diff --git a/doc/stdenv/stdenv.chapter.md b/doc/stdenv/stdenv.chapter.md
index 51330f1ec9d5..1d4ca99e3cbe 100644
--- a/doc/stdenv/stdenv.chapter.md
+++ b/doc/stdenv/stdenv.chapter.md
@@ -797,7 +797,7 @@ Hook executed at the start of the distribution phase.
 
 Hook executed at the end of the distribution phase.
 
-## Shell functions {#ssec-stdenv-functions}
+## Shell functions and utilities {#ssec-stdenv-functions}
 
 The standard environment provides a number of useful functions.
 
@@ -821,6 +821,19 @@ There’s many more kinds of arguments, they are documented in `nixpkgs/pkgs/bui
 
 Using the `makeBinaryWrapper` implementation is usually preferred, as it creates a tiny _compiled_ wrapper executable, that can be used as a shebang interpreter. This is needed mostly on Darwin, where shebangs cannot point to scripts, [due to a limitation with the `execve`-syscall](https://stackoverflow.com/questions/67100831/macos-shebang-with-absolute-path-not-working). Compiled wrappers generated by `makeBinaryWrapper` can be inspected with `less <path-to-wrapper>` - by scrolling past the binary data you should be able to see the shell command that generated the executable and there see the environment variables that were injected into the wrapper.
 
+### `remove-references-to -t` \<storepath\> [ `-t` \<storepath\> ... ] \<file\> ... {#fun-remove-references-to}
+
+Removes the references of the specified files to the specified store files. This is done without changing the size of the file by replacing the hash by `eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee`, and should work on compiled executables. This is meant to be used to remove the dependency of the output on inputs that are known to be unnecessary at runtime. Of course, reckless usage will break the patched programs.
+To use this, add `removeReferencesTo` to `nativeBuildInputs`.
+
+As `remove-references-to` is an actual executable and not a shell function, it can be used with `find`.
+Example removing all references to the compiler in the output:
+```nix
+postInstall = ''
+  find "$out" -type f -exec remove-references-to -t ${stdenv.cc} '{}' +
+'';
+```
+
 ### `substitute` \<infile\> \<outfile\> \<subs\> {#fun-substitute}
 
 Performs string substitution on the contents of \<infile\>, writing the result to \<outfile\>. The substitutions in \<subs\> are of the following form:
diff --git a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
index 31093bdbd013..7502214c86be 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
@@ -413,6 +413,15 @@
           <literal>virtualisation.docker.daemon.settings</literal>.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          Ntopng (<literal>services.ntopng</literal>) is updated to
+          5.2.1 and uses a separate Redis instance if
+          <literal>system.stateVersion</literal> is at least
+          <literal>22.05</literal>. Existing setups shouldn’t be
+          affected.
+        </para>
+      </listitem>
       <listitem>
         <para>
           The backward compatibility in
diff --git a/nixos/doc/manual/release-notes/rl-2205.section.md b/nixos/doc/manual/release-notes/rl-2205.section.md
index 258cd2fe3166..c96f898505a2 100644
--- a/nixos/doc/manual/release-notes/rl-2205.section.md
+++ b/nixos/doc/manual/release-notes/rl-2205.section.md
@@ -136,6 +136,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - If you previously used `/etc/docker/daemon.json`, you need to incorporate the changes into the new option `virtualisation.docker.daemon.settings`.
 
+- Ntopng (`services.ntopng`) is updated to 5.2.1 and uses a separate Redis instance if `system.stateVersion` is at least `22.05`. Existing setups shouldn't be affected.
+
 - The backward compatibility in `services.wordpress` to configure sites with
   the old interface has been removed. Please use `services.wordpress.sites`
   instead.
diff --git a/nixos/modules/services/backup/mysql-backup.nix b/nixos/modules/services/backup/mysql-backup.nix
index 9fca21002733..c40a0b5abc40 100644
--- a/nixos/modules/services/backup/mysql-backup.nix
+++ b/nixos/modules/services/backup/mysql-backup.nix
@@ -113,9 +113,10 @@ in
         };
       };
       services.mysql-backup = {
-        description = "Mysql backup service";
+        description = "MySQL backup service";
         enable = true;
         serviceConfig = {
+          Type = "oneshot";
           User = cfg.user;
         };
         script = backupScript;
diff --git a/nixos/modules/services/misc/mbpfan.nix b/nixos/modules/services/misc/mbpfan.nix
index d2b0f0da2ad9..e0a4d8a13e75 100644
--- a/nixos/modules/services/misc/mbpfan.nix
+++ b/nixos/modules/services/misc/mbpfan.nix
@@ -6,7 +6,7 @@ let
   cfg = config.services.mbpfan;
   verbose = if cfg.verbose then "v" else "";
   settingsFormat = pkgs.formats.ini {};
-  settingsFile = settingsFormat.generate "config.conf" cfg.settings;
+  settingsFile = settingsFormat.generate "mbpfan.ini" cfg.settings;
 
 in {
   options.services.mbpfan = {
@@ -36,29 +36,35 @@ in {
         freeformType = settingsFormat.type;
 
         options.general.min_fan1_speed = mkOption {
-          type = types.int;
+          type = types.nullOr types.int;
           default = 2000;
-          description = "The minimum fan speed.";
+          description = ''
+            The minimum fan speed. Setting to null enables automatic detection.
+            Check minimum fan limits with "cat /sys/devices/platform/applesmc.768/fan*_min".
+          '';
         };
         options.general.max_fan1_speed = mkOption {
-          type = types.int;
+          type = types.nullOr types.int;
           default = 6199;
-          description = "The maximum fan speed.";
+          description = ''
+            The maximum fan speed. Setting to null enables automatic detection.
+            Check maximum fan limits with "cat /sys/devices/platform/applesmc.768/fan*_max".
+          '';
         };
         options.general.low_temp = mkOption {
           type = types.int;
           default = 55;
-          description = "The low temperature.";
+          description = "Temperature below which fan speed will be at minimum. Try ranges 55-63.";
         };
         options.general.high_temp = mkOption {
           type = types.int;
           default = 58;
-          description = "The high temperature.";
+          description = "Fan will increase speed when higher than this temperature. Try ranges 58-66.";
         };
         options.general.max_temp = mkOption {
           type = types.int;
           default = 86;
-          description = "The maximum temperature.";
+          description = "Fan will run at full speed above this temperature. Do not set it > 90.";
         };
         options.general.polling_interval = mkOption {
           type = types.int;
diff --git a/nixos/modules/services/networking/ntopng.nix b/nixos/modules/services/networking/ntopng.nix
index 77a004e8ab3a..022fc923edaa 100644
--- a/nixos/modules/services/networking/ntopng.nix
+++ b/nixos/modules/services/networking/ntopng.nix
@@ -6,7 +6,13 @@ let
 
   cfg = config.services.ntopng;
   opt = options.services.ntopng;
-  redisCfg = config.services.redis;
+
+  createRedis = cfg.redis.createInstance != null;
+  redisService =
+    if cfg.redis.createInstance == "" then
+      "redis.service"
+    else
+      "redis-${cfg.redis.createInstance}.service";
 
   configFile = if cfg.configText != "" then
     pkgs.writeText "ntopng.conf" ''
@@ -15,8 +21,10 @@ let
     else
     pkgs.writeText "ntopng.conf" ''
       ${concatStringsSep " " (map (e: "--interface=" + e) cfg.interfaces)}
-      --http-port=${toString cfg.http-port}
-      --redis=localhost:${toString redisCfg.port}
+      --http-port=${toString cfg.httpPort}
+      --redis=${cfg.redis.address}
+      --data-dir=/var/lib/ntopng
+      --user=ntopng
       ${cfg.extraConfig}
     '';
 
@@ -24,6 +32,10 @@ in
 
 {
 
+  imports = [
+    (mkRenamedOptionModule [ "services" "ntopng" "http-port" ] [ "services" "ntopng" "httpPort" ])
+  ];
+
   options = {
 
     services.ntopng = {
@@ -56,7 +68,7 @@ in
         '';
       };
 
-      http-port = mkOption {
+      httpPort = mkOption {
         default = 3000;
         type = types.int;
         description = ''
@@ -64,6 +76,24 @@ in
         '';
       };
 
+      redis.address = mkOption {
+        type = types.str;
+        example = literalExpression "config.services.redis.ntopng.unixSocket";
+        description = ''
+          Redis address - may be a Unix socket or a network host and port.
+        '';
+      };
+
+      redis.createInstance = mkOption {
+        type = types.nullOr types.str;
+        default = if versionAtLeast config.system.stateVersion "22.05" then "ntopng" else "";
+        description = ''
+          Local Redis instance name. Set to <literal>null</literal> to disable
+          local Redis instance. Defaults to <literal>""</literal> for
+          <literal>system.stateVersion</literal> older than 22.05.
+        '';
+      };
+
       configText = mkOption {
         default = "";
         example = ''
@@ -95,23 +125,36 @@ in
   config = mkIf cfg.enable {
 
     # ntopng uses redis for data storage
-    services.redis.enable = true;
+    services.ntopng.redis.address =
+      mkIf createRedis config.services.redis.servers.${cfg.redis.createInstance}.unixSocket;
+
+    services.redis.servers = mkIf createRedis {
+      ${cfg.redis.createInstance} = {
+        enable = true;
+        user = mkIf (cfg.redis.createInstance == "ntopng") "ntopng";
+      };
+    };
 
     # nice to have manual page and ntopng command in PATH
     environment.systemPackages = [ pkgs.ntopng ];
 
+    systemd.tmpfiles.rules = [ "d /var/lib/ntopng 0700 ntopng ntopng -" ];
+
     systemd.services.ntopng = {
       description = "Ntopng Network Monitor";
-      requires = [ "redis.service" ];
-      after = [ "network.target" "redis.service" ];
+      requires = optional createRedis redisService;
+      after = [ "network.target" ] ++ optional createRedis redisService;
       wantedBy = [ "multi-user.target" ];
-      preStart = "mkdir -p /var/lib/ntopng/";
       serviceConfig.ExecStart = "${pkgs.ntopng}/bin/ntopng ${configFile}";
       unitConfig.Documentation = "man:ntopng(8)";
     };
 
-    # ntopng drops priveleges to user "nobody" and that user is already defined
-    # in users-groups.nix.
+    users.extraUsers.ntopng = {
+      group = "ntopng";
+      isSystemUser = true;
+    };
+
+    users.extraGroups.ntopng = { };
   };
 
 }
diff --git a/nixos/modules/services/web-apps/mastodon.nix b/nixos/modules/services/web-apps/mastodon.nix
index 1e3c7e53c175..8208c85bfd70 100644
--- a/nixos/modules/services/web-apps/mastodon.nix
+++ b/nixos/modules/services/web-apps/mastodon.nix
@@ -92,6 +92,7 @@ let
 
   mastodonEnv = pkgs.writeShellScriptBin "mastodon-env" ''
     set -a
+    export RAILS_ROOT="${cfg.package}"
     source "${envFile}"
     source /var/lib/mastodon/.secrets_env
     eval -- "\$@"
diff --git a/nixos/tests/doh-proxy-rust.nix b/nixos/tests/doh-proxy-rust.nix
index 23f8616849c3..11ed87d23bbe 100644
--- a/nixos/tests/doh-proxy-rust.nix
+++ b/nixos/tests/doh-proxy-rust.nix
@@ -38,6 +38,6 @@ import ./make-test-python.nix ({ lib, pkgs, ... }: {
     machine.wait_for_unit("doh-proxy-rust.service")
     machine.wait_for_open_port(53)
     machine.wait_for_open_port(3000)
-    machine.succeed(f"curl --fail '{url}?dns={query}' | grep -F {bin_ip}")
+    machine.succeed(f"curl --fail -H 'Accept: application/dns-message' '{url}?dns={query}' | grep -F {bin_ip}")
   '';
 })
diff --git a/pkgs/applications/graphics/openscad/default.nix b/pkgs/applications/graphics/openscad/default.nix
index be079b6bdb20..413e16718216 100644
--- a/pkgs/applications/graphics/openscad/default.nix
+++ b/pkgs/applications/graphics/openscad/default.nix
@@ -57,8 +57,7 @@ mkDerivation rec {
       "SPNAV_LIBPATH=${libspnav}/lib"
     ];
 
-  # src/lexer.l:36:10: fatal error: parser.hxx: No such file or directory
-  enableParallelBuilding = false; # true by default due to qmake
+  enableParallelBuilding = true;
 
   postInstall = lib.optionalString stdenv.isDarwin ''
     mkdir $out/Applications
diff --git a/pkgs/applications/graphics/renderdoc/default.nix b/pkgs/applications/graphics/renderdoc/default.nix
index 30731afebfe7..e44c49ac6bb8 100644
--- a/pkgs/applications/graphics/renderdoc/default.nix
+++ b/pkgs/applications/graphics/renderdoc/default.nix
@@ -32,13 +32,13 @@ let
 in
 mkDerivation rec {
   pname = "renderdoc";
-  version = "1.17";
+  version = "1.18";
 
   src = fetchFromGitHub {
     owner = "baldurk";
     repo = "renderdoc";
     rev = "v${version}";
-    sha256 = "sha256-Zr7Av49mK48B4N+Ca2vPIgKuVNP4YLVEs4EQepukSs8=";
+    sha256 = "sha256-nwERwdNQYY1Fd7llwZHrJBzWDJNdsySRQ3ZvXZjB7YY=";
   };
 
   buildInputs = [
diff --git a/pkgs/applications/misc/cpu-x/default.nix b/pkgs/applications/misc/cpu-x/default.nix
index 8f68a512c211..9d64a31dded9 100644
--- a/pkgs/applications/misc/cpu-x/default.nix
+++ b/pkgs/applications/misc/cpu-x/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cpu-x";
-  version = "4.2.0";
+  version = "4.3.0";
 
   src = fetchFromGitHub {
     owner = "X0rg";
     repo = "CPU-X";
     rev = "v${version}";
-    sha256 = "sha256-LWIcE86o+uU8G9DtumiH6iTqHhvq4y/QyQX7J3FhKEc=";
+    sha256 = "sha256-pYinePs7WFVfRMNYTY+Is8B+cv5w6IF7Ce+9v/mLRYg=";
   };
 
   nativeBuildInputs = [ cmake pkg-config wrapGAppsHook nasm makeWrapper ];
diff --git a/pkgs/applications/misc/cubocore-packages/coreaction/default.nix b/pkgs/applications/misc/cubocore-packages/coreaction/default.nix
index f17730cc7e95..a3a8c1dcf6cf 100644
--- a/pkgs/applications/misc/cubocore-packages/coreaction/default.nix
+++ b/pkgs/applications/misc/cubocore-packages/coreaction/default.nix
@@ -1,24 +1,16 @@
-{ mkDerivation, lib, fetchFromGitLab, fetchpatch, qtsvg, qtbase, cmake, ninja, libcprime, libcsys }:
+{ mkDerivation, lib, fetchFromGitLab, qtsvg, qtbase, cmake, ninja, libcprime, libcsys }:
 
 mkDerivation rec {
   pname = "coreaction";
-  version = "4.2.0";
+  version = "4.3.0";
 
   src = fetchFromGitLab {
     owner = "cubocore/coreapps";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-5qEZNLvbgLoAOXij0wXoVw2iyvytsYZikSJDm6F6ddc=";
+    sha256 = "sha256-XQ/GcSjGSe+3d0dJxjmmcBFoDzrmM6zsHMfbDdzmpPs=";
   };
 
-  patches = [
-    ## Fix Plugin Error: "The shared library was not found." "libbatery.so"
-    (fetchpatch {
-      url = "https://gitlab.com/cubocore/coreapps/coreaction/-/commit/1d1307363614a117978723eaad2332e6e8c05b28.patch";
-      sha256 = "039x19rsm23l9vxd5mnbl6gvc3is0igahf47kv54v6apz2q72l3f";
-    })
-  ];
-
   nativeBuildInputs = [
     cmake
     ninja
diff --git a/pkgs/applications/misc/cubocore-packages/corearchiver/default.nix b/pkgs/applications/misc/cubocore-packages/corearchiver/default.nix
index 56a05bc434ec..7549ef20b112 100644
--- a/pkgs/applications/misc/cubocore-packages/corearchiver/default.nix
+++ b/pkgs/applications/misc/cubocore-packages/corearchiver/default.nix
@@ -2,13 +2,13 @@
 
 mkDerivation rec {
   pname = "corearchiver";
-  version = "4.2.0";
+  version = "4.3.0";
 
   src = fetchFromGitLab {
     owner = "cubocore/coreapps";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-FJGsQp1lbsrvlzKPiTv/FC9RH2+JRwwIvkLDTFW8t5s=";
+    sha256 = "sha256-EUcUivUuuUApIC9daS6BFA1YoE4yO3Kc8jG0VIks/Y0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/cubocore-packages/corefm/default.nix b/pkgs/applications/misc/cubocore-packages/corefm/default.nix
index 3ec918db7af9..a3314dface43 100644
--- a/pkgs/applications/misc/cubocore-packages/corefm/default.nix
+++ b/pkgs/applications/misc/cubocore-packages/corefm/default.nix
@@ -2,13 +2,13 @@
 
 mkDerivation rec {
   pname = "corefm";
-  version = "4.2.0";
+  version = "4.3.0";
 
   src = fetchFromGitLab {
     owner = "cubocore/coreapps";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-PczKIKY9uCD+cAzAC6Gkb+g+cn9KKCQYd3epoZK8bvA=";
+    sha256 = "sha256-uScM6cVRwYopZ6NY3PSAAyxNNyX3hVnFs6hkAyF29PA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/cubocore-packages/coregarage/default.nix b/pkgs/applications/misc/cubocore-packages/coregarage/default.nix
index 719047c8de7b..f416f21c419a 100644
--- a/pkgs/applications/misc/cubocore-packages/coregarage/default.nix
+++ b/pkgs/applications/misc/cubocore-packages/coregarage/default.nix
@@ -2,13 +2,13 @@
 
 mkDerivation rec {
   pname = "coregarage";
-  version = "4.2.0";
+  version = "4.3.0";
 
   src = fetchFromGitLab {
     owner = "cubocore/coreapps";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-2pOQwSj+QKwpHVJp7VCyq6QpVW5wLUf/BE7ReXrJ78s=";
+    sha256 = "sha256-Jq0lIXfw/1Ixd+QIY7D1ErBCOSKmwkWBupcDxUUEliM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/cubocore-packages/corehunt/default.nix b/pkgs/applications/misc/cubocore-packages/corehunt/default.nix
index fb9bcd5e8ef4..7da5ebe081fd 100644
--- a/pkgs/applications/misc/cubocore-packages/corehunt/default.nix
+++ b/pkgs/applications/misc/cubocore-packages/corehunt/default.nix
@@ -2,13 +2,13 @@
 
 mkDerivation rec {
   pname = "corehunt";
-  version = "4.2.0";
+  version = "4.3.0";
 
   src = fetchFromGitLab {
     owner = "cubocore/coreapps";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-KnIqLI8MtLirFycW2YNHAjS7EDfU3dpqb6vVq9Tl6Ow=";
+    sha256 = "sha256-zhJadrdOXpl0bXxEPWjQ59Pzjg4MfIZXtYzCnJbh+pI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/cubocore-packages/coreimage/default.nix b/pkgs/applications/misc/cubocore-packages/coreimage/default.nix
index 224c946d1175..6078d04be7a7 100644
--- a/pkgs/applications/misc/cubocore-packages/coreimage/default.nix
+++ b/pkgs/applications/misc/cubocore-packages/coreimage/default.nix
@@ -2,13 +2,13 @@
 
 mkDerivation rec {
   pname = "coreimage";
-  version = "4.2.0";
+  version = "4.3.0";
 
   src = fetchFromGitLab {
     owner = "cubocore/coreapps";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-dxRHzSG5ea1MhpTjgZbFztV9mElEaeOK4NsmieSgf5Q";
+    sha256 = "sha256-uG9/8sQK0G3f7O59OHEHqNHP8cUC73hmjsfpOnj0kFM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/cubocore-packages/coreinfo/default.nix b/pkgs/applications/misc/cubocore-packages/coreinfo/default.nix
index d8df86abd870..c5f7e49d4521 100644
--- a/pkgs/applications/misc/cubocore-packages/coreinfo/default.nix
+++ b/pkgs/applications/misc/cubocore-packages/coreinfo/default.nix
@@ -2,13 +2,13 @@
 
 mkDerivation rec {
   pname = "coreinfo";
-  version = "4.2.0";
+  version = "4.3.0";
 
   src = fetchFromGitLab {
     owner = "cubocore/coreapps";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-kLBOvvulHE1+4TyZVEVZwEA+Id7+w8fI3ll+QL2ukr0=";
+    sha256 = "sha256-KoX2U07giVF2xZR1diM6teiNfKYRiqjowTJgnsMlaN0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/cubocore-packages/corekeyboard/0001-fix-installPhase.patch b/pkgs/applications/misc/cubocore-packages/corekeyboard/0001-fix-installPhase.patch
new file mode 100644
index 000000000000..084a650c610e
--- /dev/null
+++ b/pkgs/applications/misc/cubocore-packages/corekeyboard/0001-fix-installPhase.patch
@@ -0,0 +1,8 @@
+--- a/corekeyboard/CMakeLists.txt	2022-01-29 14:03:28.149607341 +0700
++++ b/CMakeLists.txt	2022-01-29 14:04:00.178733700 +0700
+@@ -55,5 +55,4 @@
+ 
+ install( TARGETS corekeyboard DESTINATION bin )
+ install( FILES org.cubocore.CoreKeyboard.desktop DESTINATION share/applications )
+-install( FILES org.cubocore.CoreKeyboard-Tray.desktop DESTINATION /etc/xdg/autostart )
+ install( FILES org.cubocore.CoreKeyboard.svg DESTINATION share/icons/hicolor/scalable/apps/ )
diff --git a/pkgs/applications/misc/cubocore-packages/corekeyboard/default.nix b/pkgs/applications/misc/cubocore-packages/corekeyboard/default.nix
index 3d4e6ddc3010..5116f80f4cb2 100644
--- a/pkgs/applications/misc/cubocore-packages/corekeyboard/default.nix
+++ b/pkgs/applications/misc/cubocore-packages/corekeyboard/default.nix
@@ -2,15 +2,20 @@
 
 mkDerivation rec {
   pname = "corekeyboard";
-  version = "4.2.0";
+  version = "4.3.0";
 
   src = fetchFromGitLab {
     owner = "cubocore/coreapps";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-0CbQ43BN4ORvtxs6FwNkgk/0jcVdFJq/tqvjUGYanM4=";
+    sha256 = "sha256-yJOcuE6HknDhXCr1qW/NJkerjvBABYntXos0owDDwcw=";
   };
 
+  patches = [
+    # Remove autostart
+    ./0001-fix-installPhase.patch
+  ];
+
   nativeBuildInputs = [
     cmake
     ninja
diff --git a/pkgs/applications/misc/cubocore-packages/corepad/default.nix b/pkgs/applications/misc/cubocore-packages/corepad/default.nix
index fcd1bfa4a4ff..bdded6e8f1fe 100644
--- a/pkgs/applications/misc/cubocore-packages/corepad/default.nix
+++ b/pkgs/applications/misc/cubocore-packages/corepad/default.nix
@@ -2,13 +2,13 @@
 
 mkDerivation rec {
   pname = "corepad";
-  version = "4.2.0";
+  version = "4.3.0";
 
   src = fetchFromGitLab {
     owner = "cubocore/coreapps";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-2bGHVv0+0NlkIqnvWm014Kr20uARWnOS5xSuNmCt/bQ=";
+    sha256 = "sha256-19qR08QhWeeXnJAQHe1SJjT0xnQLlbkXlzmd9uiMp14=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/cubocore-packages/corepaint/default.nix b/pkgs/applications/misc/cubocore-packages/corepaint/default.nix
index 6410da3ba607..228b0175a7d2 100644
--- a/pkgs/applications/misc/cubocore-packages/corepaint/default.nix
+++ b/pkgs/applications/misc/cubocore-packages/corepaint/default.nix
@@ -2,13 +2,13 @@
 
 mkDerivation rec {
   pname = "corepaint";
-  version = "4.2.0";
+  version = "4.3.0";
 
   src = fetchFromGitLab {
     owner = "cubocore/coreapps";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-nATraYm7FZEXoNWgXt1G86KdrAvRgM358F+YdfWcnkg=";
+    sha256 = "sha256-uAFV3NKtgNri8GQLD+MRacl9WYMfkMVZcoVML+oSX78=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/cubocore-packages/corepdf/default.nix b/pkgs/applications/misc/cubocore-packages/corepdf/default.nix
index bb93391c2af8..42f8fd0dd0fd 100644
--- a/pkgs/applications/misc/cubocore-packages/corepdf/default.nix
+++ b/pkgs/applications/misc/cubocore-packages/corepdf/default.nix
@@ -1,14 +1,14 @@
-{ mkDerivation, lib, fetchFromGitLab, qtbase, poppler, cmake, ninja, libcprime, libcsys }:
+{ mkDerivation, lib, fetchFromGitLab, qtbase, poppler, qtwebengine, cmake, ninja, libcprime, libcsys }:
 
 mkDerivation rec {
   pname = "corepdf";
-  version = "4.2.0";
+  version = "4.3.0";
 
   src = fetchFromGitLab {
     owner = "cubocore/coreapps";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-HeOklgCwJ5h3DeelJOZqasG+eC9DGG3R0Cqg2yPKYhM=";
+    sha256 = "sha256-VwJ3H/jNP3u5C+LATPUSftiWm89upx77fN3NqzTnU7Y=";
   };
 
   nativeBuildInputs = [
@@ -19,6 +19,7 @@ mkDerivation rec {
   buildInputs = [
     qtbase
     poppler
+    qtwebengine
     libcprime
     libcsys
   ];
diff --git a/pkgs/applications/misc/cubocore-packages/corepins/default.nix b/pkgs/applications/misc/cubocore-packages/corepins/default.nix
index 80d3a096ffe6..7b5ba0ad7a60 100644
--- a/pkgs/applications/misc/cubocore-packages/corepins/default.nix
+++ b/pkgs/applications/misc/cubocore-packages/corepins/default.nix
@@ -2,13 +2,13 @@
 
 mkDerivation rec {
   pname = "corepins";
-  version = "4.2.0";
+  version = "4.3.0";
 
   src = fetchFromGitLab {
     owner = "cubocore/coreapps";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-H/l/MHHrTmkfznVKUHFAhim8b/arT5SNK5fxTvjsTE4=";
+    sha256 = "sha256-CVToPF8/Tw+n31/A0bzyBbwF7xPBVirsqVOUsM8QtH0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/cubocore-packages/corerenamer/default.nix b/pkgs/applications/misc/cubocore-packages/corerenamer/default.nix
index f92d532ba4a5..e13485619d9a 100644
--- a/pkgs/applications/misc/cubocore-packages/corerenamer/default.nix
+++ b/pkgs/applications/misc/cubocore-packages/corerenamer/default.nix
@@ -2,13 +2,13 @@
 
 mkDerivation rec {
   pname = "corerenamer";
-  version = "4.2.0";
+  version = "4.3.0";
 
   src = fetchFromGitLab {
     owner = "cubocore/coreapps";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-OI7M7vV0CA42J5cWCqgGKEzUUHSgIJCWRTXmKRD6Jb0=";
+    sha256 = "sha256-WrMyz8Noq0EeBIxL4mSl6e+8wrivmwfoa1yKBrSgrRI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/cubocore-packages/coreshot/default.nix b/pkgs/applications/misc/cubocore-packages/coreshot/default.nix
index bf9f5e49aea6..18d773e904bf 100644
--- a/pkgs/applications/misc/cubocore-packages/coreshot/default.nix
+++ b/pkgs/applications/misc/cubocore-packages/coreshot/default.nix
@@ -2,13 +2,13 @@
 
 mkDerivation rec {
   pname = "coreshot";
-  version = "4.2.0";
+  version = "4.3.0";
 
   src = fetchFromGitLab {
     owner = "cubocore/coreapps";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-HKgGeuM3CKGXwnFwSw6a0AB0klZKY5YS9C4q2UT6TN8=";
+    sha256 = "sha256-wEpo/YINtKAYHqlGYytUPh9ndkvQBw3tRIlyjnKJaf8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/cubocore-packages/corestats/default.nix b/pkgs/applications/misc/cubocore-packages/corestats/default.nix
index a6d71eaa6cb6..ac3f7280aa76 100644
--- a/pkgs/applications/misc/cubocore-packages/corestats/default.nix
+++ b/pkgs/applications/misc/cubocore-packages/corestats/default.nix
@@ -2,13 +2,13 @@
 
 mkDerivation rec {
   pname = "corestats";
-  version = "4.2.0";
+  version = "4.3.0";
 
   src = fetchFromGitLab {
     owner = "cubocore/coreapps";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-/WBetvbd8e4v+j6e2xbGtSLwNMdLlaahSIks6r889B4=";
+    sha256 = "sha256-154BZIKb6QDrTC4DXh4dbFtN/Lq0ok/qOrqTkXa+rAo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/cubocore-packages/corestuff/0001-fix-installPhase.patch b/pkgs/applications/misc/cubocore-packages/corestuff/0001-fix-installPhase.patch
new file mode 100644
index 000000000000..d1db6a0a0a2e
--- /dev/null
+++ b/pkgs/applications/misc/cubocore-packages/corestuff/0001-fix-installPhase.patch
@@ -0,0 +1,11 @@
+--- a/corestuff/CMakeLists.txt	2022-01-29 14:09:02.699700817 +0700
++++ b/CMakeLists.txt	2022-01-29 14:09:23.211754633 +0700
+@@ -120,8 +120,3 @@
+ install( FILES org.cubocore.CoreStuff.desktop DESTINATION share/applications )
+ install( FILES org.cubocore.CoreStuff.svg DESTINATION share/icons/hicolor/scalable/apps/ )
+ install( FILES background/default.svg DESTINATION share/coreapps/background )
+-
+-if ( DEFINED ADD_AUTOSTART )
+-	message("INSTALLING TO AUTOSTART LOCATION")
+-	install( FILES org.cubocore.CoreStuff.desktop DESTINATION /etc/xdg/autostart )
+-endif()
diff --git a/pkgs/applications/misc/cubocore-packages/corestuff/default.nix b/pkgs/applications/misc/cubocore-packages/corestuff/default.nix
index 57216f4710da..04c6d82d4b27 100644
--- a/pkgs/applications/misc/cubocore-packages/corestuff/default.nix
+++ b/pkgs/applications/misc/cubocore-packages/corestuff/default.nix
@@ -2,15 +2,20 @@
 
 mkDerivation rec {
   pname = "corestuff";
-  version = "4.2.0";
+  version = "4.3.0";
 
   src = fetchFromGitLab {
     owner = "cubocore/coreapps";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-/mmCIHZXn/Jpjr37neI6owWuU1VO6o7wmRj6ZH8tUbo=";
+    sha256 = "sha256-snzW6cqxIyiXJLOD5MoEqmzen1aZN4IALESaIWIOMro=";
   };
 
+  patches = [
+    # Remove autostart
+    ./0001-fix-installPhase.patch
+  ];
+
   nativeBuildInputs = [
     cmake
     ninja
diff --git a/pkgs/applications/misc/cubocore-packages/coreterminal/default.nix b/pkgs/applications/misc/cubocore-packages/coreterminal/default.nix
index c2085686aab8..1203706a62e6 100644
--- a/pkgs/applications/misc/cubocore-packages/coreterminal/default.nix
+++ b/pkgs/applications/misc/cubocore-packages/coreterminal/default.nix
@@ -12,13 +12,13 @@
 
 mkDerivation rec {
   pname = "coreterminal";
-  version = "4.2.0";
+  version = "4.3.0";
 
   src = fetchFromGitLab {
     owner = "cubocore/coreapps";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-YXs6VTem3AaK4n1DYwKP/jqNuf09Srn2THHyJJnArlc=";
+    sha256 = "sha256-0gxcbfDD43BnkxYWSdViK3hjzfgPGFruwzF4hCxFZ7c=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/cubocore-packages/coretime/default.nix b/pkgs/applications/misc/cubocore-packages/coretime/default.nix
index af33d474e350..41fe2698e4eb 100644
--- a/pkgs/applications/misc/cubocore-packages/coretime/default.nix
+++ b/pkgs/applications/misc/cubocore-packages/coretime/default.nix
@@ -2,13 +2,13 @@
 
 mkDerivation rec {
   pname = "coretime";
-  version = "4.2.0";
+  version = "4.3.0";
 
   src = fetchFromGitLab {
     owner = "cubocore/coreapps";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-b7oqHhsuHsy96IAXPUtw+WqneEHgn/nUDgHiJt2aXXM=";
+    sha256 = "sha256-MIcmgBfgyjEyJxXCq6IbQ/i6IdtL5cWVGpV2YZbzK58=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/cubocore-packages/coretoppings/0001-fix-install-phase.patch b/pkgs/applications/misc/cubocore-packages/coretoppings/0001-fix-install-phase.patch
index 8a8b0ae40109..3c0c942ee43a 100644
--- a/pkgs/applications/misc/cubocore-packages/coretoppings/0001-fix-install-phase.patch
+++ b/pkgs/applications/misc/cubocore-packages/coretoppings/0001-fix-install-phase.patch
@@ -1,8 +1,8 @@
---- a/corepkit/CMakeLists.txt
-+++ b/corepkit/Cmakelists.txt
+--- a/corepkit/CMakeLists.txt	2021-12-25 17:52:20.000000000 +0700
++++ b/corepkit/CMakeLists.txt	2021-12-29 17:58:09.298024297 +0700
 @@ -32,4 +32,4 @@
  target_link_libraries( corepkit  Qt5::Core )
  
  install( TARGETS corepkit DESTINATION libexec/coreapps/ )
--install( FILES org.cubocore.coreapps.policy DESTINATION /usr/share/polkit-1/actions/ )
+-install( FILES org.cubocore.coreapps.policy DESTINATION share/polkit-1/actions/ )
 +install( FILES org.cubocore.coreapps.policy DESTINATION ${CMAKE_INSTALL_PREFIX}/usr/share/polkit-1/actions/ )
diff --git a/pkgs/applications/misc/cubocore-packages/coretoppings/default.nix b/pkgs/applications/misc/cubocore-packages/coretoppings/default.nix
index 154f4a389948..b72008cd43ad 100644
--- a/pkgs/applications/misc/cubocore-packages/coretoppings/default.nix
+++ b/pkgs/applications/misc/cubocore-packages/coretoppings/default.nix
@@ -30,13 +30,13 @@
 
 mkDerivation rec {
   pname = "coretoppings";
-  version = "4.2.0";
+  version = "4.3.0";
 
   src = fetchFromGitLab {
     owner = "cubocore/coreapps";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-DpmzGqjW1swLirRLzd5nblAb40LHAmf8nL+VykQNL3E=";
+    sha256 = "sha256-Yq57dY1zIuQN2Gj9haxJMomafL32B+/9v3lWlY9fvcc=";
   };
 
   patches = [
diff --git a/pkgs/applications/misc/cubocore-packages/coreuniverse/default.nix b/pkgs/applications/misc/cubocore-packages/coreuniverse/default.nix
index 0a6ccaf72142..5e72458dad45 100644
--- a/pkgs/applications/misc/cubocore-packages/coreuniverse/default.nix
+++ b/pkgs/applications/misc/cubocore-packages/coreuniverse/default.nix
@@ -2,13 +2,13 @@
 
 mkDerivation rec {
   pname = "coreuniverse";
-  version = "4.2.0";
+  version = "4.3.0";
 
   src = fetchFromGitLab {
     owner = "cubocore/coreapps";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-YZCMyYMAvd/xQYNUnURIvmQwaM+X+Ql93OS4ZIyAZLY=";
+    sha256 = "sha256-KNjXrsm4OfBxida8mcAlKgomcpg0xJg51ZxEdhaiL84=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/cubocore-packages/libcprime/default.nix b/pkgs/applications/misc/cubocore-packages/libcprime/default.nix
index 00e297bf276a..f100a3a10403 100644
--- a/pkgs/applications/misc/cubocore-packages/libcprime/default.nix
+++ b/pkgs/applications/misc/cubocore-packages/libcprime/default.nix
@@ -10,13 +10,13 @@
 
 mkDerivation rec {
   pname = "libcprime";
-  version = "4.2.2";
+  version = "4.3.0";
 
   src = fetchFromGitLab {
     owner = "cubocore";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-RywvFATA/+fDP/TR5QRWaJlDgy3EID//iVmrJcj3GXI=";
+    sha256 = "sha256-+z5dXKaV2anN6OLMycEz87kDqQScgHHEKwGhDAdHSd4=";
   };
 
   patches = [
diff --git a/pkgs/applications/misc/cubocore-packages/libcsys/default.nix b/pkgs/applications/misc/cubocore-packages/libcsys/default.nix
index d1dde9942e92..395a40ddfc66 100644
--- a/pkgs/applications/misc/cubocore-packages/libcsys/default.nix
+++ b/pkgs/applications/misc/cubocore-packages/libcsys/default.nix
@@ -2,13 +2,13 @@
 
 mkDerivation rec {
   pname = "libcsys";
-  version = "4.2.0";
+  version = "4.3.0";
 
   src = fetchFromGitLab {
     owner = "cubocore";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-9LH95uJJIn4FHfnikGi5UCI6nUNW+1cSZnJ/KpZDI5Y=";
+    sha256 = "sha256-/iRFppe08+rMQNFjWSyxo3Noy0iNaelg0JAczg/BYBs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/moolticute/default.nix b/pkgs/applications/misc/moolticute/default.nix
index 11f6e7bbc048..7097f584f54a 100644
--- a/pkgs/applications/misc/moolticute/default.nix
+++ b/pkgs/applications/misc/moolticute/default.nix
@@ -28,14 +28,14 @@ mkDerivation rec {
 
   preInstall = ''
     mkdir -p $udev/lib/udev/rules.d
-    sed -n '/^ \+cat > "$tmpfile" <<- EOF$/,/^EOF$/p' ../data/moolticute.sh |
+    sed -n '/^UDEV_RULE=="\$(cat <<-EOF$/,/^EOF$/p' ../data/moolticute.sh |
         sed '1d;$d' > $udev/lib/udev/rules.d/50-mooltipass.rules
  '';
 
   meta = with lib; {
     description = "GUI app and daemon to work with Mooltipass device via USB";
     longDescription = ''
-      To install udev rules, add `services.udev.packages == [ moolticute.udev ]`
+      To install udev rules, add `services.udev.packages = [ pkgs.moolticute.udev ]`
       into `nixos/configuration.nix`.
     '';
     homepage = "https://github.com/mooltipass/moolticute";
diff --git a/pkgs/applications/misc/spicetify-cli/default.nix b/pkgs/applications/misc/spicetify-cli/default.nix
index a3aafaf4ef0c..7617984ac910 100644
--- a/pkgs/applications/misc/spicetify-cli/default.nix
+++ b/pkgs/applications/misc/spicetify-cli/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "spicetify-cli";
-  version = "2.9.0";
+  version = "2.9.1";
 
   src = fetchFromGitHub {
     owner = "khanhas";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-PHKmrLN/JVPqefcK1FQByPWvMzNxHG5htXzgZ1D+Eds=";
+    sha256 = "sha256-Rs70LmJ/+pbISQpPuEYV2URFv7uf+jdTVQopUSKExSY=";
   };
 
   vendorSha256 = "sha256-g0RYIVIq4oMXdRZDBDnVYg7ombN5WEo/6O9hChQvOYs=";
diff --git a/pkgs/applications/misc/surface-control/default.nix b/pkgs/applications/misc/surface-control/default.nix
index e4b354845dde..d8708c5a3df1 100644
--- a/pkgs/applications/misc/surface-control/default.nix
+++ b/pkgs/applications/misc/surface-control/default.nix
@@ -1,19 +1,20 @@
-{ lib, rustPlatform, fetchFromGitHub, installShellFiles, coreutils }:
+{ lib, rustPlatform, fetchFromGitHub, pkg-config, installShellFiles, udev, coreutils }:
 
 rustPlatform.buildRustPackage rec {
   pname = "surface-control";
-  version = "0.3.1-2";
+  version = "0.4.1-2";
 
   src = fetchFromGitHub {
     owner = "linux-surface";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-SLJ4mwBafLGL5pneMTHLc4S4Tgds2xLqByWFH95TK1k=";
+    sha256 = "sha256-ZgtEmjk1HwoKkyuOiMWalK5RPb3ML8HM/wwz8OM9HoI=";
   };
 
-  cargoSha256 = "sha256-NH33AMuwf4bOF9zZJlONVMYgrrYSBq5VQClYW/rbzsM=";
+  cargoSha256 = "sha256-CsPyY/NA2+Lecemuor2nHd6yzf2PvMK7NZyvY3vewpI=";
 
-  nativeBuildInputs = [ installShellFiles ];
+  nativeBuildInputs = [ pkg-config installShellFiles ];
+  buildInputs = [ udev ];
 
   postInstall = ''
     installShellCompletion \
diff --git a/pkgs/applications/networking/cluster/istioctl/default.nix b/pkgs/applications/networking/cluster/istioctl/default.nix
index 02ed9b96f546..3d36a3210184 100644
--- a/pkgs/applications/networking/cluster/istioctl/default.nix
+++ b/pkgs/applications/networking/cluster/istioctl/default.nix
@@ -2,15 +2,15 @@
 
 buildGoModule rec {
   pname = "istioctl";
-  version = "1.12.2";
+  version = "1.13.0";
 
   src = fetchFromGitHub {
     owner = "istio";
     repo = "istio";
     rev = version;
-    sha256 = "sha256-6eVFyGVvOUr5RA5jeavKcLJedv4jOGXAg3aa4N3cNx8=";
+    sha256 = "sha256-f0e2jdiIMfakG97LqJCP5Jk41D93a6wxaChN7WwY5oA=";
   };
-  vendorSha256 = "sha256-ie7XRu+2+NmhMNtJEL2OgZH6wuTPJX9O2+cZBnI04JA=";
+  vendorSha256 = "sha256-gukwJp+qLbNJlBL5SemrVD6mExPnX0+19tbw/b4SJ8s=";
 
   doCheck = false;
 
diff --git a/pkgs/applications/networking/cluster/kubeone/default.nix b/pkgs/applications/networking/cluster/kubeone/default.nix
index 2b9ca9df0494..e08a3b46d156 100644
--- a/pkgs/applications/networking/cluster/kubeone/default.nix
+++ b/pkgs/applications/networking/cluster/kubeone/default.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "kubeone";
-  version = "1.3.3";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "kubermatic";
     repo = "kubeone";
     rev = "v${version}";
-    sha256 = "sha256-IgV1ULxwL17ECsm7MdRfQERcEVy9cEft2L7fHP3XCKo=";
+    sha256 = "sha256-uij5daVHKIfxx+8UTmU/HKSbf/RTRFuO8mCQdsC80qI=";
   };
 
-  vendorSha256 = "sha256-/rhV7JHuqejCTizcjKIkaJlbRcx7AfMcGqQYo6dlg48=";
+  vendorSha256 = "sha256-kI5i1us3Ooh603HOz9Y+HlfPUy/1J8z89/jvKEenpLw=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/applications/networking/instant-messengers/fluffychat/default.nix b/pkgs/applications/networking/instant-messengers/fluffychat/default.nix
new file mode 100644
index 000000000000..e567f18fe7b1
--- /dev/null
+++ b/pkgs/applications/networking/instant-messengers/fluffychat/default.nix
@@ -0,0 +1,31 @@
+{ lib
+, fetchFromGitLab
+, flutter
+, olm
+}:
+
+flutter.mkFlutterApp rec {
+  pname = "fluffychat";
+  version = "1.2.0";
+
+  vendorHash = "sha256-Qg0IlajbIl8e3BkKgn4O+mbZGvhfqr7XwllBLJQAA/I=";
+
+  src = fetchFromGitLab {
+    owner = "famedly";
+    repo = "fluffychat";
+    rev = "v${version}";
+    hash = "sha256-PJH3jMQc6u9R6Snn+9rNN8t+8kt6l3Xt7zKPbpqj13E=";
+  };
+
+  buildInputs = [
+    olm
+  ];
+
+  meta = with lib; {
+    description = "Chat with your friends (matrix client)";
+    homepage = "https://fluffychat.im/";
+    license = licenses.agpl3Plus;
+    maintainers = with maintainers; [ mkg20001 ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/applications/networking/instant-messengers/jami/default.nix b/pkgs/applications/networking/instant-messengers/jami/default.nix
index 5be6e0211788..3e0ba8bb5e8f 100644
--- a/pkgs/applications/networking/instant-messengers/jami/default.nix
+++ b/pkgs/applications/networking/instant-messengers/jami/default.nix
@@ -8,11 +8,11 @@
 }:
 
 rec {
-  version = "20211213.2.37be4c3";
+  version = "20211223.2.37be4c3";
 
   src = fetchzip {
     url = "https://dl.jami.net/release/tarballs/jami_${version}.tar.gz";
-    sha256 = "08abswvxwsxh6b0smb4l4cmymsbfiy7473b2sgvghj55w603prsc";
+    sha256 = "1zw9azwmxr4991nq5kl527lbwlj7psrissgvrkl1kxxbfbdncbhh";
 
     stripRoot = false;
     extraPostFetch = ''
diff --git a/pkgs/applications/office/qownnotes/default.nix b/pkgs/applications/office/qownnotes/default.nix
index 58fa569bdf00..20449b1911ff 100644
--- a/pkgs/applications/office/qownnotes/default.nix
+++ b/pkgs/applications/office/qownnotes/default.nix
@@ -5,13 +5,13 @@
 
 mkDerivation rec {
   pname = "qownnotes";
-  version = "22.2.4";
+  version = "22.2.7";
 
   src = fetchurl {
     url = "https://download.tuxfamily.org/${pname}/src/${pname}-${version}.tar.xz";
     # Fetch the checksum of current version with curl:
     # curl https://download.tuxfamily.org/qownnotes/src/qownnotes-<version>.tar.xz.sha256
-    sha256 = "d4edaa353039beacab7c324496a165919709814be60d9d7536f9118aab1e4f7e";
+    sha256 = "f7c97f3dc3435ecdc740131548aacd390332c8b97c4e6fee98a3e80985786533";
   };
 
   nativeBuildInputs = [ qmake qttools ];
diff --git a/pkgs/applications/science/misc/simgrid/default.nix b/pkgs/applications/science/misc/simgrid/default.nix
index 002c383dcaf6..888419fbc86f 100644
--- a/pkgs/applications/science/misc/simgrid/default.nix
+++ b/pkgs/applications/science/misc/simgrid/default.nix
@@ -1,13 +1,14 @@
-{ lib, stdenv, fetchFromGitLab, fetchpatch, cmake, perl, python3, boost, valgrind
-# Optional requirements
-# Lua 5.3 needed and not available now
-#, luaSupport ? false, lua5
+{ stdenv, lib, fetchFromGitLab, cmake, perl, python3, boost
 , fortranSupport ? false, gfortran
 , buildDocumentation ? false, fig2dev, ghostscript, doxygen
 , buildJavaBindings ? false, openjdk
+, buildPythonBindings ? true, python3Packages
 , modelCheckingSupport ? false, libunwind, libevent, elfutils # Inside elfutils: libelf and libdw
+, minimalBindings ? false
 , debug ? false
+, optimize ? (!debug)
 , moreTests ? false
+, withoutBin ? false
 }:
 
 with lib;
@@ -18,54 +19,35 @@ in
 
 stdenv.mkDerivation rec {
   pname = "simgrid";
-  version = "3.28";
+  version = "3.30";
 
   src = fetchFromGitLab {
     domain = "framagit.org";
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "0vylwgd4i89bvhbgfay0wq953324dwfmmr8jp9b4vvlc9m0017r9";
+    sha256 = "1dg8ywqif20g0fs8dnd6364n080nvwx7f444zcfwqwz6iax61qv1";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "fix-smpi-dirs-absolute.patch";
-      url = "https://framagit.org/simgrid/simgrid/-/commit/71f01e667577be1076646eb841e0a57bd5388545.patch";
-      sha256 = "0x3y324b6269687zfy43ilc48bwrs4nb7svh2mpg88lrz53rky15";
-    })
-  ];
-
   propagatedBuildInputs = [ boost ];
-  nativeBuildInputs = [ cmake perl python3 valgrind ]
-      ++ optionals fortranSupport [ gfortran ]
-      ++ optionals buildJavaBindings [ openjdk ]
-      ++ optionals buildDocumentation [ fig2dev ghostscript doxygen ]
-      ++ optionals modelCheckingSupport [ libunwind libevent elfutils ];
+  nativeBuildInputs = [ cmake perl python3 ]
+    ++ optionals fortranSupport [ gfortran ]
+    ++ optionals buildJavaBindings [ openjdk ]
+    ++ optionals buildPythonBindings [ python3Packages.pybind11 ]
+    ++ optionals buildDocumentation [ fig2dev ghostscript doxygen ]
+    ++ optionals modelCheckingSupport [ libunwind libevent elfutils ];
 
-  #buildInputs = optional luaSupport lua5;
+  outputs = [ "out" ]
+    ++ optionals buildPythonBindings [ "python" ];
 
-  # Make it so that libsimgrid.so will be found when running programs from
-  # the build dir.
-  preConfigure = ''
-    export LD_LIBRARY_PATH="$PWD/build/lib"
-  '';
-
-  # Release mode is not supported in SimGrid
+  # "Release" does not work. non-debug mode is Debug compiled with optimization
   cmakeBuildType = "Debug";
-
-  # Disable/Enable functionality
-  # Note: those packages are not packaged in Nixpkgs yet so some options
-  # are disabled:
-  # - papi:   for enable_smpi_papi
-  # - ns3:    for enable_ns3
-  # - lua53:  for enable_lua
-  #
-  # For more information see:
-  # https://simgrid.org/doc/3.22/Installing_SimGrid.html#simgrid-compilation-options)
   cmakeFlags = [
     "-Denable_documentation=${optionOnOff buildDocumentation}"
     "-Denable_java=${optionOnOff buildJavaBindings}"
+    "-Denable_python=${optionOnOff buildPythonBindings}"
+    "-DSIMGRID_PYTHON_LIBDIR=./" # prevents CMake to install in ${python3} dir
+    "-Denable_msg=${optionOnOff buildJavaBindings}"
     "-Denable_fortran=${optionOnOff fortranSupport}"
     "-Denable_model-checking=${optionOnOff modelCheckingSupport}"
     "-Denable_ns3=off"
@@ -75,27 +57,28 @@ stdenv.mkDerivation rec {
     "-Denable_mallocators=on"
     "-Denable_debug=on"
     "-Denable_smpi=on"
+    "-Dminimal-bindings=${optionOnOff minimalBindings}"
     "-Denable_smpi_ISP_testsuite=${optionOnOff moreTests}"
     "-Denable_smpi_MPICH3_testsuite=${optionOnOff moreTests}"
-    "-Denable_compile_warnings=${optionOnOff debug}"
-    "-Denable_compile_optimizations=${optionOnOff (!debug)}"
-    "-Denable_lto=${optionOnOff (!debug)}"
-    # "-Denable_lua=${optionOnOff luaSupport}"
-    # "-Denable_smpi_papi=${optionOnOff moreTests}"
+    "-Denable_compile_warnings=off"
+    "-Denable_compile_optimizations=${optionOnOff optimize}"
+    "-Denable_lto=${optionOnOff optimize}"
   ];
-
   makeFlags = optional debug "VERBOSE=1";
 
-  # Some Perl scripts are called to generate test during build which
-  # is before the fixupPhase, so do this manualy here:
+  # needed to run tests and to ensure correct shabangs in output scripts
   preBuild = ''
     patchShebangs ..
   '';
 
-  doCheck = true;
+  # needed by tests (so libsimgrid.so is found)
+  preConfigure = ''
+    export LD_LIBRARY_PATH="$PWD/build/lib"
+  '';
 
-  # Prevent the execution of tests known to fail.
+  doCheck = true;
   preCheck = ''
+    # prevent the execution of tests known to fail
     cat <<EOW >CTestCustom.cmake
     SET(CTEST_CUSTOM_TESTS_IGNORE smpi-replay-multiple)
     EOW
@@ -104,6 +87,20 @@ stdenv.mkDerivation rec {
     make tests -j $NIX_BUILD_CORES
   '';
 
+  postInstall = lib.optionalString withoutBin ''
+    # remove bin from output if requested.
+    # having a specific bin output would be cleaner but it does not work currently (circular references)
+    rm -rf $out/bin
+  '' + lib.optionalString buildPythonBindings ''
+    # manually install the python binding if requested.
+    mkdir -p $python/lib/python${lib.versions.majorMinor python3.version}/site-packages/
+    cp ./lib/simgrid.cpython*.so $python/lib/python${lib.versions.majorMinor python3.version}/site-packages/
+   '';
+
+  # improve debuggability if requested
+  hardeningDisable = lib.optionals debug [ "fortify" ];
+  dontStrip = debug;
+
   meta = {
     description = "Framework for the simulation of distributed applications";
     longDescription = ''
@@ -118,5 +115,6 @@ stdenv.mkDerivation rec {
     license = licenses.lgpl2Plus;
     maintainers = with maintainers; [ mickours mpoquet ];
     platforms = platforms.all;
+    broken = stdenv.isDarwin;
   };
 }
diff --git a/pkgs/applications/virtualization/qemu/default.nix b/pkgs/applications/virtualization/qemu/default.nix
index 2ae0aca5845e..ee923f4e0cd0 100644
--- a/pkgs/applications/virtualization/qemu/default.nix
+++ b/pkgs/applications/virtualization/qemu/default.nix
@@ -2,7 +2,7 @@
 , perl, pixman, vde2, alsa-lib, texinfo, flex
 , bison, lzo, snappy, libaio, libtasn1, gnutls, nettle, curl, ninja, meson, sigtool
 , makeWrapper, runtimeShell
-, attr, libcap, libcap_ng
+, attr, libcap, libcap_ng, socat
 , CoreServices, Cocoa, Hypervisor, rez, setfile
 , numaSupport ? stdenv.isLinux && !stdenv.isAarch32, numactl
 , seccompSupport ? stdenv.isLinux, libseccomp
@@ -31,6 +31,8 @@
                           ++ ["${stdenv.hostPlatform.qemuArch}-softmmu"])
                     else null)
 , nixosTestRunner ? false
+, doCheck ? false
+, qemu  # for passthru.tests
 }:
 
 stdenv.mkDerivation rec {
@@ -158,7 +160,6 @@ stdenv.mkDerivation rec {
     ++ lib.optional smbdSupport "--smbd=${samba}/bin/smbd"
     ++ lib.optional uringSupport "--enable-linux-io-uring";
 
-  doCheck = false; # tries to access /dev
   dontWrapGApps = true;
 
   # QEMU attaches entitlements with codesign and strip removes those,
@@ -182,6 +183,40 @@ stdenv.mkDerivation rec {
   '';
   preBuild = "cd build";
 
+  # tests can still timeout on slower systems
+  inherit doCheck;
+  checkInputs = [ socat ];
+  preCheck = ''
+    # time limits are a little meagre for a build machine that's
+    # potentially under load.
+    substituteInPlace ../tests/unit/meson.build \
+      --replace 'timeout: slow_tests' 'timeout: 50 * slow_tests'
+    substituteInPlace ../tests/qtest/meson.build \
+      --replace 'timeout: slow_qtests' 'timeout: 50 * slow_qtests'
+    substituteInPlace ../tests/fp/meson.build \
+      --replace 'timeout: 90)' 'timeout: 300)'
+
+    # point tests towards correct binaries
+    substituteInPlace ../tests/unit/test-qga.c \
+      --replace '/bin/echo' "$(type -P echo)"
+    substituteInPlace ../tests/unit/test-io-channel-command.c \
+      --replace '/bin/socat' "$(type -P socat)"
+
+    # combined with a long package name, some temp socket paths
+    # can end up exceeding max socket name len
+    substituteInPlace ../tests/qtest/bios-tables-test.c \
+      --replace 'qemu-test_acpi_%s_tcg_%s' '%s_%s'
+
+    # get-fsinfo attempts to access block devices, disallowed by sandbox
+    sed -i -e '/\/qga\/get-fsinfo/d' -e '/\/qga\/blacklist/d' \
+      ../tests/unit/test-qga.c
+  '' + lib.optionalString stdenv.isDarwin ''
+    # skip test that stalls on darwin, perhaps due to subtle differences
+    # in fifo behaviour
+    substituteInPlace ../tests/unit/meson.build \
+      --replace "'test-io-channel-command'" "#'test-io-channel-command'"
+  '';
+
   # Add a ‘qemu-kvm’ wrapper for compatibility/convenience.
   postInstall = ''
     ln -s $out/bin/qemu-system-${stdenv.hostPlatform.qemuArch} $out/bin/qemu-kvm
@@ -189,6 +224,9 @@ stdenv.mkDerivation rec {
 
   passthru = {
     qemu-system-i386 = "bin/qemu-system-i386";
+    tests = {
+      qemu-tests = qemu.override { doCheck = true; };
+    };
   };
 
   # Builds in ~3h with 2 cores, and ~20m with a big-parallel builder.
diff --git a/pkgs/build-support/fetchgit/deterministic-git b/pkgs/build-support/fetchgit/deterministic-git
new file mode 100755
index 000000000000..67f585559116
--- /dev/null
+++ b/pkgs/build-support/fetchgit/deterministic-git
@@ -0,0 +1,45 @@
+#!/bin/sh
+
+# some git commands print to stdout, which would contaminate our JSON output
+clean_git(){
+    git "$@" >&2
+}
+
+# Remove all remote branches, remove tags not reachable from HEAD, do a full
+# repack and then garbage collect unreferenced objects.
+make_deterministic_repo(){
+    local repo="$1"
+
+    # run in sub-shell to not touch current working directory
+    (
+    cd "$repo"
+    # Remove files that contain timestamps or otherwise have non-deterministic
+    # properties.
+    rm -rf .git/logs/ .git/hooks/ .git/index .git/FETCH_HEAD .git/ORIG_HEAD \
+        .git/refs/remotes/origin/HEAD .git/config
+
+    # Remove all remote branches.
+    git branch -r | while read -r branch; do
+        clean_git branch -rD "$branch"
+    done
+
+    # Remove tags not reachable from HEAD. If we're exactly on a tag, don't
+    # delete it.
+    maybe_tag=$(git tag --points-at HEAD)
+    git tag --contains HEAD | while read -r tag; do
+        if [ "$tag" != "$maybe_tag" ]; then
+            clean_git tag -d "$tag"
+        fi
+    done
+
+    # Do a full repack. Must run single-threaded, or else we lose determinism.
+    clean_git config pack.threads 1
+    clean_git repack -A -d -f
+    rm -f .git/config
+
+    # Garbage collect unreferenced objects.
+    # Note: --keep-largest-pack prevents non-deterministic ordering of packs
+    #   listed in .git/objects/info/packs by only using a single pack
+    clean_git gc --prune=all --keep-largest-pack
+    )
+}
diff --git a/pkgs/build-support/flutter/default.nix b/pkgs/build-support/flutter/default.nix
new file mode 100644
index 000000000000..5208dbc7d05d
--- /dev/null
+++ b/pkgs/build-support/flutter/default.nix
@@ -0,0 +1,277 @@
+{ flutter
+, lib
+, llvmPackages_13
+, cmake
+, ninja
+, pkg-config
+, wrapGAppsHook
+, autoPatchelfHook
+, util-linux
+, libselinux
+, libsepol
+, libthai
+, libdatrie
+, libxkbcommon
+, at-spi2-core
+, libsecret
+, jsoncpp
+, xorg
+, dbus
+, gtk3
+, glib
+, pcre
+, libepoxy
+, stdenvNoCC
+, cacert
+, git
+, dart
+, nukeReferences
+, targetPlatform
+, bash
+, curl
+, unzip
+, which
+, xz
+}:
+
+# absolutely no mac support for now
+
+args:
+let
+  pl = n: "##FLUTTER_${n}_PLACEHOLDER_MARKER##";
+  placeholder_deps = pl "DEPS";
+  placeholder_flutter = pl "FLUTTER";
+  fetchAttrs = [ "src" "sourceRoot" "setSourceRoot" "unpackPhase" "patches" ];
+  getAttrsOrNull = names: attrs: lib.genAttrs names (name: if attrs ? ${name} then attrs.${name} else null);
+  flutterDeps = [
+    # flutter deps
+    flutter.unwrapped
+    bash
+    curl
+    flutter.dart
+    git
+    unzip
+    which
+    xz
+  ];
+  self =
+(self: llvmPackages_13.stdenv.mkDerivation (args // {
+  deps = stdenvNoCC.mkDerivation (lib.recursiveUpdate (getAttrsOrNull fetchAttrs args) {
+    name = "${self.name}-deps-flutter-v${flutter.unwrapped.version}-${targetPlatform.system}.tar.gz";
+
+    nativeBuildInputs = flutterDeps ++ [
+      nukeReferences
+    ];
+
+    installPhase = ''
+      . ${../fetchgit/deterministic-git}
+
+      TMP=$(mktemp -d)
+
+      export HOME="$TMP"
+      export PUB_CACHE=''${PUB_CACHE:-"$HOME/.pub-cache"}
+      export ANDROID_EMULATOR_USE_SYSTEM_LIBS=1
+
+      flutter config --no-analytics &>/dev/null # mute first-run
+      flutter config --enable-linux-desktop
+      flutter packages get
+      flutter build linux || true # so it downloads tools
+
+      RES="$TMP"
+
+      mkdir -p "$RES/f"
+
+      # so we can use lock, diff yaml
+      cp "pubspec.yaml" "$RES"
+      cp "pubspec.lock" "$RES"
+      mv .dart_tool .flutter-plugins .flutter-plugins-dependencies .packages "$RES/f"
+
+      # replace paths with placeholders
+      find "$RES" -type f -exec sed -i \
+        -e s,$TMP,${placeholder_deps},g \
+        -e s,${flutter.unwrapped},${placeholder_flutter},g \
+        {} +
+
+      remove_line_matching() {
+        replace_line_matching "$1" "$2" ""
+      }
+
+      replace_line_matching() {
+        sed "s|.*$2.*|$3|g" -r -i "$1"
+      }
+
+      # nuke nondeterminism
+
+      # clientId is random
+      remove_line_matching "$RES/.flutter" clientId
+
+      # deterministic git repos
+      find "$RES" -iname .git -type d | while read -r repoGit; do
+        make_deterministic_repo "$(dirname "$repoGit")"
+      done
+
+      # dart _fetchedAt, etc
+      DART_DATE=$(date --date="@$SOURCE_DATE_EPOCH" -In | sed "s|,|.|g" | sed "s|+.*||g")
+      find "$RES/.pub-cache" -iname "*.json" -exec sed -r 's|.*_fetchedAt.*|    "_fetchedAt": "'"$DART_DATE"'",|g' -i {} +
+      replace_line_matching "$RES/f/.dart_tool/package_config.json" '"generated"' '"generated": "'"$DART_DATE"'",'
+      replace_line_matching "$RES/f/.flutter-plugins-dependencies" '"date_created"' '"date_created": "'"$DART_DATE"'",'
+      remove_line_matching "$RES/f/.packages" "Generated by pub"
+
+      # nuke refs
+      find "$RES" -type f -exec nuke-refs {} +
+
+      # Build a reproducible tar, per instructions at https://reproducible-builds.org/docs/archives/
+      tar --owner=0 --group=0 --numeric-owner --format=gnu \
+          --sort=name --mtime="@$SOURCE_DATE_EPOCH" \
+          -czf "$out" -C "$RES" .
+    '';
+
+    GIT_SSL_CAINFO = "${cacert}/etc/ssl/certs/ca-bundle.crt";
+
+    impureEnvVars = lib.fetchers.proxyImpureEnvVars ++ [
+      "GIT_PROXY_COMMAND" "NIX_GIT_SSL_CAINFO" "SOCKS_SERVER"
+    ];
+
+    # unnecesarry
+    dontFixup = true;
+
+    outputHashAlgo = if self ? vendorHash then null else "sha256";
+    # outputHashMode = "recursive";
+    outputHash = if self ? vendorHash then
+      self.vendorHash
+    else if self ? vendorSha256 then
+      self.vendorSha256
+    else
+      lib.fakeSha256;
+
+  });
+
+  nativeBuildInputs = flutterDeps ++ [
+    # flutter dev tools
+    cmake
+    ninja
+    pkg-config
+    wrapGAppsHook
+    # flutter likes dynamic linking
+    autoPatchelfHook
+  ] ++ lib.optionals (args ? nativeBuildInputs) args.nativeBuildInputs;
+
+  buildInputs = [
+    # cmake deps
+    gtk3
+    glib
+    pcre
+    util-linux
+    # also required by cmake, not sure if really needed or dep of all packages
+    libselinux
+    libsepol
+    libthai
+    libdatrie
+    xorg.libXdmcp
+    xorg.libXtst
+    libxkbcommon
+    dbus
+    at-spi2-core
+    libsecret
+    jsoncpp
+    # build deps
+    xorg.libX11
+    # directly required by build
+    libepoxy
+  ] ++ lib.optionals (args ? buildInputs) args.buildInputs;
+
+  # TODO: do we need this?
+  NIX_LDFLAGS = "-rpath ${lib.makeLibraryPath self.buildInputs}";
+  NIX_CFLAGS_COMPILE = "-I${xorg.libX11}/include";
+  LD_LIBRARY_PATH = lib.makeLibraryPath self.buildInputs;
+
+  configurePhase = ''
+    runHook preConfigure
+
+    # for some reason fluffychat build breaks without this - seems file gets overriden by some tool
+    cp pubspec.yaml pubspec-backup
+
+    # we get this from $depsFolder so disabled for now, but we might need it again once deps are fetched properly
+    # flutter config --no-analytics >/dev/null 2>/dev/null # mute first-run
+    # flutter config --enable-linux-desktop
+
+    # extract deps
+    depsFolder=$(mktemp -d)
+    tar xzf "$deps" -C "$depsFolder"
+
+    # after extracting update paths to point to real paths
+    find "$depsFolder" -type f -exec sed -i \
+      -e s,${placeholder_deps},$depsFolder,g \
+      -e s,${placeholder_flutter},${flutter.unwrapped},g \
+      {} +
+
+    # ensure we're using a lockfile for the right package version
+    if [ -e pubspec.lock ]; then
+      # diff -u pubspec.lock $depsFolder/pubspec.lock
+      true
+    else
+      cp -v "$depsFolder/pubspec.lock" .
+    fi
+    diff -u pubspec.yaml $depsFolder/pubspec.yaml
+
+    mv -v $(find $depsFolder/f -type f) .
+
+    # prepare
+    export HOME=$depsFolder
+    export PUB_CACHE=''${PUB_CACHE:-"$HOME/.pub-cache"}
+    export ANDROID_EMULATOR_USE_SYSTEM_LIBS=1
+
+    # binaries need to be patched
+    autoPatchelf -- "$depsFolder"
+
+    runHook postConfigure
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+
+    # for some reason fluffychat build breaks without this - seems file gets overriden by some tool
+    mv pubspec-backup pubspec.yaml
+    mkdir -p build/flutter_assets/fonts
+
+    flutter packages get --offline -v
+    flutter build linux --release -v
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    built=build/linux/*/release/bundle
+
+    mkdir -p $out/bin
+    mv $built $out/app
+
+    for f in $built/data/flutter_assets/assets/*.desktop; do
+      install -D $f $out/share/applications/$(basename $f)
+    done
+    for f in $(find $out/app -maxdepth 1 -type f); do
+      ln -s $f $out/bin/$(basename $f)
+    done
+
+    # this confuses autopatchelf hook otherwise
+    rm -rf "$depsFolder"
+
+    # make *.so executable
+    find $out/app -iname "*.so" -type f -exec chmod +x {} +
+
+    # remove stuff like /build/source/packages/ubuntu_desktop_installer/linux/flutter/ephemeral
+    for f in $(find $out/app -executable -type f); do
+      if patchelf --print-rpath "$f" | grep /build; then # this ignores static libs (e,g. libapp.so) also
+        echo "strip RPath of $f"
+        newrp=$(patchelf --print-rpath $f | sed -r "s|/build.*ephemeral:||g" | sed -r "s|/build.*profile:||g")
+        patchelf --set-rpath "$newrp" "$f"
+      fi
+    done
+
+    runHook postInstall
+  '';
+})) self;
+in
+  self
diff --git a/pkgs/development/beam-modules/erlang-ls/default.nix b/pkgs/development/beam-modules/erlang-ls/default.nix
index 81c5bed0a542..08ebb6136fc5 100644
--- a/pkgs/development/beam-modules/erlang-ls/default.nix
+++ b/pkgs/development/beam-modules/erlang-ls/default.nix
@@ -1,7 +1,7 @@
 { fetchFromGitHub, fetchgit, fetchHex, rebar3Relx, buildRebar3, rebar3-proper
 , stdenv, writeScript, lib }:
 let
-  version = "0.23.0";
+  version = "0.23.1";
   owner = "erlang-ls";
   repo = "erlang_ls";
   deps = import ./rebar-deps.nix {
@@ -19,7 +19,7 @@ rebar3Relx {
   inherit version;
   src = fetchFromGitHub {
     inherit owner repo;
-    sha256 = "sha256-OuTd8XhoWU598eMh1/OL2t3LHf+UAumiuAY7KocfI6c=";
+    sha256 = "sha256-N0jkdzwNi9dx0dmN4qL+mb8S60OII4C/MnR/y8G3GUY=";
     rev = version;
   };
   releaseType = "escript";
diff --git a/pkgs/development/compilers/flutter/flutter.nix b/pkgs/development/compilers/flutter/flutter.nix
index 4b0789e35eb8..43538ede339e 100644
--- a/pkgs/development/compilers/flutter/flutter.nix
+++ b/pkgs/development/compilers/flutter/flutter.nix
@@ -32,6 +32,7 @@
 , nss
 , systemd
 , which
+, callPackage
 }:
 let
   drvName = "flutter-${version}";
@@ -146,6 +147,8 @@ let
   };
 
 in
+let
+self = (self:
 runCommand drvName
 {
   startScript = ''
@@ -159,6 +162,9 @@ runCommand drvName
   passthru = {
     unwrapped = flutter;
     inherit dart;
+    mkFlutterApp = callPackage ../../../build-support/flutter {
+      flutter = self;
+    };
   };
   meta = with lib; {
     description = "Flutter is Google's SDK for building mobile, web and desktop with Dart";
@@ -179,4 +185,6 @@ runCommand drvName
 
   echo -n "$startScript" > $out/bin/${pname}
   chmod +x $out/bin/${pname}
-''
+'') self;
+in
+self
diff --git a/pkgs/development/libraries/libosmium/default.nix b/pkgs/development/libraries/libosmium/default.nix
index c9b346936f49..01cdc96e39cd 100644
--- a/pkgs/development/libraries/libosmium/default.nix
+++ b/pkgs/development/libraries/libosmium/default.nix
@@ -23,6 +23,10 @@ stdenv.mkDerivation rec {
     description = "Fast and flexible C++ library for working with OpenStreetMap data";
     homepage = "https://osmcode.org/libosmium/";
     license = licenses.boost;
+    changelog = [
+      "https://github.com/osmcode/libosmium/releases/tag/v${version}"
+      "https://github.com/osmcode/libosmium/blob/v${version}/CHANGELOG.md"
+    ];
     maintainers = with maintainers; [ das-g ];
   };
 }
diff --git a/pkgs/development/libraries/libtins/default.nix b/pkgs/development/libraries/libtins/default.nix
index d1a99fb88ab4..b7e02a62fa99 100644
--- a/pkgs/development/libraries/libtins/default.nix
+++ b/pkgs/development/libraries/libtins/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libtins";
-  version = "4.3";
+  version = "4.4";
 
   src = fetchFromGitHub {
     owner = "mfontanini";
     repo = pname;
     rev = "v${version}";
-    sha256 = "09ah1a7ska7xiki7625mn1d8i96il3hxbkc39ba8fn1a5383kmqa";
+    sha256 = "sha256-mXbinXh/CO0SZZ71+K+FozbHCCoi12+AIa2o+P0QmUw=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/libraries/mdds/default.nix b/pkgs/development/libraries/mdds/default.nix
index 4ddd3b40d364..8ca137e66119 100644
--- a/pkgs/development/libraries/mdds/default.nix
+++ b/pkgs/development/libraries/mdds/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "mdds";
-  version = "2.0.1";
+  version = "2.0.2";
 
   src = fetchurl {
     url = "https://kohei.us/files/${pname}/src/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-OrM/zljmrPlUDMGlImS+aGPvgPVawocZTMmM2kjnH+Y=";
+    sha256 = "sha256-EyEfLy44fvO3TXOh3O5Soa1c4G34+OZkdnnfknijEWo=";
   };
 
   postInstall = ''
diff --git a/pkgs/development/libraries/science/math/libhomfly/default.nix b/pkgs/development/libraries/science/math/libhomfly/default.nix
index b756109aa8fc..cd9f06499de7 100644
--- a/pkgs/development/libraries/science/math/libhomfly/default.nix
+++ b/pkgs/development/libraries/science/math/libhomfly/default.nix
@@ -6,7 +6,7 @@
 
 stdenv.mkDerivation rec {
   version = "1.02r5";
-  pname = "llibhomfly";
+  pname = "libhomfly";
 
   src = fetchFromGitHub {
     owner = "miguelmarco";
diff --git a/pkgs/development/nim-packages/karax/default.nix b/pkgs/development/nim-packages/karax/default.nix
index 35a5c78ee56a..8e8f11b228a4 100644
--- a/pkgs/development/nim-packages/karax/default.nix
+++ b/pkgs/development/nim-packages/karax/default.nix
@@ -3,6 +3,6 @@
 fetchFromGitHub {
   owner = "karaxnim";
   repo = "karax";
-  rev = "1.1.2";
-  sha256 = "07ykrd21hd76vlmkqpvv5xvaxw6aaq87bky47p2420ni85a6d94j";
+  rev = "fa4a2dc";
+  sha256 = "0xl83jsfb9l8kb0nfan9h5y6v96iz4psng2fx06a0qmig4993408";
 }
diff --git a/pkgs/development/nim-packages/redpool/default.nix b/pkgs/development/nim-packages/redpool/default.nix
index 6c4c8a8e193c..76b222739cae 100644
--- a/pkgs/development/nim-packages/redpool/default.nix
+++ b/pkgs/development/nim-packages/redpool/default.nix
@@ -3,6 +3,6 @@
 fetchFromGitHub {
   owner = "zedeus";
   repo = "redpool";
-  rev = "f880f49";
-  sha256 = "01n73bpgfdz2a3qvcfxsq4a6gxbhabf2n5np1ilzgdqkzcd4jf9b";
+  rev = "8b7c1db";
+  sha256 = "10xh5fhwnahnq1nf6j69vvnbi55kixa0ari630gr6cdx80arvbs6";
 }
diff --git a/pkgs/development/python-modules/auth0-python/default.nix b/pkgs/development/python-modules/auth0-python/default.nix
index 224b8bec4015..94a0044d3ac4 100644
--- a/pkgs/development/python-modules/auth0-python/default.nix
+++ b/pkgs/development/python-modules/auth0-python/default.nix
@@ -4,16 +4,20 @@
 , mock
 , pyjwt
 , pytestCheckHook
+, pythonOlder
 , requests
 }:
 
 buildPythonPackage rec {
   pname = "auth0-python";
-  version = "3.19.0";
+  version = "3.20.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "ed33557f252cf8b022b788ebd2b851c681979f200171498acde2b92d760db026";
+    sha256 = "sha256-WIH2lMPehrqkXCh+JbEI5nf99nt61OwLhP/pF6BbsnQ=";
   };
 
   propagatedBuildInputs = [
@@ -33,7 +37,9 @@ buildPythonPackage rec {
     "test_options_are_used_and_override"
   ];
 
-  pythonImportsCheck = [ "auth0" ];
+  pythonImportsCheck = [
+    "auth0"
+  ];
 
   meta = with lib; {
     description = "Auth0 Python SDK";
diff --git a/pkgs/development/python-modules/azure-mgmt-recoveryservicesbackup/default.nix b/pkgs/development/python-modules/azure-mgmt-recoveryservicesbackup/default.nix
index 0d3a4bfb2b33..e65d454a35a5 100644
--- a/pkgs/development/python-modules/azure-mgmt-recoveryservicesbackup/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-recoveryservicesbackup/default.nix
@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "azure-mgmt-recoveryservicesbackup";
-  version = "4.0.0";
+  version = "4.1.0";
 
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    sha256 = "a848ac1d99c935e61dfb91ca3e1577904a3eff5820fce179eb6937df8e1019ec";
+    sha256 = "sha256-gJncKsR1A6ntewOBH0nGhcjMjOkWJEPpWGN//qoEHyQ=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/doit/default.nix b/pkgs/development/python-modules/doit/default.nix
index c1d26bac0f45..c7c66fceaa7c 100644
--- a/pkgs/development/python-modules/doit/default.nix
+++ b/pkgs/development/python-modules/doit/default.nix
@@ -12,13 +12,13 @@
 
 buildPythonPackage rec {
   pname = "doit";
-  version = "0.34.1";
+  version = "0.34.2";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "49467c1bf8850a292e5fd0254ee1b219f6fd8202a0d3d4bf33af3c2dfb58d688";
+    sha256 = "sha256-OIER+Kals7RGIM7rKH0FhZJ8hdDW0/h5DTT7tFwM9sM=";
   };
 
   propagatedBuildInputs = [ cloudpickle ]
diff --git a/pkgs/development/python-modules/globus-sdk/default.nix b/pkgs/development/python-modules/globus-sdk/default.nix
index dc229b0da277..98339c851cd4 100644
--- a/pkgs/development/python-modules/globus-sdk/default.nix
+++ b/pkgs/development/python-modules/globus-sdk/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "globus-sdk";
-  version = "3.4.1";
+  version = "3.4.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "globus";
     repo = "globus-sdk-python";
     rev = version;
-    hash = "sha256-0TXBw2ZTZwPzuGnWda26MiK5V5oU85PoGAsn7uJw6fk=";
+    hash = "sha256-QdeEaOP+gPWMqtUofTwrHRqLBtjG8Kta0LfZtccTjCQ=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/mecab-python3/default.nix b/pkgs/development/python-modules/mecab-python3/default.nix
index ad717e9d0c8f..1b452850161b 100644
--- a/pkgs/development/python-modules/mecab-python3/default.nix
+++ b/pkgs/development/python-modules/mecab-python3/default.nix
@@ -8,11 +8,11 @@
 
 buildPythonPackage rec {
   pname = "mecab-python3";
-  version = "1.0.4";
+  version = "1.0.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "b150ad5fe4260539b4ef184657e552ef81307fbbe60ae1f258bc814549ea90f8";
+    sha256 = "sha256-5wPXjIimcau4FwNRZEhQAV2bv6sxUwo7QNEkgaZ3mhE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/nvchecker/default.nix b/pkgs/development/python-modules/nvchecker/default.nix
index 73819188c49c..d4d9cf1811e0 100644
--- a/pkgs/development/python-modules/nvchecker/default.nix
+++ b/pkgs/development/python-modules/nvchecker/default.nix
@@ -1,40 +1,59 @@
 { lib
-, buildPythonPackage
-, fetchFromGitHub
-, pythonOlder
-, pytestCheckHook
-, setuptools
-, packaging
-, tomli
-, structlog
-, appdirs
-, pytest-asyncio
-, flaky
-, tornado
-, pycurl
 , aiohttp
-, pytest-httpbin
+, appdirs
+, buildPythonPackage
 , docutils
+, fetchFromGitHub
+, flaky
 , installShellFiles
+, packaging
+, pycurl
+, pytest-asyncio
+, pytest-httpbin
+, pytestCheckHook
+, pythonOlder
+, setuptools
+, structlog
+, tomli
+, tornado
 }:
 
 buildPythonPackage rec {
   pname = "nvchecker";
-  version = "2.6.1";
+  version = "2.7";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
-  # Tests not included in PyPI tarball
   src = fetchFromGitHub {
     owner = "lilydjwg";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Lfo/VzsklEbv/kiKV5GbzvycwekqykRLrZBhehC1MjY=";
+    hash = "sha256-OPUqkHLG8PUlD5NP7q/BpKUvmAA8Jk1NvsPPVbImv0A=";
   };
 
-  nativeBuildInputs = [ installShellFiles docutils ];
-  propagatedBuildInputs = [ setuptools packaging tomli structlog appdirs tornado pycurl aiohttp ];
-  checkInputs = [ pytestCheckHook pytest-asyncio flaky pytest-httpbin ];
+  nativeBuildInputs = [
+    docutils
+    installShellFiles
+  ];
 
-  disabled = pythonOlder "3.7";
+  propagatedBuildInputs = [
+    aiohttp
+    appdirs
+    packaging
+    pycurl
+    setuptools
+    structlog
+    tomli
+    tornado
+  ];
+
+  checkInputs = [
+    flaky
+    pytest-asyncio
+    pytest-httpbin
+    pytestCheckHook
+  ];
 
   postBuild = ''
     patchShebangs docs/myrst2man.py
@@ -45,7 +64,13 @@ buildPythonPackage rec {
     installManPage docs/_build/man/nvchecker.1
   '';
 
-  pytestFlagsArray = [ "-m 'not needs_net'" ];
+  pythonImportsCheck = [
+    "nvchecker"
+  ];
+
+  pytestFlagsArray = [
+    "-m 'not needs_net'"
+  ];
 
   meta = with lib; {
     homepage = "https://github.com/lilydjwg/nvchecker";
diff --git a/pkgs/development/python-modules/pywizlight/default.nix b/pkgs/development/python-modules/pywizlight/default.nix
index e82aa3a2e8ef..9bfb0ec1fb0c 100644
--- a/pkgs/development/python-modules/pywizlight/default.nix
+++ b/pkgs/development/python-modules/pywizlight/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "pywizlight";
-  version = "0.5.9";
+  version = "0.5.10";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "sbidy";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-MBnO6k1nHKvLImLqGFiikIC03ThylwXb7Xehy5HjS0s=";
+    sha256 = "sha256-G895roPIa7XZUJ/kHBmBmggdWtdPvbdFk3gHaR/R2jU=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/tools/analysis/tfsec/default.nix b/pkgs/development/tools/analysis/tfsec/default.nix
index c71df0842cc1..87e7676da899 100644
--- a/pkgs/development/tools/analysis/tfsec/default.nix
+++ b/pkgs/development/tools/analysis/tfsec/default.nix
@@ -5,13 +5,13 @@
 
 buildGoPackage rec {
   pname = "tfsec";
-  version = "1.1.5";
+  version = "1.2.1";
 
   src = fetchFromGitHub {
     owner = "aquasecurity";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-33NrUav+JljP4keivnVirP7uWojD91cPb+uvOyQDKqs=";
+    sha256 = "sha256-KIS2o2pLus5aohRYsabWRxZs4KfYM6PXSNp0JZhhlZk=";
   };
 
   goPackagePath = "github.com/aquasecurity/tfsec";
diff --git a/pkgs/development/tools/database/clickhouse-backup/default.nix b/pkgs/development/tools/database/clickhouse-backup/default.nix
index d293caaba6ae..fdc15a9256dd 100644
--- a/pkgs/development/tools/database/clickhouse-backup/default.nix
+++ b/pkgs/development/tools/database/clickhouse-backup/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "clickhouse-backup";
-  version = "1.3.0";
+  version = "1.3.1";
 
   src = fetchFromGitHub {
     owner = "AlexAkulov";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-07se1eMnyhnccaIMtNHv9NPFGqR+WWvIsmjwUGrsQSI=";
+    sha256 = "sha256-M9fJFdwNyNOolXFknzEPG7pNDVrqKv/WOQZUHmr8B84=";
   };
 
-  vendorSha256 = "sha256-+LNLhUfWyLD9a0fj7M5OjR9CUMQ+XjOxNa5n3mn2X9U=";
+  vendorSha256 = "sha256-d6h0LK4zbrfkUum7FXHIP+hqBx5A0mQmvW5GOi+EMVQ=";
 
   postConfigure = ''
     export CGO_ENABLED=0
diff --git a/pkgs/development/tools/esbuild/default.nix b/pkgs/development/tools/esbuild/default.nix
index 679c9a6cc9c2..82e69c2d91ee 100644
--- a/pkgs/development/tools/esbuild/default.nix
+++ b/pkgs/development/tools/esbuild/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "esbuild";
-  version = "0.14.22";
+  version = "0.14.23";
 
   src = fetchFromGitHub {
     owner = "evanw";
     repo = "esbuild";
     rev = "v${version}";
-    sha256 = "sha256-1/SVcXp5mcfJ8X0Ev+48S5w1kn7RrFqsFSBqjo3mxcI=";
+    sha256 = "sha256-7J8l4PCXDSddlUdMYaTo3KQjhUl1IRpks0iMiYxJzD4=";
   };
 
   vendorSha256 = "sha256-QPkBR+FscUc3jOvH7olcGUhM6OW4vxawmNJuRQxPuGs=";
diff --git a/pkgs/development/tools/fnm/default.nix b/pkgs/development/tools/fnm/default.nix
index 14667191b2ef..c83966c7d6d3 100644
--- a/pkgs/development/tools/fnm/default.nix
+++ b/pkgs/development/tools/fnm/default.nix
@@ -10,20 +10,20 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "fnm";
-  version = "1.30.1";
+  version = "1.31.0";
 
   src = fetchFromGitHub {
     owner = "Schniz";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-gazpjsGC5qEVeSqN+SleWWmr44CxJAJGqRNoQB38hjI=";
+    sha256 = "sha256-8A6MKDeyuk0bzyoDydcOy4LzyYe/S+x+ZJMTOo59UA8=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
 
   buildInputs = lib.optionals stdenv.isDarwin [ DiskArbitration Foundation Security ];
 
-  cargoSha256 = "sha256-mgBi0O7sqS0XtNM++S6fDjDoJSFVCr0wWYfzkAdQspw=";
+  cargoSha256 = "sha256-oiGYkRqxN6e5EG6EDQalIK0tOekyIVQ+GhxCKK0Sd3g=";
 
   doCheck = false;
 
diff --git a/pkgs/development/tools/rust/cargo-valgrind/default.nix b/pkgs/development/tools/rust/cargo-valgrind/default.nix
index e1f26dc02b2e..97f3d4d4b3b6 100644
--- a/pkgs/development/tools/rust/cargo-valgrind/default.nix
+++ b/pkgs/development/tools/rust/cargo-valgrind/default.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-valgrind";
-  version = "2.0.1";
+  version = "2.0.2";
 
   src = fetchFromGitHub {
     owner = "jfrimmel";
     repo = "cargo-valgrind";
     rev = version;
-    sha256 = "sha256-PltYUU2O/D1PrU+K8JN4+aUVLzHCeNyIsXMU6HLodXE=";
+    sha256 = "sha256-yKmm24X+5P5UATjWn0LJqby9lKRhwlvDK5suTPxKGwU=";
   };
 
-  cargoSha256 = "sha256-XiQGkZ6pfyGkNPjpcPoY66qBl7ABTcRHCBjgmXSRrL0=";
+  cargoSha256 = "sha256-8n2WryAWi/bIL0XCSlNYcxXN2ld1tis435ScuU0QcBs=";
 
   passthru = {
     updateScript = nix-update-script {
diff --git a/pkgs/development/tools/rust/maturin/default.nix b/pkgs/development/tools/rust/maturin/default.nix
index 3cbf9c404c68..204654eb0e78 100644
--- a/pkgs/development/tools/rust/maturin/default.nix
+++ b/pkgs/development/tools/rust/maturin/default.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "maturin";
-  version = "0.11.3";
+  version = "0.12.9";
 
   src = fetchFromGitHub {
     owner = "PyO3";
     repo = "maturin";
     rev = "v${version}";
-    hash = "sha256-jWkrjFQg0EqM+e/IT2n2E4lGL2kT/Wz7r5BLlzvWSO0=";
+    hash = "sha256-FskCBviLl1yafPOlsp/IjaEOlGUuWLcGlxDrNA/qf8k=";
   };
 
-  cargoHash = "sha256-+kXwMGeE2HD59EU0Dzvg8I6LcHiPV7SKSFqnCTfkKwY=";
+  cargoHash = "sha256-zakSQptKK/X/8MDJxRUHTDIGPh77cq5PrOmPEneD0YM=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/development/tools/ytt/default.nix b/pkgs/development/tools/ytt/default.nix
index 4eb1c055daf5..fb13244daf71 100644
--- a/pkgs/development/tools/ytt/default.nix
+++ b/pkgs/development/tools/ytt/default.nix
@@ -1,13 +1,13 @@
 { lib, buildGoModule, fetchFromGitHub }:
 buildGoModule rec {
   pname = "ytt";
-  version = "0.39.0";
+  version = "0.40.0";
 
   src = fetchFromGitHub {
     owner = "vmware-tanzu";
     repo = "carvel-ytt";
     rev = "v${version}";
-    sha256 = "sha256-OzH974FowU68blLLi9l+o7JPSuY+9Bkz13Q10QOuHWA=";
+    sha256 = "sha256-Oc4hNeSDsGHsA7V05LHFAJ5xvxWth2wEd3ag2ltVR10=";
   };
 
   vendorSha256 = null;
diff --git a/pkgs/os-specific/linux/firmware/firmware-updater/default.nix b/pkgs/os-specific/linux/firmware/firmware-updater/default.nix
new file mode 100644
index 000000000000..69cd829049ca
--- /dev/null
+++ b/pkgs/os-specific/linux/firmware/firmware-updater/default.nix
@@ -0,0 +1,27 @@
+{ lib
+, flutter
+, fetchFromGitHub
+}:
+
+flutter.mkFlutterApp {
+  pname = "firmware-updater";
+  version = "unstable";
+
+  vendorHash = "sha256-QgeRCFbd3AcFekJunFTwu2nDOQpAOMJUxZhgY4stJJc=";
+
+  src = fetchFromGitHub {
+    owner = "canonical";
+    repo = "firmware-updater";
+    rev = "a51817a2551e29895352618a91df9cf93d944af1";
+    sha256 = "6uhks6a9JcyIC5o0VssqfBlE4pqKiQ7d3KOb6feNTvU=";
+    fetchSubmodules = true;
+  };
+
+  meta = with lib; {
+    description = "Firmware Updater for Linux";
+    homepage = "https://github.com/canonical/firmware-updater";
+    license = licenses.free;
+    maintainers = with maintainers; [ mkg20001 ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/servers/jackett/default.nix b/pkgs/servers/jackett/default.nix
index 98602568d8c0..fefd8a72570d 100644
--- a/pkgs/servers/jackett/default.nix
+++ b/pkgs/servers/jackett/default.nix
@@ -9,13 +9,13 @@
 
 buildDotnetModule rec {
   pname = "jackett";
-  version = "0.20.567";
+  version = "0.20.576";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "VkRLbSs7n5I4DedZL49sykrpPbFQWlUouehPRg+MNio=";
+    sha256 = "UCYGxeA3ptSNDZ3vONxlr5SKhdvPxLIeslP23ULHy7M=";
   };
 
   projectFile = "src/Jackett.Server/Jackett.Server.csproj";
diff --git a/pkgs/servers/mastodon/default.nix b/pkgs/servers/mastodon/default.nix
index e863451bb5e0..09d6d0cc105a 100644
--- a/pkgs/servers/mastodon/default.nix
+++ b/pkgs/servers/mastodon/default.nix
@@ -115,7 +115,7 @@ stdenv.mkDerivation rec {
     description = "Self-hosted, globally interconnected microblogging software based on ActivityPub";
     homepage = "https://joinmastodon.org";
     license = licenses.agpl3Plus;
-    platforms = [ "x86_64-linux" "i686-linux" ];
+    platforms = [ "x86_64-linux" "i686-linux" "aarch64-linux" ];
     maintainers = with maintainers; [ petabyteboy happy-river erictapen ];
   };
 }
diff --git a/pkgs/servers/mbtileserver/default.nix b/pkgs/servers/mbtileserver/default.nix
index 59adcde1a691..c928fcfbe6dd 100644
--- a/pkgs/servers/mbtileserver/default.nix
+++ b/pkgs/servers/mbtileserver/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "mbtileserver";
-  version = "0.8.1";
+  version = "0.8.2";
 
   src = fetchFromGitHub {
     owner = "consbio";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-C6Gz+RBUrjnfJWo4Ou+s/JYJ8iVP9FMYJ/cxJjcVsXk=";
+    sha256 = "sha256-aa0YsP+SYYDtaSstTfluEe0/+yDl82KHUSss8LZ2gOc=";
   };
 
-  vendorSha256 = "sha256-36tUTZud0hxH9oZlnKxeK/xzoEzfw3xFMnd/r0srw6U=";
+  vendorSha256 = "sha256-eVnL+28eOgbR0bjWv7XotcHDl5309EO0wV8AGMslvZw=";
 
   meta = with lib; {
     description = "A simple Go-based server for map tiles stored in mbtiles format";
diff --git a/pkgs/servers/nitter/default.nix b/pkgs/servers/nitter/default.nix
index de51da4ca661..32c7ac21dae4 100644
--- a/pkgs/servers/nitter/default.nix
+++ b/pkgs/servers/nitter/default.nix
@@ -2,14 +2,14 @@
 
 nimPackages.buildNimPackage rec {
   pname = "nitter";
-  version = "unstable-2022-01-32";
+  version = "unstable-2022-02-11";
   nimBinOnly = true;
 
   src = fetchFromGitHub {
     owner = "zedeus";
     repo = "nitter";
-    rev = "cdb4efadfeb5102b501c7ff79261fefc7327edb9";
-    sha256 = "sha256-kNK0UQd1whkaZwj98b2JYtYwjUSE1qBcAYytqnSaK1o=";
+    rev = "6695784050605c77a301c0a66764fa9a9580a2f5";
+    sha256 = "1lddzf6m74bw5kkv465cp211xxqbwnfacav7ia3y9i38rrnqwk6m";
   };
 
   buildInputs = with nimPackages; [
diff --git a/pkgs/tools/admin/aliyun-cli/default.nix b/pkgs/tools/admin/aliyun-cli/default.nix
index 5b929a0b79c8..bf4fdb973851 100644
--- a/pkgs/tools/admin/aliyun-cli/default.nix
+++ b/pkgs/tools/admin/aliyun-cli/default.nix
@@ -2,14 +2,14 @@
 
 buildGoModule rec {
   pname = "aliyun-cli";
-  version = "3.0.108";
+  version = "3.0.109";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "aliyun";
     repo = pname;
     fetchSubmodules = true;
-    sha256 = "sha256-hbT7pG4IRIzFzbaUVnCpSb5h13h2158cbGf2qn8c268=";
+    sha256 = "sha256-YlJGYt/depabhMPQtS1dwmFSxoThUEXOWi7KSWx7cRo=";
   };
 
   vendorSha256 = "sha256-c7LsCNcxdHwDBEknXJt9AyrmFcem8YtUYy06vNDBdDY=";
diff --git a/pkgs/tools/admin/eksctl/default.nix b/pkgs/tools/admin/eksctl/default.nix
index cb6546b2bb6e..47273cf5ab7e 100644
--- a/pkgs/tools/admin/eksctl/default.nix
+++ b/pkgs/tools/admin/eksctl/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "eksctl";
-  version = "0.83.0";
+  version = "0.84.0";
 
   src = fetchFromGitHub {
     owner = "weaveworks";
     repo = pname;
     rev = version;
-    sha256 = "sha256-PeReZ4sf1MZ3Eia0Ngja9DRgU0xoZTYqj7Q7Vn3p1i8=";
+    sha256 = "sha256-sHbZHLpRG8x3mTgrg+3htq8PywGe13VYJFdcVxni7Ok=";
   };
 
-  vendorSha256 = "sha256-SHcLrrJtDT2eUvAqp19gp0rB7L+WaFWkcZeznUFij0U=";
+  vendorSha256 = "sha256-as3Q8umRES/XncIZbV4UKZSGvzqHF7ClKBWvnGdkYeg=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/admin/exoscale-cli/default.nix b/pkgs/tools/admin/exoscale-cli/default.nix
index 182e594084ee..d6b1933a57c0 100644
--- a/pkgs/tools/admin/exoscale-cli/default.nix
+++ b/pkgs/tools/admin/exoscale-cli/default.nix
@@ -2,13 +2,13 @@
 
 buildGoPackage rec {
   pname = "exoscale-cli";
-  version = "1.49.2";
+  version = "1.49.3";
 
   src = fetchFromGitHub {
     owner  = "exoscale";
     repo   = "cli";
     rev    = "v${version}";
-    sha256 = "sha256-8v+U0h0+3NVSXBlulOKY0A5oDlqkgNZPoyflRNycDxU=";
+    sha256 = "sha256-ANykklex/T7JwZ/G3dB4UPkYx5jSE5AnztGsWHGfL8I=";
   };
 
   goPackagePath = "github.com/exoscale/cli";
diff --git a/pkgs/tools/networking/ntopng/0001-Undo-weird-modification-of-data_dir.patch b/pkgs/tools/networking/ntopng/0001-Undo-weird-modification-of-data_dir.patch
deleted file mode 100644
index d794efeac08a..000000000000
--- a/pkgs/tools/networking/ntopng/0001-Undo-weird-modification-of-data_dir.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff --git a/src/Prefs.cpp b/src/Prefs.cpp
-index 76385c4..db8d20d 100755
---- a/src/Prefs.cpp
-+++ b/src/Prefs.cpp
-@@ -795,7 +795,6 @@ int Prefs::checkOptions() {
-          ntop->getTrace()->traceEvent(TRACE_ERROR, "Unable to create log %s", path);
-     }
- 
--  free(data_dir); data_dir = strdup(ntop->get_install_dir());
-   docs_dir      = ntop->getValidPath(docs_dir);
-   scripts_dir   = ntop->getValidPath(scripts_dir);
-   callbacks_dir = ntop->getValidPath(callbacks_dir);
diff --git a/pkgs/tools/networking/ntopng/0002-Remove-requirement-to-have-writeable-callback-dir.patch b/pkgs/tools/networking/ntopng/0002-Remove-requirement-to-have-writeable-callback-dir.patch
deleted file mode 100644
index 50ed1daebd48..000000000000
--- a/pkgs/tools/networking/ntopng/0002-Remove-requirement-to-have-writeable-callback-dir.patch
+++ /dev/null
@@ -1,14 +0,0 @@
-diff --git a/src/Ntop.cpp b/src/Ntop.cpp
-index 8de92a9..510418f 100644
---- a/src/Ntop.cpp
-+++ b/src/Ntop.cpp
-@@ -197,8 +197,7 @@ void Ntop::registerPrefs(Prefs *_prefs) {
-   }
- 
-   if(stat(prefs->get_callbacks_dir(), &statbuf)
--     || (!(statbuf.st_mode & S_IFDIR))  /* It's not a directory */
--     || (!(statbuf.st_mode & S_IWRITE)) /* It's not writable    */) {
-+     || (!(statbuf.st_mode & S_IFDIR))  /* It's not a directory */) {
-     ntop->getTrace()->traceEvent(TRACE_ERROR, "Invalid directory %s specified",
- 				 prefs->get_callbacks_dir());
-     _exit(-1);
diff --git a/pkgs/tools/networking/ntopng/0003-New-libpcap-defines-SOCKET.patch b/pkgs/tools/networking/ntopng/0003-New-libpcap-defines-SOCKET.patch
deleted file mode 100644
index 51c9a706f898..000000000000
--- a/pkgs/tools/networking/ntopng/0003-New-libpcap-defines-SOCKET.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-From 9cb650ea96c0e5063775071cfdae072e92c553b8 Mon Sep 17 00:00:00 2001
-From: emanuele-f <faranda@ntop.org>
-Date: Tue, 18 Sep 2018 12:49:57 +0200
-Subject: [PATCH] Compilation fix with new libpcap
-
-SOCKET and INVALID_SOCKET are now defined in pcap.h
----
- third-party/mongoose/mongoose.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/third-party/mongoose/mongoose.c b/third-party/mongoose/mongoose.c
-index 6a61cea9b..634c142e3 100644
---- a/third-party/mongoose/mongoose.c
-+++ b/third-party/mongoose/mongoose.c
-@@ -247,7 +247,9 @@ struct pollfd {
- #define mg_rename(x, y) rename(x, y)
- #define mg_sleep(x) usleep((x) * 1000)
- #define ERRNO errno
-+#ifndef INVALID_SOCKET
- #define INVALID_SOCKET (-1)
-+#endif
- 
- /* ntop */
- #if ((ULONG_MAX) == (UINT_MAX))
-@@ -270,7 +272,9 @@ struct pollfd {
- #endif
- 
- //#define INT64_FMT PRId64
-+#ifndef SOCKET
- typedef int SOCKET;
-+#endif
- #define WINCDECL
- 
- #endif // End of Windows and UNIX specific includes
diff --git a/pkgs/tools/networking/ntopng/default.nix b/pkgs/tools/networking/ntopng/default.nix
index 46dd586c0fa1..652ad4e28867 100644
--- a/pkgs/tools/networking/ntopng/default.nix
+++ b/pkgs/tools/networking/ntopng/default.nix
@@ -1,62 +1,46 @@
-{ lib, stdenv, fetchurl, libpcap,/* gnutls, libgcrypt,*/ libxml2, glib
-, geoip, geolite-legacy, sqlite, which, autoreconfHook, git
-, pkg-config, groff, curl, json_c, luajit, zeromq, rrdtool
+{ lib, stdenv, fetchFromGitHub, fetchpatch, pkg-config, bash, autoreconfHook
+, zeromq, ndpi, json_c, openssl, libpcap, libcap, curl, libmaxminddb
+, rrdtool, sqlite, libmysqlclient, expat, net-snmp
 }:
 
-# ntopng includes LuaJIT, mongoose, rrdtool and zeromq in its third-party/
-# directory, but we use luajit, zeromq, and rrdtool from nixpkgs
-
 stdenv.mkDerivation rec {
   pname = "ntopng";
-  version = "2.0";
+  version = "5.2.1";
 
-  src = fetchurl {
-    urls = [
-      "mirror://sourceforge/project/ntop/ntopng/old/ntopng-${version}.tar.gz"
-      "mirror://sourceforge/project/ntop/ntopng/ntopng-${version}.tar.gz"
-    ];
-    sha256 = "0l82ivh05cmmqcvs26r6y69z849d28njipphqzvnakf43ggddgrw";
+  src = fetchFromGitHub {
+    owner = "ntop";
+    repo = "ntopng";
+    rev = version;
+    sha256 = "sha256-FeRERSq8F3HEelUCkA6pgNNcP94xrWy6EbJgk+cEdqc=";
   };
 
   patches = [
-    ./0001-Undo-weird-modification-of-data_dir.patch
-    ./0002-Remove-requirement-to-have-writeable-callback-dir.patch
-    ./0003-New-libpcap-defines-SOCKET.patch
+    (fetchpatch {
+      url = "https://github.com/ntop/ntopng/commit/0aa580e1a45f248fffe6d11729ce40571f08e187.patch";
+      sha256 = "sha256-xqEVwfGgkNS+akbJnLZsVvEQdp9GxxUen8VkFomtcPI=";
+    })
   ];
 
-  buildInputs = [ libpcap/* gnutls libgcrypt*/ libxml2 glib geoip geolite-legacy
-    sqlite which autoreconfHook git pkg-config groff curl json_c luajit zeromq
-    rrdtool ];
+  nativeBuildInputs = [ bash autoreconfHook pkg-config ];
 
+  buildInputs = [
+    zeromq ndpi json_c openssl libpcap curl libmaxminddb rrdtool sqlite
+    libmysqlclient expat net-snmp libcap
+  ];
 
-  autoreconfPhase = ''
-    substituteInPlace autogen.sh --replace "/bin/rm" "rm"
-    substituteInPlace nDPI/autogen.sh --replace "/bin/rm" "rm"
-    $shell autogen.sh
-  '';
+  autoreconfPhase = "bash autogen.sh";
 
   preConfigure = ''
     substituteInPlace Makefile.in --replace "/bin/rm" "rm"
   '';
 
   preBuild = ''
-    substituteInPlace src/Ntop.cpp --replace "/usr/local" "$out"
-
-    sed -e "s|\(#define CONST_DEFAULT_DATA_DIR\).*|\1 \"/var/lib/ntopng\"|g" \
-        -e "s|\(#define CONST_DEFAULT_DOCS_DIR\).*|\1 \"$out/share/ntopng/httpdocs\"|g" \
-        -e "s|\(#define CONST_DEFAULT_SCRIPTS_DIR\).*|\1 \"$out/share/ntopng/scripts\"|g" \
-        -e "s|\(#define CONST_DEFAULT_CALLBACKS_DIR\).*|\1 \"$out/share/ntopng/scripts/callbacks\"|g" \
-        -e "s|\(#define CONST_DEFAULT_INSTALL_DIR\).*|\1 \"$out/share/ntopng\"|g" \
+    sed -e "s|\(#define CONST_BIN_DIR \).*|\1\"$out/bin\"|g" \
+        -e "s|\(#define CONST_SHARE_DIR \).*|\1\"$out/share\"|g" \
         -i include/ntop_defines.h
-
-    rm -rf httpdocs/geoip
-    ln -s ${geolite-legacy}/share/GeoIP httpdocs/geoip
-  '' + lib.optionalString stdenv.isDarwin ''
-    sed 's|LIBS += -lstdc++.6||' -i Makefile
   '';
 
-  NIX_CFLAGS_COMPILE = "-fpermissive"
-    + lib.optionalString stdenv.cc.isClang " -Wno-error=reserved-user-defined-literal";
+  enableParallelBuilding = true;
 
   meta = with lib; {
     description = "High-speed web-based traffic analysis and flow collection tool";
diff --git a/pkgs/tools/system/gdu/default.nix b/pkgs/tools/system/gdu/default.nix
index 41e4d99f6a4c..c5da5b2d5c62 100644
--- a/pkgs/tools/system/gdu/default.nix
+++ b/pkgs/tools/system/gdu/default.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "gdu";
-  version = "5.13.1";
+  version = "5.13.2";
 
   src = fetchFromGitHub {
     owner = "dundee";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-bUzL9QkSgzJePBnGSYQvsKC975ss5b3kBdIgwgGzEtk=";
+    sha256 = "sha256-2HADEp1nDkIl56e5oxY6bC+lRWanQwjlCChm0aI0N9Q=";
   };
 
   vendorSha256 = "sha256-9+Zez33oET0nx/Xm3fXh1WFoQduMBodvml1oGO6jUYc=";
diff --git a/pkgs/tools/text/goawk/default.nix b/pkgs/tools/text/goawk/default.nix
index a4e5badeb92b..b665c1823329 100644
--- a/pkgs/tools/text/goawk/default.nix
+++ b/pkgs/tools/text/goawk/default.nix
@@ -1,13 +1,13 @@
 { buildGoModule, fetchFromGitHub, lib }:
 buildGoModule rec {
   pname = "goawk";
-  version = "1.15.0";
+  version = "1.16.0";
 
   src = fetchFromGitHub {
     owner = "benhoyt";
     repo = "goawk";
     rev = "v${version}";
-    sha256 = "sha256-gd26j6c8ORy0qkeHvwPFLkymeRiFr8MLxJ6hIrBwAZw=";
+    sha256 = "sha256-ALzCcSZHnzidj4tQzZWXT8WDPIE147KWbn7n1JHCTRE=";
   };
 
   vendorSha256 = "sha256-pQpattmS9VmO3ZIQUFn66az8GSmB4IvYhTTCFn6SUmo=";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index a3a1321250fb..8d04ce2b761d 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1797,6 +1797,8 @@ with pkgs;
 
   fspy = callPackage ../applications/misc/fspy { };
 
+  fluffychat = callPackage  ../applications/networking/instant-messengers/fluffychat { };
+
   fxlinuxprintutil = callPackage ../tools/misc/fxlinuxprintutil { };
 
   genann = callPackage ../development/libraries/genann { };
@@ -22299,6 +22301,8 @@ with pkgs;
 
   firmware-manager = callPackage ../os-specific/linux/firmware/firmware-manager { };
 
+  firmware-updater = callPackage ../os-specific/linux/firmware/firmware-updater { };
+
   fwts = callPackage ../os-specific/linux/fwts { };
 
   gobi_loader = callPackage ../os-specific/linux/gobi_loader { };