diff --git a/nixos/modules/services/web-servers/minio.nix b/nixos/modules/services/web-servers/minio.nix
index 381a55faff16..d075449012f7 100644
--- a/nixos/modules/services/web-servers/minio.nix
+++ b/nixos/modules/services/web-servers/minio.nix
@@ -4,6 +4,11 @@ with lib;
 
 let
   cfg = config.services.minio;
+
+  legacyCredentials = cfg: pkgs.writeText "minio-legacy-credentials" ''
+    MINIO_ROOT_USER=${cfg.accessKey}
+    MINIO_ROOT_PASSWORD=${cfg.secretKey}
+  '';
 in
 {
   meta.maintainers = [ maintainers.bachp ];
@@ -49,6 +54,17 @@ in
       '';
     };
 
+    rootCredentialsFile = mkOption  {
+      type = types.nullOr types.path;
+      default = null;
+      description = ''
+        File containing the MINIO_ROOT_USER, default is "minioadmin", and
+        MINIO_ROOT_PASSWORD (length >= 8), default is "minioadmin"; in the format of
+        an EnvironmentFile=, as described by systemd.exec(5).
+      '';
+      example = "/etc/nixos/minio-root-credentials";
+    };
+
     region = mkOption {
       default = "us-east-1";
       type = types.str;
@@ -72,6 +88,8 @@ in
   };
 
   config = mkIf cfg.enable {
+    warnings = optional ((cfg.accessKey != "") || (cfg.secretKey != "")) "services.minio.`accessKey` and services.minio.`secretKey` are deprecated, please use services.minio.`rootCredentialsFile` instead.";
+
     systemd.tmpfiles.rules = [
       "d '${cfg.configDir}' - minio minio - -"
     ] ++ (map (x:  "d '" + x + "' - minio minio - - ") cfg.dataDir);
@@ -86,14 +104,13 @@ in
         User = "minio";
         Group = "minio";
         LimitNOFILE = 65536;
+        EnvironmentFile = if (cfg.rootCredentialsFile != null) then cfg.rootCredentialsFile
+                          else if ((cfg.accessKey != "") || (cfg.secretKey != "")) then (legacyCredentials cfg)
+                          else null;
       };
       environment = {
         MINIO_REGION = "${cfg.region}";
         MINIO_BROWSER = "${if cfg.browser then "on" else "off"}";
-      } // optionalAttrs (cfg.accessKey != "") {
-        MINIO_ACCESS_KEY = "${cfg.accessKey}";
-      } // optionalAttrs (cfg.secretKey != "") {
-        MINIO_SECRET_KEY = "${cfg.secretKey}";
       };
     };
 
diff --git a/pkgs/applications/misc/cherrytree/default.nix b/pkgs/applications/misc/cherrytree/default.nix
index 585f62178611..ef307ce3460b 100644
--- a/pkgs/applications/misc/cherrytree/default.nix
+++ b/pkgs/applications/misc/cherrytree/default.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cherrytree";
-  version = "0.99.37";
+  version = "0.99.38";
 
   src = fetchFromGitHub {
     owner = "giuspen";
     repo = "cherrytree";
     rev = version;
-    sha256 = "1a2scwjrjijxwyfpqih23zzay3yqhyzpxnp66388fcir1cmp8zih";
+    sha256 = "sha256-04MRw6pMtJGxTMKwOzPNGg1T85SfVY5bMkF3gt2V0e0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/seaweedfs/default.nix b/pkgs/applications/networking/seaweedfs/default.nix
index 522cef2b8a79..36518db09917 100644
--- a/pkgs/applications/networking/seaweedfs/default.nix
+++ b/pkgs/applications/networking/seaweedfs/default.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "seaweedfs";
-  version = "2.50";
+  version = "2.56";
 
   src = fetchFromGitHub {
     owner = "chrislusf";
     repo = "seaweedfs";
     rev = version;
-    sha256 = "sha256-ai8/XryFw/7GYuWAmLkqHzK97QgTBPyE6m3dflck94w=";
+    sha256 = "1y9abk2i0qk5c00dnw8wvasy7dmmy6az8d1cf9bq0dwh8g8kylbn";
   };
 
-  vendorSha256 = "sha256-gJQDcACMWZWS4CgS2NDALoBzxu7Hh4ZW3f0gUFUALCM=";
+  vendorSha256 = "015qvd0h786z1iwv81i107z92mqhzldp1hkcsp75wzf4j7nmzxvf";
 
   subPackages = [ "weed" ];
 
diff --git a/pkgs/applications/science/astronomy/phd2/default.nix b/pkgs/applications/science/astronomy/phd2/default.nix
index 0e0ad06bbe9f..543e6820a763 100644
--- a/pkgs/applications/science/astronomy/phd2/default.nix
+++ b/pkgs/applications/science/astronomy/phd2/default.nix
@@ -1,19 +1,32 @@
-{ lib, stdenv, fetchFromGitHub, pkg-config, cmake, gtk3, wxGTK30-gtk3,
-  curl, gettext, glib, indi-full, libnova, wrapGAppsHook }:
+{ lib, stdenv, fetchFromGitHub, pkg-config, cmake, gtk3, wxGTK30-gtk3
+, curl, gettext, glib, indi-full, libnova, wrapGAppsHook }:
 
 stdenv.mkDerivation rec {
   pname = "phd2";
-  version = "2.6.9dev1";
+  version = "2.6.10";
 
   src = fetchFromGitHub {
     owner = "OpenPHDGuiding";
     repo = "phd2";
     rev = "v${version}";
-    sha256 = "1ih7m9lilh12xbhmwm9kkicaqy72mi3firl6df7m5x38n2zj3zm4";
+    sha256 = "sha256-2ZiPjhlguWXFcC53xG1aqAode7twtoHWszFUMQkK5xU=";
   };
 
-  nativeBuildInputs = [ cmake pkg-config wrapGAppsHook ];
-  buildInputs = [ gtk3 wxGTK30-gtk3 curl gettext glib indi-full libnova ];
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    wrapGAppsHook
+  ];
+
+  buildInputs = [
+    gtk3
+    wxGTK30-gtk3
+    curl
+    gettext
+    glib
+    indi-full
+    libnova
+  ];
 
   cmakeFlags = [
     "-DOPENSOURCE_ONLY=1"
@@ -27,8 +40,9 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://openphdguiding.org/";
     description = "Telescope auto-guidance application";
+    changelog = "https://github.com/OpenPHDGuiding/phd2/releases/tag/v${version}";
     license = licenses.bsd3;
     maintainers = with maintainers; [ hjones2199 ];
-    platforms = [ "x86_64-linux" ];
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/applications/science/electronics/gtkwave/default.nix b/pkgs/applications/science/electronics/gtkwave/default.nix
index af5441f07e21..b539df7592a5 100644
--- a/pkgs/applications/science/electronics/gtkwave/default.nix
+++ b/pkgs/applications/science/electronics/gtkwave/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gtkwave";
-  version = "3.3.109";
+  version = "3.3.110";
 
   src = fetchurl {
     url    = "mirror://sourceforge/gtkwave/${pname}-gtk3-${version}.tar.gz";
-    sha256 = "sha256-NUYezNm4tEcMqnirmo8U7Ky8ye/2MDPY3OWAk+eG3rc=";
+    sha256 = "sha256-Ku25IVa8ot3SWxODeMrOaxBY5X022TnvD3l2kAa3Wao=";
   };
 
   nativeBuildInputs = [ pkg-config wrapGAppsHook ];
diff --git a/pkgs/applications/science/robotics/emuflight-configurator/default.nix b/pkgs/applications/science/robotics/emuflight-configurator/default.nix
index 2b89a00eb4bd..ab94df9ef18f 100644
--- a/pkgs/applications/science/robotics/emuflight-configurator/default.nix
+++ b/pkgs/applications/science/robotics/emuflight-configurator/default.nix
@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   pname = "emuflight-configurator";
-  version = "0.3.5";
+  version = "0.3.6";
 
   src = fetchurl {
     url = "https://github.com/emuflight/EmuConfigurator/releases/download/${version}/emuflight-configurator_${version}_linux64.zip";
-    sha256 = "d55bdc52cf93d58c728ccb296ef912a5fc0f42c57ed95f3ded5f85d1c10838c4";
+    sha256 = "sha256-egSUd/+RNo0vr2EJibgk9nNnql5sHC11gctUMK+DzW0=";
   };
 
   nativeBuildInputs = [ wrapGAppsHook unzip copyDesktopItems ];
diff --git a/pkgs/development/interpreters/php/generic.nix b/pkgs/development/interpreters/php/generic.nix
index 5344be9c5c7e..f181db108a45 100644
--- a/pkgs/development/interpreters/php/generic.nix
+++ b/pkgs/development/interpreters/php/generic.nix
@@ -133,7 +133,7 @@ let
               unwrapped = php;
               # Select the right php tests for the php version
               tests = nixosTests."php${lib.strings.replaceStrings [ "." ] [ "" ] (lib.versions.majorMinor php.version)}";
-              inherit (php-packages) extensions buildPecl;
+              inherit (php-packages) extensions buildPecl mkExtension;
               packages = php-packages.tools;
               meta = php.meta // {
                 outputsToInstall = [ "out" ];
diff --git a/pkgs/development/libraries/SDL/default.nix b/pkgs/development/libraries/SDL/default.nix
index bf76bc1e8570..225cadac8c60 100644
--- a/pkgs/development/libraries/SDL/default.nix
+++ b/pkgs/development/libraries/SDL/default.nix
@@ -5,7 +5,7 @@
 , x11Support ? !stdenv.isCygwin && !stdenv.hostPlatform.isAndroid
 , libXext, libICE, libXrandr
 , pulseaudioSupport ? config.pulseaudio or stdenv.isLinux && !stdenv.hostPlatform.isAndroid, libpulseaudio
-, OpenGL, CoreAudio, CoreServices, AudioUnit, Kernel, Cocoa
+, OpenGL, GLUT, CoreAudio, CoreServices, AudioUnit, Kernel, Cocoa
 }:
 
 # NOTE: When editing this expression see if the same change applies to
@@ -16,7 +16,8 @@ with lib;
 let
   extraPropagatedBuildInputs = [ ]
     ++ optionals x11Support [ libXext libICE libXrandr ]
-    ++ optionals openglSupport [ libGL libGLU ]
+    ++ optionals (openglSupport && stdenv.isLinux) [ libGL libGLU ]
+    ++ optionals (openglSupport && stdenv.isDarwin) [ OpenGL GLUT ]
     ++ optional alsaSupport alsa-lib
     ++ optional pulseaudioSupport libpulseaudio
     ++ optional stdenv.isDarwin Cocoa;
diff --git a/pkgs/development/libraries/libaec/default.nix b/pkgs/development/libraries/libaec/default.nix
index 4c539860be72..aa146ca24133 100644
--- a/pkgs/development/libraries/libaec/default.nix
+++ b/pkgs/development/libraries/libaec/default.nix
@@ -4,14 +4,14 @@
 
 stdenv.mkDerivation rec {
   pname = "libaec";
-  version  = "1.0.4";
+  version  = "1.0.5";
 
   src = fetchFromGitLab {
     domain = "gitlab.dkrz.de";
     owner = "k202009";
     repo = "libaec";
     rev = "v${version}";
-    sha256 = "1rpma89i35ahbalaqz82y201syxni7jkf9892jlyyrhhrvlnm4l2";
+    sha256 = "sha256-Vi0fCd9V/EH+PcD+e6RZK2/isR1xGX25POhm1Xen5ak=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/netmap/default.nix b/pkgs/development/python-modules/netmap/default.nix
new file mode 100644
index 000000000000..012599216074
--- /dev/null
+++ b/pkgs/development/python-modules/netmap/default.nix
@@ -0,0 +1,43 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, substituteAll
+, nmap
+, python
+}:
+
+buildPythonPackage rec {
+  pname = "netmap";
+  version = "0.7.0.2";
+
+  src = fetchFromGitHub {
+    owner = "home-assistant-libs";
+    repo = "python-nmap";
+    rev = version;
+    sha256 = "1a44zz9zsxy48ahlpjjrddpyfi7cnfknicfcp35hi588qm430mag";
+  };
+
+  patches = [
+    (substituteAll {
+      src = ./nmap-path.patch;
+      nmap = "${lib.getBin nmap}/bin/nmap";
+    })
+  ];
+
+  # upstream tests require sudo
+  # make sure nmap is found instead
+  checkPhase = ''
+    runHook preCheck
+    ${python.interpreter} -c 'import nmap; nmap.PortScanner()'
+    runHook postCheck
+  '';
+
+  pythonImportsCheck = [ "nmap" ];
+
+  meta = with lib; {
+    description = "Python class to use nmap and access scan results from python3";
+    homepage = "https://github.com/home-assistant-libs/python-nmap";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ dotlambda ];
+  };
+}
diff --git a/pkgs/development/python-modules/netmap/nmap-path.patch b/pkgs/development/python-modules/netmap/nmap-path.patch
new file mode 100644
index 000000000000..99f9cb43a940
--- /dev/null
+++ b/pkgs/development/python-modules/netmap/nmap-path.patch
@@ -0,0 +1,17 @@
+diff --git a/nmap/nmap.py b/nmap/nmap.py
+index 91c460d..8c5ff0a 100755
+--- a/nmap/nmap.py
++++ b/nmap/nmap.py
+@@ -77,11 +77,7 @@ class PortScanner(object):
+     def __init__(
+         self,
+         nmap_search_path=(
+-            "nmap",
+-            "/usr/bin/nmap",
+-            "/usr/local/bin/nmap",
+-            "/sw/bin/nmap",
+-            "/opt/local/bin/nmap",
++            "@nmap@",
+         ),
+     ):
+         """
diff --git a/pkgs/development/r-modules/default.nix b/pkgs/development/r-modules/default.nix
index c4fb1f25304d..6e04e60bfb5c 100644
--- a/pkgs/development/r-modules/default.nix
+++ b/pkgs/development/r-modules/default.nix
@@ -345,6 +345,7 @@ let
     stsm = [ pkgs.gsl_1 ];
     stringi = [ pkgs.icu.dev ];
     survSNP = [ pkgs.gsl_1 ];
+    svglite = [ pkgs.libpng.dev ];
     sysfonts = [ pkgs.zlib pkgs.libpng pkgs.freetype.dev ];
     systemfonts = [ pkgs.fontconfig.dev pkgs.freetype.dev ];
     TAQMNGR = [ pkgs.zlib.dev ];
diff --git a/pkgs/development/tools/analysis/cargo-tarpaulin/default.nix b/pkgs/development/tools/analysis/cargo-tarpaulin/default.nix
index 66f2db280685..ebbfa619fed3 100644
--- a/pkgs/development/tools/analysis/cargo-tarpaulin/default.nix
+++ b/pkgs/development/tools/analysis/cargo-tarpaulin/default.nix
@@ -2,13 +2,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-tarpaulin";
-  version = "0.17.0";
+  version = "0.18.0";
 
   src = fetchFromGitHub {
     owner = "xd009642";
     repo = "tarpaulin";
     rev = version;
-    sha256 = "1z104cd3wg718x1d89znppx4h6f0c6icgmpcllyrd0d19lb71a2b";
+    sha256 = "sha256-j5VLxtu8Xg1fwDYWYJXGFUkfpgauG/5NauSniSZ7G2w=";
   };
 
   nativeBuildInputs = [
@@ -16,7 +16,7 @@ rustPlatform.buildRustPackage rec {
   ];
   buildInputs = [ openssl ];
 
-  cargoSha256 = "1hpi9aifn3g19yqkb58lphyw8cbsqllhg5dzbqx15hcfvrb7ip4k";
+  cargoSha256 = "sha256-1lFGczzcN4QPsIpEVQiSmNS7L+9rlSfxi+gopt2E7Ec=";
   #checkFlags = [ "--test-threads" "1" ];
   doCheck = false;
 
diff --git a/pkgs/development/tools/buildah/default.nix b/pkgs/development/tools/buildah/default.nix
index e3828eb7f14c..ba6f0bf652e3 100644
--- a/pkgs/development/tools/buildah/default.nix
+++ b/pkgs/development/tools/buildah/default.nix
@@ -14,13 +14,13 @@
 
 buildGoModule rec {
   pname = "buildah";
-  version = "1.21.1";
+  version = "1.21.2";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "buildah";
     rev = "v${version}";
-    sha256 = "sha256-Wes52lTcv3Jb6gJeUS6fmf4Nee3qEcc3SibaTFvQ8sQ=";
+    sha256 = "sha256-9AYFC10AYbt/qHj5hfuLRxUwibizKk4n9rgtd5RBEQg=";
   };
 
   outputs = [ "out" "man" ];
diff --git a/pkgs/development/tools/skopeo/default.nix b/pkgs/development/tools/skopeo/default.nix
index 2af1d5e2a074..ed704b0639a0 100644
--- a/pkgs/development/tools/skopeo/default.nix
+++ b/pkgs/development/tools/skopeo/default.nix
@@ -14,13 +14,13 @@
 
 buildGoModule rec {
   pname = "skopeo";
-  version = "1.3.0";
+  version = "1.3.1";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "containers";
     repo = "skopeo";
-    sha256 = "sha256-ZHEujkl+GUk5WjgDWdbJwOIKuOqJnIpGnvD1SsrHuhI=";
+    sha256 = "sha256-ARNsNt5xpXn4ifnnRdmkhJAJq98ri3+oAF+Uov+byI0=";
   };
 
   outputs = [ "out" "man" ];
diff --git a/pkgs/games/dwarf-fortress/default.nix b/pkgs/games/dwarf-fortress/default.nix
index 2a4df9bf7cf7..3e96351acbbb 100644
--- a/pkgs/games/dwarf-fortress/default.nix
+++ b/pkgs/games/dwarf-fortress/default.nix
@@ -1,4 +1,4 @@
-{ pkgs, stdenv, stdenvNoCC, gccStdenv, lib, recurseIntoAttrs }:
+{ stdenv, stdenvNoCC, gccStdenv, lib, recurseIntoAttrs, libsForQt5, newScope, texlive, perlPackages, jdk8, jre8 }:
 
 # To whomever it may concern:
 #
@@ -35,7 +35,7 @@
 with lib;
 
 let
-  callPackage = pkgs.newScope self;
+  callPackage = newScope self;
 
   # The latest Dwarf Fortress version. Maintainers: when a new version comes
   # out, ensure that (unfuck|dfhack|twbt) are all up to date before changing
@@ -45,51 +45,54 @@ let
   # Converts a version to a package name.
   versionToName = version: "dwarf-fortress_${lib.replaceStrings ["."] ["_"] version}";
 
-  dwarf-therapist-original = pkgs.qt5.callPackage ./dwarf-therapist {
-    texlive = pkgs.texlive.combine {
-      inherit (pkgs.texlive) scheme-basic float caption wrapfig adjmulticol sidecap preprint enumitem;
+  dwarf-therapist-original = libsForQt5.callPackage ./dwarf-therapist {
+    texlive = texlive.combine {
+      inherit (texlive) scheme-basic float caption wrapfig adjmulticol sidecap preprint enumitem;
     };
   };
 
   # A map of names to each Dwarf Fortress package we know about.
-  df-games = lib.listToAttrs (map (dfVersion: {
-    name = versionToName dfVersion;
-    value =
-      let
-        # I can't believe this syntax works. Spikes of Nix code indeed...
-        dwarf-fortress = callPackage ./game.nix {
-          inherit dfVersion;
-          inherit dwarf-fortress-unfuck;
+  df-games = lib.listToAttrs (map
+    (dfVersion: {
+      name = versionToName dfVersion;
+      value =
+        let
+          # I can't believe this syntax works. Spikes of Nix code indeed...
+          dwarf-fortress = callPackage ./game.nix {
+            inherit dfVersion;
+            inherit dwarf-fortress-unfuck;
+          };
+
+          # unfuck is linux-only right now, we will only use it there.
+          dwarf-fortress-unfuck =
+            if stdenv.isLinux then callPackage ./unfuck.nix { inherit dfVersion; }
+            else null;
+
+          twbt = callPackage ./twbt { inherit dfVersion; };
+
+          dfhack = callPackage ./dfhack {
+            inherit (perlPackages) XMLLibXML XMLLibXSLT;
+            inherit dfVersion twbt;
+            stdenv = gccStdenv;
+          };
+
+          dwarf-therapist = libsForQt5.callPackage ./dwarf-therapist/wrapper.nix {
+            inherit dwarf-fortress;
+            dwarf-therapist = dwarf-therapist-original;
+          };
+        in
+        callPackage ./wrapper {
+          inherit (self) themes;
+
+          dwarf-fortress = dwarf-fortress;
+          twbt = twbt;
+          dfhack = dfhack;
+          dwarf-therapist = dwarf-therapist;
+
+          jdk = jdk8; # TODO: remove override https://github.com/NixOS/nixpkgs/pull/89731
         };
-
-        # unfuck is linux-only right now, we will only use it there.
-        dwarf-fortress-unfuck = if stdenv.isLinux then callPackage ./unfuck.nix { inherit dfVersion; }
-                                else null;
-
-        twbt = callPackage ./twbt { inherit dfVersion; };
-
-        dfhack = callPackage ./dfhack {
-          inherit (pkgs.perlPackages) XMLLibXML XMLLibXSLT;
-          inherit dfVersion twbt;
-          stdenv = gccStdenv;
-        };
-
-        dwarf-therapist = callPackage ./dwarf-therapist/wrapper.nix {
-          inherit dwarf-fortress;
-          dwarf-therapist = dwarf-therapist-original;
-        };
-      in
-      callPackage ./wrapper {
-        inherit (self) themes;
-
-        dwarf-fortress = dwarf-fortress;
-        twbt = twbt;
-        dfhack = dfhack;
-        dwarf-therapist = dwarf-therapist;
-
-        jdk = pkgs.jdk8; # TODO: remove override https://github.com/NixOS/nixpkgs/pull/89731
-      };
-  }) (lib.attrNames self.df-hashes));
+    })
+    (lib.attrNames self.df-hashes));
 
   self = rec {
     df-hashes = builtins.fromJSON (builtins.readFile ./game.json);
@@ -107,7 +110,7 @@ let
     soundSense = callPackage ./soundsense.nix { };
 
     legends-browser = callPackage ./legends-browser {
-      jre = pkgs.jre8; # TODO: remove override https://github.com/NixOS/nixpkgs/pull/89731
+      jre = jre8; # TODO: remove override https://github.com/NixOS/nixpkgs/pull/89731
     };
 
     themes = recurseIntoAttrs (callPackage ./themes {
@@ -119,4 +122,5 @@ let
     cla-theme = themes.cla;
   };
 
-in self // df-games
+in
+self // df-games
diff --git a/pkgs/games/dwarf-fortress/dfhack/default.nix b/pkgs/games/dwarf-fortress/dfhack/default.nix
index 2e27d9493bd1..4bfb69355a7e 100644
--- a/pkgs/games/dwarf-fortress/dfhack/default.nix
+++ b/pkgs/games/dwarf-fortress/dfhack/default.nix
@@ -1,7 +1,20 @@
-{ stdenv, buildEnv, lib, fetchFromGitHub, cmake, writeScriptBin
-, perl, XMLLibXML, XMLLibXSLT, zlib, ruby
-, enableStoneSense ? false,  allegro5, libGLU, libGL
-, enableTWBT ? true, twbt
+{ stdenv
+, buildEnv
+, lib
+, fetchFromGitHub
+, cmake
+, writeScriptBin
+, perl
+, XMLLibXML
+, XMLLibXSLT
+, zlib
+, ruby
+, enableStoneSense ? false
+, allegro5
+, libGLU
+, libGL
+, enableTWBT ? true
+, twbt
 , SDL
 , dfVersion
 }:
@@ -60,9 +73,10 @@ let
     };
   };
 
-  release = if hasAttr dfVersion dfhack-releases
-            then getAttr dfVersion dfhack-releases
-            else throw "[DFHack] Unsupported Dwarf Fortress version: ${dfVersion}";
+  release =
+    if hasAttr dfVersion dfhack-releases
+    then getAttr dfVersion dfhack-releases
+    else throw "[DFHack] Unsupported Dwarf Fortress version: ${dfVersion}";
 
   version = release.dfHackRelease;
 
@@ -125,7 +139,7 @@ let
     nativeBuildInputs = [ cmake perl XMLLibXML XMLLibXSLT fakegit ];
     # We don't use system libraries because dfhack needs old C++ ABI.
     buildInputs = [ zlib SDL ]
-               ++ lib.optionals enableStoneSense [ allegro5 libGLU libGL ];
+      ++ lib.optionals enableStoneSense [ allegro5 libGLU libGL ];
 
     preConfigure = ''
       # Trick build system into believing we have .git
@@ -138,7 +152,7 @@ let
     '';
 
     cmakeFlags = [ "-DDFHACK_BUILD_ARCH=${arch}" "-DDOWNLOAD_RUBY=OFF" ]
-              ++ lib.optionals enableStoneSense [ "-DBUILD_STONESENSE=ON" "-DSTONESENSE_INTERNAL_SO=OFF" ];
+      ++ lib.optionals enableStoneSense [ "-DBUILD_STONESENSE=ON" "-DSTONESENSE_INTERNAL_SO=OFF" ];
 
     # dfhack expects an unversioned libruby.so to be present in the hack
     # subdirectory for ruby plugins to function.
diff --git a/pkgs/games/dwarf-fortress/dwarf-therapist/default.nix b/pkgs/games/dwarf-fortress/dwarf-therapist/default.nix
index 243db1e1c398..ec765e71158e 100644
--- a/pkgs/games/dwarf-fortress/dwarf-therapist/default.nix
+++ b/pkgs/games/dwarf-fortress/dwarf-therapist/default.nix
@@ -1,5 +1,12 @@
-{ lib, stdenv, fetchFromGitHub, qtbase
-, qtdeclarative, cmake, texlive, ninja }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, qtbase
+, qtdeclarative
+, cmake
+, texlive
+, ninja
+}:
 
 stdenv.mkDerivation rec {
   pname = "dwarf-therapist";
@@ -15,10 +22,11 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ texlive cmake ninja ];
   buildInputs = [ qtbase qtdeclarative ];
 
-  installPhase = if stdenv.isDarwin then ''
-    mkdir -p $out/Applications
-    cp -r DwarfTherapist.app $out/Applications
-  '' else null;
+  installPhase =
+    if stdenv.isDarwin then ''
+      mkdir -p $out/Applications
+      cp -r DwarfTherapist.app $out/Applications
+    '' else null;
 
   dontWrapQtApps = true;
 
diff --git a/pkgs/games/dwarf-fortress/dwarf-therapist/dwarf-therapist.in b/pkgs/games/dwarf-fortress/dwarf-therapist/dwarf-therapist.in
index 77936c430e2b..5ae0a35b5e20 100644
--- a/pkgs/games/dwarf-fortress/dwarf-therapist/dwarf-therapist.in
+++ b/pkgs/games/dwarf-fortress/dwarf-therapist/dwarf-therapist.in
@@ -5,22 +5,21 @@
 install_dir="@install@"
 therapist_dir="@therapist@"
 
-cat <<EOF >&2
+@cat@ <<EOF >&2
 Using $DT_DIR as Dwarf Therapist overlay directory.
 EOF
 
 update_path() {
   local path="$1"
 
-  mkdir -p "$DT_DIR/$(dirname "$path")"
+  @mkdir@ -p "$DT_DIR/$(@dirname@ "$path")"
   if [ ! -e "$DT_DIR/$path" ] || [ -L "$DT_DIR/$path" ]; then
-    rm -f "$DT_DIR/$path"
-    ln -s "$install_dir/share/dwarftherapist/$path" "$DT_DIR/$path"
+    @rm@ -f "$DT_DIR/$path"
+    @ln@ -s "$install_dir/share/dwarftherapist/$path" "$DT_DIR/$path"
   fi
 }
 
 cd "$install_dir/share/dwarftherapist"
 update_path memory_layouts
 
-QT_QPA_PLATFORM_PLUGIN_PATH="@qt_plugin_path@" \
-  exec "$therapist_dir/bin/dwarftherapist" "$@"
+exec "$therapist_dir/bin/dwarftherapist" "$@"
diff --git a/pkgs/games/dwarf-fortress/dwarf-therapist/wrapper.nix b/pkgs/games/dwarf-fortress/dwarf-therapist/wrapper.nix
index 7db79012ec65..93f51df1819d 100644
--- a/pkgs/games/dwarf-fortress/dwarf-therapist/wrapper.nix
+++ b/pkgs/games/dwarf-fortress/dwarf-therapist/wrapper.nix
@@ -1,8 +1,9 @@
-{ pkgs, stdenv, dwarf-therapist, dwarf-fortress, makeWrapper }:
+{ stdenv, dwarf-therapist, dwarf-fortress, substituteAll, coreutils, wrapQtAppsHook }:
 
 let
-  platformSlug = if stdenv.targetPlatform.is32bit then
-    "linux32" else "linux64";
+  platformSlug =
+    if stdenv.targetPlatform.is32bit then
+      "linux32" else "linux64";
   inifile = "linux/v0.${dwarf-fortress.baseVersion}.${dwarf-fortress.patchVersion}_${platformSlug}.ini";
 
 in
@@ -10,24 +11,32 @@ in
 stdenv.mkDerivation {
   name = "dwarf-therapist-${dwarf-therapist.version}";
 
-  wrapper = ./dwarf-therapist.in;
+  wrapper = substituteAll {
+    src = ./dwarf-therapist.in;
+    stdenv_shell = "${stdenv.shell}";
+    rm = "${coreutils}/bin/rm";
+    ln = "${coreutils}/bin/ln";
+    cat = "${coreutils}/bin/cat";
+    mkdir = "${coreutils}/bin/mkdir";
+    dirname = "${coreutils}/bin/dirname";
+    therapist = "${dwarf-therapist}";
+  };
 
   paths = [ dwarf-therapist ];
 
-  nativeBuildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ wrapQtAppsHook ];
 
   passthru = { inherit dwarf-fortress dwarf-therapist; };
 
   buildCommand = ''
     mkdir -p $out/bin
-    ln -s $out/bin/dwarftherapist $out/bin/DwarfTherapist
-    substitute $wrapper $out/bin/dwarftherapist \
-      --subst-var-by stdenv_shell ${stdenv.shell} \
-      --subst-var-by install $out \
-      --subst-var-by therapist ${dwarf-therapist} \
-      --subst-var-by qt_plugin_path "${pkgs.qt5.qtbase}/lib/qt-${pkgs.qt5.qtbase.qtCompatVersion}/plugins/platforms"
 
-    chmod 755 $out/bin/dwarftherapist
+    install -Dm755 $wrapper $out/bin/dwarftherapist
+    ln -s $out/bin/dwarftherapist $out/bin/DwarfTherapist
+
+    substituteInPlace $out/bin/dwarftherapist \
+      --subst-var-by install $out
+    wrapQtApp $out/bin/dwarftherapist
 
     # Fix up memory layouts
     rm -rf $out/share/dwarftherapist/memory_layouts/linux
diff --git a/pkgs/games/dwarf-fortress/game.nix b/pkgs/games/dwarf-fortress/game.nix
index 9200d01aa985..d73b111919e1 100644
--- a/pkgs/games/dwarf-fortress/game.nix
+++ b/pkgs/games/dwarf-fortress/game.nix
@@ -1,10 +1,16 @@
-{ stdenv, lib, fetchurl
-, SDL, dwarf-fortress-unfuck
+{ stdenv
+, lib
+, fetchurl
+, SDL
+, dwarf-fortress-unfuck
 
-# Our own "unfuck" libs for macOS
-, ncurses, fmodex, gcc
+  # Our own "unfuck" libs for macOS
+, ncurses
+, fmodex
+, gcc
 
-, dfVersion, df-hashes
+, dfVersion
+, df-hashes
 }:
 
 with lib;
@@ -30,15 +36,18 @@ let
   baseVersion = elemAt dfVersionTriple 1;
   patchVersion = elemAt dfVersionTriple 2;
 
-  game = if hasAttr dfVersion df-hashes
-         then getAttr dfVersion df-hashes
-         else throw "Unknown Dwarf Fortress version: ${dfVersion}";
-  dfPlatform = if hasAttr stdenv.hostPlatform.system platforms
-               then getAttr stdenv.hostPlatform.system platforms
-               else throw "Unsupported system: ${stdenv.hostPlatform.system}";
-  sha256 = if hasAttr dfPlatform game
-           then getAttr dfPlatform game
-           else throw "Unsupported dfPlatform: ${dfPlatform}";
+  game =
+    if hasAttr dfVersion df-hashes
+    then getAttr dfVersion df-hashes
+    else throw "Unknown Dwarf Fortress version: ${dfVersion}";
+  dfPlatform =
+    if hasAttr stdenv.hostPlatform.system platforms
+    then getAttr stdenv.hostPlatform.system platforms
+    else throw "Unsupported system: ${stdenv.hostPlatform.system}";
+  sha256 =
+    if hasAttr dfPlatform game
+    then getAttr dfPlatform game
+    else throw "Unsupported dfPlatform: ${dfPlatform}";
 
 in
 
diff --git a/pkgs/games/dwarf-fortress/lazy-pack.nix b/pkgs/games/dwarf-fortress/lazy-pack.nix
index 41620dd66f1c..b34dbd3c74b8 100644
--- a/pkgs/games/dwarf-fortress/lazy-pack.nix
+++ b/pkgs/games/dwarf-fortress/lazy-pack.nix
@@ -1,5 +1,10 @@
-{ stdenvNoCC, lib, buildEnv
-, df-games, themes, latestVersion, versionToName
+{ stdenvNoCC
+, lib
+, buildEnv
+, df-games
+, themes
+, latestVersion
+, versionToName
 , dfVersion ? latestVersion
   # This package should, at any given time, provide an opinionated "optimal"
   # DF experience. It's the equivalent of the Lazy Newbie Pack, that is, and
@@ -9,9 +14,10 @@
 , enableSoundSense ? true
 , enableStoneSense ? true
 , enableDwarfTherapist ? true
-, enableLegendsBrowser ? true, legends-browser
+, enableLegendsBrowser ? true
+, legends-browser
 , theme ? themes.phoebus
-# General config options:
+  # General config options:
 , enableIntro ? true
 , enableTruetype ? true
 , enableFPS ? false
@@ -23,9 +29,10 @@ with lib;
 
 let
   dfGame = versionToName dfVersion;
-  dwarf-fortress = if hasAttr dfGame df-games
-                   then getAttr dfGame df-games
-                   else throw "Unknown Dwarf Fortress version: ${dfVersion}";
+  dwarf-fortress =
+    if hasAttr dfGame df-games
+    then getAttr dfGame df-games
+    else throw "Unknown Dwarf Fortress version: ${dfVersion}";
   dwarf-therapist = dwarf-fortress.dwarf-therapist;
 in
 buildEnv {
@@ -33,10 +40,11 @@ buildEnv {
   paths = [
     (dwarf-fortress.override {
       inherit enableDFHack enableTWBT enableSoundSense enableStoneSense theme
-              enableIntro enableTruetype enableFPS enableTextMode enableSound;
-    })]
-    ++ lib.optional enableDwarfTherapist dwarf-therapist
-    ++ lib.optional enableLegendsBrowser legends-browser;
+        enableIntro enableTruetype enableFPS enableTextMode enableSound;
+    })
+  ]
+  ++ lib.optional enableDwarfTherapist dwarf-therapist
+  ++ lib.optional enableLegendsBrowser legends-browser;
 
   meta = with lib; {
     description = "An opinionated wrapper for Dwarf Fortress";
diff --git a/pkgs/games/dwarf-fortress/soundsense.nix b/pkgs/games/dwarf-fortress/soundsense.nix
index a59c87306903..5202c13b5b8a 100644
--- a/pkgs/games/dwarf-fortress/soundsense.nix
+++ b/pkgs/games/dwarf-fortress/soundsense.nix
@@ -1,4 +1,6 @@
-{ stdenv, fetchzip, dos2unix
+{ stdenv
+, fetchzip
+, dos2unix
 , soundPack ? stdenv.mkDerivation {
     name = "soundsense-soundpack";
     src = fetchzip {
@@ -8,7 +10,8 @@
     installPhase = ''
       cp -r . $out
     '';
-}}:
+  }
+}:
 
 stdenv.mkDerivation rec {
   version = "2016-1_196";
diff --git a/pkgs/games/dwarf-fortress/themes/default.nix b/pkgs/games/dwarf-fortress/themes/default.nix
index 6241df7590d9..c6987a1d16bd 100644
--- a/pkgs/games/dwarf-fortress/themes/default.nix
+++ b/pkgs/games/dwarf-fortress/themes/default.nix
@@ -1,19 +1,21 @@
-{lib, fetchFromGitHub, ...}:
+{ lib, fetchFromGitHub, ... }:
 
 with builtins;
 
-listToAttrs (map (v: {
-  inherit (v) name;
-  value = fetchFromGitHub {
-    name = "${v.name}-${v.version}";
-    owner = "DFgraphics";
-    repo = v.name;
-    rev = v.version;
-    sha256 = v.sha256;
-    meta = with lib; {
-      platforms = platforms.all;
-      maintainers = [ maintainers.matthewbauer maintainers.shazow ];
-      license = licenses.free;
+listToAttrs (map
+  (v: {
+    inherit (v) name;
+    value = fetchFromGitHub {
+      name = "${v.name}-${v.version}";
+      owner = "DFgraphics";
+      repo = v.name;
+      rev = v.version;
+      sha256 = v.sha256;
+      meta = with lib; {
+        platforms = platforms.all;
+        maintainers = [ maintainers.matthewbauer maintainers.shazow ];
+        license = licenses.free;
+      };
     };
-  };
-}) (fromJSON (readFile ./themes.json)))
+  })
+  (fromJSON (readFile ./themes.json)))
diff --git a/pkgs/games/dwarf-fortress/twbt/default.nix b/pkgs/games/dwarf-fortress/twbt/default.nix
index bee2c28e5308..e6c82e32f0db 100644
--- a/pkgs/games/dwarf-fortress/twbt/default.nix
+++ b/pkgs/games/dwarf-fortress/twbt/default.nix
@@ -1,4 +1,7 @@
-{ stdenvNoCC, lib, fetchurl, unzip
+{ stdenvNoCC
+, lib
+, fetchurl
+, unzip
 , dfVersion
 }:
 
@@ -49,9 +52,10 @@ let
     };
   };
 
-  release = if hasAttr dfVersion twbt-releases
-            then getAttr dfVersion twbt-releases
-            else throw "[TWBT] Unsupported Dwarf Fortress version: ${dfVersion}";
+  release =
+    if hasAttr dfVersion twbt-releases
+    then getAttr dfVersion twbt-releases
+    else throw "[TWBT] Unsupported Dwarf Fortress version: ${dfVersion}";
 in
 
 stdenvNoCC.mkDerivation rec {
diff --git a/pkgs/games/dwarf-fortress/unfuck.nix b/pkgs/games/dwarf-fortress/unfuck.nix
index 0fb08aa7e87f..7e96b284044d 100644
--- a/pkgs/games/dwarf-fortress/unfuck.nix
+++ b/pkgs/games/dwarf-fortress/unfuck.nix
@@ -1,7 +1,21 @@
-{ stdenv, lib, fetchFromGitHub, cmake
-, libGL, libSM, SDL, SDL_image, SDL_ttf, glew, openalSoft
-, ncurses, glib, gtk2, libsndfile, zlib
-, dfVersion, pkg-config
+{ stdenv
+, lib
+, fetchFromGitHub
+, cmake
+, libGL
+, libSM
+, SDL
+, SDL_image
+, SDL_ttf
+, glew
+, openalSoft
+, ncurses
+, glib
+, gtk2
+, libsndfile
+, zlib
+, dfVersion
+, pkg-config
 }:
 
 with lib;
@@ -46,9 +60,10 @@ let
     };
   };
 
-  release = if hasAttr dfVersion unfuck-releases
-            then getAttr dfVersion unfuck-releases
-            else throw "[unfuck] Unknown Dwarf Fortress version: ${dfVersion}";
+  release =
+    if hasAttr dfVersion unfuck-releases
+    then getAttr dfVersion unfuck-releases
+    else throw "[unfuck] Unknown Dwarf Fortress version: ${dfVersion}";
 in
 
 stdenv.mkDerivation {
@@ -68,8 +83,17 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [ cmake pkg-config ];
   buildInputs = [
-    libSM SDL SDL_image SDL_ttf glew openalSoft
-    ncurses gtk2 libsndfile zlib libGL
+    libSM
+    SDL
+    SDL_image
+    SDL_ttf
+    glew
+    openalSoft
+    ncurses
+    gtk2
+    libsndfile
+    zlib
+    libGL
   ];
 
   # Don't strip unused symbols; dfhack hooks into some of them.
diff --git a/pkgs/games/dwarf-fortress/wrapper/default.nix b/pkgs/games/dwarf-fortress/wrapper/default.nix
index 73288ab659f3..ce989b98ffbd 100644
--- a/pkgs/games/dwarf-fortress/wrapper/default.nix
+++ b/pkgs/games/dwarf-fortress/wrapper/default.nix
@@ -1,13 +1,22 @@
-{ stdenv, lib, buildEnv, substituteAll, runCommand
+{ stdenv
+, lib
+, buildEnv
+, substituteAll
+, runCommand
+, coreutils
 , dwarf-fortress
 , dwarf-therapist
-, enableDFHack ? false, dfhack
-, enableSoundSense ? false, soundSense, jdk
+, enableDFHack ? false
+, dfhack
+, enableSoundSense ? false
+, soundSense
+, jdk
 , enableStoneSense ? false
-, enableTWBT ? false, twbt
-, themes ? {}
+, enableTWBT ? false
+, twbt
+, themes ? { }
 , theme ? null
-# General config options:
+  # General config options:
 , enableIntro ? true
 , enableTruetype ? true
 , enableFPS ? false
@@ -31,11 +40,11 @@ let
   # These are in inverse order for first packages to override the next ones.
   themePkg = lib.optional (theme != null) ptheme;
   pkgs = lib.optional enableDFHack dfhack_
-         ++ lib.optional enableSoundSense soundSense
-         ++ lib.optional enableTWBT twbt.art
-         ++ [ dwarf-fortress ];
+    ++ lib.optional enableSoundSense soundSense
+    ++ lib.optional enableTWBT twbt.art
+    ++ [ dwarf-fortress ];
 
-  fixup = lib.singleton (runCommand "fixup" {} (''
+  fixup = lib.singleton (runCommand "fixup" { } (''
     mkdir -p $out/data/init
   '' + (if (theme != null) then ''
     cp ${lib.head themePkg}/data/init/init.txt $out/data/init/init.txt
@@ -61,7 +70,7 @@ let
     substituteInPlace $out/data/init/init.txt \
       --replace '[PRINT_MODE:2D]' '[PRINT_MODE:TWBT]'
   '' +
- lib.optionalString enableTextMode ''
+  lib.optionalString enableTextMode ''
     substituteInPlace $out/data/init/init.txt \
       --replace '[PRINT_MODE:2D]' '[PRINT_MODE:TEXT]'
   '' + ''
@@ -89,8 +98,15 @@ stdenv.mkDerivation {
     name = "dwarf-fortress-init";
     src = ./dwarf-fortress-init.in;
     inherit env;
-    exe = if stdenv.isLinux then "libs/Dwarf_Fortress"
-                            else "dwarfort.exe";
+    exe =
+      if stdenv.isLinux then "libs/Dwarf_Fortress"
+      else "dwarfort.exe";
+    stdenv_shell = "${stdenv.shell}";
+    cp = "${coreutils}/bin/cp";
+    rm = "${coreutils}/bin/rm";
+    ln = "${coreutils}/bin/ln";
+    cat = "${coreutils}/bin/cat";
+    mkdir = "${coreutils}/bin/mkdir";
   };
 
   runDF = ./dwarf-fortress.in;
diff --git a/pkgs/games/dwarf-fortress/wrapper/dwarf-fortress-init.in b/pkgs/games/dwarf-fortress/wrapper/dwarf-fortress-init.in
index b041067d89e4..27639e57f212 100644
--- a/pkgs/games/dwarf-fortress/wrapper/dwarf-fortress-init.in
+++ b/pkgs/games/dwarf-fortress/wrapper/dwarf-fortress-init.in
@@ -1,3 +1,4 @@
+#!@stdenv_shell@ -e
 shopt -s extglob
 
 [ -z "$DF_DIR" ] && export DF_DIR="${XDG_DATA_HOME:-$HOME/.local/share}/df_linux"
@@ -7,25 +8,25 @@ exe="$env_dir/@exe@"
 update_path() {
   local path="$1"
 
-  mkdir -p "$DF_DIR/$(dirname "$path")"
+  @mkdir@ -p "$DF_DIR/$(dirname "$path")"
   # If user has replaced these data directories, let them stay.
   if [ ! -e "$DF_DIR/$path" ] || [ -L "$DF_DIR/$path" ]; then
-    rm -f "$DF_DIR/$path"
-    ln -s "$env_dir/$path" "$DF_DIR/$path"
+    @rm@ -f "$DF_DIR/$path"
+    @ln@ -s "$env_dir/$path" "$DF_DIR/$path"
   fi
 }
 
 forcecopy_path() {
   local path="$1"
 
-  mkdir -p "$DF_DIR/$(dirname "$path")"
-  rm -rf "$DF_DIR/$path"
-  cp -rL --no-preserve=all "$env_dir/$path" "$DF_DIR/$path"
+  @mkdir@ -p "$DF_DIR/$(dirname "$path")"
+  @rm@ -rf "$DF_DIR/$path"
+  @cp@ -rL --no-preserve=all "$env_dir/$path" "$DF_DIR/$path"
 }
 
-mkdir -p "$DF_DIR"
+@mkdir@ -p "$DF_DIR"
 
-cat <<EOF >&2
+@cat@ <<EOF >&2
 Using $DF_DIR as Dwarf Fortress overlay directory.
 If you do any changes in it, don't forget to clean it when updating the game version!
 We try to detect changes based on data directories being symbolic links -- keep this in mind.
diff --git a/pkgs/tools/security/dnsx/default.nix b/pkgs/tools/security/dnsx/default.nix
index 33f40ce59d48..75c85deb1cce 100644
--- a/pkgs/tools/security/dnsx/default.nix
+++ b/pkgs/tools/security/dnsx/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "dnsx";
-  version = "1.0.4";
+  version = "1.0.5";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "dnsx";
     rev = "v${version}";
-    sha256 = "sha256-dfjchsmGqyWLxO2sP+TlBEeKz9Fd4bHWG2r4FJPGNMs=";
+    sha256 = "sha256-w+FQp5pvySM36UHFxBH5WRZvnGi43NZeI2tLr6HAF3Q=";
   };
 
-  vendorSha256 = "sha256-KJyWb+coWSdvZGwDw/JSLtPeynndnaevwyYIzyEH4Kc=";
+  vendorSha256 = "sha256-gsoeAau3klOFTu+ZEYEMdIuXw/5IVsfFJ2maxPaZKjA=";
 
   meta = with lib; {
     description = "Fast and multi-purpose DNS toolkit";
diff --git a/pkgs/tools/security/libtpms/default.nix b/pkgs/tools/security/libtpms/default.nix
index 71ae5c969a0e..baca0ed8b771 100644
--- a/pkgs/tools/security/libtpms/default.nix
+++ b/pkgs/tools/security/libtpms/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libtpms";
-  version = "0.8.3";
+  version = "0.8.4";
 
   src = fetchFromGitHub {
     owner = "stefanberger";
     repo = "libtpms";
     rev = "v${version}";
-    sha256 = "sha256-D6lYOVlgtBY6C07YqbG6TPnDKrUoEj82Ra6GK/HB7X8=";
+    sha256 = "sha256-9e7O9SE7e8D6ULXhICabNCrL+QTH55jQm0AI7DVteE0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/text/chroma/default.nix b/pkgs/tools/text/chroma/default.nix
index 6511d2dcdbb3..1b9cbcd3727a 100644
--- a/pkgs/tools/text/chroma/default.nix
+++ b/pkgs/tools/text/chroma/default.nix
@@ -1,31 +1,34 @@
-{ lib, buildGoModule, fetchFromGitHub, git }:
+{ lib, buildGoModule, fetchFromGitHub }:
 
 buildGoModule rec {
   pname = "chroma";
-  version = "0.9.1";
+  version = "0.9.2";
 
   src = fetchFromGitHub {
     owner  = "alecthomas";
     repo   = pname;
     rev    = "v${version}";
-    sha256 = "sha256-+4UaQrJh3PBf68rlW1lOEyEVw3vWxfc+Casa5+H8F9A=";
+    sha256 = "19d7yr6q8kwrm91yyglmw9n7wa861sgi6dbwn8sl6dp55czfwvaq";
+    # populate values otherwise taken care of by goreleaser,
+    # unfortunately these require us to use git. By doing
+    # this in postFetch we can delete .git afterwards and
+    # maintain better reproducibility of the src.
     leaveDotGit = true;
+    postFetch = ''
+      cd "$out"
+
+      commit="$(git rev-parse HEAD)"
+      date=$(git show -s --format=%aI "$commit")
+
+      substituteInPlace "$out/cmd/chroma/main.go" \
+        --replace 'version = "?"' 'version = "${version}"' \
+        --replace 'commit  = "?"' "commit = \"$commit\"" \
+        --replace 'date    = "?"' "date = \"$date\""
+
+      find "$out" -name .git -print0 | xargs -0 rm -rf
+    '';
   };
 
-  nativeBuildInputs = [ git ];
-
-  # populate values otherwise taken care of by goreleaser
-  # https://github.com/alecthomas/chroma/issues/435
-  postPatch = ''
-    commit="$(git rev-parse HEAD)"
-    date=$(git show -s --format=%aI "$commit")
-
-    substituteInPlace cmd/chroma/main.go \
-      --replace 'version = "?"' 'version = "${version}"' \
-      --replace 'commit  = "?"' "commit = \"$commit\"" \
-      --replace 'date    = "?"' "date = \"$date\""
-  '';
-
   vendorSha256 = "0y8mp08zccn9qxrsj9j7vambz8dwzsxbbgrlppzam53rg8rpxhrg";
 
   subPackages = [ "cmd/chroma" ];
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 0e616c611939..5bf4d37fd655 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -18100,7 +18100,7 @@ in
   };
 
   SDL = callPackage ../development/libraries/SDL ({
-    inherit (darwin.apple_sdk.frameworks) OpenGL CoreAudio CoreServices AudioUnit Kernel Cocoa;
+    inherit (darwin.apple_sdk.frameworks) OpenGL CoreAudio CoreServices AudioUnit Kernel Cocoa GLUT;
   } // lib.optionalAttrs stdenv.hostPlatform.isAndroid {
     # libGLU doesn’t work with Android’s SDL
     libGLU = null;
diff --git a/pkgs/top-level/php-packages.nix b/pkgs/top-level/php-packages.nix
index e518ee68f7b8..16d3c71d5248 100644
--- a/pkgs/top-level/php-packages.nix
+++ b/pkgs/top-level/php-packages.nix
@@ -59,6 +59,73 @@ lib.makeScope pkgs.newScope (self: with self; {
     pname = "php-${pname}";
   });
 
+  # Function to build an extension which is shipped as part of the php
+  # source, based on the php version.
+  #
+  # Name passed is the name of the extension and is automatically used
+  # to add the configureFlag "--enable-${name}", which can be overriden.
+  #
+  # Build inputs is used for extra deps that may be needed. And zendExtension
+  # will mark the extension as a zend extension or not.
+  mkExtension =
+    { name
+    , configureFlags ? [ "--enable-${name}" ]
+    , internalDeps ? [ ]
+    , postPhpize ? ""
+    , buildInputs ? [ ]
+    , zendExtension ? false
+    , doCheck ? true
+    , ...
+    }@args: stdenv.mkDerivation ((builtins.removeAttrs args [ "name" ]) // {
+      pname = "php-${name}";
+      extensionName = name;
+
+      inherit (php.unwrapped) version src;
+      sourceRoot = "php-${php.version}/ext/${name}";
+
+      enableParallelBuilding = true;
+      nativeBuildInputs = [ php.unwrapped autoconf pkg-config re2c ];
+      inherit configureFlags internalDeps buildInputs
+        zendExtension doCheck;
+
+      prePatch = "pushd ../..";
+      postPatch = "popd";
+
+      preConfigure = ''
+        nullglobRestore=$(shopt -p nullglob)
+        shopt -u nullglob   # To make ?-globbing work
+
+        # Some extensions have a config0.m4 or config9.m4
+        if [ -f config?.m4 ]; then
+          mv config?.m4 config.m4
+        fi
+
+        $nullglobRestore
+        phpize
+        ${postPhpize}
+        ${lib.concatMapStringsSep "\n"
+          (dep: "mkdir -p ext; ln -s ${dep.dev}/include ext/${dep.extensionName}")
+          internalDeps}
+      '';
+      checkPhase = "runHook preCheck; NO_INTERACTON=yes make test; runHook postCheck";
+      outputs = [ "out" "dev" ];
+      installPhase = ''
+        mkdir -p $out/lib/php/extensions
+        cp modules/${name}.so $out/lib/php/extensions/${name}.so
+        mkdir -p $dev/include
+        ${rsync}/bin/rsync -r --filter="+ */" \
+                              --filter="+ *.h" \
+                              --filter="- *" \
+                              --prune-empty-dirs \
+                              . $dev/include/
+      '';
+
+      meta = {
+        description = "PHP upstream extension: ${name}";
+        inherit (php.meta) maintainers homepage license;
+      };
+    });
+
   php = phpPackage;
 
   # This is a set of interactive tools based on PHP.
@@ -171,72 +238,6 @@ lib.makeScope pkgs.newScope (self: with self; {
     yaml = callPackage ../development/php-packages/yaml { };
   } // (
     let
-      # Function to build a single php extension based on the php version.
-      #
-      # Name passed is the name of the extension and is automatically used
-      # to add the configureFlag "--enable-${name}", which can be overriden.
-      #
-      # Build inputs is used for extra deps that may be needed. And zendExtension
-      # will mark the extension as a zend extension or not.
-      mkExtension =
-        { name
-        , configureFlags ? [ "--enable-${name}" ]
-        , internalDeps ? [ ]
-        , postPhpize ? ""
-        , buildInputs ? [ ]
-        , zendExtension ? false
-        , doCheck ? true
-        , ...
-        }@args: stdenv.mkDerivation ((builtins.removeAttrs args [ "name" ]) // {
-          pname = "php-${name}";
-          extensionName = name;
-
-          inherit (php.unwrapped) version src;
-          sourceRoot = "php-${php.version}/ext/${name}";
-
-          enableParallelBuilding = true;
-          nativeBuildInputs = [ php.unwrapped autoconf pkg-config re2c ];
-          inherit configureFlags internalDeps buildInputs
-            zendExtension doCheck;
-
-          prePatch = "pushd ../..";
-          postPatch = "popd";
-
-          preConfigure = ''
-            nullglobRestore=$(shopt -p nullglob)
-            shopt -u nullglob   # To make ?-globbing work
-
-            # Some extensions have a config0.m4 or config9.m4
-            if [ -f config?.m4 ]; then
-              mv config?.m4 config.m4
-            fi
-
-            $nullglobRestore
-            phpize
-            ${postPhpize}
-            ${lib.concatMapStringsSep "\n"
-              (dep: "mkdir -p ext; ln -s ${dep.dev}/include ext/${dep.extensionName}")
-              internalDeps}
-          '';
-          checkPhase = "runHook preCheck; NO_INTERACTON=yes make test; runHook postCheck";
-          outputs = [ "out" "dev" ];
-          installPhase = ''
-            mkdir -p $out/lib/php/extensions
-            cp modules/${name}.so $out/lib/php/extensions/${name}.so
-            mkdir -p $dev/include
-            ${rsync}/bin/rsync -r --filter="+ */" \
-                                  --filter="+ *.h" \
-                                  --filter="- *" \
-                                  --prune-empty-dirs \
-                                  . $dev/include/
-          '';
-
-          meta = {
-            description = "PHP upstream extension: ${name}";
-            inherit (php.meta) maintainers homepage license;
-          };
-        });
-
       # This list contains build instructions for different modules that one may
       # want to build.
       #
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 99c6294ecadb..96f5f65a93da 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -5233,6 +5233,8 @@ in {
 
   phonenumbers = callPackage ../development/python-modules/phonenumbers { };
 
+  netmap = callPackage ../development/python-modules/netmap { };
+
   openapi-core = callPackage ../development/python-modules/openapi-core { };
 
   pdunehd = callPackage ../development/python-modules/pdunehd { };