diff --git a/pkgs/applications/audio/csound/default.nix b/pkgs/applications/audio/csound/default.nix
index ab3267eae7f9..ebcdb8f4290e 100644
--- a/pkgs/applications/audio/csound/default.nix
+++ b/pkgs/applications/audio/csound/default.nix
@@ -14,7 +14,7 @@
 
 stdenv.mkDerivation rec {
   pname = "csound";
-  version = "6.16.2";
+  version = "6.17.0";
 
   hardeningDisable = [ "format" ];
 
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     owner = "csound";
     repo = "csound";
     rev = version;
-    sha256 = "sha256-1rcS3kOspU9ACx45yB8betph4G0hso1OSJQRiabX6tE=";
+    sha256 = "sha256-O19jm3JxHg4TcQzWQZu1uFjfYN2FR41fCRq5YGnTGD0=";
   };
 
   cmakeFlags = [ "-DBUILD_CSOUND_AC=0" ] # fails to find Score.hpp
@@ -37,8 +37,8 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Sound design, audio synthesis, and signal processing system, providing facilities for music composition and performance on all major operating systems and platforms";
-    homepage = "http://www.csounds.com/";
-    license = licenses.gpl2;
+    homepage = "https://csound.com/";
+    license = licenses.lgpl21Plus;
     maintainers = [maintainers.marcweber];
     platforms = platforms.linux;
   };
diff --git a/pkgs/applications/graphics/lightburn/default.nix b/pkgs/applications/graphics/lightburn/default.nix
index 4dc5506aed65..39fda9d1e771 100644
--- a/pkgs/applications/graphics/lightburn/default.nix
+++ b/pkgs/applications/graphics/lightburn/default.nix
@@ -6,7 +6,7 @@
 
 stdenv.mkDerivation rec {
   pname = "lightburn";
-  version = "1.0.06";
+  version = "1.1.00";
 
   nativeBuildInputs = [
     p7zip
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://github.com/LightBurnSoftware/deployment/releases/download/${version}/LightBurn-Linux64-v${version}.7z";
-    sha256 = "sha256-2Wlyt9Xw/FNaFkN1Q6utXdGzp42piebESQARhfpvRhM=";
+    sha256 = "sha256-BhruXo/DLBsmvHfoaarVG8cUU+QL4gNpf3M2zQPioUQ=";
   };
 
   buildInputs = [
diff --git a/pkgs/applications/misc/ddgr/default.nix b/pkgs/applications/misc/ddgr/default.nix
index 850bca3320ea..dee6f5c663f7 100644
--- a/pkgs/applications/misc/ddgr/default.nix
+++ b/pkgs/applications/misc/ddgr/default.nix
@@ -1,14 +1,14 @@
 { lib, stdenv, fetchFromGitHub, python3, installShellFiles }:
 
 stdenv.mkDerivation rec {
-  version = "1.9";
+  version = "2.0";
   pname = "ddgr";
 
   src = fetchFromGitHub {
     owner = "jarun";
     repo = "ddgr";
     rev = "v${version}";
-    sha256 = "0qbdq7k0mmvkjp6qzz88n7vf29liqn6y5w4y39ldqdc8hzw5sld7";
+    sha256 = "sha256-otfa2t/tfpYKqQu+VQxRKryUsIxM3JKILc3zseTC2KM=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
diff --git a/pkgs/applications/misc/mkgmap/default.nix b/pkgs/applications/misc/mkgmap/default.nix
index 39348b9edefb..976c3c7978a9 100644
--- a/pkgs/applications/misc/mkgmap/default.nix
+++ b/pkgs/applications/misc/mkgmap/default.nix
@@ -14,11 +14,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "mkgmap";
-  version = "4896";
+  version = "4897";
 
   src = fetchurl {
     url = "https://www.mkgmap.org.uk/download/mkgmap-r${version}-src.tar.gz";
-    sha256 = "1tPKZASmU0xfQgNZJYzhtvm0f7ynrWk/RWCFZ1kseKs=";
+    sha256 = "RR8o8stOnL6nnEkCtRT9tgo8foSxd6ASTsRcGDgbQRk=";
   };
 
   patches = [
diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix
index 0eb1893e95c0..e2acb21c6bc6 100644
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@@ -266,7 +266,7 @@ let
       google_api_key = "AIzaSyDGi15Zwl11UNe6Y-5XW_upsfyw31qwZPI";
 
       # Optional features:
-      use_gio = gnomeSupport || chromiumVersionAtLeast "99";
+      use_gio = true;
       use_gnome_keyring = gnomeKeyringSupport;
       use_cups = cupsSupport;
 
diff --git a/pkgs/applications/networking/browsers/chromium/default.nix b/pkgs/applications/networking/browsers/chromium/default.nix
index 084db58f38b7..0202ead46052 100644
--- a/pkgs/applications/networking/browsers/chromium/default.nix
+++ b/pkgs/applications/networking/browsers/chromium/default.nix
@@ -1,5 +1,5 @@
 { newScope, config, stdenv, fetchurl, makeWrapper
-, llvmPackages_13, llvmPackages_14, ed, gnugrep, coreutils, xdg-utils
+, llvmPackages_14, ed, gnugrep, coreutils, xdg-utils
 , glib, gtk3, gnome, gsettings-desktop-schemas, gn, fetchgit
 , libva, pipewire, wayland
 , gcc, nspr, nss, runCommand
@@ -19,7 +19,7 @@
 }:
 
 let
-  llvmPackages = llvmPackages_13;
+  llvmPackages = llvmPackages_14;
   stdenv = llvmPackages.stdenv;
 
   upstream-info = (lib.importJSON ./upstream-info.json).${channel};
@@ -54,9 +54,6 @@ let
           inherit (upstream-info.deps.gn) url rev sha256;
         };
       });
-    } // lib.optionalAttrs (chromiumVersionAtLeast "99") rec {
-      llvmPackages = llvmPackages_14;
-      stdenv = llvmPackages_14.stdenv;
     });
 
     browser = callPackage ./browser.nix {
diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.json b/pkgs/applications/networking/browsers/chromium/upstream-info.json
index f59cee7bab09..33284faf14e8 100644
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.json
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json
@@ -45,19 +45,19 @@
     }
   },
   "ungoogled-chromium": {
-    "version": "98.0.4758.102",
-    "sha256": "0gpk13k8pfk65vinlmkg3p7mm0qb8z35psajkxzx0v3n2bllfns1",
-    "sha256bin64": "0pfrakkfqw6ni96s2d0z50mpd63maic9rsc64zd85vh2jkmzskw6",
+    "version": "99.0.4844.51",
+    "sha256": "1qxsn8zvvvsnn0k7nn606rhaial8ikrlfh175msqpp50xibjxicp",
+    "sha256bin64": "04kqfppa88g2q54vp53avyyhqzrxljz49p4wqk76kq7fz2rm94x1",
     "deps": {
       "gn": {
-        "version": "2021-12-07",
+        "version": "2022-01-10",
         "url": "https://gn.googlesource.com/gn",
-        "rev": "fc295f3ac7ca4fe7acc6cb5fb052d22909ef3a8f",
-        "sha256": "02bx3bp85kkis704gndb6jvjph7gv3ij746bq4anl30kfrkpcifh"
+        "rev": "80a40b07305373617eba2d5878d353532af77da3",
+        "sha256": "1103lf38h7412949j6nrk48m2vv2rrxacn42sjg33lg88nyv7skv"
       },
       "ungoogled-patches": {
-        "rev": "98.0.4758.102-1",
-        "sha256": "0baz90fnzpldw0wwibhmh4pmki7vlpci9b9vvifa0rj5cwckl8a0"
+        "rev": "99.0.4844.51-1",
+        "sha256": "0rs10jrng63lk4xgnqpgc8zxaj6lp70csbx6r0ihpv4z3rdn37va"
       }
     }
   }
diff --git a/pkgs/applications/networking/browsers/yandex-browser/default.nix b/pkgs/applications/networking/browsers/yandex-browser/default.nix
index a54ccfdf6cc3..0ea0c5515270 100644
--- a/pkgs/applications/networking/browsers/yandex-browser/default.nix
+++ b/pkgs/applications/networking/browsers/yandex-browser/default.nix
@@ -50,11 +50,11 @@
 
 stdenv.mkDerivation rec {
   pname = "yandex-browser";
-  version = "21.6.2.817-1";
+  version = "22.1.3.856-1";
 
   src = fetchurl {
     url = "http://repo.yandex.ru/yandex-browser/deb/pool/main/y/${pname}-beta/${pname}-beta_${version}_amd64.deb";
-    sha256 = "sha256-xeZkQzVPPNABxa3/YBLoZl1obbFdzxdqIgLyoA4PN8U=";
+    sha256 = "sha256-+xxyV8dBnfu2hQ/ykkp7wFSaojhlPLVvMmZdh/hyaoE=";
   };
 
   nativeBuildInputs = [
@@ -109,21 +109,22 @@ stdenv.mkDerivation rec {
   ];
 
   unpackPhase = ''
-    mkdir -p $TMP/ya $out/bin
-    cp $src $TMP/ya.deb
-    ar vx ya.deb
+    mkdir $TMP/ya/ $out/bin/ -p
+    ar vx $src
     tar --no-overwrite-dir -xvf data.tar.xz -C $TMP/ya/
   '';
 
   installPhase = ''
-    cp -R $TMP/ya/opt $out/
+    cp $TMP/ya/{usr/share,opt} $out/ -R
+    substituteInPlace $out/share/applications/yandex-browser-beta.desktop --replace /usr/ $out/
     ln -sf $out/opt/yandex/browser-beta/yandex_browser $out/bin/yandex-browser
   '';
 
-  runtimeDependencies = [
-    libpulseaudio.out
-    (lib.getLib systemd)
-  ];
+  runtimeDependencies = map lib.getLib [
+    libpulseaudio
+    curl
+    systemd
+  ] ++ buildInputs;
 
   meta = with lib; {
     description = "Yandex Web Browser";
@@ -131,6 +132,5 @@ stdenv.mkDerivation rec {
     license = licenses.unfree;
     maintainers = with maintainers; [ dan4ik605743 ];
     platforms = [ "x86_64-linux" ];
-    broken = true;
   };
 }
diff --git a/pkgs/applications/version-management/github-desktop/default.nix b/pkgs/applications/version-management/github-desktop/default.nix
index 319fddcc06b8..83991407fd41 100644
--- a/pkgs/applications/version-management/github-desktop/default.nix
+++ b/pkgs/applications/version-management/github-desktop/default.nix
@@ -19,11 +19,11 @@
 
 stdenv.mkDerivation rec {
   pname = "github-desktop";
-  version = "2.9.6";
+  version = "2.9.9";
 
   src = fetchurl {
     url = "https://github.com/shiftkey/desktop/releases/download/release-${version}-linux1/GitHubDesktop-linux-${version}-linux1.deb";
-    sha256 = "sha256-YL3Gc76jWfQvY96pAlS5JB7BwSOUklNvGR0tOBdQHuE=";
+    sha256 = "sha256-LMKOxQR3Bgw00LnKqAe2hq+eASgwC7y0cxNSSt/sjWA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/build-support/appimage/default.nix b/pkgs/build-support/appimage/default.nix
index 8ae43df05cad..4d302156f707 100644
--- a/pkgs/build-support/appimage/default.nix
+++ b/pkgs/build-support/appimage/default.nix
@@ -179,6 +179,8 @@ rec {
       fribidi
       p11-kit
 
+      gmp
+
       # libraries not on the upstream include list, but nevertheless expected
       # by at least one appimage
       libtool.lib # for Synfigstudio
diff --git a/pkgs/development/libraries/physics/geant4/datasets.nix b/pkgs/development/libraries/physics/geant4/datasets.nix
index 80de299793a4..18809654c467 100644
--- a/pkgs/development/libraries/physics/geant4/datasets.nix
+++ b/pkgs/development/libraries/physics/geant4/datasets.nix
@@ -32,7 +32,7 @@ let
       };
     };
 in
-  builtins.listToAttrs (map (a: { inherit (a) pname; value = mkDataset a; }) [
+  builtins.listToAttrs (map (a: { name = a.pname; value = mkDataset a; }) [
     {
       pname = "G4NDL";
       version = "4.6";
diff --git a/pkgs/development/python-modules/cftime/default.nix b/pkgs/development/python-modules/cftime/default.nix
index 3991dc6bf685..6479933293fa 100644
--- a/pkgs/development/python-modules/cftime/default.nix
+++ b/pkgs/development/python-modules/cftime/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "cftime";
-  version = "1.5.2";
+  version = "1.6.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "375d37d9ab8bf501c048e44efce2276296e3d67bb276e891e0e93b0a8bbb988a";
+    sha256 = "sha256-ExA+ZlC+6mVSMWvVgl1qo7fpj1uBFQJt9IJnmN/590E=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pydroid-ipcam/default.nix b/pkgs/development/python-modules/pydroid-ipcam/default.nix
index 3d9b4188172b..50e04ef2018d 100644
--- a/pkgs/development/python-modules/pydroid-ipcam/default.nix
+++ b/pkgs/development/python-modules/pydroid-ipcam/default.nix
@@ -8,14 +8,16 @@
 
 buildPythonPackage rec {
   pname = "pydroid-ipcam";
-  version = "unstable-2021-06-01";
+  version = "1.3.1";
+  format = "setuptools";
+
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "home-assistant-libs";
     repo = pname;
     rev = "3ca14ff178f3506a6a91d8736deea8f06e9ad1c1";
-    sha256 = "0w81pl5fya17hg5xgba2vgxnylfd8jc70il575wdz2pw6z6ihj3s";
+    hash = "sha256-ekgYzTf8it94OYVGcJhEzVFv+9tCrdfLgyco7wq9AXE=";
   };
 
   propagatedBuildInputs = [
@@ -25,7 +27,10 @@ buildPythonPackage rec {
 
   # Project has no tests
   doCheck = false;
-  pythonImportsCheck = [ "pydroid_ipcam" ];
+
+  pythonImportsCheck = [
+    "pydroid_ipcam"
+  ];
 
   meta = with lib; {
     description = "Python library for Android IP Webcam";
diff --git a/pkgs/development/tools/misc/ccache/default.nix b/pkgs/development/tools/misc/ccache/default.nix
index aa38966b198a..8b5e61580590 100644
--- a/pkgs/development/tools/misc/ccache/default.nix
+++ b/pkgs/development/tools/misc/ccache/default.nix
@@ -21,7 +21,7 @@ let ccache = stdenv.mkDerivation rec {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-h1lhR8P4aNM6tQCodhpEIXwA0bUQ26B3aoiQeX2siCU=";
+    sha256 = "011i1aczv4nixq4gvjixcd73df2xplcrldfv0w12yaz5iy4vaw6b";
   };
 
   outputs = [ "out" "man" ];
diff --git a/pkgs/development/tools/open-policy-agent/default.nix b/pkgs/development/tools/open-policy-agent/default.nix
index 1e805e8932e5..3f6ea3b6462d 100644
--- a/pkgs/development/tools/open-policy-agent/default.nix
+++ b/pkgs/development/tools/open-policy-agent/default.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "open-policy-agent";
-  version = "0.37.2";
+  version = "0.38.0";
 
   src = fetchFromGitHub {
     owner = "open-policy-agent";
     repo = "opa";
     rev = "v${version}";
-    sha256 = "sha256-2DkqRKAN7eOTBG6P3YYa5N9oJ0ndm35jIxK7o5Z3dfA=";
+    sha256 = "sha256-RGGxqmQ0mZ5iSAzDvUU6mAlCve3MknuNr2wAzHcV3RQ=";
   };
   vendorSha256 = null;
 
diff --git a/pkgs/games/steam/default.nix b/pkgs/games/steam/default.nix
index bfe19a88ca98..430a2b3a67de 100644
--- a/pkgs/games/steam/default.nix
+++ b/pkgs/games/steam/default.nix
@@ -14,7 +14,6 @@ let
     steam-runtime = callPackage ./runtime.nix { };
     steam-runtime-wrapped = callPackage ./runtime-wrapped.nix { };
     steam = callPackage ./steam.nix { };
-    steam-fonts = callPackage ./fonts.nix { };
     steam-fhsenv = callPackage ./fhsenv.nix {
       glxinfo-i686 = pkgsi686Linux.glxinfo;
       steam-runtime-wrapped-i686 =
diff --git a/pkgs/games/steam/fhsenv.nix b/pkgs/games/steam/fhsenv.nix
index 06dbfea304ce..cd2046b23830 100644
--- a/pkgs/games/steam/fhsenv.nix
+++ b/pkgs/games/steam/fhsenv.nix
@@ -15,7 +15,6 @@
 let
   commonTargetPkgs = pkgs: with pkgs;
     [
-      steamPackages.steam-fonts
       # Needed for operating system detection until
       # https://github.com/ValveSoftware/steam-for-linux/issues/5909 is resolved
       lsb-release
diff --git a/pkgs/games/steam/fonts.nix b/pkgs/games/steam/fonts.nix
deleted file mode 100644
index 65efd42a22a4..000000000000
--- a/pkgs/games/steam/fonts.nix
+++ /dev/null
@@ -1,20 +0,0 @@
-{ stdenv, fetchurl, unzip }:
-
-stdenv.mkDerivation {
-  pname = "steam-fonts";
-  version = "1";
-
-  src = fetchurl {
-    url = "https://support.steampowered.com/downloads/1974-YFKL-4947/SteamFonts.zip";
-    sha256 = "1cgygmwich5f1jhhbmbkkpnzasjl8gy36xln76n6r2gjh6awqfx0";
-  };
-
-  nativeBuildInputs = [ unzip ];
-
-  sourceRoot = ".";
-
-  installPhase = ''
-    mkdir -p $out/share/fonts/truetype
-    cp -r *.TTF *.ttf $out/share/fonts/truetype
-  '';
-}
diff --git a/pkgs/games/unciv/default.nix b/pkgs/games/unciv/default.nix
index d58c9aee0de4..50db51b4e89e 100644
--- a/pkgs/games/unciv/default.nix
+++ b/pkgs/games/unciv/default.nix
@@ -25,11 +25,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "unciv";
-  version = "3.19.8";
+  version = "3.19.12";
 
   src = fetchurl {
     url = "https://github.com/yairm210/Unciv/releases/download/${version}/Unciv.jar";
-    sha256 = "sha256-ubMREVcislhkA3pzxuqI+HpBHq9vbMa8nyq0qhTh2x8=";
+    sha256 = "sha256-PALrOyaUYXyNH+QdE8oy1TM5U4SZjw1N0NJ2BKiqjtU=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/servers/adguardhome/bins.nix b/pkgs/servers/adguardhome/bins.nix
index 1e4e00f95961..1c2f0621b5d0 100644
--- a/pkgs/servers/adguardhome/bins.nix
+++ b/pkgs/servers/adguardhome/bins.nix
@@ -1,19 +1,19 @@
 { fetchurl, fetchzip }:
 {
 "x86_64-darwin" = fetchzip {
-  sha256 = "sha256-mKCqFMkTei7n/eI9s3aiAKc4jdnRA121TOizRHON1ic==";
-  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.4/AdGuardHome_darwin_amd64.zip";
+  sha256 = "sha256-bTbjkBHOjcI78+jyJJ1JGe/WrmTxXi5RRB1yQO2zuYw=";
+  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.5/AdGuardHome_darwin_amd64.zip";
 };
 "i686-linux" = fetchurl {
-  sha256 = "sha256-N+S2BWUskEHt5YjpncmiurdgQ6TN35TWN8Zv7bM3a5k=";
-  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.4/AdGuardHome_linux_386.tar.gz";
+  sha256 = "sha256-wdzj7P+Hhm65i5hY4l2Ty486W473coZyZnCbzx9Poro=";
+  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.5/AdGuardHome_linux_386.tar.gz";
 };
 "x86_64-linux" = fetchurl {
-  sha256 = "sha256-p665fB2lVSLpWIYlTNW+ZGOohpobdvOs0AIQ1l9BlmE=";
-  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.4/AdGuardHome_linux_amd64.tar.gz";
+  sha256 = "sha256-sZQe8rNYD0gBSpNeXS+4hbqoT5nUFbkQSI3c6VuQOC8=";
+  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.5/AdGuardHome_linux_amd64.tar.gz";
 };
 "aarch64-linux" = fetchurl {
-  sha256 = "sha256-oomkIHeQDTNDp6A6CcMv2s89PkuKpGVV4iLCxcj0Xsc=";
-  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.4/AdGuardHome_linux_arm64.tar.gz";
+  sha256 = "sha256-9JsGzFf03en2ClrodglREsYqrwr6j/vypsfEVaMzCTI=";
+  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.5/AdGuardHome_linux_arm64.tar.gz";
 };
 }
diff --git a/pkgs/servers/adguardhome/default.nix b/pkgs/servers/adguardhome/default.nix
index 0425116934b0..03d2b2ec9666 100644
--- a/pkgs/servers/adguardhome/default.nix
+++ b/pkgs/servers/adguardhome/default.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "adguardhome";
-  version = "0.107.4";
+  version = "0.107.5";
 
   src = (import ./bins.nix { inherit fetchurl fetchzip; }).${stdenv.hostPlatform.system};
 
diff --git a/pkgs/tools/filesystems/e2fsprogs/default.nix b/pkgs/tools/filesystems/e2fsprogs/default.nix
index d630c7d43f61..6fbc0b9b45f2 100644
--- a/pkgs/tools/filesystems/e2fsprogs/default.nix
+++ b/pkgs/tools/filesystems/e2fsprogs/default.nix
@@ -1,5 +1,6 @@
 { lib, stdenv, buildPackages, fetchurl, fetchpatch, pkg-config, libuuid, gettext, texinfo
 , shared ? !stdenv.hostPlatform.isStatic
+, e2fsprogs, runCommand
 }:
 
 stdenv.mkDerivation rec {
@@ -65,6 +66,15 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  passthru.tests = {
+    simple-filesystem = runCommand "e2fsprogs-create-fs" {} ''
+      mkdir -p $out
+      truncate -s10M $out/disc
+      ${e2fsprogs}/bin/mkfs.ext4 $out/disc | tee $out/success
+      ${e2fsprogs}/bin/e2fsck -n $out/disc | tee $out/success
+      [ -e $out/success ]
+    '';
+  };
   meta = with lib; {
     homepage = "http://e2fsprogs.sourceforge.net/";
     changelog = "http://e2fsprogs.sourceforge.net/e2fsprogs-release.html#${version}";
diff --git a/pkgs/tools/misc/calamares/default.nix b/pkgs/tools/misc/calamares/default.nix
index 907420b82dec..ad4158c10d50 100644
--- a/pkgs/tools/misc/calamares/default.nix
+++ b/pkgs/tools/misc/calamares/default.nix
@@ -6,12 +6,12 @@
 
 mkDerivation rec {
   pname = "calamares";
-  version = "3.2.51";
+  version = "3.2.53";
 
   # release including submodule
   src = fetchurl {
     url = "https://github.com/${pname}/${pname}/releases/download/v${version}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-MOs+VoqzHYRSXbOO8voj+3jvtYQnWyYAcTelS594LXA=";
+    sha256 = "sha256-LWkgQsvP7XmupBDSAnbwewWRT+ZaALyDFw3w7iz66X0=";
   };
 
   nativeBuildInputs = [ cmake extra-cmake-modules ];
diff --git a/pkgs/tools/misc/clipster/default.nix b/pkgs/tools/misc/clipster/default.nix
index 4e278b8cc620..e8bbb9540a11 100644
--- a/pkgs/tools/misc/clipster/default.nix
+++ b/pkgs/tools/misc/clipster/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation  rec {
   pname = "clipster";
-  version = "2.0.2";
+  version = "2.1.1";
 
   src = fetchFromGitHub {
     owner = "mrichar1";
     repo = "clipster";
     rev = version;
-    sha256 = "0582r8840dk4k4jj1zq6kmyh7z9drcng099bj7f4wvr468nb9z1p";
+    sha256 = "sha256-MLLkFsBBQtb7RFQN+uoEmuCn5bnbkYsqoyWGZtTCI2U=";
   };
 
   pythonEnv = python3.withPackages(ps: with ps; [ pygobject3 ]);
diff --git a/pkgs/tools/security/cosign/default.nix b/pkgs/tools/security/cosign/default.nix
index 5bfc16718bf7..63d36e99032e 100644
--- a/pkgs/tools/security/cosign/default.nix
+++ b/pkgs/tools/security/cosign/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "cosign";
-  version = "1.5.2";
+  version = "1.6.0";
 
   src = fetchFromGitHub {
     owner = "sigstore";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-37jahAGgQn7HwwdRTlAS/oJQ3BxTkMViI6iJMBYFgjI=";
+    sha256 = "sha256-jAkTIO+tmb1vjS2eRWU9Fau7qzPCBlXJCk00iwNpULE=";
   };
 
   buildInputs = lib.optional (stdenv.isLinux && pivKeySupport) (lib.getDev pcsclite)
@@ -16,19 +16,36 @@ buildGoModule rec {
 
   nativeBuildInputs = [ pkg-config installShellFiles ];
 
-  vendorSha256 = "sha256-d3aOX4iMlhlxgYbqCHCIFKXunVha0Fw4ZBmy4OA6EhI=";
+  vendorSha256 = "sha256-E9zeRlPIIoXo/EfagHC3aDnW747SdsPiqIA384D7NQI=";
 
-  excludedPackages = "\\(sample\\|webhook\\|help\\)";
+  subPackages = [
+    "cmd/cosign"
+    "cmd/cosign/webhook"
+    "cmd/sget"
+  ];
 
   tags = [] ++ lib.optionals pivKeySupport [ "pivkey" ] ++ lib.optionals pkcs11Support [ "pkcs11key" ];
 
-  ldflags = [ "-s" "-w" "-X github.com/sigstore/cosign/pkg/version.GitVersion=v${version}" ];
+  ldflags = [
+    "-s"
+    "-w"
+    "-X sigs.k8s.io/release-utils/version.gitVersion=v${version}"
+    "-X sigs.k8s.io/release-utils/version.gitTreeState=clean"
+  ];
 
-  postPatch = ''
-    rm pkg/cosign/tuf/client_test.go # Require network access
-    rm internal/pkg/cosign/fulcio/signer_test.go # Require network access
-    rm internal/pkg/cosign/rekor/signer_test.go # Require network access
+  postBuild = ''
+    # cmd/cosign/webhook should be called cosigned
+    mv $GOPATH/bin/{webhook,cosigned}
+  '';
+
+  preCheck = ''
+    # test all paths
+    unset subPackages
+
+    rm cmd/cosign/cli/fulcio/fulcioroots/fulcioroots_test.go # Require network access
     rm pkg/cosign/kubernetes/webhook/validator_test.go # Require network access
+    rm pkg/cosign/tlog_test.go # Require network access
+    rm pkg/cosign/tuf/client_test.go # Require network access
   '';
 
   postInstall = ''
diff --git a/pkgs/tools/text/kdiff3/default.nix b/pkgs/tools/text/kdiff3/default.nix
index 1362591e24c1..07f82c08591a 100644
--- a/pkgs/tools/text/kdiff3/default.nix
+++ b/pkgs/tools/text/kdiff3/default.nix
@@ -14,11 +14,11 @@
 
 mkDerivation rec {
   pname = "kdiff3";
-  version = "1.9.4";
+  version = "1.9.5";
 
   src = fetchurl {
     url = "https://download.kde.org/stable/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-oTBxLO7wdN9pFCaQn8SjMrZvTD8UkKVIq1v7RjFsOFo=";
+    sha256 = "sha256-CDchWW2dQ3O8LxKYOUqN21tVp61NckKTOnzYrmRoPBo=";
   };
 
   buildInputs = [ boost ];