diff --git a/nixos/modules/services/web-apps/keycloak.nix b/nixos/modules/services/web-apps/keycloak.nix
index 2d817ca19234..a1855e1c1a79 100644
--- a/nixos/modules/services/web-apps/keycloak.nix
+++ b/nixos/modules/services/web-apps/keycloak.nix
@@ -540,7 +540,8 @@ in
               db = if cfg.database.type == "postgresql" then "postgres" else cfg.database.type;
               db-username = if databaseActuallyCreateLocally then "keycloak" else cfg.database.username;
               db-password._secret = cfg.database.passwordFile;
-              db-url-host = "${cfg.database.host}:${toString cfg.database.port}";
+              db-url-host = cfg.database.host;
+              db-url-port = toString cfg.database.port;
               db-url-database = if databaseActuallyCreateLocally then "keycloak" else cfg.database.name;
               db-url-properties = prefixUnlessEmpty "?" dbProps;
               db-url = null;
diff --git a/nixos/tests/openssh.nix b/nixos/tests/openssh.nix
index 003813379e69..4083f5906d79 100644
--- a/nixos/tests/openssh.nix
+++ b/nixos/tests/openssh.nix
@@ -80,17 +80,21 @@ in {
 
         client.wait_for_unit("network.target")
         client.succeed(
-            "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no server 'echo hello world' >&2"
+            "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no server 'echo hello world' >&2",
+            timeout=30
         )
         client.succeed(
-            "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no server 'ulimit -l' | grep 1024"
+            "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no server 'ulimit -l' | grep 1024",
+            timeout=30
         )
 
         client.succeed(
-            "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no server_lazy 'echo hello world' >&2"
+            "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no server_lazy 'echo hello world' >&2",
+            timeout=30
         )
         client.succeed(
-            "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no server_lazy 'ulimit -l' | grep 1024"
+            "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no server_lazy 'ulimit -l' | grep 1024",
+            timeout=30
         )
 
     with subtest("configured-authkey"):
@@ -99,10 +103,12 @@ in {
         )
         client.succeed("chmod 600 privkey.snakeoil")
         client.succeed(
-            "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i privkey.snakeoil server true"
+            "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i privkey.snakeoil server true",
+            timeout=30
         )
         client.succeed(
-            "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i privkey.snakeoil server_lazy true"
+            "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i privkey.snakeoil server_lazy true",
+            timeout=30
         )
 
     with subtest("localhost-only"):
diff --git a/pkgs/applications/misc/libosmocore/default.nix b/pkgs/applications/misc/libosmocore/default.nix
index 273ca0245a2b..2b825705b006 100644
--- a/pkgs/applications/misc/libosmocore/default.nix
+++ b/pkgs/applications/misc/libosmocore/default.nix
@@ -1,16 +1,25 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, pkg-config
-, pcsclite, talloc, python2, gnutls
+{ lib, stdenv
+, autoreconfHook
+, fetchFromGitHub
+, gnutls
+, libmnl
+, libusb1
+, lksctp-tools
+, pcsclite
+, pkg-config
+, python3
+, talloc
 }:
 
 stdenv.mkDerivation rec {
   pname = "libosmocore";
-  version = "1.2.0";
+  version = "1.6.0";
 
   src = fetchFromGitHub {
     owner = "osmocom";
     repo = "libosmocore";
     rev = version;
-    sha256 = "1535y6r4csvslrxcki80ya6zhhc5jw2nvy9bymb55ln77pf853vg";
+    hash = "sha256-AjOyZiLlXhsetbyMBuUssoNxk22LzGOkZpeLt4vKli4=";
   };
 
   propagatedBuildInputs = [
@@ -18,11 +27,17 @@ stdenv.mkDerivation rec {
   ];
 
   nativeBuildInputs = [
-    autoreconfHook pkg-config
+    autoreconfHook
+    pkg-config
+    python3
   ];
 
   buildInputs = [
-    pcsclite python2 gnutls
+    gnutls
+    libmnl
+    libusb1
+    lksctp-tools
+    pcsclite
   ];
 
   enableParallelBuilding = true;
diff --git a/pkgs/applications/misc/upwork/default.nix b/pkgs/applications/misc/upwork/default.nix
index c6a79aa0e61e..34cc97023989 100644
--- a/pkgs/applications/misc/upwork/default.nix
+++ b/pkgs/applications/misc/upwork/default.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "upwork";
-  version = "5.6.10.7";
+  version = "5.6.10.13";
 
   src = fetchurl {
-    url = "https://upwork-usw2-desktopapp.upwork.com/binaries/v5_6_10_7_f806fd1250954801/${pname}_${version}_amd64.deb";
-    sha256 = "6fe11cd53ffb66a02aa771153c4f58af34fea25847ee5bc13802fec9b0db0280";
+    url = "https://upwork-usw2-desktopapp.upwork.com/binaries/v5_6_10_13_3c485d1dd2af4f61/${pname}_${version}_amd64.deb";
+    sha256 = "c3e1ecf14c99596f434edf93a2e08f031fbaa167025d1280cf19f68b829d6b79";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.json b/pkgs/applications/networking/browsers/chromium/upstream-info.json
index 0df1f31fb50d..bb994f7008f4 100644
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.json
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json
@@ -45,9 +45,9 @@
     }
   },
   "ungoogled-chromium": {
-    "version": "101.0.4951.41",
-    "sha256": "0dzsbr309n70jg7fpq2qfnrgcm4553akvdmnzhss1fc85s467609",
-    "sha256bin64": "12nzzsp4040mwc7jah5w0p58ckv8s16wv6ylf6vlmfby06a4xlkq",
+    "version": "101.0.4951.54",
+    "sha256": "1d808a7mvg0nd0mm20c1ny5kdvb2xvrs8vz4nnk456ix8pywcv62",
+    "sha256bin64": "1m6s6xf2wvz535w6jskk3pnibvsjpzmbxvd9rlxmqr08y219gp5y",
     "deps": {
       "gn": {
         "version": "2022-03-14",
@@ -56,8 +56,8 @@
         "sha256": "0nql15ckjqkm001xajq3qyn4h4q80i7x6dm9zinxxr1a8q5lppx3"
       },
       "ungoogled-patches": {
-        "rev": "101.0.4951.41-1",
-        "sha256": "19m31bd04yvba3w5iymkxfjnmilas3cfp383m9fl6pd4wwhy9md0"
+        "rev": "101.0.4951.54-1",
+        "sha256": "0zhzy7llqddvym992pwhkgqh2f6ywjqqg0bhahl6c0np95gzhpbs"
       }
     }
   }
diff --git a/pkgs/applications/networking/cloudflared/default.nix b/pkgs/applications/networking/cloudflared/default.nix
index 566178d8305e..c75c5824283f 100644
--- a/pkgs/applications/networking/cloudflared/default.nix
+++ b/pkgs/applications/networking/cloudflared/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "cloudflared";
-  version = "2022.4.1";
+  version = "2022.5.0";
 
   src = fetchFromGitHub {
     owner  = "cloudflare";
     repo   = "cloudflared";
     rev    = version;
-    hash   = "sha256-dgvXbWtLP6sXBlqcx/xpw9LIbcE4VlYZQO5rrS34+9I=";
+    hash   = "sha256-vz0fxSzx0vOpZy6/MVfZ467c9qdHUWZIL5wklTnnBBA=";
   };
 
   vendorSha256 = null;
diff --git a/pkgs/applications/networking/cluster/ssm-session-manager-plugin/default.nix b/pkgs/applications/networking/cluster/ssm-session-manager-plugin/default.nix
index 2caa0dc22808..1fd71cb8e991 100644
--- a/pkgs/applications/networking/cluster/ssm-session-manager-plugin/default.nix
+++ b/pkgs/applications/networking/cluster/ssm-session-manager-plugin/default.nix
@@ -1,13 +1,13 @@
 { stdenv, lib, fetchurl, autoPatchelfHook, dpkg, awscli, unzip }:
 let
-  ver = "1.2.54.0";
+  ver = "1.2.312.0";
   source =
     if stdenv.isDarwin then {
       url = "https://s3.amazonaws.com/session-manager-downloads/plugin/${ver}/mac/sessionmanager-bundle.zip";
-      sha256 = "kgxoQrtu2tsV5t/3oA+Z2juY24hPOznPGjlQMsqOIZg=";
+      sha256 = "50aac34a4dedddf20c20be24989ee5d33b46a72187791715fb9b395b54db8ef9";
     } else {
       url = "https://s3.amazonaws.com/session-manager-downloads/plugin/${ver}/ubuntu_64bit/session-manager-plugin.deb";
-      sha256 = "uug1cT4yRxNQcf+zWz0mi72G4EGa3eZHVuG36INSqrM=";
+      sha256 = "2e51ce5bf8f23a1e590fff866bbdadcf82aa03c5054c671d9115482a1b263cc7";
     };
   archivePath = if stdenv.isDarwin then "sessionmanager-bundle" else "usr/local/sessionmanagerplugin";
 in
diff --git a/pkgs/applications/networking/firewalld/default.nix b/pkgs/applications/networking/firewalld/default.nix
new file mode 100644
index 000000000000..b937c35a3f96
--- /dev/null
+++ b/pkgs/applications/networking/firewalld/default.nix
@@ -0,0 +1,104 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, autoreconfHook
+, bash
+, docbook_xml_dtd_42
+, docbook-xsl-nons
+, glib
+, gobject-introspection
+, gtk3
+, intltool
+, libnotify
+, libxml2
+, libxslt
+, networkmanagerapplet
+, pkg-config
+, python3
+, wrapGAppsNoGuiHook
+, withGui ? false
+}:
+
+let
+  pythonPath = python3.withPackages (ps: with ps; [
+    dbus-python
+    nftables
+    pygobject3
+  ] ++ lib.optionals withGui [
+    pyqt5
+    pyqt5_sip
+  ]);
+in
+stdenv.mkDerivation rec {
+  pname = "firewalld";
+  version = "1.1.1";
+
+  src = fetchFromGitHub {
+    owner = "firewalld";
+    repo = "firewalld";
+    rev = "v${version}";
+    sha256 = "sha256-w8TbovIhOhJAUZWbKdBd/+db8Hro/ttlxWZDcrCXX4Q=";
+  };
+
+  patches = [
+    ./respect-xml-catalog-files-var.patch
+  ];
+
+  postPatch = ''
+    substituteInPlace src/firewall/config/__init__.py.in \
+      --replace "/usr/share" "$out/share"
+
+    for file in config/firewall-{applet,config}.desktop.in; do
+      substituteInPlace $file \
+        --replace "/usr/bin/" "$out/bin/"
+    done
+  '' + lib.optionalString withGui ''
+    substituteInPlace src/firewall-applet.in \
+      --replace "/usr/bin/nm-connection-editor" "${networkmanagerapplet}/bin/nm-conenction-editor"
+  '';
+
+  nativeBuildInputs = [
+    autoreconfHook
+    docbook_xml_dtd_42
+    docbook-xsl-nons
+    glib
+    intltool
+    libxml2
+    libxslt
+    pkg-config
+    python3
+    python3.pkgs.wrapPython
+  ] ++ lib.optionals withGui [
+    gobject-introspection
+    wrapGAppsNoGuiHook
+  ];
+
+  buildInputs = [
+    bash
+    glib
+  ] ++ lib.optionals withGui [
+    gtk3
+    libnotify
+    pythonPath
+  ];
+
+  dontWrapGApps = true;
+
+  preFixup = lib.optionalString withGui ''
+    makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
+  '';
+
+  postFixup = ''
+    chmod +x $out/share/firewalld/*.py $out/share/firewalld/testsuite/python/*.py $out/share/firewalld/testsuite/{,integration/}testsuite
+    patchShebangs --host $out/share/firewalld/testsuite/{,integration/}testsuite $out/share/firewalld/*.py
+    wrapPythonProgramsIn "$out/bin" "$out ${pythonPath}"
+    wrapPythonProgramsIn "$out/share/firewalld/testsuite/python" "$out ${pythonPath}"
+  '';
+
+  meta = with lib; {
+    description = "Firewall daemon with D-Bus interface";
+    homepage = "https://github.com/firewalld/firewalld";
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ SuperSandro2000 ];
+  };
+}
diff --git a/pkgs/applications/networking/firewalld/respect-xml-catalog-files-var.patch b/pkgs/applications/networking/firewalld/respect-xml-catalog-files-var.patch
new file mode 100644
index 000000000000..03a10121c6be
--- /dev/null
+++ b/pkgs/applications/networking/firewalld/respect-xml-catalog-files-var.patch
@@ -0,0 +1,13 @@
+--- a/m4/jh_path_xml_catalog.m4
++++ b/m4/jh_path_xml_catalog.m4
+@@ -40,8 +40,8 @@ AC_DEFUN([JH_CHECK_XML_CATALOG],
+ [
+   AC_REQUIRE([JH_PATH_XML_CATALOG],[JH_PATH_XML_CATALOG(,[:])])dnl
+   AC_MSG_CHECKING([for ifelse([$2],,[$1],[$2]) in XML catalog])
+-  if $jh_found_xmlcatalog && \
+-     AC_RUN_LOG([$XMLCATALOG --noout "$XML_CATALOG_FILE" "$1" >&2]); then
++  # empty argument forces libxml to use XML_CATALOG_FILES variable
++  if AC_RUN_LOG([$XMLCATALOG --noout "" "$1" >&2]); then
+     AC_MSG_RESULT([found])
+     ifelse([$3],,,[$3
+ ])dnl
diff --git a/pkgs/applications/networking/seafile-client/default.nix b/pkgs/applications/networking/seafile-client/default.nix
index f4d79d00d8b1..adda284a6b8c 100644
--- a/pkgs/applications/networking/seafile-client/default.nix
+++ b/pkgs/applications/networking/seafile-client/default.nix
@@ -9,7 +9,9 @@ mkDerivation rec {
   src = fetchFromGitHub {
     owner = "haiwen";
     repo = "seafile-client";
-    rev = "v${version}";
+    # Tag v8.0.7 used to point to this commit, but was re-tagged later to a state
+    # that fails to link properly
+    rev = "8b96abf64e6aa19e3beeff6b322bcd6d28120bdd";
     sha256 = "00wfr7dvbyl7pg1xgssgz8a94c7c4n5r9266lhy9qcbz456hdcgj";
   };
 
diff --git a/pkgs/applications/networking/zerobin/default.nix b/pkgs/applications/networking/zerobin/default.nix
index 56d5274751fc..ca55085d8085 100644
--- a/pkgs/applications/networking/zerobin/default.nix
+++ b/pkgs/applications/networking/zerobin/default.nix
@@ -40,7 +40,7 @@ python3Packages.buildPythonApplication rec {
     # relax version constraints of some dependencies
     substituteInPlace setup.cfg \
       --replace "clize==4.1.1" "clize" \
-      --replace "bleach==3.1.5" "bleach>=3.1.5,<5" \
+      --replace "bleach==3.1.5" "bleach>=3.1.5,<6" \
       --replace "bottle==0.12.18" "bottle>=0.12.18,<1" \
       --replace "Paste==3.4.3" "Paste>=3.4.3,<4"
   '';
diff --git a/pkgs/development/interpreters/pixie/default.nix b/pkgs/development/interpreters/pixie/default.nix
deleted file mode 100644
index 5b93357b2665..000000000000
--- a/pkgs/development/interpreters/pixie/default.nix
+++ /dev/null
@@ -1,94 +0,0 @@
-{ lib, stdenv, fetchFromGitHub, fetchurl, python2, makeWrapper, pkg-config, gcc,
-  pypy, libffi, libedit, libuv, boost, zlib,
-  variant ? "jit", buildWithPypy ? false }:
-
-let
-  commit-count = "1364";
-  common-flags = "--thread --gcrootfinder=shadowstack --continuation";
-  variants = {
-    jit = { flags = "--opt=jit"; target = "target.py"; };
-    jit-preload = { flags = "--opt=jit"; target = "target_preload.py"; };
-    no-jit = { flags = ""; target = "target.py"; };
-    no-jit-preload = { flags = ""; target = "target_preload.py"; };
-  };
-  pixie-src = fetchFromGitHub {
-    owner = "pixie-lang";
-    repo = "pixie";
-    rev = "5eb0ccbe8b0087d3a5f2d0bbbc6998d624d3cd62";
-    sha256 = "sha256-dQ8ncH0IqU42WYxwBgjH6QQfvMIo7RZpv81UAUsPw10=";
-  };
-  pypy-tag = "91db1a9";
-  pypy-src = fetchurl {
-    name = "pypy-src-${pypy-tag}";
-    url = "https://bitbucket.org/pypy/pypy/get/${pypy-tag}.tar.bz2";
-    sha256 = "0ylbqvhbcp5m09l15i2q2h3a0vjd055x2r37cq71lkhgmmaxrwbq";
-  };
-  libs = [ libffi libedit libuv boost.dev boost.out zlib ];
-  include-path = lib.concatStringsSep ":"
-                   (map (p: "${p}/include") libs);
-  library-path = lib.concatStringsSep ":"
-                   (map (p: "${p}/lib") libs);
-  bin-path = lib.concatStringsSep ":"
-               (map (p: "${p}/bin") [ gcc ]);
-  build = {flags, target}: stdenv.mkDerivation rec {
-    pname = "pixie";
-    version = "0-r${commit-count}-${variant}";
-    nativeBuildInputs = [ makeWrapper pkg-config ];
-    buildInputs = libs;
-    PYTHON = if buildWithPypy
-      then "${pypy}/pypy-c/pypy-c"
-      else python2.interpreter;
-    unpackPhase = ''
-      cp -R ${pixie-src} pixie-src
-      mkdir pypy-src
-      (cd pypy-src
-       tar --strip-components=1 -xjf ${pypy-src})
-      chmod -R +w pypy-src pixie-src
-    '';
-    patchPhase = ''
-      (cd pixie-src
-       patch -p1 < ${./load_paths.patch}
-       libraryPaths='["${libuv}" "${libedit}" "${libffi.dev}" "${boost.dev}" "${boost.out}" "${zlib.dev}"]'
-       export libraryPaths
-       substituteAllInPlace ./pixie/ffi-infer.pxi)
-    '';
-    buildPhase = ''(
-      PYTHONPATH="`pwd`/pypy-src:$PYTHONPATH";
-      RPYTHON="`pwd`/pypy-src/rpython/bin/rpython";
-      cd pixie-src
-      $PYTHON $RPYTHON ${common-flags} ${target}
-      find pixie -name "*.pxi" -exec ./pixie-vm -c {} \;
-    )'';
-    LD_LIBRARY_PATH = library-path;
-    C_INCLUDE_PATH = include-path;
-    LIBRARY_PATH = library-path;
-    PATH = bin-path;
-    installPhase = ''
-      mkdir -p $out/share $out/bin
-      cp pixie-src/pixie-vm $out/share/pixie-vm
-      cp -R pixie-src/pixie $out/share/pixie
-      makeWrapper $out/share/pixie-vm $out/bin/pixie \
-        --prefix LD_LIBRARY_PATH : ${LD_LIBRARY_PATH} \
-        --prefix C_INCLUDE_PATH : ${C_INCLUDE_PATH} \
-        --prefix LIBRARY_PATH : ${LIBRARY_PATH} \
-        --prefix PATH : ${PATH}
-    '';
-    doCheck = true;
-    checkPhase = ''
-      RES=$(./pixie-src/pixie-vm -e "(print :ok)")
-      if [ "$RES" != ":ok" ]; then
-        echo "ERROR Unexpected output: '$RES'"
-        return 1
-      else
-        echo "$RES"
-      fi
-    '';
-    meta = {
-      description = "A clojure-like lisp, built with the pypy vm toolkit";
-      homepage = "https://github.com/pixie-lang/pixie";
-      license = lib.licenses.lgpl3;
-      platforms = ["x86_64-linux" "i686-linux" "x86_64-darwin"];
-      maintainers = with lib.maintainers; [ bendlas ];
-    };
-  };
-in build (builtins.getAttr variant variants)
diff --git a/pkgs/development/interpreters/pixie/dust.nix b/pkgs/development/interpreters/pixie/dust.nix
deleted file mode 100644
index 9c39b5c5ce63..000000000000
--- a/pkgs/development/interpreters/pixie/dust.nix
+++ /dev/null
@@ -1,46 +0,0 @@
-{ lib, stdenv, fetchFromGitHub
-, pixie, rlwrap
-}:
-
-stdenv.mkDerivation rec {
-  pname = "dust";
-  version = "0-91";
-
-  src = fetchFromGitHub {
-    owner = "pixie-lang";
-    repo = "dust";
-    rev = "efe469661e749a71e86858fd006f61464810575a";
-    sha256 = "09n57b6haxwask9m8vimv42ikczf7lgfc7m9izjrcqgs0padvfzc";
-  };
-
-  buildInputs = [ pixie ];
-
-  patches = [ ./make-paths-configurable.patch ];
-
-  configurePhase = ''
-    pixiePath="${pixie}/bin/pixie" \
-    basePath="$out/share/dust" \
-    rlwrapPath="${rlwrap}/bin/rlwrap" \
-      substituteAll dust.in dust
-    chmod +x dust
-  '';
-
-  # FIXME: AOT for dust
-  #  buildPhase = ''
-  #    find . -name "*.pxi" -exec pixie-vm -c {} \;
-  #  '';
-
-  installPhase = ''
-    mkdir -p $out/bin $out/share/dust
-    cp -a src/ run.pxi $out/share/dust
-    mv dust $out/bin/dust
-  '';
-
-  meta = with lib; {
-    description = "Provides tooling around pixie, e.g. a nicer repl, running tests and fetching dependencies";
-    homepage = src.meta.homepage;
-    maintainers = with maintainers; [ ];
-    license = licenses.lgpl3;
-    platforms = platforms.unix;
-  };
-}
diff --git a/pkgs/development/interpreters/pixie/load_paths.patch b/pkgs/development/interpreters/pixie/load_paths.patch
deleted file mode 100644
index a36d280c5867..000000000000
--- a/pkgs/development/interpreters/pixie/load_paths.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-diff --git a/pixie/ffi-infer.pxi b/pixie/ffi-infer.pxi
-index 9f13ac7..74301c2 100644
---- a/pixie/ffi-infer.pxi
-+++ b/pixie/ffi-infer.pxi
-@@ -1,15 +1,12 @@
- (ns pixie.ffi-infer
-   (:require [pixie.io-blocking :as io]))
- 
-+(defn -add-library-path [p]
-+  (swap! load-paths conj (str p "/include"))
-+  (swap! load-paths conj (str p "/lib")))
- 
--(defn -add-rel-path [rel]
--  (swap! load-paths conj (str (first @load-paths) "/" rel)))
--
--(-add-rel-path "lib")
--(-add-rel-path "include")
--(-add-rel-path "../lib")
--(-add-rel-path "../include")
--
-+(doseq [lp @libraryPaths@]
-+  (-add-library-path lp))
- 
- (def *config* nil)
- (set-dynamic! (var *config*))
diff --git a/pkgs/development/interpreters/pixie/make-paths-configurable.patch b/pkgs/development/interpreters/pixie/make-paths-configurable.patch
deleted file mode 100644
index e22e83d2ee74..000000000000
--- a/pkgs/development/interpreters/pixie/make-paths-configurable.patch
+++ /dev/null
@@ -1,119 +0,0 @@
-From 0cbb82e606610d36e52c70d888995fbbf9b0d7c8 Mon Sep 17 00:00:00 2001
-From: Herwig Hochleitner <herwig@bendlas.net>
-Date: Sun, 28 Feb 2016 16:34:14 +0100
-Subject: [PATCH] make paths configurable
-
----
- dust    | 52 ----------------------------------------------------
- dust.in | 43 +++++++++++++++++++++++++++++++++++++++++++
- 2 files changed, 43 insertions(+), 52 deletions(-)
- delete mode 100755 dust
- create mode 100755 dust.in
-
-diff --git a/dust b/dust
-deleted file mode 100755
-index ffced9b..0000000
---- a/dust
-+++ /dev/null
-@@ -1,52 +0,0 @@
--#!/usr/bin/env bash
--
--base_path=$0
--if [ -L "$base_path" ]; then
--    base_path=`readlink $base_path`
--fi
--base_path=`dirname $base_path`
--
--pixie_path=`which pixie-vm`
--if [ -z "$pixie_path" ]; then
--    echo "Error: 'pixie-vm' must be on your PATH"
--    exit 1
--fi
--
--function set_load_path() {
--    load_path=""
--    if ([ -f "project.edn" ] || [ -f "project.pxi" ]) && [ -f ".load-path" ]; then
--        load_path="`cat .load-path`"
--    fi
--}
--
--if [ ! -f "project.edn" ] && [ -f "project.pxi" ]; then
--	echo "Warning: 'project.pxi' is deprecated, please use 'project.edn'."
--	echo "To start you can run the following command:"
--	echo "  pixie-vm -l $base_path/src -e '(require dust.project :as p) (p/load-project!) (prn (dissoc @p/*project* :path))'"
--	echo
--fi
--
--set_load_path
--run_dust="$pixie_path -l $base_path/src $load_path $base_path/run.pxi"
--
--case $1 in
--    ""|"repl")
--        rlwrap_cmd=""
--        if [ -n "`which rlwrap`" ]; then
--            rlwrap_cmd="rlwrap -aignored -n"
--        fi
--        $rlwrap_cmd $pixie_path $load_path
--        ;;
--    "run")
--        shift
--        file=$1
--        shift
--        $pixie_path $load_path $file $@
--        ;;
--    -h|--help)
--        $run_dust help
--        ;;
--    *)
--        $run_dust $@
--        ;;
--esac
-diff --git a/dust.in b/dust.in
-new file mode 100755
-index 0000000..44a7fbd
---- /dev/null
-+++ b/dust.in
-@@ -0,0 +1,40 @@
-+#!/usr/bin/env bash
-+
-+base_path=@basePath@
-+pixie_path=@pixiePath@
-+rlwrap_cmd=@rlwrapPath@
-+
-+function set_load_path() {
-+    load_path=""
-+    if ([ -f "project.edn" ] || [ -f "project.pxi" ]) && [ -f ".load-path" ]; then
-+        load_path="`cat .load-path`"
-+    fi
-+}
-+
-+if [ ! -f "project.edn" ] && [ -f "project.pxi" ]; then
-+	echo "Warning: 'project.pxi' is deprecated, please use 'project.edn'."
-+	echo "To start you can run the following command:"
-+	echo "  pixie-vm -l $base_path/src -e '(require dust.project :as p) (p/load-project!) (prn (dissoc @p/*project* :path))'"
-+	echo
-+fi
-+
-+set_load_path
-+run_dust="$pixie_path -l $base_path/src $load_path $base_path/run.pxi"
-+
-+case $1 in
-+    ""|"repl")
-+        $rlwrap_cmd -aignored -n $pixie_path $load_path
-+        ;;
-+    "run")
-+        shift
-+        file=$1
-+        shift
-+        $pixie_path $load_path $file $@
-+        ;;
-+    -h|--help)
-+        $run_dust help
-+        ;;
-+    *)
-+        $run_dust $@
-+        ;;
-+esac
--- 
-2.7.1
-
diff --git a/pkgs/development/libraries/docopt_cpp/default.nix b/pkgs/development/libraries/docopt_cpp/default.nix
index 3de84b684e52..4fae1db9ba3c 100644
--- a/pkgs/development/libraries/docopt_cpp/default.nix
+++ b/pkgs/development/libraries/docopt_cpp/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, cmake, python2 }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, cmake, python3 }:
 
 stdenv.mkDerivation rec {
   version = "0.6.3";
@@ -11,7 +11,15 @@ stdenv.mkDerivation rec {
     sha256 = "0cz3vv7g5snfbsqcf3q8bmd6kv5qp84gj3avwkn4vl00krw13bl7";
   };
 
-  nativeBuildInputs = [ cmake python2 ];
+  patches = [
+    (fetchpatch {
+      name = "python3-for-tests";
+      url = "https://github.com/docopt/docopt.cpp/commit/b3d909dc952ab102a4ad5a1541a41736f35b92ba.patch";
+      hash = "sha256-JJR09pbn3QhYaZAIAjs+pe28+g1VfgHUKspWorHzr8o=";
+    })
+  ];
+
+  nativeBuildInputs = [ cmake python3 ];
 
   cmakeFlags = ["-DWITH_TESTS=ON"];
 
diff --git a/pkgs/development/libraries/goocanvas/2.x.nix b/pkgs/development/libraries/goocanvas/2.x.nix
index 1f2966695d86..f59198a5528e 100644
--- a/pkgs/development/libraries/goocanvas/2.x.nix
+++ b/pkgs/development/libraries/goocanvas/2.x.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, pkg-config, gettext, gtk-doc, gobject-introspection, python2, gtk3, cairo, glib, gnome }:
+{ lib, stdenv, fetchurl, pkg-config, gettext, gtk-doc, gobject-introspection, python3, gtk3, cairo, glib, gnome }:
 
 stdenv.mkDerivation rec {
   pname = "goocanvas";
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "141fm7mbqib0011zmkv3g8vxcjwa7hypmq71ahdyhnj2sjvy4a67";
   };
 
-  nativeBuildInputs = [ pkg-config gettext gtk-doc python2 ];
+  nativeBuildInputs = [ pkg-config gettext gtk-doc python3 ];
   buildInputs = [ gtk3 cairo glib gobject-introspection ];
 
   configureFlags = [
diff --git a/pkgs/development/libraries/libinjection/default.nix b/pkgs/development/libraries/libinjection/default.nix
index 81a1398147ba..d4193f32ccc0 100644
--- a/pkgs/development/libraries/libinjection/default.nix
+++ b/pkgs/development/libraries/libinjection/default.nix
@@ -1,5 +1,5 @@
-{ lib, stdenv, fetchFromGitHub
-, python2
+{ lib, stdenv, fetchFromGitHub, fetchpatch
+, python3
 }:
 
 stdenv.mkDerivation rec {
@@ -13,11 +13,19 @@ stdenv.mkDerivation rec {
     sha256 = "0chsgam5dqr9vjfhdcp8cgk7la6nf3lq44zs6z6si98cq743550g";
   };
 
-  nativeBuildInputs = [ python2 ];
+  nativeBuildInputs = [ python3 ];
 
   strictDeps = true;
 
-  patchPhase = ''
+  patches = [
+    (fetchpatch {
+      name = "support-python3-for-building";
+      url = "https://raw.githubusercontent.com/sysown/proxysql/bed58f92917eb651b80fd8ffa627a485eb320805/deps/libinjection/update-build-py3.diff";
+      hash = "sha256-SPdf57FIDDNpatWe5pjhAiZl5yPMDEv50k0Wj+eWTEM=";
+    })
+  ];
+
+  postPatch = ''
     patchShebangs src
     substituteInPlace src/Makefile \
       --replace /usr/local $out
diff --git a/pkgs/development/python-modules/bleach/default.nix b/pkgs/development/python-modules/bleach/default.nix
index 6d3c7fffe6ad..fce105163a54 100644
--- a/pkgs/development/python-modules/bleach/default.nix
+++ b/pkgs/development/python-modules/bleach/default.nix
@@ -11,12 +11,12 @@
 
 buildPythonPackage rec {
   pname = "bleach";
-  version = "4.1.0";
+  version = "5.0.0";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-CQDYs366YagC7kCsAGH4wrXe4pwZJ90dIz4HXr9acdo=";
+    hash = "sha256-xtbMBUvcnIO0i4CD4jbl8A8jhChmbSzi4IPqpf1WhWU=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/breezy/default.nix b/pkgs/development/python-modules/breezy/default.nix
index 3c24d5f31924..64774a70867a 100644
--- a/pkgs/development/python-modules/breezy/default.nix
+++ b/pkgs/development/python-modules/breezy/default.nix
@@ -3,23 +3,36 @@
 , fetchPypi
 , configobj
 , patiencediff
-, six
+, fastbencode
 , fastimport
 , dulwich
 , launchpadlib
 , testtools
+, pythonOlder
+, installShellFiles
 }:
 
 buildPythonPackage rec {
   pname = "breezy";
-  version = "3.2.1";
+  version = "3.2.2";
+
+  disabled = pythonOlder "3.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-4LJo6xoooq8EUoDDfQIa4y1/8XX0ybmfM6rX2wsp2Fw=";
+    sha256 = "sha256-GHpuRSCN0F2BdQc2cgyDcQz0gJT1R+xAgcVxJZVZpNU=";
   };
 
-  propagatedBuildInputs = [ configobj patiencediff six fastimport dulwich launchpadlib ];
+  nativeBuildInputs = [ installShellFiles ];
+
+  propagatedBuildInputs = [
+    configobj
+    fastbencode
+    patiencediff
+    fastimport
+    dulwich
+    launchpadlib
+  ];
 
   checkInputs = [ testtools ];
 
@@ -29,6 +42,8 @@ buildPythonPackage rec {
   # symlink for bazaar compatibility
   postInstall = ''
     ln -s "$out/bin/brz" "$out/bin/bzr"
+
+    installShellCompletion --cmd brz --bash contrib/bash/brz
   '';
 
   pythonImportsCheck = [ "breezy" ];
@@ -36,7 +51,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Friendly distributed version control system";
     homepage = "https://www.breezy-vcs.org/";
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
     maintainers = [ maintainers.marsam ];
   };
 }
diff --git a/pkgs/development/python-modules/fastbencode/default.nix b/pkgs/development/python-modules/fastbencode/default.nix
new file mode 100644
index 000000000000..87072491cef4
--- /dev/null
+++ b/pkgs/development/python-modules/fastbencode/default.nix
@@ -0,0 +1,26 @@
+{ lib, buildPythonPackage, fetchPypi, python, cython }:
+
+buildPythonPackage rec {
+  pname = "fastbencode";
+  version = "0.0.7";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-tryavlQtBmN5NSlXb0m6iJFQhVT4XQm11tXtevfgxuQ=";
+  };
+
+  nativeBuildInputs = [ cython ];
+
+  pythonImportsCheck = [ "fastbencode" ];
+
+  checkPhase = ''
+    ${python.interpreter} -m unittest fastbencode.tests.test_suite
+  '';
+
+  meta = with lib; {
+    description = "Fast implementation of bencode";
+    homepage = "https://github.com/breezy-team/fastbencode";
+    license = licenses.gpl2Only;
+    maintainers = [ maintainers.marsam ];
+  };
+}
diff --git a/pkgs/development/python-modules/nbclient/default.nix b/pkgs/development/python-modules/nbclient/default.nix
index 1b2071e7f0c5..9c96f71c2813 100644
--- a/pkgs/development/python-modules/nbclient/default.nix
+++ b/pkgs/development/python-modules/nbclient/default.nix
@@ -1,20 +1,21 @@
 { lib, buildPythonPackage, fetchPypi, pythonOlder,
   async_generator, traitlets, nbformat, nest-asyncio, jupyter-client,
   pytest, xmltodict, nbconvert, ipywidgets
-, doCheck ? true
 }:
 
 buildPythonPackage rec {
   pname = "nbclient";
-  version = "0.5.13";
+  version = "0.6.2";
+  format = "setuptools";
+
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-QMUsm148MfrsruafICs/U+ONfBxWPeD63enX7aD9r+g=";
+    hash = "sha256-i0dVPxztB3zXxFN/1dcB1G92gfJLKCdeXMHTR+fJtGs=";
   };
 
-  inherit doCheck;
+  doCheck = false; # Avoid infinite recursion
   checkInputs = [ pytest xmltodict nbconvert ipywidgets ];
   propagatedBuildInputs = [ async_generator traitlets nbformat nest-asyncio jupyter-client ];
 
diff --git a/pkgs/development/python-modules/nbconvert/default.nix b/pkgs/development/python-modules/nbconvert/default.nix
index 5a89210170fe..69aa660f1425 100644
--- a/pkgs/development/python-modules/nbconvert/default.nix
+++ b/pkgs/development/python-modules/nbconvert/default.nix
@@ -5,13 +5,11 @@
 , glibcLocales
 , entrypoints
 , bleach
-, beautifulsoup4
 , mistune
 , nbclient
 , jinja2
 , pygments
 , traitlets
-, testpath
 , jupyter_core
 , jupyterlab-pygments
 , nbformat
@@ -20,15 +18,18 @@
 , tornado
 , jupyter-client
 , defusedxml
+, tinycss2
+, beautifulsoup4
 }:
 
 buildPythonPackage rec {
   pname = "nbconvert";
-  version = "6.4.5";
+  version = "6.5.0";
+  format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-IRY6jiBzwHEJyo85iDbkXv26KqzqaNb3WopUX+8HDU4=";
+    hash = "sha256-Ij5G4nq+hZa4rtVDAfrbukM7f/6oGWpo/Xsf9Qnu6Z0=";
   };
 
   # Add $out/share/jupyter to the list of paths that are used to search for
@@ -44,10 +45,10 @@ buildPythonPackage rec {
   checkInputs = [ pytestCheckHook glibcLocales ];
 
   propagatedBuildInputs = [
-    entrypoints bleach mistune jinja2 pygments traitlets testpath
+    entrypoints bleach mistune jinja2 pygments traitlets
     jupyter_core nbformat ipykernel pandocfilters tornado jupyter-client
-    defusedxml beautifulsoup4
-    (nbclient.override { doCheck = false; }) # avoid infinite recursion
+    defusedxml tinycss2 beautifulsoup4
+    nbclient
     jupyterlab-pygments
   ];
 
diff --git a/pkgs/development/python-modules/nvchecker/default.nix b/pkgs/development/python-modules/nvchecker/default.nix
index d4d9cf1811e0..bc650b7eafe1 100644
--- a/pkgs/development/python-modules/nvchecker/default.nix
+++ b/pkgs/development/python-modules/nvchecker/default.nix
@@ -20,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "nvchecker";
-  version = "2.7";
+  version = "2.8";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -29,7 +29,7 @@ buildPythonPackage rec {
     owner = "lilydjwg";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-OPUqkHLG8PUlD5NP7q/BpKUvmAA8Jk1NvsPPVbImv0A=";
+    hash = "sha256-ikpjR1fEZBsSOE20jxTyarb9Pqn3Fz+TYOzXp0g4G9c=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/snowflake-connector-python/default.nix b/pkgs/development/python-modules/snowflake-connector-python/default.nix
index e4b5d9ee6775..743a7e77afda 100644
--- a/pkgs/development/python-modules/snowflake-connector-python/default.nix
+++ b/pkgs/development/python-modules/snowflake-connector-python/default.nix
@@ -24,12 +24,12 @@
 
 buildPythonPackage rec {
   pname = "snowflake-connector-python";
-  version = "2.7.6";
+  version = "2.7.7";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-MxYo4MoCdkSSuDteR3A72FcRWuKTRrct4y1/t8nsVIs=";
+    sha256 = "sha256-OZL/ClHY8yatR0AJVyomBq7AjBwQwm5f9UnmdlL8IFw=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/wandb/default.nix b/pkgs/development/python-modules/wandb/default.nix
index f31708baef8b..ef1e1d1198f7 100644
--- a/pkgs/development/python-modules/wandb/default.nix
+++ b/pkgs/development/python-modules/wandb/default.nix
@@ -12,6 +12,7 @@
 , jsonref
 , jsonschema
 , matplotlib
+, nbconvert
 , nbformat
 , pandas
 , pathtools
@@ -36,7 +37,7 @@
 
 buildPythonPackage rec {
   pname = "wandb";
-  version = "0.12.15";
+  version = "0.12.16";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -45,7 +46,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = "client";
     rev = "v${version}";
-    hash = "sha256-Fq+JwUEZP1QDFKYVyiR8DUU0GQV6fK50FW78qaWh+Mo=";
+    hash = "sha256-ZY7nTj93piTEeHhW+H+nQ+ws2dDmmY6u3p7uz296PbA=";
   };
 
   # setuptools is necessary since pkg_resources is required at runtime.
@@ -66,23 +67,6 @@ buildPythonPackage rec {
     shortuuid
   ];
 
-  checkInputs = [
-    azure-core
-    bokeh
-    flask
-    jsonref
-    jsonschema
-    matplotlib
-    nbformat
-    pandas
-    pydantic
-    pytest-mock
-    pytest-xdist
-    pytestCheckHook
-    scikit-learn
-    tqdm
-  ];
-
   # wandb expects git to be in PATH. See https://gist.github.com/samuela/57aeee710e41ab2bf361b7ed8fbbeabf
   # for the error message, and an example usage here: https://github.com/wandb/client/blob/d5f655b7ca7e3eac2f3a67a84bc5c2a664a31baf/wandb/sdk/internal/meta.py#L128.
   # See https://github.com/NixOS/nixpkgs/pull/164176#discussion_r828801621 as to
@@ -93,6 +77,30 @@ buildPythonPackage rec {
     ln -s ${git}/bin/git $out/bin/git
   '';
 
+  preCheck = ''
+    export HOME=$(mktemp -d)
+  '';
+
+  checkInputs = [
+    azure-core
+    bokeh
+    flask
+    jsonref
+    jsonschema
+    matplotlib
+    # Oddly enough, nbclient does not provide the `nbclient` module. Rather it's
+    # available in nbconvert. See https://github.com/NixOS/nixpkgs/issues/171493#issuecomment-1116960488.
+    nbconvert
+    nbformat
+    pandas
+    pydantic
+    pytest-mock
+    pytest-xdist
+    pytestCheckHook
+    scikit-learn
+    tqdm
+  ];
+
   disabledTestPaths = [
     # Tests that try to get chatty over sockets or spin up servers, not possible in the nix build environment.
     "tests/test_cli.py"
diff --git a/pkgs/development/tools/dive/default.nix b/pkgs/development/tools/dive/default.nix
index 581b0db3b35a..d6217671b0c1 100644
--- a/pkgs/development/tools/dive/default.nix
+++ b/pkgs/development/tools/dive/default.nix
@@ -13,8 +13,6 @@ buildGoModule rec {
 
   vendorSha256 = "sha256-0gJ3dAPoilh3IWkuesy8geNsuI1T0DN64XvInc9LvlM=";
 
-  doCheck = false;
-
   nativeBuildInputs = [ pkg-config ];
 
   buildInputs = lib.optionals stdenv.isLinux [ btrfs-progs gpgme lvm2 ];
diff --git a/pkgs/development/tools/gosec/default.nix b/pkgs/development/tools/gosec/default.nix
index ac653db1bf02..343ab9624ca6 100644
--- a/pkgs/development/tools/gosec/default.nix
+++ b/pkgs/development/tools/gosec/default.nix
@@ -20,8 +20,6 @@ buildGoModule rec {
     "cmd/gosec"
   ];
 
-  doCheck = false;
-
   ldflags = [
     "-s"
     "-w"
diff --git a/pkgs/development/tools/just/default.nix b/pkgs/development/tools/just/default.nix
index e5ad74d64c73..d9519130761d 100644
--- a/pkgs/development/tools/just/default.nix
+++ b/pkgs/development/tools/just/default.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "just";
-  version = "1.1.2";
+  version = "1.1.3";
 
   src = fetchFromGitHub {
     owner = "casey";
     repo = pname;
     rev = version;
-    sha256 = "sha256-vUtJ9QVMmDGfkYTBoK8mVaJTEfNBQD5sTEp7kC0LNZw=";
+    sha256 = "sha256-2tKO0NyWFtRQgGrOKB3bROpDaIbQzTT4s2hGnBdZ6Fg=";
   };
 
-  cargoSha256 = "sha256-rJjLXktWnT6kRx1/18AFr6KciaFF8PaTpz27wz+vGug=";
+  cargoSha256 = "sha256-O5ntehb9ifWpBxBoOcFyyc8Ns6+SzHVOifUOD2QyhMY=";
 
   nativeBuildInputs = [ installShellFiles ];
   buildInputs = lib.optionals stdenv.isDarwin [ libiconv ];
diff --git a/pkgs/development/tools/protoc-gen-entgrpc/default.nix b/pkgs/development/tools/protoc-gen-entgrpc/default.nix
new file mode 100644
index 000000000000..d92b805082a2
--- /dev/null
+++ b/pkgs/development/tools/protoc-gen-entgrpc/default.nix
@@ -0,0 +1,28 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "protoc-gen-entgrpc";
+  version = "0.2.0";
+
+  src = fetchFromGitHub {
+    owner = "ent";
+    repo = "contrib";
+    rev = "v${version}";
+    sha256 = "sha256-cpk8yRDBsupI277NWYFaLCvi3ltQDLgCrcpJ/FUVi9o=";
+  };
+
+  vendorSha256 = "sha256-RwwGFBiasxMmtKMLSyAqvkozqoyzzYuslMq+HnzZUhw=";
+
+  subPackages = [ "entproto/cmd/protoc-gen-entgrpc" ];
+
+  ldflags = [ "-s" "-w" ];
+
+  meta = with lib; {
+    description = "Generator of an implementation of the service interface for ent protobuff";
+    downloadPage = "https://github.com/ent/contrib/";
+    license = licenses.asl20;
+    homepage = "https://entgo.io/";
+    maintainers = with maintainers; [ superherointj ];
+  };
+}
+
diff --git a/pkgs/development/tools/rust/cargo-sync-readme/default.nix b/pkgs/development/tools/rust/cargo-sync-readme/default.nix
index 07c51c3163cb..904404c65c30 100644
--- a/pkgs/development/tools/rust/cargo-sync-readme/default.nix
+++ b/pkgs/development/tools/rust/cargo-sync-readme/default.nix
@@ -2,20 +2,21 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-sync-readme";
-  version = "1.0";
+  version = "1.1";
 
   src = fetchFromGitHub {
     owner = "phaazon";
     repo = pname;
     rev = version;
-    sha256 = "1c38q87fyfmj6nlwdpavb1xxpi26ncywkgqcwbvblad15c6ydcyc";
+    sha256 = "sha256-n9oIWblTTuXFFQFN6mpQiCH5N7yg5fAp8v9vpB5/DAo=";
   };
 
-  cargoSha256 = "0vrbgs49ghhl4z4ljhghcs9fnbf7qx1an9kwbrgv9wng8m1dccah";
+  cargoSha256 = "sha256-DsB2C2ELuvuVSvxG/xztmnY2qfX8+Y7udbXlpRQoL/c=";
 
   meta = with lib; {
     description = "A cargo plugin that generates a Markdown section in your README based on your Rust documentation";
     homepage = "https://github.com/phaazon/cargo-sync-readme";
+    changelog = "https://github.com/phaazon/cargo-sync-readme/blob/${version}/CHANGELOG.md";
     license = licenses.bsd3;
     maintainers = with maintainers; [ b4dm4n ];
   };
diff --git a/pkgs/development/tools/wails/default.nix b/pkgs/development/tools/wails/default.nix
index 875ed794647d..73198af687cc 100644
--- a/pkgs/development/tools/wails/default.nix
+++ b/pkgs/development/tools/wails/default.nix
@@ -15,16 +15,16 @@
 
 buildGoModule rec {
   pname = "wails";
-  version = "2.0.0-beta.34";
+  version = "2.0.0-beta.36";
 
   src = fetchFromGitHub {
     owner = "wailsapp";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-dsDruZSmr8qSNpX8L27tLpNxvdSkc2mfNQLRxN9AnCg=";
+    sha256 = "sha256-uAbVc1UDgSNJwk8R6zXXqZImo6J9TRs3zPNlWelXS/I=";
   } + "/v2";
 
-  vendorSha256 = "sha256-OaSPpCb2VxMGlkUIg3fyEJhjz256amEfXBX+5WMY3a0=";
+  vendorSha256 = "sha256-rrwlFZQT7sHhUqtU4UzwEqZbjWd/1fudfj/xdTGFUmQ=";
 
   proxyVendor = true;
 
diff --git a/pkgs/os-specific/linux/nftables/default.nix b/pkgs/os-specific/linux/nftables/default.nix
index 8485a868d8a5..051ca1963051 100644
--- a/pkgs/os-specific/linux/nftables/default.nix
+++ b/pkgs/os-specific/linux/nftables/default.nix
@@ -8,8 +8,6 @@
 , withXtables ? true , iptables
 }:
 
-with lib;
-
 stdenv.mkDerivation rec {
   version = "1.0.2";
   pname = "nftables";
@@ -28,8 +26,8 @@ stdenv.mkDerivation rec {
   buildInputs = [
     libmnl libnftnl libpcap
     gmp jansson libedit
-  ] ++ optional withXtables iptables
-    ++ optional withPython python3;
+  ] ++ lib.optional withXtables iptables
+    ++ lib.optional withPython python3;
 
   preConfigure = ''
     substituteInPlace ./configure --replace /usr/bin/file ${file}/bin/file
@@ -46,12 +44,12 @@ stdenv.mkDerivation rec {
   configureFlags = [
     "--with-json"
     "--with-cli=editline"
-  ] ++ optional (!withDebugSymbols) "--disable-debug"
-    ++ optional (!withPython) "--disable-python"
-    ++ optional withPython "--enable-python"
-    ++ optional withXtables "--with-xtables";
+  ] ++ lib.optional (!withDebugSymbols) "--disable-debug"
+    ++ lib.optional (!withPython) "--disable-python"
+    ++ lib.optional withPython "--enable-python"
+    ++ lib.optional withXtables "--with-xtables";
 
-  meta = {
+  meta = with lib; {
     description = "The project that aims to replace the existing {ip,ip6,arp,eb}tables framework";
     homepage = "https://netfilter.org/projects/nftables/";
     license = licenses.gpl2Only;
diff --git a/pkgs/servers/keycloak/default.nix b/pkgs/servers/keycloak/default.nix
index f28679f2cf5f..95a3ade822c1 100644
--- a/pkgs/servers/keycloak/default.nix
+++ b/pkgs/servers/keycloak/default.nix
@@ -13,11 +13,11 @@
 
 stdenv.mkDerivation rec {
   pname = "keycloak";
-  version = "17.0.1";
+  version = "18.0.0";
 
   src = fetchzip {
     url = "https://github.com/keycloak/keycloak/releases/download/${version}/keycloak-${version}.zip";
-    sha256 = "sha256-z1LfTUoK+v4oQxdyIQruFhl5O333zirSrkPoTFgVfmI=";
+    sha256 = "0fxf9m50hpjplj077z2zjp0qibixz5y4lbc8159cnxbd4gzpkaaf";
   };
 
   nativeBuildInputs = [ makeWrapper jre ];
@@ -57,8 +57,8 @@ stdenv.mkDerivation rec {
   '';
 
   postFixup = ''
-    substituteInPlace $out/bin/kc.sh --replace '-Dkc.home.dir=$DIRNAME/../' '-Dkc.home.dir=$KC_HOME_DIR'
-    substituteInPlace $out/bin/kc.sh --replace '-Djboss.server.config.dir=$DIRNAME/../conf' '-Djboss.server.config.dir=$KC_CONF_DIR'
+    substituteInPlace $out/bin/kc.sh --replace ${lib.escapeShellArg "-Dkc.home.dir='$DIRNAME'/../"} '-Dkc.home.dir=$KC_HOME_DIR'
+    substituteInPlace $out/bin/kc.sh --replace ${lib.escapeShellArg "-Djboss.server.config.dir='$DIRNAME'/../conf"} '-Djboss.server.config.dir=$KC_CONF_DIR'
 
     for script in $(find $out/bin -type f -executable); do
       wrapProgram "$script" --set JAVA_HOME ${jre} --prefix PATH : ${jre}/bin
diff --git a/pkgs/servers/monitoring/prometheus/aws-s3-exporter.nix b/pkgs/servers/monitoring/prometheus/aws-s3-exporter.nix
index e93db302552f..fd0234e7e163 100644
--- a/pkgs/servers/monitoring/prometheus/aws-s3-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/aws-s3-exporter.nix
@@ -1,19 +1,19 @@
-{ lib, buildGoPackage, fetchFromGitHub }:
+{ lib, buildGoModule, fetchFromGitHub }:
 
-buildGoPackage rec {
+buildGoModule rec {
   pname = "aws-s3-exporter";
-  version = "0.4.1";
-
-  goPackagePath = "github.com/ribbybibby/s3_exporter";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "ribbybibby";
     repo = "s3_exporter";
     rev = "v${version}";
-    sha256 = "01g4k5wrbc2ggxkn4yqd2v0amw8yl5dbcfwi4jm3kqkihrf0rbiq";
+    sha256 = "sha256-dYkMCCAIlFDFOFUNJd4NvtAeJDTsHeJoH90b5pSGlQE=";
   };
 
-  doCheck = true;
+  vendorSha256 = null;
+
+  ldflags = [ "-s" "-w" ];
 
   meta = with lib; {
     description = "Exports Prometheus metrics about S3 buckets and objects";
diff --git a/pkgs/tools/networking/pssh/default.nix b/pkgs/tools/networking/pssh/default.nix
index 1d7d006f537a..69236a690968 100644
--- a/pkgs/tools/networking/pssh/default.nix
+++ b/pkgs/tools/networking/pssh/default.nix
@@ -1,14 +1,14 @@
-{ lib, fetchFromGitHub, python2Packages, openssh, rsync }:
+{ lib, fetchFromGitHub, python3Packages, openssh, rsync }:
 
-python2Packages.buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "pssh";
-  version = "2.3.1";
+  version = "2.3.4";
 
   src = fetchFromGitHub {
     owner = "lilydjwg";
     repo = "pssh";
     rev = "v${version}";
-    sha256 = "0nawarxczfwajclnlsimhqkpzyqb1byvz9nsl54mi1bp80z5i4jq";
+    hash = "sha256-B1dIa6hNeq4iE8GKVhTp3Gzq7vp+v5Yyzj8uF8X71yg=";
   };
 
   postPatch = ''
@@ -20,6 +20,9 @@ python2Packages.buildPythonApplication rec {
     done
   '';
 
+  # Tests do not run with python3: https://github.com/lilydjwg/pssh/issues/126
+  doCheck = false;
+
   meta = with lib; {
     description = "Parallel SSH Tools";
     longDescription = ''
diff --git a/pkgs/tools/security/fulcio/default.nix b/pkgs/tools/security/fulcio/default.nix
index 86ba5a9b3bf4..acfce66834ff 100644
--- a/pkgs/tools/security/fulcio/default.nix
+++ b/pkgs/tools/security/fulcio/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "fulcio";
-  version = "0.4.0";
+  version = "0.4.1";
 
   src = fetchFromGitHub {
     owner = "sigstore";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-WxSN1pZ8E5vKMoqR5EkGgKnLuHYb5Wl2vzqPcPEkXWE=";
+    sha256 = "sha256-b+2M28cI+4UkzrIqI+BioxJsGqT0pqJVPTPmXe+NsZo=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -20,7 +20,7 @@ buildGoModule rec {
       find "$out" -name .git -print0 | xargs -0 rm -rf
     '';
   };
-  vendorSha256 = "sha256-v3H+uUERDHZB2ArruCOClCQFEEW8ANeReObww+1VKOI=";
+  vendorSha256 = "sha256-INPMsSyjFs4GyapOlc/k5fcI2ePUKgp4BtASOKwQhck=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/security/gopass/default.nix b/pkgs/tools/security/gopass/default.nix
index 6825e6cbba80..4e3926d7f064 100644
--- a/pkgs/tools/security/gopass/default.nix
+++ b/pkgs/tools/security/gopass/default.nix
@@ -13,7 +13,7 @@
 
 buildGoModule rec {
   pname = "gopass";
-  version = "1.14.0";
+  version = "1.14.1";
 
   nativeBuildInputs = [ installShellFiles makeWrapper ];
 
@@ -21,10 +21,10 @@ buildGoModule rec {
     owner = "gopasspw";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-swvZrsRuevBe8lVg67J0R9u3GB/Wc2ZR54Y6j1Bsa3E=";
+    sha256 = "sha256-vdMOD6Zrl718jcntjEzOG+4Rr0aqhm0YidA0x3Gseqg=";
   };
 
-  vendorSha256 = "sha256-Fq9jEJm65efBL5ShcB/XCM70UVDO/8STbbTOOHXrpSk=";
+  vendorSha256 = "sha256-mdPAZrcdlq7R7DRIfuxf4PCpEJoJjzo/+TDKAVglk7A=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/tools/security/jadx/default.nix b/pkgs/tools/security/jadx/default.nix
index 2aadf1fb7b27..1358d9f3198e 100644
--- a/pkgs/tools/security/jadx/default.nix
+++ b/pkgs/tools/security/jadx/default.nix
@@ -2,13 +2,13 @@
 
 let
   pname = "jadx";
-  version = "1.3.4";
+  version = "1.3.5";
 
   src = fetchFromGitHub {
     owner = "skylot";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-G2BgGhWk0Prbjni6HPZ/0+bWiC9uI2O13Q1SDCE5mBE=";
+    hash = "sha256-uDNHjajGqEeXOIC5SaluhHWOkA2j3LUvB6O3MHB2+YA=";
   };
 
   deps = stdenv.mkDerivation {
@@ -40,7 +40,7 @@ let
     '';
 
     outputHashMode = "recursive";
-    outputHash = "sha256-QZClHuj7oCUYX3I8B3A90m4zK7+FP24C19RIzYyPC1w=";
+    outputHash = "sha256-SFj3VPCIxEA2mj/xsibXZ1MDmV/BnmvQJUBav1gfEGM=";
   };
 in stdenv.mkDerivation {
   inherit pname version src;
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index cfb1ed919726..2ae688dc1b8f 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -324,6 +324,7 @@ mapAliases ({
   double_conversion = throw "'double_conversion' has been renamed to/replaced by 'double-conversion'"; # Converted to throw 2022-02-22
   dragon-drop = throw "'dragon-drop' has been removed in favor of 'xdragon'"; # Added 2022-04-10;
   draftsight = throw "draftsight has been removed, no longer available as freeware"; # Added 2020-08-14
+  dust = throw "dust has been removed: abandoned by upstream"; # Added 2022-04-21
   dvb_apps = throw "dvb_apps has been removed"; # Added 2020-11-03
   dwarf_fortress = throw "'dwarf_fortress' has been renamed to/replaced by 'dwarf-fortress'"; # Converted to throw 2022-02-22
   dwm-git = throw "dwm-git has been removed from nixpkgs, as it had no updates for 2 years not serving it's purpose"; # Added 2021-02-07
@@ -1001,6 +1002,7 @@ mapAliases ({
   pifi = throw "pifi has been removed from nixpkgs, as it is no longer developed"; # Added 2022-01-19
   ping = throw "'ping' does not build with recent valac and has been removed. If you are just looking for the 'ping' command use either 'iputils' or 'inetutils'"; # Added 2022-04-18
   piwik = throw "'piwik' has been renamed to/replaced by 'matomo'"; # Converted to throw 2022-02-22
+  pixie = throw "pixie has been removed: abandoned by upstream"; # Added 2022-04-21
   pkgconfig = pkg-config; # Added 2018-02-02, moved to aliases.nix 2021-01-18
   pkgconfigUpstream = throw "'pkgconfigUpstream' has been renamed to/replaced by 'pkg-configUpstream'"; # Converted to throw 2022-02-22
   planner = throw "planner has been removed from nixpkgs, as it is no longer developed and still uses python2/PyGTK"; # Added 2021-02-02
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index d3c8741ad017..f692c365eed3 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -406,6 +406,8 @@ with pkgs;
 
   protoc-gen-doc = callPackage ../development/tools/protoc-gen-doc { };
 
+  protoc-gen-entgrpc = callPackage ../development/tools/protoc-gen-entgrpc { };
+
   protoc-gen-go = callPackage ../development/tools/protoc-gen-go { };
 
   protoc-gen-go-grpc = callPackage ../development/tools/protoc-gen-go-grpc { };
@@ -14497,9 +14499,6 @@ with pkgs;
 
   inherit (ocamlPackages) reason;
 
-  pixie = callPackage ../development/interpreters/pixie { };
-  dust = callPackage ../development/interpreters/pixie/dust.nix { };
-
   buildRubyGem = callPackage ../development/ruby-modules/gem { };
   defaultGemConfig = callPackage ../development/ruby-modules/gem-config {
     inherit (darwin) DarwinTools cctools;
@@ -26119,6 +26118,10 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) Security;
   };
 
+  firewalld = callPackage ../applications/networking/firewalld { };
+
+  firewalld-gui = firewalld.override { withGui = true; };
+
   flacon = libsForQt5.callPackage ../applications/audio/flacon { };
 
   flexget = callPackage ../applications/networking/flexget { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 68c148b8210f..305576dd8e3f 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2841,6 +2841,8 @@ in {
 
   fastavro = callPackage ../development/python-modules/fastavro { };
 
+  fastbencode = callPackage ../development/python-modules/fastbencode { };
+
   fastcache = callPackage ../development/python-modules/fastcache { };
 
   fastcore = callPackage ../development/python-modules/fastcore { };
@@ -5623,6 +5625,11 @@ in {
 
   nextcord = callPackage ../development/python-modules/nextcord { };
 
+  nftables = toPythonModule (pkgs.nftables.override {
+    python3 = python;
+    withPython = true;
+  });
+
   nghttp2 = (toPythonModule (pkgs.nghttp2.override {
     inherit (self) python cython setuptools;
     inherit (pkgs) ncurses;