diff --git a/pkgs/applications/audio/librespot/default.nix b/pkgs/applications/audio/librespot/default.nix
index 5917739f2442..f477b811d70f 100644
--- a/pkgs/applications/audio/librespot/default.nix
+++ b/pkgs/applications/audio/librespot/default.nix
@@ -1,6 +1,17 @@
-{ lib, stdenv, fetchFromGitHub, rustPlatform, pkg-config, openssl, withRodio ? true
-, withALSA ? true, alsa-lib ? null, withPulseAudio ? false, libpulseaudio ? null
-, withPortAudio ? false, portaudio ? null }:
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, pkg-config
+, stdenv
+, openssl
+, withALSA ? true
+, alsa-lib
+, withPortAudio ? false
+, portaudio
+, withPulseAudio ? false
+, libpulseaudio
+, withRodio ? true
+}:
 
 rustPlatform.buildRustPackage rec {
   pname = "librespot";
@@ -15,26 +26,26 @@ rustPlatform.buildRustPackage rec {
 
   cargoSha256 = "sha256-tbDlWP0sUIa0W9HhdYNOvo9cGeqFemclhA7quh7f/Rw=";
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ pkg-config ] ++ lib.optionals stdenv.isDarwin [
+    rustPlatform.bindgenHook
+  ];
 
-  buildInputs = [ openssl ] ++ lib.optional withALSA alsa-lib
-    ++ lib.optional withPulseAudio libpulseaudio
-    ++ lib.optional withPortAudio portaudio;
+  buildInputs = [ openssl ]
+    ++ lib.optional withALSA alsa-lib
+    ++ lib.optional withPortAudio portaudio
+    ++ lib.optional withPulseAudio libpulseaudio;
 
   buildNoDefaultFeatures = true;
   buildFeatures = lib.optional withRodio "rodio-backend"
     ++ lib.optional withALSA "alsa-backend"
-    ++ lib.optional withPulseAudio "pulseaudio-backend"
-    ++ lib.optional withPortAudio "portaudio-backend";
-
-  doCheck = false;
+    ++ lib.optional withPortAudio "portaudio-backend"
+    ++ lib.optional withPulseAudio "pulseaudio-backend";
 
   meta = with lib; {
     description = "Open Source Spotify client library and playback daemon";
     homepage = "https://github.com/librespot-org/librespot";
+    changelog = "https://github.com/librespot-org/librespot/blob/v${version}/CHANGELOG.md";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ bennofs ];
-    platforms = platforms.unix;
-    broken = stdenv.isDarwin; # never built on Hydra https://hydra.nixos.org/job/nixpkgs/trunk/librespot.x86_64-darwin
   };
 }
diff --git a/pkgs/applications/editors/nano/default.nix b/pkgs/applications/editors/nano/default.nix
index d7b1f54d3912..cfb1d17c9129 100644
--- a/pkgs/applications/editors/nano/default.nix
+++ b/pkgs/applications/editors/nano/default.nix
@@ -16,11 +16,11 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "nano";
-  version = "7.0";
+  version = "7.1";
 
   src = fetchurl {
     url = "mirror://gnu/nano/${pname}-${version}.tar.xz";
-    sha256 = "jdbqw4srh4bYJoHw4a/YT2t1IQ0XORtkQ8Q35FFVIUk=";
+    sha256 = "V7p1Hpt1GfD23e5QUgLjh8dd3kQMH3qhuTEMw4FAaDY=";
   };
 
   nativeBuildInputs = [ texinfo ] ++ optional enableNls gettext;
diff --git a/pkgs/applications/file-managers/clifm/default.nix b/pkgs/applications/file-managers/clifm/default.nix
index 52f087b9db4d..003b07cb9759 100644
--- a/pkgs/applications/file-managers/clifm/default.nix
+++ b/pkgs/applications/file-managers/clifm/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "clifm";
-  version = "1.7";
+  version = "1.9";
 
   src = fetchFromGitHub {
     owner = "leo-arch";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-7nMAaMLFLF5WuWgac9wdIvzRTTVpKRM7zB2tIlowBEE=";
+    sha256 = "sha256-jrP8V1EhHldliZEjiX55TJujc82ub46aWi1boJYDVTg=";
   };
 
   buildInputs = [ libcap acl file readline ];
diff --git a/pkgs/applications/gis/qgis/unwrapped-ltr.nix b/pkgs/applications/gis/qgis/unwrapped-ltr.nix
index c694d5da3dbb..e11df27ab6c3 100644
--- a/pkgs/applications/gis/qgis/unwrapped-ltr.nix
+++ b/pkgs/applications/gis/qgis/unwrapped-ltr.nix
@@ -72,14 +72,14 @@ let
     six
   ];
 in mkDerivation rec {
-  version = "3.22.10";
+  version = "3.22.13";
   pname = "qgis-ltr-unwrapped";
 
   src = fetchFromGitHub {
     owner = "qgis";
     repo = "QGIS";
     rev = "final-${lib.replaceStrings [ "." ] [ "_" ] version}";
-    hash = "sha256-v/PshUZpf8fVW2PrGBiuAMfyfC/osOkR9GcnNOyg0l4=";
+    hash = "sha256-l9UaxPBTkKrTygise0nVBDrPX3aRRW62HtIYwrtYp3Q=";
   };
 
   passthru = {
diff --git a/pkgs/applications/gis/qgis/unwrapped.nix b/pkgs/applications/gis/qgis/unwrapped.nix
index 57913c3e17e6..9f445facb167 100644
--- a/pkgs/applications/gis/qgis/unwrapped.nix
+++ b/pkgs/applications/gis/qgis/unwrapped.nix
@@ -72,14 +72,14 @@ let
     six
   ];
 in mkDerivation rec {
-  version = "3.26.2";
+  version = "3.28.2";
   pname = "qgis-unwrapped";
 
   src = fetchFromGitHub {
     owner = "qgis";
     repo = "QGIS";
     rev = "final-${lib.replaceStrings [ "." ] [ "_" ] version}";
-    hash = "sha256-WU1yamZM/UVhtZjoZ/5J8gt7FOHEHi0D2Z9BWEl4br0=";
+    hash = "sha256-ndwDN/DH+Y+dc8aNa45cSIM8yQUmIWq0jx6xWsZo4rk=";
   };
 
   passthru = {
diff --git a/pkgs/applications/networking/flexget/default.nix b/pkgs/applications/networking/flexget/default.nix
index ac8e3129bb0b..9bd2c90d24f8 100644
--- a/pkgs/applications/networking/flexget/default.nix
+++ b/pkgs/applications/networking/flexget/default.nix
@@ -5,7 +5,7 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "flexget";
-  version = "3.5.11";
+  version = "3.5.12";
   format = "pyproject";
 
   # Fetch from GitHub in order to use `requirements.in`
@@ -13,7 +13,7 @@ python3Packages.buildPythonApplication rec {
     owner = "flexget";
     repo = "flexget";
     rev = "refs/tags/v${version}";
-    hash = "sha256-KGeTzERLlsrBHQxskrMhFHw9XyYyl33bJJK+SN++EU4=";
+    hash = "sha256-nrW6+BhcDvFt7bw0XdiDk2eNnM+ut24xTdPulNDw9X4=";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/networking/ndppd/default.nix b/pkgs/applications/networking/ndppd/default.nix
index ccaf3e0bbbb8..df3bc9f9f236 100644
--- a/pkgs/applications/networking/ndppd/default.nix
+++ b/pkgs/applications/networking/ndppd/default.nix
@@ -11,12 +11,14 @@ stdenv.mkDerivation rec {
     sha256 = "0niri5q9qyyyw5lmjpxk19pv3v4srjvmvyd5k6ks99mvqczjx9c0";
   };
 
+  nativeBuildInputs = [ gzip ];
+
   makeFlags = [
     "PREFIX=$(out)"
   ];
 
   preConfigure = ''
-    substituteInPlace Makefile --replace /bin/gzip ${gzip}/bin/gzip
+    substituteInPlace Makefile --replace /bin/gzip gzip
   '';
 
   postInstall = ''
diff --git a/pkgs/applications/science/misc/root/default.nix b/pkgs/applications/science/misc/root/default.nix
index 12b181d2edd4..f0924d1402a9 100644
--- a/pkgs/applications/science/misc/root/default.nix
+++ b/pkgs/applications/science/misc/root/default.nix
@@ -1,7 +1,7 @@
 { stdenv
 , lib
 , callPackage
-, fetchFromGitHub
+, fetchurl
 , fetchpatch
 , makeWrapper
 , cmake
@@ -48,6 +48,7 @@
 , patchRcPathFish
 , patchRcPathPosix
 , tbb
+, xrootd
 , Cocoa
 , CoreSymbolication
 , OpenGL
@@ -70,20 +71,21 @@ in
 
 stdenv.mkDerivation rec {
   pname = "root";
-  version = "6.26.08";
+  version = "6.26.10";
 
   passthru = {
     tests = import ./tests { inherit callPackage; };
   };
 
-  src = fetchFromGitHub {
-    owner = "root-project";
-    repo = "root";
-    rev = "v${builtins.replaceStrings [ "." ] [ "-" ] version}";
-    sha256 = "sha256-cNd1GvEbO/a+WdDe8EHYGmdlw3TrOT2fWaSk+s7fw7U=";
+  src = fetchurl {
+    url = "https://root.cern.ch/download/root_v${version}.source.tar.gz";
+    hash = "sha256-jla+w5cQQBeqVPnrVU3noaE0R0/gs7sPQ6cPxPq9Yl8=";
   };
 
   nativeBuildInputs = [ makeWrapper cmake pkg-config git ];
+  propagatedBuildInputs = [
+    nlohmann_json
+  ];
   buildInputs = [
     davix
     ftgl
@@ -107,12 +109,12 @@ stdenv.mkDerivation rec {
     libjpeg
     libtiff
     libpng
-    nlohmann_json
     patchRcPathCsh
     patchRcPathFish
     patchRcPathPosix
     python.pkgs.numpy
     tbb
+    xrootd
   ]
   ++ lib.optionals (!stdenv.isDarwin) [ libX11 libXpm libXft libXext libGLU libGL ]
   ++ lib.optionals (stdenv.isDarwin) [ Cocoa CoreSymbolication OpenGL ]
@@ -195,7 +197,7 @@ stdenv.mkDerivation rec {
     "-Dvdt=OFF"
     "-Dwebgui=OFF"
     "-Dxml=ON"
-    "-Dxrootd=OFF"
+    "-Dxrootd=ON"
   ]
   ++ lib.optional (stdenv.cc.libc != null) "-DC_INCLUDE_DIRS=${lib.getDev stdenv.cc.libc}/include"
   ++ lib.optionals stdenv.isDarwin [
@@ -209,19 +211,23 @@ stdenv.mkDerivation rec {
 
   NIX_LDFLAGS = lib.optionalString (stdenv.isLinux && stdenv.isAarch64 && stdenv.cc.isGNU) "-lgcc";
 
+  # Workaround the xrootd runpath bug #169677 by prefixing [DY]LD_LIBRARY_PATH with ${lib.makeLibraryPath xrootd}.
+  # TODO: Remove the [DY]LDLIBRARY_PATH prefix for xrootd when #200830 get merged.
   postInstall = ''
     for prog in rootbrowse rootcp rooteventselector rootls rootmkdir rootmv rootprint rootrm rootslimtree; do
       wrapProgram "$out/bin/$prog" \
         --set PYTHONPATH "$out/lib" \
-        --set ${lib.optionalString stdenv.isDarwin "DY"}LD_LIBRARY_PATH "$out/lib"
+        --set ${lib.optionalString stdenv.isDarwin "DY"}LD_LIBRARY_PATH "$out/lib:${lib.makeLibraryPath [ xrootd ]}"
     done
 
-    # Make ldd and sed available to the ROOT executable
-    wrapProgram "$out/bin/root" --prefix PATH : "${lib.makeBinPath [
-      gnused # sed
-      stdenv.cc # c++ ld etc.
-      stdenv.cc.libc # ldd
-    ]}"
+    # Make ldd and sed available to the ROOT executable by prefixing PATH.
+    wrapProgram "$out/bin/root" \
+      --prefix PATH : "${lib.makeBinPath [
+        gnused # sed
+        stdenv.cc # c++ ld etc.
+        stdenv.cc.libc # ldd
+      ]}" \
+      --prefix ${lib.optionalString stdenv.hostPlatform.isDarwin "DY"}LD_LIBRARY_PATH : "${lib.makeLibraryPath [ xrootd ]}"
 
     # Patch thisroot.{sh,csh,fish}
 
diff --git a/pkgs/applications/window-managers/picom/default.nix b/pkgs/applications/window-managers/picom/default.nix
index 384b806ce2f7..ddcab1095719 100644
--- a/pkgs/applications/window-managers/picom/default.nix
+++ b/pkgs/applications/window-managers/picom/default.nix
@@ -32,13 +32,13 @@
 
 stdenv.mkDerivation rec {
   pname = "picom";
-  version = "10.1";
+  version = "10.2";
 
   src = fetchFromGitHub {
     owner = "yshui";
     repo = "picom";
     rev = "v${version}";
-    hash = "sha256-EYNLLAz7CkbVGv2XMT+73RR58HzxG+Gy7b5x1qahAgo=";
+    hash = "sha256-C+icJXTkE+XMaU7N6JupsP8xhmRVggX9hY1P7za0pO0=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/data/fonts/smiley-sans/default.nix b/pkgs/data/fonts/smiley-sans/default.nix
new file mode 100644
index 000000000000..3bef9608b46e
--- /dev/null
+++ b/pkgs/data/fonts/smiley-sans/default.nix
@@ -0,0 +1,29 @@
+{ lib, stdenvNoCC, fetchzip }:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "smiley-sans";
+  version = "1.0.0";
+
+  src = fetchzip {
+    url = "https://github.com/atelier-anchor/smiley-sans/releases/download/v${version}/smiley-sans-v${version}.zip";
+    sha256 = "sha256-LE0CZkWiXjyuiEk316ABCNQL9n5GID8CipjBIu2o6uk=";
+    stripRoot = false;
+  };
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm644 -t $out/share/fonts/opentype *.otf
+    install -Dm644 -t $out/share/fonts/truetype *.ttf
+    install -Dm644 -t $out/share/fonts/woff2 *.woff2
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "A condensed and oblique Chinese typeface seeking a visual balance between the humanist and the geometric";
+    homepage = "https://atelier-anchor.com/typefaces/smiley-sans/";
+    changelog = "https://github.com/atelier-anchor/smiley-sans/blob/main/CHANGELOG.md";
+    license = licenses.ofl;
+    maintainers = with maintainers; [ candyc1oud ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/data/misc/clash-geoip/default.nix b/pkgs/data/misc/clash-geoip/default.nix
index 31d7384976d6..8c9a288b6c6a 100644
--- a/pkgs/data/misc/clash-geoip/default.nix
+++ b/pkgs/data/misc/clash-geoip/default.nix
@@ -1,23 +1,29 @@
-{ lib, stdenv, fetchurl }:
+{ lib, stdenvNoCC, fetchurl, nix-update-script }:
 
-stdenv.mkDerivation rec {
+stdenvNoCC.mkDerivation rec {
   pname = "clash-geoip";
-  version = "20220912";
+  version = "20221212";
 
-  src = ./.;
-
-  data = fetchurl {
+  src = fetchurl {
     url = "https://github.com/Dreamacro/maxmind-geoip/releases/download/${version}/Country.mmdb";
-    sha256 = "sha256-YIQjuWbizheEE9kgL+hBS1GAGf2PbpaW5mu/lim9Q9A";
+    sha256 = "sha256-pApPPRIvG8qak5chupTN2u1IUKANXtkcEMlSAPedjH4=";
   };
 
+  dontUnpack = true;
+
   installPhase = ''
     runHook preInstall
     mkdir -p $out/etc/clash
-    install -Dm 0644 $data -D $out/etc/clash/Country.mmdb
+    install -Dm 0644 $src -D $out/etc/clash/Country.mmdb
     runHook postInstall
   '';
 
+  passthru = {
+    updateScript = nix-update-script {
+      attrPath = pname;
+    };
+  };
+
   meta = with lib; {
     description = "A GeoLite2 data created by MaxMind";
     homepage = "https://github.com/Dreamacro/maxmind-geoip";
diff --git a/pkgs/development/compilers/jrsonnet/default.nix b/pkgs/development/compilers/jrsonnet/default.nix
index 696f7acb3311..ffbd1c22d4b6 100644
--- a/pkgs/development/compilers/jrsonnet/default.nix
+++ b/pkgs/development/compilers/jrsonnet/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitHub, rustPlatform, installShellFiles }:
+{ lib, rustPlatform, fetchFromGitHub, installShellFiles }:
 
 rustPlatform.buildRustPackage rec {
   pname = "jrsonnet";
@@ -11,8 +11,15 @@ rustPlatform.buildRustPackage rec {
     sha256 = "sha256-OX+iJJ3vdCsWWr8x31psV9Vne6xWDZnJc83NbJqMK1A=";
   };
 
+  cargoSha256 = "sha256-eFfAU9Q3nYAJK+kKP1Y6ONjOIfkuYTlelrFrEW9IJ8c=";
+
   nativeBuildInputs = [ installShellFiles ];
 
+  # skip flaky tests
+  checkFlags = [
+    "--skip=tests::native_ext"
+  ];
+
   postInstall = ''
     ln -s $out/bin/jrsonnet $out/bin/jsonnet
 
@@ -24,13 +31,10 @@ rustPlatform.buildRustPackage rec {
     done
   '';
 
-  cargoSha256 = "sha256-eFfAU9Q3nYAJK+kKP1Y6ONjOIfkuYTlelrFrEW9IJ8c=";
-
-  meta = {
+  meta = with lib; {
     description = "Purely-functional configuration language that helps you define JSON data";
-    maintainers = with lib.maintainers; [ lach ];
-    license = lib.licenses.mit;
     homepage = "https://github.com/CertainLach/jrsonnet";
-    broken = stdenv.isDarwin; # never built on Hydra https://hydra.nixos.org/job/nixpkgs/trunk/jrsonnet.x86_64-darwin
+    license = licenses.mit;
+    maintainers = with maintainers; [ figsoda lach ];
   };
 }
diff --git a/pkgs/development/haskell-modules/configuration-common.nix b/pkgs/development/haskell-modules/configuration-common.nix
index 8820b7cb3410..66a3687d3039 100644
--- a/pkgs/development/haskell-modules/configuration-common.nix
+++ b/pkgs/development/haskell-modules/configuration-common.nix
@@ -110,9 +110,7 @@ self: super: {
     postPatch = "sed -i s/home/tmp/ test/Spec.hs";
   }) super.shell-conduit;
 
-  # Too strict upper bound on hedgehog
-  # https://github.com/erikd/wide-word/issues/71
-  wide-word = doJailbreak super.wide-word;
+  cachix = self.generateOptparseApplicativeCompletions [ "cachix" ] super.cachix;
 
   # https://github.com/froozen/kademlia/issues/2
   kademlia = dontCheck super.kademlia;
diff --git a/pkgs/development/haskell-modules/configuration-nix.nix b/pkgs/development/haskell-modules/configuration-nix.nix
index a656e21f5fcf..601c77acf2d6 100644
--- a/pkgs/development/haskell-modules/configuration-nix.nix
+++ b/pkgs/development/haskell-modules/configuration-nix.nix
@@ -874,7 +874,7 @@ self: super: builtins.intersectAttrs super {
     (overrideCabal { doCheck = pkgs.postgresql.doCheck; })
   ];
 
-  cachix = self.generateOptparseApplicativeCompletions [ "cachix" ] (super.cachix.override { nix = pkgs.nixVersions.nix_2_9; });
+  cachix = super.cachix.override { nix = pkgs.nixVersions.nix_2_9; };
 
   hercules-ci-agent = super.hercules-ci-agent.override { nix = pkgs.nixVersions.nix_2_9; };
   hercules-ci-cnix-expr =
diff --git a/pkgs/development/interpreters/nickel/default.nix b/pkgs/development/interpreters/nickel/default.nix
index 714e9a3f9819..91200030f631 100644
--- a/pkgs/development/interpreters/nickel/default.nix
+++ b/pkgs/development/interpreters/nickel/default.nix
@@ -27,6 +27,7 @@ rustPlatform.buildRustPackage rec {
       that are then fed to another system. It is designed to have a simple,
       well-understood core: it is in essence JSON with functions.
     '';
+    changelog = "https://github.com/tweag/nickel/blob/${version}/RELEASES.md";
     license = licenses.mit;
     maintainers = with maintainers; [ AndersonTorres ];
   };
diff --git a/pkgs/development/libraries/level-zero/default.nix b/pkgs/development/libraries/level-zero/default.nix
index 592260c0a467..85a803c010b1 100644
--- a/pkgs/development/libraries/level-zero/default.nix
+++ b/pkgs/development/libraries/level-zero/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "level-zero";
-  version = "1.8.8";
+  version = "1.8.12";
 
   src = fetchFromGitHub {
     owner = "oneapi-src";
     repo = "level-zero";
     rev = "v${version}";
-    sha256 = "sha256-hfbTgEbvrhWkZEi8Km7KaxJBAc9X1kA/T2DLooKa7KQ=";
+    sha256 = "sha256-87fnucPg8JygYo3QSuA6ll0acbHQvmWzNLEp4dqkAH8=";
   };
 
   nativeBuildInputs = [ cmake addOpenGLRunpath ];
diff --git a/pkgs/development/libraries/libva/1.nix b/pkgs/development/libraries/libva/1.nix
index 5197420783a1..b3ad61d4b283 100644
--- a/pkgs/development/libraries/libva/1.nix
+++ b/pkgs/development/libraries/libva/1.nix
@@ -8,6 +8,7 @@
 , libdrm
 , libXfixes
 , wayland
+, wayland-scanner
 , libffi
 , libGL
 , mesa
@@ -28,7 +29,7 @@ stdenv.mkDerivation rec {
 
   outputs = [ "dev" "out" ];
 
-  nativeBuildInputs = [ autoreconfHook pkg-config ];
+  nativeBuildInputs = [ autoreconfHook pkg-config wayland-scanner ];
 
   buildInputs = [ libdrm ]
     ++ lib.optionals (!minimal) [ libva1-minimal libX11 libXext libXfixes wayland libffi libGL ];
diff --git a/pkgs/development/libraries/physics/hepmc3/default.nix b/pkgs/development/libraries/physics/hepmc3/default.nix
index 999a5231c0bc..22e60b20aef9 100644
--- a/pkgs/development/libraries/physics/hepmc3/default.nix
+++ b/pkgs/development/libraries/physics/hepmc3/default.nix
@@ -1,4 +1,11 @@
-{ lib, stdenv, fetchurl, cmake, coreutils, python, root }:
+{ lib
+, stdenv
+, fetchurl
+, cmake
+, coreutils
+, python
+, root
+}:
 
 let
   pythonVersion = with lib.versions; "${major python.version}${minor python.version}";
@@ -16,9 +23,14 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-zQ91yA91VJxZzCqCns52Acd96Xyypat1eQysjh1YUDI=";
   };
 
-  nativeBuildInputs = [ cmake ];
-  buildInputs = [ root_py ]
-    ++ lib.optional withPython python;
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  buildInputs = [
+    root_py
+  ]
+  ++ lib.optional withPython python;
 
   cmakeFlags = [
     "-DHEPMC3_ENABLE_PYTHON=${if withPython then "ON" else "OFF"}"
diff --git a/pkgs/development/libraries/physics/lhapdf/default.nix b/pkgs/development/libraries/physics/lhapdf/default.nix
index c26aba66515b..60b5a0b581dc 100644
--- a/pkgs/development/libraries/physics/lhapdf/default.nix
+++ b/pkgs/development/libraries/physics/lhapdf/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "lhapdf";
-  version = "6.5.2";
+  version = "6.5.3";
 
   src = fetchurl {
     url = "https://www.hepforge.org/archive/lhapdf/LHAPDF-${version}.tar.gz";
-    sha256 = "sha256-YIonU0VeBnqZQLXBa8hqtsR+LHSbyd0ZeWmW60NSsv0=";
+    sha256 = "sha256-V0Nc1pXilwZdU+ab0pCQdlyTSTa2qXX/jFWXZvIjA1k=";
   };
 
   # The Apple SDK only exports locale_t from xlocale.h whereas glibc
diff --git a/pkgs/development/misc/datafusion/default.nix b/pkgs/development/misc/datafusion/default.nix
index a2e90dab6125..f048839292b6 100644
--- a/pkgs/development/misc/datafusion/default.nix
+++ b/pkgs/development/misc/datafusion/default.nix
@@ -1,35 +1,38 @@
-{ stdenv
-, lib
+{ lib
 , rustPlatform
 , fetchFromGitHub
+, stdenv
+, darwin
 }:
-let
-  pname = "datafusion-cli";
-  version = "unstable-2022-04-08";
-in
-rustPlatform.buildRustPackage {
-  inherit pname version;
 
-  # TODO the crate has been yanked so not the best source
-  # the repo is a workspace with a lock inside a subdirectory, making
-  # compilation from github source not straightforward
-  # re-evaluate strategy on release after 7.0.0
+rustPlatform.buildRustPackage rec {
+  pname = "datafusion-cli";
+  version = "15.0.0";
+
   src = fetchFromGitHub {
     owner = "apache";
     repo = "arrow-datafusion";
-    rev = "9cbde6d0e30fd29f59b0a16e309bdb0843cc7c64";
-    sha256 = "sha256-XXd9jvWVivOBRS0PVOU9F4RQ6MrS/q78JF4S6Htd67w=";
+    rev = version;
+    sha256 = "sha256-s+gQoczTesJGOpz4W5hBPDdxo4eQnf+D10+V2kx65Io=";
   };
   sourceRoot = "source/datafusion-cli";
 
-  cargoSha256 = "sha256-Q0SjVofl1+sex15sSU9s7PgKeHG2b0gJPSqz7YZFOVs=";
+  cargoSha256 = "sha256-w+/5Ig+U8y4nwu7QisnZvc3UlZaEU/kovV6birOWndE=";
+
+  buildInputs = lib.optional stdenv.isDarwin [
+    darwin.apple_sdk.frameworks.Security
+  ];
+
+  checkFlags = [
+    # fails even outside the Nix sandbox
+    "--skip=object_storage::tests::s3_region_validation"
+  ];
 
   meta = with lib; {
-    broken = stdenv.isDarwin;
     description = "cli for Apache Arrow DataFusion";
     homepage = "https://arrow.apache.org/datafusion";
+    changelog = "https://github.com/apache/arrow-datafusion/blob/${version}/datafusion/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ happysalada ];
-    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/ocaml-modules/ansiterminal/default.nix b/pkgs/development/ocaml-modules/ansiterminal/default.nix
index edd40fb4df29..f421e59ce7da 100644
--- a/pkgs/development/ocaml-modules/ansiterminal/default.nix
+++ b/pkgs/development/ocaml-modules/ansiterminal/default.nix
@@ -1,16 +1,12 @@
-{ lib, buildDunePackage, fetchFromGitHub }:
+{ lib, buildDunePackage, fetchurl }:
 
 buildDunePackage rec {
   pname = "ANSITerminal";
-  version = "0.8.2";
+  version = "0.8.5";
 
-  useDune2 = true;
-
-  src = fetchFromGitHub {
-    owner = "Chris00";
-    repo = pname;
-    rev = version;
-    sha256 = "0dyjischrgwlxqz1p5zbqq76jvk6pl1qj75i7ydhijssr9pj278d";
+  src = fetchurl {
+    url = "https://github.com/Chris00/ANSITerminal/releases/download/${version}/ANSITerminal-${version}.tbz";
+    hash = "sha256-q3OyGLajAmfSu8QzEtzzE5gbiwvsVV2SsGuHZkst0w4=";
   };
 
   doCheck = true;
@@ -22,7 +18,7 @@ buildDunePackage rec {
       movements on ANSI terminals. It also works on the windows shell (but
       this part is currently work in progress).
     '';
-    inherit (src.meta) homepage;
+    homepage = "https://github.com/Chris00/ANSITerminal";
     license = licenses.lgpl3;
     maintainers = [ maintainers.jirkamarsik ];
   };
diff --git a/pkgs/development/python-modules/aiolifx-themes/default.nix b/pkgs/development/python-modules/aiolifx-themes/default.nix
index ebcf0d913841..98d86b25c67f 100644
--- a/pkgs/development/python-modules/aiolifx-themes/default.nix
+++ b/pkgs/development/python-modules/aiolifx-themes/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "aiolifx-themes";
-  version = "0.2.1";
+  version = "0.3.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "Djelibeybi";
     repo = "aiolifx-themes";
     rev = "refs/tags/v${version}";
-    hash = "sha256-sWEWfsew758jl6vLB7AQQ3nA83BFHF7YPy1ZaoPt45Y=";
+    hash = "sha256-2ZruUkSpLclsz3ZSyTM+UshfGG4bHwfQMM8UFjlkvBg=";
   };
 
   prePatch = ''
diff --git a/pkgs/development/python-modules/aiomisc/default.nix b/pkgs/development/python-modules/aiomisc/default.nix
index d1fd33eb618e..d3c386eef7bf 100644
--- a/pkgs/development/python-modules/aiomisc/default.nix
+++ b/pkgs/development/python-modules/aiomisc/default.nix
@@ -8,7 +8,7 @@
 , colorlog
 , croniter
 , fastapi
-, fetchFromGitHub
+, fetchPypi
 , logging-journald
 , pytestCheckHook
 , pythonOlder
@@ -20,16 +20,14 @@
 
 buildPythonPackage rec {
   pname = "aiomisc";
-  version = "16.2";
+  version = "16.2.10";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
-  src = fetchFromGitHub {
-    owner = "aiokitchen";
-    repo = pname;
-    rev = "refs/tags/v${version}";
-    hash = "sha256-wxm7MrFHZ7TrUGw5w7iLWs1olU8ZmJmJ7M/BZ6Nf0fU=";
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-iQlbd1DoPgxq+Am0BTDYXIBZoC21/54+bywDtcCXlls=";
   };
 
   propagatedBuildInputs = [
@@ -73,11 +71,14 @@ buildPythonPackage rec {
     "aiomisc"
   ];
 
-  disabledTestPaths = [
-    # Dependencies are not available at the moment
-    "tests/test_entrypoint.py"
-    "tests/test_raven_service.py"
-  ];
+  # Upstream stopped tagging with 16.2
+  doCheck = false;
+
+  # disabledTestPaths = [
+  #   # Dependencies are not available at the moment
+  #   "tests/test_entrypoint.py"
+  #   "tests/test_raven_service.py"
+  # ];
 
   meta = with lib; {
     description = "Miscellaneous utils for asyncio";
diff --git a/pkgs/development/python-modules/aliyun-python-sdk-dbfs/default.nix b/pkgs/development/python-modules/aliyun-python-sdk-dbfs/default.nix
index c0a2bed20c3c..73e997b9cd4a 100644
--- a/pkgs/development/python-modules/aliyun-python-sdk-dbfs/default.nix
+++ b/pkgs/development/python-modules/aliyun-python-sdk-dbfs/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "aliyun-python-sdk-dbfs";
-  version = "2.0.2";
+  version = "2.0.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-+zypKosn+lKEjxJhjLHD43i8jK40WvapD8pjXQehU7E=";
+    hash = "sha256-vMF0bAsICikvDtxn+wXujo8bY4DQ/xxXJmUePMQ+7Ak=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/asn1tools/default.nix b/pkgs/development/python-modules/asn1tools/default.nix
index 9168d9dcb43f..d9747450a336 100644
--- a/pkgs/development/python-modules/asn1tools/default.nix
+++ b/pkgs/development/python-modules/asn1tools/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "asn1tools";
-  version = "0.164.0";
+  version = "0.165.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "eerimoq";
     repo = "asn1tools";
     rev = version;
-    hash= "sha256-sbwwbwkhlZvCb2emuw1FTBj5pnv9SOtHpAcYPSQqIvM=";
+    hash = "sha256-E9ns4xBDHkmIET2rXsMP9/9knXZ9H0D24w5QISQrYlc=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/autofaiss/default.nix b/pkgs/development/python-modules/autofaiss/default.nix
new file mode 100644
index 000000000000..443a086c5f82
--- /dev/null
+++ b/pkgs/development/python-modules/autofaiss/default.nix
@@ -0,0 +1,60 @@
+{ buildPythonPackage
+, embedding-reader
+, faiss
+, fetchFromGitHub
+, fire
+, fsspec
+, lib
+, numpy
+, pyarrow
+, pytestCheckHook
+, pythonRelaxDepsHook
+}:
+
+buildPythonPackage rec {
+  pname = "autofaiss";
+  version = "2.15.3";
+
+  src = fetchFromGitHub {
+    owner = "criteo";
+    repo = pname;
+    rev = "refs/tags/${version}";
+    hash = "sha256-RJOOUMI4w1YPEjDKi0YkqTXU01AbVoPn2+Id6kdC5pA=";
+  };
+
+  nativeBuildInputs = [ pythonRelaxDepsHook ];
+
+  pythonRemoveDeps = [
+    # The `dataclasses` packages is a python2-only backport, unnecessary in
+    # python3.
+    "dataclasses"
+    # We call it faiss, not faiss-cpu.
+    "faiss-cpu"
+  ];
+
+  pythonRelaxDeps = [
+    # As of v2.15.3, autofaiss asks for pyarrow<8 but we have pyarrow v9.0.0 in
+    # nixpkgs at the time of writing (2022-12-15).
+    "pyarrow"
+  ];
+
+  propagatedBuildInputs = [ embedding-reader fsspec numpy faiss fire pyarrow ];
+
+  checkInputs = [ pytestCheckHook ];
+
+  disabledTests = [
+    # Attempts to spin up a Spark cluster and talk to it which doesn't work in
+    # the Nix build environment.
+    "test_build_partitioned_indexes"
+    "test_index_correctness_in_distributed_mode_with_multiple_indices"
+    "test_index_correctness_in_distributed_mode"
+    "test_quantize_with_pyspark"
+  ];
+
+  meta = with lib; {
+    description = "Automatically create Faiss knn indices with the most optimal similarity search parameters";
+    homepage = "https://github.com/criteo/autofaiss";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ samuela ];
+  };
+}
diff --git a/pkgs/development/python-modules/bluetooth-auto-recovery/default.nix b/pkgs/development/python-modules/bluetooth-auto-recovery/default.nix
index ab158f4d72e9..38a577cf123a 100644
--- a/pkgs/development/python-modules/bluetooth-auto-recovery/default.nix
+++ b/pkgs/development/python-modules/bluetooth-auto-recovery/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "bluetooth-auto-recovery";
-  version = "1.0.0";
+  version = "1.0.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-TkTWF8Ljt2cLIuz2FnktrZFAlpvTVkFh6evE8TSzJhk=";
+    hash = "sha256-gDypj2Vud6JtbGREPotvawgcsu5hbf92gJxxutWHcII=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/dnachisel/default.nix b/pkgs/development/python-modules/dnachisel/default.nix
index 1c86e3bccf6b..777b12b79cc8 100644
--- a/pkgs/development/python-modules/dnachisel/default.nix
+++ b/pkgs/development/python-modules/dnachisel/default.nix
@@ -15,13 +15,13 @@
 
 buildPythonPackage rec {
   pname = "dnachisel";
-  version = "3.2.9";
+  version = "3.2.10";
 
   src = fetchFromGitHub {
     owner = "Edinburgh-Genome-Foundry";
     repo = "DnaChisel";
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-Fg0gkI+01xIt8LQmNmRzkzd4AObg/99x34y5NclMtDQ=";
+    sha256 = "sha256-YlNOvK7ZXUHYdRX1NFEdZ646NGLtGXU1YgAjN6RY2QE=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/embedding-reader/default.nix b/pkgs/development/python-modules/embedding-reader/default.nix
new file mode 100644
index 000000000000..2d4af5ca1f12
--- /dev/null
+++ b/pkgs/development/python-modules/embedding-reader/default.nix
@@ -0,0 +1,39 @@
+{ buildPythonPackage
+, fetchFromGitHub
+, fsspec
+, lib
+, numpy
+, pandas
+, pyarrow
+, pytestCheckHook
+, pythonRelaxDepsHook
+}:
+
+buildPythonPackage rec {
+  pname = "embedding-reader";
+  version = "1.5.0";
+
+  src = fetchFromGitHub {
+    owner = "rom1504";
+    repo = pname;
+    rev = "refs/tags/${version}";
+    hash = "sha256-uyeIcAW9O9PR4cqmifC6Lx+Hn6XPb1RH/ksmUWvbdtw=";
+  };
+
+  nativeBuildInputs = [ pythonRelaxDepsHook ];
+
+  pythonRelaxDeps = [ "pyarrow" ];
+
+  propagatedBuildInputs = [ fsspec numpy pandas pyarrow ];
+
+  checkInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "embedding_reader" ];
+
+  meta = with lib; {
+    description = "Efficiently read embedding in streaming from any filesystem";
+    homepage = "https://github.com/rom1504/embedding-reader";
+    license = licenses.mit;
+    maintainers = with maintainers; [ samuela ];
+  };
+}
diff --git a/pkgs/development/python-modules/fakeredis/default.nix b/pkgs/development/python-modules/fakeredis/default.nix
index d86e6b016568..dfde6be5c4ca 100644
--- a/pkgs/development/python-modules/fakeredis/default.nix
+++ b/pkgs/development/python-modules/fakeredis/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "fakeredis";
-  version = "2.2.0";
+  version = "2.3.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "dsoftwareinc";
     repo = "fakeredis-py";
     rev = "refs/tags/v${version}";
-    hash = "sha256-W24DMVp3E6SYaVTUYCRDm/tLaGcjDqecO3rN1RO/J84=";
+    hash = "sha256-3CHBSjuvpH614Hag+8EWzpvVcdx140/NvsQHf3DyzZM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/govee-ble/default.nix b/pkgs/development/python-modules/govee-ble/default.nix
index 4034dc57cfec..7cee9b5713e7 100644
--- a/pkgs/development/python-modules/govee-ble/default.nix
+++ b/pkgs/development/python-modules/govee-ble/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "govee-ble";
-  version = "0.19.1";
+  version = "0.19.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-3uYAyItZ1X18pw3h3rTJpcv2H7O+e4sFCv1R7vb8QPI=";
+    hash = "sha256-HoEWFwpEzlTVlCD1sPOSKhvZleErxJdaqxKPv+1PcGo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/ical/default.nix b/pkgs/development/python-modules/ical/default.nix
index e1bed7184287..bb4668c5cbed 100644
--- a/pkgs/development/python-modules/ical/default.nix
+++ b/pkgs/development/python-modules/ical/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "ical";
-  version = "4.2.2";
+  version = "4.2.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "allenporter";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-YvBcfrZiHTornCEAFhNLN/siNvl119pD+o+0yNsRBA8=";
+    hash = "sha256-Af08Xnf5PNWTzRfRENSixVlfcqrvhSuutGxoDzHG4dk=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/jc/default.nix b/pkgs/development/python-modules/jc/default.nix
index a77d36eca069..f87984dc022f 100644
--- a/pkgs/development/python-modules/jc/default.nix
+++ b/pkgs/development/python-modules/jc/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "jc";
-  version = "1.22.2";
+  version = "1.22.3";
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "kellyjonbrazil";
     repo = pname;
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-GUzBZ9NCh+70yv40WDGWxQWq0F00oMpZOPQ3Y2AiQTQ=";
+    sha256 = "sha256-JOhsV4NyY5OW4smDEup1i9MTSQzK4Ldut/VybPB9ulc=";
   };
 
   propagatedBuildInputs = [ ruamel-yaml xmltodict pygments ];
diff --git a/pkgs/development/python-modules/logging-journald/default.nix b/pkgs/development/python-modules/logging-journald/default.nix
index 6abd9efeda27..7dc0d67e7a71 100644
--- a/pkgs/development/python-modules/logging-journald/default.nix
+++ b/pkgs/development/python-modules/logging-journald/default.nix
@@ -1,21 +1,28 @@
 { lib
 , buildPythonPackage
-, fetchPypi
+, fetchFromGitHub
+, poetry-core
 , pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "logging-journald";
-  version = "0.6.2";
-  format = "setuptools";
+  version = "0.6.4";
+  format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-U6kqAvMSyLDbThc6wAN/ri0vmt/vAxgFFZT65Csbpss=";
+  src = fetchFromGitHub {
+    owner = "mosquito";
+    repo = pname;
+    rev = "refs/tags/${version}";
+    hash = "sha256-g8oDFuqTBVutS7Uq7JCN+SXYL7UEQ+7G2nxzndjKAh8=";
   };
 
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
   # Circular dependency with aiomisc
   doCheck = false;
 
diff --git a/pkgs/development/python-modules/nettigo-air-monitor/default.nix b/pkgs/development/python-modules/nettigo-air-monitor/default.nix
index 1f23192eaaf1..35a6b1a613da 100644
--- a/pkgs/development/python-modules/nettigo-air-monitor/default.nix
+++ b/pkgs/development/python-modules/nettigo-air-monitor/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "nettigo-air-monitor";
-  version = "1.5.0";
+  version = "1.6.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "bieniu";
     repo = pname;
     rev = version;
-    hash = "sha256-84cd869k+JZZpjBBoHH2AyIo8ixJzVgpLLRBV4cMNKA=";
+    hash = "sha256-86YEpn3rI6Y4v0pcNk+/4tHCUzXpXZN5xwV9M/1gZ8U=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pyezviz/default.nix b/pkgs/development/python-modules/pyezviz/default.nix
index 4ae751b92dd8..a647f53150ad 100644
--- a/pkgs/development/python-modules/pyezviz/default.nix
+++ b/pkgs/development/python-modules/pyezviz/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "pyezviz";
-  version = "0.2.0.10";
+  version = "0.2.0.11";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "baqs";
     repo = "pyEzviz";
     rev = "refs/tags/${version}";
-    hash = "sha256-oi2F+OYxiQXq8JlIqbQyjpUuRciMwIaBCh27lvM7TuM=";
+    hash = "sha256-XG4+UQL8M5G8Y19PNTBAL51XJRE48qorE8FapaiddYI=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pyswitchbot/default.nix b/pkgs/development/python-modules/pyswitchbot/default.nix
index 872999bf565e..45ade7808584 100644
--- a/pkgs/development/python-modules/pyswitchbot/default.nix
+++ b/pkgs/development/python-modules/pyswitchbot/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "pyswitchbot";
-  version = "0.23.2";
+  version = "0.27.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "Danielhiversen";
     repo = "pySwitchbot";
     rev = "refs/tags/${version}";
-    hash = "sha256-bpa83uT3Gebwryb7Fc7kBv0m9aYgoL84Q625AavLw40=";
+    hash = "sha256-2ef2a8Ru3fl0mdVBy4CDObd22z0u4AF2V9FvhSfR9B4=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pytibber/default.nix b/pkgs/development/python-modules/pytibber/default.nix
index a4047483eb63..0e25985cf337 100644
--- a/pkgs/development/python-modules/pytibber/default.nix
+++ b/pkgs/development/python-modules/pytibber/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "pytibber";
-  version = "0.26.4";
+  version = "0.26.5";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "Danielhiversen";
     repo = "pyTibber";
     rev = "refs/tags/${version}";
-    hash = "sha256-R++vsJ2CJwPxG/32qam/LRj7GUj3obh9z20xXNMAnQ4=";
+    hash = "sha256-YW+Oi/ORXjeFLQfeVxCKgyRGBVx4TZKGeKMCgYkEIzo=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pyupgrade/default.nix b/pkgs/development/python-modules/pyupgrade/default.nix
index 2e17db7d29bd..b14fb46e98b1 100644
--- a/pkgs/development/python-modules/pyupgrade/default.nix
+++ b/pkgs/development/python-modules/pyupgrade/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "pyupgrade";
-  version = "3.1.0";
+  version = "3.3.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "asottile";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-OzU3Qv6qdEw0hJdbQ7Q3T6zOGpUt2uZyfy1Fxm3GT0Q=";
+    hash = "sha256-vg1eNxIkdHM1MMTkCof/ED6nqFhwSgEiKjYmqAyHMp0=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/sentry-sdk/default.nix b/pkgs/development/python-modules/sentry-sdk/default.nix
index ff52a049c7ff..fbb573fa98f8 100644
--- a/pkgs/development/python-modules/sentry-sdk/default.nix
+++ b/pkgs/development/python-modules/sentry-sdk/default.nix
@@ -40,7 +40,7 @@
 
 buildPythonPackage rec {
   pname = "sentry-sdk";
-  version = "1.11.1";
+  version = "1.12.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -49,7 +49,7 @@ buildPythonPackage rec {
     owner = "getsentry";
     repo = "sentry-python";
     rev = "refs/tags/${version}";
-    hash = "sha256-2AAi9BrF15TDiv9v2d/UF9JPgJheet33k+7iHqPlw5g=";
+    hash = "sha256-22GQO3y24xlbZgxNsD8eEWj/pVWcOlYiRV52jKTf7sc=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/sqlmap/default.nix b/pkgs/development/python-modules/sqlmap/default.nix
index 791da716c56b..f6378cfce9ed 100644
--- a/pkgs/development/python-modules/sqlmap/default.nix
+++ b/pkgs/development/python-modules/sqlmap/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "sqlmap";
-  version = "1.6.11";
+  version = "1.6.12";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-/zucBRLf5qnRURS0YS3Zv4jxRZYOIGtzPBepQ7a2nvs=";
+    sha256 = "sha256-RHDW2A9mC0zIpjNqUUhXvWDBWj7r4O+9FTFRYUqoAXw=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/transformers/default.nix b/pkgs/development/python-modules/transformers/default.nix
index e445dd7e8db3..15eee616aea3 100644
--- a/pkgs/development/python-modules/transformers/default.nix
+++ b/pkgs/development/python-modules/transformers/default.nix
@@ -24,7 +24,7 @@
 
 buildPythonPackage rec {
   pname = "transformers";
-  version = "4.24.0";
+  version = "4.25.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -33,7 +33,7 @@ buildPythonPackage rec {
     owner = "huggingface";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-aGtTey+QK12URZcGNaRAlcaOphON4ViZOGdigtXU1g0=";
+    hash = "sha256-b0xEHM72HcaTRgGisB6fnPrMaXZ8EcJfowwK92W4aYg=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/yalexs-ble/default.nix b/pkgs/development/python-modules/yalexs-ble/default.nix
index 8fd6aaed63a3..a84ba321ab21 100644
--- a/pkgs/development/python-modules/yalexs-ble/default.nix
+++ b/pkgs/development/python-modules/yalexs-ble/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "yalexs-ble";
-  version = "1.11.4";
+  version = "1.12.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "bdraco";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-EiT1Bnez1en8NTcNrGn9GmD//VcaBMfk4iwXaYTm8cU=";
+    hash = "sha256-QVZlf7t925RFVNBxOj39Ln7sezTkwQ065sbVFcoQG4Y=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/zamg/default.nix b/pkgs/development/python-modules/zamg/default.nix
index e24e712e7c07..66532c75b7d8 100644
--- a/pkgs/development/python-modules/zamg/default.nix
+++ b/pkgs/development/python-modules/zamg/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "zamg";
-  version = "0.2.0";
+  version = "0.2.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "killer0071234";
     repo = "python-zamg";
     rev = "refs/tags/v${version}";
-    hash = "sha256-mql3r1TdVHwpJi54TMj6kfP3uZO2maa5dynUL4fOiNY=";
+    hash = "sha256-P9BvrINsF6OZdNw8L8RXjpDgVWvW5s3qgCFXtEeUChM=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/tools/misc/devspace/default.nix b/pkgs/development/tools/misc/devspace/default.nix
index fe831c2eb93d..183175ecb34a 100644
--- a/pkgs/development/tools/misc/devspace/default.nix
+++ b/pkgs/development/tools/misc/devspace/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "devspace";
-  version = "6.2.1";
+  version = "6.2.2";
 
   src = fetchFromGitHub {
     owner = "loft-sh";
     repo = "devspace";
     rev = "v${version}";
-    sha256 = "sha256-V/LaK4pzML5tYaT5YBMsYgzGzsoJ6tkAOo2mGlEkJWQ=";
+    sha256 = "sha256-eET7Q0UvpvmPPgnrc6tX69dYhrsO2bsyzFkAJyp9FLg=";
   };
 
   vendorSha256 = null;
diff --git a/pkgs/development/tools/nasmfmt/default.nix b/pkgs/development/tools/nasmfmt/default.nix
index fb727e0f51c9..bb94e8f8ee81 100644
--- a/pkgs/development/tools/nasmfmt/default.nix
+++ b/pkgs/development/tools/nasmfmt/default.nix
@@ -1,22 +1,27 @@
-{ lib, buildGoPackage, fetchFromGitHub, go }:
+{ lib, buildGoModule, fetchFromGitHub }:
 
-buildGoPackage rec {
+buildGoModule rec {
   pname = "nasmfmt";
-  version = "unstable-2021-04-24";
+  version = "unstable-2022-09-15";
 
   src = fetchFromGitHub {
     owner = "yamnikov-oleg";
     repo = "nasmfmt";
-    rev = "efba220c5252eb717f080d266dcc8304efdeab40";
-    sha256 = "sha256-snhXF+IP0qzl43rKQ0Ugfo1zv3RyNfjxnMpjZEBgPQg=";
+    rev = "127dbe8e72376c67d7dff89010ccfb49fc7b533e";
+    hash = "sha256-1c7ZOdoM0/Us7cnTT3sds2P5pcCedrCfl0GqQBnf9Rk=";
   };
 
-  goPackagePath = "github.com/yamnikov-oleg/nasmfmt";
+  vendorHash = "sha256-pQpattmS9VmO3ZIQUFn66az8GSmB4IvYhTTCFn6SUmo=";
+
+  preBuild = ''
+    cp ${./go.mod} go.mod
+  '';
+
+  ldflags = [ "-s" "-w" ];
 
   meta = with lib; {
     description = "Formatter for NASM source files";
     homepage = "https://github.com/yamnikov-oleg/nasmfmt";
-    platforms = go.meta.platforms;
     license = licenses.mit;
     maintainers = with maintainers; [ ckie ];
   };
diff --git a/pkgs/development/tools/nasmfmt/go.mod b/pkgs/development/tools/nasmfmt/go.mod
new file mode 100644
index 000000000000..0dfb1521c9e5
--- /dev/null
+++ b/pkgs/development/tools/nasmfmt/go.mod
@@ -0,0 +1,3 @@
+module github.com/yamnikov-oleg/nasmfmt
+
+go 1.18
diff --git a/pkgs/servers/dns/pdns-recursor/default.nix b/pkgs/servers/dns/pdns-recursor/default.nix
index 4e9e2f014f9b..566f2ab015ff 100644
--- a/pkgs/servers/dns/pdns-recursor/default.nix
+++ b/pkgs/servers/dns/pdns-recursor/default.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "pdns-recursor";
-  version = "4.7.3";
+  version = "4.8.0";
 
   src = fetchurl {
     url = "https://downloads.powerdns.com/releases/pdns-recursor-${version}.tar.bz2";
-    sha256 = "sha256-IG12bMjwGJ951pr2TY2TfsxhpNE+jqZZTXj+MOYUBfI=";
+    sha256 = "zLkBehp4jpXpSOeyQO+NtTropQe5FfJgGI7zQ/f2i9w=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/servers/kubemq-community/default.nix b/pkgs/servers/kubemq-community/default.nix
index a3428a8db8a3..b631ce233ad6 100644
--- a/pkgs/servers/kubemq-community/default.nix
+++ b/pkgs/servers/kubemq-community/default.nix
@@ -2,12 +2,12 @@
 
 buildGoModule rec {
   pname = "kubemq-community";
-  version = "2.3.5";
+  version = "2.3.7";
   src = fetchFromGitHub {
     owner = "kubemq-io";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-kR2/Is1fQqpRyQ8yKSEvXV5xzXcHldCqgnCRNRZ+Ekg=";
+    sha256 = "sha256-oAo/O3T3wtfCumT2kjoyXKfCFHijVzSmxhslaKaeF3Y=";
   };
 
   CGO_ENABLED=0;
@@ -16,7 +16,7 @@ buildGoModule rec {
 
   doCheck = false;  # grpc tests are flaky
 
-  vendorSha256 = "sha256-mie+Akfsn+vjoxYnI23Zxk0OTFbMf51BDbJk2c0U7iU=";
+  vendorSha256 = "sha256-L1BxxSI2t0qWXizge+X3BrpGPaSy5Dk81vKuI0N5Ywg=";
 
   meta = {
     homepage = "https://github.com/kubemq-io/kubemq-community";
diff --git a/pkgs/tools/misc/coinlive/default.nix b/pkgs/tools/misc/coinlive/default.nix
index 8841f1df6e3c..a386853247dc 100644
--- a/pkgs/tools/misc/coinlive/default.nix
+++ b/pkgs/tools/misc/coinlive/default.nix
@@ -1,8 +1,10 @@
 { lib
+, stdenv
 , fetchFromGitHub
 , openssl
 , pkg-config
 , rustPlatform
+, Security
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -24,6 +26,8 @@ rustPlatform.buildRustPackage rec {
 
   buildInputs = [
     openssl
+  ] ++ lib.optionals stdenv.isDarwin [
+    Security
   ];
 
   meta = with lib; {
diff --git a/pkgs/tools/misc/mcfly/default.nix b/pkgs/tools/misc/mcfly/default.nix
index e5f079a5c316..3727ef2fd95d 100644
--- a/pkgs/tools/misc/mcfly/default.nix
+++ b/pkgs/tools/misc/mcfly/default.nix
@@ -2,13 +2,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mcfly";
-  version = "0.7.0";
+  version = "0.7.1";
 
   src = fetchFromGitHub {
     owner = "cantino";
     repo = "mcfly";
     rev = "v${version}";
-    sha256 = "sha256-4vhDtKVo5DI/A9Cg/2I7vn1bJL/8VvUtsqMn8NdVqco=";
+    sha256 = "sha256-F3kjJvv94yxiDZx3BkvCQyWDTAQfw5s5yhDfaAxwvLQ=";
   };
 
   postPatch = ''
@@ -17,7 +17,7 @@ rustPlatform.buildRustPackage rec {
     substituteInPlace mcfly.fish --replace '(command which mcfly)'  '${placeholder "out"}/bin/mcfly'
   '';
 
-  cargoSha256 = "sha256-Q8J75kI3Oob2cMweW5d1nD2mSX0WUhIacUx6XQnk95c=";
+  cargoSha256 = "sha256-9h4a2P5R571vdeRM1cgt67+Zx8VEIBrh2/Aad66ZQqc=";
 
   meta = with lib; {
     homepage = "https://github.com/cantino/mcfly";
diff --git a/pkgs/tools/misc/mongodb-compass/default.nix b/pkgs/tools/misc/mongodb-compass/default.nix
index 15345a28fb90..4fd81d1fd9fc 100644
--- a/pkgs/tools/misc/mongodb-compass/default.nix
+++ b/pkgs/tools/misc/mongodb-compass/default.nix
@@ -33,7 +33,7 @@ xorg,
 }:
 
 let
-  version = "1.34.1";
+  version = "1.34.2";
 
   rpath = lib.makeLibraryPath [
     alsa-lib
@@ -82,7 +82,7 @@ let
     if stdenv.hostPlatform.system == "x86_64-linux" then
       fetchurl {
         url = "https://downloads.mongodb.com/compass/mongodb-compass_${version}_amd64.deb";
-        sha256 = "sha256-TkwSfzTIUMCyNFVA3K+Y2ZKA3gTGXHi1mgySXef1KE4=";
+        sha256 = "sha256-qXteinKphHi2dwHQ4WMIegG+Yb9YGU/WuCbhwcoIV3Y=";
       }
     else
       throw "MongoDB compass is not supported on ${stdenv.hostPlatform.system}";
diff --git a/pkgs/tools/networking/kapp/default.nix b/pkgs/tools/networking/kapp/default.nix
index 19596e4cf13e..a7d2bda6428c 100644
--- a/pkgs/tools/networking/kapp/default.nix
+++ b/pkgs/tools/networking/kapp/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "kapp";
-  version = "0.54.0";
+  version = "0.54.1";
 
   src = fetchFromGitHub {
     owner = "vmware-tanzu";
     repo = "carvel-kapp";
     rev = "v${version}";
-    sha256 = "sha256-68JIsL+qrXB3yLU+euznAVPv57cQd5qzvHn547nwHVI=";
+    sha256 = "sha256-q9Am9ryrvmvuUCmHNCsf1iZz0wdaO87C1Gbvi40cKIA=";
   };
 
   vendorSha256 = null;
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 5a1a9a295e9f..ea0ae4665608 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -16277,6 +16277,8 @@ with pkgs;
 
   self = pkgsi686Linux.callPackage ../development/interpreters/self { };
 
+  smiley-sans = callPackage ../data/fonts/smiley-sans { };
+
   inherit (callPackages ../applications/networking/cluster/spark { })
     spark_3_2
     spark_3_1
@@ -18753,6 +18755,7 @@ with pkgs;
   CoinMP = callPackage ../development/libraries/CoinMP { };
 
   coinlive = callPackage ../tools/misc/coinlive {
+    inherit (darwin.apple_sdk.frameworks) Security;
     openssl = openssl_1_1;
   };
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 127bee350da6..405b9de1c9db 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -780,6 +780,8 @@ self: super: with self; {
 
   autocommand = callPackage ../development/python-modules/autocommand { };
 
+  autofaiss = callPackage ../development/python-modules/autofaiss { };
+
   autograd = callPackage ../development/python-modules/autograd { };
 
   autoit-ripper = callPackage ../development/python-modules/autoit-ripper { };
@@ -2935,6 +2937,8 @@ self: super: with self; {
 
   email-validator = callPackage ../development/python-modules/email-validator { };
 
+  embedding-reader = callPackage ../development/python-modules/embedding-reader { };
+
   embrace = callPackage ../development/python-modules/embrace { };
 
   emcee = callPackage ../development/python-modules/emcee { };