diff --git a/nixos/modules/config/console.nix b/nixos/modules/config/console.nix
index 168bebd8d06a..5b07901f9901 100644
--- a/nixos/modules/config/console.nix
+++ b/nixos/modules/config/console.nix
@@ -12,7 +12,7 @@ let
 
   optimizedKeymap = pkgs.runCommand "keymap" {
     nativeBuildInputs = [ pkgs.buildPackages.kbd ];
-    LOADKEYS_KEYMAP_PATH = "${consoleEnv}/share/keymaps/**";
+    LOADKEYS_KEYMAP_PATH = "${consoleEnv pkgs.kbd}/share/keymaps/**";
     preferLocalBuild = true;
   } ''
     loadkeys -b ${optionalString isUnicode "-u"} "${cfg.keyMap}" > $out
@@ -24,9 +24,9 @@ let
     FONT=${cfg.font}
   '';
 
-  consoleEnv = pkgs.buildEnv {
+  consoleEnv = kbd: pkgs.buildEnv {
     name = "console-env";
-    paths = [ pkgs.kbd ] ++ cfg.packages;
+    paths = [ kbd ] ++ cfg.packages;
     pathsToLink = [
       "/share/consolefonts"
       "/share/consoletrans"
@@ -136,9 +136,9 @@ in
         # virtual consoles.
         environment.etc."vconsole.conf".source = vconsoleConf;
         # Provide kbd with additional packages.
-        environment.etc.kbd.source = "${consoleEnv}/share";
+        environment.etc.kbd.source = "${consoleEnv pkgs.kbd}/share";
 
-        boot.initrd.preLVMCommands = mkBefore ''
+        boot.initrd.preLVMCommands = mkIf (!config.boot.initrd.systemd.enable) (mkBefore ''
           kbd_mode ${if isUnicode then "-u" else "-a"} -C /dev/console
           printf "\033%%${if isUnicode then "G" else "@"}" >> /dev/console
           loadkmap < ${optimizedKeymap}
@@ -146,12 +146,23 @@ in
           ${optionalString cfg.earlySetup ''
             setfont -C /dev/console $extraUtils/share/consolefonts/font.psf
           ''}
-        '';
+        '');
+
+        boot.initrd.systemd.contents = {
+          "/etc/kbd".source = "${consoleEnv config.boot.initrd.systemd.package.kbd}/share";
+          "/etc/vconsole.conf".source = vconsoleConf;
+        };
+        boot.initrd.systemd.storePaths = [
+          "${config.boot.initrd.systemd.package}/lib/systemd/systemd-vconsole-setup"
+          "${config.boot.initrd.systemd.package.kbd}/bin/setfont"
+          "${config.boot.initrd.systemd.package.kbd}/bin/loadkeys"
+          "${config.boot.initrd.systemd.package.kbd.gzip}/bin/gzip" # keyboard layouts are compressed
+        ];
 
         systemd.services.reload-systemd-vconsole-setup =
           { description = "Reset console on configuration changes";
             wantedBy = [ "multi-user.target" ];
-            restartTriggers = [ vconsoleConf consoleEnv ];
+            restartTriggers = [ vconsoleConf (consoleEnv pkgs.kbd) ];
             reloadIfChanged = true;
             serviceConfig =
               { RemainAfterExit = true;
@@ -175,7 +186,7 @@ in
           ${if substring 0 1 cfg.font == "/" then ''
             font="${cfg.font}"
           '' else ''
-            font="$(echo ${consoleEnv}/share/consolefonts/${cfg.font}.*)"
+            font="$(echo ${consoleEnv pkgs.kbd}/share/consolefonts/${cfg.font}.*)"
           ''}
           if [[ $font == *.gz ]]; then
             gzip -cd $font > $out/share/consolefonts/font.psf
@@ -183,6 +194,10 @@ in
             cp -L $font $out/share/consolefonts/font.psf
           fi
         '';
+        assertions = [{
+          assertion = !config.boot.initrd.systemd.enable;
+          message = "console.earlySetup is implied by systemd stage 1";
+        }];
       })
     ]))
   ];
diff --git a/nixos/modules/system/boot/systemd/initrd.nix b/nixos/modules/system/boot/systemd/initrd.nix
index c900348619c0..7f5d3ae092a7 100644
--- a/nixos/modules/system/boot/systemd/initrd.nix
+++ b/nixos/modules/system/boot/systemd/initrd.nix
@@ -398,7 +398,6 @@ in {
         "${cfg.package}/lib/systemd/systemd-shutdown"
         "${cfg.package}/lib/systemd/systemd-sulogin-shell"
         "${cfg.package}/lib/systemd/systemd-sysctl"
-        "${cfg.package}/lib/systemd/systemd-vconsole-setup"
 
         # additional systemd directories
         "${cfg.package}/lib/systemd/system-generators"
diff --git a/pkgs/applications/misc/1password-gui/default.nix b/pkgs/applications/misc/1password-gui/default.nix
index 311ef3037bb8..266cecf28916 100644
--- a/pkgs/applications/misc/1password-gui/default.nix
+++ b/pkgs/applications/misc/1password-gui/default.nix
@@ -42,11 +42,11 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "1password";
-  version = "8.6.0";
+  version = "8.6.1";
 
   src = fetchurl {
     url = "https://downloads.1password.com/linux/tar/stable/x86_64/1password-${version}.x64.tar.gz";
-    sha256 = "AgmLbf2YHZr8McSIL5dxp5HxOC7gLrZWIopuA7aL0JI=";
+    sha256 = "sha256-CbSx1UJAvNrA1gTQyi6r8NgjwQ7H+tqWU9t3TUNrDMg=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
@@ -128,7 +128,7 @@ in stdenv.mkDerivation rec {
     description = "Multi-platform password manager";
     homepage = "https://1password.com/";
     license = licenses.unfree;
-    maintainers = with maintainers; [ timstott savannidgerinel ];
+    maintainers = with maintainers; [ timstott savannidgerinel maxeaubrey ];
     platforms = [ "x86_64-linux" ];
   };
 }
diff --git a/pkgs/applications/misc/bottles/default.nix b/pkgs/applications/misc/bottles/default.nix
index 8ecb1cf1d01d..8898e0fd1d9f 100644
--- a/pkgs/applications/misc/bottles/default.nix
+++ b/pkgs/applications/misc/bottles/default.nix
@@ -20,8 +20,8 @@ let
 in
 python3Packages.buildPythonApplication rec {
   pname = "bottles";
-  version = "2022.3.28-trento-1";
-  sha256 = "1mpvym7b88pb0xxij32arj31q5m6b3z47p8zv9njvkfs0151b2v4";
+  version = "2022.4.14-trento";
+  sha256 = "0kjc1w8x4d6g2lx8x8isa2vnwacyjlh9lldf14wn4b118hsw85zs";
   # Note: Update via pkgs/applications/misc/bottles/update.py
   # mostly copypasted from pkgs/applications/networking/instant-messengers/telegram/tdesktop/update.py
 
diff --git a/pkgs/applications/networking/instant-messengers/ferdi/default.nix b/pkgs/applications/networking/instant-messengers/ferdi/default.nix
index 6e0e39043ee0..90ab331426a0 100644
--- a/pkgs/applications/networking/instant-messengers/ferdi/default.nix
+++ b/pkgs/applications/networking/instant-messengers/ferdi/default.nix
@@ -19,7 +19,7 @@ mkFranzDerivation' rec {
   name = "Ferdi";
   version = "5.8.1";
   src = fetchurl {
-    url = "https://github.com/getferdi/ferdi/releases/download/v${version}/ferdi_${version}_amd64.deb";
+    url = "https://master.dl.sourceforge.net/project/ferdi.mirror/v${version}/ferdi_${version}_amd64.deb";
     sha256 = "sha256-Bl7bM5iDQlfPSZxksqlg7GbuwWlm53QkOf/TQEg3/n0=";
   };
   extraBuildInputs = [ xorg.libxshmfence ];
diff --git a/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix b/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
index f03a91faa23f..445078070220 100644
--- a/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "signalbackup-tools";
-  version = "20220316";
+  version = "20220411";
 
   src = fetchFromGitHub {
     owner = "bepaald";
     repo = pname;
     rev = version;
-    sha256 = "sha256-c9eqY3KBzCrNOLNf1DGpARmxGzwga3+tBg3e7Yr+Rb8=";
+    sha256 = "sha256-ia+8RZ1wQTyUCs+6o9AMCH4Kh2neHjPWbXWjLkDb6/w=";
   };
 
   # Remove when Apple SDK is >= 10.13
diff --git a/pkgs/applications/networking/instant-messengers/wire-desktop/default.nix b/pkgs/applications/networking/instant-messengers/wire-desktop/default.nix
index 4b06588c24f3..4d7a2218e7df 100644
--- a/pkgs/applications/networking/instant-messengers/wire-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/wire-desktop/default.nix
@@ -11,6 +11,7 @@
 , cpio
 , xar
 , libdbusmenu
+, libxshmfence
 }:
 
 let
@@ -90,7 +91,7 @@ let
       wrapGAppsHook
     ];
 
-    buildInputs = atomEnv.packages;
+    buildInputs = [ libxshmfence ] ++ atomEnv.packages;
 
     unpackPhase = ''
       runHook preUnpack
diff --git a/pkgs/applications/networking/mailreaders/aerc/default.nix b/pkgs/applications/networking/mailreaders/aerc/default.nix
index 6b5ad03366dc..5d00242452b8 100644
--- a/pkgs/applications/networking/mailreaders/aerc/default.nix
+++ b/pkgs/applications/networking/mailreaders/aerc/default.nix
@@ -40,22 +40,19 @@ buildGoModule rec {
     substituteAllInPlace doc/aerc-config.5.scd
   '';
 
+  makeFlags = [ "PREFIX=${placeholder "out"}" ];
+
   pythonPath = [
     python3.pkgs.colorama
   ];
 
   buildInputs = [ python3 notmuch ];
 
-  buildPhase = "
-    runHook preBuild
-    # we use make instead of go build
-    runHook postBuild
-  ";
-
   installPhase = ''
     runHook preInstall
-    make PREFIX=$out GOFLAGS="$GOFLAGS -tags=notmuch" install
-    wrapPythonProgramsIn $out/share/aerc/filters "$out $pythonPath"
+
+    make $makeFlags GOFLAGS="$GOFLAGS -tags=notmuch" install
+
     runHook postInstall
   '';
 
diff --git a/pkgs/applications/networking/resilio-sync/default.nix b/pkgs/applications/networking/resilio-sync/default.nix
index fdd4ebdbd92f..bbce0e1d350e 100644
--- a/pkgs/applications/networking/resilio-sync/default.nix
+++ b/pkgs/applications/networking/resilio-sync/default.nix
@@ -1,25 +1,25 @@
 { lib, stdenv, fetchurl, ... }:
 
-let
-  arch = {
-    x86_64-linux = "x64";
-    i686-linux = "i386";
-    aarch64-linux = "arm64";
-  }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
-  libPath = lib.makeLibraryPath [ stdenv.cc.libc ];
-
-in stdenv.mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "resilio-sync";
-  version = "2.7.2";
+  version = "2.7.3";
 
-  src = fetchurl {
-    url = "https://download-cdn.resilio.com/${version}/linux-${arch}/resilio-sync_${arch}.tar.gz";
-    sha256 = {
-      x86_64-linux = "0gar5lzv1v4yqmypwqsjnfb64vffzn8mw9vnjr733fgf1pmr57hf";
-      i686-linux   = "1bws7r86h1vysjkhyvp2zk8yvxazmlczvhjlcayldskwq48iyv6w";
-      aarch64-linux = "0j8wk5cf8bcaaqxi8gnqf1mpv8nyfjyr4ibls7jnn2biqq767af2";
-    }.${stdenv.hostPlatform.system};
-  };
+  src = {
+    x86_64-linux = fetchurl {
+      url = "https://download-cdn.resilio.com/${version}/linux-x64/resilio-sync_x64.tar.gz";
+      sha256 = "sha256-DYQs9KofHkvtlsRQHRLwQHoHwSZkr40Ih0RVAw2xv3M=";
+    };
+
+    i686-linux = fetchurl {
+      url = "https://download-cdn.resilio.com/${version}/linux-i386/resilio-sync_i386.tar.gz";
+      sha256 = "sha256-PFKVBs0KthG4tuvooHkAciPhNQP0K8oi2LyoRUs5V7I=";
+    };
+
+    aarch64-linux = fetchurl {
+      url = "https://download-cdn.resilio.com/${version}/linux-arm64/resilio-sync_arm64.tar.gz";
+      sha256 = "sha256-o2DlYOBTkFhQMEDJySlVSNlVqLNbBzacyv2oTwxrXto=";
+    };
+  }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
 
   dontStrip = true; # Don't strip, otherwise patching the rpaths breaks
   sourceRoot = ".";
@@ -28,7 +28,7 @@ in stdenv.mkDerivation rec {
     install -D rslsync "$out/bin/rslsync"
     patchelf \
       --interpreter "$(< $NIX_CC/nix-support/dynamic-linker)" \
-      --set-rpath ${libPath} "$out/bin/rslsync"
+      --set-rpath ${lib.makeLibraryPath [ stdenv.cc.libc ]} "$out/bin/rslsync"
   '';
 
   meta = with lib; {
diff --git a/pkgs/applications/version-management/gitkraken/default.nix b/pkgs/applications/version-management/gitkraken/default.nix
index 52ad060c990d..8d89420607a3 100644
--- a/pkgs/applications/version-management/gitkraken/default.nix
+++ b/pkgs/applications/version-management/gitkraken/default.nix
@@ -11,24 +11,24 @@ with lib;
 let
   curlWithGnuTls = curl.override { gnutlsSupport = true; opensslSupport = false; };
   pname = "gitkraken";
-  version = "8.3.3";
+  version = "8.4.0";
 
   throwSystem = throw "Unsupported system: ${stdenv.hostPlatform.system}";
 
   srcs = {
     x86_64-linux = fetchzip {
       url = "https://release.axocdn.com/linux/GitKraken-v${version}.tar.gz";
-      sha256 = "185msrpa33w40prc88n5m0g12wh8r6szj56iikk4ps6kwr6wamy7";
+      sha256 = "sha256-yVQILgEn67iiUUQqpQqt++cZMN5u9FT0MbNf7pFES9Y=";
     };
 
     x86_64-darwin = fetchzip {
       url = "https://release.axocdn.com/darwin/GitKraken-v${version}.zip";
-      sha256 = "0iam5ni8imajxhcv12zib6m475i6czllmqy512r1wmzw9zbilf43";
+      sha256 = "sha256-cTHMl5peXj52Fy2XBfKaUKLuZnPCC4XdReOiB0fbCNk=";
     };
 
     aarch64-darwin = fetchzip {
       url = "https://release.axocdn.com/darwin-arm64/GitKraken-v${version}.zip";
-      sha256 = "12af421r4d8s4l5j54xyd3x8pa72nbilass95v0y3b0wgsi35g0z";
+      sha256 = "sha256-M3Y5qP0nozk5iTnEGK2+ds8/Vb/l0nhIo4LSrCWLDu8=";
     };
   };
 
diff --git a/pkgs/development/compilers/llvm/14/default.nix b/pkgs/development/compilers/llvm/14/default.nix
index 93cacafdc555..4e5e85684a2a 100644
--- a/pkgs/development/compilers/llvm/14/default.nix
+++ b/pkgs/development/compilers/llvm/14/default.nix
@@ -18,7 +18,7 @@
 }:
 
 let
-  release_version = "14.0.0";
+  release_version = "14.0.1";
   candidate = ""; # empty or "rcN"
   dash-candidate = lib.optionalString (candidate != "") "-${candidate}";
   rev = ""; # When using a Git commit
@@ -30,7 +30,7 @@ let
     owner = "llvm";
     repo = "llvm-project";
     rev = if rev != "" then rev else "llvmorg-${version}";
-    sha256 = "1ixqzjzq4ad3mv1w44gwcg1shy34c2b3i9ja71vx1wa7l2ms2376";
+    sha256 = "14wgrjwj02ivlwb1zgidacspkkcfpsqjmgd7r838qmwpk56yxl9f";
   };
 
   llvm_meta = {
diff --git a/pkgs/development/libraries/ghc_filesystem/default.nix b/pkgs/development/libraries/ghc_filesystem/default.nix
index 0ffad301a493..3232d7d8f615 100644
--- a/pkgs/development/libraries/ghc_filesystem/default.nix
+++ b/pkgs/development/libraries/ghc_filesystem/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "filesystem";
-  version = "1.5.6";
+  version = "1.5.12";
 
   src = fetchFromGitHub {
     owner = "gulrak";
     repo = "filesystem";
     rev = "v${version}";
-    hash = "sha256-qnBZ9aCrCPOgxymjbzrRs0gssijo8MJOMiy7QWWMb5c=";
+    hash = "sha256-j4RE5Ach7C7Kef4+H9AHSXa2L8OVyJljDwBduKcC4eE=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/python-modules/awsiotpythonsdk/default.nix b/pkgs/development/python-modules/awsiotpythonsdk/default.nix
index fc188ae683c6..7ec8b9008fd4 100644
--- a/pkgs/development/python-modules/awsiotpythonsdk/default.nix
+++ b/pkgs/development/python-modules/awsiotpythonsdk/default.nix
@@ -6,7 +6,7 @@
 
 buildPythonPackage rec {
   pname = "AWSIoTPythonSDK";
-  version = "1.5.1";
+  version = "1.5.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -14,8 +14,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "aws";
     repo = "aws-iot-device-sdk-python";
-    rev = "v${version}";
-    sha256 = "sha256-UpfgoCVbweOpWbgaqNebAAkWmhjkZu3txVoTZ/qhl3g=";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-GHMnDRxXkaKDTaawwPtMqa7EZJ8Y35+ScgtfEP9PJGs=";
   };
 
   # Module has no tests
diff --git a/pkgs/development/python-modules/dask-mpi/default.nix b/pkgs/development/python-modules/dask-mpi/default.nix
index cc44a6e97eb7..15f0b315e9f0 100644
--- a/pkgs/development/python-modules/dask-mpi/default.nix
+++ b/pkgs/development/python-modules/dask-mpi/default.nix
@@ -7,12 +7,12 @@
 }:
 
 buildPythonPackage rec {
-  version = "2021.11.0";
+  version = "2022.4.0";
   pname = "dask-mpi";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "602d2e2d7816a4abc1eb17998e1acc93a43b6f82bf94a6accca169a42de21898";
+    sha256 = "sha256-CgTx19NaBs3/UGWTMw1EFOokLJFySYzhkfV0LqxJnhc=";
   };
 
   propagatedBuildInputs = [ dask distributed mpi4py ];
diff --git a/pkgs/development/python-modules/geocachingapi/default.nix b/pkgs/development/python-modules/geocachingapi/default.nix
index 2b4bba0a434b..9d7572731788 100644
--- a/pkgs/development/python-modules/geocachingapi/default.nix
+++ b/pkgs/development/python-modules/geocachingapi/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "geocachingapi";
-  version = "0.1.1";
+  version = "0.2.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "Sholofly";
     repo = "geocachingapi-python";
     rev = "refs/tags/${version}";
-    sha256 = "sha256-Aj1fZ0dGlV7ynoZ7QwGrbku+IpOCx85wE19JDJaaYmc=";
+    sha256 = "sha256-36CkbwRDpMTprsZuPJ9khSrzqLb2Sz7iCvXtJ46uTL0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/hahomematic/default.nix b/pkgs/development/python-modules/hahomematic/default.nix
index 6bf0d0dff358..8f00c8ec1751 100644
--- a/pkgs/development/python-modules/hahomematic/default.nix
+++ b/pkgs/development/python-modules/hahomematic/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "hahomematic";
-  version = "1.1.1";
+  version = "1.1.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "danielperna84";
     repo = pname;
     rev = "refs/tags/${version}";
-    sha256 = "sha256-Wxdh9NzrZVPnDbkb6M8tTqA7RQ4enULLq3GFr0qfynY=";
+    sha256 = "sha256-yglKgRsjYGzW8PiMWu2YOQRoxei7VFPNrS8VYwDIAA0=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/jenkins-job-builder/default.nix b/pkgs/development/python-modules/jenkins-job-builder/default.nix
index bc5432cb6e3f..99c5aff43c0e 100644
--- a/pkgs/development/python-modules/jenkins-job-builder/default.nix
+++ b/pkgs/development/python-modules/jenkins-job-builder/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "jenkins-job-builder";
-  version = "3.12.0";
+  version = "4.0.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-gpsot4LW1IBfYt8eb72WJqMzWEAMt4gqWOD1KhTQjds=";
+    sha256 = "sha256-6bsiq3LwlBZdF378HXEIgZSKf7NsTjo3bbSmt7XkYgM=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pysigma-backend-insightidr/default.nix b/pkgs/development/python-modules/pysigma-backend-insightidr/default.nix
new file mode 100644
index 000000000000..4a8a51e222b9
--- /dev/null
+++ b/pkgs/development/python-modules/pysigma-backend-insightidr/default.nix
@@ -0,0 +1,47 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, poetry-core
+, pysigma
+, pytestCheckHook
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "pysigma-backend-insightidr";
+  version = "0.1.4";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.8";
+
+  src = fetchFromGitHub {
+    owner = "SigmaHQ";
+    repo = "pySigma-backend-insightidr";
+    rev = "v${version}";
+    hash = "sha256-ivigYBCoQtAfVmTiKvYugzPbw3tG0Xn5IYbHVJuubDE=";
+  };
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    pysigma
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "sigma.backends.insight_idr"
+    "sigma.pipelines.insight_idr"
+  ];
+
+  meta = with lib; {
+    description = "Library to support the Rapid7 InsightIDR backend for pySigma";
+    homepage = "https://github.com/SigmaHQ/pySigma-backend-insightidr";
+    license = with licenses; [ lgpl21Only ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/pysigma-backend-splunk/default.nix b/pkgs/development/python-modules/pysigma-backend-splunk/default.nix
index 2fc5c6a6ccda..a8c0b3d6ea67 100644
--- a/pkgs/development/python-modules/pysigma-backend-splunk/default.nix
+++ b/pkgs/development/python-modules/pysigma-backend-splunk/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "pysigma-backend-splunk";
-  version = "0.2.2";
+  version = "0.3.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "SigmaHQ";
     repo = "pySigma-backend-splunk";
     rev = "v${version}";
-    hash = "sha256-NAhAWK1eSSGQAlMGgMHrW/RTpT9LJMqwkhE9/8xWGT8=";
+    hash = "sha256-wcAqXFou20V2ZPOXCsF1Nky008q2xkfuI0RbTsatC6k=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pysigma-pipeline-crowdstrike/default.nix b/pkgs/development/python-modules/pysigma-pipeline-crowdstrike/default.nix
index 2d2aadb9eaec..5ed92014fc2e 100644
--- a/pkgs/development/python-modules/pysigma-pipeline-crowdstrike/default.nix
+++ b/pkgs/development/python-modules/pysigma-pipeline-crowdstrike/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "pysigma-pipeline-crowdstrike";
-  version = "0.1.4";
+  version = "0.1.5";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "SigmaHQ";
     repo = "pySigma-pipeline-crowdstrike";
     rev = "v${version}";
-    hash = "sha256-Riu2u1IouS1BMtXauXrNMIl06TU11pHdC0jjlOiR71s=";
+    hash = "sha256-TmvEWrkNu8gJ8rPFoRWd+uYob2rmmdasqxH1CYmz4Rk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pysigma-pipeline-sysmon/default.nix b/pkgs/development/python-modules/pysigma-pipeline-sysmon/default.nix
index 7c1e959d7406..26f058c3e197 100644
--- a/pkgs/development/python-modules/pysigma-pipeline-sysmon/default.nix
+++ b/pkgs/development/python-modules/pysigma-pipeline-sysmon/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "pysigma-pipeline-sysmon";
-  version = "0.1.3";
+  version = "0.1.5";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "SigmaHQ";
     repo = "pySigma-pipeline-sysmon";
     rev = "v${version}";
-    hash = "sha256-uJgV7emBqQN792EvfOz85BKoZY8DCCr8aUN7Ai8R9js=";
+    hash = "sha256-Bh0Qh+pY22lm/0vtJC4tFIl1KRF3zFQ8vcH0JEfYGAc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pysigma-pipeline-windows/default.nix b/pkgs/development/python-modules/pysigma-pipeline-windows/default.nix
new file mode 100644
index 000000000000..ef8595fa873c
--- /dev/null
+++ b/pkgs/development/python-modules/pysigma-pipeline-windows/default.nix
@@ -0,0 +1,46 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, poetry-core
+, pysigma
+, pytestCheckHook
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "pysigma-pipeline-windows";
+  version = "0.1.0";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.8";
+
+  src = fetchFromGitHub {
+    owner = "SigmaHQ";
+    repo = "pySigma-pipeline-windows";
+    rev = "v${version}";
+    hash = "sha256-BO6hiPLwEJX0sICqMZfcO4tqljdS+93Z1kG8IWsV9og=";
+  };
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    pysigma
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "sigma.pipelines.windows"
+  ];
+
+  meta = with lib; {
+    description = "Library to support Windows service pipeline for pySigma";
+    homepage = "https://github.com/SigmaHQ/pySigma-pipeline-windows";
+    license = with licenses; [ lgpl21Only ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/pysigma/default.nix b/pkgs/development/python-modules/pysigma/default.nix
index 1c7cd8ee299d..921de2e0c7e8 100644
--- a/pkgs/development/python-modules/pysigma/default.nix
+++ b/pkgs/development/python-modules/pysigma/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "pysigma";
-  version = "0.4.5";
+  version = "0.5.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "SigmaHQ";
     repo = "pySigma";
     rev = "v${version}";
-    hash = "sha256-jZPimSkJ6qTs0kEMVhP9Gnxu0jxA0cmgdn5++CevgIM=";
+    hash = "sha256-HGF8Tu28ksIfaCKAbnJv6sDmoQrDDjteVLxbJN1HH3U=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/wandb/default.nix b/pkgs/development/python-modules/wandb/default.nix
index 7f21877f1fb5..b4804176eddc 100644
--- a/pkgs/development/python-modules/wandb/default.nix
+++ b/pkgs/development/python-modules/wandb/default.nix
@@ -2,7 +2,6 @@
 , bokeh
 , buildPythonPackage
 , click
-, configparser
 , docker_pycreds
 , fetchFromGitHub
 , flask
@@ -22,7 +21,6 @@
 , pytest-mock
 , pytest-xdist
 , pytestCheckHook
-, python
 , python-dateutil
 , pyyaml
 , requests
@@ -33,35 +31,23 @@
 , shortuuid
 , stdenv
 , tqdm
-, yaspin
 }:
 
 buildPythonPackage rec {
   pname = "wandb";
-  version = "0.12.11";
+  version = "0.12.14";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = "client";
     rev = "v${version}";
-    sha256 = "0av4vv4llan40678bw0vlah0gn6hjg5pdqwq0c5cv15lqrdb8g32";
+    hash = "sha256-60E64ePW+C0C/eG7pLp4SpAFqycOHiCvOvmNOg2yoqY=";
   };
 
-  # The wandb requirements.txt does not distinguish python2/3 dependencies. We
-  # need to drop the subprocess32 dependency when building for python3.
-  patchPhase = ''
-    substituteInPlace requirements.txt --replace "subprocess32>=3.5.3" ""
-  '';
-
-  # git is not a setup.py dependency of wandb, but wandb does expect git to be
-  # in PATH. See https://gist.github.com/samuela/57aeee710e41ab2bf361b7ed8fbbeabf
-  # for the error message, and an example usage here: https://github.com/wandb/client/blob/master/wandb/sdk/internal/meta.py#L139-L141.
   # setuptools is necessary since pkg_resources is required at runtime.
   propagatedBuildInputs = [
     click
-    configparser
     docker_pycreds
-    git
     GitPython
     pathtools
     promise
@@ -74,9 +60,18 @@ buildPythonPackage rec {
     setproctitle
     setuptools
     shortuuid
-    yaspin
   ];
 
+  # wandb expects git to be in PATH. See https://gist.github.com/samuela/57aeee710e41ab2bf361b7ed8fbbeabf
+  # for the error message, and an example usage here: https://github.com/wandb/client/blob/d5f655b7ca7e3eac2f3a67a84bc5c2a664a31baf/wandb/sdk/internal/meta.py#L128.
+  # See https://github.com/NixOS/nixpkgs/pull/164176#discussion_r828801621 as to
+  # why we don't put it in propagatedBuildInputs. Note that this is difficult to
+  # test offline due to https://github.com/wandb/client/issues/3519.
+  postInstall = ''
+    mkdir -p $out/bin
+    ln -s ${git}/bin/git $out/bin/git
+  '';
+
   disabledTestPaths = [
     # Tests that try to get chatty over sockets or spin up servers, not possible in the nix build environment.
     "tests/test_cli.py"
@@ -106,6 +101,7 @@ buildPythonPackage rec {
     "tests/wandb_settings_test.py"
     "tests/wandb_sweep_test.py"
     "tests/wandb_verify_test.py"
+    "tests/test_model_workflows.py"
 
     # Fails and borks the pytest runner as well.
     "tests/wandb_test.py"
diff --git a/pkgs/games/frogatto/data.nix b/pkgs/games/frogatto/data.nix
index 3ca955a09c39..00e43582f6e1 100644
--- a/pkgs/games/frogatto/data.nix
+++ b/pkgs/games/frogatto/data.nix
@@ -2,14 +2,13 @@
 
 stdenv.mkDerivation {
   pname = "frogatto-data";
-  version = "unstable-2021-05-24";
+  version = "unstable-2022-04-13";
 
   src = fetchFromGitHub {
     owner = "frogatto";
     repo = "frogatto";
-    # master branch as of 2021-11-29
-    rev = "82d3dafa0cfeaad016a427bdbc729eb9509748f1";
-    sha256 = "0fmwn584xl0vafcsh72b4xnryfqyjxk5zhmymg5i8rzp6h03n8xq";
+    rev = "655493961c4ad57ba9cccdc24d23a2ded294b5f2";
+    sha256 = "0irn7p61cs8nm7dxsx84b2c3wryf2h12k2kclywdhy6xmh53w8k1";
   };
 
   installPhase = ''
diff --git a/pkgs/games/frogatto/engine.nix b/pkgs/games/frogatto/engine.nix
index 9e8ee6fe8dd8..b848c414b7a3 100644
--- a/pkgs/games/frogatto/engine.nix
+++ b/pkgs/games/frogatto/engine.nix
@@ -1,18 +1,25 @@
-{ lib, stdenv, fetchFromGitHub, which
+{ lib, stdenv, fetchFromGitHub, fetchurl, which
 , boost, SDL2, SDL2_image, SDL2_mixer, SDL2_ttf
 , glew, zlib, icu, pkg-config, cairo, libvpx }:
 
 stdenv.mkDerivation {
   pname = "anura-engine";
-  version = "unstable-2021-11-23";
+  version = "unstable-2022-04-09";
 
   src = fetchFromGitHub {
     owner = "anura-engine";
     repo = "anura";
-    rev = "816425df31624066e2815e26a25b1c5d3d355cb4";
-    sha256 = "1k7fnfgz003gcbyygv4aakhkkz3w3z9nyz7dlwz01xa6122zqyir";
+    rev = "5ac7f6fe63114274f0da7dad4c1ed673651e6424";
+    sha256 = "1yrcbvzgxdvn893qk1qcpb53pjns366fdls5qjal7lhq71kkfc67";
     fetchSubmodules = true;
   };
+  patches = [
+    # https://github.com/anura-engine/anura/issues/321
+    (fetchurl {
+      url = "https://github.com/anura-engine/anura/commit/627d08fb5254b5c66d315f1706089905c2704059.patch";
+      sha256 = "052m58qb3lg0hnxacpnjz2sz89dk0x6b5qi2q9bkzkvg38f237rr";
+    })
+  ];
 
   nativeBuildInputs = [
     which pkg-config
diff --git a/pkgs/games/mindustry/default.nix b/pkgs/games/mindustry/default.nix
index 82df3710c577..2572cd60c4a4 100644
--- a/pkgs/games/mindustry/default.nix
+++ b/pkgs/games/mindustry/default.nix
@@ -13,6 +13,7 @@
 , stb
 , ant
 , alsa-lib
+, alsa-plugins
 , glew
 
 # Make the build version easily overridable.
@@ -180,7 +181,8 @@ stdenv.mkDerivation rec {
     install -Dm644 desktop/build/libs/Mindustry.jar $out/share/mindustry.jar
     mkdir -p $out/bin
     makeWrapper ${jdk}/bin/java $out/bin/mindustry \
-      --add-flags "-jar $out/share/mindustry.jar"
+      --add-flags "-jar $out/share/mindustry.jar" \
+      --set ALSA_PLUGIN_DIR ${alsa-plugins}/lib/alsa-lib/
     install -Dm644 core/assets/icons/icon_64.png $out/share/icons/hicolor/64x64/apps/mindustry.png
   '' + optionalString enableServer ''
     install -Dm644 server/build/libs/server-release.jar $out/share/mindustry-server.jar
diff --git a/pkgs/os-specific/linux/kernel/linux-4.9.nix b/pkgs/os-specific/linux/kernel/linux-4.9.nix
index ad58c3ef6413..5786079a47de 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.9.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.9.nix
@@ -1,12 +1,12 @@
 { buildPackages, fetchurl, perl, buildLinux, nixosTests, stdenv, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.9.309";
+  version = "4.9.310";
   extraMeta.branch = "4.9";
   extraMeta.broken = stdenv.isAarch64;
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "05468rk4hlz9ag1zb7shngn5rl42npw7haqbi5mpaa0yksl5asp8";
+    sha256 = "17d3isb1i52v8360vspnywjpsy9vvkc54k5kwdddj0plawvxklw5";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.10.nix b/pkgs/os-specific/linux/kernel/linux-5.10.nix
index be92811a34c2..f13ec02408e3 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.10.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.10.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.10.110";
+  version = "5.10.111";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "14sn906f1bd87ngq1g2hx458v42d4nlzr36ba4alhcsl6836mvyv";
+    sha256 = "06mbl327bin8pv1073f7x37np3whklbvnh8lwn8wx4jmfvcb6c8q";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.15.nix b/pkgs/os-specific/linux/kernel/linux-5.15.nix
index 4cf4fbf8e78b..2286dd9ef75a 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.15.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.15.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.15.33";
+  version = "5.15.34";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -15,6 +15,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "1i590npi00w5d1znmamkm3sb293k5k4xd37miwnvz7hg17k1f2n3";
+    sha256 = "0sfviwwp7qy8b5h15lg84dyskih4l082l9gs6yrqj3rg762lcld7";
   };
 } // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.16.nix b/pkgs/os-specific/linux/kernel/linux-5.16.nix
index dc0f4b14156a..e68e76597e3e 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.16.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.16.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.16.19";
+  version = "5.16.20";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "0zlvsnbmcx4l8a5cqciwaabm1267q5zn4ah3gfhxi0jvigx2qvfs";
+    sha256 = "09dz8zp8cxvsc5amrswqqrkxd3i92ay2samlcspalaw6iz40s1nq";
   };
 } // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.17.nix b/pkgs/os-specific/linux/kernel/linux-5.17.nix
index c1a037283ace..ae1ac1400d9e 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.17.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.17.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.17.2";
+  version = "5.17.3";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "168b7zzw72k6hxbw0q402vvfir79qki9bjvxxvfi7s6g6y20z8id";
+    sha256 = "0b0nb807r2pwrifc7yk0p9q6cm472ahggfaix6yiqzmqcvisil1j";
   };
 } // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-rt-5.4.nix b/pkgs/os-specific/linux/kernel/linux-rt-5.4.nix
index a7135d83bbd3..bb404fc59e98 100644
--- a/pkgs/os-specific/linux/kernel/linux-rt-5.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-5.4.nix
@@ -6,7 +6,7 @@
 , ... } @ args:
 
 let
-  version = "5.4.182-rt72"; # updated by ./update-rt.sh
+  version = "5.4.188-rt73"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
@@ -14,14 +14,14 @@ in buildLinux (args // {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${kversion}.tar.xz";
-    sha256 = "03gly4ivsdahixmshi021al48ycsalx30vsxr3iyj47hchgj1wdj";
+    sha256 = "1g7xf2jx1hx580f42yirfgv9v0f9f88wzxxx0wiwx7wcqbyqpg4z";
   };
 
   kernelPatches = let rt-patch = {
     name = "rt";
     patch = fetchurl {
       url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "175ls411yr6c8gvmpfpyl00l0saaz9bdshjdf6ybxbpi9fmamypk";
+      sha256 = "17qx5xrchgss7zxg9lg91mqh0v3irx355003g7rj12h8y5r16l58";
     };
   }; in [ rt-patch ] ++ kernelPatches;
 
diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index 39e5c2b5c25a..7017331af86d 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -2,7 +2,7 @@
 # Do not edit!
 
 {
-  version = "2022.4.3";
+  version = "2022.4.4";
   components = {
     "abode" = ps: with ps; [
       abodepy
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index 11834937ffa9..1ba54a3ef2ff 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -168,7 +168,7 @@ let
   extraPackagesFile = writeText "home-assistant-packages" (lib.concatMapStringsSep "\n" (pkg: pkg.pname) extraBuildInputs);
 
   # Don't forget to run parse-requirements.py after updating
-  hassVersion = "2022.4.3";
+  hassVersion = "2022.4.4";
 
 in python.pkgs.buildPythonApplication rec {
   pname = "homeassistant";
@@ -186,7 +186,7 @@ in python.pkgs.buildPythonApplication rec {
     owner = "home-assistant";
     repo = "core";
     rev = version;
-    hash = "sha256-kubW0JhG9ervVHVl65YmD5jd/0oWenacAyfSP0EPmsU=";
+    hash = "sha256-NcFQjLNBGT0tNrlgkVLB3uFr9Yh4rc4HnLzALYvcrYA=";
   };
 
   # leave this in, so users don't have to constantly update their downstream patch handling
diff --git a/pkgs/servers/home-assistant/parse-requirements.py b/pkgs/servers/home-assistant/parse-requirements.py
index 80974ff0e70c..28d8331cfe43 100755
--- a/pkgs/servers/home-assistant/parse-requirements.py
+++ b/pkgs/servers/home-assistant/parse-requirements.py
@@ -37,6 +37,7 @@ PKG_SET = "home-assistant.python.pkgs"
 # If some requirements are matched by multiple or no Python packages, the
 # following can be used to choose the correct one
 PKG_PREFERENCES = {
+    "ha-av": "av",
     "youtube_dl": "youtube-dl-light",
     "tensorflow": "tensorflow",
     "fiblary3": "fiblary3-fork", # https://github.com/home-assistant/core/issues/66466
diff --git a/pkgs/servers/http/pomerium/default.nix b/pkgs/servers/http/pomerium/default.nix
index 8a5580d5d0db..49f489220606 100644
--- a/pkgs/servers/http/pomerium/default.nix
+++ b/pkgs/servers/http/pomerium/default.nix
@@ -12,12 +12,12 @@ let
 in
 buildGoModule rec {
   pname = "pomerium";
-  version = "0.17.0";
+  version = "0.17.1";
   src = fetchFromGitHub {
     owner = "pomerium";
     repo = "pomerium";
     rev = "v${version}";
-    hash = "sha256:1hv76i6k9f0kp527nxlxqhklsvkh2cmfnqlszmlk2hxij31qnf8q";
+    hash = "sha256:0b9mdzyfn7c6gwgslqk787yyrrcmdjf3282vx2zvhcr3psz0xqwx";
   };
 
   vendorSha256 = "sha256:1cq4m5a7z64yg3v1c68d15ilw78il6p53vaqzxgn338zjggr3kig";
diff --git a/pkgs/tools/networking/iperf/3.nix b/pkgs/tools/networking/iperf/3.nix
index f27a296d0462..7d7e53cef763 100644
--- a/pkgs/tools/networking/iperf/3.nix
+++ b/pkgs/tools/networking/iperf/3.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "0pvy1cj92phpbldw0bdc0ds70n8irqcyn1ybyis0a6nnz84v936y";
   };
 
-  buildInputs = [ openssl lksctp-tools ];
+  buildInputs = [ openssl ] ++ lib.optionals stdenv.isLinux [ lksctp-tools ];
   configureFlags = [
     "--with-openssl=${openssl.dev}"
   ];
diff --git a/pkgs/tools/security/sigma-cli/default.nix b/pkgs/tools/security/sigma-cli/default.nix
index a2417e7b8fe2..d3099340ff1b 100644
--- a/pkgs/tools/security/sigma-cli/default.nix
+++ b/pkgs/tools/security/sigma-cli/default.nix
@@ -5,14 +5,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "sigma-cli";
-  version = "0.3.4";
+  version = "0.4.2";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "SigmaHQ";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-FWcPHtEYqS+81dU4lB+4BLFOXtFumcyhucwvmu2TAt8=";
+    hash = "sha256-UA28A/C7RyIs96a/U98WpkgeCotT4qmpZwvO3HYUE9Q=";
   };
 
   nativeBuildInputs = with python3.pkgs; [
@@ -24,8 +24,10 @@ python3.pkgs.buildPythonApplication rec {
     prettytable
     pysigma
     pysigma-backend-splunk
+    pysigma-backend-insightidr
     pysigma-pipeline-crowdstrike
     pysigma-pipeline-sysmon
+    pysigma-pipeline-windows
   ];
 
   checkInputs = with python3.pkgs; [
diff --git a/pkgs/tools/wayland/wayland-utils/default.nix b/pkgs/tools/wayland/wayland-utils/default.nix
index 16bce1723aa6..d685bde83f95 100644
--- a/pkgs/tools/wayland/wayland-utils/default.nix
+++ b/pkgs/tools/wayland/wayland-utils/default.nix
@@ -12,6 +12,7 @@ stdenv.mkDerivation rec {
     sha256 = "1h38l850ww6hxjb1l8iwa33nkbz8q88bw6lh0aryjyp8b16crzk4";
   };
 
+  depsBuildBuild = [ pkg-config ];
   nativeBuildInputs = [ meson pkg-config ninja wayland-scanner ];
   buildInputs = [ wayland wayland-protocols ];
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index ebe9c7effb7f..e64ea1405de4 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -7724,10 +7724,14 @@ in {
 
   pysigma-backend-splunk = callPackage ../development/python-modules/pysigma-backend-splunk { };
 
+  pysigma-backend-insightidr = callPackage ../development/python-modules/pysigma-backend-insightidr { };
+
   pysigma-pipeline-crowdstrike = callPackage ../development/python-modules/pysigma-pipeline-crowdstrike { };
 
   pysigma-pipeline-sysmon = callPackage ../development/python-modules/pysigma-pipeline-sysmon { };
 
+  pysigma-pipeline-windows = callPackage ../development/python-modules/pysigma-pipeline-windows { };
+
   pysignalclirestapi = callPackage ../development/python-modules/pysignalclirestapi { };
 
   pysigset = callPackage ../development/python-modules/pysigset { };