diff --git a/maintainers/scripts/pluginupdate.py b/maintainers/scripts/pluginupdate.py
index 2a9a2d4c0a23..2c2cb3b6dd36 100644
--- a/maintainers/scripts/pluginupdate.py
+++ b/maintainers/scripts/pluginupdate.py
@@ -305,7 +305,7 @@ class CleanEnvironment(object):
 
 def get_current_plugins(editor: Editor) -> List[Plugin]:
     with CleanEnvironment():
-        cmd = ["nix", "eval", "--json", editor.get_plugins]
+        cmd = ["nix", "eval", "--impure", "--json", "--expr", editor.get_plugins]
         log.debug("Running command %s", cmd)
         out = subprocess.check_output(cmd)
     data = json.loads(out)
diff --git a/pkgs/applications/blockchains/alfis/default.nix b/pkgs/applications/blockchains/alfis/default.nix
index 7a808d2c72e9..0738661c0596 100644
--- a/pkgs/applications/blockchains/alfis/default.nix
+++ b/pkgs/applications/blockchains/alfis/default.nix
@@ -1,6 +1,5 @@
-{ stdenv, lib, fetchFromGitHub, rustPlatform, pkg-config
-, withGui ? true, webkitgtk, Cocoa, WebKit
-}:
+{ stdenv, lib, fetchFromGitHub, rustPlatform, pkg-config, withGui ? true
+, webkitgtk, Cocoa, WebKit, zenity, makeWrapper }:
 
 rustPlatform.buildRustPackage rec {
   pname = "alfis";
@@ -27,10 +26,15 @@ rustPlatform.buildRustPackage rec {
     "--skip=dns::client::tests::test_udp_client"
   ];
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ pkg-config makeWrapper ];
   buildInputs = lib.optional (withGui && stdenv.isLinux) webkitgtk
     ++ lib.optionals (withGui && stdenv.isDarwin) [ Cocoa WebKit ];
 
+  postInstall = lib.optionalString (withGui && stdenv.isLinux) ''
+    wrapProgram $out/bin/alfis \
+      --prefix PATH : ${lib.makeBinPath [ zenity ]}
+  '';
+
   meta = with lib; {
     description = "Alternative Free Identity System";
     homepage = "https://alfis.name";
diff --git a/pkgs/applications/editors/kakoune/plugins/update-shell.nix b/pkgs/applications/editors/kakoune/plugins/update-shell.nix
new file mode 100644
index 000000000000..ca83f09c7154
--- /dev/null
+++ b/pkgs/applications/editors/kakoune/plugins/update-shell.nix
@@ -0,0 +1,15 @@
+{ pkgs ? import ../../../../.. { } }:
+
+with pkgs;
+let
+  pyEnv = python3.withPackages (ps: [ ps.GitPython ]);
+in
+
+mkShell {
+  packages = [
+    bash
+    pyEnv
+    nix
+    nix-prefetch-scripts
+  ];
+}
diff --git a/pkgs/applications/editors/kakoune/plugins/update.py b/pkgs/applications/editors/kakoune/plugins/update.py
index 40a28d9afe2c..9f5f64f9e5b3 100755
--- a/pkgs/applications/editors/kakoune/plugins/update.py
+++ b/pkgs/applications/editors/kakoune/plugins/update.py
@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -p nix-prefetch-git -p python3 -p python3Packages.GitPython nix -i python3
+#!nix-shell update-shell.nix -i python3
 
 # format:
 # $ nix run nixpkgs.python3Packages.black -c black update.py
diff --git a/pkgs/applications/misc/pueue/default.nix b/pkgs/applications/misc/pueue/default.nix
index ac79f5be8460..4771666cc20a 100644
--- a/pkgs/applications/misc/pueue/default.nix
+++ b/pkgs/applications/misc/pueue/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "pueue";
-  version = "1.0.3";
+  version = "1.0.4";
 
   src = fetchFromGitHub {
     owner = "Nukesor";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-1iAXLs3O7EV7LfbXnajlDm75tQtanFInfNWZmnittlk=";
+    sha256 = "sha256-tNTKX++LrWwuVGdmAjvBStNYp4p1ai12JwJmozo1GV0=";
   };
 
-  cargoSha256 = "sha256-x/qRNxZS++DBq5B9+/9eXN95QZN/FSLi+3XyJ06Y1hg=";
+  cargoSha256 = "sha256-t1d8K0v7kHPjH78lYCRCa4pyPCvyQT1kaQtVpoROZIE=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/applications/version-management/git-and-tools/glitter/default.nix b/pkgs/applications/version-management/git-and-tools/glitter/default.nix
index d9c156a9b2a3..4b1b4c2f0b4a 100644
--- a/pkgs/applications/version-management/git-and-tools/glitter/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/glitter/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "glitter";
-  version = "1.5.2";
+  version = "1.5.3";
 
   src = fetchFromGitHub {
     owner = "milo123459";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-p+Oee0xUqd+vBjpjKI33wR21zBen29xu2gdmMCiH1zk=";
+    sha256 = "sha256-esrN6VH+ayc9DIhOLGR5oOaMjSBAc7u7fr8L1kSh4Gk=";
   };
 
-  cargoSha256 = "sha256-qmlnmj7+w+RVYj7DKiwm0JowGNlyOsbAGBwfXgRcLHE=";
+  cargoSha256 = "sha256-0ugr9HcJLsV34kKJs1E+n10tdOv09wkaYmkIodLhyLk=";
 
   # tests require it to be in a git repository
   preCheck = ''
diff --git a/pkgs/build-support/ocaml/default.nix b/pkgs/build-support/ocaml/default.nix
index cd17eb688c2e..1fe99bb6320e 100644
--- a/pkgs/build-support/ocaml/default.nix
+++ b/pkgs/build-support/ocaml/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, writeText, ocaml, findlib, ocamlbuild, camlp4 }:
 
-{ name, version, nativeBuildInputs ? [],
+{ pname ? args.name, version, nativeBuildInputs ? [],
   createFindlibDestdir ?  true,
   dontStrip ? true,
   minimumSupportedOcamlVersion ? null,
@@ -17,13 +17,13 @@ in
           lib.versionOlder minimumSupportedOcamlVersion ocaml.version;
 
 stdenv.mkDerivation (args // {
-  name = "ocaml-${name}-${version}";
+  name = "ocaml-${pname}-${version}";
 
   nativeBuildInputs = [ ocaml findlib ocamlbuild camlp4 ] ++ nativeBuildInputs;
 
   setupHook = if setupHook == null && hasSharedObjects
   then writeText "setupHook.sh" ''
-    export CAML_LD_LIBRARY_PATH="''${CAML_LD_LIBRARY_PATH-}''${CAML_LD_LIBRARY_PATH:+:}''$1/lib/ocaml/${ocaml.version}/site-lib/${name}/"
+    export CAML_LD_LIBRARY_PATH="''${CAML_LD_LIBRARY_PATH-}''${CAML_LD_LIBRARY_PATH:+:}''$1/lib/ocaml/${ocaml.version}/site-lib/${pname}/"
     ''
   else setupHook;
 
diff --git a/pkgs/development/coq-modules/graph-theory/default.nix b/pkgs/development/coq-modules/graph-theory/default.nix
index 1ecda185cdd8..5607d342a2eb 100644
--- a/pkgs/development/coq-modules/graph-theory/default.nix
+++ b/pkgs/development/coq-modules/graph-theory/default.nix
@@ -12,7 +12,7 @@ mkCoqDerivation {
 
   inherit version;
   defaultVersion = with versions; switch coq.coq-version [
-    { case = isEq "8.13"; out = "0.9"; }
+    { case = isGe "8.13"; out = "0.9"; }
   ] null;
 
   propagatedBuildInputs = [ mathcomp-algebra mathcomp-finmap hierarchy-builder ];
diff --git a/pkgs/development/libraries/gamenetworkingsockets/default.nix b/pkgs/development/libraries/gamenetworkingsockets/default.nix
index 0546bfb8e08e..8fcb5b2230e0 100644
--- a/pkgs/development/libraries/gamenetworkingsockets/default.nix
+++ b/pkgs/development/libraries/gamenetworkingsockets/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "GameNetworkingSockets";
-  version = "1.2.0";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "ValveSoftware";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1zghyc4liml8gzxflyh5gp6zi11ny6ng5hv9wyqvp32rfx221gc6";
+    sha256 = "1d3k1ciw8c8rznxsr4bfmw0f0srblpflv8xqavhcxx2zwvaya78c";
   };
 
   nativeBuildInputs = [ cmake ninja go ];
@@ -18,11 +18,10 @@ stdenv.mkDerivation rec {
   # tmp home for go
   preBuild = "export HOME=\"$TMPDIR\"";
 
-  buildInputs = [ protobuf openssl ];
+  buildInputs = [ protobuf ];
+  propagatedBuildInputs = [ openssl ];
 
   meta = with lib; {
-    # build failure is resolved on master, remove at next release
-    broken = stdenv.isDarwin;
     description = "GameNetworkingSockets is a basic transport layer for games";
     license = licenses.bsd3;
     platforms = platforms.unix;
diff --git a/pkgs/development/ocaml-modules/bin_prot/default.nix b/pkgs/development/ocaml-modules/bin_prot/default.nix
index 50ef935aff6b..3aa7cf0ec134 100644
--- a/pkgs/development/ocaml-modules/bin_prot/default.nix
+++ b/pkgs/development/ocaml-modules/bin_prot/default.nix
@@ -5,7 +5,7 @@ then throw "bin_prot-112.24.00 is not available for OCaml ${ocaml.version}"
 else
 
 buildOcaml rec {
-  name = "bin_prot";
+  pname = "bin_prot";
   version = "112.24.00";
 
   minimumSupportedOcamlVersion = "4.00";
diff --git a/pkgs/development/ocaml-modules/comparelib/default.nix b/pkgs/development/ocaml-modules/comparelib/default.nix
index addba7a4b349..a1371e4f4d5e 100644
--- a/pkgs/development/ocaml-modules/comparelib/default.nix
+++ b/pkgs/development/ocaml-modules/comparelib/default.nix
@@ -1,7 +1,7 @@
 {lib, buildOcaml, fetchurl, type_conv}:
 
 buildOcaml rec {
-  name = "comparelib";
+  pname = "comparelib";
   version = "113.00.00";
 
   minimumSupportedOcamlVersion = "4.00";
diff --git a/pkgs/development/ocaml-modules/elpi/default.nix b/pkgs/development/ocaml-modules/elpi/default.nix
index f04c3b1fe253..4412f568508c 100644
--- a/pkgs/development/ocaml-modules/elpi/default.nix
+++ b/pkgs/development/ocaml-modules/elpi/default.nix
@@ -1,5 +1,7 @@
 { stdenv, lib, fetchzip, buildDunePackage, camlp5
-, ppxlib, ppx_deriving, re, perl, ncurses
+, re, perl, ncurses
+, ppxlib, ppx_deriving
+, ppxlib_0_15, ppx_deriving_0_15
 , version ? "1.13.7"
 }:
 with lib;
@@ -23,7 +25,11 @@ buildDunePackage rec {
 
   buildInputs = [ perl ncurses ];
 
-  propagatedBuildInputs = [ camlp5 ppxlib ppx_deriving re ];
+  propagatedBuildInputs = [ camlp5 re ]
+  ++ (if lib.versionAtLeast version "1.13"
+     then [ ppxlib ppx_deriving ]
+     else [ ppxlib_0_15 ppx_deriving_0_15 ]
+  );
 
   meta = {
     description = "Embeddable λProlog Interpreter";
diff --git a/pkgs/development/ocaml-modules/estring/default.nix b/pkgs/development/ocaml-modules/estring/default.nix
index 7424d14220dc..c0cc3398763c 100644
--- a/pkgs/development/ocaml-modules/estring/default.nix
+++ b/pkgs/development/ocaml-modules/estring/default.nix
@@ -5,7 +5,7 @@ then throw "estring is not available for OCaml ${ocaml.version}"
 else
 
 buildOcaml rec {
-  name = "estring";
+  pname = "estring";
   version = "1.3";
 
   src = fetchurl {
diff --git a/pkgs/development/ocaml-modules/faillib/default.nix b/pkgs/development/ocaml-modules/faillib/default.nix
index 63040fadda5d..e2d90e06bdb5 100644
--- a/pkgs/development/ocaml-modules/faillib/default.nix
+++ b/pkgs/development/ocaml-modules/faillib/default.nix
@@ -6,7 +6,7 @@ else
 
 buildOcaml rec {
   minimumSupportedOcamlVersion = "4.00";
-  name = "faillib";
+  pname = "faillib";
   version = "111.17.00";
 
   src = fetchurl {
diff --git a/pkgs/development/ocaml-modules/herelib/default.nix b/pkgs/development/ocaml-modules/herelib/default.nix
index c5223637a158..b6f05fc46af3 100644
--- a/pkgs/development/ocaml-modules/herelib/default.nix
+++ b/pkgs/development/ocaml-modules/herelib/default.nix
@@ -2,7 +2,7 @@
 
 buildOcaml rec {
   version = "112.35.00";
-  name = "herelib";
+  pname = "herelib";
 
   minimumSupportedOcamlVersion = "4.00";
 
diff --git a/pkgs/development/ocaml-modules/janestreet/buildOcamlJane.nix b/pkgs/development/ocaml-modules/janestreet/buildOcamlJane.nix
index 62876e5eaf94..13fcdff39239 100644
--- a/pkgs/development/ocaml-modules/janestreet/buildOcamlJane.nix
+++ b/pkgs/development/ocaml-modules/janestreet/buildOcamlJane.nix
@@ -1,14 +1,14 @@
 { buildOcaml, opaline, js_build_tools, ocaml_oasis, fetchurl } :
 
-{ name, version ? "113.33.03", buildInputs ? [],
+{ pname, version ? "113.33.03", buildInputs ? [],
   hash ? "",
   minimumSupportedOcamlVersion ? "4.02", ...
 }@args:
 
 buildOcaml (args // {
-  inherit name version minimumSupportedOcamlVersion;
+  inherit pname version minimumSupportedOcamlVersion;
   src = fetchurl {
-    url = "https://github.com/janestreet/${name}/archive/${version}.tar.gz";
+    url = "https://github.com/janestreet/${pname}/archive/${version}.tar.gz";
     sha256 = hash;
   };
 
@@ -20,10 +20,16 @@ buildOcaml (args // {
   dontAddStaticConfigureFlags = true;
   configurePlatforms = [];
 
-  configurePhase = "./configure --prefix $out";
+  configurePhase = ''
+    ./configure --prefix $out
+  '';
 
-  buildPhase = "OCAML_TOPLEVEL_PATH=`ocamlfind query findlib`/.. make";
+  buildPhase = ''
+    OCAML_TOPLEVEL_PATH=`ocamlfind query findlib`/.. make
+  '';
 
-  installPhase = "opaline -prefix $prefix -libdir $OCAMLFIND_DESTDIR ${name}.install";
+  installPhase = ''
+    opaline -prefix $prefix -libdir $OCAMLFIND_DESTDIR ${pname}.install
+  '';
 
 })
diff --git a/pkgs/development/ocaml-modules/janestreet/js-build-tools.nix b/pkgs/development/ocaml-modules/janestreet/js-build-tools.nix
index 2f68ee8230e7..4186b0649bad 100644
--- a/pkgs/development/ocaml-modules/janestreet/js-build-tools.nix
+++ b/pkgs/development/ocaml-modules/janestreet/js-build-tools.nix
@@ -1,13 +1,13 @@
 { lib, buildOcaml, fetchurl, ocaml_oasis, opaline }:
 
 buildOcaml rec {
-  name = "js-build-tools";
+  pname = "js-build-tools";
   version = "113.33.06";
 
   minimumSupportedOcamlVersion = "4.02";
 
   src = fetchurl {
-    url = "https://github.com/janestreet/${name}/archive/${version}.tar.gz";
+    url = "https://github.com/janestreet/js-build-tools/archive/${version}.tar.gz";
     sha256 = "1nvgyp4gsnlnpix3li6kr90b12iin5ihichv298p03i6h2809dia";
   };
 
@@ -19,7 +19,7 @@ buildOcaml rec {
   dontAddStaticConfigureFlags = true;
   configurePlatforms = [];
   configurePhase = "./configure --prefix $prefix";
-  installPhase = "opaline -prefix $prefix -libdir $OCAMLFIND_DESTDIR ${name}.install";
+  installPhase = "opaline -prefix $prefix -libdir $OCAMLFIND_DESTDIR js-build-tools.install";
 
   patches = [ ./js-build-tools-darwin.patch ];
 
diff --git a/pkgs/development/ocaml-modules/pa_bench/default.nix b/pkgs/development/ocaml-modules/pa_bench/default.nix
index e5f9ac52067d..a2de553961a4 100644
--- a/pkgs/development/ocaml-modules/pa_bench/default.nix
+++ b/pkgs/development/ocaml-modules/pa_bench/default.nix
@@ -1,7 +1,7 @@
 {lib, buildOcaml, fetchurl, type_conv, pa_ounit}:
 
 buildOcaml rec {
-  name = "pa_bench";
+  pname = "pa_bench";
   version = "113.00.00";
 
   minimumSupportedOcamlVersion = "4.00";
diff --git a/pkgs/development/ocaml-modules/pa_ounit/default.nix b/pkgs/development/ocaml-modules/pa_ounit/default.nix
index 26d000042227..a9e49bab34a1 100644
--- a/pkgs/development/ocaml-modules/pa_ounit/default.nix
+++ b/pkgs/development/ocaml-modules/pa_ounit/default.nix
@@ -5,7 +5,7 @@ then throw "pa_ounit is not available for OCaml ${ocaml.version}"
 else
 
 buildOcaml rec {
-  name = "pa_ounit";
+  pname = "pa_ounit";
   version = "113.00.00";
 
   src = fetchurl {
diff --git a/pkgs/development/ocaml-modules/pipebang/default.nix b/pkgs/development/ocaml-modules/pipebang/default.nix
index 36eb3fe54bbe..96cfc82bc2fb 100644
--- a/pkgs/development/ocaml-modules/pipebang/default.nix
+++ b/pkgs/development/ocaml-modules/pipebang/default.nix
@@ -1,7 +1,7 @@
 {lib, buildOcaml, fetchurl}:
 
 buildOcaml rec {
-  name = "pipebang";
+  pname = "pipebang";
   version = "113.00.00";
 
   minimumSupportedOcamlVersion = "4.00";
diff --git a/pkgs/development/ocaml-modules/type_conv/112.01.01.nix b/pkgs/development/ocaml-modules/type_conv/112.01.01.nix
index 3fa9042b0351..c71bfa00e7ef 100644
--- a/pkgs/development/ocaml-modules/type_conv/112.01.01.nix
+++ b/pkgs/development/ocaml-modules/type_conv/112.01.01.nix
@@ -3,7 +3,7 @@
 buildOcaml rec {
   minimumSupportedOcamlVersion = "4.02";
 
-  name = "type_conv";
+  pname = "type_conv";
   version = "113.00.02";
 
   src = fetchurl {
diff --git a/pkgs/development/ocaml-modules/typerep/default.nix b/pkgs/development/ocaml-modules/typerep/default.nix
index 5a38bd708f7b..c51d28f9e19b 100644
--- a/pkgs/development/ocaml-modules/typerep/default.nix
+++ b/pkgs/development/ocaml-modules/typerep/default.nix
@@ -1,7 +1,7 @@
 { lib, buildOcaml, fetchFromGitHub, type_conv }:
 
 buildOcaml rec {
-  name = "typerep";
+  pname = "typerep";
   version = "112.24.00";
 
   minimumSupportedOcamlVersion = "4.00";
diff --git a/pkgs/development/ocaml-modules/variantslib/default.nix b/pkgs/development/ocaml-modules/variantslib/default.nix
index aaddda3c11bc..25d379f51648 100644
--- a/pkgs/development/ocaml-modules/variantslib/default.nix
+++ b/pkgs/development/ocaml-modules/variantslib/default.nix
@@ -5,7 +5,7 @@ then throw "variantslib-109.15.03 is not available for OCaml ${ocaml.version}"
 else
 
 buildOcaml rec {
-  name = "variantslib";
+  pname = "variantslib";
   version = "109.15.03";
 
   minimumSupportedOcamlVersion = "4.00";
diff --git a/pkgs/development/python-modules/fiona/default.nix b/pkgs/development/python-modules/fiona/default.nix
index 987a8ca6209e..0c1a3bd2c651 100644
--- a/pkgs/development/python-modules/fiona/default.nix
+++ b/pkgs/development/python-modules/fiona/default.nix
@@ -51,6 +51,12 @@ buildPythonPackage rec {
     "http" "https" "wheel"
     # Assert not true
     "test_no_append_driver_cannot_append"
+  ] ++ lib.optionals stdenv.isAarch64 [
+    # https://github.com/Toblerity/Fiona/issues/1012 the existence of this
+    # as a bug hasn't been challenged and other distributors seem to also
+    # be skipping these tests on aarch64, so this is not unique to nixpkgs.
+    "test_write_or_driver_error"
+    "test_append_or_driver_error"
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/json-schema-for-humans/default.nix b/pkgs/development/python-modules/json-schema-for-humans/default.nix
index 8df7d6f6e00f..9e6144a8ec26 100644
--- a/pkgs/development/python-modules/json-schema-for-humans/default.nix
+++ b/pkgs/development/python-modules/json-schema-for-humans/default.nix
@@ -2,14 +2,16 @@
 , beautifulsoup4
 , buildPythonPackage
 , click
+, dataclasses
 , dataclasses-json
 , fetchFromGitHub
 , htmlmin
 , jinja2
 , markdown2
-, pbr
+, poetry-core
 , pygments
 , pytestCheckHook
+, pythonOlder
 , pytz
 , pyyaml
 , requests
@@ -17,16 +19,21 @@
 
 buildPythonPackage rec {
   pname = "json-schema-for-humans";
-  version = "0.31.0";
+  version = "0.39.1";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "coveooss";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1aj1w0qxdw8d6mf5vngk0xjgs7z8vzwc2aycahnkqg7q3cagq19n";
+    sha256 = "sha256-JoD4XEfIUsAbITWa0LMYgNP6WzrblI4HUIgLpx5gn18=";
   };
 
-  nativeBuildInputs = [ pbr ];
+  nativeBuildInputs = [
+    poetry-core
+  ];
 
   propagatedBuildInputs = [
     click
@@ -38,12 +45,10 @@ buildPythonPackage rec {
     pytz
     pyyaml
     requests
+  ] ++ lib.optionals (pythonOlder "3.7") [
+    dataclasses
   ];
 
-  preBuild = ''
-    export PBR_VERSION=0.0.1
-  '';
-
   checkInputs = [
     beautifulsoup4
     pytestCheckHook
@@ -52,9 +57,13 @@ buildPythonPackage rec {
   disabledTests = [
     # Tests require network access
     "test_references_url"
+    # Tests are failing
+    "TestMdGenerate"
   ];
 
-  pythonImportsCheck = [ "json_schema_for_humans" ];
+  pythonImportsCheck = [
+    "json_schema_for_humans"
+  ];
 
   meta = with lib; {
     description = "Quickly generate HTML documentation from a JSON schema";
diff --git a/pkgs/development/python-modules/libcst/default.nix b/pkgs/development/python-modules/libcst/default.nix
index 5b950ab57397..712b15f17f22 100644
--- a/pkgs/development/python-modules/libcst/default.nix
+++ b/pkgs/development/python-modules/libcst/default.nix
@@ -15,11 +15,11 @@
 
 buildPythonPackage rec {
   pname = "libcst";
-  version = "0.3.20";
+  version = "0.3.21";
+  format = "setuptools";
+
   disabled = pythonOlder "3.6";
 
-  # Some files for tests missing from PyPi
-  # https://github.com/Instagram/LibCST/issues/331
   src = fetchFromGitHub {
     owner = "instagram";
     repo = pname;
@@ -54,7 +54,9 @@ buildPythonPackage rec {
     "test_codemod_formatter_error_input"
   ];
 
-  pythonImportsCheck = [ "libcst" ];
+  pythonImportsCheck = [
+    "libcst"
+  ];
 
   meta = with lib; {
     description = "Concrete Syntax Tree (CST) parser and serializer library for Python";
diff --git a/pkgs/development/python-modules/ocrmypdf/default.nix b/pkgs/development/python-modules/ocrmypdf/default.nix
index b6aef62dd74d..71506e60b60e 100644
--- a/pkgs/development/python-modules/ocrmypdf/default.nix
+++ b/pkgs/development/python-modules/ocrmypdf/default.nix
@@ -30,7 +30,7 @@
 
 buildPythonPackage rec {
   pname = "ocrmypdf";
-  version = "12.7.0";
+  version = "12.7.2";
 
   src = fetchFromGitHub {
     owner = "jbarlow83";
@@ -42,7 +42,7 @@ buildPythonPackage rec {
     extraPostFetch = ''
       rm "$out/.git_archival.txt"
     '';
-    sha256 = "sha256-lpTuaZRrmFoKV1SAFoGpsYfPBkLB2+iB63fg3t9RC5o=";
+    sha256 = "sha256-+mh7NgAk7R/94FXjRV+SLy478pZwYLLS8HwCazEbMf4=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
diff --git a/pkgs/development/python-modules/pikepdf/default.nix b/pkgs/development/python-modules/pikepdf/default.nix
index ab78f2262445..9f04e68a378f 100644
--- a/pkgs/development/python-modules/pikepdf/default.nix
+++ b/pkgs/development/python-modules/pikepdf/default.nix
@@ -24,7 +24,7 @@
 
 buildPythonPackage rec {
   pname = "pikepdf";
-  version = "3.2.0";
+  version = "4.0.1.post1";
   disabled = ! isPy3k;
 
   src = fetchFromGitHub {
@@ -37,7 +37,7 @@ buildPythonPackage rec {
     extraPostFetch = ''
       rm "$out/.git_archival.txt"
     '';
-    sha256 = "03c7ihd6rf6kdfc3cpgxy5pi6cj4zwscz8nyxmmp15fmdk3hkw4g";
+    sha256 = "sha256-s7eS7jYGohYt75/r++4v9K6BRfiQ3drdG5wbIL3WoiU=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/pikepdf/paths.patch b/pkgs/development/python-modules/pikepdf/paths.patch
index 807041696ad6..17349f7ac209 100644
--- a/pkgs/development/python-modules/pikepdf/paths.patch
+++ b/pkgs/development/python-modules/pikepdf/paths.patch
@@ -1,16 +1,16 @@
 diff --git a/src/pikepdf/_methods.py b/src/pikepdf/_methods.py
-index 70cdc9e..c3a14d0 100644
+index 9db6b49..4020bcf 100644
 --- a/src/pikepdf/_methods.py
 +++ b/src/pikepdf/_methods.py
-@@ -190,7 +190,7 @@ def _mudraw(buffer, fmt) -> bytes:
+@@ -204,7 +204,7 @@ def _mudraw(buffer, fmt) -> bytes:
          tmp_in.flush()
  
          proc = run(
 -            ['mudraw', '-F', fmt, '-o', '-', tmp_in.name],
 +            ['@mudraw@', '-F', fmt, '-o', '-', tmp_in.name],
-             stdout=PIPE,
-             stderr=PIPE,
+             capture_output=True,
              check=True,
+         )
 diff --git a/src/pikepdf/jbig2.py b/src/pikepdf/jbig2.py
 index 80cc910..64f6d31 100644
 --- a/src/pikepdf/jbig2.py
diff --git a/pkgs/development/tools/faas-cli/default.nix b/pkgs/development/tools/faas-cli/default.nix
index d74e9b35a2b6..425d79219c8d 100644
--- a/pkgs/development/tools/faas-cli/default.nix
+++ b/pkgs/development/tools/faas-cli/default.nix
@@ -4,20 +4,20 @@ let
     let cpuName = platform.parsed.cpu.name; in {
       "aarch64" = "arm64";
       "armv7l" = "armhf";
+      "armv6l" = "armhf";
     }.${cpuName} or cpuName;
 in
 buildGoModule rec {
   pname = "faas-cli";
   # When updating version change rev.
-  version = "0.13.13";
-  rev = "72816d486cf76c3089b915dfb0b66b85cf096634";
-  platform = faasPlatform stdenv.targetPlatform;
+  version = "0.13.15";
+  rev = "b562392b12a78a11bcff9c6fca5a47146ea2ba0a";
 
   src = fetchFromGitHub {
     owner = "openfaas";
     repo = "faas-cli";
     rev = version;
-    sha256 = "0mmrakyy2qmkldld7pxf5bx6whdadq2r52b68f9p9z7yqrdimix8";
+    sha256 = "15kjxn0p8nz8147vsm9q5q6wr2w5ssybvn247kynj2n7139iva2f";
   };
 
   CGO_ENABLED = 0;
@@ -30,7 +30,7 @@ buildGoModule rec {
     "-s" "-w"
     "-X github.com/openfaas/faas-cli/version.GitCommit=${rev}"
     "-X github.com/openfaas/faas-cli/version.Version=${version}"
-    "-X github.com/openfaas/faas-cli/commands.Platform=${platform}"
+    "-X github.com/openfaas/faas-cli/commands.Platform=${faasPlatform stdenv.targetPlatform}"
   ];
 
   meta = with lib; {
@@ -38,5 +38,13 @@ buildGoModule rec {
     description = "Official CLI for OpenFaaS ";
     license = licenses.mit;
     maintainers = with maintainers; [ welteki ];
+    platforms = [
+      "x86_64-linux"
+      "x86_64-darwin"
+      "aarch64-linux"
+      "aarch64-darwin"
+      "armv7l-linux"
+      "armv6l-linux"
+    ];
   };
 }
diff --git a/pkgs/games/soldat-unstable/default.nix b/pkgs/games/soldat-unstable/default.nix
index 496d51e31c41..b3ae3b58cfe7 100644
--- a/pkgs/games/soldat-unstable/default.nix
+++ b/pkgs/games/soldat-unstable/default.nix
@@ -1,19 +1,19 @@
 { lib, stdenv, fetchFromGitHub, fpc, zip, makeWrapper
 , SDL2, freetype, physfs, openal, gamenetworkingsockets
-, xorg, autoPatchelfHook
+, xorg, autoPatchelfHook, cmake
 }:
 
 let
   base = stdenv.mkDerivation rec {
     pname = "soldat-base";
-    version = "unstable-2020-11-26";
+    version = "unstable-2021-09-05";
 
     src = fetchFromGitHub {
       name = "base";
       owner = "Soldat";
       repo = "base";
-      rev = "e5f9c35ec12562595b248a7a921dd3458b36b605";
-      sha256 = "0qg0p2adb5v6di44iqczswldhypdqvn1nl96vxkfkxdg9i8x90w3";
+      rev = "6c74d768d511663e026e015dde788006c74406b5";
+      sha256 = "175gmkdccy8rnkd95h2zqldqfydyji1hfby8b1qbnl8wz4dh08mz";
     };
 
     nativeBuildInputs = [ zip ];
@@ -39,55 +39,37 @@ in
 
 stdenv.mkDerivation rec {
   pname = "soldat";
-  version = "unstable-2021-04-27";
+  version = "unstable-2021-11-01";
 
   src = fetchFromGitHub {
     name = "soldat";
     owner = "Soldat";
     repo = "soldat";
-    rev = "4d17667c316ff08934e97448b7f290a8dc434e81";
-    sha256 = "1pf557psmhfaagblfwdn36cw80j7bgs0lgjq8hmjbv58dysw3jdb";
+    rev = "7780d2948b724970af9f2aaf4fb4e4350d5438d9";
+    sha256 = "0r39d1394q7kabsgq6vpdlzwsajxafsg23i0r273nggfvs3m805z";
   };
 
-  nativeBuildInputs = [ fpc makeWrapper autoPatchelfHook ];
+  patches = [
+    # Don't build GameNetworkingSockets as an ExternalProject,
+    # see https://github.com/Soldat/soldat/issues/73
+    ./gamenetworkingsockets-no-external.patch
+  ];
+
+  nativeBuildInputs = [ fpc makeWrapper autoPatchelfHook cmake ];
+
+  cmakeFlags = [
+    "-DADD_ASSETS=OFF" # We provide base's smods via nix
+  ];
 
   buildInputs = [ SDL2 freetype physfs openal gamenetworkingsockets ];
+  # TODO(@sternenseemann): set proper rpath via cmake, so we don't need autoPatchelfHook
   runtimeDependencies = [ xorg.libX11 ];
 
-  buildPhase = ''
-    runHook preBuild
-
-    mkdir -p client/build server/build
-
-    # build .so from stb headers
-    pushd client/libs/stb
-    make
-    popd
-
-    # build client
-    pushd client
-    make mode=release
-    popd
-
-    # build server
-    pushd server
-    make mode=release
-    popd
-
-    runHook postBuild
-  '';
-
-  installPhase = ''
-    runHook preInstall
-
-    install -Dm644 client/libs/stb/libstb.so -t $out/lib
-    install -Dm755 client/build/soldat_* $out/bin/soldat
-    install -Dm755 server/build/soldatserver_* $out/bin/soldatserver
-
-    # make sure soldat{,server} find their game archive,
-    # let them write their state and configuration files
-    # to $XDG_CONFIG_HOME/soldat/soldat{,server} unless
-    # the user specifies otherwise.
+  # make sure soldat{,server} find their game archive,
+  # let them write their state and configuration files
+  # to $XDG_CONFIG_HOME/soldat/soldat{,server} unless
+  # the user specifies otherwise.
+  postInstall = ''
     for p in $out/bin/soldatserver $out/bin/soldat; do
       configDir="\''${XDG_CONFIG_HOME:-\$HOME/.config}/soldat/$(basename "$p")"
 
@@ -97,8 +79,6 @@ stdenv.mkDerivation rec {
         --add-flags "-fs_userpath \"$configDir\"" \
         --add-flags "-fs_basepath \"${base}/share/soldat\""
     done
-
-    runHook postInstall
   '';
 
   meta = with lib; {
@@ -106,7 +86,7 @@ stdenv.mkDerivation rec {
     license = [ licenses.mit base.meta.license ];
     inherit (src.meta) homepage;
     maintainers = [ maintainers.sternenseemann ];
-    platforms = platforms.x86_64 ++ platforms.i686;
+    platforms = [ "x86_64-linux" "i686-linux" ];
     # portability currently mainly limited by fpc
     # in nixpkgs which doesn't work on darwin,
     # aarch64 and arm support should be possible:
diff --git a/pkgs/games/soldat-unstable/gamenetworkingsockets-no-external.patch b/pkgs/games/soldat-unstable/gamenetworkingsockets-no-external.patch
new file mode 100644
index 000000000000..629ca6c67518
--- /dev/null
+++ b/pkgs/games/soldat-unstable/gamenetworkingsockets-no-external.patch
@@ -0,0 +1,14 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 1084048..1ea4c84 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -143,7 +143,8 @@ if(BUILD_CLIENT OR BUILD_SERVER)
+     file(WRITE ${PROJECT_BINARY_DIR}/bin/steam_appid.txt "638490")
+   else()
+     # GameNetworkingSockets
+-    add_subdirectory(shared/libs/GameNetworkingSockets)
++    # add_subdirectory(shared/libs/GameNetworkingSockets)
++    find_package(GameNetworkingSockets REQUIRED)
+   endif()
+ endif()
+ 
diff --git a/pkgs/misc/vim-plugins/update-shell.nix b/pkgs/misc/vim-plugins/update-shell.nix
index 18b5b1a37c5f..e1b727c49e04 100644
--- a/pkgs/misc/vim-plugins/update-shell.nix
+++ b/pkgs/misc/vim-plugins/update-shell.nix
@@ -1,14 +1,15 @@
-{ nixpkgs ? import ../../.. { } }:
-with nixpkgs;
+{ pkgs ? import ../../.. { } }:
+
+with pkgs;
 let
-  pyEnv = python3.withPackages(ps: [ ps.GitPython ]);
+  pyEnv = python3.withPackages (ps: [ ps.GitPython ]);
 in
+
 mkShell {
   packages = [
     bash
     pyEnv
-    nix_2_3
+    nix
     nix-prefetch-scripts
   ];
 }
-
diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json
index 822ab6e0dddd..f6c95acf4c6f 100644
--- a/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened/patches.json
@@ -12,41 +12,41 @@
     "4.19": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-4.19.215-hardened1.patch",
-            "sha256": "05m3x3aafwp9msmqb2h1mys54xlsq17477blhb0d3b3nyj3qv503",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.215-hardened1/linux-hardened-4.19.215-hardened1.patch"
+            "name": "linux-hardened-4.19.216-hardened1.patch",
+            "sha256": "0a8rg0lc0pj6zlkbrd3fjrjgg3f18918zzs8q4nld092hqjfjbsm",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.216-hardened1/linux-hardened-4.19.216-hardened1.patch"
         },
-        "sha256": "1czjqa5wbsmzgl7wwqlp9qbdig45ibq11m9pcykrjaclrgwn884y",
-        "version": "4.19.215"
+        "sha256": "0cs8yy5jfbvvi5j9f3kzyc4j0fjylxdj1641f53ga6gkmjmayv3d",
+        "version": "4.19.216"
     },
     "5.10": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.10.77-hardened1.patch",
-            "sha256": "1y5rdd7irlljjsw7kdv6v8issbhab3hzywggz5igca72qiy7gcwl",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.77-hardened1/linux-hardened-5.10.77-hardened1.patch"
+            "name": "linux-hardened-5.10.78-hardened1.patch",
+            "sha256": "06jbxx6vcd6xa0f8y80im14cdwb8dsk21kx18q7c77gjw628b1i1",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.78-hardened1/linux-hardened-5.10.78-hardened1.patch"
         },
-        "sha256": "1hwgbcfv9wfx9ka25lsqjrnzskynfgmswcyp5vk14wnxq7glxdnk",
-        "version": "5.10.77"
+        "sha256": "03q5lrv8gr9hnm7984pxi9kwsvxrn21qwykj60amisi2wac6r05y",
+        "version": "5.10.78"
     },
     "5.14": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.14.16-hardened1.patch",
-            "sha256": "0k9n9k25bmzn3wsqkmjc27md7vc5qwg5a79zmwfw0adwlfwlgi5y",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.14.16-hardened1/linux-hardened-5.14.16-hardened1.patch"
+            "name": "linux-hardened-5.14.17-hardened1.patch",
+            "sha256": "08s26hmmaji51aczh9spbg8ngbxz5mr067dgi05djp3cgs2hl5pw",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.14.17-hardened1/linux-hardened-5.14.17-hardened1.patch"
         },
-        "sha256": "005wis2y5dhksb6n0r4p3xjldppmdnd360dhxa04rfc4z2qwn3f3",
-        "version": "5.14.16"
+        "sha256": "0q7df51yk6di1m8ky0gplkyx6smlr9inxrd569qv3ww3ykg933sd",
+        "version": "5.14.17"
     },
     "5.4": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.4.157-hardened1.patch",
-            "sha256": "0651l6qambsdy7p1jry2ylf806gr66v6zrfz8lk0dndlhsgbb3dq",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.157-hardened1/linux-hardened-5.4.157-hardened1.patch"
+            "name": "linux-hardened-5.4.158-hardened1.patch",
+            "sha256": "1pnxwvy5x04b95bfia63916qlrj5mrp2d54dcc4hg5k29vm0z6a5",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.158-hardened1/linux-hardened-5.4.158-hardened1.patch"
         },
-        "sha256": "0jl62j22vs59bc90mvzavv0ii9hvk436pbnrpqf3x9f8nfybngwz",
-        "version": "5.4.157"
+        "sha256": "0ncdkf1iz49458k3dvq3dc5b2r9dp21jsn3ffm9lbhlgvkn8y0bf",
+        "version": "5.4.158"
     }
 }
diff --git a/pkgs/os-specific/linux/kernel/linux-4.14.nix b/pkgs/os-specific/linux/kernel/linux-4.14.nix
index 44740e746004..2073d28f078f 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.14.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.14.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "4.14.254";
+  version = "4.14.255";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0ihdlsg4jg9wwhhcbjjmrcchnl9pc0szh21nwmbhwnxgqcdmrnfz";
+    sha256 = "1mxjwqijnlvrdbpd973kdycz1dwklfkj9vpnj1cihgsf880q02zh";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.19.nix b/pkgs/os-specific/linux/kernel/linux-4.19.nix
index b0b96b010c70..1e813076d1f9 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.19.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.19.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "4.19.216";
+  version = "4.19.217";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0cs8yy5jfbvvi5j9f3kzyc4j0fjylxdj1641f53ga6gkmjmayv3d";
+    sha256 = "01500jcjvhbkn7xcan564jw0nnwc12cf8hhvl8118jqqqw612lc5";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.4.nix b/pkgs/os-specific/linux/kernel/linux-4.4.nix
index a4e3ee5f9da8..f39340b59bca 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.4.nix
@@ -1,12 +1,12 @@
 { buildPackages, fetchurl, perl, buildLinux, nixosTests, stdenv, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.4.291";
+  version = "4.4.292";
   extraMeta.branch = "4.4";
   extraMeta.broken = stdenv.isAarch64;
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0lbbvv3ha4d8nwzjh8bdk0aqyd12w6gw0nsxsdnp8pbmnndgb9vh";
+    sha256 = "0v5rz8na1d458grc49x3j1951mhvxvqzjq5g9rv1hi0p9rjala97";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.9.nix b/pkgs/os-specific/linux/kernel/linux-4.9.nix
index 424d3b690e63..f58f7c4a7e4d 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.9.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.9.nix
@@ -1,12 +1,12 @@
 { buildPackages, fetchurl, perl, buildLinux, nixosTests, stdenv, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.9.289";
+  version = "4.9.290";
   extraMeta.branch = "4.9";
   extraMeta.broken = stdenv.isAarch64;
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "19kz74qgw5yzfinnsvljmn2zm855lr4cxgfpn8gwljmkspyx1hm5";
+    sha256 = "1ns0xbcgv0ix4b3xkcws8g3ks1a31kzc5whmkf9arz1k8si5mpnd";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.10.nix b/pkgs/os-specific/linux/kernel/linux-5.10.nix
index 39eccf966f00..05f2b07ecc22 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.10.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.10.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.10.78";
+  version = "5.10.79";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "03q5lrv8gr9hnm7984pxi9kwsvxrn21qwykj60amisi2wac6r05y";
+    sha256 = "1bd86ywff2mv73sybjdjlvvvhnmsv891jlm17h5nvqifdbhmb6g4";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.14.nix b/pkgs/os-specific/linux/kernel/linux-5.14.nix
index 9d5329c166ec..66bbb131d8c1 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.14.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.14.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.14.17";
+  version = "5.14.18";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "0q7df51yk6di1m8ky0gplkyx6smlr9inxrd569qv3ww3ykg933sd";
+    sha256 = "1pr7qh2wjw7h6r3fixg9ia5r3na7vdb6b4sp9wnbifnqckahzwis";
   };
 } // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.15.nix b/pkgs/os-specific/linux/kernel/linux-5.15.nix
index 0b4bd5790423..e6ec3549aeb5 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.15.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.15.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.15.1";
+  version = "5.15.2";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "1j0lnrsj5y2bsmmym8pjc5wk4wb11y336zr9gad1nmxcr0rwvz9j";
+    sha256 = "0xdi799k15l7l9kxlq4qbp79mp1c38vxal4z4p9l5gl194x06d2n";
   };
 } // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.4.nix b/pkgs/os-specific/linux/kernel/linux-5.4.nix
index 05d33cb4697e..a3cd3c0f9db2 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.4.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.4.158";
+  version = "5.4.159";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "0ncdkf1iz49458k3dvq3dc5b2r9dp21jsn3ffm9lbhlgvkn8y0bf";
+    sha256 = "0hw68yjf0c8kahwra8hq863318cbyqc89f429z75scmb9rgk466p";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/servers/fedigroups/default.nix b/pkgs/servers/fedigroups/default.nix
new file mode 100644
index 000000000000..fe3f2f351ace
--- /dev/null
+++ b/pkgs/servers/fedigroups/default.nix
@@ -0,0 +1,40 @@
+{ lib
+, stdenv
+, fetchFromGitea
+, rustPlatform
+, pkg-config
+, openssl
+, Security
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "fedigroups";
+  version = "0.4.4";
+
+  src = fetchFromGitea {
+    domain = "git.ondrovo.com";
+    owner = "MightyPork";
+    repo = "group-actor";
+    rev = "v${version}";
+    sha256 = "sha256-1WqIQp16bs+UB+NSEZn0JH6NOkuAx8iUfho4roA2B00=";
+  };
+
+  cargoHash = "sha256-88ToWRkBDXUvnEB2K6q5f3+IMuC3zNzrXrVFZnjbA9o=";
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    openssl
+  ] ++ lib.optional stdenv.isDarwin Security;
+
+  meta = with lib; {
+    homepage = "https://git.ondrovo.com/MightyPork/group-actor#fedi-groups";
+    downloadPage = "https://git.ondrovo.com/MightyPork/group-actor/releases";
+    description = "An approximation of groups usable with Fediverse software that implements the Mastodon client API";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fgaz ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/servers/matrix-synapse/default.nix b/pkgs/servers/matrix-synapse/default.nix
index ed6b7ccd9f64..676abec8ecca 100644
--- a/pkgs/servers/matrix-synapse/default.nix
+++ b/pkgs/servers/matrix-synapse/default.nix
@@ -5,26 +5,10 @@
 }:
 
 let
-py = python3.override {
-  packageOverrides = self: super: {
-    frozendict = super.frozendict.overridePythonAttrs (oldAttrs: rec {
-      version = "1.2";
-      src = oldAttrs.src.override {
-        inherit version;
-        sha256 = "0ibf1wipidz57giy53dh7mh68f2hz38x8f4wdq88mvxj5pr7jhbp";
-      };
-      doCheck = false;
-    });
-  };
-};
-in
-
-with py.pkgs;
-
-let
-  plugins = py.pkgs.callPackage ./plugins { };
+  plugins = python3.pkgs.callPackage ./plugins { };
   tools = callPackage ./tools { };
 in
+with python3.pkgs;
 buildPythonApplication rec {
   pname = "matrix-synapse";
   version = "1.46.0";
@@ -82,13 +66,13 @@ buildPythonApplication rec {
   doCheck = !stdenv.isDarwin;
 
   checkPhase = ''
-    PYTHONPATH=".:$PYTHONPATH" ${py.interpreter} -m twisted.trial -j $NIX_BUILD_CORES tests
+    PYTHONPATH=".:$PYTHONPATH" ${python3.interpreter} -m twisted.trial -j $NIX_BUILD_CORES tests
   '';
 
   passthru.tests = { inherit (nixosTests) matrix-synapse; };
   passthru.plugins = plugins;
   passthru.tools = tools;
-  passthru.python = py;
+  passthru.python = python3;
 
   meta = with lib; {
     homepage = "https://matrix.org";
diff --git a/pkgs/tools/networking/mu/default.nix b/pkgs/tools/networking/mu/default.nix
index b94cc498fa09..47d0dffda007 100644
--- a/pkgs/tools/networking/mu/default.nix
+++ b/pkgs/tools/networking/mu/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mu";
-  version = "1.6.9";
+  version = "1.6.10";
 
   src = fetchFromGitHub {
     owner  = "djcb";
     repo   = "mu";
     rev    = version;
-    sha256 = "RoSj283fcllEbirZOScKRU4BKLoxgatDdL1qYZu+LEI=";
+    sha256 = "1uJB8QdR0JgWlogb1cdUicz+LLtYQpAvYJjwcRjXt+E=";
   };
 
   postPatch = lib.optionalString (batchSize != null) ''
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index cd5c87820044..627ac26a283f 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -20630,6 +20630,10 @@ with pkgs;
 
   fcgiwrap = callPackage ../servers/fcgiwrap { };
 
+  fedigroups = callPackage ../servers/fedigroups {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
+
   felix = callPackage ../servers/felix { };
 
   felix_remoteshell = callPackage ../servers/felix/remoteshell.nix { };
@@ -29499,6 +29503,7 @@ with pkgs;
 
   alfis = callPackage ../applications/blockchains/alfis {
     inherit (darwin.apple_sdk.frameworks) Cocoa WebKit;
+    inherit (gnome) zenity;
   };
   alfis-nogui = alfis.override {
     withGui = false;
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 8a4408260042..74691f1df2d2 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -344,8 +344,8 @@ let
         then ppxlib.override { version = "0.15.0"; }
         else ppxlib; in
       {
-        ppx_deriving = ppx_deriving.override { ppxlib = ppxlib_0_15; };
-        ppxlib = ppxlib_0_15;
+        ppx_deriving_0_15 = ppx_deriving.override { ppxlib = ppxlib_0_15; };
+        inherit ppxlib_0_15;
       }
     );