Merge staging-next into staging

85 files changed, 1946 insertions, 262 deletions

diff --git a/lib/modules.nix b/lib/modules.nix
index 5e6bee6aabe3..051dbe2ef896 100644
--- a/lib/modules.nix
+++ b/lib/modules.nix
@@ -21,6 +21,7 @@ let
     isBool
     isFunction
     isList
+    isPath
     isString
     length
     mapAttrs
@@ -45,6 +46,9 @@ let
     showOption
     unknownModule
     ;
+  inherit (lib.strings)
+    isConvertibleWithToString
+    ;
 
   showDeclPrefix = loc: decl: prefix:
     " - option(s) with prefix `${showOption (loc ++ [prefix])}' in module `${decl._file}'";
@@ -403,7 +407,7 @@ rec {
             key = module.key;
             module = module;
             modules = collectedImports.modules;
-            disabled = module.disabledModules ++ collectedImports.disabled;
+            disabled = (if module.disabledModules != [] then [{ file = module._file; disabled = module.disabledModules; }] else []) ++ collectedImports.disabled;
           }) initialModules);
 
       # filterModules :: String -> { disabled, modules } -> [ Module ]
@@ -412,10 +416,30 @@ rec {
       # modules recursively. It returns the final list of unique-by-key modules
       filterModules = modulesPath: { disabled, modules }:
         let
-          moduleKey = m: if isString m && (builtins.substring 0 1 m != "/")
-            then toString modulesPath + "/" + m
-            else toString m;
-          disabledKeys = map moduleKey disabled;
+          moduleKey = file: m:
+            if isString m
+            then
+              if builtins.substring 0 1 m == "/"
+              then m
+              else toString modulesPath + "/" + m
+
+            else if isConvertibleWithToString m
+            then
+              if m?key && m.key != toString m
+              then
+                throw "Module `${file}` contains a disabledModules item that is an attribute set that can be converted to a string (${toString m}) but also has a `.key` attribute (${m.key}) with a different value. This makes it ambiguous which module should be disabled."
+              else
+                toString m
+
+            else if m?key
+            then
+              m.key
+
+            else if isAttrs m
+            then throw "Module `${file}` contains a disabledModules item that is an attribute set, presumably a module, that does not have a `key` attribute. This means that the module system doesn't have any means to identify the module that should be disabled. Make sure that you've put the correct value in disabledModules: a string path relative to modulesPath, a path value, or an attribute set with a `key` attribute."
+            else throw "Each disabledModules item must be a path, string, or a attribute set with a key attribute, or a value supported by toString. However, one of the disabledModules items in `${toString file}` is none of that, but is of type ${builtins.typeOf m}.";
+
+          disabledKeys = concatMap ({ file, disabled }: map (moduleKey file) disabled) disabled;
           keyFilter = filter (attrs: ! elem attrs.key disabledKeys);
         in map (attrs: attrs.module) (builtins.genericClosure {
           startSet = keyFilter modules;
diff --git a/lib/tests/modules.sh b/lib/tests/modules.sh
index cde4da643937..8081b186a2f9 100755
--- a/lib/tests/modules.sh
+++ b/lib/tests/modules.sh
@@ -141,6 +141,14 @@ checkConfigError "The option .*enable.* does not exist. Definition values:\n\s*-
 checkConfigError "attribute .*enable.* in selection path .*config.enable.* not found" "$@" ./disable-define-enable.nix ./disable-declare-enable.nix
 checkConfigError "attribute .*enable.* in selection path .*config.enable.* not found" "$@" ./disable-enable-modules.nix
 
+checkConfigOutput '^true$' 'config.positive.enable' ./disable-module-with-key.nix
+checkConfigOutput '^false$' 'config.negative.enable' ./disable-module-with-key.nix
+checkConfigError 'Module ..*disable-module-bad-key.nix. contains a disabledModules item that is an attribute set, presumably a module, that does not have a .key. attribute. .*' 'config.enable' ./disable-module-bad-key.nix
+
+# Not sure if we want to keep supporting module keys that aren't strings, paths or v?key, but we shouldn't remove support accidentally.
+checkConfigOutput '^true$' 'config.positive.enable' ./disable-module-with-toString-key.nix
+checkConfigOutput '^false$' 'config.negative.enable' ./disable-module-with-toString-key.nix
+
 # Check _module.args.
 set -- config.enable ./declare-enable.nix ./define-enable-with-custom-arg.nix
 checkConfigError 'while evaluating the module argument .*custom.* in .*define-enable-with-custom-arg.nix.*:' "$@"
@@ -358,6 +366,10 @@ checkConfigOutput '^"The option `a\.b. defined in `.*/doRename-warnings\.nix. ha
   config.result \
   ./doRename-warnings.nix
 
+# Anonymous modules get deduplicated by key
+checkConfigOutput '^"pear"$' config.once.raw ./merge-module-with-key.nix
+checkConfigOutput '^"pear\\npear"$' config.twice.raw ./merge-module-with-key.nix
+
 cat <<EOF
 ====== module tests ======
 $pass Pass
diff --git a/lib/tests/modules/disable-module-bad-key.nix b/lib/tests/modules/disable-module-bad-key.nix
new file mode 100644
index 000000000000..f50d06f2f03c
--- /dev/null
+++ b/lib/tests/modules/disable-module-bad-key.nix
@@ -0,0 +1,16 @@
+{ lib, ... }:
+let
+  inherit (lib) mkOption types;
+
+  moduleWithKey = { config, ... }: {
+    config = {
+      enable = true;
+    };
+  };
+in
+{
+  imports = [
+    ./declare-enable.nix
+  ];
+  disabledModules = [ { } ];
+}
diff --git a/lib/tests/modules/disable-module-with-key.nix b/lib/tests/modules/disable-module-with-key.nix
new file mode 100644
index 000000000000..ea2a60aa832d
--- /dev/null
+++ b/lib/tests/modules/disable-module-with-key.nix
@@ -0,0 +1,34 @@
+{ lib, ... }:
+let
+  inherit (lib) mkOption types;
+
+  moduleWithKey = {
+    key = "disable-module-with-key.nix#moduleWithKey";
+    config = {
+      enable = true;
+    };
+  };
+in
+{
+  options = {
+    positive = mkOption {
+      type = types.submodule {
+        imports = [
+          ./declare-enable.nix
+          moduleWithKey
+        ];
+      };
+      default = {};
+    };
+    negative = mkOption {
+      type = types.submodule {
+        imports = [
+          ./declare-enable.nix
+          moduleWithKey
+        ];
+        disabledModules = [ moduleWithKey ];
+      };
+      default = {};
+    };
+  };
+}
diff --git a/lib/tests/modules/disable-module-with-toString-key.nix b/lib/tests/modules/disable-module-with-toString-key.nix
new file mode 100644
index 000000000000..3f8c81904ce6
--- /dev/null
+++ b/lib/tests/modules/disable-module-with-toString-key.nix
@@ -0,0 +1,34 @@
+{ lib, ... }:
+let
+  inherit (lib) mkOption types;
+
+  moduleWithKey = {
+    key = 123;
+    config = {
+      enable = true;
+    };
+  };
+in
+{
+  options = {
+    positive = mkOption {
+      type = types.submodule {
+        imports = [
+          ./declare-enable.nix
+          moduleWithKey
+        ];
+      };
+      default = {};
+    };
+    negative = mkOption {
+      type = types.submodule {
+        imports = [
+          ./declare-enable.nix
+          moduleWithKey
+        ];
+        disabledModules = [ 123 ];
+      };
+      default = {};
+    };
+  };
+}
diff --git a/lib/tests/modules/merge-module-with-key.nix b/lib/tests/modules/merge-module-with-key.nix
new file mode 100644
index 000000000000..21f00e6ef976
--- /dev/null
+++ b/lib/tests/modules/merge-module-with-key.nix
@@ -0,0 +1,49 @@
+{ lib, ... }:
+let
+  inherit (lib) mkOption types;
+
+  moduleWithoutKey = {
+    config = {
+      raw = "pear";
+    };
+  };
+
+  moduleWithKey = {
+    key = __curPos.file + "#moduleWithKey";
+    config = {
+      raw = "pear";
+    };
+  };
+
+  decl = {
+    options = {
+      raw = mkOption {
+        type = types.lines;
+      };
+    };
+  };
+in
+{
+  options = {
+    once = mkOption {
+      type = types.submodule {
+        imports = [
+          decl
+          moduleWithKey
+          moduleWithKey
+        ];
+      };
+      default = {};
+    };
+    twice = mkOption {
+      type = types.submodule {
+        imports = [
+          decl
+          moduleWithoutKey
+          moduleWithoutKey
+        ];
+      };
+      default = {};
+    };
+  };
+}
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 5652305cb9d9..34d7aa4c4f93 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -8948,7 +8948,8 @@
     githubId = 13547699;
     name = "Corin Hoad";
     keys = [{
-      fingerprint = "BA3A 5886 AE6D 526E 20B4  57D6 6A37 DF94 8318 8492";
+      # fingerprint = "BA3A 5886 AE6D 526E 20B4  57D6 6A37 DF94 8318 8492"; # old key, superseded
+      fingerprint = "6E69 6A19 4BD8 BFAE 7362  ACDB 6437 4619 95CA 7F16";
     }];
   };
   lux = {
diff --git a/nixos/doc/manual/development/replace-modules.section.md b/nixos/doc/manual/development/replace-modules.section.md
index 0c0d6a7ac2f1..ac9f5adbaf98 100644
--- a/nixos/doc/manual/development/replace-modules.section.md
+++ b/nixos/doc/manual/development/replace-modules.section.md
@@ -8,8 +8,15 @@ the system on a stable release.
 
 `disabledModules` is a top level attribute like `imports`, `options` and
 `config`. It contains a list of modules that will be disabled. This can
-either be the full path to the module or a string with the filename
-relative to the modules path (eg. \<nixpkgs/nixos/modules> for nixos).
+either be:
+ - the full path to the module,
+ - or a string with the filename relative to the modules path (eg. \<nixpkgs/nixos/modules> for nixos),
+ - or an attribute set containing a specific `key` attribute.
+
+The latter allows some modules to be disabled, despite them being distributed
+via attributes instead of file paths. The `key` should be globally unique, so
+it is recommended to include a file path in it, or rely on a framework to do it
+for you.
 
 This example will replace the existing postgresql module with the
 version defined in the nixos-unstable channel while keeping the rest of
diff --git a/pkgs/applications/editors/vscode/vscodium.nix b/pkgs/applications/editors/vscode/vscodium.nix
index cd89ab7d783d..3b70d7d8ec83 100644
--- a/pkgs/applications/editors/vscode/vscodium.nix
+++ b/pkgs/applications/editors/vscode/vscodium.nix
@@ -15,11 +15,11 @@ let
   archive_fmt = if stdenv.isDarwin then "zip" else "tar.gz";
 
   sha256 = {
-    x86_64-linux = "1qayw19mb7f0gcgcvl57gpacrqsyx2jvc6s63vzbx8jmf5qnk71a";
-    x86_64-darwin = "02z9026kp66lx6pll46xx790jj7c7wh2ca7xim373x90k8hm4kwz";
-    aarch64-linux = "1izqhzvv46p05k1z2yg380ddwmar4w2pbrd0dyvkdysvp166y931";
-    aarch64-darwin = "1zcr653ssck4nc3vf04l6bilnjdsiqscw62g1wzbyk6s50133cx8";
-    armv7l-linux = "0n914rcfn2m9zsbnkd82cmw88qbpssv6jk3g8ig3wqlircbgrw0h";
+    x86_64-linux = "11w2gzhp0vlpygk93cksxhkimc9y8w862gn9450xkzi1jsps5lj4";
+    x86_64-darwin = "0ya17adx2vbi800ws5sfqq03lrjjk6kbclrfrc2zfij2ha05xl8z";
+    aarch64-linux = "15kzjs1ha5x2hcq28nkbb0rim1v694jj6p9sz226rai3bmq9airg";
+    aarch64-darwin = "1cggppblr42jzpcz3g8052w5y1b9392iizpvg6y7001kw66ndp3n";
+    armv7l-linux = "01qqhhl5ffvba1pk4jj3q7sbahq7cvy81wvmgng1cmaj5b8m8dgp";
   }.${system} or throwSystem;
 
   sourceRoot = if stdenv.isDarwin then "" else ".";
@@ -29,7 +29,7 @@ in
 
     # Please backport all compatible updates to the stable release.
     # This is important for the extension ecosystem.
-    version = "1.75.0.23033";
+    version = "1.76.0.23062";
     pname = "vscodium";
 
     executableName = "codium";
diff --git a/pkgs/applications/misc/mkgmap/default.nix b/pkgs/applications/misc/mkgmap/default.nix
index 195c083fbfe9..4c2527cad1f2 100644
--- a/pkgs/applications/misc/mkgmap/default.nix
+++ b/pkgs/applications/misc/mkgmap/default.nix
@@ -15,12 +15,12 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "mkgmap";
-  version = "4906";
+  version = "4907";
 
   src = fetchsvn {
     url = "https://svn.mkgmap.org.uk/mkgmap/mkgmap/trunk";
     rev = version;
-    sha256 = "sha256-N1VU5XOENCQiUnDCFpotx+8Pr3VFuWLu1ABcbm0feOM=";
+    sha256 = "sha256-2DwIH6GNsK2XwaVxzPvN1qt4XRSi5fCQDwltBCBg4gI=";
   };
 
   patches = [
diff --git a/pkgs/applications/misc/organicmaps/default.nix b/pkgs/applications/misc/organicmaps/default.nix
index bbd8aaaa848b..8fa0a8e7576f 100644
--- a/pkgs/applications/misc/organicmaps/default.nix
+++ b/pkgs/applications/misc/organicmaps/default.nix
@@ -15,17 +15,19 @@
 , zlib
 , icu
 , freetype
+, pugixml
+, nix-update-script
 }:
 
 mkDerivation rec {
   pname = "organicmaps";
-  version = "2023.01.25-3";
+  version = "2023.03.05-5";
 
   src = fetchFromGitHub {
     owner = "organicmaps";
     repo = "organicmaps";
     rev = "${version}-android";
-    sha256 = "sha256-4nlD/GFOoBOCXVWtC7i6SUquEbob5++GyagZOTznygU=";
+    sha256 = "sha256-PfudozmrL8jNS/99nxSn0B3E53W34m4/ZN0y2ucB2WI=";
     fetchSubmodules = true;
   };
 
@@ -55,6 +57,7 @@ mkDerivation rec {
     zlib
     icu
     freetype
+    pugixml
   ];
 
   # Yes, this is PRE configure. The configure phase uses cmake
@@ -62,6 +65,13 @@ mkDerivation rec {
     bash ./configure.sh
   '';
 
+  passthru = {
+    updateScript = nix-update-script {
+      attrPath = pname;
+      extraArgs = [ "-vr" "(.*)-android" ];
+    };
+  };
+
   meta = with lib; {
     # darwin: "invalid application of 'sizeof' to a function type"
     broken = (stdenv.isLinux && stdenv.isAarch64) || stdenv.isDarwin;
diff --git a/pkgs/applications/networking/browsers/microsoft-edge/browser.nix b/pkgs/applications/networking/browsers/microsoft-edge/browser.nix
index 636d1a13791f..685bd7e42ac8 100644
--- a/pkgs/applications/networking/browsers/microsoft-edge/browser.nix
+++ b/pkgs/applications/networking/browsers/microsoft-edge/browser.nix
@@ -3,6 +3,7 @@
 { stdenv
 , fetchurl
 , lib
+, makeWrapper
 
 , binutils-unwrapped
 , xz
@@ -62,6 +63,10 @@ stdenv.mkDerivation rec {
     inherit sha256;
   };
 
+  nativeBuildInputs = [
+    makeWrapper
+  ];
+
   unpackCmd = "${binutils-unwrapped}/bin/ar p $src data.tar.xz | ${xz}/bin/xz -dc | ${gnutar}/bin/tar -xf -";
   sourceRoot = ".";
 
@@ -170,7 +175,7 @@ stdenv.mkDerivation rec {
       --replace /opt/microsoft/${shortName} $out/opt/microsoft/${shortName}
 
     substituteInPlace $out/opt/microsoft/${shortName}/xdg-mime \
-      --replace "''${XDG_DATA_DIRS:-/usr/local/share:/usr/share}" "''${XDG_DATA_DIRS:-/run/current-system/sw/share}" \
+      --replace "\''${XDG_DATA_DIRS:-/usr/local/share:/usr/share}" "\''${XDG_DATA_DIRS:-/run/current-system/sw/share}" \
       --replace "xdg_system_dirs=/usr/local/share/:/usr/share/" "xdg_system_dirs=/run/current-system/sw/share/" \
       --replace /usr/bin/file ${file}/bin/file
 
@@ -178,8 +183,13 @@ stdenv.mkDerivation rec {
       --replace /opt/microsoft/${shortName} $out/opt/microsoft/${shortName}
 
     substituteInPlace $out/opt/microsoft/${shortName}/xdg-settings \
-      --replace "''${XDG_DATA_DIRS:-/usr/local/share:/usr/share}" "''${XDG_DATA_DIRS:-/run/current-system/sw/share}" \
-      --replace "''${XDG_CONFIG_DIRS:-/etc/xdg}" "''${XDG_CONFIG_DIRS:-/run/current-system/sw/etc/xdg}"
+      --replace "\''${XDG_DATA_DIRS:-/usr/local/share:/usr/share}" "\''${XDG_DATA_DIRS:-/run/current-system/sw/share}" \
+      --replace "\''${XDG_CONFIG_DIRS:-/etc/xdg}" "\''${XDG_CONFIG_DIRS:-/run/current-system/sw/etc/xdg}"
+  '';
+
+  postFixup = ''
+    wrapProgram "$out/bin/${longName}" \
+      --prefix XDG_DATA_DIRS : "${gtk3}/share/gsettings-schemas/${gtk3.pname}-${gtk3.version}"
   '';
 
   meta = with lib; {
diff --git a/pkgs/applications/networking/instant-messengers/jackline/default.nix b/pkgs/applications/networking/instant-messengers/jackline/default.nix
index 5bf231ec924b..9178c73a46dd 100644
--- a/pkgs/applications/networking/instant-messengers/jackline/default.nix
+++ b/pkgs/applications/networking/instant-messengers/jackline/default.nix
@@ -4,7 +4,7 @@ with ocamlPackages;
 
 buildDunePackage rec {
   pname = "jackline";
-  version = "unstable-2022-05-27";
+  version = "unstable-2023-02-24";
 
   minimalOCamlVersion = "4.08";
 
@@ -13,8 +13,8 @@ buildDunePackage rec {
   src = fetchFromGitHub {
     owner  = "hannesm";
     repo   = "jackline";
-    rev    = "d8f7c504027a0dd51966b2b7304d6daad155a05b";
-    hash = "sha256-6SWYl2mB0g8JNVHBeTnZEbzOaTmVbsRMMEs+3j/ewwk=";
+    rev    = "846be4e7fcddf45e66e0ff5b29fb5a212d6ee8c3";
+    hash = "sha256-/j3VJRx/w9HQUnfoq/4gMWV5oVdRiPGddrgbCDk5y8c=";
   };
 
   nativeBuildInpts = [
diff --git a/pkgs/applications/networking/mullvad/mullvad.nix b/pkgs/applications/networking/mullvad/mullvad.nix
index 0d62c3c7ce96..f23ba1561a6c 100644
--- a/pkgs/applications/networking/mullvad/mullvad.nix
+++ b/pkgs/applications/networking/mullvad/mullvad.nix
@@ -15,6 +15,7 @@
 , enableOpenvpn ? true
 , openvpn-mullvad
 , shadowsocks-rust
+, installShellFiles
 }:
 rustPlatform.buildRustPackage rec {
   pname = "mullvad";
@@ -44,6 +45,7 @@ rustPlatform.buildRustPackage rec {
     protobuf
     makeWrapper
     git
+    installShellFiles
   ];
 
   buildInputs = [
@@ -59,6 +61,17 @@ rustPlatform.buildRustPackage rec {
     ln -s ${libwg}/lib/libwg.a $dest
   '';
 
+  postInstall = ''
+    compdir=$(mktemp -d)
+    for shell in bash zsh fish; do
+      $out/bin/mullvad shell-completions $shell $compdir
+    done
+    installShellCompletion --cmd mullvad \
+      --bash $compdir/mullvad.bash \
+      --zsh $compdir/_mullvad \
+      --fish $compdir/mullvad.fish
+  '';
+
   postFixup =
     # Place all binaries in the 'mullvad-' namespace, even though these
     # specific binaries aren't used in the lifetime of the program.
diff --git a/pkgs/applications/version-management/redmine/Gemfile.lock b/pkgs/applications/version-management/redmine/Gemfile.lock
index 722205e17dbe..d2e9051cafb6 100644
--- a/pkgs/applications/version-management/redmine/Gemfile.lock
+++ b/pkgs/applications/version-management/redmine/Gemfile.lock
@@ -60,14 +60,14 @@ GEM
       xpath (~> 3.2)
     childprocess (3.0.0)
     chunky_png (1.4.0)
-    concurrent-ruby (1.1.10)
+    concurrent-ruby (1.2.2)
     crass (1.0.6)
-    css_parser (1.12.0)
+    css_parser (1.14.0)
       addressable
     csv (3.1.9)
     docile (1.4.0)
-    erubi (1.11.0)
-    globalid (1.0.0)
+    erubi (1.12.0)
+    globalid (1.1.0)
       activesupport (>= 5.0)
     htmlentities (4.3.4)
     i18n (1.8.11)
@@ -81,11 +81,11 @@ GEM
     method_source (1.0.0)
     mini_magick (4.11.0)
     mini_mime (1.0.3)
-    mini_portile2 (2.8.0)
-    minitest (5.16.3)
+    mini_portile2 (2.8.1)
+    minitest (5.18.0)
     mocha (2.0.2)
       ruby2_keywords (>= 0.0.5)
-    mysql2 (0.5.4)
+    mysql2 (0.5.5)
     net-ldap (0.17.1)
     nio4r (2.5.8)
     nokogiri (1.13.10)
@@ -94,14 +94,14 @@ GEM
     nokogiri (1.13.10-x86_64-linux)
       racc (~> 1.4)
     parallel (1.22.1)
-    parser (3.1.3.0)
+    parser (3.2.1.1)
       ast (~> 2.4.1)
     pg (1.2.3)
     public_suffix (5.0.1)
     puma (5.6.5)
       nio4r (~> 2.0)
-    racc (1.6.1)
-    rack (2.2.4)
+    racc (1.6.2)
+    rack (2.2.6.3)
     rack-openid (1.4.2)
       rack (>= 1.1.0)
       ruby-openid (>= 2.1.8)
@@ -123,7 +123,7 @@ GEM
     rails-dom-testing (2.0.3)
       activesupport (>= 4.2.0)
       nokogiri (>= 1.6)
-    rails-html-sanitizer (1.4.4)
+    rails-html-sanitizer (1.5.0)
       loofah (~> 2.19, >= 2.19.1)
     railties (5.2.8.1)
       actionpack (= 5.2.8.1)
@@ -163,8 +163,8 @@ GEM
       rubocop-ast (>= 1.2.0, < 2.0)
       ruby-progressbar (~> 1.7)
       unicode-display_width (>= 1.4.0, < 3.0)
-    rubocop-ast (1.24.0)
-      parser (>= 3.1.1.0)
+    rubocop-ast (1.27.0)
+      parser (>= 3.2.1.0)
     rubocop-performance (1.10.2)
       rubocop (>= 0.90.0, < 2.0)
       rubocop-ast (>= 0.4.0)
@@ -173,7 +173,7 @@ GEM
       rack (>= 1.1)
       rubocop (>= 0.90.0, < 2.0)
     ruby-openid (2.9.2)
-    ruby-progressbar (1.11.0)
+    ruby-progressbar (1.13.0)
     ruby2_keywords (0.0.5)
     rubyzip (2.3.2)
     selenium-webdriver (3.142.7)
@@ -183,18 +183,18 @@ GEM
       docile (~> 1.1)
       simplecov-html (~> 0.11)
     simplecov-html (0.12.3)
-    sprockets (4.1.1)
+    sprockets (4.2.0)
       concurrent-ruby (~> 1.0)
-      rack (> 1, < 3)
+      rack (>= 2.2.4, < 4)
     sprockets-rails (3.4.2)
       actionpack (>= 5.2)
       activesupport (>= 5.2)
       sprockets (>= 3.0.0)
     thor (1.2.1)
     thread_safe (0.3.6)
-    tzinfo (1.2.10)
+    tzinfo (1.2.11)
       thread_safe (~> 0.1)
-    unicode-display_width (2.3.0)
+    unicode-display_width (2.4.2)
     webdrivers (4.7.0)
       nokogiri (~> 1.6)
       rubyzip (>= 1.3.0)
@@ -251,7 +251,7 @@ DEPENDENCIES
   yard
 
 RUBY VERSION
-   ruby 2.7.6p219
+   ruby 2.7.7p221
 
 BUNDLED WITH
    2.3.26
diff --git a/pkgs/applications/version-management/redmine/default.nix b/pkgs/applications/version-management/redmine/default.nix
index d71b570b7dfe..969d7d945f98 100644
--- a/pkgs/applications/version-management/redmine/default.nix
+++ b/pkgs/applications/version-management/redmine/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchurl, bundlerEnv, ruby, makeWrapper, nixosTests }:
 
 let
-  version = "4.2.9";
+  version = "4.2.10";
   rubyEnv = bundlerEnv {
     name = "redmine-env-${version}";
 
@@ -16,7 +16,7 @@ in
 
     src = fetchurl {
       url = "https://www.redmine.org/releases/${pname}-${version}.tar.gz";
-      sha256 = "sha256-04dBNF9u/RDAeYmAk7JZ2NxNzY5B38T2RkloWueoyx4=";
+      sha256 = "sha256-byY4jCOJKWJVLKSR1e/tq9QtrIiGHdnYC8M0WPZb4ek=";
     };
 
     nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/applications/version-management/redmine/gemset.nix b/pkgs/applications/version-management/redmine/gemset.nix
index fa34afaa4d60..f7340dc1de7d 100644
--- a/pkgs/applications/version-management/redmine/gemset.nix
+++ b/pkgs/applications/version-management/redmine/gemset.nix
@@ -186,10 +186,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0s4fpn3mqiizpmpy2a24k4v365pv75y50292r8ajrv4i1p5b2k14";
+      sha256 = "0krcwb6mn0iklajwngwsg850nk8k9b35dhmc2qkbdqvmifdi2y9q";
       type = "gem";
     };
-    version = "1.1.10";
+    version = "1.2.2";
   };
   crass = {
     groups = ["default"];
@@ -207,10 +207,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1107j3frhmcd95wcsz0rypchynnzhnjiyyxxcl6dlmr2lfy08z4b";
+      sha256 = "04q1vin8slr3k8mp76qz0wqgap6f9kdsbryvgfq9fljhrm463kpj";
       type = "gem";
     };
-    version = "1.12.0";
+    version = "1.14.0";
   };
   csv = {
     groups = ["default"];
@@ -237,10 +237,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "11bz1v1cxabm8672gabrw542zyg51dizlcvdck6vvwzagxbjv9zx";
+      sha256 = "08s75vs9cxlc4r1q2bjg4br8g9wc5lc5x5vl0vv4zq5ivxsdpgi7";
       type = "gem";
     };
-    version = "1.11.0";
+    version = "1.12.0";
   };
   globalid = {
     dependencies = ["activesupport"];
@@ -248,10 +248,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1n5yc058i8xhi1fwcp1w7mfi6xaxfmrifdb4r4hjfff33ldn8lqj";
+      sha256 = "0kqm5ndzaybpnpxqiqkc41k4ksyxl41ln8qqr6kb130cdxsf2dxk";
       type = "gem";
     };
-    version = "1.0.0";
+    version = "1.1.0";
   };
   htmlentities = {
     groups = ["default"];
@@ -341,20 +341,20 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0rapl1sfmfi3bfr68da4ca16yhc0pp93vjwkj7y3rdqrzy3b41hy";
+      sha256 = "1af4yarhbbx62f7qsmgg5fynrik0s36wjy3difkawy536xg343mp";
       type = "gem";
     };
-    version = "2.8.0";
+    version = "2.8.1";
   };
   minitest = {
     groups = ["default" "test"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0516ypqlx0mlcfn5xh7qppxqc3xndn1fnadxawa8wld5dkcimy30";
+      sha256 = "0ic7i5z88zcaqnpzprf7saimq2f6sad57g5mkkqsrqrcd6h3mx06";
       type = "gem";
     };
-    version = "5.16.3";
+    version = "5.18.0";
   };
   mocha = {
     dependencies = ["ruby2_keywords"];
@@ -380,10 +380,10 @@
     }];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0xsy70mg4p854jska7ff7cy8fyn9nhlkrmfdvkkfmk8qxairbfq1";
+      sha256 = "1gjvj215qdhwk3292sc7xsn6fmwnnaq2xs35hh5hc8d8j22izlbn";
       type = "gem";
     };
-    version = "0.5.4";
+    version = "0.5.5";
   };
   net-ldap = {
     groups = ["ldap"];
@@ -432,10 +432,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "17qfhjvnr9q2gp1gfdl6kndy2mb6qdwsls3vnjhb1h8ddimdm4s5";
+      sha256 = "1a2v5f8fw7nxm41xp422p1pbr41hafy62bp95m7vg42cqp5y4grc";
       type = "gem";
     };
-    version = "3.1.3.0";
+    version = "3.2.1.1";
   };
   pg = {
     groups = ["default"];
@@ -481,20 +481,20 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0p685i23lr8pl7l09g9l2mcj615fr7g33w3mkcr472lcg34nq8n8";
+      sha256 = "09jgz6r0f7v84a7jz9an85q8vvmp743dqcsdm3z9c8rqcqv6pljq";
       type = "gem";
     };
-    version = "1.6.1";
+    version = "1.6.2";
   };
   rack = {
     groups = ["default" "openid" "test"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0axc6w0rs4yj0pksfll1hjgw1k6a5q0xi2lckh91knfb72v348pa";
+      sha256 = "17wg99w29hpiq9p4cmm8c6kdg4lcw0ll2c36qw7y50gy1cs4h5j2";
       type = "gem";
     };
-    version = "2.2.4";
+    version = "2.2.6.3";
   };
   rack-openid = {
     dependencies = ["rack" "ruby-openid"];
@@ -546,10 +546,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1mcb75qvldfz6zsr4inrfx7dmb0ngxy507awx28khqmnla3hqpc9";
+      sha256 = "0ygav4xyq943qqyhjmi3mzirn180j565mc9h5j4css59x1sn0cmz";
       type = "gem";
     };
-    version = "1.4.4";
+    version = "1.5.0";
   };
   railties = {
     dependencies = ["actionpack" "activesupport" "method_source" "rake" "thor"];
@@ -724,10 +724,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0sqkg84npyq9z4d3z46w59zyr1r1rbd1mrrlglws9ksw04wdq5x9";
+      sha256 = "16iabkwqhzqh3cd4pcrp0nqv4ks2whcz84csawi78ynfk12vd20a";
       type = "gem";
     };
-    version = "1.24.0";
+    version = "1.27.0";
   };
   rubocop-performance = {
     dependencies = ["rubocop" "rubocop-ast"];
@@ -766,10 +766,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "02nmaw7yx9kl7rbaan5pl8x5nn0y4j5954mzrkzi9i3dhsrps4nc";
+      sha256 = "0cwvyb7j47m7wihpfaq7rc47zwwx9k4v7iqd9s1xch5nm53rrz40";
       type = "gem";
     };
-    version = "1.11.0";
+    version = "1.13.0";
   };
   ruby2_keywords = {
     groups = ["default" "test"];
@@ -829,10 +829,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1qj82dcfkk6c4zw357k5r05s5iwvyddh57bpwj0a1hjgaw70pcb8";
+      sha256 = "0k0236g4h3ax7v6vp9k0l2fa0w6f1wqp7dn060zm4isw4n3k89sw";
       type = "gem";
     };
-    version = "4.1.1";
+    version = "4.2.0";
   };
   sprockets-rails = {
     dependencies = ["actionpack" "activesupport" "sprockets"];
@@ -871,20 +871,20 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0rw89y3zj0wcybcyiazgcprg6hi42k8ipp1n2lbl95z1dmpgmly6";
+      sha256 = "1dk1cfnhgl14l580b650qyp8m5xpqb3zg0wb251h5jkm46hzc0b5";
       type = "gem";
     };
-    version = "1.2.10";
+    version = "1.2.11";
   };
   unicode-display_width = {
     groups = ["default" "test"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0ra70s8prfacpqwj5v2mqn1rbfz6xds3n9nsr9cwzs3z2c0wm5j7";
+      sha256 = "1gi82k102q7bkmfi7ggn9ciypn897ylln1jk9q67kjhr39fj043a";
       type = "gem";
     };
-    version = "2.3.0";
+    version = "2.4.2";
   };
   webdrivers = {
     dependencies = ["nokogiri" "rubyzip" "selenium-webdriver"];
diff --git a/pkgs/data/fonts/monocraft/default.nix b/pkgs/data/fonts/monocraft/default.nix
index 427e9ea8223b..c1e4be656ce1 100644
--- a/pkgs/data/fonts/monocraft/default.nix
+++ b/pkgs/data/fonts/monocraft/default.nix
@@ -1,15 +1,25 @@
-{ stdenv, lib, fetchFromGitHub }:
+{ stdenv, lib, fetchurl }:
 
-stdenv.mkDerivation rec {
+let
+  version = "2.4";
+  relArtifact = name: hash: fetchurl {
+    inherit name hash;
+    url = "https://github.com/IdreesInc/Monocraft/releases/download/v${version}/${name}";
+  };
+in
+stdenv.mkDerivation {
   pname = "monocraft";
-  version = "1.4";
+  inherit version;
 
-  src = fetchFromGitHub {
-    owner = "IdreesInc";
-    repo = "Monocraft";
-    rev = "v${version}";
-    sha256 = "sha256-YF0uPCc+dajJtG6mh/JpoSr6GirAhif5L5sp6hFmKLE=";
-  };
+  srcs = [
+    (relArtifact "Monocraft.otf" "sha256-PA1W+gOUStGw7cDmtEbG+B6M+sAYr8cft+Ckxj5LciU=")
+    (relArtifact "Monocraft.ttf" "sha256-S4j5v2bTJbhujT3Bt8daNN1YGYYP8zVPf9XXjuR64+o=")
+    (relArtifact "Monocraft-no-ligatures.ttf" "sha256-MuHfoP+dsXe+ODN4vWFIj50jwOxYyIiS0dd1tzVxHts=")
+    (relArtifact "Monocraft-nerd-fonts-patched.ttf" "sha256-QxMp8UwcRjWySNHWoNeX2sX9teZ4+tCFj+DG41azsXw=")
+  ];
+
+  sourceRoot = ".";
+  unpackCmd = ''cp "$curSrc" $(basename $curSrc)'';
 
   dontConfigure = true;
   dontBuild = true;
@@ -17,6 +27,7 @@ stdenv.mkDerivation rec {
   installPhase = ''
     runHook preInstall
     install -Dm644 -t $out/share/fonts/opentype *.otf
+    install -Dm644 -t $out/share/fonts/truetype *.ttf
     runHook postInstall
   '';
 
diff --git a/pkgs/development/coq-modules/coq-elpi/default.nix b/pkgs/development/coq-modules/coq-elpi/default.nix
index 7e7ec784c313..8b932499ca44 100644
--- a/pkgs/development/coq-modules/coq-elpi/default.nix
+++ b/pkgs/development/coq-modules/coq-elpi/default.nix
@@ -8,6 +8,7 @@ with builtins; with lib; let
     { case = "8.14"; out = { version = "1.13.7"; };}
     { case = "8.15"; out = { version = "1.15.0"; };}
     { case = "8.16"; out = { version = "1.16.5"; };}
+    { case = "8.17"; out = { version = "1.16.5"; };}
   ] {} );
 in mkCoqDerivation {
   pname = "elpi";
@@ -15,6 +16,7 @@ in mkCoqDerivation {
   owner = "LPCIC";
   inherit version;
   defaultVersion = lib.switch coq.coq-version [
+    { case = "8.17"; out = "1.17.0"; }
     { case = "8.16"; out = "1.15.6"; }
     { case = "8.15"; out = "1.14.0"; }
     { case = "8.14"; out = "1.11.2"; }
@@ -22,6 +24,7 @@ in mkCoqDerivation {
     { case = "8.12"; out = "1.8.3_8.12"; }
     { case = "8.11"; out = "1.6.3_8.11"; }
   ] null;
+  release."1.17.0".sha256     = "sha256-J8GatRKFU0ekNCG3V5dBI+FXypeHcLgC5QJYGYzFiEM=";
   release."1.15.6".sha256     = "sha256-qc0q01tW8NVm83801HHOBHe/7H1/F2WGDbKO6nCXfno=";
   release."1.15.1".sha256     = "sha256-NT2RlcIsFB9AvBhMxil4ZZIgx+KusMqDflj2HgQxsZg=";
   release."1.14.0".sha256     = "sha256:1v2p5dlpviwzky2i14cj7gcgf8cr0j54bdm9fl5iz1ckx60j6nvp";
diff --git a/pkgs/development/coq-modules/coqeal/default.nix b/pkgs/development/coq-modules/coqeal/default.nix
index 1ccbf9e82a0f..65c516d30221 100644
--- a/pkgs/development/coq-modules/coqeal/default.nix
+++ b/pkgs/development/coq-modules/coqeal/default.nix
@@ -8,7 +8,7 @@
 
   inherit version;
   defaultVersion = with lib.versions; lib.switch [ coq.version mathcomp.version ]  [
-      { cases = [ (range "8.13" "8.16") (isGe "1.13.0") ]; out = "1.1.1"; }
+      { cases = [ (range "8.13" "8.17") (isGe "1.13.0") ]; out = "1.1.1"; }
       { cases = [ (range "8.10" "8.15") (isGe "1.12.0") ]; out = "1.1.0"; }
       { cases = [ (isGe "8.10") (range "1.11.0" "1.12.0") ]; out = "1.0.5"; }
       { cases = [ (isGe "8.7") "1.11.0" ]; out = "1.0.4"; }
diff --git a/pkgs/development/coq-modules/coquelicot/default.nix b/pkgs/development/coq-modules/coquelicot/default.nix
index 922a601584d4..526ba4985c93 100644
--- a/pkgs/development/coq-modules/coquelicot/default.nix
+++ b/pkgs/development/coq-modules/coquelicot/default.nix
@@ -7,7 +7,7 @@ mkCoqDerivation {
   domain = "gitlab.inria.fr";
   inherit version;
   defaultVersion = with lib.versions; lib.switch coq.coq-version [
-    { case = range "8.12" "8.16"; out = "3.3.0"; }
+    { case = range "8.12" "8.17"; out = "3.3.0"; }
     { case = range "8.8" "8.16"; out = "3.2.0"; }
     { case = range "8.8" "8.13"; out = "3.1.0"; }
     { case = range "8.5" "8.9";  out = "3.0.2"; }
diff --git a/pkgs/development/coq-modules/flocq/default.nix b/pkgs/development/coq-modules/flocq/default.nix
index cf39c8211b78..3ad6f6d47810 100644
--- a/pkgs/development/coq-modules/flocq/default.nix
+++ b/pkgs/development/coq-modules/flocq/default.nix
@@ -7,10 +7,12 @@ mkCoqDerivation {
   domain = "gitlab.inria.fr";
   inherit version;
   defaultVersion = with lib.versions; lib.switch coq.coq-version [
+    { case = range "8.14" "8.17"; out = "4.1.1"; }
     { case = range "8.14" "8.16"; out = "4.1.0"; }
     { case = range "8.7" "8.15"; out = "3.4.3"; }
     { case = range "8.5" "8.8"; out = "2.6.1"; }
   ] null;
+  release."4.1.1".sha256 = "sha256-FbClxlV0ZaxITe7s9SlNbpeMNDJli+Dfh2TMrjaMtHo=";
   release."4.1.0".sha256 = "sha256:09rak9cha7q11yfqracbcq75mhmir84331h1218xcawza48rbjik";
   release."3.4.3".sha256 = "sha256-YTdWlEmFJjCcHkl47jSOgrGqdXoApJY4u618ofCaCZE=";
   release."3.4.2".sha256 = "1s37hvxyffx8ccc8mg5aba7ivfc39p216iibvd7f2cb9lniqk1pw";
diff --git a/pkgs/development/coq-modules/graph-theory/default.nix b/pkgs/development/coq-modules/graph-theory/default.nix
index cbd919c7aa61..2c9f4e4cf27c 100644
--- a/pkgs/development/coq-modules/graph-theory/default.nix
+++ b/pkgs/development/coq-modules/graph-theory/default.nix
@@ -1,19 +1,21 @@
 { lib, mkCoqDerivation, coq, mathcomp-algebra, mathcomp-finmap, mathcomp-fingroup
-, hierarchy-builder, version ? null }:
+, fourcolor, hierarchy-builder, version ? null }:
 
 mkCoqDerivation {
   pname = "graph-theory";
 
   release."0.9".sha256 = "sha256-Hl3JS9YERD8QQziXqZ9DqLHKp63RKI9HxoFYWSkJQZI=";
+  release."0.9.1".sha256 = "sha256-lRRY+501x+DqNeItBnbwYIqWLDksinWIY4x/iojRNYU=";
 
   releaseRev = v: "v${v}";
 
   inherit version;
   defaultVersion = with lib.versions; lib.switch coq.coq-version [
-    { case = range "8.13" "8.16"; out = "0.9"; }
+    { case = range "8.14" "8.16"; out = "0.9.1"; }
+    { case = range "8.12" "8.12"; out = "0.9"; }
   ] null;
 
-  propagatedBuildInputs = [ mathcomp-algebra mathcomp-finmap mathcomp-fingroup hierarchy-builder ];
+  propagatedBuildInputs = [ mathcomp-algebra mathcomp-finmap mathcomp-fingroup fourcolor hierarchy-builder ];
 
   meta = with lib; {
     description = "Library of formalized graph theory results in Coq";
diff --git a/pkgs/development/coq-modules/hierarchy-builder/default.nix b/pkgs/development/coq-modules/hierarchy-builder/default.nix
index 9bcc07387b1e..464ef4fc301d 100644
--- a/pkgs/development/coq-modules/hierarchy-builder/default.nix
+++ b/pkgs/development/coq-modules/hierarchy-builder/default.nix
@@ -5,7 +5,7 @@ let hb = mkCoqDerivation {
   owner = "math-comp";
   inherit version;
   defaultVersion = with lib.versions; lib.switch coq.coq-version [
-    { case = range "8.15" "8.16"; out = "1.4.0"; }
+    { case = range "8.15" "8.17"; out = "1.4.0"; }
     { case = range "8.13" "8.14"; out = "1.2.0"; }
     { case = range "8.12" "8.13"; out = "1.1.0"; }
     { case = isEq "8.11";         out = "0.10.0"; }
diff --git a/pkgs/development/coq-modules/interval/default.nix b/pkgs/development/coq-modules/interval/default.nix
index 02a249549df1..7e9ba5f838d0 100644
--- a/pkgs/development/coq-modules/interval/default.nix
+++ b/pkgs/development/coq-modules/interval/default.nix
@@ -7,12 +7,14 @@ mkCoqDerivation rec {
   domain = "gitlab.inria.fr";
   inherit version;
   defaultVersion = with lib.versions; lib.switch coq.coq-version [
+    { case = range "8.12" "8.17"; out = "4.6.1"; }
     { case = range "8.12" "8.16"; out = "4.6.0"; }
     { case = range "8.8" "8.16"; out = "4.5.2"; }
     { case = range "8.8" "8.12"; out = "4.0.0"; }
     { case = range "8.7" "8.11"; out = "3.4.2"; }
     { case = range "8.5" "8.6";  out = "3.3.0"; }
   ] null;
+  release."4.6.1".sha256 = "sha256-ZZSxt8ksz0g6dl/LEido5qJXgsaxHrVLqkGUHu90+e0=";
   release."4.6.0".sha256 = "sha256-n9ECKnV0L6XYcIcbYyOJKwlbisz/RRbNW5YESHo07X0=";
   release."4.5.2".sha256 = "sha256-r0yE9pkC4EYlqsimxkdlCXevRcwKa3HGFZiUH+ueUY8=";
   release."4.5.1".sha256 = "sha256-5OxbSPdw/1FFENubulKSk6fEIEYSPCxfvMMgtgN6j6s=";
diff --git a/pkgs/development/coq-modules/mathcomp-analysis/default.nix b/pkgs/development/coq-modules/mathcomp-analysis/default.nix
index e4f198695f34..27825c0564e6 100644
--- a/pkgs/development/coq-modules/mathcomp-analysis/default.nix
+++ b/pkgs/development/coq-modules/mathcomp-analysis/default.nix
@@ -26,10 +26,10 @@ let
   defaultVersion = with versions; lib.switch [ coq.version mathcomp.version ]  [
       { cases = [ (isGe "8.14") (isGe "1.13.0") ];               out = "0.6.1"; }
       { cases = [ (isGe "8.14") (range "1.13" "1.15") ];         out = "0.5.2"; }
-      { cases = [ (isGe "8.13") (range "1.13" "1.14") ];         out = "0.5.1"; }
+      { cases = [ (range "8.13" "8.15") (range "1.13" "1.14") ]; out = "0.5.1"; }
       { cases = [ (range "8.13" "8.15") (range "1.12" "1.14") ]; out = "0.3.13"; }
-      { cases = [ (range "8.11" "8.14") (isGe "1.12.0") ];       out = "0.3.10"; }
-      { cases = [ (range "8.11" "8.13") "1.11.0" ];              out = "0.3.4"; }
+      { cases = [ (range "8.11" "8.14") (range "1.12" "1.13") ]; out = "0.3.10"; }
+      { cases = [ (range "8.11" "8.12") "1.11.0" ];              out = "0.3.4"; }
       { cases = [ (range "8.10" "8.12") "1.11.0" ];              out = "0.3.3"; }
       { cases = [ (range "8.10" "8.11") "1.11.0" ];              out = "0.3.1"; }
       { cases = [ (range "8.8"  "8.11") (range "1.8" "1.10") ];  out = "0.2.3"; }
diff --git a/pkgs/development/coq-modules/mathcomp-bigenough/default.nix b/pkgs/development/coq-modules/mathcomp-bigenough/default.nix
index a4e4a1ecbb5c..97e66705998a 100644
--- a/pkgs/development/coq-modules/mathcomp-bigenough/default.nix
+++ b/pkgs/development/coq-modules/mathcomp-bigenough/default.nix
@@ -12,7 +12,7 @@ mkCoqDerivation {
   };
   inherit version;
   defaultVersion = with lib.versions; lib.switch coq.version [
-    { case = range "8.10" "8.16"; out = "1.0.1"; }
+    { case = range "8.10" "8.17"; out = "1.0.1"; }
     { case = range "8.5"  "8.14"; out = "1.0.0"; }
   ] null;
 
diff --git a/pkgs/development/coq-modules/mathcomp-finmap/default.nix b/pkgs/development/coq-modules/mathcomp-finmap/default.nix
index 551d33c9fadf..749fbb70b80f 100644
--- a/pkgs/development/coq-modules/mathcomp-finmap/default.nix
+++ b/pkgs/development/coq-modules/mathcomp-finmap/default.nix
@@ -7,7 +7,7 @@ mkCoqDerivation {
   owner = "math-comp";
   inherit version;
   defaultVersion = with lib.versions; lib.switch [ coq.version mathcomp.version ]  [
-      { cases = [ (range "8.13" "8.16")  (isGe "1.12") ];         out = "1.5.2"; }
+      { cases = [ (range "8.13" "8.17")  (isGe "1.12") ];         out = "1.5.2"; }
       { cases = [ (isGe "8.10")          (isGe "1.11") ];         out = "1.5.1"; }
       { cases = [ (range "8.7" "8.11")   "1.11.0" ];              out = "1.5.0"; }
       { cases = [ (isEq "8.11")          (range "1.8" "1.10") ];  out = "1.4.0+coq-8.11"; }
diff --git a/pkgs/development/coq-modules/mathcomp-real-closed/default.nix b/pkgs/development/coq-modules/mathcomp-real-closed/default.nix
index b114a3f290d3..cbc6b8cc7115 100644
--- a/pkgs/development/coq-modules/mathcomp-real-closed/default.nix
+++ b/pkgs/development/coq-modules/mathcomp-real-closed/default.nix
@@ -8,6 +8,7 @@ mkCoqDerivation {
   owner = "math-comp";
   inherit version;
   release = {
+    "1.1.4".sha256 = "sha256-8Hs6XfowbpeRD8RhMRf4ZJe2xf8kE0e8m7bPUzR/IM4=";
     "1.1.3".sha256 = "1vwmmnzy8i4f203i2s60dn9i0kr27lsmwlqlyyzdpsghvbr8h5b7";
     "1.1.2".sha256 = "0907x4nf7nnvn764q3x9lx41g74rilvq5cki5ziwgpsdgb98pppn";
     "1.1.1".sha256 = "0ksjscrgq1i79vys4zrmgvzy2y4ylxa8wdsf4kih63apw6v5ws6b";
@@ -18,6 +19,7 @@ mkCoqDerivation {
   };
 
   defaultVersion = with lib.versions; lib.switch [ coq.version mathcomp.version ]  [
+      { cases = [ (isGe "8.13")  (isGe "1.13.0") ]; out = "1.1.4"; }
       { cases = [ (isGe "8.13")  (isGe "1.12.0") ]; out = "1.1.3"; }
       { cases = [ (isGe "8.10")  (isGe "1.12.0") ]; out = "1.1.2"; }
       { cases = [ (isGe "8.7")   "1.11.0" ]; out = "1.1.1"; }
diff --git a/pkgs/development/coq-modules/mathcomp-zify/default.nix b/pkgs/development/coq-modules/mathcomp-zify/default.nix
index 86dd239ebf73..3ea784714653 100644
--- a/pkgs/development/coq-modules/mathcomp-zify/default.nix
+++ b/pkgs/development/coq-modules/mathcomp-zify/default.nix
@@ -9,11 +9,13 @@ mkCoqDerivation rec {
 
   defaultVersion = with lib.versions;
      lib.switch [ coq.coq-version mathcomp-algebra.version ] [
+       { cases = [ (range "8.13" "8.17") (isGe "1.12") ]; out = "1.3.0+1.12+8.13"; }
        { cases = [ (range "8.13" "8.16") (isGe "1.12") ]; out = "1.1.0+1.12+8.13"; }
      ] null;
 
   release."1.0.0+1.12+8.13".sha256 = "1j533vx6lacr89bj1bf15l1a0s7rvrx4l00wyjv99aczkfbz6h6k";
   release."1.1.0+1.12+8.13".sha256 = "1plf4v6q5j7wvmd5gsqlpiy0vwlw6hy5daq2x42gqny23w9mi2pr";
+  release."1.3.0+1.12+8.13".sha256 = "sha256-ebfY8HatP4te44M6o84DSLpDCkMu4IroPCy+HqzOnTE=";
 
   propagatedBuildInputs = [ mathcomp-algebra mathcomp-ssreflect mathcomp-fingroup ];
 
diff --git a/pkgs/development/coq-modules/mathcomp/default.nix b/pkgs/development/coq-modules/mathcomp/default.nix
index 031536b7a6ef..ac94c3159ba2 100644
--- a/pkgs/development/coq-modules/mathcomp/default.nix
+++ b/pkgs/development/coq-modules/mathcomp/default.nix
@@ -19,6 +19,7 @@ let
   owner = "math-comp";
   withDoc = single && (args.withDoc or false);
   defaultVersion = with versions; lib.switch coq.coq-version [
+      { case = range "8.13" "8.17"; out = "1.16.0"; }
       { case = range "8.14" "8.16"; out = "1.15.0"; }
       { case = range "8.11" "8.15"; out = "1.14.0"; }
       { case = range "8.11" "8.15"; out = "1.13.0"; }
@@ -31,6 +32,7 @@ let
       { case = range "8.5" "8.7";   out = "1.6.4";  }
     ] null;
   release = {
+    "1.16.0".sha256 = "sha256-gXTKhRgSGeRBUnwdDezMsMKbOvxdffT+kViZ9e1gEz0=";
     "1.15.0".sha256 = "1bp0jxl35ms54s0mdqky15w9af03f3i0n06qk12k4gw1xzvwqv21";
     "1.14.0".sha256 = "07yamlp1c0g5nahkd2gpfhammcca74ga2s6qr7a3wm6y6j5pivk9";
     "1.13.0".sha256 = "0j4cz2y1r1aw79snkcf1pmicgzf8swbaf9ippz0vg99a572zqzri";
diff --git a/pkgs/development/coq-modules/multinomials/default.nix b/pkgs/development/coq-modules/multinomials/default.nix
index 19c6015ce928..24ca5f77cf3b 100644
--- a/pkgs/development/coq-modules/multinomials/default.nix
+++ b/pkgs/development/coq-modules/multinomials/default.nix
@@ -9,7 +9,8 @@
 
   inherit version;
   defaultVersion =  with lib.versions; lib.switch [ coq.version mathcomp.version ] [
-      { cases = [ (isGe "8.10") (isGe "1.12.0") ];      out = "1.5.5"; }
+      { cases = [ (isGe "8.10") (isGe "1.13.0") ];      out = "1.5.6"; }
+      { cases = [ (range "8.10" "8.16") (range "1.12.0" "1.15.0") ]; out = "1.5.5"; }
       { cases = [ (range "8.10" "8.12") "1.12.0" ];             out = "1.5.3"; }
       { cases = [ (range "8.7" "8.12")  "1.11.0" ];             out = "1.5.2"; }
       { cases = [ (range "8.7" "8.11")  (range "1.8" "1.10") ]; out = "1.5.0"; }
@@ -17,6 +18,7 @@
       { cases = [ "8.6"                 (range "1.6" "1.7") ];  out = "1.1"; }
     ] null;
   release = {
+    "1.5.6".sha256 = "sha256-cMixgc34T9Ic6v+tYmL49QUNpZpPV5ofaNuHqblX6oY=";
     "1.5.5".sha256 = "sha256-VdXA51vr7DZl/wT/15YYMywdD7Gh91dMP9t7ij47qNQ=";
     "1.5.4".sha256 = "0s4sbh4y88l125hdxahr56325hdhxxdmqmrz7vv8524llyv3fciq";
     "1.5.3".sha256 = "1462x40y2qydjd2wcg8r6qr8cx3xv4ixzh2h8vp9h7arylkja1qd";
diff --git a/pkgs/development/embedded/platformio/core.nix b/pkgs/development/embedded/platformio/core.nix
index 61a09e047344..00ee07a5fc5b 100644
--- a/pkgs/development/embedded/platformio/core.nix
+++ b/pkgs/development/embedded/platformio/core.nix
@@ -21,10 +21,11 @@ with python3.pkgs; buildPythonApplication rec {
       --subst-var-by SPDX_LICENSE_LIST_DATA '${spdx-license-list-data.json}'
 
     substituteInPlace setup.py \
-      --replace 'uvicorn==%s" % ("0.16.0" if PY36 else "0.19.*")' 'uvicorn>=0.16"' \
-      --replace 'starlette==%s" % ("0.19.1" if PY36 else "0.21.*")' 'starlette>=0.19.1"' \
+      --replace 'aiofiles==%s" % ("0.8.0" if PY36 else "22.1.*")' 'aiofiles"' \
+      --replace 'starlette==%s" % ("0.19.1" if PY36 else "0.23.*")' 'starlette"' \
+      --replace 'uvicorn==%s" % ("0.16.0" if PY36 else "0.20.*")' 'uvicorn"' \
       --replace 'tabulate==%s" % ("0.8.10" if PY36 else "0.9.*")' 'tabulate>=0.8.10,<=0.9"' \
-      --replace 'wsproto==' 'wsproto>='
+      --replace 'wsproto==%s" % ("1.0.0" if PY36 else "1.2.*")' 'wsproto"'
   '';
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/haskell-modules/configuration-nix.nix b/pkgs/development/haskell-modules/configuration-nix.nix
index 92dd0d665d9b..320b33277270 100644
--- a/pkgs/development/haskell-modules/configuration-nix.nix
+++ b/pkgs/development/haskell-modules/configuration-nix.nix
@@ -879,17 +879,17 @@ self: super: builtins.intersectAttrs super {
   domaindriven-core = dontCheck super.domaindriven-core;
 
   cachix = overrideCabal (drv: {
-    version = "1.3";
+    version = "1.3.1";
     src = pkgs.fetchFromGitHub {
       owner = "cachix";
       repo = "cachix";
-      rev = "v1.3";
-      sha256 = "sha256-y0CqfFIWd2nl1o2XvskHfaQRg8qqRZf16BYLAqJ+Q2Q=";
+      rev = "v1.3.1";
+      sha256 = "sha256-fYQrAgxEMdtMAYadff9Hg4MAh0PSfGPiYw5Z4BrvgFU=";
     };
     buildDepends = [ self.conduit-concurrent-map ];
     postUnpack = "sourceRoot=$sourceRoot/cachix";
     postPatch = ''
-      sed -i 's/1.2/1.3/' cachix.cabal
+      sed -i 's/1.3/1.3.1/' cachix.cabal
     '';
   }) (super.cachix.override {
     nix = self.hercules-ci-cnix-store.passthru.nixPackage;
@@ -897,12 +897,12 @@ self: super: builtins.intersectAttrs super {
     hnix-store-core = super.hnix-store-core_0_6_1_0;
   });
   cachix-api = overrideCabal (drv: {
-    version = "1.3";
+    version = "1.3.1";
     src = pkgs.fetchFromGitHub {
       owner = "cachix";
       repo = "cachix";
-      rev = "v1.3";
-      sha256 = "sha256-y0CqfFIWd2nl1o2XvskHfaQRg8qqRZf16BYLAqJ+Q2Q=";
+      rev = "v1.3.1";
+      sha256 = "sha256-fYQrAgxEMdtMAYadff9Hg4MAh0PSfGPiYw5Z4BrvgFU=";
     };
     postUnpack = "sourceRoot=$sourceRoot/cachix-api";
   }) super.cachix-api;
diff --git a/pkgs/development/interpreters/erlang/R25.nix b/pkgs/development/interpreters/erlang/R25.nix
index 991880bc31e5..16481441ccc8 100644
--- a/pkgs/development/interpreters/erlang/R25.nix
+++ b/pkgs/development/interpreters/erlang/R25.nix
@@ -1,6 +1,6 @@
 { mkDerivation }:
 
 mkDerivation {
-  version = "25.2.3";
-  sha256 = "peTH8hDOEuMq18exbFhtEMrQQEqg2FPkapfNnnEfTYE=";
+  version = "25.3";
+  sha256 = "UOBrDaXpvpeM79VN0PxVQ1XsYI+OYWBbaBfYE5lZXgE=";
 }
diff --git a/pkgs/development/libraries/hunspell/dictionaries.nix b/pkgs/development/libraries/hunspell/dictionaries.nix
index 09d68fa0199d..17c73c118cec 100644
--- a/pkgs/development/libraries/hunspell/dictionaries.nix
+++ b/pkgs/development/libraries/hunspell/dictionaries.nix
@@ -29,14 +29,14 @@ let
     { shortName, shortDescription, dictFileName }:
     mkDict rec {
       inherit dictFileName;
-      version = "2.2";
+      version = "2.5";
       pname = "hunspell-dict-${shortName}-rla";
       readmeFile = "README.txt";
       src = fetchFromGitHub {
         owner = "sbosio";
         repo = "rla-es";
         rev = "v${version}";
-        sha256 = "0n9ms092k7vg7xpd3ksadxydbrizkb7js7dfxr08nbnnb9fgy0i8";
+        sha256 = "sha256-oGnxOGHzDogzUMZESydIxRTbq9Dmd03flwHx16AK1yk=";
       };
       meta = with lib; {
         description = "Hunspell dictionary for ${shortDescription} from rla";
@@ -46,13 +46,13 @@ let
         platforms = platforms.all;
       };
       nativeBuildInputs = [ bash coreutils which zip unzip ];
-      patchPhase = ''
+      postPatch = ''
         substituteInPlace ortograf/herramientas/make_dict.sh \
-           --replace /bin/bash bash \
+           --replace /bin/bash ${bash}/bin/bash \
            --replace /dev/stderr stderr.log
 
         substituteInPlace ortograf/herramientas/remover_comentarios.sh \
-           --replace /bin/bash bash \
+           --replace /bin/bash ${bash}/bin/bash \
       '';
       buildPhase = ''
         cd ortograf/herramientas
@@ -442,7 +442,7 @@ rec {
   es_CR = es-cr;
   es-cr = mkDictFromRla {
     shortName = "es-cr";
-    shortDescription = "Spanish (Costra Rica)";
+    shortDescription = "Spanish (Costa Rica)";
     dictFileName = "es_CR";
   };
 
diff --git a/pkgs/development/ocaml-modules/awa/default.nix b/pkgs/development/ocaml-modules/awa/default.nix
index fd0bf82df343..e8ff5df1a9e5 100644
--- a/pkgs/development/ocaml-modules/awa/default.nix
+++ b/pkgs/development/ocaml-modules/awa/default.nix
@@ -8,14 +8,14 @@
 
 buildDunePackage rec {
   pname = "awa";
-  version = "0.1.1";
+  version = "0.1.2";
 
   minimalOCamlVersion = "4.08";
   duneVersion = "3";
 
   src = fetchurl {
     url = "https://github.com/mirage/awa-ssh/releases/download/v${version}/awa-${version}.tbz";
-    hash = "sha256-ae1gTx3Emmkof/2Gnhq0d5RyfkFx21hHkVEVgyPdXuo=";
+    hash = "sha256-HfIqvmvmdizPSfSHthj2syszVZXVhju7tI8yNEetc38=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/ocaml-modules/conduit/default.nix b/pkgs/development/ocaml-modules/conduit/default.nix
index 99f3df493396..ada502aaf0cb 100644
--- a/pkgs/development/ocaml-modules/conduit/default.nix
+++ b/pkgs/development/ocaml-modules/conduit/default.nix
@@ -5,14 +5,14 @@
 
 buildDunePackage rec {
   pname = "conduit";
-  version = "6.1.0";
+  version = "6.2.0";
 
   minimalOCamlVersion = "4.08";
   duneVersion = "3";
 
   src = fetchurl {
     url = "https://github.com/mirage/ocaml-conduit/releases/download/v${version}/conduit-${version}.tbz";
-    sha256 = "sha256-ouKQiGMLvvksGpAhkqCVSKtKaz91p+7mciQm7KHvwF8=";
+    sha256 = "sha256-PtRAsO3aGyEt12K9skgx85TcoFmF3RtKxPlFgdFFI5Q=";
   };
 
   propagatedBuildInputs = [ astring ipaddr ipaddr-sexp sexplib uri ppx_sexp_conv ];
diff --git a/pkgs/development/ocaml-modules/conduit/mirage.nix b/pkgs/development/ocaml-modules/conduit/mirage.nix
index 09c7df5edab6..9123c235dd3a 100644
--- a/pkgs/development/ocaml-modules/conduit/mirage.nix
+++ b/pkgs/development/ocaml-modules/conduit/mirage.nix
@@ -1,7 +1,7 @@
 { buildDunePackage, conduit-lwt
 , ppx_sexp_conv, sexplib, uri, cstruct, mirage-flow
 , mirage-flow-combinators, mirage-random, mirage-time, mirage-clock
-, dns-client, vchan, xenstore, tls, tls-mirage, ipaddr, ipaddr-sexp
+, dns-client-mirage, vchan, xenstore, tls, tls-mirage, ipaddr, ipaddr-sexp
 , tcpip, ca-certs-nss
 }:
 
@@ -16,7 +16,7 @@ buildDunePackage {
   propagatedBuildInputs = [
     sexplib uri cstruct mirage-clock mirage-flow
     mirage-flow-combinators mirage-random mirage-time
-    dns-client conduit-lwt vchan xenstore tls tls-mirage
+    dns-client-mirage conduit-lwt vchan xenstore tls tls-mirage
     ipaddr ipaddr-sexp tcpip ca-certs-nss
   ];
 
diff --git a/pkgs/development/ocaml-modules/dns/cli.nix b/pkgs/development/ocaml-modules/dns/cli.nix
index 6e23eeecba97..8c1ff57bc9b3 100644
--- a/pkgs/development/ocaml-modules/dns/cli.nix
+++ b/pkgs/development/ocaml-modules/dns/cli.nix
@@ -1,4 +1,4 @@
-{ buildDunePackage, dns, dns-tsig, dns-client, dns-server, dns-certify, dnssec
+{ buildDunePackage, dns, dns-tsig, dns-client-lwt, dns-server, dns-certify, dnssec
 , bos, cmdliner, fpath, x509, mirage-crypto, mirage-crypto-pk
 , mirage-crypto-rng, hex, ptime, mtime, logs, fmt, ipaddr, lwt
 , randomconv, alcotest
@@ -17,7 +17,7 @@ buildDunePackage {
   buildInputs = [
     dns
     dns-tsig
-    dns-client
+    dns-client-lwt
     dns-server
     dns-certify
     dnssec
diff --git a/pkgs/development/ocaml-modules/dns/client-lwt.nix b/pkgs/development/ocaml-modules/dns/client-lwt.nix
new file mode 100644
index 000000000000..f17b8ed0759c
--- /dev/null
+++ b/pkgs/development/ocaml-modules/dns/client-lwt.nix
@@ -0,0 +1,30 @@
+{ lib, buildDunePackage, dns, dns-client, lwt, mirage-clock, mirage-time
+, mirage-random, mirage-crypto-rng, mtime, randomconv
+, cstruct, fmt, logs, rresult, domain-name, ipaddr, alcotest
+, ca-certs, ca-certs-nss
+, happy-eyeballs
+, tcpip
+, tls-lwt
+}:
+
+buildDunePackage {
+  pname = "dns-client-lwt";
+  inherit (dns) src version;
+  duneVersion = "3";
+
+  propagatedBuildInputs = [
+    dns
+    dns-client
+    ipaddr
+    lwt
+    ca-certs
+    happy-eyeballs
+    tls-lwt
+    mtime
+    mirage-crypto-rng
+  ];
+  checkInputs = [ alcotest ];
+  doCheck = true;
+
+  meta = dns-client.meta;
+}
diff --git a/pkgs/development/ocaml-modules/dns/client-mirage.nix b/pkgs/development/ocaml-modules/dns/client-mirage.nix
new file mode 100644
index 000000000000..2e0768d2b7ca
--- /dev/null
+++ b/pkgs/development/ocaml-modules/dns/client-mirage.nix
@@ -0,0 +1,32 @@
+{ lib, buildDunePackage, dns, dns-client, lwt, mirage-clock, mirage-time
+, mirage-random, mirage-crypto-rng, mtime, randomconv
+, cstruct, fmt, logs, rresult, domain-name, ipaddr, alcotest
+, ca-certs, ca-certs-nss
+, happy-eyeballs
+, tcpip
+, tls, tls-mirage
+}:
+
+buildDunePackage {
+  pname = "dns-client-mirage";
+  inherit (dns) src version;
+  duneVersion = "3";
+
+  propagatedBuildInputs = [
+    dns-client
+    domain-name
+    ipaddr
+    lwt
+    mirage-random
+    mirage-time
+    mirage-clock
+    ca-certs-nss
+    happy-eyeballs
+    tcpip
+    tls
+    tls-mirage
+  ];
+  doCheck = true;
+
+  meta = dns-client.meta;
+}
diff --git a/pkgs/development/ocaml-modules/dns/client.nix b/pkgs/development/ocaml-modules/dns/client.nix
index e8bd210dcd8c..bc859945e4e9 100644
--- a/pkgs/development/ocaml-modules/dns/client.nix
+++ b/pkgs/development/ocaml-modules/dns/client.nix
@@ -13,23 +13,9 @@ buildDunePackage {
   duneVersion = "3";
 
   propagatedBuildInputs = [
-    cstruct
-    fmt
-    logs
     dns
     randomconv
     domain-name
-    ipaddr
-    lwt
-    mirage-random
-    mirage-time
-    mirage-clock
-    ca-certs
-    ca-certs-nss
-    happy-eyeballs
-    tcpip
-    tls
-    tls-mirage
     mtime
     mirage-crypto-rng
   ];
diff --git a/pkgs/development/ocaml-modules/dns/default.nix b/pkgs/development/ocaml-modules/dns/default.nix
index 81bc741d974b..9012b9d8214e 100644
--- a/pkgs/development/ocaml-modules/dns/default.nix
+++ b/pkgs/development/ocaml-modules/dns/default.nix
@@ -17,14 +17,14 @@
 
 buildDunePackage rec {
   pname = "dns";
-  version = "6.4.1";
+  version = "7.0.1";
 
   minimalOCamlVersion = "4.08";
   duneVersion = "3";
 
   src = fetchurl {
     url = "https://github.com/mirage/ocaml-dns/releases/download/v${version}/dns-${version}.tbz";
-    hash = "sha256-omG0fKZAHGc+4ERC8cyK47jeEkiBZkB+1fz46j6SDno=";
+    hash = "sha256-vDe1U1NbbIPcD1AmMG265ke7651C64mds7KcFHUN4fU=";
   };
 
   propagatedBuildInputs = [ fmt logs ptime domain-name gmap cstruct ipaddr lru duration metrics base64 ];
diff --git a/pkgs/development/ocaml-modules/dns/stub.nix b/pkgs/development/ocaml-modules/dns/stub.nix
index 943d28a57c5b..343f4925b18f 100644
--- a/pkgs/development/ocaml-modules/dns/stub.nix
+++ b/pkgs/development/ocaml-modules/dns/stub.nix
@@ -1,4 +1,4 @@
-{ buildDunePackage, dns, dns-client, dns-mirage, dns-resolver, dns-tsig
+{ buildDunePackage, dns, dns-client-mirage, dns-mirage, dns-resolver, dns-tsig
 , dns-server, duration, randomconv, lwt, mirage-time, mirage-clock
 , mirage-random, tcpip, metrics
 }:
@@ -11,7 +11,7 @@ buildDunePackage {
 
   propagatedBuildInputs = [
     dns
-    dns-client
+    dns-client-mirage
     dns-mirage
     dns-resolver
     dns-tsig
diff --git a/pkgs/development/ocaml-modules/git/unix.nix b/pkgs/development/ocaml-modules/git/unix.nix
index f5e8337382e4..680c77dfa39e 100644
--- a/pkgs/development/ocaml-modules/git/unix.nix
+++ b/pkgs/development/ocaml-modules/git/unix.nix
@@ -1,4 +1,4 @@
-{ buildDunePackage, git
+{ buildDunePackage, fetchpatch, git
 , rresult, result, bigstringaf
 , fmt, bos, fpath, uri, digestif, logs, lwt
 , mirage-clock, mirage-clock-unix, astring, awa, cmdliner
@@ -14,6 +14,13 @@ buildDunePackage {
   pname = "git-unix";
   inherit (git) version src;
 
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/mirage/ocaml-git/commit/b708db8319cc456a5640618210d740a1e00468e9.patch";
+      hash = "sha256-Fe+eDhU/beZT/8br8XmOhHYJowaVEha16eGqyuu2Zr4=";
+    })
+  ];
+
   minimalOCamlVersion = "4.08";
   duneVersion = "3";
 
diff --git a/pkgs/development/ocaml-modules/happy-eyeballs/default.nix b/pkgs/development/ocaml-modules/happy-eyeballs/default.nix
index a3a2a3cff1f9..b70c6af0f8e0 100644
--- a/pkgs/development/ocaml-modules/happy-eyeballs/default.nix
+++ b/pkgs/development/ocaml-modules/happy-eyeballs/default.nix
@@ -4,13 +4,13 @@
 
 buildDunePackage rec {
   pname = "happy-eyeballs";
-  version = "0.4.0";
+  version = "0.5.0";
 
   minimalOCamlVersion = "4.08";
 
   src = fetchurl {
     url = "https://github.com/roburio/happy-eyeballs/releases/download/v${version}/happy-eyeballs-${version}.tbz";
-    hash = "sha256-gR9q4J/DnYJz8oYmk/wy17h4F6wxbllba/gkor5i1nQ=";
+    hash = "sha256-T4BOFlSj3xfUFhP9v8UaCHgmhvGrMyeqNUQf79bdBh4=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/ocaml-modules/happy-eyeballs/lwt.nix b/pkgs/development/ocaml-modules/happy-eyeballs/lwt.nix
index 50f1f9455739..6d2ef3b80571 100644
--- a/pkgs/development/ocaml-modules/happy-eyeballs/lwt.nix
+++ b/pkgs/development/ocaml-modules/happy-eyeballs/lwt.nix
@@ -1,7 +1,7 @@
 { buildDunePackage
 , happy-eyeballs
 , cmdliner
-, dns-client
+, dns-client-lwt
 , duration
 , domain-name
 , ipaddr
@@ -29,7 +29,7 @@ buildDunePackage {
   ];
 
   propagatedBuildInputs = [
-    dns-client
+    dns-client-lwt
     happy-eyeballs
     logs
     lwt
diff --git a/pkgs/development/ocaml-modules/happy-eyeballs/mirage.nix b/pkgs/development/ocaml-modules/happy-eyeballs/mirage.nix
index eb15706efac9..bc3341a422f8 100644
--- a/pkgs/development/ocaml-modules/happy-eyeballs/mirage.nix
+++ b/pkgs/development/ocaml-modules/happy-eyeballs/mirage.nix
@@ -1,7 +1,7 @@
 { buildDunePackage
 , happy-eyeballs
 , duration
-, dns-client
+, dns-client-mirage
 , domain-name
 , ipaddr
 , fmt
@@ -32,7 +32,7 @@ buildDunePackage {
   ];
 
   propagatedBuildInputs = [
-    dns-client
+    dns-client-mirage
     happy-eyeballs
     logs
     lwt
diff --git a/pkgs/development/ocaml-modules/letsencrypt/default.nix b/pkgs/development/ocaml-modules/letsencrypt/default.nix
index 13875147a4e5..9fdff45b6a54 100644
--- a/pkgs/development/ocaml-modules/letsencrypt/default.nix
+++ b/pkgs/development/ocaml-modules/letsencrypt/default.nix
@@ -21,11 +21,11 @@
 
 buildDunePackage rec {
   pname = "letsencrypt";
-  version = "0.4.1";
+  version = "0.5.0";
 
   src = fetchurl {
-    url = "https://github.com/mmaker/ocaml-letsencrypt/releases/download/v${version}/letsencrypt-v${version}.tbz";
-    hash = "sha256-+Qh19cm9yrTIvl7H6+nqdjAw+nCOAoVzAJlrsW58IHA=";
+    url = "https://github.com/mmaker/ocaml-letsencrypt/releases/download/v${version}/letsencrypt-${version}.tbz";
+    hash = "sha256-XGroZiNyP0ItOMrXK07nrVqT4Yz9RKXYvZuRkDp089M=";
   };
 
   minimalOCamlVersion = "4.08";
diff --git a/pkgs/development/ocaml-modules/mirage-crypto/default.nix b/pkgs/development/ocaml-modules/mirage-crypto/default.nix
index d5f110948dc9..816709b4cc78 100644
--- a/pkgs/development/ocaml-modules/mirage-crypto/default.nix
+++ b/pkgs/development/ocaml-modules/mirage-crypto/default.nix
@@ -7,11 +7,11 @@ buildDunePackage rec {
   minimalOCamlVersion = "4.08";
 
   pname = "mirage-crypto";
-  version = "0.10.7";
+  version = "0.11.0";
 
   src = fetchurl {
     url = "https://github.com/mirage/mirage-crypto/releases/download/v${version}/mirage-crypto-${version}.tbz";
-    sha256 = "sha256-PoGKdgwjXFtoTHtrQ7HN0qfdBOAQW2gNUk+DbrmIppw=";
+    sha256 = "sha256-A5SCuVmcIJo3dL0Tu//fQqEV0v3FuCxuANWnBo7hUeQ=";
   };
 
   doCheck = true;
diff --git a/pkgs/development/ocaml-modules/mirage-crypto/rng-lwt.nix b/pkgs/development/ocaml-modules/mirage-crypto/rng-lwt.nix
new file mode 100644
index 000000000000..f6ec2a9e3dae
--- /dev/null
+++ b/pkgs/development/ocaml-modules/mirage-crypto/rng-lwt.nix
@@ -0,0 +1,15 @@
+{ buildDunePackage, mirage-crypto, mirage-crypto-rng, dune-configurator
+, duration, logs, mtime, ocaml_lwt }:
+
+buildDunePackage rec {
+  pname = "mirage-crypto-rng-lwt";
+
+  inherit (mirage-crypto) version src;
+
+  doCheck = true;
+
+  buildInputs = [ dune-configurator ];
+  propagatedBuildInputs = [ mirage-crypto mirage-crypto-rng duration logs mtime ocaml_lwt ];
+
+  meta = mirage-crypto-rng.meta;
+}
diff --git a/pkgs/development/ocaml-modules/mirage-crypto/rng.nix b/pkgs/development/ocaml-modules/mirage-crypto/rng.nix
index 044b8ed27b82..97de946bc2cc 100644
--- a/pkgs/development/ocaml-modules/mirage-crypto/rng.nix
+++ b/pkgs/development/ocaml-modules/mirage-crypto/rng.nix
@@ -10,7 +10,7 @@ buildDunePackage rec {
   checkInputs = [ ounit2 randomconv ];
 
   buildInputs = [ dune-configurator ];
-  propagatedBuildInputs = [ cstruct mirage-crypto duration logs mtime ocaml_lwt ];
+  propagatedBuildInputs = [ cstruct mirage-crypto duration logs mtime ];
 
   strictDeps = true;
 
diff --git a/pkgs/development/ocaml-modules/paf/cohttp.nix b/pkgs/development/ocaml-modules/paf/cohttp.nix
index 2f2891493061..e7e0273e5234 100644
--- a/pkgs/development/ocaml-modules/paf/cohttp.nix
+++ b/pkgs/development/ocaml-modules/paf/cohttp.nix
@@ -22,6 +22,7 @@ buildDunePackage {
   inherit (paf)
     version
     src
+    patches
     ;
 
   duneVersion = "3";
diff --git a/pkgs/development/ocaml-modules/paf/default.nix b/pkgs/development/ocaml-modules/paf/default.nix
index 974c981f57c6..6345499ca283 100644
--- a/pkgs/development/ocaml-modules/paf/default.nix
+++ b/pkgs/development/ocaml-modules/paf/default.nix
@@ -32,6 +32,14 @@ buildDunePackage rec {
     hash = "sha256-ux8fk4XDdih4Ua9NGOJVSuPseJBPv6+6ND/esHrluQE=";
   };
 
+  patches = [
+    # Compatibility with mirage-crypto 0.11.0
+    (fetchpatch {
+      url = "https://github.com/dinosaure/paf-le-chien/commit/2f308c1c4d3ff49d42136f8ff86a4385661e4d1b.patch";
+      hash = "sha256-jmSeUpoRoUMPUNEH3Av2LxgRZs+eAectK+CpoH+SdpY=";
+    })
+  ];
+
   minimalOCamlVersion = "4.08";
   duneVersion = "3";
 
diff --git a/pkgs/development/ocaml-modules/paf/le.nix b/pkgs/development/ocaml-modules/paf/le.nix
index 429cd0a4d8d7..a31575d4690b 100644
--- a/pkgs/development/ocaml-modules/paf/le.nix
+++ b/pkgs/development/ocaml-modules/paf/le.nix
@@ -1,7 +1,7 @@
 { lib
 , buildDunePackage
 , paf
-, dns-client
+, dns-client-mirage
 , duration
 , emile
 , httpaf
@@ -18,13 +18,14 @@ buildDunePackage {
   inherit (paf)
     version
     src
+    patches
   ;
 
   duneVersion = "3";
 
   propagatedBuildInputs = [
     paf
-    dns-client
+    dns-client-mirage
     duration
     emile
     httpaf
diff --git a/pkgs/development/ocaml-modules/tls/default.nix b/pkgs/development/ocaml-modules/tls/default.nix
index b68edba2728e..18506b611f2a 100644
--- a/pkgs/development/ocaml-modules/tls/default.nix
+++ b/pkgs/development/ocaml-modules/tls/default.nix
@@ -6,11 +6,11 @@
 
 buildDunePackage rec {
   pname = "tls";
-  version = "0.15.4";
+  version = "0.16.0";
 
   src = fetchurl {
     url = "https://github.com/mirleft/ocaml-tls/releases/download/v${version}/tls-${version}.tbz";
-    sha256 = "sha256-X40dVrBvYGnv0dCj3gxFy0iNPRPrfxMshOx7o/DRw4I=";
+    sha256 = "sha256-uvIDZLNy6E/ce7YmzUUVaOeGRaHqPSUzuEPQDMu09tM=";
   };
 
   minimalOCamlVersion = "4.08";
diff --git a/pkgs/development/ocaml-modules/tls/lwt.nix b/pkgs/development/ocaml-modules/tls/lwt.nix
new file mode 100644
index 000000000000..90eefa4347e0
--- /dev/null
+++ b/pkgs/development/ocaml-modules/tls/lwt.nix
@@ -0,0 +1,19 @@
+{ lib, buildDunePackage, tls, lwt, mirage-crypto-rng-lwt, cmdliner, x509 }:
+
+buildDunePackage rec {
+  pname = "tls-lwt";
+
+  inherit (tls) src meta version;
+
+  minimalOCamlVersion = "4.11";
+  duneVersion = "3";
+
+  doCheck = true;
+
+  propagatedBuildInputs = [
+    lwt
+    mirage-crypto-rng-lwt
+    tls
+    x509
+  ];
+}
diff --git a/pkgs/development/ocaml-modules/x509/default.nix b/pkgs/development/ocaml-modules/x509/default.nix
index bd7a7a0fa47c..76076039518c 100644
--- a/pkgs/development/ocaml-modules/x509/default.nix
+++ b/pkgs/development/ocaml-modules/x509/default.nix
@@ -8,13 +8,13 @@ buildDunePackage rec {
   minimalOCamlVersion = "4.08";
 
   pname = "x509";
-  version = "0.16.2";
+  version = "0.16.4";
 
   duneVersion = "3";
 
   src = fetchurl {
     url = "https://github.com/mirleft/ocaml-x509/releases/download/v${version}/x509-${version}.tbz";
-    hash = "sha256-Zf/ZZjUAkeWe04XLmqMKgbxN/qe/Z1mpKM82veXVf2I=";
+    hash = "sha256-XegxhdASQK/I7Xd0gJSLumTGbCYFpWsjR7PlZSWqaVo=";
   };
 
   checkInputs = [ alcotest cstruct-unix ];
diff --git a/pkgs/development/python-modules/agate-sql/default.nix b/pkgs/development/python-modules/agate-sql/default.nix
index 2470506a009f..2b5863d19837 100644
--- a/pkgs/development/python-modules/agate-sql/default.nix
+++ b/pkgs/development/python-modules/agate-sql/default.nix
@@ -27,6 +27,8 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "agatesql" ];
 
   meta = with lib; {
+    # https://github.com/wireservice/agate-sql/commit/74af1badd85408909ea72cb6ca8c0b223d178c6f
+    broken = lib.versionAtLeast sqlalchemy.version "2.0";
     description = "Adds SQL read/write support to agate.";
     homepage = "https://github.com/wireservice/agate-sql";
     license = with licenses; [ mit ];
diff --git a/pkgs/development/python-modules/argh/default.nix b/pkgs/development/python-modules/argh/default.nix
index e7d49ef69694..556d26b29f08 100644
--- a/pkgs/development/python-modules/argh/default.nix
+++ b/pkgs/development/python-modules/argh/default.nix
@@ -2,6 +2,7 @@
 , buildPythonPackage
 , fetchPypi
 , fetchpatch
+, flit-core
 , iocapture
 , mock
 , pytestCheckHook
@@ -10,12 +11,17 @@
 buildPythonPackage rec {
   pname = "argh";
   version = "0.28.1";
+  format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
     hash = "sha256-sgkwhvDoCaPswktkohRTCe6PVtA0k2zVnlfFWKNXMp0=";
   };
 
+  nativeBuildInputs = [
+    flit-core
+  ];
+
   nativeCheckInputs = [
     iocapture
     mock
diff --git a/pkgs/development/python-modules/drf-spectacular/default.nix b/pkgs/development/python-modules/drf-spectacular/default.nix
index 002cdad36c60..e7866a54ff88 100644
--- a/pkgs/development/python-modules/drf-spectacular/default.nix
+++ b/pkgs/development/python-modules/drf-spectacular/default.nix
@@ -28,13 +28,13 @@
 
 buildPythonPackage rec {
   pname = "drf-spectacular";
-  version = "0.24.2";
+  version = "0.26.0";
 
   src = fetchFromGitHub {
     owner = "tfranzel";
     repo = "drf-spectacular";
     rev = version;
-    hash = "sha256-WE+iOD3OjDByisHI9GgvjUUSpvOz+IYi/3Y8AmR7Eps=";
+    hash = "sha256-yq+aTkoHI3zSsrYjokbn5UoPm/43LCnyTqdFtkrU92M=";
   };
 
   propagatedBuildInputs = [
@@ -76,6 +76,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Sane and flexible OpenAPI 3 schema generation for Django REST framework";
     homepage = "https://github.com/tfranzel/drf-spectacular";
+    changelog = "https://github.com/tfranzel/drf-spectacular/releases/tag/${version}";
     license = licenses.bsd3;
     maintainers = with maintainers; [ SuperSandro2000 ];
   };
diff --git a/pkgs/development/python-modules/flask-migrate/default.nix b/pkgs/development/python-modules/flask-migrate/default.nix
index 470639835a3b..b6bdd4e8f373 100644
--- a/pkgs/development/python-modules/flask-migrate/default.nix
+++ b/pkgs/development/python-modules/flask-migrate/default.nix
@@ -7,21 +7,27 @@
 , flask_script
 , flask-sqlalchemy
 , pytestCheckHook
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "Flask-Migrate";
-  version = "4.0.2";
-  format = "setuptools";
+  version = "4.0.4";
+  format = "pyproject";
+
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "miguelgrinberg";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-6P5oIH/mVuMy4J71VIRD1p+qbvPUlq3COpytEgKz1qo=";
+    hash = "sha256-x52LGYvXuTUCP9dR3FP7a/xNRWyCAV1sReDAYJbYDvE=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     alembic
     flask
diff --git a/pkgs/development/python-modules/jaraco-net/default.nix b/pkgs/development/python-modules/jaraco-net/default.nix
index 468720780c88..164b46dd4f7f 100644
--- a/pkgs/development/python-modules/jaraco-net/default.nix
+++ b/pkgs/development/python-modules/jaraco-net/default.nix
@@ -24,6 +24,7 @@
 , pytestCheckHook
 , cherrypy
 , importlib-resources
+, pyparsing
 , requests-mock
 }:
 
@@ -75,6 +76,7 @@ buildPythonPackage rec {
     pytestCheckHook
     cherrypy
     importlib-resources
+    pyparsing
     requests-mock
   ];
 
diff --git a/pkgs/development/python-modules/measurement/default.nix b/pkgs/development/python-modules/measurement/default.nix
index 5650170c31f4..3323e8c198ff 100644
--- a/pkgs/development/python-modules/measurement/default.nix
+++ b/pkgs/development/python-modules/measurement/default.nix
@@ -1,9 +1,18 @@
-{ lib, fetchFromGitHub, buildPythonPackage, isPy3k
-, sympy, pytest, pytest-runner, sphinx, setuptools-scm }:
+{ lib
+, fetchFromGitHub
+, buildPythonPackage
+, isPy3k
+, flit-core
+, flit-scm
+, sympy
+, pytestCheckHook
+, sphinx
+}:
 
 buildPythonPackage rec {
   pname = "measurement";
   version = "3.2.2";
+  format = "pyproject";
 
   disabled = !isPy3k;
 
@@ -14,17 +23,31 @@ buildPythonPackage rec {
     hash = "sha256-ULId0W10FaAtSgVY5ctQL3FPETVr+oq6TKWd/W53viM=";
   };
 
+  nativeBuildInputs = [
+    flit-core
+    flit-scm
+    sphinx
+  ];
+
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
   postPatch = ''
-    sed -i 's|use_scm_version=True|version="${version}"|' setup.py
+    substituteInPlace pyproject.toml \
+      --replace "--cov=measurement" ""
   '';
 
-  nativeCheckInputs = [ pytest pytest-runner ];
-  nativeBuildInputs = [ sphinx setuptools-scm ];
-  propagatedBuildInputs = [ sympy ];
+  propagatedBuildInputs = [
+    sympy
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
 
   meta = with lib; {
     description = "Use and manipulate unit-aware measurement objects in Python";
     homepage = "https://github.com/coddingtonbear/python-measurement";
+    changelog = "https://github.com/coddingtonbear/python-measurement/releases/tag/${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ bhipple ];
   };
diff --git a/pkgs/development/python-modules/plum-py/default.nix b/pkgs/development/python-modules/plum-py/default.nix
index 701a36a36853..d6020cabc99f 100644
--- a/pkgs/development/python-modules/plum-py/default.nix
+++ b/pkgs/development/python-modules/plum-py/default.nix
@@ -1,4 +1,10 @@
-{ lib, buildPythonPackage, fetchFromGitLab, isPy3k, pytest, baseline }:
+{ lib
+, buildPythonPackage
+, fetchFromGitLab
+, isPy3k
+, pytestCheckHook
+, baseline
+}:
 
 buildPythonPackage rec {
   pname = "plum-py";
@@ -12,10 +18,21 @@ buildPythonPackage rec {
     hash = "sha256-jCZUNT1HpSr0khHsjnxEzN2LCzcDV6W27PjVkwFJHUg=";
   };
 
+  postPatch = ''
+    # Drop broken version specifier
+    sed -i "/python_requires =/d" setup.cfg
+  '';
+
   pythonImportsCheck = [ "plum" ];
 
-  nativeCheckInputs = [ pytest baseline ];
-  checkPhase = "pytest tests";
+  nativeCheckInputs = [
+    baseline
+    pytestCheckHook
+  ];
+
+  pytestFlagsArray = [
+    "tests"
+  ];
 
   meta = with lib; {
     description = "Classes and utilities for packing/unpacking bytes";
diff --git a/pkgs/development/python-modules/pyfaidx/default.nix b/pkgs/development/python-modules/pyfaidx/default.nix
index 632f846bce36..3965a31e58c2 100644
--- a/pkgs/development/python-modules/pyfaidx/default.nix
+++ b/pkgs/development/python-modules/pyfaidx/default.nix
@@ -3,6 +3,7 @@
 , fetchPypi
 , nose
 , numpy
+, setuptools
 , setuptools-scm
 , six
 , glibcLocales
@@ -12,7 +13,7 @@
 buildPythonPackage rec {
   pname = "pyfaidx";
   version = "0.7.2.1";
-  format = "setuptools";
+  format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
@@ -20,6 +21,7 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
+    setuptools
     setuptools-scm
   ];
 
diff --git a/pkgs/development/python-modules/pyinsteon/default.nix b/pkgs/development/python-modules/pyinsteon/default.nix
index 400791197b6f..e7e9747d7f85 100644
--- a/pkgs/development/python-modules/pyinsteon/default.nix
+++ b/pkgs/development/python-modules/pyinsteon/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "pyinsteon";
-  version = "1.3.3";
+  version = "1.3.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-zbqgwCukTmvCIXpAvaKQl7voOI4ATqsT9NPUyRhw2EE=";
+    hash = "sha256-P/5kCXmUWQ/2yvzu/Pr0XBY8zm3fMMyoapGmdtRmxXo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pypdf/default.nix b/pkgs/development/python-modules/pypdf/default.nix
new file mode 100644
index 000000000000..ad58e6c11995
--- /dev/null
+++ b/pkgs/development/python-modules/pypdf/default.nix
@@ -0,0 +1,92 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+
+# build-system
+, flit-core
+
+# docs
+, sphinxHook
+, sphinx-rtd-theme
+, myst-parser
+
+# propagates
+, typing-extensions
+
+# optionals
+, pycryptodome
+, pillow
+
+# tests
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "pypdf";
+  version = "3.5.1";
+  format = "pyproject";
+
+  src = fetchFromGitHub {
+    owner = "py-pdf";
+    repo = "pypdf";
+    rev = "refs/tags/${version}";
+    # fetch sample files used in tests
+    fetchSubmodules = true;
+    hash = "sha256-2Ewa6mTLSNiUFIplfmZDRXmoiX1IQMwg4wq5dAU0O+4=";
+  };
+
+  outputs = [
+    "out"
+    "doc"
+  ];
+
+  nativeBuildInputs = [
+    flit-core
+
+    # docs
+    sphinxHook
+    sphinx-rtd-theme
+    myst-parser
+  ];
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace "--disable-socket" ""
+  '';
+
+  propagatedBuildInputs = lib.optionals (pythonOlder "3.10") [
+    typing-extensions
+  ];
+
+  passthru.optional-dependencies = rec {
+    full = crypto ++ image;
+    crypto = [
+      pycryptodome
+    ];
+    image = [
+      pillow
+    ];
+  };
+
+  pythonImportsCheck = [
+    "pypdf"
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ] ++ passthru.optional-dependencies.full;
+
+  pytestFlagsArray = [
+    # don't access the network
+    "-m" "'not enable_socket'"
+  ];
+
+  meta = with lib; {
+    description = "A pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files";
+    homepage = "https://github.com/py-pdf/pypdf";
+    changelog = "https://github.com/py-pdf/pypdf/blob/${src.rev}/CHANGELOG.md";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ hexa ];
+  };
+}
diff --git a/pkgs/development/python-modules/xhtml2pdf/default.nix b/pkgs/development/python-modules/xhtml2pdf/default.nix
index 78b7761ae6c2..c7f768ab2a8a 100644
--- a/pkgs/development/python-modules/xhtml2pdf/default.nix
+++ b/pkgs/development/python-modules/xhtml2pdf/default.nix
@@ -5,7 +5,7 @@
 , html5lib
 , pillow
 , pyhanko
-, pypdf3
+, pypdf
 , pytestCheckHook
 , python-bidi
 , pythonOlder
@@ -34,7 +34,7 @@ buildPythonPackage rec {
     html5lib
     pillow
     pyhanko
-    pypdf3
+    pypdf
     python-bidi
     reportlab
     svglib
diff --git a/pkgs/development/tools/go-mockery/default.nix b/pkgs/development/tools/go-mockery/default.nix
index a80249026960..118c8f52f740 100644
--- a/pkgs/development/tools/go-mockery/default.nix
+++ b/pkgs/development/tools/go-mockery/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ lib, buildGoModule, fetchFromGitHub, go-mockery, runCommand, go }:
 
 buildGoModule rec {
   pname = "go-mockery";
@@ -24,6 +24,37 @@ buildGoModule rec {
 
   vendorHash = "sha256-3lx3wHnPQ/slRXnlVAnI1ZqSykDXNivjwg1WUITGj64=";
 
+  passthru.tests = {
+    generateMock = runCommand "${pname}-test" {
+      nativeBuildInputs = [ go-mockery ];
+      buildInputs = [ go ];
+    } ''
+      if [[ $(mockery --version) != *"${version}"* ]]; then
+        echo "Error: program version does not match package version"
+        exit 1
+      fi
+
+      export HOME=$TMPDIR
+
+      cat <<EOF > foo.go
+      package main
+
+      type Foo interface {
+        Bark() string
+      }
+      EOF
+
+      mockery --name Foo --dir .
+
+      if [[ ! -f "mocks/Foo.go" ]]; then
+        echo "Error: mocks/Foo.go was not generated by ${pname}"
+        exit 1
+      fi
+
+      touch $out
+    '';
+  };
+
   meta = with lib; {
     homepage = "https://github.com/vektra/mockery";
     description = "A mock code autogenerator for Golang";
diff --git a/pkgs/development/tools/tabnine/sources.json b/pkgs/development/tools/tabnine/sources.json
index 11ca370deb62..7ce95a0e1303 100644
--- a/pkgs/development/tools/tabnine/sources.json
+++ b/pkgs/development/tools/tabnine/sources.json
@@ -1,17 +1,17 @@
 {
-  "version": "4.4.245",
+  "version": "4.4.265",
   "platforms": {
     "x86_64-linux": {
       "name": "x86_64-unknown-linux-musl",
-      "hash": "sha256-heumULn4DNYJVB8ZdQz8RcQYcLcdF85+Wjsz4K3SUDg="
+      "hash": "sha256-HyRUlOSH/GmvBlOEtdIdv5cyHaw92OqWrYqaEI63NDE="
     },
     "aarch64-darwin": {
       "name": "aarch64-apple-darwin",
-      "hash": "sha256-eLzf2srpOh9YSdl2lK1KALQ/KERIcJJoeErLxeM3J+M="
+      "hash": "sha256-ZcM7JnrPCWvhvpb7vbrLvqY9RmWjMaaAd7Wvx6Eveto="
     },
     "x86_64-darwin": {
       "name": "x86_64-apple-darwin",
-      "hash": "sha256-ZCATPu9cU2ZUUFE7vDx/xKyx8jChubrG1xby7I+0z/4="
+      "hash": "sha256-eiZv5eidDynNOb5P6IUAVI3X8xub9U0GgWFkFq6mY74="
     }
   }
 }
diff --git a/pkgs/os-specific/linux/kernel/zen-kernels.nix b/pkgs/os-specific/linux/kernel/zen-kernels.nix
index 597b76bb26c3..4a357fc1a09b 100644
--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@@ -32,7 +32,7 @@ let
 
     extraMeta = {
       branch = lib.versions.majorMinor version + "/master";
-      maintainers = with lib.maintainers; [ andresilva pedrohlc ];
+      maintainers = with lib.maintainers; [ pedrohlc ];
       description = "Built using the best configuration and kernel sources for desktop, multimedia, and gaming workloads." +
         lib.optionalString isLqx " (Same as linux_zen but less aggressive release schedule)";
     };
diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index 38ad03b57f2f..945a20101a58 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -2,7 +2,7 @@
 # Do not edit!
 
 {
-  version = "2023.3.1";
+  version = "2023.3.2";
   components = {
     "3_day_blinds" = ps: with ps; [
     ];
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index 125a0261dc5e..6f595ef2e46c 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -180,6 +180,22 @@ let
         doCheck = false;
       });
 
+      sqlalchemy = super.sqlalchemy.overridePythonAttrs (oldAttrs: rec {
+        version = "2.0.5.post1";
+        src = super.fetchPypi {
+          pname = "SQLAlchemy";
+          inherit version;
+          hash = "sha256-E+sqWILP2fTu2q7BSlYDoJbwEl98PLSGEbO/o8JT8l0=";
+        };
+        nativeCheckInputs = oldAttrs.nativeCheckInputs ++ (with super; [
+          pytest-xdist
+        ]);
+        disabledTestPaths = (oldAttrs.disabledTestPaths or []) ++ [
+          "test/aaa_profiling"
+          "test/ext/mypy"
+        ];
+      });
+
       # Pinned due to API changes in 0.3.0
       tailscale = super.tailscale.overridePythonAttrs (oldAttrs: rec {
         version = "0.2.0";
@@ -247,7 +263,7 @@ let
   extraBuildInputs = extraPackages python.pkgs;
 
   # Don't forget to run parse-requirements.py after updating
-  hassVersion = "2023.3.1";
+  hassVersion = "2023.3.2";
 
 in python.pkgs.buildPythonApplication rec {
   pname = "homeassistant";
@@ -263,7 +279,7 @@ in python.pkgs.buildPythonApplication rec {
   # Primary source is the pypi sdist, because it contains translations
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-FvdMNtiLJ6p9I6aEeICukx9mykGGMoONGNdM/I4u/eY=";
+    hash = "sha256-I6NSVoMS3xbUqh/7BxJj/Evkk7+g3N0dZVJjEbr2pCs=";
   };
 
   # Secondary source is git for tests
@@ -271,7 +287,7 @@ in python.pkgs.buildPythonApplication rec {
     owner = "home-assistant";
     repo = "core";
     rev = "refs/tags/${version}";
-    hash = "sha256-2usXU1a/QKEIaeg8JFBf/4ID2nzZLoGsfK7KXreKEBE=";
+    hash = "sha256-Qd++/73c9VDNe4AMdiDIVJXxh4qFx2x4HDkY1An2VjE=";
   };
 
   nativeBuildInputs = with python3.pkgs; [
diff --git a/pkgs/servers/home-assistant/frontend.nix b/pkgs/servers/home-assistant/frontend.nix
index 6c7329d20707..26ef8b7168f2 100644
--- a/pkgs/servers/home-assistant/frontend.nix
+++ b/pkgs/servers/home-assistant/frontend.nix
@@ -4,7 +4,7 @@ buildPythonPackage rec {
   # the frontend version corresponding to a specific home-assistant version can be found here
   # https://github.com/home-assistant/home-assistant/blob/master/homeassistant/components/frontend/manifest.json
   pname = "home-assistant-frontend";
-  version = "20230302.0";
+  version = "20230306.0";
   format = "wheel";
 
   src = fetchPypi {
@@ -12,7 +12,7 @@ buildPythonPackage rec {
     pname = "home_assistant_frontend";
     dist = "py3";
     python = "py3";
-    hash = "sha256-G+XexUc5yvADjbXBgg97FB03Al3zR9WTb4cuVBBrSuI=";
+    hash = "sha256-E/e1XyhwFiNMLz7+o99eG9sW2ZCCfPFnkBcu3BpCbxQ=";
   };
 
   # there is nothing to strip in this package
diff --git a/pkgs/servers/home-assistant/stubs.nix b/pkgs/servers/home-assistant/stubs.nix
index 4e31078381ff..0576814b68ee 100644
--- a/pkgs/servers/home-assistant/stubs.nix
+++ b/pkgs/servers/home-assistant/stubs.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "homeassistant-stubs";
-  version = "2023.3.1";
+  version = "2023.3.2";
   format = "pyproject";
 
   disabled = python.version != home-assistant.python.version;
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "KapJI";
     repo = "homeassistant-stubs";
     rev = "refs/tags/${version}";
-    hash = "sha256-WMuQgoWwri4nfKkZ8cW5o6S6G3PbHqlUxC9wyJSZhxQ=";
+    hash = "sha256-tgXjACNGD3QTrsgYtcTinW4HflwGSoCR6k6SrawQz6A=";
   };
 
   nativeBuildInputs = [
@@ -25,6 +25,14 @@ buildPythonPackage rec {
     home-assistant
   ];
 
+  postPatch = ''
+    # Relax constraint to year and month
+    substituteInPlace pyproject.toml --replace \
+      'homeassistant = "${version}"' \
+      'homeassistant = "~${lib.versions.majorMinor home-assistant.version}"'
+    cat pyproject.toml
+  '';
+
   pythonImportsCheck = [
     "homeassistant-stubs"
   ];
diff --git a/pkgs/tools/misc/pre-commit/default.nix b/pkgs/tools/misc/pre-commit/default.nix
index f51fcf254f98..7ea5b8e7ae32 100644
--- a/pkgs/tools/misc/pre-commit/default.nix
+++ b/pkgs/tools/misc/pre-commit/default.nix
@@ -1,28 +1,32 @@
 { lib
-, python3Packages
 , fetchFromGitHub
-  # tests
+, python3Packages
+, libiconv
 , cargo
+, coursier
 , dotnet-sdk
 , git
+, glibcLocales
 , go
-, libiconv
 , nodejs
+, perl
+, testers
+, pre-commit
 }:
 
 with python3Packages;
-buildPythonPackage rec {
+buildPythonApplication rec {
   pname = "pre-commit";
-  version = "2.20.0";
+  version = "3.1.0";
   format = "setuptools";
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "pre-commit";
     repo = "pre-commit";
-    rev = "refs/tags/v${version}";
-    sha256 = "sha256-+JrnJz+wFbzVw9ysPX85DDE6suF3VU7gQZdp66x5TKY=";
+    rev = "v${version}";
+    hash = "sha256-riAXvpJmuQHOfruwebijiAgN2AvqpUUI07p758qO+4k=";
   };
 
   patches = [
@@ -37,18 +41,18 @@ buildPythonPackage rec {
     pyyaml
     toml
     virtualenv
-  ] ++ lib.optionals (pythonOlder "3.8") [
-    importlib-metadata
-  ] ++ lib.optionals (pythonOlder "3.7") [
-    importlib-resources
   ];
 
   nativeCheckInputs = [
     cargo
+    coursier
     dotnet-sdk
     git
+    glibcLocales
     go
+    libiconv # For rust tests on Darwin
     nodejs
+    perl
     pytest-env
     pytest-forked
     pytest-xdist
@@ -56,11 +60,6 @@ buildPythonPackage rec {
     re-assert
   ];
 
-  buildInputs = [
-    # Required for rust test on x86_64-darwin
-    libiconv
-  ];
-
   # i686-linux: dotnet-sdk not available
   doCheck = stdenv.buildPlatform.system != "i686-linux";
 
@@ -79,19 +78,23 @@ buildPythonPackage rec {
     "--forked"
   ];
 
-  preCheck = ''
+  preCheck = lib.optionalString (!(stdenv.isLinux && stdenv.isAarch64)) ''
+    # Disable outline atomics for rust tests on aarch64-linux.
+    export RUSTFLAGS="-Ctarget-feature=-outline-atomics"
+  '' + ''
     export GIT_AUTHOR_NAME=test GIT_COMMITTER_NAME=test \
            GIT_AUTHOR_EMAIL=test@example.com GIT_COMMITTER_EMAIL=test@example.com \
            VIRTUALENV_NO_DOWNLOAD=1 PRE_COMMIT_NO_CONCURRENCY=1 LANG=en_US.UTF-8
 
-    git init -b master
+    # Resolve `.NET location: Not found` errors for dotnet tests
+    export DOTNET_ROOT="${dotnet-sdk}"
 
     export HOME=$(mktemp -d)
 
+    git init -b master
+
     python -m venv --system-site-packages venv
     source "$PWD/venv/bin/activate"
-    #$out/bin/pre-commit install
-    python setup.py develop
   '';
 
   postCheck = ''
@@ -106,7 +109,7 @@ buildPythonPackage rec {
 
     # /build/pytest-of-nixbld/pytest-0/test_install_ruby_with_version0/rbenv-2.7.2/libexec/rbenv-init:
     # /usr/bin/env: bad interpreter: No such file or directory
-    "ruby"
+    "test_ruby_"
 
     # network
     "test_additional_dependencies_roll_forward"
@@ -114,60 +117,59 @@ buildPythonPackage rec {
     "test_additional_node_dependencies_installed"
     "test_additional_rust_cli_dependencies_installed"
     "test_additional_rust_lib_dependencies_installed"
-    "test_dart_hook"
-    "test_dotnet_hook"
+    "test_coursier_hook"
+    "test_coursier_hook_additional_dependencies"
+    "test_dart"
+    "test_dart_additional_deps"
+    "test_dart_additional_deps_versioned"
+    "test_docker_hook"
+    "test_docker_image_hook_via_args"
+    "test_docker_image_hook_via_entrypoint"
+    "test_golang_default_version"
     "test_golang_hook"
     "test_golang_hook_still_works_when_gobin_is_set"
+    "test_golang_infer_go_version_default"
+    "test_golang_system"
+    "test_golang_versioned"
+    "test_language_version_with_rustup"
+    "test_installs_rust_missing_rustup"
     "test_installs_without_links_outside_env"
-    "test_local_dart_additional_dependencies"
-    "test_local_golang_additional_dependencies"
-    "test_local_lua_additional_dependencies"
-    "test_local_perl_additional_dependencies"
-    "test_local_rust_additional_dependencies"
-    "test_lua_hook"
-    "test_perl_hook"
+    "test_local_golang_additional_deps"
+    "test_lua"
+    "test_lua_additional_dependencies"
+    "test_node_additional_deps"
+    "test_node_hook_versions"
+    "test_perl_additional_dependencies"
     "test_r_hook"
+    "test_r_inline"
     "test_r_inline_hook"
     "test_r_local_with_additional_dependencies_hook"
     "test_r_with_additional_dependencies_hook"
     "test_run_a_node_hook_default_version"
+    "test_run_lib_additional_dependencies"
     "test_run_versioned_node_hook"
-
-    # python2, no explanation needed
-    "python2"
-    "test_switch_language_versions_doesnt_clobber"
-
-    # docker
-    "test_run_a_docker_hook"
+    "test_rust_cli_additional_dependencies"
+    "test_swift_language"
 
     # i don't know why these fail
     "test_install_existing_hooks_no_overwrite"
     "test_installed_from_venv"
     "test_uninstall_restores_legacy_hooks"
+    "test_dotnet_"
 
     # Expects `git commit` to fail when `pre-commit` is not in the `$PATH`,
     # but we use an absolute path so it's not an issue.
     "test_environment_not_sourced"
-
-    # broken with Git 2.38.1, upstream issue filed at https://github.com/pre-commit/pre-commit/issues/2579
-    "test_golang_with_recursive_submodule"
-    "test_install_in_submodule_and_run"
-    "test_is_in_merge_conflict_submodule"
-    "test_get_conflicted_files_in_submodule"
-    "test_sub_nothing_unstaged"
-    "test_sub_something_unstaged"
-    "test_sub_staged"
-    "test_submodule_does_not_discard_changes"
-    "test_submodule_does_not_discard_changes_recurse"
-  ] ++ lib.optionals (stdenv.isLinux && stdenv.isAarch64) [
-    # requires gcc bump
-    "test_rust_hook"
   ];
 
   pythonImportsCheck = [
     "pre_commit"
   ];
 
+  passthru.tests.version = testers.testVersion {
+    package = pre-commit;
+  };
+
   meta = with lib; {
     description = "A framework for managing and maintaining multi-language pre-commit hooks";
     homepage = "https://pre-commit.com/";
diff --git a/pkgs/tools/misc/pre-commit/languages-use-the-hardcoded-path-to-python-binaries.patch b/pkgs/tools/misc/pre-commit/languages-use-the-hardcoded-path-to-python-binaries.patch
index 6d274aae3c07..c3469c95b268 100644
--- a/pkgs/tools/misc/pre-commit/languages-use-the-hardcoded-path-to-python-binaries.patch
+++ b/pkgs/tools/misc/pre-commit/languages-use-the-hardcoded-path-to-python-binaries.patch
@@ -1,24 +1,24 @@
 diff --git a/pre_commit/languages/node.py b/pre_commit/languages/node.py
-index 26f4919..4885ec1 100644
+index 66d6136..e3f1bac 100644
 --- a/pre_commit/languages/node.py
 +++ b/pre_commit/languages/node.py
-@@ -82,7 +82,7 @@ def install_environment(
+@@ -83,7 +83,7 @@ def install_environment(
+     # https://msdn.microsoft.com/en-us/library/windows/desktop/aa365247(v=vs.85).aspx?f=255&MSPPError=-2147217396#maxpath
+     if sys.platform == 'win32':  # pragma: no cover
          envdir = fr'\\?\{os.path.normpath(envdir)}'
-     with clean_path_on_failure(envdir):
-         cmd = [
--            sys.executable, '-mnodeenv', '--prebuilt', '--clean-src', envdir,
-+            '@nodeenv@/bin/nodeenv', '--prebuilt', '--clean-src', envdir,
-         ]
-         if version != C.DEFAULT:
-             cmd.extend(['-n', version])
+-    cmd = [sys.executable, '-mnodeenv', '--prebuilt', '--clean-src', envdir]
++    cmd = ['@nodeenv@/bin/nodeenv', '--prebuilt', '--clean-src', envdir]
+     if version != C.DEFAULT:
+         cmd.extend(['-n', version])
+     cmd_output_b(*cmd)
 diff --git a/pre_commit/languages/python.py b/pre_commit/languages/python.py
-index 43b7280..f0f2338 100644
+index 976674e..485fe2d 100644
 --- a/pre_commit/languages/python.py
 +++ b/pre_commit/languages/python.py
-@@ -192,7 +192,7 @@ def install_environment(
+@@ -203,7 +203,7 @@ def install_environment(
          additional_dependencies: Sequence[str],
  ) -> None:
-     envdir = prefix.path(helpers.environment_dir(ENVIRONMENT_DIR, version))
+     envdir = lang_base.environment_dir(prefix, ENVIRONMENT_DIR, version)
 -    venv_cmd = [sys.executable, '-mvirtualenv', envdir]
 +    venv_cmd = ['@virtualenv@/bin/virtualenv', envdir]
      python = norm_version(version)
diff --git a/pkgs/tools/security/biscuit-cli/Cargo.lock b/pkgs/tools/security/biscuit-cli/Cargo.lock
new file mode 100644
index 000000000000..5081080cabf0
--- /dev/null
+++ b/pkgs/tools/security/biscuit-cli/Cargo.lock
@@ -0,0 +1,1080 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "aho-corasick"
+version = "0.7.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4f55bd91a0978cbfd91c457a164bab8b4001c833b7f323132c0a4e1922dd44e"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "android_system_properties"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "819e7219dbd41043ac279b19830f2efc897156490d7fd6ea916720117ee66311"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "anyhow"
+version = "1.0.66"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "216261ddc8289130e551ddcd5ce8a064710c0d064a4d2895c67151c92b5443f6"
+
+[[package]]
+name = "atty"
+version = "0.2.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9b39be18770d11421cdb1b9947a45dd3f37e93092cbf377614828a319d5fee8"
+dependencies = [
+ "hermit-abi",
+ "libc",
+ "winapi",
+]
+
+[[package]]
+name = "autocfg"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
+
+[[package]]
+name = "base64"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9e1b586273c5702936fe7b7d6896644d8be71e6314cfe09d3167c95f712589e8"
+
+[[package]]
+name = "biscuit-auth"
+version = "3.0.0-alpha4"
+source = "git+https://github.com/biscuit-auth/biscuit-rust?branch=main#676e32fd4071dd2f0ee0f76807f3ca53dd877c89"
+dependencies = [
+ "base64",
+ "biscuit-parser",
+ "biscuit-quote",
+ "ed25519-dalek",
+ "getrandom",
+ "hex",
+ "nom",
+ "prost",
+ "prost-types",
+ "rand",
+ "rand_core",
+ "regex",
+ "sha2",
+ "thiserror",
+ "time 0.3.17",
+ "zeroize",
+]
+
+[[package]]
+name = "biscuit-cli"
+version = "0.2.0"
+dependencies = [
+ "anyhow",
+ "atty",
+ "biscuit-auth",
+ "chrono",
+ "clap",
+ "hex",
+ "parse_duration",
+ "shell-words",
+ "tempfile",
+ "thiserror",
+ "time 0.3.17",
+]
+
+[[package]]
+name = "biscuit-parser"
+version = "0.1.0-alpha4"
+source = "git+https://github.com/biscuit-auth/biscuit-rust?branch=main#676e32fd4071dd2f0ee0f76807f3ca53dd877c89"
+dependencies = [
+ "hex",
+ "nom",
+ "proc-macro2",
+ "quote",
+ "thiserror",
+ "time 0.3.17",
+]
+
+[[package]]
+name = "biscuit-quote"
+version = "0.2.0-alpha5"
+source = "git+https://github.com/biscuit-auth/biscuit-rust?branch=main#676e32fd4071dd2f0ee0f76807f3ca53dd877c89"
+dependencies = [
+ "biscuit-parser",
+ "proc-macro-error",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "bitflags"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+
+[[package]]
+name = "block-buffer"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4152116fd6e9dadb291ae18fc1ec3575ed6d84c29642d97890f4b4a3417297e4"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "bumpalo"
+version = "3.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "572f695136211188308f16ad2ca5c851a712c464060ae6974944458eb83880ba"
+
+[[package]]
+name = "byteorder"
+version = "1.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "14c189c53d098945499cdfa7ecc63567cf3886b3332b312a5b4585d8d3a6a610"
+
+[[package]]
+name = "bytes"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec8a7b6a70fde80372154c65702f00a0f56f3e1c36abbc6c440484be248856db"
+
+[[package]]
+name = "cc"
+version = "1.0.76"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "76a284da2e6fe2092f2353e51713435363112dfd60030e22add80be333fb928f"
+
+[[package]]
+name = "cfg-if"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+
+[[package]]
+name = "chrono"
+version = "0.4.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfd4d1b31faaa3a89d7934dbded3111da0d2ef28e3ebccdb4f0179f5929d1ef1"
+dependencies = [
+ "iana-time-zone",
+ "js-sys",
+ "num-integer",
+ "num-traits",
+ "time 0.1.44",
+ "wasm-bindgen",
+ "winapi",
+]
+
+[[package]]
+name = "clap"
+version = "3.2.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "71655c45cb9845d3270c9d6df84ebe72b4dad3c2ba3f7023ad47c144e4e473a5"
+dependencies = [
+ "atty",
+ "bitflags",
+ "clap_derive",
+ "clap_lex",
+ "indexmap",
+ "once_cell",
+ "strsim",
+ "termcolor",
+ "textwrap",
+]
+
+[[package]]
+name = "clap_derive"
+version = "3.2.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ea0c8bce528c4be4da13ea6fead8965e95b6073585a2f05204bd8f4119f82a65"
+dependencies = [
+ "heck",
+ "proc-macro-error",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "clap_lex"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2850f2f5a82cbf437dd5af4d49848fbdfc27c157c3d010345776f952765261c5"
+dependencies = [
+ "os_str_bytes",
+]
+
+[[package]]
+name = "codespan-reporting"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3538270d33cc669650c4b093848450d380def10c331d38c768e34cac80576e6e"
+dependencies = [
+ "termcolor",
+ "unicode-width",
+]
+
+[[package]]
+name = "core-foundation-sys"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5827cebf4670468b8772dd191856768aedcb1b0278a04f989f7766351917b9dc"
+
+[[package]]
+name = "cpufeatures"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "28d997bd5e24a5928dd43e46dc529867e207907fe0b239c3477d924f7f2ca320"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "curve25519-dalek"
+version = "3.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "90f9d052967f590a76e62eb387bd0bbb1b000182c3cefe5364db6b7211651bc0"
+dependencies = [
+ "byteorder",
+ "digest",
+ "rand_core",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "cxx"
+version = "1.0.81"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97abf9f0eca9e52b7f81b945524e76710e6cb2366aead23b7d4fbf72e281f888"
+dependencies = [
+ "cc",
+ "cxxbridge-flags",
+ "cxxbridge-macro",
+ "link-cplusplus",
+]
+
+[[package]]
+name = "cxx-build"
+version = "1.0.81"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7cc32cc5fea1d894b77d269ddb9f192110069a8a9c1f1d441195fba90553dea3"
+dependencies = [
+ "cc",
+ "codespan-reporting",
+ "once_cell",
+ "proc-macro2",
+ "quote",
+ "scratch",
+ "syn",
+]
+
+[[package]]
+name = "cxxbridge-flags"
+version = "1.0.81"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ca220e4794c934dc6b1207c3b42856ad4c302f2df1712e9f8d2eec5afaacf1f"
+
+[[package]]
+name = "cxxbridge-macro"
+version = "1.0.81"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b846f081361125bfc8dc9d3940c84e1fd83ba54bbca7b17cd29483c828be0704"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "digest"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3dd60d1080a57a05ab032377049e0591415d2b31afd7028356dbf3cc6dcb066"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "ed25519"
+version = "1.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e9c280362032ea4203659fc489832d0204ef09f247a0506f170dafcac08c369"
+dependencies = [
+ "signature",
+]
+
+[[package]]
+name = "ed25519-dalek"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c762bae6dcaf24c4c84667b8579785430908723d5c889f469d76a41d59cc7a9d"
+dependencies = [
+ "curve25519-dalek",
+ "ed25519",
+ "rand",
+ "serde",
+ "sha2",
+ "zeroize",
+]
+
+[[package]]
+name = "either"
+version = "1.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "90e5c1c8368803113bf0c9584fc495a58b86dc8a29edbf8fe877d21d9507e797"
+
+[[package]]
+name = "fastrand"
+version = "1.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7a407cfaa3385c4ae6b23e84623d48c2798d06e3e6a1878f7f59f17b3f86499"
+dependencies = [
+ "instant",
+]
+
+[[package]]
+name = "generic-array"
+version = "0.14.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bff49e947297f3312447abdca79f45f4738097cc82b06e72054d2223f601f1b9"
+dependencies = [
+ "typenum",
+ "version_check",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.1.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8fc3cb4d91f53b50155bdcfd23f6a4c39ae1969c2ae85982b135750cccaf5fce"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "wasi 0.9.0+wasi-snapshot-preview1",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
+
+[[package]]
+name = "heck"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2540771e65fc8cb83cd6e8a237f70c319bd5c29f78ed1084ba5d50eeac86f7f9"
+
+[[package]]
+name = "hermit-abi"
+version = "0.1.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "62b467343b94ba476dcb2500d242dadbb39557df889310ac77c5d99100aaac33"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "hex"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
+
+[[package]]
+name = "iana-time-zone"
+version = "0.1.53"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "64c122667b287044802d6ce17ee2ddf13207ed924c712de9a66a5814d5b64765"
+dependencies = [
+ "android_system_properties",
+ "core-foundation-sys",
+ "iana-time-zone-haiku",
+ "js-sys",
+ "wasm-bindgen",
+ "winapi",
+]
+
+[[package]]
+name = "iana-time-zone-haiku"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0703ae284fc167426161c2e3f1da3ea71d94b21bedbcc9494e92b28e334e3dca"
+dependencies = [
+ "cxx",
+ "cxx-build",
+]
+
+[[package]]
+name = "indexmap"
+version = "1.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10a35a97730320ffe8e2d410b5d3b69279b98d2c14bdb8b70ea89ecf7888d41e"
+dependencies = [
+ "autocfg",
+ "hashbrown",
+]
+
+[[package]]
+name = "instant"
+version = "0.1.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a5bbe824c507c5da5956355e86a746d82e0e1464f65d862cc5e71da70e94b2c"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "itertools"
+version = "0.10.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b0fd2260e829bddf4cb6ea802289de2f86d6a7a690192fbe91b3f46e0f2c8473"
+dependencies = [
+ "either",
+]
+
+[[package]]
+name = "itoa"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4217ad341ebadf8d8e724e264f13e593e0648f5b3e94b3896a5df283be015ecc"
+
+[[package]]
+name = "js-sys"
+version = "0.3.60"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49409df3e3bf0856b916e2ceaca09ee28e6871cf7d9ce97a692cacfdb2a25a47"
+dependencies = [
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "lazy_static"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
+
+[[package]]
+name = "libc"
+version = "0.2.137"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc7fcc620a3bff7cdd7a365be3376c97191aeaccc2a603e600951e452615bf89"
+
+[[package]]
+name = "link-cplusplus"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9272ab7b96c9046fbc5bc56c06c117cb639fe2d509df0c421cad82d2915cf369"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "log"
+version = "0.4.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "abb12e687cfb44aa40f41fc3978ef76448f9b6038cad6aef4259d3c095a2382e"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "memchr"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2dffe52ecf27772e601905b7522cb4ef790d2cc203488bbd0e2fe85fcb74566d"
+
+[[package]]
+name = "minimal-lexical"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
+
+[[package]]
+name = "nom"
+version = "7.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a8903e5a29a317527874d0402f867152a3d21c908bb0b933e416c65e301d4c36"
+dependencies = [
+ "memchr",
+ "minimal-lexical",
+]
+
+[[package]]
+name = "num"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8536030f9fea7127f841b45bb6243b27255787fb4eb83958aa1ef9d2fdc0c36"
+dependencies = [
+ "num-bigint",
+ "num-complex",
+ "num-integer",
+ "num-iter",
+ "num-rational",
+ "num-traits",
+]
+
+[[package]]
+name = "num-bigint"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "090c7f9998ee0ff65aa5b723e4009f7b217707f1fb5ea551329cc4d6231fb304"
+dependencies = [
+ "autocfg",
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-complex"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6b19411a9719e753aff12e5187b74d60d3dc449ec3f4dc21e3989c3f554bc95"
+dependencies = [
+ "autocfg",
+ "num-traits",
+]
+
+[[package]]
+name = "num-integer"
+version = "0.1.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "225d3389fb3509a24c93f5c29eb6bde2586b98d9f016636dff58d7c6f7569cd9"
+dependencies = [
+ "autocfg",
+ "num-traits",
+]
+
+[[package]]
+name = "num-iter"
+version = "0.1.43"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d03e6c028c5dc5cac6e2dec0efda81fc887605bb3d884578bb6d6bf7514e252"
+dependencies = [
+ "autocfg",
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-rational"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c000134b5dbf44adc5cb772486d335293351644b801551abe8f75c84cfa4aef"
+dependencies = [
+ "autocfg",
+ "num-bigint",
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-traits"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "578ede34cf02f8924ab9447f50c28075b4d3e5b269972345e7e0372b38c6cdcd"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "86f0b0d4bf799edbc74508c1e8bf170ff5f41238e5f8225603ca7caaae2b7860"
+
+[[package]]
+name = "opaque-debug"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "624a8340c38c1b80fd549087862da4ba43e08858af025b236e509b6649fc13d5"
+
+[[package]]
+name = "os_str_bytes"
+version = "6.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3baf96e39c5359d2eb0dd6ccb42c62b91d9678aa68160d261b9e0ccbf9e9dea9"
+
+[[package]]
+name = "parse_duration"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7037e5e93e0172a5a96874380bf73bc6ecef022e26fa25f2be26864d6b3ba95d"
+dependencies = [
+ "lazy_static",
+ "num",
+ "regex",
+]
+
+[[package]]
+name = "ppv-lite86"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b40af805b3121feab8a3c29f04d8ad262fa8e0561883e7653e024ae4479e6de"
+
+[[package]]
+name = "proc-macro-error"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da25490ff9892aab3fcf7c36f08cfb902dd3e71ca0f9f9517bea02a73a5ce38c"
+dependencies = [
+ "proc-macro-error-attr",
+ "proc-macro2",
+ "quote",
+ "syn",
+ "version_check",
+]
+
+[[package]]
+name = "proc-macro-error-attr"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1be40180e52ecc98ad80b184934baf3d0d29f979574e439af5a55274b35f869"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "version_check",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.47"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5ea3d908b0e36316caf9e9e2c4625cdde190a7e6f440d794667ed17a1855e725"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "prost"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "71adf41db68aa0daaefc69bb30bcd68ded9b9abaad5d1fbb6304c4fb390e083e"
+dependencies = [
+ "bytes",
+ "prost-derive",
+]
+
+[[package]]
+name = "prost-derive"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b670f45da57fb8542ebdbb6105a925fe571b67f9e7ed9f47a06a84e72b4e7cc"
+dependencies = [
+ "anyhow",
+ "itertools",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "prost-types"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2d0a014229361011dc8e69c8a1ec6c2e8d0f2af7c91e3ea3f5b2170298461e68"
+dependencies = [
+ "bytes",
+ "prost",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbe448f377a7d6961e30f5955f9b8d106c3f5e449d493ee1b125c1d43c2b5179"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "rand"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6a6b1679d49b24bbfe0c803429aa1874472f50d9b363131f0e89fc356b544d03"
+dependencies = [
+ "getrandom",
+ "libc",
+ "rand_chacha",
+ "rand_core",
+ "rand_hc",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f4c8ed856279c9737206bf725bf36935d8666ead7aa69b52be55af369d193402"
+dependencies = [
+ "ppv-lite86",
+ "rand_core",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "90bde5296fc891b0cef12a6d03ddccc162ce7b2aff54160af9338f8d40df6d19"
+dependencies = [
+ "getrandom",
+]
+
+[[package]]
+name = "rand_hc"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca3129af7b92a17112d59ad498c6f81eaf463253766b90396d39ea7a39d6613c"
+dependencies = [
+ "rand_core",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.2.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fb5a58c1855b4b6819d59012155603f0b22ad30cad752600aadfcb695265519a"
+dependencies = [
+ "bitflags",
+]
+
+[[package]]
+name = "regex"
+version = "1.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e076559ef8e241f2ae3479e36f97bd5741c0330689e217ad51ce2c76808b868a"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.6.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "456c603be3e8d448b072f410900c09faf164fbce2d480456f50eea6e25f9c848"
+
+[[package]]
+name = "remove_dir_all"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3acd125665422973a33ac9d3dd2df85edad0f4ae9b00dafb1a05e43a9f5ef8e7"
+dependencies = [
+ "winapi",
+]
+
+[[package]]
+name = "scratch"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c8132065adcfd6e02db789d9285a0deb2f3fcb04002865ab67d5fb103533898"
+
+[[package]]
+name = "serde"
+version = "1.0.147"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d193d69bae983fc11a79df82342761dfbf28a99fc8d203dca4c3c1b590948965"
+
+[[package]]
+name = "sha2"
+version = "0.9.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4d58a1e1bf39749807d89cf2d98ac2dfa0ff1cb3faa38fbb64dd88ac8013d800"
+dependencies = [
+ "block-buffer",
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+ "opaque-debug",
+]
+
+[[package]]
+name = "shell-words"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24188a676b6ae68c3b2cb3a01be17fbf7240ce009799bb56d5b1409051e78fde"
+
+[[package]]
+name = "signature"
+version = "1.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "74233d3b3b2f6d4b006dc19dee745e73e2a6bfb6f93607cd3b02bd5b00797d7c"
+
+[[package]]
+name = "strsim"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "73473c0e59e6d5812c5dfe2a064a6444949f089e20eec9a2e5506596494e4623"
+
+[[package]]
+name = "subtle"
+version = "2.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6bdef32e8150c2a081110b42772ffe7d7c9032b606bc226c8260fd97e0976601"
+
+[[package]]
+name = "syn"
+version = "1.0.103"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a864042229133ada95abf3b54fdc62ef5ccabe9515b64717bcb9a1919e59445d"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "synstructure"
+version = "0.12.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f36bdaa60a83aca3921b5259d5400cbf5e90fc51931376a9bd4a0eb79aa7210f"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+ "unicode-xid",
+]
+
+[[package]]
+name = "tempfile"
+version = "3.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5cdb1ef4eaeeaddc8fbd371e5017057064af0911902ef36b39801f67cc6d79e4"
+dependencies = [
+ "cfg-if",
+ "fastrand",
+ "libc",
+ "redox_syscall",
+ "remove_dir_all",
+ "winapi",
+]
+
+[[package]]
+name = "termcolor"
+version = "1.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bab24d30b911b2376f3a13cc2cd443142f0c81dda04c118693e35b3835757755"
+dependencies = [
+ "winapi-util",
+]
+
+[[package]]
+name = "textwrap"
+version = "0.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "222a222a5bfe1bba4a77b45ec488a741b3cb8872e5e499451fd7d0129c9c7c3d"
+
+[[package]]
+name = "thiserror"
+version = "1.0.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10deb33631e3c9018b9baf9dcbbc4f737320d2b576bac10f6aefa048fa407e3e"
+dependencies = [
+ "thiserror-impl",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "1.0.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "982d17546b47146b28f7c22e3d08465f6b8903d0ea13c1660d9d84a6e7adcdbb"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "time"
+version = "0.1.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6db9e6914ab8b1ae1c260a4ae7a49b6c5611b40328a735b21862567685e73255"
+dependencies = [
+ "libc",
+ "wasi 0.10.0+wasi-snapshot-preview1",
+ "winapi",
+]
+
+[[package]]
+name = "time"
+version = "0.3.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a561bf4617eebd33bca6434b988f39ed798e527f51a1e797d0ee4f61c0a38376"
+dependencies = [
+ "itoa",
+ "serde",
+ "time-core",
+ "time-macros",
+]
+
+[[package]]
+name = "time-core"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2e153e1f1acaef8acc537e68b44906d2db6436e2b35ac2c6b42640fff91f00fd"
+
+[[package]]
+name = "time-macros"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d967f99f534ca7e495c575c62638eebc2898a8c84c119b89e250477bc4ba16b2"
+dependencies = [
+ "time-core",
+]
+
+[[package]]
+name = "typenum"
+version = "1.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dcf81ac59edc17cc8697ff311e8f5ef2d99fcbd9817b34cec66f90b6c3dfd987"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ceab39d59e4c9499d4e5a8ee0e2735b891bb7308ac83dfb4e80cad195c9f6f3"
+
+[[package]]
+name = "unicode-width"
+version = "0.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c0edd1e5b14653f783770bce4a4dabb4a5108a5370a5f5d8cfe8710c361f6c8b"
+
+[[package]]
+name = "unicode-xid"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f962df74c8c05a667b5ee8bcf162993134c104e96440b663c8daa176dc772d8c"
+
+[[package]]
+name = "version_check"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49874b5167b65d7193b8aba1567f5c7d93d001cafc34600cee003eda787e483f"
+
+[[package]]
+name = "wasi"
+version = "0.9.0+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cccddf32554fecc6acb585f82a32a72e28b48f8c4c1883ddfeeeaa96f7d8e519"
+
+[[package]]
+name = "wasi"
+version = "0.10.0+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a143597ca7c7793eff794def352d41792a93c481eb1042423ff7ff72ba2c31f"
+
+[[package]]
+name = "wasm-bindgen"
+version = "0.2.83"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eaf9f5aceeec8be17c128b2e93e031fb8a4d469bb9c4ae2d7dc1888b26887268"
+dependencies = [
+ "cfg-if",
+ "wasm-bindgen-macro",
+]
+
+[[package]]
+name = "wasm-bindgen-backend"
+version = "0.2.83"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c8ffb332579b0557b52d268b91feab8df3615f265d5270fec2a8c95b17c1142"
+dependencies = [
+ "bumpalo",
+ "log",
+ "once_cell",
+ "proc-macro2",
+ "quote",
+ "syn",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-macro"
+version = "0.2.83"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "052be0f94026e6cbc75cdefc9bae13fd6052cdcaf532fa6c45e7ae33a1e6c810"
+dependencies = [
+ "quote",
+ "wasm-bindgen-macro-support",
+]
+
+[[package]]
+name = "wasm-bindgen-macro-support"
+version = "0.2.83"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07bc0c051dc5f23e307b13285f9d75df86bfdf816c5721e573dec1f9b8aa193c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+ "wasm-bindgen-backend",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-shared"
+version = "0.2.83"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1c38c045535d93ec4f0b4defec448e4291638ee608530863b1e2ba115d4fff7f"
+
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
+[[package]]
+name = "winapi-util"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "70ec6ce85bb158151cae5e5c87f95a8e97d2c0c4b001223f33a334e3ce5de178"
+dependencies = [
+ "winapi",
+]
+
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
+
+[[package]]
+name = "zeroize"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4756f7db3f7b5574938c3eb1c117038b8e07f95ee6718c0efad4ac21508f1efd"
+dependencies = [
+ "zeroize_derive",
+]
+
+[[package]]
+name = "zeroize_derive"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f8f187641dad4f680d25c4bfc4225b418165984179f26ca76ec4fb6441d3a17"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+ "synstructure",
+]
diff --git a/pkgs/tools/security/biscuit-cli/default.nix b/pkgs/tools/security/biscuit-cli/default.nix
new file mode 100644
index 000000000000..c4d21980bd49
--- /dev/null
+++ b/pkgs/tools/security/biscuit-cli/default.nix
@@ -0,0 +1,25 @@
+{ lib, fetchFromGitHub, rustPlatform }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "biscuit-cli";
+  version = "0.2.0-next-pre20230103";
+
+  src = fetchFromGitHub {
+    owner = "biscuit-auth";
+    repo = "biscuit-cli";
+    rev = "0ecf1ec4c98a90b1bf3614558a029b47c57288df";
+    sha256 = "sha256-ADJWqx70IwuvCBeK9rb9WBIsD+oQROQSduSQ8Bu8mfk=";
+  };
+
+  cargoLock = {
+    outputHashes."biscuit-auth-3.0.0-alpha4" = "sha256-4SzOupoD33D0KHZyVLriGzUHy9XXnWK1pbgqOjJH4PI=";
+    lockFile = ./Cargo.lock;
+  };
+
+  meta = {
+    description = "CLI to generate and inspect biscuit tokens";
+    homepage = "https://www.biscuitsec.org/";
+    maintainers = [ lib.maintainers.shlevy ];
+    license = lib.licenses.bsd3;
+  };
+}
diff --git a/pkgs/tools/text/csvkit/default.nix b/pkgs/tools/text/csvkit/default.nix
index fdd3539b08e0..96383fa87f9e 100644
--- a/pkgs/tools/text/csvkit/default.nix
+++ b/pkgs/tools/text/csvkit/default.nix
@@ -2,24 +2,45 @@
 , python3
 }:
 
-python3.pkgs.buildPythonApplication rec {
+let
+  python = python3.override {
+    packageOverrides = self: super: {
+      sqlalchemy = super.sqlalchemy.overridePythonAttrs (oldAttrs: rec {
+        version = "1.4.46";
+        src = super.fetchPypi {
+          pname = "SQLAlchemy";
+          inherit version;
+          hash = "sha256-aRO4JH2KKS74MVFipRkx4rQM6RaB8bbxj2lwRSAMSjA=";
+        };
+        nativeCheckInputs = oldAttrs.nativeCheckInputs ++ (with super; [
+          pytest-xdist
+        ]);
+        disabledTestPaths = (oldAttrs.disabledTestPaths or []) ++ [
+          "test/aaa_profiling"
+          "test/ext/mypy"
+        ];
+      });
+    };
+  };
+in
+python.pkgs.buildPythonApplication rec {
   pname = "csvkit";
   version = "1.1.1";
   format = "setuptools";
 
-  src = python3.pkgs.fetchPypi {
+  src = python.pkgs.fetchPypi {
     inherit pname version;
     hash = "sha256-vt23t49rIq2+1urVrV3kv7Md0sVfMhGyorO2VSkEkiM=";
   };
 
-  propagatedBuildInputs = with python3.pkgs; [
+  propagatedBuildInputs = with python.pkgs; [
     agate
     agate-excel
     agate-dbf
     agate-sql
   ];
 
-  nativeCheckInputs = with python3.pkgs; [
+  nativeCheckInputs = with python.pkgs; [
     pytestCheckHook
   ];
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 641c48956067..20c12c203aca 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2988,6 +2988,8 @@ with pkgs;
     electron = electron_13;
   };
 
+  biscuit-cli = callPackage ../tools/security/biscuit-cli { };
+
   bitwarden = callPackage ../tools/security/bitwarden { };
 
   inherit (nodePackages) bitwarden-cli;
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 7fb8e255198b..43e8cba683cf 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -312,6 +312,10 @@ let
 
     dns-client =  callPackage ../development/ocaml-modules/dns/client.nix { };
 
+    dns-client-lwt = callPackage ../development/ocaml-modules/dns/client-lwt.nix { };
+
+    dns-client-mirage = callPackage ../development/ocaml-modules/dns/client-mirage.nix { };
+
     dns-mirage = callPackage ../development/ocaml-modules/dns/mirage.nix { };
 
     dns-resolver = callPackage ../development/ocaml-modules/dns/resolver.nix { };
@@ -906,6 +910,8 @@ let
 
     mirage-crypto-rng-async = callPackage ../development/ocaml-modules/mirage-crypto/rng-async.nix { };
 
+    mirage-crypto-rng-lwt = callPackage ../development/ocaml-modules/mirage-crypto/rng-lwt.nix { };
+
     mirage-crypto-rng-mirage = callPackage ../development/ocaml-modules/mirage-crypto/rng-mirage.nix { };
 
     mirage-device = callPackage ../development/ocaml-modules/mirage-device { };
@@ -1294,6 +1300,8 @@ let
 
     tls-async = callPackage ../development/ocaml-modules/tls/async.nix { };
 
+    tls-lwt = callPackage ../development/ocaml-modules/tls/lwt.nix { };
+
     tls-mirage = callPackage ../development/ocaml-modules/tls/mirage.nix { };
 
     torch = callPackage ../development/ocaml-modules/torch {
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 557673157459..60da90944772 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -8669,6 +8669,8 @@ self: super: with self; {
 
   pypck = callPackage ../development/python-modules/pypck { };
 
+  pypdf = callPackage ../development/python-modules/pypdf { };
+
   pypdf2 = callPackage ../development/python-modules/pypdf2 { };
 
   pypdf3 = callPackage ../development/python-modules/pypdf3 { };