diff --git a/pkgs/applications/audio/freac/default.nix b/pkgs/applications/audio/freac/default.nix
index 89c4847ededf5..ef4a6bc21afc3 100644
--- a/pkgs/applications/audio/freac/default.nix
+++ b/pkgs/applications/audio/freac/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "freac";
-  version = "1.1.5";
+  version = "1.1.6";
 
   src = fetchFromGitHub {
     owner = "enzo1982";
     repo = "freac";
     rev = "v${version}";
-    sha256 = "sha256-cRmN9D/+FLiXqZW/PYhw61EoZuL3y61YtQ/ZNjnhfmY=";
+    sha256 = "sha256-PDFc/RhxIe6M3lfVHE1QmJnu5Sy+q/yrXrXPV/8X51o=";
   };
 
   buildInputs = [
diff --git a/pkgs/applications/audio/tauon/default.nix b/pkgs/applications/audio/tauon/default.nix
index f6629fe222b9e..444443cd10c41 100644
--- a/pkgs/applications/audio/tauon/default.nix
+++ b/pkgs/applications/audio/tauon/default.nix
@@ -21,13 +21,13 @@
 
 stdenv.mkDerivation rec {
   pname = "tauon";
-  version = "7.1.0";
+  version = "7.1.1";
 
   src = fetchFromGitHub {
     owner = "Taiko2k";
     repo = "TauonMusicBox";
     rev = "v${version}";
-    sha256 = "sha256-p48fVuigfQuFrCUnTD5NTFtgiO3WaBeKOhGLoQU4O5U=";
+    sha256 = "sha256-eVliTSFTBG56mU1Crt3syoYxKclz/6W15y/30C+Tf1g=";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/editors/vscode/vscodium.nix b/pkgs/applications/editors/vscode/vscodium.nix
index d5d52010e0501..b1ab8c57ee8b2 100644
--- a/pkgs/applications/editors/vscode/vscodium.nix
+++ b/pkgs/applications/editors/vscode/vscodium.nix
@@ -13,10 +13,10 @@ let
   archive_fmt = if system == "x86_64-darwin" then "zip" else "tar.gz";
 
   sha256 = {
-    x86_64-linux = "0s45ydca4lmcyki58n4zmvdpn32x7z1q249i3qxcn2a5ay2mhhxc";
-    x86_64-darwin = "1wab60dx5hfgmsw313qk8cbwvyq291d1q82hwll129dgcfhkrzrj";
-    aarch64-linux = "1mkvca3hjcqf3k0v04lynmlm5j3lj86l5j15a505a3f8xp97yvdy";
-    armv7l-linux = "1lcaq5k17km9p6xx26dpxgq5zrnjvh3yf8svz5nb5fa01v8fz4ds";
+    x86_64-linux = "0ldfp4r7nb9npvjadgj63sd369nqmbgf5y4kpp93slsy1lbs0bk8";
+    x86_64-darwin = "05z0jx2cc1askzzdxa8vxj8gp0v9rm1jw6005bpmijvyb8s2d30w";
+    aarch64-linux = "1a5fyxzz51rb0af0wv3xh2h87yq00y5k501p7idqhj0zvd5mpqh6";
+    armv7l-linux = "05byi0aba516whzry5qkxfkm82sy2dgv1m0hyycmnkb2dwmb552m";
   }.${system};
 
   sourceRoot = {
@@ -31,7 +31,7 @@ in
 
     # Please backport all compatible updates to the stable release.
     # This is important for the extension ecosystem.
-    version = "1.64.0";
+    version = "1.64.2";
     pname = "vscodium";
 
     executableName = "codium";
diff --git a/pkgs/applications/misc/ausweisapp2/default.nix b/pkgs/applications/misc/ausweisapp2/default.nix
index 60e4504cc5017..9f3c1c82b5e04 100644
--- a/pkgs/applications/misc/ausweisapp2/default.nix
+++ b/pkgs/applications/misc/ausweisapp2/default.nix
@@ -3,13 +3,13 @@
 
 mkDerivation rec {
   pname = "AusweisApp2";
-  version = "1.22.3";
+  version = "1.22.4";
 
   src = fetchFromGitHub {
     owner = "Governikus";
     repo = "AusweisApp2";
     rev = version;
-    sha256 = "sha256-Zh1rWMdRXPj/+80Sqvp9cbV5sDrNVBebPRGTTWM1DLk=";
+    sha256 = "sha256-Mms7Vibq1Rlb2XbxiV4o1UsjDRJcwG5ZZdPOWHjnW2A=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
diff --git a/pkgs/applications/misc/dmenu/default.nix b/pkgs/applications/misc/dmenu/default.nix
index 42bc059986677..7c76b22dc99c3 100644
--- a/pkgs/applications/misc/dmenu/default.nix
+++ b/pkgs/applications/misc/dmenu/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "dmenu";
-  version = "5.0";
+  version = "5.1";
 
   src = fetchurl {
     url = "https://dl.suckless.org/tools/dmenu-${version}.tar.gz";
-    sha256 = "1lvfxzg3chsgcqbc2vr0zic7vimijgmbvnspayx73kyvqi1f267y";
+    sha256 = "sha256-H01wnrujfrcybroOZl4PE75Pok7jXJWw15ww8Uo0j9U=";
   };
 
   buildInputs = [ libX11 libXinerama zlib libXft ];
diff --git a/pkgs/applications/networking/mailreaders/notmuch/default.nix b/pkgs/applications/networking/mailreaders/notmuch/default.nix
index aa46529bdbace..184804a878886 100644
--- a/pkgs/applications/networking/mailreaders/notmuch/default.nix
+++ b/pkgs/applications/networking/mailreaders/notmuch/default.nix
@@ -2,9 +2,11 @@
 , pkg-config, gnupg
 , xapian, gmime, talloc, zlib
 , doxygen, perl, texinfo
+, notmuch
 , pythonPackages
 , emacs
 , ruby
+, testVersion
 , which, dtach, openssl, bash, gdb, man
 , withEmacs ? true
 , withRuby ? true
@@ -12,18 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "notmuch";
-  version = "0.34.3";
+  version = "0.35";
 
   src = fetchurl {
     url = "https://notmuchmail.org/releases/notmuch-${version}.tar.xz";
-    sha256 = "sha256-P+kQSDv9gVpcO5UOImp7yoFWBT/TLXrR6xoKijrK6Ig=";
+    sha256 = "0fdc81m24xrbhfrhw00g12ak4b8hap4961sq7ap6q2pjqhac8cd8";
   };
 
-  patches = [
-    # https://nmbug.notmuchmail.org/nmweb/show/87o84iza9r.fsf%40starbuck.i-did-not-set--mail-host-address--so-tickle-me
-    ./test-fix-support-for-gpgsm-in-gnupg-2.3.patch
-  ];
-
   nativeBuildInputs = [
     pkg-config
     doxygen                   # (optional) api docs
@@ -100,6 +97,7 @@ stdenv.mkDerivation rec {
 
   passthru = {
     pythonSourceRoot = "notmuch-${version}/bindings/python";
+    tests.version = testVersion { package = notmuch; };
     inherit version;
   };
 
diff --git a/pkgs/applications/networking/mailreaders/notmuch/test-fix-support-for-gpgsm-in-gnupg-2.3.patch b/pkgs/applications/networking/mailreaders/notmuch/test-fix-support-for-gpgsm-in-gnupg-2.3.patch
deleted file mode 100644
index 91c77df70109b..0000000000000
--- a/pkgs/applications/networking/mailreaders/notmuch/test-fix-support-for-gpgsm-in-gnupg-2.3.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-From a642ad542e3d3f34e949c5c66923ca8a6e6cbbd8 Mon Sep 17 00:00:00 2001
-From: Stig Palmquist <stig@stig.io>
-Date: Tue, 11 Jan 2022 13:23:13 +0100
-Subject: [PATCH] test: fix support for gpgsm in gnupg 2.3
-
-gpgsm --list-keys output changed the label for fingerprints from
-"fingerprint: " to "sha[12] fpr: " breaking tests with gnupg 2.3. this
-adds support for both.
----
- test/test-lib.sh | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/test/test-lib.sh b/test/test-lib.sh
-index 6bc0b723..3de608f9 100644
---- a/test/test-lib.sh
-+++ b/test/test-lib.sh
-@@ -145,7 +145,7 @@ add_gpgsm_home () {
-     mkdir -p -m 0700 "$GNUPGHOME"
-     gpgsm --batch --no-tty --no-common-certs-import --pinentry-mode=loopback --passphrase-fd 3 \
- 	  --disable-dirmngr --import  >"$GNUPGHOME"/import.log 2>&1 3<<<'' <$NOTMUCH_SRCDIR/test/smime/0xE0972A47.p12
--    fpr=$(gpgsm --batch --list-key test_suite@notmuchmail.org | sed -n 's/.*fingerprint: //p')
-+    fpr=$(gpgsm --batch --list-key test_suite@notmuchmail.org | sed -n 's/.*\(fingerprint\|sha1 fpr\): //p')
-     echo "$fpr S relax" >> "$GNUPGHOME/trustlist.txt"
-     gpgsm --quiet --batch --no-tty --no-common-certs-import --disable-dirmngr --import < $NOTMUCH_SRCDIR/test/smime/ca.crt
-     echo "4D:E0:FF:63:C0:E9:EC:01:29:11:C8:7A:EE:DA:3A:9A:7F:6E:C1:0D S" >> "$GNUPGHOME/trustlist.txt"
--- 
-2.34.1
-
diff --git a/pkgs/applications/radio/gnss-sdr/default.nix b/pkgs/applications/radio/gnss-sdr/default.nix
index 479b3b641cd37..383c5710808f5 100644
--- a/pkgs/applications/radio/gnss-sdr/default.nix
+++ b/pkgs/applications/radio/gnss-sdr/default.nix
@@ -7,78 +7,97 @@
 , gtest
 , openssl
 , gflags
-, gnuradio3_8
+, gnuradio
 , thrift
-, libpcap
+, enableRawUdp ? true, libpcap
 , orc
 , pkg-config
-, uhd
-, log4cpp
 , blas, lapack
 , matio
 , pugixml
 , protobuf
 }:
 
-gnuradio3_8.pkgs.mkDerivation rec {
+gnuradio.pkgs.mkDerivation rec {
   pname = "gnss-sdr";
-  # There's an issue with cpufeatures on 0.0.15, see:
-  # https://github.com/NixOS/nixpkgs/pull/142557#issuecomment-950217925
-  version = "0.0.13";
+  version = "0.0.16";
 
   src = fetchFromGitHub {
     owner = "gnss-sdr";
     repo = "gnss-sdr";
     rev = "v${version}";
-    sha256 = "0a3k47fl5dizzhbqbrbmckl636lznyjby2d2nz6fz21637hvrnby";
+    sha256 = "sha256-ODe4k6PDGtDX11FrbggEbN3tc4UtATaItUIpCKl4JjM=";
   };
 
+  patches = [
+    # Use the relative install location for volk_gnsssdr_module and
+    # cpu_features which is bundled in the source. NOTE: Perhaps this patch
+    # should be sent upstream.
+    ./fix_libcpu_features_install_path.patch
+  ];
+
   nativeBuildInputs = [
     cmake
-    gnuradio3_8.unwrapped.python
-    gnuradio3_8.unwrapped.python.pkgs.Mako
-    gnuradio3_8.unwrapped.python.pkgs.six
+    pkg-config
+    gnuradio.unwrapped.python
+    gnuradio.unwrapped.python.pkgs.Mako
+    gnuradio.unwrapped.python.pkgs.six
+  ];
+  checkInputs = [
+    gtest
   ];
 
   buildInputs = [
     gmp
     armadillo
-    gnuradio3_8.unwrapped.boost
     glog
-    gtest
-    openssl
     gflags
+    openssl
     orc
-    # UHD support is optional, but gnuradio is built with it, so there's
-    # nothing to be gained by leaving it out.
-    gnuradio3_8.unwrapped.uhd
-    log4cpp
     blas lapack
     matio
     pugixml
     protobuf
-    gnuradio3_8.pkgs.osmosdr
+    gnuradio.unwrapped.boost
+  ] ++ lib.optionals (gnuradio.hasFeature "gr-uhd") [
+    gnuradio.unwrapped.uhd
+  ] ++ (if (lib.versionAtLeast gnuradio.unwrapped.versionAttr.major "3.10") then [
+    gnuradio.unwrapped.spdlog
+  ] else [
+    gnuradio.unwrapped.log4cpp
+  ]) ++ lib.optionals (enableRawUdp) [
     libpcap
-  ] ++ lib.optionals (gnuradio3_8.hasFeature "gr-ctrlport") [
+  ] ++ lib.optionals (gnuradio.hasFeature "gr-ctrlport") [
     thrift
-    gnuradio3_8.unwrapped.python.pkgs.thrift
+    gnuradio.unwrapped.python.pkgs.thrift
+  ] ++ lib.optionals (gnuradio.hasFeature "gr-pdu" || gnuradio.hasFeature "gr-iio") [
+    gnuradio.unwrapped.libiio
+  ] ++ lib.optionals (gnuradio.hasFeature "gr-pdu") [
+    gnuradio.unwrapped.libad9361
   ];
 
   cmakeFlags = [
-    "-DGFlags_ROOT_DIR=${gflags}/lib"
+    "-DGFlags_INCLUDE_DIRS=${gflags}/include"
     "-DGLOG_INCLUDE_DIR=${glog}/include"
+    # Should use .dylib if darwin support is requested
+    "-DGFlags_LIBS=${gflags}/lib/libgflags.so"
+    "-DGLOG_LIBRARIES=${glog}/lib/libglog.so"
+    # Use our dependencies glog, gflags and armadillo dependencies
+    "-DENABLE_OWN_GLOG=OFF"
+    "-DENABLE_OWN_ARMADILLO=OFF"
+    "-DENABLE_ORC=ON"
+    "-DENABLE_LOG=ON"
+    "-DENABLE_RAW_UDP=${if enableRawUdp then "ON" else "OFF"}"
+    "-DENABLE_UHD=${if (gnuradio.hasFeature "gr-uhd") then "ON" else "OFF"}"
+    "-DENABLE_FMCOMMS2=${if (gnuradio.hasFeature "gr-iio" && gnuradio.hasFeature "gr-pdu") then "ON" else "OFF"}"
+    "-DENABLE_PLUTOSDR=${if (gnuradio.hasFeature "gr-iio") then "ON" else "OFF"}"
+    "-DENABLE_AD9361=${if (gnuradio.hasFeature "gr-pdu") then "ON" else "OFF"}"
     "-DENABLE_UNIT_TESTING=OFF"
 
     # gnss-sdr doesn't truly depend on BLAS or LAPACK, as long as
     # armadillo is built using both, so skip checking for them.
-    "-DBLAS=YES"
-    "-DLAPACK=YES"
     "-DBLAS_LIBRARIES=-lblas"
     "-DLAPACK_LIBRARIES=-llapack"
-
-    # Similarly, it doesn't actually use gfortran despite checking for
-    # its presence.
-    "-DGFORTRAN=YES"
   ];
 
   meta = with lib; {
diff --git a/pkgs/applications/radio/gnss-sdr/fix_libcpu_features_install_path.patch b/pkgs/applications/radio/gnss-sdr/fix_libcpu_features_install_path.patch
new file mode 100644
index 0000000000000..cfeb0bd416b40
--- /dev/null
+++ b/pkgs/applications/radio/gnss-sdr/fix_libcpu_features_install_path.patch
@@ -0,0 +1,47 @@
+--- a/CMakeLists.txt	1970-01-01 08:00:01.000000000 +0800
++++ b/CMakeLists.txt	2022-02-16 20:41:53.725290020 +0800
+@@ -1214,7 +1214,7 @@
+             BINARY_DIR ${CMAKE_BINARY_DIR}/volk_gnsssdr_module/build
+             CMAKE_ARGS ${VOLK_GNSSSDR_CMAKE_ARGS}
+                 -DCMAKE_BUILD_TYPE=$<$<CONFIG:None>:None>$<$<CONFIG:Debug>:Debug>$<$<CONFIG:Release>:Release>$<$<CONFIG:RelWithDebInfo>:RelWithDebInfo>$<$<CONFIG:MinSizeRel>:MinSizeRel>$<$<CONFIG:NoOptWithASM>:NoOptWithASM>$<$<CONFIG:Coverage>:Coverage>$<$<CONFIG:O2WithASM>:O2WithASM>$<$<CONFIG:O3WithASM>:O3WithASM>$<$<CONFIG:ASAN>:ASAN>
+-                -DCMAKE_INSTALL_LIBDIR=${CMAKE_INSTALL_LIBDIR}
++                -DCMAKE_INSTALL_LIBDIR=lib
+             DOWNLOAD_COMMAND ""
+             UPDATE_COMMAND ""
+             PATCH_COMMAND ""
+@@ -1247,7 +1247,7 @@
+                 )
+                 set(VOLK_GNSSSDR_BUILD_BYPRODUCTS
+                     ${VOLK_GNSSSDR_BUILD_BYPRODUCTS}
+-                    ${CMAKE_BINARY_DIR}/volk_gnsssdr_module/install/${CMAKE_INSTALL_LIBDIR}/${CMAKE_FIND_LIBRARY_PREFIXES}cpu_features${CMAKE_STATIC_LIBRARY_SUFFIX}
++                    ${CMAKE_BINARY_DIR}/volk_gnsssdr_module/install/lib/${CMAKE_FIND_LIBRARY_PREFIXES}cpu_features${CMAKE_STATIC_LIBRARY_SUFFIX}
+                 )
+             endif()
+             ExternalProject_Add(volk_gnsssdr_module
+@@ -1256,7 +1256,7 @@
+                 BINARY_DIR ${CMAKE_BINARY_DIR}/volk_gnsssdr_module/build
+                 CMAKE_ARGS ${VOLK_GNSSSDR_CMAKE_ARGS}
+                     -DCMAKE_BUILD_TYPE=$<$<CONFIG:None>:None>$<$<CONFIG:Debug>:Debug>$<$<CONFIG:Release>:Release>$<$<CONFIG:RelWithDebInfo>:RelWithDebInfo>$<$<CONFIG:MinSizeRel>:MinSizeRel>$<$<CONFIG:NoOptWithASM>:NoOptWithASM>$<$<CONFIG:Coverage>:Coverage>$<$<CONFIG:O2WithASM>:O2WithASM>$<$<CONFIG:O3WithASM>:O3WithASM>$<$<CONFIG:ASAN>:ASAN>
+-                    -DCMAKE_INSTALL_LIBDIR=${CMAKE_INSTALL_LIBDIR}
++                    -DCMAKE_INSTALL_LIBDIR=lib
+                 DOWNLOAD_COMMAND ""
+                 UPDATE_COMMAND ""
+                 PATCH_COMMAND ""
+@@ -1271,7 +1271,7 @@
+                 BINARY_DIR ${CMAKE_BINARY_DIR}/volk_gnsssdr_module/build
+                 CMAKE_ARGS ${VOLK_GNSSSDR_CMAKE_ARGS}
+                     -DCMAKE_BUILD_TYPE=$<$<CONFIG:None>:None>$<$<CONFIG:Debug>:Debug>$<$<CONFIG:Release>:Release>$<$<CONFIG:RelWithDebInfo>:RelWithDebInfo>$<$<CONFIG:MinSizeRel>:MinSizeRel>$<$<CONFIG:NoOptWithASM>:NoOptWithASM>$<$<CONFIG:Coverage>:Coverage>$<$<CONFIG:O2WithASM>:O2WithASM>$<$<CONFIG:O3WithASM>:O3WithASM>$<$<CONFIG:ASAN>:ASAN>
+-                    -DCMAKE_INSTALL_LIBDIR=${CMAKE_INSTALL_LIBDIR}
++                    -DCMAKE_INSTALL_LIBDIR=lib
+                 DOWNLOAD_COMMAND ""
+                 UPDATE_COMMAND ""
+                 PATCH_COMMAND ""
+@@ -1310,7 +1310,7 @@
+         if(CMAKE_VERSION VERSION_GREATER 3.0 AND SUPPORTED_CPU_FEATURES_ARCH)
+             if(NOT CpuFeatures_FOUND)
+                 set_target_properties(Volkgnsssdr::volkgnsssdr PROPERTIES
+-                    INTERFACE_LINK_LIBRARIES ${CMAKE_BINARY_DIR}/volk_gnsssdr_module/install/${CMAKE_INSTALL_LIBDIR}/${CMAKE_FIND_LIBRARY_PREFIXES}cpu_features${CMAKE_STATIC_LIBRARY_SUFFIX}
++                    INTERFACE_LINK_LIBRARIES ${CMAKE_BINARY_DIR}/volk_gnsssdr_module/install/lib/${CMAKE_FIND_LIBRARY_PREFIXES}cpu_features${CMAKE_STATIC_LIBRARY_SUFFIX}
+                 )
+             endif()
+         endif()
diff --git a/pkgs/applications/radio/gnuradio/3.8.nix b/pkgs/applications/radio/gnuradio/3.8.nix
index 63adbf04b0e4c..f3a56cfdb0550 100644
--- a/pkgs/applications/radio/gnuradio/3.8.nix
+++ b/pkgs/applications/radio/gnuradio/3.8.nix
@@ -251,7 +251,11 @@ stdenv.mkDerivation rec {
   ];
   passthru = shared.passthru // {
     # Deps that are potentially overriden and are used inside GR plugins - the same version must
-    inherit boost volk;
+    inherit
+      boost
+      volk
+      log4cpp
+    ;
   } // lib.optionalAttrs (hasFeature "gr-uhd") {
     inherit uhd;
   } // lib.optionalAttrs (hasFeature "gr-qtgui") {
diff --git a/pkgs/applications/radio/gnuradio/3.9.nix b/pkgs/applications/radio/gnuradio/3.9.nix
index 784ab7bd0fc23..638064bbd0729 100644
--- a/pkgs/applications/radio/gnuradio/3.9.nix
+++ b/pkgs/applications/radio/gnuradio/3.9.nix
@@ -275,7 +275,11 @@ stdenv.mkDerivation rec {
   ];
   passthru = shared.passthru // {
     # Deps that are potentially overriden and are used inside GR plugins - the same version must
-    inherit boost volk;
+    inherit
+      boost
+      volk
+      log4cpp
+    ;
   } // lib.optionalAttrs (hasFeature "gr-uhd") {
     inherit uhd;
   } // lib.optionalAttrs (hasFeature "gr-qtgui") {
diff --git a/pkgs/applications/radio/gnuradio/default.nix b/pkgs/applications/radio/gnuradio/default.nix
index 2865e8b70a104..eef1960ae1f48 100644
--- a/pkgs/applications/radio/gnuradio/default.nix
+++ b/pkgs/applications/radio/gnuradio/default.nix
@@ -49,12 +49,12 @@
 , versionAttr ? {
   major = "3.10";
   minor = "1";
-  patch = "0";
+  patch = "1";
 }
 }:
 
 let
-  sourceSha256 = "sha256-bU6z7H08G8QIToogAMI2P5tHBtVZezlBDqSbnEsqAjE=";
+  sourceSha256 = "sha256-vsAK+GQzcpA9Vsa6q4RFEzVpbF7/+yZkMsemKn6VhIg=";
   featuresInfo = {
     # Needed always
     basic = {
@@ -293,9 +293,15 @@ stdenv.mkDerivation rec {
   ];
   passthru = shared.passthru // {
     # Deps that are potentially overriden and are used inside GR plugins - the same version must
-    inherit boost volk;
+    inherit
+      boost
+      volk
+      spdlog
+    ;
   } // lib.optionalAttrs (hasFeature "gr-uhd") {
     inherit uhd;
+  } // lib.optionalAttrs (hasFeature "gr-pdu") {
+    inherit libiio libad9361;
   } // lib.optionalAttrs (hasFeature "gr-qtgui") {
     inherit (libsForQt5) qwt;
   };
diff --git a/pkgs/applications/radio/gqrx/default.nix b/pkgs/applications/radio/gqrx/default.nix
index 5fe7ddf813d68..28be25920a459 100644
--- a/pkgs/applications/radio/gqrx/default.nix
+++ b/pkgs/applications/radio/gqrx/default.nix
@@ -5,7 +5,6 @@
 , qt5
 , gnuradio3_8Minimal
 , thrift
-, log4cpp
 , mpir
 , fftwFloat
 , alsa-lib
@@ -39,7 +38,7 @@ gnuradio3_8Minimal.pkgs.mkDerivation rec {
     qt5.wrapQtAppsHook
   ];
   buildInputs = [
-    log4cpp
+    gnuradio3_8Minimal.unwrapped.log4cpp
     mpir
     fftwFloat
     alsa-lib
diff --git a/pkgs/applications/radio/qradiolink/default.nix b/pkgs/applications/radio/qradiolink/default.nix
index 6960eba6a57d1..567a587e6d5bc 100644
--- a/pkgs/applications/radio/qradiolink/default.nix
+++ b/pkgs/applications/radio/qradiolink/default.nix
@@ -7,7 +7,6 @@
 , thrift
 # Not gnuradioPackages'
 , codec2
-, log4cpp
 , gmp
 , gsm
 , libopus
@@ -48,7 +47,7 @@ gnuradio3_8.pkgs.mkDerivation rec {
   buildInputs = [
     gnuradio3_8.unwrapped.boost
     codec2
-    log4cpp
+    gnuradio3_8.unwrapped.log4cpp
     gmp
     libpulseaudio
     libconfig
diff --git a/pkgs/applications/science/logic/lean/default.nix b/pkgs/applications/science/logic/lean/default.nix
index 806a3c34df156..22e755bd852e9 100644
--- a/pkgs/applications/science/logic/lean/default.nix
+++ b/pkgs/applications/science/logic/lean/default.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "lean";
-  version = "3.39.1";
+  version = "3.39.2";
 
   src = fetchFromGitHub {
     owner  = "leanprover-community";
@@ -11,8 +11,8 @@ stdenv.mkDerivation rec {
     # from. this is then used to check whether an olean file should be
     # rebuilt. don't use a tag as rev because this will get replaced into
     # src/githash.h.in in preConfigure.
-    rev    = "1781ded0d0062f40a7eaf3ead8dcbef4429c6321";
-    sha256 = "0xdpbfjfa1q4cnf87nl7l760ivr4agpqmy3i1f2b132sgbjzm1xx";
+    rev    = "402f41cdedbd46a368fb7807bebe83550d887631";
+    sha256 = "0jddakr07ixspw19xblpj1882vxxaljg3fflhn4myvigwzkav334";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/version-management/git-lfs/default.nix b/pkgs/applications/version-management/git-lfs/default.nix
index 39b52cd7fa677..9f0126d9ac4c8 100644
--- a/pkgs/applications/version-management/git-lfs/default.nix
+++ b/pkgs/applications/version-management/git-lfs/default.nix
@@ -2,13 +2,13 @@
 
 buildGoPackage rec {
   pname = "git-lfs";
-  version = "3.1.1";
+  version = "3.1.2";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "git-lfs";
     repo = "git-lfs";
-    sha256 = "sha256-xXE0BCO1Ur5qhn0gOKOqaSGKNeXNEHD+pZCz1SoPD3A=";
+    sha256 = "sha256-IEo8poEYPjAbBGk+SQdJqyhwgMYjNLdibI+AktVIg1g=";
   };
 
   goPackagePath = "github.com/git-lfs/git-lfs";
diff --git a/pkgs/applications/virtualization/colima/default.nix b/pkgs/applications/virtualization/colima/default.nix
index 4845b1b6466a3..e83fc4ef50183 100644
--- a/pkgs/applications/virtualization/colima/default.nix
+++ b/pkgs/applications/virtualization/colima/default.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "colima";
-  version = "0.3.2";
+  version = "0.3.3";
 
   src = fetchFromGitHub {
     owner = "abiosoft";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-hZ5BqNHQAMzL69ptpbTT+fN4NdV4AFhboCL2t1sF5AQ=";
+    sha256 = "sha256-nov+DIaeYaRJy7Cz1hcKJUA88IKlZ4z/tn4WASZjxLI=";
   };
 
   nativeBuildInputs = [ installShellFiles makeWrapper ];
diff --git a/pkgs/data/misc/geolite-legacy/builder.sh b/pkgs/data/misc/geolite-legacy/builder.sh
deleted file mode 100644
index 0bb61d863ecea..0000000000000
--- a/pkgs/data/misc/geolite-legacy/builder.sh
+++ /dev/null
@@ -1,20 +0,0 @@
-source "$stdenv/setup"
-
-mkdir -p $out/share/GeoIP
-cd $out/share/GeoIP
-
-# Iterate over all environment variable names beginning with "src":
-for var in "${!src@}"; do
-    # Store the value of the variable with name $var in $src:
-    eval src="\$$var"
-
-    # Copy $src to current directory, removing Nix hash from the filename:
-    dest="${src##*/}"
-    dest="${dest#*-}"
-    cp "$src" "$dest"
-done
-
-gzip -dv *.gz
-
-ln -s GeoLiteCity.dat GeoIPCity.dat
-ln -s GeoLiteCityv6.dat GeoIPCityv6.dat
diff --git a/pkgs/data/misc/geolite-legacy/default.nix b/pkgs/data/misc/geolite-legacy/default.nix
index 735a660894926..ad9560da9a481 100644
--- a/pkgs/data/misc/geolite-legacy/default.nix
+++ b/pkgs/data/misc/geolite-legacy/default.nix
@@ -1,41 +1,34 @@
-{ lib, stdenv, fetchurl }:
+{ lib, stdenv, fetchurl, zstd }:
 
-let
-  fetchDB = src: sha256: fetchurl {
-    inherit sha256;
-    url = "https://geolite.maxmind.com/download/geoip/database/${src}";
-  };
-in
 stdenv.mkDerivation {
   pname = "geolite-legacy";
-  version = "2017-12-02";
+  version = "2022-01-25";
+
+  # We use Arch Linux package as a snapshot, because upstream database is updated in-place.
+  geoip = fetchurl {
+    url = "https://archive.archlinux.org/packages/g/geoip-database/geoip-database-20220125-1-any.pkg.tar.zst";
+    sha256 = "sha256-ieuLpllJTHYu28UXBGfDWbnr9Ei8pGnos+RPWDsAGcM=";
+  };
 
-  srcGeoIP = fetchDB
-    "GeoLiteCountry/GeoIP.dat.gz"
-    "1nggml11wzlanmzk6wbw2kla91fj8ggd9kh9yz42lnyckdlf5ac4";
-  srcGeoIPv6 = fetchDB
-    "GeoIPv6.dat.gz"
-    "0w809xgmr5zi4fgm9q3lhrnh1vl62s49n737bhq4jplm5918ki50";
-  srcGeoLiteCity = fetchDB
-    "GeoLiteCity.dat.gz"
-    "0cibajsv5xdjpw1qfx22izm5azqcj0d7nvk39irgwflkim9jfjbs";
-  srcGeoLiteCityv6 = fetchDB
-    "GeoLiteCityv6-beta/GeoLiteCityv6.dat.gz"
-    "1ldwbzgs64irfgb3kq3jp8fmhwmwqk713dr4kkdqlglrblr9hfkc";
-  srcGeoIPASNum = fetchDB
-    "asnum/GeoIPASNum.dat.gz"
-    "06qqs8qr8vxqwd80npz7n66k3bpc1vs7w43i2bb4k0di5yxnjwr9";
-  srcGeoIPASNumv6 = fetchDB
-    "asnum/GeoIPASNumv6.dat.gz"
-    "1qyq4h8cja62giv6q1qqc502vsq53wzz1kx80mgvwngmycrxa21k";
+  extra = fetchurl {
+    url = "https://archive.archlinux.org/packages/g/geoip-database-extra/geoip-database-extra-20220125-1-any.pkg.tar.zst";
+    sha256 = "sha256-xrTnuJvuvtvn+uIARtbuJUlHco3Q+9BXLljt35V3ip0=";
+  };
+
+  nativeBuildInputs = [ zstd ];
+
+  buildCommand = ''
+    tar -xaf "$geoip"
+    tar -xaf "$extra"
+    mkdir -p $out/share
+    mv usr/share/GeoIP $out/share
+  '';
 
   meta = with lib; {
     description = "GeoLite Legacy IP geolocation databases";
-    homepage = "https://geolite.maxmind.com/download/geoip";
-    license = licenses.cc-by-sa-30;
+    homepage = "https://mailfud.org/geoip-legacy/";
+    license = licenses.cc-by-sa-40;
     platforms = platforms.all;
     maintainers = with maintainers; [ fpletz ];
   };
-
-  builder = ./builder.sh;
 }
diff --git a/pkgs/development/interpreters/clojure/babashka.nix b/pkgs/development/interpreters/clojure/babashka.nix
index 51314db3f9fca..ca2391ebd25d2 100644
--- a/pkgs/development/interpreters/clojure/babashka.nix
+++ b/pkgs/development/interpreters/clojure/babashka.nix
@@ -2,11 +2,11 @@
 
 buildGraalvmNativeImage rec {
   pname = "babashka";
-  version = "0.7.4";
+  version = "0.7.5";
 
   src = fetchurl {
     url = "https://github.com/babashka/${pname}/releases/download/v${version}/${pname}-${version}-standalone.jar";
-    sha256 = "sha256-GphF32CFxZYaoTG1k9pP+cRNs/PIKtwevTcIyjG7CpQ=";
+    sha256 = "sha256-ap6YCRUqtIgh36eTIk5BSjUildvYhqkC48Y4dxNMU8c=";
   };
 
   executable = "bb";
diff --git a/pkgs/development/libraries/cpp-utilities/default.nix b/pkgs/development/libraries/cpp-utilities/default.nix
index 3eae15c58d0af..a3de08a838bc9 100644
--- a/pkgs/development/libraries/cpp-utilities/default.nix
+++ b/pkgs/development/libraries/cpp-utilities/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cpp-utilities";
-  version = "5.12.0";
+  version = "5.13.0";
 
   src = fetchFromGitHub {
     owner = "Martchus";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-rpbD3x7zIJCDZuu4K0wDkaBKSBh36amtza/wE3rb0HM=";
+    sha256 = "sha256-R22nWkI778LpCK3a5C6tvuIsEXU49wPya1fFQxdpocg=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/volk/default.nix b/pkgs/development/libraries/volk/default.nix
index bbc4189fff84d..c795d783894e9 100644
--- a/pkgs/development/libraries/volk/default.nix
+++ b/pkgs/development/libraries/volk/default.nix
@@ -10,6 +10,8 @@
 
 stdenv.mkDerivation rec {
   pname = "volk";
+  # Version 2.5.1 seems to cause a build issue for aarch64-darwin, see:
+  # https://github.com/NixOS/nixpkgs/pull/160152#issuecomment-1043380478A
   version = "2.5.0";
 
   src = fetchFromGitHub {
diff --git a/pkgs/development/libraries/webkitgtk/default.nix b/pkgs/development/libraries/webkitgtk/default.nix
index 0894457f98163..b5a16df21add6 100644
--- a/pkgs/development/libraries/webkitgtk/default.nix
+++ b/pkgs/development/libraries/webkitgtk/default.nix
@@ -64,7 +64,7 @@ assert enableGeoLocation -> geoclue2 != null;
 
 stdenv.mkDerivation rec {
   pname = "webkitgtk";
-  version = "2.34.5";
+  version = "2.34.6";
 
   outputs = [ "out" "dev" ];
 
@@ -72,7 +72,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://webkitgtk.org/releases/${pname}-${version}.tar.xz";
-    sha256 = "sha256-aJMGQ696R6OvBfRtZueEQiQzdT2rM10ygvMZqFpWKbQ=";
+    sha256 = "sha256-a8j9A0qtBDKiRZzk/H7iWtZaSSTGGL+Nk7UrDBqEwfY=";
   };
 
   patches = lib.optionals stdenv.isLinux [
diff --git a/pkgs/development/ocaml-modules/stdcompat/default.nix b/pkgs/development/ocaml-modules/stdcompat/default.nix
index 2e62669571483..0f3b5377fc519 100644
--- a/pkgs/development/ocaml-modules/stdcompat/default.nix
+++ b/pkgs/development/ocaml-modules/stdcompat/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ocaml${ocaml.version}-stdcompat";
-  version = "15";
+  version = "18";
 
   src = fetchurl {
     url = "https://github.com/thierry-martinez/stdcompat/releases/download/v${version}/stdcompat-${version}.tar.gz";
-    sha256 = "1xcwb529m4lg9cbnxa9m3x2nnl9nxzz1x5lxpvdfflg4zxl6yx2y";
+    sha256 = "sha256:01y67rndjlzfp5zq0gbqpg9skqq2hfbvhbq9lfhhk5xidr98sfj8";
   };
 
   buildInputs = [ ocaml findlib ];
diff --git a/pkgs/development/python-modules/adafruit-platformdetect/default.nix b/pkgs/development/python-modules/adafruit-platformdetect/default.nix
index 52ecac90b10b4..a93137f136b86 100644
--- a/pkgs/development/python-modules/adafruit-platformdetect/default.nix
+++ b/pkgs/development/python-modules/adafruit-platformdetect/default.nix
@@ -6,13 +6,13 @@
 
 buildPythonPackage rec {
   pname = "adafruit-platformdetect";
-  version = "3.19.5";
+  version = "3.19.6";
   format = "setuptools";
 
   src = fetchPypi {
     pname = "Adafruit-PlatformDetect";
     inherit version;
-    sha256 = "sha256-vbiMD0En11VDJUGnEc5ww0AhQ12vkbTCm/pqF7wnywI=";
+    sha256 = "sha256-Y9g0A9pVjEVcITyaQsyAew6rraTPwZuevSsDD46c0DM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/braintree/default.nix b/pkgs/development/python-modules/braintree/default.nix
index 8cf820edbfec3..c88f6712f7967 100644
--- a/pkgs/development/python-modules/braintree/default.nix
+++ b/pkgs/development/python-modules/braintree/default.nix
@@ -1,22 +1,43 @@
-{ lib,
-  fetchPypi,
-  requests,
-  buildPythonPackage
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, nose
+, pytestCheckHook
+, pythonOlder
+, requests
 }:
 
 buildPythonPackage rec {
   pname = "braintree";
-  version = "4.13.1";
+  version = "4.14.0";
+  format = "setuptools";
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "4f6addf89f5cd6123243ddc89db325e50fceec825845901dad553fde115bd938";
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = pname;
+    repo = "braintree_python";
+    rev = version;
+    hash = "sha256-qeqQX+qyy78sLe+46CA4D6VAxNHUVahS4LMYdGDzc2k=";
   };
 
-  propagatedBuildInputs = [ requests ];
+  propagatedBuildInputs = [
+    requests
+  ];
+
+  checkInputs = [
+    nose
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "braintree"
+  ];
 
-  # pypi release does not include tests
-  doCheck = false;
+  disabledTestPaths = [
+    # Don't test integrations
+    "tests/integration"
+  ];
 
   meta = with lib; {
     description = "Python library for integration with Braintree";
diff --git a/pkgs/development/python-modules/databases/default.nix b/pkgs/development/python-modules/databases/default.nix
index e85bdd7868c90..518d2066853ad 100644
--- a/pkgs/development/python-modules/databases/default.nix
+++ b/pkgs/development/python-modules/databases/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "databases";
-  version = "0.5.4";
+  version = "0.5.5";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "encode";
     repo = pname;
     rev = version;
-    hash = "sha256-67ykx7HKGgRvJ+GRVEI/e2+x51kfHHFjh/iI4tY+6aE=";
+    hash = "sha256-NOXK1UCQzqvJRfzsgIfpihuD9oF52sMD+BxqUHWF8Rk=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/gdown/default.nix b/pkgs/development/python-modules/gdown/default.nix
index 37cd3629db4fe..180624ea8168e 100644
--- a/pkgs/development/python-modules/gdown/default.nix
+++ b/pkgs/development/python-modules/gdown/default.nix
@@ -11,12 +11,12 @@
 
 buildPythonApplication rec {
   pname = "gdown";
-  version = "4.2.1";
+  version = "4.3.0";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-X3onSr8PN3D24lMtKG2Y/RiKbD1qSq2n0YVO8Y5H5K4=";
+    sha256 = "sha256-KswYue892Mlpa8wnPf9bt8MEJGtjGaMjlDt0TXGoEdE=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/ormar/default.nix b/pkgs/development/python-modules/ormar/default.nix
index fee9af147154e..d5b9b7cf88e82 100644
--- a/pkgs/development/python-modules/ormar/default.nix
+++ b/pkgs/development/python-modules/ormar/default.nix
@@ -1,37 +1,39 @@
 { lib
-, buildPythonPackage
-, pythonOlder
-, fetchFromGitHub
-, poetry-core
-, databases
-, pydantic
-, sqlalchemy
-, asyncpg
-, psycopg2
 , aiomysql
+, aiopg
 , aiosqlite
+, asyncpg
+, buildPythonPackage
 , cryptography
-, orjson
-, typing-extensions
+, databases
+, fastapi
+, fetchFromGitHub
 , importlib-metadata
-, aiopg
 , mysqlclient
+, orjson
+, poetry-core
+, psycopg2
+, pydantic
 , pymysql
-, pytestCheckHook
 , pytest-asyncio
-, fastapi
+, pytestCheckHook
+, pythonOlder
+, sqlalchemy
+, typing-extensions
 }:
 
 buildPythonPackage rec {
   pname = "ormar";
-  version = "0.10.23";
+  version = "0.10.24";
   format = "pyproject";
+
   disabled = pythonOlder "3.7";
+
   src = fetchFromGitHub {
     owner = "collerek";
     repo = pname;
     rev = version;
-    sha256 = "sha256-ILJvJyd56lqlKq7+mUz26LvusYb5AOOfoA7OgNq2fT0=";
+    hash = "sha256-zKugeGDcYDI4VKspJPWeZCBubTqMxxfOVQCuF4pC49E=";
   };
 
   nativeBuildInputs = [
@@ -39,16 +41,15 @@ buildPythonPackage rec {
   ];
 
   propagatedBuildInputs = [
-    databases
-    pydantic
-    sqlalchemy
-    asyncpg
-    psycopg2
     aiomysql
     aiosqlite
+    asyncpg
     cryptography
-
+    databases
     orjson
+    psycopg2
+    pydantic
+    sqlalchemy
   ] ++ lib.optionals (pythonOlder "3.8") [
     typing-extensions
     importlib-metadata
@@ -56,24 +57,35 @@ buildPythonPackage rec {
 
   checkInputs = [
     aiomysql
-    aiosqlite
     aiopg
+    aiosqlite
     asyncpg
-
-    psycopg2
+    fastapi
     mysqlclient
+    psycopg2
     pymysql
-
-    pytestCheckHook
     pytest-asyncio
-    fastapi
+    pytestCheckHook
+  ];
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace 'SQLAlchemy = ">=1.3.18,<=1.4.29"' 'SQLAlchemy = ">=1.3.18"' \
+      --replace 'databases = ">=0.3.2,!=0.5.0,!=0.5.1,!=0.5.2,!=0.5.3,<0.5.5"' 'databases = ">=0.5.5"'
+  '';
+
+  disabledTests = [
+    # TypeError: Object of type bytes is not JSON serializable
+    "test_bulk_operations_with_json"
   ];
 
-  pythonImportsCheck = [ "ormar" ];
+  pythonImportsCheck = [
+    "ormar"
+  ];
 
   meta = with lib; {
     homepage = "https://github.com/collerek/ormar";
-    description = "A simple async ORM with fastapi in mind and pydantic validation.";
+    description = "Async ORM with fastapi in mind and pydantic validation";
     license = licenses.mit;
     maintainers = with maintainers; [ andreasfelix ];
   };
diff --git a/pkgs/development/python-modules/pycfmodel/default.nix b/pkgs/development/python-modules/pycfmodel/default.nix
index 320e6d51c7aca..57282010eb78b 100644
--- a/pkgs/development/python-modules/pycfmodel/default.nix
+++ b/pkgs/development/python-modules/pycfmodel/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "pycfmodel";
-  version = "0.13.0";
+  version = "0.16.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "Skyscanner";
     repo = pname;
     rev = version;
-    hash = "sha256-BlnLf0C/wxPXhoAH0SRB22eGWbbZ05L20rNy6qfOI+A=";
+    hash = "sha256-44G1H6bOtqVkplaX/sHxEzErlunclLh97OPO0m6n9eM=";
   };
 
   propagatedBuildInputs = [
@@ -33,6 +33,9 @@ buildPythonPackage rec {
   disabledTests = [
     # Test require network access
     "test_cloudformation_actions"
+    "test_auxiliar_cast"
+    "test_valid_es_domain_from_aws_documentation_examples_resource_can_be_built"
+    "test_valid_opensearch_domain_from_aws_documentation_examples_resource_can_be_built"
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/pypck/default.nix b/pkgs/development/python-modules/pypck/default.nix
index ae297389bb158..724be70163abf 100644
--- a/pkgs/development/python-modules/pypck/default.nix
+++ b/pkgs/development/python-modules/pypck/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "pypck";
-  version = "0.7.13";
+  version = "0.7.14";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "alengwenus";
     repo = pname;
     rev = version;
-    sha256 = "sha256-Gbz+3Hq4yStlTI7UxB4NBZigUzZjSJFFcwdzWtbGnio=";
+    sha256 = "sha256-v8eCCbSnAmJUmHSNS+lz8JRhDFrqyxgAkgcZ2bzfOTg=";
   };
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/pysimplegui/default.nix b/pkgs/development/python-modules/pysimplegui/default.nix
index ecc396d1b0fef..d645a068d291c 100644
--- a/pkgs/development/python-modules/pysimplegui/default.nix
+++ b/pkgs/development/python-modules/pysimplegui/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "pysimplegui";
-  version = "4.56.0";
+  version = "4.57.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -15,7 +15,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "PySimpleGUI";
     inherit version;
-    sha256 = "1a13a19282f92626cc6a823cbe9f4aa08aa558870f03441a1c4e8b6cef27c9d5";
+    sha256 = "sha256-+Dcrv+esnthI74AFLK47sS2qI4sPvihuQlL54Zo32RM=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/python-songpal/default.nix b/pkgs/development/python-modules/python-songpal/default.nix
index ba17dd81166d9..715bf164a4b32 100644
--- a/pkgs/development/python-modules/python-songpal/default.nix
+++ b/pkgs/development/python-modules/python-songpal/default.nix
@@ -2,7 +2,6 @@
 , buildPythonPackage
 , pythonOlder
 , fetchFromGitHub
-, fetchpatch
 , poetry-core
 , aiohttp
 , async-upnp-client
@@ -13,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "python-songpal";
-  version = "0.13";
+  version = "0.14";
 
   format = "pyproject";
 
@@ -23,24 +22,9 @@ buildPythonPackage rec {
     owner = "rytilahti";
     repo = "python-songpal";
     rev = version;
-    sha256 = "124w6vfn992845k09bjv352havk8pg590b135m37h1x1m7fmbpwa";
+    hash = "sha256-yuCtz1B5bj3mWz4eP2GXzoaHuIQ47tIWn19jkZN54lw=";
   };
 
-  patches = [
-    # https://github.com/rytilahti/python-songpal/pull/90
-    (fetchpatch {
-      name = "switch-to-poetry-core.patch";
-      url = "https://github.com/rytilahti/python-songpal/commit/56b634790d94b2f9788d5af3d5cedff47f1e42c2.patch";
-      sha256 = "0yc0mrb91ywk77nd4mxvyc0p2kjz2w1p395755a32ls30zw2bs27";
-    })
-  ];
-
-  postPatch = ''
-    # https://github.com/rytilahti/python-songpal/issues/91
-    substituteInPlace pyproject.toml \
-      --replace 'click = "^7"' 'click = "*"'
-  '';
-
   nativeBuildInputs = [
     poetry-core
   ];
diff --git a/pkgs/development/python-modules/seatconnect/default.nix b/pkgs/development/python-modules/seatconnect/default.nix
index bc02e81e2ba67..25b1773472fff 100644
--- a/pkgs/development/python-modules/seatconnect/default.nix
+++ b/pkgs/development/python-modules/seatconnect/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "seatconnect";
-  version = "1.1.5";
+  version = "1.1.6";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "farfar";
     repo = pname;
     rev = version;
-    hash = "sha256-NA/UiapJ/SyUmrj9hd2xGV5WWy1KhxwQtqGLV73TfHk=";
+    hash = "sha256-8ZqqNDLygHgtUzTgdb34+4BHuStXJXnl9fBfo0WSNZw=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
diff --git a/pkgs/development/python-modules/slack-sdk/default.nix b/pkgs/development/python-modules/slack-sdk/default.nix
index 3c88cc9e7fad6..196d3641eeb44 100644
--- a/pkgs/development/python-modules/slack-sdk/default.nix
+++ b/pkgs/development/python-modules/slack-sdk/default.nix
@@ -20,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "slack-sdk";
-  version = "3.14.1";
+  version = "3.15.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -29,7 +29,7 @@ buildPythonPackage rec {
     owner = "slackapi";
     repo = "python-slack-sdk";
     rev = "v${version}";
-    sha256 = "sha256-KhEfD8k7qQMfY2ErqApn1K1lhIJgBiVBjjWKL2DjNdg=";
+    sha256 = "sha256-ndJdf8BGYfJsLVWqp00YD4vndS3n24UBm06ibcVRMpY=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/tools/analysis/checkov/default.nix b/pkgs/development/tools/analysis/checkov/default.nix
index b28ac95ab61cb..9d19aaa184af6 100644
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@@ -32,13 +32,13 @@ with py.pkgs;
 
 buildPythonApplication rec {
   pname = "checkov";
-  version = "2.0.859";
+  version = "2.0.866";
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = pname;
     rev = version;
-    hash = "sha256-uvuAMD/upr8mvK/YCvvlPGIZBMZ0SHxXMdv18NIsOYM=";
+    hash = "sha256-ASaRZO5/4IGT6GPQTMmwGao4Q+yuyiLO9eGV3Dy8mLQ=";
   };
 
   nativeBuildInputs = with py.pkgs; [
diff --git a/pkgs/development/tools/analysis/flow/default.nix b/pkgs/development/tools/analysis/flow/default.nix
index 0b1b3dfb8ef83..36c8528570419 100644
--- a/pkgs/development/tools/analysis/flow/default.nix
+++ b/pkgs/development/tools/analysis/flow/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "flow";
-  version = "0.171.0";
+  version = "0.172.0";
 
   src = fetchFromGitHub {
     owner = "facebook";
     repo = "flow";
     rev = "v${version}";
-    sha256 = "sha256-g/i2ZeIzitL35x3QoL+Rng3M0AiYgsBQ8TQY35Jmboc=";
+    sha256 = "sha256-N3mP1dhul7Ljn278CJmge4IrVllQJsc73A3/7mTSU70=";
   };
 
   installPhase = ''
diff --git a/pkgs/development/tools/buildah/default.nix b/pkgs/development/tools/buildah/default.nix
index ec3f4de5e11e3..ea6f866a48b12 100644
--- a/pkgs/development/tools/buildah/default.nix
+++ b/pkgs/development/tools/buildah/default.nix
@@ -14,13 +14,13 @@
 
 buildGoModule rec {
   pname = "buildah";
-  version = "1.24.1";
+  version = "1.24.2";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "buildah";
     rev = "v${version}";
-    sha256 = "sha256-Dl1ZTYzwZ3tl5k9uPnnKHObmTP6Xsw0P1LdPqCfd/d0=";
+    sha256 = "sha256-gBO+H26YGmOtP3CUHZjynAaOb0h+MJbJnWqxOZdif6w=";
   };
 
   outputs = [ "out" "man" ];
diff --git a/pkgs/development/tools/esbuild/default.nix b/pkgs/development/tools/esbuild/default.nix
index 58f7de000bec7..679c9a6cc9c24 100644
--- a/pkgs/development/tools/esbuild/default.nix
+++ b/pkgs/development/tools/esbuild/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "esbuild";
-  version = "0.14.21";
+  version = "0.14.22";
 
   src = fetchFromGitHub {
     owner = "evanw";
     repo = "esbuild";
     rev = "v${version}";
-    sha256 = "sha256-O+S8oj9gthrJ+OXSP5b/RRczLuRVFsA3u26ii2bcagk=";
+    sha256 = "sha256-1/SVcXp5mcfJ8X0Ev+48S5w1kn7RrFqsFSBqjo3mxcI=";
   };
 
   vendorSha256 = "sha256-QPkBR+FscUc3jOvH7olcGUhM6OW4vxawmNJuRQxPuGs=";
diff --git a/pkgs/development/tools/golangci-lint/default.nix b/pkgs/development/tools/golangci-lint/default.nix
index 122b4e0831eb3..6334c00fc0bbc 100644
--- a/pkgs/development/tools/golangci-lint/default.nix
+++ b/pkgs/development/tools/golangci-lint/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "golangci-lint";
-  version = "1.44.0";
+  version = "1.44.2";
 
   src = fetchFromGitHub {
     owner = "golangci";
     repo = "golangci-lint";
     rev = "v${version}";
-    sha256 = "sha256-2hEru7fnc8v7F/RrOB3jFdfLPYLpm0OupzJP6iORs+U=";
+    sha256 = "sha256-RMZZLvCJcTMzHOzUfT6aEC21T5dCwu1YOUuQ9PLS3fc=";
   };
 
-  vendorSha256 = "sha256-DLvhkTYCaXfNfehEgCNKSKlKaGHo623wBnEhNeTJbmQ=";
+  vendorSha256 = "sha256-X2hZ4BQgYHI1mx/Ywky0oo7IMtrppu+rLq2LRLPH3fY=";
 
   doCheck = false;
 
diff --git a/pkgs/development/tools/ocaml/dune/3.nix b/pkgs/development/tools/ocaml/dune/3.nix
new file mode 100644
index 0000000000000..59ea9c43512f6
--- /dev/null
+++ b/pkgs/development/tools/ocaml/dune/3.nix
@@ -0,0 +1,40 @@
+{ lib, stdenv, fetchurl, ocaml, findlib, darwin }:
+
+if lib.versionOlder ocaml.version "4.08"
+then throw "dune 3 is not available for OCaml ${ocaml.version}"
+else
+
+stdenv.mkDerivation rec {
+  pname = "dune";
+  version = "3.0.2";
+
+  src = fetchurl {
+    url = "https://github.com/ocaml/dune/releases/download/${version}/fiber-${version}.tbz";
+    sha256 = "sha256-o108qIeWMOX0VU/wWdc5bg/UDCT2CCcw/Xx3nFiDbes=";
+  };
+
+  nativeBuildInputs = [ ocaml findlib ];
+
+  buildInputs = lib.optionals stdenv.isDarwin [
+    darwin.apple_sdk.frameworks.Foundation
+  ];
+
+  strictDeps = true;
+
+  buildFlags = "release";
+
+  dontAddPrefix = true;
+  dontAddStaticConfigureFlags = true;
+  configurePlatforms = [];
+
+  installFlags = [ "PREFIX=${placeholder "out"}" "LIBDIR=$(OCAMLFIND_DESTDIR)" ];
+
+  meta = {
+    homepage = "https://dune.build/";
+    description = "A composable build system";
+    changelog = "https://github.com/ocaml/dune/raw/${version}/CHANGES.md";
+    maintainers = [ lib.maintainers.vbgl lib.maintainers.marsam ];
+    license = lib.licenses.mit;
+    inherit (ocaml.meta) platforms;
+  };
+}
diff --git a/pkgs/misc/vscode-extensions/default.nix b/pkgs/misc/vscode-extensions/default.nix
index 3db0f9d952671..3e5bf42dd958c 100644
--- a/pkgs/misc/vscode-extensions/default.nix
+++ b/pkgs/misc/vscode-extensions/default.nix
@@ -1417,6 +1417,23 @@ let
         };
       };
 
+      ms-pyright.pyright = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "pyright";
+          publisher = "ms-pyright";
+          version = "1.1.222";
+          sha256 = "sha256-QMX/SawDEnG1xVrug8mvN7EvRrRDkJffcXBUFpQi1XE=";
+        };
+        meta = with lib; {
+          description = "VS Code static type checking for Python";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=ms-pyright.pyright";
+          homepage = "https://github.com/Microsoft/pyright#readme";
+          changelog = "https://marketplace.visualstudio.com/items/ms-pyright.pyright/changelog";
+          license = licenses.mit;
+          maintainers = with maintainers; [ ratsclub ];
+        };
+      };
+
       ms-python.python = callPackage ./python {
         extractNuGet = callPackage ./python/extract-nuget.nix { };
       };
diff --git a/pkgs/servers/sql/postgresql/ext/postgis.nix b/pkgs/servers/sql/postgresql/ext/postgis.nix
index dbb800a276062..d0dfa5d00f566 100644
--- a/pkgs/servers/sql/postgresql/ext/postgis.nix
+++ b/pkgs/servers/sql/postgresql/ext/postgis.nix
@@ -15,13 +15,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "postgis";
-  version = "3.2.0";
+  version = "3.2.1";
 
   outputs = [ "out" "doc" ];
 
   src = fetchurl {
     url = "https://download.osgeo.org/postgis/source/postgis-${version}.tar.gz";
-    sha256 = "sha256-ernhVMaUfAz/uPoS1wgGrdmqBg5itshqLiBvnUtQfP0=";
+    sha256 = "sha256-+6to3ebKOTSyS6CMirDP8llPV/k96rQaFcgq4btpiT4=";
   };
 
   buildInputs = [ libxml2 postgresql geos proj gdal json_c protobufc ]
diff --git a/pkgs/tools/admin/aliyun-cli/default.nix b/pkgs/tools/admin/aliyun-cli/default.nix
index 73af7f9354518..5b929a0b79c8c 100644
--- a/pkgs/tools/admin/aliyun-cli/default.nix
+++ b/pkgs/tools/admin/aliyun-cli/default.nix
@@ -2,14 +2,14 @@
 
 buildGoModule rec {
   pname = "aliyun-cli";
-  version = "3.0.107";
+  version = "3.0.108";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "aliyun";
     repo = pname;
     fetchSubmodules = true;
-    sha256 = "sha256-B9tqebSaOoHIOc/eZa1eh+B0T7LJOtVwYy7QwNt9k90=";
+    sha256 = "sha256-hbT7pG4IRIzFzbaUVnCpSb5h13h2158cbGf2qn8c268=";
   };
 
   vendorSha256 = "sha256-c7LsCNcxdHwDBEknXJt9AyrmFcem8YtUYy06vNDBdDY=";
diff --git a/pkgs/tools/admin/synapse-admin/default.nix b/pkgs/tools/admin/synapse-admin/default.nix
index 4248e62adebf8..52b2183222ed9 100644
--- a/pkgs/tools/admin/synapse-admin/default.nix
+++ b/pkgs/tools/admin/synapse-admin/default.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "synapse-admin";
-  version = "0.8.3";
+  version = "0.8.4";
 
   src = fetchzip {
     url = "https://github.com/Awesome-Technologies/synapse-admin/releases/download/${version}/synapse-admin-${version}.tar.gz";
-    hash = "sha256-LAdMxzUffnykiDHvQYu9uNxK4428Q9CxQY2q02AcUco=";
+    hash = "sha256-hRjguUQUK7tB4VWVKRid4sRTIF/ulm9RmNA6RNUfaak=";
   };
 
   installPhase = ''
diff --git a/pkgs/tools/networking/findomain/default.nix b/pkgs/tools/networking/findomain/default.nix
index 70f1da0dc23a3..108cd769a735f 100644
--- a/pkgs/tools/networking/findomain/default.nix
+++ b/pkgs/tools/networking/findomain/default.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "findomain";
-  version = "6.1.0";
+  version = "7.0.0";
 
   src = fetchFromGitHub {
     owner = "Edu4rdSHL";
     repo = pname;
     rev = version;
-    sha256 = "sha256-oXynemPs41C4m0GAT1m5Jz5lqMNQWn4j7VcMwH6rg4E=";
+    sha256 = "sha256-dxOR+rgTaSgauVBz5PgSn8MPmsdQTEGH7h5bXFIT7wM=";
   };
 
-  cargoSha256 = "sha256-Akn2G13OuHLURYJYqypZvIfwcO3Dv/tm6XyxGMAFr1w=";
+  cargoSha256 = "sha256-w8+wn8jnsEZAkMEZRWMaytskhG+noMPjk4+U+SdghMQ=";
 
   nativeBuildInputs = [ installShellFiles perl ];
   buildInputs = lib.optionals stdenv.isDarwin [ libiconv Security ];
diff --git a/pkgs/tools/security/cfripper/default.nix b/pkgs/tools/security/cfripper/default.nix
index 1544194983d12..8959d6627de4f 100644
--- a/pkgs/tools/security/cfripper/default.nix
+++ b/pkgs/tools/security/cfripper/default.nix
@@ -3,7 +3,27 @@
 , python3
 }:
 
-python3.pkgs.buildPythonApplication rec {
+let
+  py = python3.override {
+    packageOverrides = self: super: {
+
+      # pycfmodel is pinned, https://github.com/Skyscanner/cfripper/issues/204
+      pycfmodel = super.pycfmodel.overridePythonAttrs (oldAttrs: rec {
+        version = "0.13.0";
+
+        src = fetchFromGitHub {
+          owner = "Skyscanner";
+          repo = "pycfmodel";
+          rev = version;
+          hash = "sha256-BlnLf0C/wxPXhoAH0SRB22eGWbbZ05L20rNy6qfOI+A=";
+        };
+      });
+    };
+  };
+in
+with py.pkgs;
+
+buildPythonApplication rec {
   pname = "cfripper";
   version = "1.3.3";
 
@@ -14,7 +34,7 @@ python3.pkgs.buildPythonApplication rec {
     hash = "sha256-y3h/atfFl/wDmr+YBdsWrCez4PQBEcl3xNDyTwXZIp4=";
   };
 
-  propagatedBuildInputs = with python3.pkgs; [
+  propagatedBuildInputs = with py.pkgs; [
     boto3
     cfn-flip
     click
@@ -25,7 +45,7 @@ python3.pkgs.buildPythonApplication rec {
     setuptools
   ];
 
-  checkInputs = with python3.pkgs; [
+  checkInputs = with py.pkgs; [
     moto
     pytestCheckHook
   ];
diff --git a/pkgs/tools/text/vale/default.nix b/pkgs/tools/text/vale/default.nix
index 67a7b03f180f7..4ed12b5b13449 100644
--- a/pkgs/tools/text/vale/default.nix
+++ b/pkgs/tools/text/vale/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "vale";
-  version = "2.15.0";
+  version = "2.15.1";
 
   subPackages = [ "cmd/vale" ];
   outputs = [ "out" "data" ];
@@ -11,7 +11,7 @@ buildGoModule rec {
     owner = "errata-ai";
     repo = "vale";
     rev = "v${version}";
-    sha256 = "sha256-HWekPMrQYTizyiRu9QSztZfZXsDmybXYarj6alGWJag=";
+    sha256 = "sha256-akJgIS+jf2n9NC4A+/gNQR62BaJ6T9vvdxJggOTRHn8=";
   };
 
   vendorSha256 = "sha256-2vYe943HHybOLcP8nDJe7RimMRIJdND2UPwtwB2mttE=";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 37c0cf9018be0..fd784d145230e 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2926,7 +2926,7 @@ with pkgs;
   duf = callPackage ../tools/misc/duf { };
 
   inherit (ocaml-ng.ocamlPackages_4_10) dune_1;
-  inherit (ocamlPackages) dune_2 dune-release;
+  inherit (ocamlPackages) dune_2 dune_3 dune-release;
 
   duperemove = callPackage ../tools/filesystems/duperemove { };
 
diff --git a/pkgs/top-level/gnuradio-packages.nix b/pkgs/top-level/gnuradio-packages.nix
index d291c1e830cda..1cd2c93da773d 100644
--- a/pkgs/top-level/gnuradio-packages.nix
+++ b/pkgs/top-level/gnuradio-packages.nix
@@ -14,16 +14,20 @@ let
   };
   mkDerivation = mkDerivationWith stdenv.mkDerivation;
 
-  callPackage = self.newScope {
+  callPackage = self.newScope ({
     inherit (gnuradio)
       # Packages that are potentially overriden and used as deps here.
       boost
-      uhd
       volk
     ;
     inherit mkDerivationWith mkDerivation;
-  };
-
+  } // lib.optionalAttrs (gnuradio.hasFeature "gr-uhd") {
+    inherit (gnuradio) uhd;
+  } // (if (lib.versionAtLeast gnuradio.versionAttr.major "3.10") then {
+    inherit (gnuradio) spdlog;
+  } else {
+    inherit (gnuradio) log4cpp;
+  }));
 in {
 
   inherit callPackage mkDerivation mkDerivationWith;
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index a29602dfb7d6a..fe7fd7d856ae5 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -310,6 +310,8 @@ let
       then pkgs.dune_2
       else throw "dune_2 is not available for OCaml ${ocaml.version}";
 
+    dune_3 = callPackage ../development/tools/ocaml/dune/3.nix { };
+
     dune-action-plugin = callPackage ../development/ocaml-modules/dune-action-plugin { };
 
     dune-build-info = callPackage ../development/ocaml-modules/dune-build-info { };