diff --git a/doc/contributing/submitting-changes.chapter.md b/doc/contributing/submitting-changes.chapter.md
index d428f00eea56..6f87e015b9cf 100644
--- a/doc/contributing/submitting-changes.chapter.md
+++ b/doc/contributing/submitting-changes.chapter.md
@@ -236,7 +236,7 @@ The `master` branch is the main development branch. It should only see non-break
 
 ### Staging branch {#submitting-changes-staging-branch}
 
-The `staging` branch is a development branch where mass-rebuilds go. It should only see non-breaking mass-rebuild commits. That means it is not to be used for testing, and changes must have been well tested already. If the branch is already in a broken state, please refrain from adding extra new breakages.
+The `staging` branch is a development branch where mass-rebuilds go. Mass rebuilds are commits that cause rebuilds for many packages, like more than 500 (or perhaps, if it's 'light' packages, 1000). It should only see non-breaking mass-rebuild commits. That means it is not to be used for testing, and changes must have been well tested already. If the branch is already in a broken state, please refrain from adding extra new breakages.
 
 ### Staging-next branch {#submitting-changes-staging-next-branch}
 
diff --git a/nixos/maintainers/scripts/ec2/create-amis.sh b/nixos/maintainers/scripts/ec2/create-amis.sh
index 797fe03e2095..0c1656efaf1c 100755
--- a/nixos/maintainers/scripts/ec2/create-amis.sh
+++ b/nixos/maintainers/scripts/ec2/create-amis.sh
@@ -26,12 +26,32 @@ var ${home_region:=eu-west-1}
 var ${bucket:=nixos-amis}
 var ${service_role_name:=vmimport}
 
-var ${regions:=eu-west-1 eu-west-2 eu-west-3 eu-central-1 eu-north-1
-         us-east-1 us-east-2 us-west-1 us-west-2
+# Output of the command:
+# > aws ec2 describe-regions --all-regions --query "Regions[].{Name:RegionName}" --output text | sort
+var ${regions:=
+         af-south-1
+         ap-east-1
+         ap-northeast-1
+         ap-northeast-2
+         ap-northeast-3
+         ap-south-1
+         ap-southeast-1
+         ap-southeast-2
+         ap-southeast-3
          ca-central-1
-         ap-southeast-1 ap-southeast-2 ap-northeast-1 ap-northeast-2
-         ap-south-1 ap-east-1
-         sa-east-1}
+         eu-central-1
+         eu-north-1
+         eu-south-1
+         eu-west-1
+         eu-west-2
+         eu-west-3
+         me-south-1
+         sa-east-1
+         us-east-1
+         us-east-2
+         us-west-1
+         us-west-2
+     }
 
 regions=($regions)
 
diff --git a/nixos/modules/installer/tools/nix-fallback-paths.nix b/nixos/modules/installer/tools/nix-fallback-paths.nix
index 1707935ad5bc..8fc8cc4baad5 100644
--- a/nixos/modules/installer/tools/nix-fallback-paths.nix
+++ b/nixos/modules/installer/tools/nix-fallback-paths.nix
@@ -1,7 +1,7 @@
 {
-  x86_64-linux = "/nix/store/yx36yzxpw1hn4fz8iyf1rfyd56jg3yf4-nix-2.8.0";
-  i686-linux = "/nix/store/c0hg806zvwg800qbszzj8ff4a224kjgf-nix-2.8.0";
-  aarch64-linux = "/nix/store/wic2832ll53q392r2wks4xr2nrk7p8p5-nix-2.8.0";
-  x86_64-darwin = "/nix/store/5yqdvnkmkrhl36xh0qy31pymdphjimdd-nix-2.8.0";
-  aarch64-darwin = "/nix/store/izc9592szrnpv8n86hr88bhpyc9g6b4s-nix-2.8.0";
+  x86_64-linux = "/nix/store/6mjgljq8sm9bsz6k22as5ar3jw78644m-nix-2.8.1";
+  i686-linux = "/nix/store/c4yjv4l8wncdla6ycicvsjrdf40xjkpp-nix-2.8.1";
+  aarch64-linux = "/nix/store/qkgvks80mdibq7m86hqasgr5lpixbnmh-nix-2.8.1";
+  x86_64-darwin = "/nix/store/riz4mzb1xhp36088ffnp40lz52bpxz01-nix-2.8.1";
+  aarch64-darwin = "/nix/store/dirm8hsnmvvzjs21hrx8i84w8k453jzp-nix-2.8.1";
 }
diff --git a/pkgs/applications/blockchains/ledger-live-desktop/default.nix b/pkgs/applications/blockchains/ledger-live-desktop/default.nix
index 59166149e6a6..84f6df6350f6 100644
--- a/pkgs/applications/blockchains/ledger-live-desktop/default.nix
+++ b/pkgs/applications/blockchains/ledger-live-desktop/default.nix
@@ -2,12 +2,12 @@
 
 let
   pname = "ledger-live-desktop";
-  version = "2.40.4";
+  version = "2.41.3";
   name = "${pname}-${version}";
 
   src = fetchurl {
     url = "https://github.com/LedgerHQ/${pname}/releases/download/v${version}/${pname}-${version}-linux-x86_64.AppImage";
-    hash = "sha256-ktmGXEWoCrhx9hGau2VkQi0GMa53EqHV1wGtUk6kicc=";
+    hash = "sha256-Bh3wB5AAgY6l1W3UtWUHW+lJgJ0w6gw23WvEe3/Xs1g=";
   };
 
   appimageContents = appimageTools.extractType2 {
diff --git a/pkgs/applications/graphics/drawio/default.nix b/pkgs/applications/graphics/drawio/default.nix
index 2f3728fa9bdc..3e4ea214c47e 100644
--- a/pkgs/applications/graphics/drawio/default.nix
+++ b/pkgs/applications/graphics/drawio/default.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation rec {
   pname = "drawio";
-  version = "18.0.4";
+  version = "18.0.6";
 
   src = fetchurl {
     url = "https://github.com/jgraph/drawio-desktop/releases/download/v${version}/drawio-x86_64-${version}.rpm";
-    sha256 = "0ln9vs2zyqq0pz3af6i8ynjbg59j0y6y7f5qkrgk2yv2mpnncl3m";
+    sha256 = "939d23f45f82bc4978ff3cb5d15d096f8af9658fb9f9211d3849998f6a0bd3a9";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/cluster/nomad-pack/default.nix b/pkgs/applications/networking/cluster/nomad-pack/default.nix
index 394e75f91125..5c5cb7c4a61d 100644
--- a/pkgs/applications/networking/cluster/nomad-pack/default.nix
+++ b/pkgs/applications/networking/cluster/nomad-pack/default.nix
@@ -5,17 +5,17 @@
 
 buildGoModule rec {
   pname = "nomad-pack";
-  version = "2022-04-12";
-  rev   = "50ad747d2a5a2b90af1b3564483510cb04fefbea";
+  version = "2022-05-12";
+  rev   = "bee6e8e078ff31fee916b864fbf3648294dbcdf5";
 
   src = fetchFromGitHub {
     owner = "hashicorp";
     repo = pname;
     inherit rev;
-    sha256 = "sha256-VG6Dmx5WD2AzKReMbmrpzXCNhrJqaZY3aQV9P+4ET68=";
+    sha256 = "sha256-28Dx9z7T+4WXl4voAzlSR2h3HcZMSzOuX7FHLJ4q9Sc=";
   };
 
-  vendorSha256 = "sha256-7ovR2F9N94iFK/B5OXRcqfykOYHST3354+Ge2L8yzq0=";
+  vendorSha256 = "sha256-hPsO842gmk77qc27slV2TiYNI7Ofw1RqGgcLP1gdgJ0=";
 
   # skip running go tests as they require network access
   doCheck = false;
diff --git a/pkgs/applications/networking/nextcloud-client/default.nix b/pkgs/applications/networking/nextcloud-client/default.nix
index 52e2e083ca17..d2850b176f47 100644
--- a/pkgs/applications/networking/nextcloud-client/default.nix
+++ b/pkgs/applications/networking/nextcloud-client/default.nix
@@ -1,7 +1,6 @@
 { lib
 , mkDerivation
 , fetchFromGitHub
-, fetchpatch
 , cmake
 , extra-cmake-modules
 , inotify-tools
@@ -27,7 +26,7 @@
 
 mkDerivation rec {
   pname = "nextcloud-client";
-  version = "3.5.0";
+  version = "3.5.1";
 
   outputs = [ "out" "dev" ];
 
@@ -35,18 +34,13 @@ mkDerivation rec {
     owner = "nextcloud";
     repo = "desktop";
     rev = "v${version}";
-    sha256 = "sha256-eFtBdnwHaLirzZaHDw6SRfmsqO3dmBB8Y9csJuiTf1A=";
+    sha256 = "sha256-/Bz3vkV4+ZFlGBNtkLIGsBk51a3wxy32U1KYcA3awcw=";
   };
 
   patches = [
     # Explicitly move dbus configuration files to the store path rather than `/etc/dbus-1/services`.
     ./0001-Explicitly-copy-dbus-files-into-the-store-dir.patch
     ./0001-When-creating-the-autostart-entry-do-not-use-an-abso.patch
-    # don't write cacheDir into home directory
-    (fetchpatch {
-      url = "https://github.com/nextcloud/desktop/commit/3a8aa8a2a88bc9b68098b7866e2a07aa23d3a33c.patch";
-      sha256 = "sha256-OviPANvXap3mg4haxRir/CK1aq8maWZDM/IVsN+OHgk=";
-    })
   ];
 
   postPatch = ''
diff --git a/pkgs/applications/science/logic/lean/default.nix b/pkgs/applications/science/logic/lean/default.nix
index b5e5ca8723d4..cbd09b2a1a82 100644
--- a/pkgs/applications/science/logic/lean/default.nix
+++ b/pkgs/applications/science/logic/lean/default.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "lean";
-  version = "3.42.0";
+  version = "3.43.0";
 
   src = fetchFromGitHub {
     owner  = "leanprover-community";
@@ -11,8 +11,8 @@ stdenv.mkDerivation rec {
     # from. this is then used to check whether an olean file should be
     # rebuilt. don't use a tag as rev because this will get replaced into
     # src/githash.h.in in preConfigure.
-    rev    = "b35d4695da88139a9168f2ad7acf0782e66dc4f0";
-    sha256 = "02rpigw6lnyjw8ccrlp2mcvswawkhl5y6kqa3zq76qp1fdjqjrbp";
+    rev    = "bfce34363b0efe86e93e3fe75de76ab3740c772d";
+    sha256 = "100mb003zkgrv1wd2agbk41aipk3j78k8zcjbj7pv9ixh02c7ss8";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/science/math/mxnet/default.nix b/pkgs/applications/science/math/mxnet/default.nix
index 8353226cefed..abff55413cec 100644
--- a/pkgs/applications/science/math/mxnet/default.nix
+++ b/pkgs/applications/science/math/mxnet/default.nix
@@ -40,6 +40,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ opencv3 gtest blas.provider ]
     ++ lib.optional stdenv.cc.isGNU gomp
     ++ lib.optional stdenv.cc.isClang llvmPackages.openmp
+    # FIXME: when cuda build is fixed, remove nvidia_x11, and use /run/opengl-driver/lib
     ++ lib.optionals cudaSupport [ cudatoolkit nvidia_x11 ]
     ++ lib.optional cudnnSupport cudnn;
 
@@ -78,5 +79,7 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ abbradar ];
     license = licenses.asl20;
     platforms = platforms.unix;
+    # Build failures when linking mxnet_unit_tests: https://gist.github.com/6d17447ee3557967ec52c50d93b17a1d
+    broken = cudaSupport;
   };
 }
diff --git a/pkgs/build-support/testers/default.nix b/pkgs/build-support/testers/default.nix
index 3ab97760e725..020352836c89 100644
--- a/pkgs/build-support/testers/default.nix
+++ b/pkgs/build-support/testers/default.nix
@@ -9,10 +9,19 @@
       version ? package.version,
     }: runCommand "${package.name}-test-version" { nativeBuildInputs = [ package ]; meta.timeout = 60; } ''
       if output=$(${command} 2>&1); then
-        grep -Fw "${version}" - <<< "$output"
-        touch $out
+        if grep -Fw "${version}" - <<< "$output"; then
+          touch $out
+        else
+          echo "Version string '${version}' not found!" >&2
+          echo "The output was:" >&2
+          echo "$output" >&2
+          exit 1
+        fi
       else
-        echo "$output" >&2 && exit 1
+        echo -n ${lib.escapeShellArg command} >&2
+        echo " returned a non-zero exit code." >&2
+        echo "$output" >&2
+        exit 1
       fi
     '';
 
diff --git a/pkgs/development/compilers/go/1.17.nix b/pkgs/development/compilers/go/1.17.nix
index 1483660d1ec9..2c673b7dd4ed 100644
--- a/pkgs/development/compilers/go/1.17.nix
+++ b/pkgs/development/compilers/go/1.17.nix
@@ -18,8 +18,12 @@
 , buildPackages
 , pkgsBuildTarget
 , callPackage
+, threadsCross ? null # for MinGW
 }:
 
+# threadsCross is just for MinGW
+assert threadsCross != null -> stdenv.targetPlatform.isWindows;
+
 let
   go_bootstrap = buildPackages.callPackage ./bootstrap.nix { };
 
@@ -50,6 +54,8 @@ let
   # We need a target compiler which is still runnable at build time,
   # to handle the cross-building case where build != host == target
   targetCC = pkgsBuildTarget.targetPackages.stdenv.cc;
+
+  isCross = stdenv.buildPlatform != stdenv.targetPlatform;
 in
 
 stdenv.mkDerivation rec {
@@ -71,6 +77,10 @@ stdenv.mkDerivation rec {
 
   depsTargetTargetPropagated = lib.optionals stdenv.isDarwin [ Security Foundation ];
 
+  depsBuildTarget = lib.optional isCross targetCC;
+
+  depsTargetTarget = lib.optional (threadsCross != null) threadsCross;
+
   hardeningDisable = [ "all" ];
 
   prePatch = ''
@@ -194,12 +204,12 @@ stdenv.mkDerivation rec {
   # {CC,CXX}_FOR_TARGET must be only set for cross compilation case as go expect those
   # to be different from CC/CXX
   CC_FOR_TARGET =
-    if (stdenv.buildPlatform != stdenv.targetPlatform) then
+    if isCross then
       "${targetCC}/bin/${targetCC.targetPrefix}cc"
     else
       null;
   CXX_FOR_TARGET =
-    if (stdenv.buildPlatform != stdenv.targetPlatform) then
+    if isCross then
       "${targetCC}/bin/${targetCC.targetPrefix}c++"
     else
       null;
@@ -223,7 +233,7 @@ stdenv.mkDerivation rec {
 
     export PATH=$(pwd)/bin:$PATH
 
-    ${lib.optionalString (stdenv.buildPlatform != stdenv.targetPlatform) ''
+    ${lib.optionalString isCross ''
     # Independent from host/target, CC should produce code for the building system.
     # We only set it when cross-compiling.
     export CC=${buildPackages.stdenv.cc}/bin/cc
diff --git a/pkgs/development/compilers/go/1.18.nix b/pkgs/development/compilers/go/1.18.nix
index aad9c27fc563..48ca47321cdc 100644
--- a/pkgs/development/compilers/go/1.18.nix
+++ b/pkgs/development/compilers/go/1.18.nix
@@ -18,8 +18,12 @@
 , buildPackages
 , pkgsBuildTarget
 , callPackage
+, threadsCross ? null # for MinGW
 }:
 
+# threadsCross is just for MinGW
+assert threadsCross != null -> stdenv.targetPlatform.isWindows;
+
 let
   go_bootstrap = buildPackages.callPackage ./bootstrap.nix { };
 
@@ -50,6 +54,8 @@ let
   # We need a target compiler which is still runnable at build time,
   # to handle the cross-building case where build != host == target
   targetCC = pkgsBuildTarget.targetPackages.stdenv.cc;
+
+  isCross = stdenv.buildPlatform != stdenv.targetPlatform;
 in
 
 stdenv.mkDerivation rec {
@@ -71,6 +77,10 @@ stdenv.mkDerivation rec {
 
   depsTargetTargetPropagated = lib.optionals stdenv.isDarwin [ Security Foundation ];
 
+  depsBuildTarget = lib.optional isCross targetCC;
+
+  depsTargetTarget = lib.optional (threadsCross != null) threadsCross;
+
   hardeningDisable = [ "all" ];
 
   prePatch = ''
@@ -188,12 +198,12 @@ stdenv.mkDerivation rec {
   # {CC,CXX}_FOR_TARGET must be only set for cross compilation case as go expect those
   # to be different from CC/CXX
   CC_FOR_TARGET =
-    if (stdenv.buildPlatform != stdenv.targetPlatform) then
+    if isCross then
       "${targetCC}/bin/${targetCC.targetPrefix}cc"
     else
       null;
   CXX_FOR_TARGET =
-    if (stdenv.buildPlatform != stdenv.targetPlatform) then
+    if isCross then
       "${targetCC}/bin/${targetCC.targetPrefix}c++"
     else
       null;
@@ -217,7 +227,7 @@ stdenv.mkDerivation rec {
 
     export PATH=$(pwd)/bin:$PATH
 
-    ${lib.optionalString (stdenv.buildPlatform != stdenv.targetPlatform) ''
+    ${lib.optionalString isCross ''
     # Independent from host/target, CC should produce code for the building system.
     # We only set it when cross-compiling.
     export CC=${buildPackages.stdenv.cc}/bin/cc
diff --git a/pkgs/development/libraries/opensaml-cpp/default.nix b/pkgs/development/libraries/opensaml-cpp/default.nix
index 4f83f22856e3..1f4ad96c2977 100644
--- a/pkgs/development/libraries/opensaml-cpp/default.nix
+++ b/pkgs/development/libraries/opensaml-cpp/default.nix
@@ -19,6 +19,8 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "--with-xmltooling=${xml-tooling-c}" ];
 
+  NIX_CFLAGS_COMPILE = [ "-std=c++14" ];
+
   enableParallelBuilding = true;
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/shibboleth-sp/default.nix b/pkgs/development/libraries/shibboleth-sp/default.nix
index f3b80c0b548f..5dd997352f13 100644
--- a/pkgs/development/libraries/shibboleth-sp/default.nix
+++ b/pkgs/development/libraries/shibboleth-sp/default.nix
@@ -20,6 +20,8 @@ stdenv.mkDerivation rec {
     "--with-fastcgi"
   ];
 
+  NIX_CFLAGS_COMPILE = [ "-std=c++14" ];
+
   enableParallelBuilding = true;
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/xml-tooling-c/default.nix b/pkgs/development/libraries/xml-tooling-c/default.nix
index 9cf3ddb92190..39e25241c943 100644
--- a/pkgs/development/libraries/xml-tooling-c/default.nix
+++ b/pkgs/development/libraries/xml-tooling-c/default.nix
@@ -15,6 +15,8 @@ stdenv.mkDerivation rec {
   buildInputs = [ boost curl openssl log4shib xercesc xml-security-c ];
   nativeBuildInputs = [ autoreconfHook pkg-config ];
 
+  NIX_CFLAGS_COMPILE = [ "-std=c++14" ];
+
   enableParallelBuilding = true;
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/ailment/default.nix b/pkgs/development/python-modules/ailment/default.nix
index 498caa2045da..2a66a332c398 100644
--- a/pkgs/development/python-modules/ailment/default.nix
+++ b/pkgs/development/python-modules/ailment/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "ailment";
-  version = "9.2.3";
+  version = "9.2.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-R8AaQj/Rdz8SSN2L8v8ZzIxnPQqdg/SKUB6FV9uYFLs=";
+    hash = "sha256-YsH9QAKoM4WILabgLvEZMJXPfpkfn/h4tofNIcGJY+k=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/angr/default.nix b/pkgs/development/python-modules/angr/default.nix
index f8e3ac530f17..bbfdcb43732f 100644
--- a/pkgs/development/python-modules/angr/default.nix
+++ b/pkgs/development/python-modules/angr/default.nix
@@ -46,7 +46,7 @@ in
 
 buildPythonPackage rec {
   pname = "angr";
-  version = "9.2.3";
+  version = "9.2.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
@@ -55,7 +55,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-RcAiPzz2JUlNIGU7+6WCd5JskRYmlMee8wOcOclfb0Q=";
+    hash = "sha256-3iw1tk2r6Ee302AMjgsRi6EL5py+4Blf47EWrWyiqNk=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/angrop/default.nix b/pkgs/development/python-modules/angrop/default.nix
index d46c18f6d177..8c40a51ff438 100644
--- a/pkgs/development/python-modules/angrop/default.nix
+++ b/pkgs/development/python-modules/angrop/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "angrop";
-  version = "9.2.3";
+  version = "9.2.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-bhdn3uomvegpvynR0ts4KdwFapX2xGfuwp4e57Xtcoo=";
+    hash = "sha256-EMW2RxImYoPSnkBG027g5o5K3WT40F/Dj+GzqS8/K6g=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/archinfo/default.nix b/pkgs/development/python-modules/archinfo/default.nix
index 59a2f9ad9c9a..da139209577a 100644
--- a/pkgs/development/python-modules/archinfo/default.nix
+++ b/pkgs/development/python-modules/archinfo/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "archinfo";
-  version = "9.2.3";
+  version = "9.2.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-r0cZXyj47HmgFVyQ3POGexeQxBiQ1xx/ptsPMwCRjHY=";
+    hash = "sha256-d5SP9pnDWXEzjBXKeqnuKK6+lrFRWYwmiV4MjfqORwk=";
   };
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/claripy/default.nix b/pkgs/development/python-modules/claripy/default.nix
index e37f1ee8dbd3..49d82215e7cf 100644
--- a/pkgs/development/python-modules/claripy/default.nix
+++ b/pkgs/development/python-modules/claripy/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "claripy";
-  version = "9.2.3";
+  version = "9.2.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-O2nkGIQfjGmhrqBPoMI97DsCvOUZix0VcUHwmDyF40Q=";
+    hash = "sha256-nP2mqBmgpn7zFtMd9suH3kfEqKtzIjaZl6ALsvihVgE=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/cle/default.nix b/pkgs/development/python-modules/cle/default.nix
index f626e62db0d3..2c7b80b524da 100644
--- a/pkgs/development/python-modules/cle/default.nix
+++ b/pkgs/development/python-modules/cle/default.nix
@@ -15,7 +15,7 @@
 
 let
   # The binaries are following the argr projects release cycle
-  version = "9.2.3";
+  version = "9.2.4";
 
   # Binary files from https://github.com/angr/binaries (only used for testing and only here)
   binaries = fetchFromGitHub {
@@ -37,7 +37,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-gyWeE4sF9Bmk2CNmXh90xMtXlaz/Agm7wX6sWr0Fyco=";
+    hash = "sha256-SlYayKfosSicMxMZszZpxJ3ewKScyLpv6s5ayoVE9Ko=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/deepdiff/default.nix b/pkgs/development/python-modules/deepdiff/default.nix
index 2601eedc2fa2..cba0ac56396e 100644
--- a/pkgs/development/python-modules/deepdiff/default.nix
+++ b/pkgs/development/python-modules/deepdiff/default.nix
@@ -8,19 +8,20 @@
 , numpy
 , pytestCheckHook
 , pyyaml
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "deepdiff";
-  version = "5.7.0";
+  version = "5.8.2";
   format = "setuptools";
 
-  # pypi source does not contain all fixtures required for tests
+  disabled = pythonOlder "3.6";
+
   src = fetchFromGitHub {
     owner = "seperman";
     repo = "deepdiff";
-    # 5.7.0 release not tagged https://github.com/seperman/deepdiff/issues/300
-    rev = "f2ffdb83b2993f4f0bb7e854620f0acd0bf6339e";
+    rev = "v${version}";
     hash = "sha256-0UBx7sH2iMrLVl5FtHNTwoecLHi8GbInn75G3FSg4gk=";
   };
 
@@ -48,10 +49,15 @@ buildPythonPackage rec {
     pyyaml
   ];
 
+  disabledTests = [
+    # Assertion issue with the decimal places
+    "test_get_numeric_types_distance"
+  ];
+
   meta = with lib; {
     description = "Deep Difference and Search of any Python object/data";
     homepage = "https://github.com/seperman/deepdiff";
     license = licenses.mit;
-    maintainers = [ maintainers.mic92 ];
+    maintainers = with maintainers; [ mic92 ];
   };
 }
diff --git a/pkgs/development/python-modules/mailchecker/default.nix b/pkgs/development/python-modules/mailchecker/default.nix
index b62d4a67e755..ca5b0d3184e0 100644
--- a/pkgs/development/python-modules/mailchecker/default.nix
+++ b/pkgs/development/python-modules/mailchecker/default.nix
@@ -6,14 +6,14 @@
 
 buildPythonPackage rec {
   pname = "mailchecker";
-  version = "4.1.16";
+  version = "4.1.17";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-A+lh+BggMSJ/PIcYMfX3u/YlKVqhG5IxbrHPb1U6Ll4=";
+    hash = "sha256-NfgLI490/9YoHIXTVD890RTe+qP9rrwAFv8Xkc1IY5s=";
   };
 
   # Module has no tests
diff --git a/pkgs/development/python-modules/marshmallow-oneofschema/default.nix b/pkgs/development/python-modules/marshmallow-oneofschema/default.nix
index a4b15ce9a544..8fc946305bc8 100644
--- a/pkgs/development/python-modules/marshmallow-oneofschema/default.nix
+++ b/pkgs/development/python-modules/marshmallow-oneofschema/default.nix
@@ -1,22 +1,43 @@
-{ lib, buildPythonPackage, fetchPypi, marshmallow, setuptools }:
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, marshmallow
+, pytestCheckHook
+, pythonOlder
+, setuptools
+}:
 
 buildPythonPackage rec {
   pname = "marshmallow-oneofschema";
   version = "3.0.1";
+  format = "setuptools";
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "62cd2099b29188c92493c2940ee79d1bf2f2619a71721664e5a98ec2faa58237";
+  disabled = pythonOlder "3.6";
+
+  src = fetchFromGitHub {
+    owner = "marshmallow-code";
+    repo = pname;
+    rev = version;
+    hash = "sha256-x0v8WkfjGkP2668QIQiewQViYFDIS2zBWMULcDThWas=";
   };
 
-  propagatedBuildInputs = [ marshmallow setuptools ];
+  propagatedBuildInputs = [
+    marshmallow
+    setuptools
+  ];
 
-  pythonImportsCheck = [ "marshmallow_oneofschema" ];
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "marshmallow_oneofschema"
+  ];
 
   meta = with lib; {
-    homepage = "https://github.com/marshmallow-code/marshmallow-oneofschema";
     description = "Marshmallow library extension that allows schema (de)multiplexing";
+    homepage = "https://github.com/marshmallow-code/marshmallow-oneofschema";
     license = licenses.mit;
-    maintainers = [ maintainers.ivan-tkatchev ];
+    maintainers = with maintainers; [ ivan-tkatchev ];
   };
 }
diff --git a/pkgs/development/python-modules/marshmallow/default.nix b/pkgs/development/python-modules/marshmallow/default.nix
index a4f60d8202a4..50e7e71cc9e3 100644
--- a/pkgs/development/python-modules/marshmallow/default.nix
+++ b/pkgs/development/python-modules/marshmallow/default.nix
@@ -1,15 +1,17 @@
 { lib
 , buildPythonPackage
-, pythonOlder
 , fetchFromGitHub
 , pytestCheckHook
+, pythonOlder
 , pytz
 , simplejson
+, packaging
 }:
 
 buildPythonPackage rec {
   pname = "marshmallow";
-  version = "3.13.0";
+  version = "3.15.0";
+  format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
@@ -17,9 +19,13 @@ buildPythonPackage rec {
     owner = "marshmallow-code";
     repo = pname;
     rev = version;
-    sha256 = "sha256-tP/RKo2Hzxz2bT7ybRs9wGzq7TpsmzmOPi3BGuSLDA0=";
+    hash = "sha256-ZqMrMNfP/RKW2jQDNPgfhyeqmSc40pZbnrcXHbw2emc=";
   };
 
+  propagatedBuildInputs = [
+    packaging
+  ];
+
   checkInputs = [
     pytestCheckHook
     pytz
@@ -31,10 +37,7 @@ buildPythonPackage rec {
   ];
 
   meta = with lib; {
-    description = ''
-      A lightweight library for converting complex objects to and from
-      simple Python datatypes.
-    '';
+    description = "Library for converting complex objects to and from simple Python datatypes";
     homepage = "https://github.com/marshmallow-code/marshmallow";
     license = licenses.mit;
     maintainers = with maintainers; [ cript0nauta ];
diff --git a/pkgs/development/python-modules/napalm/default.nix b/pkgs/development/python-modules/napalm/default.nix
index ef59a33a956a..09d38875db8e 100644
--- a/pkgs/development/python-modules/napalm/default.nix
+++ b/pkgs/development/python-modules/napalm/default.nix
@@ -1,23 +1,42 @@
-{ lib, buildPythonPackage, fetchFromGitHub, callPackage, setuptools, cffi
+{ lib, buildPythonPackage, fetchFromGitHub, fetchpatch, setuptools, cffi
 , paramiko, requests, future, textfsm, jinja2, netaddr, pyyaml, pyeapi, netmiko
 , junos-eznc, ciscoconfparse, scp, lxml, ncclient, pytestCheckHook, ddt, mock
-, pythonOlder, pythonAtLeast }:
+, pythonOlder }:
 
 buildPythonPackage rec {
   pname = "napalm";
-  version = "3.3.1";
+  version = "3.4.1";
   format = "setuptools";
 
-  disabled = pythonOlder "3.6" || pythonAtLeast "3.9";
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "napalm-automation";
     repo = "napalm";
     rev = version;
-    sha256 = "15h1h1a3avv48i14x96b8v7zkhmwg7dnzxycxr18f9530j237rq6";
+    sha256 = "sha256-TNWRJtc6+VS6wgJGGvCPDoFQmOKQAyXdjFQo9bPJ2F8=";
   };
 
+  patches = [
+    # netmiko 4.0.0 support
+    (fetchpatch{
+      url = "https://github.com/napalm-automation/napalm/commit/4b8cc85db3236099a04f742cf71773e74d9dd70e.patch";
+      excludes = [ "requirements.txt" ];
+      sha256 = "sha256-DBKp+wiKd+/j2xAqaQL3UCcGQd6wnWcNTsNXBBt9c98=";
+    })
+    (fetchpatch{
+      url = "https://github.com/napalm-automation/napalm/commit/4a8b5b1823335dd79aa5269c038a1f08ecd35cdd.patch";
+      sha256 = "sha256-uiou/rzmnFf4wAvXwmUsGJx99GeHWKJB2JrMM1kLakM=";
+    })
+  ];
+
+  postPatch = ''
+    substituteInPlace requirements.txt \
+      --replace "netmiko>=3.3.0,<4.0.0" "netmiko"
+  '';
+
   buildInputs = [ setuptools ];
+
   propagatedBuildInputs = [
     cffi
     paramiko
diff --git a/pkgs/development/python-modules/napalm/hp-procurve.nix b/pkgs/development/python-modules/napalm/hp-procurve.nix
index 774fdd2299cc..f6ebfa980e6e 100644
--- a/pkgs/development/python-modules/napalm/hp-procurve.nix
+++ b/pkgs/development/python-modules/napalm/hp-procurve.nix
@@ -30,12 +30,14 @@ buildPythonPackage rec {
     "test_method_signatures"
     # AttributeError: 'PatchedProcurveDriver' object has no attribute 'platform'
     "test_get_config_filtered"
+    # AssertionError
+    "test_get_interfaces"
   ];
 
   meta = with lib; {
     description = "HP ProCurve Driver for NAPALM automation frontend";
-    homepage =
-      "https://github.com/napalm-automation-community/napalm-hp-procurve";
+    homepage = "https://github.com/napalm-automation-community/napalm-hp-procurve";
     license = licenses.asl20;
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/development/python-modules/netmiko/default.nix b/pkgs/development/python-modules/netmiko/default.nix
index 3081b5a6b7cd..482c298a90e3 100644
--- a/pkgs/development/python-modules/netmiko/default.nix
+++ b/pkgs/development/python-modules/netmiko/default.nix
@@ -3,16 +3,15 @@
 
 buildPythonPackage rec {
   pname = "netmiko";
-  version = "4.0.0";
+  version = "4.1.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-fVhBkiO1JpqMIFl32xlwSjeCd7aObocXPAr069fKdmc=";
+    sha256 = "sha256-VwUZdHr82WsEprB7rk5d62AwaCxzngftDgjeBZW4OWQ=";
   };
 
   buildInputs = [ setuptools ];
-  propagatedBuildInputs =
-    [ paramiko scp tenacity textfsm ntc-templates pyserial ];
+  propagatedBuildInputs = [ paramiko scp tenacity pyyaml textfsm ntc-templates pyserial ];
 
   # tests require closed-source pyats and genie packages
   doCheck = false;
diff --git a/pkgs/development/python-modules/pyvex/default.nix b/pkgs/development/python-modules/pyvex/default.nix
index 682bc0d80ac7..095de81b2619 100644
--- a/pkgs/development/python-modules/pyvex/default.nix
+++ b/pkgs/development/python-modules/pyvex/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "pyvex";
-  version = "9.2.3";
+  version = "9.2.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-uGZlWDTDczBiNCd4D4y6Umz44G8Zn3Zr8/R7Kn+4aS8=";
+    hash = "sha256-r+dmf5qIjiN5vmdzBmPORnPWPrjLKGks+OAdZXdAbOc=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/tools/konstraint/default.nix b/pkgs/development/tools/konstraint/default.nix
index 945785910034..ed11ab5b6667 100644
--- a/pkgs/development/tools/konstraint/default.nix
+++ b/pkgs/development/tools/konstraint/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "konstraint";
-  version = "0.19.1";
+  version = "0.20.0";
 
   src = fetchFromGitHub {
     owner = "plexsystems";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-MQ9Rb8U1CGbEgNtkOdK879dr8uOro6CAl4wGMbuT+wo=";
+    sha256 = "sha256-xSJxBJzLfZhBcXqKs8EZRHTpgb1YeKDTzrOiBtGBwTI=";
   };
   vendorSha256 = "sha256-gUuceNwOI+ss2YDiIF+zxyOj53iV6kGtVhNCd5KQomo=";
 
diff --git a/pkgs/games/anki/bin.nix b/pkgs/games/anki/bin.nix
index aade2aaae9ec..45ec432dc7ba 100644
--- a/pkgs/games/anki/bin.nix
+++ b/pkgs/games/anki/bin.nix
@@ -3,22 +3,22 @@
 let
   pname = "anki-bin";
   # Update hashes for both Linux and Darwin!
-  version = "2.1.51";
+  version = "2.1.52";
 
   sources = {
     linux = fetchurl {
       url = "https://github.com/ankitects/anki/releases/download/${version}/anki-${version}-linux-qt6.tar.zst";
-      sha256 = "sha256-ZKVc+TvkNu5mGgibhRIuoLuIfvyoVDy+c4h+Apz9P+0=";
+      sha256 = "sha256-+eRflNMxutoSY9yQfnhIjfLg9b9CNv+7UuYyg4jgfK4=";
     };
 
     # For some reason anki distributes completely separate dmg-files for the aarch64 version and the x86_64 version
     darwin-x86_64 = fetchurl {
       url = "https://github.com/ankitects/anki/releases/download/${version}/anki-${version}-mac-intel-qt6.dmg";
-      sha256 = "sha256-wZMJEbcpezVAuBSKlwNTHlqjp0FfmyDB7XD6BBuJhyA=";
+      sha256 = "sha256-keQxaf0KOQjCb22dQD/1VytW2fk35OPUJyJ42kaoAr8=";
     };
     darwin-aarch64 = fetchurl {
       url = "https://github.com/ankitects/anki/releases/download/${version}/anki-${version}-mac-apple-qt6.dmg";
-      sha256 = "sha256-6RDTYKoisX5DJ9VPWrP9VH9DCABabb9MB3nG4S8jtR0=";
+      sha256 = "sha256-mYPSOjXh18nWpZjXLAjEodoxopr6rxadESMAf/t9SlI=";
     };
   };
 
@@ -44,7 +44,7 @@ let
 
   meta = with lib; {
     inherit (anki.meta) license homepage description longDescription;
-    platforms = [ "x86_64-linux" "x86_64-darwin" ];
+    platforms = [ "x86_64-linux" "x86_64-darwin" "aarch64-darwin" ];
     maintainers = with maintainers; [ atemu ];
   };
 
diff --git a/pkgs/os-specific/windows/default.nix b/pkgs/os-specific/windows/default.nix
index 15e3d7f89ab6..c34f97a17db2 100644
--- a/pkgs/os-specific/windows/default.nix
+++ b/pkgs/os-specific/windows/default.nix
@@ -37,6 +37,8 @@ lib.makeScope newScope (self: with self; {
     stdenv = crossThreadsStdenv;
   };
 
+  npiperelay = callPackage ./npiperelay { };
+
   pthreads = callPackage ./pthread-w32 { };
 
   wxMSW = callPackage ./wxMSW-2.8 { };
diff --git a/pkgs/os-specific/windows/npiperelay/default.nix b/pkgs/os-specific/windows/npiperelay/default.nix
new file mode 100644
index 000000000000..edc83a27e551
--- /dev/null
+++ b/pkgs/os-specific/windows/npiperelay/default.nix
@@ -0,0 +1,23 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "npiperelay";
+  version = "0.1.0";
+
+  src = fetchFromGitHub {
+    owner = "jstarks";
+    repo = "npiperelay";
+    rev = "v${version}";
+    sha256 = "sha256-cg4aZmpTysc8m1euxIO2XPv8OMnBk1DwhFcuIFHF/1o=";
+  };
+
+  vendorSha256 = null;
+
+  meta = {
+    description = "Access Windows named pipes from WSL";
+    homepage = "https://github.com/jstarks/npiperelay";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.shlevy ];
+    platforms = lib.platforms.windows;
+  };
+}
diff --git a/pkgs/tools/filesystems/9pfs/default.nix b/pkgs/tools/filesystems/9pfs/default.nix
index 03f082a40381..d9c609d7c0a9 100644
--- a/pkgs/tools/filesystems/9pfs/default.nix
+++ b/pkgs/tools/filesystems/9pfs/default.nix
@@ -24,6 +24,12 @@ stdenv.mkDerivation {
 
   buildInputs = [ fuse ];
 
+  # Workaround build failure on -fno-common toolchains like upstream
+  # gcc-10. Otherwise build fails as:
+  #   ld: lib/auth_rpc.o:/build/source/lib/../9pfs.h:35: multiple definition of
+  #     `logfile'; 9pfs.o:/build/source/9pfs.h:35: first defined here
+  NIX_CFLAGS_COMPILE = "-fcommon";
+
   enableParallelBuilding = true;
 
   meta = {