diff --git a/lib/strings.nix b/lib/strings.nix
index 376c537287e9..64bf5bbafd3d 100644
--- a/lib/strings.nix
+++ b/lib/strings.nix
@@ -328,7 +328,7 @@ rec {
        escape ["(" ")"] "(foo)"
        => "\\(foo\\)"
   */
-  escape = list: replaceChars list (map (c: "\\${c}") list);
+  escape = list: replaceStrings list (map (c: "\\${c}") list);
 
   /* Escape occurence of the element of `list` in `string` by
      converting to its ASCII value and prefixing it with \\x.
@@ -341,7 +341,7 @@ rec {
        => "foo\\x20bar"
 
   */
-  escapeC = list: replaceChars list (map (c: "\\x${ toLower (lib.toHexString (charToInt c))}") list);
+  escapeC = list: replaceStrings list (map (c: "\\x${ toLower (lib.toHexString (charToInt c))}") list);
 
   /* Quote string to be used safely within the Bourne shell.
 
@@ -471,19 +471,8 @@ rec {
     ["\"" "'" "<" ">" "&"]
     ["&quot;" "&apos;" "&lt;" "&gt;" "&amp;"];
 
-  # Obsolete - use replaceStrings instead.
-  replaceChars = builtins.replaceStrings or (
-    del: new: s:
-    let
-      substList = lib.zipLists del new;
-      subst = c:
-        let found = lib.findFirst (sub: sub.fst == c) null substList; in
-        if found == null then
-          c
-        else
-          found.snd;
-    in
-      stringAsChars subst s);
+  # warning added 12-12-2022
+  replaceChars = lib.warn "replaceChars is a deprecated alias of replaceStrings, replace usages of it with replaceStrings." builtins.replaceStrings;
 
   # Case conversion utilities.
   lowerChars = stringToCharacters "abcdefghijklmnopqrstuvwxyz";
@@ -497,7 +486,7 @@ rec {
        toLower "HOME"
        => "home"
   */
-  toLower = replaceChars upperChars lowerChars;
+  toLower = replaceStrings upperChars lowerChars;
 
   /* Converts an ASCII string to upper-case.
 
@@ -507,7 +496,7 @@ rec {
        toUpper "home"
        => "HOME"
   */
-  toUpper = replaceChars lowerChars upperChars;
+  toUpper = replaceStrings lowerChars upperChars;
 
   /* Appends string context from another string.  This is an implementation
      detail of Nix and should be used carefully.
diff --git a/nixos/lib/systemd-lib.nix b/nixos/lib/systemd-lib.nix
index 4c52643446ed..c6c8753d5325 100644
--- a/nixos/lib/systemd-lib.nix
+++ b/nixos/lib/systemd-lib.nix
@@ -8,9 +8,9 @@ let
   systemd = cfg.package;
 in rec {
 
-  shellEscape = s: (replaceChars [ "\\" ] [ "\\\\" ] s);
+  shellEscape = s: (replaceStrings [ "\\" ] [ "\\\\" ] s);
 
-  mkPathSafeName = lib.replaceChars ["@" ":" "\\" "[" "]"] ["-" "-" "-" "" ""];
+  mkPathSafeName = lib.replaceStrings ["@" ":" "\\" "[" "]"] ["-" "-" "-" "" ""];
 
   # a type for options that take a unit name
   unitNameType = types.strMatching "[a-zA-Z0-9@%:_.\\-]+[.](service|socket|device|mount|automount|swap|target|path|timer|scope|slice)";
@@ -258,7 +258,7 @@ in rec {
 
   makeJobScript = name: text:
     let
-      scriptName = replaceChars [ "\\" "@" ] [ "-" "_" ] (shellEscape name);
+      scriptName = replaceStrings [ "\\" "@" ] [ "-" "_" ] (shellEscape name);
       out = (pkgs.writeShellScriptBin scriptName ''
         set -e
         ${text}
diff --git a/nixos/lib/utils.nix b/nixos/lib/utils.nix
index 9eefa80d1c8b..def3aa13f320 100644
--- a/nixos/lib/utils.nix
+++ b/nixos/lib/utils.nix
@@ -48,7 +48,7 @@ rec {
     trim = s: removeSuffix "/" (removePrefix "/" s);
     normalizedPath = strings.normalizePath s;
   in
-    replaceChars ["/"] ["-"]
+    replaceStrings ["/"] ["-"]
     (replacePrefix "." (strings.escapeC ["."] ".")
     (strings.escapeC (stringToCharacters " !\"#$%&'()*+,;<=>=@[\\]^`{|}~-")
     (if normalizedPath == "/" then normalizedPath else trim normalizedPath)));
@@ -67,7 +67,7 @@ rec {
         else if builtins.isInt arg || builtins.isFloat arg then toString arg
         else throw "escapeSystemdExecArg only allows strings, paths and numbers";
     in
-      replaceChars [ "%" "$" ] [ "%%" "$$" ] (builtins.toJSON s);
+      replaceStrings [ "%" "$" ] [ "%%" "$$" ] (builtins.toJSON s);
 
   # Quotes a list of arguments into a single string for use in a Exec*
   # line.
@@ -112,7 +112,7 @@ rec {
         else if isAttrs item then
           map (name:
             let
-              escapedName = ''"${replaceChars [''"'' "\\"] [''\"'' "\\\\"] name}"'';
+              escapedName = ''"${replaceStrings [''"'' "\\"] [''\"'' "\\\\"] name}"'';
             in
               recurse (prefix + "." + escapedName) item.${name}) (attrNames item)
         else if isList item then
diff --git a/nixos/modules/config/swap.nix b/nixos/modules/config/swap.nix
index 10d52ade288b..76a054b100eb 100644
--- a/nixos/modules/config/swap.nix
+++ b/nixos/modules/config/swap.nix
@@ -160,7 +160,7 @@ let
     config = rec {
       device = mkIf options.label.isDefined
         "/dev/disk/by-label/${config.label}";
-      deviceName = lib.replaceChars ["\\"] [""] (escapeSystemdPath config.device);
+      deviceName = lib.replaceStrings ["\\"] [""] (escapeSystemdPath config.device);
       realDevice = if config.randomEncryption.enable then "/dev/mapper/${deviceName}" else config.device;
     };
 
diff --git a/nixos/modules/programs/xfs_quota.nix b/nixos/modules/programs/xfs_quota.nix
index a1e9ff941c6b..0fc2958b3f38 100644
--- a/nixos/modules/programs/xfs_quota.nix
+++ b/nixos/modules/programs/xfs_quota.nix
@@ -94,7 +94,7 @@ in
         '';
 
         wantedBy = [ "multi-user.target" ];
-        after = [ ((replaceChars [ "/" ] [ "-" ] opts.fileSystem) + ".mount") ];
+        after = [ ((replaceStrings [ "/" ] [ "-" ] opts.fileSystem) + ".mount") ];
 
         restartTriggers = [ config.environment.etc.projects.source ];
 
diff --git a/nixos/modules/services/mail/listmonk.nix b/nixos/modules/services/mail/listmonk.nix
index c4ea6747196c..8b636bd5b1ff 100644
--- a/nixos/modules/services/mail/listmonk.nix
+++ b/nixos/modules/services/mail/listmonk.nix
@@ -8,7 +8,7 @@ let
   # Escaping is done according to https://www.postgresql.org/docs/current/sql-syntax-lexical.html#SQL-SYNTAX-CONSTANTS
   setDatabaseOption = key: value:
     "UPDATE settings SET value = '${
-      lib.replaceChars [ "'" ] [ "''" ] (builtins.toJSON value)
+      lib.replaceStrings [ "'" ] [ "''" ] (builtins.toJSON value)
     }' WHERE key = '${key}';";
   updateDatabaseConfigSQL = pkgs.writeText "update-database-config.sql"
     (concatStringsSep "\n" (mapAttrsToList setDatabaseOption
diff --git a/nixos/modules/services/monitoring/prometheus/default.nix b/nixos/modules/services/monitoring/prometheus/default.nix
index f6bae8f9e965..f516b75ab10f 100644
--- a/nixos/modules/services/monitoring/prometheus/default.nix
+++ b/nixos/modules/services/monitoring/prometheus/default.nix
@@ -3,7 +3,7 @@
 with lib;
 
 let
-  json = pkgs.formats.json { };
+  yaml = pkgs.formats.yaml { };
   cfg = config.services.prometheus;
   checkConfigEnabled =
     (lib.isBool cfg.checkConfig && cfg.checkConfig)
@@ -11,8 +11,6 @@ let
 
   workingDir = "/var/lib/" + cfg.stateDir;
 
-  prometheusYmlOut = "${workingDir}/prometheus-substituted.yaml";
-
   triggerReload = pkgs.writeShellScriptBin "trigger-reload-prometheus" ''
     PATH="${makeBinPath (with pkgs; [ systemd ])}"
     if systemctl -q is-active prometheus.service; then
@@ -38,7 +36,7 @@ let
         promtool ${what} $out
       '' else file;
 
-  generatedPrometheusYml = json.generate "prometheus.yml" promConfig;
+  generatedPrometheusYml = yaml.generate "prometheus.yml" promConfig;
 
   # This becomes the main config file for Prometheus
   promConfig = {
@@ -73,7 +71,8 @@ let
     "--web.listen-address=${cfg.listenAddress}:${builtins.toString cfg.port}"
     "--alertmanager.notification-queue-capacity=${toString cfg.alertmanagerNotificationQueueCapacity}"
   ] ++ optional (cfg.webExternalUrl != null) "--web.external-url=${cfg.webExternalUrl}"
-    ++ optional (cfg.retentionTime != null) "--storage.tsdb.retention.time=${cfg.retentionTime}";
+    ++ optional (cfg.retentionTime != null) "--storage.tsdb.retention.time=${cfg.retentionTime}"
+    ++ optional (cfg.webConfigFile != null) "--web.config.file=${cfg.webConfigFile}";
 
   filterValidPrometheus = filterAttrsListRecursive (n: v: !(n == "_module" || v == null));
   filterAttrsListRecursive = pred: x:
@@ -1719,6 +1718,15 @@ in
       '';
     };
 
+    webConfigFile = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      description = lib.mdDoc ''
+        Specifies which file should be used as web.config.file and be passed on startup.
+        See https://prometheus.io/docs/prometheus/latest/configuration/https/ for valid options.
+      '';
+    };
+
     checkConfig = mkOption {
       type = with types; either bool (enum [ "syntax-only" ]);
       default = true;
diff --git a/nixos/modules/services/networking/supplicant.nix b/nixos/modules/services/networking/supplicant.nix
index 0a48e73932e8..13d84736e2c2 100644
--- a/nixos/modules/services/networking/supplicant.nix
+++ b/nixos/modules/services/networking/supplicant.nix
@@ -13,7 +13,7 @@ let
   serviceName = iface: "supplicant-${if (iface=="WLAN") then "wlan@" else (
                                      if (iface=="LAN") then "lan@" else (
                                      if (iface=="DBUS") then "dbus"
-                                     else (replaceChars [" "] ["-"] iface)))}";
+                                     else (replaceStrings [" "] ["-"] iface)))}";
 
   # TODO: Use proper privilege separation for wpa_supplicant
   supplicantService = iface: suppl:
@@ -27,7 +27,7 @@ let
       driverArg = optionalString (suppl.driver != null) "-D${suppl.driver}";
       bridgeArg = optionalString (suppl.bridge!="") "-b${suppl.bridge}";
       confFileArg = optionalString (suppl.configFile.path!=null) "-c${suppl.configFile.path}";
-      extraConfFile = pkgs.writeText "supplicant-extra-conf-${replaceChars [" "] ["-"] iface}" ''
+      extraConfFile = pkgs.writeText "supplicant-extra-conf-${replaceStrings [" "] ["-"] iface}" ''
         ${optionalString suppl.userControlled.enable "ctrl_interface=DIR=${suppl.userControlled.socketDir} GROUP=${suppl.userControlled.group}"}
         ${optionalString suppl.configFile.writable "update_config=1"}
         ${suppl.extraConf}
@@ -223,7 +223,7 @@ in
         text = ''
           ${flip (concatMapStringsSep "\n") (filter (n: n!="WLAN" && n!="LAN" && n!="DBUS") (attrNames cfg)) (iface:
             flip (concatMapStringsSep "\n") (splitString " " iface) (i: ''
-              ACTION=="add", SUBSYSTEM=="net", ENV{INTERFACE}=="${i}", TAG+="systemd", ENV{SYSTEMD_WANTS}+="supplicant-${replaceChars [" "] ["-"] iface}.service", TAG+="SUPPLICANT_ASSIGNED"''))}
+              ACTION=="add", SUBSYSTEM=="net", ENV{INTERFACE}=="${i}", TAG+="systemd", ENV{SYSTEMD_WANTS}+="supplicant-${replaceStrings [" "] ["-"] iface}.service", TAG+="SUPPLICANT_ASSIGNED"''))}
 
           ${optionalString (hasAttr "WLAN" cfg) ''
             ACTION=="add", SUBSYSTEM=="net", ENV{DEVTYPE}=="wlan", TAG!="SUPPLICANT_ASSIGNED", TAG+="systemd", PROGRAM="/run/current-system/systemd/bin/systemd-escape -p %E{INTERFACE}", ENV{SYSTEMD_WANTS}+="supplicant-wlan@$result.service"
diff --git a/nixos/modules/services/networking/wireguard.nix b/nixos/modules/services/networking/wireguard.nix
index ce5616672c16..9c13f8b847d1 100644
--- a/nixos/modules/services/networking/wireguard.nix
+++ b/nixos/modules/services/networking/wireguard.nix
@@ -315,7 +315,7 @@ let
 
   peerUnitServiceName = interfaceName: publicKey: dynamicRefreshEnabled:
     let
-      keyToUnitName = replaceChars
+      keyToUnitName = replaceStrings
         [ "/" "-"    " "     "+"     "="      ]
         [ "-" "\\x2d" "\\x20" "\\x2b" "\\x3d" ];
       unitName = keyToUnitName publicKey;
diff --git a/nixos/modules/system/boot/loader/grub/grub.nix b/nixos/modules/system/boot/loader/grub/grub.nix
index a67b10608aa7..1d266b5a37d5 100644
--- a/nixos/modules/system/boot/loader/grub/grub.nix
+++ b/nixos/modules/system/boot/loader/grub/grub.nix
@@ -38,7 +38,7 @@ let
   grubConfig = args:
     let
       efiSysMountPoint = if args.efiSysMountPoint == null then args.path else args.efiSysMountPoint;
-      efiSysMountPoint' = replaceChars [ "/" ] [ "-" ] efiSysMountPoint;
+      efiSysMountPoint' = replaceStrings [ "/" ] [ "-" ] efiSysMountPoint;
     in
     pkgs.writeText "grub-config.xml" (builtins.toXML
     { splashImage = f cfg.splashImage;
diff --git a/nixos/modules/tasks/network-interfaces.nix b/nixos/modules/tasks/network-interfaces.nix
index 4c211b747614..4d47a56ccca3 100644
--- a/nixos/modules/tasks/network-interfaces.nix
+++ b/nixos/modules/tasks/network-interfaces.nix
@@ -1377,12 +1377,12 @@ in
       # networkmanager falls back to "/proc/sys/net/ipv6/conf/default/use_tempaddr"
       "net.ipv6.conf.default.use_tempaddr" = tempaddrValues.${cfg.tempAddresses}.sysctl;
     } // listToAttrs (forEach interfaces
-        (i: nameValuePair "net.ipv4.conf.${replaceChars ["."] ["/"] i.name}.proxy_arp" i.proxyARP))
+        (i: nameValuePair "net.ipv4.conf.${replaceStrings ["."] ["/"] i.name}.proxy_arp" i.proxyARP))
       // listToAttrs (forEach interfaces
         (i: let
           opt = i.tempAddress;
           val = tempaddrValues.${opt}.sysctl;
-         in nameValuePair "net.ipv6.conf.${replaceChars ["."] ["/"] i.name}.use_tempaddr" val));
+         in nameValuePair "net.ipv6.conf.${replaceStrings ["."] ["/"] i.name}.use_tempaddr" val));
 
     security.wrappers = {
       ping = {
@@ -1495,7 +1495,7 @@ in
           in
           ''
             # override to ${msg} for ${i.name}
-            ACTION=="add", SUBSYSTEM=="net", RUN+="${pkgs.procps}/bin/sysctl net.ipv6.conf.${replaceChars ["."] ["/"] i.name}.use_tempaddr=${val}"
+            ACTION=="add", SUBSYSTEM=="net", RUN+="${pkgs.procps}/bin/sysctl net.ipv6.conf.${replaceStrings ["."] ["/"] i.name}.use_tempaddr=${val}"
           '') (filter (i: i.tempAddress != cfg.tempAddresses) interfaces);
       })
     ] ++ lib.optional (cfg.wlanInterfaces != {})
diff --git a/nixos/tests/installer.nix b/nixos/tests/installer.nix
index 9b3c8a762991..398ad8de19cf 100644
--- a/nixos/tests/installer.nix
+++ b/nixos/tests/installer.nix
@@ -57,7 +57,7 @@ let
 
         hardware.enableAllFirmware = lib.mkForce false;
 
-        ${replaceChars ["\n"] ["\n  "] extraConfig}
+        ${replaceStrings ["\n"] ["\n  "] extraConfig}
       }
     '';
 
diff --git a/nixos/tests/prometheus-exporters.nix b/nixos/tests/prometheus-exporters.nix
index 8b40d7e41c00..fa8c59170bf5 100644
--- a/nixos/tests/prometheus-exporters.nix
+++ b/nixos/tests/prometheus-exporters.nix
@@ -6,7 +6,7 @@
 let
   inherit (import ../lib/testing-python.nix { inherit system pkgs; }) makeTest;
   inherit (pkgs.lib) concatStringsSep maintainers mapAttrs mkMerge
-    removeSuffix replaceChars singleton splitString;
+    removeSuffix replaceStrings singleton splitString;
 
   /*
     * The attrset `exporterTests` contains one attribute
@@ -182,7 +182,7 @@ let
         enable = true;
         extraFlags = [ "--web.collectd-push-path /collectd" ];
       };
-      exporterTest = let postData = replaceChars [ "\n" ] [ "" ] ''
+      exporterTest = let postData = replaceStrings [ "\n" ] [ "" ] ''
         [{
           "values":[23],
           "dstypes":["gauge"],
diff --git a/pkgs/applications/audio/munt/libmt32emu.nix b/pkgs/applications/audio/munt/libmt32emu.nix
index d8b2ae1510cc..571cd16e2aa8 100644
--- a/pkgs/applications/audio/munt/libmt32emu.nix
+++ b/pkgs/applications/audio/munt/libmt32emu.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "munt";
     repo = "munt";
-    rev = "${pname}_${lib.replaceChars [ "." ] [ "_" ] version}";
+    rev = "${pname}_${lib.replaceStrings [ "." ] [ "_" ] version}";
     sha256 = "sha256-XGds9lDfSiY0D8RhYG4TGyjYEVvVYuAfNSv9+VxiJEs=";
   };
 
diff --git a/pkgs/applications/audio/munt/mt32emu-qt.nix b/pkgs/applications/audio/munt/mt32emu-qt.nix
index 207fbc3717f7..92488ac587b6 100644
--- a/pkgs/applications/audio/munt/mt32emu-qt.nix
+++ b/pkgs/applications/audio/munt/mt32emu-qt.nix
@@ -14,7 +14,7 @@
 }:
 
 let
-  char2underscore = char: str: lib.replaceChars [ char ] [ "_" ] str;
+  char2underscore = char: str: lib.replaceStrings [ char ] [ "_" ] str;
 in
 mkDerivation rec {
   pname = "mt32emu-qt";
diff --git a/pkgs/applications/audio/munt/mt32emu-smf2wav.nix b/pkgs/applications/audio/munt/mt32emu-smf2wav.nix
index 86b5dcee4a65..b9e87a305303 100644
--- a/pkgs/applications/audio/munt/mt32emu-smf2wav.nix
+++ b/pkgs/applications/audio/munt/mt32emu-smf2wav.nix
@@ -8,7 +8,7 @@
 }:
 
 let
-  char2underscore = char: str: lib.replaceChars [ char ] [ "_" ] str;
+  char2underscore = char: str: lib.replaceStrings [ char ] [ "_" ] str;
 in
 stdenv.mkDerivation rec {
   pname = "mt32emu-smf2wav";
diff --git a/pkgs/applications/audio/qjackctl/default.nix b/pkgs/applications/audio/qjackctl/default.nix
index 434be82f6fb3..2406ba24a8c9 100644
--- a/pkgs/applications/audio/qjackctl/default.nix
+++ b/pkgs/applications/audio/qjackctl/default.nix
@@ -13,7 +13,7 @@ mkDerivation rec {
   src = fetchFromGitHub {
     owner = "rncbc";
     repo = "qjackctl";
-    rev = "${pname}_${lib.replaceChars ["."] ["_"] version}";
+    rev = "${pname}_${lib.replaceStrings ["."] ["_"] version}";
     sha256 = "sha256-PchW9cM5qEP51G9RXUZ3j/AvKqTkgNiw3esqSQqsy0M=";
   };
 
diff --git a/pkgs/applications/audio/roomeqwizard/default.nix b/pkgs/applications/audio/roomeqwizard/default.nix
index b02ab65cd87c..acb7ae6e43a1 100644
--- a/pkgs/applications/audio/roomeqwizard/default.nix
+++ b/pkgs/applications/audio/roomeqwizard/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
   version = "5.20.5";
 
   src = fetchurl {
-    url = "https://www.roomeqwizard.com/installers/REW_linux_${lib.replaceChars [ "." ] [ "_" ] version}.sh";
+    url = "https://www.roomeqwizard.com/installers/REW_linux_${lib.replaceStrings [ "." ] [ "_" ] version}.sh";
     sha256 = "NYTRiOZmwkni4k+jI2SV84z5umO7+l+eKpwPCdlDD3U=";
   };
 
diff --git a/pkgs/applications/editors/jetbrains/linux.nix b/pkgs/applications/editors/jetbrains/linux.nix
index a28029888bb0..dec117def52a 100644
--- a/pkgs/applications/editors/jetbrains/linux.nix
+++ b/pkgs/applications/editors/jetbrains/linux.nix
@@ -21,7 +21,7 @@ with stdenv; lib.makeOverridable mkDerivation (rec {
   desktopItem = makeDesktopItem {
     name = pname;
     exec = pname;
-    comment = lib.replaceChars ["\n"] [" "] meta.longDescription;
+    comment = lib.replaceStrings ["\n"] [" "] meta.longDescription;
     desktopName = product;
     genericName = meta.description;
     categories = [ "Development" ];
diff --git a/pkgs/applications/emulators/atari800/default.nix b/pkgs/applications/emulators/atari800/default.nix
index c1f685827047..0f1d4a47582e 100644
--- a/pkgs/applications/emulators/atari800/default.nix
+++ b/pkgs/applications/emulators/atari800/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "atari800";
     repo = "atari800";
-    rev = "ATARI800_${replaceChars ["."] ["_"] version}";
+    rev = "ATARI800_${replaceStrings ["."] ["_"] version}";
     sha256 = "sha256-+eJXhqPyU0GhmzF7DbteTXzEnn5klCor9Io/UgXQfQg=";
   };
 
diff --git a/pkgs/applications/emulators/desmume/default.nix b/pkgs/applications/emulators/desmume/default.nix
index 74f179324675..2b3deaba653b 100644
--- a/pkgs/applications/emulators/desmume/default.nix
+++ b/pkgs/applications/emulators/desmume/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "TASVideos";
     repo = "desmume";
-    rev = "release_${lib.replaceChars ["."] ["_"] finalAttrs.version}";
+    rev = "release_${lib.replaceStrings ["."] ["_"] finalAttrs.version}";
     hash = "sha256-vmjKXa/iXLTwtqnG+ZUvOnOQPZROeMpfM5J3Jh/Ynfo=";
   };
 
diff --git a/pkgs/applications/emulators/retroarch/mkLibretroCore.nix b/pkgs/applications/emulators/retroarch/mkLibretroCore.nix
index 6ab652127009..829b96387f11 100644
--- a/pkgs/applications/emulators/retroarch/mkLibretroCore.nix
+++ b/pkgs/applications/emulators/retroarch/mkLibretroCore.nix
@@ -16,7 +16,7 @@
 }@args:
 
 let
-  d2u = if normalizeCore then (lib.replaceChars [ "-" ] [ "_" ]) else (x: x);
+  d2u = if normalizeCore then (lib.replaceStrings [ "-" ] [ "_" ]) else (x: x);
   coreDir = placeholder "out" + libretroCore;
   coreFilename = "${d2u core}_libretro${stdenv.hostPlatform.extensions.sharedLibrary}";
   mainProgram = "retroarch-${core}";
diff --git a/pkgs/applications/maui/default.nix b/pkgs/applications/maui/default.nix
index edb6837deaa3..3cd8b56015bb 100644
--- a/pkgs/applications/maui/default.nix
+++ b/pkgs/applications/maui/default.nix
@@ -78,6 +78,7 @@ let
       nota = callPackage ./nota.nix { };
       pix = callPackage ./pix.nix { };
       shelf = callPackage ./shelf.nix { };
+      station = callPackage ./station.nix { };
       vvave = callPackage ./vvave.nix { };
     };
 
diff --git a/pkgs/applications/maui/station.nix b/pkgs/applications/maui/station.nix
new file mode 100644
index 000000000000..49e8cae3f63d
--- /dev/null
+++ b/pkgs/applications/maui/station.nix
@@ -0,0 +1,36 @@
+{ lib
+, mkDerivation
+, cmake
+, extra-cmake-modules
+, kcoreaddons
+, ki18n
+, kirigami2
+, mauikit
+, mauikit-filebrowsing
+, qmltermwidget
+}:
+
+mkDerivation {
+  pname = "station";
+
+  nativeBuildInputs = [
+    cmake
+    extra-cmake-modules
+  ];
+
+  buildInputs = [
+    kcoreaddons
+    ki18n
+    kirigami2
+    mauikit
+    mauikit-filebrowsing
+    qmltermwidget
+  ];
+
+  meta = with lib; {
+    description = "Convergent terminal emulator";
+    homepage = "https://invent.kde.org/maui/station";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ onny ];
+  };
+}
diff --git a/pkgs/applications/misc/sweethome3d/default.nix b/pkgs/applications/misc/sweethome3d/default.nix
index 6450dca82d0a..d505761f8076 100644
--- a/pkgs/applications/misc/sweethome3d/default.nix
+++ b/pkgs/applications/misc/sweethome3d/default.nix
@@ -105,7 +105,7 @@ let
     };
   };
 
-  d2u = lib.replaceChars ["."] ["_"];
+  d2u = lib.replaceStrings ["."] ["_"];
 
 in {
 
diff --git a/pkgs/applications/misc/sweethome3d/editors.nix b/pkgs/applications/misc/sweethome3d/editors.nix
index 9ef9fd0f7f44..6c737f469c67 100644
--- a/pkgs/applications/misc/sweethome3d/editors.nix
+++ b/pkgs/applications/misc/sweethome3d/editors.nix
@@ -81,7 +81,7 @@ let
 
   };
 
-  d2u = lib.replaceChars ["."] ["_"];
+  d2u = lib.replaceStrings ["."] ["_"];
 
 in {
 
diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.json b/pkgs/applications/networking/browsers/chromium/upstream-info.json
index 8cd58ec73796..7521c27d139b 100644
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.json
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json
@@ -19,9 +19,9 @@
     }
   },
   "beta": {
-    "version": "109.0.5414.36",
-    "sha256": "14kicgbadb83401dpfqnz3hb3dxi55nfydj5wpmg29dyw0bdndpm",
-    "sha256bin64": "11lpv9432xqkdj4q89sfyd0261444s9amncnzdmij93ni1wac8b4",
+    "version": "109.0.5414.46",
+    "sha256": "17wzll9024c80fhgxi33ix1rpmqh9sbpx6qvw9cvhdlmhn0b5017",
+    "sha256bin64": "199n8a7pjnhbgkm2dwh9hq7pzf39x932bh6b056jqp032d5c00ns",
     "deps": {
       "gn": {
         "version": "2022-11-10",
@@ -32,9 +32,9 @@
     }
   },
   "dev": {
-    "version": "110.0.5449.0",
-    "sha256": "1zims8jw7k53qpv4kml3n15hy587jgg0sai7j4zrv3i3lk8jr6g7",
-    "sha256bin64": "1ykgxr3jxbqdgrq6g6vzbxnig05vljzdx800j6hn3kxwr9cdqwxn",
+    "version": "110.0.5464.2",
+    "sha256": "18k4rrwszk4xz416xi6li9b5pdajlscfgg4cyv67y10z7f28qwby",
+    "sha256bin64": "0hzv55bba4041400zjysgzz1n8svzvi156xyrayfr5ynapf7g2rd",
     "deps": {
       "gn": {
         "version": "2022-11-29",
@@ -45,8 +45,8 @@
     }
   },
   "ungoogled-chromium": {
-    "version": "108.0.5359.99",
-    "sha256": "0v5ynal3s28s4f9s4s95hblnjxiy6498qmk04s0vf2ixqwi7rivn",
+    "version": "108.0.5359.125",
+    "sha256": "0n8aigw7qv6dzd8898xz435kj79z73v916amfaxyz69g57pnpqhn",
     "sha256bin64": null,
     "deps": {
       "gn": {
@@ -56,8 +56,8 @@
         "sha256": "1rhadb6qk867jafr85x2m3asis3jv7x06blhmad2d296p26d5w6x"
       },
       "ungoogled-patches": {
-        "rev": "108.0.5359.99-1",
-        "sha256": "0qibibgi54mdwmmcmz613qk9mgjczspvq09bz5m0wpkxbx7hla0i"
+        "rev": "108.0.5359.125-1",
+        "sha256": "1dacvzi6j4xyjjnrsb79mhhj7jc992z1di9acl4appfydlqadgv3"
       }
     }
   }
diff --git a/pkgs/applications/science/math/weka/default.nix b/pkgs/applications/science/math/weka/default.nix
index 6a9eeff3b57c..c29015402a39 100644
--- a/pkgs/applications/science/math/weka/default.nix
+++ b/pkgs/applications/science/math/weka/default.nix
@@ -5,7 +5,7 @@ stdenv.mkDerivation rec {
   version = "3.9.6";
 
   src = fetchurl {
-    url = "mirror://sourceforge/weka/${lib.replaceChars ["."]["-"] "${pname}-${version}"}.zip";
+    url = "mirror://sourceforge/weka/${lib.replaceStrings ["."]["-"] "${pname}-${version}"}.zip";
     sha256 = "sha256-8fVN4MXYqXNEmyVtXh1IrauHTBZWgWG8AvsGI5Y9Aj0=";
   };
 
diff --git a/pkgs/applications/science/misc/openmodelica/omlibrary/fakegit.nix b/pkgs/applications/science/misc/openmodelica/omlibrary/fakegit.nix
index fdbc79aae599..cad21c2a6e44 100644
--- a/pkgs/applications/science/misc/openmodelica/omlibrary/fakegit.nix
+++ b/pkgs/applications/science/misc/openmodelica/omlibrary/fakegit.nix
@@ -13,7 +13,7 @@ let
 
   hashname = r:
     let
-      rpl = lib.replaceChars [ ":" "/" ] [ "_" "_" ];
+      rpl = lib.replaceStrings [ ":" "/" ] [ "_" "_" ];
     in
     (rpl r.url) + "-" + (rpl r.rev);
 
diff --git a/pkgs/build-support/fetchmavenartifact/default.nix b/pkgs/build-support/fetchmavenartifact/default.nix
index 4274b4b52bfa..efdbd0decf95 100644
--- a/pkgs/build-support/fetchmavenartifact/default.nix
+++ b/pkgs/build-support/fetchmavenartifact/default.nix
@@ -39,14 +39,14 @@ assert (repos != []) || (url != "") || (urls != []);
 let
   name_ =
     lib.concatStrings [
-      (lib.replaceChars ["."] ["_"] groupId) "_"
-      (lib.replaceChars ["."] ["_"] artifactId) "-"
+      (lib.replaceStrings ["."] ["_"] groupId) "_"
+      (lib.replaceStrings ["."] ["_"] artifactId) "-"
       version
     ];
   mkJarUrl = repoUrl:
     lib.concatStringsSep "/" [
       (lib.removeSuffix "/" repoUrl)
-      (lib.replaceChars ["."] ["/"] groupId)
+      (lib.replaceStrings ["."] ["/"] groupId)
       artifactId
       version
       "${artifactId}-${version}${lib.optionalString (!isNull classifier) "-${classifier}"}.jar"
diff --git a/pkgs/build-support/rust/build-rust-crate/configure-crate.nix b/pkgs/build-support/rust/build-rust-crate/configure-crate.nix
index ea150c2fe85d..1c946764c758 100644
--- a/pkgs/build-support/rust/build-rust-crate/configure-crate.nix
+++ b/pkgs/build-support/rust/build-rust-crate/configure-crate.nix
@@ -32,7 +32,7 @@ let version_ = lib.splitString "-" crateVersion;
     completeDepsDir = lib.concatStringsSep " " completeDeps;
     completeBuildDepsDir = lib.concatStringsSep " " completeBuildDeps;
     envFeatures = lib.concatStringsSep " " (
-      map (f: lib.replaceChars ["-"] ["_"] (lib.toUpper f)) crateFeatures
+      map (f: lib.replaceStrings ["-"] ["_"] (lib.toUpper f)) crateFeatures
     );
 in ''
   ${echo_colored colors}
diff --git a/pkgs/development/compilers/elm/makeDotElm.nix b/pkgs/development/compilers/elm/makeDotElm.nix
index b8076d72e481..43252747c3a3 100644
--- a/pkgs/development/compilers/elm/makeDotElm.nix
+++ b/pkgs/development/compilers/elm/makeDotElm.nix
@@ -3,7 +3,7 @@
 ver: deps:
   let cmds = lib.mapAttrsToList (name: info: let
                pkg = stdenv.mkDerivation {
-                 name = lib.replaceChars ["/"] ["-"] name + "-${info.version}";
+                 name = lib.replaceStrings ["/"] ["-"] name + "-${info.version}";
 
                  src = fetchurl {
                    url = "https://github.com/${name}/archive/${info.version}.tar.gz";
diff --git a/pkgs/development/interpreters/gauche/default.nix b/pkgs/development/interpreters/gauche/default.nix
index 86dc7d666d2b..31492620cb9f 100644
--- a/pkgs/development/interpreters/gauche/default.nix
+++ b/pkgs/development/interpreters/gauche/default.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "shirok";
     repo = pname;
-    rev = "release${lib.replaceChars [ "." ] [ "_" ] version}";
+    rev = "release${lib.replaceStrings [ "." ] [ "_" ] version}";
     sha256 = "0ki1w7sa10ivmg51sqjskby0gsznb0d3738nz80x589033km5hmb";
   };
 
diff --git a/pkgs/development/libraries/icu/base.nix b/pkgs/development/libraries/icu/base.nix
index e1b2ccda3552..a714e758bd88 100644
--- a/pkgs/development/libraries/icu/base.nix
+++ b/pkgs/development/libraries/icu/base.nix
@@ -9,7 +9,7 @@ let
 
   baseAttrs = {
     src = fetchurl {
-      url = "https://github.com/unicode-org/icu/releases/download/release-${lib.replaceChars [ "." ] [ "-" ] version}/icu4c-${lib.replaceChars [ "." ] [ "_" ] version}-src.tgz";
+      url = "https://github.com/unicode-org/icu/releases/download/release-${lib.replaceStrings [ "." ] [ "-" ] version}/icu4c-${lib.replaceStrings [ "." ] [ "_" ] version}-src.tgz";
       inherit sha256;
     };
 
diff --git a/pkgs/development/libraries/java/hsqldb/default.nix b/pkgs/development/libraries/java/hsqldb/default.nix
index b5d93069cf8f..deb895da7d9c 100644
--- a/pkgs/development/libraries/java/hsqldb/default.nix
+++ b/pkgs/development/libraries/java/hsqldb/default.nix
@@ -3,7 +3,7 @@
 stdenv.mkDerivation rec {
   pname = "hsqldb";
   version = "2.7.1";
-  underscoreMajMin = lib.strings.replaceChars ["."] ["_"] (lib.versions.majorMinor version);
+  underscoreMajMin = lib.replaceStrings ["."] ["_"] (lib.versions.majorMinor version);
 
   src = fetchurl {
     url = "mirror://sourceforge/project/hsqldb/hsqldb/hsqldb_${underscoreMajMin}/hsqldb-${version}.zip";
diff --git a/pkgs/development/libraries/muparser/default.nix b/pkgs/development/libraries/muparser/default.nix
index f213f39c06d3..910a25134989 100644
--- a/pkgs/development/libraries/muparser/default.nix
+++ b/pkgs/development/libraries/muparser/default.nix
@@ -3,7 +3,7 @@
 stdenv.mkDerivation rec {
   pname = "muparser";
   version = "2.2.3";
-  url-version = lib.replaceChars ["."] ["_"] version;
+  url-version = lib.replaceStrings ["."] ["_"] version;
 
   src = fetchurl {
     url = "mirror://sourceforge/muparser/muparser_v${url-version}.zip";
diff --git a/pkgs/development/libraries/opendkim/default.nix b/pkgs/development/libraries/opendkim/default.nix
index 22c5fca76a48..00b5d624153a 100644
--- a/pkgs/development/libraries/opendkim/default.nix
+++ b/pkgs/development/libraries/opendkim/default.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "trusteddomainproject";
     repo = "OpenDKIM";
-    rev = "rel-opendkim-${lib.replaceChars ["."] ["-"] version}";
+    rev = "rel-opendkim-${lib.replaceStrings ["."] ["-"] version}";
     sha256 = "0nx3in8sa6xna4vfacj8g60hfzk61jpj2ldag80xzxip9c3rd2pw";
   };
 
diff --git a/pkgs/development/libraries/opensubdiv/default.nix b/pkgs/development/libraries/opensubdiv/default.nix
index 026465c97ae8..46bbc079aeb8 100644
--- a/pkgs/development/libraries/opensubdiv/default.nix
+++ b/pkgs/development/libraries/opensubdiv/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "PixarAnimationStudios";
     repo = "OpenSubdiv";
-    rev = "v${lib.replaceChars ["."] ["_"] version}";
+    rev = "v${lib.replaceStrings ["."] ["_"] version}";
     sha256 = "sha256-ejxQ5mGIIrEa/rAfkTrRbIRerrAvEPoWn7e0lIqS1JQ=";
   };
 
diff --git a/pkgs/development/mobile/androidenv/build-app.nix b/pkgs/development/mobile/androidenv/build-app.nix
index 6f4b32b486ba..7e34c34607eb 100644
--- a/pkgs/development/mobile/androidenv/build-app.nix
+++ b/pkgs/development/mobile/androidenv/build-app.nix
@@ -16,7 +16,7 @@ let
   extraArgs = removeAttrs args ([ "name" ] ++ builtins.attrNames androidSdkFormalArgs);
 in
 stdenv.mkDerivation ({
-  name = lib.replaceChars [" "] [""] name; # Android APKs may contain white spaces in their names, but Nix store paths cannot
+  name = lib.replaceStrings [" "] [""] name; # Android APKs may contain white spaces in their names, but Nix store paths cannot
   ANDROID_HOME = "${androidsdk}/libexec/android-sdk";
   buildInputs = [ jdk ant ];
   buildPhase = ''
diff --git a/pkgs/development/mobile/androidenv/build-tools.nix b/pkgs/development/mobile/androidenv/build-tools.nix
index 1f1316d8fb6b..2b094df03455 100644
--- a/pkgs/development/mobile/androidenv/build-tools.nix
+++ b/pkgs/development/mobile/androidenv/build-tools.nix
@@ -1,10 +1,10 @@
-{deployAndroidPackage, lib, package, os, autoPatchelfHook, makeWrapper, pkgs, pkgs_i686}:
+{deployAndroidPackage, lib, package, os, autoPatchelfHook, makeWrapper, pkgs, pkgsi686Linux}:
 
 deployAndroidPackage {
   inherit package os;
   nativeBuildInputs = [ makeWrapper ]
     ++ lib.optionals (os == "linux") [ autoPatchelfHook ];
-  buildInputs = lib.optionals (os == "linux") [ pkgs.glibc pkgs.zlib pkgs.ncurses5 pkgs_i686.glibc pkgs_i686.zlib pkgs_i686.ncurses5 pkgs.libcxx ];
+  buildInputs = lib.optionals (os == "linux") [ pkgs.glibc pkgs.zlib pkgs.ncurses5 pkgsi686Linux.glibc pkgsi686Linux.zlib pkgsi686Linux.ncurses5 pkgs.libcxx ];
   patchInstructions = ''
     ${lib.optionalString (os == "linux") ''
       addAutoPatchelfSearchPath $packageBaseDir/lib
diff --git a/pkgs/development/mobile/androidenv/compose-android-packages.nix b/pkgs/development/mobile/androidenv/compose-android-packages.nix
index e379c12f9716..6f3cd94a7791 100644
--- a/pkgs/development/mobile/androidenv/compose-android-packages.nix
+++ b/pkgs/development/mobile/androidenv/compose-android-packages.nix
@@ -1,4 +1,4 @@
-{ requireFile, autoPatchelfHook, pkgs, pkgsHostHost, pkgs_i686
+{ callPackage, stdenv, lib, fetchurl, ruby, writeText
 , licenseAccepted ? false
 }:
 
@@ -25,9 +25,6 @@
 }:
 
 let
-  inherit (pkgs) stdenv lib fetchurl;
-  inherit (pkgs.buildPackages) makeWrapper unzip;
-
   # Determine the Android os identifier from Nix's system identifier
   os = if stdenv.system == "x86_64-linux" then "linux"
     else if stdenv.system == "x86_64-darwin" then "macosx"
@@ -35,7 +32,7 @@ let
 
   # Uses mkrepo.rb to create a repo spec.
   mkRepoJson = { packages ? [], images ? [], addons ? [] }: let
-    mkRepoRuby = (pkgs.ruby.withPackages (pkgs: with pkgs; [ slop nokogiri ]));
+    mkRepoRuby = (ruby.withPackages (pkgs: with pkgs; [ slop nokogiri ]));
     mkRepoRubyArguments = lib.lists.flatten [
       (builtins.map (package: ["--packages" "${package}"]) packages)
       (builtins.map (image: ["--images" "${image}"]) images)
@@ -115,25 +112,24 @@ let
   ] ++ extraLicenses);
 in
 rec {
-  deployAndroidPackage = import ./deploy-androidpackage.nix {
-    inherit stdenv unzip;
+  deployAndroidPackage = callPackage ./deploy-androidpackage.nix {
   };
 
-  platform-tools = import ./platform-tools.nix {
-    inherit deployAndroidPackage autoPatchelfHook pkgs lib;
+  platform-tools = callPackage ./platform-tools.nix {
+    inherit deployAndroidPackage;
     os = if stdenv.system == "aarch64-darwin" then "macosx" else os; # "macosx" is a universal binary here
     package = packages.platform-tools.${platformToolsVersion};
   };
 
   build-tools = map (version:
-    import ./build-tools.nix {
-      inherit deployAndroidPackage os autoPatchelfHook makeWrapper pkgs pkgs_i686 lib;
+    callPackage ./build-tools.nix {
+      inherit deployAndroidPackage;
       package = packages.build-tools.${version};
     }
   ) buildToolsVersions;
 
-  emulator = import ./emulator.nix {
-    inherit deployAndroidPackage os autoPatchelfHook makeWrapper pkgs pkgs_i686 lib;
+  emulator = callPackage ./emulator.nix {
+    inherit deployAndroidPackage os;
     package = packages.emulator.${emulatorVersion};
   };
 
@@ -171,16 +167,16 @@ rec {
   ) platformVersions);
 
   cmake = map (version:
-    import ./cmake.nix {
-      inherit deployAndroidPackage os autoPatchelfHook pkgs lib stdenv;
+    callPackage ./cmake.nix {
+      inherit deployAndroidPackage os;
       package = packages.cmake.${version};
     }
   ) cmakeVersions;
 
   # Creates a NDK bundle.
   makeNdkBundle = ndkVersion:
-    import ./ndk-bundle {
-      inherit deployAndroidPackage os autoPatchelfHook makeWrapper pkgs pkgsHostHost lib platform-tools stdenv;
+    callPackage ./ndk-bundle {
+      inherit deployAndroidPackage os platform-tools;
       package = packages.ndk-bundle.${ndkVersion} or packages.ndk.${ndkVersion};
     };
 
@@ -253,8 +249,8 @@ rec {
     ${lib.concatMapStringsSep "\n" (str: "  - ${str}") licenseNames}
 
     by setting nixpkgs config option 'android_sdk.accept_license = true;'.
-  '' else import ./tools.nix {
-    inherit deployAndroidPackage requireFile packages toolsVersion autoPatchelfHook makeWrapper os pkgs pkgs_i686 lib;
+  '' else callPackage ./tools.nix {
+    inherit deployAndroidPackage packages toolsVersion;
 
     postInstall = ''
       # Symlink all requested plugins
@@ -323,7 +319,7 @@ rec {
       ${lib.concatMapStrings (licenseName:
         let
           licenseHashes = builtins.concatStringsSep "\n" (mkLicenseHashes licenseName);
-          licenseHashFile = pkgs.writeText "androidenv-${licenseName}" licenseHashes;
+          licenseHashFile = writeText "androidenv-${licenseName}" licenseHashes;
         in
         ''
           ln -s ${licenseHashFile} licenses/${licenseName}
diff --git a/pkgs/development/mobile/androidenv/default.nix b/pkgs/development/mobile/androidenv/default.nix
index a13b98cf945c..90064becfb5b 100644
--- a/pkgs/development/mobile/androidenv/default.nix
+++ b/pkgs/development/mobile/androidenv/default.nix
@@ -1,21 +1,17 @@
-{ config, pkgs ? import <nixpkgs> {}, pkgsHostHost ? pkgs.pkgsHostHost
-, pkgs_i686 ? import <nixpkgs> { system = "i686-linux"; }
+{ config, pkgs ? import <nixpkgs> {}
 , licenseAccepted ? config.android_sdk.accept_license or false
 }:
 
 rec {
-  composeAndroidPackages = import ./compose-android-packages.nix {
-    inherit (pkgs) requireFile autoPatchelfHook;
-    inherit pkgs pkgsHostHost pkgs_i686 licenseAccepted;
+  composeAndroidPackages = pkgs.callPackage ./compose-android-packages.nix {
+    inherit licenseAccepted;
   };
 
-  buildApp = import ./build-app.nix {
-    inherit (pkgs) stdenv lib jdk ant gnumake gawk;
+  buildApp = pkgs.callPackage ./build-app.nix {
     inherit composeAndroidPackages;
   };
 
-  emulateApp = import ./emulate-app.nix {
-    inherit (pkgs) stdenv lib runtimeShell;
+  emulateApp = pkgs.callPackage ./emulate-app.nix {
     inherit composeAndroidPackages;
   };
 
diff --git a/pkgs/development/mobile/androidenv/emulator.nix b/pkgs/development/mobile/androidenv/emulator.nix
index f68d51c75c3f..0a680fd360f5 100644
--- a/pkgs/development/mobile/androidenv/emulator.nix
+++ b/pkgs/development/mobile/androidenv/emulator.nix
@@ -1,4 +1,4 @@
-{ deployAndroidPackage, lib, package, os, autoPatchelfHook, makeWrapper, pkgs, pkgs_i686 }:
+{ deployAndroidPackage, lib, package, os, autoPatchelfHook, makeWrapper, pkgs, pkgsi686Linux }:
 
 deployAndroidPackage {
   inherit package os;
@@ -13,7 +13,7 @@ deployAndroidPackage {
       zlib
       ncurses5
       stdenv.cc.cc
-      pkgs_i686.glibc
+      pkgsi686Linux.glibc
       expat
       freetype
       nss
diff --git a/pkgs/development/mobile/androidenv/examples/shell.nix b/pkgs/development/mobile/androidenv/examples/shell.nix
index 074dfc001e68..15021ce4eeeb 100644
--- a/pkgs/development/mobile/androidenv/examples/shell.nix
+++ b/pkgs/development/mobile/androidenv/examples/shell.nix
@@ -7,11 +7,11 @@
     sha256 = "1wg61h4gndm3vcprdcg7rc4s1v3jkm5xd7lw8r2f67w502y94gcy";
   }),
   pkgs ? import nixpkgsSource {},
-  pkgs_i686 ? import nixpkgsSource { system = "i686-linux"; },*/
+  pkgsi686Linux ? import nixpkgsSource { system = "i686-linux"; },*/
 
   # If you want to use the in-tree version of nixpkgs:
   pkgs ? import ../../../../.. {},
-  pkgs_i686 ? import ../../../../.. { system = "i686-linux"; },
+  pkgsi686Linux ? import ../../../../.. { system = "i686-linux"; },
 
   config ? pkgs.config
 }:
@@ -46,13 +46,13 @@ let
   };
 
   androidEnv = pkgs.callPackage "${androidEnvNixpkgs}/pkgs/development/mobile/androidenv" {
-    inherit config pkgs pkgs_i686;
+    inherit config pkgs pkgsi686Linux;
     licenseAccepted = true;
   };*/
 
   # Otherwise, just use the in-tree androidenv:
   androidEnv = pkgs.callPackage ./.. {
-    inherit config pkgs pkgs_i686;
+    inherit config pkgs pkgsi686Linux;
     licenseAccepted = true;
   };
 
diff --git a/pkgs/development/mobile/androidenv/platform-tools.nix b/pkgs/development/mobile/androidenv/platform-tools.nix
index 52443486bbb6..49bc8da92a8b 100644
--- a/pkgs/development/mobile/androidenv/platform-tools.nix
+++ b/pkgs/development/mobile/androidenv/platform-tools.nix
@@ -2,7 +2,8 @@
 
 deployAndroidPackage {
   inherit package os;
-  buildInputs = lib.optionals (os == "linux") [ autoPatchelfHook pkgs.glibc pkgs.zlib pkgs.ncurses5 ];
+  nativeBuildInputs = lib.optionals (os == "linux") [ autoPatchelfHook ];
+  buildInputs = lib.optionals (os == "linux") [ pkgs.glibc pkgs.zlib pkgs.ncurses5 ];
   patchInstructions = lib.optionalString (os == "linux") ''
     addAutoPatchelfSearchPath $packageBaseDir/lib64
     autoPatchelf --no-recurse $packageBaseDir/lib64
diff --git a/pkgs/development/mobile/androidenv/tools.nix b/pkgs/development/mobile/androidenv/tools.nix
index f535672d35ea..36e7e52b80a5 100644
--- a/pkgs/development/mobile/androidenv/tools.nix
+++ b/pkgs/development/mobile/androidenv/tools.nix
@@ -1,7 +1,7 @@
-{deployAndroidPackage, requireFile, lib, packages, toolsVersion, autoPatchelfHook, makeWrapper, os, pkgs, pkgs_i686, postInstall ? ""}:
+{deployAndroidPackage, requireFile, lib, packages, toolsVersion, os, callPackage, postInstall ? ""}:
 
-if toolsVersion == "26.0.1" then import ./tools/26.nix {
-  inherit deployAndroidPackage lib autoPatchelfHook makeWrapper os pkgs pkgs_i686 postInstall;
+if toolsVersion == "26.0.1" then callPackage ./tools/26.nix {
+  inherit deployAndroidPackage lib os postInstall;
   package = {
     name = "tools";
     path = "tools";
@@ -17,10 +17,10 @@ if toolsVersion == "26.0.1" then import ./tools/26.nix {
       };
     };
   };
-} else if toolsVersion == "26.1.1" then import ./tools/26.nix {
-  inherit deployAndroidPackage lib autoPatchelfHook makeWrapper os pkgs pkgs_i686 postInstall;
+} else if toolsVersion == "26.1.1" then callPackage ./tools/26.nix {
+  inherit deployAndroidPackage lib os postInstall;
   package = packages.tools.${toolsVersion};
-} else import ./tools/25.nix {
-  inherit deployAndroidPackage lib autoPatchelfHook makeWrapper os pkgs pkgs_i686 postInstall;
+} else callPackage ./tools/25.nix {
+  inherit deployAndroidPackage lib os postInstall;
   package = packages.tools.${toolsVersion};
 }
diff --git a/pkgs/development/mobile/androidenv/tools/25.nix b/pkgs/development/mobile/androidenv/tools/25.nix
index 82642e04280b..85a114fbc29c 100644
--- a/pkgs/development/mobile/androidenv/tools/25.nix
+++ b/pkgs/development/mobile/androidenv/tools/25.nix
@@ -1,9 +1,9 @@
-{deployAndroidPackage, lib, package, autoPatchelfHook, makeWrapper, os, pkgs, pkgs_i686, postInstall ? ""}:
+{deployAndroidPackage, lib, package, autoPatchelfHook, makeWrapper, os, pkgs, pkgsi686Linux, postInstall ? ""}:
 
 deployAndroidPackage {
   name = "androidsdk";
   nativeBuildInputs = [ autoPatchelfHook makeWrapper ];
-  buildInputs = lib.optionals (os == "linux") [ pkgs.glibc pkgs.xorg.libX11 pkgs.xorg.libXext pkgs.xorg.libXdamage pkgs.xorg.libxcb pkgs.xorg.libXfixes pkgs.xorg.libXrender pkgs.fontconfig.lib pkgs.freetype pkgs.libGL pkgs.zlib pkgs.ncurses5 pkgs.libpulseaudio pkgs_i686.glibc pkgs_i686.xorg.libX11 pkgs_i686.xorg.libXrender pkgs_i686.fontconfig pkgs_i686.freetype pkgs_i686.zlib ];
+  buildInputs = lib.optionals (os == "linux") [ pkgs.glibc pkgs.xorg.libX11 pkgs.xorg.libXext pkgs.xorg.libXdamage pkgs.xorg.libxcb pkgs.xorg.libXfixes pkgs.xorg.libXrender pkgs.fontconfig.lib pkgs.freetype pkgs.libGL pkgs.zlib pkgs.ncurses5 pkgs.libpulseaudio pkgsi686Linux.glibc pkgsi686Linux.xorg.libX11 pkgsi686Linux.xorg.libXrender pkgsi686Linux.fontconfig pkgsi686Linux.freetype pkgsi686Linux.zlib ];
   inherit package os;
 
   patchInstructions = ''
diff --git a/pkgs/development/mobile/androidenv/tools/26.nix b/pkgs/development/mobile/androidenv/tools/26.nix
index 2f4f88a75975..527d36027183 100644
--- a/pkgs/development/mobile/androidenv/tools/26.nix
+++ b/pkgs/development/mobile/androidenv/tools/26.nix
@@ -1,4 +1,4 @@
-{deployAndroidPackage, lib, package, autoPatchelfHook, makeWrapper, os, pkgs, pkgs_i686, postInstall ? ""}:
+{deployAndroidPackage, lib, package, autoPatchelfHook, makeWrapper, os, pkgs, pkgsi686Linux, postInstall ? ""}:
 
 deployAndroidPackage {
   name = "androidsdk";
@@ -8,7 +8,7 @@ deployAndroidPackage {
   buildInputs = lib.optional (os == "linux") (
       (with pkgs; [ glibc freetype fontconfig fontconfig.lib])
       ++ (with pkgs.xorg; [ libX11 libXrender libXext ])
-      ++ (with pkgs_i686; [ glibc xorg.libX11 xorg.libXrender xorg.libXext fontconfig.lib freetype zlib ])
+      ++ (with pkgsi686Linux; [ glibc xorg.libX11 xorg.libXrender xorg.libXext fontconfig.lib freetype zlib ])
     );
 
   patchInstructions = ''
diff --git a/pkgs/development/mobile/titaniumenv/build-app.nix b/pkgs/development/mobile/titaniumenv/build-app.nix
index 82a264e702de..e4c3062cf531 100644
--- a/pkgs/development/mobile/titaniumenv/build-app.nix
+++ b/pkgs/development/mobile/titaniumenv/build-app.nix
@@ -34,7 +34,7 @@ let
   extraArgs = removeAttrs args [ "name" "preRebuild" "androidsdkArgs" "xcodewrapperArgs" ];
 in
 stdenv.mkDerivation ({
-  name = lib.replaceChars [" "] [""] name;
+  name = lib.replaceStrings [" "] [""] name;
 
   buildInputs = [ nodejs titanium alloy python which file jdk ];
 
diff --git a/pkgs/development/mobile/xcodeenv/build-app.nix b/pkgs/development/mobile/xcodeenv/build-app.nix
index ae8416c8d769..4bef0ba2db0e 100644
--- a/pkgs/development/mobile/xcodeenv/build-app.nix
+++ b/pkgs/development/mobile/xcodeenv/build-app.nix
@@ -53,7 +53,7 @@ let
   extraArgs = removeAttrs args ([ "name" "scheme" "xcodeFlags" "release" "certificateFile" "certificatePassword" "provisioningProfile" "signMethod" "generateIPA" "generateXCArchive" "enableWirelessDistribution" "installURL" "bundleId" "version" ] ++ builtins.attrNames xcodewrapperFormalArgs);
 in
 stdenv.mkDerivation ({
-  name = lib.replaceChars [" "] [""] name; # iOS app names can contain spaces, but in the Nix store this is not allowed
+  name = lib.replaceStrings [" "] [""] name; # iOS app names can contain spaces, but in the Nix store this is not allowed
   buildPhase = ''
     # Be sure that the Xcode wrapper has priority over everything else.
     # When using buildInputs this does not seem to be the case.
diff --git a/pkgs/development/mobile/xcodeenv/simulate-app.nix b/pkgs/development/mobile/xcodeenv/simulate-app.nix
index ea0502eb9818..ca6806d43b99 100644
--- a/pkgs/development/mobile/xcodeenv/simulate-app.nix
+++ b/pkgs/development/mobile/xcodeenv/simulate-app.nix
@@ -9,7 +9,7 @@ let
   xcodewrapper = composeXcodeWrapper xcodewrapperArgs;
 in
 stdenv.mkDerivation {
-  name = lib.replaceChars [" "] [""] name;
+  name = lib.replaceStrings [" "] [""] name;
   buildCommand = ''
     mkdir -p $out/bin
     cat > $out/bin/run-test-simulator << "EOF"
diff --git a/pkgs/development/python-modules/black/default.nix b/pkgs/development/python-modules/black/default.nix
index 2dd909a338a5..1eda802075bd 100644
--- a/pkgs/development/python-modules/black/default.nix
+++ b/pkgs/development/python-modules/black/default.nix
@@ -23,14 +23,14 @@
 
 buildPythonPackage rec {
   pname = "black";
-  version = "22.10.0";
+  version = "22.12.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-9RNYjaWZlD4M3k4yzJh56CXVhyDWVXBi0QmMWtgAgOE=";
+    hash = "sha256-IpNR5aGMow9Ee/ck0Af4kPl+E68HC7atTApEHNdZai8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/eth-keys/default.nix b/pkgs/development/python-modules/eth-keys/default.nix
index 00029b7df05f..dac43e527cec 100644
--- a/pkgs/development/python-modules/eth-keys/default.nix
+++ b/pkgs/development/python-modules/eth-keys/default.nix
@@ -50,6 +50,8 @@ buildPythonPackage rec {
     "test_public_key_compression_is_equal"
     "test_public_key_decompression_is_equal"
     "test_signatures_with_high_s"
+    # timing sensitive
+    "test_encode_decode_pairings"
   ];
 
   pythonImportsCheck = [ "eth_keys" ];
diff --git a/pkgs/development/python-modules/isort/default.nix b/pkgs/development/python-modules/isort/default.nix
index 466d51266216..799f21bbebe7 100644
--- a/pkgs/development/python-modules/isort/default.nix
+++ b/pkgs/development/python-modules/isort/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "isort";
-  version = "5.10.1";
+  version = "5.11.2";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "PyCQA";
     repo = "isort";
     rev = version;
-    sha256 = "09spgl2k9xrprr5gbpfc91a8p7mx7a0c64ydgc91b3jhrmnd9jg1";
+    sha256 = "sha256-4Du9vYI1srStWCTfZr4Rq3uH5c9cRtR8ZqihI36G6hA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/python-telegram-bot/default.nix b/pkgs/development/python-modules/python-telegram-bot/default.nix
index 47d716d1c868..88cb826dbbf0 100644
--- a/pkgs/development/python-modules/python-telegram-bot/default.nix
+++ b/pkgs/development/python-modules/python-telegram-bot/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "python-telegram-bot";
-  version = "13.14";
+  version = "13.15";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-6TkdQ+sRI94md6nSTqh4qdUyfWWyQZr7plP0dtJq7MM=";
+    hash = "sha256-tAR2BrgIG2K71qo2H3yh7+h/qPGIHsnZMtNYRL9XoVQ=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pytorch-pfn-extras/default.nix b/pkgs/development/python-modules/pytorch-pfn-extras/default.nix
index 8fc3b2eae037..522366fa1d09 100644
--- a/pkgs/development/python-modules/pytorch-pfn-extras/default.nix
+++ b/pkgs/development/python-modules/pytorch-pfn-extras/default.nix
@@ -12,13 +12,13 @@
 
 buildPythonPackage rec {
   pname = "pytorch-pfn-extras";
-  version = "0.6.2";
+  version = "0.6.3";
 
   src = fetchFromGitHub {
     owner = "pfnet";
     repo = pname;
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-J1+y5hHMKC31rIYeWI3Ca8Hdx0FF+MnCOAp0ejHzX/Y=";
+    sha256 = "sha256-B8B5zULIuqiojP7bmj3sABC9dqYLqOX5CfEN6slOFZ8=";
   };
 
   propagatedBuildInputs = [ numpy packaging torch typing-extensions ];
diff --git a/pkgs/development/python-modules/rapidfuzz/default.nix b/pkgs/development/python-modules/rapidfuzz/default.nix
index 307011b63638..e5a22879fe95 100644
--- a/pkgs/development/python-modules/rapidfuzz/default.nix
+++ b/pkgs/development/python-modules/rapidfuzz/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "rapidfuzz";
-  version = "2.13.4";
+  version = "2.13.6";
 
   disabled = pythonOlder "3.7";
 
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "maxbachmann";
     repo = "RapidFuzz";
     rev = "refs/tags/v${version}";
-    hash = "sha256-ztGeWQTEilKzL93fruBpMvQY1W6OiMGvWUK/bgMhYd8=";
+    hash = "sha256-TvauQ5U3+xF01HuYsnmuPn3uqoDSg42vYk2qR9AdBIg=";
   };
 
   nativeBuildInputs = [
@@ -80,7 +80,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Rapid fuzzy string matching";
     homepage = "https://github.com/maxbachmann/RapidFuzz";
-    changelog = "https://github.com/maxbachmann/RapidFuzz/blob/${src.rev}/CHANGELOG.md";
+    changelog = "https://github.com/maxbachmann/RapidFuzz/blob/${src.rev}/CHANGELOG.rst";
     license = licenses.mit;
     maintainers = with maintainers; [ dotlambda ];
   };
diff --git a/pkgs/development/python-modules/scikit-learn/default.nix b/pkgs/development/python-modules/scikit-learn/default.nix
index 9739163cea50..ca5bc74c0105 100644
--- a/pkgs/development/python-modules/scikit-learn/default.nix
+++ b/pkgs/development/python-modules/scikit-learn/default.nix
@@ -95,7 +95,7 @@ buildPythonPackage rec {
     changelog = let
       major = versions.major version;
       minor = versions.minor version;
-      dashVer = replaceChars ["."] ["-"] version;
+      dashVer = replaceStrings ["."] ["-"] version;
     in
       "https://scikit-learn.org/stable/whats_new/v${major}.${minor}.html#version-${dashVer}";
     homepage = "https://scikit-learn.org";
diff --git a/pkgs/development/python-modules/ujson/default.nix b/pkgs/development/python-modules/ujson/default.nix
index 15e71e9544d9..372a2df8413f 100644
--- a/pkgs/development/python-modules/ujson/default.nix
+++ b/pkgs/development/python-modules/ujson/default.nix
@@ -8,12 +8,12 @@
 
 buildPythonPackage rec {
   pname = "ujson";
-  version = "5.5.0";
+  version = "5.6.0";
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-slB3qXHH2ke9aEapEqdH9pY3dtkHIMiGA7G1XYF5B4A=";
+    sha256 = "sha256-+IHi2KAi6Shaouq2uoZ0NY28srV/poYY2I1ik3rD/wQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/haskell/lambdabot/default.nix b/pkgs/development/tools/haskell/lambdabot/default.nix
index 0b0a9778c361..b563fa4b7a75 100644
--- a/pkgs/development/tools/haskell/lambdabot/default.nix
+++ b/pkgs/development/tools/haskell/lambdabot/default.nix
@@ -20,8 +20,8 @@ let allPkgs = pkgs: mueval.defaultPkgs pkgs ++ [ pkgs.lambdabot-trusted ] ++ pac
                             ++ lib.optional withDjinn haskellPackages.djinn
                             ++ lib.optional (aspell != null) aspell
                            );
-    modulesStr = lib.replaceChars ["\n"] [" "] modules;
-    configStr = lib.replaceChars ["\n"] [" "] configuration;
+    modulesStr = lib.replaceStrings ["\n"] [" "] modules;
+    configStr = lib.replaceStrings ["\n"] [" "] configuration;
 
 in haskellLib.overrideCabal (self: {
   patches = (self.patches or []) ++ [ ./custom-config.patch ];
diff --git a/pkgs/development/tools/misc/segger-ozone/default.nix b/pkgs/development/tools/misc/segger-ozone/default.nix
index 7f68d3e7fc66..e5d3ec0ff3f3 100644
--- a/pkgs/development/tools/misc/segger-ozone/default.nix
+++ b/pkgs/development/tools/misc/segger-ozone/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
   version = "3.22a";
 
   src = fetchurl {
-    url = "https://www.segger.com/downloads/jlink/Ozone_Linux_V${(lib.replaceChars ["."] [""] version)}_x86_64.tgz";
+    url = "https://www.segger.com/downloads/jlink/Ozone_Linux_V${(lib.replaceStrings ["."] [""] version)}_x86_64.tgz";
     sha256 = "0v1r8qvp1w2f3yip9fys004pa0smlmq69p7w77lfvghs1rmg1649";
   };
 
diff --git a/pkgs/development/web/kcgi/default.nix b/pkgs/development/web/kcgi/default.nix
index 8845924d886a..84bfc654c773 100644
--- a/pkgs/development/web/kcgi/default.nix
+++ b/pkgs/development/web/kcgi/default.nix
@@ -3,7 +3,7 @@
 stdenv.mkDerivation rec {
   pname = "kcgi";
   version = "0.10.8";
-  underscoreVersion = lib.replaceChars ["."] ["_"] version;
+  underscoreVersion = lib.replaceStrings ["."] ["_"] version;
 
   src = fetchFromGitHub {
     owner = "kristapsdz";
diff --git a/pkgs/games/jumpy/default.nix b/pkgs/games/jumpy/default.nix
index 645069e4354d..332db4a7a0fe 100644
--- a/pkgs/games/jumpy/default.nix
+++ b/pkgs/games/jumpy/default.nix
@@ -2,57 +2,72 @@
 , rustPlatform
 , fetchFromGitHub
 , stdenv
+, makeWrapper
 , pkg-config
 , alsa-lib
-, libGL
-, xorg
+, libxkbcommon
 , udev
-, Cocoa
-, OpenGL
+, vulkan-loader
+, wayland
+, xorg
+, darwin
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "jumpy";
-  version = "0.4.3";
+  version = "0.5.1";
 
   src = fetchFromGitHub {
-    owner = "fishfolks";
+    owner = "fishfolk";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-01zhiQi6v/8ZajsdBU+4hKUCj+PRJ/vUHluOIzy/Gi8=";
+    sha256 = "sha256-5hgd4t9ZKHmv8wzED7Tn+ykzUM0EbQqRX15HBHzXtJY=";
   };
 
-  cargoSha256 = "sha256-AXaGuRqSFiq+Uiy+UaqPdPVyDhCogC64KZZ0Ah1Yo7A=";
+  cargoSha256 = "sha256-cK5n75T+Kkd6F4q4MFZNn0R6W6Nk2/H23AGhIe2FCig=";
 
-  nativeBuildInputs = lib.optionals stdenv.isLinux [
+  nativeBuildInputs = [
+    makeWrapper
+  ] ++ lib.optionals stdenv.isLinux [
     pkg-config
   ];
 
   buildInputs = lib.optionals stdenv.isLinux [
     alsa-lib
-    libGL
-    xorg.libX11
-    xorg.libXi
+    libxkbcommon
     udev
+    vulkan-loader
+    wayland
+    xorg.libX11
+    xorg.libXcursor
+    xorg.libXi
+    xorg.libXi
+    xorg.libXrandr
   ] ++ lib.optionals stdenv.isDarwin [
-    Cocoa
-    OpenGL
+    darwin.apple_sdk.frameworks.Cocoa
+    rustPlatform.bindgenHook
   ];
 
   postPatch = ''
-    substituteInPlace src/main.rs \
-      --replace ./assets $out/share/assets \
-      --replace ./mods $out/share/mods
+    touch ../$(stripHash $cargoDeps)/taffy/README.md
   '';
 
   postInstall = ''
     mkdir $out/share
-    cp -r assets mods $out/share
+    cp -r assets $out/share
+    wrapProgram $out/bin/jumpy \
+      --set-default JUMPY_ASSET_DIR $out/share/assets
+  '';
+
+  postFixup = lib.optionalString stdenv.isLinux ''
+    patchelf $out/bin/.jumpy-wrapped \
+      --add-rpath ${lib.makeLibraryPath [ vulkan-loader ]}
   '';
 
   meta = with lib; {
     description = "A tactical 2D shooter played by up to 4 players online or on a shared screen";
     homepage = "https://fishfight.org/";
+    changelog = "https://github.com/fishfolk/jumpy/releases/tag/v${version}";
     license = with licenses; [ mit /* or */ asl20 ];
     maintainers = with maintainers; [ figsoda ];
   };
diff --git a/pkgs/games/nexuiz/default.nix b/pkgs/games/nexuiz/default.nix
index 4082e853aa30..fe3081109e9b 100644
--- a/pkgs/games/nexuiz/default.nix
+++ b/pkgs/games/nexuiz/default.nix
@@ -11,7 +11,7 @@
 let
   version = "2.5.2";
 
-  version_short = lib.replaceChars [ "." ] [ "" ] version;
+  version_short = lib.replaceStrings [ "." ] [ "" ] version;
 in stdenv.mkDerivation {
   pname = "nexuiz";
   inherit version;
diff --git a/pkgs/games/terraria-server/default.nix b/pkgs/games/terraria-server/default.nix
index 2b63fcca45fc..104633198995 100644
--- a/pkgs/games/terraria-server/default.nix
+++ b/pkgs/games/terraria-server/default.nix
@@ -3,7 +3,7 @@
 stdenv.mkDerivation rec {
   pname = "terraria-server";
   version = "1.4.4.9";
-  urlVersion = lib.replaceChars [ "." ] [ "" ] version;
+  urlVersion = lib.replaceStrings [ "." ] [ "" ] version;
 
   src = fetchurl {
     url = "https://terraria.org/api/download/pc-dedicated-server/terraria-server-${urlVersion}.zip";
diff --git a/pkgs/os-specific/linux/apfs/default.nix b/pkgs/os-specific/linux/apfs/default.nix
index 6b7f596683e4..da0660ad1139 100644
--- a/pkgs/os-specific/linux/apfs/default.nix
+++ b/pkgs/os-specific/linux/apfs/default.nix
@@ -2,17 +2,18 @@
 , stdenv
 , fetchFromGitHub
 , kernel
+, nixosTests
 }:
 
 stdenv.mkDerivation {
   pname = "apfs";
-  version = "unstable-2022-08-15-${kernel.version}";
+  version = "unstable-2022-10-20-${kernel.version}";
 
   src = fetchFromGitHub {
     owner = "linux-apfs";
     repo = "linux-apfs-rw";
-    rev = "e4bf2d51d3fe8485ad2b28a89c157ada32ee3d77";
-    sha256 = "sha256-zvl1H9AIExgt6t2A2w7zDwXmRsmLY8y3P6EfbBuFdh8=";
+    rev = "e6eb67c92d425d395eac1c4403629391bdd5064d";
+    sha256 = "sha256-6rv5qZCjOqt0FaNFhA3tYg6/SdssvoT8kPVhalajgOo=";
   };
 
   hardeningDisable = [ "pic" ];
@@ -24,6 +25,8 @@ stdenv.mkDerivation {
     "INSTALL_MOD_PATH=$(out)"
   ];
 
+  passthru.tests.test = nixosTests.apfs;
+
   meta = with lib; {
     description = "APFS module for linux";
     homepage = "https://github.com/linux-apfs/linux-apfs-rw";
diff --git a/pkgs/servers/invidious/default.nix b/pkgs/servers/invidious/default.nix
index 0b426f13e67e..8b9138e0a4cb 100644
--- a/pkgs/servers/invidious/default.nix
+++ b/pkgs/servers/invidious/default.nix
@@ -44,7 +44,7 @@ crystal.buildCrystalPackage rec {
       substituteInPlace src/invidious.cr \
           --replace ${lib.escapeShellArg branchTemplate} '"master"' \
           --replace ${lib.escapeShellArg commitTemplate} '"${lib.substring 0 7 versions.invidious.rev}"' \
-          --replace ${lib.escapeShellArg versionTemplate} '"${lib.replaceChars ["-"] ["."] (lib.substring 9 10 version)}"' \
+          --replace ${lib.escapeShellArg versionTemplate} '"${lib.replaceStrings ["-"] ["."] (lib.substring 9 10 version)}"' \
           --replace ${lib.escapeShellArg assetCommitTemplate} '"${lib.substring 0 7 versions.invidious.rev}"'
 
       # Patch the assets and locales paths to be absolute
diff --git a/pkgs/servers/mqtt/nanomq/default.nix b/pkgs/servers/mqtt/nanomq/default.nix
index a66922e20245..8587152fc578 100644
--- a/pkgs/servers/mqtt/nanomq/default.nix
+++ b/pkgs/servers/mqtt/nanomq/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "nanomq";
-  version = "0.14.1";
+  version = "0.14.5";
 
   src = fetchFromGitHub {
     owner = "emqx";
     repo = "nanomq";
     rev = finalAttrs.version;
-    hash = "sha256-seSnY09WIBiVDn/wbTe/y/61wY6mDF1cYneKHX3SOag=";
+    hash = "sha256-VbVeePacHrE79qV74rGv70G4Hj6O8nK4XCZ3xKbxuQU=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/servers/plex/raw.nix b/pkgs/servers/plex/raw.nix
index 77f2a5bb8e0e..1bb3b0d0103d 100644
--- a/pkgs/servers/plex/raw.nix
+++ b/pkgs/servers/plex/raw.nix
@@ -12,16 +12,16 @@
 # server, and the FHS userenv and corresponding NixOS module should
 # automatically pick up the changes.
 stdenv.mkDerivation rec {
-  version = "1.29.2.6364-6d72b0cf6";
+  version = "1.30.0.6486-629d58034";
   pname = "plexmediaserver";
 
   # Fetch the source
   src = if stdenv.hostPlatform.system == "aarch64-linux" then fetchurl {
     url = "https://downloads.plex.tv/plex-media-server-new/${version}/debian/plexmediaserver_${version}_arm64.deb";
-    sha256 = "sha256-rd8xnCRniDt6BoOo40g95EwgAT+lFpAOlYHlLAGn9Yc=";
+    sha256 = "sha256-7blNvNx18sazfff6yIlRXp9vKWiRVISccx/8wjxWz34=";
   } else fetchurl {
     url = "https://downloads.plex.tv/plex-media-server-new/${version}/debian/plexmediaserver_${version}_amd64.deb";
-    sha256 = "sha256-6wLfhA1kPVWgREFJnhByewe4u4HCHbj8LY94+piewzE=";
+    sha256 = "sha256-ol0WSYwk0Cmz6xJYe3mqaPDjgi4VPiH+vHnP0BIwVBU=";
   };
 
   outputs = [ "out" "basedb" ];
diff --git a/pkgs/servers/web-apps/morty/default.nix b/pkgs/servers/web-apps/morty/default.nix
index 85731d14d63f..b09490850697 100644
--- a/pkgs/servers/web-apps/morty/default.nix
+++ b/pkgs/servers/web-apps/morty/default.nix
@@ -1,43 +1,28 @@
-{ lib, buildGoPackage, fetchFromGitHub }:
+{ lib, buildGoModule, fetchFromGitHub }:
 
-buildGoPackage rec {
+buildGoModule {
   pname = "morty";
-  version = "0.2.0";
-
-  goPackagePath = "github.com/asciimoo/morty";
+  version = "unstable-2021-04-22";
 
   src = fetchFromGitHub {
     owner = "asciimoo";
     repo = "morty";
-    rev = "v${version}";
-    sha256 = "sha256-NWfsqJKJcRPKR8gWQbgal1JsenDesczPcz/+uzhtefM=";
+    rev = "f5bff1e285d3f973cacf73318e55175edafd633f";
+    sha256 = "sha256-ik2VAPdxllt76UVFt77c1ltxIwFNahAKjn3FuErNFYo=";
   };
 
-  goDeps = ./deps.nix;
+  vendorSha256 = "sha256-3sllcoTDYQBAyAT7e9KeKNrlTEbgnoZc0Vt0ksQByvo=";
 
   meta = with lib; {
-    homepage = "https://github.com/asciimoo/morty";
-    maintainers = with maintainers; [ leenaars ];
-    license = licenses.agpl3;
     description = "Privacy aware web content sanitizer proxy as a service";
     longDescription = ''
-      Morty is a web content sanitizer proxy as a service. It rewrites web
-      pages to exclude malicious HTML tags and attributes. It also replaces
-      external resource references to prevent third party information leaks.
+      Morty rewrites web pages to exclude malicious HTML tags and attributes.
+      It also replaces external resource references to prevent third party information leaks.
 
-      The main goal of morty is to provide a result proxy for searx, but it
-      can be used as a standalone sanitizer service too.
-
-      Features:
-
-      * HTML sanitization
-      * Rewrites HTML/CSS external references to locals
-      * JavaScript blocking
-      * No Cookies forwarded
-      * No Referrers
-      * No Caching/Etag
-      * Supports GET/POST forms and IFrames
-      * Optional HMAC URL verifier key to prevent service abuse
+      The main goal of morty is to provide a result proxy for searx, but it can be used as a standalone sanitizer service too.
     '';
+    homepage = "https://github.com/asciimoo/morty";
+    maintainers = with maintainers; [ leenaars SuperSandro2000 ];
+    license = licenses.agpl3;
   };
 }
diff --git a/pkgs/servers/web-apps/morty/deps.nix b/pkgs/servers/web-apps/morty/deps.nix
deleted file mode 100644
index 643fc5bb7636..000000000000
--- a/pkgs/servers/web-apps/morty/deps.nix
+++ /dev/null
@@ -1,57 +0,0 @@
-# This file was generated by https://github.com/kamilchm/go2nix v1.2.1
-[
-  {
-    goPackagePath = "github.com/klauspost/compress";
-    fetch = {
-      type = "git";
-      url = "https://github.com/klauspost/compress";
-      rev = "5698df94daded084fa836b7df2ffbf6cbd3dd63a";
-      sha256 = "1jligmzsyv08dysdaih3r95ki0dqnay9wlzganl4r0mamwhq22wz";
-    };
-  }
-  {
-    goPackagePath = "github.com/klauspost/cpuid";
-    fetch = {
-      type = "git";
-      url = "https://github.com/klauspost/cpuid";
-      rev = "ae832f27941af41db13bd6d8efd2493e3b22415a";
-      sha256 = "1h46y0lbzx0zjdnwbh0znf2ghgbvpzk1p269kkn7v8645xk3apk9";
-    };
-  }
-  {
-    goPackagePath = "github.com/valyala/bytebufferpool";
-    fetch = {
-      type = "git";
-      url = "https://github.com/valyala/bytebufferpool";
-      rev = "e746df99fe4a3986f4d4f79e13c1e0117ce9c2f7";
-      sha256 = "01lqzjddq6kz9v41nkky7wbgk7f1cw036sa7ldz10d82g5klzl93";
-    };
-  }
-  {
-    goPackagePath = "github.com/valyala/fasthttp";
-    fetch = {
-      type = "git";
-      url = "https://github.com/valyala/fasthttp";
-      rev = "e5f51c11919d4f66400334047b897ef0a94c6f3c";
-      sha256 = "0g24gys7xk449jd9ja89vr33i3amcb12jnmhsrmd5r2q8byv3l09";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/net";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/net";
-      rev = "f5dfe339be1d06f81b22525fe34671ee7d2c8904";
-      sha256 = "01y9j7pjnnld4ipmzjvs0hls0hh698f2sga8cxaw5y6r5j7igaah";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/text";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/text";
-      rev = "4e4a3210bb54bb31f6ab2cdca2edcc0b50c420c1";
-      sha256 = "10505r4xw1njnr2ns1s5r62s4pwif0kfaa30xxpgpz6qxrrmw15s";
-    };
-  }
-]
diff --git a/pkgs/tools/misc/dua/default.nix b/pkgs/tools/misc/dua/default.nix
index fb89e91c1044..0ace2196ed8c 100644
--- a/pkgs/tools/misc/dua/default.nix
+++ b/pkgs/tools/misc/dua/default.nix
@@ -2,7 +2,7 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "dua";
-  version = "2.18.0";
+  version = "2.19.0";
 
   buildInputs = lib.optionals stdenv.isDarwin [ libiconv Foundation ];
 
@@ -10,7 +10,7 @@ rustPlatform.buildRustPackage rec {
     owner = "Byron";
     repo = "dua-cli";
     rev = "v${version}";
-    sha256 = "sha256-8WXby+b5bZEylAmgONTHsKCDl9W9KCCk76utZUd9CuA=";
+    sha256 = "sha256-cb2WW0FpY5GMzll7sgbDRcgiKYSVZjJ8e8BabywF9wg=";
     # Remove unicode file names which leads to different checksums on HFS+
     # vs. other filesystems because of unicode normalisation.
     postFetch = ''
@@ -18,7 +18,7 @@ rustPlatform.buildRustPackage rec {
     '';
   };
 
-  cargoSha256 = "sha256-NHPlBZhZoZHASQ3BaYfH+sLyWKYmCsAwwd7ENI0bIFo=";
+  cargoSha256 = "sha256-79dUeQOf6hiSRzz5mLWcSP5bLXMOU5YcE9ecd/t9VaI=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/misc/esphome/dashboard.nix b/pkgs/tools/misc/esphome/dashboard.nix
index a68ca895ec14..04abea26cabc 100644
--- a/pkgs/tools/misc/esphome/dashboard.nix
+++ b/pkgs/tools/misc/esphome/dashboard.nix
@@ -5,12 +5,12 @@
 
 buildPythonPackage rec {
   pname = "esphome-dashboard";
-  version = "20221109.0";
+  version = "20221213.0";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-9LL/tO40Mr4PGojj50m4UIPoqImnDRNoVPqr8xXs6KU=";
+    hash = "sha256-LwP+LBHzEWjPUih6aaZnI7Yh85vsa1Md1YgBWkLOUIs=";
   };
 
   # no tests
diff --git a/pkgs/tools/misc/esphome/default.nix b/pkgs/tools/misc/esphome/default.nix
index 94f2ec3ed402..71e82e031305 100644
--- a/pkgs/tools/misc/esphome/default.nix
+++ b/pkgs/tools/misc/esphome/default.nix
@@ -15,14 +15,14 @@ let
 in
 with python.pkgs; buildPythonApplication rec {
   pname = "esphome";
-  version = "2022.11.4";
+  version = "2022.12.0";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-sQ6uKAsXNQ1mZYvrJpUcS4bYAGg1pzqp0KB2ceePbqY=";
+    hash = "sha256-ZFu9txZTdCOhDpsjz7cjmWkY+Fdd07masd0YA/tRS80=";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/security/semgrep/common.nix b/pkgs/tools/security/semgrep/common.nix
index a721448124e4..0b3524dca567 100644
--- a/pkgs/tools/security/semgrep/common.nix
+++ b/pkgs/tools/security/semgrep/common.nix
@@ -1,41 +1,55 @@
 { lib, fetchFromGitHub, fetchzip, stdenv }:
 
 rec {
-  version = "0.112.1";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "returntocorp";
     repo = "semgrep";
     rev = "v${version}";
-    sha256 = "sha256-SZtxZz4x6YUKw1uO5HQTU4lRY989SoCNsPQphJr+L0Y=";
+    sha256 = "sha256-4fNBpokHKCtMB3P0ot1TzcuzOs5hlyH8nIw+bCGqThA=";
   };
 
   # submodule dependencies
   # these are fetched so we:
   #   1. don't fetch the many submodules we don't need
   #   2. avoid fetchSubmodules since it's prone to impurities
-  langsSrc = fetchFromGitHub {
-    owner = "returntocorp";
-    repo = "semgrep-langs";
-    rev = "91e288062eb794e8a5e6967d1009624237793491";
-    sha256 = "sha256-z2t2bTRyj5zu9h/GBg2YeRFimpJsd3dA7dK8VBaKzHo=";
-  };
-
-  interfacesSrc = fetchFromGitHub {
-    owner = "returntocorp";
-    repo = "semgrep-interfaces";
-    rev = "7bc457a32e088ef21adf1529fa0ddeea634b9131";
-    sha256 = "sha256-xN8Qm1/YLa49k9fZKDoPPmHASI2ipI3mkKlwEK2ajO4=";
+  submodules = {
+    "cli/src/semgrep/lang" = fetchFromGitHub {
+      owner = "returntocorp";
+      repo = "semgrep-langs";
+      rev = "65cb2ed80e31e01b122f893fef8428d14432da75";
+      sha256 = "sha256-HdPJdOlMM1l7vNSATkEu5KrCkpt2feEAH8LFDU84KUM=";
+    };
+    "cli/src/semgrep/semgrep_interfaces" = fetchFromGitHub {
+      owner = "returntocorp";
+      repo = "semgrep-interfaces";
+      rev = "c69e30a4cf39f11cab5378700f5e193e8282079e";
+      sha256 = "sha256-Wr3/TWx/LHiTFCoGY4sqdsn3dHvMsEIVYA3RGiv88xQ=";
+    };
   };
 
   # fetch pre-built semgrep-core since the ocaml build is complex and relies on
   # the opam package manager at some point
-  coreRelease = if stdenv.isDarwin then fetchzip {
-      url = "https://github.com/returntocorp/semgrep/releases/download/v${version}/semgrep-v${version}-osx.zip";
-      sha256 = "sha256-JiOH39vMDL6r9WKuPO0CDkRwGZtzl/GIFoSegVddFpw=";
-  } else fetchzip {
-      url = "https://github.com/returntocorp/semgrep/releases/download/v${version}/semgrep-v${version}-ubuntu-16.04.tgz";
-      sha256 = "sha256-V6r+VQrgz8uVSbRa2AmW4lnLxovk63FL7LqVKD46RBw=";
+  core = rec {
+    data = {
+      x86_64-linux = {
+        suffix = "-ubuntu-16.04.tgz";
+        sha256 = "sha256-SsaAuhcDyO3nr6H2xOtdxzOoEQd6aIe0mlpehvDWzU0=";
+      };
+      x86_64-darwin = {
+        suffix = "-osx.zip";
+        sha256 = "sha256-DAcAB/q6XeljCp4mVljIJB4AUjUuzMSRMFzIuyjWMew=";
+      };
+    };
+    src = let
+      inherit (stdenv.hostPlatform) system;
+      selectSystemData = data: data.${system} or (throw "Unsupported system: ${system}");
+      inherit (selectSystemData data) suffix sha256;
+    in fetchzip {
+      url = "https://github.com/returntocorp/semgrep/releases/download/v${version}/semgrep-v${version}${suffix}";
+      inherit sha256;
+    };
   };
 
   meta = with lib; {
diff --git a/pkgs/tools/security/semgrep/default.nix b/pkgs/tools/security/semgrep/default.nix
index 1df7c515e305..c97d877b483e 100644
--- a/pkgs/tools/security/semgrep/default.nix
+++ b/pkgs/tools/security/semgrep/default.nix
@@ -15,12 +15,26 @@ let
 in
 buildPythonApplication rec {
   pname = "semgrep";
-  inherit (common) version;
-  src = "${common.src}/cli";
+  inherit (common) src version;
 
-  SEMGREP_CORE_BIN = "${semgrep-core}/bin/semgrep-core";
+  postPatch = (lib.concatStringsSep "\n" (lib.mapAttrsToList (
+    path: submodule: ''
+      # substitute ${path}
+      # remove git submodule placeholder
+      rm -r ${path}
+      # link submodule
+      ln -s ${submodule}/ ${path}
+    ''
+  ) common.submodules)) + ''
+    cd cli
+  '';
 
   nativeBuildInputs = [ pythonRelaxDepsHook ];
+  # tell cli/setup.py to not copy semgrep-core into the result
+  # this means we can share a copy of semgrep-core and avoid an issue where it
+  # copies the binary but doesn't retain the executable bit
+  SEMGREP_SKIP_BIN = true;
+
   pythonRelaxDeps = [
     "attrs"
     "boltons"
@@ -28,37 +42,6 @@ buildPythonApplication rec {
     "typing-extensions"
   ];
 
-  postPatch = ''
-    # remove git submodule placeholders
-    rm -r ./src/semgrep/{lang,semgrep_interfaces}
-    # link submodule dependencies
-    ln -s ${common.langsSrc}/ ./src/semgrep/lang
-    ln -s ${common.interfacesSrc}/ ./src/semgrep/semgrep_interfaces
-  '';
-
-  doCheck = true;
-  checkInputs = [ git pytestCheckHook ] ++ (with pythonPackages; [
-    pytest-snapshot
-    pytest-mock
-    pytest-freezegun
-    types-freezegun
-  ]);
-  disabledTests = [
-    # requires networking
-    "tests/unit/test_metric_manager.py"
-  ];
-  preCheck = ''
-    # tests need a home directory
-    export HOME="$(mktemp -d)"
-
-    # disabledTestPaths doesn't manage to avoid the e2e tests
-    # remove them from pyproject.toml
-    # and remove need for pytest-split
-    substituteInPlace pyproject.toml \
-      --replace '"tests/e2e",' "" \
-      --replace 'addopts = "--splitting-algorithm=least_duration"' ""
-  '';
-
   propagatedBuildInputs = with pythonPackages; [
     attrs
     boltons
@@ -77,8 +60,45 @@ buildPythonApplication rec {
     urllib3
     typing-extensions
     python-lsp-jsonrpc
+    tomli
   ];
 
+  doCheck = true;
+  checkInputs = [ git pytestCheckHook ] ++ (with pythonPackages; [
+    pytest-snapshot
+    pytest-mock
+    pytest-freezegun
+    types-freezegun
+  ]);
+  disabledTests = [
+    # requires networking
+    "test_send"
+    # requires networking
+    "test_parse_exclude_rules_auto"
+  ];
+  preCheck = ''
+    # tests need a home directory
+    export HOME="$(mktemp -d)"
+
+    # disabledTestPaths doesn't manage to avoid the e2e tests
+    # remove them from pyproject.toml
+    # and remove need for pytest-split
+    substituteInPlace pyproject.toml \
+      --replace '"tests/e2e",' "" \
+      --replace 'addopts = "--splitting-algorithm=least_duration"' ""
+  '';
+
+  # since we stop cli/setup.py from finding semgrep-core and copying it into
+  # the result we need to provide it on the PATH
+  preFixup = ''
+    makeWrapperArgs+=(--prefix PATH : ${lib.makeBinPath [ semgrep-core ]})
+  '';
+
+  passthru = {
+    inherit common;
+    updateScript = ./update.sh;
+  };
+
   meta = common.meta // {
     description = common.meta.description + " - cli";
   };
diff --git a/pkgs/tools/security/semgrep/semgrep-core.nix b/pkgs/tools/security/semgrep/semgrep-core.nix
index 3a9c904ad733..e5ce941298a4 100644
--- a/pkgs/tools/security/semgrep/semgrep-core.nix
+++ b/pkgs/tools/security/semgrep/semgrep-core.nix
@@ -6,8 +6,7 @@ in
 stdenvNoCC.mkDerivation rec {
   pname = "semgrep-core";
   inherit (common) version;
-
-  src = common.coreRelease;
+  inherit (common.core) src;
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/tools/security/semgrep/update.sh b/pkgs/tools/security/semgrep/update.sh
new file mode 100755
index 000000000000..2b464d602018
--- /dev/null
+++ b/pkgs/tools/security/semgrep/update.sh
@@ -0,0 +1,139 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl gnused jq
+
+set -euxo pipefail
+
+# provide a github token so you don't get rate limited
+# if you use gh cli you can use:
+#     `export GITHUB_TOKEN="$(cat ~/.config/gh/config.yml | yq '.hosts."github.com".oauth_token' -r)"`
+# or just set your token by hand:
+#     `read -s -p "Enter your token: " GITHUB_TOKEN; export GITHUB_TOKEN`
+#     (we use read so it doesn't show in our shell history and in secret mode so the token you paste isn't visible)
+if [ -z "${GITHUB_TOKEN:-}" ]; then
+    echo "no GITHUB_TOKEN provided - you could meet API request limiting" >&2
+fi
+
+ROOT="$(dirname "$(readlink -f "$0")")"
+NIXPKGS_ROOT="$ROOT/../../../.."
+NIX_DRV="$ROOT/default.nix"
+
+COMMON_FILE="$ROOT/common.nix"
+
+instantiateClean() {
+    nix-instantiate -A "$1" --eval --strict | cut -d\" -f2
+}
+
+# get latest version
+NEW_VERSION=$(
+  curl -s -H
+    "Accept: application/vnd.github.v3+json" \
+    ${GITHUB_TOKEN:+ -H "Authorization: bearer $GITHUB_TOKEN"} \
+    https://api.github.com/repos/returntocorp/semgrep/releases/latest \
+  | jq -r '.tag_name'
+)
+# trim v prefix
+NEW_VERSION="${NEW_VERSION:1}"
+OLD_VERSION="$(instantiateClean semgrep.common.version)"
+
+if [[ "$OLD_VERSION" == "$NEW_VERSION" ]]; then
+    echo "Already up to date"
+    exit
+fi
+
+replace() {
+    sed -i "s@$1@$2@g" "$3"
+}
+
+fetchgithub() {
+    set +eo pipefail
+    nix-build -A "$1" 2>&1 >/dev/null | grep "got:" | cut -d':' -f2 | sed 's| ||g'
+    set -eo pipefail
+}
+
+fetchzip() {
+    set +eo pipefail
+    nix-build -E "with import $NIXPKGS_ROOT {}; fetchzip {url = \"$1\"; sha256 = lib.fakeSha256; }" 2>&1 >/dev/null | grep "got:" | cut -d':' -f2 | sed 's| ||g'
+    set -eo pipefail
+}
+
+replace "$OLD_VERSION" "$NEW_VERSION" "$COMMON_FILE"
+
+echo "Updating src"
+
+OLD_HASH="$(instantiateClean semgrep.common.src.outputHash)"
+echo "Old hash $OLD_HASH"
+TMP_HASH="sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="
+replace "$OLD_HASH" "$TMP_HASH" "$COMMON_FILE"
+NEW_HASH="$(fetchgithub semgrep.common.src)"
+echo "New hash $NEW_HASH"
+replace "$TMP_HASH" "$NEW_HASH" "$COMMON_FILE"
+
+echo "Updated src"
+
+# loop through platforms for core
+nix-instantiate -E "with import $NIXPKGS_ROOT {}; builtins.attrNames semgrep.common.core.data" --eval --strict --json \
+| jq '.[]' -r \
+| while read -r PLATFORM; do
+    echo "Updating core for $PLATFORM"
+    SUFFIX=$(instantiateClean semgrep.common.core.data."$1".suffix "$PLATFORM")
+    OLD_HASH=$(instantiateClean semgrep.common.core.data."$1".sha256 "$PLATFORM")
+    echo "Old hash $OLD_HASH"
+
+    NEW_URL="https://github.com/returntocorp/semgrep/releases/download/v$NEW_VERSION/semgrep-v$NEW_VERSION$SUFFIX"
+    NEW_HASH="$(fetchzip "$NEW_URL")"
+    echo "New hash $NEW_HASH"
+
+    replace "$OLD_HASH" "$NEW_HASH" "$COMMON_FILE"
+
+    echo "Updated core for $PLATFORM"
+done
+
+OLD_PWD=$PWD
+TMPDIR="$(mktemp -d)"
+# shallow clone to check submodule commits, don't actually need the submodules
+git clone https://github.com/returntocorp/semgrep "$TMPDIR/semgrep" --depth 1 --branch "v$NEW_VERSION"
+
+get_submodule_commit() {
+    OLD_PWD=$PWD
+    (
+        cd "$TMPDIR/semgrep"
+        git ls-tree --object-only HEAD "$1"
+        cd "$OLD_PWD"
+    )
+}
+
+# loop through submodules
+nix-instantiate -E "with import $NIXPKGS_ROOT {}; builtins.attrNames semgrep.passthru.common.submodules" --eval --strict --json \
+| jq '.[]' -r \
+| while read -r SUBMODULE; do
+    echo "Updating $SUBMODULE"
+    OLD_REV=$(instantiateClean semgrep.passthru.common.submodules."$SUBMODULE".rev)
+    echo "Old commit $OLD_REV"
+    OLD_HASH=$(instantiateClean semgrep.passthru.common.submodules."$SUBMODULE".outputHash)
+    echo "Old hash $OLD_HASH"
+
+    NEW_REV=$(get_submodule_commit "$SUBMODULE")
+    echo "New commit $NEW_REV"
+
+    if [[ "$OLD_REV" == "$NEW_REV" ]]; then
+      echo "$SUBMODULE already up to date"
+      continue
+    fi
+
+    NEW_URL=$(instantiateClean semgrep.passthru.common.submodules."$SUBMODULE".url | sed "s@$OLD_REV@$NEW_REV@g")
+    NEW_HASH=$(nix --experimental-features nix-command hash to-sri "sha256:$(nix-prefetch-url "$NEW_URL")")
+
+    TMP_HASH="sha256-ABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="
+    replace "$OLD_REV" "$NEW_REV" "$COMMON_FILE"
+    replace "$OLD_HASH" "$TMP_HASH" "$COMMON_FILE"
+    NEW_HASH="$(fetchgithub semgrep.passthru.common.submodules."$SUBMODULE")"
+    echo "New hash $NEW_HASH"
+    replace "$TMP_HASH" "$NEW_HASH" "$COMMON_FILE"
+
+    echo "Updated $SUBMODULE"
+done
+
+rm -rf "$TMPDIR"
+
+echo "Finished"
+
diff --git a/pkgs/tools/text/mdbook/default.nix b/pkgs/tools/text/mdbook/default.nix
index 56d60eb7fb55..7a89064f0d09 100644
--- a/pkgs/tools/text/mdbook/default.nix
+++ b/pkgs/tools/text/mdbook/default.nix
@@ -2,25 +2,19 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mdbook";
-  version = "0.4.21";
+  version = "0.4.24";
 
   src = fetchFromGitHub {
     owner = "rust-lang";
     repo = "mdBook";
-    rev = "v${version}";
-    sha256 = "sha256-ggcyOsA4cyo5l87cZmOMI0w1gCzmWy9NRJiWxjBdB1E=";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-Y7ZbgRX0ZaYtLA20fD/L9eNMbARI1f7g6O4Yl/UDO5E=";
   };
 
-  cargoSha256 = "sha256-KVoMC8ypikABVkIj5dCSHzYZ9CV8UMuAFxSEYLaQTSk=";
+  cargoSha256 = "sha256-74LyxlDx9tVjw0KGPml6EZbAIbDiW3tvM/CEj5BW7pI=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ CoreServices ];
 
-  # Tests rely on unset 'RUST_LOG' value to emit INFO messages.
-  # 'RUST_LOG=' nixpkgs default enables warnings only and breaks tests.
-  # Can be removed when https://github.com/rust-lang/mdBook/pull/1777
-  # is released.
-  logLevel = "info";
-
   passthru = {
     tests = {
       inherit nix;
@@ -30,7 +24,8 @@ rustPlatform.buildRustPackage rec {
   meta = with lib; {
     description = "Create books from MarkDown";
     homepage = "https://github.com/rust-lang/mdBook";
+    changelog = "https://github.com/rust-lang/mdBook/blob/v${version}/CHANGELOG.md";
     license = [ licenses.mpl20 ];
-    maintainers = [ maintainers.havvy ];
+    maintainers = with maintainers; [ havvy Frostman ];
   };
 }
diff --git a/pkgs/tools/typesetting/tex/pgf-tikz/pgf-1.x.nix b/pkgs/tools/typesetting/tex/pgf-tikz/pgf-1.x.nix
index 6f5dddf7b5df..25c65d081911 100644
--- a/pkgs/tools/typesetting/tex/pgf-tikz/pgf-1.x.nix
+++ b/pkgs/tools/typesetting/tex/pgf-tikz/pgf-1.x.nix
@@ -10,7 +10,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "pgf-tikz";
     repo = "pgf";
-    rev = "refs/tags/version-${lib.replaceChars ["."] ["-"] finalAttrs.version}";
+    rev = "refs/tags/version-${lib.replaceStrings ["."] ["-"] finalAttrs.version}";
     hash = "sha256-WZ/191iEDd5VK1bnV9JZx2BZfACUeAUhAqrlyx+ZvA4=";
   };
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 1a9615646870..b033268758f5 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3367,9 +3367,7 @@ with pkgs;
 
   anbox = callPackage ../os-specific/linux/anbox { };
 
-  androidenv = callPackage ../development/mobile/androidenv {
-    pkgs_i686 = pkgsi686Linux;
-  };
+  androidenv = callPackage ../development/mobile/androidenv { };
 
   androidndkPkgs = androidndkPkgs_21;
   androidndkPkgs_21 = (callPackage ../development/androidndk-pkgs {})."21";
@@ -34283,9 +34281,7 @@ with pkgs;
 
   fish-fillets-ng = callPackage ../games/fish-fillets-ng { };
 
-  jumpy = callPackage ../games/jumpy {
-    inherit (darwin.apple_sdk.frameworks) Cocoa OpenGL;
-  };
+  jumpy = callPackage ../games/jumpy { };
 
   flightgear = libsForQt5.callPackage ../games/flightgear { };
 
diff --git a/pkgs/top-level/haxe-packages.nix b/pkgs/top-level/haxe-packages.nix
index bda390e255d8..82ad280380c4 100644
--- a/pkgs/top-level/haxe-packages.nix
+++ b/pkgs/top-level/haxe-packages.nix
@@ -4,7 +4,7 @@ let
   self = haxePackages;
   haxePackages = with self; {
 
-    withCommas = lib.replaceChars ["."] [","];
+    withCommas = lib.replaceStrings ["."] [","];
 
     # simulate "haxelib dev $libname ."
     simulateHaxelibDev = libname: ''