diff --git a/.github/workflows/update-terraform-providers.yml b/.github/workflows/update-terraform-providers.yml
index f9e4dd683b9f..8bd82acbe791 100644
--- a/.github/workflows/update-terraform-providers.yml
+++ b/.github/workflows/update-terraform-providers.yml
@@ -25,7 +25,7 @@ jobs:
           git commit -m "${{ steps.setup.outputs.title }}" providers.json
           popd
       - name: create PR
-        uses: peter-evans/create-pull-request@v3
+        uses: peter-evans/create-pull-request@v4
         with:
           body: |
             Automatic update by [update-terraform-providers](https://github.com/NixOS/nixpkgs/blob/master/.github/workflows/update-terraform-providers.yml) action.
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index dcd9bb8aff1d..ed72e2464531 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -662,6 +662,7 @@
   ./services/monitoring/longview.nix
   ./services/monitoring/mackerel-agent.nix
   ./services/monitoring/metricbeat.nix
+  ./services/monitoring/mimir.nix
   ./services/monitoring/monit.nix
   ./services/monitoring/munin.nix
   ./services/monitoring/nagios.nix
diff --git a/nixos/modules/services/monitoring/mimir.nix b/nixos/modules/services/monitoring/mimir.nix
new file mode 100644
index 000000000000..df853f037ee6
--- /dev/null
+++ b/nixos/modules/services/monitoring/mimir.nix
@@ -0,0 +1,63 @@
+{ config, lib, pkgs, ... }:
+
+let
+  inherit (lib) escapeShellArgs mkEnableOption mkIf mkOption types;
+
+  cfg = config.services.mimir;
+
+  settingsFormat = pkgs.formats.yaml {};
+in {
+  options.services.mimir = {
+    enable = mkEnableOption "mimir";
+
+    configuration = mkOption {
+      type = (pkgs.formats.json {}).type;
+      default = {};
+      description = ''
+        Specify the configuration for Mimir in Nix.
+      '';
+    };
+
+    configFile = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      description = ''
+        Specify a configuration file that Mimir should use.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    assertions = [{
+      assertion = (
+        (cfg.configuration == {} -> cfg.configFile != null) &&
+        (cfg.configFile != null -> cfg.configuration == {})
+      );
+      message  = ''
+        Please specify either
+        'services.mimir.configuration' or
+        'services.mimir.configFile'.
+      '';
+    }];
+
+    systemd.services.mimir = {
+      description = "mimir Service Daemon";
+      wantedBy = [ "multi-user.target" ];
+
+      serviceConfig = let
+        conf = if cfg.configFile == null
+               then settingsFormat.generate "config.yaml" cfg.configuration
+               else cfg.configFile;
+      in
+      {
+        ExecStart = "${pkgs.grafana-mimir}/bin/mimir --config.file=${conf}";
+        DynamicUser = true;
+        Restart = "always";
+        ProtectSystem = "full";
+        DevicePolicy = "closed";
+        NoNewPrivileges = true;
+        StateDirectory = "mimir";
+      };
+    };
+  };
+}
diff --git a/nixos/tests/custom-ca.nix b/nixos/tests/custom-ca.nix
index 60c6c82223a9..8e91bd3eead2 100644
--- a/nixos/tests/custom-ca.nix
+++ b/nixos/tests/custom-ca.nix
@@ -1,9 +1,14 @@
 # Checks that `security.pki` options are working in curl and the main browser
-# engines: Gecko (via Firefox), Chromium, QtWebEngine (Falkon) and WebKitGTK
-# (via Midori). The test checks that certificates issued by a custom trusted
-# CA are accepted but those from an unknown CA are rejected.
+# engines: Gecko (via Firefox), Chromium, QtWebEngine (via qutebrowser) and
+# WebKitGTK (via Midori). The test checks that certificates issued by a custom
+# trusted CA are accepted but those from an unknown CA are rejected.
 
-import ./make-test-python.nix ({ pkgs, lib, ... }:
+{ system ? builtins.currentSystem,
+  config ? {},
+  pkgs ? import ../.. { inherit system config; }
+}:
+
+with import ../lib/testing-python.nix { inherit system pkgs; };
 
 let
   makeCert = { caName, domain }: pkgs.runCommand "example-cert"
@@ -68,24 +73,8 @@ let
       domain = "bad.example.com";
     };
 
-in
-
-{
-  name = "custom-ca";
-  meta.maintainers = with lib.maintainers; [ rnhmjoj ];
-
-  enableOCR = true;
-
-  nodes.machine = { pkgs, ... }:
-    { imports = [ ./common/user-account.nix ./common/x11.nix ];
-
-      # chromium-based browsers refuse to run as root
-      test-support.displayManager.auto.user = "alice";
-
-      # browsers may hang with the default memory
-      virtualisation.memorySize = 600;
-
-      networking.hosts."127.0.0.1" = [ "good.example.com" "bad.example.com" ];
+  webserverConfig =
+    { networking.hosts."127.0.0.1" = [ "good.example.com" "bad.example.com" ];
       security.pki.certificateFiles = [ "${example-good-cert}/ca.crt" ];
 
       services.nginx.enable = true;
@@ -107,73 +96,98 @@ in
             return 200 'It does not work!';
           '';
         };
-
-      environment.systemPackages = with pkgs; [
-        xdotool
-        firefox
-        chromium
-        qutebrowser
-        midori
-      ];
     };
 
-  testScript = ''
-    from typing import Tuple
-    def execute_as(user: str, cmd: str) -> Tuple[int, str]:
-        """
-        Run a shell command as a specific user.
-        """
-        return machine.execute(f"sudo -u {user} {cmd}")
+  curlTest = makeTest {
+    name = "custom-ca-curl";
+    meta.maintainers = with lib.maintainers; [ rnhmjoj ];
+    nodes.machine = { ... }: webserverConfig;
+    testScript = ''
+        with subtest("Good certificate is trusted in curl"):
+            machine.wait_for_unit("nginx")
+            machine.wait_for_open_port(443)
+            machine.succeed("curl -fv https://good.example.com")
+
+        with subtest("Unknown CA is untrusted in curl"):
+            machine.fail("curl -fv https://bad.example.com")
+    '';
+  };
+
+  mkBrowserTest = browser: testParams: makeTest {
+    name = "custom-ca-${browser}";
+    meta.maintainers = with lib.maintainers; [ rnhmjoj ];
+
+    enableOCR = true;
+
+    nodes.machine = { pkgs, ... }:
+      { imports =
+          [ ./common/user-account.nix
+            ./common/x11.nix
+            webserverConfig
+          ];
+
+        # chromium-based browsers refuse to run as root
+        test-support.displayManager.auto.user = "alice";
+
+        # browsers may hang with the default memory
+        virtualisation.memorySize = 600;
+
+        environment.systemPackages = [ pkgs.xdotool pkgs.${browser} ];
+      };
+
+    testScript = ''
+      from typing import Tuple
+      def execute_as(user: str, cmd: str) -> Tuple[int, str]:
+          """
+          Run a shell command as a specific user.
+          """
+          return machine.execute(f"sudo -u {user} {cmd}")
 
 
-    def wait_for_window_as(user: str, cls: str) -> None:
-        """
-        Wait until a X11 window of a given user appears.
-        """
+      def wait_for_window_as(user: str, cls: str) -> None:
+          """
+          Wait until a X11 window of a given user appears.
+          """
 
-        def window_is_visible(last_try: bool) -> bool:
-            ret, stdout = execute_as(user, f"xdotool search --onlyvisible --class {cls}")
-            if last_try:
-                machine.log(f"Last chance to match {cls} on the window list")
-            return ret == 0
+          def window_is_visible(last_try: bool) -> bool:
+              ret, stdout = execute_as(user, f"xdotool search --onlyvisible --class {cls}")
+              if last_try:
+                  machine.log(f"Last chance to match {cls} on the window list")
+              return ret == 0
 
-        with machine.nested("Waiting for a window to appear"):
-            retry(window_is_visible)
+          with machine.nested("Waiting for a window to appear"):
+              retry(window_is_visible)
 
 
-    machine.start()
+      machine.start()
+      machine.wait_for_x()
 
-    with subtest("Good certificate is trusted in curl"):
-        machine.wait_for_unit("nginx")
-        machine.wait_for_open_port(443)
-        machine.succeed("curl -fv https://good.example.com")
+      command = "${browser} ${testParams.args or ""}"
+      with subtest("Good certificate is trusted in ${browser}"):
+          execute_as(
+              "alice", f"{command} https://good.example.com >&2 &"
+          )
+          wait_for_window_as("alice", "${browser}")
+          machine.sleep(4)
+          execute_as("alice", "xdotool key ctrl+r")  # reload to be safe
+          machine.wait_for_text("It works!")
+          machine.screenshot("good${browser}")
+          execute_as("alice", "xdotool key ctrl+w")  # close tab
 
-    with subtest("Unknown CA is untrusted in curl"):
-        machine.fail("curl -fv https://bad.example.com")
+      with subtest("Unknown CA is untrusted in ${browser}"):
+          execute_as("alice", f"{command} https://bad.example.com >&2 &")
+          machine.wait_for_text("${testParams.error}")
+          machine.screenshot("bad${browser}")
+    '';
+  };
 
-    browsers = {
-      "firefox": "Security Risk",
-      "chromium": "not private",
-      "qutebrowser -T": "Certificate error",
-      "midori": "Security"
-    }
+in
 
-    machine.wait_for_x()
-    for command, error in browsers.items():
-        browser = command.split()[0]
-        with subtest("Good certificate is trusted in " + browser):
-            execute_as(
-                "alice", f"{command} https://good.example.com >&2 &"
-            )
-            wait_for_window_as("alice", browser)
-            machine.wait_for_text("It works!")
-            machine.screenshot("good" + browser)
-            execute_as("alice", "xdotool key ctrl+w")  # close tab
-
-        with subtest("Unknown CA is untrusted in " + browser):
-            execute_as("alice", f"{command} https://bad.example.com >&2 &")
-            machine.wait_for_text(error)
-            machine.screenshot("bad" + browser)
-            machine.succeed("pkill -f " + browser)
-  '';
-})
+{
+  curl = curlTest;
+} // pkgs.lib.mapAttrs mkBrowserTest {
+  firefox = { error = "Security Risk"; };
+  chromium = { error = "not private"; };
+  qutebrowser = { args = "-T"; error = "Certificate error"; };
+  midori = { error = "Security"; };
+}
diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.json b/pkgs/applications/networking/browsers/chromium/upstream-info.json
index 6369e9dc3696..ab0f72d10e68 100644
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.json
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json
@@ -32,15 +32,15 @@
     }
   },
   "dev": {
-    "version": "102.0.5005.22",
-    "sha256": "12s4w8qs71a7r13mm28w6kld2q21srwalsy2yfcys4kjmfp4gqfa",
-    "sha256bin64": "07jj7nvgalzvxacx6srccc82ggckzj4x10w1k2zskcyxpblnd7fc",
+    "version": "103.0.5028.0",
+    "sha256": "06i6kgsdril5gfbjl1sh0z5hqvq64bchhb2z8w0h8cw9977bvqk6",
+    "sha256bin64": "09hxvcv5n1kd4qnwh6pxzmrlnc8xijm7rwb1c8c57v0jjb32x9ry",
     "deps": {
       "gn": {
-        "version": "2022-04-14",
+        "version": "2022-04-26",
         "url": "https://gn.googlesource.com/gn",
-        "rev": "fd9f2036f26d83f9fcfe93042fb952e5a7fe2167",
-        "sha256": "0b5xs0chcv3hfhy71rycsmgxnqbm375a333hwav8929k9cbi5p9h"
+        "rev": "ced9fbfe6943854e65ada4ac1849d1fa4cb19348",
+        "sha256": "14fgjsfqihmma1cr8n30n37vxkf20paa6swq2yxn1agjvfr9cdvl"
       }
     }
   },
diff --git a/pkgs/applications/networking/instant-messengers/zoom-us/default.nix b/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
index 58b8cc056c1c..db38a2d0e862 100644
--- a/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
+++ b/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
@@ -110,8 +110,8 @@ stdenv.mkDerivation rec {
     runHook preInstall
     ${rec {
       aarch64-darwin = ''
-        mkdir -p $out/Applications/zoom.us.app
-        cp -R . $out/Applications/zoom.us.app
+        mkdir -p $out/Applications
+        cp -R zoom.us.app $out/Applications/
       '';
       # darwin steps same on both architectures
       x86_64-darwin = aarch64-darwin;
diff --git a/pkgs/applications/networking/nextcloud-client/default.nix b/pkgs/applications/networking/nextcloud-client/default.nix
index 3afdbec0ac54..da8dc03d02f3 100644
--- a/pkgs/applications/networking/nextcloud-client/default.nix
+++ b/pkgs/applications/networking/nextcloud-client/default.nix
@@ -50,15 +50,18 @@ mkDerivation rec {
     done
   '';
 
+  # required to not include inkscape in the wrapper
+  strictDeps = true;
+
   nativeBuildInputs = [
     pkg-config
     cmake
-    extra-cmake-modules
     inkscape
     sphinx
   ];
 
   buildInputs = [
+    extra-cmake-modules
     inotify-tools
     libcloudproviders
     libsecret
@@ -95,7 +98,7 @@ mkDerivation rec {
     description = "Nextcloud themed desktop client";
     homepage = "https://nextcloud.com";
     license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ kranzes ];
+    maintainers = with maintainers; [ kranzes SuperSandro2000 ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/applications/radio/uhd/default.nix b/pkgs/applications/radio/uhd/default.nix
index 2928b19f29df..6fa8462ec10c 100644
--- a/pkgs/applications/radio/uhd/default.nix
+++ b/pkgs/applications/radio/uhd/default.nix
@@ -41,6 +41,8 @@ stdenv.mkDerivation rec {
   # and xxx.yyy.zzz. Hrmpf... style keeps changing
   version = "4.1.0.5";
 
+  outputs = [ "out" "dev" ];
+
   src = fetchFromGitHub {
     owner = "EttusResearch";
     repo = "uhd";
diff --git a/pkgs/development/gnuradio-modules/osmosdr/default.nix b/pkgs/development/gnuradio-modules/osmosdr/default.nix
index 326a2b9d9bde..b0c7a43c8e4c 100644
--- a/pkgs/development/gnuradio-modules/osmosdr/default.nix
+++ b/pkgs/development/gnuradio-modules/osmosdr/default.nix
@@ -39,6 +39,8 @@ in mkDerivation {
   inherit version src;
   disabledForGRafter = "3.9";
 
+  outputs = [ "out" "dev" ];
+
   buildInputs = [
     log4cpp
     mpir
diff --git a/pkgs/development/libraries/qwt/default.nix b/pkgs/development/libraries/qwt/default.nix
index 46cfc426efa4..e74f8300bf72 100644
--- a/pkgs/development/libraries/qwt/default.nix
+++ b/pkgs/development/libraries/qwt/default.nix
@@ -4,6 +4,8 @@ stdenv.mkDerivation rec {
   pname = "qwt";
   version = "6.2.0";
 
+  outputs = [ "out" "dev" ];
+
   src = fetchurl {
     url = "mirror://sourceforge/qwt/qwt-${version}.tar.bz2";
     sha256 = "sha256-kZT2UTlV0P1zAPZxWBdQZEYBl6urGpL6EnpnpLC3FTA=";
diff --git a/pkgs/development/ocaml-modules/atd/default.nix b/pkgs/development/ocaml-modules/atd/default.nix
index 7468900e07e6..5ff5496ed6f6 100644
--- a/pkgs/development/ocaml-modules/atd/default.nix
+++ b/pkgs/development/ocaml-modules/atd/default.nix
@@ -1,25 +1,17 @@
-{ lib, menhir, easy-format, fetchurl, buildDunePackage, which, re, nixosTests }:
+{ lib, atdgen-codec-runtime, menhir, easy-format, buildDunePackage, which, re, nixosTests }:
 
 buildDunePackage rec {
   pname = "atd";
-  version = "2.2.1";
+  inherit (atdgen-codec-runtime) version src;
 
-  useDune2 = true;
-
-  minimumOCamlVersion = "4.02";
-
-  src = fetchurl {
-    url = "https://github.com/ahrefs/atd/releases/download/2.2.1/atd-2.2.1.tbz";
-    sha256 = "17jm79np69ixp53a4njxnlb1pg8sd1g47nm3nyki9clkc8d4qsyv";
-  };
+  minimalOCamlVersion = "4.08";
 
   nativeBuildInputs = [ which menhir ];
-  propagatedBuildInputs = [ easy-format re ];
+  buildInputs = [ re ];
+  propagatedBuildInputs = [ easy-format ];
 
   strictDeps = true;
 
-  doCheck = true;
-
   passthru.tests = {
     smoke-test = nixosTests.atd;
   };
@@ -27,7 +19,7 @@ buildDunePackage rec {
   meta = with lib; {
     homepage = "https://github.com/mjambon/atd";
     description = "Syntax for cross-language type definitions";
-    license = licenses.bsd3;
+    license = licenses.mit;
     maintainers = with maintainers; [ aij jwilberding ];
   };
 }
diff --git a/pkgs/development/ocaml-modules/atdgen/codec-runtime.nix b/pkgs/development/ocaml-modules/atdgen/codec-runtime.nix
new file mode 100644
index 000000000000..9ad64549ea3f
--- /dev/null
+++ b/pkgs/development/ocaml-modules/atdgen/codec-runtime.nix
@@ -0,0 +1,18 @@
+{ lib, buildDunePackage, fetchurl }:
+
+buildDunePackage rec {
+  pname = "atdgen-codec-runtime";
+  version = "2.4.1";
+
+  src = fetchurl {
+    url = "https://github.com/ahrefs/atd/releases/download/${version}/atdgen-codec-runtime-${version}.tbz";
+    sha256 = "sha256:16888rnvhgh5yxxsnzsj10g5pzs1l4dn27n23kk2f4641dn26s3a";
+  };
+
+  meta = {
+    description = "Runtime for atdgen generated bucklescript converters";
+    homepage = "https://github.com/ahrefs/atd";
+    maintainers = [ lib.maintainers.vbgl ];
+    license = lib.licenses.mit;
+  };
+}
diff --git a/pkgs/development/ocaml-modules/atdgen/default.nix b/pkgs/development/ocaml-modules/atdgen/default.nix
index 2537c92d97a5..f35e6617a9bd 100644
--- a/pkgs/development/ocaml-modules/atdgen/default.nix
+++ b/pkgs/development/ocaml-modules/atdgen/default.nix
@@ -1,26 +1,17 @@
-{ buildDunePackage, atd, biniou, yojson }:
-
-let runtime =
-  buildDunePackage {
-    pname = "atdgen-runtime";
-    inherit (atd) version useDune2 src;
-
-    propagatedBuildInputs = [ biniou yojson ];
-
-    meta = { inherit (atd.meta) license; };
-  }
-; in
+{ buildDunePackage, alcotest, atd, atdgen-codec-runtime, atdgen-runtime, biniou, re, yojson }:
 
 buildDunePackage {
   pname = "atdgen";
-  inherit (atd) version useDune2 src;
+  inherit (atdgen-codec-runtime) version src;
 
-  buildInputs = [ atd ];
+  buildInputs = [ atd re ];
 
-  propagatedBuildInputs = [ runtime ];
+  propagatedBuildInputs = [ atdgen-runtime ];
 
-  meta = {
+  doCheck = true;
+  checkInputs = [ alcotest atdgen-codec-runtime ];
+
+  meta = atd.meta // {
     description = "Generates efficient JSON serializers, deserializers and validators";
-    inherit (atd.meta) license;
   };
 }
diff --git a/pkgs/development/ocaml-modules/atdgen/runtime.nix b/pkgs/development/ocaml-modules/atdgen/runtime.nix
new file mode 100644
index 000000000000..0fc98a1f66be
--- /dev/null
+++ b/pkgs/development/ocaml-modules/atdgen/runtime.nix
@@ -0,0 +1,15 @@
+{ buildDunePackage, atdgen-codec-runtime, biniou, camlp-streams, yojson }:
+
+buildDunePackage rec {
+  pname = "atdgen-runtime";
+  inherit (atdgen-codec-runtime) version src;
+
+  minimalOCamlVersion = "4.08";
+
+  propagatedBuildInputs = [ biniou camlp-streams yojson ];
+
+  meta = atdgen-codec-runtime.meta // {
+    description = "Runtime library for code generated by atdgen";
+  };
+
+}
diff --git a/pkgs/development/ocaml-modules/camlp-streams/default.nix b/pkgs/development/ocaml-modules/camlp-streams/default.nix
new file mode 100644
index 000000000000..d5c8ac945d58
--- /dev/null
+++ b/pkgs/development/ocaml-modules/camlp-streams/default.nix
@@ -0,0 +1,20 @@
+{ lib, buildDunePackage, fetchFromGitHub }:
+
+buildDunePackage rec {
+  pname = "camlp-streams";
+  version = "5.0";
+
+  src = fetchFromGitHub {
+    owner = "ocaml";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256:1wd5k0irzwi841b27pbx0n5fdybbgx97184zm8cjajizd2j8w0g5";
+  };
+
+  meta = {
+    description = "Stream and Genlex libraries for use with Camlp4 and Camlp5";
+    license = lib.licenses.lgpl21Only;
+    maintainers = [ lib.maintainers.vbgl ];
+  };
+
+}
diff --git a/pkgs/development/python-modules/awscrt/default.nix b/pkgs/development/python-modules/awscrt/default.nix
index cc43d411039f..d1866c0fc7d0 100644
--- a/pkgs/development/python-modules/awscrt/default.nix
+++ b/pkgs/development/python-modules/awscrt/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "awscrt";
-  version = "0.13.9";
+  version = "0.13.11";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-9XUzHfezr+bhQt6OKYiVEaCHqqWE6J7Y4Rj3MmaMAXA=";
+    hash = "sha256-Yx3I3RD57Nx6Cvm4moc5zmMbdsHeYiMghDfbQUor38E=";
   };
 
   buildInputs = lib.optionals stdenv.isDarwin [
diff --git a/pkgs/development/python-modules/browser-cookie3/default.nix b/pkgs/development/python-modules/browser-cookie3/default.nix
index d15f28e475c2..163c0e4a15ad 100644
--- a/pkgs/development/python-modules/browser-cookie3/default.nix
+++ b/pkgs/development/python-modules/browser-cookie3/default.nix
@@ -1,7 +1,7 @@
 { lib
 , fetchPypi
 , buildPythonPackage
-, isPy3k
+, pythonOlder
 , lz4
 , keyring
 , pbkdf2
@@ -11,15 +11,16 @@
 
 buildPythonPackage rec {
   pname = "browser-cookie3";
-  version = "0.13.0";
+  version = "0.14.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "9f8e5ddf5a6641a1fdca12d82b0923777ba59a988b68c9bcf358bfb7c42ef25b";
+    hash = "sha256-kWYMl/JZxonLfT0u/13bXz0MlC36jssWWq/i05FDpOA=";
   };
 
-  disabled = !isPy3k;
-
   propagatedBuildInputs = [
     lz4
     keyring
diff --git a/pkgs/development/python-modules/elementpath/default.nix b/pkgs/development/python-modules/elementpath/default.nix
index e756701ab4e4..e3104d8d882e 100644
--- a/pkgs/development/python-modules/elementpath/default.nix
+++ b/pkgs/development/python-modules/elementpath/default.nix
@@ -6,16 +6,16 @@
 
 buildPythonPackage rec {
   pname = "elementpath";
-  version = "2.5.0";
+  version = "2.5.1";
   format = "setuptools";
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "sissaschool";
     repo = "elementpath";
-    rev = "v${version}";
-    sha256 = "sha256-I2Vg0rpCFH1Z+N+JgtDv2se6lXsggzOsJn3Fj252aTQ=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-tejsQ6m9XyMGDIEDzWYwSav5Iqa9S/DIYShOpoSlTWo=";
   };
 
   # avoid circular dependency with xmlschema which directly depends on this
diff --git a/pkgs/development/python-modules/faraday-plugins/default.nix b/pkgs/development/python-modules/faraday-plugins/default.nix
index fb26c1621fe3..92a9eb9edc0c 100644
--- a/pkgs/development/python-modules/faraday-plugins/default.nix
+++ b/pkgs/development/python-modules/faraday-plugins/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "faraday-plugins";
-  version = "1.6.4";
+  version = "1.6.5";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "infobyte";
     repo = "faraday_plugins";
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-0IAr91ql4ShjGQol3uc/erIHW6E1Vzj724JJ3NaLZUo=";
+    sha256 = "sha256-mzzUbUBlzOyFpDaoUwwjxC3dqbheLWAt8gXrIH0XXss=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/flatdict/default.nix b/pkgs/development/python-modules/flatdict/default.nix
index 186118d30100..bed9647af844 100644
--- a/pkgs/development/python-modules/flatdict/default.nix
+++ b/pkgs/development/python-modules/flatdict/default.nix
@@ -5,13 +5,13 @@
 
 buildPythonPackage rec {
   pname = "flatdict";
-  version = "4.0.0";
+  version = "4.0.1";
 
   src = fetchFromGitHub {
     owner = "gmr";
     repo = pname;
     rev = version;
-    hash = "sha256-qH4MMDSXf92BPavnRdCka6lRoWZg+2KnHpHA8kt5JaM=";
+    hash = "sha256-CWsTiCNdIKSQtjpQC07lhZoU1hXT/MGpXdj649x2GlU=";
   };
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/google-cloud-videointelligence/default.nix b/pkgs/development/python-modules/google-cloud-videointelligence/default.nix
index 58368693523c..060847cc0f75 100644
--- a/pkgs/development/python-modules/google-cloud-videointelligence/default.nix
+++ b/pkgs/development/python-modules/google-cloud-videointelligence/default.nix
@@ -11,11 +11,11 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-videointelligence";
-  version = "2.6.1";
+  version = "2.7.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-p1HXFxURs0axONrqHahl/SPvWN2mhAhvJePFOwzRR4c=";
+    sha256 = "sha256-ylzS63MoRkJ5JZpLBMX6B9EE99EwahWuC8rEYRg00B0=";
   };
 
   propagatedBuildInputs = [ google-api-core proto-plus ];
diff --git a/pkgs/development/python-modules/hahomematic/default.nix b/pkgs/development/python-modules/hahomematic/default.nix
index e3d949793456..c8b7b2eaa4f4 100644
--- a/pkgs/development/python-modules/hahomematic/default.nix
+++ b/pkgs/development/python-modules/hahomematic/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "hahomematic";
-  version = "1.2.0";
+  version = "1.2.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "danielperna84";
     repo = pname;
     rev = "refs/tags/${version}";
-    sha256 = "sha256-qHJld5vn2UNb9xBIn0gHteJ9Yn1EBoKhnNflWLaZI8I=";
+    sha256 = "sha256-INhw7d+hbVCfeB7vr9QhCgaLOpIl0OHhgrYN6o6E1YI=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/json-schema-for-humans/default.nix b/pkgs/development/python-modules/json-schema-for-humans/default.nix
index 8fb0e2dd40cf..6be5da3fda55 100644
--- a/pkgs/development/python-modules/json-schema-for-humans/default.nix
+++ b/pkgs/development/python-modules/json-schema-for-humans/default.nix
@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "json-schema-for-humans";
-  version = "0.40";
+  version = "0.40.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "coveooss";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-H0jvOnrWE4/xxRYNehshHBRNc/qLX1+sCV7O1ACCdew=";
+    hash = "sha256-9bHylNG+YT+tZmqE8DJMbhpPPaany29+0sIt1jKmFLg=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/lightwave2/default.nix b/pkgs/development/python-modules/lightwave2/default.nix
index 1f2558ef7611..f5e341fc43aa 100644
--- a/pkgs/development/python-modules/lightwave2/default.nix
+++ b/pkgs/development/python-modules/lightwave2/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "lightwave2";
-  version = "0.8.14";
+  version = "0.8.15";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-zUPo81MC1K830ss7ECfawiYU1RNah9PIKAz1Uqz7c/w=";
+    sha256 = "sha256-FKEUpfHnPwiLwC8fk+6AikviZKX7DBoWpSMxK1cHC2Y=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/peaqevcore/default.nix b/pkgs/development/python-modules/peaqevcore/default.nix
index d8cec1cc3e21..c84edc4e92c4 100644
--- a/pkgs/development/python-modules/peaqevcore/default.nix
+++ b/pkgs/development/python-modules/peaqevcore/default.nix
@@ -6,14 +6,14 @@
 
 buildPythonPackage rec {
   pname = "peaqevcore";
-  version = "0.0.19";
+  version = "0.0.20";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-eEMzhrVKZJjUYwwdZ8M+xi0pbxseOS4ddW9il4XYwJs=";
+    hash = "sha256-h/WQzkDoEuE4grnb0YeuWhHDPWIqVHgjWgMq02XLahs=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pynrrd/default.nix b/pkgs/development/python-modules/pynrrd/default.nix
index 641cd6bd1280..91cff70bae35 100644
--- a/pkgs/development/python-modules/pynrrd/default.nix
+++ b/pkgs/development/python-modules/pynrrd/default.nix
@@ -2,20 +2,30 @@
 , buildPythonPackage
 , fetchFromGitHub
 , numpy
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "pynrrd";
-  version = "0.4.2";
+  version = "0.4.3";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "mhe";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "1wn3ara3i19fi1y9a5j4imyczpa6dkkzd5djggxg4kkl1ff9awrj";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-4UM2NAKWfsjxAoLQCFSPVKG5GukxqppywqvLM0V/dIs=";
   };
 
-  propagatedBuildInputs = [ numpy ];
+  propagatedBuildInputs = [
+    numpy
+  ];
+
+  pythonImportsCheck = [
+    "nrrd"
+  ];
 
   meta = with lib; {
     homepage = "https://github.com/mhe/pynrrd";
diff --git a/pkgs/development/python-modules/python-gitlab/default.nix b/pkgs/development/python-modules/python-gitlab/default.nix
index 8ccf35ff8e84..3db152119a22 100644
--- a/pkgs/development/python-modules/python-gitlab/default.nix
+++ b/pkgs/development/python-modules/python-gitlab/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "python-gitlab";
-  version = "3.3.0";
+  version = "3.4.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-/vJdQaYvkdqC7iD3KnKLnGnu80zwowBc27mgtHHVtJg=";
+    sha256 = "sha256-YYC4HuLyZa2NhBKVahdAtNPOynsori9wff5iN1/tAII=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/reorder-python-imports/default.nix b/pkgs/development/python-modules/reorder-python-imports/default.nix
index 860188eba606..1bb3475168c1 100644
--- a/pkgs/development/python-modules/reorder-python-imports/default.nix
+++ b/pkgs/development/python-modules/reorder-python-imports/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "reorder-python-imports";
-  version = "3.0.1";
+  version = "3.1.0";
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "asottile";
     repo = "reorder_python_imports";
     rev = "v${version}";
-    sha256 = "1bdKM1sUhpZHy03DdoTzpt1iGm1t1nWnuPyTgl3KhCY=";
+    hash = "sha256-Ge+VQjK24TqWLMQS19DBX+FFHF3irogK21orlENJx50=";
   };
 
   propagatedBuildInputs = [ aspy-refactor-imports ];
diff --git a/pkgs/development/python-modules/rns/default.nix b/pkgs/development/python-modules/rns/default.nix
index 39496de24c09..fde916994a41 100644
--- a/pkgs/development/python-modules/rns/default.nix
+++ b/pkgs/development/python-modules/rns/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "rns";
-  version = "0.3.4";
+  version = "0.3.5";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "markqvist";
     repo = "Reticulum";
     rev = version;
-    hash = "sha256-fpXbp0Tj22flco9Rg4JTWZes6oxY7FhvYD76jA3yVuE=";
+    hash = "sha256-LzrI5pJ3mLaxikqS1eWFvdgneoCnsRTYWbshVX7U8lg=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/socid-extractor/default.nix b/pkgs/development/python-modules/socid-extractor/default.nix
index 38b1de48b2f4..de552ca673c9 100644
--- a/pkgs/development/python-modules/socid-extractor/default.nix
+++ b/pkgs/development/python-modules/socid-extractor/default.nix
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "soxoj";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0vdcxinpnl3vn2l4dybbyggdzm5mpmi3qbpars7lrg5m0mib0cml";
+    hash = "sha256-tDKwYgW1vEyPzuouPGK9tdTf3vNr+UaosHtQe23srG0=";
   };
 
   propagatedBuildInputs = [
@@ -27,6 +27,12 @@ buildPythonPackage rec {
     requests
   ];
 
+  postPatch = ''
+    # https://github.com/soxoj/socid-extractor/pull/125
+    substituteInPlace requirements.txt \
+      --replace "beautifulsoup4~=4.10.0" "beautifulsoup4>=4.10.0"
+  '';
+
   # Test require network access
   doCheck = false;
 
diff --git a/pkgs/development/python-modules/types-requests/default.nix b/pkgs/development/python-modules/types-requests/default.nix
index f425785449b8..19a63f846404 100644
--- a/pkgs/development/python-modules/types-requests/default.nix
+++ b/pkgs/development/python-modules/types-requests/default.nix
@@ -6,12 +6,12 @@
 
 buildPythonPackage rec {
   pname = "types-requests";
-  version = "2.27.22";
+  version = "2.27.24";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-LoGnTS2x5tBrqkqeGJZyBUNzkpeiParAQ2o04vxzJXQ=";
+    sha256 = "sha256-4c3pnpLV+3r6DuU5JLIR9MR2OVFkNNhtyE1T7IT8+oo=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/tools/analysis/checkov/default.nix b/pkgs/development/tools/analysis/checkov/default.nix
index b97ed2b67672..29a34ce62711 100644
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@@ -32,13 +32,13 @@ with py.pkgs;
 
 buildPythonApplication rec {
   pname = "checkov";
-  version = "2.0.1088";
+  version = "2.0.1098";
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = pname;
     rev = version;
-    hash = "sha256-g4kn8tdLgTnOFmeX8nywBvmAXL7WqCfX6ylgp7Z6Alk=";
+    hash = "sha256-CFH7zb3f50tlYhRiZ/q0b8PDhithVhaeRTtsXvan+bw=";
   };
 
   nativeBuildInputs = with py.pkgs; [
diff --git a/pkgs/misc/cups/drivers/kyodialog3/default.nix b/pkgs/misc/cups/drivers/kyodialog3/default.nix
index 7e0a0dea67d1..5a17f88a725c 100644
--- a/pkgs/misc/cups/drivers/kyodialog3/default.nix
+++ b/pkgs/misc/cups/drivers/kyodialog3/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
   dontStrip = true;
 
   src = fetchzip {
-    url = "https://la.kyoceradocumentsolutions.com/content/dam/kdc/kdag/downloads/technical/executables/drivers/kyoceradocumentsolutions/lad/en/Kyocera_Linux_PPD_Ver_${version}.tar.gz";
+    url = "https://www.kyoceradocumentsolutions.us/content/download-center-americas/us/drivers/drivers/Kyocera_Linux_PPD_Ver_${lib.replaceChars ["."] ["_"] version}_tar_gz.download.gz";
     sha256 = "11znnlkfssakml7w80gxlz1k59f3nvhph91fkzzadnm9i7a8yjal";
   };
 
diff --git a/pkgs/servers/monitoring/grafana/default.nix b/pkgs/servers/monitoring/grafana/default.nix
index d4a413dc6860..652f203460bc 100644
--- a/pkgs/servers/monitoring/grafana/default.nix
+++ b/pkgs/servers/monitoring/grafana/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "grafana";
-  version = "8.5.0";
+  version = "8.5.1";
 
   excludedPackages = [ "alert_webhook_listener" "clean-swagger" "release_publisher" "slow_proxy" "slow_proxy_mac" "macaron" ];
 
@@ -10,15 +10,15 @@ buildGoModule rec {
     rev = "v${version}";
     owner = "grafana";
     repo = "grafana";
-    sha256 = "sha256-6arJ903XWfS8vnr8jtxyMj7jju6XiwR0xAq/mh8hys4=";
+    sha256 = "sha256-GwvJA+lcbUuVbzniDW6gYbxQO5uXSP6rjzgmcJ5YYxk=";
   };
 
   srcStatic = fetchurl {
     url = "https://dl.grafana.com/oss/release/grafana-${version}.linux-amd64.tar.gz";
-    sha256 = "1alqkc8pj0798anybvfcv1z8dij1ywf5gyc3byj9vmjm4a78apmd";
+    sha256 = "030zl5k8b4hcay06a2lvlmq8swbix88ii4gz9yd4kywcjy5vhnyf";
   };
 
-  vendorSha256 = "sha256-7ZcREAWaUs8aQHtqKxtH84Pkf54lhH/rlFmYQTZtKj8=";
+  vendorSha256 = "sha256-ZL+A6Sz0uHg7ZzYHmA4EU5ZxfRXBLyKglk135iQT600=";
 
   nativeBuildInputs = [ wire ];
 
diff --git a/pkgs/tools/audio/abcmidi/default.nix b/pkgs/tools/audio/abcmidi/default.nix
index b4a5420aa9c0..cd2661128a9a 100644
--- a/pkgs/tools/audio/abcmidi/default.nix
+++ b/pkgs/tools/audio/abcmidi/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "abcMIDI";
-  version = "2022.04.06";
+  version = "2022.04.28";
 
   src = fetchzip {
     url = "https://ifdo.ca/~seymour/runabc/${pname}-${version}.zip";
-    hash = "sha256-s1LFiwFXQsodQdGvgNy7pgXhsWYHw7lVhRXuNYHnvNQ=";
+    hash = "sha256-a/zFCxdy+GTh5daZO7QBHWeeJ1dead3Dn7dk02jBnc0=";
   };
 
   meta = with lib; {
diff --git a/pkgs/tools/inputmethods/ibus-engines/ibus-table-others/default.nix b/pkgs/tools/inputmethods/ibus-engines/ibus-table-others/default.nix
index 18fc21e98088..d725691a0452 100644
--- a/pkgs/tools/inputmethods/ibus-engines/ibus-table-others/default.nix
+++ b/pkgs/tools/inputmethods/ibus-engines/ibus-table-others/default.nix
@@ -2,22 +2,18 @@
 
 stdenv.mkDerivation rec {
   pname = "ibus-table-others";
-  version = "1.3.12";
+  version = "1.3.13";
 
   src = fetchurl {
     url = "https://github.com/moebiuscurve/ibus-table-others/releases/download/${version}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-2k7JtLr+zO71rbTz11CCiIPx+orn0dw/Y8m47WfRDEU=";
+    sha256 = "sha256-XN11iOShWyzRzmo/Ke+1Qh//o4ZhsmJWimgA1by2VZo=";
   };
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ ibus ibus-table python3 ];
 
   preBuild = ''
-    export HOME=$(mktemp -d)/ibus-table-others
-  '';
-
-  postFixup = ''
-    rm -rf $HOME
+    export HOME=$TMPDIR
   '';
 
   meta = with lib; {
diff --git a/pkgs/tools/misc/fclones/default.nix b/pkgs/tools/misc/fclones/default.nix
index 2854456c1b05..a67742252eb2 100644
--- a/pkgs/tools/misc/fclones/default.nix
+++ b/pkgs/tools/misc/fclones/default.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "fclones";
-  version = "0.20.1";
+  version = "0.21.0";
 
   src = fetchFromGitHub {
     owner = "pkolaczk";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-3xIJkV/BC+qdMP2vsUr5wIwqzaz2uCV/j6VdC6uvzgY=";
+    sha256 = "sha256-4V6K4OkQkmFr45x+VYVDmrO9Tdaxt05Q7d7E9UumChE=";
   };
 
-  cargoSha256 = "sha256-GN8vz67/Pd39E3iYeqVfjC7zxvcA8u88lv42kWovlCo=";
+  cargoSha256 = "sha256-PPaub+2NV0QlmyevbhvUHzX2RV/vFmJz/j+wwfBBzfQ=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
     AppKit
diff --git a/pkgs/tools/misc/lrzsz/default.nix b/pkgs/tools/misc/lrzsz/default.nix
index e4b5e71a2560..e097ab12f082 100644
--- a/pkgs/tools/misc/lrzsz/default.nix
+++ b/pkgs/tools/misc/lrzsz/default.nix
@@ -17,6 +17,8 @@ stdenv.mkDerivation rec {
     })
   ];
 
+  makeFlags = [ "AR:=$(AR)" ];
+
   nativeBuildInputs = [ gettext ];
 
   hardeningDisable = [ "format" ];
diff --git a/pkgs/tools/typesetting/tectonic/default.nix b/pkgs/tools/typesetting/tectonic/default.nix
index 4b4ec194a977..ecab3c4a8fa6 100644
--- a/pkgs/tools/typesetting/tectonic/default.nix
+++ b/pkgs/tools/typesetting/tectonic/default.nix
@@ -9,25 +9,26 @@
 , pkg-config
 , makeWrapper
 , biber
+, icu
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "tectonic";
-  version = "0.8.2";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "tectonic-typesetting";
     repo = "tectonic";
     rev = "tectonic@${version}";
     fetchSubmodules = true;
-    sha256 = "sha256-Xw/Rs30mH81b8qqdpmbXjSSYIG08wwRvykzhPpF94uk=";
+    sha256 = "mfIEfue64kG4NmIEdTPRAqt6y22XfcgH6GtvJxuH6TU=";
   };
 
-  cargoSha256 = "sha256-JzYCxsaBuQ5I+FgHVRQPNM32bJlE4H9Fd+48/jXDcr0=";
+  cargoSha256 = "CH1FdZ7cPrE0V0yjauOjDKrRNioC3MjtcnZaOTkMptc=";
 
   nativeBuildInputs = [ pkg-config makeWrapper ];
 
-  buildInputs = [ fontconfig harfbuzz openssl ]
+  buildInputs = [ icu fontconfig harfbuzz openssl ]
     ++ lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [ ApplicationServices Cocoa Foundation ]);
 
   # Tectonic runs biber when it detects it needs to run it, see:
@@ -51,6 +52,6 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://tectonic-typesetting.github.io/";
     changelog = "https://github.com/tectonic-typesetting/tectonic/blob/tectonic@${version}/CHANGELOG.md";
     license = with licenses; [ mit ];
-    maintainers = [ maintainers.lluchs maintainers.doronbehar ];
+    maintainers = with maintainers; [ lluchs doronbehar ];
   };
 }
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index c75e92da4ee2..3619a844c723 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -46,6 +46,10 @@ let
 
     atdgen = callPackage ../development/ocaml-modules/atdgen { };
 
+    atdgen-codec-runtime = callPackage ../development/ocaml-modules/atdgen/codec-runtime.nix { };
+
+    atdgen-runtime = callPackage ../development/ocaml-modules/atdgen/runtime.nix { };
+
     awa = callPackage ../development/ocaml-modules/awa { };
 
     awa-lwt = callPackage ../development/ocaml-modules/awa/lwt.nix { };
@@ -105,6 +109,8 @@ let
 
     camlidl = callPackage ../development/tools/ocaml/camlidl { };
 
+    camlp-streams = callPackage ../development/ocaml-modules/camlp-streams { };
+
     camlp4 =
       if lib.versionOlder "4.02" ocaml.version
       then callPackage ../development/tools/ocaml/camlp4 { }