diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 3b56e53c50df..3efd6efcefaa 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -8621,6 +8621,12 @@
       fingerprint = "FEF0 AE2D 5449 3482 5F06  40AA 186A 1EDA C5C6 3F83";
     }];
   };
+  mightyiam = {
+    email = "mightyiampresence@gmail.com";
+    github = "mightyiam";
+    githubId = 635591;
+    name = "Shahar Dawn Or";
+  };
   mihnea-s = {
     email = "mihn.stn@gmail.com";
     github = "mihnea-s";
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index e8ea79d651a0..d5e93ff85f72 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -278,6 +278,7 @@ in {
   kubernetes = handleTestOn ["x86_64-linux"] ./kubernetes {};
   latestKernel.login = handleTest ./login.nix { latestKernel = true; };
   leaps = handleTest ./leaps.nix {};
+  lemmy = handleTest ./lemmy.nix {};
   libinput = handleTest ./libinput.nix {};
   libreddit = handleTest ./libreddit.nix {};
   libresprite = handleTest ./libresprite.nix {};
diff --git a/nixos/tests/cagebreak.nix b/nixos/tests/cagebreak.nix
index 1dcc910f9744..799535eecef6 100644
--- a/nixos/tests/cagebreak.nix
+++ b/nixos/tests/cagebreak.nix
@@ -33,6 +33,7 @@ in
 
     hardware.opengl.enable = true;
     programs.xwayland.enable = true;
+    services.udisks2.enable = true;
     environment.systemPackages = [ pkgs.cagebreak pkgs.wayland-utils ];
 
     # Need to switch to a different GPU driver than the default one (-vga std) so that Cagebreak can launch:
diff --git a/nixos/tests/lemmy.nix b/nixos/tests/lemmy.nix
new file mode 100644
index 000000000000..5436d0b300cc
--- /dev/null
+++ b/nixos/tests/lemmy.nix
@@ -0,0 +1,85 @@
+import ./make-test-python.nix ({ pkgs, lib, ... }:
+let
+  uiPort = 1234;
+  backendPort = 5678;
+  lemmyNodeName = "server";
+in
+{
+  name = "lemmy";
+  meta = with lib.maintainers; { maintainers = [ mightyiam ]; };
+
+  nodes = {
+    client = { };
+
+    "${lemmyNodeName}" = {
+      services.lemmy = {
+        enable = true;
+        jwtSecretPath = pkgs.writeTextFile {
+          name = "lemmy-secret";
+          text = "very-secret-password123";
+        };
+        ui.port = uiPort;
+        settings = {
+          hostname = "http://${lemmyNodeName}";
+          port = backendPort;
+          database.createLocally = true;
+        };
+        caddy.enable = true;
+      };
+
+      networking.firewall.allowedTCPPorts = [ 80 ];
+
+      # pict-rs seems to need more than 1025114112 bytes
+      virtualisation.memorySize = 2000;
+    };
+  };
+
+  testScript = ''
+    server = ${lemmyNodeName}
+
+    with subtest("the backend starts and responds"):
+        server.wait_for_unit("lemmy.service")
+        server.wait_for_open_port(${toString backendPort})
+        server.succeed("curl --fail localhost:${toString backendPort}/api/v3/site")
+
+    with subtest("the UI starts and responds"):
+        server.wait_for_unit("lemmy-ui.service")
+        server.wait_for_open_port(${toString uiPort})
+        server.succeed("curl --fail localhost:${toString uiPort}")
+
+    with subtest("Lemmy-UI responds through the caddy reverse proxy"):
+        server.wait_for_unit("network-online.target")
+        server.wait_for_unit("caddy.service")
+        server.wait_for_open_port(80)
+        body = server.execute("curl --fail --location ${lemmyNodeName}")[1]
+        assert "Lemmy" in body, f"String Lemmy not found in response for ${lemmyNodeName}: \n{body}"
+
+    with subtest("the server is exposed externally"):
+        client.wait_for_unit("network-online.target")
+        client.succeed("curl -v --fail ${lemmyNodeName}")
+
+    with subtest("caddy correctly routes backend requests"):
+        # Make sure we are not hitting frontend
+        server.execute("systemctl stop lemmy-ui.service")
+
+        def assert_http_code(url, expected_http_code, extra_curl_args=""):
+            _, http_code = server.execute(f'curl --silent -o /dev/null {extra_curl_args} --fail --write-out "%{{http_code}}" {url}')
+            assert http_code == str(expected_http_code), f"expected http code {expected_http_code}, got {http_code}"
+
+        # Caddy responds with HTTP code 502 if it cannot handle the requested path
+        assert_http_code("${lemmyNodeName}/obviously-wrong-path/", 502)
+
+        assert_http_code("${lemmyNodeName}/static/js/client.js", 200)
+        assert_http_code("${lemmyNodeName}/api/v3/site", 200)
+
+        # A 404 confirms that the request goes to the backend
+        # No path can return 200 until after we upload an image to pict-rs
+        assert_http_code("${lemmyNodeName}/pictrs/", 404)
+
+        # The paths `/feeds/*` and `/nodeinfo/*` are not tested because they seem to be misconfigured
+
+        assert_http_code("${lemmyNodeName}/some-other-made-up-path/", 404, "-X POST")
+        assert_http_code("${lemmyNodeName}/some-other-path", 404, "-H 'Accept: application/activity+json'")
+        assert_http_code("${lemmyNodeName}/some-other-path", 404, "-H 'Accept: application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\"'")
+  '';
+})
diff --git a/pkgs/applications/audio/praat/default.nix b/pkgs/applications/audio/praat/default.nix
index b178d88d7a6b..38240d69f7c6 100644
--- a/pkgs/applications/audio/praat/default.nix
+++ b/pkgs/applications/audio/praat/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "praat";
-  version = "6.2.16";
+  version = "6.2.17";
 
   src = fetchFromGitHub {
     owner = "praat";
     repo = "praat";
     rev = "v${version}";
-    sha256 = "sha256-k6wFTwXMXpLb+nddJ6fOfhzCOrcbQR7Pot8rmrx2gYs=";
+    sha256 = "sha256-368Dq4UU1+NTlskQQ5t/nEmyjLvSfdW3rhqzwKoKjzE=";
   };
 
   configurePhase = ''
diff --git a/pkgs/applications/audio/sonic-pi/default.nix b/pkgs/applications/audio/sonic-pi/default.nix
index 051a326c607d..3e7f2ddd4ad9 100644
--- a/pkgs/applications/audio/sonic-pi/default.nix
+++ b/pkgs/applications/audio/sonic-pi/default.nix
@@ -39,13 +39,13 @@
 
 stdenv.mkDerivation rec {
   pname = "sonic-pi";
-  version = "4.0.3";
+  version = "4.1.0";
 
   src = fetchFromGitHub {
     owner = "sonic-pi-net";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-kTuW+i/kdPhyG3L6SkgQTE9UvADY49KahJcw3+5Uz4k=";
+    hash = "sha256-kEZNVTAWkiqxyPJHSL4Gismpwxd+PnXiH8CgQCV3+PQ=";
   };
 
   mixFodDeps = beamPackages.fetchMixDeps {
@@ -61,10 +61,8 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     wrapQtAppsHook
     copyDesktopItems
-
     cmake
     pkg-config
-
     erlang
     elixir
     beamPackages.hex
diff --git a/pkgs/applications/emulators/sameboy/default.nix b/pkgs/applications/emulators/sameboy/default.nix
index d1fd26bfeaf9..c509582f8cdb 100644
--- a/pkgs/applications/emulators/sameboy/default.nix
+++ b/pkgs/applications/emulators/sameboy/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "sameboy";
-  version = "0.15.4";
+  version = "0.15.5";
 
   src = fetchFromGitHub {
     owner = "LIJI32";
     repo = "SameBoy";
     rev = "v${version}";
-    sha256 = "sha256-YLWo6Em/NdU60Dtu4ePANSKLixozxpxVwD3dJcAOs3g=";
+    sha256 = "sha256-R93ZIc1Ics3diJJDdGUBCEGRDW25YnC1ZY0DyJjpyVM=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/applications/misc/dwmbar/default.nix b/pkgs/applications/misc/dwmbar/default.nix
new file mode 100644
index 000000000000..5559f4a6e5af
--- /dev/null
+++ b/pkgs/applications/misc/dwmbar/default.nix
@@ -0,0 +1,37 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+}:
+
+stdenv.mkDerivation {
+  pname = "dwmbar";
+  version = "unstable-2021-12-22";
+
+  src = fetchFromGitHub {
+    owner = "thytom";
+    repo = "dwmbar";
+    rev = "574f5703c558a56bc9c354471543511255423dc7";
+    sha256 = "sha256-IrelZpgsxq2dnsjMdh7VC5eKffEGRbDkZmZBD+tROPs=";
+  };
+
+  postPatch = ''
+    substituteInPlace dwmbar \
+      --replace 'DEFAULT_CONFIG_DIR="/usr/share/dwmbar"' "DEFAULT_CONFIG_DIR=\"$out/share/dwmbar\""
+  '';
+
+  installPhase = ''
+    install -d $out/share/dwmbar
+    cp -r modules $out/share/dwmbar/
+    install -D -t $out/share/dwmbar/ config
+    install -D -t $out/share/dwmbar/ bar.sh
+    install -Dm755 -t $out/bin/ dwmbar
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/thytom/dwmbar";
+    description = "A Modular Status Bar for dwm";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ baitinq ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/applications/misc/pure-maps/default.nix b/pkgs/applications/misc/pure-maps/default.nix
index d7eeb95db691..793e5291d5b5 100644
--- a/pkgs/applications/misc/pure-maps/default.nix
+++ b/pkgs/applications/misc/pure-maps/default.nix
@@ -6,13 +6,13 @@
 
 mkDerivation rec {
   pname = "pure-maps";
-  version = "3.1.0";
+  version = "3.1.1";
 
   src = fetchFromGitHub {
     owner = "rinigus";
     repo = "pure-maps";
     rev = version;
-    hash = "sha256-PjZ8aKF+g3mH7z6LIUxI7mbtkcFv3wznBywaX/Y+1FU=";
+    hash = "sha256-ZPW2hNnaRfv5aTXqku7hPShN0leOuVEJ3T/OOTzwgXQ=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/misc/valentina/default.nix b/pkgs/applications/misc/valentina/default.nix
index 7329d8204cd7..f5cd55c534c3 100644
--- a/pkgs/applications/misc/valentina/default.nix
+++ b/pkgs/applications/misc/valentina/default.nix
@@ -1,65 +1,54 @@
-{ mkDerivation, lib, fetchhg
+{ lib, stdenv, fetchFromGitLab, substituteAll, installShellFiles
 , qmake, qttools
-, qtbase, qtsvg, qtxmlpatterns
-, poppler_utils
+, qtsvg, qttranslations, qtxmlpatterns
+, wrapQtAppsHook
 }:
 
-with lib;
-
-mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "valentina";
-  version = "0.6.1";
+  version = "0.7.51";
 
-  src = fetchhg {
-    url = "https://bitbucket.org/dismine/valentina";
+  src = fetchFromGitLab {
+    owner = "smart-pattern";
+    repo = "valentina";
     rev = "v${version}";
-    sha256 = "0dxk2av7xbsd233sr9wa1hamzb7pp8yx6p5b43rsnvnzchkqf423";
+    hash = "sha256-N9fC2tCP4TVNncatHaz5W5Mp3jOmAcEWYCl30+0myaE=";
   };
 
+  patches = (substituteAll {
+    # See https://github.com/NixOS/nixpkgs/issues/86054
+    src = ./fix-qttranslations-path.patch;
+    inherit qttranslations;
+  });
+
   postPatch = ''
-    substituteInPlace common.pri \
-      --replace '$$[QT_INSTALL_HEADERS]/QtXmlPatterns' '${getDev qtxmlpatterns}/include/QtXmlPatterns' \
-      --replace '$$[QT_INSTALL_HEADERS]/QtSvg' '${getDev qtsvg}/include/QtSvg' \
-      --replace '$$[QT_INSTALL_HEADERS]/' '${getDev qtbase}/include/' \
-      --replace '$$[QT_INSTALL_HEADERS]' '${getDev qtbase}'
-    substituteInPlace src/app/tape/tape.pro \
-      --replace '$$[QT_INSTALL_BINS]/rcc' '${getDev qtbase}/bin/rcc'
     substituteInPlace src/app/translations.pri \
-      --replace '$$[QT_INSTALL_BINS]/$$LRELEASE' '${getDev qttools}/bin/lrelease'
-    substituteInPlace src/app/valentina/mainwindowsnogui.cpp \
-      --replace 'define PDFTOPS "pdftops"' 'define PDFTOPS "${getBin poppler_utils}/bin/pdftops"'
-    substituteInPlace src/app/valentina/dialogs/dialogsavelayout.h \
-      --replace 'define PDFTOPS "pdftops"' 'define PDFTOPS "${getBin poppler_utils}/bin/pdftops"'
+      --replace '$$[QT_INSTALL_BINS]/$$LRELEASE' '${lib.getDev qttools}/bin/lrelease'
   '';
 
-  nativeBuildInputs = [ qmake qttools ];
+  nativeBuildInputs = [ qmake qttools wrapQtAppsHook installShellFiles ];
 
-  buildInputs = [ qtbase qtsvg qtxmlpatterns poppler_utils ];
+  buildInputs = [ qtsvg qtxmlpatterns ];
 
-  configurePhase = ''
-    qmake PREFIX=/ Valentina.pro -r "CONFIG += noTests noRunPath no_ccache noDebugSymbols"
-  '';
-
-  installFlags = [ "INSTALL_ROOT=$(out)" ];
+  qmakeFlags = [
+    "-r"
+    "PREFIX=${placeholder "out"}"
+    "CONFIG+=noTests"
+    "CONFIG+=noRunPath"
+    "CONFIG+=no_ccache"
+    "CONFIG+=noDebugSymbols"
+  ];
 
   postInstall = ''
-    mv $out/usr/share $out/
-    rmdir $out/usr
-
-    mkdir -p $out/share/man/man1
-    gzip -9c dist/debian/valentina.1 > $out/share/man/man1/valentina.1.gz
-    gzip -9c dist/debian/tape.1 > $out/share/man/man1/tape.1.gz
-
-    mkdir -p $out/share/mime/packages
-    cp dist/debian/valentina.sharedmimeinfo $out/share/mime/packages/valentina.xml
+    installManPage dist/debian/*.1
+    install -Dm644 dist/debian/valentina.sharedmimeinfo $out/share/mime/packages/valentina.xml
   '';
 
-  enableParallelBuilding = true;
-
-  meta = {
+  meta = with lib; {
     description = "An open source sewing pattern drafting software";
-    homepage = "https://valentinaproject.bitbucket.io/";
-    license = licenses.gpl3;
+    homepage = "https://smart-pattern.com.ua/";
+    changelog = "https://gitlab.com/smart-pattern/valentina/-/blob/v${version}/ChangeLog.txt";
+    license = licenses.gpl3Plus;
     platforms = platforms.linux;
     maintainers = with maintainers; [ jfrankenau ];
   };
diff --git a/pkgs/applications/misc/valentina/fix-qttranslations-path.patch b/pkgs/applications/misc/valentina/fix-qttranslations-path.patch
new file mode 100644
index 000000000000..de3fe05cc8b0
--- /dev/null
+++ b/pkgs/applications/misc/valentina/fix-qttranslations-path.patch
@@ -0,0 +1,37 @@
+diff --git i/src/libs/vmisc/vabstractapplication.cpp w/src/libs/vmisc/vabstractapplication.cpp
+index b64817bab..5f9aa3518 100644
+--- i/src/libs/vmisc/vabstractapplication.cpp
++++ w/src/libs/vmisc/vabstractapplication.cpp
+@@ -221,26 +221,26 @@ void VAbstractApplication::LoadTranslation(const QString &locale)
+     ClearTranslation();
+ 
+     qtTranslator = new QTranslator(this);
+-#if defined(Q_OS_WIN) || defined(Q_OS_MAC)
++#if defined(Q_OS_WIN)
+     qtTranslator->load("qt_" + locale, translationsPath(locale));
+ #else
+-    qtTranslator->load("qt_" + locale, QLibraryInfo::location(QLibraryInfo::TranslationsPath));
++    qtTranslator->load("qt_" + locale, QLatin1String("@qttranslations@/translations"));
+ #endif
+     installTranslator(qtTranslator);
+ 
+     qtxmlTranslator = new QTranslator(this);
+-#if defined(Q_OS_WIN) || defined(Q_OS_MAC)
++#if defined(Q_OS_WIN)
+     qtxmlTranslator->load("qtxmlpatterns_" + locale, translationsPath(locale));
+ #else
+-    qtxmlTranslator->load("qtxmlpatterns_" + locale, QLibraryInfo::location(QLibraryInfo::TranslationsPath));
++    qtxmlTranslator->load("qtxmlpatterns_" + locale, QLatin1String("@qttranslations@/translations"));
+ #endif
+     installTranslator(qtxmlTranslator);
+ 
+     qtBaseTranslator = new QTranslator(this);
+-#if defined(Q_OS_WIN) || defined(Q_OS_MAC)
++#if defined(Q_OS_WIN)
+     qtBaseTranslator->load("qtbase_" + locale, translationsPath(locale));
+ #else
+-    qtBaseTranslator->load("qtbase_" + locale, QLibraryInfo::location(QLibraryInfo::TranslationsPath));
++    qtBaseTranslator->load("qtbase_" + locale, QLatin1String("@qttranslations@/translations"));
+ #endif
+     installTranslator(qtBaseTranslator);
+ 
diff --git a/pkgs/applications/networking/cluster/pluto/default.nix b/pkgs/applications/networking/cluster/pluto/default.nix
index b90660199e28..e7e603c28c95 100644
--- a/pkgs/applications/networking/cluster/pluto/default.nix
+++ b/pkgs/applications/networking/cluster/pluto/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "pluto";
-  version = "5.10.5";
+  version = "5.10.6";
 
   src = fetchFromGitHub {
     owner = "FairwindsOps";
     repo = "pluto";
     rev = "v${version}";
-    sha256 = "sha256-Pdw8xPpH9PjLDbno8u3IWI7ygO18j2P3puE55+Pmzec=";
+    sha256 = "sha256-FNt+e13IEpIWB6gBYWfwJ+Qu7W/cyHvV+XGNhn17rdg=";
   };
 
-  vendorSha256 = "sha256-hAnlKMDqrQG8vlmBLufJlq79rb1vo4PdVaJjBBSjnRM=";
+  vendorSha256 = "sha256-M/D7V6v4+BlROoxhT9URuj9EI6qXYG2VoXcCVN+j6aU=";
 
   ldflags = [
     "-w" "-s"
diff --git a/pkgs/applications/networking/cluster/werf/default.nix b/pkgs/applications/networking/cluster/werf/default.nix
index 6024975021e5..7d1c1912ee23 100644
--- a/pkgs/applications/networking/cluster/werf/default.nix
+++ b/pkgs/applications/networking/cluster/werf/default.nix
@@ -11,13 +11,13 @@
 
 buildGoModule rec {
   pname = "werf";
-  version = "1.2.166";
+  version = "1.2.167";
 
   src = fetchFromGitHub {
     owner = "werf";
     repo = "werf";
     rev = "v${version}";
-    sha256 = "sha256-8LBGdjcnZTejH+lRo0im+czJJHOfhpmEB4DXM/qugYs=";
+    sha256 = "sha256-ddrNrRRol4x/14AUdmavkpbqXvI4XSWhWXu7MXrJ9D4=";
   };
 
   vendorSha256 = "sha256-E5yDk48O7zze8QTeLQ999QmB8XLkpKNZ8JQ2wVRMGCU=";
diff --git a/pkgs/applications/networking/instant-messengers/cinny-desktop/default.nix b/pkgs/applications/networking/instant-messengers/cinny-desktop/default.nix
index 0da3d38e6759..d5d47cda3385 100644
--- a/pkgs/applications/networking/instant-messengers/cinny-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/cinny-desktop/default.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation rec {
   name = "cinny-desktop";
-  version = "2.1.2";
+  version = "2.1.3";
 
   src = fetchurl {
     url = "https://github.com/cinnyapp/cinny-desktop/releases/download/v${version}/Cinny_desktop-x86_64.deb";
-    sha256 = "sha256-JLu6xAnUaeRTM/yj2Qsc7pXTRXCnvxx8NL2fDXyAUg0=";
+    sha256 = "sha256-fUnWGnulj/515aEdd+rCy/LGLLAs2yAOOBUn9K1LhNs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
index 7adc02efc80c..fdedea7244b5 100644
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
@@ -9,7 +9,7 @@
 
 stdenv.mkDerivation rec {
   pname = "signal-desktop";
-  version = "5.56.0"; # Please backport all updates to the stable channel.
+  version = "5.57.0"; # Please backport all updates to the stable channel.
   # All releases have a limited lifetime and "expire" 90 days after the release.
   # When releases "expire" the application becomes unusable until an update is
   # applied. The expiration date for the current release can be extracted with:
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://updates.signal.org/desktop/apt/pool/main/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-    sha256 = "sha256-8z6FSeEEOrkNYWh9cS7c6GDAufBuiVmHmo7Ie6mueyI=";
+    sha256 = "sha256-42xKqK/7V2GPHk/L396O7UoWn5vTyILVTbLa0Tf6NaY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/science/electronics/nvc/default.nix b/pkgs/applications/science/electronics/nvc/default.nix
index 236f7df5d76b..d7480bb42518 100644
--- a/pkgs/applications/science/electronics/nvc/default.nix
+++ b/pkgs/applications/science/electronics/nvc/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "nvc";
-  version = "1.7.0";
+  version = "1.7.1";
 
   src = fetchFromGitHub {
     owner = "nickg";
     repo = pname;
     rev = "r${version}";
-    sha256 = "sha256-U9VxpHzrAQPMqnSs0YcEnc9dlQUutTuZCJP5F1v7eaA=";
+    sha256 = "sha256-OcRwhhX93E8LHUeFzgjGxw6OANACOUJmY4i0JKjtHfI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/video/mov-cli/default.nix b/pkgs/applications/video/mov-cli/default.nix
new file mode 100644
index 000000000000..35789cb395f3
--- /dev/null
+++ b/pkgs/applications/video/mov-cli/default.nix
@@ -0,0 +1,29 @@
+{ lib
+, python3
+, fetchFromGitHub
+}:
+
+python3.pkgs.buildPythonPackage rec {
+  pname = "mov-cli";
+  version = "unstable-2022-06-30";
+
+  src = fetchFromGitHub {
+    owner = "mov-cli";
+    repo = "mov-cli";
+    rev = "b89e807e8ffc830b0b18c8e98712441c03774b8e";
+    sha256 = "sha256-D+OeXcLdkbG4ASbPQYIWf7J1CRZ9jH3UXxfTL4WleY0=";
+  };
+
+  propagatedBuildInputs = with python3.pkgs; [ setuptools httpx click beautifulsoup4 colorama ];
+
+  postPatch = ''
+    substituteInPlace setup.py --replace "bs4" "beautifulsoup4"
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/mov-cli/mov-cli";
+    description = "A cli tool to browse and watch movies";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ baitinq ];
+  };
+}
diff --git a/pkgs/applications/virtualization/qemu/default.nix b/pkgs/applications/virtualization/qemu/default.nix
index 32dc872a5c4b..3d8d87ec2274 100644
--- a/pkgs/applications/virtualization/qemu/default.nix
+++ b/pkgs/applications/virtualization/qemu/default.nix
@@ -41,11 +41,11 @@ stdenv.mkDerivation rec {
     + lib.optionalString xenSupport "-xen"
     + lib.optionalString hostCpuOnly "-host-cpu-only"
     + lib.optionalString nixosTestRunner "-for-vm-tests";
-  version = "7.0.0";
+  version = "7.1.0";
 
   src = fetchurl {
-    url= "https://download.qemu.org/qemu-${version}.tar.xz";
-    sha256 = "sha256-9rN1x5UfcoQCeYsLqrsthkeMpT1Eztvvq74cRr9G+Dk=";
+    url = "https://download.qemu.org/qemu-${version}.tar.xz";
+    sha256 = "1rmvrgqjhrvcmchnz170dxvrrf14n6nm39y8ivrprmfydd9lwqx0";
   };
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
@@ -109,44 +109,6 @@ stdenv.mkDerivation rec {
       sha256 = "sha256-oC+bRjEHixv1QEFO9XAm4HHOwoiT+NkhknKGPydnZ5E=";
       revert = true;
     })
-    # make nixos tests that boot from USB more stable
-    # https://lists.nongnu.org/archive/html/qemu-devel/2022-05/msg01484.html
-    (fetchpatch {
-      url = "https://gitlab.com/raboof/qemu/-/commit/3fb5e8fe4434130b1167a995b2a01c077cca2cd5.patch";
-      sha256 = "sha256-evzrN3i4ntc/AFG0C0rezQpQbWcnx74nXO+5DLErX8o=";
-    })
-    # fix 9p on macOS host, landed in master
-    (fetchpatch {
-      name = "fix-9p-on-macos.patch";
-      url = "https://gitlab.com/qemu/qemu/-/commit/f5643914a9e8f79c606a76e6a9d7ea82a3fc3e65.patch";
-      sha256 = "sha256-8i13wU135h+YxoXFtkXweBN3hMslpWoNoeQ7Ydmn3V4=";
-    })
-    (fetchpatch {
-      name = "CVE-2022-35414.patch";
-      url = "https://gitlab.com/qemu-project/qemu/-/commit/418ade7849ce7641c0f7333718caf5091a02fd4c.patch";
-      sha256 = "sha256-zQHDXedIXZBnabv4+3TA4z5mY1+KZiPmqUbhaSkGLgA=";
-    })
-    # needed for CVE-2022-0216's test to pass
-    (fetchpatch {
-      name = "fuzz-tests-x86-only.patch";
-      url = "https://gitlab.com/qemu-project/qemu/-/commit/b911c30c566dee48a27bc1bfa1ee6df3a729cbbb.patch";
-      sha256 = "sha256-RXKRmZo25yZ1VuBtBA+BsY8as9kIcACqE6aEYmIm9KQ=";
-    })
-    (fetchpatch {
-      name = "CVE-2022-0216.part-1.patch";
-      url = "https://gitlab.com/qemu-project/qemu/-/commit/6c8fa961da5e60f574bb52fd3ad44b1e9e8ad4b8.patch";
-      sha256 = "sha256-0z0zVPBVXFSU8qEV0Ea2+rDxyikMyitlDM0jZOLLC6s=";
-    })
-    (fetchpatch {
-      name = "CVE-2022-0216.part-2.patch";
-      url = "https://gitlab.com/qemu-project/qemu/-/commit/4367a20cc442c56b05611b4224de9a61908f9eac.patch";
-      sha256 = "sha256-hpNu4Zjw1dIbT6Vt57cayHE1Elaltp0a/bsKlDY0Qr8=";
-    })
-    (fetchpatch {
-      name = "CVE-2020-14394.patch";
-      url = "https://gitlab.com/qemu-project/qemu/-/commit/effaf5a240e03020f4ae953e10b764622c3e87cc.patch";
-      sha256 = "sha256-NobsIxRC+xlyj8d/oD4mqgXAGX37pfww/PQQuKhrTzc=";
-    })
   ]
   ++ lib.optional nixosTestRunner ./force-uid0-on-9p.patch;
 
diff --git a/pkgs/applications/virtualization/qemu/fix-qemu-ga.patch b/pkgs/applications/virtualization/qemu/fix-qemu-ga.patch
index 0b2dd0ee5ece..94dec6916800 100644
--- a/pkgs/applications/virtualization/qemu/fix-qemu-ga.patch
+++ b/pkgs/applications/virtualization/qemu/fix-qemu-ga.patch
@@ -1,16 +1,17 @@
-diff -Naur a/qga/commands-posix.c b/qga/commands-posix.c
---- a/qga/commands-posix.c
-+++ b/qga/commands-posix.c
-@@ -109,6 +109,8 @@
-         reopen_fd_to_null(1);
-         reopen_fd_to_null(2);
- 
-+        execle("/run/current-system/sw/bin/shutdown", "shutdown", "-h", shutdown_flag, "+0",
-+               "hypervisor initiated shutdown", (char*)NULL, environ);
-         execle("/sbin/shutdown", "shutdown", "-h", shutdown_flag, "+0",
-                "hypervisor initiated shutdown", (char*)NULL, environ);
-         _exit(EXIT_FAILURE);
-@@ -157,11 +159,13 @@
+diff --git i/qga/commands-posix.c w/qga/commands-posix.c
+index 954efed01b..39c4b916ce 100644
+--- i/qga/commands-posix.c
++++ w/qga/commands-posix.c
+@@ -123,6 +123,8 @@ void qmp_guest_shutdown(bool has_mode, const char *mode, Error **errp)
+         execl("/sbin/shutdown", "shutdown", shutdown_flag, "-g0", "-y",
+               "hypervisor initiated shutdown", (char *)NULL);
+ #else
++        execl("/run/current-system/sw/bin/shutdown", "shutdown", "-h", shutdown_flag, "+0",
++               "hypervisor initiated shutdown", (char *)NULL);
+         execl("/sbin/shutdown", "shutdown", "-h", shutdown_flag, "+0",
+                "hypervisor initiated shutdown", (char *)NULL);
+ #endif
+@@ -158,11 +160,13 @@ void qmp_guest_set_time(bool has_time, int64_t time_ns, Error **errp)
      pid_t pid;
      Error *local_err = NULL;
      struct timeval tv;
@@ -25,12 +26,11 @@ diff -Naur a/qga/commands-posix.c b/qga/commands-posix.c
      }
  
      if (!hwclock_available) {
-@@ -207,6 +211,8 @@
+@@ -208,6 +212,7 @@ void qmp_guest_set_time(bool has_time, int64_t time_ns, Error **errp)
  
          /* Use '/sbin/hwclock -w' to set RTC from the system time,
           * or '/sbin/hwclock -s' to set the system time from RTC. */
-+        execle(hwclock_path_nix, "hwclock", has_time ? "-w" : "-s",
-+               NULL, environ);
-         execle(hwclock_path, "hwclock", has_time ? "-w" : "-s",
-                NULL, environ);
++        execl(hwclock_path_nix, "hwclock", has_time ? "-w" : "-s", NULL);
+         execl(hwclock_path, "hwclock", has_time ? "-w" : "-s", NULL);
          _exit(EXIT_FAILURE);
+     } else if (pid < 0) {
diff --git a/pkgs/applications/virtualization/qemu/revert-ui-cocoa-add-clipboard-support.patch b/pkgs/applications/virtualization/qemu/revert-ui-cocoa-add-clipboard-support.patch
index 775066f6fdde..2faab7acd873 100644
--- a/pkgs/applications/virtualization/qemu/revert-ui-cocoa-add-clipboard-support.patch
+++ b/pkgs/applications/virtualization/qemu/revert-ui-cocoa-add-clipboard-support.patch
@@ -1,4 +1,4 @@
-From 19b0952b36b6b5c4bd2665cc0bd4e55a85f81b55 Mon Sep 17 00:00:00 2001
+From 756021d1e433925cf9a732d7ea67b01b0beb061c Mon Sep 17 00:00:00 2001
 From: Will Cohen <willcohen@users.noreply.github.com>
 Date: Tue, 29 Mar 2022 14:00:56 -0400
 Subject: [PATCH] Revert "ui/cocoa: Add clipboard support"
@@ -7,8 +7,8 @@ This reverts commit 7e3e20d89129614f4a7b2451fe321cc6ccca3b76.
 ---
  include/ui/clipboard.h |   2 +-
  ui/clipboard.c         |   2 +-
- ui/cocoa.m             | 121 -----------------------------------------
- 3 files changed, 2 insertions(+), 123 deletions(-)
+ ui/cocoa.m             | 123 -----------------------------------------
+ 3 files changed, 2 insertions(+), 125 deletions(-)
 
 diff --git a/include/ui/clipboard.h b/include/ui/clipboard.h
 index ce76aa451f..c4e1dc4ff4 100644
@@ -37,18 +37,18 @@ index 9079ef829b..6b9ed59e1b 100644
  {
      if (!info ||
 diff --git a/ui/cocoa.m b/ui/cocoa.m
-index c4e5468f9e..cd3bdf0cec 100644
+index 5a8bd5dd84..79ed6d043f 100644
 --- a/ui/cocoa.m
 +++ b/ui/cocoa.m
-@@ -28,7 +28,6 @@
- #include <crt_externs.h>
+@@ -29,7 +29,6 @@
  
- #include "qemu-common.h"
+ #include "qemu/help-texts.h"
+ #include "qemu-main.h"
 -#include "ui/clipboard.h"
  #include "ui/console.h"
  #include "ui/input.h"
  #include "ui/kbd-state.h"
-@@ -107,10 +106,6 @@ static void cocoa_switch(DisplayChangeListener *dcl,
+@@ -109,10 +108,6 @@ static void cocoa_switch(DisplayChangeListener *dcl,
  static QemuSemaphore app_started_sem;
  static bool allow_events;
  
@@ -59,7 +59,7 @@ index c4e5468f9e..cd3bdf0cec 100644
  // Utility functions to run specified code block with iothread lock held
  typedef void (^CodeBlock)(void);
  typedef bool (^BoolCodeBlock)(void);
-@@ -1805,105 +1800,6 @@ static void addRemovableDevicesMenuItems(void)
+@@ -1815,107 +1810,6 @@ static void addRemovableDevicesMenuItems(void)
      qapi_free_BlockInfoList(pointerToFree);
  }
  
@@ -146,16 +146,18 @@ index c4e5468f9e..cd3bdf0cec 100644
 -static void cocoa_clipboard_request(QemuClipboardInfo *info,
 -                                    QemuClipboardType type)
 -{
+-    NSAutoreleasePool *pool;
 -    NSData *text;
 -
 -    switch (type) {
 -    case QEMU_CLIPBOARD_TYPE_TEXT:
+-        pool = [[NSAutoreleasePool alloc] init];
 -        text = [[NSPasteboard generalPasteboard] dataForType:NSPasteboardTypeString];
 -        if (text) {
 -            qemu_clipboard_set_data(&cbpeer, info, type,
 -                                    [text length], [text bytes], true);
--            [text release];
 -        }
+-        [pool release];
 -        break;
 -    default:
 -        break;
@@ -165,7 +167,7 @@ index c4e5468f9e..cd3bdf0cec 100644
  /*
   * The startup process for the OSX/Cocoa UI is complicated, because
   * OSX insists that the UI runs on the initial main thread, and so we
-@@ -1938,7 +1834,6 @@ static void cocoa_clipboard_request(QemuClipboardInfo *info,
+@@ -1950,7 +1844,6 @@ static void cocoa_clipboard_request(QemuClipboardInfo *info,
      COCOA_DEBUG("Second thread: calling qemu_main()\n");
      status = qemu_main(gArgc, gArgv, *_NSGetEnviron());
      COCOA_DEBUG("Second thread: qemu_main() returned, exiting\n");
@@ -173,7 +175,7 @@ index c4e5468f9e..cd3bdf0cec 100644
      exit(status);
  }
  
-@@ -2054,18 +1949,6 @@ static void cocoa_refresh(DisplayChangeListener *dcl)
+@@ -2066,18 +1959,6 @@ static void cocoa_refresh(DisplayChangeListener *dcl)
              [cocoaView setAbsoluteEnabled:YES];
          });
      }
@@ -192,7 +194,7 @@ index c4e5468f9e..cd3bdf0cec 100644
      [pool release];
  }
  
-@@ -2105,10 +1988,6 @@ static void cocoa_display_init(DisplayState *ds, DisplayOptions *opts)
+@@ -2117,10 +1998,6 @@ static void cocoa_display_init(DisplayState *ds, DisplayOptions *opts)
  
      // register vga output callbacks
      register_displaychangelistener(&dcl);
diff --git a/pkgs/development/libraries/folly/default.nix b/pkgs/development/libraries/folly/default.nix
index 8e3afb1e5c38..6cde17e5fce6 100644
--- a/pkgs/development/libraries/folly/default.nix
+++ b/pkgs/development/libraries/folly/default.nix
@@ -22,13 +22,13 @@
 
 stdenv.mkDerivation rec {
   pname = "folly";
-  version = "2022.08.22.00";
+  version = "2022.08.29.00";
 
   src = fetchFromGitHub {
     owner = "facebook";
     repo = "folly";
     rev = "v${version}";
-    sha256 = "sha256-Cj8JK3uoObt1G8kd2y4KxS88WwLPthdBvPcLi1C24aQ=";
+    sha256 = "sha256-OALOfjr9qEqr8dbL9G8USKImU+hDP8iDfJijzT6KPLM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/awscrt/default.nix b/pkgs/development/python-modules/awscrt/default.nix
index 33d3dcf49918..080889680443 100644
--- a/pkgs/development/python-modules/awscrt/default.nix
+++ b/pkgs/development/python-modules/awscrt/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "awscrt";
-  version = "0.14.0";
+  version = "0.14.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-MGLTFcsWVC/gTdgjny6LwyOO6QRc1QcLkVzy677Lqqw=";
+    hash = "sha256-nLlldO4otyWKn91L6vCiBh9csplFrN8tiK1tfeik6Y4=";
   };
 
   buildInputs = lib.optionals stdenv.isDarwin [
diff --git a/pkgs/development/python-modules/flower/default.nix b/pkgs/development/python-modules/flower/default.nix
index 14bb7ae6cb46..5d3e7d4482bd 100644
--- a/pkgs/development/python-modules/flower/default.nix
+++ b/pkgs/development/python-modules/flower/default.nix
@@ -3,7 +3,6 @@
 , fetchPypi
 , celery
 , humanize
-, mock
 , pytz
 , tornado
 , prometheus-client
@@ -12,12 +11,12 @@
 
 buildPythonPackage rec {
   pname = "flower";
-  version = "1.1.0";
+  version = "1.2.0";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-+SDKKQLXU5/BgKsV5R8dkYNV5cwj2oVP+dWcbloXJbY=";
+    sha256 = "46493c7e8d9ca2167e8a46eb97ae8d280997cb40a81993230124d74f0fe40bac";
   };
 
   postPatch = ''
@@ -35,27 +34,17 @@ buildPythonPackage rec {
   ];
 
   checkInputs = [
-    mock
     pytestCheckHook
   ];
 
-  disabledTests = [
-    # AssertionError as the celery release can't be detected
-    "test_default"
-    "test_with_app"
-  ];
-
   pythonImportsCheck = [
     "flower"
   ];
 
   meta = with lib; {
-    description = "Celery Flower";
+    description = "Real-time monitor and web admin for Celery distributed task queue";
     homepage = "https://github.com/mher/flower";
     license = licenses.bsdOriginal;
     maintainers = with maintainers; [ arnoldfarkas ];
-    knownVulnerabilities = [
-      "CVE-2022-30034"
-    ];
   };
 }
diff --git a/pkgs/development/python-modules/google-cloud-securitycenter/default.nix b/pkgs/development/python-modules/google-cloud-securitycenter/default.nix
index 076be48781fc..558872f718ef 100644
--- a/pkgs/development/python-modules/google-cloud-securitycenter/default.nix
+++ b/pkgs/development/python-modules/google-cloud-securitycenter/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-securitycenter";
-  version = "1.14.0";
+  version = "1.15.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-VNvIt3WYMMXOMovJvbSwKU2/Xz8/F+BW0XoKdi0QSo0=";
+    hash = "sha256-rWV7lY0CHrVJFOA/Yix/o3OE++wKSK5EEXOV6o5lwIo=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/nextcord/default.nix b/pkgs/development/python-modules/nextcord/default.nix
index 8f303acd8fa4..140d81c87c72 100644
--- a/pkgs/development/python-modules/nextcord/default.nix
+++ b/pkgs/development/python-modules/nextcord/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "nextcord";
-  version = "2.0.0";
+  version = "2.1.0";
 
   format = "setuptools";
 
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "nextcord";
     repo = "nextcord";
     rev = "refs/tags/v${version}";
-    hash = "sha256-MjpWPirupXoSnvnRNePx4hUTbiWHcL2bwUOoZAvN7pU=";
+    hash = "sha256-/M7Wyb1GW6LPWm41jVnhWA6+dyTrdLyJ6pfsMozw5xI=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/python-novaclient/default.nix b/pkgs/development/python-modules/python-novaclient/default.nix
index d4a9e9255f23..5ae75098ddd3 100644
--- a/pkgs/development/python-modules/python-novaclient/default.nix
+++ b/pkgs/development/python-modules/python-novaclient/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "python-novaclient";
-  version = "18.0.0";
+  version = "18.1.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-6esqm9ukZNggwQB3XDwvZJMIjfZq8T37kyXMa4ZcjSM=";
+    hash = "sha256-eCBVnRZfGk2BDn2nyV+IQl2L5JX20aPG9CA7isGH4lQ=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/tinycss2/default.nix b/pkgs/development/python-modules/tinycss2/default.nix
index 7e49433bc2f3..8d6d457d31a6 100644
--- a/pkgs/development/python-modules/tinycss2/default.nix
+++ b/pkgs/development/python-modules/tinycss2/default.nix
@@ -4,38 +4,41 @@
 , fetchFromGitHub
 , webencodings
 , pytestCheckHook
+, flit-core
 }:
 
 buildPythonPackage rec {
   pname = "tinycss2";
-  version = "1.1.0";
-  disabled = pythonOlder "3.5";
+  version = "1.1.1";
   format = "flit";
 
+  disabled = pythonOlder "3.6";
+
   src = fetchFromGitHub {
     owner = "kozea";
     repo = "tinycss2";
     rev = "v${version}";
     # for tests
     fetchSubmodules = true;
-    sha256 = "sha256-WA88EYolL76WqeA1UKR3Sfw11j8NuOGOxPezujYizH8=";
+    sha256 = "sha256-RUF/3cjNgDFofoxl9iKY3u5ZAVVQmXu2Qbb5U4brdcQ=";
   };
 
-  propagatedBuildInputs = [ webencodings ];
-
-  checkInputs = [
-    pytestCheckHook
-  ];
-
   postPatch = ''
     substituteInPlace pyproject.toml \
       --replace "'pytest-cov', 'pytest-flake8', 'pytest-isort', 'coverage[toml]'" "" \
-      --replace "--isort --flake8 --cov" ""
+      --replace "--isort --flake8 --cov --no-cov-on-fail" ""
   '';
 
+  nativeBuildInputs = [ flit-core ];
+
+  propagatedBuildInputs = [ webencodings ];
+
+  checkInputs = [ pytestCheckHook ];
+
   meta = with lib; {
     description = "Low-level CSS parser for Python";
     homepage = "https://github.com/Kozea/tinycss2";
     license = licenses.bsd3;
+    maintainers = with maintainers; [ onny ];
   };
 }
diff --git a/pkgs/development/tools/kafkactl/default.nix b/pkgs/development/tools/kafkactl/default.nix
index 12278e56d80a..63c80d993e71 100644
--- a/pkgs/development/tools/kafkactl/default.nix
+++ b/pkgs/development/tools/kafkactl/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "kafkactl";
-  version = "1.23.1";
+  version = "2.5.0";
 
   src = fetchFromGitHub {
     owner = "deviceinsight";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1zg0lar16axi25mnmdbdyrm876rbc328kq1yvhjlnzskmkhzjsg2";
+    sha256 = "sha256-cCAmqiriiNSEpo5fHLPsarmLLhBE9QILa9xFNLlCorM=";
   };
 
-  vendorSha256 = "0pnnrpyg40lb54h0k36c4iibapzlh54cdvc4mampmj13kphk3zzg";
+  vendorSha256 = "sha256-Y0Muihh9S8g3SLH12jw1MYyq5mpbrTJWJu4cSNTCqmE=";
   doCheck = false;
 
   meta = with lib; {
diff --git a/pkgs/development/tools/rust/cargo-workspaces/default.nix b/pkgs/development/tools/rust/cargo-workspaces/default.nix
new file mode 100644
index 000000000000..ed0eec126d8c
--- /dev/null
+++ b/pkgs/development/tools/rust/cargo-workspaces/default.nix
@@ -0,0 +1,51 @@
+{ fetchCrate
+, lib
+, rustPlatform
+, pkg-config
+, openssl
+, zlib
+, stdenv
+, darwin
+, libssh2
+, libgit2
+, IOKit
+, Security
+, CoreFoundation
+, AppKit
+, System
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "cargo-workspaces";
+  version = "0.2.35";
+
+  src = fetchCrate {
+    inherit pname version;
+    sha256 = "sha256-MHoVeutoMaHHl1uxv52NOuvXsssqDuyfHTuyTqg9y+U=";
+  };
+
+  cargoSha256 = "sha256-wUVNsUx7JS5icjxbz3CV1lNUvuuL+gTL2QzuE+030WU=";
+  verifyCargoDeps = true;
+
+  # needed to get libssh2/libgit2 to link properly
+  LIBGIT2_SYS_USE_PKG_CONFIG = true;
+  LIBSSH2_SYS_USE_PKG_CONFIG = true;
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ openssl zlib libssh2 libgit2 ] ++ (
+    lib.optionals stdenv.isDarwin ([ IOKit Security CoreFoundation AppKit ]
+      ++ (lib.optionals stdenv.isAarch64 [ System ]))
+  );
+
+  meta = with lib; {
+    description = "A tool for managing cargo workspaces and their crates, inspired by lerna";
+    longDescription = ''
+      A tool that optimizes the workflow around cargo workspaces with
+      git and cargo by providing utilities to version, publish, execute
+      commands and more.
+    '';
+    homepage = "https://github.com/pksunkara/cargo-workspaces";
+    license = licenses.mit;
+    maintainers = with maintainers; [ macalinao ];
+  };
+}
diff --git a/pkgs/development/tools/worker-build/default.nix b/pkgs/development/tools/worker-build/default.nix
index 41c92732dcc8..dc6f2e9e9df5 100644
--- a/pkgs/development/tools/worker-build/default.nix
+++ b/pkgs/development/tools/worker-build/default.nix
@@ -1,17 +1,19 @@
-{ lib, stdenv, fetchFromGitHub, rustPlatform }:
+{ lib, stdenv, fetchFromGitHub, rustPlatform, Security }:
 
 rustPlatform.buildRustPackage rec {
   pname = "worker-build";
-  version = "0.0.10";
+  version = "0.0.11";
 
   src = fetchFromGitHub {
     owner = "cloudflare";
     repo = "workers-rs";
     rev = "v${version}";
-    sha256 = "sha256-p19Q/XAOvDKXRvDWeMRo4C1TnvxYg88CAyldN7AhJDM=";
+    sha256 = "sha256-oqnYWrytQ3hCf4T/PNIXTs3tW+W8HvuvIulRhdhzsDU=";
   };
 
-  cargoSha256 = "sha256-8fnsiWZjxCxhv4NWcRIpKbT8vQyhe27es80ttKX/oPs=";
+  cargoSha256 = "sha256-t35LMyiQl2bsGjNIKqb8sKbrmCLZ0pmoo0qX0buGA+o=";
+
+  buildInputs = lib.optionals stdenv.isDarwin [ Security ];
 
   buildAndTestSubdir = "worker-build";
 
diff --git a/pkgs/games/papermc/default.nix b/pkgs/games/papermc/default.nix
index 31c9467109e9..7b8733d6213d 100644
--- a/pkgs/games/papermc/default.nix
+++ b/pkgs/games/papermc/default.nix
@@ -1,10 +1,10 @@
 { lib, stdenv, fetchurl, bash, jre }:
 let
-  mcVersion = "1.18.2";
-  buildNum = "313";
+  mcVersion = "1.19.2";
+  buildNum = "131";
   jar = fetchurl {
     url = "https://papermc.io/api/v2/projects/paper/versions/${mcVersion}/builds/${buildNum}/downloads/paper-${mcVersion}-${buildNum}.jar";
-    sha256 = "sha256-wotk0Pu1wKomj83nMCyzzPZ+Y9RkQUbfeWjRGaSt7lE=";
+    sha256 = "sha256-y7+bByWPc/2KBG/DOX/CFsIQWNboJs68++6Y64lyVt4=";
   };
 in stdenv.mkDerivation {
   pname = "papermc";
diff --git a/pkgs/servers/dns/pdns-recursor/default.nix b/pkgs/servers/dns/pdns-recursor/default.nix
index ded457c43a8b..35d79d6b1439 100644
--- a/pkgs/servers/dns/pdns-recursor/default.nix
+++ b/pkgs/servers/dns/pdns-recursor/default.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "pdns-recursor";
-  version = "4.7.1";
+  version = "4.7.2";
 
   src = fetchurl {
     url = "https://downloads.powerdns.com/releases/pdns-recursor-${version}.tar.bz2";
-    sha256 = "sha256-0vlFc6bw5joQNMorMBwn6/LhMAplW6ZpzFAtXqjW7Gg=";
+    sha256 = "sha256-vbQZB5D+dZd41vBRWvu8wKKLPn4bg8Vwyq84QZ1Xgg0=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/servers/web-apps/lemmy/server.nix b/pkgs/servers/web-apps/lemmy/server.nix
index 65425eb96a16..2917d660ba94 100644
--- a/pkgs/servers/web-apps/lemmy/server.nix
+++ b/pkgs/servers/web-apps/lemmy/server.nix
@@ -8,6 +8,7 @@
 , Security
 , protobuf
 , rustfmt
+, nixosTests
 }:
 let
   pinData = lib.importJSON ./pin.json;
@@ -42,6 +43,7 @@ rustPlatform.buildRustPackage rec {
   nativeBuildInputs = [ protobuf rustfmt ];
 
   passthru.updateScript = ./update.sh;
+  passthru.tests.lemmy-server = nixosTests.lemmy;
 
   meta = with lib; {
     description = "🐀 Building a federated alternative to reddit in rust";
diff --git a/pkgs/servers/web-apps/lemmy/ui.nix b/pkgs/servers/web-apps/lemmy/ui.nix
index f140cf071ea9..82aa67a45d45 100644
--- a/pkgs/servers/web-apps/lemmy/ui.nix
+++ b/pkgs/servers/web-apps/lemmy/ui.nix
@@ -6,6 +6,7 @@
 , pkg-config
 , fetchFromGitHub
 , fetchYarnDeps
+, nixosTests
 }:
 
 let
@@ -67,6 +68,7 @@ mkYarnPackage {
   distPhase = "true";
 
   passthru.updateScript = ./update.sh;
+  passthru.tests.lemmy-ui = nixosTests.lemmy;
 
   meta = with lib; {
     description = "Building a federated alternative to reddit in rust";
diff --git a/pkgs/servers/web-apps/searxng/default.nix b/pkgs/servers/web-apps/searxng/default.nix
index 0ea20aca1ffe..0ddfc5351e3f 100644
--- a/pkgs/servers/web-apps/searxng/default.nix
+++ b/pkgs/servers/web-apps/searxng/default.nix
@@ -5,13 +5,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "searxng";
-  version = "unstable-2022-07-15";
+  version = "unstable-2022-09-01";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
-    rev = "7bf4e8d12d1d0ee53bf71f7c3a4010ef936f25d9";
-    sha256 = "sha256-Fuv9AoV9WnI6qMgj4Ve016RF8gaLXYgw89jRROcm/A8=";
+    rev = "174e5242569812618af4ebd9a646ba2a6ded5459";
+    sha256 = "sha256-Q1+4HkgOoTRtW5XYWpC5dpukkrjG5fP0585soo/srmQ=";
   };
 
   postPatch = ''
diff --git a/pkgs/shells/murex/default.nix b/pkgs/shells/murex/default.nix
new file mode 100644
index 000000000000..bbeb5d9b9837
--- /dev/null
+++ b/pkgs/shells/murex/default.nix
@@ -0,0 +1,27 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
+
+buildGoModule rec {
+  pname = "murex";
+  version = "2.10.2400";
+
+  src = fetchFromGitHub {
+    owner = "lmorg";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0bqd91m7m4i4lfvz4p1lbrfs01kyh73p0g236q13bv4x1n1lkqr3";
+  };
+
+  vendorSha256 = "sha256-hLz36ESf6To6sT/ha/yXyhG0U1gGw8HDfnrPJnws25g=";
+
+  subPackages = [ "." ];
+
+  meta = with lib; {
+    description = "Bash-like shell and scripting environment with advanced features designed for safety and productivity";
+    homepage = "https://murex.rocks";
+    license = licenses.gpl2;
+    maintainers = with maintainers; [ dit7ya ];
+  };
+}
diff --git a/pkgs/tools/admin/copilot-cli/default.nix b/pkgs/tools/admin/copilot-cli/default.nix
index 149232c697a6..dfbf451b2d73 100644
--- a/pkgs/tools/admin/copilot-cli/default.nix
+++ b/pkgs/tools/admin/copilot-cli/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "copilot-cli";
-  version = "1.21.0";
+  version = "1.21.1";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-zGmb3EvWkGGJuq9R3GWEfHZvFn7DMC6B6Onk06mFiWI=";
+    sha256 = "sha256-6x809FXjPQH7Q90GCZdcMI1SuqR868UGnVK1Hs5qZNo=";
   };
 
-  vendorSha256 = "sha256-8avzCfCBSVLsWUgBBiD4pYTWrd2X2rdruU5v+AJ3EKY=";
+  vendorSha256 = "sha256-+nARXJdMmU36Gz2fjXbkFMafJGVUJx+T/zTQRcfVYik=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 5bfd2567efae..c1b033db89ad 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -230,6 +230,8 @@ with pkgs;
     python3 = python39;
   };
 
+  mov-cli = callPackage ../applications/video/mov-cli { };
+
   ani-cli = callPackage ../applications/video/ani-cli { };
 
   anime-downloader = callPackage ../applications/video/anime-downloader { };
@@ -5947,7 +5949,9 @@ with pkgs;
 
   wallutils = callPackage ../tools/graphics/wallutils { };
 
-  worker-build = callPackage ../development/tools/worker-build { };
+  worker-build = callPackage ../development/tools/worker-build {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   wrangler = callPackage ../development/tools/wrangler {
     inherit (darwin.apple_sdk.frameworks) CoreFoundation CoreServices Security;
@@ -12774,6 +12778,8 @@ with pkgs;
 
   mksh = callPackage ../shells/mksh { };
 
+  murex = callPackage ../shells/murex { };
+
   oh = callPackage ../shells/oh { };
 
   oil = callPackage ../shells/oil { };
@@ -14537,6 +14543,9 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) CoreServices Foundation;
   };
   cargo-wipe = callPackage ../development/tools/rust/cargo-wipe { };
+  cargo-workspaces = callPackage ../development/tools/rust/cargo-workspaces {
+    inherit (darwin.apple_sdk.frameworks) IOKit Security CoreFoundation AppKit System;
+  };
   cargo-xbuild = callPackage ../development/tools/rust/cargo-xbuild { };
   cargo-generate = callPackage ../development/tools/rust/cargo-generate {
     inherit (darwin.apple_sdk.frameworks) Security;
@@ -27093,6 +27102,8 @@ with pkgs;
 
   dwmblocks = callPackage ../applications/misc/dwmblocks { };
 
+  dwmbar = callPackage ../applications/misc/dwmbar { };
+
   dwm-status = callPackage ../applications/window-managers/dwm/dwm-status.nix { };
 
   exploitdb = callPackage ../tools/security/exploitdb { };
@@ -31512,7 +31523,7 @@ with pkgs;
 
   utox = callPackage ../applications/networking/instant-messengers/utox { };
 
-  valentina = libsForQt512.callPackage ../applications/misc/valentina { };
+  valentina = libsForQt5.callPackage ../applications/misc/valentina { };
 
   vbindiff = callPackage ../applications/editors/vbindiff { };