diff --git a/.github/workflows/editorconfig.yml b/.github/workflows/editorconfig.yml
index 01a6d736c137..445f0fcbaf8f 100644
--- a/.github/workflows/editorconfig.yml
+++ b/.github/workflows/editorconfig.yml
@@ -11,7 +11,7 @@ on:
 jobs:
   tests:
     runs-on: ubuntu-latest
-    if: github.repository_owner == 'NixOS'
+    if: "github.repository_owner == 'NixOS' && !contains(github.event.pull_request.title, '[skip editorconfig]')"
     steps:
     - name: Get list of changed files from PR
       env:
diff --git a/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
index ed5ffe352323..96cb5187889f 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
@@ -2023,6 +2023,12 @@ Superuser created successfully.
           hydrus manual</link>.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          More jdk and jre versions are now exposed via
+          <literal>java-packages.compiler</literal>.
+        </para>
+      </listitem>
     </itemizedlist>
   </section>
 </section>
diff --git a/nixos/doc/manual/release-notes/rl-2111.section.md b/nixos/doc/manual/release-notes/rl-2111.section.md
index 61bcd745a356..584bde952a2a 100644
--- a/nixos/doc/manual/release-notes/rl-2111.section.md
+++ b/nixos/doc/manual/release-notes/rl-2111.section.md
@@ -549,3 +549,5 @@ In addition to numerous new and upgraded packages, this release has the followin
 - RetroArch has been upgraded from version `1.8.5` to `1.9.13.2`. Since the previous release was quite old, if you're having issues after the upgrade, please delete your `$XDG_CONFIG_HOME/retroarch/retroarch.cfg` file.
 
 - hydrus has been upgraded from version `438` to `463`. Since upgrading between releases this old is advised against, be sure to have a backup of your data before upgrading. For details, see [the hydrus manual](https://hydrusnetwork.github.io/hydrus/help/getting_started_installing.html#big_updates).
+
+- More jdk and jre versions are now exposed via `java-packages.compiler`.
diff --git a/pkgs/applications/editors/poke/default.nix b/pkgs/applications/editors/poke/default.nix
index a24666741e14..cdfacaf92ede 100644
--- a/pkgs/applications/editors/poke/default.nix
+++ b/pkgs/applications/editors/poke/default.nix
@@ -19,13 +19,15 @@ let
   isCross = stdenv.hostPlatform != stdenv.buildPlatform;
 in stdenv.mkDerivation rec {
   pname = "poke";
-  version = "1.3";
+  version = "1.4";
 
   src = fetchurl {
     url = "mirror://gnu/${pname}/${pname}-${version}.tar.gz";
-    hash = "sha256-unhjA0obCABLDuj4i9qUFgcH6aeB1VVvVVtQdYPPDxs=";
+    sha256 = "sha256-zgVN8pVgySEjATJwPuRJ/hMLbiWrA6psx5a7QBUGqiQ=";
   };
 
+  outputs = [ "out" "dev" "info" "lib" "man" ];
+
   postPatch = ''
     patchShebangs .
   '';
@@ -46,7 +48,9 @@ in stdenv.mkDerivation rec {
   ++ lib.optional textStylingSupport gettext
   ++ lib.optional (!isCross) dejagnu;
 
-  configureFlags = lib.optionals guiSupport [
+  configureFlags = [
+    "--datadir=${placeholder "lib"}/share"
+  ] ++ lib.optionals guiSupport [
     "--with-tcl=${tcl}/lib"
     "--with-tk=${tk}/lib"
     "--with-tkinclude=${tk.dev}/include"
@@ -57,6 +61,10 @@ in stdenv.mkDerivation rec {
   doCheck = !isCross;
   checkInputs = lib.optionals (!isCross) [ dejagnu ];
 
+  postInstall = ''
+    moveToOutput share/emacs "$out"
+  '';
+
   meta = with lib; {
     description = "Interactive, extensible editor for binary data";
     homepage = "http://www.jemarch.net/poke";
diff --git a/pkgs/applications/gis/qgis/unwrapped.nix b/pkgs/applications/gis/qgis/unwrapped.nix
index 4f62ccecbaf5..0ec81c785b4b 100644
--- a/pkgs/applications/gis/qgis/unwrapped.nix
+++ b/pkgs/applications/gis/qgis/unwrapped.nix
@@ -56,14 +56,14 @@ let
     six
   ];
 in mkDerivation rec {
-  version = "3.16.13";
+  version = "3.16.14";
   pname = "qgis-unwrapped";
 
   src = fetchFromGitHub {
     owner = "qgis";
     repo = "QGIS";
     rev = "final-${lib.replaceStrings [ "." ] [ "_" ] version}";
-    sha256 = "13irzs89lknfxf2y7j931bh0zmqgiwifdbbzvwn8yxxr21gd68ac";
+    sha256 = "sha256-3FUGSBdlhJhhpTPtYuzKOznsC7PJV3kRL9Il2Yryi1Q=";
   };
 
   passthru = {
@@ -123,6 +123,6 @@ in mkDerivation rec {
     homepage = "https://www.qgis.org";
     license = lib.licenses.gpl2Plus;
     platforms = with lib.platforms; linux;
-    maintainers = with lib.maintainers; [ lsix sikmir ];
+    maintainers = with lib.maintainers; [ lsix sikmir erictapen ];
   };
 }
diff --git a/pkgs/applications/radio/gnuradio/default.nix b/pkgs/applications/radio/gnuradio/default.nix
index d92af80701b1..61aafb63b5db 100644
--- a/pkgs/applications/radio/gnuradio/default.nix
+++ b/pkgs/applications/radio/gnuradio/default.nix
@@ -46,13 +46,13 @@
 , pname ? "gnuradio"
 , versionAttr ? {
   major = "3.9";
-  minor = "3";
+  minor = "4";
   patch = "0";
 }
 }:
 
 let
-  sourceSha256 = "sha256-jVfExv1CcnlOaaj/XtnfhWAHnQsshZJ1l/zXo0uovdo=";
+  sourceSha256 = "sha256-O+37CyF0IVPdUB1e68HsaXD0T2VsOLPXOpLNlRYEXUk=";
   featuresInfo = {
     # Needed always
     basic = {
@@ -79,6 +79,9 @@ let
       native = [ doxygen ];
       cmakeEnableFlag = "DOXYGEN";
     };
+    man-pages = {
+      cmakeEnableFlag = "MANPAGES";
+    };
     python-support = {
       pythonRuntime = [ python.pkgs.six ];
       native = [
@@ -269,11 +272,6 @@ stdenv.mkDerivation rec {
   patches = [
     # Not accepted upstream, see https://github.com/gnuradio/gnuradio/pull/5227
     ./modtool-newmod-permissions.patch
-    (fetchpatch {
-      # https://github.com/gnuradio/gnuradio/pull/5225
-      url = "https://github.com/gnuradio/gnuradio/commit/4cef46e3ea0faf04e05ca1a5846cd1568fa51bb2.patch";
-      sha256 = "sha256-6AlGbtD1S0c3I9JSoLTMP4YqwDU17i2j+XRkuR+QTuc=";
-    })
   ];
   passthru = shared.passthru // {
     # Deps that are potentially overriden and are used inside GR plugins - the same version must
diff --git a/pkgs/applications/science/astronomy/kstars/default.nix b/pkgs/applications/science/astronomy/kstars/default.nix
index c7e76b6ad923..b7b9fbeb14d3 100644
--- a/pkgs/applications/science/astronomy/kstars/default.nix
+++ b/pkgs/applications/science/astronomy/kstars/default.nix
@@ -14,11 +14,11 @@
 
 mkDerivation rec {
   pname = "kstars";
-  version = "3.5.5";
+  version = "3.5.6";
 
   src = fetchurl {
     url = "mirror://kde/stable/kstars/kstars-${version}.tar.xz";
-    sha256 = "sha256-cD31YFBnKvEPyBQils6qJxNKagDoIi8/Znfxj/Gsa0M=";
+    sha256 = "sha256-n+fGYLzQAGS8828hr7XE9qiTMyg99L+W7VRjd9aEkrQ=";
   };
 
   nativeBuildInputs = [ extra-cmake-modules kdoctools ];
diff --git a/pkgs/applications/science/logic/abc/default.nix b/pkgs/applications/science/logic/abc/default.nix
index cbcd452033ca..fe73f4f4d6e2 100644
--- a/pkgs/applications/science/logic/abc/default.nix
+++ b/pkgs/applications/science/logic/abc/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname   = "abc-verifier";
-  version = "2020.11.24";
+  version = "2021.11.12";
 
   src = fetchFromGitHub {
-    owner  = "yosyshq";
-    repo   = "abc";
-    rev    = "4f5f73d18b137930fb3048c0b385c82fa078db38";
-    sha256 = "0z1kp223kix7i4r7mbj2bzawkdzc55nsgc41m85dmbajl9fsj1m0";
+    owner = "yosyshq";
+    repo  = "abc";
+    rev   = "f6fa2ddcfc89099726d60386befba874c7ac1e0d";
+    hash  = "sha256-0rvMPZ+kL0m/GjlCLx3eXYQ0osQ2wQiS3+csqPl3U9s=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/science/logic/symbiyosys/default.nix b/pkgs/applications/science/logic/symbiyosys/default.nix
index 87bd1e2e6370..b9bf480f7e6d 100644
--- a/pkgs/applications/science/logic/symbiyosys/default.nix
+++ b/pkgs/applications/science/logic/symbiyosys/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation {
   pname = "symbiyosys";
-  version = "2021.09.13";
+  version = "2021.11.30";
 
   src = fetchFromGitHub {
-    owner  = "YosysHQ";
-    repo   = "SymbiYosys";
-    rev    = "15278f13467bea24a7300e23ebc5555b9261facf";
-    sha256 = "sha256-gp9F4MaGgD6XfD7AjuB/LmMVcxFurqWHEiXPeyzlQzk=";
+    owner = "YosysHQ";
+    repo  = "SymbiYosys";
+    rev   = "b409b1179e36d2a3fff66c85b7d4e271769a2d9e";
+    hash  = "sha256-S7of2upntiMkSdh4kf1RsrjriS31Eh8iEcVvG36isQg=";
   };
 
   buildInputs = [ ];
diff --git a/pkgs/development/compilers/nextpnr/default.nix b/pkgs/development/compilers/nextpnr/default.nix
index 07d301187a8e..ed64d9e6a66d 100644
--- a/pkgs/development/compilers/nextpnr/default.nix
+++ b/pkgs/development/compilers/nextpnr/default.nix
@@ -14,14 +14,14 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "nextpnr";
-  version = "2021.09.27";
+  version = "2021.11.24"; # tagged as 0.1, but we'll keep tracking HEAD
 
   srcs = [
     (fetchFromGitHub {
       owner  = "YosysHQ";
       repo   = "nextpnr";
-      rev    = "9d8d3bdbc48133ff7758c9c5293e5904bc6e5ba7";
-      sha256 = "sha256-5Axo8qX2+ATqQ170QqfhRwYfCRQLCKBW1kc89x9XljE=";
+      rev    = "fd2d4a8f999947ece42f791e19ddc4c2d8b823f2";
+      sha256 = "sha256-bGh3svJeVRJO0rTnSYoTndeQrTENx6j9t+GCGX4RX4k=";
       name   = "nextpnr";
     })
     (fetchFromGitHub {
diff --git a/pkgs/development/compilers/openjdk/darwin/default.nix b/pkgs/development/compilers/openjdk/darwin/16.nix
similarity index 100%
rename from pkgs/development/compilers/openjdk/darwin/default.nix
rename to pkgs/development/compilers/openjdk/darwin/16.nix
diff --git a/pkgs/development/compilers/openjdk/darwin/17.nix b/pkgs/development/compilers/openjdk/darwin/17.nix
new file mode 100644
index 000000000000..813702a2fbfd
--- /dev/null
+++ b/pkgs/development/compilers/openjdk/darwin/17.nix
@@ -0,0 +1,81 @@
+{ lib, stdenv, fetchurl, unzip, setJavaClassPath }:
+let
+  # Details from https://www.azul.com/downloads/?version=java-17-lts&os=macos&package=jdk
+  # Note that the latest build may differ by platform
+  dist = {
+    x86_64-darwin = {
+      arch = "x64";
+      zuluVersion = "17.30.15";
+      jdkVersion = "17.0.1";
+      sha256 = "sha256-CdZP5XY3O0MUQigRvIQC+7dwAXaCKw4eK/L/imytEOs=";
+    };
+
+    aarch64-darwin = {
+      arch = "aarch64";
+      zuluVersion = "17.30.19";
+      jdkVersion = "17.0.1";
+      sha256 = "sha256-zhBCXOnO/fsj6+q+vAlEz7QVMRFKLVvYnjwZzFz6mRM=";
+    };
+  }."${stdenv.hostPlatform.system}";
+
+  jce-policies = fetchurl {
+    # Ugh, unversioned URLs... I hope this doesn't change often enough to cause pain before we move to a Darwin source build of OpenJDK!
+    url = "http://cdn.azul.com/zcek/bin/ZuluJCEPolicies.zip";
+    sha256 = "0nk7m0lgcbsvldq2wbfni2pzq8h818523z912i7v8hdcij5s48c0";
+  };
+
+  jdk = stdenv.mkDerivation rec {
+    pname = "zulu${dist.zuluVersion}-ca-jdk";
+    version = dist.jdkVersion;
+
+    src = fetchurl {
+      url = "https://cdn.azul.com/zulu/bin/zulu${dist.zuluVersion}-ca-jdk${dist.jdkVersion}-macosx_${dist.arch}.tar.gz";
+      inherit (dist) sha256;
+      curlOpts = "-H Referer:https://www.azul.com/downloads/zulu/";
+    };
+
+    nativeBuildInputs = [ unzip ];
+
+    installPhase = ''
+      mkdir -p $out
+      mv * $out
+
+      unzip ${jce-policies}
+      mv -f ZuluJCEPolicies/*.jar $out/lib/security/
+
+      # jni.h expects jni_md.h to be in the header search path.
+      ln -s $out/include/darwin/*_md.h $out/include/
+
+      if [ -f $out/LICENSE ]; then
+        install -D $out/LICENSE $out/share/zulu/LICENSE
+        rm $out/LICENSE
+      fi
+    '';
+
+    preFixup = ''
+      # Propagate the setJavaClassPath setup hook from the JDK so that
+      # any package that depends on the JDK has $CLASSPATH set up
+      # properly.
+      mkdir -p $out/nix-support
+      printWords ${setJavaClassPath} > $out/nix-support/propagated-build-inputs
+
+      # Set JAVA_HOME automatically.
+      cat <<EOF >> $out/nix-support/setup-hook
+      if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
+      EOF
+    '';
+
+    # fixupPhase is moving the man to share/man which breaks it because it's a
+    # relative symlink.
+    postFixup = ''
+      ln -nsf ../zulu-${lib.versions.major version}.jdk/Contents/Home/man $out/share/man
+    '';
+
+    passthru = {
+      home = jdk;
+    };
+
+    meta = import ./meta.nix lib;
+  };
+in
+jdk
diff --git a/pkgs/development/compilers/yosys/default.nix b/pkgs/development/compilers/yosys/default.nix
index 56e0dc3b57d6..4101f06a3480 100644
--- a/pkgs/development/compilers/yosys/default.nix
+++ b/pkgs/development/compilers/yosys/default.nix
@@ -34,13 +34,13 @@
 
 stdenv.mkDerivation rec {
   pname   = "yosys";
-  version = "0.10+1";
+  version = "0.11+52";
 
   src = fetchFromGitHub {
-    owner  = "YosysHQ";
-    repo   = "yosys";
-    rev    = "7a7df9a3b4996b17bb774377483b15de49aa3d9b";
-    sha256 = "sha256-gi/Q6loIQ75NTbS9b/Q8sdrl9NGBDae2+AAGHVYB0WI=";
+    owner = "YosysHQ";
+    repo  = "yosys";
+    rev   = "2be110cb0ba645f95f62ee01b6a6fa46a85d5b26";
+    hash  = "sha256-A1QKu6SbtpJJPF8/LA5SMUP3/+n5giM6rOYdc6vkl90=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/coq-modules/equations/default.nix b/pkgs/development/coq-modules/equations/default.nix
index e6d5e11fcc5f..f563d1728744 100644
--- a/pkgs/development/coq-modules/equations/default.nix
+++ b/pkgs/development/coq-modules/equations/default.nix
@@ -7,7 +7,7 @@ with lib; mkCoqDerivation {
   inherit version;
   defaultVersion = switch coq.coq-version [
     { case = "8.14"; out = "1.3-8.14"; }
-    { case = "8.13"; out = "1.2.4+coq8.13"; }
+    { case = "8.13"; out = "1.3-8.13"; }
     { case = "8.12"; out = "1.2.4+coq8.12"; }
     { case = "8.11"; out = "1.2.4+coq8.11"; }
     { case = "8.10"; out = "1.2.1+coq8.10-2"; }
@@ -44,6 +44,8 @@ with lib; mkCoqDerivation {
     release."1.2.4+coq8.12".sha256    = "1n0w8is464qcq8mk2mv7amaf0khbjz5mpc9phf0rhpjm0lb22cb3";
     release."1.2.4+coq8.13".rev       = "v1.2.4-8.13";
     release."1.2.4+coq8.13".sha256    = "0i014lshsdflzw6h0qxra9d2f0q82vffxv2f29awbb9ad0p4rq4q";
+    release."1.3-8.13".rev            = "v1.3-8.13";
+    release."1.3-8.13".sha256         = "1jwjbkkkk4bwf6pz4zzz8fy5bb17aqyf4smkja59rgj9ya6nrdhg";
     release."1.3-8.14".rev            = "v1.3-8.14";
     release."1.3-8.14".sha256         = "19bj9nncd1r9g4273h5qx35gs3i4bw5z9bhjni24b413hyj55hkv";
 
diff --git a/pkgs/development/libraries/lzlib/default.nix b/pkgs/development/libraries/lzlib/default.nix
new file mode 100644
index 000000000000..098336dfbd12
--- /dev/null
+++ b/pkgs/development/libraries/lzlib/default.nix
@@ -0,0 +1,26 @@
+{ lib, stdenv, fetchurl, texinfo }:
+
+stdenv.mkDerivation rec {
+  pname = "lzlib";
+  version = "1.10";
+  outputs = [ "out" "info" ];
+
+  nativeBuildInputs = [ texinfo ];
+
+  src = fetchurl {
+    url = "mirror://savannah/lzip/${pname}/${pname}-${version}.tar.gz";
+    sha256 = "sha256-HWq3gApbQ+Vv0gYH/Sz9qeVQNQ3JX1vrakzhT4W0EEM=";
+  };
+
+  makeFlags = [ "AR:=$(AR)" "CC:=$(CC)" ];
+  doCheck = true;
+
+  meta = with lib; {
+    homepage = "https://www.nongnu.org/lzip/${pname}.html";
+    description =
+      "Data compression library providing in-memory LZMA compression and decompression functions, including integrity checking of the decompressed data";
+    license = licenses.bsd2;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ ehmry ];
+  };
+}
diff --git a/pkgs/development/python-modules/apycula/default.nix b/pkgs/development/python-modules/apycula/default.nix
index 0f86c103c27d..53851ded566d 100644
--- a/pkgs/development/python-modules/apycula/default.nix
+++ b/pkgs/development/python-modules/apycula/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "apycula";
-  version = "0.0.1a11";
+  version = "0.0.1a12";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit version;
     pname = "Apycula";
-    sha256 = "0fwk1pgphpgj0lazjy40ii08xq2qi6bvrfc30rwfj52yff1s9akn";
+    hash = "sha256-TFb1C1GaMAK+ckEeXDxSyO2Cgx5dmq62daoSnAiAFmI=";
   };
 
   nativeBuildInputs = [ setuptools-scm ];
diff --git a/pkgs/development/python-modules/bx-python/default.nix b/pkgs/development/python-modules/bx-python/default.nix
index b7e906c3b91b..db5d0166f552 100644
--- a/pkgs/development/python-modules/bx-python/default.nix
+++ b/pkgs/development/python-modules/bx-python/default.nix
@@ -1,16 +1,16 @@
-{ lib, fetchFromGitHub, buildPythonPackage, isPy27, numpy, cython, zlib, six
+{ lib, fetchFromGitHub, buildPythonPackage, pythonOlder, numpy, cython, zlib, six
 , python-lzo, nose }:
 
 buildPythonPackage rec {
   pname = "bx-python";
   version = "0.8.12";
-  disabled = isPy27;
+  disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "bxlab";
     repo = "bx-python";
     rev = "v${version}";
-    sha256 = "0mclahslz34vq9x424jmzsxk0nmpm1j716fa8h3zwr9ssvch7skc";
+    sha256 = "sha256-bOoD2dY6Zf4HRMqZcGSot1owu/5VEkF6wpuMTzVUlFU=";
   };
 
   nativeBuildInputs = [ cython ];
diff --git a/pkgs/development/python-modules/flux-led/default.nix b/pkgs/development/python-modules/flux-led/default.nix
index 1bfc96ff7217..58e271b10dc5 100644
--- a/pkgs/development/python-modules/flux-led/default.nix
+++ b/pkgs/development/python-modules/flux-led/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "flux-led";
-  version = "0.25.1";
+  version = "0.25.10";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "Danielhiversen";
     repo = "flux_led";
     rev = version;
-    sha256 = "sha256-+GgA7ma27dah8G/ITsy84jZHpktJHnGSMjzMfAvvuJg=";
+    sha256 = "sha256-WkLwiQNwueksPpuQ5aMBsenKyzUid1fbeOqEDAhfjkA=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pytenable/default.nix b/pkgs/development/python-modules/pytenable/default.nix
index e36e4f178b8c..af3c2c9b6514 100644
--- a/pkgs/development/python-modules/pytenable/default.nix
+++ b/pkgs/development/python-modules/pytenable/default.nix
@@ -19,13 +19,13 @@
 
 buildPythonPackage rec {
   pname = "pytenable";
-  version = "1.4.0";
+  version = "1.4.2";
 
   src = fetchFromGitHub {
     owner = "tenable";
     repo = "pyTenable";
     rev = version;
-    sha256 = "sha256-JdI0nAX/leTnYgGId2ct04u1a+z7eU2UY6pk2cUM4fg=";
+    sha256 = "sha256-qljoJ+nYFVS5VHr/M4mITtO9Czuyb4HLzVjhprhyJIs=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/qcs-api-client/default.nix b/pkgs/development/python-modules/qcs-api-client/default.nix
index 50d88458a4d6..0bdde93a159d 100644
--- a/pkgs/development/python-modules/qcs-api-client/default.nix
+++ b/pkgs/development/python-modules/qcs-api-client/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "qcs-api-client";
-  version = "0.20.3";
+  version = "0.20.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-3PzjCdH0Mxw1GvtqvEMyAaYt96QX0zoXwK3azF2ey+U=";
+    sha256 = "sha256-bw/NvB4YkdAfm8YyWlLPC4Z0GH9Ez9M9yIjgubiyskw=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/sendgrid/default.nix b/pkgs/development/python-modules/sendgrid/default.nix
index bb84ba6b21c7..99367f97b8dd 100644
--- a/pkgs/development/python-modules/sendgrid/default.nix
+++ b/pkgs/development/python-modules/sendgrid/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "sendgrid";
-  version = "6.9.1";
+  version = "6.9.2";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = "sendgrid-python";
     rev = version;
-    sha256 = "sha256-u7qakmJ9pKV1zonILEvMHxzMF6EaY+ZJUfh5s3TTH5w=";
+    sha256 = "sha256-eqmYuVW912E8hiVReLAoclmNDc2+gOIcUo9lRUx9AwM=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/sqlmap/default.nix b/pkgs/development/python-modules/sqlmap/default.nix
index 66fa42e74013..429ebc9e0d61 100644
--- a/pkgs/development/python-modules/sqlmap/default.nix
+++ b/pkgs/development/python-modules/sqlmap/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "sqlmap";
-  version = "1.5.11";
+  version = "1.5.12";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "196021f0eff1699853675ee80e13bc856c9f1a088d93a0ac023651d2a3f62cf5";
+    sha256 = "sha256-9FplToUd4CIkYZ88+Lat+joniZzRZDOfifH5z4sH8RM=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/tools/analysis/checkov/default.nix b/pkgs/development/tools/analysis/checkov/default.nix
index aabbcd07a535..7927a797656b 100644
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@@ -46,13 +46,13 @@ with py.pkgs;
 
 buildPythonApplication rec {
   pname = "checkov";
-  version = "2.0.614";
+  version = "2.0.625";
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = pname;
     rev = version;
-    sha256 = "sha256-z1d1Zcq4x2wU/j4yWpaRwJXsUqy95Ai2uM18EHqxze0=";
+    sha256 = "sha256-Q2GaLHciqgsvnYAFdq6839OHcpxWM2m/H10CPmBj2vg=";
   };
 
   nativeBuildInputs = with py.pkgs; [
diff --git a/pkgs/development/tools/build-managers/bloop/default.nix b/pkgs/development/tools/build-managers/bloop/default.nix
index 8710d390dea0..ebb4bb5f36c3 100644
--- a/pkgs/development/tools/build-managers/bloop/default.nix
+++ b/pkgs/development/tools/build-managers/bloop/default.nix
@@ -3,6 +3,7 @@
 , coursier
 , autoPatchelfHook
 , installShellFiles
+, makeWrapper
 , jre
 , lib
 , zlib
@@ -10,76 +11,83 @@
 
 stdenv.mkDerivation rec {
   pname = "bloop";
-  version = "1.4.9";
+  version = "1.4.11";
 
   bloop-coursier-channel = fetchurl {
     url = "https://github.com/scalacenter/bloop/releases/download/v${version}/bloop-coursier.json";
-    sha256 = "0yh9k98c0cq9ksi3g6rb1q1qblnhcznrc5z1y9ps8cvwv2lx8ly4";
+    sha256 = "CoF/1nggjaL17SWmWDcKicfgoyqpOSZUse8f+3TgD0E=";
   };
 
   bloop-bash = fetchurl {
     url = "https://github.com/scalacenter/bloop/releases/download/v${version}/bash-completions";
-    sha256 = "1ldxlqv353gvhdn4yq7z506ywvnjv6fjsi8wigwhzg89876pwsys";
+    sha256 = "2mt+zUEJvQ/5ixxFLZ3Z0m7uDSj/YE9sg/uNMjamvdE=";
   };
 
   bloop-fish = fetchurl {
     url = "https://github.com/scalacenter/bloop/releases/download/v${version}/fish-completions";
-    sha256 = "1pa8h81l2498q8dbd83fzipr99myjwxpy8xdgzhvqzdmfv6aa4m0";
+    sha256 = "oBKlzHa1fbzhf60jfzuXvqaUb/xuoLYawigRQQOCSN0=";
   };
 
   bloop-zsh = fetchurl {
     url = "https://github.com/scalacenter/bloop/releases/download/v${version}/zsh-completions";
-    sha256 = "1xzg0qfkjdmzm3mvg82mc4iia8cl7b6vbl8ng4ir2xsz00zjrlsq";
+    sha256 = "WNMsPwBfd5EjeRbRtc06lCEVI2FVoLfrqL82OR0G7/c=";
   };
 
   bloop-coursier = stdenv.mkDerivation rec {
     name = "${pname}-coursier-${version}";
 
     platform = if stdenv.isLinux && stdenv.isx86_64 then "x86_64-pc-linux"
-               else if stdenv.isDarwin && stdenv.isx86_64 then "x86_64-apple-darwin"
-               else throw "unsupported platform";
+    else if stdenv.isDarwin && stdenv.isx86_64 then "x86_64-apple-darwin"
+    else throw "unsupported platform";
 
-    phases = [ "installPhase" ];
+    dontUnpack = true;
     installPhase = ''
+      runHook preInstall
+
       export COURSIER_CACHE=$(pwd)
       export COURSIER_JVM_CACHE=$(pwd)
 
       mkdir channel
       ln -s ${bloop-coursier-channel} channel/bloop.json
-      ${coursier}/bin/cs install --install-dir $out --install-platform ${platform} --default-channels=false --channel channel --only-prebuilt=true bloop
+      ${coursier}/bin/cs install --install-dir . --install-platform ${platform} --default-channels=false --channel channel --only-prebuilt=true bloop
 
-      # Remove binary part of the coursier launcher script to make derivation output hash stable
-      sed -i '5,$ d' $out/bloop
-   '';
+      # Only keeping the binary, we'll wrap it ourselves
+      # This guarantees the output of this fixed-output derivation doesn't have references to itself
+      install -D -m 0755 .bloop.aux $out
+
+      runHook postInstall
+    '';
 
     outputHashMode = "recursive";
     outputHashAlgo = "sha256";
-    outputHash = if stdenv.isLinux && stdenv.isx86_64 then "1hxyzf430g95l6qz1qlq8wvizvy6j3a7a9crb3lcxd67cpbg3x7i"
-      else if stdenv.isDarwin && stdenv.isx86_64 then "0x5yqf3i8y6s5h27yr0jkpvj6ch25ckx2802dmaxlgq6gz0fx6w2"
-      else throw "unsupported platform";
+    outputHash = if stdenv.isLinux && stdenv.isx86_64 then "0c02n779z4l7blzla5820bzfhblbp5nlizx9f8wns4miwnph357f"
+    else if stdenv.isDarwin && stdenv.isx86_64 then "1gy5k9ii86rxyv2v9if4n1clvmb1hi4ym32mp6miwgcjla10sv30"
+    else throw "unsupported platform";
   };
 
   dontUnpack = true;
-  nativeBuildInputs = [ autoPatchelfHook installShellFiles ];
+  nativeBuildInputs = [ autoPatchelfHook installShellFiles makeWrapper ];
   buildInputs = [ stdenv.cc.cc.lib zlib ];
   propagatedBuildInputs = [ jre ];
 
   installPhase = ''
+    runHook preInstall
+
     export COURSIER_CACHE=$(pwd)
     export COURSIER_JVM_CACHE=$(pwd)
 
-    mkdir -p $out/bin
-    cp ${bloop-coursier}/bloop $out/bloop
-    cp ${bloop-coursier}/.bloop.aux $out/.bloop.aux
-    ln -s $out/bloop $out/bin/bloop
+    install -D -m 0755 ${bloop-coursier} $out/.bloop-wrapped
 
-    # patch the bloop launcher so that it works when symlinked
-    sed "s|\$(dirname \"\$0\")|$out|" -i $out/bloop
+    makeWrapper $out/.bloop-wrapped $out/bin/bloop \
+      --set CS_NATIVE_LAUNCHER true \
+      --set IS_CS_INSTALLED_LAUNCHER true
 
     #Install completions
     installShellCompletion --name bloop --bash ${bloop-bash}
     installShellCompletion --name _bloop --zsh ${bloop-zsh}
     installShellCompletion --name bloop.fish --fish ${bloop-fish}
+
+    runHook postInstall
   '';
 
   meta = with lib; {
@@ -87,6 +95,6 @@ stdenv.mkDerivation rec {
     license = licenses.asl20;
     description = "A Scala build server and command-line tool to make the compile and test developer workflows fast and productive in a build-tool-agnostic way";
     platforms = [ "x86_64-linux" "x86_64-darwin" ];
-    maintainers = with maintainers; [ tomahna ];
+    maintainers = with maintainers; [ kubukoz tomahna ];
   };
 }
diff --git a/pkgs/development/tools/build-managers/scala-cli/default.nix b/pkgs/development/tools/build-managers/scala-cli/default.nix
index 7d7e084a79ff..33f9811ab836 100644
--- a/pkgs/development/tools/build-managers/scala-cli/default.nix
+++ b/pkgs/development/tools/build-managers/scala-cli/default.nix
@@ -1,15 +1,15 @@
 { stdenv, coreutils, lib, installShellFiles, zlib, autoPatchelfHook, fetchurl }:
 
 let
-  version = "0.0.8";
+  version = "0.0.9";
   assets = {
     x86_64-darwin = {
       asset = "scala-cli-x86_64-apple-darwin.gz";
-      sha256 = "14bf1zwvfq86vh00qlf8jf4sb82p9jakrmwqhnv9p0x13lq56xm5";
+      sha256 = "sha256-1KwJuapqGhMEIMwrJp2LKlpYFtl+OP9DyaMtge9ZedI=";
     };
     x86_64-linux = {
       asset = "scala-cli-x86_64-pc-linux.gz";
-      sha256 = "01dhcj6q9c87aqpz8vy1kwaa1qqq9bh43rkx2sabhnfrzj4vypjr";
+      sha256 = "sha256-IDXO+MgFlnT7VPugcQr/IGLZeD/vWFqJ0D0zVIbTtk4=";
     };
   };
 in
@@ -22,10 +22,10 @@ stdenv.mkDerivation {
     let
       asset = assets."${stdenv.hostPlatform.system}" or (throw "Unsupported platform ${stdenv.hostPlatform.system}");
     in
-      fetchurl {
-        url = "https://github.com/Virtuslab/scala-cli/releases/download/v${version}/${asset.asset}";
-        sha256 = asset.sha256;
-      };
+    fetchurl {
+      url = "https://github.com/Virtuslab/scala-cli/releases/download/v${version}/${asset.asset}";
+      sha256 = asset.sha256;
+    };
 
   unpackPhase = ''
     runHook preUnpack
diff --git a/pkgs/development/tools/earthly/default.nix b/pkgs/development/tools/earthly/default.nix
index 1cd5d9caf282..c6cc57e14c5c 100644
--- a/pkgs/development/tools/earthly/default.nix
+++ b/pkgs/development/tools/earthly/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "earthly";
-  version = "0.5.24";
+  version = "0.6.2";
 
   src = fetchFromGitHub {
     owner = "earthly";
     repo = "earthly";
     rev = "v${version}";
-    sha256 = "sha256-d4TCuFj7nbQDxTLCStrGj698iUYTH0mCqoCZeeOGNIE=";
+    sha256 = "sha256-a2NNpQvbhMY66nbk4RAXFb/o1qR5OXPm93ujzS2cxp4=";
   };
 
-  vendorSha256 = "sha256-3o+jizVVHcPZ6nNT2nCF8fLDynnFccI2Y50kbXp2qAI=";
+  vendorSha256 = "sha256-0wyefhY/KR79K9DDI4/8EaA/DFI1rf6wxsBIAZo+rUI=";
 
   ldflags = [
     "-s" "-w"
diff --git a/pkgs/development/tools/shellcheck/default.nix b/pkgs/development/tools/shellcheck/default.nix
index 13cfc93cfc67..e85b596607b1 100644
--- a/pkgs/development/tools/shellcheck/default.nix
+++ b/pkgs/development/tools/shellcheck/default.nix
@@ -21,9 +21,7 @@ let
     pname = "shellcheck";
     version = bin.version;
 
-    inherit (ShellCheck) src;
-
-    meta = builtins.removeAttrs ShellCheck.meta [ "hydraPlatforms" ];
+    inherit (ShellCheck) meta src;
 
     nativeBuildInputs = [ pandoc ];
 
diff --git a/pkgs/os-specific/linux/kernel/linux-zen.nix b/pkgs/os-specific/linux/kernel/linux-zen.nix
index a822f5d10805..8ff8b30809b7 100644
--- a/pkgs/os-specific/linux/kernel/linux-zen.nix
+++ b/pkgs/os-specific/linux/kernel/linux-zen.nix
@@ -2,7 +2,7 @@
 
 let
   # having the full version string here makes it easier to update
-  modDirVersion = "5.15.3-zen1";
+  modDirVersion = "5.15.5-zen1";
   parts = lib.splitString "-" modDirVersion;
   version = lib.elemAt parts 0;
   suffix = lib.elemAt parts 1;
@@ -19,7 +19,7 @@ buildLinux (args // {
     owner = "zen-kernel";
     repo = "zen-kernel";
     rev = "v${modDirVersion}";
-    sha256 = "sha256-GleOhTKLhnhepAlR+TkiCYcgEe5KfVvDKTPWP7/D8wQ=";
+    sha256 = "sha256-sEt6h29GY18+45jHheRd69eCw+EAzn/CVUK5XRqdZcA=";
   };
 
   structuredExtraConfig = with lib.kernel; {
diff --git a/pkgs/servers/dns/knot-resolver/default.nix b/pkgs/servers/dns/knot-resolver/default.nix
index 420b09234547..26f35145b67c 100644
--- a/pkgs/servers/dns/knot-resolver/default.nix
+++ b/pkgs/servers/dns/knot-resolver/default.nix
@@ -17,11 +17,11 @@ lua = luajitPackages;
 
 unwrapped = stdenv.mkDerivation rec {
   pname = "knot-resolver";
-  version = "5.4.2";
+  version = "5.4.3";
 
   src = fetchurl {
     url = "https://secure.nic.cz/files/knot-resolver/${pname}-${version}.tar.xz";
-    sha256 = "ea6a219571a752056669bae3f2c0c3ed0bec58af5ab832d505a3ec9c4063a58b";
+    sha256 = "488729eb93190336b6bca10de0d78ecb7919f77fcab105debc0a644aa7d0a506";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/servers/nfd/default.nix b/pkgs/servers/nfd/default.nix
new file mode 100644
index 000000000000..5be17fc7b49e
--- /dev/null
+++ b/pkgs/servers/nfd/default.nix
@@ -0,0 +1,55 @@
+{ lib
+, stdenv
+, boost
+, fetchFromGitHub
+, libpcap
+, ndn-cxx
+, openssl
+, pkg-config
+, sphinx
+, systemd
+, wafHook
+, websocketpp
+, withSystemd ? stdenv.isLinux
+, withWebSocket ? true
+}:
+
+stdenv.mkDerivation rec {
+  pname = "nfd";
+  version = "0.7.1";
+
+  src = fetchFromGitHub {
+    owner = "named-data";
+    repo = lib.toUpper pname;
+    rev = "NFD-${version}";
+    sha256 = "1l9bchj8c68r6qw4vr1kc96jgxl0vpqa2vjkvy1xmhz92sivr6gi";
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = [ pkg-config sphinx wafHook ];
+  buildInputs = [ libpcap ndn-cxx openssl websocketpp ] ++ lib.optional withSystemd systemd;
+
+  wafConfigureFlags = [
+    "--boost-includes=${boost.dev}/include"
+    "--boost-libs=${boost.out}/lib"
+    "--with-tests"
+  ] ++ lib.optional (!withWebSocket) "--without-websocket";
+
+  doCheck = true;
+  checkPhase = ''
+    runHook preCheck
+    build/unit-tests-core
+    # build/unit-tests-daemon # 3 tests fail
+    build/unit-tests-rib
+    build/unit-tests-tools
+    runHook postCheck
+  '';
+
+  meta = with lib; {
+    homepage = "https://named-data.net/";
+    description = "Named Data Neworking (NDN) Forwarding Daemon";
+    license = licenses.gpl3Plus;
+    platforms = platforms.unix;
+    maintainers = [ maintainers.bertof ];
+  };
+}
diff --git a/pkgs/tools/archivers/tarlz/default.nix b/pkgs/tools/archivers/tarlz/default.nix
new file mode 100644
index 000000000000..d5b53c5eaaaa
--- /dev/null
+++ b/pkgs/tools/archivers/tarlz/default.nix
@@ -0,0 +1,28 @@
+{ lib, stdenv, fetchurl, lzip, lzlib, texinfo }:
+
+stdenv.mkDerivation rec {
+  pname = "tarlz";
+  version = "0.11";
+  outputs = [ "out" "man" "info" ];
+
+  nativeBuildInputs = [ lzip texinfo ];
+  buildInputs = [ lzlib ];
+
+  src = fetchurl {
+    url = "mirror://savannah/lzip/${pname}/${pname}-${version}.tar.lz";
+    sha256 = "sha256-PalRMerepfYDSaDs4irck+1v5Gy/vlB9CyU6omWUXlk=";
+  };
+
+  enableParallelBuilding = true;
+  makeFlags = [ "CXX:=$(CXX)" ];
+  doCheck = true;
+
+  meta = with lib; {
+    homepage = "https://www.nongnu.org/lzip/${pname}.html";
+    description =
+      "Massively parallel combined implementation of the tar archiver and the lzip compressor";
+    license = licenses.gpl2Plus;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ ehmry ];
+  };
+}
diff --git a/pkgs/tools/graphics/goverlay/default.nix b/pkgs/tools/graphics/goverlay/default.nix
index b8cd6df4751f..11fe1a20a195 100644
--- a/pkgs/tools/graphics/goverlay/default.nix
+++ b/pkgs/tools/graphics/goverlay/default.nix
@@ -20,6 +20,7 @@
 , util-linux
 , vulkan-tools
 , which
+, nix-update-script
 }:
 
 let
@@ -36,13 +37,13 @@ let
   '';
 in stdenv.mkDerivation rec {
   pname = "goverlay";
-  version = "0.6.4";
+  version = "0.7";
 
   src = fetchFromGitHub {
     owner = "benjamimgois";
     repo = pname;
     rev = version;
-    sha256 = "sha256-xuv7u2lLQAB0Zmu7UHGXP/sJwcb8vHDf9hFL+pF+818=";
+    sha256 = "sha256-LdpgEfCNbf0/sY8v8D3KiapYEd23tVy4nQ7RuGwl7jM=";
   };
 
   outputs = [ "out" "man" ];
@@ -102,6 +103,10 @@ in stdenv.mkDerivation rec {
     "--set QT_QPA_PLATFORM xcb"
   ];
 
+  passthru.updateScript = nix-update-script {
+    attrPath = pname;
+  };
+
   meta = with lib; {
     description = "An opensource project that aims to create a Graphical UI to help manage Linux overlays";
     homepage = "https://github.com/benjamimgois/goverlay";
diff --git a/pkgs/tools/graphics/goverlay/find-xdg-data-files.patch b/pkgs/tools/graphics/goverlay/find-xdg-data-files.patch
index 96970cd769a1..86f31a68dc70 100644
--- a/pkgs/tools/graphics/goverlay/find-xdg-data-files.patch
+++ b/pkgs/tools/graphics/goverlay/find-xdg-data-files.patch
@@ -1,8 +1,8 @@
 diff --git a/overlayunit.pas b/overlayunit.pas
-index 8c2276d..a62e60a 100644
+index 537491b..744f604 100644
 --- a/overlayunit.pas
 +++ b/overlayunit.pas
-@@ -4913,7 +4913,7 @@ begin
+@@ -5011,7 +5011,7 @@ begin
     //Determine Mangohud dependency status
  
            //locate MangoHud and store result in tmp folder
@@ -11,7 +11,7 @@ index 8c2276d..a62e60a 100644
  
            // Assign Text file dependency_mangohud to variable mangohudVAR
            AssignFile(mangohudVAR, '/tmp/goverlay/dependency_mangohud');
-@@ -4922,7 +4922,7 @@ begin
+@@ -5020,7 +5020,7 @@ begin
            CloseFile(mangohudVAR);
  
            // Read String and store value on mangohuddependencyVALUE based on result
@@ -20,7 +20,7 @@ index 8c2276d..a62e60a 100644
            mangohuddependencyVALUE := 1
            else
            mangohuddependencyVALUE := 0;
-@@ -4931,7 +4931,7 @@ begin
+@@ -5029,7 +5029,7 @@ begin
     //Determine vkBasalt dependency staus
  
             //locate vkBasalt and store result in tmp folder
@@ -29,7 +29,7 @@ index 8c2276d..a62e60a 100644
  
             // Assign Text file dependency_mangohud to variable mangohudVAR
             AssignFile(vkbasaltVAR, '/tmp/goverlay/dependency_vkbasalt');
-@@ -4940,7 +4940,7 @@ begin
+@@ -5038,7 +5038,7 @@ begin
             CloseFile(vkbasaltVAR);
  
             // Read String and store value on vkbasaltdependencyVALUE based on result
diff --git a/pkgs/tools/inputmethods/m17n-lib/default.nix b/pkgs/tools/inputmethods/m17n-lib/default.nix
index 2ca60bca3e74..cc290ab0eca9 100644
--- a/pkgs/tools/inputmethods/m17n-lib/default.nix
+++ b/pkgs/tools/inputmethods/m17n-lib/default.nix
@@ -11,9 +11,11 @@ stdenv.mkDerivation rec {
   strictDeps = true;
 
   # reconf needed to sucesfully cross-compile
-  nativeBuildInputs = [ autoreconfHook pkg-config ];
-
-  buildInputs = [ m17n_db ];
+  nativeBuildInputs = [
+    autoreconfHook pkg-config
+    # requires m17n-db tool at build time
+    m17n_db
+  ];
 
   # Fails parallel build due to missing intra-package depends:
   #   https://savannah.nongnu.org/bugs/index.php?61377
diff --git a/pkgs/tools/nix/nix-output-monitor/default.nix b/pkgs/tools/nix/nix-output-monitor/default.nix
index a94ae45ccea5..a0700e43c5b2 100644
--- a/pkgs/tools/nix/nix-output-monitor/default.nix
+++ b/pkgs/tools/nix/nix-output-monitor/default.nix
@@ -5,11 +5,11 @@
 }:
 mkDerivation rec {
   pname = "nix-output-monitor";
-  version = "1.0.3.3";
+  version = "1.0.4.0";
   src = fetchFromGitHub {
     owner = "maralorn";
     repo = "nix-output-monitor";
-    sha256 = "1x26s9gzcygn96600g0r1a1sxqav6c38iq981rhmc808mqlyxmp8";
+    hash = "sha256-3EQgjrDX8C3qG6danuPRl2gnPlX1qZjxjrROrKitsS0=";
     rev = "v${version}";
   };
   isLibrary = true;
diff --git a/pkgs/tools/security/jadx/default.nix b/pkgs/tools/security/jadx/default.nix
index 02533f7f6f5f..9749f93282ef 100644
--- a/pkgs/tools/security/jadx/default.nix
+++ b/pkgs/tools/security/jadx/default.nix
@@ -2,13 +2,13 @@
 
 let
   pname = "jadx";
-  version = "1.2.0";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "skylot";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1w1wc81mkjcsgjbrihbsphxkcmwnfnf555pmlsd2vs2a04nki01y";
+    hash = "sha256-dEtmn6d7B+0p3SOmnpJigBCDjfnyY1qazXdmwtvoWwE=";
   };
 
   deps = stdenv.mkDerivation {
@@ -21,6 +21,14 @@ let
       export GRADLE_USER_HOME=$(mktemp -d)
       export JADX_VERSION=${version}
       gradle --no-daemon jar
+
+      # Apparently, Gradle won't cache the `compileOnlyApi` dependency
+      # `org.jetbrains:annotations:22.0.0` which is defined in
+      # `io.github.skylot:raung-common`. To make it available in the
+      # output, we patch `build.gradle` and run Gradle again.
+      substituteInPlace build.gradle \
+        --replace 'org.jetbrains:annotations:23.0.0' 'org.jetbrains:annotations:22.0.0'
+      gradle --no-daemon jar
     '';
 
     # Mavenize dependency paths
@@ -31,9 +39,8 @@ let
         | sh
     '';
 
-    outputHashAlgo = "sha256";
     outputHashMode = "recursive";
-    outputHash = "05fsycpd90dbak2vgdpd9cz08liq5j78ag9ry9y1s62ld776g0hz";
+    outputHash = "sha256-t2kfih5JbIZvJMSHcCsTteDJ9MWJK/wUiqmHU5odMdY=";
   };
 in stdenv.mkDerivation {
   inherit pname version src;
diff --git a/pkgs/tools/security/kubescape/default.nix b/pkgs/tools/security/kubescape/default.nix
index e68980cc9659..9534480b7dde 100644
--- a/pkgs/tools/security/kubescape/default.nix
+++ b/pkgs/tools/security/kubescape/default.nix
@@ -6,20 +6,20 @@
 
 buildGoModule rec {
   pname = "kubescape";
-  version = "1.0.131";
+  version = "1.0.132";
 
   src = fetchFromGitHub {
     owner = "armosec";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-DcReo4pTdI8ssWH1IqD8gDUm4jQ0jBBJ+ltxSpdkxQE=";
+    sha256 = "sha256-hx11RCLEUW/2MKNIXz51wOyKC7zv0M3Wvblam/E3rdQ=";
   };
 
   nativeBuildInputs = [
     installShellFiles
   ];
 
-  vendorSha256 = "sha256-SxJnYJyKFed1c+zgeeXQQhsKHlaDevJGMwqA5gPef3s=";
+  vendorSha256 = "sha256-GrQmWHdCk8Yl/ryS2zLQU8XCkjfS20qjlEScU8AQT0o=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 3844f0f8731c..7bb75e401a61 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -9916,6 +9916,8 @@ with pkgs;
 
   target-isns = callPackage ../os-specific/linux/target-isns { };
 
+  tarlz = callPackage ../tools/archivers/tarlz { };
+
   tarsnap = callPackage ../tools/backup/tarsnap { };
 
   tarsnapper = callPackage ../tools/backup/tarsnapper { };
@@ -12251,116 +12253,31 @@ with pkgs;
 
   hugs = callPackage ../development/interpreters/hugs { };
 
-  openjfx11 = callPackage ../development/compilers/openjdk/openjfx/11.nix { };
-
-  openjfx15 = callPackage ../development/compilers/openjdk/openjfx/15.nix { };
-
-  openjdk8-bootstrap =
-    if adoptopenjdk-hotspot-bin-8.meta.available then
-      adoptopenjdk-hotspot-bin-8
-    else
-      callPackage ../development/compilers/openjdk/bootstrap.nix { version = "8"; };
-
-  /* legacy jdk for use as needed by older apps */
-  openjdk8 =
-    if stdenv.isDarwin then
-      callPackage ../development/compilers/openjdk/darwin/8.nix { }
-    else
-      callPackage ../development/compilers/openjdk/8.nix {
-        inherit (gnome2) GConf gnome_vfs;
-      };
-
-  openjdk8_headless =
-    if stdenv.isDarwin || stdenv.isAarch64 then
-      openjdk8
-    else
-      openjdk8.override { headless = true; };
+  inherit (javaPackages) openjfx11 openjfx15;
+  openjfx = openjfx15;
 
+  openjdk8-bootstrap = javaPackages.compiler.openjdk8-bootstrap;
+  openjdk8 = javaPackages.compiler.openjdk8;
+  openjdk8_headless = javaPackages.compiler.openjdk8.headless;
   jdk8 = openjdk8;
   jdk8_headless = openjdk8_headless;
   jre8 = openjdk8.jre;
   jre8_headless = openjdk8_headless.jre;
 
-  openjdk11-bootstrap =
-    if adoptopenjdk-hotspot-bin-11.meta.available then
-      adoptopenjdk-hotspot-bin-11
-    else
-      callPackage ../development/compilers/openjdk/bootstrap.nix { version = "10"; };
-
-  openjdk11 =
-    if stdenv.isDarwin then
-      callPackage ../development/compilers/openjdk/darwin/11.nix { }
-    else
-      callPackage ../development/compilers/openjdk/11.nix {
-        openjfx = openjfx11;
-        inherit (gnome2) GConf gnome_vfs;
-      };
-
-  openjdk11_headless =
-    if stdenv.isDarwin then
-      openjdk11
-    else
-      openjdk11.override { headless = true; };
-
-  openjdk17-bootstrap =
-    if adoptopenjdk-hotspot-bin-16.meta.available then
-      adoptopenjdk-hotspot-bin-16
-    else
-      /* adoptopenjdk not available for i686, so fall back to our old builds for bootstrapping */
-      callPackage ../development/compilers/openjdk/16.nix {
-        openjfx = openjfx11; /* need this despite next line :-( */
-        enableJavaFX = false;
-        headless = true;
-        inherit (gnome2) GConf gnome_vfs;
-        openjdk16-bootstrap = callPackage ../development/compilers/openjdk/15.nix {
-          openjfx = openjfx11; /* need this despite next line :-( */
-          enableJavaFX = false;
-          headless = true;
-          inherit (gnome2) GConf gnome_vfs;
-          openjdk15-bootstrap = callPackage ../development/compilers/openjdk/14.nix {
-            openjfx = openjfx11; /* need this despite next line :-( */
-            enableJavaFX = false;
-            headless = true;
-            inherit (gnome2) GConf gnome_vfs;
-            openjdk14-bootstrap = callPackage ../development/compilers/openjdk/13.nix {
-              openjfx = openjfx11; /* need this despite next line :-( */
-              enableJavaFX = false;
-              headless = true;
-              inherit (gnome2) GConf gnome_vfs;
-              openjdk13-bootstrap = callPackage ../development/compilers/openjdk/12.nix {
-                stdenv = gcc8Stdenv; /* build segfaults with gcc9 or newer, so use gcc8 like Debian does */
-                openjfx = openjfx11; /* need this despite next line :-( */
-                enableJavaFX = false;
-                headless = true;
-                inherit (gnome2) GConf gnome_vfs;
-              };
-            };
-          };
-        };
-      };
-
+  openjdk11-bootstrap = javaPackages.compiler.openjdk11-bootstrap;
+  openjdk11 = javaPackages.compiler.openjdk11;
+  openjdk11_headless = javaPackages.compiler.openjdk11.headless;
   jdk11 = openjdk11;
   jdk11_headless = openjdk11_headless;
 
-  /* Latest JDK */
-  openjdk17 =
-    if stdenv.isDarwin then
-      callPackage ../development/compilers/openjdk/darwin { }
-    else
-      callPackage ../development/compilers/openjdk/17.nix {
-        openjfx = openjfx15;
-        inherit (gnome2) GConf gnome_vfs;
-      };
-
-  openjdk17_headless =
-    if stdenv.isDarwin then
-      openjdk17
-    else
-      openjdk17.override { headless = true; };
-
+  openjdk17-bootstrap = javaPackages.compiler.openjdk17-bootstrap;
+  openjdk17 = javaPackages.compiler.openjdk17;
+  openjdk17_headless = javaPackages.compiler.openjdk17.headless;
   jdk17 = openjdk17;
   jdk17_headless = openjdk17_headless;
 
+  openjdk16-bootstrap = javaPackages.compiler.openjdk16-bootstrap;
+
   /* default JDK */
   jdk = jdk17;
 
@@ -15878,6 +15795,8 @@ with pkgs;
 
   ndn-tools = callPackage ../tools/networking/ndn-tools { };
 
+  nfd = callPackage ../servers/nfd { };
+
   cddlib = callPackage ../development/libraries/cddlib {};
 
   cdk = callPackage ../development/libraries/cdk {};
@@ -18630,6 +18549,8 @@ with pkgs;
 
   lyra = callPackage ../development/libraries/lyra { };
 
+  lzlib = callPackage ../development/libraries/lzlib { };
+
   lzo = callPackage ../development/libraries/lzo { };
 
   opencl-clang = callPackage ../development/libraries/opencl-clang { };
diff --git a/pkgs/top-level/java-packages.nix b/pkgs/top-level/java-packages.nix
index 7f1bb6e89a7c..cf6474f0da5b 100644
--- a/pkgs/top-level/java-packages.nix
+++ b/pkgs/top-level/java-packages.nix
@@ -5,8 +5,174 @@ with pkgs;
 let
   mavenbuild = callPackage ../development/java-modules/build-maven-package.nix { };
   fetchMaven = callPackage ../development/java-modules/m2install.nix { };
+
+  openjfx11 = callPackage ../development/compilers/openjdk/openjfx/11.nix { };
+  openjfx15 = callPackage ../development/compilers/openjdk/openjfx/15.nix { };
+
 in {
-  inherit mavenbuild fetchMaven;
+  inherit mavenbuild fetchMaven openjfx11 openjfx15;
+
+  compiler = let
+
+    gnomeArgs = {
+      inherit (gnome2) GConf gnome_vfs;
+    };
+
+    bootstrapArgs = gnomeArgs // {
+      openjfx = openjfx11; /* need this despite next line :-( */
+      enableJavaFX = false;
+      headless = true;
+    };
+
+    mkAdoptopenjdk = path-linux: path-darwin: let
+      package-linux  = import path-linux { inherit lib; };
+      package-darwin = import path-darwin { inherit lib; };
+      package = if stdenv.isLinux
+        then package-linux
+        else package-darwin;
+    in rec {
+      inherit package-linux package-darwin;
+
+      jdk-hotspot = callPackage package.jdk-hotspot {};
+      jre-hotspot = callPackage package.jre-hotspot {};
+      jdk-openj9  = callPackage package.jdk-openj9  {};
+      jre-openj9  = callPackage package.jre-openj9  {};
+    };
+
+    mkBootstrap = adoptopenjdk: path: args:
+      /* adoptopenjdk not available for i686, so fall back to our old builds for bootstrapping */
+      if   adoptopenjdk.jdk-hotspot.meta.available
+      then adoptopenjdk.jdk-hotspot
+      else callPackage path args;
+
+    mkOpenjdk = path-linux: path-darwin: args:
+      if stdenv.isLinux
+      then mkOpenjdkLinuxOnly path-linux args
+      else let
+        openjdk = callPackage path-darwin {};
+      in openjdk // { headless = openjdk; };
+
+    mkOpenjdkLinuxOnly = path-linux: args: let
+      openjdk = callPackage path-linux  (gnomeArgs // args);
+    in openjdk // {
+      headless = openjdk.override { headless = true; };
+    };
+
+    openjdkDarwinMissing = version:
+      abort "OpenJDK ${builtins.toString version} is currently not supported on Darwin by nixpkgs.";
+
+  in rec {
+
+    adoptopenjdk-8 = mkAdoptopenjdk
+      ../development/compilers/adoptopenjdk-bin/jdk8-linux.nix
+      ../development/compilers/adoptopenjdk-bin/jdk8-darwin.nix;
+
+    adoptopenjdk-11 = mkAdoptopenjdk
+      ../development/compilers/adoptopenjdk-bin/jdk11-linux.nix
+      ../development/compilers/adoptopenjdk-bin/jdk11-darwin.nix;
+
+    adoptopenjdk-13 = mkAdoptopenjdk
+      ../development/compilers/adoptopenjdk-bin/jdk13-linux.nix
+      ../development/compilers/adoptopenjdk-bin/jdk13-darwin.nix;
+
+    adoptopenjdk-14 = mkAdoptopenjdk
+      ../development/compilers/adoptopenjdk-bin/jdk14-linux.nix
+      ../development/compilers/adoptopenjdk-bin/jdk14-darwin.nix;
+
+    adoptopenjdk-15 = mkAdoptopenjdk
+      ../development/compilers/adoptopenjdk-bin/jdk15-linux.nix
+      ../development/compilers/adoptopenjdk-bin/jdk15-darwin.nix;
+
+    adoptopenjdk-16 = mkAdoptopenjdk
+      ../development/compilers/adoptopenjdk-bin/jdk16-linux.nix
+      ../development/compilers/adoptopenjdk-bin/jdk16-darwin.nix;
+
+    openjdk8-bootstrap = mkBootstrap adoptopenjdk-8
+      ../development/compilers/openjdk/bootstrap.nix
+      { version = "8"; };
+
+    openjdk11-bootstrap = mkBootstrap adoptopenjdk-11
+      ../development/compilers/openjdk/bootstrap.nix
+      { version = "10"; };
+
+    openjdk13-bootstrap = mkBootstrap adoptopenjdk-13
+      ../development/compilers/openjdk/12.nix
+      (bootstrapArgs // {
+        /* build segfaults with gcc9 or newer, so use gcc8 like Debian does */
+        stdenv = gcc8Stdenv;
+      });
+
+    openjdk14-bootstrap = mkBootstrap adoptopenjdk-14
+      ../development/compilers/openjdk/13.nix
+      (bootstrapArgs // {
+        inherit openjdk13-bootstrap;
+      });
+
+    openjdk15-bootstrap = mkBootstrap adoptopenjdk-15
+      ../development/compilers/openjdk/14.nix
+      (bootstrapArgs // {
+        inherit openjdk14-bootstrap;
+      });
+
+    openjdk16-bootstrap = mkBootstrap adoptopenjdk-16
+      ../development/compilers/openjdk/15.nix
+      (bootstrapArgs // {
+        inherit openjdk15-bootstrap;
+      });
+
+    openjdk17-bootstrap = mkBootstrap adoptopenjdk-16
+      ../development/compilers/openjdk/16.nix
+      (bootstrapArgs // {
+        inherit openjdk16-bootstrap;
+      });
+
+    openjdk8 = mkOpenjdk
+      ../development/compilers/openjdk/8.nix
+      ../development/compilers/openjdk/darwin/8.nix
+      { };
+
+    openjdk11 = mkOpenjdk
+      ../development/compilers/openjdk/11.nix
+      ../development/compilers/openjdk/darwin/11.nix
+      { openjfx = openjfx11; };
+
+    openjdk12 = mkOpenjdkLinuxOnly ../development/compilers/openjdk/12.nix {
+        /* build segfaults with gcc9 or newer, so use gcc8 like Debian does */
+        stdenv = gcc8Stdenv;
+        openjfx = openjfx11;
+    };
+
+    openjdk13 = mkOpenjdkLinuxOnly ../development/compilers/openjdk/13.nix {
+      inherit openjdk13-bootstrap;
+      openjfx = openjfx11;
+    };
+
+    openjdk14 = mkOpenjdkLinuxOnly ../development/compilers/openjdk/14.nix {
+      inherit openjdk14-bootstrap;
+      openjfx = openjfx11;
+    };
+
+    openjdk15 = mkOpenjdkLinuxOnly ../development/compilers/openjdk/15.nix {
+      inherit openjdk15-bootstrap;
+      openjfx = openjfx15;
+    };
+
+    openjdk16 = mkOpenjdk
+      ../development/compilers/openjdk/16.nix
+      ../development/compilers/openjdk/darwin/16.nix
+      {
+        inherit openjdk16-bootstrap;
+        openjfx = openjfx15;
+      };
+
+    openjdk17 = mkOpenjdk
+      ../development/compilers/openjdk/17.nix
+      ../development/compilers/openjdk/darwin/17.nix
+      {
+        inherit openjdk17-bootstrap;
+        openjfx = openjfx15;
+      };
+  };
 
   mavenPlugins = recurseIntoAttrs (callPackage ../development/java-modules/mavenPlugins.nix { });
 
diff --git a/pkgs/top-level/splice.nix b/pkgs/top-level/splice.nix
index a093442d3698..459baaca2e63 100644
--- a/pkgs/top-level/splice.nix
+++ b/pkgs/top-level/splice.nix
@@ -42,7 +42,7 @@ let
         valueBuildBuild = pkgsBuildBuild.${name} or {};
         valueBuildHost = pkgsBuildHost.${name} or {};
         valueBuildTarget = pkgsBuildTarget.${name} or {};
-        valueHostHost = throw "`valueHostHost` unimplemented: pass manually rather than relying on splice.";
+        valueHostHost = pkgsHostHost.${name} or {};
         valueHostTarget = pkgsHostTarget.${name} or {};
         valueTargetTarget = pkgsTargetTarget.${name} or {};
         augmentedValue = defaultValue
@@ -53,7 +53,7 @@ let
             __spliced =
                  (lib.optionalAttrs (pkgsBuildBuild ? ${name}) { buildBuild = valueBuildBuild; })
               // (lib.optionalAttrs (pkgsBuildTarget ? ${name}) { buildTarget = valueBuildTarget; })
-              // { hostHost = valueHostHost; }
+              // (lib.optionalAttrs (pkgsHostHost ? ${name}) { hostHost = valueHostHost; })
               // (lib.optionalAttrs (pkgsTargetTarget ? ${name}) { targetTarget = valueTargetTarget;
           });
         };
@@ -81,7 +81,7 @@ let
           pkgsBuildBuild = valueBuildBuild;
           pkgsBuildHost = valueBuildHost;
           pkgsBuildTarget = valueBuildTarget;
-          pkgsHostHost = {};
+          pkgsHostHost = valueHostHost;
           pkgsHostTarget = valueHostTarget;
           pkgsTargetTarget = valueTargetTarget;
         # Don't be fancy about non-derivations. But we could have used used