diff --git a/nixos/modules/services/networking/envoy.nix b/nixos/modules/services/networking/envoy.nix
index 20cfebb79914..c68ceab9619c 100644
--- a/nixos/modules/services/networking/envoy.nix
+++ b/nixos/modules/services/networking/envoy.nix
@@ -6,18 +6,29 @@ let
   cfg = config.services.envoy;
   format = pkgs.formats.json { };
   conf = format.generate "envoy.json" cfg.settings;
-  validateConfig = file:
+  validateConfig = required: file:
     pkgs.runCommand "validate-envoy-conf" { } ''
-      ${pkgs.envoy}/bin/envoy --log-level error --mode validate -c "${file}"
+      ${cfg.package}/bin/envoy --log-level error --mode validate -c "${file}" ${lib.optionalString (!required) "|| true"}
       cp "${file}" "$out"
     '';
-
 in
 
 {
   options.services.envoy = {
     enable = mkEnableOption (lib.mdDoc "Envoy reverse proxy");
 
+    package = mkPackageOptionMD pkgs "envoy" { };
+
+    requireValidConfig = mkOption {
+      type = types.bool;
+      default = true;
+      description = lib.mdDoc ''
+        Whether a failure during config validation at build time is fatal.
+        When the config can't be checked during build time, for example when it includes
+        other files, disable this option.
+      '';
+    };
+
     settings = mkOption {
       type = format.type;
       default = { };
@@ -46,38 +57,44 @@ in
   };
 
   config = mkIf cfg.enable {
-    environment.systemPackages = [ pkgs.envoy ];
+    environment.systemPackages = [ cfg.package ];
     systemd.services.envoy = {
       description = "Envoy reverse proxy";
       after = [ "network-online.target" ];
       requires = [ "network-online.target" ];
       wantedBy = [ "multi-user.target" ];
       serviceConfig = {
-        ExecStart = "${pkgs.envoy}/bin/envoy -c ${validateConfig conf}";
-        DynamicUser = true;
+        ExecStart = "${cfg.package}/bin/envoy -c ${validateConfig cfg.requireValidConfig conf}";
+        CacheDirectory = [ "envoy" ];
+        LogsDirectory = [ "envoy" ];
         Restart = "no";
-        CacheDirectory = "envoy";
-        LogsDirectory = "envoy";
-        AmbientCapabilities = "CAP_NET_BIND_SERVICE";
-        CapabilityBoundingSet = "CAP_NET_BIND_SERVICE";
-        RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6 AF_NETLINK AF_XDP";
-        SystemCallArchitectures = "native";
+        # Hardening
+        AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
+        CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
+        DeviceAllow = [ "" ];
+        DevicePolicy = "closed";
+        DynamicUser = true;
         LockPersonality = true;
-        RestrictNamespaces = true;
-        RestrictRealtime = true;
-        PrivateUsers = false;  # breaks CAP_NET_BIND_SERVICE
+        MemoryDenyWriteExecute = false; # at least wasmr needs WX permission
         PrivateDevices = true;
+        PrivateUsers = false; # breaks CAP_NET_BIND_SERVICE
+        ProcSubset = "pid";
         ProtectClock = true;
         ProtectControlGroups = true;
         ProtectHome = true;
+        ProtectHostname = true;
         ProtectKernelLogs = true;
         ProtectKernelModules = true;
         ProtectKernelTunables = true;
         ProtectProc = "ptraceable";
-        ProtectHostname = true;
         ProtectSystem = "strict";
+        RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" "AF_NETLINK" "AF_XDP" ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        SystemCallArchitectures = "native";
+        SystemCallErrorNumber = "EPERM";
+        SystemCallFilter = [ "@system-service" "~@privileged" "~@resources" ];
         UMask = "0066";
-        SystemCallFilter = "~@clock @module @mount @reboot @swap @obsolete @cpu-emulation";
       };
     };
   };
diff --git a/nixos/modules/services/networking/hostapd.nix b/nixos/modules/services/networking/hostapd.nix
index f13457fcde25..ecc158f8151d 100644
--- a/nixos/modules/services/networking/hostapd.nix
+++ b/nixos/modules/services/networking/hostapd.nix
@@ -20,6 +20,8 @@ let
     ssid=${cfg.ssid}
     hw_mode=${cfg.hwMode}
     channel=${toString cfg.channel}
+    ieee80211n=1
+    ieee80211ac=1
     ${optionalString (cfg.countryCode != null) "country_code=${cfg.countryCode}"}
     ${optionalString (cfg.countryCode != null) "ieee80211d=1"}
 
@@ -34,6 +36,7 @@ let
 
     ${optionalString cfg.wpa ''
       wpa=2
+      wpa_pairwise=CCMP
       wpa_passphrase=${cfg.wpaPassphrase}
     ''}
     ${optionalString cfg.noScan "noscan=1"}
@@ -66,7 +69,6 @@ in
       };
 
       interface = mkOption {
-        default = "";
         example = "wlp2s0";
         type = types.str;
         description = lib.mdDoc ''
diff --git a/nixos/tests/envoy.nix b/nixos/tests/envoy.nix
index 9d2c32ce102f..1e4bfe626398 100644
--- a/nixos/tests/envoy.nix
+++ b/nixos/tests/envoy.nix
@@ -13,7 +13,7 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : {
           socket_address = {
             protocol = "TCP";
             address = "127.0.0.1";
-            port_value = 9901;
+            port_value = 80;
           };
         };
       };
@@ -22,12 +22,33 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : {
         clusters = [];
       };
     };
+    specialisation = {
+      withoutConfigValidation.configuration = { ... }: {
+        services.envoy = {
+          requireValidConfig = false;
+          settings.admin.access_log_path = lib.mkForce "/var/log/envoy/access.log";
+        };
+      };
+    };
   };
 
-  testScript = ''
-    machine.start()
-    machine.wait_for_unit("envoy.service")
-    machine.wait_for_open_port(9901)
-    machine.wait_until_succeeds("curl -fsS localhost:9901/ready")
-  '';
+  testScript = { nodes, ... }:
+    let
+      specialisations = "${nodes.machine.system.build.toplevel}/specialisation";
+    in
+    ''
+      machine.start()
+
+      with subtest("envoy.service starts and responds with ready"):
+        machine.wait_for_unit("envoy.service")
+        machine.wait_for_open_port(80)
+        machine.wait_until_succeeds("curl -fsS localhost:80/ready")
+
+      with subtest("envoy.service works with config path not available at eval time"):
+        machine.succeed('${specialisations}/withoutConfigValidation/bin/switch-to-configuration test')
+        machine.wait_for_unit("envoy.service")
+        machine.wait_for_open_port(80)
+        machine.wait_until_succeeds("curl -fsS localhost:80/ready")
+        machine.succeed('test -f /var/log/envoy/access.log')
+    '';
 })
diff --git a/pkgs/applications/audio/gtkcord4/default.nix b/pkgs/applications/audio/gtkcord4/default.nix
index 7471a0afb4ca..f5b2cf5576e3 100644
--- a/pkgs/applications/audio/gtkcord4/default.nix
+++ b/pkgs/applications/audio/gtkcord4/default.nix
@@ -19,13 +19,13 @@
 
 buildGoModule rec {
   pname = "gtkcord4";
-  version = "0.0.8";
+  version = "0.0.9";
 
   src = fetchFromGitHub {
     owner = "diamondburned";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-aJRVk9KFCJbIFInkg5BCJ6ygBlDCFF53WXO9qyACFus=";
+    hash = "sha256-55mS+hrhLLRkhgih5lvdM9Xka+WKg2iliFm6TYF6n3w=";
   };
 
   nativeBuildInputs = [
@@ -61,7 +61,7 @@ buildGoModule rec {
     install -D -m 444 internal/icons/png/logo.png $out/share/icons/hicolor/256x256/apps/gtkcord4.png
   '';
 
-  vendorHash = "sha256-usnlaOqyMd8rdnFpuCqfaCES8bPaB+NbdL4pFybKJbM=";
+  vendorHash = "sha256-IQpokMeo46vZIdVA1F7JILXCN9bUqTMOCa/SQ0JSjaM=";
 
   meta = with lib; {
     description = "GTK4 Discord client in Go, attempt #4.";
diff --git a/pkgs/applications/blockchains/elements/default.nix b/pkgs/applications/blockchains/elements/default.nix
index a39cbc341e89..80fa1e94589f 100644
--- a/pkgs/applications/blockchains/elements/default.nix
+++ b/pkgs/applications/blockchains/elements/default.nix
@@ -24,13 +24,13 @@
 
 stdenv.mkDerivation rec {
   pname = if withGui then "elements" else "elementsd";
-  version = "22.0.2";
+  version = "22.1";
 
   src = fetchFromGitHub {
     owner = "ElementsProject";
     repo = "elements";
     rev = "elements-${version}";
-    sha256 = "sha256-20Tem6CD7XAt1EDfkl46Nxhb+Vq3sCk/UqnLCAm85FU=";
+    sha256 = "sha256-HDV06O9k+TpYR0ZwLas2hvDwxvnfoa8VUzgvkXv/WV8=";
   };
 
   nativeBuildInputs =
diff --git a/pkgs/applications/editors/vscode/extensions/ms-toolsai-jupyter/default.nix b/pkgs/applications/editors/vscode/extensions/ms-toolsai-jupyter/default.nix
index e713ba29e84b..7089f9e3d39d 100644
--- a/pkgs/applications/editors/vscode/extensions/ms-toolsai-jupyter/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/ms-toolsai-jupyter/default.nix
@@ -1,14 +1,11 @@
 { lib, vscode-utils, jq, moreutils }:
 
-let
-  inherit (vscode-utils) buildVscodeMarketplaceExtension;
-
-in buildVscodeMarketplaceExtension {
+vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "jupyter";
     publisher = "ms-toolsai";
-    version = "2022.11.1003381023";
-    sha256 = "0cbnr52pq0yw6i4yzyrifyrz186l482m9s01h4l7d74fby9ska8h";
+    version = "2023.2.1000411022";
+    sha256 = "sha256-gMK/t/rLXYN3rlHxxVeW0W/FWEP0ZCiEwzM8DY14vYg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/tellico/default.nix b/pkgs/applications/misc/tellico/default.nix
index af8a538a822b..d732fdde136a 100644
--- a/pkgs/applications/misc/tellico/default.nix
+++ b/pkgs/applications/misc/tellico/default.nix
@@ -24,14 +24,14 @@
 
 mkDerivation rec {
   pname = "tellico";
-  version = "3.4.5";
+  version = "3.4.6";
 
   src = fetchFromGitLab {
     domain = "invent.kde.org";
     owner = "office";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-XWzSbtyxOkASTwT5b7+hIEwaKe2bEo6ij+CnPbYNEc0=";
+    hash = "sha256-aHA4DYuxh4vzXL82HRGMPfqS0DGqq/FLMEuhsr4eLko=";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/networking/instant-messengers/deltachat-desktop/default.nix b/pkgs/applications/networking/instant-messengers/deltachat-desktop/default.nix
index 3d9fc7627b60..f4eb47428b5b 100644
--- a/pkgs/applications/networking/instant-messengers/deltachat-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/deltachat-desktop/default.nix
@@ -21,17 +21,17 @@
 
 let
   libdeltachat' = libdeltachat.overrideAttrs (old: rec {
-    version = "1.107.0";
+    version = "1.107.1";
     src = fetchFromGitHub {
       owner = "deltachat";
       repo = "deltachat-core-rust";
       rev = version;
-      hash = "sha256-fjiS7GZy1BLgmxu4LFOWgucORcVx+9KleQcga+hRkSY=";
+      hash = "sha256-ISAUZyFrp86ILtRrlowceBQNJ7+tbJReIAe6+u4wwQI=";
     };
     cargoDeps = rustPlatform.fetchCargoTarball {
       inherit src;
       name = "${old.pname}-${version}";
-      hash = "sha256-7XhSI/C0GEmsaL0UupvufB1bfPGbzSQJH720Y4/Do3o=";
+      hash = "sha256-B4BMxiI3GhsjeD3gYrq5ZpbZ7l77ycrIMWu2sUzZiz4=";
     };
   });
   esbuild' = esbuild.override {
@@ -48,16 +48,16 @@ let
   };
 in buildNpmPackage rec {
   pname = "deltachat-desktop";
-  version = "1.34.3";
+  version = "1.34.4";
 
   src = fetchFromGitHub {
     owner = "deltachat";
     repo = "deltachat-desktop";
     rev = "v${version}";
-    hash = "sha256-6WZJD8lMsk1WNguMkXygBCTVpOzNkNuVZJ3Ygv6VBkM=";
+    hash = "sha256-LV8/r6psUZuCEGbaH1nWlrkeNbEYG8R5O1aCxECPH1E=";
   };
 
-  npmDepsHash = "sha256-B91yQ/xi8+uyOllqYR7lZTfLBpJvZat1cIIJk9TkM/c=";
+  npmDepsHash = "sha256-rdZVvsyCo/6C4+gjytCCn9Qcl+chc6U+6orkcM59I8U=";
 
   nativeBuildInputs = [
     makeWrapper
diff --git a/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix b/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
index 35846f4b7e45..3fe012fd0b59 100644
--- a/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "signalbackup-tools";
-  version = "20230203";
+  version = "20230211";
 
   src = fetchFromGitHub {
     owner = "bepaald";
     repo = pname;
     rev = version;
-    sha256 = "sha256-xXIdXv2U5VpRSuJ9Kl6HMDBZGpXRYGPZFBBk9QYODtU=";
+    hash = "sha256-NeArgsl5xbgcXY8OKjF2wMdwJqgsBdR1XSrIWPqRWMs=";
   };
 
   postPatch = ''
@@ -36,5 +36,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl3Only;
     maintainers = [ maintainers.malo ];
     platforms = platforms.all;
+    broken = stdenv.isDarwin;
   };
 }
diff --git a/pkgs/applications/networking/mailreaders/tutanota-desktop/default.nix b/pkgs/applications/networking/mailreaders/tutanota-desktop/default.nix
index a2972f9bfb96..6b5e8a254c89 100644
--- a/pkgs/applications/networking/mailreaders/tutanota-desktop/default.nix
+++ b/pkgs/applications/networking/mailreaders/tutanota-desktop/default.nix
@@ -3,12 +3,12 @@ electron, libsecret }:
 
 stdenv.mkDerivation rec {
   pname = "tutanota-desktop";
-  version = "3.106.4";
+  version = "3.108.12";
 
   src = fetchurl {
     url = "https://github.com/tutao/tutanota/releases/download/tutanota-desktop-release-${version}/${pname}-${version}-unpacked-linux.tar.gz";
     name = "tutanota-desktop-${version}.tar.gz";
-    sha256 = "sha256-RU2JEFtYOpxqA02YDuB/V4t/ZZ608EHGMPpwxVOzRz4=";
+    sha256 = "sha256-ZXQCth5nhCkEZI348057cRjzFWl/IEytQmkmBuJzw3w=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/science/biology/eggnog-mapper/default.nix b/pkgs/applications/science/biology/eggnog-mapper/default.nix
index 9aa655932d35..c555a30b15a8 100644
--- a/pkgs/applications/science/biology/eggnog-mapper/default.nix
+++ b/pkgs/applications/science/biology/eggnog-mapper/default.nix
@@ -8,13 +8,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "eggnog-mapper";
-  version = "2.1.9";
+  version = "2.1.10";
 
   src = fetchFromGitHub {
     owner = "eggnogdb";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-Fn7hJhZG/T8f2nP+ltl1/FBFwXz0Kxz/4mIma/Z0bnE=";
+    hash = "sha256-6R2gl2l2Cl/eva0g+kxDLBI2+5T9cFTgaGMsEfeDVU0=";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/virtualization/containerd/default.nix b/pkgs/applications/virtualization/containerd/default.nix
index d95b37ef1d30..3c76f5679778 100644
--- a/pkgs/applications/virtualization/containerd/default.nix
+++ b/pkgs/applications/virtualization/containerd/default.nix
@@ -10,13 +10,13 @@
 
 buildGoModule rec {
   pname = "containerd";
-  version = "1.6.16";
+  version = "1.6.17";
 
   src = fetchFromGitHub {
     owner = "containerd";
     repo = "containerd";
     rev = "v${version}";
-    hash = "sha256-p2I188MGoxnd7dBAMQ0bM5+GT8z3y9S4cZW2Q99DyzY=";
+    hash = "sha256-5Kpqgn4g08i8UVw9mfK5gc2wSx4wTk6NIzbT7tzY+ho=";
   };
 
   vendorHash = null;
diff --git a/pkgs/data/themes/obsidian2/default.nix b/pkgs/data/themes/obsidian2/default.nix
index 6e5dc5f35a18..a5bfac658b42 100644
--- a/pkgs/data/themes/obsidian2/default.nix
+++ b/pkgs/data/themes/obsidian2/default.nix
@@ -1,17 +1,24 @@
-{ lib, stdenv, fetchurl, gtk-engine-murrine }:
+{ lib
+, stdenv
+, fetchurl
+, gtk-engine-murrine
+, gitUpdater
+}:
 
 stdenv.mkDerivation rec {
   pname = "theme-obsidian2";
-  version = "2.21";
+  version = "2.22";
 
   src = fetchurl {
     url = "https://github.com/madmaxms/theme-obsidian-2/releases/download/v${version}/obsidian-2-theme.tar.xz";
-    sha256 = "sha256-ptiJeb4ebfnH6HpTN1NsPAYbkLlPcZtn2aBKO0zW2Tw=";
+    sha256 = "sha256-WvSlzCock0UMdvajHRBNHSugVMStR1FDt9vjzX5Kp8A=";
   };
 
   sourceRoot = ".";
 
-  propagatedUserEnvPkgs = [ gtk-engine-murrine ];
+  propagatedUserEnvPkgs = [
+    gtk-engine-murrine
+  ];
 
   installPhase = ''
     runHook preInstall
@@ -20,8 +27,13 @@ stdenv.mkDerivation rec {
     runHook postInstall
   '';
 
+  passthru.updateScript = gitUpdater {
+    url = "https://github.com/madmaxms/theme-obsidian-2";
+    rev-prefix = "v";
+  };
+
   meta = with lib; {
-    description = "Gnome theme, based upon Adwaita-Maia dark skin";
+    description = "Gnome theme based upon Adwaita-Maia dark skin";
     homepage = "https://github.com/madmaxms/theme-obsidian-2";
     license = with licenses; [ gpl3Only ];
     platforms = platforms.linux;
diff --git a/pkgs/desktops/gnome-2/desktop/gtksourceview/default.nix b/pkgs/desktops/gnome-2/desktop/gtksourceview/default.nix
index df63449c2f61..9db253dab3a2 100644
--- a/pkgs/desktops/gnome-2/desktop/gtksourceview/default.nix
+++ b/pkgs/desktops/gnome-2/desktop/gtksourceview/default.nix
@@ -1,15 +1,19 @@
 {lib, stdenv, fetchpatch, fetchurl, autoreconfHook, pkg-config, atk, cairo, glib
 , gnome-common, gtk2, pango
-, libxml2Python, perl, intltool, gettext, gtk-mac-integration-gtk2 }:
+, libxml2Python, perl, intltool, gettext, gtk-mac-integration-gtk2
+, testers
+}:
 
 with lib;
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "gtksourceview";
   version = "2.10.5";
 
-  src = fetchurl {
-    url = "mirror://gnome/sources/gtksourceview/2.10/${pname}-${version}.tar.bz2";
+  src = let
+    inherit (finalAttrs) pname version;
+  in fetchurl {
+    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.bz2";
     sha256 = "c585773743b1df8a04b1be7f7d90eecdf22681490d6810be54c81a7ae152191e";
   };
 
@@ -40,4 +44,10 @@ stdenv.mkDerivation rec {
   '';
 
   doCheck = false; # requires X11 daemon
-}
+
+  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+
+  meta = {
+    pkgConfigModules = [ "gtksourceview-2.0" ];
+  };
+})
diff --git a/pkgs/desktops/gnome-2/platform/gnome-vfs/default.nix b/pkgs/desktops/gnome-2/platform/gnome-vfs/default.nix
index 4c9f28230c31..7ce615fb3c71 100644
--- a/pkgs/desktops/gnome-2/platform/gnome-vfs/default.nix
+++ b/pkgs/desktops/gnome-2/platform/gnome-vfs/default.nix
@@ -1,12 +1,16 @@
 { lib, stdenv, fetchurl, fetchpatch, pkg-config, libxml2, bzip2, openssl, dbus-glib
-, glib, gamin, cdparanoia, intltool, GConf, gnome_mime_data, avahi, acl }:
+, glib, gamin, cdparanoia, intltool, GConf, gnome_mime_data, avahi, acl
+, testers
+}:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "gnome-vfs";
   version = "2.24.4";
 
-  src = fetchurl {
-    url = "mirror://gnome/sources/gnome-vfs/${lib.versions.majorMinor version}/gnome-vfs-${version}.tar.bz2";
+  src = let
+    inherit (finalAttrs) pname version;
+  in fetchurl {
+    url = "mirror://gnome/sources/gnome-vfs/${lib.versions.majorMinor version}/${pname}-${version}.tar.bz2";
     sha256 = "1ajg8jb8k3snxc7rrgczlh8daxkjidmcv3zr9w809sq4p2sn9pk2";
   };
 
@@ -35,4 +39,10 @@ stdenv.mkDerivation rec {
   postPatch = "find . -name Makefile.in | xargs sed 's/-DG_DISABLE_DEPRECATED//g' -i ";
 
   doCheck = false; # needs dbus daemon
-}
+
+  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+
+  meta = {
+    pkgConfigModules = [ "gnome-vfs-2.0" "gnome-vfs-module-2.0" ];
+  };
+})
diff --git a/pkgs/desktops/gnome/core/libgnome-keyring/default.nix b/pkgs/desktops/gnome/core/libgnome-keyring/default.nix
index aa3c7ed39811..9d2e3d4eff74 100644
--- a/pkgs/desktops/gnome/core/libgnome-keyring/default.nix
+++ b/pkgs/desktops/gnome/core/libgnome-keyring/default.nix
@@ -1,14 +1,16 @@
-{ lib, stdenv, fetchurl, glib, dbus, libgcrypt, pkg-config, intltool, gobject-introspection, gnome }:
+{ lib, stdenv, fetchurl, glib, dbus, libgcrypt, pkg-config, intltool, gobject-introspection, gnome
+, testers
+}:
 
 let
   pname = "libgnome-keyring";
   version = "3.12.0";
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   name = "${pname}-${version}";
 
   src = fetchurl {
-    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${name}.tar.xz";
+    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
     sha256 = "c4c178fbb05f72acc484d22ddb0568f7532c409b0a13e06513ff54b91e947783";
   };
 
@@ -17,10 +19,13 @@ stdenv.mkDerivation rec {
   propagatedBuildInputs = [ glib gobject-introspection dbus libgcrypt ];
   nativeBuildInputs = [ pkg-config intltool ];
 
+  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+
   meta = {
     description = "Framework for managing passwords and other secrets";
     homepage = "https://wiki.gnome.org/Projects/GnomeKeyring";
     license = with lib.licenses; [ gpl2Plus lgpl2Plus ];
+    pkgConfigModules = [ "gnome-keyring-1" ];
     inherit (glib.meta) platforms maintainers;
 
     longDescription = ''
@@ -29,4 +34,4 @@ stdenv.mkDerivation rec {
       with the gnome-keyring system.
     '';
   };
-}
+})
diff --git a/pkgs/development/compilers/qbe/default.nix b/pkgs/development/compilers/qbe/default.nix
index c9464813d3f2..ee075ec04056 100644
--- a/pkgs/development/compilers/qbe/default.nix
+++ b/pkgs/development/compilers/qbe/default.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "qbe";
-  version = "1.0";
+  version = "1.1";
 
   src = fetchzip {
     url = "https://c9x.me/compile/release/qbe-${version}.tar.xz";
-    sha256 = "sha256-Or6m/y5hb9SlSToBevjhaSbk5Lo5BasbqeJmKd1QpGM=";
+    sha256 = "sha256-yFZ3cpp7eLjf7ythKFTY1YEJYyfeg2en4/D8+9oM1B4=";
   };
 
   makeFlags = [ "PREFIX=$(out)" ];
diff --git a/pkgs/development/libraries/cairo/default.nix b/pkgs/development/libraries/cairo/default.nix
index ee8e436d2926..70a59bfa0db7 100644
--- a/pkgs/development/libraries/cairo/default.nix
+++ b/pkgs/development/libraries/cairo/default.nix
@@ -156,7 +156,7 @@ in {
       "cairo-ps"
       "cairo-svg"
     ] ++ lib.optional gobjectSupport "cairo-gobject"
-      ++ lib.optional pdfSupport "cairo-gobject";
+      ++ lib.optional pdfSupport "cairo-pdf";
     platforms = platforms.all;
   };
 })
diff --git a/pkgs/development/libraries/freealut/default.nix b/pkgs/development/libraries/freealut/default.nix
index 36bc4a256777..c29899922979 100644
--- a/pkgs/development/libraries/freealut/default.nix
+++ b/pkgs/development/libraries/freealut/default.nix
@@ -1,11 +1,13 @@
-{ lib, stdenv, darwin, fetchurl, openal }:
+{ lib, stdenv, darwin, fetchurl, openal
+, testers
+}:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "freealut";
   version = "1.1.0";
 
   src = fetchurl {
-    url = "http://www.openal.org/openal_webstf/downloads/freealut-${version}.tar.gz";
+    url = "http://www.openal.org/openal_webstf/downloads/freealut-${finalAttrs.version}.tar.gz";
     sha256 = "0kzlil6112x2429nw6mycmif8y6bxr2cwjcvp18vh6s7g63ymlb0";
   };
 
@@ -14,10 +16,13 @@ stdenv.mkDerivation rec {
     darwin.apple_sdk.frameworks.OpenAL
   ;
 
+  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+
   meta = {
     homepage = "http://openal.org/";
     description = "Free implementation of OpenAL's ALUT standard";
     license = lib.licenses.lgpl2;
+    pkgConfigModules = [ "freealut" ];
     platforms = lib.platforms.unix;
   };
-}
+})
diff --git a/pkgs/development/libraries/freeglut/default.nix b/pkgs/development/libraries/freeglut/default.nix
index 776023f35f01..8c12766204cf 100644
--- a/pkgs/development/libraries/freeglut/default.nix
+++ b/pkgs/development/libraries/freeglut/default.nix
@@ -1,11 +1,13 @@
-{ lib, stdenv, fetchurl, libICE, libXext, libXi, libXrandr, libXxf86vm, libGL, libGLU, cmake }:
+{ lib, stdenv, fetchurl, libICE, libXext, libXi, libXrandr, libXxf86vm, libGL, libGLU, cmake
+, testers
+}:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "freeglut";
   version = "3.2.2";
 
   src = fetchurl {
-    url = "mirror://sourceforge/freeglut/freeglut-${version}.tar.gz";
+    url = "mirror://sourceforge/freeglut/freeglut-${finalAttrs.version}.tar.gz";
     sha256 = "sha256-xZRKCC3wu6lrV1bd2x910M1yzie1OVxsHd6Fwv8pelA=";
   };
 
@@ -22,6 +24,8 @@ stdenv.mkDerivation rec {
                  "-DFREEGLUT_BUILD_STATIC:BOOL=OFF"
                ];
 
+  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+
   meta = with lib; {
     description = "Create and manage windows containing OpenGL contexts";
     longDescription = ''
@@ -34,7 +38,8 @@ stdenv.mkDerivation rec {
     '';
     homepage = "https://freeglut.sourceforge.net/";
     license = licenses.mit;
+    pkgConfigModules = [ "glut" ];
     platforms = platforms.all;
     maintainers = [ maintainers.bjornfor ];
   };
-}
+})
diff --git a/pkgs/development/libraries/freetype/default.nix b/pkgs/development/libraries/freetype/default.nix
index 68907d798e19..48048e4a9108 100644
--- a/pkgs/development/libraries/freetype/default.nix
+++ b/pkgs/development/libraries/freetype/default.nix
@@ -22,14 +22,15 @@
 , qt5
 , texmacs
 , ttfautohint
+, testers
 }:
 
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "freetype";
   version = "2.12.1";
 
-  src = fetchurl {
+  src = let inherit (finalAttrs) pname version; in fetchurl {
     url = "mirror://savannah/${pname}/${pname}-${version}.tar.xz";
     sha256 = "sha256-R2byAVfMTPDNKS+Av5F/ktHEObJDrDAY3r9rkUDEGn8=";
   };
@@ -82,6 +83,7 @@ stdenv.mkDerivation rec {
       ttfautohint;
     inherit (python3.pkgs) freetype-py;
     inherit (qt5) qtbase;
+    pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
   };
 
   meta = with lib; {
@@ -96,6 +98,7 @@ stdenv.mkDerivation rec {
     homepage = "https://www.freetype.org/";
     license = licenses.gpl2Plus; # or the FreeType License (BSD + advertising clause)
     platforms = platforms.all;
+    pkgConfigModules = [ "freetype2" ];
     maintainers = with maintainers; [ ttuegel ];
   };
-}
+})
diff --git a/pkgs/development/libraries/gdk-pixbuf/default.nix b/pkgs/development/libraries/gdk-pixbuf/default.nix
index 5e44d2221f2a..ca0e8f81c4d0 100644
--- a/pkgs/development/libraries/gdk-pixbuf/default.nix
+++ b/pkgs/development/libraries/gdk-pixbuf/default.nix
@@ -19,16 +19,19 @@
 , doCheck ? false
 , makeWrapper
 , lib
+, testers
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "gdk-pixbuf";
   version = "2.42.10";
 
   outputs = [ "out" "dev" "man" "devdoc" ]
     ++ lib.optional (stdenv.buildPlatform == stdenv.hostPlatform) "installedTests";
 
-  src = fetchurl {
+  src = let
+    inherit (finalAttrs) pname version;
+  in fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
     sha256 = "7ptsddE7oJaQei48aye2G80X9cfr6rWltDnS8uOf5Es=";
   };
@@ -97,7 +100,7 @@ stdenv.mkDerivation rec {
     '' + lib.optionalString stdenv.isDarwin ''
       # meson erroneously installs loaders with .dylib extension on Darwin.
       # Their @rpath has to be replaced before gdk-pixbuf-query-loaders looks at them.
-      for f in $out/${passthru.moduleDir}/*.dylib; do
+      for f in $out/${finalAttrs.passthru.moduleDir}/*.dylib; do
           install_name_tool -change @rpath/libgdk_pixbuf-2.0.0.dylib $out/lib/libgdk_pixbuf-2.0.0.dylib $f
           mv $f ''${f%.dylib}.so
       done
@@ -127,12 +130,13 @@ stdenv.mkDerivation rec {
 
   passthru = {
     updateScript = gnome.updateScript {
-      packageName = pname;
+      packageName = finalAttrs.pname;
       versionPolicy = "odd-unstable";
     };
 
     tests = {
       installedTests = nixosTests.installed-tests.gdk-pixbuf;
+      pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
     };
 
     # gdk_pixbuf_moduledir variable from gdk-pixbuf-2.0.pc
@@ -145,6 +149,7 @@ stdenv.mkDerivation rec {
     license = licenses.lgpl21Plus;
     maintainers = [ maintainers.eelco ] ++ teams.gnome.members;
     mainProgram = "gdk-pixbuf-thumbnailer";
+    pkgConfigModules = [ "gdk-pixbuf-2.0" ];
     platforms = platforms.unix;
   };
-}
+})
diff --git a/pkgs/development/libraries/geos/3.9.nix b/pkgs/development/libraries/geos/3.9.nix
index fd0531fa747f..415746d3e544 100644
--- a/pkgs/development/libraries/geos/3.9.nix
+++ b/pkgs/development/libraries/geos/3.9.nix
@@ -1,11 +1,15 @@
-{ lib, stdenv, fetchurl }:
+{ lib
+, stdenv
+, fetchurl
+, testers
+}:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "geos";
   version = "3.9.2";
 
   src = fetchurl {
-    url = "https://download.osgeo.org/geos/${pname}-${version}.tar.bz2";
+    url = "https://download.osgeo.org/geos/${finalAttrs.pname}-${finalAttrs.version}.tar.bz2";
     sha256 = "sha256-RKWpviHX1HNDa/Yhwt3MPPWou+PHhuEyKWGKO52GEpc=";
   };
 
@@ -14,12 +18,15 @@ stdenv.mkDerivation rec {
   # https://trac.osgeo.org/geos/ticket/993
   configureFlags = lib.optional stdenv.isAarch32 "--disable-inline";
 
+  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+
   meta = with lib; {
     description = "C++ port of the Java Topology Suite (JTS)";
     homepage = "https://trac.osgeo.org/geos";
     license = licenses.lgpl21Only;
+    pkgConfigModules = [ "geos" ];
     maintainers = with lib.maintainers; [
       willcohen
     ];
   };
-}
+})
diff --git a/pkgs/development/libraries/geos/default.nix b/pkgs/development/libraries/geos/default.nix
index a331e0254568..670fa30cb0f1 100644
--- a/pkgs/development/libraries/geos/default.nix
+++ b/pkgs/development/libraries/geos/default.nix
@@ -2,14 +2,16 @@
 , stdenv
 , fetchurl
 , fetchpatch
-, cmake }:
+, cmake
+, testers
+}:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "geos";
   version = "3.11.1";
 
   src = fetchurl {
-    url = "https://download.osgeo.org/geos/${pname}-${version}.tar.bz2";
+    url = "https://download.osgeo.org/geos/${finalAttrs.pname}-${finalAttrs.version}.tar.bz2";
     hash = "sha256-bQ6zz6n5LZR3Mcx18XUDVrO9/AfqAgVT2vavHHaOC+I=";
   };
 
@@ -17,12 +19,15 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
+  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+
   meta = with lib; {
     description = "C++ port of the Java Topology Suite (JTS)";
     homepage = "https://trac.osgeo.org/geos";
     license = licenses.lgpl21Only;
+    pkgConfigModules = [ "geos" ];
     maintainers = with lib.maintainers; [
       willcohen
     ];
   };
-}
+})
diff --git a/pkgs/development/libraries/glew/1.10.nix b/pkgs/development/libraries/glew/1.10.nix
index 8fa77013e105..3f355deb33b9 100644
--- a/pkgs/development/libraries/glew/1.10.nix
+++ b/pkgs/development/libraries/glew/1.10.nix
@@ -1,13 +1,14 @@
 { lib, stdenv, fetchurl, libGLU, libXmu, libXi, libXext
 , AGL, OpenGL
+, testers
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "glew";
   version = "1.10.0";
 
   src = fetchurl {
-    url = "mirror://sourceforge/glew/glew-${version}.tgz";
+    url = "mirror://sourceforge/glew/${finalAttrs.pname}-${finalAttrs.version}.tgz";
     sha256 = "01zki46dr5khzlyywr3cg615bcal32dazfazkf360s1znqh17i4r";
   };
 
@@ -41,11 +42,14 @@ stdenv.mkDerivation rec {
     "SYSTEM=${if stdenv.hostPlatform.isMinGW then "mingw" else stdenv.hostPlatform.parsed.kernel.name}"
   ];
 
+  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+
   meta = with lib; {
     description = "An OpenGL extension loading library for C(++)";
     homepage = "https://glew.sourceforge.net/";
     license = licenses.free; # different files under different licenses
       #["BSD" "GLX" "SGI-B" "GPL2"]
+    pkgConfigModules = [ "glew" ];
     platforms = platforms.mesaPlatforms;
   };
-}
+})
diff --git a/pkgs/development/libraries/glew/default.nix b/pkgs/development/libraries/glew/default.nix
index 1e30eb744ba8..4cbd85e7a04c 100644
--- a/pkgs/development/libraries/glew/default.nix
+++ b/pkgs/development/libraries/glew/default.nix
@@ -1,14 +1,15 @@
 { lib, stdenv, fetchurl, fetchpatch, cmake, libGLU, libXmu, libXi, libXext
 , OpenGL
 , enableEGL ? false
+, testers
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "glew";
   version = "2.2.0";
 
   src = fetchurl {
-    url = "mirror://sourceforge/glew/${pname}-${version}.tgz";
+    url = "mirror://sourceforge/glew/${finalAttrs.pname}-${finalAttrs.version}.tgz";
     sha256 = "1qak8f7g1iswgswrgkzc7idk7jmqgwrs58fhg2ai007v7j4q5z6l";
   };
 
@@ -44,14 +45,17 @@ stdenv.mkDerivation rec {
     EOF
   '';
 
+  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+
   meta = with lib; {
     description = "An OpenGL extension loading library for C/C++";
     homepage = "https://glew.sourceforge.net/";
     license = with licenses; [ /* modified bsd */ free mit gpl2Only ]; # For full details, see https://github.com/nigels-com/glew#copyright-and-licensing
+    pkgConfigModules = [ "glew" ];
     platforms = with platforms;
       if enableEGL then
         subtractLists darwin mesaPlatforms
       else
         mesaPlatforms;
   };
-}
+})
diff --git a/pkgs/development/libraries/glib/default.nix b/pkgs/development/libraries/glib/default.nix
index ac7977d0f62f..9e932e547f43 100644
--- a/pkgs/development/libraries/glib/default.nix
+++ b/pkgs/development/libraries/glib/default.nix
@@ -19,6 +19,7 @@
 , desktop-file-utils, shared-mime-info
 , darwin
 , makeHardcodeGsettingsPatch
+, testers
 }:
 
 assert stdenv.isLinux -> util-linuxMinimal != null;
@@ -280,7 +281,10 @@ stdenv.mkDerivation (finalAttrs: {
     getSchemaPath = pkg: makeSchemaPath pkg pkg.name;
     getSchemaDataDirPath = pkg: makeSchemaDataDirPath pkg pkg.name;
 
-    tests.withChecks = finalAttrs.finalPackage.overrideAttrs (_: { doCheck = true; });
+    tests = {
+      withChecks = finalAttrs.finalPackage.overrideAttrs (_: { doCheck = true; });
+      pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+    };
 
     inherit flattenInclude;
     updateScript = gnome.updateScript {
@@ -306,6 +310,11 @@ stdenv.mkDerivation (finalAttrs: {
     homepage    = "https://wiki.gnome.org/Projects/GLib";
     license     = licenses.lgpl21Plus;
     maintainers = teams.gnome.members ++ (with maintainers; [ lovek323 raskin ]);
+    pkgConfigModules = [
+      "gio-2.0"
+      "gobject-2.0"
+      "gthread-2.0"
+    ];
     platforms   = platforms.unix;
 
     longDescription = ''
diff --git a/pkgs/development/libraries/gobject-introspection/default.nix b/pkgs/development/libraries/gobject-introspection/default.nix
index 4ab8cbbf9650..f83b7c10819e 100644
--- a/pkgs/development/libraries/gobject-introspection/default.nix
+++ b/pkgs/development/libraries/gobject-introspection/default.nix
@@ -21,6 +21,7 @@
 , gobject-introspection-unwrapped
 , nixStoreDir ? builtins.storeDir
 , x11Support ? true
+, testers
 }:
 
 # now that gobject-introspection creates large .gir files (eg gtk3 case)
@@ -145,12 +146,14 @@ stdenv.mkDerivation (finalAttrs: {
       packageName = "gobject-introspection";
       versionPolicy = "odd-unstable";
     };
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
   };
 
   meta = with lib; {
     description = "A middleware layer between C libraries and language bindings";
     homepage = "https://gi.readthedocs.io/";
     maintainers = teams.gnome.members ++ (with maintainers; [ lovek323 artturin ]);
+    pkgConfigModules = [ "gobject-introspection-1.0" ];
     platforms = platforms.unix;
     license = with licenses; [ gpl2 lgpl2 ];
 
diff --git a/pkgs/development/libraries/gstreamer/base/default.nix b/pkgs/development/libraries/gstreamer/base/default.nix
index 395708c2a680..e03f9f0b844f 100644
--- a/pkgs/development/libraries/gstreamer/base/default.nix
+++ b/pkgs/development/libraries/gstreamer/base/default.nix
@@ -37,15 +37,18 @@
 , enableCdparanoia ? (!stdenv.isDarwin)
 , cdparanoia
 , glib
+, testers
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "gst-plugins-base";
   version = "1.20.3";
 
   outputs = [ "out" "dev" ];
 
-  src = fetchurl {
+  src = let
+    inherit (finalAttrs) pname version;
+  in fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
     sha256 = "sha256-fjCz3YGnA4D/dVT5mEcdaZb/drvm/FRHCW+FHiRHPJ8=";
   };
@@ -146,11 +149,19 @@ stdenv.mkDerivation rec {
     waylandEnabled = enableWayland;
   };
 
+  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+
   meta = with lib; {
     description = "Base GStreamer plug-ins and helper libraries";
     homepage = "https://gstreamer.freedesktop.org";
     license = licenses.lgpl2Plus;
+    pkgConfigModules = [
+      "gstreamer-audio-1.0"
+      "gstreamer-base-1.0"
+      "gstreamer-net-1.0"
+      "gstreamer-video-1.0"
+    ];
     platforms = platforms.unix;
     maintainers = with maintainers; [ matthewbauer ];
   };
-}
+})
diff --git a/pkgs/development/libraries/gstreamer/core/default.nix b/pkgs/development/libraries/gstreamer/core/default.nix
index 41acd079583e..80fc921a3679 100644
--- a/pkgs/development/libraries/gstreamer/core/default.nix
+++ b/pkgs/development/libraries/gstreamer/core/default.nix
@@ -17,9 +17,10 @@
 , lib
 , CoreServices
 , gobject-introspection
+, testers
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "gstreamer";
   version = "1.20.3";
 
@@ -32,7 +33,9 @@ stdenv.mkDerivation rec {
     # - https://github.com/NixOS/nixpkgs/issues/98769#issuecomment-702296551
   ];
 
-  src = fetchurl {
+  src = let
+    inherit (finalAttrs) pname version;
+  in fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
     sha256 = "sha256-YH2vZLu9X7GK+dF+IcDSLE1wL//oOyPLItGxryyiOio=";
   };
@@ -108,11 +111,16 @@ stdenv.mkDerivation rec {
 
   setupHook = ./setup-hook.sh;
 
-  meta = with lib ;{
+  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+
+  meta = with lib; {
     description = "Open source multimedia framework";
     homepage = "https://gstreamer.freedesktop.org";
     license = licenses.lgpl2Plus;
+    pkgConfigModules = [
+      "gstreamer-controller-1.0"
+    ];
     platforms = platforms.unix;
     maintainers = with maintainers; [ ttuegel matthewbauer ];
   };
-}
+})
diff --git a/pkgs/development/libraries/gtk/2.x.nix b/pkgs/development/libraries/gtk/2.x.nix
index 23680c9b6757..88dfc54094f3 100644
--- a/pkgs/development/libraries/gtk/2.x.nix
+++ b/pkgs/development/libraries/gtk/2.x.nix
@@ -5,6 +5,7 @@
 , gdktarget ? if stdenv.isDarwin then "quartz" else "x11"
 , AppKit, Cocoa
 , fetchpatch, buildPackages
+, testers
 }:
 
 let
@@ -17,12 +18,12 @@ let
 
 in
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "gtk+";
   version = "2.24.33";
 
   src = fetchurl {
-    url = "mirror://gnome/sources/gtk+/2.24/${pname}-${version}.tar.xz";
+    url = "mirror://gnome/sources/gtk+/2.24/${finalAttrs.pname}-${finalAttrs.version}.tar.xz";
     sha256 = "rCrHV/WULTGKMRpUsMgLXvKV8pnCpzxjL2v7H/Scxto=";
   };
 
@@ -37,7 +38,9 @@ stdenv.mkDerivation rec {
   ];
 
 
-  nativeBuildInputs = setupHooks ++ [ perl pkg-config gettext gobject-introspection ];
+  nativeBuildInputs = finalAttrs.setupHooks ++ [
+    perl pkg-config gettext gobject-introspection
+  ];
 
   patches = [
     ./patches/2.0-immodules.cache.patch
@@ -90,6 +93,7 @@ stdenv.mkDerivation rec {
       $out/bin/gtk-query-immodules-2.0 $out/lib/gtk-2.0/2.10.0/immodules/*.so > $out/lib/gtk-2.0/2.10.0/immodules.cache
     ''; # workaround for bug of nix-mode for Emacs */ '';
     inherit gdktarget;
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
   };
 
   meta = with lib; {
@@ -97,6 +101,13 @@ stdenv.mkDerivation rec {
     homepage    = "https://www.gtk.org/";
     license     = licenses.lgpl2Plus;
     maintainers = with maintainers; [ lovek323 raskin ];
+    pkgConfigModules = [
+      "gdk-2.0"
+      "gtk+-2.0"
+    ] ++ lib.optionals (gdktarget == "x11") [
+      "gdk-x11-2.0"
+      "gtk+-x11-2.0"
+    ];
     platforms   = platforms.all;
 
     longDescription = ''
@@ -111,4 +122,4 @@ stdenv.mkDerivation rec {
     '';
     changelog = "https://gitlab.gnome.org/GNOME/gtk/-/raw/${version}/NEWS";
   };
-}
+})
diff --git a/pkgs/development/libraries/gtk/3.x.nix b/pkgs/development/libraries/gtk/3.x.nix
index 1533f59b4aec..6737cdd7e410 100644
--- a/pkgs/development/libraries/gtk/3.x.nix
+++ b/pkgs/development/libraries/gtk/3.x.nix
@@ -46,6 +46,7 @@
 , QuartzCore
 , broadwaySupport ? true
 , wayland-scanner
+, testers
 }:
 
 let
@@ -58,7 +59,7 @@ let
 
 in
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "gtk+3";
   version = "3.24.36";
 
@@ -70,7 +71,9 @@ stdenv.mkDerivation rec {
     gtkCleanImmodulesCache
   ];
 
-  src = fetchurl {
+  src = let
+    inherit (finalAttrs) version;
+  in fetchurl {
     url = "mirror://gnome/sources/gtk+/${lib.versions.majorMinor version}/gtk+-${version}.tar.xz";
     sha256 = "sha256-J6bvFXdDNQyAf/6lm6odcCJtvt6CpelT/9WOpgWf5pE=";
   };
@@ -99,7 +102,7 @@ stdenv.mkDerivation rec {
     python3
     sassc
     gdk-pixbuf
-  ] ++ setupHooks ++ lib.optionals withGtkDoc [
+  ] ++ finalAttrs.setupHooks ++ lib.optionals withGtkDoc [
     docbook_xml_dtd_43
     docbook-xsl-nons
     gtk-doc
@@ -212,7 +215,7 @@ stdenv.mkDerivation rec {
 
     for program in ''${demos[@]}; do
       wrapProgram $dev/bin/$program \
-        --prefix XDG_DATA_DIRS : "$GSETTINGS_SCHEMAS_PATH:$out/share/gsettings-schemas/${pname}-${version}"
+        --prefix XDG_DATA_DIRS : "$GSETTINGS_SCHEMAS_PATH:$out/share/gsettings-schemas/${finalAttrs.pname}-${finalAttrs.version}"
     done
   '' + lib.optionalString stdenv.isDarwin ''
     # a comment created a cycle between outputs
@@ -225,6 +228,7 @@ stdenv.mkDerivation rec {
       attrPath = "gtk3";
       freeze = true;
     };
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
   };
 
   meta = with lib; {
@@ -242,7 +246,14 @@ stdenv.mkDerivation rec {
     homepage = "https://www.gtk.org/";
     license = licenses.lgpl2Plus;
     maintainers = with maintainers; [ raskin ] ++ teams.gnome.members;
+    pkgConfigModules = [
+      "gdk-3.0"
+      "gtk+-3.0"
+    ] ++ lib.optionals x11Support [
+      "gdk-x11-3.0"
+      "gtk+-x11-3.0"
+    ];
     platforms = platforms.all;
     changelog = "https://gitlab.gnome.org/GNOME/gtk/-/raw/${version}/NEWS";
   };
-}
+})
diff --git a/pkgs/development/libraries/gtksourceview/3.x.nix b/pkgs/development/libraries/gtksourceview/3.x.nix
index 447e7d061fdb..704a7c3e9c54 100644
--- a/pkgs/development/libraries/gtksourceview/3.x.nix
+++ b/pkgs/development/libraries/gtksourceview/3.x.nix
@@ -1,12 +1,16 @@
 { lib, stdenv, fetchurl, pkg-config, atk, cairo, glib, gtk3, pango, vala
-, libxml2, perl, intltool, gettext, gobject-introspection, dbus, xvfb-run, shared-mime-info }:
+, libxml2, perl, intltool, gettext, gobject-introspection, dbus, xvfb-run, shared-mime-info
+, testers
+}:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "gtksourceview";
   version = "3.24.11";
 
-  src = fetchurl {
-    url = "mirror://gnome/sources/gtksourceview/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
+  src = let
+    inherit (finalAttrs) pname version;
+  in fetchurl {
+    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
     sha256 = "1zbpj283b5ycz767hqz5kdq02wzsga65pp4fykvhg8xj6x50f6v9";
   };
 
@@ -42,10 +46,13 @@ stdenv.mkDerivation rec {
       make check
   '';
 
+  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+
   meta = with lib; {
     homepage = "https://wiki.gnome.org/Projects/GtkSourceView";
+    pkgConfigModules = [ "gtksourceview-3.0" ];
     platforms = with platforms; linux ++ darwin;
     license = licenses.lgpl21;
     maintainers = teams.gnome.members;
   };
-}
+})
diff --git a/pkgs/development/libraries/gtksourceview/4.x.nix b/pkgs/development/libraries/gtksourceview/4.x.nix
index 95e6e8d2e107..e824e1ed9c67 100644
--- a/pkgs/development/libraries/gtksourceview/4.x.nix
+++ b/pkgs/development/libraries/gtksourceview/4.x.nix
@@ -19,15 +19,18 @@
 , dbus
 , xvfb-run
 , shared-mime-info
+, testers
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "gtksourceview";
   version = "4.8.4";
 
   outputs = [ "out" "dev" ];
 
-  src = fetchurl {
+  src = let
+    inherit (finalAttrs) pname version;
+  in fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
     sha256 = "fsnRj7KD0fhKOj7/O3pysJoQycAGWXs/uru1lYQgqH0=";
   };
@@ -101,11 +104,14 @@ stdenv.mkDerivation rec {
     };
   };
 
+  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+
   meta = with lib; {
     description = "Source code editing widget for GTK";
     homepage = "https://wiki.gnome.org/Projects/GtkSourceView";
+    pkgConfigModules = [ "gtksourceview-4" ];
     platforms = platforms.unix;
     license = licenses.lgpl21Plus;
     maintainers = teams.gnome.members;
   };
-}
+})
diff --git a/pkgs/development/libraries/gtksourceview/5.x.nix b/pkgs/development/libraries/gtksourceview/5.x.nix
index 849c3caf2672..100e3e44a88f 100644
--- a/pkgs/development/libraries/gtksourceview/5.x.nix
+++ b/pkgs/development/libraries/gtksourceview/5.x.nix
@@ -20,15 +20,18 @@
 , dbus
 , xvfb-run
 , shared-mime-info
+, testers
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "gtksourceview";
   version = "5.6.2";
 
   outputs = [ "out" "dev" "devdoc" ];
 
-  src = fetchurl {
+  src = let
+    inherit (finalAttrs) pname version;
+  in fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
     sha256 = "HxRsFW8TWmBJnZeeNXfJm24VoRFEV2er5iGbs0xUXHc=";
   };
@@ -117,11 +120,14 @@ stdenv.mkDerivation rec {
     };
   };
 
+  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+
   meta = with lib; {
     description = "Source code editing widget for GTK";
     homepage = "https://wiki.gnome.org/Projects/GtkSourceView";
+    pkgConfigModules = [ "gtksourceview-5" ];
     platforms = platforms.unix;
     license = licenses.lgpl21Plus;
     maintainers = teams.gnome.members;
   };
-}
+})
diff --git a/pkgs/development/libraries/ldb/default.nix b/pkgs/development/libraries/ldb/default.nix
index 37856f5a0130..bdd630103e37 100644
--- a/pkgs/development/libraries/ldb/default.nix
+++ b/pkgs/development/libraries/ldb/default.nix
@@ -12,6 +12,7 @@
 , docbook_xml_dtd_42
 , cmocka
 , wafHook
+, libxcrypt
 }:
 
 stdenv.mkDerivation rec {
@@ -32,6 +33,8 @@ stdenv.mkDerivation rec {
     libxslt
     docbook-xsl-nons
     docbook_xml_dtd_42
+    tdb
+    tevent
   ];
 
   buildInputs = [
@@ -42,6 +45,7 @@ stdenv.mkDerivation rec {
     tevent
     popt
     cmocka
+    libxcrypt
   ];
 
   # otherwise the configure script fails with
diff --git a/pkgs/development/libraries/libgnome-keyring/default.nix b/pkgs/development/libraries/libgnome-keyring/default.nix
index 3f5a5961ba0f..775bcf2f2a43 100644
--- a/pkgs/development/libraries/libgnome-keyring/default.nix
+++ b/pkgs/development/libraries/libgnome-keyring/default.nix
@@ -1,10 +1,14 @@
-{ lib, stdenv, fetchurl, glib, dbus, libgcrypt, pkg-config, intltool }:
+{ lib, stdenv, fetchurl, glib, dbus, libgcrypt, pkg-config, intltool
+, testers
+}:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "libgnome-keyring";
   version = "2.32.0";
 
-  src = fetchurl {
+  src = let
+    inherit (finalAttrs) pname version;
+  in fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.bz2";
     sha256 = "030gka96kzqg1r19b4xrmac89hf1xj1kr5p461yvbzfxh46qqf2n";
   };
@@ -14,9 +18,12 @@ stdenv.mkDerivation rec {
   propagatedBuildInputs = [ glib dbus libgcrypt ];
   nativeBuildInputs = [ pkg-config intltool ];
 
+  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+
   meta = {
+    pkgConfigModules = [ "gnome-keyring-1" ];
     inherit (glib.meta) platforms maintainers;
     homepage = "https://wiki.gnome.org/Projects/GnomeKeyring";
     license = with lib.licenses; [ gpl2 lgpl2 ];
   };
-}
+})
diff --git a/pkgs/development/libraries/libzip/default.nix b/pkgs/development/libraries/libzip/default.nix
index d3b7e5642546..6ba8eaf6f170 100644
--- a/pkgs/development/libraries/libzip/default.nix
+++ b/pkgs/development/libraries/libzip/default.nix
@@ -12,14 +12,15 @@
 , openssl
 , withZstd ? false
 , zstd
+, testers
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "libzip";
   version = "1.9.2";
 
   src = fetchurl {
-    url = "https://libzip.org/download/${pname}-${version}.tar.gz";
+    url = "https://libzip.org/download/${finalAttrs.pname}-${finalAttrs.version}.tar.gz";
     sha256 = "sha256-/Wp/dF3j1pz1YD7cnLM9KJDwGY5BUlXQmHoM8Q2CTG8=";
   };
 
@@ -41,11 +42,14 @@ stdenv.mkDerivation rec {
     patchShebangs regress
   '';
 
+  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+
   meta = with lib; {
     homepage = "https://libzip.org/";
     description = "A C library for reading, creating and modifying zip archives";
     license = licenses.bsd3;
+    pkgConfigModules = [ "libzip" ];
     platforms = platforms.unix;
     changelog = "https://github.com/nih-at/libzip/blob/v${version}/NEWS.md";
   };
-}
+})
diff --git a/pkgs/development/libraries/mesa-glu/default.nix b/pkgs/development/libraries/mesa-glu/default.nix
index d2e92da0ea96..1c08812db45c 100644
--- a/pkgs/development/libraries/mesa-glu/default.nix
+++ b/pkgs/development/libraries/mesa-glu/default.nix
@@ -1,10 +1,14 @@
-{ lib, stdenv, fetchurl, pkg-config, libGL, ApplicationServices }:
+{ lib, stdenv, fetchurl, pkg-config, libGL, ApplicationServices
+, testers
+}:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "glu";
   version = "9.0.2";
 
-  src = fetchurl {
+  src = let
+    inherit (finalAttrs) pname version;
+  in fetchurl {
     url = "https://mesa.freedesktop.org/archive/${pname}/${pname}-${version}.tar.xz";
     sha256 = "sha256-bnKA/1hcah2d/N8vykiSUWNLM3e/wzwp5AAkZqONAtQ=";
   };
@@ -15,11 +19,14 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "dev" ];
 
+  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+
   meta = {
     description = "OpenGL utility library";
     homepage = "https://cgit.freedesktop.org/mesa/glu/";
     license = lib.licenses.sgi-b-20;
+    pkgConfigModules = [ "glu" ];
     platforms = lib.platforms.unix;
     broken = stdenv.hostPlatform.isAndroid;
   };
-}
+})
diff --git a/pkgs/development/libraries/qt-5/modules/qtbase.nix b/pkgs/development/libraries/qt-5/modules/qtbase.nix
index 44f72701854c..b718f69610d4 100644
--- a/pkgs/development/libraries/qt-5/modules/qtbase.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtbase.nix
@@ -24,13 +24,14 @@
 , debug ? false
 , developerBuild ? false
 , decryptSslTraffic ? false
+, testers
 }:
 
 let
   debugSymbols = debug || developerBuild;
 in
 
-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
   pname = "qtbase";
   inherit qtCompatVersion src version;
   debug = debugSymbols;
@@ -338,12 +339,33 @@ stdenv.mkDerivation {
 
   setupHook = ../hooks/qtbase-setup-hook.sh;
 
+  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+
   meta = with lib; {
     homepage = "https://www.qt.io/";
     description = "A cross-platform application framework for C++";
     license = with licenses; [ fdl13Plus gpl2Plus lgpl21Plus lgpl3Plus ];
     maintainers = with maintainers; [ qknight ttuegel periklis bkchr ];
+    pkgConfigModules = [
+      "Qt5Concurrent"
+      "Qt5Core"
+      "Qt5DBus"
+      "Qt5Gui"
+      "Qt5Network"
+      "Qt5OpenGL"
+      "Qt5OpenGLExtensions"
+      "Qt5PrintSupport"
+      #"Qt5Qml"
+      #"Qt5QmlModels"
+      #"Qt5Quick"
+      #"Qt5QuickTest"
+      #"Qt5QuickWidgets"
+      "Qt5Sql"
+      "Qt5Test"
+      "Qt5Widgets"
+      "Qt5Xml"
+    ];
     platforms = platforms.unix;
   };
 
-}
+})
diff --git a/pkgs/development/libraries/science/math/cudnn/extension.nix b/pkgs/development/libraries/science/math/cudnn/extension.nix
index ac22faeabb02..dc538411211b 100644
--- a/pkgs/development/libraries/science/math/cudnn/extension.nix
+++ b/pkgs/development/libraries/science/math/cudnn/extension.nix
@@ -68,12 +68,47 @@ final: prev: let
         supportedCudaVersions = [ "10.2" ];
       }
     ];
+    "8.0.5" = [
+      rec {
+        fileVersion = "10.1";
+        fullVersion = "8.0.5.39";
+        hash = "sha256-kJCElSmIlrM6qVBjo0cfk8NmJ9esAcF9w211xl7qSgA=";
+        url = "${urlPrefix}/v${majorMinorPatch fullVersion}/cudnn-${fileVersion}-linux-x64-v${fullVersion}.tgz";
+        # https://docs.nvidia.com/deeplearning/cudnn/archives/cudnn-805/support-matrix/index.html
+        supportedCudaVersions = [ "10.1" ];
+      }
+      rec {
+        fileVersion = "10.2";
+        fullVersion = "8.0.5.39";
+        hash = "sha256-IfhMBcZ78eyFnnfDjM1b8VSWT6HDCPRJlZvkw1bjgvM=";
+        url = "${urlPrefix}/v${majorMinorPatch fullVersion}/cudnn-${fileVersion}-linux-x64-v${fullVersion}.tgz";
+        # https://docs.nvidia.com/deeplearning/cudnn/archives/cudnn-805/support-matrix/index.html
+        supportedCudaVersions = [ "10.2" ];
+      }
+      rec {
+        fileVersion = "11.0";
+        fullVersion = "8.0.5.39";
+        hash = "sha256-ThbueJXetKixwZS4ErpJWG730mkCBRQB03F1EYmKm3M=";
+        url = "${urlPrefix}/v${majorMinorPatch fullVersion}/cudnn-${fileVersion}-linux-x64-v${fullVersion}.tgz";
+        # https://docs.nvidia.com/deeplearning/cudnn/archives/cudnn-805/support-matrix/index.html
+        supportedCudaVersions = [ "11.0" ];
+      }
+      rec {
+        fileVersion = "11.1";
+        fullVersion = "8.0.5.39";
+        hash = "sha256-HQRr+nk5navMb2yxUHkYdUQ5RC6gyp4Pvs3URvmwDM4=";
+        url = "${urlPrefix}/v${majorMinorPatch fullVersion}/cudnn-${fileVersion}-linux-x64-v${fullVersion}.tgz";
+        # https://docs.nvidia.com/deeplearning/cudnn/archives/cudnn-805/support-matrix/index.html
+        supportedCudaVersions = [ "11.1" ];
+      }
+    ];
     "8.1.1" = [
       rec {
         fileVersion = "10.2";
         fullVersion = "8.1.1.33";
         hash = "sha256-Kkp7mabpv6aQ6xm7QeSVU/KnpJGls6v8rpAOFmxbbr0=";
         url = "${urlPrefix}/v${majorMinorPatch fullVersion}/cudnn-${fileVersion}-linux-x64-v${fullVersion}.tgz";
+        # https://docs.nvidia.com/deeplearning/cudnn/archives/cudnn-811/support-matrix/index.html#cudnn-versions-810-811
         supportedCudaVersions = [ "10.2" ];
       }
       rec {
@@ -81,38 +116,61 @@ final: prev: let
         fullVersion = "8.1.1.33";
         hash = "sha256-mKh4TpKGLyABjSDCgbMNSgzZUfk2lPZDPM9K6cUCumo=";
         url = "${urlPrefix}/v${majorMinorPatch fullVersion}/cudnn-${fileVersion}-linux-x64-v${fullVersion}.tgz";
-        supportedCudaVersions = [ "11.2" ];
+        # https://docs.nvidia.com/deeplearning/cudnn/archives/cudnn-811/support-matrix/index.html#cudnn-versions-810-811
+        supportedCudaVersions = [ "11.0" "11.1" "11.2" ];
       }
     ];
-    "8.3.2" = [
+    "8.2.4" = [
       rec {
         fileVersion = "10.2";
-        fullVersion = "8.3.2.44";
-        hash = "sha256-1vVu+cqM+PketzIQumw9ykm6REbBZhv6/lXB7EC2aaw=";
+        fullVersion = "8.2.4.15";
+        hash = "sha256-0jyUoxFaHHcRamwSfZF1+/WfcjNkN08mo0aZB18yIvE=";
+        url = "${urlPrefix}/v${majorMinorPatch fullVersion}/cudnn-${fileVersion}-linux-x64-v${fullVersion}.tgz";
+        # https://docs.nvidia.com/deeplearning/cudnn/archives/cudnn-824/support-matrix/index.html
+        supportedCudaVersions = [ "10.2" ];
+      }
+      rec {
+        fileVersion = "11.4";
+        fullVersion = "8.2.4.15";
+        hash = "sha256-Dl0t+JC5ln76ZhnaQhMQ2XMjVlp58FoajLm3Fluq0Nc=";
+        url = "${urlPrefix}/v${majorMinorPatch fullVersion}/cudnn-${fileVersion}-linux-x64-v${fullVersion}.tgz";
+        # https://docs.nvidia.com/deeplearning/cudnn/archives/cudnn-824/support-matrix/index.html
+        supportedCudaVersions = [  "11.0" "11.1" "11.2" "11.3" "11.4" ];
+      }
+    ];
+    "8.3.3" = [
+      rec {
+        fileVersion = "10.2";
+        fullVersion = "8.3.3.40";
+        hash = "sha256-2FVPKzLmKV1fyPOsJeaPlAWLAYyAHaucFD42gS+JJqs=";
         url = "${urlPrefix}/v${majorMinorPatch fullVersion}/local_installers/${fileVersion}/cudnn-linux-x86_64-${fullVersion}_cuda${fileVersion}-archive.tar.xz";
+        # https://docs.nvidia.com/deeplearning/cudnn/archives/cudnn-833/support-matrix/index.html
         supportedCudaVersions = [ "10.2" ];
       }
       rec {
         fileVersion = "11.5";
-        fullVersion = "8.3.2.44";
-        hash = "sha256-VQCVPAjF5dHd3P2iNPnvvdzb5DpTsm3AqCxyP6FwxFc=";
+        fullVersion = "8.3.3.40";
+        hash = "sha256-6r6Wx1zwPqT1N5iU2RTx+K4UzqsSGYnoSwg22Sf7dzE=";
         url = "${urlPrefix}/v${majorMinorPatch fullVersion}/local_installers/${fileVersion}/cudnn-linux-x86_64-${fullVersion}_cuda${fileVersion}-archive.tar.xz";
-        supportedCudaVersions = [ "11.0" "11.1" "11.2" "11.3" "11.4" "11.5" "11.6" "11.7" ];
+        # https://docs.nvidia.com/deeplearning/cudnn/archives/cudnn-833/support-matrix/index.html
+        supportedCudaVersions = [ "11.0" "11.1" "11.2" "11.3" "11.4" "11.5" "11.6" ];
       }
     ];
-    "8.4.0" = [
+    "8.4.1" = [
       rec {
         fileVersion = "10.2";
-        fullVersion = "8.4.0.27";
-        hash = "sha256-FMXjykJYJxmW0f2VnELRfFgs5Nmv9FH4RSRGnnhP0VQ=";
+        fullVersion = "8.4.1.50";
+        hash = "sha256-I88qMmU6lIiLVmaPuX7TTbisgTav839mssxUo3lQNjg=";
         url = "${urlPrefix}/v${majorMinorPatch fullVersion}/local_installers/${fileVersion}/cudnn-linux-x86_64-${fullVersion}_cuda${fileVersion}-archive.tar.xz";
+        # https://docs.nvidia.com/deeplearning/cudnn/archives/cudnn-841/support-matrix/index.html
         supportedCudaVersions = [ "10.2" ];
       }
       rec {
         fileVersion = "11.6";
-        fullVersion = "8.4.0.27";
-        hash = "sha256-0Zva/ZgAx50p5vb/+p+eLBDREy1sL/ELFZPgV+dN0FA=";
+        fullVersion = "8.4.1.50";
+        hash = "sha256-7JbSN22B/KQr3T1MPXBambKaBlurV/kgVhx2PinGfQE=";
         url = "${urlPrefix}/v${majorMinorPatch fullVersion}/local_installers/${fileVersion}/cudnn-linux-x86_64-${fullVersion}_cuda${fileVersion}-archive.tar.xz";
+        # https://docs.nvidia.com/deeplearning/cudnn/archives/cudnn-841/support-matrix/index.html
         supportedCudaVersions = [ "11.0" "11.1" "11.2" "11.3" "11.4" "11.5" "11.6" "11.7" ];
       }
     ];
@@ -122,6 +180,7 @@ final: prev: let
         fullVersion = "8.5.0.96";
         hash = "sha256-1mzhbbzR40WKkHnQLtJHhg0vYgf7G8a0OBcCwIOkJjM=";
         url = "${urlPrefix}/v${majorMinorPatch fullVersion}/local_installers/${fileVersion}/cudnn-linux-x86_64-${fullVersion}_cuda${major fileVersion}-archive.tar.xz";
+        # https://docs.nvidia.com/deeplearning/cudnn/archives/cudnn-850/support-matrix/index.html
         supportedCudaVersions = [ "10.2" ];
       }
       rec {
@@ -129,6 +188,7 @@ final: prev: let
         fullVersion = "8.5.0.96";
         hash = "sha256-VFSm/ZTwCHKMqumtrZk8ToXvNjAuJrzkO+p9RYpee20=";
         url = "${urlPrefix}/v${majorMinorPatch fullVersion}/local_installers/${fileVersion}/cudnn-linux-x86_64-${fullVersion}_cuda${major fileVersion}-archive.tar.xz";
+        # https://docs.nvidia.com/deeplearning/cudnn/archives/cudnn-850/support-matrix/index.html
         supportedCudaVersions = [ "11.0" "11.1" "11.2" "11.3" "11.4" "11.5" "11.6" "11.7" ];
       }
     ];
@@ -138,6 +198,7 @@ final: prev: let
         fullVersion = "8.6.0.163";
         hash = "sha256-t4sr/GrFqqdxu2VhaJQk5K1Xm/0lU4chXG8hVL09R9k=";
         url = "${urlPrefix}/v${majorMinorPatch fullVersion}/local_installers/${fileVersion}/cudnn-linux-x86_64-${fullVersion}_cuda${major fileVersion}-archive.tar.xz";
+        # https://docs.nvidia.com/deeplearning/cudnn/archives/cudnn-860/support-matrix/index.html
         supportedCudaVersions = [ "10.2" ];
       }
       rec {
@@ -145,6 +206,25 @@ final: prev: let
         fullVersion = "8.6.0.163";
         hash = "sha256-u8OW30cpTGV+3AnGAGdNYIyxv8gLgtz0VHBgwhcRFZ4=";
         url = "${urlPrefix}/v${majorMinorPatch fullVersion}/local_installers/${fileVersion}/cudnn-linux-x86_64-${fullVersion}_cuda${major fileVersion}-archive.tar.xz";
+        # https://docs.nvidia.com/deeplearning/cudnn/archives/cudnn-860/support-matrix/index.html
+        supportedCudaVersions = [ "11.0" "11.1" "11.2" "11.3" "11.4" "11.5" "11.6" "11.7" "11.8" ];
+      }
+    ];
+    "8.7.0" = [
+      rec {
+        fileVersion = "10.2";
+        fullVersion = "8.7.0.84";
+        hash = "sha256-bZhaqc8+GbPV2FQvvbbufd8VnEJgvfkICc2N3/gitRg=";
+        url = "${urlPrefix}/v${majorMinorPatch fullVersion}/local_installers/${fileVersion}/cudnn-linux-x86_64-${fullVersion}_cuda${major fileVersion}-archive.tar.xz";
+        # https://docs.nvidia.com/deeplearning/cudnn/archives/cudnn-870/support-matrix/index.html
+        supportedCudaVersions = [ "10.2" ];
+      }
+      rec {
+        fileVersion = "11.8";
+        fullVersion = "8.7.0.84";
+        hash = "sha256-l2xMunIzyXrnQAavq1Fyl2MAukD1slCiH4z3H1nJ920=";
+        url = "${urlPrefix}/v${majorMinorPatch fullVersion}/local_installers/${fileVersion}/cudnn-linux-x86_64-${fullVersion}_cuda${major fileVersion}-archive.tar.xz";
+        # https://docs.nvidia.com/deeplearning/cudnn/archives/cudnn-870/support-matrix/index.html
         supportedCudaVersions = [ "11.0" "11.1" "11.2" "11.3" "11.4" "11.5" "11.6" "11.7" "11.8" ];
       }
     ];
@@ -153,17 +233,17 @@ final: prev: let
   # Default attributes
   cuDnnDefaultVersion = {
     "10.0" = "7.4.2";
-    "10.1" = "7.6.5";
-    "10.2" = "8.6.0";
-    "11.0" = "8.6.0";
-    "11.1" = "8.6.0";
-    "11.2" = "8.6.0";
-    "11.3" = "8.6.0";
-    "11.4" = "8.6.0";
-    "11.5" = "8.6.0";
-    "11.6" = "8.6.0";
-    "11.7" = "8.6.0";
-    "11.8" = "8.6.0";
-  }.${cudaVersion} or "8.6.0";
+    "10.1" = "8.0.5";
+    "10.2" = "8.7.0";
+    "11.0" = "8.7.0";
+    "11.1" = "8.7.0";
+    "11.2" = "8.7.0";
+    "11.3" = "8.7.0";
+    "11.4" = "8.7.0";
+    "11.5" = "8.7.0";
+    "11.6" = "8.7.0";
+    "11.7" = "8.7.0";
+    "11.8" = "8.7.0";
+  }.${cudaVersion} or "8.7.0";
 
 in cuDnnPackages
diff --git a/pkgs/development/libraries/tevent/default.nix b/pkgs/development/libraries/tevent/default.nix
index f10235650c4a..7b798d00b01e 100644
--- a/pkgs/development/libraries/tevent/default.nix
+++ b/pkgs/development/libraries/tevent/default.nix
@@ -10,6 +10,7 @@
 , docbook_xml_dtd_42
 , which
 , wafHook
+, libxcrypt
 }:
 
 stdenv.mkDerivation rec {
@@ -36,6 +37,7 @@ stdenv.mkDerivation rec {
     cmocka
     readline # required to build python
     talloc
+    libxcrypt
   ];
 
   # otherwise the configure script fails with
@@ -52,6 +54,11 @@ stdenv.mkDerivation rec {
     "--builtin-libraries=replace"
   ];
 
+  # python-config from build Python gives incorrect values when cross-compiling.
+  # If python-config is not found, the build falls back to using the sysconfig
+  # module, which works correctly in all cases.
+  PYTHON_CONFIG = "/invalid";
+
   meta = with lib; {
     description = "An event system based on the talloc memory management library";
     homepage = "https://tevent.samba.org/";
diff --git a/pkgs/development/libraries/wasilibc/default.nix b/pkgs/development/libraries/wasilibc/default.nix
index d978e911c3a8..8a8c4ec059ef 100644
--- a/pkgs/development/libraries/wasilibc/default.nix
+++ b/pkgs/development/libraries/wasilibc/default.nix
@@ -8,7 +8,7 @@
 
 let
   pname = "wasilibc";
-  version = "17";
+  version = "19";
 in
 stdenv.mkDerivation {
   inherit pname version;
@@ -17,7 +17,7 @@ stdenv.mkDerivation {
     owner = "WebAssembly";
     repo = "wasi-libc";
     rev = "refs/tags/wasi-sdk-${version}";
-    hash = "sha256-h2X78icCmnn6Y6baOxp8Xm7F2+RZZgaV2fszzi2q/iA=";
+    hash = "sha256-yQSKoSil/C/1lIHwEO9eQKC/ye3PJIFGYjHyNDn61y4=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/libraries/wlroots/default.nix b/pkgs/development/libraries/wlroots/default.nix
index 9d03d193d81c..8e0ebab220af 100644
--- a/pkgs/development/libraries/wlroots/default.nix
+++ b/pkgs/development/libraries/wlroots/default.nix
@@ -121,8 +121,8 @@ rec {
   };
 
   wlroots_0_16 = generic {
-    version = "0.16.1";
-    hash = "sha256-UyPN7zmytre4emwx/ztZ4JefXHwixPV6UEEqnhSLbIY=";
+    version = "0.16.2";
+    hash = "sha256-JeDDYinio14BOl6CbzAPnJDOnrk4vgGNMN++rcy2ItQ=";
     extraBuildInputs = [ vulkan-loader ];
     extraNativeBuildInputs = [ glslang ];
     extraPatch = ''
diff --git a/pkgs/development/lisp-modules-new/ql.nix b/pkgs/development/lisp-modules-new/ql.nix
index aa04a8dce2e2..f65a55dae117 100644
--- a/pkgs/development/lisp-modules-new/ql.nix
+++ b/pkgs/development/lisp-modules-new/ql.nix
@@ -51,6 +51,9 @@ let
       nativeBuildInputs = [ pkgs.libdevil ];
       nativeLibs = [ pkgs.libdevil ];
     };
+    cl-freeimage = pkg: {
+      nativeLibs = [ freeimage ];
+    };
     cl-freetype2 = pkg: {
       nativeLibs = [ freetype ];
       nativeBuildInputs = [ freetype ];
@@ -144,6 +147,7 @@ let
     };
     classimp = pkg: {
       nativeLibs = [ assimp ];
+      meta.broken = true; # Requires assimp ≤ 5.0.x.
     };
     clsql-postgresql = pkg: {
       nativeLibs = [ postgresql.lib ];
diff --git a/pkgs/development/python-modules/acquire/default.nix b/pkgs/development/python-modules/acquire/default.nix
index b1b13bf581d1..c3b32bbc5dee 100644
--- a/pkgs/development/python-modules/acquire/default.nix
+++ b/pkgs/development/python-modules/acquire/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "acquire";
-  version = "3.3";
+  version = "3.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -25,8 +25,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "fox-it";
     repo = "acquire";
-    rev = version;
-    hash = "sha256-S7EZZxNcoLcZyyRNGlZj6nGoCAlqCxNdh3azIVKvOTM=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-VkO+XLIC/UQzvfLsgbKcx9i8OxTC6J32nkxPHWWn7m8=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
@@ -64,6 +64,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Tool to quickly gather forensic artifacts from disk images or a live system";
     homepage = "https://github.com/fox-it/acquire";
+    changelog = "https://github.com/fox-it/acquire/releases/tag/${version}";
     license = licenses.agpl3Only;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/aliyun-python-sdk-cdn/default.nix b/pkgs/development/python-modules/aliyun-python-sdk-cdn/default.nix
index 6d0a9d5eb2a4..ddbd7f1e2891 100644
--- a/pkgs/development/python-modules/aliyun-python-sdk-cdn/default.nix
+++ b/pkgs/development/python-modules/aliyun-python-sdk-cdn/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "aliyun-python-sdk-cdn";
-  version = "3.8.1";
+  version = "3.8.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-bcAaFwAS9xAbCLtqYtSiALHtlGklHFgGXpgiZZpR6no=";
+    hash = "sha256-pNWqow396BB5cC1dOhDelykjqeWFN+IKosKEDu5nB1o=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/aliyun-python-sdk-iot/default.nix b/pkgs/development/python-modules/aliyun-python-sdk-iot/default.nix
index 6a5802c388f9..06c56116de4e 100644
--- a/pkgs/development/python-modules/aliyun-python-sdk-iot/default.nix
+++ b/pkgs/development/python-modules/aliyun-python-sdk-iot/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "aliyun-python-sdk-iot";
-  version = "8.49.0";
+  version = "8.50.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-POrDx4xXCIOBU4hvXu03XcZI2F6xHsjHNJRBaGFC8U8=";
+    hash = "sha256-tFI6iPvKWp69PKvkBrMQrkMZD03VHhLIIDy0VI5XLEA=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/blis/default.nix b/pkgs/development/python-modules/blis/default.nix
index 69bc78ddda65..2a0e2183cba5 100644
--- a/pkgs/development/python-modules/blis/default.nix
+++ b/pkgs/development/python-modules/blis/default.nix
@@ -50,6 +50,5 @@ buildPythonPackage rec {
     homepage = "https://github.com/explosion/cython-blis";
     license = licenses.bsd3;
     maintainers = with maintainers; [ ];
-    platforms = platforms.x86_64;
   };
 }
diff --git a/pkgs/development/python-modules/boschshcpy/default.nix b/pkgs/development/python-modules/boschshcpy/default.nix
index 2115eb273d66..765c52dddc07 100644
--- a/pkgs/development/python-modules/boschshcpy/default.nix
+++ b/pkgs/development/python-modules/boschshcpy/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "boschshcpy";
-  version = "0.2.53";
+  version = "0.2.54";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "tschamm";
     repo = pname;
     rev = version;
-    sha256 = "sha256-V7FNuVXKJqIOsDqwg6Bn2Vb9QnuQ1XYzE4m0x2ipXW8=";
+    sha256 = "sha256-1MoC69klHIHMmvQSS8bnuEQGm6IloyzR0RcROIx0GNI=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/buildbot/plugins.nix b/pkgs/development/python-modules/buildbot/plugins.nix
index ee36e10531f1..e6f78dfc0bd7 100644
--- a/pkgs/development/python-modules/buildbot/plugins.nix
+++ b/pkgs/development/python-modules/buildbot/plugins.nix
@@ -1,4 +1,4 @@
-{ lib, buildPythonPackage, fetchPypi, buildbot-pkg, mock }:
+{ lib, buildPythonPackage, fetchPypi, buildbot-pkg, mock, cairosvg, klein, jinja2 }:
 
 {
   www = buildPythonPackage rec {
@@ -115,4 +115,28 @@
       license = licenses.gpl2;
     };
   };
+
+  badges = buildPythonPackage rec {
+    pname = "buildbot-badges";
+    inherit (buildbot-pkg) version;
+
+    src = fetchPypi {
+      inherit pname version;
+      sha256 = "sha256-H0Dn+uTtFyZgyqbk3QQEc5t7CJovyzU+XuCoTe4Ajug=";
+    };
+
+    buildInputs = [ buildbot-pkg ];
+    propagatedBuildInputs = [ cairosvg klein jinja2 ];
+
+    # No tests
+    doCheck = false;
+
+    meta = with lib; {
+      homepage = "https://buildbot.net/";
+      description = "Buildbot Badges Plugin";
+      maintainers = with maintainers; [ julienmalka ];
+      license = licenses.gpl2;
+    };
+  };
+
 }
diff --git a/pkgs/development/python-modules/dissect-cim/default.nix b/pkgs/development/python-modules/dissect-cim/default.nix
index e13da65aee19..ccd426f94bad 100644
--- a/pkgs/development/python-modules/dissect-cim/default.nix
+++ b/pkgs/development/python-modules/dissect-cim/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-cim";
-  version = "3.3";
+  version = "3.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -19,8 +19,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "fox-it";
     repo = "dissect.cim";
-    rev = version;
-    hash = "sha256-d02P6RXIiriOujGns9mOkyiJLNQFNTTW61kInzS17Y4=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-RlkTsAvX+9c69JBy+DZbcCfAvcCnWDisgdQQMBkphtg=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
@@ -46,6 +46,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Dissect module implementing a parser for the Windows Common Information Model (CIM) database";
     homepage = "https://github.com/fox-it/dissect.cim";
+    changelog = "https://github.com/fox-it/dissect.cim/releases/tag/${version}";
     license = licenses.agpl3Only;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/dissect-clfs/default.nix b/pkgs/development/python-modules/dissect-clfs/default.nix
index 3e807d3bd260..d73d2145985f 100644
--- a/pkgs/development/python-modules/dissect-clfs/default.nix
+++ b/pkgs/development/python-modules/dissect-clfs/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-clfs";
-  version = "1.2";
+  version = "1.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -18,8 +18,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "fox-it";
     repo = "dissect.clfs";
-    rev = version;
-    hash = "sha256-1nh81ppJpYre3y7hJ9xS+TNU1NfTH+9NMHdV55kPEXI=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-QzEcJvujkNVUXtqu7yY7sJ/U55jzGBbUHxOVDxg4vac=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
@@ -44,6 +44,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Dissect module implementing a parser for the CLFS (Common Log File System) file system";
     homepage = "https://github.com/fox-it/dissect.clfs";
+    changelog = "https://github.com/fox-it/dissect.clfs/releases/tag/${version}";
     license = licenses.agpl3Only;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/dissect-cstruct/default.nix b/pkgs/development/python-modules/dissect-cstruct/default.nix
index 722e1a75f775..6b0f74f16bd7 100644
--- a/pkgs/development/python-modules/dissect-cstruct/default.nix
+++ b/pkgs/development/python-modules/dissect-cstruct/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-cstruct";
-  version = "3.3";
+  version = "3.5";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -17,8 +17,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "fox-it";
     repo = "dissect.cstruct";
-    rev = version;
-    hash = "sha256-8OxAsrECgsQf8+EaZtJ3XNhwdhBI08o3r+xhD/D1NhQ=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-tEWqw3ySF1ebOMztZwAlkTiY0mFCzTM58wD0XDfljFA=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
@@ -39,6 +39,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Dissect module implementing a parser for C-like structures";
     homepage = "https://github.com/fox-it/dissect.cstruct";
+    changelog = "https://github.com/fox-it/dissect.cstruct/releases/tag/${version}";
     license = licenses.agpl3Only;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/dissect-esedb/default.nix b/pkgs/development/python-modules/dissect-esedb/default.nix
index 74c8bdf9ec70..e2188b70ff75 100644
--- a/pkgs/development/python-modules/dissect-esedb/default.nix
+++ b/pkgs/development/python-modules/dissect-esedb/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-esedb";
-  version = "3.3";
+  version = "3.5";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -19,8 +19,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "fox-it";
     repo = "dissect.esedb";
-    rev = version;
-    hash = "sha256-ErPihjAcukMerCAxLdDQVUApeNdFnFn0Zejo3LhgZFc=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-wTzr9b95jhPbZVWM/C9T1OSBLK39sCIjbsNK/6Z83JE=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
@@ -46,6 +46,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Dissect module implementing a parser for Microsofts Extensible Storage Engine Database (ESEDB)";
     homepage = "https://github.com/fox-it/dissect.esedb";
+    changelog = "https://github.com/fox-it/dissect.esedb/releases/tag/${version}";
     license = licenses.agpl3Only;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/dissect-etl/default.nix b/pkgs/development/python-modules/dissect-etl/default.nix
index ffde95490763..6c0bc54c42fb 100644
--- a/pkgs/development/python-modules/dissect-etl/default.nix
+++ b/pkgs/development/python-modules/dissect-etl/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-etl";
-  version = "3.2";
+  version = "3.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -19,8 +19,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "fox-it";
     repo = "dissect.etl";
-    rev = version;
-    hash = "sha256-s3Ls8tuqp/COBF+WV9RRyfo7FAqPcXmBZ08gHZMPzOU=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-rEYWTMBzMyaADqT1Pp5z1J2Uf/t/GeX/FAnZVnaycYs=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
@@ -46,6 +46,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Dissect module implementing a parser for Event Trace Log (ETL) files";
     homepage = "https://github.com/fox-it/dissect.etl";
+    changelog = "https://github.com/fox-it/dissect.etl/releases/tag/${version}";
     license = licenses.agpl3Only;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/dissect-eventlog/default.nix b/pkgs/development/python-modules/dissect-eventlog/default.nix
index 7fa3e68cabc6..00021187679e 100644
--- a/pkgs/development/python-modules/dissect-eventlog/default.nix
+++ b/pkgs/development/python-modules/dissect-eventlog/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-eventlog";
-  version = "3.2";
+  version = "3.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -19,8 +19,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "fox-it";
     repo = "dissect.eventlog";
-    rev = version;
-    hash = "sha256-emNGZs/5LWD29xE5BmXQKQfkZApLZlGs6KNIqobaKvM=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-PbU9Rd0D+xdleTIMAV+esw1WynWU4++8KeXlHS9yiJs=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
@@ -46,6 +46,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Dissect module implementing parsers for the Windows EVT, EVTX and WEVT log file formats";
     homepage = "https://github.com/fox-it/dissect.eventlog";
+    changelog = "https://github.com/fox-it/dissect.eventlog/releases/tag/${version}";
     license = licenses.agpl3Only;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/dissect-evidence/default.nix b/pkgs/development/python-modules/dissect-evidence/default.nix
index f6608aac9f71..ed3cbb56eb07 100644
--- a/pkgs/development/python-modules/dissect-evidence/default.nix
+++ b/pkgs/development/python-modules/dissect-evidence/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-evidence";
-  version = "3.2";
+  version = "3.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -19,8 +19,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "fox-it";
     repo = "dissect.evidence";
-    rev = version;
-    hash = "sha256-rm9IjsXHz4GS8M/oPaDoaxjwqMMtD0qjRtQ3vFJQyQY=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-R4ua7JeT09GkoBwM2YGf2T0PJXhldUpqAS3xsB9L79c=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
@@ -46,6 +46,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Dissect module implementing a parsers for various forensic evidence file containers";
     homepage = "https://github.com/fox-it/dissect.evidence";
+    changelog = "https://github.com/fox-it/dissect.evidence/releases/tag/${version}";
     license = licenses.agpl3Only;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/dissect-executable/default.nix b/pkgs/development/python-modules/dissect-executable/default.nix
new file mode 100644
index 000000000000..0b932de9a2a2
--- /dev/null
+++ b/pkgs/development/python-modules/dissect-executable/default.nix
@@ -0,0 +1,48 @@
+{ lib
+, buildPythonPackage
+, dissect-cstruct
+, dissect-util
+, fetchFromGitHub
+, setuptools
+, setuptools-scm
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "dissect-executable";
+  version = "1.1";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "fox-it";
+    repo = "dissect.executable";
+    rev = "refs/tags/${version}";
+    hash = "sha256-c58g2L3B/3/pC+iyXphYsjhpBs0I0Q64B8+rv5k1dtg=";
+  };
+
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = [
+    dissect-cstruct
+    dissect-util
+  ];
+
+  pythonImportsCheck = [
+    "dissect.executable"
+  ];
+
+  meta = with lib; {
+    description = "Dissect module implementing a parser for various executable formats such as PE, ELF and Macho-O";
+    homepage = "https://github.com/fox-it/dissect.executable";
+    changelog = "https://github.com/fox-it/dissect.executable/releases/tag/${version}";
+    license = licenses.agpl3Only;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/dissect-extfs/default.nix b/pkgs/development/python-modules/dissect-extfs/default.nix
index 45aea2685d59..f337d3ae8efd 100644
--- a/pkgs/development/python-modules/dissect-extfs/default.nix
+++ b/pkgs/development/python-modules/dissect-extfs/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-extfs";
-  version = "3.2";
+  version = "3.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -19,8 +19,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "fox-it";
     repo = "dissect.extfs";
-    rev = version;
-    hash = "sha256-KGqmguKwCSQw2USKuWFMQCz+D8XMv5W12eJfUxgz324=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-VCPNY/4SUkFpLuSs2Cxu8u5qt2sQ9VGlfdPssybxhk8=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
@@ -46,6 +46,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Dissect module implementing a parser for the ExtFS file system";
     homepage = "https://github.com/fox-it/dissect.extfs";
+    changelog = "https://github.com/fox-it/dissect.extfs/releases/tag/${version}";
     license = licenses.agpl3Only;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/dissect-fat/default.nix b/pkgs/development/python-modules/dissect-fat/default.nix
index 47b2cafdb813..b384fb5cba9f 100644
--- a/pkgs/development/python-modules/dissect-fat/default.nix
+++ b/pkgs/development/python-modules/dissect-fat/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-fat";
-  version = "3.2";
+  version = "3.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -18,8 +18,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "fox-it";
     repo = "dissect.fat";
-    rev = version;
-    hash = "sha256-kqdVgUkvW9I5CI4T9b7VeX6hPm3Ufwrdnhmo1jR5Fdg=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-v4GjI6DdDfxO3kGZ7Z5C6mkdRj9axsT9mvlSOQyiMBw=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
@@ -44,6 +44,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Dissect module implementing a parser for the FAT file system";
     homepage = "https://github.com/fox-it/dissect.fat";
+    changelog = "https://github.com/fox-it/dissect.fat/releases/tag/${version}";
     license = licenses.agpl3Only;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/dissect-ffs/default.nix b/pkgs/development/python-modules/dissect-ffs/default.nix
index fd4d4372e2ac..37f95807fcc6 100644
--- a/pkgs/development/python-modules/dissect-ffs/default.nix
+++ b/pkgs/development/python-modules/dissect-ffs/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-ffs";
-  version = "3.2";
+  version = "3.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -19,8 +19,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "fox-it";
     repo = "dissect.ffs";
-    rev = version;
-    hash = "sha256-kcYSoY3a8ljY9LWzOUekLBzokE+wJrG1KEr0p5CCj0U=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-nGxojXslFVcqU+9StBOacmCyoZJJB4B4OIvql/cbcZE=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
@@ -46,6 +46,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Dissect module implementing a parser for the FFS file system";
     homepage = "https://github.com/fox-it/dissect.ffs";
+    changelog = "https://github.com/fox-it/dissect.ffs/releases/tag/${version}";
     license = licenses.agpl3Only;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/dissect-hypervisor/default.nix b/pkgs/development/python-modules/dissect-hypervisor/default.nix
index 92c885907f15..b5ee17918a6f 100644
--- a/pkgs/development/python-modules/dissect-hypervisor/default.nix
+++ b/pkgs/development/python-modules/dissect-hypervisor/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-hypervisor";
-  version = "3.3";
+  version = "3.5";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -21,8 +21,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "fox-it";
     repo = "dissect.hypervisor";
-    rev = version;
-    hash = "sha256-Q7lbFr+gc6inQEJT54DXjpyyis5GxrKQHI5qqa1INKo=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-dWaU3v2QcoqVIygeufy0ZYVliBE1tijV3qEsvCOIarM=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
@@ -55,6 +55,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Dissect module implementing parsers for various hypervisor disk, backup and configuration files";
     homepage = "https://github.com/fox-it/dissect.hypervisor";
+    changelog = "https://github.com/fox-it/dissect.hypervisor/releases/tag/${version}";
     license = licenses.agpl3Only;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/dissect-ntfs/default.nix b/pkgs/development/python-modules/dissect-ntfs/default.nix
index 1b27129e9d58..611f9b56226e 100644
--- a/pkgs/development/python-modules/dissect-ntfs/default.nix
+++ b/pkgs/development/python-modules/dissect-ntfs/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-ntfs";
-  version = "3.2";
+  version = "3.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -19,8 +19,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "fox-it";
     repo = "dissect.ntfs";
-    rev = version;
-    hash = "sha256-4QEsWTdqlHIP1a9g45+zv1SdHY0Ofsr7Rf1z+ctssSw=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-xhtAN0QaLLbQk/aAd9PlEkyW39w33iPaQtGzbouI6hc=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
@@ -51,6 +51,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Dissect module implementing a parser for the NTFS file system";
     homepage = "https://github.com/fox-it/dissect.ntfs";
+    changelog = "https://github.com/fox-it/dissect.ntfs/releases/tag/${version}";
     license = licenses.agpl3Only;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/dissect-ole/default.nix b/pkgs/development/python-modules/dissect-ole/default.nix
index fb5ead471abb..5540c62a8baf 100644
--- a/pkgs/development/python-modules/dissect-ole/default.nix
+++ b/pkgs/development/python-modules/dissect-ole/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-ole";
-  version = "3.2";
+  version = "3.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -18,8 +18,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "fox-it";
     repo = "dissect.ole";
-    rev = version;
-    hash = "sha256-0bIlnRFKBvSXnBIU4+1V7WzyXCvulUpNSXG1Rj2k4jY=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-m2+AcKp8rH+VQIdT85oKoA8QoyNQOmrZ2DvBELZnEqM=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
@@ -44,6 +44,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Dissect module implementing a parser for the Object Linking & Embedding (OLE) format";
     homepage = "https://github.com/fox-it/dissect.ole";
+    changelog = "https://github.com/fox-it/dissect.ole/releases/tag/${version}";
     license = licenses.agpl3Only;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/dissect-regf/default.nix b/pkgs/development/python-modules/dissect-regf/default.nix
index d731aeb68a08..c453cbf9a439 100644
--- a/pkgs/development/python-modules/dissect-regf/default.nix
+++ b/pkgs/development/python-modules/dissect-regf/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-regf";
-  version = "3.2";
+  version = "3.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -19,8 +19,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "fox-it";
     repo = "dissect.regf";
-    rev = version;
-    hash = "sha256-hSMdgGkSmFDAiO6C1xTJDmKClHwrGc887wqO3/5NZn4=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-3QJ1N9LukvEa74rndN/Sj6Vq10YJVBsOGdlMzR9TrKA=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
@@ -46,6 +46,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Dissect module implementing a parser for Windows registry file format";
     homepage = "https://github.com/fox-it/dissect.regf";
+    changelog = "https://github.com/fox-it/dissect.regf/releases/tag/${version}";
     license = licenses.agpl3Only;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/dissect-shellitem/default.nix b/pkgs/development/python-modules/dissect-shellitem/default.nix
index 4a4b3802128e..c0f4228593a6 100644
--- a/pkgs/development/python-modules/dissect-shellitem/default.nix
+++ b/pkgs/development/python-modules/dissect-shellitem/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-shellitem";
-  version = "3.2";
+  version = "3.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -19,8 +19,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "fox-it";
     repo = "dissect.shellitem";
-    rev = version;
-    hash = "sha256-z0/KSOgo5Gnl4MLOY5eUPHlI/8dCyYaEEiKMmkP7cgg=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-flTv2Y+UwMTQnvqRS/pZRPkTsIjvCAp7B4rKAQPOJL4=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
@@ -46,6 +46,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Dissect module implementing a parser for the Shellitem structures";
     homepage = "https://github.com/fox-it/dissect.shellitem";
+    changelog = "https://github.com/fox-it/dissect.shellitem/releases/tag/${version}";
     license = licenses.agpl3Only;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/dissect-sql/default.nix b/pkgs/development/python-modules/dissect-sql/default.nix
index 55e52c9c9120..69bfbb4a659e 100644
--- a/pkgs/development/python-modules/dissect-sql/default.nix
+++ b/pkgs/development/python-modules/dissect-sql/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-sql";
-  version = "3.2";
+  version = "3.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -19,8 +19,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "fox-it";
     repo = "dissect.sql";
-    rev = version;
-    hash = "sha256-yw0EUxlgm7/3FpecGGvxkukudyFMv0fmPbOLJqc2tC0=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-sIXFEckHFr9H4oGFw8uuC+c54PR8ZbQxJKb5x5EixxQ=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
@@ -46,6 +46,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Dissect module implementing a parsers for the SQLite database file format";
     homepage = "https://github.com/fox-it/dissect.sql";
+    changelog = "https://github.com/fox-it/dissect.sql/releases/tag/${version}";
     license = licenses.agpl3Only;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/dissect-squashfs/default.nix b/pkgs/development/python-modules/dissect-squashfs/default.nix
new file mode 100644
index 000000000000..1413b352f03c
--- /dev/null
+++ b/pkgs/development/python-modules/dissect-squashfs/default.nix
@@ -0,0 +1,59 @@
+{ lib
+, buildPythonPackage
+, dissect-cstruct
+, dissect-util
+, fetchFromGitHub
+, lz4
+, python-lzo
+, pythonOlder
+, setuptools
+, setuptools-scm
+, zstandard
+}:
+
+buildPythonPackage rec {
+  pname = "dissect-squashfs";
+  version = "1.0";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "fox-it";
+    repo = "dissect.squashfs";
+    rev = "refs/tags/${version}";
+    hash = "sha256-bDR6GAgl1dOhZ3fWA7E27KS6pj9AXInNxwmwNXXV3lc=";
+  };
+
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = [
+    dissect-cstruct
+    dissect-util
+  ];
+
+  passthru.optional-dependencies = {
+    full = [
+      lz4
+      python-lzo
+      zstandard
+    ];
+  };
+
+  pythonImportsCheck = [
+    "dissect.squashfs"
+  ];
+
+  meta = with lib; {
+    description = "Dissect module implementing a parser for the SquashFS file system";
+    homepage = "https://github.com/fox-it/dissect.squashfs";
+    changelog = "https://github.com/fox-it/dissect.squashfs/releases/tag/${version}";
+    license = licenses.agpl3Only;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/dissect-target/default.nix b/pkgs/development/python-modules/dissect-target/default.nix
index 0c69d93ef3ee..65786ef0a9e2 100644
--- a/pkgs/development/python-modules/dissect-target/default.nix
+++ b/pkgs/development/python-modules/dissect-target/default.nix
@@ -24,6 +24,7 @@
 , flow-record
 , fusepy
 , ipython
+, pycryptodome
 , pytestCheckHook
 , pythonOlder
 , pyyaml
@@ -36,7 +37,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-target";
-  version = "3.4";
+  version = "3.7";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -44,8 +45,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "fox-it";
     repo = "dissect.target";
-    rev = version;
-    hash = "sha256-QwEznweETwDTuTctOnq0n27JYXC9BO5l6BYpXsMRVq4=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-jFQ8BxCC4PW135igfXA5EmlWYIZ0zF12suiUMiLbArA=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
@@ -56,6 +57,7 @@ buildPythonPackage rec {
   ];
 
   propagatedBuildInputs = [
+    defusedxml
     dissect-cstruct
     dissect-eventlog
     dissect-evidence
@@ -71,7 +73,6 @@ buildPythonPackage rec {
   passthru.optional-dependencies = {
     full = [
       asn1crypto
-      defusedxml
       dissect-cim
       dissect-clfs
       dissect-esedb
@@ -84,6 +85,7 @@ buildPythonPackage rec {
       dissect-xfs
       fusepy
       ipython
+      pycryptodome
       pyyaml
       yara-python
       zstandard
@@ -101,11 +103,14 @@ buildPythonPackage rec {
   disabledTests = [
     # Test requires rdump
     "test_exec_target_command"
+    # Issue with tar file
+    "test_tar_sensitive_drive_letter"
   ];
 
   meta = with lib; {
     description = "Dissect module that provides a programming API and command line tools";
     homepage = "https://github.com/fox-it/dissect.target";
+    changelog = "https://github.com/fox-it/dissect.target/releases/tag/${version}";
     license = licenses.agpl3Only;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/dissect-thumbcache/default.nix b/pkgs/development/python-modules/dissect-thumbcache/default.nix
index ca48d44d344d..8a47b9eeaab0 100644
--- a/pkgs/development/python-modules/dissect-thumbcache/default.nix
+++ b/pkgs/development/python-modules/dissect-thumbcache/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-thumbcache";
-  version = "1.1";
+  version = "1.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -19,8 +19,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "fox-it";
     repo = "dissect.thumbcache";
-    rev = version;
-    hash = "sha256-4yUVJwIQniE9AAtAgzHczOZfyWZly86JKc0Qh3byYf4=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-lTtTZQgEvgaVoNPnVeRGO/BQU/8RfQ2ktljSBflhlOw=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
@@ -51,6 +51,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Dissect module implementing a parser for the Windows thumbcache";
     homepage = "https://github.com/fox-it/dissect.thumbcache";
+    changelog = "https://github.com/fox-it/dissect.thumbcache/releases/tag/${version}";
     license = licenses.agpl3Only;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/dissect-util/default.nix b/pkgs/development/python-modules/dissect-util/default.nix
index cac7233b9efb..b816656a53b1 100644
--- a/pkgs/development/python-modules/dissect-util/default.nix
+++ b/pkgs/development/python-modules/dissect-util/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-util";
-  version = "3.3";
+  version = "3.6";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -17,8 +17,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "fox-it";
     repo = "dissect.util";
-    rev = version;
-    hash = "sha256-HGlWyRjvXu1d0n1PPkMyl8NNRRhsjMzXZJMS1MjdTWQ=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-hijwu2QT9xJZ1F0wz5NO0mAVe/VA3JcPmoEYQiQRLtM=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
@@ -39,6 +39,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Dissect module implementing various utility functions for the other Dissect modules";
     homepage = "https://github.com/fox-it/dissect.util";
+    changelog = "https://github.com/fox-it/dissect.util/releases/tag/${version}";
     license = licenses.agpl3Only;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/dissect-vmfs/default.nix b/pkgs/development/python-modules/dissect-vmfs/default.nix
index a520ce8c05a5..0834e967b2d6 100644
--- a/pkgs/development/python-modules/dissect-vmfs/default.nix
+++ b/pkgs/development/python-modules/dissect-vmfs/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-vmfs";
-  version = "3.2";
+  version = "3.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -19,8 +19,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "fox-it";
     repo = "dissect.vmfs";
-    rev = version;
-    hash = "sha256-6ZNybNRL97Zz6O32r4X0K3/+vZF3Qid98rj2pgGWgvI=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-9+1geOJ+vzy6+eGibX+BUHbtzyLhq3MPBsad98ykn3I=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
@@ -46,6 +46,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Dissect module implementing a parser for the VMFS file system";
     homepage = "https://github.com/fox-it/dissect.vmfs";
+    changelog = "https://github.com/fox-it/dissect.vmfs/releases/tag/${version}";
     license = licenses.agpl3Only;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/dissect-volume/default.nix b/pkgs/development/python-modules/dissect-volume/default.nix
index cff900efbefa..9053d83f0e49 100644
--- a/pkgs/development/python-modules/dissect-volume/default.nix
+++ b/pkgs/development/python-modules/dissect-volume/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-volume";
-  version = "3.2";
+  version = "3.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -19,8 +19,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "fox-it";
     repo = "dissect.volume";
-    rev = version;
-    hash = "sha256-NwY4J1FSCvNIoH9uUHJVlM3jJt6A9CZ7uCWhlIdYztM=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-5O2ywPJi9M7gvcreS7DrW2qJ32MoR3Qero7jJ5gv0ow=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
@@ -46,6 +46,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Dissect module implementing various utility functions for the other Dissect modules";
     homepage = "https://github.com/fox-it/dissect.volume";
+    changelog = "https://github.com/fox-it/dissect.volume/releases/tag/${version}";
     license = licenses.agpl3Only;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/dissect-xfs/default.nix b/pkgs/development/python-modules/dissect-xfs/default.nix
index 60a7ee1abb2f..772e223c5979 100644
--- a/pkgs/development/python-modules/dissect-xfs/default.nix
+++ b/pkgs/development/python-modules/dissect-xfs/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-xfs";
-  version = "3.2";
+  version = "3.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -19,8 +19,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "fox-it";
     repo = "dissect.xfs";
-    rev = version;
-    hash = "sha256-S05Y+Oe1q4DcTR9al2K82Q41EP0FnDGUp1gfzYiS/Yk=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-OasoZ+HGvW8PPWDBvKdrfiE3FqnXPx0xjBVFWLBYHwQ=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
@@ -46,6 +46,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Dissect module implementing a parser for the XFS file system";
     homepage = "https://github.com/fox-it/dissect.xfs";
+    changelog = "https://github.com/fox-it/dissect.xfs/releases/tag/${version}";
     license = licenses.agpl3Only;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/dissect/default.nix b/pkgs/development/python-modules/dissect/default.nix
index e6da0a1a6a8e..59db158b6636 100644
--- a/pkgs/development/python-modules/dissect/default.nix
+++ b/pkgs/development/python-modules/dissect/default.nix
@@ -10,12 +10,14 @@
 , dissect-extfs
 , dissect-fat
 , dissect-ffs
+, dissect-executable
 , dissect-hypervisor
 , dissect-ntfs
 , dissect-ole
 , dissect-regf
 , dissect-shellitem
 , dissect-sql
+, dissect-squashfs
 , dissect-target
 , dissect-util
 , dissect-vmfs
@@ -29,7 +31,7 @@
 
 buildPythonPackage rec {
   pname = "dissect";
-  version = "3.3";
+  version = "3.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -37,8 +39,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "fox-it";
     repo = "dissect";
-    rev = version;
-    hash = "sha256-1m5reKmPFSqMW/wYdiMw95l8A9E5FS8RHLb8/i1rQKY=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-+t6v553lP9NEimNlp48NQ+6dpIOrgfZ1FU3LNJF44YY=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
@@ -56,6 +58,7 @@ buildPythonPackage rec {
     dissect-etl
     dissect-eventlog
     dissect-evidence
+    dissect-executable
     dissect-extfs
     dissect-fat
     dissect-ffs
@@ -65,6 +68,7 @@ buildPythonPackage rec {
     dissect-regf
     dissect-shellitem
     dissect-sql
+    dissect-squashfs
     dissect-target
     dissect-util
     dissect-vmfs
@@ -82,6 +86,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Dissect meta module";
     homepage = "https://github.com/fox-it/dissect";
+    changelog = "https://github.com/fox-it/dissect/releases/tag/${version}";
     license = licenses.agpl3Only;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/django-webpack-loader/default.nix b/pkgs/development/python-modules/django-webpack-loader/default.nix
index 7b5b6c67cff4..d550ea9862d4 100644
--- a/pkgs/development/python-modules/django-webpack-loader/default.nix
+++ b/pkgs/development/python-modules/django-webpack-loader/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "django-webpack-loader";
-  version = "1.8.0";
+  version = "1.8.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-puZ5gF6WB7Bz7lJwLZtCa6waVGCdlmExqkNMeGAqwFA=";
+    hash = "sha256-BzvtoY4pKfpc2DuvvKr5deWUXoShe/qBkny2yfWhe5Q=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/djangorestframework-camel-case/default.nix b/pkgs/development/python-modules/djangorestframework-camel-case/default.nix
index c4d1d300cca7..cdecb5beff5d 100644
--- a/pkgs/development/python-modules/djangorestframework-camel-case/default.nix
+++ b/pkgs/development/python-modules/djangorestframework-camel-case/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "djangorestframework-camel-case";
-  version = "1.3.0";
+  version = "1.4.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-31kTYv+kSMjwo1TFauilP7eruxXiIpUdDG9feBYzkH4=";
+    sha256 = "sha256-SNkv1llh/2uzIKAMkmqnpab3sCeNCP0cXpYFSycIF58=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/flow-record/default.nix b/pkgs/development/python-modules/flow-record/default.nix
index b46b1df5410a..825c7f19436b 100644
--- a/pkgs/development/python-modules/flow-record/default.nix
+++ b/pkgs/development/python-modules/flow-record/default.nix
@@ -14,16 +14,16 @@
 
 buildPythonPackage rec {
   pname = "flow-record";
-  version = "3.7";
+  version = "3.9";
   format = "pyproject";
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.9";
 
   src = fetchFromGitHub {
     owner = "fox-it";
     repo = "flow.record";
-    rev = version;
-    hash = "sha256-bXI7q+unlrXvagKisAO4INfzeXlC4g918xmPmwMDCK8=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-hvd5I1n3lOuP9sUtVO69yGCVOVEWYKKfFf7OjAJCXIg=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
@@ -69,6 +69,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Library for defining and creating structured data";
     homepage = "https://github.com/fox-it/flow.record";
+    changelog = "https://github.com/fox-it/flow.record/releases/tag/${version}";
     license = licenses.agpl3Only;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/ibm-cloud-sdk-core/default.nix b/pkgs/development/python-modules/ibm-cloud-sdk-core/default.nix
index 6eb64f79ed32..deff4de058e1 100644
--- a/pkgs/development/python-modules/ibm-cloud-sdk-core/default.nix
+++ b/pkgs/development/python-modules/ibm-cloud-sdk-core/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "ibm-cloud-sdk-core";
-  version = "3.16.1";
+  version = "3.16.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-TsM56eE2qCJsr+ZHTaY7Wd/ZjhFqWJXA7Z3O+2MCgPc=";
+    hash = "sha256-fPYl9cz9GIDAKZYEH+8g+omRtGMU+abBx16If7H5i3I=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/msgspec/default.nix b/pkgs/development/python-modules/msgspec/default.nix
index 6844ba5e0d1d..78aa7eb6e61e 100644
--- a/pkgs/development/python-modules/msgspec/default.nix
+++ b/pkgs/development/python-modules/msgspec/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "msgspec";
-  version = "0.13.0";
+  version = "0.13.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "jcrist";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-R3/ljUBm0WTRIdp5qoHtH3k1ReaMzASsD4tB8bHKAMc=";
+    hash = "sha256-TGCdsimcoY3441/nOXxHGqYM4q8uoWd78HtUts6EOJY=";
   };
 
   # Requires libasan to be accessible
diff --git a/pkgs/development/python-modules/renault-api/default.nix b/pkgs/development/python-modules/renault-api/default.nix
index 321b3daec198..1a9c2b509fbb 100644
--- a/pkgs/development/python-modules/renault-api/default.nix
+++ b/pkgs/development/python-modules/renault-api/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "renault-api";
-  version = "0.1.11";
+  version = "0.1.12";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -24,8 +24,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "hacf-fr";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-71UFVXfww3wgSO2qoRCuV80+33B91Bjl2+nuuCbQRLg=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-uSyqAs0JqrsFuMpfuILoIGxLL+HVOGI/euCZziCgEdQ=";
   };
 
   nativeBuildInputs = [
@@ -58,6 +58,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python library to interact with the Renault API";
     homepage = "https://github.com/hacf-fr/renault-api";
+    changelog = "https://github.com/hacf-fr/renault-api/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/games/beret/use-home-dir.patch b/pkgs/games/beret/use-home-dir.patch
deleted file mode 100644
index c8597a0303b8..000000000000
--- a/pkgs/games/beret/use-home-dir.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-diff -Naur beret-beret-orig/game.c beret-beret/game.c
---- beret-beret-orig/game.c	2011-12-17 18:51:32.000000000 -0500
-+++ beret-beret/game.c	2011-12-21 13:16:37.047511020 -0500
-@@ -10,12 +10,10 @@
- #include <stdlib.h>
- #include <stdio.h>
- #include <string.h>
--#ifdef __APPLE__
- #include <sys/stat.h>
- #include <unistd.h>
- #include <errno.h>
- #include <pwd.h>
--#endif
- 
- #define CAMSCROLL 15
- #define SCR_WIDTH 780
-@@ -88,12 +86,8 @@
- #define DIRSEP "/"
- #endif
- 
--#ifdef __APPLE__
--#define SUPPORT_PATH "Library/Application Support/Beret/"
--#define RESOURCE_PATH "Beret.app/Contents/Resources/"
--#else
-+#define SUPPORT_PATH ".beret"
- #define RESOURCE_PATH ""
--#endif
- 
- #define QUITMOD_WIN KMOD_ALT
- #define QUITKEY_WIN SDLK_F4
-@@ -812,7 +806,6 @@
- 
- int init() {
- 
--  #ifdef __APPLE__
-   char filestr[512];
-   // Get the home directory of the user.
-   struct passwd *pwd = getpwuid(getuid());
-@@ -827,9 +820,6 @@
-     sprintf(filestr, "%s/saves", support_path);
-     mkdir(filestr, S_IRWXU);
-   }
--  #else
--  sprintf(support_path, "");
--  #endif
- 
-   if (SDL_Init(SDL_INIT_EVERYTHING) == -1) {
-     printf("Error: couldn't initialize SDL\n");
diff --git a/pkgs/os-specific/solo5/0001-Fix-test.patch b/pkgs/os-specific/solo5/0001-Fix-test.patch
new file mode 100644
index 000000000000..bd01c129bec2
--- /dev/null
+++ b/pkgs/os-specific/solo5/0001-Fix-test.patch
@@ -0,0 +1,25 @@
+From bf1f143455d1c8283d90964e0121b50c14a67bda Mon Sep 17 00:00:00 2001
+From: Lana Black <lana@illuminati.industries>
+Date: Sat, 11 Feb 2023 11:53:21 +0000
+Subject: [PATCH] Fix test.
+
+---
+ tests/tests.bats | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tests/tests.bats b/tests/tests.bats
+index c542b7a..98520ee 100644
+--- a/tests/tests.bats
++++ b/tests/tests.bats
+@@ -196,7 +196,7 @@ xen_expect_abort() {
+   run test_hello/test_hello.hvt
+   case "${CONFIG_HOST}" in
+   Linux)
+-    [ "$status" -eq 127 ] && [[ "$output" == *"No such file or directory"* ]]
++    [ "$status" -eq 127 ] && ([[ "$output" == *"No such file or directory"* ]] || [[ "$output" == *"required file not found"* ]])
+     ;;
+   FreeBSD)
+     # XXX: imgact_elf.c:load_interp() outputs the "ELF interpreter ... not
+-- 
+2.39.0
+
diff --git a/pkgs/os-specific/solo5/default.nix b/pkgs/os-specific/solo5/default.nix
index c449e46a998e..c436f247866f 100644
--- a/pkgs/os-specific/solo5/default.nix
+++ b/pkgs/os-specific/solo5/default.nix
@@ -24,6 +24,8 @@ in stdenv.mkDerivation {
     sha256 = "sha256-viwrS9lnaU8sTGuzK/+L/PlMM/xRRtgVuK5pixVeDEw=";
   };
 
+  patches = [ ./0001-Fix-test.patch ];
+
   hardeningEnable = [ "pie" ];
 
   configurePhase = ''
diff --git a/pkgs/servers/etebase/default.nix b/pkgs/servers/etebase/default.nix
index 079b87fe9a73..1b50e3cbe459 100644
--- a/pkgs/servers/etebase/default.nix
+++ b/pkgs/servers/etebase/default.nix
@@ -36,11 +36,8 @@ buildPythonPackage rec {
     pynacl
     redis
     typing-extensions
-  ] ++ lib.optional withLdap [
-    python-ldap
-  ] ++ lib.optional withPostgres [
-    psycopg2
-  ];
+  ] ++ lib.optional withLdap python-ldap
+    ++ lib.optional withPostgres psycopg2;
 
   installPhase = ''
     mkdir -p $out/bin $out/lib
diff --git a/pkgs/servers/snappymail/default.nix b/pkgs/servers/snappymail/default.nix
index dd08098b8a26..cf87168224a2 100644
--- a/pkgs/servers/snappymail/default.nix
+++ b/pkgs/servers/snappymail/default.nix
@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation rec {
   pname = "snappymail";
-  version = "2.25.3";
+  version = "2.25.5";
 
   src = fetchurl {
     url = "https://github.com/the-djmaze/snappymail/releases/download/v${version}/snappymail-${version}.tar.gz";
-    sha256 = "sha256-FK0F1STRdE1Ny+l0ILQMofXSXDhyzoMgZCT+MuCSmcA=";
+    sha256 = "sha256-oNZxlzaaIIK+Y0twZmddV7bJXEscN22pLWskEPGaB3c=";
   };
 
   sourceRoot = "snappymail";
diff --git a/pkgs/tools/compression/bzip2/1_1.nix b/pkgs/tools/compression/bzip2/1_1.nix
index ca5670a2e512..e9d6f7c44dab 100644
--- a/pkgs/tools/compression/bzip2/1_1.nix
+++ b/pkgs/tools/compression/bzip2/1_1.nix
@@ -3,9 +3,10 @@
 , meson
 , python3
 , ninja
+, testers
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "bzip2-unstable";
   version = "2020-08-11";
 
@@ -34,10 +35,13 @@ stdenv.mkDerivation rec {
 
   strictDeps = true;
 
+  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+
   meta = with lib; {
     description = "High-quality data compression program";
     license = licenses.bsdOriginal;
+    pkgConfigModules = [ "bz2" ];
     platforms = platforms.all;
     maintainers = [];
   };
-}
+})
diff --git a/pkgs/tools/compression/bzip3/default.nix b/pkgs/tools/compression/bzip3/default.nix
index 55ef5309d57d..37a4519c9454 100644
--- a/pkgs/tools/compression/bzip3/default.nix
+++ b/pkgs/tools/compression/bzip3/default.nix
@@ -3,9 +3,10 @@
 , fetchFromGitHub
 , autoreconfHook
 , pkg-config
+, testers
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "bzip3";
   version = "1.2.2";
 
@@ -14,12 +15,12 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "kspalaiologos";
     repo = "bzip3";
-    rev = version;
+    rev = finalAttrs.version;
     hash = "sha256-B59Z7+5SFjt/UgppNtdUtzw96y+EVglHoKzq9Il9ud8=";
   };
 
   postPatch = ''
-    echo -n "${version}" > .tarball-version
+    echo -n "${finalAttrs.version}" > .tarball-version
     patchShebangs build-aux
 
     # build-aux/ax_subst_man_date.m4 calls git if the file exists
@@ -35,12 +36,15 @@ stdenv.mkDerivation rec {
     "--disable-arch-native"
   ] ++ lib.optionals stdenv.isDarwin [ "--disable-link-time-optimization" ];
 
+  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+
   meta = {
     description = "A better and stronger spiritual successor to BZip2";
     homepage = "https://github.com/kspalaiologos/bzip3";
-    changelog = "https://github.com/kspalaiologos/bzip3/blob/${src.rev}/NEWS";
+    changelog = "https://github.com/kspalaiologos/bzip3/blob/${finalAttrs.src.rev}/NEWS";
     license = lib.licenses.lgpl3Plus;
     maintainers = with lib.maintainers; [ dotlambda ];
+    pkgConfigModules = [ "bzip3" ];
     platforms = lib.platforms.unix;
   };
-}
+})
diff --git a/pkgs/tools/games/joystickwake/default.nix b/pkgs/tools/games/joystickwake/default.nix
index ad7fc339feab..203c58b8f619 100644
--- a/pkgs/tools/games/joystickwake/default.nix
+++ b/pkgs/tools/games/joystickwake/default.nix
@@ -10,7 +10,7 @@ python3.pkgs.buildPythonApplication rec {
     sha256 = "sha256-0rVVxaaAFHkmJeG3e181x7faTIeFwupplWepoyxc51g=";
   };
 
-  propagatedBuildInputs = with python3.pkgs; [ pyudev xlib ];
+  propagatedBuildInputs = with python3.pkgs; [ dbus-next pyudev xlib ];
 
   postInstall = ''
     # autostart file
diff --git a/pkgs/tools/networking/dnscrypt-proxy2/default.nix b/pkgs/tools/networking/dnscrypt-proxy2/default.nix
index b0f03c093202..5457cf4ab53c 100644
--- a/pkgs/tools/networking/dnscrypt-proxy2/default.nix
+++ b/pkgs/tools/networking/dnscrypt-proxy2/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "dnscrypt-proxy2";
-  version = "2.1.3";
+  version = "2.1.4";
 
   vendorSha256 = null;
 
@@ -12,7 +12,7 @@ buildGoModule rec {
     owner = "DNSCrypt";
     repo = "dnscrypt-proxy";
     rev = version;
-    sha256 = "sha256-5wfxjx8SxynY6DpPIvOLwSsBdM/0zSzfaVDQTI/RUD0=";
+    sha256 = "sha256-98DeCrDp0TmPCSvOrJ7KgIQZBR2K1fFJrmNccZ7nSug=";
   };
 
   meta = with lib; {
diff --git a/pkgs/tools/networking/netbird/default.nix b/pkgs/tools/networking/netbird/default.nix
index c1becc886a59..4301f606a402 100644
--- a/pkgs/tools/networking/netbird/default.nix
+++ b/pkgs/tools/networking/netbird/default.nix
@@ -14,13 +14,13 @@ let
 in
 buildGoModule rec {
   pname = "netbird";
-  version = "0.12.0";
+  version = "0.13.0";
 
   src = fetchFromGitHub {
     owner = "netbirdio";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-ajfNHkdYNJCuDhFmww1X0d9F0dmo2/h0GlfLYWvTHKc=";
+    sha256 = "sha256-Afj2pllGPL86hhSNDSbvO+GkA62CI8V5dnUa0mjEMCg=";
   };
 
   vendorHash = "sha256-3uEcb0nVHrfHZTZ/j/9l6zR1zMfLR0mVaN/Hydyam4Q=";
diff --git a/pkgs/tools/typesetting/mmark/default.nix b/pkgs/tools/typesetting/mmark/default.nix
index 0513035094bd..a5b677888420 100644
--- a/pkgs/tools/typesetting/mmark/default.nix
+++ b/pkgs/tools/typesetting/mmark/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "mmark";
-  version = "2.2.30";
+  version = "2.2.31";
 
   src = fetchFromGitHub {
     owner = "mmarkdown";
     repo = "mmark";
     rev = "v${version}";
-    sha256 = "sha256-14SGA3a72i+HYptTEpxf4YiLXZzZ1R/t1agvm3ie4g8=";
+    sha256 = "sha256-mCnlLsvkkB7ZvBCLYHvYanz9XgWo92v5M/kKulhUKTE=";
   };
 
-  vendorSha256 = "sha256-GjR9cOGLB6URHQi+qcyNbP7rm0+y4wypvgUxgJzIgGQ=";
+  vendorHash = "sha256-GjR9cOGLB6URHQi+qcyNbP7rm0+y4wypvgUxgJzIgGQ=";
 
   ldflags = [ "-s" "-w" ];
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index cfbb687af4c5..ba4832390102 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1477,7 +1477,7 @@ self: super: with self; {
 
   buildbot-ui = self.buildbot.withPlugins (with self.buildbot-plugins; [ www ]);
 
-  buildbot-full = self.buildbot.withPlugins (with self.buildbot-plugins; [ www console-view waterfall-view grid-view wsgi-dashboards ]);
+  buildbot-full = self.buildbot.withPlugins (with self.buildbot-plugins; [ www console-view waterfall-view grid-view wsgi-dashboards badges ]);
 
   buildbot-pkg = callPackage ../development/python-modules/buildbot/pkg.nix { };
 
@@ -2461,6 +2461,8 @@ self: super: with self; {
 
   dissect-evidence = callPackage ../development/python-modules/dissect-evidence { };
 
+  dissect-executable = callPackage ../development/python-modules/dissect-executable { };
+
   dissect-extfs = callPackage ../development/python-modules/dissect-extfs { };
 
   dissect-hypervisor = callPackage ../development/python-modules/dissect-hypervisor { };
@@ -2473,6 +2475,8 @@ self: super: with self; {
 
   dissect-shellitem = callPackage ../development/python-modules/dissect-shellitem { };
 
+  dissect-squashfs = callPackage ../development/python-modules/dissect-squashfs { };
+
   dissect-sql = callPackage ../development/python-modules/dissect-sql { };
 
   dissect-target = callPackage ../development/python-modules/dissect-target { };