diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 498fc61878c0..8a356b8ebdb4 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -9369,6 +9369,16 @@
     githubId = 1391883;
     name = "Tom Hall";
   };
+  Thunderbottom = {
+    email = "chinmaydpai@gmail.com";
+    github = "Thunderbottom";
+    githubId = 11243138;
+    name = "Chinmay D. Pai";
+    keys = [{
+      longkeyid = "rsa4096/0x75507BE256F40CED";
+      fingerprint = "7F3E EEAA EE66 93CC 8782  042A 7550 7BE2 56F4 0CED";
+    }];
+  };
   tiagolobocastro = {
     email = "tiagolobocastro@gmail.com";
     github = "tiagolobocastro";
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index c7e83a95de83..3055459e7818 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -321,7 +321,8 @@
   ./services/desktops/gsignond.nix
   ./services/desktops/gvfs.nix
   ./services/desktops/malcontent.nix
-  ./services/desktops/pipewire.nix
+  ./services/desktops/pipewire/pipewire.nix
+  ./services/desktops/pipewire/pipewire-media-session.nix
   ./services/desktops/gnome3/at-spi2-core.nix
   ./services/desktops/gnome3/chrome-gnome-shell.nix
   ./services/desktops/gnome3/evolution-data-server.nix
diff --git a/nixos/modules/services/desktops/pipewire.nix b/nixos/modules/services/desktops/pipewire.nix
deleted file mode 100644
index 134becf6b0c4..000000000000
--- a/nixos/modules/services/desktops/pipewire.nix
+++ /dev/null
@@ -1,183 +0,0 @@
-# pipewire service.
-{ config, lib, pkgs, ... }:
-
-with lib;
-
-let
-  cfg = config.services.pipewire;
-  enable32BitAlsaPlugins = cfg.alsa.support32Bit
-                           && pkgs.stdenv.isx86_64
-                           && pkgs.pkgsi686Linux.pipewire != null;
-
-  # The package doesn't output to $out/lib/pipewire directly so that the
-  # overlays can use the outputs to replace the originals in FHS environments.
-  #
-  # This doesn't work in general because of missing development information.
-  jack-libs = pkgs.runCommand "jack-libs" {} ''
-    mkdir -p "$out/lib"
-    ln -s "${cfg.package.jack}/lib" "$out/lib/pipewire"
-  '';
-in {
-
-  meta = {
-    maintainers = teams.freedesktop.members;
-  };
-
-  ###### interface
-  options = {
-    services.pipewire = {
-      enable = mkEnableOption "pipewire service";
-
-      package = mkOption {
-        type = types.package;
-        default = pkgs.pipewire;
-        defaultText = "pkgs.pipewire";
-        example = literalExample "pkgs.pipewire";
-        description = ''
-          The pipewire derivation to use.
-        '';
-      };
-
-      socketActivation = mkOption {
-        default = true;
-        type = types.bool;
-        description = ''
-          Automatically run pipewire when connections are made to the pipewire socket.
-        '';
-      };
-
-      extraConfig = mkOption {
-        type = types.lines;
-        default = "";
-        description = ''
-          Literal string to append to /etc/pipewire/pipewire.conf.
-        '';
-      };
-
-      sessionManager = mkOption {
-        type = types.nullOr types.string;
-        default = null;
-        example = literalExample ''"''${pipewire}/bin/pipewire-media-session"'';
-        description = ''
-          Path to the pipewire session manager executable.
-        '';
-      };
-
-      sessionManagerArguments = mkOption {
-        type = types.listOf types.string;
-        default = [];
-        example = literalExample ''[ "-p" "bluez5.msbc-support=true" ]'';
-        description = ''
-          Arguments passed to the pipewire session manager.
-        '';
-      };
-
-      alsa = {
-        enable = mkEnableOption "ALSA support";
-        support32Bit = mkEnableOption "32-bit ALSA support on 64-bit systems";
-      };
-
-      jack = {
-        enable = mkEnableOption "JACK audio emulation";
-      };
-
-      pulse = {
-        enable = mkEnableOption "PulseAudio server emulation";
-      };
-    };
-  };
-
-
-  ###### implementation
-  config = mkIf cfg.enable {
-    assertions = [
-      {
-        assertion = cfg.pulse.enable -> !config.hardware.pulseaudio.enable;
-        message = "PipeWire based PulseAudio server emulation replaces PulseAudio. This option requires `hardware.pulseaudio.enable` to be set to false";
-      }
-      {
-        assertion = cfg.jack.enable -> !config.services.jack.jackd.enable;
-        message = "PipeWire based JACK emulation doesn't use the JACK service. This option requires `services.jack.jackd.enable` to be set to false";
-      }
-    ];
-
-    services.pipewire.sessionManager = mkDefault "${cfg.package}/bin/pipewire-media-session";
-
-    environment.systemPackages = [ cfg.package ]
-                                 ++ lib.optional cfg.jack.enable jack-libs;
-
-    systemd.packages = [ cfg.package ]
-                       ++ lib.optional cfg.pulse.enable cfg.package.pulse;
-
-    # PipeWire depends on DBUS but doesn't list it. Without this booting
-    # into a terminal results in the service crashing with an error.
-    systemd.user.sockets.pipewire.wantedBy = lib.mkIf cfg.socketActivation [ "sockets.target" ];
-    systemd.user.sockets.pipewire-pulse.wantedBy = lib.mkIf (cfg.socketActivation && cfg.pulse.enable) ["sockets.target"];
-    systemd.user.services.pipewire.bindsTo = [ "dbus.service" ];
-    services.udev.packages = [ cfg.package ];
-
-    # If any paths are updated here they must also be updated in the package test.
-    environment.etc."alsa/conf.d/49-pipewire-modules.conf" = mkIf cfg.alsa.enable {
-      text = ''
-        pcm_type.pipewire {
-          libs.native = ${cfg.package.lib}/lib/alsa-lib/libasound_module_pcm_pipewire.so ;
-          ${optionalString enable32BitAlsaPlugins
-            "libs.32Bit = ${pkgs.pkgsi686Linux.pipewire.lib}/lib/alsa-lib/libasound_module_pcm_pipewire.so ;"}
-        }
-        ctl_type.pipewire {
-          libs.native = ${cfg.package.lib}/lib/alsa-lib/libasound_module_ctl_pipewire.so ;
-          ${optionalString enable32BitAlsaPlugins
-            "libs.32Bit = ${pkgs.pkgsi686Linux.pipewire.lib}/lib/alsa-lib/libasound_module_ctl_pipewire.so ;"}
-        }
-      '';
-    };
-    environment.etc."alsa/conf.d/50-pipewire.conf" = mkIf cfg.alsa.enable {
-      source = "${cfg.package}/share/alsa/alsa.conf.d/50-pipewire.conf";
-    };
-    environment.etc."alsa/conf.d/99-pipewire-default.conf" = mkIf cfg.alsa.enable {
-      source = "${cfg.package}/share/alsa/alsa.conf.d/99-pipewire-default.conf";
-    };
-    environment.sessionVariables.LD_LIBRARY_PATH =
-      lib.optional cfg.jack.enable "/run/current-system/sw/lib/pipewire";
-
-    environment.etc."pipewire/pipewire.conf" = {
-      # Adapted from src/daemon/pipewire.conf.in
-      text = ''
-        set-prop link.max-buffers 16 # version < 3 clients can't handle more
-
-        add-spa-lib audio.convert* audioconvert/libspa-audioconvert
-        add-spa-lib api.alsa.* alsa/libspa-alsa
-        add-spa-lib api.v4l2.* v4l2/libspa-v4l2
-        add-spa-lib api.libcamera.* libcamera/libspa-libcamera
-        add-spa-lib api.bluez5.* bluez5/libspa-bluez5
-        add-spa-lib api.vulkan.* vulkan/libspa-vulkan
-        add-spa-lib api.jack.* jack/libspa-jack
-        add-spa-lib support.* support/libspa-support
-
-        load-module libpipewire-module-rtkit # rt.prio=20 rt.time.soft=200000 rt.time.hard=200000
-        load-module libpipewire-module-protocol-native
-        load-module libpipewire-module-profiler
-        load-module libpipewire-module-metadata
-        load-module libpipewire-module-spa-device-factory
-        load-module libpipewire-module-spa-node-factory
-        load-module libpipewire-module-client-node
-        load-module libpipewire-module-client-device
-        load-module libpipewire-module-portal
-        load-module libpipewire-module-access
-        load-module libpipewire-module-adapter
-        load-module libpipewire-module-link-factory
-        load-module libpipewire-module-session-manager
-
-        create-object spa-node-factory factory.name=support.node.driver node.name=Dummy priority.driver=8000
-
-        exec ${cfg.sessionManager} ${lib.concatStringsSep " " cfg.sessionManagerArguments}
-
-        ${cfg.extraConfig}
-      '';
-    };
-
-    environment.etc."pipewire/media-session.d/with-alsa" = mkIf cfg.alsa.enable { text = ""; };
-    environment.etc."pipewire/media-session.d/with-pulseaudio" = mkIf cfg.pulse.enable { text = ""; };
-    environment.etc."pipewire/media-session.d/with-jack" = mkIf cfg.jack.enable { text = ""; };
-  };
-}
diff --git a/nixos/modules/services/desktops/pipewire/pipewire-media-session.nix b/nixos/modules/services/desktops/pipewire/pipewire-media-session.nix
new file mode 100644
index 000000000000..168cf13a88cb
--- /dev/null
+++ b/nixos/modules/services/desktops/pipewire/pipewire-media-session.nix
@@ -0,0 +1,340 @@
+# pipewire example session manager.
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.pipewire.media-session;
+  enable32BitAlsaPlugins = cfg.alsa.support32Bit
+                           && pkgs.stdenv.isx86_64
+                           && pkgs.pkgsi686Linux.pipewire != null;
+
+  # Helpers for generating the pipewire JSON config file
+  mkSPAValueString = v:
+  if builtins.isList v then "[${lib.concatMapStringsSep " " mkSPAValueString v}]"
+  else if lib.types.attrs.check v then
+    "{${lib.concatStringsSep " " (mkSPAKeyValue v)}}"
+  else lib.generators.mkValueStringDefault { } v;
+
+  mkSPAKeyValue = attrs: map (def: def.content) (
+  lib.sortProperties
+    (
+      lib.mapAttrsToList
+        (k: v: lib.mkOrder (v._priority or 1000) "${lib.escape [ "=" ] k} = ${mkSPAValueString (v._content or v)}")
+        attrs
+    )
+  );
+
+  toSPAJSON = attrs: lib.concatStringsSep "\n" (mkSPAKeyValue attrs);
+in {
+
+  meta = {
+    maintainers = teams.freedesktop.members;
+  };
+
+  ###### interface
+  options = {
+    services.pipewire.media-session = {
+      enable = mkOption {
+        type = types.bool;
+        default = true;
+        description = "Example pipewire session manager";
+      };
+
+      package = mkOption {
+        type = types.package;
+        default = pkgs.pipewire.mediaSession;
+        example = literalExample "pkgs.pipewire.mediaSession";
+        description = ''
+          The pipewire-media-session derivation to use.
+        '';
+      };
+
+      config = mkOption {
+        type = types.attrs;
+        description = ''
+          Configuration for the media session core.
+        '';
+        default = {
+          # media-session config file
+          properties = {
+            # Properties to configure the session and some
+            # modules
+            #mem.mlock-all = false;
+            #context.profile.modules = "default,rtkit";
+          };
+
+          spa-libs = {
+            # Mapping from factory name to library.
+            "api.bluez5.*" = "bluez5/libspa-bluez5";
+            "api.alsa.*" = "alsa/libspa-alsa";
+            "api.v4l2.*" = "v4l2/libspa-v4l2";
+            "api.libcamera.*" = "libcamera/libspa-libcamera";
+          };
+
+          modules = {
+            # These are the modules that are enabled when a file with
+            # the key name is found in the media-session.d config directory.
+            # the default bundle is always enabled.
+
+            default = [
+              "flatpak"			# manages flatpak access
+              "portal"			# manage portal permissions
+              "v4l2"			# video for linux udev detection
+              #"libcamera"		# libcamera udev detection
+              "suspend-node"		# suspend inactive nodes
+              "policy-node"		# configure and link nodes
+              #"metadata"		# export metadata API
+              #"default-nodes"		# restore default nodes
+              #"default-profile"	# restore default profiles
+              #"default-routes"		# restore default route
+              #"streams-follow-default"	# move streams when default changes
+              #"alsa-seq"		# alsa seq midi support
+              #"alsa-monitor"		# alsa udev detection
+              #"bluez5"			# bluetooth support
+              #"restore-stream"		# restore stream settings
+            ];
+            "with-audio" = [
+              "metadata"
+              "default-nodes"
+              "default-profile"
+              "default-routes"
+              "alsa-seq"
+              "alsa-monitor"
+            ];
+            "with-alsa" = [
+              "with-audio"
+            ];
+            "with-jack" = [
+              "with-audio"
+            ];
+            "with-pulseaudio" = [
+              "with-audio"
+              "bluez5"
+              "restore-stream"
+              "streams-follow-default"
+            ];
+          };
+        };
+      };
+
+      alsaMonitorConfig = mkOption {
+        type = types.attrs;
+        description = ''
+          Configuration for the alsa monitor.
+        '';
+        default = {
+          # alsa-monitor config file
+          properties = {
+            #alsa.jack-device = true
+          };
+
+          rules = [
+          # an array of matches/actions to evaluate
+          {
+            # rules for matching a device or node. It is an array of
+            # properties that all need to match the regexp. If any of the
+            # matches work, the actions are executed for the object.
+            matches = [
+              {
+                # this matches all cards
+                device.name = "~alsa_card.*";
+              }
+            ];
+            actions = {
+              # actions can update properties on the matched object.
+              update-props = {
+                api.alsa.use-acp = true;
+                #api.alsa.use-ucm = true;
+                #api.alsa.soft-mixer = false;
+                #api.alsa.ignore-dB = false;
+                #device.profile-set = "profileset-name";
+                #device.profile = "default profile name";
+                api.acp.auto-profile = false;
+                api.acp.auto-port = false;
+                #device.nick = "My Device";
+              };
+            };
+          }
+          {
+            matches = [
+              {
+                # matches all sinks
+                node.name = "~alsa_input.*";
+              }
+              {
+                # matches all sources
+                node.name = "~alsa_output.*";
+              }
+            ];
+            actions = {
+              update-props = {
+                #node.nick = 			"My Node";
+                #node.nick = 			null;
+                #priority.driver = 		100;
+                #priority.session = 		100;
+                #node.pause-on-idle = 		false;
+                #resample.quality = 		4;
+                #channelmix.normalize =		false;
+                #channelmix.mix-lfe = 		false;
+                #audio.channels = 		2;
+                #audio.format = 		"S16LE";
+                #audio.rate = 			44100;
+                #audio.position = 		"FL,FR";
+                #api.alsa.period-size =         1024;
+                #api.alsa.headroom =            0;
+                #api.alsa.disable-mmap =        false;
+                #api.alsa.disable-batch =       false;
+              };
+            };
+          }
+          ];
+        };
+      };
+
+      bluezMonitorConfig = mkOption {
+        type = types.attrs;
+        description = ''
+          Configuration for the bluez5 monitor.
+        '';
+        default = {
+          # bluez-monitor config file
+          properties = {
+            # msbc is not expected to work on all headset + adapter combinations.
+            #bluez5.msbc-support = true;
+            #bluez5.sbc-xq-support = true;
+
+            # Enabled headset roles (default: [ hsp_hs hfp_ag ]), this
+            # property only applies to native backend. Currently some headsets
+            # (Sony WH-1000XM3) are not working with both hsp_ag and hfp_ag
+            # enabled, disable either hsp_ag or hfp_ag to work around it.
+            #
+            # Supported headset roles: hsp_hs (HSP Headset),
+            #                          hsp_ag (HSP Audio Gateway),
+            #                          hfp_ag (HFP Audio Gateway)
+            #bluez5.headset-roles = [ "hsp_hs" "hsp_ag" "hfp_ag" ];
+
+            # Enabled A2DP codecs (default: all)
+            #bluez5.codecs = [ "sbc" "aac" "ldac" "aptx" "aptx_hd" ];
+          };
+
+          rules = [
+          # an array of matches/actions to evaluate
+          {
+            # rules for matching a device or node. It is an array of
+            # properties that all need to match the regexp. If any of the
+            # matches work, the actions are executed for the object.
+            matches = [
+              {
+                # this matches all cards
+                device.name = "~bluez_card.*";
+              }
+            ];
+            actions = {
+              # actions can update properties on the matched object.
+              update-props = {
+                #device.nick = 			"My Device";
+              };
+            };
+          }
+          {
+            matches = [
+              {
+                # matches all sinks
+                node.name = "~bluez_input.*";
+              }
+              {
+                # matches all sources
+                node.name = "~bluez_output.*";
+              }
+            ];
+            actions = {
+              update-props = {
+                #node.nick = 			"My Node"
+                #node.nick = 			null;
+                #priority.driver = 		100;
+                #priority.session = 		100;
+                #node.pause-on-idle = 		false;
+                #resample.quality = 		4;
+                #channelmix.normalize =		false;
+                #channelmix.mix-lfe = 		false;
+              };
+            };
+          }
+          ];
+        };
+      };
+
+      v4l2MonitorConfig = mkOption {
+        type = types.attrs;
+        description = ''
+          Configuration for the V4L2 monitor.
+        '';
+        default = {
+          # v4l2-monitor config file
+          properties = {
+          };
+
+          rules = [
+            # an array of matches/actions to evaluate
+            {
+              # rules for matching a device or node. It is an array of
+              # properties that all need to match the regexp. If any of the
+              # matches work, the actions are executed for the object.
+              matches = [
+                {
+                  # this matches all devices
+                  device.name = "~v4l2_device.*";
+                }
+              ];
+              actions = {
+                # actions can update properties on the matched object.
+                update-props = {
+                  #device.nick = 			"My Device";
+                };
+              };
+            }
+            {
+              matches = [
+                {
+                  # matches all sinks
+                  node.name = "~v4l2_input.*";
+                }
+                {
+                  # matches all sources
+                  node.name = "~v4l2_output.*";
+                }
+              ];
+              actions = {
+                update-props = {
+                  #node.nick = 			"My Node";
+                  #node.nick = 			null;
+                  #priority.driver = 		100;
+                  #priority.session = 		100;
+                  #node.pause-on-idle = 		true;
+                };
+              };
+            }
+          ];
+        };
+      };
+    };
+  };
+
+  ###### implementation
+  config = mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
+    services.pipewire.sessionManagerExecutable = "${cfg.package}/bin/pipewire-media-session";
+
+    environment.etc."pipewire/media-session.d/media-session.conf" = { text = toSPAJSON cfg.config; };
+    environment.etc."pipewire/media-session.d/v4l2-monitor.conf" = { text = toSPAJSON cfg.v4l2MonitorConfig; };
+
+    environment.etc."pipewire/media-session.d/with-alsa" = mkIf config.services.pipewire.alsa.enable { text = ""; };
+    environment.etc."pipewire/media-session.d/alsa-monitor.conf" = mkIf config.services.pipewire.alsa.enable { text = toSPAJSON cfg.alsaMonitorConfig; };
+
+    environment.etc."pipewire/media-session.d/with-pulseaudio" = mkIf config.services.pipewire.pulse.enable { text = ""; };
+    environment.etc."pipewire/media-session.d/bluez-monitor.conf" = mkIf config.services.pipewire.pulse.enable { text = toSPAJSON cfg.bluezMonitorConfig; };
+
+    environment.etc."pipewire/media-session.d/with-jack" = mkIf config.services.pipewire.jack.enable { text = ""; };
+  };
+}
diff --git a/nixos/modules/services/desktops/pipewire/pipewire.nix b/nixos/modules/services/desktops/pipewire/pipewire.nix
new file mode 100644
index 000000000000..044120de7c71
--- /dev/null
+++ b/nixos/modules/services/desktops/pipewire/pipewire.nix
@@ -0,0 +1,265 @@
+# pipewire service.
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.pipewire;
+  enable32BitAlsaPlugins = cfg.alsa.support32Bit
+                           && pkgs.stdenv.isx86_64
+                           && pkgs.pkgsi686Linux.pipewire != null;
+
+  # The package doesn't output to $out/lib/pipewire directly so that the
+  # overlays can use the outputs to replace the originals in FHS environments.
+  #
+  # This doesn't work in general because of missing development information.
+  jack-libs = pkgs.runCommand "jack-libs" {} ''
+    mkdir -p "$out/lib"
+    ln -s "${cfg.package.jack}/lib" "$out/lib/pipewire"
+  '';
+
+  # Helpers for generating the pipewire JSON config file
+  mkSPAValueString = v:
+  if builtins.isList v then "[${lib.concatMapStringsSep " " mkSPAValueString v}]"
+  else if lib.types.attrs.check v then
+    "{${lib.concatStringsSep " " (mkSPAKeyValue v)}}"
+  else lib.generators.mkValueStringDefault { } v;
+
+  mkSPAKeyValue = attrs: map (def: def.content) (
+  lib.sortProperties
+    (
+      lib.mapAttrsToList
+        (k: v: lib.mkOrder (v._priority or 1000) "${lib.escape [ "=" ] k} = ${mkSPAValueString (v._content or v)}")
+        attrs
+    )
+  );
+
+  toSPAJSON = attrs: lib.concatStringsSep "\n" (mkSPAKeyValue attrs);
+in {
+
+  meta = {
+    maintainers = teams.freedesktop.members;
+  };
+
+  ###### interface
+  options = {
+    services.pipewire = {
+      enable = mkEnableOption "pipewire service";
+
+      package = mkOption {
+        type = types.package;
+        default = pkgs.pipewire;
+        defaultText = "pkgs.pipewire";
+        example = literalExample "pkgs.pipewire";
+        description = ''
+          The pipewire derivation to use.
+        '';
+      };
+
+      socketActivation = mkOption {
+        default = true;
+        type = types.bool;
+        description = ''
+          Automatically run pipewire when connections are made to the pipewire socket.
+        '';
+      };
+
+      config = mkOption {
+        type = types.attrs;
+        description = ''
+          Configuration for the pipewire daemon.
+        '';
+        default = {
+          properties = {
+            ## set-prop is used to configure properties in the system
+            #
+            # "library.name.system" = "support/libspa-support";
+            # "context.data-loop.library.name.system" = "support/libspa-support";
+            "link.max-buffers" = 16; # version < 3 clients can't handle more than 16
+            #"mem.allow-mlock" = false;
+            #"mem.mlock-all" = true;
+            ## https://gitlab.freedesktop.org/pipewire/pipewire/-/blob/master/src/pipewire/pipewire.h#L93
+            #"log.level" = 2; # 5 is trace, which is verbose as hell, default is 2 which is warnings, 4 is debug output, 3 is info
+
+            ## Properties for the DSP configuration
+            #
+            #"default.clock.rate" = 48000;
+            #"default.clock.quantum" = 1024;
+            #"default.clock.min-quantum" = 32;
+            #"default.clock.max-quantum" = 8192;
+            #"default.video.width" = 640;
+            #"default.video.height" = 480;
+            #"default.video.rate.num" = 25;
+            #"default.video.rate.denom" = 1;
+          };
+
+          spa-libs = {
+            ## add-spa-lib <factory-name regex> <library-name>
+            #
+            # used to find spa factory names. It maps an spa factory name
+            # regular expression to a library name that should contain
+            # that factory.
+            #
+            "audio.convert*" = "audioconvert/libspa-audioconvert";
+            "api.alsa.*" = "alsa/libspa-alsa";
+            "api.v4l2.*" = "v4l2/libspa-v4l2";
+            "api.libcamera.*" = "libcamera/libspa-libcamera";
+            "api.bluez5.*" = "bluez5/libspa-bluez5";
+            "api.vulkan.*" = "vulkan/libspa-vulkan";
+            "api.jack.*" = "jack/libspa-jack";
+            "support.*" = "support/libspa-support";
+            # "videotestsrc" = "videotestsrc/libspa-videotestsrc";
+            # "audiotestsrc" = "audiotestsrc/libspa-audiotestsrc";
+          };
+
+          modules = {
+            ##  <module-name> = { [args = "<key>=<value> ..."]
+            #                     [flags = ifexists] }
+            #                     [flags = [ifexists]|[nofail]}
+            #
+            # Loads a module with the given parameters.
+            # If ifexists is given, the module is ignoed when it is not found.
+            # If nofail is given, module initialization failures are ignored.
+            #
+            libpipewire-module-rtkit = {
+              args = {
+                #rt.prio = 20;
+                #rt.time.soft = 200000;
+                #rt.time.hard = 200000;
+                #nice.level = -11;
+              };
+              flags = "ifexists|nofail";
+            };
+            libpipewire-module-protocol-native = { _priority = -100; _content = "null"; };
+            libpipewire-module-profiler = "null";
+            libpipewire-module-metadata = "null";
+            libpipewire-module-spa-device-factory = "null";
+            libpipewire-module-spa-node-factory = "null";
+            libpipewire-module-client-node = "null";
+            libpipewire-module-client-device = "null";
+            libpipewire-module-portal = "null";
+            libpipewire-module-access = {
+              args.access = {
+                allowed = ["${builtins.unsafeDiscardStringContext cfg.sessionManagerExecutable}"];
+                rejected = [];
+                restricted = [];
+                force = "flatpak";
+              };
+            };
+            libpipewire-module-adapter = "null";
+            libpipewire-module-link-factory = "null";
+            libpipewire-module-session-manager = "null";
+          };
+
+          objects = {
+            ## create-object [-nofail] <factory-name> [<key>=<value> ...]
+            #
+            # Creates an object from a PipeWire factory with the given parameters.
+            # If -nofail is given, errors are ignored (and no object is created)
+            #
+          };
+
+
+          exec = {
+            ## exec <program-name>
+            #
+            # Execute the given program. This is usually used to start the
+            # session manager. run the session manager with -h for options
+            #
+            "${builtins.unsafeDiscardStringContext cfg.sessionManagerExecutable}" = { args = "\"${lib.concatStringsSep " " cfg.sessionManagerArguments}\""; };
+          };
+        };
+      };
+
+      sessionManagerExecutable = mkOption {
+        type = types.str;
+        default = "";
+        example = literalExample ''${pkgs.pipewire.mediaSession}/bin/pipewire-media-session'';
+        description = ''
+          Path to the session manager executable.
+        '';
+      };
+
+      sessionManagerArguments = mkOption {
+        type = types.listOf types.str;
+        default = [];
+        example = literalExample ''["-p" "bluez5.msbc-support=true"]'';
+        description = ''
+          Arguments passed to the pipewire session manager.
+        '';
+      };
+
+      alsa = {
+        enable = mkEnableOption "ALSA support";
+        support32Bit = mkEnableOption "32-bit ALSA support on 64-bit systems";
+      };
+
+      jack = {
+        enable = mkEnableOption "JACK audio emulation";
+      };
+
+      pulse = {
+        enable = mkEnableOption "PulseAudio server emulation";
+      };
+    };
+  };
+
+
+  ###### implementation
+  config = mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = cfg.pulse.enable -> !config.hardware.pulseaudio.enable;
+        message = "PipeWire based PulseAudio server emulation replaces PulseAudio. This option requires `hardware.pulseaudio.enable` to be set to false";
+      }
+      {
+        assertion = cfg.jack.enable -> !config.services.jack.jackd.enable;
+        message = "PipeWire based JACK emulation doesn't use the JACK service. This option requires `services.jack.jackd.enable` to be set to false";
+      }
+    ];
+
+    environment.systemPackages = [ cfg.package ]
+                                 ++ lib.optional cfg.jack.enable jack-libs;
+
+    systemd.packages = [ cfg.package ]
+                       ++ lib.optional cfg.pulse.enable cfg.package.pulse;
+
+    # PipeWire depends on DBUS but doesn't list it. Without this booting
+    # into a terminal results in the service crashing with an error.
+    systemd.user.sockets.pipewire.wantedBy = lib.mkIf cfg.socketActivation [ "sockets.target" ];
+    systemd.user.sockets.pipewire-pulse.wantedBy = lib.mkIf (cfg.socketActivation && cfg.pulse.enable) ["sockets.target"];
+    systemd.user.services.pipewire.bindsTo = [ "dbus.service" ];
+    services.udev.packages = [ cfg.package ];
+
+    # If any paths are updated here they must also be updated in the package test.
+    environment.etc."alsa/conf.d/49-pipewire-modules.conf" = mkIf cfg.alsa.enable {
+      text = ''
+        pcm_type.pipewire {
+          libs.native = ${cfg.package.lib}/lib/alsa-lib/libasound_module_pcm_pipewire.so ;
+          ${optionalString enable32BitAlsaPlugins
+            "libs.32Bit = ${pkgs.pkgsi686Linux.pipewire.lib}/lib/alsa-lib/libasound_module_pcm_pipewire.so ;"}
+        }
+        ctl_type.pipewire {
+          libs.native = ${cfg.package.lib}/lib/alsa-lib/libasound_module_ctl_pipewire.so ;
+          ${optionalString enable32BitAlsaPlugins
+            "libs.32Bit = ${pkgs.pkgsi686Linux.pipewire.lib}/lib/alsa-lib/libasound_module_ctl_pipewire.so ;"}
+        }
+      '';
+    };
+    environment.etc."alsa/conf.d/50-pipewire.conf" = mkIf cfg.alsa.enable {
+      source = "${cfg.package}/share/alsa/alsa.conf.d/50-pipewire.conf";
+    };
+    environment.etc."alsa/conf.d/99-pipewire-default.conf" = mkIf cfg.alsa.enable {
+      source = "${cfg.package}/share/alsa/alsa.conf.d/99-pipewire-default.conf";
+    };
+
+    environment.sessionVariables.LD_LIBRARY_PATH =
+      lib.optional cfg.jack.enable "/run/current-system/sw/lib/pipewire";
+
+    # https://gitlab.freedesktop.org/pipewire/pipewire/-/issues/464#note_723554
+    systemd.user.services.pipewire.environment = {
+      "PIPEWIRE_LINK_PASSIVE" = "1";
+      "PIPEWIRE_CONFIG_FILE" = pkgs.writeText "pipewire.conf" (toSPAJSON cfg.config);
+    };
+  };
+}
diff --git a/nixos/modules/virtualisation/hyperv-guest.nix b/nixos/modules/virtualisation/hyperv-guest.nix
index adc2810a9939..105224b89649 100644
--- a/nixos/modules/virtualisation/hyperv-guest.nix
+++ b/nixos/modules/virtualisation/hyperv-guest.nix
@@ -31,6 +31,8 @@ in {
         "hv_balloon" "hv_netvsc" "hv_storvsc" "hv_utils" "hv_vmbus"
       ];
 
+      initrd.availableKernelModules = [ "hyperv_keyboard" ];
+
       kernelParams = [
         "video=hyperv_fb:${cfg.videoMode} elevator=noop"
       ];
diff --git a/pkgs/applications/editors/kibi/default.nix b/pkgs/applications/editors/kibi/default.nix
index 71833be33002..337a46c0ec6b 100644
--- a/pkgs/applications/editors/kibi/default.nix
+++ b/pkgs/applications/editors/kibi/default.nix
@@ -5,15 +5,15 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "kibi";
-  version = "0.2.1";
+  version = "0.2.2";
 
-  cargoSha256 = "1cbiidq0w5f9ynb09b6828p7p7y5xhpgz47n2jsl8mp96ydhy5lv";
+  cargoSha256 = "sha256-8iEUOLFwHBLS0HQL/oLnv6lcV3V9Hm4jMqXkqPvIF9E=";
 
   src = fetchFromGitHub {
     owner = "ilai-deutel";
     repo = "kibi";
     rev = "v${version}";
-    sha256 = "1x5bvvq33380k2qhs1bwz3f9zl5q1sl7iic47pxfkzv24bpjnypb";
+    sha256 = "sha256-ox1qKWxJlUIFzEqeyzG2kqZix3AHnOKFrlpf6O5QM+k=";
   };
 
   meta = with lib; {
diff --git a/pkgs/applications/misc/tickrs/default.nix b/pkgs/applications/misc/tickrs/default.nix
index d49c62219026..b9fd02650a67 100644
--- a/pkgs/applications/misc/tickrs/default.nix
+++ b/pkgs/applications/misc/tickrs/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "tickrs";
-  version = "0.10.2";
+  version = "0.11.0";
 
   src = fetchFromGitHub {
     owner = "tarkah";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-kX5Vp+yNlzBj1ewm7zNtpmbk5B2OQi0nrUNV7l6XUH0=";
+    sha256 = "sha256-Hx/9WW94rDAjlSZoUz5/43MQ6830OELLogRvHTbmWv0=";
   };
 
-  cargoSha256 = "sha256-X7ULfb2+9l8ik12SwWCTdUfki6xbk8pCnFaiEvCwYGw=";
+  cargoSha256 = "sha256-TYDNx1TNGcREaeHXaejTeMDEITTTUrHCrExZYa+MSHg=";
 
   nativeBuildInputs = [ perl ];
 
diff --git a/pkgs/applications/networking/cluster/tilt/default.nix b/pkgs/applications/networking/cluster/tilt/default.nix
index 415a895e523f..7f7f34d1cb5c 100644
--- a/pkgs/applications/networking/cluster/tilt/default.nix
+++ b/pkgs/applications/networking/cluster/tilt/default.nix
@@ -5,13 +5,13 @@ buildGoModule rec {
   /* Do not use "dev" as a version. If you do, Tilt will consider itself
     running in development environment and try to serve assets from the
     source tree, which is not there once build completes.  */
-  version = "0.18.8";
+  version = "0.18.9";
 
   src = fetchFromGitHub {
     owner  = "tilt-dev";
     repo   = pname;
     rev    = "v${version}";
-    sha256 = "sha256-ICJrY4XUrxVeZlMx69SB/ounfIwLFSguf9bhLOpYP3E=";
+    sha256 = "sha256-bsLqTpBhYeDMAv8vmnbjz+bmkyGqX3V7OkOwCprftC0=";
   };
   vendorSha256 = null;
 
diff --git a/pkgs/applications/networking/mailreaders/mailnag/default.nix b/pkgs/applications/networking/mailreaders/mailnag/default.nix
index 1fa9c66c8ff6..9a2bd563fc8d 100644
--- a/pkgs/applications/networking/mailreaders/mailnag/default.nix
+++ b/pkgs/applications/networking/mailreaders/mailnag/default.nix
@@ -1,5 +1,4 @@
 { lib
-, callPackage
 , fetchFromGitHub
 , gettext
 , xorg # for lndir
@@ -24,13 +23,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "mailnag";
-  version = "2.1.0";
+  version = "2.2.0";
 
   src = fetchFromGitHub {
     owner = "pulb";
     repo = "mailnag";
     rev = "v${version}";
-    sha256 = "08jqs3v01a9gkjca9xgjidhdgvnlm4541z9bwh9m3k5p2g76sz96";
+    sha256 = "0m1cyzwzm7z4p2v31dx098a1iar7dbilwyjcxiqnjx05nlmiqvgf";
   };
 
   buildInputs = [
diff --git a/pkgs/applications/office/ledger/default.nix b/pkgs/applications/office/ledger/default.nix
index 7f543c9bbcc6..5478382cbd83 100644
--- a/pkgs/applications/office/ledger/default.nix
+++ b/pkgs/applications/office/ledger/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitHub, cmake, boost, gmp, mpfr, libedit, python
+{ stdenv, lib, fetchFromGitHub, cmake, boost, gmp, mpfr, libedit, python3
 , texinfo, gnused, usePython ? true }:
 
 stdenv.mkDerivation rec {
@@ -15,8 +15,8 @@ stdenv.mkDerivation rec {
   outputs = [ "out" "dev" ];
 
   buildInputs = [
-    (boost.override { enablePython = usePython; })
-    gmp mpfr libedit python gnused
+    (boost.override { enablePython = usePython; python = python3; })
+    gmp mpfr libedit python3 gnused
   ];
 
   nativeBuildInputs = [ cmake texinfo ];
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
   # however, that would write to a different nixstore path, pass our own sitePackages location
   prePatch = lib.optionalString usePython ''
     substituteInPlace src/CMakeLists.txt \
-      --replace 'DESTINATION ''${Python_SITEARCH}' 'DESTINATION "${python.sitePackages}"'
+      --replace 'DESTINATION ''${Python_SITEARCH}' 'DESTINATION "${python3.sitePackages}"'
   '';
 
   installTargets = [ "doc" "install" ];
diff --git a/pkgs/applications/science/electronics/hal-hardware-analyzer/default.nix b/pkgs/applications/science/electronics/hal-hardware-analyzer/default.nix
index 2c5ee674a23d..e84e9b7400e4 100644
--- a/pkgs/applications/science/electronics/hal-hardware-analyzer/default.nix
+++ b/pkgs/applications/science/electronics/hal-hardware-analyzer/default.nix
@@ -1,17 +1,17 @@
 { lib, stdenv, fetchFromGitHub, cmake, ninja, pkg-config, python3Packages
 , boost, rapidjson, qtbase, qtsvg, igraph, spdlog, wrapQtAppsHook
-, fmt, graphviz, llvmPackages ? null
+, fmt, graphviz, llvmPackages, z3
 }:
 
 stdenv.mkDerivation rec {
-  version = "3.1.9";
+  version = "3.2.5";
   pname = "hal-hardware-analyzer";
 
   src = fetchFromGitHub {
     owner = "emsec";
     repo = "hal";
     rev = "v${version}";
-    sha256 = "0yvvlx0hq73x20va4csa8kyx3x4z648s6l6qqirzjpmxa1w91xc6";
+    sha256 = "0hc10wbngh4gfiiy9ndkf1y6dclcgy38x1n9k5wpvmf13vdah3zy";
   };
   # make sure bundled dependencies don't get in the way - install also otherwise
   # copies them in full to the output, bloating the package
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
   '';
 
   nativeBuildInputs = [ cmake ninja pkg-config ];
-  buildInputs = [ qtbase qtsvg boost rapidjson igraph spdlog fmt graphviz wrapQtAppsHook ]
+  buildInputs = [ qtbase qtsvg boost rapidjson igraph spdlog fmt graphviz wrapQtAppsHook z3 ]
     ++ (with python3Packages; [ python pybind11 ])
     ++ lib.optional stdenv.cc.isClang llvmPackages.openmp;
 
diff --git a/pkgs/development/compilers/ponyc/default.nix b/pkgs/development/compilers/ponyc/default.nix
index 3a2e3c4b944c..9fc8188daa10 100644
--- a/pkgs/development/compilers/ponyc/default.nix
+++ b/pkgs/development/compilers/ponyc/default.nix
@@ -1,15 +1,15 @@
-{ lib, stdenv, fetchFromGitHub, fetchurl, makeWrapper, pcre2, coreutils, which, libressl, libxml2, cmake, z3, substituteAll,
+{ lib, stdenv, fetchFromGitHub, fetchurl, makeWrapper, pcre2, coreutils, which, openssl, libxml2, cmake, z3, substituteAll,
   cc ? stdenv.cc, lto ? !stdenv.isDarwin }:
 
 stdenv.mkDerivation (rec {
   pname = "ponyc";
-  version = "0.38.1";
+  version = "0.38.3";
 
   src = fetchFromGitHub {
     owner = "ponylang";
     repo = pname;
     rev = version;
-    sha256 = "1hk810k9h3bl641pgw91y4x2qw67rvbapx6p2pk9qz5p7nfcn7qh";
+    sha256 = "14kivmyphi7gbd7mgd4cnsiwl4cl7wih8kwzh7n79s2s4c5hj4ak";
 
 # Due to a bug in LLVM 9.x, ponyc has to include its own vendored patched
 # LLVM.  (The submodule is a specific tag in the LLVM source tree).
@@ -24,7 +24,7 @@ stdenv.mkDerivation (rec {
   };
 
   ponygbenchmark = fetchurl {
-    url = https://github.com/google/benchmark/archive/v1.5.0.tar.gz;
+    url = "https://github.com/google/benchmark/archive/v1.5.0.tar.gz";
     sha256 = "06i2cr4rj126m1zfz0x1rbxv1mw1l7a11mzal5kqk56cdrdicsiw";
     name = "v1.5.0.tar.gz";
   };
@@ -39,7 +39,7 @@ stdenv.mkDerivation (rec {
     (substituteAll {
       src = ./make-safe-for-sandbox.patch;
       googletest = fetchurl {
-        url = https://github.com/google/googletest/archive/release-1.8.1.tar.gz;
+        url = "https://github.com/google/googletest/archive/release-1.8.1.tar.gz";
         sha256 = "17147961i01fl099ygxjx4asvjanwdd446nwbq9v8156h98zxwcv";
         name = "release-1.8.1.tar.gz";
       };
@@ -95,7 +95,7 @@ stdenv.mkDerivation (rec {
     wrapProgram $out/bin/ponyc \
       --prefix PATH ":" "${stdenv.cc}/bin" \
       --set-default CC "$CC" \
-      --prefix PONYPATH : "${lib.makeLibraryPath [ pcre2 libressl (placeholder "out") ]}"
+      --prefix PONYPATH : "${lib.makeLibraryPath [ pcre2 openssl (placeholder "out") ]}"
   '';
 
   # Stripping breaks linking for ponyc
diff --git a/pkgs/development/interpreters/erlang/generic-builder.nix b/pkgs/development/interpreters/erlang/generic-builder.nix
index ab37c726515d..110a93a3ba5a 100644
--- a/pkgs/development/interpreters/erlang/generic-builder.nix
+++ b/pkgs/development/interpreters/erlang/generic-builder.nix
@@ -19,6 +19,7 @@
 , javacSupport ? false, javacPackages ? [ openjdk11 ]
 , odbcSupport ? false, odbcPackages ? [ unixODBC ]
 , withSystemd ? stdenv.isLinux # systemd support in epmd
+, opensslPackage ? openssl
 , wxPackages ? [ libGL libGLU wxGTK xorg.libX11 ]
 , preUnpack ? "", postUnpack ? ""
 , patches ? [], patchPhase ? "", prePatch ? "", postPatch ? ""
@@ -51,7 +52,7 @@ in stdenv.mkDerivation ({
 
   nativeBuildInputs = [ autoconf makeWrapper perl gnum4 libxslt libxml2 ];
 
-  buildInputs = [ ncurses openssl ]
+  buildInputs = [ ncurses opensslPackage ]
     ++ optionals wxSupport wxPackages2
     ++ optionals odbcSupport odbcPackages
     ++ optionals javacSupport javacPackages
@@ -80,7 +81,7 @@ in stdenv.mkDerivation ({
     ./otp_build autoconf
   '';
 
-  configureFlags = [ "--with-ssl=${openssl.dev}" ]
+  configureFlags = [ "--with-ssl=${lib.getDev opensslPackage}" ]
     ++ optional enableThreads "--enable-threads"
     ++ optional enableSmpSupport "--enable-smp-support"
     ++ optional enableKernelPoll "--enable-kernel-poll"
diff --git a/pkgs/development/interpreters/ruby/default.nix b/pkgs/development/interpreters/ruby/default.nix
index a31747c512b3..65189fda0793 100644
--- a/pkgs/development/interpreters/ruby/default.nix
+++ b/pkgs/development/interpreters/ruby/default.nix
@@ -1,6 +1,6 @@
 { stdenv, buildPackages, lib
 , fetchurl, fetchpatch, fetchFromSavannah, fetchFromGitHub
-, zlib, openssl, gdbm, ncurses, readline, groff, libyaml, libffi, autoreconfHook, bison
+, zlib, openssl, gdbm, ncurses, readline, groff, libyaml, libffi, jemalloc, autoreconfHook, bison
 , autoconf, libiconv, libobjc, libunwind, Foundation
 , buildEnv, bundler, bundix
 , makeWrapper, buildRubyGem, defaultGemConfig, removeReferencesTo
@@ -44,6 +44,7 @@ let
       , groff, docSupport ? true
       , libyaml, yamlSupport ? true
       , libffi, fiddleSupport ? true
+      , jemalloc, jemallocSupport ? false
       # By default, ruby has 3 observed references to stdenv.cc:
       #
       # - If you run:
@@ -94,6 +95,7 @@ let
           ++ (op opensslSupport openssl)
           ++ (op gdbmSupport gdbm)
           ++ (op yamlSupport libyaml)
+          ++ (op jemallocSupport jemalloc)
           # Looks like ruby fails to build on darwin without readline even if curses
           # support is not enabled, so add readline to the build inputs if curses
           # support is disabled (if it's enabled, we already have it) and we're
@@ -134,6 +136,7 @@ let
           ++ op useRailsExpress "--with-baseruby=${baseruby}/bin/ruby"
           ++ op (!jitSupport) "--disable-jit-support"
           ++ op (!docSupport) "--disable-install-doc"
+          ++ op (jemallocSupport) "--with-jemalloc"
           ++ ops stdenv.isDarwin [
             # on darwin, we have /usr/include/tk.h -- so the configure script detects
             # that tk is installed
diff --git a/pkgs/development/libraries/nuraft/default.nix b/pkgs/development/libraries/nuraft/default.nix
index 58e5e4013590..f9ae9d5ffe64 100644
--- a/pkgs/development/libraries/nuraft/default.nix
+++ b/pkgs/development/libraries/nuraft/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "nuraft";
-  version = "1.1.2";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "eBay";
     repo = "NuRaft";
     rev = "v${version}";
-    sha256 = "sha256-l6rG8f+JAWfAJxEZPKRHZo2k8x9WbtSJC3gGCSMHYfs=";
+    sha256 = "sha256-1k+AWmpAiHcQVEB5kUaMtNWhOnTBnmJiNU8zL1J/PEk=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/pipewire/default.nix b/pkgs/development/libraries/pipewire/default.nix
index fdd45b4bb0d9..fc566d91e913 100644
--- a/pkgs/development/libraries/pipewire/default.nix
+++ b/pkgs/development/libraries/pipewire/default.nix
@@ -19,13 +19,16 @@
 , libsndfile
 , vulkan-headers
 , vulkan-loader
+, ncurses
 , makeFontsConf
 , callPackage
 , nixosTests
+, withMediaSession ? true
 , gstreamerSupport ? true, gst_all_1 ? null
 , ffmpegSupport ? true, ffmpeg ? null
-, bluezSupport ? true, bluez ? null, sbc ? null, libopenaptx ? null, ldacbt ? null
+, bluezSupport ? true, bluez ? null, sbc ? null, libopenaptx ? null, ldacbt ? null, fdk_aac ? null
 , nativeHspSupport ? true
+, nativeHfpSupport ? true
 , ofonoSupport ? true
 , hsphfpdSupport ? true
 }:
@@ -36,111 +39,117 @@ let
   };
 
   mesonBool = b: if b then "true" else "false";
-in
-stdenv.mkDerivation rec {
-  pname = "pipewire";
-  version = "0.3.18";
 
-  outputs = [
-    "out"
-    "lib"
-    "pulse"
-    "jack"
-    "dev"
-    "doc"
-    "installedTests"
-  ];
+  self = stdenv.mkDerivation rec {
+    pname = "pipewire";
+    version = "0.3.21";
 
-  src = fetchFromGitLab {
-    domain = "gitlab.freedesktop.org";
-    owner = "pipewire";
-    repo = "pipewire";
-    rev = version;
-    sha256 = "1yghhgs18yqrnd0b2r75l5n8yng962r1wszbsi01v6i9zib3jc9g";
-  };
+    outputs = [
+      "out"
+      "lib"
+      "pulse"
+      "jack"
+      "dev"
+      "doc"
+      "mediaSession"
+      "installedTests"
+    ];
 
-  patches = [
-    # Break up a dependency cycle between outputs.
-    ./alsa-profiles-use-libdir.patch
-    # Move installed tests into their own output.
-    ./installed-tests-path.patch
-    # Change the path of the pipewire-pulse binary in the service definition.
-    ./pipewire-pulse-path.patch
-    # Add flag to specify configuration directory (different from the installation directory).
-    ./pipewire-config-dir.patch
-  ];
+    src = fetchFromGitLab {
+      domain = "gitlab.freedesktop.org";
+      owner = "pipewire";
+      repo = "pipewire";
+      rev = version;
+      hash = "sha256:2YJzPTMPIoQQeNja3F53SD4gtpdSlbD/i77hBWiQfuQ=";
+    };
 
-  nativeBuildInputs = [
-    doxygen
-    graphviz
-    meson
-    ninja
-    pkg-config
-  ];
+    patches = [
+      # Break up a dependency cycle between outputs.
+      ./alsa-profiles-use-libdir.patch
+      # Move installed tests into their own output.
+      ./installed-tests-path.patch
+      # Change the path of the pipewire-pulse binary in the service definition.
+      ./pipewire-pulse-path.patch
+      # Add flag to specify configuration directory (different from the installation directory).
+      ./pipewire-config-dir.patch
+    ];
 
-  buildInputs = [
-    alsaLib
-    dbus
-    glib
-    libjack2
-    libsndfile
-    udev
-    vulkan-headers
-    vulkan-loader
-    valgrind
-    systemd
-  ] ++ lib.optionals gstreamerSupport [ gst_all_1.gst-plugins-base gst_all_1.gstreamer ]
-  ++ lib.optional ffmpegSupport ffmpeg
-  ++ lib.optionals bluezSupport [ bluez libopenaptx ldacbt sbc ];
+    nativeBuildInputs = [
+      doxygen
+      graphviz
+      meson
+      ninja
+      pkg-config
+    ];
 
-  mesonFlags = [
-    "-Ddocs=true"
-    "-Dman=false" # we don't have xmltoman
-    "-Dexamples=true" # only needed for `pipewire-media-session`
-    "-Dudevrulesdir=lib/udev/rules.d"
-    "-Dinstalled_tests=true"
-    "-Dinstalled_test_prefix=${placeholder "installedTests"}"
-    "-Dpipewire_pulse_prefix=${placeholder "pulse"}"
-    "-Dlibjack-path=${placeholder "jack"}/lib"
-    "-Dgstreamer=${mesonBool gstreamerSupport}"
-    "-Dffmpeg=${mesonBool ffmpegSupport}"
-    "-Dbluez5=${mesonBool bluezSupport}"
-    "-Dbluez5-backend-native=${mesonBool nativeHspSupport}"
-    "-Dbluez5-backend-ofono=${mesonBool ofonoSupport}"
-    "-Dbluez5-backend-hsphfpd=${mesonBool hsphfpdSupport}"
-    "-Dpipewire_config_dir=/etc/pipewire"
-  ];
+    buildInputs = [
+      alsaLib
+      dbus
+      glib
+      libjack2
+      libsndfile
+      ncurses
+      udev
+      vulkan-headers
+      vulkan-loader
+      valgrind
+      systemd
+    ] ++ lib.optionals gstreamerSupport [ gst_all_1.gst-plugins-base gst_all_1.gstreamer ]
+    ++ lib.optional ffmpegSupport ffmpeg
+    ++ lib.optionals bluezSupport [ bluez libopenaptx ldacbt sbc fdk_aac ];
 
-  FONTCONFIG_FILE = fontsConf; # Fontconfig error: Cannot load default config file
+    mesonFlags = [
+      "-Ddocs=true"
+      "-Dman=false" # we don't have xmltoman
+      "-Dexamples=${mesonBool withMediaSession}" # only needed for `pipewire-media-session`
+      "-Dudevrulesdir=lib/udev/rules.d"
+      "-Dinstalled_tests=true"
+      "-Dinstalled_test_prefix=${placeholder "installedTests"}"
+      "-Dpipewire_pulse_prefix=${placeholder "pulse"}"
+      "-Dlibjack-path=${placeholder "jack"}/lib"
+      "-Dgstreamer=${mesonBool gstreamerSupport}"
+      "-Dffmpeg=${mesonBool ffmpegSupport}"
+      "-Dbluez5=${mesonBool bluezSupport}"
+      "-Dbluez5-backend-hsp-native=${mesonBool nativeHspSupport}"
+      "-Dbluez5-backend-hfp-native=${mesonBool nativeHfpSupport}"
+      "-Dbluez5-backend-ofono=${mesonBool ofonoSupport}"
+      "-Dbluez5-backend-hsphfpd=${mesonBool hsphfpdSupport}"
+      "-Dpipewire_config_dir=/etc/pipewire"
+    ];
 
-  doCheck = true;
+    FONTCONFIG_FILE = fontsConf; # Fontconfig error: Cannot load default config file
 
-  postInstall = ''
-    moveToOutput "share/systemd/user/pipewire-pulse.*" "$pulse"
-    moveToOutput "lib/systemd/user/pipewire-pulse.*" "$pulse"
-    moveToOutput "bin/pipewire-pulse" "$pulse"
-  '';
+    doCheck = true;
 
-  passthru.tests = {
-    installedTests = nixosTests.installed-tests.pipewire;
+    postInstall = ''
+      moveToOutput "share/systemd/user/pipewire-pulse.*" "$pulse"
+      moveToOutput "lib/systemd/user/pipewire-pulse.*" "$pulse"
+      moveToOutput "bin/pipewire-pulse" "$pulse"
+      moveToOutput "bin/pipewire-media-session" "$mediaSession"
+    '';
 
-    # This ensures that all the paths used by the NixOS module are found.
-    test-paths = callPackage ./test-paths.nix {
-      paths-out = [
-        "share/alsa/alsa.conf.d/50-pipewire.conf"
-      ];
-      paths-lib = [
-        "lib/alsa-lib/libasound_module_pcm_pipewire.so"
-        "share/alsa-card-profile/mixer"
-      ];
+    passthru.tests = {
+      installedTests = nixosTests.installed-tests.pipewire;
+
+      # This ensures that all the paths used by the NixOS module are found.
+      test-paths = callPackage ./test-paths.nix {
+        paths-out = [
+          "share/alsa/alsa.conf.d/50-pipewire.conf"
+        ];
+        paths-lib = [
+          "lib/alsa-lib/libasound_module_pcm_pipewire.so"
+          "share/alsa-card-profile/mixer"
+        ];
+      };
+    };
+
+    meta = with lib; {
+      description = "Server and user space API to deal with multimedia pipelines";
+      homepage = "https://pipewire.org/";
+      license = licenses.mit;
+      platforms = platforms.linux;
+      maintainers = with maintainers; [ jtojnar ];
     };
   };
 
-  meta = with lib; {
-    description = "Server and user space API to deal with multimedia pipelines";
-    homepage = "https://pipewire.org/";
-    license = licenses.mit;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ jtojnar ];
-  };
-}
+in self
diff --git a/pkgs/development/libraries/pipewire/pipewire-pulse-path.patch b/pkgs/development/libraries/pipewire/pipewire-pulse-path.patch
index 6ac86b111eef..99782e1bb218 100644
--- a/pkgs/development/libraries/pipewire/pipewire-pulse-path.patch
+++ b/pkgs/development/libraries/pipewire/pipewire-pulse-path.patch
@@ -1,19 +1,22 @@
 diff --git a/meson_options.txt b/meson_options.txt
-index 4b9e46b8..9d73ed06 100644
+index 050a4c31..c481e76c 100644
 --- a/meson_options.txt
 +++ b/meson_options.txt
-@@ -147,3 +147,6 @@ option('pw-cat',
+@@ -148,6 +148,9 @@ option('udev',
  option('udevrulesdir',
         type : 'string',
         description : 'Directory for udev rules (defaults to /lib/udev/rules.d)')
 +option('pipewire_pulse_prefix',
 +       type : 'string',
 +       description : 'Install directory for the pipewire-pulse daemon')
+ option('systemd-user-unit-dir',
+        type : 'string',
+        description : 'Directory for user systemd units (defaults to /usr/lib/systemd/user)')
 diff --git a/src/daemon/systemd/user/meson.build b/src/daemon/systemd/user/meson.build
-index 29fc93d4..f78946f2 100644
+index 46dfbbc8..0d975cec 100644
 --- a/src/daemon/systemd/user/meson.build
 +++ b/src/daemon/systemd/user/meson.build
-@@ -6,7 +6,7 @@ install_data(
+@@ -9,7 +9,7 @@ install_data(
  
  systemd_config = configuration_data()
  systemd_config.set('PW_BINARY', join_paths(pipewire_bindir, 'pipewire'))
diff --git a/pkgs/development/libraries/science/math/libtorch/bin.nix b/pkgs/development/libraries/science/math/libtorch/bin.nix
index 9631f3931cab..72c4e5ac1eb1 100644
--- a/pkgs/development/libraries/science/math/libtorch/bin.nix
+++ b/pkgs/development/libraries/science/math/libtorch/bin.nix
@@ -8,10 +8,16 @@
 , fixDarwinDylibNames
 
 , cudaSupport
-, nvidia_x11
+, cudatoolkit_10_2
+, cudnn_cudatoolkit_10_2
 }:
 
 let
+  # The binary libtorch distribution statically links the CUDA
+  # toolkit. This means that we do not need to provide CUDA to
+  # this derivation. However, we should ensure on version bumps
+  # that the CUDA toolkit for `passthru.tests` is still
+  # up-to-date.
   version = "1.7.1";
   device = if cudaSupport then "cuda" else "cpu";
   srcs = import ./binary-hashes.nix version;
@@ -24,12 +30,7 @@ in stdenv.mkDerivation {
 
   nativeBuildInputs =
     if stdenv.isDarwin then [ fixDarwinDylibNames ]
-    else [ addOpenGLRunpath patchelf ]
-      ++ lib.optionals cudaSupport [ addOpenGLRunpath ];
-
-  buildInputs = [
-    stdenv.cc.cc
-  ] ++ lib.optionals cudaSupport [ nvidia_x11 ];
+    else [ patchelf ] ++ lib.optionals cudaSupport [ addOpenGLRunpath ];
 
   dontBuild = true;
   dontConfigure = true;
@@ -56,9 +57,7 @@ in stdenv.mkDerivation {
   '';
 
   postFixup = let
-    libPaths = [ stdenv.cc.cc.lib ]
-      ++ lib.optionals cudaSupport [ nvidia_x11 ];
-    rpath = lib.makeLibraryPath libPaths;
+    rpath = lib.makeLibraryPath [ stdenv.cc.cc.lib ];
   in lib.optionalString stdenv.isLinux ''
     find $out/lib -type f \( -name '*.so' -or -name '*.so.*' \) | while read lib; do
       echo "setting rpath for $lib..."
@@ -108,12 +107,17 @@ in stdenv.mkDerivation {
 
   outputs = [ "out" "dev" ];
 
-  passthru.tests.cmake = callPackage ./test { };
+  passthru.tests.cmake = callPackage ./test {
+    inherit cudaSupport;
+    cudatoolkit = cudatoolkit_10_2;
+    cudnn = cudnn_cudatoolkit_10_2;
+  };
 
   meta = with lib; {
     description = "C++ API of the PyTorch machine learning framework";
     homepage = "https://pytorch.org/";
     license = licenses.unfree; # Includes CUDA and Intel MKL.
+    maintainers = with maintainers; [ danieldk ];
     platforms = with platforms; linux ++ darwin;
   };
 }
diff --git a/pkgs/development/libraries/science/math/libtorch/test/default.nix b/pkgs/development/libraries/science/math/libtorch/test/default.nix
index e69807871f46..60f9b5ad8846 100644
--- a/pkgs/development/libraries/science/math/libtorch/test/default.nix
+++ b/pkgs/development/libraries/science/math/libtorch/test/default.nix
@@ -1,6 +1,28 @@
-{ stdenv, cmake, libtorch-bin, symlinkJoin }:
+{ lib
+, stdenv
+, cmake
+, libtorch-bin
+, linkFarm
+, symlinkJoin
 
-stdenv.mkDerivation {
+, cudaSupport
+, cudatoolkit
+, cudnn
+}:
+let
+  cudatoolkit_joined = symlinkJoin {
+    name = "${cudatoolkit.name}-unsplit";
+    paths = [ cudatoolkit.out cudatoolkit.lib ];
+  };
+
+  # We do not have access to /run/opengl-driver/lib in the sandbox,
+  # so use a stub instead.
+  cudaStub = linkFarm "cuda-stub" [{
+    name = "libcuda.so.1";
+    path = "${cudatoolkit}/lib/stubs/libcuda.so";
+  }];
+
+in stdenv.mkDerivation {
   pname = "libtorch-test";
   version = libtorch-bin.version;
 
@@ -8,7 +30,11 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [ cmake ];
 
-  buildInputs = [ libtorch-bin ];
+  buildInputs = [ libtorch-bin ] ++
+    lib.optionals cudaSupport [ cudnn ];
+
+  cmakeFlags = lib.optionals cudaSupport
+    [ "-DCUDA_TOOLKIT_ROOT_DIR=${cudatoolkit_joined}" ];
 
   doCheck = true;
 
@@ -17,6 +43,7 @@ stdenv.mkDerivation {
   '';
 
   checkPhase = ''
-    ./test
+    LD_LIBRARY_PATH=${cudaStub}''${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH \
+      ./test
   '';
 }
diff --git a/pkgs/development/python-modules/adafruit-platformdetect/default.nix b/pkgs/development/python-modules/adafruit-platformdetect/default.nix
index cc8ee9462504..1b68cc7bb551 100644
--- a/pkgs/development/python-modules/adafruit-platformdetect/default.nix
+++ b/pkgs/development/python-modules/adafruit-platformdetect/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "Adafruit-PlatformDetect";
-  version = "3.1.0";
+  version = "3.1.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-Wd8Qq/jE/C/zx1CRuKLt5Tz8VHY/4bwUa229aDcCFjk=";
+    sha256 = "sha256-JcqDuTzR2sffEbmhJHRPJggLruc9lKQ4aO/Ab88yo/I=";
   };
 
   nativeBuildInputs = [ setuptools-scm ];
diff --git a/pkgs/development/python-modules/pytorch/bin.nix b/pkgs/development/python-modules/pytorch/bin.nix
index 1ffda5c86b0e..0571269fa8b2 100644
--- a/pkgs/development/python-modules/pytorch/bin.nix
+++ b/pkgs/development/python-modules/pytorch/bin.nix
@@ -5,7 +5,6 @@
 , isPy38
 , isPy39
 , python
-, nvidia_x11
 , addOpenGLRunpath
 , future
 , numpy
@@ -52,7 +51,7 @@ in buildPythonPackage {
   '';
 
   postFixup = let
-    rpath = lib.makeLibraryPath [ stdenv.cc.cc.lib nvidia_x11 ];
+    rpath = lib.makeLibraryPath [ stdenv.cc.cc.lib ];
   in ''
     find $out/${python.sitePackages}/torch/lib -type f \( -name '*.so' -or -name '*.so.*' \) | while read lib; do
       echo "setting rpath for $lib..."
diff --git a/pkgs/development/tools/misc/openfpgaloader/default.nix b/pkgs/development/tools/misc/openfpgaloader/default.nix
index 94f92bfcf298..9537e11e1127 100644
--- a/pkgs/development/tools/misc/openfpgaloader/default.nix
+++ b/pkgs/development/tools/misc/openfpgaloader/default.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "openfpgaloader";
-  version = "0.2.1";
+  version = "0.2.5";
 
   src = fetchFromGitHub {
     owner = "trabucayre";
     repo = "openFPGALoader";
     rev = "v${version}";
-    sha256 = "0j87mlghbanh6c7lrxv0x3p6zgd0wrkcs9b8jf6ifh7b3ivcfg82";
+    sha256 = "sha256-Qbw+vmpxiZXTGM0JwpS5mGzcsSJNegsvmncm+cOVrVE=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
diff --git a/pkgs/games/blobwars/default.nix b/pkgs/games/blobwars/default.nix
new file mode 100644
index 000000000000..b99c9f2b8e36
--- /dev/null
+++ b/pkgs/games/blobwars/default.nix
@@ -0,0 +1,34 @@
+{ stdenv, lib, fetchurl, pkg-config, gettext, SDL2, SDL2_image, SDL2_mixer, SDL2_net, SDL2_ttf, zlib }:
+
+stdenv.mkDerivation rec {
+  pname = "blobwars";
+  version = "2.00";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/${pname}/${pname}-${version}.tar.gz";
+    sha256 = "c406279f6cdf2aed3c6edb8d8be16efeda0217494acd525f39ee2bd3e77e4a99";
+  };
+
+  nativeBuildInputs = [ pkg-config gettext ];
+  buildInputs = [ SDL2 SDL2_image SDL2_mixer SDL2_net SDL2_ttf zlib ];
+  NIX_CFLAGS_COMPILE = [ "-Wno-error" ];
+
+  makeFlags = [ "PREFIX=$(out)" "RELEASE=1" ];
+
+  postInstall = ''
+    install -Dm755 $out/games/blobwars -t $out/bin
+    rm -r $out/games
+    cp -r {data,gfx,sound,music} $out/share/games/blobwars/
+    # fix world readable bit
+    find $out/share/games/blobwars/. -type d -exec chmod 755 {} +
+    find $out/share/games/blobwars/. -type f -exec chmod 644 {} +
+  '';
+
+  meta = with lib; {
+    description = "Platform action game featuring a blob with lots of weapons";
+    homepage = "https://www.parallelrealities.co.uk/games/metalBlobSolid/";
+    license = with licenses; [ gpl2Plus free ];
+    maintainers = with maintainers; [ iblech ];
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/os-specific/linux/btfs/default.nix b/pkgs/os-specific/linux/btfs/default.nix
index dc0b13ef59b4..70864b311d29 100644
--- a/pkgs/os-specific/linux/btfs/default.nix
+++ b/pkgs/os-specific/linux/btfs/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "btfs";
-  version = "2.23";
+  version = "2.24";
 
   src = fetchFromGitHub {
     owner  = "johang";
     repo   = pname;
     rev    = "v${version}";
-    sha256 = "1cfjhyn9cjyyxyd0f08b2ra258pzkljwvkj0iwrjpd0nrbl6wkq5";
+    sha256 = "sha256-fkS0U/MqFRQNi+n7NE4e1cnNICvfST2IQ9FMoJUyj6w=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
diff --git a/pkgs/os-specific/linux/microcode/intel.nix b/pkgs/os-specific/linux/microcode/intel.nix
index d6d04f12f885..3ac8e6dcd4af 100644
--- a/pkgs/os-specific/linux/microcode/intel.nix
+++ b/pkgs/os-specific/linux/microcode/intel.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "microcode-intel";
-  version = "20201118";
+  version = "20210216";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "Intel-Linux-Processor-Microcode-Data-Files";
     rev = "microcode-${version}";
-    sha256 = "1xs3f2rbfqnpz9qs7a1kl363qdyb8fybmmyd37v573clqf7l4lgg";
+    sha256 = "17wrfp7h7xbvncgm1fp103zkyz9n1f820jy6yca1aq208264hjkv";
   };
 
   nativeBuildInputs = [ iucode-tool libarchive ];
diff --git a/pkgs/os-specific/linux/pam_gnupg/default.nix b/pkgs/os-specific/linux/pam_gnupg/default.nix
index 6ffc6050055e..ffb397334c16 100644
--- a/pkgs/os-specific/linux/pam_gnupg/default.nix
+++ b/pkgs/os-specific/linux/pam_gnupg/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pam_gnupg";
-  version = "0.2";
+  version = "0.3";
 
   src = fetchFromGitHub {
     owner = "cruegge";
     repo = "pam-gnupg";
     rev = "v${version}";
-    sha256 = "1d8046clv7r3bl77dbpza4f1zlkjffvdczbb5bci3prz7dyfrwsz";
+    sha256 = "sha256-NDl6MsvIDAXkaLqXt7Wa0T7aulT31P5Z/d/Vb+ILya0=";
   };
 
   configureFlags = [
diff --git a/pkgs/tools/misc/bmap-tools/default.nix b/pkgs/tools/misc/bmap-tools/default.nix
index 79094dc9540a..c78c0121ed0c 100644
--- a/pkgs/tools/misc/bmap-tools/default.nix
+++ b/pkgs/tools/misc/bmap-tools/default.nix
@@ -1,16 +1,18 @@
-{ lib, fetchFromGitHub, python2Packages }:
+{ lib, fetchFromGitHub, python3Packages }:
 
-python2Packages.buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "bmap-tools";
-  version = "3.4";
+  version = "3.6";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "bmap-tools";
     rev = "v${version}";
-    sha256 = "0p0pdwvyf9b4czi1pnhclm1ih8kw78nk2sj4if5hwi7s5423wk5q";
+    sha256 = "01xzrv5nvd2nvj91lz4x9s91y9825j9pj96z0ap6yvy3w2dgvkkl";
   };
 
+  propagatedBuildInputs = with python3Packages; [ six ];
+
   # tests fail only on hydra.
   doCheck = false;
 
diff --git a/pkgs/tools/misc/neofetch/default.nix b/pkgs/tools/misc/neofetch/default.nix
index 1ed201802d53..1826d6846d42 100644
--- a/pkgs/tools/misc/neofetch/default.nix
+++ b/pkgs/tools/misc/neofetch/default.nix
@@ -1,6 +1,6 @@
-{ lib, stdenv, fetchFromGitHub }:
+{ lib, stdenvNoCC, fetchFromGitHub, bash }:
 
-stdenv.mkDerivation rec {
+stdenvNoCC.mkDerivation rec {
   pname = "neofetch";
   version = "7.1.0";
 
@@ -11,7 +11,11 @@ stdenv.mkDerivation rec {
     sha256 = "0i7wpisipwzk0j62pzaigbiq42y1mn4sbraz4my2jlz6ahwf00kv";
   };
 
-  dontBuild = true;
+  strictDeps = true;
+  buildInputs = [ bash ];
+  postPatch = ''
+    patchShebangs --host neofetch
+  '';
 
   makeFlags = [
     "PREFIX=${placeholder "out"}"
diff --git a/pkgs/tools/misc/rlwrap/default.nix b/pkgs/tools/misc/rlwrap/default.nix
index ac1431d3a1be..a78d6f143a12 100644
--- a/pkgs/tools/misc/rlwrap/default.nix
+++ b/pkgs/tools/misc/rlwrap/default.nix
@@ -1,26 +1,30 @@
-{ lib, stdenv, fetchurl, readline }:
+{ lib, stdenv, fetchFromGitHub, autoreconfHook, perl, readline }:
 
 stdenv.mkDerivation rec {
   pname = "rlwrap";
-  version = "0.43";
+  version = "0.45";
 
-  src = fetchurl {
-    url = "https://github.com/hanslub42/rlwrap/releases/download/v${version}/${pname}-${version}.tar.gz";
-    sha256 = "0bzb7ylk2770iv59v2d0gypb21y2xn87m299s9rqm6rdi2vx11lf";
+  src = fetchFromGitHub {
+    owner = "hanslub42";
+    repo = "rlwrap";
+    rev = "v${version}";
+    sha256 = "1ppkjdnxrxh99g4xaiaglm5bmp24006rfahci0cn1g7zwilkjy8s";
   };
 
+  postPatch = ''
+    substituteInPlace src/readline.c \
+      --replace "if(*p >= 0 && *p < ' ')" "if(*p >= 0 && (*p >= 0) && (*p < ' '))"
+  '';
+
+  nativeBuildInputs = [ autoreconfHook perl ];
+
   buildInputs = [ readline ];
 
-  # Be high-bit-friendly
-  preBuild = ''
-    sed -i src/readline.c -e "s@[*]p [<] ' '@(*p >= 0) \\&\\& (*p < ' ')@"
-  '';
-
-  meta = {
+  meta = with lib; {
     description = "Readline wrapper for console programs";
     homepage = "https://github.com/hanslub42/rlwrap";
-    license = lib.licenses.gpl2Plus;
-    platforms = lib.platforms.unix;
-    maintainers = with lib.maintainers; [ ];
+    license = licenses.gpl2Plus;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ SuperSandro2000 ];
   };
 }
diff --git a/pkgs/tools/networking/boundary/default.nix b/pkgs/tools/networking/boundary/default.nix
index 304972717df9..37cb23f9876f 100644
--- a/pkgs/tools/networking/boundary/default.nix
+++ b/pkgs/tools/networking/boundary/default.nix
@@ -14,12 +14,12 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "boundary";
-  version = "0.1.6";
+  version = "0.1.7";
 
   src = fetchsrc version {
-    x86_64-linux = "sha256-6Pwl8smp6ZX57hzPc7e8gVSqnPHse+RvhU2xprG/2dg=";
-    aarch64-linux = "sha256-/ZhLZ/Sj0h4HvOJthe83Y5Hqpz1UYiaQZxuyR8loI44=";
-    x86_64-darwin = "sha256-s+XoEmup/jvIf+jGI3OPIGFDwsWbgE1yuySLWsC3jJE=";
+    x86_64-linux = "sha256-cSD9V/Hj/eEc6k+LMNRnSEA94fA6bQUfCgA+XdqAR4k=";
+    aarch64-linux = "sha256-MG97PhG/t1rdmTF3n2YHYsTo8VODCaY3cfnv8YHgAY8=";
+    x86_64-darwin = "sha256-p60UiIy9DGx7AaEvmyo4FLa0Z67MQRNJkw1nHaM6eww=";
   };
 
   dontConfigure = true;
@@ -29,6 +29,14 @@ stdenv.mkDerivation rec {
     install -D boundary $out/bin/boundary
   '';
 
+  doInstallCheck = true;
+  installCheckPhase = ''
+    runHook preInstallCheck
+    $out/bin/boundary --help
+    $out/bin/boundary version
+    runHook postInstallCheck
+  '';
+
   dontPatchELF = true;
   dontPatchShebangs = true;
 
diff --git a/pkgs/tools/networking/pritunl-ssh/default.nix b/pkgs/tools/networking/pritunl-ssh/default.nix
new file mode 100644
index 000000000000..586fc780699f
--- /dev/null
+++ b/pkgs/tools/networking/pritunl-ssh/default.nix
@@ -0,0 +1,29 @@
+{ lib, stdenv, fetchFromGitHub, python3 }:
+
+stdenv.mkDerivation rec {
+  pname   = "pritunl-ssh";
+  version = "1.0.1674.4";
+
+  src = fetchFromGitHub {
+    owner = "pritunl";
+    repo = "pritunl-zero-client";
+    rev = version;
+    sha256 = "07z60lipbwm0p7s2bxcij21jid8w4nyh6xk2qq5qdm4acq4k1i88";
+  };
+
+  buildInputs = [ python3 ];
+
+  installPhase = ''
+    mkdir -p $out/bin
+    install ssh_client.py $out/bin/pritunl-ssh
+    install ssh_host_client.py $out/bin/pritunl-ssh-host
+  '';
+
+  meta = with lib; {
+    description = "Pritunl Zero SSH client";
+    homepage = "https://github.com/pritunl/pritunl-zero-client";
+    license = licenses.unfree;
+    maintainers = with maintainers; [ Thunderbottom ];
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/tools/networking/tendermint/default.nix b/pkgs/tools/networking/tendermint/default.nix
index 059c531cc612..d822dfc7fc6c 100644
--- a/pkgs/tools/networking/tendermint/default.nix
+++ b/pkgs/tools/networking/tendermint/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "tendermint";
-  version = "0.34.3";
+  version = "0.34.4";
 
   src = fetchFromGitHub {
     owner = "tendermint";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-tkIoLYfqlnyyAAgEKyQgE317uwyhc8xRTCTUXi+9r9s=";
+    sha256 = "sha256-Kh2B+2BImQdDOo9iyg4ijSMUNQjXFaqWDStpAQL3fy8=";
   };
 
-  vendorSha256 = "sha256-DviK+MkJwcv2Dhwmqra5G/fTaWxXFbUSUVnAkSHjeII=";
+  vendorSha256 = "sha256-0Y9QDBVNYE2x3nY3loRKTCtYWXRnK7v+drRVvTMY4Dg=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/typesetting/fop/default.nix b/pkgs/tools/typesetting/fop/default.nix
index a572ce216ee6..1c5e7b0079df 100644
--- a/pkgs/tools/typesetting/fop/default.nix
+++ b/pkgs/tools/typesetting/fop/default.nix
@@ -2,22 +2,25 @@
 
 stdenv.mkDerivation rec {
   pname = "fop";
-  version = "2.1";
+  version = "2.6";
 
   src = fetchurl {
     url = "mirror://apache/xmlgraphics/fop/source/${pname}-${version}-src.tar.gz";
-    sha256 = "165rx13q47l6qc29ppr7sg1z26vw830s3rkklj5ap7wgvy0ivbz5";
+    sha256 = "145qph3c0m4bmb342qxq1hwsg594lndmfs9ga1v7pk53s34sckq8";
   };
 
   buildInputs = [ ant jdk ];
 
-  buildPhase = "ant";
+  # build only the "package" target, which generates the fop command.
+  buildPhase = ''
+     export JAVA_TOOL_OPTIONS="-Dfile.encoding=UTF8"
+     ant -f fop/build.xml package
+  '';
 
   installPhase = ''
     mkdir -p $out/bin $out/lib $out/share/doc/fop
-
-    cp build/*.jar lib/*.jar $out/lib/
-    cp -r README examples/ $out/share/doc/fop/
+    cp fop/build/*.jar fop/lib/*.jar $out/lib/
+    cp -r README fop/examples/ $out/share/doc/fop/
 
     # There is a fop script in the source archive, but it has many impurities.
     # Instead of patching out 90 % of the script, we write our own.
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 6a8f24b91fd0..6451aaf5dae3 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1677,7 +1677,6 @@ in
     else libtensorflow-bin;
 
   libtorch-bin = callPackage ../development/libraries/science/math/libtorch/bin.nix {
-    inherit (linuxPackages) nvidia_x11;
     cudaSupport = config.cudaSupport or false;
   };
 
@@ -7242,6 +7241,8 @@ in
 
   prettyping = callPackage ../tools/networking/prettyping { };
 
+  pritunl-ssh = callPackage ../tools/networking/pritunl-ssh { };
+
   profile-cleaner = callPackage ../tools/misc/profile-cleaner { };
 
   profile-sync-daemon = callPackage ../tools/misc/profile-sync-daemon { };
@@ -26537,6 +26538,8 @@ in
 
   blobby = callPackage ../games/blobby { };
 
+  blobwars = callPackage ../games/blobwars { };
+
   boohu = callPackage ../games/boohu { };
 
   braincurses = callPackage ../games/braincurses { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 9b5bdfbfb7de..b9a89164f8e8 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -6510,9 +6510,7 @@ in {
 
   pytorch = callPackage ../development/python-modules/pytorch { cudaSupport = pkgs.config.cudaSupport or false; };
 
-  pytorch-bin = callPackage ../development/python-modules/pytorch/bin.nix {
-    inherit (pkgs.linuxPackages) nvidia_x11;
-  };
+  pytorch-bin = callPackage ../development/python-modules/pytorch/bin.nix { };
 
   pytorch-lightning = callPackage ../development/python-modules/pytorch-lightning { };