diff --git a/nixos/modules/security/pam.nix b/nixos/modules/security/pam.nix
index b5bd22f6ba7..3cde7e95155 100644
--- a/nixos/modules/security/pam.nix
+++ b/nixos/modules/security/pam.nix
@@ -965,7 +965,7 @@ in
         mr ${pkgs.apparmor-pam}/lib/security/pam_apparmor.so,
       '' +
       optionalString (isEnabled (cfg: cfg.enableKwallet)) ''
-        mr ${pkgs.plasma5.kwallet-pam}/lib/security/pam_kwallet5.so,
+        mr ${pkgs.plasma5Packages.kwallet-pam}/lib/security/pam_kwallet5.so,
       '' +
       optionalString config.virtualisation.lxc.lxcfs.enable ''
         mr ${pkgs.lxc}/lib/security/pam_cgfs.so
diff --git a/nixos/modules/virtualisation/vmware-guest.nix b/nixos/modules/virtualisation/vmware-guest.nix
index 962a9059ea4..9465a8d6800 100644
--- a/nixos/modules/virtualisation/vmware-guest.nix
+++ b/nixos/modules/virtualisation/vmware-guest.nix
@@ -56,5 +56,7 @@ in
           ${open-vm-tools}/bin/vmware-user-suid-wrapper
         '';
     };
+
+    services.udev.packages = [ open-vm-tools ];
   };
 }
diff --git a/pkgs/applications/audio/strawberry/default.nix b/pkgs/applications/audio/strawberry/default.nix
index c8ffba2c2a7..8e052759231 100644
--- a/pkgs/applications/audio/strawberry/default.nix
+++ b/pkgs/applications/audio/strawberry/default.nix
@@ -28,6 +28,7 @@
 , qtx11extras
 , qttools
 , withGstreamer ? true
+, glib-networking
 , gst_all_1 ? null
 , withVlc ? true
 , libvlc ? null
@@ -69,6 +70,7 @@ mkDerivation rec {
     p11-kit
   ]
   ++ lib.optionals withGstreamer (with gst_all_1; [
+    glib-networking
     gstreamer
     gst-plugins-base
     gst-plugins-good
@@ -82,8 +84,11 @@ mkDerivation rec {
     util-linux
   ];
 
-  postInstall = ''
-    qtWrapperArgs+=(--prefix GST_PLUGIN_SYSTEM_PATH_1_0 : "$GST_PLUGIN_SYSTEM_PATH_1_0")
+  postInstall = lib.optionalString withGstreamer ''
+    qtWrapperArgs+=(
+      --prefix GST_PLUGIN_SYSTEM_PATH_1_0 : "$GST_PLUGIN_SYSTEM_PATH_1_0"
+      --prefix GIO_EXTRA_MODULES : "${glib-networking.out}/lib/gio/modules"
+    )
   '';
 
   meta = with lib; {
diff --git a/pkgs/applications/graphics/sane/backends/airscan/default.nix b/pkgs/applications/graphics/sane/backends/airscan/default.nix
index d2ff4339890..8d0e32e2b4e 100644
--- a/pkgs/applications/graphics/sane/backends/airscan/default.nix
+++ b/pkgs/applications/graphics/sane/backends/airscan/default.nix
@@ -2,7 +2,7 @@
 , libxml2, gnutls, sane-backends }:
 stdenv.mkDerivation rec {
   pname = "sane-airscan";
-  version = "0.99.24";
+  version = "0.99.26";
 
   nativeBuildInputs = [ meson ninja pkg-config ];
   buildInputs = [ avahi gnutls libjpeg libpng libxml2 sane-backends ];
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     owner = "alexpevzner";
     repo = pname;
     rev = version;
-    sha256 = "sha256-2zSLC9P7Q/GMefHvmrUz6nV2hgScb4BhPAkahNBouqk=";
+    sha256 = "08snfg5zx9924ryww0kxf1kgl085yw7fg6l4f1kzlhcmqf1958w5";
   };
 
   meta = with lib; {
diff --git a/pkgs/applications/networking/browsers/firefox/wrapper.nix b/pkgs/applications/networking/browsers/firefox/wrapper.nix
index 13becfc4f62..f338a41be71 100644
--- a/pkgs/applications/networking/browsers/firefox/wrapper.nix
+++ b/pkgs/applications/networking/browsers/firefox/wrapper.nix
@@ -11,6 +11,7 @@
 , libkrb5
 , libva
 , mesa # firefox wants gbm for drm+dmabuf
+, cups
 }:
 
 ## configurability of the wrapper itself
@@ -62,7 +63,7 @@ let
           ++ lib.optional (cfg.enableFXCastBridge or false) fx_cast_bridge
           ++ extraNativeMessagingHosts
         );
-      libs =   lib.optionals stdenv.isLinux [ udev libva mesa libnotify xorg.libXScrnSaver ]
+      libs =   lib.optionals stdenv.isLinux [ udev libva mesa libnotify xorg.libXScrnSaver cups ]
             ++ lib.optional (pipewireSupport && lib.versionAtLeast version "83") pipewire
             ++ lib.optional ffmpegSupport ffmpeg
             ++ lib.optional gssSupport libkrb5
diff --git a/pkgs/applications/networking/instant-messengers/teamspeak/server.nix b/pkgs/applications/networking/instant-messengers/teamspeak/server.nix
index e266265291b..daa97b68217 100644
--- a/pkgs/applications/networking/instant-messengers/teamspeak/server.nix
+++ b/pkgs/applications/networking/instant-messengers/teamspeak/server.nix
@@ -4,13 +4,13 @@ let
   arch = if stdenv.is64bit then "amd64" else "x86";
 in stdenv.mkDerivation rec {
   pname = "teamspeak-server";
-  version = "3.13.3";
+  version = "3.13.5";
 
   src = fetchurl {
     url = "https://files.teamspeak-services.com/releases/server/${version}/teamspeak3-server_linux_${arch}-${version}.tar.bz2";
     sha256 = if stdenv.is64bit
-      then "sha256-+b9S0ekQmXF5KwvVcmHIDpp0iZRO2W1ls8eYhDzjUUw="
-      else "sha256-Qu6xPzbUdqO93j353cfQILlFYqmwFSnFWG9TjniX0+c=";
+      then "sha256-2tSX/ET2lZsi0mVB3KnbnBXMSTRsneGUA8w6mZ6TmlY="
+      else "sha256-RdxG4nGXTTSY+P5oZu4uP5l7gKcU9C6uIILyNldSK50=";
   };
 
   buildInputs = [ stdenv.cc.cc postgresql.lib ];
@@ -18,6 +18,8 @@ in stdenv.mkDerivation rec {
   nativeBuildInputs = [ autoPatchelfHook ];
 
   installPhase = ''
+    runHook preInstall
+
     # Install files.
     mkdir -p $out/lib/teamspeak
     mv * $out/lib/teamspeak/
@@ -26,18 +28,20 @@ in stdenv.mkDerivation rec {
     mkdir -p $out/bin/
     ln -s $out/lib/teamspeak/ts3server $out/bin/ts3server
     ln -s $out/lib/teamspeak/tsdns/tsdnsserver $out/bin/tsdnsserver
+
+    runHook postInstall
   '';
 
   passthru.updateScript = writeScript "update-teampeak-server" ''
     #!/usr/bin/env nix-shell
-    #!nix-shell -i bash -p common-updater-scripts curl gnugrep gnused
+    #!nix-shell -i bash -p common-updater-scripts curl gnugrep gnused jq pup
 
     set -eu -o pipefail
 
     version=$( \
-        curl -s "https://www.teamspeak.de/download/teamspeak-3-amd64-server-linux/" \
-        | grep softwareVersion \
-        | sed -E -e 's/^.*<span itemprop="softwareVersion">([^<]+)<\/span>.*$/\1/' \
+      curl https://www.teamspeak.com/en/downloads/ \
+        | pup "#server .linux .version json{}" \
+        | jq -r ".[0].text"
     )
 
     versionOld=$(nix-instantiate --eval --strict -A "teamspeak_server.version")
diff --git a/pkgs/applications/virtualization/open-vm-tools/default.nix b/pkgs/applications/virtualization/open-vm-tools/default.nix
index e7479957444..da0a07c60a5 100644
--- a/pkgs/applications/virtualization/open-vm-tools/default.nix
+++ b/pkgs/applications/virtualization/open-vm-tools/default.nix
@@ -1,18 +1,20 @@
-{ stdenv, lib, fetchFromGitHub, makeWrapper, autoreconfHook, fetchpatch,
-  fuse, libmspack, openssl, pam, xercesc, icu, libdnet, procps, libtirpc, rpcsvc-proto,
-  libX11, libXext, libXinerama, libXi, libXrender, libXrandr, libXtst,
-  pkg-config, glib, gdk-pixbuf-xlib, gtk3, gtkmm3, iproute2, dbus, systemd, which,
-  withX ? true }:
+{ stdenv, lib, fetchFromGitHub, makeWrapper, autoreconfHook
+, bash, fuse, libmspack, openssl, pam, xercesc, icu, libdnet, procps, libtirpc, rpcsvc-proto
+, libX11, libXext, libXinerama, libXi, libXrender, libXrandr, libXtst
+, pkg-config, glib, gdk-pixbuf-xlib, gtk3, gtkmm3, iproute2, dbus, systemd, which
+, libdrm, udev
+, withX ? true
+}:
 
 stdenv.mkDerivation rec {
   pname = "open-vm-tools";
-  version = "11.2.5";
+  version = "11.3.0";
 
   src = fetchFromGitHub {
     owner  = "vmware";
     repo   = "open-vm-tools";
     rev    = "stable-${version}";
-    sha256 = "sha256-Jv+NSKw/+l+b4lfVGgCZFlcTScO/WAO/d7DtI0FAEV4=";
+    sha256 = "1yfffxc7drr1hyg28jcvly7jn1bm4ca76lmma5ykbmba2qqszx49";
   };
 
   sourceRoot = "${src.name}/open-vm-tools";
@@ -20,32 +22,15 @@ stdenv.mkDerivation rec {
   outputs = [ "out" "dev" ];
 
   nativeBuildInputs = [ autoreconfHook makeWrapper pkg-config ];
-  buildInputs = [ fuse glib icu libdnet libmspack libtirpc openssl pam procps rpcsvc-proto xercesc ]
+  buildInputs = [ fuse glib icu libdnet libdrm libmspack libtirpc openssl pam procps rpcsvc-proto udev xercesc ]
       ++ lib.optionals withX [ gdk-pixbuf-xlib gtk3 gtkmm3 libX11 libXext libXinerama libXi libXrender libXrandr libXtst ];
 
-  patches = [
-    # Fix building with glib 2.68. Remove after next release.
-    # We drop AUTHORS due to conflicts when applying.
-    # https://github.com/vmware/open-vm-tools/pull/505
-    (fetchpatch {
-      url = "https://github.com/vmware/open-vm-tools/commit/82931a1bcb39d5132910c7fb2ddc086c51d06662.patch";
-      stripLen = 1;
-      excludes = [ "AUTHORS" ];
-      sha256 = "0yz5hnngr5vd4416hvmh8734a9vxa18d2xd37kl7if0p9vik6zlg";
-    })
-  ];
-
   postPatch = ''
-     # Build bugfix for 10.1.0, stolen from Arch PKGBUILD
-     mkdir -p common-agent/etc/config
-     sed -i 's|.*common-agent/etc/config/Makefile.*|\\|' configure.ac
-
      sed -i 's,etc/vmware-tools,''${prefix}/etc/vmware-tools,' Makefile.am
      sed -i 's,^confdir = ,confdir = ''${prefix},' scripts/Makefile.am
      sed -i 's,usr/bin,''${prefix}/usr/bin,' scripts/Makefile.am
      sed -i 's,etc/vmware-tools,''${prefix}/etc/vmware-tools,' services/vmtoolsd/Makefile.am
      sed -i 's,$(PAM_PREFIX),''${prefix}/$(PAM_PREFIX),' services/vmtoolsd/Makefile.am
-     sed -i 's,$(UDEVRULESDIR),''${prefix}/$(UDEVRULESDIR),' udev/Makefile.am
 
      # Avoid a glibc >= 2.25 deprecation warning that gets fatal via -Werror.
      sed 1i'#include <sys/sysmacros.h>' -i lib/wiper/wiperPosix.c
@@ -54,24 +39,28 @@ stdenv.mkDerivation rec {
      sed -i 's,/sbin/shutdown,shutdown,' lib/system/systemLinux.c
   '';
 
-  configureFlags = [ "--without-kernel-modules" "--without-xmlsecurity" ]
-    ++ lib.optional (!withX) "--without-x";
+  configureFlags = [
+    "--without-kernel-modules"
+    "--without-xmlsecurity"
+    "--with-udev-rules-dir=${placeholder "out"}/lib/udev/rules.d"
+  ] ++ lib.optional (!withX) "--without-x";
 
   enableParallelBuilding = true;
 
   NIX_CFLAGS_COMPILE = builtins.toString [
-    # igrone glib-2.62 deprecations
-    # Drop in next stable release.
-    "-DGLIB_DISABLE_DEPRECATION_WARNINGS"
-
     # fix build with gcc9
     "-Wno-error=address-of-packed-member"
     "-Wno-error=format-overflow"
   ];
 
+  preConfigure = ''
+    mkdir -p ${placeholder "out"}/lib/udev/rules.d
+  '';
+
   postInstall = ''
     wrapProgram "$out/etc/vmware-tools/scripts/vmware/network" \
       --prefix PATH ':' "${lib.makeBinPath [ iproute2 dbus systemd which ]}"
+    substituteInPlace "$out/lib/udev/rules.d/99-vmware-scsi-udev.rules" --replace "/bin/sh" "${bash}/bin/sh"
   '';
 
   meta = with lib; {
diff --git a/pkgs/applications/window-managers/dwm/default.nix b/pkgs/applications/window-managers/dwm/default.nix
index 2c3ed2e47e8..088581b6701 100644
--- a/pkgs/applications/window-managers/dwm/default.nix
+++ b/pkgs/applications/window-managers/dwm/default.nix
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
       tags.
     '';
     license = licenses.mit;
-    maintainers = with maintainers; [ viric ];
+    maintainers = with maintainers; [ viric neonfuz ];
     platforms = platforms.all;
   };
 }
diff --git a/pkgs/data/fonts/twemoji-color-font/default.nix b/pkgs/data/fonts/twemoji-color-font/default.nix
index a2fde6813b7..ae1d3f9927f 100644
--- a/pkgs/data/fonts/twemoji-color-font/default.nix
+++ b/pkgs/data/fonts/twemoji-color-font/default.nix
@@ -5,20 +5,20 @@
 
 stdenv.mkDerivation rec {
   pname = "twemoji-color-font";
-  version = "13.0.1";
+  version = "13.1.0";
 
   # We fetch the prebuilt font because building it takes 1.5 hours on hydra.
   # Relevant issue: https://github.com/NixOS/nixpkgs/issues/97871
   src = fetchurl {
     url = "https://github.com/eosrei/twemoji-color-font/releases/download/v${version}/TwitterColorEmoji-SVGinOT-Linux-${version}.tar.gz";
-    sha256 = "1mn2cb6a3v0q8i81s9a8bk49nbwxq91n6ki7827i7rhjkncb0mbn";
+    sha256 = "sha256-V8DWUUAK+HLDPcq3izPs174PfUnaSeLByDpZwhUIX5Q=";
   };
 
   dontBuild = true;
 
   installPhase = ''
     install -Dm755 TwitterColorEmoji-SVGinOT.ttf $out/share/fonts/truetype/TwitterColorEmoji-SVGinOT.ttf
-    install -Dm644 fontconfig/56-twemoji-color.conf $out/etc/fonts/conf.d/56-twemoji-color.conf
+    install -Dm644 fontconfig/46-twemoji-color.conf $out/etc/fonts/conf.d/46-twemoji-color.conf
   '';
 
   meta = with lib; {
diff --git a/pkgs/desktops/gnome/apps/gnome-boxes/default.nix b/pkgs/desktops/gnome/apps/gnome-boxes/default.nix
index 9ddd53ca429..8d0e86b1a93 100644
--- a/pkgs/desktops/gnome/apps/gnome-boxes/default.nix
+++ b/pkgs/desktops/gnome/apps/gnome-boxes/default.nix
@@ -49,6 +49,7 @@
 , webkitgtk
 , vte
 , glib-networking
+, qemu-utils
 }:
 
 stdenv.mkDerivation rec {
@@ -120,7 +121,7 @@ stdenv.mkDerivation rec {
   ];
 
   preFixup = ''
-    gappsWrapperArgs+=(--prefix PATH : "${lib.makeBinPath [ mtools cdrkit libcdio ]}")
+    gappsWrapperArgs+=(--prefix PATH : "${lib.makeBinPath [ mtools cdrkit libcdio qemu-utils ]}")
   '';
 
   postPatch = ''
diff --git a/pkgs/desktops/gnome/core/caribou/default.nix b/pkgs/desktops/gnome/core/caribou/default.nix
index 5985ff82266..50fb1c3de56 100644
--- a/pkgs/desktops/gnome/core/caribou/default.nix
+++ b/pkgs/desktops/gnome/core/caribou/default.nix
@@ -1,6 +1,6 @@
 { fetchurl, lib, stdenv, pkg-config, gnome, glib, gtk3, clutter, dbus, python3, libxml2
 , libxklavier, libXtst, gtk2, intltool, libxslt, at-spi2-core, autoreconfHook
-, wrapGAppsHook, libgee }:
+, wrapGAppsHook, libgee, vala_0_40 }:
 
 let
   pname = "caribou";
@@ -21,9 +21,19 @@ in stdenv.mkDerivation rec {
       url = "https://bugzilla.gnome.org/attachment.cgi?id=364774";
       sha256 = "15k1455grf6knlrxqbjnk7sals1730b0whj30451scp46wyvykvd";
     })
+    (fetchurl {
+      name = "fix-build-modern-vala.patch";
+      url = "https://gitlab.gnome.org/GNOME/caribou/-/commit/76fbd11575f918fc898cb0f5defe07f67c11ec38.patch";
+      sha256 = "0qy27zk7889hg51nx40afgppcx9iaihxbg3aqz9w35d6fmhr2k2y";
+    })
+    (fetchurl {
+      name = "CVE-2021-3567.patch";
+      url = "https://gitlab.gnome.org/GNOME/caribou/-/commit/d41c8e44b12222a290eaca16703406b113a630c6.patch";
+      sha256 = "1vd2j3823k2p3msv7fq2437p3jvxzbd7hyh07i80g9754ylh92y8";
+    })
   ];
 
-  nativeBuildInputs = [ pkg-config intltool libxslt libxml2 autoreconfHook wrapGAppsHook ];
+  nativeBuildInputs = [ pkg-config intltool libxslt libxml2 autoreconfHook wrapGAppsHook vala_0_40 ];
 
   buildInputs = [
     glib gtk3 clutter at-spi2-core dbus pythonEnv python3.pkgs.pygobject3
diff --git a/pkgs/desktops/gnome/core/eog/default.nix b/pkgs/desktops/gnome/core/eog/default.nix
index 426a8783352..e67a623069b 100644
--- a/pkgs/desktops/gnome/core/eog/default.nix
+++ b/pkgs/desktops/gnome/core/eog/default.nix
@@ -28,11 +28,11 @@
 
 stdenv.mkDerivation rec {
   pname = "eog";
-  version = "40.1";
+  version = "40.2";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-e+CGA3/tm2v4S6yXqD48kYMBt+nJavEwsnJS0KURFok=";
+    sha256 = "sha256-kITimZMftX3ih+V9vS7i0pf7Z0DA1TW52o1fGWqP0ZU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/spice/correct-meson.patch b/pkgs/development/libraries/spice/correct-meson.patch
deleted file mode 100644
index d3422cb915b..00000000000
--- a/pkgs/development/libraries/spice/correct-meson.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-diff --git a/meson.build b/meson.build
-index 8b8ae8bb..e58c436c 100644
---- a/meson.build
-+++ b/meson.build
-@@ -2,7 +2,7 @@
- # project definition
- #
- project('spice', 'c',
--        version : run_command('build-aux/git-version-gen', '${MESON_SOURCE_ROOT}/.tarball-version', check : true).stdout().strip(),
-+        version : run_command('build-aux/git-version-gen', meson.source_root() + '/.tarball-version', check : true).stdout().strip(),
-         license : 'LGPLv2.1',
-         meson_version : '>= 0.48')
-
-diff --git a/server/meson.build b/server/meson.build
-index 34d8eef1..988ccab2 100644
---- a/server/meson.build
-+++ b/server/meson.build
-@@ -7,7 +7,7 @@ version_info = meson.project_version().split('.')
- major = '@0@'.format(version_info[0])
- minor = '@0@'.format(version_info[1])
- micro = version_info[2].to_int()
--if not version_info[3].contains('git')
-+if not version_info.contains('git')
-   micro += 1
- endif
- micro = '@0@'.format(micro)
diff --git a/pkgs/development/libraries/spice/default.nix b/pkgs/development/libraries/spice/default.nix
index 584b1e15a8e..1934866f138 100644
--- a/pkgs/development/libraries/spice/default.nix
+++ b/pkgs/development/libraries/spice/default.nix
@@ -26,18 +26,13 @@
 
 stdenv.mkDerivation rec {
   pname = "spice";
-  version = "0.14.2";
+  version = "0.15.0";
 
   src = fetchurl {
-    url = "https://www.spice-space.org/download/releases/${pname}-${version}.tar.bz2";
-    sha256 = "19r999py9v9c7md2bb8ysj809ag1hh6djl1ik8jcgx065s4b60xj";
+    url = "https://www.spice-space.org/download/releases/spice-server/${pname}-${version}.tar.bz2";
+    sha256 = "1xd0xffw0g5vvwbq4ksmm3jjfq45f9dw20xpmi82g1fj9f7wy85k";
   };
 
-  patches = [
-    # submitted https://gitlab.freedesktop.org/spice/spice/merge_requests/4
-    ./correct-meson.patch
-  ];
-
   postPatch = ''
     patchShebangs build-aux
   '';
diff --git a/pkgs/development/tools/jbang/default.nix b/pkgs/development/tools/jbang/default.nix
index dfef3906602..1220ec90d90 100644
--- a/pkgs/development/tools/jbang/default.nix
+++ b/pkgs/development/tools/jbang/default.nix
@@ -1,12 +1,12 @@
 { stdenv, lib, fetchzip, jdk, makeWrapper, coreutils, curl }:
 
 stdenv.mkDerivation rec {
-  version = "0.70.0";
+  version = "0.71.1";
   pname = "jbang";
 
   src = fetchzip {
     url = "https://github.com/jbangdev/jbang/releases/download/v${version}/${pname}-${version}.tar";
-    sha256 = "sha256-Fy7TvWJVRJI5fhfZzMuW+KBLaVLWKjk/I3Kx60Wazyo=";
+    sha256 = "sha256-+s2Wa+5Qznqpv84VEZCMmzy0bI1mN/BknPObYqJlaYs=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/misc/drivers/hplip/default.nix b/pkgs/misc/drivers/hplip/default.nix
index 98a67a75f0b..c8566bfc07a 100644
--- a/pkgs/misc/drivers/hplip/default.nix
+++ b/pkgs/misc/drivers/hplip/default.nix
@@ -101,7 +101,12 @@ python3Packages.buildPythonApplication {
     ./hplip-3.20.11-nixos-cups-ppd-search-path.patch
   ];
 
-  prePatch = ''
+  postPatch = ''
+    # https://github.com/NixOS/nixpkgs/issues/44230
+    substituteInPlace createPPD.sh \
+      --replace ppdc "${cups}/bin/ppdc" \
+      --replace "gzip -c" "gzip -cn"
+
     # HPLIP hardcodes absolute paths everywhere. Nuke from orbit.
     find . -type f -exec sed -i \
       -e s,/etc/hp,$out/etc/hp,g \
@@ -149,6 +154,12 @@ python3Packages.buildPythonApplication {
     export CUPS_DATADIR="${cups}/share/cups"
   '';
 
+  postConfigure = ''
+    # don't save timestamp, in order to improve reproducibility
+    substituteInPlace Makefile \
+      --replace "GZIP_ENV = --best" "GZIP_ENV = --best -n"
+  '';
+
   enableParallelBuilding = true;
 
   #
diff --git a/pkgs/misc/vscode-extensions/remote-ssh/default.nix b/pkgs/misc/vscode-extensions/remote-ssh/default.nix
index 29ca973a0aa..ab59527d82b 100644
--- a/pkgs/misc/vscode-extensions/remote-ssh/default.nix
+++ b/pkgs/misc/vscode-extensions/remote-ssh/default.nix
@@ -36,8 +36,8 @@ in
     mktplcRef = {
       name = "remote-ssh";
       publisher = "ms-vscode-remote";
-      version = "0.50.0";
-      sha256 = "01pyd6759p5nkjhjy3iplrl748xblr54l1jphk2g02s1n5ds2qb9";
+      version = "0.65.7";
+      sha256 = "ae86c4be79fc5af747bb1f1aa5841221af80ee7476cc2f1c9ac277fa2fa1d683";
     };
 
     postPatch = ''
diff --git a/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh b/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
old mode 100644
new mode 100755
index 467654d1806..37e0abaf4b4
--- a/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
+++ b/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
@@ -216,7 +216,12 @@ nixBuild() {
 }
 
 nixFlakeBuild() {
-    if [ -z "$buildHost" ]; then
+    if [[ -z "$buildHost" && -z "$targetHost" ]] &&
+       ! [ "$action" = switch -o "$action" = boot ]
+    then
+        nix "${flakeFlags[@]}" build "$@"
+        readlink -f ./result
+    elif [ -z "$buildHost" ]; then
         nix "${flakeFlags[@]}" build "$@" --out-link "${tmpDir}/result"
         readlink -f "${tmpDir}/result"
     else
diff --git a/pkgs/shells/zsh/zsh-completions/default.nix b/pkgs/shells/zsh/zsh-completions/default.nix
index 07e538610ba..249826a2a25 100644
--- a/pkgs/shells/zsh/zsh-completions/default.nix
+++ b/pkgs/shells/zsh/zsh-completions/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "zsh-completions";
-  version = "0.32.0";
+  version = "0.33.0";
 
   src = fetchFromGitHub {
     owner = "zsh-users";
     repo = pname;
     rev = version;
-    sha256 = "12l9wrx0aysyj62kgp5limglz0nq73w8c415wcshxnxmhyk6sw6d";
+    sha256 = "0vs14n29wvkai84fvz3dz2kqznwsq2i5fzbwpv8nsfk1126ql13i";
   };
 
   installPhase= ''
diff --git a/pkgs/tools/admin/virtscreen/default.nix b/pkgs/tools/admin/virtscreen/default.nix
index ebfd6c21772..a1558248f80 100644
--- a/pkgs/tools/admin/virtscreen/default.nix
+++ b/pkgs/tools/admin/virtscreen/default.nix
@@ -1,4 +1,12 @@
-{ lib, stdenv, fetchFromGitHub, python3Packages, x11vnc, xrandr, libGL }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, python3Packages
+, x11vnc
+, xrandr
+, libGL
+, qt5
+}:
 
 python3Packages.buildPythonApplication rec {
   pname = "virtscreen";
@@ -16,6 +24,8 @@ python3Packages.buildPythonApplication rec {
     sha256 = "005qach6phz8w17k8kqmyd647c6jkfybczybxq0yxi5ik0s91a08";
   };
 
+  nativeBuildInputs = [ qt5.wrapQtAppsHook ];
+
   propagatedBuildInputs = with python3Packages; [
     netifaces
     pyqt5
@@ -24,10 +34,17 @@ python3Packages.buildPythonApplication rec {
     xrandr
   ];
 
-  postPatch = let
-    ext = stdenv.hostPlatform.extensions.sharedLibrary; in ''
+  dontWrapQtApps = true;
+
+  makeWrapperArgs = [
+    "\${qtWrapperArgs[@]}"
+    # import Qt.labs.platform failed without this
+    "--prefix QML2_IMPORT_PATH : ${qt5.qtquickcontrols2.bin}/${qt5.qtbase.qtQmlPrefix}"
+  ];
+
+  postPatch = ''
     substituteInPlace virtscreen/__main__.py \
-      --replace "'GL'" "'${libGL}/lib/libGL${ext}'" \
+      --replace "'GL'" "'${libGL}/lib/libGL${stdenv.hostPlatform.extensions.sharedLibrary}'" \
   '';
 
   meta = with lib; {
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index def255d9533..20727323881 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -23126,7 +23126,11 @@ in
 
   dwl = callPackage ../applications/window-managers/dwl { };
 
-  dwm = callPackage ../applications/window-managers/dwm { };
+  dwm = callPackage ../applications/window-managers/dwm {
+    # dwm is configured entirely through source modification. Allow users to
+    # specify patches through nixpkgs.config.dwm.patches
+    patches = config.dwm.patches or [];
+  };
 
   dwmblocks = callPackage ../applications/misc/dwmblocks { };