diff --git a/pkgs/development/interpreters/trealla/default.nix b/pkgs/development/interpreters/trealla/default.nix
index f72c8b69eb1b..6c6268011a73 100644
--- a/pkgs/development/interpreters/trealla/default.nix
+++ b/pkgs/development/interpreters/trealla/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "trealla";
-  version = "1.9.37";
+  version = "1.12.0";
 
   src = fetchFromGitHub {
     owner = "infradig";
     repo = "trealla";
     rev = "v${version}";
-    sha256 = "sha256-0cj4FGaYKIKCgWwRyLUw1DcvNnioQPOtqZhSvWSaojU=";
+    sha256 = "sha256-5gMf62WSGf46Bg8CaI9weSMRjrdGiuxtaDV9FrS2xO8=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/libraries/libvirt/default.nix b/pkgs/development/libraries/libvirt/default.nix
index 2d13b993fd28..dca856dbb571 100644
--- a/pkgs/development/libraries/libvirt/default.nix
+++ b/pkgs/development/libraries/libvirt/default.nix
@@ -183,6 +183,10 @@ stdenv.mkDerivation rec {
       # do not use "''${qemu_kvm}/bin/qemu-kvm" to avoid bound VMs to particular qemu derivations
       substituteInPlace src/lxc/lxc_conf.c \
         --replace 'lxc_path,' '"/run/libvirt/nix-emulators/libvirt_lxc",'
+      substituteInPlace build-aux/meson.build \
+        --replace "gsed" "sed" \
+        --replace "gmake" "make" \
+        --replace "ggrep" "grep"
       patchShebangs .
     ''
     + (lib.concatStringsSep "\n" (lib.mapAttrsToList patchBuilder overrides));
diff --git a/pkgs/development/python-modules/awkward/default.nix b/pkgs/development/python-modules/awkward/default.nix
index 53cd4671d2ca..62f383c56785 100644
--- a/pkgs/development/python-modules/awkward/default.nix
+++ b/pkgs/development/python-modules/awkward/default.nix
@@ -11,11 +11,11 @@
 
 buildPythonPackage rec {
   pname = "awkward";
-  version = "1.4.0";
+  version = "1.5.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "25ae6114d5962c717cb87e3bc30a2f6eaa232b252cf8c51ba805b8f04664ae0d";
+    sha256 = "3cb1b0e28f420232d894d89665d5c0c8241b99e56d806171f4faf5cdfec08ae1";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/python-modules/deezer-py/default.nix b/pkgs/development/python-modules/deezer-py/default.nix
index 46a4774e1ca7..07e0991dda9f 100644
--- a/pkgs/development/python-modules/deezer-py/default.nix
+++ b/pkgs/development/python-modules/deezer-py/default.nix
@@ -7,12 +7,12 @@
 
 buildPythonPackage rec {
   pname = "deezer-py";
-  version = "1.1.3";
+  version = "1.2.2";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-FdLSJFALeGcecLAHk9khJTKlMd3Mec/w/PGQOHqxYMQ=";
+    sha256 = "a491af5fcc9e44a2a28be8832169e703a920dae42c78539f45cad59075700ac9";
   };
 
   propagatedBuildInputs = [ requests ];
diff --git a/pkgs/development/tools/analysis/tfsec/default.nix b/pkgs/development/tools/analysis/tfsec/default.nix
index 5ded1e5cab25..99138a612441 100644
--- a/pkgs/development/tools/analysis/tfsec/default.nix
+++ b/pkgs/development/tools/analysis/tfsec/default.nix
@@ -5,13 +5,13 @@
 
 buildGoPackage rec {
   pname = "tfsec";
-  version = "0.58.6";
+  version = "0.58.9";
 
   src = fetchFromGitHub {
     owner = "aquasecurity";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-FTrzEVTmMxXshDOvlSmQEwekde621KIclpFm1oEduEo=";
+    sha256 = "1i61xls3jj5w3cliqs28m1y6p47yav24m40zxa6kf0jj4s50m1d3";
   };
 
   goPackagePath = "github.com/aquasecurity/tfsec";
diff --git a/pkgs/development/tools/build-managers/bazel/buildtools/default.nix b/pkgs/development/tools/build-managers/bazel/buildtools/default.nix
index 4ff5c39fac67..3c9adac6cb1d 100644
--- a/pkgs/development/tools/build-managers/bazel/buildtools/default.nix
+++ b/pkgs/development/tools/build-managers/bazel/buildtools/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "bazel-buildtools";
-  version = "4.0.1";
+  version = "4.2.0";
 
   src = fetchFromGitHub {
     owner = "bazelbuild";
     repo = "buildtools";
     rev = version;
-    sha256 = "0q7b9zh38vblqs5lwhjk28km89p706aky4wv6bwz2vg9gl6bfclq";
+    sha256 = "sha256-m6jTDFgjUpQrm77tCnpIRHUFJCFl7GKwu7NoHtoLNa4=";
   };
 
-  vendorSha256 = "1w6i1lb72mfdyb901gpl9yc6ql73j5kik6li0j5jv5ab2m3j9qvf";
+  vendorSha256 = "sha256-buMkRxVLlS2LBJGaGWeR41BsmE/0vgDS8s1VcRYN0fA=";
 
   preBuild = ''
     rm -r warn/docs
diff --git a/pkgs/os-specific/linux/firmware/system76-firmware/default.nix b/pkgs/os-specific/linux/firmware/system76-firmware/default.nix
index a7bc36106996..4d0ae9a1d5a7 100644
--- a/pkgs/os-specific/linux/firmware/system76-firmware/default.nix
+++ b/pkgs/os-specific/linux/firmware/system76-firmware/default.nix
@@ -2,13 +2,13 @@
 rustPlatform.buildRustPackage rec {
   pname = "system76-firmware";
   # Check Makefile when updating, make sure postInstall matches make install
-  version = "1.0.28";
+  version = "1.0.29";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = pname;
     rev = version;
-    sha256 = "sha256-hv8Vdpg/Tt3eo2AdFlOEG182jH5Oy7/BX3p1EMPQjnc=";
+    sha256 = "sha256-4wvVls6Z42GtC/MVFTvCv1UV/w5nt4p9oTMU4Bqh4JU=";
   };
 
   nativeBuildInputs = [ pkg-config makeWrapper ];
@@ -17,7 +17,7 @@ rustPlatform.buildRustPackage rec {
 
   cargoBuildFlags = [ "--workspace" ];
 
-  cargoSha256 = "sha256-A39zvxvZB3j59giPAVeucHPzqwofnugmLweiPXh5Uzg=";
+  cargoSha256 = "sha256-x2FO4UWtsvUeKgPxaqjdxtp9vWJq9vLIqQPyGF8nQG4=";
 
   # Purposefully don't install systemd unit file, that's for NixOS
   postInstall = ''