diff --git a/pkgs/applications/audio/ptcollab/default.nix b/pkgs/applications/audio/ptcollab/default.nix
index 2ec27cb49e67..637acb320b15 100644
--- a/pkgs/applications/audio/ptcollab/default.nix
+++ b/pkgs/applications/audio/ptcollab/default.nix
@@ -13,13 +13,13 @@
 
 mkDerivation rec {
   pname = "ptcollab";
-  version = "0.6.2.0";
+  version = "0.6.3.0";
 
   src = fetchFromGitHub {
     owner = "yuxshao";
     repo = "ptcollab";
     rev = "v${version}";
-    sha256 = "sha256-iSCuFCwOPrvff9N/a2J0kPrxikhyR7yYbD4VaU/TF4M=";
+    sha256 = "sha256-fxFT3wgFHd2YbwUTna5PTvaCcCAaDXGLbqKz6nVrsKI=";
   };
 
   nativeBuildInputs = [ qmake pkg-config ];
diff --git a/pkgs/applications/editors/vscode/extensions/rescript/default.nix b/pkgs/applications/editors/vscode/extensions/rescript/default.nix
index fb0f1db8d59f..902bc58f1d14 100644
--- a/pkgs/applications/editors/vscode/extensions/rescript/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/rescript/default.nix
@@ -1,6 +1,7 @@
 { lib, stdenv, vscode-utils, callPackage }:
 let
-  rescript-editor-analysis = (callPackage ./rescript-editor-analysis.nix { });
+  version = "1.6.0";
+  rescript-editor-analysis = callPackage ./rescript-editor-analysis.nix { inherit version; };
   arch =
     if stdenv.isLinux then "linux"
     else if stdenv.isDarwin then "darwin"
@@ -11,8 +12,8 @@ vscode-utils.buildVscodeMarketplaceExtension rec {
   mktplcRef = {
     name = "rescript-vscode";
     publisher = "chenglou92";
-    version = "1.3.0";
-    sha256 = "sha256-Sgi7FFOpI/XOeyPOrDhwZdZ+43ilUz7oQ49yB7tiMXk=";
+    inherit version;
+    sha256 = "sha256-/Nv+uyTkJQVaPKIDRr1P/Z5vsituXpP48/sDn3FUEeA=";
   };
   postPatch = ''
     rm -r ${analysisDir}
@@ -22,7 +23,7 @@ vscode-utils.buildVscodeMarketplaceExtension rec {
   meta = with lib; {
     description = "The official VSCode plugin for ReScript";
     homepage = "https://github.com/rescript-lang/rescript-vscode";
-    maintainers = with maintainers; [ dlip ];
+    maintainers = with maintainers; [ dlip jayesh-bhoot ];
     license = licenses.mit;
   };
 }
diff --git a/pkgs/applications/editors/vscode/extensions/rescript/rescript-editor-analysis.nix b/pkgs/applications/editors/vscode/extensions/rescript/rescript-editor-analysis.nix
index 518280b4b06b..a0b49f9c44be 100644
--- a/pkgs/applications/editors/vscode/extensions/rescript/rescript-editor-analysis.nix
+++ b/pkgs/applications/editors/vscode/extensions/rescript/rescript-editor-analysis.nix
@@ -1,21 +1,24 @@
-{ lib, stdenv, fetchFromGitHub, bash, ocaml }:
+{ lib, stdenv, fetchFromGitHub, bash, ocaml, dune_3, version }:
 
 stdenv.mkDerivation {
   pname = "rescript-editor-analysis";
-  version = "1.1.3";
+  inherit version;
 
   src = fetchFromGitHub {
     owner = "rescript-lang";
     repo = "rescript-vscode";
-    rev = "8d0412a72307b220b7f5774e2612760a2d429059";
-    sha256 = "rHQtfuIiEWlSPuZvNpEafsvlXCj2Uv1YRR1IfvKfC2s=";
+    rev = version;
+    sha256 = "sha256-O5kZCnhtMcevPTs5UxhIXx124WQf1VvF2WMVHjMEQZc=";
   };
 
-  nativeBuildInputs = [ ocaml ];
+  nativeBuildInputs = [ ocaml dune_3 ];
 
+  # Skip testing phases because they need to download and install node modules
   postPatch = ''
     cd analysis
-    substituteInPlace Makefile --replace "/bin/bash" "${bash}/bin/bash"
+    substituteInPlace Makefile \
+      --replace "build: build-analysis-binary build-reanalyze build-tests" "build: build-analysis-binary" \
+      --replace "test: test-analysis-binary test-reanalyze" "test: test-analysis-binary"
   '';
 
   installPhase = ''
@@ -25,7 +28,7 @@ stdenv.mkDerivation {
   meta = with lib; {
     description = "Analysis binary for the ReScript VSCode plugin";
     homepage = "https://github.com/rescript-lang/rescript-vscode";
-    maintainers = with maintainers; [ dlip ];
+    maintainers = with maintainers; [ dlip jayesh-bhoot ];
     license = licenses.mit;
   };
 }
diff --git a/pkgs/applications/networking/cluster/atmos/default.nix b/pkgs/applications/networking/cluster/atmos/default.nix
index 64b39b2ddaeb..ef7c3787bdc9 100644
--- a/pkgs/applications/networking/cluster/atmos/default.nix
+++ b/pkgs/applications/networking/cluster/atmos/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "atmos";
-  version = "1.8.0";
+  version = "1.8.2";
 
   src = fetchFromGitHub {
     owner = "cloudposse";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Jt8/sB6cpxNr0Mcp0+KrwxQAicOHHRGnHXLruBSvZ4M=";
+    sha256 = "sha256-rDbnny/qRU31ciAXKLGLXS3FhgOpxmkLT4oatYCbt9g=";
   };
 
-  vendorSha256 = "sha256-d2Eod1AK6Ei5Az9wPHVqij8K4CVj7Ptewd3dBJ9Wt3o=";
+  vendorSha256 = "sha256-Kfv3RlH80E/9yf/rvnY5vljaRr4cH5AhgXQn54x72Ds=";
 
   ldflags = [ "-s" "-w" "-X github.com/cloudposse/atmos/cmd.Version=v${version}" ];
 
diff --git a/pkgs/applications/networking/cluster/kubebuilder/default.nix b/pkgs/applications/networking/cluster/kubebuilder/default.nix
index bf469c0f4b56..dd6e71a58abe 100644
--- a/pkgs/applications/networking/cluster/kubebuilder/default.nix
+++ b/pkgs/applications/networking/cluster/kubebuilder/default.nix
@@ -5,6 +5,9 @@
 , git
 , go
 , gnumake
+, installShellFiles
+, testers
+, kubebuilder
 }:
 
 buildGoModule rec {
@@ -17,32 +20,47 @@ buildGoModule rec {
     rev = "v${version}";
     sha256 = "sha256-nLjmz9OakBLTBWdYA6czgtJmCuP96abNwLcLZo+yZ48=";
   };
+
   vendorSha256 = "sha256-xljLDwubwr6rZ/ZpW9/WithClaMo88ivlBhWFb0iAvo=";
 
   subPackages = ["cmd"];
 
+  allowGoReference = true;
+
   ldflags = [
     "-X main.kubeBuilderVersion=v${version}"
     "-X main.goos=${go.GOOS}"
     "-X main.goarch=${go.GOARCH}"
-    "-X main.gitCommit=v${version}"
-    "-X main.buildDate=v${version}"
+    "-X main.gitCommit=unknown"
+    "-X main.buildDate=unknown"
   ];
 
-  doCheck = true;
+  nativeBuildInputs = [
+    makeWrapper
+    git
+    installShellFiles
+  ];
 
   postInstall = ''
     mv $out/bin/cmd $out/bin/kubebuilder
     wrapProgram $out/bin/kubebuilder \
       --prefix PATH : ${lib.makeBinPath [ go gnumake ]}
+
+    installShellCompletion --cmd kubebuilder \
+      --bash <($out/bin/kubebuilder completion bash) \
+      --fish <($out/bin/kubebuilder completion fish) \
+      --zsh <($out/bin/kubebuilder completion zsh)
   '';
 
-  allowGoReference = true;
-  nativeBuildInputs = [ makeWrapper git ];
+  passthru.tests.version = testers.testVersion {
+    command = "${kubebuilder}/bin/kubebuilder version";
+    package = kubebuilder;
+    version = "v${version}";
+  };
 
   meta = with lib; {
-    homepage = "https://github.com/kubernetes-sigs/kubebuilder";
     description = "SDK for building Kubernetes APIs using CRDs";
+    homepage = "https://github.com/kubernetes-sigs/kubebuilder";
     license = licenses.asl20;
     maintainers = with maintainers; [ cmars ];
   };
diff --git a/pkgs/applications/version-management/got/default.nix b/pkgs/applications/version-management/got/default.nix
index a74fe8b098c3..bda8bb2c066a 100644
--- a/pkgs/applications/version-management/got/default.nix
+++ b/pkgs/applications/version-management/got/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "got";
-  version = "0.75.1";
+  version = "0.76";
 
   src = fetchurl {
     url = "https://gameoftrees.org/releases/portable/got-portable-${version}.tar.gz";
-    sha256 = "sha256-GlEXB89fZPRZAwvUUHcyKCH3Jj5AOvMSHFodsVKepSQ=";
+    sha256 = "sha256-05VUIHUqXnES4CmgopzQ2LQ0uldSffsGF5ExedEO+yA=";
   };
 
   nativeBuildInputs = [ pkg-config bison ];
diff --git a/pkgs/build-support/portable-service/default.nix b/pkgs/build-support/portable-service/default.nix
new file mode 100644
index 000000000000..6389e8d66fb1
--- /dev/null
+++ b/pkgs/build-support/portable-service/default.nix
@@ -0,0 +1,111 @@
+{ pkgs, lib, stdenv }:
+/*
+  Create a systemd portable service image
+  https://systemd.io/PORTABLE_SERVICES/
+
+  Example:
+  pkgs.portableService {
+    pname = "demo";
+    version = "1.0";
+    units = [ demo-service demo-socket ];
+  }
+*/
+{
+  # The name and version of the portable service. The resulting image will be
+  # created in result/$pname_$version.raw
+  pname
+, version
+
+  # Units is a list of derivations for systemd unit files. Those files will be
+  # copied to /etc/systemd/system in the resulting image. Note that the unit
+  # names must be prefixed with the name of the portable service.
+, units
+
+  # Basic info about the portable service image, used for the generated
+  # /etc/os-release
+, description ? null
+, homepage ? null
+
+  # A list of attribute sets {object, symlink}. Symlinks will be created
+  # in the root filesystem of the image to objects in the nix store.
+, symlinks ? [ ]
+
+  # A list of additional derivations to be included in the image as-is.
+, contents ? [ ]
+
+  # mksquashfs options
+, squashfsTools ? pkgs.squashfsTools
+, squash-compression ? "xz -Xdict-size 100%"
+, squash-block-size ? "1M"
+}:
+
+let
+  filterNull = lib.filterAttrs (_: v: v != null);
+  envFileGenerator = lib.generators.toKeyValue { };
+
+  rootFsScaffold =
+    let
+      os-release-params = {
+        PORTABLE_ID = pname;
+        PORTABLE_PRETTY_NAME = description;
+        HOME_URL = homepage;
+        ID = "nixos";
+        PRETTY_NAME = "NixOS";
+        BUILD_ID = "rolling";
+      };
+      os-release = pkgs.writeText "os-release"
+        (envFileGenerator (filterNull os-release-params));
+
+    in
+    stdenv.mkDerivation {
+      pname = "root-fs-scaffold";
+      inherit version;
+
+      buildCommand = ''
+        # scaffold a file system layout
+        mkdir -p $out/etc/systemd/system $out/proc $out/sys $out/dev $out/run \
+                 $out/tmp $out/var/tmp $out/var/lib $out/var/cache $out/var/log
+
+        # empty files to mount over with host's version
+        touch $out/etc/resolv.conf $out/etc/machine-id
+
+        # required for portable services
+        cp ${os-release} $out/etc/os-release
+      ''
+      # units **must** be copied to /etc/systemd/system/
+      + (lib.concatMapStringsSep "\n" (u: "cp ${u} $out/etc/systemd/system/${u.name};") units)
+      + (lib.concatMapStringsSep "\n"
+        ({ object, symlink }: ''
+          mkdir -p $(dirname $out/${symlink});
+          ln -s ${object} $out/${symlink};
+        '')
+        symlinks)
+      ;
+    };
+in
+
+assert lib.assertMsg (lib.all (u: lib.hasPrefix pname u.name) units) "Unit names must be prefixed with the service name";
+
+stdenv.mkDerivation {
+  pname = "${pname}-img";
+  inherit version;
+
+  nativeBuildInputs = [ squashfsTools ];
+  closureInfo = pkgs.closureInfo { rootPaths = [ rootFsScaffold ] ++ contents; };
+
+  buildCommand = ''
+    mkdir -p nix/store
+    for i in $(< $closureInfo/store-paths); do
+      cp -a "$i" "''${i:1}"
+    done
+
+    mkdir -p $out
+    # the '.raw' suffix is mandatory by the portable service spec
+    mksquashfs nix ${rootFsScaffold}/* $out/"${pname}_${version}.raw" \
+      -quiet -noappend \
+      -exit-on-error \
+      -keep-as-directory \
+      -all-root -root-mode 755 \
+      -b ${squash-block-size} -comp ${squash-compression}
+  '';
+}
diff --git a/pkgs/development/coq-modules/mathcomp-analysis/default.nix b/pkgs/development/coq-modules/mathcomp-analysis/default.nix
index 19c4e6a5a187..99c760fce0ce 100644
--- a/pkgs/development/coq-modules/mathcomp-analysis/default.nix
+++ b/pkgs/development/coq-modules/mathcomp-analysis/default.nix
@@ -1,11 +1,11 @@
-{ coq, mkCoqDerivation, mathcomp, mathcomp-finmap, mathcomp-bigenough, mathcomp-real-closed,
-  hierarchy-builder, lib, version ? null }:
-
-with lib;
-let mca = mkCoqDerivation {
-
-  namePrefix = [ "coq" "mathcomp" ];
-  pname = "analysis";
+{ lib,
+  mkCoqDerivation, recurseIntoAttrs,
+  mathcomp, mathcomp-finmap, mathcomp-bigenough, mathcomp-real-closed,
+  hierarchy-builder,
+  coqPackages, coq, version ? null }@args:
+with builtins // lib;
+let
+  repo  = "math-comp";
   owner = "math-comp";
 
   release."0.5.3".sha256 = "sha256-1NjFsi5TITF8ZWx1NyppRmi8g6YaoUtTdS9bU/sUe5k=";
@@ -20,7 +20,6 @@ let mca = mkCoqDerivation {
   release."0.3.1".sha256 = "1iad288yvrjv8ahl9v18vfblgqb1l5z6ax644w49w9hwxs93f2k8";
   release."0.2.3".sha256 = "0p9mr8g1qma6h10qf7014dv98ln90dfkwn76ynagpww7qap8s966";
 
-  inherit version;
   defaultVersion = with versions; switch [ coq.version mathcomp.version ]  [
       { cases = [ (isGe "8.14") (isGe "1.13.0") ];               out = "0.5.3"; }
       { cases = [ (isGe "8.14") (range "1.13" "1.15") ];         out = "0.5.2"; }
@@ -33,21 +32,55 @@ let mca = mkCoqDerivation {
       { cases = [ (range "8.8"  "8.11") (range "1.8" "1.10") ];  out = "0.2.3"; }
     ] null;
 
-  propagatedBuildInputs =
-    [ mathcomp.ssreflect mathcomp.field
-      mathcomp-finmap mathcomp-bigenough mathcomp-real-closed ];
+  # list of analysis packages sorted by dependency order
+  packages = [ "classical" "analysis" ];
 
-  meta = {
-    description = "Analysis library compatible with Mathematical Components";
-    maintainers = [ maintainers.cohencyril ];
-    license = licenses.cecill-c;
-  };
-}; in
-mca.overrideAttrs (o:
-  let ext = { propagatedBuildInputs = o.propagatedBuildInputs
-                                      ++ [ hierarchy-builder ]; };
-  in with versions; switch o.version [
-    {case = "dev";        out = ext;}
-    {case = isGe "0.3.4"; out = ext;}
-  ] {}
-)
+  mathcomp_ = package: let
+      analysis-deps = map mathcomp_ (head (splitList (pred.equal package) packages));
+      pkgpath = if package == "analysis" then "theories" else "${package}";
+      pname = "mathcomp-${package}";
+      derivation = mkCoqDerivation ({
+        inherit version pname defaultVersion release repo owner;
+
+        namePrefix = [ "coq" "mathcomp" ];
+
+        propagatedBuildInputs =
+          (if package == "classical" then
+             [ mathcomp.ssreflect mathcomp.algebra mathcomp-finmap ]
+           else
+             [ mathcomp.field mathcomp-bigenough mathcomp-real-closed ])
+          ++ [ analysis-deps ];
+
+        preBuild = ''
+          cd ${pkgpath}
+        '';
+
+        meta = {
+          description = "Analysis library compatible with Mathematical Components";
+          maintainers = [ maintainers.cohencyril ];
+          license     = licenses.cecill-c;
+        };
+
+        passthru = genAttrs packages mathcomp_;
+      });
+    # split packages didn't exist before 0.6, so bulding nothing in that case
+    patched-derivation1 = derivation.overrideAttrs (o:
+      optionalAttrs (o.pname != null && o.pname != "mathcomp-analysis" &&
+         o.version != null && o.version != "dev" && versions.isLt "0.6" o.version)
+      { preBuild = ""; buildPhase = "echo doing nothing"; installPhase = "echo doing nothing"; }
+    );
+    patched-derivation2 = patched-derivation1.overrideAttrs (o:
+      optionalAttrs (o.pname != null && o.pname == "mathcomp-analysis" &&
+         o.version != null && o.version != "dev" && versions.isLt "0.6" o.version)
+      { preBuild = ""; }
+    );
+    patched-derivation = patched-derivation2.overrideAttrs (o:
+      optionalAttrs (o.version != null
+        && (o.version == "dev" || versions.isGe "0.3.4" o.version))
+      {
+        propagatedBuildInputs = o.propagatedBuildInputs ++ [ hierarchy-builder ];
+      }
+    );
+    in patched-derivation;
+in
+mathcomp_ "analysis"
diff --git a/pkgs/development/python-modules/pypdf2/default.nix b/pkgs/development/python-modules/pypdf2/default.nix
index 18cd8dcec572..f66e6dddbbad 100644
--- a/pkgs/development/python-modules/pypdf2/default.nix
+++ b/pkgs/development/python-modules/pypdf2/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "PyPDF2";
-  version = "2.10.9";
+  version = "2.11.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-8tpSVPBU6O+BDFMf4Rr28KQ2or4VmF7g0oho2GmOWj8=";
+    sha256 = "sha256-2IF2H2xjEJqFkJPJHckKFdAf816s3rkoCTYLliPiw8k=";
   };
 
   LC_ALL = "en_US.UTF-8";
diff --git a/pkgs/development/tools/nil/default.nix b/pkgs/development/tools/nil/default.nix
index f32f4693ed2f..fca968c909a7 100644
--- a/pkgs/development/tools/nil/default.nix
+++ b/pkgs/development/tools/nil/default.nix
@@ -1,26 +1,31 @@
-{ lib, rustPlatform, fetchFromGitHub }:
-
-let
-  date = "2022-09-19";
-in
+{ lib, rustPlatform, fetchFromGitHub, nix, nix-update-script }:
 
 rustPlatform.buildRustPackage rec {
   pname = "nil";
-  version = "unstable-${date}";
+  version = "2022-09-26";
 
   src = fetchFromGitHub {
     owner = "oxalica";
     repo = pname;
-    rev = date;
-    sha256 = "sha256-WdBRfp0shz6Xhwx0fEUQwROK52XNDTkmhC2xkdT+INA=";
+    rev = version;
+    hash = "sha256-2bcAXcJiFV+xKSIy3oD2/TkijV4302jAtTF3xtHiOhU=";
   };
 
-  cargoSha256 = "sha256-J1CRe5xPl428mwOO4kDxLyPBc0mtzl3iU4mUqW5d4+E=";
+  cargoHash = "sha256-RL9n2kfWPpu17qudqSx5DkZbgxqVCf2IRBu/koCAqFA=";
 
-  CFG_DATE = date;
+  CFG_DATE = version;
+  CFG_REV = "release";
+
+  nativeBuildInputs = [
+    (lib.getBin nix)
+  ];
+
+  passthru.updateScript = nix-update-script {
+    attrPath = pname;
+  };
 
   meta = with lib; {
-    description = "A language server for Nix Expression Language";
+    description = "Yet another language server for Nix";
     homepage = "https://github.com/oxalica/nil";
     license = with licenses; [ mit asl20 ];
     maintainers = with maintainers; [ figsoda oxalica ];
diff --git a/pkgs/development/tools/ruff/default.nix b/pkgs/development/tools/ruff/default.nix
new file mode 100644
index 000000000000..0da37f099cea
--- /dev/null
+++ b/pkgs/development/tools/ruff/default.nix
@@ -0,0 +1,33 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, stdenv
+, CoreServices
+, Security
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "ruff";
+  version = "0.0.46";
+
+  src = fetchFromGitHub {
+    owner = "charliermarsh";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "10khkcv2bjsxkwn18vkm025v2qxdiymy8gmky09xz37s51bysvlh";
+  };
+
+  cargoSha256 = "sha256-i0fQ8oEbZen9LD1dccXc4pczBMadP1/fk1cwaNKvVYQ=";
+
+  buildInputs = lib.optionals stdenv.isDarwin [
+    CoreServices
+    Security
+  ];
+
+  meta = with lib; {
+    description = "An extremely fast Python linter";
+    homepage = "https://github.com/charliermarsh/ruff";
+    license = licenses.mit;
+    maintainers = with maintainers; [ figsoda ];
+  };
+}
diff --git a/pkgs/tools/admin/awscli/default.nix b/pkgs/tools/admin/awscli/default.nix
index dbf990807e98..532317dd27cd 100644
--- a/pkgs/tools/admin/awscli/default.nix
+++ b/pkgs/tools/admin/awscli/default.nix
@@ -90,6 +90,7 @@ with py.pkgs; buildPythonApplication rec {
     homepage = "https://aws.amazon.com/cli/";
     description = "Unified tool to manage your AWS services";
     license = licenses.asl20;
+    mainProgram = "aws";
     maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/tools/misc/plantuml/default.nix b/pkgs/tools/misc/plantuml/default.nix
index 126d58cd0ab2..f023c58bd0e0 100644
--- a/pkgs/tools/misc/plantuml/default.nix
+++ b/pkgs/tools/misc/plantuml/default.nix
@@ -1,12 +1,12 @@
 { lib, stdenv, fetchurl, makeWrapper, jre, graphviz }:
 
 stdenv.mkDerivation rec {
-  version = "1.2022.7";
+  version = "1.2022.8";
   pname = "plantuml";
 
   src = fetchurl {
     url = "https://github.com/plantuml/plantuml/releases/download/v${version}/plantuml-pdf-${version}.jar";
-    sha256 = "sha256-GnFueIK4RDGViHmyBtfQqNpId+4ufCsci7c1YCcZjAQ=";
+    sha256 = "sha256-9K9d7dQnMFTq1zpZU2t0NIhzQVIyk8b6PnI0cRJJ5t0=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 1b26565fe7d0..25c834ab1203 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -17009,6 +17009,8 @@ with pkgs;
     };
   }));
 
+  portableService = callPackage ../build-support/portable-service { };
+
   polar = callPackage ../tools/misc/polar { };
 
   inherit (nodePackages) postcss-cli;
@@ -36229,6 +36231,10 @@ with pkgs;
 
   rucksack = callPackage ../development/tools/rucksack { };
 
+  ruff = callPackage ../development/tools/ruff {
+    inherit (darwin.apple_sdk.frameworks) CoreServices Security;
+  };
+
   sam-ba = callPackage ../tools/misc/sam-ba { };
 
   sndio = callPackage ../misc/sndio { };
diff --git a/pkgs/top-level/coq-packages.nix b/pkgs/top-level/coq-packages.nix
index 51d883be39f1..87688c53d2da 100644
--- a/pkgs/top-level/coq-packages.nix
+++ b/pkgs/top-level/coq-packages.nix
@@ -75,6 +75,7 @@ let
       mathcomp-character = self.mathcomp.character;
       mathcomp-abel = callPackage ../development/coq-modules/mathcomp-abel {};
       mathcomp-analysis = callPackage ../development/coq-modules/mathcomp-analysis {};
+      mathcomp-classical = self.mathcomp-analysis.classical;
       mathcomp-finmap = callPackage ../development/coq-modules/mathcomp-finmap {};
       mathcomp-bigenough = callPackage ../development/coq-modules/mathcomp-bigenough {};
       mathcomp-real-closed = callPackage ../development/coq-modules/mathcomp-real-closed {};