diff --git a/doc/languages-frameworks/python.section.md b/doc/languages-frameworks/python.section.md
index 0ca20617b8518..c1945adb1cd30 100644
--- a/doc/languages-frameworks/python.section.md
+++ b/doc/languages-frameworks/python.section.md
@@ -58,7 +58,7 @@ with a nix-shell that has `numpy` and `toolz` in Python 3.9; then we will create
 a re-usable environment in a single-file Python script; then we will create a
 full Python environment for development with this same environment.
 
-Philosphically, this should be familiar to users who are used to a `venv` style
+Philosophically, this should be familiar to users who are used to a `venv` style
 of development: individual projects create their own Python environments without
 impacting the global environment or each other.
 
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 81b4756699977..22f5178de1126 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -11511,6 +11511,12 @@
     githubId = 3737;
     name = "Peter Jones";
   };
+  phip1611 = {
+    email = "phip1611@gmail.com";
+    github = "phip1611";
+    githubId = 5737016;
+    name = "Philipp Schuster";
+  };
   pkharvey = {
     email = "kayharvey@protonmail.com";
     github = "pkharvey";
diff --git a/maintainers/scripts/eval-release.nix b/maintainers/scripts/eval-release.nix
index bb9572cbc7956..4f0ca24650251 100644
--- a/maintainers/scripts/eval-release.nix
+++ b/maintainers/scripts/eval-release.nix
@@ -17,6 +17,7 @@ let
         if (builtins.tryEval attrs.drvPath).success
         then { inherit (attrs) name drvPath; }
         else { failed = true; }
+      else if attrs == null then {}
       else { recurseForDerivations = true; } //
            mapAttrs (n: v: let path' = path ++ [n]; in trace path' (recurse path' v)) attrs
     else { };
diff --git a/nixos/modules/services/audio/hqplayerd.nix b/nixos/modules/services/audio/hqplayerd.nix
index eff1549380c84..d54400b18e307 100644
--- a/nixos/modules/services/audio/hqplayerd.nix
+++ b/nixos/modules/services/audio/hqplayerd.nix
@@ -82,7 +82,6 @@ in
       etc = {
         "hqplayer/hqplayerd.xml" = mkIf (cfg.config != null) { source = pkgs.writeText "hqplayerd.xml" cfg.config; };
         "hqplayer/hqplayerd4-key.xml" = mkIf (cfg.licenseFile != null) { source = cfg.licenseFile; };
-        "modules-load.d/taudio2.conf".source = "${pkg}/etc/modules-load.d/taudio2.conf";
       };
       systemPackages = [ pkg ];
     };
@@ -91,8 +90,6 @@ in
       allowedTCPPorts = [ 8088 4321 ];
     };
 
-    services.udev.packages = [ pkg ];
-
     systemd = {
       tmpfiles.rules = [
         "d ${configDir}      0755 hqplayer hqplayer - -"
diff --git a/nixos/modules/services/hardware/throttled.nix b/nixos/modules/services/hardware/throttled.nix
index 2d801a7e838ff..afca24d976e1a 100644
--- a/nixos/modules/services/hardware/throttled.nix
+++ b/nixos/modules/services/hardware/throttled.nix
@@ -20,7 +20,7 @@ in {
   config = mkIf cfg.enable {
     systemd.packages = [ pkgs.throttled ];
     # The upstream package has this in Install, but that's not enough, see the NixOS manual
-    systemd.services.lenovo_fix.wantedBy = [ "multi-user.target" ];
+    systemd.services.throttled.wantedBy = [ "multi-user.target" ];
 
     environment.etc."throttled.conf".source =
       if cfg.extraConfig != ""
diff --git a/nixos/modules/services/monitoring/prometheus/exporters.nix b/nixos/modules/services/monitoring/prometheus/exporters.nix
index 23cac6793cc6d..fd40dce1410c1 100644
--- a/nixos/modules/services/monitoring/prometheus/exporters.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters.nix
@@ -64,6 +64,7 @@ let
     "rspamd"
     "rtl_433"
     "script"
+    "shelly"
     "snmp"
     "smartctl"
     "smokeping"
diff --git a/nixos/modules/services/monitoring/prometheus/exporters/shelly.nix b/nixos/modules/services/monitoring/prometheus/exporters/shelly.nix
new file mode 100644
index 0000000000000..b9cfd1b1e84a9
--- /dev/null
+++ b/nixos/modules/services/monitoring/prometheus/exporters/shelly.nix
@@ -0,0 +1,27 @@
+{ config, lib, pkgs, options }:
+
+with lib;
+
+let
+  cfg = config.services.prometheus.exporters.shelly;
+in
+{
+  port = 9784;
+  extraOpts = {
+    metrics-file = mkOption {
+      type = types.path;
+      description = lib.mdDoc ''
+        Path to the JSON file with the metric definitions
+      '';
+    };
+  };
+  serviceOpts = {
+    serviceConfig = {
+      ExecStart = ''
+        ${pkgs.prometheus-shelly-exporter}/bin/shelly_exporter \
+          -metrics-file ${cfg.metrics-file} \
+          -listen-address ${cfg.listenAddress}:${toString cfg.port}
+      '';
+    };
+  };
+}
diff --git a/nixos/modules/services/networking/avahi-daemon.nix b/nixos/modules/services/networking/avahi-daemon.nix
index 28dd24f4e7c0c..103f73fdaa685 100644
--- a/nixos/modules/services/networking/avahi-daemon.nix
+++ b/nixos/modules/services/networking/avahi-daemon.nix
@@ -275,6 +275,7 @@ in
         BusName = "org.freedesktop.Avahi";
         Type = "dbus";
         ExecStart = "${pkgs.avahi}/sbin/avahi-daemon --syslog -f ${avahiDaemonConf}";
+        ConfigurationDirectory = "avahi/services";
       };
     };
 
diff --git a/nixos/modules/virtualisation/amazon-options.nix b/nixos/modules/virtualisation/amazon-options.nix
index 926fe43b0ffe6..3ea4a6cf78183 100644
--- a/nixos/modules/virtualisation/amazon-options.nix
+++ b/nixos/modules/virtualisation/amazon-options.nix
@@ -28,13 +28,13 @@ in {
             options = {
               mount = lib.mkOption {
                 description = lib.mdDoc "Where to mount this dataset.";
-                type = types.nullOr types.string;
+                type = types.nullOr types.str;
                 default = null;
               };
 
               properties = lib.mkOption {
                 description = lib.mdDoc "Properties to set on this dataset.";
-                type = types.attrsOf types.string;
+                type = types.attrsOf types.str;
                 default = {};
               };
             };
diff --git a/nixos/modules/virtualisation/openstack-options.nix b/nixos/modules/virtualisation/openstack-options.nix
index c71b581b02ca7..52f45de92ecbb 100644
--- a/nixos/modules/virtualisation/openstack-options.nix
+++ b/nixos/modules/virtualisation/openstack-options.nix
@@ -29,13 +29,13 @@ in
             options = {
               mount = lib.mkOption {
                 description = lib.mdDoc "Where to mount this dataset.";
-                type = types.nullOr types.string;
+                type = types.nullOr types.str;
                 default = null;
               };
 
               properties = lib.mkOption {
                 description = lib.mdDoc "Properties to set on this dataset.";
-                type = types.attrsOf types.string;
+                type = types.attrsOf types.str;
                 default = { };
               };
             };
diff --git a/nixos/tests/apfs.nix b/nixos/tests/apfs.nix
index a8841fe93046e..ac0459b57e9ce 100644
--- a/nixos/tests/apfs.nix
+++ b/nixos/tests/apfs.nix
@@ -21,9 +21,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
     with subtest("Enable case sensitivity and normalization sensitivity"):
       machine.succeed(
           "mkapfs -s -z /dev/vdb",
-          # Triggers a bug, see https://github.com/linux-apfs/linux-apfs-rw/issues/15
-          # "mount -o cknodes,readwrite /dev/vdb /tmp/mnt",
-          "mount -o readwrite /dev/vdb /tmp/mnt",
+          "mount -o cknodes,readwrite /dev/vdb /tmp/mnt",
           "echo 'Hello World 1' > /tmp/mnt/test.txt",
           "[ ! -f /tmp/mnt/TeSt.TxT ] || false", # Test case sensitivity
           "echo 'Hello World 1' | diff - /tmp/mnt/test.txt",
@@ -36,13 +34,13 @@ import ./make-test-python.nix ({ pkgs, ... }: {
     with subtest("Disable case sensitivity and normalization sensitivity"):
       machine.succeed(
           "mkapfs /dev/vdb",
-          "mount -o readwrite /dev/vdb /tmp/mnt",
+          "mount -o cknodes,readwrite /dev/vdb /tmp/mnt",
           "echo 'bla bla bla' > /tmp/mnt/Test.txt",
           "echo -n 'Hello World' > /tmp/mnt/test.txt",
           "echo ' 1' >> /tmp/mnt/TEST.TXT",
           "umount /tmp/mnt",
           "apfsck /dev/vdb",
-          "mount -o readwrite /dev/vdb /tmp/mnt",
+          "mount -o cknodes,readwrite /dev/vdb /tmp/mnt",
           "echo 'Hello World 1' | diff - /tmp/mnt/TeSt.TxT", # Test case insensitivity
           "echo 'Hello World 2' > /tmp/mnt/\u0061\u0301.txt",
           "echo 'Hello World 2' | diff - /tmp/mnt/\u0061\u0301.txt",
diff --git a/nixos/tests/prometheus-exporters.nix b/nixos/tests/prometheus-exporters.nix
index 5f50a3f87d5d2..82d50da638183 100644
--- a/nixos/tests/prometheus-exporters.nix
+++ b/nixos/tests/prometheus-exporters.nix
@@ -1060,6 +1060,20 @@ let
       '';
     };
 
+    shelly = {
+      exporterConfig = {
+        enable = true;
+        metrics-file = "${pkgs.writeText "test.json" ''{}''}";
+      };
+      exporterTest = ''
+        wait_for_unit("prometheus-shelly-exporter.service")
+        wait_for_open_port(9784)
+        wait_until_succeeds(
+            "curl -sSf 'localhost:9784/metrics'"
+        )
+      '';
+    };
+
     script = {
       exporterConfig = {
         enable = true;
diff --git a/pkgs/applications/audio/jmusicbot/default.nix b/pkgs/applications/audio/jmusicbot/default.nix
index d9d7bf19e7d61..7a1676e7873c5 100644
--- a/pkgs/applications/audio/jmusicbot/default.nix
+++ b/pkgs/applications/audio/jmusicbot/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchurl, makeWrapper, jre }:
+{ stdenv, lib, fetchurl, makeWrapper, jre_headless }:
 
 stdenv.mkDerivation rec {
   pname = "JMusicBot";
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
     mkdir -p $out/lib
     cp $src $out/lib/JMusicBot
 
-    makeWrapper ${jre}/bin/java $out/bin/JMusicBot \
+    makeWrapper ${jre_headless}/bin/java $out/bin/JMusicBot \
       --add-flags "-Xmx1G -Dnogui=true -Djava.util.concurrent.ForkJoinPool.common.parallelism=1 -jar $out/lib/JMusicBot"
   '';
 
@@ -27,6 +27,6 @@ stdenv.mkDerivation rec {
     sourceProvenance = with sourceTypes; [ binaryBytecode ];
     license = licenses.asl20;
     maintainers = with maintainers; [ SuperSandro2000 ];
-    platforms = platforms.all;
+    inherit (jre_headless.meta) platforms;
   };
 }
diff --git a/pkgs/applications/audio/lsp-plugins/default.nix b/pkgs/applications/audio/lsp-plugins/default.nix
index be841577ad79b..dd00bd1f2c022 100644
--- a/pkgs/applications/audio/lsp-plugins/default.nix
+++ b/pkgs/applications/audio/lsp-plugins/default.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
         pname = "lsp-plugins";
-        version = "1.2.4";
+        version = "1.2.5";
 
         src = fetchurl {
                 url = "https://github.com/sadko4u/${pname}/releases/download/${version}/${pname}-src-${version}.tar.gz";
-                sha256 = "sha256-GTrcUy10bN9Xj2I7uuGyP82c6NVpnQbXTI85H231yyo=";
+                sha256 = "sha256-YYrt+FbpY7iEui0aw4Ce94BW1SHDk0OH8gFSzkW2fkw=";
         };
 
         nativeBuildInputs = [ pkg-config php makeWrapper ];
diff --git a/pkgs/applications/audio/musikcube/default.nix b/pkgs/applications/audio/musikcube/default.nix
index 82d4be406baf3..706a36b5327fa 100644
--- a/pkgs/applications/audio/musikcube/default.nix
+++ b/pkgs/applications/audio/musikcube/default.nix
@@ -10,7 +10,7 @@
 , gnutls
 , lame
 , libev
-, libgme
+, game-music-emu
 , libmicrohttpd
 , libopenmpt
 , mpg123
@@ -51,7 +51,7 @@ stdenv.mkDerivation rec {
     gnutls
     lame
     libev
-    libgme
+    game-music-emu
     libmicrohttpd
     libopenmpt
     mpg123
diff --git a/pkgs/applications/audio/osdlyrics/default.nix b/pkgs/applications/audio/osdlyrics/default.nix
index ccac79763114a..3dd43fe3044ca 100644
--- a/pkgs/applications/audio/osdlyrics/default.nix
+++ b/pkgs/applications/audio/osdlyrics/default.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation rec {
   pname = "osdlyrics";
-  version = "0.5.12";
+  version = "0.5.13";
 
   src = fetchFromGitHub {
     owner = "osdlyrics";
     repo = "osdlyrics";
     rev = version;
-    sha256 = "sha256-QGgwxmurdwo0xyq7p+1xditRebv64ewGTvNJI7MUnq4=";
+    sha256 = "sha256-E4pVXopqQYJW+a5nUf9dMabxJ9nYPu3C2ti8LlY470c=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/audio/pianotrans/default.nix b/pkgs/applications/audio/pianotrans/default.nix
new file mode 100644
index 0000000000000..89e0716a0adc9
--- /dev/null
+++ b/pkgs/applications/audio/pianotrans/default.nix
@@ -0,0 +1,38 @@
+{ lib
+, fetchFromGitHub
+, python3
+, ffmpeg
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "pianotrans";
+  version = "1.0";
+  format = "setuptools";
+
+  src = fetchFromGitHub {
+    owner = "azuwis";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-6Otup1Yat1dBZdSoR4lDfpytUQ2RbDXC6ieo835Nw+U=";
+  };
+
+  propagatedBuildInputs = with python3.pkgs; [
+    piano-transcription-inference
+    torch
+    tkinter
+  ];
+
+  # Project has no tests
+  doCheck = false;
+
+  makeWrapperArgs = [
+    ''--prefix PATH : "${lib.makeBinPath [ ffmpeg ]}"''
+  ];
+
+  meta = with lib; {
+    description = "Simple GUI for ByteDance's Piano Transcription with Pedals";
+    homepage = "https://github.com/azuwis/pianotrans";
+    license = licenses.mit;
+    maintainers = with maintainers; [ azuwis ];
+  };
+}
diff --git a/pkgs/applications/audio/yesplaymusic/default.nix b/pkgs/applications/audio/yesplaymusic/default.nix
index 758dcbbd935a2..aee0d1d192fe7 100644
--- a/pkgs/applications/audio/yesplaymusic/default.nix
+++ b/pkgs/applications/audio/yesplaymusic/default.nix
@@ -22,25 +22,25 @@
 , systemd
 }:
 let
-  pname = "YesPlayMusic";
-  version = "0.4.5";
+  pname = "yesplaymusic";
+  version = "0.4.7";
 
   srcs = {
     x86_64-linux = fetchurl {
       url = "https://github.com/qier222/YesPlayMusic/releases/download/v${version}/yesplaymusic_${version}_amd64.deb";
-      hash = "sha256-igd2MzIjwDSOLP0Xi2mSJnEPGWendggPC/MwTDCDui0=";
+      hash = "sha256-nnnHE2OgIqoz3dC+G0219FVBhvnWivLW1BX6+NYo6Ng=";
     };
     aarch64-linux = fetchurl {
       url = "https://github.com/qier222/YesPlayMusic/releases/download/v${version}/yesplaymusic_${version}_arm64.deb";
-      hash = "sha256-6MZrAJGXuEJ9HMUje3ppTz2rdaBydwoQKBk6af81pT0=";
+      hash = "sha256-+rrhY5iDDt/nYs0Vz5/Ef0sgpsdBKMtb1aVfCZLgRgg=";
     };
     x86_64-darwin = fetchurl {
       url = "https://github.com/qier222/YesPlayMusic/releases/download/v${version}/YesPlayMusic-mac-${version}-x64.dmg";
-      hash = "sha256-mvmaSrDoIDeOVylkJCVY97yRUHfEI8CysmKrgBUrFGM=";
+      hash = "sha256-z8CASZRWKlj1g3mhxTMMeR4klTvQ2ReSrL7Rt18qQbM=";
     };
     aarch64-darwin = fetchurl {
       url = "https://github.com/qier222/YesPlayMusic/releases/download/v${version}/YesPlayMusic-mac-${version}-arm64.dmg";
-      hash = "sha256-Qo03rGS/qB6Sc1IunU7F81WJ/t+mWR7ZRsKYK97LHik=";
+      hash = "sha256-McYLczudKG4tRNIw/Ws4rht0n4tiKA2M99yKtJbdlY8=";
     };
   };
   src = srcs.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
diff --git a/pkgs/applications/blockchains/chia-dev-tools/default.nix b/pkgs/applications/blockchains/chia-dev-tools/default.nix
index d65eb37f3985f..e7b92b268a64b 100644
--- a/pkgs/applications/blockchains/chia-dev-tools/default.nix
+++ b/pkgs/applications/blockchains/chia-dev-tools/default.nix
@@ -37,12 +37,13 @@ python3Packages.buildPythonApplication rec {
 
   propagatedBuildInputs = with python3Packages; [
     (toPythonModule chia)
+    pytest # required at runtime by the "test" command
+    pytest-asyncio
     pytimeparse
   ];
 
   nativeCheckInputs = with python3Packages; [
     pytestCheckHook
-    pytest-asyncio
   ];
 
   preCheck = ''
diff --git a/pkgs/applications/blockchains/erigon/default.nix b/pkgs/applications/blockchains/erigon/default.nix
index e81dc1813e524..a17bef8cae373 100644
--- a/pkgs/applications/blockchains/erigon/default.nix
+++ b/pkgs/applications/blockchains/erigon/default.nix
@@ -2,7 +2,7 @@
 
 let
   pname = "erigon";
-  version = "2.35.2";
+  version = "2.37.0";
 in
 buildGoModule {
   inherit pname version;
@@ -11,11 +11,11 @@ buildGoModule {
     owner = "ledgerwatch";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-hGJ9SeUYACOuypTJmPnrv4f8ujjsUt3dZbwso+94g3M=";
+    sha256 = "sha256-r/mumt/f0wrOsXyEHo/NX0lJGt8zqXEVNC+9DWDkHAM=";
     fetchSubmodules = true;
   };
 
-  vendorSha256 = "sha256-lKzJLRCcyhQIV7y1XxqbvTINLlUwWFnflZgGQHYzBjY=";
+  vendorSha256 = "sha256-vSJZ1wIx1CiLE04ZBDnQDQqM2v8BBLxw5qbAsixC3/U=";
   proxyVendor = true;
 
   # Build errors in mdbx when format hardening is enabled:
diff --git a/pkgs/applications/editors/glow/default.nix b/pkgs/applications/editors/glow/default.nix
index dde5083d9c8d0..5472b28b62b9f 100644
--- a/pkgs/applications/editors/glow/default.nix
+++ b/pkgs/applications/editors/glow/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "glow";
-  version = "1.4.1";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "charmbracelet";
     repo = "glow";
     rev = "v${version}";
-    sha256 = "0m673xf67q9gjhd98ysh3dvwiqbj6lgsbm20c4zxyz76vdn5k6x8";
+    sha256 = "sha256-CI0S9XJtJQClpQvI6iSb5rcHafEUwr2V6+Fq560lRfM=";
   };
 
-  vendorSha256 = "0ngasfcimizahm80gflxzz3cxz0ir10l62i03l73w8syx4wll0q4";
+  vendorHash = "sha256-2QrHBbhJ04r/vPK2m8J2KZSFrREDCc18tlKd7evghBc=";
 
   doCheck = false;
 
diff --git a/pkgs/applications/emulators/ppsspp/default.nix b/pkgs/applications/emulators/ppsspp/default.nix
index b300dc08268ae..a2664e12641d2 100644
--- a/pkgs/applications/emulators/ppsspp/default.nix
+++ b/pkgs/applications/emulators/ppsspp/default.nix
@@ -12,89 +12,92 @@
 , makeWrapper
 , pkg-config
 , python3
-, qtbase ? null
-, qtmultimedia ? null
+, qtbase
+, qtmultimedia
 , snappy
 , vulkan-loader
 , wayland
-, wrapQtAppsHook ? null
+, wrapQtAppsHook
 , zlib
+, enableQt ? false
 , enableVulkan ? true
 , forceWayland ? false
 }:
 
 let
-  enableQt = (qtbase != null);
-  frontend = if enableQt then "Qt" else "SDL and headless";
-  vulkanPath = lib.makeLibraryPath [ vulkan-loader ];
-
   # experimental, see https://github.com/hrydgard/ppsspp/issues/13845
   vulkanWayland = enableVulkan && forceWayland;
 in
-  # Only SDL front end needs to specify whether to use Wayland
-  assert forceWayland -> !enableQt;
-  stdenv.mkDerivation (finalAttrs: {
-    pname = "ppsspp"
-      + lib.optionalString enableQt "-qt"
-      + lib.optionalString (!enableQt) "-sdl"
-      + lib.optionalString forceWayland "-wayland";
-    version = "1.14.4";
+# Only SDL frontend needs to specify whether to use Wayland
+assert forceWayland -> !enableQt;
+stdenv.mkDerivation (self: {
+  pname = "ppsspp"
+          + lib.optionalString enableQt "-qt"
+          + lib.optionalString (!enableQt) "-sdl"
+          + lib.optionalString forceWayland "-wayland";
+  version = "1.14.4";
 
-    src = fetchFromGitHub {
-      owner = "hrydgard";
-      repo = "ppsspp";
-      rev = "v${finalAttrs.version}";
-      fetchSubmodules = true;
-      sha256 = "sha256-7xzhN8JIQD4LZg8sQ8rLNYZrW0nCNBfZFgzoKdoWbKc=";
-    };
+  src = fetchFromGitHub {
+    owner = "hrydgard";
+    repo = "ppsspp";
+    rev = "v${self.version}";
+    fetchSubmodules = true;
+    sha256 = "sha256-7xzhN8JIQD4LZg8sQ8rLNYZrW0nCNBfZFgzoKdoWbKc=";
+  };
 
-    postPatch = ''
-      substituteInPlace git-version.cmake --replace unknown ${finalAttrs.src.rev}
-      substituteInPlace UI/NativeApp.cpp --replace /usr/share $out/share
-    '';
+  postPatch = ''
+    substituteInPlace git-version.cmake --replace unknown ${self.src.rev}
+    substituteInPlace UI/NativeApp.cpp --replace /usr/share $out/share
+  '';
 
-    nativeBuildInputs = [
-      cmake
-      copyDesktopItems
-      makeWrapper
-      pkg-config
-      python3
-      wrapQtAppsHook
-    ];
+  nativeBuildInputs = [
+    cmake
+    copyDesktopItems
+    makeWrapper
+    pkg-config
+    python3
+  ] ++ lib.optional enableQt wrapQtAppsHook;
 
-    buildInputs = [
-      SDL2
-      ffmpeg
-      (glew.override { enableEGL = forceWayland; })
-      libzip
-      qtbase
-      qtmultimedia
-      snappy
-      zlib
-    ] ++ lib.optional enableVulkan vulkan-loader
-      ++ lib.optionals vulkanWayland [ wayland libffi ];
+  buildInputs = [
+    SDL2
+    ffmpeg
+    (glew.override { enableEGL = forceWayland; })
+    libzip
+    snappy
+    zlib
+  ] ++ lib.optionals enableQt [
+    qtbase
+    qtmultimedia
+  ] ++ lib.optional enableVulkan vulkan-loader
+  ++ lib.optionals vulkanWayland [ wayland libffi ];
 
-    cmakeFlags = [
-      "-DHEADLESS=${if enableQt then "OFF" else "ON"}"
-      "-DOpenGL_GL_PREFERENCE=GLVND"
-      "-DUSE_SYSTEM_FFMPEG=ON"
-      "-DUSE_SYSTEM_LIBZIP=ON"
-      "-DUSE_SYSTEM_SNAPPY=ON"
-      "-DUSE_WAYLAND_WSI=${if vulkanWayland then "ON" else "OFF"}"
-      "-DUSING_QT_UI=${if enableQt then "ON" else "OFF"}"
-    ];
+  cmakeFlags = [
+    "-DHEADLESS=${if enableQt then "OFF" else "ON"}"
+    "-DOpenGL_GL_PREFERENCE=GLVND"
+    "-DUSE_SYSTEM_FFMPEG=ON"
+    "-DUSE_SYSTEM_LIBZIP=ON"
+    "-DUSE_SYSTEM_SNAPPY=ON"
+    "-DUSE_WAYLAND_WSI=${if vulkanWayland then "ON" else "OFF"}"
+    "-DUSING_QT_UI=${if enableQt then "ON" else "OFF"}"
+  ];
 
-    desktopItems = [(makeDesktopItem {
+  desktopItems = [
+    (makeDesktopItem {
       desktopName = "PPSSPP";
       name = "ppsspp";
       exec = "ppsspp";
       icon = "ppsspp";
       comment = "Play PSP games on your computer";
       categories = [ "Game" "Emulator" ];
-    })];
+    })
+  ];
 
-    installPhase = ''
+  installPhase = let
+    vulkanPath = lib.makeLibraryPath [ vulkan-loader ];
+  in
+    ''
       runHook preInstall
+
       mkdir -p $out/share/{applications,ppsspp}
     '' + (if enableQt then ''
       install -Dm555 PPSSPPQt $out/bin/ppsspp
@@ -108,14 +111,16 @@ in
         --prefix LD_LIBRARY_PATH : ${vulkanPath} \
     '' + "\n" + ''
       mv assets $out/share/ppsspp
+
       runHook postInstall
     '';
 
-    meta = with lib; {
-      homepage = "https://www.ppsspp.org/";
-      description = "A HLE Playstation Portable emulator, written in C++ (${frontend})";
-      license = licenses.gpl2Plus;
-      maintainers = with maintainers; [ AndersonTorres ];
-      platforms = platforms.linux;
-    };
-  })
+  meta = {
+    homepage = "https://www.ppsspp.org/";
+    description = "A HLE Playstation Portable emulator, written in C++ ("
+                  + (if enableQt then "Qt" else "SDL + headless") + ")";
+    license = lib.licenses.gpl2Plus;
+    maintainers = [ lib.maintainers.AndersonTorres ];
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/applications/graphics/imv/default.nix b/pkgs/applications/graphics/imv/default.nix
index f78a4f6068154..30a8a24e3bc27 100644
--- a/pkgs/applications/graphics/imv/default.nix
+++ b/pkgs/applications/graphics/imv/default.nix
@@ -11,7 +11,7 @@
 , icu
 , pango
 , inih
-, withWindowSystem ? "all"
+, withWindowSystem ? null
 , xorg
 , libxkbcommon
 , libGLU
@@ -27,6 +27,12 @@
 }:
 
 let
+  # default value of withWindowSystem
+  withWindowSystem' =
+         if withWindowSystem != null then withWindowSystem
+    else if stdenv.isLinux then "all"
+    else "x11";
+
   windowSystems = {
     all = windowSystems.x11 ++ windowSystems.wayland;
     x11 = [ libGLU xorg.libxcb xorg.libX11 ];
@@ -47,7 +53,7 @@ let
 in
 
 # check that given window system is valid
-assert lib.assertOneOf "withWindowSystem" withWindowSystem
+assert lib.assertOneOf "withWindowSystem" withWindowSystem'
   (builtins.attrNames windowSystems);
 # check that every given backend is valid
 assert builtins.all
@@ -56,18 +62,18 @@ assert builtins.all
 
 stdenv.mkDerivation rec {
   pname = "imv";
-  version = "4.3.1";
+  version = "4.4.0";
   outputs = [ "out" "man" ];
 
   src = fetchFromSourcehut {
     owner = "~exec64";
     repo = "imv";
     rev = "v${version}";
-    sha256 = "sha256-gMAd8skst72QT4jGFH7aRdWeAd4tf/uQgXhGaM/Dpgc=";
+    sha256 = "sha256-LLEEbriHzZhAOQivqHqdr6g7lh4uj++ytlme8AfRjf4=";
   };
 
   mesonFlags = [
-    "-Dwindows=${withWindowSystem}"
+    "-Dwindows=${withWindowSystem'}"
     "-Dtest=enabled"
     "-Dman=enabled"
   ] ++ backendFlags;
@@ -87,7 +93,7 @@ stdenv.mkDerivation rec {
     libxkbcommon
     pango
     inih
-  ] ++ windowSystems."${withWindowSystem}"
+  ] ++ windowSystems."${withWindowSystem'}"
     ++ builtins.map (b: backends."${b}") withBackends;
 
   postInstall = ''
@@ -96,7 +102,7 @@ stdenv.mkDerivation rec {
     install -Dm644 ../files/imv.desktop $out/share/applications/
   '';
 
-  postFixup = lib.optionalString (withWindowSystem == "all") ''
+  postFixup = lib.optionalString (withWindowSystem' == "all") ''
     # The `bin/imv` script assumes imv-wayland or imv-x11 in PATH,
     # so we have to fix those to the binaries we installed into the /nix/store
 
@@ -109,9 +115,10 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "A command line image viewer for tiling window managers";
-    homepage = "https://github.com/eXeC64/imv";
+    homepage = "https://sr.ht/~exec64/imv/";
     license = licenses.mit;
     maintainers = with maintainers; [ rnhmjoj markus1189 ];
     platforms = platforms.all;
+    badPlatforms = platforms.darwin;
   };
 }
diff --git a/pkgs/applications/graphics/qiv/default.nix b/pkgs/applications/graphics/qiv/default.nix
index 0075abc0f6f00..96ec02294ffdc 100644
--- a/pkgs/applications/graphics/qiv/default.nix
+++ b/pkgs/applications/graphics/qiv/default.nix
@@ -1,12 +1,12 @@
 { lib, stdenv, fetchurl, pkg-config, gtk2, imlib2, file, lcms2, libexif } :
 
 stdenv.mkDerivation (rec {
-  version = "2.3.2";
+  version = "2.3.3";
   pname = "qiv";
 
   src = fetchurl {
     url = "https://spiegl.de/qiv/download/${pname}-${version}.tgz";
-    sha256 = "1mc0f2nnas4q0d7zc9r6g4z93i32xlx0p9hl4fn5zkyml24a1q28";
+    sha256 = "sha256-7whf/eLUiwWzZlk55a4eNZ06OBAI+4J2hPfW/UxTNwQ=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/applications/graphics/sane/xsane.nix b/pkgs/applications/graphics/sane/xsane.nix
index 007483fb5e260..cd64c7b8d44e4 100644
--- a/pkgs/applications/graphics/sane/xsane.nix
+++ b/pkgs/applications/graphics/sane/xsane.nix
@@ -1,6 +1,6 @@
 { lib
 , stdenv
-, fetchurl
+, fetchFromGitLab
 , sane-backends
 , sane-frontends
 , libX11
@@ -10,15 +10,19 @@
 , libusb-compat-0_1
 , gimpSupport ? false
 , gimp
+, nix-update-script
 }:
 
 stdenv.mkDerivation rec {
   pname = "xsane";
   version = "0.999";
 
-  src = fetchurl {
-    url = "http://www.xsane.org/download/xsane-${version}.tar.gz";
-    sha256 = "0jrb918sfb9jw3vmrz0z7np4q55hgsqqffpixs0ir5nwcwzd50jp";
+  src = fetchFromGitLab {
+    owner = "frontend";
+    group = "sane-project";
+    repo = pname;
+    rev = version;
+    hash = "sha256-oOg94nUsT9LLKnHocY0S5g02Y9a1UazzZAjpEI/s+yM=";
   };
 
   preConfigure = ''
@@ -31,11 +35,13 @@ stdenv.mkDerivation rec {
   buildInputs = [ libpng libusb-compat-0_1 sane-backends sane-frontends libX11 gtk2 ]
     ++ lib.optional gimpSupport gimp;
 
+  passthru.updateScript = nix-update-script { };
+
   meta = with lib; {
     homepage = "http://www.sane-project.org/";
     description = "Graphical scanning frontend for sane";
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ melling ];
   };
 }
diff --git a/pkgs/applications/misc/cotp/default.nix b/pkgs/applications/misc/cotp/default.nix
index 408838a0a284d..fb3e149bc8e84 100644
--- a/pkgs/applications/misc/cotp/default.nix
+++ b/pkgs/applications/misc/cotp/default.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   name = "cotp";
-  version = "1.1.0";
+  version = "1.2.1";
 
   src = fetchFromGitHub {
     owner = "replydev";
     repo = "cotp";
     rev = "v${version}";
-    hash = "sha256-SbS+ch7/45kZb49jW2mnRWQruLrfrNfeZFqEPHQKGUg=";
+    hash = "sha256-DIb/lgJxwg+QuqzN/0YoUV1iZwRqh6PAN0KRK7TbWDs=";
   };
 
-  cargoHash = "sha256-2lIR3K4/hr4XSmNGFd/dhwoFOtEB9KSnUrZkcaCyc9k=";
+  cargoHash = "sha256-uvH4mdI8ya/MJJngXQ98oXjG7JjUdvPwIzvJrdwlOEE=";
 
   buildInputs = lib.optionals stdenv.isLinux [ libxcb ]
     ++ lib.optionals stdenv.isDarwin [ AppKit ];
diff --git a/pkgs/applications/misc/gImageReader/default.nix b/pkgs/applications/misc/gImageReader/default.nix
index f570a044309e6..4e215f30fc312 100644
--- a/pkgs/applications/misc/gImageReader/default.nix
+++ b/pkgs/applications/misc/gImageReader/default.nix
@@ -16,13 +16,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "gImageReader";
-  version = "3.4.0";
+  version = "3.4.1";
 
   src = fetchFromGitHub {
     owner= "manisandro";
     repo = "gImageReader";
     rev = "v${version}";
-    sha256 = "sha256-lJ4wPLxVN3NERnru8vLreiWMEUip6xeCXAfoT8DcfiQ=";
+    sha256 = "sha256-vW4FbviMHBiJ3rwJY/yS7JDOoCT72nGV6jEeo+k6ylU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/keystore-explorer/default.nix b/pkgs/applications/misc/keystore-explorer/default.nix
index c2162b6f0c469..2c8a31acc18a6 100644
--- a/pkgs/applications/misc/keystore-explorer/default.nix
+++ b/pkgs/applications/misc/keystore-explorer/default.nix
@@ -1,11 +1,11 @@
 { fetchzip, lib, stdenv, jdk, runtimeShell, glib, wrapGAppsHook }:
 
 stdenv.mkDerivation rec {
-  version = "5.5.1";
+  version = "5.5.2";
   pname = "keystore-explorer";
   src = fetchzip {
     url = "https://github.com/kaikramer/keystore-explorer/releases/download/v${version}/kse-${lib.replaceStrings ["."] [""] version}.zip";
-    sha256 = "2C/LkUUuef30PkN7HL0CtcNOjR5uNo9XaCiTatv5hgA=";
+    sha256 = "sha256-mDi/TSYumCg2hAnMOI2QpdAOSlDMpdJPqzatFotAqUk=";
   };
 
   # glib is necessary so file dialogs don't hang.
diff --git a/pkgs/applications/misc/overmind/default.nix b/pkgs/applications/misc/overmind/default.nix
index c06713c98a66e..ec1ea90cd47ce 100644
--- a/pkgs/applications/misc/overmind/default.nix
+++ b/pkgs/applications/misc/overmind/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "overmind";
-  version = "2.3.0";
+  version = "2.4.0";
 
   nativeBuildInputs = [ makeWrapper ];
 
@@ -14,10 +14,10 @@ buildGoModule rec {
     owner = "DarthSim";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-vmmSsg0JneMseFCcx/no2x/Ghppmyiod8ZAIb4JWW9I=";
+    sha256 = "sha256-cpsTytV1TbvdR7XUKkp4GPD1qyt1qnmY6qOsge01swE=";
   };
 
-  vendorSha256 = "sha256-QIKyLknPvmt8yiUCSCIqha8h9ozDGeQnKSM9Vwus0uY=";
+  vendorHash = "sha256-ndgnFBGtVFc++h+EnA37aY9+zNsO5GDrTECA4TEWPN4=";
 
   meta = with lib; {
     homepage = "https://github.com/DarthSim/overmind";
diff --git a/pkgs/applications/misc/pgmodeler/default.nix b/pkgs/applications/misc/pgmodeler/default.nix
index 237e229fc54d6..96cc51fceb78a 100644
--- a/pkgs/applications/misc/pgmodeler/default.nix
+++ b/pkgs/applications/misc/pgmodeler/default.nix
@@ -1,28 +1,30 @@
 { lib
+, stdenv
 , fetchFromGitHub
+, wrapQtAppsHook
 , pkg-config
 , qmake
-, mkDerivation
+, qtwayland
 , qtsvg
 , postgresql
 }:
 
-mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "pgmodeler";
-  version = "1.0.0-beta1";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "pgmodeler";
     repo = "pgmodeler";
     rev = "v${version}";
-    sha256 = "sha256-5ZIzxo2UvE+aKznF9ZLYFg5z3JkYCB+9rGdVDJl14Hw=";
+    sha256 = "sha256-Lim9iQYdmulwZEIayoBGoAmQ7rysTEEof5iXy3kfKXs=";
   };
 
-  nativeBuildInputs = [ pkg-config qmake ];
+  nativeBuildInputs = [ pkg-config qmake wrapQtAppsHook ];
   qmakeFlags = [ "pgmodeler.pro" "CONFIG+=release" ];
 
   # todo: libpq would suffice here. Unfortunately this won't work, if one uses only postgresql.lib here.
-  buildInputs = [ postgresql qtsvg ];
+  buildInputs = [ postgresql qtsvg qtwayland ];
 
   meta = with lib; {
     description = "A database modeling tool for PostgreSQL";
diff --git a/pkgs/applications/networking/cluster/argocd-autopilot/default.nix b/pkgs/applications/networking/cluster/argocd-autopilot/default.nix
index fedf499d481e4..41fe5cb96094b 100644
--- a/pkgs/applications/networking/cluster/argocd-autopilot/default.nix
+++ b/pkgs/applications/networking/cluster/argocd-autopilot/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "argocd-autopilot";
-  version = "0.4.10";
+  version = "0.4.11";
 
   src = fetchFromGitHub {
     owner = "argoproj-labs";
     repo = "argocd-autopilot";
     rev = "v${version}";
-    sha256 = "sha256-DUWJDWqB+jyp3/2/eFP1ss2grNtrvUuvGWK0FYTXObc=";
+    sha256 = "sha256-0y7WP6v1DrAyK9p9cVME9RpNH1ZY0NNMtjHhmPT68kQ=";
   };
 
-  vendorHash = "sha256-4ylOLnpvz/aQIoxVz2z69Rq/x2UG91yMmtSHyquvNq0=";
+  vendorHash = "sha256-KkklEcxk6pNbxSkomh3LqlK8jgpGC/pZMBkJgXMUi8E=";
 
   proxyVendor = true;
 
diff --git a/pkgs/applications/networking/cluster/kubeone/default.nix b/pkgs/applications/networking/cluster/kubeone/default.nix
index 96e0e4894ec66..3d569d4bdca80 100644
--- a/pkgs/applications/networking/cluster/kubeone/default.nix
+++ b/pkgs/applications/networking/cluster/kubeone/default.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "kubeone";
-  version = "1.5.5";
+  version = "1.5.6";
 
   src = fetchFromGitHub {
     owner = "kubermatic";
     repo = "kubeone";
     rev = "v${version}";
-    hash = "sha256-PdrU3kKuoT4MP5N2t4E1PIKZOMu8D0ZbUyMTIi/KZ7g=";
+    hash = "sha256-u0ievi2Zj5kerTQWhNPkT3HFdLYVwHOigkvWk6Zc3go=";
   };
 
   vendorHash = "sha256-Y4eivDchnN2rtQWjFY3cFiJXRfj48UfVUKM/OLuWXGA=";
diff --git a/pkgs/applications/networking/cluster/tanka/default.nix b/pkgs/applications/networking/cluster/tanka/default.nix
index 010527121e573..29727e0a697df 100644
--- a/pkgs/applications/networking/cluster/tanka/default.nix
+++ b/pkgs/applications/networking/cluster/tanka/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "tanka";
-  version = "0.23.1";
+  version = "0.24.0";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-exPFlcbku51Bs/YISRyjl8iwLYRVS9ltRQPpd/QpnWk=";
+    sha256 = "sha256-RZLmbf9ginMbFAaUKL5mK5HIYQslP8Vu8zdh1OJ1P1Y=";
   };
 
-  vendorSha256 = "sha256-eo4B2p5Yo1r5jro49mSetp9AFYhcTXbyy7wGuaFwbb0=";
+  vendorHash = "sha256-g9e0NesI7WdaTHZ57XRlo8as3IWAFlFW4nkyf6+kd40=";
 
   doCheck = false;
 
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index cbdbd5327dbeb..2e9a94e3b33c6 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -84,13 +84,13 @@
     "vendorHash": "sha256-99PwwxVHfRGC0QCQGhifRzqWFOHZ1R7Ge2ou7OjiggQ="
   },
   "auth0": {
-    "hash": "sha256-BlMYx6Ockk8YpiA0wCu2tBwhUIznFJ9b4knSeKA6M/g=",
+    "hash": "sha256-3iB/Vcv6Vzs9teulhu0npl6IuIJRsKy8FkBcIPTKw8A=",
     "homepage": "https://registry.terraform.io/providers/auth0/auth0",
     "owner": "auth0",
     "repo": "terraform-provider-auth0",
-    "rev": "v0.42.0",
+    "rev": "v0.43.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-OhtomdRIjKxELnSQGbZvrHAE1ag4VAyuSOMrZvZ5q0s="
+    "vendorHash": "sha256-pRbhgukYRn0Ej0v/ANKZ3gtkmfL8qo1E6F/fKDNf/Iw="
   },
   "avi": {
     "hash": "sha256-0FcdVd7EGVHZ0iRonoGfjwYgXpJtUhqX5i925Ejhv54=",
@@ -158,11 +158,11 @@
     "vendorHash": "sha256-3PLBs8LSE5JPtrhmdx+jQsnCrfZQQEUGA7wnf9M72yY="
   },
   "bigip": {
-    "hash": "sha256-VntKiBTQxe8lKV8Bb3A0moA/EUzyQQ7CInPjKJL4iBQ=",
+    "hash": "sha256-nlk3ckrLNtPQ9s8uQ2jvARinPVF+A2T0IUY2rBcUFDk=",
     "homepage": "https://registry.terraform.io/providers/F5Networks/bigip",
     "owner": "F5Networks",
     "repo": "terraform-provider-bigip",
-    "rev": "v1.16.1",
+    "rev": "v1.16.2",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -304,11 +304,11 @@
     "vendorHash": "sha256-BpXhKjfxyCLdGRHn1GexW0MoLj4/C6Bn7scZ76JARxQ="
   },
   "digitalocean": {
-    "hash": "sha256-l/p2HStjvxF6UB1SnY3EoGjC/3t5FdlC6LMk7jn11KI=",
+    "hash": "sha256-ZTt/lfHWD9G/SbZ7mLKPjJAsva5bgRqvvX8Lh1Ci+ts=",
     "homepage": "https://registry.terraform.io/providers/digitalocean/digitalocean",
     "owner": "digitalocean",
     "repo": "terraform-provider-digitalocean",
-    "rev": "v2.25.2",
+    "rev": "v2.26.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -368,11 +368,11 @@
     "vendorHash": "sha256-NLvw606QxUwCDViLbR5LjoWGZnk48/zG0NownEATYKM="
   },
   "exoscale": {
-    "hash": "sha256-F1tYiEy9eQ7GcgVPNfe6Jy6hXEWdFHGXA6esAnOgiQE=",
+    "hash": "sha256-48msmXj7SFmi5TA0/QYm66oIETymWi5ayF+yExyp+hk=",
     "homepage": "https://registry.terraform.io/providers/exoscale/exoscale",
     "owner": "exoscale",
     "repo": "terraform-provider-exoscale",
-    "rev": "v0.43.0",
+    "rev": "v0.44.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -1014,11 +1014,11 @@
     "vendorHash": "sha256-MIO0VHofPtKPtynbvjvEukMNr5NXHgk7BqwIhbc9+u0="
   },
   "signalfx": {
-    "hash": "sha256-UgZr2ZFN5RvB7BG+DIXK6eSvTyvaVUKoBTIQ6aAfCpY=",
+    "hash": "sha256-9cGF/uyC/sqCx7Y9aEawkKVJvHE8siGgWRWWf4ok3B0=",
     "homepage": "https://registry.terraform.io/providers/splunk-terraform/signalfx",
     "owner": "splunk-terraform",
     "repo": "terraform-provider-signalfx",
-    "rev": "v6.21.0",
+    "rev": "v6.22.0",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-Iue8P14x8P0lMa85goSF1D5mEeXw6dH1atJQhgbnZ6Y="
   },
@@ -1032,11 +1032,11 @@
     "vendorHash": null
   },
   "snowflake": {
-    "hash": "sha256-0nofzwxzf19T9klfzp+h3icyN4S92nPfq/HN+qaHK/E=",
+    "hash": "sha256-cy/rolY0Ag/8Vbfs7XERIZxUsF65sap5/EHqU2w44bM=",
     "homepage": "https://registry.terraform.io/providers/Snowflake-Labs/snowflake",
     "owner": "Snowflake-Labs",
     "repo": "terraform-provider-snowflake",
-    "rev": "v0.56.0",
+    "rev": "v0.56.1",
     "spdx": "MIT",
     "vendorHash": "sha256-ulgTRY8qQ5oXONkwYtffRl1QMNnbvyn0zYiYqqvwrUU="
   },
@@ -1104,13 +1104,13 @@
     "vendorHash": null
   },
   "tfe": {
-    "hash": "sha256-YhsAKyD3YYYWfxIHcAgMxdQc//0WQvXTsa+fVhSCG6U=",
+    "hash": "sha256-eFyRa4T+CqIeOcEYj4DQP6ypR7AROYrGDYuYSqBfKr0=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/tfe",
     "owner": "hashicorp",
     "repo": "terraform-provider-tfe",
-    "rev": "v0.41.0",
+    "rev": "v0.42.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-LgCS7W6mGGlX4vEhlPYL+Wo/urHv7aiopXWEBoEyL1c="
+    "vendorHash": "sha256-bhAoNJSbrpAzw0qCKIm84h6tFqUWT0JeBs1gJpPeJdU="
   },
   "thunder": {
     "hash": "sha256-fXvwBOIW3/76V3O9t25wff0oGViqSaSB2VgMdItXyn4=",
@@ -1250,13 +1250,13 @@
     "vendorHash": "sha256-ib1Esx2AO7b9S+v+zzuATgSVHI3HVwbzEeyqhpBz1BQ="
   },
   "yandex": {
-    "hash": "sha256-g3BdCQKBuxrTn/sScJtRMyL2EoiOF5MpMXMM6I++dEg=",
+    "hash": "sha256-aBWcxC6mHM/3GOjnN/Qi0DNoZjehh5i3C2+XRZ2Igdo=",
     "homepage": "https://registry.terraform.io/providers/yandex-cloud/yandex",
     "owner": "yandex-cloud",
     "proxyVendor": true,
     "repo": "terraform-provider-yandex",
-    "rev": "v0.84.0",
+    "rev": "v0.85.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-q9Rs2yJtI7MVqBcd9wwtyqR9PzmVkhKatbRRZwFm3po="
+    "vendorHash": "sha256-eLCFnBGAvH0ZEzOb5xVCY0Yy4U5V407AhpGSFpa9t7I="
   }
 }
diff --git a/pkgs/applications/networking/go-graft/default.nix b/pkgs/applications/networking/go-graft/default.nix
index 7e268e27f1a0f..88319182a648f 100644
--- a/pkgs/applications/networking/go-graft/default.nix
+++ b/pkgs/applications/networking/go-graft/default.nix
@@ -2,19 +2,19 @@
 
 buildGoModule rec {
   pname = "go-graft";
-  version = "0.2.15";
+  version = "0.2.16";
 
   src = fetchFromGitHub {
     owner = "mzz2017";
     repo = "gg";
     rev = "v${version}";
-    sha256 = "sha256-INoJcb6XUMvT1E56hC3BGK3Ax+v4jSRpZV12zpjYfMA=";
+    sha256 = "sha256-zdOcQ/+WXS7pDfnvYdb/FDjMT3yJdwnS8DoH2MIDcDs=";
   };
 
   CGO_ENABLED = 0;
 
   ldflags = [ "-X github.com/mzz2017/gg/cmd.Version=${version}" "-s" "-w" "-buildid=" ];
-  vendorSha256 = "sha256-kKIekANzLY2TYFyII1/BkKkqPYgmHB9xEfAVhJyI8FI=";
+  vendorHash = "sha256-kx94B1XIXWJOY9Y69lNb/sHWVjsuFuOXrdtJFJrUuAs=";
   subPackages = [ "." ];
 
   meta = with lib; {
diff --git a/pkgs/applications/networking/instant-messengers/briar-desktop/default.nix b/pkgs/applications/networking/instant-messengers/briar-desktop/default.nix
index 67edd3d1b2748..8613a2585e2c8 100644
--- a/pkgs/applications/networking/instant-messengers/briar-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/briar-desktop/default.nix
@@ -19,11 +19,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "briar-desktop";
-  version = "0.3.1-beta";
+  version = "0.4.0-beta";
 
   src = fetchurl {
-    url = "https://desktop.briarproject.org/jars/linux/0.3.1-beta/briar-desktop-linux-0.3.1-beta.jar";
-    sha256 = "841dc198101e6e8aa6b5ab6bd6b80e9c6b2593cb88bc3b2592f947baf963389d";
+    url = "https://desktop.briarproject.org/jars/linux/${version}/briar-desktop-linux-${version}.jar";
+    hash = "sha256-7zeIWsdPvROHGaf5igodlZss6Gow3kp6PX+QAzmxMnw=";
   };
 
   dontUnpack = true;
@@ -58,6 +58,6 @@ stdenv.mkDerivation rec {
     homepage = "https://code.briarproject.org/briar/briar-desktop";
     license = licenses.gpl3;
     maintainers = with maintainers; [ onny ];
-    platforms = [ "x86_64-linux" "aarch64-linux" "armv7l-linux" ];
+    platforms = [ "x86_64-linux" ];
   };
 }
diff --git a/pkgs/applications/networking/instant-messengers/dino/default.nix b/pkgs/applications/networking/instant-messengers/dino/default.nix
index 72e546286bf5a..5a65b43a8acb8 100644
--- a/pkgs/applications/networking/instant-messengers/dino/default.nix
+++ b/pkgs/applications/networking/instant-messengers/dino/default.nix
@@ -75,6 +75,9 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = ["-DBUILD_TESTS=yes"];
 
+  # Undefined symbols for architecture arm64: "_gpg_strerror"
+  NIX_LDFLAGS = lib.optionalString stdenv.isDarwin "-lgpg-error";
+
   doCheck = true;
   checkPhase = ''
     runHook preCheck
diff --git a/pkgs/applications/networking/instant-messengers/element/pin.json b/pkgs/applications/networking/instant-messengers/element/pin.json
index cc0578f71fec9..ccb7ecd1537f7 100644
--- a/pkgs/applications/networking/instant-messengers/element/pin.json
+++ b/pkgs/applications/networking/instant-messengers/element/pin.json
@@ -1,7 +1,7 @@
 {
-  "version": "1.11.20",
-  "desktopSrcHash": "mlB2UvRYzaJ6FWGDOqyZY6NTY7QoWCiCvmFDyWTPuMQ=",
-  "desktopYarnHash": "0ccwsy9ma7sn6d5f9jfv40dhj0y6aax8msx9bihjdmx989nkkh2m",
-  "webSrcHash": "55oLS89Pmy4d7DhBQc4i6boQIH2LgujE7kl6QwcKltw=",
-  "webYarnHash": "1aiq5wvb8cz2a5rc0h11s16fnyak0p9zhzbqwhf1rs6c1gav7777"
+  "version": "1.11.22",
+  "desktopSrcHash": "UJesD6cshsf/NK2ZTzOtAUfH+8JcGP9oCLFhkgfM0E0=",
+  "desktopYarnHash": "0bq24rjf63rkq3jphv7raqaz2fnibmj41z905k5f3l4ln835ndfv",
+  "webSrcHash": "B2clSJgKkjvQdIXQgi3bBPaVTDKOjeNBOvkAtcPOkFI=",
+  "webYarnHash": "182fh1ayh1y98kbg4mn8fxqvljs19b02j4ivvjszm55dcpwfp1df"
 }
diff --git a/pkgs/applications/networking/instant-messengers/element/update.sh b/pkgs/applications/networking/instant-messengers/element/update.sh
index b02e1d022393e..976b6cb0ba8fc 100755
--- a/pkgs/applications/networking/instant-messengers/element/update.sh
+++ b/pkgs/applications/networking/instant-messengers/element/update.sh
@@ -1,9 +1,6 @@
 #!/usr/bin/env nix-shell
 #!nix-shell -I nixpkgs=../../../../../ -i bash -p nix wget prefetch-yarn-deps nix-prefetch-github
 
-# FIXME should fix itself on the next release -> remove the warning if that's the case
-echo "WARNING: on the last update, the yarn.lock had to be patched. Please be careful when updating the hashes!"
-
 if [ "$#" -gt 1 ] || [[ "$1" == -* ]]; then
   echo "Regenerates packaging data for the element packages."
   echo "Usage: $0 [git release tag]"
diff --git a/pkgs/applications/networking/instant-messengers/rambox/default.nix b/pkgs/applications/networking/instant-messengers/rambox/default.nix
index e97b6c5b3ffbc..04c2fa27e5590 100644
--- a/pkgs/applications/networking/instant-messengers/rambox/default.nix
+++ b/pkgs/applications/networking/instant-messengers/rambox/default.nix
@@ -2,11 +2,11 @@
 
 let
   pname = "rambox";
-  version = "2.0.9";
+  version = "2.0.10";
 
   src = fetchurl {
     url = "https://github.com/ramboxapp/download/releases/download/v${version}/Rambox-${version}-linux-x64.AppImage";
-    sha256 = "sha256-o2ydZodmMAYeU0IiczKNlzY2hgTJbzyJWO/cZSTfAuM=";
+    sha256 = "sha256-NvsrWkdINrQV7V9SLfjtlN+obgQb0u8d/QgjGpZ+fpc=";
   };
 
   desktopItem = (makeDesktopItem {
diff --git a/pkgs/applications/networking/nextdns/default.nix b/pkgs/applications/networking/nextdns/default.nix
index b6f93ede05eee..c17c65e14fe2f 100644
--- a/pkgs/applications/networking/nextdns/default.nix
+++ b/pkgs/applications/networking/nextdns/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "nextdns";
-  version = "1.38.0";
+  version = "1.39.4";
 
   src = fetchFromGitHub {
     owner = "nextdns";
     repo = "nextdns";
     rev = "v${version}";
-    sha256 = "sha256-dJ/3MBEsA8M4pfE+GPT/bNnK3n4fL3Hwk0umgMTJAfY=";
+    sha256 = "sha256-7inMloKU/AL4s/p171xCzs4p4+AcLsvsbVsELK9vhFc=";
   };
 
-  vendorSha256 = "sha256-pCta8FzGVpl9fvnnjQ7/e2x/HolXAuxnz0vwKejGk98=";
+  vendorHash = "sha256-pCta8FzGVpl9fvnnjQ7/e2x/HolXAuxnz0vwKejGk98=";
 
   ldflags = [ "-s" "-w" "-X main.version=${version}" ];
 
diff --git a/pkgs/applications/networking/rymdport/default.nix b/pkgs/applications/networking/rymdport/default.nix
index dfd9d50b19512..e2b6e86c6cbdc 100644
--- a/pkgs/applications/networking/rymdport/default.nix
+++ b/pkgs/applications/networking/rymdport/default.nix
@@ -11,13 +11,13 @@
 
 buildGoModule rec {
   pname = "rymdport";
-  version = "3.3.0";
+  version = "3.3.1";
 
   src = fetchFromGitHub {
     owner = "Jacalz";
     repo = "rymdport";
     rev = "v${version}";
-    hash = "sha256-IsUKZL1aOKH01yZ7e/ciAESQKdZSscH+ytI3wptChy0=";
+    hash = "sha256-8Iul8YSxrfP7uG/uSmV+Qro+B1r+mhkOxCICHf204Lg=";
   };
 
   vendorHash = "sha256-9Z++E4Lb1+VBvOx5GJ4yQuj7fpwUhlsMhavTifKxVw4=";
diff --git a/pkgs/applications/office/gnumeric/default.nix b/pkgs/applications/office/gnumeric/default.nix
index e93be60741bb3..1fbb9b7cbd97a 100644
--- a/pkgs/applications/office/gnumeric/default.nix
+++ b/pkgs/applications/office/gnumeric/default.nix
@@ -7,11 +7,11 @@ let
   inherit (python3Packages) python pygobject3;
 in stdenv.mkDerivation rec {
   pname = "gnumeric";
-  version = "1.12.53";
+  version = "1.12.54";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "VWjkyNzqu5Ao8TYdEEVSL5Xwpx2qWelzy90tObrdTwI=";
+    sha256 = "RpBAYv0cSkyTWW0mv2eTLNcvwPjSxaZ8F5GFJ/7oK3Q=";
   };
 
   configureFlags = [ "--disable-component" ];
diff --git a/pkgs/applications/office/morgen/default.nix b/pkgs/applications/office/morgen/default.nix
index 7065343378f1e..d06d4d776a119 100644
--- a/pkgs/applications/office/morgen/default.nix
+++ b/pkgs/applications/office/morgen/default.nix
@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   pname = "morgen";
-  version = "2.5.16";
+  version = "2.6.4";
 
   src = fetchurl {
     url = "https://download.todesktop.com/210203cqcj00tw1/morgen-${version}.deb";
-    sha256 = "sha256-U77yOgQNSj1p3WZbwkyq0Ui2UrXeuAv5sD7L+ZI2x24=";
+    sha256 = "sha256-2Cze8R22Wrvp+FJq/7Kp36i7Areo5e9fdBo3DQ+rvZY=";
   };
 
   nativeBuildInputs = [
@@ -19,9 +19,6 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ alsa-lib gtk3 libxshmfence mesa nss ];
 
-  dontBuild = true;
-  dontConfigure = true;
-
   unpackCmd = ''
     dpkg-deb -x ${src} ./morgen-${pname}
   '';
@@ -37,7 +34,7 @@ stdenv.mkDerivation rec {
     # 2. Fixes startup script
     substituteInPlace $TMP/work/dist/main.js \
       --replace "process.resourcesPath,\"todesktop-runtime-config.json" "\"$out/opt/Morgen/resources/todesktop-runtime-config.json" \
-      --replace "Exec=\"+process.execPath+\"" "Exec=$out/bin/morgen"
+      --replace "Exec=\".concat(process.execPath," "Exec=\".concat(\"$out/bin/morgen\","
     asar pack --unpack='{*.node,*.ftz,rect-overlay}' "$TMP/work" $out/opt/Morgen/resources/app.asar
 
     substituteInPlace $out/share/applications/morgen.desktop \
diff --git a/pkgs/applications/radio/flex-ncat/default.nix b/pkgs/applications/radio/flex-ncat/default.nix
index 31167406c7d1e..5425c6b73ac8e 100644
--- a/pkgs/applications/radio/flex-ncat/default.nix
+++ b/pkgs/applications/radio/flex-ncat/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "flex-ncat";
-  version = "0.1-20221109.1";
+  version = "0.2-20230126.0";
 
   src = fetchFromGitHub {
     owner = "kc2g-flex-tools";
     repo = "nCAT";
     rev = "v${version}";
-    hash = "sha256-MlbzPZuEOhb3wJMXWkrt6DK8z0MPgznSm0N9Y6vJVWY=";
+    hash = "sha256-2taQQVTgAFyqtS06zZ+4Qmr/JIqU6mxNQYvxt+L/Mtc=";
   };
 
-  vendorSha256 = "sha256-lnJtFixgv4ke4Knavb+XKFPzHCiAPhNtfZS3SRVvY2g=";
+  vendorHash = "sha256-Tv6sbfWNOHYwA7v1SpNeM9aHs+3DSFv4V4qxllxrzJc=";
 
   meta = with lib; {
     homepage = "https://github.com/kc2g-flex-tools/nCAT";
diff --git a/pkgs/applications/science/robotics/betaflight-configurator/default.nix b/pkgs/applications/science/robotics/betaflight-configurator/default.nix
index 271274126b754..a76327b854b0d 100644
--- a/pkgs/applications/science/robotics/betaflight-configurator/default.nix
+++ b/pkgs/applications/science/robotics/betaflight-configurator/default.nix
@@ -13,10 +13,10 @@ let
 in
 stdenv.mkDerivation rec {
   inherit pname;
-  version = "10.8.0";
+  version = "10.9.0";
   src = fetchurl {
     url = "https://github.com/betaflight/${pname}/releases/download/${version}/${pname}_${version}_linux64-portable.zip";
-    sha256 = "sha256-Xn0ga2Z1UKd++TriL47ulV6idVTNBR8uiSW7FnL7r1g=";
+    sha256 = "sha256-9FzMyBIR2u1zXHtTWJABM6RF1+OyjYdEPlRwtig9blI=";
   };
 
   nativeBuildInputs = [ wrapGAppsHook unzip ];
diff --git a/pkgs/applications/version-management/gitea/default.nix b/pkgs/applications/version-management/gitea/default.nix
index 9210722c4e1df..1b4734027b7d0 100644
--- a/pkgs/applications/version-management/gitea/default.nix
+++ b/pkgs/applications/version-management/gitea/default.nix
@@ -39,20 +39,15 @@ buildGoModule rec {
 
   buildInputs = lib.optional pamSupport pam;
 
-  preBuild =
-    let
-      tags = lib.optional pamSupport "pam"
-        ++ lib.optional sqliteSupport "sqlite sqlite_unlock_notify";
-      tagsString = lib.concatStringsSep " " tags;
-    in
-    ''
-      export buildFlagsArray=(
-        -tags="${tagsString}"
-        -ldflags='-X "main.Version=${version}" -X "main.Tags=${tagsString}"'
-      )
-    '';
+  tags = lib.optional pamSupport "pam"
+    ++ lib.optionals sqliteSupport [ "sqlite" "sqlite_unlock_notify" ];
 
-  ldflags = [ "-s" "-w" ];
+  ldflags = [
+    "-s"
+    "-w"
+    "-X main.Version=${version}"
+    "-X 'main.Tags=${lib.concatStringsSep " " tags}'"
+  ];
 
   outputs = [ "out" "data" ];
 
diff --git a/pkgs/applications/version-management/gitlab/data.json b/pkgs/applications/version-management/gitlab/data.json
index a36dc3bc2503c..06eb8d78f06e7 100644
--- a/pkgs/applications/version-management/gitlab/data.json
+++ b/pkgs/applications/version-management/gitlab/data.json
@@ -1,14 +1,14 @@
 {
-  "version": "15.7.5",
-  "repo_hash": "sha256-zo1b82y114NpX43rJAWQmUhORM1kQxyiSnonqPUQJmY=",
-  "yarn_hash": "086v3lr4hnz8z8pla1d3mi2smldidmx2z2cmffn830ianpqkk83l",
+  "version": "15.8.1",
+  "repo_hash": "sha256-AdgebB7IY18u/J1F67oNnwVYmmeYJPNCI/yll2eZEiQ=",
+  "yarn_hash": "1famdjvsbhvnkg5sp2vnc3jzaixww41833pb0427s3qpig0fc7az",
   "owner": "gitlab-org",
   "repo": "gitlab",
-  "rev": "v15.7.5-ee",
+  "rev": "v15.8.1-ee",
   "passthru": {
-    "GITALY_SERVER_VERSION": "15.7.5",
-    "GITLAB_PAGES_VERSION": "15.7.5",
-    "GITLAB_SHELL_VERSION": "14.14.0",
-    "GITLAB_WORKHORSE_VERSION": "15.7.5"
+    "GITALY_SERVER_VERSION": "15.8.1",
+    "GITLAB_PAGES_VERSION": "15.8.1",
+    "GITLAB_SHELL_VERSION": "14.15.0",
+    "GITLAB_WORKHORSE_VERSION": "15.8.1"
   }
 }
diff --git a/pkgs/applications/version-management/gitlab/gitaly/Gemfile.lock b/pkgs/applications/version-management/gitlab/gitaly/Gemfile.lock
index da95241d34c4b..2b90a2e0cdaf0 100644
--- a/pkgs/applications/version-management/gitlab/gitaly/Gemfile.lock
+++ b/pkgs/applications/version-management/gitlab/gitaly/Gemfile.lock
@@ -80,7 +80,7 @@ GEM
       reverse_markdown (~> 1.0)
       rugged (>= 0.24, < 2.0)
       thor (>= 0.19, < 2.0)
-    loofah (2.19.0)
+    loofah (2.19.1)
       crass (~> 1.0.2)
       nokogiri (>= 1.5.9)
     memoizable (0.4.2)
@@ -90,7 +90,7 @@ GEM
     minitest (5.16.3)
     msgpack (1.3.3)
     multipart-post (2.1.1)
-    nokogiri (1.13.8)
+    nokogiri (1.13.10)
       mini_portile2 (~> 2.8.0)
       racc (~> 1.4)
     octokit (4.20.0)
@@ -112,15 +112,15 @@ GEM
       coderay (~> 1.1.0)
       method_source (~> 0.9.0)
     public_suffix (4.0.7)
-    racc (1.6.0)
+    racc (1.6.1)
     rack (2.2.4)
     rack-test (2.0.2)
       rack (>= 1.3)
     rails-dom-testing (2.0.3)
       activesupport (>= 4.2.0)
       nokogiri (>= 1.6)
-    rails-html-sanitizer (1.4.3)
-      loofah (~> 2.3)
+    rails-html-sanitizer (1.4.4)
+      loofah (~> 2.19, >= 2.19.1)
     rainbow (3.0.0)
     rbtrace (0.4.14)
       ffi (>= 1.0.6)
diff --git a/pkgs/applications/version-management/gitlab/gitaly/default.nix b/pkgs/applications/version-management/gitlab/gitaly/default.nix
index 9f217aa65f34c..28452edbfe465 100644
--- a/pkgs/applications/version-management/gitlab/gitaly/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitaly/default.nix
@@ -11,7 +11,7 @@ let
     gemdir = ./.;
   };
 
-  version = "15.7.5";
+  version = "15.8.1";
   package_version = "v${lib.versions.major version}";
   gitaly_package = "gitlab.com/gitlab-org/gitaly/${package_version}";
 
@@ -22,10 +22,10 @@ let
       owner = "gitlab-org";
       repo = "gitaly";
       rev = "v${version}";
-      sha256 = "sha256-FT77MUcErc/16tChwyNczCLtADTOEzKKTsTlhLI6aV8=";
+      sha256 = "sha256-TolduUm8OhpubHXMCyy0vQhj65lauh5eST5UDvdWNVE=";
     };
 
-    vendorSha256 = "sha256-UEEM0mv7d0gmDcsSKbeh4JcTnX4f5oogZnhRpqaNxwY=";
+    vendorSha256 = "sha256-8P5X/bqeI1hY45IGsvEWOg3GuetEQF/XtZzUMdX22pA=";
 
     ldflags = [ "-X ${gitaly_package}/internal/version.version=${version}" "-X ${gitaly_package}/internal/version.moduleVersion=${version}" ];
 
diff --git a/pkgs/applications/version-management/gitlab/gitaly/gemset.nix b/pkgs/applications/version-management/gitlab/gitaly/gemset.nix
index f7471a12b008d..f3a4a082f205c 100644
--- a/pkgs/applications/version-management/gitlab/gitaly/gemset.nix
+++ b/pkgs/applications/version-management/gitlab/gitaly/gemset.nix
@@ -317,10 +317,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1fpyk1965py77al7iadkn5dibwgvybknkr7r8bii2dj73wvr29rh";
+      sha256 = "08qhzck271anrx9y6qa6mh8hwwdzsgwld8q0000rcd7yvvpnjr3c";
       type = "gem";
     };
-    version = "2.19.0";
+    version = "2.19.1";
   };
   memoizable = {
     dependencies = ["thread_safe"];
@@ -385,10 +385,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0g7axlq2y6gzmixzzzhw3fn6nhrhg469jj8gfr7gs8igiclpkhkr";
+      sha256 = "0n79k78c5vdcyl0m3y3l5x9kxl6xf5lgriwi2vd665qmdkr01vnk";
       type = "gem";
     };
-    version = "1.13.8";
+    version = "1.13.10";
   };
   octokit = {
     dependencies = ["faraday" "sawyer"];
@@ -494,10 +494,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0la56m0z26j3mfn1a9lf2l03qx1xifanndf9p3vx1azf6sqy7v9d";
+      sha256 = "0p685i23lr8pl7l09g9l2mcj615fr7g33w3mkcr472lcg34nq8n8";
       type = "gem";
     };
-    version = "1.6.0";
+    version = "1.6.1";
   };
   rack = {
     groups = ["default"];
@@ -537,10 +537,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1mj0b7ay10a2fgwj70kjw7mlyrp7a5la8lx8zmwhy40bkansdfrf";
+      sha256 = "1mcb75qvldfz6zsr4inrfx7dmb0ngxy507awx28khqmnla3hqpc9";
       type = "gem";
     };
-    version = "1.4.3";
+    version = "1.4.4";
   };
   rainbow = {
     source = {
diff --git a/pkgs/applications/version-management/gitlab/gitlab-shell/default.nix b/pkgs/applications/version-management/gitlab/gitlab-shell/default.nix
index 74fd1ab320e02..25e2a0642423a 100644
--- a/pkgs/applications/version-management/gitlab/gitlab-shell/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-shell/default.nix
@@ -2,19 +2,19 @@
 
 buildGoModule rec {
   pname = "gitlab-shell";
-  version = "14.14.0";
+  version = "14.15.0";
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-shell";
     rev = "v${version}";
-    sha256 = "sha256-zXRLaEy2Q+mm1GLjLB1AxRtBxXAoLw6PA1YOJfvVhoc=";
+    sha256 = "sha256-GDhYBL5LT3r6UIjDDY3LV5VgcBch190hYLPb6uMWETs=";
   };
 
   buildInputs = [ ruby ];
 
   patches = [ ./remove-hardcoded-locations.patch ];
 
-  vendorSha256 = "sha256-mhmM33cXJbqVJ1jY82Mi/nWzz7HXdxxSsFNQknFkwpQ=";
+  vendorSha256 = "sha256-2DpQNJw67ipIW3ctHDJthuDrKNZCYvjXGlDxzBEMGWs=";
 
   postInstall = ''
     cp -r "$NIX_BUILD_TOP/source"/bin/* $out/bin
diff --git a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
index b164076c28b69..7a808ee2ff649 100644
--- a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
@@ -5,7 +5,7 @@ in
 buildGoModule rec {
   pname = "gitlab-workhorse";
 
-  version = "15.7.5";
+  version = "15.8.1";
 
   src = fetchFromGitLab {
     owner = data.owner;
@@ -16,7 +16,7 @@ buildGoModule rec {
 
   sourceRoot = "source/workhorse";
 
-  vendorSha256 = "sha256-TrLc5L4kLAdu1CEM3ezw6hhF6Icy3rXkFyUaVTUQ6X4=";
+  vendorSha256 = "sha256-0FWR6cIV/0R2OrOAKhvuVnIY3Hkw4CIjyBUeF/paumw=";
   buildInputs = [ git ];
   ldflags = [ "-X main.Version=${version}" ];
   doCheck = false;
diff --git a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
index 417dc56637da3..96517b56ff918 100644
--- a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
@@ -5,7 +5,7 @@ source 'https://rubygems.org'
 if ENV['BUNDLER_CHECKSUM_VERIFICATION_OPT_IN'] # this verification is still experimental
   $LOAD_PATH.unshift(File.expand_path("vendor/gems/bundler-checksum/lib", __dir__))
   require 'bundler-checksum'
-  Bundler::Checksum.patch!
+  BundlerChecksum.patch!
 end
 
 gem 'bundler-checksum', '~> 0.1.0', path: 'vendor/gems/bundler-checksum', require: false
@@ -37,7 +37,7 @@ gem 'view_component', '~> 2.74.1'
 gem 'default_value_for', '~> 3.4.0'
 
 # Supported DBs
-gem 'pg', '~> 1.4.3'
+gem 'pg', '~> 1.4.5'
 
 gem 'rugged', '~> 1.2'
 gem 'grape-path-helpers', '~> 1.7.1'
@@ -84,7 +84,7 @@ gem 'gssapi', group: :kerberos
 gem 'timfel-krb5-auth', '~> 0.8', group: :kerberos
 
 # Spam and anti-bot protection
-gem 'recaptcha', '~> 4.11', require: 'recaptcha/rails'
+gem 'recaptcha', '~> 5.12', require: 'recaptcha/rails'
 gem 'akismet', '~> 3.0'
 gem 'invisible_captcha', '~> 2.0.0'
 
@@ -113,7 +113,7 @@ gem 'gpgme', '~> 2.0.22'
 # GitLab fork with several improvements to original library. For full list of changes
 # see https://github.com/intridea/omniauth-ldap/compare/master...gitlabhq:master
 gem 'gitlab_omniauth-ldap', '~> 2.2.0', require: 'omniauth-ldap'
-gem 'net-ldap', '~> 0.16.3'
+gem 'net-ldap', '~> 0.17.1'
 
 # API
 gem 'grape', '~> 1.5.2'
@@ -200,7 +200,7 @@ gem 'diffy', '~> 3.4'
 gem 'diff_match_patch', '~> 0.1.0'
 
 # Application server
-gem 'rack', '~> 2.2.4'
+gem 'rack', '~> 2.2.6', '>= 2.2.6.2'
 # https://github.com/zombocom/rack-timeout/blob/master/README.md#rails-apps-manually
 gem 'rack-timeout', '~> 0.6.3', require: 'rack/timeout/base'
 
@@ -304,7 +304,7 @@ gem 'fast_blank'
 gem 'gitlab-chronic', '~> 0.10.5'
 gem 'gitlab_chronic_duration', '~> 0.10.6.2'
 
-gem 'rack-proxy', '~> 0.7.4'
+gem 'rack-proxy', '~> 0.7.6'
 
 gem 'sassc-rails', '~> 2.1.0'
 gem 'autoprefixer-rails', '10.2.5.1'
@@ -358,12 +358,12 @@ gem 'prometheus-client-mmap', '~> 0.17', require: 'prometheus/client'
 gem 'warning', '~> 1.3.0'
 
 group :development do
-  gem 'lefthook', '~> 1.2.6', require: false
+  gem 'lefthook', '~> 1.2.7', require: false
   gem 'rubocop'
   gem 'solargraph', '~> 0.47.2', require: false
 
   gem 'letter_opener_web', '~> 2.0.0'
-  gem 'lookbook', '~> 1.2', '>= 1.2.1'
+  gem 'lookbook', '~> 1.4', '>= 1.4.5'
 
   # Better errors handler
   gem 'better_errors', '~> 2.9.1'
@@ -395,7 +395,7 @@ group :development, :test do
   gem 'spring', '~> 4.1.0'
   gem 'spring-commands-rspec', '~> 1.0.4'
 
-  gem 'gitlab-styles', '~> 9.1.0', require: false
+  gem 'gitlab-styles', '~> 9.2.0', require: false
 
   gem 'haml_lint', '~> 0.40.0', require: false
   gem 'bundler-audit', '~> 0.7.0.1', require: false
@@ -538,7 +538,7 @@ gem 'mail-smtp_pool', '~> 0.1.0', path: 'vendor/gems/mail-smtp_pool', require: f
 gem 'microsoft_graph_mailer', '~> 0.1.0', path: 'vendor/gems/microsoft_graph_mailer'
 
 # File encryption
-gem 'lockbox', '~> 0.6.2'
+gem 'lockbox', '~> 1.1.1'
 
 # Email validation
 gem 'valid_email', '~> 0.1'
@@ -574,6 +574,7 @@ gem 'arr-pm', '~> 0.0.12'
 
 # Apple plist parsing
 gem 'CFPropertyList'
+gem 'app_store_connect'
 
 # For phone verification
 gem 'telesignenterprise', '~> 2.2'
diff --git a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
index 087d4d8aeec04..ea1771e5af3bd 100644
--- a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
@@ -172,6 +172,9 @@ GEM
     apollo_upload_server (2.1.0)
       actionpack (>= 4.2)
       graphql (>= 1.8)
+    app_store_connect (0.29.0)
+      activesupport (>= 6.0.0)
+      jwt (>= 1.4, <= 2.5.0)
     arr-pm (0.0.12)
     asana (0.10.13)
       faraday (~> 1.0)
@@ -598,7 +601,7 @@ GEM
     gitlab-sidekiq-fetcher (0.9.0)
       json (>= 2.5)
       sidekiq (~> 6.1)
-    gitlab-styles (9.1.0)
+    gitlab-styles (9.2.0)
       rubocop (~> 1.38.0)
       rubocop-gitlab-security (~> 0.1.1)
       rubocop-graphql (~> 0.14)
@@ -832,7 +835,7 @@ GEM
       kramdown (~> 2.0)
     launchy (2.5.0)
       addressable (~> 2.7)
-    lefthook (1.2.6)
+    lefthook (1.2.7)
     letter_opener (1.7.0)
       launchy (~> 2.2)
     letter_opener_web (2.0.0)
@@ -861,7 +864,7 @@ GEM
       ffi-compiler (~> 1.0)
       rake (~> 13.0)
     locale (2.1.3)
-    lockbox (0.6.2)
+    lockbox (1.1.1)
     lograge (0.11.2)
       actionpack (>= 4)
       activesupport (>= 4)
@@ -870,7 +873,7 @@ GEM
     loofah (2.19.1)
       crass (~> 1.0.2)
       nokogiri (>= 1.5.9)
-    lookbook (1.2.1)
+    lookbook (1.4.5)
       actioncable
       activemodel
       css_parser
@@ -930,7 +933,7 @@ GEM
     nenv (0.3.0)
     net-http-persistent (4.0.1)
       connection_pool (~> 2.2)
-    net-ldap (0.16.3)
+    net-ldap (0.17.1)
     net-ntp (2.1.3)
     net-scp (3.0.0)
       net-ssh (>= 2.6.5, < 7.0.0)
@@ -1068,7 +1071,7 @@ GEM
       tty-color (~> 0.5)
     peek (1.1.0)
       railties (>= 4.0.0)
-    pg (1.4.3)
+    pg (1.4.5)
     pg_query (2.2.0)
       google-protobuf (>= 3.19.2)
     plist (3.6.0)
@@ -1108,7 +1111,7 @@ GEM
     pyu-ruby-sasl (0.0.3.3)
     raabro (1.4.0)
     racc (1.6.1)
-    rack (2.2.4)
+    rack (2.2.6.2)
     rack-accept (0.4.5)
       rack (>= 0.4)
     rack-attack (6.6.1)
@@ -1123,7 +1126,7 @@ GEM
       rack (>= 2.1.0)
     rack-protection (2.2.2)
       rack
-    rack-proxy (0.7.4)
+    rack-proxy (0.7.6)
       rack
     rack-test (2.0.2)
       rack (>= 1.3)
@@ -1150,8 +1153,8 @@ GEM
     rails-dom-testing (2.0.3)
       activesupport (>= 4.2.0)
       nokogiri (>= 1.6)
-    rails-html-sanitizer (1.4.3)
-      loofah (~> 2.3)
+    rails-html-sanitizer (1.4.4)
+      loofah (~> 2.19, >= 2.19.1)
     rails-i18n (7.0.3)
       i18n (>= 0.7, < 2)
       railties (>= 6.0.0, < 8)
@@ -1174,7 +1177,7 @@ GEM
     rchardet (1.8.0)
     rdoc (6.3.2)
     re2 (1.6.0)
-    recaptcha (4.13.1)
+    recaptcha (5.12.3)
       json
     recursive-open-struct (1.1.3)
     redcarpet (3.5.1)
@@ -1274,14 +1277,14 @@ GEM
       rubocop (>= 0.51)
     rubocop-graphql (0.18.0)
       rubocop (>= 0.87, < 2)
-    rubocop-performance (1.15.0)
+    rubocop-performance (1.15.1)
       rubocop (>= 1.7.0, < 2.0)
       rubocop-ast (>= 0.4.0)
-    rubocop-rails (2.17.2)
+    rubocop-rails (2.17.3)
       activesupport (>= 4.2.0)
       rack (>= 1.1)
       rubocop (>= 1.33.0, < 2.0)
-    rubocop-rspec (2.15.0)
+    rubocop-rspec (2.16.0)
       rubocop (~> 1.33)
     ruby-fogbugz (0.3.0)
       crack (~> 0.4)
@@ -1581,6 +1584,7 @@ DEPENDENCIES
   addressable (~> 2.8)
   akismet (~> 3.0)
   apollo_upload_server (~> 2.1.0)
+  app_store_connect
   arr-pm (~> 0.0.12)
   asana (~> 0.10.13)
   asciidoctor (~> 2.0.17)
@@ -1672,7 +1676,7 @@ DEPENDENCIES
   gitlab-net-dns (~> 0.9.1)
   gitlab-omniauth-openid-connect (~> 0.10.0)
   gitlab-sidekiq-fetcher (= 0.9.0)
-  gitlab-styles (~> 9.1.0)
+  gitlab-styles (~> 9.2.0)
   gitlab_chronic_duration (~> 0.10.6.2)
   gitlab_omniauth-ldap (~> 2.2.0)
   gon (~> 6.4.0)
@@ -1716,15 +1720,15 @@ DEPENDENCIES
   knapsack (~> 1.21.1)
   kramdown (~> 2.3.1)
   kubeclient (~> 4.9.3)!
-  lefthook (~> 1.2.6)
+  lefthook (~> 1.2.7)
   letter_opener_web (~> 2.0.0)
   license_finder (~> 7.0)
   licensee (~> 9.15)
   listen (~> 3.7)
-  lockbox (~> 0.6.2)
+  lockbox (~> 1.1.1)
   lograge (~> 0.5)
   loofah (~> 2.19.1)
-  lookbook (~> 1.2, >= 1.2.1)
+  lookbook (~> 1.4, >= 1.4.5)
   lru_redux
   mail (= 2.7.1)
   mail-smtp_pool (~> 0.1.0)!
@@ -1734,7 +1738,7 @@ DEPENDENCIES
   mini_magick (~> 4.10.1)
   minitest (~> 5.11.0)
   multi_json (~> 1.14.1)
-  net-ldap (~> 0.16.3)
+  net-ldap (~> 0.17.1)
   net-ntp
   nokogiri (~> 1.13.10)
   oauth2 (~> 2.0)
@@ -1767,7 +1771,7 @@ DEPENDENCIES
   parallel (~> 1.19)
   parslet (~> 1.8)
   peek (~> 1.1)
-  pg (~> 1.4.3)
+  pg (~> 1.4.5)
   pg_query (~> 2.2)
   png_quantizator (~> 0.2.1)
   premailer-rails (~> 1.10.3)
@@ -1777,11 +1781,11 @@ DEPENDENCIES
   pry-shell (~> 0.5.1)
   puma (~> 5.6.5)
   puma_worker_killer (~> 0.3.1)
-  rack (~> 2.2.4)
+  rack (~> 2.2.6, >= 2.2.6.2)
   rack-attack (~> 6.6.1)
   rack-cors (~> 1.1.1)
   rack-oauth2 (~> 1.21.3)
-  rack-proxy (~> 0.7.4)
+  rack-proxy (~> 0.7.6)
   rack-timeout (~> 0.6.3)
   rails (~> 6.1.6.1)
   rails-controller-testing
@@ -1790,7 +1794,7 @@ DEPENDENCIES
   rbtrace (~> 0.4)
   rdoc (~> 6.3.2)
   re2 (~> 1.6.0)
-  recaptcha (~> 4.11)
+  recaptcha (~> 5.12)
   redis (~> 4.8.0)
   redis-actionpack (~> 5.3.0)
   redis-namespace (~> 1.9.0)
diff --git a/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix b/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
index 968d07704fcb9..269318a0961d1 100644
--- a/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
@@ -206,6 +206,17 @@ src:
     };
     version = "2.1.0";
   };
+  app_store_connect = {
+    dependencies = ["activesupport" "jwt"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "03s3x8b6ifjrqk9ian59i9yyxxl65ykvbb4r424j2hjsh8iskmq1";
+      type = "gem";
+    };
+    version = "0.29.0";
+  };
   arr-pm = {
     groups = ["default"];
     platforms = [];
@@ -2177,10 +2188,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1ch27hxbby16jxvxg1jq3sqdbd3gg7ss4ymxn3yhsjy7gyglxza6";
+      sha256 = "196fhlbhhanpbn5iriccp7m04xgkq7swyk07im50q7z05pxyf1ki";
       type = "gem";
     };
-    version = "9.1.0";
+    version = "9.2.0";
   };
   gitlab_chronic_duration = {
     dependencies = ["numerizer"];
@@ -3098,10 +3109,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0qyylcc57pcf8mwm9dvlzkfjxcpbypnp4q21ni05s7wxalxb12ld";
+      sha256 = "18vcakjkb5fhavq9s6j7zwjc14c652361qws5g1slqb300anfww2";
       type = "gem";
     };
-    version = "1.2.6";
+    version = "1.2.7";
   };
   letter_opener = {
     dependencies = ["launchy"];
@@ -3194,10 +3205,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0g6w327y8d7dr0d7zw6p7hmlwh0hcvb7pkc7xxyf5mn3fmw6fdh1";
+      sha256 = "1h1a3h3rfv3094pn5zn7d3c066dmhx9i380mhqa1qyagqla6pw8a";
       type = "gem";
     };
-    version = "0.6.2";
+    version = "1.1.1";
   };
   lograge = {
     dependencies = ["actionpack" "activesupport" "railties" "request_store"];
@@ -3227,10 +3238,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1mv5q4gpgzklwrgp7s7mhi0gb7x739qhyrni2n96i2vr4nv48a3l";
+      sha256 = "1nww5h9frmbjfpfy2nb296vn78xnq1qg0lq3lsn52ky8s8rb65dw";
       type = "gem";
     };
-    version = "1.2.1";
+    version = "1.4.5";
   };
   lru_redux = {
     groups = ["default"];
@@ -3581,10 +3592,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "13lh6qizxi8fza8py73b2dvjp9p010dvbaq7diagir9nh8plsinv";
+      sha256 = "1ycw0qsw3hap8svakl0i30jkj0ffd4lpyrn17a1j0w8mz5ainmsj";
       type = "gem";
     };
-    version = "0.16.3";
+    version = "0.17.1";
   };
   net-ntp = {
     groups = ["default"];
@@ -4153,10 +4164,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1ypj64nhq3grs9zh40vmyfyhmxlhljjsbg5q0jxhlxg5v76ij0mb";
+      sha256 = "1wd6nl81nbdwck04hccsm7wf23ghpi8yddd9j4rbwyvyj0sbsff1";
       type = "gem";
     };
-    version = "1.4.3";
+    version = "1.4.5";
   };
   pg_query = {
     dependencies = ["google-protobuf"];
@@ -4358,10 +4369,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0axc6w0rs4yj0pksfll1hjgw1k6a5q0xi2lckh91knfb72v348pa";
+      sha256 = "0qvp6h2abmlsl4sqjsvac03cr2mxq6143gbx4kq52rpazp021qsb";
       type = "gem";
     };
-    version = "2.2.4";
+    version = "2.2.6.2";
   };
   rack-accept = {
     dependencies = ["rack"];
@@ -4424,10 +4435,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1m6j2xk3s3ps3r9vqgwq3flyij9jgkyzanmgiifid8yqhcskgfx8";
+      sha256 = "1a62439xwn5v6hsl9s11hdk4wj58czhcbg7lminv23mnkc0ca147";
       type = "gem";
     };
-    version = "0.7.4";
+    version = "0.7.6";
   };
   rack-test = {
     dependencies = ["rack"];
@@ -4489,10 +4500,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1mj0b7ay10a2fgwj70kjw7mlyrp7a5la8lx8zmwhy40bkansdfrf";
+      sha256 = "1mcb75qvldfz6zsr4inrfx7dmb0ngxy507awx28khqmnla3hqpc9";
       type = "gem";
     };
-    version = "1.4.3";
+    version = "1.4.4";
   };
   rails-i18n = {
     dependencies = ["i18n" "railties"];
@@ -4614,10 +4625,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "121pkq8kwqjh4l751xzx15bjp5vmf5pirfmpb11h71zsiavjqv6w";
+      sha256 = "1vmpppgdy64qa16bvkss0xyzmyyzxv5hwzvc1i6saw4yvm58kl9p";
       type = "gem";
     };
-    version = "4.13.1";
+    version = "5.12.3";
   };
   recursive-open-struct = {
     groups = ["default"];
@@ -5020,10 +5031,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1h06a2asg8pjq7l0k885126n60y54rgw0qr957qarpv7qligzn4c";
+      sha256 = "00ld0hfm2x5hzms9xhkyjfxs8afsmlg1kf0mklk68cq4wwwihkwd";
       type = "gem";
     };
-    version = "1.15.0";
+    version = "1.15.1";
   };
   rubocop-rails = {
     dependencies = ["activesupport" "rack" "rubocop"];
@@ -5031,10 +5042,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "052viwgi7dbbnq0pxihz1k72dwhph8gw4v2zzw057w42l39hhh6i";
+      sha256 = "1bv51vwcg5m4v35n7653xclw9vv3ifvgbhvc2l79wz2p76ipm1bx";
       type = "gem";
     };
-    version = "2.17.2";
+    version = "2.17.3";
   };
   rubocop-rspec = {
     dependencies = ["rubocop"];
@@ -5042,10 +5053,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0pj53m5zcrgyhb2zsjxqsav9sm9s8jh0mgk8c1qckaxy3dkwfxm4";
+      sha256 = "1rpcww107xq6aj5wkypzjj346jaxhqal33wmhlwb9gc2h425yg5k";
       type = "gem";
     };
-    version = "2.15.0";
+    version = "2.16.0";
   };
   ruby-fogbugz = {
     dependencies = ["crack" "multipart-post"];
diff --git a/pkgs/applications/version-management/got/default.nix b/pkgs/applications/version-management/got/default.nix
index 7db96739b2b53..e601b1165f5d8 100644
--- a/pkgs/applications/version-management/got/default.nix
+++ b/pkgs/applications/version-management/got/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "got";
-  version = "0.82";
+  version = "0.83";
 
   src = fetchurl {
     url = "https://gameoftrees.org/releases/portable/got-portable-${version}.tar.gz";
-    sha256 = "sha256-Lb0WZ4gTuG/GBAnEh9ff/K0ciwjDX3cmEhItMyJ/lmI=";
+    sha256 = "sha256-kNhU6OR9IUNPL72D90nhq2X5vmVW7YUmpnq/EOUvG/8=";
   };
 
   nativeBuildInputs = [ pkg-config bison ];
diff --git a/pkgs/applications/version-management/sublime-merge/default.nix b/pkgs/applications/version-management/sublime-merge/default.nix
index ceee5d6b48868..62122bc35b15a 100644
--- a/pkgs/applications/version-management/sublime-merge/default.nix
+++ b/pkgs/applications/version-management/sublime-merge/default.nix
@@ -9,8 +9,8 @@ in {
   } {};
 
   sublime-merge-dev = common {
-    buildVersion = "2081";
-    x64sha256 = "QzJP25KxczmrR5PZ9ujRSM3V+TrKqiH82plo1bTv48s=";
+    buildVersion = "2082";
+    x64sha256 = "Gl1BrLTSDLRTgrYQW/99o0XRjSIxvnNYRIViZEidcsM=";
     dev = true;
   } {};
 }
diff --git a/pkgs/applications/virtualization/crun/default.nix b/pkgs/applications/virtualization/crun/default.nix
index 60d05f6f23095..b37937e7461c6 100644
--- a/pkgs/applications/virtualization/crun/default.nix
+++ b/pkgs/applications/virtualization/crun/default.nix
@@ -38,13 +38,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "crun";
-  version = "1.7.2";
+  version = "1.8";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = pname;
     rev = version;
-    sha256 = "sha256-SNNy/oI3ZcMeRLEMS2nSCS/rRaen5WsDfhdlHQCdtP4=";
+    hash = "sha256-8R9cja8Blk+7Sp25bJ9t9e0TvazD41livK+KKAwRpLg=";
     fetchSubmodules = true;
   };
 
@@ -74,9 +74,9 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "A fast and lightweight fully featured OCI runtime and C library for running containers";
+    homepage = "https://github.com/containers/crun";
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
-    inherit (src.meta) homepage;
     maintainers = with maintainers; [ ] ++ teams.podman.members;
   };
 }
diff --git a/pkgs/applications/virtualization/docker/default.nix b/pkgs/applications/virtualization/docker/default.nix
index 5027a8fd5c911..1aa5071938a89 100644
--- a/pkgs/applications/virtualization/docker/default.nix
+++ b/pkgs/applications/virtualization/docker/default.nix
@@ -2,11 +2,12 @@
 
 rec {
   dockerGen = {
-      version, rev, sha256
-      , moby-src
-      , runcRev, runcSha256
-      , containerdRev, containerdSha256
-      , tiniRev, tiniSha256, buildxSupport ? true, composeSupport ? true
+      version
+      , cliRev, cliHash
+      , mobyRev, mobyHash
+      , runcRev, runcHash
+      , containerdRev, containerdHash
+      , tiniRev, tiniHash, buildxSupport ? true, composeSupport ? true
       # package dependencies
       , stdenv, fetchFromGitHub, fetchpatch, buildGoPackage
       , makeWrapper, installShellFiles, pkg-config, glibc
@@ -29,7 +30,7 @@ rec {
         owner = "opencontainers";
         repo = "runc";
         rev = runcRev;
-        sha256 = runcSha256;
+        hash = runcHash;
       };
 
       # docker/runc already include these patches / are not applicable
@@ -44,7 +45,7 @@ rec {
         owner = "containerd";
         repo = "containerd";
         rev = containerdRev;
-        sha256 = containerdSha256;
+        hash = containerdHash;
       };
 
       buildInputs = oldAttrs.buildInputs
@@ -59,7 +60,7 @@ rec {
         owner = "krallin";
         repo = "tini";
         rev = tiniRev;
-        sha256 = tiniSha256;
+        hash = tiniHash;
       };
 
       # Do not remove static from make files as we want a static binary
@@ -70,6 +71,13 @@ rec {
       NIX_CFLAGS_COMPILE = "-DMINIMAL=ON";
     });
 
+    moby-src = fetchFromGitHub {
+      owner = "moby";
+      repo = "moby";
+      rev = mobyRev;
+      hash = mobyHash;
+    };
+
     moby = buildGoPackage (lib.optionalAttrs stdenv.isLinux rec {
       pname = "moby";
       inherit version;
@@ -95,7 +103,7 @@ rec {
         (fetchpatch {
           name = "buildkit-zfs.patch";
           url = "https://github.com/moby/moby/pull/43136.patch";
-          sha256 = "1WZfpVnnqFwLMYqaHLploOodls0gHF8OCp7MrM26iX8=";
+          hash = "sha256-1WZfpVnnqFwLMYqaHLploOodls0gHF8OCp7MrM26iX8=";
         })
       ];
 
@@ -108,7 +116,7 @@ rec {
         # build engine
         cd ./go/src/${goPackagePath}
         export AUTO_GOPATH=1
-        export DOCKER_GITCOMMIT="${rev}"
+        export DOCKER_GITCOMMIT="${cliRev}"
         export VERSION="${version}"
         ./hack/make.sh dynbinary
         cd -
@@ -159,8 +167,8 @@ rec {
     src = fetchFromGitHub {
       owner = "docker";
       repo = "cli";
-      rev = "v${version}";
-      sha256 = sha256;
+      rev = cliRev;
+      hash = cliHash;
     };
 
     goPackagePath = "github.com/docker/cli";
@@ -192,7 +200,7 @@ rec {
       mkdir -p .gopath/src/github.com/docker/
       ln -sf $PWD .gopath/src/github.com/docker/cli
       export GOPATH="$PWD/.gopath:$GOPATH"
-      export GITCOMMIT="${rev}"
+      export GITCOMMIT="${cliRev}"
       export VERSION="${version}"
       export BUILDTIME="1970-01-01T00:00:00Z"
       source ./scripts/build/.variables
@@ -254,20 +262,16 @@ rec {
   # Get revisions from
   # https://github.com/moby/moby/tree/${version}/hack/dockerfile/install/*
   docker_20_10 = callPackage dockerGen rec {
-    version = "20.10.21";
-    rev = "v${version}";
-    sha256 = "sha256-hPQ1t7L2fqoFWoinqIrDwFQ1bo9TzMb4l3HmAotIUS8=";
-    moby-src = fetchFromGitHub {
-      owner = "moby";
-      repo = "moby";
-      rev = "v${version}";
-      sha256 = "sha256-BcYDh/UEmmURt7hWLWdPTKVu/Nzoeq/shE+HnUoh8b4=";
-    };
+    version = "20.10.23";
+    cliRev = "v${version}";
+    cliHash = "sha256-fNaRpstyG90Jzq3+U2A42Jj+ixb+m7tXLioIcsegPbQ=";
+    mobyRev = "v${version}";
+    mobyHash = "sha256-nBPw/M4VC9XeZ9S33HWdWSjY2J2mYpI/TPOzvLjSmJM=";
     runcRev = "v1.1.4";
-    runcSha256 = "sha256-ougJHW1Z+qZ324P8WpZqawY1QofKnn8WezP7orzRTdA=";
-    containerdRev = "v1.6.9";
-    containerdSha256 = "sha256-KvQdYQLzgt/MKPsA/mO5un6nE3/xcvVYwIveNn/uDnU=";
+    runcHash = "sha256-ougJHW1Z+qZ324P8WpZqawY1QofKnn8WezP7orzRTdA=";
+    containerdRev = "v1.6.15";
+    containerdHash = "sha256-Vlftq//mLYZPoT2R/lHJA6wLnqiuC+Cpy4lGQC8jCPA=";
     tiniRev = "v0.19.0";
-    tiniSha256 = "sha256-ZDKu/8yE5G0RYFJdhgmCdN3obJNyRWv6K/Gd17zc1sI=";
+    tiniHash = "sha256-ZDKu/8yE5G0RYFJdhgmCdN3obJNyRWv6K/Gd17zc1sI=";
   };
 }
diff --git a/pkgs/build-support/rust/build-rust-crate/configure-crate.nix b/pkgs/build-support/rust/build-rust-crate/configure-crate.nix
index 1c946764c7581..5168eb6ab7592 100644
--- a/pkgs/build-support/rust/build-rust-crate/configure-crate.nix
+++ b/pkgs/build-support/rust/build-rust-crate/configure-crate.nix
@@ -130,7 +130,7 @@ in ''
   export CARGO_CFG_UNIX=1
   export CARGO_CFG_TARGET_ENV="gnu"
   export CARGO_CFG_TARGET_ENDIAN=${if stdenv.hostPlatform.parsed.cpu.significantByte.name == "littleEndian" then "little" else "big"}
-  export CARGO_CFG_TARGET_POINTER_WIDTH=${toString stdenv.hostPlatform.parsed.cpu.bits}
+  export CARGO_CFG_TARGET_POINTER_WIDTH=${with stdenv.hostPlatform; toString (if isILP32 then 32 else parsed.cpu.bits)}
   export CARGO_CFG_TARGET_VENDOR=${stdenv.hostPlatform.parsed.vendor.name}
 
   export CARGO_MANIFEST_DIR=$(pwd)
diff --git a/pkgs/data/fonts/cozette/default.nix b/pkgs/data/fonts/cozette/default.nix
index 29ecabe9de2c3..35d24db563d1d 100644
--- a/pkgs/data/fonts/cozette/default.nix
+++ b/pkgs/data/fonts/cozette/default.nix
@@ -2,11 +2,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "cozette";
-  version = "1.13.0";
+  version = "1.19.0";
 
   src = fetchzip {
     url = "https://github.com/slavfox/Cozette/releases/download/v.${version}/CozetteFonts.zip";
-    hash = "sha256-bMgjNnm84vk7jT2UvgCeQwmjZ+9X1GzGLXIEukhaWGw=";
+    hash = "sha256-nlEnQjQJAFRvZgdGMiloMs4afugmSFnITTIHD+Qkggg=";
   };
 
   installPhase = ''
diff --git a/pkgs/data/fonts/roboto-serif/default.nix b/pkgs/data/fonts/roboto-serif/default.nix
new file mode 100644
index 0000000000000..d6cc1019ccd41
--- /dev/null
+++ b/pkgs/data/fonts/roboto-serif/default.nix
@@ -0,0 +1,42 @@
+{ lib
+, stdenvNoCC
+, fetchurl
+, unzip
+}:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "roboto-serif";
+  version = "1.007";
+
+  src = fetchurl {
+    url = "https://github.com/googlefonts/roboto-serif/releases/download/v${version}/RobotoSerifFonts-v${version}.zip";
+    hash = "sha256-A14GztkTvaLBvcm1i3A0Vi9vaz77nFYYoSNggqbffFo=";
+  };
+
+  sourceRoot = ".";
+
+  nativeBuildInputs = [
+    unzip
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm644 variable/*.ttf -t $out/share/fonts/truetype
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "The Roboto family of fonts";
+    longDescription = ''
+      Google’s signature family of fonts, the default font on Android and
+      Chrome OS, and the recommended font for Google’s visual language,
+      Material Design.
+    '';
+    homepage = "https://github.com/googlefonts/roboto-serif";
+    license = licenses.ofl;
+    maintainers = with maintainers; [ wegank ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/data/icons/numix-icon-theme-circle/default.nix b/pkgs/data/icons/numix-icon-theme-circle/default.nix
index ef69669ece5b2..f966f22b8285a 100644
--- a/pkgs/data/icons/numix-icon-theme-circle/default.nix
+++ b/pkgs/data/icons/numix-icon-theme-circle/default.nix
@@ -2,13 +2,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "numix-icon-theme-circle";
-  version = "23.01.25";
+  version = "23.01.29";
 
   src = fetchFromGitHub {
     owner = "numixproject";
     repo = pname;
     rev = version;
-    sha256 = "sha256-bejoClo31C2gO7Ni1cIxaumwDrhumRZgAPpxS1Jt/Fw=";
+    sha256 = "sha256-VmVzU8ACBE4Rx0uVScdQVbygDLE9MmD7ssD1j4ri74g=";
   };
 
   nativeBuildInputs = [ gtk3 ];
diff --git a/pkgs/data/icons/numix-icon-theme-square/default.nix b/pkgs/data/icons/numix-icon-theme-square/default.nix
index f82477c3d651d..b7074b8142393 100644
--- a/pkgs/data/icons/numix-icon-theme-square/default.nix
+++ b/pkgs/data/icons/numix-icon-theme-square/default.nix
@@ -2,13 +2,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "numix-icon-theme-square";
-  version = "23.01.25";
+  version = "23.01.29";
 
   src = fetchFromGitHub {
     owner = "numixproject";
     repo = pname;
     rev = version;
-    sha256 = "sha256-ZScDymdtrDTCrLB9Fp3zxBQt0A3qz0vN1OhBCK5K/HQ=";
+    sha256 = "sha256-uHy1HXCRlPQh9t9bsvClTmP4FW/sP91hYKUXxtdBmdw=";
   };
 
   nativeBuildInputs = [ gtk3 ];
diff --git a/pkgs/desktops/deepin/apps/deepin-terminal/default.nix b/pkgs/desktops/deepin/apps/deepin-terminal/default.nix
new file mode 100644
index 0000000000000..657b69e6d95a3
--- /dev/null
+++ b/pkgs/desktops/deepin/apps/deepin-terminal/default.nix
@@ -0,0 +1,76 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, fetchpatch
+, dtkwidget
+, qt5integration
+, qt5platform-plugins
+, dde-qt-dbus-factory
+, cmake
+, qtbase
+, qttools
+, qtx11extras
+, pkg-config
+, wrapQtAppsHook
+, at-spi2-core
+, libsecret
+, chrpath
+, lxqt
+, gtest
+}:
+
+stdenv.mkDerivation rec {
+  pname = "deepin-terminal";
+  version = "5.4.34";
+
+  src = fetchFromGitHub {
+    owner = "linuxdeepin";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-CpI7dyQwrYOYzqVZ6aa+/OAUC3xRyY4ZwzH1mqURTfY=";
+  };
+
+  patches = [
+    (fetchpatch {
+      name = "chore: use GNUInstallDirs in CmakeLists";
+      url = "https://github.com/linuxdeepin/deepin-terminal/commit/b18a2ca8411f09f5573aa2a8403a484b693ec975.patch";
+      sha256 = "sha256-Qy8Jg+7BfZr8tQEsCAzhMEwf6rU96gkgup5f9bMMELY=";
+    })
+  ];
+
+  cmakeFlags = [ "-DVERSION=${version}" ];
+
+  nativeBuildInputs = [
+    cmake
+    qttools
+    pkg-config
+    wrapQtAppsHook
+    lxqt.lxqt-build-tools
+  ];
+
+  buildInputs = [
+    dtkwidget
+    qt5platform-plugins
+    dde-qt-dbus-factory
+    qtx11extras
+    at-spi2-core
+    libsecret
+    chrpath
+    gtest
+  ];
+
+  strictDeps = true;
+
+  # qt5integration must be placed before qtsvg in QT_PLUGIN_PATH
+  qtWrapperArgs = [
+    "--prefix QT_PLUGIN_PATH : ${qt5integration}/${qtbase.qtPluginPrefix}"
+  ];
+
+  meta = with lib; {
+    description = "Terminal emulator with workspace, multiple windows, remote management, quake mode and other features";
+    homepage = "https://github.com/linuxdeepin/deepin-terminal";
+    license = licenses.gpl3Plus;
+    platforms = platforms.linux;
+    maintainers = teams.deepin.members;
+  };
+}
diff --git a/pkgs/desktops/deepin/artwork/dde-account-faces/default.nix b/pkgs/desktops/deepin/artwork/dde-account-faces/default.nix
new file mode 100644
index 0000000000000..91438a043c0a6
--- /dev/null
+++ b/pkgs/desktops/deepin/artwork/dde-account-faces/default.nix
@@ -0,0 +1,26 @@
+{ stdenvNoCC
+, lib
+, fetchFromGitHub
+}:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "dde-account-faces";
+  version = "1.0.12.1";
+
+  src = fetchFromGitHub {
+    owner = "linuxdeepin";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-NWjR8qxWi2IrcP0cSF+lLxBJ/GrVpk1BfTjVH0ytinY=";
+  };
+
+  makeFlags = [ "PREFIX=${placeholder "out"}/var" ];
+
+  meta = with lib; {
+    description = "Account faces of deepin desktop environment";
+    homepage = "https://github.com/linuxdeepin/dde-account-faces";
+    license = with licenses; [ gpl3Plus cc0 ];
+    platforms = platforms.linux;
+    maintainers = teams.deepin.members;
+  };
+}
diff --git a/pkgs/desktops/deepin/artwork/deepin-gtk-theme/default.nix b/pkgs/desktops/deepin/artwork/deepin-gtk-theme/default.nix
new file mode 100644
index 0000000000000..3864989196f39
--- /dev/null
+++ b/pkgs/desktops/deepin/artwork/deepin-gtk-theme/default.nix
@@ -0,0 +1,31 @@
+{ stdenvNoCC
+, lib
+, fetchFromGitHub
+, gtk-engine-murrine
+}:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "deepin-gtk-theme";
+  version = "unstable-2022-07-26";
+
+  src = fetchFromGitHub {
+    owner = "linuxdeepin";
+    repo = "deepin-gtk-theme";
+    rev = "5ac53cbdfba4e6804451605db726876a3be9fb07";
+    sha256 = "sha256-NJ5URKYs4rVzddXxkwJK9ih40f8McVEbj3G1tPFAiMs";
+  };
+
+  propagatedUserEnvPkgs = [
+    gtk-engine-murrine
+  ];
+
+  makeFlags = [ "PREFIX=${placeholder "out"}" ];
+
+  meta = with lib; {
+    description = "Deepin GTK Theme";
+    homepage = "https://github.com/linuxdeepin/deepin-gtk-theme";
+    license = licenses.gpl3Plus;
+    platforms = platforms.unix;
+    maintainers = teams.deepin.members;
+  };
+}
diff --git a/pkgs/desktops/deepin/artwork/deepin-icon-theme/default.nix b/pkgs/desktops/deepin/artwork/deepin-icon-theme/default.nix
new file mode 100644
index 0000000000000..0cda82fdfcf29
--- /dev/null
+++ b/pkgs/desktops/deepin/artwork/deepin-icon-theme/default.nix
@@ -0,0 +1,46 @@
+{ stdenvNoCC
+, lib
+, fetchFromGitHub
+, gtk3
+, xcursorgen
+, papirus-icon-theme
+}:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "deepin-icon-theme";
+  version = "2021.11.24";
+
+  src = fetchFromGitHub {
+    owner = "linuxdeepin";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-UC3PbqolcCbVrIEDqMovfJ4oeofMUGJag1A6u7X3Ml8=";
+  };
+
+  makeFlags = [ "PREFIX=${placeholder "out"}" ];
+
+  nativeBuildInputs = [
+    gtk3
+    xcursorgen
+  ];
+
+  propagatedBuildInputs = [
+    papirus-icon-theme
+  ];
+
+  dontDropIconThemeCache = true;
+
+  postFixup = ''
+    for theme in $out/share/icons/*; do
+      gtk-update-icon-cache $theme
+    done
+  '';
+
+  meta = with lib; {
+    description = "Deepin Icon Theme provides the base icon themes on Deepin";
+    homepage = "https://github.com/linuxdeepin/deepin-icon-theme";
+    license = licenses.gpl3Plus;
+    platforms = platforms.linux;
+    maintainers = teams.deepin.members;
+  };
+}
diff --git a/pkgs/desktops/deepin/artwork/deepin-sound-theme/default.nix b/pkgs/desktops/deepin/artwork/deepin-sound-theme/default.nix
new file mode 100644
index 0000000000000..f311339b6be01
--- /dev/null
+++ b/pkgs/desktops/deepin/artwork/deepin-sound-theme/default.nix
@@ -0,0 +1,26 @@
+{ stdenvNoCC
+, lib
+, fetchFromGitHub
+}:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "deepin-sound-theme";
+  version = "15.10.6";
+
+  src = fetchFromGitHub {
+    owner = "linuxdeepin";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-BvG/ygZfM6sDuDSzAqwCzDXGT/bbA6Srlpg3br117OU=";
+  };
+
+  makeFlags = [ "PREFIX=${placeholder "out"}" ];
+
+  meta = with lib; {
+    description = "The freedesktop sound theme for Deepin";
+    homepage = "https://github.com/linuxdeepin/deepin-sound-theme";
+    license = licenses.gpl3Plus;
+    platforms = platforms.linux;
+    maintainers = teams.deepin.members;
+  };
+}
diff --git a/pkgs/desktops/deepin/default.nix b/pkgs/desktops/deepin/default.nix
index 037cfaa3f33d1..69f6afff8ee06 100644
--- a/pkgs/desktops/deepin/default.nix
+++ b/pkgs/desktops/deepin/default.nix
@@ -22,6 +22,13 @@ let
 
     #### Dtk Application
     deepin-calculator = callPackage ./apps/deepin-calculator { };
+    deepin-terminal = callPackage ./apps/deepin-terminal { };
+
+    #### ARTWORK
+    dde-account-faces = callPackage ./artwork/dde-account-faces { };
+    deepin-icon-theme = callPackage ./artwork/deepin-icon-theme { };
+    deepin-gtk-theme = callPackage ./artwork/deepin-gtk-theme { };
+    deepin-sound-theme = callPackage ./artwork/deepin-sound-theme { };
   };
 in
 lib.makeScope libsForQt5.newScope packages
diff --git a/pkgs/desktops/pantheon/third-party/pantheon-tweaks/default.nix b/pkgs/desktops/pantheon/third-party/pantheon-tweaks/default.nix
index d0ee4a0d1c766..a140d9cdcb0eb 100644
--- a/pkgs/desktops/pantheon/third-party/pantheon-tweaks/default.nix
+++ b/pkgs/desktops/pantheon/third-party/pantheon-tweaks/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pantheon-tweaks";
-  version = "1.0.4";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "pantheon-tweaks";
     repo = pname;
     rev = version;
-    sha256 = "sha256-L/3PrkfWOGYtqeH/DajGEGCsF5yYnWuESxUTfROSHQ4=";
+    sha256 = "sha256-wj9bvcES8JAgDtW0Damfd8VQNLK+SCFTDVWp/nYGcgI=";
   };
 
   patches = [
diff --git a/pkgs/desktops/xfce/applications/xfce4-taskmanager/default.nix b/pkgs/desktops/xfce/applications/xfce4-taskmanager/default.nix
index 9bbc524eab0f4..4eb6786ffddc1 100644
--- a/pkgs/desktops/xfce/applications/xfce4-taskmanager/default.nix
+++ b/pkgs/desktops/xfce/applications/xfce4-taskmanager/default.nix
@@ -1,14 +1,32 @@
-{ lib, mkXfceDerivation, exo, gtk3, libxfce4ui, xfconf, libwnck, libXmu }:
+{ lib
+, mkXfceDerivation
+, exo
+, gtk3
+, libxfce4ui
+, xfconf
+, libwnck
+, libXmu
+}:
 
 mkXfceDerivation {
   category = "apps";
   pname = "xfce4-taskmanager";
   version = "1.5.5";
+  odd-unstable = false;
 
   sha256 = "sha256-worHYB9qibRxMaCYQ0+nHA9CSTColewgahyrXiPOnQA=";
 
-  nativeBuildInputs = [ exo ];
-  buildInputs = [ gtk3 libxfce4ui xfconf libwnck libXmu ];
+  nativeBuildInputs = [
+    exo
+  ];
+
+  buildInputs = [
+    gtk3
+    libxfce4ui
+    xfconf
+    libwnck
+    libXmu
+  ];
 
   meta = with lib; {
     description = "Easy to use task manager for Xfce";
diff --git a/pkgs/desktops/xfce/core/libxfce4util/default.nix b/pkgs/desktops/xfce/core/libxfce4util/default.nix
index a2bdee37eb695..efc917ab1f282 100644
--- a/pkgs/desktops/xfce/core/libxfce4util/default.nix
+++ b/pkgs/desktops/xfce/core/libxfce4util/default.nix
@@ -3,9 +3,9 @@
 mkXfceDerivation {
   category = "xfce";
   pname = "libxfce4util";
-  version = "4.18.0";
+  version = "4.18.1";
 
-  sha256 = "sha256-m4O/vTFqzkF6rzyGVw8xdwcX7S/SyOSJo8aCZjniXAw=";
+  sha256 = "sha256-nqASXyHR7wNiNPorlz2ix+Otyir6I9KCCr1vfS6GO8E=";
 
   nativeBuildInputs = [ gobject-introspection vala ];
 
diff --git a/pkgs/desktops/xfce/core/thunar/default.nix b/pkgs/desktops/xfce/core/thunar/default.nix
index c64a696031865..f4dfebb422f79 100644
--- a/pkgs/desktops/xfce/core/thunar/default.nix
+++ b/pkgs/desktops/xfce/core/thunar/default.nix
@@ -21,9 +21,9 @@
 let unwrapped = mkXfceDerivation {
   category = "xfce";
   pname = "thunar";
-  version = "4.18.1";
+  version = "4.18.3";
 
-  sha256 = "sha256-n624TZGygFrOjkQ9fUVJUetRV8JDXYSg89tOHm4Va+M=";
+  sha256 = "sha256-sYn1gBzqEFcB3jHWxmoqqv0Cxa3mui/j0kgBqJMgJrc=";
 
   nativeBuildInputs = [
     docbook_xsl
diff --git a/pkgs/desktops/xfce/core/xfce4-panel/default.nix b/pkgs/desktops/xfce/core/xfce4-panel/default.nix
index d76523a94c3cd..155e3124207cf 100644
--- a/pkgs/desktops/xfce/core/xfce4-panel/default.nix
+++ b/pkgs/desktops/xfce/core/xfce4-panel/default.nix
@@ -2,7 +2,6 @@
 , mkXfceDerivation
 , exo
 , garcon
-, glib
 , gobject-introspection
 , gtk3
 , libdbusmenu-gtk3
@@ -17,9 +16,9 @@
 mkXfceDerivation {
   category = "xfce";
   pname = "xfce4-panel";
-  version = "4.18.0";
+  version = "4.18.1";
 
-  sha256 = "sha256-CnZk0Ca3IG6nmiwe7eIvPqpzJgRZHIyqeoTA5cPpU7s=";
+  sha256 = "sha256-5GJO8buOTnRGnm3+kesrZjTprCY1qiyookpW6dzI2AE=";
 
   nativeBuildInputs = [
     gobject-introspection
@@ -37,7 +36,6 @@ mkXfceDerivation {
   ];
 
   propagatedBuildInputs = [
-    glib
     gtk3
     libxfce4util
   ];
@@ -49,9 +47,6 @@ mkXfceDerivation {
        --replace "/usr/share/zoneinfo" "${tzdata}/share/zoneinfo"
   '';
 
-  # Workaround https://bugzilla.xfce.org/show_bug.cgi?id=15825
-  NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
-
   meta = with lib; {
     description = "Panel for the Xfce desktop environment";
     maintainers = with maintainers; [ ] ++ teams.xfce.members;
diff --git a/pkgs/desktops/xfce/core/xfdesktop/default.nix b/pkgs/desktops/xfce/core/xfdesktop/default.nix
index 7d67741657992..ed36d2b92b737 100644
--- a/pkgs/desktops/xfce/core/xfdesktop/default.nix
+++ b/pkgs/desktops/xfce/core/xfdesktop/default.nix
@@ -3,9 +3,9 @@
 mkXfceDerivation {
   category = "xfce";
   pname = "xfdesktop";
-  version = "4.18.0";
+  version = "4.18.1";
 
-  sha256 = "sha256-HZVu5UVLKDCWaUpw1SV8E0JLGRG946w4QLlA51rg/Bo=";
+  sha256 = "sha256-33G7X5kA3MCNJ9Aq9ZCafP0Qm/46iUmLFB8clhKwDz8=";
 
   buildInputs = [
     exo
diff --git a/pkgs/desktops/xfce/panel-plugins/xfce4-datetime-plugin/default.nix b/pkgs/desktops/xfce/panel-plugins/xfce4-datetime-plugin/default.nix
index 5202f7f54c245..eaf090c348cff 100644
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-datetime-plugin/default.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-datetime-plugin/default.nix
@@ -9,10 +9,10 @@
 mkXfceDerivation {
   category = "panel-plugins";
   pname = "xfce4-datetime-plugin";
-  version = "0.8.2";
+  version = "0.8.3";
 
   rev-prefix = "xfce4-datetime-plugin-";
-  sha256 = "sha256-ov4Wh9Pj01u0NrjDn5p+qXlD2LY3gEUC1e/jPjkn4xQ=";
+  sha256 = "sha256-dpN5ZN7VjgO1GQ6v8NXuBKACyIwIosaiVGtmLEb6auI=";
 
   nativeBuildInputs = [
     gettext
diff --git a/pkgs/desktops/xfce/panel-plugins/xfce4-whiskermenu-plugin/default.nix b/pkgs/desktops/xfce/panel-plugins/xfce4-whiskermenu-plugin/default.nix
index 0dc3d3a81aa60..a1027c752ddd3 100644
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-whiskermenu-plugin/default.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-whiskermenu-plugin/default.nix
@@ -3,10 +3,10 @@
 mkXfceDerivation {
   category = "panel-plugins";
   pname = "xfce4-whiskermenu-plugin";
-  version = "2.7.1";
+  version = "2.7.2";
   rev-prefix = "v";
   odd-unstable = false;
-  sha256 = "sha256-aN8PwH5YIbjiyS5tTcU2AU4LAYC2tBStDxhCXi/dvkQ=";
+  sha256 = "sha256-yp8NpBVgqEv34qmDMKPdy53awgSLtYfeaw1JrxENFps=";
 
   nativeBuildInputs = [ cmake ];
 
diff --git a/pkgs/development/compilers/gcc/common/configure-flags.nix b/pkgs/development/compilers/gcc/common/configure-flags.nix
index c9e9b00f60ed1..25e59148440a0 100644
--- a/pkgs/development/compilers/gcc/common/configure-flags.nix
+++ b/pkgs/development/compilers/gcc/common/configure-flags.nix
@@ -119,7 +119,7 @@ let
       #  or ${with_sysroot}${native_system_header_dir}
       # While native build (build == host == target) uses passed headers
       # path as is:
-      #    ${native_system_header_dir}
+      #    ${with_build_sysroot}${native_system_header_dir}
       #
       # Nixpkgs uses flat directory structure for both native and cross
       # cases. As a result libc headers don't get found for cross case
diff --git a/pkgs/development/compilers/zig/0.10.nix b/pkgs/development/compilers/zig/0.10.nix
new file mode 100644
index 0000000000000..89f23b9ca25d5
--- /dev/null
+++ b/pkgs/development/compilers/zig/0.10.nix
@@ -0,0 +1,69 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, coreutils
+, llvmPackages
+, libxml2
+, zlib
+}:
+
+stdenv.mkDerivation rec {
+  pname = "zig";
+  version = "0.10.1";
+
+  src = fetchFromGitHub {
+    owner = "ziglang";
+    repo = pname;
+    rev = version;
+    hash = "sha256-69QIkkKzApOGfrBdgtmxFMDytRkSh+0YiaJQPbXsBeo=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    llvmPackages.llvm.dev
+  ];
+
+  buildInputs = [
+    coreutils
+    libxml2
+    zlib
+  ] ++ (with llvmPackages; [
+    libclang
+    lld
+    llvm
+  ]);
+
+  preBuild = ''
+    export HOME=$TMPDIR;
+  '';
+
+  postPatch = ''
+    # Zig's build looks at /usr/bin/env to find dynamic linking info. This
+    # doesn't work in Nix' sandbox. Use env from our coreutils instead.
+    substituteInPlace lib/std/zig/system/NativeTargetInfo.zig --replace "/usr/bin/env" "${coreutils}/bin/env"
+  '';
+
+  cmakeFlags = [
+    # file RPATH_CHANGE could not write new RPATH
+    "-DCMAKE_SKIP_BUILD_RPATH=ON"
+  ];
+
+  doCheck = true;
+  installCheckPhase = ''
+    $out/bin/zig test --cache-dir "$TMPDIR" -I $src/test $src/test/behavior.zig
+  '';
+
+  meta = with lib; {
+    homepage = "https://ziglang.org/";
+    description =
+      "General-purpose programming language and toolchain for maintaining robust, optimal, and reusable software";
+    license = licenses.mit;
+    maintainers = with maintainers; [ aiotter andrewrk AndersonTorres ];
+    platforms = platforms.unix;
+    # Build fails on Darwin on both AArch64 and x86_64:
+    # https://github.com/NixOS/nixpkgs/pull/210324#issuecomment-1381313616
+    # https://github.com/NixOS/nixpkgs/pull/210324#issuecomment-1381236045
+    broken = stdenv.isDarwin;
+  };
+}
diff --git a/pkgs/development/compilers/zig/default.nix b/pkgs/development/compilers/zig/0.9.1.nix
similarity index 100%
rename from pkgs/development/compilers/zig/default.nix
rename to pkgs/development/compilers/zig/0.9.1.nix
diff --git a/pkgs/development/coq-modules/equations/default.nix b/pkgs/development/coq-modules/equations/default.nix
index 5f38c4bbae24c..b574f4c9fb209 100644
--- a/pkgs/development/coq-modules/equations/default.nix
+++ b/pkgs/development/coq-modules/equations/default.nix
@@ -6,6 +6,7 @@
   repo = "Coq-Equations";
   inherit version;
   defaultVersion = lib.switch coq.coq-version [
+    { case = "8.17"; out = "1.3+8.17"; }
     { case = "8.16"; out = "1.3+8.16"; }
     { case = "8.15"; out = "1.3+8.15"; }
     { case = "8.14"; out = "1.3+8.14"; }
@@ -54,6 +55,8 @@
     release."1.3+8.15".sha256         = "1vfcfpsp9zyj0sw0cwibk76nj6n0r6gwh8m1aa3lbvc0b1kbm32k";
     release."1.3+8.16".rev            = "v1.3-8.16";
     release."1.3+8.16".sha256         = "sha256-zyMGeRObtSGWh7n3WCqesBZL5EgLvKwmnTy09rYpxyE=";
+    release."1.3+8.17".rev            = "v1.3-8.17";
+    release."1.3+8.17".sha256         = "sha256-yNotSIxFkhTg3reZIchGQ7cV9WmTJ7p7hPfKGBiByDw=";
 
   mlPlugin = true;
 
diff --git a/pkgs/development/interpreters/erlang/R25.nix b/pkgs/development/interpreters/erlang/R25.nix
index d6dc77c3da69c..b2ad0846cd681 100644
--- a/pkgs/development/interpreters/erlang/R25.nix
+++ b/pkgs/development/interpreters/erlang/R25.nix
@@ -1,6 +1,6 @@
 { mkDerivation }:
 
 mkDerivation {
-  version = "25.2.1";
-  sha256 = "xJ3fadveOFZ0TeHhjl3VnAtWyFTOVUIoFubXofvrsT0=";
+  version = "25.2.2";
+  sha256 = "HfEh2IhifFe/gQ4sK99uBnmUGvNCeJ2mlTQf7IzenEs=";
 }
diff --git a/pkgs/development/interpreters/wasmer/default.nix b/pkgs/development/interpreters/wasmer/default.nix
index b6bb4c16634f2..5666b078b4c32 100644
--- a/pkgs/development/interpreters/wasmer/default.nix
+++ b/pkgs/development/interpreters/wasmer/default.nix
@@ -14,16 +14,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "wasmer";
-  version = "3.1.0";
+  version = "3.1.1";
 
   src = fetchFromGitHub {
     owner = "wasmerio";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-t/ObsvUSNGFvHkVH2nl8vLFI+5GUQx6niCgeH4ykk/0=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-797I3FBBfnAgNfOdMajm3WNkMo3MUXb1347LBggXrLk=";
   };
 
-  cargoSha256 = "sha256-75/0D0lrV50wH51Ll7M1Lvqj2kRSaJXiQWElxCaF9mE=";
+  cargoHash = "sha256-zUTwhfRLKUixgj3JXiz2QOuwbFhfget+GcFSRL1QJ3w=";
 
   nativeBuildInputs = [ rustPlatform.bindgenHook ];
 
diff --git a/pkgs/development/libraries/cmark-gfm/default.nix b/pkgs/development/libraries/cmark-gfm/default.nix
index 30f018bc0dfaf..b88766952ee1e 100644
--- a/pkgs/development/libraries/cmark-gfm/default.nix
+++ b/pkgs/development/libraries/cmark-gfm/default.nix
@@ -1,13 +1,13 @@
 { lib, stdenv, fetchFromGitHub, cmake }:
 stdenv.mkDerivation rec {
   pname = "cmark-gfm";
-  version = "0.29.0.gfm.8";
+  version = "0.29.0.gfm.9";
 
   src = fetchFromGitHub {
     owner = "github";
     repo = "cmark-gfm";
     rev = version;
-    sha256 = "sha256-i+y1VORza6pn8a/AfbBKpov/n0ChR9++RC7E8P9p3MY=";
+    sha256 = "sha256-goQtLaiLCyEqVItPfH3e/pFroQWZuVT5oxLs1/GwdoU=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/dqlite/default.nix b/pkgs/development/libraries/dqlite/default.nix
index 331fe93e90dee..cb7b7466d0539 100644
--- a/pkgs/development/libraries/dqlite/default.nix
+++ b/pkgs/development/libraries/dqlite/default.nix
@@ -1,15 +1,15 @@
 { lib, stdenv, fetchFromGitHub, autoreconfHook, pkg-config, file, libuv
-, raft-canonical, sqlite }:
+, raft-canonical, sqlite, lxd }:
 
 stdenv.mkDerivation rec {
   pname = "dqlite";
-  version = "1.13.0";
+  version = "1.14.0";
 
   src = fetchFromGitHub {
     owner = "canonical";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-KVQa11gw/8h3Be+52V44W2M+fd7sB35emrS/aUEUGl0=";
+    hash = "sha256-x76f9Sw3BMgWSY7DLIqDjbggp/qVu8mJBtf4znTz9hA=";
   };
 
   nativeBuildInputs = [ autoreconfHook file pkg-config ];
@@ -26,6 +26,10 @@ stdenv.mkDerivation rec {
 
   outputs = [ "dev" "out" ];
 
+  passthru.tests = {
+    inherit lxd;
+  };
+
   meta = with lib; {
     description = ''
       Expose a SQLite database over the network and replicate it across a
diff --git a/pkgs/development/libraries/gdcm/default.nix b/pkgs/development/libraries/gdcm/default.nix
index d2182154f7118..d21fd25019604 100644
--- a/pkgs/development/libraries/gdcm/default.nix
+++ b/pkgs/development/libraries/gdcm/default.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gdcm";
-  version = "3.0.20";
+  version = "3.0.21";
 
   src = fetchFromGitHub {
     owner = "malaterre";
     repo = "GDCM";
     rev = "v${version}";
-    sha256 = "sha256-MaQk2VlaZxZPNzVF9pUnEzMaXyN0tq2P3kodnGpl6PA=";
+    sha256 = "sha256-BmUJCqCGt+BvVpLG4bzCH4lsqmhWHU0gbOIU2CCIMGU=";
   };
 
   cmakeFlags = [
diff --git a/pkgs/development/libraries/goffice/default.nix b/pkgs/development/libraries/goffice/default.nix
index 9e2585d7ee036..1bd0d69ea6d77 100644
--- a/pkgs/development/libraries/goffice/default.nix
+++ b/pkgs/development/libraries/goffice/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "goffice";
-  version = "0.10.53";
+  version = "0.10.54";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "J/1YeW+qHNTMASDDTqhTFaCJHscfVbxnk8FOzxaKP1c=";
+    sha256 = "WDXNnVPmT3UmLAOZZu/fTYj0Vvyx8IeM5NEIgqUK1aA=";
   };
 
   nativeBuildInputs = [ pkg-config intltool ];
diff --git a/pkgs/development/libraries/jellyfin-ffmpeg/default.nix b/pkgs/development/libraries/jellyfin-ffmpeg/default.nix
index c461e168b20ca..537ab60fda1c5 100644
--- a/pkgs/development/libraries/jellyfin-ffmpeg/default.nix
+++ b/pkgs/development/libraries/jellyfin-ffmpeg/default.nix
@@ -9,13 +9,13 @@
   nv-codec-headers = nv-codec-headers-11;
 }).overrideAttrs (old: rec {
   pname = "jellyfin-ffmpeg";
-  version = "5.1.2-6";
+  version = "5.1.2-7";
 
   src = fetchFromGitHub {
     owner = "jellyfin";
     repo = "jellyfin-ffmpeg";
     rev = "v${version}";
-    sha256 = "sha256-YPw29cnScchL4Y2CEatUjzqUW/U9kOdi29Dr577Qy5A=";
+    sha256 = "sha256-OWSixz1QjWthykO55wMAlywe2ihFLugzLH1qg4Qbe3I=";
   };
 
   buildInputs = old.buildInputs ++ [ chromaprint ];
diff --git a/pkgs/development/libraries/libffcall/default.nix b/pkgs/development/libraries/libffcall/default.nix
index 3f2398e19de7e..07de21a4120cc 100644
--- a/pkgs/development/libraries/libffcall/default.nix
+++ b/pkgs/development/libraries/libffcall/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libffcall";
-  version = "2.2";
+  version = "2.4";
 
   src = fetchurl {
     url = "mirror://gnu/libffcall/libffcall-${version}.tar.gz";
-    sha256 = "sha256-6/o3+XtslPrCTs8xk/n8gpUXz4Gu6awtGRr5k9c8t0c=";
+    sha256 = "sha256-jvaZIdvcBrxbuQUTYiY3p7g6cfMfW6N3vp2P2PV5EsI=";
   };
 
   enableParallelBuilding = false;
diff --git a/pkgs/development/libraries/live555/default.nix b/pkgs/development/libraries/live555/default.nix
index 7ceb70bb8bcd4..1e6311692a055 100644
--- a/pkgs/development/libraries/live555/default.nix
+++ b/pkgs/development/libraries/live555/default.nix
@@ -10,7 +10,7 @@
 
 stdenv.mkDerivation rec {
   pname = "live555";
-  version = "2022.12.01";
+  version = "2023.01.19";
 
   src = fetchurl {
     urls = [
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
       "https://download.videolan.org/contrib/live555/live.${version}.tar.gz"
       "mirror://sourceforge/slackbuildsdirectlinks/live.${version}.tar.gz"
     ];
-    sha256 = "sha256-BXwdPcJMJrM+FMTcNZKIWt8iBAOh4SVeihAeIzxpwQg=";
+    sha256 = "sha256-p8ZJE/f3AHxf3CnqgR48p4HyYicbPkKv3UvBBB2G+pk=";
   };
 
   nativeBuildInputs = lib.optional stdenv.isDarwin darwin.cctools;
diff --git a/pkgs/development/libraries/openmpi/default.nix b/pkgs/development/libraries/openmpi/default.nix
index 51194a36798f0..1a9a5deb0d9aa 100644
--- a/pkgs/development/libraries/openmpi/default.nix
+++ b/pkgs/development/libraries/openmpi/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, gfortran, perl, libnl
+{ lib, stdenv, fetchurl, fetchpatch, gfortran, perl, libnl
 , rdma-core, zlib, numactl, libevent, hwloc, targetPackages, symlinkJoin
 , libpsm2, libfabric, pmix, ucx
 
@@ -32,6 +32,14 @@ in stdenv.mkDerivation rec {
     sha256 = "03ckngrff1cl0l81vfvrfhp99rbgk7s0633kr1l468yibwbjx4cj";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "RDMA-osc-perform-CAS-in-shared-memory-if-possible.patch";
+      url = "https://github.com/open-mpi/ompi/pull/10513/commits/0512c135a77a0278e5288e0e119dce24c95ebed4.patch";
+      sha256 = "sha256-K1Gc+hBUkTPY1WqLP6JWo623EUhkoL4ONrqPVDNfFuE=";
+    })
+  ];
+
   postPatch = ''
     patchShebangs ./
 
diff --git a/pkgs/development/libraries/pinocchio/default.nix b/pkgs/development/libraries/pinocchio/default.nix
index 4cf69bb795b14..df42dea81a5c4 100644
--- a/pkgs/development/libraries/pinocchio/default.nix
+++ b/pkgs/development/libraries/pinocchio/default.nix
@@ -11,14 +11,14 @@
 
 stdenv.mkDerivation rec {
   pname = "pinocchio";
-  version = "2.6.14";
+  version = "2.6.15";
 
   src = fetchFromGitHub {
     owner = "stack-of-tasks";
     repo = pname;
     rev = "v${version}";
     fetchSubmodules = true;
-    sha256 = "sha256-3dPGeWnIVIErLnd+mxwudTj4qHyN2k7H94EsHYmKV1I=";
+    hash = "sha256-bnm5nbb0mKw76k2J2Qi04n7bmfzadtqV/AmnWSzbb+0=";
   };
 
   # error: use of undeclared identifier '__sincos'
diff --git a/pkgs/development/libraries/raft-canonical/default.nix b/pkgs/development/libraries/raft-canonical/default.nix
index 0fc885033e64e..e2dd81b13877c 100644
--- a/pkgs/development/libraries/raft-canonical/default.nix
+++ b/pkgs/development/libraries/raft-canonical/default.nix
@@ -1,14 +1,14 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, pkg-config, file, libuv, lz4 }:
+{ lib, stdenv, fetchFromGitHub, autoreconfHook, pkg-config, file, libuv, lz4, lxd }:
 
 stdenv.mkDerivation rec {
   pname = "raft-canonical";
-  version = "0.16.0";
+  version = "0.17.1";
 
   src = fetchFromGitHub {
     owner = "canonical";
     repo = "raft";
     rev = "refs/tags/v${version}";
-    hash = "sha256-qDLAEhknY+BB83OC6tfi7w/ZY/K492J5ZglLNUoBwbc=";
+    hash = "sha256-P6IYl6xcsqXw1ilt6HYw757FL2syy1XePBVGbPAlz6Q=";
   };
 
   nativeBuildInputs = [ autoreconfHook file pkg-config ];
@@ -32,6 +32,10 @@ stdenv.mkDerivation rec {
 
   outputs = [ "dev" "out" ];
 
+  passthru.tests = {
+    inherit lxd;
+  };
+
   meta = with lib; {
     description = ''
       Fully asynchronous C implementation of the Raft consensus protocol
diff --git a/pkgs/development/libraries/umockdev/default.nix b/pkgs/development/libraries/umockdev/default.nix
index da2ba16dedc1e..6b7f58bcd6daa 100644
--- a/pkgs/development/libraries/umockdev/default.nix
+++ b/pkgs/development/libraries/umockdev/default.nix
@@ -20,13 +20,13 @@
 
 stdenv.mkDerivation rec {
   pname = "umockdev";
-  version = "0.17.15";
+  version = "0.17.16";
 
   outputs = [ "bin" "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "https://github.com/martinpitt/umockdev/releases/download/${version}/${pname}-${version}.tar.xz";
-    sha256 = "7UGO4rv7B4H0skuXKe8nCtg83czWaln/lEsFnvE2j+8=";
+    sha256 = "sha256-T0BbjOkhn4EX2GBezYFbiUHNgp2uEbSiaxpJ/36jriY=";
   };
 
   patches = [
diff --git a/pkgs/development/ocaml-modules/ocaml-r/default.nix b/pkgs/development/ocaml-modules/ocaml-r/default.nix
index fd628e7651c72..8de5abf7e4814 100644
--- a/pkgs/development/ocaml-modules/ocaml-r/default.nix
+++ b/pkgs/development/ocaml-modules/ocaml-r/default.nix
@@ -1,44 +1,37 @@
-{ lib, fetchFromGitHub, buildDunePackage, pkg-config, dune-configurator, stdio, R
+{ lib, fetchFromGitHub, fetchpatch, buildDunePackage, pkg-config, dune-configurator, stdio, R
 , alcotest
 }:
 
 buildDunePackage rec {
   pname = "ocaml-r";
-  version = "0.4.0";
+  version = "0.6.0";
 
-  useDune2 = true;
+  duneVersion = "3";
 
-  minimumOCamlVersion = "4.08";
+  minimalOCamlVersion = "4.08";
 
   src = fetchFromGitHub {
     owner = "pveber";
     repo = pname;
     rev = "v${version}";
-    sha256 = "10is2s148kfh3g0pwniyzp5mh48k57ldvn8gm86469zvgxyij1ri";
+    sha256 = "sha256-jPyVMxjeh9+xu0dD1gelAxcOhxouKczyvzVoKZ5oSrs=";
   };
 
-  # Without the following patch, stub generation fails with:
-  # > Fatal error: exception (Failure "not supported: osVersion")
-  preConfigure = ''
-    substituteInPlace stubgen/stubgen.ml --replace  \
-    'failwithf "not supported: %s" name ()' \
-    'sprintf "(* not supported: %s *)" name'
-    substituteInPlace lib/config/discover.ml --replace \
-    ' libRmath"' '"'
-  '';
-
-  # This currently fails with dune
-  strictDeps = false;
+  # Finds R and Rmathlib separatley
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/pveber/ocaml-r/commit/aa96dc5.patch";
+      sha256 = "sha256-xW33W2ciesyUkDKEH08yfOXv0wP0V6X80or2/n2Nrb4=";
+    })
+  ];
 
   nativeBuildInputs = [ pkg-config R ];
   buildInputs = [ dune-configurator stdio R ];
 
   doCheck = true;
-  nativeCheckInputs = [ alcotest ];
+  checkInputs = [ alcotest ];
 
   meta = {
-    # This has been broken by the update to R 4.2.0 (#171597)
-    broken = true;
     description = "OCaml bindings for the R interpreter";
     inherit (src.meta) homepage;
     license = lib.licenses.gpl3;
diff --git a/pkgs/development/python-modules/ailment/default.nix b/pkgs/development/python-modules/ailment/default.nix
index d5ec32348e754..2e878b014cc24 100644
--- a/pkgs/development/python-modules/ailment/default.nix
+++ b/pkgs/development/python-modules/ailment/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "ailment";
-  version = "9.2.35";
+  version = "9.2.36";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-t4t9TATmskvi/Qr9Eje7l+tRiKa+NiwI+KVYqEiSNgo=";
+    hash = "sha256-PEX2SanglMqjtJHuH+gA5dnikh7qqLFiXbmrcIzs1+A=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/airtouch4pyapi/default.nix b/pkgs/development/python-modules/airtouch4pyapi/default.nix
index 1c567181f9b48..de19c59653644 100644
--- a/pkgs/development/python-modules/airtouch4pyapi/default.nix
+++ b/pkgs/development/python-modules/airtouch4pyapi/default.nix
@@ -1,14 +1,13 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, fetchpatch
 , numpy
 , pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "airtouch4pyapi";
-  version = "1.0.5";
+  version = "1.0.8";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -16,19 +15,10 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "LonePurpleWolf";
     repo = pname;
-    # https://github.com/LonePurpleWolf/airtouch4pyapi/issues/5
-    rev = "34783888846783c058fe79cec16feda45504f701";
-    sha256 = "17c7fm72p085pg9msvsfdggbskvm12a6jlb5bw1cndrqsqcrxywx";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-RiRwebumidn0nijL/e9J74ZYx0DASi1up5BTNxYoGEA=";
   };
 
-  patches = [
-    # https://github.com/LonePurpleWolf/airtouch4pyapi/pull/10
-    (fetchpatch {
-      url = "https://github.com/LonePurpleWolf/airtouch4pyapi/commit/5b5d91fad63495c83422e7a850897946ac95b25d.patch";
-      hash = "sha256-tVlCLXuOJSqjbs0jj0iHCIXWZE8wmMV3ChzmE6uq3SM=";
-    })
-  ];
-
   propagatedBuildInputs = [
     numpy
   ];
diff --git a/pkgs/development/python-modules/amaranth/default.nix b/pkgs/development/python-modules/amaranth/default.nix
index 0cb078f0f7ecd..3e7aae7f3daac 100644
--- a/pkgs/development/python-modules/amaranth/default.nix
+++ b/pkgs/development/python-modules/amaranth/default.nix
@@ -47,6 +47,11 @@ buildPythonPackage rec {
       url = "https://github.com/amaranth-lang/amaranth/pull/722/commits/e5a56b07c568e5f4cc2603eefebd14c5cc4e13d8.patch";
       hash = "sha256-C8FyMSKHA7XsEMpO9eYNZx/X5rGaK7p3eXP+jSb6wVg=";
     })
+    (fetchpatch {
+      name = "add-python-3.11-support.patch";
+      url = "https://github.com/amaranth-lang/amaranth/commit/851546bf2d16db62663d7002bece51f07078d0a5.patch";
+      hash = "sha256-eetlFCLqmpCfTKViD16OScJbkql1yhdi5uJGnfnpcCE=";
+    })
   ];
 
   SETUPTOOLS_SCM_PRETEND_VERSION="${realVersion}";
diff --git a/pkgs/development/python-modules/angr/default.nix b/pkgs/development/python-modules/angr/default.nix
index c8b80357ca774..4abcad0e7c9ba 100644
--- a/pkgs/development/python-modules/angr/default.nix
+++ b/pkgs/development/python-modules/angr/default.nix
@@ -31,7 +31,7 @@
 
 buildPythonPackage rec {
   pname = "angr";
-  version = "9.2.35";
+  version = "9.2.36";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -40,7 +40,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-zJ3dURT2T44Nl0KPSw8bTeJO33siBLAOu/lXGaQeEdQ=";
+    hash = "sha256-KVIrhzd3EoDIVImshfjZrBAiNkCtlFAd6Ox9ATsvPTY=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/ansible/core.nix b/pkgs/development/python-modules/ansible/core.nix
index b4d09d38f8873..8f8e98ca64966 100644
--- a/pkgs/development/python-modules/ansible/core.nix
+++ b/pkgs/development/python-modules/ansible/core.nix
@@ -24,11 +24,11 @@
 
 buildPythonPackage rec {
   pname = "ansible-core";
-  version = "2.14.0";
+  version = "2.14.2";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-+ki0gctiO/ebuQPyIwl2gaDBPhtOx+eOfdfYWNNqNLI=";
+    hash = "sha256-R/DUtBJbWO26ZDWkfzfL5qGNpUWU0Y+BKVi7DLWNTmU=";
   };
 
   # ansible_connection is already wrapped, so don't pass it through
diff --git a/pkgs/development/python-modules/apycula/default.nix b/pkgs/development/python-modules/apycula/default.nix
index 4347fd925dc16..894a30c7c606e 100644
--- a/pkgs/development/python-modules/apycula/default.nix
+++ b/pkgs/development/python-modules/apycula/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "apycula";
-  version = "0.6.1";
+  version = "0.6.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     inherit version;
     pname = "Apycula";
-    hash = "sha256-/XQ/Q4/LzCBDaTindbBENOh5OSIH2JPLyiYFWT9DcP4=";
+    hash = "sha256-WnxH/AKi7j2u1SWVtyggUD09OqXfOST1Ayr9DrbYMcQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/arcam-fmj/default.nix b/pkgs/development/python-modules/arcam-fmj/default.nix
index 2310ef1e6df90..c441265377949 100644
--- a/pkgs/development/python-modules/arcam-fmj/default.nix
+++ b/pkgs/development/python-modules/arcam-fmj/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "arcam-fmj";
-  version = "1.0.1";
+  version = "1.1.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "elupus";
     repo = "arcam_fmj";
     rev = "refs/tags/${version}";
-    hash = "sha256-Lmz701qdqFlXro279AdNx+P1o3Q/Om63jKvy854ogto=";
+    hash = "sha256-oXMoDpb4tg4iYAanTfPzeFp/IQl4bIELCTdM24hM84A=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/archinfo/default.nix b/pkgs/development/python-modules/archinfo/default.nix
index b2824ed9ae7e0..22a460cc27410 100644
--- a/pkgs/development/python-modules/archinfo/default.nix
+++ b/pkgs/development/python-modules/archinfo/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "archinfo";
-  version = "9.2.35";
+  version = "9.2.36";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-/GGchV+B/1gleZM0mW8vVk/9Uwf1zYH0B7HwziAla6w=";
+    hash = "sha256-anZsvDIH1AWaFUG5UTuyQiOKeoUB/+MSbu5pjPZJxag=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/asyncmy/default.nix b/pkgs/development/python-modules/asyncmy/default.nix
index b81c4d2c6968b..7e3129b726c14 100644
--- a/pkgs/development/python-modules/asyncmy/default.nix
+++ b/pkgs/development/python-modules/asyncmy/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "asyncmy";
-  version = "0.2.5";
+  version = "0.2.6";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -17,8 +17,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "long2ice";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-yLAse8p+2RYHJmDwD5vrHlf29URB+kdupjD1DwTcRAc=";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-UWwqQ0ZYGoOsgRC7ROV9DDBQ/l/vXWB6uHpQ/WaFRAw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/claripy/default.nix b/pkgs/development/python-modules/claripy/default.nix
index a7b7564fd65b4..a8811d7f37ac5 100644
--- a/pkgs/development/python-modules/claripy/default.nix
+++ b/pkgs/development/python-modules/claripy/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "claripy";
-  version = "9.2.35";
+  version = "9.2.36";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-vfyrYcwQopwSxGAA+8JFCkog0Po/s9HkGI3PJzSALSI=";
+    hash = "sha256-gF8T1ZTvTjyt+kEOxI3ryDJOZv4go54VTxSGEdUyGt4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/cle/default.nix b/pkgs/development/python-modules/cle/default.nix
index 0464777b51682..e1f022c1a463b 100644
--- a/pkgs/development/python-modules/cle/default.nix
+++ b/pkgs/development/python-modules/cle/default.nix
@@ -16,7 +16,7 @@
 
 let
   # The binaries are following the argr projects release cycle
-  version = "9.2.35";
+  version = "9.2.36";
 
   # Binary files from https://github.com/angr/binaries (only used for testing and only here)
   binaries = fetchFromGitHub {
@@ -38,7 +38,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-0qDSxB77kKwYCLPWt/Wb//LLTJC8WJIv0Cw+HwE21sQ=";
+    hash = "sha256-XqoBFV87m/uz0proGDtbaewsoY8vsA6ToGwdv7xvO9Y=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/clickhouse-driver/default.nix b/pkgs/development/python-modules/clickhouse-driver/default.nix
index ac382aaf7ef6b..375fee87486cd 100644
--- a/pkgs/development/python-modules/clickhouse-driver/default.nix
+++ b/pkgs/development/python-modules/clickhouse-driver/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "clickhouse-driver";
-  version = "0.2.2";
+  version = "0.2.5";
 
   # pypi source doesn't contain tests
   src = fetchFromGitHub {
     owner = "mymarilyn";
     repo = "clickhouse-driver";
     rev = version;
-    sha256 = "0sx4jbadx9frzhqnj8b9w9l508x1r7j7b9883h7xq93lf00rxkfz";
+    hash = "sha256-o5v37jPKmvUW4GFVD742nHSdO0g0z2FA4FkacbaRfNA=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/django/4.nix b/pkgs/development/python-modules/django/4.nix
index 48ad8d9ea87c5..91c83942be8c1 100644
--- a/pkgs/development/python-modules/django/4.nix
+++ b/pkgs/development/python-modules/django/4.nix
@@ -43,14 +43,14 @@
 
 buildPythonPackage rec {
   pname = "Django";
-  version = "4.1.5";
+  version = "4.1.6";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-/1br1+rQ/V2+Bv4VewAkp6rqLgWTuzeF+1lM+U2tWO8=";
+    hash = "sha256-vOsP4aOGeBrweIyuQQhiJ1bNBed3VEje7ASnHd+HaF0=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/eigenpy/default.nix b/pkgs/development/python-modules/eigenpy/default.nix
index 4f070068a12da..66e6441c588df 100644
--- a/pkgs/development/python-modules/eigenpy/default.nix
+++ b/pkgs/development/python-modules/eigenpy/default.nix
@@ -9,14 +9,14 @@
 
 stdenv.mkDerivation rec {
   pname = "eigenpy";
-  version = "2.9.0";
+  version = "2.9.1";
 
   src = fetchFromGitHub {
     owner = "stack-of-tasks";
     repo = pname;
     rev = "v${version}";
     fetchSubmodules = true;
-    hash = "sha256-gYGJutTnvq5ERv6tDff6b+t7Kitnx9QAD/6hauHxOt4=";
+    hash = "sha256-R+j68l2N+Qb2uqdl+Ng6nwj8O3YhqXgnYZBIzZ06aRA=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/python-modules/etebase/default.nix b/pkgs/development/python-modules/etebase/default.nix
index bc99c09b402b3..f12fd2b5ca70f 100644
--- a/pkgs/development/python-modules/etebase/default.nix
+++ b/pkgs/development/python-modules/etebase/default.nix
@@ -13,19 +13,19 @@
 
 buildPythonPackage rec {
   pname = "etebase";
-  version = "0.31.5";
+  version = "0.31.6";
 
   src = fetchFromGitHub {
     owner = "etesync";
     repo = "etebase-py";
     rev = "v${version}";
-    hash = "sha256-87t3toMaApnOSPBKfTGGLo2VRLqU8irFac9lg3kA1eE=";
+    hash = "sha256-T61nPW3wjBRjmJ81w59T1b/Kxrwwqvyj3gILE9OF/5Q=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-Qg0aJ6CZaPxGneIs4o402A+fhI/nlJ9X/XdMFqkD/YY=";
+    hash = "sha256-wrMNtcaLAsWBVeJbYbYo+Xmobl01lnUbR9NUqqUzUgU=";
   };
 
   format = "pyproject";
diff --git a/pkgs/development/python-modules/fastavro/default.nix b/pkgs/development/python-modules/fastavro/default.nix
index 9826ae25170f1..c4070226eee63 100644
--- a/pkgs/development/python-modules/fastavro/default.nix
+++ b/pkgs/development/python-modules/fastavro/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "fastavro";
-  version = "1.7.0";
+  version = "1.7.1";
 
   disabled = pythonOlder "3.6";
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "refs/tags/${version}";
-    sha256 = "sha256-vzaaX3wj1UkFGCohxYlPw6NA0b+oV/2JtpYXC4zncjk=";
+    sha256 = "sha256-oFBOHcrtJe9u/hdW4p8GgIJ2g4oiSNa+qbDFBuMB/HQ=";
   };
 
   preBuild = ''
diff --git a/pkgs/development/python-modules/fiona/default.nix b/pkgs/development/python-modules/fiona/default.nix
index 852e0a18e91db..fec7fac990cd9 100644
--- a/pkgs/development/python-modules/fiona/default.nix
+++ b/pkgs/development/python-modules/fiona/default.nix
@@ -1,31 +1,23 @@
-{ stdenv, lib, buildPythonPackage, fetchPypi, isPy3k, pythonOlder
+{ stdenv, lib, buildPythonPackage, fetchPypi, isPy3k, pythonOlder, cython
 , attrs, click, cligj, click-plugins, six, munch, enum34
 , pytestCheckHook, boto3, mock, giflib, pytz
 , gdal, certifi
-, fetchpatch
 }:
 
 buildPythonPackage rec {
   pname = "fiona";
-  version = "1.8.22";
+  version = "1.9.0";
 
   src = fetchPypi {
     pname = "Fiona";
     inherit version;
-    sha256 = "sha256-qCqZzps+eCV0AVfEXJ+yJZ1OkvCohqqsJfDbQP/h7qM=";
+    hash = "sha256-bkh8v7pahJ+98G5FFp/X4fFmL0Tz1xerS5RgRrJFfq4=";
   };
 
-  patches = [
-    # https://github.com/Toblerity/Fiona/pull/1122
-    (fetchpatch {
-      url = "https://github.com/Toblerity/Fiona/commit/fa632130dcd9dfbb982ecaa4911b3fab3459168f.patch";
-      hash = "sha256-IuNHr3yBqS1jY9Swvcq8XPv6BpVlInDx0FVuzEMaYTY=";
-    })
-  ];
-
   CXXFLAGS = lib.optionalString stdenv.cc.isClang "-std=c++11";
 
   nativeBuildInputs = [
+    cython
     gdal # for gdal-config
   ];
 
@@ -62,6 +54,8 @@ buildPythonPackage rec {
     "test_no_append_driver_cannot_append"
   ];
 
+  pythonImportsCheck = [ "fiona" ];
+
   meta = with lib; {
     description = "OGR's neat, nimble, no-nonsense API for Python";
     homepage = "https://fiona.readthedocs.io/";
diff --git a/pkgs/development/python-modules/ghrepo-stats/default.nix b/pkgs/development/python-modules/ghrepo-stats/default.nix
index 71e640cce795e..b7f65f9e7843f 100644
--- a/pkgs/development/python-modules/ghrepo-stats/default.nix
+++ b/pkgs/development/python-modules/ghrepo-stats/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "ghrepo-stats";
-  version = "0.5.0";
+  version = "0.5.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -17,8 +17,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "mrbean-bremen";
     repo = pname;
-    rev = "v${version}";
-    hash = "sha256-rTW6wADpkP9GglNmQNVecHfA2yJZuzYhJfsLfucbcgY=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-QHFwIfX0rSVnWgxe82zQXMwIS99CiPgprfoMbuXvXH0=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/glean-parser/default.nix b/pkgs/development/python-modules/glean-parser/default.nix
index ee5eea4220de9..7506c5295b5f4 100644
--- a/pkgs/development/python-modules/glean-parser/default.nix
+++ b/pkgs/development/python-modules/glean-parser/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "glean-parser";
-  version = "6.4.0";
+  version = "7.0.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "glean_parser";
     inherit version;
-    hash = "sha256-9+U9kRMkcQY0tjao6Pmi0STqh0xw0pFU0/xZXlawkKM=";
+    hash = "sha256-xIlg3W/A3FBvVOEin/ku0QdmzGXlmOm5yLeYvoGkzNU=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/glean-sdk/default.nix b/pkgs/development/python-modules/glean-sdk/default.nix
index ef7f5a70358a4..7834688e15f23 100644
--- a/pkgs/development/python-modules/glean-sdk/default.nix
+++ b/pkgs/development/python-modules/glean-sdk/default.nix
@@ -17,19 +17,19 @@
 
 buildPythonPackage rec {
   pname = "glean-sdk";
-  version = "51.2.0";
+  version = "52.2.0";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-4EXCYthMabdmxWYltcnO0UTNeAYXwXQeRfwxt1WD3Ug=";
+    hash = "sha256-iW432YtZtRGUWia33Lsnu+aQuedhBJdh8dZ30FPg6Vk=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-qOGoonutuIY+0UVaVSVVt0NbqEICdNs3qHWG0Epmkl0=";
+    hash = "sha256-/7qKIQglNKGveKFtPeqd35Mq2hH/20BGTgDBgip4PnI=";
   };
 
   nativeBuildInputs = [
@@ -56,11 +56,6 @@ buildPythonPackage rec {
     "test_client_activity_api"
   ];
 
-  postPatch = ''
-    substituteInPlace glean-core/python/setup.py \
-      --replace "glean_parser==5.0.1" "glean_parser>=5.0.1"
-  '';
-
   pythonImportsCheck = [
     "glean"
   ];
@@ -70,6 +65,6 @@ buildPythonPackage rec {
     description = "Telemetry client libraries and are a part of the Glean project";
     homepage = "https://mozilla.github.io/glean/book/index.html";
     license = licenses.mpl20;
-    maintainers = [];
+    maintainers = with maintainers; [ melling ];
   };
 }
diff --git a/pkgs/development/python-modules/m2crypto/default.nix b/pkgs/development/python-modules/m2crypto/default.nix
index 8e214540b12d4..8f75d74f95252 100644
--- a/pkgs/development/python-modules/m2crypto/default.nix
+++ b/pkgs/development/python-modules/m2crypto/default.nix
@@ -1,41 +1,43 @@
 { lib
-, fetchpatch
 , buildPythonPackage
 , fetchPypi
-, pythonOlder
+, fetchpatch
 , swig2
 , openssl
 , typing
+, parameterized
 }:
 
 
 buildPythonPackage rec {
-  version = "0.36.0";
+  version = "0.38.0";
   pname = "M2Crypto";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1hadbdckmjzfb8qzbkafypin6sakfx35j2qx0fsivh757s7c2hhm";
+    sha256 = "sha256-mfImCjCQHJSajcbV+CzVMS/7iryS52YzuvIxu7yy3ss=";
   };
 
   patches = [
+    # Use OpenSSL_version_num() instead of unrealiable parsing of .h file.
+    (fetchpatch {
+      url = "https://src.fedoraproject.org/rpms/m2crypto/raw/42951285c800f72e0f0511cec39a7f49e970a05c/f/m2crypto-MR271-opensslversion.patch";
+      hash = "sha256-e1/NHgWza+kum76MUFSofq9Ko3pML67PUfqWjcwIl+A=";
+    })
+    # Changed required to pass tests on OpenSSL 3.0
+    (fetchpatch {
+      url = "https://src.fedoraproject.org/rpms/m2crypto/raw/42951285c800f72e0f0511cec39a7f49e970a05c/f/m2crypto-0.38-ossl3-tests.patch";
+      hash = "sha256-B6JKoPh76+CIna6zmrvFj50DIp3pzg8aKyzz+Q5hqQ0=";
+    })
+    # Allow EVP tests fail on non-FIPS algorithms
     (fetchpatch {
-      url = "https://github.com/void-linux/void-packages/raw/7946d12eb3d815e5ecd4578f1a6133d948694370/srcpkgs/python-M2Crypto/patches/libressl.patch";
-      sha256 = "0z5qnkndg6ma5f5qqrid5m95i9kybsr000v3fdy1ab562kf65a27";
+      url = "https://src.fedoraproject.org/rpms/m2crypto/raw/42951285c800f72e0f0511cec39a7f49e970a05c/f/m2crypto-0.38-ossl3-tests-evp.patch";
+      hash = "sha256-jMUAphVBQMFaOJSeYUCQMV3WSe9VDQqG6GY5fDQXZnA=";
     })
   ];
-  patchFlags = [ "-p0" ];
-
-  nativeBuildInputs = [ swig2 ];
-  buildInputs = [ swig2 openssl ];
-
-  propagatedBuildInputs = lib.optional (pythonOlder "3.5") typing;
 
-  preConfigure = ''
-    substituteInPlace setup.py --replace "self.openssl = '/usr'" "self.openssl = '${openssl.dev}'"
-  '';
-
-  doCheck = false; # another test that depends on the network.
+  nativeBuildInputs = [ swig2 openssl ];
+  buildInputs = [ openssl parameterized ];
 
   meta = with lib; {
     description = "A Python crypto and SSL toolkit";
@@ -43,5 +45,4 @@ buildPythonPackage rec {
     license = licenses.mit;
     maintainers = with maintainers; [ andrew-d ];
   };
-
 }
diff --git a/pkgs/development/python-modules/minidb/default.nix b/pkgs/development/python-modules/minidb/default.nix
index 16becae6f4f11..8bd0aea36ca47 100644
--- a/pkgs/development/python-modules/minidb/default.nix
+++ b/pkgs/development/python-modules/minidb/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "minidb";
-  version = "2.0.6";
+  version = "2.0.7";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -15,8 +15,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "thp";
     repo = "minidb";
-    rev = version;
-    hash = "sha256-H7W+GBapT9uJgbPlARp4ZLKTN7hZlF/FbNo7rObqDM4=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-0f2usKoHs4NO/Ir8MhyiAVZFYnUkVH5avdh3QdHzY6s=";
   };
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/openstacksdk/default.nix b/pkgs/development/python-modules/openstacksdk/default.nix
index 986fa493bf9b7..f514791fd0c7f 100644
--- a/pkgs/development/python-modules/openstacksdk/default.nix
+++ b/pkgs/development/python-modules/openstacksdk/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage rec {
   pname = "openstacksdk";
-  version = "0.103.0";
+  version = "1.0.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-T58RiYZgOWdDXzl2s+BZlQpxvY5BqDFsyK+y2WaKB0E=";
+    hash = "sha256-z2vVGeMB94S/51bB+Tf47ByvP9BWQ1TzQHpFGS8FR8w=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/piano-transcription-inference/default.nix b/pkgs/development/python-modules/piano-transcription-inference/default.nix
new file mode 100644
index 0000000000000..272f3f6810bf3
--- /dev/null
+++ b/pkgs/development/python-modules/piano-transcription-inference/default.nix
@@ -0,0 +1,75 @@
+{ stdenv
+, lib
+, buildPythonPackage
+, fetchPypi
+, fetchpatch
+, fetchurl
+, librosa
+, matplotlib
+, mido
+, torch
+, torchlibrosa
+}:
+
+buildPythonPackage rec {
+  pname = "piano-transcription-inference";
+  version = "0.0.5";
+  format = "setuptools";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-nbhuSkXuWrekFxwdNHaspuag+3K1cKwq90IpATBpWPY=";
+  };
+
+  checkpoint = fetchurl {
+    name = "piano-transcription-inference.pth";
+    # The download url can be found in
+    # https://github.com/qiuqiangkong/piano_transcription_inference/blob/master/piano_transcription_inference/inference.py
+    url = "https://zenodo.org/record/4034264/files/CRNN_note_F1%3D0.9677_pedal_F1%3D0.9186.pth?download=1";
+    hash = "sha256-w/qXMHJb9Kdi8cFLyAzVmG6s2gGwJvWkolJc1geHYUE=";
+  };
+
+  propagatedBuildInputs = [
+    librosa
+    matplotlib
+    mido
+    torch
+    torchlibrosa
+  ];
+
+  patches = [
+    # Fix run against librosa 0.9.0
+    # https://github.com/qiuqiangkong/piano_transcription_inference/pull/10
+    (fetchpatch {
+      url = "https://github.com/qiuqiangkong/piano_transcription_inference/commit/b2d448916be771cd228f709c23c474942008e3e8.patch";
+      hash = "sha256-8O4VtFij//k3fhcbMRz4J8Iz4AdOPLkuk3UTxuCSy8U=";
+    })
+  ];
+
+  postPatch = ''
+    substituteInPlace piano_transcription_inference/inference.py --replace \
+      "checkpoint_path='{}/piano_transcription_inference_data/note_F1=0.9677_pedal_F1=0.9186.pth'.format(str(Path.home()))" \
+      "checkpoint_path='$out/share/checkpoint.pth'"
+  '';
+
+  postInstall = ''
+    mkdir "$out/share"
+    ln -s "${checkpoint}" "$out/share/checkpoint.pth"
+  '';
+
+  # Project has no tests.
+  # In order to make pythonImportsCheck work, NUMBA_CACHE_DIR env var need to
+  # be set to a writable dir (https://github.com/numba/numba/issues/4032#issuecomment-488102702).
+  # pythonImportsCheck has no pre* hook, use checkPhase to wordaround that.
+  checkPhase = ''
+    export NUMBA_CACHE_DIR="$(mktemp -d)"
+  '';
+  pythonImportsCheck = [ "piano_transcription_inference" ];
+
+  meta = with lib; {
+    description = "A piano transcription inference package";
+    homepage = "https://github.com/qiuqiangkong/piano_transcription_inference";
+    license = licenses.mit;
+    maintainers = with maintainers; [ azuwis ];
+  };
+}
diff --git a/pkgs/development/python-modules/plugwise/default.nix b/pkgs/development/python-modules/plugwise/default.nix
index 30306842529c4..338c189678764 100644
--- a/pkgs/development/python-modules/plugwise/default.nix
+++ b/pkgs/development/python-modules/plugwise/default.nix
@@ -21,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "plugwise";
-  version = "0.27.4";
+  version = "0.27.5";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -30,7 +30,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = "python-plugwise";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Ti0ZQlWsZaGvpfCTUnGNzdKcqKO84fAtlIUWC0wiyTI=";
+    hash = "sha256-qEAXyWa5OjTpF4foi0ljHKbemIEHORPGE6vIVL57BOU=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/python-benedict/default.nix b/pkgs/development/python-modules/python-benedict/default.nix
index 4cc1ad2589ee1..446fbfcd9c9eb 100644
--- a/pkgs/development/python-modules/python-benedict/default.nix
+++ b/pkgs/development/python-modules/python-benedict/default.nix
@@ -24,7 +24,7 @@
 
 buildPythonPackage rec {
   pname = "python-benedict";
-  version = "0.28.0";
+  version = "0.28.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -33,7 +33,7 @@ buildPythonPackage rec {
     owner = "fabiocaccamo";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-o5WeqAVg1oGumkQbWeBNJgWgHxz5UOvYpnHt8NviTKA=";
+    hash = "sha256-6gzmVOuJfNpNJlea4Am20HI98mgcKkwtU/28l7qg20Y=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pyvex/default.nix b/pkgs/development/python-modules/pyvex/default.nix
index 7c647293176cc..58523a13b0669 100644
--- a/pkgs/development/python-modules/pyvex/default.nix
+++ b/pkgs/development/python-modules/pyvex/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "pyvex";
-  version = "9.2.35";
+  version = "9.2.36";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-4qLfwzJhmcB1CwWTOvgX9qzYSfd2f3WOcXh+Aer1O3I=";
+    hash = "sha256-KV/fkgYUt8hfpGxDO3CNNrC91BaI9W8T2mr2H4eJdxo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/rising/default.nix b/pkgs/development/python-modules/rising/default.nix
index 058e457d9ebe0..5c8ccfbcdd0a1 100644
--- a/pkgs/development/python-modules/rising/default.nix
+++ b/pkgs/development/python-modules/rising/default.nix
@@ -1,9 +1,11 @@
 { lib
 , buildPythonPackage
-, isPy27
+, pythonOlder
 , fetchFromGitHub
 , pytestCheckHook
+, pythonRelaxDepsHook
 , dill
+, lightning-utilities
 , numpy
 , torch
 , threadpoolctl
@@ -12,21 +14,34 @@
 
 buildPythonPackage rec {
   pname = "rising";
-  version = "0.2.1";
-
-  disabled = isPy27;
+  version = "0.3.0";
+  disabled = pythonOlder "TODO";
 
   src = fetchFromGitHub {
     owner = "PhoenixDL";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "15wYWToXRae1cMpHWbJwzAp0THx6ED9ixQgL+n1v9PI=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-sBzVTst5Tp2oZZ+Xsg3M7uAMbucL6idlpYwHvib3EaY=";
   };
 
-  propagatedBuildInputs = [ numpy torch threadpoolctl tqdm ];
+  nativeBuildInputs = [ pythonRelaxDepsHook ];
+
+  pythonRelaxDeps = [ "lightning-utilities" ];
+
+  propagatedBuildInputs = [
+    lightning-utilities numpy torch threadpoolctl tqdm
+  ];
   nativeCheckInputs = [ dill pytestCheckHook ];
 
-  disabledTests = [ "test_affine" ];  # deprecated division operator '/'
+  pythonImportsCheck = [
+    "rising"
+    "rising.loading"
+    "rising.ops"
+    "rising.random"
+    "rising.transforms"
+    "rising.transforms.functional"
+    "rising.utils"
+  ];
 
   meta = {
     description = "High-performance data loading and augmentation library in PyTorch";
diff --git a/pkgs/development/python-modules/tensorflow-probability/default.nix b/pkgs/development/python-modules/tensorflow-probability/default.nix
index 6f820298ec13c..bd447bd4325a5 100644
--- a/pkgs/development/python-modules/tensorflow-probability/default.nix
+++ b/pkgs/development/python-modules/tensorflow-probability/default.nix
@@ -1,8 +1,10 @@
 { lib
+, stdenv
 , fetchFromGitHub
-, bazel_3
+, bazel_6
 , buildBazelPackage
 , buildPythonPackage
+, cctools
 , python
 , setuptools
 , wheel
@@ -25,7 +27,7 @@
 }:
 
 let
-  version = "0.15.0";
+  version = "0.19.0";
   pname = "tensorflow_probability";
 
   # first build all binaries and generate setup.py using bazel
@@ -35,7 +37,7 @@ let
       owner = "tensorflow";
       repo = "probability";
       rev = "v" + version;
-      sha256 = "155fgmra90s08vjnp61qxdrpzq74xa3kdzhgdkavwgc25pvxn3mi";
+      hash = "sha256-ZkQ20Qt/RF/leVP6Kc38tGgPz+C6lEuHvoL+s97oksE=";
     };
     nativeBuildInputs = [
       # needed to create the output wheel in installPhase
@@ -46,12 +48,13 @@ let
       tensorflow
     ];
 
-    bazel = bazel_3;
+    bazel = bazel_6;
 
     bazelTarget = ":pip_pkg";
+    LIBTOOL = lib.optionalString stdenv.isDarwin "${cctools}/bin/libtool";
 
     fetchAttrs = {
-      sha256 = "0sgxdlw5x3dydy53l10vbrj8smh78b7r1wff8jxcgp4w69mk8zfm";
+      sha256 = "sha256-pST4R45mWC5j0ngkkRe+hmostaMploW0+BN3WKPt0t0=";
     };
 
     buildAttrs = {
diff --git a/pkgs/development/python-modules/torchlibrosa/default.nix b/pkgs/development/python-modules/torchlibrosa/default.nix
new file mode 100644
index 0000000000000..bab73b0dae93a
--- /dev/null
+++ b/pkgs/development/python-modules/torchlibrosa/default.nix
@@ -0,0 +1,50 @@
+{ stdenv
+, lib
+, buildPythonPackage
+, fetchPypi
+, fetchpatch
+, librosa
+, numpy
+, torch
+}:
+
+buildPythonPackage rec {
+  pname = "torchlibrosa";
+  version = "0.0.9";
+  format = "setuptools";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-+LzejKvLlJIIwWm9rYPCWQDSueIwnG5gbkwNE+wbv0A=";
+  };
+
+  propagatedBuildInputs = [
+    librosa
+    numpy
+    torch
+  ];
+
+  patches = [
+    # Fix run against librosa 0.9.0, https://github.com/qiuqiangkong/torchlibrosa/pull/8
+    (fetchpatch {
+      url = "https://github.com/qiuqiangkong/torchlibrosa/commit/eec7e7559a47d0ef0017322aee29a31dad0572d5.patch";
+      hash = "sha256-c1x3MA14Plm7+lVuqiuLWgSY6FW615qnKbcWAfbrcas=";
+    })
+  ];
+
+  # Project has no tests.
+  # In order to make pythonImportsCheck work, NUMBA_CACHE_DIR env var need to
+  # be set to a writable dir (https://github.com/numba/numba/issues/4032#issuecomment-488102702).
+  # pythonImportsCheck has no pre* hook, use checkPhase to workaround that.
+  checkPhase = ''
+    export NUMBA_CACHE_DIR="$(mktemp -d)"
+  '';
+  pythonImportsCheck = [ "torchlibrosa" ];
+
+  meta = with lib; {
+    description = "PyTorch implemention of part of librosa functions";
+    homepage = "https://github.com/qiuqiangkong/torchlibrosa";
+    license = licenses.mit;
+    maintainers = with maintainers; [ azuwis ];
+  };
+}
diff --git a/pkgs/development/tools/analysis/cppcheck/default.nix b/pkgs/development/tools/analysis/cppcheck/default.nix
index 1a8183ebab8d2..51fd3aefa87e3 100644
--- a/pkgs/development/tools/analysis/cppcheck/default.nix
+++ b/pkgs/development/tools/analysis/cppcheck/default.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cppcheck";
-  version = "2.9.3";
+  version = "2.10";
 
   src = fetchFromGitHub {
     owner = "danmar";
     repo = "cppcheck";
     rev = version;
-    hash = "sha256-AaZzr5r+tpG5M40HSx45KCUBPhN/nSpXxS5H3FuSx2c=";
+    hash = "sha256-Ss35foFlh4sw6TxMp++0b9E5KDUjBpDPuWIHsak8OGY=";
   };
 
   buildInputs = [ pcre
diff --git a/pkgs/development/tools/biodiff/default.nix b/pkgs/development/tools/biodiff/default.nix
index 839f7b1b6ccc6..610b991ec52a7 100644
--- a/pkgs/development/tools/biodiff/default.nix
+++ b/pkgs/development/tools/biodiff/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "biodiff";
-  version = "1.0.3";
+  version = "1.0.4";
 
   src = fetchFromGitHub {
     owner = "8051Enthusiast";
     repo = "biodiff";
     rev = "v${version}";
-    sha256 = "sha256-ZIZ6XpRuqhacpvi1kf7zvMszzbF8IvWrMlxAZnJJSxE=";
+    sha256 = "sha256-anGiqTiZVm6q8BII1Ahg2ph7OwX5isCa16orEcf4aFE=";
   };
 
-  cargoSha256 = "sha256-/LrrHK9j6xg3J56ubM9RdkJeMn4nvpddUGMtHu2s6OE=";
+  cargoSha256 = "sha256-uyATu6M04IRFtzFb2ox0xUYFXjkW+t+71Iy58TuqCko=";
 
   meta = with lib; {
     description = "Hex diff viewer using alignment algorithms from biology";
diff --git a/pkgs/development/tools/ddosify/default.nix b/pkgs/development/tools/ddosify/default.nix
index e0d03e7f890b6..65e6dd4b2a8c1 100644
--- a/pkgs/development/tools/ddosify/default.nix
+++ b/pkgs/development/tools/ddosify/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "ddosify";
-  version = "0.13.0";
+  version = "0.13.1";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-tw6rrhFhuIsVAj5IqSHGHSYheDqGENLDxiJr+PQno1U=";
+    sha256 = "sha256-bS/7S4PxZSTYvxLFmC486PBHNhkGUIPAnUJQztp3ouw=";
   };
 
   vendorHash = "sha256-3y5ppTtvGqwWhgnVBpP4gf26DHKPnSNYK4jfhBiYDwY=";
diff --git a/pkgs/development/tools/goa/default.nix b/pkgs/development/tools/goa/default.nix
index da4d07bb78891..eac91732be117 100644
--- a/pkgs/development/tools/goa/default.nix
+++ b/pkgs/development/tools/goa/default.nix
@@ -5,15 +5,15 @@
 
 buildGoModule rec {
   pname = "goa";
-  version = "3.10.2";
+  version = "3.11.0";
 
   src = fetchFromGitHub {
     owner = "goadesign";
     repo = "goa";
     rev = "v${version}";
-    sha256 = "sha256-cVCzuOZf2zFY01+t20sRArEFinWqvZ461jJIQIyf0yI=";
+    sha256 = "sha256-KgCF44kpr8dAHzLgoRKXfd9warQUiFggGZ/Dy/49j1Q=";
   };
-  vendorSha256 = "sha256-xLn7qGmBtNSnIZ7Gn4h/Aa037V0lO1jT/8P9PB7bH5o=";
+  vendorHash = "sha256-d76aeiSkW0sZeFylWIkCoquWzX78s2iaDeX3VE8cYfI=";
 
   subPackages = [ "cmd/goa" ];
 
diff --git a/pkgs/development/tools/jet/default.nix b/pkgs/development/tools/jet/default.nix
index 0808b81df03f0..bf34d472be80c 100644
--- a/pkgs/development/tools/jet/default.nix
+++ b/pkgs/development/tools/jet/default.nix
@@ -2,11 +2,11 @@
 
 buildGraalvmNativeImage rec {
   pname = "jet";
-  version = "0.3.21";
+  version = "0.4.23";
 
   src = fetchurl {
     url = "https://github.com/borkdude/${pname}/releases/download/v${version}/${pname}-${version}-standalone.jar";
-    sha256 = "sha256-p7jTPnXpDg1bbPMEmznFWNZ4lq/zt2fZUOE6IOc9akY=";
+    sha256 = "sha256-ijqMyzmF1C3+5oT3ho1MSkoGuFJGvjhh7WWF/JDV/j8=";
   };
 
   extraNativeImageBuildArgs = [
diff --git a/pkgs/development/tools/kubie/default.nix b/pkgs/development/tools/kubie/default.nix
index b2e69d7fc3518..4d363d4e75f46 100644
--- a/pkgs/development/tools/kubie/default.nix
+++ b/pkgs/development/tools/kubie/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "kubie";
-  version = "0.19.1";
+  version = "0.19.2";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "sbstp";
     repo = "kubie";
-    sha256 = "sha256-tZ4qa48I/J62bqc9eoSSpTrJjU+LpweF/kI1TMiFrEY=";
+    sha256 = "sha256-foY1fcIn+jywABwEVBWctx4zwLg7k2zxkpL8UAhx6kA=";
   };
 
-  cargoSha256 = "sha256-WpX1wkMPtUwT6KOi0Bij1tzGlDhti828wBSfzpXuZaY=";
+  cargoHash = "sha256-WHaORWwR7PeKacaCtXjTYMTCyZ4ZFWo1smVx5ig+Z9U=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/development/tools/language-servers/jdt-language-server/default.nix b/pkgs/development/tools/language-servers/jdt-language-server/default.nix
index 1af69700152d2..1b194814a270d 100644
--- a/pkgs/development/tools/language-servers/jdt-language-server/default.nix
+++ b/pkgs/development/tools/language-servers/jdt-language-server/default.nix
@@ -7,12 +7,12 @@
 
 stdenv.mkDerivation rec {
   pname = "jdt-language-server";
-  version = "1.17.0";
-  timestamp = "202210271413";
+  version = "1.19.0";
+  timestamp = "202301171536";
 
   src = fetchurl {
     url = "https://download.eclipse.org/jdtls/milestones/${version}/jdt-language-server-${version}-${timestamp}.tar.gz";
-    sha256 = "sha256-3NVzL3o/8LXR94/3Yma42XHfwNEFEVrmUijkeMs/vL0=";
+    sha256 = "sha256-9rreuMw2pODzOVX5PBmUZoV5ixUDilQyTsrnyCQ+IHs=";
   };
 
   sourceRoot = ".";
diff --git a/pkgs/development/tools/protoc-gen-go-vtproto/default.nix b/pkgs/development/tools/protoc-gen-go-vtproto/default.nix
index ee1793f01cab0..3adab620534ba 100644
--- a/pkgs/development/tools/protoc-gen-go-vtproto/default.nix
+++ b/pkgs/development/tools/protoc-gen-go-vtproto/default.nix
@@ -4,16 +4,16 @@
 }:
 buildGoModule rec {
   pname = "protoc-gen-go-vtproto";
-  version = "0.3.0";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "planetscale";
     repo = "vtprotobuf";
     rev = "v${version}";
-    sha256 = "sha256-fOF7n1WeQ3s1S+o5NbAoTUnqqk5IHtKvXCb2o8LmI5U=";
+    sha256 = "sha256-WtiXoQWjjFf+TP2zpAXNH05XdcrLSpw3S0TG4lkzp2E=";
   };
 
-  vendorSha256 = "sha256-JpSVO8h7+StLG9/dJQkmrIlh9zIHABoqP1hq+X5ajVs=";
+  vendorHash = "sha256-JpSVO8h7+StLG9/dJQkmrIlh9zIHABoqP1hq+X5ajVs=";
 
   excludedPackages = [ "conformance" ];
 
diff --git a/pkgs/development/tools/quick-lint-js/default.nix b/pkgs/development/tools/quick-lint-js/default.nix
index 80adc6f30a75e..aa3dd1ee86883 100644
--- a/pkgs/development/tools/quick-lint-js/default.nix
+++ b/pkgs/development/tools/quick-lint-js/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "quick-lint-js";
-  version = "2.9.0";
+  version = "2.11.0";
 
   src = fetchFromGitHub {
     owner = "quick-lint";
     repo = "quick-lint-js";
     rev = version;
-    sha256 = "sha256-hWwEaUf+TntRfxI3HjJV+hJ+dV6TRncxSCbaxE1sIjs=";
+    sha256 = "sha256-hpDVR58Qez+TcAO77GXvjuH7NfBxdRvIi8WsBIuz3nI=";
   };
 
   nativeBuildInputs = [ cmake ninja ];
diff --git a/pkgs/development/tools/ruff/default.nix b/pkgs/development/tools/ruff/default.nix
index 2789a3d608f20..f8319fe6c2fff 100644
--- a/pkgs/development/tools/ruff/default.nix
+++ b/pkgs/development/tools/ruff/default.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "ruff";
-  version = "0.0.238";
+  version = "0.0.239";
 
   src = fetchFromGitHub {
     owner = "charliermarsh";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-hsJJsPJQrkzn+otpFhsESLRhfYEcUSXJULkScWPyQNk=";
+    sha256 = "sha256-ogAy1HrkoG7PWvDd4HlqTVNjrWpyWw2B+E9DANCoJNo=";
   };
 
-  cargoSha256 = "sha256-stEPoiXKXnjYcKqlJPwcjWAV4W2GLIp2lQ0ejVd/EF8=";
+  cargoSha256 = "sha256-C5ZOV2EUiV4W3J3jXS+aDyL3w+Rjx1YGTaE8ikqB2VQ=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/development/tools/rust/cargo-tally/default.nix b/pkgs/development/tools/rust/cargo-tally/default.nix
index e2fde75ba8297..55b63dadad973 100644
--- a/pkgs/development/tools/rust/cargo-tally/default.nix
+++ b/pkgs/development/tools/rust/cargo-tally/default.nix
@@ -2,14 +2,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-tally";
-  version = "1.0.21";
+  version = "1.0.22";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-YEsgXIZ4R2w0HOkTV8LOGi2g32nHRs63nhk9yVR4vak=";
+    sha256 = "sha256-h3w9xxzExDojJw2OIPMT9lQ/lzYQNf9WJVHBP+tOnPw=";
   };
 
-  cargoSha256 = "sha256-jLbYC862fZONvMHh0CLsiuUmn/hmAF6sRLuav3P+bck=";
+  cargoSha256 = "sha256-EPYfmRms00AE4NkmOJBnIKYOCFbjd2qwRi6/i09hQ6U=";
 
   buildInputs = lib.optionals stdenv.isDarwin (with darwin.apple_sdk_11_0.frameworks; [
     DiskArbitration
diff --git a/pkgs/development/tools/rust/cargo-zigbuild/default.nix b/pkgs/development/tools/rust/cargo-zigbuild/default.nix
index 7d58d112da312..79822a7735e50 100644
--- a/pkgs/development/tools/rust/cargo-zigbuild/default.nix
+++ b/pkgs/development/tools/rust/cargo-zigbuild/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-zigbuild";
-  version = "0.14.5";
+  version = "0.15.0";
 
   src = fetchFromGitHub {
     owner = "messense";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-+H+T/PEpJyRySTJlVGbAevLzAEZs5J8BNqwZjiXhuuU=";
+    sha256 = "sha256-4Sp3PVhUvXn7FzPHHyyRBUHY5TQYEPLFdoI4ARQ4V0k=";
   };
 
-  cargoSha256 = "sha256-IOR/G+SPGl3MgOMjmsVPpvoode8U7K52vqs7yu0BdQk=";
+  cargoSha256 = "sha256-QplcedhsqFiAwcqBrEe2ns4DdZ+R/IuoKtkx8eGk19g=";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/development/tools/ttfb/default.nix b/pkgs/development/tools/ttfb/default.nix
new file mode 100644
index 0000000000000..a3b8898eacf44
--- /dev/null
+++ b/pkgs/development/tools/ttfb/default.nix
@@ -0,0 +1,45 @@
+{ darwin
+, fetchCrate
+, lib
+, openssl
+, pkg-config
+, rustPlatform
+, stdenv
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "ttfb";
+  version = "1.6.0";
+
+  src = fetchCrate {
+    inherit pname version;
+    sha256 = "sha256-o7kzQ8jtAqDwTUPtjeNqgotxREeWl7jQG+EDrYWJL/Q=";
+  };
+
+  cargoSha256 = "sha256-ayyYrrFDVOYVjVo5TLaRn2mvmywe5BjQ7kRVV2r0iK8=";
+
+  # The bin feature activates all dependencies of the binary. Otherwise,
+  # only the library is build.
+  buildFeatures = [ "bin" ];
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    openssl
+  ] ++ lib.optionals stdenv.isDarwin [
+    darwin.apple_sdk.frameworks.Security
+  ];
+
+  meta = with lib; {
+    description = "CLI-Tool to measure the TTFB (time to first byte) of HTTP(S) requests";
+    longDescription = ''
+      This crate measures the times of DNS lookup, TCP connect, TLS handshake, and HTTP's TTFB
+      for a given IP or domain.
+    '';
+    homepage = "https://github.com/phip1611/ttfb";
+    changelog = "https://github.com/phip1611/ttfb/blob/v${version}/CHANGELOG.md";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ phip1611 ];
+  };
+}
+
diff --git a/pkgs/development/tools/typos/default.nix b/pkgs/development/tools/typos/default.nix
index 1a231575476c3..87ec2964a00b3 100644
--- a/pkgs/development/tools/typos/default.nix
+++ b/pkgs/development/tools/typos/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "typos";
-  version = "1.13.8";
+  version = "1.13.9";
 
   src = fetchFromGitHub {
     owner = "crate-ci";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-ROMO6IkfpzFvB5Y4RRqrX5NnYzdHT1tsJBdCc1lDu7k=";
+    hash = "sha256-dAe19D9q5JXeWCnsfbz0NnAtnAQj0dyIy6cdyjqVxEg=";
   };
 
-  cargoHash = "sha256-VAVlzciWVKcgl/QKiF3Hfzx11jUi/0J9b6EmaZzG9qE=";
+  cargoHash = "sha256-gc3tDTsmgvMfLbWh5XALEpZuK6e8FXsomfq4U/xTPXM=";
 
   meta = with lib; {
     description = "Source code spell checker";
diff --git a/pkgs/development/tools/wasm-bindgen-cli/default.nix b/pkgs/development/tools/wasm-bindgen-cli/default.nix
index 7f9d8fae4c24a..ec336d422ab16 100644
--- a/pkgs/development/tools/wasm-bindgen-cli/default.nix
+++ b/pkgs/development/tools/wasm-bindgen-cli/default.nix
@@ -12,14 +12,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "wasm-bindgen-cli";
-  version = "0.2.83";
+  version = "0.2.84";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-+PWxeRL5MkIfJtfN3/DjaDlqRgBgWZMa6dBt1Q+lpd0=";
+    sha256 = "sha256-0rK+Yx4/Jy44Fw5VwJ3tG243ZsyOIBBehYU54XP/JGk=";
   };
 
-  cargoSha256 = "sha256-GwLeA6xLt7I+NzRaqjwVpt1pzRex1/snq30DPv4FR+g=";
+  cargoSha256 = "sha256-vcpxcRlW1OKoD64owFF6mkxSqmNrvY+y3Ckn5UwEQ50=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/development/tools/zprint/default.nix b/pkgs/development/tools/zprint/default.nix
index c401ecf0bb52b..f93098aebfe24 100644
--- a/pkgs/development/tools/zprint/default.nix
+++ b/pkgs/development/tools/zprint/default.nix
@@ -2,11 +2,11 @@
 
 buildGraalvmNativeImage rec {
   pname = "zprint";
-  version = "1.2.4";
+  version = "1.2.5";
 
   src = fetchurl {
     url = "https://github.com/kkinnear/${pname}/releases/download/${version}/${pname}-filter-${version}";
-    sha256 = "sha256-PgmaKxTOZPgHhEfFA5FdHrKHHpfieoK2QZBYR3f0J8s=";
+    sha256 = "sha256-PWdR5jqyzvTk9HoxqDldwtZNik34dmebBtZZ5vtva4A=";
   };
 
   extraNativeImageBuildArgs = [
diff --git a/pkgs/games/crispy-doom/default.nix b/pkgs/games/crispy-doom/default.nix
index 7454242c72b5e..e3385eaca5373 100644
--- a/pkgs/games/crispy-doom/default.nix
+++ b/pkgs/games/crispy-doom/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "crispy-doom";
-  version = "5.11.1";
+  version = "5.12.0";
 
   src = fetchFromGitHub {
     owner = "fabiangreffrath";
     repo = pname;
     rev = "${pname}-${version}";
-    sha256 = "sha256-2Sjl9XO01ko0BwbFQSFv9mNoetyMa8Dxx17y0JmlLS0=";
+    sha256 = "sha256-ep48Lgxw0yKd7+Cx6wMEnOqu/1vjdCM36+TKv1sb1Tk=";
   };
 
   postPatch = ''
diff --git a/pkgs/games/unciv/default.nix b/pkgs/games/unciv/default.nix
index 76dac1e5e2783..b036ded0b74c9 100644
--- a/pkgs/games/unciv/default.nix
+++ b/pkgs/games/unciv/default.nix
@@ -25,11 +25,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "unciv";
-  version = "4.4.3";
+  version = "4.4.6";
 
   src = fetchurl {
     url = "https://github.com/yairm210/Unciv/releases/download/${version}/Unciv.jar";
-    sha256 = "sha256-oPZdQEfWgVo4M0WDhKfDDB4GqnzQEM8x79FSa3jC+U0=";
+    sha256 = "sha256-I4EKYoN+36a65mcZ2UWH3Ws75Ojdmpw/6flKFmEuIk8=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/os-specific/linux/apfs/default.nix b/pkgs/os-specific/linux/apfs/default.nix
index da0660ad11395..e6961684d0e4a 100644
--- a/pkgs/os-specific/linux/apfs/default.nix
+++ b/pkgs/os-specific/linux/apfs/default.nix
@@ -5,15 +5,18 @@
 , nixosTests
 }:
 
+let
+  tag = "0.3.0";
+in
 stdenv.mkDerivation {
   pname = "apfs";
-  version = "unstable-2022-10-20-${kernel.version}";
+  version = "${tag}-${kernel.version}";
 
   src = fetchFromGitHub {
     owner = "linux-apfs";
     repo = "linux-apfs-rw";
-    rev = "e6eb67c92d425d395eac1c4403629391bdd5064d";
-    sha256 = "sha256-6rv5qZCjOqt0FaNFhA3tYg6/SdssvoT8kPVhalajgOo=";
+    rev = "v${tag}";
+    sha256 = "sha256-ABFqkiIJuFapFsUIFHfw8+TujePZm7ZX/qHuFO2KdnQ=";
   };
 
   hardeningDisable = [ "pic" ];
@@ -29,6 +32,15 @@ stdenv.mkDerivation {
 
   meta = with lib; {
     description = "APFS module for linux";
+    longDescription = ''
+      The Apple File System (APFS) is the copy-on-write filesystem currently
+      used on all Apple devices. This module provides a degree of experimental
+      support on Linux.
+      If you make use of the write support, expect data corruption.
+      Read-only support is somewhat more complete, with sealed volumes,
+      snapshots, and all the missing compression algorithms recently added.
+      Encryption is still not in the works though.
+    '';
     homepage = "https://github.com/linux-apfs/linux-apfs-rw";
     license = licenses.gpl2Only;
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/busybox/default.nix b/pkgs/os-specific/linux/busybox/default.nix
index 3feb590eb5d64..8a510a4d0c5d6 100644
--- a/pkgs/os-specific/linux/busybox/default.nix
+++ b/pkgs/os-specific/linux/busybox/default.nix
@@ -50,14 +50,14 @@ in
 
 stdenv.mkDerivation rec {
   pname = "busybox";
-  version = "1.35.0";
+  version = "1.36.0";
 
   # Note to whoever is updating busybox: please verify that:
   # nix-build pkgs/stdenv/linux/make-bootstrap-tools.nix -A test
   # still builds after the update.
   src = fetchurl {
     url = "https://busybox.net/downloads/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-+u6yRMNaNIozT0pZ5EYm7ocPsHtohNaMEK6LwZ+DppQ=";
+    sha256 = "sha256-VCdQyK98smMOIBeAtPmfPczusG9QW0eexoJBweavYaU=";
   };
 
   hardeningDisable = [ "format" "pie" ]
@@ -75,11 +75,6 @@ stdenv.mkDerivation rec {
       url = "https://git.alpinelinux.org/aports/plain/main/busybox/0002-nslookup-sanitize-all-printed-strings-with-printable.patch?id=ed92963eb55bbc8d938097b9ccb3e221a94653f4";
       sha256 = "sha256-vl1wPbsHtXY9naajjnTicQ7Uj3N+EQ8pRNnrdsiow+w=";
     })
-    (fetchurl {
-      name = "CVE-2022-30065.patch";
-      url = "https://git.alpinelinux.org/aports/plain/main/busybox/CVE-2022-30065.patch?id=4ffd996b3f8298c7dd424b912c245864c816e354";
-      sha256 = "sha256-+WSYxI6eF8S0tya/S62f9Nc6jVMnHO0q1OyM69GlNTY=";
-    })
   ] ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) ./clang-cross.patch;
 
   separateDebugInfo = true;
diff --git a/pkgs/os-specific/linux/iotop-c/default.nix b/pkgs/os-specific/linux/iotop-c/default.nix
index 39429cba4b9c6..2917ace349fb2 100644
--- a/pkgs/os-specific/linux/iotop-c/default.nix
+++ b/pkgs/os-specific/linux/iotop-c/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "iotop-c";
-  version = "1.22";
+  version = "1.23";
 
   src = fetchFromGitHub {
     owner = "Tomas-M";
     repo = "iotop";
     rev = "v${version}";
-    sha256 = "sha256-MHjG14vZsuDrR9/SLotb7Uc3RW8Np9E2X0GXkSM+RxE=";
+    sha256 = "sha256-4DTYtUltmZ+nkm4ZLac+6JbBW3z+qby7sP33LwEXtcQ=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/os-specific/linux/kernel/linux-5.10.nix b/pkgs/os-specific/linux/kernel/linux-5.10.nix
index 7f984e43d7b7b..b2a9f27947c33 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.10.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.10.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.10.165";
+  version = "5.10.166";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "03dg8yx0gdzm8zbwd1f9jn4c5jhr8qilhjzxgwm0mv8riz2fy7cp";
+    sha256 = "1bz1sgkqniwg84wv9vcg08mksa5q533vgynsd3y0xnjv1rwa2l80";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.15.nix b/pkgs/os-specific/linux/kernel/linux-5.15.nix
index 75f035ec2119e..9ae7546f3c9db 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.15.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.15.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.15.90";
+  version = "5.15.91";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "0hiv74mxkp3v04lphnyw16akgavaz527bzhnfnpm6rv848047zg6";
+    sha256 = "107yw7mibibhfrggm8idzn5bayjvkxaq1kv3kkm1lpxipsqjng56";
   };
 } // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-6.1.nix b/pkgs/os-specific/linux/kernel/linux-6.1.nix
index f1fc40ee7644b..2bed730a8b119 100644
--- a/pkgs/os-specific/linux/kernel/linux-6.1.nix
+++ b/pkgs/os-specific/linux/kernel/linux-6.1.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "6.1.8";
+  version = "6.1.9";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v6.x/linux-${version}.tar.xz";
-    sha256 = "0vc1ggjy4wvna7g6xgbjzhk93whssj9ixcal0hkhldxsp0xba2xn";
+    sha256 = "0awjynyy049px0h7li59w3zgn3z39alv6glzrmx6wf1wd62z236n";
   };
 } // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix b/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
index aefd662aa4d2c..6a1ba266a3747 100644
--- a/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
@@ -6,7 +6,7 @@
 , ... } @ args:
 
 let
-  version = "5.10.162-rt78"; # updated by ./update-rt.sh
+  version = "5.10.165-rt81"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
@@ -17,14 +17,14 @@ in buildLinux (args // {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${kversion}.tar.xz";
-    sha256 = "05yjgp1la5flwqji9b6j7nbdgg5fwzv2ph536v4f9pzza3y01i1f";
+    sha256 = "03dg8yx0gdzm8zbwd1f9jn4c5jhr8qilhjzxgwm0mv8riz2fy7cp";
   };
 
   kernelPatches = let rt-patch = {
     name = "rt";
     patch = fetchurl {
       url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "146y62kzxm0d7bw8riqds0m8iilx3zd6yh5dfxr5q90jcjnah16x";
+      sha256 = "1441lwmz4v427gcyddps17ms96y86klmnlw95kc74j6wmy387fcg";
     };
   }; in [ rt-patch ] ++ kernelPatches;
 
diff --git a/pkgs/os-specific/linux/sysdig/default.nix b/pkgs/os-specific/linux/sysdig/default.nix
index 21f232d0c2da9..e316423f01a06 100644
--- a/pkgs/os-specific/linux/sysdig/default.nix
+++ b/pkgs/os-specific/linux/sysdig/default.nix
@@ -3,7 +3,6 @@
 , libyamlcpp, nlohmann_json, re2
 }:
 
-with lib;
 let
   # Compare with https://github.com/draios/sysdig/blob/dev/cmake/modules/falcosecurity-libs.cmake
   libsRev = "0.9.1";
@@ -54,7 +53,7 @@ stdenv.mkDerivation rec {
     libyamlcpp
     jsoncpp
     nlohmann_json
-  ] ++ optionals (kernel != null) kernel.moduleBuildDependencies;
+  ] ++ lib.optionals (kernel != null) kernel.moduleBuildDependencies;
 
   hardeningDisable = [ "pic" ];
 
@@ -82,7 +81,7 @@ stdenv.mkDerivation rec {
     "-DUSE_BUNDLED_TBB=OFF"
     "-DUSE_BUNDLED_RE2=OFF"
     "-DCREATE_TEST_TARGETS=OFF"
-  ] ++ optional (kernel == null) "-DBUILD_DRIVER=OFF";
+  ] ++ lib.optional (kernel == null) "-DBUILD_DRIVER=OFF";
 
   # needed since luajit-2.1.0-beta3
   NIX_CFLAGS_COMPILE = "-DluaL_reg=luaL_Reg -DluaL_getn(L,i)=((int)lua_objlen(L,i))";
@@ -93,7 +92,7 @@ stdenv.mkDerivation rec {
       exit 1
     fi
     cmakeFlagsArray+=(-DCMAKE_EXE_LINKER_FLAGS="-ltbb -lcurl -labsl_synchronization")
-  '' + optionalString (kernel != null) ''
+  '' + lib.optionalString (kernel != null) ''
     export INSTALL_MOD_PATH="$out"
     export KERNELDIR="${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
   '';
@@ -106,7 +105,7 @@ stdenv.mkDerivation rec {
       rmdir $out/etc/bash_completion.d
       rmdir $out/etc
     ''
-    + optionalString (kernel != null) ''
+    + lib.optionalString (kernel != null) ''
       make install_driver
       kernel_dev=${kernel.dev}
       kernel_dev=''${kernel_dev#/nix/store/}
@@ -121,7 +120,7 @@ stdenv.mkDerivation rec {
     '';
 
 
-  meta = {
+  meta = with lib; {
     description = "A tracepoint-based system tracing tool for Linux (with clients for other OSes)";
     license = with licenses; [ asl20 gpl2 mit ];
     maintainers = [maintainers.raskin];
diff --git a/pkgs/servers/consul/default.nix b/pkgs/servers/consul/default.nix
index dab2d0ba45ae3..cc2fa4be2745d 100644
--- a/pkgs/servers/consul/default.nix
+++ b/pkgs/servers/consul/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "consul";
-  version = "1.14.3";
+  version = "1.14.4";
   rev = "v${version}";
 
   # Note: Currently only release tags are supported, because they have the Consul UI
@@ -17,7 +17,7 @@ buildGoModule rec {
     owner = "hashicorp";
     repo = pname;
     inherit rev;
-    sha256 = "sha256-zTsFLBd+7G+8HT8EGLSQaMhFfh/7s1tfu2gZtIMbkDs=";
+    sha256 = "sha256-aPJcb7nIjNIT5Bt/On+KFHHA2bNBO4y7HDFpsjhh8j0=";
   };
 
   passthru.tests.consul = nixosTests.consul;
@@ -26,7 +26,7 @@ buildGoModule rec {
   # has a split module structure in one repo
   subPackages = ["." "connect/certgen"];
 
-  vendorSha256 = "sha256-tekrveDmUq6qYafRMm7knxp9+FevaDbu4DZusO6KDtA=";
+  vendorHash = "sha256-g7Pi/wOjClwcuqeHQjhqBtnORArx1G4Znqvfl0bf3V4=";
 
   doCheck = false;
 
diff --git a/pkgs/servers/hqplayerd/default.nix b/pkgs/servers/hqplayerd/default.nix
index 1b312218aeda8..a65de7cf229ca 100644
--- a/pkgs/servers/hqplayerd/default.nix
+++ b/pkgs/servers/hqplayerd/default.nix
@@ -28,11 +28,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "hqplayerd";
-  version = "4.33.0-96sse42";
+  version = "4.34.0-100sse42";
 
   src = fetchurl {
     url = "https://www.signalyst.eu/bins/${pname}/fc36/${pname}-${version}.fc36.x86_64.rpm";
-    hash = "sha256-4gPK31XMd5JUp2+il1Qa7r0EaXVGEvKoYLNGSD2dLUs=";
+    hash = "sha256-MCRZ0XKi6pztVTuPQpPEn6wHsOwtSxR0Px9r12jnC9U=";
   };
 
   unpackPhase = ''
@@ -76,14 +76,6 @@ stdenv.mkDerivation rec {
     mkdir -p $out/etc
     cp -rv ./etc/hqplayer $out/etc/
 
-    # udev rules
-    mkdir -p $out/etc/udev
-    cp -rv ./etc/udev/rules.d $out/etc/udev/
-
-    # kernel module cfgs
-    mkdir -p $out/etc
-    cp -rv ./etc/modules-load.d $out/etc/
-
     # systemd service file
     mkdir -p $out/lib/systemd
     cp -rv ./usr/lib/systemd/system $out/lib/systemd/
diff --git a/pkgs/servers/monitoring/prometheus/shelly-exporter.nix b/pkgs/servers/monitoring/prometheus/shelly-exporter.nix
new file mode 100644
index 0000000000000..ee8002e661406
--- /dev/null
+++ b/pkgs/servers/monitoring/prometheus/shelly-exporter.nix
@@ -0,0 +1,24 @@
+{ lib, buildGoModule, fetchFromGitHub, nixosTests }:
+
+buildGoModule rec {
+  pname = "shelly_exporter";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "aexel90";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-L0TuBDq5eEahQvzqd1WuvmXuQbbblCM+Nvj15IybnVo=";
+  };
+
+  vendorSha256 = "sha256-BCrge2xLT4b4wpYA+zcsH64a/nfV8+HeZF7L49p2gEw=";
+
+  passthru.tests = { inherit (nixosTests.prometheus-exporters) shelly; };
+
+  meta = with lib; {
+    description = "Shelly humidity sensor exporter for prometheus";
+    homepage = "https://github.com/aexel90/shelly_exporter";
+    license = licenses.asl20;
+    maintainers = with maintainers; [drupol];
+  };
+}
diff --git a/pkgs/servers/prowlarr/default.nix b/pkgs/servers/prowlarr/default.nix
index 01eeb6fcb1aa6..6dde194f92ea4 100644
--- a/pkgs/servers/prowlarr/default.nix
+++ b/pkgs/servers/prowlarr/default.nix
@@ -16,14 +16,14 @@ let
   }."${stdenv.hostPlatform.system}" or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
 
   hash = {
-    x64-linux_hash = "sha256-w9je2dcVMDhUCG2zK9uQWpTXQh3zw+0yL/qVrl3DqzE=";
-    arm64-linux_hash = "sha256-j5pxMTLE2Mk91q76Y1n8j3pG/1aPrGkkvSjzAI8nJro=";
-    x64-osx_hash = "sha256-ILz3zNQNUwFGMLvz4sqZMzsN+tw/HNpr5mFLSIKQ4Gg=";
+    x64-linux_hash = "sha256-0JeZaHaAJ0Z+wcEPGA8yidiKsU/lxEgC6BGpFEzjO0A=";
+    arm64-linux_hash = "sha256-/N8SY0JS3yX2MARb7MN68CWEZQ8mIXM5zmg96r8hVsw=";
+    x64-osx_hash = "sha256-kcD6ATOGYJULk6g+v4uISDtnzr0c1y2BntIt3MWUR0Q=";
   }."${arch}-${os}_hash";
 
 in stdenv.mkDerivation rec {
   pname = "prowlarr";
-  version = "1.1.1.2377";
+  version = "1.1.2.2453";
 
   src = fetchurl {
     url = "https://github.com/Prowlarr/Prowlarr/releases/download/v${version}/Prowlarr.develop.${version}.${os}-core-${arch}.tar.gz";
diff --git a/pkgs/servers/roon-server/default.nix b/pkgs/servers/roon-server/default.nix
index f1ff08b930cfc..067f9b48d58ef 100644
--- a/pkgs/servers/roon-server/default.nix
+++ b/pkgs/servers/roon-server/default.nix
@@ -15,7 +15,7 @@
 , stdenv
 }:
 let
-  version = "2.0-1193";
+  version = "2.0-1202";
   urlVersion = builtins.replaceStrings [ "." "-" ] [ "00" "0" ] version;
 in
 stdenv.mkDerivation {
@@ -24,7 +24,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://download.roonlabs.com/updates/production/RoonServer_linuxx64_${urlVersion}.tar.bz2";
-    hash = "sha256-yvM4mEFBelT8Nox0vzI4tlQbxDUkoMAB6q8l5LW8+b4=";
+    hash = "sha256-YeBzXnw/BpJDUJ7fUf7TH0zQcpCjUm9peB7zPO2ZsYI=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/servers/rtsp-simple-server/default.nix b/pkgs/servers/rtsp-simple-server/default.nix
index 09412c8858f5a..0ff710ae63496 100644
--- a/pkgs/servers/rtsp-simple-server/default.nix
+++ b/pkgs/servers/rtsp-simple-server/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "rtsp-simple-server";
-  version = "0.21.1";
+  version = "0.21.2";
 
   src = fetchFromGitHub {
     owner = "aler9";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-hYO/MMZBb9YczvIq4mn1XE9rhnaTg9t35by/GHtvdJQ=";
+    hash = "sha256-dg+Xl3yHiWJPV+3iFcMVCPHOpHo0+pFiJv+ZVXDAK6k=";
   };
 
-  vendorHash = "sha256-Q1zeKGu20kOpjqdLCB7stuWBqi/2EyWK7vMRAYUCJKg=";
+  vendorHash = "sha256-KvG0+wxe0D+TxQmxaskTa228zUlOxCZE9rGqMYkdwzM=";
 
   # Tests need docker
   doCheck = false;
diff --git a/pkgs/servers/uxplay/default.nix b/pkgs/servers/uxplay/default.nix
index 789f3ba8d679a..76aa73c0b0dfd 100644
--- a/pkgs/servers/uxplay/default.nix
+++ b/pkgs/servers/uxplay/default.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "uxplay";
-  version = "1.61.1";
+  version = "1.62";
 
   src = fetchFromGitHub {
     owner = "FDH2";
     repo = "UxPlay";
     rev = "v${version}";
-    sha256 = "sha256-eLTIpRmKewBghUYFot8I3iTeiI6wlU7WNs8/X3w+U80=";
+    sha256 = "sha256-+IO+ITSa5LSFdCaU28B/MMBl4a+35957VlNxIQK5IqU=";
   };
 
   postPatch = ''
diff --git a/pkgs/servers/web-apps/wallabag/default.nix b/pkgs/servers/web-apps/wallabag/default.nix
index 955eac2c6c334..4fb9c43380da3 100644
--- a/pkgs/servers/web-apps/wallabag/default.nix
+++ b/pkgs/servers/web-apps/wallabag/default.nix
@@ -16,7 +16,7 @@
 
 let
   pname = "wallabag";
-  version = "2.5.2";
+  version = "2.5.3";
 in
 stdenv.mkDerivation {
   inherit pname version;
@@ -27,7 +27,7 @@ stdenv.mkDerivation {
       "https://static.wallabag.org/releases/wallabag-release-${version}.tar.gz"
       "https://github.com/wallabag/wallabag/releases/download/${version}/wallabag-${version}.tar.gz"
     ];
-    hash = "sha256-Q989SorGPm3KBuQhGAinYU6HGIa9RrhtRPvwGALU6jk=";
+    hash = "sha256-a30z9rdXcfc2eVuShEobgDWWHr9TfMwq9WwaWdrI3QU=";
   };
 
   patches = [
@@ -45,8 +45,12 @@ stdenv.mkDerivation {
   dontBuild = true;
 
   installPhase = ''
+    runHook preInstall
+
     mkdir $out
     cp -R * $out/
+
+    runHook postInstall
   '';
 
   meta = with lib; {
diff --git a/pkgs/servers/zigbee2mqtt/default.nix b/pkgs/servers/zigbee2mqtt/default.nix
index 837ffc070a1b1..b05b963784189 100644
--- a/pkgs/servers/zigbee2mqtt/default.nix
+++ b/pkgs/servers/zigbee2mqtt/default.nix
@@ -8,16 +8,16 @@
 
 buildNpmPackage rec {
   pname = "zigbee2mqtt";
-  version = "1.29.2";
+  version = "1.30.0";
 
   src = fetchFromGitHub {
     owner = "Koenkk";
     repo = "zigbee2mqtt";
     rev = version;
-    hash = "sha256-f3M5QgSN7j/zfKAmJiAPGSEa2pS77zJKUamQrZMllYY=";
+    hash = "sha256-BmkSpl+6aUTiueB9VILOcmJM+tCxK2NbqJvJYfoyvBo=";
   };
 
-  npmDepsHash = "sha256-cVX26bshHNOAPVhJQ3G88orrqQvxsF3FnR3/TNVZZJY=";
+  npmDepsHash = "sha256-ZrUbn/6hbbBRng+TJG6cxBUJ4Td4/P6MoeKVkInPmb4=";
 
   nativeBuildInputs = [
     python3
diff --git a/pkgs/shells/carapace/default.nix b/pkgs/shells/carapace/default.nix
index 912985c1cfed0..32185663e1337 100644
--- a/pkgs/shells/carapace/default.nix
+++ b/pkgs/shells/carapace/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "carapace";
-  version = "0.20.2";
+  version = "0.21.0";
 
   src = fetchFromGitHub {
     owner = "rsteube";
     repo = "${pname}-bin";
     rev = "v${version}";
-    sha256 = "sha256-UPm0B3sv2+0/tS7NdqY5fpvMbI9B7CxixWF9M74H5w0=";
+    sha256 = "sha256-vpYBgDX0CxTNphmdwrI56AtlPlf2DGf3BZ+jWwdanpw=";
   };
 
-  vendorHash = "sha256-l4DG6sZyFqu4OlxxL6mmcXTGljxY7xk5u5QlOr8dBNI=";
+  vendorHash = "sha256-Qi2fkAdO0clpKowSdoxyanIB65oagqEnw5gCqVHPJb0=";
 
   subPackages = [ "./cmd/carapace" ];
 
diff --git a/pkgs/shells/zsh/nix-zsh-completions/default.nix b/pkgs/shells/zsh/nix-zsh-completions/default.nix
index 59e9fa8d8d487..73b9b55b0b8a1 100644
--- a/pkgs/shells/zsh/nix-zsh-completions/default.nix
+++ b/pkgs/shells/zsh/nix-zsh-completions/default.nix
@@ -2,26 +2,15 @@
 
 stdenv.mkDerivation rec {
   pname = "nix-zsh-completions";
-  version = "0.4.4";
+  version = "unstable-2023-01-30";
 
   src = fetchFromGitHub {
-    owner = "spwhitt";
+    owner = "nix-community";
     repo = "nix-zsh-completions";
-    rev = version;
-    sha256 = "1n9whlys95k4wc57cnz3n07p7zpkv796qkmn68a50ygkx6h3afqf";
+    rev = "6a1bfc024481bdba568f2ced65e02f3a359a7692";
+    hash = "sha256-aXetjkl5nPuYHHyuX59ywXF+4Xg+PUCV6Y2u+g18gEk=";
   };
 
-  # https://github.com/spwhitt/nix-zsh-completions/issues/42
-  #
-  # _nix completion is broken. Remove it; _nix provided by the nix
-  # package will be used instead. It is not sufficient to set low
-  # meta.priority below if nix is installed in the system profile and
-  # nix-zsh-completions in an user profile. In that case, the broken
-  # version takes precedence over the good one.
-  postPatch = ''
-    rm _nix
-  '';
-
   strictDeps = true;
   installPhase = ''
     mkdir -p $out/share/zsh/{site-functions,plugins/nix}
@@ -30,9 +19,8 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    homepage = "https://github.com/spwhitt/nix-zsh-completions";
+    homepage = "https://github.com/nix-community/nix-zsh-completions";
     description = "ZSH completions for Nix, NixOS, and NixOps";
-    priority = 6; # prevent collisions with nix 2.4's built-in completions
     license = licenses.bsd3;
     platforms = platforms.all;
     maintainers = with maintainers; [ spwhitt olejorgenb hedning ma27 ];
diff --git a/pkgs/tools/graphics/glmark2/default.nix b/pkgs/tools/graphics/glmark2/default.nix
index 9615b57e0c1a7..5503e9eb38e03 100644
--- a/pkgs/tools/graphics/glmark2/default.nix
+++ b/pkgs/tools/graphics/glmark2/default.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation rec {
   pname = "glmark2";
-  version = "2021.12";
+  version = "2023.01";
 
   src = fetchFromGitHub {
     owner = "glmark2";
     repo = "glmark2";
     rev = version;
-    sha256 = "sha256-S6KkazkG+kdx02MPwrYvCFWSOtM6t5xT0OTE9PLCzas=";
+    sha256 = "sha256-WCvc5GqrAdpIKQ4LVqwO6ZGbzBgLCl49NxiGJynIjSQ=";
   };
 
   nativeBuildInputs = [ pkg-config wafHook makeWrapper ];
diff --git a/pkgs/tools/inputmethods/skk/skk-dicts/default.nix b/pkgs/tools/inputmethods/skk/skk-dicts/default.nix
index f20e2899f1859..bb974fbc8b58c 100644
--- a/pkgs/tools/inputmethods/skk/skk-dicts/default.nix
+++ b/pkgs/tools/inputmethods/skk/skk-dicts/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, buildPackages, libiconv, skktools }:
+{ lib, stdenv, fetchurl, buildPackages, iconv, skktools }:
 
 let
   # kana to kanji
@@ -25,15 +25,13 @@ let
     url = "https://raw.githubusercontent.com/skk-dev/dict/8b35d07a7d2044d48b063d2774d9f9d00bb7cb48/SKK-JISYO.assoc";
     sha256 = "1smcbyv6srrhnpl7ic9nqds9nz3g2dgqngmhzkrdlwmvcpvakp1v";
   };
-
-  iconvBin = if stdenv.isDarwin then libiconv else  buildPackages.stdenv.cc.libc;
 in
 
 stdenv.mkDerivation {
   pname = "skk-dicts-unstable";
   version = "2020-03-24";
   srcs = [ small medium large edict assoc ];
-  nativeBuildInputs = [ skktools ] ++ lib.optional stdenv.isDarwin libiconv;
+  nativeBuildInputs = [ iconv skktools ];
 
   strictDeps = true;
 
@@ -51,8 +49,7 @@ stdenv.mkDerivation {
     for src in $srcs; do
       dst=$out/share/$(dictname $src)
       echo ";;; -*- coding: utf-8 -*-" > $dst  # libskk requires this on the first line
-      ${lib.getBin iconvBin}/bin/iconv \
-        -f EUC-JP -t UTF-8 $src | skkdic-expr2 >> $dst
+      iconv -f EUC-JP -t UTF-8 $src | skkdic-expr2 >> $dst
     done
 
     # combine .L .edict and .assoc for convenience
diff --git a/pkgs/tools/misc/dust/default.nix b/pkgs/tools/misc/dust/default.nix
index bd4452263a92d..b6a17a38b5bf3 100644
--- a/pkgs/tools/misc/dust/default.nix
+++ b/pkgs/tools/misc/dust/default.nix
@@ -1,14 +1,14 @@
-{ stdenv, lib, fetchFromGitHub, rustPlatform, AppKit }:
+{ stdenv, lib, fetchFromGitHub, rustPlatform, AppKit, installShellFiles }:
 
 rustPlatform.buildRustPackage rec {
   pname = "du-dust";
-  version = "0.8.3";
+  version = "0.8.4";
 
   src = fetchFromGitHub {
     owner = "bootandy";
     repo = "dust";
     rev = "v${version}";
-    sha256 = "sha256-+YcHiW4kR4JeIY6zv1WJ97dCIakvtbn8+b9tLFH+aLE=";
+    sha256 = "sha256-g1i003nBbTYIuKG4ZCQSoI8gINTVc8BKRoO3UOeHOGE=";
     # Remove unicode file names which leads to different checksums on HFS+
     # vs. other filesystems because of unicode normalisation.
     postFetch = ''
@@ -16,12 +16,19 @@ rustPlatform.buildRustPackage rec {
     '';
   };
 
-  cargoSha256 = "sha256-yKj9CBoEC6UJf4L+XO2qi69//45lSqblMe8ofnLctEw=";
+  cargoHash = "sha256-jtQ/nkD5XMD2rsq550XsRK416wOCR3OuhgGPeuC3jzc=";
+
+  nativeBuildInputs = [ installShellFiles ];
 
   buildInputs = lib.optionals stdenv.isDarwin [ AppKit ];
 
   doCheck = false;
 
+  postInstall = ''
+    installManPage man-page/dust.1
+    installShellCompletion completions/dust.{bash,fish} --zsh completions/_dust
+  '';
+
   meta = with lib; {
     description = "du + rust = dust. Like du but more intuitive";
     homepage = "https://github.com/bootandy/dust";
diff --git a/pkgs/tools/misc/fclones/default.nix b/pkgs/tools/misc/fclones/default.nix
index c226ad329dd22..6309483dd88f2 100644
--- a/pkgs/tools/misc/fclones/default.nix
+++ b/pkgs/tools/misc/fclones/default.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "fclones";
-  version = "0.29.1";
+  version = "0.29.3";
 
   src = fetchFromGitHub {
     owner = "pkolaczk";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-spWfZx2br7gSLS0xaUBvMgvA326ISh16i/s0K3m1HCI=";
+    sha256 = "sha256-dz7Mxi5KIZYw0oLic50hNT6rWbQpfiBE4hlZsxNfKsA=";
   };
 
-  cargoSha256 = "sha256-qwjwauM2ejeMEbajVD8Deuhl/qMcB7MsvjR2CYGaF+M=";
+  cargoHash = "sha256-I9pd+Q3b++ujynfpZq88lqPSUOc/SXWpNzR/CwtNEPA=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
     AppKit
diff --git a/pkgs/tools/misc/iam-policy-json-to-terraform/default.nix b/pkgs/tools/misc/iam-policy-json-to-terraform/default.nix
index 4d00ffb03b4bf..ed7b0ab43182b 100644
--- a/pkgs/tools/misc/iam-policy-json-to-terraform/default.nix
+++ b/pkgs/tools/misc/iam-policy-json-to-terraform/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "iam-policy-json-to-terraform";
-  version = "1.8.1";
+  version = "1.8.2";
 
   src = fetchFromGitHub {
     owner = "flosell";
     repo = pname;
     rev = "${version}";
-    sha256 = "sha256-O3JlBWT2YVu3mv/BCbs65k7HMF4cRCihd59wZzeoxcI=";
+    sha256 = "sha256-ovmWZpeHt1L8zNzG7+2BohteSjpYADMivi+AP0Vm8/E=";
   };
 
-  vendorSha256 = "sha256-IXWt/yFapDamfZClI6gm5vPA5VW2gV2iEq5c/nJXiiA=";
+  vendorHash = "sha256-1WTc7peTJI3IvHJqznqRz29uQ2NG0CZpAAzlyYymZCQ=";
 
   meta = with lib; {
     description = "Small tool to convert an IAM Policy in JSON format into a Terraform aws_iam_policy_document ";
diff --git a/pkgs/tools/misc/lbdb/default.nix b/pkgs/tools/misc/lbdb/default.nix
index 3a7338221bac7..43dab4772d5f1 100644
--- a/pkgs/tools/misc/lbdb/default.nix
+++ b/pkgs/tools/misc/lbdb/default.nix
@@ -15,6 +15,7 @@ let
   perl' = perl.withPackages (p: with p; [
     AuthenSASL
     ConvertASN1
+    IOSocketSSL
     perlldap
   ]);
 in
diff --git a/pkgs/tools/misc/plantuml-server/default.nix b/pkgs/tools/misc/plantuml-server/default.nix
index ddbb7708ec8b4..607bc53033d5f 100644
--- a/pkgs/tools/misc/plantuml-server/default.nix
+++ b/pkgs/tools/misc/plantuml-server/default.nix
@@ -1,14 +1,14 @@
 { lib, stdenv, fetchurl }:
 
 let
-  version = "1.2023.0";
+  version = "1.2023.1";
 in
 stdenv.mkDerivation rec {
   pname = "plantuml-server";
   inherit version;
   src = fetchurl {
     url = "https://github.com/plantuml/plantuml-server/releases/download/v${version}/plantuml-v${version}.war";
-    sha256 = "sha256-FYyP6CZb+uarXlGEAPyt6KKvciZ5XsfjilDW0JObpDw=";
+    sha256 = "sha256-SaUk+gaMCpKF1HR9tpEhbZNmKV70LPHeH/YPsU8WGsU=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/tools/misc/wimboot/default.nix b/pkgs/tools/misc/wimboot/default.nix
index 71f31c720d024..12c411f3ef438 100644
--- a/pkgs/tools/misc/wimboot/default.nix
+++ b/pkgs/tools/misc/wimboot/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "wimboot";
-  version = "2.7.4";
+  version = "2.7.5";
 
   src = fetchFromGitHub {
     owner = "ipxe";
     repo = "wimboot";
     rev = "v${version}";
-    sha256 = "sha256-LaPH6nGQanweAG0niS75hr7zbO/9A3iZjS8wHD//oJ4=";
+    sha256 = "sha256-rbJONP3ge+2+WzCIpTUZeieQz9Q/MZfEUmQVbZ+9Dro=";
   };
 
   sourceRoot = "source/src";
diff --git a/pkgs/tools/networking/mubeng/default.nix b/pkgs/tools/networking/mubeng/default.nix
index c35cf14717c02..713a4eef55da5 100644
--- a/pkgs/tools/networking/mubeng/default.nix
+++ b/pkgs/tools/networking/mubeng/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "mubeng";
-  version = "0.12.0-dev";
+  version = "0.13.0";
 
   src = fetchFromGitHub {
     owner = "kitabisa";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-NBZmu0VcVUhJSdM3fzZ+4Q5oX8uxO6GLpEUq74x8HUU=";
+    hash = "sha256-FfqldK2iDB4Cy5M1uMUDEikV8JMMBzh2kgmvtZiJTOc=";
   };
 
-  vendorHash = "sha256-1JxyP6CrJ4/g7o3eGeN1kRXJU/jNLEB8fW1bjJytQqQ=";
+  vendorHash = "sha256-5YqourXzrRdfmWdHE/ZsRTze2h02ZHAsprQrSTZFrhY=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/tools/networking/tgt/default.nix b/pkgs/tools/networking/tgt/default.nix
index dedafc52f979e..3d67bbb079322 100644
--- a/pkgs/tools/networking/tgt/default.nix
+++ b/pkgs/tools/networking/tgt/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "tgt";
-  version = "1.0.84";
+  version = "1.0.85";
 
   src = fetchFromGitHub {
     owner = "fujita";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-NlEEakmut4WMI+mpm+SJOgHmWELRcl/dZJspks3VoqY=";
+    sha256 = "sha256-hjP+1uBcUfIFdRd0gbZXR+VsAF+6QrvV3//GrQhOKWc=";
   };
 
   nativeBuildInputs = [ libxslt docbook_xsl makeWrapper ];
diff --git a/pkgs/tools/security/cloudfox/default.nix b/pkgs/tools/security/cloudfox/default.nix
index 51aefd496c55f..f03a1a17171a5 100644
--- a/pkgs/tools/security/cloudfox/default.nix
+++ b/pkgs/tools/security/cloudfox/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "cloudfox";
-  version = "1.9.0";
+  version = "1.9.1";
 
   src = fetchFromGitHub {
     owner = "BishopFox";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-HLBW7a2sjA/bs8VJkwQNqM6YPEfa1onMoK89G5Fsb8s=";
+    hash = "sha256-TV2knPG5n5l8APeAmpDfu6vQLtEhjqH21JXAZLk0DDI=";
   };
 
   vendorHash = "sha256-xMHlooXuLECQi7co2/WvY0TIoV0S5OgcBklICCFk3ls=";
diff --git a/pkgs/tools/security/eid-mw/default.nix b/pkgs/tools/security/eid-mw/default.nix
index d73a93d851b74..dcd4686bb3ef2 100644
--- a/pkgs/tools/security/eid-mw/default.nix
+++ b/pkgs/tools/security/eid-mw/default.nix
@@ -21,13 +21,13 @@
 stdenv.mkDerivation rec {
   pname = "eid-mw";
   # NOTE: Don't just blindly update to the latest version/tag. Releases are always for a specific OS.
-  version = "5.1.4";
+  version = "5.1.9";
 
   src = fetchFromGitHub {
     owner = "Fedict";
     repo = "eid-mw";
     rev = "v${version}";
-    sha256 = "pHzjLyQFn7UvFrPUcI/ZQHMOwVp6ndnX9YegJzlhERM=";
+    hash = "sha256-E7mNEgh8hujagqQe0ycEGcRDOlxVY7KzXw+DD8Wf9N8=";
   };
 
   nativeBuildInputs = [ autoreconfHook autoconf-archive pkg-config makeWrapper ];
diff --git a/pkgs/tools/security/proxmark3/proxmark3-rrg.nix b/pkgs/tools/security/proxmark3/proxmark3-rrg.nix
index a366dbf8224d8..6b021e9702772 100644
--- a/pkgs/tools/security/proxmark3/proxmark3-rrg.nix
+++ b/pkgs/tools/security/proxmark3/proxmark3-rrg.nix
@@ -7,13 +7,13 @@
 
 mkDerivation rec {
   pname = "proxmark3-rrg";
-  version = "4.15864";
+  version = "4.16191";
 
   src = fetchFromGitHub {
     owner = "RfidResearchGroup";
     repo = "proxmark3";
     rev = "v${version}";
-    sha256 = "sha256-vFebyXKC/vf8W8fGkTpSGTA0ZmfwnXSuuiOjV/u9240=";
+    sha256 = "sha256-l0aDp0s9ekUUHqkzGfVoSIf/4/GN2uiVGL/+QtKRCOs=";
   };
 
   nativeBuildInputs = [ pkg-config gcc-arm-embedded ];
diff --git a/pkgs/tools/security/teler/default.nix b/pkgs/tools/security/teler/default.nix
index 1a66d7aea0dd7..989743fda8947 100644
--- a/pkgs/tools/security/teler/default.nix
+++ b/pkgs/tools/security/teler/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "teler";
-  version = "2.0.0-dev.2";
+  version = "2.0.0-dev.3";
 
   src = fetchFromGitHub {
     owner = "kitabisa";
     repo = "teler";
     rev = "v${version}";
-    hash = "sha256-GlpQBmJ7HSKPFieM7E5NOnqGlUjQv9Ywe6XF5QIi+c4=";
+    hash = "sha256-2QrHxToHxHTjSl76q9A8fXCkOZkCwh1fu1h+HDUGsGA=";
   };
 
-  vendorHash = "sha256-g2YBMyLDGQZKxDBcZ1mca16jxODnJzcmMfFivBn6SdE=";
+  vendorHash = "sha256-gV/PJFcANeYTYUJG3PYNsApYaeBLx76+vVBvcuKDYO4=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/tools/system/automatic-timezoned/default.nix b/pkgs/tools/system/automatic-timezoned/default.nix
index ea3f03161dbb9..0d72541afe28a 100644
--- a/pkgs/tools/system/automatic-timezoned/default.nix
+++ b/pkgs/tools/system/automatic-timezoned/default.nix
@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "automatic-timezoned";
-  version = "1.0.60";
+  version = "1.0.61";
 
   src = fetchFromGitHub {
     owner = "maxbrunet";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-6p9hLbU5ZaA4o6PRyfSt/gb3D3XeeWacJ2LlpJ0+w18=";
+    sha256 = "sha256-BAUvqRgcHVVFuTNX9W0PiYF3f1yd2mJxmE7It9as4gs=";
   };
 
-  cargoHash = "sha256-COWvEfFQMi3ltQSEFK3S6y07YLqqtjAf2H4p0TX/U70=";
+  cargoHash = "sha256-baQP9GEkZx5dSm64GpQ0h5SKQUzZALyplRUKEKX0K8U=";
 
   meta = with lib; {
     description = "Automatically update system timezone based on location";
diff --git a/pkgs/tools/system/systeroid/default.nix b/pkgs/tools/system/systeroid/default.nix
index 4fd26b5d487c5..88b19d1b92b5b 100644
--- a/pkgs/tools/system/systeroid/default.nix
+++ b/pkgs/tools/system/systeroid/default.nix
@@ -7,13 +7,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "systeroid";
-  version = "0.3.0";
+  version = "0.3.1";
 
   src = fetchFromGitHub {
     owner = "orhun";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-VkkobNYkz8FunyaS6EJpfqOvDdwZJE+P2YTSJCgHZI0=";
+    sha256 = "sha256-uQa6n8DESnpO9xzfExywY6lG3nZkNSpjgEm5b+ayc8I=";
   };
 
   postPatch = ''
@@ -21,7 +21,7 @@ rustPlatform.buildRustPackage rec {
       --replace '"/usr/share/doc/kernel-doc-*/Documentation/*",' '"${linux-doc}/share/doc/linux-doc/*",'
   '';
 
-  cargoSha256 = "sha256-ulmU33j2edzMA/L4KXiM5M6RhH3MmMAkA2DuHxdj2uk=";
+  cargoHash = "sha256-baxXSjbS/5i9xnQGdPYPqgu0c2HGEAU7j7X8wtKSznA=";
 
   buildInputs = [
     xorg.libxcb
diff --git a/pkgs/tools/system/throttled/default.nix b/pkgs/tools/system/throttled/default.nix
index efbc9ed3dd3fd..f09c0480865ff 100644
--- a/pkgs/tools/system/throttled/default.nix
+++ b/pkgs/tools/system/throttled/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, python3Packages }:
+{ lib, stdenv, fetchFromGitHub, python3Packages, pciutils }:
 
 stdenv.mkDerivation rec {
   pname = "throttled";
@@ -20,7 +20,11 @@ stdenv.mkDerivation rec {
   ];
 
   # The upstream unit both assumes the install location, and tries to run in a virtualenv
-  postPatch = ''sed -e 's|ExecStart=.*|ExecStart=${placeholder "out"}/bin/throttled.py|' -i systemd/throttled.service'';
+  postPatch = ''
+    sed -e 's|ExecStart=.*|ExecStart=${placeholder "out"}/bin/throttled.py|' -i systemd/throttled.service
+
+    substituteInPlace throttled.py --replace "'setpci'" "'${pciutils}/bin/setpci'"
+  '';
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/tools/text/cmigemo/default.nix b/pkgs/tools/text/cmigemo/default.nix
index 1f9ef7701ba16..7b2598a9cfb24 100644
--- a/pkgs/tools/text/cmigemo/default.nix
+++ b/pkgs/tools/text/cmigemo/default.nix
@@ -1,11 +1,8 @@
 { lib, stdenv, fetchFromGitHub, buildPackages
-, libiconv, nkf, perl, which
+, iconv, nkf, perl, which
 , skk-dicts
 }:
 
-let
-  iconvBin = if stdenv.isDarwin then libiconv else  buildPackages.stdenv.cc.libc;
-in
 stdenv.mkDerivation {
   pname = "cmigemo";
   version = "1.3e";
@@ -17,7 +14,7 @@ stdenv.mkDerivation {
     sha256 = "00a6kdmxp16b8x0p04ws050y39qspd1bqlfq74bkirc55b77a2m1";
   };
 
-  nativeBuildInputs = [ libiconv nkf perl which ];
+  nativeBuildInputs = [ iconv nkf perl which ];
 
   postUnpack = ''
     cp ${skk-dicts}/share/SKK-JISYO.L source/dict/
@@ -27,10 +24,6 @@ stdenv.mkDerivation {
 
   makeFlags = [ "INSTALL=install" ];
 
-  preBuild = ''
-    makeFlagsArray+=(FILTER_UTF8="${lib.getBin iconvBin}/bin/iconv -t utf-8 -f cp932")
-  '';
-
   buildFlags = [ (if stdenv.isDarwin then "osx-all" else "gcc-all") ];
 
   installTargets = [ (if stdenv.isDarwin then "osx-install" else "gcc-install") ];
diff --git a/pkgs/tools/text/mark/default.nix b/pkgs/tools/text/mark/default.nix
index dfff4ffefe856..af084b4aa1904 100644
--- a/pkgs/tools/text/mark/default.nix
+++ b/pkgs/tools/text/mark/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "mark";
-  version = "8.6";
+  version = "8.7";
 
   src = fetchFromGitHub {
     owner  = "kovetskiy";
     repo   = "mark";
     rev    = version;
-    sha256 = "sha256-2HcCibcP3/E3nu+PoNFChLFyCwAeAdp6I8mN95747Sg=";
+    sha256 = "sha256-A6EfP7l95eg9uL6NDqiPSzQ59JmTdE96UqunHETns9M=";
   };
 
-  vendorHash = "sha256-t2xiw1Z0BIT7pO4Z16XmsJE72RgL9Hobfy7LakpEYh4=";
+  vendorHash = "sha256-LJ288Z8xz/Xoy5I2OAk9v5hxRUkQcRTmNaQ31kHE8gQ=";
 
   ldflags = [ "-s" "-w" "-X main.version=${version}" ];
 
diff --git a/pkgs/tools/text/ugrep/default.nix b/pkgs/tools/text/ugrep/default.nix
index e9293d33b3ee5..b6ee1d60a82be 100644
--- a/pkgs/tools/text/ugrep/default.nix
+++ b/pkgs/tools/text/ugrep/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ugrep";
-  version = "3.9.6";
+  version = "3.9.7";
 
   src = fetchFromGitHub {
     owner = "Genivia";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-BzYlZl4NYjCXaM9ISGKSEP2xGFsE5GgX4zEIDniundo=";
+    hash = "sha256-y6P0EQfp2HFmhn2c7RwX8jVLUOfLT+LVhtz+OIoaVSo=";
   };
 
   buildInputs = [
diff --git a/pkgs/tools/wayland/swayimg/default.nix b/pkgs/tools/wayland/swayimg/default.nix
index 24f44fa8d3361..f3ba661e91f56 100644
--- a/pkgs/tools/wayland/swayimg/default.nix
+++ b/pkgs/tools/wayland/swayimg/default.nix
@@ -22,13 +22,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "swayimg";
-  version = "1.9";
+  version = "1.10";
 
   src = fetchFromGitHub {
     owner = "artemsen";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-864riSvWhWV4X84UeZ+xfQBOAQmwMrX6s90TXMGeruY=";
+    sha256 = "sha256-Iq7T00hvr9Mv50V/GKJBddjoeHdFa2DneVaXyxhMCE0=";
   };
 
   strictDeps = true;
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 763a6e0e62dd3..8377da4b7d12a 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2171,7 +2171,7 @@ with pkgs;
 
   pcsxr = callPackage ../applications/emulators/pcsxr { };
 
-  ppsspp = callPackage ../applications/emulators/ppsspp { };
+  ppsspp = libsForQt5.callPackage ../applications/emulators/ppsspp { };
 
   ppsspp-sdl = ppsspp;
 
@@ -2181,7 +2181,7 @@ with pkgs;
   };
 
   ppsspp-qt = ppsspp.override {
-    inherit (libsForQt5) qtbase qtmultimedia wrapQtAppsHook;
+    enableQt = true;
     enableVulkan = false; # https://github.com/hrydgard/ppsspp/issues/11628
   };
 
@@ -5406,9 +5406,13 @@ with pkgs;
 
   rex = callPackage ../tools/system/rex { };
 
-  river = callPackage ../applications/window-managers/river { };
+  river = callPackage ../applications/window-managers/river {
+    zig = zig_0_9;
+  };
 
-  rivercarro = callPackage ../applications/misc/rivercarro { };
+  rivercarro = callPackage ../applications/misc/rivercarro {
+    zig = zig_0_9;
+  };
 
   rmapi = callPackage ../applications/misc/remarkable/rmapi { };
 
@@ -7254,7 +7258,9 @@ with pkgs;
 
   findutils = callPackage ../tools/misc/findutils { };
 
-  findup = callPackage ../tools/misc/findup { };
+  findup = callPackage ../tools/misc/findup {
+    zig = zig_0_9;
+  };
 
   bsd-finger = callPackage ../tools/networking/bsd-finger { };
   bsd-fingerd = bsd-finger.override({ buildClient = false; });
@@ -7597,11 +7603,8 @@ with pkgs;
 
   gitkraken = callPackage ../applications/version-management/gitkraken { };
 
-  gitlab = callPackage ../applications/version-management/gitlab {
-    openssl = openssl_1_1;
-  };
+  gitlab = callPackage ../applications/version-management/gitlab { };
   gitlab-ee = callPackage ../applications/version-management/gitlab {
-    openssl = openssl_1_1;
     gitlabEnterprise = true;
   };
 
@@ -9804,7 +9807,7 @@ with pkgs;
   mole = callPackage ../tools/networking/mole { };
 
   morgen = callPackage ../applications/office/morgen {
-    electron = electron_15;
+    electron = electron_22;
   };
 
   mosh = callPackage ../tools/networking/mosh { };
@@ -12729,6 +12732,8 @@ with pkgs;
 
   oysttyer = callPackage ../applications/networking/instant-messengers/oysttyer { };
 
+  ttfb = callPackage ../development/tools/ttfb { };
+
   twilight = callPackage ../tools/graphics/twilight {
     libX11 = xorg.libX11;
   };
@@ -16529,7 +16534,7 @@ with pkgs;
     bluezSupport = true;
     x11Support = true;
   };
-  python311Full = python310.override {
+  python311Full = python311.override {
     self = python311Full;
     pythonAttr = "python311Full";
     bluezSupport = true;
@@ -18814,7 +18819,9 @@ with pkgs;
 
   ytt = callPackage ../development/tools/ytt {};
 
-  zls = callPackage ../development/tools/zls { };
+  zls = callPackage ../development/tools/zls {
+    zig = zig_0_9;
+  };
 
   zydis = callPackage ../development/libraries/zydis { };
 
@@ -21321,6 +21328,14 @@ with pkgs;
 
   libiconvReal = callPackage ../development/libraries/libiconv { };
 
+  iconv =
+    if lib.elem stdenv.hostPlatform.libc [ "glibc" "musl" ] then
+      lib.getBin stdenv.cc.libc
+    else if stdenv.hostPlatform.isDarwin then
+      lib.getBin darwin.libiconv
+    else
+      lib.getBin libiconvReal;
+
   # On non-GNU systems we need GNU Gettext for libintl.
   libintl = if stdenv.hostPlatform.libc != "glibc" then gettext else null;
 
@@ -23833,9 +23848,15 @@ with pkgs;
   libzra = callPackage ../development/libraries/libzra { };
 
   # requires a newer Apple SDK
-  zig = darwin.apple_sdk_11_0.callPackage ../development/compilers/zig {
+  zig_0_9 = darwin.apple_sdk_11_0.callPackage ../development/compilers/zig/0.9.1.nix {
     llvmPackages = llvmPackages_13;
   };
+  # requires a newer Apple SDK
+  zig_0_10 = darwin.apple_sdk_11_0.callPackage ../development/compilers/zig/0.10.nix {
+    llvmPackages = llvmPackages_15;
+  };
+  # Zig 0.10.1 is broken on Darwin, so use 0.9.1 on Darwin instead.
+  zig = if stdenv.isDarwin then zig_0_9 else zig_0_10;
 
   zimlib = callPackage ../development/libraries/zimlib { };
 
@@ -25073,6 +25094,7 @@ with pkgs;
   prometheus-rtl_433-exporter = callPackage ../servers/monitoring/prometheus/rtl_433-exporter.nix { };
   prometheus-sachet = callPackage ../servers/monitoring/prometheus/sachet.nix { };
   prometheus-script-exporter = callPackage ../servers/monitoring/prometheus/script-exporter.nix { };
+  prometheus-shelly-exporter = callPackage ../servers/monitoring/prometheus/shelly-exporter.nix { };
   prometheus-smartctl-exporter = callPackage ../servers/monitoring/prometheus/smartctl-exporter { };
   prometheus-smokeping-prober = callPackage ../servers/monitoring/prometheus/smokeping-prober.nix { };
   prometheus-snmp-exporter = callPackage ../servers/monitoring/prometheus/snmp-exporter.nix { };
@@ -27716,6 +27738,8 @@ with pkgs;
 
   roboto-mono = callPackage ../data/fonts/roboto-mono { };
 
+  roboto-serif = callPackage ../data/fonts/roboto-serif { };
+
   roboto-slab = callPackage ../data/fonts/roboto-slab { };
 
   hasklig = callPackage ../data/fonts/hasklig {};
@@ -28844,7 +28868,7 @@ with pkgs;
   dunst = callPackage ../applications/misc/dunst { };
 
   du-dust = callPackage ../tools/misc/dust {
-    inherit (darwin.apple_sdk.frameworks) AppKit;
+    inherit (darwin.apple_sdk_11_0.frameworks) AppKit;
   };
 
   dutree = callPackage ../tools/misc/dutree { };
@@ -30187,7 +30211,9 @@ with pkgs;
 
   waybar = callPackage ../applications/misc/waybar {};
 
-  waylock = callPackage ../applications/misc/waylock {};
+  waylock = callPackage ../applications/misc/waylock {
+    zig = zig_0_9;
+  };
 
   wayshot = callPackage ../tools/misc/wayshot { };
 
@@ -31104,7 +31130,9 @@ with pkgs;
 
   merkaartor = libsForQt5.callPackage ../applications/misc/merkaartor { };
 
-  mepo = callPackage ../applications/misc/mepo { };
+  mepo = callPackage ../applications/misc/mepo {
+    zig = zig_0_9;
+  };
 
   meshcentral = callPackage ../tools/admin/meshcentral { };
 
@@ -31743,7 +31771,9 @@ with pkgs;
 
   netcoredbg = callPackage ../development/tools/misc/netcoredbg { };
 
-  ncdu = callPackage ../tools/misc/ncdu { };
+  ncdu = callPackage ../tools/misc/ncdu {
+    zig = zig_0_9;
+  };
   ncdu_1 = callPackage ../tools/misc/ncdu/1.nix { };
 
   ncdc = callPackage ../applications/networking/p2p/ncdc { };
@@ -32059,6 +32089,8 @@ with pkgs;
 
   pianoteq = callPackage ../applications/audio/pianoteq { };
 
+  pianotrans = callPackage ../applications/audio/pianotrans { };
+
   picard = callPackage ../applications/audio/picard { };
 
   picocom = callPackage ../tools/misc/picocom {
@@ -34768,7 +34800,9 @@ with pkgs;
     inherit (perlPackages) PathTiny;
   };
 
-  blackshades = callPackage ../games/blackshades { };
+  blackshades = callPackage ../games/blackshades {
+    zig = zig_0_9;
+  };
 
   blobby = callPackage ../games/blobby { };
 
@@ -37911,7 +37945,7 @@ with pkgs;
 
   pgadmin4 = callPackage ../tools/admin/pgadmin { };
 
-  pgmodeler = libsForQt5.callPackage ../applications/misc/pgmodeler { };
+  pgmodeler = qt6Packages.callPackage ../applications/misc/pgmodeler { };
 
   physlock = callPackage ../misc/screensavers/physlock { };
 
diff --git a/pkgs/top-level/pkg-config/test-defaultPkgConfigPackages.nix b/pkgs/top-level/pkg-config/test-defaultPkgConfigPackages.nix
index 1e53a02ec8a9f..37687117987d0 100644
--- a/pkgs/top-level/pkg-config/test-defaultPkgConfigPackages.nix
+++ b/pkgs/top-level/pkg-config/test-defaultPkgConfigPackages.nix
@@ -42,4 +42,4 @@ let
     else testers.hasPkgConfigModule { inherit moduleName; package = pkg; };
 
 in
-  allTests // { inherit tests-combined; }
+  lib.recurseIntoAttrs allTests // { inherit tests-combined; }
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index be3ea429793e1..afa2458272940 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -3079,7 +3079,6 @@ self: super: with self; {
 
   etebase = callPackage ../development/python-modules/etebase {
     inherit (pkgs.darwin.apple_sdk.frameworks) Security;
-    openssl = pkgs.openssl_1_1;
   };
 
   etebase-server = callPackage ../servers/etebase { };
@@ -5584,10 +5583,7 @@ self: super: with self; {
 
   lzstring = callPackage ../development/python-modules/lzstring { };
 
-  m2crypto = callPackage ../development/python-modules/m2crypto {
-    # https://gitlab.com/m2crypto/m2crypto/-/issues/310
-    openssl = pkgs.openssl_1_1;
-  };
+  m2crypto = callPackage ../development/python-modules/m2crypto { };
 
   m2r = callPackage ../development/python-modules/m2r { };
 
@@ -7069,6 +7065,8 @@ self: super: with self; {
 
   pi1wire = callPackage ../development/python-modules/pi1wire { };
 
+  piano-transcription-inference = callPackage ../development/python-modules/piano-transcription-inference { };
+
   piccata = callPackage ../development/python-modules/piccata { };
 
   pick = callPackage ../development/python-modules/pick { };
@@ -11263,7 +11261,9 @@ self: super: with self; {
 
   tensorflow-metadata = callPackage ../development/python-modules/tensorflow-metadata { };
 
-  tensorflow-probability = callPackage ../development/python-modules/tensorflow-probability { };
+  tensorflow-probability = callPackage ../development/python-modules/tensorflow-probability {
+    inherit (pkgs.darwin) cctools;
+  };
 
   tensorflow = self.tensorflow-build;
 
@@ -11531,6 +11531,8 @@ self: super: with self; {
 
   torchinfo = callPackage ../development/python-modules/torchinfo { };
 
+  torchlibrosa = callPackage ../development/python-modules/torchlibrosa { };
+
   torchvision = callPackage ../development/python-modules/torchvision { };
 
   torchvision-bin = callPackage ../development/python-modules/torchvision/bin.nix { };