diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 044d052e9f36..bd332e7583a1 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -13614,6 +13614,12 @@
     githubId = 34967;
     name = "Julius de Bruijn";
   };
+  pineapplehunter = {
+    email = "peshogo+nixpkgs@gmail.com";
+    github = "pineapplehunter";
+    githubId = 8869894;
+    name = "Shogo Takata";
+  };
   pingiun = {
     email = "nixos@pingiun.com";
     github = "pingiun";
diff --git a/nixos/doc/manual/development/what-happens-during-a-system-switch.chapter.md b/nixos/doc/manual/development/what-happens-during-a-system-switch.chapter.md
index 9cbec729803a..5d6d67f1aa92 100644
--- a/nixos/doc/manual/development/what-happens-during-a-system-switch.chapter.md
+++ b/nixos/doc/manual/development/what-happens-during-a-system-switch.chapter.md
@@ -21,8 +21,9 @@ If the action is `switch` or `test`, the currently running system is inspected
 and the actions to switch to the new system are calculated. This process takes
 two data sources into account: `/etc/fstab` and the current systemd status.
 Mounts and swaps are read from `/etc/fstab` and the corresponding actions are
-generated. If a new mount is added, for example, the proper `.mount` unit is
-marked to be started. The current systemd state is inspected, the difference
+generated. If the options of a mount are modified, for example, the proper `.mount`
+unit is reloaded (or restarted if anything else changed and it's neither the root
+mount or the nix store). The current systemd state is inspected, the difference
 between the current system and the desired configuration is calculated and
 actions are generated to get to this state. There are a lot of nuances that can
 be controlled by the units which are explained here.
diff --git a/nixos/doc/manual/release-notes/rl-2311.section.md b/nixos/doc/manual/release-notes/rl-2311.section.md
index 13b8dc6e2244..b7c856f7a127 100644
--- a/nixos/doc/manual/release-notes/rl-2311.section.md
+++ b/nixos/doc/manual/release-notes/rl-2311.section.md
@@ -17,8 +17,9 @@
     - Updating with `nixos-rebuild boot` and rebooting is recommended, since in some rare cases the `nixos-rebuild switch` into the new generation on a live system might fail due to missing mount units.
 
 - [`sudo-rs`], a reimplementation of `sudo` in Rust, is now supported.
-  Switching to it (via `security.sudo.package = pkgs.sudo-rs;`) introduces
-  slight changes in default behaviour, due to `sudo-rs`' current limitations:
+  An experimental new module `security.sudo-rs` was added.
+  Switching to it (via `security.sudo.enable = false; security.sudo-rs.enable = true;`) introduces
+  slight changes in sudo behaviour, due to `sudo-rs`' current limitations:
   - terminfo-related environment variables aren't preserved for `root` and `wheel`;
   - `root` and `wheel` are not given the ability to set (or preserve)
     arbitrary environment variables.
@@ -270,6 +271,8 @@ The module update takes care of the new config syntax and the data itself (user
 
 - `services.nginx` gained a `defaultListen` option at server-level with support for PROXY protocol listeners, also `proxyProtocol` is now exposed in `services.nginx.virtualHosts.<name>.listen` option. It is now possible to run PROXY listeners and non-PROXY listeners at a server-level, see [#213510](https://github.com/NixOS/nixpkgs/pull/213510/) for more details.
 
+- `generic-extlinux-compatible` bootloader (and raspberry pi with uboot) supports appending secrets to the initramfs
+
 - `services.restic.backups` now adds wrapper scripts to your system path, which set the same environment variables as the service, so restic operations can easly be run from the command line. This behavior can be disabled by setting `createWrapper` to `false`, per backup configuration.
 
 - `services.prometheus.exporters` has a new exporter to monitor electrical power consumption based on PowercapRAPL sensor called [Scaphandre](https://github.com/hubblo-org/scaphandre), see [#239803](https://github.com/NixOS/nixpkgs/pull/239803) for more details.
@@ -308,6 +311,8 @@ The module update takes care of the new config syntax and the data itself (user
 
 - New `boot.bcache.enable` (default enabled) allows completely removing `bcache` mount support.
 
+- The module `services.mbpfan` now has the option `aggressive` enabled by default for better heat moderation. You can disable it for upstream defaults.
+
 - `security.sudo` now provides two extra options, that do not change the
   module's default behaviour:
   - `defaultOptions` controls the options used for the default rules;
diff --git a/nixos/lib/test-driver/test_driver/machine.py b/nixos/lib/test-driver/test_driver/machine.py
index 06d952d64f4d..2afcbc95c667 100644
--- a/nixos/lib/test-driver/test_driver/machine.py
+++ b/nixos/lib/test-driver/test_driver/machine.py
@@ -582,7 +582,9 @@ class Machine:
 
         # While sh is bash on NixOS, this is not the case for every distro.
         # We explicitly call bash here to allow for the driver to boot other distros as well.
-        out_command = f"{timeout_str} bash -c {shlex.quote(command)} 2>/dev/null | (base64 -w 0; echo)\n"
+        out_command = (
+            f"{timeout_str} bash -c {shlex.quote(command)} | (base64 -w 0; echo)\n"
+        )
 
         assert self.shell
         self.shell.send(out_command.encode())
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index e17d430e59b6..22724138d5dd 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -311,6 +311,7 @@
   ./security/rngd.nix
   ./security/rtkit.nix
   ./security/sudo.nix
+  ./security/sudo-rs.nix
   ./security/systemd-confinement.nix
   ./security/tpm2.nix
   ./security/wrappers/default.nix
diff --git a/nixos/modules/security/sudo-rs.nix b/nixos/modules/security/sudo-rs.nix
new file mode 100644
index 000000000000..6b8f09a8d3d0
--- /dev/null
+++ b/nixos/modules/security/sudo-rs.nix
@@ -0,0 +1,296 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+
+  inherit (pkgs) sudo sudo-rs;
+
+  cfg = config.security.sudo-rs;
+
+  enableSSHAgentAuth =
+    with config.security;
+    pam.enableSSHAgentAuth && pam.sudo.sshAgentAuth;
+
+  usingMillersSudo = cfg.package.pname == sudo.pname;
+  usingSudoRs = cfg.package.pname == sudo-rs.pname;
+
+  toUserString = user: if (isInt user) then "#${toString user}" else "${user}";
+  toGroupString = group: if (isInt group) then "%#${toString group}" else "%${group}";
+
+  toCommandOptionsString = options:
+    "${concatStringsSep ":" options}${optionalString (length options != 0) ":"} ";
+
+  toCommandsString = commands:
+    concatStringsSep ", " (
+      map (command:
+        if (isString command) then
+          command
+        else
+          "${toCommandOptionsString command.options}${command.command}"
+      ) commands
+    );
+
+in
+
+{
+
+  ###### interface
+
+  options.security.sudo-rs = {
+
+    defaultOptions = mkOption {
+      type = with types; listOf str;
+      default = optional usingMillersSudo "SETENV";
+      defaultText = literalMD ''
+        `[ "SETENV" ]` if using the default `sudo` implementation
+      '';
+      description = mdDoc ''
+        Options used for the default rules, granting `root` and the
+        `wheel` group permission to run any command as any user.
+      '';
+    };
+
+    enable = mkOption {
+      type = types.bool;
+      default = false;
+      description = mdDoc ''
+        Whether to enable the {command}`sudo` command, which
+        allows non-root users to execute commands as root.
+      '';
+    };
+
+    package = mkOption {
+      type = types.package;
+      default = pkgs.sudo-rs;
+      defaultText = literalExpression "pkgs.sudo-rs";
+      description = mdDoc ''
+        Which package to use for `sudo`.
+      '';
+    };
+
+    wheelNeedsPassword = mkOption {
+      type = types.bool;
+      default = true;
+      description = mdDoc ''
+        Whether users of the `wheel` group must
+        provide a password to run commands as super user via {command}`sudo`.
+      '';
+      };
+
+    execWheelOnly = mkOption {
+      type = types.bool;
+      default = false;
+      description = mdDoc ''
+        Only allow members of the `wheel` group to execute sudo by
+        setting the executable's permissions accordingly.
+        This prevents users that are not members of `wheel` from
+        exploiting vulnerabilities in sudo such as CVE-2021-3156.
+      '';
+    };
+
+    configFile = mkOption {
+      type = types.lines;
+      # Note: if syntax errors are detected in this file, the NixOS
+      # configuration will fail to build.
+      description = mdDoc ''
+        This string contains the contents of the
+        {file}`sudoers` file.
+      '';
+    };
+
+    extraRules = mkOption {
+      description = mdDoc ''
+        Define specific rules to be in the {file}`sudoers` file.
+        More specific rules should come after more general ones in order to
+        yield the expected behavior. You can use mkBefore/mkAfter to ensure
+        this is the case when configuration options are merged.
+      '';
+      default = [];
+      example = literalExpression ''
+        [
+          # Allow execution of any command by all users in group sudo,
+          # requiring a password.
+          { groups = [ "sudo" ]; commands = [ "ALL" ]; }
+
+          # Allow execution of "/home/root/secret.sh" by user `backup`, `database`
+          # and the group with GID `1006` without a password.
+          { users = [ "backup" "database" ]; groups = [ 1006 ];
+            commands = [ { command = "/home/root/secret.sh"; options = [ "SETENV" "NOPASSWD" ]; } ]; }
+
+          # Allow all users of group `bar` to run two executables as user `foo`
+          # with arguments being pre-set.
+          { groups = [ "bar" ]; runAs = "foo";
+            commands =
+              [ "/home/baz/cmd1.sh hello-sudo"
+                  { command = '''/home/baz/cmd2.sh ""'''; options = [ "SETENV" ]; } ]; }
+        ]
+      '';
+      type = with types; listOf (submodule {
+        options = {
+          users = mkOption {
+            type = with types; listOf (either str int);
+            description = mdDoc ''
+              The usernames / UIDs this rule should apply for.
+            '';
+            default = [];
+          };
+
+          groups = mkOption {
+            type = with types; listOf (either str int);
+            description = mdDoc ''
+              The groups / GIDs this rule should apply for.
+            '';
+            default = [];
+          };
+
+          host = mkOption {
+            type = types.str;
+            default = "ALL";
+            description = mdDoc ''
+              For what host this rule should apply.
+            '';
+          };
+
+          runAs = mkOption {
+            type = with types; str;
+            default = "ALL:ALL";
+            description = mdDoc ''
+              Under which user/group the specified command is allowed to run.
+
+              A user can be specified using just the username: `"foo"`.
+              It is also possible to specify a user/group combination using `"foo:bar"`
+              or to only allow running as a specific group with `":bar"`.
+            '';
+          };
+
+          commands = mkOption {
+            description = mdDoc ''
+              The commands for which the rule should apply.
+            '';
+            type = with types; listOf (either str (submodule {
+
+              options = {
+                command = mkOption {
+                  type = with types; str;
+                  description = mdDoc ''
+                    A command being either just a path to a binary to allow any arguments,
+                    the full command with arguments pre-set or with `""` used as the argument,
+                    not allowing arguments to the command at all.
+                  '';
+                };
+
+                options = mkOption {
+                  type = with types; listOf (enum [ "NOPASSWD" "PASSWD" "NOEXEC" "EXEC" "SETENV" "NOSETENV" "LOG_INPUT" "NOLOG_INPUT" "LOG_OUTPUT" "NOLOG_OUTPUT" ]);
+                  description = mdDoc ''
+                    Options for running the command. Refer to the [sudo manual](https://www.sudo.ws/man/1.7.10/sudoers.man.html).
+                  '';
+                  default = [];
+                };
+              };
+
+            }));
+          };
+        };
+      });
+    };
+
+    extraConfig = mkOption {
+      type = types.lines;
+      default = "";
+      description = mdDoc ''
+        Extra configuration text appended to {file}`sudoers`.
+      '';
+    };
+  };
+
+
+  ###### implementation
+
+  config = mkIf cfg.enable {
+    security.sudo-rs.extraRules =
+      let
+        defaultRule = { users ? [], groups ? [], opts ? [] }: [ {
+          inherit users groups;
+          commands = [ {
+            command = "ALL";
+            options = opts ++ cfg.defaultOptions;
+          } ];
+        } ];
+      in mkMerge [
+        # This is ordered before users' `mkBefore` rules,
+        # so as not to introduce unexpected changes.
+        (mkOrder 400 (defaultRule { users = [ "root" ]; }))
+
+        # This is ordered to show before (most) other rules, but
+        # late-enough for a user to `mkBefore` it.
+        (mkOrder 600 (defaultRule {
+          groups = [ "wheel" ];
+          opts = (optional (!cfg.wheelNeedsPassword) "NOPASSWD");
+        }))
+      ];
+
+    security.sudo-rs.configFile = concatStringsSep "\n" (filter (s: s != "") [
+      ''
+        # Don't edit this file. Set the NixOS options ‘security.sudo-rs.configFile’
+        # or ‘security.sudo-rs.extraRules’ instead.
+      ''
+      (optionalString enableSSHAgentAuth ''
+        # Keep SSH_AUTH_SOCK so that pam_ssh_agent_auth.so can do its magic.
+        Defaults env_keep+=SSH_AUTH_SOCK
+      '')
+      (concatStringsSep "\n" (
+        lists.flatten (
+          map (
+            rule: optionals (length rule.commands != 0) [
+              (map (user: "${toUserString user}	${rule.host}=(${rule.runAs})	${toCommandsString rule.commands}") rule.users)
+              (map (group: "${toGroupString group}	${rule.host}=(${rule.runAs})	${toCommandsString rule.commands}") rule.groups)
+            ]
+          ) cfg.extraRules
+        )
+      ) + "\n")
+      (optionalString (cfg.extraConfig != "") ''
+        # extraConfig
+        ${cfg.extraConfig}
+      '')
+    ]);
+
+    security.wrappers = let
+      owner = "root";
+      group = if cfg.execWheelOnly then "wheel" else "root";
+      setuid = true;
+      permissions = if cfg.execWheelOnly then "u+rx,g+x" else "u+rx,g+x,o+x";
+    in {
+      sudo = {
+        source = "${cfg.package.out}/bin/sudo";
+        inherit owner group setuid permissions;
+      };
+      # sudo-rs does not yet ship a sudoedit (as of v0.2.0)
+      sudoedit = mkIf usingMillersSudo {
+        source = "${cfg.package.out}/bin/sudoedit";
+        inherit owner group setuid permissions;
+      };
+    };
+
+    environment.systemPackages = [ sudo ];
+
+    security.pam.services.sudo = { sshAgentAuth = true; usshAuth = true; };
+    security.pam.services.sudo-i = mkIf usingSudoRs
+      { sshAgentAuth = true; usshAuth = true; };
+
+    environment.etc.sudoers =
+      { source =
+          pkgs.runCommand "sudoers"
+          {
+            src = pkgs.writeText "sudoers-in" cfg.configFile;
+            preferLocalBuild = true;
+          }
+          "${pkgs.buildPackages."${cfg.package.pname}"}/bin/visudo -f $src -c && cp $src $out";
+        mode = "0440";
+      };
+
+  };
+
+  meta.maintainers = [ lib.maintainers.nicoo ];
+
+}
diff --git a/nixos/modules/security/sudo.nix b/nixos/modules/security/sudo.nix
index 4bdbe9671e6d..d225442773c6 100644
--- a/nixos/modules/security/sudo.nix
+++ b/nixos/modules/security/sudo.nix
@@ -4,16 +4,9 @@ with lib;
 
 let
 
-  inherit (pkgs) sudo sudo-rs;
-
   cfg = config.security.sudo;
 
-  enableSSHAgentAuth =
-    with config.security;
-    pam.enableSSHAgentAuth && pam.sudo.sshAgentAuth;
-
-  usingMillersSudo = cfg.package.pname == sudo.pname;
-  usingSudoRs = cfg.package.pname == sudo-rs.pname;
+  inherit (pkgs) sudo;
 
   toUserString = user: if (isInt user) then "#${toString user}" else "${user}";
   toGroupString = group: if (isInt group) then "%#${toString group}" else "%${group}";
@@ -37,51 +30,41 @@ in
 
   ###### interface
 
-  options.security.sudo = {
+  options = {
 
-    defaultOptions = mkOption {
-      type = with types; listOf str;
-      default = optional usingMillersSudo "SETENV";
-      defaultText = literalMD ''
-        `[ "SETENV" ]` if using the default `sudo` implementation
-      '';
-      description = mdDoc ''
-        Options used for the default rules, granting `root` and the
-        `wheel` group permission to run any command as any user.
-      '';
-    };
-
-    enable = mkOption {
+    security.sudo.enable = mkOption {
       type = types.bool;
       default = true;
-      description = mdDoc ''
-        Whether to enable the {command}`sudo` command, which
-        allows non-root users to execute commands as root.
-      '';
+      description =
+        lib.mdDoc ''
+          Whether to enable the {command}`sudo` command, which
+          allows non-root users to execute commands as root.
+        '';
     };
 
-    package = mkOption {
+    security.sudo.package = mkOption {
       type = types.package;
       default = pkgs.sudo;
       defaultText = literalExpression "pkgs.sudo";
-      description = mdDoc ''
+      description = lib.mdDoc ''
         Which package to use for `sudo`.
       '';
     };
 
-    wheelNeedsPassword = mkOption {
+    security.sudo.wheelNeedsPassword = mkOption {
       type = types.bool;
       default = true;
-      description = mdDoc ''
-        Whether users of the `wheel` group must
-        provide a password to run commands as super user via {command}`sudo`.
-      '';
+      description =
+        lib.mdDoc ''
+          Whether users of the `wheel` group must
+          provide a password to run commands as super user via {command}`sudo`.
+        '';
       };
 
-    execWheelOnly = mkOption {
+    security.sudo.execWheelOnly = mkOption {
       type = types.bool;
       default = false;
-      description = mdDoc ''
+      description = lib.mdDoc ''
         Only allow members of the `wheel` group to execute sudo by
         setting the executable's permissions accordingly.
         This prevents users that are not members of `wheel` from
@@ -89,18 +72,19 @@ in
       '';
     };
 
-    configFile = mkOption {
+    security.sudo.configFile = mkOption {
       type = types.lines;
       # Note: if syntax errors are detected in this file, the NixOS
       # configuration will fail to build.
-      description = mdDoc ''
-        This string contains the contents of the
-        {file}`sudoers` file.
-      '';
+      description =
+        lib.mdDoc ''
+          This string contains the contents of the
+          {file}`sudoers` file.
+        '';
     };
 
-    extraRules = mkOption {
-      description = mdDoc ''
+    security.sudo.extraRules = mkOption {
+      description = lib.mdDoc ''
         Define specific rules to be in the {file}`sudoers` file.
         More specific rules should come after more general ones in order to
         yield the expected behavior. You can use mkBefore/mkAfter to ensure
@@ -130,7 +114,7 @@ in
         options = {
           users = mkOption {
             type = with types; listOf (either str int);
-            description = mdDoc ''
+            description = lib.mdDoc ''
               The usernames / UIDs this rule should apply for.
             '';
             default = [];
@@ -138,7 +122,7 @@ in
 
           groups = mkOption {
             type = with types; listOf (either str int);
-            description = mdDoc ''
+            description = lib.mdDoc ''
               The groups / GIDs this rule should apply for.
             '';
             default = [];
@@ -147,7 +131,7 @@ in
           host = mkOption {
             type = types.str;
             default = "ALL";
-            description = mdDoc ''
+            description = lib.mdDoc ''
               For what host this rule should apply.
             '';
           };
@@ -155,7 +139,7 @@ in
           runAs = mkOption {
             type = with types; str;
             default = "ALL:ALL";
-            description = mdDoc ''
+            description = lib.mdDoc ''
               Under which user/group the specified command is allowed to run.
 
               A user can be specified using just the username: `"foo"`.
@@ -165,7 +149,7 @@ in
           };
 
           commands = mkOption {
-            description = mdDoc ''
+            description = lib.mdDoc ''
               The commands for which the rule should apply.
             '';
             type = with types; listOf (either str (submodule {
@@ -173,7 +157,7 @@ in
               options = {
                 command = mkOption {
                   type = with types; str;
-                  description = mdDoc ''
+                  description = lib.mdDoc ''
                     A command being either just a path to a binary to allow any arguments,
                     the full command with arguments pre-set or with `""` used as the argument,
                     not allowing arguments to the command at all.
@@ -182,7 +166,7 @@ in
 
                 options = mkOption {
                   type = with types; listOf (enum [ "NOPASSWD" "PASSWD" "NOEXEC" "EXEC" "SETENV" "NOSETENV" "LOG_INPUT" "NOLOG_INPUT" "LOG_OUTPUT" "NOLOG_OUTPUT" ]);
-                  description = mdDoc ''
+                  description = lib.mdDoc ''
                     Options for running the command. Refer to the [sudo manual](https://www.sudo.ws/man/1.7.10/sudoers.man.html).
                   '';
                   default = [];
@@ -195,10 +179,10 @@ in
       });
     };
 
-    extraConfig = mkOption {
+    security.sudo.extraConfig = mkOption {
       type = types.lines;
       default = "";
-      description = mdDoc ''
+      description = lib.mdDoc ''
         Extra configuration text appended to {file}`sudoers`.
       '';
     };
@@ -208,52 +192,44 @@ in
   ###### implementation
 
   config = mkIf cfg.enable {
-    security.sudo.extraRules =
-      let
-        defaultRule = { users ? [], groups ? [], opts ? [] }: [ {
-          inherit users groups;
-          commands = [ {
-            command = "ALL";
-            options = opts ++ cfg.defaultOptions;
-          } ];
-        } ];
-      in mkMerge [
-        # This is ordered before users' `mkBefore` rules,
-        # so as not to introduce unexpected changes.
-        (mkOrder 400 (defaultRule { users = [ "root" ]; }))
+    assertions = [
+      { assertion = cfg.package.pname != "sudo-rs";
+        message = "The NixOS `sudo` module does not work with `sudo-rs` yet."; }
+    ];
 
-        # This is ordered to show before (most) other rules, but
-        # late-enough for a user to `mkBefore` it.
-        (mkOrder 600 (defaultRule {
-          groups = [ "wheel" ];
-          opts = (optional (!cfg.wheelNeedsPassword) "NOPASSWD");
-        }))
-      ];
+    # We `mkOrder 600` so that the default rule shows up first, but there is
+    # still enough room for a user to `mkBefore` it.
+    security.sudo.extraRules = mkOrder 600 [
+      { groups = [ "wheel" ];
+        commands = [ { command = "ALL"; options = (if cfg.wheelNeedsPassword then [ "SETENV" ] else [ "NOPASSWD" "SETENV" ]); } ];
+      }
+    ];
 
-    security.sudo.configFile = concatStringsSep "\n" (filter (s: s != "") [
+    security.sudo.configFile =
       ''
         # Don't edit this file. Set the NixOS options ‘security.sudo.configFile’
         # or ‘security.sudo.extraRules’ instead.
-      ''
-      (optionalString enableSSHAgentAuth ''
+
         # Keep SSH_AUTH_SOCK so that pam_ssh_agent_auth.so can do its magic.
         Defaults env_keep+=SSH_AUTH_SOCK
-      '')
-      (concatStringsSep "\n" (
-        lists.flatten (
-          map (
-            rule: optionals (length rule.commands != 0) [
-              (map (user: "${toUserString user}	${rule.host}=(${rule.runAs})	${toCommandsString rule.commands}") rule.users)
-              (map (group: "${toGroupString group}	${rule.host}=(${rule.runAs})	${toCommandsString rule.commands}") rule.groups)
-            ]
-          ) cfg.extraRules
-        )
-      ) + "\n")
-      (optionalString (cfg.extraConfig != "") ''
-        # extraConfig
+
+        # "root" is allowed to do anything.
+        root        ALL=(ALL:ALL) SETENV: ALL
+
+        # extraRules
+        ${concatStringsSep "\n" (
+          lists.flatten (
+            map (
+              rule: optionals (length rule.commands != 0) [
+                (map (user: "${toUserString user}	${rule.host}=(${rule.runAs})	${toCommandsString rule.commands}") rule.users)
+                (map (group: "${toGroupString group}	${rule.host}=(${rule.runAs})	${toCommandsString rule.commands}") rule.groups)
+              ]
+            ) cfg.extraRules
+          )
+        )}
+
         ${cfg.extraConfig}
-      '')
-    ]);
+      '';
 
     security.wrappers = let
       owner = "root";
@@ -265,8 +241,7 @@ in
         source = "${cfg.package.out}/bin/sudo";
         inherit owner group setuid permissions;
       };
-      # sudo-rs does not yet ship a sudoedit (as of v0.2.0)
-      sudoedit = mkIf usingMillersSudo {
+      sudoedit = {
         source = "${cfg.package.out}/bin/sudoedit";
         inherit owner group setuid permissions;
       };
@@ -275,8 +250,6 @@ in
     environment.systemPackages = [ sudo ];
 
     security.pam.services.sudo = { sshAgentAuth = true; usshAuth = true; };
-    security.pam.services.sudo-i = mkIf usingSudoRs
-      { sshAgentAuth = true; usshAuth = true; };
 
     environment.etc.sudoers =
       { source =
@@ -285,12 +258,12 @@ in
             src = pkgs.writeText "sudoers-in" cfg.configFile;
             preferLocalBuild = true;
           }
-          "${cfg.package}/bin/visudo -f $src -c && cp $src $out";
+          # Make sure that the sudoers file is syntactically valid.
+          # (currently disabled - NIXOS-66)
+          "${pkgs.buildPackages.sudo}/sbin/visudo -f $src -c && cp $src $out";
         mode = "0440";
       };
 
   };
 
-  meta.maintainers = [ lib.maintainers.nicoo ];
-
 }
diff --git a/nixos/modules/services/matrix/synapse.nix b/nixos/modules/services/matrix/synapse.nix
index 5cce36f41e50..1354a8cb58b4 100644
--- a/nixos/modules/services/matrix/synapse.nix
+++ b/nixos/modules/services/matrix/synapse.nix
@@ -1022,7 +1022,7 @@ in {
 
     systemd.targets.matrix-synapse = lib.mkIf hasWorkers {
       description = "Synapse Matrix parent target";
-      after = [ "network.target" ] ++ optional hasLocalPostgresDB "postgresql.service";
+      after = [ "network-online.target" ] ++ optional hasLocalPostgresDB "postgresql.service";
       wantedBy = [ "multi-user.target" ];
     };
 
@@ -1036,7 +1036,7 @@ in {
             unitConfig.ReloadPropagatedFrom = "matrix-synapse.target";
           }
           else {
-            after = [ "network.target" ] ++ optional hasLocalPostgresDB "postgresql.service";
+            after = [ "network-online.target" ] ++ optional hasLocalPostgresDB "postgresql.service";
             wantedBy = [ "multi-user.target" ];
           };
         baseServiceConfig = {
diff --git a/nixos/modules/services/misc/mbpfan.nix b/nixos/modules/services/misc/mbpfan.nix
index e75c35254143..8f64fb2d9c52 100644
--- a/nixos/modules/services/misc/mbpfan.nix
+++ b/nixos/modules/services/misc/mbpfan.nix
@@ -26,7 +26,7 @@ in {
 
     aggressive = mkOption {
       type = types.bool;
-      default = false;
+      default = true;
       description = lib.mdDoc "If true, favors higher default fan speeds.";
     };
 
@@ -38,17 +38,20 @@ in {
 
         options.general.low_temp = mkOption {
           type = types.int;
-          default = 63;
+          default = (if cfg.aggressive then 55 else 63);
+          defaultText = literalExpression "55";
           description = lib.mdDoc "If temperature is below this, fans will run at minimum speed.";
         };
         options.general.high_temp = mkOption {
           type = types.int;
-          default = 66;
+          default = (if cfg.aggressive then 58 else 66);
+          defaultText = literalExpression "58";
           description = lib.mdDoc "If temperature is above this, fan speed will gradually increase.";
         };
         options.general.max_temp = mkOption {
           type = types.int;
-          default = 86;
+          default = (if cfg.aggressive then 78 else 86);
+          defaultText = literalExpression "78";
           description = lib.mdDoc "If temperature is above this, fans will run at maximum speed.";
         };
         options.general.polling_interval = mkOption {
@@ -70,13 +73,6 @@ in {
   ];
 
   config = mkIf cfg.enable {
-    services.mbpfan.settings = mkIf cfg.aggressive {
-      general.min_fan1_speed = mkDefault 2000;
-      general.low_temp = mkDefault 55;
-      general.high_temp = mkDefault 58;
-      general.max_temp = mkDefault 70;
-    };
-
     boot.kernelModules = [ "coretemp" "applesmc" ];
     environment.systemPackages = [ cfg.package ];
     environment.etc."mbpfan.conf".source = settingsFile;
@@ -86,6 +82,7 @@ in {
       wantedBy = [ "sysinit.target" ];
       after = [ "syslog.target" "sysinit.target" ];
       restartTriggers = [ config.environment.etc."mbpfan.conf".source ];
+
       serviceConfig = {
         Type = "simple";
         ExecStart = "${cfg.package}/bin/mbpfan -f${verbose}";
diff --git a/nixos/modules/services/search/typesense.nix b/nixos/modules/services/search/typesense.nix
index 856c3cad22df..c158d04fea23 100644
--- a/nixos/modules/services/search/typesense.nix
+++ b/nixos/modules/services/search/typesense.nix
@@ -83,12 +83,12 @@ in {
         Group = "typesense";
 
         StateDirectory = "typesense";
-        StateDirectoryMode = "0700";
+        StateDirectoryMode = "0750";
 
         # Hardening
         CapabilityBoundingSet = "";
         LockPersonality = true;
-        MemoryDenyWriteExecute = true;
+        # MemoryDenyWriteExecute = true; needed since 0.25.1
         NoNewPrivileges = true;
         PrivateUsers = true;
         PrivateTmp = true;
diff --git a/nixos/modules/system/activation/switch-to-configuration.pl b/nixos/modules/system/activation/switch-to-configuration.pl
index 8bd450d7343b..e05f89bb0fb4 100755
--- a/nixos/modules/system/activation/switch-to-configuration.pl
+++ b/nixos/modules/system/activation/switch-to-configuration.pl
@@ -74,7 +74,7 @@ if ("@localeArchive@" ne "") {
 
 if (!defined($action) || ($action ne "switch" && $action ne "boot" && $action ne "test" && $action ne "dry-activate")) {
     print STDERR <<"EOF";
-Usage: $0 [switch|boot|test]
+Usage: $0 [switch|boot|test|dry-activate]
 
 switch:       make the configuration the boot default and activate now
 boot:         make the configuration the boot default
@@ -661,10 +661,20 @@ foreach my $mount_point (keys(%{$cur_fss})) {
         # Filesystem entry disappeared, so unmount it.
         $units_to_stop{$unit} = 1;
     } elsif ($cur->{fsType} ne $new->{fsType} || $cur->{device} ne $new->{device}) {
-        # Filesystem type or device changed, so unmount and mount it.
-        $units_to_stop{$unit} = 1;
-        $units_to_start{$unit} = 1;
-        record_unit($start_list_file, $unit);
+        if ($mount_point eq '/' or $mount_point eq '/nix') {
+            if ($cur->{options} ne $new->{options}) {
+                # Mount options changed, so remount it.
+                $units_to_reload{$unit} = 1;
+                record_unit($reload_list_file, $unit);
+            } else {
+                # Don't unmount / or /nix if the device changed
+                $units_to_skip{$unit} = 1;
+            }
+        } else {
+            # Filesystem type or device changed, so unmount and mount it.
+            $units_to_restart{$unit} = 1;
+            record_unit($restart_list_file, $unit);
+        }
     } elsif ($cur->{options} ne $new->{options}) {
         # Mount options changes, so remount it.
         $units_to_reload{$unit} = 1;
diff --git a/nixos/modules/system/boot/loader/generic-extlinux-compatible/extlinux-conf-builder.sh b/nixos/modules/system/boot/loader/generic-extlinux-compatible/extlinux-conf-builder.sh
index 1a0da0050291..84a0a93ded17 100644
--- a/nixos/modules/system/boot/loader/generic-extlinux-compatible/extlinux-conf-builder.sh
+++ b/nixos/modules/system/boot/loader/generic-extlinux-compatible/extlinux-conf-builder.sh
@@ -70,13 +70,33 @@ copyToKernelsDir() {
 addEntry() {
     local path=$(readlink -f "$1")
     local tag="$2" # Generation number or 'default'
+    local current="$3" # whether this is the current/latest generation
 
     if ! test -e $path/kernel -a -e $path/initrd; then
         return
     fi
 
+    if test -e "$path/append-initrd-secrets"; then
+        local initrd="$target/nixos/$(basename "$path")-initramfs-with-secrets"
+        cp $(readlink -f "$path/initrd") "$initrd"
+        chmod 600 "${initrd}"
+        chown 0:0 "${initrd}"
+        filesCopied[$initrd]=1
+
+        "$path/append-initrd-secrets" "$initrd" || if test "${current}" = "1"; then
+            echo "failed to create initrd secrets for the current generation." >&2
+            echo "are your \`boot.initrd.secrets\` still in place?" >&2
+            exit 1
+        else
+            echo "warning: failed to create initrd secrets for \"$path\", an older generation" >&2
+            echo "note: this is normal after having removed or renamed a file in \`boot.initrd.secrets\`" >&2
+        fi
+    else
+        copyToKernelsDir "$path/initrd"; initrd=$result
+    fi
+
     copyToKernelsDir "$path/kernel"; kernel=$result
-    copyToKernelsDir "$path/initrd"; initrd=$result
+
     dtbDir=$(readlink -m "$path/dtbs")
     if [ -e "$dtbDir" ]; then
         copyToKernelsDir "$dtbDir"; dtbs=$result
@@ -130,18 +150,20 @@ MENU TITLE ------------------------------------------------------------
 TIMEOUT $timeout
 EOF
 
-addEntry $default default >> $tmpFile
+addEntry $default default 1 >> $tmpFile
 
 if [ "$numGenerations" -gt 0 ]; then
     # Add up to $numGenerations generations of the system profile to the menu,
     # in reverse (most recent to least recent) order.
+    current=1
     for generation in $(
             (cd /nix/var/nix/profiles && ls -d system-*-link) \
             | sed 's/system-\([0-9]\+\)-link/\1/' \
             | sort -n -r \
             | head -n $numGenerations); do
         link=/nix/var/nix/profiles/system-$generation-link
-        addEntry $link $generation
+        addEntry $link $generation $current
+        current=0
     done >> $tmpFile
 fi
 
diff --git a/nixos/modules/system/boot/loader/raspberrypi/raspberrypi.nix b/nixos/modules/system/boot/loader/raspberrypi/raspberrypi.nix
index 9c9bee93de8a..c64ef092667b 100644
--- a/nixos/modules/system/boot/loader/raspberrypi/raspberrypi.nix
+++ b/nixos/modules/system/boot/loader/raspberrypi/raspberrypi.nix
@@ -142,6 +142,7 @@ in
         assertion = !pkgs.stdenv.hostPlatform.isAarch64 || cfg.version >= 3;
         message = "Only Raspberry Pi >= 3 supports aarch64.";
       };
+      boot.loader.supportsInitrdSecrets = cfg.uboot.enable;
 
       system.build.installBootLoader = builder;
       system.boot.loader.id = "raspberrypi";
diff --git a/nixos/modules/system/boot/stage-1.nix b/nixos/modules/system/boot/stage-1.nix
index a3551f68dbe8..1cf58dbe9f1f 100644
--- a/nixos/modules/system/boot/stage-1.nix
+++ b/nixos/modules/system/boot/stage-1.nix
@@ -610,6 +610,13 @@ in
             path the secret should have inside the initrd, the value
             is the path it should be copied from (or null for the same
             path inside and out).
+
+            The loader `generic-extlinux-compatible` supports this. Because
+            it is not well know how different implementations react to
+            concatenated cpio archives, this is disabled by default. It can be
+            enabled by setting {option}`boot.loader.supportsInitrdSecrets`
+            to true. If this works for you, please report your findings at
+            https://github.com/NixOS/nixpkgs/issues/247145 .
           '';
         example = literalExpression
           ''
diff --git a/nixos/tests/sudo-rs.nix b/nixos/tests/sudo-rs.nix
index 150c0d5b4f1d..6006863217b6 100644
--- a/nixos/tests/sudo-rs.nix
+++ b/nixos/tests/sudo-rs.nix
@@ -5,7 +5,7 @@ let
   password = "helloworld";
 in
   import ./make-test-python.nix ({ lib, pkgs, ...} : {
-    name = "sudo";
+    name = "sudo-rs";
     meta.maintainers = pkgs.sudo-rs.meta.maintainers;
 
     nodes.machine =
@@ -22,7 +22,9 @@ in
           test5 = { isNormalUser = true; };
         };
 
-        security.sudo = {
+        security.sudo.enable = false;
+
+        security.sudo-rs = {
           enable = true;
           package = pkgs.sudo-rs;
           wheelNeedsPassword = false;
@@ -54,7 +56,9 @@ in
         noadmin = { isNormalUser = true; };
       };
 
-      security.sudo = {
+      security.sudo.enable = false;
+
+      security.sudo-rs = {
         package = pkgs.sudo-rs;
         enable = true;
         wheelNeedsPassword = false;
@@ -86,7 +90,7 @@ in
             machine.succeed("sudo -u test5 sudo -n -u test1 true")
 
         with subtest("test5 user should not be able to run commands under root"):
-            machine.fail("sudo -u test5 sudo -n -u root true")
+            machine.fail("sudo -u test5 sudo -n -u root true 2>/dev/null")
 
         with subtest("users in wheel should be able to run sudo despite execWheelOnly"):
             strict.succeed('faketty -- su - admin -c "sudo -u root true"')
diff --git a/nixos/tests/switch-test.nix b/nixos/tests/switch-test.nix
index 529a20864206..5ffdf180d5e3 100644
--- a/nixos/tests/switch-test.nix
+++ b/nixos/tests/switch-test.nix
@@ -58,6 +58,37 @@ in {
       '');
 
       specialisation = rec {
+        brokenInitInterface.configuration.config.system.extraSystemBuilderCmds = ''
+          echo "systemd 0" > $out/init-interface-version
+        '';
+
+        modifiedSystemConf.configuration.systemd.extraConfig = ''
+          # Hello world!
+        '';
+
+        addedMount.configuration.virtualisation.fileSystems."/test" = {
+          device = "tmpfs";
+          fsType = "tmpfs";
+        };
+
+        addedMountOptsModified.configuration = {
+          imports = [ addedMount.configuration ];
+          virtualisation.fileSystems."/test".options = [ "x-test" ];
+        };
+
+        addedMountDevModified.configuration = {
+          imports = [ addedMountOptsModified.configuration ];
+          virtualisation.fileSystems."/test".device = lib.mkForce "ramfs";
+        };
+
+        storeMountModified.configuration = {
+          virtualisation.fileSystems."/".device = lib.mkForce "auto";
+        };
+
+        swap.configuration.swapDevices = lib.mkVMOverride [
+          { device = "/swapfile"; size = 1; }
+        ];
+
         simpleService.configuration = {
           systemd.services.test = {
             wantedBy = [ "multi-user.target" ];
@@ -643,6 +674,97 @@ in {
 
         # test and dry-activate actions are tested further down below
 
+        # invalid action fails the script
+        switch_to_specialisation("${machine}", "", action="broken-action", fail=True)
+        # no action fails the script
+        assert "Usage:" in machine.fail("${machine}/bin/switch-to-configuration 2>&1")
+
+    with subtest("init interface version"):
+        # Do not try to switch to an invalid init interface version
+        assert "incompatible" in switch_to_specialisation("${machine}", "brokenInitInterface", fail=True)
+
+    with subtest("systemd restarts"):
+        # systemd is restarted when its system.conf changes
+        out = switch_to_specialisation("${machine}", "modifiedSystemConf")
+        assert_contains(out, "restarting systemd...")
+
+    with subtest("continuing from an aborted switch"):
+        # An aborted switch will write into a file what it tried to start
+        # and a second switch should continue from this
+        machine.succeed("echo dbus.service > /run/nixos/start-list")
+        out = switch_to_specialisation("${machine}", "modifiedSystemConf")
+        assert_contains(out, "starting the following units: dbus.service\n")
+
+    with subtest("fstab mounts"):
+        switch_to_specialisation("${machine}", "")
+        # add a mountpoint
+        out = switch_to_specialisation("${machine}", "addedMount")
+        assert_lacks(out, "stopping the following units:")
+        assert_lacks(out, "NOT restarting the following changed units:")
+        assert_lacks(out, "\nrestarting the following units:")
+        assert_lacks(out, "\nstarting the following units:")
+        assert_contains(out, "the following new units were started: test.mount\n")
+        # modify the mountpoint's options
+        out = switch_to_specialisation("${machine}", "addedMountOptsModified")
+        assert_lacks(out, "stopping the following units:")
+        assert_lacks(out, "NOT restarting the following changed units:")
+        assert_contains(out, "reloading the following units: test.mount\n")
+        assert_lacks(out, "\nrestarting the following units:")
+        assert_lacks(out, "\nstarting the following units:")
+        assert_lacks(out, "the following new units were started:")
+        # modify the device
+        out = switch_to_specialisation("${machine}", "addedMountDevModified")
+        assert_lacks(out, "stopping the following units:")
+        assert_lacks(out, "NOT restarting the following changed units:")
+        assert_lacks(out, "reloading the following units:")
+        assert_contains(out, "\nrestarting the following units: test.mount\n")
+        assert_lacks(out, "\nstarting the following units:")
+        assert_lacks(out, "the following new units were started:")
+        # modify both
+        out = switch_to_specialisation("${machine}", "addedMount")
+        assert_lacks(out, "stopping the following units:")
+        assert_lacks(out, "NOT restarting the following changed units:")
+        assert_lacks(out, "reloading the following units:")
+        assert_contains(out, "\nrestarting the following units: test.mount\n")
+        assert_lacks(out, "\nstarting the following units:")
+        assert_lacks(out, "the following new units were started:")
+        # remove the mount
+        out = switch_to_specialisation("${machine}", "")
+        assert_contains(out, "stopping the following units: test.mount\n")
+        assert_lacks(out, "NOT restarting the following changed units:")
+        assert_contains(out, "reloading the following units: dbus.service\n")
+        assert_lacks(out, "\nrestarting the following units:")
+        assert_lacks(out, "\nstarting the following units:")
+        assert_lacks(out, "the following new units were started:")
+        # change something about the / mount
+        out = switch_to_specialisation("${machine}", "storeMountModified")
+        assert_lacks(out, "stopping the following units:")
+        assert_contains(out, "NOT restarting the following changed units: -.mount")
+        assert_contains(out, "reloading the following units: dbus.service\n")
+        assert_lacks(out, "\nrestarting the following units:")
+        assert_lacks(out, "\nstarting the following units:")
+        assert_lacks(out, "the following new units were started:")
+
+    with subtest("swaps"):
+        switch_to_specialisation("${machine}", "")
+        # add a swap
+        out = switch_to_specialisation("${machine}", "swap")
+        assert_lacks(out, "stopping the following units:")
+        assert_lacks(out, "NOT restarting the following changed units:")
+        assert_contains(out, "reloading the following units: dbus.service\n")
+        assert_lacks(out, "\nrestarting the following units:")
+        assert_lacks(out, "\nstarting the following units:")
+        assert_contains(out, "the following new units were started: swapfile.swap")
+        # remove it
+        out = switch_to_specialisation("${machine}", "")
+        assert_contains(out, "stopping swap device: /swapfile")
+        assert_lacks(out, "stopping the following units:")
+        assert_lacks(out, "NOT restarting the following changed units:")
+        assert_contains(out, "reloading the following units: dbus.service\n")
+        assert_lacks(out, "\nrestarting the following units:")
+        assert_lacks(out, "\nstarting the following units:")
+        assert_lacks(out, "the following new units were started:")
+
     with subtest("services"):
         switch_to_specialisation("${machine}", "")
         # Nothing happens when nothing is changed
diff --git a/pkgs/applications/blockchains/dcrctl/default.nix b/pkgs/applications/blockchains/dcrctl/default.nix
index 31e56254ee78..97f9b7767db7 100644
--- a/pkgs/applications/blockchains/dcrctl/default.nix
+++ b/pkgs/applications/blockchains/dcrctl/default.nix
@@ -19,6 +19,6 @@ buildGoModule rec {
     homepage = "https://decred.org";
     description = "A secure Decred wallet daemon written in Go (golang)";
     license = with lib.licenses; [ isc ];
-    maintainers = with lib.maintainers; [ aaronjheng ];
+    maintainers = with lib.maintainers; [ ];
   };
 }
diff --git a/pkgs/applications/editors/jetbrains/plugins/plugins.json b/pkgs/applications/editors/jetbrains/plugins/plugins.json
index dd86e3e807ed..7dacad6e7a46 100644
--- a/pkgs/applications/editors/jetbrains/plugins/plugins.json
+++ b/pkgs/applications/editors/jetbrains/plugins/plugins.json
@@ -21,12 +21,12 @@
         "232.9559.28": "https://plugins.jetbrains.com/files/164/390591/IdeaVim-2.5.1-signed.zip",
         "232.9559.58": "https://plugins.jetbrains.com/files/164/390591/IdeaVim-2.5.1-signed.zip",
         "232.9559.61": "https://plugins.jetbrains.com/files/164/390591/IdeaVim-2.5.1-signed.zip",
-        "232.9559.64": "https://plugins.jetbrains.com/files/164/390591/IdeaVim-2.5.1-signed.zip",
         "232.9921.42": "https://plugins.jetbrains.com/files/164/390591/IdeaVim-2.5.1-signed.zip",
-        "232.9921.46": "https://plugins.jetbrains.com/files/164/390591/IdeaVim-2.5.1-signed.zip",
         "232.9921.47": "https://plugins.jetbrains.com/files/164/390591/IdeaVim-2.5.1-signed.zip",
         "232.9921.48": "https://plugins.jetbrains.com/files/164/390591/IdeaVim-2.5.1-signed.zip",
-        "232.9921.53": "https://plugins.jetbrains.com/files/164/390591/IdeaVim-2.5.1-signed.zip"
+        "232.9921.53": "https://plugins.jetbrains.com/files/164/390591/IdeaVim-2.5.1-signed.zip",
+        "232.9921.55": "https://plugins.jetbrains.com/files/164/390591/IdeaVim-2.5.1-signed.zip",
+        "232.9921.62": "https://plugins.jetbrains.com/files/164/390591/IdeaVim-2.5.1-signed.zip"
       },
       "name": "ideavim"
     },
@@ -60,12 +60,12 @@
         "232.9559.28": null,
         "232.9559.58": null,
         "232.9559.61": null,
-        "232.9559.64": null,
         "232.9921.42": null,
-        "232.9921.46": null,
         "232.9921.47": null,
         "232.9921.48": null,
-        "232.9921.53": null
+        "232.9921.53": null,
+        "232.9921.55": null,
+        "232.9921.62": null
       },
       "name": "kotlin"
     },
@@ -90,12 +90,12 @@
         "232.9559.28": "https://plugins.jetbrains.com/files/6981/383851/ini-232.9559.64.zip",
         "232.9559.58": "https://plugins.jetbrains.com/files/6981/383851/ini-232.9559.64.zip",
         "232.9559.61": "https://plugins.jetbrains.com/files/6981/383851/ini-232.9559.64.zip",
-        "232.9559.64": "https://plugins.jetbrains.com/files/6981/383851/ini-232.9559.64.zip",
-        "232.9921.42": "https://plugins.jetbrains.com/files/6981/393737/ini-232.9921.36.zip",
-        "232.9921.46": "https://plugins.jetbrains.com/files/6981/393737/ini-232.9921.36.zip",
-        "232.9921.47": "https://plugins.jetbrains.com/files/6981/393737/ini-232.9921.36.zip",
-        "232.9921.48": "https://plugins.jetbrains.com/files/6981/393737/ini-232.9921.36.zip",
-        "232.9921.53": "https://plugins.jetbrains.com/files/6981/393737/ini-232.9921.36.zip"
+        "232.9921.42": "https://plugins.jetbrains.com/files/6981/398535/ini-232.9921.55.zip",
+        "232.9921.47": "https://plugins.jetbrains.com/files/6981/398535/ini-232.9921.55.zip",
+        "232.9921.48": "https://plugins.jetbrains.com/files/6981/398535/ini-232.9921.55.zip",
+        "232.9921.53": "https://plugins.jetbrains.com/files/6981/398535/ini-232.9921.55.zip",
+        "232.9921.55": "https://plugins.jetbrains.com/files/6981/398535/ini-232.9921.55.zip",
+        "232.9921.62": "https://plugins.jetbrains.com/files/6981/398535/ini-232.9921.55.zip"
       },
       "name": "ini"
     },
@@ -105,8 +105,8 @@
         "phpstorm"
       ],
       "builds": {
-        "232.9559.64": "https://plugins.jetbrains.com/files/7219/389222/Symfony_Plugin-2022.1.256.zip",
-        "232.9921.47": "https://plugins.jetbrains.com/files/7219/389222/Symfony_Plugin-2022.1.256.zip"
+        "232.9921.47": "https://plugins.jetbrains.com/files/7219/401047/Symfony_Plugin-2022.1.257.zip",
+        "232.9921.55": "https://plugins.jetbrains.com/files/7219/401047/Symfony_Plugin-2022.1.257.zip"
       },
       "name": "symfony-support"
     },
@@ -116,8 +116,8 @@
         "phpstorm"
       ],
       "builds": {
-        "232.9559.64": "https://plugins.jetbrains.com/files/7320/346181/PHP_Annotations-9.4.0.zip",
-        "232.9921.47": "https://plugins.jetbrains.com/files/7320/346181/PHP_Annotations-9.4.0.zip"
+        "232.9921.47": "https://plugins.jetbrains.com/files/7320/346181/PHP_Annotations-9.4.0.zip",
+        "232.9921.55": "https://plugins.jetbrains.com/files/7320/346181/PHP_Annotations-9.4.0.zip"
       },
       "name": "php-annotations"
     },
@@ -132,9 +132,9 @@
       "builds": {
         "232.9559.28": "https://plugins.jetbrains.com/files/7322/381781/python-ce-232.9559.62.zip",
         "232.9559.61": "https://plugins.jetbrains.com/files/7322/381781/python-ce-232.9559.62.zip",
-        "232.9921.46": "https://plugins.jetbrains.com/files/7322/395441/python-ce-232.9921.47.zip",
-        "232.9921.47": "https://plugins.jetbrains.com/files/7322/395441/python-ce-232.9921.47.zip",
-        "232.9921.53": "https://plugins.jetbrains.com/files/7322/395441/python-ce-232.9921.47.zip"
+        "232.9921.47": "https://plugins.jetbrains.com/files/7322/401058/python-ce-232.9921.77.zip",
+        "232.9921.53": "https://plugins.jetbrains.com/files/7322/401058/python-ce-232.9921.77.zip",
+        "232.9921.62": "https://plugins.jetbrains.com/files/7322/401058/python-ce-232.9921.77.zip"
       },
       "name": "python-community-edition"
     },
@@ -158,11 +158,11 @@
         "232.9559.28": "https://plugins.jetbrains.com/files/8182/395553/intellij-rust-0.4.201.5424-232.zip",
         "232.9559.58": "https://plugins.jetbrains.com/files/8182/395553/intellij-rust-0.4.201.5424-232.zip",
         "232.9559.61": "https://plugins.jetbrains.com/files/8182/395553/intellij-rust-0.4.201.5424-232.zip",
-        "232.9559.64": "https://plugins.jetbrains.com/files/8182/395553/intellij-rust-0.4.201.5424-232.zip",
         "232.9921.42": "https://plugins.jetbrains.com/files/8182/395553/intellij-rust-0.4.201.5424-232.zip",
         "232.9921.47": "https://plugins.jetbrains.com/files/8182/395553/intellij-rust-0.4.201.5424-232.zip",
         "232.9921.48": "https://plugins.jetbrains.com/files/8182/395553/intellij-rust-0.4.201.5424-232.zip",
-        "232.9921.53": "https://plugins.jetbrains.com/files/8182/395553/intellij-rust-0.4.201.5424-232.zip"
+        "232.9921.53": "https://plugins.jetbrains.com/files/8182/395553/intellij-rust-0.4.201.5424-232.zip",
+        "232.9921.55": "https://plugins.jetbrains.com/files/8182/395553/intellij-rust-0.4.201.5424-232.zip"
       },
       "name": "-deprecated-rust"
     },
@@ -186,11 +186,11 @@
         "232.9559.28": "https://plugins.jetbrains.com/files/8182/372556/intellij-rust-0.4.200.5420-232-beta.zip",
         "232.9559.58": "https://plugins.jetbrains.com/files/8182/372556/intellij-rust-0.4.200.5420-232-beta.zip",
         "232.9559.61": "https://plugins.jetbrains.com/files/8182/372556/intellij-rust-0.4.200.5420-232-beta.zip",
-        "232.9559.64": "https://plugins.jetbrains.com/files/8182/372556/intellij-rust-0.4.200.5420-232-beta.zip",
         "232.9921.42": "https://plugins.jetbrains.com/files/8182/372556/intellij-rust-0.4.200.5420-232-beta.zip",
         "232.9921.47": "https://plugins.jetbrains.com/files/8182/372556/intellij-rust-0.4.200.5420-232-beta.zip",
         "232.9921.48": "https://plugins.jetbrains.com/files/8182/372556/intellij-rust-0.4.200.5420-232-beta.zip",
-        "232.9921.53": "https://plugins.jetbrains.com/files/8182/372556/intellij-rust-0.4.200.5420-232-beta.zip"
+        "232.9921.53": "https://plugins.jetbrains.com/files/8182/372556/intellij-rust-0.4.200.5420-232-beta.zip",
+        "232.9921.55": "https://plugins.jetbrains.com/files/8182/372556/intellij-rust-0.4.200.5420-232-beta.zip"
       },
       "name": "-deprecated-rust-beta"
     },
@@ -234,12 +234,12 @@
         "232.9559.28": "https://plugins.jetbrains.com/files/8607/370632/NixIDEA-0.4.0.10.zip",
         "232.9559.58": "https://plugins.jetbrains.com/files/8607/370632/NixIDEA-0.4.0.10.zip",
         "232.9559.61": "https://plugins.jetbrains.com/files/8607/370632/NixIDEA-0.4.0.10.zip",
-        "232.9559.64": "https://plugins.jetbrains.com/files/8607/370632/NixIDEA-0.4.0.10.zip",
         "232.9921.42": "https://plugins.jetbrains.com/files/8607/370632/NixIDEA-0.4.0.10.zip",
-        "232.9921.46": "https://plugins.jetbrains.com/files/8607/370632/NixIDEA-0.4.0.10.zip",
         "232.9921.47": "https://plugins.jetbrains.com/files/8607/370632/NixIDEA-0.4.0.10.zip",
         "232.9921.48": "https://plugins.jetbrains.com/files/8607/370632/NixIDEA-0.4.0.10.zip",
-        "232.9921.53": "https://plugins.jetbrains.com/files/8607/370632/NixIDEA-0.4.0.10.zip"
+        "232.9921.53": "https://plugins.jetbrains.com/files/8607/370632/NixIDEA-0.4.0.10.zip",
+        "232.9921.55": "https://plugins.jetbrains.com/files/8607/370632/NixIDEA-0.4.0.10.zip",
+        "232.9921.62": "https://plugins.jetbrains.com/files/8607/370632/NixIDEA-0.4.0.10.zip"
       },
       "name": "nixidea"
     },
@@ -273,12 +273,12 @@
         "232.9559.28": "https://plugins.jetbrains.com/files/10037/358813/CSVEditor-3.2.1-232.zip",
         "232.9559.58": "https://plugins.jetbrains.com/files/10037/358813/CSVEditor-3.2.1-232.zip",
         "232.9559.61": "https://plugins.jetbrains.com/files/10037/358813/CSVEditor-3.2.1-232.zip",
-        "232.9559.64": "https://plugins.jetbrains.com/files/10037/358813/CSVEditor-3.2.1-232.zip",
         "232.9921.42": "https://plugins.jetbrains.com/files/10037/358813/CSVEditor-3.2.1-232.zip",
-        "232.9921.46": "https://plugins.jetbrains.com/files/10037/358813/CSVEditor-3.2.1-232.zip",
         "232.9921.47": "https://plugins.jetbrains.com/files/10037/358813/CSVEditor-3.2.1-232.zip",
         "232.9921.48": "https://plugins.jetbrains.com/files/10037/358813/CSVEditor-3.2.1-232.zip",
-        "232.9921.53": "https://plugins.jetbrains.com/files/10037/358813/CSVEditor-3.2.1-232.zip"
+        "232.9921.53": "https://plugins.jetbrains.com/files/10037/358813/CSVEditor-3.2.1-232.zip",
+        "232.9921.55": "https://plugins.jetbrains.com/files/10037/358813/CSVEditor-3.2.1-232.zip",
+        "232.9921.62": "https://plugins.jetbrains.com/files/10037/358813/CSVEditor-3.2.1-232.zip"
       },
       "name": "csv-editor"
     },
@@ -303,12 +303,12 @@
         "232.9559.28": "https://plugins.jetbrains.com/files/12062/364117/keymap-vscode-232.8660.88.zip",
         "232.9559.58": "https://plugins.jetbrains.com/files/12062/364117/keymap-vscode-232.8660.88.zip",
         "232.9559.61": "https://plugins.jetbrains.com/files/12062/364117/keymap-vscode-232.8660.88.zip",
-        "232.9559.64": "https://plugins.jetbrains.com/files/12062/364117/keymap-vscode-232.8660.88.zip",
         "232.9921.42": "https://plugins.jetbrains.com/files/12062/364117/keymap-vscode-232.8660.88.zip",
-        "232.9921.46": "https://plugins.jetbrains.com/files/12062/364117/keymap-vscode-232.8660.88.zip",
         "232.9921.47": "https://plugins.jetbrains.com/files/12062/364117/keymap-vscode-232.8660.88.zip",
         "232.9921.48": "https://plugins.jetbrains.com/files/12062/364117/keymap-vscode-232.8660.88.zip",
-        "232.9921.53": "https://plugins.jetbrains.com/files/12062/364117/keymap-vscode-232.8660.88.zip"
+        "232.9921.53": "https://plugins.jetbrains.com/files/12062/364117/keymap-vscode-232.8660.88.zip",
+        "232.9921.55": "https://plugins.jetbrains.com/files/12062/364117/keymap-vscode-232.8660.88.zip",
+        "232.9921.62": "https://plugins.jetbrains.com/files/12062/364117/keymap-vscode-232.8660.88.zip"
       },
       "name": "vscode-keymap"
     },
@@ -333,12 +333,12 @@
         "232.9559.28": "https://plugins.jetbrains.com/files/12559/364124/keymap-eclipse-232.8660.88.zip",
         "232.9559.58": "https://plugins.jetbrains.com/files/12559/364124/keymap-eclipse-232.8660.88.zip",
         "232.9559.61": "https://plugins.jetbrains.com/files/12559/364124/keymap-eclipse-232.8660.88.zip",
-        "232.9559.64": "https://plugins.jetbrains.com/files/12559/364124/keymap-eclipse-232.8660.88.zip",
         "232.9921.42": "https://plugins.jetbrains.com/files/12559/364124/keymap-eclipse-232.8660.88.zip",
-        "232.9921.46": "https://plugins.jetbrains.com/files/12559/364124/keymap-eclipse-232.8660.88.zip",
         "232.9921.47": "https://plugins.jetbrains.com/files/12559/364124/keymap-eclipse-232.8660.88.zip",
         "232.9921.48": "https://plugins.jetbrains.com/files/12559/364124/keymap-eclipse-232.8660.88.zip",
-        "232.9921.53": "https://plugins.jetbrains.com/files/12559/364124/keymap-eclipse-232.8660.88.zip"
+        "232.9921.53": "https://plugins.jetbrains.com/files/12559/364124/keymap-eclipse-232.8660.88.zip",
+        "232.9921.55": "https://plugins.jetbrains.com/files/12559/364124/keymap-eclipse-232.8660.88.zip",
+        "232.9921.62": "https://plugins.jetbrains.com/files/12559/364124/keymap-eclipse-232.8660.88.zip"
       },
       "name": "eclipse-keymap"
     },
@@ -363,12 +363,12 @@
         "232.9559.28": "https://plugins.jetbrains.com/files/13017/364038/keymap-visualStudio-232.8660.88.zip",
         "232.9559.58": "https://plugins.jetbrains.com/files/13017/364038/keymap-visualStudio-232.8660.88.zip",
         "232.9559.61": "https://plugins.jetbrains.com/files/13017/364038/keymap-visualStudio-232.8660.88.zip",
-        "232.9559.64": "https://plugins.jetbrains.com/files/13017/364038/keymap-visualStudio-232.8660.88.zip",
         "232.9921.42": "https://plugins.jetbrains.com/files/13017/364038/keymap-visualStudio-232.8660.88.zip",
-        "232.9921.46": "https://plugins.jetbrains.com/files/13017/364038/keymap-visualStudio-232.8660.88.zip",
         "232.9921.47": "https://plugins.jetbrains.com/files/13017/364038/keymap-visualStudio-232.8660.88.zip",
         "232.9921.48": "https://plugins.jetbrains.com/files/13017/364038/keymap-visualStudio-232.8660.88.zip",
-        "232.9921.53": "https://plugins.jetbrains.com/files/13017/364038/keymap-visualStudio-232.8660.88.zip"
+        "232.9921.53": "https://plugins.jetbrains.com/files/13017/364038/keymap-visualStudio-232.8660.88.zip",
+        "232.9921.55": "https://plugins.jetbrains.com/files/13017/364038/keymap-visualStudio-232.8660.88.zip",
+        "232.9921.62": "https://plugins.jetbrains.com/files/13017/364038/keymap-visualStudio-232.8660.88.zip"
       },
       "name": "visual-studio-keymap"
     },
@@ -393,12 +393,12 @@
         "232.9559.28": "https://plugins.jetbrains.com/files/14059/82616/darcula-pitch-black.jar",
         "232.9559.58": "https://plugins.jetbrains.com/files/14059/82616/darcula-pitch-black.jar",
         "232.9559.61": "https://plugins.jetbrains.com/files/14059/82616/darcula-pitch-black.jar",
-        "232.9559.64": "https://plugins.jetbrains.com/files/14059/82616/darcula-pitch-black.jar",
         "232.9921.42": "https://plugins.jetbrains.com/files/14059/82616/darcula-pitch-black.jar",
-        "232.9921.46": "https://plugins.jetbrains.com/files/14059/82616/darcula-pitch-black.jar",
         "232.9921.47": "https://plugins.jetbrains.com/files/14059/82616/darcula-pitch-black.jar",
         "232.9921.48": "https://plugins.jetbrains.com/files/14059/82616/darcula-pitch-black.jar",
-        "232.9921.53": "https://plugins.jetbrains.com/files/14059/82616/darcula-pitch-black.jar"
+        "232.9921.53": "https://plugins.jetbrains.com/files/14059/82616/darcula-pitch-black.jar",
+        "232.9921.55": "https://plugins.jetbrains.com/files/14059/82616/darcula-pitch-black.jar",
+        "232.9921.62": "https://plugins.jetbrains.com/files/14059/82616/darcula-pitch-black.jar"
       },
       "name": "darcula-pitch-black"
     },
@@ -423,12 +423,12 @@
         "232.9559.28": "https://plugins.jetbrains.com/files/17718/391768/github-copilot-intellij-1.2.22.3129.zip",
         "232.9559.58": "https://plugins.jetbrains.com/files/17718/391768/github-copilot-intellij-1.2.22.3129.zip",
         "232.9559.61": "https://plugins.jetbrains.com/files/17718/391768/github-copilot-intellij-1.2.22.3129.zip",
-        "232.9559.64": "https://plugins.jetbrains.com/files/17718/391768/github-copilot-intellij-1.2.22.3129.zip",
         "232.9921.42": "https://plugins.jetbrains.com/files/17718/391768/github-copilot-intellij-1.2.22.3129.zip",
-        "232.9921.46": "https://plugins.jetbrains.com/files/17718/391768/github-copilot-intellij-1.2.22.3129.zip",
         "232.9921.47": "https://plugins.jetbrains.com/files/17718/391768/github-copilot-intellij-1.2.22.3129.zip",
         "232.9921.48": "https://plugins.jetbrains.com/files/17718/391768/github-copilot-intellij-1.2.22.3129.zip",
-        "232.9921.53": "https://plugins.jetbrains.com/files/17718/391768/github-copilot-intellij-1.2.22.3129.zip"
+        "232.9921.53": "https://plugins.jetbrains.com/files/17718/391768/github-copilot-intellij-1.2.22.3129.zip",
+        "232.9921.55": "https://plugins.jetbrains.com/files/17718/391768/github-copilot-intellij-1.2.22.3129.zip",
+        "232.9921.62": "https://plugins.jetbrains.com/files/17718/391768/github-copilot-intellij-1.2.22.3129.zip"
       },
       "name": "github-copilot"
     },
@@ -453,12 +453,12 @@
         "232.9559.28": "https://plugins.jetbrains.com/files/18444/165585/NetBeans6.5Keymap.zip",
         "232.9559.58": "https://plugins.jetbrains.com/files/18444/165585/NetBeans6.5Keymap.zip",
         "232.9559.61": "https://plugins.jetbrains.com/files/18444/165585/NetBeans6.5Keymap.zip",
-        "232.9559.64": "https://plugins.jetbrains.com/files/18444/165585/NetBeans6.5Keymap.zip",
         "232.9921.42": "https://plugins.jetbrains.com/files/18444/165585/NetBeans6.5Keymap.zip",
-        "232.9921.46": "https://plugins.jetbrains.com/files/18444/165585/NetBeans6.5Keymap.zip",
         "232.9921.47": "https://plugins.jetbrains.com/files/18444/165585/NetBeans6.5Keymap.zip",
         "232.9921.48": "https://plugins.jetbrains.com/files/18444/165585/NetBeans6.5Keymap.zip",
-        "232.9921.53": "https://plugins.jetbrains.com/files/18444/165585/NetBeans6.5Keymap.zip"
+        "232.9921.53": "https://plugins.jetbrains.com/files/18444/165585/NetBeans6.5Keymap.zip",
+        "232.9921.55": "https://plugins.jetbrains.com/files/18444/165585/NetBeans6.5Keymap.zip",
+        "232.9921.62": "https://plugins.jetbrains.com/files/18444/165585/NetBeans6.5Keymap.zip"
       },
       "name": "netbeans-6-5-keymap"
     }
@@ -480,11 +480,11 @@
     "https://plugins.jetbrains.com/files/631/395438/python-232.9921.47.zip": "sha256-+2ow+tbZUipK92SKp0AegcRwUL1OSQuGE4FlZPOAGSk=",
     "https://plugins.jetbrains.com/files/6954/381727/kotlin-plugin-223-1.9.10-release-459-IJ8836.35.zip": "sha256-gHkNQyWh6jtY1986aI7Qo6ZNrniPy+Yq4XLLA0pKJkA=",
     "https://plugins.jetbrains.com/files/6981/383851/ini-232.9559.64.zip": "sha256-XJoRZ3ExKHkUZljuuMjMzMCcFw0A+vOyJAwtf+soHU4=",
-    "https://plugins.jetbrains.com/files/6981/393737/ini-232.9921.36.zip": "sha256-oUb3W64ZpXep3MsbL+/DG0kVzBQYEv6LG7jghb2aUQQ=",
-    "https://plugins.jetbrains.com/files/7219/389222/Symfony_Plugin-2022.1.256.zip": "sha256-PeaqtFldh89x6wMGSM1RUR2PLSnXa7mKSojOkrFM2R8=",
+    "https://plugins.jetbrains.com/files/6981/398535/ini-232.9921.55.zip": "sha256-Jntjg8pXb2HfE8yojDcECM/Lbv4k7J2AoxQ2yD2R23s=",
+    "https://plugins.jetbrains.com/files/7219/401047/Symfony_Plugin-2022.1.257.zip": "sha256-H5ZfeMT93sGUrDh/7ba9zsW/eQz37Rl/iShY6ryNM3E=",
     "https://plugins.jetbrains.com/files/7320/346181/PHP_Annotations-9.4.0.zip": "sha256-hT5K4w4lhvNwDzDMDSvsIDGj9lyaRqglfOhlbNdqpWs=",
     "https://plugins.jetbrains.com/files/7322/381781/python-ce-232.9559.62.zip": "sha256-wyqNQO4fFU9fJVbHbde/NWtY/RVOF/71o+TgWfS7VuM=",
-    "https://plugins.jetbrains.com/files/7322/395441/python-ce-232.9921.47.zip": "sha256-2oRXtVv9ima8W6vywkDX4IeUGwfVNEo4rsqYBmmWhKc=",
+    "https://plugins.jetbrains.com/files/7322/401058/python-ce-232.9921.77.zip": "sha256-cr4LxSz8xVzC+Zm+6LnWGLbF6aGBVLW56crCIQOawhc=",
     "https://plugins.jetbrains.com/files/8182/329558/intellij-rust-0.4.194.5382-223.zip": "sha256-AgaKH4ZaxLhumk1P9BVJGpvluKnpYIulCDIRQpaWlKA=",
     "https://plugins.jetbrains.com/files/8182/372556/intellij-rust-0.4.200.5420-232-beta.zip": "sha256-ZlSfPvhPixEz5JxU9qyG0nL3jiSjr4gKaf/xYcQI1vQ=",
     "https://plugins.jetbrains.com/files/8182/395553/intellij-rust-0.4.201.5424-232.zip": "sha256-pVwBEyUCx/DJET9uIm8vxFeChE8FskWyfLjDpfg2mAE=",
diff --git a/pkgs/applications/editors/jetbrains/versions.json b/pkgs/applications/editors/jetbrains/versions.json
index b627ea855053..1a1f17c54e97 100644
--- a/pkgs/applications/editors/jetbrains/versions.json
+++ b/pkgs/applications/editors/jetbrains/versions.json
@@ -67,10 +67,10 @@
     "phpstorm": {
       "update-channel": "PhpStorm RELEASE",
       "url-template": "https://download.jetbrains.com/webide/PhpStorm-{version}.tar.gz",
-      "version": "2023.2.1",
-      "sha256": "bcb506fa27078f78da44a38f4fbab0a2000cea26385f51800c931d0cbd1b47c4",
-      "url": "https://download.jetbrains.com/webide/PhpStorm-2023.2.1.tar.gz",
-      "build_number": "232.9559.64",
+      "version": "2023.2.2",
+      "sha256": "5e3dd021b82dcad0f51bded677aa87680dcc3f5d843951c48848a9191141bf1d",
+      "url": "https://download.jetbrains.com/webide/PhpStorm-2023.2.2.tar.gz",
+      "build_number": "232.9921.55",
       "version-major-minor": "2022.3"
     },
     "pycharm-community": {
@@ -108,10 +108,10 @@
     "rust-rover": {
       "update-channel": "RustRover EAP",
       "url-template": "https://download.jetbrains.com/rustrover/RustRover-{version}.tar.gz",
-      "version": "2023.2",
-      "sha256": "5a51bcae179467e9c6440bc0c31bffd27c6fc58d593a0cbecd5aeb51508d27b6",
-      "url": "https://download.jetbrains.com/rustrover/RustRover-232.9921.46.tar.gz",
-      "build_number": "232.9921.46"
+      "version": "2023.2 EAP",
+      "sha256": "1f67e1a82f5cbb7c84382c7f251ae06b1e2699fa7d2fa4129e23ec2e43251687",
+      "url": "https://download.jetbrains.com/rustrover/RustRover-232.9921.62.tar.gz",
+      "build_number": "232.9921.62"
     },
     "webstorm": {
       "update-channel": "WebStorm RELEASE",
@@ -190,10 +190,10 @@
     "phpstorm": {
       "update-channel": "PhpStorm RELEASE",
       "url-template": "https://download.jetbrains.com/webide/PhpStorm-{version}.dmg",
-      "version": "2023.2.1",
-      "sha256": "5d238f0d3ddd59762256dc406ae2430e5abf79f9a04488722a87e54b70db68ef",
-      "url": "https://download.jetbrains.com/webide/PhpStorm-2023.2.1.dmg",
-      "build_number": "232.9559.64",
+      "version": "2023.2.2",
+      "sha256": "99a9bb313a5c141ecd1810306deaca3cf52d338edf206362b3f9d9337a27890e",
+      "url": "https://download.jetbrains.com/webide/PhpStorm-2023.2.2.dmg",
+      "build_number": "232.9921.55",
       "version-major-minor": "2022.3"
     },
     "pycharm-community": {
@@ -231,10 +231,10 @@
     "rust-rover": {
       "update-channel": "RustRover EAP",
       "url-template": "https://download.jetbrains.com/rustrover/RustRover-{version}.dmg",
-      "version": "2023.2",
-      "sha256": "4c7193acf07f44b91512d8b4c04c88068b8599e76150a81dfd728046910a0929",
-      "url": "https://download.jetbrains.com/rustrover/RustRover-232.9921.46.dmg",
-      "build_number": "232.9921.46"
+      "version": "2023.2 EAP",
+      "sha256": "dfde444bff011783cb4a5aa2aafae8ea989874c19535b01da8214df5eb3174fb",
+      "url": "https://download.jetbrains.com/rustrover/RustRover-232.9921.62.dmg",
+      "build_number": "232.9921.62"
     },
     "webstorm": {
       "update-channel": "WebStorm RELEASE",
@@ -313,10 +313,10 @@
     "phpstorm": {
       "update-channel": "PhpStorm RELEASE",
       "url-template": "https://download.jetbrains.com/webide/PhpStorm-{version}-aarch64.dmg",
-      "version": "2023.2.1",
-      "sha256": "886e79089e5e783739e71f57f8f20b9ecbc2e9e7cc9b941bb99d1444181939df",
-      "url": "https://download.jetbrains.com/webide/PhpStorm-2023.2.1-aarch64.dmg",
-      "build_number": "232.9559.64",
+      "version": "2023.2.2",
+      "sha256": "a31daeddae532324436b2d11acbd5fb657721883f17c7ef4457ac76a51bd4189",
+      "url": "https://download.jetbrains.com/webide/PhpStorm-2023.2.2-aarch64.dmg",
+      "build_number": "232.9921.55",
       "version-major-minor": "2022.3"
     },
     "pycharm-community": {
@@ -354,10 +354,10 @@
     "rust-rover": {
       "update-channel": "RustRover EAP",
       "url-template": "https://download.jetbrains.com/rustrover/RustRover-{version}-aarch64.dmg",
-      "version": "2023.2",
-      "sha256": "7f01fef11d89c6c6c870a79007607babde40f7a958b7103d1028aa760ed713b7",
-      "url": "https://download.jetbrains.com/rustrover/RustRover-232.9921.46-aarch64.dmg",
-      "build_number": "232.9921.46"
+      "version": "2023.2 EAP",
+      "sha256": "35d44a4f72c027283843aaa6409de701d14274cdc5a614c3fdc53121383f9389",
+      "url": "https://download.jetbrains.com/rustrover/RustRover-232.9921.62-aarch64.dmg",
+      "build_number": "232.9921.62"
     },
     "webstorm": {
       "update-channel": "WebStorm RELEASE",
diff --git a/pkgs/applications/misc/madonctl/default.nix b/pkgs/applications/misc/madonctl/default.nix
index df783aa36a9c..0e204ea83854 100644
--- a/pkgs/applications/misc/madonctl/default.nix
+++ b/pkgs/applications/misc/madonctl/default.nix
@@ -32,6 +32,6 @@ buildGoModule rec {
     description = "CLI for the Mastodon social network API";
     homepage = "https://github.com/McKael/madonctl";
     license = licenses.mit;
-    maintainers = with maintainers; [ aaronjheng ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/applications/misc/process-compose/default.nix b/pkgs/applications/misc/process-compose/default.nix
index 0e90ad933d5e..8ec268c212de 100644
--- a/pkgs/applications/misc/process-compose/default.nix
+++ b/pkgs/applications/misc/process-compose/default.nix
@@ -8,13 +8,13 @@ let config-module = "github.com/f1bonacc1/process-compose/src/config";
 in
 buildGoModule rec {
   pname = "process-compose";
-  version = "0.60.0";
+  version = "0.65.1";
 
   src = fetchFromGitHub {
     owner = "F1bonacc1";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-BsDel6F09HP5Oz2p0DDXKuS7Id5XPhZZxEzwu76vVwk=";
+    hash = "sha256-wlsZV9yE9486EBbIwVOcA4KBf9tfI0Ao1JSIPjJAcEU=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
diff --git a/pkgs/applications/networking/cluster/civo/default.nix b/pkgs/applications/networking/cluster/civo/default.nix
index ac6cea0fb2ba..be63630ab717 100644
--- a/pkgs/applications/networking/cluster/civo/default.nix
+++ b/pkgs/applications/networking/cluster/civo/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "civo";
-  version = "1.0.65";
+  version = "1.0.66";
 
   src = fetchFromGitHub {
     owner  = "civo";
     repo   = "cli";
     rev    = "v${version}";
-    sha256 = "sha256-zuWKU2bZM0zdEupvWi1CV3S7urEhm4dc+sFYoQmljCk=";
+    sha256 = "sha256-17dRFRG3HpYJvqE4+SFI6a6nP6umkKc61rwQu4FiG6Q=";
   };
 
-  vendorHash = "sha256-Tym9Xu+oECUm78nIAyDwYYpR88wNxT4bmoy7iUwUQTU=";
+  vendorHash = "sha256-AvAS3S7bepaTFPelE+Bj5/UuQIXEDvSAtDuFaPRC9sk=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/applications/networking/cluster/helm-docs/default.nix b/pkgs/applications/networking/cluster/helm-docs/default.nix
index 657d428912dd..cf286c8dc6f5 100644
--- a/pkgs/applications/networking/cluster/helm-docs/default.nix
+++ b/pkgs/applications/networking/cluster/helm-docs/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "helm-docs";
-  version = "1.11.1";
+  version = "1.11.2";
 
   src = fetchFromGitHub {
     owner = "norwoodj";
     repo = "helm-docs";
     rev = "v${version}";
-    hash = "sha256-4o3hdqaW/AtegKStMKVerE3dRr3iZxQ+Lm2Aj3aOy98=";
+    hash = "sha256-w4QV96/02Pbs/l0lTLPYY8Ag21ZDDVPdgvuveiKUCoM=";
   };
 
   vendorHash = "sha256-6byD8FdeqdRDNUZFZ7FUUdyTuFOO8s3rb6YPGKdwLB8=";
diff --git a/pkgs/applications/networking/cluster/kubeshark/default.nix b/pkgs/applications/networking/cluster/kubeshark/default.nix
index 23f43688d5c9..d958e06b7eca 100644
--- a/pkgs/applications/networking/cluster/kubeshark/default.nix
+++ b/pkgs/applications/networking/cluster/kubeshark/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "kubeshark";
-  version = "50.2";
+  version = "50.4";
 
   src = fetchFromGitHub {
     owner = "kubeshark";
     repo = "kubeshark";
     rev = version;
-    sha256 = "sha256-bABPfy790cMIfunKYfZwDbEn07fhq6g0m/yqeFgJg4Y=";
+    sha256 = "sha256-+9AnzY/vnB1OGzkKmYL0sxWS17NV+MGnHNXGOtt+BKU=";
   };
 
-  vendorHash = "sha256-rcxnvKkc9zerfULRdU5eGRRqSDQQDNMYaLJ7oEMQghk=";
+  vendorHash = "sha256-Vcn1Ky/J/3QiV6M5fLedDcpkLp5WsVcXRkOEgkKPYEQ=";
 
   ldflags = let t = "github.com/kubeshark/kubeshark"; in [
    "-s" "-w"
diff --git a/pkgs/applications/networking/drive/default.nix b/pkgs/applications/networking/drive/default.nix
index b90be9e2a55d..4c7b5727fbac 100644
--- a/pkgs/applications/networking/drive/default.nix
+++ b/pkgs/applications/networking/drive/default.nix
@@ -29,6 +29,6 @@ buildGoModule rec {
     homepage = "https://github.com/odeke-em/drive";
     description = "Google Drive client for the commandline";
     license = licenses.asl20;
-    maintainers = with maintainers; [ aaronjheng ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/applications/networking/gnmic/default.nix b/pkgs/applications/networking/gnmic/default.nix
index 43884541cdd1..4e78f0c0fcd2 100644
--- a/pkgs/applications/networking/gnmic/default.nix
+++ b/pkgs/applications/networking/gnmic/default.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "gnmic";
-  version = "0.31.7";
+  version = "0.32.0";
 
   src = fetchFromGitHub {
     owner = "openconfig";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-bX8oZk0psPqoXFU8b2JQmfFaPz18yiuSVXDmhoOnpFg=";
+    hash = "sha256-aEAbIh1BH8R05SpSMSXL2IrudjIki72k7NGvjjKkxZw=";
   };
 
   vendorHash = "sha256-hIG3kG2e9Y2hnHJ+96cPLgnlp5ParsLgWQY0HZTDggY=";
diff --git a/pkgs/applications/office/fava/default.nix b/pkgs/applications/office/fava/default.nix
index a9827abf2062..b7e2105a94ea 100644
--- a/pkgs/applications/office/fava/default.nix
+++ b/pkgs/applications/office/fava/default.nix
@@ -2,12 +2,12 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "fava";
-  version = "1.26";
+  version = "1.26.1";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-YSxUqwmv7LQqnT9U1dau9pYaKvEEG5Tbi7orylJKkp0=";
+    hash = "sha256-pj4kaQDXahjhN7bu7xxT/ZuoCfPdGyo898482S5gnlE=";
   };
 
   nativeBuildInputs = with python3.pkgs; [ setuptools-scm ];
diff --git a/pkgs/applications/window-managers/hyprwm/hyprland/default.nix b/pkgs/applications/window-managers/hyprwm/hyprland/default.nix
index 9ee45ba883c2..14a38ec9effc 100644
--- a/pkgs/applications/window-managers/hyprwm/hyprland/default.nix
+++ b/pkgs/applications/window-managers/hyprwm/hyprland/default.nix
@@ -40,13 +40,13 @@ assert lib.assertMsg (!nvidiaPatches) "The option `nvidiaPatches` has been renam
 assert lib.assertMsg (!hidpiXWayland) "The option `hidpiXWayland` has been removed. Please refer https://wiki.hyprland.org/Configuring/XWayland";
 stdenv.mkDerivation (finalAttrs: {
   pname = "hyprland" + lib.optionalString debug "-debug";
-  version = "0.29.1";
+  version = "0.30.0";
 
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = finalAttrs.pname;
     rev = "v${finalAttrs.version}";
-    hash = "sha256-j9ypIwZkotNZMyk8R/W002OzDHd0C0OHSKE7uOFpf2k=";
+    hash = "sha256-a0nqm82brOC0QroGOXxcIKxOMAfl9I6pfFOYjCeRzO0=";
   };
 
   patches = [
diff --git a/pkgs/applications/window-managers/hyprwm/hyprland/wlroots.nix b/pkgs/applications/window-managers/hyprwm/hyprland/wlroots.nix
index b5651749c41c..4188a13c34da 100644
--- a/pkgs/applications/window-managers/hyprwm/hyprland/wlroots.nix
+++ b/pkgs/applications/window-managers/hyprwm/hyprland/wlroots.nix
@@ -42,8 +42,8 @@ wlroots.overrideAttrs
       domain = "gitlab.freedesktop.org";
       owner = "wlroots";
       repo = "wlroots";
-      rev = "717ded9bb0191ea31bf4368be32e7a15fe1b8294";
-      hash = "sha256-eBKkG7tMxg92NskEn8dHRFY245JwjirWRoOZzW6DnUw=";
+      rev = "98a745d926d8048bc30aef11b421df207a01c279";
+      hash = "sha256-LEIUGXvKR5DYFQUTavC3yifcObvG4XZUUHfxXmu8nEM=";
     };
 
     pname =
diff --git a/pkgs/applications/window-managers/hyprwm/xdg-desktop-portal-hyprland/default.nix b/pkgs/applications/window-managers/hyprwm/xdg-desktop-portal-hyprland/default.nix
index dd0882edc297..37c4bb03002e 100644
--- a/pkgs/applications/window-managers/hyprwm/xdg-desktop-portal-hyprland/default.nix
+++ b/pkgs/applications/window-managers/hyprwm/xdg-desktop-portal-hyprland/default.nix
@@ -21,15 +21,15 @@
 , hyprland
 , slurp
 }:
-stdenv.mkDerivation {
+stdenv.mkDerivation (self: {
   pname = "xdg-desktop-portal-hyprland";
-  version = "unstable-2023-09-10";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = "xdg-desktop-portal-hyprland";
-    rev = "aca51609d4c415b30e88b96c6f49f0142cbcdae7";
-    hash = "sha256-RF6LXm4J6mBF3B8VcQuABuU4g4tCPHgMYJQSoJ3DW+8=";
+    rev = "v${self.version}";
+    hash = "sha256-K1cqx+NP4lxPwRVPLEeSUfagaMI3m5hdYvQe7sZr7BU=";
   };
 
   nativeBuildInputs = [
@@ -73,4 +73,4 @@ stdenv.mkDerivation {
     maintainers = with maintainers; [ fufexan ];
     platforms = platforms.linux;
   };
-}
+})
diff --git a/pkgs/by-name/ba/badger/package.nix b/pkgs/by-name/ba/badger/package.nix
new file mode 100644
index 000000000000..4c41b8f88496
--- /dev/null
+++ b/pkgs/by-name/ba/badger/package.nix
@@ -0,0 +1,30 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
+
+buildGoModule rec {
+  pname = "badger";
+  version = "4.2.0";
+
+  src = fetchFromGitHub {
+    owner = "dgraph-io";
+    repo = "badger";
+    rev = "v${version}";
+    hash = "sha256-+b+VTGUGmqixB51f1U2QK+XfVra4zXybW19n/CeeoAQ=";
+  };
+
+  vendorHash = "sha256-YiSmxtRt8HtYcvPL9ZKMjb2ch/MZBjZp5pIIBdqQ7Nw=";
+
+  subPackages = [ "badger" ];
+
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Fast key-value DB in Go";
+    homepage = "https://github.com/dgraph-io/badger";
+    license = licenses.asl20;
+    mainProgram = "badger";
+    maintainers = with maintainers; [ farcaller ];
+  };
+}
diff --git a/pkgs/by-name/le/lemminx/package.nix b/pkgs/by-name/le/lemminx/package.nix
new file mode 100644
index 000000000000..fe078ba84acf
--- /dev/null
+++ b/pkgs/by-name/le/lemminx/package.nix
@@ -0,0 +1,104 @@
+{ lib
+, fetchFromGitHub
+, makeWrapper
+, jre
+, maven
+, writeScript
+, lemminx
+}:
+
+maven.buildMavenPackage rec {
+  pname = "lemminx";
+  version = "0.27.0";
+
+  src = fetchFromGitHub {
+    owner = "eclipse";
+    repo = "lemminx";
+    rev = version;
+    hash = "sha256-VWYTkYlPziNRyxHdvIWVuDlABpKdzhC/F6BUBj/opks=";
+    # Lemminx reads this git information at runtime from a git.properties
+    # file on the classpath
+    leaveDotGit = true;
+    postFetch = ''
+      cat > $out/org.eclipse.lemminx/src/main/resources/git.properties << EOF
+      git.build.version=${version}
+      git.commit.id.abbrev=$(git -C $out rev-parse --short HEAD)
+      git.commit.message.short=$(git -C $out log -1 --pretty=format:%s)
+      git.branch=main
+      EOF
+      rm -rf $out/.git
+    '';
+  };
+
+  manualMvnArtifacts = [
+    "org.apache.maven.surefire:surefire-junit-platform:3.1.2"
+    "org.junit.platform:junit-platform-launcher:1.10.0"
+  ];
+
+  mvnHash = "sha256-sIiCp1AorVQXt13Tq0vw9jGioG3zcQMqqKS/Q0Tf4MQ=";
+
+  buildOffline = true;
+
+  # disable gitcommitid plugin which needs a .git folder which we
+  # don't have
+  mvnDepsParameters = "-Dmaven.gitcommitid.skip=true";
+
+  # disable failing tests which either need internet access or are flaky
+  mvnParameters = lib.escapeShellArgs [
+    "-Dmaven.gitcommitid.skip=true"
+    "-Dtest=!XMLValidationCommandTest,
+    !XMLValidationExternalResourcesBasedOnDTDTest,
+    !XMLSchemaPublishDiagnosticsTest,
+    !PlatformTest,
+    !XMLValidationExternalResourcesBasedOnXSDTest,
+    !XMLExternalTest,
+    !XMLSchemaCompletionExtensionsTest,
+    !XMLSchemaDiagnosticsTest,
+    !MissingChildElementCodeActionTest,
+    !XSDValidationExternalResourcesTest,
+    !DocumentLifecycleParticipantTest"
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin $out/share
+    install -Dm644 org.eclipse.lemminx/target/org.eclipse.lemminx-uber.jar \
+      $out/share
+
+    makeWrapper ${jre}/bin/java $out/bin/lemminx \
+      --add-flags "-jar $out/share/org.eclipse.lemminx-uber.jar"
+
+    runHook postInstall
+  '';
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  passthru.updateScript = writeScript "update-lemminx" ''
+    #!/usr/bin/env nix-shell
+    #!nix-shell -i bash -p curl pcre common-updater-scripts jq gnused
+    set -eu -o pipefail
+
+    LATEST_TAG=$(curl https://api.github.com/repos/eclipse/lemminx/tags | \
+      jq -r '[.[] | select(.name | test("^[0-9]"))] | sort_by(.name | split(".") |
+      map(tonumber)) | reverse | .[0].name')
+    update-source-version lemminx "$LATEST_TAG"
+    sed -i '0,/mvnHash *= *"[^"]*"/{s/mvnHash = "[^"]*"/mvnHash = ""/}' ${lemminx}
+
+    echo -e "\nFetching all mvn dependencies to calculate the mvnHash. This may take a while ..."
+    nix-build -A lemminx.fetchedMavenDeps 2> lemminx-stderr.log || true
+
+    NEW_MVN_HASH=$(cat lemminx-stderr.log | grep "got:" | awk '{print ''$2}')
+    rm lemminx-stderr.log
+    # escaping double quotes looks ugly but is needed for variable substitution
+    # use # instead of / as separator because the sha256 might contain the / character
+    sed -i "0,/mvnHash *= *\"[^\"]*\"/{s#mvnHash = \"[^\"]*\"#mvnHash = \"$NEW_MVN_HASH\"#}" ${lemminx}
+  '';
+
+  meta = with lib; {
+    description = "XML Language Server";
+    homepage = "https://github.com/eclipse/lemminx";
+    license = licenses.epl20;
+    maintainers = with maintainers; [ tricktron ];
+  };
+}
diff --git a/pkgs/by-name/lu/luastatus/package.nix b/pkgs/by-name/lu/luastatus/package.nix
new file mode 100644
index 000000000000..5bac2809ccf4
--- /dev/null
+++ b/pkgs/by-name/lu/luastatus/package.nix
@@ -0,0 +1,88 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+# Native Build Inputs
+, cmake
+, pkg-config
+, makeWrapper
+# Dependencies
+, yajl
+, alsa-lib
+, libpulseaudio
+, glib
+, libnl
+, udev
+, libXau
+, libXdmcp
+, pcre2
+, pcre
+, util-linux
+, libselinux
+, libsepol
+, lua5
+, docutils
+, libxcb
+, libX11
+, xcbutil
+, xcbutilwm
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "luastatus";
+  version = "0.6.0";
+
+  src = fetchFromGitHub {
+    owner = "shdown";
+    repo = "luastatus";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-whO5pjUPaCwEb2GDCIPnTk39MejSQOoRRQ5kdYEQ0Pc=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    makeWrapper
+  ];
+
+  buildInputs = [
+    libxcb
+    libX11
+    xcbutil
+    xcbutilwm
+    libXdmcp
+    libXau
+    libpulseaudio
+    libnl
+    libselinux
+    libsepol
+    yajl
+    alsa-lib
+    glib
+    udev
+    pcre2
+    pcre
+    util-linux
+    lua5
+    docutils
+  ];
+
+  postInstall = ''
+    wrapProgram $out/bin/luastatus-stdout-wrapper \
+      --prefix LUASTATUS : $out/bin/luastatus
+
+    wrapProgram $out/bin/luastatus-i3-wrapper \
+      --prefix LUASTATUS : $out/bin/luastatus
+
+    wrapProgram $out/bin/luastatus-lemonbar-launcher \
+      --prefix LUASTATUS : $out/bin/luastatus
+  '';
+
+  meta = with lib; {
+    description = "Universal status bar content generator";
+    homepage = "https://github.com/shdown/luastatus";
+    changelog = "https://github.com/shdown/luastatus/releases/tag/${finalAttrs.version}";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ kashw2 ];
+    platforms = platforms.linux;
+  };
+})
diff --git a/pkgs/data/misc/ddccontrol-db/default.nix b/pkgs/data/misc/ddccontrol-db/default.nix
index efb3f021ec5a..52e6c59285af 100644
--- a/pkgs/data/misc/ddccontrol-db/default.nix
+++ b/pkgs/data/misc/ddccontrol-db/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ddccontrol-db";
-  version = "20230821";
+  version = "20230911";
 
   src = fetchFromGitHub {
     owner = "ddccontrol";
     repo = pname;
     rev = version;
-    sha256 = "sha256-R+DXpT9Tgt311G/OtmKp3sqN0ex/rlLt3JuSK7kciC0=";
+    sha256 = "sha256-3lGzQ95ZS9yr9dX+wCTmX6Q+IsbMCfBa4zhcyxsG4+w=";
   };
 
   nativeBuildInputs = [ autoreconfHook intltool ];
diff --git a/pkgs/development/compilers/circt/default.nix b/pkgs/development/compilers/circt/default.nix
index c6f787078b67..f8eaae9a0401 100644
--- a/pkgs/development/compilers/circt/default.nix
+++ b/pkgs/development/compilers/circt/default.nix
@@ -14,12 +14,12 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "circt";
-  version = "1.54.0";
+  version = "1.56.1";
   src = fetchFromGitHub {
     owner = "llvm";
     repo = "circt";
     rev = "firtool-${version}";
-    sha256 = "sha256-jHDQl6UJTyNGZ4PUTEiZCIN/RSRbBxlaVutkwrWbK9M=";
+    sha256 = "sha256-MOwjfSUd5Dvlvek763AMZWK29dUoc2fblb5qtByTqLA=";
     fetchSubmodules = true;
   };
 
@@ -78,7 +78,7 @@ stdenv.mkDerivation rec {
     description = "Circuit IR compilers and tools";
     homepage = "https://circt.org/";
     license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ sharzy ];
+    maintainers = with lib.maintainers; [ sharzy pineapplehunter ];
     platforms = lib.platforms.all;
   };
 }
diff --git a/pkgs/development/compilers/ghdl/default.nix b/pkgs/development/compilers/ghdl/default.nix
index 0e11c703d7b6..e00294cf1845 100644
--- a/pkgs/development/compilers/ghdl/default.nix
+++ b/pkgs/development/compilers/ghdl/default.nix
@@ -11,26 +11,17 @@
 
 assert backend == "mcode" || backend == "llvm";
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "ghdl-${backend}";
-  version = "2.0.0";
+  version = "3.0.0";
 
   src = fetchFromGitHub {
     owner  = "ghdl";
     repo   = "ghdl";
-    rev    = "v${version}";
-    sha256 = "sha256-B/G3FGRzYy4Y9VNNB8yM3FohiIjPJhYSVbqsTN3cL5k=";
+    rev    = "v${finalAttrs.version}";
+    hash   = "sha256-94RNtHbOpbC2q/Z+PsQplrLxXmpS3LXOCXyTBB+n9c4=";
   };
 
-  patches = [
-    # https://github.com/ghdl/ghdl/issues/2056
-    (fetchpatch {
-      name = "fix-build-gcc-12.patch";
-      url = "https://github.com/ghdl/ghdl/commit/f8b87697e8b893b6293ebbfc34670c32bfb49397.patch";
-      hash = "sha256-tVbMm8veFkNPs6WFBHvaic5Jkp1niyg0LfFufa+hT/E=";
-    })
-  ];
-
   LIBRARY_PATH = "${stdenv.cc.libc}/lib";
 
   nativeBuildInputs = [
@@ -59,8 +50,6 @@ stdenv.mkDerivation rec {
     "--with-llvm-config=${llvm.dev}/bin/llvm-config"
   ];
 
-  hardeningDisable = [ "format" ];
-
   enableParallelBuilding = true;
 
   passthru = {
@@ -72,11 +61,12 @@ stdenv.mkDerivation rec {
     };
   };
 
-  meta = with lib; {
+  meta = {
     homepage = "https://github.com/ghdl/ghdl";
     description = "VHDL 2008/93/87 simulator";
-    maintainers = with maintainers; [ lucus16 thoughtpolice ];
-    platforms = platforms.linux;
-    license = licenses.gpl2;
+    license = lib.licenses.gpl2Plus;
+    mainProgram = "ghdl";
+    maintainers = with lib.maintainers; [ eclairevoyant lucus16 thoughtpolice ];
+    platforms = lib.platforms.linux;
   };
-}
+})
diff --git a/pkgs/development/libraries/faudio/default.nix b/pkgs/development/libraries/faudio/default.nix
index af07f5854ccb..7f95b9995499 100644
--- a/pkgs/development/libraries/faudio/default.nix
+++ b/pkgs/development/libraries/faudio/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "faudio";
-  version = "23.08";
+  version = "23.09";
 
   src = fetchFromGitHub {
     owner = "FNA-XNA";
     repo = "FAudio";
     rev = version;
-    sha256 = "sha256-ceFnk0JQtolx7Q1FnADCO0z6fCxu1RzmN3sHohy4hzU=";
+    sha256 = "sha256-Sl+dOM1YMDwCN07ThR/JFwhNS10P7+uQJNUQAvFdYa8=";
   };
 
   nativeBuildInputs = [cmake];
diff --git a/pkgs/development/libraries/intel-gmmlib/default.nix b/pkgs/development/libraries/intel-gmmlib/default.nix
index 7faeb324ad55..331198e975ed 100644
--- a/pkgs/development/libraries/intel-gmmlib/default.nix
+++ b/pkgs/development/libraries/intel-gmmlib/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , cmake
 # for passthru.tests
 , intel-compute-runtime
@@ -10,24 +9,15 @@
 
 stdenv.mkDerivation rec {
   pname = "intel-gmmlib";
-  version = "22.3.7";
+  version = "22.3.11";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "gmmlib";
     rev = "intel-gmmlib-${version}";
-    sha256 = "sha256-/iwTPWRVTZk1dhZD2Grcnc76ItgXjf2VrFD+93h8YvM=";
+    sha256 = "sha256-pweKUf/KW64neJkEZwjePh7ft8KEBu1I9zCIx/lMQT8=";
   };
 
-  patches = [
-    # fix build on i686
-    # https://github.com/intel/gmmlib/pull/104
-    (fetchpatch {
-      url = "https://github.com/intel/gmmlib/commit/2526286f29d8ad3d3a5833bdc29e23e5f3300b34.patch";
-      hash = "sha256-mChK6wprAt+bo39g6LTNy25kJeGoKabpXFq2gSDhaPw=";
-    })
-  ];
-
   nativeBuildInputs = [ cmake ];
 
   passthru.tests = {
diff --git a/pkgs/development/python-modules/anywidget/default.nix b/pkgs/development/python-modules/anywidget/default.nix
index f96ef47e7332..b4c29745e555 100644
--- a/pkgs/development/python-modules/anywidget/default.nix
+++ b/pkgs/development/python-modules/anywidget/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "anywidget";
-  version = "0.6.3";
+  version = "0.6.5";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-OUKxmYceEKURJeQTVI7oLT4SdZM90V7BoZf0UykkEV4=";
+    hash = "sha256-prriSqvy2S9URnXfTEY88lssU71/cV38egSIqnLHE+Q=";
   };
 
   # We do not need the jupyterlab build dependency, because we do not need to
diff --git a/pkgs/development/python-modules/automx2/default.nix b/pkgs/development/python-modules/automx2/default.nix
new file mode 100644
index 000000000000..cfc3a8484b67
--- /dev/null
+++ b/pkgs/development/python-modules/automx2/default.nix
@@ -0,0 +1,46 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, flask
+, flask-migrate
+, ldap3
+, pytestCheckHook
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "automx2";
+  version = "unstable-2023-08-23";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "rseichter";
+    repo = pname;
+    rev = "f3e3fc8e769c3799361001d51b7d9335a6a9d1a8";
+    hash = "sha256-NkeazjjGDYUXfoydvEfww6e7SkSZ8rMRlML+oOaf374=";
+  };
+
+  propagatedBuildInputs = [
+    flask
+    flask-migrate
+    ldap3
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "automx2"
+  ];
+
+  meta = with lib; {
+    description = "Email client configuration made easy";
+    homepage = "https://rseichter.github.io/automx2/";
+    changelog = "https://github.com/rseichter/automx2/blob/${version}/CHANGELOG";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ twey ];
+  };
+}
diff --git a/pkgs/development/python-modules/frozendict/default.nix b/pkgs/development/python-modules/frozendict/default.nix
index f262710119ca..3ed26a476b6e 100644
--- a/pkgs/development/python-modules/frozendict/default.nix
+++ b/pkgs/development/python-modules/frozendict/default.nix
@@ -20,12 +20,6 @@ buildPythonPackage rec {
     hash = "sha256-4a0DvZOzNJqpop7wi+FagUR+8oaekz4EDNIYdUaAWC8=";
   };
 
-  postPatch = ''
-    # https://github.com/Marco-Sulla/python-frozendict/pull/69
-    substituteInPlace setup.py \
-      --replace 'if impl == "PyPy":' 'if impl == "PyPy" or not src_path.exists():'
-  '';
-
   nativeCheckInputs = [
     pytestCheckHook
   ];
@@ -48,6 +42,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/Marco-Sulla/python-frozendict";
     changelog = "https://github.com/Marco-Sulla/python-frozendict/releases/tag/v${version}";
     license = licenses.lgpl3Only;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ pbsds ];
   };
 }
diff --git a/pkgs/development/python-modules/heudiconv/default.nix b/pkgs/development/python-modules/heudiconv/default.nix
index 514d4e2477b6..3cdf1463cd57 100644
--- a/pkgs/development/python-modules/heudiconv/default.nix
+++ b/pkgs/development/python-modules/heudiconv/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage rec {
   pname = "heudiconv";
-  version = "0.13.1";
+  version = "1.0.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-UUBRC6RToj4XVbJnxG+EKdue4NVpTAW31RNm9ieF1lU=";
+    hash = "sha256-cW6G2NtPZiyqqJ3w9a3Y/6blEaXtR9eGG5epPknimsw=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/paddleocr/default.nix b/pkgs/development/python-modules/paddleocr/default.nix
index 9bd81077abfd..c75d6e87e07a 100644
--- a/pkgs/development/python-modules/paddleocr/default.nix
+++ b/pkgs/development/python-modules/paddleocr/default.nix
@@ -28,7 +28,7 @@
 }:
 
 let
-  version = "2.7.0.1";
+  version = "2.7.0";
 in
 buildPythonPackage {
   pname = "paddleocr";
@@ -38,8 +38,8 @@ buildPythonPackage {
   src = fetchFromGitHub {
     owner = "PaddlePaddle";
     repo = "PaddleOCR";
-    rev = "254786752a2659e184822b4b2de5637a05236590";
-    hash = "sha256-M/Fpk9swX9Gds7o5poM9Iv6LOhKoZNbe0Wv9JNMPOU0=";
+    rev = "v${version}";
+    hash = "sha256-r7Y666KpY855NCSinCBBUz9PXHfZ56+oZW1/0ISpWe4=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/posthog/default.nix b/pkgs/development/python-modules/posthog/default.nix
index d6136cf71723..0f20800ece0d 100644
--- a/pkgs/development/python-modules/posthog/default.nix
+++ b/pkgs/development/python-modules/posthog/default.nix
@@ -14,7 +14,7 @@
 }:
 let
   pname = "posthog";
-  version = "3.0.1";
+  version = "3.0.2";
 in
 buildPythonPackage {
   inherit pname version;
@@ -24,7 +24,7 @@ buildPythonPackage {
     owner = "PostHog";
     repo = "posthog-python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-GSHsa05DUcbIHg1HCoIn8d4NZoG+Iddqfgod2nP4fX0=";
+    hash = "sha256-QASqjphAWtYuIyhbFTYwv1gD+rXvrmp5W0Te4MFn1AA=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/streamlit/default.nix b/pkgs/development/python-modules/streamlit/default.nix
index 95a11c70592b..58a10bdb148b 100755
--- a/pkgs/development/python-modules/streamlit/default.nix
+++ b/pkgs/development/python-modules/streamlit/default.nix
@@ -12,7 +12,7 @@
 , packaging
 , pandas
 , pillow
-, protobuf3
+, protobuf
 , pyarrow
 , pydeck
 , pympler
@@ -60,7 +60,7 @@ buildPythonPackage rec {
     packaging
     pandas
     pillow
-    protobuf3
+    protobuf
     pyarrow
     pydeck
     pympler
diff --git a/pkgs/development/python-modules/types-redis/default.nix b/pkgs/development/python-modules/types-redis/default.nix
index 92ffba08b684..1b59386174eb 100644
--- a/pkgs/development/python-modules/types-redis/default.nix
+++ b/pkgs/development/python-modules/types-redis/default.nix
@@ -7,12 +7,12 @@
 
 buildPythonPackage rec {
   pname = "types-redis";
-  version = "4.6.0.6";
+  version = "4.6.0.7";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-eGWoQ4ApN6st3KM1ecTiVb/nP4evhYJOrXpnKbqS/FI=";
+    hash = "sha256-KMQVPdtcnU8Q3vRKJFRnPDYdLV/DzYZ887sVIPP1mjg=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/userpath/default.nix b/pkgs/development/python-modules/userpath/default.nix
index edf92f571166..5f4a31d39b19 100644
--- a/pkgs/development/python-modules/userpath/default.nix
+++ b/pkgs/development/python-modules/userpath/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "userpath";
-  version = "1.9.0";
+  version = "1.9.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-heMnRUMXRHfGLVcB7UOj7xBRgkqd13aWitxBHlhkDdE=";
+    hash = "sha256-zoF2co2YyRS2QBeBvzsj/M2WjRZHU5yHiMcBA3XgJ5Y=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/amqpcat/default.nix b/pkgs/development/tools/amqpcat/default.nix
index a7c30cc9e4b6..774af838b63a 100644
--- a/pkgs/development/tools/amqpcat/default.nix
+++ b/pkgs/development/tools/amqpcat/default.nix
@@ -1,14 +1,14 @@
-{ stdenv, lib, fetchFromGitHub, crystal, openssl, testers, amqpcat }:
+{ lib, fetchFromGitHub, crystal, openssl, testers, amqpcat }:
 
 crystal.buildCrystalPackage rec {
   pname = "amqpcat";
-  version = "0.2.4";
+  version = "0.2.5";
 
   src = fetchFromGitHub {
     owner = "cloudamqp";
     repo = "amqpcat";
     rev = "v${version}";
-    hash = "sha256-Ec8LlOYYp3fXYgvps/ikeB4MqBEXTw1BAF5nJyL7dI0=";
+    hash = "sha256-AXX4aF5717lSIO0/2jNDPXXLtM/h//BlxO+cX71aWG4=";
   };
 
   format = "shards";
@@ -28,6 +28,5 @@ crystal.buildCrystalPackage rec {
     homepage = "https://github.com/cloudamqp/amqpcat";
     license = licenses.mit;
     maintainers = with maintainers; [ aaronjheng ];
-    broken = stdenv.isDarwin; # Linking errors. Hope someone can help fix it.
   };
 }
diff --git a/pkgs/development/tools/amqpcat/shards.nix b/pkgs/development/tools/amqpcat/shards.nix
index 3321c4c9e170..4cfa4933f11f 100644
--- a/pkgs/development/tools/amqpcat/shards.nix
+++ b/pkgs/development/tools/amqpcat/shards.nix
@@ -1,12 +1,12 @@
 {
   amq-protocol = {
     url = "https://github.com/cloudamqp/amq-protocol.cr.git";
-    rev = "v0.3.24";
-    sha256 = "011xia60wkmbjsk8j4qnswx0lg1i7vrchjwnxlksjv3npp2z98a3";
+    rev = "v1.1.4";
+    sha256 = "1x10zh371wmwi55rpdymfhf7hbh900zc94b64hkk12pp20mws55r";
   };
   amqp-client = {
     url = "https://github.com/cloudamqp/amqp-client.cr.git";
-    rev = "v0.6.2";
-    sha256 = "0h9c2v7ks776msm3dn2d68y85i6mm4gm5s3jlrs8dlp36kndkplc";
+    rev = "v1.0.11";
+    sha256 = "0d08k9jjd9jw40slj71wi9p6773d1djva9zjb40pskcgg2wfirx3";
   };
 }
diff --git a/pkgs/development/tools/analysis/flow/default.nix b/pkgs/development/tools/analysis/flow/default.nix
index f59a7e9ab7dd..8aa6e7e07446 100644
--- a/pkgs/development/tools/analysis/flow/default.nix
+++ b/pkgs/development/tools/analysis/flow/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "flow";
-  version = "0.216.1";
+  version = "0.217.0";
 
   src = fetchFromGitHub {
     owner = "facebook";
     repo = "flow";
     rev = "v${version}";
-    sha256 = "sha256-Nx6BAeaJGbrfjmH5dSb8Cb1TG2SDeF+lCeGOLW27cJs=";
+    sha256 = "sha256-QMgxic8fx7/Beahu8xyE247syLWgq1LZb3I5UdZp2XM=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/tools/continuous-integration/cirrus-cli/default.nix b/pkgs/development/tools/continuous-integration/cirrus-cli/default.nix
index 7c2a9302297a..9defb319111c 100644
--- a/pkgs/development/tools/continuous-integration/cirrus-cli/default.nix
+++ b/pkgs/development/tools/continuous-integration/cirrus-cli/default.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "cirrus-cli";
-  version = "0.103.1";
+  version = "0.104.0";
 
   src = fetchFromGitHub {
     owner = "cirruslabs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-K8uhI/lX0xCvCLKv4mpahZm0ukTInzMjFBnPumRp2gc=";
+    sha256 = "sha256-3X/VZirKSYD+y//e8Ft8f0D27vJWekdyUTmVvOgc5bQ=";
   };
 
   vendorHash = "sha256-0otC2+f0PMBZ+0Xiyq4kBd2YCJjAvDhThB3W9gIjHOY=";
diff --git a/pkgs/development/tools/database/atlas/default.nix b/pkgs/development/tools/database/atlas/default.nix
index ee5d4f89d63e..337f0393dca9 100644
--- a/pkgs/development/tools/database/atlas/default.nix
+++ b/pkgs/development/tools/database/atlas/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "atlas";
-  version = "0.14.0";
+  version = "0.14.1";
 
   src = fetchFromGitHub {
     owner = "ariga";
     repo = "atlas";
     rev = "v${version}";
-    hash = "sha256-6Y6b8BBfCErbKJqhR7zhltbysibUlY7KAyZe7g5mRxQ=";
+    hash = "sha256-dOqL/9sJUbaHqF3N5PEL7f6LxQQWNL0FvaH5BxQp4Xg=";
   };
 
   modRoot = "cmd/atlas";
diff --git a/pkgs/development/tools/database/dbmate/default.nix b/pkgs/development/tools/database/dbmate/default.nix
index d7eecde5e162..bad6a1644b9d 100644
--- a/pkgs/development/tools/database/dbmate/default.nix
+++ b/pkgs/development/tools/database/dbmate/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "dbmate";
-  version = "2.5.0";
+  version = "2.6.0";
 
   src = fetchFromGitHub {
     owner = "amacneil";
     repo = "dbmate";
     rev = "refs/tags/v${version}";
-    hash = "sha256-s3J5Mf+eCChIGmm89nq1heoJKscCA9nINGAGe0/qxaI=";
+    hash = "sha256-5dYWCcCQymwzWGY67lds5QQzHHkKt3OGkvqXDLwt/q8=";
   };
 
-  vendorHash = "sha256-ohSwDFisNXnq+mqGD2v4X58lumHvpyTyJxME418GSMY=";
+  vendorHash = "sha256-1sfIwawsWefh+nj4auqRjU4dWuDbgpvhAc8cF8DhICg=";
 
   doCheck = false;
 
diff --git a/pkgs/development/tools/doctl/default.nix b/pkgs/development/tools/doctl/default.nix
index d3f80124bd6c..31e6a3e71d54 100644
--- a/pkgs/development/tools/doctl/default.nix
+++ b/pkgs/development/tools/doctl/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "doctl";
-  version = "1.98.0";
+  version = "1.99.0";
 
   vendorHash = null;
 
@@ -31,7 +31,7 @@ buildGoModule rec {
     owner = "digitalocean";
     repo = "doctl";
     rev = "v${version}";
-    sha256 = "sha256-M9kSQoYcJudL/y/Yc6enVT/rJusd+oe3BdjkaLRQ0gU=";
+    sha256 = "sha256-xwkbekTnwisgr1gkUewMkz0E5iQg6bWgVz8tne7ME9Y=";
   };
 
   meta = with lib; {
diff --git a/pkgs/development/tools/gauge/default.nix b/pkgs/development/tools/gauge/default.nix
index d752151b356d..2884ee13ee42 100644
--- a/pkgs/development/tools/gauge/default.nix
+++ b/pkgs/development/tools/gauge/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "gauge";
-  version = "1.5.2";
+  version = "1.5.4";
 
   src = fetchFromGitHub {
     owner = "getgauge";
     repo = "gauge";
     rev = "v${version}";
-    hash = "sha256-gdqb9atksAU2bjNdoOfxb3XYl3H/1F51Xnfnm78J3CQ=";
+    hash = "sha256-BJyc8umtJUsZgj4jdoYf6PSaDg41mnrZNd6rAdewWro=";
   };
 
-  vendorHash = "sha256-PmidtbtX+x5cxuop+OCrfdPP5EiJnyvFyxHveGVGAEo=";
+  vendorHash = "sha256-K0LoAJzYzQorKp3o1oH5qruMBbJiCQrduBgoZ0naaLc=";
 
   excludedPackages = [ "build" "man" ];
 
diff --git a/pkgs/development/tools/gdlv/default.nix b/pkgs/development/tools/gdlv/default.nix
index 7dfa53901c4d..0992dc90b686 100644
--- a/pkgs/development/tools/gdlv/default.nix
+++ b/pkgs/development/tools/gdlv/default.nix
@@ -2,25 +2,32 @@
 , stdenv
 , buildGoModule
 , fetchFromGitHub
-, OpenGL
+, Foundation
+, CoreGraphics
+, Metal
 , AppKit
 }:
 
 buildGoModule rec {
   pname = "gdlv";
-  version = "1.8.0";
+  version = "1.10.0";
 
   src = fetchFromGitHub {
     owner = "aarzilli";
     repo = "gdlv";
     rev = "v${version}";
-    sha256 = "sha256-G1/Wbz836yfGZ/1ArICrNbWU6eh4SHXDmo4FKkjUszY=";
+    hash = "sha256-OPsQOFwV6jIX4ZOVwJmpTeQUr/zkfkqCr86HmPhYarI=";
   };
 
+  preBuild = lib.optionalString (stdenv.isDarwin && lib.versionOlder stdenv.hostPlatform.darwinMinVersion "11.0") ''
+    export MACOSX_DEPLOYMENT_TARGET=10.15
+  '';
+
   vendorHash = null;
+
   subPackages = ".";
 
-  buildInputs = lib.optionals stdenv.isDarwin [ OpenGL AppKit ];
+  buildInputs = lib.optionals stdenv.isDarwin [ Foundation CoreGraphics Metal AppKit ];
 
   meta = with lib; {
     description = "GUI frontend for Delve";
diff --git a/pkgs/development/tools/language-servers/ccls/default.nix b/pkgs/development/tools/language-servers/ccls/default.nix
index a401fc47eac9..6afbc1d4d9ab 100644
--- a/pkgs/development/tools/language-servers/ccls/default.nix
+++ b/pkgs/development/tools/language-servers/ccls/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ccls";
-  version = "0.20220729";
+  version = "0.20230717";
 
   src = fetchFromGitHub {
     owner = "MaskRay";
     repo = "ccls";
     rev = version;
-    sha256 = "sha256-eSWgk6KdEyjDLPc27CsOCXDU7AKMoXNyzoA6dSwZ5TI=";
+    sha256 = "sha256-u499fHd2lyqOYXJApFdiIXHQGF+QEVlQ4E8jm5VMb3w=";
   };
 
   nativeBuildInputs = [ cmake llvmPackages.llvm.dev ];
diff --git a/pkgs/development/tools/language-servers/millet/Cargo.lock b/pkgs/development/tools/language-servers/millet/Cargo.lock
index ba83ab4a9eb9..3c7e5cc534fc 100644
--- a/pkgs/development/tools/language-servers/millet/Cargo.lock
+++ b/pkgs/development/tools/language-servers/millet/Cargo.lock
@@ -28,7 +28,7 @@ dependencies = [
 
 [[package]]
 name = "analysis"
-version = "0.13.3"
+version = "0.13.4"
 dependencies = [
  "config",
  "diagnostic",
@@ -118,7 +118,7 @@ checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
 
 [[package]]
 name = "chain-map"
-version = "0.13.3"
+version = "0.13.4"
 dependencies = [
  "fast-hash",
  "str-util",
@@ -131,7 +131,7 @@ source = "git+https://github.com/azdavis/language-util.git#5e9a78d6f82e6129a7847
 
 [[package]]
 name = "cm-syntax"
-version = "0.13.3"
+version = "0.13.4"
 dependencies = [
  "lex-util",
  "paths",
@@ -160,7 +160,7 @@ dependencies = [
 
 [[package]]
 name = "config"
-version = "0.13.3"
+version = "0.13.4"
 dependencies = [
  "fast-hash",
  "serde",
@@ -188,7 +188,7 @@ checksum = "7704b5fdd17b18ae31c4c1da5a2e0305a2bf17b5249300a9ee9ed7b72114c636"
 
 [[package]]
 name = "cov-mark"
-version = "0.13.3"
+version = "0.13.4"
 dependencies = [
  "fast-hash",
  "once_cell",
@@ -427,7 +427,7 @@ dependencies = [
 
 [[package]]
 name = "input"
-version = "0.13.3"
+version = "0.13.4"
 dependencies = [
  "cm-syntax",
  "config",
@@ -475,7 +475,7 @@ checksum = "3752f229dcc5a481d60f385fa479ff46818033d881d2d801aa27dffcfb5e8306"
 
 [[package]]
 name = "lang-srv"
-version = "0.13.3"
+version = "0.13.4"
 dependencies = [
  "analysis",
  "anyhow",
@@ -503,7 +503,7 @@ checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
 
 [[package]]
 name = "lex-util"
-version = "0.13.3"
+version = "0.13.4"
 
 [[package]]
 name = "libc"
@@ -575,7 +575,7 @@ dependencies = [
 
 [[package]]
 name = "millet-cli"
-version = "0.13.3"
+version = "0.13.4"
 dependencies = [
  "analysis",
  "codespan-reporting",
@@ -593,7 +593,7 @@ dependencies = [
 
 [[package]]
 name = "millet-ls"
-version = "0.13.3"
+version = "0.13.4"
 dependencies = [
  "anyhow",
  "env_logger",
@@ -613,7 +613,7 @@ dependencies = [
 
 [[package]]
 name = "mlb-hir"
-version = "0.13.3"
+version = "0.13.4"
 dependencies = [
  "fast-hash",
  "paths",
@@ -624,7 +624,7 @@ dependencies = [
 
 [[package]]
 name = "mlb-statics"
-version = "0.13.3"
+version = "0.13.4"
 dependencies = [
  "config",
  "diagnostic",
@@ -648,7 +648,7 @@ dependencies = [
 
 [[package]]
 name = "mlb-syntax"
-version = "0.13.3"
+version = "0.13.4"
 dependencies = [
  "lex-util",
  "paths",
@@ -711,7 +711,7 @@ checksum = "dd8b5dd2ae5ed71462c540258bedcb51965123ad7e7ccf4b9a8cafaa4a63576d"
 
 [[package]]
 name = "panic-hook"
-version = "0.13.3"
+version = "0.13.4"
 dependencies = [
  "better-panic",
 ]
@@ -924,7 +924,7 @@ dependencies = [
 
 [[package]]
 name = "slash-var-path"
-version = "0.13.3"
+version = "0.13.4"
 dependencies = [
  "fast-hash",
  "str-util",
@@ -932,14 +932,14 @@ dependencies = [
 
 [[package]]
 name = "sml-comment"
-version = "0.13.3"
+version = "0.13.4"
 dependencies = [
  "sml-syntax",
 ]
 
 [[package]]
 name = "sml-dynamics"
-version = "0.13.3"
+version = "0.13.4"
 dependencies = [
  "fast-hash",
  "fmt-util",
@@ -950,7 +950,7 @@ dependencies = [
 
 [[package]]
 name = "sml-dynamics-tests"
-version = "0.13.3"
+version = "0.13.4"
 dependencies = [
  "config",
  "pretty_assertions",
@@ -966,7 +966,7 @@ dependencies = [
 
 [[package]]
 name = "sml-file-syntax"
-version = "0.13.3"
+version = "0.13.4"
 dependencies = [
  "config",
  "elapsed",
@@ -980,7 +980,7 @@ dependencies = [
 
 [[package]]
 name = "sml-fixity"
-version = "0.13.3"
+version = "0.13.4"
 dependencies = [
  "fast-hash",
  "once_cell",
@@ -989,7 +989,7 @@ dependencies = [
 
 [[package]]
 name = "sml-hir"
-version = "0.13.3"
+version = "0.13.4"
 dependencies = [
  "la-arena",
  "sml-lab",
@@ -1000,7 +1000,7 @@ dependencies = [
 
 [[package]]
 name = "sml-hir-lower"
-version = "0.13.3"
+version = "0.13.4"
 dependencies = [
  "config",
  "cov-mark",
@@ -1015,14 +1015,14 @@ dependencies = [
 
 [[package]]
 name = "sml-lab"
-version = "0.13.3"
+version = "0.13.4"
 dependencies = [
  "str-util",
 ]
 
 [[package]]
 name = "sml-lex"
-version = "0.13.3"
+version = "0.13.4"
 dependencies = [
  "cov-mark",
  "diagnostic",
@@ -1037,7 +1037,7 @@ source = "git+https://github.com/azdavis/sml-libs.git#0d94e3ce13f2a489dff86151f7
 
 [[package]]
 name = "sml-naive-fmt"
-version = "0.13.3"
+version = "0.13.4"
 dependencies = [
  "fast-hash",
  "sml-comment",
@@ -1046,11 +1046,11 @@ dependencies = [
 
 [[package]]
 name = "sml-namespace"
-version = "0.13.3"
+version = "0.13.4"
 
 [[package]]
 name = "sml-parse"
-version = "0.13.3"
+version = "0.13.4"
 dependencies = [
  "diagnostic",
  "event-parse",
@@ -1062,14 +1062,14 @@ dependencies = [
 
 [[package]]
 name = "sml-path"
-version = "0.13.3"
+version = "0.13.4"
 dependencies = [
  "str-util",
 ]
 
 [[package]]
 name = "sml-scon"
-version = "0.13.3"
+version = "0.13.4"
 dependencies = [
  "num-bigint",
  "num-traits",
@@ -1078,7 +1078,7 @@ dependencies = [
 
 [[package]]
 name = "sml-statics"
-version = "0.13.3"
+version = "0.13.4"
 dependencies = [
  "chain-map",
  "config",
@@ -1101,7 +1101,7 @@ dependencies = [
 
 [[package]]
 name = "sml-statics-types"
-version = "0.13.3"
+version = "0.13.4"
 dependencies = [
  "chain-map",
  "code-h2-md-map",
@@ -1120,7 +1120,7 @@ dependencies = [
 
 [[package]]
 name = "sml-symbol-kind"
-version = "0.13.3"
+version = "0.13.4"
 dependencies = [
  "sml-namespace",
  "sml-statics-types",
@@ -1128,7 +1128,7 @@ dependencies = [
 
 [[package]]
 name = "sml-syntax"
-version = "0.13.3"
+version = "0.13.4"
 dependencies = [
  "code-h2-md-map",
  "fast-hash",
@@ -1139,7 +1139,7 @@ dependencies = [
 
 [[package]]
 name = "sml-ty-var-scope"
-version = "0.13.3"
+version = "0.13.4"
 dependencies = [
  "fast-hash",
  "sml-hir",
@@ -1210,7 +1210,7 @@ dependencies = [
 
 [[package]]
 name = "tests"
-version = "0.13.3"
+version = "0.13.4"
 dependencies = [
  "analysis",
  "cm-syntax",
@@ -1554,7 +1554,7 @@ dependencies = [
 
 [[package]]
 name = "xtask"
-version = "0.13.3"
+version = "0.13.4"
 dependencies = [
  "anyhow",
  "flate2",
diff --git a/pkgs/development/tools/language-servers/millet/default.nix b/pkgs/development/tools/language-servers/millet/default.nix
index 98685dac45f4..27b7a7a5675b 100644
--- a/pkgs/development/tools/language-servers/millet/default.nix
+++ b/pkgs/development/tools/language-servers/millet/default.nix
@@ -2,13 +2,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "millet";
-  version = "0.13.3";
+  version = "0.13.4";
 
   src = fetchFromGitHub {
     owner = "azdavis";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-zbj1wFaPmxhPHIo+P3kbx0S0kksWDK+TgJ68ntzvcek=";
+    hash = "sha256-TLv2czZsZDOk8i8/0VxALflC/WV+MvRlbgbxB4kKsW0=";
   };
 
   cargoLock = {
diff --git a/pkgs/development/tools/language-servers/pylyzer/default.nix b/pkgs/development/tools/language-servers/pylyzer/default.nix
index 1383cfe31446..db4f582488b7 100644
--- a/pkgs/development/tools/language-servers/pylyzer/default.nix
+++ b/pkgs/development/tools/language-servers/pylyzer/default.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "pylyzer";
-  version = "0.0.45";
+  version = "0.0.47";
 
   src = fetchFromGitHub {
     owner = "mtshiba";
     repo = "pylyzer";
     rev = "v${version}";
-    hash = "sha256-YEw8EU+YUBqfKL2RM1komz6D1/2GshNQtQso7rN0yCM=";
+    hash = "sha256-edLzBQvyanF7ozkDH+aqUF8j8r2cNKBKxLvEyPoCRIc=";
   };
 
-  cargoHash = "sha256-5NaeSu/9mAQoqN/7mXrZomlzR/JjUxcIy9fRdV2H8yM=";
+  cargoHash = "sha256-moTOErMKe7+3lAAOfz3F3cGzYB+xXqtNLPO3134JFl0=";
 
   nativeBuildInputs = [
     git
diff --git a/pkgs/development/tools/mysql-shell/default.nix b/pkgs/development/tools/mysql-shell/default.nix
index 837d560f4dc4..b12e13d28011 100644
--- a/pkgs/development/tools/mysql-shell/default.nix
+++ b/pkgs/development/tools/mysql-shell/default.nix
@@ -36,26 +36,30 @@
 let
   pythonDeps = with python3.pkgs; [ certifi paramiko pyyaml ];
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "mysql-shell";
   version = "8.0.34";
 
   srcs = [
     (fetchurl {
-      url = "https://cdn.mysql.com//Downloads/MySQL-Shell/mysql-shell-${version}-src.tar.gz";
-      hash = "sha256-QY1PmhGw3PhqZ79+H/Xbb9uOvmrBlFQRS7idnV5OXF0=";
+      url = "https://cdn.mysql.com//Downloads/MySQL-${lib.versions.majorMinor finalAttrs.version}/mysql-${finalAttrs.version}.tar.gz";
+      hash = "sha256-5l0Do8QmGLX7+ZBCrtMyCUAumyeqYsfIdD/9R4jY2x0=";
     })
     (fetchurl {
-      url = "https://dev.mysql.com/get/Downloads/MySQL-${lib.versions.majorMinor version}/mysql-${version}.tar.gz";
-      hash = "sha256-5l0Do8QmGLX7+ZBCrtMyCUAumyeqYsfIdD/9R4jY2x0=";
+      url = "https://cdn.mysql.com//Downloads/MySQL-Shell/mysql-shell-${finalAttrs.version}-src.tar.gz";
+      hash = "sha256-QY1PmhGw3PhqZ79+H/Xbb9uOvmrBlFQRS7idnV5OXF0=";
     })
   ];
 
-  sourceRoot = "mysql-shell-${version}-src";
+  sourceRoot = "mysql-shell-${finalAttrs.version}-src";
+
+  postUnpack = ''
+    mv mysql-${finalAttrs.version} mysql
+  '';
 
   postPatch = ''
-    substituteInPlace ../mysql-${version}/cmake/libutils.cmake --replace /usr/bin/libtool libtool
-    substituteInPlace ../mysql-${version}/cmake/os/Darwin.cmake --replace /usr/bin/libtool libtool
+    substituteInPlace ../mysql/cmake/libutils.cmake --replace /usr/bin/libtool libtool
+    substituteInPlace ../mysql/cmake/os/Darwin.cmake --replace /usr/bin/libtool libtool
 
     substituteInPlace cmake/libutils.cmake --replace /usr/bin/libtool libtool
   '';
@@ -93,20 +97,19 @@ stdenv.mkDerivation rec {
     echo "Building mysqlclient mysqlxclient"
 
     cmake -DWITH_BOOST=system -DWITH_SYSTEM_LIBS=ON -DWITH_ROUTER=OFF -DWITH_UNIT_TESTS=OFF \
-      -DFORCE_UNSUPPORTED_COMPILER=1 -S ../mysql-${version} -B ../mysql-${version}/build
+      -DFORCE_UNSUPPORTED_COMPILER=1 -S ../mysql -B ../mysql/build
 
-    cmake --build ../mysql-${version}/build --parallel ''${NIX_BUILD_CORES:-1} --target mysqlclient mysqlxclient
+    cmake --build ../mysql/build --parallel ''${NIX_BUILD_CORES:-1} --target mysqlclient mysqlxclient
   '';
 
   cmakeFlags = [
-    "-DMYSQL_SOURCE_DIR=../mysql-${version}"
-    "-DMYSQL_BUILD_DIR=../mysql-${version}/build"
-    "-DMYSQL_CONFIG_EXECUTABLE=../../mysql-${version}/build/scripts/mysql_config"
+    "-DMYSQL_SOURCE_DIR=../mysql"
+    "-DMYSQL_BUILD_DIR=../mysql/build"
+    "-DMYSQL_CONFIG_EXECUTABLE=../../mysql/build/scripts/mysql_config"
     "-DWITH_ZSTD=system"
     "-DWITH_LZ4=system"
     "-DWITH_ZLIB=system"
     "-DWITH_PROTOBUF=${protobuf}"
-    "-DHAVE_V8=0" # V8 10.x required.
     "-DHAVE_PYTHON=1"
   ];
 
@@ -115,10 +118,10 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    homepage = "https://dev.mysql.com/doc/mysql-shell/${lib.versions.majorMinor version}/en/";
+    homepage = "https://dev.mysql.com/doc/mysql-shell/${lib.versions.majorMinor finalAttrs.version}/en/";
     description = "A new command line scriptable shell for MySQL";
     license = licenses.gpl2;
     maintainers = with maintainers; [ aaronjheng ];
     mainProgram = "mysqlsh";
   };
-}
+})
diff --git a/pkgs/development/tools/prettierd/default.nix b/pkgs/development/tools/prettierd/default.nix
index b3ba24db42c8..7e55e5be101a 100644
--- a/pkgs/development/tools/prettierd/default.nix
+++ b/pkgs/development/tools/prettierd/default.nix
@@ -8,18 +8,18 @@
 }:
 mkYarnPackage rec {
   pname = "prettierd";
-  version = "0.23.4";
+  version = "0.25.1";
 
   src = fetchFromGitHub {
     owner = "fsouza";
     repo = "prettierd";
     rev = "v${version}";
-    hash = "sha256-GTukjkA/53N9ICdfCJr5HAqhdL5T0pth6zAk8Fu/cis=";
+    hash = "sha256-aoRfZ9SJazz0ir1fyHypn3aYqK9DJOLLVPMuFcOm/20=";
   };
 
   offlineCache = fetchYarnDeps {
     yarnLock = src + "/yarn.lock";
-    hash = "sha256-32wMwkVgO5DQuROWnujVGNeCAUq1D6jJurecsD2ROOU=";
+    hash = "sha256-HsWsRIONRNY9akZ2LXlWcPhH6N5qCKnesaDX1gQp+NU=";
   };
 
   packageJSON = ./package.json;
diff --git a/pkgs/development/tools/prettierd/package.json b/pkgs/development/tools/prettierd/package.json
index 8769bac80c7b..5ba4d0980034 100644
--- a/pkgs/development/tools/prettierd/package.json
+++ b/pkgs/development/tools/prettierd/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@fsouza/prettierd",
-  "version": "0.23.4",
+  "version": "0.25.1",
   "description": "prettier, as a daemon",
   "bin": {
     "prettierd": "./bin/prettierd"
@@ -24,14 +24,13 @@
   },
   "homepage": "https://github.com/fsouza/prettierd",
   "devDependencies": {
-    "@types/node": "^20.2.5",
-    "@types/prettier": "^2.7.2",
-    "typescript": "^5.0.4"
+    "@types/node": "^20.6.3",
+    "@types/prettier": "^3.0.0",
+    "typescript": "^5.2.2"
   },
   "dependencies": {
-    "core_d": "^5.0.1",
-    "nanolru": "^1.0.0",
-    "prettier": "^2.8.8"
+    "core_d": "^6.0.0",
+    "prettier": "^3.0.3"
   },
   "files": [
     "bin",
@@ -40,7 +39,7 @@
     "README.md"
   ],
   "optionalDependencies": {
-    "@babel/parser": "^7.22.3",
-    "@typescript-eslint/typescript-estree": "^5.59.7"
+    "@babel/parser": "^7.22.16",
+    "@typescript-eslint/typescript-estree": "^6.7.2"
   }
 }
diff --git a/pkgs/development/tools/rust/cargo-insta/default.nix b/pkgs/development/tools/rust/cargo-insta/default.nix
index 5db787197a1d..18842a94a997 100644
--- a/pkgs/development/tools/rust/cargo-insta/default.nix
+++ b/pkgs/development/tools/rust/cargo-insta/default.nix
@@ -5,24 +5,24 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-insta";
-  version = "1.31.0";
+  version = "1.32.0";
 
   src = fetchFromGitHub {
     owner = "mitsuhiko";
     repo = "insta";
     rev = "refs/tags/${version}";
-    hash = "sha256-hQaVUBw8X60DW1Ox4GzO+OCWMHmVYuCkjH5x/sMULiE=";
+    hash = "sha256-s6d0q4K2UTG+BWzvH5KOAllzYAkEapEuDoiI9KQW31I=";
   };
 
   sourceRoot = "${src.name}/cargo-insta";
 
-  cargoHash = "sha256-q6Ups4SDGjT5Zc9ujhRpRdh3uWq99lizgA7gpPVSl+A=";
+  cargoHash = "sha256-ZQUzoKE3OGaY22VYiku7GqjGN9jUNx09a0EcgCRzzcM=";
 
   meta = with lib; {
     description = "A Cargo subcommand for snapshot testing";
     homepage = "https://github.com/mitsuhiko/insta";
     changelog = "https://github.com/mitsuhiko/insta/blob/${version}/CHANGELOG.md";
     license = licenses.asl20;
-    maintainers = with lib.maintainers; [ figsoda oxalica matthiasbeyer ];
+    maintainers = with maintainers; [ figsoda oxalica matthiasbeyer ];
   };
 }
diff --git a/pkgs/development/tools/rust/cargo-machete/default.nix b/pkgs/development/tools/rust/cargo-machete/default.nix
index 5078ddf6043c..75d83e7be5af 100644
--- a/pkgs/development/tools/rust/cargo-machete/default.nix
+++ b/pkgs/development/tools/rust/cargo-machete/default.nix
@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-machete";
-  version = "0.5.0";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "bnjbvr";
     repo = "cargo-machete";
     rev = "v${version}";
-    hash = "sha256-AOi4SnFkt82iQIP3bp/9JIaYiqjiEjKvJKUvrLQJTX8=";
+    hash = "sha256-LDhC/vwhyY4KD1RArCxl+nZl5IVj0zAjxlRLwWpnTvI=";
   };
 
-  cargoHash = "sha256-Q/2py0zgCYgnxFpcJD5PfNfIfIEUjtjFPjxDe25f0BQ=";
+  cargoHash = "sha256-vygAznYd/mtArSkLjoIpIxS4RiE3drRfKwNhD1w7KoY=";
 
   # tests require internet access
   doCheck = false;
diff --git a/pkgs/development/tools/trunk-io/default.nix b/pkgs/development/tools/trunk-io/default.nix
index d9be944f61fb..78b5247a4911 100644
--- a/pkgs/development/tools/trunk-io/default.nix
+++ b/pkgs/development/tools/trunk-io/default.nix
@@ -1,11 +1,11 @@
 { lib, stdenv, fetchurl }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "trunk-io";
   version = "1.2.7";
 
   src = fetchurl {
-    url = "https://trunk.io/releases/launcher/${version}/trunk";
+    url = "https://trunk.io/releases/launcher/${finalAttrs.version}/trunk";
     hash = "sha256-i2m+6Y6gvkHYwzESJv0DkLcHkXqz+g4e43TV6u1UTj8=";
   };
 
@@ -25,4 +25,4 @@ stdenv.mkDerivation rec {
     license = licenses.unfree;
     maintainers = with maintainers; [ aaronjheng ];
   };
-}
+})
diff --git a/pkgs/development/tools/typos/default.nix b/pkgs/development/tools/typos/default.nix
index f3752cb90a93..09de5505adba 100644
--- a/pkgs/development/tools/typos/default.nix
+++ b/pkgs/development/tools/typos/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "typos";
-  version = "1.16.12";
+  version = "1.16.13";
 
   src = fetchFromGitHub {
     owner = "crate-ci";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-zi1SVEl+EZacPOEjpOIG9KiXY2790fO63gGyc2jKNoE=";
+    hash = "sha256-ldmbPxQUEXQ8T1Gy2xIl8uCMMD/sat23esOSnnf3SWs=";
   };
 
-  cargoHash = "sha256-UQVERFAaGyrWIp+3fxZ0Bpbv7ZTPYQiTCRgaYnU8Zq0=";
+  cargoHash = "sha256-7o3xiaxuFanEplSADCRy4tFsACKNFlsNrJfNJ9HBJFg=";
 
   meta = with lib; {
     description = "Source code spell checker";
diff --git a/pkgs/games/harmonist/default.nix b/pkgs/games/harmonist/default.nix
index c08ed624959d..cbb556cbc948 100644
--- a/pkgs/games/harmonist/default.nix
+++ b/pkgs/games/harmonist/default.nix
@@ -25,6 +25,6 @@ buildGoModule rec {
     '';
     homepage = "https://harmonist.tuxfamily.org/";
     license = licenses.isc;
-    maintainers = with maintainers; [ aaronjheng ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/misc/dxvk/dxvk.nix b/pkgs/misc/dxvk/dxvk.nix
index b7bc4f2fc127..129090faaf47 100644
--- a/pkgs/misc/dxvk/dxvk.nix
+++ b/pkgs/misc/dxvk/dxvk.nix
@@ -46,12 +46,12 @@ let
       ];
     };
     "default" = rec {
-      version = "2.2";
+      version = "2.3";
       src = fetchFromGitHub {
         owner = "doitsujin";
         repo = "dxvk";
         rev = "v${version}";
-        hash = "sha256-GKRd66DvcA+7p3/wDqAUi02ZLRSVZ/fvJM0PQDEKVMA=";
+        hash = "sha256-RU+B0XfphD5HHW/vSzqHLUaGS3E31d5sOLp3lMmrCB8=";
         fetchSubmodules = true; # Needed for the DirectX headers and libdisplay-info
       };
       patches = [ ];
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index 2e5582677369..038a3105a182 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -1012,6 +1012,7 @@ let
 
       X86_AMD_PLATFORM_DEVICE = yes;
       X86_PLATFORM_DRIVERS_DELL = whenAtLeast "5.12" yes;
+      X86_PLATFORM_DRIVERS_HP = whenAtLeast "6.1" yes;
 
       LIRC = mkMerge [ (whenOlder "4.16" module) (whenAtLeast "4.17" yes) ];
 
diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 7b212cbdda35..0019a7c5f38c 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -4,35 +4,35 @@
         "hash": "sha256:1hbva5vsfi48h82ll4kmhzm5hxp7340bj2smwgvjikam26icaj54"
     },
     "6.5": {
-        "version": "6.5.4",
-        "hash": "sha256:0s8nzd8yaq06bq8byk7aakbk95gh0rhlif26h1biw94v48anrxxx"
+        "version": "6.5.5",
+        "hash": "sha256:15gg8sb6cfgk1afwj7fl7mj4nkj14w43vzwvw0qsg3nzyxwh7wcc"
     },
     "6.4": {
         "version": "6.4.16",
         "hash": "sha256:0zgj1z97jyx7wf12zrnlcp0mj4cl43ais9qsy6dh1jwylf2fq9ln"
     },
     "6.1": {
-        "version": "6.1.54",
-        "hash": "sha256:09sfrq2l8f777mx2n9mhb6bgz1064bl04921byqnmk87si31w653"
+        "version": "6.1.55",
+        "hash": "sha256:1h0mzx52q9pvdv7rhnvb8g68i7bnlc9rf8gy9qn4alsxq4g28zm8"
     },
     "5.15": {
-        "version": "5.15.132",
-        "hash": "sha256:1b0qjsaqjw2rk86shmmrj2aasblkn27acjmc761vnjg7sv2baxs1"
+        "version": "5.15.133",
+        "hash": "sha256:1paxzzcagc7s8i491zjny43rxhfamafyly438kj8hyw96iwmx17g"
     },
     "5.10": {
-        "version": "5.10.195",
-        "hash": "sha256:0n4vg2i9sq89wnz85arlyvwysh9s83cgzs5bk2wh98bivi5fwfs1"
+        "version": "5.10.197",
+        "hash": "sha256:1awkm7lln5gf6kld9z5h4mg39bd778jsdswwlwb7iv7bn03lafhq"
     },
     "5.4": {
-        "version": "5.4.256",
-        "hash": "sha256:0fim5q9xakwnjfg48bpsic9r2r8dvrjlalqqkm9vh1rml9mhi967"
+        "version": "5.4.257",
+        "hash": "sha256:1w1x91slzg9ggakqhyxnmvz77v2cwfk8bz0knrpgz9qya9q5jxrf"
     },
     "4.19": {
-        "version": "4.19.294",
-        "hash": "sha256:03x0xsb8a369zdr81hg6xdl5n5v48k6iwnhj6r29725777lvvbfc"
+        "version": "4.19.295",
+        "hash": "sha256:1b1qslpk1kka7nxam48s22xsqd9qmp716hmibgfsjxl5y3jc4cmp"
     },
     "4.14": {
-        "version": "4.14.325",
-        "hash": "sha256:117p1mdha57f6d3kdwac9jrbmib7g77q4xhir8ghl6fmrs1f2sav"
+        "version": "4.14.326",
+        "hash": "sha256:0y0lvzidw775mgx211wnc1c6223iqv8amz5y9jkz9h7l3l7y8p2m"
     }
 }
diff --git a/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix b/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
index 19b46d873086..eb2031b129da 100644
--- a/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
@@ -6,7 +6,7 @@
 , ... } @ args:
 
 let
-  version = "5.10.186-rt91"; # updated by ./update-rt.sh
+  version = "5.10.180-rt89"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
@@ -17,14 +17,14 @@ in buildLinux (args // {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${kversion}.tar.xz";
-    sha256 = "1qqv91r13akgik1q4jybf8czskxxizk6lpv4rsvjn9sx2dm2jq0y";
+    sha256 = "0a8cicvcyl5w4vi7gxhgd59ny44gj9cbv4z5pnwn9jgny55rm0ys";
   };
 
   kernelPatches = let rt-patch = {
     name = "rt";
     patch = fetchurl {
       url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "1h5p0p3clq0gmaszvddmfll17adv02wfp2bfrd5x3aigvigwfmjb";
+      sha256 = "00m6psnjam26x70f8wpssvjp6v49dyllp356fpfbhjqmj7y142bm";
     };
   }; in [ rt-patch ] ++ kernelPatches;
 
diff --git a/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix b/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix
index d599c3bda311..f45926020b5b 100644
--- a/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix
@@ -6,7 +6,7 @@
 , ... } @ args:
 
 let
-  version = "6.1.46-rt14"; # updated by ./update-rt.sh
+  version = "6.1.54-rt15"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
@@ -18,14 +18,14 @@ in buildLinux (args // {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v6.x/linux-${kversion}.tar.xz";
-    sha256 = "15m228bllks2p8gpsmvplx08yxzp7bij9fnmnafqszylrk7ppxpm";
+    sha256 = "09sfrq2l8f777mx2n9mhb6bgz1064bl04921byqnmk87si31w653";
   };
 
   kernelPatches = let rt-patch = {
     name = "rt";
     patch = fetchurl {
       url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "0mrpsy175iz0b51hwgqbj15w83lm3m57il3gqwb489gln7mpzy17";
+      sha256 = "0ihdid1ihg26kjini66j87vh4220gl8xm9dai7zignha2zh238kh";
     };
   }; in [ rt-patch ] ++ kernelPatches;
 
diff --git a/pkgs/os-specific/linux/rdma-core/default.nix b/pkgs/os-specific/linux/rdma-core/default.nix
index 98ddb7bb57b8..59cbc5d83a8f 100644
--- a/pkgs/os-specific/linux/rdma-core/default.nix
+++ b/pkgs/os-specific/linux/rdma-core/default.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rdma-core";
-  version = "47.0";
+  version = "48.0";
 
   src = fetchFromGitHub {
     owner = "linux-rdma";
     repo = "rdma-core";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-R+qgHDu9GRwT5ic1DCDlYe1Xb4hqi8pgitKq9iBBQNQ=";
+    hash = "sha256-/ltuZ9OiwJJ6CuAd6hqJwo+wETOgZ4UcW50BrjudF+k=";
   };
 
   strictDeps = true;
diff --git a/pkgs/servers/demoit/default.nix b/pkgs/servers/demoit/default.nix
index 1ffd5aba546d..3a587230eef8 100644
--- a/pkgs/servers/demoit/default.nix
+++ b/pkgs/servers/demoit/default.nix
@@ -3,17 +3,19 @@
 , fetchFromGitHub
 }:
 
-buildGoModule {
+buildGoModule rec {
   pname = "demoit";
-  version = "unstable-2022-09-03";
+  version = "1.0";
 
   src = fetchFromGitHub {
     owner = "dgageot";
     repo = "demoit";
-    rev = "258780987922e46abde8e848247af0a9435e3099";
-    sha256 = "sha256-yRfdnqk93GOTBa0zZrm4K3AkUqxGmlrwlKYcD6CtgRg=";
+    rev = "v${version}";
+    hash = "sha256-3g0k2Oau0d9tXYDtxHpUKvAQ1FnGhjRP05YVTlmgLhM=";
   };
+
   vendorHash = null;
+
   subPackages = [ "." ];
 
   meta = with lib; {
diff --git a/pkgs/servers/matrix-synapse/plugins/s3-storage-provider.nix b/pkgs/servers/matrix-synapse/plugins/s3-storage-provider.nix
index 42d62539b6b3..92e111dbb623 100644
--- a/pkgs/servers/matrix-synapse/plugins/s3-storage-provider.nix
+++ b/pkgs/servers/matrix-synapse/plugins/s3-storage-provider.nix
@@ -7,6 +7,7 @@
 , pythonOlder
 , tqdm
 , twisted
+, psycopg2
 }:
 
 buildPythonPackage rec {
@@ -37,6 +38,7 @@ buildPythonPackage rec {
     humanize
     tqdm
     twisted
+    psycopg2
   ]
   # For the s3_media_upload script
   ++ matrix-synapse-unwrapped.propagatedBuildInputs;
diff --git a/pkgs/servers/monitoring/do-agent/default.nix b/pkgs/servers/monitoring/do-agent/default.nix
index d1009616a1f9..51502d9e1ba6 100644
--- a/pkgs/servers/monitoring/do-agent/default.nix
+++ b/pkgs/servers/monitoring/do-agent/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "do-agent";
-  version = "3.16.6";
+  version = "3.16.7";
 
   src = fetchFromGitHub {
     owner = "digitalocean";
     repo = "do-agent";
     rev = version;
-    sha256 = "sha256-2KzgIv7DMEnzEJzC0fUrHQ1VIqClCgw55huqZFlctxk=";
+    sha256 = "sha256-m1OHCaSY13L+184ju6rzJ/SO0OCIlOtMNAvdkGTXTFw=";
   };
 
   ldflags = [
diff --git a/pkgs/servers/skydns/default.nix b/pkgs/servers/skydns/default.nix
index be9e815b9ec4..2ae2efbbb759 100644
--- a/pkgs/servers/skydns/default.nix
+++ b/pkgs/servers/skydns/default.nix
@@ -29,6 +29,6 @@ buildGoModule rec {
     description = "A distributed service for announcement and discovery of services";
     homepage = "https://github.com/skynetservices/skydns";
     license = lib.licenses.mit;
-    maintainers = with maintainers; [ aaronjheng ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/servers/sql/postgresql/ext/plpgsql_check.nix b/pkgs/servers/sql/postgresql/ext/plpgsql_check.nix
index 83e456069267..abbb1ac4d3e1 100644
--- a/pkgs/servers/sql/postgresql/ext/plpgsql_check.nix
+++ b/pkgs/servers/sql/postgresql/ext/plpgsql_check.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "plpgsql_check";
-  version = "2.5.0";
+  version = "2.5.1";
 
   src = fetchFromGitHub {
     owner = "okbob";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-6S1YG/4KGlgtTBrxh3p6eMd/aCovK/QME4f2z0YTUxc=";
+    hash = "sha256-4J4uKcQ/jRKKgrpUUed9MXDmOJaYKYDzznt1DItr6T0=";
   };
 
   buildInputs = [ postgresql ];
diff --git a/pkgs/tools/audio/dsp/default.nix b/pkgs/tools/audio/dsp/default.nix
index 57990199dfa8..e17e211d3402 100644
--- a/pkgs/tools/audio/dsp/default.nix
+++ b/pkgs/tools/audio/dsp/default.nix
@@ -15,14 +15,14 @@
 , libpulseaudio
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "dsp";
   version = "1.9";
 
   src = fetchFromGitHub {
     owner = "bmc0";
     repo = "dsp";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     hash = "sha256-S1pzVQ/ceNsx0vGmzdDWw2TjPVLiRgzR4edFblWsekY=";
   };
 
@@ -47,6 +47,6 @@ stdenv.mkDerivation rec {
     description = "An audio processing program with an interactive mode";
     license = licenses.isc;
     maintainers = with maintainers; [ aaronjheng ];
-    platforms = platforms.linux ++ platforms.darwin;
+    platforms = platforms.linux;
   };
-}
+})
diff --git a/pkgs/tools/backup/kopia/default.nix b/pkgs/tools/backup/kopia/default.nix
index ffdfd8acb6c6..020902c1a0c6 100644
--- a/pkgs/tools/backup/kopia/default.nix
+++ b/pkgs/tools/backup/kopia/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "kopia";
-  version = "0.13.0";
+  version = "0.14.1";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-wQZzFrrxLzJ16TOrhxBlUuz+eCdqW/PmHUTuJP1Wy9Y=";
+    hash = "sha256-ELnop8/f7/4E5FnWwGrPJt3n9YhSG1jei1tAt3zr1KI=";
   };
 
-  vendorHash = "sha256-OeDgaO125y8eCQlm9Lv5RZlb1fNLTCplEQbpJ2KMVms=";
+  vendorHash = "sha256-8NTAnkIJkFKyjQL7KBoCqtSBog9Hz1vPBo81u8YcA1A=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/filesystems/erofs-utils/default.nix b/pkgs/tools/filesystems/erofs-utils/default.nix
index a10addbfa51e..163439c903ed 100644
--- a/pkgs/tools/filesystems/erofs-utils/default.nix
+++ b/pkgs/tools/filesystems/erofs-utils/default.nix
@@ -1,20 +1,20 @@
-{ lib, stdenv, fetchurl, autoreconfHook, pkg-config, fuse, util-linux, lz4
+{ lib, stdenv, fetchurl, autoreconfHook, pkg-config, fuse, util-linux, lz4, zlib
 , fuseSupport ? stdenv.isLinux
 }:
 
 stdenv.mkDerivation rec {
   pname = "erofs-utils";
-  version = "1.6";
+  version = "1.7";
   outputs = [ "out" "man" ];
 
   src = fetchurl {
     url =
       "https://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs-utils.git/snapshot/erofs-utils-${version}.tar.gz";
-    sha256 = "sha256-2/Gtrv8buFMrKacsip4ZGTjJOJlGdw3HY9PFnm8yBXE=";
+    hash = "sha256-tutSm7Qj6y3XecnanCYyhVSItLkeI1U6Mc4j8Rycziw=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
-  buildInputs = [ util-linux lz4 ]
+  buildInputs = [ util-linux lz4 zlib ]
     ++ lib.optionals fuseSupport [ fuse ];
 
   configureFlags = lib.optionals fuseSupport [ "--enable-fuse" ];
diff --git a/pkgs/tools/filesystems/gcsfuse/default.nix b/pkgs/tools/filesystems/gcsfuse/default.nix
index e9cb2d8912b1..0af1a965fc4e 100644
--- a/pkgs/tools/filesystems/gcsfuse/default.nix
+++ b/pkgs/tools/filesystems/gcsfuse/default.nix
@@ -42,6 +42,6 @@ buildGoModule rec {
     homepage = "https://cloud.google.com/storage/docs/gcs-fuse";
     changelog = "https://github.com/GoogleCloudPlatform/gcsfuse/releases/tag/v${version}";
     license = licenses.asl20;
-    maintainers = with maintainers; [ aaronjheng ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/tools/filesystems/go-mtpfs/default.nix b/pkgs/tools/filesystems/go-mtpfs/default.nix
index 115928e4979c..f82e5b7c362a 100644
--- a/pkgs/tools/filesystems/go-mtpfs/default.nix
+++ b/pkgs/tools/filesystems/go-mtpfs/default.nix
@@ -28,7 +28,7 @@ buildGoModule rec {
     description = "A simple FUSE filesystem for mounting Android devices as a MTP device";
     homepage = "https://github.com/hanwen/go-mtpfs";
     license = licenses.bsd3;
-    maintainers = with maintainers; [ aaronjheng ];
+    maintainers = with maintainers; [ ];
     broken = stdenv.isDarwin;
   };
 }
diff --git a/pkgs/tools/filesystems/mergerfs/default.nix b/pkgs/tools/filesystems/mergerfs/default.nix
index b48db16b8fdf..e2e6e28e3b62 100644
--- a/pkgs/tools/filesystems/mergerfs/default.nix
+++ b/pkgs/tools/filesystems/mergerfs/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mergerfs";
-  version = "2.37.0";
+  version = "2.37.1";
 
   src = fetchFromGitHub {
     owner = "trapexit";
     repo = pname;
     rev = version;
-    sha256 = "sha256-IJcTzEKFMSAryG44Rpwgl0toxFxNyyJyaVC8MO1Dv7M=";
+    sha256 = "sha256-4WowGrmFDDpmZlAVH73oiKBdgQeqEkbwZCaDSd1rAEc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/games/minecraft/minecraft-server-hibernation/default.nix b/pkgs/tools/games/minecraft/minecraft-server-hibernation/default.nix
index 4e39edd83efa..ff0e7873827b 100644
--- a/pkgs/tools/games/minecraft/minecraft-server-hibernation/default.nix
+++ b/pkgs/tools/games/minecraft/minecraft-server-hibernation/default.nix
@@ -2,24 +2,35 @@
 
 buildGoModule rec {
   pname = "minecraft-server-hibernation";
-  version = "2.4.10";
+  version = "2.5.0";
 
   src = fetchFromGitHub {
     owner = "gekware";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-hflPVO+gqHr0jDrhWzd7t/E6WsswiMKMHCkTUK4E05k=";
+    hash = "sha256-b6LeqjIraIasHBpaVgy8esl4NV8rdBrfO7ewgeIocS8=";
   };
 
-  vendorHash = "sha256-W6P7wz1FGL6Os1zmmqWJ7/sO8zizfnwg+TMiFWGHIOM=";
+  vendorHash = null;
 
   ldflags = [ "-s" "-w" ];
 
+  checkFlags =
+    let
+      skippedTests = [
+        # Disable tests requiring network access
+        "Test_getPing"
+        "Test_getReqType"
+        "Test_QueryBasic"
+        "Test_QueryFull"
+      ];
+    in
+    [ "-skip" "${builtins.concatStringsSep "|" skippedTests}" ];
+
   meta = with lib; {
     description = "Autostart and stop minecraft-server when players join/leave";
     homepage = "https://github.com/gekware/minecraft-server-hibernation";
     license = licenses.gpl3Only;
-    platforms = platforms.linux;
     maintainers = with maintainers; [ squarepear ];
   };
 }
diff --git a/pkgs/tools/misc/claws/default.nix b/pkgs/tools/misc/claws/default.nix
index 9d360e40c2a8..5690ec74d0a2 100644
--- a/pkgs/tools/misc/claws/default.nix
+++ b/pkgs/tools/misc/claws/default.nix
@@ -19,6 +19,6 @@ buildGoModule rec {
     homepage = "https://github.com/thehowl/claws";
     description = "Interactive command line client for testing websocket servers";
     license = licenses.mit;
-    maintainers = with maintainers; [ aaronjheng ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/tools/misc/dashing/default.nix b/pkgs/tools/misc/dashing/default.nix
index 4b960c3fa54a..7a1541b7e940 100644
--- a/pkgs/tools/misc/dashing/default.nix
+++ b/pkgs/tools/misc/dashing/default.nix
@@ -23,6 +23,6 @@ buildGoModule rec {
     description = "A Dash Generator Script for Any HTML";
     homepage = "https://github.com/technosophos/dashing";
     license = licenses.mit;
-    maintainers = with maintainers; [ aaronjheng ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/tools/misc/gosu/default.nix b/pkgs/tools/misc/gosu/default.nix
index df42c6ea9495..6f08e027d8f8 100644
--- a/pkgs/tools/misc/gosu/default.nix
+++ b/pkgs/tools/misc/gosu/default.nix
@@ -23,7 +23,7 @@ buildGoModule rec {
     description = "Tool that avoids TTY and signal-forwarding behavior of sudo and su";
     homepage = "https://github.com/tianon/gosu";
     license = licenses.asl20;
-    maintainers = with maintainers; [ aaronjheng ];
+    maintainers = with maintainers; [ ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/tools/misc/pouf/default.nix b/pkgs/tools/misc/pouf/default.nix
index 6b4f812bf3b2..9206e16463ed 100644
--- a/pkgs/tools/misc/pouf/default.nix
+++ b/pkgs/tools/misc/pouf/default.nix
@@ -5,16 +5,21 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "pouf";
-  version = "0.5.1";
+  version = "0.6.3";
 
   src = fetchFromGitHub {
     owner = "mothsart";
     repo = pname;
     rev = version;
-    sha256 = "1zz91r37d6nqvdy29syq853krqdkigiqihwz7ww9kvagfvzvdh13";
+    hash = "sha256-tW86b9a7u1jyfmHjwjs+5DaUujRZH+VhGQsj0CBj0yk=";
   };
 
-  cargoSha256 = "1ikm9fqi37jznln2xsyzfm625lv8kwjzanpm3wglx2s1k1jkmcy9";
+  cargoHash = "sha256-rVJAaeg27SdM8cTx12rKLIGEYtXUhLHXUYpT78oVNlo=";
+
+  # Cargo.lock is outdated.
+  preConfigure = ''
+    cargo update --offline
+  '';
 
   postInstall = "make PREFIX=$out copy-data";
 
diff --git a/pkgs/tools/misc/wakatime/default.nix b/pkgs/tools/misc/wakatime/default.nix
index bf0e9657296b..2ce8df19867e 100644
--- a/pkgs/tools/misc/wakatime/default.nix
+++ b/pkgs/tools/misc/wakatime/default.nix
@@ -47,7 +47,7 @@ buildGoModule rec {
     homepage = "https://wakatime.com/";
     description = "WakaTime command line interface";
     license = licenses.bsd3;
-    maintainers = with maintainers; [ aaronjheng ];
+    maintainers = with maintainers; [ ];
     mainProgram = "wakatime-cli";
   };
 }
diff --git a/pkgs/tools/networking/shadowsocks-rust/default.nix b/pkgs/tools/networking/shadowsocks-rust/default.nix
index 55fc6289fe09..4dcd1ee250e4 100644
--- a/pkgs/tools/networking/shadowsocks-rust/default.nix
+++ b/pkgs/tools/networking/shadowsocks-rust/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "shadowsocks-rust";
-  version = "1.16.1";
+  version = "1.16.2";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "shadowsocks";
     repo = pname;
-    hash = "sha256-h/2zHxgp8sXcUOpmtneoAX0hNt19pObfyGW3wIzQNxc=";
+    hash = "sha256-TE1pGLS77WpaT0J0rUllihmHY5nOHzxd1LMsNjptXrg=";
   };
 
-  cargoHash = "sha256-MZGd1SyTSZ6y9W9h+M3Y5cwX6hLCFiuPZb307PRtvQk=";
+  cargoHash = "sha256-Fq/EMA7PHL/1eWNwT0naRtfkIU0Hia5yzFWmsyugOFc=";
 
   nativeBuildInputs = lib.optionals stdenv.isLinux [ pkg-config ];
 
diff --git a/pkgs/tools/security/bitwarden/cli.nix b/pkgs/tools/security/bitwarden/cli.nix
index 22cfca249718..6e4ebb9d0987 100644
--- a/pkgs/tools/security/bitwarden/cli.nix
+++ b/pkgs/tools/security/bitwarden/cli.nix
@@ -12,16 +12,16 @@ let
   buildNpmPackage' = buildNpmPackage.override { nodejs = nodejs_18; };
 in buildNpmPackage' rec {
   pname = "bitwarden-cli";
-  version = "2023.8.2";
+  version = "2023.9.0";
 
   src = fetchFromGitHub {
     owner = "bitwarden";
     repo = "clients";
     rev = "cli-v${version}";
-    hash = "sha256-v9ql01dwWf9kBxw75n9svQousrnbUi8NY1wkJx06teg=";
+    hash = "sha256-s9jj1qmh4aCvtVY85U4AU7pcc8ABu9essFYqwf64dns=";
   };
 
-  npmDepsHash = "sha256-RvkauNvt6MZxWMssEtaCjXP1z/3NsReywUgCefV/jjM=";
+  npmDepsHash = "sha256-0q3XoC87kfC2PYMsNse4DV8M8OXjckiLTdN3LK06lZY=";
 
   nativeBuildInputs = [
     python3
diff --git a/pkgs/tools/security/bitwarden/default.nix b/pkgs/tools/security/bitwarden/default.nix
index fae9848f482f..41ce0d7e5e89 100644
--- a/pkgs/tools/security/bitwarden/default.nix
+++ b/pkgs/tools/security/bitwarden/default.nix
@@ -1,6 +1,7 @@
 { lib
 , applyPatches
 , buildNpmPackage
+, cargo
 , dbus
 , electron_24
 , fetchFromGitHub
@@ -12,11 +13,12 @@
 , makeDesktopItem
 , makeWrapper
 , moreutils
+, napi-rs-cli
 , nodejs_18
 , pkg-config
 , python3
+, rustc
 , rustPlatform
-, wrapGAppsHook
 }:
 
 let
@@ -26,56 +28,6 @@ let
   buildNpmPackage' = buildNpmPackage.override { nodejs = nodejs_18; };
   electron = electron_24;
 
-  version = "2023.8.3";
-  src = applyPatches {
-    src = fetchFromGitHub {
-      owner = "bitwarden";
-      repo = "clients";
-      rev = "desktop-v${version}";
-      hash = "sha256-ZsAc9tC087Em/VzgaVm5fU+JnI4gIsSAphxicdJWztU=";
-    };
-
-    patches = [ ];
-  };
-
-  desktop-native = rustPlatform.buildRustPackage {
-    pname = "bitwarden-desktop-native";
-    inherit src version;
-    sourceRoot = "${src.name}/apps/desktop/desktop_native";
-    cargoHash = "sha256-iBZvdBfuZtcoSgyU4B58ARIBplqUuT5bRev9qnk9LpE=";
-
-    nativeBuildInputs = [
-      pkg-config
-      wrapGAppsHook
-    ];
-
-    buildInputs = [
-      glib
-      gtk3
-      libsecret
-    ];
-
-    nativeCheckInputs = [
-      dbus
-      (gnome.gnome-keyring.override { useWrappedDaemon = false; })
-    ];
-
-    checkFlags = [
-      "--skip=password::password::tests::test"
-    ];
-
-    checkPhase = ''
-      runHook preCheck
-
-      export HOME=$(mktemp -d)
-      export -f cargoCheckHook runHook _eval _callImplicitHook
-      dbus-run-session \
-        --config-file=${dbus}/share/dbus-1/session.conf \
-        -- bash -e -c cargoCheckHook
-      runHook postCheck
-    '';
-  };
-
   desktopItem = makeDesktopItem {
     name = "bitwarden";
     exec = "bitwarden %U";
@@ -84,26 +36,48 @@ let
     desktopName = "Bitwarden";
     categories = [ "Utility" ];
   };
-
-in
-
-buildNpmPackage' {
+in buildNpmPackage' rec {
   pname = "bitwarden";
-  inherit src version;
+  version = "2023.9.0";
+
+  src = fetchFromGitHub {
+    owner = "bitwarden";
+    repo = "clients";
+    rev = "desktop-v${version}";
+    hash = "sha256-8rNJmDpKLzTre5c2wktle7tthp1owZK5WAQP80/2R0g=";
+  };
 
   makeCacheWritable = true;
-  npmBuildFlags = [
-    "--workspace apps/desktop"
-  ];
-  npmDepsHash = "sha256-ARq6iYOkL9CMyAX37g8+Wf+UQsH7hU1jCq/52I1qS9A=";
+  npmWorkspace = "apps/desktop";
+  npmDepsHash = "sha256-0q3XoC87kfC2PYMsNse4DV8M8OXjckiLTdN3LK06lZY=";
 
-  ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    name = "${pname}-${version}";
+    inherit src;
+    sourceRoot = "${src.name}/${cargoRoot}";
+    hash = "sha256-YF3UHQWCSuWAg2frE8bo1XrLn44P6+1A7YUh4RZxwo0=";
+  };
+  cargoRoot = "apps/desktop/desktop_native";
+
+  env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
 
   nativeBuildInputs = [
+    cargo
     jq
     makeWrapper
     moreutils
+    napi-rs-cli
+    pkg-config
     python3
+    rustc
+    rustPlatform.cargoCheckHook
+    rustPlatform.cargoSetupHook
+  ];
+
+  buildInputs = [
+    glib
+    gtk3
+    libsecret
   ];
 
   preBuild = ''
@@ -111,15 +85,14 @@ buildNpmPackage' {
       echo 'ERROR: electron version mismatch'
       exit 1
     fi
-
-    jq 'del(.scripts.postinstall)' apps/desktop/package.json | sponge apps/desktop/package.json
-    jq '.scripts.build = ""' apps/desktop/desktop_native/package.json | sponge apps/desktop/desktop_native/package.json
-    cp ${desktop-native}/lib/libdesktop_native.so apps/desktop/desktop_native/desktop_native.linux-x64-musl.node
   '';
 
   postBuild = ''
     pushd apps/desktop
 
+    # desktop_native/index.js loads a file of that name regarldess of the libc being used
+    mv desktop_native/desktop_native.* desktop_native/desktop_native.linux-x64-musl.node
+
     npm exec electron-builder -- \
       --dir \
       -c.electronDist=${electron}/libexec/electron \
@@ -128,6 +101,32 @@ buildNpmPackage' {
     popd
   '';
 
+  doCheck = true;
+
+  nativeCheckInputs = [
+    dbus
+    (gnome.gnome-keyring.override { useWrappedDaemon = false; })
+  ];
+
+  checkFlags = [
+    "--skip=password::password::tests::test"
+  ];
+
+  checkPhase = ''
+    runHook preCheck
+
+    pushd ${cargoRoot}
+    export HOME=$(mktemp -d)
+    export -f cargoCheckHook runHook _eval _callImplicitHook
+    export cargoCheckType=release
+    dbus-run-session \
+      --config-file=${dbus}/share/dbus-1/session.conf \
+      -- bash -e -c cargoCheckHook
+    popd
+
+    runHook postCheck
+  '';
+
   installPhase = ''
     mkdir $out
 
@@ -154,11 +153,12 @@ buildNpmPackage' {
     popd
   '';
 
-  meta = with lib; {
+  meta = {
+    changelog = "https://github.com/bitwarden/clients/releases/tag/${src.rev}";
     inherit description;
     homepage = "https://bitwarden.com";
     license = lib.licenses.gpl3;
-    maintainers = with maintainers; [ amarshall kiwi ];
+    maintainers = with lib.maintainers; [ amarshall kiwi ];
     platforms = [ "x86_64-linux" ];
   };
 }
diff --git a/pkgs/tools/security/hologram/default.nix b/pkgs/tools/security/hologram/default.nix
index 1a7e45c8024d..86bc4293747c 100644
--- a/pkgs/tools/security/hologram/default.nix
+++ b/pkgs/tools/security/hologram/default.nix
@@ -24,7 +24,7 @@ buildGoModule rec {
   meta = with lib; {
     homepage = "https://github.com/AdRoll/hologram/";
     description = "Easy, painless AWS credentials on developer laptops";
-    maintainers = with maintainers; [ aaronjheng ];
+    maintainers = with maintainers; [ ];
     license = licenses.asl20;
   };
 }
diff --git a/pkgs/tools/system/jump/default.nix b/pkgs/tools/system/jump/default.nix
index c1e625e14c15..3ff64996d013 100644
--- a/pkgs/tools/system/jump/default.nix
+++ b/pkgs/tools/system/jump/default.nix
@@ -30,6 +30,6 @@ buildGoModule rec {
     '';
     homepage = "https://github.com/gsamokovarov/jump";
     license = licenses.mit;
-    maintainers = with maintainers; [ aaronjheng ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/tools/system/nkeys/default.nix b/pkgs/tools/system/nkeys/default.nix
index 22a22157f06e..9914e6f14243 100644
--- a/pkgs/tools/system/nkeys/default.nix
+++ b/pkgs/tools/system/nkeys/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "nkeys";
-  version = "0.4.4";
+  version = "0.4.5";
 
   src = fetchFromGitHub {
     owner = "nats-io";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-ePpFzwjFKcm/xgt9TBl1CVnJYxO389rV9uLONeUeX0c=";
+    hash = "sha256-txPd4Q/ApaNutt2Ik5E2478tHAQmpTJQKYnHA9niz3E=";
   };
 
   vendorHash = "sha256-ozK0vimYs7wGplw1QhSu+q8R+YsIYHU4m08a7K6i78I=";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 5a55998eab43..3577d59436b0 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1078,6 +1078,7 @@ with pkgs;
     antlr = antlr4_10;
     boost = boost177; # Configure checks for specific version.
     icu =  icu69;
+    protobuf = protobuf3_21;
   };
 
   broadlink-cli = callPackage ../tools/misc/broadlink-cli { };
@@ -5678,6 +5679,7 @@ with pkgs;
   hyprdim = callPackage ../applications/misc/hyprdim { };
 
   hyprland = callPackage ../applications/window-managers/hyprwm/hyprland {
+    stdenv = gcc13Stdenv;
     wlroots = callPackage ../applications/window-managers/hyprwm/hyprland/wlroots.nix { };
     udis86 = callPackage ../applications/window-managers/hyprwm/hyprland/udis86.nix { };
   };
@@ -28583,7 +28585,7 @@ with pkgs;
   ginkgo = callPackage ../development/tools/ginkgo { };
 
   gdlv = darwin.apple_sdk_11_0.callPackage ../development/tools/gdlv {
-    inherit (darwin.apple_sdk_11_0.frameworks) OpenGL AppKit;
+    inherit (darwin.apple_sdk_11_0.frameworks) Foundation CoreGraphics Metal AppKit;
   };
 
   go-bindata = callPackage ../development/tools/go-bindata { };
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 0caac1471461..2e6d5e0e8986 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -19827,10 +19827,10 @@ with self; {
 
   PerlLanguageServer = buildPerlPackage {
     pname = "Perl-LanguageServer";
-    version = "2.5.0";
+    version = "2.6.1";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/G/GR/GRICHTER/Perl-LanguageServer-2.5.0.tar.gz";
-      hash = "sha256-LQYcIkepqAT1JMkSuIN6mxivz6AZkpShcRsVD1oTmQQ=";
+      url = "mirror://cpan/authors/id/G/GR/GRICHTER/Perl-LanguageServer-2.6.1.tar.gz";
+      hash = "sha256-IDM0uwsEXMeHAu9DA0CdCB87aN3XRoNEdGOIJ8NMsZg=";
     };
     propagatedBuildInputs = [ AnyEvent AnyEventAIO ClassRefresh CompilerLexer Coro DataDump HashSafeKeys IOAIO JSON Moose PadWalker ];
     meta = {
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index e0d755933ffe..22cceac43250 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -910,6 +910,8 @@ self: super: with self; {
 
   automate-home = callPackage ../development/python-modules/automate-home { };
 
+  automx2 = callPackage ../development/python-modules/automx2 { };
+
   autopage = callPackage ../development/python-modules/autopage { };
 
   autopep8 = callPackage ../development/python-modules/autopep8 { };