diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 7c5b83464242..bd8cc3688e41 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -9245,6 +9245,13 @@
     githubId = 2057309;
     name = "Sergey Sofeychuk";
   };
+  lx = {
+    email = "alex@adnab.me";
+    github = "Alexis211";
+    githubId = 101484;
+    matrix = "@lx:deuxfleurs.fr";
+    name = "Alex Auvolat";
+  };
   lxea = {
     email = "nix@amk.ie";
     github = "lxea";
diff --git a/nixos/doc/manual/release-notes/rl-2305.section.md b/nixos/doc/manual/release-notes/rl-2305.section.md
index 6b0147571847..10224db34288 100644
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@@ -107,6 +107,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - [trurl](https://github.com/curl/trurl), a command line tool for URL parsing and manipulation.
 
+- [wgautomesh](https://git.deuxfleurs.fr/Deuxfleurs/wgautomesh), a simple utility to help connect wireguard nodes together in a full mesh topology. Available as [services.wgautomesh](options.html#opt-services.wgautomesh.enable).
+
 - [woodpecker-agents](https://woodpecker-ci.org/), a simple CI engine with great extensibility. Available as [services.woodpecker-agents](#opt-services.woodpecker-agents.agents._name_.enable).
 
 - [woodpecker-server](https://woodpecker-ci.org/), a simple CI engine with great extensibility. Available as [services.woodpecker-server](#opt-services.woodpecker-server.enable).
diff --git a/nixos/modules/installer/tools/nixos-generate-config.pl b/nixos/modules/installer/tools/nixos-generate-config.pl
index 74972c0994be..a082ed3450e9 100644
--- a/nixos/modules/installer/tools/nixos-generate-config.pl
+++ b/nixos/modules/installer/tools/nixos-generate-config.pl
@@ -200,7 +200,7 @@ sub pciCheck {
     }
 
     # In case this is a virtio scsi device, we need to explicitly make this available.
-    if ($vendor eq "0x1af4" && $device eq "0x1004") {
+    if ($vendor eq "0x1af4" && ($device eq "0x1004" || $device eq "0x1048") ) {
         push @initrdAvailableKernelModules, "virtio_scsi";
     }
 
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index b6ac23c10d06..f1c459f75570 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1044,6 +1044,7 @@
   ./services/networking/wg-netmanager.nix
   ./services/networking/webhook.nix
   ./services/networking/wg-quick.nix
+  ./services/networking/wgautomesh.nix
   ./services/networking/wireguard.nix
   ./services/networking/wpa_supplicant.nix
   ./services/networking/wstunnel.nix
diff --git a/nixos/modules/services/networking/wgautomesh.nix b/nixos/modules/services/networking/wgautomesh.nix
new file mode 100644
index 000000000000..93227a9b625d
--- /dev/null
+++ b/nixos/modules/services/networking/wgautomesh.nix
@@ -0,0 +1,161 @@
+{ lib, config, pkgs, ... }:
+with lib;
+let
+  cfg = config.services.wgautomesh;
+  settingsFormat = pkgs.formats.toml { };
+  configFile =
+    # Have to remove nulls manually as TOML generator will not just skip key
+    # if value is null
+    settingsFormat.generate "wgautomesh-config.toml"
+      (filterAttrs (k: v: v != null)
+        (mapAttrs
+          (k: v:
+            if k == "peers"
+            then map (e: filterAttrs (k: v: v != null) e) v
+            else v)
+          cfg.settings));
+  runtimeConfigFile =
+    if cfg.enableGossipEncryption
+    then "/run/wgautomesh/wgautomesh.toml"
+    else configFile;
+in
+{
+  options.services.wgautomesh = {
+    enable = mkEnableOption (mdDoc "the wgautomesh daemon");
+    logLevel = mkOption {
+      type = types.enum [ "trace" "debug" "info" "warn" "error" ];
+      default = "info";
+      description = mdDoc "wgautomesh log level.";
+    };
+    enableGossipEncryption = mkOption {
+      type = types.bool;
+      default = true;
+      description = mdDoc "Enable encryption of gossip traffic.";
+    };
+    gossipSecretFile = mkOption {
+      type = types.path;
+      description = mdDoc ''
+        File containing the shared secret key to use for gossip encryption.
+        Required if `enableGossipEncryption` is set.
+      '';
+    };
+    enablePersistence = mkOption {
+      type = types.bool;
+      default = true;
+      description = mdDoc "Enable persistence of Wireguard peer info between restarts.";
+    };
+    openFirewall = mkOption {
+      type = types.bool;
+      default = true;
+      description = mdDoc "Automatically open gossip port in firewall (recommended).";
+    };
+    settings = mkOption {
+      type = types.submodule {
+        freeformType = settingsFormat.type;
+        options = {
+
+          interface = mkOption {
+            type = types.str;
+            description = mdDoc ''
+              Wireguard interface to manage (it is NOT created by wgautomesh, you
+              should use another NixOS option to create it such as
+              `networking.wireguard.interfaces.wg0 = {...};`).
+            '';
+            example = "wg0";
+          };
+          gossip_port = mkOption {
+            type = types.port;
+            description = mdDoc ''
+              wgautomesh gossip port, this MUST be the same number on all nodes in
+              the wgautomesh network.
+            '';
+            default = 1666;
+          };
+          lan_discovery = mkOption {
+            type = types.bool;
+            default = true;
+            description = mdDoc "Enable discovery of peers on the same LAN using UDP broadcast.";
+          };
+          upnp_forward_external_port = mkOption {
+            type = types.nullOr types.port;
+            default = null;
+            description = mdDoc ''
+              Public port number to try to redirect to this machine's Wireguard
+              daemon using UPnP IGD.
+            '';
+          };
+          peers = mkOption {
+            type = types.listOf (types.submodule {
+              options = {
+                pubkey = mkOption {
+                  type = types.str;
+                  description = mdDoc "Wireguard public key of this peer.";
+                };
+                address = mkOption {
+                  type = types.str;
+                  description = mdDoc ''
+                    Wireguard address of this peer (a single IP address, multliple
+                    addresses or address ranges are not supported).
+                  '';
+                  example = "10.0.0.42";
+                };
+                endpoint = mkOption {
+                  type = types.nullOr types.str;
+                  description = mdDoc ''
+                    Bootstrap endpoint for connecting to this Wireguard peer if no
+                    other address is known or none are working.
+                  '';
+                  default = null;
+                  example = "wgnode.mydomain.example:51820";
+                };
+              };
+            });
+            default = [ ];
+            description = mdDoc "wgautomesh peer list.";
+          };
+        };
+
+      };
+      default = { };
+      description = mdDoc "Configuration for wgautomesh.";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    services.wgautomesh.settings = {
+      gossip_secret_file = mkIf cfg.enableGossipEncryption "$CREDENTIALS_DIRECTORY/gossip_secret";
+      persist_file = mkIf cfg.enablePersistence "/var/lib/wgautomesh/state";
+    };
+
+    systemd.services.wgautomesh = {
+      path = [ pkgs.wireguard-tools ];
+      environment = { RUST_LOG = "wgautomesh=${cfg.logLevel}"; };
+      description = "wgautomesh";
+      serviceConfig = {
+        Type = "simple";
+
+        ExecStart = "${getExe pkgs.wgautomesh} ${runtimeConfigFile}";
+        Restart = "always";
+        RestartSec = "30";
+        LoadCredential = mkIf cfg.enableGossipEncryption [ "gossip_secret:${cfg.gossipSecretFile}" ];
+
+        ExecStartPre = mkIf cfg.enableGossipEncryption [
+          ''${pkgs.envsubst}/bin/envsubst \
+              -i ${configFile} \
+              -o ${runtimeConfigFile}''
+        ];
+
+        DynamicUser = true;
+        StateDirectory = "wgautomesh";
+        StateDirectoryMode = "0700";
+        RuntimeDirectory = "wgautomesh";
+        AmbientCapabilities = "CAP_NET_ADMIN";
+        CapabilityBoundingSet = "CAP_NET_ADMIN";
+      };
+      wantedBy = [ "multi-user.target" ];
+    };
+    networking.firewall.allowedUDPPorts =
+      mkIf cfg.openFirewall [ cfg.settings.gossip_port ];
+  };
+}
+
diff --git a/nixos/modules/services/printing/cupsd.nix b/nixos/modules/services/printing/cupsd.nix
index 9ac89e057620..f6a23fb900f0 100644
--- a/nixos/modules/services/printing/cupsd.nix
+++ b/nixos/modules/services/printing/cupsd.nix
@@ -317,6 +317,7 @@ in
     environment.etc.cups.source = "/var/lib/cups";
 
     services.dbus.packages = [ cups.out ] ++ optional polkitEnabled cups-pk-helper;
+    services.udev.packages = cfg.drivers;
 
     # Allow asswordless printer admin for members of wheel group
     security.polkit.extraConfig = mkIf polkitEnabled ''
diff --git a/nixos/modules/services/security/fail2ban.nix b/nixos/modules/services/security/fail2ban.nix
index ead24d147071..1962d3f59c9f 100644
--- a/nixos/modules/services/security/fail2ban.nix
+++ b/nixos/modules/services/security/fail2ban.nix
@@ -78,6 +78,13 @@ in
         '';
       };
 
+      bantime = mkOption {
+        default = null;
+        type = types.nullOr types.str;
+        example = "10m";
+        description = lib.mdDoc "Number of seconds that a host is banned.";
+      };
+
       maxretry = mkOption {
         default = 3;
         type = types.ints.unsigned;
@@ -320,6 +327,9 @@ in
       ''}
       # Miscellaneous options
       ignoreip    = 127.0.0.1/8 ${optionalString config.networking.enableIPv6 "::1"} ${concatStringsSep " " cfg.ignoreIP}
+      ${optionalString (cfg.bantime != null) ''
+        bantime     = ${cfg.bantime}
+      ''}
       maxretry    = ${toString cfg.maxretry}
       backend     = systemd
       # Actions
diff --git a/nixos/modules/services/web-apps/moodle.nix b/nixos/modules/services/web-apps/moodle.nix
index 5f8d9c5b15f4..b617e9a59379 100644
--- a/nixos/modules/services/web-apps/moodle.nix
+++ b/nixos/modules/services/web-apps/moodle.nix
@@ -56,7 +56,7 @@ let
   mysqlLocal = cfg.database.createLocally && cfg.database.type == "mysql";
   pgsqlLocal = cfg.database.createLocally && cfg.database.type == "pgsql";
 
-  phpExt = pkgs.php80.buildEnv {
+  phpExt = pkgs.php81.buildEnv {
     extensions = { all, ... }: with all; [ iconv mbstring curl openssl tokenizer soap ctype zip gd simplexml dom intl sqlite3 pgsql pdo_sqlite pdo_pgsql pdo_odbc pdo_mysql pdo mysqli session zlib xmlreader fileinfo filter opcache exif sodium ];
     extraConfig = "max_input_vars = 5000";
   };
diff --git a/nixos/modules/virtualisation/multipass.nix b/nixos/modules/virtualisation/multipass.nix
index 6ef7de4b2bf5..b331b3be7ea5 100644
--- a/nixos/modules/virtualisation/multipass.nix
+++ b/nixos/modules/virtualisation/multipass.nix
@@ -33,8 +33,8 @@ in
       description = "Multipass orchestrates virtual Ubuntu instances.";
 
       wantedBy = [ "multi-user.target" ];
-      wants = [ "network.target" ];
-      after = [ "network.target" ];
+      wants = [ "network-online.target" ];
+      after = [ "network-online.target" ];
 
       environment = {
         "XDG_DATA_HOME" = "/var/lib/multipass/data";
diff --git a/nixos/tests/power-profiles-daemon.nix b/nixos/tests/power-profiles-daemon.nix
index 278e94711830..c887cde4b829 100644
--- a/nixos/tests/power-profiles-daemon.nix
+++ b/nixos/tests/power-profiles-daemon.nix
@@ -6,6 +6,7 @@ import ./make-test-python.nix ({ pkgs, ... }:
     maintainers = [ mvnetbiz ];
   };
   nodes.machine = { pkgs, ... }: {
+    security.polkit.enable = true;
     services.power-profiles-daemon.enable = true;
     environment.systemPackages = [ pkgs.glib ];
   };
diff --git a/pkgs/applications/audio/airwindows-lv2/default.nix b/pkgs/applications/audio/airwindows-lv2/default.nix
index 15db4c1cf03d..36d9ea7fb8b4 100644
--- a/pkgs/applications/audio/airwindows-lv2/default.nix
+++ b/pkgs/applications/audio/airwindows-lv2/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "airwindows-lv2";
-  version = "16.0";
+  version = "18.0";
   src = fetchFromGitHub {
     owner = "hannesbraun";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-jdeJ/VAJTDeiR9pyYps82F2Ty16r+a/FK+XV5L3rWco=";
+    sha256 = "sha256-06mfTvt0BXHUGZG2rnEbuOPIP+jD76mQZTo+m4b4lo4=";
   };
 
   nativeBuildInputs = [ meson ninja pkg-config ];
diff --git a/pkgs/applications/misc/cpu-x/default.nix b/pkgs/applications/misc/cpu-x/default.nix
index 197e7ec86d08..d6e3bb28e18e 100644
--- a/pkgs/applications/misc/cpu-x/default.nix
+++ b/pkgs/applications/misc/cpu-x/default.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cpu-x";
-  version = "4.5.2";
+  version = "4.5.3";
 
   src = fetchFromGitHub {
     owner = "X0rg";
     repo = "CPU-X";
     rev = "v${version}";
-    sha256 = "sha256-VPmwnzoOBNLDYZsoEknbcX7QP2Tcm08pL/rw1uCK8xM=";
+    sha256 = "sha256-o48NkOPabfnwsu+nyXJOstW6g0JSUgIrEFx1nNCR7XE=";
   };
 
   nativeBuildInputs = [ cmake pkg-config wrapGAppsHook nasm makeWrapper ];
diff --git a/pkgs/applications/misc/crow-translate/default.nix b/pkgs/applications/misc/crow-translate/default.nix
index 7ec45226785f..906cf082e297 100644
--- a/pkgs/applications/misc/crow-translate/default.nix
+++ b/pkgs/applications/misc/crow-translate/default.nix
@@ -19,11 +19,11 @@
 
 stdenv.mkDerivation rec {
   pname = "crow-translate";
-  version = "2.10.3";
+  version = "2.10.4";
 
   src = fetchzip {
     url = "https://github.com/${pname}/${pname}/releases/download/${version}/${pname}-${version}-source.tar.gz";
-    hash = "sha256-K6mYzR4EIBHd0w/6Dpx4ldX4iDFszmfSLT6jNTfJlDQ=";
+    hash = "sha256-M2vAH1YAvNOhDsz+BWxvteR8YX89FHtbUcQZr1uVoCs=";
   };
 
   patches = [
diff --git a/pkgs/applications/misc/hstr/default.nix b/pkgs/applications/misc/hstr/default.nix
index e7ad05b5085a..2963ba732f05 100644
--- a/pkgs/applications/misc/hstr/default.nix
+++ b/pkgs/applications/misc/hstr/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "hstr";
-  version = "2.6";
+  version = "3.1";
 
   src = fetchFromGitHub {
     owner  = "dvorka";
     repo   = "hstr";
     rev    = version;
-    sha256 = "sha256-yfaDISnTDb20DgMOvh6jJYisV6eL/Mp5jafnWEnFG8c=";
+    hash   = "sha256-OuLy1aiEwUJDGy3+UXYF1Vx1nNXic46WIZEM1xrIPfA=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
diff --git a/pkgs/applications/networking/browsers/firefox/common.nix b/pkgs/applications/networking/browsers/firefox/common.nix
index ee07ee23e874..ce69742a3f6a 100644
--- a/pkgs/applications/networking/browsers/firefox/common.nix
+++ b/pkgs/applications/networking/browsers/firefox/common.nix
@@ -221,12 +221,13 @@ buildStdenv.mkDerivation ({
     "profilingPhase"
   ];
 
-  patches = lib.optionals (lib.versionOlder version "102.6.0") [
+  patches = lib.optionals (lib.versionAtLeast version "112.0" && lib.versionOlder version "113.0") [
     (fetchpatch {
-      # https://bugzilla.mozilla.org/show_bug.cgi?id=1773259
-      name = "rust-cbindgen-0.24.2-compat.patch";
-      url = "https://raw.githubusercontent.com/canonical/firefox-snap/5622734942524846fb0eb7108918c8cd8557fde3/patches/fix-ftbfs-newer-cbindgen.patch";
-      hash = "sha256-+wNZhkDB3HSknPRD4N6cQXY7zMT/DzNXx29jQH0Gb1o=";
+      # Crash when desktop scaling does not divide window scale on Wayland
+      # https://bugzilla.mozilla.org/show_bug.cgi?id=1803016
+      name = "mozbz1803016.patch";
+      url = "https://hg.mozilla.org/mozilla-central/raw-rev/1068e0955cfb";
+      hash = "sha256-iPqmofsmgvlFNm+mqVPbdgMKmP68ANuzYu+PzfCpoNA=";
     })
   ]
   ++ lib.optional (lib.versionOlder version "111") ./env_var_for_system_dir-ff86.patch
diff --git a/pkgs/applications/networking/browsers/librewolf/src.json b/pkgs/applications/networking/browsers/librewolf/src.json
index 6b32c4d80251..472bbbe27142 100644
--- a/pkgs/applications/networking/browsers/librewolf/src.json
+++ b/pkgs/applications/networking/browsers/librewolf/src.json
@@ -1,11 +1,11 @@
 {
-  "packageVersion": "112.0-1",
+  "packageVersion": "112.0.1-1",
   "source": {
-    "rev": "112.0-1",
-    "sha256": "1qjckchx20bf20z05g8m7hqm68v4hpn20fbs52l19z87irglmmfk"
+    "rev": "112.0.1-1",
+    "sha256": "0bk3idpl11n4gwk8rgfi2pilwx9n56s8dpp7y599h17mlrsw8az4"
   },
   "firefox": {
-    "version": "112.0",
-    "sha512": "6b2bc8c0c93f3109da27168fe7e8f734c6ab4efb4ca56ff2d5e3a52659da71173bba2104037a000623833be8338621fca482f39f836e3910fe2996e6d0a68b39"
+    "version": "112.0.1",
+    "sha512": "23a5cd9c1f165275d8ca7465bebce86018441c72292421f4ed56d7ad8ada9402dc8d22a08467d9d0ef3ef8c62338006dfa3bcbddf12cb8a59eafa0bd7d0cda50"
   }
 }
diff --git a/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix b/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
index cfb06eba692b..04a64b96899a 100644
--- a/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
+++ b/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
@@ -1,6 +1,7 @@
 { lib, stdenv
 , fetchurl
 , makeDesktopItem
+, writeText
 
 # Common run-time dependencies
 , zlib
@@ -112,6 +113,19 @@ let
       hash = "sha256-mi8btxI6de5iQ8HzNpvuFdJHjzi03zZJT65dsWEiDHA=";
     };
   };
+
+  distributionIni = writeText "distribution.ini" (lib.generators.toINI {} {
+    # Some light branding indicating this build uses our distro preferences
+    Global = {
+      id = "nixos";
+      version = "1.0";
+      about = "Tor Browser for NixOS";
+    };
+  });
+
+  policiesJson = writeText "policies.json" (builtins.toJSON {
+    policies.DisableAppUpdate = true;
+  });
 in
 stdenv.mkDerivation rec {
   pname = "tor-browser-bundle-bin";
@@ -132,7 +146,9 @@ stdenv.mkDerivation rec {
     categories = [ "Network" "WebBrowser" "Security" ];
   };
 
-  buildCommand = ''
+  buildPhase = ''
+    runHook preBuild
+
     # For convenience ...
     TBB_IN_STORE=$out/share/tor-browser
     interp=$(< $NIX_CC/nix-support/dynamic-linker)
@@ -209,7 +225,7 @@ stdenv.mkDerivation rec {
 
     // Insist on using IPC for communicating with Tor
     //
-    // Defaults to creating \$TBB_HOME/TorBrowser/Data/Tor/{socks,control}.socket
+    // Defaults to creating \$XDG_RUNTIME_DIR/Tor/{socks,control}.socket
     lockPref("extensions.torlauncher.control_port_use_ipc", true);
     lockPref("extensions.torlauncher.socks_port_use_ipc", true);
 
@@ -331,6 +347,7 @@ stdenv.mkDerivation rec {
       echo "user_pref(\"extensions.torlauncher.toronionauthdir_path\", \"\$HOME/TorBrowser/Data/Tor/onion-auth\");"
       echo "user_pref(\"extensions.torlauncher.torrc_path\", \"\$HOME/TorBrowser/Data/Tor/torrc\");"
       echo "user_pref(\"extensions.torlauncher.tordatadir_path\", \"\$HOME/TorBrowser/Data/Tor\");"
+      echo "user_pref(\"network.proxy.socks\", \"file://\$XDG_RUNTIME_DIR/Tor/socks.socket\");"
     } >> "\$HOME/TorBrowser/Data/Browser/profile.default/prefs.js"
 
     # Lift-off
@@ -416,6 +433,18 @@ stdenv.mkDerivation rec {
     echo "Checking tor-browser wrapper ..."
       TBB_HOME=$(mktemp -d) \
       $out/bin/tor-browser --version >/dev/null
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    # Install distribution customizations
+    install -Dvm644 ${distributionIni} $out/share/tor-browser/distribution/distribution.ini
+    install -Dvm644 ${policiesJson} $out/share/tor-browser/distribution/policies.json
+
+    runHook postInstall
   '';
 
   meta = with lib; {
diff --git a/pkgs/applications/networking/cluster/click/default.nix b/pkgs/applications/networking/cluster/click/default.nix
index 2d76e0a26cb9..79dae1d1344a 100644
--- a/pkgs/applications/networking/cluster/click/default.nix
+++ b/pkgs/applications/networking/cluster/click/default.nix
@@ -1,8 +1,6 @@
 { darwin, fetchFromGitHub, rustPlatform, lib, stdenv }:
 
-with rustPlatform;
-
-buildRustPackage rec {
+rustPlatform.buildRustPackage rec {
   pname = "click";
   version = "0.4.2";
 
diff --git a/pkgs/applications/networking/cluster/glooctl/default.nix b/pkgs/applications/networking/cluster/glooctl/default.nix
index 3cf79268f70c..1381f4c92f28 100644
--- a/pkgs/applications/networking/cluster/glooctl/default.nix
+++ b/pkgs/applications/networking/cluster/glooctl/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "glooctl";
-  version = "1.13.11";
+  version = "1.13.12";
 
   src = fetchFromGitHub {
     owner = "solo-io";
     repo = "gloo";
     rev = "v${version}";
-    hash = "sha256-K3tk55YPgBSF0YrxSw8zypnzgwEiyEPAAbiGyuKId9o=";
+    hash = "sha256-JGmt07aXcxbPH772oWTD7YPvLLuxZGy8rdXEN1EgCNc=";
   };
 
   subPackages = [ "projects/gloo/cli/cmd" ];
diff --git a/pkgs/applications/networking/cluster/kaniko/default.nix b/pkgs/applications/networking/cluster/kaniko/default.nix
index a34c8634e182..923d07af1b1f 100644
--- a/pkgs/applications/networking/cluster/kaniko/default.nix
+++ b/pkgs/applications/networking/cluster/kaniko/default.nix
@@ -9,13 +9,13 @@
 
 buildGoModule rec {
   pname = "kaniko";
-  version = "1.9.1";
+  version = "1.9.2";
 
   src = fetchFromGitHub {
     owner = "GoogleContainerTools";
     repo = "kaniko";
     rev = "v${version}";
-    hash = "sha256-sPICsDgkijQ7PyeTWQgT553toc4/rWPPo7SY3ptX82U=";
+    hash = "sha256-dXQ0/o1qISv+sjNVIpfF85bkbM9sGOGwqVbWZpMWfMY=";
   };
 
   vendorHash = null;
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index af81759b4dfe..6f21a03f71da 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -182,13 +182,13 @@
     "vendorHash": "sha256-dm+2SseBeS49/QoepRwJ1VFwPCtU+6VymvyEH/sLkvI="
   },
   "buildkite": {
-    "hash": "sha256-4Bbod7IuinZE28AZ2r1BBrexgbS29jEpwtG8aTKj7M8=",
+    "hash": "sha256-gITbMnNrqkef+giXXm9RVSLZJdWpKkqPT0rifF+0l1U=",
     "homepage": "https://registry.terraform.io/providers/buildkite/buildkite",
     "owner": "buildkite",
     "repo": "terraform-provider-buildkite",
-    "rev": "v0.14.0",
+    "rev": "v0.15.0",
     "spdx": "MIT",
-    "vendorHash": "sha256-dN5oNNO5lf8dUfk9SDUH3f3nA0CNoJyfTqk+Z5lwTz8="
+    "vendorHash": "sha256-X79ZrkKWhbyozSr3fhMmIRKZnB5dY/T1oQ7haaXuhEI="
   },
   "checkly": {
     "hash": "sha256-tdimESlkfRO/kdA6JOX72vQNXFLJZ9VKwPRxsJo5WFI=",
@@ -318,13 +318,13 @@
     "vendorHash": null
   },
   "dns": {
-    "hash": "sha256-qLKlnw0vnPvxJluvUiBERu1YdtrRklocVw314/lvQT4=",
+    "hash": "sha256-pTBPSiPO84L9vhBv4mJIMJP0UNVwrz/MX0YCZODwb7s=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/dns",
     "owner": "hashicorp",
     "repo": "terraform-provider-dns",
-    "rev": "v3.2.4",
+    "rev": "v3.3.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-Ba4J6LUchqhdZTxcJxTgP20aZVioybIzKvF4j5TDQIk="
+    "vendorHash": "sha256-wx8BXlobu86Nk9D8o5loKhbO14ANI+shFQ2i7jswKgE="
   },
   "dnsimple": {
     "hash": "sha256-d3kbHf17dBnQC5FOCcqGeZ/6+qV1pxvEJ9IZwXoodFc=",
@@ -419,11 +419,11 @@
     "vendorHash": "sha256-uWTY8cFztXFrQQ7GW6/R+x9M6vHmsb934ldq+oeW5vk="
   },
   "github": {
-    "hash": "sha256-GlNOYpIRX+DL7cfBsst83MdW/SXmh16L+MwDSFLzXYo=",
+    "hash": "sha256-iFYYKFPa9+pTpmTddFzqB1yRwBnp8NG281oxQP7V6+U=",
     "homepage": "https://registry.terraform.io/providers/integrations/github",
     "owner": "integrations",
     "repo": "terraform-provider-github",
-    "rev": "v5.22.0",
+    "rev": "v5.23.0",
     "spdx": "MIT",
     "vendorHash": null
   },
@@ -602,13 +602,13 @@
     "vendorHash": "sha256-vSIeSEzyJQzh9Aid/FWsF4xDYXMOhbsaLQ31mtfH7/Y="
   },
   "kafka": {
-    "hash": "sha256-p8KT6K9fcd0OFy+NoZyZzQxG13fIiyMJg2yNPKIWH60=",
+    "hash": "sha256-IG0xgMs0j2jRJBa52Wsx7/r4s9DRnw5b+AfYpZAewxI=",
     "homepage": "https://registry.terraform.io/providers/Mongey/kafka",
     "owner": "Mongey",
     "repo": "terraform-provider-kafka",
-    "rev": "v0.5.2",
+    "rev": "v0.5.3",
     "spdx": "MIT",
-    "vendorHash": "sha256-RzC8j+Toub7kiOKW6IppjwyJ0vGEJ0YHb8YXrWFkZW4="
+    "vendorHash": "sha256-Z5APR41/+MsrHAtpTZKnG0qTi1+JSBJbPTVxNpd6f84="
   },
   "kafka-connect": {
     "hash": "sha256-PiSVfzNPEXAgONb/eaVAN4yPudn5glcHL0BLqE5PWsw=",
@@ -801,11 +801,11 @@
   },
   "nutanix": {
     "deleteVendor": true,
-    "hash": "sha256-PQwP2xIh635pc8nL0qhiUUqaf5Dm8uERFk61LUk6Xmc=",
+    "hash": "sha256-szqvEU1cxEIBKIeHmeqT6YAEsXZDvINxfDyp76qswzw=",
     "homepage": "https://registry.terraform.io/providers/nutanix/nutanix",
     "owner": "nutanix",
     "repo": "terraform-provider-nutanix",
-    "rev": "v1.8.0",
+    "rev": "v1.8.1",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-LRIfxQGwG988HE5fftGl6JmBG7tTknvmgpm4Fu1NbWI="
   },
diff --git a/pkgs/applications/networking/dyndns/cfdyndns/default.nix b/pkgs/applications/networking/dyndns/cfdyndns/default.nix
index afddb6be875e..eb7d1bf5c8d9 100644
--- a/pkgs/applications/networking/dyndns/cfdyndns/default.nix
+++ b/pkgs/applications/networking/dyndns/cfdyndns/default.nix
@@ -1,8 +1,6 @@
 { lib, fetchFromGitHub, rustPlatform, pkg-config, openssl }:
 
-with rustPlatform;
-
-buildRustPackage rec {
+rustPlatform.buildRustPackage rec {
   pname = "cfdyndns";
   version = "0.0.3";
   src = fetchFromGitHub {
diff --git a/pkgs/applications/networking/hydroxide/default.nix b/pkgs/applications/networking/hydroxide/default.nix
index 42ff69127553..df6f1e2d793f 100644
--- a/pkgs/applications/networking/hydroxide/default.nix
+++ b/pkgs/applications/networking/hydroxide/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "hydroxide";
-  version = "0.2.25";
+  version = "0.2.26";
 
   src = fetchFromGitHub {
     owner = "emersion";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-YBaimsHRmmh5d98c9x56JIyOOnkZsypxdqlSCG6pVJ4=";
+    sha256 = "sha256-UCS49P83dGTD/Wx95Mslstm2C6hKgJB/1tJTZmmwLDg=";
   };
 
   vendorHash = "sha256-OLsJc/AMtD03KA8SN5rsnaq57/cB7bMB/f7FfEjErEU=";
diff --git a/pkgs/applications/networking/instant-messengers/deltachat-desktop/Cargo.lock b/pkgs/applications/networking/instant-messengers/deltachat-desktop/Cargo.lock
index 5d9f4fa9c27c..87198de0352e 100644
--- a/pkgs/applications/networking/instant-messengers/deltachat-desktop/Cargo.lock
+++ b/pkgs/applications/networking/instant-messengers/deltachat-desktop/Cargo.lock
@@ -189,12 +189,12 @@ dependencies = [
 
 [[package]]
 name = "async-imap"
-version = "0.6.0"
-source = "git+https://github.com/async-email/async-imap?branch=master#90270474a5a494669e7c63c13471d189afdc98ae"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d11e163a705d0c809dfc886eee95df5117c758539c940c0fe9aa3aa4da5388ce"
 dependencies = [
  "async-channel",
- "async-native-tls 0.4.0",
- "base64 0.13.1",
+ "base64 0.21.0",
  "byte-pool",
  "chrono",
  "futures",
@@ -218,18 +218,6 @@ dependencies = [
  "event-listener",
 ]
 
-[[package]]
-name = "async-native-tls"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d57d4cec3c647232e1094dc013546c0b33ce785d8aeb251e1f20dfaf8a9a13fe"
-dependencies = [
- "native-tls",
- "thiserror",
- "tokio",
- "url",
-]
-
 [[package]]
 name = "async-native-tls"
 version = "0.5.0"
@@ -494,9 +482,9 @@ checksum = "0d261e256854913907f67ed06efbc3338dfe6179796deefc1ff763fc1aee5535"
 
 [[package]]
 name = "byte-pool"
-version = "0.2.3"
+version = "0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8c7230ddbb427b1094d477d821a99f3f54d36333178eeb806e279bcdcecf0ca"
+checksum = "c2f1b21189f50b5625efa6227cf45e9d4cfdc2e73582df2b879e9689e78a7158"
 dependencies = [
  "crossbeam-queue",
  "stable_deref_trait",
@@ -836,9 +824,9 @@ dependencies = [
 
 [[package]]
 name = "crossbeam-channel"
-version = "0.5.7"
+version = "0.5.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf2b3e8478797446514c91ef04bafcb59faba183e621ad488df88983cc14128c"
+checksum = "a33c2bf77f2df06183c3aa30d1e96c0695a313d4f9c453cc3762a6db39f99200"
 dependencies = [
  "cfg-if",
  "crossbeam-utils",
@@ -1061,13 +1049,13 @@ dependencies = [
 
 [[package]]
 name = "deltachat"
-version = "1.112.6"
+version = "1.112.7"
 dependencies = [
  "ansi_term",
  "anyhow",
  "async-channel",
  "async-imap",
- "async-native-tls 0.5.0",
+ "async-native-tls",
  "async-smtp",
  "async_zip",
  "backtrace",
@@ -1135,7 +1123,7 @@ dependencies = [
 
 [[package]]
 name = "deltachat-jsonrpc"
-version = "1.112.6"
+version = "1.112.7"
 dependencies = [
  "anyhow",
  "async-channel",
@@ -1158,7 +1146,7 @@ dependencies = [
 
 [[package]]
 name = "deltachat-repl"
-version = "1.112.6"
+version = "1.112.7"
 dependencies = [
  "ansi_term",
  "anyhow",
@@ -1173,7 +1161,7 @@ dependencies = [
 
 [[package]]
 name = "deltachat-rpc-server"
-version = "1.112.6"
+version = "1.112.7"
 dependencies = [
  "anyhow",
  "deltachat",
@@ -1197,7 +1185,7 @@ dependencies = [
 
 [[package]]
 name = "deltachat_ffi"
-version = "1.112.6"
+version = "1.112.7"
 dependencies = [
  "anyhow",
  "deltachat",
diff --git a/pkgs/applications/networking/instant-messengers/deltachat-desktop/default.nix b/pkgs/applications/networking/instant-messengers/deltachat-desktop/default.nix
index 23f7a62033f0..f0004246b247 100644
--- a/pkgs/applications/networking/instant-messengers/deltachat-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/deltachat-desktop/default.nix
@@ -21,17 +21,16 @@
 
 let
   libdeltachat' = libdeltachat.overrideAttrs (old: rec {
-    version = "1.112.6";
+    version = "1.112.7";
     src = fetchFromGitHub {
       owner = "deltachat";
       repo = "deltachat-core-rust";
       rev = version;
-      hash = "sha256-xadf6N5x3zdefwsKUFaVs71HmLMpJoUq5LL7IENsvC0=";
+      hash = "sha256-zBstNj8IZ8ScwZxzvTxDPwe8R0n2z/EuvjbR+bJepJk=";
     };
     cargoDeps = rustPlatform.importCargoLock {
       lockFile = ./Cargo.lock;
       outputHashes = {
-        "async-imap-0.6.0" = "sha256-q6ZDm+4i+EtiMgkW/8LQ/TkDO/sj0p7KJhpYE76zAjo=";
         "email-0.0.21" = "sha256-Ys47MiEwVZenRNfenT579Rb17ABQ4QizVFTWUq3+bAY=";
         "encoded-words-0.2.0" = "sha256-KK9st0hLFh4dsrnLd6D8lC6pRFFs8W+WpZSGMGJcosk=";
         "lettre-0.9.2" = "sha256-+hU1cFacyyeC9UGVBpS14BWlJjHy90i/3ynMkKAzclk=";
@@ -53,16 +52,16 @@ let
   };
 in buildNpmPackage rec {
   pname = "deltachat-desktop";
-  version = "1.36.2";
+  version = "1.36.3";
 
   src = fetchFromGitHub {
     owner = "deltachat";
     repo = "deltachat-desktop";
     rev = "v${version}";
-    hash = "sha256-0f3i+ZmORq1IDdzsIJo7e4lCnC3K1B5SY9pjpGM8+ro=";
+    hash = "sha256-OmAWABZLTNU8EzXl2Rp/Y4DJcaqXuMt14ReaJbHx/u8=";
   };
 
-  npmDepsHash = "sha256-9gfqVFGmouGd+E78/GDKyanHEvA37OZSR1zBEpVOYF0=";
+  npmDepsHash = "sha256-u2hYIhXGMnjAp5T2h4THcTL5Om4Zg8aTO3NpSiphAXc=";
 
   nativeBuildInputs = [
     makeWrapper
diff --git a/pkgs/applications/networking/instant-messengers/discord/linux.nix b/pkgs/applications/networking/instant-messengers/discord/linux.nix
index 10fb303fdd67..43a0ff082bff 100644
--- a/pkgs/applications/networking/instant-messengers/discord/linux.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/linux.nix
@@ -6,9 +6,10 @@
 , libXi, libXrandr, libXrender, libXtst, libxcb, libxshmfence, mesa, nspr, nss
 , pango, systemd, libappindicator-gtk3, libdbusmenu, writeScript, python3, runCommand
 , libunity
+, speechd
 , wayland
 , branch
-, common-updater-scripts, withOpenASAR ? false }:
+, common-updater-scripts, withOpenASAR ? false, withTTS ? false }:
 
 let
   disableBreakingUpdates = runCommand "disable-breaking-updates.py"
@@ -46,7 +47,7 @@ stdenv.mkDerivation rec {
 
   dontWrapGApps = true;
 
-  libPath = lib.makeLibraryPath [
+  libPath = lib.makeLibraryPath ([
     libcxx
     systemd
     libpulseaudio
@@ -87,7 +88,7 @@ stdenv.mkDerivation rec {
     libappindicator-gtk3
     libdbusmenu
     wayland
-  ];
+  ] ++ lib.optional withTTS speechd);
 
   installPhase = ''
     runHook preInstall
@@ -102,6 +103,7 @@ stdenv.mkDerivation rec {
     wrapProgramShell $out/opt/${binaryName}/${binaryName} \
         "''${gappsWrapperArgs[@]}" \
         --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform=wayland --enable-features=WaylandWindowDecorations}}" \
+        ${lib.strings.optionalString withTTS "--add-flags \"--enable-speech-dispatcher\""} \
         --prefix XDG_DATA_DIRS : "${gtk3}/share/gsettings-schemas/${gtk3.name}/" \
         --prefix LD_LIBRARY_PATH : ${libPath}:$out/opt/${binaryName} \
         --run "${lib.getExe disableBreakingUpdates}"
diff --git a/pkgs/applications/networking/instant-messengers/ferdium/default.nix b/pkgs/applications/networking/instant-messengers/ferdium/default.nix
index 813e1973e551..0ff76e418862 100644
--- a/pkgs/applications/networking/instant-messengers/ferdium/default.nix
+++ b/pkgs/applications/networking/instant-messengers/ferdium/default.nix
@@ -1,16 +1,22 @@
-{ lib, mkFranzDerivation, fetchurl, xorg }:
+{ lib, mkFranzDerivation, fetchurl, xorg, nix-update-script }:
 
 mkFranzDerivation rec {
   pname = "ferdium";
   name = "Ferdium";
-  version = "6.2.4";
+  version = "6.2.6";
   src = fetchurl {
     url = "https://github.com/ferdium/ferdium-app/releases/download/v${version}/Ferdium-linux-${version}-amd64.deb";
-    sha256 = "sha256-iat0d06IhupMVYfK8Ot14gBY+5rHO4e/lVYqbX9ucIo=";
+    sha256 = "sha256-jG3NdolWqQzj/62jYwnqJHz5uT6QIuOkrpL/FcLl56k=";
   };
 
   extraBuildInputs = [ xorg.libxshmfence ];
 
+  passthru = {
+    updateScript = nix-update-script {
+      extraArgs = [ "--override-filename" ./default.nix  ];
+    };
+  };
+
   meta = with lib; {
     description = "All your services in one place built by the community";
     homepage = "https://ferdium.org/";
diff --git a/pkgs/applications/networking/instant-messengers/franz/generic.nix b/pkgs/applications/networking/instant-messengers/franz/generic.nix
index 44546aabe223..b48acec1d32b 100644
--- a/pkgs/applications/networking/instant-messengers/franz/generic.nix
+++ b/pkgs/applications/networking/instant-messengers/franz/generic.nix
@@ -28,9 +28,10 @@
 
 # Helper function for building a derivation for Franz and forks.
 
-{ pname, name, version, src, meta, extraBuildInputs ? [] }:
-
-stdenv.mkDerivation rec {
+{ pname, name, version, src, meta, extraBuildInputs ? [], ... } @ args:
+let
+  cleanedArgs = builtins.removeAttrs args [ "pname" "name" "version" "src" "meta" "extraBuildInputs" ];
+in stdenv.mkDerivation (rec {
   inherit pname version src meta;
 
   # Don't remove runtime deps.
@@ -91,4 +92,4 @@ stdenv.mkDerivation rec {
       --suffix PATH : ${xdg-utils}/bin \
       "''${gappsWrapperArgs[@]}"
   '';
-}
+} // cleanedArgs)
diff --git a/pkgs/applications/networking/sniffnet/default.nix b/pkgs/applications/networking/sniffnet/default.nix
index 0fc2167f02a9..95c85d95d647 100644
--- a/pkgs/applications/networking/sniffnet/default.nix
+++ b/pkgs/applications/networking/sniffnet/default.nix
@@ -15,16 +15,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "sniffnet";
-  version = "1.1.3";
+  version = "1.1.4";
 
   src = fetchFromGitHub {
     owner = "gyulyvgc";
     repo = "sniffnet";
     rev = "refs/tags/v${version}";
-    hash = "sha256-sJUc14MXaCS4OHtwdCuwI1b7NAlOnaGsXBNUYCEXJqQ=";
+    hash = "sha256-8G6cfp5/eXjwyNBk2SvE2XmUt7Y42E76IjDU5QHUK7s=";
   };
 
-  cargoHash = "sha256-neRVpJmI4TgzvIQqKNqBr61O7rR8246PcxG50IIKE/M=";
+  cargoHash = "sha256-KN7jlB6PzRGpHBk5UvqPLhxRG7QAzOXLmEuFYNhdZJU=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/applications/science/machine-learning/streamlit/default.nix b/pkgs/applications/science/machine-learning/streamlit/default.nix
index ad22d57882ed..3db5356b4964 100755
--- a/pkgs/applications/science/machine-learning/streamlit/default.nix
+++ b/pkgs/applications/science/machine-learning/streamlit/default.nix
@@ -26,12 +26,12 @@
 
 buildPythonApplication rec {
   pname = "streamlit";
-  version = "1.18.1";
+  version = "1.21.0";
   format = "wheel"; # source currently requires pipenv
 
   src = fetchPypi {
     inherit pname version format;
-    hash = "sha256-lO2QfM/G+4M55f8JCZBwk10SkMp4gXb68KncHm90k7g=";
+    hash = "sha256-BYYlmJUqkSbhZlLKpbyI7u6nsnc68lLi2szxyEzqrvQ=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/applications/science/misc/root/default.nix b/pkgs/applications/science/misc/root/default.nix
index 037b8dfa09c7..2ebfd4a1a87a 100644
--- a/pkgs/applications/science/misc/root/default.nix
+++ b/pkgs/applications/science/misc/root/default.nix
@@ -191,7 +191,7 @@ stdenv.mkDerivation rec {
     "-Dpythia6=OFF"
     "-Dpythia8=OFF"
     "-Drfio=OFF"
-    "-Droot7=OFF"
+    "-Droot7=ON"
     "-Dsqlite=OFF"
     "-Dssl=ON"
     "-Dtmva=ON"
diff --git a/pkgs/applications/version-management/ghq/default.nix b/pkgs/applications/version-management/ghq/default.nix
index b9bfc6f745ec..80704e49a208 100644
--- a/pkgs/applications/version-management/ghq/default.nix
+++ b/pkgs/applications/version-management/ghq/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "ghq";
-  version = "1.4.1";
+  version = "1.4.2";
 
   src = fetchFromGitHub {
     owner = "x-motemen";
     repo = "ghq";
     rev = "v${version}";
-    sha256 = "sha256-dUW5eZODHkhhzC21uA9jFnwb9Q+9/t7o0K/nGbsZH84=";
+    sha256 = "sha256-ggTx5Kz9cRqOqxxzERv4altf7m1GlreGgOiYCnHyJks=";
   };
 
-  vendorHash = "sha256-Q3sIXt8srGI1ZFUdQ+x6I6Tc07HqyH0Hyu4kBe64uRs=";
+  vendorHash = "sha256-6ZDvU3RQ/1M4DZMFOaQsEuodldB8k+2thXNhvZlVQEg=";
 
   doCheck = false;
 
diff --git a/pkgs/applications/version-management/glab/default.nix b/pkgs/applications/version-management/glab/default.nix
index 09e5525e22c3..847a25f3be60 100644
--- a/pkgs/applications/version-management/glab/default.nix
+++ b/pkgs/applications/version-management/glab/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "glab";
-  version = "1.26.0";
+  version = "1.28.0";
 
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "cli";
     rev = "v${version}";
-    hash = "sha256-k0wkHw12MyVsAudaihoymGkP4y5y98cR7LKa+hEC1Mc=";
+    hash = "sha256-e3tblY/lf25TJrsLeQdaPcgVlsaEimkjQxO0P9X1o6w=";
   };
 
-  vendorHash = "sha256-FZ1CiR8Rj/sMoCnQm6ArGQfRTlvmD14EZDmufnlTSTk=";
+  vendorHash = "sha256-PH0PJujdRtnVS0s6wWtS6kffQBQduqb2KJYru9ePatw=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/applications/virtualization/ecs-agent/default.nix b/pkgs/applications/virtualization/ecs-agent/default.nix
index 58c303a46c40..928eb53c2715 100644
--- a/pkgs/applications/virtualization/ecs-agent/default.nix
+++ b/pkgs/applications/virtualization/ecs-agent/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "amazon-ecs-agent";
-  version = "1.67.2";
+  version = "1.70.1";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "aws";
     repo = pname;
-    hash = "sha256-iSL5ogS8BLcxge3eo+kCqtsGmj7P1wbi+/84nA9fO2Q=";
+    hash = "sha256-CAoMXWxtsGJOEOxZ8ZLwLYAWW0kY/4jryrIAFDbOeXA=";
   };
 
   vendorHash = null;
diff --git a/pkgs/applications/virtualization/singularity/generic.nix b/pkgs/applications/virtualization/singularity/generic.nix
index 5312dbdda0ff..ab9f1d1ce710 100644
--- a/pkgs/applications/virtualization/singularity/generic.nix
+++ b/pkgs/applications/virtualization/singularity/generic.nix
@@ -36,7 +36,9 @@ in
 , conmon
 , coreutils
 , cryptsetup
+, e2fsprogs
 , fakeroot
+, fuse2fs ? e2fsprogs.fuse2fs
 , go
 , gpgme
 , libseccomp
@@ -46,6 +48,10 @@ in
 , openssl
 , squashfsTools
 , squashfuse
+  # Test dependencies
+, singularity-tools
+, cowsay
+, hello
   # Overridable configurations
 , enableNvidiaContainerCli ? true
   # Compile with seccomp support
@@ -83,7 +89,7 @@ let
     ln -s ${lib.escapeShellArg newgidmapPath} "$out/bin/newgidmap"
   '');
 in
-buildGoModule {
+(buildGoModule {
   inherit pname version src;
 
   # Override vendorHash with the output got from
@@ -113,6 +119,12 @@ buildGoModule {
     which
   ];
 
+  # Search inside the project sources
+  # and see the `control` file of the Debian package from upstream repos
+  # for build-time dependencies and run-time utilities
+  # apptainer/apptainer: https://github.com/apptainer/apptainer/blob/main/dist/debian/control
+  # sylabs/singularity: https://github.com/sylabs/singularity/blob/main/debian/control
+
   buildInputs = [
     bash # To patch /bin/sh shebangs.
     conmon
@@ -120,8 +132,7 @@ buildGoModule {
     gpgme
     libuuid
     openssl
-    squashfsTools
-    squashfuse
+    squashfsTools # Required at build time by SingularityCE
   ]
   ++ lib.optional enableNvidiaContainerCli nvidia-docker
   ++ lib.optional enableSeccomp libseccomp
@@ -144,6 +155,8 @@ buildGoModule {
     bash
     coreutils
     cryptsetup # cryptsetup
+    fakeroot
+    fuse2fs # Mount ext3 filesystems
     go
     privileged-un-utils
     squashfsTools # mksquashfs unsquashfs # Make / unpack squashfs image
@@ -191,10 +204,7 @@ buildGoModule {
     substituteInPlace "$out/bin/run-singularity" \
       --replace "/usr/bin/env ${projectName}" "$out/bin/${projectName}"
     wrapProgram "$out/bin/${projectName}" \
-      --prefix PATH : "${lib.makeBinPath [
-        fakeroot
-        squashfsTools # Singularity (but not Apptainer) expects unsquashfs from the host PATH
-      ]}"
+      --prefix PATH : "''${defaultPathInputs// /\/bin:}"
     # Make changes in the config file
     ${lib.optionalString enableNvidiaContainerCli ''
       substituteInPlace "$out/etc/${projectName}/${projectName}.conf" \
@@ -235,4 +245,14 @@ buildGoModule {
     maintainers = with maintainers; [ jbedo ShamrockLee ];
     mainProgram = projectName;
   } // extraMeta;
-}
+}).overrideAttrs (finalAttrs: prevAttrs: {
+  passthru = prevAttrs.passthru or { } // {
+    tests = {
+      image-hello-cowsay = singularity-tools.buildImage {
+        name = "hello-cowsay";
+        contents = [ hello cowsay ];
+        singularity = finalAttrs.finalPackage;
+      };
+    };
+  };
+})
diff --git a/pkgs/applications/virtualization/singularity/packages.nix b/pkgs/applications/virtualization/singularity/packages.nix
index a21066d77574..73bed19fb734 100644
--- a/pkgs/applications/virtualization/singularity/packages.nix
+++ b/pkgs/applications/virtualization/singularity/packages.nix
@@ -7,20 +7,20 @@ let
   apptainer = callPackage
     (import ./generic.nix rec {
       pname = "apptainer";
-      version = "1.1.5";
+      version = "1.1.7";
       projectName = "apptainer";
 
       src = fetchFromGitHub {
         owner = "apptainer";
         repo = "apptainer";
         rev = "v${version}";
-        hash = "sha256-onJkpHJNsO0cQO2m+TmdMuMkuvH178mDhOeX41bYFic=";
+        hash = "sha256-3F8qwP27IXcnnEYMnLzkCOxQDx7yej6QIZ40Wb5pk34=";
       };
 
       # Update by running
       # nix-prefetch -E "{ sha256 }: ((import ./. { }).apptainer.override { vendorHash = sha256; }).go-modules"
       # at the root directory of the Nixpkgs repository
-      vendorHash = "sha256-tAnh7A8Lw5KtY7hq+sqHMEUlgXvgeeCKKIfRZFoRtug=";
+      vendorHash = "sha256-PfFubgR/W1WBXIsRO+Kg7hA6ebeAcRiJlTlAZbnl19A=";
 
       extraDescription = " (previously known as Singularity)";
       extraMeta.homepage = "https://apptainer.org";
@@ -38,20 +38,20 @@ let
   singularity = callPackage
     (import ./generic.nix rec {
       pname = "singularity-ce";
-      version = "3.10.4";
+      version = "3.11.1";
       projectName = "singularity";
 
       src = fetchFromGitHub {
         owner = "sylabs";
         repo = "singularity";
         rev = "v${version}";
-        hash = "sha256-bUnQXQVwaVA3Lkw3X9TBWqNBgiPxAVCHnkq0vc+CIsM=";
+        hash = "sha256-gdgg6VN3Ily+2Remz6dZBhhfWIxyaBa4bIlFcgrA/uY=";
       };
 
       # Update by running
       # nix-prefetch -E "{ sha256 }: ((import ./. { }).singularity.override { vendorHash = sha256; }).go-modules"
       # at the root directory of the Nixpkgs repository
-      vendorHash = "sha256-K8helLcOuz3E4LzBE9y3pnZqwdwhO/iMPTN1o22ipVg=";
+      vendorHash = "sha256-mBhlH6LSmcJuc6HbU/3Q9ii7vJkW9jcikBWCl8oeMOk=";
 
       # Do not build conmon from the Git submodule source,
       # Use Nixpkgs provided version
diff --git a/pkgs/applications/window-managers/icewm/default.nix b/pkgs/applications/window-managers/icewm/default.nix
index 20f73952eebf..8e2e3c9d1250 100644
--- a/pkgs/applications/window-managers/icewm/default.nix
+++ b/pkgs/applications/window-managers/icewm/default.nix
@@ -41,13 +41,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "icewm";
-  version = "3.3.2";
+  version = "3.3.3";
 
   src = fetchFromGitHub {
     owner = "ice-wm";
     repo = "icewm";
     rev = finalAttrs.version;
-    hash = "sha256-9fw3vqcorWZZROYm1vbDOrlkzEbuk7X2dOO/Edo3AOg=";
+    hash = "sha256-VcUc1T3uTj8fhSZ+/XWRzgoenjqA/gguxuNsj+PYzB0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/build-support/fetchgit/default.nix b/pkgs/build-support/fetchgit/default.nix
index 56973f5d3678..e920355f460f 100644
--- a/pkgs/build-support/fetchgit/default.nix
+++ b/pkgs/build-support/fetchgit/default.nix
@@ -66,7 +66,7 @@ lib.warnIf (builtins.isString sparseCheckout)
 stdenvNoCC.mkDerivation {
   inherit name;
   builder = ./builder.sh;
-  fetcher = ./nix-prefetch-git;  # This must be a string to ensure it's called with bash.
+  fetcher = ./nix-prefetch-git;
 
   nativeBuildInputs = [ git ]
     ++ lib.optionals fetchLFS [ git-lfs ];
diff --git a/pkgs/data/fonts/lxgw-neoxihei/default.nix b/pkgs/data/fonts/lxgw-neoxihei/default.nix
index 6b93826d4d99..234fd2c508f1 100644
--- a/pkgs/data/fonts/lxgw-neoxihei/default.nix
+++ b/pkgs/data/fonts/lxgw-neoxihei/default.nix
@@ -5,11 +5,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "lxgw-neoxihei";
-  version = "1.009";
+  version = "1.010";
 
   src = fetchurl {
     url = "https://github.com/lxgw/LxgwNeoXiHei/releases/download/v${version}/LXGWNeoXiHei.ttf";
-    hash = "sha256-Q7rrgqrjALLY2y40mNfNmzSeGwcVwhZUmDj08nlWsao=";
+    hash = "sha256-IIiQn2Qlac4ZFy/gVubrpqEpJIt0Dav2TEL29xDC7w4=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/data/fonts/sarasa-gothic/default.nix b/pkgs/data/fonts/sarasa-gothic/default.nix
index c8a3a65a00b7..3498e840eae6 100644
--- a/pkgs/data/fonts/sarasa-gothic/default.nix
+++ b/pkgs/data/fonts/sarasa-gothic/default.nix
@@ -2,13 +2,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "sarasa-gothic";
-  version = "0.40.4";
+  version = "0.40.5";
 
   src = fetchurl {
     # Use the 'ttc' files here for a smaller closure size.
     # (Using 'ttf' files gives a closure size about 15x larger, as of November 2021.)
     url = "https://github.com/be5invis/Sarasa-Gothic/releases/download/v${version}/sarasa-gothic-ttc-${version}.7z";
-    hash = "sha256-PVlozsWYomsQKp8WxHD8+pxzlTmIKGPK71HDLWMR9S0=";
+    hash = "sha256-bs3o8+LyCTCZvUYigUWfSmjFrzPg7nLzElZYxDEsQ9k=";
   };
 
   sourceRoot = ".";
diff --git a/pkgs/data/icons/numix-icon-theme-circle/default.nix b/pkgs/data/icons/numix-icon-theme-circle/default.nix
index f7890c54aa34..8d6fbe4ff4b5 100644
--- a/pkgs/data/icons/numix-icon-theme-circle/default.nix
+++ b/pkgs/data/icons/numix-icon-theme-circle/default.nix
@@ -2,13 +2,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "numix-icon-theme-circle";
-  version = "23.03.19";
+  version = "23.04.05";
 
   src = fetchFromGitHub {
     owner = "numixproject";
     repo = pname;
     rev = version;
-    sha256 = "sha256-kvIPtPJkBIioz/ScES3xmzjJ0IH4eK5wYSj5Jb2U47g=";
+    sha256 = "sha256-eyTiAfwons/VDsNCNfYp4OR+U37LvTIh8Wfktie8PKU=";
   };
 
   nativeBuildInputs = [ gtk3 ];
diff --git a/pkgs/data/icons/tela-circle-icon-theme/default.nix b/pkgs/data/icons/tela-circle-icon-theme/default.nix
index eee3a425b709..d5c29013c51a 100644
--- a/pkgs/data/icons/tela-circle-icon-theme/default.nix
+++ b/pkgs/data/icons/tela-circle-icon-theme/default.nix
@@ -19,13 +19,13 @@ lib.checkListOfEnum "${pname}: color variants" [ "standard" "black" "blue" "brow
 
 stdenvNoCC.mkDerivation rec {
   inherit pname;
-  version = "2023-01-29";
+  version = "2023-04-16";
 
   src = fetchFromGitHub {
     owner = "vinceliuice";
     repo = pname;
     rev = version;
-    sha256 = "J3opK+5xGmV81ubA60BZw9+9IifylrRYo+5cRLWd6Xs=";
+    sha256 = "OHI/kT4HMlWUTxIeGXjtuIYBzQKM3XTGXuE9cviNDTM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/compilers/crystal/build-package.nix b/pkgs/development/compilers/crystal/build-package.nix
index dea386b875b4..e1ff7d08fb54 100644
--- a/pkgs/development/compilers/crystal/build-package.nix
+++ b/pkgs/development/compilers/crystal/build-package.nix
@@ -1,6 +1,7 @@
 { stdenv
 , lib
 , crystal
+, pcre2
 , shards
 , git
 , pkg-config
@@ -90,7 +91,8 @@ stdenv.mkDerivation (mkDerivationArgs // {
 
   inherit enableParallelBuilding;
   strictDeps = true;
-  buildInputs = args.buildInputs or [ ] ++ [ crystal ];
+  buildInputs = args.buildInputs or [ ] ++ [ crystal ]
+    ++ lib.optional (lib.versionAtLeast crystal.version "1.8") pcre2;
 
   nativeBuildInputs = args.nativeBuildInputs or [ ] ++ [
     crystal
diff --git a/pkgs/development/compilers/crystal/default.nix b/pkgs/development/compilers/crystal/default.nix
index e51e1e27dd37..d35869b4a78a 100644
--- a/pkgs/development/compilers/crystal/default.nix
+++ b/pkgs/development/compilers/crystal/default.nix
@@ -72,18 +72,6 @@ let
       meta.platforms = lib.attrNames sha256s;
     };
 
-  commonBuildInputs = extraBuildInputs: [
-    boehmgc
-    pcre
-    pcre2
-    libevent
-    libyaml
-    zlib
-    libxml2
-    openssl
-  ] ++ extraBuildInputs
-  ++ lib.optionals stdenv.isDarwin [ libiconv ];
-
   generic = (
     { version
     , sha256
@@ -92,7 +80,7 @@ let
     , extraBuildInputs ? [ ]
     , buildFlags ? [ "all" "docs" "release=1"]
     }:
-    lib.fix (compiler: stdenv.mkDerivation {
+    lib.fix (compiler: stdenv.mkDerivation (finalAttrs: {
       pname = "crystal";
       inherit buildFlags doCheck version;
 
@@ -172,7 +160,16 @@ let
 
       strictDeps = true;
       nativeBuildInputs = [ binary makeWrapper which pkg-config llvmPackages.llvm ];
-      buildInputs = commonBuildInputs extraBuildInputs;
+      buildInputs = [
+        boehmgc
+        (if lib.versionAtLeast version "1.8" then pcre2 else pcre)
+        libevent
+        libyaml
+        zlib
+        libxml2
+        openssl
+      ] ++ extraBuildInputs
+      ++ lib.optionals stdenv.isDarwin [ libiconv ];
 
       makeFlags = [
         "CRYSTAL_CONFIG_VERSION=${version}"
@@ -202,7 +199,7 @@ let
           --suffix PATH : ${lib.makeBinPath [ pkg-config llvmPackages.clang which ]} \
           --suffix CRYSTAL_PATH : lib:$lib/crystal \
           --suffix CRYSTAL_LIBRARY_PATH : ${
-            lib.makeLibraryPath (commonBuildInputs extraBuildInputs)
+            lib.makeLibraryPath finalAttrs.buildInputs
           }
         install -dm755 $lib/crystal
         cp -r src/* $lib/crystal/
@@ -248,7 +245,7 @@ let
         license = licenses.asl20;
         maintainers = with maintainers; [ david50407 manveru peterhoeg ];
       };
-    })
+    }))
   );
 
 in
diff --git a/pkgs/development/compilers/go/1.18.nix b/pkgs/development/compilers/go/1.18.nix
index 2e05fac64ffc..de74e99d9bb4 100644
--- a/pkgs/development/compilers/go/1.18.nix
+++ b/pkgs/development/compilers/go/1.18.nix
@@ -59,7 +59,7 @@ stdenv.mkDerivation rec {
     ++ lib.optionals stdenv.isLinux [ stdenv.cc.libc.out ]
     ++ lib.optionals (stdenv.hostPlatform.libc == "glibc") [ stdenv.cc.libc.static ];
 
-  depsTargetTargetPropagated = lib.optionals stdenv.isDarwin [ Foundation Security xcbuild ];
+  depsTargetTargetPropagated = lib.optionals stdenv.targetPlatform.isDarwin [ Foundation Security xcbuild ];
 
   depsBuildTarget = lib.optional isCross targetCC;
 
diff --git a/pkgs/development/compilers/go/1.19.nix b/pkgs/development/compilers/go/1.19.nix
index 1891e9c9cf2e..6199ce5bb12e 100644
--- a/pkgs/development/compilers/go/1.19.nix
+++ b/pkgs/development/compilers/go/1.19.nix
@@ -59,7 +59,7 @@ stdenv.mkDerivation rec {
     ++ lib.optionals stdenv.isLinux [ stdenv.cc.libc.out ]
     ++ lib.optionals (stdenv.hostPlatform.libc == "glibc") [ stdenv.cc.libc.static ];
 
-  depsTargetTargetPropagated = lib.optionals stdenv.isDarwin [ Foundation Security xcbuild ];
+  depsTargetTargetPropagated = lib.optionals stdenv.targetPlatform.isDarwin [ Foundation Security xcbuild ];
 
   depsBuildTarget = lib.optional isCross targetCC;
 
diff --git a/pkgs/development/compilers/go/1.20.nix b/pkgs/development/compilers/go/1.20.nix
index a7b36e4e7dfb..3570f9efedf3 100644
--- a/pkgs/development/compilers/go/1.20.nix
+++ b/pkgs/development/compilers/go/1.20.nix
@@ -58,7 +58,7 @@ stdenv.mkDerivation rec {
     ++ lib.optionals stdenv.isLinux [ stdenv.cc.libc.out ]
     ++ lib.optionals (stdenv.hostPlatform.libc == "glibc") [ stdenv.cc.libc.static ];
 
-  depsTargetTargetPropagated = lib.optionals stdenv.isDarwin [ Foundation Security xcbuild ];
+  depsTargetTargetPropagated = lib.optionals stdenv.targetPlatform.isDarwin [ Foundation Security xcbuild ];
 
   depsBuildTarget = lib.optional isCross targetCC;
 
diff --git a/pkgs/development/compilers/llvm/git/default.nix b/pkgs/development/compilers/llvm/git/default.nix
index c7b5e03226ef..d6d8186aecbc 100644
--- a/pkgs/development/compilers/llvm/git/default.nix
+++ b/pkgs/development/compilers/llvm/git/default.nix
@@ -3,6 +3,7 @@
 , libxml2, python3, fetchFromGitHub, overrideCC, wrapCCWith, wrapBintoolsWith
 , buildLlvmTools # tools, but from the previous stage, for cross
 , targetLlvmLibraries # libraries, but from the next stage, for cross
+, targetLlvm
 # This is the default binutils, but with *this* version of LLD rather
 # than the default LLVM verion's, if LLD is the choice. We use these for
 # the `useLLVM` bootstrapping below.
@@ -344,7 +345,7 @@ in let
     };
 
     openmp = callPackage ./openmp {
-      inherit llvm_meta;
+      inherit llvm_meta targetLlvm;
     };
   });
 
diff --git a/pkgs/development/compilers/llvm/git/libcxx/default.nix b/pkgs/development/compilers/llvm/git/libcxx/default.nix
index de4260540e92..94374c8a312d 100644
--- a/pkgs/development/compilers/llvm/git/libcxx/default.nix
+++ b/pkgs/development/compilers/llvm/git/libcxx/default.nix
@@ -17,7 +17,7 @@ let
   basename = "libcxx";
 in
 
-assert stdenv.isDarwin -> cxxabi.pname == "libcxxabi";
+assert stdenv.isDarwin -> cxxabi.libName == "c++abi";
 
 stdenv.mkDerivation rec {
   pname = basename + lib.optionalString headersOnly "-headers";
@@ -64,35 +64,33 @@ stdenv.mkDerivation rec {
 
   buildInputs = lib.optionals (!headersOnly) [ cxxabi ];
 
-  cmakeFlags = [
+  cmakeFlags = let
+    # See: https://libcxx.llvm.org/BuildingLibcxx.html#cmdoption-arg-libcxx-cxx-abi-string
+    libcxx_cxx_abi_opt = {
+      "c++abi" = "system-libcxxabi";
+      "cxxrt" = "libcxxrt";
+    }.${cxxabi.libName} or (throw "unknown cxxabi: ${cxxabi.libName} (${cxxabi.pname})");
+  in [
     "-DLLVM_ENABLE_RUNTIMES=libcxx"
-    "-DLIBCXX_CXX_ABI=${lib.optionalString (!headersOnly) "system-"}${cxxabi.pname}"
-  ] ++ lib.optional (!headersOnly && cxxabi.pname == "libcxxabi") "-DLIBCXX_CXX_ABI_INCLUDE_PATHS=${cxxabi.dev}/include/c++/v1"
+    "-DLIBCXX_CXX_ABI=${if headersOnly then "none" else libcxx_cxx_abi_opt}"
+  ] ++ lib.optional (!headersOnly && cxxabi.libName == "c++abi") "-DLIBCXX_CXX_ABI_INCLUDE_PATHS=${cxxabi.dev}/include/c++/v1"
     ++ lib.optional (stdenv.hostPlatform.isMusl || stdenv.hostPlatform.isWasi) "-DLIBCXX_HAS_MUSL_LIBC=1"
     ++ lib.optional (stdenv.hostPlatform.useLLVM or false) "-DLIBCXX_USE_COMPILER_RT=ON"
     ++ lib.optionals stdenv.hostPlatform.isWasm [
       "-DLIBCXX_ENABLE_THREADS=OFF"
       "-DLIBCXX_ENABLE_FILESYSTEM=OFF"
       "-DLIBCXX_ENABLE_EXCEPTIONS=OFF"
-    ] ++ lib.optional (!enableShared) "-DLIBCXX_ENABLE_SHARED=OFF";
+    ] ++ lib.optional (!enableShared) "-DLIBCXX_ENABLE_SHARED=OFF"
+    # If we're only building the headers we don't actually *need* a functioning
+    # C/C++ compiler:
+    ++ lib.optionals (headersOnly) [
+      "-DCMAKE_C_COMPILER_WORKS=ON"
+      "-DCMAKE_CXX_COMPILER_WORKS=ON"
+    ];
 
   ninjaFlags = lib.optional headersOnly "generate-cxx-headers";
   installTargets = lib.optional headersOnly "install-cxx-headers";
 
-  preInstall = lib.optionalString (stdenv.isDarwin && !headersOnly) ''
-    for file in lib/*.dylib; do
-      if [ -L "$file" ]; then continue; fi
-
-      baseName=$(basename $(${stdenv.cc.targetPrefix}otool -D $file | tail -n 1))
-      installName="$out/lib/$baseName"
-      abiName=$(echo "$baseName" | sed -e 's/libc++/libc++abi/')
-
-      for other in $(${stdenv.cc.targetPrefix}otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
-        ${stdenv.cc.targetPrefix}install_name_tool -change $other ${cxxabi}/lib/$abiName $file
-      done
-    done
-  '';
-
   passthru = {
     isLLVM = true;
     inherit cxxabi;
diff --git a/pkgs/development/compilers/llvm/git/llvm/default.nix b/pkgs/development/compilers/llvm/git/llvm/default.nix
index 96477c0686d4..ae8e1385bd8f 100644
--- a/pkgs/development/compilers/llvm/git/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/git/llvm/default.nix
@@ -24,10 +24,10 @@
   && (stdenv.hostPlatform == stdenv.buildPlatform)
 , enableManpages ? false
 , enableSharedLibraries ? !stdenv.hostPlatform.isStatic
-, enablePFM ? !(stdenv.isDarwin
-  || stdenv.isAarch64 # broken for Ampere eMAG 8180 (c2.large.arm on Packet) #56245
-  || stdenv.isAarch32 # broken for the armv7l builder
-)
+, enablePFM ? stdenv.isLinux /* PFM only supports Linux */
+  # broken for Ampere eMAG 8180 (c2.large.arm on Packet) #56245
+  # broken for the armv7l builder
+  && !stdenv.hostPlatform.isAarch
 , enablePolly ? true
 } @args:
 
diff --git a/pkgs/development/compilers/llvm/git/openmp/default.nix b/pkgs/development/compilers/llvm/git/openmp/default.nix
index f22101e9cade..52aeb4bd9800 100644
--- a/pkgs/development/compilers/llvm/git/openmp/default.nix
+++ b/pkgs/development/compilers/llvm/git/openmp/default.nix
@@ -6,6 +6,7 @@
 , cmake
 , ninja
 , llvm
+, targetLlvm
 , lit
 , clang-unwrapped
 , perl
@@ -34,7 +35,9 @@ stdenv.mkDerivation rec {
   outputs = [ "out" "dev" ];
 
   nativeBuildInputs = [ cmake ninja perl pkg-config lit ];
-  buildInputs = [ llvm ];
+  buildInputs = [
+    (if stdenv.buildPlatform == stdenv.hostPlatform then llvm else targetLlvm)
+  ];
 
   # Unsup:Pass:XFail:Fail
   # 26:267:16:8
diff --git a/pkgs/development/libraries/aws-c-auth/default.nix b/pkgs/development/libraries/aws-c-auth/default.nix
index 2a7bc10304c1..fa170ba2b969 100644
--- a/pkgs/development/libraries/aws-c-auth/default.nix
+++ b/pkgs/development/libraries/aws-c-auth/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-auth";
-  version = "0.6.22";
+  version = "0.6.26";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-auth";
     rev = "v${version}";
-    sha256 = "sha256-crqoUXPf+2/bhKvvw6fiKNqozVqczbf+aSlK390/w/Q=";
+    sha256 = "sha256-PvdkTw5JydJT0TbXLB2C9tk4T+ho+fAbaw4jU9m5KuU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/aws-c-common/default.nix b/pkgs/development/libraries/aws-c-common/default.nix
index b7d1eb244ea8..93ac1df04652 100644
--- a/pkgs/development/libraries/aws-c-common/default.nix
+++ b/pkgs/development/libraries/aws-c-common/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-common";
-  version = "0.8.9";
+  version = "0.8.15";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-zaX97qFJ/YcjEq6mQqtT6SHIEeRxGgDkAvN72Vjxe98=";
+    sha256 = "sha256-AemFZZwfHdjqX/sXUw1fpusICOa3C7rT6Ofsz5bGYOQ=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/aws-c-event-stream/default.nix b/pkgs/development/libraries/aws-c-event-stream/default.nix
index 12c012d09b90..fb857a3f316c 100644
--- a/pkgs/development/libraries/aws-c-event-stream/default.nix
+++ b/pkgs/development/libraries/aws-c-event-stream/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-event-stream";
-  version = "0.2.18";
+  version = "0.2.20";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-zsPhZHguOky55fz2m5xu4H42/pWATGJEHyoK0fZLybc=";
+    sha256 = "sha256-UDACkGqTtyLablSzePMmMk4iGpgfdtZU/SEv0RCSFfA=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/aws-c-http/default.nix b/pkgs/development/libraries/aws-c-http/default.nix
index 08ce799ffbe6..8cb2703147ef 100644
--- a/pkgs/development/libraries/aws-c-http/default.nix
+++ b/pkgs/development/libraries/aws-c-http/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-http";
-  version = "0.7.3";
+  version = "0.7.6";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-http";
     rev = "v${version}";
-    sha256 = "sha256-n4BTiqxFz9eOTgh4o78TN2QgCIUbE2Z4jDq27HNORLo=";
+    sha256 = "sha256-pJGzGbIuz8UJkfmTQEZgXSOMuYixMezNZmgaRlcnmfg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/aws-c-io/default.nix b/pkgs/development/libraries/aws-c-io/default.nix
index 34c20b11fcdb..041edf2a5220 100644
--- a/pkgs/development/libraries/aws-c-io/default.nix
+++ b/pkgs/development/libraries/aws-c-io/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-io";
-  version = "0.13.18";
+  version = "0.13.19";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-+12vByeXdQDdc0fn5tY8k4QP4qyqqLRuc8vtuvE/AfU=";
+    sha256 = "sha256-6lTAnoBWbwyWpycsaS7dpCC9c4xYws19HCNyTd7aRho=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/aws-c-mqtt/default.nix b/pkgs/development/libraries/aws-c-mqtt/default.nix
index aab3dec12396..5f3fda00c52a 100644
--- a/pkgs/development/libraries/aws-c-mqtt/default.nix
+++ b/pkgs/development/libraries/aws-c-mqtt/default.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-mqtt";
-  version = "0.8.4";
+  version = "0.8.8";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-mqtt";
     rev = "v${version}";
-    sha256 = "sha256-33D+XcNH5e8ty/rckuJFMMP7xG0IhG5wl8Thvu9b7hM=";
+    sha256 = "sha256-bt5Qjw+CqgTfi/Ibhc4AwmJxr22Q6m3ygpmeMhvQTT0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/aws-c-s3/default.nix b/pkgs/development/libraries/aws-c-s3/default.nix
index cb77bade69aa..97c7083c669a 100644
--- a/pkgs/development/libraries/aws-c-s3/default.nix
+++ b/pkgs/development/libraries/aws-c-s3/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-s3";
-  version = "0.2.2";
+  version = "0.2.8";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-s3";
     rev = "v${version}";
-    sha256 = "sha256-hPb9KTq/+OrUlE5EtmE6PYvtxsEmBb8K9ab7CAaELNo=";
+    sha256 = "sha256-kwYzsKdEy+e0GxqYcakcdwoaC2LLPZe8E7bZNrmqok0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/aws-c-sdkutils/default.nix b/pkgs/development/libraries/aws-c-sdkutils/default.nix
index 298ea5cb946c..49b584e5add8 100644
--- a/pkgs/development/libraries/aws-c-sdkutils/default.nix
+++ b/pkgs/development/libraries/aws-c-sdkutils/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-sdkutils";
-  version = "0.1.7";
+  version = "0.1.8";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-sdkutils";
     rev = "v${version}";
-    sha256 = "sha256-qu/+xYorB+QXP5Ixj5ZFP9ZenVYV6hcmxHnH14DEgrU=";
+    sha256 = "sha256-7aLupTbKC2I7+ylySe1xq3q6YDP9ogLlsWSKBk+jI+Q=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/aws-crt-cpp/0001-build-Make-includedir-properly-overrideable.patch b/pkgs/development/libraries/aws-crt-cpp/0001-build-Make-includedir-properly-overrideable.patch
index ed08abfb48f8..9b61316ffb91 100644
--- a/pkgs/development/libraries/aws-crt-cpp/0001-build-Make-includedir-properly-overrideable.patch
+++ b/pkgs/development/libraries/aws-crt-cpp/0001-build-Make-includedir-properly-overrideable.patch
@@ -1,41 +1,41 @@
-From 6be95cf45c4b5beae8b364468cef42d5c5880836 Mon Sep 17 00:00:00 2001
+From 2370ee92e78cfb0d55e3958b63ac71b16567b5fd Mon Sep 17 00:00:00 2001
 From: Jan Tojnar <jtojnar@gmail.com>
-Date: Sun, 9 Jan 2022 01:57:18 +0100
+Date: Wed, 9 Nov 2022 17:59:17 +0100
 Subject: [PATCH] build: Make includedir properly overrideable
 
 This is required by some package managers like Nix.
 ---
- CMakeLists.txt | 20 ++++++++++++--------
- 1 file changed, 12 insertions(+), 8 deletions(-)
+ CMakeLists.txt | 22 +++++++++++++---------
+ 1 file changed, 13 insertions(+), 9 deletions(-)
 
 diff --git a/CMakeLists.txt b/CMakeLists.txt
-index ad50174..e0be58c 100644
+index 9f13d21..f6e62c7 100644
 --- a/CMakeLists.txt
 +++ b/CMakeLists.txt
-@@ -54,6 +54,10 @@ elseif(NOT DEFINED CMAKE_INSTALL_LIBDIR)
+@@ -66,6 +66,10 @@ elseif(NOT DEFINED CMAKE_INSTALL_LIBDIR)
      set(CMAKE_INSTALL_LIBDIR "lib")
  endif()
- 
+
 +if(NOT DEFINED CMAKE_INSTALL_INCLUDEDIR)
 +    set(CMAKE_INSTALL_INCLUDEDIR "include")
 +endif()
 +
- if (${CMAKE_INSTALL_LIBDIR} STREQUAL "lib64")
+ if(${CMAKE_INSTALL_LIBDIR} STREQUAL "lib64")
      set(FIND_LIBRARY_USE_LIB64_PATHS true)
  endif()
-@@ -302,7 +306,7 @@ endif ()
- 
+@@ -322,7 +326,7 @@ endif()
+
  target_include_directories(${PROJECT_NAME} PUBLIC
-         $<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}/include>
--        $<INSTALL_INTERFACE:include>)
-+        $<INSTALL_INTERFACE:${CMAKE_INSTALL_INCLUDEDIR}>)
- 
+     $<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}/include>
+-    $<INSTALL_INTERFACE:include>)
++    $<INSTALL_INTERFACE:${CMAKE_INSTALL_INCLUDEDIR}>)
+
  aws_use_package(aws-c-http)
  aws_use_package(aws-c-mqtt)
-@@ -316,13 +320,13 @@ aws_use_package(aws-c-s3)
- 
+@@ -336,14 +340,14 @@ aws_use_package(aws-c-s3)
+
  target_link_libraries(${PROJECT_NAME} ${DEP_AWS_LIBS})
- 
+
 -install(FILES ${AWS_CRT_HEADERS} DESTINATION "include/aws/crt" COMPONENT Development)
 -install(FILES ${AWS_CRT_AUTH_HEADERS} DESTINATION "include/aws/crt/auth" COMPONENT Development)
 -install(FILES ${AWS_CRT_CRYPTO_HEADERS} DESTINATION "include/aws/crt/crypto" COMPONENT Development)
@@ -43,6 +43,7 @@ index ad50174..e0be58c 100644
 -install(FILES ${AWS_CRT_IOT_HEADERS} DESTINATION "include/aws/iot" COMPONENT Development)
 -install(FILES ${AWS_CRT_MQTT_HEADERS} DESTINATION "include/aws/crt/mqtt" COMPONENT Development)
 -install(FILES ${AWS_CRT_HTTP_HEADERS} DESTINATION "include/aws/crt/http" COMPONENT Development)
+-install(FILES ${AWS_CRT_ENDPOINT_HEADERS} DESTINATION "include/aws/crt/endpoints" COMPONENT Development)
 +install(FILES ${AWS_CRT_HEADERS} DESTINATION "${CMAKE_INSTALL_INCLUDEDIR}/aws/crt" COMPONENT Development)
 +install(FILES ${AWS_CRT_AUTH_HEADERS} DESTINATION "${CMAKE_INSTALL_INCLUDEDIR}/aws/crt/auth" COMPONENT Development)
 +install(FILES ${AWS_CRT_CRYPTO_HEADERS} DESTINATION "${CMAKE_INSTALL_INCLUDEDIR}/aws/crt/crypto" COMPONENT Development)
@@ -50,9 +51,9 @@ index ad50174..e0be58c 100644
 +install(FILES ${AWS_CRT_IOT_HEADERS} DESTINATION "${CMAKE_INSTALL_INCLUDEDIR}/aws/iot" COMPONENT Development)
 +install(FILES ${AWS_CRT_MQTT_HEADERS} DESTINATION "${CMAKE_INSTALL_INCLUDEDIR}/aws/crt/mqtt" COMPONENT Development)
 +install(FILES ${AWS_CRT_HTTP_HEADERS} DESTINATION "${CMAKE_INSTALL_INCLUDEDIR}/aws/crt/http" COMPONENT Development)
- 
- install(
-         TARGETS ${PROJECT_NAME}
--- 
-2.34.1
++install(FILES ${AWS_CRT_ENDPOINT_HEADERS} DESTINATION "${CMAKE_INSTALL_INCLUDEDIR}/aws/crt/endpoints" COMPONENT Development)
 
+ install(
+     TARGETS ${PROJECT_NAME}
+--
+2.37.3
diff --git a/pkgs/development/libraries/aws-crt-cpp/default.nix b/pkgs/development/libraries/aws-crt-cpp/default.nix
index 3d4b31ad57d1..38811a9425cb 100644
--- a/pkgs/development/libraries/aws-crt-cpp/default.nix
+++ b/pkgs/development/libraries/aws-crt-cpp/default.nix
@@ -17,7 +17,7 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-crt-cpp";
-  version = "0.18.9";
+  version = "0.19.8";
 
   outputs = [ "out" "dev" ];
 
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
     owner = "awslabs";
     repo = "aws-crt-cpp";
     rev = "v${version}";
-    sha256 = "sha256-NEsEKUKmADevb8SSc8EFuXLc12fuOf6fXI76yVeDQno=";
+    sha256 = "sha256-z/9ifBv4KbH5RiR1t1Dz8cCWZlHrMSyB8/w4pdTscw0=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/aws-sdk-cpp/default.nix b/pkgs/development/libraries/aws-sdk-cpp/default.nix
index bb7989a2cbf5..e1711d4cd59e 100644
--- a/pkgs/development/libraries/aws-sdk-cpp/default.nix
+++ b/pkgs/development/libraries/aws-sdk-cpp/default.nix
@@ -1,18 +1,11 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , cmake
 , curl
 , openssl
-, s2n-tls
 , zlib
 , aws-crt-cpp
-, aws-c-cal
-, aws-c-common
-, aws-c-event-stream
-, aws-c-io
-, aws-checksums
 , CoreAudio
 , AudioToolbox
 , # Allow building a limited set of APIs, e.g. ["s3" "ec2"].
@@ -31,13 +24,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "aws-sdk-cpp";
-  version = "1.9.294";
+  version = "1.11.37";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "aws-sdk-cpp";
     rev = version;
-    sha256 = "sha256-Z1eRKW+8nVD53GkNyYlZjCcT74MqFqqRMeMc33eIQ9g=";
+    sha256 = "sha256-C1PdLNagoIMk9/AAV2Pp7kWcspasJtN9Tx679FnEprc=";
   };
 
   patches = [
@@ -50,30 +43,15 @@ stdenv.mkDerivation rec {
     substituteInPlace cmake/compiler_settings.cmake \
       --replace '"-Werror"' ' '
 
-    # Missing includes for GCC11
-    sed '5i#include <thread>' -i \
-      aws-cpp-sdk-cloudfront-integration-tests/CloudfrontOperationTest.cpp \
-      aws-cpp-sdk-cognitoidentity-integration-tests/IdentityPoolOperationTest.cpp \
-      aws-cpp-sdk-dynamodb-integration-tests/TableOperationTest.cpp \
-      aws-cpp-sdk-elasticfilesystem-integration-tests/ElasticFileSystemTest.cpp \
-      aws-cpp-sdk-lambda-integration-tests/FunctionTest.cpp \
-      aws-cpp-sdk-mediastore-data-integration-tests/MediaStoreDataTest.cpp \
-      aws-cpp-sdk-queues/source/sqs/SQSQueue.cpp \
-      aws-cpp-sdk-redshift-integration-tests/RedshiftClientTest.cpp \
-      aws-cpp-sdk-s3-crt-integration-tests/BucketAndObjectOperationTest.cpp \
-      aws-cpp-sdk-s3-integration-tests/BucketAndObjectOperationTest.cpp \
-      aws-cpp-sdk-s3control-integration-tests/S3ControlTest.cpp \
-      aws-cpp-sdk-sqs-integration-tests/QueueOperationTest.cpp \
-      aws-cpp-sdk-transfer-tests/TransferTests.cpp
     # Flaky on Hydra
-    rm aws-cpp-sdk-core-tests/aws/auth/AWSCredentialsProviderTest.cpp
+    rm tests/aws-cpp-sdk-core-tests/aws/auth/AWSCredentialsProviderTest.cpp
     # Includes aws-c-auth private headers, so only works with submodule build
-    rm aws-cpp-sdk-core-tests/aws/auth/AWSAuthSignerTest.cpp
+    rm tests/aws-cpp-sdk-core-tests/aws/auth/AWSAuthSignerTest.cpp
     # TestRandomURLMultiThreaded fails
-    rm aws-cpp-sdk-core-tests/http/HttpClientTest.cpp
+    rm tests/aws-cpp-sdk-core-tests/http/HttpClientTest.cpp
   '' + lib.optionalString stdenv.isi686 ''
     # EPSILON is exceeded
-    rm aws-cpp-sdk-core-tests/aws/client/AdaptiveRetryStrategyTest.cpp
+    rm tests/aws-cpp-sdk-core-tests/aws/client/AdaptiveRetryStrategyTest.cpp
   '';
 
   # FIXME: might be nice to put different APIs in different outputs
diff --git a/pkgs/development/libraries/fcft/default.nix b/pkgs/development/libraries/fcft/default.nix
index 7b988a9ad86c..d4a923add791 100644
--- a/pkgs/development/libraries/fcft/default.nix
+++ b/pkgs/development/libraries/fcft/default.nix
@@ -56,7 +56,7 @@ stdenv.mkDerivation rec {
       fionera
       sternenseemann
     ];
-    license = licenses.mit;
+    license = with licenses; [ mit zlib ];
     platforms = with platforms; linux;
   };
 }
diff --git a/pkgs/development/libraries/grpc/default.nix b/pkgs/development/libraries/grpc/default.nix
index 2d591109f27d..1ff8df9e58b7 100644
--- a/pkgs/development/libraries/grpc/default.nix
+++ b/pkgs/development/libraries/grpc/default.nix
@@ -21,7 +21,7 @@
 
 stdenv.mkDerivation rec {
   pname = "grpc";
-  version = "1.53.0"; # N.B: if you change this, please update:
+  version = "1.54.0"; # N.B: if you change this, please update:
     # pythonPackages.grpcio-tools
     # pythonPackages.grpcio-status
 
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     owner = "grpc";
     repo = "grpc";
     rev = "v${version}";
-    hash = "sha256-YRVWR1woMDoq8TWFrL2nqQvAbtqBnUd3QlfbFTJm8dc=";
+    hash = "sha256-WVH7rYyFx2LyAnctnNbX4KevoJ5KKZujN+SmL0Y6wvw=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/libraries/gsl-lite/default.nix b/pkgs/development/libraries/gsl-lite/default.nix
index 34beee93ecd3..9078df05d9db 100644
--- a/pkgs/development/libraries/gsl-lite/default.nix
+++ b/pkgs/development/libraries/gsl-lite/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gsl-lite";
-  version = "0.40.0";
+  version = "0.41.0";
 
   src = fetchFromGitHub {
     owner = "gsl-lite";
     repo = "gsl-lite";
     rev = "v${version}";
-    hash = "sha256-80ksT8XFn2LLMr63gKGZD/0+FDLnAtFyMpuuSjtoBlk=";
+    hash = "sha256-cuuix302bVA7dWa7EJoxJ+otf1rSzjWQK8DHJsVkQio=";
   };
 
   nativeBuildInputs = [ cmake ninja ];
diff --git a/pkgs/development/libraries/gvm-libs/default.nix b/pkgs/development/libraries/gvm-libs/default.nix
index b1499a777e6d..8e3667afc20d 100644
--- a/pkgs/development/libraries/gvm-libs/default.nix
+++ b/pkgs/development/libraries/gvm-libs/default.nix
@@ -23,13 +23,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gvm-libs";
-  version = "22.4.5";
+  version = "22.4.6";
 
   src = fetchFromGitHub {
     owner = "greenbone";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-dnR562qsDoW8Xb4TNrpcn66tn9iVmcmTaBxMbb+CX64=";
+    hash = "sha256-HG9DwUX0rTE7Fc5AOl98u/JEfvfd0iwn3fvsIG8lsfU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/libdeltachat/Cargo.lock b/pkgs/development/libraries/libdeltachat/Cargo.lock
index 5d9f4fa9c27c..87198de0352e 100644
--- a/pkgs/development/libraries/libdeltachat/Cargo.lock
+++ b/pkgs/development/libraries/libdeltachat/Cargo.lock
@@ -189,12 +189,12 @@ dependencies = [
 
 [[package]]
 name = "async-imap"
-version = "0.6.0"
-source = "git+https://github.com/async-email/async-imap?branch=master#90270474a5a494669e7c63c13471d189afdc98ae"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d11e163a705d0c809dfc886eee95df5117c758539c940c0fe9aa3aa4da5388ce"
 dependencies = [
  "async-channel",
- "async-native-tls 0.4.0",
- "base64 0.13.1",
+ "base64 0.21.0",
  "byte-pool",
  "chrono",
  "futures",
@@ -218,18 +218,6 @@ dependencies = [
  "event-listener",
 ]
 
-[[package]]
-name = "async-native-tls"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d57d4cec3c647232e1094dc013546c0b33ce785d8aeb251e1f20dfaf8a9a13fe"
-dependencies = [
- "native-tls",
- "thiserror",
- "tokio",
- "url",
-]
-
 [[package]]
 name = "async-native-tls"
 version = "0.5.0"
@@ -494,9 +482,9 @@ checksum = "0d261e256854913907f67ed06efbc3338dfe6179796deefc1ff763fc1aee5535"
 
 [[package]]
 name = "byte-pool"
-version = "0.2.3"
+version = "0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8c7230ddbb427b1094d477d821a99f3f54d36333178eeb806e279bcdcecf0ca"
+checksum = "c2f1b21189f50b5625efa6227cf45e9d4cfdc2e73582df2b879e9689e78a7158"
 dependencies = [
  "crossbeam-queue",
  "stable_deref_trait",
@@ -836,9 +824,9 @@ dependencies = [
 
 [[package]]
 name = "crossbeam-channel"
-version = "0.5.7"
+version = "0.5.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf2b3e8478797446514c91ef04bafcb59faba183e621ad488df88983cc14128c"
+checksum = "a33c2bf77f2df06183c3aa30d1e96c0695a313d4f9c453cc3762a6db39f99200"
 dependencies = [
  "cfg-if",
  "crossbeam-utils",
@@ -1061,13 +1049,13 @@ dependencies = [
 
 [[package]]
 name = "deltachat"
-version = "1.112.6"
+version = "1.112.7"
 dependencies = [
  "ansi_term",
  "anyhow",
  "async-channel",
  "async-imap",
- "async-native-tls 0.5.0",
+ "async-native-tls",
  "async-smtp",
  "async_zip",
  "backtrace",
@@ -1135,7 +1123,7 @@ dependencies = [
 
 [[package]]
 name = "deltachat-jsonrpc"
-version = "1.112.6"
+version = "1.112.7"
 dependencies = [
  "anyhow",
  "async-channel",
@@ -1158,7 +1146,7 @@ dependencies = [
 
 [[package]]
 name = "deltachat-repl"
-version = "1.112.6"
+version = "1.112.7"
 dependencies = [
  "ansi_term",
  "anyhow",
@@ -1173,7 +1161,7 @@ dependencies = [
 
 [[package]]
 name = "deltachat-rpc-server"
-version = "1.112.6"
+version = "1.112.7"
 dependencies = [
  "anyhow",
  "deltachat",
@@ -1197,7 +1185,7 @@ dependencies = [
 
 [[package]]
 name = "deltachat_ffi"
-version = "1.112.6"
+version = "1.112.7"
 dependencies = [
  "anyhow",
  "deltachat",
diff --git a/pkgs/development/libraries/libdeltachat/default.nix b/pkgs/development/libraries/libdeltachat/default.nix
index 3e11f0008d4d..0fa666b6ed38 100644
--- a/pkgs/development/libraries/libdeltachat/default.nix
+++ b/pkgs/development/libraries/libdeltachat/default.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libdeltachat";
-  version = "1.112.6";
+  version = "1.112.7";
 
   src = fetchFromGitHub {
     owner = "deltachat";
     repo = "deltachat-core-rust";
     rev = "v${version}";
-    hash = "sha256-xadf6N5x3zdefwsKUFaVs71HmLMpJoUq5LL7IENsvC0=";
+    hash = "sha256-zBstNj8IZ8ScwZxzvTxDPwe8R0n2z/EuvjbR+bJepJk=";
   };
 
   patches = [
@@ -34,7 +34,6 @@ stdenv.mkDerivation rec {
   cargoDeps = rustPlatform.importCargoLock {
     lockFile = ./Cargo.lock;
     outputHashes = {
-      "async-imap-0.6.0" = "sha256-q6ZDm+4i+EtiMgkW/8LQ/TkDO/sj0p7KJhpYE76zAjo=";
       "email-0.0.21" = "sha256-Ys47MiEwVZenRNfenT579Rb17ABQ4QizVFTWUq3+bAY=";
       "encoded-words-0.2.0" = "sha256-KK9st0hLFh4dsrnLd6D8lC6pRFFs8W+WpZSGMGJcosk=";
       "lettre-0.9.2" = "sha256-+hU1cFacyyeC9UGVBpS14BWlJjHy90i/3ynMkKAzclk=";
diff --git a/pkgs/development/libraries/libzen/default.nix b/pkgs/development/libraries/libzen/default.nix
index a0c99457d47b..12ac860320c7 100644
--- a/pkgs/development/libraries/libzen/default.nix
+++ b/pkgs/development/libraries/libzen/default.nix
@@ -1,11 +1,11 @@
 { lib, stdenv, fetchurl, autoreconfHook }:
 
 stdenv.mkDerivation rec {
-  version = "0.4.40";
+  version = "0.4.41";
   pname = "libzen";
   src = fetchurl {
     url = "https://mediaarea.net/download/source/libzen/${version}/libzen_${version}.tar.bz2";
-    sha256 = "sha256-VUPixFIUudnwuk9D3uYdApbh/58UJ+1sh53dG2K59p4=";
+    sha256 = "sha256-6yN9fT3Kbca6BocZQgon3gk0p4PMrrKGdWKzWvOQHi0=";
   };
 
   nativeBuildInputs = [ autoreconfHook ];
diff --git a/pkgs/development/libraries/live555/default.nix b/pkgs/development/libraries/live555/default.nix
index 1e6311692a05..61c431c502be 100644
--- a/pkgs/development/libraries/live555/default.nix
+++ b/pkgs/development/libraries/live555/default.nix
@@ -10,7 +10,7 @@
 
 stdenv.mkDerivation rec {
   pname = "live555";
-  version = "2023.01.19";
+  version = "2023.03.30";
 
   src = fetchurl {
     urls = [
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
       "https://download.videolan.org/contrib/live555/live.${version}.tar.gz"
       "mirror://sourceforge/slackbuildsdirectlinks/live.${version}.tar.gz"
     ];
-    sha256 = "sha256-p8ZJE/f3AHxf3CnqgR48p4HyYicbPkKv3UvBBB2G+pk=";
+    sha256 = "sha256-v/1Nh8dicdWeNxFp7bakhEaKB4ysKtRFnyLKqNmJ2tQ=";
   };
 
   nativeBuildInputs = lib.optional stdenv.isDarwin darwin.cctools;
diff --git a/pkgs/development/libraries/physics/hepmc3/default.nix b/pkgs/development/libraries/physics/hepmc3/default.nix
index 3379e3d04d29..f0caef03348e 100644
--- a/pkgs/development/libraries/physics/hepmc3/default.nix
+++ b/pkgs/development/libraries/physics/hepmc3/default.nix
@@ -16,11 +16,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "hepmc3";
-  version = "3.2.5";
+  version = "3.2.6";
 
   src = fetchurl {
     url = "http://hepmc.web.cern.ch/hepmc/releases/HepMC3-${version}.tar.gz";
-    sha256 = "sha256-zQ91yA91VJxZzCqCns52Acd96Xyypat1eQysjh1YUDI=";
+    sha256 = "sha256-JI87WzbddzhEy+c9UfYIkUWDNLmGsll1TFnb9Lvx1SU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/qt-6/default.nix b/pkgs/development/libraries/qt-6/default.nix
index 931a9dc3fc7b..90a25f34c213 100644
--- a/pkgs/development/libraries/qt-6/default.nix
+++ b/pkgs/development/libraries/qt-6/default.nix
@@ -65,6 +65,7 @@ let
         qtlocation
         qtlottie
         qtmultimedia
+        qtmqtt
         qtnetworkauth
         qtpositioning
         qtsensors
@@ -107,6 +108,7 @@ let
         inherit (gst_all_1) gstreamer gst-plugins-base gst-plugins-good gst-libav gst-vaapi;
         inherit (darwin.apple_sdk_11_0.frameworks) VideoToolbox;
       };
+      qtmqtt = callPackage ./modules/qtmqtt.nix { };
       qtnetworkauth = callPackage ./modules/qtnetworkauth.nix { };
       qtpositioning = callPackage ./modules/qtpositioning.nix { };
       qtsensors = callPackage ./modules/qtsensors.nix { };
diff --git a/pkgs/development/libraries/qt-6/modules/qtmqtt.nix b/pkgs/development/libraries/qt-6/modules/qtmqtt.nix
new file mode 100644
index 000000000000..a8f6d7b04df9
--- /dev/null
+++ b/pkgs/development/libraries/qt-6/modules/qtmqtt.nix
@@ -0,0 +1,14 @@
+{ qtModule
+, fetchurl
+, qtbase
+}:
+
+qtModule rec {
+  pname = "qtmqtt";
+  version = "6.5.0";
+  src = fetchurl {
+    url = "https://github.com/qt/qtmqtt/archive/refs/tags/v${version}.tar.gz";
+    sha256 = "qv3GYApd4QKk/Oubx48VhG/Dbl/rvq5ua0UinPlDDNY=";
+  };
+  qtInputs = [ qtbase ];
+}
diff --git a/pkgs/development/libraries/science/math/ipopt/default.nix b/pkgs/development/libraries/science/math/ipopt/default.nix
index e9ca26d23958..9b26b352cdad 100644
--- a/pkgs/development/libraries/science/math/ipopt/default.nix
+++ b/pkgs/development/libraries/science/math/ipopt/default.nix
@@ -12,13 +12,13 @@ assert (!blas.isILP64) && (!lapack.isILP64);
 
 stdenv.mkDerivation rec {
   pname = "ipopt";
-  version = "3.14.11";
+  version = "3.14.12";
 
   src = fetchFromGitHub {
     owner = "coin-or";
     repo = "Ipopt";
     rev = "releases/${version}";
-    sha256 = "sha256-PzNDiTZkPORFckFJryFuvn/rsfx3wrXJ9Qde88gH5o4=";
+    sha256 = "sha256-cyV3tgmZz5AExxxdGJ12r+PPXn7v2AEhxb9icBxolS8=";
   };
 
   CXXDEFS = [ "-DHAVE_RAND" "-DHAVE_CSTRING" "-DHAVE_CSTDIO" ];
diff --git a/pkgs/development/libraries/sentencepiece/default.nix b/pkgs/development/libraries/sentencepiece/default.nix
index ea903ca58e0e..67875df02e25 100644
--- a/pkgs/development/libraries/sentencepiece/default.nix
+++ b/pkgs/development/libraries/sentencepiece/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "sentencepiece";
-  version = "0.1.97";
+  version = "0.1.98";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-T6qQtLmuPKVha0CwX4fBH7IQoAlwVj64X2qDecWd7s8=";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-afODoC4G3ibVXMLEIxusmju4wkTcOtlEzS17+EuyIZw=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/spice-gtk/default.nix b/pkgs/development/libraries/spice-gtk/default.nix
index 81311fb23700..002012db505e 100644
--- a/pkgs/development/libraries/spice-gtk/default.nix
+++ b/pkgs/development/libraries/spice-gtk/default.nix
@@ -135,6 +135,7 @@ stdenv.mkDerivation rec {
     "-Dpolkit=disabled"
   ] ++ lib.optionals (!stdenv.isLinux) [
     "-Dlibcap-ng=disabled"
+    "-Degl=disabled"
   ] ++ lib.optionals stdenv.hostPlatform.isMusl [
     "-Dcoroutine=gthread" # Fixes "Function missing:makecontext"
   ];
diff --git a/pkgs/development/misc/brev-cli/default.nix b/pkgs/development/misc/brev-cli/default.nix
index 753d0ececb12..ffb2d6bd1873 100644
--- a/pkgs/development/misc/brev-cli/default.nix
+++ b/pkgs/development/misc/brev-cli/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "brev-cli";
-  version = "0.6.215";
+  version = "0.6.217";
 
   src = fetchFromGitHub {
     owner = "brevdev";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Yv59F3i++l6UA8J3l3pyyaeagAcPIqsAWBlSojxjflg=";
+    sha256 = "sha256-wrdR0g8lND0V7BCKXDyk93Kf7eEIdg4Vb85MbhhK8AE=";
   };
 
   vendorHash = "sha256-IR/tgqh8rS4uN5jSOcopCutbHCKHSU9icUfRhOgu4t8=";
diff --git a/pkgs/development/misc/loc/default.nix b/pkgs/development/misc/loc/default.nix
index ce262d946a80..9f6286d14f4c 100644
--- a/pkgs/development/misc/loc/default.nix
+++ b/pkgs/development/misc/loc/default.nix
@@ -1,8 +1,6 @@
 { lib, fetchFromGitHub, rustPlatform }:
 
-with rustPlatform;
-
-buildRustPackage rec {
+rustPlatform.buildRustPackage rec {
   version = "0.4.1";
   pname = "loc";
 
diff --git a/pkgs/development/ocaml-modules/cohttp/lwt-jsoo.nix b/pkgs/development/ocaml-modules/cohttp/lwt-jsoo.nix
new file mode 100644
index 000000000000..611abb7751ba
--- /dev/null
+++ b/pkgs/development/ocaml-modules/cohttp/lwt-jsoo.nix
@@ -0,0 +1,31 @@
+{ lib, buildDunePackage
+, cohttp, cohttp-lwt, logs, lwt, js_of_ocaml, js_of_ocaml-ppx, js_of_ocaml-lwt
+, nodejs, lwt_ppx
+}:
+
+buildDunePackage {
+  pname = "cohttp-lwt-jsoo";
+  inherit (cohttp-lwt) version src;
+
+  duneVersion = "3";
+
+  propagatedBuildInputs = [
+    cohttp
+    cohttp-lwt
+    logs
+    lwt
+    js_of_ocaml
+    js_of_ocaml-ppx
+    js_of_ocaml-lwt
+  ];
+
+  doCheck = true;
+  checkInputs = [
+    nodejs
+    lwt_ppx
+  ];
+
+  meta = cohttp-lwt.meta // {
+    description = "CoHTTP implementation for the Js_of_ocaml JavaScript compiler";
+  };
+}
diff --git a/pkgs/development/ocaml-modules/cohttp/top.nix b/pkgs/development/ocaml-modules/cohttp/top.nix
new file mode 100644
index 000000000000..0a8f54871b1b
--- /dev/null
+++ b/pkgs/development/ocaml-modules/cohttp/top.nix
@@ -0,0 +1,16 @@
+{ lib, buildDunePackage, cohttp }:
+
+buildDunePackage {
+  pname = "cohttp-top";
+  inherit (cohttp) version src;
+
+  duneVersion = "3";
+
+  propagatedBuildInputs = [ cohttp ];
+
+  doCheck = true;
+
+  meta = cohttp.meta // {
+    description = "CoHTTP toplevel pretty printers for HTTP types";
+  };
+}
diff --git a/pkgs/development/ocaml-modules/lwt/camlp4.nix b/pkgs/development/ocaml-modules/lwt/camlp4.nix
index e48d7cfa185a..de8252c55549 100644
--- a/pkgs/development/ocaml-modules/lwt/camlp4.nix
+++ b/pkgs/development/ocaml-modules/lwt/camlp4.nix
@@ -11,10 +11,11 @@ buildDunePackage rec {
     sha256 = "1lv8z6ljfy47yvxmwf5jrvc5d3dc90r1n291x53j161sf22ddrk9";
   };
 
-  useDune2 = false;
+  duneVersion = "1";
 
   minimalOCamlVersion = "4.02";
 
+  nativeBuildInputs = [ camlp4 ];
   propagatedBuildInputs = [ camlp4 ];
 
   preBuild = "rm META.lwt_camlp4";
diff --git a/pkgs/development/ocaml-modules/lwt/default.nix b/pkgs/development/ocaml-modules/lwt/default.nix
index 8004cfcd4bb4..cf631fd08e41 100644
--- a/pkgs/development/ocaml-modules/lwt/default.nix
+++ b/pkgs/development/ocaml-modules/lwt/default.nix
@@ -1,5 +1,5 @@
 { lib, fetchFromGitHub, libev, buildDunePackage
-, cppo, dune-configurator, ocplib-endian
+, ocaml, cppo, dune-configurator, ocplib-endian
 }:
 
 buildDunePackage rec {
@@ -15,6 +15,11 @@ buildDunePackage rec {
     sha256 = "sha256-XstKs0tMwliCyXnP0Vzi5WC27HKJGnATUYtbbQmH1TE=";
   };
 
+  postPatch = lib.optionalString (lib.versionAtLeast ocaml.version "5.0") ''
+    substituteInPlace src/unix/dune \
+      --replace "libraries bigarray lwt" "libraries lwt"
+  '';
+
   nativeBuildInputs = [ cppo ];
   buildInputs = [ dune-configurator ];
   propagatedBuildInputs = [ libev ocplib-endian ];
diff --git a/pkgs/development/ocaml-modules/ocplib-endian/default.nix b/pkgs/development/ocaml-modules/ocplib-endian/default.nix
index 1e657fce8dd1..285e8de84b39 100644
--- a/pkgs/development/ocaml-modules/ocplib-endian/default.nix
+++ b/pkgs/development/ocaml-modules/ocplib-endian/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildDunePackage, fetchFromGitHub, cppo }:
+{ lib, buildDunePackage, fetchFromGitHub, ocaml, cppo }:
 
 buildDunePackage rec {
   version = "1.2";
@@ -11,6 +11,11 @@ buildDunePackage rec {
     sha256 = "sha256-THTlhOfXAPaqTt1qBkht+D67bw6M175QLvXoUMgjks4=";
   };
 
+  postPatch = lib.optionalString (lib.versionAtLeast ocaml.version "5.0") ''
+    substituteInPlace src/dune \
+      --replace "libraries ocplib_endian bigarray" "libraries ocplib_endian"
+  '';
+
   minimalOCamlVersion = "4.03";
 
   nativeBuildInputs = [ cppo ];
diff --git a/pkgs/development/ocaml-modules/tcpip/default.nix b/pkgs/development/ocaml-modules/tcpip/default.nix
index 90100c2d5b57..30710bfae265 100644
--- a/pkgs/development/ocaml-modules/tcpip/default.nix
+++ b/pkgs/development/ocaml-modules/tcpip/default.nix
@@ -63,6 +63,7 @@ buildDunePackage rec {
     mirage-clock-unix
     ipaddr-cstruct
   ];
+  __darwinAllowLocalNetworking = true;
 
   meta = with lib; {
     description = "OCaml TCP/IP networking stack, used in MirageOS";
diff --git a/pkgs/development/php-packages/composer/default.nix b/pkgs/development/php-packages/composer/default.nix
index 9b6779af04d6..e3a1037e4dd9 100644
--- a/pkgs/development/php-packages/composer/default.nix
+++ b/pkgs/development/php-packages/composer/default.nix
@@ -2,11 +2,11 @@
 
 mkDerivation rec {
   pname = "composer";
-  version = "2.5.4";
+  version = "2.5.5";
 
   src = fetchurl {
     url = "https://github.com/composer/composer/releases/download/${version}/composer.phar";
-    sha256 = "sha256-kc5sv5Rj6uhq6dXCHUL6pgGlGfP7srYjpV7iRngHm9M=";
+    sha256 = "sha256-VmptHPS+HMOsiC0qKhOBf/rlTmD1qnyRN0NIEKWAn/w=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/development/php-packages/php-cs-fixer/default.nix b/pkgs/development/php-packages/php-cs-fixer/default.nix
index c34d4b175cef..c3a8d6cca759 100644
--- a/pkgs/development/php-packages/php-cs-fixer/default.nix
+++ b/pkgs/development/php-packages/php-cs-fixer/default.nix
@@ -2,14 +2,14 @@
 
 let
   pname = "php-cs-fixer";
-  version = "3.13.1";
+  version = "3.16.0";
 in
 mkDerivation {
   inherit pname version;
 
   src = fetchurl {
     url = "https://github.com/FriendsOfPHP/PHP-CS-Fixer/releases/download/v${version}/php-cs-fixer.phar";
-    sha256 = "4bQrCjuaWN4Dbs1tkk4m1WxSb510ue7G59HA+gQ52yk=";
+    sha256 = "sha256-B4VzfsSwcffR/t4eREMLH9jRWCTumYel6GM4rpumVBY=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/development/php-packages/psalm/default.nix b/pkgs/development/php-packages/psalm/default.nix
index b6a990559531..6af4cc699e8c 100644
--- a/pkgs/development/php-packages/psalm/default.nix
+++ b/pkgs/development/php-packages/psalm/default.nix
@@ -2,14 +2,14 @@
 
 let
   pname = "psalm";
-  version = "5.4.0";
+  version = "5.9.0";
 in
 mkDerivation {
   inherit pname version;
 
   src = fetchurl {
     url = "https://github.com/vimeo/psalm/releases/download/${version}/psalm.phar";
-    sha256 = "sha256-d5jf68s+LppUDwERQaqr+ry8L+Zmob8VwetYkQ+vIUg=";
+    sha256 = "sha256-56vLT/t+3f5ZyH1pFmgy4vtSMQcDYLQZIF/iIkwd2vM=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/development/python-modules/brother-ql/default.nix b/pkgs/development/python-modules/brother-ql/default.nix
index c7b727c73a5f..f6cfe5868209 100644
--- a/pkgs/development/python-modules/brother-ql/default.nix
+++ b/pkgs/development/python-modules/brother-ql/default.nix
@@ -33,5 +33,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/pklaus/brother_ql";
     license = licenses.gpl3;
     maintainers = with maintainers; [ grahamc ];
+    mainProgram = "brother_ql";
   };
 }
diff --git a/pkgs/development/python-modules/django-dynamic-preferences/default.nix b/pkgs/development/python-modules/django-dynamic-preferences/default.nix
index fb897ef1dc46..bdb6c1d8229c 100644
--- a/pkgs/development/python-modules/django-dynamic-preferences/default.nix
+++ b/pkgs/development/python-modules/django-dynamic-preferences/default.nix
@@ -1,22 +1,49 @@
-{ lib, buildPythonPackage, fetchPypi
-, django, persisting-theory, six
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+
+# dependencies
+, django
+, persisting-theory
+, six
+
+# tests
+, djangorestframework
+, pytest-django
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "django-dynamic-preferences";
-  version = "1.14.0";
+  version = "1.15.0";
+  format = "setuptools";
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-wAq8uNUkBnOQpmUYz80yaDuHrTzGINWRNkn8dwe4CDM=";
+  src = fetchFromGitHub {
+    owner = "agateblue";
+    repo = "django-dynamic-preferences";
+    rev = "refs/tags/${version}";
+    hash = "sha256-S0PAlSrMOQ68mX548pZzARfau/lytXWC4S5uVO1rUmo=";
   };
 
-  propagatedBuildInputs = [ six django persisting-theory ];
+  buildInputs = [
+    django
+  ];
 
-  # django.core.exceptions.ImproperlyConfigured: Requested setting DYNAMIC_PREFERENCES, but settings are not configured. You must either define the environment variable DJANGO_SETTINGS_MODULE or call settings.configure() before accessing settings
-  doCheck = false;
+  propagatedBuildInputs = [
+    six
+    persisting-theory
+  ];
+
+  nativeCheckInputs = [
+    djangorestframework
+    pytestCheckHook
+    pytest-django
+  ];
+
+  env.DJANGO_SETTINGS = "tests.settings";
 
   meta = with lib; {
+    changelog = "https://github.com/agateblue/django-dynamic-preferences/blob/${version}/HISTORY.rst";
     homepage = "https://github.com/EliotBerriot/django-dynamic-preferences";
     description = "Dynamic global and instance settings for your django project";
     license = licenses.bsd3;
diff --git a/pkgs/development/python-modules/grpcio-status/default.nix b/pkgs/development/python-modules/grpcio-status/default.nix
index c4748193303e..e6c4ec584e34 100644
--- a/pkgs/development/python-modules/grpcio-status/default.nix
+++ b/pkgs/development/python-modules/grpcio-status/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "grpcio-status";
-  version = "1.53.0";
+  version = "1.54.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-WkaCDcfZS6xIquXdl8lMreoJ2AoFVTrKdKkqKVQDBCA=";
+    hash = "sha256-tQMF1SwN9haUk8yl8uObm013Oz8w1Kemtt18GMuJAHw=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/grpcio-tools/default.nix b/pkgs/development/python-modules/grpcio-tools/default.nix
index 0b6418a4797b..938fd43619c4 100644
--- a/pkgs/development/python-modules/grpcio-tools/default.nix
+++ b/pkgs/development/python-modules/grpcio-tools/default.nix
@@ -2,12 +2,12 @@
 
 buildPythonPackage rec {
   pname = "grpcio-tools";
-  version = "1.53.0";
+  version = "1.54.0";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-kl7/8tY8oyZvk8kk/+ul1JbxaozL4SX6DRis9HzF+og=";
+    hash = "sha256-33msv1mZcBjhMXE7cWov3bVVbhhA6fud5MpzvyBZWQ4=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/jax/default.nix b/pkgs/development/python-modules/jax/default.nix
index 26f89695ee16..12a69358b45e 100644
--- a/pkgs/development/python-modules/jax/default.nix
+++ b/pkgs/development/python-modules/jax/default.nix
@@ -5,6 +5,7 @@
 , etils
 , fetchFromGitHub
 , jaxlib
+, jaxlib-bin
 , lapack
 , matplotlib
 , numpy
@@ -13,15 +14,20 @@
 , pytest-xdist
 , pythonOlder
 , scipy
+, stdenv
 , typing-extensions
 }:
 
 let
   usingMKL = blas.implementation == "mkl" || lapack.implementation == "mkl";
+  # jaxlib is broken on aarch64-* as of 2023-03-05, but the binary wheels work
+  # fine. jaxlib is only used in the checkPhase, so switching backends does not
+  # impact package behavior. Get rid of this once jaxlib is fixed on aarch64-*.
+  jaxlib' = if jaxlib.meta.broken then jaxlib-bin else jaxlib;
 in
 buildPythonPackage rec {
   pname = "jax";
-  version = "0.4.1";
+  version = "0.4.5";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -29,14 +35,14 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "google";
     repo = pname;
-    rev = "refs/tags/jaxlib-v${version}";
-    hash = "sha256-ajLI0iD0YZRK3/uKSbhlIZGc98MdW174vA34vhoy7Iw=";
+    # google/jax contains tags for jax and jaxlib. Only use jax tags!
+    rev = "refs/tags/${pname}-v${version}";
+    hash = "sha256-UJzX8zP3qaEUIV5hPJhiGiLJO7k8p962MHWxIHDY1ZA=";
   };
 
   # jaxlib is _not_ included in propagatedBuildInputs because there are
   # different versions of jaxlib depending on the desired target hardware. The
-  # JAX project ships separate wheels for CPU, GPU, and TPU. Currently only the
-  # CPU wheel is packaged.
+  # JAX project ships separate wheels for CPU, GPU, and TPU.
   propagatedBuildInputs = [
     absl-py
     etils
@@ -47,7 +53,7 @@ buildPythonPackage rec {
   ] ++ etils.optional-dependencies.epath;
 
   nativeCheckInputs = [
-    jaxlib
+    jaxlib'
     matplotlib
     pytestCheckHook
     pytest-xdist
@@ -83,6 +89,11 @@ buildPythonPackage rec {
     "test_custom_linear_solve_cholesky"
     "test_custom_root_with_aux"
     "testEigvalsGrad_shape"
+  ] ++ lib.optionals (stdenv.isAarch64 && stdenv.isDarwin) [
+    # See https://github.com/google/jax/issues/14793.
+    "test_for_loop_fixpoint_correctly_identifies_loop_varying_residuals_unrolled_for_loop"
+    "testQdwhWithRandomMatrix3"
+    "testScanGrad_jit_scan"
   ];
 
   # See https://github.com/google/jax/issues/11722. This is a temporary fix in
diff --git a/pkgs/development/python-modules/jaxlib/bin.nix b/pkgs/development/python-modules/jaxlib/bin.nix
index 8574ed207754..c7e84e4c11a2 100644
--- a/pkgs/development/python-modules/jaxlib/bin.nix
+++ b/pkgs/development/python-modules/jaxlib/bin.nix
@@ -39,7 +39,7 @@ assert cudaSupport -> lib.versionAtLeast cudatoolkit.version "11.1";
 assert cudaSupport -> lib.versionAtLeast cudnn.version "8.2";
 
 let
-  version = "0.3.22";
+  version = "0.4.4";
 
   pythonVersion = python.pythonVersion;
 
@@ -50,21 +50,21 @@ let
   cpuSrcs = {
     "x86_64-linux" = fetchurl {
       url = "https://storage.googleapis.com/jax-releases/nocuda/jaxlib-${version}-cp310-cp310-manylinux2014_x86_64.whl";
-      hash = "sha256-w2wo0jk+1BdEkNwfSZRQbebdI4Ac8Kgn0MB0cIMcWU4=";
+      hash = "sha256-4VT909AB+ti5HzQvsaZWNY6MS/GItlVEFH9qeZnUuKQ=";
     };
     "aarch64-darwin" = fetchurl {
       url = "https://storage.googleapis.com/jax-releases/mac/jaxlib-${version}-cp310-cp310-macosx_11_0_arm64.whl";
-      hash = "sha256-7Ir55ZhBkccqfoa56WVBF8QwFAC2ws4KFHDkfVw6zm0=";
+      hash = "sha256-wuOmoCeTldslSa0MommQeTe+RYKhUMam1ZXrgSov+8U=";
     };
     "x86_64-darwin" = fetchurl {
       url = "https://storage.googleapis.com/jax-releases/mac/jaxlib-${version}-cp310-cp310-macosx_10_14_x86_64.whl";
-      hash = "sha256-bOoQI+T+YsTUNA+cDu6wwYTcq9fyyzCpK9qrdCrNVoA=";
+      hash = "sha256-arfiTw8yafJwjRwJhKby2O7y3+4ksh3PjaKW9JgJ1ok=";
     };
   };
 
   gpuSrc = fetchurl {
     url = "https://storage.googleapis.com/jax-releases/cuda11/jaxlib-${version}+cuda11.cudnn82-cp310-cp310-manylinux2014_x86_64.whl";
-    hash = "sha256-rabU62p4fF7Tu/6t8LNYZdf6YO06jGry/JtyFZeamCs=";
+    hash = "sha256-bJ62DdzuPSV311ZI2R/LJQ3fOkDibtz2+8wDKw31FLk=";
   };
 in
 buildPythonPackage rec {
@@ -77,7 +77,13 @@ buildPythonPackage rec {
   # python version.
   disabled = !(pythonVersion == "3.10");
 
-  src = if !cudaSupport then cpuSrcs."${stdenv.hostPlatform.system}" else gpuSrc;
+  # See https://discourse.nixos.org/t/ofborg-does-not-respect-meta-platforms/27019/6.
+  src =
+    if !cudaSupport then
+      (
+        cpuSrcs."${stdenv.hostPlatform.system}"
+          or (throw "jaxlib-bin is not supported on ${stdenv.hostPlatform.system}")
+      ) else gpuSrc;
 
   # Prebuilt wheels are dynamically linked against things that nix can't find.
   # Run `autoPatchelfHook` to automagically fix them.
diff --git a/pkgs/development/python-modules/jaxlib/default.nix b/pkgs/development/python-modules/jaxlib/default.nix
index ae919f66364a..cc4a7fe8b16f 100644
--- a/pkgs/development/python-modules/jaxlib/default.nix
+++ b/pkgs/development/python-modules/jaxlib/default.nix
@@ -52,7 +52,7 @@ let
   inherit (cudaPackages) backendStdenv cudatoolkit cudaFlags cudnn nccl;
 
   pname = "jaxlib";
-  version = "0.3.22";
+  version = "0.4.4";
 
   meta = with lib; {
     description = "JAX is Autograd and XLA, brought together for high-performance machine learning research.";
@@ -137,8 +137,9 @@ let
     src = fetchFromGitHub {
       owner = "google";
       repo = "jax";
-      rev = "${pname}-v${version}";
-      hash = "sha256-bnczJ8ma/UMKhA5MUQ6H4az+Tj+By14ZTG6lQQwptQs=";
+      # google/jax contains tags for jax and jaxlib. Only use jaxlib tags!
+      rev = "refs/tags/${pname}-v${version}";
+      hash = "sha256-DP68UwS9bg243iWU4MLHN0pwl8LaOcW3Sle1ZjsLOHo=";
     };
 
     nativeBuildInputs = [
@@ -242,9 +243,9 @@ let
 
       sha256 =
         if cudaSupport then
-          "sha256-4yu4y4SwSQoeaOz9yojhvCRGSC6jp61ycVDIKyIK/l8="
+          "sha256-cgsiloW77p4+TKRrYequZ/UwKwfO2jsHKtZ+aA30H7E="
         else
-          "sha256-CyRfPfJc600M7VzR3/SQX/EAyeaXRJwDQWot5h2XnFU=";
+          "sha256-D7WYG3YUaWq+4APYx8WpA191VVtoHG0fth3uEHXOeos=";
     };
 
     buildAttrs = {
diff --git a/pkgs/development/python-modules/onvif-zeep-async/default.nix b/pkgs/development/python-modules/onvif-zeep-async/default.nix
index be5605c29266..b8d0b654dc0c 100644
--- a/pkgs/development/python-modules/onvif-zeep-async/default.nix
+++ b/pkgs/development/python-modules/onvif-zeep-async/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "onvif-zeep-async";
-  version = "1.2.11";
+  version = "1.3.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-SCK4PITp9XRlHeon10Sh5GvhMWNPLu4Y4oFLRC8JHVo=";
+    hash = "sha256-Gd3OfFfJE//uDiaU6HTlURCqoGOG4jvuMN1TlDy7pZU=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pydeps/default.nix b/pkgs/development/python-modules/pydeps/default.nix
index 2449ecafb915..579f7600e868 100644
--- a/pkgs/development/python-modules/pydeps/default.nix
+++ b/pkgs/development/python-modules/pydeps/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "pydeps";
-  version = "1.11.2";
+  version = "1.12.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "thebjorn";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-6eiSzuxspWutEKL1pKBeZ0/ZQjS07BpTwgd8dyrePcM=";
+    hash = "sha256-lwQaU7MwFuk+VBCKl4zBNWRFo88/uW2DxXjiZNyuHAg=";
   };
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/tplink-omada-client/default.nix b/pkgs/development/python-modules/tplink-omada-client/default.nix
index 1635195b3306..33fa741bd025 100644
--- a/pkgs/development/python-modules/tplink-omada-client/default.nix
+++ b/pkgs/development/python-modules/tplink-omada-client/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "tplink-omada-client";
-  version = "1.2.3";
+  version = "1.2.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "tplink_omada_client";
     inherit version;
-    hash = "sha256-6c4xWa4XGtnEb3n7oL95oA6bqwaRrHCOn6WCi/xg3Sg=";
+    hash = "sha256-4kvFlk+4GWFRFVIAirg0wKk5se8g+kvmxQ54RiluuoU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/analysis/codeql/default.nix b/pkgs/development/tools/analysis/codeql/default.nix
index 641bcfdf08ba..ac9f0727edc3 100644
--- a/pkgs/development/tools/analysis/codeql/default.nix
+++ b/pkgs/development/tools/analysis/codeql/default.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "codeql";
-  version = "2.12.5";
+  version = "2.12.6";
 
   dontConfigure = true;
   dontBuild = true;
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
 
   src = fetchzip {
     url = "https://github.com/github/codeql-cli-binaries/releases/download/v${version}/codeql.zip";
-    sha256 = "sha256-PjebVOzd0Vy3mX4q6Zs+AbxaKTpjE5QJzhciZfLcyUc=";
+    sha256 = "sha256-0AOrjM7wUMgyKLmeoAPMY7O/YWXmqb5OBJGlGV5JFR0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/bazel-gazelle/default.nix b/pkgs/development/tools/bazel-gazelle/default.nix
index 70e76ca389c0..51fc1410c659 100644
--- a/pkgs/development/tools/bazel-gazelle/default.nix
+++ b/pkgs/development/tools/bazel-gazelle/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "bazel-gazelle";
-  version = "0.28.0";
+  version = "0.30.0";
 
   src = fetchFromGitHub {
     owner = "bazelbuild";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-axpRS8SZwChmLYSaarxZkwvrRk72XRHW7v4d11EtJ3k=";
+    sha256 = "sha256-95nA6IEuAIh/6J6G2jADz3UKpQj5wybQ1HpaHSI+QRo=";
   };
 
-  vendorSha256 = null;
+  vendorHash = null;
 
   doCheck = false;
 
diff --git a/pkgs/development/tools/build-managers/shards/default.nix b/pkgs/development/tools/build-managers/shards/default.nix
index 5fc102546a22..a7ba17b24b11 100644
--- a/pkgs/development/tools/build-managers/shards/default.nix
+++ b/pkgs/development/tools/build-managers/shards/default.nix
@@ -37,8 +37,8 @@ let
 in
 rec {
   shards_0_17 = generic {
-    version = "0.17.2";
-    hash = "sha256-2HpoMgyi8jnWYiBHscECYiaRu2g0mAH+dCY1t5m/l1s=";
+    version = "0.17.3";
+    hash = "sha256-vgcMB/vp685YwYI9XtJ5cTEjdnYaZY9aOMUnJBJaQoU=";
   };
 
   shards = shards_0_17;
diff --git a/pkgs/development/tools/chit/default.nix b/pkgs/development/tools/chit/default.nix
index dd37efb506d6..41839f9e2625 100644
--- a/pkgs/development/tools/chit/default.nix
+++ b/pkgs/development/tools/chit/default.nix
@@ -2,9 +2,7 @@
 , darwin
 }:
 
-with rustPlatform;
-
-buildRustPackage rec {
+rustPlatform.buildRustPackage rec {
   pname = "chit";
   version = "0.1.15";
 
diff --git a/pkgs/development/tools/clog-cli/default.nix b/pkgs/development/tools/clog-cli/default.nix
index feedbd2ab261..077eac32aa20 100644
--- a/pkgs/development/tools/clog-cli/default.nix
+++ b/pkgs/development/tools/clog-cli/default.nix
@@ -1,8 +1,6 @@
 { fetchFromGitHub, rustPlatform, lib }:
 
-with rustPlatform;
-
-buildRustPackage rec {
+rustPlatform.buildRustPackage rec {
   pname = "clog-cli";
   version = "0.9.3";
 
diff --git a/pkgs/development/tools/ctlptl/default.nix b/pkgs/development/tools/ctlptl/default.nix
index 182ad8e484f7..9ce957ef155e 100644
--- a/pkgs/development/tools/ctlptl/default.nix
+++ b/pkgs/development/tools/ctlptl/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "ctlptl";
-  version = "0.8.17";
+  version = "0.8.18";
 
   src = fetchFromGitHub {
     owner = "tilt-dev";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-vX2U6bkl8ms31zIjXOy/3vw/q9ul74x9TEpsLu5o6XI=";
+    hash = "sha256-J1mq25EcoSvZNvfkBWQjRG0eXWFroNqQ8ylEohoninI=";
   };
 
-  vendorHash = "sha256-zlMCfa94gYLWDYC9YOzhLYs5khzmDk8a/2MljpSoFng=";
+  vendorHash = "sha256-QGceY4xUdjPyO0XGpE0mvP5Q5nQKc/tkBp0Iseuw8Ro=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/development/tools/datree/default.nix b/pkgs/development/tools/datree/default.nix
index dadf9a663a71..6f2fa356e5a5 100644
--- a/pkgs/development/tools/datree/default.nix
+++ b/pkgs/development/tools/datree/default.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "datree";
-  version = "1.8.47";
+  version = "1.8.65";
 
   src = fetchFromGitHub {
     owner = "datreeio";
     repo = "datree";
     rev = "refs/tags/${version}";
-    hash = "sha256-pL8fagVEVrAoIwbKQy1UpHOvFxYaMiw4cmmRgIamyic=";
+    hash = "sha256-UL8VVKQBRwJz7kw9/0IHaFvsh3h94BrzDoqDFqOzjXU=";
   };
 
   vendorHash = "sha256-MrVIpr2iwddW3yUeBuDfeg+Xo9Iarr/fp4Rc4WGYGeU=";
diff --git a/pkgs/development/tools/dyff/default.nix b/pkgs/development/tools/dyff/default.nix
index 0c4bba13b2c4..2d0ca43ff4ca 100644
--- a/pkgs/development/tools/dyff/default.nix
+++ b/pkgs/development/tools/dyff/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "dyff";
-  version = "1.5.6";
+  version = "1.5.7";
 
   src = fetchFromGitHub {
     owner = "homeport";
     repo = "dyff";
     rev = "v${version}";
-    sha256 = "sha256-98A8yI0YnGeSz1ie1zQLXPtBAr6JyxsLAf/uNwRAb3M=";
+    sha256 = "sha256-iavJgJnmUFNjdCwVifNP1K5gQ94Rth4wbZ99VXFgNpA=";
   };
 
-  vendorSha256 = "sha256-iJTIOZUNMKW3wpFhLiNRJW1SM8rThG0tBMpCWdvO/YA=";
+  vendorHash = "sha256-48IpEBA5EaGZBhrRqAwGcf8xQuP/IlzWPFhh+7bFlPc=";
 
   subPackages = [
     "cmd/dyff"
diff --git a/pkgs/development/tools/esbuild/default.nix b/pkgs/development/tools/esbuild/default.nix
index a9de781ecda7..6edf64e695fa 100644
--- a/pkgs/development/tools/esbuild/default.nix
+++ b/pkgs/development/tools/esbuild/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "esbuild";
-  version = "0.17.16";
+  version = "0.17.17";
 
   src = fetchFromGitHub {
     owner = "evanw";
     repo = "esbuild";
     rev = "v${version}";
-    hash = "sha256-GwYuxEGFS8qcu7C7mmndcz2cUVoYp0+oEMKhSItf0DU=";
+    hash = "sha256-UPY/edmriacHqQ030nvYsuRj6OwdazFbsCs1oHAahaU=";
   };
 
   vendorHash = "sha256-+BfxCyg0KkDQpHt/wycy/8CTG6YBA/VJvJFhhzUnSiQ=";
diff --git a/pkgs/development/tools/fx/default.nix b/pkgs/development/tools/fx/default.nix
index 10f2e300b0d9..9e478867445e 100644
--- a/pkgs/development/tools/fx/default.nix
+++ b/pkgs/development/tools/fx/default.nix
@@ -2,21 +2,22 @@
 
 buildGoModule rec {
   pname = "fx";
-  version = "24.0.0";
+  version = "24.1.0";
 
   src = fetchFromGitHub {
     owner = "antonmedv";
     repo = pname;
     rev = version;
-    sha256 = "sha256-Sg+mluDOGpkEUl+3BoItuPnMqs8F6o+D5xIqF0w0EIU=";
+    hash = "sha256-X6wuCAiQa1coHMz96aAXKGZFnius1vHJpk+EhbXqoMA=";
   };
 
-  vendorSha256 = "sha256-4hx1AZQQ4xHBTzBK0OmrTUGMK4Rfu36cmopVV4SOjCQ=";
+  vendorHash = "sha256-J19MhLvjxcxvcub888UFKI0iIf7OG3dmP5v40ElHCU4=";
 
   meta = with lib; {
     description = "Terminal JSON viewer";
     homepage = "https://github.com/antonmedv/fx";
+    changelog = "https://github.com/antonmedv/fx/releases/tag/${src.rev}";
     license = licenses.mit;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ figsoda ];
   };
 }
diff --git a/pkgs/development/tools/go-minimock/default.nix b/pkgs/development/tools/go-minimock/default.nix
index 61053d2b1da6..344e8aa47965 100644
--- a/pkgs/development/tools/go-minimock/default.nix
+++ b/pkgs/development/tools/go-minimock/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "go-minimock";
-  version = "3.1.2";
+  version = "3.1.3";
 
   src = fetchFromGitHub {
     owner = "gojuno";
     repo = "minimock";
     rev = "v${version}";
-    sha256 = "sha256-r1P9uLIxdDDI+slWO/K3nKf5gmsCEVfephrR+ZCXhBE=";
+    sha256 = "sha256-6n5FOHTfsLYqnhlDO3etMnrypeOElmwdvoFQb3aSBts=";
   };
 
   ldflags = [
diff --git a/pkgs/development/tools/go-motion/default.nix b/pkgs/development/tools/go-motion/default.nix
index d7e686235af4..7505522d46fd 100644
--- a/pkgs/development/tools/go-motion/default.nix
+++ b/pkgs/development/tools/go-motion/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "motion";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "fatih";
     repo = "motion";
     rev = "v${version}";
-    sha256 = "sha256-bD6Mm9/LOzguoK/xMpVEeT7G8j1shCsMv14wFostlW4=";
+    sha256 = "sha256-7vkMhjO4JUAf0sUcKiMjqJ5GzLb//QoHd7Cagerx4/s=";
   };
 
-  vendorSha256 = null;
+  vendorHash = null;
 
   ldflags = [ "-s" "-w" ];
 
diff --git a/pkgs/development/tools/language-servers/millet/Cargo.lock b/pkgs/development/tools/language-servers/millet/Cargo.lock
index ee19149bcf08..3e9cbaece14e 100644
--- a/pkgs/development/tools/language-servers/millet/Cargo.lock
+++ b/pkgs/development/tools/language-servers/millet/Cargo.lock
@@ -28,7 +28,7 @@ dependencies = [
 
 [[package]]
 name = "analysis"
-version = "0.9.0"
+version = "0.9.3"
 dependencies = [
  "config",
  "diagnostic",
@@ -107,7 +107,7 @@ checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
 
 [[package]]
 name = "chain-map"
-version = "0.9.0"
+version = "0.9.3"
 dependencies = [
  "fast-hash",
  "str-util",
@@ -116,11 +116,11 @@ dependencies = [
 [[package]]
 name = "char-name"
 version = "0.1.0"
-source = "git+https://github.com/azdavis/language-util.git#cc57f0aef443b16a8cd5a7506d11e182ab091e8d"
+source = "git+https://github.com/azdavis/language-util.git#48188e47909b733e5532d3dd70bc5dfa88394f9b"
 
 [[package]]
 name = "cm-syntax"
-version = "0.9.0"
+version = "0.9.3"
 dependencies = [
  "lex-util",
  "paths",
@@ -132,14 +132,14 @@ dependencies = [
 [[package]]
 name = "code-h2-md-map"
 version = "0.1.0"
-source = "git+https://github.com/azdavis/language-util.git#cc57f0aef443b16a8cd5a7506d11e182ab091e8d"
+source = "git+https://github.com/azdavis/language-util.git#48188e47909b733e5532d3dd70bc5dfa88394f9b"
 dependencies = [
  "fast-hash",
 ]
 
 [[package]]
 name = "config"
-version = "0.9.0"
+version = "0.9.3"
 dependencies = [
  "fast-hash",
  "serde",
@@ -206,7 +206,7 @@ dependencies = [
 [[package]]
 name = "diagnostic"
 version = "0.1.0"
-source = "git+https://github.com/azdavis/language-util.git#cc57f0aef443b16a8cd5a7506d11e182ab091e8d"
+source = "git+https://github.com/azdavis/language-util.git#48188e47909b733e5532d3dd70bc5dfa88394f9b"
 
 [[package]]
 name = "diff"
@@ -223,7 +223,7 @@ checksum = "9bda8e21c04aca2ae33ffc2fd8c23134f3cac46db123ba97bd9d3f3b8a4a85e1"
 [[package]]
 name = "elapsed"
 version = "0.1.0"
-source = "git+https://github.com/azdavis/language-util.git#cc57f0aef443b16a8cd5a7506d11e182ab091e8d"
+source = "git+https://github.com/azdavis/language-util.git#48188e47909b733e5532d3dd70bc5dfa88394f9b"
 dependencies = [
  "log",
 ]
@@ -271,7 +271,7 @@ dependencies = [
 [[package]]
 name = "event-parse"
 version = "0.1.0"
-source = "git+https://github.com/azdavis/language-util.git#cc57f0aef443b16a8cd5a7506d11e182ab091e8d"
+source = "git+https://github.com/azdavis/language-util.git#48188e47909b733e5532d3dd70bc5dfa88394f9b"
 dependencies = [
  "drop_bomb",
  "rowan",
@@ -281,7 +281,7 @@ dependencies = [
 [[package]]
 name = "fast-hash"
 version = "0.1.0"
-source = "git+https://github.com/azdavis/language-util.git#cc57f0aef443b16a8cd5a7506d11e182ab091e8d"
+source = "git+https://github.com/azdavis/language-util.git#48188e47909b733e5532d3dd70bc5dfa88394f9b"
 dependencies = [
  "rustc-hash",
 ]
@@ -299,7 +299,7 @@ dependencies = [
 [[package]]
 name = "fmt-util"
 version = "0.1.0"
-source = "git+https://github.com/azdavis/language-util.git#cc57f0aef443b16a8cd5a7506d11e182ab091e8d"
+source = "git+https://github.com/azdavis/language-util.git#48188e47909b733e5532d3dd70bc5dfa88394f9b"
 
 [[package]]
 name = "form_urlencoded"
@@ -352,7 +352,7 @@ checksum = "9a3a5bfb195931eeb336b2a7b4d761daec841b97f947d34394601737a7bba5e4"
 [[package]]
 name = "identifier-case"
 version = "0.1.0"
-source = "git+https://github.com/azdavis/language-util.git#cc57f0aef443b16a8cd5a7506d11e182ab091e8d"
+source = "git+https://github.com/azdavis/language-util.git#48188e47909b733e5532d3dd70bc5dfa88394f9b"
 
 [[package]]
 name = "idna"
@@ -367,7 +367,7 @@ dependencies = [
 [[package]]
 name = "idx"
 version = "0.1.0"
-source = "git+https://github.com/azdavis/language-util.git#cc57f0aef443b16a8cd5a7506d11e182ab091e8d"
+source = "git+https://github.com/azdavis/language-util.git#48188e47909b733e5532d3dd70bc5dfa88394f9b"
 
 [[package]]
 name = "indexmap"
@@ -381,7 +381,7 @@ dependencies = [
 
 [[package]]
 name = "input"
-version = "0.9.0"
+version = "0.9.3"
 dependencies = [
  "cm-syntax",
  "config",
@@ -440,7 +440,7 @@ checksum = "1dabfe0d01e15fde0eba33b9de62475c59e681a47ce4ffe0534af2577a3f8524"
 
 [[package]]
 name = "lang-srv"
-version = "0.9.0"
+version = "0.9.3"
 dependencies = [
  "analysis",
  "anyhow",
@@ -468,7 +468,7 @@ checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
 
 [[package]]
 name = "lex-util"
-version = "0.9.0"
+version = "0.9.3"
 
 [[package]]
 name = "libc"
@@ -533,7 +533,7 @@ dependencies = [
 
 [[package]]
 name = "millet-cli"
-version = "0.9.0"
+version = "0.9.3"
 dependencies = [
  "analysis",
  "config",
@@ -547,7 +547,7 @@ dependencies = [
 
 [[package]]
 name = "millet-ls"
-version = "0.9.0"
+version = "0.9.3"
 dependencies = [
  "anyhow",
  "env_logger",
@@ -567,7 +567,7 @@ dependencies = [
 
 [[package]]
 name = "mlb-hir"
-version = "0.9.0"
+version = "0.9.3"
 dependencies = [
  "fast-hash",
  "paths",
@@ -578,20 +578,19 @@ dependencies = [
 
 [[package]]
 name = "mlb-statics"
-version = "0.9.0"
+version = "0.9.3"
 dependencies = [
  "config",
  "diagnostic",
  "fast-hash",
  "mlb-hir",
- "once_cell",
  "paths",
  "sml-comment",
  "sml-file-syntax",
  "sml-fixity",
  "sml-hir",
+ "sml-hir-lower",
  "sml-libs",
- "sml-lower",
  "sml-namespace",
  "sml-statics",
  "sml-statics-types",
@@ -603,7 +602,7 @@ dependencies = [
 
 [[package]]
 name = "mlb-syntax"
-version = "0.9.0"
+version = "0.9.3"
 dependencies = [
  "lex-util",
  "paths",
@@ -669,7 +668,7 @@ dependencies = [
 
 [[package]]
 name = "panic-hook"
-version = "0.9.0"
+version = "0.9.3"
 dependencies = [
  "better-panic",
 ]
@@ -677,7 +676,7 @@ dependencies = [
 [[package]]
 name = "paths"
 version = "0.1.0"
-source = "git+https://github.com/azdavis/language-util.git#cc57f0aef443b16a8cd5a7506d11e182ab091e8d"
+source = "git+https://github.com/azdavis/language-util.git#48188e47909b733e5532d3dd70bc5dfa88394f9b"
 dependencies = [
  "fast-hash",
  "glob",
@@ -688,7 +687,7 @@ dependencies = [
 [[package]]
 name = "pattern-match"
 version = "0.1.0"
-source = "git+https://github.com/azdavis/language-util.git#cc57f0aef443b16a8cd5a7506d11e182ab091e8d"
+source = "git+https://github.com/azdavis/language-util.git#48188e47909b733e5532d3dd70bc5dfa88394f9b"
 dependencies = [
  "fast-hash",
 ]
@@ -826,7 +825,7 @@ checksum = "291a097c63d8497e00160b166a967a4a79c64f3facdd01cbd7502231688d77df"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.14",
+ "syn 2.0.15",
 ]
 
 [[package]]
@@ -848,7 +847,7 @@ checksum = "bcec881020c684085e55a25f7fd888954d56609ef363479dc5a1305eb0d40cab"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.14",
+ "syn 2.0.15",
 ]
 
 [[package]]
@@ -862,7 +861,7 @@ dependencies = [
 
 [[package]]
 name = "slash-var-path"
-version = "0.9.0"
+version = "0.9.3"
 dependencies = [
  "fast-hash",
  "str-util",
@@ -870,20 +869,29 @@ dependencies = [
 
 [[package]]
 name = "sml-comment"
-version = "0.9.0"
+version = "0.9.3"
 dependencies = [
  "sml-syntax",
 ]
 
+[[package]]
+name = "sml-dynamics"
+version = "0.9.3"
+dependencies = [
+ "fast-hash",
+ "sml-mir",
+ "uniq",
+]
+
 [[package]]
 name = "sml-file-syntax"
-version = "0.9.0"
+version = "0.9.3"
 dependencies = [
  "config",
  "elapsed",
  "sml-fixity",
+ "sml-hir-lower",
  "sml-lex",
- "sml-lower",
  "sml-parse",
  "sml-ty-var-scope",
  "text-pos",
@@ -891,7 +899,7 @@ dependencies = [
 
 [[package]]
 name = "sml-fixity"
-version = "0.9.0"
+version = "0.9.3"
 dependencies = [
  "fast-hash",
  "once_cell",
@@ -900,17 +908,39 @@ dependencies = [
 
 [[package]]
 name = "sml-hir"
-version = "0.9.0"
+version = "0.9.3"
 dependencies = [
  "la-arena",
- "num-bigint",
+ "sml-lab",
  "sml-path",
+ "sml-scon",
+ "str-util",
+]
+
+[[package]]
+name = "sml-hir-lower"
+version = "0.9.3"
+dependencies = [
+ "config",
+ "diagnostic",
+ "fast-hash",
+ "lex-util",
+ "sml-hir",
+ "sml-path",
+ "sml-syntax",
+ "str-util",
+]
+
+[[package]]
+name = "sml-lab"
+version = "0.9.3"
+dependencies = [
  "str-util",
 ]
 
 [[package]]
 name = "sml-lex"
-version = "0.9.0"
+version = "0.9.3"
 dependencies = [
  "diagnostic",
  "lex-util",
@@ -923,23 +953,17 @@ version = "0.1.0"
 source = "git+https://github.com/azdavis/sml-libs.git#360d865bfe1e8afc4f8e483e0ac8f53da0593041"
 
 [[package]]
-name = "sml-lower"
-version = "0.9.0"
+name = "sml-mir"
+version = "0.9.3"
 dependencies = [
- "config",
- "diagnostic",
- "fast-hash",
- "lex-util",
- "num-traits",
- "sml-hir",
- "sml-path",
- "sml-syntax",
- "str-util",
+ "sml-lab",
+ "sml-scon",
+ "uniq",
 ]
 
 [[package]]
 name = "sml-naive-fmt"
-version = "0.9.0"
+version = "0.9.3"
 dependencies = [
  "fast-hash",
  "sml-comment",
@@ -948,11 +972,11 @@ dependencies = [
 
 [[package]]
 name = "sml-namespace"
-version = "0.9.0"
+version = "0.9.3"
 
 [[package]]
 name = "sml-parse"
-version = "0.9.0"
+version = "0.9.3"
 dependencies = [
  "diagnostic",
  "event-parse",
@@ -964,14 +988,23 @@ dependencies = [
 
 [[package]]
 name = "sml-path"
-version = "0.9.0"
+version = "0.9.3"
 dependencies = [
  "str-util",
 ]
 
+[[package]]
+name = "sml-scon"
+version = "0.9.3"
+dependencies = [
+ "num-bigint",
+ "num-traits",
+ "str-util",
+]
+
 [[package]]
 name = "sml-statics"
-version = "0.9.0"
+version = "0.9.3"
 dependencies = [
  "chain-map",
  "config",
@@ -992,7 +1025,7 @@ dependencies = [
 
 [[package]]
 name = "sml-statics-types"
-version = "0.9.0"
+version = "0.9.3"
 dependencies = [
  "chain-map",
  "code-h2-md-map",
@@ -1009,7 +1042,7 @@ dependencies = [
 
 [[package]]
 name = "sml-syntax"
-version = "0.9.0"
+version = "0.9.3"
 dependencies = [
  "char-name",
  "code-h2-md-map",
@@ -1022,7 +1055,7 @@ dependencies = [
 
 [[package]]
 name = "sml-ty-var-scope"
-version = "0.9.0"
+version = "0.9.3"
 dependencies = [
  "fast-hash",
  "sml-hir",
@@ -1040,7 +1073,7 @@ dependencies = [
 [[package]]
 name = "str-util"
 version = "0.1.0"
-source = "git+https://github.com/azdavis/language-util.git#cc57f0aef443b16a8cd5a7506d11e182ab091e8d"
+source = "git+https://github.com/azdavis/language-util.git#48188e47909b733e5532d3dd70bc5dfa88394f9b"
 dependencies = [
  "smol_str",
 ]
@@ -1058,9 +1091,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "2.0.14"
+version = "2.0.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fcf316d5356ed6847742d036f8a39c3b8435cac10bd528a4bd461928a6ab34d5"
+checksum = "a34fcf3e8b60f57e6a14301a2e916d323af98b0ea63c599441eec8558660c822"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1070,7 +1103,7 @@ dependencies = [
 [[package]]
 name = "syntax-gen"
 version = "0.1.0"
-source = "git+https://github.com/azdavis/language-util.git#cc57f0aef443b16a8cd5a7506d11e182ab091e8d"
+source = "git+https://github.com/azdavis/language-util.git#48188e47909b733e5532d3dd70bc5dfa88394f9b"
 dependencies = [
  "fast-hash",
  "identifier-case",
@@ -1090,7 +1123,7 @@ dependencies = [
 
 [[package]]
 name = "tests"
-version = "0.9.0"
+version = "0.9.3"
 dependencies = [
  "analysis",
  "cm-syntax",
@@ -1110,13 +1143,12 @@ dependencies = [
  "sml-syntax",
  "str-util",
  "text-pos",
- "xshell",
 ]
 
 [[package]]
 name = "text-pos"
 version = "0.1.0"
-source = "git+https://github.com/azdavis/language-util.git#cc57f0aef443b16a8cd5a7506d11e182ab091e8d"
+source = "git+https://github.com/azdavis/language-util.git#48188e47909b733e5532d3dd70bc5dfa88394f9b"
 dependencies = [
  "fast-hash",
  "text-size-util",
@@ -1131,7 +1163,7 @@ checksum = "288cb548dbe72b652243ea797201f3d481a0609a967980fcc5b2315ea811560a"
 [[package]]
 name = "text-size-util"
 version = "0.1.0"
-source = "git+https://github.com/azdavis/language-util.git#cc57f0aef443b16a8cd5a7506d11e182ab091e8d"
+source = "git+https://github.com/azdavis/language-util.git#48188e47909b733e5532d3dd70bc5dfa88394f9b"
 dependencies = [
  "text-size",
 ]
@@ -1154,7 +1186,7 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 [[package]]
 name = "token"
 version = "0.1.0"
-source = "git+https://github.com/azdavis/language-util.git#cc57f0aef443b16a8cd5a7506d11e182ab091e8d"
+source = "git+https://github.com/azdavis/language-util.git#48188e47909b733e5532d3dd70bc5dfa88394f9b"
 
 [[package]]
 name = "toml"
@@ -1193,7 +1225,7 @@ dependencies = [
 [[package]]
 name = "topo-sort"
 version = "0.1.0"
-source = "git+https://github.com/azdavis/language-util.git#cc57f0aef443b16a8cd5a7506d11e182ab091e8d"
+source = "git+https://github.com/azdavis/language-util.git#48188e47909b733e5532d3dd70bc5dfa88394f9b"
 
 [[package]]
 name = "ungrammar"
@@ -1240,7 +1272,7 @@ checksum = "c0edd1e5b14653f783770bce4a4dabb4a5108a5370a5f5d8cfe8710c361f6c8b"
 [[package]]
 name = "uniq"
 version = "0.1.0"
-source = "git+https://github.com/azdavis/language-util.git#cc57f0aef443b16a8cd5a7506d11e182ab091e8d"
+source = "git+https://github.com/azdavis/language-util.git#48188e47909b733e5532d3dd70bc5dfa88394f9b"
 
 [[package]]
 name = "url"
@@ -1423,24 +1455,9 @@ dependencies = [
  "memchr",
 ]
 
-[[package]]
-name = "xshell"
-version = "0.2.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "962c039b3a7b16cf4e9a4248397c6585c07547412e7d6a6e035389a802dcfe90"
-dependencies = [
- "xshell-macros",
-]
-
-[[package]]
-name = "xshell-macros"
-version = "0.2.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1dbabb1cbd15a1d6d12d9ed6b35cc6777d4af87ab3ba155ea37215f20beab80c"
-
 [[package]]
 name = "xtask"
-version = "0.9.0"
+version = "0.9.3"
 dependencies = [
  "anyhow",
  "flate2",
diff --git a/pkgs/development/tools/language-servers/millet/default.nix b/pkgs/development/tools/language-servers/millet/default.nix
index 76b9b83a9608..956e3c4f9dfa 100644
--- a/pkgs/development/tools/language-servers/millet/default.nix
+++ b/pkgs/development/tools/language-servers/millet/default.nix
@@ -2,19 +2,19 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "millet";
-  version = "0.9.0";
+  version = "0.9.3";
 
   src = fetchFromGitHub {
     owner = "azdavis";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-lZW+R9fSrW10bLJCIsdtfgrrRRKnfg/sVtlfxl+XFR0=";
+    hash = "sha256-swT16F/gOHiAeZGrD9O4THIHMXDQOpsaUsSjhpkw3fU=";
   };
 
   cargoLock = {
     lockFile = ./Cargo.lock;
     outputHashes = {
-      "char-name-0.1.0" = "sha256-dq7y7WOzOzEZztojgh21wPrIqCfiioFJ/gbJ2jY10lQ=";
+      "char-name-0.1.0" = "sha256-hO7SO1q5hPY5wJJ8A+OxxCI7GeHtdMz34OWu9ViVny0=";
       "sml-libs-0.1.0" = "sha256-+sxaPBG5qBIC195BFQYH8Yo6juuelGZzztCUiS45WRg=";
     };
   };
diff --git a/pkgs/development/tools/language-servers/typst-lsp/Cargo.lock b/pkgs/development/tools/language-servers/typst-lsp/Cargo.lock
index 9cf6e325eacb..dd9c44cbe0dc 100644
--- a/pkgs/development/tools/language-servers/typst-lsp/Cargo.lock
+++ b/pkgs/development/tools/language-servers/typst-lsp/Cargo.lock
@@ -1612,7 +1612,7 @@ dependencies = [
 
 [[package]]
 name = "typst-lsp"
-version = "0.4.0"
+version = "0.4.1"
 dependencies = [
  "anyhow",
  "comemo",
diff --git a/pkgs/development/tools/language-servers/typst-lsp/default.nix b/pkgs/development/tools/language-servers/typst-lsp/default.nix
index c3d4ac3b395e..919fa268baa6 100644
--- a/pkgs/development/tools/language-servers/typst-lsp/default.nix
+++ b/pkgs/development/tools/language-servers/typst-lsp/default.nix
@@ -5,13 +5,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "typst-lsp";
-  version = "0.4.0";
+  version = "0.4.1";
 
   src = fetchFromGitHub {
     owner = "nvarner";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-buU9H+zO5s/IO5JSGRuumVreW8D+qogRt884fHknPOA=";
+    hash = "sha256-bjgGJxAHc3D0j+ZIPPzBw9vJJgchW9hy5E/qCmFjDUw=";
   };
 
   cargoLock = {
diff --git a/pkgs/development/tools/misc/phpunit/default.nix b/pkgs/development/tools/misc/phpunit/default.nix
index 751646e15aa0..e640209e9f64 100644
--- a/pkgs/development/tools/misc/phpunit/default.nix
+++ b/pkgs/development/tools/misc/phpunit/default.nix
@@ -2,14 +2,14 @@
 
 let
   pname = "phpunit";
-  version = "10.0.16";
+  version = "10.1.0";
 in
 stdenv.mkDerivation {
   inherit pname version;
 
   src = fetchurl {
     url = "https://phar.phpunit.de/phpunit-${version}.phar";
-    hash = "sha256-e/wUIri2y4yKI1V+U/vAD3ef2ZeKxBcFrb0Ay/rlTtM=";
+    hash = "sha256-1zYGgYV4BHxjBE3QcV6XP73u2JIaUzCKS70eDB7e9DQ=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/development/tools/misc/slint-lsp/default.nix b/pkgs/development/tools/misc/slint-lsp/default.nix
index 0ecebde8c244..fcbe98003151 100644
--- a/pkgs/development/tools/misc/slint-lsp/default.nix
+++ b/pkgs/development/tools/misc/slint-lsp/default.nix
@@ -25,14 +25,14 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "slint-lsp";
-  version = "0.3.5";
+  version = "1.0.0";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-7ctzbuBP2AeBCd+/n18EdxIeCK89fCPb1ZbSRjdg8u0=";
+    sha256 = "sha256-Ua8ENLxmfYv6zF/uihT49ZpphFaC3zS882cttJ/rvc4=";
   };
 
-  cargoHash = "sha256-b5zb5YMqCfj8jAXQPQnBp6qTs0OGTrTgsd9bDGzPdus=";
+  cargoHash = "sha256-IzjOAy9zTtsD4jHjI1oVXBg7Si1AeDNH8ATK4yO8WVw=";
 
   nativeBuildInputs = [ cmake pkg-config fontconfig ];
   buildInputs = rpathLibs ++ [ xorg.libxcb.dev ]
diff --git a/pkgs/development/tools/pax-rs/default.nix b/pkgs/development/tools/pax-rs/default.nix
index 1731dabf3704..d89221da8fea 100644
--- a/pkgs/development/tools/pax-rs/default.nix
+++ b/pkgs/development/tools/pax-rs/default.nix
@@ -1,7 +1,6 @@
 { lib, fetchFromGitHub, fetchurl, rustPlatform, runCommand } :
-with rustPlatform;
 
-buildRustPackage rec {
+rustPlatform.buildRustPackage rec {
   pname = "pax-rs";
   version = "0.4.0";
 
diff --git a/pkgs/development/tools/rust/cargo-llvm-cov/default.nix b/pkgs/development/tools/rust/cargo-llvm-cov/default.nix
index 4e9f3ae809c5..1808440ab33a 100644
--- a/pkgs/development/tools/rust/cargo-llvm-cov/default.nix
+++ b/pkgs/development/tools/rust/cargo-llvm-cov/default.nix
@@ -6,13 +6,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-llvm-cov";
-  version = "0.5.14";
+  version = "0.5.16";
 
   src = fetchzip {
     url = "https://crates.io/api/v1/crates/${pname}/${version}/download#${pname}-${version}.tar.gz";
-    sha256 = "sha256-J1oG1lnpdLYBLmBK8UcLhM6xr9q53FDkjM3ihYthznY=";
+    sha256 = "sha256-aVvYQ9/04juse89EzYY6f9HEwRHjZxbDnuJpX6jzlbc=";
   };
-  cargoSha256 = "sha256-4noIfJifszGI5PlvZf8ZkDRuXsGBX+Io2H0blrE0vy4=";
+  cargoSha256 = "sha256-dxKtOWhHSZdr5RNQ+w+CXFHN+oQXUmSQ7w9i9IO7Q6I=";
 
   # skip tests which require llvm-tools-preview
   checkFlags = [
diff --git a/pkgs/development/tools/rust/cargo-ndk/default.nix b/pkgs/development/tools/rust/cargo-ndk/default.nix
index 03117e9c1f41..148a35014fd1 100644
--- a/pkgs/development/tools/rust/cargo-ndk/default.nix
+++ b/pkgs/development/tools/rust/cargo-ndk/default.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-ndk";
-  version = "2.12.6";
+  version = "3.0.1";
 
   src = fetchFromGitHub {
     owner = "bbqsrc";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-VGdFIMyZhb7SDWAXgs7kFlblYCO4rLf+3/N7Mashc4o=";
+    sha256 = "sha256-fPN5me8+KrnFR0NkWVxWm8OXZbObUWsYKChldme0qyc=";
   };
 
-  cargoHash = "sha256-pv6t9oKj5tdQjpvBgj/Y11uKJIaIWcaA9ib/Id/s+qs=";
+  cargoHash = "sha256-UEQ+6N7D1/+vhdzYthcTP1YuVEmo5llrpndKuwmrjKc=";
 
   meta = with lib; {
     description = "Cargo extension for building Android NDK projects";
diff --git a/pkgs/development/tools/rust/cargo-release/Cargo.lock b/pkgs/development/tools/rust/cargo-release/Cargo.lock
index 952d667c6a1e..c1ac6ee34661 100644
--- a/pkgs/development/tools/rust/cargo-release/Cargo.lock
+++ b/pkgs/development/tools/rust/cargo-release/Cargo.lock
@@ -165,7 +165,7 @@ dependencies = [
 
 [[package]]
 name = "cargo-release"
-version = "0.24.9"
+version = "0.24.10"
 dependencies = [
  "anyhow",
  "assert_fs",
diff --git a/pkgs/development/tools/rust/cargo-release/default.nix b/pkgs/development/tools/rust/cargo-release/default.nix
index 7074fd6b4539..6422384e1667 100644
--- a/pkgs/development/tools/rust/cargo-release/default.nix
+++ b/pkgs/development/tools/rust/cargo-release/default.nix
@@ -2,6 +2,7 @@
 , rustPlatform
 , fetchFromGitHub
 , pkg-config
+, libgit2_1_5
 , openssl
 , stdenv
 , curl
@@ -11,13 +12,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-release";
-  version = "0.24.9";
+  version = "0.24.10";
 
   src = fetchFromGitHub {
     owner = "crate-ci";
     repo = "cargo-release";
     rev = "refs/tags/v${version}";
-    hash = "sha256-J71TfOG9gagp2YbsEq2z8fCwBTMJmkYhY5Gl4lB+cDI=";
+    hash = "sha256-3kOis5C0XOdp0CCCSZ8PoGtePqW7ozwzSTA9TGe7kAg=";
   };
 
   cargoLock = {
@@ -32,6 +33,7 @@ rustPlatform.buildRustPackage rec {
   ];
 
   buildInputs = [
+    libgit2_1_5
     openssl
   ] ++ lib.optionals stdenv.isDarwin [
     curl
@@ -42,7 +44,8 @@ rustPlatform.buildRustPackage rec {
     git
   ];
 
-  OPENSSL_NO_VENDOR = true;
+  # disable vendored-libgit2 and vendored-openssl
+  buildNoDefaultFeatures = true;
 
   meta = with lib; {
     description = ''Cargo subcommand "release": everything about releasing a rust crate'';
diff --git a/pkgs/development/tools/tabnine/sources.json b/pkgs/development/tools/tabnine/sources.json
index 7ce95a0e1303..7ec3dd45378a 100644
--- a/pkgs/development/tools/tabnine/sources.json
+++ b/pkgs/development/tools/tabnine/sources.json
@@ -1,17 +1,17 @@
 {
-  "version": "4.4.265",
+  "version": "4.4.282",
   "platforms": {
     "x86_64-linux": {
       "name": "x86_64-unknown-linux-musl",
-      "hash": "sha256-HyRUlOSH/GmvBlOEtdIdv5cyHaw92OqWrYqaEI63NDE="
+      "hash": "sha256-ddf30gAKYztw6RD5fPK/eb7AoYp/SiN9hDDEuUT3LZE="
     },
     "aarch64-darwin": {
       "name": "aarch64-apple-darwin",
-      "hash": "sha256-ZcM7JnrPCWvhvpb7vbrLvqY9RmWjMaaAd7Wvx6Eveto="
+      "hash": "sha256-fZyovA6Oq/jGF1OAzm/6nfldaVtZyor9IJGQtVmCVLM="
     },
     "x86_64-darwin": {
       "name": "x86_64-apple-darwin",
-      "hash": "sha256-eiZv5eidDynNOb5P6IUAVI3X8xub9U0GgWFkFq6mY74="
+      "hash": "sha256-4oVDbUtl+zkaL9kDCdfAvCCDlJRZG8ho0LufKx7nTkg="
     }
   }
 }
diff --git a/pkgs/development/web/deno/default.nix b/pkgs/development/web/deno/default.nix
index bd1798e50483..fd6c8a22fcd8 100644
--- a/pkgs/development/web/deno/default.nix
+++ b/pkgs/development/web/deno/default.nix
@@ -12,15 +12,15 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "deno";
-  version = "1.32.4";
+  version = "1.32.5";
 
   src = fetchFromGitHub {
     owner = "denoland";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-yTTvfhOeU8zBwC+btscSlQygwEwjFlpvQQtiYunPCTI=";
+    hash = "sha256-H2qa83To6kG4rvpCwjxmsgPnuUHj6chK4UUultY4/OU=";
   };
-  cargoHash = "sha256-GgOqo0q9sQyoYWUZkuBW6kxWXzpI3/+0YgRPhVD0GhM=";
+  cargoHash = "sha256-FgqpHn5WMoLjUQfiow7BuyvCu7ypuO4wWm/B4kr40MI=";
 
   postPatch = ''
     # upstream uses lld on aarch64-darwin for faster builds
diff --git a/pkgs/games/gcompris/default.nix b/pkgs/games/gcompris/default.nix
index af41da4a3e4f..204f5b3d82e7 100644
--- a/pkgs/games/gcompris/default.nix
+++ b/pkgs/games/gcompris/default.nix
@@ -20,11 +20,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gcompris";
-  version = "3.1";
+  version = "3.2";
 
   src = fetchurl {
     url = "https://download.kde.org/stable/gcompris/qt/src/gcompris-qt-${version}.tar.xz";
-    hash = "sha256-wABGojMfiMgjUT5gVDfB5JmXK1SPkrIkqLT/403zUFI=";
+    hash = "sha256-WopJB9p7GnfCtUoEKxtzzRXCogcx03ofRjGLhkvW0Rs=";
   };
 
   cmakeFlags = [
diff --git a/pkgs/games/mindustry/default.nix b/pkgs/games/mindustry/default.nix
index 45991d7c5518..816cd10ccfe7 100644
--- a/pkgs/games/mindustry/default.nix
+++ b/pkgs/games/mindustry/default.nix
@@ -34,20 +34,20 @@
 
 let
   pname = "mindustry";
-  version = "142";
+  version = "143.1";
   buildVersion = makeBuildVersion version;
 
   Mindustry = fetchFromGitHub {
     owner = "Anuken";
     repo = "Mindustry";
     rev = "v${version}";
-    hash = "sha256-xL1oy93ljAl1hdzsdEF9NHZL/yb11markUg271C++R4=";
+    hash = "sha256-p6HxccLg+sjFW+ZGGTfo5ZvOIs6lKjub88kX/iaBres=";
   };
   Arc = fetchFromGitHub {
     owner = "Anuken";
     repo = "Arc";
     rev = "v${version}";
-    hash = "sha256-CKcAnYAuHQb6wPkDUpinU83MVxhdvhYpjjuS3sEb6cg=";
+    hash = "sha256-fbFjelwqBRadcUmbW3/oDnhmNAjTj660qB5WwXugIIU=";
   };
   soloud = fetchFromGitHub {
     owner = "Anuken";
@@ -126,7 +126,7 @@ let
         | sh
     '';
     outputHashMode = "recursive";
-    outputHash = "sha256-Fy2GXdB+cmRfiQFKnnz+UTUxT+LBTZa69BNwC23XD84=";
+    outputHash = "sha256-uxnW5AqX6PazqHJYLuF/By5qpev8Se+992jCyacogSY=";
   };
 
 in
diff --git a/pkgs/games/osu-lazer/bin.nix b/pkgs/games/osu-lazer/bin.nix
index dc69ec7de0e0..6f137f5bde81 100644
--- a/pkgs/games/osu-lazer/bin.nix
+++ b/pkgs/games/osu-lazer/bin.nix
@@ -7,21 +7,21 @@
 
 let
   pname = "osu-lazer-bin";
-  version = "2023.403.1";
+  version = "2023.419.0";
   name = "${pname}-${version}";
 
   osu-lazer-bin-src = {
     aarch64-darwin = {
       url = "https://github.com/ppy/osu/releases/download/${version}/osu.app.Apple.Silicon.zip";
-      sha256 = "sha256-M0ByF2bEK4tWLSP04gjQTAyOyXfP2cB/w90otkwIfFs=";
+      sha256 = "sha256-KItS8OykIjinSgm/CtF3YUMUQE9OfZ6aZ6DLBpyyDQE=";
     };
     x86_64-darwin = {
       url = "https://github.com/ppy/osu/releases/download/${version}/osu.app.Intel.zip";
-      sha256 = "sha256-lsGtdGm9UGzgz/OCwnev4XGUwHdzMTlBIgWH7qDKt+w=";
+      sha256 = "sha256-O4MlcawL6wlj6HilSH8wm0GJWN8DqWjNw51YJGu2NMs=";
     };
     x86_64-linux = {
       url = "https://github.com/ppy/osu/releases/download/${version}/osu.AppImage";
-      sha256 = "sha256-xHz9CYpI02m54xJOkO8Kd7KIxvAELqCDOZnw05EsSYw=";
+      sha256 = "sha256-v+p+IOaHhb/wgqmeSO78rqLQLPGtCOEZBj+I3oZH9N0=";
     };
   }.${stdenv.system} or (throw "${pname}-${version}: ${stdenv.system} is unsupported.");
 
diff --git a/pkgs/games/osu-lazer/default.nix b/pkgs/games/osu-lazer/default.nix
index b938cfcfb7ea..c3e3cb9b4a48 100644
--- a/pkgs/games/osu-lazer/default.nix
+++ b/pkgs/games/osu-lazer/default.nix
@@ -17,13 +17,13 @@
 
 buildDotnetModule rec {
   pname = "osu-lazer";
-  version = "2023.403.1";
+  version = "2023.419.0";
 
   src = fetchFromGitHub {
     owner = "ppy";
     repo = "osu";
     rev = version;
-    sha256 = "sha256-IFy8QkuDgfXfKXthPS5khpehbS4eQEBI66YJUO/22O0=";
+    sha256 = "sha256-BTrEE2+0EgYUAiAhanq3H38hlEMJLXVo47dc1+9VARQ=";
   };
 
   projectFile = "osu.Desktop/osu.Desktop.csproj";
diff --git a/pkgs/games/osu-lazer/deps.nix b/pkgs/games/osu-lazer/deps.nix
index 3cb72d4c9563..2a73cee72dec 100644
--- a/pkgs/games/osu-lazer/deps.nix
+++ b/pkgs/games/osu-lazer/deps.nix
@@ -130,15 +130,15 @@
   (fetchNuGet { pname = "ppy.ManagedBass"; version = "2022.1216.0"; sha256 = "19nnj1hq2v21mrplnivjr9c4y3wg4hhfnc062sjgzkmiv1cchvf8"; })
   (fetchNuGet { pname = "ppy.ManagedBass.Fx"; version = "2022.1216.0"; sha256 = "1vw573mkligpx9qiqasw1683cqaa1kgnxhlnbdcj9c4320b1pwjm"; })
   (fetchNuGet { pname = "ppy.ManagedBass.Mix"; version = "2022.1216.0"; sha256 = "185bpvgbnd8y20r7vxb1an4pd1aal9b7b5wvmv3knz0qg8j0chd9"; })
-  (fetchNuGet { pname = "ppy.osu.Framework"; version = "2023.403.0"; sha256 = "1jwa6zm8sk3nicflna43ab2p91yapsnqw2baxpbm829qzvrw7yfz"; })
+  (fetchNuGet { pname = "ppy.osu.Framework"; version = "2023.418.0"; sha256 = "0bxvza7kq3vba64800r6wr0cq31y0dhbwzkqh89cq42v7hqrpa0f"; })
   (fetchNuGet { pname = "ppy.osu.Framework.NativeLibs"; version = "2022.525.0"; sha256 = "1zsqj3xng06bb46vg79xx35n2dsh3crqg951r1ga2gxqzgzy4nk0"; })
   (fetchNuGet { pname = "ppy.osu.Framework.SourceGeneration"; version = "2022.1222.1"; sha256 = "1pwwsp4rfzl6166mhrn5lsnyazpckhfh1m6ggf9d1lw2wb58vxfr"; })
-  (fetchNuGet { pname = "ppy.osu.Game.Resources"; version = "2023.402.0"; sha256 = "1yi48dnsi8lg0i5hhmk9yqjzhwsjrch6gm8jdr5rxkfxwbkk6i7s"; })
+  (fetchNuGet { pname = "ppy.osu.Game.Resources"; version = "2023.417.0"; sha256 = "015dk8rhj2m9842wmdv76bhp81xmqlh2jxlqj934lskvwv24kl66"; })
   (fetchNuGet { pname = "ppy.osuTK.NS20"; version = "1.0.211"; sha256 = "0j4a9n39pqm0cgdcps47p5n2mqph3h94r7hmf0bs59imif4jxvjy"; })
   (fetchNuGet { pname = "ppy.SDL2-CS"; version = "1.0.652-alpha"; sha256 = "104amh94xlnp13qfjkwwvi74qanx52k52dd7h7j2anaa0g350rrh"; })
-  (fetchNuGet { pname = "ppy.Veldrid"; version = "4.9.2-g0ec05acb9b"; sha256 = "16gq7x3kp1rg9qpjfp5hxdmkgyhpkk1m62sfmcrpckk9xz46jlc3"; })
-  (fetchNuGet { pname = "ppy.Veldrid.MetalBindings"; version = "4.9.2-g0ec05acb9b"; sha256 = "0frfsgbiml8178f70szdhngc4yk22f7akf65yww9c8ri850wcd79"; })
-  (fetchNuGet { pname = "ppy.Veldrid.OpenGLBindings"; version = "4.9.2-g0ec05acb9b"; sha256 = "0mxcbdlhzmzm8m22ssliwqpqgvk1lfzqayn8nrb8gi7h37jvk165"; })
+  (fetchNuGet { pname = "ppy.Veldrid"; version = "4.9.3-gf1f8dc0432"; sha256 = "01xnb43gkbrn3wnb79k9k5cg2xhq4vf94i7c648003i0pdvm0rbz"; })
+  (fetchNuGet { pname = "ppy.Veldrid.MetalBindings"; version = "4.9.3-gf1f8dc0432"; sha256 = "0w15rfshjrkblk91gl7mqdvbfrqi19bpgx60zm42znx5r4ryjix8"; })
+  (fetchNuGet { pname = "ppy.Veldrid.OpenGLBindings"; version = "4.9.3-gf1f8dc0432"; sha256 = "1mr7mcpjb4fz3lbxi1qv9vwjsbm8sgh20gb8xbvpjkzj9hk5xbp3"; })
   (fetchNuGet { pname = "ppy.Veldrid.SPIRV"; version = "1.0.15-gc5e8498253"; sha256 = "16rs7633v27mcvq4c1np7mp6y9hg3l1f15i9rh61gyx75x2rs5pm"; })
   (fetchNuGet { pname = "Realm"; version = "10.20.0"; sha256 = "0gy0l2r7726wb6i599n55dn9035h0g7k0binfiy2dy9bjwz60jqk"; })
   (fetchNuGet { pname = "Realm.Fody"; version = "10.20.0"; sha256 = "0rwcbbzr41iww3k59rjgy5xy7bna1x906h5blbllpywgpc2l5afw"; })
diff --git a/pkgs/games/vintagestory/default.nix b/pkgs/games/vintagestory/default.nix
index 96c8e5ba7afb..046fbefb4318 100644
--- a/pkgs/games/vintagestory/default.nix
+++ b/pkgs/games/vintagestory/default.nix
@@ -17,11 +17,11 @@
 
 stdenv.mkDerivation rec {
   pname = "vintagestory";
-  version = "1.17.10";
+  version = "1.17.11";
 
   src = fetchurl {
     url = "https://cdn.vintagestory.at/gamefiles/stable/vs_archive_${version}.tar.gz";
-    sha256 = "sha256-1HsWby4Jf+ndE9xsDrS+vELymDedRwSgNiCDLoiPBec=";
+    sha256 = "sha256-iIQRwnJX+7GJcOqXJutInqpSX2fKlPmwFFAq6TqNWWY=";
   };
 
   nativeBuildInputs = [ makeWrapper copyDesktopItems ];
diff --git a/pkgs/misc/lilypond/unstable.nix b/pkgs/misc/lilypond/unstable.nix
index 468cd51439ec..56e6c8db79e8 100644
--- a/pkgs/misc/lilypond/unstable.nix
+++ b/pkgs/misc/lilypond/unstable.nix
@@ -1,10 +1,10 @@
 { lib, fetchurl, lilypond }:
 
 lilypond.overrideAttrs (oldAttrs: rec {
-  version = "2.25.1";
+  version = "2.25.3";
   src = fetchurl {
     url = "https://lilypond.org/download/sources/v${lib.versions.majorMinor version}/lilypond-${version}.tar.gz";
-    sha256 = "sha256-DchY+4+bWIvTZb4v9q/fAqStkbsxHhvty3eur0ZFYVs=";
+    sha256 = "sha256-CVMMzL31NWd6PKf66m0ctBXFpqHMwxQibuifaU9lftg=";
   };
 
   passthru.updateScript = {
diff --git a/pkgs/os-specific/darwin/rectangle/default.nix b/pkgs/os-specific/darwin/rectangle/default.nix
index 8261c4198c1c..dcdbdde1fae1 100644
--- a/pkgs/os-specific/darwin/rectangle/default.nix
+++ b/pkgs/os-specific/darwin/rectangle/default.nix
@@ -1,23 +1,37 @@
-{ lib, stdenv, fetchurl, cpio, xar, undmg, ... }:
+{ lib
+, stdenvNoCC
+, fetchurl
+, undmg
+, gitUpdater
+}:
 
-stdenv.mkDerivation rec {
+stdenvNoCC.mkDerivation rec {
   pname = "rectangle";
-  version = "0.59";
+  version = "0.68";
 
   src = fetchurl {
     url = "https://github.com/rxhanson/Rectangle/releases/download/v${version}/Rectangle${version}.dmg";
-    sha256 = "sha256-6K4HJ4qWjf/BsoxmSWyO/Km3BZujCnMJ2/xCMkH3TaI=";
+    hash = "sha256-N1zSMmRo6ux/b16K4Og68A5bfht2WWi7S40Yys3QkTY=";
   };
 
-  sourceRoot = "Rectangle.app";
+  sourceRoot = ".";
 
   nativeBuildInputs = [ undmg ];
 
   installPhase = ''
-    mkdir -p $out/Applications/Rectangle.app
-    cp -R . $out/Applications/Rectangle.app
+    runHook preInstall
+
+    mkdir -p $out/Applications
+    mv Rectangle.app $out/Applications
+
+    runHook postInstall
   '';
 
+  passthru.updateScript = gitUpdater {
+    url = "https://github.com/rxhanson/Rectangle";
+    rev-prefix = "v";
+  };
+
   meta = with lib; {
     description = "Move and resize windows in macOS using keyboard shortcuts or snap areas";
     homepage = "https://rectangleapp.com/";
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index a3c59a5a6c9b..57d339b0fbab 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -98,7 +98,7 @@
 , withImportd ? !stdenv.hostPlatform.isMusl
 , withKmod ? true
 , withLibBPF ? lib.versionAtLeast buildPackages.llvmPackages.clang.version "10.0"
-    && stdenv.hostPlatform.isAarch -> lib.versionAtLeast stdenv.hostPlatform.parsed.cpu.version "6" # assumes hard floats
+    && (stdenv.hostPlatform.isAarch -> lib.versionAtLeast stdenv.hostPlatform.parsed.cpu.version "6") # assumes hard floats
     && !stdenv.hostPlatform.isMips64   # see https://github.com/NixOS/nixpkgs/pull/194149#issuecomment-1266642211
 , withLibidn2 ? true
 , withLocaled ? true
diff --git a/pkgs/servers/adguardhome/bins.nix b/pkgs/servers/adguardhome/bins.nix
index f42190011554..db05a61fc46a 100644
--- a/pkgs/servers/adguardhome/bins.nix
+++ b/pkgs/servers/adguardhome/bins.nix
@@ -1,31 +1,31 @@
 { fetchurl, fetchzip }:
 {
 x86_64-darwin = fetchzip {
-  sha256 = "sha256-amKwWr+0Q9Ci0CxLEjtxTiu/T9wJL77DPL/QiWqsMoc=";
-  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.28/AdGuardHome_darwin_amd64.zip";
+  sha256 = "sha256-ygf5D8s1Yv9J1mVDAZrW9Q/4scQopQ547TfHG+fFwoU=";
+  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.29/AdGuardHome_darwin_amd64.zip";
 };
 aarch64-darwin = fetchzip {
-  sha256 = "sha256-dJHFGTIv+inVU6djuQkFcOF2nTALd+1dS888ooHXt/w=";
-  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.28/AdGuardHome_darwin_arm64.zip";
+  sha256 = "sha256-s112LwCusgRcTaGmKWcRlUA2XnbdxJ7lVkWzG3QIUqQ=";
+  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.29/AdGuardHome_darwin_arm64.zip";
 };
 i686-linux = fetchurl {
-  sha256 = "sha256-ijcR3z0aUN0euC9oygULlMtaNnffelv45ku4zmcZkUA=";
-  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.28/AdGuardHome_linux_386.tar.gz";
+  sha256 = "sha256-mBqxPT/qaER4nI1+pmmpUSTJuCb9eax9DMRIY+J92Lk=";
+  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.29/AdGuardHome_linux_386.tar.gz";
 };
 x86_64-linux = fetchurl {
-  sha256 = "sha256-aXmDer5/bq0L6SoPhqyJ8IY2FzH+TYNHDvQTZgrrrj0=";
-  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.28/AdGuardHome_linux_amd64.tar.gz";
+  sha256 = "sha256-M4VfjRnrqYxKc9neIJndJoa8D44RRIjN5ItE4Ec6VKY=";
+  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.29/AdGuardHome_linux_amd64.tar.gz";
 };
 aarch64-linux = fetchurl {
-  sha256 = "sha256-E2QBwA0prJ4B8a6tEj9lBkAnrYUTlsweOJBpQsLBo9M=";
-  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.28/AdGuardHome_linux_arm64.tar.gz";
+  sha256 = "sha256-6zekpNnfss4r/Z+g/Te0O+oDpCskKu39NI8Q0e7bHOo=";
+  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.29/AdGuardHome_linux_arm64.tar.gz";
 };
 armv6l-linux = fetchurl {
-  sha256 = "sha256-NARiVRdT7U0E6BUlehJbEeHQ9tF6vmCh/d59osVy/S0=";
-  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.28/AdGuardHome_linux_armv6.tar.gz";
+  sha256 = "sha256-j0n3lKyaxOXX7YHcpYlC1dpCz741q1tes2kgadHzivI=";
+  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.29/AdGuardHome_linux_armv6.tar.gz";
 };
 armv7l-linux = fetchurl {
-  sha256 = "sha256-HU6uUSfdr3UkPX+oyjGlMHJkcfpGBRphBNLtBG3oLzY=";
-  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.28/AdGuardHome_linux_armv7.tar.gz";
+  sha256 = "sha256-LyD3arGmk5YWXB2FZBLPcMAukvBtlXfFPSQ/mZBJohA=";
+  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.29/AdGuardHome_linux_armv7.tar.gz";
 };
 }
diff --git a/pkgs/servers/adguardhome/default.nix b/pkgs/servers/adguardhome/default.nix
index 7d620d17ba5f..f3bbf5fb6db0 100644
--- a/pkgs/servers/adguardhome/default.nix
+++ b/pkgs/servers/adguardhome/default.nix
@@ -7,7 +7,7 @@ in
 
 stdenv.mkDerivation rec {
   pname = "adguardhome";
-  version = "0.107.28";
+  version = "0.107.29";
   src = sources.${system} or (throw "Source for ${pname} is not available for ${system}");
 
   installPhase = ''
diff --git a/pkgs/servers/akkoma/akkoma-fe/default.nix b/pkgs/servers/akkoma/akkoma-fe/default.nix
index 9b6dbdce521c..b4a91a36b5d5 100644
--- a/pkgs/servers/akkoma/akkoma-fe/default.nix
+++ b/pkgs/servers/akkoma/akkoma-fe/default.nix
@@ -7,14 +7,14 @@
 
 stdenv.mkDerivation rec {
   pname = "akkoma-fe";
-  version = "unstable-2023-03-11";
+  version = "unstable-2023-04-14";
 
   src = fetchFromGitea {
     domain = "akkoma.dev";
     owner = "AkkomaGang";
     repo = "akkoma-fe";
-    rev = "85abc622136c2f346f7855824290f6093afe2794";
-    hash = "sha256-EBspufZ92/mLzjdK2R5lpOyrnFataeY/2NabIU0T3Lc=";
+    rev = "9aa64d82c964265133be97b08b0cdf0e75680419";
+    hash = "sha256-WwjpYD8U+JvygPMo8VcQDdsjek3iKbpT18rXSVMPDG8=";
   };
 
   offlineCache = fetchYarnDeps {
diff --git a/pkgs/servers/akkoma/default.nix b/pkgs/servers/akkoma/default.nix
index 56770a4d3535..5c9ae060df78 100644
--- a/pkgs/servers/akkoma/default.nix
+++ b/pkgs/servers/akkoma/default.nix
@@ -9,14 +9,14 @@
 
 beamPackages.mixRelease rec {
   pname = "pleroma";
-  version = "3.7.1";
+  version = "3.8.0";
 
   src = fetchFromGitea {
     domain = "akkoma.dev";
     owner = "AkkomaGang";
     repo = "akkoma";
     rev = "v${version}";
-    hash = "sha256-Ovi2AnfkeCDlv3INomPxu8R1ARexOzZHC8dOLucrDaQ=";
+    hash = "sha256-KpaJ2xx3XEibMv1G8o9Lw7+LcnxPCUiWlmdcoi5wklQ=";
   };
 
   postPatch = ''
diff --git a/pkgs/servers/akkoma/mix.nix b/pkgs/servers/akkoma/mix.nix
index 95186f6758d0..0e88bf4a1a88 100644
--- a/pkgs/servers/akkoma/mix.nix
+++ b/pkgs/servers/akkoma/mix.nix
@@ -348,12 +348,12 @@ let
 
     ecto = buildMix rec {
       name = "ecto";
-      version = "3.9.4";
+      version = "3.9.5";
 
       src = fetchHex {
         pkg = "${name}";
         version = "${version}";
-        sha256 = "0xgfz1pzylj22k0qa8zh4idvd4139b1lwnmq33na8fia2j69hpyy";
+        sha256 = "0k5p40cy6zxi3wm885amf78724zvb5a8chmpljzw1kdsiifi3wyl";
       };
 
       beamDeps = [ decimal jason telemetry ];
@@ -478,12 +478,12 @@ let
 
     ex_doc = buildMix rec {
       name = "ex_doc";
-      version = "0.29.2";
+      version = "0.29.3";
 
       src = fetchHex {
         pkg = "${name}";
         version = "${version}";
-        sha256 = "1bq37vm5sc46k75n1m6h1n42r3czj957xqjh68z7b2m1xlwp2pbb";
+        sha256 = "1qdzflf1lbi5phg2vs8p3aznz0p8wmmx56qynp1ix008gdypiiix";
       };
 
       beamDeps = [ earmark_parser makeup_elixir makeup_erlang ];
@@ -1076,12 +1076,12 @@ let
 
     phoenix_live_view = buildMix rec {
       name = "phoenix_live_view";
-      version = "0.18.17";
+      version = "0.18.18";
 
       src = fetchHex {
         pkg = "${name}";
         version = "${version}";
-        sha256 = "0f6f7m2naw85qgzh3bsrnwy7l1lwffsbmx3s7g4qv6x234773dgl";
+        sha256 = "052jv2kbc2nb4qs4ly4idcai6q8wyfkvv59adpg9w67kf820v0d5";
       };
 
       beamDeps = [ jason phoenix phoenix_html phoenix_template phoenix_view telemetry ];
@@ -1141,12 +1141,12 @@ let
 
     plug = buildMix rec {
       name = "plug";
-      version = "1.14.0";
+      version = "1.14.2";
 
       src = fetchHex {
         pkg = "${name}";
         version = "${version}";
-        sha256 = "056wkb1b17mh5h9ncs2vbswvpjsm2iqc580nmyrvgznlqwr080mz";
+        sha256 = "04wdyv6nma74bj1m49vkm2bc5mjf8zclfg957fng8g71hw0wabw4";
       };
 
       beamDeps = [ mime plug_crypto telemetry ];
@@ -1154,12 +1154,12 @@ let
 
     plug_cowboy = buildMix rec {
       name = "plug_cowboy";
-      version = "2.6.0";
+      version = "2.6.1";
 
       src = fetchHex {
         pkg = "${name}";
         version = "${version}";
-        sha256 = "19jgv5dm53hv5aqgxxzr3fnrpgfll9ics199swp6iriwfl5z4g07";
+        sha256 = "04v6xc4v741dr2y38j66fmcc4xc037dnaxzkj2vih6j53yif2dny";
       };
 
       beamDeps = [ cowboy cowboy_telemetry plug ];
@@ -1167,12 +1167,12 @@ let
 
     plug_crypto = buildMix rec {
       name = "plug_crypto";
-      version = "1.2.4";
+      version = "1.2.5";
 
       src = fetchHex {
         pkg = "${name}";
         version = "${version}";
-        sha256 = "1k0sx7c64icxcvgvccnpcszqrjg9a75i535ym6flvjdf7zq1br2d";
+        sha256 = "0hnqgzc3zas7j7wycgnkkdhaji5farkqccy2n4p1gqj5ccfrlm16";
       };
 
       beamDeps = [];
@@ -1453,12 +1453,12 @@ let
 
     timex = buildMix rec {
       name = "timex";
-      version = "3.7.9";
+      version = "3.7.11";
 
       src = fetchHex {
         pkg = "${name}";
         version = "${version}";
-        sha256 = "1q8chs28k5my6nzzm61rhc2l9wkhzfn0kiqzf87i71xvwn11asb4";
+        sha256 = "1anijimbrb3ngdy6fdspr8c9hz6dip7nakx0gayzkfmsxzvj944b";
       };
 
       beamDeps = [ combine gettext tzdata ];
diff --git a/pkgs/servers/etcd/3.4.nix b/pkgs/servers/etcd/3.4.nix
index c43821a928ee..cb16aee6c240 100644
--- a/pkgs/servers/etcd/3.4.nix
+++ b/pkgs/servers/etcd/3.4.nix
@@ -2,9 +2,9 @@
 
 buildGoModule rec {
   pname = "etcd";
-  version = "3.4.24";
+  version = "3.4.25";
 
-  vendorHash = "sha256-8fWiei7hZ4NO1CIMPQaRe4gyBF1CUjcqU5Eghyiy64w=";
+  vendorHash = "sha256-duqOIMIXAuJjvKDM15mDdi+LZUZm0uK0MjTv2Dsl3FA=";
 
   doCheck = false;
 
@@ -12,7 +12,7 @@ buildGoModule rec {
     owner = "etcd-io";
     repo = "etcd";
     rev = "v${version}";
-    sha256 = "sha256-jbMwSvCn9y4md60pWd7nF2Ck2XJDkYfg5olr1qVrPd4=";
+    sha256 = "sha256-CReSNWoRN2cBrhVujlAsOaI1gUfws962oLIVGWnLTAQ=";
   };
 
   buildPhase = ''
diff --git a/pkgs/servers/http/router/default.nix b/pkgs/servers/http/router/default.nix
index 517174630f8d..f1e382745179 100644
--- a/pkgs/servers/http/router/default.nix
+++ b/pkgs/servers/http/router/default.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "router";
-  version = "1.15.0";
+  version = "1.15.1";
 
   src = fetchFromGitHub {
     owner = "apollographql";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-TA0HE5zbSSPTq5Z/NP6/s1yqXyCicDmSAgqulmKbQeM=";
+    sha256 = "sha256-xekMw0StdCSI3tls0D2I5rqRV8fVtecGSEzlB3ao6zY=";
   };
 
-  cargoSha256 = "sha256-binpEhtq5tQhSDD2mRKYMdwg9VZlBQZR3xZpOeZNYyY=";
+  cargoSha256 = "sha256-F9MomJQShJUE9QIJJmdFxSs/FVctig17ZclndFl1SUY=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/servers/imgproxy/default.nix b/pkgs/servers/imgproxy/default.nix
index 9ab8e9b44aae..adc4459bd7a8 100644
--- a/pkgs/servers/imgproxy/default.nix
+++ b/pkgs/servers/imgproxy/default.nix
@@ -3,12 +3,12 @@
 
 buildGoModule rec {
   pname = "imgproxy";
-  version = "3.14.0";
+  version = "3.15.0";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
-    sha256 = "sha256-12yThmRsRW0RLNAgafZaciqJP5sRonyrkVSUf+LM7J0=";
+    sha256 = "sha256-Y0QxjIY8ac/6MAdqKDEv3/et1+ysCMkV522jxDP72Js=";
     rev = "v${version}";
   };
 
diff --git a/pkgs/servers/roon-server/default.nix b/pkgs/servers/roon-server/default.nix
index 3f8c5169ff1e..0548ed569038 100644
--- a/pkgs/servers/roon-server/default.nix
+++ b/pkgs/servers/roon-server/default.nix
@@ -15,7 +15,7 @@
 , stdenv
 }:
 let
-  version = "2.0-1244";
+  version = "2.0-1259";
   urlVersion = builtins.replaceStrings [ "." "-" ] [ "00" "0" ] version;
 in
 stdenv.mkDerivation {
@@ -24,7 +24,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://download.roonlabs.com/updates/production/RoonServer_linuxx64_${urlVersion}.tar.bz2";
-    hash = "sha256-godyvkeClBc6AW3WWNYRX+2gqhGWf/Y7xJdX6RfYDn0=";
+    hash = "sha256-nd0dDiiUmwhuVivB78EXdj6LrK0ufdSrVYH/0Y++img=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/servers/tarssh/default.nix b/pkgs/servers/tarssh/default.nix
index 446e187e467a..051ebe964ee2 100644
--- a/pkgs/servers/tarssh/default.nix
+++ b/pkgs/servers/tarssh/default.nix
@@ -1,8 +1,6 @@
 { fetchFromGitHub, rustPlatform, lib }:
 
-with rustPlatform;
-
-buildRustPackage rec {
+rustPlatform.buildRustPackage rec {
   pname = "tarssh";
   version = "0.7.0";
 
diff --git a/pkgs/servers/xmpp/ejabberd/default.nix b/pkgs/servers/xmpp/ejabberd/default.nix
index bec594041037..671e88c52810 100644
--- a/pkgs/servers/xmpp/ejabberd/default.nix
+++ b/pkgs/servers/xmpp/ejabberd/default.nix
@@ -1,36 +1,23 @@
 { stdenv, writeScriptBin, makeWrapper, lib, fetchurl, git, cacert, libpng, libjpeg, libwebp
 , erlang, openssl, expat, libyaml, bash, gnused, gnugrep, coreutils, util-linux, procps, gd
-, flock
+, flock, autoreconfHook
+, nixosTests
 , withMysql ? false
 , withPgsql ? false
 , withSqlite ? false, sqlite
 , withPam ? false, pam
 , withZlib ? true, zlib
-, withIconv ? true
 , withTools ? false
 , withRedis ? false
 }:
 
 let
-  fakegit = writeScriptBin "git" ''
-    #! ${stdenv.shell} -e
-    if [ "$1" = "describe" ]; then
-      [ -r .rev ] && cat .rev || true
-    fi
-  '';
-
   ctlpath = lib.makeBinPath [ bash gnused gnugrep coreutils util-linux procps ];
-
 in stdenv.mkDerivation rec {
-  version = "21.04";
   pname = "ejabberd";
+  version = "23.01";
 
-  src = fetchurl {
-    url = "https://www.process-one.net/downloads/downloads-action.php?file=/${version}/${pname}-${version}.tgz";
-    sha256 = "09s8mj0dkvp9mxazsqxqqmnl5n2xyi8avx0rzgvqrbl3byanzfzr";
-  };
-
-  nativeBuildInputs = [ fakegit makeWrapper ];
+  nativeBuildInputs = [ makeWrapper autoreconfHook ];
 
   buildInputs = [ erlang openssl expat libyaml gd ]
     ++ lib.optional withSqlite sqlite
@@ -38,15 +25,25 @@ in stdenv.mkDerivation rec {
     ++ lib.optional withZlib zlib
   ;
 
+  src = fetchurl {
+    url = "https://www.process-one.net/downloads/downloads-action.php?file=/${version}/ejabberd-${version}.tar.gz";
+    sha256 = "sha256-K4P+A2u/Hbina4b3GP8T3wmPoQxiv88GuB4KZOb2+cA=";
+  };
+
+  passthru.tests = {
+    inherit (nixosTests) ejabberd;
+  };
+
   deps = stdenv.mkDerivation {
     pname = "ejabberd-deps";
-    inherit version;
 
-    inherit src;
+    inherit src version;
 
     configureFlags = [ "--enable-all" "--with-sqlite3=${sqlite.dev}" ];
 
-    nativeBuildInputs = [ git erlang openssl expat libyaml sqlite pam zlib ];
+    nativeBuildInputs = [
+      git erlang openssl expat libyaml sqlite pam zlib autoreconfHook
+    ];
 
     GIT_SSL_CAINFO = "${cacert}/etc/ssl/certs/ca-bundle.crt";
 
@@ -66,25 +63,29 @@ in stdenv.mkDerivation rec {
       cp -r deps $out
     '';
 
-    outputHashMode = "recursive";
+    dontPatchELF = true;
+    dontStrip = true;
+    # avoid /nix/store references in the source
+    dontPatchShebangs = true;
+
     outputHashAlgo = "sha256";
-    outputHash = "1mvixgb46ss35abjwz3lw38c69bii1xyj557a92bvrxc1gc6gx31";
+    outputHashMode = "recursive";
+    outputHash = "sha256-Lj4YSPOiiJQ6uN4cAR+1s/eVSfoIsuvWR7gGkVYrOfc=";
   };
 
-  configureFlags =
-    [ (lib.enableFeature withMysql "mysql")
-      (lib.enableFeature withPgsql "pgsql")
-      (lib.enableFeature withSqlite "sqlite")
-      (lib.enableFeature withPam "pam")
-      (lib.enableFeature withZlib "zlib")
-      (lib.enableFeature withIconv "iconv")
-      (lib.enableFeature withTools "tools")
-      (lib.enableFeature withRedis "redis")
-    ] ++ lib.optional withSqlite "--with-sqlite3=${sqlite.dev}";
+  configureFlags = [
+    (lib.enableFeature withMysql "mysql")
+    (lib.enableFeature withPgsql "pgsql")
+    (lib.enableFeature withSqlite "sqlite")
+    (lib.enableFeature withPam "pam")
+    (lib.enableFeature withZlib "zlib")
+    (lib.enableFeature withTools "tools")
+    (lib.enableFeature withRedis "redis")
+  ] ++ lib.optional withSqlite "--with-sqlite3=${sqlite.dev}";
 
   enableParallelBuilding = true;
 
-  preBuild = ''
+  postPatch = ''
     cp -r $deps deps
     chmod -R +w deps
     patchShebangs .
diff --git a/pkgs/shells/carapace/default.nix b/pkgs/shells/carapace/default.nix
index 829e23acf6bb..3fac72e2430e 100644
--- a/pkgs/shells/carapace/default.nix
+++ b/pkgs/shells/carapace/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "carapace";
-  version = "0.24.1";
+  version = "0.24.4";
 
   src = fetchFromGitHub {
     owner = "rsteube";
     repo = "${pname}-bin";
     rev = "v${version}";
-    sha256 = "sha256-eJD+7J5R+Oomj4QbOj5QHB30F0jpWmnkbl6bhVOEgDU=";
+    sha256 = "sha256-UEvmaUr/3Fq92HSfBPxSpfuo5mp5zMSYGZu2HLZvUq0=";
   };
 
-  vendorHash = "sha256-UMRAyUcGxPsW4Q7o5KtXMmdcuY+DEGhbm4jPBVLOLGQ=";
+  vendorHash = "sha256-4Q8yBDds2EIxt5Caxoq8hk4X6ADwVe04P3Jt3L+Qf0M=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/tools/admin/auth0-cli/default.nix b/pkgs/tools/admin/auth0-cli/default.nix
index 0509173650de..b21f5eb4ad47 100644
--- a/pkgs/tools/admin/auth0-cli/default.nix
+++ b/pkgs/tools/admin/auth0-cli/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "auth0-cli";
-  version = "0.13.1";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "auth0";
     repo = "auth0-cli";
     rev = "v${version}";
-    hash = "sha256-FotjdMbQXDwkURSeye86sIFN60V//UlF7kZrwfkvTGY=";
+    hash = "sha256-Zrv9Dj4TqMEgnWYNvBUbrPS6Ab23AkCn66hclPKH224=";
   };
 
-  vendorHash = "sha256-2lu8mlADpTjp11S/chz9Ow5W5dw5l6llitJxamNiyLg=";
+  vendorHash = "sha256-MGMmWCe2LVIpK7O1e90Nvahbnu5sm9vK/4s0lPPpl1g=";
 
   ldflags = [
     "-s" "-w"
diff --git a/pkgs/tools/admin/clair/default.nix b/pkgs/tools/admin/clair/default.nix
index bfdbc45507f4..a12049e6fea7 100644
--- a/pkgs/tools/admin/clair/default.nix
+++ b/pkgs/tools/admin/clair/default.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "clair";
-  version = "4.6.0";
+  version = "4.6.1";
 
   src = fetchFromGitHub {
     owner = "quay";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-Dl1wwK4OSv/nvhT7bH6qOdX4/qL3xFdmz5qiYaEm59Y=";
+    hash = "sha256-yh617C99WSi//3YBIim5QLJTh8KgVcMkgG6AqRJYVvA=";
   };
 
-  vendorHash = "sha256-NqEpJHBZfzUQJ+H8CQBDdb37nlwA+JuXhZzfCAyO0Co=";
+  vendorHash = "sha256-V9Y+dZv3RKiyzGJB1o4+M4QQeRpBkCtJOr2zyjTCKTY=";
 
   nativeBuildInputs = [
     makeWrapper
diff --git a/pkgs/tools/admin/eksctl/default.nix b/pkgs/tools/admin/eksctl/default.nix
index 42846d9c0a36..85d72b1b56f1 100644
--- a/pkgs/tools/admin/eksctl/default.nix
+++ b/pkgs/tools/admin/eksctl/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "eksctl";
-  version = "0.136.0";
+  version = "0.137.0";
 
   src = fetchFromGitHub {
     owner = "weaveworks";
     repo = pname;
     rev = version;
-    hash = "sha256-KWWMogB2yTu6FYU0BYkhY0VfAg7ppQqTmtrlvD2cds0=";
+    hash = "sha256-OTTEJugF/yur3n6LZ1ESJV03DzFEvQ4HXCFUDLrTbYg=";
   };
 
-  vendorHash = "sha256-WJiCK5DVsCU+aBlkhpHISuY8MxDxJiVK1nKtY8uxziI=";
+  vendorHash = "sha256-q+xLO1oppamR34TMFEajY/D+3nPcXDW0oeA/pzS8hI0=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/admin/fastlane/Gemfile.lock b/pkgs/tools/admin/fastlane/Gemfile.lock
index c441e996300a..7fcce64ecd7d 100644
--- a/pkgs/tools/admin/fastlane/Gemfile.lock
+++ b/pkgs/tools/admin/fastlane/Gemfile.lock
@@ -3,21 +3,21 @@ GEM
   specs:
     CFPropertyList (3.0.6)
       rexml
-    addressable (2.8.1)
+    addressable (2.8.4)
       public_suffix (>= 2.0.2, < 6.0)
     artifactory (3.0.15)
     atomos (0.1.3)
     aws-eventstream (1.2.0)
-    aws-partitions (1.716.0)
-    aws-sdk-core (3.170.0)
+    aws-partitions (1.748.0)
+    aws-sdk-core (3.171.0)
       aws-eventstream (~> 1, >= 1.0.2)
       aws-partitions (~> 1, >= 1.651.0)
       aws-sigv4 (~> 1.5)
       jmespath (~> 1, >= 1.6.1)
-    aws-sdk-kms (1.62.0)
+    aws-sdk-kms (1.63.0)
       aws-sdk-core (~> 3, >= 3.165.0)
       aws-sigv4 (~> 1.1)
-    aws-sdk-s3 (1.119.1)
+    aws-sdk-s3 (1.120.1)
       aws-sdk-core (~> 3, >= 3.165.0)
       aws-sdk-kms (~> 1)
       aws-sigv4 (~> 1.4)
@@ -66,7 +66,7 @@ GEM
     faraday_middleware (1.2.0)
       faraday (~> 1.0)
     fastimage (2.2.6)
-    fastlane (2.212.1)
+    fastlane (2.212.2)
       CFPropertyList (>= 2.3, < 4.0.0)
       addressable (>= 2.8, < 3.0.0)
       artifactory (~> 3.0)
@@ -106,8 +106,8 @@ GEM
       xcpretty (~> 0.3.0)
       xcpretty-travis-formatter (>= 0.0.3)
     gh_inspector (1.1.3)
-    google-apis-androidpublisher_v3 (0.34.0)
-      google-apis-core (>= 0.9.1, < 2.a)
+    google-apis-androidpublisher_v3 (0.39.0)
+      google-apis-core (>= 0.11.0, < 2.a)
     google-apis-core (0.11.0)
       addressable (~> 2.5, >= 2.5.1)
       googleauth (>= 0.16.2, < 2.a)
@@ -119,8 +119,8 @@ GEM
       webrick
     google-apis-iamcredentials_v1 (0.17.0)
       google-apis-core (>= 0.11.0, < 2.a)
-    google-apis-playcustomapp_v1 (0.12.0)
-      google-apis-core (>= 0.9.1, < 2.a)
+    google-apis-playcustomapp_v1 (0.13.0)
+      google-apis-core (>= 0.11.0, < 2.a)
     google-apis-storage_v1 (0.19.0)
       google-apis-core (>= 0.9.0, < 2.a)
     google-cloud-core (1.6.0)
@@ -128,7 +128,7 @@ GEM
       google-cloud-errors (~> 1.0)
     google-cloud-env (1.6.0)
       faraday (>= 0.17.3, < 3.0)
-    google-cloud-errors (1.3.0)
+    google-cloud-errors (1.3.1)
     google-cloud-storage (1.44.0)
       addressable (~> 2.8)
       digest-crc (~> 0.4)
@@ -137,7 +137,7 @@ GEM
       google-cloud-core (~> 1.6)
       googleauth (>= 0.16.2, < 2.a)
       mini_mime (~> 1.0)
-    googleauth (1.3.0)
+    googleauth (1.5.2)
       faraday (>= 0.17.3, < 3.a)
       jwt (>= 1.4, < 3.0)
       memoist (~> 0.16)
@@ -215,4 +215,4 @@ DEPENDENCIES
   fastlane
 
 BUNDLED WITH
-   2.4.6
+   2.4.10
diff --git a/pkgs/tools/admin/fastlane/gemset.nix b/pkgs/tools/admin/fastlane/gemset.nix
index 5bd70e1f6ad8..7addbdeb9985 100644
--- a/pkgs/tools/admin/fastlane/gemset.nix
+++ b/pkgs/tools/admin/fastlane/gemset.nix
@@ -5,10 +5,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1ypdmpdn20hxp5vwxz3zc04r5xcwqc25qszdlg41h8ghdqbllwmw";
+      sha256 = "15s8van7r2ad3dq6i03l3z4hqnvxcq75a3h72kxvf9an53sqma20";
       type = "gem";
     };
-    version = "2.8.1";
+    version = "2.8.4";
   };
   artifactory = {
     groups = ["default"];
@@ -45,10 +45,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1dy4pxcblfl67gdw64ffjh9zxv10nnjszri861f8xa6cfqr3hqp1";
+      sha256 = "12pi6xcvwaplzgy24vqiw2q9aaxs5r8gl92kv2gy6riqldgs10gi";
       type = "gem";
     };
-    version = "1.716.0";
+    version = "1.748.0";
   };
   aws-sdk-core = {
     dependencies = ["aws-eventstream" "aws-partitions" "aws-sigv4" "jmespath"];
@@ -56,10 +56,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0zc4zhv2wq7s5p8c9iaplama1lpg2kwldg81j83c8w4xydf1wd2r";
+      sha256 = "0732vv8zi67z25fss1sdvqx0vv1ap3w6hz1avxzwznkjp002vj39";
       type = "gem";
     };
-    version = "3.170.0";
+    version = "3.171.0";
   };
   aws-sdk-kms = {
     dependencies = ["aws-sdk-core" "aws-sigv4"];
@@ -67,10 +67,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "070s86pxrbq98iddq6shdq7g0lrzgsdqnsnc5l4kygvqimliq4dr";
+      sha256 = "0v87zi28dfmrv7bv91yfldccnpd63n295siirbz7wqv1rajn8n02";
       type = "gem";
     };
-    version = "1.62.0";
+    version = "1.63.0";
   };
   aws-sdk-s3 = {
     dependencies = ["aws-sdk-core" "aws-sdk-kms" "aws-sigv4"];
@@ -78,10 +78,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1rpnlzsl52znhcki13jkwdshgwf51pn26267481f4fa842gr7xgp";
+      sha256 = "1mapdzm97rv22pca1hvvshwsafa12gd2yv2fcy63dfjn5vjjq893";
       type = "gem";
     };
-    version = "1.119.1";
+    version = "1.120.1";
   };
   aws-sigv4 = {
     dependencies = ["aws-eventstream"];
@@ -368,10 +368,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0b22m2dkydyv2si55b1jzznzgxf2ycx2aarv1j5p25k861h2gsml";
+      sha256 = "15sa3v3aaslympg9nmadmpxpbzykdiybzxn3navc7mf0iscb3q7s";
       type = "gem";
     };
-    version = "2.212.1";
+    version = "2.212.2";
   };
   gh_inspector = {
     groups = ["default"];
@@ -389,10 +389,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "09almff2kzdkciai63365q18wy0dfjhj48h8wa7lk77pjbfxgqfp";
+      sha256 = "0wzsrh3k07x2vxw649hwwylfij1pbmiivcm4ihiiizz778jrwhn4";
       type = "gem";
     };
-    version = "0.34.0";
+    version = "0.39.0";
   };
   google-apis-core = {
     dependencies = ["addressable" "googleauth" "httpclient" "mini_mime" "representable" "retriable" "rexml" "webrick"];
@@ -422,10 +422,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1kq1hfzg3i5i9fml7f6ffpihy340h23w2gcgqdkdhqgc5zd7nq0s";
+      sha256 = "1mlgwiid5lgg41y7qk8ca9lzhwx5njs25hz5fbf1mdal0kwm37lm";
       type = "gem";
     };
-    version = "0.12.0";
+    version = "0.13.0";
   };
   google-apis-storage_v1 = {
     dependencies = ["google-apis-core"];
@@ -465,10 +465,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0jynh1s93nl8njm5l5wcy86pnjmv112cq6m0443s52f04hg6h2s5";
+      sha256 = "0flpj7v196c3xsqx4yjb7rjcj8p0by4rhj6qf5zanw4p1i41ssf0";
       type = "gem";
     };
-    version = "1.3.0";
+    version = "1.3.1";
   };
   google-cloud-storage = {
     dependencies = ["addressable" "digest-crc" "google-apis-iamcredentials_v1" "google-apis-storage_v1" "google-cloud-core" "googleauth" "mini_mime"];
@@ -487,10 +487,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1hpwgwhk0lmnknkw8kbdfxn95qqs6aagpq815l5fkw9w6mi77pai";
+      sha256 = "1lj5haarpn7rybbq9s031zcn9ji3rlz5bk64bwa2j34q5s1h5gis";
       type = "gem";
     };
-    version = "1.3.0";
+    version = "1.5.2";
   };
   highline = {
     groups = ["default"];
diff --git a/pkgs/tools/filesystems/securefs/add-macfuse-support.patch b/pkgs/tools/filesystems/securefs/add-macfuse-support.patch
deleted file mode 100644
index 217f637ff9db..000000000000
--- a/pkgs/tools/filesystems/securefs/add-macfuse-support.patch
+++ /dev/null
@@ -1,188 +0,0 @@
-From 8c65c2219976c02a68e27c28156ec0c4c02857e0 Mon Sep 17 00:00:00 2001
-From: midchildan <git@midchildan.org>
-Date: Sun, 28 Mar 2021 23:39:59 +0900
-Subject: [PATCH] Support the latest FUSE on macOS
-
-This drops osxfuse support in favor of macFUSE. macFUSE is a newer
-version of osxfuse that supports the latest release of macOS, and is a
-rebranded version of the same project.
----
- CMakeLists.txt             |  8 ++----
- LICENSE.md                 | 58 ++++++++++++++++++++------------------
- README.md                  |  2 +-
- sources/commands.cpp       |  6 ----
- 4 files changed, 33 insertions(+), 41 deletions(-)
-
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 7b5e57d..c176554 100755
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -18,12 +18,8 @@ git_describe(GIT_VERSION --tags)
- configure_file(${CMAKE_SOURCE_DIR}/sources/git-version.cpp.in ${CMAKE_BINARY_DIR}/git-version.cpp)
- 
- if (UNIX)
--    find_path(FUSE_INCLUDE_DIR fuse.h PATHS /usr/local/include PATH_SUFFIXES osxfuse)
--    if (APPLE)
--        find_library(FUSE_LIBRARIES osxfuse PATHS /usr/local/lib)
--    else()
--        find_library(FUSE_LIBRARIES fuse PATHS /usr/local/lib)
--    endif()
-+    find_path(FUSE_INCLUDE_DIR fuse.h PATHS /usr/local/include)
-+    find_library(FUSE_LIBRARIES fuse PATHS /usr/local/lib)
-     include_directories(${FUSE_INCLUDE_DIR})
-     link_libraries(${FUSE_LIBRARIES})
-     add_compile_options(-Wall -Wextra -Wno-unknown-pragmas)
-diff --git a/LICENSE.md b/LICENSE.md
-index a8f920c..b134532 100644
---- a/LICENSE.md
-+++ b/LICENSE.md
-@@ -758,13 +758,11 @@ Public License instead of this License.
- 
- ------------------------------------------------------------------------------
- 
--# [osxfuse] (https://github.com/osxfuse/osxfuse)
-+# [macFUSE] (https://github.com/osxfuse/osxfuse)
- 
--FUSE for macOS is a software developed by the osxfuse project and is covered
--under the following BSD-style license:
-+macFUSE is covered under the following license:
- 
--  Copyright (c) 2011-2016 Benjamin Fleischer
--  Copyright (c) 2011-2012 Erik Larsson
-+  Copyright (c) 2011-2021 Benjamin Fleischer
-   All rights reserved.
- 
-   Redistribution  and  use  in  source  and  binary  forms,  with   or   without
-@@ -775,9 +773,13 @@ under the following BSD-style license:
-   2. Redistributions in binary form must reproduce the above  copyright  notice,
-      this list of conditions and the following disclaimer in  the  documentation
-      and/or other materials provided with the distribution.
--  3. Neither the name of osxfuse nor the names of its contributors may  be  used
--     to endorse or promote products derived from this software without  specific
--     prior written permission.
-+  3. Neither the name of the copyright holder nor the names of its  contributors
-+     may be used to endorse or  promote  products  derived  from  this  software 
-+     without specific prior written permission.
-+  4. Redistributions in binary form, bundled with commercial software,  are  not
-+     allowed without  specific  prior  written  permission.  This  includes  the
-+     automated download or installation or  both  of  the  binary  form  in  the
-+     context of commercial software.
- 
-   THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND  CONTRIBUTORS  "AS  IS"
-   AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING,  BUT  NOT  LIMITED  TO,  THE
-@@ -791,9 +793,9 @@ under the following BSD-style license:
-   ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN  IF  ADVISED  OF  THE
-   POSSIBILITY OF SUCH DAMAGE.
- 
--FUSE for macOS is a fork of MacFUSE. MacFUSE has been developed by Google Inc..
--Additional information and the original source of MacFUSE are available on
--http://code.google.com/p/macfuse/. MacFUSE is covered under the following
-+macFUSE is a fork of the legacy Google MacFUSE software. Additional information
-+and the original source code of Google MacFUSE are available on
-+http://code.google.com/p/macfuse/. Google MacFUSE is covered under the following
- BSD-style license:
- 
-   Copyright (c) 2007—2009 Google Inc.
-@@ -830,9 +832,9 @@ BSD-style license:
- Portions of this package were derived from code developed by other authors.
- Please read further for specific details.
- 
--* Unless otherwise noted, parts of the FUSE for macOS kernel extension contain
--  code derived from the FreeBSD version of FUSE, which is covered under the
--  following BSD-style license:
-+* Unless otherwise noted, parts of the macFUSE kernel extension contain code
-+  derived from the FreeBSD version of FUSE, which is covered under the following
-+  BSD-style license:
- 
-     Copyright (C) 2005 Csaba Henk. All rights reserved.
- 
-@@ -856,12 +858,13 @@ Please read further for specific details.
-     (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT  OF  THE  USE  OF
-     THIS  SOFTWARE,  EVEN  IF  ADVISED  OF  THE  POSSIBILITY  OF  SUCH   DAMAGE.
- 
--* Parts of the FUSE for macOS kernel extension contain code derived from Tuxera
--  Inc.'s "rebel" branch. The original source of the "rebel" branch is available
--  on https://github.com/tuxera. These modifications are covered under the
--  following BSD-style license:
-+* Parts of the macFUSE kernel extension contain code derived from Tuxera's
-+  "rebel" branch. The original source code of the "rebel" branch is available on
-+  https://github.com/tuxera. These modifications are covered under the following
-+  BSD-style license:
- 
-     Copyright (c) 2010 Tuxera Inc.
-+    Copyright (c) 2011-2012 Erik Larsson
-     All rights reserved.
- 
-     Redistribution  and  use  in  source  and  binary  forms,  with  or  without
-@@ -888,9 +891,9 @@ Please read further for specific details.
-     ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED  OF  THE
-     POSSIBILITY OF SUCH DAMAGE.
- 
--* Parts of FUSE for macOS contain code derived from Fuse4X. The original source
--  of Fuse4X is available on https://github.com/fuse4x. Fuse4X is covered under
--  the following BSD-style license:
-+* Parts of macFUSE contain code derived from Fuse4X. The original source code of
-+  Fuse4X is available on https://github.com/fuse4x. Fuse4X is covered under the
-+  following BSD-style license:
- 
-     Copyright (c) 2011 Anatol Pomozov
-     All rights reserved.
-@@ -916,21 +919,20 @@ Please read further for specific details.
-     ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED  OF  THE
-     POSSIBILITY OF SUCH DAMAGE.
- 
--* Parts of the mount_osxfuse command-line program are covered under the Apple
-+* Parts of the mount_macfuse command-line program are covered under the Apple
-   Public Source License (APSL). You can read the APSL at:
- 
-     http://www.opensource.apple.com/license/apsl/
- 
--* fuse_kernel.h is an unmodified copy of the interface header from the Linux
-+* fuse_kernel.h is a modified copy of the interface header from the Linux
-   FUSE distribution (https://github.com/libfuse/libfuse). fuse_kernel.h can be
-   redistributed either under the GPL or under the BSD license. It is being
-   redistributed here under the BSD license.
- 
--* fuse_nodehash.c is a slightly modified version of HashNode.c from an
--  Apple Developer Technical Support (DTS) sample code example. The original
--  source, which is available on
--  http://developer.apple.com/library/mac/#samplecode/MFSLives/, has the
--  following disclaimer:
-+* fuse_nodehash.c is a modified version of HashNode.c from an Apple Developer
-+  Technical Support (DTS) sample code example. The original source, which is
-+  available on http://developer.apple.com/library/mac/#samplecode/MFSLives/,
-+  has the following disclaimer:
- 
-     Disclaimer: IMPORTANT: This Apple software  is  supplied  to  you  by  Apple
-     Computer, Inc.  Apple") in consideration of your agreement to the  following
-diff --git a/README.md b/README.md
-index 9085e96..6fe3592 100644
---- a/README.md
-+++ b/README.md
-@@ -28,7 +28,7 @@ There are already many encrypting filesystem in widespread use. Some notable one
- 
- ### macOS
- 
--Install with [Homebrew](https://brew.sh). [osxfuse](https://osxfuse.github.io) has to be installed beforehand.
-+Install with [Homebrew](https://brew.sh). [macFUSE](https://osxfuse.github.io) has to be installed beforehand.
- ```
- brew install securefs
- ```
-diff --git a/sources/commands.cpp b/sources/commands.cpp
-index a371212..862602b 100644
---- a/sources/commands.cpp
-+++ b/sources/commands.cpp
-@@ -1252,12 +1252,6 @@ class VersionCommand : public CommandBase
-                 printf("WinFsp %u.%u\n", vn >> 16, vn & 0xFFFFu);
-             }
-         }
--#elif defined(__APPLE__)
--        typedef const char* version_function(void);
--        auto osx_version_func
--            = reinterpret_cast<version_function*>(::dlsym(RTLD_DEFAULT, "osxfuse_version"));
--        if (osx_version_func)
--            printf("osxfuse %s\n", osx_version_func());
- #else
-         typedef int version_function(void);
-         auto fuse_version_func
-
diff --git a/pkgs/tools/filesystems/securefs/default.nix b/pkgs/tools/filesystems/securefs/default.nix
index 5fad07d87b73..791c01d8eed8 100644
--- a/pkgs/tools/filesystems/securefs/default.nix
+++ b/pkgs/tools/filesystems/securefs/default.nix
@@ -1,29 +1,22 @@
-{ lib, stdenv, fetchFromGitHub
+{ lib
+, stdenv
+, fetchFromGitHub
 , cmake
-, fuse }:
+, fuse
+}:
 
 stdenv.mkDerivation rec {
   pname = "securefs";
-  version = "0.11.1";
+  version = "0.13.1";
 
   src = fetchFromGitHub {
-    sha256 = "1sxfgqgy63ml7vg7zj3glvra4wj2qmfv9jzmpm1jqy8hq7qlqlsx";
-    rev = version;
-    repo = "securefs";
     owner = "netheril96";
+    repo = "securefs";
+    rev = version;
     fetchSubmodules = true;
+    hash = "sha256-7xjGuN7jcLgfGkaBoSj+WsBpM806PPGzeBs7DnI+fwc=";
   };
 
-  patches = [
-    # Make it build with macFUSE
-    # Backported from https://github.com/netheril96/securefs/pull/114
-    ./add-macfuse-support.patch
-  ];
-
-  postPatch = ''
-    sed -i -e '/TEST_SOURCES/d' CMakeLists.txt
-  '';
-
   nativeBuildInputs = [ cmake ];
   buildInputs = [ fuse ];
 
@@ -42,7 +35,5 @@ stdenv.mkDerivation rec {
     '';
     license = with licenses; [ bsd2 mit ];
     platforms = platforms.unix;
-    # never built on aarch64-darwin since first introduction in nixpkgs
-    broken = stdenv.isDarwin && stdenv.isAarch64;
   };
 }
diff --git a/pkgs/tools/inputmethods/ibus/default.nix b/pkgs/tools/inputmethods/ibus/default.nix
index e3b4acf7f28d..140ca8c86ea8 100644
--- a/pkgs/tools/inputmethods/ibus/default.nix
+++ b/pkgs/tools/inputmethods/ibus/default.nix
@@ -1,6 +1,7 @@
 { lib, stdenv
 , substituteAll
 , fetchFromGitHub
+, fetchpatch
 , autoreconfHook
 , gettext
 , makeWrapper
@@ -56,13 +57,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "ibus";
-  version = "1.5.27";
+  version = "1.5.28";
 
   src = fetchFromGitHub {
     owner = "ibus";
     repo = "ibus";
     rev = version;
-    sha256 = "sha256-DwX7SYRb18C0Lz2ySPS3yV99Q1xQezs0Ls2P7Rbtk5Q=";
+    sha256 = "sha256-zjV+QkhVkrHFs9Vt1FpbvmS4nRHxwKaKU3mQkSgyLaQ=";
   };
 
   patches = [
@@ -72,6 +73,12 @@ stdenv.mkDerivation rec {
       pythonSitePackages = python3.sitePackages;
     })
     ./build-without-dbus-launch.patch
+    # unicode and emoji input are broken before 1.5.29
+    # https://github.com/NixOS/nixpkgs/issues/226526
+    (fetchpatch {
+      url = "https://github.com/ibus/ibus/commit/7c8abbe89403c2fcb08e3fda42049a97187e53ab.patch";
+      hash = "sha256-59HzAdLq8ahrF7K+tFGLjTodwIiTkJGEkFe8quqIkhU=";
+    })
   ];
 
   outputs = [ "out" "dev" "installedTests" ];
@@ -98,6 +105,12 @@ stdenv.mkDerivation rec {
     "--with-ucd-dir=${unicode-character-database}/share/unicode"
   ];
 
+  # missing make dependency
+  # https://github.com/NixOS/nixpkgs/pull/218120#issuecomment-1514027173
+  preBuild = ''
+    make -C src ibusenumtypes.h
+  '';
+
   makeFlags = [
     "test_execsdir=${placeholder "installedTests"}/libexec/installed-tests/ibus"
     "test_sourcesdir=${placeholder "installedTests"}/share/installed-tests/ibus"
diff --git a/pkgs/tools/misc/cpuminer/default.nix b/pkgs/tools/misc/cpuminer/default.nix
index 69fcb76cf649..28335ccb4481 100644
--- a/pkgs/tools/misc/cpuminer/default.nix
+++ b/pkgs/tools/misc/cpuminer/default.nix
@@ -1,5 +1,7 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchFromGitHub
+, fetchpatch
 , curl
 , jansson
 , perl
@@ -17,7 +19,15 @@ stdenv.mkDerivation rec {
     sha256 = "0f44i0z8rid20c2hiyp92xq0q0mjj537r05sa6vdbc0nl0a5q40i";
   };
 
-  patchPhase = if stdenv.cc.isClang then "${perl}/bin/perl ./nomacro.pl" else null;
+  patches = [
+    (fetchpatch {
+      name = "fix-build-on-aarch64.patch";
+      url = "https://github.com/pooler/cpuminer/commit/5f02105940edb61144c09a7eb960bba04a10d5b7.patch";
+      hash = "sha256-lGAcwDcXgcJBFhasSEdQIEIY7pp6x/PEXHBsVwAOqhc=";
+    })
+  ];
+
+  postPatch = if stdenv.cc.isClang then "${perl}/bin/perl ./nomacro.pl" else null;
 
   nativeBuildInputs = [ autoreconfHook ];
   buildInputs = [ curl jansson ];
@@ -30,7 +40,5 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2;
     platforms = platforms.all;
     maintainers = with maintainers; [ pSub ];
-    # never built on aarch64-darwin since first introduction in nixpkgs
-    broken = stdenv.isDarwin && stdenv.isAarch64;
   };
 }
diff --git a/pkgs/tools/misc/ffsend/default.nix b/pkgs/tools/misc/ffsend/default.nix
index 1aedac7ca16f..a96492246d21 100644
--- a/pkgs/tools/misc/ffsend/default.nix
+++ b/pkgs/tools/misc/ffsend/default.nix
@@ -13,9 +13,7 @@ in
 
 assert (x11Support && usesX11) -> xclip != null || xsel != null;
 
-with rustPlatform;
-
-buildRustPackage rec {
+rustPlatform.buildRustPackage rec {
   pname = "ffsend";
   version = "0.2.76";
 
diff --git a/pkgs/tools/misc/fluent-bit/default.nix b/pkgs/tools/misc/fluent-bit/default.nix
index 471bd9d62e6e..7df58d84b819 100644
--- a/pkgs/tools/misc/fluent-bit/default.nix
+++ b/pkgs/tools/misc/fluent-bit/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fluent-bit";
-  version = "2.0.10";
+  version = "2.0.11";
 
   src = fetchFromGitHub {
     owner = "fluent";
     repo = "fluent-bit";
     rev = "v${version}";
-    sha256 = "sha256-6bmtSsNjSy7+Q2MWJdrP+zaXKwV4CEiBjhdZju+RBLI=";
+    sha256 = "sha256-/LkQnS3NMvZf0yP6X32sayXvUDd0et5VkCWvJe4GboI=";
   };
 
   nativeBuildInputs = [ cmake flex bison ];
diff --git a/pkgs/tools/misc/gparted/default.nix b/pkgs/tools/misc/gparted/default.nix
index f6b5d9f5041b..278dced6b644 100644
--- a/pkgs/tools/misc/gparted/default.nix
+++ b/pkgs/tools/misc/gparted/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, intltool, gettext, coreutils, gnused, gnome
+{ lib, stdenv, fetchurl, gettext, coreutils, gnused, gnome
 , gnugrep, parted, glib, libuuid, pkg-config, gtkmm3, libxml2
 , gpart, hdparm, procps, util-linux, polkit, wrapGAppsHook, substituteAll
 , mtools, dosfstools
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gparted";
-  version = "1.4.0";
+  version = "1.5.0";
 
   src = fetchurl {
     url = "mirror://sourceforge/gparted/${pname}-${version}.tar.gz";
-    sha256 = "sha256-5Sk6eS5T/b66KcSoNBE82WA9DWOTMNqTGkaL82h4h74=";
+    sha256 = "sha256-PJXqJqlECD/x2bF2ObHirZdY3yJdx1H/QHsqaqCSqN4=";
   };
 
   # Tries to run `pkexec --version` to get version.
@@ -28,7 +28,12 @@ stdenv.mkDerivation rec {
   configureFlags = [ "--disable-doc" ];
 
   buildInputs = [ parted glib libuuid gtkmm3 libxml2 polkit.bin gnome.adwaita-icon-theme  ];
-  nativeBuildInputs = [ intltool gettext pkg-config wrapGAppsHook ];
+  nativeBuildInputs = [ gettext pkg-config wrapGAppsHook ];
+
+  preConfigure = ''
+    # For ITS rules
+    addToSearchPath "XDG_DATA_DIRS" "${polkit.out}/share"
+  '';
 
   preFixup = ''
     gappsWrapperArgs+=(
diff --git a/pkgs/tools/misc/halp/default.nix b/pkgs/tools/misc/halp/default.nix
index d166df30908f..90b51e9b50d0 100644
--- a/pkgs/tools/misc/halp/default.nix
+++ b/pkgs/tools/misc/halp/default.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "halp";
-  version = "0.1.5";
+  version = "0.1.6";
 
   src = fetchFromGitHub {
     owner = "orhun";
     repo = "halp";
     rev = "v${version}";
-    hash = "sha256-Iowo3IBYnLCLnILIBithJejqDkzszCEgufcOcv2pVHI=";
+    hash = "sha256-VGfZwXB2MM8dfjc89LjHBalNFTvp6B6KI0lPOlkHDOQ=";
   };
 
-  cargoHash = "sha256-YWMcY8tc/XAm7tMxGD+TyowTisDlcdVI/GXMDR7m/kQ=";
+  cargoHash = "sha256-beYDb8+UKPLkkzey95Da8Ft2NwH2JZZsBLNvoW8FJN4=";
 
   patches = [
     # patch tests to point to the correct target directory
diff --git a/pkgs/tools/misc/mmctl/default.nix b/pkgs/tools/misc/mmctl/default.nix
index a708e9e694eb..16b142d76cb5 100644
--- a/pkgs/tools/misc/mmctl/default.nix
+++ b/pkgs/tools/misc/mmctl/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "mmctl";
-  version = "7.5.2";
+  version = "7.10.0";
 
   src = fetchFromGitHub {
     owner = "mattermost";
     repo = "mmctl";
     rev = "v${version}";
-    sha256 = "sha256-qBt7YL4u/gt7pPjqXLvjtTH6Dhr3udcqAD1/VjxyJPg=";
+    sha256 = "sha256-ptkpPwTSoWZhcPAFfBhB73F/eubzzeGPI99K/K3ZT64=";
   };
 
-  vendorSha256 = null;
+  vendorHash = null;
 
   checkPhase = "make test";
 
diff --git a/pkgs/tools/misc/peep/default.nix b/pkgs/tools/misc/peep/default.nix
index 6fdacce9e5f1..1ecad087ccfb 100644
--- a/pkgs/tools/misc/peep/default.nix
+++ b/pkgs/tools/misc/peep/default.nix
@@ -2,21 +2,22 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "peep";
-  version = "0.1.4-post.2021-08-17";
+  version = "0.1.6";
 
   src = fetchFromGitHub {
     owner = "ryochack";
     repo = "peep";
-    rev = "0eceafe16ff1f9c6d6784cca75b6f612c38901c4";
-    sha256 = "sha256-HtyT9kFS7derPhiBzICHIz3AvYVcYpUj1OW+t5RivRs=";
+    rev = "v${version}";
+    hash = "sha256-6Y7ZI0kIPE7uMMOkXgm75JMEec090xZPBJFJr9DaswA=";
   };
 
-  cargoSha256 = "sha256-sHsmHCMuHc56Mkqk2NUtZgC0RGyqhPvW1fKHkEAhqYk=";
+  cargoHash = "sha256-CDWa03H8vWfhx2dwZU5rAV3fSwAGqCIPcvl+lTG4npE=";
 
   meta = with lib; {
     description = "The CLI text viewer tool that works like less command on small pane within the terminal window";
-    license = licenses.mit;
     homepage = "https://github.com/ryochack/peep";
-    maintainers = with maintainers; [ ];
+    changelog = "https://github.com/ryochack/peep/releases/tag/${src.rev}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ figsoda ];
   };
 }
diff --git a/pkgs/tools/misc/steampipe/default.nix b/pkgs/tools/misc/steampipe/default.nix
index 6968fff13e7d..ad4fdb58f714 100644
--- a/pkgs/tools/misc/steampipe/default.nix
+++ b/pkgs/tools/misc/steampipe/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "steampipe";
-  version = "0.19.3";
+  version = "0.19.4";
 
   src = fetchFromGitHub {
     owner = "turbot";
     repo = "steampipe";
     rev = "v${version}";
-    sha256 = "sha256-RbtIDgTVS/vtYQpbTQ7Yl7oBtC8c6D9Pns9SdEjUsmI=";
+    sha256 = "sha256-VfSCm+p702HgFgiKRjcRHiBOd6Dx9ld8T27U9jmuC+8=";
   };
 
   vendorHash = "sha256-XrEdaNLG46BwMEF/vhAk9+A6vH4mpbtH7vWXd01Y7ME=";
diff --git a/pkgs/tools/networking/dae/default.nix b/pkgs/tools/networking/dae/default.nix
index cf193b73c76a..0aaaa697d2b1 100644
--- a/pkgs/tools/networking/dae/default.nix
+++ b/pkgs/tools/networking/dae/default.nix
@@ -5,17 +5,17 @@
 }:
 buildGoModule rec {
   pname = "dae";
-  version = "0.1.5";
+  version = "0.1.7";
 
   src = fetchFromGitHub {
     owner = "daeuniverse";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-EoStRmyYOtvG5ejtvHWNe9IIeE77hqp1OXBhRdxCYHs=";
+    sha256 = "sha256-J/LKVmWda88kaLY1w0elEoksrWswDvuhb6RTZvl6uH0=";
     fetchSubmodules = true;
   };
 
-  vendorHash = "sha256-vxHufE3538l6zIcozFcrNhl+2sG1PtzkVxC0NyL3WMU=";
+  vendorHash = "sha256-euTgB660px8J/3D3n+jzyetzzs6uD6yrXGvIgqzQcR0=";
 
   proxyVendor = true;
 
diff --git a/pkgs/tools/networking/drill/default.nix b/pkgs/tools/networking/drill/default.nix
index a0ca8453ec92..032ce0be5e22 100644
--- a/pkgs/tools/networking/drill/default.nix
+++ b/pkgs/tools/networking/drill/default.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "drill";
-  version = "0.8.2";
+  version = "0.8.3";
 
   src = fetchFromGitHub {
     owner = "fcsonline";
     repo = pname;
     rev = version;
-    sha256 = "sha256-x+ljh96RkmZQBPxUcXwcYQhRQAxMB8YOAsdg3aiht+U=";
+    sha256 = "sha256-4y5gpkQB0U6Yq92O6DDD5eq/i/36l/VfeyiE//pcZOk=";
   };
 
-  cargoHash = "sha256-GPa3gfqY3fiBI75+hLlqnR1+vUUWCxkracOdR6SsJFk=";
+  cargoHash = "sha256-96eUCg0mzgUFLOKxpwRfzj1jH2Z+aDohBTztvRVWln0=";
 
   nativeBuildInputs = lib.optionals stdenv.isLinux [
     pkg-config
diff --git a/pkgs/tools/networking/ghz/default.nix b/pkgs/tools/networking/ghz/default.nix
index da554b5a21a9..bebc2626652a 100644
--- a/pkgs/tools/networking/ghz/default.nix
+++ b/pkgs/tools/networking/ghz/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "ghz";
-  version = "0.111.0";
+  version = "0.115.0";
 
   src = fetchFromGitHub {
     owner = "bojand";
     repo = "ghz";
     rev = "v${version}";
-    sha256 = "sha256-FXehWUdFHsWYF/WXrJtmoDIb0Smh3D4aSJS8aOpvoxg=";
+    sha256 = "sha256-Y/RvXBE2+ztAPJrSBek1APkN7F3LIWAz13TGQUgFzR0=";
   };
 
-  vendorSha256 = "sha256-VjrSUP0SwE5iOTevqIGlnSjH+TV4Ajx/PKuco9etkSc=";
+  vendorHash = "sha256-BTfdKH2FBfIeHOG4dhOopoPQWHjhlJstQWWOkMwEOGs=";
 
   subPackages = [ "cmd/ghz" "cmd/ghz-web" ];
 
diff --git a/pkgs/tools/networking/mu/default.nix b/pkgs/tools/networking/mu/default.nix
index 9d2286e2271f..5e9d1ea7c1d1 100644
--- a/pkgs/tools/networking/mu/default.nix
+++ b/pkgs/tools/networking/mu/default.nix
@@ -31,6 +31,17 @@ stdenv.mkDerivation rec {
       --replace "/bin/rm" "${coreutils}/bin/rm"
   '';
 
+  # AOT native-comp, mostly copied from pkgs/build-support/emacs/generic.nix
+  postInstall = lib.optionalString (emacs.nativeComp or false) ''
+    mkdir -p $out/share/emacs/native-lisp
+    export EMACSLOADPATH=$out/share/emacs/site-lisp/mu4e:
+    export EMACSNATIVELOADPATH=$out/share/emacs/native-lisp:
+
+    find $out/share/emacs -type f -name '*.el' -print0 \
+      | xargs -0 -I {} -n 1 -P $NIX_BUILD_CORES sh -c \
+          "emacs --batch --eval '(setq large-file-warning-threshold nil)' -f batch-native-compile {} || true"
+  '';
+
   buildInputs = [ emacs glib gmime3 texinfo xapian ];
 
   mesonFlags = [
diff --git a/pkgs/tools/networking/wgautomesh/default.nix b/pkgs/tools/networking/wgautomesh/default.nix
new file mode 100644
index 000000000000..823987888a31
--- /dev/null
+++ b/pkgs/tools/networking/wgautomesh/default.nix
@@ -0,0 +1,25 @@
+{ lib
+, fetchFromGitea
+, rustPlatform
+}:
+rustPlatform.buildRustPackage rec {
+  pname = "wgautomesh";
+  version = "0.1.0";
+
+  src = fetchFromGitea {
+    domain = "git.deuxfleurs.fr";
+    owner = "Deuxfleurs";
+    repo = "wgautomesh";
+    rev = "v${version}";
+    sha256 = "FiFEpYLSJg52EtBXaZ685ICbaIyY9URrDt0bS0HPi0Q=";
+  };
+
+  cargoHash = "sha256-DGDVjQ4fr4/F1RE0qVc5CWcXrrCEswCF7rQQwlKzMPA=";
+
+  meta = with lib; {
+    description = "A simple utility to help connect wireguard nodes together in a full mesh topology";
+    homepage = "https://git.deuxfleurs.fr/Deuxfleurs/wgautomesh";
+    license = licenses.agpl3Only;
+    maintainers = [ maintainers.lx ];
+  };
+}
diff --git a/pkgs/tools/nix/nixpkgs-hammering/default.nix b/pkgs/tools/nix/nixpkgs-hammering/default.nix
index 8cec4597d30b..3ce8bd1fc23e 100644
--- a/pkgs/tools/nix/nixpkgs-hammering/default.nix
+++ b/pkgs/tools/nix/nixpkgs-hammering/default.nix
@@ -8,13 +8,13 @@
 }:
 
 let
-  version = "unstable-2022-11-15";
+  version = "unstable-2023-03-09";
 
   src = fetchFromGitHub {
     owner = "jtojnar";
     repo = "nixpkgs-hammering";
-    rev = "1b038ef38fececb39b65a4cdfa7273ed9d9359b4";
-    hash = "sha256-5wZGGTahP1Tlu+WAgGx8Q9YnnHtyhfScl9j6X3W+Toc=";
+    rev = "243b81c687aac33d6716957c0cd2235c81631044";
+    hash = "sha256-a57Ux6W2EvJBEHL6Op9Pz6Tvw/LRRk7uCMRvneXggEo=";
   };
 
   meta = with lib; {
@@ -28,7 +28,7 @@ let
     pname = "nixpkgs-hammering-rust-checks";
     inherit version src meta;
     sourceRoot = "${src.name}/rust-checks";
-    cargoHash = "sha256-YiC9mts6h15ZGdLKKmCVNNdTWDPtbDF0J5pwtjc6YKM=";
+    cargoHash = "sha256-MFYMP6eQS0wJbHmTRKaKajSborzaW6dEfshtAZcP+xs=";
   };
 in
 
diff --git a/pkgs/tools/package-management/nix-update/default.nix b/pkgs/tools/package-management/nix-update/default.nix
index 81d518e1b24c..b172fcd7f3cd 100644
--- a/pkgs/tools/package-management/nix-update/default.nix
+++ b/pkgs/tools/package-management/nix-update/default.nix
@@ -9,14 +9,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "nix-update";
-  version = "0.16.0";
+  version = "0.17.0";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "Mic92";
     repo = pname;
     rev = version;
-    hash = "sha256-4Hrumb4c0861Aorzfk0eM3++XiWkGopnMuIdb+MTKlo=";
+    hash = "sha256-qWVlJJmjrN3inRJ7ukGVT5971CMmB1KWM4XwluqYuzU=";
   };
 
   makeWrapperArgs = [
diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix
index d8b2d21dbb02..6b21e2b9f61a 100644
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@@ -20,23 +20,74 @@ let
     patches = (drv.patches or [ ]) ++ [ ./patches/boehmgc-coroutine-sp-fallback.patch ];
   });
 
-  aws-sdk-cpp-nix = (aws-sdk-cpp.override {
+  # old nix fails to build with newer aws-sdk-cpp and the patch doesn't apply
+  aws-sdk-cpp-old-nix = (aws-sdk-cpp.override {
     apis = [ "s3" "transfer" ];
     customMemoryManagement = false;
-  }).overrideDerivation (args: {
+  }).overrideAttrs (args: rec {
+    # intentionally overriding postPatch
+    version = "1.9.294";
+
+    src = fetchFromGitHub {
+      owner = "aws";
+      repo = "aws-sdk-cpp";
+      rev = version;
+      sha256 = "sha256-Z1eRKW+8nVD53GkNyYlZjCcT74MqFqqRMeMc33eIQ9g=";
+    };
+    postPatch = ''
+      # Avoid blanket -Werror to evade build failures on less
+      # tested compilers.
+      substituteInPlace cmake/compiler_settings.cmake \
+        --replace '"-Werror"' ' '
+
+      # Missing includes for GCC11
+      sed '5i#include <thread>' -i \
+        aws-cpp-sdk-cloudfront-integration-tests/CloudfrontOperationTest.cpp \
+        aws-cpp-sdk-cognitoidentity-integration-tests/IdentityPoolOperationTest.cpp \
+        aws-cpp-sdk-dynamodb-integration-tests/TableOperationTest.cpp \
+        aws-cpp-sdk-elasticfilesystem-integration-tests/ElasticFileSystemTest.cpp \
+        aws-cpp-sdk-lambda-integration-tests/FunctionTest.cpp \
+        aws-cpp-sdk-mediastore-data-integration-tests/MediaStoreDataTest.cpp \
+        aws-cpp-sdk-queues/source/sqs/SQSQueue.cpp \
+        aws-cpp-sdk-redshift-integration-tests/RedshiftClientTest.cpp \
+        aws-cpp-sdk-s3-crt-integration-tests/BucketAndObjectOperationTest.cpp \
+        aws-cpp-sdk-s3-integration-tests/BucketAndObjectOperationTest.cpp \
+        aws-cpp-sdk-s3control-integration-tests/S3ControlTest.cpp \
+        aws-cpp-sdk-sqs-integration-tests/QueueOperationTest.cpp \
+        aws-cpp-sdk-transfer-tests/TransferTests.cpp
+      # Flaky on Hydra
+      rm aws-cpp-sdk-core-tests/aws/auth/AWSCredentialsProviderTest.cpp
+      # Includes aws-c-auth private headers, so only works with submodule build
+      rm aws-cpp-sdk-core-tests/aws/auth/AWSAuthSignerTest.cpp
+      # TestRandomURLMultiThreaded fails
+      rm aws-cpp-sdk-core-tests/http/HttpClientTest.cpp
+    '' + lib.optionalString aws-sdk-cpp.stdenv.isi686 ''
+      # EPSILON is exceeded
+      rm aws-cpp-sdk-core-tests/aws/client/AdaptiveRetryStrategyTest.cpp
+    '';
+
     patches = (args.patches or [ ]) ++ [ ./patches/aws-sdk-cpp-TransferManager-ContentEncoding.patch ];
 
     # only a stripped down version is build which takes a lot less resources to build
     requiredSystemFeatures = null;
   });
 
+  aws-sdk-cpp-nix = (aws-sdk-cpp.override {
+    apis = [ "s3" "transfer" ];
+    customMemoryManagement = false;
+  }).overrideAttrs (args: {
+    # only a stripped down version is build which takes a lot less resources to build
+    requiredSystemFeatures = null;
+  });
+
+
   common = args:
     callPackage
       (import ./common.nix ({ inherit lib fetchFromGitHub; } // args))
       {
         inherit Security storeDir stateDir confDir;
         boehmgc = boehmgc-nix;
-        aws-sdk-cpp = aws-sdk-cpp-nix;
+        aws-sdk-cpp = if lib.versionAtLeast args.version "2.12pre" then aws-sdk-cpp-nix else aws-sdk-cpp-old-nix;
       };
 
   # https://github.com/NixOS/nix/pull/7585
diff --git a/pkgs/tools/security/cloudlist/default.nix b/pkgs/tools/security/cloudlist/default.nix
index fb9a420e3680..d9f97553b0f6 100644
--- a/pkgs/tools/security/cloudlist/default.nix
+++ b/pkgs/tools/security/cloudlist/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "cloudlist";
-  version = "1.0.1";
+  version = "1.0.3";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-CYEQ+hHFKSHuW2U//59g+oHkxRzVOZzipkOB6KueHvA=";
+    sha256 = "sha256-PWOC+Y+tCr5LqWJpSVoIeOquO2vMb06KW25pBEER3Ys=";
   };
 
-  vendorSha256 = "sha256-pZsRpvSDGpfEVgszB52cZS5Kk+REeLnw3qsyGGVZoa0=";
+  vendorHash = "sha256-FesvXH29thy6B9VXZnuvllJ+9VQR4i6q1JzrULaU82s=";
 
   meta = with lib; {
     description = "Tool for listing assets from multiple cloud providers";
diff --git a/pkgs/tools/security/cyclonedx-gomod/default.nix b/pkgs/tools/security/cyclonedx-gomod/default.nix
index 95bb35259aa3..5385fd19c8ac 100644
--- a/pkgs/tools/security/cyclonedx-gomod/default.nix
+++ b/pkgs/tools/security/cyclonedx-gomod/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "cyclonedx-gomod";
-  version = "1.3.0";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "CycloneDX";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-jUTSPsnGStP4aPfYS4kWiFiIEDnGkfg1Zm4EX+eD4Wo=";
+    hash = "sha256-GCRLOfrL1jFExGb5DbJa8s7RQv8Wn81TGktShZqeC54=";
   };
 
-  vendorHash = "sha256-ZiIift8On6vpu8IKI/GD3WFaFb2Xd54t8FJJqwR4tsM=";
+  vendorHash = "sha256-gFewqutvkFc/CVpBD3ORGcfiG5UNh5tQ1ElHpM3g5+I=";
 
   # Tests require network access and cyclonedx executable
   doCheck = false;
diff --git a/pkgs/tools/security/ripasso/cursive.nix b/pkgs/tools/security/ripasso/cursive.nix
index d808e344aceb..ab2498980f69 100644
--- a/pkgs/tools/security/ripasso/cursive.nix
+++ b/pkgs/tools/security/ripasso/cursive.nix
@@ -17,8 +17,7 @@
 , installShellFiles
 }:
 
-with rustPlatform;
-buildRustPackage rec {
+rustPlatform.buildRustPackage rec {
   version = "0.6.4";
   pname = "ripasso-cursive";
 
diff --git a/pkgs/tools/security/web-eid-app/default.nix b/pkgs/tools/security/web-eid-app/default.nix
new file mode 100644
index 000000000000..4f1b1cc0f6c6
--- /dev/null
+++ b/pkgs/tools/security/web-eid-app/default.nix
@@ -0,0 +1,49 @@
+{ lib
+, mkDerivation
+, fetchFromGitHub
+, cmake
+, gtest
+, pcsclite
+, pkg-config
+, qmake
+, qttranslations
+}:
+
+mkDerivation rec {
+  pname = "web-eid-app";
+  version = "2.2.0";
+
+  src = fetchFromGitHub {
+    owner = "web-eid";
+    repo = "web-eid-app";
+    rev = "v${version}";
+    sha256 = "sha256-TOzOcPY4m7OdCfaAXyc/joIHe2O2YbyDrXiNytPMKSk=";
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
+
+  buildInputs = [
+    gtest # required during build of lib/libelectronic-id/lib/libpcsc-cpp
+    pcsclite
+    qttranslations
+  ];
+
+  meta = with lib; {
+    description = "signing and authentication operations with smart cards for the Web eID browser extension";
+    longDescription = ''
+      The Web eID application performs cryptographic digital signing and
+      authentication operations with electronic ID smart cards for the Web eID
+      browser extension (it is the [native messaging host](https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/Native_messaging)
+      for the extension). Also works standalone without the extension in command-line
+      mode.
+    '';
+    homepage = "https://github.com/web-eid/web-eid-app";
+    license = licenses.mit;
+    maintainers = [ maintainers.flokli ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/tools/system/automatic-timezoned/default.nix b/pkgs/tools/system/automatic-timezoned/default.nix
index 371f9c04b814..cc8c978fbcd3 100644
--- a/pkgs/tools/system/automatic-timezoned/default.nix
+++ b/pkgs/tools/system/automatic-timezoned/default.nix
@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "automatic-timezoned";
-  version = "1.0.81";
+  version = "1.0.82";
 
   src = fetchFromGitHub {
     owner = "maxbrunet";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-i+l+nYfGUXzpbqINWsX2U/CHQ7sMvZyvrLakItyLE6I=";
+    sha256 = "sha256-ONpOGu2xzCJMQiuqeRfjPiOvuXfnaaah7OvAtHa7F4s=";
   };
 
-  cargoHash = "sha256-wRzi/efAfC6PGJFATB4EQjyTRkxsn5wBiY2DJom4npY=";
+  cargoHash = "sha256-lzhrze7VbI0jCJTLCjc+rZu4xlEYnZ76V9pSeigaCn8=";
 
   meta = with lib; {
     description = "Automatically update system timezone based on location";
diff --git a/pkgs/tools/system/go-audit/default.nix b/pkgs/tools/system/go-audit/default.nix
index e9c74e0b9812..83bd7827fff5 100644
--- a/pkgs/tools/system/go-audit/default.nix
+++ b/pkgs/tools/system/go-audit/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "go-audit";
-  version = "1.1.1";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "slackhq";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-iJm33IZ3kGWnGVDVbQCTvoo+dXBU5092YYXZG+Z7vi0=";
+    sha256 = "sha256-Li/bMgl/wj9bHpXW5gwWvb7BvyBPzeLCP979J2kyRCM=";
   };
 
-  vendorSha256 = "sha256-sQBnnBZm7kM8IAfsFhSIBLo2LLdTimVAQw1ogWo/a4Y=";
+  vendorHash = "sha256-JHimXGsUMAQqCutREsmtgDIf6Vda+it0IL3AfS86omU=";
 
   # Tests need network access
   doCheck = false;
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 9d319aa08856..6007e7db8585 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1877,6 +1877,7 @@ mapAliases ({
     inherit (stdenvAdapters) overrideCC;
     buildLlvmTools = buildPackages.llvmPackages_git.tools;
     targetLlvmLibraries = targetPackages.llvmPackages_git.libraries or llvmPackages_git.libraries;
+    targetLlvm = targetPackages.llvmPackages_git.llvm or llvmPackages_git.llvm;
   });
 
   # Added 2022-01-28
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 73594265adf1..16ed1640de17 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -12029,9 +12029,7 @@ with pkgs;
 
   secp256k1 = callPackage ../tools/security/secp256k1 { };
 
-  securefs = callPackage ../tools/filesystems/securefs {
-    stdenv = clangStdenv;
-  };
+  securefs = darwin.apple_sdk_11_0.callPackage ../tools/filesystems/securefs { };
 
   seehecht = callPackage ../tools/text/seehecht { };
 
@@ -13465,6 +13463,8 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) Security;
   };
 
+  wgautomesh = callPackage ../tools/networking/wgautomesh { };
+
   woff2 = callPackage ../development/web/woff2 { };
 
   woodpecker-agent = callPackage ../development/tools/continuous-integration/woodpecker/agent.nix { };
@@ -13757,6 +13757,8 @@ with pkgs;
 
   wdfs = callPackage ../tools/filesystems/wdfs { };
 
+  web-eid-app = libsForQt5.callPackage ../tools/security/web-eid-app { };
+
   wdiff = callPackage ../tools/text/wdiff { };
 
   wdisplays = callPackage ../tools/graphics/wdisplays { };
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index ea7103ac6fa6..b03e77d20011 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -209,10 +209,14 @@ let
 
     cohttp-lwt = callPackage ../development/ocaml-modules/cohttp/lwt.nix { };
 
+    cohttp-lwt-jsoo = callPackage ../development/ocaml-modules/cohttp/lwt-jsoo.nix { };
+
     cohttp-lwt-unix = callPackage ../development/ocaml-modules/cohttp/lwt-unix.nix { };
 
     cohttp-mirage = callPackage ../development/ocaml-modules/cohttp/mirage.nix { };
 
+    cohttp-top = callPackage ../development/ocaml-modules/cohttp/top.nix { };
+
     coin =  callPackage ../development/ocaml-modules/coin { };
 
     color = callPackage ../development/ocaml-modules/color { };