Merge staging-next into staging

59 files changed, 364 insertions, 375 deletions

diff --git a/doc/stdenv/stdenv.chapter.md b/doc/stdenv/stdenv.chapter.md
index b3f9f681da4c6..2d4c2eefb5af2 100644
--- a/doc/stdenv/stdenv.chapter.md
+++ b/doc/stdenv/stdenv.chapter.md
@@ -101,11 +101,11 @@ To build a `stdenv` package in a [`nix-shell`](https://nixos.org/manual/nix/unst
 
 ```bash
 nix-shell '<nixpkgs>' -A some_package
-eval ${unpackPhase:-unpackPhase}
+eval "${unpackPhase:-unpackPhase}"
 cd $sourceRoot
-eval ${patchPhase:-patchPhase}
-eval ${configurePhase:-configurePhase}
-eval ${buildPhase:-buildPhase}
+eval "${patchPhase:-patchPhase}"
+eval "${configurePhase:-configurePhase}"
+eval "${buildPhase:-buildPhase}"
 ```
 
 To modify a [phase](#sec-stdenv-phases), first print it with
diff --git a/nixos/modules/security/doas.nix b/nixos/modules/security/doas.nix
index be30a6b92e267..115ca33efb5c5 100644
--- a/nixos/modules/security/doas.nix
+++ b/nixos/modules/security/doas.nix
@@ -75,7 +75,9 @@ in
         {file}`/etc/doas.conf` file. More specific rules should
         come after more general ones in order to yield the expected behavior.
         You can use `mkBefore` and/or `mkAfter` to ensure
-        this is the case when configuration options are merged.
+        this is the case when configuration options are merged. Be aware that
+        this option cannot be used to override the behaviour allowing
+        passwordless operation for root.
       '';
       example = literalExpression ''
         [
@@ -224,7 +226,9 @@ in
       type = with types; lines;
       default = "";
       description = lib.mdDoc ''
-        Extra configuration text appended to {file}`doas.conf`.
+        Extra configuration text appended to {file}`doas.conf`. Be aware that
+        this option cannot be used to override the behaviour allowing
+        passwordless operation for root.
       '';
     };
   };
@@ -266,14 +270,14 @@ in
             # completely replace the contents of this file, use
             # `environment.etc."doas.conf"`.
 
-            # "root" is allowed to do anything.
-            permit nopass keepenv root
-
             # extraRules
             ${concatStringsSep "\n" (lists.flatten (map mkRule cfg.extraRules))}
 
             # extraConfig
             ${cfg.extraConfig}
+
+            # "root" is allowed to do anything.
+            permit nopass keepenv root
           '';
           preferLocalBuild = true;
         }
diff --git a/nixos/modules/services/networking/avahi-daemon.nix b/nixos/modules/services/networking/avahi-daemon.nix
index 103f73fdaa685..3a7519c7230b3 100644
--- a/nixos/modules/services/networking/avahi-daemon.nix
+++ b/nixos/modules/services/networking/avahi-daemon.nix
@@ -5,7 +5,7 @@ with lib;
 let
   cfg = config.services.avahi;
 
-  yesNo = yes : if yes then "yes" else "no";
+  yesNo = yes: if yes then "yes" else "no";
 
   avahiDaemonConf = with cfg; pkgs.writeText "avahi-daemon.conf" ''
     [server]
@@ -17,7 +17,8 @@ let
     browse-domains=${concatStringsSep ", " browseDomains}
     use-ipv4=${yesNo ipv4}
     use-ipv6=${yesNo ipv6}
-    ${optionalString (interfaces!=null) "allow-interfaces=${concatStringsSep "," interfaces}"}
+    ${optionalString (allowInterfaces!=null) "allow-interfaces=${concatStringsSep "," allowInterfaces}"}
+    ${optionalString (denyInterfaces!=null) "deny-interfaces=${concatStringsSep "," denyInterfaces}"}
     ${optionalString (domainName!=null) "domain-name=${domainName}"}
     allow-point-to-point=${yesNo allowPointToPoint}
     ${optionalString (cacheEntriesMax!=null) "cache-entries-max=${toString cacheEntriesMax}"}
@@ -39,6 +40,10 @@ let
   '';
 in
 {
+  imports = [
+    (lib.mkRenamedOptionModule [ "services" "avahi" "interfaces" ] [ "services" "avahi" "allowInterfaces" ])
+  ];
+
   options.services.avahi = {
     enable = mkOption {
       type = types.bool;
@@ -91,7 +96,7 @@ in
       description = lib.mdDoc "Whether to use IPv6.";
     };
 
-    interfaces = mkOption {
+    allowInterfaces = mkOption {
       type = types.nullOr (types.listOf types.str);
       default = null;
       description = lib.mdDoc ''
@@ -101,6 +106,17 @@ in
       '';
     };
 
+    denyInterfaces = mkOption {
+      type = types.nullOr (types.listOf types.str);
+      default = null;
+      description = lib.mdDoc ''
+        List of network interfaces that should be ignored by the
+        {command}`avahi-daemon`. Other unspecified interfaces will be used,
+        unless {option}`allowInterfaces` is set. This option takes precedence
+        over {option}`allowInterfaces`.
+      '';
+    };
+
     openFirewall = mkOption {
       type = types.bool;
       default = true;
@@ -134,7 +150,7 @@ in
 
     extraServiceFiles = mkOption {
       type = with types; attrsOf (either str path);
-      default = {};
+      default = { };
       example = literalExpression ''
         {
           ssh = "''${pkgs.avahi}/etc/avahi/services/ssh.service";
@@ -236,7 +252,7 @@ in
       isSystemUser = true;
     };
 
-    users.groups.avahi = {};
+    users.groups.avahi = { };
 
     system.nssModules = optional cfg.nssmdns pkgs.nssmdns;
     system.nssDatabases.hosts = optionals cfg.nssmdns (mkMerge [
@@ -246,10 +262,12 @@ in
 
     environment.systemPackages = [ pkgs.avahi ];
 
-    environment.etc = (mapAttrs' (n: v: nameValuePair
-      "avahi/services/${n}.service"
-      { ${if types.path.check v then "source" else "text"} = v; }
-    ) cfg.extraServiceFiles);
+    environment.etc = (mapAttrs'
+      (n: v: nameValuePair
+        "avahi/services/${n}.service"
+        { ${if types.path.check v then "source" else "text"} = v; }
+      )
+      cfg.extraServiceFiles);
 
     systemd.sockets.avahi-daemon = {
       description = "Avahi mDNS/DNS-SD Stack Activation Socket";
diff --git a/pkgs/applications/editors/cudatext/default.nix b/pkgs/applications/editors/cudatext/default.nix
index 5ff9dd593e579..1081ed1b10c0a 100644
--- a/pkgs/applications/editors/cudatext/default.nix
+++ b/pkgs/applications/editors/cudatext/default.nix
@@ -38,13 +38,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "cudatext";
-  version = "1.187.0";
+  version = "1.187.1";
 
   src = fetchFromGitHub {
     owner = "Alexey-T";
     repo = "CudaText";
     rev = version;
-    hash = "sha256-Ri/VTJF59GCJdhbMWRAYaQifj7FjVYSACywpq8gHKXg=";
+    hash = "sha256-OdeiJ+g2woNjjQI5z3TDSi9Tt8kOheUrd/Gak+fmXX0=";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/editors/cudatext/deps.json b/pkgs/applications/editors/cudatext/deps.json
index 85cefe1444637..33ba30821cb80 100644
--- a/pkgs/applications/editors/cudatext/deps.json
+++ b/pkgs/applications/editors/cudatext/deps.json
@@ -16,13 +16,13 @@
   },
   "ATSynEdit": {
     "owner": "Alexey-T",
-    "rev": "2023.03.10",
-    "hash": "sha256-NdLg/cQNy5SaC/zPb3bLplUe6FiO7ePi1++WDIvQziI="
+    "rev": "2023.03.14",
+    "hash": "sha256-mrjMG0t10lOd9hOEGBt9iGlpGdHcgbEVRcezyuUOqPQ="
   },
   "ATSynEdit_Cmp": {
     "owner": "Alexey-T",
-    "rev": "2023.03.10",
-    "hash": "sha256-KfzTO0GMFkWRFxbRSdKAh4sr7cx7A2snj/UO1nsvacI="
+    "rev": "2023.03.14",
+    "hash": "sha256-75ndPG3nSM7Y/jEZFPmKfQMnFrARe1DNva1HoDHxqAE="
   },
   "EControl": {
     "owner": "Alexey-T",
diff --git a/pkgs/applications/editors/sigil/default.nix b/pkgs/applications/editors/sigil/default.nix
index 138c886e76394..9f51d41428c14 100644
--- a/pkgs/applications/editors/sigil/default.nix
+++ b/pkgs/applications/editors/sigil/default.nix
@@ -5,13 +5,13 @@
 
 mkDerivation rec {
   pname = "sigil";
-  version = "1.9.20";
+  version = "1.9.30";
 
   src = fetchFromGitHub {
     repo = "Sigil";
     owner = "Sigil-Ebook";
     rev = version;
-    sha256 = "sha256-rpJ+HBYmGuhxnZbJn59mc+IokBc5834X2uyriIGnsqA=";
+    sha256 = "sha256-07JK3xHpNDs6CU8je8PNyTugNBi2mQ7G109R3JX4eyg=";
   };
 
   pythonPath = with python3Packages; [ lxml ];
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index 49fc219c34224..11f66e8a5d539 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -171,6 +171,18 @@ final: prev:
     meta.homepage = "https://github.com/vigoux/LanguageTool.nvim/";
   };
 
+  LazyVim = buildVimPluginFrom2Nix {
+    pname = "LazyVim";
+    version = "2023-03-17";
+    src = fetchFromGitHub {
+      owner = "LazyVim";
+      repo = "LazyVim";
+      rev = "c10e550639caef68146d122d9bc4a66f2f38650a";
+      sha256 = "04d062kxa0pz57liymim3i17hz51w0690c2y4q22h3kfarcmj0ws";
+    };
+    meta.homepage = "https://github.com/LazyVim/LazyVim/";
+  };
+
   LeaderF = buildVimPluginFrom2Nix {
     pname = "LeaderF";
     version = "2023-03-02";
@@ -1169,6 +1181,18 @@ final: prev:
     meta.homepage = "https://github.com/bbchung/clighter8/";
   };
 
+  clipboard-image-nvim = buildVimPluginFrom2Nix {
+    pname = "clipboard-image.nvim";
+    version = "2022-11-10";
+    src = fetchFromGitHub {
+      owner = "ekickx";
+      repo = "clipboard-image.nvim";
+      rev = "d1550dc26729b7954f95269952e90471b838fa25";
+      sha256 = "0lq13rscsnjglnbynisz4fmsh4xzn12lisgjk9cm61sjg9pw6yl9";
+    };
+    meta.homepage = "https://github.com/ekickx/clipboard-image.nvim/";
+  };
+
   cmd-parser-nvim = buildVimPluginFrom2Nix {
     pname = "cmd-parser.nvim";
     version = "2022-02-23";
@@ -6897,6 +6921,18 @@ final: prev:
     meta.homepage = "https://github.com/steelsojka/pears.nvim/";
   };
 
+  persistence-nvim = buildVimPluginFrom2Nix {
+    pname = "persistence.nvim";
+    version = "2023-02-28";
+    src = fetchFromGitHub {
+      owner = "folke";
+      repo = "persistence.nvim";
+      rev = "adcf6913693a0434665d162ee45a186230496f8a";
+      sha256 = "1fx713swa6138mpmqgpc6lf7nvm4j7nm6fr8zwpgqn6dv71jdhxd";
+    };
+    meta.homepage = "https://github.com/folke/persistence.nvim/";
+  };
+
   peskcolor-vim = buildVimPluginFrom2Nix {
     pname = "peskcolor.vim";
     version = "2016-06-11";
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index 15184a29c6c48..d8eca1c8b07a1 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -13,6 +13,7 @@ https://github.com/ionide/Ionide-vim/,HEAD,
 https://github.com/martinda/Jenkinsfile-vim-syntax/,,
 https://github.com/autozimu/LanguageClient-neovim/,,
 https://github.com/vigoux/LanguageTool.nvim/,,
+https://github.com/LazyVim/LazyVim/,,
 https://github.com/Yggdroot/LeaderF/,,
 https://github.com/Valloric/MatchTagAlways/,,
 https://github.com/numToStr/Navigator.nvim/,,
@@ -98,6 +99,7 @@ https://github.com/xavierd/clang_complete/,,
 https://github.com/p00f/clangd_extensions.nvim/,HEAD,
 https://github.com/rhysd/clever-f.vim/,,
 https://github.com/bbchung/clighter8/,,
+https://github.com/ekickx/clipboard-image.nvim/,,
 https://github.com/winston0410/cmd-parser.nvim/,,
 https://github.com/hrsh7th/cmp-buffer/,,
 https://github.com/hrsh7th/cmp-calc/,,
@@ -580,6 +582,7 @@ https://github.com/drewtempelmeyer/palenight.vim/,,
 https://github.com/NLKNguyen/papercolor-theme/,,
 https://github.com/tmsvg/pear-tree/,,
 https://github.com/steelsojka/pears.nvim/,,
+https://github.com/folke/persistence.nvim/,,
 https://github.com/andsild/peskcolor.vim/,,
 https://github.com/pest-parser/pest.vim/,HEAD,
 https://github.com/lifepillar/pgsql.vim/,,
diff --git a/pkgs/applications/graphics/autotrace/autofig.nix b/pkgs/applications/graphics/autotrace/autofig.nix
deleted file mode 100644
index 9555dd4c02ed7..0000000000000
--- a/pkgs/applications/graphics/autotrace/autofig.nix
+++ /dev/null
@@ -1,11 +0,0 @@
-{ stdenv, fetchurl }:
-
-stdenv.mkDerivation {
-  pname = "autofig";
-  version = "0.1";
-
-  src = fetchurl {
-    url = "http://autotrace.sourceforge.net/tools/autofig.tar.gz";
-    sha256 = "11cs9hdbgcl3aamcs3149i8kvyyldmnjf6yq81kbcf8fdmfk2zdq";
-  };
-}
diff --git a/pkgs/applications/graphics/autotrace/default.nix b/pkgs/applications/graphics/autotrace/default.nix
index 502aeddf81464..96a53b5efbac6 100644
--- a/pkgs/applications/graphics/autotrace/default.nix
+++ b/pkgs/applications/graphics/autotrace/default.nix
@@ -1,125 +1,58 @@
-{ lib, stdenv, fetchurl, callPackage, libpng12, imagemagick
-, autoreconfHook, glib, pstoedit, pkg-config, gettext, gd, darwin
-, runtimeShell }:
-
-# TODO: Figure out why the resultant binary is somehow linked against
-# libpng16.so.16 rather than libpng12.
+{ lib
+, stdenv
+, fetchFromGitHub
+, fetchpatch
+, autoreconfHook
+, gettext
+, intltool
+, pkg-config
+, glib
+, imagemagick
+, libpng
+, pstoedit
+, darwin
+}:
 
 stdenv.mkDerivation rec {
   pname = "autotrace";
-  version = "0.31.1";
+  version = "0.31.9";
 
-  src = fetchurl {
-    url = "mirror://sourceforge/autotrace/AutoTrace/0.31.1/${pname}-${version}.tar.gz";
-    sha256 = "1xmgja5fv48mdbsa51inf7ksz36nqd6bsaybrk5xgprm6cy946js";
+  src = fetchFromGitHub {
+    owner = "autotrace";
+    repo = "autotrace";
+    rev = version;
+    hash = "sha256-8qqB6oKmbz95dNLtdLvb69cEj/P7TzdoKEyJ8+4ITzs=";
   };
 
-  # The below commented out part is for an identically-named project
-  # on GitHub which appears to derive somehow from the Sourceforge
-  # version, but I have no idea what the lineage is of this project.
-  # It will build, but it segfaults when I attempt to run -centerline.
-  # Someone may need this for some reason, so I've left it here.
-  #
-  #src = fetchFromGitHub {
-  #  owner = "autotrace";
-  #  repo = "autotrace";
-  #  rev = "b3ac8818d86943102cb4f13734e0b527c42dc45a";
-  #  sha256 = "0z5h2mvxwckk2msi361zk1nc9fdcvxyimyc2hlyqd6h8k3p7zdi4";
-  #};
-  #postConfigure = ''
-  #  sed -i -e "s/at_string/gchar */g" *.c
-  #  sed -i -e "s/at_address/gpointer/g" *.c
-  #  sed -i -e "s/at_bitmap_type/struct _at_bitmap/g" *.c
-  #  sed -i -e "s/AT_BITMAP_BITS(bitmap)/AT_BITMAP_BITS(\&bitmap)/g" input-magick.c
-  #'';
-
-  autofig = callPackage ./autofig.nix {};
-  nativeBuildInputs = [ autoreconfHook glib autofig pkg-config gettext ];
-  buildInputs = [ libpng12 imagemagick pstoedit ]
-    ++ lib.optionals stdenv.isDarwin
-       (with darwin.apple_sdk.frameworks; [ gd ApplicationServices ]);
-
-  postUnpack = ''
-    pushd $sourceRoot
-    autofig autotrace-config.af
-    popd
-  '';
-
-  # This complains about various m4 files, but it appears to not be an
-  # actual error.
-  preConfigure = ''
-    glib-gettextize --copy --force
-    # pstoedit-config no longer exists, it was replaced with pkg-config
-    mkdir wrappers
-    cat >wrappers/pstoedit-config <<'EOF'
-    #!${runtimeShell}
-    # replace --version with --modversion for pkg-config
-    args=''${@/--version/--modversion}
-    exec pkg-config pstoedit "''${args[@]}"
-    EOF
-    chmod +x wrappers/pstoedit-config
-    export PATH="$PATH:$PWD/wrappers"
-  '';
+  patches = [
+    (fetchpatch {
+      name = "imagemagick7-support.patch";
+      url = "https://github.com/autotrace/autotrace/pull/105.patch";
+      hash = "sha256-Q82LRF/BsJ/Ii2s+7yaYHs9agMKYVYIMnbwqz8P92s0=";
+    })
+  ];
+
+  nativeBuildInputs = [
+    autoreconfHook
+    gettext
+    intltool
+    pkg-config
+  ];
+
+  buildInputs = [
+    glib
+    imagemagick
+    libpng
+    pstoedit
+  ] ++ lib.optionals stdenv.isDarwin [
+    darwin.apple_sdk.frameworks.Foundation
+  ];
 
   meta = with lib; {
-    homepage = "https://autotrace.sourceforge.net/";
+    homepage = "https://github.com/autotrace/autotrace";
     description = "Utility for converting bitmap into vector graphics";
     platforms = platforms.unix;
     maintainers = with maintainers; [ hodapp ];
     license = licenses.gpl2;
-    knownVulnerabilities = [
-      "CVE-2013-1953"
-      "CVE-2016-7392"
-      "CVE-2017-9151"
-      "CVE-2017-9152"
-      "CVE-2017-9153"
-      "CVE-2017-9154"
-      "CVE-2017-9155"
-      "CVE-2017-9156"
-      "CVE-2017-9157"
-      "CVE-2017-9158"
-      "CVE-2017-9159"
-      "CVE-2017-9160"
-      "CVE-2017-9161"
-      "CVE-2017-9162"
-      "CVE-2017-9163"
-      "CVE-2017-9164"
-      "CVE-2017-9165"
-      "CVE-2017-9166"
-      "CVE-2017-9167"
-      "CVE-2017-9168"
-      "CVE-2017-9169"
-      "CVE-2017-9170"
-      "CVE-2017-9171"
-      "CVE-2017-9172"
-      "CVE-2017-9173"
-      "CVE-2017-9174"
-      "CVE-2017-9175"
-      "CVE-2017-9176"
-      "CVE-2017-9177"
-      "CVE-2017-9178"
-      "CVE-2017-9179"
-      "CVE-2017-9180"
-      "CVE-2017-9181"
-      "CVE-2017-9182"
-      "CVE-2017-9183"
-      "CVE-2017-9184"
-      "CVE-2017-9185"
-      "CVE-2017-9186"
-      "CVE-2017-9187"
-      "CVE-2017-9188"
-      "CVE-2017-9189"
-      "CVE-2017-9190"
-      "CVE-2017-9191"
-      "CVE-2017-9192"
-      "CVE-2017-9193"
-      "CVE-2017-9194"
-      "CVE-2017-9195"
-      "CVE-2017-9196"
-      "CVE-2017-9197"
-      "CVE-2017-9198"
-      "CVE-2017-9199"
-      "CVE-2017-9200"
-    ];
   };
 }
diff --git a/pkgs/applications/graphics/gimp/default.nix b/pkgs/applications/graphics/gimp/default.nix
index def4bc2e1bb8b..e7b257cea4384 100644
--- a/pkgs/applications/graphics/gimp/default.nix
+++ b/pkgs/applications/graphics/gimp/default.nix
@@ -53,14 +53,14 @@
 
 let
   python = python2.withPackages (pp: [ pp.pygtk ]);
-in stdenv.mkDerivation rec {
+in stdenv.mkDerivation (finalAttrs: {
   pname = "gimp";
   version = "2.10.34";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
-    url = "http://download.gimp.org/pub/gimp/v${lib.versions.majorMinor version}/${pname}-${version}.tar.bz2";
+    url = "http://download.gimp.org/pub/gimp/v${lib.versions.majorMinor finalAttrs.version}/gimp-${finalAttrs.version}.tar.bz2";
     sha256 = "hABGQtNRs5ikKTzX/TWSBEqUTwW7UoUO5gaPJHxleqM=";
   };
 
@@ -154,10 +154,12 @@ in stdenv.mkDerivation rec {
 
   doCheck = true;
 
-  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-DGDK_OSX_BIG_SUR=16";
+  env = {
+    NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-DGDK_OSX_BIG_SUR=16";
 
-  # Check if librsvg was built with --disable-pixbuf-loader.
-  PKG_CONFIG_GDK_PIXBUF_2_0_GDK_PIXBUF_MODULEDIR = "${librsvg}/${gdk-pixbuf.moduleDir}";
+    # Check if librsvg was built with --disable-pixbuf-loader.
+    PKG_CONFIG_GDK_PIXBUF_2_0_GDK_PIXBUF_MODULEDIR = "${librsvg}/${gdk-pixbuf.moduleDir}";
+  };
 
   preConfigure = ''
     # The check runs before glib-networking is registered
@@ -165,21 +167,23 @@ in stdenv.mkDerivation rec {
   '';
 
   postFixup = ''
-    wrapProgram $out/bin/gimp-${lib.versions.majorMinor version} \
+    wrapProgram $out/bin/gimp-${lib.versions.majorMinor finalAttrs.version} \
       --set GDK_PIXBUF_MODULE_FILE "$GDK_PIXBUF_MODULE_FILE"
   '';
 
-  passthru = rec {
+  passthru = {
     # The declarations for `gimp-with-plugins` wrapper,
     # used for determining plug-in installation paths
-    majorVersion = "${lib.versions.major version}.0";
-    targetLibDir = "lib/gimp/${majorVersion}";
-    targetDataDir = "share/gimp/${majorVersion}";
-    targetPluginDir = "${targetLibDir}/plug-ins";
-    targetScriptDir = "${targetDataDir}/scripts";
+    majorVersion = "${lib.versions.major finalAttrs.version}.0";
+    targetLibDir = "lib/gimp/${finalAttrs.passthru.majorVersion}";
+    targetDataDir = "share/gimp/${finalAttrs.passthru.majorVersion}";
+    targetPluginDir = "${finalAttrs.passthru.targetLibDir}/plug-ins";
+    targetScriptDir = "${finalAttrs.passthru.targetDataDir}/scripts";
 
     # probably its a good idea to use the same gtk in plugins ?
     gtk = gtk2;
+
+    python2Support = withPython;
   };
 
   meta = with lib; {
@@ -190,4 +194,4 @@ in stdenv.mkDerivation rec {
     platforms = platforms.unix;
     mainProgram = "gimp";
   };
-}
+})
diff --git a/pkgs/applications/graphics/gimp/plugins/default.nix b/pkgs/applications/graphics/gimp/plugins/default.nix
index 2077fabc35dfe..4ef13e7ad312e 100644
--- a/pkgs/applications/graphics/gimp/plugins/default.nix
+++ b/pkgs/applications/graphics/gimp/plugins/default.nix
@@ -31,26 +31,27 @@ let
         install -Dt "$pluginDir" "$@"
       }
     '';
-
-    # Override installation paths.
-    PKG_CONFIG_GIMP_2_0_GIMPLIBDIR = "${placeholder "out"}/${gimp.targetLibDir}";
-    PKG_CONFIG_GIMP_2_0_GIMPDATADIR = "${placeholder "out"}/${gimp.targetDataDir}";
   }
   // attrs
   // {
-      name = "${gimp.pname}-plugin-${name}";
-      buildInputs = [
-        gimp
-        gimp.gtk
-        glib
-      ] ++ (attrs.buildInputs or []);
-
-      nativeBuildInputs = [
-        pkg-config
-        intltool
-      ] ++ (attrs.nativeBuildInputs or []);
-    }
-  );
+    name = "${gimp.pname}-plugin-${name}";
+    buildInputs = [
+      gimp
+      gimp.gtk
+      glib
+    ] ++ (attrs.buildInputs or []);
+
+    nativeBuildInputs = [
+      pkg-config
+      intltool
+    ] ++ (attrs.nativeBuildInputs or []);
+
+    # Override installation paths.
+    env = {
+      PKG_CONFIG_GIMP_2_0_GIMPLIBDIR = "${placeholder "out"}/${gimp.targetLibDir}";
+      PKG_CONFIG_GIMP_2_0_GIMPDATADIR = "${placeholder "out"}/${gimp.targetDataDir}";
+    } // attrs.env or { };
+  });
 
   scriptDerivation = {src, ...}@attrs : pluginDerivation ({
     prePhases = "extraLib";
@@ -116,8 +117,13 @@ in
       url = "https://ftp.gimp.org/pub/gimp/plug-ins/v2.6/gap/gimp-gap-2.6.0.tar.bz2";
       sha256 = "1jic7ixcmsn4kx2cn32nc5087rk6g8xsrz022xy11yfmgvhzb0ql";
     };
-    NIX_LDFLAGS = "-lm";
+
     hardeningDisable = [ "format" ];
+
+    env = {
+      NIX_LDFLAGS = "-lm";
+    };
+
     meta = with lib; {
       description = "The GIMP Animation Package";
       homepage = "https://www.gimp.org";
@@ -208,6 +214,10 @@ in
       rev = "v${version}";
       sha256 = "1jwc8bhhm21xhrgw56nzbma6fwg59gc8anlmyns7jdiw83y0zx3j";
     };
+
+    meta = {
+      broken = !gimp.python2Support;
+    };
   };
 
   texturize = pluginDerivation {
@@ -233,15 +243,19 @@ in
     pname = "wavelet-sharpen";
     version = "0.1.2";
 
-    # Workaround build failure on -fno-common toolchains like upstream
-    # gcc-10. Otherwise build fails as:
-    #   ld: interface.o:(.bss+0xe0): multiple definition of `fimg'; plugin.o:(.bss+0x40): first defined here
-    env.NIX_CFLAGS_COMPILE = "-fcommon";
-    NIX_LDFLAGS = "-lm";
     src = fetchurl {
       url = "https://github.com/pixlsus/registry.gimp.org_static/raw/master/registry.gimp.org/files/wavelet-sharpen-0.1.2.tar.gz";
       sha256 = "0vql1k67i21g5ivaa1jh56rg427m0icrkpryrhg75nscpirfxxqw";
     };
+
+    env = {
+      # Workaround build failure on -fno-common toolchains like upstream
+      # gcc-10. Otherwise build fails as:
+      #   ld: interface.o:(.bss+0xe0): multiple definition of `fimg'; plugin.o:(.bss+0x40): first defined here
+      NIX_CFLAGS_COMPILE = "-fcommon";
+      NIX_LDFLAGS = "-lm";
+    };
+
     installPhase = "installPlugin src/wavelet-sharpen"; # TODO translations are not copied .. How to do this on nix?
   };
 
diff --git a/pkgs/applications/graphics/gimp/wrapper.nix b/pkgs/applications/graphics/gimp/wrapper.nix
index 353990ca3a958..5b92093005e09 100644
--- a/pkgs/applications/graphics/gimp/wrapper.nix
+++ b/pkgs/applications/graphics/gimp/wrapper.nix
@@ -1,8 +1,9 @@
-{ lib, symlinkJoin, gimp, makeWrapper, gimpPlugins, gnome, plugins ? null}:
+{ lib, symlinkJoin, makeWrapper, gimpPlugins, gnome, plugins ? null}:
 
 let
+inherit (gimpPlugins) gimp;
 allPlugins = lib.filter (pkg: lib.isDerivation pkg && !pkg.meta.broken or false) (lib.attrValues gimpPlugins);
-selectedPlugins = lib.filter (pkg: pkg != gimpPlugins.gimp) (if plugins == null then allPlugins else plugins);
+selectedPlugins = lib.filter (pkg: pkg != gimp) (if plugins == null then allPlugins else plugins);
 extraArgs = map (x: x.wrapArgs or "") selectedPlugins;
 versionBranch = lib.versions.majorMinor gimp.version;
 
diff --git a/pkgs/applications/graphics/rnote/default.nix b/pkgs/applications/graphics/rnote/default.nix
index 1dcb3c5802a8a..042879d8d5184 100644
--- a/pkgs/applications/graphics/rnote/default.nix
+++ b/pkgs/applications/graphics/rnote/default.nix
@@ -1,9 +1,9 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , alsa-lib
 , appstream-glib
-, clang
 , cmake
 , desktop-file-utils
 , glib
@@ -19,34 +19,43 @@
 , rustPlatform
 , shared-mime-info
 , wrapGAppsHook4
+, AudioUnit
 }:
 
 stdenv.mkDerivation rec {
   pname = "rnote";
-  version = "0.5.16";
+  version = "0.5.17";
 
   src = fetchFromGitHub {
     owner = "flxzt";
     repo = "rnote";
     rev = "v${version}";
-    hash = "sha256-blpANUfFam46Vyyc3vaB7vX07CRMtdMZR2n7FOLGgaU=";
+    hash = "sha256-/crqcp0oCq1f/5hnYfIcuSUzF5GmiAh2lLhQh+IzP4o=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-vVU/OVwtIPRw1Ohe5EIqovhyd4oYOR7CPISz8Zo74r0=";
+    hash = "sha256-sfsk67zTmVPPtohJcgQ/OoMPeoNTo/zGs3hdA1D9SwM=";
   };
 
+  patches = [
+    # https://github.com/flxzt/rnote/pull/569
+    (fetchpatch {
+      url = "https://github.com/flxzt/rnote/commit/8585b446c08b246f3d55359026415cb3d242d44e.patch";
+      hash = "sha256-ePpTQ/3mzZTNjU9P4vTu9CM0vX8+r8b6njuj7hDgFCg=";
+    })
+  ];
+
   nativeBuildInputs = [
     appstream-glib # For appstream-util
-    clang
     cmake
     desktop-file-utils # For update-desktop-database
     meson
     ninja
     pkg-config
     python3 # For the postinstall script
+    rustPlatform.bindgenHook
     rustPlatform.cargoSetupHook
     rustPlatform.rust.cargo
     rustPlatform.rust.rustc
@@ -57,17 +66,18 @@ stdenv.mkDerivation rec {
   dontUseCmakeConfigure = true;
 
   buildInputs = [
-    alsa-lib
     glib
     gstreamer
     gtk4
     libadwaita
     libxml2
     poppler
+  ] ++ lib.optionals stdenv.isLinux [
+    alsa-lib
+  ] ++ lib.optionals stdenv.isDarwin [
+    AudioUnit
   ];
 
-  LIBCLANG_PATH = "${clang.cc.lib}/lib";
-
   postPatch = ''
     pushd build-aux
     chmod +x cargo_build.py meson_post_install.py
@@ -80,8 +90,8 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/flxzt/rnote";
     changelog = "https://github.com/flxzt/rnote/releases/tag/${src.rev}";
     description = "Simple drawing application to create handwritten notes";
-    license = licenses.gpl3Only;
+    license = licenses.gpl3Plus;
     maintainers = with maintainers; [ dotlambda yrd ];
-    platforms = platforms.linux;
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/applications/misc/hubstaff/default.nix b/pkgs/applications/misc/hubstaff/default.nix
index 3916e97a6962f..4f3859e2e22b1 100644
--- a/pkgs/applications/misc/hubstaff/default.nix
+++ b/pkgs/applications/misc/hubstaff/default.nix
@@ -4,9 +4,9 @@
 , curl, writeShellScript, common-updater-scripts }:
 
 let
-  url = "https://hubstaff-production.s3.amazonaws.com/downloads/HubstaffClient/Builds/Release/1.6.7-5c6fee47/Hubstaff-1.6.7-5c6fee47.sh";
-  version = "1.6.7-5c6fee47";
-  sha256 = "0i0xlabdi4xhjkfwb6s4bwjnl4k3dj15k7aqjilmq5wb4rhhfpws";
+  url = "https://hubstaff-production.s3.amazonaws.com/downloads/HubstaffClient/Builds/Release/1.6.12-da9418f3/Hubstaff-1.6.12-da9418f3.sh";
+  version = "1.6.12-da9418f3";
+  sha256 = "1iz81g0r20215z65mj6bfls7h0dp1k5kk8q10fjbdfj82rpwbfws";
 
   rpath = lib.makeLibraryPath
     [ libX11 zlib libSM libICE libXext freetype libXrender fontconfig libXft
diff --git a/pkgs/applications/misc/masterpdfeditor/default.nix b/pkgs/applications/misc/masterpdfeditor/default.nix
index 1ea5db2515f00..192b3dd7c73ee 100644
--- a/pkgs/applications/misc/masterpdfeditor/default.nix
+++ b/pkgs/applications/misc/masterpdfeditor/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "masterpdfeditor";
-  version = "5.8.70";
+  version = "5.9.35";
 
   src = fetchurl {
     url = "https://code-industry.net/public/master-pdf-editor-${version}-qt5.x86_64.tar.gz";
-    sha256 = "sha256-mheHvHU7Z1jUxFWEEfXv2kVO51t/edTK3xV82iteUXM=";
+    sha256 = "sha256-c5DYS0PQemZ8Sql2KjnuMspCLDJzU95rsbuIdoxWDM0=";
   };
 
   nativeBuildInputs = [ autoPatchelfHook wrapQtAppsHook ];
diff --git a/pkgs/applications/networking/irc/irccloud/default.nix b/pkgs/applications/networking/irc/irccloud/default.nix
index 93ab9f828f644..d6b7af7c0a86b 100644
--- a/pkgs/applications/networking/irc/irccloud/default.nix
+++ b/pkgs/applications/networking/irc/irccloud/default.nix
@@ -2,12 +2,12 @@
 
 let
   pname = "irccloud";
-  version = "0.13.0";
+  version = "0.16.0";
   name = "${pname}-${version}";
 
   src = fetchurl {
     url = "https://github.com/irccloud/irccloud-desktop/releases/download/v${version}/IRCCloud-${version}-linux-x86_64.AppImage";
-    sha256 = "0ff69m5jav2c90918avsr5wvik2gds3klij3dzhkb352fgrd1s0l";
+    sha256 = "sha256-/hMPvYdnVB1XjKgU2v47HnVvW4+uC3rhRjbucqin4iI=";
   };
 
   appimageContents = appimageTools.extractType2 {
diff --git a/pkgs/applications/networking/p2p/tixati/default.nix b/pkgs/applications/networking/p2p/tixati/default.nix
deleted file mode 100644
index ed88546129fb8..0000000000000
--- a/pkgs/applications/networking/p2p/tixati/default.nix
+++ /dev/null
@@ -1,31 +0,0 @@
-{ lib, stdenv, fetchurl, glib, zlib, dbus, dbus-glib, gtk2, gdk-pixbuf, cairo, pango }:
-
-stdenv.mkDerivation rec {
-  pname = "tixati";
-  version = "2.89";
-
-  src = fetchurl {
-    url = "https://download2.tixati.com/download/tixati-${version}-1.x86_64.manualinstall.tar.gz";
-    sha256 = "sha256-fd7DMKoRxNmNjCxl2ViINjnCEXJrhJU4aaRT+NoB1vI=";
-  };
-
-  installPhase = ''
-    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-             --set-rpath ${lib.makeLibraryPath [ glib zlib dbus dbus-glib gtk2 gdk-pixbuf cairo pango ]} \
-             tixati
-    install -D tixati         $out/bin/tixati
-    install -D tixati.desktop $out/share/applications/tixati.desktop
-    install -D tixati.png     $out/share/icons/tixati.png
-  '';
-
-  dontStrip = true;
-
-  meta = with lib; {
-    description = "Torrent client";
-    homepage = "http://www.tixati.com";
-    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-    license = licenses.unfree;
-    platforms = [ "x86_64-linux" ];
-    maintainers = with maintainers; [ ];
-  };
-}
diff --git a/pkgs/applications/office/kitsas/default.nix b/pkgs/applications/office/kitsas/default.nix
index bcac1b916fa27..3fd6dd82db90c 100644
--- a/pkgs/applications/office/kitsas/default.nix
+++ b/pkgs/applications/office/kitsas/default.nix
@@ -2,17 +2,19 @@
 
 stdenv.mkDerivation rec {
   pname = "kitsas";
-  version = "3.2.1";
+  version = "4.0.3";
 
   src = fetchFromGitHub {
     owner = "artoh";
     repo = "kitupiikki";
     rev = "v${version}";
-    sha256 = "sha256-1gp6CMoDTAp6ORnuk5wos67zygmE9s2pXwvwcR+Hwgg=";
+    hash = "sha256-7s21++sA4enZFuDVUEAbn7InpyLx6BOwrFdsUzHWK0M=";
   };
 
-  # QList::swapItemsAt was introduced in Qt 5.13
-  patches = lib.optional (lib.versionOlder qtbase.version "5.13") ./qt-512.patch;
+  postPatch = ''
+    substituteInPlace kitsas/kitsas.pro \
+      --replace "LIBS += -L/usr/local/opt/poppler-qt5/lib -lpoppler-qt6" "LIBS += -lpoppler-qt5"
+  '';
 
   nativeBuildInputs = [ pkg-config qmake wrapQtAppsHook ];
 
@@ -26,10 +28,10 @@ stdenv.mkDerivation rec {
 
   qmakeFlags = [ "../kitsas/kitsas.pro" ];
 
-  installPhase = if stdenv.isDarwin then ''
+  installPhase = lib.optionalString stdenv.isDarwin ''
     mkdir -p $out/Applications
     mv kitsas.app $out/Applications
-  '' else ''
+  '' + lib.optionalString (!stdenv.isDarwin) ''
     install -Dm755 kitsas -t $out/bin
     install -Dm644 ../kitsas.svg -t $out/share/icons/hicolor/scalable/apps
     install -Dm644 ../kitsas.png -t $out/share/icons/hicolor/256x256/apps
diff --git a/pkgs/applications/office/kitsas/qt-512.patch b/pkgs/applications/office/kitsas/qt-512.patch
deleted file mode 100644
index b225b933104cf..0000000000000
--- a/pkgs/applications/office/kitsas/qt-512.patch
+++ /dev/null
@@ -1,24 +0,0 @@
-diff --git i/kitsas/apuri/siirtoapuri.cpp w/kitsas/apuri/siirtoapuri.cpp
-index 9a2c51f3..9565200f 100644
---- i/kitsas/apuri/siirtoapuri.cpp
-+++ w/kitsas/apuri/siirtoapuri.cpp
-@@ -25,6 +25,7 @@
- #include "db/tositetyyppimodel.h"
- #include "tiliote/tiliotekirjaaja.h"
- 
-+#include <QtAlgorithms>
- #include <QDebug>
- 
- SiirtoApuri::SiirtoApuri(QWidget *parent, Tosite *tosite) :
-@@ -361,8 +362,9 @@ void SiirtoApuri::laskunmaksu()
-         TositeVienti eka = lista.at(0).toMap();        
-         tosite()->asetaPvm(eka.pvm());
-         tosite()->asetaOtsikko( eka.selite() );
--        if( eka.kreditEuro() )
--            lista.swapItemsAt(0,1);
-+        if( eka.kreditEuro() ) {
-+            qSwap(lista.begin()[0], lista.begin()[1]);
-+        }
-         tosite()->viennit()->asetaViennit(lista);
-         reset();
- 
diff --git a/pkgs/applications/office/timeular/default.nix b/pkgs/applications/office/timeular/default.nix
index e038749f44ed5..de6c807b385f8 100644
--- a/pkgs/applications/office/timeular/default.nix
+++ b/pkgs/applications/office/timeular/default.nix
@@ -5,12 +5,12 @@
 }:
 
 let
-  version = "4.8.0";
+  version = "5.7.8";
   pname = "timeular";
 
   src = fetchurl {
     url = "https://s3.amazonaws.com/timeular-desktop-packages/linux/production/Timeular-${version}.AppImage";
-    sha256 = "sha256:0y2asw3jf2n4c7y0yr669jfqw4frp5nzzv3lffimfdr78gihma66";
+    sha256 = "sha256-gIYo91ITpFtYdYGek4bXaOowMSILXZ4fJYNKeZDhk+Y=";
   };
 
   appimageContents = appimageTools.extractType2 {
diff --git a/pkgs/applications/science/chemistry/openmolcas/MKL-MPICH.patch b/pkgs/applications/science/chemistry/openmolcas/MKL-MPICH.patch
deleted file mode 100644
index c1bc211a68e4f..0000000000000
--- a/pkgs/applications/science/chemistry/openmolcas/MKL-MPICH.patch
+++ /dev/null
@@ -1,24 +0,0 @@
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 276ae4e..5e56176 100644
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -1304,9 +1304,9 @@ if (LINALG STREQUAL "MKL")
-       endif ()
-     else ()
-       if (ADDRMODE EQUAL 64)
--        set (libpath "${MKLROOT}/lib/intel64")
-+        set (libpath "${MKLROOT}/lib")
-       elseif (ADDRMODE EQUAL 32)
--        set (libpath "${MKLROOT}/lib/ia32")
-+        set (libpath "${MKLROOT}/lib")
-       endif ()
-     endif ()
-     set (MKL_LIBRARY_PATH ${libpath} CACHE PATH "location of MKL libraries." FORCE)
-@@ -1380,7 +1380,7 @@ if (LINALG STREQUAL "MKL")
-     find_library (LIBMKL_BLACS NAMES "mkl_blacs_intelmpi_ilp64"
-                   PATHS ${MKL_LIBRARY_PATH} NO_DEFAULT_PATH)
-   elseif (MPI_IMPLEMENTATION STREQUAL "mpich")
--    find_library (LIBMKL_BLACS NAMES "mkl_blacs_ilp64"
-+    find_library (LIBMKL_BLACS NAMES "mkl_blacs_intelmpi_ilp64"
-                   PATHS ${MKL_LIBRARY_PATH} NO_DEFAULT_PATH)
-   endif ()
diff --git a/pkgs/applications/science/chemistry/openmolcas/default.nix b/pkgs/applications/science/chemistry/openmolcas/default.nix
index f1df2a486c424..9acb2019d1f22 100644
--- a/pkgs/applications/science/chemistry/openmolcas/default.nix
+++ b/pkgs/applications/science/chemistry/openmolcas/default.nix
@@ -15,21 +15,19 @@ let
 
 in stdenv.mkDerivation {
   pname = "openmolcas";
-  version = "22.10";
+  version = "23.02";
 
   src = fetchFromGitLab {
     owner = "Molcas";
     repo = "OpenMolcas";
     # The tag keeps moving, fix a hash instead
-    rev = "aedb15be52d6dee285dd3e10e9d05f44e4ca969a"; # 2022-10-22
-    sha256 = "sha256-7d2wBIEg/r5bPZXlngTIZxYdMN0UIop7TA+WFZmzCo8=";
+    rev = "03265f62cd98b985712b063aea88313f984a8857"; # 2023-02-11
+    sha256 = "sha256-Kj2RDJq8PEvKclLrSYIOdl6g6lcRsTNZCjwxGOs3joY=";
   };
 
   patches = [
     # Required to handle openblas multiple outputs
     ./openblasPath.patch
-    # Required for MKL builds
-    ./MKL-MPICH.patch
   ];
 
   postPatch = ''
diff --git a/pkgs/applications/video/mpv/default.nix b/pkgs/applications/video/mpv/default.nix
index a24d2eb2394e0..a8a552ec0b8e5 100644
--- a/pkgs/applications/video/mpv/default.nix
+++ b/pkgs/applications/video/mpv/default.nix
@@ -99,7 +99,7 @@ in stdenv.mkDerivation (self: {
       # fixes EDL error on youtube DASH streams https://github.com/mpv-player/mpv/issues/11392
       # to be removed on next release
       url = "https://github.com/mpv-player/mpv/commit/94c189dae76ba280d9883b16346c3dfb9720687e.patch";
-      sha256 = "sha256-MGXU1L5OSxY5bdEpu9vHngnRXMr7WHeHWuamhjcUD4A=";
+      sha256 = "sha256-GeAltLAwkOKk82YfXYSrkNEX08uPauh7+kVbBGPWeT8=";
     })
   ];
 
diff --git a/pkgs/build-support/cc-wrapper/default.nix b/pkgs/build-support/cc-wrapper/default.nix
index 96fd8b66bb428..d2a1ed39ee07f 100644
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@@ -228,6 +228,10 @@ stdenv.mkDerivation {
 
       if [ -e $ccPath/cpp ]; then
         wrap ${targetPrefix}cpp $wrapper $ccPath/cpp
+    '' + lib.optionalString (hostPlatform != targetPlatform) ''
+      elif [ -e $ccPath/${targetPrefix}cpp ]; then
+        wrap ${targetPrefix}cpp $wrapper $ccPath/${targetPrefix}cpp
+    '' + ''
       fi
     ''
 
diff --git a/pkgs/development/compilers/ballerina/default.nix b/pkgs/development/compilers/ballerina/default.nix
index f8dcc907f7ab5..20c13c9f25ddd 100644
--- a/pkgs/development/compilers/ballerina/default.nix
+++ b/pkgs/development/compilers/ballerina/default.nix
@@ -1,6 +1,6 @@
 { ballerina, lib, writeText, runCommand, makeWrapper, fetchzip, stdenv, openjdk }:
 let
-  version = "2201.2.2";
+  version = "2201.4.0";
   codeName = "swan-lake";
 in stdenv.mkDerivation {
   pname = "ballerina";
@@ -8,7 +8,7 @@ in stdenv.mkDerivation {
 
   src = fetchzip {
     url = "https://dist.ballerina.io/downloads/${version}/ballerina-${version}-${codeName}.zip";
-    sha256 = "sha256-xBr7lsZJKk4VXuUDt7IRQN/ZDH4WrxYjd1mBIoyb9qs=";
+    sha256 = "sha256-720QKGOerRzXsnbUghk+HGOMl4lQxHDYya3+FHtU/Ys=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
@@ -19,7 +19,7 @@ in stdenv.mkDerivation {
     runHook postInstall
   '';
   preFixup = ''
-    wrapProgram $out/bin/bal --set JAVA_HOME ${openjdk}/lib/openjdk
+    wrapProgram $out/bin/bal --set JAVA_HOME ${openjdk}
   '';
 
   passthru.tests.smokeTest = let
diff --git a/pkgs/development/libraries/libcerf/default.nix b/pkgs/development/libraries/libcerf/default.nix
index 7a3b963141894..38bb6de70e06f 100644
--- a/pkgs/development/libraries/libcerf/default.nix
+++ b/pkgs/development/libraries/libcerf/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libcerf";
-  version = "2.1";
+  version = "2.3";
 
   src = fetchurl {
     url = "https://jugit.fz-juelich.de/mlz/libcerf/-/archive/v${version}/libcerf-v${version}.tar.gz";
-    sha256 = "sha256-ihzYt/rgS4KpUWglISm4wbrKCYooX/jT8leB3q0Ut1o=";
+    sha256 = "sha256-zO7+5G6EzojQdRAzkLT50Ew05Lw7ltczKSw2g21PcGU=";
   };
 
   nativeBuildInputs = [ cmake perl ];
diff --git a/pkgs/development/libraries/libcint/default.nix b/pkgs/development/libraries/libcint/default.nix
index 09f9d8b420b9c..7163c312ea920 100644
--- a/pkgs/development/libraries/libcint/default.nix
+++ b/pkgs/development/libraries/libcint/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libcint";
-  version = "5.1.6";
+  version = "5.2.1";
 
   src = fetchFromGitHub {
     owner = "sunqm";
     repo = "libcint";
     rev = "v${version}";
-    hash = "sha256-vhi/VzT/WmkfWi+hliN60o7eT+XgDr7T/k8DG3N1moc=";
+    hash = "sha256-sFdigOlS5fAi2dV4dhcPg3roqFdvpnh580WDqTA6DGg=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/libqglviewer/default.nix b/pkgs/development/libraries/libqglviewer/default.nix
index 65d7a83a8384f..d69daee07bd86 100644
--- a/pkgs/development/libraries/libqglviewer/default.nix
+++ b/pkgs/development/libraries/libqglviewer/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libqglviewer";
-  version = "2.7.2";
+  version = "2.8.0";
 
   src = fetchurl {
     url = "http://www.libqglviewer.com/src/libQGLViewer-${version}.tar.gz";
-    sha256 = "023w7da1fyn2z69nbkp2rndiv886zahmc5cmira79zswxjfpklp2";
+    sha256 = "sha256-A9LTOUhmzcQZ9DcTrtgnJixxTMT6zd6nw7odk9rjxMw=";
   };
 
   nativeBuildInputs = [ qmake ];
diff --git a/pkgs/development/libraries/libusb-compat/0.1.nix b/pkgs/development/libraries/libusb-compat/0.1.nix
index b9aa26c67a088..db80cfd81d069 100644
--- a/pkgs/development/libraries/libusb-compat/0.1.nix
+++ b/pkgs/development/libraries/libusb-compat/0.1.nix
@@ -8,7 +8,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libusb-compat";
-  version = "0.1.7";
+  version = "0.1.8";
 
   outputs = [ "out" "dev" ]; # get rid of propagating systemd closure
   outputBin = "dev";
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
     owner = "libusb";
     repo = "libusb-compat-0.1";
     rev = "v${version}";
-    sha256 = "1nybccgjs14b3phhaycq2jx1gym4nf6sghvnv9qdfmlqxacx0jz5";
+    sha256 = "sha256-pAPERYSxoc47gwpPUoMkrbK8TOXyx03939vlFN0hHRg=";
   };
 
   patches = lib.optional stdenv.hostPlatform.isMusl ./fix-headers.patch;
diff --git a/pkgs/development/libraries/pcl/default.nix b/pkgs/development/libraries/pcl/default.nix
index 385288ffdcbc3..fbc84ce8351de 100644
--- a/pkgs/development/libraries/pcl/default.nix
+++ b/pkgs/development/libraries/pcl/default.nix
@@ -23,13 +23,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pcl";
-  version = "1.12.0";
+  version = "1.13.0";
 
   src = fetchFromGitHub {
     owner = "PointCloudLibrary";
     repo = "pcl";
     rev = "${pname}-${version}";
-    sha256 = "0jhvciaw43y6iqqk7hyxnfhn1b4bsw5fpy04s01r5pkcsjjbdbqc";
+    sha256 = "sha256-JDiDAmdpwUR3Sff63ehyvetIFXAgGOrI+HEaZ5lURps=";
   };
 
   # remove attempt to prevent (x86/x87-specific) extended precision use
diff --git a/pkgs/development/libraries/pupnp/default.nix b/pkgs/development/libraries/pupnp/default.nix
index d407c3137efc0..a9d8f8a8c9261 100644
--- a/pkgs/development/libraries/pupnp/default.nix
+++ b/pkgs/development/libraries/pupnp/default.nix
@@ -6,7 +6,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libupnp";
-  version = "1.14.14";
+  version = "1.14.15";
 
   outputs = [ "out" "dev" ];
 
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
     owner = "pupnp";
     repo = "pupnp";
     rev = "release-${version}";
-    sha256 = "sha256-LZFCfYz6MKMt0IDH22EbcmTRUXrrhQMaSjqAZH28nIQ=";
+    sha256 = "sha256-Yrd5sRvFsqBzVHODutK5JHCgoqzh26s/sGmsU2Db+bI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/mobile/genymotion/default.nix b/pkgs/development/mobile/genymotion/default.nix
index d8413117a30b8..0659046950014 100644
--- a/pkgs/development/mobile/genymotion/default.nix
+++ b/pkgs/development/mobile/genymotion/default.nix
@@ -24,11 +24,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "genymotion";
-  version = "3.2.1";
+  version = "3.3.3";
   src = fetchurl {
     url = "https://dl.genymotion.com/releases/genymotion-${version}/genymotion-${version}-linux_x64.bin";
     name = "genymotion-${version}-linux_x64.bin";
-    sha256 = "sha256-yCczUfiMcuu9OauMDmMdtnheDBXiC9tOEu0cWAW95FM=";
+    sha256 = "sha256-8NJgYILOR63tWZc3tHDie79uM1hBnAwJNwGp/h2RHCo=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/development/python-modules/azure-keyvault-certificates/default.nix b/pkgs/development/python-modules/azure-keyvault-certificates/default.nix
index 8ad7dc1c23b72..77d81c87ec31a 100644
--- a/pkgs/development/python-modules/azure-keyvault-certificates/default.nix
+++ b/pkgs/development/python-modules/azure-keyvault-certificates/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "azure-keyvault-certificates";
-  version = "4.6.0";
+  version = "4.7.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    hash = "sha256-5wkbBhGgOCxXxMb8enRYyZ8QqMoN1PnYNlgxjOxxOZ4=";
+    hash = "sha256-nkfZp0gl5QKxPVSByZwYIEDE9Ucj9DNx4AhZQ23888o=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/mesa/default.nix b/pkgs/development/python-modules/mesa/default.nix
index 9310637b7c79e..ddf46813746e0 100644
--- a/pkgs/development/python-modules/mesa/default.nix
+++ b/pkgs/development/python-modules/mesa/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "mesa";
-  version = "1.1.1";
+  version = "1.2.0";
   format = "setuptools";
 
   # According to their docs, this library is for Python 3+.
@@ -21,7 +21,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "Mesa";
     inherit version;
-    hash = "sha256-FPQLPClI8CKVsacZs4DLFnaikVSwrevU5TfUMevXgSY=";
+    hash = "sha256-Hb+iISf9Aug3JIf+3kcXwYPshAe2CkqbGPEuSY2Ij9s=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/passlib/default.nix b/pkgs/development/python-modules/passlib/default.nix
index f18307c50bf0c..e85d979ade795 100644
--- a/pkgs/development/python-modules/passlib/default.nix
+++ b/pkgs/development/python-modules/passlib/default.nix
@@ -38,6 +38,13 @@ buildPythonPackage rec {
     "test_82_crypt_support"
   ];
 
+  pytestFlagsArray = [
+    # hashing algorithms we don't support anymore
+    "--deselect=passlib/tests/test_handlers.py::des_crypt_os_crypt_test::test_82_crypt_support"
+    "--deselect=passlib/tests/test_handlers.py::md5_crypt_os_crypt_test::test_82_crypt_support"
+    "--deselect=passlib/tests/test_handlers.py::sha256_crypt_os_crypt_test::test_82_crypt_support"
+  ];
+
   meta = with lib; {
     description = "A password hashing library for Python";
     homepage = "https://foss.heptapod.net/python-libs/passlib";
diff --git a/pkgs/development/python-modules/pyscf/default.nix b/pkgs/development/python-modules/pyscf/default.nix
index e984e5767383d..55c11fe8f9ef3 100644
--- a/pkgs/development/python-modules/pyscf/default.nix
+++ b/pkgs/development/python-modules/pyscf/default.nix
@@ -1,7 +1,6 @@
 { buildPythonPackage
 , lib
 , fetchFromGitHub
-, fetchpatch
 , cmake
 , blas
 , libcint
@@ -17,21 +16,15 @@
 
 buildPythonPackage rec {
   pname = "pyscf";
-  version = "2.1.1";
+  version = "2.2.0";
 
   src = fetchFromGitHub {
     owner = "pyscf";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-KMxwyAK00Zc0i76zWTMznfXQCVCt+4HOH8SlwuOCORk=";
+    hash = "sha256-3ylFz5j176hBQLklLmVKltE8whynzojsoBEWjEL2M14=";
   };
 
-  patches = [ (fetchpatch {
-    name = "libxc-6";  # https://github.com/pyscf/pyscf/pull/1467
-    url = "https://github.com/pyscf/pyscf/commit/ebcfacc90e119cd7f9dcdbf0076a84660349fc79.patch";
-    hash = "sha256-O+eDlUKJeThxQcHrMGqxjDfRCmCNP+OCgv/L72jAF/o=";
-  })];
-
   # setup.py calls Cmake and passes the arguments in CMAKE_CONFIGURE_ARGS to cmake.
   nativeBuildInputs = [ cmake ];
   dontUseCmakeConfigure = true;
diff --git a/pkgs/development/python-modules/pyvirtualdisplay/default.nix b/pkgs/development/python-modules/pyvirtualdisplay/default.nix
index 90b3e0b118b20..0ba6c4ba6c00f 100644
--- a/pkgs/development/python-modules/pyvirtualdisplay/default.nix
+++ b/pkgs/development/python-modules/pyvirtualdisplay/default.nix
@@ -1,10 +1,10 @@
-{ lib, buildPythonPackage, fetchPypi, EasyProcess }:
+{ lib, buildPythonPackage, fetchPypi, easyprocess }:
 
 buildPythonPackage rec {
   pname = "pyvirtualdisplay";
   version = "3.0";
 
-  propagatedBuildInputs = [ EasyProcess ];
+  propagatedBuildInputs = [ easyprocess ];
 
   src = fetchPypi {
     pname = "PyVirtualDisplay";
diff --git a/pkgs/development/python-modules/screenlogicpy/default.nix b/pkgs/development/python-modules/screenlogicpy/default.nix
index 90d179bffad44..7ed829df16794 100644
--- a/pkgs/development/python-modules/screenlogicpy/default.nix
+++ b/pkgs/development/python-modules/screenlogicpy/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "screenlogicpy";
-  version = "0.8.1";
+  version = "0.8.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "dieselrabbit";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-cnQ3YqVz0AfEVma/RfQuB5kOBxo59qJJBn7PwaEe8Ro=";
+    hash = "sha256-7w2cg+LfL3w2Xxf8s7lFxE/HkqZ6RBYp8LkZTOwgK+I=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/sexpdata/default.nix b/pkgs/development/python-modules/sexpdata/default.nix
index 4502c6e38ae63..45c0224e30af4 100644
--- a/pkgs/development/python-modules/sexpdata/default.nix
+++ b/pkgs/development/python-modules/sexpdata/default.nix
@@ -5,11 +5,11 @@
 
 buildPythonPackage rec {
   pname = "sexpdata";
-  version = "0.0.4";
+  version = "1.0.0";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-5Xb2Lq0y1QQeYw+UV9LBp1RNf+XdlqSbVRWSORFcN3M=";
+    hash = "sha256-6NX3XDeKB8bRzGH62WEbRRyTg8AlMFLhYZioUuFiBwU=";
   };
 
   doCheck = false;
diff --git a/pkgs/development/python-modules/twisted/default.nix b/pkgs/development/python-modules/twisted/default.nix
index 0f0f455a42354..758b3f4eea0b8 100644
--- a/pkgs/development/python-modules/twisted/default.nix
+++ b/pkgs/development/python-modules/twisted/default.nix
@@ -63,6 +63,12 @@ buildPythonPackage rec {
       url = "https://github.com/twisted/twisted/pull/11787.diff";
       hash = "sha256-bQgUmbvDa61Vg8p/o/ivfkOAHyj1lTgHkrRVEGLM9aU=";
     })
+    (fetchpatch {
+      # Conditionally skip tests that require METHOD_CRYPT
+      # https://github.com/twisted/twisted/pull/11827
+      url = "https://github.com/mweinelt/twisted/commit/e69e652de671aac0abf5c7e6c662fc5172758c5a.patch";
+      hash = "sha256-LmvKUTViZoY/TPBmSlx4S9FbJNZfB5cxzn/YcciDmoI=";
+    })
   ] ++ lib.optionals (pythonAtLeast "3.11") [
     (fetchpatch {
       url = "https://github.com/twisted/twisted/pull/11734.diff";
diff --git a/pkgs/development/python-modules/y-py/default.nix b/pkgs/development/python-modules/y-py/default.nix
index 12111407e5254..f3c681eb4f885 100644
--- a/pkgs/development/python-modules/y-py/default.nix
+++ b/pkgs/development/python-modules/y-py/default.nix
@@ -1,7 +1,9 @@
 { lib
+, stdenv
 , buildPythonPackage
 , fetchPypi
 , rustPlatform
+, libiconv
 , pytestCheckHook
 }:
 
@@ -29,6 +31,8 @@ buildPythonPackage rec {
     rust.rustc
   ];
 
+  buildInputs = lib.optional stdenv.isDarwin libiconv;
+
   pythonImportsCheck = [ "y_py" ];
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/zfec/default.nix b/pkgs/development/python-modules/zfec/default.nix
index e58e29a974354..fd5b99448d48b 100644
--- a/pkgs/development/python-modules/zfec/default.nix
+++ b/pkgs/development/python-modules/zfec/default.nix
@@ -2,7 +2,6 @@
 , buildPythonPackage
 , fetchPypi
 , pyutil
-, setuptoolsTrial
 , twisted
 }:
 
@@ -17,12 +16,9 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [ pyutil ];
 
-  nativeCheckInputs = [ setuptoolsTrial twisted ];
+  nativeCheckInputs = [ twisted ];
 
-  # argparse is in the stdlib but zfec doesn't know that.
-  postPatch = ''
-    sed -i -e '/argparse/d' setup.py
-  '';
+  checkPhase = "trial zfec";
 
   pythonImportsCheck = [ "zfec" ];
 
diff --git a/pkgs/development/tools/misc/patchelf/unstable.nix b/pkgs/development/tools/misc/patchelf/unstable.nix
index e814d78aa6792..66c14bd07e0e1 100644
--- a/pkgs/development/tools/misc/patchelf/unstable.nix
+++ b/pkgs/development/tools/misc/patchelf/unstable.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "patchelf";
-  version = "unstable-2022-10-26";
+  version = "unstable-2023-03-07";
 
   src = fetchFromGitHub {
     owner = "NixOS";
     repo = "patchelf";
-    rev = "af77f12554be9cc4b9e8b639df26f2659dd30500";
-    sha256 = "sha256-ajMOC1wyTVUOvP0rOt/uO6+1+S4bIAc1jWQ8Uwbzrn8=";
+    rev = "ea2fca765c440fff1ff74e1463444dea7b819db2";
+    sha256 = "sha256-IH80NcLhwjGpIXEjHuV+NgaSC+Y/PXquxZ/C8Bl+CLk=";
   };
 
   # Drop test that fails on musl (?)
diff --git a/pkgs/development/web/bootstrap-studio/default.nix b/pkgs/development/web/bootstrap-studio/default.nix
index 988c279814606..67b2af313a6a4 100644
--- a/pkgs/development/web/bootstrap-studio/default.nix
+++ b/pkgs/development/web/bootstrap-studio/default.nix
@@ -2,10 +2,10 @@
 
 let
   pname = "bootstrap-studio";
-  version = "6.0.1";
+  version = "6.2.1";
   src = fetchurl {
     url = "https://bootstrapstudio.io/releases/desktop/${version}/Bootstrap%20Studio.AppImage";
-    sha256 = "sha256-piRqIB/bCF0IBZfXdlXrc7gmPTIUDbk8xhP7X5ozyWg=";
+    sha256 = "sha256-1+3YCM1K2k1Gga7Y2ciMqmwzxYJQ7Ab5uDHP1iHXK7g=";
   };
   appimageContents = appimageTools.extractType2 { inherit pname version src; };
 in
diff --git a/pkgs/os-specific/linux/fwts/default.nix b/pkgs/os-specific/linux/fwts/default.nix
index ec3d0f880f840..8e09d0825cf62 100644
--- a/pkgs/os-specific/linux/fwts/default.nix
+++ b/pkgs/os-specific/linux/fwts/default.nix
@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   pname = "fwts";
-  version = "22.09.00";
+  version = "23.01.00";
 
   src = fetchzip {
     url = "https://fwts.ubuntu.com/release/${pname}-V${version}.tar.gz";
-    sha256 = "sha256-BaaUvRbon8V8RvAgw+AC9MCHC65Y/NFT1iFZ+B8P2Hk=";
+    sha256 = "sha256-HuAjT4RuWup+h7ZzAKH8ez81RtuNj/JT8ilL8Ps+P0c=";
     stripRoot = false;
   };
 
diff --git a/pkgs/os-specific/linux/zfs/default.nix b/pkgs/os-specific/linux/zfs/default.nix
index 1a6d077aa242f..d92ccc3463868 100644
--- a/pkgs/os-specific/linux/zfs/default.nix
+++ b/pkgs/os-specific/linux/zfs/default.nix
@@ -250,10 +250,10 @@ in {
     # IMPORTANT: Always use a tagged release candidate or commits from the
     # zfs-<version>-staging branch, because this is tested by the OpenZFS
     # maintainers.
-    version = "2.1.10-staging-2023-03-02";
-    rev = "9d2e5c14b2f94c91aa389799bd9e80e1098263e7";
+    version = "2.1.10-staging-2023-03-15";
+    rev = "a5c469c5f380b09705ad0bee15e2ca7a5f78213c";
 
-    sha256 = "sha256-E+nLmmSSPtGDjqBQp2GXJsYR2zCEpcxU0/9BD5QHdnA=";
+    sha256 = "sha256-CdPuyZMXFzANEdnsr/rB5ckkT8X5uziniY5vmRCKl1U=";
 
     isUnstable = true;
   };
diff --git a/pkgs/servers/miniflux/default.nix b/pkgs/servers/miniflux/default.nix
index 5e24e5e9a8eb6..5c55cd67b2b5d 100644
--- a/pkgs/servers/miniflux/default.nix
+++ b/pkgs/servers/miniflux/default.nix
@@ -2,7 +2,7 @@
 
 let
   pname = "miniflux";
-  version = "2.0.42";
+  version = "2.0.43";
 
 in buildGoModule {
   inherit pname version;
@@ -11,10 +11,10 @@ in buildGoModule {
     owner = pname;
     repo = "v2";
     rev = version;
-    sha256 = "sha256-2ywaQubE/DZCTIX6a3vh1VH+/lfoe9gRzkqih8ULU8Q=";
+    sha256 = "sha256-IVIAlDYOuAl51V/Q1hpkjIREHTXq8E5D/w4cyTZ8ebs=";
   };
 
-  vendorSha256 = "sha256-KtYFjNqUIYgAwIkEhQwg5OdjIluyENeZ6Qo5TGKzA/s=";
+  vendorHash = "sha256-/BINHOlRmAfOIXY9x5VjnQwIc87Mt2TAvBE1tPq6W80=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/servers/nosql/ferretdb/default.nix b/pkgs/servers/nosql/ferretdb/default.nix
index 2b7431ba9d28c..b8711fa7a2942 100644
--- a/pkgs/servers/nosql/ferretdb/default.nix
+++ b/pkgs/servers/nosql/ferretdb/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "ferretdb";
-  version = "0.9.2";
+  version = "0.9.3";
 
   src = fetchFromGitHub {
     owner = "FerretDB";
     repo = "FerretDB";
     rev = "v${version}";
-    sha256 = "sha256-lJlj5GNgrllcaEednxVCmMPHG2aU4z3mKkm9t0cO5Tk=";
+    sha256 = "sha256-UVRrCzgQdr86cc3jG+FSI/y3dxkHxoydMncXMgPMcz4=";
   };
 
   postPatch = ''
@@ -19,7 +19,7 @@ buildGoModule rec {
     echo nixpkgs     > build/version/package.txt
   '';
 
-  vendorSha256 = "sha256-I5ucq3K0lRsokG9lahmBUH9mIYa5tgHnL+vxKSzW1hw=";
+  vendorSha256 = "sha256-pvRs+X8DbHeThJPZ3St+MzLrQBLHRtdkKSHjBax3V10=";
 
   CGO_ENABLED = 0;
 
@@ -27,6 +27,15 @@ buildGoModule rec {
 
   tags = [ "ferretdb_tigris" ];
 
+  # tests in cmd/ferretdb are not production relevant
+  doCheck = false;
+
+  # the binary panics if something required wasn't set during compilation
+  doInstallCheck = true;
+  installCheckPhase = ''
+    $out/bin/ferretdb --version | grep ${version}
+  '';
+
   meta = with lib; {
     description = "A truly Open Source MongoDB alternative";
     homepage = "https://www.ferretdb.io/";
diff --git a/pkgs/servers/roon-server/default.nix b/pkgs/servers/roon-server/default.nix
index 2f60d525dc071..66c878d00e1b9 100644
--- a/pkgs/servers/roon-server/default.nix
+++ b/pkgs/servers/roon-server/default.nix
@@ -15,7 +15,7 @@
 , stdenv
 }:
 let
-  version = "2.0-1223";
+  version = "2.0-1234";
   urlVersion = builtins.replaceStrings [ "." "-" ] [ "00" "0" ] version;
 in
 stdenv.mkDerivation {
@@ -24,7 +24,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://download.roonlabs.com/updates/production/RoonServer_linuxx64_${urlVersion}.tar.bz2";
-    hash = "sha256-1jHNHj1tB80/CdE7GPCgRsI0+2Gfx4kiE6a0EOI/K5U=";
+    hash = "sha256-644tLtNr3rl3sB3BF0QoiwuIF4tWS8PjehmPKwdpg2k=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/servers/search/khoj/default.nix b/pkgs/servers/search/khoj/default.nix
index 6859562d4f622..058fe91ab7653 100644
--- a/pkgs/servers/search/khoj/default.nix
+++ b/pkgs/servers/search/khoj/default.nix
@@ -1,4 +1,5 @@
 { lib
+, stdenv
 , fetchFromGitHub
 , python3
 , qt6
@@ -43,8 +44,10 @@ python3.pkgs.buildPythonApplication rec {
     wrapQtAppsHook
   ]);
 
-  buildInputs = with qt6; [
-    qtwayland
+  buildInputs = lib.optionals stdenv.isLinux [
+    qt6.qtwayland
+  ] ++ lib.optionals stdenv.isDarwin [
+    qt6.qtbase
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
@@ -106,5 +109,7 @@ python3.pkgs.buildPythonApplication rec {
     changelog = "https://github.com/debanjum/khoj/releases/tag/${version}";
     license = licenses.gpl3Only;
     maintainers = with maintainers; [ dit7ya ];
+    # src/tcmalloc.cc:333] Attempt to free invalid pointer
+    broken = stdenv.isDarwin;
   };
 }
diff --git a/pkgs/tools/admin/qovery-cli/default.nix b/pkgs/tools/admin/qovery-cli/default.nix
index 0280bde01e88e..eedc4756c8ddc 100644
--- a/pkgs/tools/admin/qovery-cli/default.nix
+++ b/pkgs/tools/admin/qovery-cli/default.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "qovery-cli";
-  version = "0.52.0";
+  version = "0.52.2";
 
   src = fetchFromGitHub {
     owner = "Qovery";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-AbgUxCZBnGkuzA8xmr6s4QxTtQFFkhjPmLmSX2AcQXE=";
+    hash = "sha256-vZBNoDh/QnrTQrDubocA3FL7Cn5M1n/w+hE99GF9QC4=";
   };
 
   vendorHash = "sha256-V7yPXSN+3H8NkD384MkvKbymNQ/O2Q9HoMO4M8mzVto=";
diff --git a/pkgs/tools/cd-dvd/dvd+rw-tools/darwin.patch b/pkgs/tools/cd-dvd/dvd+rw-tools/darwin.patch
new file mode 100644
index 0000000000000..7a7490c52673e
--- /dev/null
+++ b/pkgs/tools/cd-dvd/dvd+rw-tools/darwin.patch
@@ -0,0 +1,17 @@
+diff --git a/Makefile.m4 b/Makefile.m4
+index a6a100b..bf7c041 100644
+--- a/Makefile.m4
++++ b/Makefile.m4
+@@ -30,8 +32,10 @@ LINK.o	=$(LINK.cc)
+ # to install set-root-uid, `make BIN_MODE=04755 install'...
+ BIN_MODE?=0755
+ install:	dvd+rw-tools
+-	install -o root -m $(BIN_MODE) $(CHAIN) /usr/bin
+-	install -o root -m 0644 growisofs.1 /usr/share/man/man1
++	install -d $(prefix)/bin
++	install -d $(prefix)/share/man/man1
++	install -m $(BIN_MODE) $(CHAIN) $(prefix)/bin
++	install -m 0644 growisofs.1 $(prefix)/share/man/man1
+ ])
+ 
+ ifelse(OS,MINGW32,[
diff --git a/pkgs/tools/cd-dvd/dvd+rw-tools/default.nix b/pkgs/tools/cd-dvd/dvd+rw-tools/default.nix
index d396bf030ca63..a618d93214f62 100644
--- a/pkgs/tools/cd-dvd/dvd+rw-tools/default.nix
+++ b/pkgs/tools/cd-dvd/dvd+rw-tools/default.nix
@@ -1,5 +1,8 @@
-{ lib, stdenv, fetchurl, fetchpatch, cdrtools, m4 }:
+{ lib, stdenv, fetchurl, fetchpatch, cdrtools, m4, darwin }:
 
+let
+  inherit (darwin.apple_sdk.frameworks) IOKit;
+in
 stdenv.mkDerivation rec {
   pname = "dvd+rw-tools";
   version = "7.1";
@@ -9,8 +12,8 @@ stdenv.mkDerivation rec {
     sha256 = "1jkjvvnjcyxpql97xjjx0kwvy70kxpiznr2zpjy2hhci5s10zmpq";
   };
 
+  patches = [ ./darwin.patch ]
   # Patches from Gentoo
-  patches = [ ]
   ++ builtins.map ({pfile, sha256}: fetchpatch {
        url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/app-cdr/dvd+rw-tools/files/${pfile}?id=b510df361241e8f16314b1f14642305f0111dac6";
        inherit sha256;
@@ -28,14 +31,26 @@ stdenv.mkDerivation rec {
      ];
 
   nativeBuildInputs = [ m4 ];
-  buildInputs = [ cdrtools ];
+  buildInputs = [ cdrtools ]
+    ++ lib.optionals stdenv.isDarwin [ IOKit ];
 
-  makeFlags = [ "prefix=${placeholder "out"}" ];
+  makeFlags = [
+    "prefix=${placeholder "out"}"
+    "CC=${stdenv.cc.targetPrefix}cc"
+    "CXX=${stdenv.cc.targetPrefix}c++"
+  ];
+
+  env.NIX_CFLAGS_COMPILE = toString (lib.optionals stdenv.isDarwin [
+    # error: invalid suffix on literal; C++11 requires a space between literal and identifier
+    "-Wno-reserved-user-defined-literal"
+    # error: non-constant-expression cannot be narrowed from type 'size_t' (aka 'unsigned long') to 'IOByteCount' (aka 'unsigned int') in initializer list
+    "-Wno-c++11-narrowing"
+  ]);
 
   meta = with lib; {
     homepage = "http://fy.chalmers.se/~appro/linux/DVD+RW/tools";
     description = "Tools for mastering Blu-ray and DVD+-RW/+-R media";
-    platforms = platforms.linux;
+    platforms = platforms.unix;
     license = with licenses; [ gpl2 publicDomain ];
   };
 }
diff --git a/pkgs/tools/networking/zap/default.nix b/pkgs/tools/networking/zap/default.nix
index 8fdf8a38f3173..c8168d22249d0 100644
--- a/pkgs/tools/networking/zap/default.nix
+++ b/pkgs/tools/networking/zap/default.nix
@@ -2,16 +2,16 @@
 
 stdenv.mkDerivation rec {
   pname = "zap";
-  version = "2.11.1";
+  version = "2.12.0";
   src = fetchurl {
     url = "https://github.com/zaproxy/zaproxy/releases/download/v${version}/ZAP_${version}_Linux.tar.gz";
-    sha256 = "0b1qqrjm4m76djy0az9hnz3rqpz1qkql4faqmi7gkx33b1p6d0sz";
+    sha256 = "sha256-nESTyZHLk0cGOGTSQ2o3lc87aXYGJeez20Ac00LT/FU=";
   };
 
   buildInputs = [ jre ];
 
   # From https://github.com/zaproxy/zaproxy/blob/master/zap/src/main/java/org/parosproxy/paros/Constant.java
-  version_tag = "2010000";
+  version_tag = "20012000";
 
   # Copying config and adding version tag before first use to avoid permission
   # issues if zap tries to copy config on it's own.
diff --git a/pkgs/tools/package-management/librepo/default.nix b/pkgs/tools/package-management/librepo/default.nix
index d19b1f868c0c4..1d43efe3f8af8 100644
--- a/pkgs/tools/package-management/librepo/default.nix
+++ b/pkgs/tools/package-management/librepo/default.nix
@@ -13,7 +13,7 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "1.14.5";
+  version = "1.15.1";
   pname = "librepo";
 
   outputs = [ "out" "dev" "py" ];
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     owner = "rpm-software-management";
     repo = "librepo";
     rev = version;
-    sha256 = "sha256-4Y6ht/mKQmjBI9CZuQg4DmuyTM4KbqQcCb9jmUtapLY=";
+    sha256 = "sha256-XVjVu+UTIDbrKHmfJ2zZBLp/h0cLCZFxv/XZ0Iy8VPI=";
   };
 
   nativeBuildInputs = [
@@ -58,7 +58,7 @@ stdenv.mkDerivation rec {
     description = "Library providing C and Python (libcURL like) API for downloading linux repository metadata and packages";
     homepage = "https://rpm-software-management.github.io/librepo/";
     license = licenses.lgpl2Plus;
-    platforms = platforms.linux ++ platforms.darwin;
+    platforms = platforms.linux;
     maintainers = with maintainers; [ copumpkin ];
   };
 }
diff --git a/pkgs/tools/typesetting/fop/default.nix b/pkgs/tools/typesetting/fop/default.nix
index 68b8399fc76c6..0855c442deb94 100644
--- a/pkgs/tools/typesetting/fop/default.nix
+++ b/pkgs/tools/typesetting/fop/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "fop";
-  version = "2.7";
+  version = "2.8";
 
   src = fetchurl {
     url = "mirror://apache/xmlgraphics/fop/source/${pname}-${version}-src.tar.gz";
-    sha256 = "sha256-tPGlISmJzrx9F8cnX70j3nPMVyWdkojAFDZVYlSthtQ=";
+    sha256 = "sha256-b7Av17wu6Ar/npKOiwYqzlvBFSIuXTpqTacM1sxtBvc=";
   };
 
   buildInputs = [ ant jdk ];
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index c8b91abb8375e..1a216f33582eb 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1553,6 +1553,7 @@ mapAliases ({
   timescale-prometheus = promscale; # Added 2020-09-29
   timedoctor = throw "'timedoctor' has been removed from nixpkgs"; # Added 2022-10-09
   timetable = throw "timetable has been removed, as the upstream project has been abandoned"; # Added 2021-09-05
+  tixati = throw "'tixati' has been removed from nixpkgs as it is unfree and unmaintained"; # Added 2023-03-17
   tkcvs = tkrev; # Added 2022-03-07
   togglesg-download = throw "togglesg-download was removed 2021-04-30 as it's unmaintained"; # Added 2021-04-30
   tokodon = plasma5Packages.tokodon;
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index ca5eb3f71b76a..2a8019ffb86a4 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -11717,6 +11717,7 @@ with pkgs;
 
   rnote = callPackage ../applications/graphics/rnote {
     inherit (gst_all_1) gstreamer;
+    inherit (darwin.apple_sdk.frameworks) AudioUnit;
   };
 
   rnp = callPackage ../tools/security/rnp { };
@@ -33786,8 +33787,6 @@ with pkgs;
 
   tipp10 = qt5.callPackage ../applications/misc/tipp10 { };
 
-  tixati = callPackage ../applications/networking/p2p/tixati { };
-
   tkrev = callPackage ../applications/version-management/tkrev { };
 
   tla = callPackage ../applications/version-management/arch { };