Merge branch 'master' into haskell-updates

author: maralorn <mail@maralorn.de> 2023-01-05 00:18:05 +0100
committer: maralorn <mail@maralorn.de> 2023-01-05 00:18:05 +0100
commit: 3b1869aa951895eb3402fc0bc884490c034f99fc (patch)
tree: e12588d5fb10dcce0badfdb25d1682209c8f04cb
parent: 4045943b6411536f9c0484b7cb3772200895e97d (diff)
parent: 05968fc7e41177096305caa0b9360574367ce9fa (diff)
114 files changed, 1020 insertions, 503 deletions
diff --git a/doc/builders/special/darwin-builder.section.md b/doc/builders/special/darwin-builder.section.md
index af9de5751b2c1..3913b692498d0 100644
--- a/doc/builders/special/darwin-builder.section.md
+++ b/doc/builders/special/darwin-builder.section.md
@@ -28,19 +28,21 @@ Password:
 ```
 
 … so that it can install a private key used to `ssh` into the build server.
-After that the script will launch the virtual machine:
+After that the script will launch the virtual machine and automatically log you
+in as the `builder` user:
 
 ```
 <<< Welcome to NixOS 22.11.20220901.1bd8d11 (aarch64) - ttyAMA0 >>>
 
 Run 'nixos-help' for the NixOS manual.
 
-nixos login:
+nixos login: builder (automatic login)
+
+
+[builder@nixos:~]$
 ```
 
-> Note: When you need to stop the VM, type `Ctrl`-`a` + `c` to open the `qemu`
-> prompt and then type `system_powerdown` followed by `Enter`, or run `shutdown now`
-> as the `builder` user (e.g. `ssh -i keys/builder_ed25519 builder@localhost shutdown now`)
+> Note: When you need to stop the VM, run `shutdown now` as the `builder` user.
 
 To delegate builds to the remote builder, add the following options to your
 `nix.conf` file:
diff --git a/doc/contributing/quick-start.chapter.md b/doc/contributing/quick-start.chapter.md
index 96b30d3822c16..e6bb5f2b0b607 100644
--- a/doc/contributing/quick-start.chapter.md
+++ b/doc/contributing/quick-start.chapter.md
@@ -34,7 +34,7 @@ To add a package to Nixpkgs:
 
    - Apache HTTPD: [`pkgs/servers/http/apache-httpd/2.4.nix`](https://github.com/NixOS/nixpkgs/blob/master/pkgs/servers/http/apache-httpd/2.4.nix). A bunch of optional features, variable substitutions in the configure flags, a post-install hook, and miscellaneous hackery.
 
-   - Thunderbird: [`pkgs/applications/networking/mailreaders/thunderbird/default.nix`](https://github.com/NixOS/nixpkgs/blob/master/pkgs/applications/networking/mailreaders/thunderbird/default.nix). Lots of dependencies.
+   - buildMozillaMach: [`pkgs/applications/networking/browser/firefox/common.nix`](https://github.com/NixOS/nixpkgs/blob/master/pkgs/applications/networking/browsers/firefox/common.nix). A reusable build function for Firefox, Thunderbird and Librewolf.
 
    - JDiskReport, a Java utility: [`pkgs/tools/misc/jdiskreport/default.nix`](https://github.com/NixOS/nixpkgs/blob/master/pkgs/tools/misc/jdiskreport/default.nix). Nixpkgs doesn’t have a decent `stdenv` for Java yet so this is pretty ad-hoc.
 
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index f384f68358209..805d54832a44e 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -121,6 +121,12 @@
     githubId = 7414843;
     name = "Nicholas von Klitzing";
   };
+  _3JlOy-PYCCKUi = {
+    name = "3JlOy-PYCCKUi";
+    email = "3jl0y_pycckui@riseup.net";
+    github = "3JlOy-PYCCKUi";
+    githubId = 46464602;
+  };
   _360ied = {
     name = "Brian Zhu";
     email = "therealbarryplayer@gmail.com";
@@ -4552,6 +4558,12 @@
     githubId = 225893;
     name = "James Cook";
   };
+  farcaller = {
+    name = "Vladimir Pouzanov";
+    email = "farcaller@gmail.com";
+    github = "farcaller";
+    githubId = 693;
+  };
   fare = {
     email = "fahree@gmail.com";
     github = "fare";
diff --git a/nixos/doc/manual/from_md/installation/upgrading.chapter.xml b/nixos/doc/manual/from_md/installation/upgrading.chapter.xml
index 9f4cfaf36b628..99882784b46fc 100644
--- a/nixos/doc/manual/from_md/installation/upgrading.chapter.xml
+++ b/nixos/doc/manual/from_md/installation/upgrading.chapter.xml
@@ -12,7 +12,7 @@
     <listitem>
       <para>
         <emphasis>Stable channels</emphasis>, such as
-        <link xlink:href="https://nixos.org/channels/nixos-22.05"><literal>nixos-22.11</literal></link>.
+        <link xlink:href="https://nixos.org/channels/nixos-22.11"><literal>nixos-22.11</literal></link>.
         These only get conservative bug fixes and package upgrades. For
         instance, a channel update may cause the Linux kernel on your
         system to be upgraded from 4.19.34 to 4.19.38 (a minor bug fix),
@@ -33,7 +33,7 @@
     <listitem>
       <para>
         <emphasis>Small channels</emphasis>, such as
-        <link xlink:href="https://nixos.org/channels/nixos-22.05-small"><literal>nixos-22.11-small</literal></link>
+        <link xlink:href="https://nixos.org/channels/nixos-22.11-small"><literal>nixos-22.11-small</literal></link>
         or
         <link xlink:href="https://nixos.org/channels/nixos-unstable-small"><literal>nixos-unstable-small</literal></link>.
         These are identical to the stable and unstable channels
diff --git a/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml
index 4fb5749e71c88..12e4d490300ec 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml
@@ -117,6 +117,15 @@
       </listitem>
       <listitem>
         <para>
+          <literal>podman</literal> now uses the
+          <literal>netavark</literal> network stack. Users will need to
+          delete all of their local containers, images, volumes, etc, by
+          running <literal>podman system reset --force</literal> once
+          before upgrading their systems.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
           The EC2 image module no longer fetches instance metadata in
           stage-1. This results in a significantly smaller initramfs,
           since network drivers no longer need to be included, and
diff --git a/nixos/doc/manual/installation/upgrading.chapter.md b/nixos/doc/manual/installation/upgrading.chapter.md
index 249bcd97cec84..26b6b8cc23ef1 100644
--- a/nixos/doc/manual/installation/upgrading.chapter.md
+++ b/nixos/doc/manual/installation/upgrading.chapter.md
@@ -6,7 +6,7 @@ expressions and associated binaries. The NixOS channels are updated
 automatically from NixOS's Git repository after certain tests have
 passed and all packages have been built. These channels are:
 
--   *Stable channels*, such as [`nixos-22.11`](https://nixos.org/channels/nixos-22.05).
+-   *Stable channels*, such as [`nixos-22.11`](https://nixos.org/channels/nixos-22.11).
     These only get conservative bug fixes and package upgrades. For
     instance, a channel update may cause the Linux kernel on your system
     to be upgraded from 4.19.34 to 4.19.38 (a minor bug fix), but not
@@ -19,7 +19,7 @@ passed and all packages have been built. These channels are:
     radical changes between channel updates. It's not recommended for
     production systems.
 
--   *Small channels*, such as [`nixos-22.11-small`](https://nixos.org/channels/nixos-22.05-small)
+-   *Small channels*, such as [`nixos-22.11-small`](https://nixos.org/channels/nixos-22.11-small)
     or [`nixos-unstable-small`](https://nixos.org/channels/nixos-unstable-small).
     These are identical to the stable and unstable channels described above,
     except that they contain fewer binary packages. This means they get updated
diff --git a/nixos/doc/manual/release-notes/rl-2305.section.md b/nixos/doc/manual/release-notes/rl-2305.section.md
index b5c9c4ceb55d9..07ee346c2c872 100644
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@@ -40,6 +40,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - `borgbackup` module now has an option for inhibiting system sleep while backups are running, defaulting to off (not inhibiting sleep), available as [`services.borgbackup.jobs.<name>.inhibitsSleep`](#opt-services.borgbackup.jobs._name_.inhibitsSleep).
 
+- `podman` now uses the `netavark` network stack. Users will need to delete all of their local containers, images, volumes, etc, by running `podman system reset --force` once before upgrading their systems.
+
 - The EC2 image module no longer fetches instance metadata in stage-1. This results in a significantly smaller initramfs, since network drivers no longer need to be included, and faster boots, since metadata fetching can happen in parallel with startup of other services.
   This breaks services which rely on metadata being present by the time stage-2 is entered. Anything which reads EC2 metadata from `/etc/ec2-metadata` should now have an `after` dependency on `fetch-ec2-metadata.service`
 
diff --git a/nixos/modules/profiles/macos-builder.nix b/nixos/modules/profiles/macos-builder.nix
index fddf19ad12517..4a5359582bce0 100644
--- a/nixos/modules/profiles/macos-builder.nix
+++ b/nixos/modules/profiles/macos-builder.nix
@@ -59,10 +59,14 @@ in
     trusted-users = [ "root" user ];
   };
 
-  services.openssh = {
-    enable = true;
+  services = {
+    getty.autologinUser = user;
 
-    authorizedKeysFiles = [ "${keysDirectory}/%u_${keyType}.pub" ];
+    openssh = {
+      enable = true;
+
+      authorizedKeysFiles = [ "${keysDirectory}/%u_${keyType}.pub" ];
+    };
   };
 
   system.build.macos-builder-installer =
diff --git a/nixos/modules/services/monitoring/apcupsd.nix b/nixos/modules/services/monitoring/apcupsd.nix
index d4216b44cdc8c..666479c78a84d 100644
--- a/nixos/modules/services/monitoring/apcupsd.nix
+++ b/nixos/modules/services/monitoring/apcupsd.nix
@@ -62,6 +62,21 @@ let
 
   );
 
+  # Ensure the CLI uses our generated configFile
+  wrappedBinaries = pkgs.runCommandLocal "apcupsd-wrapped-binaries"
+    { nativeBuildInputs = [ pkgs.makeWrapper ]; }
+    ''
+      for p in "${lib.getBin pkgs.apcupsd}/bin/"*; do
+          bname=$(basename "$p")
+          makeWrapper "$p" "$out/bin/$bname" --add-flags "-f ${configFile}"
+      done
+    '';
+
+  apcupsdWrapped = pkgs.symlinkJoin {
+    name = "apcupsd-wrapped";
+    # Put wrappers first so they "win"
+    paths = [ wrappedBinaries pkgs.apcupsd ];
+  };
 in
 
 {
@@ -138,7 +153,7 @@ in
     } ];
 
     # Give users access to the "apcaccess" tool
-    environment.systemPackages = [ pkgs.apcupsd ];
+    environment.systemPackages = [ apcupsdWrapped ];
 
     # NOTE 1: apcupsd runs as root because it needs permission to run
     # "shutdown"
diff --git a/nixos/modules/services/x11/desktop-managers/cinnamon.nix b/nixos/modules/services/x11/desktop-managers/cinnamon.nix
index 08c5625fc7ddd..df1b6f731a4e4 100644
--- a/nixos/modules/services/x11/desktop-managers/cinnamon.nix
+++ b/nixos/modules/services/x11/desktop-managers/cinnamon.nix
@@ -180,6 +180,7 @@ in
         mint-themes
         mint-x-icons
         mint-y-icons
+        xapp # provides some xapp-* icons
       ] config.environment.cinnamon.excludePackages);
 
       xdg.mime.enable = true;
diff --git a/nixos/modules/virtualisation/podman/default.nix b/nixos/modules/virtualisation/podman/default.nix
index 13bbb4471ea5d..6c00fabaa1858 100644
--- a/nixos/modules/virtualisation/podman/default.nix
+++ b/nixos/modules/virtualisation/podman/default.nix
@@ -1,7 +1,6 @@
 { config, lib, pkgs, ... }:
 let
   cfg = config.virtualisation.podman;
-  toml = pkgs.formats.toml { };
   json = pkgs.formats.json { };
 
   inherit (lib) mkOption types;
@@ -27,24 +26,13 @@ let
     done
   '';
 
-  net-conflist = pkgs.runCommand "87-podman-bridge.conflist"
-    {
-      nativeBuildInputs = [ pkgs.jq ];
-      extraPlugins = builtins.toJSON cfg.defaultNetwork.extraPlugins;
-      jqScript = ''
-        . + { "plugins": (.plugins + $extraPlugins) }
-      '';
-    } ''
-    jq <${cfg.package}/etc/cni/net.d/87-podman-bridge.conflist \
-      --argjson extraPlugins "$extraPlugins" \
-      "$jqScript" \
-      >$out
-  '';
-
 in
 {
   imports = [
-    ./dnsname.nix
+    (lib.mkRemovedOptionModule [ "virtualisation" "podman" "defaultNetwork" "dnsname" ]
+      "Use virtualisation.podman.defaultNetwork.settings.dns_enabled instead.")
+    (lib.mkRemovedOptionModule [ "virtualisation" "podman" "defaultNetwork" "extraPlugins" ]
+      "Netavark isn't compatible with CNI plugins.")
     ./network-socket.nix
   ];
 
@@ -149,11 +137,11 @@ in
       '';
     };
 
-    defaultNetwork.extraPlugins = lib.mkOption {
-      type = types.listOf json.type;
-      default = [ ];
+    defaultNetwork.settings = lib.mkOption {
+      type = json.type;
+      default = { };
       description = lib.mdDoc ''
-        Extra CNI plugin configurations to add to podman's default network.
+        Settings for podman's default network.
       '';
     };
 
@@ -164,11 +152,26 @@ in
       environment.systemPackages = [ cfg.package ]
         ++ lib.optional cfg.dockerCompat dockerCompat;
 
-      environment.etc."cni/net.d/87-podman-bridge.conflist".source = net-conflist;
+      # https://github.com/containers/podman/blob/097cc6eb6dd8e598c0e8676d21267b4edb11e144/docs/tutorials/basic_networking.md#default-network
+      environment.etc."containers/networks/podman.json" = lib.mkIf (cfg.defaultNetwork.settings != { }) {
+        source = json.generate "podman.json" ({
+          dns_enabled = false;
+          driver = "bridge";
+          id = "0000000000000000000000000000000000000000000000000000000000000000";
+          internal = false;
+          ipam_options = { driver = "host-local"; };
+          ipv6_enabled = false;
+          name = "podman";
+          network_interface = "podman0";
+          subnets = [{ gateway = "10.88.0.1"; subnet = "10.88.0.0/16"; }];
+        } // cfg.defaultNetwork.settings);
+      };
 
       virtualisation.containers = {
         enable = true; # Enable common /etc/containers configuration
-        containersConf.settings = lib.optionalAttrs cfg.enableNvidia {
+        containersConf.settings = {
+          network.network_backend = "netavark";
+        } // lib.optionalAttrs cfg.enableNvidia {
           engine = {
             conmon_env_vars = [ "PATH=${lib.makeBinPath [ pkgs.nvidia-podman ]}" ];
             runtimes.nvidia = [ "${pkgs.nvidia-podman}/bin/nvidia-container-runtime" ];
diff --git a/nixos/modules/virtualisation/podman/dnsname.nix b/nixos/modules/virtualisation/podman/dnsname.nix
deleted file mode 100644
index 3e7d35ae1e44d..0000000000000
--- a/nixos/modules/virtualisation/podman/dnsname.nix
+++ /dev/null
@@ -1,36 +0,0 @@
-{ config, lib, pkgs, ... }:
-let
-  inherit (lib)
-    mkOption
-    mkIf
-    types
-    ;
-
-  cfg = config.virtualisation.podman;
-
-in
-{
-  options = {
-    virtualisation.podman = {
-
-      defaultNetwork.dnsname.enable = mkOption {
-        type = types.bool;
-        default = false;
-        description = lib.mdDoc ''
-          Enable DNS resolution in the default podman network.
-        '';
-      };
-
-    };
-  };
-
-  config = {
-    virtualisation.containers.containersConf.cniPlugins = mkIf cfg.defaultNetwork.dnsname.enable [ pkgs.dnsname-cni ];
-    virtualisation.podman.defaultNetwork.extraPlugins =
-      lib.optional cfg.defaultNetwork.dnsname.enable {
-        type = "dnsname";
-        domainName = "dns.podman";
-        capabilities.aliases = true;
-      };
-  };
-}
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 75f01d888b218..83ad7c48a0892 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -78,6 +78,7 @@ in {
   allTerminfo = handleTest ./all-terminfo.nix {};
   alps = handleTest ./alps.nix {};
   amazon-init-shell = handleTest ./amazon-init-shell.nix {};
+  apcupsd = handleTest ./apcupsd.nix {};
   apfs = handleTest ./apfs.nix {};
   apparmor = handleTest ./apparmor.nix {};
   atd = handleTest ./atd.nix {};
@@ -527,7 +528,6 @@ in {
   plotinus = handleTest ./plotinus.nix {};
   podgrab = handleTest ./podgrab.nix {};
   podman = handleTestOn ["aarch64-linux" "x86_64-linux"] ./podman/default.nix {};
-  podman-dnsname = handleTestOn ["aarch64-linux" "x86_64-linux"] ./podman/dnsname.nix {};
   podman-tls-ghostunnel = handleTestOn ["aarch64-linux" "x86_64-linux"] ./podman/tls-ghostunnel.nix {};
   polaris = handleTest ./polaris.nix {};
   pomerium = handleTestOn ["x86_64-linux"] ./pomerium.nix {};
diff --git a/nixos/tests/apcupsd.nix b/nixos/tests/apcupsd.nix
new file mode 100644
index 0000000000000..287140f039d85
--- /dev/null
+++ b/nixos/tests/apcupsd.nix
@@ -0,0 +1,41 @@
+let
+  # arbitrary address
+  ipAddr = "192.168.42.42";
+in
+import ./make-test-python.nix ({ lib, pkgs, ... }: {
+  name = "apcupsd";
+  meta.maintainers = with lib.maintainers; [ bjornfor ];
+
+  nodes = {
+    machine = {
+      services.apcupsd = {
+        enable = true;
+        configText = ''
+          UPSTYPE usb
+          BATTERYLEVEL 42
+          # Configure NISIP so that the only way apcaccess can work is to read
+          # this config.
+          NISIP ${ipAddr}
+        '';
+      };
+      networking.interfaces.eth1 = {
+        ipv4.addresses = [{
+          address = ipAddr;
+          prefixLength = 24;
+        }];
+      };
+    };
+  };
+
+  # Check that the service starts, that the CLI (apcaccess) works and that it
+  # uses the config (ipAddr) defined in the service config.
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("apcupsd.service")
+    machine.wait_for_open_port(3551, "${ipAddr}")
+    res = machine.succeed("apcaccess")
+    expect_line="MBATTCHG : 42 Percent"
+    assert "MBATTCHG : 42 Percent" in res, f"expected apcaccess output to contain '{expect_line}' but got '{res}'"
+    machine.shutdown()
+  '';
+})
diff --git a/nixos/tests/podman/default.nix b/nixos/tests/podman/default.nix
index 106ba2057d063..c2ea399d65af3 100644
--- a/nixos/tests/podman/default.nix
+++ b/nixos/tests/podman/default.nix
@@ -13,6 +13,13 @@ import ../make-test-python.nix (
           isNormalUser = true;
         };
       };
+      dns = { pkgs, ... }: {
+        virtualisation.podman.enable = true;
+
+        virtualisation.podman.defaultNetwork.settings.dns_enabled = true;
+
+        networking.firewall.allowedUDPPorts = [ 53 ];
+      };
       docker = { pkgs, ... }: {
         virtualisation.podman.enable = true;
 
@@ -43,6 +50,7 @@ import ../make-test-python.nix (
 
 
       podman.wait_for_unit("sockets.target")
+      dns.wait_for_unit("sockets.target")
       docker.wait_for_unit("sockets.target")
       start_all()
 
@@ -120,6 +128,23 @@ import ../make-test-python.nix (
           pid = podman.succeed("podman run --rm --init busybox readlink /proc/self").strip()
           assert pid == "2"
 
+      with subtest("aardvark-dns"):
+        dns.succeed("tar cv --files-from /dev/null | podman import - scratchimg")
+        dns.succeed(
+          "podman run -d --name=webserver -v /nix/store:/nix/store -v /run/current-system/sw/bin:/bin -w ${pkgs.writeTextDir "index.html" "<h1>Hi</h1>"} scratchimg ${pkgs.python3}/bin/python -m http.server 8000"
+        )
+        dns.succeed("podman ps | grep webserver")
+        dns.succeed("""
+          for i in `seq 0 120`; do
+            podman run --rm --name=client -v /nix/store:/nix/store -v /run/current-system/sw/bin:/bin scratchimg ${pkgs.curl}/bin/curl http://webserver:8000 >/dev/console \
+              && exit 0
+            sleep 0.5
+          done
+          exit 1
+        """)
+        dns.succeed("podman stop webserver")
+        dns.succeed("podman rm webserver")
+
       with subtest("A podman member can use the docker cli"):
           docker.succeed(su_cmd("docker version"))
 
diff --git a/nixos/tests/podman/dnsname.nix b/nixos/tests/podman/dnsname.nix
deleted file mode 100644
index 3768ae79e0676..0000000000000
--- a/nixos/tests/podman/dnsname.nix
+++ /dev/null
@@ -1,42 +0,0 @@
-import ../make-test-python.nix (
-  { pkgs, lib, ... }:
-  let
-    inherit (pkgs) writeTextDir python3 curl;
-    webroot = writeTextDir "index.html" "<h1>Hi</h1>";
-  in
-  {
-    name = "podman-dnsname";
-    meta = {
-      maintainers = with lib.maintainers; [ roberth ] ++ lib.teams.podman.members;
-    };
-
-    nodes = {
-      podman = { pkgs, ... }: {
-        virtualisation.podman.enable = true;
-        virtualisation.podman.defaultNetwork.dnsname.enable = true;
-      };
-    };
-
-    testScript = ''
-      podman.wait_for_unit("sockets.target")
-
-      with subtest("DNS works"): # also tests inter-container tcp routing
-        podman.succeed("tar cv --files-from /dev/null | podman import - scratchimg")
-        podman.succeed(
-          "podman run -d --name=webserver -v /nix/store:/nix/store -v /run/current-system/sw/bin:/bin -w ${webroot} scratchimg ${python3}/bin/python -m http.server 8000"
-        )
-        podman.succeed("podman ps | grep webserver")
-        podman.succeed("""
-          for i in `seq 0 120`; do
-            podman run --rm --name=client -v /nix/store:/nix/store -v /run/current-system/sw/bin:/bin scratchimg ${curl}/bin/curl http://webserver:8000 >/dev/console \
-              && exit 0
-            sleep 0.5
-          done
-          exit 1
-        """)
-        podman.succeed("podman stop webserver")
-        podman.succeed("podman rm webserver")
-
-    '';
-  }
-)
diff --git a/pkgs/applications/blockchains/polkadot/default.nix b/pkgs/applications/blockchains/polkadot/default.nix
index 596130337c7ad..1f5636dd41c34 100644
--- a/pkgs/applications/blockchains/polkadot/default.nix
+++ b/pkgs/applications/blockchains/polkadot/default.nix
@@ -10,13 +10,13 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "polkadot";
-  version = "0.9.33";
+  version = "0.9.36";
 
   src = fetchFromGitHub {
     owner = "paritytech";
     repo = "polkadot";
     rev = "v${version}";
-    sha256 = "sha256-vAFGLcsbGuoaNtxtEIHSeX00nsULJROCEhaMv5IEcp4=";
+    sha256 = "sha256-HzQFlnn+SPasI0g0DYDCRoFCMVyxlUmEQAobvzRnAW4=";
 
     # the build process of polkadot requires a .git folder in order to determine
     # the git commit hash that is being built and add it to the version string.
@@ -32,7 +32,7 @@ rustPlatform.buildRustPackage rec {
     '';
   };
 
-  cargoSha256 = "sha256-SZUkgtI/4kA5iWzalmGo5KXRHXKgdeCo2SSCVF66p5E=";
+  cargoSha256 = "sha256-P31GW/1HiaZLF6e8Fq1YnH1ZLhiOhURm8st9a4KRlJU=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ Security ];
 
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index 263c0428ff149..72f2dd526867b 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -4665,6 +4665,43 @@ final: prev:
     meta.homepage = "https://github.com/chentoast/marks.nvim/";
   };
 
+  mason-lspconfig-nvim = buildVimPluginFrom2Nix {
+    pname = "mason-lspconfig.nvim";
+    version = "2022-07-25";
+    src = fetchFromGitHub {
+      owner = "williamboman";
+      repo = "mason-lspconfig.nvim";
+      rev = "ad3b109cff22af979ab3d15564cd63dc3ae2f0f0";
+      sha256 = "0jvnc9zlr5cazdrhjm1v0bjkrz5lb2z8dzlkq59b433f52qv9zrf";
+    };
+    meta.homepage = "https://github.com/williamboman/mason-lspconfig.nvim/";
+  };
+
+  mason-tool-installer-nvim = buildVimPluginFrom2Nix {
+    pname = "mason-tool-installer.nvim";
+    version = "2022-07-26";
+    src = fetchFromGitHub {
+      owner = "WhoIsSethDaniel";
+      repo = "mason-tool-installer.nvim";
+      rev = "6d9276655c09ef2358ddb105cac4a34cfa8853c0";
+      sha256 = "0j5k9fhjffkx3b5asnwxzj22fvncs69vs0rkx13ii3gdvwczbc5w";
+    };
+    meta.homepage = "https://github.com/WhoIsSethDaniel/mason-tool-installer.nvim/";
+  };
+
+
+  mason-nvim = buildVimPluginFrom2Nix {
+    pname = "mason.nvim";
+    version = "2022-07-27";
+    src = fetchFromGitHub {
+      owner = "williamboman";
+      repo = "mason.nvim";
+      rev = "269ee222f76e705619da2c0130c0a06e76419b88";
+      sha256 = "1bngr68gfv33p989dqhz6xmhips7i2yjni96qgnqwhdjczfw865v";
+    };
+    meta.homepage = "https://github.com/williamboman/mason.nvim/";
+  };
+
   matchit-zip = buildVimPluginFrom2Nix {
     pname = "matchit.zip";
     version = "2010-10-18";
diff --git a/pkgs/applications/editors/vim/plugins/overrides.nix b/pkgs/applications/editors/vim/plugins/overrides.nix
index e94ac82659d78..8d5f6bcd27d34 100644
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@@ -598,6 +598,14 @@ self: super: {
     '';
   });
 
+  mason-lspconfig-nvim = super.mason-lspconfig-nvim.overrideAttrs (old: {
+    dependencies = with self; [ mason-nvim nvim-lspconfig ];
+  });
+
+  mason-tool-installer-nvim = super.mason-tool-installer-nvim.overrideAttrs (old: {
+    dependencies = with self; [ mason-nvim ];
+  });
+
   meson = buildVimPluginFrom2Nix {
     inherit (meson) pname version src;
     preInstall = "cd data/syntax-highlighting/vim";
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index f729c240f5df7..4cfe4228ea9fd 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -391,6 +391,9 @@ https://github.com/rktjmp/lush.nvim/,,
 https://github.com/mkasa/lushtags/,,
 https://github.com/iamcco/markdown-preview.nvim/,,
 https://github.com/chentoast/marks.nvim/,,
+https://github.com/williamboman/mason-lspconfig.nvim/,HEAD,
+https://github.com/WhoIsSethDaniel/mason-tool-installer.nvim/,HEAD,
+https://github.com/williamboman/mason.nvim/,HEAD,
 https://github.com/vim-scripts/matchit.zip/,,
 https://github.com/marko-cerovac/material.nvim/,,
 https://github.com/kaicataldo/material.vim/,HEAD,
diff --git a/pkgs/applications/graphics/qview/default.nix b/pkgs/applications/graphics/qview/default.nix
index 7f4f4cc1a9765..e5d148da8e6a5 100644
--- a/pkgs/applications/graphics/qview/default.nix
+++ b/pkgs/applications/graphics/qview/default.nix
@@ -3,33 +3,31 @@
 , fetchFromGitHub
 , qmake
 , qtbase
+, qttools
 , qtimageformats
 , qtsvg
 }:
 
 mkDerivation rec {
   pname = "qview";
-  version = "4.0";
+  version = "5.0";
 
   src = fetchFromGitHub {
     owner = "jurplel";
     repo = "qView";
     rev = version;
-    sha256 = "15n9cq7w3ckinnx38hvncxrbkv4qm4k51sal41q4y0pkvhmafhnr";
+    hash = "sha256-VQ0H9iPrrxO9e/kMo7yZ/zN5I2qDWBCAFacS9uGuZLI=";
   };
 
   nativeBuildInputs = [ qmake ];
 
   buildInputs = [
     qtbase
+    qttools
     qtimageformats
     qtsvg
   ];
 
-  patchPhase = ''
-    sed "s|/usr/|$out/|g" -i qView.pro
-  '';
-
   meta = with lib; {
     description = "Practical and minimal image viewer";
     homepage = "https://interversehq.com/qview/";
diff --git a/pkgs/applications/misc/electrum/default.nix b/pkgs/applications/misc/electrum/default.nix
index bab227aee779e..f4e6ad3feb3c9 100644
--- a/pkgs/applications/misc/electrum/default.nix
+++ b/pkgs/applications/misc/electrum/default.nix
@@ -20,7 +20,7 @@
 }:
 
 let
-  version = "4.3.2";
+  version = "4.3.3";
 
   libsecp256k1_name =
     if stdenv.isLinux then "libsecp256k1.so.0"
@@ -37,7 +37,7 @@ let
     owner = "spesmilo";
     repo = "electrum";
     rev = version;
-    sha256 = "sha256-z2/UamKmBq/5a0PTbHdAqGK617Lc8xRhHRpbCc7jeZo=";
+    sha256 = "sha256-40GfOKBTAi8RAsAVrG9rv1Jr5IqM+1yro6YYRsSULxw=";
 
     postFetch = ''
       mv $out ./all
@@ -53,7 +53,7 @@ python3.pkgs.buildPythonApplication {
 
   src = fetchurl {
     url = "https://download.electrum.org/${version}/Electrum-${version}.tar.gz";
-    sha256 = "sha256-vTZArTwbKcf6/vPQOvjubPecsg+h+QlZ6rdbl6qNfs0=";
+    sha256 = "sha256-NPXGfbEjT9l88ZnGbDcE3+oGxThTzW7YfesBzssGsbc=";
   };
 
   postUnpack = ''
diff --git a/pkgs/applications/misc/limesctl/default.nix b/pkgs/applications/misc/limesctl/default.nix
index 5ac3e9938fc3e..a40b253d4ba09 100644
--- a/pkgs/applications/misc/limesctl/default.nix
+++ b/pkgs/applications/misc/limesctl/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "limesctl";
-  version = "3.1.1";
+  version = "3.1.3";
 
   src = fetchFromGitHub {
     owner = "sapcc";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-/CYZMuW5/YoZszTOaQZLRhJdZAGGMY+s7vMK01hyMvg=";
+    sha256 = "sha256-fi36jsQr/Mn1FyOlle/WSpREQgZU6+h4IJzd3ZfItvI=";
   };
 
-  vendorSha256 = "sha256-BwhbvCUOOp5ZeY/22kIZ58e+iPH0pVgiNOyoD6O2zPo=";
+  vendorSha256 = "sha256-gcIPASIk4Zq8y+KppYNRkf/9guCsYv9XskFANrqOCts=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/applications/misc/remarkable/rmapi/default.nix b/pkgs/applications/misc/remarkable/rmapi/default.nix
index 2a3fbb4470110..2da548619b140 100644
--- a/pkgs/applications/misc/remarkable/rmapi/default.nix
+++ b/pkgs/applications/misc/remarkable/rmapi/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "rmapi";
-  version = "0.0.23";
+  version = "0.0.25";
 
   src = fetchFromGitHub {
     owner = "juruen";
     repo = "rmapi";
     rev = "v${version}";
-    sha256 = "sha256-x6J3lQqSiqROLFB+S6nY/ONSluc7ffqJcK93bQpsjIs=";
+    sha256 = "sha256-7pwCd9tey7w5B8UgsMLHegPqmmY1prLM+Sk9o42X9lY=";
   };
 
   vendorSha256 = "sha256-Id2RaiSxthyR6egDQz2zulbSZ4STRTaA3yQIr6Mx9kg=";
diff --git a/pkgs/applications/misc/yubioath-flutter/default.nix b/pkgs/applications/misc/yubioath-flutter/default.nix
index 50bb48347ac64..6b58dd1caf5db 100644
--- a/pkgs/applications/misc/yubioath-flutter/default.nix
+++ b/pkgs/applications/misc/yubioath-flutter/default.nix
@@ -4,6 +4,8 @@
 , fetchFromGitHub
 , stdenv
 , pcre2
+, gnome
+, makeWrapper
 }:
 let
   vendorHashes = {
@@ -54,12 +56,20 @@ flutter.mkFlutterApp rec {
     # Symlink binary.
     ln -sf "$out/app/authenticator" "$out/bin/yubioath-flutter"
 
+    # Needed for QR scanning to work.
+    wrapProgram "$out/bin/yubioath-flutter" \
+      --prefix PATH : ${lib.makeBinPath [ gnome.gnome-screenshot ]}
+
     # Set the correct path to the binary in desktop file.
     substituteInPlace "$out/share/applications/com.yubico.authenticator.desktop" \
       --replace "@EXEC_PATH/authenticator" "$out/bin/yubioath-flutter" \
       --replace "@EXEC_PATH/linux_support/com.yubico.yubioath.png" "$out/share/icons/com.yubico.yubioath.png"
   '';
 
+  nativeBuildInputs = [
+    makeWrapper
+  ];
+
   buildInputs = [
     pcre2
   ];
diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.json b/pkgs/applications/networking/browsers/chromium/upstream-info.json
index 74942ffd03f34..daf40e3aadfdb 100644
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.json
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json
@@ -19,9 +19,9 @@
     }
   },
   "beta": {
-    "version": "109.0.5414.61",
-    "sha256": "1dk832ishjhba0rnf57w7vqrr8dyqga6zsgw9945i7zz997fpjyi",
-    "sha256bin64": "1s1d7h9ygzpa5b39pdivn5vvpm7fpnhw5p3lz8blrgn61m8h6jg6",
+    "version": "109.0.5414.74",
+    "sha256": "0pcfaj3n3rjk4va9g0ajlsv1719kdhqcnjdd4piinqxb4qy27vgd",
+    "sha256bin64": "1ihjjf8x5080p9bizhqrrr0rcjf0l1nps9xq9naa2f48y5zfshkd",
     "deps": {
       "gn": {
         "version": "2022-11-10",
diff --git a/pkgs/applications/networking/cluster/cni/plugins.nix b/pkgs/applications/networking/cluster/cni/plugins.nix
index aad583c675c01..bc39dbcd5e400 100644
--- a/pkgs/applications/networking/cluster/cni/plugins.nix
+++ b/pkgs/applications/networking/cluster/cni/plugins.nix
@@ -38,7 +38,7 @@ buildGoModule rec {
     "plugins/meta/vrf"
   ];
 
-  passthru.tests = { inherit (nixosTests) cri-o podman; };
+  passthru.tests = { inherit (nixosTests) cri-o; };
 
   meta = with lib; {
     description = "Some standard networking plugins, maintained by the CNI team";
diff --git a/pkgs/applications/networking/cluster/dnsname-cni/default.nix b/pkgs/applications/networking/cluster/dnsname-cni/default.nix
index a0bc37f2cdb84..3a543f40dd49c 100644
--- a/pkgs/applications/networking/cluster/dnsname-cni/default.nix
+++ b/pkgs/applications/networking/cluster/dnsname-cni/default.nix
@@ -3,7 +3,6 @@
   dnsmasq,
   fetchFromGitHub,
   lib,
-  nixosTests,
   makeWrapper,
 }:
 
@@ -28,10 +27,6 @@ buildGoModule rec {
 
   doCheck = false; # NOTE: requires root privileges
 
-  passthru.tests = {
-    inherit (nixosTests) podman-dnsname;
-  };
-
   meta = with lib; {
     description = "DNS name resolution for containers";
     homepage = "https://github.com/containers/dnsname";
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 76e9f34dbeba3..52416fc34c8bb 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -149,11 +149,11 @@
   },
   "baiducloud": {
     "deleteVendor": true,
-    "hash": "sha256-MwpFSUhAZ6TjqWfsy7qazBtd1CrLbsAIDyRLonsDXiM=",
+    "hash": "sha256-g3+n0Q0Hl4yRaYK0snl4um5B5FS54Y6aMM7LeluPik4=",
     "homepage": "https://registry.terraform.io/providers/baidubce/baiducloud",
     "owner": "baidubce",
     "repo": "terraform-provider-baiducloud",
-    "rev": "v1.19.1",
+    "rev": "v1.19.2",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-3PLBs8LSE5JPtrhmdx+jQsnCrfZQQEUGA7wnf9M72yY="
   },
@@ -424,11 +424,11 @@
     "vendorHash": "sha256-uWTY8cFztXFrQQ7GW6/R+x9M6vHmsb934ldq+oeW5vk="
   },
   "github": {
-    "hash": "sha256-o7Sge0rCfP6Yueq+DP7siBsEinawgGe+nEu0/Olu8uQ=",
+    "hash": "sha256-foPj/zLJJx3mI1PpDwcThptT5EprEDfakUWRsjaa0nc=",
     "homepage": "https://registry.terraform.io/providers/integrations/github",
     "owner": "integrations",
     "repo": "terraform-provider-github",
-    "rev": "v5.12.0",
+    "rev": "v5.13.0",
     "spdx": "MIT",
     "vendorHash": null
   },
diff --git a/pkgs/applications/networking/cluster/terraform/default.nix b/pkgs/applications/networking/cluster/terraform/default.nix
index fe105fa3b71ab..4865ca4901cb8 100644
--- a/pkgs/applications/networking/cluster/terraform/default.nix
+++ b/pkgs/applications/networking/cluster/terraform/default.nix
@@ -168,8 +168,8 @@ rec {
   mkTerraform = attrs: pluggable (generic attrs);
 
   terraform_1 = mkTerraform {
-    version = "1.3.6";
-    sha256 = "sha256-aETsvcHoHSwqWCAdn9JPJLcX1Wi1umUghSjkq37OYDU=";
+    version = "1.3.7";
+    sha256 = "sha256-z49DXJ9oYObJQWHPeuKvQ6jJtAheYuy0+QmvZ74ZbTQ";
     vendorSha256 = "sha256-fviukVGBkbxFs2fJpEp/tFMymXex7NRQdcGIIA9W88k=";
     patches = [ ./provider-path-0_15.patch ];
     passthru = {
diff --git a/pkgs/applications/networking/instant-messengers/keet/default.nix b/pkgs/applications/networking/instant-messengers/keet/default.nix
new file mode 100644
index 0000000000000..557078cd8b508
--- /dev/null
+++ b/pkgs/applications/networking/instant-messengers/keet/default.nix
@@ -0,0 +1,32 @@
+{ lib, appimageTools, fetchurl }:
+
+let
+  pname = "keet";
+  version = "1.2.1";
+
+  src = fetchurl {
+    url = "https://keet.io/downloads/${version}/Keet.AppImage";
+    sha256 = "1f76ccfa16719a24f6d84b88e5ca49fab1c372de309ce74393461903c5c49d98";
+  };
+
+  appimageContents = appimageTools.extract { inherit pname version src; };
+in appimageTools.wrapType2 {
+  inherit src pname version;
+
+  extraInstallCommands = ''
+    mv $out/bin/${pname}-${version} $out/bin/${pname}
+
+    install -m 444 -D ${appimageContents}/${pname}.desktop -t $out/share/applications
+    substituteInPlace $out/share/applications/${pname}.desktop \
+      --replace 'Exec=AppRun' 'Exec=${pname}'
+    cp -r ${appimageContents}/usr/share/icons $out/share
+  '';
+
+  meta = with lib; {
+    description = "Peer-to-Peer Chat";
+    homepage = "https://keet.io";
+    license = licenses.unfree;
+    maintainers = with maintainers; [ extends ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
diff --git a/pkgs/applications/networking/seaweedfs/default.nix b/pkgs/applications/networking/seaweedfs/default.nix
index cf23d22087396..3757d57df8160 100644
--- a/pkgs/applications/networking/seaweedfs/default.nix
+++ b/pkgs/applications/networking/seaweedfs/default.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "seaweedfs";
-  version = "3.34";
+  version = "3.38";
 
   src = fetchFromGitHub {
-    owner = "chrislusf";
+    owner = "seaweedfs";
     repo = "seaweedfs";
     rev = version;
-    hash = "sha256-lOCZHkLJCDvaT3CcHUBbsybdy0H6BfKKGpd/73cxcWA=";
+    hash = "sha256-LYMGkv1rgUtA/TwulBhgw0w+8kbICtEgr7/K6exalxM=";
   };
 
-  vendorHash = "sha256-1RUWONkXArXYg8gQogKUhMSGdIYyT3lq5qWuUQBsFig=";
+  vendorHash = "sha256-mwfs/tdq1Qq2auEwz24emf7pjpIJAncI78oxhAn2WkI=";
 
   subPackages = [ "weed" ];
 
@@ -49,7 +49,7 @@ buildGoModule rec {
   meta = with lib; {
     description = "Simple and highly scalable distributed file system";
     homepage = "https://github.com/chrislusf/seaweedfs";
-    maintainers = with maintainers; [ azahi cmacrae ];
+    maintainers = with maintainers; [ azahi cmacrae wozeparrot ];
     mainProgram = "weed";
     license = licenses.asl20;
   };
diff --git a/pkgs/applications/video/haruna/default.nix b/pkgs/applications/video/haruna/default.nix
index 0d063e707185c..a776fabc9a790 100644
--- a/pkgs/applications/video/haruna/default.nix
+++ b/pkgs/applications/video/haruna/default.nix
@@ -26,13 +26,13 @@
 
 mkDerivation rec {
   pname = "haruna";
-  version = "0.9.3";
+  version = "0.10.0";
 
   src = fetchFromGitLab {
     owner = "multimedia";
     repo = "haruna";
     rev = "v${version}";
-    hash = "sha256-JINvLmiS6EnkAmxbqPJI+J9Wk4+ZXwZZm1x5Ew7FCBg=";
+    hash = "sha256-UU8tbaZz7udDulh+PHPZDc3rm1MvK4dafPgXL50apMI=";
     domain = "invent.kde.org";
   };
 
diff --git a/pkgs/applications/virtualization/podman/default.nix b/pkgs/applications/virtualization/podman/default.nix
index 3fed07237f75e..f6cc83fde17c4 100644
--- a/pkgs/applications/virtualization/podman/default.nix
+++ b/pkgs/applications/virtualization/podman/default.nix
@@ -68,7 +68,6 @@ buildGoModule rec {
     ${if stdenv.isDarwin then ''
       mv bin/{darwin/podman,podman}
     '' else ''
-      install -Dm644 cni/87-podman-bridge.conflist -t $out/etc/cni/net.d
       install -Dm644 contrib/tmpfile/podman.conf -t $out/lib/tmpfiles.d
       for s in contrib/systemd/**/*.in; do
         substituteInPlace "$s" --replace "@@PODMAN@@" "podman" # don't use unwrapped binary
@@ -92,7 +91,6 @@ buildGoModule rec {
     # related modules
     inherit (nixosTests)
       podman-tls-ghostunnel
-      podman-dnsname
       ;
     oci-containers-podman = nixosTests.oci-containers.podman;
   };
diff --git a/pkgs/applications/virtualization/podman/wrapper.nix b/pkgs/applications/virtualization/podman/wrapper.nix
index d0131eacdd37e..7fe483a7079e5 100644
--- a/pkgs/applications/virtualization/podman/wrapper.nix
+++ b/pkgs/applications/virtualization/podman/wrapper.nix
@@ -15,12 +15,12 @@
 , iproute2
 , catatonit
 , gvproxy
+, aardvark-dns
+, netavark
 }:
 
 # do not add qemu to this wrapper, store paths get written to the podman vm config and break when GCed
 
-# adding aardvark-dns/netavark to `helpersBin` requires changes to the modules and tests
-
 let
   binPath = lib.makeBinPath ([
   ] ++ lib.optionals stdenv.isLinux [
@@ -41,7 +41,9 @@ let
     paths = [
       gvproxy
     ] ++ lib.optionals stdenv.isLinux [
+      aardvark-dns
       catatonit # added here for the pause image and also set in `containersConf` for `init_path`
+      netavark
       podman-unwrapped.rootlessport
     ];
   };
diff --git a/pkgs/applications/window-managers/picom/picom-next.nix b/pkgs/applications/window-managers/picom/picom-next.nix
index c89eb9e7cab31..3788974355489 100644
--- a/pkgs/applications/window-managers/picom/picom-next.nix
+++ b/pkgs/applications/window-managers/picom/picom-next.nix
@@ -1,13 +1,14 @@
-{ picom, lib, fetchFromGitHub }:
+{ pcre, pcre2, picom, lib, fetchFromGitHub }:
 
 picom.overrideAttrs (oldAttrs: rec {
   pname = "picom-next";
-  version = "unstable-2022-09-29";
+  version = "unstable-2022-12-23";
+  buildInputs = [ pcre2 ] ++ lib.remove pcre oldAttrs.buildInputs;
   src = fetchFromGitHub {
     owner = "yshui";
     repo = "picom";
-    rev = "0fe4e0a1d4e2c77efac632b15f9a911e47fbadf3";
-    sha256 = "1slcmayja8cszapxzs83xl1i9n9q0dz79cn5gzzf4mfcwvnxp8km";
+    rev = "60ac2b64db78363fe04189cc734daea3d721d87e";
+    sha256 = "09s8kgczks01xbvg3qxqi2rz3lkzgdfyvhrj30mg6n11b6xfgi0d";
   };
   meta.maintainers = with lib.maintainers; oldAttrs.meta.maintainers ++ [ GKasparov ];
 })
diff --git a/pkgs/data/misc/osinfo-db/default.nix b/pkgs/data/misc/osinfo-db/default.nix
index 0f11459a17028..67c3dc7a3c12c 100644
--- a/pkgs/data/misc/osinfo-db/default.nix
+++ b/pkgs/data/misc/osinfo-db/default.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation rec {
   pname = "osinfo-db";
-  version = "20220830";
+  version = "20221130";
 
   src = fetchurl {
     url = "https://releases.pagure.org/libosinfo/${pname}-${version}.tar.xz";
-    sha256 = "sha256-gRFkPZDeq4ONt/IT8VS+8uBXNQqcg0JF7gHdZEM7qvs=";
+    sha256 = "sha256-opVMrXob7yZ5lJmHxjiI8eCBsJ4R+3JQVDcvA37HcX8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/compilers/blueprint/default.nix b/pkgs/development/compilers/blueprint/default.nix
index 7ac0a68be05b9..425ea5766f9c0 100644
--- a/pkgs/development/compilers/blueprint/default.nix
+++ b/pkgs/development/compilers/blueprint/default.nix
@@ -1,14 +1,13 @@
-{ gtk4
-, python3
-, stdenv
-, fetchFromGitLab
+{ fetchFromGitLab
 , gobject-introspection
+, gtk4
 , lib
 , meson
 , ninja
+, python3
+, stdenv
 , testers
 }:
-
 stdenv.mkDerivation (finalAttrs: {
   pname = "blueprint-compiler";
   version = "0.6.0";
@@ -21,31 +20,27 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-L6EGterkZ8EB6xSnJDZ3IMuOumpTpEGnU74X3UgC7k0=";
   };
 
-  doCheck = true;
-
   nativeBuildInputs = [
     meson
     ninja
   ];
 
   buildInputs = [
-    python3
-    gtk4
-  ] ++ (with python3.pkgs; [
-    pygobject3
-    wrapPython
-  ]);
+    (python3.withPackages (ps: with ps; [
+      pygobject3
+    ]))
+  ];
 
   propagatedBuildInputs = [
+    # For setup hook, so that the compiler can find typelib files
     gobject-introspection
   ];
 
-  postFixup = ''
-    makeWrapperArgs="\
-      --prefix GI_TYPELIB_PATH : $GI_TYPELIB_PATH \
-      --prefix PYTHONPATH : \"$(toPythonPath $out):$(toPythonPath ${python3.pkgs.pygobject3})\""
-    wrapPythonPrograms
-  '';
+  doCheck = true;
+
+  checkInputs = [
+    gtk4
+  ];
 
   passthru.tests.version = testers.testVersion {
     package = finalAttrs.finalPackage;
diff --git a/pkgs/development/compilers/gcc/12/default.nix b/pkgs/development/compilers/gcc/12/default.nix
index 78c7a12027ce5..3c9362fee1ad2 100644
--- a/pkgs/development/compilers/gcc/12/default.nix
+++ b/pkgs/development/compilers/gcc/12/default.nix
@@ -16,6 +16,7 @@
 , gmp, mpfr, libmpc, gettext, which, patchelf
 , isl ? null # optional, for the Graphite optimization framework.
 , zlib ? null
+, libucontext ? null
 , gnatboot ? null
 , enableMultilib ? false
 , enablePlugin ? stdenv.hostPlatform == stdenv.buildPlatform # Whether to support user-supplied plug-ins
@@ -70,6 +71,44 @@ let majorVersion = "12";
       })
       ++ optional langD ../libphobos.patch
 
+      # backport fixes to build gccgo with musl libc
+      ++ optionals (langGo && stdenv.hostPlatform.isMusl) [
+        (fetchpatch {
+          excludes = [ "gcc/go/gofrontend/MERGE" ];
+          url = "https://github.com/gcc-mirror/gcc/commit/cf79b1117bd177d3d4c6ed24b6fa243c3628ac2d.diff";
+          hash = "sha256-mS5ZiYi5D8CpGXrWg3tXlbhp4o86ew1imCTwaHLfl+I=";
+        })
+        (fetchpatch {
+          excludes = [ "gcc/go/gofrontend/MERGE" ];
+          url = "https://github.com/gcc-mirror/gcc/commit/7f195a2270910a6ed08bd76e3a16b0a6503f9faf.diff";
+          hash = "sha256-Ze/cFM0dQofKH00PWPDoklXUlwWhwA1nyTuiDAZ6FKo=";
+        })
+        (fetchpatch {
+          excludes = [ "gcc/go/gofrontend/MERGE" ];
+          url = "https://github.com/gcc-mirror/gcc/commit/762fd5e5547e464e25b4bee435db6df4eda0de90.diff";
+          hash = "sha256-o28upwTcHAnHG2Iq0OewzwSBEhHs+XpBGdIfZdT81pk=";
+        })
+        (fetchpatch {
+          excludes = [ "gcc/go/gofrontend/MERGE" ];
+          url = "https://github.com/gcc-mirror/gcc/commit/e73d9fcafbd07bc3714fbaf8a82db71d50015c92.diff";
+          hash = "sha256-1SjYCVHLEUihdON2TOC3Z2ufM+jf2vH0LvYtZL+c1Fo=";
+        })
+        (fetchpatch {
+          excludes = [ "gcc/go/gofrontend/MERGE" ];
+          url = "https://github.com/gcc-mirror/gcc/commit/b6c6a3d64f2e4e9347733290aca3c75898c44b2e.diff";
+          hash = "sha256-RycJ3YCHd3MXtYFjxP0zY2Wuw7/C4bWoBAQtTKJZPOQ=";
+        })
+        (fetchpatch {
+          excludes = [ "gcc/go/gofrontend/MERGE" ];
+          url = "https://github.com/gcc-mirror/gcc/commit/2b1a604a9b28fbf4f382060bebd04adb83acc2f9.diff";
+          hash = "sha256-WiBQG0Xbk75rHk+AMDvsbrm+dc7lDH0EONJXSdEeMGE=";
+        })
+        (fetchpatch {
+          url = "https://github.com/gcc-mirror/gcc/commit/c86b726c048eddc1be320c0bf64a897658bee13d.diff";
+          hash = "sha256-QSIlqDB6JRQhbj/c3ejlmbfWz9l9FurdSWxpwDebnlI=";
+        })
+      ]
+
       # Obtain latest patch with ../update-mcfgthread-patches.sh
       ++ optional (!crossStageStatic && targetPlatform.isMinGW && threadsCross.model == "mcf") ./Added-mcf-thread-model-support-from-mcfgthread.patch;
 
@@ -178,6 +217,7 @@ stdenv.mkDerivation ({
     targetPackages.stdenv.cc.bintools # For linking code at run-time
   ] ++ (optional (isl != null) isl)
     ++ (optional (zlib != null) zlib)
+    ++ (optional (langGo && stdenv.hostPlatform.isMusl) libucontext)
     ;
 
   depsTargetTarget = optional (!crossStageStatic && threadsCross != {}) threadsCross.package;
diff --git a/pkgs/development/interpreters/python/cpython/2.7/default.nix b/pkgs/development/interpreters/python/cpython/2.7/default.nix
index 15626fe28cd7c..4052281b0f0df 100644
--- a/pkgs/development/interpreters/python/cpython/2.7/default.nix
+++ b/pkgs/development/interpreters/python/cpython/2.7/default.nix
@@ -199,11 +199,10 @@ let
     "--enable-shared"
   ] ++ [
     "--with-threads"
-    "--enable-unicode=ucs${toString ucsEncoding}"
-  ] ++ optionals (stdenv.hostPlatform.isCygwin || stdenv.hostPlatform.isAarch64) [
     "--with-system-ffi"
-  ] ++ optionals stdenv.hostPlatform.isCygwin [
     "--with-system-expat"
+    "--enable-unicode=ucs${toString ucsEncoding}"
+  ] ++ optionals stdenv.hostPlatform.isCygwin [
     "ac_cv_func_bind_textdomain_codeset=yes"
   ] ++ optionals stdenv.isDarwin [
     "--disable-toolbox-glue"
@@ -238,10 +237,7 @@ let
   strictDeps = true;
   buildInputs =
     optional (stdenv ? cc && stdenv.cc.libc != null) stdenv.cc.libc ++
-    [ bzip2 openssl zlib ]
-    ++ optional (stdenv.hostPlatform.isCygwin || stdenv.hostPlatform.isAarch64) libffi
-    ++ optional stdenv.hostPlatform.isCygwin expat
-    ++ [ db gdbm ncurses sqlite readline ]
+    [ bzip2 openssl zlib libffi expat db gdbm ncurses sqlite readline ]
     ++ optionals x11Support [ tcl tk libX11 ]
     ++ optional (stdenv.isDarwin && configd != null) configd;
   nativeBuildInputs =
diff --git a/pkgs/development/libraries/afflib/default.nix b/pkgs/development/libraries/afflib/default.nix
index cb0c8025ddfab..e82c3c8dfe77a 100644
--- a/pkgs/development/libraries/afflib/default.nix
+++ b/pkgs/development/libraries/afflib/default.nix
@@ -3,14 +3,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "3.7.19";
+  version = "3.7.20";
   pname = "afflib";
 
   src = fetchFromGitHub {
     owner = "sshock";
     repo = "AFFLIBv3";
     rev = "v${version}";
-    sha256 = "1qs843yi33yqbp0scqirn753lxzg762rz6xy2h3f8f77fijqj2qb";
+    sha256 = "sha256-xkqBfTftzn+rgeuoaKfHP7vQmy4VZuaCq8VFlfZTUE4=";
   };
 
   nativeBuildInputs = [ autoreconfHook ];
diff --git a/pkgs/development/libraries/cegui/default.nix b/pkgs/development/libraries/cegui/default.nix
index ba3366198c2c8..cb302f3381ca0 100644
--- a/pkgs/development/libraries/cegui/default.nix
+++ b/pkgs/development/libraries/cegui/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, cmake, ogre, freetype, boost, expat }:
+{ lib, stdenv, fetchurl, cmake, ogre, freetype, boost, expat, libiconv }:
 
 stdenv.mkDerivation rec {
   pname = "cegui";
@@ -10,12 +10,15 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ cmake ];
-  buildInputs = [ ogre freetype boost expat ];
+  buildInputs = [ ogre freetype boost expat ]
+    ++ lib.optionals stdenv.isDarwin [ libiconv ];
+
+  cmakeFlags = lib.optional (stdenv.isDarwin && stdenv.isAarch64) "-DCMAKE_OSX_ARCHITECTURES=arm64";
 
   meta = with lib; {
     homepage = "http://cegui.org.uk/";
     description = "C++ Library for creating GUIs";
     license = licenses.mit;
-    platforms = platforms.linux;
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/libraries/libbluray/default.nix b/pkgs/development/libraries/libbluray/default.nix
index f987e7c6497f5..bc10d06b846cc 100644
--- a/pkgs/development/libraries/libbluray/default.nix
+++ b/pkgs/development/libraries/libbluray/default.nix
@@ -11,27 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libbluray";
-  version = "1.3.2";
+  version = "1.3.4";
 
   src = fetchurl {
     url = "https://get.videolan.org/libbluray/${version}/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-RWgU258Hwe7N736ED8uyCXbvgU34dUKL+4Hs9FhR8XA=";
+    hash = "sha256-R4/9aKD13ejvbKmJt/A1taCiLFmRQuXNP/ewO76+Xys=";
   };
 
-  patches = [
-    ./BDJ-JARFILE-path.patch
-    (fetchpatch {
-      name = "Initial-support-for-Java-18.patch";
-      url = "https://code.videolan.org/videolan/libbluray/-/commit/3187c3080096e107f0a27eed1843232b58342577.patch";
-      hash = "sha256-2TSciAoPzELkgmFGB38h1RgynOCJueyCL8hIADxAPHo=";
-    })
-    (fetchpatch {
-      name = "bd-j-BDJSecurityManager-Change-setSecurityManager-de.patch";
-      url = "https://code.videolan.org/videolan/libbluray/-/commit/9a2d23d049760ef9cc9661ff90011a84d90368f1.patch";
-      hash = "sha256-xCc2h5ocXCqnpVMPQaybT2Ncs2YOzifQ0mlCCUhYlc8=";
-    })
-  ];
-
   nativeBuildInputs = [ pkg-config autoreconfHook ]
     ++ lib.optionals withJava [ ant ];
 
diff --git a/pkgs/development/libraries/libucontext/default.nix b/pkgs/development/libraries/libucontext/default.nix
new file mode 100644
index 0000000000000..1ce0e443b352a
--- /dev/null
+++ b/pkgs/development/libraries/libucontext/default.nix
@@ -0,0 +1,23 @@
+{ lib, stdenv, fetchFromGitHub }:
+
+stdenv.mkDerivation rec {
+  pname = "libucontext";
+  version = "1.2";
+
+  src = fetchFromGitHub {
+    owner = "kaniini";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-fk3ZKkp3dsyeF6SOWSccr5MkKEwS4AAuosD/h+6wjSw=";
+  };
+
+  makeFlags = [ "DESTDIR=$(out)" ];
+
+  meta = with lib; {
+    homepage = "https://github.com/kaniini/libucontext";
+    description = "ucontext implementation featuring glibc-compatible ABI";
+    license = licenses.isc;
+    platforms = platforms.linux;
+    maintainers = [ maintainers.yuka ];
+  };
+}
diff --git a/pkgs/development/libraries/mpdecimal/default.nix b/pkgs/development/libraries/mpdecimal/default.nix
new file mode 100644
index 0000000000000..5fa03b7083e2b
--- /dev/null
+++ b/pkgs/development/libraries/mpdecimal/default.nix
@@ -0,0 +1,47 @@
+{ lib, stdenv, fetchurl }:
+
+stdenv.mkDerivation rec {
+  pname = "mpdecimal";
+  version = "2.5.1";
+  outputs = [ "out" "doc" ];
+
+  src = fetchurl {
+    url = "https://www.bytereef.org/software/mpdecimal/releases/mpdecimal-${version}.tar.gz";
+    hash = "sha256-n5zUwEH5m1xJ/7e1nZ8S2VtoPYhYVgiqVqYwdmeysh8=";
+  };
+
+  configureFlags = [ "LD=${stdenv.cc.targetPrefix}cc" ];
+
+  meta = {
+    description = "Library for arbitrary precision decimal floating point arithmetic";
+
+    longDescription =  ''
+      libmpdec is a fast C/C++ library for correctly-rounded arbitrary
+      precision decimal floating point arithmetic.  It is a complete
+      implementation of Mike Cowlishaw/IBM's General Decimal Arithmetic
+      Specification. The full specification is available here:
+
+      http://speleotrove.com/decimal/
+
+      libmpdec will - with minor restrictions - also conform to the IEEE
+      754-2008 Standard for Floating-Point Arithmetic, provided that the
+      appropriate context parameters are set.
+
+      libmpdec++ is a complete implementation of the General Decimal Arithmetic
+      Specification.  libmpdec++ is mostly a header library around libmpdec's C
+      functions.
+    '';
+
+    homepage = "https://www.bytereef.org/mpdecimal/index.html";
+
+    downloadPage = "https://www.bytereef.org/mpdecimal/download.html";
+
+    changelog = "https://www.bytereef.org/mpdecimal/changelog.html";
+
+    license = lib.licenses.bsd2;
+
+    maintainers = with lib.maintainers; [ kaction ];
+
+    platforms = lib.platforms.unix;
+  };
+}
diff --git a/pkgs/development/libraries/ogre/1.10.x.nix b/pkgs/development/libraries/ogre/1.10.x.nix
index cd65630879ef9..73f15b744bf5c 100644
--- a/pkgs/development/libraries/ogre/1.10.x.nix
+++ b/pkgs/development/libraries/ogre/1.10.x.nix
@@ -1,50 +1,110 @@
-{ fetchurl, stdenv, lib
-, cmake, libGLU, libGL
-, freetype, freeimage, zziplib, xorgproto, libXrandr
-, libXaw, freeglut, libXt, libpng, boost, ois
-, libX11, libXmu, libSM, pkg-config
-, libXxf86vm, libICE
+{ lib
+, stdenv
+, fetchurl
+, fetchpatch
+, cmake
+, pkg-config
+, boost
+, freeimage
+, freetype
+, libpng
+, ois
+, zziplib
+, freeglut
+, libGL
+, libGLU
+, libICE
+, libSM
+, libX11
+, libXaw
+, libXmu
+, libXrandr
 , libXrender
-, withNvidiaCg ? false, nvidia_cg_toolkit
-, withSamples ? false }:
+, libXt
+, libXxf86vm
+, xorgproto
+, darwin
+, withNvidiaCg ? false
+, nvidia_cg_toolkit
+, withSamples ? false
+}:
 
+let
+  inherit (darwin.apple_sdk.frameworks) AGL Cocoa;
+in
 stdenv.mkDerivation rec {
   pname = "ogre";
   version = "1.10.11";
 
   src = fetchurl {
-     url = "https://bitbucket.org/sinbad/ogre/get/v${lib.replaceStrings ["."] ["-"] version}.tar.gz";
-     sha256 = "1zwvlx5dz9nwjazhnrhzb0w8ilpa84r0hrxrmmy69pgr1p1yif5a";
+    url = "https://bitbucket.org/sinbad/ogre/get/v${lib.replaceStrings ["."] ["-"] version}.tar.gz";
+    sha256 = "1zwvlx5dz9nwjazhnrhzb0w8ilpa84r0hrxrmmy69pgr1p1yif5a";
   };
 
-  # fix for ARM. sys/sysctl.h has moved in later glibcs, and
-  # https://github.com/OGRECave/ogre-next/issues/132 suggests it isn't
-  # needed anyway.
-  postPatch = ''
-    substituteInPlace OgreMain/src/OgrePlatformInformation.cpp \
-      --replace '#include <sys/sysctl.h>' ""
-  '';
+  patches = [
+    # aarch64-darwin support
+    (fetchpatch {
+      url = "https://github.com/OGRECave/ogre/commit/bd5fbe3482c56e58c6c3b3bf439b1eab8c1be258.patch";
+      includes = [ "OgreMain/include/OgrePlatform*.h" ];
+      sha256 = "sha256-ELeCklQkltz7DeDaGl78Jk1H3Wdfu8fMUiMZaJM4s/Y=";
+    })
+    (fetchpatch {
+      url = "https://github.com/OGRECave/ogre/commit/0873244cc06b613ca2afbcb5522fe9ef89f111c5.patch";
+      sha256 = "sha256-xGvlMB55B2rdthxNMIM5iFf9p/6zuE8bGL9P04qtweQ=";
+    })
+    # aarch64-linux support
+    (fetchpatch {
+      name = "fix-build-on-aarch64-linux.patch";
+      url = "https://github.com/OGRECave/ogre/commit/8ec086e9bc2e24fab373b514c572483b69071d69.patch";
+      sha256 = "sha256-22wlJPZ7lRIPAMqvpI/2YI0neQjGi1UXt8y5zNSpxCw=";
+    })
+  ];
 
-  cmakeFlags = [ "-DOGRE_BUILD_SAMPLES=${toString withSamples}" ]
-    ++ map (x: "-DOGRE_BUILD_PLUGIN_${x}=on")
-           ([ "BSP" "OCTREE" "PCZ" "PFX" ] ++ lib.optional withNvidiaCg "CG")
-    ++ map (x: "-DOGRE_BUILD_RENDERSYSTEM_${x}=on") [ "GL" ];
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
 
-  nativeBuildInputs = [ cmake pkg-config ];
-  buildInputs =
-   [ libGLU libGL
-     freetype freeimage zziplib xorgproto libXrandr
-     libXaw freeglut libXt libpng boost ois
-     libX11 libXmu libSM
-     libXxf86vm libICE
-     libXrender
-   ] ++ lib.optional withNvidiaCg nvidia_cg_toolkit;
+  buildInputs = [
+    boost
+    freeimage
+    freetype
+    libpng
+    ois
+    zziplib
+  ] ++ lib.optionals stdenv.isLinux [
+    freeglut
+    libGL
+    libGLU
+    libICE
+    libSM
+    libX11
+    libXaw
+    libXmu
+    libXrandr
+    libXrender
+    libXt
+    libXxf86vm
+    xorgproto
+  ] ++ lib.optionals stdenv.isDarwin [
+    AGL
+    Cocoa
+  ] ++ lib.optionals withNvidiaCg [
+    nvidia_cg_toolkit
+  ];
+
+  cmakeFlags = [
+    "-DOGRE_BUILD_COMPONENT_OVERLAY_IMGUI=FALSE"
+    "-DOGRE_BUILD_SAMPLES=${toString withSamples}"
+  ] ++ lib.optionals stdenv.isDarwin [
+    "-DOGRE_BUILD_LIBS_AS_FRAMEWORKS=FALSE"
+  ];
 
   meta = {
-    description = "A 3D engine";
+    description = "3D Object-Oriented Graphics Rendering Engine";
     homepage = "https://www.ogre3d.org/";
-    maintainers = [ lib.maintainers.raskin ];
-    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ raskin wegank ];
+    platforms = lib.platforms.unix;
     license = lib.licenses.mit;
   };
 }
diff --git a/pkgs/development/mobile/maestro/default.nix b/pkgs/development/mobile/maestro/default.nix
index 6228b4760b64b..cbcbb619585ef 100644
--- a/pkgs/development/mobile/maestro/default.nix
+++ b/pkgs/development/mobile/maestro/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "maestro";
-  version = "1.18.2";
+  version = "1.18.3";
 
   src = fetchurl {
     url = "https://github.com/mobile-dev-inc/maestro/releases/download/cli-${version}/maestro.zip";
-    sha256 = "02w544q5dwyayl3mcrp0q4b140bpmk0xpcjjqq0i0sbhffzw1jn8";
+    sha256 = "13kv6ydd2xka0lnnpcn5jv12pw9n6p7nljdlgkimwvsqsh1z5kfc";
   };
 
   dontUnpack = true;
@@ -28,6 +28,7 @@ stdenv.mkDerivation rec {
     homepage = "https://maestro.mobile.dev/";
     license = licenses.asl20;
     platforms = lib.platforms.all;
+    changelog = "https://github.com/mobile-dev-inc/maestro/blob/main/CHANGELOG.md";
     maintainers = with maintainers; [ SubhrajyotiSen ];
   };
 }
diff --git a/pkgs/development/ocaml-modules/fileutils/default.nix b/pkgs/development/ocaml-modules/fileutils/default.nix
index 819298ac8cf18..0431c733cb909 100644
--- a/pkgs/development/ocaml-modules/fileutils/default.nix
+++ b/pkgs/development/ocaml-modules/fileutils/default.nix
@@ -1,25 +1,25 @@
-{ lib, fetchurl, buildDunePackage, stdlib-shims, ounit }:
+{ lib, fetchurl, ocaml, buildDunePackage, seq, stdlib-shims, ounit2 }:
 
 buildDunePackage rec {
   pname = "fileutils";
-  version = "0.6.3";
+  version = "0.6.4";
 
   src = fetchurl {
-    url = "https://github.com/gildor478/ocaml-fileutils/releases/download/v${version}/fileutils-v${version}.tbz";
-    sha256 = "0qhlhc7fzcq0yfg1wyszsi0gyc4w9hyzmfv84aq9wc79i3283xgg";
+    url = "https://github.com/gildor478/ocaml-fileutils/releases/download/v${version}/fileutils-${version}.tbz";
+    hash = "sha256-enu2vGo2tuvawrTkap6bENNmxaLUQXpfHWih+7oKRF8=";
   };
 
-  minimumOCamlVersion = "4.03";
-  useDune2 = true;
+  minimalOCamlVersion = "4.03";
 
   propagatedBuildInputs = [
+    seq
     stdlib-shims
   ];
 
   checkInputs = [
-    ounit
+    ounit2
   ];
-  doCheck = true;
+  doCheck = lib.versionAtLeast ocaml.version "4.04";
 
   meta = with lib; {
     description = "OCaml API to manipulate real files (POSIX like) and filenames";
diff --git a/pkgs/development/python-modules/ailment/default.nix b/pkgs/development/python-modules/ailment/default.nix
index 13be1fcc1a67a..00b2df6256371 100644
--- a/pkgs/development/python-modules/ailment/default.nix
+++ b/pkgs/development/python-modules/ailment/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "ailment";
-  version = "9.2.31";
+  version = "9.2.32";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-jG7lZet15mp1ltbdcv1ZMHHa+ydFXQiNS+dl70tmluE=";
+    hash = "sha256-JHKF1uTzAzYrVx1iOtOjJYFbnvFeTzUjTmm24leHIMs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/angr/default.nix b/pkgs/development/python-modules/angr/default.nix
index 82355e75be927..0646d10a13732 100644
--- a/pkgs/development/python-modules/angr/default.nix
+++ b/pkgs/development/python-modules/angr/default.nix
@@ -31,7 +31,7 @@
 
 buildPythonPackage rec {
   pname = "angr";
-  version = "9.2.31";
+  version = "9.2.32";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -40,7 +40,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-i7kIHDg1iCtEeigS2+4MTS2fmUYYEbruL7q0s1skR9k=";
+    hash = "sha256-nyFEyOo4qtkyjAmkOV0JEOKAKWJKwjRrywKqP2yoJ54=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/ansible-lint/default.nix b/pkgs/development/python-modules/ansible-lint/default.nix
index 691a4f1146cff..b567c10e8d926 100644
--- a/pkgs/development/python-modules/ansible-lint/default.nix
+++ b/pkgs/development/python-modules/ansible-lint/default.nix
@@ -22,13 +22,14 @@
 
 buildPythonPackage rec {
   pname = "ansible-lint";
-  version = "6.10.0";
+  version = "6.10.1";
   format = "pyproject";
+
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-9ezsWOvntr/El2vn1uQAQRqK8FsOGhnxXyX1nzQBNIw=";
+    hash = "sha256-JPFbYa9SvCKwXQCPnrdmLxz0KrdACNqfia9x/FQMz6Q=";
   };
 
   postPatch = ''
@@ -91,15 +92,15 @@ buildPythonPackage rec {
     "test_run_inside_role_dir"
     "test_run_multiple_role_path_no_trailing_slash"
     "test_runner_exclude_globs"
-
     "test_discover_lintables_umlaut"
   ];
 
   makeWrapperArgs = [ "--prefix PATH : ${lib.makeBinPath [ ansible-core ]}" ];
 
   meta = with lib; {
-    homepage = "https://github.com/ansible/ansible-lint";
     description = "Best practices checker for Ansible";
+    homepage = "https://github.com/ansible/ansible-lint";
+    changelog = "https://github.com/ansible/ansible-lint/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ sengaya ];
   };
diff --git a/pkgs/development/python-modules/archinfo/default.nix b/pkgs/development/python-modules/archinfo/default.nix
index 4bdc1c5585c9d..bc1b290a1f26d 100644
--- a/pkgs/development/python-modules/archinfo/default.nix
+++ b/pkgs/development/python-modules/archinfo/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "archinfo";
-  version = "9.2.31";
+  version = "9.2.32";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-mrsEdVUp13XqVwrbLYbR8vAsu5wPHQcIOBBSmSPJQYY=";
+    hash = "sha256-LChk65iM238jB1jwgEis5Wfz8YGmb9UCOdmQcU+3bFA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/cachecontrol/default.nix b/pkgs/development/python-modules/cachecontrol/default.nix
index 529975f1080bf..c5c7128f72236 100644
--- a/pkgs/development/python-modules/cachecontrol/default.nix
+++ b/pkgs/development/python-modules/cachecontrol/default.nix
@@ -18,6 +18,8 @@ buildPythonPackage rec {
 
   disabled = pythonOlder "3.6";
 
+  __darwinAllowLocalNetworking = true;
+
   src = fetchFromGitHub {
     owner = "ionrock";
     repo = pname;
diff --git a/pkgs/development/python-modules/claripy/default.nix b/pkgs/development/python-modules/claripy/default.nix
index 3190cb6f7190d..9c7bb0898d863 100644
--- a/pkgs/development/python-modules/claripy/default.nix
+++ b/pkgs/development/python-modules/claripy/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "claripy";
-  version = "9.2.31";
+  version = "9.2.32";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-hIzB6E1z3ufbHFoe2IfBTuF4uuJibaFTqDjTf5ubHDU=";
+    hash = "sha256-Cf56Q2ZqBq3uoCGqG5pYxA6ANP8VLC6pAMZIL5ubq30=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/cle/default.nix b/pkgs/development/python-modules/cle/default.nix
index 02d7d9e5390b8..3e876db6d66a6 100644
--- a/pkgs/development/python-modules/cle/default.nix
+++ b/pkgs/development/python-modules/cle/default.nix
@@ -16,7 +16,7 @@
 
 let
   # The binaries are following the argr projects release cycle
-  version = "9.2.31";
+  version = "9.2.32";
 
   # Binary files from https://github.com/angr/binaries (only used for testing and only here)
   binaries = fetchFromGitHub {
@@ -38,7 +38,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-ZgM1GEsmp6LOoFf33l6cZY6cyCoitPDEpFbAVuAd0p8=";
+    hash = "sha256-KYWhwL3DAa/2Hb4I1NfYWA5gXrwEeMpDpAWCWGLqFeE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/geniushub-client/default.nix b/pkgs/development/python-modules/geniushub-client/default.nix
index 019c1e1a21bce..da0e7e2c33588 100644
--- a/pkgs/development/python-modules/geniushub-client/default.nix
+++ b/pkgs/development/python-modules/geniushub-client/default.nix
@@ -1,30 +1,47 @@
 { lib
-, buildPythonPackage
-, fetchPypi
 , aiohttp
+, buildPythonPackage
+, fetchFromGitHub
+, pytestCheckHook
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "geniushub-client";
-  version = "0.6.30";
+  version = "0.7.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.9";
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "390932b6e5051e221d104b2683d9deb6e352172c4ec4eeede0954bf2f9680211";
+  src = fetchFromGitHub {
+    owner = "manzanotti";
+    repo = pname;
+    rev = "refs/tags/v${version}";
+    hash = "sha256-amsMZjCsPI8CUfSct4uumn8nVZDESlQFh19LXu3yb7o=";
   };
 
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace 'VERSION = os.environ["GITHUB_REF_NAME"]' "" \
+      --replace "version=VERSION," 'version="${version}",'
+  '';
+
   propagatedBuildInputs = [
     aiohttp
   ];
 
-  # tests only implemented after 0.6.30
-  doCheck = false;
+  checkInputs = [
+    pytestCheckHook
+  ];
 
-  pythonImportsCheck = [ "geniushubclient" ];
+  pythonImportsCheck = [
+    "geniushubclient"
+  ];
 
   meta = with lib; {
-    description = "Aiohttp-based client for Genius Hub systems";
-    homepage = "https://github.com/zxdavb/geniushub-client";
+    description = "Module to interact with Genius Hub systems";
+    homepage = "https://github.com/manzanotti/geniushub-client";
+    changelog = "https://github.com/manzanotti/geniushub-client/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ dotlambda ];
   };
diff --git a/pkgs/development/python-modules/ghrepo-stats/default.nix b/pkgs/development/python-modules/ghrepo-stats/default.nix
index 154700e89af24..71e640cce795e 100644
--- a/pkgs/development/python-modules/ghrepo-stats/default.nix
+++ b/pkgs/development/python-modules/ghrepo-stats/default.nix
@@ -1,4 +1,5 @@
 { lib
+, beautifulsoup4
 , buildPythonPackage
 , fetchFromGitHub
 , matplotlib
@@ -8,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "ghrepo-stats";
-  version = "0.4.0";
+  version = "0.5.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -17,10 +18,17 @@ buildPythonPackage rec {
     owner = "mrbean-bremen";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-KFjqHrN0prcqu3wEPZpa7rLfuD0X/DN7BMo4zcHNmYo=";
+    hash = "sha256-rTW6wADpkP9GglNmQNVecHfA2yJZuzYhJfsLfucbcgY=";
   };
 
+  postPatch = ''
+    # https://github.com/mrbean-bremen/ghrepo-stats/pull/1
+    substituteInPlace setup.py \
+      --replace "bs4" "beautifulsoup4"
+  '';
+
   propagatedBuildInputs = [
+    beautifulsoup4
     matplotlib
     PyGithub
   ];
diff --git a/pkgs/development/python-modules/meross-iot/default.nix b/pkgs/development/python-modules/meross-iot/default.nix
index 7b707e25afdf8..e7507bcee171e 100644
--- a/pkgs/development/python-modules/meross-iot/default.nix
+++ b/pkgs/development/python-modules/meross-iot/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "meross-iot";
-  version = "0.4.5.2";
+  version = "0.4.5.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "albertogeniola";
     repo = "MerossIot";
     rev = "refs/tags/${version}";
-    hash = "sha256-gT4HxdmyX7oOQFBo1frkmmoXrNfGOcqL0hPZ40kRZeo=";
+    hash = "sha256-HPA3oeanFHx+g0nt/nsTzG3RTCdsjNSvDCXILR271P4=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/mitmproxy/default.nix b/pkgs/development/python-modules/mitmproxy/default.nix
index b85000fe05c50..688065712c81a 100644
--- a/pkgs/development/python-modules/mitmproxy/default.nix
+++ b/pkgs/development/python-modules/mitmproxy/default.nix
@@ -47,8 +47,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "mitmproxy";
     repo = "mitmproxy";
-    rev = "refs/tags/v${version}";
-    sha256 = "sha256-nW/WfiY6uF67qNa95tvNvSv/alP2WmzTk34LEBma/04=";
+    rev = "refs/tags/${version}";
+    sha256 = "sha256-CINKvRnBspciS+wefJB8gzBE13L8CjbYCkmLmTTeYlA=";
   };
 
   propagatedBuildInputs = [
@@ -110,6 +110,10 @@ buildPythonPackage rec {
     "test_flowview"
     # ValueError: Exceeds the limit (4300) for integer string conversion
     "test_roundtrip_big_integer"
+
+    "test_wireguard"
+    "test_commands_exist"
+    "test_statusbar"
   ];
 
   disabledTestPaths = [
diff --git a/pkgs/development/python-modules/pyatmo/default.nix b/pkgs/development/python-modules/pyatmo/default.nix
index f448942ae01d7..0abcd60dcb843 100644
--- a/pkgs/development/python-modules/pyatmo/default.nix
+++ b/pkgs/development/python-modules/pyatmo/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "pyatmo";
-  version = "7.4.0";
+  version = "7.5.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "jabesq";
     repo = "pyatmo";
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-0AgmH0cxXPUBzC30HyX68WsSyYsDcPaVQHLOIsZbHzI=";
+    hash = "sha256-GucatimZTg0Fggrz4bG1x6YSa3wE/uLGB4ufil/km3w=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
@@ -62,6 +62,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Simple API to access Netatmo weather station data";
     homepage = "https://github.com/jabesq/pyatmo";
+    changelog = "https://github.com/jabesq/pyatmo/blob/v${version}/CHANGELOG.md";
     license = licenses.mit;
     maintainers = with maintainers; [ delroth ];
   };
diff --git a/pkgs/development/python-modules/pypck/default.nix b/pkgs/development/python-modules/pypck/default.nix
index 13519664b52bc..26292d3a8312d 100644
--- a/pkgs/development/python-modules/pypck/default.nix
+++ b/pkgs/development/python-modules/pypck/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "pypck";
-  version = "0.7.15";
+  version = "0.7.16";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -18,8 +18,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "alengwenus";
     repo = pname;
-    rev = version;
-    hash = "sha256-OuM/r9rxIl4niY87cEcbZ73x2ZIQbaPZqbMrQ7hZE/g=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-OcXMVgG62JUH28BGvfO/rpnC++/klhBLJ2HafDu9R40=";
   };
 
   checkInputs = [
@@ -45,6 +45,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "LCN-PCK library written in Python";
     homepage = "https://github.com/alengwenus/pypck";
+    changelog = "https://github.com/alengwenus/pypck/releases/tag/${version}";
     license = with licenses; [ epl20 ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/python-fsutil/default.nix b/pkgs/development/python-modules/python-fsutil/default.nix
index 1f04a3a14b2d9..6ebb1485d2038 100644
--- a/pkgs/development/python-modules/python-fsutil/default.nix
+++ b/pkgs/development/python-modules/python-fsutil/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "python-fsutil";
-  version = "0.8.0";
+  version = "0.9.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "fabiocaccamo";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-J5B5THfB/yPG1JSCpO2HTHTH0jn0nbKFzXpZMGJ/dKA=";
+    hash = "sha256-rMQjsGqdiXe8zS18hZQAro3UWyHPjNJYyQ/NAoxbE7k=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/python-ipmi/default.nix b/pkgs/development/python-modules/python-ipmi/default.nix
index cbd68f387656d..08c23dfb5d3a5 100644
--- a/pkgs/development/python-modules/python-ipmi/default.nix
+++ b/pkgs/development/python-modules/python-ipmi/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "python-ipmi";
-  version = "0.5.2";
+  version = "0.5.3";
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "kontron";
     repo = pname;
     rev = version;
-    sha256 = "sha256-VXWSoVRfgJWf9rOT4SE1mTJdeNmzR3TRc2pc6Pp1M5U=";
+    sha256 = "sha256-Y8HJ7MXYHJRUWPTcw8p+GGSFswuRI7u+/bIaJpKy7lY=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pyvex/default.nix b/pkgs/development/python-modules/pyvex/default.nix
index 2f82837c5cf4d..12cfd4e71779a 100644
--- a/pkgs/development/python-modules/pyvex/default.nix
+++ b/pkgs/development/python-modules/pyvex/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "pyvex";
-  version = "9.2.31";
+  version = "9.2.32";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Te0wFz+3/HVKlMXW5WJ6mRGh8wWiMXR6Ypi/4hvnz/8=";
+    hash = "sha256-5ZCFAEHcM+3yH9pFyrduG8Uo1Ofr4JkvcXjJEi5KRMc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/qtawesome/default.nix b/pkgs/development/python-modules/qtawesome/default.nix
index b4e02e77b2290..00873503e0f7c 100644
--- a/pkgs/development/python-modules/qtawesome/default.nix
+++ b/pkgs/development/python-modules/qtawesome/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "qtawesome";
-  version = "1.2.1";
+  version = "1.2.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "spyder-ide";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-KcYCXrTP8ED5j/VTLTw7a8zotDSqIu9ultmwp8Ip5nM=";
+    hash = "sha256-zXwIwYG76aCKPTE8mGiAOK8kQUCzJbqnjJszmIqByaA=";
   };
 
   propagatedBuildInputs = [
@@ -40,6 +40,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Iconic fonts in PyQt and PySide applications";
     homepage = "https://github.com/spyder-ide/qtawesome";
+    changelog = "https://github.com/spyder-ide/qtawesome/blob/v${version}/CHANGELOG.md";
     license = licenses.mit;
     maintainers = with maintainers; [ ];
     platforms = platforms.linux; # fails on Darwin
diff --git a/pkgs/development/python-modules/roonapi/default.nix b/pkgs/development/python-modules/roonapi/default.nix
index 282e5b684f65f..ae3116de9ae53 100644
--- a/pkgs/development/python-modules/roonapi/default.nix
+++ b/pkgs/development/python-modules/roonapi/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "roonapi";
-  version = "0.1.2";
+  version = "0.1.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "pavoni";
     repo = "pyroon";
     rev = version;
-    hash = "sha256-HcHs9UhRbSKTxW5qEvmMrQ+kWIBAqVpyldapx635uNM=";
+    hash = "sha256-QOFBNTz8g3f6C8Vjkblrd3QFCRrA1WqOCv6xS4GbFC4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/skodaconnect/default.nix b/pkgs/development/python-modules/skodaconnect/default.nix
index a3354718c3aa4..6ea921c9f58af 100644
--- a/pkgs/development/python-modules/skodaconnect/default.nix
+++ b/pkgs/development/python-modules/skodaconnect/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "skodaconnect";
-  version = "1.2.5";
+  version = "1.3.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "lendy007";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-Re6ECMaDmg007XHw9Kpa46+oEs+01CzOZzszKzKS4WA=";
+    hash = "sha256-1x1TQNhKL3RgoeYSB8l607mHt0VrHwOU1CFemoaTCt8=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
diff --git a/pkgs/development/python-modules/socialscan/default.nix b/pkgs/development/python-modules/socialscan/default.nix
index 9e51ccd81d37e..5e25e3c16bec2 100644
--- a/pkgs/development/python-modules/socialscan/default.nix
+++ b/pkgs/development/python-modules/socialscan/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "socialscan";
-  version = "1.4.2";
+  version = "2.0.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -17,8 +17,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "iojw";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "rT+/j6UqDOzuNBdN3I74YIxS6qkhd7BjHCGX+gGjprc=";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-jiyTcpJ00DvfweChawj1ugdCVHHAdwDbHEp9jivH7gs=";
   };
 
   propagatedBuildInputs = [
@@ -37,6 +37,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python library and CLI for accurately querying username and email usage on online platforms";
     homepage = "https://github.com/iojw/socialscan";
+    changelog = "https://github.com/iojw/socialscan/releases/tag/v${version}";
     license = with licenses; [ mpl20 ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/tubeup/default.nix b/pkgs/development/python-modules/tubeup/default.nix
index 045780219d427..abb5e6c1fc0fd 100644
--- a/pkgs/development/python-modules/tubeup/default.nix
+++ b/pkgs/development/python-modules/tubeup/default.nix
@@ -4,29 +4,39 @@
 , fetchPypi
 , yt-dlp
 , docopt
-, isPy27
+, pythonOlder
+, urllib3
 }:
 
 buildPythonPackage rec {
   pname = "tubeup";
-  version = "0.0.34";
+  version = "0.0.35";
   format = "setuptools";
 
-  disabled = isPy27;
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "ae1e606b243fd70742f8b5871c497628d258ee9f416caa46544aca9a5fbfbca0";
+    sha256 = "006aea68bb8d967a7427c58ee7862e3f2481dae667c2bbcfb1a1f2fd80e665d1";
   };
 
   postPatch = ''
     substituteInPlace setup.py \
+      --replace "internetarchive==3.0.2" "internetarchive" \
+      --replace "urllib3==1.26.13" "urllib3" \
       --replace "docopt==0.6.2" "docopt"
   '';
 
-  propagatedBuildInputs = [ internetarchive docopt yt-dlp ];
+  propagatedBuildInputs = [
+    internetarchive
+    docopt
+    urllib3
+    yt-dlp
+  ];
 
-  pythonImportsCheck = [ "tubeup" ];
+  pythonImportsCheck = [
+    "tubeup"
+  ];
 
   # Tests failing upstream
   doCheck = false;
@@ -34,7 +44,8 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Youtube (and other video site) to Internet Archive Uploader";
     homepage = "https://github.com/bibanon/tubeup";
+    changelog = "https://github.com/bibanon/tubeup/releases/tag/${version}";
     license = licenses.gpl3Only;
-    maintainers = [ maintainers.marsam ];
+    maintainers = with maintainers; [ marsam ];
   };
 }
diff --git a/pkgs/development/python-modules/zha-quirks/default.nix b/pkgs/development/python-modules/zha-quirks/default.nix
index c4cc67e24c0b1..c0e0edb124c7f 100644
--- a/pkgs/development/python-modules/zha-quirks/default.nix
+++ b/pkgs/development/python-modules/zha-quirks/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "zha-quirks";
-  version = "0.0.89";
+  version = "0.0.90";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "zigpy";
     repo = "zha-device-handlers";
     rev = "refs/tags/${version}";
-    hash = "sha256-5qSznGO3Cke+lGPLHjzh/db5O0/Ypmd6D5MTHuiox6Q=";
+    hash = "sha256-SfzwS7M821uGfbOLR37iiw+gEebKDgu1H7f0fs3J9kw=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/tools/build-managers/tup/default.nix b/pkgs/development/tools/build-managers/tup/default.nix
index 0763f2e9359c9..e53acd4e9e606 100644
--- a/pkgs/development/tools/build-managers/tup/default.nix
+++ b/pkgs/development/tools/build-managers/tup/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, fuse3, macfuse-stubs, pkg-config, pcre }:
+{ lib, stdenv, fetchFromGitHub, fuse3, macfuse-stubs, pkg-config, sqlite, pcre }:
 
 let
   fuse = if stdenv.isDarwin then macfuse-stubs else fuse3;
@@ -15,13 +15,24 @@ in stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ fuse pcre ];
+  buildInputs = [ fuse pcre sqlite ];
 
   patches = [ ./fusermount-setuid.patch ];
 
   configurePhase = ''
     substituteInPlace  src/tup/link.sh --replace '`git describe' '`echo ${version}'
-    substituteInPlace Tuprules.tup --replace 'pcre-config' 'pkg-config libpcre'
+
+    for f in Tupfile Tuprules.tup src/tup/server/Tupfile build.sh; do
+      substituteInPlace "$f" \
+        --replace "pkg-config"  "${stdenv.cc.targetPrefix}pkg-config" \
+        --replace "pcre-config" "${stdenv.cc.targetPrefix}pkg-config libpcre"
+    done
+
+    cat << EOF > tup.config
+    CONFIG_CC=${stdenv.cc.targetPrefix}cc
+    CONFIG_AR=${stdenv.cc.targetPrefix}ar
+    CONFIG_TUP_USE_SYSTEM_SQLITE=y
+    EOF
   '';
 
   # Regular tup builds require fusermount to have suid, which nix cannot
diff --git a/pkgs/development/tools/database/apgdiff/default.nix b/pkgs/development/tools/database/apgdiff/default.nix
index 016259f0bbb4c..d96e3dbd99d04 100644
--- a/pkgs/development/tools/database/apgdiff/default.nix
+++ b/pkgs/development/tools/database/apgdiff/default.nix
@@ -29,7 +29,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     homepage = "https://apgdiff.com";
     license = licenses.mit;
     inherit (jre.meta) platforms;
-    sourceProvenance = sourceTypes.binaryBytecode;
+    sourceProvenance = [ sourceTypes.binaryBytecode ];
     maintainers = [ maintainers.misterio77 ];
   };
 })
diff --git a/pkgs/development/tools/language-servers/millet/default.nix b/pkgs/development/tools/language-servers/millet/default.nix
index ccc895b895694..1c87084f7d868 100644
--- a/pkgs/development/tools/language-servers/millet/default.nix
+++ b/pkgs/development/tools/language-servers/millet/default.nix
@@ -2,24 +2,24 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "millet";
-  version = "0.6.0";
+  version = "0.6.7";
 
   src = fetchFromGitHub {
     owner = "azdavis";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-tP1ccUtHfj+JPUYGo+QFYjbz56uNl3p53QNeE/xaCt4=";
+    hash = "sha256-sZy5SQ3Gd6bZcEx/30XJXoUI2/HRGTUn8ZZHtti5Cos=";
   };
 
-  cargoHash = "sha256-umOlvHDA8AtoAeB1i8nNgbjvzTmzwZfdjF+TCTKzqAU=";
+  cargoHash = "sha256-74bGGZakz3yAaamqt3UU4r0QGbUcN6vIXebsgTj6cBM=";
 
   postPatch = ''
     rm .cargo/config.toml
   '';
 
-  cargoBuildFlags = [ "--package" "lang-srv" ];
+  cargoBuildFlags = [ "--package" "millet-ls" ];
 
-  cargoTestFlags = [ "--package" "lang-srv" ];
+  cargoTestFlags = [ "--package" "millet-ls" ];
 
   meta = with lib; {
     description = "A language server for Standard ML";
@@ -27,6 +27,6 @@ rustPlatform.buildRustPackage rec {
     changelog = "https://github.com/azdavis/millet/raw/v${version}/docs/changelog.md";
     license = [ licenses.mit /* or */ licenses.asl20 ];
     maintainers = with maintainers; [ marsam ];
-    mainProgram = "lang-srv";
+    mainProgram = "millet-ls";
   };
 }
diff --git a/pkgs/development/tools/misc/universal-ctags/default.nix b/pkgs/development/tools/misc/universal-ctags/default.nix
index 02d5a4e549da2..30c0800f2c5f4 100644
--- a/pkgs/development/tools/misc/universal-ctags/default.nix
+++ b/pkgs/development/tools/misc/universal-ctags/default.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "universal-ctags";
-  version = "5.9.20221106.0";
+  version = "6.0.0";
 
   src = fetchFromGitHub {
     owner = "universal-ctags";
     repo = "ctags";
-    rev = "p${finalAttrs.version}";
-    hash = "sha256-6piWdofvlX+ysXmRPnQc7PlZuHSyVqdVxOztY2+Pcss=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-XlqBndo8g011SDGp3zM7S+AQ0aCp6rpQlqJF6e5Dd6w=";
   };
 
   depsBuildBuild = [
@@ -76,7 +76,7 @@ stdenv.mkDerivation (finalAttrs: {
     '';
     license = licenses.gpl2Plus;
     maintainers = [ maintainers.AndersonTorres ];
-    platforms = platforms.unix;
+    platforms = platforms.all;
     mainProgram = "ctags";
     priority = 1; # over the emacs implementation
   };
diff --git a/pkgs/development/tools/ruff/default.nix b/pkgs/development/tools/ruff/default.nix
index ef5a143f94c65..8c38ec2833ca2 100644
--- a/pkgs/development/tools/ruff/default.nix
+++ b/pkgs/development/tools/ruff/default.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "ruff";
-  version = "0.0.207";
+  version = "0.0.209";
 
   src = fetchFromGitHub {
     owner = "charliermarsh";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-DAjBie0wiweT/FE4kHLrYoymy+NJvaXkYSky1iJwwv4=";
+    sha256 = "sha256-DYMGGA/GGE4Vue8G61gmDFspODVI81vTK9iOuIB8dDA=";
   };
 
-  cargoSha256 = "sha256-px6T0DsQPWD6qWZpvEoEUwAiFPxVaBmevGguYpPTQoo=";
+  cargoSha256 = "sha256-Uvl/3VutaquorMMd8KQlqBc5DOdh23oLZSjGExTqUWE=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
     darwin.apple_sdk.frameworks.CoreServices
diff --git a/pkgs/development/tools/rust/cargo-nextest/default.nix b/pkgs/development/tools/rust/cargo-nextest/default.nix
index 13bfdccac61f4..676a09bae86c5 100644
--- a/pkgs/development/tools/rust/cargo-nextest/default.nix
+++ b/pkgs/development/tools/rust/cargo-nextest/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-nextest";
-  version = "0.9.47";
+  version = "0.9.48";
 
   src = fetchFromGitHub {
     owner = "nextest-rs";
     repo = "nextest";
     rev = "cargo-nextest-${version}";
-    sha256 = "sha256-G7Y2x9aRcQB28uR2TlyG8JW9kYSD9iMPASd0VFXOxcE=";
+    sha256 = "sha256-y1Ka9XEXuwavAI23C4UmjTHraHHnbsA3QzDIkkSqfoU=";
   };
 
-  cargoSha256 = "sha256-7fesLvkHPpPS4xKn3r6hLjQzP0udm92BsVPhdckTk7c=";
+  cargoSha256 = "sha256-1LsAbBdRz5Xf+LF/eOc34d+SQ0Ein8JW5/4v7ZZEFqA=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ Security ];
 
diff --git a/pkgs/development/tools/rust/cargo-tauri/default.nix b/pkgs/development/tools/rust/cargo-tauri/default.nix
index 9c863e09efdd9..3f9549401441c 100644
--- a/pkgs/development/tools/rust/cargo-tauri/default.nix
+++ b/pkgs/development/tools/rust/cargo-tauri/default.nix
@@ -1,4 +1,5 @@
 { lib
+, stdenv
 , rustPlatform
 , fetchFromGitHub
 , pkg-config
@@ -7,8 +8,12 @@
 , cairo
 , gtk3
 , webkitgtk
+, darwin
 }:
 
+let
+  inherit (darwin.apple_sdk.frameworks) CoreServices Security;
+in
 rustPlatform.buildRustPackage rec {
   pname = "tauri";
   version = "1.2.3";
@@ -26,7 +31,8 @@ rustPlatform.buildRustPackage rec {
 
   cargoSha256 = "sha256-Hp6+T2CN0CsXaGnCVqAYaOjZNDkmI+MXDfHIgbU1S0g=";
 
-  buildInputs = [ glibc libsoup cairo gtk3 webkitgtk ];
+  buildInputs = lib.optionals stdenv.isLinux [ glibc libsoup cairo gtk3 webkitgtk ]
+    ++ lib.optionals stdenv.isDarwin [ CoreServices Security ];
   nativeBuildInputs = [ pkg-config ];
 
   meta = with lib; {
diff --git a/pkgs/development/tools/sq/default.nix b/pkgs/development/tools/sq/default.nix
index d150332ae63e1..e13549009792d 100644
--- a/pkgs/development/tools/sq/default.nix
+++ b/pkgs/development/tools/sq/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "sq";
-  version = "0.18.2";
+  version = "0.20.0";
 
   src = fetchFromGitHub {
     owner = "neilotoole";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-x5NHMTyOZSGOnAUCRu1qZggU5m832TFrBTSNJU6DUKo=";
+    sha256 = "sha256-mJp4lb4pzjdjodHk2zLAEePn+oIPI/vTtU0YOIbmWDY=";
   };
 
-  vendorSha256 = "sha256-IRuwX+VF0ltASTt/QKlZ3A00tgDhc9qpBfzhINp3HgQ=";
+  vendorSha256 = "sha256-8kk+KCanbnsizGRjF3qcxCBxC7Sx0zfptQFTETZp89E=";
 
   proxyVendor = true;
 
diff --git a/pkgs/development/tools/zsv/default.nix b/pkgs/development/tools/zsv/default.nix
index a4aabab9d93f0..d5f188f80b684 100644
--- a/pkgs/development/tools/zsv/default.nix
+++ b/pkgs/development/tools/zsv/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "zsv";
-  version = "0.3.3-alpha";
+  version = "0.3.4-alpha";
 
   src = fetchFromGitHub {
     owner = "liquidaty";
     repo = "zsv";
     rev = "v${version}";
-    sha256 = "sha256-gKtnyBCgiXNKiAjOYk2rxExfcNGHEAmjealcCTWRj+M=";
+    sha256 = "sha256-3drVqKRs5bjkvQiHyEANI5geeF5g7ba2+RxmAhxbu84=";
   };
 
   nativeBuildInputs = [ perl ];
diff --git a/pkgs/games/itch/default.nix b/pkgs/games/itch/default.nix
index 5776a1b43b2b0..ca0a04a8492d1 100644
--- a/pkgs/games/itch/default.nix
+++ b/pkgs/games/itch/default.nix
@@ -93,7 +93,7 @@ stdenvNoCC.mkDerivation rec {
     homepage = "https://github.com/itchio/itch";
     license = licenses.mit;
     platforms = platforms.linux;
-    sourceProvenance = lib.sourceTypes.binaryBytecode;
+    sourceProvenance = [ lib.sourceTypes.binaryBytecode ];
     maintainers = with maintainers; [ pasqui23 ];
   };
 }
diff --git a/pkgs/games/r2mod_cli/default.nix b/pkgs/games/r2mod_cli/default.nix
index eb1dd25811aaf..b34159c3cd602 100644
--- a/pkgs/games/r2mod_cli/default.nix
+++ b/pkgs/games/r2mod_cli/default.nix
@@ -8,20 +8,20 @@
 
 stdenv.mkDerivation rec {
   pname = "r2mod_cli";
-  version = "1.2.1";
+  version = "1.3.2";
 
   src = fetchFromGitHub {
     owner = "Foldex";
     repo = "r2mod_cli";
     rev = "v${version}";
-    sha256 = "sha256-FS9P/uTZU4d6zpM3TlEW6i6PLGHxqqO2fc8D7VsPCig=";
+    sha256 = "sha256-WL6zF6EdGjNyOm0j4zYZ1Oe7StEttKFNO28Ne/dA7CQ=";
   };
 
   buildInputs = [ bashInteractive ];
 
   nativeBuildInputs = [ makeWrapper ];
 
-  makeFlags = [ "PREFIX=$(out)" ];
+  makeFlags = [ "DESTDIR=" "PREFIX=$(out)" ];
 
   postInstall = ''
     wrapProgram $out/bin/r2mod --prefix PATH : "${lib.makeBinPath [ jq p7zip ]}";
diff --git a/pkgs/servers/apcupsd/default.nix b/pkgs/servers/apcupsd/default.nix
index 9e5e81457e905..aff8bba91a7f5 100644
--- a/pkgs/servers/apcupsd/default.nix
+++ b/pkgs/servers/apcupsd/default.nix
@@ -1,5 +1,6 @@
 { lib, stdenv, fetchurl, pkg-config, systemd, util-linux, coreutils, wall, hostname, man
 , enableCgiScripts ? true, gd
+, nixosTests
 }:
 
 assert enableCgiScripts -> gd != null;
@@ -52,6 +53,8 @@ stdenv.mkDerivation rec {
     done
   '';
 
+  passthru.tests.smoke = nixosTests.apcupsd;
+
   meta = with lib; {
     description = "Daemon for controlling APC UPSes";
     homepage = "http://www.apcupsd.com/";
diff --git a/pkgs/servers/clickhouse/default.nix b/pkgs/servers/clickhouse/default.nix
index b797951e41122..b3a1754dcab62 100644
--- a/pkgs/servers/clickhouse/default.nix
+++ b/pkgs/servers/clickhouse/default.nix
@@ -8,7 +8,7 @@
 
 stdenv.mkDerivation rec {
   pname = "clickhouse";
-  version = "22.8.5.29";
+  version = "22.8.11.15";
 
   broken = stdenv.buildPlatform.is32bit; # not supposed to work on 32-bit https://github.com/ClickHouse/ClickHouse/pull/23959#issuecomment-835343685
 
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
     repo   = "ClickHouse";
     rev    = "v${version}-lts";
     fetchSubmodules = true;
-    sha256 = "sha256-JRdZb5YgaumTnjJEYIXh9o3NSv67DAdl9gizVKvGTJI=";
+    sha256 = "sha256-ZFS7RgeTV/eMSiI0o9WO1fHjRkPDNZs0Gm3w+blGsz0=";
   };
 
   nativeBuildInputs = [ cmake libtool llvm-bintools ninja ];
diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index 3b561c1e31736..26f643fcaf30a 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -2,7 +2,7 @@
 # Do not edit!
 
 {
-  version = "2022.12.8";
+  version = "2022.12.9";
   components = {
     "3_day_blinds" = ps: with ps; [
     ];
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index 24d59402d2818..c09ecc6fb49d0 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -190,7 +190,7 @@ let
   extraPackagesFile = writeText "home-assistant-packages" (lib.concatMapStringsSep "\n" (pkg: pkg.pname) extraBuildInputs);
 
   # Don't forget to run parse-requirements.py after updating
-  hassVersion = "2022.12.8";
+  hassVersion = "2022.12.9";
 
 in python.pkgs.buildPythonApplication rec {
   pname = "homeassistant";
@@ -208,7 +208,7 @@ in python.pkgs.buildPythonApplication rec {
     owner = "home-assistant";
     repo = "core";
     rev = "refs/tags/${version}";
-    hash = "sha256-oJwA0YELlgMbnf1XiLDGlMLrvFaLP7WMv9/0KOI4XDI=";
+    hash = "sha256-tf2H4+79CGTmbKZtJpzYOzAgi90RpSy89hoDNS24m0Q=";
   };
 
   # leave this in, so users don't have to constantly update their downstream patch handling
diff --git a/pkgs/servers/mautrix-googlechat/default.nix b/pkgs/servers/mautrix-googlechat/default.nix
new file mode 100644
index 0000000000000..db1f7c6d1f254
--- /dev/null
+++ b/pkgs/servers/mautrix-googlechat/default.nix
@@ -0,0 +1,72 @@
+{ fetchFromGitHub, fetchpatch
+, lib
+, python3
+, protobuf3_20
+, enableE2be ? true, enableMetrics ? true, enableSqlite ? true
+}: python3.pkgs.buildPythonApplication rec {
+  pname = "mautrix-googlechat";
+  version = "0.4.0";
+
+  src = fetchFromGitHub {
+    owner = "mautrix";
+    repo = "googlechat";
+    rev = "v${version}";
+    sha256 = "sha256-UVWYT0HTOUEkBG0n6KNhCSSO/2PAF1rIvCaw478z+q0=";
+  };
+
+  patches = [
+    (fetchpatch {
+      # patch setup.py to generate $out/bin/mautrix-googlechat
+      # https://github.com/mautrix/googlechat/pull/81
+      name = "mautrix-googlechat-entry-point.patch";
+      url = "https://github.com/mautrix/googlechat/pull/81/commits/112fa3d27bc6f89a02321cb80d219de149e00df8.patch";
+      sha256 = "sha256-DsITDNLsIgBIqN6sD5JHaFW0LToxVUTzWc7mE2L09IQ=";
+    })
+  ];
+
+  doCheck = false;
+
+  postPatch = ''
+    sed -i requirements.txt \
+      -e 's/asyncpg>=.*/asyncpg/'
+  '';
+
+  baseConfigPath = "share/mautrix-googlechat/example-config.yaml";
+  postInstall = ''
+    rm $out/example-config.yaml
+    install -D mautrix_googlechat/example-config.yaml $out/$baseConfigPath
+  '';
+
+  passthru.optional-dependencies = with python3.pkgs; {
+    e2be = [
+      python-olm
+      pycryptodome
+      unpaddedbase64
+    ];
+    metrics = [ prometheus-client ];
+    sqlite = [ aiosqlite ];
+  };
+
+  propagatedBuildInputs = with python3.pkgs; [
+    aiohttp
+    yarl
+    asyncpg
+    ruamel-yaml
+    CommonMark
+    python-magic
+    (protobuf.override {
+      protobuf = protobuf3_20;
+    })
+    mautrix
+  ] ++ lib.optionals enableE2be passthru.optional-dependencies.e2be
+  ++ lib.optionals enableMetrics passthru.optional-dependencies.metrics
+  ++ lib.optionals enableSqlite passthru.optional-dependencies.sqlite;
+
+  meta = with lib; {
+    homepage = "https://github.com/mautrix/googlechat";
+    description = "A Matrix-Google Chat puppeting bridge";
+    license = licenses.agpl3Plus;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ arcnmx ];
+  };
+}
diff --git a/pkgs/servers/onlyoffice-documentserver/default.nix b/pkgs/servers/onlyoffice-documentserver/default.nix
index 179257f67e37b..51417fce2666e 100644
--- a/pkgs/servers/onlyoffice-documentserver/default.nix
+++ b/pkgs/servers/onlyoffice-documentserver/default.nix
@@ -144,7 +144,7 @@ let
       homepage = "ONLYOFFICE Document Server is an online office suite comprising viewers and editors";
       license = licenses.agpl3;
       platforms = [ "x86_64-linux" ];
-      sourceProvenance = sourceTypes.binaryNativeCode;
+      sourceProvenance = [ sourceTypes.binaryNativeCode ];
       maintainers = with maintainers; [ SuperSandro2000 ];
     };
   };
diff --git a/pkgs/servers/web-apps/wordpress/default.nix b/pkgs/servers/web-apps/wordpress/default.nix
index d14a1559e4681..8c8a65360c14c 100644
--- a/pkgs/servers/web-apps/wordpress/default.nix
+++ b/pkgs/servers/web-apps/wordpress/default.nix
@@ -1,36 +1,7 @@
-{ lib, stdenv, fetchurl, nixosTests, writeScript }:
-
-stdenv.mkDerivation rec {
-  pname = "wordpress";
-  version = "6.0.3";
-
-  src = fetchurl {
-    url = "https://wordpress.org/${pname}-${version}.tar.gz";
-    sha256 = "sha256-eSi0qwzXoJ1wYUzi34s7QbBbwRm2hfXoyGFivhPBq5o=";
-  };
-
-  installPhase = ''
-    mkdir -p $out/share/wordpress
-    cp -r . $out/share/wordpress
-  '';
-
-  passthru.tests = {
-    inherit (nixosTests) wordpress;
-  };
-
-  passthru.updateScript = writeScript "update.sh" ''
-    #!/usr/bin/env nix-shell
-    #!nix-shell -i bash -p common-updater-scripts jq
-    set -eu -o pipefail
-    version=$(curl --globoff "https://api.wordpress.org/core/version-check/1.7/" | jq -r '.offers[0].version')
-    update-source-version wordpress $version
-  '';
-
-  meta = with lib; {
-    homepage = "https://wordpress.org";
-    description = "WordPress is open source software you can use to create a beautiful website, blog, or app";
-    license = [ licenses.gpl2 ];
-    maintainers = [ maintainers.basvandijk ];
-    platforms = platforms.all;
+{ callPackage }: builtins.mapAttrs (_: callPackage ./generic.nix) rec {
+  wordpress = wordpress6_1;
+  wordpress6_1 = {
+    version = "6.1.1";
+    hash = "sha256-IR6FSmm3Pd8cCHNQTH1oIaLYsEP1obVjr0bDJkD7H60=";
   };
 }
diff --git a/pkgs/servers/web-apps/wordpress/generic.nix b/pkgs/servers/web-apps/wordpress/generic.nix
new file mode 100644
index 0000000000000..3c9aa377d7704
--- /dev/null
+++ b/pkgs/servers/web-apps/wordpress/generic.nix
@@ -0,0 +1,36 @@
+{ lib, version, hash, stdenv, fetchurl, nixosTests, writeScript }:
+
+stdenv.mkDerivation rec {
+  pname = "wordpress";
+  inherit version;
+
+  src = fetchurl {
+    url = "https://wordpress.org/${pname}-${version}.tar.gz";
+    inherit hash;
+  };
+
+  installPhase = ''
+    mkdir -p $out/share/wordpress
+    cp -r . $out/share/wordpress
+  '';
+
+  passthru.tests = {
+    inherit (nixosTests) wordpress;
+  };
+
+  passthru.updateScript = writeScript "update.sh" ''
+    #!/usr/bin/env nix-shell
+    #!nix-shell -i bash -p common-updater-scripts jq
+    set -eu -o pipefail
+    version=$(curl --globoff "https://api.wordpress.org/core/version-check/1.7/" | jq -r '.offers[0].version')
+    update-source-version wordpress $version
+  '';
+
+  meta = with lib; {
+    homepage = "https://wordpress.org";
+    description = "WordPress is open source software you can use to create a beautiful website, blog, or app";
+    license = [ licenses.gpl2 ];
+    maintainers = [ maintainers.basvandijk ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/servers/web-apps/wordpress/packages/default.nix b/pkgs/servers/web-apps/wordpress/packages/default.nix
index d8968de20c397..715e9556bc7fd 100644
--- a/pkgs/servers/web-apps/wordpress/packages/default.nix
+++ b/pkgs/servers/web-apps/wordpress/packages/default.nix
@@ -2,7 +2,7 @@
 # Licensed under: MIT
 # Slightly modified
 
-{ lib, newScope, plugins, themes, languages }:
+{ lib, newScope, plugins, themes, languages, callPackage }:
 
 let packages = self:
   let
@@ -82,4 +82,4 @@ let packages = self:
   } // lib.mapAttrs (type: pkgs: lib.makeExtensible (_: lib.mapAttrs (pname: data: self.mkOfficialWordpressDerivation { type = lib.removeSuffix "s" type; inherit pname data; }) pkgs)) generatedJson;
 
 # This creates an extensible scope.
-in (lib.makeExtensible (_: (lib.makeScope newScope packages))).extend (selfWP: superWP: {})
+in lib.recursiveUpdate ((lib.makeExtensible (_: (lib.makeScope newScope packages))).extend (selfWP: superWP: {})) (callPackage ./thirdparty.nix {})
diff --git a/pkgs/servers/web-apps/wordpress/packages/plugins.json b/pkgs/servers/web-apps/wordpress/packages/plugins.json
index 6746d21c6ee8e..0e844758b20d0 100644
--- a/pkgs/servers/web-apps/wordpress/packages/plugins.json
+++ b/pkgs/servers/web-apps/wordpress/packages/plugins.json
@@ -72,10 +72,10 @@
     "version": "5.0.18"
   },
   "mailpoet": {
-    "path": "mailpoet/tags/4.3.0",
-    "rev": "2836720",
-    "sha256": "0igaq34gq5ysk5ai39b641kx7rqsj052m6r55zl6z7xjpxhf37aw",
-    "version": "4.3.0"
+    "path": "mailpoet/tags/4.3.1",
+    "rev": "2843001",
+    "sha256": "0nnmfk1rxhf31makfc0v7mlh30799saxpf8agqdlavrmqpvypvzb",
+    "version": "4.3.1"
   },
   "merge-minify-refresh": {
     "path": "merge-minify-refresh/trunk",
@@ -150,15 +150,21 @@
     "version": "3.7.0"
   },
   "wp-statistics": {
-    "path": "wp-statistics/tags/13.2.10",
-    "rev": "2838980",
-    "sha256": "02wg8y4zfx0h87k38dy21gfys1g99r4dswwv6g308vflcml68ma1",
-    "version": "13.2.10"
+    "path": "wp-statistics/tags/13.2.11",
+    "rev": "2841966",
+    "sha256": "0bdg63q9wq82rpj7lxiwsvbpxa03r2v1pngs2pxifd4632b7ikni",
+    "version": "13.2.11"
   },
   "wp-user-avatars": {
     "path": "wp-user-avatars/trunk",
     "rev": "2540784",
     "sha256": "1g21nl6xs9zyq0ainjwa06wl90975l8f9rj0fa20zkmw17w2mdgl",
     "version": "1.4.1"
+  },
+  "wpforms-lite": {
+    "path": "wpforms-lite/tags/1.7.8",
+    "rev": "2815943",
+    "sha256": "0xqnjxlj2m6zpcasj3gksg9qzjm8pynjr8sar8xbgfz8ichs5m6m",
+    "version": "1.7.8"
   }
 }
diff --git a/pkgs/servers/web-apps/wordpress/packages/thirdparty.nix b/pkgs/servers/web-apps/wordpress/packages/thirdparty.nix
new file mode 100644
index 0000000000000..19d23531f6b02
--- /dev/null
+++ b/pkgs/servers/web-apps/wordpress/packages/thirdparty.nix
@@ -0,0 +1,8 @@
+{fetchzip}: {
+  plugins.civicrm = fetchzip rec {
+    name = "civicrm";
+    version = "5.56.0";
+    url = "https://storage.googleapis.com/${name}/${name}-stable/${version}/${name}-${version}-wordpress.zip";
+    hash = "sha256-XsNFxVL0LF+OHlsqjjTV41x9ERLwMDq9BnKKP3Px2aI=";
+  };
+}
diff --git a/pkgs/servers/web-apps/wordpress/packages/wordpress-plugins.json b/pkgs/servers/web-apps/wordpress/packages/wordpress-plugins.json
index 4e4e84ab8ccc2..193c0ae4f2ae5 100644
--- a/pkgs/servers/web-apps/wordpress/packages/wordpress-plugins.json
+++ b/pkgs/servers/web-apps/wordpress/packages/wordpress-plugins.json
@@ -26,4 +26,5 @@
 , "wp-mail-smtp"
 , "wp-statistics"
 , "wp-user-avatars"
+, "wpforms-lite"
 ]
diff --git a/pkgs/stdenv/generic/check-meta.nix b/pkgs/stdenv/generic/check-meta.nix
index 83557f995af34..da2e9b135f2e3 100644
--- a/pkgs/stdenv/generic/check-meta.nix
+++ b/pkgs/stdenv/generic/check-meta.nix
@@ -93,14 +93,14 @@ let
 
   hasNonSourceProvenance = attrs:
     (attrs ? meta.sourceProvenance) &&
-    isNonSource (lib.lists.toList attrs.meta.sourceProvenance);
+    isNonSource attrs.meta.sourceProvenance;
 
   # Allow granular checks to allow only some non-source-built packages
   # Example:
   # { pkgs, ... }:
   # {
   #   allowNonSource = false;
-  #   allowNonSourcePredicate = with pkgs.lib.lists; pkg: !(any (p: !p.isSource && p != lib.sourceTypes.binaryFirmware) (toList pkg.meta.sourceProvenance));
+  #   allowNonSourcePredicate = with pkgs.lib.lists; pkg: !(any (p: !p.isSource && p != lib.sourceTypes.binaryFirmware) pkg.meta.sourceProvenance);
   # }
   allowNonSourcePredicate = config.allowNonSourcePredicate or (x: false);
 
@@ -269,7 +269,7 @@ let
     license = let
       licenseType = either (attrsOf anything) str; # TODO disallow `str` licenses, use a module
     in either licenseType (listOf licenseType);
-    sourceProvenance = either (listOf (attrsOf anything)) (attrsOf anything);
+    sourceProvenance = listOf lib.types.attrs;
     maintainers = listOf (attrsOf anything); # TODO use the maintainer type from lib/tests/maintainer-module.nix
     priority = int;
     platforms = listOf str;
diff --git a/pkgs/tools/admin/pulumi/default.nix b/pkgs/tools/admin/pulumi/default.nix
index ddfbfee6107f7..e95a265ebd6f4 100644
--- a/pkgs/tools/admin/pulumi/default.nix
+++ b/pkgs/tools/admin/pulumi/default.nix
@@ -109,7 +109,7 @@ buildGoModule rec {
   meta = with lib; {
     homepage = "https://pulumi.io/";
     description = "Pulumi is a cloud development platform that makes creating cloud programs easy and productive";
-    sourceProvenance = sourceTypes.fromSource;
+    sourceProvenance = [ sourceTypes.fromSource ];
     license = licenses.asl20;
     platforms = platforms.unix;
     maintainers = with maintainers; [
diff --git a/pkgs/tools/filesystems/gcsfuse/default.nix b/pkgs/tools/filesystems/gcsfuse/default.nix
index 225048f0e3a83..f45d4cd95b690 100644
--- a/pkgs/tools/filesystems/gcsfuse/default.nix
+++ b/pkgs/tools/filesystems/gcsfuse/default.nix
@@ -1,21 +1,31 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
 
 buildGoModule rec {
   pname = "gcsfuse";
-  version = "0.41.9";
+  version = "0.41.10";
 
   src = fetchFromGitHub {
     owner = "googlecloudplatform";
     repo = "gcsfuse";
-    rev = "v${version}";
-    sha256 = "sha256-hfdQa0e1S1cIF4V2XPFBl4jzzTWlIxZIJ99PRxCP55s=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-rtBqXC1CTkbKDP6pzkRQ7GnM5f4xt6eUMW3n9wZu0hc=";
   };
 
   vendorSha256 = null;
 
-  subPackages = [ "." "tools/mount_gcsfuse" ];
+  subPackages = [
+    "."
+    "tools/mount_gcsfuse"
+  ];
 
-  ldflags = [ "-s" "-w" "-X main.gcsfuseVersion=${version}" ];
+  ldflags = [
+    "-s"
+    "-w"
+    "-X main.gcsfuseVersion=${version}"
+  ];
 
   preCheck =
     let skippedTests = [
@@ -35,6 +45,7 @@ buildGoModule rec {
   meta = with lib;{
     description = "A user-space file system for interacting with Google Cloud Storage";
     homepage = "https://cloud.google.com/storage/docs/gcs-fuse";
+    changelog = "https://github.com/GoogleCloudPlatform/gcsfuse/releases/tag/v${version}";
     license = licenses.asl20;
     platforms = platforms.unix;
     maintainers = with maintainers; [ aaronjheng ];
diff --git a/pkgs/tools/filesystems/httm/default.nix b/pkgs/tools/filesystems/httm/default.nix
index 1138ecb7f9970..a19333f1cc838 100644
--- a/pkgs/tools/filesystems/httm/default.nix
+++ b/pkgs/tools/filesystems/httm/default.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "httm";
-  version = "0.18.3";
+  version = "0.19.2";
 
   src = fetchFromGitHub {
     owner = "kimono-koans";
     repo = pname;
     rev = version;
-    sha256 = "sha256-LJFBridWS7YYO9Bw3mzRdRnh2gGUxAtuoNq2T1wuAcY=";
+    sha256 = "sha256-0diHZFD4+glTdGWWJk/5amr0mDsvKV5OibKGQNtitIk=";
   };
 
-  cargoSha256 = "sha256-/v0QQ3EnmL1EKEjJ4O0t52SOrCz+CVBpunogEfVMpBw=";
+  cargoSha256 = "sha256-Rg1wmDLmkDC25meZIe94WZ3Wp8a93VAqRJXjmaE6k18=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/misc/broot/default.nix b/pkgs/tools/misc/broot/default.nix
index 5bd2f231392fa..c920aebd32168 100644
--- a/pkgs/tools/misc/broot/default.nix
+++ b/pkgs/tools/misc/broot/default.nix
@@ -1,7 +1,7 @@
 { lib
 , stdenv
 , rustPlatform
-, fetchCrate
+, fetchFromGitHub
 , installShellFiles
 , makeWrapper
 , pkg-config
@@ -15,14 +15,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "broot";
-  version = "1.18.0";
+  version = "1.19.0";
 
-  src = fetchCrate {
-    inherit pname version;
-    sha256 = "sha256-GR0a5NDJBcRLoNOeG6S+fP3Fr7r5fVB9oEcjANRYJt4=";
+  src = fetchFromGitHub {
+    owner = "Canop";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-pg+eHmClDd04tWljQUS0IRyMzkHnkpkofuhz/KyQbWo=";
   };
 
-  cargoHash = "sha256-Hk9bc1mo8GxcPICKXc9zDq18S5TZElDncxJ+w2fC2do=";
+  cargoHash = "sha256-+RUYC39L7yyh1xYPfZn7tDIf1cmmBuGcqTNibFk7s6M=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/tools/misc/debian-devscripts/default.nix b/pkgs/tools/misc/debian-devscripts/default.nix
index 343713c02255a..6b710f2e2c0d0 100644
--- a/pkgs/tools/misc/debian-devscripts/default.nix
+++ b/pkgs/tools/misc/debian-devscripts/default.nix
@@ -34,13 +34,14 @@ in stdenv.mkDerivation rec {
     tgtpy="$out/lib/${python.libPrefix}/site-packages"
     mkdir -p "$tgtpy"
     export PYTHONPATH="$PYTHONPATH''${PYTHONPATH:+:}$tgtpy"
-    find po4a scripts -type f -exec sed -r \
+    find lib po4a scripts -type f -exec sed -r \
       -e "s@/usr/bin/gpg(2|)@${gnupg}/bin/gpg@g" \
       -e "s@/usr/(s|)bin/sendmail@${sendmailPath}@g" \
       -e "s@/usr/bin/diff@${diffutils}/bin/diff@g" \
       -e "s@/usr/bin/gpgv(2|)@${gnupg}/bin/gpgv@g" \
       -e "s@(command -v|/usr/bin/)curl@${curl.bin}/bin/curl@g" \
       -e "s@sensible-editor@${sensible-editor}@g" \
+      -e "s@(^|\W)/bin/bash@\1${stdenv.shell}@g" \
       -i {} +
     sed -e "s@/usr/share/sgml/[^ ]*/manpages/docbook.xsl@${docbook_xsl}/xml/xsl/docbook/manpages/docbook.xsl@" -i scripts/Makefile
     sed -r \
@@ -66,6 +67,9 @@ in stdenv.mkDerivation rec {
         --prefix PYTHONPATH : "$out/${python.sitePackages}" \
         --prefix PATH : "${dpkg}/bin"
     done
+    ln -s cvs-debi $out/bin/cvs-debc
+    ln -s debchange $out/bin/dch
+    ln -s pts-subscribe $out/bin/pts-unsubscribe
   '';
 
   meta = with lib; {
diff --git a/pkgs/tools/networking/aardvark-dns/default.nix b/pkgs/tools/networking/aardvark-dns/default.nix
index fdf76d459a296..4f4576dfe297d 100644
--- a/pkgs/tools/networking/aardvark-dns/default.nix
+++ b/pkgs/tools/networking/aardvark-dns/default.nix
@@ -1,6 +1,7 @@
 { lib
 , rustPlatform
 , fetchFromGitHub
+, nixosTests
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -16,6 +17,8 @@ rustPlatform.buildRustPackage rec {
 
   cargoHash = "sha256-naWkSXQHfImd6R+RHKkmTe8UiqxknZEFYoJ0g/URCVY=";
 
+  passthru.tests = { inherit (nixosTests) podman; };
+
   meta = with lib; {
     description = "Authoritative dns server for A/AAAA container records";
     homepage = "https://github.com/containers/aardvark-dns";
diff --git a/pkgs/tools/networking/netavark/default.nix b/pkgs/tools/networking/netavark/default.nix
index fbd0a8119c51f..bac09558e7fbb 100644
--- a/pkgs/tools/networking/netavark/default.nix
+++ b/pkgs/tools/networking/netavark/default.nix
@@ -3,6 +3,7 @@
 , fetchFromGitHub
 , installShellFiles
 , mandown
+, nixosTests
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -25,6 +26,8 @@ rustPlatform.buildRustPackage rec {
     installManPage docs/netavark.1
   '';
 
+  passthru.tests = { inherit (nixosTests) podman; };
+
   meta = with lib; {
     description = "Rust based network stack for containers";
     homepage = "https://github.com/containers/netavark";
diff --git a/pkgs/tools/networking/nfdump/default.nix b/pkgs/tools/networking/nfdump/default.nix
index 3a24794f419b1..713bf400f4b1b 100644
--- a/pkgs/tools/networking/nfdump/default.nix
+++ b/pkgs/tools/networking/nfdump/default.nix
@@ -1,22 +1,40 @@
-{ lib, stdenv, fetchFromGitHub
-, autoconf, automake, libtool, pkg-config
-, bzip2, libpcap, flex, bison }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, autoconf
+, automake
+, libtool
+, pkg-config
+, bzip2
+, libpcap
+, flex
+, bison
+}:
 
-let version = "1.7.0.1"; in
-
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
   pname = "nfdump";
-  inherit version;
+  version = "1.7.1";
 
   src = fetchFromGitHub {
     owner = "phaag";
     repo = "nfdump";
-    rev = "v${version}";
-    sha256 = "sha256-yD/NFGw38ishqQmKhlnHYodXmJuezI09hxNsyObZ1QE=";
+    rev =  "refs/tags/v${version}";
+    hash = "sha256-oCaJPx6+C0NQSuUcsP54sycNLt/zaqe5c81dwHNBcnQ=";
   };
 
-  nativeBuildInputs = [ autoconf automake flex libtool pkg-config bison ];
-  buildInputs = [ bzip2 libpcap ];
+  nativeBuildInputs = [
+    autoconf
+    automake
+    flex
+    libtool
+    pkg-config
+    bison
+  ];
+
+  buildInputs = [
+    bzip2
+    libpcap
+  ];
 
   preConfigure = ''
     # The script defaults to glibtoolize on darwin, so we pass the correct
@@ -37,8 +55,9 @@ stdenv.mkDerivation {
       nfdump is a set of tools for working with netflow data.
     '';
     homepage = "https://github.com/phaag/nfdump";
+    changelog = "https://github.com/phaag/nfdump/releases/tag/v${version}";
     license = licenses.bsd3;
-    maintainers = [ maintainers.takikawa ];
+    maintainers = with maintainers; [ takikawa ];
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/tools/networking/sing-box/default.nix b/pkgs/tools/networking/sing-box/default.nix
index 99d320f4f85c8..fbc268e7b880d 100644
--- a/pkgs/tools/networking/sing-box/default.nix
+++ b/pkgs/tools/networking/sing-box/default.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "sing-box";
-  version = "1.1.1";
+  version = "1.1.2";
 
   src = fetchFromGitHub {
     owner = "SagerNet";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-CNy+C5E5iAZHZ7PsS0Hj43irCuCvy/bes3kovvH81/o=";
+    hash = "sha256-FbW2h/muCk/vAItYHYRA/DFFPQvmTqNq74XUZQkUXaA=";
   };
 
-  vendorHash = "sha256-fUHfvqzbu2P7N413dDuV41myhReNSYvgF+Cc6SgG6y4=";
+  vendorHash = "sha256-kJE+1bekIpv36cG0/Gi25kjnJmTjTp6lt344kFCUSXI=";
 
   tags = [
     "with_quic"
diff --git a/pkgs/tools/networking/smokeping/default.nix b/pkgs/tools/networking/smokeping/default.nix
index 2b4a12bc73788..29996a1c7243b 100644
--- a/pkgs/tools/networking/smokeping/default.nix
+++ b/pkgs/tools/networking/smokeping/default.nix
@@ -1,16 +1,26 @@
-{ lib, stdenv, fetchurl, fping, rrdtool, perlPackages, nixosTests }:
+{ lib, stdenv, fetchurl, fetchpatch, fping, rrdtool, perlPackages, autoreconfHook, nixosTests }:
 
 stdenv.mkDerivation rec {
   pname = "smokeping";
-  version = "2.6.11";
+  version = "2.8.2";
   src = fetchurl {
     url = "https://oss.oetiker.ch/smokeping/pub/smokeping-${version}.tar.gz";
-    sha256 = "1p9hpa2zs33p7hzrds80kwrm5255s0869v3s3qmsyx2sx63c7czj";
+    sha256 = "sha256-KeYRGLRV4juWmtpfjiq0MtPi74fUr+LIbeSgPXGItuo=";
   };
+
+  patches = [
+    (fetchpatch {
+      url = "https://src.fedoraproject.org/rpms/smokeping/raw/4ebf1921706a5a29c758fdce2f59cc35652c944a/f/smokeping-2.8.2-no-3rd-party.patch";
+      hash = "sha256-97rQ4m9HHl3lIpQyjZvu+gZSrNIB2pckxmopCQAQPp0=";
+    })
+  ];
+
   propagatedBuildInputs = [ rrdtool ] ++
     (with perlPackages; [ perl FCGI CGI CGIFast ConfigGrammar DigestHMAC NetTelnet
       NetOpenSSH NetSNMP LWP IOTty fping NetDNS perlldap ]);
 
+  nativeBuildInputs = [ autoreconfHook ];
+
   postInstall = ''
     mv $out/htdocs/smokeping.fcgi.dist $out/htdocs/smokeping.fcgi
   '';
@@ -19,7 +29,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "Network latency collector";
-    homepage = "http://oss.oetiker.ch/smokeping";
+    homepage = "https://oss.oetiker.ch/smokeping";
     license = lib.licenses.gpl2Plus;
     platforms = lib.platforms.all;
     maintainers = [ lib.maintainers.erictapen ];
diff --git a/pkgs/tools/networking/v2ray/default.nix b/pkgs/tools/networking/v2ray/default.nix
index 741465bebee4e..51f70abcc71db 100644
--- a/pkgs/tools/networking/v2ray/default.nix
+++ b/pkgs/tools/networking/v2ray/default.nix
@@ -6,18 +6,18 @@
 
 buildGoModule rec {
   pname = "v2ray-core";
-  version = "5.1.0";
+  version = "5.2.0";
 
   src = fetchFromGitHub {
     owner = "v2fly";
     repo = "v2ray-core";
     rev = "v${version}";
-    hash = "sha256-87BtyaJN6qbinZQ+6MAwaK62YzbVnncj4qnEErG5tfA=";
+    hash = "sha256-/n8GyKcTsus7BWspg6Br4ALH98A1dSpkNFNKkRlIqHs=";
   };
 
   # `nix-update` doesn't support `vendorHash` yet.
   # https://github.com/Mic92/nix-update/pull/95
-  vendorSha256 = "sha256-RuDCAgTzqwe5fUwa9ce2wRx4FPT8siRLbP7mU8/jg/Y=";
+  vendorSha256 = "sha256-85k6XWe12m2siejfoPJru87/AYdVSl+ag09jUkBIc0M=";
 
   ldflags = [ "-s" "-w" "-buildid=" ];
 
diff --git a/pkgs/tools/networking/wireproxy/default.nix b/pkgs/tools/networking/wireproxy/default.nix
new file mode 100644
index 0000000000000..9f4109b1e0b0d
--- /dev/null
+++ b/pkgs/tools/networking/wireproxy/default.nix
@@ -0,0 +1,31 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
+
+buildGoModule rec {
+  pname = "wireproxy";
+  version = "1.0.5";
+
+  src = fetchFromGitHub {
+    owner = "octeep";
+    repo = "wireproxy";
+    rev = "v${version}";
+    hash = "sha256-5xyKmFxXYhrR8EbG1/ByD10lhkPT9Ky1lq+LL2djaao=";
+  };
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X main.version=v${version}"
+  ];
+
+  vendorHash = "sha256-/LZs6N2m5nHx735Ug+PcM1I1ZL9f8VYEpd7Tt4WizMQ=";
+
+  meta = with lib; {
+    description = "Wireguard client that exposes itself as a socks5 proxy";
+    homepage = "https://github.com/octeep/wireproxy";
+    license = licenses.isc;
+    maintainers = with maintainers; [ _3JlOy-PYCCKUi ];
+  };
+}
diff --git a/pkgs/tools/package-management/licensee/Gemfile.lock b/pkgs/tools/package-management/licensee/Gemfile.lock
index 438ba3e8c6f3d..487224bf5da21 100644
--- a/pkgs/tools/package-management/licensee/Gemfile.lock
+++ b/pkgs/tools/package-management/licensee/Gemfile.lock
@@ -4,25 +4,25 @@ GEM
     addressable (2.8.1)
       public_suffix (>= 2.0.2, < 6.0)
     dotenv (2.8.1)
-    faraday (2.7.1)
+    faraday (2.7.2)
       faraday-net_http (>= 2.0, < 3.1)
       ruby2_keywords (>= 0.0.4)
     faraday-net_http (3.0.2)
-    licensee (9.15.3)
+    licensee (9.16.0)
       dotenv (~> 2.0)
       octokit (>= 4.20, < 7.0)
       reverse_markdown (>= 1, < 3)
       rugged (>= 0.24, < 2.0)
       thor (>= 0.19, < 2.0)
-    mini_portile2 (2.8.0)
-    nokogiri (1.13.9)
+    mini_portile2 (2.8.1)
+    nokogiri (1.13.10)
       mini_portile2 (~> 2.8.0)
       racc (~> 1.4)
     octokit (6.0.1)
       faraday (>= 1, < 3)
       sawyer (~> 0.9)
-    public_suffix (5.0.0)
-    racc (1.6.0)
+    public_suffix (5.0.1)
+    racc (1.6.2)
     reverse_markdown (2.1.1)
       nokogiri
     ruby2_keywords (0.0.5)
@@ -39,4 +39,4 @@ DEPENDENCIES
   licensee
 
 BUNDLED WITH
-   2.3.25
+   2.3.26
diff --git a/pkgs/tools/package-management/licensee/gemset.nix b/pkgs/tools/package-management/licensee/gemset.nix
index 656f67f3a270e..25726d2ac5c25 100644
--- a/pkgs/tools/package-management/licensee/gemset.nix
+++ b/pkgs/tools/package-management/licensee/gemset.nix
@@ -26,10 +26,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1wyz9ab0mzi84gpf81fs19vrixglmmxi25k6n1mn9h141qmsp590";
+      sha256 = "17lacy6n0hsayafvgxgzmngfq2x62b2arbn32bj2yyzmgxwyxhqn";
       type = "gem";
     };
-    version = "2.7.1";
+    version = "2.7.2";
   };
   faraday-net_http = {
     groups = ["default"];
@@ -47,20 +47,20 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0n0l1c8kxhpdg6pgv1wgwpdfc7gqkygpd8h41shwc95rapdha9gg";
+      sha256 = "0i4hs0vbgp0w3pdddr37zhydm16af122rmr0w39v3nqrj1ir65kv";
       type = "gem";
     };
-    version = "9.15.3";
+    version = "9.16.0";
   };
   mini_portile2 = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0rapl1sfmfi3bfr68da4ca16yhc0pp93vjwkj7y3rdqrzy3b41hy";
+      sha256 = "1af4yarhbbx62f7qsmgg5fynrik0s36wjy3difkawy536xg343mp";
       type = "gem";
     };
-    version = "2.8.0";
+    version = "2.8.1";
   };
   nokogiri = {
     dependencies = ["mini_portile2" "racc"];
@@ -68,10 +68,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0cam1455nmi3fzzpa9ixn2hsim10fbprmj62ajpd6d02mwdprwwn";
+      sha256 = "0n79k78c5vdcyl0m3y3l5x9kxl6xf5lgriwi2vd665qmdkr01vnk";
       type = "gem";
     };
-    version = "1.13.9";
+    version = "1.13.10";
   };
   octokit = {
     dependencies = ["faraday" "sawyer"];
@@ -89,20 +89,20 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0sqw1zls6227bgq38sxb2hs8nkdz4hn1zivs27mjbniswfy4zvi6";
+      sha256 = "0hz0bx2qs2pwb0bwazzsah03ilpf3aai8b7lk7s35jsfzwbkjq35";
       type = "gem";
     };
-    version = "5.0.0";
+    version = "5.0.1";
   };
   racc = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0la56m0z26j3mfn1a9lf2l03qx1xifanndf9p3vx1azf6sqy7v9d";
+      sha256 = "09jgz6r0f7v84a7jz9an85q8vvmp743dqcsdm3z9c8rqcqv6pljq";
       type = "gem";
     };
-    version = "1.6.0";
+    version = "1.6.2";
   };
   reverse_markdown = {
     dependencies = ["nokogiri"];
diff --git a/pkgs/tools/security/mitmproxy2swagger/default.nix b/pkgs/tools/security/mitmproxy2swagger/default.nix
index 560e9a175da0c..3378e0d332c7f 100644
--- a/pkgs/tools/security/mitmproxy2swagger/default.nix
+++ b/pkgs/tools/security/mitmproxy2swagger/default.nix
@@ -5,14 +5,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "mitmproxy2swagger";
-  version = "0.7.1";
+  version = "0.7.2";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "alufers";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-morBtuRZZ/d3ye8aB+m2dSwWoaF3JJ92c+CgF71MqH4=";
+    hash = "sha256-LnH0RDiRYJAGI7ZT6Idu1AqSz0yBRuBJvhIgY72Z4CA=";
   };
 
   nativeBuildInputs = with python3.pkgs; [
diff --git a/pkgs/tools/security/pass/extensions/checkup.nix b/pkgs/tools/security/pass/extensions/checkup.nix
index 5ae846d4a4b31..b1cff6a20724b 100644
--- a/pkgs/tools/security/pass/extensions/checkup.nix
+++ b/pkgs/tools/security/pass/extensions/checkup.nix
@@ -3,7 +3,7 @@
 
 let
   pname = "pass-checkup";
-  version = "0.2.1";
+  version = "0.2.2";
 in stdenv.mkDerivation {
   inherit pname version;
 
@@ -11,7 +11,7 @@ in stdenv.mkDerivation {
     owner = "etu";
     repo = pname;
     rev = version;
-    sha256 = "18b6rx59r7g0hvqs2affvw0g0jyifyzhanwgz2q2b8nhjgqgnar2";
+    sha256 = "1p65yxr00k35g4bnagszp8i03pmhnrcmipgrdsawps2ba8faqp6r";
   };
 
   nativeBuildInputs = [ shellcheck ];
diff --git a/pkgs/tools/security/trufflehog/default.nix b/pkgs/tools/security/trufflehog/default.nix
index 27574241576ad..76ccda498b47f 100644
--- a/pkgs/tools/security/trufflehog/default.nix
+++ b/pkgs/tools/security/trufflehog/default.nix
@@ -1,43 +1,33 @@
 { lib
-, python3Packages
+, fetchFromGitHub
+, buildGoModule
 }:
 
-let
-  truffleHogRegexes = python3Packages.buildPythonPackage rec {
-    pname = "truffleHogRegexes";
-    version = "0.0.7";
-    src = python3Packages.fetchPypi {
-      inherit pname version;
-      sha256 = "b81dfc60c86c1e353f436a0e201fd88edb72d5a574615a7858485c59edf32405";
-    };
-  };
-in
-  python3Packages.buildPythonApplication rec {
-    pname = "truffleHog";
-    version = "2.2.1";
+buildGoModule rec {
+  pname = "trufflehog";
+  version = "3.21.0";
 
-    src = python3Packages.fetchPypi {
-      inherit pname version;
-      hash = "sha256-fw0JyM2iqQrkL4FAXllEozJdkKWELS3eAURx5NZcceQ=";
-    };
+  src = fetchFromGitHub {
+    owner = "trufflesecurity";
+    repo = "trufflehog";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-rse5uyQ7EUBhs0IyC92B/Z7YCeNIXTlZEqrlcjFekgA=";
+  };
 
-    # Relax overly restricted version constraint
-    postPatch = ''
-      substituteInPlace setup.py --replace "GitPython ==" "GitPython >= "
-    '';
+  vendorHash = "sha256-KyyJ7hUWF29L8oB9GkJ918/BQoLMsz+tStT2T9Azunk=";
 
-    propagatedBuildInputs = [
-      python3Packages.gitpython
-      truffleHogRegexes
-    ];
+  # Test cases run git clone and require network access
+  doCheck = false;
 
-    # Test cases run git clone and require network access
-    doCheck = false;
+  postInstall = ''
+    rm $out/bin/{generate,snifftest}
+  '';
 
-    meta = with lib; {
-      homepage = "https://github.com/dxa4481/truffleHog";
-      description = "Searches through git repositories for high entropy strings and secrets, digging deep into commit history";
-      license = with licenses; [ gpl2 ];
-      maintainers = with maintainers; [ bhipple ];
-    };
-  }
+  meta = with lib; {
+    description = "Find credentials all over the place";
+    homepage = "https://github.com/trufflesecurity/trufflehog";
+    changelog = "https://github.com/trufflesecurity/trufflehog/releases/tag/v${version}";
+    license = with licenses; [ agpl3 ];
+    maintainers = with maintainers; [ ];
+  };
+}
diff --git a/pkgs/tools/text/miller/default.nix b/pkgs/tools/text/miller/default.nix
index ed7e0f0230d1a..9d00ab028a9aa 100644
--- a/pkgs/tools/text/miller/default.nix
+++ b/pkgs/tools/text/miller/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "miller";
-  version = "6.5.0";
+  version = "6.6.0";
 
   src = fetchFromGitHub {
     owner = "johnkerl";
     repo = "miller";
     rev = "v${version}";
-    sha256 = "sha256-k/ibxJYgk3CT+/mYJ3DN9GatuiIgMPMs1+5cbCg4jxM=";
+    sha256 = "sha256-Uvf2kkWD6ir8XicEX+FNYmd2A9c/jd6GgwjYomNfjfc=";
   };
 
-  vendorSha256 = "sha256-UQHqDuQeXfmGrRYSbqW6lnBDVTgDJGhJWmH4kgPrggE=";
+  vendorSha256 = "sha256-VW0mTq0oc95wVkFa+0rpsiOlS/9LT2Xy6u0RtSTsEoA=";
 
   subPackages = [ "cmd/mlr" ];
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 8e15d2571837f..678a2f20519e7 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -8854,6 +8854,8 @@ with pkgs;
 
   mautrix-facebook = callPackage ../servers/mautrix-facebook { };
 
+  mautrix-googlechat = callPackage ../servers/mautrix-googlechat { };
+
   mautrix-signal = recurseIntoAttrs (callPackage ../servers/mautrix-signal { });
 
   mautrix-telegram = recurseIntoAttrs (callPackage ../servers/mautrix-telegram { });
@@ -12894,6 +12896,8 @@ with pkgs;
 
   wireguard-tools = callPackage ../tools/networking/wireguard-tools { };
 
+  wireproxy = callPackage ../tools/networking/wireproxy { };
+
   wiringpi = callPackage ../os-specific/linux/wiringpi { };
 
   wg-friendly-peer-names = callPackage ../tools/networking/wg-friendly-peer-names { };
@@ -14491,7 +14495,7 @@ with pkgs;
 
   gnu-smalltalk = callPackage ../development/compilers/gnu-smalltalk { };
 
-  gccgo = wrapCC (gcc.cc.override {
+  gccgo = wrapCC ((if stdenv.hostPlatform.isMusl then gcc_latest else gcc).cc.override {
     name = "gccgo";
     langCC = true; #required for go.
     langC = true;
@@ -16285,6 +16289,8 @@ with pkgs;
 
   pipenv = callPackage ../development/tools/pipenv {};
 
+  pipx = with python3.pkgs; toPythonApplication pipx;
+
   pipewire = callPackage ../development/libraries/pipewire {
     # ffmpeg depends on SDL2 which depends on pipewire by default.
     # Break the cycle by depending on ffmpeg-headless.
@@ -19616,6 +19622,8 @@ with pkgs;
 
   mpfi = callPackage ../development/libraries/mpfi { };
 
+  mpdecimal = callPackage ../development/libraries/mpdecimal { };
+
   mpfshell = callPackage ../development/tools/mpfshell { };
 
   # A GMP fork
@@ -21413,6 +21421,8 @@ with pkgs;
 
   libusbsio = callPackage ../development/libraries/libusbsio { };
 
+  libucontext = callPackage ../development/libraries/libucontext { };
+
   libutempter = callPackage ../development/libraries/libutempter { };
 
   libuldaq = callPackage ../development/libraries/libuldaq { };
@@ -23860,9 +23870,9 @@ with pkgs;
 
   clickhouse = callPackage ../servers/clickhouse {
     # upstream requires llvm12 as of v22.3.2.2
-    inherit (llvmPackages_13) clang-unwrapped lld llvm;
-    llvm-bintools = llvmPackages_13.bintools;
-    stdenv = llvmPackages_13.stdenv;
+    inherit (llvmPackages_14) clang-unwrapped lld llvm;
+    llvm-bintools = llvmPackages_14.bintools;
+    stdenv = llvmPackages_14.stdenv;
   };
 
   clickhouse-cli = with python3Packages; toPythonApplication clickhouse-cli;
@@ -30111,6 +30121,8 @@ with pkgs;
 
   kdeltachat = libsForQt5.callPackage ../applications/networking/instant-messengers/kdeltachat { };
 
+  keet = callPackage ../applications/networking/instant-messengers/keet { };
+
   kepubify = callPackage ../tools/misc/kepubify { };
 
   kermit = callPackage ../tools/misc/kermit { };
@@ -37885,7 +37897,7 @@ with pkgs;
 
   wmutils-opt = callPackage ../tools/X11/wmutils-opt { };
 
-  wordpress = callPackage ../servers/web-apps/wordpress { };
+  inherit (callPackage ../servers/web-apps/wordpress {}) wordpress wordpress6_1;
 
   wordpressPackages = ( callPackage ../servers/web-apps/wordpress/packages {
     plugins = lib.importJSON ../servers/web-apps/wordpress/packages/plugins.json;
diff --git a/pkgs/top-level/release-cross.nix b/pkgs/top-level/release-cross.nix
index 6eeda58a6c172..0a419ae7cf06e 100644
--- a/pkgs/top-level/release-cross.nix
+++ b/pkgs/top-level/release-cross.nix
@@ -92,7 +92,7 @@ let
   # with their host distribution's versions of nix's numerous
   # build dependencies.
   nixCrossStatic = {
-    nixStatic = platforms.linux;  # no need for buildPlatform=*-darwin
+    nixStatic = linux;  # no need for buildPlatform=*-darwin
   };
 
 in
author	maralorn <mail@maralorn.de>	2023-01-05 00:18:05 +0100
committer	maralorn <mail@maralorn.de>	2023-01-05 00:18:05 +0100
commit	3b1869aa951895eb3402fc0bc884490c034f99fc (patch)
tree	e12588d5fb10dcce0badfdb25d1682209c8f04cb
parent	4045943b6411536f9c0484b7cb3772200895e97d (diff)
parent	05968fc7e41177096305caa0b9360574367ce9fa (diff)