Merge master into haskell-updates

author: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> 2023-03-12 00:13:51 +0000
committer: GitHub <noreply@github.com> 2023-03-12 00:13:51 +0000
commit: f2032fa12b9143fc1ae8dd64c530e725fa013e0b (patch)
tree: be57a57ea48493c91137a18400078ae2ccdc137a /pkgs
parent: f2ae2be316594098fee7140ee6d151e8c05cd0a5 (diff)
parent: 8b6900dc2ff916fe0c8b6ed250f1ef55d9962bb2 (diff)
127 files changed, 844 insertions, 374 deletions
diff --git a/pkgs/applications/audio/bitwig-studio/bitwig-studio4.nix b/pkgs/applications/audio/bitwig-studio/bitwig-studio4.nix
index 940e6c3c0c683..e6b0bea5d4e6c 100644
--- a/pkgs/applications/audio/bitwig-studio/bitwig-studio4.nix
+++ b/pkgs/applications/audio/bitwig-studio/bitwig-studio4.nix
@@ -24,11 +24,11 @@
 
 stdenv.mkDerivation rec {
   pname = "bitwig-studio";
-  version = "4.4.6";
+  version = "4.4.8";
 
   src = fetchurl {
     url = "https://downloads.bitwig.com/stable/${version}/${pname}-${version}.deb";
-    sha256 = "sha256-VcK74JrVH81sgNeh1FDvCO1jtgkVeLpx5IqlXuzH27A=";
+    sha256 = "sha256-qdqRvCmp6Q7lcTdOIEHeQKAAOLtJxs867gapopyeHuc=";
   };
 
   nativeBuildInputs = [ dpkg makeWrapper wrapGAppsHook ];
diff --git a/pkgs/applications/audio/mixxx/default.nix b/pkgs/applications/audio/mixxx/default.nix
index 76c5de75ef544..e72e809e91757 100644
--- a/pkgs/applications/audio/mixxx/default.nix
+++ b/pkgs/applications/audio/mixxx/default.nix
@@ -52,13 +52,13 @@
 
 mkDerivation rec {
   pname = "mixxx";
-  version = "2.3.3";
+  version = "2.3.4";
 
   src = fetchFromGitHub {
     owner = "mixxxdj";
     repo = "mixxx";
     rev = version;
-    sha256 = "sha256-NRtrEobdJMFgDXrEeb2t1zeVN8pQP7+pda2DSU/yNX8=";
+    sha256 = "sha256-1hOMU/Mdk1vT0GQipn/WX2fm9ddN0mPIq7kf2i2w3xQ=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
@@ -116,7 +116,7 @@ mkDerivation rec {
 
   # mixxx installs udev rules to DATADIR instead of SYSCONFDIR
   # let's disable this and install udev rules manually via postInstall
-  # see https://github.com/mixxxdj/mixxx/blob/2.3.3/CMakeLists.txt#L1381-L1392
+  # see https://github.com/mixxxdj/mixxx/blob/2.3.4/CMakeLists.txt#L1381-L1392
   cmakeFlags = [
     "-DINSTALL_USER_UDEV_RULES=OFF"
   ];
diff --git a/pkgs/applications/audio/mympd/default.nix b/pkgs/applications/audio/mympd/default.nix
index a1a958c3d558f..d987c770c983c 100644
--- a/pkgs/applications/audio/mympd/default.nix
+++ b/pkgs/applications/audio/mympd/default.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mympd";
-  version = "10.2.4";
+  version = "10.2.5";
 
   src = fetchFromGitHub {
     owner = "jcorporation";
     repo = "myMPD";
     rev = "v${version}";
-    sha256 = "sha256-12hCIAwrLQkwiU9t9nNPBdIiHfMidfErSWOA0FPfhBQ=";
+    sha256 = "sha256-ZxGMvbm9GKhhfCNZdeIYUh2FF4c3vXtvRdu24u3Zrtg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/audio/ncspot/default.nix b/pkgs/applications/audio/ncspot/default.nix
index c15f6b9c14e16..85613815b38cf 100644
--- a/pkgs/applications/audio/ncspot/default.nix
+++ b/pkgs/applications/audio/ncspot/default.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "ncspot";
-  version = "0.12.0";
+  version = "0.13.0";
 
   src = fetchFromGitHub {
     owner = "hrkfdn";
     repo = "ncspot";
     rev = "v${version}";
-    sha256 = "sha256-kqGYBaXmGeGuGJ5fcc4OQzHISU8fVuQNGwiD8nyPa/0=";
+    hash = "sha256-YWA8chp33SkMdo+XT/7qikIkgwt8pozC9wMFpY8Dv8Q=";
   };
 
-  cargoSha256 = "sha256-gVXH2pFtyMfYkCqda9NrqOgczvmxiWHe0zArJfnnrgE=";
+  cargoHash = "sha256-DB3r6pPtustEQG8QXM6qT1hkd7msC//46bhVP/HMxnY=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/applications/audio/qmmp/default.nix b/pkgs/applications/audio/qmmp/default.nix
index 00931a21011c6..5712eacd2a2f6 100644
--- a/pkgs/applications/audio/qmmp/default.nix
+++ b/pkgs/applications/audio/qmmp/default.nix
@@ -5,16 +5,14 @@
 # input plugins
 , libmad, taglib, libvorbis, libogg, flac, libmpcdec, libmodplug, libsndfile
 , libcdio, cdparanoia, libcddb, faad2, ffmpeg, wildmidi, libbs2b, game-music-emu
+, libarchive, opusfile, soxr, wavpack
 # output plugins
-, alsa-lib, libpulseaudio, pipewire
+, alsa-lib, libpulseaudio, pipewire, libjack2
 # effect plugins
 , libsamplerate
 }:
 
 # Additional plugins that can be added:
-#  wavpack (https://www.wavpack.com/)
-#  Ogg Opus support
-#  JACK audio support
 #  ProjectM visualization plugin
 
 # To make MIDI work we must tell Qmmp what instrument configuration to use (and
@@ -45,8 +43,9 @@ stdenv.mkDerivation rec {
       # input plugins
       libmad taglib libvorbis libogg flac libmpcdec libmodplug libsndfile
       libcdio cdparanoia libcddb faad2 ffmpeg wildmidi libbs2b game-music-emu
+      libarchive opusfile soxr wavpack
       # output plugins
-      alsa-lib libpulseaudio pipewire
+      alsa-lib libpulseaudio pipewire libjack2
       # effect plugins
       libsamplerate
     ];
diff --git a/pkgs/applications/audio/strawberry/default.nix b/pkgs/applications/audio/strawberry/default.nix
index eeed1e1837cde..8f3eef1cdbfe1 100644
--- a/pkgs/applications/audio/strawberry/default.nix
+++ b/pkgs/applications/audio/strawberry/default.nix
@@ -42,13 +42,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "strawberry";
-  version = "1.0.14";
+  version = "1.0.15";
 
   src = fetchFromGitHub {
     owner = "jonaski";
     repo = pname;
     rev = version;
-    hash = "sha256-ThfycS5yNpp6+mE33qPqEWlhSB3OIF7d/t2XvI+rF2E=";
+    hash = "sha256-P7M7UIRFr0pABNhb63pV3TqIdTP8Xox4f0BT2ii9rRE=";
   };
 
   # the big strawberry shown in the context menu is *very* much in your face, so use the grey version instead
diff --git a/pkgs/applications/audio/tageditor/default.nix b/pkgs/applications/audio/tageditor/default.nix
index 47c6a32ad1f23..b79e9c217e51e 100644
--- a/pkgs/applications/audio/tageditor/default.nix
+++ b/pkgs/applications/audio/tageditor/default.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation rec {
   pname = "tageditor";
-  version = "3.7.7";
+  version = "3.7.8";
 
   src = fetchFromGitHub {
     owner = "martchus";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-CjbV/Uwpe+x7LBDUDY+NRonUt549MrjGnlJ2olIrKQ4=";
+    hash = "sha256-/34KS6nxpIsKEklSRpO+AmGAdpJhapoGe24DCCodU38=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/editors/cudatext/default.nix b/pkgs/applications/editors/cudatext/default.nix
index 08e6d7ea447e9..5ff9dd593e579 100644
--- a/pkgs/applications/editors/cudatext/default.nix
+++ b/pkgs/applications/editors/cudatext/default.nix
@@ -38,13 +38,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "cudatext";
-  version = "1.186.2";
+  version = "1.187.0";
 
   src = fetchFromGitHub {
     owner = "Alexey-T";
     repo = "CudaText";
     rev = version;
-    hash = "sha256-qpxYzman93e+u0BHxdhBUyfnZOR4hjQpTuNikGDNQCA=";
+    hash = "sha256-Ri/VTJF59GCJdhbMWRAYaQifj7FjVYSACywpq8gHKXg=";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/editors/cudatext/deps.json b/pkgs/applications/editors/cudatext/deps.json
index 86854afd48285..85cefe1444637 100644
--- a/pkgs/applications/editors/cudatext/deps.json
+++ b/pkgs/applications/editors/cudatext/deps.json
@@ -11,18 +11,18 @@
   },
   "ATFlatControls": {
     "owner": "Alexey-T",
-    "rev": "2023.02.05",
-    "hash": "sha256-ZOnIhUnFd+7mBEz6YIhUOQkhBbCNeTFD0tfUILuC1x4="
+    "rev": "2023.03.10",
+    "hash": "sha256-RHNWJN+P3w67UupeikHn6GrWZCOSoGCrP7BYG7myx+A="
   },
   "ATSynEdit": {
     "owner": "Alexey-T",
-    "rev": "2023.03.02",
-    "hash": "sha256-rZzcWED8c68wtejUho71kbPtLyDyOlXpS/eg8Ti0r2A="
+    "rev": "2023.03.10",
+    "hash": "sha256-NdLg/cQNy5SaC/zPb3bLplUe6FiO7ePi1++WDIvQziI="
   },
   "ATSynEdit_Cmp": {
     "owner": "Alexey-T",
-    "rev": "2022.10.18",
-    "hash": "sha256-yaS1XF0v5rkfKj9aksSc4XimKh5wpL7yLt4ElcIKAIE="
+    "rev": "2023.03.10",
+    "hash": "sha256-KfzTO0GMFkWRFxbRSdKAh4sr7cx7A2snj/UO1nsvacI="
   },
   "EControl": {
     "owner": "Alexey-T",
diff --git a/pkgs/applications/emulators/box64/default.nix b/pkgs/applications/emulators/box64/default.nix
index 12c13bb9ae87d..38ff3db999f6a 100644
--- a/pkgs/applications/emulators/box64/default.nix
+++ b/pkgs/applications/emulators/box64/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , gitUpdater
 , cmake
 , python3
@@ -16,24 +15,15 @@ assert withDynarec -> stdenv.hostPlatform.isAarch64;
 
 stdenv.mkDerivation rec {
   pname = "box64";
-  version = "0.2.0";
+  version = "0.2.2";
 
   src = fetchFromGitHub {
     owner = "ptitSeb";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-eMp2eSWMRJQvLRQKUirBua6Kt7ZtyebfUnKIlibkNFU=";
+    hash = "sha256-aIvL0H0k0/lz2lCLxB17RxNm0cxVozYthy0z85/FuUE=";
   };
 
-  patches = [
-    # Fix mmx & cppThreads tests on x86_64
-    # Remove when version > 0.2.0
-    (fetchpatch {
-      url = "https://github.com/ptitSeb/box64/commit/3819aecf078fcf47b2bc73713531361406a51895.patch";
-      hash = "sha256-11hy5Ol5FSE/kNJmXAIwNLbapldhlZGKtOLIoL6pYrg=";
-    })
-  ];
-
   nativeBuildInputs = [
     cmake
     python3
diff --git a/pkgs/applications/emulators/proton-caller/default.nix b/pkgs/applications/emulators/proton-caller/default.nix
index 4b5da92d1d611..e0fd948eb8666 100644
--- a/pkgs/applications/emulators/proton-caller/default.nix
+++ b/pkgs/applications/emulators/proton-caller/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "proton-caller";
-  version = "3.1.1";
+  version = "3.1.2";
 
   src = fetchFromGitHub {
     owner = "caverym";
     repo = pname;
     rev = version;
-    sha256 = "sha256-fN/8woLkTFD0aGILwweHhpey3cGQw2NolvpOmdkEEGA=";
+    sha256 = "sha256-srzahBMihkEP9/+7oRij5POHkCcH6QBh4kGz42Pz0nM=";
   };
 
-  cargoSha256 = "sha256-2zczu9MtsDDbfjbmLXCiPJrxNoNNBN0KAGeN+a53SRg=";
+  cargoHash = "sha256-LBXCcFqqscCGgtTzt/gr7Lz0ExT9kAWrXPuPuKzKt0E=";
 
   meta = with lib; {
     description = "Run Windows programs with Proton";
diff --git a/pkgs/applications/misc/dunst/default.nix b/pkgs/applications/misc/dunst/default.nix
index 24bfaf785e1f8..18110a07c3743 100644
--- a/pkgs/applications/misc/dunst/default.nix
+++ b/pkgs/applications/misc/dunst/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "dunst";
-  version = "1.9.0";
+  version = "1.9.1";
 
   src = fetchFromGitHub {
     owner = "dunst-project";
     repo = "dunst";
     rev = "v${version}";
-    sha256 = "sha256-fRPhu+kpwLPvdzIpXSjXFzQTfv4xewOMv/1ZqLJw3dk=";
+    sha256 = "sha256-oCeC/rbI/sydcQ7Rv9feEzw2Gcl7mUde4OOv50dyUSg=";
   };
 
   nativeBuildInputs = [ perl pkg-config which systemd makeWrapper ];
diff --git a/pkgs/applications/misc/pe-bear/default.nix b/pkgs/applications/misc/pe-bear/default.nix
index 06642f7e496a4..a50b53378e7dc 100644
--- a/pkgs/applications/misc/pe-bear/default.nix
+++ b/pkgs/applications/misc/pe-bear/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pe-bear";
-  version = "0.6.5";
+  version = "0.6.5.2";
 
   src = fetchFromGitHub {
     owner = "hasherezade";
     repo = "pe-bear";
     rev = "v${version}";
-    sha256 = "sha256-qFEfrXX2Rpmo4eF1Z/dKBN/NxMovK3mDfQPxYp85eB8=";
+    sha256 = "sha256-00OebZZUUwQ1yruTKEUj+bNEKY/CuzdLEbejnnagPnY=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/networking/cluster/kluctl/default.nix b/pkgs/applications/networking/cluster/kluctl/default.nix
index 6df6b472a4288..755209adc94c5 100644
--- a/pkgs/applications/networking/cluster/kluctl/default.nix
+++ b/pkgs/applications/networking/cluster/kluctl/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "kluctl";
-  version = "2.19.2";
+  version = "2.19.3";
 
   src = fetchFromGitHub {
     owner = "kluctl";
     repo = "kluctl";
     rev = "v${version}";
-    hash = "sha256-7+hXjYaCqInhP3O8IS8IwkUTGhnmcIWRR1qqvA6UQoc=";
+    hash = "sha256-yp471eWrwnJiCAVwqnZzq1rN1Mt4d42ymVvsUtTyOsc=";
   };
 
-  vendorHash = "sha256-xBUrY8v4yHtWGaaRXHxQRGdZHzMGoJX2hFLL+0Vb1QY=";
+  vendorHash = "sha256-Ws0Qaw2hk8alOF/K5Wd0ZcMGr6Q3JiQIo/kHOXiGvmg=";
 
   ldflags = [ "-s" "-w" "-X main.version=v${version}" ];
 
diff --git a/pkgs/applications/networking/cluster/kubebuilder/default.nix b/pkgs/applications/networking/cluster/kubebuilder/default.nix
index c2818505a8099..0b38759af9f72 100644
--- a/pkgs/applications/networking/cluster/kubebuilder/default.nix
+++ b/pkgs/applications/networking/cluster/kubebuilder/default.nix
@@ -12,13 +12,13 @@
 
 buildGoModule rec {
   pname = "kubebuilder";
-  version = "3.9.0";
+  version = "3.9.1";
 
   src = fetchFromGitHub {
     owner = "kubernetes-sigs";
     repo = "kubebuilder";
     rev = "v${version}";
-    hash = "sha256-AT7BrLVe5sSqAnQyhrkDktxVhuh1e0o5eB8oWWVbL8Q=";
+    hash = "sha256-sX+MYMZTRJ3udCtW3yeGBlYpJV35UDQwtcgi7/pXhek=";
   };
 
   vendorHash = "sha256-wxKEywUs5ezeOlIRT2k3C4G0XaX6h1ORt9/G6+FzVic=";
diff --git a/pkgs/applications/networking/cluster/kubelogin-oidc/default.nix b/pkgs/applications/networking/cluster/kubelogin-oidc/default.nix
index 1b1dc175d3c41..7dcd1b3297e80 100644
--- a/pkgs/applications/networking/cluster/kubelogin-oidc/default.nix
+++ b/pkgs/applications/networking/cluster/kubelogin-oidc/default.nix
@@ -2,18 +2,18 @@
 
 buildGoModule rec {
   pname = "kubelogin";
-  version = "1.26.0";
+  version = "1.27.0";
 
   src = fetchFromGitHub {
     owner = "int128";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-A8J381KNhQbWZ+68P8+1xj/lEEc/+YiJ80LqRQatdFQ=";
+    sha256 = "sha256-oBgth4lAQP4UrFIk/AErlfyyCgPrugs5wQJDFxqGum0=";
   };
 
   subPackages = ["."];
 
-  vendorSha256 = "sha256-V+O3yFxGJTcFETD2qYOurQUbME5NvRNQTr43OkxXFFE=";
+  vendorHash = "sha256-IJCbh1ryyk0r72SrVEiI7K5nIFf1+UGjTkXaNKpGsmo=";
 
   # Rename the binary instead of symlinking to avoid conflict with the
   # Azure version of kubelogin
diff --git a/pkgs/applications/networking/cluster/roxctl/default.nix b/pkgs/applications/networking/cluster/roxctl/default.nix
index 5ef93e307cfba..971f43117e89c 100644
--- a/pkgs/applications/networking/cluster/roxctl/default.nix
+++ b/pkgs/applications/networking/cluster/roxctl/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "roxctl";
-  version = "3.73.2";
+  version = "3.73.3";
 
   src = fetchFromGitHub {
     owner = "stackrox";
     repo = "stackrox";
     rev = version;
-    sha256 = "sha256-5MMSQy7SUFZhUycv1Kfkz46aY2tMldNZOH63wlQjq6o=";
+    sha256 = "sha256-ri4ir5mOfefB23gVk+XltXNYEz1jMoIVbJ5b0sS444k=";
   };
 
   vendorHash = "sha256-YRNOOn/Ei0rHLZrTtQxlBBn48pePDHllnI65Iil160k=";
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 96f5cb2a168cc..529602f2defb9 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -128,11 +128,11 @@
     "vendorHash": null
   },
   "azurerm": {
-    "hash": "sha256-PvlW3BB2ZATZA18nOGgxMSWzjC8YIjUY9ofw7XwnbmU=",
+    "hash": "sha256-XcqBkb+de+ikNtrDe33OZHhhv6ed2pXhbXXb7L661RI=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/azurerm",
     "owner": "hashicorp",
     "repo": "terraform-provider-azurerm",
-    "rev": "v3.46.0",
+    "rev": "v3.47.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -467,11 +467,11 @@
     "vendorHash": "sha256-fqVBnAivVekV+4tpkl+E6eNA3wi8mhLevJRCs3W7L2g="
   },
   "grafana": {
-    "hash": "sha256-b6vmtr2eHm7YNhRHS96+l6BLHYHgixR8Pw7/jK0tRPI=",
+    "hash": "sha256-2Ig0ZwU9ZzsfAq5XCFMvL1NCmfnhVjoIrgl74hQypGE=",
     "homepage": "https://registry.terraform.io/providers/grafana/grafana",
     "owner": "grafana",
     "repo": "terraform-provider-grafana",
-    "rev": "v1.36.0",
+    "rev": "v1.36.1",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-zPO+TbJsFrgfjSaSrX5YRop/0LDDw/grNNntaIGiBU0="
   },
@@ -540,11 +540,11 @@
     "vendorHash": "sha256-rxh8Me+eOKPCbfHFT3tRsbM7JU67dBqv2JOiWArI/2Y="
   },
   "huaweicloud": {
-    "hash": "sha256-x/5jt31yPTJRHSHRZqSrrjNdERWho6l71jvS7x6dR0c=",
+    "hash": "sha256-5Yw1b7tuGg8tDL1rQhqgFMTgtvc2k0n45dR5xvr7Dmo=",
     "homepage": "https://registry.terraform.io/providers/huaweicloud/huaweicloud",
     "owner": "huaweicloud",
     "repo": "terraform-provider-huaweicloud",
-    "rev": "v1.45.0",
+    "rev": "v1.45.1",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -648,13 +648,13 @@
     "vendorHash": null
   },
   "launchdarkly": {
-    "hash": "sha256-7m5+Fu9UjmGWL4PgYCpI9vMStfmU4oQ1cx+7wAirEbQ=",
+    "hash": "sha256-zi4GzbQmvvfxQ5vL4FbVkqUcwm7Y4ET8GFeIc/LipTY=",
     "homepage": "https://registry.terraform.io/providers/launchdarkly/launchdarkly",
     "owner": "launchdarkly",
     "repo": "terraform-provider-launchdarkly",
-    "rev": "v2.11.0",
+    "rev": "v2.12.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-j8Lit22aWeLvYrq5ao0nIdcVZDSxaAKaW+bxQ/JCSgE="
+    "vendorHash": "sha256-Fb2k493XTePXgpCY9ZoMWaCZqq3fx3A2dBRsOp1MDBc="
   },
   "libvirt": {
     "hash": "sha256-VO9fbRLz7mDYT8WORodnN4l3II2j+TdpV8cZ9M+NjTM=",
@@ -820,13 +820,13 @@
     "vendorHash": null
   },
   "okta": {
-    "hash": "sha256-3Ym2Q3Y2f26ioiB3N2HZiPsrgVe4zszJDR7e0gzxOHU=",
+    "hash": "sha256-O4ZTGYM9r3XFzr2Nx/Tt2Fs7WOqQuQWfo+ZMmZyg+mo=",
     "homepage": "https://registry.terraform.io/providers/okta/okta",
     "owner": "okta",
     "repo": "terraform-provider-okta",
-    "rev": "v3.43.0",
+    "rev": "v3.44.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-7jA44ZcBGCeLrr+On8F9er+ch2qf6vbijTRtu+aHrB4="
+    "vendorHash": "sha256-KYOzbbBjE2C7+1St62rs9mlJFhpIlWQJ0reh5V5tQsk="
   },
   "oktaasa": {
     "hash": "sha256-2LhxgowqKvDDDOwdznusL52p2DKP+UiXALHcs9ZQd0U=",
@@ -883,11 +883,11 @@
     "vendorHash": null
   },
   "pagerduty": {
-    "hash": "sha256-9aIYGmcbDgSZqtldLBMRjD0qKJZ3USuwNBpK3bvGrFY=",
+    "hash": "sha256-FHGoaWJQ3HRtY/LNCTX+L+jgYMPKkefjpbtfzMVbPQw=",
     "homepage": "https://registry.terraform.io/providers/PagerDuty/pagerduty",
     "owner": "PagerDuty",
     "repo": "terraform-provider-pagerduty",
-    "rev": "v2.11.1",
+    "rev": "v2.11.2",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -964,11 +964,11 @@
     "vendorHash": null
   },
   "scaleway": {
-    "hash": "sha256-4xHPQFmOAqEpqfJ6ng5z3wcuNZF8jNqu+4ZNJNxaBaI=",
+    "hash": "sha256-aWn/w7k+gxCodN7W9GBM9Ontkg6Ir2LNLYkY34ORxzI=",
     "homepage": "https://registry.terraform.io/providers/scaleway/scaleway",
     "owner": "scaleway",
     "repo": "terraform-provider-scaleway",
-    "rev": "v2.13.0",
+    "rev": "v2.13.1",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-kh1wv7cuWCC1rP0WBQW95pFg53gZTakqGoMIDMDSmt0="
   },
diff --git a/pkgs/applications/science/biology/diamond/default.nix b/pkgs/applications/science/biology/diamond/default.nix
index 2b34f61ab2cfb..c81cc35ff08e9 100644
--- a/pkgs/applications/science/biology/diamond/default.nix
+++ b/pkgs/applications/science/biology/diamond/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "diamond";
-  version = "2.1.4";
+  version = "2.1.5";
 
   src = fetchFromGitHub {
     owner = "bbuchfink";
     repo = "diamond";
     rev = "v${version}";
-    sha256 = "sha256-Og1cxEMJ24cncNDD2dXwy58OZ/nJmGdqrMRr5Y6YmHo=";
+    sha256 = "sha256-ud11GNuDL1HDNaAzkNB/ebuPJR4wgWYy49zBr93BtSo=";
   };
 
 
diff --git a/pkgs/applications/version-management/gitlint/default.nix b/pkgs/applications/version-management/gitlint/default.nix
index d32de426fefa5..f03de45890580 100644
--- a/pkgs/applications/version-management/gitlint/default.nix
+++ b/pkgs/applications/version-management/gitlint/default.nix
@@ -7,21 +7,16 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "gitlint";
-  version = "0.19.0";
+  version = "0.19.1";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "jorisroovers";
     repo = "gitlint";
-    rev = "v${version}";
-    sha256 = "sha256-w4v6mcjCX0V3Mj1K23ErpXdyEKQcA4vykns7UwNBEZ4=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-4SGkkC4LjZXTDXwK6jMOIKXR1qX76CasOwSqv8XUrjs=";
   };
 
-  patches = [
-    # otherwise hatch tries to run git to collect some metadata about the build
-    ./dont-try-to-use-git.diff
-  ];
-
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
 
   # Upstream splitted the project into gitlint and gitlint-core to
@@ -51,6 +46,7 @@ python3.pkgs.buildPythonApplication rec {
   meta = with lib; {
     description = "Linting for your git commit messages";
     homepage = "https://jorisroovers.com/gitlint/";
+    changelog = "https://github.com/jorisroovers/gitlint/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ ethancedwards8 fab ];
   };
diff --git a/pkgs/applications/version-management/gitlint/dont-try-to-use-git.diff b/pkgs/applications/version-management/gitlint/dont-try-to-use-git.diff
deleted file mode 100644
index 4d52cb57736ff..0000000000000
--- a/pkgs/applications/version-management/gitlint/dont-try-to-use-git.diff
+++ /dev/null
@@ -1,14 +0,0 @@
---- a/pyproject.toml
-+++ b/pyproject.toml
-@@ -61,10 +63,3 @@ include = [
- exclude = [
-     "/gitlint/tests", #
- ]
--
--[tool.hatch.metadata.hooks.vcs.urls]
--Homepage = "https://jorisroovers.github.io/gitlint"
--Documentation = "https://jorisroovers.github.io/gitlint"
--Source = "https://github.com/jorisroovers/gitlint/tree/main/gitlint-core"
--Changelog = "https://github.com/jorisroovers/gitlint/blob/main/CHANGELOG.md"
--'Source Commit' = "https://github.com/jorisroovers/gitlint/tree/{commit_hash}/gitlint-core"
-\ No newline at end of file
diff --git a/pkgs/applications/version-management/glab/default.nix b/pkgs/applications/version-management/glab/default.nix
index a789a35f7a5d7..09e5525e22c35 100644
--- a/pkgs/applications/version-management/glab/default.nix
+++ b/pkgs/applications/version-management/glab/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "glab";
-  version = "1.25.3";
+  version = "1.26.0";
 
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "cli";
     rev = "v${version}";
-    hash = "sha256-x/VH6cRrJZ2t2iftBPC86FcgIwjRNzV11MwLG2y+Paw=";
+    hash = "sha256-k0wkHw12MyVsAudaihoymGkP4y5y98cR7LKa+hEC1Mc=";
   };
 
   vendorHash = "sha256-FZ1CiR8Rj/sMoCnQm6ArGQfRTlvmD14EZDmufnlTSTk=";
diff --git a/pkgs/applications/virtualization/colima/default.nix b/pkgs/applications/virtualization/colima/default.nix
index 9e5372dce5ce2..47da9a3c7b25a 100644
--- a/pkgs/applications/virtualization/colima/default.nix
+++ b/pkgs/applications/virtualization/colima/default.nix
@@ -17,13 +17,13 @@
 
 buildGoModule rec {
   pname = "colima";
-  version = "0.5.3";
+  version = "0.5.4";
 
   src = fetchFromGitHub {
     owner = "abiosoft";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-uAstW+LzgT+xEJf4WNVSZsWtE50RU/rRpC7mkkFMIJU=";
+    sha256 = "sha256-oCYHQFajtZXVAVeJ8zvJABlmwmOUgisvVg9eLT7wd0M=";
     # We need the git revision
     leaveDotGit = true;
     postFetch = ''
diff --git a/pkgs/applications/virtualization/nixpacks/default.nix b/pkgs/applications/virtualization/nixpacks/default.nix
index 695cd970b7bb7..861d4877e428f 100644
--- a/pkgs/applications/virtualization/nixpacks/default.nix
+++ b/pkgs/applications/virtualization/nixpacks/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "nixpacks";
-  version = "1.4.1";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "railwayapp";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-zxgNHzKXekZnk0OsHw30u4L9U2mIT/MryZuAQ2EBEYg=";
+    sha256 = "sha256-1IJboAy0GYgkysY84+wHHOulA/aiux7pgCtxfr0CFV8=";
   };
 
-  cargoHash = "sha256-tsGyrU/5yp5PJ2d5HUoaw/jhGgYyDt6qBK+DvC79kmY=";
+  cargoHash = "sha256-kAou5pPOwbOZ9n8+fQJ4+Hh9x7wrY898R5XTuUEvF2o=";
 
   # skip test due FHS dependency
   doCheck = false;
diff --git a/pkgs/applications/window-managers/weston/default.nix b/pkgs/applications/window-managers/weston/default.nix
index 9886fc97af149..49a18187d76c6 100644
--- a/pkgs/applications/window-managers/weston/default.nix
+++ b/pkgs/applications/window-managers/weston/default.nix
@@ -6,6 +6,7 @@
 , pipewire ? null, pango ? null, libunwind ? null, freerdp ? null, vaapi ? null
 , libva ? null, libwebp ? null, xwayland ? null
 # beware of null defaults, as the parameters *are* supplied by callPackage by default
+, buildDemo ? false
 }:
 
 stdenv.mkDerivation rec {
@@ -32,7 +33,7 @@ stdenv.mkDerivation rec {
     "-Dremoting=false" # TODO
     "-Dpipewire=${lib.boolToString (pipewire != null)}"
     "-Dimage-webp=${lib.boolToString (libwebp != null)}"
-    "-Ddemo-clients=false"
+    (lib.mesonBool "demo-clients" buildDemo)
     "-Dsimple-clients="
     "-Dtest-junit-xml=false"
     # TODO:
diff --git a/pkgs/build-support/fetchpatch/default.nix b/pkgs/build-support/fetchpatch/default.nix
index d059715cedc1e..a3ca6685147d3 100644
--- a/pkgs/build-support/fetchpatch/default.nix
+++ b/pkgs/build-support/fetchpatch/default.nix
@@ -8,6 +8,7 @@
 
 { relative ? null
 , stripLen ? 0
+, decode ? "cat" # custom command to decode patch e.g. base64 -d
 , extraPrefix ? null
 , excludes ? []
 , includes ? []
@@ -36,6 +37,17 @@ fetchurl ({
       exit 1
     fi
 
+    set +e
+    ${decode} < "$out" > "$tmpfile"
+    if [ $? -ne 0 ] || [ ! -s "$tmpfile" ]; then
+        echo 'Failed to decode patch with command "'${lib.escapeShellArg decode}'"' >&2
+        echo 'Fetched file was (limited to 128 bytes):' >&2
+        od -A x -t x1z -v -N 128 "$out" >&2
+        exit 1
+    fi
+    set -e
+    mv "$tmpfile" "$out"
+
     "${patchutils}/bin/lsdiff" \
       ${lib.optionalString (relative != null) "-p1 -i ${lib.escapeShellArg relative}/'*'"} \
       "$out" \
@@ -76,5 +88,6 @@ fetchurl ({
     mv "$tmpfile" "$out"
   '' + postFetch;
 } // builtins.removeAttrs args [
-  "relative" "stripLen" "extraPrefix" "excludes" "includes" "revert" "postFetch"
+  "relative" "stripLen" "decode" "extraPrefix" "excludes" "includes" "revert"
+  "postFetch"
 ])
diff --git a/pkgs/build-support/fetchpatch/tests.nix b/pkgs/build-support/fetchpatch/tests.nix
index 38bbb8ba69d28..0a27f1bc70e7a 100644
--- a/pkgs/build-support/fetchpatch/tests.nix
+++ b/pkgs/build-support/fetchpatch/tests.nix
@@ -25,4 +25,11 @@ in
     revert = true;
     sha256 = if isFetchpatch2 then "sha256-+UKmEbr2rIAweCav/hR/7d4ZrYV84ht/domTrHtm8sM=" else "sha256-+UKmEbr2rIAweCav/hR/7d4ZrYV84ht/domTrHtm8sM=";
   };
+
+  decode = testers.invalidateFetcherByDrvHash fetchpatch {
+    name = "gcc.patch";
+    url = "https://chromium.googlesource.com/aosp/platform/external/libchrome/+/f37ae3b1a873d74182a2ac31d96742ead9c1f523^!?format=TEXT";
+    decode = "base64 -d";
+    sha256 = if isFetchpatch2 then "sha256-oMvPlmzE51ArI+EvFxONXkqmNee39106/O1ikG0Bdso=" else "sha256-SJHk8XrutqAyoIdORlhCpBCN626P+uzed7mjKz5eQYY=";
+  };
 }
diff --git a/pkgs/data/fonts/charis-sil/default.nix b/pkgs/data/fonts/charis-sil/default.nix
index 52c32fcc3d804..b4880fd218dec 100644
--- a/pkgs/data/fonts/charis-sil/default.nix
+++ b/pkgs/data/fonts/charis-sil/default.nix
@@ -2,11 +2,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "charis-sil";
-  version = "6.101";
+  version = "6.200";
 
   src = fetchzip {
     url = "https://software.sil.org/downloads/r/charis/CharisSIL-${version}.zip";
-    hash = "sha256-Rf5eKQVZw7zgTv6KkJUdNdd4sSJPdvjy/GDLusvlgzE=";
+    hash = "sha256-q451lec/l13Uanmr8K/C55Cr3avRvqQUkPK/ZZ1kgHo=";
   };
 
   installPhase = ''
diff --git a/pkgs/development/compilers/circt/default.nix b/pkgs/development/compilers/circt/default.nix
index 7bf6a64eeb84c..d868989470304 100644
--- a/pkgs/development/compilers/circt/default.nix
+++ b/pkgs/development/compilers/circt/default.nix
@@ -13,12 +13,12 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "circt";
-  version = "1.30.0";
+  version = "1.34.0";
   src = fetchFromGitHub {
     owner = "llvm";
     repo = "circt";
     rev = "firtool-${version}";
-    sha256 = "sha256-VP1QwY/gA8wxjpzbAlEV5r2Q8sTt3K2sGdKmxr6ndB8=";
+    sha256 = "sha256-QrCli0nNlvOM4taqWZ6GzK5luvXmyxaCgfDlXSRLSQA=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/interpreters/luau/default.nix b/pkgs/development/interpreters/luau/default.nix
index caeef615ff686..ad45dd299fbe6 100644
--- a/pkgs/development/interpreters/luau/default.nix
+++ b/pkgs/development/interpreters/luau/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "luau";
-  version = "0.563";
+  version = "0.567";
 
   src = fetchFromGitHub {
     owner = "Roblox";
     repo = "luau";
     rev = version;
-    hash = "sha256-aGduwwguzIg3kFspIa/5nDFAC836J3B10Pg63psuWto=";
+    hash = "sha256-x1P9/TZUU/XITH1/8NtPXzM46fwk0VxHNphlWqzhoog=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/interpreters/python/default.nix b/pkgs/development/interpreters/python/default.nix
index c4b95af92f284..70fd5c240df49 100644
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@@ -197,9 +197,9 @@ in {
       major = "3";
       minor = "12";
       patch = "0";
-      suffix = "a5";
+      suffix = "a6";
     };
-    hash = "sha256-1m73o0L+OjVvnO47uXrcHl+0hA9rbP994P991JX4Mjs=";
+    hash = "sha256-KYRAJSxLa04SDgFMFdcp6vird5MA3Mph1CLFN+ToXso=";
     inherit (darwin) configd;
     inherit passthruFun;
   };
diff --git a/pkgs/development/interpreters/ruby/default.nix b/pkgs/development/interpreters/ruby/default.nix
index 2bab78ecd4197..05184cd7d71e0 100644
--- a/pkgs/development/interpreters/ruby/default.nix
+++ b/pkgs/development/interpreters/ruby/default.nix
@@ -3,7 +3,7 @@
 , zlib, gdbm, ncurses, readline, groff, libyaml, libffi, jemalloc, autoreconfHook, bison
 , autoconf, libiconv, libobjc, libunwind, Foundation
 , buildEnv, bundler, bundix
-, makeWrapper, buildRubyGem, defaultGemConfig, removeReferencesTo
+, makeBinaryWrapper, buildRubyGem, defaultGemConfig, removeReferencesTo
 , openssl, openssl_1_1
 } @ args:
 
@@ -47,7 +47,7 @@ let
       , autoreconfHook, bison, autoconf
       , buildEnv, bundler, bundix
       , libiconv, libobjc, libunwind, Foundation
-      , makeWrapper, buildRubyGem, defaultGemConfig
+      , makeBinaryWrapper, buildRubyGem, defaultGemConfig
       , baseRuby ? buildPackages.ruby_3_1.override {
           useRailsExpress = false;
           docSupport = false;
@@ -272,7 +272,7 @@ let
           };
 
           inherit (import ../../ruby-modules/with-packages {
-            inherit lib stdenv makeWrapper buildRubyGem buildEnv;
+            inherit lib stdenv makeBinaryWrapper buildRubyGem buildEnv;
             gemConfig = defaultGemConfig;
             ruby = self;
           }) withPackages buildGems gems;
diff --git a/pkgs/development/libraries/boca/default.nix b/pkgs/development/libraries/boca/default.nix
index 2c86bf981b701..50023491d3a08 100644
--- a/pkgs/development/libraries/boca/default.nix
+++ b/pkgs/development/libraries/boca/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "BoCA";
-  version = "1.0.6a";
+  version = "1.0.7";
 
   src = fetchFromGitHub {
     owner = "enzo1982";
     repo = "boca";
     rev = "v${version}";
-    sha256 = "sha256-LndlwdM5NlTv73Z1lMkHuIZkVfn48P/LssBnE4X9Sgc=";
+    sha256 = "sha256-HIYUMFj5yiEC+liZLMXD9otPyoEb1sxHlECTYtYXc2I=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/g2o/default.nix b/pkgs/development/libraries/g2o/default.nix
index 0536ec95c6ff1..1140565eefc7e 100644
--- a/pkgs/development/libraries/g2o/default.nix
+++ b/pkgs/development/libraries/g2o/default.nix
@@ -3,13 +3,13 @@
 
 mkDerivation rec {
   pname = "g2o";
-  version = "20201223";
+  version = "20230223";
 
   src = fetchFromGitHub {
     owner = "RainerKuemmerle";
     repo = pname;
     rev = "${version}_git";
-    sha256 = "sha256-Ik6uBz4Z4rc5+mPNdT8vlNZSBom4Tvt8Y6myBC/s0m8=";
+    sha256 = "sha256-J2Z3oRkyiinIfywBQvnq1Q8Z5WuzQXOVTZTwN8oivf0=";
   };
 
   # Removes a reference to gcc that is only used in a debug message
@@ -20,9 +20,6 @@ mkDerivation rec {
   nativeBuildInputs = [ cmake makeWrapper ];
   buildInputs = [ eigen suitesparse blas lapack libGLU qtbase libqglviewer ];
 
-  # Silence noisy warning
-  CXXFLAGS = "-Wno-deprecated-copy";
-
   dontWrapQtApps = true;
 
   cmakeFlags = [
diff --git a/pkgs/development/libraries/hipsparse/default.nix b/pkgs/development/libraries/hipsparse/default.nix
index 0252c57aefc9b..769c6da0fa8fb 100644
--- a/pkgs/development/libraries/hipsparse/default.nix
+++ b/pkgs/development/libraries/hipsparse/default.nix
@@ -17,7 +17,7 @@
 # This can also use cuSPARSE as a backend instead of rocSPARSE
 stdenv.mkDerivation (finalAttrs: {
   pname = "hipsparse";
-  version = "5.4.2";
+  version = "5.4.3";
 
   outputs = [
     "out"
diff --git a/pkgs/development/libraries/httplib/default.nix b/pkgs/development/libraries/httplib/default.nix
index 3d0ef7740e7fb..e18808b753d6c 100644
--- a/pkgs/development/libraries/httplib/default.nix
+++ b/pkgs/development/libraries/httplib/default.nix
@@ -5,13 +5,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "httplib";
-  version = "0.12.0";
+  version = "0.12.1";
 
   src = fetchFromGitHub {
     owner = "yhirose";
     repo = "cpp-httplib";
     rev = "v${version}";
-    hash = "sha256-Qr8jaZSj5xPiTF8reur09/R2jrtDk5hxHKeVTccHbZQ=";
+    hash = "sha256-F0MXuScZP2kmyCWv+DVXOB9rRk2T7hMgum7Zbs8X7QI=";
   };
 
   # Header-only library.
diff --git a/pkgs/development/libraries/libheif/default.nix b/pkgs/development/libraries/libheif/default.nix
index 5d008f394e8f4..2257e3405e102 100644
--- a/pkgs/development/libraries/libheif/default.nix
+++ b/pkgs/development/libraries/libheif/default.nix
@@ -22,7 +22,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libheif";
-  version = "1.14.2";
+  version = "1.15.1";
 
   outputs = [ "bin" "out" "dev" "man" ];
 
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
     owner = "strukturag";
     repo = "libheif";
     rev = "v${version}";
-    sha256 = "sha256-JwPeSNUc++z6RfMe0qAuXdekzLWR/MCmsT+Ykvp9a/s=";
+    sha256 = "sha256-5908S46hEXhCYcTsqulmUnat0KOlXsnY5LI/l1l7/1Q=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/liblouis/default.nix b/pkgs/development/libraries/liblouis/default.nix
index b9b61214462ca..35824239047cf 100644
--- a/pkgs/development/libraries/liblouis/default.nix
+++ b/pkgs/development/libraries/liblouis/default.nix
@@ -11,9 +11,9 @@
 , perl
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "liblouis";
-  version = "3.24.0";
+  version = "3.25.0";
 
   outputs = [ "out" "dev" "info" "doc" ]
     # configure: WARNING: cannot generate manual pages while cross compiling
@@ -22,8 +22,8 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "liblouis";
     repo = "liblouis";
-    rev = "v${version}";
-    sha256 = "sha256-QSrCQhP3t+WPyBQPLJbZEaDCjXD8Lo6IAGKHsbL2S1o=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-On5PbBgvDAeD41oGb5EKBtKvi/VXnLsVrTMX7tcwnq4=";
   };
 
   nativeBuildInputs = [
@@ -63,7 +63,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Open-source braille translator and back-translator";
-    homepage = "https://liblouis.org/";
+    homepage = "https://liblouis.io/";
     license = with licenses; [
       lgpl21Plus # library
       gpl3Plus # tools
@@ -71,4 +71,4 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ jtojnar ];
     platforms = platforms.unix;
   };
-}
+})
diff --git a/pkgs/development/libraries/migraphx/default.nix b/pkgs/development/libraries/migraphx/default.nix
index 15581e00e528f..fc4ccec94ad6f 100644
--- a/pkgs/development/libraries/migraphx/default.nix
+++ b/pkgs/development/libraries/migraphx/default.nix
@@ -46,7 +46,7 @@ let
   };
 in stdenv.mkDerivation (finalAttrs: {
   pname = "migraphx";
-  version = "5.4.2";
+  version = "5.4.3";
 
   outputs = [
     "out"
diff --git a/pkgs/development/libraries/minizip-ng/default.nix b/pkgs/development/libraries/minizip-ng/default.nix
index 5f7dc56ed7f8b..4fc4974b0129d 100644
--- a/pkgs/development/libraries/minizip-ng/default.nix
+++ b/pkgs/development/libraries/minizip-ng/default.nix
@@ -14,30 +14,15 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "minizip-ng";
-  version = "3.0.7";
+  version = "3.0.8";
 
   src = fetchFromGitHub {
     owner = "zlib-ng";
     repo = finalAttrs.pname;
     rev = finalAttrs.version;
-    sha256 = "sha256-m/zSVx8vYzLA23Cusd1p/ZSGd1mV3gM6UqDnmEXqpq4=";
+    sha256 = "sha256-Vzp+5fQBJoO1pG7j8LwC2/B/cOgM/exhKyb3zHuy89Y=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "find-system-gtest.patch";
-      url = "https://github.com/zlib-ng/minizip-ng/commit/be23c8d3b7e2cb5ba619e60517cad277ee510fb7.patch";
-      sha256 = "sha256-azwrGj6kgTyTepGAmOlxDOFOwJKQE5J2bwUIn6sgKUY=";
-    })
-
-    # otherwise signing unit tests fail
-    (fetchpatch {
-      name = "disable-mz-signing-by-default.patch";
-      url = "https://github.com/zlib-ng/minizip-ng/commit/60649ada97581afc0bc2fffc50ce402ff1e6df5d.patch";
-      sha256 = "sha256-bHGM4H8RPYkfAjxcS1bPohR9IFOFT0Mx4Mg34UnnD+w=";
-    })
-  ];
-
   nativeBuildInputs = [ cmake pkg-config ];
   buildInputs = [ zlib bzip2 xz zstd openssl ];
 
diff --git a/pkgs/development/libraries/mlt/qt-5.nix b/pkgs/development/libraries/mlt/qt-5.nix
index c2d4e6aa56d84..b7a881548d38e 100644
--- a/pkgs/development/libraries/mlt/qt-5.nix
+++ b/pkgs/development/libraries/mlt/qt-5.nix
@@ -27,13 +27,13 @@
 
 mkDerivation rec {
   pname = "mlt";
-  version = "7.12.0";
+  version = "7.14.0";
 
   src = fetchFromGitHub {
     owner = "mltframework";
     repo = "mlt";
     rev = "v${version}";
-    sha256 = "sha256-Y7lbfwA0lkQB3PjYQIQaQ0BeXGcgyCmMnDqqZJ8zUaA=";
+    sha256 = "sha256-BmvgDj/zgGJNpTy5A9XPOl+9001Kc0qSFSqQ3gwZPmI=";
   };
 
   buildInputs = [
diff --git a/pkgs/development/libraries/muparserx/default.nix b/pkgs/development/libraries/muparserx/default.nix
index bdc558dc10292..c6b6c75c22d81 100644
--- a/pkgs/development/libraries/muparserx/default.nix
+++ b/pkgs/development/libraries/muparserx/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "muparserx";
-  version = "4.0.11";
+  version = "4.0.12";
 
   src = fetchFromGitHub {
     owner = "beltoforion";
     repo = "muparserx";
     rev = "v${version}";
-    sha256 = "sha256-BWzHlz1mQYsvWa53EtO05Rb4rRHJBSRguJTHLtgqpPw=";
+    sha256 = "sha256-rekPXmncNdVX6LvPQP1M2Pzs3pyiCCcLPLnPFiyWJ4s=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/presage/default.nix b/pkgs/development/libraries/presage/default.nix
index b3c3c21e3046b..8f7e15867099f 100644
--- a/pkgs/development/libraries/presage/default.nix
+++ b/pkgs/development/libraries/presage/default.nix
@@ -26,7 +26,8 @@ stdenv.mkDerivation rec {
 
   patches = [
     (fetchpatch {
-      url = "https://git.alpinelinux.org/aports/plain/community/presage/gcc6.patch";
+      name = "gcc6.patch";
+      url = "https://git.alpinelinux.org/aports/plain/community/presage/gcc6.patch?id=40e2044c9ecb36eacb3a1fd043f09548d210dc01";
       sha256 = "0243nx1ygggmsly7057vndb4pkjxg9rpay5gyqqrq9jjzjzh63dj";
     })
     ./fixed-cppunit-detection.patch
diff --git a/pkgs/development/libraries/qxmpp/default.nix b/pkgs/development/libraries/qxmpp/default.nix
index aede57810aa2f..2b14142e34be4 100644
--- a/pkgs/development/libraries/qxmpp/default.nix
+++ b/pkgs/development/libraries/qxmpp/default.nix
@@ -9,13 +9,13 @@
 
 mkDerivation rec {
   pname = "qxmpp";
-  version = "1.5.1";
+  version = "1.5.2";
 
   src = fetchFromGitHub {
     owner = "qxmpp-project";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-6iI+s+iSKK8TeocvyOxou7cF9ZXlWr5prUbPhoHOoSM=";
+    sha256 = "sha256-nwU0Iw3aLv4EyNdblTOQKcCYVYfK8i54c0piks4DoUo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/rapidjson/default.nix b/pkgs/development/libraries/rapidjson/default.nix
index b67824b5cc55b..f73e01b64764c 100644
--- a/pkgs/development/libraries/rapidjson/default.nix
+++ b/pkgs/development/libraries/rapidjson/default.nix
@@ -25,7 +25,8 @@ stdenv.mkDerivation rec {
       sha256 = "1qm62iad1xfsixv1li7qy475xc7gc04hmi2q21qdk6l69gk7mf82";
     })
     (fetchpatch {
-      url = "https://git.alpinelinux.org/aports/plain/community/rapidjson/do-not-include-gtest-src-dir.patch";
+      name = "do-not-include-gtest-src-dir.patch";
+      url = "https://git.alpinelinux.org/aports/plain/community/rapidjson/do-not-include-gtest-src-dir.patch?id=9e5eefc7a5fcf5938a8dc8a3be8c75e9e6809909";
       hash = "sha256-BjSZEwfCXA/9V+kxQ/2JPWbc26jQn35CfN8+8NW24s4=";
     })
   ];
diff --git a/pkgs/development/libraries/science/math/ipopt/default.nix b/pkgs/development/libraries/science/math/ipopt/default.nix
index c544436af8efa..e9ca26d23958e 100644
--- a/pkgs/development/libraries/science/math/ipopt/default.nix
+++ b/pkgs/development/libraries/science/math/ipopt/default.nix
@@ -12,13 +12,13 @@ assert (!blas.isILP64) && (!lapack.isILP64);
 
 stdenv.mkDerivation rec {
   pname = "ipopt";
-  version = "3.14.10";
+  version = "3.14.11";
 
   src = fetchFromGitHub {
     owner = "coin-or";
     repo = "Ipopt";
     rev = "releases/${version}";
-    sha256 = "sha256-4SHmqalrGeqp1nBx2BQLRnRWEYw5lJk5Yao67GQw3qM=";
+    sha256 = "sha256-PzNDiTZkPORFckFJryFuvn/rsfx3wrXJ9Qde88gH5o4=";
   };
 
   CXXDEFS = [ "-DHAVE_RAND" "-DHAVE_CSTRING" "-DHAVE_CSTDIO" ];
diff --git a/pkgs/development/libraries/simdjson/default.nix b/pkgs/development/libraries/simdjson/default.nix
index a44dc213f6ea6..ecd7bb39fe4a0 100644
--- a/pkgs/development/libraries/simdjson/default.nix
+++ b/pkgs/development/libraries/simdjson/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "simdjson";
-  version = "3.1.3";
+  version = "3.1.5";
 
   src = fetchFromGitHub {
     owner = "simdjson";
     repo = "simdjson";
     rev = "v${version}";
-    sha256 = "sha256-VDwpCPyjhkXgehcMJs6srD3PFtlC2m4jurJum6wNeVY=";
+    sha256 = "sha256-gBHgPKEeoryjMVL/EonmeY/7imcJej/Yj8ovPk/moTk=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/waffle/default.nix b/pkgs/development/libraries/waffle/default.nix
index 0fc513b68f46b..e2a90d2e284d9 100644
--- a/pkgs/development/libraries/waffle/default.nix
+++ b/pkgs/development/libraries/waffle/default.nix
@@ -17,14 +17,14 @@
 
 stdenv.mkDerivation rec {
   pname = "waffle";
-  version = "1.7.0";
+  version = "1.7.2";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "mesa";
     repo = "waffle";
     rev = "v${version}";
-    sha256 = "iY+dAgXutD/uDFocwd9QXjq502IOsk+3RQMA2S/CMV4=";
+    sha256 = "sha256-dwDNMLgZrILb559yGs4sNA7D+nD60972+JOy0PKfL0w=";
   };
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/datasette/default.nix b/pkgs/development/python-modules/datasette/default.nix
index 6781f82135512..7c6eafe3808cf 100644
--- a/pkgs/development/python-modules/datasette/default.nix
+++ b/pkgs/development/python-modules/datasette/default.nix
@@ -29,7 +29,7 @@
 
 buildPythonPackage rec {
   pname = "datasette";
-  version = "0.64.1";
+  version = "0.64.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -38,7 +38,7 @@ buildPythonPackage rec {
     owner = "simonw";
     repo = pname;
     rev = "refs/tags/${version}";
-    sha256 = "sha256-EXYAiXqEfQVDTwc4MFTroLPEaTZ3QYTlUsuNQ72oHpA=";
+    sha256 = "sha256-AxIJUJzFEAvAV59hYDB3pb5/1rS9d7T0ltl6lVWTCrE=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/django-ipware/default.nix b/pkgs/development/python-modules/django-ipware/default.nix
index ba8f1d79db8cc..9513a757673f3 100644
--- a/pkgs/development/python-modules/django-ipware/default.nix
+++ b/pkgs/development/python-modules/django-ipware/default.nix
@@ -1,12 +1,20 @@
-{ lib, buildPythonPackage, fetchPypi, django }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+, django
+, pythonOlder
+}:
 
 buildPythonPackage rec {
   pname = "django-ipware";
-  version = "4.0.2";
+  version = "5.0.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "602a58325a4808bd19197fef2676a0b2da2df40d0ecf21be414b2ff48c72ad05";
+    hash = "sha256-T6VgfuheEu5eFYvHVp/x4TT7FXloGqH/Pw7QS+Ib4VM=";
   };
 
   propagatedBuildInputs = [ django ];
@@ -20,6 +28,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "A Django application to retrieve user's IP address";
     homepage = "https://github.com/un33k/django-ipware";
+    changelog = "https://github.com/un33k/django-ipware/blob/v${version}/CHANGELOG.md";
     license = licenses.mit;
     maintainers = with maintainers; [ ];
   };
diff --git a/pkgs/development/python-modules/dkimpy/default.nix b/pkgs/development/python-modules/dkimpy/default.nix
index 9d294977ca70b..0d3021612bd16 100644
--- a/pkgs/development/python-modules/dkimpy/default.nix
+++ b/pkgs/development/python-modules/dkimpy/default.nix
@@ -3,11 +3,11 @@
 
 buildPythonPackage rec {
   pname = "dkimpy";
-  version = "1.1.0";
+  version = "1.1.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-NQDukEVLfCz3ElgeA5jrRwONJ+aRSDKd9jTs2Y3YYhw=";
+    sha256 = "sha256-dVl0S1qQGWkZCPCgxlPiBrbL9jbIxtZuGggnz8jsf5E=";
 };
 
   nativeCheckInputs = [ pytest ];
diff --git a/pkgs/development/python-modules/holidays/default.nix b/pkgs/development/python-modules/holidays/default.nix
index bab50ea617b3c..0110d038e64b4 100644
--- a/pkgs/development/python-modules/holidays/default.nix
+++ b/pkgs/development/python-modules/holidays/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "holidays";
-  version = "0.20";
+  version = "0.21";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "dr-prodigy";
     repo = "python-holidays";
     rev = "refs/tags/v.${version}";
-    hash = "sha256-hz0v4g94RMA1dKOLu4BSYnK5EPNl1hIWEShFJWO0F3A=";
+    hash = "sha256-acV/m4orkOEbON7C4ThGvaQtTMpp4c8FNesC7UepJFc=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/jenkins-job-builder/default.nix b/pkgs/development/python-modules/jenkins-job-builder/default.nix
index 49b7dd44c6039..e85ce03595163 100644
--- a/pkgs/development/python-modules/jenkins-job-builder/default.nix
+++ b/pkgs/development/python-modules/jenkins-job-builder/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "jenkins-job-builder";
-  version = "4.1.0";
+  version = "4.3.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-5jCltdomD4u5LZrYJFUHB/sLORXYuWoeJOalAci0+XQ=";
+    sha256 = "sha256-pvka8TLMEclzJ2Iw4iLSiR1ioV3frzQStLu21+kSSHI=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/peaqevcore/default.nix b/pkgs/development/python-modules/peaqevcore/default.nix
index fa762998489d3..f4c93a252bcff 100644
--- a/pkgs/development/python-modules/peaqevcore/default.nix
+++ b/pkgs/development/python-modules/peaqevcore/default.nix
@@ -6,14 +6,14 @@
 
 buildPythonPackage rec {
   pname = "peaqevcore";
-  version = "13.0.0";
+  version = "13.0.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-uQ5e85KHFaJCgpALFCYVs+nY0fZIE4UIYdNOn6VrIWM=";
+    hash = "sha256-2V0+F0S2i7paBDN8FmsT1wV4qdJ4XmkOyZ3EDfyjGks=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pydeconz/default.nix b/pkgs/development/python-modules/pydeconz/default.nix
index 3ccb8960f5ef8..a0d41e0a56a82 100644
--- a/pkgs/development/python-modules/pydeconz/default.nix
+++ b/pkgs/development/python-modules/pydeconz/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "pydeconz";
-  version = "108";
+  version = "110";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "Kane610";
     repo = "deconz";
     rev = "refs/tags/v${version}";
-    hash = "sha256-CPFkfVwvk0AO/DoE1Nj1jLdLvuOpRzndmRK/M6SSGtk=";
+    hash = "sha256-2eHKFq+urzJS3K55O0hca0h4ElowJZD6nIkYkzyBFCM=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/python-benedict/default.nix b/pkgs/development/python-modules/python-benedict/default.nix
index 446fbfcd9c9eb..c1c10cfc902e4 100644
--- a/pkgs/development/python-modules/python-benedict/default.nix
+++ b/pkgs/development/python-modules/python-benedict/default.nix
@@ -24,7 +24,7 @@
 
 buildPythonPackage rec {
   pname = "python-benedict";
-  version = "0.28.3";
+  version = "0.29.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -33,7 +33,7 @@ buildPythonPackage rec {
     owner = "fabiocaccamo";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-6gzmVOuJfNpNJlea4Am20HI98mgcKkwtU/28l7qg20Y=";
+    hash = "sha256-tsTd9EJkwI98ynXu/vz5hX+X55vxOkhIfeawQNn2f6Q=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/python-rapidjson/default.nix b/pkgs/development/python-modules/python-rapidjson/default.nix
index f2cd6d285b753..9cb3baf0663da 100644
--- a/pkgs/development/python-modules/python-rapidjson/default.nix
+++ b/pkgs/development/python-modules/python-rapidjson/default.nix
@@ -21,7 +21,8 @@ let
     };
     patches = [
       (fetchpatch {
-        url = "https://git.alpinelinux.org/aports/plain/community/rapidjson/do-not-include-gtest-src-dir.patch";
+        name = "do-not-include-gtest-src-dir.patch";
+        url = "https://git.alpinelinux.org/aports/plain/community/rapidjson/do-not-include-gtest-src-dir.patch?id=9e5eefc7a5fcf5938a8dc8a3be8c75e9e6809909";
         hash = "sha256-BjSZEwfCXA/9V+kxQ/2JPWbc26jQn35CfN8+8NW24s4=";
       })
     ];
diff --git a/pkgs/development/python-modules/unrardll/default.nix b/pkgs/development/python-modules/unrardll/default.nix
index f0a0cbbf17590..e6d746165144e 100644
--- a/pkgs/development/python-modules/unrardll/default.nix
+++ b/pkgs/development/python-modules/unrardll/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "unrardll";
-  version = "0.1.5";
+  version = "0.1.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "8bebb480b96cd49d4290d814914f39cff75cf0fa0514c4790bb32b1757227c78";
+    sha256 = "sha256-4QZ/4nu03iBO+PNpLyPZPF07QpL3iyksb8fcT3V0n3Y=";
   };
 
   buildInputs = [ unrar ];
diff --git a/pkgs/development/ruby-modules/with-packages/default.nix b/pkgs/development/ruby-modules/with-packages/default.nix
index 5be820b60e300..31573bce499fc 100644
--- a/pkgs/development/ruby-modules/with-packages/default.nix
+++ b/pkgs/development/ruby-modules/with-packages/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, buildEnv, buildRubyGem, ruby, gemConfig, makeWrapper }:
+{ stdenv, lib, buildEnv, buildRubyGem, ruby, gemConfig, makeBinaryWrapper }:
 
 /*
 Example usage:
@@ -43,7 +43,7 @@ let
 
       wrappedRuby = stdenv.mkDerivation {
         name = "wrapped-${ruby.name}";
-        nativeBuildInputs = [ makeWrapper ];
+        nativeBuildInputs = [ makeBinaryWrapper ];
         buildCommand = ''
           mkdir -p $out/bin
           for i in ${ruby}/bin/*; do
@@ -54,7 +54,7 @@ let
 
     in stdenv.mkDerivation {
       name = "${ruby.name}-with-packages";
-      nativeBuildInputs = [ makeWrapper ];
+      nativeBuildInputs = [ makeBinaryWrapper ];
       buildInputs = [ selected ruby ];
 
       dontUnpack = true;
diff --git a/pkgs/development/ruby-modules/with-packages/test.nix b/pkgs/development/ruby-modules/with-packages/test.nix
index ca2934b6f61c9..be652747c4699 100644
--- a/pkgs/development/ruby-modules/with-packages/test.nix
+++ b/pkgs/development/ruby-modules/with-packages/test.nix
@@ -15,6 +15,22 @@ let
       pkgs.ruby.gems) //
     (import ./require_exceptions.nix);
 
+  testWrapper = ruby: stdenv.mkDerivation {
+    name = "test-wrappedRuby-${ruby.name}";
+    buildInputs = [ ((ruby.withPackages (ps: [ ])).wrappedRuby) ];
+    buildCommand = ''
+      cat <<'EOF' > test-ruby
+      #!/usr/bin/env ruby
+      puts RUBY_VERSION
+      EOF
+
+      chmod +x test-ruby
+      patchShebangs test-ruby
+      [[ $(./test-ruby) = $(${ruby}/bin/ruby test-ruby) ]]
+      touch $out
+    '';
+  };
+
   tests = ruby:
     lib.mapAttrs (name: gem:
       let
@@ -39,7 +55,7 @@ let
 in
   stdenv.mkDerivation {
     name = "test-all-ruby-gems";
-    buildInputs = builtins.foldl' (sum: ruby: sum ++ ( builtins.attrValues (tests ruby) )) [] rubyVersions;
+    buildInputs = builtins.foldl' (sum: ruby: sum ++ [ (testWrapper ruby) ] ++ ( builtins.attrValues (tests ruby) )) [] rubyVersions;
     buildCommand = ''
       touch $out
     '';
diff --git a/pkgs/development/tools/altair-graphql-client/default.nix b/pkgs/development/tools/altair-graphql-client/default.nix
index 312afa557ddd9..0ff47dae38f0c 100644
--- a/pkgs/development/tools/altair-graphql-client/default.nix
+++ b/pkgs/development/tools/altair-graphql-client/default.nix
@@ -2,11 +2,11 @@
 
 let
   pname = "altair";
-  version = "5.0.14";
+  version = "5.0.17";
 
   src = fetchurl {
     url = "https://github.com/imolorhe/altair/releases/download/v${version}/altair_${version}_x86_64_linux.AppImage";
-    sha256 = "sha256-gd7aSBNhTO1ira76lL+1apLlXYXRfGWAbGAsJEUtEqw=";
+    sha256 = "sha256-UX7WqQt5inVldrXG3bIVmR8ucCvbHdyVLgQ/srhpCak=";
   };
 
   appimageContents = appimageTools.extract { inherit pname version src; };
diff --git a/pkgs/development/tools/buf/default.nix b/pkgs/development/tools/buf/default.nix
index c5561b9b666f8..fdf763efb26a1 100644
--- a/pkgs/development/tools/buf/default.nix
+++ b/pkgs/development/tools/buf/default.nix
@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "buf";
-  version = "1.15.0";
+  version = "1.15.1";
 
   src = fetchFromGitHub {
     owner = "bufbuild";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-63JWRyB586klWSQskBY/fDRTdXrQa15IygdZfmHpEqM=";
+    hash = "sha256-XiB8ZlbtzU66abM9zJotaMCrbYScqWmDv4ulEeQS6+g=";
   };
 
-  vendorHash = "sha256-XRv8AnktIPR1emRdRMmDwOh7r3kNByy0REwZbg3NYPc=";
+  vendorHash = "sha256-bQKpy5xjUItgQ79r8TrMUOjo0Ze9E25glvOv312W1k0=";
 
   patches = [
     # Skip a test that requires networking to be available to work.
diff --git a/pkgs/development/tools/continuous-integration/github-runner/default.nix b/pkgs/development/tools/continuous-integration/github-runner/default.nix
index 8c4e52b22bb05..36931247d1292 100644
--- a/pkgs/development/tools/continuous-integration/github-runner/default.nix
+++ b/pkgs/development/tools/continuous-integration/github-runner/default.nix
@@ -21,7 +21,7 @@ buildDotnetModule rec {
     owner = "actions";
     repo = "runner";
     rev = "v${version}";
-    hash = "sha256-bzCa3OI8/pE8K9U38RN0xWbLkjJPA4mUlsrbH1etpG4=";
+    hash = "sha256-gGIYlYM4Rf7Ils2rThsQHWIkLDt5Htg4NDuJhxvl1rU=";
     # Required to obtain HEAD's Git commit hash
     leaveDotGit = true;
   };
diff --git a/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix b/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix
index 9a101323fb38d..6dad681809daf 100644
--- a/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix
+++ b/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix
@@ -1,7 +1,7 @@
 { lib, buildGoModule, fetchFromGitLab, fetchurl, bash }:
 
 let
-  version = "15.9.0";
+  version = "15.9.1";
 in
 buildGoModule rec {
   inherit version;
@@ -23,7 +23,7 @@ buildGoModule rec {
     owner = "gitlab-org";
     repo = "gitlab-runner";
     rev = "v${version}";
-    sha256 = "sha256-wdeH1/1FNG1vwmSmXo7KjhxfQTmQk9lNAxVNoUKlLi4=";
+    sha256 = "sha256-J8wcTU2bilhEKwOAVgaJk743b66TLndYOxc1k+S/cBg=";
   };
 
   patches = [
diff --git a/pkgs/development/tools/database/dbmate/default.nix b/pkgs/development/tools/database/dbmate/default.nix
index baa7ebf562038..385be71d82a52 100644
--- a/pkgs/development/tools/database/dbmate/default.nix
+++ b/pkgs/development/tools/database/dbmate/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "dbmate";
-  version = "1.16.2";
+  version = "2.0.1";
 
   src = fetchFromGitHub {
     owner = "amacneil";
     repo = "dbmate";
     rev = "v${version}";
-    sha256 = "sha256-5hjAP2+0hbYcA9G7YJyRqqp1ZC8LzFDomjeFjl4z4FY=";
+    sha256 = "sha256-zARaxjzVTi90BkwPOyfGYk3mBHRoAGMOe2LPlJB4Mvo=";
   };
 
-  vendorHash = "sha256-7fC1jJMY/XK+GX5t2/o/k+EjFxAlRAmiemMcWaZhL9o=";
+  vendorHash = "sha256-NZ2HVFViU8Vzwyo33cueNJwdCT4exZlB7g4WgoWKZBE=";
 
   doCheck = false;
 
diff --git a/pkgs/development/tools/kafkactl/default.nix b/pkgs/development/tools/kafkactl/default.nix
index 750e93f66557a..e52eda11bb3a2 100644
--- a/pkgs/development/tools/kafkactl/default.nix
+++ b/pkgs/development/tools/kafkactl/default.nix
@@ -1,21 +1,26 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
 
 buildGoModule rec {
   pname = "kafkactl";
-  version = "3.0.3";
+  version = "3.1.0";
 
   src = fetchFromGitHub {
     owner = "deviceinsight";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-rz3cAA5iqhrCZhLc+RKZhudiMlfu3m6wWYNHAnUP/kg=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-H6oSkPQx5bk9VBBoeGVg0Ri5LTCv96tR4Vq4guymAbQ=";
   };
 
   vendorHash = "sha256-Y3BPt3PsedrlCoKiKUObf6UQd+MuNiCGLpJUg94XSgA=";
+
   doCheck = false;
 
   meta = with lib; {
-    inherit (src.meta) homepage;
+    homepage = "https://github.com/deviceinsight/kafkactl";
+    changelog = "https://github.com/deviceinsight/kafkactl/blob/v${version}/CHANGELOG.md";
     description = "Command Line Tool for managing Apache Kafka";
     longDescription = ''
       A command-line interface for interaction with Apache Kafka.
diff --git a/pkgs/development/tools/language-servers/nil/default.nix b/pkgs/development/tools/language-servers/nil/default.nix
index 866293aba8b31..7a25b50aae2db 100644
--- a/pkgs/development/tools/language-servers/nil/default.nix
+++ b/pkgs/development/tools/language-servers/nil/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "nil";
-  version = "2023-03-01";
+  version = "2023-03-11";
 
   src = fetchFromGitHub {
     owner = "oxalica";
     repo = pname;
     rev = version;
-    hash = "sha256-HGd/TV8ZHVAVBx+ndrxAfS/Nz+VHOQjNWjtKkkgYkqA=";
+    hash = "sha256-5WEdrN+ABrNOdfQc2k2mf+fj+ZvZR1Dp/PtypEdlFWA=";
   };
 
-  cargoHash = "sha256-A6Go1OYAaoDvQtAcK5BL5Tz00iLPOft0VLH6usWtb9g=";
+  cargoHash = "sha256-ISkw0lhUKJG8nWUHcR93sLUFt5dDEyK7EORcOXEmVbE=";
 
   CFG_RELEASE = version;
 
diff --git a/pkgs/development/tools/marksman/default.nix b/pkgs/development/tools/marksman/default.nix
index d31268f9cedda..3007e648bf8a6 100644
--- a/pkgs/development/tools/marksman/default.nix
+++ b/pkgs/development/tools/marksman/default.nix
@@ -8,13 +8,13 @@
 
 buildDotnetModule rec {
   pname = "marksman";
-  version = "2023-01-29";
+  version = "2023-03-04";
 
   src = fetchFromGitHub {
     owner = "artempyanykh";
     repo = "marksman";
     rev = version;
-    sha256 = "sha256-UPPO4ueu7gMR7a573M2/xT3N0QgRSNBshJAqoyXEZpc=";
+    sha256 = "sha256-jBZC2z1wtDMIssgRrKkZpl9NQ3XkRCcxo5eylwB2OBQ=";
   };
 
   projectFile = "Marksman/Marksman.fsproj";
diff --git a/pkgs/development/tools/misc/cmake-language-server/default.nix b/pkgs/development/tools/misc/cmake-language-server/default.nix
index e245128aa28cd..9c2641487df41 100644
--- a/pkgs/development/tools/misc/cmake-language-server/default.nix
+++ b/pkgs/development/tools/misc/cmake-language-server/default.nix
@@ -11,17 +11,17 @@
 
 buildPythonApplication rec {
   pname = "cmake-language-server";
-  version = "unstable-2023-01-08";
+  version = "0.1.7";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "regen100";
-    repo = pname;
-    rev = "60c376a5fda29835060687569cb212350a292116";
-    hash = "sha256-vNG43sZy2wMetY5mbgxIoei5jCCj1f8vWiovWtwzbPc=";
+    repo = "cmake-language-server";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-ExEAi47hxxEJeoT3FCwpRwJrf3URnI47/5FDL7fS5sY=";
   };
 
-  PDM_PEP517_SCM_VERSION = "2023.1";
+  PDM_PEP517_SCM_VERSION = version;
 
   patches = [
     # Test timeouts occasionally cause the build to fail
diff --git a/pkgs/development/tools/misc/cmake-language-server/disable-test-timeouts.patch b/pkgs/development/tools/misc/cmake-language-server/disable-test-timeouts.patch
index 6b66681056bbf..237558bb66039 100644
--- a/pkgs/development/tools/misc/cmake-language-server/disable-test-timeouts.patch
+++ b/pkgs/development/tools/misc/cmake-language-server/disable-test-timeouts.patch
@@ -1,10 +1,10 @@
 diff --git a/tests/test_server.py b/tests/test_server.py
-index 2d09bb2..59a122a 100644
+index f349329..d130a2e 100644
 --- a/tests/test_server.py
 +++ b/tests/test_server.py
-@@ -26,7 +26,7 @@ from pygls.lsp.types import (
- )
- from pygls.server import LanguageServer
+@@ -27,7 +27,7 @@ from pygls.server import LanguageServer
+ 
+ from cmake_language_server.server import CMakeLanguageServer
  
 -CALL_TIMEOUT = 2
 +CALL_TIMEOUT = None
diff --git a/pkgs/development/tools/misc/seer/default.nix b/pkgs/development/tools/misc/seer/default.nix
index e44d8a9ce118b..ccb71310c5d8d 100644
--- a/pkgs/development/tools/misc/seer/default.nix
+++ b/pkgs/development/tools/misc/seer/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "seer";
-  version = "1.14";
+  version = "1.15";
 
   src = fetchFromGitHub {
     owner = "epasveer";
     repo = "seer";
     rev = "v${version}";
-    sha256 = "sha256-IxFG+OhRhPRPSyGFJh559Tz2E7aMOtpphm9GbYS0dRA=";
+    sha256 = "sha256-TktCUO281Cok47qT60DMAO5uUIg1iDH1RKx+fBPezLs=";
   };
 
   preConfigure = ''
diff --git a/pkgs/development/tools/oh-my-posh/default.nix b/pkgs/development/tools/oh-my-posh/default.nix
index 0fc9506594622..ab6dddc5e6b9e 100644
--- a/pkgs/development/tools/oh-my-posh/default.nix
+++ b/pkgs/development/tools/oh-my-posh/default.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "oh-my-posh";
-  version = "14.9.2";
+  version = "14.12.0";
 
   src = fetchFromGitHub {
     owner = "jandedobbeleer";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-9ZIMAJVVrJk8ny3TgwXHSxrg713dSbPlgQnY/b0m2Ps=";
+    hash = "sha256-brwfM/IPgwLdVwMNur4EBCsubbv/DCVhTMJbAn6mbFg=";
   };
 
   vendorHash = "sha256-JZ5UiL2vGsXy/xmz+NcAKYDmp5hq7bx54/OdUyQHUp0=";
diff --git a/pkgs/development/tools/opcr-policy/default.nix b/pkgs/development/tools/opcr-policy/default.nix
index 919c8c0a48b83..46365e23fd77c 100644
--- a/pkgs/development/tools/opcr-policy/default.nix
+++ b/pkgs/development/tools/opcr-policy/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "opcr-policy";
-  version = "0.1.50";
+  version = "0.1.51";
 
   src = fetchFromGitHub {
     owner = "opcr-io";
     repo = "policy";
     rev = "v${version}";
-    sha256 = "sha256-u7epE09WcbXAX1W+zkCOTDECnBTIOFC3gjNowtpuYtI=";
+    sha256 = "sha256-RpjuKtxiZA6l0ZW0TsEUn2AMLjU/V2RRfQLmfa0imW4=";
   };
   vendorHash = "sha256-QoD6J+is+InumLiFdbL/y1tuWwBCdBebx6RrIZ4Irik=";
 
diff --git a/pkgs/development/tools/rust/cargo-pgx/buildPgxExtension.nix b/pkgs/development/tools/rust/cargo-pgx/buildPgxExtension.nix
new file mode 100644
index 0000000000000..4b4f7f9d7486b
--- /dev/null
+++ b/pkgs/development/tools/rust/cargo-pgx/buildPgxExtension.nix
@@ -0,0 +1,160 @@
+# preBuildAndTest and some small other bits
+# taken from https://github.com/tcdi/pgx/blob/v0.4.5/nix/extension.nix
+# (but now heavily modified)
+# which uses MIT License with the following license file
+#
+# MIT License
+#
+# Portions Copyright 2019-2021 ZomboDB, LLC.
+# Portions Copyright 2021-2022 Technology Concepts & Design, Inc. <support@tcdi.com>.
+# All rights reserved.
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in all
+# copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+
+{ lib
+, cargo-pgx
+, pkg-config
+, rustPlatform
+, stdenv
+, Security
+, writeShellScriptBin
+}:
+
+# The idea behind: Use it mostly like rustPlatform.buildRustPackage and so
+# we hand most of the arguments down.
+#
+# Additional arguments are:
+#   - `postgresql` postgresql package of the version of postgresql this extension should be build for.
+#                  Needs to be the build platform variant.
+#   - `useFakeRustfmt` Whether to use a noop fake command as rustfmt. cargo-pgx tries to call rustfmt.
+#                      If the generated rust bindings aren't needed to use the extension, its a
+#                      unnecessary and heavy dependency. If you set this to true, you also
+#                      have to add `rustfmt` to `nativeBuildInputs`.
+
+{ buildAndTestSubdir ? null
+, buildType ? "release"
+, buildFeatures ? [ ]
+, cargoBuildFlags ? [ ]
+, postgresql
+# cargo-pgx calls rustfmt on generated bindings, this is not strictly necessary, so we avoid the
+# dependency here. Set to false and provide rustfmt in nativeBuildInputs, if you need it, e.g.
+# if you include the generated code in the output via postInstall.
+, useFakeRustfmt ? true
+, ...
+} @ args:
+let
+  rustfmtInNativeBuildInputs = lib.lists.any (dep: lib.getName dep == "rustfmt") (args.nativeBuildInputs or []);
+in
+
+assert lib.asserts.assertMsg ((args.installPhase or "") == "")
+  "buildPgxExtensions overwrites the installPhase, so providing one does nothing";
+assert lib.asserts.assertMsg ((args.buildPhase or "") == "")
+  "buildPgxExtensions overwrites the buildPhase, so providing one does nothing";
+assert lib.asserts.assertMsg (useFakeRustfmt -> !rustfmtInNativeBuildInputs)
+  "The parameter useFakeRustfmt is set to true, but rustfmt is included in nativeBuildInputs. Either set useFakeRustfmt to false or remove rustfmt from nativeBuildInputs.";
+assert lib.asserts.assertMsg (!useFakeRustfmt -> rustfmtInNativeBuildInputs)
+  "The parameter useFakeRustfmt is set to false, but rustfmt is not included in nativeBuildInputs. Either set useFakeRustfmt to true or add rustfmt from nativeBuildInputs.";
+
+let
+  fakeRustfmt = writeShellScriptBin "rustfmt" ''
+    exit 0
+    '';
+  maybeDebugFlag = lib.optionalString (buildType != "release") "--debug";
+  maybeEnterBuildAndTestSubdir = lib.optionalString (buildAndTestSubdir != null) ''
+    export CARGO_TARGET_DIR="$(pwd)/target"
+    pushd "${buildAndTestSubdir}"
+  '';
+  maybeLeaveBuildAndTestSubdir = lib.optionalString (buildAndTestSubdir != null) "popd";
+
+  pgxPostgresMajor = lib.versions.major postgresql.version;
+  preBuildAndTest = ''
+    export PGX_HOME=$(mktemp -d)
+    export PGDATA="$PGX_HOME/data-${pgxPostgresMajor}/"
+    cargo-pgx pgx init "--pg${pgxPostgresMajor}" ${postgresql}/bin/pg_config
+    echo "unix_socket_directories = '$(mktemp -d)'" > "$PGDATA/postgresql.conf"
+
+    # This is primarily for Mac or other Nix systems that don't use the nixbld user.
+    export USER="$(whoami)"
+    pg_ctl start
+    createuser -h localhost --superuser --createdb "$USER" || true
+    pg_ctl stop
+  '';
+
+  argsForBuildRustPackage = builtins.removeAttrs args [ "postgresql" "useFakeRustfmt" ];
+
+  # so we don't accidentally `(rustPlatform.buildRustPackage argsForBuildRustPackage) // { ... }` because
+  # we forgot parentheses
+  finalArgs = argsForBuildRustPackage // {
+    buildInputs = (args.buildInputs or [ ]) ++ lib.optionals stdenv.isDarwin [ Security ];
+
+    nativeBuildInputs = (args.nativeBuildInputs or [ ]) ++ [
+      cargo-pgx
+      postgresql
+      pkg-config
+      rustPlatform.bindgenHook
+    ] ++ lib.optionals useFakeRustfmt [ fakeRustfmt ];
+
+    buildPhase = ''
+      runHook preBuild
+
+      echo "Executing cargo-pgx buildPhase"
+      ${preBuildAndTest}
+      ${maybeEnterBuildAndTestSubdir}
+
+      NIX_PGLIBDIR="${postgresql}/lib" \
+      PGX_BUILD_FLAGS="--frozen -j $NIX_BUILD_CORES ${builtins.concatStringsSep " " cargoBuildFlags}" \
+      cargo-pgx pgx package \
+        --pg-config ${postgresql}/bin/pg_config \
+        ${maybeDebugFlag} \
+        --features "${builtins.concatStringsSep " " buildFeatures}" \
+        --out-dir "$out"
+
+      ${maybeLeaveBuildAndTestSubdir}
+
+      runHook postBuild
+    '';
+
+    preCheck = preBuildAndTest + args.preCheck or "";
+
+    installPhase = ''
+      runHook preInstall
+
+      echo "Executing buildPgxExtension install"
+
+      ${maybeEnterBuildAndTestSubdir}
+
+      cargo-pgx pgx stop all
+
+      mv $out/${postgresql}/* $out
+      rm -rf $out/nix
+
+      ${maybeLeaveBuildAndTestSubdir}
+
+      runHook postInstall
+    '';
+
+    PGX_PG_SYS_SKIP_BINDING_REWRITE = "1";
+    CARGO_BUILD_INCREMENTAL = "false";
+    RUST_BACKTRACE = "full";
+
+    checkNoDefaultFeatures = true;
+    checkFeatures = (args.checkFeatures or [ ]) ++ [ "pg_test pg${pgxPostgresMajor}" ];
+  };
+in
+rustPlatform.buildRustPackage finalArgs
diff --git a/pkgs/development/tools/skaffold/default.nix b/pkgs/development/tools/skaffold/default.nix
index 4e1a51f5154a0..cba9f174bf1ed 100644
--- a/pkgs/development/tools/skaffold/default.nix
+++ b/pkgs/development/tools/skaffold/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "skaffold";
-  version = "2.1.0";
+  version = "2.2.0";
 
   src = fetchFromGitHub {
     owner = "GoogleContainerTools";
     repo = "skaffold";
     rev = "v${version}";
-    sha256 = "sha256-D0KcnxfjPBGHLGs5YLdecuKL07jIhF6w/SIr/I/W1rI=";
+    sha256 = "sha256-4/FnuyesqW+9zA4TArm/7MpTzWURGG7ZjQKh3WFghZQ=";
   };
 
-  vendorSha256 = "sha256-yy1BVorjLEcZR6PqupBiZx2plwPJ6xlxripbyB6RLek=";
+  vendorHash = "sha256-hy0xi21Lq3MzXnBB8+8FqNZsxp4fLshnaRm4v+GyLUg=";
 
   subPackages = ["cmd/skaffold"];
 
diff --git a/pkgs/development/tools/stylua/default.nix b/pkgs/development/tools/stylua/default.nix
index 60110d6c99f31..6e8b7df3cbc45 100644
--- a/pkgs/development/tools/stylua/default.nix
+++ b/pkgs/development/tools/stylua/default.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "stylua";
-  version = "0.16.1";
+  version = "0.17.0";
 
   src = fetchFromGitHub {
     owner = "johnnymorganz";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-PpkJwCVZr21P1WmU2Kid+X9JwKdJs1krY6keQoMqDvc=";
+    sha256 = "sha256-Q+0B7O769blQVHC4++G+FZTKa1llmn6xkS1UDBcFLOA=";
   };
 
-  cargoSha256 = "sha256-oCoE+Fk2zcVlV8H+f/soAWlhXNsLTysmqLXx9yjdnFY=";
+  cargoSha256 = "sha256-lnodLMqiJsxm5rO+FMbvVhzX3z9R4eyPf+ujDCDk8ow=";
 
   # remove cargo config so it can find the linker on aarch64-unknown-linux-gnu
   postPatch = ''
diff --git a/pkgs/development/tools/xc/default.nix b/pkgs/development/tools/xc/default.nix
index 9b4643435bacf..ebdbbc4ac5483 100644
--- a/pkgs/development/tools/xc/default.nix
+++ b/pkgs/development/tools/xc/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "xc";
-  version = "0.0.175";
+  version = "0.1.181";
 
   src = fetchFromGitHub {
     owner = "joerdav";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Uc9MTxl32xQ7u6N0mocDAoD9tgv/YOPCzhonsavX9Vo=";
+    sha256 = "sha256-C6qZdO6+n9BWm69y09kvnEBF45sB6bfOfmteNO2x68I=";
   };
 
   vendorHash = "sha256-cySflcTuAzbFZbtXmzZ98nfY8HUq1UedONTtKP4EICs=";
diff --git a/pkgs/development/web/flyctl/default.nix b/pkgs/development/web/flyctl/default.nix
index 142c86894fce3..32736d0ffa96d 100644
--- a/pkgs/development/web/flyctl/default.nix
+++ b/pkgs/development/web/flyctl/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "flyctl";
-  version = "0.0.483";
+  version = "0.0.484";
 
   src = fetchFromGitHub {
     owner = "superfly";
     repo = "flyctl";
     rev = "v${version}";
-    hash = "sha256-z6FBJ8cE8UeOP/3ojzQo3LjEJr5bBshf+4CgMmb1RTQ=";
+    hash = "sha256-2//mxYTF6lAolj5aQOXF12NOwEa/VPoen9LNxD7gYDo=";
   };
 
   vendorHash = "sha256-2y671bvOmkKEqbcttcCG1L1by/J8gkGZxts7kFyTIxk=";
diff --git a/pkgs/games/unciv/default.nix b/pkgs/games/unciv/default.nix
index e616033d685fd..91d6fa9b2d171 100644
--- a/pkgs/games/unciv/default.nix
+++ b/pkgs/games/unciv/default.nix
@@ -25,11 +25,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "unciv";
-  version = "4.5.2";
+  version = "4.5.5";
 
   src = fetchurl {
     url = "https://github.com/yairm210/Unciv/releases/download/${version}/Unciv.jar";
-    hash = "sha256-HhMccVlpIJoGW3LLqg1clw+dWcRUVHwCgtrmBcOXFSE=";
+    hash = "sha256-m7wyWxTKXrxJUtUpG2Dwg4s91TBbE0eFNAyDhS98ggo=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/games/vassal/default.nix b/pkgs/games/vassal/default.nix
index c7971c7d38745..0c6704eeab42d 100644
--- a/pkgs/games/vassal/default.nix
+++ b/pkgs/games/vassal/default.nix
@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation rec {
   pname = "VASSAL";
-  version = "3.6.13";
+  version = "3.6.14";
 
   src = fetchzip {
     url = "https://github.com/vassalengine/vassal/releases/download/${version}/${pname}-${version}-linux.tar.bz2";
-    sha256 = "sha256-5YswOh2jnOafctp7q8INtIqQwx1ugGm0QP9vDfal7t0=";
+    sha256 = "sha256-0/QJyntLV1DLzLJ8p4f+tCXPKl3DMf+j4/gkI+Mt+rc=";
   };
 
   buildInputs = [
diff --git a/pkgs/os-specific/linux/kernel/zen-kernels.nix b/pkgs/os-specific/linux/kernel/zen-kernels.nix
index 4a357fc1a09b7..97f6685e6c13f 100644
--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@@ -4,16 +4,16 @@ let
   # comments with variant added for update script
   # ./update-zen.py zen
   zenVariant = {
-    version = "6.2.2"; #zen
-    suffix = "zen2"; #zen
-    sha256 = "0hbsd8id1f27zlxffid7pyycm5dlh6hw8y6f8dv6czd8k9v1qngs"; #zen
+    version = "6.2.5"; #zen
+    suffix = "zen1"; #zen
+    sha256 = "0ilkb8rqww30nl4sa01jy97s8gs67y96qwf9r0z0z7xy3w05s8bl"; #zen
     isLqx = false;
   };
   # ./update-zen.py lqx
   lqxVariant = {
-    version = "6.1.15"; #lqx
-    suffix = "lqx2"; #lqx
-    sha256 = "1z3bwn2pmbaa8cqld4fsxkzkdb5213n83bgb8jkm9v4943pa220i"; #lqx
+    version = "6.1.18"; #lqx
+    suffix = "lqx1"; #lqx
+    sha256 = "1gyjy01ys74apa65abgvxcj0y51vf5ixampyj3jd8lxzn4vvkih6"; #lqx
     isLqx = true;
   };
   zenKernelsFor = { version, suffix, sha256, isLqx }: buildLinux (args // {
diff --git a/pkgs/os-specific/linux/musl/default.nix b/pkgs/os-specific/linux/musl/default.nix
index 7a0fabf9d4682..454c81747444b 100644
--- a/pkgs/os-specific/linux/musl/default.nix
+++ b/pkgs/os-specific/linux/musl/default.nix
@@ -4,20 +4,24 @@
 }:
 let
   cdefs_h = fetchurl {
-    url = "http://git.alpinelinux.org/cgit/aports/plain/main/libc-dev/sys-cdefs.h";
+    name = "sys-cdefs.h";
+    url = "https://git.alpinelinux.org/aports/plain/main/libc-dev/sys-cdefs.h?id=7ca0ed62d4c0d713d9c7dd5b9a077fba78bce578";
     sha256 = "16l3dqnfq0f20rzbkhc38v74nqcsh9n3f343bpczqq8b1rz6vfrh";
   };
   queue_h = fetchurl {
-    url = "http://git.alpinelinux.org/cgit/aports/plain/main/libc-dev/sys-queue.h";
+    name = "sys-queue.h";
+    url = "http://git.alpinelinux.org/aports/plain/main/libc-dev/sys-queue.h?id=7ca0ed62d4c0d713d9c7dd5b9a077fba78bce578";
     sha256 = "12qm82id7zys92a1qh2l1qf2wqgq6jr4qlbjmqyfffz3s3nhfd61";
   };
   tree_h = fetchurl {
-    url = "http://git.alpinelinux.org/cgit/aports/plain/main/libc-dev/sys-tree.h";
+    name = "sys-tree.h";
+    url = "http://git.alpinelinux.org/aports/plain/main/libc-dev/sys-tree.h?id=7ca0ed62d4c0d713d9c7dd5b9a077fba78bce578";
     sha256 = "14igk6k00bnpfw660qhswagyhvr0gfqg4q55dxvaaq7ikfkrir71";
   };
 
   stack_chk_fail_local_c = fetchurl {
-    url = "https://git.alpinelinux.org/aports/plain/main/musl/__stack_chk_fail_local.c?h=3.10-stable";
+    name = "__stack_chk_fail_local.c";
+    url = "https://git.alpinelinux.org/aports/plain/main/musl/__stack_chk_fail_local.c?id=9afbe3cbbf4c30ff23c733218c3c03d7e8c6461d";
     sha256 = "1nhkzzy9pklgjcq2yg89d3l18jif331srd3z3vhy5qwxl1spv6i9";
   };
 
diff --git a/pkgs/servers/adguardhome/bins.nix b/pkgs/servers/adguardhome/bins.nix
index f72f4dfcbfc2e..8c897bf33c62f 100644
--- a/pkgs/servers/adguardhome/bins.nix
+++ b/pkgs/servers/adguardhome/bins.nix
@@ -1,31 +1,31 @@
 { fetchurl, fetchzip }:
 {
 x86_64-darwin = fetchzip {
-  sha256 = "sha256-mOn0RYWmGzIeHyVwVTGPUvFyVQ8Zu57KW7UkGMWRejA=";
-  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.25/AdGuardHome_darwin_amd64.zip";
+  sha256 = "sha256-hGa1SrueZWGokeJb+p/6eaYv1AP1a2TUiGo+rcJBw3Y=";
+  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.26/AdGuardHome_darwin_amd64.zip";
 };
 aarch64-darwin = fetchzip {
-  sha256 = "sha256-urdLtEOMJ2ZeaWezihpv5UU8Li2gnmYk6+gzn9E/3Nw=";
-  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.25/AdGuardHome_darwin_arm64.zip";
+  sha256 = "sha256-wm8scjBaQuKJQu2OfYWDQqF2TLdPEZQEGSgaLzoGTb0=";
+  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.26/AdGuardHome_darwin_arm64.zip";
 };
 i686-linux = fetchurl {
-  sha256 = "sha256-yWlo7adaQcPrM4zOPq5BLw6rZPYg2Qr2T1R7H8QZuvA=";
-  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.25/AdGuardHome_linux_386.tar.gz";
+  sha256 = "sha256-nie5WOeMajq8ucOwLHDXMG1FU7wBS3GTQHKCn0XjBCQ=";
+  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.26/AdGuardHome_linux_386.tar.gz";
 };
 x86_64-linux = fetchurl {
-  sha256 = "sha256-pD1vs4NHWByZmEozdgpzBXDeSzbEBouyawd41Emf8QE=";
-  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.25/AdGuardHome_linux_amd64.tar.gz";
+  sha256 = "sha256-Ai6QzmNrALHKxJIX5gx5GQiLlcpKRuT+ALxN0PDJQ9E=";
+  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.26/AdGuardHome_linux_amd64.tar.gz";
 };
 aarch64-linux = fetchurl {
-  sha256 = "sha256-BpknO9qL4Jo31d/vRXjuU/wJWfCVvLfgh6tZLG/6ipI=";
-  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.25/AdGuardHome_linux_arm64.tar.gz";
+  sha256 = "sha256-cJ7vvv4Yyo0r01eOuZI6jqc4LFmSDmVl84aJjwxkuR4=";
+  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.26/AdGuardHome_linux_arm64.tar.gz";
 };
 armv6l-linux = fetchurl {
-  sha256 = "sha256-yUyRz/2hqvN8XkuzfMfG6ibYOb68WjJaqgAIAfoZH0s=";
-  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.25/AdGuardHome_linux_armv6.tar.gz";
+  sha256 = "sha256-DfeSBIOO/vZQExbrqku28s8a9s22tfuojccIwe37tS4=";
+  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.26/AdGuardHome_linux_armv6.tar.gz";
 };
 armv7l-linux = fetchurl {
-  sha256 = "sha256-MOvDKvq24+NFmgseZZA3zz0z6Vr/7OvO8sHpsDWvMuo=";
-  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.25/AdGuardHome_linux_armv7.tar.gz";
+  sha256 = "sha256-OHoU8dP5b2jqFTfn4FCxL88HrQntcxZ5enMFr/YN1zI=";
+  url = "https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.26/AdGuardHome_linux_armv7.tar.gz";
 };
 }
diff --git a/pkgs/servers/adguardhome/default.nix b/pkgs/servers/adguardhome/default.nix
index 77a5530d30986..b6252ef604135 100644
--- a/pkgs/servers/adguardhome/default.nix
+++ b/pkgs/servers/adguardhome/default.nix
@@ -7,7 +7,7 @@ in
 
 stdenv.mkDerivation rec {
   pname = "adguardhome";
-  version = "0.107.25";
+  version = "0.107.26";
   src = sources.${system} or (throw "Source for ${pname} is not available for ${system}");
 
   installPhase = ''
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   passthru = {
     updateScript = ./update.sh;
-    schema_version = 16;
+    schema_version = 17;
     tests.adguardhome = nixosTests.adguardhome;
   };
 
diff --git a/pkgs/servers/dns/knot-dns/default.nix b/pkgs/servers/dns/knot-dns/default.nix
index 539dbd6a80657..9ed93e623b978 100644
--- a/pkgs/servers/dns/knot-dns/default.nix
+++ b/pkgs/servers/dns/knot-dns/default.nix
@@ -59,7 +59,7 @@ stdenv.mkDerivation rec {
   passthru.tests = {
     inherit knot-resolver;
   } // lib.optionalAttrs stdenv.isLinux {
-    inherit (nixosTests) knot;
+    inherit (nixosTests) knot kea;
     # Some dependencies are very version-sensitive, so the might get dropped
     # or embedded after some update, even if the nixPackagers didn't intend to.
     # For non-linux I don't know a good replacement for `ldd`.
diff --git a/pkgs/servers/komga/default.nix b/pkgs/servers/komga/default.nix
index 5af5a44d16853..1f651a5f46e59 100644
--- a/pkgs/servers/komga/default.nix
+++ b/pkgs/servers/komga/default.nix
@@ -8,11 +8,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "komga";
-  version = "0.162.0";
+  version = "0.163.0";
 
   src = fetchurl {
     url = "https://github.com/gotson/${pname}/releases/download/v${version}/${pname}-${version}.jar";
-    sha256 = "sha256-RcEAqMfpXH7PudLOROpSZw/5HrEeuBFBkllOjGdXZCU=";
+    sha256 = "sha256-dKbdzfjb+brY++uflVvuF1LaOIaYn1UqIGIjCsyLMv8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/servers/matrix-synapse/matrix-appservice-irc/default.nix b/pkgs/servers/matrix-synapse/matrix-appservice-irc/default.nix
index d96e60ba780f2..8c6e8a1025ce2 100644
--- a/pkgs/servers/matrix-synapse/matrix-appservice-irc/default.nix
+++ b/pkgs/servers/matrix-synapse/matrix-appservice-irc/default.nix
@@ -9,16 +9,16 @@
 
 buildNpmPackage rec {
   pname = "matrix-appservice-irc";
-  version = "0.37.0";
+  version = "0.37.1";
 
   src = fetchFromGitHub {
     owner = "matrix-org";
     repo = "matrix-appservice-irc";
     rev = "refs/tags/${version}";
-    hash = "sha256-krF/eUyGHB4M3sQVaBh7+OaHnM/g9XVaBa8gizPkLKE=";
+    hash = "sha256-d/CA27A0txnVnSCJeS/qeK90gOu1QjQaFBk+gblEdH8=";
   };
 
-  npmDepsHash = "sha256-VkVpFt3cwnBkN0AGDaE5Bd6xINGL6XugZ4TBsDONWCg=";
+  npmDepsHash = "sha256-s/b/G49HlDbYsSmwRYrm4Bcv/81tHLC8Ac1IMEwGFW8=";
 
   nativeBuildInputs = [
     python3
diff --git a/pkgs/servers/monitoring/prometheus/influxdb-exporter.nix b/pkgs/servers/monitoring/prometheus/influxdb-exporter.nix
index f4b96b1cf7a85..8f40e61bc98d3 100644
--- a/pkgs/servers/monitoring/prometheus/influxdb-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/influxdb-exporter.nix
@@ -6,17 +6,17 @@
 
 buildGoModule rec {
   pname = "influxdb_exporter";
-  version = "0.11.2";
+  version = "0.11.3";
   rev = "v${version}";
 
   src = fetchFromGitHub {
     inherit rev;
     owner = "prometheus";
     repo = "influxdb_exporter";
-    hash = "sha256-UIB6/0rYOrS/B7CFffg0lPaAhSbmk0KSEogjCundXAU=";
+    hash = "sha256-jb384/i76KxQEgqnebEDkH33iPLAAzKFkA8OtmExrWc=";
   };
 
-  vendorHash = "sha256-ueE1eE0cxr7+APvIEzR26Uprx0CXN1jfNLzGVgDmJQk=";
+  vendorHash = "sha256-pD/oWbFa6pg9miNA2z6RubsBd3+X/DWRoQuaVwjuOmI=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/servers/pocketbase/default.nix b/pkgs/servers/pocketbase/default.nix
index c8da1b233c21a..34b2324c81093 100644
--- a/pkgs/servers/pocketbase/default.nix
+++ b/pkgs/servers/pocketbase/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "pocketbase";
-  version = "0.12.3";
+  version = "0.13.2";
 
   src = fetchFromGitHub {
     owner = "pocketbase";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-/uqUOuNHFyah6nrQI3lRNkB2vpV9vKXJog1ck0zoruo=";
+    sha256 = "sha256-P150wEJHTC294LcRhSHF5/+w08WKBvhUZsJ9ENi1EM8=";
   };
 
-  vendorHash = "sha256-8NBudXcU3cjSbo6qpGZVLtbrLedzwijwrbiTgC+OMcU=";
+  vendorHash = "sha256-hvziOq5zyYwWcvqa23IzHXj/DT27MAcNVegYR38beJ4=";
 
   # This is the released subpackage from upstream repo
   subPackages = [ "examples/base" ];
diff --git a/pkgs/servers/pufferpanel/default.nix b/pkgs/servers/pufferpanel/default.nix
index d89a859b89884..bfb9106b90ea9 100644
--- a/pkgs/servers/pufferpanel/default.nix
+++ b/pkgs/servers/pufferpanel/default.nix
@@ -2,23 +2,53 @@
 , buildGoModule
 , fetchFromGitHub
 , makeWrapper
-, pkgs
-, stdenv
 , fetchzip
-, jdk
-, nodejs
+, fetchpatch
 , pathDeps ? [ ]
 }:
 
 buildGoModule rec {
   pname = "pufferpanel";
-  version = "2.2.0";
+  version = "2.6.6";
+
+  patches = [
+    # Bump go-sqlite3 version to avoid a GNU C compiler error.
+    # See https://github.com/PufferPanel/PufferPanel/pull/1240
+    (fetchpatch {
+      url = "https://github.com/PufferPanel/PufferPanel/pull/1240/commits/3065dca2d9b05a56789971ccf0f43a7079a390b8.patch";
+      hash = "sha256-ygMrhJoba8swoRBBii7BEiLihqOebLUtSH7os7W3s+k=";
+    })
+
+    # Fix errors in tests.
+    # See https://github.com/PufferPanel/PufferPanel/pull/1241
+    (fetchpatch {
+      url = "https://github.com/PufferPanel/PufferPanel/pull/1241/commits/ffd21bce4bff3040c8e3e783e5b4779222e7a3a5.patch";
+      hash = "sha256-BzGfcWhzRrCHKkAhWf0uvXiiiutWqthn/ed7bN2hR8U=";
+    })
+
+    # Seems to be an anti-feature. Startup is the only place where user/group is
+    # hardcoded and checked.
+    #
+    # There is no technical reason PufferPanel cannot run as a different user,
+    # especially for simple commands like `pufferpanel version`.
+    ./disable-group-checks.patch
+
+    # Some tests do not have network requests stubbed :(
+    ./skip-network-tests.patch
+  ];
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X=github.com/pufferpanel/pufferpanel/v2.Hash=none"
+    "-X=github.com/pufferpanel/pufferpanel/v2.Version=${version}-nixpkgs"
+  ];
 
   src = fetchFromGitHub {
     owner = "pufferpanel";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1ifig8ckjlg47wj0lfk4q941dan7llb1i5l76akcpjq726b2j8lh";
+    hash = "sha256-0Vyi47Rkpe3oODHfsl/7tCerENpiEa3EWBHhfTO/uu4=";
   };
 
   # PufferPanel is split into two parts: the backend daemon and the
@@ -28,25 +58,35 @@ buildGoModule rec {
   # we just download the built frontend and package that.
   frontend = fetchzip {
     url = "https://github.com/PufferPanel/PufferPanel/releases/download/v${version}/pufferpanel_${version}_linux_arm64.zip";
-    sha256 = "0phbf4asr0dns7if84crx05kfgr44yaxrbsbihdywbhh2mb16052";
+    hash = "sha256-z7HWhiEBma37OMGEkTGaEbnF++Nat8wAZE2UeOoaO/U=";
     stripRoot = false;
-  } + "/www";
+    postFetch = ''
+      mv $out $TMPDIR/subdir
+      mv $TMPDIR/subdir/www $out
+    '';
+  };
 
   nativeBuildInputs = [ makeWrapper ];
 
-  vendorSha256 = "061l1sy0z3kd7rc2blqh333gy66nbadfxy9hyxgq07dszds4byys";
+  vendorHash = "sha256-fB8MxSl9E2W+BdO6i+drbCe9Z3bPHPi0MvpJEomU9co=";
+  proxyVendor = true;
 
   postFixup = ''
     mkdir -p $out/share/pufferpanel
     cp -r ${src}/assets/email $out/share/pufferpanel/templates
     cp -r ${frontend} $out/share/pufferpanel/www
 
-    # Wrap the binary with the path to the external files.
-    mv $out/bin/cmd $out/bin/pufferpanel
-    wrapProgram "$out/bin/pufferpanel" \
-      --set PUFFER_PANEL_EMAIL_TEMPLATES $out/share/pufferpanel/templates/emails.json \
-      --set GIN_MODE release \
-      --set PUFFER_PANEL_WEB_FILES $out/share/pufferpanel/www \
+    # Rename cmd to pufferpanel and remove other binaries.
+    mv $out/bin $TMPDIR/bin
+    mkdir $out/bin
+    mv $TMPDIR/bin/cmd $out/bin/pufferpanel
+
+    # Wrap the binary with the path to the external files, but allow setting
+    # custom paths if needed.
+    wrapProgram $out/bin/pufferpanel \
+      --set-default GIN_MODE release \
+      --set-default PUFFER_PANEL_EMAIL_TEMPLATES $out/share/pufferpanel/templates/emails.json \
+      --set-default PUFFER_PANEL_WEB_FILES $out/share/pufferpanel/www \
       --prefix PATH : ${lib.escapeShellArg (lib.makeBinPath pathDeps)}
   '';
 
@@ -55,6 +95,5 @@ buildGoModule rec {
     homepage = "https://www.pufferpanel.com/";
     license = with licenses; [ asl20 ];
     maintainers = with maintainers; [ ckie ];
-    broken = stdenv.isDarwin; # never built on Hydra https://hydra.nixos.org/job/nixpkgs/trunk/pufferpanel.x86_64-darwin
   };
 }
diff --git a/pkgs/servers/pufferpanel/disable-group-checks.patch b/pkgs/servers/pufferpanel/disable-group-checks.patch
new file mode 100644
index 0000000000000..a3f0aa074b603
--- /dev/null
+++ b/pkgs/servers/pufferpanel/disable-group-checks.patch
@@ -0,0 +1,34 @@
+diff --git a/cmd/main.go b/cmd/main.go
+index f9af7038..099ff2e2 100644
+--- a/cmd/main.go
++++ b/cmd/main.go
+@@ -24,11 +24,6 @@ import (
+ )
+ 
+ func main() {
+-	if !pufferpanel.UserInGroup("pufferpanel") {
+-		fmt.Println("You do not have permission to use this command")
+-		return
+-	}
+-
+ 	defer logging.Close()
+ 
+ 	defer func() {
+diff --git a/cmd/user.go b/cmd/user.go
+index d4a27aaf..9bf21910 100644
+--- a/cmd/user.go
++++ b/cmd/user.go
+@@ -218,10 +218,9 @@ type userCreate struct {
+ }
+ 
+ func editUser(cmd *cobra.Command, args []string) {
+-	if !pufferpanel.UserInGroup() {
+-		fmt.Printf("You do not have permission to use this command")
+-		return
+-	}
++	// Keeping import to avoid merge conflicts with future updates in case
++	// PufferPanel starts using this import elsewhere in this file.
++	_ = pufferpanel.UserInGroup
+ 
+ 	db, err := database.GetConnection()
+ 	if err != nil {
diff --git a/pkgs/servers/pufferpanel/skip-network-tests.patch b/pkgs/servers/pufferpanel/skip-network-tests.patch
new file mode 100644
index 0000000000000..b2bddd191d0b9
--- /dev/null
+++ b/pkgs/servers/pufferpanel/skip-network-tests.patch
@@ -0,0 +1,61 @@
+diff --git a/operations/javadl/javadl_test.go b/operations/javadl/javadl_test.go
+index 3938a58c..a51e2f4a 100644
+--- a/operations/javadl/javadl_test.go
++++ b/operations/javadl/javadl_test.go
+@@ -22,6 +22,8 @@ import (
+ )
+ 
+ func Test_downloadJava(t *testing.T) {
++	t.Skip("requires network access")
++
+ 	tests := []struct {
+ 		name    string
+ 		wantErr bool
+diff --git a/operations/spongedl/spongedl_test.go b/operations/spongedl/spongedl_test.go
+index efb1665c..1b93be8c 100644
+--- a/operations/spongedl/spongedl_test.go
++++ b/operations/spongedl/spongedl_test.go
+@@ -5,6 +5,8 @@ import (
+ )
+ 
+ func TestSpongeDl_Run(t *testing.T) {
++	t.Skip("requires network access")
++
+ 	type fields struct {
+ 		Recommended      bool
+ 		SpongeType       string
+diff --git a/operations/steamgamedl/dl_test.go b/operations/steamgamedl/dl_test.go
+index f4df4bf3..f7cd9681 100644
+--- a/operations/steamgamedl/dl_test.go
++++ b/operations/steamgamedl/dl_test.go
+@@ -19,6 +19,8 @@ import (
+ )
+ 
+ func Test_downloadSteamcmd(t *testing.T) {
++	t.Skip("requires network access")
++
+ 	tests := []struct {
+ 		name    string
+ 		wantErr bool
+diff --git a/services/templates_test.go b/services/templates_test.go
+index 5305dbc0..127efc54 100644
+--- a/services/templates_test.go
++++ b/services/templates_test.go
+@@ -9,6 +9,8 @@ import (
+ )
+ 
+ func TestTemplate_GetImportableTemplates(t1 *testing.T) {
++	t1.Skip("requires network access")
++
+ 	t1.Run("GetImportableTemplates", func(t1 *testing.T) {
+ 		t := &Template{}
+ 
+@@ -26,6 +28,8 @@ func TestTemplate_GetImportableTemplates(t1 *testing.T) {
+ }
+ 
+ func TestTemplate_ImportTemplates(t1 *testing.T) {
++	t1.Skip("requires network access")
++
+ 	t1.Run("GetImportableTemplates", func(t1 *testing.T) {
+ 		db := prepareDatabase(t1)
+ 		if t1.Failed() {
diff --git a/pkgs/servers/snappymail/default.nix b/pkgs/servers/snappymail/default.nix
index 4309aaadf9dbc..bdc94c57bc89d 100644
--- a/pkgs/servers/snappymail/default.nix
+++ b/pkgs/servers/snappymail/default.nix
@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation rec {
   pname = "snappymail";
-  version = "2.26.3";
+  version = "2.26.4";
 
   src = fetchurl {
     url = "https://github.com/the-djmaze/snappymail/releases/download/v${version}/snappymail-${version}.tar.gz";
-    sha256 = "sha256-kNfFQnUFfIS9x6da0nmm4cHK16ZTScQXOa7lL6QFBDQ=";
+    sha256 = "sha256-BWjkdzAm9/bvPTjsdg+Vr+gr0fqzEvARmaySth95fsI=";
   };
 
   sourceRoot = "snappymail";
diff --git a/pkgs/servers/spicedb/default.nix b/pkgs/servers/spicedb/default.nix
index ee6cb17ff0ff5..50c6b2a5ed037 100644
--- a/pkgs/servers/spicedb/default.nix
+++ b/pkgs/servers/spicedb/default.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "spicedb";
-  version = "1.16.2";
+  version = "1.17.0";
 
   src = fetchFromGitHub {
     owner = "authzed";
     repo = "spicedb";
     rev = "v${version}";
-    hash = "sha256-OH5O0wOg36sAKWr8sFPYU8RX/S9DbbSnGJvQ1v2pXmQ=";
+    hash = "sha256-oTmEMFoSIW1JQIzhGxAuHW/VSZZk5FnzdLZvjhg90ZQ=";
   };
 
-  vendorHash = "sha256-drnVAWMj7x8HlEQXoichgl35qW07tsk3JvXU/d1ukAc=";
+  vendorHash = "sha256-tIjHgEfq7kKwyQ9iCzI51ne88WrxUATYvJYcHbVX4jQ=";
 
   subPackages = [ "cmd/spicedb" ];
 
diff --git a/pkgs/servers/sql/postgresql/ext/timescaledb_toolkit.nix b/pkgs/servers/sql/postgresql/ext/timescaledb_toolkit.nix
new file mode 100644
index 0000000000000..d672928cd3d6b
--- /dev/null
+++ b/pkgs/servers/sql/postgresql/ext/timescaledb_toolkit.nix
@@ -0,0 +1,42 @@
+{ lib
+, fetchFromGitHub
+, buildPgxExtension
+, postgresql
+, stdenv
+, nixosTests
+}:
+
+buildPgxExtension rec {
+  inherit postgresql;
+
+  pname = "timescaledb_toolkit";
+  version = "1.14.0";
+
+  src = fetchFromGitHub {
+    owner = "timescale";
+    repo = "timescaledb-toolkit";
+    rev = version;
+    sha256 = "sha256-ADmYALsCzZGqTX0XSkCif7ndvXwa8nEqddQpty4hbZ0=";
+  };
+
+  cargoSha256 = "sha256-ukjJ11LmfG+k8D20rj68i43gOWUN80nf3hIAjUWXihI=";
+  buildAndTestSubdir = "extension";
+
+  passthru.tests = {
+    timescaledb_toolkit = nixosTests.timescaledb;
+  };
+
+  # tests take really long
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Provide additional tools to ease all things analytic when using TimescaleDB";
+    homepage = "https://github.com/timescale/timescaledb-toolkit";
+    maintainers = with maintainers; [ typetetris ];
+    platforms = postgresql.meta.platforms;
+    license = licenses.asl20;
+
+    # as it needs to be used with timescaledb, simply use the condition from there
+    broken = versionOlder postgresql.version "12";
+  };
+}
diff --git a/pkgs/servers/sql/postgresql/packages.nix b/pkgs/servers/sql/postgresql/packages.nix
index 2bf9db061a918..b6fc6480aecb2 100644
--- a/pkgs/servers/sql/postgresql/packages.nix
+++ b/pkgs/servers/sql/postgresql/packages.nix
@@ -56,6 +56,8 @@ self: super: {
 
     timescaledb = super.callPackage ./ext/timescaledb.nix { };
 
+    timescaledb_toolkit = super.callPackage ./ext/timescaledb_toolkit.nix { };
+
     tsearch_extras = super.callPackage ./ext/tsearch_extras.nix { };
 
     tds_fdw = super.callPackage ./ext/tds_fdw.nix { };
diff --git a/pkgs/servers/web-apps/vikunja/api.nix b/pkgs/servers/web-apps/vikunja/api.nix
index 7dd98c553fc70..ea91cb2505a8b 100644
--- a/pkgs/servers/web-apps/vikunja/api.nix
+++ b/pkgs/servers/web-apps/vikunja/api.nix
@@ -2,14 +2,14 @@
 
 buildGoModule rec {
   pname = "vikunja-api";
-  version = "0.20.2";
+  version = "0.20.3";
 
   src = fetchFromGitea {
     domain = "kolaente.dev";
     owner = "vikunja";
     repo = "api";
     rev = "v${version}";
-    sha256 = "sha256-VSzjP6fC9zxUnY3ZhapRUXUS4V7+BVvXJKrxm71CK4o=";
+    hash = "sha256-krmshpv7X8Ua61NUSZGTT1+avoBBNSFuxPa93go3qBY=";
   };
 
   nativeBuildInputs =
@@ -24,7 +24,7 @@ buildGoModule rec {
         '';
       in [ fakeGit mage ];
 
-  vendorSha256 = "sha256-8qaEMHBZcop1wH3tmNKAAMEYA4qrE6dlwxhRsCDeZaY=";
+  vendorSha256 = "sha256-TY6xJnz6phIrybZ2Ix7xwuMzGQ1f0xk0KwgPnaTaKYw=";
 
   # checks need to be disabled because of needed internet for some checks
   doCheck = false;
diff --git a/pkgs/servers/web-apps/vikunja/frontend.nix b/pkgs/servers/web-apps/vikunja/frontend.nix
index 14787835f79f3..2ccf1b4f3f5ae 100644
--- a/pkgs/servers/web-apps/vikunja/frontend.nix
+++ b/pkgs/servers/web-apps/vikunja/frontend.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "vikunja-frontend";
-  version = "0.20.3";
+  version = "0.20.4";
 
   src = fetchurl {
     url = "https://dl.vikunja.io/frontend/${pname}-${version}.zip";
-    sha256 = "sha256-+VtdgbJaXcPlO70Gqsur6osBb7iAvVnPv2iaHbs2Rmk=";
+    hash = "sha256-gkeX/2f6T8GW6jQa+qFcGc/k5cu9QoO9b3tL6B4lPOQ=";
   };
 
   nativeBuildInputs = [ unzip ];
diff --git a/pkgs/shells/fish/plugins/autopair-fish.nix b/pkgs/shells/fish/plugins/autopair-fish.nix
deleted file mode 100644
index 292d492f2046e..0000000000000
--- a/pkgs/shells/fish/plugins/autopair-fish.nix
+++ /dev/null
@@ -1,20 +0,0 @@
-{ lib, stdenv, buildFishPlugin, fetchFromGitHub }:
-
-buildFishPlugin rec {
-  pname = "autopair.fish";
-  version = "1.0.4";
-
-  src = fetchFromGitHub {
-    owner = "jorgebucaran";
-    repo = pname;
-    rev = version;
-    sha256 = "sha256-s1o188TlwpUQEN3X5MxUlD/2CFCpEkWu83U9O+wg3VU=";
-  };
-
-  meta = with lib; {
-    description = "Auto-complete matching pairs in the Fish command line.";
-    homepage = "https://github.com/jorgebucaran/autopair.fish";
-    license = licenses.mit;
-    maintainers = with maintainers; [ thehedgeh0g ];
-  };
-}
diff --git a/pkgs/shells/fish/plugins/autopair.nix b/pkgs/shells/fish/plugins/autopair.nix
index d1036829bfdb8..50b5a30b1d93a 100644
--- a/pkgs/shells/fish/plugins/autopair.nix
+++ b/pkgs/shells/fish/plugins/autopair.nix
@@ -2,19 +2,19 @@
 
 buildFishPlugin rec {
   pname = "autopair";
-  version = "1.0.3";
+  version = "1.0.4";
 
   src = fetchFromGitHub {
     owner = "jorgebucaran";
     repo = "autopair.fish";
     rev = version;
-    sha256 = "sha256-l6WJ2kjDO/TnU9FSigjxk5xFp90xl68gDfggkE/wrlM=";
+    sha256 = "sha256-s1o188TlwpUQEN3X5MxUlD/2CFCpEkWu83U9O+wg3VU=";
   };
 
   meta = with lib; {
     description = "Auto-complete matching pairs in the Fish command line";
     homepage = "https://github.com/jorgebucaran/autopair.fish";
     license = licenses.mit;
-    maintainers = with maintainers; [ kidonng ];
+    maintainers = with maintainers; [ figsoda kidonng thehedgeh0g ];
   };
 }
diff --git a/pkgs/shells/fish/plugins/default.nix b/pkgs/shells/fish/plugins/default.nix
index 718dbfec7a642..9197c4907fdfa 100644
--- a/pkgs/shells/fish/plugins/default.nix
+++ b/pkgs/shells/fish/plugins/default.nix
@@ -1,10 +1,8 @@
-{ lib, newScope }:
+{ lib, newScope, config }:
 
 lib.makeScope newScope (self: with self; {
   autopair = callPackage ./autopair.nix { };
 
-  autopair-fish = callPackage ./autopair-fish.nix { };
-
   buildFishPlugin = callPackage ./build-fish-plugin.nix { };
 
   colored-man-pages = callPackage ./colored-man-pages.nix { };
@@ -41,4 +39,6 @@ lib.makeScope newScope (self: with self; {
   sponge = callPackage ./sponge.nix { };
 
   tide = callPackage ./tide.nix { };
+} // lib.optionalAttrs config.allowAliases {
+  autopair-fish = self.autopair; # Added 2023-03-10
 })
diff --git a/pkgs/test/texlive/default.nix b/pkgs/test/texlive/default.nix
index 217a862e1c563..cb607f3a1328e 100644
--- a/pkgs/test/texlive/default.nix
+++ b/pkgs/test/texlive/default.nix
@@ -1,6 +1,26 @@
 { lib, runCommand, fetchurl, file, texlive, writeShellScript }:
 
 {
+
+  luaotfload-fonts = runCommand "texlive-test-lualatex" {
+    nativeBuildInputs = [
+      (with texlive; combine { inherit scheme-medium libertinus-fonts; })
+    ];
+    input = builtins.toFile "lualatex-testfile.tex" ''
+      \documentclass{article}
+      \usepackage{fontspec}
+      \setmainfont{Libertinus Serif}
+      \begin{document}
+        \LaTeX{} is great
+      \end{document}
+    '';
+  }
+  ''
+    export HOME="$(mktemp -d)"
+    lualatex -halt-on-error "$input"
+    echo success > $out
+  '';
+
   chktex = runCommand "texlive-test-chktex" {
     nativeBuildInputs = [
       (with texlive; combine { inherit scheme-infraonly chktex; })
diff --git a/pkgs/tools/admin/aws-vault/default.nix b/pkgs/tools/admin/aws-vault/default.nix
index 49c5e99a353b8..cb9e3d1255792 100644
--- a/pkgs/tools/admin/aws-vault/default.nix
+++ b/pkgs/tools/admin/aws-vault/default.nix
@@ -7,16 +7,16 @@
 }:
 buildGoModule rec {
   pname = "aws-vault";
-  version = "7.0.0";
+  version = "7.0.2";
 
   src = fetchFromGitHub {
     owner = "99designs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-i7wL59MvjsLhEIs3Ejc/DB2m6IfrZqLCeSs1ziPCz+0=";
+    sha256 = "sha256-uNe2dltwLoUBUH/p4CN6HCOvBsq2yASxxwkSEtkJRbQ=";
   };
 
-  vendorHash = "sha256-kcaQw2ooJupMsK9rYlYZOIAW5H4Oa346K9VGjdnaq1E=";
+  vendorHash = "sha256-CPn4JLIZz23ZNcl3LPJumx20WOXTI13s69MVo/Pof+s=";
 
   nativeBuildInputs = [ installShellFiles makeWrapper ];
 
diff --git a/pkgs/tools/admin/eksctl/default.nix b/pkgs/tools/admin/eksctl/default.nix
index b00d8327b4190..8cea35d5ace74 100644
--- a/pkgs/tools/admin/eksctl/default.nix
+++ b/pkgs/tools/admin/eksctl/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "eksctl";
-  version = "0.132.0";
+  version = "0.133.0";
 
   src = fetchFromGitHub {
     owner = "weaveworks";
     repo = pname;
     rev = version;
-    sha256 = "sha256-wKTESd+YKJd94yUuqm1v4biyGCABbhwTlKLzbiOg6H0=";
+    sha256 = "sha256-QRm0a7x39vhxRT29+tTrpr3ZyPPHtHtxLWiyqTgPYCM=";
   };
 
-  vendorHash = "sha256-A06vwsadznqe1xraMZnseRAJkrpCdciKBxPUBus39ws=";
+  vendorHash = "sha256-R/VFq+SO/ZWf9ztg/75ASidqznCkO47T2PFsgKJwEWM=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/admin/pulumi/default.nix b/pkgs/tools/admin/pulumi/default.nix
index 0f1cbb65f91e5..2787358fdf2d5 100644
--- a/pkgs/tools/admin/pulumi/default.nix
+++ b/pkgs/tools/admin/pulumi/default.nix
@@ -14,7 +14,7 @@
 
 buildGoModule rec {
   pname = "pulumi";
-  version = "3.56.0";
+  version = "3.57.1";
 
   # Used in pulumi-language packages, which inherit this prop
   sdkVendorHash = "sha256-oXsU4h4CwukJHttYLT7JiW2He8Yq5qAwnxL8+G5FIpc=";
@@ -23,12 +23,12 @@ buildGoModule rec {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-cXNYg5zNfZTTuv+EaSGuaA9mbMPq7vKTKcsxfnM3NbQ=";
+    hash = "sha256-F5mrk0Qb5Hxjx49KEXEUBN6wB52ztTuV+L37/I0tF48=";
     # Some tests rely on checkout directory name
     name = "pulumi";
   };
 
-  vendorHash = "sha256-TWpH3y+7kLknPy+CExhnjfEvaIWWs1d5JCVF3FA1Z7I=";
+  vendorHash = "sha256-G+5UuiIMWQSp5I8EnlWo32jUkg0ini/UhQYA/MTYB0Y=";
 
   sourceRoot = "${src.name}/pkg";
 
diff --git a/pkgs/tools/audio/openai-whisper-cpp/default.nix b/pkgs/tools/audio/openai-whisper-cpp/default.nix
index 2398b5483ea6f..17aa6c5444da5 100644
--- a/pkgs/tools/audio/openai-whisper-cpp/default.nix
+++ b/pkgs/tools/audio/openai-whisper-cpp/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "whisper-cpp";
-  version = "1.2.0";
+  version = "1.2.1";
 
   src = fetchFromGitHub {
     owner = "ggerganov";
     repo = "whisper.cpp";
     rev = "refs/tags/v${version}" ;
-    hash = "sha256-7/10t1yE7Gbs+cyj8I9vJoDeaxEz9Azc2j3f6QCjDGM=";
+    hash = "sha256-gcw+tcrwCt2CynNXQZxb+WxN/0chIQIJnwUAw9JGkYA=";
   };
 
   # The upstream download script tries to download the models to the
diff --git a/pkgs/tools/backup/btrbk/default.nix b/pkgs/tools/backup/btrbk/default.nix
index e1aaafa3d1f61..34bd7c56178d4 100644
--- a/pkgs/tools/backup/btrbk/default.nix
+++ b/pkgs/tools/backup/btrbk/default.nix
@@ -54,7 +54,7 @@ stdenv.mkDerivation rec {
   '';
 
   passthru.tests = {
-    inherit (nixosTests) btrbk btrbk-no-timer btrbk-section-order;
+    inherit (nixosTests) btrbk btrbk-no-timer btrbk-section-order btrbk-doas;
   };
 
   passthru.updateScript = genericUpdater {
diff --git a/pkgs/tools/games/minecraft/fabric-installer/default.nix b/pkgs/tools/games/minecraft/fabric-installer/default.nix
index 74b822a974861..9d9bc657467d1 100644
--- a/pkgs/tools/games/minecraft/fabric-installer/default.nix
+++ b/pkgs/tools/games/minecraft/fabric-installer/default.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "fabric-installer";
-  version = "0.11.1";
+  version = "0.11.2";
 
   src = fetchurl {
     url = "https://maven.fabricmc.net/net/fabricmc/fabric-installer/${version}/fabric-installer-${version}.jar";
-    sha256 = "sha256-eRf5+hS+babvPNt/5r87Y6WToOuHO9Yn6YGn45iM1zo=";
+    sha256 = "sha256-xq1b7xuxK1pyJ74+5UDCyQav30rIEUt44KygsUYAXCc=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/tools/graphics/directx-shader-compiler/default.nix b/pkgs/tools/graphics/directx-shader-compiler/default.nix
index 192dd7e88f795..6549c0bbade51 100644
--- a/pkgs/tools/graphics/directx-shader-compiler/default.nix
+++ b/pkgs/tools/graphics/directx-shader-compiler/default.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "directx-shader-compiler";
-  version = "1.7.2212";
+  version = "1.7.2212.1";
 
   # Put headers in dev, there are lot of them which aren't necessary for
   # using the compiler binary.
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
     owner = "microsoft";
     repo = "DirectXShaderCompiler";
     rev = "v${version}";
-    hash = "sha256-/FuG6ThvA3XMlHhnshRJpKC+vf4LM8/hurUoPagpTqA=";
+    hash = "sha256-old/vGNoj0mimuvd/RkwNeynBp+gBrkwQ7ah2oUZll0=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/tools/misc/rpm-ostree/default.nix b/pkgs/tools/misc/rpm-ostree/default.nix
index 3c3b02dd3f98d..c2d1ea58b237a 100644
--- a/pkgs/tools/misc/rpm-ostree/default.nix
+++ b/pkgs/tools/misc/rpm-ostree/default.nix
@@ -40,13 +40,13 @@
 
 stdenv.mkDerivation rec {
   pname = "rpm-ostree";
-  version = "2023.1";
+  version = "2023.2";
 
   outputs = [ "out" "dev" "man" "devdoc" ];
 
   src = fetchurl {
     url = "https://github.com/coreos/${pname}/releases/download/v${version}/${pname}-${version}.tar.xz";
-    hash = "sha256-JNLp1IHbIRpe3Au2iUsx7x065rirQlzT9bg7CoqHCyg=";
+    hash = "sha256-/C5la0b1plfqnsfSnfoSkSROIlAcvAfeg4m/PYV2UnY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/misc/turbo/default.nix b/pkgs/tools/misc/turbo/default.nix
index 520a4553b4793..38b9b997b6f53 100644
--- a/pkgs/tools/misc/turbo/default.nix
+++ b/pkgs/tools/misc/turbo/default.nix
@@ -12,6 +12,8 @@
 , extra-cmake-modules
 , fontconfig
 , go
+, testers
+, turbo
 }:
 let
   version = "1.8.3";
@@ -82,6 +84,8 @@ rustPlatform.buildRustPackage rec {
   # Browser tests time out with chromium and google-chrome
   doCheck = false;
 
+  passthru.tests.version = testers.testVersion { package = turbo; };
+
   meta = with lib; {
     description = "High-performance build system for JavaScript and TypeScript codebases";
     homepage = "https://turbo.build/";
diff --git a/pkgs/tools/networking/dnsperf/default.nix b/pkgs/tools/networking/dnsperf/default.nix
index f4d6dcdb9965c..d7b1dd365a27e 100644
--- a/pkgs/tools/networking/dnsperf/default.nix
+++ b/pkgs/tools/networking/dnsperf/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "dnsperf";
-  version = "2.11.0";
+  version = "2.11.1";
 
   src = fetchFromGitHub {
     owner = "DNS-OARC";
     repo = "dnsperf";
     rev = "v${version}";
-    sha256 = "sha256-HLh+Z+ik7F52MBqQEMf1PuqTB32JOrpS8sHrqqln5kU=";
+    sha256 = "sha256-dgPpuX8Geo20BV8g0uhjSdsZUOoC+Dnz4Y2vdMW6KjY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/networking/frp/default.nix b/pkgs/tools/networking/frp/default.nix
index 030de9840fe30..6b09adea63b62 100644
--- a/pkgs/tools/networking/frp/default.nix
+++ b/pkgs/tools/networking/frp/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "frp";
-  version = "0.47.0";
+  version = "0.48.0";
 
   src = fetchFromGitHub {
     owner = "fatedier";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-S2qccDzS+Kj1tEAUR4a0G/4Eu3DAF7lY7ffxU6aykVU=";
+    sha256 = "sha256-e9Qof+HxSJHzAUbLb+w5oWPTOslTPxnC8BVAmtMQGlE=";
   };
 
-  vendorHash = "sha256-ffkXNE3LkgdCGfO6K9lGxEMxT/9Q1o0m3BMtu6tDHdk=";
+  vendorHash = "sha256-DhzirX+AGe8dE62M0hiE5SlWK8HqhNN0MMk9i2Ntrs8=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/networking/netbird/default.nix b/pkgs/tools/networking/netbird/default.nix
index dc306a0d603c7..80cc4f097a217 100644
--- a/pkgs/tools/networking/netbird/default.nix
+++ b/pkgs/tools/networking/netbird/default.nix
@@ -14,16 +14,16 @@ let
 in
 buildGoModule rec {
   pname = "netbird";
-  version = "0.14.2";
+  version = "0.14.4";
 
   src = fetchFromGitHub {
     owner = "netbirdio";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-qrXD/jRLyQR4T3tffCs+Nby+cvRPVvGNHy0NQAmYYAg=";
+    sha256 = "sha256-AzWYJGYlUsgR5ihXwY9ZyN/pL5avionql/jwqhYKsxc=";
   };
 
-  vendorHash = "sha256-2/kk4qTO85fYnNO5vXIFxxFR55xZ5wenogJTMsLfYsg=";
+  vendorHash = "sha256-8cVEujVKwKvO81H+ukVxQouVVH7uZm/FwK9RAKJLN2c=";
 
   nativeBuildInputs = [ installShellFiles ] ++ lib.optional ui pkg-config;
 
diff --git a/pkgs/tools/networking/opensnitch/daemon.nix b/pkgs/tools/networking/opensnitch/daemon.nix
index 94a4c0661c9ae..3390776a17ae9 100644
--- a/pkgs/tools/networking/opensnitch/daemon.nix
+++ b/pkgs/tools/networking/opensnitch/daemon.nix
@@ -11,6 +11,8 @@
 , iptables
 , makeWrapper
 , protoc-gen-go-grpc
+, testers
+, opensnitch
 }:
 
 buildGoModule rec {
@@ -70,6 +72,11 @@ buildGoModule rec {
       --prefix PATH : ${lib.makeBinPath [ iptables ]}
   '';
 
+  passthru.tests.version = testers.testVersion {
+    package = opensnitch;
+    command = "opensnitchd -version";
+  };
+
   meta = with lib; {
     description = "An application firewall";
     homepage = "https://github.com/evilsocket/opensnitch/wiki";
diff --git a/pkgs/tools/networking/smartdns/default.nix b/pkgs/tools/networking/smartdns/default.nix
index d02a1ccac11e9..25054fc1944d1 100644
--- a/pkgs/tools/networking/smartdns/default.nix
+++ b/pkgs/tools/networking/smartdns/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "smartdns";
-  version = "40";
+  version = "41";
 
   src = fetchFromGitHub {
     owner = "pymumu";
     repo = pname;
     rev = "Release${version}";
-    sha256 = "sha256-Un4LUBWVwbWYK4rZY2+gdk6Zi+n36Xawma8Dok2Sa0U=";
+    sha256 = "sha256-FVHOjW5SEShxTPPd4IuEfPV6vvqr0RepV976eJmxqwM=";
   };
 
   buildInputs = [ openssl ];
diff --git a/pkgs/tools/security/browserpass/default.nix b/pkgs/tools/security/browserpass/default.nix
index ba96e2a70fe5d..31a0bd63db032 100644
--- a/pkgs/tools/security/browserpass/default.nix
+++ b/pkgs/tools/security/browserpass/default.nix
@@ -1,18 +1,18 @@
 { lib, buildGoModule, fetchFromGitHub, makeWrapper, gnupg }:
 buildGoModule rec {
   pname = "browserpass";
-  version = "3.0.10";
+  version = "3.1.0";
 
   src = fetchFromGitHub {
     owner = "browserpass";
     repo = "browserpass-native";
     rev = version;
-    sha256 = "8eAwUwcRTnhVDkQc3HsvTP0TqC4LfVrUelxdbJxe9t0=";
+    sha256 = "sha256-UZzOPRRiCUIG7uSSp9AEPMDN/+4cgyK47RhrI8oUx8U=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
 
-  vendorSha256 = "gWXcYyIp86b/Pn6vj7qBj/VZS9rTr4weVw0YWmg+36c=";
+  vendorHash = "sha256-CjuH4ANP2bJDeA+o+1j+obbtk5/NVLet/OFS3Rms4r0=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/security/goverview/default.nix b/pkgs/tools/security/goverview/default.nix
new file mode 100644
index 0000000000000..77f46526d95d6
--- /dev/null
+++ b/pkgs/tools/security/goverview/default.nix
@@ -0,0 +1,34 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
+
+buildGoModule rec {
+  pname = "goverview";
+  version = "1.0.1";
+
+  src = fetchFromGitHub {
+    owner = "j3ssie";
+    repo = "goverview";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-IgvpMuDwMK9IdPs1IRbPbpgr7xZuDX3boVT5d7Lb+3w=";
+  };
+
+  vendorHash = "sha256-i/m2s9e8PDfGmguNihynVI3Y7nAXC4weoWFXOwUVDSE=";
+
+  ldflags = [
+    "-w"
+    "-s"
+  ];
+
+  # Tests require network access
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Tool to get an overview of the list of URLs";
+    homepage = "https://github.com/j3ssie/goverview";
+    changelog = "https://github.com/j3ssie/goverview/releases/tag/v${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/tools/security/step-cli/default.nix b/pkgs/tools/security/step-cli/default.nix
index 344fcfb2cff6a..e79e8264a1997 100644
--- a/pkgs/tools/security/step-cli/default.nix
+++ b/pkgs/tools/security/step-cli/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "step-cli";
-  version = "0.23.3";
+  version = "0.23.4";
 
   src = fetchFromGitHub {
     owner = "smallstep";
     repo = "cli";
     rev = "refs/tags/v${version}";
-    hash = "sha256-gJsezi7yczVagR7faQvehyGWW6E7sfDXrJEVdsUSSp0=";
+    hash = "sha256-RNuYqmfMrIrWodrn7lpM0YO+HVxz+gKr5IregRqo5ak=";
   };
 
   ldflags = [
@@ -25,7 +25,7 @@ buildGoModule rec {
     rm command/certificate/remote_test.go
   '';
 
-  vendorHash = "sha256-YsZGs5/QQLdnXOeEnDXevlnJrOBoLkdYqTj2ZIoUOkA=";
+  vendorHash = "sha256-drIVwsqgJsYDXSuu5AhnBnKwwgkhVyNS/HS9FcoJeLM=";
 
   meta = with lib; {
     description = "A zero trust swiss army knife for working with X509, OAuth, JWT, OATH OTP, etc";
diff --git a/pkgs/tools/system/zfxtop/default.nix b/pkgs/tools/system/zfxtop/default.nix
index 79a88ade3dde3..9b5489e0dce48 100644
--- a/pkgs/tools/system/zfxtop/default.nix
+++ b/pkgs/tools/system/zfxtop/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "zfxtop";
-  version = "0.2.1";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "ssleert";
     repo = "zfxtop";
     rev = version;
-    hash = "sha256-9o32sryffcCt/sBnaT5QzD5oLRfJHgq1yKP8d0pk2JQ=";
+    hash = "sha256-auq5NvpI7De9/QBUDPFtXwsAeX/D2RmlVaKe/lrs1MQ=";
   };
 
-  vendorHash = "sha256-H1X7j77Wp8ipgNTMZbFwoSA7NrILahFK8YwoP1W3h2c=";
+  vendorHash = "sha256-VKBRgDu9xVbZrC5fadkdFjd1OETNwaxgraRnA34ETzE=";
 
   meta = with lib; {
     description = "fetch top for gen Z with X written by bubbletea enjoyer";
diff --git a/pkgs/tools/text/csvquote/csvquote-path.patch b/pkgs/tools/text/csvquote/csvquote-path.patch
new file mode 100644
index 0000000000000..a3f87055f2380
--- /dev/null
+++ b/pkgs/tools/text/csvquote/csvquote-path.patch
@@ -0,0 +1,14 @@
+--- a/csvheader
++++ b/csvheader
+@@ -29,10 +29,6 @@ while getopts "d:tq:r:" arg; do
+     esac
+ done
+ 
+-CSVQUOTE=`which csvquote` || CSVQUOTE="./csvquote"
+-if [ ! -f $CSVQUOTE ]; then
+-    echo "csvquote program not found. exiting"
+-    exit 1
+-fi
++CSVQUOTE=@out@/bin/csvquote
+ 
+ $CSVQUOTE $@ | head -n 1 | tr "$DEL" '\n' | nl -ba | $CSVQUOTE -u -d "$DEL" -q "$QUO" -r "$REC"
diff --git a/pkgs/tools/text/csvquote/default.nix b/pkgs/tools/text/csvquote/default.nix
new file mode 100644
index 0000000000000..2812de2084121
--- /dev/null
+++ b/pkgs/tools/text/csvquote/default.nix
@@ -0,0 +1,47 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, patsh
+}:
+
+stdenv.mkDerivation rec {
+  pname = "csvquote";
+  version = "0.1.5";
+
+  src = fetchFromGitHub {
+    owner = "dbro";
+    repo = "csvquote";
+    rev = "v${version}";
+    hash = "sha256-847JAoDEfA9K4LB8z9cqSw+GTImqmITBylB/4odLDb0=";
+  };
+
+  patches = [
+    # patch csvheader to use csvquote from the derivation
+    ./csvquote-path.patch
+  ];
+
+  nativeBuildInputs = [
+    patsh
+  ];
+
+  makeFlags = [
+    "BINDIR=$(out)/bin"
+  ];
+
+  preInstall = ''
+    mkdir -p "$out/bin"
+  '';
+
+  postInstall = ''
+    substituteAllInPlace $out/bin/csvheader
+    patsh $out/bin/csvheader -fs ${builtins.storeDir}
+  '';
+
+  meta = with lib; {
+    description = "Enables common unix utlities like cut, awk, wc, head to work correctly with csv data containing delimiters and newlines";
+    homepage = "https://github.com/dbro/csvquote";
+    license = licenses.mit;
+    maintainers = with maintainers; [ figsoda ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/tools/text/mdbook-katex/default.nix b/pkgs/tools/text/mdbook-katex/default.nix
index bb0db2740d33f..40999bc71ebb2 100644
--- a/pkgs/tools/text/mdbook-katex/default.nix
+++ b/pkgs/tools/text/mdbook-katex/default.nix
@@ -2,14 +2,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mdbook-katex";
-  version = "0.3.9";
+  version = "0.3.10";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-FsKHGw/6n/8eCJh1XatNsw3iCzD+siHdJ3i0dNKD5Go=";
+    hash = "sha256-oGefjf4URmE0i6mOjpZfBcSh280O+IvrAhu3vFAyntQ=";
   };
 
-  cargoHash = "sha256-nyLWbwruzQeyPGkVuMiRCTHtFE+E9nQ57ZMXxqIcLxE=";
+  cargoHash = "sha256-tkMdxkJcvmDSH2ree1nol1JlKKhI5G4x9x5Hs0peKI8=";
 
   OPENSSL_DIR = "${lib.getDev openssl}";
   OPENSSL_LIB_DIR = "${lib.getLib openssl}/lib";
diff --git a/pkgs/tools/text/vale/default.nix b/pkgs/tools/text/vale/default.nix
index 20c9226efd9f2..f1aaf769f66de 100644
--- a/pkgs/tools/text/vale/default.nix
+++ b/pkgs/tools/text/vale/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "vale";
-  version = "2.23.3";
+  version = "2.24.0";
 
   subPackages = [ "cmd/vale" ];
   outputs = [ "out" "data" ];
@@ -11,7 +11,7 @@ buildGoModule rec {
     owner = "errata-ai";
     repo = "vale";
     rev = "v${version}";
-    hash = "sha256-M4tq/gUpI0tGMJJOHE2TtGIbFzbv9/pP6yZGDf68VHI=";
+    hash = "sha256-mUZ9ktqy6zLwPNjr8raJHwn6/UL4kzlT1baE+HrwPgo=";
   };
 
   vendorHash = "sha256-ZgBt4BgZWViNqYCuqb/Wt1zVjFM9h1UsmsYox7kMJ1A=";
diff --git a/pkgs/tools/text/xml/html-xml-utils/default.nix b/pkgs/tools/text/xml/html-xml-utils/default.nix
index 05c9a16ad38f2..4e2566e5c5253 100644
--- a/pkgs/tools/text/xml/html-xml-utils/default.nix
+++ b/pkgs/tools/text/xml/html-xml-utils/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "html-xml-utils";
-  version = "8.4";
+  version = "8.5";
 
   src = fetchurl {
     url = "https://www.w3.org/Tools/HTML-XML-utils/${pname}-${version}.tar.gz";
-    sha256 = "sha256-QbubFOH0zWEC4/jft55xRqJMCWk4aYcxZcQhdppX0Tc=";
+    sha256 = "sha256-8gpGrE7TDQKM14R25fIPXikXqVy3vOfffxfY+z5Peec=";
   };
 
   buildInputs = [curl libiconv];
diff --git a/pkgs/tools/typesetting/tex/texlive/bin.nix b/pkgs/tools/typesetting/tex/texlive/bin.nix
index 6876e4090074c..255c208783f97 100644
--- a/pkgs/tools/typesetting/tex/texlive/bin.nix
+++ b/pkgs/tools/typesetting/tex/texlive/bin.nix
@@ -30,6 +30,14 @@ let
       for i in texk/kpathsea/mktex*; do
         sed -i '/^mydir=/d' "$i"
       done
+
+      # ST_NLINK_TRICK causes kpathsea to treat folders with no real subfolders
+      # as leaves, even if they contain symlinks to other folders; must be
+      # disabled to work correctly with the nix store", see section 5.3.6
+      # “Subdirectory expansion” of the kpathsea manual
+      # http://mirrors.ctan.org/systems/doc/kpathsea/kpathsea.pdf for more
+      # details
+      sed -i '/^#define ST_NLINK_TRICK/d' texk/kpathsea/config.h
     '';
 
     configureFlags = [
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 73165c25a672f..a9103cf91a26b 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -4317,6 +4317,8 @@ with pkgs;
 
   csvkit = callPackage ../tools/text/csvkit { };
 
+  csvquote = callPackage ../tools/text/csvquote { };
+
   csvtool = callPackage ../development/ocaml-modules/csv/csvtool.nix { };
 
   csv2latex = callPackage ../tools/misc/csv2latex { };
@@ -15951,6 +15953,9 @@ with pkgs;
   cargo-pgx = callPackage ../development/tools/rust/cargo-pgx {
     inherit (darwin.apple_sdk.frameworks) Security;
   };
+  buildPgxExtension = callPackage ../development/tools/rust/cargo-pgx/buildPgxExtension.nix {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
   cargo-release = callPackage ../development/tools/rust/cargo-release { };
   cargo-rr = callPackage ../development/tools/rust/cargo-rr { };
   cargo-tarpaulin = callPackage ../development/tools/analysis/cargo-tarpaulin {
@@ -26621,6 +26626,8 @@ with pkgs;
 
   govendor = callPackage ../development/tools/govendor { };
 
+  goverview = callPackage ../tools/security/goverview { };
+
   go-tools = callPackage ../development/tools/go-tools { };
 
   gotest = callPackage ../development/tools/gotest { };
author	github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2023-03-12 00:13:51 +0000
committer	GitHub <noreply@github.com>	2023-03-12 00:13:51 +0000
commit	f2032fa12b9143fc1ae8dd64c530e725fa013e0b (patch)
tree	be57a57ea48493c91137a18400078ae2ccdc137a /pkgs
parent	f2ae2be316594098fee7140ee6d151e8c05cd0a5 (diff)
parent	8b6900dc2ff916fe0c8b6ed250f1ef55d9962bb2 (diff)