about summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--.github/CODEOWNERS1
-rw-r--r--.github/workflows/backport.yml12
-rw-r--r--.github/workflows/update-terraform-providers.yml6
-rw-r--r--CONTRIBUTING.md5
-rw-r--r--doc/builders/special/darwin-builder.section.md3
-rw-r--r--doc/doc-support/default.nix1
-rw-r--r--doc/doc-support/lib-function-docs.nix6
-rw-r--r--doc/doc-support/lib-function-locations.nix16
-rw-r--r--doc/languages-frameworks/python.section.md16
-rw-r--r--lib/default.nix3
-rw-r--r--lib/path/README.md196
-rw-r--r--lib/path/default.nix218
-rw-r--r--lib/path/tests/default.nix34
-rw-r--r--lib/path/tests/generate.awk64
-rw-r--r--lib/path/tests/prop.nix60
-rwxr-xr-xlib/path/tests/prop.sh179
-rw-r--r--lib/path/tests/unit.nix125
-rw-r--r--lib/systems/default.nix16
-rw-r--r--lib/systems/inspect.nix1
-rw-r--r--lib/tests/release.nix3
-rw-r--r--maintainers/maintainer-list.nix15
-rw-r--r--nixos/doc/manual/from_md/release-notes/rl-2305.section.xml7
-rw-r--r--nixos/doc/manual/release-notes/rl-2305.section.md2
-rw-r--r--nixos/modules/profiles/macos-builder.nix30
-rw-r--r--nixos/modules/programs/gnupg.nix2
-rw-r--r--nixos/modules/programs/nix-ld.nix29
-rw-r--r--nixos/modules/services/desktops/pipewire/daemon/jack.conf.json25
-rw-r--r--nixos/modules/services/desktops/pipewire/daemon/pipewire-pulse.conf.json15
-rw-r--r--nixos/modules/services/desktops/pipewire/daemon/pipewire.conf.json8
-rw-r--r--nixos/modules/services/misc/gitea.nix7
-rw-r--r--nixos/modules/services/misc/paperless.nix21
-rw-r--r--nixos/modules/services/monitoring/parsedmarc.md1
-rw-r--r--nixos/modules/services/monitoring/parsedmarc.nix46
-rw-r--r--nixos/modules/services/monitoring/parsedmarc.xml7
-rw-r--r--nixos/modules/services/networking/ntp/chrony.nix56
-rw-r--r--nixos/modules/services/web-apps/snipe-it.nix5
-rw-r--r--nixos/modules/services/web-servers/nginx/default.nix2
-rw-r--r--nixos/modules/services/x11/desktop-managers/plasma5.nix11
-rw-r--r--nixos/modules/services/x11/window-managers/i3.nix3
-rw-r--r--nixos/modules/virtualisation/waydroid.nix6
-rw-r--r--nixos/tests/paperless.nix4
-rw-r--r--nixos/tests/parsedmarc/default.nix1
-rw-r--r--pkgs/applications/audio/bitwig-studio/bitwig-studio4.nix50
-rw-r--r--pkgs/applications/audio/famistudio/default.nix4
-rw-r--r--pkgs/applications/audio/mousai/default.nix2
-rw-r--r--pkgs/applications/audio/ncspot/default.nix6
-rw-r--r--pkgs/applications/audio/ocenaudio/default.nix4
-rw-r--r--pkgs/applications/audio/qpwgraph/default.nix4
-rw-r--r--pkgs/applications/audio/rosegarden/default.nix4
-rw-r--r--pkgs/applications/audio/spek/default.nix13
-rw-r--r--pkgs/applications/audio/spotifyd/default.nix6
-rw-r--r--pkgs/applications/audio/strawberry/default.nix4
-rw-r--r--pkgs/applications/editors/l3afpad/default.nix25
-rw-r--r--pkgs/applications/editors/lite-xl/default.nix4
-rw-r--r--pkgs/applications/editors/molsketch/default.nix40
-rw-r--r--pkgs/applications/editors/vim/plugins/generated.nix164
-rw-r--r--pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix20
-rwxr-xr-xpkgs/applications/editors/vim/plugins/nvim-treesitter/update.py7
-rwxr-xr-xpkgs/applications/editors/vim/plugins/update.py12
-rw-r--r--pkgs/applications/editors/vim/plugins/vim-plugin-names2
-rw-r--r--pkgs/applications/emulators/bsnes/ares/default.nix3
-rw-r--r--pkgs/applications/emulators/melonDS/default.nix24
-rw-r--r--pkgs/applications/emulators/wibo/default.nix6
-rw-r--r--pkgs/applications/gis/saga/default.nix4
-rw-r--r--pkgs/applications/graphics/blockbench-electron/default.nix10
-rw-r--r--pkgs/applications/graphics/eyedropper/default.nix8
-rw-r--r--pkgs/applications/graphics/openimageio/2.x.nix21
-rw-r--r--pkgs/applications/misc/grip/default.nix4
-rw-r--r--pkgs/applications/misc/josm/default.nix6
-rw-r--r--pkgs/applications/misc/keepass-diff/default.nix22
-rw-r--r--pkgs/applications/misc/librecad/default.nix49
-rw-r--r--pkgs/applications/misc/nwg-dock/default.nix6
-rw-r--r--pkgs/applications/misc/scli/default.nix6
-rw-r--r--pkgs/applications/misc/termpdf.py/default.nix21
-rw-r--r--pkgs/applications/misc/yubioath-flutter/default.nix57
-rw-r--r--pkgs/applications/misc/yubioath-flutter/helper.nix2
-rw-r--r--pkgs/applications/networking/browsers/librewolf/src.json10
-rw-r--r--pkgs/applications/networking/browsers/palemoon/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/crc/default.nix29
-rwxr-xr-xpkgs/applications/networking/cluster/crc/update.sh12
-rw-r--r--pkgs/applications/networking/cluster/kube-score/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/kubent/default.nix6
-rw-r--r--pkgs/applications/networking/cluster/terraform-providers/providers.json10
-rwxr-xr-xpkgs/applications/networking/cluster/terraform-providers/update-provider2
-rw-r--r--pkgs/applications/networking/flexget/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix4
-rw-r--r--pkgs/applications/networking/libcoap/default.nix4
-rw-r--r--pkgs/applications/networking/mailreaders/tutanota-desktop/default.nix4
-rw-r--r--pkgs/applications/networking/msmtp/default.nix1
-rw-r--r--pkgs/applications/networking/protonmail-bridge/default.nix6
-rw-r--r--pkgs/applications/networking/remote/xrdp/default.nix14
-rw-r--r--pkgs/applications/networking/soapui/default.nix12
-rw-r--r--pkgs/applications/networking/syncthing/default.nix6
-rw-r--r--pkgs/applications/office/ledger/default.nix7
-rw-r--r--pkgs/applications/office/paperless-ngx/default.nix2
-rw-r--r--pkgs/applications/office/qownnotes/default.nix4
-rw-r--r--pkgs/applications/radio/ax25-apps/default.nix33
-rw-r--r--pkgs/applications/science/biology/igv/default.nix4
-rw-r--r--pkgs/applications/science/electronics/dataexplorer/default.nix9
-rw-r--r--pkgs/applications/version-management/deepgit/default.nix86
-rw-r--r--pkgs/applications/version-management/gitea/default.nix6
-rw-r--r--pkgs/applications/video/mkvtoolnix/default.nix4
-rw-r--r--pkgs/applications/video/openshot-qt/libopenshot-audio.nix4
-rw-r--r--pkgs/applications/virtualization/nixpacks/default.nix6
-rw-r--r--pkgs/applications/virtualization/pods/default.nix6
-rw-r--r--pkgs/applications/window-managers/dwm/dwm-status.nix7
-rw-r--r--pkgs/applications/window-managers/i3/default.nix4
-rw-r--r--pkgs/applications/window-managers/i3/gaps.nix29
-rw-r--r--pkgs/applications/window-managers/river/default.nix10
-rw-r--r--pkgs/data/fonts/dm-sans/default.nix21
-rw-r--r--pkgs/data/fonts/iosevka/bin.nix2
-rw-r--r--pkgs/data/fonts/iosevka/variants.nix184
-rw-r--r--pkgs/data/fonts/noto-fonts/default.nix197
-rw-r--r--pkgs/data/icons/whitesur-icon-theme/default.nix2
-rw-r--r--pkgs/desktops/gnome/core/gnome-control-center/default.nix2
-rw-r--r--pkgs/development/compilers/edk2/default.nix2
-rw-r--r--pkgs/development/compilers/gcc-arm-embedded/12/default.nix52
-rw-r--r--pkgs/development/compilers/go/1.20.nix180
-rw-r--r--pkgs/development/compilers/ispc/default.nix7
-rw-r--r--pkgs/development/compilers/julia/1.8.nix2
-rw-r--r--pkgs/development/compilers/llvm/8/lldb/default.nix17
-rw-r--r--pkgs/development/compilers/llvm/8/lldb/lldb-gdb-remote-no-libcompress.patch30
-rw-r--r--pkgs/development/compilers/llvm/9/lldb/default.nix23
-rw-r--r--pkgs/development/compilers/llvm/9/lldb/lldb-gdb-remote-no-libcompress.patch17
-rw-r--r--pkgs/development/compilers/shaderc/default.nix16
-rw-r--r--pkgs/development/compilers/tinycc/default.nix7
-rw-r--r--pkgs/development/embedded/fpga/openfpgaloader/default.nix4
-rw-r--r--pkgs/development/interpreters/evcxr/default.nix6
-rw-r--r--pkgs/development/interpreters/ruby/default.nix2
-rw-r--r--pkgs/development/libraries/ada/spark2014/default.nix7
-rw-r--r--pkgs/development/libraries/aws-c-http/default.nix4
-rw-r--r--pkgs/development/libraries/aws-c-mqtt/default.nix4
-rw-r--r--pkgs/development/libraries/aws-c-s3/default.nix4
-rw-r--r--pkgs/development/libraries/aws-checksums/default.nix4
-rw-r--r--pkgs/development/libraries/gnome-online-accounts/default.nix2
-rw-r--r--pkgs/development/libraries/gtksourceview/5.x.nix8
-rw-r--r--pkgs/development/libraries/gvfs/default.nix2
-rw-r--r--pkgs/development/libraries/jxrlib/default.nix28
-rw-r--r--pkgs/development/libraries/libftdi/1.x.nix1
-rw-r--r--pkgs/development/libraries/libgpg-error/default.nix12
-rw-r--r--pkgs/development/libraries/libksi/default.nix4
-rw-r--r--pkgs/development/libraries/libmilter/darwin.patch24
-rw-r--r--pkgs/development/libraries/libmilter/default.nix6
-rw-r--r--pkgs/development/libraries/libmilter/glibc-2.30.patch44
-rw-r--r--pkgs/development/libraries/libpg_query/default.nix4
-rw-r--r--pkgs/development/libraries/libplacebo/default.nix3
-rw-r--r--pkgs/development/libraries/librest/1.0.nix2
-rw-r--r--pkgs/development/libraries/libvgm/default.nix6
-rw-r--r--pkgs/development/libraries/minizip-ng/default.nix12
-rw-r--r--pkgs/development/libraries/nss/generic.nix6
-rw-r--r--pkgs/development/libraries/nv-codec-headers/11_x.nix4
-rw-r--r--pkgs/development/libraries/opencolorio/default.nix48
-rw-r--r--pkgs/development/libraries/s2n-tls/default.nix4
-rw-r--r--pkgs/development/libraries/tinygltf/default.nix4
-rw-r--r--pkgs/development/libraries/tkrzw/default.nix3
-rw-r--r--pkgs/development/libraries/wolfssl/default.nix4
-rw-r--r--pkgs/development/nim-packages/base32/default.nix18
-rw-r--r--pkgs/development/nim-packages/cbor/default.nix21
-rw-r--r--pkgs/development/nim-packages/nimSHA2/default.nix18
-rw-r--r--pkgs/development/nim-packages/npeg/default.nix18
-rw-r--r--pkgs/development/nim-packages/taps/default.nix19
-rw-r--r--pkgs/development/nim-packages/tkrzw/default.nix21
-rw-r--r--pkgs/development/ocaml-modules/base64/default.nix8
-rw-r--r--pkgs/development/ocaml-modules/domainslib/default.nix29
-rw-r--r--pkgs/development/ocaml-modules/dscheck/default.nix28
-rw-r--r--pkgs/development/ocaml-modules/lockfree/default.nix29
-rw-r--r--pkgs/development/ocaml-modules/mrmime/default.nix9
-rw-r--r--pkgs/development/ocaml-modules/oseq/default.nix33
-rw-r--r--pkgs/development/ocaml-modules/parany/default.nix24
-rw-r--r--pkgs/development/ocaml-modules/piaf/default.nix4
-rw-r--r--pkgs/development/ocaml-modules/ppx_deriving/default.nix3
-rw-r--r--pkgs/development/python-modules/afdko/default.nix4
-rw-r--r--pkgs/development/python-modules/aiortm/default.nix9
-rw-r--r--pkgs/development/python-modules/aiounifi/default.nix6
-rw-r--r--pkgs/development/python-modules/azure-storage-blob/default.nix25
-rw-r--r--pkgs/development/python-modules/cirq-google/default.nix2
-rw-r--r--pkgs/development/python-modules/django/4.nix4
-rw-r--r--pkgs/development/python-modules/google-api-core/default.nix26
-rw-r--r--pkgs/development/python-modules/google-auth-httplib2/default.nix9
-rw-r--r--pkgs/development/python-modules/google-auth/default.nix13
-rw-r--r--pkgs/development/python-modules/google-cloud-access-context-manager/default.nix4
-rw-r--r--pkgs/development/python-modules/google-cloud-appengine-logging/default.nix9
-rw-r--r--pkgs/development/python-modules/google-cloud-asset/default.nix11
-rw-r--r--pkgs/development/python-modules/google-cloud-audit-log/default.nix18
-rw-r--r--pkgs/development/python-modules/google-cloud-automl/default.nix24
-rw-r--r--pkgs/development/python-modules/google-cloud-bigquery-datatransfer/default.nix19
-rw-r--r--pkgs/development/python-modules/google-cloud-bigquery-logging/default.nix9
-rw-r--r--pkgs/development/python-modules/google-cloud-bigquery-storage/default.nix28
-rw-r--r--pkgs/development/python-modules/google-cloud-bigquery/default.nix52
-rw-r--r--pkgs/development/python-modules/google-cloud-bigtable/default.nix13
-rw-r--r--pkgs/development/python-modules/google-cloud-compute/default.nix9
-rw-r--r--pkgs/development/python-modules/google-cloud-container/default.nix17
-rw-r--r--pkgs/development/python-modules/google-cloud-core/default.nix31
-rw-r--r--pkgs/development/python-modules/google-cloud-datacatalog/default.nix17
-rw-r--r--pkgs/development/python-modules/google-cloud-dataproc/default.nix7
-rw-r--r--pkgs/development/python-modules/google-cloud-datastore/default.nix11
-rw-r--r--pkgs/development/python-modules/google-cloud-dlp/default.nix21
-rw-r--r--pkgs/development/python-modules/google-cloud-dns/default.nix23
-rw-r--r--pkgs/development/python-modules/google-cloud-error-reporting/default.nix17
-rw-r--r--pkgs/development/python-modules/google-cloud-firestore/default.nix21
-rw-r--r--pkgs/development/python-modules/google-cloud-iam-logging/default.nix11
-rw-r--r--pkgs/development/python-modules/google-cloud-iam/default.nix23
-rw-r--r--pkgs/development/python-modules/google-cloud-iot/default.nix19
-rw-r--r--pkgs/development/python-modules/google-cloud-kms/default.nix32
-rw-r--r--pkgs/development/python-modules/google-cloud-language/default.nix15
-rw-r--r--pkgs/development/python-modules/google-cloud-logging/default.nix24
-rw-r--r--pkgs/development/python-modules/google-cloud-monitoring/default.nix18
-rw-r--r--pkgs/development/python-modules/google-cloud-org-policy/default.nix40
-rw-r--r--pkgs/development/python-modules/google-cloud-os-config/default.nix15
-rw-r--r--pkgs/development/python-modules/google-cloud-pubsub/default.nix21
-rw-r--r--pkgs/development/python-modules/google-cloud-redis/default.nix15
-rw-r--r--pkgs/development/python-modules/google-cloud-resource-manager/default.nix17
-rw-r--r--pkgs/development/python-modules/google-cloud-runtimeconfig/default.nix27
-rw-r--r--pkgs/development/python-modules/google-cloud-secret-manager/default.nix17
-rw-r--r--pkgs/development/python-modules/google-cloud-securitycenter/default.nix17
-rw-r--r--pkgs/development/python-modules/google-cloud-spanner/default.nix21
-rw-r--r--pkgs/development/python-modules/google-cloud-speech/default.nix11
-rw-r--r--pkgs/development/python-modules/google-cloud-storage/default.nix26
-rw-r--r--pkgs/development/python-modules/google-cloud-tasks/default.nix13
-rw-r--r--pkgs/development/python-modules/google-cloud-testutils/default.nix23
-rw-r--r--pkgs/development/python-modules/google-cloud-texttospeech/default.nix13
-rw-r--r--pkgs/development/python-modules/google-cloud-trace/default.nix13
-rw-r--r--pkgs/development/python-modules/google-cloud-translate/default.nix13
-rw-r--r--pkgs/development/python-modules/google-cloud-videointelligence/default.nix13
-rw-r--r--pkgs/development/python-modules/google-cloud-vision/default.nix13
-rw-r--r--pkgs/development/python-modules/google-cloud-websecurityscanner/default.nix15
-rw-r--r--pkgs/development/python-modules/google-resumable-media/default.nix31
-rw-r--r--pkgs/development/python-modules/hassil/default.nix13
-rw-r--r--pkgs/development/python-modules/kiwiki-client/default.nix42
-rw-r--r--pkgs/development/python-modules/osc-lib/default.nix1
-rw-r--r--pkgs/development/python-modules/plugwise/default.nix5
-rw-r--r--pkgs/development/python-modules/pykaleidescape/default.nix51
-rw-r--r--pkgs/development/python-modules/pytest-relaxed/default.nix47
-rw-r--r--pkgs/development/python-modules/python-arango/default.nix16
-rw-r--r--pkgs/development/python-modules/trezor/default.nix4
-rw-r--r--pkgs/development/python-modules/whois/default.nix4
-rw-r--r--pkgs/development/ruby-modules/bundler/default.nix4
-rw-r--r--pkgs/development/tools/comby/default.nix4
-rw-r--r--pkgs/development/tools/continuous-integration/woodpecker/cli.nix12
-rw-r--r--pkgs/development/tools/continuous-integration/woodpecker/common.nix6
-rw-r--r--pkgs/development/tools/continuous-integration/woodpecker/woodpecker-package.json3
-rw-r--r--pkgs/development/tools/database/timescaledb-tune/default.nix6
-rw-r--r--pkgs/development/tools/devd/default.nix26
-rw-r--r--pkgs/development/tools/esbuild/default.nix6
-rw-r--r--pkgs/development/tools/language-servers/nil/default.nix7
-rw-r--r--pkgs/development/tools/misc/highlight-assertions/default.nix8
-rw-r--r--pkgs/development/tools/misc/loccount/default.nix30
-rw-r--r--pkgs/development/tools/misc/ptags/default.nix6
-rw-r--r--pkgs/development/tools/ocaml/dune/3.nix4
-rw-r--r--pkgs/development/tools/ruff/default.nix6
-rw-r--r--pkgs/development/tools/winhelpcgi/default.nix23
-rw-r--r--pkgs/games/nanosaur/default.nix15
-rw-r--r--pkgs/games/nanosaur2/default.nix15
-rw-r--r--pkgs/games/otto-matic/default.nix17
-rw-r--r--pkgs/games/quakespasm/default.nix4
-rw-r--r--pkgs/games/rare/default.nix6
-rw-r--r--pkgs/os-specific/darwin/apple-sdk-11.0/private-frameworks.nix3
-rw-r--r--pkgs/os-specific/darwin/apple-sdk/default.nix2
-rw-r--r--pkgs/os-specific/linux/eudev/default.nix2
-rw-r--r--pkgs/os-specific/linux/kernel/linux-5.15.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-6.0.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-6.1.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-libre.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/zen-kernels.nix10
-rw-r--r--pkgs/os-specific/linux/waydroid/default.nix8
-rw-r--r--pkgs/servers/dcnnt/default.nix4
-rw-r--r--pkgs/servers/home-assistant/component-packages.nix7
-rw-r--r--pkgs/servers/http/jetty/default.nix4
-rw-r--r--pkgs/servers/http/unit/default.nix4
-rw-r--r--pkgs/servers/irc/inspircd/default.nix7
-rw-r--r--pkgs/servers/mattermost/default.nix11
-rw-r--r--pkgs/servers/monitoring/vmagent/default.nix4
-rw-r--r--pkgs/servers/nosql/redis/default.nix17
-rw-r--r--pkgs/servers/pocketbase/default.nix6
-rw-r--r--pkgs/servers/prowlarr/default.nix8
-rw-r--r--pkgs/servers/sql/pgbouncer/default.nix8
-rw-r--r--pkgs/servers/sql/pgpool/default.nix4
-rw-r--r--pkgs/servers/sql/postgresql/ext/pg_ivm.nix4
-rw-r--r--pkgs/servers/sql/postgresql/ext/pgroonga.nix4
-rw-r--r--pkgs/servers/sql/postgresql/ext/pgrouting.nix4
-rw-r--r--pkgs/servers/sql/postgresql/ext/plpgsql_check.nix4
-rw-r--r--pkgs/servers/tautulli/default.nix6
-rw-r--r--pkgs/servers/tidb/default.nix31
-rw-r--r--pkgs/servers/web-apps/bookstack/default.nix4
-rw-r--r--pkgs/stdenv/linux/default.nix91
-rw-r--r--pkgs/tools/X11/xpra/default.nix1
-rw-r--r--pkgs/tools/admin/trivy/default.nix6
-rw-r--r--pkgs/tools/audio/vgmtools/default.nix6
-rw-r--r--pkgs/tools/filesystems/garage/default.nix4
-rw-r--r--pkgs/tools/filesystems/juicefs/default.nix6
-rw-r--r--pkgs/tools/filesystems/xtreemfs/default.nix35
-rw-r--r--pkgs/tools/graphics/barcode/default.nix4
-rw-r--r--pkgs/tools/graphics/sanjuuni/default.nix44
-rw-r--r--pkgs/tools/inputmethods/remote-touchpad/default.nix10
-rw-r--r--pkgs/tools/misc/fend/default.nix6
-rw-r--r--pkgs/tools/misc/hoard/default.nix6
-rw-r--r--pkgs/tools/misc/mmctl/default.nix4
-rw-r--r--pkgs/tools/misc/moar/default.nix4
-rw-r--r--pkgs/tools/misc/nurl/default.nix16
-rw-r--r--pkgs/tools/misc/open-pdf-sign/default.nix4
-rw-r--r--pkgs/tools/misc/star-history/default.nix6
-rw-r--r--pkgs/tools/misc/yt-dlp/default.nix4
-rw-r--r--pkgs/tools/networking/cadaver/configure.patch20
-rw-r--r--pkgs/tools/networking/cadaver/default.nix44
-rw-r--r--pkgs/tools/networking/chrony/default.nix33
-rw-r--r--pkgs/tools/networking/chrony/makefile.patch23
-rw-r--r--pkgs/tools/networking/hans/default.nix4
-rw-r--r--pkgs/tools/networking/pathvector/default.nix6
-rw-r--r--pkgs/tools/networking/shadowsocks-rust/default.nix19
-rw-r--r--pkgs/tools/networking/ssh-askpass-fullscreen/default.nix4
-rw-r--r--pkgs/tools/networking/xray/default.nix6
-rw-r--r--pkgs/tools/nix/nixdoc/default.nix10
-rw-r--r--pkgs/tools/security/age/default.nix29
-rw-r--r--pkgs/tools/security/gnupg/23.nix3
-rw-r--r--pkgs/tools/security/metasploit/Gemfile2
-rw-r--r--pkgs/tools/security/metasploit/Gemfile.lock12
-rw-r--r--pkgs/tools/security/metasploit/default.nix4
-rw-r--r--pkgs/tools/security/metasploit/gemset.nix18
-rw-r--r--pkgs/tools/system/java-service-wrapper/default.nix4
-rw-r--r--pkgs/tools/text/d2/default.nix6
-rw-r--r--pkgs/tools/text/frawk/default.nix8
-rw-r--r--pkgs/tools/typesetting/sile/default.nix6
-rw-r--r--pkgs/top-level/aliases.nix1
-rw-r--r--pkgs/top-level/all-packages.nix59
-rw-r--r--pkgs/top-level/nim-packages.nix16
-rw-r--r--pkgs/top-level/ocaml-packages.nix8
-rw-r--r--pkgs/top-level/python-packages.nix4
-rw-r--r--pkgs/top-level/release-cross.nix15
-rw-r--r--pkgs/top-level/ruby-packages.nix8
329 files changed, 4257 insertions, 1470 deletions
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index be881b7f55482..5120eb4895f6c 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -28,6 +28,7 @@
 /lib/cli.nix                @edolstra @nbp @Profpatsch
 /lib/debug.nix              @edolstra @nbp @Profpatsch
 /lib/asserts.nix            @edolstra @nbp @Profpatsch
+/lib/path.*                 @infinisil @fricklerhandwerk
 
 # Nixpkgs Internals
 /default.nix                                     @nbp
diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
index da5cb5d2fa0c3..d5e78cda08646 100644
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@@ -14,23 +14,19 @@ permissions:
 jobs:
   backport:
     permissions:
-      contents: write  # for zeebe-io/backport-action to create branch
-      pull-requests: write  # for zeebe-io/backport-action to create PR to backport
+      contents: write # for korthout/backport-action to create branch
+      pull-requests: write # for korthout/backport-action to create PR to backport
     name: Backport Pull Request
     if: github.repository_owner == 'NixOS' && github.event.pull_request.merged == true && (github.event_name != 'labeled' || startsWith('backport', github.event.label.name))
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
         with:
-          # required to find all branches
-          fetch-depth: 0
           ref: ${{ github.event.pull_request.head.sha }}
       - name: Create backport PRs
-        uses: zeebe-io/backport-action@v0.0.9
+        uses: korthout/backport-action@v1.0.0
         with:
-          # Config README: https://github.com/zeebe-io/backport-action#backport-action
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-          github_workspace: ${{ github.workspace }}
+          # Config README: https://github.com/korthout/backport-action#backport-action
           pull_description: |-
             Bot-based backport to `${target_branch}`, triggered by a label in #${pull_number}.
 
diff --git a/.github/workflows/update-terraform-providers.yml b/.github/workflows/update-terraform-providers.yml
index 3a6e0ad63e525..079147f7d7247 100644
--- a/.github/workflows/update-terraform-providers.yml
+++ b/.github/workflows/update-terraform-providers.yml
@@ -11,8 +11,8 @@ permissions:
 jobs:
   tf-providers:
     permissions:
-      contents: write  # for peter-evans/create-pull-request to create branch
-      pull-requests: write  # for peter-evans/create-pull-request to create a PR, for peter-evans/create-or-update-comment to create or update comment
+      contents: write # for peter-evans/create-pull-request to create branch
+      pull-requests: write # for peter-evans/create-pull-request to create a PR, for peter-evans/create-or-update-comment to create or update comment
     if: github.repository_owner == 'NixOS' && github.ref == 'refs/heads/master' # ensure workflow_dispatch only runs on master
     runs-on: ubuntu-latest
     steps:
@@ -25,6 +25,8 @@ jobs:
         run: |
           echo "title=terraform-providers: update $(date -u +"%Y-%m-%d")" >> $GITHUB_OUTPUT
       - name: update terraform-providers
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
           git config user.name "github-actions[bot]"
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index c6bc661c72b66..19108bb5a8fb6 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -38,11 +38,14 @@ Below is a short excerpt of some points in there:
     The old config generation system used impure shell scripts and could break in specific circumstances (see #1234).
 
 * `meta.description` should:
+  * Be short, just one sentence.
   * Be capitalized.
   * Not start with the package name.
-  * Not have a period at the end.
+    * More generally, it should not refer to the package name.
+  * Not end with a period (or any punctuation for that matter).
 * `meta.license` must be set and fit the upstream license.
   * If there is no upstream license, `meta.license` should default to `lib.licenses.unfree`.
+  * If in doubt, try to contact the upstream developers for clarification.
 * `meta.maintainers` must be set.
 
 See the nixpkgs manual for more details on [standard meta-attributes](https://nixos.org/nixpkgs/manual/#sec-standard-meta-attributes).
diff --git a/doc/builders/special/darwin-builder.section.md b/doc/builders/special/darwin-builder.section.md
index 205db14347aa2..af9de5751b2c1 100644
--- a/doc/builders/special/darwin-builder.section.md
+++ b/doc/builders/special/darwin-builder.section.md
@@ -39,7 +39,8 @@ nixos login:
 ```
 
 > Note: When you need to stop the VM, type `Ctrl`-`a` + `c` to open the `qemu`
-> prompt and then type `quit` followed by `Enter`
+> prompt and then type `system_powerdown` followed by `Enter`, or run `shutdown now`
+> as the `builder` user (e.g. `ssh -i keys/builder_ed25519 builder@localhost shutdown now`)
 
 To delegate builds to the remote builder, add the following options to your
 `nix.conf` file:
diff --git a/doc/doc-support/default.nix b/doc/doc-support/default.nix
index ec180064c35d8..e9cb96e37fdd5 100644
--- a/doc/doc-support/default.nix
+++ b/doc/doc-support/default.nix
@@ -12,6 +12,7 @@ let
     { name = "lists"; description = "list manipulation functions"; }
     { name = "debug"; description = "debugging functions"; }
     { name = "options"; description = "NixOS / nixpkgs option handling"; }
+    { name = "path"; description = "path functions"; }
     { name = "filesystem"; description = "filesystem functions"; }
     { name = "sources"; description = "source filtering functions"; }
     { name = "cli"; description = "command-line serialization functions"; }
diff --git a/doc/doc-support/lib-function-docs.nix b/doc/doc-support/lib-function-docs.nix
index d6fa08aa96205..cf218fa704017 100644
--- a/doc/doc-support/lib-function-docs.nix
+++ b/doc/doc-support/lib-function-docs.nix
@@ -10,7 +10,11 @@ with pkgs; stdenv.mkDerivation {
   installPhase = ''
     function docgen {
       # TODO: wrap lib.$1 in <literal>, make nixdoc not escape it
-      nixdoc -c "$1" -d "lib.$1: $2" -f "$1.nix" > "$out/$1.xml"
+      if [[ -e "../lib/$1.nix" ]]; then
+        nixdoc -c "$1" -d "lib.$1: $2" -f "$1.nix" > "$out/$1.xml"
+      else
+        nixdoc -c "$1" -d "lib.$1: $2" -f "$1/default.nix" > "$out/$1.xml"
+      fi
       echo "<xi:include href='$1.xml' />" >> "$out/index.xml"
     }
 
diff --git a/doc/doc-support/lib-function-locations.nix b/doc/doc-support/lib-function-locations.nix
index ae1123c63ad30..3ede09ba50f58 100644
--- a/doc/doc-support/lib-function-locations.nix
+++ b/doc/doc-support/lib-function-locations.nix
@@ -2,19 +2,21 @@
 let
   revision = pkgs.lib.trivial.revisionWithDefault (nixpkgs.revision or "master");
 
-  libDefPos = set:
-    builtins.map
-      (name: {
-        name = name;
+  libDefPos = prefix: set:
+    builtins.concatMap
+      (name: [{
+        name = builtins.concatStringsSep "." (prefix ++ [name]);
         location = builtins.unsafeGetAttrPos name set;
-      })
-      (builtins.attrNames set);
+      }] ++ nixpkgsLib.optionals
+        (builtins.length prefix == 0 && builtins.isAttrs set.${name})
+        (libDefPos (prefix ++ [name]) set.${name})
+      ) (builtins.attrNames set);
 
   libset = toplib:
     builtins.map
       (subsetname: {
         subsetname = subsetname;
-        functions = libDefPos toplib.${subsetname};
+        functions = libDefPos [] toplib.${subsetname};
       })
       (builtins.map (x: x.name) libsets);
 
diff --git a/doc/languages-frameworks/python.section.md b/doc/languages-frameworks/python.section.md
index ab5ba42895859..2f15d0f0468a4 100644
--- a/doc/languages-frameworks/python.section.md
+++ b/doc/languages-frameworks/python.section.md
@@ -570,7 +570,13 @@ test run would be:
 
 ```
   checkInputs = [ pytest ];
-  checkPhase = "pytest";
+  checkPhase = ''
+    runHook preCheck
+
+    pytest
+
+    runHook postCheck
+  '';
 ```
 
 However, many repositories' test suites do not translate well to nix's build
@@ -582,7 +588,11 @@ To filter tests using pytest, one can do the following:
   checkInputs = [ pytest ];
   # avoid tests which need additional data or touch network
   checkPhase = ''
+    runHook preCheck
+
     pytest tests/ --ignore=tests/integration -k 'not download and not update'
+
+    runHook postCheck
   '';
 ```
 
@@ -1408,7 +1418,11 @@ example of such a situation is when `py.test` is used.
     # assumes the tests are located in tests
     checkInputs = [ pytest ];
     checkPhase = ''
+      runHook preCheck
+
       py.test -k 'not function_name and not other_function' tests
+
+      runHook postCheck
     '';
   }
   ```
diff --git a/lib/default.nix b/lib/default.nix
index f0f136adbc41b..6e1da00badf61 100644
--- a/lib/default.nix
+++ b/lib/default.nix
@@ -27,7 +27,6 @@ let
     maintainers = import ../maintainers/maintainer-list.nix;
     teams = callLibs ../maintainers/team-list.nix;
     meta = callLibs ./meta.nix;
-    sources = callLibs ./sources.nix;
     versions = callLibs ./versions.nix;
 
     # module system
@@ -53,7 +52,9 @@ let
     fetchers = callLibs ./fetchers.nix;
 
     # Eval-time filesystem handling
+    path = callLibs ./path;
     filesystem = callLibs ./filesystem.nix;
+    sources = callLibs ./sources.nix;
 
     # back-compat aliases
     platforms = self.systems.doubles;
diff --git a/lib/path/README.md b/lib/path/README.md
new file mode 100644
index 0000000000000..87e552d120d77
--- /dev/null
+++ b/lib/path/README.md
@@ -0,0 +1,196 @@
+# Path library
+
+This document explains why the `lib.path` library is designed the way it is.
+
+The purpose of this library is to process [filesystem paths]. It does not read files from the filesystem.
+It exists to support the native Nix [path value type] with extra functionality.
+
+[filesystem paths]: https://en.m.wikipedia.org/wiki/Path_(computing)
+[path value type]: https://nixos.org/manual/nix/stable/language/values.html#type-path
+
+As an extension of the path value type, it inherits the same intended use cases and limitations:
+- Only use paths to access files at evaluation time, such as the local project source.
+- Paths cannot point to derivations, so they are unfit to represent dependencies.
+- A path implicitly imports the referenced files into the Nix store when interpolated to a string. Therefore paths are not suitable to access files at build- or run-time, as you risk importing the path from the evaluation system instead.
+
+Overall, this library works with two types of paths:
+- Absolute paths are represented with the Nix [path value type]. Nix automatically normalises these paths.
+- Subpaths are represented with the [string value type] since path value types don't support relative paths. This library normalises these paths as safely as possible. Absolute paths in strings are not supported.
+
+  A subpath refers to a specific file or directory within an absolute base directory.
+  It is a stricter form of a relative path, notably [without support for `..` components][parents] since those could escape the base directory.
+
+[string value type]: https://nixos.org/manual/nix/stable/language/values.html#type-string
+
+This library is designed to be as safe and intuitive as possible, throwing errors when operations are attempted that would produce surprising results, and giving the expected result otherwise.
+
+This library is designed to work well as a dependency for the `lib.filesystem` and `lib.sources` library components. Contrary to these library components, `lib.path` does not read any paths from the filesystem.
+
+This library makes only these assumptions about paths and no others:
+- `dirOf path` returns the path to the parent directory of `path`, unless `path` is the filesystem root, in which case `path` is returned.
+  - There can be multiple filesystem roots: `p == dirOf p` and `q == dirOf q` does not imply `p == q`.
+    - While there's only a single filesystem root in stable Nix, the [lazy trees feature](https://github.com/NixOS/nix/pull/6530) introduces [additional filesystem roots](https://github.com/NixOS/nix/pull/6530#discussion_r1041442173).
+- `path + ("/" + string)` returns the path to the `string` subdirectory in `path`.
+  - If `string` contains no `/` characters, then `dirOf (path + ("/" + string)) == path`.
+  - If `string` contains no `/` characters, then `baseNameOf (path + ("/" + string)) == string`.
+- `path1 == path2` returns `true` only if `path1` points to the same filesystem path as `path2`.
+
+Notably we do not make the assumption that we can turn paths into strings using `toString path`.
+
+## Design decisions
+
+Each subsection here contains a decision along with arguments and counter-arguments for (+) and against (-) that decision.
+
+### Leading dots for relative paths
+[leading-dots]: #leading-dots-for-relative-paths
+
+Observing: Since subpaths are a form of relative paths, they can have a leading `./` to indicate it being a relative path, this is generally not necessary for tools though.
+
+Considering: Paths should be as explicit, consistent and unambiguous as possible.
+
+Decision: Returned subpaths should always have a leading `./`.
+
+<details>
+<summary>Arguments</summary>
+
+- (+) In shells, just running `foo` as a command wouldn't execute the file `foo`, whereas `./foo` would execute the file. In contrast, `foo/bar` does execute that file without the need for `./`. This can lead to confusion about when a `./` needs to be prefixed. If a `./` is always included, this becomes a non-issue. This effectively then means that paths don't overlap with command names.
+- (+) Prepending with `./` makes the subpaths always valid as relative Nix path expressions.
+- (+) Using paths in command line arguments could give problems if not escaped properly, e.g. if a path was `--version`. This is not a problem with `./--version`. This effectively then means that paths don't overlap with GNU-style command line options.
+- (-) `./` is not required to resolve relative paths, resolution always has an implicit `./` as prefix.
+- (-) It's less noisy without the `./`, e.g. in error messages.
+  - (+) But similarly, it could be confusing whether something was even a path.
+    e.g. `foo` could be anything, but `./foo` is more clearly a path.
+- (+) Makes it more uniform with absolute paths (those always start with `/`).
+  - (-) That is not relevant for practical purposes.
+- (+) `find` also outputs results with `./`.
+  - (-) But only if you give it an argument of `.`. If you give it the argument `some-directory`, it won't prefix that.
+- (-) `realpath --relative-to` doesn't prefix relative paths with `./`.
+  - (+) There is no need to return the same result as `realpath`.
+
+</details>
+
+### Representation of the current directory
+[curdir]: #representation-of-the-current-directory
+
+Observing: The subpath that produces the base directory can be represented with `.` or `./` or `./.`.
+
+Considering: Paths should be as consistent and unambiguous as possible.
+
+Decision: It should be `./.`.
+
+<details>
+<summary>Arguments</summary>
+
+- (+) `./` would be inconsistent with [the decision to not persist trailing slashes][trailing-slashes].
+- (-) `.` is how `realpath` normalises paths.
+- (+) `.` can be interpreted as a shell command (it's a builtin for sourcing files in `bash` and `zsh`).
+- (+) `.` would be the only path without a `/`. It could not be used as a Nix path expression, since those require at least one `/` to be parsed as such.
+- (-) `./.` is rather long.
+  - (-) We don't require users to type this though, as it's only output by the library.
+    As inputs all three variants are supported for subpaths (and we can't do anything about absolute paths)
+- (-) `builtins.dirOf "foo" == "."`, so `.` would be consistent with that.
+- (+) `./.` is consistent with the [decision to have leading `./`][leading-dots].
+- (+) `./.` is a valid Nix path expression, although this property does not hold for every relative path or subpath.
+
+</details>
+
+### Subpath representation
+[relrepr]: #subpath-representation
+
+Observing: Subpaths such as `foo/bar` can be represented in various ways:
+- string: `"foo/bar"`
+- list with all the components: `[ "foo" "bar" ]`
+- attribute set: `{ type = "relative-path"; components = [ "foo" "bar" ]; }`
+
+Considering: Paths should be as safe to use as possible. We should generate string outputs in the library and not encourage users to do that themselves.
+
+Decision: Paths are represented as strings.
+
+<details>
+<summary>Arguments</summary>
+
+- (+) It's simpler for the users of the library. One doesn't have to convert a path a string before it can be used.
+  - (+) Naively converting the list representation to a string with `concatStringsSep "/"` would break for `[]`, requiring library users to be more careful.
+- (+) It doesn't encourage people to do their own path processing and instead use the library.
+  With a list representation it would seem easy to just use `lib.lists.init` to get the parent directory, but then it breaks for `.`, which would be represented as `[ ]`.
+- (+) `+` is convenient and doesn't work on lists and attribute sets.
+  - (-) Shouldn't use `+` anyways, we export safer functions for path manipulation.
+
+</details>
+
+### Parent directory
+[parents]: #parent-directory
+
+Observing: Relative paths can have `..` components, which refer to the parent directory.
+
+Considering: Paths should be as safe and unambiguous as possible.
+
+Decision: `..` path components in string paths are not supported, neither as inputs nor as outputs. Hence, string paths are called subpaths, rather than relative paths.
+
+<details>
+<summary>Arguments</summary>
+
+- (+) If we wanted relative paths to behave according to the "physical" interpretation (as a directory tree with relations between nodes), it would require resolving symlinks, since e.g. `foo/..` would not be the same as `.` if `foo` is a symlink.
+  - (-) The "logical" interpretation is also valid (treating paths as a sequence of names), and is used by some software. It is simpler, and not using symlinks at all is safer.
+  - (+) Mixing both models can lead to surprises.
+  - (+) We can't resolve symlinks without filesystem access.
+  - (+) Nix also doesn't support reading symlinks at evaluation time.
+  - (-) We could just not handle such cases, e.g. `equals "foo" "foo/bar/.. == false`. The paths are different, we don't need to check whether the paths point to the same thing.
+    - (+) Assume we said `relativeTo /foo /bar == "../bar"`. If this is used like `/bar/../foo` in the end, and `bar` turns out to be a symlink to somewhere else, this won't be accurate.
+      - (-) We could decide to not support such ambiguous operations, or mark them as such, e.g. the normal `relativeTo` will error on such a case, but there could be `extendedRelativeTo` supporting that.
+- (-) `..` are a part of paths, a path library should therefore support it.
+  - (+) If we can convincingly argue that all such use cases are better done e.g. with runtime tools, the library not supporting it can nudge people towards using those.
+- (-) We could allow "..", but only in the prefix.
+  - (+) Then we'd have to throw an error for doing `append /some/path "../foo"`, making it non-composable.
+  - (+) The same is for returning paths with `..`: `relativeTo /foo /bar => "../bar"` would produce a non-composable path.
+- (+) We argue that `..` is not needed at the Nix evaluation level, since we'd always start evaluation from the project root and don't go up from there.
+  - (+) `..` is supported in Nix paths, turning them into absolute paths.
+    - (-) This is ambiguous in the presence of symlinks.
+- (+) If you need `..` for building or runtime, you can use build-/run-time tooling to create those (e.g. `realpath` with `--relative-to`), or use absolute paths instead.
+  This also gives you the ability to correctly handle symlinks.
+
+</details>
+
+### Trailing slashes
+[trailing-slashes]: #trailing-slashes
+
+Observing: Subpaths can contain trailing slashes, like `foo/`, indicating that the path points to a directory and not a file.
+
+Considering: Paths should be as consistent as possible, there should only be a single normalisation for the same path.
+
+Decision: All functions remove trailing slashes in their results.
+
+<details>
+<summary>Arguments</summary>
+
+- (+) It allows normalisations to be unique, in that there's only a single normalisation for the same path. If trailing slashes were preserved, both `foo/bar` and `foo/bar/` would be valid but different normalisations for the same path.
+- Comparison to other frameworks to figure out the least surprising behavior:
+  - (+) Nix itself doesn't support trailing slashes when parsing and doesn't preserve them when appending paths.
+  - (-) [Rust's std::path](https://doc.rust-lang.org/std/path/index.html) does preserve them during [construction](https://doc.rust-lang.org/std/path/struct.Path.html#method.new).
+    - (+) Doesn't preserve them when returning individual [components](https://doc.rust-lang.org/std/path/struct.Path.html#method.components).
+    - (+) Doesn't preserve them when [canonicalizing](https://doc.rust-lang.org/std/path/struct.Path.html#method.canonicalize).
+  - (+) [Python 3's pathlib](https://docs.python.org/3/library/pathlib.html#module-pathlib) doesn't preserve them during [construction](https://docs.python.org/3/library/pathlib.html#pathlib.PurePath).
+    - Notably it represents the individual components as a list internally.
+  - (-) [Haskell's filepath](https://hackage.haskell.org/package/filepath-1.4.100.0) has [explicit support](https://hackage.haskell.org/package/filepath-1.4.100.0/docs/System-FilePath.html#g:6) for handling trailing slashes.
+    - (-) Does preserve them for [normalisation](https://hackage.haskell.org/package/filepath-1.4.100.0/docs/System-FilePath.html#v:normalise).
+  - (-) [NodeJS's Path library](https://nodejs.org/api/path.html) preserves trailing slashes for [normalisation](https://nodejs.org/api/path.html#pathnormalizepath).
+    - (+) For [parsing a path](https://nodejs.org/api/path.html#pathparsepath) into its significant elements, trailing slashes are not preserved.
+- (+) Nix's builtin function `dirOf` gives an unexpected result for paths with trailing slashes: `dirOf "foo/bar/" == "foo/bar"`.
+  Inconsistently, `baseNameOf` works correctly though: `baseNameOf "foo/bar/" == "bar"`.
+  - (-) We are writing a path library to improve handling of paths though, so we shouldn't use these functions and discourage their use.
+- (-) Unexpected result when normalising intermediate paths, like `relative.normalise ("foo" + "/") + "bar" == "foobar"`.
+  - (+) This is not a practical use case though.
+  - (+) Don't use `+` to append paths, this library has a `join` function for that.
+    - (-) Users might use `+` out of habit though.
+- (+) The `realpath` command also removes trailing slashes.
+- (+) Even with a trailing slash, the path is the same, it's only an indication that it's a directory.
+
+</details>
+
+## Other implementations and references
+
+- [Rust](https://doc.rust-lang.org/std/path/struct.Path.html)
+- [Python](https://docs.python.org/3/library/pathlib.html)
+- [Haskell](https://hackage.haskell.org/package/filepath-1.4.100.0/docs/System-FilePath.html)
+- [Nodejs](https://nodejs.org/api/path.html)
+- [POSIX.1-2017](https://pubs.opengroup.org/onlinepubs/9699919799/nframe.html)
diff --git a/lib/path/default.nix b/lib/path/default.nix
new file mode 100644
index 0000000000000..96a9244407bf5
--- /dev/null
+++ b/lib/path/default.nix
@@ -0,0 +1,218 @@
+# Functions for working with paths, see ./path.md
+{ lib }:
+let
+
+  inherit (builtins)
+    isString
+    split
+    match
+    ;
+
+  inherit (lib.lists)
+    length
+    head
+    last
+    genList
+    elemAt
+    ;
+
+  inherit (lib.strings)
+    concatStringsSep
+    substring
+    ;
+
+  inherit (lib.asserts)
+    assertMsg
+    ;
+
+  # Return the reason why a subpath is invalid, or `null` if it's valid
+  subpathInvalidReason = value:
+    if ! isString value then
+      "The given value is of type ${builtins.typeOf value}, but a string was expected"
+    else if value == "" then
+      "The given string is empty"
+    else if substring 0 1 value == "/" then
+      "The given string \"${value}\" starts with a `/`, representing an absolute path"
+    # We don't support ".." components, see ./path.md#parent-directory
+    else if match "(.*/)?\\.\\.(/.*)?" value != null then
+      "The given string \"${value}\" contains a `..` component, which is not allowed in subpaths"
+    else null;
+
+  # Split and normalise a relative path string into its components.
+  # Error for ".." components and doesn't include "." components
+  splitRelPath = path:
+    let
+      # Split the string into its parts using regex for efficiency. This regex
+      # matches patterns like "/", "/./", "/././", with arbitrarily many "/"s
+      # together. These are the main special cases:
+      # - Leading "./" gets split into a leading "." part
+      # - Trailing "/." or "/" get split into a trailing "." or ""
+      #   part respectively
+      #
+      # These are the only cases where "." and "" parts can occur
+      parts = split "/+(\\./+)*" path;
+
+      # `split` creates a list of 2 * k + 1 elements, containing the k +
+      # 1 parts, interleaved with k matches where k is the number of
+      # (non-overlapping) matches. This calculation here gets the number of parts
+      # back from the list length
+      # floor( (2 * k + 1) / 2 ) + 1 == floor( k + 1/2 ) + 1 == k + 1
+      partCount = length parts / 2 + 1;
+
+      # To assemble the final list of components we want to:
+      # - Skip a potential leading ".", normalising "./foo" to "foo"
+      # - Skip a potential trailing "." or "", normalising "foo/" and "foo/." to
+      #   "foo". See ./path.md#trailing-slashes
+      skipStart = if head parts == "." then 1 else 0;
+      skipEnd = if last parts == "." || last parts == "" then 1 else 0;
+
+      # We can now know the length of the result by removing the number of
+      # skipped parts from the total number
+      componentCount = partCount - skipEnd - skipStart;
+
+    in
+      # Special case of a single "." path component. Such a case leaves a
+      # componentCount of -1 due to the skipStart/skipEnd not verifying that
+      # they don't refer to the same character
+      if path == "." then []
+
+      # Generate the result list directly. This is more efficient than a
+      # combination of `filter`, `init` and `tail`, because here we don't
+      # allocate any intermediate lists
+      else genList (index:
+        # To get to the element we need to add the number of parts we skip and
+        # multiply by two due to the interleaved layout of `parts`
+        elemAt parts ((skipStart + index) * 2)
+      ) componentCount;
+
+  # Join relative path components together
+  joinRelPath = components:
+    # Always return relative paths with `./` as a prefix (./path.md#leading-dots-for-relative-paths)
+    "./" +
+    # An empty string is not a valid relative path, so we need to return a `.` when we have no components
+    (if components == [] then "." else concatStringsSep "/" components);
+
+in /* No rec! Add dependencies on this file at the top. */ {
+
+
+  /* Whether a value is a valid subpath string.
+
+  - The value is a string
+
+  - The string is not empty
+
+  - The string doesn't start with a `/`
+
+  - The string doesn't contain any `..` path components
+
+  Type:
+    subpath.isValid :: String -> Bool
+
+  Example:
+    # Not a string
+    subpath.isValid null
+    => false
+
+    # Empty string
+    subpath.isValid ""
+    => false
+
+    # Absolute path
+    subpath.isValid "/foo"
+    => false
+
+    # Contains a `..` path component
+    subpath.isValid "../foo"
+    => false
+
+    # Valid subpath
+    subpath.isValid "foo/bar"
+    => true
+
+    # Doesn't need to be normalised
+    subpath.isValid "./foo//bar/"
+    => true
+  */
+  subpath.isValid = value:
+    subpathInvalidReason value == null;
+
+
+  /* Normalise a subpath. Throw an error if the subpath isn't valid, see
+  `lib.path.subpath.isValid`
+
+  - Limit repeating `/` to a single one
+
+  - Remove redundant `.` components
+
+  - Remove trailing `/` and `/.`
+
+  - Add leading `./`
+
+  Laws:
+
+  - (Idempotency) Normalising multiple times gives the same result:
+
+        subpath.normalise (subpath.normalise p) == subpath.normalise p
+
+  - (Uniqueness) There's only a single normalisation for the paths that lead to the same file system node:
+
+        subpath.normalise p != subpath.normalise q -> $(realpath ${p}) != $(realpath ${q})
+
+  - Don't change the result when appended to a Nix path value:
+
+        base + ("/" + p) == base + ("/" + subpath.normalise p)
+
+  - Don't change the path according to `realpath`:
+
+        $(realpath ${p}) == $(realpath ${subpath.normalise p})
+
+  - Only error on invalid subpaths:
+
+        builtins.tryEval (subpath.normalise p)).success == subpath.isValid p
+
+  Type:
+    subpath.normalise :: String -> String
+
+  Example:
+    # limit repeating `/` to a single one
+    subpath.normalise "foo//bar"
+    => "./foo/bar"
+
+    # remove redundant `.` components
+    subpath.normalise "foo/./bar"
+    => "./foo/bar"
+
+    # add leading `./`
+    subpath.normalise "foo/bar"
+    => "./foo/bar"
+
+    # remove trailing `/`
+    subpath.normalise "foo/bar/"
+    => "./foo/bar"
+
+    # remove trailing `/.`
+    subpath.normalise "foo/bar/."
+    => "./foo/bar"
+
+    # Return the current directory as `./.`
+    subpath.normalise "."
+    => "./."
+
+    # error on `..` path components
+    subpath.normalise "foo/../bar"
+    => <error>
+
+    # error on empty string
+    subpath.normalise ""
+    => <error>
+
+    # error on absolute path
+    subpath.normalise "/foo"
+    => <error>
+  */
+  subpath.normalise = path:
+    assert assertMsg (subpathInvalidReason path == null)
+      "lib.path.subpath.normalise: Argument is not a valid subpath string: ${subpathInvalidReason path}";
+    joinRelPath (splitRelPath path);
+
+}
diff --git a/lib/path/tests/default.nix b/lib/path/tests/default.nix
new file mode 100644
index 0000000000000..9a31e42828f48
--- /dev/null
+++ b/lib/path/tests/default.nix
@@ -0,0 +1,34 @@
+{
+  nixpkgs ? ../../..,
+  system ? builtins.currentSystem,
+  pkgs ? import nixpkgs {
+    config = {};
+    overlays = [];
+    inherit system;
+  },
+  libpath ? ../..,
+  # Random seed
+  seed ? null,
+}:
+pkgs.runCommand "lib-path-tests" {
+  nativeBuildInputs = with pkgs; [
+    nix
+    jq
+    bc
+  ];
+} ''
+  # Needed to make Nix evaluation work
+  export NIX_STATE_DIR=$(mktemp -d)
+
+  cp -r ${libpath} lib
+  export TEST_LIB=$PWD/lib
+
+  echo "Running unit tests lib/path/tests/unit.nix"
+  nix-instantiate --eval lib/path/tests/unit.nix \
+    --argstr libpath "$TEST_LIB"
+
+  echo "Running property tests lib/path/tests/prop.sh"
+  bash lib/path/tests/prop.sh ${toString seed}
+
+  touch $out
+''
diff --git a/lib/path/tests/generate.awk b/lib/path/tests/generate.awk
new file mode 100644
index 0000000000000..811dd0c46d332
--- /dev/null
+++ b/lib/path/tests/generate.awk
@@ -0,0 +1,64 @@
+# Generate random path-like strings, separated by null characters.
+#
+# Invocation:
+#
+#     awk -f ./generate.awk -v <variable>=<value> | tr '\0' '\n'
+#
+# Customizable variables (all default to 0):
+# - seed: Deterministic random seed to use for generation
+# - count: Number of paths to generate
+# - extradotweight: Give extra weight to dots being generated
+# - extraslashweight: Give extra weight to slashes being generated
+# - extranullweight: Give extra weight to null being generated, making paths shorter
+BEGIN {
+  # Random seed, passed explicitly for reproducibility
+  srand(seed)
+
+  # Don't include special characters below 32
+  minascii = 32
+  # Don't include DEL at 128
+  maxascii = 127
+  upperascii = maxascii - minascii
+
+  # add extra weight for ., in addition to the one weight from the ascii range
+  upperdot = upperascii + extradotweight
+
+  # add extra weight for /, in addition to the one weight from the ascii range
+  upperslash = upperdot + extraslashweight
+
+  # add extra weight for null, indicating the end of the string
+  # Must be at least 1 to have strings end at all
+  total = upperslash + 1 + extranullweight
+
+  # new=1 indicates that it's a new string
+  new=1
+  while (count > 0) {
+
+    # Random integer between [0, total)
+    value = int(rand() * total)
+
+    if (value < upperascii) {
+      # Ascii range
+      printf("%c", value + minascii)
+      new=0
+
+    } else if (value < upperdot) {
+      # Dot range
+      printf "."
+      new=0
+
+    } else if (value < upperslash) {
+      # If it's the start of a new path, only generate a / in 10% of cases
+      # This is always an invalid subpath, which is not a very interesting case
+      if (new && rand() > 0.1) continue
+      printf "/"
+
+    } else {
+      # Do not generate empty strings
+      if (new) continue
+      printf "\x00"
+      count--
+      new=1
+    }
+  }
+}
diff --git a/lib/path/tests/prop.nix b/lib/path/tests/prop.nix
new file mode 100644
index 0000000000000..67e5c1e9d61c7
--- /dev/null
+++ b/lib/path/tests/prop.nix
@@ -0,0 +1,60 @@
+# Given a list of path-like strings, check some properties of the path library
+# using those paths and return a list of attribute sets of the following form:
+#
+#     { <string> = <lib.path.subpath.normalise string>; }
+#
+# If `normalise` fails to evaluate, the attribute value is set to `""`.
+# If not, the resulting value is normalised again and an appropriate attribute set added to the output list.
+{
+  # The path to the nixpkgs lib to use
+  libpath,
+  # A flat directory containing files with randomly-generated
+  # path-like values
+  dir,
+}:
+let
+  lib = import libpath;
+
+  # read each file into a string
+  strings = map (name:
+    builtins.readFile (dir + "/${name}")
+  ) (builtins.attrNames (builtins.readDir dir));
+
+  inherit (lib.path.subpath) normalise isValid;
+  inherit (lib.asserts) assertMsg;
+
+  normaliseAndCheck = str:
+    let
+      originalValid = isValid str;
+
+      tryOnce = builtins.tryEval (normalise str);
+      tryTwice = builtins.tryEval (normalise tryOnce.value);
+
+      absConcatOrig = /. + ("/" + str);
+      absConcatNormalised = /. + ("/" + tryOnce.value);
+    in
+      # Check the lib.path.subpath.normalise property to only error on invalid subpaths
+      assert assertMsg
+        (originalValid -> tryOnce.success)
+        "Even though string \"${str}\" is valid as a subpath, the normalisation for it failed";
+      assert assertMsg
+        (! originalValid -> ! tryOnce.success)
+        "Even though string \"${str}\" is invalid as a subpath, the normalisation for it succeeded";
+
+      # Check normalisation idempotency
+      assert assertMsg
+        (originalValid -> tryTwice.success)
+        "For valid subpath \"${str}\", the normalisation \"${tryOnce.value}\" was not a valid subpath";
+      assert assertMsg
+        (originalValid -> tryOnce.value == tryTwice.value)
+        "For valid subpath \"${str}\", normalising it once gives \"${tryOnce.value}\" but normalising it twice gives a different result: \"${tryTwice.value}\"";
+
+      # Check that normalisation doesn't change a string when appended to an absolute Nix path value
+      assert assertMsg
+        (originalValid -> absConcatOrig == absConcatNormalised)
+        "For valid subpath \"${str}\", appending to an absolute Nix path value gives \"${absConcatOrig}\", but appending the normalised result \"${tryOnce.value}\" gives a different value \"${absConcatNormalised}\"";
+
+      # Return an empty string when failed
+      if tryOnce.success then tryOnce.value else "";
+
+in lib.genAttrs strings normaliseAndCheck
diff --git a/lib/path/tests/prop.sh b/lib/path/tests/prop.sh
new file mode 100755
index 0000000000000..c956e55bbfa05
--- /dev/null
+++ b/lib/path/tests/prop.sh
@@ -0,0 +1,179 @@
+#!/usr/bin/env bash
+
+# Property tests for the `lib.path` library
+#
+# It generates random path-like strings and runs the functions on
+# them, checking that the expected laws of the functions hold
+
+set -euo pipefail
+shopt -s inherit_errexit
+
+# https://stackoverflow.com/a/246128
+SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
+
+if test -z "${TEST_LIB:-}"; then
+    TEST_LIB=$SCRIPT_DIR/../..
+fi
+
+tmp="$(mktemp -d)"
+clean_up() {
+    rm -rf "$tmp"
+}
+trap clean_up EXIT
+mkdir -p "$tmp/work"
+cd "$tmp/work"
+
+# Defaulting to a random seed but the first argument can override this
+seed=${1:-$RANDOM}
+echo >&2 "Using seed $seed, use \`lib/path/tests/prop.sh $seed\` to reproduce this result"
+
+# The number of random paths to generate. This specific number was chosen to
+# be fast enough while still generating enough variety to detect bugs.
+count=500
+
+debug=0
+# debug=1 # print some extra info
+# debug=2 # print generated values
+
+# Fine tuning parameters to balance the number of generated invalid paths
+# to the variance in generated paths.
+extradotweight=64   # Larger value: more dots
+extraslashweight=64 # Larger value: more slashes
+extranullweight=16  # Larger value: shorter strings
+
+die() {
+    echo >&2 "test case failed: " "$@"
+    exit 1
+}
+
+if [[ "$debug" -ge 1 ]]; then
+    echo >&2 "Generating $count random path-like strings"
+fi
+
+# Read stream of null-terminated strings entry-by-entry into bash,
+# write it to a file and the `strings` array.
+declare -a strings=()
+mkdir -p "$tmp/strings"
+while IFS= read -r -d $'\0' str; do
+    echo -n "$str" > "$tmp/strings/${#strings[@]}"
+    strings+=("$str")
+done < <(awk \
+    -f "$SCRIPT_DIR"/generate.awk \
+    -v seed="$seed" \
+    -v count="$count" \
+    -v extradotweight="$extradotweight" \
+    -v extraslashweight="$extraslashweight" \
+    -v extranullweight="$extranullweight")
+
+if [[ "$debug" -ge 1 ]]; then
+    echo >&2 "Trying to normalise the generated path-like strings with Nix"
+fi
+
+# Precalculate all normalisations with a single Nix call. Calling Nix for each
+# string individually would take way too long
+nix-instantiate --eval --strict --json \
+    --argstr libpath "$TEST_LIB" \
+    --argstr dir "$tmp/strings" \
+    "$SCRIPT_DIR"/prop.nix \
+    >"$tmp/result.json"
+
+# Uses some jq magic to turn the resulting attribute set into an associative
+# bash array assignment
+declare -A normalised_result="($(jq '
+    to_entries
+    | map("[\(.key | @sh)]=\(.value | @sh)")
+    | join(" \n")' -r < "$tmp/result.json"))"
+
+# Looks up a normalisation result for a string
+# Checks that the normalisation is only failing iff it's an invalid subpath
+# For valid subpaths, returns 0 and prints the normalisation result
+# For invalid subpaths, returns 1
+normalise() {
+    local str=$1
+    # Uses the same check for validity as in the library implementation
+    if [[ "$str" == "" || "$str" == /* || "$str" =~ ^(.*/)?\.\.(/.*)?$ ]]; then
+        valid=
+    else
+        valid=1
+    fi
+
+    normalised=${normalised_result[$str]}
+    # An empty string indicates failure, this is encoded in ./prop.nix
+    if [[ -n "$normalised" ]]; then
+        if [[ -n "$valid" ]]; then
+            echo "$normalised"
+        else
+            die "For invalid subpath \"$str\", lib.path.subpath.normalise returned this result: \"$normalised\""
+        fi
+    else
+        if [[ -n "$valid" ]]; then
+            die "For valid subpath \"$str\", lib.path.subpath.normalise failed"
+        else
+            if [[ "$debug" -ge 2 ]]; then
+                echo >&2 "String \"$str\" is not a valid subpath"
+            fi
+            # Invalid and it correctly failed, we let the caller continue if they catch the exit code
+            return 1
+        fi
+    fi
+}
+
+# Intermediate result populated by test_idempotency_realpath
+# and used in test_normalise_uniqueness
+#
+# Contains a mapping from a normalised subpath to the realpath result it represents
+declare -A norm_to_real
+
+test_idempotency_realpath() {
+    if [[ "$debug" -ge 1 ]]; then
+        echo >&2 "Checking idempotency of each result and making sure the realpath result isn't changed"
+    fi
+
+    # Count invalid subpaths to display stats
+    invalid=0
+    for str in "${strings[@]}"; do
+        if ! result=$(normalise "$str"); then
+            ((invalid++)) || true
+            continue
+        fi
+
+        # Check the law that it doesn't change the result of a realpath
+        mkdir -p -- "$str" "$result"
+        real_orig=$(realpath -- "$str")
+        real_norm=$(realpath -- "$result")
+
+        if [[ "$real_orig" != "$real_norm" ]]; then
+            die "realpath of the original string \"$str\" (\"$real_orig\") is not the same as realpath of the normalisation \"$result\" (\"$real_norm\")"
+        fi
+
+        if [[ "$debug" -ge 2 ]]; then
+            echo >&2 "String \"$str\" gets normalised to \"$result\" and file path \"$real_orig\""
+        fi
+        norm_to_real["$result"]="$real_orig"
+    done
+    if [[ "$debug" -ge 1 ]]; then
+        echo >&2 "$(bc <<< "scale=1; 100 / $count * $invalid")% of the total $count generated strings were invalid subpath strings, and were therefore ignored"
+    fi
+}
+
+test_normalise_uniqueness() {
+    if [[ "$debug" -ge 1 ]]; then
+        echo >&2 "Checking for the uniqueness law"
+    fi
+
+    for norm_p in "${!norm_to_real[@]}"; do
+        real_p=${norm_to_real["$norm_p"]}
+        for norm_q in "${!norm_to_real[@]}"; do
+            real_q=${norm_to_real["$norm_q"]}
+            # Checks normalisation uniqueness law for each pair of values
+            if [[ "$norm_p" != "$norm_q" && "$real_p" == "$real_q" ]]; then
+                die "Normalisations \"$norm_p\" and \"$norm_q\" are different, but the realpath of them is the same: \"$real_p\""
+            fi
+        done
+    done
+}
+
+test_idempotency_realpath
+test_normalise_uniqueness
+
+echo >&2 tests ok
diff --git a/lib/path/tests/unit.nix b/lib/path/tests/unit.nix
new file mode 100644
index 0000000000000..eccf3b7b1c33b
--- /dev/null
+++ b/lib/path/tests/unit.nix
@@ -0,0 +1,125 @@
+# Unit tests for lib.path functions. Use `nix-build` in this directory to
+# run these
+{ libpath }:
+let
+  lib = import libpath;
+  inherit (lib.path) subpath;
+
+  cases = lib.runTests {
+    testSubpathIsValidExample1 = {
+      expr = subpath.isValid null;
+      expected = false;
+    };
+    testSubpathIsValidExample2 = {
+      expr = subpath.isValid "";
+      expected = false;
+    };
+    testSubpathIsValidExample3 = {
+      expr = subpath.isValid "/foo";
+      expected = false;
+    };
+    testSubpathIsValidExample4 = {
+      expr = subpath.isValid "../foo";
+      expected = false;
+    };
+    testSubpathIsValidExample5 = {
+      expr = subpath.isValid "foo/bar";
+      expected = true;
+    };
+    testSubpathIsValidExample6 = {
+      expr = subpath.isValid "./foo//bar/";
+      expected = true;
+    };
+    testSubpathIsValidTwoDotsEnd = {
+      expr = subpath.isValid "foo/..";
+      expected = false;
+    };
+    testSubpathIsValidTwoDotsMiddle = {
+      expr = subpath.isValid "foo/../bar";
+      expected = false;
+    };
+    testSubpathIsValidTwoDotsPrefix = {
+      expr = subpath.isValid "..foo";
+      expected = true;
+    };
+    testSubpathIsValidTwoDotsSuffix = {
+      expr = subpath.isValid "foo..";
+      expected = true;
+    };
+    testSubpathIsValidTwoDotsPrefixComponent = {
+      expr = subpath.isValid "foo/..bar/baz";
+      expected = true;
+    };
+    testSubpathIsValidTwoDotsSuffixComponent = {
+      expr = subpath.isValid "foo/bar../baz";
+      expected = true;
+    };
+    testSubpathIsValidThreeDots = {
+      expr = subpath.isValid "...";
+      expected = true;
+    };
+    testSubpathIsValidFourDots = {
+      expr = subpath.isValid "....";
+      expected = true;
+    };
+    testSubpathIsValidThreeDotsComponent = {
+      expr = subpath.isValid "foo/.../bar";
+      expected = true;
+    };
+    testSubpathIsValidFourDotsComponent = {
+      expr = subpath.isValid "foo/..../bar";
+      expected = true;
+    };
+
+    testSubpathNormaliseExample1 = {
+      expr = subpath.normalise "foo//bar";
+      expected = "./foo/bar";
+    };
+    testSubpathNormaliseExample2 = {
+      expr = subpath.normalise "foo/./bar";
+      expected = "./foo/bar";
+    };
+    testSubpathNormaliseExample3 = {
+      expr = subpath.normalise "foo/bar";
+      expected = "./foo/bar";
+    };
+    testSubpathNormaliseExample4 = {
+      expr = subpath.normalise "foo/bar/";
+      expected = "./foo/bar";
+    };
+    testSubpathNormaliseExample5 = {
+      expr = subpath.normalise "foo/bar/.";
+      expected = "./foo/bar";
+    };
+    testSubpathNormaliseExample6 = {
+      expr = subpath.normalise ".";
+      expected = "./.";
+    };
+    testSubpathNormaliseExample7 = {
+      expr = (builtins.tryEval (subpath.normalise "foo/../bar")).success;
+      expected = false;
+    };
+    testSubpathNormaliseExample8 = {
+      expr = (builtins.tryEval (subpath.normalise "")).success;
+      expected = false;
+    };
+    testSubpathNormaliseExample9 = {
+      expr = (builtins.tryEval (subpath.normalise "/foo")).success;
+      expected = false;
+    };
+    testSubpathNormaliseIsValidDots = {
+      expr = subpath.normalise "./foo/.bar/.../baz...qux";
+      expected = "./foo/.bar/.../baz...qux";
+    };
+    testSubpathNormaliseWrongType = {
+      expr = (builtins.tryEval (subpath.normalise null)).success;
+      expected = false;
+    };
+    testSubpathNormaliseTwoDots = {
+      expr = (builtins.tryEval (subpath.normalise "..")).success;
+      expected = false;
+    };
+  };
+in
+  if cases == [] then "Unit tests successful"
+  else throw "Path unit tests failed: ${lib.generators.toPretty {} cases}"
diff --git a/lib/systems/default.nix b/lib/systems/default.nix
index 4c1e9d9f25364..4a5e66caec7c4 100644
--- a/lib/systems/default.nix
+++ b/lib/systems/default.nix
@@ -101,7 +101,14 @@ rec {
         }.${final.parsed.kernel.name} or null;
 
          # uname -m
-         processor = final.parsed.cpu.name;
+         processor =
+           if final.isPower64
+           then "ppc64${lib.optionalString final.isLittleEndian "le"}"
+           else if final.isPower
+           then "ppc${lib.optionalString final.isLittleEndian "le"}"
+           else if final.isMips64
+           then "mips64"  # endianness is *not* included on mips64
+           else final.parsed.cpu.name;
 
          # uname -r
          release = null;
@@ -135,12 +142,7 @@ rec {
         if final.isAarch32 then "arm"
         else if final.isx86_64 then "x86_64"
         else if final.isx86 then "i386"
-        else {
-          powerpc = "ppc";
-          powerpcle = "ppc";
-          powerpc64 = "ppc64";
-          powerpc64le = "ppc64le";
-        }.${final.parsed.cpu.name} or final.parsed.cpu.name;
+        else final.uname.processor;
 
       # Name used by UEFI for architectures.
       efiArch =
diff --git a/lib/systems/inspect.nix b/lib/systems/inspect.nix
index 4e0bb8e672e9a..53d84118bd30d 100644
--- a/lib/systems/inspect.nix
+++ b/lib/systems/inspect.nix
@@ -48,6 +48,7 @@ rec {
 
     is32bit        = { cpu = { bits = 32; }; };
     is64bit        = { cpu = { bits = 64; }; };
+    isILP32        = map (a: { abi = { abi = a; }; }) [ "n32" "ilp32" "x32" ];
     isBigEndian    = { cpu = { significantByte = significantBytes.bigEndian; }; };
     isLittleEndian = { cpu = { significantByte = significantBytes.littleEndian; }; };
 
diff --git a/lib/tests/release.nix b/lib/tests/release.nix
index b93a4236f91e1..f67892ab962f2 100644
--- a/lib/tests/release.nix
+++ b/lib/tests/release.nix
@@ -15,6 +15,9 @@ pkgs.runCommand "nixpkgs-lib-tests" {
       inherit pkgs;
       lib = import ../.;
     })
+    (import ../path/tests {
+      inherit pkgs;
+    })
   ];
 } ''
     datadir="${pkgs.nix}/share"
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 0766a6c9868d5..f384f68358209 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -5138,6 +5138,12 @@
     githubId = 15957973;
     name = "Jeffry Molanus";
   };
+  gilice = {
+    email = "gilice@proton.me";
+    github = "gilice";
+    githubId = 104317939;
+    name = "gilice";
+  };
   gilligan = {
     email = "tobias.pflug@gmail.com";
     github = "gilligan";
@@ -14223,6 +14229,13 @@
     githubId = 13155277;
     name = "Tom Houle";
   };
+  tomodachi94 = {
+    email = "tomodachi94+nixpkgs@protonmail.com";
+    matrix = "@tomodachi94:matrix.org";
+    github = "tomodachi94";
+    githubId = 68489118;
+    name = "Tomodachi94";
+  };
   tomsmeets = {
     email = "tom.tsmeets@gmail.com";
     github = "TomSmeets";
@@ -16068,7 +16081,7 @@
     githubId = 17733984;
   };
   wesleyjrz = {
-    email = "wesleyjr2002@gmail.com";
+    email = "dev@wesleyjrz.com";
     name = "Wesley V. Santos Jr.";
     github = "wesleyjrz";
     githubId = 60184588;
diff --git a/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml
index ea3be31a20606..4fb5749e71c88 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml
@@ -341,6 +341,13 @@
       </listitem>
       <listitem>
         <para>
+          <literal>services.chronyd</literal> is now started with
+          additional systemd sandbox/hardening options for better
+          security.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
           The module <literal>services.headscale</literal> was
           refactored to be compliant with
           <link xlink:href="https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md">RFC
diff --git a/nixos/doc/manual/release-notes/rl-2305.section.md b/nixos/doc/manual/release-notes/rl-2305.section.md
index df0ec622e56e7..b5c9c4ceb55d9 100644
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@@ -94,6 +94,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
   And backup your data.
 
+- `services.chronyd` is now started with additional systemd sandbox/hardening options for better security.
+
 - The module `services.headscale` was refactored to be compliant with [RFC 0042](https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md). To be precise, this means that the following things have changed:
 
   - Most settings has been migrated under [services.headscale.settings](#opt-services.headscale.settings) which is an attribute-set that
diff --git a/nixos/modules/profiles/macos-builder.nix b/nixos/modules/profiles/macos-builder.nix
index a981814730a17..fddf19ad12517 100644
--- a/nixos/modules/profiles/macos-builder.nix
+++ b/nixos/modules/profiles/macos-builder.nix
@@ -9,7 +9,8 @@ let
 
 in
 
-{ imports = [
+{
+  imports = [
     ../virtualisation/qemu-vm.nix
 
     # Avoid a dependency on stateVersion
@@ -18,8 +19,7 @@ in
         ../virtualisation/nixos-containers.nix
         ../services/x11/desktop-managers/xterm.nix
       ];
-      config = {
-      };
+      config = { };
       options.boot.isContainer = lib.mkOption { default = false; internal = true; };
     }
   ];
@@ -98,11 +98,11 @@ in
       '';
 
     in
-      script.overrideAttrs (old: {
-        meta = (old.meta or { }) // {
-          platforms = lib.platforms.darwin;
-        };
-      });
+    script.overrideAttrs (old: {
+      meta = (old.meta or { }) // {
+        platforms = lib.platforms.darwin;
+      };
+    });
 
   system = {
     # To prevent gratuitous rebuilds on each change to Nixpkgs
@@ -118,10 +118,22 @@ in
     '');
   };
 
-  users.users."${user}"= {
+  users.users."${user}" = {
     isNormalUser = true;
   };
 
+  security.polkit.enable = true;
+
+  security.polkit.extraConfig = ''
+    polkit.addRule(function(action, subject) {
+      if (action.id === "org.freedesktop.login1.power-off" && subject.user === "${user}") {
+        return "yes";
+      } else {
+        return "no";
+      }
+    })
+  '';
+
   virtualisation = {
     diskSize = 20 * 1024;
 
diff --git a/nixos/modules/programs/gnupg.nix b/nixos/modules/programs/gnupg.nix
index 828f24f99111d..cb8d0ecff4cb8 100644
--- a/nixos/modules/programs/gnupg.nix
+++ b/nixos/modules/programs/gnupg.nix
@@ -135,7 +135,7 @@ in
       # The SSH agent protocol doesn't have support for changing TTYs; however we
       # can simulate this with the `exec` feature of openssh (see ssh_config(5))
       # that hooks a command to the shell currently running the ssh program.
-      Match host * exec "${cfg.package}/bin/gpg-connect-agent --quiet updatestartuptty /bye >/dev/null 2>&1"
+      Match host * exec "${pkgs.runtimeShell} -c '${cfg.package}/bin/gpg-connect-agent --quiet updatestartuptty /bye >/dev/null 2>&1'"
     '';
 
     environment.extraInit = mkIf cfg.agent.enableSSHSupport ''
diff --git a/nixos/modules/programs/nix-ld.nix b/nixos/modules/programs/nix-ld.nix
index f753cf5f97e5b..9a12b4ca5c74f 100644
--- a/nixos/modules/programs/nix-ld.nix
+++ b/nixos/modules/programs/nix-ld.nix
@@ -36,23 +36,22 @@ let
 in
 {
   meta.maintainers = [ lib.maintainers.mic92 ];
-  options = {
-    programs.nix-ld = {
-      enable = lib.mkEnableOption (lib.mdDoc ''nix-ld, Documentation: <https://github.com/Mic92/nix-ld>'');
-      package = lib.mkOption {
-        type = lib.types.package;
-        description = lib.mdDoc "Which package to use for the nix-ld.";
-        default = pkgs.nix-ld;
-        defaultText = lib.mdDoc "pkgs.nix-ld";
-      };
-      libraries = lib.mkOption {
-        type = lib.types.listOf lib.types.package;
-        description = lib.mdDoc "Libraries that automatically become available to all programs. The default set includes common libraries.";
-        default = baseLibraries;
-        defaultText = lib.mdDoc "baseLibraries";
-      };
+  options.programs.nix-ld = {
+    enable = lib.mkEnableOption (lib.mdDoc ''nix-ld, Documentation: <https://github.com/Mic92/nix-ld>'');
+    package = lib.mkOption {
+      type = lib.types.package;
+      description = lib.mdDoc "Which package to use for the nix-ld.";
+      default = pkgs.nix-ld;
+      defaultText = lib.literalExpression "pkgs.nix-ld";
+    };
+    libraries = lib.mkOption {
+      type = lib.types.listOf lib.types.package;
+      description = lib.mdDoc "Libraries that automatically become available to all programs. The default set includes common libraries.";
+      default = baseLibraries;
+      defaultText = lib.literalExpression "baseLibraries derived from systemd and nix dependencies.";
     };
   };
+
   config = lib.mkIf config.programs.nix-ld.enable {
     systemd.tmpfiles.packages = [ cfg.package ];
 
diff --git a/nixos/modules/services/desktops/pipewire/daemon/jack.conf.json b/nixos/modules/services/desktops/pipewire/daemon/jack.conf.json
index 128178bfa027f..4a173f7322972 100644
--- a/nixos/modules/services/desktops/pipewire/daemon/jack.conf.json
+++ b/nixos/modules/services/desktops/pipewire/daemon/jack.conf.json
@@ -33,6 +33,31 @@
       "actions": {
         "update-props": {}
       }
+    },
+    {
+      "matches": [
+        {
+          "application.process.binary": "jack_bufsize"
+        }
+      ],
+      "actions": {
+        "update-props": {
+          "jack.global-buffer-size": true
+        }
+      }
+    },
+    {
+      "matches": [
+        {
+          "application.process.binary": "qsynth"
+        }
+      ],
+      "actions": {
+        "update-props": {
+          "node.pause-on-idle": false,
+          "node.passive": true
+        }
+      }
     }
   ]
 }
diff --git a/nixos/modules/services/desktops/pipewire/daemon/pipewire-pulse.conf.json b/nixos/modules/services/desktops/pipewire/daemon/pipewire-pulse.conf.json
index 114afbfb0ea46..b1a864853325c 100644
--- a/nixos/modules/services/desktops/pipewire/daemon/pipewire-pulse.conf.json
+++ b/nixos/modules/services/desktops/pipewire/daemon/pipewire-pulse.conf.json
@@ -32,10 +32,12 @@
       "args": {}
     }
   ],
-  "context.exec": [
+  "context.exec": [],
+  "pulse.cmd": [
     {
-      "path": "pactl",
-      "args": "load-module module-always-sink"
+      "cmd": "load-module",
+      "args": "module-always-sink",
+      "flags": []
     }
   ],
   "stream.properties": {},
@@ -89,13 +91,14 @@
     {
       "matches": [
         {
-          "application.name": "~speech-dispatcher*"
+          "application.name": "~speech-dispatcher.*"
         }
       ],
       "actions": {
         "update-props": {
-          "pulse.min.req": "1024/48000",
-          "pulse.min.quantum": "1024/48000"
+          "pulse.min.req": "512/48000",
+          "pulse.min.quantum": "512/48000",
+          "pulse.idle.timeout": 5
         }
       }
     }
diff --git a/nixos/modules/services/desktops/pipewire/daemon/pipewire.conf.json b/nixos/modules/services/desktops/pipewire/daemon/pipewire.conf.json
index bf3b2d660827a..53fc103d22144 100644
--- a/nixos/modules/services/desktops/pipewire/daemon/pipewire.conf.json
+++ b/nixos/modules/services/desktops/pipewire/daemon/pipewire.conf.json
@@ -70,6 +70,14 @@
     },
     {
       "name": "libpipewire-module-session-manager"
+    },
+    {
+      "name": "libpipewire-module-x11-bell",
+      "args": {},
+      "flags": [
+        "ifexists",
+        "nofail"
+      ]
     }
   ],
   "context.objects": [
diff --git a/nixos/modules/services/misc/gitea.nix b/nixos/modules/services/misc/gitea.nix
index ceb4c11728544..00e90f5b32b47 100644
--- a/nixos/modules/services/misc/gitea.nix
+++ b/nixos/modules/services/misc/gitea.nix
@@ -395,7 +395,7 @@ in
           ROOT_URL = cfg.rootUrl;
         }
         (mkIf cfg.enableUnixSocket {
-          PROTOCOL = "unix";
+          PROTOCOL = "http+unix";
           HTTP_ADDR = "/run/gitea/gitea.sock";
         })
         (mkIf (!cfg.enableUnixSocket) {
@@ -404,7 +404,6 @@ in
         })
         (mkIf cfg.lfs.enable {
           LFS_START_SERVER = true;
-          LFS_CONTENT_PATH = cfg.lfs.contentDir;
         })
 
       ];
@@ -426,6 +425,10 @@ in
       oauth2 = {
         JWT_SECRET = "#oauth2jwtsecret#";
       };
+
+      lfs = mkIf (cfg.lfs.enable) {
+        PATH = cfg.lfs.contentDir;
+      };
     };
 
     services.postgresql = optionalAttrs (usePostgresql && cfg.database.createDatabase) {
diff --git a/nixos/modules/services/misc/paperless.nix b/nixos/modules/services/misc/paperless.nix
index 33a8394dff2d2..1dddd147ac095 100644
--- a/nixos/modules/services/misc/paperless.nix
+++ b/nixos/modules/services/misc/paperless.nix
@@ -212,14 +212,14 @@ in
 
     systemd.services.paperless-scheduler = {
       description = "Paperless Celery Beat";
+      wantedBy = [ "multi-user.target" ];
+      wants = [ "paperless-consumer.service" "paperless-web.service" "paperless-task-queue.service" ];
       serviceConfig = defaultServiceConfig // {
         User = cfg.user;
         ExecStart = "${pkg}/bin/celery --app paperless beat --loglevel INFO";
         Restart = "on-failure";
       };
       environment = env;
-      wantedBy = [ "multi-user.target" ];
-      wants = [ "paperless-consumer.service" "paperless-web.service" "paperless-task-queue.service" ];
 
       preStart = ''
         ln -sf ${manage} ${cfg.dataDir}/paperless-manage
@@ -248,6 +248,7 @@ in
 
     systemd.services.paperless-task-queue = {
       description = "Paperless Celery Workers";
+      after = [ "paperless-scheduler.service" ];
       serviceConfig = defaultServiceConfig // {
         User = cfg.user;
         ExecStart = "${pkg}/bin/celery --app paperless worker --loglevel INFO";
@@ -275,20 +276,24 @@ in
 
     systemd.services.paperless-consumer = {
       description = "Paperless document consumer";
+      # Bind to `paperless-scheduler` so that the consumer never runs
+      # during migrations
+      bindsTo = [ "paperless-scheduler.service" ];
+      after = [ "paperless-scheduler.service" ];
       serviceConfig = defaultServiceConfig // {
         User = cfg.user;
         ExecStart = "${pkg}/bin/paperless-ngx document_consumer";
         Restart = "on-failure";
       };
       environment = env;
-      # Bind to `paperless-scheduler` so that the consumer never runs
-      # during migrations
-      bindsTo = [ "paperless-scheduler.service" ];
-      after = [ "paperless-scheduler.service" ];
     };
 
     systemd.services.paperless-web = {
       description = "Paperless web server";
+      # Bind to `paperless-scheduler` so that the web server never runs
+      # during migrations
+      bindsTo = [ "paperless-scheduler.service" ];
+      after = [ "paperless-scheduler.service" ];
       serviceConfig = defaultServiceConfig // {
         User = cfg.user;
         ExecStart = ''
@@ -312,10 +317,6 @@ in
       # Allow the web interface to access the private /tmp directory of the server.
       # This is required to support uploading files via the web interface.
       unitConfig.JoinsNamespaceOf = "paperless-task-queue.service";
-      # Bind to `paperless-scheduler` so that the web server never runs
-      # during migrations
-      bindsTo = [ "paperless-scheduler.service" ];
-      after = [ "paperless-scheduler.service" ];
     };
 
     users = optionalAttrs (cfg.user == defaultUser) {
diff --git a/nixos/modules/services/monitoring/parsedmarc.md b/nixos/modules/services/monitoring/parsedmarc.md
index d93134a4cc767..5a17f79da5d46 100644
--- a/nixos/modules/services/monitoring/parsedmarc.md
+++ b/nixos/modules/services/monitoring/parsedmarc.md
@@ -17,7 +17,6 @@ services.parsedmarc = {
     host = "imap.example.com";
     user = "alice@example.com";
     password = "/path/to/imap_password_file";
-    watch = true;
   };
   provision.geoIp = false; # Not recommended!
 };
diff --git a/nixos/modules/services/monitoring/parsedmarc.nix b/nixos/modules/services/monitoring/parsedmarc.nix
index 3540d91fc9f37..40c76b804559c 100644
--- a/nixos/modules/services/monitoring/parsedmarc.nix
+++ b/nixos/modules/services/monitoring/parsedmarc.nix
@@ -123,7 +123,10 @@ in
             host = "imap.example.com";
             user = "alice@example.com";
             password = { _secret = "/run/keys/imap_password" };
+          };
+          mailbox = {
             watch = true;
+            batch_size = 30;
           };
           splunk_hec = {
             url = "https://splunkhec.example.com";
@@ -170,6 +173,24 @@ in
             };
           };
 
+          mailbox = {
+            watch = lib.mkOption {
+              type = lib.types.bool;
+              default = true;
+              description = lib.mdDoc ''
+                Use the IMAP IDLE command to process messages as they arrive.
+              '';
+            };
+
+            delete = lib.mkOption {
+              type = lib.types.bool;
+              default = false;
+              description = lib.mdDoc ''
+                Delete messages after processing them, instead of archiving them.
+              '';
+            };
+          };
+
           imap = {
             host = lib.mkOption {
               type = lib.types.str;
@@ -216,22 +237,6 @@ in
               '';
               apply = x: if isAttrs x || x == null then x else { _secret = x; };
             };
-
-            watch = lib.mkOption {
-              type = lib.types.bool;
-              default = true;
-              description = lib.mdDoc ''
-                Use the IMAP IDLE command to process messages as they arrive.
-              '';
-            };
-
-            delete = lib.mkOption {
-              type = lib.types.bool;
-              default = false;
-              description = lib.mdDoc ''
-                Delete messages after processing them, instead of archiving them.
-              '';
-            };
           };
 
           smtp = {
@@ -360,6 +365,13 @@ in
 
   config = lib.mkIf cfg.enable {
 
+    warnings = let
+      deprecationWarning = optname: "Starting in 8.0.0, the `${optname}` option has been moved from the `services.parsedmarc.settings.imap`"
+        + "configuration section to the `services.parsedmarc.settings.mailbox` configuration section.";
+      hasImapOpt = lib.flip builtins.hasAttr cfg.settings.imap;
+      movedOptions = [ "reports_folder" "archive_folder" "watch" "delete" "test" "batch_size" ];
+    in builtins.map deprecationWarning (builtins.filter hasImapOpt movedOptions);
+
     services.elasticsearch.enable = lib.mkDefault cfg.provision.elasticsearch;
 
     services.geoipupdate = lib.mkIf cfg.provision.geoIp {
@@ -444,6 +456,8 @@ in
           ssl = false;
           user = cfg.provision.localMail.recipientName;
           password = "${pkgs.writeText "imap-password" "@imap-password@"}";
+        };
+        mailbox = {
           watch = true;
         };
       })
diff --git a/nixos/modules/services/monitoring/parsedmarc.xml b/nixos/modules/services/monitoring/parsedmarc.xml
index 7167b52d0357d..b6a4bcf8ff5a5 100644
--- a/nixos/modules/services/monitoring/parsedmarc.xml
+++ b/nixos/modules/services/monitoring/parsedmarc.xml
@@ -15,14 +15,13 @@
       email address and saves them to a local Elasticsearch instance
       looks like this:
     </para>
-    <programlisting language="bash">
+    <programlisting>
 services.parsedmarc = {
   enable = true;
   settings.imap = {
     host = &quot;imap.example.com&quot;;
     user = &quot;alice@example.com&quot;;
     password = &quot;/path/to/imap_password_file&quot;;
-    watch = true;
   };
   provision.geoIp = false; # Not recommended!
 };
@@ -45,7 +44,7 @@ services.parsedmarc = {
       email address that should be configured in the domain’s dmarc
       policy is <literal>dmarc@monitoring.example.com</literal>.
     </para>
-    <programlisting language="bash">
+    <programlisting>
 services.parsedmarc = {
   enable = true;
   provision = {
@@ -68,7 +67,7 @@ services.parsedmarc = {
       Elasticsearch instance is automatically added as a Grafana
       datasource, and the dashboard is added to Grafana as well.
     </para>
-    <programlisting language="bash">
+    <programlisting>
 services.parsedmarc = {
   enable = true;
   provision = {
diff --git a/nixos/modules/services/networking/ntp/chrony.nix b/nixos/modules/services/networking/ntp/chrony.nix
index 7e3bb565d10bf..dc180d4a4f954 100644
--- a/nixos/modules/services/networking/ntp/chrony.nix
+++ b/nixos/modules/services/networking/ntp/chrony.nix
@@ -147,9 +147,9 @@ in
     systemd.services.systemd-timedated.environment = { SYSTEMD_TIMEDATED_NTP_SERVICES = "chronyd.service"; };
 
     systemd.tmpfiles.rules = [
-      "d ${stateDir} 0755 chrony chrony - -"
-      "f ${driftFile} 0640 chrony chrony -"
-      "f ${keyFile} 0640 chrony chrony -"
+      "d ${stateDir} 0750 chrony chrony - -"
+      "f ${driftFile} 0640 chrony chrony - -"
+      "f ${keyFile} 0640 chrony chrony - -"
     ];
 
     systemd.services.chronyd =
@@ -164,15 +164,47 @@ in
         path = [ chronyPkg ];
 
         unitConfig.ConditionCapability = "CAP_SYS_TIME";
-        serviceConfig =
-          { Type = "simple";
-            ExecStart = "${chronyPkg}/bin/chronyd ${builtins.toString chronyFlags}";
-
-            ProtectHome = "yes";
-            ProtectSystem = "full";
-            PrivateTmp = "yes";
-          };
-
+        serviceConfig = {
+          Type = "simple";
+          ExecStart = "${chronyPkg}/bin/chronyd ${builtins.toString chronyFlags}";
+
+          # Proc filesystem
+          ProcSubset = "pid";
+          ProtectProc = "invisible";
+          # Access write directories
+          ReadWritePaths = [ "${stateDir}" ];
+          UMask = "0027";
+          # Capabilities
+          CapabilityBoundingSet = [ "CAP_CHOWN" "CAP_DAC_OVERRIDE" "CAP_NET_BIND_SERVICE" "CAP_SETGID" "CAP_SETUID" "CAP_SYS_RESOURCE" "CAP_SYS_TIME" ];
+          # Device Access
+          DeviceAllow = [ "char-pps rw" "char-ptp rw" "char-rtc rw" ];
+          DevicePolicy = "closed";
+          # Security
+          NoNewPrivileges = true;
+          # Sandboxing
+          ProtectSystem = "full";
+          ProtectHome = true;
+          PrivateTmp = true;
+          PrivateDevices = true;
+          PrivateUsers = false;
+          ProtectHostname = true;
+          ProtectClock = false;
+          ProtectKernelTunables = true;
+          ProtectKernelModules = true;
+          ProtectKernelLogs = true;
+          ProtectControlGroups = true;
+          RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
+          RestrictNamespaces = true;
+          LockPersonality = true;
+          MemoryDenyWriteExecute = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          RemoveIPC = true;
+          PrivateMounts = true;
+          # System Call Filtering
+          SystemCallArchitectures = "native";
+          SystemCallFilter = [ "~@cpu-emulation @debug @keyring @mount @obsolete @privileged @resources" "@clock" "@setuid" "capset" "chown" ];
+        };
       };
   };
 }
diff --git a/nixos/modules/services/web-apps/snipe-it.nix b/nixos/modules/services/web-apps/snipe-it.nix
index 314a69a73a872..93b0aafab64bf 100644
--- a/nixos/modules/services/web-apps/snipe-it.nix
+++ b/nixos/modules/services/web-apps/snipe-it.nix
@@ -454,8 +454,9 @@ in {
 
           # A placeholder file for invalid barcodes
           invalid_barcode_location="${cfg.dataDir}/public/uploads/barcodes/invalid_barcode.gif"
-          [ ! -e "$invalid_barcode_location" ] \
-              && cp ${snipe-it}/share/snipe-it/invalid_barcode.gif "$invalid_barcode_location"
+          if [ ! -e "$invalid_barcode_location" ]; then
+              cp ${snipe-it}/share/snipe-it/invalid_barcode.gif "$invalid_barcode_location"
+          fi
         '';
     };
 
diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix
index 95e600ea79a5a..d31f3d5d4650b 100644
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@@ -571,7 +571,7 @@ in
         defaultText = literalExpression "pkgs.nginxStable";
         type = types.package;
         apply = p: p.override {
-          modules = p.modules ++ cfg.additionalModules;
+          modules = lib.unique (p.modules ++ cfg.additionalModules);
         };
         description = lib.mdDoc ''
           Nginx package to use. This defaults to the stable version. Note
diff --git a/nixos/modules/services/x11/desktop-managers/plasma5.nix b/nixos/modules/services/x11/desktop-managers/plasma5.nix
index 9fcb408c287d5..eb30e601dd009 100644
--- a/nixos/modules/services/x11/desktop-managers/plasma5.nix
+++ b/nixos/modules/services/x11/desktop-managers/plasma5.nix
@@ -32,7 +32,7 @@ let
   inherit (lib)
     getBin optionalString literalExpression
     mkRemovedOptionModule mkRenamedOptionModule
-    mkDefault mkIf mkMerge mkOption types;
+    mkDefault mkIf mkMerge mkOption mkPackageOption types;
 
   ini = pkgs.formats.ini { };
 
@@ -198,6 +198,11 @@ in
       example = literalExpression "[ pkgs.plasma5Packages.oxygen ]";
     };
 
+    notoPackage = mkPackageOption pkgs "Noto fonts" {
+      default = [ "noto-fonts" ];
+      example = "noto-fonts-lgc-plus";
+    };
+
     # Internally allows configuring kdeglobals globally
     kdeglobals = mkOption {
       internal = true;
@@ -401,7 +406,7 @@ in
       # Enable GTK applications to load SVG icons
       services.xserver.gdk-pixbuf.modulePackages = [ pkgs.librsvg ];
 
-      fonts.fonts = with pkgs; [ noto-fonts hack-font ];
+      fonts.fonts = with pkgs; [ cfg.notoPackage hack-font ];
       fonts.fontconfig.defaultFonts = {
         monospace = [ "Hack" "Noto Sans Mono" ];
         sansSerif = [ "Noto Sans" ];
@@ -545,7 +550,7 @@ in
         }
         {
           # The user interface breaks without pulse
-          assertion = config.hardware.pulseaudio.enable;
+          assertion = config.hardware.pulseaudio.enable || (config.services.pipewire.enable && config.services.pipewire.pulse.enable);
           message = "Plasma Mobile requires pulseaudio.";
         }
       ];
diff --git a/nixos/modules/services/x11/window-managers/i3.nix b/nixos/modules/services/x11/window-managers/i3.nix
index 64109e0c39fdd..5bb73cd0bfb17 100644
--- a/nixos/modules/services/x11/window-managers/i3.nix
+++ b/nixos/modules/services/x11/window-managers/i3.nix
@@ -31,7 +31,6 @@ in
       type        = types.package;
       default     = pkgs.i3;
       defaultText = literalExpression "pkgs.i3";
-      example     = literalExpression "pkgs.i3-gaps";
       description = lib.mdDoc ''
         i3 package to use.
       '';
@@ -73,6 +72,6 @@ in
 
   imports = [
     (mkRemovedOptionModule [ "services" "xserver" "windowManager" "i3-gaps" "enable" ]
-      "Use services.xserver.windowManager.i3.enable and set services.xserver.windowManager.i3.package to pkgs.i3-gaps to use i3-gaps.")
+      "i3-gaps was merged into i3. Use services.xserver.windowManager.i3.enable instead.")
   ];
 }
diff --git a/nixos/modules/virtualisation/waydroid.nix b/nixos/modules/virtualisation/waydroid.nix
index a2cfd806f322e..46e5f901015d9 100644
--- a/nixos/modules/virtualisation/waydroid.nix
+++ b/nixos/modules/virtualisation/waydroid.nix
@@ -56,12 +56,8 @@ in
 
       wantedBy = [ "multi-user.target" ];
 
-      unitConfig = {
-        ConditionPathExists = "/var/lib/waydroid/lxc/waydroid";
-      };
-
       serviceConfig = {
-        ExecStart = "${pkgs.waydroid}/bin/waydroid container start";
+        ExecStart = "${pkgs.waydroid}/bin/waydroid -w container start";
         ExecStop = "${pkgs.waydroid}/bin/waydroid container stop";
         ExecStopPost = "${pkgs.waydroid}/bin/waydroid session stop";
       };
diff --git a/nixos/tests/paperless.nix b/nixos/tests/paperless.nix
index b97834835c2c9..7f36de4c29b71 100644
--- a/nixos/tests/paperless.nix
+++ b/nixos/tests/paperless.nix
@@ -26,6 +26,10 @@ import ./make-test-python.nix ({ lib, ... }: {
         # Wait until server accepts connections
         machine.wait_until_succeeds("curl -fs localhost:28981")
 
+    # Required for consuming documents via the web interface
+    with subtest("Task-queue gets ready"):
+        machine.wait_for_unit("paperless-task-queue.service")
+
     with subtest("Add a document via the web interface"):
         machine.succeed(
             "convert -size 400x40 xc:white -font 'DejaVu-Sans' -pointsize 20 -fill black "
diff --git a/nixos/tests/parsedmarc/default.nix b/nixos/tests/parsedmarc/default.nix
index 50b977723e9c7..837cf9d7e6dce 100644
--- a/nixos/tests/parsedmarc/default.nix
+++ b/nixos/tests/parsedmarc/default.nix
@@ -155,7 +155,6 @@ in
                   ssl = true;
                   user = "alice";
                   password = "${pkgs.writeText "imap-password" "foobar"}";
-                  watch = true;
                 };
               };
 
diff --git a/pkgs/applications/audio/bitwig-studio/bitwig-studio4.nix b/pkgs/applications/audio/bitwig-studio/bitwig-studio4.nix
index d7215f93973f6..940e6c3c0c683 100644
--- a/pkgs/applications/audio/bitwig-studio/bitwig-studio4.nix
+++ b/pkgs/applications/audio/bitwig-studio/bitwig-studio4.nix
@@ -1,8 +1,26 @@
-{ stdenv, fetchurl, alsa-lib, cairo, dpkg, freetype
-, gdk-pixbuf, glib, gtk3, lib, xorg
-, libglvnd, libjack2, ffmpeg
-, libxkbcommon, xdg-utils, zlib, pipewire, pulseaudio
-, wrapGAppsHook, makeWrapper }:
+{ stdenv
+, fetchurl
+, alsa-lib
+, cairo
+, dpkg
+, ffmpeg
+, freetype
+, gdk-pixbuf
+, glib
+, gtk3
+, lib
+, libglvnd
+, libjack2
+, libjpeg
+, libxkbcommon
+, makeWrapper
+, pipewire
+, pulseaudio
+, wrapGAppsHook
+, xdg-utils
+, xorg
+, zlib
+}:
 
 stdenv.mkDerivation rec {
   pname = "bitwig-studio";
@@ -24,7 +42,27 @@ stdenv.mkDerivation rec {
   dontWrapGApps = true; # we only want $gappsWrapperArgs here
 
   buildInputs = with xorg; [
-    alsa-lib cairo freetype gdk-pixbuf glib gtk3 libxcb xcbutil xcbutilwm zlib libXtst libxkbcommon pipewire pulseaudio libjack2 libX11 libglvnd libXcursor stdenv.cc.cc.lib
+    alsa-lib
+    cairo
+    freetype
+    gdk-pixbuf
+    glib
+    gtk3
+    libglvnd
+    libjack2
+    # libjpeg8 is required for converting jpeg's to colour palettes
+    libjpeg
+    libxcb
+    libXcursor
+    libX11
+    libXtst
+    libxkbcommon
+    pipewire
+    pulseaudio
+    stdenv.cc.cc.lib
+    xcbutil
+    xcbutilwm
+    zlib
   ];
 
   installPhase = ''
diff --git a/pkgs/applications/audio/famistudio/default.nix b/pkgs/applications/audio/famistudio/default.nix
index 1ff08bd06b93d..81a2646ad74a5 100644
--- a/pkgs/applications/audio/famistudio/default.nix
+++ b/pkgs/applications/audio/famistudio/default.nix
@@ -10,12 +10,12 @@
 
 stdenv.mkDerivation rec {
   pname = "famistudio";
-  version = "4.0.4";
+  version = "4.0.6";
 
   src = fetchzip {
     url = "https://github.com/BleuBleu/FamiStudio/releases/download/${version}/FamiStudio${lib.strings.concatStrings (lib.splitVersion version)}-LinuxAMD64.zip";
     stripRoot = false;
-    sha256 = "sha256-qdSldObfwC5J1b4tpHT9S/xxJ2StBTsPA80QS7bs2vo=";
+    sha256 = "sha256-Se9EIQTjZQM5qqzlEB4hGVRHDFdu6GecNGpw9gYMbW4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/audio/mousai/default.nix b/pkgs/applications/audio/mousai/default.nix
index 96d686864fbc7..51b5aa037f06b 100644
--- a/pkgs/applications/audio/mousai/default.nix
+++ b/pkgs/applications/audio/mousai/default.nix
@@ -50,6 +50,7 @@ python3.pkgs.buildPythonApplication rec {
     desktop-file-utils
     gettext
     glib
+    gobject-introspection
     gtk4
     meson
     ninja
@@ -58,7 +59,6 @@ python3.pkgs.buildPythonApplication rec {
   ];
 
   buildInputs = [
-    gobject-introspection
     gst_all_1.gstreamer
     gst_all_1.gst-plugins-base
     gst_all_1.gst-plugins-good
diff --git a/pkgs/applications/audio/ncspot/default.nix b/pkgs/applications/audio/ncspot/default.nix
index 2a56b6aa3ccf2..c15f6b9c14e16 100644
--- a/pkgs/applications/audio/ncspot/default.nix
+++ b/pkgs/applications/audio/ncspot/default.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "ncspot";
-  version = "0.11.2";
+  version = "0.12.0";
 
   src = fetchFromGitHub {
     owner = "hrkfdn";
     repo = "ncspot";
     rev = "v${version}";
-    sha256 = "sha256-xJzj387exWDvNias50fELvoAxgIoxDHVVRoAD4FJHUw=";
+    sha256 = "sha256-kqGYBaXmGeGuGJ5fcc4OQzHISU8fVuQNGwiD8nyPa/0=";
   };
 
-  cargoSha256 = "sha256-6QOD8IhrnjyaOEYVYt2DA3dI6Wcu1tCXnIp+Ruc+EEo=";
+  cargoSha256 = "sha256-gVXH2pFtyMfYkCqda9NrqOgczvmxiWHe0zArJfnnrgE=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/applications/audio/ocenaudio/default.nix b/pkgs/applications/audio/ocenaudio/default.nix
index 73bee279803bd..f40fb1413264d 100644
--- a/pkgs/applications/audio/ocenaudio/default.nix
+++ b/pkgs/applications/audio/ocenaudio/default.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ocenaudio";
-  version = "3.11.20";
+  version = "3.11.21";
 
   src = fetchurl {
     url = "https://www.ocenaudio.com/downloads/index.php/ocenaudio_debian9_64.deb?version=${version}";
-    sha256 = "sha256-ifzth9qd2YX9WeF6QeXSWkMqRyTGBxPyTm5tkanPiFQ=";
+    sha256 = "sha256-nItqx3g4W3s1phHe6F8EtOL4nwJQ0XnKB8Ujg71/Q3Q=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/audio/qpwgraph/default.nix b/pkgs/applications/audio/qpwgraph/default.nix
index e9b6e76368e93..3e0206a654bf0 100644
--- a/pkgs/applications/audio/qpwgraph/default.nix
+++ b/pkgs/applications/audio/qpwgraph/default.nix
@@ -5,14 +5,14 @@
 
 mkDerivation rec {
   pname = "qpwgraph";
-  version = "0.3.6";
+  version = "0.3.9";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "rncbc";
     repo = "qpwgraph";
     rev = "v${version}";
-    sha256 = "sha256-uN3SAmpurINV+7vw51fWdwnuW2yBxnedY6BXdwn/S2s=";
+    sha256 = "sha256-KGZ67FF3WlKwUzVV3qz1DR/7i1mXsfXVVyuNoIR9uP0=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
diff --git a/pkgs/applications/audio/rosegarden/default.nix b/pkgs/applications/audio/rosegarden/default.nix
index dd0112d821620..0a82a4671db28 100644
--- a/pkgs/applications/audio/rosegarden/default.nix
+++ b/pkgs/applications/audio/rosegarden/default.nix
@@ -23,11 +23,11 @@
 
 stdenv.mkDerivation rec {
   pname = "rosegarden";
-  version = "20.12";
+  version = "22.12.1";
 
   src = fetchurl {
     url = "mirror://sourceforge/rosegarden/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-iGaEr8WFipV4I00fhFGI2xMBFPf784IIxNXs2hUTHFs=";
+    sha256 = "sha256-fqeif37lxJeBcI+cYVpRkZuJImSlmeZO3yzSNzPZkgY=";
   };
 
   postPhase = ''
diff --git a/pkgs/applications/audio/spek/default.nix b/pkgs/applications/audio/spek/default.nix
index 74c53f96efdc1..0c1aa5fa0e2f2 100644
--- a/pkgs/applications/audio/spek/default.nix
+++ b/pkgs/applications/audio/spek/default.nix
@@ -1,22 +1,19 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, intltool, pkg-config, ffmpeg, wxGTK30, gtk3, wrapGAppsHook }:
+{ lib, stdenv, fetchFromGitHub, autoreconfHook, intltool, pkg-config, ffmpeg, wxGTK32, gtk3, wrapGAppsHook }:
 
 stdenv.mkDerivation rec {
   pname = "spek";
-  version = "unstable-2018-12-29";
+  version = "0.8.4";
 
   src = fetchFromGitHub {
     owner = "alexkay";
     repo = "spek";
-    rev = "f071c2956176ad53c7c8059e5c00e694ded31ded";
-    sha256 = "1l9gj9c1n92zlcjnyjyk211h83dk0idk644xnm5rs7q40p2zliy5";
+    rev = "v${version}";
+    sha256 = "sha256-JLQx5LlnVe1TT1KVO3/QSVRqYL+pAMCxoDWrnkUNmRU=";
   };
 
-  # needed for autoreconfHook
-  AUTOPOINT="intltoolize --automake --copy";
-
   nativeBuildInputs = [ autoreconfHook intltool pkg-config wrapGAppsHook ];
 
-  buildInputs = [ ffmpeg wxGTK30 gtk3 ];
+  buildInputs = [ ffmpeg wxGTK32 gtk3 ];
 
   meta = with lib; {
     description = "Analyse your audio files by showing their spectrogram";
diff --git a/pkgs/applications/audio/spotifyd/default.nix b/pkgs/applications/audio/spotifyd/default.nix
index bfeb8a7dab3a3..274b054955b75 100644
--- a/pkgs/applications/audio/spotifyd/default.nix
+++ b/pkgs/applications/audio/spotifyd/default.nix
@@ -9,16 +9,16 @@
 
 rustPackages.rustPlatform.buildRustPackage rec {
   pname = "spotifyd";
-  version = "0.3.3";
+  version = "0.3.4";
 
   src = fetchFromGitHub {
     owner = "Spotifyd";
     repo = "spotifyd";
     rev = "v${version}";
-    sha256 = "1liql2wp7cx0x4ha1578wx3m4byd295m4ph268s05yw2wrnr3v6c";
+    sha256 = "sha256-9zwHBDrdvE2R/cdrWgjsfHlm3wEZ9SB2VNcqezB/Op0=";
   };
 
-  cargoSha256 = "1plvqd55d1gj0ydimv3154pwgj2sh1fqx2182nw8akzdfmzg1150";
+  cargoSha256 = "sha256-fQm7imXpm5AcKdg0cU/Rf2mAeg2ebZKRisJZSnG0REI=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/applications/audio/strawberry/default.nix b/pkgs/applications/audio/strawberry/default.nix
index 13dc80c1dc632..303e0e265f813 100644
--- a/pkgs/applications/audio/strawberry/default.nix
+++ b/pkgs/applications/audio/strawberry/default.nix
@@ -42,13 +42,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "strawberry";
-  version = "1.0.10";
+  version = "1.0.11";
 
   src = fetchFromGitHub {
     owner = "jonaski";
     repo = pname;
     rev = version;
-    hash = "sha256-N3jLw2UXLXLpTmFIHihzcMXrxJY0gmvwoawTQ0vRR+w=";
+    hash = "sha256-w2KOZwxPpe/yQw2RBeTEYueeq7m5ZCQXlUH/f52GiyI=";
   };
 
   # the big strawberry shown in the context menu is *very* much in your face, so use the grey version instead
diff --git a/pkgs/applications/editors/l3afpad/default.nix b/pkgs/applications/editors/l3afpad/default.nix
new file mode 100644
index 0000000000000..e047aaa270289
--- /dev/null
+++ b/pkgs/applications/editors/l3afpad/default.nix
@@ -0,0 +1,25 @@
+{ lib, stdenv, fetchurl, intltool, pkg-config, gtk3, fetchFromGitHub
+, autoreconfHook, wrapGAppsHook }:
+
+stdenv.mkDerivation rec {
+  version = "unstable-2022-02-14";
+  pname = "l3afpad";
+
+  src = fetchFromGitHub {
+    owner = "stevenhoneyman";
+    repo = pname;
+    rev = "16f22222116b78b7f6a6fd83289937cdaabed624";
+    sha256 = "sha256-ly2w9jmRlprm/PnyC0LYjrxBVK+J0DLiSpzuTUMZpWA=";
+  };
+
+  nativeBuildInputs = [ pkg-config autoreconfHook wrapGAppsHook ];
+  buildInputs = [ intltool gtk3 ];
+
+  meta = with lib; {
+    description = "Simple text editor forked from Leafpad using GTK+ 3.x";
+    homepage = "https://github.com/stevenhoneyman/l3afpad";
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ ckie ];
+    license = licenses.gpl2;
+  };
+}
diff --git a/pkgs/applications/editors/lite-xl/default.nix b/pkgs/applications/editors/lite-xl/default.nix
index 11dd387523774..577ea527804c7 100644
--- a/pkgs/applications/editors/lite-xl/default.nix
+++ b/pkgs/applications/editors/lite-xl/default.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "lite-xl";
-  version = "2.1.0";
+  version = "2.1.1";
 
   src = fetchFromGitHub {
     owner = "lite-xl";
     repo = "lite-xl";
     rev = "v${version}";
-    sha256 = "sha256-9nQFdii6SY14Cul7Ki0DUEsu75HWTCeEZtXaU6KGRiM=";
+    sha256 = "sha256-tZ9bCazs4ygNl5RKFNUtxboaMcG8a7mIz2FuiExX1d4=";
   };
 
   nativeBuildInputs = [ meson ninja pkg-config ];
diff --git a/pkgs/applications/editors/molsketch/default.nix b/pkgs/applications/editors/molsketch/default.nix
new file mode 100644
index 0000000000000..cb94cef3a328f
--- /dev/null
+++ b/pkgs/applications/editors/molsketch/default.nix
@@ -0,0 +1,40 @@
+{ lib
+, stdenv
+, mkDerivation
+, fetchurl
+, cmake
+, pkg-config
+, hicolor-icon-theme
+, openbabel
+, desktop-file-utils
+, qttranslations
+}:
+
+mkDerivation rec {
+  pname = "molsketch";
+  version = "0.7.3";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/molsketch/Molsketch-${version}-src.tar.gz";
+    hash = "sha256-82iNJRiXqESwidjifKBf0+ljcqbFD1WehsXI8VUgrwQ=";
+  };
+
+  preConfigure = ''
+    cmakeFlags="$cmakeFlags -DMSK_PREFIX=$out"
+  '';
+
+  nativeBuildInputs = [ cmake pkg-config ];
+  buildInputs = [
+    hicolor-icon-theme
+    openbabel
+    desktop-file-utils
+    qttranslations
+  ];
+
+  meta = with lib; {
+    description = "2D molecule editor";
+    homepage = "https://sourceforge.net/projects/molsketch/";
+    license = licenses.gpl2Plus;
+    maintainers = [ maintainers.fortuneteller2k ];
+  };
+}
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index 16af8d0a3e74d..263c0428ff149 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -835,12 +835,12 @@ final: prev:
 
   barbecue-nvim = buildVimPluginFrom2Nix {
     pname = "barbecue.nvim";
-    version = "2022-12-31";
+    version = "2023-01-02";
     src = fetchFromGitHub {
       owner = "utilyre";
       repo = "barbecue.nvim";
-      rev = "95f145a9445df954918e3751dd51ba2446606a31";
-      sha256 = "1vv4pp02znww3kmwn0y9j8xds6z83cfbv4mr1fcw8qj2k6f76h2r";
+      rev = "1006f449e7bef625e706d53adfe944647c6a990d";
+      sha256 = "1765bf151k1gcjb5c6yysrhabbr9bi454xhlk9nvr3zlfzsva5h8";
     };
     meta.homepage = "https://github.com/utilyre/barbecue.nvim/";
   };
@@ -2033,6 +2033,18 @@ final: prev:
     meta.homepage = "https://github.com/Shougo/context_filetype.vim/";
   };
 
+  copilot-cmp = buildVimPluginFrom2Nix {
+    pname = "copilot-cmp";
+    version = "2022-10-12";
+    src = fetchFromGitHub {
+      owner = "zbirenbaum";
+      repo = "copilot-cmp";
+      rev = "84d5a0e8e4d1638e7554899cb7b642fa24cf463f";
+      sha256 = "180y6d89bldlpilhfz7dakyaml6mfhspnxjn4jliwql4k45xckbi";
+    };
+    meta.homepage = "https://github.com/zbirenbaum/copilot-cmp/";
+  };
+
   copilot-lua = buildVimPluginFrom2Nix {
     pname = "copilot.lua";
     version = "2022-12-20";
@@ -2131,12 +2143,12 @@ final: prev:
 
   crates-nvim = buildVimPluginFrom2Nix {
     pname = "crates.nvim";
-    version = "2022-12-17";
+    version = "2023-01-02";
     src = fetchFromGitHub {
       owner = "saecki";
       repo = "crates.nvim";
-      rev = "a70328ae638e20548bcfc64eb9561101104b3008";
-      sha256 = "0i5bpg4sxm61200mwi3flji5cciv8izbcp38i4bkjm82ad09byzf";
+      rev = "d8657ee78e0c5cb47d4ed87aae11047af03491b9";
+      sha256 = "0s43mmcx2pmvww7vp1hzgk1xfxw2pcg7rs07wk4lm3ld5a0fyhcs";
     };
     meta.homepage = "https://github.com/saecki/crates.nvim/";
   };
@@ -2915,12 +2927,12 @@ final: prev:
 
   firenvim = buildVimPluginFrom2Nix {
     pname = "firenvim";
-    version = "2022-11-10";
+    version = "2023-01-02";
     src = fetchFromGitHub {
       owner = "glacambre";
       repo = "firenvim";
-      rev = "17a189f0f1e2d4197e00cd56dbeaed8c268bac8c";
-      sha256 = "1fwwmvl1zciffwjf6iskqa5qychknnc300y9ympg51hlxzmm0vpz";
+      rev = "c9cab43d62919c5fd34ebe33270a227a11442e12";
+      sha256 = "1dgn27midg4sis3bq6y9k42dpmk2415kskv7lq56s0pq963377fi";
     };
     meta.homepage = "https://github.com/glacambre/firenvim/";
   };
@@ -3180,12 +3192,12 @@ final: prev:
 
   gentoo-syntax = buildVimPluginFrom2Nix {
     pname = "gentoo-syntax";
-    version = "2022-12-04";
+    version = "2023-01-02";
     src = fetchFromGitHub {
       owner = "gentoo";
       repo = "gentoo-syntax";
-      rev = "526aeb1acda9504a4293b2a221700f6441211a7d";
-      sha256 = "0nzsn79m3xk338gikz0qk7lqriia0fjfxbw3k9aj5h3kqxw7qgmw";
+      rev = "9e4f5360b69558799c6974ed72248b86d09c6549";
+      sha256 = "1pv64p2g385h4awapg99m39r3qipkpwg4rkicvdsc0dsnamqmis3";
     };
     meta.homepage = "https://github.com/gentoo/gentoo-syntax/";
   };
@@ -3310,6 +3322,18 @@ final: prev:
     meta.homepage = "https://github.com/gregsexton/gitv/";
   };
 
+  glance-nvim = buildVimPluginFrom2Nix {
+    pname = "glance.nvim";
+    version = "2022-12-05";
+    src = fetchFromGitHub {
+      owner = "DNLHC";
+      repo = "glance.nvim";
+      rev = "cc087d378c3458fd2fb5ddf627af5e8fa1b76458";
+      sha256 = "0608j0kawm641sd7jcccc461wabncxlnssldi976grb5v8mk3kx0";
+    };
+    meta.homepage = "https://github.com/DNLHC/glance.nvim/";
+  };
+
   gleam-vim = buildVimPluginFrom2Nix {
     pname = "gleam.vim";
     version = "2020-06-24";
@@ -3527,12 +3551,12 @@ final: prev:
 
   haskell-tools-nvim = buildVimPluginFrom2Nix {
     pname = "haskell-tools.nvim";
-    version = "2023-01-01";
+    version = "2023-01-02";
     src = fetchFromGitHub {
       owner = "MrcJkb";
       repo = "haskell-tools.nvim";
-      rev = "ad0f38f8c1a2cabc155ef9c7f6065578150edbe8";
-      sha256 = "1p0iinpzfhsh79kcxihs8zrzdzragvg93i73z3y33k7nrbqhplk8";
+      rev = "37684363cbab507f5069c2976f1232888734dc5b";
+      sha256 = "0fyl0ab4rbw0sm4275dhjb0vcfa2pvxbqy03s7wiy86yn6h994cy";
     };
     meta.homepage = "https://github.com/MrcJkb/haskell-tools.nvim/";
   };
@@ -4067,12 +4091,12 @@ final: prev:
 
   lazy-nvim = buildVimPluginFrom2Nix {
     pname = "lazy.nvim";
-    version = "2023-01-01";
+    version = "2023-01-02";
     src = fetchFromGitHub {
       owner = "folke";
       repo = "lazy.nvim";
-      rev = "3974a6cbe38f7958c2e4f41c6f0d9a6c001a723d";
-      sha256 = "1idpzy1mnkgvpgiiirazpfpdm2xvv4zl7bbfsvmfqi6wc57c7vx6";
+      rev = "06db1ec3c6baa9460e42ef8ed4d2cc2613b194cb";
+      sha256 = "071zhazm15jbp8biv4516fckhy72fvvxlnjvicdi43b2g2941zcn";
     };
     meta.homepage = "https://github.com/folke/lazy.nvim/";
   };
@@ -4703,12 +4727,12 @@ final: prev:
 
   mini-nvim = buildVimPluginFrom2Nix {
     pname = "mini.nvim";
-    version = "2022-12-30";
+    version = "2023-01-02";
     src = fetchFromGitHub {
       owner = "echasnovski";
       repo = "mini.nvim";
-      rev = "06eddfd8d6341e6c4f53ec9ae109a376a566329d";
-      sha256 = "19q7khrgkc2214gjn988dlviavpf7ry695h9x077a1ykkml5jxfm";
+      rev = "a2d436f4b8b7d59c0ebcf5a5fed39ccab0e68515";
+      sha256 = "0p1g34xwnqkallf0y9lfv0czcwgqf1dlh1d7ir3cc024zfmx0d2j";
     };
     meta.homepage = "https://github.com/echasnovski/mini.nvim/";
   };
@@ -5063,12 +5087,12 @@ final: prev:
 
   neoconf-nvim = buildVimPluginFrom2Nix {
     pname = "neoconf.nvim";
-    version = "2023-01-01";
+    version = "2023-01-02";
     src = fetchFromGitHub {
       owner = "folke";
       repo = "neoconf.nvim";
-      rev = "02eef4955474c026ae425d8888b17e036d93c4c2";
-      sha256 = "0w8dd3mzbhvfhyg7qdr97k4wsih81li6pzj19qp36220lzz6a3j7";
+      rev = "590ff74e81694088c43f1f73982dcb7aa51c03ff";
+      sha256 = "13bz3pdc4lcd8f2jr5g5p8fp12cwszamsvbyzbwbh6cfcj1qi9z0";
     };
     meta.homepage = "https://github.com/folke/neoconf.nvim/";
   };
@@ -5087,12 +5111,12 @@ final: prev:
 
   neodev-nvim = buildVimPluginFrom2Nix {
     pname = "neodev.nvim";
-    version = "2022-12-28";
+    version = "2023-01-02";
     src = fetchFromGitHub {
       owner = "folke";
       repo = "neodev.nvim";
-      rev = "8e06acf88e0621badd9499cfcafbce5ca97dfe8e";
-      sha256 = "1s09id5l0580ckrn7srkq8d2n0mg75dph3zknwb5wig3k11yajhz";
+      rev = "c045c0fe93b1f9c78443d0f3b88660fffbcf64a7";
+      sha256 = "1zw7shzfcjnclv1bj4agkbqv0jswpz3bv9amj9397ypjlafm25wc";
     };
     meta.homepage = "https://github.com/folke/neodev.nvim/";
   };
@@ -5171,12 +5195,12 @@ final: prev:
 
   neorg = buildVimPluginFrom2Nix {
     pname = "neorg";
-    version = "2022-12-23";
+    version = "2023-01-02";
     src = fetchFromGitHub {
       owner = "nvim-neorg";
       repo = "neorg";
-      rev = "2c18f831effb5f3f383b2049902be23ea0dd7a8e";
-      sha256 = "10lwjrwxjmag2jbhpzfv9g6zpl7mlmv646gr062pragb2cphrm7n";
+      rev = "00532bd997d2aef0384ed8f11500d33d229a7e53";
+      sha256 = "194fp3j7fyvd6iwk5n4s8jm81ljkgi8a5611iibasl8wynzmvvv1";
     };
     meta.homepage = "https://github.com/nvim-neorg/neorg/";
   };
@@ -5243,24 +5267,24 @@ final: prev:
 
   neotest-haskell = buildVimPluginFrom2Nix {
     pname = "neotest-haskell";
-    version = "2022-12-28";
+    version = "2023-01-02";
     src = fetchFromGitHub {
       owner = "MrcJkb";
       repo = "neotest-haskell";
-      rev = "7a3a6fcf2bde2a98b2d221bf54162eef2e09eb50";
-      sha256 = "1i99x9d6kqd8qrvy3si2h4mk3d5akqjibs006wf7fp2gr7fivvkc";
+      rev = "c6a60b8476e146f22e47b378d8f52ed7b35dd8a1";
+      sha256 = "0235ljraa6cbwb81jhijw10i3kc1xlmiq01qwzgqz8saacd26ccr";
     };
     meta.homepage = "https://github.com/MrcJkb/neotest-haskell/";
   };
 
   neovim-ayu = buildVimPluginFrom2Nix {
     pname = "neovim-ayu";
-    version = "2023-01-01";
+    version = "2023-01-02";
     src = fetchFromGitHub {
       owner = "Shatur";
       repo = "neovim-ayu";
-      rev = "5dd9db767538e62005bb028a88c08ff321248aa2";
-      sha256 = "03s75winr4i9gdd9wm98g15x2h0w9iwpdrzg2xp771b43qvilxzv";
+      rev = "9fe707327c539cf092b8e6c4e7ba82e906ee0d06";
+      sha256 = "0j3aqf294967q6b55vjj96mw1ki0dx6306mjvglj52bkl9ya5nhc";
     };
     meta.homepage = "https://github.com/Shatur/neovim-ayu/";
   };
@@ -5399,12 +5423,12 @@ final: prev:
 
   nlsp-settings-nvim = buildVimPluginFrom2Nix {
     pname = "nlsp-settings.nvim";
-    version = "2023-01-01";
+    version = "2023-01-02";
     src = fetchFromGitHub {
       owner = "tamago324";
       repo = "nlsp-settings.nvim";
-      rev = "e73d509e77d97324a1fe3cc0118a707cc28cf92b";
-      sha256 = "0n6crpb6gvi5vyirypz7s4c38k80iah1203w5hvlx5qr0bjxw14c";
+      rev = "4d7588d898cc4d20891d36a5288045237ca523da";
+      sha256 = "080d32pwwq7r1crb843m9vq4wqdzx2l0cmd0b0aq8zqgh7d1c6ck";
     };
     meta.homepage = "https://github.com/tamago324/nlsp-settings.nvim/";
   };
@@ -5963,12 +5987,12 @@ final: prev:
 
   nvim-lint = buildVimPluginFrom2Nix {
     pname = "nvim-lint";
-    version = "2022-12-15";
+    version = "2023-01-02";
     src = fetchFromGitHub {
       owner = "mfussenegger";
       repo = "nvim-lint";
-      rev = "d60514f14baf8eacef4166070783d26c28fe3699";
-      sha256 = "0fxk2gwq1dpmjsk9vwb8vh54xv7wh21skw1c4wg8pz9fcar3790w";
+      rev = "f6ce208ec8b84fe125a4b74566a73d817abec3a8";
+      sha256 = "002qphin2cypfwnzp51q042hi5iqmh9dkx6cd0cy0l5yyayvzjrw";
     };
     meta.homepage = "https://github.com/mfussenegger/nvim-lint/";
   };
@@ -6035,12 +6059,12 @@ final: prev:
 
   nvim-metals = buildVimPluginFrom2Nix {
     pname = "nvim-metals";
-    version = "2022-12-29";
+    version = "2023-01-02";
     src = fetchFromGitHub {
       owner = "scalameta";
       repo = "nvim-metals";
-      rev = "7fd10c569ed4eb9f7ec5355d7829ab124b4e6f99";
-      sha256 = "1jc26mh63pq5jslzxjhbihywa0x4q4qmayc5qcq9davmghdsd5hf";
+      rev = "ddc1cb77b84c96152ab2a05cd22215da49d624ba";
+      sha256 = "0fxbxi7xy19qhd1mzq2h8q5plq6sbmgy50z6kipc8n8lf57f2p5v";
     };
     meta.homepage = "https://github.com/scalameta/nvim-metals/";
   };
@@ -6071,12 +6095,12 @@ final: prev:
 
   nvim-neoclip-lua = buildVimPluginFrom2Nix {
     pname = "nvim-neoclip.lua";
-    version = "2022-10-13";
+    version = "2023-01-01";
     src = fetchFromGitHub {
       owner = "AckslD";
       repo = "nvim-neoclip.lua";
-      rev = "3e0b9a134838c7356d743f84a272c92410c47d8d";
-      sha256 = "19xwirhaw8y9blll37xwk13cn74cw6cl1j76773nkxgx5m5cynpg";
+      rev = "db50498b0e07c1fb2e5b9894e512d7b333a8bb76";
+      sha256 = "1nicrjh16d2bpqa41c0cz2wq4fqnpjlr2mmidld48p1xl4fvviin";
     };
     meta.homepage = "https://github.com/AckslD/nvim-neoclip.lua/";
   };
@@ -6191,12 +6215,12 @@ final: prev:
 
   nvim-surround = buildVimPluginFrom2Nix {
     pname = "nvim-surround";
-    version = "2022-12-30";
+    version = "2023-01-01";
     src = fetchFromGitHub {
       owner = "kylechui";
       repo = "nvim-surround";
-      rev = "64e21061953102b19bbb22e824fbb96054782799";
-      sha256 = "11m62i66gicv7spz6bcsxpdqshi19v0306bh69lcmbyawbwyli4a";
+      rev = "ad56e6234bf42fb7f7e4dccc7752e25abd5ec80e";
+      sha256 = "1fi5lk3iacjdbq1p4wm0bia93awwqfn7jiy019vpg4gngi41azrz";
     };
     meta.homepage = "https://github.com/kylechui/nvim-surround/";
   };
@@ -6231,20 +6255,20 @@ final: prev:
     src = fetchFromGitHub {
       owner = "nvim-tree";
       repo = "nvim-tree.lua";
-      rev = "e322fbb80b0be5e885268c91ab29cbfe0143cd5b";
-      sha256 = "1195sw9h1wk5p2x9xj3zqkm5a7sm6l8qq8jxhvrbq14xmw5594sm";
+      rev = "951b6e7e55da8aee9566cc0b17c11f9451cec349";
+      sha256 = "11f1m815bgj0j6xack9q8jcnaqbpzlxhlbkqalwl8ahd6w06n9qv";
     };
     meta.homepage = "https://github.com/nvim-tree/nvim-tree.lua/";
   };
 
   nvim-treesitter = buildVimPluginFrom2Nix {
     pname = "nvim-treesitter";
-    version = "2023-01-01";
+    version = "2023-01-02";
     src = fetchFromGitHub {
       owner = "nvim-treesitter";
       repo = "nvim-treesitter";
-      rev = "b67822bf58b0fbf0c496ae21a177d02fa8388edf";
-      sha256 = "01l1sl39pia8fa2b7ld0rdi76yjlrnh82rlxvgfqjivppq23k0zm";
+      rev = "12e95e160d7d45b76a36bca6303dd8447ab77490";
+      sha256 = "1vsqcl4xcy02lp8rv1fgvq3y76whb0grmj63rif7b48vrj427w94";
     };
     meta.homepage = "https://github.com/nvim-treesitter/nvim-treesitter/";
   };
@@ -6323,12 +6347,12 @@ final: prev:
 
   nvim-ts-rainbow = buildVimPluginFrom2Nix {
     pname = "nvim-ts-rainbow";
-    version = "2022-11-04";
+    version = "2023-01-02";
     src = fetchFromGitHub {
       owner = "p00f";
       repo = "nvim-ts-rainbow";
-      rev = "064fd6c0a15fae7f876c2c6dd4524ca3fad96750";
-      sha256 = "1b7z8xyiplb9rjkdqwijnypjqrssrz5lr1wnl5vk1pyb6dnxspzg";
+      rev = "ef95c15a935f97c65a80e48e12fe72d49aacf9b9";
+      sha256 = "0ldv8g9i25286n0xqa1cj7a2lglcz9564dawz6ixd4ipsysjj571";
     };
     meta.homepage = "https://github.com/p00f/nvim-ts-rainbow/";
   };
@@ -8923,12 +8947,12 @@ final: prev:
 
   vim-airline = buildVimPluginFrom2Nix {
     pname = "vim-airline";
-    version = "2023-01-01";
+    version = "2023-01-02";
     src = fetchFromGitHub {
       owner = "vim-airline";
       repo = "vim-airline";
-      rev = "785dbbe504f9fe00f6adc1cc2598fcc701cec224";
-      sha256 = "105k0qnav9xpadjbnnxz5nq6zlp856kjndy1p8ic12brzsjr74dv";
+      rev = "0913c0a3b6fc256e6de8dff00dfd1c9388cad9a6";
+      sha256 = "0bvyr49shcqbdmcp0q06nfbay5cff11r80nhis3p3gdccik74zv7";
     };
     meta.homepage = "https://github.com/vim-airline/vim-airline/";
   };
@@ -10279,12 +10303,12 @@ final: prev:
 
   vim-graphql = buildVimPluginFrom2Nix {
     pname = "vim-graphql";
-    version = "2022-12-24";
+    version = "2023-01-02";
     src = fetchFromGitHub {
       owner = "jparise";
       repo = "vim-graphql";
-      rev = "ee618bc2101040a4a702b4724a094ca2820562b4";
-      sha256 = "1qj5jsdz3r9j6djhqdfjpd6qmpqbamngr8y4lvgkjpbjz2jvrgp1";
+      rev = "ca377b1592428c0a96507d17197fdc79d4694123";
+      sha256 = "1mhx32gvm7bpf1av7laji3ic5im5yzplskw7z1bcny16f8p0m6my";
     };
     meta.homepage = "https://github.com/jparise/vim-graphql/";
   };
@@ -12146,8 +12170,8 @@ final: prev:
     src = fetchFromGitHub {
       owner = "tpope";
       repo = "vim-sensible";
-      rev = "dad453eb1b1dfb5d682b0834341239eb647768f9";
-      sha256 = "0bjn7lr7bxifxrjfmkpdq8f41lwjwjbxqq30in92r7d7dv811yy8";
+      rev = "eb59f4550894257af6033b95d23e3971d369e8b8";
+      sha256 = "0d5nfdjcsl2mxlxdgxrq5crgfmlpbpf5ypz57hxh4ribnj3b3027";
     };
     meta.homepage = "https://github.com/tpope/vim-sensible/";
   };
@@ -12731,12 +12755,12 @@ final: prev:
 
   vim-tmux-navigator = buildVimPluginFrom2Nix {
     pname = "vim-tmux-navigator";
-    version = "2022-12-08";
+    version = "2023-01-02";
     src = fetchFromGitHub {
       owner = "christoomey";
       repo = "vim-tmux-navigator";
-      rev = "41ea9d23b814014c8d8daf8b44fa0cd827a0e5f4";
-      sha256 = "15581nighr1a82gkn0blkx75l6bz0vfq573nf626dw1qa652nipz";
+      rev = "18f0c7fc1e7181e6422247505727d7111c5da544";
+      sha256 = "0ws9sz3sz4izfh6chrvj8p00np37n16n48mrzispdm3ph8nb1ii3";
     };
     meta.homepage = "https://github.com/christoomey/vim-tmux-navigator/";
   };
diff --git a/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix b/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
index 447a1d5183e43..c6c995700075b 100644
--- a/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
@@ -1,6 +1,6 @@
 # generated by pkgs/applications/editors/vim/plugins/nvim-treesitter/update.py
 
-{ buildGrammar, fetchFromGitHub, fetchFromGitLab, fetchFromSourcehut, fetchgit }:
+{ buildGrammar, fetchFromBitbucket, fetchFromGitHub, fetchFromGitLab, fetchFromGitea, fetchFromGitiles, fetchFromRepoOrCz, fetchFromSourcehut, fetchgit }:
 
 {
   ada = buildGrammar {
@@ -604,12 +604,12 @@
   };
   help = buildGrammar {
     language = "help";
-    version = "61c7505";
+    version = "9dee68e";
     source = fetchFromGitHub {
       owner = "neovim";
       repo = "tree-sitter-vimdoc";
-      rev = "61c75058299f3d1cf565697e4073d7b2cc6a6d6c";
-      hash = "sha256-MTossQzmBoHqXu933suYUUyDbmb20uO5oZlV31BYqIA=";
+      rev = "9dee68e3912d16e9878b06e3cd87e21ada3d9029";
+      hash = "sha256-6XYEC+wKrCbPtcdjFH1O0EdX84M+NpPfTO2tXGFkwtk=";
     };
     meta.homepage = "https://github.com/neovim/tree-sitter-vimdoc";
   };
@@ -1371,8 +1371,10 @@
   t32 = buildGrammar {
     language = "t32";
     version = "f8106fc";
-    source = fetchgit {
-      url = "https://codeberg.org/xasc/tree-sitter-t32";
+    source = fetchFromGitea {
+      domain = "codeberg.org";
+      owner = "xasc";
+      repo = "tree-sitter-t32";
       rev = "f8106fcf5a27f905b3d9d55d9cd3e910bea70c60";
       hash = "sha256-hKddSekx67Yqm4+LqVaH8Sf1+73RlCnXE6th2FTHB34=";
     };
@@ -1494,12 +1496,12 @@
   };
   v = buildGrammar {
     language = "v";
-    version = "f0aa56e";
+    version = "0e3725a";
     source = fetchFromGitHub {
       owner = "vlang";
       repo = "vls";
-      rev = "f0aa56eec7689f08a389c90ad8d3e5e0d18b3cd7";
-      hash = "sha256-d69SvXDWxeRk2hvou8MhXUpUrSBwYENqFDGpT/Y5UpM=";
+      rev = "0e3725a0c10d357f16b716f9a321a337bc802f02";
+      hash = "sha256-RDG/HFSMF5zxtO/elhtv2oH3OnUx47X3xYRqS1+Oz9U=";
     };
     location = "tree_sitter_v";
     meta.homepage = "https://github.com/vlang/vls";
diff --git a/pkgs/applications/editors/vim/plugins/nvim-treesitter/update.py b/pkgs/applications/editors/vim/plugins/nvim-treesitter/update.py
index 416a6d7f96a86..6b297cd59157b 100755
--- a/pkgs/applications/editors/vim/plugins/nvim-treesitter/update.py
+++ b/pkgs/applications/editors/vim/plugins/nvim-treesitter/update.py
@@ -60,7 +60,12 @@ def generate_grammar(item):
 
 generated_file = """# generated by pkgs/applications/editors/vim/plugins/nvim-treesitter/update.py
 
-{ buildGrammar, fetchFromGitHub, fetchFromGitLab, fetchFromSourcehut, fetchgit }:
+{ buildGrammar"""
+
+for fetcher in subprocess.check_output(["nurl", "-L"], text=True).splitlines():
+    generated_file += f", {fetcher}"
+
+generated_file += """ }:
 
 {
 """
diff --git a/pkgs/applications/editors/vim/plugins/update.py b/pkgs/applications/editors/vim/plugins/update.py
index 7e5c7380597c7..20336c66ed6ec 100755
--- a/pkgs/applications/editors/vim/plugins/update.py
+++ b/pkgs/applications/editors/vim/plugins/update.py
@@ -137,11 +137,15 @@ def main():
         subprocess.check_call([nvim_treesitter_dir.joinpath("update.py")])
 
         if editor.nixpkgs_repo:
-            msg = "vimPlugins.nvim-treesitter: update grammars"
-            print(f"committing to nixpkgs: {msg}")
             index = editor.nixpkgs_repo.index
-            index.add([str(nvim_treesitter_dir.joinpath("generated.nix"))])
-            index.commit(msg)
+            for diff in index.diff(None):
+                if diff.a_path == "pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix":
+                    msg = "vimPlugins.nvim-treesitter: update grammars"
+                    print(f"committing to nixpkgs: {msg}")
+                    index.add([str(nvim_treesitter_dir.joinpath("generated.nix"))])
+                    index.commit(msg)
+                    return
+            print("no updates to nvim-treesitter grammars")
 
 
 if __name__ == "__main__":
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index bf53350006c6d..f729c240f5df7 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -170,6 +170,7 @@ https://github.com/rhysd/conflict-marker.vim/,,
 https://github.com/Olical/conjure/,,
 https://github.com/wellle/context.vim/,,
 https://github.com/Shougo/context_filetype.vim/,,
+https://github.com/zbirenbaum/copilot-cmp/,HEAD,
 https://github.com/zbirenbaum/copilot.lua/,HEAD,
 https://github.com/github/copilot.vim/,,
 https://github.com/ms-jpq/coq.artifacts/,HEAD,
@@ -276,6 +277,7 @@ https://github.com/vim-scripts/gitignore.vim/,,
 https://github.com/ruifm/gitlinker.nvim/,,
 https://github.com/lewis6991/gitsigns.nvim/,,
 https://github.com/gregsexton/gitv/,,
+https://github.com/DNLHC/glance.nvim/,HEAD,
 https://github.com/gleam-lang/gleam.vim/,,
 https://github.com/ellisonleao/glow.nvim/,,
 https://github.com/p00f/godbolt.nvim/,HEAD,
diff --git a/pkgs/applications/emulators/bsnes/ares/default.nix b/pkgs/applications/emulators/bsnes/ares/default.nix
index 96fc5c76d2f90..36d2dfe1ff332 100644
--- a/pkgs/applications/emulators/bsnes/ares/default.nix
+++ b/pkgs/applications/emulators/bsnes/ares/default.nix
@@ -2,6 +2,7 @@
 , stdenv
 , fetchFromGitHub
 , pkg-config
+, which
 , wrapGAppsHook
 , libicns
 , SDL2
@@ -42,6 +43,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     pkg-config
+    which
     wrapGAppsHook
   ] ++ lib.optionals stdenv.isDarwin [
     libicns
@@ -72,6 +74,7 @@ stdenv.mkDerivation (finalAttrs: {
     "hiro=gtk3"
   ] ++ lib.optionals stdenv.isDarwin [
     "hiro=cocoa"
+    "lto=false"
     "vulkan=false"
   ] ++ [
     "local=false"
diff --git a/pkgs/applications/emulators/melonDS/default.nix b/pkgs/applications/emulators/melonDS/default.nix
index 6e389b8daf640..d1573ba5967be 100644
--- a/pkgs/applications/emulators/melonDS/default.nix
+++ b/pkgs/applications/emulators/melonDS/default.nix
@@ -1,34 +1,44 @@
 { lib
 , fetchFromGitHub
-, mkDerivation
+, stdenv
 , cmake
-, libepoxy
+, extra-cmake-modules
 , libarchive
 , libpcap
 , libslirp
 , pkg-config
 , qtbase
+, qtmultimedia
 , SDL2
+, wayland
+, wrapQtAppsHook
 }:
 
-mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "melonDS";
-  version = "0.9.4";
+  version = "0.9.5";
 
   src = fetchFromGitHub {
     owner = "Arisotura";
     repo = pname;
     rev = version;
-    sha256 = "sha256-FSacau7DixU6R4eKNIYVRZiMb/GhijTzHbcGlZ6WG/I=";
+    sha256 = "sha256-n4Vkxb/7fr214PgB6VFNgH1tMDgTBS/UHUQ6V4uGkDA=";
   };
 
-  nativeBuildInputs = [ cmake pkg-config ];
+  nativeBuildInputs = [
+    cmake
+    extra-cmake-modules
+    pkg-config
+    wrapQtAppsHook
+  ];
+
   buildInputs = [
-    libepoxy
     libarchive
     libslirp
     qtbase
+    qtmultimedia
     SDL2
+    wayland
   ];
 
   qtWrapperArgs = [ "--prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ libpcap ]}" ];
diff --git a/pkgs/applications/emulators/wibo/default.nix b/pkgs/applications/emulators/wibo/default.nix
index 69137cb8f0304..54a544fc60040 100644
--- a/pkgs/applications/emulators/wibo/default.nix
+++ b/pkgs/applications/emulators/wibo/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "wibo";
-  version = "0.2.4";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "decompals";
     repo = "wibo";
     rev = version;
-    hash = "sha256-dpfKSiIWE9L5BLPH2t8RsUz7Ufkdo/5zn1dewaEgJl0=";
+    hash = "sha256-J5h/RpF+twb5fBjSDQMVB5SoTWWs8VD/EUuikuj73YA=";
   };
 
   nativeBuildInputs = [
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
       meta.license = lib.licenses.unfree;
     };
   in lib.optionalString doCheck ''
-    MWCIncludes=. ./wibo ${gc}/GC/2.7/mwcceppc.exe -c ../test/test.c
+    MWCIncludes=../test ./wibo ${gc}/GC/2.7/mwcceppc.exe -c ../test/test.c
     file test.o | grep "ELF 32-bit"
   '';
 
diff --git a/pkgs/applications/gis/saga/default.nix b/pkgs/applications/gis/saga/default.nix
index fc940cfce3018..59794b88a4fd3 100644
--- a/pkgs/applications/gis/saga/default.nix
+++ b/pkgs/applications/gis/saga/default.nix
@@ -31,11 +31,11 @@
 
 mkDerivation rec {
   pname = "saga";
-  version = "8.4.0";
+  version = "8.5.0";
 
   src = fetchurl {
     url = "mirror://sourceforge/saga-gis/SAGA%20-%20${lib.versions.major version}/SAGA%20-%20${version}/saga-${version}.tar.gz";
-    sha256 = "sha256-v6DPwV20fcsznrEaFJk0/ewU4z3cTjzYYuLkyMwSLV0=";
+    sha256 = "sha256-JzSuu1wGfCkxIDcTbP5jpHtJNvl8eAP3jznXvwSPeY0=";
   };
 
   sourceRoot = "saga-${version}/saga-gis";
diff --git a/pkgs/applications/graphics/blockbench-electron/default.nix b/pkgs/applications/graphics/blockbench-electron/default.nix
index 1968756496bbb..5afd0f1d876fc 100644
--- a/pkgs/applications/graphics/blockbench-electron/default.nix
+++ b/pkgs/applications/graphics/blockbench-electron/default.nix
@@ -1,12 +1,12 @@
-{ lib, stdenv, fetchurl, appimageTools, makeWrapper, electron_16 }:
+{ lib, stdenv, fetchurl, appimageTools, makeWrapper, electron_22 }:
 
 stdenv.mkDerivation rec {
   pname = "blockbench-electron";
-  version = "4.1.1";
+  version = "4.5.2";
 
   src = fetchurl {
     url = "https://github.com/JannisX11/blockbench/releases/download/v${version}/Blockbench_${version}.AppImage";
-    sha256 = "0mqdkjhmylrjjfrm05jv1967qqka5263fgcn9qzax08gcq93s18f";
+    sha256 = "sha256-uUgVBdYMCF31+L/FV4ADIpUdEAmnW59KfscQxUStPWM=";
     name = "${pname}-${version}.AppImage";
   };
 
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
   '';
 
   postFixup = ''
-    makeWrapper ${electron_16}/bin/electron $out/bin/${pname} \
+    makeWrapper ${electron_22}/bin/electron $out/bin/${pname} \
       --add-flags $out/share/${pname}/resources/app.asar \
       --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ stdenv.cc.cc ]}"
   '';
@@ -42,7 +42,7 @@ stdenv.mkDerivation rec {
     description = "A boxy 3D model editor powered by Electron";
     homepage = "https://blockbench.net/";
     license = licenses.gpl3Only;
-    maintainers = [ maintainers.ckie ];
+    maintainers = with maintainers; [ ckie ];
     platforms = [ "x86_64-linux" ];
   };
 }
diff --git a/pkgs/applications/graphics/eyedropper/default.nix b/pkgs/applications/graphics/eyedropper/default.nix
index 32098c977044f..41999239af1ae 100644
--- a/pkgs/applications/graphics/eyedropper/default.nix
+++ b/pkgs/applications/graphics/eyedropper/default.nix
@@ -15,19 +15,19 @@
 
 stdenv.mkDerivation rec {
   pname = "eyedropper";
-  version = "0.4.0";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "FineFindus";
     repo = pname;
-    rev = version;
-    hash = "sha256-bOpwHaFOoUlh+yyC1go6BeFxfJhUmwZPi6kYAqCagEI=";
+    rev = "v${version}";
+    hash = "sha256-sDrMIryVFkjMGHbYvNDmKb1HyJNGb3Hd+muxUJKhogE=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-TkdOq+icU2zNbXzN6nbkXjL1o/Lfumqr/5S0pQaxY5Q=";
+    hash = "sha256-mztc44hHdqzR3WbG6tkCL38EfgBajRLlpMC8ElpXnlo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/graphics/openimageio/2.x.nix b/pkgs/applications/graphics/openimageio/2.x.nix
index d6b710595a315..88d99a0fae76e 100644
--- a/pkgs/applications/graphics/openimageio/2.x.nix
+++ b/pkgs/applications/graphics/openimageio/2.x.nix
@@ -1,5 +1,6 @@
 { lib, stdenv
 , fetchFromGitHub
+, fetchpatch
 , boost
 , cmake
 , giflib
@@ -7,7 +8,7 @@
 , libjpeg
 , libpng
 , libtiff
-, opencolorio_1
+, opencolorio
 , openexr
 , robin-map
 , unzip
@@ -16,15 +17,23 @@
 
 stdenv.mkDerivation rec {
   pname = "openimageio";
-  version = "2.2.17.0";
+  version = "2.4.6.1";
 
   src = fetchFromGitHub {
     owner = "OpenImageIO";
     repo = "oiio";
-    rev = "Release-${version}";
-    sha256 = "0jqpb1zci911wdm928addsljxx8zsh0gzbhv9vbw6man4wi93h6h";
+    rev = "v${version}";
+    sha256 = "sha256-oBICukkborxXFHXyM2rIn5qSbCWECjwDQI9MUg13IRU=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "arm-fix-signed-unsigned-simd-mismatch.patch";
+      url = "https://github.com/OpenImageIO/oiio/commit/726c51181a2888b0bd1edbef5ac8451e9cc3f893.patch";
+      hash = "sha256-G4vexf0OHZ/sbcRob5X92tajkmAv72ok8rcVQtIE9XE=";
+    })
+  ];
+
   outputs = [ "bin" "out" "dev" "doc" ];
 
   nativeBuildInputs = [
@@ -39,7 +48,7 @@ stdenv.mkDerivation rec {
     libjpeg
     libpng
     libtiff
-    opencolorio_1
+    opencolorio
     openexr
     robin-map
     fmt
@@ -58,7 +67,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    homepage = "http://www.openimageio.org";
+    homepage = "https://openimageio.org";
     description = "A library and tools for reading and writing images";
     license = licenses.bsd3;
     maintainers = with maintainers; [ goibhniu ];
diff --git a/pkgs/applications/misc/grip/default.nix b/pkgs/applications/misc/grip/default.nix
index 4461df09c2245..281f8dec22720 100644
--- a/pkgs/applications/misc/grip/default.nix
+++ b/pkgs/applications/misc/grip/default.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation rec {
   pname = "grip";
-  version = "4.2.3";
+  version = "4.2.4";
 
   src = fetchurl {
     url = "mirror://sourceforge/grip/grip-${version}.tar.gz";
-    sha256 = "sha256-5Qgsf4+xs0ckhYJk2csKulXC3nWaLRAsQ15qaTkKkjw=";
+    sha256 = "sha256-lXu0mLLfcX8K1EmoFH0vp2cHluyRwhTL0/bW5Ax36mI=";
   };
 
   nativeBuildInputs = [ pkg-config libtool ];
diff --git a/pkgs/applications/misc/josm/default.nix b/pkgs/applications/misc/josm/default.nix
index 7b2973b5075e7..2efe9ec440e1c 100644
--- a/pkgs/applications/misc/josm/default.nix
+++ b/pkgs/applications/misc/josm/default.nix
@@ -3,15 +3,15 @@
 }:
 let
   pname = "josm";
-  version = "18583";
+  version = "18621";
   srcs = {
     jar = fetchurl {
       url = "https://josm.openstreetmap.de/download/josm-snapshot-${version}.jar";
-      hash = "sha256-6S6E7ngTCBXb0epPfYxIswLvfm9r2Ql0wgOs/PxpmIM=";
+      hash = "sha256-RZiYHDqowk0oG/rQVcsoYpZvL4wNmegZD2EHlsQggw8=";
     };
     macosx = fetchurl {
       url = "https://josm.openstreetmap.de/download/macosx/josm-macos-${version}-java17.zip";
-      hash = "sha256-3XEoSCXEpeqZj1y4nns5+0JR1SINYE1rsmQ4fMflxRQ=";
+      hash = "sha256-Sf5mgxWjq240U1tUByBS6FFb0Tpj/QP7yHl+wvTIfng=";
     };
     pkg = fetchsvn {
       url = "https://josm.openstreetmap.de/svn/trunk/native/linux/tested";
diff --git a/pkgs/applications/misc/keepass-diff/default.nix b/pkgs/applications/misc/keepass-diff/default.nix
new file mode 100644
index 0000000000000..3f88c00b4f5ae
--- /dev/null
+++ b/pkgs/applications/misc/keepass-diff/default.nix
@@ -0,0 +1,22 @@
+{ lib, fetchFromGitHub, rustPlatform }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "keepass-diff";
+  version = "1.1.3";
+
+  src = fetchFromGitHub {
+    owner = "Narigo";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-jd/cUkTHylLwzxolQUzMlXHauCfXUhcUr/1zKpdngbo=";
+  };
+
+  cargoSha256 = "sha256-2e2lGG72HmX7AFk0+J3U62Kch5ylrqvaIpitRF546JA=";
+
+  meta = with lib; {
+    description = "A CLI-tool to diff Keepass (.kdbx) files";
+    homepage = "https://keepass-diff.narigo.dev/";
+    license = licenses.mit;
+    maintainers = with maintainers; [ wamserma ];
+  };
+}
diff --git a/pkgs/applications/misc/librecad/default.nix b/pkgs/applications/misc/librecad/default.nix
index 54ed6c10f42a7..566730c12222a 100644
--- a/pkgs/applications/misc/librecad/default.nix
+++ b/pkgs/applications/misc/librecad/default.nix
@@ -1,7 +1,6 @@
 { lib
 , boost
 , fetchFromGitHub
-, fetchpatch
 , installShellFiles
 , mkDerivation
 , muparser
@@ -15,38 +14,42 @@
 
 mkDerivation rec {
   pname = "librecad";
-  version = "2.2.0-rc2";
+  version = "2.2.0";
 
   src = fetchFromGitHub {
     owner = "LibreCAD";
     repo = "LibreCAD";
     rev = version;
-    sha256 = "sha256-RNg7ioMriH4A7V65+4mh8NhsUHs/8IbTt38nVkYilCE=";
+    sha256 = "sha256-horKTegmvcMg4m5NbZ4nzy4J6Ac/6+E5OkiZl0v6TBc=";
   };
 
-  patches = [
-    (fetchpatch {
-      url = "https://github.com/LibreCAD/LibreCAD/pull/1465/commits/4edcbe72679f95cb60979c77a348c1522a20b0f4.patch";
-      sha256 = "sha256-P0G2O5sL7Ip860ByxFQ87TfV/lq06wCQnzPxADGqFPs=";
-      name = "CVE-2021-45342.patch";
-    })
+  buildInputs = [
+    boost
+    muparser
+    qtbase
+    qtsvg
+  ];
+
+  nativeBuildInputs = [
+    installShellFiles
+    pkg-config
+    qmake
+    qttools
+  ];
+
+  qmakeFlags = [
+    "MUPARSER_DIR=${muparser}"
+    "BOOST_DIR=${boost.dev}"
   ];
 
   postPatch = ''
     substituteInPlace scripts/postprocess-unix.sh \
       --replace /bin/sh ${runtimeShell}
 
-    substituteInPlace librecad/src/lib/engine/rs_system.cpp \
-      --replace /usr/share $out/share
-
     substituteInPlace librecad/src/main/qc_applicationwindow.cpp \
       --replace __DATE__ 0
   '';
 
-  qmakeFlags = [
-    "MUPARSER_DIR=${muparser}"
-    "BOOST_DIR=${boost.dev}"
-  ];
 
   installPhase = ''
     runHook preInstall
@@ -65,20 +68,6 @@ mkDerivation rec {
     runHook postInstall
   '';
 
-  buildInputs = [
-    boost
-    muparser
-    qtbase
-    qtsvg
-  ];
-
-  nativeBuildInputs = [
-    installShellFiles
-    pkg-config
-    qmake
-    qttools
-  ];
-
   meta = with lib; {
     description = "2D CAD package based on Qt";
     homepage = "https://librecad.org";
diff --git a/pkgs/applications/misc/nwg-dock/default.nix b/pkgs/applications/misc/nwg-dock/default.nix
index 32361b276b208..ff12f5d159ceb 100644
--- a/pkgs/applications/misc/nwg-dock/default.nix
+++ b/pkgs/applications/misc/nwg-dock/default.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "nwg-dock";
-  version = "0.3.2";
+  version = "0.3.3";
 
   src = fetchFromGitHub {
     owner = "nwg-piotr";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-X2AhzQsgUWHkPp1YoAxcbq+Oni9C6Yrnyt+Plxya8OI=";
+    sha256 = "sha256-RCVG38Y8VV7qGz/CaOZ4aw4Sg3PQdrB29zZqATjvYDQ=";
   };
 
-  vendorSha256 = "sha256-5vGfWEBiC3ZJzVTHaOPbaaK/9+yg7Nj0mpbJbYpbY/A=";
+  vendorSha256 = "sha256-WDygnKdldZda4GadfStHWsDel1KLdzjVjw0RxmnFPRE=";
 
   ldflags = [ "-s" "-w" ];
 
diff --git a/pkgs/applications/misc/scli/default.nix b/pkgs/applications/misc/scli/default.nix
index abd47c149ebb2..d300691934b25 100644
--- a/pkgs/applications/misc/scli/default.nix
+++ b/pkgs/applications/misc/scli/default.nix
@@ -8,13 +8,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "scli";
-  version = "0.7.1";
+  version = "0.7.2";
 
   src = fetchFromGitHub {
     owner = "isamert";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-YEgeeoUqDeBx3jPddTeykl+68lS8gVKD+zdo+gRTaT4=";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-7yyORM77oByH1gxx/TNkjJQBsig6ZxsfeI3ijg71oBs=";
   };
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/applications/misc/termpdf.py/default.nix b/pkgs/applications/misc/termpdf.py/default.nix
index 4ccddcd70071c..e51f7633e013a 100644
--- a/pkgs/applications/misc/termpdf.py/default.nix
+++ b/pkgs/applications/misc/termpdf.py/default.nix
@@ -1,26 +1,15 @@
-{ lib
-, buildPythonApplication
-, fetchFromGitHub
-, bibtool
-, pybtex
-, pymupdf
-, pynvim
-, pyperclip
-, roman
-, pdfrw
-, pagelabels
-, setuptools
-}:
+{ lib, buildPythonApplication, fetchFromGitHub, bibtool, pybtex, pymupdf, pynvim
+, pyperclip, roman, pdfrw, pagelabels, setuptools }:
 
 buildPythonApplication {
   pname = "termpdf.py";
-  version = "2019-10-03";
+  version = "2022-03-28";
 
   src = fetchFromGitHub {
     owner = "dsanson";
     repo = "termpdf.py";
-    rev = "4f3bdf4b5a00801631f2498f2c38c81e0a588ae2";
-    sha256 = "05gbj2fqzqndq1mx6g9asa7i6z8a9jdjrvilfwx8lg23cs356m6m";
+    rev = "e7bd0824cb7d340b8dba7d862e696dba9cb5e5e2";
+    sha256 = "HLQZBaDoZFVBs4JfJcwhrLx8pxdEI56/iTpUjT5pBhk=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/applications/misc/yubioath-flutter/default.nix b/pkgs/applications/misc/yubioath-flutter/default.nix
index d858605e9044b..50bb48347ac64 100644
--- a/pkgs/applications/misc/yubioath-flutter/default.nix
+++ b/pkgs/applications/misc/yubioath-flutter/default.nix
@@ -5,53 +5,70 @@
 , stdenv
 , pcre2
 }:
-
 let
   vendorHashes = {
     x86_64-linux = "sha256-BwhWA8N0S55XkljDKPNkDhsj0QSpmJJ5MwEnrPjymS8=";
     aarch64-linux = "sha256-T1aGz3+2Sls+rkUVDUo39Ky2igg+dxGSUaf3qpV7ovQ=";
   };
-
+in
+flutter.mkFlutterApp rec {
+  pname = "yubioath-flutter";
   version = "6.0.2";
+
   src = fetchFromGitHub {
     owner = "Yubico";
     repo = "yubioath-flutter";
     rev = version;
     sha256 = "13nh5qpq02c6azfdh4cbzhlrq0hs9is45q5z5cnxg84hrx26hd4k";
   };
-  meta = with lib; {
-    description = "Yubico Authenticator for Desktop";
-    homepage = "https://github.com/Yubico/yubioath-flutter";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ lukegb ];
-    platforms = builtins.attrNames vendorHashes;
-  };
-
-  helper = python3.pkgs.callPackage ./helper.nix { inherit src version meta; };
-in
-flutter.mkFlutterApp rec {
-  pname = "yubioath-flutter";
-  inherit src version meta;
 
-  passthru.helper = helper;
+  passthru.helper = python3.pkgs.callPackage ./helper.nix { inherit src version meta; };
 
-  vendorHash = vendorHashes."${stdenv.system}";
+  vendorHash = vendorHashes.${stdenv.system};
 
   postPatch = ''
     substituteInPlace linux/CMakeLists.txt \
-      --replace "../build/linux/helper" "${helper}/libexec/helper"
+      --replace "../build/linux/helper" "${passthru.helper}/libexec/helper"
   '';
 
   preInstall = ''
     # Make sure we have permission to delete things CMake has copied in to our build directory from elsewhere.
-    chmod -R +w build/
+    chmod -R +w build
   '';
+
   postInstall = ''
     # Swap the authenticator-helper symlink with the correct symlink.
-    ln -fs "${helper}/bin/authenticator-helper" "$out/app/helper/authenticator-helper"
+    ln -fs "${passthru.helper}/bin/authenticator-helper" "$out/app/helper/authenticator-helper"
+
+    # Move the icon.
+    mkdir $out/share/icons
+    mv $out/app/linux_support/com.yubico.yubioath.png $out/share/icons
+
+    # Cleanup.
+    rm -rf \
+      "$out/app/README.adoc" \
+      "$out/app/desktop_integration.sh" \
+      "$out/app/linux_support" \
+      $out/bin/* # We will repopulate this directory later.
+
+    # Symlink binary.
+    ln -sf "$out/app/authenticator" "$out/bin/yubioath-flutter"
+
+    # Set the correct path to the binary in desktop file.
+    substituteInPlace "$out/share/applications/com.yubico.authenticator.desktop" \
+      --replace "@EXEC_PATH/authenticator" "$out/bin/yubioath-flutter" \
+      --replace "@EXEC_PATH/linux_support/com.yubico.yubioath.png" "$out/share/icons/com.yubico.yubioath.png"
   '';
 
   buildInputs = [
     pcre2
   ];
+
+  meta = with lib; {
+    description = "Yubico Authenticator for Desktop";
+    homepage = "https://github.com/Yubico/yubioath-flutter";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ lukegb ];
+    platforms = builtins.attrNames vendorHashes;
+  };
 }
diff --git a/pkgs/applications/misc/yubioath-flutter/helper.nix b/pkgs/applications/misc/yubioath-flutter/helper.nix
index a37ae01990ab2..12e5f52d6b2e7 100644
--- a/pkgs/applications/misc/yubioath-flutter/helper.nix
+++ b/pkgs/applications/misc/yubioath-flutter/helper.nix
@@ -12,7 +12,7 @@
 , meta
 }:
 
-buildPythonApplication rec {
+buildPythonApplication {
   pname = "yubioath-flutter-helper";
   inherit src version meta;
 
diff --git a/pkgs/applications/networking/browsers/librewolf/src.json b/pkgs/applications/networking/browsers/librewolf/src.json
index 4070556cdce6f..9955fd0a936cc 100644
--- a/pkgs/applications/networking/browsers/librewolf/src.json
+++ b/pkgs/applications/networking/browsers/librewolf/src.json
@@ -1,11 +1,11 @@
 {
-  "packageVersion": "108.0-1",
+  "packageVersion": "108.0.1-1",
   "source": {
-    "rev": "108.0-1",
-    "sha256": "1gfqxlcgf7qxgisbj565ndrfhkk68py2jpwrx7k2j7zpszkb2f4m"
+    "rev": "108.0.1-1",
+    "sha256": "0ix8ri2s8rnpd9nqvwlk50x9hp51y70gb3r6f7lh4ldg2bay08n0"
   },
   "firefox": {
-    "version": "108.0",
-    "sha512": "fa800f62cca395a51b9a04373a27be48fc3860208e34ecf74d908127638d1eb8c41cf9898be6896777d408127d5c4b7104d9ee89c97da923b2dc6ea32186187e"
+    "version": "108.0.1",
+    "sha512": "e6219ed6324422ec293ed96868738e056582bb9f7fb82e59362541f3465c6ebca806d26ecd801156b074c3675bd5a22507b1f1fa53eebf82b7dd35f2b1ff0625"
   }
 }
diff --git a/pkgs/applications/networking/browsers/palemoon/default.nix b/pkgs/applications/networking/browsers/palemoon/default.nix
index 3e08b228159c0..9efa3e79dc054 100644
--- a/pkgs/applications/networking/browsers/palemoon/default.nix
+++ b/pkgs/applications/networking/browsers/palemoon/default.nix
@@ -45,7 +45,7 @@ assert with lib.strings; (
 
 stdenv.mkDerivation rec {
   pname = "palemoon";
-  version = "31.4.1.1";
+  version = "31.4.2";
 
   src = fetchFromGitea {
     domain = "repo.palemoon.org";
@@ -53,7 +53,7 @@ stdenv.mkDerivation rec {
     repo = "Pale-Moon";
     rev = "${version}_Release";
     fetchSubmodules = true;
-    sha256 = "sha256-lr8xT9tRxVjg1DxUZuCyWuCFBPPdmkvsnmAsoX8o/6Y=";
+    sha256 = "sha256-vJhjQfsa05fFNL24tUBHfKoKZG2aLXp5xBdUqqGDtAE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/cluster/crc/default.nix b/pkgs/applications/networking/cluster/crc/default.nix
index 9710156f11507..825b203393730 100644
--- a/pkgs/applications/networking/cluster/crc/default.nix
+++ b/pkgs/applications/networking/cluster/crc/default.nix
@@ -10,20 +10,22 @@
 }:
 
 let
-  openShiftVersion = "4.10.22";
-  podmanVersion = "4.1.0";
+  openShiftVersion = "4.11.13";
+  okdVersion = "4.11.0-0.okd-2022-11-05-030711";
+  podmanVersion = "4.2.0";
   writeKey = "cvpHsNcmGCJqVzf6YxrSnVlwFSAZaYtp";
 in
 buildGoModule rec {
-  version = "2.6.0";
+  version = "2.11.0";
   pname = "crc";
-  gitCommit = "6b954d40ec3280ca63e825805503d4414a3ff55b";
+  gitCommit = "a5f90a25abcacd4aa334490f0d204329abeaa691";
+  modRoot = "cmd/crc";
 
   src = fetchFromGitHub {
-    owner = "code-ready";
+    owner = "crc-org";
     repo = "crc";
     rev = "v${version}";
-    sha256 = "sha256-4EaonL+7/zPEbuM12jQFx8wLR62iLYZ3LkHAibdGQZc=";
+    sha256 = "sha256-0e62mQ01pt0kClrEx4ss2T8BN1+0aQiCFPyDg5agbTU";
   };
 
   vendorSha256 = null;
@@ -41,21 +43,18 @@ buildGoModule rec {
   tags = [ "containers_image_openpgp" ];
 
   ldflags = [
-    "-X github.com/code-ready/crc/pkg/crc/version.crcVersion=${version}"
-    "-X github.com/code-ready/crc/pkg/crc/version.bundleVersion=${openShiftVersion}"
-    "-X github.com/code-ready/crc/pkg/crc/version.podmanVersion=${podmanVersion}"
-    "-X github.com/code-ready/crc/pkg/crc/version.commitSha=${gitCommit}"
-    "-X github.com/code-ready/crc/pkg/crc/segment.WriteKey=${writeKey}"
+    "-X github.com/crc-org/crc/pkg/crc/version.crcVersion=${version}"
+    "-X github.com/crc-org/crc/pkg/crc/version.ocpVersion=${openShiftVersion}"
+    "-X github.com/crc-org/crc/pkg/crc/version.okdVersion=${okdVersion}"
+    "-X github.com/crc-org/crc/pkg/crc/version.podmanVersion=${podmanVersion}"
+    "-X github.com/crc-org/crc/pkg/crc/version.commitSha=${builtins.substring 0 8 gitCommit}"
+    "-X github.com/crc-org/crc/pkg/crc/segment.WriteKey=${writeKey}"
   ];
 
   preBuild = ''
     export HOME=$(mktemp -d)
   '';
 
-  # tests are currently broken on aarch64-darwin
-  # https://github.com/code-ready/crc/issues/3237
-  doCheck = !(stdenv.isDarwin && stdenv.isAarch64);
-  checkFlags = [ "-args --crc-binary=$out/bin/crc" ];
 
   passthru.tests.version = testers.testVersion {
     package = crc;
diff --git a/pkgs/applications/networking/cluster/crc/update.sh b/pkgs/applications/networking/cluster/crc/update.sh
index 3ac34c168bacd..93503c6115c6f 100755
--- a/pkgs/applications/networking/cluster/crc/update.sh
+++ b/pkgs/applications/networking/cluster/crc/update.sh
@@ -14,7 +14,7 @@ cd ${NIXPKGS_CRC_FOLDER}
 
 LATEST_TAG_RAWFILE=${WORKDIR}/latest_tag.json
 curl --silent ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} \
-    https://api.github.com/repos/code-ready/crc/releases >${LATEST_TAG_RAWFILE}
+    https://api.github.com/repos/crc-org/crc/releases  >${LATEST_TAG_RAWFILE}
 
 LATEST_TAG_NAME=$(jq 'map(.tag_name)' ${LATEST_TAG_RAWFILE} |
     grep -v -e rc -e engine | tail -n +2 | head -n -1 | sed 's|[", ]||g' | sort -rV | head -n1)
@@ -22,15 +22,18 @@ LATEST_TAG_NAME=$(jq 'map(.tag_name)' ${LATEST_TAG_RAWFILE} |
 CRC_VERSION=$(echo ${LATEST_TAG_NAME} | sed 's/^v//')
 
 CRC_COMMIT=$(curl --silent ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} \
-    https://api.github.com/repos/code-ready/crc/tags |
+    https://api.github.com/repos/crc-org/crc/tags |
     jq -r "map(select(.name == \"${LATEST_TAG_NAME}\")) | .[0] | .commit.sha")
 
 FILE_MAKEFILE=${WORKDIR}/Makefile
-curl --silent https://raw.githubusercontent.com/code-ready/crc/${CRC_COMMIT}/Makefile >$FILE_MAKEFILE
+curl --silent https://raw.githubusercontent.com/crc-org/crc/${CRC_COMMIT}/Makefile >$FILE_MAKEFILE
 
 OPENSHIFT_VERSION=$(grep 'OPENSHIFT_VERSION' ${FILE_MAKEFILE} |
     head -n1 | awk '{print $3}')
 
+OKD_VERSION=$(grep 'OKD_VERSION' ${FILE_MAKEFILE} |
+    head -n1 | awk '{print $3}')
+
 PODMAN_VERSION=$(grep 'PODMAN_VERSION' ${FILE_MAKEFILE} |
     head -n1 | awk '{print $3}')
 
@@ -46,6 +49,9 @@ sed -i "s|gitCommit = \".*\"|gitCommit = \"${CRC_COMMIT:-}\"|" \
 sed -i "s|openShiftVersion = \".*\"|openShiftVersion = \"${OPENSHIFT_VERSION:-}\"|" \
     ${NIXPKGS_CRC_FOLDER}/default.nix
 
+sed -i "s|okdVersion = \".*\"|okdVersion = \"${OKD_VERSION:-}\"|" \
+    ${NIXPKGS_CRC_FOLDER}/default.nix
+
 sed -i "s|podmanVersion = \".*\"|podmanVersion = \"${PODMAN_VERSION:-}\"|" \
     ${NIXPKGS_CRC_FOLDER}/default.nix
 
diff --git a/pkgs/applications/networking/cluster/kube-score/default.nix b/pkgs/applications/networking/cluster/kube-score/default.nix
index 6b3bcf54c2635..492f9bcd51f4f 100644
--- a/pkgs/applications/networking/cluster/kube-score/default.nix
+++ b/pkgs/applications/networking/cluster/kube-score/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "kube-score";
-  version = "1.16.0";
+  version = "1.16.1";
 
   src = fetchFromGitHub {
     owner = "zegl";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-dKvPLAT9e8gNJkKDF7dQPGLSkv9QUjQklUX8Dm8i33E=";
+    hash = "sha256-/aCuPL0bzzoNczvSdLYS8obTu8bZzO5HhBmRZ3/ArAM=";
   };
 
   vendorHash = "sha256-pcNdszOfsYKiASOUNKflbr89j/wb9ILQvjMJYsiGPWo=";
diff --git a/pkgs/applications/networking/cluster/kubent/default.nix b/pkgs/applications/networking/cluster/kubent/default.nix
index 5302917cdfff4..bba56a5b058af 100644
--- a/pkgs/applications/networking/cluster/kubent/default.nix
+++ b/pkgs/applications/networking/cluster/kubent/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "kubent";
-  version = "0.6.0";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     owner = "doitintl";
     repo = "kube-no-trouble";
     rev = "${version}";
-    sha256 = "sha256-aXuBYfXQfg6IQE9cFFTBCPNmDg7IZYPAAeuAxCiU0ro=";
+    sha256 = "sha256-QIvMhKAo30gInqJBpHvhcyjgVkdRqgBKwLQ80ng/75U=";
   };
 
-  vendorSha256 = "sha256-WQwWBcwhFZxXPFO6h+5Y8VDM4urJGfZ6AOvhRoaSbpk=";
+  vendorSha256 = "sha256-XXf6CPPHVvCTZA4Ve5/wmlgXQ/gZZUW0W/jXA0bJgLA=";
 
   ldflags = [
     "-w" "-s"
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 598577c9d9c81..76e9f34dbeba3 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -48,11 +48,11 @@
     "vendorHash": "sha256-pz+h8vbdCEgNSH9AoPlIP7zprViAMawXk64SV0wnVPo="
   },
   "alicloud": {
-    "hash": "sha256-m5IZ6JiEbyAuNo2LiuuP05yApvoHypjFnGioWJ/4ETQ=",
+    "hash": "sha256-Ym3ZN4bRcLXyjnSvWxq/RNvjkfGdpyfkp4sH1D/Ll28=",
     "homepage": "https://registry.terraform.io/providers/aliyun/alicloud",
     "owner": "aliyun",
     "repo": "terraform-provider-alicloud",
-    "rev": "v1.194.1",
+    "rev": "v1.195.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -167,13 +167,13 @@
     "vendorHash": null
   },
   "bitbucket": {
-    "hash": "sha256-rE9kEMC/b3J5YjF94HBqUhorjcsMAx40jnxgsShNNUc=",
+    "hash": "sha256-xDUL9W6lQGMZPQBe4eghW9JcQeTUgm+3ND6erikVFMM=",
     "homepage": "https://registry.terraform.io/providers/DrFaust92/bitbucket",
     "owner": "DrFaust92",
     "repo": "terraform-provider-bitbucket",
-    "rev": "v2.27.0",
+    "rev": "v2.29.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-8/ZEO0cxseXqQHx+/wKjsM0T3l+tBdCTFZqNfjaTOpo="
+    "vendorHash": "sha256-foMmZbNPLww1MN4UZwuynBDgt2w40aMqVINRw//Q0d0="
   },
   "brightbox": {
     "hash": "sha256-ISK6cpE4DVrVzjC0N5BdyR3Z5LfF9qfg/ACTgDP+WqY=",
diff --git a/pkgs/applications/networking/cluster/terraform-providers/update-provider b/pkgs/applications/networking/cluster/terraform-providers/update-provider
index 5630cbe9ed573..aaa8a44d60c0e 100755
--- a/pkgs/applications/networking/cluster/terraform-providers/update-provider
+++ b/pkgs/applications/networking/cluster/terraform-providers/update-provider
@@ -137,7 +137,7 @@ repo="$(echo "${provider_source_url}" | cut -d '/' -f 5)"
 update_attr repo "${repo}"
 
 if [[ ${spdx} == 1 ]]; then
-  spdx="$(curl -L -s "https://api.github.com/repos/${org}/${repo}/license" | jq -r '.license.spdx_id')"
+  spdx="$(curl -L -s ${GITHUB_TOKEN:+-u ":${GITHUB_TOKEN}"} "https://api.github.com/repos/${org}/${repo}/license" | jq -r '.license.spdx_id')"
   update_attr spdx "${spdx}"
 fi
 
diff --git a/pkgs/applications/networking/flexget/default.nix b/pkgs/applications/networking/flexget/default.nix
index 665af1cf2eadc..8782816b232a1 100644
--- a/pkgs/applications/networking/flexget/default.nix
+++ b/pkgs/applications/networking/flexget/default.nix
@@ -5,7 +5,7 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "flexget";
-  version = "3.5.13";
+  version = "3.5.16";
   format = "pyproject";
 
   # Fetch from GitHub in order to use `requirements.in`
@@ -13,7 +13,7 @@ python3Packages.buildPythonApplication rec {
     owner = "flexget";
     repo = "flexget";
     rev = "refs/tags/v${version}";
-    hash = "sha256-0yO4prnYJkD7eiyrEOPHlDTsgGgRhQujsp8k2FsLYKI=";
+    hash = "sha256-9hcl7OZLi86hZHLotsN1QlPzQ1Ep5vJumAyZxSxxIE8=";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix b/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
index a4070a2aea3b5..97fb6dfc2e3ab 100644
--- a/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "signalbackup-tools";
-  version = "20221208";
+  version = "20221227-1";
 
   src = fetchFromGitHub {
     owner = "bepaald";
     repo = pname;
     rev = version;
-    sha256 = "sha256-GSZy2zW9Ek9nP9zoBfvq3wLghEsaGqmC1f4cs+OVaFE=";
+    sha256 = "sha256-yOOKgB7MO9LW6qkr/JZOYtteQTW/Yms4CMAg4EIJGc8=";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/networking/libcoap/default.nix b/pkgs/applications/networking/libcoap/default.nix
index ea4d27c6b412a..673b864630d47 100644
--- a/pkgs/applications/networking/libcoap/default.nix
+++ b/pkgs/applications/networking/libcoap/default.nix
@@ -4,13 +4,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "libcoap";
-  version = "4.3.0";
+  version = "4.3.1";
   src = fetchFromGitHub {
     repo = "libcoap";
     owner = "obgm";
     rev = "v${version}";
     fetchSubmodules = true;
-    sha256 = "1l031ys833gch600g9g3lvbsr4nysx6glbbj4lwvx3ywl0jr6l9k";
+    sha256 = "sha256-4XcAo5StyYIfe9wD0cPHKFZalMcBAuiVV2qFZ126KT8=";
   };
   nativeBuildInputs = [
     automake
diff --git a/pkgs/applications/networking/mailreaders/tutanota-desktop/default.nix b/pkgs/applications/networking/mailreaders/tutanota-desktop/default.nix
index 283091ccc57d2..cc6d5ceff758f 100644
--- a/pkgs/applications/networking/mailreaders/tutanota-desktop/default.nix
+++ b/pkgs/applications/networking/mailreaders/tutanota-desktop/default.nix
@@ -3,12 +3,12 @@ electron, libsecret }:
 
 stdenv.mkDerivation rec {
   pname = "tutanota-desktop";
-  version = "3.105.9";
+  version = "3.106.4";
 
   src = fetchurl {
     url = "https://github.com/tutao/tutanota/releases/download/tutanota-desktop-release-${version}/${pname}-${version}-unpacked-linux.tar.gz";
     name = "tutanota-desktop-${version}.tar.gz";
-    sha256 = "sha256-PkAxtpyL4rXJfz+YgbVteOP1V0hlF25htvOCkEGFq4k=";
+    sha256 = "sha256-RU2JEFtYOpxqA02YDuB/V4t/ZZ608EHGMPpwxVOzRz4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/msmtp/default.nix b/pkgs/applications/networking/msmtp/default.nix
index df5c1354562c2..904239960181c 100644
--- a/pkgs/applications/networking/msmtp/default.nix
+++ b/pkgs/applications/networking/msmtp/default.nix
@@ -128,4 +128,5 @@ symlinkJoin {
   name = "msmtp-${version}";
   inherit version meta;
   paths = [ binaries scripts ];
+  passthru = { inherit binaries scripts; };
 }
diff --git a/pkgs/applications/networking/protonmail-bridge/default.nix b/pkgs/applications/networking/protonmail-bridge/default.nix
index a7954bcc575e2..bdf75f6440e2e 100644
--- a/pkgs/applications/networking/protonmail-bridge/default.nix
+++ b/pkgs/applications/networking/protonmail-bridge/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "protonmail-bridge";
-  version = "2.1.3";
+  version = "2.3.0";
 
   src = fetchFromGitHub {
     owner = "ProtonMail";
     repo = "proton-bridge";
     rev = "br-${version}";
-    sha256 = "sha256-+XeNhjwtH1T5p8iydMQk22nXztyamSn6yY56/qqvkmk=";
+    sha256 = "sha256-7p+Q6/BphE/dxNQe+gfcIty6TAWHUcPpvSJWfmf4OQg=";
   };
 
-  vendorSha256 = "sha256-YTGjiteYfuRkDC4M9c/JKqURq4WiC5n9pFRqRVYhyxU=";
+  vendorSha256 = "sha256-dhrn6xQ0IJzBYeO6ko2PUCO+idopC2An0ylqCnx5jKg=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/applications/networking/remote/xrdp/default.nix b/pkgs/applications/networking/remote/xrdp/default.nix
index feb8252c7edae..3744451f3e282 100644
--- a/pkgs/applications/networking/remote/xrdp/default.nix
+++ b/pkgs/applications/networking/remote/xrdp/default.nix
@@ -100,6 +100,20 @@ let
       license = licenses.asl20;
       maintainers = [ ];
       platforms = platforms.linux;
+      knownVulnerabilities = [
+        "CVE-2020-4044"
+        "CVE-2022-23468"
+        "CVE-2022-23477"
+        "CVE-2022-23478"
+        "CVE-2022-23479"
+        "CVE-2022-23480"
+        "CVE-2022-23481"
+        "CVE-2022-23482"
+        "CVE-2022-23483"
+        "CVE-2022-23484"
+        "CVE-2022-23493"
+        "CVE-2022-23613"
+      ];
     };
   };
 in xrdp
diff --git a/pkgs/applications/networking/soapui/default.nix b/pkgs/applications/networking/soapui/default.nix
index f3c8301a69b61..fc515590f37ae 100644
--- a/pkgs/applications/networking/soapui/default.nix
+++ b/pkgs/applications/networking/soapui/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "soapui";
-  version = "5.6.0";
+  version = "5.7.0";
 
   src = fetchurl {
     url = "https://s3.amazonaws.com/downloads.eviware/soapuios/${version}/SoapUI-${version}-linux-bin.tar.gz";
-    sha256 = "0vmj11fswja0ddnbc4vb7gj1al8km7ilma9bv1waaj8h5c8qpayi";
+    sha256 = "sha256-qzhy4yHmOk13dFUd2KEZhXtWY86QwyjJgYxx9GGoN80=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
@@ -28,16 +28,16 @@ stdenv.mkDerivation rec {
     (writeText "soapui-${version}.patch" ''
       --- a/bin/soapui.sh
       +++ b/bin/soapui.sh
-      @@ -34,7 +34,7 @@ SOAPUI_CLASSPATH=$SOAPUI_HOME/bin/soapui-${version}.jar:$SOAPUI_HOME/lib/*
-       export SOAPUI_CLASSPATH
+      @@ -50,7 +50,7 @@
+       #JAVA 16
+       JAVA_OPTS="$JAVA_OPTS --illegal-access=permit"
 
-       JAVA_OPTS="-Xms128m -Xmx1024m -XX:MinHeapFreeRatio=20 -XX:MaxHeapFreeRatio=40 -Dsoapui.properties=soapui.properties -Dsoapui.home=$SOAPUI_HOME/bin -splash:SoapUI-Spashscreen.png"
       -JFXRTPATH=`java -cp $SOAPUI_CLASSPATH com.eviware.soapui.tools.JfxrtLocator`
       +JFXRTPATH=`${jdk}/bin/java -cp $SOAPUI_CLASSPATH com.eviware.soapui.tools.JfxrtLocator`
        SOAPUI_CLASSPATH=$JFXRTPATH:$SOAPUI_CLASSPATH
 
        if $darwin
-      @@ -69,4 +69,4 @@ echo = SOAPUI_HOME = $SOAPUI_HOME
+      @@ -85,4 +85,4 @@
        echo =
        echo ================================
 
diff --git a/pkgs/applications/networking/syncthing/default.nix b/pkgs/applications/networking/syncthing/default.nix
index 297520dcb923d..e74084e14c524 100644
--- a/pkgs/applications/networking/syncthing/default.nix
+++ b/pkgs/applications/networking/syncthing/default.nix
@@ -4,16 +4,16 @@ let
   common = { stname, target, postInstall ? "" }:
     buildGoModule rec {
       pname = stname;
-      version = "1.22.2";
+      version = "1.23.0";
 
       src = fetchFromGitHub {
         owner = "syncthing";
         repo = "syncthing";
         rev = "v${version}";
-        hash = "sha256-t1JIkUjSEshSm3Zi5Ck8IOmTv2tC0dUYyJvlKua/BcI=";
+        hash = "sha256-Z4YVU45na4BgIbN/IlORpTCuf2EuSuOyppDRzswn3EI=";
       };
 
-      vendorSha256 = "sha256-UdzWD8I8ulPBXdF5wZQ7hQoVO9Bnj18Gw5t4wqolSPA=";
+      vendorHash = "sha256-q63iaRxJRvPY0Np20O6JmdMEjSg/kxRneBfs8fRTwXk=";
 
       doCheck = false;
 
diff --git a/pkgs/applications/office/ledger/default.nix b/pkgs/applications/office/ledger/default.nix
index d4b4bde7b10b4..e885e03c1cd2a 100644
--- a/pkgs/applications/office/ledger/default.nix
+++ b/pkgs/applications/office/ledger/default.nix
@@ -41,6 +41,13 @@ stdenv.mkDerivation rec {
       sha256 = "sha256-vwVQnY9EUCXPzhDJ4PSOmQStb9eF6H0yAOiEmL6sAlk=";
       excludes = [ "doc/NEWS.md" ];
     })
+
+    # Fix included bug with boost >= 1.76. Remove with the next release
+    (fetchpatch {
+      url = "https://github.com/ledger/ledger/commit/1cb9b84fdecc5604bd1172cdd781859ff3871a52.patch";
+      sha256 = "sha256-ipVkRcTmnEvpfyPgMzLVJ9Sz8QxHeCURQI5dX8xh758=";
+      excludes = [ "test/regress/*" ];
+    })
   ];
 
   installTargets = [ "doc" "install" ];
diff --git a/pkgs/applications/office/paperless-ngx/default.nix b/pkgs/applications/office/paperless-ngx/default.nix
index eaad04c64f6f3..feda51e4f6653 100644
--- a/pkgs/applications/office/paperless-ngx/default.nix
+++ b/pkgs/applications/office/paperless-ngx/default.nix
@@ -10,6 +10,7 @@
 , qpdf
 , tesseract5
 , unpaper
+, poppler_utils
 , liberation_ttf
 , fetchFromGitHub
 }:
@@ -75,6 +76,7 @@ let
     qpdf
     tesseract5
     unpaper
+    poppler_utils
   ];
 in
 python.pkgs.pythonPackages.buildPythonApplication rec {
diff --git a/pkgs/applications/office/qownnotes/default.nix b/pkgs/applications/office/qownnotes/default.nix
index 73c470259f14d..bb27f0d4ec906 100644
--- a/pkgs/applications/office/qownnotes/default.nix
+++ b/pkgs/applications/office/qownnotes/default.nix
@@ -5,13 +5,13 @@
 
 mkDerivation rec {
   pname = "qownnotes";
-  version = "22.11.7";
+  version = "22.12.3";
 
   src = fetchurl {
     url = "https://download.tuxfamily.org/${pname}/src/${pname}-${version}.tar.xz";
     # Fetch the checksum of current version with curl:
     # curl https://download.tuxfamily.org/qownnotes/src/qownnotes-<version>.tar.xz.sha256
-    sha256 = "2fbc20f17422bc44c35dd3e78feb710ca275ecb34c550b2a9c743939531f7878";
+    sha256 = "sha256-fpI7RYOGmWwmau6tF8FPmY2/FtN9foWRX8/WgrNU6E8=";
   };
 
   nativeBuildInputs = [ qmake qttools ];
diff --git a/pkgs/applications/radio/ax25-apps/default.nix b/pkgs/applications/radio/ax25-apps/default.nix
new file mode 100644
index 0000000000000..4f9ecd3580f87
--- /dev/null
+++ b/pkgs/applications/radio/ax25-apps/default.nix
@@ -0,0 +1,33 @@
+{ lib
+, stdenv
+, fetchurl
+, libax25
+, ncurses
+}:
+
+stdenv.mkDerivation rec {
+  pname = "ax25-apps";
+  version = "0.0.8-rc5";
+
+  buildInputs = [ libax25 ncurses ];
+
+  # Due to recent unsolvable administrative domain problems with linux-ax25.org,
+  # the new domain is linux-ax25.in-berlin.de
+  src = fetchurl {
+    url = "https://linux-ax25.in-berlin.de/pub/ax25-apps/ax25-apps-${version}.tar.gz";
+    sha256 = "sha256-MzQOIyy5tbJKmojMrgtOcsaQTFJvs3rqt2hUgholz5Y=";
+  };
+
+  configureFlags = [
+    "--sysconfdir=/etc"
+    "--program-transform-name=s@^call$@ax&@;s@^listen$@ax&@"
+  ];
+
+  meta = with lib; {
+    description = "AX.25 ham radio applications";
+    homepage = "https://linux-ax25.in-berlin.de/wiki/Main_Page";
+    license = licenses.lgpl21Only;
+    maintainers = with maintainers; [ sarcasticadmin ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/applications/science/biology/igv/default.nix b/pkgs/applications/science/biology/igv/default.nix
index 8262714256635..b330f6b41a05b 100644
--- a/pkgs/applications/science/biology/igv/default.nix
+++ b/pkgs/applications/science/biology/igv/default.nix
@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   pname = "igv";
-  version = "2.15.1";
+  version = "2.15.4";
   src = fetchzip {
     url = "https://data.broadinstitute.org/igv/projects/downloads/${lib.versions.majorMinor version}/IGV_${version}.zip";
-    sha256 = "sha256-hwZ6Pl6BxoVbJI5e3b0s7jhQ/AADhVJVqM9Q8ppERuk=";
+    sha256 = "sha256-nDD0QTtLDe//VFMsIPKIykZ6dY85p3aomrCaF1p9HQM=";
   };
 
   installPhase = ''
diff --git a/pkgs/applications/science/electronics/dataexplorer/default.nix b/pkgs/applications/science/electronics/dataexplorer/default.nix
index 9d06f614870aa..535871e4edba8 100644
--- a/pkgs/applications/science/electronics/dataexplorer/default.nix
+++ b/pkgs/applications/science/electronics/dataexplorer/default.nix
@@ -2,18 +2,17 @@
 , stdenv
 , fetchurl
 , jdk
-, jre
 , ant
 , makeWrapper
 }:
 
 stdenv.mkDerivation rec {
   pname = "dataexplorer";
-  version = "3.7.3";
+  version = "3.7.4";
 
   src = fetchurl {
     url = "mirror://savannah/dataexplorer/dataexplorer-${version}-src.tar.gz";
-    sha256 = "sha256-cqvlPV4i9m0x3hbruC5y2APsyjfI5y9RT8XVzsDaT/Q=";
+    sha256 = "sha256-bghI7Hun7ZKUVEj7T58K0oaclnhUGd4z+eIqZF3eXHQ=";
   };
 
   nativeBuildInputs = [ ant makeWrapper ];
@@ -37,11 +36,11 @@ stdenv.mkDerivation rec {
     # but it hardcodes bash shebang and does not pin the java path.
     # So we create our own wrapper, using similar cmdline args as upstream.
     mkdir -p $out/bin
-    makeWrapper ${jre}/bin/java $out/bin/DataExplorer \
+    makeWrapper ${jdk}/bin/java $out/bin/DataExplorer \
       --add-flags "-Xms64m -Xmx3092m -jar $out/share/DataExplorer/DataExplorer.jar" \
       --set SWT_GTK3 0
 
-    makeWrapper ${jre}/bin/java $out/bin/DevicePropertiesEditor \
+    makeWrapper ${jdk}/bin/java $out/bin/DevicePropertiesEditor \
       --add-flags "-Xms32m -Xmx512m -classpath $out/share/DataExplorer/DataExplorer.jar gde.ui.dialog.edit.DevicePropertiesEditor" \
       --set SWT_GTK3 0 \
       --set LIBOVERLAY_SCROLLBAR 0
diff --git a/pkgs/applications/version-management/deepgit/default.nix b/pkgs/applications/version-management/deepgit/default.nix
new file mode 100644
index 0000000000000..312dc523710e6
--- /dev/null
+++ b/pkgs/applications/version-management/deepgit/default.nix
@@ -0,0 +1,86 @@
+{ copyDesktopItems
+, fetchurl
+, glib
+, gnome
+, gtk3
+, jre
+, lib
+, makeDesktopItem
+, stdenv
+, wrapGAppsHook
+}:
+
+stdenv.mkDerivation rec {
+  pname = "deepgit";
+  version = "4.3";
+
+  src = fetchurl {
+    url = "https://www.syntevo.com/downloads/deepgit/deepgit-linux-${lib.replaceStrings [ "." ] [ "_" ] version}.tar.gz";
+    hash = "sha256-bA/EySZjuSDYaZplwHcpeP1VakcnG5K1hYTk7cSVbz0=";
+  };
+
+  nativeBuildInputs = [
+    copyDesktopItems
+    wrapGAppsHook
+  ];
+
+  buildInputs = [
+    gnome.adwaita-icon-theme
+    gtk3
+    jre
+  ];
+
+  preFixup = ''
+    gappsWrapperArgs+=(
+      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ glib gtk3 ]}
+      --set DEEPGIT_JAVA_HOME ${jre}
+    )
+    patchShebangs bin/deepgit.sh
+  '';
+
+  desktopItems = [(makeDesktopItem rec {
+    name = pname;
+    desktopName = "DeepGit";
+    keywords = [ "git" ];
+    comment = "Git-Client";
+    categories = [
+      "Development"
+      "RevisionControl"
+    ];
+    terminal = false;
+    startupNotify = true;
+    startupWMClass = desktopName;
+    exec = pname;
+    mimeTypes = [
+      "x-scheme-handler/${pname}"
+      "x-scheme-handler/sourcetree"
+    ];
+    icon = pname;
+  })];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -pv $out/{bin,share/icons/hicolor/scalable/apps/}
+    cp -a lib license.html $out
+    mv bin/deepgit.sh $out/bin/deepgit
+
+    for icon_size in 32 48 64 128 256; do
+      path=$icon_size'x'$icon_size
+      icon=bin/deepgit-$icon_size.png
+      mkdir -p $out/share/icons/hicolor/$path/apps
+      cp $icon $out/share/icons/hicolor/$path/apps/deepgit.png
+    done
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "A tool to investigate the history of source code";
+    homepage = "https://www.syntevo.com/deepgit";
+    changelog = "https://www.syntevo.com/deepgit/changelog.txt";
+    license = licenses.unfree;
+    maintainers = with maintainers; [ urandom ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/applications/version-management/gitea/default.nix b/pkgs/applications/version-management/gitea/default.nix
index aa394fb452787..e90213c971a3a 100644
--- a/pkgs/applications/version-management/gitea/default.nix
+++ b/pkgs/applications/version-management/gitea/default.nix
@@ -1,4 +1,5 @@
 { lib
+, stdenv
 , buildGoPackage
 , fetchurl
 , makeWrapper
@@ -14,12 +15,12 @@
 
 buildGoPackage rec {
   pname = "gitea";
-  version = "1.17.4";
+  version = "1.18.0";
 
   # not fetching directly from the git repo, because that lacks several vendor files for the web UI
   src = fetchurl {
     url = "https://dl.gitea.io/gitea/${version}/gitea-src-${version}.tar.gz";
-    sha256 = "sha256-koZEr89QhxCf2Dd/7SWiS/ZZoRIBfyu0mbxKknjXPK4=";
+    sha256 = "sha256-X0KvIB2JvSoh2MR9FcwKObQzod2GxhKeGqIKU5CKTEM=";
   };
 
   patches = [
@@ -68,5 +69,6 @@ buildGoPackage rec {
     homepage = "https://gitea.io";
     license = licenses.mit;
     maintainers = with maintainers; [ disassembler kolaente ma27 techknowlogick ];
+    broken = stdenv.isDarwin;
   };
 }
diff --git a/pkgs/applications/video/mkvtoolnix/default.nix b/pkgs/applications/video/mkvtoolnix/default.nix
index 05aaa8fe646e7..779f8bf3bf7e7 100644
--- a/pkgs/applications/video/mkvtoolnix/default.nix
+++ b/pkgs/applications/video/mkvtoolnix/default.nix
@@ -47,13 +47,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "mkvtoolnix";
-  version = "71.1.0";
+  version = "72.0.0";
 
   src = fetchFromGitLab {
     owner = "mbunkus";
     repo = "mkvtoolnix";
     rev = "release-${version}";
-    sha256 = "sha256-JHbnjcXOctB6HQeHXykWbykdn35S2fCYegMkc3GLmAI=";
+    sha256 = "sha256-3XKvcV6vwXrn2mf8ziclKgEPOwn3IPyLYy6+d0DscHs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/video/openshot-qt/libopenshot-audio.nix b/pkgs/applications/video/openshot-qt/libopenshot-audio.nix
index 438eae4670980..0c028a4a046f9 100644
--- a/pkgs/applications/video/openshot-qt/libopenshot-audio.nix
+++ b/pkgs/applications/video/openshot-qt/libopenshot-audio.nix
@@ -20,13 +20,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libopenshot-audio";
-  version = "0.2.2";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "OpenShot";
     repo = "libopenshot-audio";
     rev = "v${version}";
-    sha256 = "sha256-XtwTZsj/L/sw/28E7Qr5UyghGlBFFXvbmZLGXBB8vg0=";
+    sha256 = "sha256-b3BZ275oJTxWfBWtdZetUQw0t7QznL0Q0lP7cKy/avg=";
   };
 
   patches = [
diff --git a/pkgs/applications/virtualization/nixpacks/default.nix b/pkgs/applications/virtualization/nixpacks/default.nix
index eac91d4bf29bb..c6fe444db1fdc 100644
--- a/pkgs/applications/virtualization/nixpacks/default.nix
+++ b/pkgs/applications/virtualization/nixpacks/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "nixpacks";
-  version = "0.16.0";
+  version = "1.0.3";
 
   src = fetchFromGitHub {
     owner = "railwayapp";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-p9kKTNtZoWl2rZyL1cD7fK9+IwDtBCfdRzWjKQmje5M=";
+    sha256 = "sha256-0Q0G2vUIkKRTSbQQrXoInzaPfFNWwT/NQ1/NKQeVpHU=";
   };
 
-  cargoSha256 = "sha256-UWefCe5DLaxUFNbQV0XNyqNI1dx9HPHfwj+aJaEasFc=";
+  cargoSha256 = "sha256-vLUR8Rs33GukkRihoB9jD3G4ailJc8oakm7NSjoZdok=";
 
   # skip test due FHS dependency
   doCheck = false;
diff --git a/pkgs/applications/virtualization/pods/default.nix b/pkgs/applications/virtualization/pods/default.nix
index 516fba43f4b33..4963949927b5f 100644
--- a/pkgs/applications/virtualization/pods/default.nix
+++ b/pkgs/applications/virtualization/pods/default.nix
@@ -17,19 +17,19 @@
 
 stdenv.mkDerivation rec {
   pname = "pods";
-  version = "1.0.0-rc.3";
+  version = "1.0.1";
 
   src = fetchFromGitHub {
     owner = "marhkb";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-4dRwrB2M0GooRq3Hi2nmpbQm9RaLqrkZkEDTQpEd7bo=";
+    sha256 = "sha256-oa7A0RMF7kPQXydysGpzAICgGoIRLWUMRibXdiftYyk=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    sha256 = "sha256-wGO2qp8jKHEevQ5vMDxqMzvRr1QazclhZ98M3B29PqQ=";
+    sha256 = "sha256-RMxk7e/z+YneNWI/xsZDmXr7DqB7qHEY8HPvTCeSLjg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/window-managers/dwm/dwm-status.nix b/pkgs/applications/window-managers/dwm/dwm-status.nix
index a1b790b33da8e..424528e9c1aa8 100644
--- a/pkgs/applications/window-managers/dwm/dwm-status.nix
+++ b/pkgs/applications/window-managers/dwm/dwm-status.nix
@@ -9,19 +9,19 @@ in
 
 rustPlatform.buildRustPackage rec {
   pname = "dwm-status";
-  version = "1.8.0";
+  version = "1.8.1";
 
   src = fetchFromGitHub {
     owner = "Gerschtli";
     repo = pname;
     rev = version;
-    sha256 = "sha256-BCnEnBB0OCUwvhh4XEI2eOzfy34VHNFzbqqW26X6If0=";
+    sha256 = "sha256-GkTPEmsnHFLUvbasAOXOQjFKs1Y9aaG87uyPvnQaT8Y=";
   };
 
   nativeBuildInputs = [ makeWrapper pkg-config ];
   buildInputs = [ dbus gdk-pixbuf libnotify xorg.libX11 ];
 
-  cargoSha256 = "sha256-ylB0XGmIPW7Dbc6eDS8FZsq1AOOqntx1byaH3XIal0I=";
+  cargoSha256 = "sha256-eRfXUnyzOfVSEiwjLCaNbETUPXVU2Ed2VUNM9FjS5YE=";
 
   postInstall = lib.optionalString (bins != [])  ''
     wrapProgram $out/bin/dwm-status --prefix "PATH" : "${lib.makeBinPath bins}"
@@ -30,6 +30,7 @@ rustPlatform.buildRustPackage rec {
   meta = with lib; {
     description = "Highly performant and configurable DWM status service";
     homepage = "https://github.com/Gerschtli/dwm-status";
+    changelog = "https://github.com/Gerschtli/dwm-status/blob/master/CHANGELOG.md";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ gerschtli ];
     mainProgram = pname;
diff --git a/pkgs/applications/window-managers/i3/default.nix b/pkgs/applications/window-managers/i3/default.nix
index 4ffa04d73bf5f..b9079c8828148 100644
--- a/pkgs/applications/window-managers/i3/default.nix
+++ b/pkgs/applications/window-managers/i3/default.nix
@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation rec {
   pname = "i3";
-  version = "4.21.1";
+  version = "4.22";
 
   src = fetchurl {
     url = "https://i3wm.org/downloads/${pname}-${version}.tar.xz";
-    sha256 = "sha256-7f14EoXGVKBdxtsnLOAwDEQo5vvYddmZZOV94ltBvB4=";
+    sha256 = "sha256-KGOZEeWdlWOfCSZCqYL14d6lkiUMK1zpjtoQCDNRPks=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/window-managers/i3/gaps.nix b/pkgs/applications/window-managers/i3/gaps.nix
deleted file mode 100644
index 35a58bd25f00e..0000000000000
--- a/pkgs/applications/window-managers/i3/gaps.nix
+++ /dev/null
@@ -1,29 +0,0 @@
-{ fetchFromGitHub, lib, i3 }:
-
-i3.overrideAttrs (oldAttrs : rec {
-  pname = "i3-gaps";
-  version = "4.21.1";
-
-  src = fetchFromGitHub {
-    owner = "Airblader";
-    repo = "i3";
-    rev = version;
-    sha256 = "sha256-+JxJjvzEuAA4CH+gufzAzIqd5BSvHtPvLm2zTfXc/xk=";
-  };
-
-  meta = with lib; {
-    description = "A fork of the i3 tiling window manager with some additional features";
-    homepage    = "https://github.com/Airblader/i3";
-    maintainers = with maintainers; [ fmthoma ];
-    license     = licenses.bsd3;
-    platforms   = platforms.linux ++ platforms.netbsd ++ platforms.openbsd;
-
-    longDescription = ''
-      Fork of i3wm, a tiling window manager primarily targeted at advanced users
-      and developers. Based on a tree as data structure, supports tiling,
-      stacking, and tabbing layouts, handled dynamically, as well as floating
-      windows. This fork adds a few features such as gaps between windows.
-      Configured via plain text file. Multi-monitor. UTF-8 clean.
-    '';
-  };
-})
diff --git a/pkgs/applications/window-managers/river/default.nix b/pkgs/applications/window-managers/river/default.nix
index 3231882a4fba2..e4f0760b68eb2 100644
--- a/pkgs/applications/window-managers/river/default.nix
+++ b/pkgs/applications/window-managers/river/default.nix
@@ -7,7 +7,7 @@
 , scdoc
 , xwayland
 , wayland-protocols
-, wlroots
+, wlroots_0_16
 , libxkbcommon
 , pixman
 , udev
@@ -20,13 +20,13 @@
 
 stdenv.mkDerivation rec {
   pname = "river";
-  version = "0.1.3";
+  version = "0.2.0";
 
   src = fetchFromGitHub {
     owner = "riverwm";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-bHfHhyDx/Wzhvhr7mAeVzJf0TBJgMTGb/ClGjWMLlQ8=";
+    sha256 = "sha256-BrOZch6wkiBB4rk0M7Aoy8sZh8uOTQFOPxd3xLyy/K0=";
     fetchSubmodules = true;
   };
 
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     wayland-protocols
-    wlroots
+    wlroots_0_16
     libxkbcommon
     pixman
     udev
@@ -69,6 +69,6 @@ stdenv.mkDerivation rec {
     description = "A dynamic tiling wayland compositor";
     license = licenses.gpl3Plus;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ fortuneteller2k ];
+    maintainers = with maintainers; [ fortuneteller2k adamcstephens ];
   };
 }
diff --git a/pkgs/data/fonts/dm-sans/default.nix b/pkgs/data/fonts/dm-sans/default.nix
new file mode 100644
index 0000000000000..f7b556fe538d3
--- /dev/null
+++ b/pkgs/data/fonts/dm-sans/default.nix
@@ -0,0 +1,21 @@
+{ lib, fetchzip }:
+let version = "1.002"; in
+fetchzip {
+  inherit version;
+  pname = "dm-sans";
+  url = "https://github.com/googlefonts/dm-fonts/releases/download/v${version}/DeepMindSans_v${version}.zip";
+  stripRoot = false;
+  hash = "sha256-zyS0gz7CGn39HCiyeN5cAP63v9nG6jffGSsI1vr84EQ=";
+
+  postFetch = ''
+    mkdir -p $out/share/fonts/truetype
+    mv $out/*.ttf $out/share/fonts/truetype
+  '';
+
+  meta = {
+    description = "A geometric sans-serif typeface";
+    homepage = "https://github.com/googlefonts/dm-fonts";
+    license = lib.licenses.ofl;
+    maintainers = with lib.maintainers; [ gilice ];
+  };
+}
diff --git a/pkgs/data/fonts/iosevka/bin.nix b/pkgs/data/fonts/iosevka/bin.nix
index ac9569fc95fc6..5d55dfbac88b1 100644
--- a/pkgs/data/fonts/iosevka/bin.nix
+++ b/pkgs/data/fonts/iosevka/bin.nix
@@ -11,7 +11,7 @@ let
     (builtins.attrNames (builtins.removeAttrs variantHashes [ "iosevka" ]));
 in stdenv.mkDerivation rec {
   pname = "${name}-bin";
-  version = "16.8.2";
+  version = "17.0.2";
 
   src = fetchurl {
     url = "https://github.com/be5invis/Iosevka/releases/download/v${version}/ttc-${name}-${version}.zip";
diff --git a/pkgs/data/fonts/iosevka/variants.nix b/pkgs/data/fonts/iosevka/variants.nix
index a1da74c34b6c8..c2b4f0268f863 100644
--- a/pkgs/data/fonts/iosevka/variants.nix
+++ b/pkgs/data/fonts/iosevka/variants.nix
@@ -1,95 +1,95 @@
 # This file was autogenerated. DO NOT EDIT!
 {
-  iosevka = "1zdjwczfmb6swa4yza4nydhvspj9wvi1lvd4d9inr9ssc0ky0h0k";
-  iosevka-aile = "15ahii9597g8p2m0abx3zha26093gsnihn66nm9l1jqrda8s3bfx";
-  iosevka-curly = "1xqxzj9zxfxy3mpq9kjfzjxpi106qp6dq9x32vdfm192l2kcz4dq";
-  iosevka-curly-slab = "0rp6p5v1jd4ihgkshmzm90b9i2kafz94ng2f0lxqrjkh88xg2qkz";
-  iosevka-etoile = "1ml7wmkq7im97z9zgg184bw0a3wzk5rd10jx29ybb4hfklp5mpgk";
-  iosevka-slab = "1dydq9pw0n9kj1nwbyrcb7cxsmjbs69fj91rnl9ayjp6fis2npfl";
-  iosevka-ss01 = "0q26f6n986cs6bzbyqsd0rnk064cxyr7z6iskn1gbf3138cj1q2j";
-  iosevka-ss02 = "1g93qx9b7l5fq5lbxjgvfxmzzmmplgd3cygc3kl7z0xdqfzqh735";
-  iosevka-ss03 = "0vfg0qr0w22yq0igzm0wpd3gf74n2w1xsk7lpzsxcrpljzmjrry5";
-  iosevka-ss04 = "10phf294w91b4m259pgddpih5r9ys49fib419vnh0rcn3f3c0vmz";
-  iosevka-ss05 = "074551ir5a45c7k00bfsbp162vc537xyqdqgi6h7j7lkhn7rfjvg";
-  iosevka-ss06 = "09jn7lk0gc3ns3640g2ng2jh44g180kjcx4fcyacipx5sfwwhjaf";
-  iosevka-ss07 = "18jn9png6jqh5g7883v50za44sa1h78ni8jmpzmfpnhhsvxfq6f2";
-  iosevka-ss08 = "0drgk3r1p4pn5vvdjrms3vivzizd7jkpla40z0gvi7832cssxk0d";
-  iosevka-ss09 = "0xynk2m5nhhlk34c2d3962mcz8mh7n2f64jd4n8l6v3mibcmjh8n";
-  iosevka-ss10 = "1yygdiikbdklk7ddyg3mmvypcmwbm9iym63qvabv0n2dxm5fjylz";
-  iosevka-ss11 = "0as42f552xdpla332sabrxf98l33rv17qzig8f2g38cvwhdp7wc1";
-  iosevka-ss12 = "179499aa1yh5hp0zlwvbyfixi72qky59lba5hd9b53s81jxph778";
-  iosevka-ss13 = "0dprpbcykq5a4gz9941vbiaj7l36xvwip19l1g0422ffg9yrlqvg";
-  iosevka-ss14 = "04843xsmab4y3hxicpkv6ard7kynm6dhyxxsmyz0n3rvl0jk4krj";
-  iosevka-ss15 = "1j0ljgpz3x5wkcj1jx8dnb5ccp1fcyg4i8p40cr01azmbxhwj5m5";
-  iosevka-ss16 = "0gn6x6f03mccfq6lfglbfzxgg74v30k7nadqjlj08fsxp37iiqzc";
-  iosevka-ss17 = "1qnh6bqz15h1xaxcqjsbiidaqbrjikc20fys5fwjflh213csy2n8";
-  iosevka-ss18 = "0p85kp81ylm8fm5fgyp6sv9rcf8gvznpfgn7mbw26y1lx7gmh6xy";
-  sgr-iosevka = "1g97vv4n020r8j9k4w7dzam2xvfqs80nbfvmxkswsnfg3kys1n58";
-  sgr-iosevka-aile = "0ysds3663psv1nr6nyzwxm47vg02jhpgssm3lmdls4g07y93f1fl";
-  sgr-iosevka-curly = "1kzclraj9ndcask13f4iwvf360zm7p78xqf645wbfa9h4rzd93l5";
-  sgr-iosevka-curly-slab = "12y4fyf22mzrnbzl9785ffg6pqcgbdbss1hambf03av2cdvc7sfi";
-  sgr-iosevka-etoile = "1d04q0wnsymfv3zklfz77yvq1xa1zlj1fi2ihljlzrlfw8ybn90c";
-  sgr-iosevka-fixed = "0p6h9hhqbjn9y7dvf78fm0jy6wd884gh4cn4k6070v0psm5xp0y1";
-  sgr-iosevka-fixed-curly = "0l4yd4p8gzsmxgfh90l7z2x6l8v56v5jwsyshq6jawc8xcbny3rb";
-  sgr-iosevka-fixed-curly-slab = "13cg8by9j57r2vbh0anms61dcxvxrzf3yw91s1g6nmhllqd5aqrq";
-  sgr-iosevka-fixed-slab = "03v8i2p2sww6p2dmzq1xqrrik2k1qz91xn9d9ww2zwz47hkgbysm";
-  sgr-iosevka-fixed-ss01 = "1caliz8g63cny7zrq5gkan2366c381d2rl48jnqmmpij3zsx8axz";
-  sgr-iosevka-fixed-ss02 = "01sgb5mrrry2nln0yfzm5z00x5rv28iav3xpww33xcrgwvvvxfp0";
-  sgr-iosevka-fixed-ss03 = "076ayn5y5gxla7w9ildg445wlc2r36vfnhqim7wkphach9mqjn1j";
-  sgr-iosevka-fixed-ss04 = "0x1bd9vy8a0afykb97yl669hsf5mn2gjm9ly5hlb3bnmxaw8dchj";
-  sgr-iosevka-fixed-ss05 = "0f6yn9z3sv28ilx1j0sh0yw19m0kzi81razq7q601k7q4klzm7dw";
-  sgr-iosevka-fixed-ss06 = "0qjsg1xl6x6355c5x2lakh5cbv1vjs1z1s13ikbqhv8wckklmbb0";
-  sgr-iosevka-fixed-ss07 = "0z8yy005l4srqgi2sh64vj1238ydw04kg4vqzj612bmydp5r4vbj";
-  sgr-iosevka-fixed-ss08 = "0dh9gr3qhpw2ap3j69nnsbiqi04y59rgvpwxgw2z8jcdksh7syal";
-  sgr-iosevka-fixed-ss09 = "1lf4vi363rz7mchin262zwz21lpnp1k77v934858qyspc8fkgf1j";
-  sgr-iosevka-fixed-ss10 = "0i7lkr892mq1nks2fsll2lhrzgad0q4hpvl4wafd2jx9wi21b158";
-  sgr-iosevka-fixed-ss11 = "13p1z9x9yi064p1jh0gybrbv2np5ynyggmasf7259cs1l89fqci4";
-  sgr-iosevka-fixed-ss12 = "1ydkj92f9nyyxhvcscxahnjp75pd66ps0flj09f8kk7lbs9vcx4f";
-  sgr-iosevka-fixed-ss13 = "1gkzv8l298kyvgkil47d6gshjvjfdgr0chjhnkl7yqqmwwl23rn2";
-  sgr-iosevka-fixed-ss14 = "0klm69qmirappqijsl0si5yv8pk56k5d5jqpib8l0scb99pxvi2y";
-  sgr-iosevka-fixed-ss15 = "0ym7zdvh0g52jkpijls572hjyv8jk47srq4nqvig0qygkx3w24nf";
-  sgr-iosevka-fixed-ss16 = "0clhkh8lxn0garhsj9jca2iw173gihac10bcm12i0mq8ca8qxrhl";
-  sgr-iosevka-fixed-ss17 = "1225rd8w2c65zvmq5gbg2f8n7bnmqdjf9g0cjqi42gwns840k81h";
-  sgr-iosevka-fixed-ss18 = "0r47grjpbdk6ccrdvdz7vsln5923wl4xb4xcm3q803p8sfb4h38x";
-  sgr-iosevka-slab = "1f96ml19ph39bnkdfrag84z1w7d6r7l5sk8vl2gw55hqwb9h423y";
-  sgr-iosevka-ss01 = "167s8175qcq544d0j21rwrjispdrw8q41p3dfd9kri4x3cbgqndy";
-  sgr-iosevka-ss02 = "0hj18h8hz18ggqm4mj4cdqhp7aa2w8p647y2my5rh989k8y5pgw8";
-  sgr-iosevka-ss03 = "012mxn8azidrjq39jvvscmlazvx4lv94ibvfp3acfp7chhgshi4g";
-  sgr-iosevka-ss04 = "1g1wi82baa71p1596430akdd0hhxzp7fa1gimjkvl871h7nal5r3";
-  sgr-iosevka-ss05 = "1s1jmr4aam0584gy9jbk8fxymn2y9vfz6yd12bkd7l8m73y819bw";
-  sgr-iosevka-ss06 = "1bqrm6g8q77g8b9b14dbwnj9gc0g68niw32fw7fjzpypgsgwh5y3";
-  sgr-iosevka-ss07 = "0mw4qmfnjdncyk8r30km1pvcmv46dlps6zkq7c8szy2lsnlshspf";
-  sgr-iosevka-ss08 = "0kikssw16p3bnlm796fbdkzl5vwm496lz4j9c5ms9hgpk7j1qxcc";
-  sgr-iosevka-ss09 = "02vrzi199qszm10jmnijx786lmkcx0npfaachp51n9lpsvs23i64";
-  sgr-iosevka-ss10 = "138lhzjxq9ar8dmm1cdjdvdkn3blhi423hcvhr6wfxps629xvlw2";
-  sgr-iosevka-ss11 = "08ry7fbfswri4vq20513lj4xfjv70dqvs8aadqx0gwkcknmdawq2";
-  sgr-iosevka-ss12 = "1nlzzxkp2gn5hx2js33c86w7823ircpi2d2s63a6irgqwzm0dc53";
-  sgr-iosevka-ss13 = "0yrzqhns7a82fpwl7gndjpaln3251s89vc91rc1lc4rcmqzpjdfy";
-  sgr-iosevka-ss14 = "1km2bvnrp5g1axfl59agh9qrkdayh5h23pdmf6dxw8a8s3sknf7w";
-  sgr-iosevka-ss15 = "0fym1sgf375d8y8qbgyjx9x2y5h0iidnbd7fxqk1jdzcm4ndnrv5";
-  sgr-iosevka-ss16 = "0h5rcvqw1xwvhkcdb082zbd3hl0ymnv8nxvf9g8lprpwb222ag8b";
-  sgr-iosevka-ss17 = "1s7p4ydpgkhxfjsp3vqn059l43gpxmlf54pawl6i53ldzgjsfx1a";
-  sgr-iosevka-ss18 = "0rpfvl3yffpg5c3155pmswpg31qj2wd2zh1k42r5k84ws9l9ns7d";
-  sgr-iosevka-term = "0i2bxrfpvcg4agrsj6d6dfiim2lz9p7xm17b5928xbk5cxl08v9b";
-  sgr-iosevka-term-curly = "0k0zqfkkjk8fi88gqnr44hcbm3y4wpx4p99dqv51ssra7ggqbs5z";
-  sgr-iosevka-term-curly-slab = "1krc6mva1mif6xlnfxxqnxxfaljszg3zkivgvmbkaqgb7y39ph87";
-  sgr-iosevka-term-slab = "0r4f29218l2mql9bld488bdmzzgqav81i757vfj6qrc5m6w6znah";
-  sgr-iosevka-term-ss01 = "1hvi8xc0zagx267vfhwymnyq5y1bb9p6d7vs5nijrkq7hlkyl8j3";
-  sgr-iosevka-term-ss02 = "0pha6nz5736ygv6mhf6xk5kp29wxg5sn336rh45w3q9dh3df2bh0";
-  sgr-iosevka-term-ss03 = "169lxbrr6i40cpa45381r04q0q8vgmhaypdzp30lg8gm69wpgs87";
-  sgr-iosevka-term-ss04 = "0273cinikxp1xrxzcs0dn51xsi1h59yw7pdvaciqys62vb09cai8";
-  sgr-iosevka-term-ss05 = "0rax2nwzgy9pmw4qld2spfpsv98vs4mpqz0zw6zr1dd6jdhzvr3b";
-  sgr-iosevka-term-ss06 = "1r2ja3idf68kvsk7r3mjx2zqjdx41rvsb9xhxnp9llga51r3y4f7";
-  sgr-iosevka-term-ss07 = "0rb1wq206p4g6i5v32x0y2lr1vs93qg5hfichbpi3bdjjpwlvg10";
-  sgr-iosevka-term-ss08 = "1bsnmvdabnrj65s9d9i0s3q4zn1b2w2xvsqsjjgs3iwsbhy5b7n3";
-  sgr-iosevka-term-ss09 = "1vm3jkv58n1zf96hgd28mrqls23zdk8cpml9wvmlj7p9y7x0qcxs";
-  sgr-iosevka-term-ss10 = "0120gip4r40dzmc5vpl9avhzyfh16w0vdqw8ks259arcd72s0j4v";
-  sgr-iosevka-term-ss11 = "14rf4h9zdnvkjsvwcikmgpnlpypk1qpdld1sw5wf1drbarpxynkl";
-  sgr-iosevka-term-ss12 = "0g6rrsz0fc2szjxp4hxsw0ji4vcdhq5qx32hq83is2iqkkbylsz9";
-  sgr-iosevka-term-ss13 = "19nk2wn13xnacih8qydxsjcpqwaqyklc6dsrx9b2rv7x8ksxyzdp";
-  sgr-iosevka-term-ss14 = "16cjsfk5gn77f4h5g29cx5jj3zrxcl26izyivs5n161xvrq95inb";
-  sgr-iosevka-term-ss15 = "07y306f40dmfdzzgfk2mmq3aipwzqcsff7yjcd3g9hn6cznn85jq";
-  sgr-iosevka-term-ss16 = "0lbmqlsd7zlrfy9fxrj6ngnw2lwvv437z3ibw33qgch1vv4qz4yz";
-  sgr-iosevka-term-ss17 = "08w4x5dd7klnafp6ifnd61m1s3q9ncbr1llx8ywa00s1dfxxsc0f";
-  sgr-iosevka-term-ss18 = "0b2vxkc8c2jmpxlvj2gdy2ghygsiifrp4pivmpgp3amwa913smsk";
+  iosevka = "004vj7r84kansfvdh0d7qmp9xdsrbw4x0iqa8k37pvg0czzvzz14";
+  iosevka-aile = "0mm9y56z6rlfj1w3giql4n12190i95rizd182id9jgjiap75nqdi";
+  iosevka-curly = "0z3hd4wbpz4r1njdprafad8jlq77scwjyy60j6nb900bid0s130b";
+  iosevka-curly-slab = "1v3wrydar72l3nrnjajlrqkz3brqwc5g8vsix1c2acw7k8pj4adq";
+  iosevka-etoile = "04vlvi5dzfpz6qvkv8r4ba0zp36bwdxqyspf7za8a1cqpwg6dhv1";
+  iosevka-slab = "0b7n3rvf6irp4scpm5g9pr5ikik2q7mkw35qdy63wq0d7vy7k67m";
+  iosevka-ss01 = "0xa0hrn6hjzj094xs1wilp9csb3i3yfpngfw9g9p59wnsphq12k7";
+  iosevka-ss02 = "00ygpybyq5qa1fva5d5lbmpl34cf6w18kba958rjzydc5zj4hfk1";
+  iosevka-ss03 = "1l2s01a32mblgmd7c6n11nwk9fxh7iflba6da9wb9rszwj9kh7fb";
+  iosevka-ss04 = "1pqvclbhw8nrlaasi03l3mjmg8sh48fhh6fl1ngmsc86k15ym8xy";
+  iosevka-ss05 = "1vg827f694kx841fnsjkmwvs4nbcy9jpbxfr6cbjmhr9g9hp8qis";
+  iosevka-ss06 = "1zkndj11ld5crkkyf8pbn6bd8xigm4mvs9h0mb15hqym09phsvbf";
+  iosevka-ss07 = "0ssalch56zkdr7q97s215iwjsiny0a4svjp5qij0w0w9vfh1c8q4";
+  iosevka-ss08 = "0i1v47ji7wn13vmad9jkskislqg1zgi3vsk2fjygx8z9b39svs1h";
+  iosevka-ss09 = "1bk9lr4zafj97p53pdqryi01malijniqhn9mkz984m0z7fnyh35j";
+  iosevka-ss10 = "1rqmak3bwmj32s9s85ipxfyplcxqljj1z8p1s3i6l8njqfx9hmv9";
+  iosevka-ss11 = "0d13sgam6kpw0pp0g0ibhi7ji63yijfjgrid32fs99i7l636f7y0";
+  iosevka-ss12 = "1ya76hfizg56ryfmf12lmb9wivdhx8wps55m3mryldaqw3ys5fh5";
+  iosevka-ss13 = "0gdz4g9l2p4ah5ms2nhnwz14h8bvw1mszxzjj6v474za2py989dh";
+  iosevka-ss14 = "14l6vk0yzk4c2gk28s30ys9k26ic3p9sywbbwinzm7y67knqsc2b";
+  iosevka-ss15 = "1vpx2ksdjmlp37difs12b4cs25x73v5qlqzjvck2z9ikbgf9drn7";
+  iosevka-ss16 = "088zf8q75v4qgpdinlf80rfkblviwxk94kzf0qa7zsk1hg9xmb59";
+  iosevka-ss17 = "0wz5z58aalk4xp9xhcq3xrm6mf2l28gp5qydxgajgzz7lh405znh";
+  iosevka-ss18 = "12r294lrwy1a663dzfs0hxsg113v127365nwb2wn5q7jksmaxxd6";
+  sgr-iosevka = "13fy2vyslhrikf9vf668754gdqfz1dyqfx9kk0r5yzi0g6ysvdkx";
+  sgr-iosevka-aile = "0qjyag5axpcfqng6cqv4j0fh0a6f0v834iwhf8zx7qgh1h6j1vvy";
+  sgr-iosevka-curly = "1gvi7clwyl24dyrmrcb2i4n96p9rqhxxl6cvl1bdv9v6qi9y65lc";
+  sgr-iosevka-curly-slab = "10ha1h64w2189azpszdg328c0p1nfg8r9rwrk1qxs7cv7mkmr5fj";
+  sgr-iosevka-etoile = "0yd95kn3ickra7ssb62m8c61c8aarxkljcxk9j470rf679fsj3rp";
+  sgr-iosevka-fixed = "00qiswcfhqf1jsw4xwbqdpaq2jhxvkcdq5vhjg26q97nv5hdqk9w";
+  sgr-iosevka-fixed-curly = "1bqcsqysxf3x5g5970hgsazy0qgdkqhjdh1pqknqng2r8awrpi45";
+  sgr-iosevka-fixed-curly-slab = "1jcxc19q83k7rxcsyg99ahg267i7q86kf9kxzb06bj48f52ypkd3";
+  sgr-iosevka-fixed-slab = "1dgjqn7pniq45f5m2sqj47nmdmrgkk2g1860f262b48aydh3lfnh";
+  sgr-iosevka-fixed-ss01 = "0g9jwlc616b52r9wakpdi61ny79vr64zg2cch5jrvsn03gkp47jv";
+  sgr-iosevka-fixed-ss02 = "0lvc2m8cwrfsp1lnnl3fshqj6xskv0gdj4xr3m16axkwa60h2qcb";
+  sgr-iosevka-fixed-ss03 = "0fhsrmbvwwnrg3jicark56r0zirnq5yp1lg2xaznx8wmw08221z5";
+  sgr-iosevka-fixed-ss04 = "0wy4mja82xrxwfmdpkmil9d8q6681a8dj44wb3h8hvybd40qm8xf";
+  sgr-iosevka-fixed-ss05 = "1rhilqnw3kay2mgjmjzxaappgyz3rib4gq142j717m0scbd7c5dw";
+  sgr-iosevka-fixed-ss06 = "0ci3sfy39850zks4glnlr7ml40akhh290rz43s4qd7lcpsyiqaw8";
+  sgr-iosevka-fixed-ss07 = "1i0r4sb9jpipp08cw43n8ajskfyzk5yz2d08h4z0bfd4k8ap9vd0";
+  sgr-iosevka-fixed-ss08 = "1jgqdr09gpv2rysi8yj3p6wc79xhx81hncaim3vmj32gkv3pqpbx";
+  sgr-iosevka-fixed-ss09 = "1m9085hmpljn3pfnxjc3h2q0agkidqdi5b2dl744xs9p1nzm7y9c";
+  sgr-iosevka-fixed-ss10 = "03j0bv0yfd15jjc2ssffsbhq7vcg38prxycvzh1nbc9g0rl3ji24";
+  sgr-iosevka-fixed-ss11 = "0kgjjnsihycxyqlgc4zngfqiynqp8agnic7mydni8mqwl1jxaw17";
+  sgr-iosevka-fixed-ss12 = "0v0gva1v3q9xhvzyv1qlggb0dy96a9fm2vm682jj913j925mh23m";
+  sgr-iosevka-fixed-ss13 = "06jd2lggi8i9lmaqjhss837wplaypc60k8fnjall16wzdg3an8di";
+  sgr-iosevka-fixed-ss14 = "1qvdyran2c56wrzwnz5l42ld1iy6y7bvadw3mgrjfi01xfs43ncb";
+  sgr-iosevka-fixed-ss15 = "06kpf9fzvq8flvn2fw6cg5n9c629qnwpxh8vx0z9bqn29kqvf0d1";
+  sgr-iosevka-fixed-ss16 = "0sdm5h1zbr812pa2i1c8qz1a884pcdcng47xyk7li5v1y2gznmij";
+  sgr-iosevka-fixed-ss17 = "109d2cl2cs8wzqq2g9sjcfbxl8x2zl4pssh3jsns8n2yx63lmkxf";
+  sgr-iosevka-fixed-ss18 = "1pjy2zb0qgjqy11mbj4ia8pdxm8h888ifwsjyjy0zm9q6v8y5xcb";
+  sgr-iosevka-slab = "0vak6d76ignsik1561s8dm1r4pqn02w32vavls668mjg3i051llq";
+  sgr-iosevka-ss01 = "0p195gvj4ljjw4difg78hq139l5hmpk4jbjm8pzfrxmn643z0yi4";
+  sgr-iosevka-ss02 = "01llc2hykx7i7r9bp7gcc650iw9ry5c17s2ap06j0vv7gz0a47h5";
+  sgr-iosevka-ss03 = "0m208v1mdxm2w5c92cijpvbcqh4hxg2mchghwchq9kyk00b1ld2d";
+  sgr-iosevka-ss04 = "15x7i8pxy5i512whh6464x4l72qygvrd0rs1y3y1kbavp1scb5ck";
+  sgr-iosevka-ss05 = "1xqxc66nfb5n38hyr8s3r7yrm4v27ymr8mfkqp10jnpyyi47mwg5";
+  sgr-iosevka-ss06 = "1wskdfz3y24ia402b0mn34393w9nbjszqryg7x8ka1c4fjvccwdn";
+  sgr-iosevka-ss07 = "09ahix65wcspjmsjnw9f7mad8pl7m9yl4kzlh2awv3ag448cgj3s";
+  sgr-iosevka-ss08 = "03g23ni2jqvwjbibhpbn6i2ddc3yr5znvxhinwgag45vrjfr629m";
+  sgr-iosevka-ss09 = "0n1vi5r5yjxrrdx0w5ab1hd31dwzrg9n8cp6gcj1d532mk6y7y74";
+  sgr-iosevka-ss10 = "034ai6djsw32jd0y037svfp2mlrsg99gwxl9awjvip219n6gqly2";
+  sgr-iosevka-ss11 = "1ngkjmgiq99p51ar2hff8xf27xq18m32wrw2igk8mr58r35xzkpi";
+  sgr-iosevka-ss12 = "1wdh48px6ywj990nm45w8nmllvl9f8k9pj2jf5frfrr9qshvzsmz";
+  sgr-iosevka-ss13 = "0wh2dq3crpdx002wv6lzznirx7bvgkl04x429nzfvkkwp28y2jj9";
+  sgr-iosevka-ss14 = "05w3bl8kxj9qgm2vqhl93bz0zyhkdhbsmxh82fwl74mxs530sjpj";
+  sgr-iosevka-ss15 = "09xf5xlzz4d4whw4blwa9hlyij0kfihi8q3q448p40r116kvl2zy";
+  sgr-iosevka-ss16 = "1d6jfaxz8ivn3a7zsk408z0hr9rjh2gv93zqq41a191zpgd7zj3g";
+  sgr-iosevka-ss17 = "12x3nlcq89c6ldq70bi5w418iqwmb2i8jq7csh9cg7ghbl4bmr9x";
+  sgr-iosevka-ss18 = "0z9pg0y56ix679br1zdfmqsf9an704gb1gf420mypkr9dyf2yh50";
+  sgr-iosevka-term = "1ry11xwl715lpiy6psh4l4bwjsf5f14igrv6wzag60xk0ip91qgv";
+  sgr-iosevka-term-curly = "0jkblgqmpixh4qjr96sjv6mag1faak2yz7251g63x4gbf2sbahlq";
+  sgr-iosevka-term-curly-slab = "1yjcy6y31nyilkxmid6laxwsrmf61akgsaz5ybjy20vhhkylj1hj";
+  sgr-iosevka-term-slab = "1cxv8qh4mjs0xl0v3ckgz916dir3n4wvmibhv161valvd5cswrci";
+  sgr-iosevka-term-ss01 = "0i6qkxwgbq2iz4gzqcfi5jdnw7rdrasdh5cmbah72fxrxmwbwxrx";
+  sgr-iosevka-term-ss02 = "13hgq4airgimi26c2bi54m6405w7gi3pl3i76nxr009vkia50nsk";
+  sgr-iosevka-term-ss03 = "1n0f4kmnaibsf7ss34shc1yhdjsfsia76qycpsl2jhhq3531z080";
+  sgr-iosevka-term-ss04 = "11fq16w1h4ajzs24qx6ng0nnh0c0pbqa9m75bavn47vjhl10d1v9";
+  sgr-iosevka-term-ss05 = "1ym9hq8hk687b4ahg2dq1hp7gb7xjxnak12ijsppzsgp42dmjbjl";
+  sgr-iosevka-term-ss06 = "1zc70ywxzk2m69rrmcah8kq994j9y40bhm0wnb9cbl45zkgacms1";
+  sgr-iosevka-term-ss07 = "03cd38wnjmqkm93v23ga4yd03w5l58yb8ipw1pi9s8i7vicicvb5";
+  sgr-iosevka-term-ss08 = "0226qnp4nabsynd7nxvis237vm31785k7msh2vpxnmbl8m2h54b6";
+  sgr-iosevka-term-ss09 = "1c63qiiz8pw49x7xjfxbnm36isc486bk9d19zbfhylchbd0yfbxx";
+  sgr-iosevka-term-ss10 = "1pl3b935mbdf126m0bjq17wfy80rdcvq3zmh13w2hb8pmx0m31gg";
+  sgr-iosevka-term-ss11 = "1nqzh75ia7z74f3v6m9jkh51qhjpxnmhqxnz3ks5s5rb3qgvj1h6";
+  sgr-iosevka-term-ss12 = "0z9xafdp75c88g1mf5hyh6h88n1w3qs6fid7bvwy1jjnsnai835s";
+  sgr-iosevka-term-ss13 = "0bccy0fhr5kqx1b53wb6gcijn7axlbg2x24vp8mh72mnw306qnf3";
+  sgr-iosevka-term-ss14 = "174srnn43rwsc1l8qjk6hrqg3qndk2sf61cii3v2hk1pnrqxs85r";
+  sgr-iosevka-term-ss15 = "15lg2p7hpdkd21f8nkywxzp8gmxg3wpi2q33m0bchvcr1cb6p326";
+  sgr-iosevka-term-ss16 = "0b20m1akm95nbkjy7cqgn4gfiaashdkwc1nf6abwhpm8iydwas3v";
+  sgr-iosevka-term-ss17 = "1x0n4z4si9qzkqanbdp1lqn73hynbxa7s59rwc9z0s902vyqpgcx";
+  sgr-iosevka-term-ss18 = "19b3nx5mvdr6r6hbcqjxrdsyr975ym42v0i670l4550bg0z24cyl";
 }
diff --git a/pkgs/data/fonts/noto-fonts/default.nix b/pkgs/data/fonts/noto-fonts/default.nix
index da3b0f81d4319..6161f711958c4 100644
--- a/pkgs/data/fonts/noto-fonts/default.nix
+++ b/pkgs/data/fonts/noto-fonts/default.nix
@@ -11,21 +11,43 @@
 , imagemagick
 , zopfli
 , buildPackages
+, variants ? [ ]
 }:
-
 let
-  mkNoto = { pname, weights }:
-    stdenvNoCC.mkDerivation {
+  notoLongDescription = ''
+    When text is rendered by a computer, sometimes characters are
+    displayed as “tofu”. They are little boxes to indicate your device
+    doesn’t have a font to display the text.
+
+    Google has been developing a font family called Noto, which aims to
+    support all languages with a harmonious look and feel. Noto is
+    Google’s answer to tofu. The name noto is to convey the idea that
+    Google’s goal is to see “no more tofu”.  Noto has multiple styles and
+    weights, and freely available to all.
+
+    This package also includes the Arimo, Cousine, and Tinos fonts.
+  '';
+in
+rec {
+  mkNoto =
+    { pname
+    , weights
+    , variants ? [ ]
+    , longDescription ? notoLongDescription
+    }:
+    stdenvNoCC.mkDerivation rec {
       inherit pname;
-      version = "2020-01-23";
+      version = "20201206-phase3";
 
       src = fetchFromGitHub {
         owner = "googlefonts";
         repo = "noto-fonts";
-        rev = "f4726a2ec36169abd02a6d8abe67c8ff0236f6d8";
-        sha256 = "0zc1r7zph62qmvzxqfflsprazjf6x1qnwc2ma27kyzh6v36gaykw";
+        rev = "v${version}";
+        hash = "sha256-x60RvCRFLoGe0CNvswROnDkIsUFbWH+/laN8q2qkUPk=";
       };
 
+      _variants = map (variant: builtins.replaceStrings [ " " ] [ "" ] variant) variants;
+
       installPhase = ''
         # We copy in reverse preference order -- unhinted first, then
         # hinted -- to get the "best" version of each font while
@@ -33,29 +55,24 @@ let
         #
         # TODO: install OpenType, variable versions?
         local out_ttf=$out/share/fonts/truetype/noto
-        install -m444 -Dt $out_ttf phaseIII_only/unhinted/ttf/*/*-${weights}.ttf
-        install -m444 -Dt $out_ttf phaseIII_only/hinted/ttf/*/*-${weights}.ttf
-        install -m444 -Dt $out_ttf unhinted/*/*-${weights}.ttf
-        install -m444 -Dt $out_ttf hinted/*/*-${weights}.ttf
-      '';
+      '' + (if _variants == [ ] then ''
+        install -m444 -Dt $out_ttf archive/unhinted/*/*-${weights}.ttf
+        install -m444 -Dt $out_ttf archive/hinted/*/*-${weights}.ttf
+        install -m444 -Dt $out_ttf unhinted/*/*/*-${weights}.ttf
+        install -m444 -Dt $out_ttf hinted/*/*/*-${weights}.ttf
+      '' else ''
+        for variant in $_variants; do
+          install -m444 -Dt $out_ttf archive/unhinted/$variant/*-${weights}.ttf
+          install -m444 -Dt $out_ttf archive/hinted/$variant/*-${weights}.ttf
+          install -m444 -Dt $out_ttf unhinted/*/$variant/*-${weights}.ttf
+          install -m444 -Dt $out_ttf hinted/*/$variant/*-${weights}.ttf
+        done
+      '');
 
       meta = with lib; {
         description = "Beautiful and free fonts for many languages";
         homepage = "https://www.google.com/get/noto/";
-        longDescription =
-        ''
-          When text is rendered by a computer, sometimes characters are
-          displayed as “tofu”. They are little boxes to indicate your device
-          doesn’t have a font to display the text.
-
-          Google has been developing a font family called Noto, which aims to
-          support all languages with a harmonious look and feel. Noto is
-          Google’s answer to tofu. The name noto is to convey the idea that
-          Google’s goal is to see “no more tofu”.  Noto has multiple styles and
-          weights, and freely available to all.
-
-          This package also includes the Arimo, Cousine, and Tinos fonts.
-        '';
+        inherit longDescription;
         license = licenses.ofl;
         platforms = platforms.all;
         maintainers = with maintainers; [ mathnerd314 emily ];
@@ -100,14 +117,34 @@ let
         maintainers = with maintainers; [ mathnerd314 emily ];
       };
     };
-in
 
-{
   noto-fonts = mkNoto {
     pname = "noto-fonts";
     weights = "{Regular,Bold,Light,Italic,BoldItalic,LightItalic}";
   };
 
+  noto-fonts-lgc-plus = mkNoto {
+    pname = "noto-fonts-lgc-plus";
+    weights = "{Regular,Bold,Light,Italic,BoldItalic,LightItalic}";
+    variants = [
+      "Noto Sans"
+      "Noto Serif"
+      "Noto Sans Display"
+      "Noto Serif Display"
+      "Noto Sans Mono"
+      "Noto Music"
+      "Noto Sans Symbols"
+      "Noto Sans Symbols 2"
+      "Noto Sans Math"
+    ];
+    longDescription = ''
+      This package provides the Noto Fonts, but only for latin, greek
+      and cyrillic scripts, as well as some extra fonts. To create a
+      custom Noto package with custom variants, see the `mkNoto`
+      helper function.
+    '';
+  };
+
   noto-fonts-extra = mkNoto {
     pname = "noto-fonts-extra";
     weights = "{Black,Condensed,Extra,Medium,Semi,Thin}*";
@@ -127,64 +164,66 @@ in
     sha256 = "sha256-1w66Ge7DZjbONGhxSz69uFhfsjMsDiDkrGl6NsoB7dY=";
   };
 
-  noto-fonts-emoji = let
-    version = "2.038";
-    emojiPythonEnv =
-      buildPackages.python3.withPackages (p: with p; [ fonttools nototools ]);
-  in stdenvNoCC.mkDerivation {
-    pname = "noto-fonts-emoji";
-    inherit version;
-
-    src = fetchFromGitHub {
-      owner = "googlefonts";
-      repo = "noto-emoji";
-      rev = "v${version}";
-      sha256 = "1rgmcc6nqq805iqr8kvxxlk5cf50q714xaxk3ld6rjrd69kb8ix9";
-    };
-
-    depsBuildBuild = [
-      buildPackages.stdenv.cc
-      pkg-config
-      cairo
-    ];
-
-    nativeBuildInputs = [
-      imagemagick
-      zopfli
-      pngquant
-      which
-      emojiPythonEnv
-    ];
+  noto-fonts-emoji =
+    let
+      version = "2.038";
+      emojiPythonEnv =
+        buildPackages.python3.withPackages (p: with p; [ fonttools nototools ]);
+    in
+    stdenvNoCC.mkDerivation {
+      pname = "noto-fonts-emoji";
+      inherit version;
 
-    postPatch = ''
-      patchShebangs *.py
-      patchShebangs third_party/color_emoji/*.py
-      # remove check for virtualenv, since we handle
-      # python requirements using python.withPackages
-      sed -i '/ifndef VIRTUAL_ENV/,+2d' Makefile
+      src = fetchFromGitHub {
+        owner = "googlefonts";
+        repo = "noto-emoji";
+        rev = "v${version}";
+        sha256 = "1rgmcc6nqq805iqr8kvxxlk5cf50q714xaxk3ld6rjrd69kb8ix9";
+      };
 
-      # Make the build verbose so it won't get culled by Hydra thinking that
-      # it somehow got stuck doing nothing.
-      sed -i 's;\t@;\t;' Makefile
-    '';
+      depsBuildBuild = [
+        buildPackages.stdenv.cc
+        pkg-config
+        cairo
+      ];
+
+      nativeBuildInputs = [
+        imagemagick
+        zopfli
+        pngquant
+        which
+        emojiPythonEnv
+      ];
+
+      postPatch = ''
+        patchShebangs *.py
+        patchShebangs third_party/color_emoji/*.py
+        # remove check for virtualenv, since we handle
+        # python requirements using python.withPackages
+        sed -i '/ifndef VIRTUAL_ENV/,+2d' Makefile
+
+        # Make the build verbose so it won't get culled by Hydra thinking that
+        # it somehow got stuck doing nothing.
+        sed -i 's;\t@;\t;' Makefile
+      '';
 
-    enableParallelBuilding = true;
+      enableParallelBuilding = true;
 
-    installPhase = ''
-      runHook preInstall
-      mkdir -p $out/share/fonts/noto
-      cp NotoColorEmoji.ttf $out/share/fonts/noto
-      runHook postInstall
-    '';
+      installPhase = ''
+        runHook preInstall
+        mkdir -p $out/share/fonts/noto
+        cp NotoColorEmoji.ttf $out/share/fonts/noto
+        runHook postInstall
+      '';
 
-    meta = with lib; {
-      description = "Color and Black-and-White emoji fonts";
-      homepage = "https://github.com/googlefonts/noto-emoji";
-      license = with licenses; [ ofl asl20 ];
-      platforms = platforms.all;
-      maintainers = with maintainers; [ mathnerd314 sternenseemann ];
+      meta = with lib; {
+        description = "Color and Black-and-White emoji fonts";
+        homepage = "https://github.com/googlefonts/noto-emoji";
+        license = with licenses; [ ofl asl20 ];
+        platforms = platforms.all;
+        maintainers = with maintainers; [ mathnerd314 sternenseemann ];
+      };
     };
-  };
 
   noto-fonts-emoji-blob-bin =
     let
diff --git a/pkgs/data/icons/whitesur-icon-theme/default.nix b/pkgs/data/icons/whitesur-icon-theme/default.nix
index 80f6b5ce24ae3..d665c9f2b0d7e 100644
--- a/pkgs/data/icons/whitesur-icon-theme/default.nix
+++ b/pkgs/data/icons/whitesur-icon-theme/default.nix
@@ -6,6 +6,7 @@
 , jdupes
 , boldPanelIcons ? false
 , blackPanelIcons ? false
+, alternativeIcons ? false
 , themeVariants ? []
 }:
 
@@ -54,6 +55,7 @@ stdenvNoCC.mkDerivation rec {
     ./install.sh --dest $out/share/icons \
       --name WhiteSur \
       --theme ${builtins.toString themeVariants} \
+      ${lib.optionalString alternativeIcons "--alternative"} \
       ${lib.optionalString boldPanelIcons "--bold"} \
       ${lib.optionalString blackPanelIcons "--black"}
 
diff --git a/pkgs/desktops/gnome/core/gnome-control-center/default.nix b/pkgs/desktops/gnome/core/gnome-control-center/default.nix
index 4161598634f9d..0d3b3bc5c6dd6 100644
--- a/pkgs/desktops/gnome/core/gnome-control-center/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-control-center/default.nix
@@ -165,6 +165,8 @@ stdenv.mkDerivation rec {
     done
   '';
 
+  separateDebugInfo = true;
+
   passthru = {
     updateScript = gnome.updateScript {
       packageName = pname;
diff --git a/pkgs/development/compilers/edk2/default.nix b/pkgs/development/compilers/edk2/default.nix
index 43dc18244a91e..8019d2131afd6 100644
--- a/pkgs/development/compilers/edk2/default.nix
+++ b/pkgs/development/compilers/edk2/default.nix
@@ -83,7 +83,7 @@ edk2 = buildStdenv.mkDerivation {
     description = "Intel EFI development kit";
     homepage = "https://github.com/tianocore/tianocore.github.io/wiki/EDK-II/";
     license = licenses.bsd2;
-    platforms = [ "x86_64-linux" "i686-linux" "aarch64-linux" "x86_64-darwin" ];
+    platforms = with platforms; aarch64 ++ i686 ++ x86_64;
   };
 
   passthru = {
diff --git a/pkgs/development/compilers/gcc-arm-embedded/12/default.nix b/pkgs/development/compilers/gcc-arm-embedded/12/default.nix
new file mode 100644
index 0000000000000..caff0ad023f8d
--- /dev/null
+++ b/pkgs/development/compilers/gcc-arm-embedded/12/default.nix
@@ -0,0 +1,52 @@
+{ lib
+, stdenv
+, fetchurl
+, ncurses5
+, python38
+}:
+
+stdenv.mkDerivation rec {
+  pname = "gcc-arm-embedded";
+  version = "12.2.rel1";
+
+  platform = {
+    aarch64-linux = "aarch64";
+    x86_64-darwin = "darwin-x86_64";
+    x86_64-linux  = "x86_64";
+  }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
+
+  src = fetchurl {
+    url = "https://developer.arm.com/-/media/Files/downloads/gnu/${version}/binrel/arm-gnu-toolchain-${version}-${platform}-arm-none-eabi.tar.xz";
+    sha256 = {
+      aarch64-linux = "131ydgndff7dyhkivfchbk43lv3cv2p172knkqilx64aapvk5qvy";
+      x86_64-darwin = "00i9gd1ny00681pwinh6ng9x45xsyrnwc6hm2vr348z9gasyxh00";
+      x86_64-linux  = "0rv8r5zh0a5621v0xygxi8f6932qgwinw2s9vnniasp9z7897gl4";
+    }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
+  };
+
+  dontConfigure = true;
+  dontBuild = true;
+  dontPatchELF = true;
+  dontStrip = true;
+
+  installPhase = ''
+    mkdir -p $out
+    cp -r * $out
+  '';
+
+  preFixup = ''
+    find $out -type f | while read f; do
+      patchelf "$f" > /dev/null 2>&1 || continue
+      patchelf --set-interpreter $(cat ${stdenv.cc}/nix-support/dynamic-linker) "$f" || true
+      patchelf --set-rpath ${lib.makeLibraryPath [ "$out" stdenv.cc.cc ncurses5 python38 ]} "$f" || true
+    done
+  '';
+
+  meta = with lib; {
+    description = "Pre-built GNU toolchain from ARM Cortex-M & Cortex-R processors";
+    homepage = "https://developer.arm.com/open-source/gnu-toolchain/gnu-rm";
+    license = with licenses; [ bsd2 gpl2 gpl3 lgpl21 lgpl3 mit ];
+    maintainers = with maintainers; [ prusnak ];
+    platforms = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" ];
+  };
+}
diff --git a/pkgs/development/compilers/go/1.20.nix b/pkgs/development/compilers/go/1.20.nix
new file mode 100644
index 0000000000000..5081e5efecfe1
--- /dev/null
+++ b/pkgs/development/compilers/go/1.20.nix
@@ -0,0 +1,180 @@
+{ lib
+, stdenv
+, fetchurl
+, tzdata
+, substituteAll
+, iana-etc
+, Security
+, Foundation
+, xcbuild
+, mailcap
+, buildPackages
+, pkgsBuildTarget
+, threadsCross
+, testers
+, skopeo
+, buildGo120Module
+}:
+
+let
+  goBootstrap = buildPackages.callPackage ./bootstrap117.nix { };
+
+  skopeoTest = skopeo.override { buildGoModule = buildGo120Module; };
+
+  goarch = platform: {
+    "aarch64" = "arm64";
+    "arm" = "arm";
+    "armv5tel" = "arm";
+    "armv6l" = "arm";
+    "armv7l" = "arm";
+    "i686" = "386";
+    "mips" = "mips";
+    "mips64el" = "mips64le";
+    "mipsel" = "mipsle";
+    "powerpc64le" = "ppc64le";
+    "riscv64" = "riscv64";
+    "s390x" = "s390x";
+    "x86_64" = "amd64";
+  }.${platform.parsed.cpu.name} or (throw "Unsupported system: ${platform.parsed.cpu.name}");
+
+  # We need a target compiler which is still runnable at build time,
+  # to handle the cross-building case where build != host == target
+  targetCC = pkgsBuildTarget.targetPackages.stdenv.cc;
+
+  isCross = stdenv.buildPlatform != stdenv.targetPlatform;
+in
+stdenv.mkDerivation rec {
+  pname = "go";
+  version = "1.20rc1";
+
+  src = fetchurl {
+    url = "https://go.dev/dl/go${version}.src.tar.gz";
+    sha256 = "sha256-FzEFTKmE8l/dCD0Ejt+gghDMkWf1oIanHeuhKMcTtBQ=";
+  };
+
+  strictDeps = true;
+  buildInputs = [ ]
+    ++ lib.optionals stdenv.isLinux [ stdenv.cc.libc.out ]
+    ++ lib.optionals (stdenv.hostPlatform.libc == "glibc") [ stdenv.cc.libc.static ];
+
+  depsTargetTargetPropagated = lib.optionals stdenv.isDarwin [ Foundation Security xcbuild ];
+
+  depsBuildTarget = lib.optional isCross targetCC;
+
+  depsTargetTarget = lib.optional stdenv.targetPlatform.isWindows threadsCross.package;
+
+  postPatch = ''
+    patchShebangs .
+  '';
+
+  patches = [
+    (substituteAll {
+      src = ./iana-etc-1.17.patch;
+      iana = iana-etc;
+    })
+    # Patch the mimetype database location which is missing on NixOS.
+    # but also allow static binaries built with NixOS to run outside nix
+    (substituteAll {
+      src = ./mailcap-1.17.patch;
+      inherit mailcap;
+    })
+    # prepend the nix path to the zoneinfo files but also leave the original value for static binaries
+    # that run outside a nix server
+    (substituteAll {
+      src = ./tzdata-1.19.patch;
+      inherit tzdata;
+    })
+    ./remove-tools-1.11.patch
+    ./go_no_vendor_checks-1.16.patch
+  ];
+
+  GOOS = stdenv.targetPlatform.parsed.kernel.name;
+  GOARCH = goarch stdenv.targetPlatform;
+  # GOHOSTOS/GOHOSTARCH must match the building system, not the host system.
+  # Go will nevertheless build a for host system that we will copy over in
+  # the install phase.
+  GOHOSTOS = stdenv.buildPlatform.parsed.kernel.name;
+  GOHOSTARCH = goarch stdenv.buildPlatform;
+
+  # {CC,CXX}_FOR_TARGET must be only set for cross compilation case as go expect those
+  # to be different from CC/CXX
+  CC_FOR_TARGET =
+    if isCross then
+      "${targetCC}/bin/${targetCC.targetPrefix}cc"
+    else
+      null;
+  CXX_FOR_TARGET =
+    if isCross then
+      "${targetCC}/bin/${targetCC.targetPrefix}c++"
+    else
+      null;
+
+  GOARM = toString (lib.intersectLists [ (stdenv.hostPlatform.parsed.cpu.version or "") ] [ "5" "6" "7" ]);
+  GO386 = "softfloat"; # from Arch: don't assume sse2 on i686
+  CGO_ENABLED = 1;
+
+  GOROOT_BOOTSTRAP = "${goBootstrap}/share/go";
+
+  buildPhase = ''
+    runHook preBuild
+    export GOCACHE=$TMPDIR/go-cache
+    # this is compiled into the binary
+    export GOROOT_FINAL=$out/share/go
+
+    export PATH=$(pwd)/bin:$PATH
+
+    ${lib.optionalString isCross ''
+    # Independent from host/target, CC should produce code for the building system.
+    # We only set it when cross-compiling.
+    export CC=${buildPackages.stdenv.cc}/bin/cc
+    ''}
+    ulimit -a
+
+    pushd src
+    ./make.bash
+    popd
+    runHook postBuild
+  '';
+
+  preInstall = ''
+    # Contains the wrong perl shebang when cross compiling,
+    # since it is not used for anything we can deleted as well.
+    rm src/regexp/syntax/make_perl_groups.pl
+  '' + (if (stdenv.buildPlatform != stdenv.hostPlatform) then ''
+    mv bin/*_*/* bin
+    rmdir bin/*_*
+    ${lib.optionalString (!(GOHOSTARCH == GOARCH && GOOS == GOHOSTOS)) ''
+      rm -rf pkg/${GOHOSTOS}_${GOHOSTARCH} pkg/tool/${GOHOSTOS}_${GOHOSTARCH}
+    ''}
+  '' else if (stdenv.hostPlatform != stdenv.targetPlatform) then ''
+    rm -rf bin/*_*
+    ${lib.optionalString (!(GOHOSTARCH == GOARCH && GOOS == GOHOSTOS)) ''
+      rm -rf pkg/${GOOS}_${GOARCH} pkg/tool/${GOOS}_${GOARCH}
+    ''}
+  '' else "");
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $GOROOT_FINAL
+    cp -a bin pkg src lib misc api doc $GOROOT_FINAL
+    ln -s $GOROOT_FINAL/bin $out/bin
+    runHook postInstall
+  '';
+
+  disallowedReferences = [ goBootstrap ];
+
+  passthru = {
+    inherit goBootstrap skopeoTest;
+    tests = {
+      skopeo = testers.testVersion { package = skopeoTest; };
+    };
+  };
+
+  meta = with lib; {
+    description = "The Go Programming language";
+    homepage = "https://go.dev/";
+    license = licenses.bsd3;
+    maintainers = teams.golang.members;
+    platforms = platforms.darwin ++ platforms.linux;
+  };
+}
diff --git a/pkgs/development/compilers/ispc/default.nix b/pkgs/development/compilers/ispc/default.nix
index c75c6e25b7526..004bf4bb10de5 100644
--- a/pkgs/development/compilers/ispc/default.nix
+++ b/pkgs/development/compilers/ispc/default.nix
@@ -2,7 +2,7 @@
 , cmake, which, m4, python3, bison, flex, llvmPackages, ncurses
 
   # the default test target is sse4, but that is not supported by all Hydra agents
-, testedTargets ? [ "sse2-i32x4" ]
+, testedTargets ? if stdenv.isAarch64 || stdenv.isAarch32 then [ "neon-i32x4" ] else [ "sse2-i32x4" ]
 }:
 
 stdenv.mkDerivation rec {
@@ -58,14 +58,15 @@ stdenv.mkDerivation rec {
     "-DCLANGPP_EXECUTABLE=${llvmPackages.clang}/bin/clang++"
     "-DISPC_INCLUDE_EXAMPLES=OFF"
     "-DISPC_INCLUDE_UTILS=OFF"
-    "-DARM_ENABLED=FALSE"
+    ("-DARM_ENABLED=" + (if stdenv.isAarch64 || stdenv.isAarch32 then "TRUE" else "FALSE"))
+    ("-DX86_ENABLED=" + (if stdenv.isx86_64 || stdenv.isx86_32 then "TRUE" else "FALSE"))
   ];
 
   meta = with lib; {
     homepage    = "https://ispc.github.io/";
     description = "Intel 'Single Program, Multiple Data' Compiler, a vectorised language";
     license     = licenses.bsd3;
-    platforms   = [ "x86_64-linux" "x86_64-darwin" ]; # TODO: buildable on more platforms?
+    platforms   = [ "x86_64-linux" "x86_64-darwin" "aarch64-linux" "aarch64-darwin" ]; # TODO: buildable on more platforms?
     maintainers = with maintainers; [ aristid thoughtpolice athas ];
   };
 }
diff --git a/pkgs/development/compilers/julia/1.8.nix b/pkgs/development/compilers/julia/1.8.nix
index 643e762ab11b2..83e87bf4c2f2f 100644
--- a/pkgs/development/compilers/julia/1.8.nix
+++ b/pkgs/development/compilers/julia/1.8.nix
@@ -54,7 +54,7 @@ stdenv.mkDerivation rec {
     # https://github.com/JuliaCI/julia-buildbot/blob/master/master/inventory.py
     "JULIA_CPU_TARGET=generic;sandybridge,-xsaveopt,clone_all;haswell,-rdrnd,base(1)"
   ] ++ lib.optionals stdenv.isAarch64 [
-    "JULIA_CPU_TERGET=generic;cortex-a57;thunderx2t99;armv8.2-a,crypto,fullfp16,lse,rdm"
+    "JULIA_CPU_TARGET=generic;cortex-a57;thunderx2t99;armv8.2-a,crypto,fullfp16,lse,rdm"
   ];
 
   # remove forbidden reference to $TMPDIR
diff --git a/pkgs/development/compilers/llvm/8/lldb/default.nix b/pkgs/development/compilers/llvm/8/lldb/default.nix
index f6d77d0b00f49..3612211542984 100644
--- a/pkgs/development/compilers/llvm/8/lldb/default.nix
+++ b/pkgs/development/compilers/llvm/8/lldb/default.nix
@@ -23,6 +23,9 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./gnu-install-dirs.patch
+
+    # Fix darwin build
+    ./lldb-gdb-remote-no-libcompress.patch
   ];
 
   postPatch = ''
@@ -33,6 +36,9 @@ stdenv.mkDerivation rec {
       cmake/modules/LLDBStandalone.cmake
     sed -i 's,"$.LLVM_LIBRARY_DIR.",${libllvm.lib}/lib ${libclang.lib}/lib,' \
       cmake/modules/LLDBStandalone.cmake
+
+    substituteInPlace tools/CMakeLists.txt \
+      --replace "add_subdirectory(debugserver)" ""
   '';
 
   outputs = [ "out" "lib" "dev" ];
@@ -46,7 +52,11 @@ stdenv.mkDerivation rec {
   ] ++ lib.optionals stdenv.isDarwin [
     darwin.libobjc
     darwin.apple_sdk.libs.xpc
-    darwin.apple_sdk.frameworks.Foundation darwin.bootstrap_cmds darwin.apple_sdk.frameworks.Carbon darwin.apple_sdk.frameworks.Cocoa
+    darwin.apple_sdk.frameworks.Foundation
+    darwin.bootstrap_cmds
+    darwin.apple_sdk.frameworks.Carbon
+    darwin.apple_sdk.frameworks.Cocoa
+    darwin.apple_sdk.frameworks.DebugSymbols
   ];
 
   CXXFLAGS = "-fno-rtti";
@@ -55,6 +65,9 @@ stdenv.mkDerivation rec {
   cmakeFlags = [
     "-DLLDB_INCLUDE_TESTS=${if doCheck then "YES" else "NO"}"
     "-DLLDB_CODESIGN_IDENTITY=" # codesigning makes nondeterministic
+  ] ++ lib.optionals stdenv.isDarwin [
+    # Building debugserver requires the proprietary libcompression
+    "-DLLDB_NO_DEBUGSERVER=ON"
   ] ++ lib.optionals doCheck [
     "-DLLDB_TEST_C_COMPILER=${stdenv.cc}/bin/${stdenv.cc.targetPrefix}cc"
     "-DLLDB_TEST_CXX_COMPILER=${stdenv.cc}/bin/${stdenv.cc.targetPrefix}c++"
@@ -80,7 +93,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = llvm_meta // {
-    broken = stdenv.isDarwin;
+    broken = stdenv.isDarwin && stdenv.isAarch64;
     homepage = "https://lldb.llvm.org/";
     description = "A next-generation high-performance debugger";
     longDescription = ''
diff --git a/pkgs/development/compilers/llvm/8/lldb/lldb-gdb-remote-no-libcompress.patch b/pkgs/development/compilers/llvm/8/lldb/lldb-gdb-remote-no-libcompress.patch
new file mode 100644
index 0000000000000..e04d4ffb1060d
--- /dev/null
+++ b/pkgs/development/compilers/llvm/8/lldb/lldb-gdb-remote-no-libcompress.patch
@@ -0,0 +1,30 @@
+diff -ru a/source/Plugins/Process/gdb-remote/GDBRemoteCommunication.cpp b/source/Plugins/Process/gdb-remote/GDBRemoteCommunication.cpp
+--- a/source/Plugins/Process/gdb-remote/GDBRemoteCommunication.cpp	2019-01-09 19:46:09.000000000 -0500
++++ b/source/Plugins/Process/gdb-remote/GDBRemoteCommunication.cpp	2021-11-27 00:23:08.000000000 -0500
+@@ -42,11 +42,6 @@
+ #define DEBUGSERVER_BASENAME "lldb-server"
+ #endif
+ 
+-#if defined(__APPLE__)
+-#define HAVE_LIBCOMPRESSION
+-#include <compression.h>
+-#endif
+-
+ #if defined(HAVE_LIBZ)
+ #include <zlib.h>
+ #endif
+diff -ru a/source/Plugins/Process/gdb-remote/GDBRemoteCommunicationClient.cpp b/source/Plugins/Process/gdb-remote/GDBRemoteCommunicationClient.cpp
+--- a/source/Plugins/Process/gdb-remote/GDBRemoteCommunicationClient.cpp	2018-12-18 18:02:50.000000000 -0500
++++ b/source/Plugins/Process/gdb-remote/GDBRemoteCommunicationClient.cpp	2021-11-27 00:09:07.000000000 -0500
+@@ -37,11 +37,6 @@
+ 
+ #include "llvm/ADT/StringSwitch.h"
+ 
+-#if defined(__APPLE__)
+-#define HAVE_LIBCOMPRESSION
+-#include <compression.h>
+-#endif
+-
+ using namespace lldb;
+ using namespace lldb_private;
+ using namespace lldb_private::process_gdb_remote;
diff --git a/pkgs/development/compilers/llvm/9/lldb/default.nix b/pkgs/development/compilers/llvm/9/lldb/default.nix
index 644911b905cca..57560ccbfe5be 100644
--- a/pkgs/development/compilers/llvm/9/lldb/default.nix
+++ b/pkgs/development/compilers/llvm/9/lldb/default.nix
@@ -1,5 +1,6 @@
 { lib, stdenv, llvm_meta
 , fetch
+, fetchpatch
 , cmake
 , zlib
 , ncurses
@@ -13,6 +14,7 @@
 , version
 , darwin
 , makeWrapper
+, perl
 , lit
 }:
 
@@ -25,12 +27,27 @@ stdenv.mkDerivation rec {
   patches = [
     ./procfs.patch
     ./gnu-install-dirs.patch
+
+    # Fix darwin build
+    (fetchpatch {
+      name = "lldb-use-system-debugserver-fix.patch";
+      url = "https://github.com/llvm-mirror/lldb/commit/be770754cc43da22eacdb70c6203f4582eeb011f.diff";
+      sha256 = "sha256-tKkk6sn//0Hu0nlzoKWs5fXMWc+O2JAWOEJ1ZnaLuVU=";
+      excludes = [ "packages/*" ];
+      postFetch = ''
+        substituteInPlace "$out" --replace add_lldb_tool_subdirectory add_subdirectory
+      '';
+    })
+    ./lldb-gdb-remote-no-libcompress.patch
   ];
 
   outputs = [ "out" "lib" "dev" ];
 
   nativeBuildInputs = [
     cmake python3 which swig lit makeWrapper
+  ] ++ lib.optionals stdenv.isDarwin [
+    # for scripts/generate-vers.pl
+    perl
   ];
 
   buildInputs = [
@@ -42,6 +59,7 @@ stdenv.mkDerivation rec {
     darwin.bootstrap_cmds
     darwin.apple_sdk.frameworks.Carbon
     darwin.apple_sdk.frameworks.Cocoa
+    darwin.apple_sdk.frameworks.DebugSymbols
   ];
 
   CXXFLAGS = "-fno-rtti";
@@ -52,6 +70,9 @@ stdenv.mkDerivation rec {
     "-DClang_DIR=${libclang.dev}/lib/cmake"
     "-DLLVM_EXTERNAL_LIT=${lit}/bin/lit"
     "-DLLDB_CODESIGN_IDENTITY=" # codesigning makes nondeterministic
+  ] ++ lib.optionals stdenv.isDarwin [
+    # Building debugserver requires the proprietary libcompression
+    "-DLLDB_USE_SYSTEM_DEBUGSERVER=ON"
   ] ++ lib.optionals doCheck [
     "-DLLDB_TEST_C_COMPILER=${stdenv.cc}/bin/${stdenv.cc.targetPrefix}cc"
     "-DLLDB_TEST_CXX_COMPILER=${stdenv.cc}/bin/${stdenv.cc.targetPrefix}c++"
@@ -80,7 +101,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = llvm_meta // {
-    broken = stdenv.isDarwin;
+    broken = stdenv.isDarwin && stdenv.isAarch64;
     homepage = "https://lldb.llvm.org/";
     description = "A next-generation high-performance debugger";
     longDescription = ''
diff --git a/pkgs/development/compilers/llvm/9/lldb/lldb-gdb-remote-no-libcompress.patch b/pkgs/development/compilers/llvm/9/lldb/lldb-gdb-remote-no-libcompress.patch
new file mode 100644
index 0000000000000..ff2dcd301fa3e
--- /dev/null
+++ b/pkgs/development/compilers/llvm/9/lldb/lldb-gdb-remote-no-libcompress.patch
@@ -0,0 +1,17 @@
+diff -ru a/source/Plugins/Process/gdb-remote/GDBRemoteCommunicationClient.cpp b/source/Plugins/Process/gdb-remote/GDBRemoteCommunicationClient.cpp
+--- a/source/Plugins/Process/gdb-remote/GDBRemoteCommunicationClient.cpp	2019-12-11 14:15:30.000000000 -0500
++++ b/source/Plugins/Process/gdb-remote/GDBRemoteCommunicationClient.cpp	2021-11-26 23:44:28.000000000 -0500
+@@ -36,13 +36,6 @@
+ 
+ #include "llvm/ADT/StringSwitch.h"
+ 
+-#if defined(__APPLE__)
+-#ifndef HAVE_LIBCOMPRESSION
+-#define HAVE_LIBCOMPRESSION
+-#endif
+-#include <compression.h>
+-#endif
+-
+ using namespace lldb;
+ using namespace lldb_private;
+ using namespace lldb_private::process_gdb_remote;
diff --git a/pkgs/development/compilers/shaderc/default.nix b/pkgs/development/compilers/shaderc/default.nix
index 65938fcc22659..3a75c9b8c9592 100644
--- a/pkgs/development/compilers/shaderc/default.nix
+++ b/pkgs/development/compilers/shaderc/default.nix
@@ -8,25 +8,25 @@ let
   glslang = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "glslang";
-    rev = "18eef33bd7a4bf5ad8c69f99cb72022608cf6e73";
-    sha256 = "sha256-tkWVvYmSpJPaZ8VJOkAWndDWhA0PiHAkR3feBAo+knM=";
+    rev = "728c689574fba7e53305b475cd57f196c1a21226";
+    hash = "sha256-BAgDQosiO3e4yy2DpQ6SjrJNrHTUDSduHFRvzWvd4v0=";
   };
   spirv-tools = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "SPIRV-Tools";
-    rev = "c2d5375fa7cc87c93f692e7200d5d974283d4391";
-    sha256 = "sha256-tMJRljrlH+qb+27rTn+3LuEyMOVpiU0zSCiGNfUTb6g=";
+    rev = "d9446130d5165f7fafcb3599252a22e264c7d4bd";
+    hash = "sha256-fuYhzfkWXDm1icLHifc32XZCNQ6Dj5f5WJslT2JoMbc=";
   };
   spirv-headers = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "SPIRV-Headers";
-    rev = "0c28b6451d77774912e52949c1e57fa726edf113";
-    sha256 = "sha256-KpCMceTV/BRaoJe1qeXhKYQNQqdGaM6Q9nklpJKzHFY=";
+    rev = "c214f6f2d1a7253bb0e9f195c2dc5b0659dc99ef";
+    hash = "sha256-/9EDOiqN6ZzDhRKP/Kv8D/BT2Cs7G8wyzEsGATLpmrA=";
   };
 in
 stdenv.mkDerivation rec {
   pname = "shaderc";
-  version = "2021.0";
+  version = "2022.4";
 
   outputs = [ "out" "lib" "bin" "dev" "static" ];
 
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
     owner = "google";
     repo = "shaderc";
     rev = "v${version}";
-    sha256 = "sha256-RfSMzrGVtdXbr/mjSrHoN447e3vMQfJbesQMvLOARBs=";
+    hash = "sha256-/p2gJ7Lnh8IfvwBwHPDtmfLJ8j+Rbv+Oxu9lxY6fxfk=";
   };
 
   patchPhase = ''
diff --git a/pkgs/development/compilers/tinycc/default.nix b/pkgs/development/compilers/tinycc/default.nix
index 21eb497a116ab..159b1827fc8fd 100644
--- a/pkgs/development/compilers/tinycc/default.nix
+++ b/pkgs/development/compilers/tinycc/default.nix
@@ -78,6 +78,10 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
   checkTarget = "test";
+  # https://www.mail-archive.com/tinycc-devel@nongnu.org/msg10142.html
+  preCheck = lib.optionalString (stdenv.isDarwin && stdenv.isx86_64) ''
+    rm tests/tests2/{108,114}*
+  '';
 
   meta = with lib; {
     homepage = "https://repo.or.cz/tinycc.git";
@@ -106,7 +110,8 @@ stdenv.mkDerivation rec {
     license = licenses.lgpl21Only;
     maintainers = with maintainers; [ joachifm AndersonTorres ];
     platforms = platforms.unix;
-    broken = stdenv.isDarwin;
+    # https://www.mail-archive.com/tinycc-devel@nongnu.org/msg10199.html
+    broken = stdenv.isDarwin && stdenv.isAarch64;
   };
 }
 # TODO: more multiple outputs
diff --git a/pkgs/development/embedded/fpga/openfpgaloader/default.nix b/pkgs/development/embedded/fpga/openfpgaloader/default.nix
index db97476dd692a..b71e89f2de61f 100644
--- a/pkgs/development/embedded/fpga/openfpgaloader/default.nix
+++ b/pkgs/development/embedded/fpga/openfpgaloader/default.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "openfpgaloader";
-  version = "0.9.1";
+  version = "0.10.0";
 
   src = fetchFromGitHub {
     owner = "trabucayre";
     repo = "openFPGALoader";
     rev = "v${version}";
-    sha256 = "sha256-CnJBmbvJ4FfKqdyoD8K94Eeoqly2Q6UV5wQ6EWv2isI=";
+    sha256 = "sha256-MPIFD7/jUEotY/EhuzNhaz8C3LVMxUr++fhtCpbbz0o=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
diff --git a/pkgs/development/interpreters/evcxr/default.nix b/pkgs/development/interpreters/evcxr/default.nix
index 24c271ee71929..eab1f90e5f327 100644
--- a/pkgs/development/interpreters/evcxr/default.nix
+++ b/pkgs/development/interpreters/evcxr/default.nix
@@ -3,16 +3,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "evcxr";
-  version = "0.14.1";
+  version = "0.14.2";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "evcxr";
     rev = "v${version}";
-    sha256 = "sha256-sdvBAmINl/3Hv9gnPVruI5lCuSu1VQ9swY0GNJrsEVk=";
+    sha256 = "sha256-gREAtCh4jerqxhwNslXIXRMLkoj0RlhbIwQXbb8LVws=";
   };
 
-  cargoSha256 = "sha256-wKoseZTAZOeT0LEHTlnO5cMpYx6sinnQkEVXCYXupAY=";
+  cargoSha256 = "sha256-xuxWOVSUJVQvSDA5xhFBjdO/ODLA4fzEnzG9p0DRF2Q=";
 
   RUST_SRC_PATH = "${rustPlatform.rustLibSrc}";
 
diff --git a/pkgs/development/interpreters/ruby/default.nix b/pkgs/development/interpreters/ruby/default.nix
index c7e01ea0f94d8..04ed31bbf3aa7 100644
--- a/pkgs/development/interpreters/ruby/default.nix
+++ b/pkgs/development/interpreters/ruby/default.nix
@@ -248,7 +248,7 @@ let
             inherit lib stdenv makeWrapper buildRubyGem buildEnv;
             gemConfig = defaultGemConfig;
             ruby = self;
-          }) withPackages gems;
+          }) withPackages buildGems gems;
 
         } // lib.optionalAttrs useBaseRuby {
           inherit baseRuby;
diff --git a/pkgs/development/libraries/ada/spark2014/default.nix b/pkgs/development/libraries/ada/spark2014/default.nix
index 1e6157cfb9a25..d928dddfc8df5 100644
--- a/pkgs/development/libraries/ada/spark2014/default.nix
+++ b/pkgs/development/libraries/ada/spark2014/default.nix
@@ -5,7 +5,6 @@
 , gnatcoll-core
 , gprbuild
 , python3
-, why3
 , ocaml
 , ocamlPackages
 , makeWrapper
@@ -53,11 +52,9 @@ stdenv.mkDerivation rec {
     make setup
   '';
 
-  postInstall = ''
+  installPhase = ''
+    make install-all
     cp -a ./install/. $out
-    # help gnatprove to locate why3server
-    wrapProgram "$out/bin/gnatprove" \
-        --prefix PATH : "${why3}/lib/why3"
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/aws-c-http/default.nix b/pkgs/development/libraries/aws-c-http/default.nix
index 4f9a46820b08a..a1da60f4aae0a 100644
--- a/pkgs/development/libraries/aws-c-http/default.nix
+++ b/pkgs/development/libraries/aws-c-http/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-http";
-  version = "0.6.27";
+  version = "0.6.28";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-http";
     rev = "v${version}";
-    sha256 = "sha256-prDQemFMIt33fna44tAaKlnblO4t5UU0vS6qyJKgJxk=";
+    sha256 = "sha256-Yl6+66UHUAQweFh/ziftWQKElamN1Mc9mZCdtFhRKXc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/aws-c-mqtt/default.nix b/pkgs/development/libraries/aws-c-mqtt/default.nix
index f5fc821e46702..802421d25a919 100644
--- a/pkgs/development/libraries/aws-c-mqtt/default.nix
+++ b/pkgs/development/libraries/aws-c-mqtt/default.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-mqtt";
-  version = "0.8.1";
+  version = "0.8.2";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-mqtt";
     rev = "v${version}";
-    sha256 = "sha256-nmSNG5o2Ck80OG4ZGYIayVdnw3Z2fn1VkUIuI9RYfL8=";
+    sha256 = "sha256-C8Ge+dSW/n9dh3MyZt/uOya3ONsC6Ji+59yylL7h8kY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/aws-c-s3/default.nix b/pkgs/development/libraries/aws-c-s3/default.nix
index 19ad8053c19f6..ccb0b9b35cfea 100644
--- a/pkgs/development/libraries/aws-c-s3/default.nix
+++ b/pkgs/development/libraries/aws-c-s3/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-s3";
-  version = "0.2.0";
+  version = "0.2.1";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-s3";
     rev = "v${version}";
-    sha256 = "sha256-tFweXB610Ua8+x05rg+rOqh9QPhXjpvvzGf8EVVIHks=";
+    sha256 = "sha256-PT6ivk6WsM27jaULJ5CBAojaO7rGxzs/cxv7aRf2nn8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/aws-checksums/default.nix b/pkgs/development/libraries/aws-checksums/default.nix
index d820b0c71930f..bfbc163c16239 100644
--- a/pkgs/development/libraries/aws-checksums/default.nix
+++ b/pkgs/development/libraries/aws-checksums/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-checksums";
-  version = "0.1.13";
+  version = "0.1.14";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-pSUSJTbwKYF2GsJG8DhLxxsv1ssp+/1c2gMY4dXbdFQ=";
+    sha256 = "sha256-yoViXJuM9UQMcn8W0CcWkCXroBLXjAestr+oqWHi5hQ=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/gnome-online-accounts/default.nix b/pkgs/development/libraries/gnome-online-accounts/default.nix
index 5344534aec5de..43eb7a2ff3015 100644
--- a/pkgs/development/libraries/gnome-online-accounts/default.nix
+++ b/pkgs/development/libraries/gnome-online-accounts/default.nix
@@ -87,6 +87,8 @@ stdenv.mkDerivation rec {
 
   NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
 
+  separateDebugInfo = true;
+
   passthru = {
     updateScript = gnome.updateScript {
       versionPolicy = "odd-unstable";
diff --git a/pkgs/development/libraries/gtksourceview/5.x.nix b/pkgs/development/libraries/gtksourceview/5.x.nix
index d3ac8246d95e5..083c987853429 100644
--- a/pkgs/development/libraries/gtksourceview/5.x.nix
+++ b/pkgs/development/libraries/gtksourceview/5.x.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchurl
+, fetchpatch2
 , meson
 , ninja
 , pkg-config
@@ -37,6 +38,13 @@ stdenv.mkDerivation rec {
     # but not from its own datadr (it assumes it will be in XDG_DATA_DIRS).
     # Since this is not generally true with Nix, let’s add $out/share unconditionally.
     ./4.x-nix_share_path.patch
+
+    # Add Nix syntax highlighting.
+    # https://gitlab.gnome.org/GNOME/gtksourceview/-/merge_requests/303
+    (fetchpatch2 {
+      url = "https://gitlab.gnome.org/GNOME/gtksourceview/-/commit/2cc7fd079f9fc8b593c727c68a2c783c82299562.patch";
+      sha256 = "bTYWjEDpdbnUxcYNKl2YtSLfYlMfcbQSSYQjhixOGS8=";
+    })
   ];
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/gvfs/default.nix b/pkgs/development/libraries/gvfs/default.nix
index d80d7f82bfd97..37a282c4ccad6 100644
--- a/pkgs/development/libraries/gvfs/default.nix
+++ b/pkgs/development/libraries/gvfs/default.nix
@@ -131,6 +131,8 @@ stdenv.mkDerivation rec {
   doCheck = false; # fails with "ModuleNotFoundError: No module named 'gi'"
   doInstallCheck = doCheck;
 
+  separateDebugInfo = true;
+
   passthru = {
     updateScript = gnome.updateScript {
       packageName = pname;
diff --git a/pkgs/development/libraries/jxrlib/default.nix b/pkgs/development/libraries/jxrlib/default.nix
index 06499e151ba1a..e6768dc0fa501 100644
--- a/pkgs/development/libraries/jxrlib/default.nix
+++ b/pkgs/development/libraries/jxrlib/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, python3, fixDarwinDylibNames }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, cmake }:
 
 stdenv.mkDerivation rec {
   pname = "jxrlib";
@@ -13,21 +13,25 @@ stdenv.mkDerivation rec {
     sha256 = "0rk3hbh00nw0wgbfbqk1szrlfg3yq7w6ar16napww3nrlm9cj65w";
   };
 
-  postPatch = ''
-    substituteInPlace Makefile \
-      --replace "cc" "$CC"
-  '' + lib.optionalString stdenv.isDarwin ''
-    substituteInPlace Makefile \
-      --replace '-shared' '-dynamiclib -undefined dynamic_lookup' \
-      --replace '.so' '.dylib'
-  '';
+  patches = [
+    (fetchpatch {
+      url = "https://salsa.debian.org/debian-phototools-team/jxrlib/-/raw/df96f9b9c1fbe9cdc97589c337f8a948bc81c4d0/debian/patches/usecmake.patch";
+      sha256 = "sha256-BpCToLgA5856PZk5mXlwAy3Oh9aYP/2wvu2DXDTqufM=";
+    })
+    (fetchpatch {
+      url = "https://salsa.debian.org/debian-phototools-team/jxrlib/-/raw/6c88037293aff8d5bc8a76ea32b36781c430ede3/debian/patches/bug803743.patch";
+      sha256 = "sha256-omIGa+ZrWjaH/IkBn4jgjufF/HEDKw69anVCX4hw+xQ=";
+    })
+    (fetchpatch {
+      url = "https://salsa.debian.org/debian-phototools-team/jxrlib/-/raw/b23d49062ec6a9b2739c9dade86be525a72fc807/debian/patches/pkg-config.patch";
+      sha256 = "sha256-ZACaXEi+rbKIFBHtSBheyFfqV2HYsKKrT+SmTShyUhg=";
+    })
+  ];
 
-  nativeBuildInputs = [ python3 ] ++ lib.optional stdenv.isDarwin fixDarwinDylibNames;
+  nativeBuildInputs = [ cmake ];
 
   strictDeps = true;
 
-  makeFlags = [ "DIR_INSTALL=$(out)" "SHARED=1" ];
-
   meta = with lib; {
     description = "Implementation of the JPEG XR image codec standard";
     homepage = "https://jxrlib.codeplex.com";
diff --git a/pkgs/development/libraries/libftdi/1.x.nix b/pkgs/development/libraries/libftdi/1.x.nix
index e19a9764bdf9e..75c9beea9b98c 100644
--- a/pkgs/development/libraries/libftdi/1.x.nix
+++ b/pkgs/development/libraries/libftdi/1.x.nix
@@ -44,6 +44,7 @@ stdenv.mkDerivation rec {
     "-DLINK_PYTHON_LIBRARY=${onOff pythonSupport}"
     "-DPYTHON_BINDINGS=${onOff pythonSupport}"
     "-DDOCUMENTATION=${onOff docSupport}"
+  ] ++ lib.optionals pythonSupport [
     "-DPYTHON_EXECUTABLE=${python3.pythonForBuild.interpreter}"
     "-DPYTHON_LIBRARY=${python3}/lib/libpython${python3.pythonVersion}${stdenv.hostPlatform.extensions.sharedLibrary}"
   ];
diff --git a/pkgs/development/libraries/libgpg-error/default.nix b/pkgs/development/libraries/libgpg-error/default.nix
index 4f687d41dd6ea..fcd7946a1351f 100644
--- a/pkgs/development/libraries/libgpg-error/default.nix
+++ b/pkgs/development/libraries/libgpg-error/default.nix
@@ -37,13 +37,21 @@ in stdenv.mkDerivation (rec {
   nativeBuildInputs = [ gettext ];
 
   postConfigure =
-    lib.optionalString stdenv.isSunOS
     # For some reason, /bin/sh on OpenIndiana leads to this at the end of the
     # `config.status' run:
     #   ./config.status[1401]: shift: (null): bad number
     # (See <https://hydra.nixos.org/build/2931046/nixlog/1/raw>.)
     # Thus, re-run it with Bash.
-      "${stdenv.shell} config.status";
+    lib.optionalString stdenv.isSunOS ''
+      ${stdenv.shell} config.status
+    ''
+    # ./configure errorneous decides to use weak symbols on pkgsStatic,
+    # which, together with other defines results in locking functions in
+    # src/posix-lock.c to be no-op, causing tests/t-lock.c to fail.
+    + lib.optionalString stdenv.hostPlatform.isStatic ''
+      sed '/USE_POSIX_THREADS_WEAK/ d' config.h
+      echo '#undef USE_POSIX_THREADS_WEAK' >> config.h
+    '';
 
   doCheck = true; # not cross
 
diff --git a/pkgs/development/libraries/libksi/default.nix b/pkgs/development/libraries/libksi/default.nix
index 015121811710b..634e52b97ab60 100644
--- a/pkgs/development/libraries/libksi/default.nix
+++ b/pkgs/development/libraries/libksi/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libksi";
-  version = "3.20.3025";
+  version = "3.21.3075";
 
   src = fetchFromGitHub {
     owner = "Guardtime";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0cagysr8j92r6g7f0mwrlkpn9xz9ncz2v3jymh47j3ljxmfbagpz";
+    sha256 = "sha256-JEdjy91+8xJPNzjkumadT05SxcvtM551+SjLN1SQcAU=";
   };
 
   nativeBuildInputs = [ autoreconfHook ];
diff --git a/pkgs/development/libraries/libmilter/darwin.patch b/pkgs/development/libraries/libmilter/darwin.patch
index be46662d6b385..9bad640450c60 100644
--- a/pkgs/development/libraries/libmilter/darwin.patch
+++ b/pkgs/development/libraries/libmilter/darwin.patch
@@ -13,16 +13,16 @@ Fix build issues on Darwin.
  define(`confLDOPTS', `${Extra_LD_Flags}')
 --- a/sendmail/sendmail.h	2020-05-18 14:51:17.000000000 +0200
 +++ b/sendmail/sendmail.h	2020-05-18 14:51:00.000000000 +0200
-@@ -104,7 +104,11 @@
- # endif /* NETX25 */
+@@ -122,7 +122,11 @@
+ # endif
  
- # if NAMED_BIND
--#  include <arpa/nameser.h>
-+#  ifdef __APPLE__
-+#   include <arpa/nameser_compat.h>
-+#  else
-+#   include <arpa/nameser.h>
-+#  endif
- #  ifdef NOERROR
- #   undef NOERROR		/* avoid <sys/streams.h> conflict */
- #  endif /* NOERROR */
+ #if NAMED_BIND
+-# include <arpa/nameser.h>
++# ifdef __APPLE__
++#  include <arpa/nameser_compat.h>
++# else
++#  include <arpa/nameser.h>
++# endif
+ # ifdef NOERROR
+ #  undef NOERROR		/* avoid <sys/streams.h> conflict */
+ # endif
diff --git a/pkgs/development/libraries/libmilter/default.nix b/pkgs/development/libraries/libmilter/default.nix
index 38788b3c964ba..ee92235adacce 100644
--- a/pkgs/development/libraries/libmilter/default.nix
+++ b/pkgs/development/libraries/libmilter/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libmilter";
-  version = "8.15.2";
+  version = "8.17.1";
 
   src = fetchurl {
     url = "ftp://ftp.sendmail.org/pub/sendmail/sendmail.${version}.tar.gz";
-    sha256 = "0fdl9ndmspqspdlmghzxlaqk56j3yajk52d7jxcg21b7sxglpy94";
+    sha256 = "sha256-BLx2tsiG5tERvn/Y2qMrjOABKKKItrUuBnvCnzhUpuY=";
   };
 
   buildPhase = ''
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
     sh Build -f ./a.m4
   '';
 
-  patches = [ ./install.patch ./sharedlib.patch ./glibc-2.30.patch ./darwin.patch ];
+  patches = [ ./install.patch ./sharedlib.patch ./darwin.patch ];
 
   nativeBuildInputs = [ m4 ] ++ lib.optional stdenv.isDarwin fixDarwinDylibNames;
 
diff --git a/pkgs/development/libraries/libmilter/glibc-2.30.patch b/pkgs/development/libraries/libmilter/glibc-2.30.patch
deleted file mode 100644
index e72ec9911e37a..0000000000000
--- a/pkgs/development/libraries/libmilter/glibc-2.30.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-diff --git a/libmilter/sm_gethost.c b/libmilter/sm_gethost.c
-index 2423c34..f00468c 100644
---- a/libmilter/sm_gethost.c
-+++ b/libmilter/sm_gethost.c
-@@ -52,16 +52,8 @@ sm_getipnodebyname(name, family, flags, err)
- 	bool resv6 = true;
- 	struct hostent *h;
- 
--	if (family == AF_INET6)
--	{
--		/* From RFC2133, section 6.1 */
--		resv6 = bitset(RES_USE_INET6, _res.options);
--		_res.options |= RES_USE_INET6;
--	}
- 	SM_SET_H_ERRNO(0);
--	h = gethostbyname(name);
--	if (family == AF_INET6 && !resv6)
--		_res.options &= ~RES_USE_INET6;
-+	h = gethostbyname2(name, family);
- 
- 	/* the function is supposed to return only the requested family */
- 	if (h != NULL && h->h_addrtype != family)
-diff --git a/sendmail/conf.c b/sendmail/conf.c
-index c73334e..500dafb 100644
---- a/sendmail/conf.c
-+++ b/sendmail/conf.c
-@@ -4243,16 +4243,8 @@ sm_getipnodebyname(name, family, flags, err)
- # else /* HAS_GETHOSTBYNAME2 */
- 	bool resv6 = true;
- 
--	if (family == AF_INET6)
--	{
--		/* From RFC2133, section 6.1 */
--		resv6 = bitset(RES_USE_INET6, _res.options);
--		_res.options |= RES_USE_INET6;
--	}
- 	SM_SET_H_ERRNO(0);
--	h = gethostbyname(name);
--	if (!resv6)
--		_res.options &= ~RES_USE_INET6;
-+	h = gethostbyname2(name, family);
- 
- 	/* the function is supposed to return only the requested family */
- 	if (h != NULL && h->h_addrtype != family)
diff --git a/pkgs/development/libraries/libpg_query/default.nix b/pkgs/development/libraries/libpg_query/default.nix
index 0387679835e53..cb5f545c9d935 100644
--- a/pkgs/development/libraries/libpg_query/default.nix
+++ b/pkgs/development/libraries/libpg_query/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libpg_query";
-  version = "14-3.0.0";
+  version = "15-4.0.0";
 
   src = fetchFromGitHub {
     owner = "pganalyze";
     repo = "libpg_query";
     rev = version;
-    sha256 = "sha256-rICN8fkPcYw32N6TdpbrszGUoRzwQdfRSW6A0AC8toM=";
+    sha256 = "sha256-2BZT/jGfGwia+Map5OkeTcWVFJssykhrdRT2IDAzrfs=";
   };
 
   nativeBuildInputs = [ which ];
diff --git a/pkgs/development/libraries/libplacebo/default.nix b/pkgs/development/libraries/libplacebo/default.nix
index 73d97a476559f..754ac2097b950 100644
--- a/pkgs/development/libraries/libplacebo/default.nix
+++ b/pkgs/development/libraries/libplacebo/default.nix
@@ -7,7 +7,6 @@
 , vulkan-headers
 , vulkan-loader
 , shaderc
-, glslang
 , lcms2
 , libepoxy
 , libGL
@@ -38,7 +37,6 @@ stdenv.mkDerivation rec {
     vulkan-headers
     vulkan-loader
     shaderc
-    glslang
     lcms2
     libepoxy
     libGL
@@ -50,6 +48,7 @@ stdenv.mkDerivation rec {
     "-Dvulkan-registry=${vulkan-headers}/share/vulkan/registry/vk.xml"
     "-Ddemos=false" # Don't build and install the demo programs
     "-Dd3d11=disabled" # Disable the Direct3D 11 based renderer
+    "-Dglslang=disabled" # rely on shaderc for GLSL compilation instead
   ] ++ lib.optionals stdenv.isDarwin [
     "-Dunwind=disabled" # libplacebo doesn’t build with `darwin.libunwind`
   ];
diff --git a/pkgs/development/libraries/librest/1.0.nix b/pkgs/development/libraries/librest/1.0.nix
index cbd525d40b0e3..130d6944e92bb 100644
--- a/pkgs/development/libraries/librest/1.0.nix
+++ b/pkgs/development/libraries/librest/1.0.nix
@@ -58,6 +58,8 @@ stdenv.mkDerivation rec {
     moveToOutput "share/doc" "$devdoc"
   '';
 
+  separateDebugInfo = true;
+
   passthru = {
     updateScript = gnome.updateScript {
       packageName = pname;
diff --git a/pkgs/development/libraries/libvgm/default.nix b/pkgs/development/libraries/libvgm/default.nix
index f7c85b292a663..a6d9a68abba59 100644
--- a/pkgs/development/libraries/libvgm/default.nix
+++ b/pkgs/development/libraries/libvgm/default.nix
@@ -42,13 +42,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "libvgm";
-  version = "unstable-2022-08-02";
+  version = "unstable-2022-11-25";
 
   src = fetchFromGitHub {
     owner = "ValleyBell";
     repo = "libvgm";
-    rev = "0e349256338144205303a1495ddc788a854be1eb";
-    sha256 = "FNNPiIfBUxkwgEbiFebPGn6ZIxv3ypDefcOzC6r94hE=";
+    rev = "fd7da37b96b5937a0bb5a41bacbae0a0ef59069f";
+    sha256 = "1tjooO/f72lRdZDxXVSxBySWsUMNWuqI2yQOipa7zFY=";
   };
 
   outputs = [
diff --git a/pkgs/development/libraries/minizip-ng/default.nix b/pkgs/development/libraries/minizip-ng/default.nix
index 8f12dc29784e6..19cd07fc16011 100644
--- a/pkgs/development/libraries/minizip-ng/default.nix
+++ b/pkgs/development/libraries/minizip-ng/default.nix
@@ -51,13 +51,13 @@ stdenv.mkDerivation (finalAttrs: {
     "-DMZ_LIBCOMP=OFF"
   ];
 
-  postInstall = let
-    libext = if stdenv.hostPlatform.isStatic then ".a" else ".so";
-  in ''
+  postInstall = ''
     # make lib findable as libminizip-ng even if compat is enabled
-    if [ ! -e $out/lib/libminizip-ng${libext} ]; then
-      ln -s $out/lib/libminizip${libext} $out/lib/libminizip-ng${libext}
-    fi
+    for ext in so dylib a ; do
+      if [ -e $out/lib/libminizip.$ext ] && [ ! -e $out/lib/libminizip-ng.$ext ]; then
+        ln -s $out/lib/libminizip.$ext $out/lib/libminizip-ng.$ext
+      fi
+    done
     if [ ! -e $out/include/minizip-ng ]; then
       ln -s $out/include $out/include/minizip-ng
     fi
diff --git a/pkgs/development/libraries/nss/generic.nix b/pkgs/development/libraries/nss/generic.nix
index a2e44f40227f8..89227b78f2f73 100644
--- a/pkgs/development/libraries/nss/generic.nix
+++ b/pkgs/development/libraries/nss/generic.nix
@@ -103,7 +103,11 @@ stdenv.mkDerivation rec {
       runHook postBuild
     '';
 
-  NIX_CFLAGS_COMPILE = "-Wno-error -DNIX_NSS_LIBDIR=\"${placeholder "out"}/lib/\" " + lib.optionalString stdenv.hostPlatform.is64bit "-DNSS_USE_64=1";
+  NIX_CFLAGS_COMPILE =
+    "-Wno-error -DNIX_NSS_LIBDIR=\"${placeholder "out"}/lib/\" "
+    + lib.optionalString stdenv.hostPlatform.is64bit "-DNSS_USE_64=1"
+    + lib.optionalString stdenv.hostPlatform.isILP32 " -DNS_PTR_LE_32=1" # See RNG_RandomUpdate() in drdbg.c
+  ;
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/development/libraries/nv-codec-headers/11_x.nix b/pkgs/development/libraries/nv-codec-headers/11_x.nix
index 284905cd4aa36..fba333ff6dbe6 100644
--- a/pkgs/development/libraries/nv-codec-headers/11_x.nix
+++ b/pkgs/development/libraries/nv-codec-headers/11_x.nix
@@ -5,12 +5,12 @@
 
 stdenv.mkDerivation rec {
   pname = "nv-codec-headers";
-  version = "11.1.5.1";
+  version = "11.1.5.2";
 
   src = fetchgit {
     url = "https://git.videolan.org/git/ffmpeg/nv-codec-headers.git";
     rev = "n${version}";
-    sha256 = "sha256-yTOKLjyYLxT/nI1FBOMwHpkDhfuua3+6Z5Mpb7ZrRhU=";
+    sha256 = "sha256-KzaqwpzISHB7tSTruynEOJmSlJnAFK2h7/cRI/zkNPk=";
   };
 
   makeFlags = [
diff --git a/pkgs/development/libraries/opencolorio/default.nix b/pkgs/development/libraries/opencolorio/default.nix
index 53a37da01fd63..4cf75039c49e7 100644
--- a/pkgs/development/libraries/opencolorio/default.nix
+++ b/pkgs/development/libraries/opencolorio/default.nix
@@ -8,6 +8,7 @@
 , ilmbase
 , pystring
 , imath
+, minizip-ng
 # Only required on Linux
 , glew
 , freeglut
@@ -21,19 +22,18 @@
 # Build apps
 , buildApps ? true # Utility applications
 , lcms2
-, openimageio2
-, openexr
+, openexr_3
 }:
 
 stdenv.mkDerivation rec {
   pname = "opencolorio";
-  version = "2.1.2";
+  version = "2.2.0";
 
   src = fetchFromGitHub {
     owner = "AcademySoftwareFoundation";
     repo = "OpenColorIO";
     rev = "v${version}";
-    sha256 = "sha256-e1PpWjjfSjtgN9Rs/+lsA45Z9S4y4T6nqrJ02DZ4vjs=";
+    sha256 = "sha256-l5UUysHdP/gb4Mn5A64XEoHOkthl6Mlb95CuI0l4vXQ=";
   };
 
   patches = [
@@ -43,8 +43,21 @@ stdenv.mkDerivation rec {
       revert = true;
       sha256 = "sha256-0DF+lwi2nfkUFG0wYvL3HYbhZS6SqGtPWoOabrFS1Eo=";
     })
+    (fetchpatch {
+      name = "pkg-config-absolute-path.patch";
+      url = "https://github.com/AcademySoftwareFoundation/OpenColorIO/commit/332462e7f5051b7e26ee3d8c22890cd5e71e7c30.patch";
+      sha256 = "sha256-7xHALhnOkKszgFBgPIbiZQaORnEJ+1M6RyoZdFgjElM=";
+    })
   ];
 
+  postPatch = lib.optionalString stdenv.isDarwin ''
+    # these tests don't like being run headless on darwin. no builtin
+    # way of skipping tests so this is what we're reduced to.
+    substituteInPlace tests/cpu/Config_tests.cpp \
+      --replace 'OCIO_ADD_TEST(Config, virtual_display)' 'static void _skip_virtual_display()' \
+      --replace 'OCIO_ADD_TEST(Config, virtual_display_with_active_displays)' 'static void _skip_virtual_display_with_active_displays()'
+  '';
+
   nativeBuildInputs = [ cmake ];
   buildInputs = [
     expat
@@ -52,25 +65,24 @@ stdenv.mkDerivation rec {
     ilmbase
     pystring
     imath
+    minizip-ng
   ] ++ lib.optionals stdenv.hostPlatform.isLinux [ glew freeglut ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [ Carbon GLUT Cocoa ]
     ++ lib.optionals pythonBindings [ python3Packages.python python3Packages.pybind11 ]
-    ++ lib.optionals buildApps [ lcms2 openimageio2 openexr ];
-
-    cmakeFlags = [
-      "-DOCIO_INSTALL_EXT_PACKAGES=NONE"
-    ] ++ lib.optional (!pythonBindings) "-DOCIO_BUILD_PYTHON=OFF"
-      ++ lib.optional (!buildApps) "-DOCIO_BUILD_APPS=OFF";
+    ++ lib.optionals buildApps [
+      lcms2
+      openexr_3
+    ];
 
-  # TODO Investigate this: Python and GPU tests fail to load libOpenColorIO.so.2.0
-  # doCheck = true;
+  cmakeFlags = [
+    "-DOCIO_INSTALL_EXT_PACKAGES=NONE"
+    # GPU test fails with: freeglut (GPU tests): failed to open display ''
+    "-DOCIO_BUILD_GPU_TESTS=OFF"
+  ] ++ lib.optional (!pythonBindings) "-DOCIO_BUILD_PYTHON=OFF"
+    ++ lib.optional (!buildApps) "-DOCIO_BUILD_APPS=OFF";
 
-  # https://github.com/AcademySoftwareFoundation/OpenColorIO/issues/1649
-  postPatch = ''
-    substituteInPlace src/OpenColorIO/CMakeLists.txt \
-      --replace '\$'{exec_prefix}/'$'{CMAKE_INSTALL_INCLUDEDIR} '$'{CMAKE_INSTALL_FULL_INCLUDEDIR} \
-      --replace '\$'{exec_prefix}/'$'{CMAKE_INSTALL_LIBDIR} '$'{CMAKE_INSTALL_FULL_LIBDIR}
-  '';
+  # precision issues on non-x86
+  doCheck = stdenv.isx86_64;
 
   meta = with lib; {
     homepage = "https://opencolorio.org";
diff --git a/pkgs/development/libraries/s2n-tls/default.nix b/pkgs/development/libraries/s2n-tls/default.nix
index ada5a5faec7a2..c0e0e34c5e39d 100644
--- a/pkgs/development/libraries/s2n-tls/default.nix
+++ b/pkgs/development/libraries/s2n-tls/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "s2n-tls";
-  version = "1.3.30";
+  version = "1.3.31";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-gDbQky2tNhtgdHmbMqnB6uIkJp2JhqyOMjPiW6EakK0=";
+    sha256 = "sha256-jdjy5Th73Sd/8NvivB2g9dVRDW3DEvUSYXZ1o2U6Y88=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/tinygltf/default.nix b/pkgs/development/libraries/tinygltf/default.nix
index 0ea26ffa62a70..8d8b6c4c9ed99 100644
--- a/pkgs/development/libraries/tinygltf/default.nix
+++ b/pkgs/development/libraries/tinygltf/default.nix
@@ -6,14 +6,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "2.6.3";
+  version = "2.7.0";
   pname = "tinygltf";
 
   src = fetchFromGitHub {
     owner = "syoyo";
     repo = "tinygltf";
     rev = "v${version}";
-    sha256 = "sha256-IyezvHzgLRyc3z8HdNsQMqDEhP+Ytw0stFNak3C8lTo=";
+    sha256 = "sha256-pIymkC+LzoSPU0jnpBH07ag/04W0c9TmPeDUSYQdgx4=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/tkrzw/default.nix b/pkgs/development/libraries/tkrzw/default.nix
index 4ede98f75099e..db963e5d86237 100644
--- a/pkgs/development/libraries/tkrzw/default.nix
+++ b/pkgs/development/libraries/tkrzw/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl }:
+{ lib, stdenv, fetchurl, nimPackages }:
 
 stdenv.mkDerivation rec {
   pname = "tkrzw";
@@ -19,6 +19,7 @@ stdenv.mkDerivation rec {
 
   doCheck = false; # memory intensive
 
+  passthru.tests.nim = nimPackages.tkrzw;
   meta = with lib; {
     description = "A set of implementations of DBM";
     homepage = "https://dbmx.net/tkrzw/";
diff --git a/pkgs/development/libraries/wolfssl/default.nix b/pkgs/development/libraries/wolfssl/default.nix
index e61a6f6c39317..a8e2259a3bc1c 100644
--- a/pkgs/development/libraries/wolfssl/default.nix
+++ b/pkgs/development/libraries/wolfssl/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "wolfssl";
-  version = "5.5.3";
+  version = "5.5.4";
 
   src = fetchFromGitHub {
     owner = "wolfSSL";
     repo = "wolfssl";
     rev = "v${version}-stable";
-    hash = "sha256-36L7kZ9Dqp3pDjodqELBdSBFwrf+GnRP7KNFYrRUCuU=";
+    hash = "sha256-sR/Gjk50kLej5oJzDH1I6/V+7OIRiwtyeg5tEE3fmHk=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/nim-packages/base32/default.nix b/pkgs/development/nim-packages/base32/default.nix
new file mode 100644
index 0000000000000..543c63754bc61
--- /dev/null
+++ b/pkgs/development/nim-packages/base32/default.nix
@@ -0,0 +1,18 @@
+{ lib, buildNimPackage, fetchFromGitHub }:
+
+buildNimPackage rec {
+  pname = "base32";
+  version = "0.1.3";
+  src = fetchFromGitHub {
+    owner = "OpenSystemsLab";
+    repo = "${pname}.nim";
+    rev = version;
+    hash = "sha256-BsDly13xsY2bu4N9LGHB0OGej/JhAx3B01TDdF0M8Jk=";
+  };
+  doCheck = true;
+  meta = src.meta // {
+    description = "Base32 library for Nim";
+    maintainers = with lib.maintainers; [ ehmry ];
+    license = lib.licenses.mit;
+  };
+}
diff --git a/pkgs/development/nim-packages/cbor/default.nix b/pkgs/development/nim-packages/cbor/default.nix
new file mode 100644
index 0000000000000..9302ca7a97e21
--- /dev/null
+++ b/pkgs/development/nim-packages/cbor/default.nix
@@ -0,0 +1,21 @@
+{ lib, buildNimPackage, fetchFromSourcehut }:
+
+buildNimPackage rec {
+  pname = "cbor";
+  version = "20221007";
+  src = fetchFromSourcehut {
+    owner = "~ehmry";
+    repo = "nim_${pname}";
+    rev = version;
+    hash = "sha256-zFkYsXFRAiBrfz3VNML3l+rYrdJmczl0bfZcJSbHHbM=";
+  };
+  doCheck = true;
+  meta = with lib;
+    src.meta // {
+      description =
+        "Concise Binary Object Representation decoder and encoder (RFC8949)";
+      license = licenses.unlicense;
+      maintainers = [ maintainers.ehmry ];
+      mainProgram = "cbordiag";
+    };
+}
diff --git a/pkgs/development/nim-packages/nimSHA2/default.nix b/pkgs/development/nim-packages/nimSHA2/default.nix
new file mode 100644
index 0000000000000..812b179b5d704
--- /dev/null
+++ b/pkgs/development/nim-packages/nimSHA2/default.nix
@@ -0,0 +1,18 @@
+{ lib, buildNimPackage, fetchFromGitHub }:
+
+buildNimPackage rec {
+  pname = "nimSHA2";
+  version = "unstable-2021-09-09";
+  src = fetchFromGitHub {
+    owner = "jangko";
+    repo = pname;
+    rev = "b8f666069dff1ed0c5142dd1ca692f0e71434716";
+    hash = "sha256-Wqb3mQ7638UOTze71mf6WMyGiw9qTwhbJiGGb+9OR2k=";
+  };
+  doCheck = true;
+  meta = src.meta // {
+    description = "Secure Hash Algorithm 2";
+    maintainers = with lib.maintainers; [ ehmry ];
+    license = lib.licenses.mit;
+  };
+}
diff --git a/pkgs/development/nim-packages/npeg/default.nix b/pkgs/development/nim-packages/npeg/default.nix
new file mode 100644
index 0000000000000..552449b7102a5
--- /dev/null
+++ b/pkgs/development/nim-packages/npeg/default.nix
@@ -0,0 +1,18 @@
+{ lib, buildNimPackage, fetchFromGitHub }:
+
+buildNimPackage rec {
+  pname = "npeg";
+  version = "1.0.1";
+  src = fetchFromGitHub {
+    owner = "zevv";
+    repo = pname;
+    rev = version;
+    hash = "sha256-EN3wTSa+WveO7V29A2lJgWLwIlHzQE8t7T2m4u7niMc=";
+  };
+  doCheck = true;
+  meta = src.meta // {
+    description = "NPeg is a pure Nim pattern matching library";
+    maintainers = with lib.maintainers; [ ehmry ];
+    license = lib.licenses.mit;
+  };
+}
diff --git a/pkgs/development/nim-packages/taps/default.nix b/pkgs/development/nim-packages/taps/default.nix
new file mode 100644
index 0000000000000..4bf8f247977e8
--- /dev/null
+++ b/pkgs/development/nim-packages/taps/default.nix
@@ -0,0 +1,19 @@
+{ lib, buildNimPackage, fetchFromSourcehut, getdns }:
+
+buildNimPackage rec {
+  pname = "taps";
+  version = "20221228";
+  src = fetchFromSourcehut {
+    owner = "~ehmry";
+    repo = "nim_${pname}";
+    rev = version;
+    hash = "sha256-0EjMP5pIPJg4/3nzj6ECC68f709TS06OrJlTZ0tavEo=";
+  };
+  propagatedBuildInputs = [ getdns ];
+  doCheck = false;
+  meta = src.meta // {
+    description = "Transport Services Interface";
+    license = lib.licenses.isc;
+    maintainers = [ lib.maintainers.ehmry ];
+  };
+}
diff --git a/pkgs/development/nim-packages/tkrzw/default.nix b/pkgs/development/nim-packages/tkrzw/default.nix
new file mode 100644
index 0000000000000..1988260ac4854
--- /dev/null
+++ b/pkgs/development/nim-packages/tkrzw/default.nix
@@ -0,0 +1,21 @@
+{ lib, buildNimPackage, fetchFromSourcehut, pkg-config, tkrzw }:
+
+buildNimPackage rec {
+  pname = "tkrzw";
+  version = "20220922";
+  src = fetchFromSourcehut {
+    owner = "~ehmry";
+    repo = "nim-${pname}";
+    rev = version;
+    hash = "sha256-66rUuK+wUrqs1QYjteZcaIrfg+LHQNcR+XM+EtVuGsA=";
+  };
+  propagatedNativeBuildInputs = [ pkg-config ];
+  propagatedBuildInputs = [ tkrzw ];
+  doCheck = true;
+  meta = with lib;
+    src.meta // {
+      description = "Nim wrappers over some of the Tkrzw C++ library";
+      license = lib.licenses.apsl20;
+      maintainers = with lib.maintainers; [ ehmry ];
+    };
+}
diff --git a/pkgs/development/ocaml-modules/base64/default.nix b/pkgs/development/ocaml-modules/base64/default.nix
index 7310bb968ffcc..26230287dd52a 100644
--- a/pkgs/development/ocaml-modules/base64/default.nix
+++ b/pkgs/development/ocaml-modules/base64/default.nix
@@ -1,18 +1,18 @@
-{ lib, fetchurl, buildDunePackage, ocaml, alcotest, bos, rresult }:
+{ lib, fetchurl, buildDunePackage, ocaml, findlib, alcotest, bos, rresult }:
 
 buildDunePackage rec {
   pname = "base64";
   version = "3.5.0";
 
-  minimumOCamlVersion = "4.03";
-
-  useDune2 = true;
+  minimalOCamlVersion = "4.03";
 
   src = fetchurl {
     url = "https://github.com/mirage/ocaml-base64/releases/download/v${version}/base64-v${version}.tbz";
     sha256 = "sha256-WJ3pwAV46/54QZismBjTWGxHSyMWts0+HEbMsfYq46Q=";
   };
 
+  propagatedBuildInputs = [ findlib ];
+
   # otherwise fmt breaks evaluation
   doCheck = lib.versionAtLeast ocaml.version "4.08";
   checkInputs = [ alcotest bos rresult ];
diff --git a/pkgs/development/ocaml-modules/domainslib/default.nix b/pkgs/development/ocaml-modules/domainslib/default.nix
new file mode 100644
index 0000000000000..6db57f81c48f9
--- /dev/null
+++ b/pkgs/development/ocaml-modules/domainslib/default.nix
@@ -0,0 +1,29 @@
+{ lib, fetchurl, buildDunePackage
+, lockfree
+, mirage-clock-unix
+}:
+
+buildDunePackage rec {
+  pname = "domainslib";
+  version = "0.5.0";
+
+  duneVersion = "3";
+  minimalOCamlVersion = "5.0";
+
+  src = fetchurl {
+    url = "https://github.com/ocaml-multicore/domainslib/releases/download/v${version}/domainslib-${version}.tbz";
+    hash = "sha256-rty+9DUhTUEcN7BPl8G6Q/G/MJ6z/UAn0RPkG8hACwA=";
+  };
+
+  propagatedBuildInputs = [ lockfree ];
+
+  doCheck = true;
+  checkInputs = [ mirage-clock-unix ];
+
+  meta = {
+    homepage = "https://github.com/ocaml-multicore/domainslib";
+    description = "Nested-parallel programming";
+    license = lib.licenses.isc;
+    maintainers = [ lib.maintainers.vbgl ];
+  };
+}
diff --git a/pkgs/development/ocaml-modules/dscheck/default.nix b/pkgs/development/ocaml-modules/dscheck/default.nix
new file mode 100644
index 0000000000000..0f74fb5e24141
--- /dev/null
+++ b/pkgs/development/ocaml-modules/dscheck/default.nix
@@ -0,0 +1,28 @@
+{ lib, fetchurl, buildDunePackage
+, containers
+, oseq
+}:
+
+buildDunePackage rec {
+  pname = "dscheck";
+  version = "0.1.0";
+
+  minimalOCamlVersion = "5.0";
+  duneVersion = "3";
+
+  src = fetchurl {
+    url = "https://github.com/ocaml-multicore/dscheck/releases/download/${version}/dscheck-${version}.tbz";
+    hash = "sha256-zoouFZJcUp71yeluVb1xLUIMcFv99OpkcQQCHkPTKcI=";
+  };
+
+  propagatedBuildInputs = [ containers oseq ];
+
+  doCheck = true;
+
+  meta = {
+    description = "Traced atomics";
+    homepage = "https://github.com/ocaml-multicore/dscheck";
+    license = lib.licenses.isc;
+    maintainers = [ lib.maintainers.vbgl ];
+  };
+}
diff --git a/pkgs/development/ocaml-modules/lockfree/default.nix b/pkgs/development/ocaml-modules/lockfree/default.nix
new file mode 100644
index 0000000000000..c3400d4583e04
--- /dev/null
+++ b/pkgs/development/ocaml-modules/lockfree/default.nix
@@ -0,0 +1,29 @@
+{ lib, fetchurl, buildDunePackage
+, dscheck
+, qcheck, qcheck-alcotest
+}:
+
+buildDunePackage rec {
+  pname = "lockfree";
+  version = "0.3.0";
+
+  minimalOCamlVersion = "5.0";
+  duneVersion = "3";
+
+  src = fetchurl {
+    url = "https://github.com/ocaml-multicore/lockfree/releases/download/${version}/lockfree-${version}.tbz";
+    hash = "sha256-XdJR5ojFsA7bJ4aZ5rh10NjopE0NjfqQ9KitOLMh3Jo=";
+  };
+
+  propagatedBuildInputs = [ dscheck ];
+
+  doCheck = true;
+  checkInputs = [ qcheck qcheck-alcotest ];
+
+  meta = {
+    description = "Lock-free data structures for multicore OCaml";
+    homepage = "https://github.com/ocaml-multicore/lockfree";
+    license = lib.licenses.isc;
+    maintainers = [ lib.maintainers.vbgl ];
+  };
+}
diff --git a/pkgs/development/ocaml-modules/mrmime/default.nix b/pkgs/development/ocaml-modules/mrmime/default.nix
index 50cd04ddb0a77..a2d118765616d 100644
--- a/pkgs/development/ocaml-modules/mrmime/default.nix
+++ b/pkgs/development/ocaml-modules/mrmime/default.nix
@@ -6,6 +6,7 @@
 , bigarray-overlap
 , bigstringaf
 , buildDunePackage
+, cmdliner
 , emile
 , fetchzip
 , fmt
@@ -16,6 +17,7 @@
 , ke
 , lib
 , mirage-crypto-rng
+, ocaml
 , pecu
 , prettym
 , ptime
@@ -34,7 +36,9 @@ buildDunePackage rec {
     sha256 = "14k67v0b39b8jq3ny2ymi8g8sqx2gd81mlzsjphdzdqnlx6fk716";
   };
 
-  useDune2 = true;
+  duneVersion = "3";
+
+  buildInputs = [ cmdliner hxd ];
 
   propagatedBuildInputs = [
     angstrom
@@ -60,10 +64,9 @@ buildDunePackage rec {
 
   checkInputs = [
     alcotest
-    hxd
     jsonm
   ];
-  doCheck = true;
+  doCheck = lib.versionOlder ocaml.version "5.0";
 
   meta = {
     description = "Parser and generator of mail in OCaml";
diff --git a/pkgs/development/ocaml-modules/oseq/default.nix b/pkgs/development/ocaml-modules/oseq/default.nix
new file mode 100644
index 0000000000000..cbe02de2ef11f
--- /dev/null
+++ b/pkgs/development/ocaml-modules/oseq/default.nix
@@ -0,0 +1,33 @@
+{ lib, fetchFromGitHub, buildDunePackage
+, seq
+, containers, qcheck
+}:
+
+buildDunePackage rec {
+  version = "0.4";
+  pname = "oseq";
+
+  src = fetchFromGitHub {
+    owner = "c-cube";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-FoCBvvPwa/dUCrgDEd0clEKAO7EcpedjaO4v+yUO874=";
+  };
+
+  propagatedBuildInputs = [ seq ];
+
+  duneVersion = "3";
+
+  doCheck = true;
+  checkInputs = [
+    containers
+    qcheck
+  ];
+
+  meta = {
+    homepage = "https://c-cube.github.io/oseq/";
+    description = "Purely functional iterators compatible with standard `seq`";
+    license = lib.licenses.bsd2;
+    maintainers = [ lib.maintainers.vbgl ];
+  };
+}
diff --git a/pkgs/development/ocaml-modules/parany/default.nix b/pkgs/development/ocaml-modules/parany/default.nix
index 4f072391deb0c..f5af161679555 100644
--- a/pkgs/development/ocaml-modules/parany/default.nix
+++ b/pkgs/development/ocaml-modules/parany/default.nix
@@ -1,20 +1,32 @@
-{ lib, buildDunePackage, fetchFromGitHub, ocamlnet, cpu }:
+{ lib, buildDunePackage, fetchFromGitHub, ocaml, cpu, domainslib }:
+
+let params =
+  if lib.versionAtLeast ocaml.version "5.00" then {
+    version = "13.0.1";
+    hash = "sha256-OYa0uLsDyzjmXZgWcYUxLhqco4Kp/icfDamNe3En5JQ=";
+    propagatedBuildInputs = [ domainslib ];
+  } else {
+    version = "12.2.2";
+    hash = "sha256-woZ4XJqqoRr/7mDurXYvTbSUUcLBEylzVYBQp1BAOqc=";
+    propagatedBuildInputs = [ cpu ];
+  }
+; in
 
 buildDunePackage rec {
   pname = "parany";
-  version = "12.1.2";
+  inherit (params) version;
 
-  useDune2 = true;
-  minimumOCamlVersion = "4.03.0";
+  duneVersion = "3";
+  minimalOCamlVersion = "4.08";
 
   src = fetchFromGitHub {
     owner = "UnixJunkie";
     repo = pname;
     rev = "v${version}";
-    sha256 = "yOeJzb2Wr6jA4efI9/fuqDCl/Tza3zxT3YjAiJmhHHg=";
+    inherit (params) hash;
   };
 
-  propagatedBuildInputs = [ ocamlnet cpu ];
+  inherit (params) propagatedBuildInputs;
 
   meta = with lib; {
     inherit (src.meta) homepage;
diff --git a/pkgs/development/ocaml-modules/piaf/default.nix b/pkgs/development/ocaml-modules/piaf/default.nix
index 0d0ec1594d40a..7239a70a0b747 100644
--- a/pkgs/development/ocaml-modules/piaf/default.nix
+++ b/pkgs/development/ocaml-modules/piaf/default.nix
@@ -1,5 +1,6 @@
 { alcotest-lwt
 , buildDunePackage
+, ocaml
 , dune-site
 , fetchzip
 , gluten-lwt-unix
@@ -14,6 +15,9 @@
 , uri
 }:
 
+lib.throwIf (lib.versionAtLeast ocaml.version "5.0")
+  "piaf is not available for OCaml ${ocaml.version}"
+
 buildDunePackage rec {
   pname = "piaf";
   version = "0.1.0";
diff --git a/pkgs/development/ocaml-modules/ppx_deriving/default.nix b/pkgs/development/ocaml-modules/ppx_deriving/default.nix
index fbe484dea0448..176e8ff8abc73 100644
--- a/pkgs/development/ocaml-modules/ppx_deriving/default.nix
+++ b/pkgs/development/ocaml-modules/ppx_deriving/default.nix
@@ -1,6 +1,7 @@
 { lib
 , fetchurl
 , buildDunePackage
+, ocaml
 , cppo
 , ppxlib
 , ppx_derivers
@@ -51,7 +52,7 @@ buildDunePackage rec {
     result
   ];
 
-  doCheck = true;
+  doCheck = lib.versionOlder ocaml.version "5.0";
   checkInputs = [
     (if lib.versionAtLeast version "5.2" then ounit2 else ounit)
   ];
diff --git a/pkgs/development/python-modules/afdko/default.nix b/pkgs/development/python-modules/afdko/default.nix
index 29593503252ad..739198fa4aeb9 100644
--- a/pkgs/development/python-modules/afdko/default.nix
+++ b/pkgs/development/python-modules/afdko/default.nix
@@ -91,6 +91,10 @@ buildPythonPackage rec {
     "test_spec"
   ] ++ lib.optionals (stdenv.hostPlatform.isi686) [
     "test_type1mm_inputs"
+  ] ++ [
+    # No longer succeeds in 2023
+    # https://github.com/adobe-type-tools/afdko/issues/1589
+    "test_ufo_fontinfo_parsing"
   ];
 
   passthru.tests = {
diff --git a/pkgs/development/python-modules/aiortm/default.nix b/pkgs/development/python-modules/aiortm/default.nix
index 83ed397e47d07..a305061984ae0 100644
--- a/pkgs/development/python-modules/aiortm/default.nix
+++ b/pkgs/development/python-modules/aiortm/default.nix
@@ -1,8 +1,10 @@
 { lib
 , aiohttp
+, aioresponses
 , buildPythonPackage
 , click
 , fetchFromGitHub
+, pydantic
 , poetry-core
 , pytestCheckHook
 , pythonOlder
@@ -11,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "aiortm";
-  version = "0.3.1";
+  version = "0.4.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -20,7 +22,7 @@ buildPythonPackage rec {
     owner = "MartinHjelmare";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-DTFynPFf0NUBieXDiMKhCNwBqx3s/xzggNmnz/IKjbU=";
+    hash = "sha256-cdCKcwpQ+u3CkMiPfMf6DnH2SYc7ab8q5W72aEEnNx4=";
   };
 
   nativeBuildInputs = [
@@ -30,10 +32,12 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     aiohttp
     click
+    pydantic
     yarl
   ];
 
   checkInputs = [
+    aioresponses
     pytestCheckHook
   ];
 
@@ -49,6 +53,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Library for the Remember the Milk API";
     homepage = "https://github.com/MartinHjelmare/aiortm";
+    changelog = "https://github.com/MartinHjelmare/aiortm/blob/v${version}/CHANGELOG.md";
     license = with licenses; [ asl20 ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/aiounifi/default.nix b/pkgs/development/python-modules/aiounifi/default.nix
index 2ac587ddff3ac..96a8ab9d8e526 100644
--- a/pkgs/development/python-modules/aiounifi/default.nix
+++ b/pkgs/development/python-modules/aiounifi/default.nix
@@ -12,7 +12,8 @@
 
 buildPythonPackage rec {
   pname = "aiounifi";
-  version = "42";
+  version = "43";
+  format = "setuptools";
 
   disabled = pythonOlder "3.9";
 
@@ -20,7 +21,7 @@ buildPythonPackage rec {
     owner = "Kane610";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-vScAWEjdzXSy1gktz+Tfhx13S6OeXZbwZgoS6D1BBtk=";
+    hash = "sha256-qpFQdNlw6voqccoJwPsnmbU5DtAC6zwtouUeysZ8/0M=";
   };
 
   propagatedBuildInputs = [
@@ -46,6 +47,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python library for communicating with Unifi Controller API";
     homepage = "https://github.com/Kane610/aiounifi";
+    changelog = "https://github.com/Kane610/aiounifi/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ peterhoeg ];
   };
diff --git a/pkgs/development/python-modules/azure-storage-blob/default.nix b/pkgs/development/python-modules/azure-storage-blob/default.nix
index 3b3499a780f0e..f8f7f2f403b28 100644
--- a/pkgs/development/python-modules/azure-storage-blob/default.nix
+++ b/pkgs/development/python-modules/azure-storage-blob/default.nix
@@ -1,37 +1,46 @@
 { lib
-, buildPythonPackage
-, fetchPypi
 , azure-common
 , azure-core
 , azure-storage-common
+, buildPythonPackage
+, cryptography
+, fetchPypi
+, isodate
 , msrest
-, isPy3k
-, futures ? null
+, pythonOlder
+, typing-extensions
 }:
 
 buildPythonPackage rec {
   pname = "azure-storage-blob";
-  version = "12.13.1";
+  version = "12.14.1";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    sha256 = "sha256-iZxLjiZxgS0s948QdVaifbsSjKqiuwYJTnKj1YNnQK8=";
+    hash = "sha256-hg1NgphaS/x9MnHnEnWvMw9U8zCnVDVUNae6dJzN6Zc=";
   };
 
   propagatedBuildInputs = [
     azure-common
     azure-core
     azure-storage-common
+    cryptography
+    isodate
     msrest
-  ] ++ lib.optional (!isPy3k) futures;
+    typing-extensions
+  ];
 
-  # has no tests
+  # Module has no tests
   doCheck = false;
 
   meta = with lib; {
     description = "Client library for Microsoft Azure Storage services containing the blob service APIs";
     homepage = "https://github.com/Azure/azure-sdk-for-python";
+    changelog = "https://github.com/Azure/azure-sdk-for-python/blob/azure-storage-blob_${version}/sdk/storage/azure-storage-blob/CHANGELOG.md";
     license = licenses.mit;
     maintainers = with maintainers; [ cmcdragonkai maxwilson ];
   };
diff --git a/pkgs/development/python-modules/cirq-google/default.nix b/pkgs/development/python-modules/cirq-google/default.nix
index ebd420244e4b2..eeba8feebe7e6 100644
--- a/pkgs/development/python-modules/cirq-google/default.nix
+++ b/pkgs/development/python-modules/cirq-google/default.nix
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     cirq-core
     google-api-core
     protobuf
-  ];
+  ] ++ google-api-core.optional-dependencies.grpc;
 
   checkInputs = [
     freezegun
diff --git a/pkgs/development/python-modules/django/4.nix b/pkgs/development/python-modules/django/4.nix
index cb6f40e422ce7..b4df7caed3ed9 100644
--- a/pkgs/development/python-modules/django/4.nix
+++ b/pkgs/development/python-modules/django/4.nix
@@ -43,14 +43,14 @@
 
 buildPythonPackage rec {
   pname = "Django";
-  version = "4.1.4";
+  version = "4.1.5";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-04pOEI0jhsuWN9pmqC3I0HM8rt5Mg8Sv29p4r0IUIRs=";
+    hash = "sha256-/1br1+rQ/V2+Bv4VewAkp6rqLgWTuzeF+1lM+U2tWO8=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/google-api-core/default.nix b/pkgs/development/python-modules/google-api-core/default.nix
index c92eb490df0e2..9dfc1950fd6ea 100644
--- a/pkgs/development/python-modules/google-api-core/default.nix
+++ b/pkgs/development/python-modules/google-api-core/default.nix
@@ -4,38 +4,50 @@
 , google-auth
 , googleapis-common-protos
 , grpcio
+, grpcio-gcp
 , grpcio-status
-, protobuf
-, proto-plus
-, requests
 , mock
+, proto-plus
+, protobuf
 , pytest-asyncio
 , pytestCheckHook
 , pythonOlder
+, requests
 }:
 
 buildPythonPackage rec {
   pname = "google-api-core";
-  version = "2.10.2";
+  version = "2.11.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-EMBvdzn+V3gfh1Izdejho6RnS/Y5LNYTGjIiGCuXEyA=";
+    hash = "sha256-S5u11aOAoL76BXOzAmUbipqJJiwXMON79CPOxRGATCI=";
   };
 
   propagatedBuildInputs = [
     googleapis-common-protos
     google-auth
-    grpcio
-    grpcio-status
     protobuf
     proto-plus
     requests
   ];
 
+  passthru.optional-dependencies = {
+    grpc = [
+      grpcio
+      grpcio-status
+    ];
+    grpcgcp = [
+      grpcio-gcp
+    ];
+    grpcio-gcp = [
+      grpcio-gcp
+    ];
+  };
+
   checkInputs = [
     mock
     pytest-asyncio
diff --git a/pkgs/development/python-modules/google-auth-httplib2/default.nix b/pkgs/development/python-modules/google-auth-httplib2/default.nix
index 0109175ab85cb..ee67860201db9 100644
--- a/pkgs/development/python-modules/google-auth-httplib2/default.nix
+++ b/pkgs/development/python-modules/google-auth-httplib2/default.nix
@@ -5,17 +5,21 @@
 , google-auth
 , httplib2
 , mock
-, pytestCheckHook
 , pytest-localserver
+, pytestCheckHook
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "google-auth-httplib2";
   version = "0.1.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "a07c39fd632becacd3f07718dfd6021bf396978f03ad3ce4321d060015cc30ac";
+    hash = "sha256-oHw5/WMr7KzT8HcY39YCG/OWl48DrTzkMh0GABXMMKw=";
   };
 
   propagatedBuildInputs = [
@@ -33,6 +37,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Google Authentication Library: httplib2 transport";
     homepage = "https://github.com/GoogleCloudPlatform/google-auth-library-python-httplib2";
+    changelog = "https://github.com/googleapis/google-auth-library-python-httplib2/blob/v${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ SuperSandro2000 ];
   };
diff --git a/pkgs/development/python-modules/google-auth/default.nix b/pkgs/development/python-modules/google-auth/default.nix
index 2a411783fff35..65f2bf1516cef 100644
--- a/pkgs/development/python-modules/google-auth/default.nix
+++ b/pkgs/development/python-modules/google-auth/default.nix
@@ -11,6 +11,7 @@
 , pyopenssl
 , pyu2f
 , requests
+, pythonOlder
 , aioresponses
 , asynctest
 , flask
@@ -27,11 +28,14 @@
 
 buildPythonPackage rec {
   pname = "google-auth";
-  version = "2.14.0";
+  version = "2.15.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-zySBeFXYdO3i79BxqiISVEX1Vd4Whbc5qXgvz0CMKj0=";
+    sha256 = "sha256-cvEqbPyWjXVNe9qzacXFwWAyEG5S0yxt/YSE5MAabR8=";
   };
 
   propagatedBuildInputs = [
@@ -56,6 +60,9 @@ buildPythonPackage rec {
     reauth = [
       pyu2f
     ];
+    requests = [
+      requests
+    ];
   };
 
   checkInputs = [
@@ -92,7 +99,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Google Auth Python Library";
     longDescription = ''
-      This library simplifies using Google’s various server-to-server
+      This library simplifies using Google's various server-to-server
       authentication mechanisms to access Google APIs.
     '';
     homepage = "https://github.com/googleapis/google-auth-library-python";
diff --git a/pkgs/development/python-modules/google-cloud-access-context-manager/default.nix b/pkgs/development/python-modules/google-cloud-access-context-manager/default.nix
index 55da4e874704a..b105e9cfe16d4 100644
--- a/pkgs/development/python-modules/google-cloud-access-context-manager/default.nix
+++ b/pkgs/development/python-modules/google-cloud-access-context-manager/default.nix
@@ -3,6 +3,7 @@
 , fetchPypi
 , google-api-core
 , pythonOlder
+, protobuf
 }:
 
 buildPythonPackage rec {
@@ -19,7 +20,8 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     google-api-core
-  ];
+    protobuf
+  ] ++ google-api-core.optional-dependencies.grpc;
 
   # No tests in repo
   doCheck = false;
diff --git a/pkgs/development/python-modules/google-cloud-appengine-logging/default.nix b/pkgs/development/python-modules/google-cloud-appengine-logging/default.nix
index 4dedba76ff44e..8b75007f5b171 100644
--- a/pkgs/development/python-modules/google-cloud-appengine-logging/default.nix
+++ b/pkgs/development/python-modules/google-cloud-appengine-logging/default.nix
@@ -5,6 +5,7 @@
 , grpc-google-iam-v1
 , mock
 , proto-plus
+, protobuf
 , pytest-asyncio
 , pytestCheckHook
 , pythonOlder
@@ -12,21 +13,22 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-appengine-logging";
-  version = "1.1.6";
+  version = "1.2.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-N0d/8lqqLT4IXbg0QpxchtJ4PmBOvXc4yGkvNhvHyJc=";
+    hash = "sha256-pvao522dfnRx6JJe4osRgU+q1LpBvdOTP4W9UVVZNiY=";
   };
 
   propagatedBuildInputs = [
     google-api-core
     grpc-google-iam-v1
     proto-plus
-  ];
+    protobuf
+  ] ++ google-api-core.optional-dependencies.grpc;
 
   checkInputs = [
     mock
@@ -42,6 +44,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Appengine logging client library";
     homepage = "https://github.com/googleapis/python-appengine-logging";
+    changelog = "https://github.com/googleapis/python-appengine-logging/blob/v${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/google-cloud-asset/default.nix b/pkgs/development/python-modules/google-cloud-asset/default.nix
index 68fe9c08a7405..ec5664ae905aa 100644
--- a/pkgs/development/python-modules/google-cloud-asset/default.nix
+++ b/pkgs/development/python-modules/google-cloud-asset/default.nix
@@ -8,6 +8,7 @@
 , google-cloud-os-config
 , google-cloud-testutils
 , libcst
+, protobuf
 , proto-plus
 , pytest-asyncio
 , pytestCheckHook
@@ -35,7 +36,14 @@ buildPythonPackage rec {
     google-cloud-os-config
     libcst
     proto-plus
-  ];
+    protobuf
+  ] ++ google-api-core.optional-dependencies.grpc;
+
+  passthru.optional-dependencies = {
+    libcst = [
+      libcst
+    ];
+  };
 
   checkInputs = [
     google-cloud-testutils
@@ -56,6 +64,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python Client for Google Cloud Asset API";
     homepage = "https://github.com/googleapis/python-asset";
+    changelog = "https://github.com/googleapis/python-asset/blob/v${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ SuperSandro2000 ];
   };
diff --git a/pkgs/development/python-modules/google-cloud-audit-log/default.nix b/pkgs/development/python-modules/google-cloud-audit-log/default.nix
index e1effd0ac2a2f..e1276718efca7 100644
--- a/pkgs/development/python-modules/google-cloud-audit-log/default.nix
+++ b/pkgs/development/python-modules/google-cloud-audit-log/default.nix
@@ -1,12 +1,21 @@
-{ lib, buildPythonPackage, fetchPypi, googleapis-common-protos, protobuf }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+, googleapis-common-protos
+, protobuf
+, pythonOlder
+}:
 
 buildPythonPackage rec {
   pname = "google-cloud-audit-log";
   version = "0.2.4";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-qr5VQ2ceT4qcekwOPqmoe6K6K5b5/61vqgIgmQDh8wg=";
+    hash = "sha256-qr5VQ2ceT4qcekwOPqmoe6K6K5b5/61vqgIgmQDh8wg=";
   };
 
   propagatedBuildInputs = [ googleapis-common-protos protobuf ];
@@ -14,11 +23,14 @@ buildPythonPackage rec {
   # tests are a bit wonky to setup and are not very deep either
   doCheck = false;
 
-  pythonImportsCheck = [ "google.cloud.audit" ];
+  pythonImportsCheck = [
+    "google.cloud.audit"
+  ];
 
   meta = with lib; {
     description = "Google Cloud Audit Protos";
     homepage = "https://github.com/googleapis/python-audit-log";
+    changelog = "https://github.com/googleapis/python-audit-log/blob/v${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ SuperSandro2000 ];
   };
diff --git a/pkgs/development/python-modules/google-cloud-automl/default.nix b/pkgs/development/python-modules/google-cloud-automl/default.nix
index 87ac3fe68f1a8..c9f5c994aae4e 100644
--- a/pkgs/development/python-modules/google-cloud-automl/default.nix
+++ b/pkgs/development/python-modules/google-cloud-automl/default.nix
@@ -1,15 +1,16 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, pytestCheckHook
-, libcst
 , google-api-core
 , google-cloud-storage
 , google-cloud-testutils
+, libcst
+, mock
 , pandas
 , proto-plus
+, protobuf
 , pytest-asyncio
-, mock
+, pytestCheckHook
 , pythonOlder
 }:
 
@@ -27,9 +28,21 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     google-api-core
-    libcst
     proto-plus
-  ];
+    protobuf
+  ] ++ google-api-core.optional-dependencies.grpc;
+
+  passthru.optional-dependencies = {
+    libcst = [
+      libcst
+    ];
+    pandas = [
+      pandas
+    ];
+    storage = [
+      google-cloud-storage
+    ];
+  };
 
   checkInputs = [
     google-cloud-storage
@@ -64,6 +77,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Cloud AutoML API client library";
     homepage = "https://github.com/googleapis/python-automl";
+    changelog = "https://github.com/googleapis/python-automl/blob/v${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ SuperSandro2000 ];
   };
diff --git a/pkgs/development/python-modules/google-cloud-bigquery-datatransfer/default.nix b/pkgs/development/python-modules/google-cloud-bigquery-datatransfer/default.nix
index ebb6d95eb1f32..3643cf69b767f 100644
--- a/pkgs/development/python-modules/google-cloud-bigquery-datatransfer/default.nix
+++ b/pkgs/development/python-modules/google-cloud-bigquery-datatransfer/default.nix
@@ -3,37 +3,39 @@
 , fetchPypi
 , google-api-core
 , libcst
+, mock
 , proto-plus
-, pytestCheckHook
+, protobuf
 , pytest-asyncio
-, pytz
-, mock
+, pytestCheckHook
 , pythonOlder
+, pytz
 }:
 
 buildPythonPackage rec {
   pname = "google-cloud-bigquery-datatransfer";
-  version = "3.7.3";
+  version = "3.8.0";
   format = "setuptools";
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-oPgbgaq5RQM4C2qmf36i+qXDQA9sV16abCleNkdGYC0=";
+    hash = "sha256-TR41fn/e4185RW8zkd3SY1E/jNQZuUYJr1n+TwNPHT4=";
   };
 
   propagatedBuildInputs = [
     google-api-core
     libcst
     proto-plus
+    protobuf
     pytz
-  ];
+  ] ++ google-api-core.optional-dependencies.grpc;
 
   checkInputs = [
     mock
-    pytestCheckHook
     pytest-asyncio
+    pytestCheckHook
   ];
 
   pythonImportsCheck = [
@@ -44,6 +46,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "BigQuery Data Transfer API client library";
     homepage = "https://github.com/googleapis/python-bigquery-datatransfer";
+    changelog = "https://github.com/googleapis/python-bigquery-datatransfer/blob/v${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ SuperSandro2000 ];
   };
diff --git a/pkgs/development/python-modules/google-cloud-bigquery-logging/default.nix b/pkgs/development/python-modules/google-cloud-bigquery-logging/default.nix
index c46db49774e60..926d14d5267ac 100644
--- a/pkgs/development/python-modules/google-cloud-bigquery-logging/default.nix
+++ b/pkgs/development/python-modules/google-cloud-bigquery-logging/default.nix
@@ -5,6 +5,7 @@
 , grpc-google-iam-v1
 , mock
 , proto-plus
+, protobuf
 , pytest-asyncio
 , pytestCheckHook
 , pythonOlder
@@ -12,21 +13,22 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-bigquery-logging";
-  version = "1.0.7";
+  version = "1.1.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-F8PP/Vs+sOVDEwIUvWnO6C4+rQvVTtWKMPnREwKEQ0I=";
+    hash = "sha256-TGK5ghwhVBN0VBMj84Jjt4gpsXQC+HKAr5yP756PbDM=";
   };
 
   propagatedBuildInputs = [
     google-api-core
     grpc-google-iam-v1
     proto-plus
-  ];
+    protobuf
+  ] ++ google-api-core.optional-dependencies.grpc;
 
   checkInputs = [
     mock
@@ -42,6 +44,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Bigquery logging client library";
     homepage = "https://github.com/googleapis/python-bigquery-logging";
+    changelog = "https://github.com/googleapis/python-bigquery-logging/blob/v${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/google-cloud-bigquery-storage/default.nix b/pkgs/development/python-modules/google-cloud-bigquery-storage/default.nix
index 766a793082cb0..9972918a7c2cb 100644
--- a/pkgs/development/python-modules/google-cloud-bigquery-storage/default.nix
+++ b/pkgs/development/python-modules/google-cloud-bigquery-storage/default.nix
@@ -1,24 +1,45 @@
 { lib
 , buildPythonPackage
+, fastavro
 , fetchPypi
 , google-api-core
 , google-auth
 , google-cloud-bigquery
+, pandas
+, protobuf
+, pyarrow
 , pytestCheckHook
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "google-cloud-bigquery-storage";
   version = "2.16.2";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-5qyk97b06tuH+FEJBhd1Y1GOFYfIt7FivPjhyede9BY=";
+    hash = "sha256-5qyk97b06tuH+FEJBhd1Y1GOFYfIt7FivPjhyede9BY=";
   };
 
   propagatedBuildInputs = [
     google-api-core
-  ];
+    protobuf
+  ] ++ google-api-core.optional-dependencies.grpc;
+
+  passthru.optional-dependencies = {
+    fastavro = [
+      fastavro
+    ];
+    pandas = [
+      pandas
+    ];
+    pyarrow = [
+      pyarrow
+    ];
+  };
 
   checkInputs = [
     google-auth
@@ -26,7 +47,7 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  # dependency loop with google-cloud-bigquery
+  # Dependency loop with google-cloud-bigquery
   doCheck = false;
 
   preCheck = ''
@@ -42,6 +63,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "BigQuery Storage API API client library";
     homepage = "https://github.com/googleapis/python-bigquery-storage";
+    changelog = "https://github.com/googleapis/python-bigquery-storage/blob/v${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ SuperSandro2000 ];
   };
diff --git a/pkgs/development/python-modules/google-cloud-bigquery/default.nix b/pkgs/development/python-modules/google-cloud-bigquery/default.nix
index 1c71878ed0b48..bc80fc531ffec 100644
--- a/pkgs/development/python-modules/google-cloud-bigquery/default.nix
+++ b/pkgs/development/python-modules/google-cloud-bigquery/default.nix
@@ -1,58 +1,85 @@
 { lib
 , buildPythonPackage
-, fetchPypi
-, pytestCheckHook
 , db-dtypes
+, fetchPypi
 , freezegun
+, google-api-core
 , google-cloud-bigquery-storage
 , google-cloud-core
 , google-cloud-datacatalog
 , google-cloud-storage
 , google-cloud-testutils
 , google-resumable-media
+, grpcio
 , ipython
 , mock
 , pandas
 , proto-plus
+, protobuf
 , psutil
 , pyarrow
 , pytest-xdist
+, pytestCheckHook
+, python-dateutil
 , pythonOlder
+, requests
+, tqdm
 }:
 
 buildPythonPackage rec {
   pname = "google-cloud-bigquery";
-  version = "3.3.5";
+  version = "3.4.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-+7ZXmcAnVN3K7ZgfSotrAhtpzADUzZw1yh1swnLq2dE=";
+    hash = "sha256-iEaJcU2YojZN3px8Nn6CKMcRYQi7rXpjZd/eORY4mFs=";
   };
 
   propagatedBuildInputs = [
+    grpcio
+    google-api-core
     google-cloud-core
     google-cloud-bigquery-storage
     google-resumable-media
     proto-plus
-    pyarrow
-  ];
+    protobuf
+    requests
+    python-dateutil
+  ] ++ google-api-core.optional-dependencies.grpc;
+
+  passthru.optional-dependencies = {
+    bqstorage = [
+      google-cloud-bigquery-storage
+      grpcio
+      pyarrow
+    ];
+    pandas = [
+      db-dtypes
+      pandas
+      pyarrow
+    ];
+    tqdm = [
+      tqdm
+    ];
+    ipython = [
+      ipython
+    ];
+  };
 
   checkInputs = [
-    db-dtypes
     freezegun
     google-cloud-testutils
-    ipython
     mock
-    pandas
     psutil
     google-cloud-datacatalog
     google-cloud-storage
     pytestCheckHook
     pytest-xdist
-  ];
+  ] ++ passthru.optional-dependencies.pandas
+  ++ passthru.optional-dependencies.ipython;
 
   # prevent google directory from shadowing google imports
   preCheck = ''
@@ -83,10 +110,12 @@ buildPythonPackage rec {
     "test__initiate_resumable_upload_mtls"
     "test__initiate_resumable_upload_with_retry"
     "test_table_clones"
+    "test_context_with_default_connection"
+    "test_context_with_custom_connection"
   ];
 
   disabledTestPaths = [
-    # requires credentials
+    # Tests require credentials
     "tests/system/test_query.py"
     "tests/system/test_job_retry.py"
     "tests/system/test_pandas.py"
@@ -100,6 +129,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Google BigQuery API client library";
     homepage = "https://github.com/googleapis/python-bigquery";
+    changelog = "https://github.com/googleapis/python-bigquery/blob/v${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ SuperSandro2000 ];
   };
diff --git a/pkgs/development/python-modules/google-cloud-bigtable/default.nix b/pkgs/development/python-modules/google-cloud-bigtable/default.nix
index 7e8f98ce51eb8..ecf9162ce8e7e 100644
--- a/pkgs/development/python-modules/google-cloud-bigtable/default.nix
+++ b/pkgs/development/python-modules/google-cloud-bigtable/default.nix
@@ -3,10 +3,12 @@
 , fetchPypi
 , google-api-core
 , google-cloud-core
+, grpcio
 , grpc-google-iam-v1
 , libcst
 , mock
 , proto-plus
+, protobuf
 , pytestCheckHook
 , pythonOlder
 }:
@@ -27,11 +29,18 @@ buildPythonPackage rec {
     google-api-core
     google-cloud-core
     grpc-google-iam-v1
-    libcst
     proto-plus
-  ];
+    protobuf
+  ] ++ google-api-core.optional-dependencies.grpc;
+
+  passthru.optional-dependencies = {
+    libcst = [
+      libcst
+    ];
+  };
 
   checkInputs = [
+    grpcio
     mock
     pytestCheckHook
   ];
diff --git a/pkgs/development/python-modules/google-cloud-compute/default.nix b/pkgs/development/python-modules/google-cloud-compute/default.nix
index f51cac5d8a5c5..e1041f2811c02 100644
--- a/pkgs/development/python-modules/google-cloud-compute/default.nix
+++ b/pkgs/development/python-modules/google-cloud-compute/default.nix
@@ -12,19 +12,21 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-compute";
-  version = "1.5.2";
+  version = "1.8.0";
+  format = "setuptools";
+
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-D0pIR1vQEt/7aIxMo0uDlxvt+fwS2DxCurU/lxMHAjo=";
+    hash = "sha256-pnhXkYSXph7aIZJoI3tXTNIUkH44S22QDIGXUl9ceFU=";
   };
 
   propagatedBuildInputs = [
     google-api-core
     proto-plus
     protobuf
-  ];
+  ] ++ google-api-core.optional-dependencies.grpc;
 
   checkInputs = [
     mock
@@ -48,6 +50,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "API Client library for Google Cloud Compute";
     homepage = "https://github.com/googleapis/python-compute";
+    changelog = "https://github.com/googleapis/python-compute/blob/v${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ jpetrucciani ];
   };
diff --git a/pkgs/development/python-modules/google-cloud-container/default.nix b/pkgs/development/python-modules/google-cloud-container/default.nix
index 260079e58179c..eab497f2d7b46 100644
--- a/pkgs/development/python-modules/google-cloud-container/default.nix
+++ b/pkgs/development/python-modules/google-cloud-container/default.nix
@@ -2,42 +2,42 @@
 , buildPythonPackage
 , fetchPypi
 , google-api-core
-, grpc-google-iam-v1
 , libcst
 , mock
 , proto-plus
-, pytestCheckHook
+, protobuf
 , pytest-asyncio
+, pytestCheckHook
 , pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "google-cloud-container";
-  version = "2.13.0";
+  version = "2.14.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Rq4DuCbXX4DSIr01AFYo0O4+wQv4B5yzrrX9a2ecAFI=";
+    hash = "sha256-r/AmdcXIChEqp3AvO2xU2lsM3pqmn/Tmv8/cQJ+kuCE=";
   };
 
   propagatedBuildInputs = [
     google-api-core
-    grpc-google-iam-v1
     libcst
     proto-plus
-  ];
+    protobuf
+  ] ++ google-api-core.optional-dependencies.grpc;
 
   checkInputs = [
     mock
-    pytestCheckHook
     pytest-asyncio
+    pytestCheckHook
   ];
 
   disabledTests = [
-    # requires credentials
+    # Test requires credentials
     "test_list_clusters"
   ];
 
@@ -50,6 +50,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Google Container Engine API client library";
     homepage = "https://github.com/googleapis/python-container";
+    changelog = "https://github.com/googleapis/python-container/blob/v${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ SuperSandro2000 ];
   };
diff --git a/pkgs/development/python-modules/google-cloud-core/default.nix b/pkgs/development/python-modules/google-cloud-core/default.nix
index bc72ce501035b..910528bbcaf07 100644
--- a/pkgs/development/python-modules/google-cloud-core/default.nix
+++ b/pkgs/development/python-modules/google-cloud-core/default.nix
@@ -1,34 +1,55 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, pytestCheckHook
 , google-api-core
+, google-auth
+, grpcio
 , mock
+, pytestCheckHook
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "google-cloud-core";
   version = "2.3.2";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-uVKe5wR/2NS/SiGC3mGRVCQN8X++YOrTmQeMGuFSr5o=";
+    hash = "sha256-uVKe5wR/2NS/SiGC3mGRVCQN8X++YOrTmQeMGuFSr5o=";
   };
 
-  propagatedBuildInputs = [ google-api-core ];
+  propagatedBuildInputs = [
+    google-auth
+    google-api-core
+  ];
+
+  passthru.optional-dependencies = {
+    grpc = [
+      grpcio
+    ];
+  };
 
-  checkInputs = [ mock pytestCheckHook ];
+  checkInputs = [
+    mock
+    pytestCheckHook
+  ] ++ passthru.optional-dependencies.grpc;
 
   # prevent google directory from shadowing google imports
   preCheck = ''
     rm -r google
   '';
 
-  pythonImportsCheck = [ "google.cloud" ];
+  pythonImportsCheck = [
+    "google.cloud"
+  ];
 
   meta = with lib; {
     description = "API Client library for Google Cloud: Core Helpers";
     homepage = "https://github.com/googleapis/python-cloud-core";
+    changelog = "https://github.com/googleapis/python-cloud-core/blob/v${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ SuperSandro2000 ];
   };
diff --git a/pkgs/development/python-modules/google-cloud-datacatalog/default.nix b/pkgs/development/python-modules/google-cloud-datacatalog/default.nix
index 297847f6f3ac8..a21a09458b555 100644
--- a/pkgs/development/python-modules/google-cloud-datacatalog/default.nix
+++ b/pkgs/development/python-modules/google-cloud-datacatalog/default.nix
@@ -1,39 +1,41 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, libcst
 , google-api-core
 , grpc-google-iam-v1
+, libcst
+, mock
 , proto-plus
+, protobuf
 , pytest-asyncio
 , pytestCheckHook
-, mock
 , pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "google-cloud-datacatalog";
-  version = "3.9.3";
+  version = "3.10.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-JgGs4lqOruHohIy6GaUGSHr0vd+lFsI5u4PVZwt7tdo=";
+    hash = "sha256-5j8daEVqDEQKHU/XbZ9U6qp0Aaye0KUzJMyj9fiJtRs=";
   };
 
   propagatedBuildInputs = [
-    libcst
     google-api-core
     grpc-google-iam-v1
+    libcst
     proto-plus
-  ];
+    protobuf
+  ] ++ google-api-core.optional-dependencies.grpc;
 
   checkInputs = [
+    mock
     pytest-asyncio
     pytestCheckHook
-    mock
   ];
 
   pythonImportsCheck = [
@@ -43,6 +45,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Google Cloud Data Catalog API API client library";
     homepage = "https://github.com/googleapis/python-datacatalog";
+    changelog = "https://github.com/googleapis/python-datacatalog/blob/v${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ SuperSandro2000 ];
   };
diff --git a/pkgs/development/python-modules/google-cloud-dataproc/default.nix b/pkgs/development/python-modules/google-cloud-dataproc/default.nix
index 7e75978a3510a..7d11b2b3c1c43 100644
--- a/pkgs/development/python-modules/google-cloud-dataproc/default.nix
+++ b/pkgs/development/python-modules/google-cloud-dataproc/default.nix
@@ -5,6 +5,7 @@
 , mock
 , libcst
 , proto-plus
+, protobuf
 , pytestCheckHook
 , pytest-asyncio
 , pythonOlder
@@ -26,7 +27,8 @@ buildPythonPackage rec {
     google-api-core
     libcst
     proto-plus
-  ];
+    protobuf
+  ] ++ google-api-core.optional-dependencies.grpc;
 
   checkInputs = [
     mock
@@ -35,7 +37,7 @@ buildPythonPackage rec {
   ];
 
   disabledTests = [
-    # requires credentials
+    # Test requires credentials
     "test_list_clusters"
   ];
 
@@ -47,6 +49,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Google Cloud Dataproc API client library";
     homepage = "https://github.com/googleapis/python-dataproc";
+    changelog = "https://github.com/googleapis/python-dataproc/blob/v${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ SuperSandro2000 ];
   };
diff --git a/pkgs/development/python-modules/google-cloud-datastore/default.nix b/pkgs/development/python-modules/google-cloud-datastore/default.nix
index a950f09050c6d..72b9d4efb80e7 100644
--- a/pkgs/development/python-modules/google-cloud-datastore/default.nix
+++ b/pkgs/development/python-modules/google-cloud-datastore/default.nix
@@ -3,12 +3,13 @@
 , fetchPypi
 , google-api-core
 , google-cloud-core
+, google-cloud-testutils
 , libcst
-, proto-plus
 , mock
-, pytestCheckHook
+, proto-plus
+, protobuf
 , pytest-asyncio
-, google-cloud-testutils
+, pytestCheckHook
 , pythonOlder
 }:
 
@@ -28,7 +29,8 @@ buildPythonPackage rec {
     google-api-core
     google-cloud-core
     proto-plus
-  ];
+    protobuf
+  ] ++ google-api-core.optional-dependencies.grpc;
 
   passthru.optional-dependencies = {
     libcst = [
@@ -66,6 +68,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Google Cloud Datastore API client library";
     homepage = "https://github.com/googleapis/python-datastore";
+    changelog = "https://github.com/googleapis/python-datastore/blob/v${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ SuperSandro2000 ];
   };
diff --git a/pkgs/development/python-modules/google-cloud-dlp/default.nix b/pkgs/development/python-modules/google-cloud-dlp/default.nix
index 331b6d8adb7b2..dfa8c22c5cb4f 100644
--- a/pkgs/development/python-modules/google-cloud-dlp/default.nix
+++ b/pkgs/development/python-modules/google-cloud-dlp/default.nix
@@ -3,33 +3,31 @@
 , fetchPypi
 , google-api-core
 , google-cloud-testutils
-, libcst
+, mock
 , proto-plus
-, pytestCheckHook
+, protobuf
 , pytest-asyncio
-, pytz
-, mock
+, pytestCheckHook
 , pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "google-cloud-dlp";
-  version = "3.9.2";
+  version = "3.10.0";
   format = "setuptools";
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-yoiHO4/dhFDGZJB+WiouyBtbTQWIecwaIvR+qw8MGBU=";
+    hash = "sha256-0/bTCi1BhTrM8VJLuFZ9gZc0uwZqpAhcwoPt25flvkI=";
   };
 
   propagatedBuildInputs = [
     google-api-core
-    libcst
     proto-plus
-    pytz
-  ];
+    protobuf
+  ] ++ google-api-core.optional-dependencies.grpc;
 
   checkInputs = [
     google-cloud-testutils
@@ -39,7 +37,7 @@ buildPythonPackage rec {
   ];
 
   disabledTests = [
-    # requires credentials
+    # Test requires credentials
     "test_inspect_content"
   ];
 
@@ -51,6 +49,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Cloud Data Loss Prevention (DLP) API API client library";
     homepage = "https://github.com/googleapis/python-dlp";
+    changelog = "https://github.com/googleapis/python-dlp/blob/v${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ SuperSandro2000 ];
   };
diff --git a/pkgs/development/python-modules/google-cloud-dns/default.nix b/pkgs/development/python-modules/google-cloud-dns/default.nix
index 00bedca7c4cab..f95995aec56bd 100644
--- a/pkgs/development/python-modules/google-cloud-dns/default.nix
+++ b/pkgs/development/python-modules/google-cloud-dns/default.nix
@@ -3,22 +3,32 @@
 , fetchPypi
 , google-api-core
 , google-cloud-core
-, pytestCheckHook
 , mock
+, pytestCheckHook
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "google-cloud-dns";
   version = "0.34.1";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-RPpi7pPFHGxXIWBY2S0qkRa3E6SocanRajqDuZ4wwfk=";
+    hash = "sha256-RPpi7pPFHGxXIWBY2S0qkRa3E6SocanRajqDuZ4wwfk=";
   };
 
-  propagatedBuildInputs = [ google-api-core google-cloud-core ];
+  propagatedBuildInputs = [
+    google-api-core
+    google-cloud-core
+  ];
 
-  checkInputs = [ mock pytestCheckHook ];
+  checkInputs = [
+    mock
+    pytestCheckHook
+  ];
 
   preCheck = ''
     # don#t shadow python imports
@@ -30,11 +40,14 @@ buildPythonPackage rec {
     "test_quota"
   ];
 
-  pythonImportsCheck = [ "google.cloud.dns" ];
+  pythonImportsCheck = [
+    "google.cloud.dns"
+  ];
 
   meta = with lib; {
     description = "Google Cloud DNS API client library";
     homepage = "https://github.com/googleapis/python-dns";
+    changelog = "https://github.com/googleapis/python-dns/blob/v${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ SuperSandro2000 ];
   };
diff --git a/pkgs/development/python-modules/google-cloud-error-reporting/default.nix b/pkgs/development/python-modules/google-cloud-error-reporting/default.nix
index 5ec7903b9e2df..8a7b7eaf6af50 100644
--- a/pkgs/development/python-modules/google-cloud-error-reporting/default.nix
+++ b/pkgs/development/python-modules/google-cloud-error-reporting/default.nix
@@ -1,33 +1,35 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, pytestCheckHook
+, google-api-core
 , google-cloud-logging
 , google-cloud-testutils
-, libcst
 , mock
 , proto-plus
+, protobuf
 , pytest-asyncio
+, pytestCheckHook
 , pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "google-cloud-error-reporting";
-  version = "1.6.3";
+  version = "1.7.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-7QR4NS98MtJ8aMLC+qQeTrK1Rv5kw6XlZhSKbatrZFY=";
+    hash = "sha256-biI1dbn7lpD1KUGkOV5NMLJlYxZTfH+zW6i65fbJWko=";
   };
 
   propagatedBuildInputs = [
+    google-api-core
     google-cloud-logging
-    libcst
     proto-plus
-  ];
+    protobuf
+  ] ++ google-api-core.optional-dependencies.grpc;
 
   checkInputs = [
     google-cloud-testutils
@@ -37,7 +39,7 @@ buildPythonPackage rec {
   ];
 
   disabledTests = [
-    # require credentials
+    # Tests require credentials
     "test_report_error_event"
     "test_report_exception"
   ];
@@ -50,6 +52,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Stackdriver Error Reporting API client library";
     homepage = "https://github.com/googleapis/python-error-reporting";
+    changelog = "https://github.com/googleapis/python-error-reporting/blob/v${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ SuperSandro2000 ];
   };
diff --git a/pkgs/development/python-modules/google-cloud-firestore/default.nix b/pkgs/development/python-modules/google-cloud-firestore/default.nix
index 5abd123f8f1aa..dfd31c499bbd1 100644
--- a/pkgs/development/python-modules/google-cloud-firestore/default.nix
+++ b/pkgs/development/python-modules/google-cloud-firestore/default.nix
@@ -1,37 +1,43 @@
 { lib
+, aiounittest
 , buildPythonPackage
 , fetchPypi
-, aiounittest
 , google-api-core
-, google-cloud-testutils
 , google-cloud-core
+, google-cloud-testutils
 , mock
 , proto-plus
-, pytestCheckHook
+, protobuf
 , pytest-asyncio
+, pytestCheckHook
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "google-cloud-firestore";
-  version = "2.7.2";
+  version = "2.7.3";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-yGB6dLcRxEuqPYGEbpOI5DInos/1ILWmzeXN+ck/W+g=";
+    hash = "sha256-rH2aIst5XHEq93FXxlfDreROIWnM8pmq2UOOg9T2kjU=";
   };
 
   propagatedBuildInputs = [
     google-api-core
     google-cloud-core
     proto-plus
-  ];
+    protobuf
+  ] ++ google-api-core.optional-dependencies.grpc;
 
   checkInputs = [
     aiounittest
     google-cloud-testutils
     mock
-    pytestCheckHook
     pytest-asyncio
+    pytestCheckHook
   ];
 
   preCheck = ''
@@ -60,6 +66,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Google Cloud Firestore API client library";
     homepage = "https://github.com/googleapis/python-firestore";
+    changelog = "https://github.com/googleapis/python-firestore/blob/v${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ SuperSandro2000 ];
   };
diff --git a/pkgs/development/python-modules/google-cloud-iam-logging/default.nix b/pkgs/development/python-modules/google-cloud-iam-logging/default.nix
index 601d213892e22..4bf47d5a82be4 100644
--- a/pkgs/development/python-modules/google-cloud-iam-logging/default.nix
+++ b/pkgs/development/python-modules/google-cloud-iam-logging/default.nix
@@ -5,6 +5,7 @@
 , grpc-google-iam-v1
 , mock
 , proto-plus
+, protobuf
 , pytest-asyncio
 , pytestCheckHook
 , pythonOlder
@@ -12,21 +13,22 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-iam-logging";
-  version = "1.0.6";
+  version = "1.1.0";
   format = "setuptools";
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-XiuEki6bNKZ8CzfcBBjnDbAh2yEADZohpP991OTf2DI=";
+    hash = "sha256-q+R8l14wD0PNxP1xKwZcXlbyln3uwoscAsOvletuetg=";
   };
 
   propagatedBuildInputs = [
     google-api-core
     grpc-google-iam-v1
     proto-plus
-  ];
+    protobuf
+  ] ++ google-api-core.optional-dependencies.grpc;
 
   checkInputs = [
     mock
@@ -42,6 +44,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "IAM Service Logging client library";
     homepage = "https://github.com/googleapis/python-iam-logging";
+    changelog = "https://github.com/googleapis/python-iam-logging/blob/v${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/google-cloud-iam/default.nix b/pkgs/development/python-modules/google-cloud-iam/default.nix
index 21ca4ff099fec..b415a5015e689 100644
--- a/pkgs/development/python-modules/google-cloud-iam/default.nix
+++ b/pkgs/development/python-modules/google-cloud-iam/default.nix
@@ -1,28 +1,38 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, pytestCheckHook
-, pythonOlder
 , google-api-core
 , libcst
 , mock
 , proto-plus
 , pytest-asyncio
+, pytestCheckHook
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "google-cloud-iam";
-  version = "2.9.0";
+  version = "2.10.0";
+  format = "setuptools";
+
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-/FPuPDJC+AuRNCtKv7pFrpsOlopPFEV/KggDWulRU8A=";
+    hash = "sha256-8q/Am7x5LFN9Uaw37QdUdwL19J1FgxRKjRL0Vrc+1TI=";
   };
 
-  propagatedBuildInputs = [ google-api-core libcst proto-plus ];
+  propagatedBuildInputs = [
+    google-api-core
+    libcst
+    proto-plus
+  ] ++ google-api-core.optional-dependencies.grpc;
 
-  checkInputs = [ mock pytestCheckHook pytest-asyncio ];
+  checkInputs = [
+    mock
+    pytest-asyncio
+    pytestCheckHook
+  ];
 
   pythonImportsCheck = [
     "google.cloud.iam_credentials"
@@ -32,6 +42,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "IAM Service Account Credentials API client library";
     homepage = "https://github.com/googleapis/python-iam";
+    changelog = "https://github.com/googleapis/python-iam/releases/tag/v${version}";
     license = licenses.asl20;
     maintainers = with maintainers; [ austinbutler SuperSandro2000 ];
   };
diff --git a/pkgs/development/python-modules/google-cloud-iot/default.nix b/pkgs/development/python-modules/google-cloud-iot/default.nix
index bd902197416a6..4cbfcbe42423f 100644
--- a/pkgs/development/python-modules/google-cloud-iot/default.nix
+++ b/pkgs/development/python-modules/google-cloud-iot/default.nix
@@ -1,39 +1,41 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, grpc-google-iam-v1
 , google-api-core
+, grpc-google-iam-v1
 , libcst
+, mock
 , proto-plus
-, pytestCheckHook
+, protobuf
 , pytest-asyncio
+, pytestCheckHook
 , pythonOlder
-, mock
 }:
 
 buildPythonPackage rec {
   pname = "google-cloud-iot";
-  version = "2.6.4";
+  version = "2.7.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-d3RRVqgetOS3sAT6UkV5DB/NZMjeZd5tBtd9ME8Wvs4=";
+    hash = "sha256-vV5emuGcFwUctnPNRW1NSFej599Lc6rFSKAlaaCatZw=";
   };
 
   propagatedBuildInputs = [
-    grpc-google-iam-v1
     google-api-core
+    grpc-google-iam-v1
     libcst
     proto-plus
-  ];
+    protobuf
+  ] ++ google-api-core.optional-dependencies.grpc;
 
   checkInputs = [
     mock
-    pytestCheckHook
     pytest-asyncio
+    pytestCheckHook
   ];
 
   disabledTests = [
@@ -49,6 +51,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Cloud IoT API API client library";
     homepage = "https://github.com/googleapis/python-iot";
+    changelog = "https://github.com/googleapis/python-iot/blob/v${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ SuperSandro2000 ];
   };
diff --git a/pkgs/development/python-modules/google-cloud-kms/default.nix b/pkgs/development/python-modules/google-cloud-kms/default.nix
index 0173f38c184c0..0f99cf3433ca5 100644
--- a/pkgs/development/python-modules/google-cloud-kms/default.nix
+++ b/pkgs/development/python-modules/google-cloud-kms/default.nix
@@ -1,30 +1,45 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, pytestCheckHook
-, grpc-google-iam-v1
 , google-api-core
-, libcst
+, grpc-google-iam-v1
 , mock
 , proto-plus
+, protobuf
 , pytest-asyncio
+, pytestCheckHook
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "google-cloud-kms";
-  version = "2.12.3";
+  version = "2.13.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-ooWxYH4B8HY9ybWj0GQqUnfiFXzLCqyXGGZsocV9Od0=";
+    hash = "sha256-0nOQnibi1T0JW9NQaKSrNCnfB5EgsnNYMVCEiUsPRdU=";
   };
 
-  propagatedBuildInputs = [ grpc-google-iam-v1 google-api-core libcst proto-plus ];
+  propagatedBuildInputs = [
+    grpc-google-iam-v1
+    google-api-core
+    proto-plus
+    protobuf
+  ] ++ google-api-core.optional-dependencies.grpc;
 
-  checkInputs = [ mock pytestCheckHook pytest-asyncio ];
+  checkInputs = [
+    mock
+    pytest-asyncio
+    pytestCheckHook
+  ];
 
   # Disable tests that need credentials
-  disabledTests = [ "test_list_global_key_rings" ];
+  disabledTests = [
+    "test_list_global_key_rings"
+  ];
 
   pythonImportsCheck = [
     "google.cloud.kms"
@@ -34,6 +49,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Cloud Key Management Service (KMS) API API client library";
     homepage = "https://github.com/googleapis/python-kms";
+    changelog = "https://github.com/googleapis/python-kms/blob/v${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ SuperSandro2000 ];
   };
diff --git a/pkgs/development/python-modules/google-cloud-language/default.nix b/pkgs/development/python-modules/google-cloud-language/default.nix
index 84b2c14ee7005..21db9ecf9dfbe 100644
--- a/pkgs/development/python-modules/google-cloud-language/default.nix
+++ b/pkgs/development/python-modules/google-cloud-language/default.nix
@@ -2,34 +2,32 @@
 , buildPythonPackage
 , fetchPypi
 , google-api-core
-, libcst
-, mock
 , proto-plus
-, pytestCheckHook
+, protobuf
 , pytest-asyncio
+, pytestCheckHook
 , pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "google-cloud-language";
-  version = "2.6.1";
+  version = "2.7.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-KAZmikDsTmNarRo9fxrTR5EtGfSYm1i4rP1iX8pa6Zo=";
+    hash = "sha256-2BVkbQt6y9WGLjFBCt4pXPtGcmcsF8FxThOUIu7CgR8=";
   };
 
   propagatedBuildInputs = [
     google-api-core
-    libcst
     proto-plus
-  ];
+    protobuf
+  ] ++ google-api-core.optional-dependencies.grpc;
 
   checkInputs = [
-    mock
     pytestCheckHook
     pytest-asyncio
   ];
@@ -43,6 +41,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Google Cloud Natural Language API client library";
     homepage = "https://github.com/googleapis/python-language";
+    changelog = "https://github.com/googleapis/python-language/blob/v${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ SuperSandro2000 ];
   };
diff --git a/pkgs/development/python-modules/google-cloud-logging/default.nix b/pkgs/development/python-modules/google-cloud-logging/default.nix
index 2fb93c8a73d1b..7a6e2cfcaf27a 100644
--- a/pkgs/development/python-modules/google-cloud-logging/default.nix
+++ b/pkgs/development/python-modules/google-cloud-logging/default.nix
@@ -1,32 +1,34 @@
 { lib
 , buildPythonPackage
-, fetchPypi
 , django
+, fetchPypi
 , flask
 , google-api-core
 , google-cloud-appengine-logging
 , google-cloud-audit-log
 , google-cloud-core
 , google-cloud-testutils
+, grpc-google-iam-v1
 , mock
 , pandas
 , proto-plus
-, pytestCheckHook
+, protobuf
 , pytest-asyncio
+, pytestCheckHook
 , pythonOlder
 , rich
 }:
 
 buildPythonPackage rec {
   pname = "google-cloud-logging";
-  version = "3.3.1";
+  version = "3.4.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-bxFBWi6cx7TeeofMP59XVRX9aDpCP2N5lAkUpWYW1wU=";
+    hash = "sha256-zeD1n625F0aHRiUrr0sR6gD21obvAhORg+r5IfOu5rQ=";
   };
 
   propagatedBuildInputs = [
@@ -34,8 +36,10 @@ buildPythonPackage rec {
     google-cloud-appengine-logging
     google-cloud-audit-log
     google-cloud-core
+    grpc-google-iam-v1
     proto-plus
-  ];
+    protobuf
+  ] ++ google-api-core.optional-dependencies.grpc;
 
   checkInputs = [
     django
@@ -56,10 +60,16 @@ buildPythonPackage rec {
   preCheck = ''
     # prevent google directory from shadowing google imports
     rm -r google
-    # requires credentials
-    rm tests/system/test_system.py tests/unit/test__gapic.py
   '';
 
+  disabledTestPaths = [
+    # Tests require credentials
+    "tests/system/test_system.py"
+    "tests/unit/test__gapic.py"
+    # Exclude performance tests
+    "tests/performance/test_performance.py"
+  ];
+
   pythonImportsCheck = [
     "google.cloud.logging"
     "google.cloud.logging_v2"
diff --git a/pkgs/development/python-modules/google-cloud-monitoring/default.nix b/pkgs/development/python-modules/google-cloud-monitoring/default.nix
index 935d82a410a24..f4e381ace9df7 100644
--- a/pkgs/development/python-modules/google-cloud-monitoring/default.nix
+++ b/pkgs/development/python-modules/google-cloud-monitoring/default.nix
@@ -3,12 +3,12 @@
 , fetchPypi
 , google-api-core
 , google-cloud-testutils
-, libcst
+, mock
 , proto-plus
 , pandas
 , pytestCheckHook
 , pytest-asyncio
-, mock
+, protobuf
 , pythonOlder
 }:
 
@@ -25,18 +25,23 @@ buildPythonPackage rec {
   };
 
   propagatedBuildInputs = [
-    libcst
     google-api-core
     proto-plus
-  ];
+    protobuf
+  ] ++ google-api-core.optional-dependencies.grpc;
+
+  passthru.optional-dependencies = {
+    pandas = [
+      pandas
+    ];
+  };
 
   checkInputs = [
     google-cloud-testutils
     mock
-    pandas
     pytestCheckHook
     pytest-asyncio
-  ];
+  ] ++ passthru.optional-dependencies.pandas;
 
   disabledTests = [
     # requires credentials
@@ -51,6 +56,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Stackdriver Monitoring API client library";
     homepage = "https://github.com/googleapis/python-monitoring";
+    changelog = "https://github.com/googleapis/python-monitoring/blob/v${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ SuperSandro2000 ];
   };
diff --git a/pkgs/development/python-modules/google-cloud-org-policy/default.nix b/pkgs/development/python-modules/google-cloud-org-policy/default.nix
index 8c3f2f683e706..8f708fc652138 100644
--- a/pkgs/development/python-modules/google-cloud-org-policy/default.nix
+++ b/pkgs/development/python-modules/google-cloud-org-policy/default.nix
@@ -1,26 +1,50 @@
-{ lib, buildPythonPackage, fetchPypi, pytestCheckHook, google-api-core, mock, proto-plus, protobuf, pytest-asyncio }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+, google-api-core
+, proto-plus
+, protobuf
+, pytest-asyncio
+, pytestCheckHook
+, pythonOlder
+}:
 
 buildPythonPackage rec {
   pname = "google-cloud-org-policy";
-  version = "1.4.1";
+  version = "1.5.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-KYZvlpPqGy0zGDSZF3y6MsFZyb9M+88HGYp4NpPCiSY=";
+    hash = "sha256-fA8O/pdUNgY3dwj17D7aoHUjzaXpMmL3w0TU6A6gqHo=";
   };
 
-  propagatedBuildInputs = [ google-api-core proto-plus ];
+  propagatedBuildInputs = [
+    google-api-core
+    proto-plus
+    protobuf
+  ] ++ google-api-core.optional-dependencies.grpc;
+
+  checkInputs = [
+    pytest-asyncio
+    pytestCheckHook
+  ];
 
-  # prevent google directory from shadowing google imports
+  # Prevent google directory from shadowing google imports
   preCheck = ''
     rm -r google
   '';
-  checkInputs = [ mock protobuf pytest-asyncio pytestCheckHook ];
-  pythonImportsCheck = [ "google.cloud.orgpolicy" ];
+
+  pythonImportsCheck = [
+    "google.cloud.orgpolicy"
+  ];
 
   meta = with lib; {
-    description = "Protobufs for Google Cloud Organization Policy.";
+    description = "Protobufs for Google Cloud Organization Policy";
     homepage = "https://github.com/googleapis/python-org-policy";
+    changelog = "https://github.com/googleapis/python-org-policy/blob/v${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ austinbutler SuperSandro2000 ];
   };
diff --git a/pkgs/development/python-modules/google-cloud-os-config/default.nix b/pkgs/development/python-modules/google-cloud-os-config/default.nix
index 18f7dafae7a5d..d6733d4d93192 100644
--- a/pkgs/development/python-modules/google-cloud-os-config/default.nix
+++ b/pkgs/development/python-modules/google-cloud-os-config/default.nix
@@ -2,8 +2,7 @@
 , buildPythonPackage
 , fetchPypi
 , google-api-core
-, libcst
-, mock
+, protobuf
 , proto-plus
 , pytestCheckHook
 , pytest-asyncio
@@ -12,26 +11,25 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-os-config";
-  version = "1.12.4";
+  version = "1.13.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-SmzCo/nh6FbTt+7lw4XAyF5gwDHQCOz8Nbl05/AkDfY=";
+    hash = "sha256-CHAiHhXjrLMz7On7Gm5H4fIY3Sq8R2whsI9+D9xXDIM=";
   };
 
   propagatedBuildInputs = [
     google-api-core
-    libcst
     proto-plus
-  ];
+    protobuf
+  ] ++ google-api-core.optional-dependencies.grpc;
 
   checkInputs = [
-    mock
-    pytestCheckHook
     pytest-asyncio
+    pytestCheckHook
   ];
 
   pythonImportsCheck = [
@@ -46,6 +44,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Google Cloud OS Config API client library";
     homepage = "https://github.com/googleapis/python-os-config";
+    changelog = "https://github.com/googleapis/python-os-config/blob/v${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ SuperSandro2000 ];
   };
diff --git a/pkgs/development/python-modules/google-cloud-pubsub/default.nix b/pkgs/development/python-modules/google-cloud-pubsub/default.nix
index 29ddb25013913..83e17cd096b1c 100644
--- a/pkgs/development/python-modules/google-cloud-pubsub/default.nix
+++ b/pkgs/development/python-modules/google-cloud-pubsub/default.nix
@@ -1,15 +1,16 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, pytestCheckHook
 , google-api-core
 , google-cloud-testutils
 , grpc-google-iam-v1
+, grpcio
 , grpcio-status
 , libcst
-, mock
 , proto-plus
+, protobuf
 , pytest-asyncio
+, pytestCheckHook
 , pythonOlder
 }:
 
@@ -26,16 +27,23 @@ buildPythonPackage rec {
   };
 
   propagatedBuildInputs = [
-    grpc-google-iam-v1
     google-api-core
+    grpc-google-iam-v1
+    grpcio
     grpcio-status
     libcst
     proto-plus
-  ];
+    protobuf
+  ] ++ google-api-core.optional-dependencies.grpc;
+
+  passthru.optional-dependencies = {
+    libcst = [
+      libcst
+    ];
+  };
 
   checkInputs = [
     google-cloud-testutils
-    mock
     pytestCheckHook
     pytest-asyncio
   ];
@@ -56,7 +64,8 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "Google Cloud Pub/Sub API client library";
-    homepage = "https://pypi.org/project/google-cloud-pubsub";
+    homepage = "https://github.com/googleapis/python-pubsub";
+    changelog = "https://github.com/googleapis/python-pubsub/blob/v${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ SuperSandro2000 ];
   };
diff --git a/pkgs/development/python-modules/google-cloud-redis/default.nix b/pkgs/development/python-modules/google-cloud-redis/default.nix
index 96b20dcc26074..96589bece702e 100644
--- a/pkgs/development/python-modules/google-cloud-redis/default.nix
+++ b/pkgs/development/python-modules/google-cloud-redis/default.nix
@@ -2,34 +2,32 @@
 , buildPythonPackage
 , fetchPypi
 , google-api-core
-, libcst
-, mock
 , proto-plus
-, pytestCheckHook
+, protobuf
 , pytest-asyncio
+, pytestCheckHook
 , pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "google-cloud-redis";
-  version = "2.9.3";
+  version = "2.10.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-81RPV8GaSU0jpYTyjFWxakpbuBz994eA7I/wyTxmg8Y=";
+    hash = "sha256-byppjhrBLentcRwMSbuaf3L7wU+rkP2Z92j2zzEPdY0=";
   };
 
   propagatedBuildInputs = [
     google-api-core
-    libcst
     proto-plus
-  ];
+    protobuf
+  ] ++ google-api-core.optional-dependencies.grpc;
 
   checkInputs = [
-    mock
     pytestCheckHook
     pytest-asyncio
   ];
@@ -43,6 +41,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Google Cloud Memorystore for Redis API client library";
     homepage = "https://github.com/googleapis/python-redis";
+    changelog = "https://github.com/googleapis/python-redis/blob/v${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ SuperSandro2000 ];
   };
diff --git a/pkgs/development/python-modules/google-cloud-resource-manager/default.nix b/pkgs/development/python-modules/google-cloud-resource-manager/default.nix
index 7291702a83d34..2237a468f004e 100644
--- a/pkgs/development/python-modules/google-cloud-resource-manager/default.nix
+++ b/pkgs/development/python-modules/google-cloud-resource-manager/default.nix
@@ -1,25 +1,26 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, pytestCheckHook
-, google-cloud-core
 , google-api-core
+, google-cloud-core
 , grpc-google-iam-v1
 , proto-plus
-, mock
+, protobuf
+, pytest-asyncio
+, pytestCheckHook
 , pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "google-cloud-resource-manager";
-  version = "1.6.3";
+  version = "1.7.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-bPipp05loDhXiWlnx5MHt1gFx1Kt47xBIk5hZ3dLyck=";
+    hash = "sha256-n66Yl3xSGJNxyn2LJVGO8fuXtCKFHLRcCeoWhvxCCok=";
   };
 
   propagatedBuildInputs = [
@@ -27,10 +28,11 @@ buildPythonPackage rec {
     google-cloud-core
     grpc-google-iam-v1
     proto-plus
-  ];
+    protobuf
+  ] ++ google-api-core.optional-dependencies.grpc;
 
   checkInputs = [
-    mock
+    pytest-asyncio
     pytestCheckHook
   ];
 
@@ -47,6 +49,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Google Cloud Resource Manager API client library";
     homepage = "https://github.com/googleapis/python-resource-manager";
+    changelog = "https://github.com/googleapis/python-resource-manager/blob/v${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ SuperSandro2000 ];
   };
diff --git a/pkgs/development/python-modules/google-cloud-runtimeconfig/default.nix b/pkgs/development/python-modules/google-cloud-runtimeconfig/default.nix
index 3b435ac5adac4..15e80892d9cb2 100644
--- a/pkgs/development/python-modules/google-cloud-runtimeconfig/default.nix
+++ b/pkgs/development/python-modules/google-cloud-runtimeconfig/default.nix
@@ -5,34 +5,49 @@
 , google-cloud-core
 , mock
 , pytestCheckHook
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "google-cloud-runtimeconfig";
   version = "0.33.2";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-MPmyvm2FSrUzb1y5i4xl5Cqea6sxixLoZ7V1hxNi7hw=";
+    hash = "sha256-MPmyvm2FSrUzb1y5i4xl5Cqea6sxixLoZ7V1hxNi7hw=";
   };
 
-  propagatedBuildInputs = [ google-api-core google-cloud-core ];
+  propagatedBuildInputs = [
+    google-api-core
+    google-cloud-core
+  ];
 
-  checkInputs = [ mock pytestCheckHook ];
+  checkInputs = [
+    mock
+    pytestCheckHook
+  ];
 
   # Client tests require credentials
-  disabledTests = [ "client_options" ];
+  disabledTests = [
+    "client_options"
+  ];
 
   # prevent google directory from shadowing google imports
   preCheck = ''
     rm -r google
   '';
 
-  pythonImportsCheck = [ "google.cloud.runtimeconfig" ];
+  pythonImportsCheck = [
+    "google.cloud.runtimeconfig"
+  ];
 
   meta = with lib; {
     description = "Google Cloud RuntimeConfig API client library";
-    homepage = "https://pypi.org/project/google-cloud-runtimeconfig";
+    homepage = "https://github.com/googleapis/python-runtimeconfig";
+    changelog = "https://github.com/googleapis/python-runtimeconfig/blob/v${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ SuperSandro2000 ];
   };
diff --git a/pkgs/development/python-modules/google-cloud-secret-manager/default.nix b/pkgs/development/python-modules/google-cloud-secret-manager/default.nix
index f8a0e4053d8e5..1c2bc12ae3711 100644
--- a/pkgs/development/python-modules/google-cloud-secret-manager/default.nix
+++ b/pkgs/development/python-modules/google-cloud-secret-manager/default.nix
@@ -3,37 +3,35 @@
 , fetchPypi
 , google-api-core
 , grpc-google-iam-v1
-, libcst
-, mock
 , proto-plus
-, pytestCheckHook
+, protobuf
 , pytest-asyncio
+, pytestCheckHook
 , pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "google-cloud-secret-manager";
-  version = "2.12.6";
+  version = "2.13.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-equimX9D+MOzWQPvxUw4moAvOYU7qB6B4RkPCTQg7PY=";
+    hash = "sha256-1BBOEdkh0jVBHtSVEnOsXtaCPF/GuXB90FCZeOmue9I=";
   };
 
   propagatedBuildInputs = [
     google-api-core
     grpc-google-iam-v1
-    libcst
     proto-plus
-  ];
+    protobuf
+  ] ++ google-api-core.optional-dependencies.grpc;
 
   checkInputs = [
-    mock
-    pytestCheckHook
     pytest-asyncio
+    pytestCheckHook
   ];
 
   pythonImportsCheck = [
@@ -45,6 +43,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Secret Manager API API client library";
     homepage = "https://github.com/googleapis/python-secret-manager";
+    changelog = "https://github.com/googleapis/python-secret-manager/blob/v${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ siriobalmelli SuperSandro2000 ];
   };
diff --git a/pkgs/development/python-modules/google-cloud-securitycenter/default.nix b/pkgs/development/python-modules/google-cloud-securitycenter/default.nix
index bdf3aca4653a8..504c86e49926d 100644
--- a/pkgs/development/python-modules/google-cloud-securitycenter/default.nix
+++ b/pkgs/development/python-modules/google-cloud-securitycenter/default.nix
@@ -1,37 +1,35 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, grpc-google-iam-v1
 , google-api-core
-, libcst
-, mock
+, grpc-google-iam-v1
 , proto-plus
-, pytestCheckHook
+, protobuf
 , pytest-asyncio
+, pytestCheckHook
 , pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "google-cloud-securitycenter";
-  version = "1.16.2";
+  version = "1.17.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-DU+0gpnWqmtm5nkLoHbEq5k3pnybsEag+aKEp7+HFmo=";
+    hash = "sha256-wkq0/LEgEQokKzREpOkprKZUK/paP8CgS51anLTy5Dk=";
   };
 
   propagatedBuildInputs = [
     grpc-google-iam-v1
     google-api-core
-    libcst
     proto-plus
-  ];
+    protobuf
+  ] ++ google-api-core.optional-dependencies.grpc;
 
   checkInputs = [
-    mock
     pytestCheckHook
     pytest-asyncio
   ];
@@ -46,6 +44,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Cloud Security Command Center API API client library";
     homepage = "https://github.com/googleapis/python-securitycenter";
+    changelog = "https://github.com/googleapis/python-securitycenter/blob/v${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ SuperSandro2000 ];
   };
diff --git a/pkgs/development/python-modules/google-cloud-spanner/default.nix b/pkgs/development/python-modules/google-cloud-spanner/default.nix
index e5e32526a1cbb..0efc0a07d9f87 100644
--- a/pkgs/development/python-modules/google-cloud-spanner/default.nix
+++ b/pkgs/development/python-modules/google-cloud-spanner/default.nix
@@ -1,16 +1,18 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, grpc-google-iam-v1
+, google-api-core
 , google-cloud-core
 , google-cloud-testutils
+, grpc-google-iam-v1
 , libcst
 , mock
 , proto-plus
-, pytestCheckHook
+, protobuf
 , pytest-asyncio
-, sqlparse
+, pytestCheckHook
 , pythonOlder
+, sqlparse
 }:
 
 buildPythonPackage rec {
@@ -26,18 +28,25 @@ buildPythonPackage rec {
   };
 
   propagatedBuildInputs = [
+    google-api-core
     google-cloud-core
     grpc-google-iam-v1
-    libcst
     proto-plus
+    protobuf
     sqlparse
-  ];
+  ] ++ google-api-core.optional-dependencies.grpc;
+
+  passthru.optional-dependencies = {
+    libcst = [
+      libcst
+    ];
+  };
 
   checkInputs = [
     google-cloud-testutils
     mock
-    pytestCheckHook
     pytest-asyncio
+    pytestCheckHook
   ];
 
   preCheck = ''
diff --git a/pkgs/development/python-modules/google-cloud-speech/default.nix b/pkgs/development/python-modules/google-cloud-speech/default.nix
index a0e68cdff34f1..0bc05828dd191 100644
--- a/pkgs/development/python-modules/google-cloud-speech/default.nix
+++ b/pkgs/development/python-modules/google-cloud-speech/default.nix
@@ -2,11 +2,11 @@
 , buildPythonPackage
 , fetchPypi
 , google-api-core
-, libcst
 , mock
 , proto-plus
-, pytestCheckHook
+, protobuf
 , pytest-asyncio
+, pytestCheckHook
 , pythonOlder
 , setuptools
 }:
@@ -24,16 +24,16 @@ buildPythonPackage rec {
   };
 
   propagatedBuildInputs = [
-    libcst
     google-api-core
     proto-plus
+    protobuf
     setuptools
-  ];
+  ] ++ google-api-core.optional-dependencies.grpc;
 
   checkInputs = [
     mock
-    pytestCheckHook
     pytest-asyncio
+    pytestCheckHook
   ];
 
   disabledTestPaths = [
@@ -51,6 +51,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Google Cloud Speech API client library";
     homepage = "https://github.com/googleapis/python-speech";
+    changelog = "https://github.com/googleapis/python-speech/blob/v${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ SuperSandro2000 ];
   };
diff --git a/pkgs/development/python-modules/google-cloud-storage/default.nix b/pkgs/development/python-modules/google-cloud-storage/default.nix
index 84f489a220b6b..541997fb72f0a 100644
--- a/pkgs/development/python-modules/google-cloud-storage/default.nix
+++ b/pkgs/development/python-modules/google-cloud-storage/default.nix
@@ -1,35 +1,44 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, pytestCheckHook
 , google-auth
-, google-cloud-iam
 , google-cloud-core
+, google-cloud-iam
 , google-cloud-kms
 , google-cloud-testutils
 , google-resumable-media
 , mock
+, protobuf
+, pytestCheckHook
 , pythonOlder
+, requests
 }:
 
 buildPythonPackage rec {
   pname = "google-cloud-storage";
-  version = "2.5.0";
+  version = "2.7.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-OC80uR3iIS48LntA7AedJ+4uPbuumbdbG82MYwY84jU=";
+    hash = "sha256-GsLVjS1pPLE0HrxIZZo1J753jZ4tiYlpeidGAlko/xc=";
   };
 
   propagatedBuildInputs = [
     google-auth
     google-cloud-core
     google-resumable-media
+    requests
   ];
 
+  passthru.optional-dependencies = {
+    protobuf = [
+      protobuf
+    ];
+  };
+
   checkInputs = [
     google-cloud-iam
     google-cloud-kms
@@ -38,7 +47,7 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  # disable tests which require credentials and network access
+  # Disable tests which require credentials and network access
   disabledTests = [
     "create"
     "download"
@@ -51,6 +60,7 @@ buildPythonPackage rec {
     "test_list_buckets"
     "test_open"
     "test_anonymous_client_access_to_public_bucket"
+    "test_ctor_w_custom_endpoint_use_auth"
   ];
 
   disabledTestPaths = [
@@ -59,6 +69,7 @@ buildPythonPackage rec {
     "tests/system/test_bucket.py"
     "tests/system/test_fileio.py"
     "tests/system/test_kms_integration.py"
+    "tests/unit/test_transfer_manager.py"
   ];
 
   preCheck = ''
@@ -69,11 +80,14 @@ buildPythonPackage rec {
     rm tests/conformance/test_conformance.py
   '';
 
-  pythonImportsCheck = [ "google.cloud.storage" ];
+  pythonImportsCheck = [
+    "google.cloud.storage"
+  ];
 
   meta = with lib; {
     description = "Google Cloud Storage API client library";
     homepage = "https://github.com/googleapis/python-storage";
+    changelog = "https://github.com/googleapis/python-storage/blob/v${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ SuperSandro2000 ];
   };
diff --git a/pkgs/development/python-modules/google-cloud-tasks/default.nix b/pkgs/development/python-modules/google-cloud-tasks/default.nix
index 8bbaa96f51cee..4e8a51cedde63 100644
--- a/pkgs/development/python-modules/google-cloud-tasks/default.nix
+++ b/pkgs/development/python-modules/google-cloud-tasks/default.nix
@@ -3,9 +3,9 @@
 , fetchPypi
 , google-api-core
 , grpc-google-iam-v1
-, libcst
 , mock
 , proto-plus
+, protobuf
 , pytest-asyncio
 , pytestCheckHook
 , pythonOlder
@@ -13,22 +13,22 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-tasks";
-  version = "2.10.4";
+  version = "2.11.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ZQ9PQ75yWEEQNyfqO8EyJ66euqL5na2q1TiIgxz8HXA=";
+    hash = "sha256-TC2uDnD95NUx1LLLLotZK9tJd6JWZa4MjipcE6k07Mo=";
   };
 
   propagatedBuildInputs = [
     google-api-core
     grpc-google-iam-v1
-    libcst
     proto-plus
-  ];
+    protobuf
+  ] ++ google-api-core.optional-dependencies.grpc;
 
   checkInputs = [
     mock
@@ -37,7 +37,7 @@ buildPythonPackage rec {
   ];
 
   disabledTests = [
-    # requires credentials
+    # Test requires credentials
     "test_list_queues"
   ];
 
@@ -51,6 +51,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Cloud Tasks API API client library";
     homepage = "https://github.com/googleapis/python-tasks";
+    changelog = "https://github.com/googleapis/python-tasks/blob/v${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ SuperSandro2000 ];
   };
diff --git a/pkgs/development/python-modules/google-cloud-testutils/default.nix b/pkgs/development/python-modules/google-cloud-testutils/default.nix
index c2bd3f0a14661..10a2826c5daa4 100644
--- a/pkgs/development/python-modules/google-cloud-testutils/default.nix
+++ b/pkgs/development/python-modules/google-cloud-testutils/default.nix
@@ -1,24 +1,41 @@
-{ lib, buildPythonPackage, fetchPypi, click, google-auth, packaging, six }:
+{ lib
+, buildPythonPackage
+, click
+, fetchPypi
+, google-auth
+, packaging
+, pythonOlder
+}:
 
 buildPythonPackage rec {
   pname = "google-cloud-testutils";
   version = "1.3.3";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
     sha256 = "sha256-bRjvNNmvsBy0sR4C0DoC/n7A9ez6AfXUJrXZiHKkz0g=";
   };
 
-  propagatedBuildInputs = [ click google-auth packaging six ];
+  propagatedBuildInputs = [
+    click
+    google-auth
+    packaging
+  ];
 
   # does not contain tests
   doCheck = false;
 
-  pythonImportsCheck = [ "test_utils" ];
+  pythonImportsCheck = [
+    "test_utils"
+  ];
 
   meta = with lib; {
     description = "System test utilities for google-cloud-python";
     homepage = "https://github.com/googleapis/python-test-utils";
+    changelog  ="https://github.com/googleapis/python-test-utils/blob/v${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ SuperSandro2000 ];
   };
diff --git a/pkgs/development/python-modules/google-cloud-texttospeech/default.nix b/pkgs/development/python-modules/google-cloud-texttospeech/default.nix
index 6920239879fc0..dc808df9df7f5 100644
--- a/pkgs/development/python-modules/google-cloud-texttospeech/default.nix
+++ b/pkgs/development/python-modules/google-cloud-texttospeech/default.nix
@@ -1,32 +1,32 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, pytestCheckHook
 , google-api-core
-, libcst
 , mock
 , proto-plus
+, protobuf
 , pytest-asyncio
+, pytestCheckHook
 , pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "google-cloud-texttospeech";
-  version = "2.12.3";
+  version = "2.13.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-gnSl/W0mTv6It//+xV5ti0Rd6io1Gh4yxd0arrbEPtQ=";
+    hash = "sha256-jpDwERTLRmS1mO2O2OboZa6AAUh3k/Dyg77TCVTqLok=";
   };
 
   propagatedBuildInputs = [
-    libcst
     google-api-core
     proto-plus
-  ];
+    protobuf
+  ] ++ google-api-core.optional-dependencies.grpc;
 
   checkInputs = [
     mock
@@ -49,6 +49,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Google Cloud Text-to-Speech API client library";
     homepage = "https://github.com/googleapis/python-texttospeech";
+    changelog = "https://github.com/googleapis/python-texttospeech/blob/v${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ SuperSandro2000 ];
   };
diff --git a/pkgs/development/python-modules/google-cloud-trace/default.nix b/pkgs/development/python-modules/google-cloud-trace/default.nix
index 0bfe7189c8608..4cc58aa670604 100644
--- a/pkgs/development/python-modules/google-cloud-trace/default.nix
+++ b/pkgs/development/python-modules/google-cloud-trace/default.nix
@@ -2,32 +2,32 @@
 , buildPythonPackage
 , fetchPypi
 , google-api-core
-, google-cloud-core
 , google-cloud-testutils
 , mock
 , proto-plus
-, pytestCheckHook
+, protobuf
 , pytest-asyncio
+, pytestCheckHook
 , pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "google-cloud-trace";
-  version = "1.7.3";
+  version = "1.8.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-HFntFmPn3FPhCrB+nnJlBD9zqG2jDsP2naEl2IxhRqE=";
+    hash = "sha256-dKywvDNcvDOULHREKcHWIBVVBBzrttICX+VgcborJVI=";
   };
 
   propagatedBuildInputs = [
     google-api-core
-    google-cloud-core
     proto-plus
-  ];
+    protobuf
+  ] ++ google-api-core.optional-dependencies.grpc;
 
   checkInputs = [
     google-cloud-testutils
@@ -51,6 +51,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Cloud Trace API client library";
     homepage = "https://github.com/googleapis/python-trace";
+    changelog = "https://github.com/googleapis/python-trace/blob/v${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ SuperSandro2000 ];
   };
diff --git a/pkgs/development/python-modules/google-cloud-translate/default.nix b/pkgs/development/python-modules/google-cloud-translate/default.nix
index 295eb13a240ee..7041f9bf4365a 100644
--- a/pkgs/development/python-modules/google-cloud-translate/default.nix
+++ b/pkgs/development/python-modules/google-cloud-translate/default.nix
@@ -1,35 +1,35 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, pytestCheckHook
 , google-api-core
 , google-cloud-core
 , google-cloud-testutils
-, libcst
 , mock
 , proto-plus
+, protobuf
 , pytest-asyncio
+, pytestCheckHook
 , pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "google-cloud-translate";
-  version = "3.8.4";
+  version = "3.9.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-cptSFyAByZRZ7Dr93skVPeCvUoh0/PMACp3dmOEQfuc=";
+    hash = "sha256-XPfN+IN5gc5KQEXPeaYF5gIlHPxmDoe90RKFqNG6eF8=";
   };
 
   propagatedBuildInputs = [
     google-api-core
     google-cloud-core
-    libcst
     proto-plus
-  ];
+    protobuf
+  ] ++ google-api-core.optional-dependencies.grpc;
 
   checkInputs = [
     google-cloud-testutils
@@ -53,6 +53,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Google Cloud Translation API client library";
     homepage = "https://github.com/googleapis/python-translate";
+    changelog = "https://github.com/googleapis/python-translate/blob/v${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ SuperSandro2000 ];
   };
diff --git a/pkgs/development/python-modules/google-cloud-videointelligence/default.nix b/pkgs/development/python-modules/google-cloud-videointelligence/default.nix
index 0c0d579f7daad..51115b4f006dd 100644
--- a/pkgs/development/python-modules/google-cloud-videointelligence/default.nix
+++ b/pkgs/development/python-modules/google-cloud-videointelligence/default.nix
@@ -1,31 +1,33 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, mock
 , google-api-core
 , google-cloud-testutils
+, mock
 , proto-plus
-, pytestCheckHook
+, protobuf
 , pytest-asyncio
+, pytestCheckHook
 , pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "google-cloud-videointelligence";
-  version = "2.8.3";
+  version = "2.9.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-pB7exeGYpFT4nf3YuIhoI+bqG6YYEP6oWs0tohkOIbw=";
+    hash = "sha256-gd0cJX6XHwQguNJ7jFDUVwQg9eNk0ZUL4VH5L+3K+Lw=";
   };
 
   propagatedBuildInputs = [
     google-api-core
     proto-plus
-  ];
+    protobuf
+  ] ++ google-api-core.optional-dependencies.grpc;
 
   checkInputs = [
     google-cloud-testutils
@@ -51,6 +53,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Google Cloud Video Intelligence API client library";
     homepage = "https://github.com/googleapis/python-videointelligence";
+    changelog = "https://github.com/googleapis/python-videointelligence/blob/v${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ SuperSandro2000 ];
   };
diff --git a/pkgs/development/python-modules/google-cloud-vision/default.nix b/pkgs/development/python-modules/google-cloud-vision/default.nix
index b29dd1cff410e..86a83155f5616 100644
--- a/pkgs/development/python-modules/google-cloud-vision/default.nix
+++ b/pkgs/development/python-modules/google-cloud-vision/default.nix
@@ -2,31 +2,31 @@
 , buildPythonPackage
 , fetchPypi
 , google-api-core
-, libcst
 , mock
 , proto-plus
-, pytestCheckHook
+, protobuf
 , pytest-asyncio
+, pytestCheckHook
 , pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "google-cloud-vision";
-  version = "3.1.4";
+  version = "3.2.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-1nqU9Sr+tWPK3l5r7UiFD0wA3+UmYcHFT4ta2bdRL+U=";
+    hash = "sha256-SZQxkx57cY+8q4Mg880jT8TlYcfwLz4KEpHiyOb2Ujc=";
   };
 
   propagatedBuildInputs = [
-    libcst
     google-api-core
     proto-plus
-  ];
+    protobuf
+  ] ++ google-api-core.optional-dependencies.grpc;
 
   checkInputs = [
     mock
@@ -47,6 +47,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Cloud Vision API API client library";
     homepage = "https://github.com/googleapis/python-vision";
+    changelog = "https://github.com/googleapis/python-vision/blob/v${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ SuperSandro2000 ];
   };
diff --git a/pkgs/development/python-modules/google-cloud-websecurityscanner/default.nix b/pkgs/development/python-modules/google-cloud-websecurityscanner/default.nix
index d35944777fbfd..024a637ce8c17 100644
--- a/pkgs/development/python-modules/google-cloud-websecurityscanner/default.nix
+++ b/pkgs/development/python-modules/google-cloud-websecurityscanner/default.nix
@@ -1,34 +1,32 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, pytestCheckHook
 , google-api-core
-, libcst
 , mock
-, protobuf
 , proto-plus
+, protobuf
 , pytest-asyncio
+, pytestCheckHook
 , pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "google-cloud-websecurityscanner";
-  version = "1.9.2";
+  version = "1.10.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-fUnoV5I9kMwC9zUdsHit6MbIYFV+3E+GT76vwEmzNNs=";
+    hash = "sha256-93ijizxgVFxXzj8IzxrgzzXTQKl7UH3egvL41HVk5is=";
   };
 
   propagatedBuildInputs = [
     google-api-core
-    libcst
-    protobuf
     proto-plus
-  ];
+    protobuf
+  ] ++ google-api-core.optional-dependencies.grpc;
 
   checkInputs = [
     mock
@@ -44,6 +42,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Google Cloud Web Security Scanner API client library";
     homepage = "https://github.com/googleapis/python-websecurityscanner";
+    changelog = "https://github.com/googleapis/python-websecurityscanner/blob/v${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ SuperSandro2000 ];
   };
diff --git a/pkgs/development/python-modules/google-resumable-media/default.nix b/pkgs/development/python-modules/google-resumable-media/default.nix
index 0820ac217f195..b5e4de424b0c5 100644
--- a/pkgs/development/python-modules/google-resumable-media/default.nix
+++ b/pkgs/development/python-modules/google-resumable-media/default.nix
@@ -1,27 +1,49 @@
 { lib
+, aiohttp
 , buildPythonPackage
 , fetchPypi
 , google-auth
 , google-cloud-testutils
 , google-crc32c
 , mock
-, pytestCheckHook
 , pytest-asyncio
+, pytestCheckHook
+, pythonOlder
 , requests
 }:
 
 buildPythonPackage rec {
   pname = "google-resumable-media";
   version = "2.4.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-jVUYUC+SuezISsRneb1PCWlOyzujij58pzeobRXLyh8=";
+    hash = "sha256-jVUYUC+SuezISsRneb1PCWlOyzujij58pzeobRXLyh8=";
   };
 
-  propagatedBuildInputs = [ google-auth google-crc32c requests ];
+  propagatedBuildInputs = [
+    google-auth
+    google-crc32c
+  ];
+
+  passthru.optional-dependencies = {
+    requests = [
+      requests
+    ];
+    aiohttp = [
+      aiohttp
+    ];
+  };
 
-  checkInputs = [ google-cloud-testutils mock pytestCheckHook pytest-asyncio ];
+  checkInputs = [
+    google-cloud-testutils
+    mock
+    pytest-asyncio
+    pytestCheckHook
+  ] ++ passthru.optional-dependencies.requests;
 
   preCheck = ''
     # prevent shadowing imports
@@ -40,6 +62,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Utilities for Google Media Downloads and Resumable Uploads";
     homepage = "https://github.com/GoogleCloudPlatform/google-resumable-media-python";
+    changelog = "https://github.com/googleapis/google-resumable-media-python/blob/v${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ SuperSandro2000 ];
   };
diff --git a/pkgs/development/python-modules/hassil/default.nix b/pkgs/development/python-modules/hassil/default.nix
index bbbe26faccb95..84800b51381a0 100644
--- a/pkgs/development/python-modules/hassil/default.nix
+++ b/pkgs/development/python-modules/hassil/default.nix
@@ -2,6 +2,9 @@
 , buildPythonPackage
 , fetchPypi
 
+# build
+, antlr4
+
 # propagates
 , antlr4-python3-runtime
 , dataclasses-json
@@ -13,7 +16,7 @@
 
 let
   pname = "hassil";
-  version = "0.1.3";
+  version = "0.1.4";
 in
 buildPythonPackage {
   inherit pname version;
@@ -21,11 +24,17 @@ buildPythonPackage {
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-KWkzHWMo50OIrZ2kwFhhqDSleFFkAD7/JugjvSyCkww=";
+    hash = "sha256-ygaPdfH2jBk2xvlgt7V8/VcZAtv6Lwsi8g+stK/DdT8=";
   };
 
+  nativeBuildInputs = [
+    antlr4
+  ];
+
   postPatch = ''
     sed -i 's/antlr4-python3-runtime==.*/antlr4-python3-runtime/' requirements.txt
+    rm hassil/grammar/*.{tokens,interp}
+    antlr -Dlanguage=Python3 -visitor -o hassil/grammar/ *.g4
   '';
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/kiwiki-client/default.nix b/pkgs/development/python-modules/kiwiki-client/default.nix
new file mode 100644
index 0000000000000..22da8a5236e21
--- /dev/null
+++ b/pkgs/development/python-modules/kiwiki-client/default.nix
@@ -0,0 +1,42 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, python-dateutil
+, pythonOlder
+, requests
+}:
+
+buildPythonPackage rec {
+  pname = "kiwiki-client";
+  version = "0.1.2";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "c7h";
+    repo = "kiwiki_client";
+    rev = "refs/tags/${version}";
+    hash = "sha256-CIBed8HzbUqUIzNy1lHxIgjneA6R8uKtmd43LU92M0Q=";
+  };
+
+  propagatedBuildInputs = [
+    python-dateutil
+    requests
+  ];
+
+  # Module has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "kiwiki"
+  ];
+
+  meta = with lib; {
+    description = "Module to interact with the KIWI.KI API";
+    homepage = "https://github.com/c7h/kiwiki_client";
+    changelog = "https://github.com/c7h/kiwiki_client/releases/tag/${version}";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/osc-lib/default.nix b/pkgs/development/python-modules/osc-lib/default.nix
index 9d2a4929a6e77..1e86f11e41472 100644
--- a/pkgs/development/python-modules/osc-lib/default.nix
+++ b/pkgs/development/python-modules/osc-lib/default.nix
@@ -56,7 +56,6 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "osc_lib" ];
 
   meta = with lib; {
-    broken = stdenv.isDarwin;
     description = "OpenStackClient Library";
     homepage = "https://github.com/openstack/osc-lib";
     license = licenses.asl20;
diff --git a/pkgs/development/python-modules/plugwise/default.nix b/pkgs/development/python-modules/plugwise/default.nix
index 5762d03e7042b..e00f5fa9a619e 100644
--- a/pkgs/development/python-modules/plugwise/default.nix
+++ b/pkgs/development/python-modules/plugwise/default.nix
@@ -21,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "plugwise";
-  version = "0.27.0";
+  version = "0.27.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -30,7 +30,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = "python-plugwise";
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-W6aLpm3Z0JQIZcqDu9wH2RFuXfzl0Px61zfIuhm92pk=";
+    hash = "sha256-56KJQBYaQK08o9W6ZLWHCLCVPCLHh5Q+GTZqTTexn90=";
   };
 
   propagatedBuildInputs = [
@@ -63,6 +63,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python module for Plugwise Smiles, Stretch and USB stick";
     homepage = "https://github.com/plugwise/python-plugwise";
+    changelog = "https://github.com/plugwise/python-plugwise/releases/tag/v${version}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/pykaleidescape/default.nix b/pkgs/development/python-modules/pykaleidescape/default.nix
new file mode 100644
index 0000000000000..62d65490ff0aa
--- /dev/null
+++ b/pkgs/development/python-modules/pykaleidescape/default.nix
@@ -0,0 +1,51 @@
+{ lib
+, aiohttp
+, buildPythonPackage
+, dnspython
+, fetchFromGitHub
+, pytest-asyncio
+, pytestCheckHook
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "pykaleidescape";
+  version = "1.0.1";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "SteveEasley";
+    repo = pname;
+    rev = "refs/tags/v${version}";
+    hash = "sha256-KM/gtpsQ27QZz2uI1t/yVN5no0zp9LZag1duAJzK55g=";
+  };
+
+  propagatedBuildInputs = [
+    aiohttp
+    dnspython
+  ];
+
+  checkInputs = [
+    pytest-asyncio
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "kaleidescape"
+  ];
+
+  disabledTests = [
+    # Test requires network access
+    "test_resolve_succeeds"
+  ];
+
+  meta = with lib; {
+    description = "Module for controlling Kaleidescape devices";
+    homepage = "https://github.com/SteveEasley/pykaleidescape";
+    changelog = "https://github.com/SteveEasley/pykaleidescape/releases/tag/v${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/pytest-relaxed/default.nix b/pkgs/development/python-modules/pytest-relaxed/default.nix
index 13838eb326c98..46a95c725d475 100644
--- a/pkgs/development/python-modules/pytest-relaxed/default.nix
+++ b/pkgs/development/python-modules/pytest-relaxed/default.nix
@@ -1,44 +1,53 @@
 { lib
 , buildPythonPackage
+, decorator
 , fetchPypi
+, invocations
+, invoke
 , pytest
-, six
-, decorator
 , pytestCheckHook
+, pythonOlder
 }:
 
 buildPythonPackage rec {
-  version = "1.1.5";
   pname = "pytest-relaxed";
+  version = "2.0.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "e39a7e5b14e14dfff0de0ad720dfffa740c128d599ab14cfac13f4deb34164a6";
+    hash = "sha256-Szc8x1Rmb/YPVCWmnLQUZCwqEc56RsjOBmpzjkCSyjk=";
   };
 
-  # newer decorator versions are incompatible and cause the test suite to fail
-  # but only a few utility functions are used from this package which means it has no actual impact on test execution in paramiko and Fabric
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace "decorator>=4,<5" "decorator>=4" \
-      --replace "pytest>=3,<5" "pytest>=3"
-  '';
+  buildInputs = [
+    pytest
+  ];
 
-  buildInputs = [ pytest ];
+  propagatedBuildInputs = [
+    decorator
+  ];
 
-  propagatedBuildInputs = [ six decorator ];
+  checkInputs = [
+    invocations
+    invoke
+    pytestCheckHook
+  ];
 
-  checkInputs = [ pytestCheckHook ];
+  pytestFlagsArray = [
+    "tests"
+  ];
 
-  # lots of assertion errors mainly around decorator
-  doCheck = false;
+  pythonImportsCheck = [
+    "pytest_relaxed"
+  ];
 
   meta = with lib; {
     homepage = "https://pytest-relaxed.readthedocs.io/";
     description = "Relaxed test discovery/organization for pytest";
+    changelog = "https://github.com/bitprophet/pytest-relaxed/blob/${version}/docs/changelog.rst";
     license = licenses.bsd0;
-    maintainers = [ maintainers.costrouc ];
-    # see https://github.com/bitprophet/pytest-relaxed/issues/12
-    broken = true;
+    maintainers = with maintainers; [ costrouc ];
   };
 }
diff --git a/pkgs/development/python-modules/python-arango/default.nix b/pkgs/development/python-modules/python-arango/default.nix
index ba44e94b9a31a..c5c3a93c3bae2 100644
--- a/pkgs/development/python-modules/python-arango/default.nix
+++ b/pkgs/development/python-modules/python-arango/default.nix
@@ -22,15 +22,16 @@ in
 
 buildPythonPackage rec {
   pname = "python-arango";
-  version = "7.5.3";
-  disabled = pythonOlder "3.7";
+  version = "7.5.4";
   format = "setuptools";
 
+  disabled = pythonOlder "3.7";
+
   src = fetchFromGitHub {
     owner = "ArangoDB-Community";
     repo = "python-arango";
-    rev = version;
-    sha256 = "0qb2yp05z8dmgsyyxqrl3q0a60jaiih96zhxmqrn2yf7as45n07j";
+    rev = "refs/tags/${version}";
+    hash = "sha256-b3UZuH2hpulRSThReBkDwh0MLJmc95HeWInmmMAl4g0=";
   };
 
   propagatedBuildInputs = [
@@ -127,12 +128,15 @@ buildPythonPackage rec {
     "test_replication_applier"
   ];
 
-  pythonImportsCheck = [ "arango" ];
+  pythonImportsCheck = [
+    "arango"
+  ];
 
   meta = with lib; {
     description = "Python Driver for ArangoDB";
     homepage = "https://github.com/ArangoDB-Community/python-arango";
+    changelog = "https://github.com/ArangoDB-Community/python-arango/releases/tag/${version}";
     license = licenses.mit;
-    maintainers = [ maintainers.jsoo1 ];
+    maintainers = with maintainers; [ jsoo1 ];
   };
 }
diff --git a/pkgs/development/python-modules/trezor/default.nix b/pkgs/development/python-modules/trezor/default.nix
index ae9778d910393..080792a98b5ab 100644
--- a/pkgs/development/python-modules/trezor/default.nix
+++ b/pkgs/development/python-modules/trezor/default.nix
@@ -25,13 +25,13 @@
 
 buildPythonPackage rec {
   pname = "trezor";
-  version = "0.13.4";
+  version = "0.13.5";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "04a77b44005971819386bbd55242a1004b1f88fbbdb829deb039a1e0028a4af1";
+    sha256 = "sha256-jhUBca/+rDge/bFHgpKQhNZBTsd8zNyHHW8NZE/1e9g=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
diff --git a/pkgs/development/python-modules/whois/default.nix b/pkgs/development/python-modules/whois/default.nix
index 9cfae34b5ad61..11669fd81c13b 100644
--- a/pkgs/development/python-modules/whois/default.nix
+++ b/pkgs/development/python-modules/whois/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "whois";
-  version = "0.9.19";
+  version = "0.9.20";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     owner = "DannyCork";
     repo = "python-whois";
     rev = "refs/tags/${version}";
-    hash = "sha256-b8OZppynDT0MCwH4ic+wMJzWqyUzsigzxD0yYGfgJmI=";
+    hash = "sha256-J2v2TKTrzhi1XLW2e/N3jAGCy3W8cQEFV5cJAf8gT4g=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/ruby-modules/bundler/default.nix b/pkgs/development/ruby-modules/bundler/default.nix
index 35b93abda4900..43878362bb6d9 100644
--- a/pkgs/development/ruby-modules/bundler/default.nix
+++ b/pkgs/development/ruby-modules/bundler/default.nix
@@ -4,8 +4,8 @@ buildRubyGem rec {
   inherit ruby;
   name = "${gemName}-${version}";
   gemName = "bundler";
-  version = "2.3.26";
-  source.sha256 = "sha256-HuU832HnKK2Cxtv/Bs/NhVHVQi6I6GID8OLb6a6Zngk=";
+  version = "2.4.2";
+  source.sha256 = "sha256-mYUOxAWH7hv7Kn521OVI8PyzoO3T6LGPJjAxA07buR8=";
   dontPatchShebangs = true;
 
   passthru.updateScript = writeScript "gem-update-script" ''
diff --git a/pkgs/development/tools/comby/default.nix b/pkgs/development/tools/comby/default.nix
index d97287ab579ba..f77acfffa9b31 100644
--- a/pkgs/development/tools/comby/default.nix
+++ b/pkgs/development/tools/comby/default.nix
@@ -15,8 +15,8 @@ let
     ocamlPackages.buildDunePackage rec {
       inherit pname preBuild;
       version = "1.8.1";
-      useDune2 = true;
-      minimumOcamlVersion = "4.08.1";
+      duneVersion = "3";
+      minimalOcamlVersion = "4.08.1";
       doCheck = true;
 
       src = fetchFromGitHub {
diff --git a/pkgs/development/tools/continuous-integration/woodpecker/cli.nix b/pkgs/development/tools/continuous-integration/woodpecker/cli.nix
index aa83dfb16166e..b5eda9efb9173 100644
--- a/pkgs/development/tools/continuous-integration/woodpecker/cli.nix
+++ b/pkgs/development/tools/continuous-integration/woodpecker/cli.nix
@@ -1,4 +1,4 @@
-{ lib, buildGoModule, callPackage, fetchFromGitHub, fetchpatch }:
+{ lib, buildGoModule, callPackage, fetchFromGitHub }:
 let
   common = callPackage ./common.nix { };
 in
@@ -7,16 +7,6 @@ buildGoModule {
   inherit (common) version src ldflags postBuild;
   vendorSha256 = null;
 
-  patches = [
-    # Fixes https://github.com/NixOS/nixpkgs/issues/184875, until a new version
-    # is released.
-    (fetchpatch {
-      name = "display-system-ca-error-only-if-there-is-an-error.patch";
-      url = "https://github.com/woodpecker-ci/woodpecker/commit/1fb800329488de74c9db7cfc5dc43fb5a4efbad8.patch";
-      sha256 = "sha256-wKI/7PhbxsAD/qrl4nnkHyyQhQcvGlySysnxytGJzfU=";
-    })
-  ];
-
   subPackages = "cmd/cli";
 
   CGO_ENABLED = 0;
diff --git a/pkgs/development/tools/continuous-integration/woodpecker/common.nix b/pkgs/development/tools/continuous-integration/woodpecker/common.nix
index d6b337f4892af..e94e83b7e6b98 100644
--- a/pkgs/development/tools/continuous-integration/woodpecker/common.nix
+++ b/pkgs/development/tools/continuous-integration/woodpecker/common.nix
@@ -1,8 +1,8 @@
 { lib, fetchFromGitHub }:
 let
-  version = "0.15.5";
-  srcSha256 = "yaA2PKw4xuqd8vGXh/GhcJJHw4mJ1z97tWJTREE14ow=";
-  yarnSha256 = "1jpb4gblmknl81f6iclqg8ba82ca931q38xpm0kzki8y5ayk9n67";
+  version = "0.15.6";
+  srcSha256 = "sha256-8XXeGEw7+NGULsD5/g1j9+P2h82oRpEuMJT6sMp+z38=";
+  yarnSha256 = "sha256-PY0BIBbjyi2DG+n5x/IPc0AwrFSwII4huMDU+FeZ/Sc=";
 in
 {
   inherit version yarnSha256;
diff --git a/pkgs/development/tools/continuous-integration/woodpecker/woodpecker-package.json b/pkgs/development/tools/continuous-integration/woodpecker/woodpecker-package.json
index eb29431a0566c..3caa2f3cbf7f0 100644
--- a/pkgs/development/tools/continuous-integration/woodpecker/woodpecker-package.json
+++ b/pkgs/development/tools/continuous-integration/woodpecker/woodpecker-package.json
@@ -18,7 +18,6 @@
   },
   "dependencies": {
     "@kyvg/vue3-notification": "2.3.4",
-    "@meforma/vue-toaster": "1.2.2",
     "ansi-to-html": "0.7.2",
     "dayjs": "1.10.7",
     "floating-vue": "2.0.0-beta.5",
@@ -54,7 +53,7 @@
     "typescript": "4.4.4",
     "unplugin-icons": "0.12.17",
     "unplugin-vue-components": "0.17.0",
-    "vite": "2.6.13",
+    "vite": "2.9.13",
     "vite-plugin-windicss": "1.4.12",
     "vite-svg-loader": "3.0.0",
     "vue-tsc": "0.28.10",
diff --git a/pkgs/development/tools/database/timescaledb-tune/default.nix b/pkgs/development/tools/database/timescaledb-tune/default.nix
index faf820c1bde21..020c99380b6aa 100644
--- a/pkgs/development/tools/database/timescaledb-tune/default.nix
+++ b/pkgs/development/tools/database/timescaledb-tune/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "timescaledb-tune";
-  version = "0.14.2";
+  version = "0.14.3";
 
   src = fetchFromGitHub {
     owner = "timescale";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-vbFfqGWYpw0ppon/0oQMRixQStk+YSi/QFMi0AQoUpQ=";
+    sha256 = "sha256-MQi8A7eWOShP/VhxuX4Uhz1ueLtKvOi1x4E7aFXEsQo=";
   };
 
-  vendorSha256 = "sha256-n2jrg9FiR/gSrbds/QVV8Duf7BTEs36yYi4F3Ve+d0E=";
+  vendorSha256 = "sha256-yXWeINubvfZ2S+3gVFsrzeVO3XXIiZ14qfK+9Bj3SV4=";
 
   ldflags = [ "-s" "-w" ];
 
diff --git a/pkgs/development/tools/devd/default.nix b/pkgs/development/tools/devd/default.nix
index 0789850a49453..05ed14dfcd6e7 100644
--- a/pkgs/development/tools/devd/default.nix
+++ b/pkgs/development/tools/devd/default.nix
@@ -1,16 +1,30 @@
-{ buildGoPackage, fetchFromGitHub, lib }:
+{ buildGoModule, fetchFromGitHub, fetchpatch, lib }:
 
-buildGoPackage rec {
+buildGoModule rec {
   pname = "devd";
-  version = "0.9";
+  version = "unstable-2020-04-27";
+
   src = fetchFromGitHub {
     owner = "cortesi";
     repo = "devd";
-    rev = "v${version}";
-    sha256 = "1b02fj821k68q7xl48wc194iinqw9jiavzfl136hlzvg4m07p1wf";
+    rev = "c1a3bfba27d8e028de90fb24452374412a4cffb3";
+    hash = "sha256-k0zj7fiYbaHnNUUI7ruD0vXiT4c1bxPuR4I0dRouCbU=";
   };
-  goPackagePath = "github.com/cortesi/devd";
+
+  vendorHash = "sha256-o7MbN/6n7fkp/yqYyQbfWBUqI09/JYh5jtV31gjNf6w=";
+
+  patches = [
+    # Update x/sys to support go 1.17.
+    (fetchpatch {
+      url = "https://github.com/cortesi/devd/commit/5f4720bf41399736b4e7e1a493da6c87a583d0b2.patch";
+      hash = "sha256-WDN08XNsDPuZwBCE8iDXgGAWFwx2UTwqRkhzKMtPKR8=";
+    })
+  ];
+
   subPackages = [ "cmd/devd" ];
+
+  ldflags = [ "-s" "-w" ];
+
   meta = with lib; {
     description = "A local webserver for developers";
     homepage = "https://github.com/cortesi/devd";
diff --git a/pkgs/development/tools/esbuild/default.nix b/pkgs/development/tools/esbuild/default.nix
index 42f02ee15f858..07b136ab03b6e 100644
--- a/pkgs/development/tools/esbuild/default.nix
+++ b/pkgs/development/tools/esbuild/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "esbuild";
-  version = "0.16.7";
+  version = "0.16.13";
 
   src = fetchFromGitHub {
     owner = "evanw";
     repo = "esbuild";
     rev = "v${version}";
-    sha256 = "sha256-zo7YQ4Is3VWsXGvPNrg95tZ76qTSQRyntFjDeqhoyVw=";
+    hash = "sha256-X4UB2RDfupUP+u+4g2jLxbpx4n4uarhcjs5VtP9Zi20=";
   };
 
-  vendorSha256 = "sha256-+BfxCyg0KkDQpHt/wycy/8CTG6YBA/VJvJFhhzUnSiQ=";
+  vendorHash = "sha256-+BfxCyg0KkDQpHt/wycy/8CTG6YBA/VJvJFhhzUnSiQ=";
 
   subPackages = [ "cmd/esbuild" ];
 
diff --git a/pkgs/development/tools/language-servers/nil/default.nix b/pkgs/development/tools/language-servers/nil/default.nix
index 2f434436226c8..22f1e98f1826e 100644
--- a/pkgs/development/tools/language-servers/nil/default.nix
+++ b/pkgs/development/tools/language-servers/nil/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "nil";
-  version = "2022-12-01";
+  version = "2023-01-01";
 
   src = fetchFromGitHub {
     owner = "oxalica";
     repo = pname;
     rev = version;
-    hash = "sha256-E/QGmoL7Q3GDR2/I5o2CAMHMcmPQEJAySke1s+nOaho=";
+    hash = "sha256-xpNlmGG7Qy0SPzXZ9sQ0i9Yo2hMaK+YsTEOTk10rs+k=";
   };
 
-  cargoHash = "sha256-T3i86L6cF6uFbSs7xtKHGzB6XrE9jn2RZghxFzDleXU=";
+  cargoHash = "sha256-mwfM3hIEaHKa2oPVWzXpua+W2Oa5brvNRbRCcV0KapY=";
 
   CFG_DATE = version;
   CFG_REV = "release";
@@ -25,6 +25,7 @@ rustPlatform.buildRustPackage rec {
   meta = with lib; {
     description = "Yet another language server for Nix";
     homepage = "https://github.com/oxalica/nil";
+    changelog = "https://github.com/oxalica/nil/releases/tag/${version}";
     license = with licenses; [ mit asl20 ];
     maintainers = with maintainers; [ figsoda oxalica ];
   };
diff --git a/pkgs/development/tools/misc/highlight-assertions/default.nix b/pkgs/development/tools/misc/highlight-assertions/default.nix
index 8d2aabe4bf5c6..c16bf863349a4 100644
--- a/pkgs/development/tools/misc/highlight-assertions/default.nix
+++ b/pkgs/development/tools/misc/highlight-assertions/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "highlight-assertions";
-  version = "unstable-2022-11-24";
+  version = "0.1.6";
 
   src = fetchFromGitHub {
     owner = "thehamsta";
     repo = pname;
-    rev = "c738a51513285ded4fc16d68afcdb77761543f92";
-    sha256 = "sha256-vYXr0xFwRUwSEP++834A/4M1QB14Wx+qWwB9PUtn3uA=";
+    rev = "v${version}";
+    sha256 = "sha256-OVf8s7zuGj5//zWJIVBfHBoA6zD+l8lqVQGn2vHsvSQ=";
   };
 
-  cargoSha256 = "sha256-sezjd7tmVVDoRsrsTK2zKjHmrBcAQDHyHd/dR1q1za0=";
+  cargoSha256 = "sha256-cS4IbFuxZCKDIAcgiKzBF/qQ6mXZb9omvMeGcU+yWpk=";
 
   # requires nightly features
   RUSTC_BOOTSTRAP = 1;
diff --git a/pkgs/development/tools/misc/loccount/default.nix b/pkgs/development/tools/misc/loccount/default.nix
index 32a14404c6062..5fd519eb06a51 100644
--- a/pkgs/development/tools/misc/loccount/default.nix
+++ b/pkgs/development/tools/misc/loccount/default.nix
@@ -1,18 +1,29 @@
-{ lib, buildGoPackage, fetchFromGitLab }:
-buildGoPackage rec {
+{ lib, buildGoModule, fetchFromGitLab, python3 }:
+buildGoModule rec {
   pname = "loccount";
-  version = "1.2";
-
-  goPackagePath = "gitlab.com/esr/loccount";
-  excludedPackages = "tests";
+  version = "2.14";
 
   src = fetchFromGitLab {
     owner = "esr";
     repo = "loccount";
     rev = version;
-    sha256 = "18z7ai7wy2k9yd3w65d37apfqs3h9bc2c15y7v1bydppi44zfsdk";
+    hash = "sha256-9tzDNwWM4uzxC+xqM603l8EIqYrGUUvZgSe6r1EyHi8=";
   };
 
+  vendorHash = "sha256-pQpattmS9VmO3ZIQUFn66az8GSmB4IvYhTTCFn6SUmo=";
+
+  excludedPackages = "tests";
+
+  nativeBuildInputs = [ python3 ];
+
+  ldflags = [ "-s" "-w" ];
+
+  preBuild = ''
+    patchShebangs --build tablegen.py
+
+    go generate
+  '';
+
   meta = with lib; {
     description = "Re-implementation of sloccount in Go";
     longDescription = ''
@@ -26,10 +37,9 @@ buildGoPackage rec {
       an exception; loccount corrects buggy counting of single-quote multiline
       literals in sloccount 2.26.
     '';
-    homepage="https://gitlab.com/esr/loccount";
-    downloadPage="https://gitlab.com/esr/loccount/tree/master";
+    homepage = "https://gitlab.com/esr/loccount";
+    downloadPage = "https://gitlab.com/esr/loccount/tree/master";
     license = licenses.bsd2;
     maintainers = with maintainers; [ calvertvl ];
-    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/tools/misc/ptags/default.nix b/pkgs/development/tools/misc/ptags/default.nix
index b8be0ee3dc6da..6f554e6d352b6 100644
--- a/pkgs/development/tools/misc/ptags/default.nix
+++ b/pkgs/development/tools/misc/ptags/default.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "ptags";
-  version = "0.3.2";
+  version = "0.3.4";
 
   src = fetchFromGitHub {
     owner = "dalance";
     repo = "ptags";
     rev = "v${version}";
-    sha256 = "1xr1szh4dfrcmi6s6dj791k1ix2zbv75rqkqbyb1lmh5548kywkg";
+    sha256 = "sha256-hFHzNdTX3nw2OwRxk9lKrt/YpaBXwi5aE/Qn3W9PRf4=";
   };
 
-  cargoSha256 = "1pz5hvn1iq26i8c2cmqavhnri8h0sn40khrxvcdkj9q47nsj5wcx";
+  cargoSha256 = "sha256-cFezB7uwUznC/8NXJNrBqP0lf0sXAQBoGksXFOGrUIg=";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/development/tools/ocaml/dune/3.nix b/pkgs/development/tools/ocaml/dune/3.nix
index c6e5c3da01649..7c305012c57ea 100644
--- a/pkgs/development/tools/ocaml/dune/3.nix
+++ b/pkgs/development/tools/ocaml/dune/3.nix
@@ -6,11 +6,11 @@ else
 
 stdenv.mkDerivation rec {
   pname = "dune";
-  version = "3.6.1";
+  version = "3.6.2";
 
   src = fetchurl {
     url = "https://github.com/ocaml/dune/releases/download/${version}/dune-${version}.tbz";
-    sha256 = "sha256-8dWsBLegJ/PVSeJc+IXr96zBNeApHBjmtDEjp5nBQ84=";
+    sha256 = "sha256-ttSrhI77BKoqMl0AFdMu1EFO1xMOx6oS+YFY7/RFzzw=";
   };
 
   nativeBuildInputs = [ ocaml findlib ];
diff --git a/pkgs/development/tools/ruff/default.nix b/pkgs/development/tools/ruff/default.nix
index 5caa5357e9b78..ef5a143f94c65 100644
--- a/pkgs/development/tools/ruff/default.nix
+++ b/pkgs/development/tools/ruff/default.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "ruff";
-  version = "0.0.205";
+  version = "0.0.207";
 
   src = fetchFromGitHub {
     owner = "charliermarsh";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-fs9AjYnsOV3tbmoXoIfK5OJbErfImQl01TvorS/R4zc=";
+    sha256 = "sha256-DAjBie0wiweT/FE4kHLrYoymy+NJvaXkYSky1iJwwv4=";
   };
 
-  cargoSha256 = "sha256-YirtNOamGgjM84rZcZhOXfWj1WD4vvAJvi6nKx0lmTI=";
+  cargoSha256 = "sha256-px6T0DsQPWD6qWZpvEoEUwAiFPxVaBmevGguYpPTQoo=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
     darwin.apple_sdk.frameworks.CoreServices
diff --git a/pkgs/development/tools/winhelpcgi/default.nix b/pkgs/development/tools/winhelpcgi/default.nix
new file mode 100644
index 0000000000000..cd7bfe344357a
--- /dev/null
+++ b/pkgs/development/tools/winhelpcgi/default.nix
@@ -0,0 +1,23 @@
+{ stdenv, fetchurl, libwmf, libpng, pkg-config, lib }: stdenv.mkDerivation {
+  name = "winhelpcgi-1.0-rc3";
+
+  src = fetchurl {
+    url = "http://www.herdsoft.com/ftp/winhelpcgi_1.0-1.tar.gz";
+    sha256 = "sha256-9HIs50ZGoTfGixD9c/DQs0KJMQtmfsDVB8qRMnQtXNw=";
+
+  };
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [ libwmf libpng ];
+
+  meta = {
+    description = "CGI module for Linux, Solaris, MacOS X and AIX to read Windows Help Files";
+
+    homepage = "http://www.herdsoft.com/linux/produkte/winhelpcgi.html";
+
+    license = lib.licenses.gpl2Only;
+
+    maintainers = [ lib.maintainers.shlevy ];
+  };
+}
diff --git a/pkgs/games/nanosaur/default.nix b/pkgs/games/nanosaur/default.nix
index c62fd3c5db729..32c2a0b9ecc91 100644
--- a/pkgs/games/nanosaur/default.nix
+++ b/pkgs/games/nanosaur/default.nix
@@ -20,21 +20,12 @@ stdenv.mkDerivation rec {
     SDL2
   ];
 
-  configurePhase = ''
-    runHook preConfigure
-    cmake -S . -B build -DCMAKE_BUILD_TYPE=Release
-    runHook postConfigure
-  '';
-
-  buildPhase = ''
-    runHook preBuild
-    cmake --build build
-    runHook postBuild
-  '';
+  cmakeFlags = [ "-DCMAKE_BUILD_TYPE=Release" ];
 
   installPhase = ''
     runHook preInstall
-    mv build $out
+    mkdir -p "$out/bin"
+    mv Nanosaur Data ReadMe.txt "$out/"
     makeWrapper $out/Nanosaur $out/bin/Nanosaur --chdir "$out"
     runHook postInstall
   '';
diff --git a/pkgs/games/nanosaur2/default.nix b/pkgs/games/nanosaur2/default.nix
index da0e6dbe72932..e4e0919cd30cf 100644
--- a/pkgs/games/nanosaur2/default.nix
+++ b/pkgs/games/nanosaur2/default.nix
@@ -20,21 +20,12 @@ stdenv.mkDerivation rec {
     SDL2
   ];
 
-  configurePhase = ''
-    runHook preConfigure
-    cmake -S . -B build -DCMAKE_BUILD_TYPE=Release
-    runHook postConfigure
-  '';
-
-  buildPhase = ''
-    runHook preBuild
-    cmake --build build
-    runHook postBuild
-  '';
+  cmakeFlags = [ "-DCMAKE_BUILD_TYPE=Release" ];
 
   installPhase = ''
     runHook preInstall
-    mv build $out
+    mkdir -p "$out/bin"
+    mv Nanosaur2 Data ReadMe.txt "$out/"
     makeWrapper $out/Nanosaur2 $out/bin/Nanosaur2 --chdir "$out"
     runHook postInstall
   '';
diff --git a/pkgs/games/otto-matic/default.nix b/pkgs/games/otto-matic/default.nix
index 7523f2070e9a9..17b63b263029b 100644
--- a/pkgs/games/otto-matic/default.nix
+++ b/pkgs/games/otto-matic/default.nix
@@ -12,22 +12,23 @@ stdenv.mkDerivation rec {
     fetchSubmodules = true;
   };
 
-  buildInputs = [
-    SDL2
-  ];
-
   nativeBuildInputs = [
     cmake
     makeWrapper
   ];
 
+  buildInputs = [
+    SDL2
+  ];
+
+  cmakeFlags = [ "-DCMAKE_BUILD_TYPE=Release" ];
+
   installPhase = ''
     runHook preInstall
 
-    mkdir -p $out/share/OttoMatic
-    mv Data $out/share/OttoMatic
-    install -Dm755 {.,$out/bin}/OttoMatic
-    wrapProgram $out/bin/OttoMatic --chdir "$out/share/OttoMatic"
+    mkdir -p "$out/bin"
+    mv OttoMatic Data ReadMe.txt "$out/"
+    makeWrapper $out/OttoMatic $out/bin/OttoMatic --chdir "$out"
 
     runHook postInstall
   '';
diff --git a/pkgs/games/quakespasm/default.nix b/pkgs/games/quakespasm/default.nix
index 030532b524d7e..6681370c79d65 100644
--- a/pkgs/games/quakespasm/default.nix
+++ b/pkgs/games/quakespasm/default.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "quakespasm";
-  version = "0.95.0";
+  version = "0.95.1";
 
   src = fetchurl {
     url = "mirror://sourceforge/quakespasm/quakespasm-${version}.tar.gz";
-    sha256 = "sha256-pjXqOyL5ILu0Tx5sfehYXbVsL11Abt9cgZJ4xkkBrnA=";
+    sha256 = "sha256-hBmEV3s65yQysMiq4zEP4swfCgCCiT5dzZdhg7bSNOI=";
   };
 
   sourceRoot = "${pname}-${version}/Quake";
diff --git a/pkgs/games/rare/default.nix b/pkgs/games/rare/default.nix
index fbd3f95128218..766673d3ea024 100644
--- a/pkgs/games/rare/default.nix
+++ b/pkgs/games/rare/default.nix
@@ -3,13 +3,13 @@
 
 buildPythonApplication rec {
   pname = "rare";
-  version = "1.9.3";
+  version = "1.9.4";
 
   src = fetchFromGitHub {
     owner = "Dummerle";
     repo = "Rare";
-    rev = version;
-    sha256 = "sha256-M+OMsyamh4WHIx7Pv2sLylOrnSmYrv1aEm3atqXrDaw=";
+    rev = "refs/tags/${version}";
+    sha256 = "sha256-+STwVsDdvjP7HaqmaQVug+6h0n0rw/j4LGQQSNdLVQQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/os-specific/darwin/apple-sdk-11.0/private-frameworks.nix b/pkgs/os-specific/darwin/apple-sdk-11.0/private-frameworks.nix
index b8786ec92f6da..4d9f68c0d35f6 100644
--- a/pkgs/os-specific/darwin/apple-sdk-11.0/private-frameworks.nix
+++ b/pkgs/os-specific/darwin/apple-sdk-11.0/private-frameworks.nix
@@ -18,4 +18,7 @@
 
   # Also expose CoreSymbolication; used by `root` package.
   CoreSymbolication = {};
+
+  # Also expose DebugSymbols; used by `llvmPackages_8.lldb` package.
+  DebugSymbols = {};
 }
diff --git a/pkgs/os-specific/darwin/apple-sdk/default.nix b/pkgs/os-specific/darwin/apple-sdk/default.nix
index 0cf95cbe9c561..376cc731639d8 100644
--- a/pkgs/os-specific/darwin/apple-sdk/default.nix
+++ b/pkgs/os-specific/darwin/apple-sdk/default.nix
@@ -326,7 +326,7 @@ in rec {
         "Versions/A/Frameworks/WebKitLegacy.framework/Versions/A/WebKitLegacy.tbd"
       ];
     });
-  } // lib.genAttrs [ "ContactsPersistence" "CoreSymbolication" "GameCenter" "SkyLight" "UIFoundation" ] (x: tbdOnlyFramework x {});
+  } // lib.genAttrs [ "ContactsPersistence" "CoreSymbolication" "DebugSymbols" "GameCenter" "SkyLight" "UIFoundation" ] (x: tbdOnlyFramework x {});
 
   bareFrameworks = lib.mapAttrs framework (import ./frameworks.nix {
     inherit frameworks libs;
diff --git a/pkgs/os-specific/linux/eudev/default.nix b/pkgs/os-specific/linux/eudev/default.nix
index 7807f475e9b17..0dd69784516a5 100644
--- a/pkgs/os-specific/linux/eudev/default.nix
+++ b/pkgs/os-specific/linux/eudev/default.nix
@@ -2,7 +2,6 @@
 , stdenv
 , fetchFromGitHub
 , autoreconfHook
-, glib
 , gperf
 , kmod
 , pkg-config
@@ -27,7 +26,6 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    glib
     kmod
     util-linux
   ];
diff --git a/pkgs/os-specific/linux/kernel/linux-5.15.nix b/pkgs/os-specific/linux/kernel/linux-5.15.nix
index 561447eca00bc..fa9f84a72f6b5 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.15.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.15.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.15.85";
+  version = "5.15.86";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "024qhjh9mgfnanr1qd8002n6a4wpn98lajli12a0m3n9z8lsw2rc";
+    sha256 = "1vpjnmwqsx6akph2nvbsv2jl7pp8b7xns3vmwbljsl23lkpxkz40";
   };
 } // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-6.0.nix b/pkgs/os-specific/linux/kernel/linux-6.0.nix
index 6cb9aae83be31..aa194a8efdeaf 100644
--- a/pkgs/os-specific/linux/kernel/linux-6.0.nix
+++ b/pkgs/os-specific/linux/kernel/linux-6.0.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "6.0.15";
+  version = "6.0.16";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v6.x/linux-${version}.tar.xz";
-    sha256 = "08389890gq4b9vkvrb22lzkr4blkn3a5ma074ns19gl89wyyp16l";
+    sha256 = "1r2wf3hf7yxl7lxma7plyi8pk3dmlsrpm763rf0g1h8ilsy72844";
   };
 } // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-6.1.nix b/pkgs/os-specific/linux/kernel/linux-6.1.nix
index 594fcb45573fb..fb7aff46e5378 100644
--- a/pkgs/os-specific/linux/kernel/linux-6.1.nix
+++ b/pkgs/os-specific/linux/kernel/linux-6.1.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "6.1.1";
+  version = "6.1.2";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v6.x/linux-${version}.tar.xz";
-    sha256 = "1yqxjz0f722s2bcssqg5b6m6lvq5l4vrlh3bjviajda4rxvi7rm3";
+    sha256 = "1bni72q0jjg39vqckcif57kh7d1x4k4jir5a11pz9clryp2g6hgf";
   };
 } // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-libre.nix b/pkgs/os-specific/linux/kernel/linux-libre.nix
index 9900a10417ec9..698ca10016ca1 100644
--- a/pkgs/os-specific/linux/kernel/linux-libre.nix
+++ b/pkgs/os-specific/linux/kernel/linux-libre.nix
@@ -1,8 +1,8 @@
 { stdenv, lib, fetchsvn, linux
 , scripts ? fetchsvn {
     url = "https://www.fsfla.org/svn/fsfla/software/linux-libre/releases/branches/";
-    rev = "19007";
-    sha256 = "1f37z6xn4ikc2p06y8rdaja8cj2r9qnp9y0zrl8g8kqmdzs6c15g";
+    rev = "19027";
+    sha256 = "0g7sf48rwicwzwhjpzs82j6v3j4s17xhrgfgysdd523r07437ryv";
   }
 , ...
 }:
diff --git a/pkgs/os-specific/linux/kernel/zen-kernels.nix b/pkgs/os-specific/linux/kernel/zen-kernels.nix
index 08671e83ffc51..c061b54337925 100644
--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@@ -4,16 +4,16 @@ let
   # comments with variant added for update script
   # ./update-zen.py zen
   zenVariant = {
-    version = "6.1"; #zen
+    version = "6.1.2"; #zen
     suffix = "zen1"; #zen
-    sha256 = "1xxn6hqq2j8l57hb32sqmfdlylzgy21g6fmra73zqql4vbx4r1nb"; #zen
+    sha256 = "0wys16f4z221r3g3fc8cb5i0hcymjsk780jk657ihx5xm3anv3kf"; #zen
     isLqx = false;
   };
   # ./update-zen.py lqx
   lqxVariant = {
-    version = "6.0.13"; #lqx
-    suffix = "lqx3"; #lqx
-    sha256 = "0dc295d9dfm3j2nmvkzy21ky1k6jp7c7miqjhqgfjny9yk1b41k4"; #lqx
+    version = "6.1.2"; #lqx
+    suffix = "lqx1"; #lqx
+    sha256 = "03kwp1c3amk87sjdji9643gr396hca8crqf2z614wkd84vdwary0"; #lqx
     isLqx = true;
   };
   zenKernelsFor = { version, suffix, sha256, isLqx }: buildLinux (args // {
diff --git a/pkgs/os-specific/linux/waydroid/default.nix b/pkgs/os-specific/linux/waydroid/default.nix
index 55630f2fad3b1..efa21cfb26b57 100644
--- a/pkgs/os-specific/linux/waydroid/default.nix
+++ b/pkgs/os-specific/linux/waydroid/default.nix
@@ -1,5 +1,4 @@
-{ stdenv
-, lib
+{ lib
 , fetchFromGitHub
 , python3Packages
 , dnsmasq
@@ -8,7 +7,6 @@
 , kmod
 , lxc
 , iproute2
-, iptables
 , nftables
 , util-linux
 , which
@@ -17,14 +15,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "waydroid";
-  version = "1.3.3";
+  version = "1.3.4";
   format = "other";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "sha256-av1kcOSViUV2jsFiTE21N6sAJIL6K+zKkpPHjx6iYVk=";
+    sha256 = "sha256-0GBob9BUwiE5cFGdK8AdwsTjTOdc+AIWqUGN/gFfOqI=";
   };
 
   propagatedBuildInputs = with python3Packages; [
diff --git a/pkgs/servers/dcnnt/default.nix b/pkgs/servers/dcnnt/default.nix
index 07458c40b8f84..1140325b05f38 100644
--- a/pkgs/servers/dcnnt/default.nix
+++ b/pkgs/servers/dcnnt/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonApplication rec {
   pname = "dcnnt";
-  version = "0.7.1";
+  version = "0.9.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-vKCQgg0m58hoN79WcZ4mM6bjCJOPxhAT4ifZ3b/5bkA=";
+    sha256 = "sha256-YG+NLKI9cz8Uu2y+Ut2q+vn67ExTya00XjHlWRAksz8=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index b72fa929a7dbd..3b561c1e31736 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -1720,7 +1720,8 @@
     "kaiterra" = ps: with ps; [
     ]; # missing inputs: kaiterra-async-client
     "kaleidescape" = ps: with ps; [
-    ]; # missing inputs: pykaleidescape
+      pykaleidescape
+    ];
     "kankun" = ps: with ps; [
     ];
     "keba" = ps: with ps; [
@@ -1776,7 +1777,8 @@
       pykira
     ];
     "kiwi" = ps: with ps; [
-    ]; # missing inputs: kiwiki-client
+      kiwiki-client
+    ];
     "kmtronic" = ps: with ps; [
       pykmtronic
     ];
@@ -4380,6 +4382,7 @@
     "jewish_calendar"
     "juicenet"
     "justnimbus"
+    "kaleidescape"
     "keenetic_ndms2"
     "kegtron"
     "keymitt_ble"
diff --git a/pkgs/servers/http/jetty/default.nix b/pkgs/servers/http/jetty/default.nix
index b5e1611630e44..9082dceb50212 100644
--- a/pkgs/servers/http/jetty/default.nix
+++ b/pkgs/servers/http/jetty/default.nix
@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   pname = "jetty";
-  version = "11.0.12";
+  version = "11.0.13";
   src = fetchurl {
     url = "mirror://maven/org/eclipse/jetty/jetty-home/${version}/jetty-home-${version}.tar.gz";
-    sha256 = "sha256-otRm4hOJYK5QbWYevMosQlrSbmcni4ZREvwBo751JOQ=";
+    sha256 = "sha256-RZryj2AJKKv13iwRBVwushOpPFLUj7wd4JIgJ6JVIz4=";
   };
 
   dontBuild = true;
diff --git a/pkgs/servers/http/unit/default.nix b/pkgs/servers/http/unit/default.nix
index 5ce6af5aae4a0..87506287a8765 100644
--- a/pkgs/servers/http/unit/default.nix
+++ b/pkgs/servers/http/unit/default.nix
@@ -30,14 +30,14 @@ let
   php81-unit = php81.override phpConfig;
 
 in stdenv.mkDerivation rec {
-  version = "1.28.0";
+  version = "1.29.0";
   pname = "unit";
 
   src = fetchFromGitHub {
     owner = "nginx";
     repo = pname;
     rev = version;
-    sha256 = "sha256-nsalloOghC8tOMRP/N/L2raOmWwA4cz6Yr6H3IHHbR4=";
+    sha256 = "sha256-Na7whutGpd1yLePlcZyiZK9a/Y4YQnv7dkC5FjENqzs=";
   };
 
   nativeBuildInputs = [ which ];
diff --git a/pkgs/servers/irc/inspircd/default.nix b/pkgs/servers/irc/inspircd/default.nix
index 8f2d607d1a441..c8a9e12631e4b 100644
--- a/pkgs/servers/irc/inspircd/default.nix
+++ b/pkgs/servers/irc/inspircd/default.nix
@@ -50,6 +50,7 @@ let
     "mysql"
     "pgsql"
     "regex_pcre"
+    "regex_pcre2"
     "regex_re2"
     "regex_tre"
     "sqlite3"
@@ -69,6 +70,7 @@ in
 , postgresql
 , libmysqlclient
 , pcre
+, pcre2
 , tre
 , re2
 , sqlite
@@ -97,6 +99,7 @@ let
     mysql           = [ libmysqlclient ];
     pgsql           = [ postgresql ];
     regex_pcre      = [ pcre ];
+    regex_pcre2     = [ pcre2 ];
     regex_re2       = [ re2 ];
     regex_tre       = [ tre ];
     sqlite3         = [ sqlite ];
@@ -142,13 +145,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "inspircd";
-  version = "3.14.0";
+  version = "3.15.0";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-xrS/lvXHMVdtKta+57Vu4HygAuALFj+odJi8ScyrLGQ=";
+    sha256 = "sha256-4n9Tj+xTmPRPisiFjlyx7kYfReonIxoCWu18XWfEXY0=";
   };
 
   outputs = [ "bin" "lib" "man" "doc" "out" ];
diff --git a/pkgs/servers/mattermost/default.nix b/pkgs/servers/mattermost/default.nix
index 1d5386e89e1a4..01819e8e99f20 100644
--- a/pkgs/servers/mattermost/default.nix
+++ b/pkgs/servers/mattermost/default.nix
@@ -7,18 +7,18 @@
 
 buildGoModule rec {
   pname = "mattermost";
-  version = "7.5.1";
+  version = "7.5.2";
 
   src = fetchFromGitHub {
     owner = "mattermost";
     repo = "mattermost-server";
     rev = "v${version}";
-    sha256 = "sha256-uaud5yCJTV3/+5eqHvIurxM1EPtetTWeFTjkPKYmFiA=";
+    sha256 = "sha256-Jm7bu/RoFp7h38Ygis3U2E7Hbbj4zmRPc4PacxxASsw=";
   };
 
   webapp = fetchurl {
     url = "https://releases.mattermost.com/${version}/mattermost-${version}-linux-amd64.tar.gz";
-    sha256 = "sha256-DdQjXo3n13qt62iFWhSWuTcEXJiHLGdkWn8ulqvzTI0=";
+    sha256 = "sha256-Zvzme6Og/LLsT4XyFDAQscNgO+jCwwzDDytYOo4qM0U=";
   };
 
   vendorSha256 = "sha256-qZQXNVbJZDddVE+xk6F8XJCEg5dhhuXz68wcn2Uvmxk=";
@@ -29,6 +29,11 @@ buildGoModule rec {
     "-s"
     "-w"
     "-X github.com/mattermost/mattermost-server/v6/model.Version=${version}"
+    "-X github.com/mattermost/mattermost-server/v6/model.BuildNumber=${version}-nixpkgs"
+    "-X github.com/mattermost/mattermost-server/v6/model.BuildDate=1970-01-01"
+    "-X github.com/mattermost/mattermost-server/v6/model.BuildHash=v${version}"
+    "-X github.com/mattermost/mattermost-server/v6/model.BuildHashEnterprise=v${version}"
+    "-X github.com/mattermost/mattermost-server/v6/model.BuildEnterpriseReady=false"
   ];
 
   postInstall = ''
diff --git a/pkgs/servers/monitoring/vmagent/default.nix b/pkgs/servers/monitoring/vmagent/default.nix
index 71038d5637de4..c19be78717072 100644
--- a/pkgs/servers/monitoring/vmagent/default.nix
+++ b/pkgs/servers/monitoring/vmagent/default.nix
@@ -1,13 +1,13 @@
 { lib, fetchFromGitHub, buildGoModule }:
 buildGoModule rec {
   pname = "vmagent";
-  version = "1.85.0";
+  version = "1.85.3";
 
   src = fetchFromGitHub {
     owner = "VictoriaMetrics";
     repo = "VictoriaMetrics";
     rev = "v${version}";
-    sha256 = "sha256-ez/gq+QBDy2xGqUBoUWQFDDUpd4i0zpj9mUDZUWKbIw=";
+    sha256 = "sha256-/p5oHxp1fVyUMjZ3vim9YKNhFqIACGa3KTYIv/k4MXg=";
   };
 
   ldflags = [ "-s" "-w" "-X github.com/VictoriaMetrics/VictoriaMetrics/lib/buildinfo.Version=${version}" ];
diff --git a/pkgs/servers/nosql/redis/default.nix b/pkgs/servers/nosql/redis/default.nix
index 804070d0f0f56..b34c18a08bc67 100644
--- a/pkgs/servers/nosql/redis/default.nix
+++ b/pkgs/servers/nosql/redis/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, lua, pkg-config, nixosTests
-, tcl, which, ps, fetchpatch
+, tcl, which, ps, getconf
 , withSystemd ? stdenv.isLinux && !stdenv.hostPlatform.isStatic, systemd
 # dependency ordering is broken at the moment when building with openssl
 , tlsSupport ? !stdenv.hostPlatform.isStatic, openssl
@@ -7,22 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "redis";
-  version = "7.0.5";
+  version = "7.0.7";
 
   src = fetchurl {
     url = "https://download.redis.io/releases/${pname}-${version}.tar.gz";
-    hash = "sha256-ZwVMw3tYwSXfk714AAJh7A70Q2omtA84Jix4DlYxXMM=";
+    hash = "sha256-jTJ9foh9G7MI/Deq9xegv3n1gSnjc5Bpqu6uiJVaxYY=";
   };
 
-  patches = [
-    # https://nvd.nist.gov/vuln/detail/CVE-2022-3647
-    (fetchpatch {
-      name = "CVE-2022-3647.patch";
-      url = "https://github.com/redis/redis/commit/0bf90d944313919eb8e63d3588bf63a367f020a3.patch";
-      sha256 = "sha256-R5Tj/bHFTRnvWXiOYvRulqePzU5zvKbGfpO87TLfLWk=";
-    })
-  ];
-
   nativeBuildInputs = [ pkg-config ];
 
   buildInputs = [ lua ]
@@ -45,7 +36,7 @@ stdenv.mkDerivation rec {
 
   # darwin currently lacks a pure `pgrep` which is extensively used here
   doCheck = !stdenv.isDarwin;
-  checkInputs = [ which tcl ps ];
+  checkInputs = [ which tcl ps ] ++ lib.optionals stdenv.hostPlatform.isStatic [ getconf ];
   checkPhase = ''
     runHook preCheck
 
diff --git a/pkgs/servers/pocketbase/default.nix b/pkgs/servers/pocketbase/default.nix
index ae3825c3907da..fc5fc093dcd18 100644
--- a/pkgs/servers/pocketbase/default.nix
+++ b/pkgs/servers/pocketbase/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "pocketbase";
-  version = "0.10.1";
+  version = "0.10.4";
 
   src = fetchFromGitHub {
     owner = "pocketbase";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-IFyiopURkza22VYW5VM23hZ+GAKr+ykxn7r/MyQfGAI=";
+    sha256 = "sha256-ma60DvoknvB1NN+DEq6CMnhSjcR/ACWCQSOYbyRlsCs=";
   };
 
-  vendorSha256 = "sha256-5iT67xJ9pH/QhkMTKvYIU0NsMWg6KVum+trNyt2a2rg=";
+  vendorSha256 = "sha256-crVyKpvy7twZFDwwYNe+8GB0UAJ8j4F1yqYFu2CWW7o=";
 
   # This is the released subpackage from upstream repo
   subPackages = [ "examples/base" ];
diff --git a/pkgs/servers/prowlarr/default.nix b/pkgs/servers/prowlarr/default.nix
index 9bf1ecd129530..15b98ca035d8e 100644
--- a/pkgs/servers/prowlarr/default.nix
+++ b/pkgs/servers/prowlarr/default.nix
@@ -16,14 +16,14 @@ let
   }."${stdenv.hostPlatform.system}" or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
 
   hash = {
-    x64-linux_hash = "sha256-OYCZPP8w3HSxph8mg5MWDsjG7ubSFsPtpEQY7TWJ198=";
-    arm64-linux_hash = "sha256-kts6pOKaBVrr3uOba9UXsMLnzAA5EalfZk+v5PKqbMQ=";
-    x64-osx_hash = "sha256-/TEvsgeQUZdMFoPoZkCaJQCiJPguLt3AxiCbMg+Q/8M=";
+    x64-linux_hash = "sha256-r5A7KkzugTXwLejaQuKW/EhV99e8gqj8kmgliNMi/xU=";
+    arm64-linux_hash = "sha256-HdtUSMHteFDdp0yZYFC4EHK2S3cr6dEXklyTp5bqHYQ=";
+    x64-osx_hash = "sha256-GyHiBiz5LoT+DGxcC0v7OXvdUwaLyrczda/aUkABnrs=";
   }."${arch}-${os}_hash";
 
 in stdenv.mkDerivation rec {
   pname = "prowlarr";
-  version = "1.0.0.2171";
+  version = "1.0.1.2210";
 
   src = fetchurl {
     url = "https://github.com/Prowlarr/Prowlarr/releases/download/v${version}/Prowlarr.develop.${version}.${os}-core-${arch}.tar.gz";
diff --git a/pkgs/servers/sql/pgbouncer/default.nix b/pkgs/servers/sql/pgbouncer/default.nix
index 0a6bfda03a73f..46030c286a4e6 100644
--- a/pkgs/servers/sql/pgbouncer/default.nix
+++ b/pkgs/servers/sql/pgbouncer/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "pgbouncer";
-  version = "1.17.0";
+  version = "1.18.0";
 
   src = fetchurl {
-    url = "https://pgbouncer.github.io/downloads/files/${version}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-ZXMJt7xceoXL9wqaRBtTX3gkEjCB6rt7qG0ANJolbiM=";
+    url = "https://www.pgbouncer.org/downloads/files/${version}/${pname}-${version}.tar.gz";
+    sha256 = "sha256-k0nJ5Z9viBVjVPT2ryfNsBSiNbAK4YTLqjdoi9DfVEw=";
   };
 
   nativeBuildInputs = [ pkg-config ];
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
 
   meta = with lib; {
-    homepage = "https://pgbouncer.github.io";
+    homepage = "https://www.pgbouncer.org/";
     description = "Lightweight connection pooler for PostgreSQL";
     license = licenses.isc;
     maintainers = with maintainers; [ _1000101 ];
diff --git a/pkgs/servers/sql/pgpool/default.nix b/pkgs/servers/sql/pgpool/default.nix
index 10b8871c57861..f6f40bcd69571 100644
--- a/pkgs/servers/sql/pgpool/default.nix
+++ b/pkgs/servers/sql/pgpool/default.nix
@@ -10,12 +10,12 @@
 
 stdenv.mkDerivation rec {
   pname = "pgpool-II";
-  version = "4.3.3";
+  version = "4.4.1";
 
   src = fetchurl {
     url = "https://www.pgpool.net/mediawiki/download.php?f=pgpool-II-${version}.tar.gz";
     name = "pgpool-II-${version}.tar.gz";
-    sha256 = "sha256-bHNDS67lgThqlVX+WWKL9GeCD31b2+M0F2g5mgOCyXk=";
+    sha256 = "sha256-Szebu6jheBKKHO5KW9GuEW3ts9phIbcowY8PVMiB8yg=";
   };
 
   buildInputs = [
diff --git a/pkgs/servers/sql/postgresql/ext/pg_ivm.nix b/pkgs/servers/sql/postgresql/ext/pg_ivm.nix
index be044befb266f..1def48d46d976 100644
--- a/pkgs/servers/sql/postgresql/ext/pg_ivm.nix
+++ b/pkgs/servers/sql/postgresql/ext/pg_ivm.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pg_ivm";
-  version = "1.3";
+  version = "1.4";
 
   src = fetchFromGitHub {
     owner = "sraoss";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-HdIqAB/A6+EvioKhS2OKmlABjpeTAgkbU5ihbt/OzdI=";
+    hash = "sha256-pz9eHmd7GC30r0uUObOlrcdkAX4c+szjYAXS1U999CE=";
   };
 
   buildInputs = [ postgresql ];
diff --git a/pkgs/servers/sql/postgresql/ext/pgroonga.nix b/pkgs/servers/sql/postgresql/ext/pgroonga.nix
index 05be683f1ff73..0bccc1bfb7a33 100644
--- a/pkgs/servers/sql/postgresql/ext/pgroonga.nix
+++ b/pkgs/servers/sql/postgresql/ext/pgroonga.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "pgroonga";
-  version = "2.4.0";
+  version = "2.4.2";
 
   src = fetchurl {
     url = "https://packages.groonga.org/source/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-W6quDn2B+BZ+J46aNMbtVq7OizT1q5jyKMZECAk0F7M=";
+    sha256 = "sha256-5klltU+9dz30tjE0lQfNinrVEZyT8UpK120kQ1j/yig=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/servers/sql/postgresql/ext/pgrouting.nix b/pkgs/servers/sql/postgresql/ext/pgrouting.nix
index 68aaa1dd0a4ae..5dc21742ef495 100644
--- a/pkgs/servers/sql/postgresql/ext/pgrouting.nix
+++ b/pkgs/servers/sql/postgresql/ext/pgrouting.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "pgrouting";
-  version = "3.3.2";
+  version = "3.4.2";
 
   nativeBuildInputs = [ cmake perl ];
   buildInputs = [ postgresql boost ];
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     owner  = "pgRouting";
     repo   = pname;
     rev    = "v${version}";
-    sha256 = "sha256-H7h+eiH02qLscpiZ8yV5ofL7upeqRBXNQDGYS86f3og=";
+    sha256 = "sha256-By3XX4ow5+OdvpLlpozZe3674VSehO9T96pQtJy5y6g=";
   };
 
   installPhase = ''
diff --git a/pkgs/servers/sql/postgresql/ext/plpgsql_check.nix b/pkgs/servers/sql/postgresql/ext/plpgsql_check.nix
index 3254bf9e2519b..4c5b006099185 100644
--- a/pkgs/servers/sql/postgresql/ext/plpgsql_check.nix
+++ b/pkgs/servers/sql/postgresql/ext/plpgsql_check.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "plpgsql_check";
-  version = "2.2.4";
+  version = "2.2.6";
 
   src = fetchFromGitHub {
     owner = "okbob";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-YUJLh1IgOOnNxPrH8NaY3jGEV+4mTjRffooIANkbbFo=";
+    hash = "sha256-8HFyIzJ1iF3K2vTlibFallvkMKjFTJ2DO64fORToD8E=";
   };
 
   buildInputs = [ postgresql ];
diff --git a/pkgs/servers/tautulli/default.nix b/pkgs/servers/tautulli/default.nix
index eb145bccf0990..e68cbf073e012 100644
--- a/pkgs/servers/tautulli/default.nix
+++ b/pkgs/servers/tautulli/default.nix
@@ -2,7 +2,7 @@
 
 buildPythonApplication rec {
   pname = "Tautulli";
-  version = "2.10.5";
+  version = "2.11.1";
   format = "other";
 
   pythonPath = [ setuptools ];
@@ -12,7 +12,7 @@ buildPythonApplication rec {
     owner = "Tautulli";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-+lXiRM4D9tOE55guond9coFRC61X7CVPS2HjRDtqiII=";
+    sha256 = "sha256-9hWTnBi8t3ZJzrDvvViQ/jYDdbNCabVAion9E9sjqRQ=";
   };
 
   installPhase = ''
@@ -48,6 +48,6 @@ buildPythonApplication rec {
     homepage = "https://tautulli.com/";
     license = licenses.gpl3Plus;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ csingley rhoriguchi ];
+    maintainers = with maintainers; [ rhoriguchi ];
   };
 }
diff --git a/pkgs/servers/tidb/default.nix b/pkgs/servers/tidb/default.nix
new file mode 100644
index 0000000000000..e9fabdfbd687e
--- /dev/null
+++ b/pkgs/servers/tidb/default.nix
@@ -0,0 +1,31 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "tidb";
+  version = "6.5.0";
+
+  src = fetchFromGitHub {
+    owner = "pingcap";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-U3RGQADiS3mNq+4U+Qn+LMYbX8vxkTmofnRc+yrAcIA=";
+  };
+
+  vendorSha256 = "sha256-ljPFNjnmPaUx1PHtjlJh9ubKBDS3PgvbqTce9pi3GSc=";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/pingcap/tidb/dumpling/cli.ReleaseVersion=${version}"
+    "-X github.com/pingcap/tidb/util/versioninfo.TiDBEdition=Community"
+  ];
+
+  subPackages = [ "tidb-server" ];
+
+  meta = with lib; {
+    description = "An open-source, cloud-native, distributed, MySQL-Compatible database for elastic scale and real-time analytics";
+    homepage = "https://pingcap.com";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ candyc1oud ];
+  };
+}
diff --git a/pkgs/servers/web-apps/bookstack/default.nix b/pkgs/servers/web-apps/bookstack/default.nix
index bcac0e37ffc0d..75fe60e2557a1 100644
--- a/pkgs/servers/web-apps/bookstack/default.nix
+++ b/pkgs/servers/web-apps/bookstack/default.nix
@@ -16,13 +16,13 @@ let
 
 in package.override rec {
   pname = "bookstack";
-  version = "22.11";
+  version = "22.11.1";
 
   src = fetchFromGitHub {
     owner = "bookstackapp";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1k82dmlrq0ni9c4wf77d4jzrf24jxi1h5zfsj7132z4ql5di5gz4";
+    sha256 = "sha256-0yofstZiTK/I6c8go5ENivq41nOfL+0mzIHgbQSEUWo=";
   };
 
   meta = with lib; {
diff --git a/pkgs/stdenv/linux/default.nix b/pkgs/stdenv/linux/default.nix
index dbaff342fb1af..5116de9803487 100644
--- a/pkgs/stdenv/linux/default.nix
+++ b/pkgs/stdenv/linux/default.nix
@@ -1,8 +1,61 @@
 # This file constructs the standard build environment for the
-# Linux/i686 platform.  It's completely pure; that is, it relies on no
+# Linux platform.  It's completely pure; that is, it relies on no
 # external (non-Nix) tools, such as /usr/bin/gcc, and it contains a C
 # compiler and linker that do not search in default locations,
 # ensuring purity of components produced by it.
+#
+# It starts from prebuilt seed bootstrapFiles and creates a series of
+# nixpkgs instances (stages) to gradually rebuild stdenv, which
+# is used to build all other packages (including the bootstrapFiles).
+#
+# Goals of the bootstrap process:
+# 1. final stdenv must not reference any of the bootstrap files.
+# 2. final stdenv must not contain any of the bootstrap files
+#    (the only current violation is libgcc_s.so in glibc).
+# 3. final stdenv must not contain any of the files directly
+#    generated by the bootstrap code generators (assembler, linker,
+#    compiler). The only current violations are: libgcc_s.so in glibc,
+#    the lib{mpfr,mpc,gmp,isl} which are statically linked
+#    into the final gcc).
+#
+# These goals ensure that final packages and final stdenv are built
+# exclusively using nixpkgs package definitions and don't depend
+# on bootstrapTools (via direct references, inclusion
+# of copied code, or code compiled directly by bootstrapTools).
+#
+# Stages are described below along with their definitions.
+#
+# Debugging stdenv dependency graph:
+# An useful tool to explore dependencies across stages is to use
+# '__bootPackages' attribute of 'stdenv. Examples of last 3 stages:
+# - stdenv
+# - stdenv.__bootPackages.stdenv
+# - stdenv.__bootPackages.stdenv.__bootPackages.stdenv
+# - ... and so on.
+#
+# To explore build-time dependencies in graphical form one can use
+# the following:
+#     $ nix-store --query --graph $(nix-instantiate -A stdenv) |
+#         grep -P -v '[.]sh|[.]patch|bash|[.]tar' | # avoid clutter
+#         dot -Tsvg > stdenv-final.svg
+#
+# To find all the packages built by a particular stdenv instance:
+#    $ for stage in 0 1 2 3 4; do
+#      echo "stage${stage} used in:"
+#      nix-store --query --graph $(nix-instantiate -A stdenv) |
+#          grep -P ".*bootstrap-stage${stage}-stdenv.*->.*" |
+#          sed 's/"[0-9a-z]\{32\}-/"/g'
+#      done
+#
+# To verify which stdenv was used to build a given final package:
+#     $ nix-store --query --graph $(nix-instantiate -A stdenv) |
+#       grep -P -v '[.]sh|[.]patch|bash|[.]tar' |
+#       grep -P '.*stdenv.*->.*glibc-2'
+#     "...-bootstrap-stage2-stdenv-linux.drv" -> "...-glibc-2.35-224.drv";
+#
+# For a TUI (rather than CLI) view, you can use:
+#
+#     $ nix-tree --derivation $(nix-instantiate -A stdenv)
 { lib
 , localSystem, crossSystem, config, overlays, crossOverlays ? []
 
@@ -147,6 +200,9 @@ in
 
   # Build a dummy stdenv with no GCC or working fetchurl.  This is
   # because we need a stdenv to build the GCC wrapper and fetchurl.
+  #
+  # resulting stage0 stdenv:
+  # - coreutils, binutils, glibc, gcc: from bootstrapFiles
   (prevStage: stageFun prevStage {
     name = "bootstrap-stage0";
 
@@ -202,6 +258,9 @@ in
   # If we ever need to use a package from more than one stage back, we
   # simply re-export those packages in the middle stage(s) using the
   # overrides attribute and the inherit syntax.
+  #
+  # resulting stage1 stdenv:
+  # - coreutils, binutils, glibc, gcc: from bootstrapFiles
   (prevStage: stageFun prevStage {
     name = "bootstrap-stage1";
 
@@ -228,6 +287,10 @@ in
 
   # 2nd stdenv that contains our own rebuilt binutils and is used for
   # compiling our own Glibc.
+  #
+  # resulting stage2 stdenv:
+  # - coreutils, glibc, gcc: from bootstrapFiles
+  # - binutils: from nixpkgs, built by bootstrapFiles toolchain
   (prevStage: stageFun prevStage {
     name = "bootstrap-stage2";
 
@@ -296,6 +359,10 @@ in
   # Construct a third stdenv identical to the 2nd, except that this
   # one uses the rebuilt Glibc from stage2.  It still uses the recent
   # binutils and rest of the bootstrap tools, including GCC.
+  #
+  # resulting stage3 stdenv:
+  # - coreutils, gcc: from bootstrapFiles
+  # - glibc, binutils: from nixpkgs, built by bootstrapFiles toolchain
   (prevStage: stageFun prevStage {
     name = "bootstrap-stage3";
 
@@ -332,6 +399,17 @@ in
 
   # Construct a fourth stdenv that uses the new GCC.  But coreutils is
   # still from the bootstrap tools.
+  #
+  # resulting stage4 stdenv:
+  # - coreutils: from bootstrapFiles
+  # - glibc, binutils: from nixpkgs, built by bootstrapFiles toolchain
+  # - gcc: from nixpkgs, built by bootstrapFiles toolchain. Can assume
+  #        it has almost no code from bootstrapTools as gcc bootstraps
+  #        internally. The only exceptions are crt files from glibc
+  #        built by bootstrapTools used to link executables and libraries,
+  #        and the bootstrapTools-built, statically-linked
+  #        lib{mpfr,mpc,gmp,isl}.a which are linked into the final gcc
+  #        (see commit cfde88976ba4cddd01b1bb28b40afd12ea93a11d).
   (prevStage: stageFun prevStage {
     name = "bootstrap-stage4";
 
@@ -388,6 +466,17 @@ in
   # When updating stdenvLinux, make sure that the result has no
   # dependency (`nix-store -qR') on bootstrapTools or the first
   # binutils built.
+  #
+  # resulting stage5 (final) stdenv:
+  # - coreutils, binutils: from nixpkgs, built by nixpkgs toolchain
+  # - glibc: from nixpkgs, built by bootstrapFiles toolchain
+  # - gcc: from nixpkgs, built by bootstrapFiles toolchain. Can assume
+  #        it has almost no code from bootstrapTools as gcc bootstraps
+  #        internally. The only exceptions are crt files from glibc
+  #        built by bootstrapTools used to link executables and libraries,
+  #        and the bootstrapTools-built, statically-linked
+  #        lib{mpfr,mpc,gmp,isl}.a which are linked into the final gcc
+  #        (see commit cfde88976ba4cddd01b1bb28b40afd12ea93a11d).
   (prevStage: {
     inherit config overlays;
     stdenv = import ../generic rec {
diff --git a/pkgs/tools/X11/xpra/default.nix b/pkgs/tools/X11/xpra/default.nix
index dd94f5ad46a23..05a36726c0c75 100644
--- a/pkgs/tools/X11/xpra/default.nix
+++ b/pkgs/tools/X11/xpra/default.nix
@@ -151,6 +151,7 @@ in buildPythonApplication rec {
     python-uinput
     pyxdg
     rencode
+    invoke
   ] ++ lib.optionals withNvenc [
     pycuda
     pynvml
diff --git a/pkgs/tools/admin/trivy/default.nix b/pkgs/tools/admin/trivy/default.nix
index 9200dd9174957..14e62fa0612ec 100644
--- a/pkgs/tools/admin/trivy/default.nix
+++ b/pkgs/tools/admin/trivy/default.nix
@@ -5,17 +5,17 @@
 
 buildGoModule rec {
   pname = "trivy";
-  version = "0.35.0";
+  version = "0.36.0";
 
   src = fetchFromGitHub {
     owner = "aquasecurity";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-0lEKXCQ7os6hyqEuugNI8ogZiqJZq58VGafEKrcmV3I=";
+    sha256 = "sha256-5yAfF/iRAbCJFXEcdhg7vqiMTpw7NNixFaQU93uSv6I=";
   };
   # hash missmatch on across linux and darwin
   proxyVendor = true;
-  vendorSha256 = "sha256-cl6EShtXhe72fbKIMbma9pEGLPBVSNZMiHWi94BbkMM=";
+  vendorSha256 = "sha256-9oG6xJ0D6SulN6ErC/F5Ycmly4wp+GCF8lftu+xoagE=";
 
   excludedPackages = "misc";
 
diff --git a/pkgs/tools/audio/vgmtools/default.nix b/pkgs/tools/audio/vgmtools/default.nix
index a65ba1b4cda40..9571e1160666b 100644
--- a/pkgs/tools/audio/vgmtools/default.nix
+++ b/pkgs/tools/audio/vgmtools/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vgmtools";
-  version = "unstable-2022-12-03";
+  version = "unstable-2022-12-30";
 
   src = fetchFromGitHub {
     owner = "vgmrips";
     repo = "vgmtools";
-    rev = "b9216623ffb9219c46a7a10669175c7a4c8cd946";
-    sha256 = "fPt/z4D4C8TWoz7FivxmXGDcYGc7sXWvxE0+CoyFgDQ=";
+    rev = "6c2c21dfc871f8cb9c33a77fe7db01419b6ad97d";
+    sha256 = "qe8cHGf8X7JjjoiRQ/S3q/WhyvgrMEwsCo7QoQkmg5w=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/filesystems/garage/default.nix b/pkgs/tools/filesystems/garage/default.nix
index 18c2b96de8078..f41ad499dc096 100644
--- a/pkgs/tools/filesystems/garage/default.nix
+++ b/pkgs/tools/filesystems/garage/default.nix
@@ -84,8 +84,8 @@ in
       version = "0.8.0";
       sha256 = "sha256-c2RhHfg0+YV2E9Ckl1YSc+0nfzbHPIt0JgtT0DND9lA=";
       cargoSha256 = "sha256-vITXckNOiJbMuQW6/8p7dsZThkjxg/zUy3AZBbn33no=";
-      # On Darwin, tests are failing.
-      broken = stdenv.isDarwin;
+      # On x86_64-darwin, tests are failing.
+      broken = stdenv.isDarwin && stdenv.isx86_64;
     };
 
     garage_0_8 = garage_0_8_0;
diff --git a/pkgs/tools/filesystems/juicefs/default.nix b/pkgs/tools/filesystems/juicefs/default.nix
index 7418e858b20c2..193bc25fbc918 100644
--- a/pkgs/tools/filesystems/juicefs/default.nix
+++ b/pkgs/tools/filesystems/juicefs/default.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "juicefs";
-  version = "1.0.2";
+  version = "1.0.3";
 
   src = fetchFromGitHub {
     owner = "juicedata";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-JxN8p/935k+mWkGNSKrI7jCTxcGs5TcUXcmkDjwnzZg=";
+    sha256 = "sha256-zGVOodjNPH/vCIBEjXo3MTg8McybakMv7tg0Y9ahasU=";
   };
 
-  vendorSha256 = "sha256-rYyzy6UQQu8q+ei4GAEEq+JPhAAUvHcRpIzNts150OA=";
+  vendorSha256 = "sha256-YzFGqn9r06TEMiKuuUbUkoacFpsAOPopX9MNB4mlTIM=";
 
   ldflags = [ "-s" "-w" ];
 
diff --git a/pkgs/tools/filesystems/xtreemfs/default.nix b/pkgs/tools/filesystems/xtreemfs/default.nix
index 0effd84566490..6c02117936dac 100644
--- a/pkgs/tools/filesystems/xtreemfs/default.nix
+++ b/pkgs/tools/filesystems/xtreemfs/default.nix
@@ -9,7 +9,7 @@
 , cmake
 , file
 , fuse
-, jdk
+, jdk8
 , openssl
 , python3
 , valgrind
@@ -17,30 +17,49 @@
 }:
 
 stdenv.mkDerivation {
+  pname = "XtreemFS";
+  # using unstable release because stable (v1.5.1) has broken repl java plugin
+  version = "unstable-2015-06-17";
+
   src = fetchFromGitHub {
-    # using unstable release because stable (v1.5.1) has broken repl java plugin
     rev = "7ddcb081aa125b0cfb008dc98addd260b8353ab3";
     owner = "xtreemfs";
     repo = "xtreemfs";
     sha256 = "1hjmd32pla27zf98ghzz6r5ml8ry86m9dsryv1z01kxv5l95b3m0";
   };
 
-  pname = "XtreemFS";
-  version = "1.5.1.81";
-
   nativeBuildInputs = [ makeWrapper python3 ];
   buildInputs = [ which attr ];
 
   patches = [
     (fetchpatch {
+      name = "protobuf-add-arm64-atomicops.patch";
+      url = "https://github.com/protocolbuffers/protobuf/commit/2ca19bd8066821a56f193e7fca47139b25c617ad.patch";
+      stripLen = 1;
+      extraPrefix = "cpp/thirdparty/protobuf-2.5.0/";
+      sha256 = "sha256-hlL5ZiJhpO3fPpcSTV+yki4zahg/OhFdIZEGF1TNTe0=";
+    })
+    (fetchpatch {
+      name = "protobuf-add-aarch64-architecture-to-platform-macros.patch";
+      url = "https://github.com/protocolbuffers/protobuf/commit/f0b6a5cfeb5f6347c34975446bda08e0c20c9902.patch";
+      stripLen = 1;
+      extraPrefix = "cpp/thirdparty/protobuf-2.5.0/";
+      sha256 = "sha256-VRl303x9g5ES/LMODcAdhsPiEmQTq/qXhE/DfvLXF84=";
+    })
+    (fetchpatch {
+      name = "xtreemfs-fix-for-boost-version-1.66.patch";
+      url = "https://github.com/xtreemfs/xtreemfs/commit/aab843cb115ab0739edf7f58fd2d4553a05374a8.patch";
+      sha256 = "sha256-y/vXI/PT1TwSy8/73+RKIgKq4pZ9i22MBxr6jo/M5l8=";
+    })
+    (fetchpatch {
+      name = "xtreemfs-fix-for-openssl_1_1.patch";
       url = "https://github.com/xtreemfs/xtreemfs/commit/ebfdc2fff56c09f310159d92026883941e42a953.patch";
       sha256 = "075w00ad88qm6xpm5679m0gfzkrc53w17sk7ycybf4hzxjs29ygy";
-      name = "xtreemfs-fix-for-openssl_1_1";
     })
   ];
 
   preConfigure = ''
-    export JAVA_HOME=${jdk}
+    export JAVA_HOME=${jdk8}
     export ANT_HOME=${ant}
 
     export BOOST_INCLUDEDIR=${boost.dev}/include
@@ -90,7 +109,5 @@ stdenv.mkDerivation {
     maintainers = with lib.maintainers; [ raskin matejc ];
     platforms = lib.platforms.linux;
     license = lib.licenses.bsd3;
-    # never built on aarch64-linux since first introduction in nixpkgs
-    broken = stdenv.isLinux && stdenv.isAarch64;
   };
 }
diff --git a/pkgs/tools/graphics/barcode/default.nix b/pkgs/tools/graphics/barcode/default.nix
index eed06602a5ddf..9eb368b83af60 100644
--- a/pkgs/tools/graphics/barcode/default.nix
+++ b/pkgs/tools/graphics/barcode/default.nix
@@ -16,12 +16,14 @@ stdenv.mkDerivation rec {
     })
   ];
 
+  configureFlags = lib.optional stdenv.isDarwin "ac_cv_func_calloc_0_nonnull=yes";
+
   hardeningDisable = [ "format" ];
 
   meta = with lib; {
     description = "GNU barcode generator";
     maintainers = with maintainers; [ raskin ];
-    platforms = platforms.linux; # Maybe other non-darwin Unix
+    platforms = platforms.unix;
     downloadPage = "https://ftp.gnu.org/gnu/barcode/";
     homepage = "https://www.gnu.org/software/barcode/";
     license = licenses.gpl3;
diff --git a/pkgs/tools/graphics/sanjuuni/default.nix b/pkgs/tools/graphics/sanjuuni/default.nix
new file mode 100644
index 0000000000000..bccb336b702ce
--- /dev/null
+++ b/pkgs/tools/graphics/sanjuuni/default.nix
@@ -0,0 +1,44 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, pkg-config
+, ffmpeg
+, poco
+}:
+
+stdenv.mkDerivation rec {
+  pname = "sanjuuni";
+  version = "0.2";
+
+  src = fetchFromGitHub {
+    owner = "MCJack123";
+    repo = "sanjuuni";
+    rev = version;
+    sha256 = "sha256-WWDbPwiU4YD8XCMuqLWEGinpHkq2FNJZsz3GyVqjDHQ=";
+  };
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    ffmpeg
+    poco
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm755 sanjuuni $out/bin/sanjuuni
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/MCJack123/sanjuuni";
+    description = "A command-line tool that converts images and videos into a format that can be displayed in ComputerCraft";
+    maintainers = [ maintainers.tomodachi94 ];
+    license = licenses.gpl2Plus;
+    broken = stdenv.isDarwin;
+  };
+}
diff --git a/pkgs/tools/inputmethods/remote-touchpad/default.nix b/pkgs/tools/inputmethods/remote-touchpad/default.nix
index 35e334a2fe7f1..a086892caf444 100644
--- a/pkgs/tools/inputmethods/remote-touchpad/default.nix
+++ b/pkgs/tools/inputmethods/remote-touchpad/default.nix
@@ -1,27 +1,27 @@
 { buildGoModule
 , fetchFromGitHub
 , lib
-, libX11
 , libXi
+, libXrandr
 , libXt
 , libXtst
 }:
 
 buildGoModule rec {
   pname = "remote-touchpad";
-  version = "1.2.2";
+  version = "1.2.3";
 
   src = fetchFromGitHub {
     owner = "unrud";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-KkrBWrZBvALM0TdF8AlW5Zf+r8EO9I76Otkq4cA+ikg=";
+    sha256 = "sha256-Yakx4eHcw3p8UAg3zAiWVrZyOFChhC5wWa0uJIKJn5g=";
   };
 
-  buildInputs = [ libX11 libXi libXt libXtst ];
+  buildInputs = [ libXi libXrandr libXt libXtst ];
   tags = [ "portal,x11" ];
 
-  vendorSha256 = "sha256-lEl0SOqbw6PARgO1qIN20p13BbexfCeJug1ZkuahV+k=";
+  vendorSha256 = "sha256-xlGAxKr2fav8WgAO+zW6ZTL7QgkdyUqRdQIOErDjRTg=";
 
   meta = with lib; {
     description = "Control mouse and keyboard from the webbrowser of a smartphone.";
diff --git a/pkgs/tools/misc/fend/default.nix b/pkgs/tools/misc/fend/default.nix
index 453697e8a5cc8..ecf2a4bf0e5a7 100644
--- a/pkgs/tools/misc/fend/default.nix
+++ b/pkgs/tools/misc/fend/default.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "fend";
-  version = "1.1.1";
+  version = "1.1.3";
 
   src = fetchFromGitHub {
     owner = "printfn";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-1hoMIZ4mfXYF+ec/Eax2fSNBbx+UEY2c/jQCaRi+UqU=";
+    sha256 = "sha256-3A+MxRonN1dhF7PrsGgc6zai1TQ9K8YIyqD0lqa3/EY=";
   };
 
-  cargoSha256 = "sha256-jGPS9x4DKQCXZkaJu9qIEqoxIu+1WraqfqxGFRV5z7A=";
+  cargoSha256 = "sha256-VgueZKMDI35ERQR+V2SFxnUplHFS0LbJlGb/bRXUYWk=";
 
   nativeBuildInputs = [ pandoc installShellFiles ];
   buildInputs = lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.Security ];
diff --git a/pkgs/tools/misc/hoard/default.nix b/pkgs/tools/misc/hoard/default.nix
index e69b517b4e15b..1eb1080c16b86 100644
--- a/pkgs/tools/misc/hoard/default.nix
+++ b/pkgs/tools/misc/hoard/default.nix
@@ -2,13 +2,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "hoard";
-  version = "1.0.1";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "Hyde46";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-xXZ1bbCRhS8/rb1eIErvw2wEWF1unLXSP/YKn5Z4Vwo=";
+    sha256 = "sha256-WCyu6vW0l8J2Xh8OGXMXVDBs287m2nPlRHeA0j8uvlk=";
   };
 
   buildInputs = [ ncurses openssl ]
@@ -16,7 +16,7 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  cargoSha256 = "sha256-c60yxbZG258R5iH6x0LhipbyXal/kDxddEzTfl82hCE=";
+  cargoSha256 = "sha256-Cku9NnrjWT7VmOCryb0sbCQibG+iU9CHT3Cvd6M/9f4=";
 
   meta = with lib; {
     description = "CLI command organizer written in rust";
diff --git a/pkgs/tools/misc/mmctl/default.nix b/pkgs/tools/misc/mmctl/default.nix
index 459cc0d90a5d0..a708e9e694eb9 100644
--- a/pkgs/tools/misc/mmctl/default.nix
+++ b/pkgs/tools/misc/mmctl/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "mmctl";
-  version = "7.5.1";
+  version = "7.5.2";
 
   src = fetchFromGitHub {
     owner = "mattermost";
     repo = "mmctl";
     rev = "v${version}";
-    sha256 = "sha256-pNO0FBL1NM4SoKPEjUETeQ/hwdhJj5XpUIXJJ0mfH5M=";
+    sha256 = "sha256-qBt7YL4u/gt7pPjqXLvjtTH6Dhr3udcqAD1/VjxyJPg=";
   };
 
   vendorSha256 = null;
diff --git a/pkgs/tools/misc/moar/default.nix b/pkgs/tools/misc/moar/default.nix
index 50c2a1f4fdc43..8c76dfd60d36f 100644
--- a/pkgs/tools/misc/moar/default.nix
+++ b/pkgs/tools/misc/moar/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "moar";
-  version = "1.11.2";
+  version = "1.11.3";
 
   src = fetchFromGitHub {
     owner = "walles";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-UzgGJrnckiuUT4JYSTQ4TargO4B2sjVMMOYygg7wGps=";
+    sha256 = "sha256-j/nxZgaK8WZadYjc7f4nJUn282YfBeflWh7lSjA4QVs=";
   };
 
   vendorSha256 = "sha256-XexIBg49gK+b2Zef5eR7NfqFZHPp5DXhlcC3Loh6PfI=";
diff --git a/pkgs/tools/misc/nurl/default.nix b/pkgs/tools/misc/nurl/default.nix
index f52ecf18b8cf1..6f0cf9bdfefaa 100644
--- a/pkgs/tools/misc/nurl/default.nix
+++ b/pkgs/tools/misc/nurl/default.nix
@@ -1,6 +1,7 @@
 { lib
 , rustPlatform
 , fetchFromGitHub
+, installShellFiles
 , makeWrapper
 , gitMinimal
 , mercurial
@@ -9,24 +10,31 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "nurl";
-  version = "0.1.1";
+  version = "0.3.1";
 
   src = fetchFromGitHub {
     owner = "nix-community";
     repo = "nurl";
     rev = "v${version}";
-    hash = "sha256-dN53Xpb3zOVI6Xpi+RRFQPLIMP3+ATMXpYpFGgFpzPw=";
+    hash = "sha256-fLa9gNdwBOSOMisU1UI8KAKGOkDN13LZsBpH+bObqUM=";
   };
 
-  cargoSha256 = "sha256-bdxHxLUeIPlRw7NKg0nTaDAkQam80eepqbuAmFVIMNs=";
+  cargoSha256 = "sha256-vyhsZYYSpR2qbwTXOw8e1DFRQ78RVHktK6zCbiXT7RI=";
 
-  nativeBuildInputs = [ makeWrapper ];
+  nativeBuildInputs = [
+    installShellFiles
+    makeWrapper
+  ];
 
   postInstall = ''
     wrapProgram $out/bin/nurl \
       --prefix PATH : ${lib.makeBinPath [ gitMinimal mercurial nix ]}
+    installManPage artifacts/nurl.1
+    installShellCompletion artifacts/nurl.{bash,fish} --zsh artifacts/_nurl
   '';
 
+  GEN_ARTIFACTS = "artifacts";
+
   meta = with lib; {
     description = "Command-line tool to generate Nix fetcher calls from repository URLs";
     homepage = "https://github.com/nix-community/nurl";
diff --git a/pkgs/tools/misc/open-pdf-sign/default.nix b/pkgs/tools/misc/open-pdf-sign/default.nix
index 66cccb2402332..ca18fb3a0466d 100644
--- a/pkgs/tools/misc/open-pdf-sign/default.nix
+++ b/pkgs/tools/misc/open-pdf-sign/default.nix
@@ -1,12 +1,12 @@
 { lib, stdenv, fetchurl, makeWrapper, jre, nix-update-script }:
 
 stdenv.mkDerivation rec {
-  version = "0.1.1";
+  version = "0.1.2";
   pname = "open-pdf-sign";
 
   src = fetchurl {
     url = "https://github.com/open-pdf-sign/open-pdf-sign/releases/download/v${version}/open-pdf-sign.jar";
-    sha256 = "sha256-n8ua/wUz/PquB7viaFqBu2XX1KQYago4s6JUwYRLvNA=";
+    sha256 = "sha256-k7ECqrZj7MXbQN5HCcVNcKbLe9LjigQboYs65gf4awA=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/misc/star-history/default.nix b/pkgs/tools/misc/star-history/default.nix
index b10ce6a38ceca..984adf51f5d25 100644
--- a/pkgs/tools/misc/star-history/default.nix
+++ b/pkgs/tools/misc/star-history/default.nix
@@ -9,14 +9,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "star-history";
-  version = "1.0.7";
+  version = "1.0.8";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-Cn05HX4GbHTwMwWxP3x0EtDEFqmn93eA+g4AXFFNNgE=";
+    sha256 = "sha256-ya2wUcO/2V/JHJ005p63j9Qu6oQehGYDhCYE7a5MBDA=";
   };
 
-  cargoSha256 = "sha256-UnlTpuYoyvu3MK87zogwzmKhGJwIENws1Ak4VYnfTBI=";
+  cargoSha256 = "sha256-zmgOQNaodZrl/rsYOpv6nTu/IDaQYQ94jeUg3LOvvuA=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/tools/misc/yt-dlp/default.nix b/pkgs/tools/misc/yt-dlp/default.nix
index 1b01cca1a3f9f..4bcb98532ebad 100644
--- a/pkgs/tools/misc/yt-dlp/default.nix
+++ b/pkgs/tools/misc/yt-dlp/default.nix
@@ -20,11 +20,11 @@ buildPythonPackage rec {
   # The websites yt-dlp deals with are a very moving target. That means that
   # downloads break constantly. Because of that, updates should always be backported
   # to the latest stable release.
-  version = "2022.11.11";
+  version = "2023.1.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-9rliAjwXp3FRR28Pbtcb6H0Bdim6XZmUUovFSFIRkbY=";
+    sha256 = "sha256-uNe7tcFZX3GIVaMfNNigJ2pwhvXT9ULAIaje2LJtNq4=";
   };
 
   propagatedBuildInputs = [ brotli certifi mutagen pycryptodomex websockets ];
diff --git a/pkgs/tools/networking/cadaver/configure.patch b/pkgs/tools/networking/cadaver/configure.patch
deleted file mode 100644
index b618099b371a9..0000000000000
--- a/pkgs/tools/networking/cadaver/configure.patch
+++ /dev/null
@@ -1,20 +0,0 @@
---- a/configure.orig
-+++ b/configure
-@@ -9595,7 +9595,7 @@ fi
- $as_echo "$ne_cv_lib_neon" >&6; }
-     if test "$ne_cv_lib_neon" = "yes"; then
-        ne_cv_lib_neonver=no
--       for v in 27 28 29; do
-+       for v in 27 28 29 30 31; do
-           case $ne_libver in
-           0.$v.*) ne_cv_lib_neonver=yes ;;
-           esac
-@@ -10328,7 +10328,7 @@ fi
- $as_echo "$ne_cv_lib_neon" >&6; }
-     if test "$ne_cv_lib_neon" = "yes"; then
-        ne_cv_lib_neonver=no
--       for v in 27 28 29; do
-+       for v in 27 28 29 30 31; do
-           case $ne_libver in
-           0.$v.*) ne_cv_lib_neonver=yes ;;
-           esac
diff --git a/pkgs/tools/networking/cadaver/default.nix b/pkgs/tools/networking/cadaver/default.nix
index e8c57e529cf32..d94c89371b1b8 100644
--- a/pkgs/tools/networking/cadaver/default.nix
+++ b/pkgs/tools/networking/cadaver/default.nix
@@ -1,35 +1,41 @@
-{ lib, stdenv, fetchurl, fetchpatch, neon, pkg-config, readline, zlib, openssl }:
+{ lib
+, stdenv
+, fetchurl
+, neon
+, pkg-config
+, zlib
+, openssl
+}:
 
 stdenv.mkDerivation rec {
   pname = "cadaver";
-  version = "0.23.3";
+  version = "0.24";
 
   src = fetchurl {
-    url = "http://www.webdav.org/cadaver/cadaver-${version}.tar.gz";
-    sha256 = "1jizq69ifrjbjvz5y79wh1ny94gsdby4gdxwjad4bfih6a5fck7x";
+    url = "https://notroj.github.io/cadaver/cadaver-${version}.tar.gz";
+    hash = "sha256-Rs/y8+vTLNMoNoEspHvMdTU/wr51fwk9qIwN2PEP1fY=";
   };
 
-  patches = [
-    (fetchpatch {
-      url = "https://projects.archlinux.org/svntogit/community.git/plain/trunk/disable-sslv2.patch?h=packages/cadaver";
-      name = "disable-sslv2.patch";
-      sha256 = "1qx65hv584wdarks51yhd3y38g54affkphm5wz27xiz4nhmbssrr";
-    })
-    # Cadaver also works with newer versions of neon than stated
-    # in the configure script
-    ./configure.patch
+  configureFlags = [
+    "--with-ssl"
   ];
 
-  configureFlags = [ "--with-ssl" "--with-readline" ];
+  nativeBuildInputs = [
+    pkg-config
+  ];
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ neon readline zlib openssl ];
+  buildInputs = [
+    neon
+    openssl
+    zlib
+  ];
 
   meta = with lib; {
     description = "A command-line WebDAV client";
-    homepage    = "http://www.webdav.org/cadaver";
+    homepage = "https://notroj.github.io/cadaver/";
+    changelog = "https://github.com/notroj/cadaver/blob/${version}/NEWS";
     maintainers = with maintainers; [ ianwookim ];
-    license     = licenses.gpl2;
-    platforms   = with platforms; linux ++ freebsd ++ openbsd;
+    license = licenses.gpl2Plus;
+    platforms = with platforms; linux ++ freebsd ++ openbsd;
   };
 }
diff --git a/pkgs/tools/networking/chrony/default.nix b/pkgs/tools/networking/chrony/default.nix
index de710e6b3f18f..2b1bee85bcff0 100644
--- a/pkgs/tools/networking/chrony/default.nix
+++ b/pkgs/tools/networking/chrony/default.nix
@@ -1,5 +1,7 @@
-{ lib, stdenv, fetchurl, pkg-config, libcap, readline, texinfo, nss, nspr
-, libseccomp, pps-tools, gnutls }:
+{ lib, stdenv, fetchurl, pkg-config
+, gnutls, libedit, nspr, nss, readline, texinfo
+, libcap, libseccomp, pps-tools
+}:
 
 stdenv.mkDerivation rec {
   pname = "chrony";
@@ -7,22 +9,33 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://download.tuxfamily.org/chrony/${pname}-${version}.tar.gz";
-    sha256 = "sha256-nQ2oiahl8ImlohYQ/7ZxPjyUOM4wOmO0nC+26v9biAQ=";
+    hash = "sha256-nQ2oiahl8ImlohYQ/7ZxPjyUOM4wOmO0nC+26v9biAQ=";
   };
 
+  outputs = [ "out" "man" ];
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [ gnutls libedit nspr nss readline texinfo ]
+    ++ lib.optionals stdenv.isLinux [ libcap libseccomp pps-tools ];
+
+  configureFlags = [
+    "--enable-ntp-signd"
+    "--sbindir=$(out)/bin"
+    "--chronyrundir=/run/chrony"
+  ] ++ lib.optional stdenv.isLinux "--enable-scfilter";
+
+  patches = [
+    # Cleanup the installation script
+    ./makefile.patch
+  ];
+
   postPatch = ''
     patchShebangs test
   '';
 
-  buildInputs = [ readline texinfo nss nspr gnutls ]
-    ++ lib.optionals stdenv.isLinux [ libcap libseccomp pps-tools ];
-  nativeBuildInputs = [ pkg-config ];
-
   hardeningEnable = [ "pie" ];
 
-  configureFlags = [ "--chronyvardir=$(out)/var/lib/chrony" "--enable-ntp-signd" ]
-    ++ lib.optional stdenv.isLinux "--enable-scfilter";
-
   meta = with lib; {
     description = "Sets your computer's clock from time servers on the Net";
     homepage = "https://chrony.tuxfamily.org/";
diff --git a/pkgs/tools/networking/chrony/makefile.patch b/pkgs/tools/networking/chrony/makefile.patch
new file mode 100644
index 0000000000000..be15ccb5cb22a
--- /dev/null
+++ b/pkgs/tools/networking/chrony/makefile.patch
@@ -0,0 +1,23 @@
+diff --git a/Makefile.in b/Makefile.in
+index ef100a4..47f54f4 100644
+--- a/Makefile.in
++++ b/Makefile.in
+@@ -23,7 +23,7 @@
+ 
+ SYSCONFDIR = @SYSCONFDIR@
+ BINDIR = @BINDIR@
+-SBINDIR = @SBINDIR@
++SBINDIR = @BINDIR@
+ LOCALSTATEDIR = @LOCALSTATEDIR@
+ CHRONYVARDIR = @CHRONYVARDIR@
+ DESTDIR =
+@@ -86,9 +86,7 @@ getdate :
+ 
+ install: chronyd chronyc
+ 	[ -d $(DESTDIR)$(SYSCONFDIR) ] || mkdir -p $(DESTDIR)$(SYSCONFDIR)
+-	[ -d $(DESTDIR)$(SBINDIR) ] || mkdir -p $(DESTDIR)$(SBINDIR)
+ 	[ -d $(DESTDIR)$(BINDIR) ] || mkdir -p $(DESTDIR)$(BINDIR)
+-	[ -d $(DESTDIR)$(CHRONYVARDIR) ] || mkdir -p $(DESTDIR)$(CHRONYVARDIR)
+ 	if [ -f $(DESTDIR)$(SBINDIR)/chronyd ]; then rm -f $(DESTDIR)$(SBINDIR)/chronyd ; fi
+ 	if [ -f $(DESTDIR)$(BINDIR)/chronyc ]; then rm -f $(DESTDIR)$(BINDIR)/chronyc ; fi
+ 	cp chronyd $(DESTDIR)$(SBINDIR)/chronyd
diff --git a/pkgs/tools/networking/hans/default.nix b/pkgs/tools/networking/hans/default.nix
index 04271d6ef7105..86855cf6034f3 100644
--- a/pkgs/tools/networking/hans/default.nix
+++ b/pkgs/tools/networking/hans/default.nix
@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   pname = "hans";
-  version = "1.0";
+  version = "1.1";
 
   src = fetchFromGitHub {
-    sha256 = "1qnfl7wr5x937b6jx3vhhvnwnrclrqvq7d7zxbfhk74pdwnjy8n4";
+    sha256 = "sha256-r6IDs8Seys94LBNnedcfVX5aW8x//ZN0Yh/DGTg8niA=";
     rev = "v${version}";
     repo = "hans";
     owner = "friedrich";
diff --git a/pkgs/tools/networking/pathvector/default.nix b/pkgs/tools/networking/pathvector/default.nix
index 4ca1504070a24..b6c0f0b05cbd5 100644
--- a/pkgs/tools/networking/pathvector/default.nix
+++ b/pkgs/tools/networking/pathvector/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "pathvector";
-  version = "6.0.2";
+  version = "6.0.3";
 
   src = fetchFromGitHub {
     owner = "natesales";
     repo = "pathvector";
     rev = "v${version}";
-    sha256 = "sha256-Rr7SVvi2K20qFTd4Gd2BzBTVIa/lCeBAJHLZ6iV2aSw=";
+    sha256 = "sha256-WY9208bbJOSDJ9WaV8KIr65GZjqhFjdzwTga0u4oQo4=";
   };
 
-  vendorSha256 = "sha256-bqfYILEGgbnla7EUrzjIO2mMAuL6e4WI2OHUwOr6i+g=";
+  vendorSha256 = "sha256-R3o1L34FXbtRzJ1I2Xj4iWsiFJJWexGWYv2TmvhINe0=";
 
   CGO_ENABLED = 0;
 
diff --git a/pkgs/tools/networking/shadowsocks-rust/default.nix b/pkgs/tools/networking/shadowsocks-rust/default.nix
index 0b203ba2caaee..d4e2b590b08ca 100644
--- a/pkgs/tools/networking/shadowsocks-rust/default.nix
+++ b/pkgs/tools/networking/shadowsocks-rust/default.nix
@@ -1,24 +1,22 @@
-{ lib, stdenv, fetchFromGitHub, rustPlatform, pkg-config, openssl, CoreServices, libiconv }:
+{ lib, stdenv, fetchFromGitHub, rustPlatform, pkg-config, openssl, Security, CoreServices }:
 
 rustPlatform.buildRustPackage rec {
   pname = "shadowsocks-rust";
-  version = "1.14.3";
+  version = "1.15.2";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "shadowsocks";
     repo = pname;
-    sha256 = "sha256-tRiziyCw1Qpm22RtZHeKt4VFReJidFHsPxPSjxIA3hA=";
+    hash = "sha256-CvAOvtC5U2njQuUjFxjnGeqhuxrCw4XI6goo1TxIhIU=";
   };
 
-  cargoSha256 = "sha256-snnzNb1yJ8L5pMvNNEIf5hZOpFV6DKOWGtGP1T3YTWg=";
+  cargoHash = "sha256-ctZlYo82M7GKVvrEkw/7+aH9R0MeEsyv3IKl9k4SbiA=";
 
-  RUSTC_BOOTSTRAP = 1;
+  nativeBuildInputs = lib.optionals stdenv.isLinux [ pkg-config ];
 
-  nativeBuildInputs = [ pkg-config ];
-
-  buildInputs = [ openssl ]
-    ++ lib.optionals stdenv.isDarwin [ CoreServices libiconv ];
+  buildInputs = lib.optionals stdenv.isLinux [ openssl ]
+    ++ lib.optionals stdenv.isDarwin [ Security CoreServices ];
 
   cargoBuildFlags = [
     "--features=aead-cipher-extra,local-dns,local-http-native-tls,local-redir,local-tun"
@@ -36,8 +34,9 @@ rustPlatform.buildRustPackage rec {
   ];
 
   meta = with lib; {
+    description = "A Rust port of Shadowsocks";
     homepage = "https://github.com/shadowsocks/shadowsocks-rust";
-    description = "A Rust port of shadowsocks";
+    changelog = "https://github.com/shadowsocks/shadowsocks-rust/raw/v${version}/debian/changelog";
     license = licenses.mit;
     maintainers = [ maintainers.marsam ];
   };
diff --git a/pkgs/tools/networking/ssh-askpass-fullscreen/default.nix b/pkgs/tools/networking/ssh-askpass-fullscreen/default.nix
index beb61502ec7f2..3faff612aadc3 100644
--- a/pkgs/tools/networking/ssh-askpass-fullscreen/default.nix
+++ b/pkgs/tools/networking/ssh-askpass-fullscreen/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ssh-askpass-fullscreen";
-  version = "1.2";
+  version = "1.3";
 
   src = fetchFromGitHub {
     owner = "atj";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1zldhylln412974cnxyqcrrc6b4ry3m9s5ijq3dnwz2g7nz1bx9d";
+    sha256 = "sha256-1GER+SxTpbMiYLwFCwLX/hLvzCIqutyvQc9DNJ7d1C0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/networking/xray/default.nix b/pkgs/tools/networking/xray/default.nix
index e3878111d24ca..29b898e8da11b 100644
--- a/pkgs/tools/networking/xray/default.nix
+++ b/pkgs/tools/networking/xray/default.nix
@@ -20,16 +20,16 @@ let
 in
 buildGoModule rec {
   pname = "xray";
-  version = "1.6.6-2";
+  version = "1.7.0";
 
   src = fetchFromGitHub {
     owner = "XTLS";
     repo = "Xray-core";
     rev = "v${version}";
-    sha256 = "sha256-nNG1HNsV/ITWdM9a4KkV44Oq/P92yD/oQjO7+pSBX38=";
+    sha256 = "sha256-aNIb90obew+tvd/rYVddK1MmUqLXSqi9xAu65BQFvk0=";
   };
 
-  vendorSha256 = "sha256-64pyrhPplki0R+rsjh6pi+PCOzWVbES40r0Z1Vhk44o=";
+  vendorSha256 = "sha256-zZdUPjlul9f1jKy0Zf79KOToHIsvfgwDp6XpFPYyTzk=";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/tools/nix/nixdoc/default.nix b/pkgs/tools/nix/nixdoc/default.nix
index 945809e7a7673..be485f9065531 100644
--- a/pkgs/tools/nix/nixdoc/default.nix
+++ b/pkgs/tools/nix/nixdoc/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, rustPlatform, darwin }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, rustPlatform, darwin }:
 
 rustPlatform.buildRustPackage rec {
   pname = "nixdoc";
@@ -11,6 +11,14 @@ rustPlatform.buildRustPackage rec {
     sha256 = "14d4dq06jdqazxvv7fq5872zy0capxyb0fdkp8qg06gxl1iw201s";
   };
 
+  patches = [
+    # Support nested identifiers https://github.com/nix-community/nixdoc/pull/27
+    (fetchpatch {
+      url = "https://github.com/nix-community/nixdoc/pull/27/commits/ea542735bf675fe2ccd37edaffb9138d1a8c1b7e.patch";
+      sha256 = "1fmz44jv2r9qsnjxvkkjfb0safy69l4x4vx1g5gisrp8nwdn94rj";
+    })
+  ];
+
   buildInputs =  lib.optionals stdenv.isDarwin [ darwin.Security ];
 
   cargoSha256 = "1nv6g8rmjjbwqmjkrpqncypqvx5c7xp2zlx5h6rw2j9d1wlys0v5";
diff --git a/pkgs/tools/security/age/default.nix b/pkgs/tools/security/age/default.nix
index 2e9d988500f19..588285973e479 100644
--- a/pkgs/tools/security/age/default.nix
+++ b/pkgs/tools/security/age/default.nix
@@ -1,17 +1,38 @@
-{ lib, buildGoModule, fetchFromGitHub, installShellFiles }:
+{ lib, buildGoModule, fetchFromGitHub, fetchpatch, installShellFiles }:
 
 buildGoModule rec {
   pname = "age";
-  version = "1.0.0";
-  vendorSha256 = "sha256-Hdsd+epcLFLkeHzJ2CUu4ss1qOd0+lTjhfs9MhI5Weg=";
+  version = "1.1.1";
+  vendorSha256 = "sha256-MumPdRTz840+hoisJ7ADgBhyK3n8P6URobbRJYDFkDY=";
 
   src = fetchFromGitHub {
     owner = "FiloSottile";
     repo = "age";
     rev = "v${version}";
-    sha256 = "sha256-MfyW8Yv8swKqA7Hl45l5Zn4wZrQmE661eHsKIywy36U=";
+    sha256 = "sha256-LRxxJQLQkzoCNYGS/XBixVmYXoZ1mPHKvFicPGXYLcw=";
   };
 
+  # Worked with the upstream to change the way test vectors were sourced from
+  # another repo at test run time, so we can run test without network access.
+  # https://github.com/FiloSottile/age/pull/476
+  #
+  # Changes landed after v1.1.1, so we'll patch this one until next release.
+  patches = [
+    # Revert "all: temporarily disable testscript tests"
+    (fetchpatch {
+      name = "0001-revert-temporarily-disabled-testscript-tests.patch";
+      url = "https://github.com/FiloSottile/age/commit/5471e05672de168766f5f11453fd324c53c264e5.patch";
+      sha256 = "sha256-F3oDhRWJqqcF9MDDWPeO9V/wUGXkmUXY87wgokUIoOk=";
+    })
+
+    # age: depend on c2sp.org/CCTV/age for TestVectors
+    (fetchpatch {
+      name = "0002-depend-on-c2sp_cctv_age__TestVectors.patch";
+      url = "https://github.com/FiloSottile/age/commit/edf7388f7731b274b055dcab3ec4006cc4961b68.patch";
+      sha256 = "sha256-CloCj/uF3cqTeCfRkV6TeYiovuDQXm1ZIklREWAot1E=";
+    })
+  ];
+
   ldflags = [
     "-s" "-w" "-X main.Version=${version}"
   ];
diff --git a/pkgs/tools/security/gnupg/23.nix b/pkgs/tools/security/gnupg/23.nix
index 0b7941ce46e18..2030e8195e680 100644
--- a/pkgs/tools/security/gnupg/23.nix
+++ b/pkgs/tools/security/gnupg/23.nix
@@ -57,7 +57,8 @@ stdenv.mkDerivation rec {
     "--with-ksba-prefix=${libksba.dev}"
     "--with-npth-prefix=${npth}"
   ] ++ lib.optional guiSupport "--with-pinentry-pgm=${pinentry}/${pinentryBinaryPath}"
-  ++ lib.optional withTpm2Tss "--with-tss=intel";
+  ++ lib.optional withTpm2Tss "--with-tss=intel"
+  ++ lib.optional stdenv.isDarwin "--disable-ccid-driver";
   postInstall = if enableMinimal
   then ''
     rm -r $out/{libexec,sbin,share}
diff --git a/pkgs/tools/security/metasploit/Gemfile b/pkgs/tools/security/metasploit/Gemfile
index 44bc53c3758a4..af741dbed2144 100644
--- a/pkgs/tools/security/metasploit/Gemfile
+++ b/pkgs/tools/security/metasploit/Gemfile
@@ -1,4 +1,4 @@
 # frozen_string_literal: true
 source "https://rubygems.org"
 
-gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.2.32"
+gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.2.33"
diff --git a/pkgs/tools/security/metasploit/Gemfile.lock b/pkgs/tools/security/metasploit/Gemfile.lock
index 0b6562f274230..d68346b54c326 100644
--- a/pkgs/tools/security/metasploit/Gemfile.lock
+++ b/pkgs/tools/security/metasploit/Gemfile.lock
@@ -1,9 +1,9 @@
 GIT
   remote: https://github.com/rapid7/metasploit-framework
-  revision: 70f696d7322148eba2fca49c5219dcb9a0133c6e
-  ref: refs/tags/6.2.32
+  revision: c2aca5f1d6a798c3c595ef6953172def7bf532d5
+  ref: refs/tags/6.2.33
   specs:
-    metasploit-framework (6.2.32)
+    metasploit-framework (6.2.33)
       actionpack (~> 6.0)
       activerecord (~> 6.0)
       activesupport (~> 6.0)
@@ -128,7 +128,7 @@ GEM
     arel-helpers (2.14.0)
       activerecord (>= 3.1.0, < 8)
     aws-eventstream (1.2.0)
-    aws-partitions (1.684.0)
+    aws-partitions (1.686.0)
     aws-sdk-core (3.168.4)
       aws-eventstream (~> 1, >= 1.0.2)
       aws-partitions (~> 1, >= 1.651.0)
@@ -249,7 +249,7 @@ GEM
     metasploit_payloads-mettle (1.0.20)
     method_source (1.0.0)
     mini_portile2 (2.8.1)
-    minitest (5.16.3)
+    minitest (5.17.0)
     mqtt (0.5.0)
     msgpack (1.6.0)
     multi_json (1.15.0)
@@ -290,7 +290,7 @@ GEM
     puma (6.0.1)
       nio4r (~> 2.0)
     racc (1.6.2)
-    rack (2.2.4)
+    rack (2.2.5)
     rack-protection (3.0.5)
       rack
     rack-test (2.0.2)
diff --git a/pkgs/tools/security/metasploit/default.nix b/pkgs/tools/security/metasploit/default.nix
index 59954f489397f..5241622aa0e89 100644
--- a/pkgs/tools/security/metasploit/default.nix
+++ b/pkgs/tools/security/metasploit/default.nix
@@ -15,13 +15,13 @@ let
   };
 in stdenv.mkDerivation rec {
   pname = "metasploit-framework";
-  version = "6.2.32";
+  version = "6.2.33";
 
   src = fetchFromGitHub {
     owner = "rapid7";
     repo = "metasploit-framework";
     rev = version;
-    sha256 = "sha256-uadIhrmrvdxzp4PchPHOy9beODME0hhgNqEqGqxyAZ8=";
+    sha256 = "sha256-b7MBY+rQxDlXBJumtA7Kqm2yXDP8hEVaCfo8ydreWoY=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/security/metasploit/gemset.nix b/pkgs/tools/security/metasploit/gemset.nix
index 31123befc2d84..1dbe5352f05a9 100644
--- a/pkgs/tools/security/metasploit/gemset.nix
+++ b/pkgs/tools/security/metasploit/gemset.nix
@@ -104,10 +104,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "16jpljblpy5drx2fj8nwsw41mmwp7xkadhrigp4rsiny4lb80qg8";
+      sha256 = "07gdradgxbkr5vjnc4gxcm01sahidx6yqc9fr8a8i1z4ivydzhz9";
       type = "gem";
     };
-    version = "1.684.0";
+    version = "1.686.0";
   };
   aws-sdk-core = {
     groups = ["default"];
@@ -604,12 +604,12 @@
     platforms = [];
     source = {
       fetchSubmodules = false;
-      rev = "70f696d7322148eba2fca49c5219dcb9a0133c6e";
-      sha256 = "17q1fan1lam16rh1ilh46cwdxmnbrvqq9p43lxrxrgdbp634i9xr";
+      rev = "c2aca5f1d6a798c3c595ef6953172def7bf532d5";
+      sha256 = "11jsvvdcjg7s15d4b17w6dfb4vdar87b99lv0ibkki6hx9ih3cvg";
       type = "git";
       url = "https://github.com/rapid7/metasploit-framework";
     };
-    version = "6.2.32";
+    version = "6.2.33";
   };
   metasploit-model = {
     groups = ["default"];
@@ -676,10 +676,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0516ypqlx0mlcfn5xh7qppxqc3xndn1fnadxawa8wld5dkcimy30";
+      sha256 = "1kjy67qajw4rnkbjs5jyk7kc3lyhz5613fwj1i8f6ppdk4zampy0";
       type = "gem";
     };
-    version = "5.16.3";
+    version = "5.17.0";
   };
   mqtt = {
     groups = ["default"];
@@ -947,10 +947,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0axc6w0rs4yj0pksfll1hjgw1k6a5q0xi2lckh91knfb72v348pa";
+      sha256 = "14xjykbmngjhb4p02b7yghf0gqgqjfpi6i028x9g6q6xs782ci3j";
       type = "gem";
     };
-    version = "2.2.4";
+    version = "2.2.5";
   };
   rack-protection = {
     groups = ["default"];
diff --git a/pkgs/tools/system/java-service-wrapper/default.nix b/pkgs/tools/system/java-service-wrapper/default.nix
index 93d86a75d1877..e17271d50ef2c 100644
--- a/pkgs/tools/system/java-service-wrapper/default.nix
+++ b/pkgs/tools/system/java-service-wrapper/default.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "java-service-wrapper";
-  version = "3.5.50";
+  version = "3.5.51";
 
   src = fetchurl {
     url = "https://wrapper.tanukisoftware.com/download/${version}/wrapper_${version}_src.tar.gz";
-    hash = "sha256-Vw5/wN0Yr39bax4XavhM5u+sCgEA7QCrhC2V3BxB7Vo=";
+    hash = "sha256-XkgzggtFLYCt3gP0F4wq38TFHCoo/x+bDzzz/TqmvB0=";
   };
 
   buildInputs = [ jdk ];
diff --git a/pkgs/tools/text/d2/default.nix b/pkgs/tools/text/d2/default.nix
index d3a45b222685e..a020497704d62 100644
--- a/pkgs/tools/text/d2/default.nix
+++ b/pkgs/tools/text/d2/default.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "d2";
-  version = "0.1.2";
+  version = "0.1.4";
 
   src = fetchFromGitHub {
     owner = "terrastruct";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-O3T26Stau168hP7Hhv2bayamXQvaFD6feyW5AYoHf0U=";
+    hash = "sha256-whxXMU9jQ/ixXUx6vqs1CdLWZGHTBFJcA6v1Z4aAV4s=";
   };
 
-  vendorHash = "sha256-k9zaZ28vs3R5usWUW5N78zz0PuP5UrYEhgXxpQ+v5sE=";
+  vendorHash = "sha256-t94xCNteYRpbV2GzrD4ppD8xfUV1HTJPkipEzr36CaM=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/tools/text/frawk/default.nix b/pkgs/tools/text/frawk/default.nix
index d4e0f809ebe1e..74afabac33bdc 100644
--- a/pkgs/tools/text/frawk/default.nix
+++ b/pkgs/tools/text/frawk/default.nix
@@ -10,14 +10,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "frawk";
-  version = "0.4.6";
+  version = "0.4.7";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-yEdfMikMcsQePxQL1+lma95O1x5z1B7aXAEf8apuGaU=";
+    sha256 = "sha256-fqOFFkw+mV9QLTH3K6Drk3kDqU4wrQTj7OQrtgYuD7M=";
   };
 
-  cargoSha256 = "sha256-osi77Fx8jSfIvAIpThgPbnuJVF/Ydr2/+ROHcDG5ZbA=";
+  cargoSha256 = "sha256-G39/CESjMouwPQJBdsmd+MBusGNQmyNjw3PJSFBCdSk=";
 
   buildInputs = [ libxml2 ncurses zlib ];
 
@@ -36,8 +36,8 @@ rustPlatform.buildRustPackage rec {
   meta = with lib; {
     description = "A small programming language for writing short programs processing textual data";
     homepage = "https://github.com/ezrosent/frawk";
+    changelog = "https://github.com/ezrosent/frawk/releases/tag/v${version}";
     license = with licenses; [ mit /* or */ asl20 ];
     maintainers = with maintainers; [ figsoda ];
-    platforms = platforms.x86;
   };
 }
diff --git a/pkgs/tools/typesetting/sile/default.nix b/pkgs/tools/typesetting/sile/default.nix
index a07b46c3a3b95..e1a75976cfb1d 100644
--- a/pkgs/tools/typesetting/sile/default.nix
+++ b/pkgs/tools/typesetting/sile/default.nix
@@ -1,5 +1,4 @@
 { lib, stdenv
-, gnumake42
 , darwin
 , fetchurl
 , makeWrapper
@@ -44,11 +43,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "sile";
-  version = "0.14.5";
+  version = "0.14.7";
 
   src = fetchurl {
     url = "https://github.com/sile-typesetter/sile/releases/download/v${version}/${pname}-${version}.tar.xz";
-    sha256 = "01wf0rihksk2ldxgci5vzl3j575vnp6wgk12yd28mwzxkss6n39g";
+    sha256 = "01sx4368bws47989zdahhksgy5jgc1qw4hhvpib4qcz3fs6xpx9j";
   };
 
   configureFlags = [
@@ -60,7 +59,6 @@ stdenv.mkDerivation rec {
     gitMinimal
     pkg-config
     makeWrapper
-    gnumake42
   ];
   buildInputs = [
     luaEnv
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 3f7ae1cc2f8eb..7041d012f4b2c 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -633,6 +633,7 @@ mapAliases ({
 
   ### I ###
 
+  i3-gaps = i3; # Added 2023-01-03
   i3cat = throw "i3cat has been dropped due to the lack of maintanence from upstream since 2016"; # Added 2022-06-02
   iana_etc = throw "'iana_etc' has been renamed to/replaced by 'iana-etc'"; # Converted to throw 2022-02-22
   iasl = throw "iasl has been removed, use acpica-tools instead"; # Added 2021-08-08
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 4469b008c1350..74f72a17e1354 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1543,6 +1543,8 @@ with pkgs;
 
   ### APPLICATIONS/VERSION-MANAGEMENT
 
+  deepgit = callPackage ../applications/version-management/deepgit {};
+
   git = callPackage ../applications/version-management/git {
     inherit (darwin.apple_sdk.frameworks) CoreServices Security;
     perlLibs = [perlPackages.LWP perlPackages.URI perlPackages.TermReadKey];
@@ -3346,6 +3348,10 @@ with pkgs;
 
   wiiload = callPackage ../development/tools/wiiload { };
 
+  winhelpcgi = callPackage ../development/tools/winhelpcgi {
+    libpng = libpng12;
+  };
+
   wiimms-iso-tools = callPackage ../tools/filesystems/wiimms-iso-tools { };
 
   waypoint = callPackage ../applications/networking/cluster/waypoint { };
@@ -4817,6 +4823,8 @@ with pkgs;
 
   jellyfin-media-player = libsForQt5.callPackage ../applications/video/jellyfin-media-player {
     inherit (darwin.apple_sdk.frameworks) CoreFoundation Cocoa CoreAudio MediaPlayer;
+    # Disable pipewire to avoid segfault, see https://github.com/jellyfin/jellyfin-media-player/issues/341
+    mpv = wrapMpv (mpv-unwrapped.override { pipewireSupport = false; }) {};
   };
 
   jellyfin-mpv-shim = python3Packages.callPackage ../applications/video/jellyfin-mpv-shim { };
@@ -7952,6 +7960,8 @@ with pkgs;
 
   haskell-language-server = callPackage ../development/tools/haskell/haskell-language-server/withWrapper.nix { };
 
+  hassil = with python3Packages; toPythonApplication hassil;
+
   hasmail = callPackage ../applications/networking/mailreaders/hasmail { };
 
   haste-client = callPackage ../tools/misc/haste-client { };
@@ -9082,6 +9092,8 @@ with pkgs;
 
   leafpad = callPackage ../applications/editors/leafpad { };
 
+  l3afpad = callPackage ../applications/editors/l3afpad { };
+
   leatherman = callPackage ../development/libraries/leatherman { };
 
   ledit = callPackage ../tools/misc/ledit {
@@ -11460,6 +11472,8 @@ with pkgs;
 
   sandboxfs = callPackage ../tools/filesystems/sandboxfs { };
 
+  sanjuuni = callPackage ../tools/graphics/sanjuuni { };
+
   sasquatch = callPackage ../tools/filesystems/sasquatch { };
 
   sasview = libsForQt5.callPackage ../applications/science/misc/sasview {};
@@ -11584,7 +11598,7 @@ with pkgs;
   shabnam-fonts = callPackage ../data/fonts/shabnam-fonts { };
 
   shadowsocks-rust = callPackage ../tools/networking/shadowsocks-rust {
-    inherit (darwin.apple_sdk.frameworks) CoreServices;
+    inherit (darwin.apple_sdk.frameworks) Security CoreServices;
   };
 
   shadowsocks-v2ray-plugin = callPackage ../tools/networking/shadowsocks-v2ray-plugin { };
@@ -12292,6 +12306,8 @@ with pkgs;
 
   tie = callPackage ../development/tools/misc/tie { };
 
+  tidb = callPackage ../servers/tidb { };
+
   tikzit = libsForQt5.callPackage ../tools/typesetting/tikzit { };
 
   tinc_pre = callPackage ../tools/networking/tinc/pre.nix { };
@@ -13339,8 +13355,7 @@ with pkgs;
   };
 
   xtreemfs = callPackage ../tools/filesystems/xtreemfs {
-    boost = boost165;
-    jdk = jdk8; # TODO: remove override https://github.com/NixOS/nixpkgs/pull/89731
+    boost = boost17x;
   };
 
   xurls = callPackage ../tools/text/xurls {};
@@ -14507,7 +14522,8 @@ with pkgs;
   gcc-arm-embedded-9 = callPackage ../development/compilers/gcc-arm-embedded/9 {};
   gcc-arm-embedded-10 = callPackage ../development/compilers/gcc-arm-embedded/10 {};
   gcc-arm-embedded-11 = callPackage ../development/compilers/gcc-arm-embedded/11 {};
-  gcc-arm-embedded = gcc-arm-embedded-11;
+  gcc-arm-embedded-12 = callPackage ../development/compilers/gcc-arm-embedded/12 {};
+  gcc-arm-embedded = gcc-arm-embedded-12;
 
   # Has to match the default gcc so that there are no linking errors when
   # using C/C++ libraries in D packages
@@ -15671,7 +15687,7 @@ with pkgs;
     gconf = gnome2.GConf;
   };
 
-  tinycc = callPackage ../development/compilers/tinycc { };
+  tinycc = darwin.apple_sdk_11_0.callPackage ../development/compilers/tinycc { };
 
   tinygo = callPackage ../development/compilers/tinygo {
     llvmPackages = llvmPackages_14;
@@ -23585,6 +23601,17 @@ with pkgs;
     go = buildPackages.go_1_19;
   };
 
+  # requires a newer Apple SDK
+  go_1_20 = darwin.apple_sdk_11_0.callPackage ../development/compilers/go/1.20.nix {
+    inherit (darwin.apple_sdk_11_0.frameworks) Foundation Security;
+  };
+  buildGo120Module = darwin.apple_sdk_11_0.callPackage ../build-support/go/module.nix {
+    go = buildPackages.go_1_20;
+  };
+  buildGo120Package = darwin.apple_sdk_11_0.callPackage ../build-support/go/package.nix {
+    go = buildPackages.go_1_20;
+  };
+
   go2nix = callPackage ../development/tools/go2nix { };
 
   leaps = callPackage ../development/tools/leaps { };
@@ -26544,6 +26571,7 @@ with pkgs;
 
   dina-font = callPackage ../data/fonts/dina { };
 
+  dm-sans = callPackage ../data/fonts/dm-sans { };
   dns-root-data = callPackage ../data/misc/dns-root-data { };
 
   docbook5 = callPackage ../data/sgml+xml/schemas/docbook-5.0 { };
@@ -27012,7 +27040,9 @@ with pkgs;
   nordzy-icon-theme = callPackage ../data/icons/nordzy-icon-theme { };
 
   inherit (callPackages ../data/fonts/noto-fonts {})
+    mkNoto
     noto-fonts
+    noto-fonts-lgc-plus
     noto-fonts-cjk-sans
     noto-fonts-cjk-serif
     noto-fonts-emoji
@@ -27748,6 +27778,8 @@ with pkgs;
 
   avocode = callPackage ../applications/graphics/avocode {};
 
+  ax25-apps = callPackage ../applications/radio/ax25-apps {};
+
   ax25-tools = callPackage ../applications/radio/ax25-tools {};
 
   azpainter = callPackage ../applications/graphics/azpainter { };
@@ -27882,7 +27914,9 @@ with pkgs;
     inherit bitwig-studio1;
   };
   bitwig-studio3 =  callPackage ../applications/audio/bitwig-studio/bitwig-studio3.nix { };
-  bitwig-studio4 =  callPackage ../applications/audio/bitwig-studio/bitwig-studio4.nix { };
+  bitwig-studio4 =  callPackage ../applications/audio/bitwig-studio/bitwig-studio4.nix {
+    libjpeg = libjpeg.override { enableJpeg8 = true; };
+  };
 
   bitwig-studio = bitwig-studio4;
 
@@ -28648,6 +28682,8 @@ with pkgs;
   keepassx2 = callPackage ../applications/misc/keepassx/2.0.nix { };
   keepassxc = libsForQt5.callPackage ../applications/misc/keepassx/community.nix { };
 
+  keepass-diff = callPackage ../applications/misc/keepass-diff { };
+
   keeweb = callPackage ../applications/misc/keeweb { };
 
   inherit (gnome) evince;
@@ -29287,6 +29323,8 @@ with pkgs;
 
   moe =  callPackage ../applications/editors/moe { };
 
+  molsketch = libsForQt5.callPackage ../applications/editors/molsketch { };
+
   pattypan = callPackage ../applications/misc/pattypan {};
 
   praat = callPackage ../applications/audio/praat { };
@@ -29742,8 +29780,6 @@ with pkgs;
 
   i3-auto-layout = callPackage ../applications/window-managers/i3/auto-layout.nix { };
 
-  i3-gaps = callPackage ../applications/window-managers/i3/gaps.nix { };
-
   i3-rounded = callPackage ../applications/window-managers/i3/rounded.nix { };
 
   i3altlayout = callPackage ../applications/window-managers/i3/altlayout.nix { };
@@ -31366,7 +31402,7 @@ with pkgs;
     boost = boost175;
   };
 
-  openimageio2 = callPackage ../applications/graphics/openimageio/2.x.nix { };
+  openimageio2 = darwin.apple_sdk_11_0.callPackage ../applications/graphics/openimageio/2.x.nix { };
 
   openjump = callPackage ../applications/misc/openjump { };
 
@@ -36311,7 +36347,10 @@ with pkgs;
 
   csxcad = callPackage ../applications/science/electronics/csxcad { };
 
-  dataexplorer = callPackage ../applications/science/electronics/dataexplorer { };
+  dataexplorer = callPackage ../applications/science/electronics/dataexplorer {
+    # executable fails at startup for jdk > 17
+    jdk = jdk17;
+  };
 
   diylc = callPackage ../applications/science/electronics/diylc { };
 
diff --git a/pkgs/top-level/nim-packages.nix b/pkgs/top-level/nim-packages.nix
index 2277a1f1b7b41..ca52d7f52b566 100644
--- a/pkgs/top-level/nim-packages.nix
+++ b/pkgs/top-level/nim-packages.nix
@@ -14,12 +14,16 @@ lib.makeScope newScope (self:
     astpatternmatching =
       callPackage ../development/nim-packages/astpatternmatching { };
 
-    bumpy = callPackage ../development/nim-packages/bumpy { };
+    base32 = callPackage ../development/nim-packages/base32 { };
 
-    chroma = callPackage ../development/nim-packages/chroma { };
+    bumpy = callPackage ../development/nim-packages/bumpy { };
 
     c2nim = callPackage ../development/nim-packages/c2nim { };
 
+    cbor = callPackage ../development/nim-packages/cbor { };
+
+    chroma = callPackage ../development/nim-packages/chroma { };
+
     docopt = callPackage ../development/nim-packages/docopt { };
 
     flatty = callPackage ../development/nim-packages/flatty { };
@@ -47,10 +51,14 @@ lib.makeScope newScope (self:
 
     nimbox = callPackage ../development/nim-packages/nimbox { };
 
+    nimSHA2 = callPackage ../development/nim-packages/nimSHA2 { };
+
     nimsimd = callPackage ../development/nim-packages/nimsimd { };
 
     noise = callPackage ../development/nim-packages/noise { };
 
+    npeg = callPackage ../development/nim-packages/npeg { };
+
     packedjson = callPackage ../development/nim-packages/packedjson { };
 
     pixie = callPackage ../development/nim-packages/pixie { };
@@ -82,8 +90,12 @@ lib.makeScope newScope (self:
 
     supersnappy = callPackage ../development/nim-packages/supersnappy { };
 
+    taps = callPackage ../development/nim-packages/taps { };
+
     tempfile = callPackage ../development/nim-packages/tempfile { };
 
+    tkrzw = callPackage ../development/nim-packages/tkrzw { inherit (pkgs) tkrzw; };
+
     ui = callPackage ../development/nim-packages/ui { inherit (pkgs) libui; };
 
     unicodedb = callPackage ../development/nim-packages/unicodedb { };
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 0f9762d8157b6..1ac15512d76d8 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -328,8 +328,12 @@ let
 
     domain-name = callPackage ../development/ocaml-modules/domain-name { };
 
+    domainslib = callPackage ../development/ocaml-modules/domainslib { };
+
     dose3 = callPackage ../development/ocaml-modules/dose3 { };
 
+    dscheck = callPackage ../development/ocaml-modules/dscheck { };
+
     dssi = callPackage ../development/ocaml-modules/dssi { };
 
     dtoa = callPackage ../development/ocaml-modules/dtoa { };
@@ -737,6 +741,8 @@ let
 
     lo = callPackage ../development/ocaml-modules/lo { };
 
+    lockfree = callPackage ../development/ocaml-modules/lockfree { };
+
     logs = callPackage ../development/ocaml-modules/logs { };
 
     lru = callPackage ../development/ocaml-modules/lru { };
@@ -1116,6 +1122,8 @@ let
 
     ordering = callPackage ../development/ocaml-modules/ordering { };
 
+    oseq = callPackage ../development/ocaml-modules/oseq { };
+
     otfm = callPackage ../development/ocaml-modules/otfm { };
 
     otoml = callPackage ../development/ocaml-modules/otoml { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 5011e5ecb3ff9..7e1a758e4d4ce 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -5075,6 +5075,8 @@ self: super: with self; {
 
   kivy-garden = callPackage ../development/python-modules/kivy-garden { };
 
+  kiwiki-client = callPackage ../development/python-modules/kiwiki-client { };
+
   kiwisolver = callPackage ../development/python-modules/kiwisolver { };
 
   klaus = callPackage ../development/python-modules/klaus { };
@@ -8059,6 +8061,8 @@ self: super: with self; {
 
   pykakasi = callPackage ../development/python-modules/pykakasi { };
 
+  pykaleidescape = callPackage ../development/python-modules/pykaleidescape { };
+
   pykdl = callPackage ../development/python-modules/pykdl { };
 
   pykdtree = callPackage ../development/python-modules/pykdtree {
diff --git a/pkgs/top-level/release-cross.nix b/pkgs/top-level/release-cross.nix
index 93e36360bf9c6..6eeda58a6c172 100644
--- a/pkgs/top-level/release-cross.nix
+++ b/pkgs/top-level/release-cross.nix
@@ -84,6 +84,17 @@ let
     buildPackages.binutils = nativePlatforms;
     mpg123 = nativePlatforms;
   };
+
+  # Enabled-but-unsupported platforms for which nix is known to build.
+  # We provide Hydra-built `nixStatic` for these platforms.  This
+  # allows users to bootstrap their own system without either (a)
+  # trusting binaries from a non-Hydra source or (b) having to fight
+  # with their host distribution's versions of nix's numerous
+  # build dependencies.
+  nixCrossStatic = {
+    nixStatic = platforms.linux;  # no need for buildPlatform=*-darwin
+  };
+
 in
 
 {
@@ -226,4 +237,8 @@ in
     # attribute, so there is no way to detect this -- we must add it
     # as a special case.
     (builtins.removeAttrs tools ["bootstrapTools"]);
+
+  # Cross-built nixStatic for platforms for enabled-but-unsupported platforms
+  mips64el-nixCrossStatic = mapTestOnCross lib.systems.examples.mips64el-linux-gnuabi64 nixCrossStatic;
+  powerpc64le-nixCrossStatic = mapTestOnCross lib.systems.examples.powernv nixCrossStatic;
 }
diff --git a/pkgs/top-level/ruby-packages.nix b/pkgs/top-level/ruby-packages.nix
index 2b5d1349d177f..4ae1a50eb757e 100644
--- a/pkgs/top-level/ruby-packages.nix
+++ b/pkgs/top-level/ruby-packages.nix
@@ -1847,10 +1847,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1fpyk1965py77al7iadkn5dibwgvybknkr7r8bii2dj73wvr29rh";
+      sha256 = "sha256-bGRp797+NJYBAACjRvnTv3EOEaxGYeNTz1aFIyb7ECM=";
       type = "gem";
     };
-    version = "2.19.0";
+    version = "2.19.1";
   };
   mab = {
     groups = ["default"];
@@ -2124,10 +2124,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0cam1455nmi3fzzpa9ixn2hsim10fbprmj62ajpd6d02mwdprwwn";
+      sha256 = "sha256-0+4A8mwVF2PaFpHH/Ghx3dA+Uy90+FEB9aztwtCZ6Vg=";
       type = "gem";
     };
-    version = "1.13.9";
+    version = "1.13.10";
   };
   octokit = {
     dependencies = ["faraday" "sawyer"];