about summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--lib/strings.nix4
-rw-r--r--lib/tests/misc.nix21
-rw-r--r--maintainers/maintainer-list.nix18
-rw-r--r--nixos/modules/services/networking/haproxy.nix17
-rw-r--r--nixos/modules/services/security/kanidm.nix14
-rw-r--r--nixos/modules/services/web-apps/invidious.nix64
-rw-r--r--nixos/modules/services/x11/picom.nix6
-rw-r--r--nixos/tests/prometheus-exporters.nix2
-rw-r--r--pkgs/applications/audio/asunder/default.nix4
-rw-r--r--pkgs/applications/audio/cava/default.nix4
-rw-r--r--pkgs/applications/audio/g4music/default.nix53
-rw-r--r--pkgs/applications/editors/emacs/elisp-packages/manual-packages.nix4
-rw-r--r--pkgs/applications/editors/emacs/elisp-packages/manual-packages/consult-gh/default.nix52
-rw-r--r--pkgs/applications/editors/emacs/elisp-packages/manual-packages/power-mode/default.nix22
-rw-r--r--pkgs/applications/editors/texstudio/default.nix4
-rw-r--r--pkgs/applications/emulators/ccemux/default.nix12
-rw-r--r--pkgs/applications/emulators/ryujinx/default.nix6
-rw-r--r--pkgs/applications/emulators/ryujinx/deps.nix102
-rw-r--r--pkgs/applications/misc/gpsprune/default.nix4
-rw-r--r--pkgs/applications/misc/waybar/default.nix10
-rw-r--r--pkgs/applications/networking/appgate-sdp/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/kubectl-klock/default.nix23
-rw-r--r--pkgs/applications/networking/cluster/pachyderm/default.nix6
-rw-r--r--pkgs/applications/networking/cluster/terraform-providers/providers.json36
-rw-r--r--pkgs/applications/networking/cluster/tf-summarize/default.nix5
-rw-r--r--pkgs/applications/networking/instant-messengers/deltachat-desktop/default.nix6
-rw-r--r--pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix11
-rw-r--r--pkgs/applications/networking/instant-messengers/teams-for-linux/screensharing-wayland-hack-fix.patch28
-rw-r--r--pkgs/applications/system/monitor/default.nix9
-rw-r--r--pkgs/applications/version-management/gitea/default.nix4
-rw-r--r--pkgs/applications/video/mkvtoolnix/default.nix4
-rw-r--r--pkgs/development/libraries/geos/default.nix5
-rw-r--r--pkgs/development/libraries/level-zero/default.nix4
-rw-r--r--pkgs/development/libraries/libdeltachat/Cargo.lock20
-rw-r--r--pkgs/development/libraries/libdeltachat/default.nix4
-rw-r--r--pkgs/development/libraries/poppler/default.nix4
-rw-r--r--pkgs/development/libraries/qt-6/default.nix3
-rw-r--r--pkgs/development/libraries/qt-6/patches/0008-qtbase-find-qmlimportscanner-in-macdeployqt-via-environment.patch35
-rw-r--r--pkgs/development/libraries/qt-6/patches/0009-qtbase-check-in-the-QML-folder-of-this-library-does-actuall.patch35
-rw-r--r--pkgs/development/libraries/qt-6/patches/0010-qtbase-pass-to-qmlimportscanner-the-QML2_IMPORT_PATH.patch30
-rw-r--r--pkgs/development/python-modules/awesomeversion/default.nix3
-rw-r--r--pkgs/development/python-modules/ax/default.nix8
-rw-r--r--pkgs/development/python-modules/backports-strenum/default.nix47
-rw-r--r--pkgs/development/python-modules/boschshcpy/default.nix4
-rw-r--r--pkgs/development/python-modules/botorch/default.nix4
-rw-r--r--pkgs/development/python-modules/caldav/default.nix4
-rw-r--r--pkgs/development/python-modules/casbin/default.nix4
-rw-r--r--pkgs/development/python-modules/cfgv/default.nix31
-rw-r--r--pkgs/development/python-modules/deid/default.nix6
-rw-r--r--pkgs/development/python-modules/detectron2/default.nix10
-rw-r--r--pkgs/development/python-modules/fakeredis/default.nix4
-rw-r--r--pkgs/development/python-modules/gpytorch/default.nix6
-rw-r--r--pkgs/development/python-modules/linear_operator/default.nix6
-rw-r--r--pkgs/development/python-modules/lxmf/default.nix4
-rw-r--r--pkgs/development/python-modules/nomadnet/default.nix4
-rw-r--r--pkgs/development/python-modules/nsz/default.nix25
-rw-r--r--pkgs/development/python-modules/ocrmypdf/default.nix8
-rw-r--r--pkgs/development/python-modules/okta/default.nix56
-rw-r--r--pkgs/development/python-modules/pandas-stubs/default.nix12
-rw-r--r--pkgs/development/python-modules/pdfplumber/default.nix48
-rw-r--r--pkgs/development/python-modules/pydicom/default.nix8
-rw-r--r--pkgs/development/python-modules/pyipp/default.nix4
-rw-r--r--pkgs/development/python-modules/pyoverkiz/default.nix10
-rw-r--r--pkgs/development/python-modules/pysigma-backend-elasticsearch/default.nix4
-rw-r--r--pkgs/development/python-modules/pytest-raises/default.nix25
-rw-r--r--pkgs/development/python-modules/qcodes/default.nix30
-rw-r--r--pkgs/development/python-modules/rns/default.nix4
-rw-r--r--pkgs/development/python-modules/rokuecp/default.nix6
-rw-r--r--pkgs/development/python-modules/spsdk/default.nix13
-rw-r--r--pkgs/development/python-modules/treeo/default.nix2
-rw-r--r--pkgs/development/python-modules/txtai/default.nix6
-rw-r--r--pkgs/development/python-modules/typer/default.nix9
-rw-r--r--pkgs/development/python-modules/vulcan-api/default.nix9
-rw-r--r--pkgs/development/tools/build-managers/buck2/default.nix104
-rw-r--r--pkgs/development/tools/build-managers/buck2/hashes.json10
-rwxr-xr-xpkgs/development/tools/build-managers/buck2/update.sh4
-rw-r--r--pkgs/development/tools/continuous-integration/forgejo-actions-runner/default.nix8
-rw-r--r--pkgs/development/tools/database/sqlc/default.nix6
-rw-r--r--pkgs/development/tools/misc/ztags/default.nix30
-rw-r--r--pkgs/development/tools/operator-sdk/default.nix6
-rw-r--r--pkgs/development/tools/reindeer/default.nix8
-rw-r--r--pkgs/development/tools/viceroy/default.nix6
-rw-r--r--pkgs/games/forge-mtg/default.nix6
-rw-r--r--pkgs/games/path-of-building/default.nix4
-rw-r--r--pkgs/os-specific/linux/rtw88/default.nix8
-rw-r--r--pkgs/servers/invidious/default.nix14
-rwxr-xr-xpkgs/servers/invidious/update.sh2
-rw-r--r--pkgs/servers/invidious/versions.json6
-rw-r--r--pkgs/servers/mail/mailman/0001-Disable-broken-test_help_output-testcase.patch36
-rw-r--r--pkgs/servers/mail/mailman/hyperkitty.nix20
-rw-r--r--pkgs/servers/mail/mailman/postorius.nix6
-rw-r--r--pkgs/servers/mail/mailman/python.nix38
-rw-r--r--pkgs/servers/mail/mailman/web.nix4
-rw-r--r--pkgs/servers/mail/rspamd/default.nix32
-rw-r--r--pkgs/servers/monitoring/prometheus/redis-exporter.nix16
-rw-r--r--pkgs/servers/monitoring/prometheus/smartctl-exporter/default.nix6
-rw-r--r--pkgs/servers/search/opensearch/default.nix39
-rw-r--r--pkgs/servers/sql/postgresql/ext/plr.nix4
-rw-r--r--pkgs/servers/web-apps/wiki-js/default.nix39
-rw-r--r--pkgs/servers/web-apps/wiki-js/drop-node-check.patch19
-rw-r--r--pkgs/tools/backup/duplicati/default.nix6
-rw-r--r--pkgs/tools/misc/panoply/default.nix4
-rw-r--r--pkgs/tools/networking/netbird/default.nix6
-rw-r--r--pkgs/tools/security/dumpasn1/configpath.patch28
-rw-r--r--pkgs/tools/security/dumpasn1/default.nix34
-rw-r--r--pkgs/tools/security/pynitrokey/default.nix1
-rw-r--r--pkgs/tools/security/trufflehog/default.nix4
-rw-r--r--pkgs/tools/system/gptman/default.nix20
-rw-r--r--pkgs/tools/wayland/wl-mirror/default.nix5
-rw-r--r--pkgs/top-level/all-packages.nix8
-rw-r--r--pkgs/top-level/linux-kernels.nix1
-rw-r--r--pkgs/top-level/python-packages.nix2
112 files changed, 1130 insertions, 593 deletions
diff --git a/lib/strings.nix b/lib/strings.nix
index 1eb6cf9c1afbe..df891c8998872 100644
--- a/lib/strings.nix
+++ b/lib/strings.nix
@@ -629,10 +629,10 @@ rec {
             This behavior is deprecated and will throw an error in the future.''
     (let
       preLen = stringLength prefix;
-      sLen = stringLength str;
     in
       if substring 0 preLen str == prefix then
-        substring preLen (sLen - preLen) str
+        # -1 will take the string until the end
+        substring preLen (-1) str
       else
         str);
 
diff --git a/lib/tests/misc.nix b/lib/tests/misc.nix
index dcfa4c540f0cb..6d55ae684771e 100644
--- a/lib/tests/misc.nix
+++ b/lib/tests/misc.nix
@@ -349,6 +349,27 @@ runTests {
     expected = true;
   };
 
+  testRemovePrefixExample1 = {
+    expr = removePrefix "foo." "foo.bar.baz";
+    expected = "bar.baz";
+  };
+  testRemovePrefixExample2 = {
+    expr = removePrefix "xxx" "foo.bar.baz";
+    expected = "foo.bar.baz";
+  };
+  testRemovePrefixEmptyPrefix = {
+    expr = removePrefix "" "foo";
+    expected = "foo";
+  };
+  testRemovePrefixEmptyString = {
+    expr = removePrefix "foo" "";
+    expected = "";
+  };
+  testRemovePrefixEmptyBoth = {
+    expr = removePrefix "" "";
+    expected = "";
+  };
+
   testNormalizePath = {
     expr = strings.normalizePath "//a/b//c////d/";
     expected = "/a/b/c/d/";
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 27325e6132c5a..dbb6b7f71535d 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -8724,6 +8724,11 @@
     githubId = 1927188;
     name = "karolchmist";
   };
+  katexochen = {
+    github = "katexochen";
+    githubId = 49727155;
+    name = "Paul Meyer";
+  };
   kayhide = {
     email = "kayhide@gmail.com";
     github = "kayhide";
@@ -15081,6 +15086,13 @@
       fingerprint = "30BB FF3F AB0B BB3E 0435  F83C 8E8F F66E 2AE8 D970";
     }];
   };
+  scm2342 = {
+    name = "Sven Mattsen";
+    email = "nix@sven.cc";
+    matrix = "@scm:matrix.sven.cc";
+    github = "scm2342";
+    githubId = 154108;
+  };
   scode = {
     email = "peter.schuller@infidyne.com";
     github = "scode";
@@ -17787,6 +17799,12 @@
       fingerprint = "5814 50EB 6E17 E715 7C63  E7F1 9879 8C3C 4D68 8D6D";
     }];
   };
+  viluon = {
+    email = "nix@viluon.me";
+    github = "viluon";
+    githubId = 7235381;
+    name = "Ondřej Kvapil";
+  };
   vincentbernat = {
     email = "vincent@bernat.ch";
     github = "vincentbernat";
diff --git a/nixos/modules/services/networking/haproxy.nix b/nixos/modules/services/networking/haproxy.nix
index e0b686434b6e9..208eb356d629d 100644
--- a/nixos/modules/services/networking/haproxy.nix
+++ b/nixos/modules/services/networking/haproxy.nix
@@ -17,14 +17,9 @@ with lib;
   options = {
     services.haproxy = {
 
-      enable = mkOption {
-        type = types.bool;
-        default = false;
-        description = lib.mdDoc ''
-          Whether to enable HAProxy, the reliable, high performance TCP/HTTP
-          load balancer.
-        '';
-      };
+      enable = mkEnableOption (lib.mdDoc "HAProxy, the reliable, high performance TCP/HTTP load balancer.");
+
+      package = mkPackageOptionMD pkgs "haproxy" { };
 
       user = mkOption {
         type = types.str;
@@ -70,15 +65,15 @@ with lib;
         ExecStartPre = [
           # when the master process receives USR2, it reloads itself using exec(argv[0]),
           # so we create a symlink there and update it before reloading
-          "${pkgs.coreutils}/bin/ln -sf ${pkgs.haproxy}/sbin/haproxy /run/haproxy/haproxy"
+          "${pkgs.coreutils}/bin/ln -sf ${lib.getExe cfg.package} /run/haproxy/haproxy"
           # when running the config test, don't be quiet so we can see what goes wrong
           "/run/haproxy/haproxy -c -f ${haproxyCfg}"
         ];
         ExecStart = "/run/haproxy/haproxy -Ws -f /etc/haproxy.cfg -p /run/haproxy/haproxy.pid";
         # support reloading
         ExecReload = [
-          "${pkgs.haproxy}/sbin/haproxy -c -f ${haproxyCfg}"
-          "${pkgs.coreutils}/bin/ln -sf ${pkgs.haproxy}/sbin/haproxy /run/haproxy/haproxy"
+          "${lib.getExe cfg.package} -c -f ${haproxyCfg}"
+          "${pkgs.coreutils}/bin/ln -sf ${lib.getExe cfg.package} /run/haproxy/haproxy"
           "${pkgs.coreutils}/bin/kill -USR2 $MAINPID"
         ];
         KillMode = "mixed";
diff --git a/nixos/modules/services/security/kanidm.nix b/nixos/modules/services/security/kanidm.nix
index 6fb9f71a489e2..d8a99dee59f44 100644
--- a/nixos/modules/services/security/kanidm.nix
+++ b/nixos/modules/services/security/kanidm.nix
@@ -69,6 +69,8 @@ in
     enableServer = lib.mkEnableOption (lib.mdDoc "the Kanidm server");
     enablePam = lib.mkEnableOption (lib.mdDoc "the Kanidm PAM and NSS integration");
 
+    package = lib.mkPackageOptionMD pkgs "kanidm" {};
+
     serverSettings = lib.mkOption {
       type = lib.types.submodule {
         freeformType = settingsFormat.type;
@@ -222,7 +224,7 @@ in
         }
       ];
 
-    environment.systemPackages = lib.mkIf cfg.enableClient [ pkgs.kanidm ];
+    environment.systemPackages = lib.mkIf cfg.enableClient [ cfg.package ];
 
     systemd.services.kanidm = lib.mkIf cfg.enableServer {
       description = "kanidm identity management daemon";
@@ -237,7 +239,7 @@ in
           StateDirectory = "kanidm";
           StateDirectoryMode = "0700";
           RuntimeDirectory = "kanidmd";
-          ExecStart = "${pkgs.kanidm}/bin/kanidmd server -c ${serverConfigFile}";
+          ExecStart = "${cfg.package}/bin/kanidmd server -c ${serverConfigFile}";
           User = "kanidm";
           Group = "kanidm";
 
@@ -270,7 +272,7 @@ in
           CacheDirectory = "kanidm-unixd";
           CacheDirectoryMode = "0700";
           RuntimeDirectory = "kanidm-unixd";
-          ExecStart = "${pkgs.kanidm}/bin/kanidm_unixd";
+          ExecStart = "${cfg.package}/bin/kanidm_unixd";
           User = "kanidm-unixd";
           Group = "kanidm-unixd";
 
@@ -302,7 +304,7 @@ in
       partOf = [ "kanidm-unixd.service" ];
       restartTriggers = [ unixConfigFile clientConfigFile ];
       serviceConfig = {
-        ExecStart = "${pkgs.kanidm}/bin/kanidm_unixd_tasks";
+        ExecStart = "${cfg.package}/bin/kanidm_unixd_tasks";
 
         BindReadOnlyPaths = [
           "/nix/store"
@@ -346,7 +348,7 @@ in
       })
     ];
 
-    system.nssModules = lib.mkIf cfg.enablePam [ pkgs.kanidm ];
+    system.nssModules = lib.mkIf cfg.enablePam [ cfg.package ];
 
     system.nssDatabases.group = lib.optional cfg.enablePam "kanidm";
     system.nssDatabases.passwd = lib.optional cfg.enablePam "kanidm";
@@ -365,7 +367,7 @@ in
           description = "Kanidm server";
           isSystemUser = true;
           group = "kanidm";
-          packages = with pkgs; [ kanidm ];
+          packages = [ cfg.package ];
         };
       })
       (lib.mkIf cfg.enablePam {
diff --git a/nixos/modules/services/web-apps/invidious.nix b/nixos/modules/services/web-apps/invidious.nix
index 8823da0100141..5603ef7392e82 100644
--- a/nixos/modules/services/web-apps/invidious.nix
+++ b/nixos/modules/services/web-apps/invidious.nix
@@ -7,6 +7,9 @@ let
 
   settingsFile = settingsFormat.generate "invidious-settings" cfg.settings;
 
+  generatedHmacKeyFile = "/var/lib/invidious/hmac_key";
+  generateHmac = cfg.hmacKeyFile == null;
+
   serviceConfig = {
     systemd.services.invidious = {
       description = "Invidious (An alternative YouTube front-end)";
@@ -14,22 +17,47 @@ let
       after = [ "network-online.target" ];
       wantedBy = [ "multi-user.target" ];
 
-      script =
-        let
-          jqFilter = "."
-            + lib.optionalString (cfg.database.host != null) "[0].db.password = \"'\"'\"$(cat ${lib.escapeShellArg cfg.database.passwordFile})\"'\"'\""
-            + " | .[0]"
-            + lib.optionalString (cfg.extraSettingsFile != null) " * .[1]";
-          jqFiles = [ settingsFile ] ++ lib.optional (cfg.extraSettingsFile != null) cfg.extraSettingsFile;
-        in
-        ''
-          export INVIDIOUS_CONFIG="$(${pkgs.jq}/bin/jq -s "${jqFilter}" ${lib.escapeShellArgs jqFiles})"
-          exec ${cfg.package}/bin/invidious
-        '';
+      preStart = lib.optionalString generateHmac ''
+        if [[ ! -e "${generatedHmacKeyFile}" ]]; then
+          ${pkgs.pwgen}/bin/pwgen 20 1 > "${generatedHmacKeyFile}"
+          chmod 0600 "${generatedHmacKeyFile}"
+        fi
+      '';
+
+      script = ''
+        configParts=()
+      ''
+      # autogenerated hmac_key
+      + lib.optionalString generateHmac ''
+        configParts+=("$(${pkgs.jq}/bin/jq -R '{"hmac_key":.}' <"${generatedHmacKeyFile}")")
+      ''
+      # generated settings file
+      + ''
+        configParts+=("$(< ${lib.escapeShellArg settingsFile})")
+      ''
+      # optional database password file
+      + lib.optionalString (cfg.database.host != null) ''
+        configParts+=("$(${pkgs.jq}/bin/jq -R '{"db":{"password":.}}' ${lib.escapeShellArg cfg.database.passwordFile})")
+      ''
+      # optional extra settings file
+      + lib.optionalString (cfg.extraSettingsFile != null) ''
+        configParts+=("$(< ${lib.escapeShellArg cfg.extraSettingsFile})")
+      ''
+      # explicitly specified hmac key file
+      + lib.optionalString (cfg.hmacKeyFile != null) ''
+        configParts+=("$(< ${lib.escapeShellArg cfg.hmacKeyFile})")
+      ''
+      # merge all parts into a single configuration with later elements overriding previous elements
+      + ''
+        export INVIDIOUS_CONFIG="$(${pkgs.jq}/bin/jq -s 'reduce .[] as $item ({}; . * $item)' <<<"''${configParts[*]}")"
+        exec ${cfg.package}/bin/invidious
+      '';
 
       serviceConfig = {
         RestartSec = "2s";
         DynamicUser = true;
+        StateDirectory = "invidious";
+        StateDirectoryMode = "0750";
 
         CapabilityBoundingSet = "";
         PrivateDevices = true;
@@ -171,6 +199,18 @@ in
       '';
     };
 
+    hmacKeyFile = lib.mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      description = lib.mdDoc ''
+        A path to a file containing the `hmac_key`. If `null`, a key will be generated automatically on first
+        start.
+
+        If non-`null`, this option overrides any `hmac_key` specified in {option}`services.invidious.settings` or
+        via {option}`services.invidious.extraSettingsFile`.
+      '';
+    };
+
     extraSettingsFile = lib.mkOption {
       type = types.nullOr types.str;
       default = null;
diff --git a/nixos/modules/services/x11/picom.nix b/nixos/modules/services/x11/picom.nix
index 1d6f3daa40225..3df0ea9e60bb0 100644
--- a/nixos/modules/services/x11/picom.nix
+++ b/nixos/modules/services/x11/picom.nix
@@ -61,6 +61,8 @@ in {
       '';
     };
 
+    package = mkPackageOptionMD pkgs "picom" { };
+
     fade = mkOption {
       type = types.bool;
       default = false;
@@ -301,13 +303,13 @@ in {
       };
 
       serviceConfig = {
-        ExecStart = "${pkgs.picom}/bin/picom --config ${configFile}";
+        ExecStart = "${getExe cfg.package} --config ${configFile}";
         RestartSec = 3;
         Restart = "always";
       };
     };
 
-    environment.systemPackages = [ pkgs.picom ];
+    environment.systemPackages = [ cfg.package ];
   };
 
   meta.maintainers = with lib.maintainers; [ rnhmjoj ];
diff --git a/nixos/tests/prometheus-exporters.nix b/nixos/tests/prometheus-exporters.nix
index 64e2811beb060..d86f8ac634e82 100644
--- a/nixos/tests/prometheus-exporters.nix
+++ b/nixos/tests/prometheus-exporters.nix
@@ -1200,7 +1200,7 @@ let
       };
       exporterTest = ''
         wait_until_succeeds(
-            'journalctl -eu prometheus-smartctl-exporter.service -o cat | grep "Device unavailable"'
+            'journalctl -eu prometheus-smartctl-exporter.service -o cat | grep "Unable to detect device type"'
         )
       '';
     };
diff --git a/pkgs/applications/audio/asunder/default.nix b/pkgs/applications/audio/asunder/default.nix
index d6efada907632..dbaef1cf2acfa 100644
--- a/pkgs/applications/audio/asunder/default.nix
+++ b/pkgs/applications/audio/asunder/default.nix
@@ -10,11 +10,11 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "2.9.7";
+  version = "3.0.1";
   pname = "asunder";
   src = fetchurl {
     url = "http://littlesvr.ca/asunder/releases/${pname}-${version}.tar.bz2";
-    sha256 = "1x3l308ss0iqhz90qyjb94gyd8b4piyrm2nzjmg5kf049k9prjf1";
+    sha256 = "sha256-iGji4bl7ZofIAOf2EiYqMWu4V+3TmIN2jOYottJTN2s=";
   };
 
   nativeBuildInputs = [ intltool makeWrapper pkg-config ];
diff --git a/pkgs/applications/audio/cava/default.nix b/pkgs/applications/audio/cava/default.nix
index e898f17d9345c..1e8b3047de720 100644
--- a/pkgs/applications/audio/cava/default.nix
+++ b/pkgs/applications/audio/cava/default.nix
@@ -3,7 +3,7 @@
 
 stdenv.mkDerivation rec {
   pname = "cava";
-  version = "0.8.3";
+  version = "0.9.0";
 
   buildInputs = [
     alsa-lib
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
     owner = "karlstav";
     repo = "cava";
     rev = version;
-    sha256 = "sha256-6xiWhWynIbUWFIieiYIg24PgwnKuNSIEpkY+P6gyFGw=";
+    sha256 = "sha256-mIgkvgVcbRdE29lSLojIzIsnwZgnQ+B2sgScDWrLyd8=";
   };
 
   nativeBuildInputs = [ autoreconfHook ];
diff --git a/pkgs/applications/audio/g4music/default.nix b/pkgs/applications/audio/g4music/default.nix
new file mode 100644
index 0000000000000..3e45bf4d87524
--- /dev/null
+++ b/pkgs/applications/audio/g4music/default.nix
@@ -0,0 +1,53 @@
+{ lib
+, stdenv
+, fetchFromGitLab
+, desktop-file-utils
+, gobject-introspection
+, gst_all_1
+, gtk4
+, libadwaita
+, meson
+, ninja
+, pkg-config
+, vala
+, wrapGAppsHook4
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "g4music";
+  version = "3.2";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.gnome.org";
+    owner = "neithern";
+    repo = "g4music";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-BlHOYD4sOmJPNMzM5QA97Ah1N9tIat0Y6qxN6c5pmsw=";
+  };
+
+  nativeBuildInputs = [
+    desktop-file-utils
+    gobject-introspection
+    meson
+    ninja
+    pkg-config
+    vala
+    wrapGAppsHook4
+  ];
+
+  buildInputs = [
+    gtk4
+    libadwaita
+  ] ++ (with gst_all_1; [
+    gst-plugins-base
+    gst-plugins-good
+    gstreamer
+  ]);
+
+  meta = with lib; {
+    description = "A beautiful, fast, fluent, light weight music player written in GTK4";
+    homepage = "https://gitlab.gnome.org/neithern/g4music";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ magnouvean ];
+    platforms = platforms.linux;
+  };
+})
diff --git a/pkgs/applications/editors/emacs/elisp-packages/manual-packages.nix b/pkgs/applications/editors/emacs/elisp-packages/manual-packages.nix
index 9ed5f23dead00..5bb88c835610c 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages.nix
@@ -17,6 +17,8 @@ in
 
   cask = callPackage ./manual-packages/cask { };
 
+  consult-gh = callPackage ./manual-packages/consult-gh { };
+
   control-lock = callPackage ./manual-packages/control-lock { };
 
   ebuild-mode = callPackage ./manual-packages/ebuild-mode { };
@@ -65,8 +67,6 @@ in
 
   pod-mode = callPackage ./manual-packages/pod-mode { };
 
-  power-mode = callPackage ./manual-packages/power-mode { };
-
   prisma-mode = callPackage ./manual-packages/prisma-mode { };
 
   structured-haskell-mode = self.shm;
diff --git a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/consult-gh/default.nix b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/consult-gh/default.nix
new file mode 100644
index 0000000000000..64addcf38893e
--- /dev/null
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/consult-gh/default.nix
@@ -0,0 +1,52 @@
+{ lib
+, melpaBuild
+, fetchFromGitHub
+, consult
+, embark
+, forge
+, gh
+, markdown-mode
+, writeText
+, unstableGitUpdater
+}:
+
+let
+  commit = "1fe876d9552b6ec6af257a4299a34eca99b40539";
+in
+melpaBuild {
+  pname = "consult-gh";
+  version = "20230706.438";
+
+  inherit commit;
+
+  src = fetchFromGitHub {
+    owner = "armindarvish";
+    repo = "consult-gh";
+    rev = commit;
+    hash = "sha256-bi+qlNvNMXbS4cXbXt01txwD2NAyAqJGNKeOtdtj7tg=";
+  };
+
+  packageRequires = [
+    consult
+    embark
+    forge
+    gh
+    markdown-mode
+  ];
+
+  recipe = writeText "recipe" ''
+    (consult-gh
+      :repo "armindarvish/consult-gh"
+      :fetcher github
+      :files ("consult-gh-embark.el" "consult-gh-forge.el" "consult-gh.el"))
+  '';
+
+  passthru.updateScript = unstableGitUpdater { };
+
+  meta = {
+    homepage = "https://github.com/armindarvish/consult-gh";
+    description = "A GitHub CLI client inside GNU Emacs using Consult";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+  };
+}
diff --git a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/power-mode/default.nix b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/power-mode/default.nix
deleted file mode 100644
index bd6a2996d6e1b..0000000000000
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/power-mode/default.nix
+++ /dev/null
@@ -1,22 +0,0 @@
-{ trivialBuild
-, fetchFromGitHub
-, emacs
-}:
-
-trivialBuild rec {
-  pname = "power-mode";
-  version = "0.pre+unstable=2021-06-06";
-
-  src = fetchFromGitHub {
-    owner = "elizagamedev";
-    repo  = "power-mode.el";
-    rev = "940e0aa36220f863e8f43840b4ed634b464fbdbb";
-    hash = "sha256-Wy8o9QTWqvH9cP7xsTpF5QSd4mWNIPXJTadoADKeHWY=";
-  };
-
-  meta = {
-    homepage = "https://github.com/elizagamedev/power-mode.el";
-    description = "Imbue Emacs with power!";
-    inherit (emacs.meta) platforms;
-  };
-}
diff --git a/pkgs/applications/editors/texstudio/default.nix b/pkgs/applications/editors/texstudio/default.nix
index 97f51014d0b6a..b9a386684f9ed 100644
--- a/pkgs/applications/editors/texstudio/default.nix
+++ b/pkgs/applications/editors/texstudio/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "texstudio";
-  version = "4.6.2";
+  version = "4.6.3";
 
   src = fetchFromGitHub {
     owner = "texstudio-org";
     repo = "texstudio";
     rev = finalAttrs.version;
-    hash = "sha256-2bvKB/8HcZoTk2J6FQXXJREqGp6EZ95C2Aqcx9o/eho=";
+    hash = "sha256-L8N7T7FFfjT801HxbQiiC0ewW7vde4S0RVmNT2CWiWY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/emulators/ccemux/default.nix b/pkgs/applications/emulators/ccemux/default.nix
index 742b3dc88ae28..15fb0f88593f0 100644
--- a/pkgs/applications/emulators/ccemux/default.nix
+++ b/pkgs/applications/emulators/ccemux/default.nix
@@ -3,24 +3,24 @@
 }:
 
 let
-  version = "1.1.1";
-  rev = "af12e2e4da586275ba931eae8f40a2201251bf59";
+  version = "unstable-2023-07-08";
+  rev = "989cfe52a0458b991e0a7d87edec81d3fef472ac";
 
   baseUrl = "https://emux.cc/versions/${lib.substring 0 8 rev}/CCEmuX";
   jar =
     if useCCTweaked
     then fetchurl {
       url = "${baseUrl}-cct.jar";
-      sha256 = "0d9gzi1h5vz32fp4lfn7dam189jcm7bwbqwmlpj0c47p8l0d4lsv";
+      hash = "sha256-B9Zan6wpYnUtaNbUIrXvkchPiEquMs9R2Kiqg85/VdY=";
     }
     else fetchurl {
       url = "${baseUrl}-cc.jar";
-      sha256 = "0ky5vxh8m1v98zllifxif8xxd25j2xdp19hjnj4xlkck71lbnb34";
+      hash = "sha256-2Z38O6z7OrHKe8GdLnexin749uJzQaCZglS+SwVD5YE=";
     };
 
   desktopIcon = fetchurl {
     url = "https://github.com/CCEmuX/CCEmuX/raw/${rev}/src/main/resources/img/icon.png";
-    sha256 = "1vmb6rg9k2y99j8xqfgbsvfgfi3g985rmqwrd7w3y54ffr2r99c2";
+    hash = "sha256-gqWURXaOFD/4aZnjmgtKb0T33NbrOdyRTMmLmV42q+4=";
   };
   desktopItem =  makeDesktopItem {
     name = "CCEmuX";
@@ -63,6 +63,6 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/CCEmuX/CCEmuX";
     sourceProvenance = with sourceTypes; [ binaryBytecode ];
     license = licenses.mit;
-    maintainers = with maintainers; [ CrazedProgrammer ];
+    maintainers = with maintainers; [ CrazedProgrammer viluon ];
   };
 }
diff --git a/pkgs/applications/emulators/ryujinx/default.nix b/pkgs/applications/emulators/ryujinx/default.nix
index fd8cd88fafc70..19e9ea8026d8d 100644
--- a/pkgs/applications/emulators/ryujinx/default.nix
+++ b/pkgs/applications/emulators/ryujinx/default.nix
@@ -28,13 +28,13 @@
 
 buildDotnetModule rec {
   pname = "ryujinx";
-  version = "1.1.974"; # Based off of the official github actions builds: https://github.com/Ryujinx/Ryujinx/actions/workflows/release.yml
+  version = "1.1.986"; # Based off of the official github actions builds: https://github.com/Ryujinx/Ryujinx/actions/workflows/release.yml
 
   src = fetchFromGitHub {
     owner = "Ryujinx";
     repo = "Ryujinx";
-    rev = "5a0aa074b661753d8f0202a73d9f6f3ac6e2ab11";
-    sha256 = "0f1wivwf7hnsqi7sgqjrikxvakrk8dmywpmyd36a3s5lbk878wp3";
+    rev = "33f544fd9248361440afd6013e0ef9d69971d6da";
+    sha256 = "1cnz3j8qndfrm1iifbzswyf4vcii939naj29bvr2mp6bdwrbqi49";
   };
 
   dotnet-sdk = dotnetCorePackages.sdk_7_0;
diff --git a/pkgs/applications/emulators/ryujinx/deps.nix b/pkgs/applications/emulators/ryujinx/deps.nix
index 8de8a7293e56f..7d952d9371f0a 100644
--- a/pkgs/applications/emulators/ryujinx/deps.nix
+++ b/pkgs/applications/emulators/ryujinx/deps.nix
@@ -2,49 +2,54 @@
 # Please dont edit it manually, your changes might get overwritten!
 
 { fetchNuGet }: [
-  (fetchNuGet { pname = "Avalonia"; version = "0.10.21"; sha256 = "1x6z0wvlg5ww6n7idj2pwc6mxd7k9xsb7vh3v0z4in3rck0vwz95"; })
-  (fetchNuGet { pname = "Avalonia.Angle.Windows.Natives"; version = "2.1.0.2020091801"; sha256 = "04jm83cz7vkhhr6n2c9hya2k8i2462xbf6np4bidk55as0jdq43a"; })
-  (fetchNuGet { pname = "Avalonia.BuildServices"; version = "0.0.16"; sha256 = "11v3a4kda04jacznl7j8fc9zw16ysajwc3ljmdribbqz1rrr823v"; })
-  (fetchNuGet { pname = "Avalonia.Controls.DataGrid"; version = "0.10.21"; sha256 = "0rx9qni3m1zhv6n73kskgj7vd6fxsalg84i2202gz53m11li7yvj"; })
-  (fetchNuGet { pname = "Avalonia.Desktop"; version = "0.10.21"; sha256 = "0jjx8lfbzqznqv7xpkfi8xvygqcqfk8wzkj9ambq30cn4h1ids05"; })
-  (fetchNuGet { pname = "Avalonia.Diagnostics"; version = "0.10.21"; sha256 = "10fl0nb8lhpvms1apb3mmswrpirc2j8vr78jvb63cni0885vxhab"; })
-  (fetchNuGet { pname = "Avalonia.FreeDesktop"; version = "0.10.21"; sha256 = "038i1vim97niyh9qf5b1lbrakc8r7m03nk1yqn3iv563q8zbwfq7"; })
-  (fetchNuGet { pname = "Avalonia.Markup.Xaml.Loader"; version = "0.10.21"; sha256 = "0p0jz3za6y708fp0wpbjyqivfp6979ldwx8r95nmdmh10fm9q4yi"; })
-  (fetchNuGet { pname = "Avalonia.Native"; version = "0.10.21"; sha256 = "08f17zb0dq7p7naz96il15lhbrzan4897wghkl8rrd80dw0bhbb2"; })
-  (fetchNuGet { pname = "Avalonia.Remote.Protocol"; version = "0.10.21"; sha256 = "03ca99awvp178jsndy5zlsc17rlx29iz0x2jvj85fh6qdvds2dhj"; })
-  (fetchNuGet { pname = "Avalonia.Skia"; version = "0.10.18"; sha256 = "1vi83d9q6m2zd7b5snyzjxsj3vdp5bmi5vqhfslzghslpbhj2zwv"; })
-  (fetchNuGet { pname = "Avalonia.Skia"; version = "0.10.21"; sha256 = "0fja6rv0gw5kjiz0vpnyv5lv8xz5gzd71wz0052x9mrgq3jz00p8"; })
-  (fetchNuGet { pname = "Avalonia.Svg"; version = "0.10.18"; sha256 = "06h7yh2lkm4rqfchn7nxqjbqx4afh42w61z9sby7b5gj56h5a84q"; })
-  (fetchNuGet { pname = "Avalonia.Svg.Skia"; version = "0.10.18"; sha256 = "0s25aq3xz0km55jwdxp59z8cc0d1zqaag1hiwnxdzd30id2ahn66"; })
-  (fetchNuGet { pname = "Avalonia.Win32"; version = "0.10.21"; sha256 = "0ichldyigbsd82jrryq340bqlh7jw9zr850fyni2g3h0bbcx5327"; })
-  (fetchNuGet { pname = "Avalonia.X11"; version = "0.10.21"; sha256 = "08vbdiv2k9vp8gp59rk0z63jyn8hlv8a4956jczy05ail5qfl94v"; })
+  (fetchNuGet { pname = "Avalonia"; version = "11.0.3"; sha256 = "1ig635386glxgfv9l894dqp98l93ymsylml649xm42lc9a9f1khc"; })
+  (fetchNuGet { pname = "Avalonia.Angle.Windows.Natives"; version = "2.1.0.2023020321"; sha256 = "1az4s1g22ipak9a3xfh55z2h3rm6lpqh7svbpw6ag4ysrgsjjsjd"; })
+  (fetchNuGet { pname = "Avalonia.BuildServices"; version = "0.0.29"; sha256 = "05mm7f0jssih3gbzqfgjnfq5cnqa85ihsg0z1897ciihv8qd3waq"; })
+  (fetchNuGet { pname = "Avalonia.Controls.ColorPicker"; version = "11.0.0"; sha256 = "06wgzhxkivlaxkn8p61wainsprml2g1q4jmvy9fpn64qnfywjdn7"; })
+  (fetchNuGet { pname = "Avalonia.Controls.ColorPicker"; version = "11.0.3"; sha256 = "0xcxwc588lc2ify2d3m53pmwjgf7p9lwz5q11hn8p5c9zh01iai9"; })
+  (fetchNuGet { pname = "Avalonia.Controls.DataGrid"; version = "11.0.3"; sha256 = "1kls0v2rjimcv7k0dvqd3l694xdg9nf8wdzcz1cadi4qvj0bx7l4"; })
+  (fetchNuGet { pname = "Avalonia.Controls.ItemsRepeater"; version = "11.0.0"; sha256 = "1qxw096av0n4ks0jixh7xxrzgsn9fshp1ypy3vvij7r0a1sk7y1q"; })
+  (fetchNuGet { pname = "Avalonia.Controls.ItemsRepeater"; version = "11.0.0-rc2.1"; sha256 = "0pmc0fi2abn9qaqwx9lvqnd1a5a8lzp8zin72d3k3xjsh1w1g0n8"; })
+  (fetchNuGet { pname = "Avalonia.Desktop"; version = "11.0.3"; sha256 = "0g8hzvkf2rrfnpmm56m2miwpdw14l04rr0q8xz03j220fy9xk5fm"; })
+  (fetchNuGet { pname = "Avalonia.Diagnostics"; version = "11.0.3"; sha256 = "1rificg9ikf8m2550ylrqavkkvihf8xb22agmdrbz07v7s93v731"; })
+  (fetchNuGet { pname = "Avalonia.FreeDesktop"; version = "11.0.3"; sha256 = "0w8qc45phfz4mnnx1mfxi042qmq31shmjmz5inb4maw9xha0yr3c"; })
+  (fetchNuGet { pname = "Avalonia.Markup.Xaml.Loader"; version = "11.0.3"; sha256 = "09g4flx6sg2b2mkwbqrwl51q87xzy0d43j2xjxvnwc8vwhr1h8gs"; })
+  (fetchNuGet { pname = "Avalonia.Native"; version = "11.0.3"; sha256 = "1gi3y2cdfcjkwjldavahyx09a1n91jpvx8szwrfgr3kk4ycc5lyn"; })
+  (fetchNuGet { pname = "Avalonia.Remote.Protocol"; version = "11.0.0"; sha256 = "1b5031k8slwiz7bncih67fjl6ny234yd4skqxk611l9zp5snjic2"; })
+  (fetchNuGet { pname = "Avalonia.Remote.Protocol"; version = "11.0.3"; sha256 = "0syh20a6892pip4qz32kgc5w77ig40yjgwbcknivhjr8arc3126r"; })
+  (fetchNuGet { pname = "Avalonia.Skia"; version = "11.0.0"; sha256 = "1ra1kd0kkblppr5zy7rzdbwllggrzvp9lkxblf9mg3y8rnp6fk83"; })
+  (fetchNuGet { pname = "Avalonia.Skia"; version = "11.0.3"; sha256 = "0089z8ml8pblq6hispj1nf7lvf6zplrrlix22jcd87pm13232pg2"; })
+  (fetchNuGet { pname = "Avalonia.Svg"; version = "11.0.0"; sha256 = "1xmgaj2wnjdl16x4y6rmfp3q9faca5na90zlb8j62rxcwf1v3lkr"; })
+  (fetchNuGet { pname = "Avalonia.Svg.Skia"; version = "11.0.0"; sha256 = "0cd8w9pm7lpifdzjmsnmjlzdqgq3qw653mcj3adczb5ycqqbd8p3"; })
+  (fetchNuGet { pname = "Avalonia.Themes.Simple"; version = "11.0.3"; sha256 = "0zkm0asxcbsybswxs0p6ybsiq6j1l1j02h0xfxzsmhcimm3y92kk"; })
+  (fetchNuGet { pname = "Avalonia.Win32"; version = "11.0.3"; sha256 = "14pj98057fmfgafq0pni7pw79ls0lsf3jaydfjmdjyw5x2b2x51q"; })
+  (fetchNuGet { pname = "Avalonia.X11"; version = "11.0.3"; sha256 = "0pb41fpiwndcf34r53apxf92qgqxavc4zfl1xy847pz3kj1vsclp"; })
   (fetchNuGet { pname = "CommandLineParser"; version = "2.9.1"; sha256 = "1sldkj8lakggn4hnyabjj1fppqh50fkdrr1k99d4gswpbk5kv582"; })
   (fetchNuGet { pname = "Concentus"; version = "1.1.7"; sha256 = "0y5z444wrbhlmsqpy2sxmajl1fbf74843lvgj3y6vz260dn2q0l0"; })
   (fetchNuGet { pname = "DiscordRichPresence"; version = "1.2.1.24"; sha256 = "0maw0yd6xgwy0cgk593z3zva0r5j267zpdmmpq8avj3zbna6n4x1"; })
   (fetchNuGet { pname = "DynamicData"; version = "7.14.2"; sha256 = "07k79w4702masq71rk865mi3h1kaxamyp7dgl08ny4n22gg8482k"; })
   (fetchNuGet { pname = "ExCSS"; version = "4.1.4"; sha256 = "1y50xp6rihkydbf5l73mr3qq2rm6rdfjrzdw9h1dw9my230q5lpd"; })
   (fetchNuGet { pname = "Fizzler"; version = "1.2.1"; sha256 = "1w5jb1d0figbv68dydbnlcsfmqlc3sv9z1zxp7d79dg2dkarc4qm"; })
-  (fetchNuGet { pname = "FluentAvaloniaUI"; version = "1.4.5"; sha256 = "1j5ivy83f13dgn09qrfkq44ijvh0m9rbdx8760g47di70c4lda7j"; })
+  (fetchNuGet { pname = "FluentAvaloniaUI"; version = "2.0.1"; sha256 = "12w6rk3qgn6i2zk06appf98pgdf89pw10865qcwn5xpjwm7487k2"; })
   (fetchNuGet { pname = "FSharp.Core"; version = "7.0.200"; sha256 = "1ji816r8idwjmxk8bzyq1z32ybz7xdg3nb0a7pnvqr8vys11bkgb"; })
   (fetchNuGet { pname = "GtkSharp.Dependencies"; version = "1.1.1"; sha256 = "0ffywnc3ca1lwhxdnk99l238vsprsrsh678bgm238lb7ja7m52pw"; })
-  (fetchNuGet { pname = "HarfBuzzSharp"; version = "2.8.2.1-preview.108"; sha256 = "0xs4px4fy5b6glc77rqswzpi5ddhxvbar1md6q9wla7hckabnq0z"; })
-  (fetchNuGet { pname = "HarfBuzzSharp.NativeAssets.Linux"; version = "2.8.2.1-preview.108"; sha256 = "16wvgvyra2g1b38rxxgkk85wbz89hspixs54zfcm4racgmj1mrj4"; })
-  (fetchNuGet { pname = "HarfBuzzSharp.NativeAssets.macOS"; version = "2.8.2.1-preview.108"; sha256 = "16v7lrwwif2f5zfkx08n6y6w3m56mh4hy757biv0w9yffaf200js"; })
-  (fetchNuGet { pname = "HarfBuzzSharp.NativeAssets.WebAssembly"; version = "2.8.2.1-preview.108"; sha256 = "15kqb353snwpavz3jja63mq8xjqsrw1f902scm8wxmsqrm5q6x55"; })
-  (fetchNuGet { pname = "HarfBuzzSharp.NativeAssets.Win32"; version = "2.8.2.1-preview.108"; sha256 = "0n6ymn9jqms3mk5hg0ar4y9jmh96myl6q0jimn7ahb1a8viq55k1"; })
-  (fetchNuGet { pname = "JetBrains.Annotations"; version = "10.3.0"; sha256 = "1grdx28ga9fp4hwwpwv354rizm8anfq4lp045q4ss41gvhggr3z8"; })
-  (fetchNuGet { pname = "jp2masa.Avalonia.Flexbox"; version = "0.2.0"; sha256 = "1abck2gad29mgf9gwqgc6wr8iwl64v50n0sbxcj1bcxgkgndraiq"; })
+  (fetchNuGet { pname = "HarfBuzzSharp"; version = "2.8.2.3"; sha256 = "115aybicqs9ijjlcv6k6r5v0agkjm1bm1nkd0rj3jglv8s0xvmp2"; })
+  (fetchNuGet { pname = "HarfBuzzSharp.NativeAssets.Linux"; version = "2.8.2.3"; sha256 = "1f18ahwkaginrg0vwsi6s56lvnqvvxv7pzklfs5lnknasxy1a76z"; })
+  (fetchNuGet { pname = "HarfBuzzSharp.NativeAssets.macOS"; version = "2.8.2.3"; sha256 = "052d8frpkj4ijs6fm6xp55xbv95b1s9biqwa0w8zp3rgm88m9236"; })
+  (fetchNuGet { pname = "HarfBuzzSharp.NativeAssets.WebAssembly"; version = "2.8.2.3"; sha256 = "043hv36bg5240znbm8x5la7py17m4jfzy57q3ka32f6zjld83j36"; })
+  (fetchNuGet { pname = "HarfBuzzSharp.NativeAssets.Win32"; version = "2.8.2.3"; sha256 = "08khd2jqm8sw58ljz5srangzfm2sz3gd2q1jzc5fr80lj8rv6r74"; })
+  (fetchNuGet { pname = "jp2masa.Avalonia.Flexbox"; version = "0.3.0-beta.4"; sha256 = "17847ssn15l755zmspvb69wsfbj9ayvy9xl8zgjx6wvvwp6x89cp"; })
   (fetchNuGet { pname = "LibHac"; version = "0.18.0"; sha256 = "19d5fqdcws0730580jlda6pdddprxcrhw7b3ybiiglabsr7bmgdv"; })
-  (fetchNuGet { pname = "MicroCom.CodeGenerator.MSBuild"; version = "0.10.4"; sha256 = "1bdgy6g15d1mln1xpvs6sy0l2zvfs4hxw6nc3qm16qb8hdgvb73y"; })
-  (fetchNuGet { pname = "MicroCom.Runtime"; version = "0.10.4"; sha256 = "0ccbzp0d01dcahm7ban7xyh1rk7k2pkml3l5i7s85cqk5lnczpw2"; })
-  (fetchNuGet { pname = "Microsoft.CodeAnalysis.Analyzers"; version = "2.9.6"; sha256 = "18mr1f0wpq0fir8vjnq0a8pz50zpnblr7sabff0yqx37c975934a"; })
+  (fetchNuGet { pname = "MicroCom.CodeGenerator.MSBuild"; version = "0.11.0"; sha256 = "0ynvaq3faqh4pirl0l8l6xq2ikk3f27xw05i8vm3vwamgy4p7k2f"; })
+  (fetchNuGet { pname = "MicroCom.Runtime"; version = "0.11.0"; sha256 = "0p9c3m0zk59x9dcqw077hzd2yk60myisbacvm36mnwpcjwzjkp2m"; })
+  (fetchNuGet { pname = "Microsoft.CodeAnalysis.Analyzers"; version = "3.0.0"; sha256 = "0bbl0jpqywqmzz2gagld1p2gvdfldjfjmm25hil9wj2nq1zc4di8"; })
   (fetchNuGet { pname = "Microsoft.CodeAnalysis.Analyzers"; version = "3.3.4"; sha256 = "0wd6v57p53ahz5z9zg4iyzmy3src7rlsncyqpcag02jjj1yx6g58"; })
-  (fetchNuGet { pname = "Microsoft.CodeAnalysis.Common"; version = "3.4.0"; sha256 = "12rn6gl4viycwk3pz5hp5df63g66zvba4hnkwr3f0876jj5ivmsw"; })
+  (fetchNuGet { pname = "Microsoft.CodeAnalysis.Common"; version = "3.8.0"; sha256 = "12n7rvr39bzkf2maw7zplw8rwpxpxss4ich3bb2pw770rx4nyvyw"; })
   (fetchNuGet { pname = "Microsoft.CodeAnalysis.Common"; version = "4.6.0"; sha256 = "0qvkwkbqz4dhkxsisanax1lwm3nzyyb4kgb40qczxbl8g251cjp2"; })
-  (fetchNuGet { pname = "Microsoft.CodeAnalysis.CSharp"; version = "3.4.0"; sha256 = "0rhylcwa95bxawcgixk64knv7p7xrykdjcabmx3gknk8hvj1ai9y"; })
+  (fetchNuGet { pname = "Microsoft.CodeAnalysis.CSharp"; version = "3.8.0"; sha256 = "1kmry65csvfn72zzc16vj1nfbfwam28wcmlrk3m5rzb8ydbzgylb"; })
   (fetchNuGet { pname = "Microsoft.CodeAnalysis.CSharp"; version = "4.6.0"; sha256 = "1yfvwygx795c9lswpiv8q19zydifarzljdmvv67vjmi559cm8b1q"; })
-  (fetchNuGet { pname = "Microsoft.CodeAnalysis.CSharp.Scripting"; version = "3.4.0"; sha256 = "1h2f0z9xnw987x8bydka1sd42ijqjx973md6v1gvpy1qc6ad244g"; })
-  (fetchNuGet { pname = "Microsoft.CodeAnalysis.Scripting.Common"; version = "3.4.0"; sha256 = "195gqnpwqkg2wlvk8x6yzm7byrxfq9bki20xmhf6lzfsdw3z4mf2"; })
+  (fetchNuGet { pname = "Microsoft.CodeAnalysis.CSharp.Scripting"; version = "3.8.0"; sha256 = "0w0yx0lpg54iw5jazqk46h48gx43ij32gwac8iywdj6kxfxm03vw"; })
+  (fetchNuGet { pname = "Microsoft.CodeAnalysis.Scripting.Common"; version = "3.8.0"; sha256 = "0hjgxcsj5zy27lqk0986m59n5dbplx2vjjla2lsvg4bwg8qa7bpk"; })
   (fetchNuGet { pname = "Microsoft.CodeCoverage"; version = "17.6.3"; sha256 = "1xxzd2yxlbq2h4k6flp7lvffmmwrjlyha2z1yvrxxymiyyggk2zg"; })
   (fetchNuGet { pname = "Microsoft.CSharp"; version = "4.3.0"; sha256 = "0gw297dgkh0al1zxvgvncqs0j15lsna9l1wpqas4rflmys440xvb"; })
   (fetchNuGet { pname = "Microsoft.CSharp"; version = "4.5.0"; sha256 = "01i28nvzccxbqmiz217fxs6hnjwmd5fafs37rd49a6qp53y6623l"; })
@@ -136,7 +141,7 @@
   (fetchNuGet { pname = "Ryujinx.SDL2-CS"; version = "2.28.1-build28"; sha256 = "0kn7f6cgvb2rsybiif6g7xkw1srmfr306zpv029lvi264dv6aj6l"; })
   (fetchNuGet { pname = "shaderc.net"; version = "0.1.0"; sha256 = "0f35s9h0vj9f1rx9bssj66hibc3j9bzrb4wgb5q2jwkf5xncxbpq"; })
   (fetchNuGet { pname = "SharpZipLib"; version = "1.4.2"; sha256 = "0ijrzz2szxjmv2cipk7rpmg14dfaigdkg7xabjvb38ih56m9a27y"; })
-  (fetchNuGet { pname = "ShimSkiaSharp"; version = "0.5.18"; sha256 = "1i97f2zbsm8vhcbcfj6g4ml6g261gijdh7s3rmvwvxgfha6qyvkg"; })
+  (fetchNuGet { pname = "ShimSkiaSharp"; version = "1.0.0"; sha256 = "0gdsrzh8q8mxlm7sxvai7zshaz93a3dm1ha4cgs4845lfhpn8nhc"; })
   (fetchNuGet { pname = "Silk.NET.Core"; version = "2.16.0"; sha256 = "1mkqc2aicvknmpyfry2v7jjxh3apaxa6dmk1vfbwxnkysl417x0k"; })
   (fetchNuGet { pname = "Silk.NET.Vulkan"; version = "2.16.0"; sha256 = "0sg5mxv7ga5pq6wc0lz52j07fxrcfmb0an30r4cxsxk66298z2wy"; })
   (fetchNuGet { pname = "Silk.NET.Vulkan.Extensions.EXT"; version = "2.16.0"; sha256 = "05918f6fl8byla2m7qjp7dvxww2rbpj2sqd4xq26rl885fmddfvf"; })
@@ -144,16 +149,16 @@
   (fetchNuGet { pname = "SixLabors.Fonts"; version = "1.0.0-beta0013"; sha256 = "0r0aw8xxd32rwcawawcz6asiyggz02hnzg5hvz8gimq8hvwx1wql"; })
   (fetchNuGet { pname = "SixLabors.ImageSharp"; version = "1.0.4"; sha256 = "0fmgn414my76gjgp89qlc210a0lqvnvkvk2fcwnpwxdhqpfvyilr"; })
   (fetchNuGet { pname = "SixLabors.ImageSharp.Drawing"; version = "1.0.0-beta11"; sha256 = "0hl0rs3kr1zdnx3gdssxgli6fyvmwzcfp99f4db71s0i8j8b2bp5"; })
-  (fetchNuGet { pname = "SkiaSharp"; version = "2.88.1-preview.108"; sha256 = "01sm36hdgmcgkai9m09xn2qfz8v7xhh803n8fng8rlxwnw60rgg6"; })
-  (fetchNuGet { pname = "SkiaSharp.HarfBuzz"; version = "2.88.1-preview.108"; sha256 = "1hjscqn2kfgvn367drxzwssj5f5arn919x6clywbbf2dhggcdnn5"; })
-  (fetchNuGet { pname = "SkiaSharp.NativeAssets.Linux"; version = "2.88.1-preview.108"; sha256 = "19jf2jcq2spwbpx3cfdi2a95jf4y8205rh56lmkh8zsxd2k7fjyp"; })
-  (fetchNuGet { pname = "SkiaSharp.NativeAssets.macOS"; version = "2.88.1-preview.108"; sha256 = "1vcpqd7slh2b9gsacpd7mk1266r1xfnkm6230k8chl3ng19qlf15"; })
-  (fetchNuGet { pname = "SkiaSharp.NativeAssets.WebAssembly"; version = "2.88.1-preview.108"; sha256 = "0a89gqjw8k97arr0kyd0fm3f46k1qamksbnyns9xdlgydjg557dd"; })
-  (fetchNuGet { pname = "SkiaSharp.NativeAssets.Win32"; version = "2.88.1-preview.108"; sha256 = "05g9blprq5msw3wshrgsk19y0fvhjlqiybs1vdyhfmww330jlypn"; })
+  (fetchNuGet { pname = "SkiaSharp"; version = "2.88.3"; sha256 = "1yq694myq2rhfp2hwwpyzcg1pzpxcp7j72wib8p9pw9dfj7008sv"; })
+  (fetchNuGet { pname = "SkiaSharp.HarfBuzz"; version = "2.88.3"; sha256 = "0axz2zfyg0h3zis7rr86ikrm2jbxxy0gqb3bbawpgynf1k0fsi6a"; })
+  (fetchNuGet { pname = "SkiaSharp.NativeAssets.Linux"; version = "2.88.3"; sha256 = "0dajvr60nwvnv7s6kcqgw1w97zxdpz1c5lb7kcq7r0hi0l05ck3q"; })
+  (fetchNuGet { pname = "SkiaSharp.NativeAssets.macOS"; version = "2.88.3"; sha256 = "191ajgi6fnfqcvqvkayjsxasiz6l0bv3pps8vv9abbyc4b12qvph"; })
+  (fetchNuGet { pname = "SkiaSharp.NativeAssets.WebAssembly"; version = "2.88.3"; sha256 = "1w5njksq3amrrp7fqxw89nv6ar2kgc5yx092i4rxv7hrjbd1aagx"; })
+  (fetchNuGet { pname = "SkiaSharp.NativeAssets.Win32"; version = "2.88.3"; sha256 = "03wwfbarsxjnk70qhqyd1dw65098dncqk2m0vksx92j70i7lry6q"; })
   (fetchNuGet { pname = "SPB"; version = "0.0.4-build28"; sha256 = "1ran6qwzlkv6xpvnp7n0nkva0zfrzwlcxj7zfzz9v8mpicqs297x"; })
-  (fetchNuGet { pname = "Svg.Custom"; version = "0.5.18"; sha256 = "0x68cs525k7c2dvj3vhjhx7bcls600xlsjkhfi7xvj0621masxa4"; })
-  (fetchNuGet { pname = "Svg.Model"; version = "0.5.18"; sha256 = "1pqqaphdsjv4w9qlzb2i0kf0aas8778nlb4nysyiy5rdvpp7zzng"; })
-  (fetchNuGet { pname = "Svg.Skia"; version = "0.5.18"; sha256 = "0j1n096d49gd53j6zzngf5v81dnrdzaa4rx7fpmk8zp1xz2wjb2j"; })
+  (fetchNuGet { pname = "Svg.Custom"; version = "1.0.0"; sha256 = "0bmvgaqy4iaxw9x88ifx3a2zz0vw3p9w6pj4bk3xfnf5p9vjx1mr"; })
+  (fetchNuGet { pname = "Svg.Model"; version = "1.0.0"; sha256 = "0yrjcqcrlgqpdm3bi59nc3fppcqgrfc7jddjwxjj2q423gimip97"; })
+  (fetchNuGet { pname = "Svg.Skia"; version = "1.0.0"; sha256 = "1bs2l9fjiqpip4qh0aw7x8f8m0ja0xlcj5vwd329knkww2jx1d3c"; })
   (fetchNuGet { pname = "System.AppContext"; version = "4.1.0"; sha256 = "0fv3cma1jp4vgj7a8hqc9n7hr1f1kjp541s6z0q1r6nazb4iz9mz"; })
   (fetchNuGet { pname = "System.Buffers"; version = "4.0.0"; sha256 = "13s659bcmg9nwb6z78971z1lr6bmh2wghxi1ayqyzl4jijd351gr"; })
   (fetchNuGet { pname = "System.Buffers"; version = "4.3.0"; sha256 = "0fgns20ispwrfqll4q1zc1waqcmylb3zc50ys9x8zlwxh9pmd9jy"; })
@@ -163,7 +168,7 @@
   (fetchNuGet { pname = "System.Collections"; version = "4.0.11"; sha256 = "1ga40f5lrwldiyw6vy67d0sg7jd7ww6kgwbksm19wrvq9hr0bsm6"; })
   (fetchNuGet { pname = "System.Collections"; version = "4.3.0"; sha256 = "19r4y64dqyrq6k4706dnyhhw7fs24kpp3awak7whzss39dakpxk9"; })
   (fetchNuGet { pname = "System.Collections.Concurrent"; version = "4.0.12"; sha256 = "07y08kvrzpak873pmyxs129g1ch8l27zmg51pcyj2jvq03n0r0fc"; })
-  (fetchNuGet { pname = "System.Collections.Immutable"; version = "1.5.0"; sha256 = "1d5gjn5afnrf461jlxzawcvihz195gayqpcfbv6dd7pxa9ialn06"; })
+  (fetchNuGet { pname = "System.Collections.Immutable"; version = "5.0.0"; sha256 = "1kvcllagxz2q92g81zkz81djkn2lid25ayjfgjalncyc68i15p0r"; })
   (fetchNuGet { pname = "System.Collections.Immutable"; version = "7.0.0"; sha256 = "1n9122cy6v3qhsisc9lzwa1m1j62b8pi2678nsmnlyvfpk0zdagm"; })
   (fetchNuGet { pname = "System.ComponentModel.Annotations"; version = "4.5.0"; sha256 = "1jj6f6g87k0iwsgmg3xmnn67a14mq88np0l1ys5zkxhkvbc8976p"; })
   (fetchNuGet { pname = "System.Console"; version = "4.0.0"; sha256 = "0ynxqbc3z1nwbrc11hkkpw9skw116z4y9wjzn7id49p9yi7mzmlf"; })
@@ -186,12 +191,12 @@
   (fetchNuGet { pname = "System.IO.FileSystem"; version = "4.0.1"; sha256 = "0kgfpw6w4djqra3w5crrg8xivbanh1w9dh3qapb28q060wb9flp1"; })
   (fetchNuGet { pname = "System.IO.FileSystem.Primitives"; version = "4.0.1"; sha256 = "1s0mniajj3lvbyf7vfb5shp4ink5yibsx945k6lvxa96r8la1612"; })
   (fetchNuGet { pname = "System.IO.Hashing"; version = "7.0.0"; sha256 = "0vilmb817wnw8w13kkps831p05zzc41dldigpbr3wqi0hsrf8ad9"; })
+  (fetchNuGet { pname = "System.IO.Pipelines"; version = "6.0.0"; sha256 = "08211lvckdsdbd67xz4f6cyk76cli565j0dby1grlc4k9bhwby65"; })
   (fetchNuGet { pname = "System.Linq"; version = "4.1.0"; sha256 = "1ppg83svb39hj4hpp5k7kcryzrf3sfnm08vxd5sm2drrijsla2k5"; })
   (fetchNuGet { pname = "System.Linq"; version = "4.3.0"; sha256 = "1w0gmba695rbr80l1k2h4mrwzbzsyfl2z4klmpbsvsg5pm4a56s7"; })
   (fetchNuGet { pname = "System.Linq.Expressions"; version = "4.1.0"; sha256 = "1gpdxl6ip06cnab7n3zlcg6mqp7kknf73s8wjinzi4p0apw82fpg"; })
   (fetchNuGet { pname = "System.Linq.Expressions"; version = "4.3.0"; sha256 = "0ky2nrcvh70rqq88m9a5yqabsl4fyd17bpr63iy2mbivjs2nyypv"; })
   (fetchNuGet { pname = "System.Management"; version = "7.0.2"; sha256 = "0mjdkzl459hnz0qg4m0xp2kwizsqgdc9vc3xk7y7cv0znhhbb7bc"; })
-  (fetchNuGet { pname = "System.Memory"; version = "4.5.3"; sha256 = "0naqahm3wljxb5a911d37mwjqjdxv9l0b49p5dmfyijvni2ppy8a"; })
   (fetchNuGet { pname = "System.Memory"; version = "4.5.4"; sha256 = "14gbbs22mcxwggn0fcfs1b062521azb9fbb7c113x0mq6dzq9h6y"; })
   (fetchNuGet { pname = "System.Memory"; version = "4.5.5"; sha256 = "08jsfwimcarfzrhlyvjjid61j02irx6xsklf32rv57x2aaikvx0h"; })
   (fetchNuGet { pname = "System.Net.Http"; version = "4.1.0"; sha256 = "1i5rqij1icg05j8rrkw4gd4pgia1978mqhjzhsjg69lvwcdfg8yb"; })
@@ -204,13 +209,11 @@
   (fetchNuGet { pname = "System.ObjectModel"; version = "4.0.12"; sha256 = "1sybkfi60a4588xn34nd9a58png36i0xr4y4v4kqpg8wlvy5krrj"; })
   (fetchNuGet { pname = "System.ObjectModel"; version = "4.3.0"; sha256 = "191p63zy5rpqx7dnrb3h7prvgixmk168fhvvkkvhlazncf8r3nc2"; })
   (fetchNuGet { pname = "System.Private.Uri"; version = "4.3.0"; sha256 = "04r1lkdnsznin0fj4ya1zikxiqr0h6r6a1ww2dsm60gqhdrf0mvx"; })
-  (fetchNuGet { pname = "System.Reactive"; version = "5.0.0"; sha256 = "1lafmpnadhiwxyd543kraxa3jfdpm6ipblxrjlibym9b1ykpr5ik"; })
   (fetchNuGet { pname = "System.Reactive"; version = "6.0.0"; sha256 = "1mkvx1fwychpczksy6svfmniqhbm3xqblxqik6178l12xgq7aw45"; })
   (fetchNuGet { pname = "System.Reflection"; version = "4.1.0"; sha256 = "1js89429pfw79mxvbzp8p3q93il6rdff332hddhzi5wqglc4gml9"; })
   (fetchNuGet { pname = "System.Reflection"; version = "4.3.0"; sha256 = "0xl55k0mw8cd8ra6dxzh974nxif58s3k1rjv1vbd7gjbjr39j11m"; })
   (fetchNuGet { pname = "System.Reflection.Emit"; version = "4.0.1"; sha256 = "0ydqcsvh6smi41gyaakglnv252625hf29f7kywy2c70nhii2ylqp"; })
   (fetchNuGet { pname = "System.Reflection.Emit"; version = "4.3.0"; sha256 = "11f8y3qfysfcrscjpjym9msk7lsfxkk4fmz9qq95kn3jd0769f74"; })
-  (fetchNuGet { pname = "System.Reflection.Emit"; version = "4.7.0"; sha256 = "121l1z2ypwg02yz84dy6gr82phpys0njk7yask3sihgy214w43qp"; })
   (fetchNuGet { pname = "System.Reflection.Emit.ILGeneration"; version = "4.0.1"; sha256 = "1pcd2ig6bg144y10w7yxgc9d22r7c7ww7qn1frdfwgxr24j9wvv0"; })
   (fetchNuGet { pname = "System.Reflection.Emit.ILGeneration"; version = "4.3.0"; sha256 = "0w1n67glpv8241vnpz1kl14sy7zlnw414aqwj4hcx5nd86f6994q"; })
   (fetchNuGet { pname = "System.Reflection.Emit.Lightweight"; version = "4.0.1"; sha256 = "1s4b043zdbx9k39lfhvsk68msv1nxbidhkq6nbm27q7sf8xcsnxr"; })
@@ -218,6 +221,7 @@
   (fetchNuGet { pname = "System.Reflection.Extensions"; version = "4.0.1"; sha256 = "0m7wqwq0zqq9gbpiqvgk3sr92cbrw7cp3xn53xvw7zj6rz6fdirn"; })
   (fetchNuGet { pname = "System.Reflection.Extensions"; version = "4.3.0"; sha256 = "02bly8bdc98gs22lqsfx9xicblszr2yan7v2mmw3g7hy6miq5hwq"; })
   (fetchNuGet { pname = "System.Reflection.Metadata"; version = "1.6.0"; sha256 = "1wdbavrrkajy7qbdblpbpbalbdl48q3h34cchz24gvdgyrlf15r4"; })
+  (fetchNuGet { pname = "System.Reflection.Metadata"; version = "5.0.0"; sha256 = "17qsl5nanlqk9iz0l5wijdn6ka632fs1m1fvx18dfgswm258r3ss"; })
   (fetchNuGet { pname = "System.Reflection.Metadata"; version = "7.0.0"; sha256 = "1wilasn2qmj870h2bhw348lspamm7pbinpb4m89icg113510l00v"; })
   (fetchNuGet { pname = "System.Reflection.Primitives"; version = "4.0.1"; sha256 = "1bangaabhsl4k9fg8khn83wm6yial8ik1sza7401621jc6jrym28"; })
   (fetchNuGet { pname = "System.Reflection.Primitives"; version = "4.3.0"; sha256 = "04xqa33bld78yv5r93a8n76shvc8wwcdgr1qvvjh959g3rc31276"; })
@@ -227,9 +231,8 @@
   (fetchNuGet { pname = "System.Resources.ResourceManager"; version = "4.3.0"; sha256 = "0sjqlzsryb0mg4y4xzf35xi523s4is4hz9q4qgdvlvgivl7qxn49"; })
   (fetchNuGet { pname = "System.Runtime"; version = "4.1.0"; sha256 = "02hdkgk13rvsd6r9yafbwzss8kr55wnj8d5c7xjnp8gqrwc8sn0m"; })
   (fetchNuGet { pname = "System.Runtime"; version = "4.3.0"; sha256 = "066ixvgbf2c929kgknshcxqj6539ax7b9m570cp8n179cpfkapz7"; })
-  (fetchNuGet { pname = "System.Runtime.CompilerServices.Unsafe"; version = "4.5.2"; sha256 = "1vz4275fjij8inf31np78hw50al8nqkngk04p3xv5n4fcmf1grgi"; })
-  (fetchNuGet { pname = "System.Runtime.CompilerServices.Unsafe"; version = "4.6.0"; sha256 = "0xmzi2gpbmgyfr75p24rqqsba3cmrqgmcv45lsqp5amgrdwd0f0m"; })
   (fetchNuGet { pname = "System.Runtime.CompilerServices.Unsafe"; version = "4.7.0"; sha256 = "16r6sn4czfjk8qhnz7bnqlyiaaszr0ihinb7mq9zzr1wba257r54"; })
+  (fetchNuGet { pname = "System.Runtime.CompilerServices.Unsafe"; version = "4.7.1"; sha256 = "119br3pd85lq8zcgh4f60jzmv1g976q1kdgi3hvqdlhfbw6siz2j"; })
   (fetchNuGet { pname = "System.Runtime.CompilerServices.Unsafe"; version = "5.0.0"; sha256 = "02k25ivn50dmqx5jn8hawwmz24yf0454fjd823qk6lygj9513q4x"; })
   (fetchNuGet { pname = "System.Runtime.CompilerServices.Unsafe"; version = "6.0.0"; sha256 = "0qm741kh4rh57wky16sq4m0v05fxmkjjr87krycf5vp9f0zbahbc"; })
   (fetchNuGet { pname = "System.Runtime.Extensions"; version = "4.1.0"; sha256 = "0rw4rm4vsm3h3szxp9iijc3ksyviwsv6f63dng3vhqyg4vjdkc2z"; })
@@ -253,7 +256,6 @@
   (fetchNuGet { pname = "System.Security.Principal"; version = "4.3.0"; sha256 = "12cm2zws06z4lfc4dn31iqv7072zyi4m910d4r6wm8yx85arsfxf"; })
   (fetchNuGet { pname = "System.Security.Principal.Windows"; version = "4.3.0"; sha256 = "00a0a7c40i3v4cb20s2cmh9csb5jv2l0frvnlzyfxh848xalpdwr"; })
   (fetchNuGet { pname = "System.Security.Principal.Windows"; version = "4.5.0"; sha256 = "0rmj89wsl5yzwh0kqjgx45vzf694v9p92r4x4q6yxldk1cv1hi86"; })
-  (fetchNuGet { pname = "System.Security.Principal.Windows"; version = "4.7.0"; sha256 = "1a56ls5a9sr3ya0nr086sdpa9qv0abv31dd6fp27maqa9zclqq5d"; })
   (fetchNuGet { pname = "System.Text.Encoding"; version = "4.0.11"; sha256 = "1dyqv0hijg265dwxg6l7aiv74102d6xjiwplh2ar1ly6xfaa4iiw"; })
   (fetchNuGet { pname = "System.Text.Encoding"; version = "4.3.0"; sha256 = "1f04lkir4iladpp51sdgmis9dj4y8v08cka0mbmsy0frc9a4gjqr"; })
   (fetchNuGet { pname = "System.Text.Encoding.CodePages"; version = "4.5.1"; sha256 = "1z21qyfs6sg76rp68qdx0c9iy57naan89pg7p6i3qpj8kyzn921w"; })
@@ -269,14 +271,12 @@
   (fetchNuGet { pname = "System.Threading.Tasks"; version = "4.0.11"; sha256 = "0nr1r41rak82qfa5m0lhk9mp0k93bvfd7bbd9sdzwx9mb36g28p5"; })
   (fetchNuGet { pname = "System.Threading.Tasks"; version = "4.3.0"; sha256 = "134z3v9abw3a6jsw17xl3f6hqjpak5l682k2vz39spj4kmydg6k7"; })
   (fetchNuGet { pname = "System.Threading.Tasks.Extensions"; version = "4.0.0"; sha256 = "1cb51z062mvc2i8blpzmpn9d9mm4y307xrwi65di8ri18cz5r1zr"; })
-  (fetchNuGet { pname = "System.Threading.Tasks.Extensions"; version = "4.5.3"; sha256 = "0g7r6hm572ax8v28axrdxz1gnsblg6kszq17g51pj14a5rn2af7i"; })
   (fetchNuGet { pname = "System.Threading.Tasks.Extensions"; version = "4.5.4"; sha256 = "0y6ncasgfcgnjrhynaf0lwpkpkmv4a07sswwkwbwb5h7riisj153"; })
   (fetchNuGet { pname = "System.Threading.ThreadPool"; version = "4.3.0"; sha256 = "027s1f4sbx0y1xqw2irqn6x161lzj8qwvnh2gn78ciiczdv10vf1"; })
   (fetchNuGet { pname = "System.Threading.Timer"; version = "4.0.1"; sha256 = "15n54f1f8nn3mjcjrlzdg6q3520571y012mx7v991x2fvp73lmg6"; })
   (fetchNuGet { pname = "System.ValueTuple"; version = "4.5.0"; sha256 = "00k8ja51d0f9wrq4vv5z2jhq8hy31kac2rg0rv06prylcybzl8cy"; })
   (fetchNuGet { pname = "System.Xml.ReaderWriter"; version = "4.0.11"; sha256 = "0c6ky1jk5ada9m94wcadih98l6k1fvf6vi7vhn1msjixaha419l5"; })
   (fetchNuGet { pname = "System.Xml.XDocument"; version = "4.0.11"; sha256 = "0n4lvpqzy9kc7qy1a4acwwd7b7pnvygv895az5640idl2y9zbz18"; })
-  (fetchNuGet { pname = "Tmds.DBus"; version = "0.9.0"; sha256 = "0vvx6sg8lxm23g5jvm5wh2gfs95mv85vd52lkq7d1b89bdczczf3"; })
+  (fetchNuGet { pname = "Tmds.DBus.Protocol"; version = "0.15.0"; sha256 = "0d99kcs7r9cp6gpyc7z230czkkyx4164x86dhy0mca73f2ykc2g2"; })
   (fetchNuGet { pname = "UnicornEngine.Unicorn"; version = "2.0.2-rc1-fb78016"; sha256 = "1r43b5fd5q8xq8b5nk11jsz2gnm96dh7sxc0rrv2p605ivz7icin"; })
-  (fetchNuGet { pname = "XamlNameReferenceGenerator"; version = "1.6.1"; sha256 = "0348gj9g5rl0pj2frx4vscj6602gfyn9ba3i1rmfcrxh9jwwa09m"; })
 ]
diff --git a/pkgs/applications/misc/gpsprune/default.nix b/pkgs/applications/misc/gpsprune/default.nix
index 58a18f59b5b6c..dd76fe87550a5 100644
--- a/pkgs/applications/misc/gpsprune/default.nix
+++ b/pkgs/applications/misc/gpsprune/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gpsprune";
-  version = "22.2";
+  version = "23.1";
 
   src = fetchurl {
     url = "https://activityworkshop.net/software/gpsprune/gpsprune_${version}.jar";
-    sha256 = "sha256-7T7UmS650VvYN29vQxemzsaxF5wPFF+yCNCTyXY7nmY=";
+    sha256 = "sha256-0Lf/GuqlovVbnk3jSJHFGF688GXABcSVLr1hATaIomk=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/applications/misc/waybar/default.nix b/pkgs/applications/misc/waybar/default.nix
index 7c0c88bb6d877..b2e0f0545a59e 100644
--- a/pkgs/applications/misc/waybar/default.nix
+++ b/pkgs/applications/misc/waybar/default.nix
@@ -38,30 +38,30 @@
 let
   # Derived from subprojects/cava.wrap
   libcava = rec {
-    version = "0.8.4";
+    version = "0.8.5";
     src = fetchFromGitHub {
       owner = "LukashonakV";
       repo = "cava";
       rev = version;
-      hash = "sha256-66uc0CEriV9XOjSjFTt+bxghEXY1OGrpjd+7d6piJUI=";
+      hash = "sha256-b/XfqLh8PnW018sGVKRRlFvBpo2Ru1R2lUeTR7pugBo=";
     };
   };
 in
 stdenv.mkDerivation rec {
   pname = "waybar";
-  version = "0.9.20";
+  version = "0.9.21";
 
   src = fetchFromGitHub {
     owner = "Alexays";
     repo = "Waybar";
     rev = version;
-    hash = "sha256-xLcoysnCPB9+jI5cZokWWIvXM5wo3eXOe/hXfuChBR4=";
+    hash = "sha256-VvQTRo2MuJ475lKrExVhzi74fb1wAw0gHD1v4rcWIDk=";
   };
 
   postUnpack = lib.optional cavaSupport ''
     (
       cd "$sourceRoot"
-      cp -R --no-preserve=mode,ownership ${libcava.src} subprojects/cava-0.8.4
+      cp -R --no-preserve=mode,ownership ${libcava.src} subprojects/cava-0.8.5
       patchShebangs .
     )
   '';
diff --git a/pkgs/applications/networking/appgate-sdp/default.nix b/pkgs/applications/networking/appgate-sdp/default.nix
index d5c779051e493..2acf0f010c4e0 100644
--- a/pkgs/applications/networking/appgate-sdp/default.nix
+++ b/pkgs/applications/networking/appgate-sdp/default.nix
@@ -86,11 +86,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "appgate-sdp";
-  version = "6.2.0";
+  version = "6.2.1";
 
   src = fetchurl {
     url = "https://bin.appgate-sdp.com/${lib.versions.majorMinor version}/client/appgate-sdp_${version}_amd64.deb";
-    sha256 = "sha256-qs4hrhQGPMYfhz95y8lNECcDGbsvypVN5DPSKsHhiFs=";
+    sha256 = "sha256-TjwVUBSBYo67lJyTXeee1bSaCnYLGE/MKSt+YEV+/Hw=";
   };
 
   # just patch interpreter
diff --git a/pkgs/applications/networking/cluster/kubectl-klock/default.nix b/pkgs/applications/networking/cluster/kubectl-klock/default.nix
new file mode 100644
index 0000000000000..b6abac2fc960c
--- /dev/null
+++ b/pkgs/applications/networking/cluster/kubectl-klock/default.nix
@@ -0,0 +1,23 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "kubectl-klock";
+  version = "0.3.1";
+
+  src = fetchFromGitHub {
+    owner = "jillejr";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-zOdi2QUVvRPPiI22bm7Z5OeShslysjcnvkhroOjbZrU=";
+  };
+
+  vendorSha256 = "sha256-r4oAmD/7CXYiWEWR/FC/Ab0LNxehWv6oCWjQ/fGU2rU=";
+
+  meta = with lib; {
+    description = "A kubectl plugin to render watch output in a more readable fashion";
+    homepage = "https://github.com/jillejr/kubectl-klock";
+    changelog = "https://github.com/jillejr/kubectl-klock/releases/tag/v${version}";
+    license = licenses.gpl3Plus;
+    maintainers = [ maintainers.scm2342 ];
+  };
+}
diff --git a/pkgs/applications/networking/cluster/pachyderm/default.nix b/pkgs/applications/networking/cluster/pachyderm/default.nix
index c948d08d305f6..5483fc1e0f494 100644
--- a/pkgs/applications/networking/cluster/pachyderm/default.nix
+++ b/pkgs/applications/networking/cluster/pachyderm/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "pachyderm";
-  version = "2.6.8";
+  version = "2.7.0";
 
   src = fetchFromGitHub {
     owner = "pachyderm";
     repo = "pachyderm";
     rev = "v${version}";
-    hash = "sha256-2AD/JGdcJV8qYH/k3gR9YgLsMcyKtWJmqQN29NUsE4Y=";
+    hash = "sha256-OA6NY8hI/Aw6vdtDfN1cRXdsLLfxW5ECg5tobPZB66Y=";
   };
 
-  vendorHash = "sha256-3EG9d4ERaWuHaKFt0KFCOKIgTdrL7HZTO+GSi2RROKY=";
+  vendorHash = "sha256-q8Cx+J5BjMvO5wuvH5Tc5Oa9rjW7vXvS4DhSVv/E3E4=";
 
   subPackages = [ "src/server/cmd/pachctl" ];
 
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 509bd5d578109..e7f3038f7a608 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -182,13 +182,13 @@
     "vendorHash": "sha256-/dOiXO2aPkuZaFiwv/6AXJdIADgx8T7eOwvJfBBoqg8="
   },
   "buildkite": {
-    "hash": "sha256-GRFthxNKWcdOdFL6gnI7Y3ehSzqt8ijzBe4eyRy0KcM=",
+    "hash": "sha256-rcklWodBh5iJjxIjGhEH0l3S9bXUWfBG52V/23o8JDM=",
     "homepage": "https://registry.terraform.io/providers/buildkite/buildkite",
     "owner": "buildkite",
     "repo": "terraform-provider-buildkite",
-    "rev": "v0.23.0",
+    "rev": "v0.24.0",
     "spdx": "MIT",
-    "vendorHash": "sha256-oVXrSI+DU6NgmVIPcS4He4mHVrkA2tMxFUpxMnv0bu4="
+    "vendorHash": "sha256-3BtXtXhFyTNQD0J/5hNi0JsPcaIDWUQNEgf6r0VIfMM="
   },
   "checkly": {
     "hash": "sha256-tOTrAi6hd4HFbHAj0p/LTYdxQl1R1WuQ9L4hzqmDVqI=",
@@ -227,13 +227,13 @@
     "vendorHash": "sha256-VTSbi2pDllzyKDhWs5EpWSXO5oKl+khVqLg/Ro3x8ys="
   },
   "cloudfoundry": {
-    "hash": "sha256-hoX2KNUzC7G+bFxReTN/6IG8/P4rczHAYn2QQ2iOioc=",
+    "hash": "sha256-yEqsdgTSlwppt6ILRZQ6Epyh5WVN6Il3xsBOa/NfIdo=",
     "homepage": "https://registry.terraform.io/providers/cloudfoundry-community/cloudfoundry",
     "owner": "cloudfoundry-community",
     "repo": "terraform-provider-cloudfoundry",
-    "rev": "v0.51.2",
+    "rev": "v0.51.3",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-FR0HnLLVv8H5jC3gRv8jk2VLsavlHNQny+UqZ00InTY="
+    "vendorHash": "sha256-0hq4dR1KqnE2IXMwif2/NVKQKRO/QplW/A6sB4pJ+FM="
   },
   "cloudinit": {
     "hash": "sha256-fdtUKD8XC1Y72IzrsCfTZYVYZwLqY3gV2sajiw4Krzw=",
@@ -501,13 +501,13 @@
     "vendorHash": null
   },
   "hcloud": {
-    "hash": "sha256-TbEbqTgzp7pUXrhjxvs5hrFI5u//xIIniOvusZsseiE=",
+    "hash": "sha256-kuC4tm8ob9bg7iLcUaGEHMYh6XaZp4rQiVlnbo1Xzek=",
     "homepage": "https://registry.terraform.io/providers/hetznercloud/hcloud",
     "owner": "hetznercloud",
     "repo": "terraform-provider-hcloud",
-    "rev": "v1.42.0",
+    "rev": "v1.42.1",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-wrgGxCNa5xLdBEy6RNNCz8ZVracyVsHzHtaQse6Ph+E="
+    "vendorHash": "sha256-r8njRjQGYESeHuD8pF6rRUe1j2VVMwoDITFi2StC5bk="
   },
   "helm": {
     "hash": "sha256-mGrQ5YKNsv1+Vkan5ohMXnTYofhCQPuTFjemXF/g+tA=",
@@ -519,11 +519,11 @@
     "vendorHash": "sha256-a80+gjjoFOKI96pUMvTMyM90F5oCb1Ime8hPQcFedFE="
   },
   "heroku": {
-    "hash": "sha256-tdaj6ZbVCvQTYblgpRC5GFoW8fbzTSHf0j6BM1tOlik=",
+    "hash": "sha256-PexzolGXe0dy+6vGXVDTqtHGjF66DTtt4/GUyx78RMQ=",
     "homepage": "https://registry.terraform.io/providers/heroku/heroku",
     "owner": "heroku",
     "repo": "terraform-provider-heroku",
-    "rev": "v5.2.5",
+    "rev": "v5.2.6",
     "spdx": null,
     "vendorHash": null
   },
@@ -781,11 +781,11 @@
     "vendorHash": null
   },
   "newrelic": {
-    "hash": "sha256-6dQ0oJeYBmMhpldt8SyPL0VY4IM4n3Dpg62SYvCjigI=",
+    "hash": "sha256-tbXRo7VNwjidyg/KcnwqmrxbnplMsUkCQAAsQb0WxSE=",
     "homepage": "https://registry.terraform.io/providers/newrelic/newrelic",
     "owner": "newrelic",
     "repo": "terraform-provider-newrelic",
-    "rev": "v3.26.0",
+    "rev": "v3.26.1",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-BWCL84bDsfrcM9Bkc3G6r0RQ1YnonH1D9bDSywTcigw="
   },
@@ -836,13 +836,13 @@
     "vendorHash": null
   },
   "okta": {
-    "hash": "sha256-cNVHEZPUkpruM7EDrriKeefzsHhwC+vyadTztRyGCFA=",
+    "hash": "sha256-yoO8LDSB80GfEjPR3sf8JcciX+3gM1qtFBv/rFAzb6g=",
     "homepage": "https://registry.terraform.io/providers/okta/okta",
     "owner": "okta",
     "repo": "terraform-provider-okta",
-    "rev": "v4.1.0",
+    "rev": "v4.2.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-0KB2L7L6EWN2VMsTKXtWElzBRfmny+JjarhhzZtWxtA="
+    "vendorHash": "sha256-tXVV8lcB8A66WtsWb2wDcJEERjzbHm/eqHyzIOrVk7E="
   },
   "oktaasa": {
     "hash": "sha256-2LhxgowqKvDDDOwdznusL52p2DKP+UiXALHcs9ZQd0U=",
@@ -899,11 +899,11 @@
     "vendorHash": null
   },
   "pagerduty": {
-    "hash": "sha256-vMMxSmfNz9FZtFyOMo6e5OHX6GWNVAP/X/ewJ0sUHb0=",
+    "hash": "sha256-pMim8Bjjtuysdd4LgsV4+JPjEMw+3bF8vOKIBJVSScY=",
     "homepage": "https://registry.terraform.io/providers/PagerDuty/pagerduty",
     "owner": "PagerDuty",
     "repo": "terraform-provider-pagerduty",
-    "rev": "v2.15.2",
+    "rev": "v2.15.3",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
diff --git a/pkgs/applications/networking/cluster/tf-summarize/default.nix b/pkgs/applications/networking/cluster/tf-summarize/default.nix
index 8cc48d7a2e8f0..d4958d762b4f4 100644
--- a/pkgs/applications/networking/cluster/tf-summarize/default.nix
+++ b/pkgs/applications/networking/cluster/tf-summarize/default.nix
@@ -13,10 +13,11 @@ buildGoModule rec {
     owner = "dineshba";
     repo = "tf-summarize";
     rev = "v${version}";
-    sha256 = "0c6fcz0n22mq8bqr82h9lfxx4n1bk9gjlc7d131lpf14yiacih3p";
+    hash = "sha256-d8DIVPQkuEvDCO0wKl+aK1jSu6MJCpTxQrgKYcFnzjA=";
   };
 
-  vendorSha256 = "cnybdZth7qlP2BHK8uvLCoqJtggMIkvaL2+YugiUZRE=";
+  vendorHash = "sha256-cnybdZth7qlP2BHK8uvLCoqJtggMIkvaL2+YugiUZRE=";
+
   ldflags = [
     "-s"
     "-w"
diff --git a/pkgs/applications/networking/instant-messengers/deltachat-desktop/default.nix b/pkgs/applications/networking/instant-messengers/deltachat-desktop/default.nix
index 3dd30751cd0dd..6ad5b5ddc1539 100644
--- a/pkgs/applications/networking/instant-messengers/deltachat-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/deltachat-desktop/default.nix
@@ -33,16 +33,16 @@ let
 in
 buildNpmPackage rec {
   pname = "deltachat-desktop";
-  version = "1.38.1";
+  version = "1.40.0";
 
   src = fetchFromGitHub {
     owner = "deltachat";
     repo = "deltachat-desktop";
     rev = "v${version}";
-    hash = "sha256-nXYXjq6bLGvH4m8ECwxfkcUjOsUUj07bt3NFb3oD0Gw=";
+    hash = "sha256-QvSBM2zR/LcQ2wtkh6mtlU8iqYmZfv6U5bRyMYjLZhE=";
   };
 
-  npmDepsHash = "sha256-fQKFSWljHHPp1A8lcxVxrMVESuTiB3GkSWDb98yCZz4=";
+  npmDepsHash = "sha256-lxyXfPNu5U+0cge+cwcXHIJv+gVXCSzc5t/2c4IQxNM=";
 
   nativeBuildInputs = [
     makeWrapper
diff --git a/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix b/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix
index 792572e5c1c01..ec318aa3e18e4 100644
--- a/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix
+++ b/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix
@@ -17,25 +17,20 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "teams-for-linux";
-  version = "1.2.8";
+  version = "1.3.2";
 
   src = fetchFromGitHub {
     owner = "IsmaelMartinez";
     repo = "teams-for-linux";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-5OocTsQjmNZCnzAY1RfrxD6Ad/kZTIkFl/3OmeJl1oI=";
+    hash = "sha256-2WoTbkRGH9l6cQrveyxGvO/Dy+0NV4UTDaooYn8k06s=";
   };
 
   offlineCache = fetchYarnDeps {
     yarnLock = "${finalAttrs.src}/yarn.lock";
-    hash = "sha256-XUASMWrH8wWeYsr6gCdQGgV/7E6hLDWkJ0BXHZCepKQ=";
+    hash = "sha256-j5N6d270myUylDVDFQTScbsGp1wlpt5sISDJBRCV/GU=";
   };
 
-  patches = [
-    # Can be removed once Electron upstream resolves https://github.com/electron/electron/issues/36660
-    ./screensharing-wayland-hack-fix.patch
-  ];
-
   nativeBuildInputs = [ yarn fixup_yarn_lock nodejs copyDesktopItems makeWrapper ];
 
   configurePhase = ''
diff --git a/pkgs/applications/networking/instant-messengers/teams-for-linux/screensharing-wayland-hack-fix.patch b/pkgs/applications/networking/instant-messengers/teams-for-linux/screensharing-wayland-hack-fix.patch
deleted file mode 100644
index 1ae26c06f0975..0000000000000
--- a/pkgs/applications/networking/instant-messengers/teams-for-linux/screensharing-wayland-hack-fix.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-diff --git a/app/index.js b/app/index.js
-index ea89608..98f4a90 100644
---- a/app/index.js
-+++ b/app/index.js
-@@ -1,4 +1,4 @@
--const { app, ipcMain, desktopCapturer, systemPreferences, powerMonitor } = require('electron');
-+const { app, ipcMain, desktopCapturer, nativeImage, systemPreferences, powerMonitor } = require('electron');
- const path = require('path');
- const fs = require('fs');
- const { LucidLog } = require('lucid-log');
-@@ -97,7 +97,16 @@ if (!gotTheLock) {
- 	ipcMain.handle('getSystemIdleState', handleGetSystemIdleState);
- 	ipcMain.handle('getZoomLevel', handleGetZoomLevel);
- 	ipcMain.handle('saveZoomLevel', handleSaveZoomLevel);
--	ipcMain.handle('desktopCapturerGetSources', (event, opts) => desktopCapturer.getSources(opts));
-+	ipcMain.handle('desktopCapturerGetSources', (event, opts) => process.env.XDG_SESSION_TYPE == 'wayland' ?
-+		// Port wayland electron 22+ screenshare "fix" from webcord
-+		Promise.resolve([{
-+			id: "screen:1:0",
-+			appIcon: nativeImage.createEmpty(),
-+			display_id: "",
-+			name: "Entire Screen",
-+			thumbnail: nativeImage.createEmpty()
-+		}])
-+		: desktopCapturer.getSources(opts));
- 	ipcMain.handle('getCustomBGList', handleGetCustomBGList);
- 	ipcMain.on('play-notification-sound', playNotificationSound);
- 	ipcMain.on('user-status-changed', userStatusChangedHandler);
diff --git a/pkgs/applications/system/monitor/default.nix b/pkgs/applications/system/monitor/default.nix
index e3917ce0e0144..ca3c5e0faef70 100644
--- a/pkgs/applications/system/monitor/default.nix
+++ b/pkgs/applications/system/monitor/default.nix
@@ -9,6 +9,7 @@
 , pantheon
 , python3
 , curl
+, flatpak
 , gettext
 , glib
 , gtk3
@@ -27,13 +28,13 @@
 
 stdenv.mkDerivation rec {
   pname = "monitor";
-  version = "0.16.1";
+  version = "0.17.0";
 
   src = fetchFromGitHub {
     owner = "stsdc";
     repo = "monitor";
     rev = version;
-    sha256 = "sha256-ZTsb1xcJ7eeCEPebZW0anmG1SUPAzZakw4WzJql9VTQ=";
+    sha256 = "sha256-GUNMA4CRO4cKBjNr7i8yRflstbT8g2ciDHppjUUbAOc=";
     fetchSubmodules = true;
   };
 
@@ -49,6 +50,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     curl
+    flatpak
     glib
     gtk3
     json-glib
@@ -85,7 +87,8 @@ stdenv.mkDerivation rec {
 
   passthru = {
     updateScript = gitUpdater {
-      ignoredVersions = "ci.*";
+      # Upstream frequently tags these to fix CI, which are mostly irrelevant to us.
+      ignoredVersions = "-";
     };
   };
 
diff --git a/pkgs/applications/version-management/gitea/default.nix b/pkgs/applications/version-management/gitea/default.nix
index 89cae801ec29c..c017b360c36e4 100644
--- a/pkgs/applications/version-management/gitea/default.nix
+++ b/pkgs/applications/version-management/gitea/default.nix
@@ -20,12 +20,12 @@
 
 buildGoModule rec {
   pname = "gitea";
-  version = "1.20.1";
+  version = "1.20.2";
 
   # not fetching directly from the git repo, because that lacks several vendor files for the web UI
   src = fetchurl {
     url = "https://dl.gitea.com/gitea/${version}/gitea-src-${version}.tar.gz";
-    hash = "sha256-LYOCNZJiGuMM1ly1Sp+0F8Us8LtAXzH5NzJf2CLcHck=";
+    hash = "sha256-a88ltflOcZQVWcEjC3r6rbPSk6LRtATcEQecYt/wg04=";
   };
 
   vendorHash = null;
diff --git a/pkgs/applications/video/mkvtoolnix/default.nix b/pkgs/applications/video/mkvtoolnix/default.nix
index 58cab86e6b1df..0f5b7ca7a0706 100644
--- a/pkgs/applications/video/mkvtoolnix/default.nix
+++ b/pkgs/applications/video/mkvtoolnix/default.nix
@@ -46,13 +46,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "mkvtoolnix";
-  version = "77.0";
+  version = "78.0";
 
   src = fetchFromGitLab {
     owner = "mbunkus";
     repo = "mkvtoolnix";
     rev = "release-${version}";
-    sha256 = "t+kfFS5c8w+c9wxNh59nceFesfdMy8qvHlUqDbZAxkk=";
+    sha256 = "sha256-iImcpuGZsRlwBTPyPUsfHAOkOIhc8eYs6rinl8O78oU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/geos/default.nix b/pkgs/development/libraries/geos/default.nix
index c3c5b17372e0c..49dc54c20fd5a 100644
--- a/pkgs/development/libraries/geos/default.nix
+++ b/pkgs/development/libraries/geos/default.nix
@@ -21,10 +21,11 @@ stdenv.mkDerivation (finalAttrs: {
   passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
 
   meta = with lib; {
-    description = "C++ port of the Java Topology Suite (JTS)";
-    homepage = "https://trac.osgeo.org/geos";
+    description = "C/C++ library for computational geometry with a focus on algorithms used in geographic information systems (GIS) software";
+    homepage = "https://libgeos.org";
     license = licenses.lgpl21Only;
     maintainers = teams.geospatial.members;
     pkgConfigModules = [ "geos" ];
+    mainProgram = "geosop";
   };
 })
diff --git a/pkgs/development/libraries/level-zero/default.nix b/pkgs/development/libraries/level-zero/default.nix
index a117863aa337b..c213e75d5f2d3 100644
--- a/pkgs/development/libraries/level-zero/default.nix
+++ b/pkgs/development/libraries/level-zero/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "level-zero";
-  version = "1.13.1";
+  version = "1.13.5";
 
   src = fetchFromGitHub {
     owner = "oneapi-src";
     repo = "level-zero";
     rev = "refs/tags/v${version}";
-    hash = "sha256-qV2OM41+DkuT3lDCTHOyNkHixD/HITfCiItBQX6Ewio=";
+    hash = "sha256-XpLbbcB8M63q+0Vj7NrERSXVIjy5KQrVZMvYijUbJhw=";
   };
 
   nativeBuildInputs = [ cmake addOpenGLRunpath ];
diff --git a/pkgs/development/libraries/libdeltachat/Cargo.lock b/pkgs/development/libraries/libdeltachat/Cargo.lock
index 735db14604c52..f2528c30384e9 100644
--- a/pkgs/development/libraries/libdeltachat/Cargo.lock
+++ b/pkgs/development/libraries/libdeltachat/Cargo.lock
@@ -1123,7 +1123,7 @@ dependencies = [
 
 [[package]]
 name = "deltachat"
-version = "1.118.0"
+version = "1.119.1"
 dependencies = [
  "ansi_term",
  "anyhow",
@@ -1199,7 +1199,7 @@ dependencies = [
 
 [[package]]
 name = "deltachat-jsonrpc"
-version = "1.118.0"
+version = "1.119.1"
 dependencies = [
  "anyhow",
  "async-channel",
@@ -1223,7 +1223,7 @@ dependencies = [
 
 [[package]]
 name = "deltachat-repl"
-version = "1.118.0"
+version = "1.119.1"
 dependencies = [
  "ansi_term",
  "anyhow",
@@ -1238,7 +1238,7 @@ dependencies = [
 
 [[package]]
 name = "deltachat-rpc-server"
-version = "1.118.0"
+version = "1.119.1"
 dependencies = [
  "anyhow",
  "deltachat",
@@ -1263,7 +1263,7 @@ dependencies = [
 
 [[package]]
 name = "deltachat_ffi"
-version = "1.118.0"
+version = "1.119.1"
 dependencies = [
  "anyhow",
  "deltachat",
@@ -4958,14 +4958,14 @@ dependencies = [
 
 [[package]]
 name = "tokio-tar"
-version = "0.3.0"
+version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a50188549787c32c1c3d9c8c71ad7e003ccf2f102489c5a96e385c84760477f4"
+checksum = "9d5714c010ca3e5c27114c1cdeb9d14641ace49874aa5626d7149e47aedace75"
 dependencies = [
  "filetime",
  "futures-core",
  "libc",
- "redox_syscall 0.2.16",
+ "redox_syscall 0.3.5",
  "tokio",
  "tokio-stream",
  "xattr",
@@ -5778,9 +5778,9 @@ dependencies = [
 
 [[package]]
 name = "xattr"
-version = "0.2.3"
+version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6d1526bbe5aaeb5eb06885f4d987bcdfa5e23187055de9b83fe00156a821fabc"
+checksum = "f4686009f71ff3e5c4dbcf1a282d0a44db3f021ba69350cd42086b3e5f1c6985"
 dependencies = [
  "libc",
 ]
diff --git a/pkgs/development/libraries/libdeltachat/default.nix b/pkgs/development/libraries/libdeltachat/default.nix
index 562f45048aab8..96ef2f6cd4274 100644
--- a/pkgs/development/libraries/libdeltachat/default.nix
+++ b/pkgs/development/libraries/libdeltachat/default.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libdeltachat";
-  version = "1.118.0";
+  version = "1.119.1";
 
   src = fetchFromGitHub {
     owner = "deltachat";
     repo = "deltachat-core-rust";
     rev = "v${version}";
-    hash = "sha256-1vkmz7LFG420zYETYIf3ayOQEPp+hz7Dr7gULz1nJOs=";
+    hash = "sha256-LP5h99qldf9QoRDmo581H+sUx1QsD6nOGt1ES3Fr/6E=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/poppler/default.nix b/pkgs/development/libraries/poppler/default.nix
index bc1478a909256..3774a3e05dcfa 100644
--- a/pkgs/development/libraries/poppler/default.nix
+++ b/pkgs/development/libraries/poppler/default.nix
@@ -47,13 +47,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: rec {
   pname = "poppler-${suffix}";
-  version = "23.07.0"; # beware: updates often break cups-filters build, check texlive and scribus too!
+  version = "23.08.0"; # beware: updates often break cups-filters build, check texlive and scribus too!
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "https://poppler.freedesktop.org/poppler-${version}.tar.xz";
-    hash = "sha256-8ptLS/R1cmERdkVMjyFQbXHSfspQEaOapEA4swuVfbA=";
+    hash = "sha256-Skv3/JA7nxoqt9BLfF2CINubxiYcxz/bmoJtwnL0mqg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/qt-6/default.nix b/pkgs/development/libraries/qt-6/default.nix
index d9bc6ae15e1f8..74ac03bbeb6da 100644
--- a/pkgs/development/libraries/qt-6/default.nix
+++ b/pkgs/development/libraries/qt-6/default.nix
@@ -48,6 +48,9 @@ let
           ./patches/0005-qtbase-deal-with-a-font-face-at-index-0-as-Regular-f.patch
           ./patches/0006-qtbase-qt-cmake-always-use-cmake-from-path.patch
           ./patches/0007-qtbase-find-qt-tools-in-QTTOOLSPATH.patch
+          ./patches/0008-qtbase-find-qmlimportscanner-in-macdeployqt-via-environment.patch
+          ./patches/0009-qtbase-check-in-the-QML-folder-of-this-library-does-actuall.patch
+          ./patches/0010-qtbase-pass-to-qmlimportscanner-the-QML2_IMPORT_PATH.patch
         ];
       };
       env = callPackage ./qt-env.nix { };
diff --git a/pkgs/development/libraries/qt-6/patches/0008-qtbase-find-qmlimportscanner-in-macdeployqt-via-environment.patch b/pkgs/development/libraries/qt-6/patches/0008-qtbase-find-qmlimportscanner-in-macdeployqt-via-environment.patch
new file mode 100644
index 0000000000000..32e30679ec595
--- /dev/null
+++ b/pkgs/development/libraries/qt-6/patches/0008-qtbase-find-qmlimportscanner-in-macdeployqt-via-environment.patch
@@ -0,0 +1,35 @@
+From 505391a31aa353b8f1cc5d3feb9861582554d9f1 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Juan=20Pedro=20Bol=C3=ADvar=20Puente?= <raskolnikov@gnu.org>
+Date: Wed, 9 Aug 2023 16:16:21 +0200
+Subject: [PATCH 1/3] Find qmlimportscanner in macdeployqt via environment
+
+The qmlimportscanner tool is provided by qtdeclarative. Because of the
+modularized installation in Nix, it can not be found via the usual
+mechanisms.  Also, hard-coding it like we do for Qt5 would also not
+work, as it would require making qtbase depend on qtdeclarative.
+
+Here we add an option to provide its location via the environment.
+While this means macdeployqt does not work out of the box, it provides
+a workaround for users.
+---
+ src/tools/macdeployqt/shared/shared.cpp | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/src/tools/macdeployqt/shared/shared.cpp b/src/tools/macdeployqt/shared/shared.cpp
+index 643fe5390a..b8fcc9c9bd 100644
+--- a/src/tools/macdeployqt/shared/shared.cpp
++++ b/src/tools/macdeployqt/shared/shared.cpp
+@@ -1270,6 +1270,10 @@ bool deployQmlImports(const QString &appBundlePath, DeploymentInfo deploymentInf
+     if (!QFile::exists(qmlImportScannerPath))
+         qmlImportScannerPath = QCoreApplication::applicationDirPath() + "/qmlimportscanner";
+ 
++    // Fallback: Pass qml import scanner via environment variable
++    if (!QFile::exists(qmlImportScannerPath))
++        qmlImportScannerPath = ::qgetenv("NIX_QMLIMPORTSCANNER");
++
+     // Verify that we found a qmlimportscanner binary
+     if (!QFile::exists(qmlImportScannerPath)) {
+         LogError() << "qmlimportscanner not found at" << qmlImportScannerPath;
+-- 
+2.26.2
+
diff --git a/pkgs/development/libraries/qt-6/patches/0009-qtbase-check-in-the-QML-folder-of-this-library-does-actuall.patch b/pkgs/development/libraries/qt-6/patches/0009-qtbase-check-in-the-QML-folder-of-this-library-does-actuall.patch
new file mode 100644
index 0000000000000..4436d512d9d8d
--- /dev/null
+++ b/pkgs/development/libraries/qt-6/patches/0009-qtbase-check-in-the-QML-folder-of-this-library-does-actuall.patch
@@ -0,0 +1,35 @@
+From 32df59bea18bebc18d6d308750e88be325522d2e Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Juan=20Pedro=20Bol=C3=ADvar=20Puente?= <raskolnikov@gnu.org>
+Date: Thu, 10 Aug 2023 14:15:34 +0200
+Subject: [PATCH 2/3] Check in the QML folder of this library does actually
+ exist
+
+In a modularized installation, this folder will be the location where
+`qtbase` itself is installed, but `qtbase` does not have any QML
+code, and `qmlimportscanner` will complain that it does not exist.
+---
+ src/tools/macdeployqt/shared/shared.cpp | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/src/tools/macdeployqt/shared/shared.cpp b/src/tools/macdeployqt/shared/shared.cpp
+index b8fcc9c9bd..676d34d545 100644
+--- a/src/tools/macdeployqt/shared/shared.cpp
++++ b/src/tools/macdeployqt/shared/shared.cpp
+@@ -1290,9 +1290,12 @@ bool deployQmlImports(const QString &appBundlePath, DeploymentInfo deploymentInf
+     }
+     for (const QString &importPath : qmlImportPaths)
+         argumentList << "-importPath" << importPath;
++
+     QString qmlImportsPath = QLibraryInfo::path(QLibraryInfo::QmlImportsPath);
+-    argumentList.append( "-importPath");
+-    argumentList.append(qmlImportsPath);
++    if (QFile::exists(qmlImportsPath)) {
++        argumentList.append( "-importPath");
++        argumentList.append(qmlImportsPath);
++    }
+ 
+     // run qmlimportscanner
+     QProcess qmlImportScanner;
+-- 
+2.26.2
+
diff --git a/pkgs/development/libraries/qt-6/patches/0010-qtbase-pass-to-qmlimportscanner-the-QML2_IMPORT_PATH.patch b/pkgs/development/libraries/qt-6/patches/0010-qtbase-pass-to-qmlimportscanner-the-QML2_IMPORT_PATH.patch
new file mode 100644
index 0000000000000..81f0f76636d9c
--- /dev/null
+++ b/pkgs/development/libraries/qt-6/patches/0010-qtbase-pass-to-qmlimportscanner-the-QML2_IMPORT_PATH.patch
@@ -0,0 +1,30 @@
+From 39eb99dcd66f8ffb632fed6308a49896fe5ad2d3 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Juan=20Pedro=20Bol=C3=ADvar=20Puente?= <raskolnikov@gnu.org>
+Date: Thu, 10 Aug 2023 14:17:03 +0200
+Subject: [PATCH 3/3] Pass to qmlimportscanner the QML2_IMPORT_PATH
+
+---
+ src/tools/macdeployqt/shared/shared.cpp | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/src/tools/macdeployqt/shared/shared.cpp b/src/tools/macdeployqt/shared/shared.cpp
+index 676d34d545..7908b07b3c 100644
+--- a/src/tools/macdeployqt/shared/shared.cpp
++++ b/src/tools/macdeployqt/shared/shared.cpp
+@@ -1297,6 +1297,13 @@ bool deployQmlImports(const QString &appBundlePath, DeploymentInfo deploymentInf
+         argumentList.append(qmlImportsPath);
+     }
+ 
++    // In a modularized installation of qt as we have in Nix, instead, we will
++    // read the paths from the environment, as they are spread in multiple
++    // locations and normally set in the environment like this
++    auto envQmlImportPaths = ::qgetenv("QML2_IMPORT_PATH").split(':');
++    for (const QString &importPath : envQmlImportPaths)
++        argumentList << "-importPath" << importPath;
++
+     // run qmlimportscanner
+     QProcess qmlImportScanner;
+     qmlImportScanner.start(qmlImportScannerPath, argumentList);
+-- 
+2.26.2
+
diff --git a/pkgs/development/python-modules/awesomeversion/default.nix b/pkgs/development/python-modules/awesomeversion/default.nix
index d838a0f287501..159f06ddb393d 100644
--- a/pkgs/development/python-modules/awesomeversion/default.nix
+++ b/pkgs/development/python-modules/awesomeversion/default.nix
@@ -16,7 +16,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "ludeeus";
     repo = pname;
-    rev = version;
+    rev = "refs/tags/${version}";
     hash = "sha256-3bHE3U4MM/fQM9zBYfoLpAObay82vchjX9FpJukMGNg=";
   };
 
@@ -41,6 +41,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python module to deal with versions";
     homepage = "https://github.com/ludeeus/awesomeversion";
+    changelog = "https://github.com/ludeeus/awesomeversion/releases/tag/${version}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/ax/default.nix b/pkgs/development/python-modules/ax/default.nix
index be254b3db9cef..e9ca9dba6ca73 100644
--- a/pkgs/development/python-modules/ax/default.nix
+++ b/pkgs/development/python-modules/ax/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage rec {
   pname = "ax";
-  version = "0.3.2";
+  version = "0.3.4";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "facebook";
     repo = pname;
     rev = version;
-    hash = "sha256-1KLLjeUktXvIDOlTQzMmpbL/On8PTxZQ44Qi4BT3nPk=";
+    hash = "sha256-Yc6alEKXbtQ0hitIdPhkJWhZQg150b0NJJRLZ+f1hdY=";
   };
 
   nativeBuildInputs = [
@@ -66,6 +66,10 @@ buildPythonPackage rec {
     "--ignore=ax/service/tests/test_with_db_settings_base.py"
     "--ignore=ax/storage"
   ];
+  disabledTests = [
+    # exact comparison of floating points
+    "test_optimize_l0_homotopy"
+  ];
   pythonImportsCheck = [ "ax" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/backports-strenum/default.nix b/pkgs/development/python-modules/backports-strenum/default.nix
new file mode 100644
index 0000000000000..a23a79024a482
--- /dev/null
+++ b/pkgs/development/python-modules/backports-strenum/default.nix
@@ -0,0 +1,47 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pytestCheckHook
+, pythonOlder
+, setuptools
+, setuptools-scm
+, wheel
+}:
+
+buildPythonPackage rec {
+  pname = "backports-strenum";
+  version = "1.2.4";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.8";
+
+  src = fetchFromGitHub {
+    owner = "clbarnes";
+    repo = "backports.strenum";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-AhAMVawnBMJ45a3mpthUZvqTeqeCB1Uco4MSusLyA4E=";
+  };
+
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+    wheel
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "backports.strenum"
+  ];
+
+  meta = with lib; {
+    description = "Base class for creating enumerated constants that are also subclasses of str";
+    homepage = "https://github.com/clbarnes/backports.strenum";
+    license = with licenses; [ psfl ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/boschshcpy/default.nix b/pkgs/development/python-modules/boschshcpy/default.nix
index 0c76607137cdd..8d0f0b21590ef 100644
--- a/pkgs/development/python-modules/boschshcpy/default.nix
+++ b/pkgs/development/python-modules/boschshcpy/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "boschshcpy";
-  version = "0.2.57";
+  version = "0.2.60";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "tschamm";
     repo = pname;
     rev = version;
-    hash = "sha256-/TD5zvvtOkoVG+EJzNNSMbOKXm78Di9tDrBIxpN4wbg=";
+    hash = "sha256-RCHOkTBnJcqGc3Y0cQhkgkizuqNl98MU8lxpVoHVLcc=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/botorch/default.nix b/pkgs/development/python-modules/botorch/default.nix
index a27523d2fe952..5729a7a40a411 100644
--- a/pkgs/development/python-modules/botorch/default.nix
+++ b/pkgs/development/python-modules/botorch/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "botorch";
-  version = "0.8.5";
+  version = "0.9.2";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "pytorch";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-VcNHgfk8OfLJseQxHksycWuCPCudCtOdcRV0XnxHSfU=";
+    hash = "sha256-8obS+qMQwepKUxPkMbufR/SaacYekl6FA6t6XW6llA4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/caldav/default.nix b/pkgs/development/python-modules/caldav/default.nix
index c53eb0e20bcec..15daa3b0697c5 100644
--- a/pkgs/development/python-modules/caldav/default.nix
+++ b/pkgs/development/python-modules/caldav/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "caldav";
-  version = "1.2.1";
+  version = "1.3.6";
 
   format = "setuptools";
   disabled = pythonOlder "3.7";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "python-caldav";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-nA7if28M4rDZwlF+ga/1FqD838zeu0OblrPUer3w3qM=";
+    hash = "sha256-N3pY3UYxOZgZbXqqsvASej12dOtdpyEHOL10btOKm/w=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/casbin/default.nix b/pkgs/development/python-modules/casbin/default.nix
index bee1e89512c69..ce337cb8de3c4 100644
--- a/pkgs/development/python-modules/casbin/default.nix
+++ b/pkgs/development/python-modules/casbin/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "casbin";
-  version = "1.23.0";
+  version = "1.23.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = "pycasbin";
     rev = "refs/tags/v${version}";
-    hash = "sha256-CPbWPDimbarmltwren63hRj/B7LF9+5osiQAZ6sWsks=";
+    hash = "sha256-jL02G4Z2Lhy/02Lb7aSUDEKg2h34UXJbwMFaDSPgc+U=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/cfgv/default.nix b/pkgs/development/python-modules/cfgv/default.nix
index c7b074089a687..0975d649a1672 100644
--- a/pkgs/development/python-modules/cfgv/default.nix
+++ b/pkgs/development/python-modules/cfgv/default.nix
@@ -1,23 +1,36 @@
-{ lib, buildPythonPackage, fetchPypi, isPy27, six }:
+{ lib
+, buildPythonPackage
+, pythonOlder
+, fetchFromGitHub
+, pytestCheckHook
+}:
 
 buildPythonPackage rec {
   pname = "cfgv";
-  version = "3.3.1";
-  disabled = isPy27;
+  version = "3.4.0";
+  format = "setuptools";
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "f5a830efb9ce7a445376bb66ec94c638a9787422f96264c98edc6bdeed8ab736";
+  disabled = pythonOlder "3.8";
+
+  src = fetchFromGitHub {
+    owner = "asottile";
+    repo = "cfgv";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-P02j53dltwdrlUBG89AI+P2GkXYKTVrQNF15rZt58jw=";
   };
 
-  propagatedBuildInputs = [ six ];
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
 
-  # Tests not included in PyPI tarball
-  doCheck = false;
+  pythonImportsCheck = [
+    "cfgv"
+  ];
 
   meta = with lib; {
     description = "Validate configuration and produce human readable error messages";
     homepage = "https://github.com/asottile/cfgv";
     license = licenses.mit;
+    maintainers = with lib.maintainers; [ nickcao ];
   };
 }
diff --git a/pkgs/development/python-modules/deid/default.nix b/pkgs/development/python-modules/deid/default.nix
index 6c51463138816..6927d656a9f20 100644
--- a/pkgs/development/python-modules/deid/default.nix
+++ b/pkgs/development/python-modules/deid/default.nix
@@ -36,7 +36,7 @@ let
 in
 buildPythonPackage rec {
   pname = "deid";
-  version = "0.3.21";
+  version = "0.3.22";
 
   format = "pyproject";
   disabled = pythonOlder "3.7";
@@ -46,8 +46,8 @@ buildPythonPackage rec {
     owner = "pydicom";
     repo = pname;
     # the github repo does not contain Pypi version tags:
-    rev = "38717b8cbfd69566ba489dd0c9858bb93101e26d";
-    hash = "sha256-QqofxNjshbNfu8vZ37rB6pxj5R8q0wlUhJRhrpkKySk=";
+    rev = "40dc96125daeb65856d643e12c3d6dfec756be0d";
+    hash = "sha256-OtxQPF29eqt8I1Q12ga8a1IjBVO+VBk6y0DQmRtCNoU=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/detectron2/default.nix b/pkgs/development/python-modules/detectron2/default.nix
index cc750427dacbd..e7870fbe47593 100644
--- a/pkgs/development/python-modules/detectron2/default.nix
+++ b/pkgs/development/python-modules/detectron2/default.nix
@@ -59,10 +59,16 @@ buildPythonPackage {
   src = fetchFromGitHub {
     owner = "facebookresearch";
     repo = "detectron2";
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
     sha256 = "1w6cgvc8r2lwr72yxicls650jr46nriv1csivp2va9k1km8jx2sf";
   };
 
+  postPatch = ''
+    # https://github.com/facebookresearch/detectron2/issues/5010
+    substituteInPlace detectron2/data/transforms/transform.py \
+      --replace "interp=Image.LINEAR" "interp=Image.BILINEAR"
+  '';
+
   nativeBuildInputs = [
     pythonRelaxDepsHook
     ninja
@@ -123,6 +129,8 @@ buildPythonPackage {
     "tests/structures/test_instances.py"
     # hangs for some reason
     "tests/modeling/test_model_e2e.py"
+    # KeyError: 'precision'
+    "tests/data/test_coco_evaluation.py"
   ];
 
   disabledTests = [
diff --git a/pkgs/development/python-modules/fakeredis/default.nix b/pkgs/development/python-modules/fakeredis/default.nix
index af8bc72fa51e6..0ffe4d40195b8 100644
--- a/pkgs/development/python-modules/fakeredis/default.nix
+++ b/pkgs/development/python-modules/fakeredis/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "fakeredis";
-  version = "2.17.0";
+  version = "2.18.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "dsoftwareinc";
     repo = "fakeredis-py";
     rev = "refs/tags/v${version}";
-    hash = "sha256-nDxuXDWnTt/ljd/M4pElo4U8jn91l+J9fPAfYpS0mOc=";
+    hash = "sha256-+bJbtqBUgix4oIq49hQEk3/cNXfvXFXE/m/qR1zy8jo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/gpytorch/default.nix b/pkgs/development/python-modules/gpytorch/default.nix
index f914bc326ba9b..74d85d801f699 100644
--- a/pkgs/development/python-modules/gpytorch/default.nix
+++ b/pkgs/development/python-modules/gpytorch/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "gpytorch";
-  version = "1.10";
+  version = "1.11";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "cornellius-gp";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-KY3ItkVjBfIYMkZAmD56EBGR9YN/MRN7b2K3zrK6Qmk=";
+    hash = "sha256-cpkfjx5G/4duL1Rr4nkHTHi03TDcYbcx3bKP2Ny7Ijo=";
   };
 
   postPatch = ''
@@ -40,6 +40,8 @@ buildPythonPackage rec {
     # flaky numerical tests
     "test_classification_error"
     "test_matmul_matrix_broadcast"
+    # https://github.com/cornellius-gp/gpytorch/issues/2396
+    "test_t_matmul_matrix"
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/linear_operator/default.nix b/pkgs/development/python-modules/linear_operator/default.nix
index 48fb004c14c4b..baecb5a732f6f 100644
--- a/pkgs/development/python-modules/linear_operator/default.nix
+++ b/pkgs/development/python-modules/linear_operator/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, jaxtyping
 , scipy
 , torch
 , pytestCheckHook
@@ -8,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "linear_operator";
-  version = "0.4.0";
+  version = "0.5.1";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "cornellius-gp";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-0f3F3k3xJACbx42jtwsAmjZwPAOfLywZs8VOrwWicc4=";
+    hash = "sha256-7NkcvVDwFaLHBZZhq7aKY3cWxe90qeKmodP6cVsdrPM=";
   };
 
   postPatch = ''
@@ -24,6 +25,7 @@ buildPythonPackage rec {
   '';
 
   propagatedBuildInputs = [
+    jaxtyping
     scipy
     torch
   ];
diff --git a/pkgs/development/python-modules/lxmf/default.nix b/pkgs/development/python-modules/lxmf/default.nix
index f28b261f50993..af7ae5d6e87ae 100644
--- a/pkgs/development/python-modules/lxmf/default.nix
+++ b/pkgs/development/python-modules/lxmf/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "lxmf";
-  version = "0.3.1";
+  version = "0.3.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     owner = "markqvist";
     repo = "lxmf";
     rev = "refs/tags/${version}";
-    hash = "sha256-uz3IUUL5rdYwUsBNdHB+K/ZaCCnUE5EThFConVl8YgM=";
+    hash = "sha256-6ZnYI6GlFkMjBLsZhhFg8G9j3I/DfjLAnKsRFEua7uU=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/nomadnet/default.nix b/pkgs/development/python-modules/nomadnet/default.nix
index 28410b313298d..71070e2decd53 100644
--- a/pkgs/development/python-modules/nomadnet/default.nix
+++ b/pkgs/development/python-modules/nomadnet/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "nomadnet";
-  version = "0.3.5";
+  version = "0.3.6";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "markqvist";
     repo = "NomadNet";
     rev = "refs/tags/${version}";
-    hash = "sha256-SPQ/3ntdD+EBW2YZJKfg2lornlg1ktnvTd1PNAqNSIg=";
+    hash = "sha256-3b6uwojekWthH5AsAVfS/ue+yAoIMac1LQff1mrM9PM=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/nsz/default.nix b/pkgs/development/python-modules/nsz/default.nix
index 88402b340a123..e9d6edbfa80a4 100644
--- a/pkgs/development/python-modules/nsz/default.nix
+++ b/pkgs/development/python-modules/nsz/default.nix
@@ -1,21 +1,33 @@
-{ lib, buildPythonPackage, fetchFromGitHub, pycryptodome, enlighten, zstandard
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pycryptodome
+, pythonOlder
+, enlighten
+, zstandard
 , withGUI ? true
 , kivy
 }:
 
 buildPythonPackage rec {
   pname = "nsz";
-  version = "4.3.0";
+  version = "4.4.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "nicoboss";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-azmUJ3ofLdNwNeIQL/TuPYE98FZ8yXwbJx3wHCo8lw4=";
+    hash = "sha256-glK4CK7D33FfLqHLxVr4kkb887/A9tqxPwWpcXYZu/0=";
   };
 
-  propagatedBuildInputs = [pycryptodome enlighten zstandard ]
-    ++ lib.optional withGUI kivy;
+  propagatedBuildInputs = [
+    pycryptodome
+    enlighten
+    zstandard
+  ] ++ lib.optional withGUI kivy;
 
   # do not check, as nsz requires producation keys
   # dumped from a Nintendo Switch.
@@ -23,7 +35,8 @@ buildPythonPackage rec {
 
   meta = with lib; {
     homepage = "https://github.com/nicoboss/nsz";
-    description = "NSZ - Homebrew compatible NSP/XCI compressor/decompressor";
+    description = "Homebrew compatible NSP/XCI compressor/decompressor";
+    changelog = "https://github.com/nicoboss/nsz/releases/tag/${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ eyjhb ];
   };
diff --git a/pkgs/development/python-modules/ocrmypdf/default.nix b/pkgs/development/python-modules/ocrmypdf/default.nix
index a9eeef0c55de2..58d77f7712d03 100644
--- a/pkgs/development/python-modules/ocrmypdf/default.nix
+++ b/pkgs/development/python-modules/ocrmypdf/default.nix
@@ -1,6 +1,5 @@
 { lib
 , buildPythonPackage
-, coloredlogs
 , deprecation
 , fetchFromGitHub
 , ghostscript
@@ -17,6 +16,7 @@
 , pytest-xdist
 , pytestCheckHook
 , pythonOlder
+, rich
 , reportlab
 , setuptools
 , setuptools-scm
@@ -30,7 +30,7 @@
 
 buildPythonPackage rec {
   pname = "ocrmypdf";
-  version = "14.3.0";
+  version = "14.4.0";
 
   disabled = pythonOlder "3.8";
 
@@ -46,7 +46,7 @@ buildPythonPackage rec {
     postFetch = ''
       rm "$out/.git_archival.txt"
     '';
-    hash = "sha256-OUz19N2YIl7iwayjulx0v1K00jB5SdWo8m5XiJ9BDSs=";
+    hash = "sha256-i1ZUBKR8dJXZkALUFwkzYcjtZ5Li66DfD2fupCGRQC4=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
@@ -69,7 +69,6 @@ buildPythonPackage rec {
   ];
 
   propagatedBuildInputs = [
-    coloredlogs
     deprecation
     img2pdf
     packaging
@@ -78,6 +77,7 @@ buildPythonPackage rec {
     pillow
     pluggy
     reportlab
+    rich
     tqdm
   ] ++ lib.optionals (pythonOlder "3.9") [
     importlib-resources
diff --git a/pkgs/development/python-modules/okta/default.nix b/pkgs/development/python-modules/okta/default.nix
index 42b4738fe6fa0..f2e19e4a63403 100644
--- a/pkgs/development/python-modules/okta/default.nix
+++ b/pkgs/development/python-modules/okta/default.nix
@@ -1,58 +1,69 @@
 { lib
 , stdenv
+, aenum
+, aiohttp
 , buildPythonPackage
 , fetchPypi
-# install requirements
-, pycryptodome
-, yarl
 , flatdict
-, python-jose
-, aenum
-, aiohttp
+, pycryptodome
+, pycryptodomex
 , pydash
-, xmltodict
-, pyyaml
-# test requirements
-, pytestCheckHook
-, pytest-recording
+, pyfakefs
 , pytest-asyncio
 , pytest-mock
-, pyfakefs
+, pytest-recording
+, pytestCheckHook
+, python-jose
+, pythonOlder
+, pyyaml
+, xmltodict
+, yarl
 }:
 
 buildPythonPackage rec {
   pname = "okta";
-  version = "2.8.0";
+  version = "2.9.2";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-yIVJoKX9b9Y7Ydl28twHxgPbUa58LJ12Oz3tvpU7CAc=";
+    hash = "sha256-kbzqriybzN/86vov3Q+kH2lj9plK1GzWPlc/Nc/nWF0=";
   };
 
   propagatedBuildInputs = [
-    pycryptodome
-    yarl
-    flatdict
-    python-jose
     aenum
     aiohttp
+    flatdict
+    pycryptodome
+    pycryptodomex
     pydash
-    xmltodict
+    python-jose
     pyyaml
+    xmltodict
+    yarl
   ];
 
   checkInputs = [
-    pytestCheckHook
+    pyfakefs
     pytest-asyncio
     pytest-mock
     pytest-recording
-    pyfakefs
+    pytestCheckHook
   ];
 
-  pytestFlagsArray = [ "tests/" ];
+  pytestFlagsArray = [
+    "tests/"
+  ];
 
   disabledTests = [
     "test_client_raise_exception"
+    # vcr.errors.CannotOverwriteExistingCassetteException: Can't overwrite existing cassette
+    "test_get_org_contact_user"
+    "test_update_org_contact_user"
+    "test_get_role_subscription"
+    "test_subscribe_unsubscribe"
   ];
 
   pythonImportsCheck = [
@@ -68,6 +79,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python SDK for the Okta Management API";
     homepage = "https://github.com/okta/okta-sdk-python";
+    changelog = "https://github.com/okta/okta-sdk-python/blob/v${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ jbgosselin ];
   };
diff --git a/pkgs/development/python-modules/pandas-stubs/default.nix b/pkgs/development/python-modules/pandas-stubs/default.nix
index 0325217946e8a..ef387df4f4c68 100644
--- a/pkgs/development/python-modules/pandas-stubs/default.nix
+++ b/pkgs/development/python-modules/pandas-stubs/default.nix
@@ -24,7 +24,7 @@
 
 buildPythonPackage rec {
   pname = "pandas-stubs";
-  version = "1.5.3.230321";
+  version = "2.0.3.230814";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -33,7 +33,7 @@ buildPythonPackage rec {
     owner = "pandas-dev";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-RjU762VyDPy86Cvmr8hfPkqLtmntB3F6tf2OAgqmnK4=";
+    hash = "sha256-V/igL+vPJADOL7LwBJljqs2a1BB3vDVYTWXIkK/ImYY=";
   };
 
   nativeBuildInputs = [
@@ -66,6 +66,7 @@ buildPythonPackage rec {
     # AttributeErrors, missing dependencies, error and warning checks
     "test_aggregate_frame_combinations"
     "test_aggregate_series_combinations"
+    "test_all_read_without_lxml_dtype_backend"
     "test_arrow_dtype"
     "test_attribute_conflict_warning"
     "test_categorical_conversion_warning"
@@ -79,6 +80,8 @@ buildPythonPackage rec {
     "test_database_error"
     "test_dummies"
     "test_from_dummies_args"
+    "test_hdf_context_manager"
+    "test_hdfstore"
     "test_incompatibility_warning"
     "test_index_astype"
     "test_indexing_error"
@@ -95,6 +98,9 @@ buildPythonPackage rec {
     "test_possible_precision_loss"
     "test_pyperclip_exception"
     "test_quantile_150_changes"
+    "test_read_hdf_iterator"
+    "test_read_sql_via_sqlalchemy_connection"
+    "test_read_sql_via_sqlalchemy_engine"
     "test_resample_150_changes"
     "test_reset_index_150_changes"
     "test_reset_index"
@@ -107,8 +113,6 @@ buildPythonPackage rec {
     "test_types_rank"
     "test_undefined_variable_error"
     "test_value_label_type_mismatch"
-    "test_read_sql_via_sqlalchemy_connection"
-    "test_read_sql_via_sqlalchemy_engine"
   ] ++ lib.optionals stdenv.isDarwin [
     "test_plotting" # Fatal Python error: Illegal instruction
   ];
diff --git a/pkgs/development/python-modules/pdfplumber/default.nix b/pkgs/development/python-modules/pdfplumber/default.nix
index a4dbe9dfb184b..a43eaae34a808 100644
--- a/pkgs/development/python-modules/pdfplumber/default.nix
+++ b/pkgs/development/python-modules/pdfplumber/default.nix
@@ -1,32 +1,22 @@
 { lib
-, stdenv
 , buildPythonPackage
 , fetchFromGitHub
-, pythonOlder
-# build inputs
+, jupyterlab
+, nbexec
+, pandas
+, pandas-stubs
 , pdfminer-six
 , pillow
-, wand
-# check inputs
-, pytestCheckHook
-, pytest-cov
 , pytest-parallel
-, flake8
-, black
-, isort
-, pandas
-, mypy
-, pandas-stubs
+, pytestCheckHook
+, pythonOlder
 , types-pillow
-, jupyterlab
-, nbexec
+, wand
 }:
-let
+
+buildPythonPackage rec {
   pname = "pdfplumber";
   version = "0.9.0";
-in
-buildPythonPackage {
-  inherit pname version;
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -38,6 +28,11 @@ buildPythonPackage {
     hash = "sha256-cGTn1JTSp1YvksemjlvvToZcVauZ7GKINiNmG5f4zKg=";
   };
 
+  postPatch = ''
+    substituteInPlace setup.cfg \
+      --replace "--cov=pdfplumber --cov-report xml:coverage.xml --cov-report term" ""
+  '';
+
   propagatedBuildInputs = [
     pdfminer-six
     pillow
@@ -49,18 +44,13 @@ buildPythonPackage {
   '';
 
   nativeCheckInputs = [
-    pytestCheckHook
-    pytest-cov
-    pytest-parallel
-    flake8
-    black
-    isort
+    jupyterlab
+    nbexec
     pandas
-    mypy
     pandas-stubs
+    pytest-parallel
+    pytestCheckHook
     types-pillow
-    jupyterlab
-    nbexec
   ];
 
   pythonImportsCheck = [
@@ -73,7 +63,7 @@ buildPythonPackage {
   ];
 
   meta = with lib; {
-    description = "Plumb a PDF for detailed information about each char, rectangle, line, et cetera — and easily extract text and tables.";
+    description = "Plumb a PDF for detailed information about each char, rectangle, line, et cetera — and easily extract text and tables";
     homepage = "https://github.com/jsvine/pdfplumber";
     changelog = "https://github.com/jsvine/pdfplumber/releases/tag/v${version}";
     license = licenses.mit;
diff --git a/pkgs/development/python-modules/pydicom/default.nix b/pkgs/development/python-modules/pydicom/default.nix
index 34a802a256920..a2100c83c8df0 100644
--- a/pkgs/development/python-modules/pydicom/default.nix
+++ b/pkgs/development/python-modules/pydicom/default.nix
@@ -11,13 +11,13 @@
 
 let
   pname = "pydicom";
-  version = "2.3.1";
+  version = "2.4.2";
 
   src = fetchFromGitHub {
     owner = "pydicom";
     repo = "pydicom";
     rev = "refs/tags/v${version}";
-    hash = "sha256-xt0aK908lLgNlpcI86OSxy96Z/PZnQh7+GXzJ0VMQGA=";
+    hash = "sha256-FNZVu2/7kBGeP4iTH53bsApfHzHFxr5bxqbqkI4T95E=";
   };
 
   # Pydicom needs pydicom-data to run some tests. If these files aren't downloaded
@@ -25,8 +25,8 @@ let
   test_data = fetchFromGitHub {
     owner = "pydicom";
     repo = "pydicom-data";
-    rev = "bbb723879690bb77e077a6d57657930998e92bd5";
-    hash = "sha256-dCI1temvpNWiWJYVfQZKy/YJ4ad5B0e9hEKHJnEeqzk=";
+    rev = "cbb9b2148bccf0f550e3758c07aca3d0e328e768";
+    hash = "sha256-nF/j7pfcEpWHjjsqqTtIkW8hCEbuQ3J4IxpRk0qc1CQ=";
   };
 
 in
diff --git a/pkgs/development/python-modules/pyipp/default.nix b/pkgs/development/python-modules/pyipp/default.nix
index de0bdc5f637ef..c080d634b83b0 100644
--- a/pkgs/development/python-modules/pyipp/default.nix
+++ b/pkgs/development/python-modules/pyipp/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "pyipp";
-  version = "0.14.2";
+  version = "0.14.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
    owner = "ctalkington";
    repo = "python-ipp";
    rev = version;
-   hash = "sha256-IPmpup0VrilfLnYiigjVjL6oRwW4RPlgiafIy7yyckI=";
+   hash = "sha256-WbrAvIdFUPzSxGjIPzNny0V1W8S774vyREgylenJp24=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pyoverkiz/default.nix b/pkgs/development/python-modules/pyoverkiz/default.nix
index 7f261a3cfd1be..4dae164a0501e 100644
--- a/pkgs/development/python-modules/pyoverkiz/default.nix
+++ b/pkgs/development/python-modules/pyoverkiz/default.nix
@@ -2,6 +2,7 @@
 , aiohttp
 , attrs
 , backoff
+, backports-strenum
 , boto3
 , buildPythonPackage
 , fetchFromGitHub
@@ -15,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "pyoverkiz";
-  version = "1.9.1";
+  version = "1.10.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -24,7 +25,7 @@ buildPythonPackage rec {
     owner = "iMicknl";
     repo = "python-overkiz-api";
     rev = "refs/tags/v${version}";
-    hash = "sha256-03tbWCkSAG/aE6hsPxCPuGRFPTiMgkp/tCzWScPW8YE=";
+    hash = "sha256-tb0xU1H1VrWTuObCg1+mFkzawAzrknO3fER7cN2St7U=";
   };
 
   postPatch = ''
@@ -37,11 +38,12 @@ buildPythonPackage rec {
   ];
 
   propagatedBuildInputs = [
-    attrs
     aiohttp
+    attrs
     backoff
-    pyhumps
+    backports-strenum
     boto3
+    pyhumps
     warrant-lite
   ];
 
diff --git a/pkgs/development/python-modules/pysigma-backend-elasticsearch/default.nix b/pkgs/development/python-modules/pysigma-backend-elasticsearch/default.nix
index 69bca8d73444e..1bff99c958206 100644
--- a/pkgs/development/python-modules/pysigma-backend-elasticsearch/default.nix
+++ b/pkgs/development/python-modules/pysigma-backend-elasticsearch/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "pysigma-backend-elasticsearch";
-  version = "1.0.4";
+  version = "1.0.5";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "SigmaHQ";
     repo = "pySigma-backend-elasticsearch";
     rev = "refs/tags/v${version}";
-    hash = "sha256-HHg5WNnWm7/4yhKRNMxskZzOgyH5qTjRxh55g8nkCb8=";
+    hash = "sha256-a+2RW+S0Tpf1odfLi0JEdbxfJehF+HI/sHc4QX7lQ+4=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pytest-raises/default.nix b/pkgs/development/python-modules/pytest-raises/default.nix
index 68c23064afe9f..1b7beb74c5942 100644
--- a/pkgs/development/python-modules/pytest-raises/default.nix
+++ b/pkgs/development/python-modules/pytest-raises/default.nix
@@ -1,25 +1,44 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, pytest
 , pytestCheckHook
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "pytest-raises";
   version = "0.11";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "Lemmons";
     repo = pname;
-    rev = version;
-    sha256 = "0gbb4kml2qv7flp66i73mgb4qihdaybb6c96b5dw3mhydhymcsy2";
+    rev = "refs/tags/${version}";
+    hash = "sha256-wmtWPWwe1sFbWSYxs5ZXDUZM1qvjRGMudWdjQeskaz0=";
   };
 
+  buildInputs = [
+    pytest
+  ];
+
   nativeCheckInputs = [
     pytestCheckHook
   ];
 
-  pythonImportsCheck = [ "pytest_raises" ];
+  pythonImportsCheck = [
+    "pytest_raises"
+  ];
+
+  disabledTests = [
+    # Failed: nomatch: '*::test_pytest_mark_raises_unexpected_exception FAILED*'
+    # https://github.com/Lemmons/pytest-raises/issues/30
+    "test_pytest_mark_raises_unexpected_exception"
+    "test_pytest_mark_raises_unexpected_match"
+    "test_pytest_mark_raises_parametrize"
+  ];
 
   meta = with lib; {
     description = "An implementation of pytest.raises as a pytest.mark fixture";
diff --git a/pkgs/development/python-modules/qcodes/default.nix b/pkgs/development/python-modules/qcodes/default.nix
index 5796a6de6f12e..7fbb1bb3d5593 100644
--- a/pkgs/development/python-modules/qcodes/default.nix
+++ b/pkgs/development/python-modules/qcodes/default.nix
@@ -53,14 +53,14 @@
 
 buildPythonPackage rec {
   pname = "qcodes";
-  version = "0.39.0";
+  version = "0.39.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-zKn9LN7FBxKUfYSxUV1O6fB2s/B5bQpGDZTrK4DcxmU=";
+    sha256 = "sha256-2gJ/WeynabiGB1Z66+qaUbf6/1wogf/XjIE2mCAXUZY=";
   };
 
   postPatch = ''
@@ -78,8 +78,9 @@ buildPythonPackage rec {
     broadbean
     h5netcdf
     h5py
-    ipywidgets
     ipykernel
+    ipython
+    ipywidgets
     jsonschema
     matplotlib
     numpy
@@ -87,18 +88,17 @@ buildPythonPackage rec {
     opencensus-ext-azure
     packaging
     pandas
+    pillow
     pyvisa
+    rsa
     ruamel-yaml
     tabulate
-    typing-extensions
     tqdm
+    typing-extensions
     uncertainties
     websockets
     wrapt
     xarray
-    ipython
-    pillow
-    rsa
   ] ++ lib.optionals (pythonOlder "3.10") [
     importlib-metadata
   ];
@@ -139,10 +139,22 @@ buildPythonPackage rec {
   ];
 
   disabledTestPaths = [
-    # depends on qcodes-loop, causing a cyclic dependency
+    # Test depends on qcodes-loop, causing a cyclic dependency
     "qcodes/tests/dataset/measurement/test_load_legacy_data.py"
   ];
 
+  disabledTests = [
+    # Tests are time-sensitive and power-consuming
+    # Those tests fails repeatably
+    "test_access_channels_by_slice"
+    "test_do1d_additional_setpoints_shape"
+    "test_dond_1d_additional_setpoints_shape"
+    "test_field_limits"
+    "test_get_array_in_scalar_param_data"
+    "test_get_parameter_data"
+    "test_ramp_safely"
+  ];
+
   pythonImportsCheck = [
     "qcodes"
   ];
@@ -152,8 +164,8 @@ buildPythonPackage rec {
   '';
 
   meta = with lib; {
-    homepage = "https://qcodes.github.io/Qcodes/";
     description = "Python-based data acquisition framework";
+    homepage = "https://qcodes.github.io/Qcodes/";
     changelog = "https://github.com/QCoDeS/Qcodes/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ evilmav ];
diff --git a/pkgs/development/python-modules/rns/default.nix b/pkgs/development/python-modules/rns/default.nix
index 84b8c975f15d7..574af8aeecc9f 100644
--- a/pkgs/development/python-modules/rns/default.nix
+++ b/pkgs/development/python-modules/rns/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "rns";
-  version = "0.5.6";
+  version = "0.5.7";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "markqvist";
     repo = "Reticulum";
     rev = "refs/tags/${version}";
-    hash = "sha256-s/rOU9FEWdb0vmRsMq/yPkP/ZTNc5wjlfdB0V+ltryQ=";
+    hash = "sha256-0WNgJKhxK4WjYQ0n7ofqrRxf4m9uWn2ygcZiv3uhrhM=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/rokuecp/default.nix b/pkgs/development/python-modules/rokuecp/default.nix
index a6d9f2e8fa014..ac67ff88acb9d 100644
--- a/pkgs/development/python-modules/rokuecp/default.nix
+++ b/pkgs/development/python-modules/rokuecp/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "rokuecp";
-  version = "0.18.0";
+  version = "0.18.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "ctalkington";
     repo = "python-rokuecp";
     rev = "refs/tags/${version}";
-    hash = "sha256-YvJ1+o7/S/QNROedYGsP8m99Dr+WpAkfe5YPEN+2ZhU=";
+    hash = "sha256-0ArnP9xITVpbIfDrsNK3ukmeJBdd6SE3tnDwCLWSHMo=";
   };
 
   nativeBuildInputs = [
@@ -52,7 +52,7 @@ buildPythonPackage rec {
   postPatch = ''
     substituteInPlace pyproject.toml \
       --replace 'version = "0.0.0"' 'version = "${version}"' \
-      --replace " --cov" ""
+      --replace "--cov" ""
   '';
 
   disabledTests = [
diff --git a/pkgs/development/python-modules/spsdk/default.nix b/pkgs/development/python-modules/spsdk/default.nix
index 2177ebc97220e..4aafc2e6c1317 100644
--- a/pkgs/development/python-modules/spsdk/default.nix
+++ b/pkgs/development/python-modules/spsdk/default.nix
@@ -17,10 +17,12 @@
 , deepmerge
 , fastjsonschema
 , hexdump
+, importlib-metadata
 , jinja2
 , libusbsio
 , oscrypto
 , pycryptodome
+, pyftdi
 , pylink-square
 , pyocd
 , pypemicro
@@ -34,13 +36,13 @@
 
 buildPythonPackage rec {
   pname = "spsdk";
-  version = "1.10.1";
+  version = "1.11.0";
 
   src = fetchFromGitHub {
-    owner = "NXPmicro";
+    owner = "nxp-mcuxpresso";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-2UTgVHqFJqizJ6mDT7+PFec3bQexcBG6v8X0E5Ai4Hc=";
+    hash = "sha256-B3qedAXSG3A8rcWu1O2GnZ1ZqHN+7fQK43qXzGnDEY0=";
   };
 
   nativeBuildInputs = [
@@ -92,6 +94,8 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
+    importlib-metadata
+    pyftdi
     pytestCheckHook
     voluptuous
   ];
@@ -99,8 +103,9 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "spsdk" ];
 
   meta = with lib; {
+    changelog = "https://github.com/nxp-mcuxpresso/spsdk/blob/${src.rev}/docs/release_notes.rst";
     description = "NXP Secure Provisioning SDK";
-    homepage = "https://github.com/NXPmicro/spsdk";
+    homepage = "https://github.com/nxp-mcuxpresso/spsdk";
     license = licenses.bsd3;
     maintainers = with maintainers; [ frogamic sbruder ];
   };
diff --git a/pkgs/development/python-modules/treeo/default.nix b/pkgs/development/python-modules/treeo/default.nix
index 30a90bd36eea5..1560e1810ba6b 100644
--- a/pkgs/development/python-modules/treeo/default.nix
+++ b/pkgs/development/python-modules/treeo/default.nix
@@ -53,5 +53,7 @@ buildPythonPackage rec {
     homepage = "https://github.com/cgarciae/treeo";
     license = licenses.mit;
     maintainers = with maintainers; [ ndl ];
+    # obsolete as of 2023-02-27 and not updated for more than a year as of 2023-08
+    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/txtai/default.nix b/pkgs/development/python-modules/txtai/default.nix
index acf1db58d2a6f..1d4413a6dce91 100644
--- a/pkgs/development/python-modules/txtai/default.nix
+++ b/pkgs/development/python-modules/txtai/default.nix
@@ -52,7 +52,7 @@
 , unittestCheckHook
 }:
 let
-  version = "5.5.1";
+  version = "6.0.0";
   api = [ aiohttp fastapi uvicorn ];
   # cloud = [ apache-libcloud ];
   console = [ rich ];
@@ -104,8 +104,8 @@ buildPythonPackage {
   src = fetchFromGitHub {
     owner = "neuml";
     repo = "txtai";
-    rev = "v${version}";
-    hash = "sha256-h6TwWzLYfFg5x2QMIstAZ5pkxfHobBU+b4gb0HiayzY=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-lGRdSUSQGdxe+I4WrUkE4hIyyJ1HcFn3cXO3zd27fsM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/typer/default.nix b/pkgs/development/python-modules/typer/default.nix
index e5676eba46798..b072f3a6d8ca9 100644
--- a/pkgs/development/python-modules/typer/default.nix
+++ b/pkgs/development/python-modules/typer/default.nix
@@ -28,6 +28,15 @@ buildPythonPackage rec {
     hash = "sha256-UJIv15rqL0dRqOBAj/ENJmK9DIu/qEdVppnzutopeLI=";
   };
 
+  patches = [
+    # https://github.com/tiangolo/typer/pull/651
+    (fetchpatch {
+      name = "unpin-flit-core-dependency.patch";
+      url = "https://github.com/tiangolo/typer/commit/78a0ee2eec9f54ad496420e177fdaad84984def1.patch";
+      hash = "sha256-VVUzFvF2KCXXkCfCU5xu9acT6OLr+PlQQPeVGONtU4A=";
+    })
+  ];
+
   nativeBuildInputs = [
     flit-core
   ];
diff --git a/pkgs/development/python-modules/vulcan-api/default.nix b/pkgs/development/python-modules/vulcan-api/default.nix
index eeeb246888110..a7ed68b16a1c0 100644
--- a/pkgs/development/python-modules/vulcan-api/default.nix
+++ b/pkgs/development/python-modules/vulcan-api/default.nix
@@ -7,6 +7,7 @@
 , fetchFromGitHub
 , pyopenssl
 , pythonOlder
+, pythonRelaxDepsHook
 , pytz
 , related
 , requests
@@ -28,6 +29,14 @@ buildPythonPackage rec {
     hash = "sha256-5Tj611p4wYn7GjoCtCTRhUZkKyAJglHcci76ciVFWik=";
   };
 
+  pythonRemoveDeps = [
+    "faust-cchardet"
+  ];
+
+  nativeBuildInputs = [
+    pythonRelaxDepsHook
+  ];
+
   propagatedBuildInputs = [
     aenum
     aiodns
diff --git a/pkgs/development/tools/build-managers/buck2/default.nix b/pkgs/development/tools/build-managers/buck2/default.nix
index 17637f69790cf..fef32f1015cba 100644
--- a/pkgs/development/tools/build-managers/buck2/default.nix
+++ b/pkgs/development/tools/build-managers/buck2/default.nix
@@ -2,56 +2,76 @@
 , testers, buck2 # for passthru.tests
 }:
 
+# NOTE (aseipp): buck2 uses a precompiled binary build for good reason — the
+# upstream codebase extensively uses unstable `rustc` nightly features, and as a
+# result can't be built upstream in any sane manner. it is only ever tested and
+# integrated against a single version of the compiler, which produces all usable
+# binaries. you shouldn't try to workaround this or get clever and think you can
+# patch it to work; just accept it for now. it is extremely unlikely buck2 will
+# build with a stable compiler anytime soon; see related upstream issues:
+#
+#   - NixOS/nixpkgs#226677
+#   - NixOS/nixpkgs#232471
+#   - facebook/buck2#265
+#   - facebook/buck2#322
+#
+# worth noting: it *is* possible to build buck2 from source using
+# buildRustPackage, and it works fine, but only if you are using flakes and can
+# import `rust-overlay` from somewhere else to vendor your compiler. See
+# nixos/nixpkgs#226677 for more information about that.
+
+# NOTE (aseipp): this expression is mostly automated, and you are STRONGLY
+# RECOMMENDED to use to nix-update for updating this expression when new
+# releases come out, which runs the sibling `update.sh` script.
+#
+# from the root of the nixpkgs git repository, run:
+#
+#    nix-shell maintainers/scripts/update.nix \
+#      --argstr commit true \
+#      --argstr package buck2
+
 let
-  # NOTE (aseipp): buck2 uses a precompiled binary build for good reason — the
-  # upstream codebase extensively uses unstable `rustc` nightly features, and as
-  # a result can't be built upstream in any sane manner. it is only ever tested
-  # and integrated against a single version of the compiler, which produces all
-  # usable binaries. you shouldn't try to workaround this or get clever and
-  # think you can patch it to work; just accept it for now. it is extremely
-  # unlikely buck2 will build with a stable compiler anytime soon; see related
-  # upstream issues:
-  #
-  #   - NixOS/nixpkgs#226677
-  #   - NixOS/nixpkgs#232471
-  #   - facebook/buck2#265
-  #   - facebook/buck2#322
-  #
-  # worth noting: it *is* possible to build buck2 from source using
-  # buildRustPackage, and it works fine, but only if you are using flakes and
-  # can import `rust-overlay` from somewhere else to vendor your compiler. See
-  # nixos/nixpkgs#226677 for more information about that.
-
-  # map our platform name to the rust toolchain suffix
-  suffix = {
-    x86_64-darwin  = "x86_64-apple-darwin";
-    aarch64-darwin = "aarch64-apple-darwin";
-    x86_64-linux   = "x86_64-unknown-linux-musl";
-    aarch64-linux  = "aarch64-unknown-linux-musl";
-  }."${stdenv.hostPlatform.system}" or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
-
-  allHashes = builtins.fromJSON (builtins.readFile ./hashes.json);
+
+  # build hashes, which correspond to the hashes of the precompiled binaries
+  # procued by GitHub Actions. this also includes the hash for a download of a
+  # compatible buck2-prelude
+  buildHashes = builtins.fromJSON (builtins.readFile ./hashes.json);
 
   # our version of buck2; this should be a git tag
-  buck2-version = "2023-08-01";
+  version = "2023-08-15";
+
+  # the platform-specific, statically linked binary — which is also
+  # zstd-compressed
   src =
     let
-      hash = allHashes."${stdenv.hostPlatform.system}";
-      url = "https://github.com/facebook/buck2/releases/download/${buck2-version}/buck2-${suffix}.zst";
-    in fetchurl { inherit url hash; };
+      suffix = {
+        # map our platform name to the rust toolchain suffix
+        # NOTE (aseipp): must be synchronized with update.sh!
+        x86_64-darwin  = "x86_64-apple-darwin";
+        aarch64-darwin = "aarch64-apple-darwin";
+        x86_64-linux   = "x86_64-unknown-linux-musl";
+        aarch64-linux  = "aarch64-unknown-linux-musl";
+      }."${stdenv.hostPlatform.system}" or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
+
+      name = "buck2-${version}-${suffix}.zst";
+      hash = buildHashes."${stdenv.hostPlatform.system}";
+      url = "https://github.com/facebook/buck2/releases/download/${version}/buck2-${suffix}.zst";
+    in fetchurl { inherit name url hash; };
 
-  # compatible version of buck2 prelude; a git revision in the buck2-prelude repository
-  buck2-prelude = "acf49faaa61fd6ad9facd9e1418eed514bbb2ec8";
+  # compatible version of buck2 prelude; this is exported via passthru.prelude
+  # for downstream consumers to use when they need to automate any kind of
+  # tooling
   prelude-src =
     let
-      hash = allHashes."_prelude";
-      url = "https://github.com/facebook/buck2-prelude/archive/${buck2-prelude}.tar.gz";
-    in fetchurl { inherit url hash; };
+      prelude-hash = "40d6fffd01f224d25a62d982f4a3f00b275a5677";
+      name = "buck2-prelude-${version}.tar.gz";
+      hash = buildHashes."_prelude";
+      url = "https://github.com/facebook/buck2-prelude/archive/${prelude-hash}.tar.gz";
+    in fetchurl { inherit name url hash; };
 
-in
-stdenv.mkDerivation rec {
+in stdenv.mkDerivation {
   pname = "buck2";
-  version = "unstable-${buck2-version}"; # TODO (aseipp): kill 'unstable' once a non-prerelease is made
+  version = "unstable-${version}"; # TODO (aseipp): kill 'unstable' once a non-prerelease is made
   inherit src;
 
   nativeBuildInputs = [ zstd ];
@@ -88,9 +108,9 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Fast, hermetic, multi-language build system";
     homepage = "https://buck2.build";
-    changelog = "https://github.com/facebook/buck2/releases/tag/${buck2-version}";
+    changelog = "https://github.com/facebook/buck2/releases/tag/${version}";
     license = with licenses; [ asl20 /* or */ mit ];
-    mainProgram = pname;
+    mainProgram = "buck2";
     maintainers = with maintainers; [ thoughtpolice ];
     platforms = [
       "x86_64-linux" "aarch64-linux"
diff --git a/pkgs/development/tools/build-managers/buck2/hashes.json b/pkgs/development/tools/build-managers/buck2/hashes.json
index b4b1c3f73d481..3918b447ca985 100644
--- a/pkgs/development/tools/build-managers/buck2/hashes.json
+++ b/pkgs/development/tools/build-managers/buck2/hashes.json
@@ -1,7 +1,7 @@
 { "_comment": "@generated by pkgs/development/tools/build-managers/buck2/update.sh"
-, "_prelude": "sha256-SkCsVymQL/i8tUvKoLVtOQRYRm3zuF+WOFnbCggQwes="
-, "x86_64-linux": "sha256-wZULK2FPZ4GtQ5MMQmgfmtbMHJ7sPbue2RdVY0dmRuE="
-, "x86_64-darwin": "sha256-FmayArw2gswKjAEv0AzpFZNiXNx3GmJnPwH9g+Y/BGU="
-, "aarch64-linux": "sha256-3M1dRIFU0CwoVCbmq3oghhz51wW37melzt9hdIHqzzY="
-, "aarch64-darwin": "sha256-UAe73UNDSLL8OHqzAd+NOwwtW4bpVBz/aL4wdy3VuYg="
+, "_prelude": "sha256-TaQ31JvG4ihVn3n1HLuxf9D6Kq5KOb6xRMVMt2odoqY="
+, "x86_64-linux": "sha256-3Ae0e/J4GI7qPZnN36Ss7qImY8JWmETkbSyKSuGbpbg="
+, "x86_64-darwin": "sha256-GOMuNFTwX8uf65OJ5o54u14T/47MSp/5g6crTJDa6mk="
+, "aarch64-linux": "sha256-4oZXiPDu0zlQtlFTH1uH7OHKaNVVUjiQeZYbtc39yi0="
+, "aarch64-darwin": "sha256-vPgK9cYjBz0d41n56Cxqjly5FAnr/vr0GsoqUuOIVQo="
 }
diff --git a/pkgs/development/tools/build-managers/buck2/update.sh b/pkgs/development/tools/build-managers/buck2/update.sh
index 8e142dd1c978e..179ab6f3601da 100755
--- a/pkgs/development/tools/build-managers/buck2/update.sh
+++ b/pkgs/development/tools/build-managers/buck2/update.sh
@@ -41,11 +41,11 @@ done
 echo "}" >> "$HFILE"
 
 sed -i \
-  's/buck2-version\s*=\s*".*";/buck2-version = "'"$VERSION"'";/' \
+  '0,/version\s*=\s*".*";/s//version = "'"$VERSION"'";/' \
   "$NFILE"
 
 sed -i \
-  's/buck2-prelude\s*=\s*".*";/buck2-prelude = "'"$PRELUDE_HASH"'";/' \
+  '0,/prelude-hash\s*=\s*".*";/s//prelude-hash = "'"$PRELUDE_HASH"'";/' \
   "$NFILE"
 
 echo "Done; wrote $HFILE and updated version in $NFILE."
diff --git a/pkgs/development/tools/continuous-integration/forgejo-actions-runner/default.nix b/pkgs/development/tools/continuous-integration/forgejo-actions-runner/default.nix
index 1a048de134299..8b9a108d3db5a 100644
--- a/pkgs/development/tools/continuous-integration/forgejo-actions-runner/default.nix
+++ b/pkgs/development/tools/continuous-integration/forgejo-actions-runner/default.nix
@@ -7,17 +7,17 @@
 
 buildGoModule rec {
   pname = "forgejo-actions-runner";
-  version = "2.3.0";
+  version = "2.4.0";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "forgejo";
     repo = "runner";
     rev = "v${version}";
-    hash = "sha256-ZIhUlTGeNuJSrBVXYjAz/YHYmkR3wg1LAe0uUabEQRQ=";
+    hash = "sha256-EEwXo2MvdBlSMho4rrYD4wXLccS/30NbCuxO0CUktgE=";
   };
 
-  vendorHash = "sha256-OauNDA0mkarSWrZBfJE/SYspa3CTEYKpLRMvbPdIoRo=";
+  vendorHash = "sha256-FspNmiphGHSeZFmdlWIDsEUrCc8THfb0Wm67cMCTtHI=";
 
   ldflags = [
     "-s"
@@ -25,7 +25,7 @@ buildGoModule rec {
     "-X gitea.com/gitea/act_runner/internal/pkg/ver.version=${src.rev}"
   ];
 
-  doCheck = false; # Test try to lookuyp code.forgejo.org.
+  doCheck = false; # Test try to lookup code.forgejo.org.
 
   passthru.tests.version = testers.testVersion {
     package = forgejo-actions-runner;
diff --git a/pkgs/development/tools/database/sqlc/default.nix b/pkgs/development/tools/database/sqlc/default.nix
index 0fac85bcad947..dfe0cac81f891 100644
--- a/pkgs/development/tools/database/sqlc/default.nix
+++ b/pkgs/development/tools/database/sqlc/default.nix
@@ -1,7 +1,7 @@
 { lib, buildGoModule, fetchFromGitHub }:
 
 let
-  version = "1.19.1";
+  version = "1.20.0";
 in
 buildGoModule {
   pname = "sqlc";
@@ -11,11 +11,11 @@ buildGoModule {
     owner = "kyleconroy";
     repo = "sqlc";
     rev    = "v${version}";
-    sha256 = "sha256-xZogHQ44amdhFewovFd1TWrul0wlofUqo46Ay13Mnig=";
+    sha256 = "sha256-ITW5jIlNoiW7sl6s5jCVRELglauZzSPmAj3PXVpdIGA=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-owH+Gd6K+RzBRhWEs99qQLXV3UWysEkLinEFvzSzXIU=";
+  vendorHash = "sha256-5ZJPHdjg3QCB/hJ+C7oXSfzBfg0fZ+kFyMXqC7KpJmY=";
 
   subPackages = [ "cmd/sqlc" ];
 
diff --git a/pkgs/development/tools/misc/ztags/default.nix b/pkgs/development/tools/misc/ztags/default.nix
new file mode 100644
index 0000000000000..589e9c0062b23
--- /dev/null
+++ b/pkgs/development/tools/misc/ztags/default.nix
@@ -0,0 +1,30 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, zig_0_11
+}:
+
+stdenv.mkDerivation {
+  pname = "ztags";
+  version = "unstable-2023-08-03";
+
+  src = fetchFromGitHub {
+    owner = "gpanders";
+    repo = "ztags";
+    rev = "6ef039047f6580772c5ff97e8770d919dc07a4fa";
+    hash = "sha256-WuDEHzNU3I4VPHEAkRdIUE5LPbQEKbUnITdFutGV58Y=";
+  };
+
+  nativeBuildInputs = [
+    zig_0_11.hook
+  ];
+
+  meta = with lib; {
+    description = "Generate tags files for Zig projects";
+    homepage = "https://github.com/gpanders/ztags";
+    license = licenses.mit;
+    maintainers = with maintainers; [ figsoda ];
+    mainProgram = "ztags";
+    inherit (zig_0_11.meta) platforms;
+  };
+}
diff --git a/pkgs/development/tools/operator-sdk/default.nix b/pkgs/development/tools/operator-sdk/default.nix
index 9dcac86c76130..3ba63d8440b3c 100644
--- a/pkgs/development/tools/operator-sdk/default.nix
+++ b/pkgs/development/tools/operator-sdk/default.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "operator-sdk";
-  version = "1.30.0";
+  version = "1.31.0";
 
   src = fetchFromGitHub {
     owner = "operator-framework";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-mDjBu25hOhm3FrUDsFq1rjBn58K91Bao8gqN2heZ9ps=";
+    hash = "sha256-v/7nqZg/lwiK2k92kQWSZCSjEZhTAQHCGBcTfxQX2r0=";
   };
 
-  vendorHash = "sha256-QfTWjSsWpbbGgKrv4U2E6jA6eAT4wnj0ixpUqDxtsY8=";
+  vendorHash = "sha256-geKWTsDLx5drTleTnneg2JIbe5sMS5JUQxTX9Bcm+IQ=";
 
   nativeBuildInputs = [
     makeWrapper
diff --git a/pkgs/development/tools/reindeer/default.nix b/pkgs/development/tools/reindeer/default.nix
index f2b934187e542..5d352ccca0b01 100644
--- a/pkgs/development/tools/reindeer/default.nix
+++ b/pkgs/development/tools/reindeer/default.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "reindeer";
-  version = "unstable-2023-07-14";
+  version = "unstable-2023-08-14";
 
   src = fetchFromGitHub {
     owner = "facebookincubator";
     repo = pname;
-    rev = "381fe232bcab77b432e2f29dbbd685e013d19c76";
-    sha256 = "sha256-xyoGmleJAZA/tdB2Q11vPe9rcn74SCBPiTR//Cpx1Lw=";
+    rev = "7ab6fc86006c3a9c7d46775d23474f86b1d29881";
+    sha256 = "sha256-wn5MwBDOKnHIOVYZK68GOjvX7dkFaWJuLJOxgUR6bok=";
   };
 
-  cargoSha256 = "sha256-GVOkZcleKakXE58LbJthAa5ZWArKkIok/RawLXcwGPw=";
+  cargoSha256 = "sha256-MVQVYiJ6512wahVG8ONtZB+jgXXEGGFnE89VHGa/77U=";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs =
diff --git a/pkgs/development/tools/viceroy/default.nix b/pkgs/development/tools/viceroy/default.nix
index 0b2f219014a0d..d33975a71f116 100644
--- a/pkgs/development/tools/viceroy/default.nix
+++ b/pkgs/development/tools/viceroy/default.nix
@@ -2,18 +2,18 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "viceroy";
-  version = "0.6.1";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     owner = "fastly";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-+vvlj8gGCHKQ2T245fwaZxCiglRnrDFwupQIh3I47Ys=";
+    hash = "sha256-ml9N4oxq80A1y7oFE98eifFIEtdcT9IRhXwDMEJ298k=";
   };
 
   buildInputs = lib.optional stdenv.isDarwin Security;
 
-  cargoHash = "sha256-0Qr40hMA59WaHinkUkebF0CwPy3aublgfzSz1er7Uws=";
+  cargoHash = "sha256-PC2StxMefsiKaY9fXIG4167G9SoWlbmJBDGwrFBa4os=";
 
   cargoTestFlags = [
     "--package viceroy-lib"
diff --git a/pkgs/games/forge-mtg/default.nix b/pkgs/games/forge-mtg/default.nix
index fbcc652d80d33..cc5c56977bb98 100644
--- a/pkgs/games/forge-mtg/default.nix
+++ b/pkgs/games/forge-mtg/default.nix
@@ -8,13 +8,13 @@
 }:
 
 let
-  version = "1.6.56";
+  version = "1.6.57";
 
   src = fetchFromGitHub {
     owner = "Card-Forge";
     repo = "forge";
     rev = "forge-${version}";
-    hash = "sha256-VB/ToTq1XwHPEUNmbocwUoCP4DfyAFdlRAwxrx4tNJU=";
+    hash = "sha256-pxnnqLfyblbIgIRZZrx8Y8K43zUv9mu7PzZ7zltpEUQ=";
   };
 
   # launch4j downloads and runs a native binary during the package phase.
@@ -27,7 +27,7 @@ maven.buildMavenPackage {
 
   # Tests need a running Xorg.
   mvnParameters = "-DskipTests";
-  mvnHash = "sha256-ajrHnaiJS7ZnR9BjLaXK2bnAKCp5UWQqYpjWbz3z6bw=";
+  mvnHash = "sha256-QK9g0tG75lIhEtf4jW03N32YbD9Fe5iI0JTuqmCTtnE=";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/games/path-of-building/default.nix b/pkgs/games/path-of-building/default.nix
index 050961957ba76..ab48a12c8b352 100644
--- a/pkgs/games/path-of-building/default.nix
+++ b/pkgs/games/path-of-building/default.nix
@@ -1,6 +1,6 @@
 { stdenv, lib, fetchFromGitHub, runCommand, unzip, meson, ninja, pkg-config, qtbase, qttools, wrapQtAppsHook, luajit }:
 let
-  dataVersion = "2.31.0";
+  dataVersion = "2.31.1";
   frontendVersion = "unstable-2023-04-09";
 in
 stdenv.mkDerivation {
@@ -19,7 +19,7 @@ stdenv.mkDerivation {
       owner = "PathOfBuildingCommunity";
       repo = "PathOfBuilding";
       rev = "v${dataVersion}";
-      hash = "sha256-romuFNd80TuskJUp/UqmI3hPjVMxE/xoBTpQVCu5MBI=";
+      hash = "sha256-K/u8NYUv4U/XgGP/LkYMRzwmw1LFn25OW6bmvqqRpVQ=";
     };
 
     nativeBuildInputs = [ unzip ];
diff --git a/pkgs/os-specific/linux/rtw88/default.nix b/pkgs/os-specific/linux/rtw88/default.nix
index abe98927613f4..a28a9f3d19e82 100644
--- a/pkgs/os-specific/linux/rtw88/default.nix
+++ b/pkgs/os-specific/linux/rtw88/default.nix
@@ -5,13 +5,13 @@ let
 in
 stdenv.mkDerivation {
   pname = "rtw88";
-  version = "unstable-2022-11-05";
+  version = "unstable-2023-07-23";
 
   src = fetchFromGitHub {
     owner = "lwfinger";
     repo = "rtw88";
-    rev = "c0dfe571fd7b307e036f186ef5711b4c0d9f3f08";
-    sha256 = "1gc5nv5pyrfag826z36vsrbirg6iww99yx45pcgpp7rmrpbwamvg";
+    rev = "9b6fe04a741a6b0a1edc5ca134927784bff033a5";
+    hash = "sha256-OzaIy+WTrljwAhC73wEIRUXrkz1NrGNJAS3zofQyV6E=";
   };
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
@@ -30,7 +30,7 @@ stdenv.mkDerivation {
   '';
 
   meta = with lib; {
-    description = "The newest Realtek rtlwifi codes";
+    description = "Backport of the latest Realtek RTW88 driver from wireless-next for older kernels";
     homepage = "https://github.com/lwfinger/rtw88";
     license = with licenses; [ bsd3 gpl2Only ];
     maintainers = with maintainers; [ tvorog atila ];
diff --git a/pkgs/servers/invidious/default.nix b/pkgs/servers/invidious/default.nix
index 7efeb5d9c39d9..0b1cea5fd689a 100644
--- a/pkgs/servers/invidious/default.nix
+++ b/pkgs/servers/invidious/default.nix
@@ -97,12 +97,16 @@ crystal.buildCrystalPackage rec {
     cp -r config/sql $out/share/invidious/config
   '';
 
-  # Invidious tries to open config/config.yml and connect to the database, even
-  # when running --help. This specifies a minimal configuration in an
-  # environment variable. Even though the database is bogus, --help still
-  # works.
+  # Invidious tries to open and validate config/config.yml, even when
+  # running --help. This specifies a minimal configuration in an
+  # environment variable. Even though the database and hmac_key are
+  # bogus, --help still works.
   installCheckPhase = ''
-    INVIDIOUS_CONFIG="database_url: sqlite3:///dev/null" $out/bin/invidious --help
+    INVIDIOUS_CONFIG="$(cat <<EOF
+    database_url: sqlite3:///dev/null
+    hmac_key: "this-is-required"
+    EOF
+    )" $out/bin/invidious --help
   '';
 
   passthru = {
diff --git a/pkgs/servers/invidious/update.sh b/pkgs/servers/invidious/update.sh
index 4810534cd2981..d7302e16bfbd4 100755
--- a/pkgs/servers/invidious/update.sh
+++ b/pkgs/servers/invidious/update.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p curl crystal crystal2nix jq git moreutils nix nix-prefetch pkg-config
+#!nix-shell -i bash -p curl crystal crystal2nix jq git moreutils nix nix-prefetch pkg-config pcre
 git_url='https://github.com/iv-org/invidious.git'
 git_branch='master'
 git_dir='/var/tmp/invidious.git'
diff --git a/pkgs/servers/invidious/versions.json b/pkgs/servers/invidious/versions.json
index 860bd4ce2aeb0..f2bc1e7af4d8d 100644
--- a/pkgs/servers/invidious/versions.json
+++ b/pkgs/servers/invidious/versions.json
@@ -4,9 +4,9 @@
     "sha256": "sha256-EU6T9yQCdOLx98Io8o01rEsgxDFF/Xoy42LgPopD2/A="
   },
   "invidious": {
-    "rev": "545a5937d87d31622e87bb2ba8151f8aecd66c81",
-    "sha256": "sha256-1Ra3nLO2DsnTvyovteF0cOIl07GHbJyPbTYBRIyKuAs=",
-    "version": "unstable-2023-06-06"
+    "rev": "34508966027fce3f460d9670eeecef67b92565a0",
+    "sha256": "sha256-z+6YHhESb0Ws9DRaVH4AR2i/SaWgM9OhTzxdY1bkv/0=",
+    "version": "unstable-2023-08-07"
   },
   "lsquic": {
     "sha256": "sha256-hG8cUvhbCNeMOsKkaJlgGpzUrIx47E/WhmPIdI5F3qM=",
diff --git a/pkgs/servers/mail/mailman/0001-Disable-broken-test_help_output-testcase.patch b/pkgs/servers/mail/mailman/0001-Disable-broken-test_help_output-testcase.patch
new file mode 100644
index 0000000000000..3b6094bd02f0b
--- /dev/null
+++ b/pkgs/servers/mail/mailman/0001-Disable-broken-test_help_output-testcase.patch
@@ -0,0 +1,36 @@
+From 1a914beafe2b00770213fa4d146ffad9d897dc0c Mon Sep 17 00:00:00 2001
+From: Maximilian Bosch <maximilian@mbosch.me>
+Date: Sat, 12 Aug 2023 12:27:25 +0200
+Subject: [PATCH] Disable broken `test_help_output` testcase
+
+The assertion fails, but checking for the exact whereabouts of helptext
+doesn't bring too much value anyways, so it seems OK to just skip the
+test.
+---
+ .../tests/commands/test_attachments_to_file.py      | 13 -------------
+ 1 file changed, 13 deletions(-)
+
+diff --git a/hyperkitty/tests/commands/test_attachments_to_file.py b/hyperkitty/tests/commands/test_attachments_to_file.py
+index b3e61f3a..8db7c4b2 100644
+--- a/hyperkitty/tests/commands/test_attachments_to_file.py
++++ b/hyperkitty/tests/commands/test_attachments_to_file.py
+@@ -83,16 +83,3 @@ class CommandTestCase(TestCase):
+             self.assertEqual(fp.getvalue(), """\
+ 2 attachments moved.
+ """)
+-
+-    def test_help_output(self):
+-        with io.StringIO() as fp, redirect_stdout(fp):
+-            with suppress(SystemExit):
+-                call_command('attachments_to_file', '--help')
+-
+-            output_value = fp.getvalue()
+-            assert (
+-                "HYPERKITTY_ATTACHMENT_FOLDER" in output_value
+-                and "-c CHUNK_SIZE" in output_value
+-                and "-c CHUNK_SIZE, --chunk-size CHUNK_SIZE" in output_value
+-                and "-v {0,1}, --verbosity {0,1}" in output_value
+-            )
+-- 
+2.40.1
+
diff --git a/pkgs/servers/mail/mailman/hyperkitty.nix b/pkgs/servers/mail/mailman/hyperkitty.nix
index f0cac80bb5fd1..334a24b1ed003 100644
--- a/pkgs/servers/mail/mailman/hyperkitty.nix
+++ b/pkgs/servers/mail/mailman/hyperkitty.nix
@@ -1,36 +1,22 @@
 { lib
 , python3
 , fetchPypi
-, fetchpatch
 }:
 
 with python3.pkgs;
 
 buildPythonPackage rec {
   pname = "HyperKitty";
-  # Note: Mailman core must be on the latest version before upgrading HyperKitty.
-  # See: https://gitlab.com/mailman/postorius/-/issues/516#note_544571309
-  version = "1.3.5";
+  version = "1.3.7";
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-gmkiK8pIHfubbbxNdm/D6L2o722FptxYgINYdIUOn4Y=";
+    sha256 = "sha256-TXSso+wwVGdBymIzns5yOS4pj1EdConmm87b/NyBAss=";
   };
 
   patches = [
-    # FIXME: backport Python 3.10 support fix, remove for next release
-    (fetchpatch {
-      url = "https://gitlab.com/mailman/hyperkitty/-/commit/551a44a76e46931fc5c1bcb341235d8f579820be.patch";
-      sha256 = "sha256-5XCrvyrDEqH3JryPMoOXSlVVDLQ+PdYBqwGYxkExdvk=";
-      includes = [ "hyperkitty/*" ];
-    })
-
-    # Fix for Python >=3.9.13
-    (fetchpatch {
-      url = "https://gitlab.com/mailman/hyperkitty/-/commit/3efe7507944dbdbfcfa4c182d332528712476b28.patch";
-      sha256 = "sha256-yXuhTbmfDiYEXEsnz+zp+xLHRqI4GtkOhGHN+37W0iQ=";
-    })
+    ./0001-Disable-broken-test_help_output-testcase.patch
   ];
 
   postPatch = ''
diff --git a/pkgs/servers/mail/mailman/postorius.nix b/pkgs/servers/mail/mailman/postorius.nix
index fefffffc87c86..1e93b20f3232a 100644
--- a/pkgs/servers/mail/mailman/postorius.nix
+++ b/pkgs/servers/mail/mailman/postorius.nix
@@ -4,13 +4,11 @@ with python3.pkgs;
 
 buildPythonPackage rec {
   pname = "postorius";
-  # Note: Mailman core must be on the latest version before upgrading Postorious.
-  # See: https://gitlab.com/mailman/postorius/-/issues/516#note_544571309
-  version = "1.3.6";
+  version = "1.3.8";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-KwzEU9IfcQ6YPZu3jPuFrd6ux/3e2pzoLfTrak/aGmg=";
+    sha256 = "sha256-1mSt+PVx3xUJDc5JwrCmKiRNIDwbsjjbM2Fi5Sgz6h8=";
   };
 
   propagatedBuildInputs = [ django-mailman3 readme_renderer ];
diff --git a/pkgs/servers/mail/mailman/python.nix b/pkgs/servers/mail/mailman/python.nix
index dfd8790302fde..8549cb7150d2a 100644
--- a/pkgs/servers/mail/mailman/python.nix
+++ b/pkgs/servers/mail/mailman/python.nix
@@ -1,21 +1,25 @@
-{ python3, fetchPypi }:
+{ python3, lib, overlay ? (_: _: {}) }:
 
 python3.override {
-  packageOverrides = self: super: {
-    django = super.django_3;
+  packageOverrides = lib.composeExtensions
+    (self: super: {
+      /*
+        This overlay can be used whenever we need to override
+        dependencies specific to the mailman ecosystem: in the past
+        this was necessary for e.g. psycopg2[1] or sqlalchemy[2].
 
-    # does not find tests
-    alembic = super.alembic.overridePythonAttrs (oldAttrs: {
-      doCheck = false;
-    });
-    # Fixes `AssertionError: database connection isn't set to UTC`
-    psycopg2 = super.psycopg2.overridePythonAttrs (a: rec {
-      version = "2.8.6";
-      src = fetchPypi {
-        inherit version;
-        inherit (a) pname;
-        sha256 = "fb23f6c71107c37fd667cb4ea363ddeb936b348bbd6449278eb92c189699f543";
-      };
-    });
-  };
+        In such a large ecosystem this sort of issue is expected
+        to arise again. Since we don't want to clutter the python package-set
+        itself with version overrides and don't want to change the APIs
+        in here back and forth every time this comes up (and as a result
+        force users to change their code accordingly), this overlay
+        is kept on purpose, even when empty.
+
+        [1] 72a14ea563a3f5bf85db659349a533fe75a8b0ce
+        [2] f931bc81d63f5cfda55ac73d754c87b3fd63b291
+      */
+      django = super.django_3;
+    })
+
+    overlay;
 }
diff --git a/pkgs/servers/mail/mailman/web.nix b/pkgs/servers/mail/mailman/web.nix
index bb50586e8d561..b63fa8c655053 100644
--- a/pkgs/servers/mail/mailman/web.nix
+++ b/pkgs/servers/mail/mailman/web.nix
@@ -6,12 +6,12 @@ with python3.pkgs;
 
 buildPythonPackage rec {
   pname = "mailman-web";
-  version = "0.0.5";
+  version = "0.0.6";
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-9pvs/VATAsMcGNrj58b/LifysEPTNhrAP57sfp4nX6Q=";
+    sha256 = "sha256-UWdqrcx529r6kwgf0YEHiDrpZlGoUBR6OdYtHMTPMGY=";
   };
 
   postPatch = ''
diff --git a/pkgs/servers/mail/rspamd/default.nix b/pkgs/servers/mail/rspamd/default.nix
index 579a664e63706..eb96fa9738e36 100644
--- a/pkgs/servers/mail/rspamd/default.nix
+++ b/pkgs/servers/mail/rspamd/default.nix
@@ -1,6 +1,23 @@
-{ stdenv, lib, fetchFromGitHub, cmake, perl
-, glib, luajit, openssl, pcre, pkg-config, sqlite, ragel, icu
-, hyperscan, jemalloc, blas, lapack, lua, libsodium
+{ stdenv
+, lib
+, fetchFromGitHub
+, fetchpatch2
+, cmake
+, perl
+, glib
+, luajit
+, openssl
+, pcre
+, pkg-config
+, sqlite
+, ragel
+, icu
+, hyperscan
+, jemalloc
+, blas
+, lapack
+, lua
+, libsodium
 , withBlas ? true
 , withHyperscan ? stdenv.isx86_64
 , withLuaJIT ? stdenv.isx86_64
@@ -20,6 +37,15 @@ stdenv.mkDerivation rec {
     hash = "sha256-GuWuJK73RE+cS8451m+bcmpZNQEzmZtexm19xgdDQeU=";
   };
 
+  patches = [
+    # Fix leak in `gzip` function
+    # https://github.com/rspamd/rspamd/issues/4564
+    (fetchpatch2 {
+      url = "https://github.com/rspamd/rspamd/commit/ffbab4fbf218514845b8e5209aec044621b1f460.patch";
+      hash = "sha256-ltkC/mZcYmGoSFILaTTRB/UWSn36flEbuJP4Buys05Y=";
+    })
+  ];
+
   hardeningEnable = [ "pie" ];
 
   nativeBuildInputs = [ cmake pkg-config perl ];
diff --git a/pkgs/servers/monitoring/prometheus/redis-exporter.nix b/pkgs/servers/monitoring/prometheus/redis-exporter.nix
index b6641914ad358..e256c8e2c7892 100644
--- a/pkgs/servers/monitoring/prometheus/redis-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/redis-exporter.nix
@@ -1,25 +1,17 @@
-{ lib, buildGoModule, fetchFromGitHub, nixosTests, fetchpatch }:
+{ lib, buildGoModule, fetchFromGitHub, nixosTests }:
 
 buildGoModule rec {
   pname = "redis_exporter";
-  version = "1.51.0";
+  version = "1.52.0";
 
   src = fetchFromGitHub {
     owner = "oliver006";
     repo = "redis_exporter";
     rev = "v${version}";
-    sha256 = "sha256-NvkAwUrygjys25lcTxtRnrex4+XIK2yzqKkk26f4cmE=";
+    sha256 = "sha256-DVl67+pouQHg26vF5ONntPjQfyxnLusI3LTpT96ogNw=";
   };
 
-  patches = [
-    # https://github.com/oliver006/redis_exporter/pull/812
-    (fetchpatch {
-      url = "https://github.com/Ma27/redis_exporter/commit/250b2e9febbadef326ca9ae68c372dfaabd53ca9.patch";
-      sha256 = "sha256-G1OIUwlFZ06UWudWvc6v1YFcRz05ji1326nUcd9zYDc=";
-    })
-  ];
-
-  vendorHash = "sha256-S7cEaFBgyvDmsNq+NvqtC8I2SRL/ngXUuNdx6TN/riI=";
+  vendorHash = "sha256-nezvUbKZ8yi7Etp/dg3sT2g5bWBFMYZimt31NT91BEo=";
 
   ldflags = [
     "-X main.BuildVersion=${version}"
diff --git a/pkgs/servers/monitoring/prometheus/smartctl-exporter/default.nix b/pkgs/servers/monitoring/prometheus/smartctl-exporter/default.nix
index df21ef09f9f1c..c25882a201b65 100644
--- a/pkgs/servers/monitoring/prometheus/smartctl-exporter/default.nix
+++ b/pkgs/servers/monitoring/prometheus/smartctl-exporter/default.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "smartctl_exporter";
-  version = "0.9.1";
+  version = "0.10.0";
 
   src = fetchFromGitHub {
     owner = "prometheus-community";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-fc1NZ5QwzR/jJkeaDm5PMT4wBFFlqZOXKTJMBJWKJJ8=";
+    hash = "sha256-M4d8l9EbOZsi2ubyRo7KSBYewcC9NidW/Rf1QVVIvo8=";
   };
 
-  vendorSha256 = "sha256-lQKuT5dzjDHFpRSmcXpKD1RJDlEv+0kcxENkv3mT4FU=";
+  vendorHash = "sha256-0WLI+nLhRkf1CGhSer1Jkv1nUho5sxIbTE/Mf5JmX7U=";
 
   ldflags = [
     "-X github.com/prometheus/common/version.Version=${version}"
diff --git a/pkgs/servers/search/opensearch/default.nix b/pkgs/servers/search/opensearch/default.nix
index 8e4514eb0bc26..d32d77f0ae49d 100644
--- a/pkgs/servers/search/opensearch/default.nix
+++ b/pkgs/servers/search/opensearch/default.nix
@@ -1,27 +1,30 @@
-{ lib
-, stdenv
-, stdenvNoCC
+{ coreutils
 , fetchurl
-, makeWrapper
-, jre_headless
 , gnugrep
-, coreutils
-, autoPatchelfHook
-, zlib
+, jre_headless
+, lib
+, makeBinaryWrapper
 , nixosTests
+, stdenv
+, stdenvNoCC
 }:
 
-stdenvNoCC.mkDerivation rec {
+stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "opensearch";
-  version = "2.8.0";
+  version = "2.9.0";
 
   src = fetchurl {
-    url = "https://artifacts.opensearch.org/releases/bundle/opensearch/${version}/opensearch-${version}-linux-x64.tar.gz";
-    hash = "sha256-64vWis+YQfjOw8eaYi1nggq/Q2ErqqcEuISXPGROypc=";
+    url = "https://artifacts.opensearch.org/releases/bundle/opensearch/${finalAttrs.version}/opensearch-${finalAttrs.version}-linux-x64.tar.gz";
+    hash = "sha256-A9YjwtmacQDC8PrdyP/ai6J+roqmP/bz99rSM3votow=";
   };
 
-  nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [ jre_headless ];
+  nativeBuildInputs = [
+    makeBinaryWrapper
+  ];
+
+  buildInputs = [
+    jre_headless
+  ];
 
   installPhase = ''
     runHook preInstall
@@ -48,12 +51,12 @@ stdenvNoCC.mkDerivation rec {
   meta = {
     description = "Open Source, Distributed, RESTful Search Engine";
     homepage = "https://github.com/opensearch-project/OpenSearch";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ shyim ];
+    platforms = lib.platforms.unix;
     sourceProvenance = with lib.sourceTypes; [
       binaryBytecode
       binaryNativeCode
     ];
-    license = lib.licenses.asl20;
-    platforms = lib.platforms.unix;
-    maintainers = with lib.maintainers; [ shyim ];
   };
-}
+})
diff --git a/pkgs/servers/sql/postgresql/ext/plr.nix b/pkgs/servers/sql/postgresql/ext/plr.nix
index 68faa58b2e832..7dcb3c0c4660d 100644
--- a/pkgs/servers/sql/postgresql/ext/plr.nix
+++ b/pkgs/servers/sql/postgresql/ext/plr.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "plr";
-  version = "8.4.5";
+  version = "8.4.6";
 
   src = fetchFromGitHub {
     owner = "postgres-plr";
     repo = "plr";
     rev = "REL${builtins.replaceStrings ["."] ["_"] version}";
-    sha256 = "sha256-G/V3I1JI6dWto/hK6lfOTBYEvbmkovvnvk2TwSQq4no=";
+    sha256 = "sha256-c+wKWL66pulihVQnhdbzivrZOMD1/FfOpb+vFoHgqVg=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/servers/web-apps/wiki-js/default.nix b/pkgs/servers/web-apps/wiki-js/default.nix
index 20fa13d1739f7..b79dffc083715 100644
--- a/pkgs/servers/web-apps/wiki-js/default.nix
+++ b/pkgs/servers/web-apps/wiki-js/default.nix
@@ -2,48 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "wiki-js";
-  version = "2.5.299";
+  version = "2.5.300";
 
   src = fetchurl {
     url = "https://github.com/Requarks/wiki/releases/download/v${version}/${pname}.tar.gz";
-    sha256 = "sha256-GYe05dbR8RwCzPedeCMUQTWZ51roM/V2jUPPv7o7UEU=";
+    sha256 = "sha256-Cycq2oeB8v02VtE5KPs09+uzZqvGbJRH+J4YPDYo+yY=";
   };
 
-  # Implements nodejs 18 support as it's not planned to fix this before
-  # the release of v3[1] which is planned to happen in 2023, but not before
-  # NixOS 23.05. However, in the lifespan of 23.05 v16 will get EOLed, so
-  # we have to hack this on our own.
-  #
-  # The problem we fix here is that `exports."/public/"` in a `package.json`
-  # is prohibited, i.e. you cannot export full directories anymore.
-  #
-  # Unfortunately it's non-trivial to fix this because v10 of `extract-files`
-  # (where the problem is fixed) doesn't work for graphql-tools (which depends
-  # on this). Updating this as well is also quite complex because in later
-  # versions the package was split up into multiple smaller packages and
-  # thus a lot of parts of the code-base would need to be changed accordingly.
-  #
-  # Since this is the only breaking change of nodejs 17/18[2][3], this workaround
-  # will be necessary until we can upgrade to v3.
-  #
-  # [1] https://github.com/requarks/wiki/discussions/6388
-  # [2] https://nodejs.org/en/blog/release/v17.0.0
-  # [3] https://nodejs.org/en/blog/release/v18.0.0
-  patches = [ ./drop-node-check.patch ];
-  nativeBuildInputs = [ jq moreutils ];
-  postPatch = ''
-    # Dirty hack to implement nodejs-18 support.
-    <./node_modules/extract-files/package.json jq '
-      # error out loud if the structure has changed and we need to change
-      # this expression
-      if .exports|has("./public/")|not then
-        halt_error(1)
-      else
-        .exports."./public/*" = "./public/*.js" | del(.exports."./public/")
-      end
-    ' | sponge ./node_modules/extract-files/package.json
-  '';
-
   sourceRoot = ".";
 
   dontBuild = true;
diff --git a/pkgs/servers/web-apps/wiki-js/drop-node-check.patch b/pkgs/servers/web-apps/wiki-js/drop-node-check.patch
deleted file mode 100644
index 227649ba10d2d..0000000000000
--- a/pkgs/servers/web-apps/wiki-js/drop-node-check.patch
+++ /dev/null
@@ -1,19 +0,0 @@
-diff --git a/server/index.js b/server/index.js
-index 7cdb4f80..161ebeb7 100644
---- a/server/index.js
-+++ b/server/index.js
-@@ -8,14 +8,6 @@ const { nanoid } = require('nanoid')
- const { DateTime } = require('luxon')
- const { gte } = require('semver')
- 
--// ----------------------------------------
--// Check Node.js version
--// ----------------------------------------
--if (gte(process.version, '18.0.0')) {
--  console.error('You\'re using an unsupported Node.js version. Please read the requirements.')
--  process.exit(1)
--}
--
- // ----------------------------------------
- // Init WIKI instance
- // ----------------------------------------
diff --git a/pkgs/tools/backup/duplicati/default.nix b/pkgs/tools/backup/duplicati/default.nix
index edea1e4b8634e..3667b4afda47a 100644
--- a/pkgs/tools/backup/duplicati/default.nix
+++ b/pkgs/tools/backup/duplicati/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "duplicati";
-  version = "2.0.6.3";
+  version = "2.0.7.1";
   channel = "beta";
-  build_date = "2021-06-17";
+  build_date = "2023-05-25";
 
   src = fetchzip {
     url = "https://github.com/duplicati/duplicati/releases/download/v${version}-${version}_${channel}_${build_date}/duplicati-${version}_${channel}_${build_date}.zip";
-    sha256 = "sha256-usMwlmer6rLgP46wGVkaAIocUW4MjuEpVWdX7rRcghg=";
+    hash = "sha256-isPmRC6N+gEZgvJ0bgeFf5kOQJsicZOsGnT+CAGgg+U=";
     stripRoot = false;
   };
 
diff --git a/pkgs/tools/misc/panoply/default.nix b/pkgs/tools/misc/panoply/default.nix
index 44c2df30a330a..db72f76e1a057 100644
--- a/pkgs/tools/misc/panoply/default.nix
+++ b/pkgs/tools/misc/panoply/default.nix
@@ -2,11 +2,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "panoply";
-  version = "5.2.8";
+  version = "5.2.9";
 
   src = fetchurl {
     url = "https://www.giss.nasa.gov/tools/panoply/download/PanoplyJ-${version}.tgz";
-    sha256 = "sha256-KqlXG49hUHoQPvkDxJ2kJzRn+imMONQT04TP5r6AV6I=";
+    sha256 = "sha256-InnHiaPvSCCtRmWStyrYQMhNQnoG+lhSBe7ECrPFKFc=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/networking/netbird/default.nix b/pkgs/tools/networking/netbird/default.nix
index 25c2f9a3aeb5e..67e7f453eb5c0 100644
--- a/pkgs/tools/networking/netbird/default.nix
+++ b/pkgs/tools/networking/netbird/default.nix
@@ -30,16 +30,16 @@ let
 in
 buildGoModule rec {
   pname = "netbird";
-  version = "0.22.3";
+  version = "0.22.4";
 
   src = fetchFromGitHub {
     owner = "netbirdio";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-1LUHS3G46EnDz0FgAXXOqluGD+fTRaALypZKNgXtCf0=";
+    sha256 = "sha256-t5uD/1SryxlCA1IPYPTL2nTov+cDzGdprs+J06vpLKI=";
   };
 
-  vendorHash = "sha256-Fj80sYoNXt/rHUC8IEevbNbSIvWHPaKd90UQQTkd/7w=";
+  vendorHash = "sha256-CwozOBAPFSsa1XzDOHBgmFSwGiNekWT8t7KGR2KOOX4=";
 
   nativeBuildInputs = [ installShellFiles ] ++ lib.optional ui pkg-config;
 
diff --git a/pkgs/tools/security/dumpasn1/configpath.patch b/pkgs/tools/security/dumpasn1/configpath.patch
new file mode 100644
index 0000000000000..4578faafc350e
--- /dev/null
+++ b/pkgs/tools/security/dumpasn1/configpath.patch
@@ -0,0 +1,28 @@
+From ab8bd63b32b963ddc7346a2dabfd39fba8bfba72 Mon Sep 17 00:00:00 2001
+From: Paul Meyer <49727155+katexochen@users.noreply.github.com>
+Date: Sun, 13 Aug 2023 14:13:21 +0200
+Subject: [PATCH] make config path injectable during build
+
+This way a config path can be added to the list during build by
+defining the makro.
+
+Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
+---
+ dumpasn1.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/dumpasn1.c b/dumpasn1.c
+index e7bf268..94f1582 100644
+--- a/dumpasn1.c
++++ b/dumpasn1.c
+@@ -451,6 +451,10 @@ static const char *configPaths[] = {
+ 	/* General environment-based paths */
+ 	"$DUMPASN1_PATH/",
+ 
++  #ifdef DUMPASN1_CONFIG_PATH
++	DUMPASN1_CONFIG_PATH,
++  #endif /* DUMPASN1_CONFIG_PATH */
++
+ 	NULL
+ 	};
+ #endif /* OS-specific search paths */
diff --git a/pkgs/tools/security/dumpasn1/default.nix b/pkgs/tools/security/dumpasn1/default.nix
new file mode 100644
index 0000000000000..d224531940a75
--- /dev/null
+++ b/pkgs/tools/security/dumpasn1/default.nix
@@ -0,0 +1,34 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "dumpasn1";
+  version = "20230207.0.0";
+
+  src = fetchFromGitHub {
+    owner = "katexochen";
+    repo = "dumpasn1";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-r40czSLdjCYbt73zK7exCoP/kMq6+pyJfz9LKJLLaXM=";
+  };
+
+  CFLAGS = ''-DDUMPASN1_CONFIG_PATH='"$(out)/etc/"' '';
+
+  makeFlags = [ "prefix=$(out)" ];
+
+  patches = [
+    # Allow adding a config file path during build via makro.
+    # Used to add the store path of the included config file through CFLAGS.
+    # This won't be merged upstream.
+    ./configpath.patch
+  ];
+
+  meta = with lib; {
+    description = "Display and debug ASN.1 data";
+    homepage = "https://github.com/katexochen/dumpasn1";
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ katexochen ];
+    platforms = platforms.linux ++ platforms.darwin;
+  };
+})
diff --git a/pkgs/tools/security/pynitrokey/default.nix b/pkgs/tools/security/pynitrokey/default.nix
index b0a40fba9dcb3..337d08da96242 100644
--- a/pkgs/tools/security/pynitrokey/default.nix
+++ b/pkgs/tools/security/pynitrokey/default.nix
@@ -46,6 +46,7 @@ buildPythonApplication rec {
   ];
 
   pythonRelaxDeps = [
+    "click"
     "cryptography"
     "protobuf"
     "python-dateutil"
diff --git a/pkgs/tools/security/trufflehog/default.nix b/pkgs/tools/security/trufflehog/default.nix
index c9f55216dbdbf..4772c9148f92e 100644
--- a/pkgs/tools/security/trufflehog/default.nix
+++ b/pkgs/tools/security/trufflehog/default.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "trufflehog";
-  version = "3.47.0";
+  version = "3.48.0";
 
   src = fetchFromGitHub {
     owner = "trufflesecurity";
     repo = "trufflehog";
     rev = "refs/tags/v${version}";
-    hash = "sha256-qdVWq+YESSHAmylyOWLygchy1VBxHDOmgk9CxSl22es=";
+    hash = "sha256-mt4ht9bRV6yh5aunX/zelqttNGvPvhIrX0rN7nEpS2g=";
   };
 
   vendorHash = "sha256-AlyONwUP4Z8S8Qj3hbGFCyhUlYzlN6AIxGzrnQaXBLY=";
diff --git a/pkgs/tools/system/gptman/default.nix b/pkgs/tools/system/gptman/default.nix
index db15f8b02522d..8c4d650105351 100644
--- a/pkgs/tools/system/gptman/default.nix
+++ b/pkgs/tools/system/gptman/default.nix
@@ -1,23 +1,29 @@
-{ lib, stdenv, fetchFromGitHub, rustPlatform, libiconv }:
+{ lib, stdenv, fetchFromGitHub, rustPlatform, libiconv, testers, gptman }:
 
 rustPlatform.buildRustPackage rec {
   pname = "gptman";
-  version = "0.8.3";
+  version = "1.0.1";
 
   src = fetchFromGitHub {
-    owner = "cecton";
+    owner = "rust-disk-partition-management";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-hI3F1E1vdbNDEeJ4FrU0EvR0t64svzUIpI6zaf0CquM=";
+    hash = "sha256-sDRnvF/XPXgWIIIrOmnEuktP8XvZxPahF2n4h8RCX+o=";
   };
 
-  cargoSha256 = "sha256-3PRGPZGymccRo9dtQZgMMEL29x+GiUkTzgc8uAB/ocQ=";
+  cargoHash = "sha256-voslPSh7n31cGTKaayKXomgiXWVTutuc4FxfnZUDejc=";
 
   buildInputs = lib.optional stdenv.isDarwin libiconv;
 
+  buildFeatures = [ "cli" ];
+
+  passthru.tests.version = testers.testVersion {
+    package = gptman;
+  };
+
   meta = with lib; {
-    description = "A CLI tool for Linux to copy a partition from one disk to another and more.";
-    homepage = "https://github.com/cecton/gptman";
+    description = "A GPT manager that allows you to copy partitions from one disk to another and more";
+    homepage = "https://github.com/rust-disk-partition-management/gptman";
     license = with licenses; [ asl20 /* or */ mit ];
     maintainers = with maintainers; [ akshgpt7 ];
   };
diff --git a/pkgs/tools/wayland/wl-mirror/default.nix b/pkgs/tools/wayland/wl-mirror/default.nix
index 8e19bdc1d9e4a..0746dd5ff09b3 100644
--- a/pkgs/tools/wayland/wl-mirror/default.nix
+++ b/pkgs/tools/wayland/wl-mirror/default.nix
@@ -28,16 +28,17 @@ in
 
 stdenv.mkDerivation rec {
   pname = "wl-mirror";
-  version = "0.13.1";
+  version = "0.13.2";
 
   src = fetchFromGitHub {
     owner = "Ferdi265";
     repo = "wl-mirror";
     rev = "v${version}";
-    hash = "sha256-qYJmcsID5qbUs27ZCU2HkWVVnBmxWmyzSgruLPB4jI8=";
+    hash = "sha256-dmdRe4GZ1W2gD7ZF1MudBqfZIm9HyBjISa+xB54BLz4=";
   };
 
   strictDeps = true;
+  depsBuildBuild = [ pkg-config ];
   nativeBuildInputs = [ cmake pkg-config wayland-scanner scdoc makeWrapper ];
   buildInputs = [ libGL wayland wayland-protocols wlr-protocols bash ];
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 5b40158b0e6d3..7e304915b92cc 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -7464,6 +7464,8 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) Security;
   };
 
+  dumpasn1 = callPackage ../tools/security/dumpasn1 { };
+
   dumptorrent = callPackage ../tools/misc/dumptorrent { };
 
   duo-unix = callPackage ../tools/security/duo-unix { };
@@ -20342,6 +20344,8 @@ with pkgs;
 
   zon2nix = callPackage ../tools/nix/zon2nix { };
 
+  ztags = callPackage ../development/tools/misc/ztags { };
+
   ### DEVELOPMENT / LIBRARIES
 
   a52dec = callPackage ../development/libraries/a52dec { };
@@ -32025,6 +32029,8 @@ with pkgs;
 
   svox = callPackage ../applications/audio/svox { };
 
+  g4music = callPackage ../applications/audio/g4music { };
+
   genesys = callPackage ../applications/misc/genesys { };
 
   giada = callPackage ../applications/audio/giada { };
@@ -33034,6 +33040,8 @@ with pkgs;
 
   kubectl-images = callPackage ../applications/networking/cluster/kubectl-images { };
 
+  kubectl-klock = callPackage ../applications/networking/cluster/kubectl-klock { };
+
   kubectl-ktop = callPackage ../applications/networking/cluster/kubectl-ktop { };
 
   kubectl-node-shell = callPackage ../applications/networking/cluster/kubectl-node-shell { };
diff --git a/pkgs/top-level/linux-kernels.nix b/pkgs/top-level/linux-kernels.nix
index c68f0345f112c..bf2114130e746 100644
--- a/pkgs/top-level/linux-kernels.nix
+++ b/pkgs/top-level/linux-kernels.nix
@@ -442,7 +442,6 @@ in {
     rtl8821cu = callPackage ../os-specific/linux/rtl8821cu { };
 
     rtw88 = callPackage ../os-specific/linux/rtw88 { };
-    rtlwifi_new = rtw88;
 
     rtw89 = if lib.versionOlder kernel.version "5.16" then callPackage ../os-specific/linux/rtw89 { } else null;
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index de0c57dc64859..cbc2d73747091 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1211,6 +1211,8 @@ self: super: with self; {
 
   backports-shutil-which = callPackage ../development/python-modules/backports-shutil-which { };
 
+  backports-strenum = callPackage ../development/python-modules/backports-strenum { };
+
   backports-zoneinfo = callPackage ../development/python-modules/backports-zoneinfo { };
 
   bacpypes = callPackage ../development/python-modules/bacpypes { };