diff --git a/nixos/doc/manual/default.nix b/nixos/doc/manual/default.nix
index a89e5e466500..0ddb3fa7fbe9 100644
--- a/nixos/doc/manual/default.nix
+++ b/nixos/doc/manual/default.nix
@@ -176,36 +176,6 @@ let
       lintrng $out/man-pages-combined.xml
     '';
 
-  olinkDB = runCommand "manual-olinkdb"
-    { inherit sources;
-      nativeBuildInputs = [ buildPackages.libxml2.bin buildPackages.libxslt.bin ];
-    }
-    ''
-      xsltproc \
-        ${manualXsltprocOptions} \
-        --stringparam collect.xref.targets only \
-        --stringparam targets.filename "$out/manual.db" \
-        --nonet \
-        ${docbook_xsl_ns}/xml/xsl/docbook/xhtml/chunktoc.xsl \
-        ${manual-combined}/manual-combined.xml
-
-      cat > "$out/olinkdb.xml" <<EOF
-      <?xml version="1.0" encoding="utf-8"?>
-      <!DOCTYPE targetset SYSTEM
-        "file://${docbook_xsl_ns}/xml/xsl/docbook/common/targetdatabase.dtd" [
-        <!ENTITY manualtargets SYSTEM "file://$out/manual.db">
-      ]>
-      <targetset>
-        <targetsetinfo>
-            Allows for cross-referencing olinks between the manpages
-            and manual.
-        </targetsetinfo>
-
-        <document targetdoc="manual">&manualtargets;</document>
-      </targetset>
-      EOF
-    '';
-
 in rec {
   inherit generatedSources;
 
@@ -224,7 +194,6 @@ in rec {
       mkdir -p $dst
       xsltproc \
         ${manualXsltprocOptions} \
-        --stringparam target.database.document "${olinkDB}/olinkdb.xml" \
         --stringparam id.warnings "1" \
         --nonet --output $dst/ \
         ${docbook_xsl_ns}/xml/xsl/docbook/xhtml/chunktoc.xsl \
@@ -261,7 +230,6 @@ in rec {
 
       xsltproc \
         ${manualXsltprocOptions} \
-        --stringparam target.database.document "${olinkDB}/olinkdb.xml" \
         --nonet --xinclude --output $dst/epub/ \
         ${docbook_xsl_ns}/xml/xsl/docbook/epub/docbook.xsl \
         ${manual-combined}/manual-combined.xml
@@ -295,7 +263,6 @@ in rec {
         --param man.output.base.dir "'$out/share/man/'" \
         --param man.endnotes.are.numbered 0 \
         --param man.break.after.slash 1 \
-        --stringparam target.database.document "${olinkDB}/olinkdb.xml" \
         ${docbook_xsl_ns}/xml/xsl/docbook/manpages/docbook.xsl \
         ${manual-combined}/man-pages-combined.xml
     '';
diff --git a/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml
index aa58c2a354d5..0e6add60c354 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml
@@ -739,6 +739,15 @@
           been fixed to allow more than one plugin in the path.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          A new option was added to the virtualisation module that
+          enables specifying explicitly named network interfaces in QEMU
+          VMs. The existing <literal>virtualisation.vlans</literal> is
+          still supported for cases where the name of the network
+          interface is irrelevant.
+        </para>
+      </listitem>
     </itemizedlist>
   </section>
 </section>
diff --git a/nixos/doc/manual/release-notes/rl-2305.section.md b/nixos/doc/manual/release-notes/rl-2305.section.md
index 13ff807b79c0..2329373f54b8 100644
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@@ -185,3 +185,5 @@ In addition to numerous new and upgraded packages, this release has the followin
 - `nixos-version` now accepts `--configuration-revision` to display more information about the current generation revision
 
 - The option `services.nomad.extraSettingsPlugins` has been fixed to allow more than one plugin in the path.
+
+- A new option was added to the virtualisation module that enables specifying explicitly named network interfaces in QEMU VMs. The existing `virtualisation.vlans` is still supported for cases where the name of the network interface is irrelevant.
diff --git a/nixos/lib/make-options-doc/default.nix b/nixos/lib/make-options-doc/default.nix
index 335217703c82..01db7bcbee9b 100644
--- a/nixos/lib/make-options-doc/default.nix
+++ b/nixos/lib/make-options-doc/default.nix
@@ -109,29 +109,7 @@ in rec {
     { meta.description = "List of NixOS options in JSON format";
       nativeBuildInputs = [
         pkgs.brotli
-        (let
-          # python3Minimal can't be overridden with packages on Darwin, due to a missing framework.
-          # Instead of modifying stdenv, we take the easy way out, since most people on Darwin will
-          # just be hacking on the Nixpkgs manual (which also uses make-options-doc).
-          python = if pkgs.stdenv.isDarwin then pkgs.python3 else pkgs.python3Minimal;
-          self = (python.override {
-            inherit self;
-            includeSiteCustomize = true;
-           });
-         in self.withPackages (p:
-           let
-            # TODO add our own small test suite when rendering is split out into a new tool
-            markdown-it-py = p.markdown-it-py.override {
-              disableTests = true;
-            };
-            mdit-py-plugins = p.mdit-py-plugins.override {
-              inherit markdown-it-py;
-              disableTests = true;
-            };
-          in [
-            markdown-it-py
-            mdit-py-plugins
-          ]))
+        pkgs.python3Minimal
       ];
       options = builtins.toFile "options.json"
         (builtins.unsafeDiscardStringContext (builtins.toJSON optionsNix));
@@ -141,8 +119,6 @@ in rec {
         if baseOptionsJSON == null
         then builtins.toFile "base.json" "{}"
         else baseOptionsJSON;
-
-      MANPAGE_URLS = pkgs.path + "/doc/manpage-urls.json";
     }
     ''
       # Export list of options in different format.
@@ -153,7 +129,6 @@ in rec {
       python ${./mergeJSON.py} \
         ${lib.optionalString warningsAreErrors "--warnings-are-errors"} \
         ${if allowDocBook then "--warn-on-docbook" else "--error-on-docbook"} \
-        ${lib.optionalString markdownByDefault "--markdown-by-default"} \
         $baseJSON $options \
         > $dst/options.json
 
@@ -172,21 +147,45 @@ in rec {
     fi >"$out"
   '';
 
-  # Convert options.json into an XML file.
-  # The actual generation of the xml file is done in nix purely for the convenience
-  # of not having to generate the xml some other way
-  optionsXML = pkgs.runCommand "options.xml" {} ''
-    export NIX_STORE_DIR=$TMPDIR/store
-    export NIX_STATE_DIR=$TMPDIR/state
-    ${pkgs.nix}/bin/nix-instantiate \
-      --eval --xml --strict ${./optionsJSONtoXML.nix} \
-      --argstr file ${optionsJSON}/share/doc/nixos/options.json \
-      > "$out"
-  '';
+  optionsDocBook = pkgs.runCommand "options-docbook.xml" {
+    MANPAGE_URLS = pkgs.path + "/doc/manpage-urls.json";
+    OTD_DOCUMENT_TYPE = documentType;
+    OTD_VARIABLE_LIST_ID = variablelistId;
+    OTD_OPTION_ID_PREFIX = optionIdPrefix;
+    OTD_REVISION = revision;
 
-  optionsDocBook = pkgs.runCommand "options-docbook.xml" {} ''
-    optionsXML=${optionsXML}
-    if grep /nixpkgs/nixos/modules $optionsXML; then
+    nativeBuildInputs = [
+      (let
+        # python3Minimal can't be overridden with packages on Darwin, due to a missing framework.
+        # Instead of modifying stdenv, we take the easy way out, since most people on Darwin will
+        # just be hacking on the Nixpkgs manual (which also uses make-options-doc).
+        python = if pkgs.stdenv.isDarwin then pkgs.python3 else pkgs.python3Minimal;
+        self = (python.override {
+          inherit self;
+          includeSiteCustomize = true;
+        });
+      in self.withPackages (p:
+        let
+          # TODO add our own small test suite when rendering is split out into a new tool
+          markdown-it-py = p.markdown-it-py.override {
+            disableTests = true;
+          };
+          mdit-py-plugins = p.mdit-py-plugins.override {
+            inherit markdown-it-py;
+            disableTests = true;
+          };
+        in [
+          markdown-it-py
+          mdit-py-plugins
+        ]))
+    ];
+  } ''
+    python ${./optionsToDocbook.py} \
+      ${lib.optionalString markdownByDefault "--markdown-by-default"} \
+      ${optionsJSON}/share/doc/nixos/options.json \
+      > options.xml
+
+    if grep /nixpkgs/nixos/modules options.xml; then
       echo "The manual appears to depend on the location of Nixpkgs, which is bad"
       echo "since this prevents sharing via the NixOS channel.  This is typically"
       echo "caused by an option default that refers to a relative path (see above"
@@ -194,14 +193,7 @@ in rec {
       exit 1
     fi
 
-    ${pkgs.python3Minimal}/bin/python ${./sortXML.py} $optionsXML sorted.xml
     ${pkgs.libxslt.bin}/bin/xsltproc \
-      --stringparam documentType '${documentType}' \
-      --stringparam revision '${revision}' \
-      --stringparam variablelistId '${variablelistId}' \
-      --stringparam optionIdPrefix '${optionIdPrefix}' \
-      -o intermediate.xml ${./options-to-docbook.xsl} sorted.xml
-    ${pkgs.libxslt.bin}/bin/xsltproc \
-      -o "$out" ${./postprocess-option-descriptions.xsl} intermediate.xml
+      -o "$out" ${./postprocess-option-descriptions.xsl} options.xml
   '';
 }
diff --git a/nixos/lib/make-options-doc/mergeJSON.py b/nixos/lib/make-options-doc/mergeJSON.py
index 2de0bbae1d91..b4f72b8a3fdc 100644
--- a/nixos/lib/make-options-doc/mergeJSON.py
+++ b/nixos/lib/make-options-doc/mergeJSON.py
@@ -3,19 +3,6 @@ import json
 import os
 import sys
 from typing import Any, Dict, List
-from collections.abc import MutableMapping, Sequence
-import inspect
-
-# for MD conversion
-import markdown_it
-import markdown_it.renderer
-from markdown_it.token import Token
-from markdown_it.utils import OptionsDict
-from mdit_py_plugins.container import container_plugin
-from mdit_py_plugins.deflist import deflist_plugin
-from mdit_py_plugins.myst_role import myst_role_plugin
-import re
-from xml.sax.saxutils import escape, quoteattr
 
 JSON = Dict[str, Any]
 
@@ -55,236 +42,9 @@ def unpivot(options: Dict[Key, Option]) -> Dict[str, JSON]:
         result[opt.name] = opt.value
     return result
 
-manpage_urls = json.load(open(os.getenv('MANPAGE_URLS')))
-
-class Renderer(markdown_it.renderer.RendererProtocol):
-    __output__ = "docbook"
-    def __init__(self, parser=None):
-        self.rules = {
-            k: v
-            for k, v in inspect.getmembers(self, predicate=inspect.ismethod)
-            if not (k.startswith("render") or k.startswith("_"))
-        } | {
-            "container_{.note}_open": self._note_open,
-            "container_{.note}_close": self._note_close,
-            "container_{.important}_open": self._important_open,
-            "container_{.important}_close": self._important_close,
-            "container_{.warning}_open": self._warning_open,
-            "container_{.warning}_close": self._warning_close,
-        }
-    def render(self, tokens: Sequence[Token], options: OptionsDict, env: MutableMapping) -> str:
-        assert '-link-tag-stack' not in env
-        env['-link-tag-stack'] = []
-        assert '-deflist-stack' not in env
-        env['-deflist-stack'] = []
-        def do_one(i, token):
-            if token.type == "inline":
-                assert token.children is not None
-                return self.renderInline(token.children, options, env)
-            elif token.type in self.rules:
-                return self.rules[token.type](tokens[i], tokens, i, options, env)
-            else:
-                raise NotImplementedError("md token not supported yet", token)
-        return "".join(map(lambda arg: do_one(*arg), enumerate(tokens)))
-    def renderInline(self, tokens: Sequence[Token], options: OptionsDict, env: MutableMapping) -> str:
-        # HACK to support docbook links and xrefs. link handling is only necessary because the docbook
-        # manpage stylesheet converts - in urls to a mathematical minus, which may be somewhat incorrect.
-        for i, token in enumerate(tokens):
-            if token.type != 'link_open':
-                continue
-            token.tag = 'link'
-            # turn [](#foo) into xrefs
-            if token.attrs['href'][0:1] == '#' and tokens[i + 1].type == 'link_close':
-                token.tag = "xref"
-            # turn <x> into links without contents
-            if tokens[i + 1].type == 'text' and tokens[i + 1].content == token.attrs['href']:
-                tokens[i + 1].content = ''
-
-        def do_one(i, token):
-            if token.type in self.rules:
-                return self.rules[token.type](tokens[i], tokens, i, options, env)
-            else:
-                raise NotImplementedError("md node not supported yet", token)
-        return "".join(map(lambda arg: do_one(*arg), enumerate(tokens)))
-
-    def text(self, token, tokens, i, options, env):
-        return escape(token.content)
-    def paragraph_open(self, token, tokens, i, options, env):
-        return "<para>"
-    def paragraph_close(self, token, tokens, i, options, env):
-        return "</para>"
-    def hardbreak(self, token, tokens, i, options, env):
-        return "<literallayout>\n</literallayout>"
-    def softbreak(self, token, tokens, i, options, env):
-        # should check options.breaks() and emit hard break if so
-        return "\n"
-    def code_inline(self, token, tokens, i, options, env):
-        return f"<literal>{escape(token.content)}</literal>"
-    def code_block(self, token, tokens, i, options, env):
-        return f"<programlisting>{escape(token.content)}</programlisting>"
-    def link_open(self, token, tokens, i, options, env):
-        env['-link-tag-stack'].append(token.tag)
-        (attr, start) = ('linkend', 1) if token.attrs['href'][0] == '#' else ('xlink:href', 0)
-        return f"<{token.tag} {attr}={quoteattr(token.attrs['href'][start:])}>"
-    def link_close(self, token, tokens, i, options, env):
-        return f"</{env['-link-tag-stack'].pop()}>"
-    def list_item_open(self, token, tokens, i, options, env):
-        return "<listitem>"
-    def list_item_close(self, token, tokens, i, options, env):
-        return "</listitem>\n"
-    # HACK open and close para for docbook change size. remove soon.
-    def bullet_list_open(self, token, tokens, i, options, env):
-        return "<para><itemizedlist>\n"
-    def bullet_list_close(self, token, tokens, i, options, env):
-        return "\n</itemizedlist></para>"
-    def em_open(self, token, tokens, i, options, env):
-        return "<emphasis>"
-    def em_close(self, token, tokens, i, options, env):
-        return "</emphasis>"
-    def strong_open(self, token, tokens, i, options, env):
-        return "<emphasis role=\"strong\">"
-    def strong_close(self, token, tokens, i, options, env):
-        return "</emphasis>"
-    def fence(self, token, tokens, i, options, env):
-        info = f" language={quoteattr(token.info)}" if token.info != "" else ""
-        return f"<programlisting{info}>{escape(token.content)}</programlisting>"
-    def blockquote_open(self, token, tokens, i, options, env):
-        return "<para><blockquote>"
-    def blockquote_close(self, token, tokens, i, options, env):
-        return "</blockquote></para>"
-    def _note_open(self, token, tokens, i, options, env):
-        return "<para><note>"
-    def _note_close(self, token, tokens, i, options, env):
-        return "</note></para>"
-    def _important_open(self, token, tokens, i, options, env):
-        return "<para><important>"
-    def _important_close(self, token, tokens, i, options, env):
-        return "</important></para>"
-    def _warning_open(self, token, tokens, i, options, env):
-        return "<para><warning>"
-    def _warning_close(self, token, tokens, i, options, env):
-        return "</warning></para>"
-    # markdown-it emits tokens based on the html syntax tree, but docbook is
-    # slightly different. html has <dl>{<dt/>{<dd/>}}</dl>,
-    # docbook has <variablelist>{<varlistentry><term/><listitem/></varlistentry>}<variablelist>
-    # we have to reject multiple definitions for the same term for time being.
-    def dl_open(self, token, tokens, i, options, env):
-        env['-deflist-stack'].append({})
-        return "<para><variablelist>"
-    def dl_close(self, token, tokens, i, options, env):
-        env['-deflist-stack'].pop()
-        return "</variablelist></para>"
-    def dt_open(self, token, tokens, i, options, env):
-        env['-deflist-stack'][-1]['has-dd'] = False
-        return "<varlistentry><term>"
-    def dt_close(self, token, tokens, i, options, env):
-        return "</term>"
-    def dd_open(self, token, tokens, i, options, env):
-        if env['-deflist-stack'][-1]['has-dd']:
-            raise Exception("multiple definitions per term not supported")
-        env['-deflist-stack'][-1]['has-dd'] = True
-        return "<listitem>"
-    def dd_close(self, token, tokens, i, options, env):
-        return "</listitem></varlistentry>"
-    def myst_role(self, token, tokens, i, options, env):
-        if token.meta['name'] == 'command':
-            return f"<command>{escape(token.content)}</command>"
-        if token.meta['name'] == 'file':
-            return f"<filename>{escape(token.content)}</filename>"
-        if token.meta['name'] == 'var':
-            return f"<varname>{escape(token.content)}</varname>"
-        if token.meta['name'] == 'env':
-            return f"<envar>{escape(token.content)}</envar>"
-        if token.meta['name'] == 'option':
-            return f"<option>{escape(token.content)}</option>"
-        if token.meta['name'] == 'manpage':
-            [page, section] = [ s.strip() for s in token.content.rsplit('(', 1) ]
-            section = section[:-1]
-            man = f"{page}({section})"
-            title = f"<refentrytitle>{escape(page)}</refentrytitle>"
-            vol = f"<manvolnum>{escape(section)}</manvolnum>"
-            ref = f"<citerefentry>{title}{vol}</citerefentry>"
-            if man in manpage_urls:
-                return f"<link xlink:href={quoteattr(manpage_urls[man])}>{ref}</link>"
-            else:
-                return ref
-        raise NotImplementedError("md node not supported yet", token)
-
-md = (
-    markdown_it.MarkdownIt(renderer_cls=Renderer)
-    # TODO maybe fork the plugin and have only a single rule for all?
-    .use(container_plugin, name="{.note}")
-    .use(container_plugin, name="{.important}")
-    .use(container_plugin, name="{.warning}")
-    .use(deflist_plugin)
-    .use(myst_role_plugin)
-)
-
-# converts in-place!
-def convertMD(options: Dict[str, Any]) -> str:
-    def convertString(path: str, text: str) -> str:
-        try:
-            rendered = md.render(text)
-            return rendered
-        except:
-            print(f"error in {path}")
-            raise
-
-    def optionIs(option: Dict[str, Any], key: str, typ: str) -> bool:
-        if key not in option: return False
-        if type(option[key]) != dict: return False
-        if '_type' not in option[key]: return False
-        return option[key]['_type'] == typ
-
-    def convertCode(name: str, option: Dict[str, Any], key: str):
-        rendered = f"{key}-db"
-        if optionIs(option, key, 'literalMD'):
-            option[rendered] = convertString(name, f"*{key.capitalize()}:*\n{option[key]['text']}")
-        elif optionIs(option, key, 'literalExpression'):
-            code = option[key]['text']
-            # for multi-line code blocks we only have to count ` runs at the beginning
-            # of a line, but this is much easier.
-            multiline = '\n' in code
-            longest, current = (0, 0)
-            for c in code:
-                current = current + 1 if c == '`' else 0
-                longest = max(current, longest)
-            # inline literals need a space to separate ticks from content, code blocks
-            # need newlines. inline literals need one extra tick, code blocks need three.
-            ticks, sep = ('`' * (longest + (3 if multiline else 1)), '\n' if multiline else ' ')
-            code = f"{ticks}{sep}{code}{sep}{ticks}"
-            option[rendered] = convertString(name, f"*{key.capitalize()}:*\n{code}")
-        elif optionIs(option, key, 'literalDocBook'):
-            option[rendered] = f"<para><emphasis>{key.capitalize()}:</emphasis> {option[key]['text']}</para>"
-        elif key in option:
-            raise Exception(f"{name} {key} has unrecognized type", option[key])
-
-    for (name, option) in options.items():
-        try:
-            if optionIs(option, 'description', 'mdDoc'):
-                option['description'] = convertString(name, option['description']['text'])
-            elif markdownByDefault:
-                option['description'] = convertString(name, option['description'])
-            else:
-                option['description'] = ("<nixos:option-description><para>" +
-                                         option['description'] +
-                                         "</para></nixos:option-description>")
-
-            convertCode(name, option, 'example')
-            convertCode(name, option, 'default')
-
-            if 'relatedPackages' in option:
-                option['relatedPackages'] = convertString(name, option['relatedPackages'])
-        except Exception as e:
-            raise Exception(f"Failed to render option {name}: {str(e)}")
-
-
-    return options
-
 warningsAreErrors = False
 warnOnDocbook = False
 errorOnDocbook = False
-markdownByDefault = False
 optOffset = 0
 for arg in sys.argv[1:]:
     if arg == "--warnings-are-errors":
@@ -296,9 +56,6 @@ for arg in sys.argv[1:]:
     elif arg == "--error-on-docbook":
         optOffset += 1
         errorOnDocbook = True
-    if arg == "--markdown-by-default":
-        optOffset += 1
-        markdownByDefault = True
 
 options = pivot(json.load(open(sys.argv[1 + optOffset], 'r')))
 overrides = pivot(json.load(open(sys.argv[2 + optOffset], 'r')))
@@ -404,4 +161,4 @@ if hasWarnings and warningsAreErrors:
         file=sys.stderr)
     sys.exit(1)
 
-json.dump(convertMD(unpivot(options)), fp=sys.stdout)
+json.dump(unpivot(options), fp=sys.stdout)
diff --git a/nixos/lib/make-options-doc/options-to-docbook.xsl b/nixos/lib/make-options-doc/options-to-docbook.xsl
deleted file mode 100644
index a2e88febdaff..000000000000
--- a/nixos/lib/make-options-doc/options-to-docbook.xsl
+++ /dev/null
@@ -1,179 +0,0 @@
-<?xml version="1.0"?>
-
-<xsl:stylesheet version="1.0"
-                xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
-                xmlns:str="http://exslt.org/strings"
-                xmlns:xlink="http://www.w3.org/1999/xlink"
-                xmlns:nixos="tag:nixos.org"
-                xmlns="http://docbook.org/ns/docbook"
-                extension-element-prefixes="str"
-                >
-
-  <xsl:output method='xml' encoding="UTF-8" />
-
-  <xsl:param name="revision" />
-  <xsl:param name="documentType" />
-  <xsl:param name="program" />
-  <xsl:param name="variablelistId" />
-  <xsl:param name="optionIdPrefix" />
-
-
-  <xsl:template match="/expr/list">
-    <xsl:choose>
-      <xsl:when test="$documentType = 'appendix'">
-        <appendix xml:id="appendix-configuration-options">
-          <title>Configuration Options</title>
-          <xsl:call-template name="variable-list"/>
-        </appendix>
-      </xsl:when>
-      <xsl:otherwise>
-        <xsl:call-template name="variable-list"/>
-      </xsl:otherwise>
-    </xsl:choose>
-  </xsl:template>
-
-  <xsl:template name="variable-list">
-      <variablelist>
-      <xsl:attribute name="id" namespace="http://www.w3.org/XML/1998/namespace"><xsl:value-of select="$variablelistId"/></xsl:attribute>
-        <xsl:for-each select="attrs">
-          <xsl:variable name="id" select="
-            concat($optionIdPrefix,
-              translate(
-                attr[@name = 'name']/string/@value,
-                '*&lt; >[]:&quot;',
-                '________'
-            ))" />
-          <varlistentry>
-            <term xlink:href="#{$id}">
-              <xsl:attribute name="xml:id"><xsl:value-of select="$id"/></xsl:attribute>
-              <option>
-                <xsl:value-of select="attr[@name = 'name']/string/@value" />
-              </option>
-            </term>
-
-            <listitem>
-
-              <xsl:value-of disable-output-escaping="yes"
-                            select="attr[@name = 'description']/string/@value" />
-
-              <xsl:if test="attr[@name = 'type']">
-                <para>
-                  <emphasis>Type:</emphasis>
-                  <xsl:text> </xsl:text>
-                  <xsl:value-of select="attr[@name = 'type']/string/@value"/>
-                  <xsl:if test="attr[@name = 'readOnly']/bool/@value = 'true'">
-                    <xsl:text> </xsl:text>
-                    <emphasis>(read only)</emphasis>
-                  </xsl:if>
-                </para>
-              </xsl:if>
-
-              <xsl:if test="attr[@name = 'default-db']">
-                <xsl:value-of disable-output-escaping="yes"
-                              select="attr[@name = 'default-db']/string/@value" />
-              </xsl:if>
-
-              <xsl:if test="attr[@name = 'example-db']">
-                <xsl:value-of disable-output-escaping="yes"
-                              select="attr[@name = 'example-db']/string/@value" />
-              </xsl:if>
-
-              <xsl:if test="attr[@name = 'relatedPackages']">
-                <para>
-                  <emphasis>Related packages:</emphasis>
-                </para>
-                <xsl:value-of disable-output-escaping="yes"
-                              select="attr[@name = 'relatedPackages']/string/@value" />
-              </xsl:if>
-
-              <xsl:if test="count(attr[@name = 'declarations']/list/*) != 0">
-                <para>
-                  <emphasis>Declared by:</emphasis>
-                </para>
-                <xsl:apply-templates select="attr[@name = 'declarations']" />
-              </xsl:if>
-
-              <xsl:if test="count(attr[@name = 'definitions']/list/*) != 0">
-                <para>
-                  <emphasis>Defined by:</emphasis>
-                </para>
-                <xsl:apply-templates select="attr[@name = 'definitions']" />
-              </xsl:if>
-
-            </listitem>
-
-          </varlistentry>
-
-        </xsl:for-each>
-
-      </variablelist>
-  </xsl:template>
-
-
-  <xsl:template match="attrs[attr[@name = '_type' and string[@value = 'literalDocBook']]]" mode = "top">
-    <xsl:value-of disable-output-escaping="yes" select="attr[@name = 'text']/string/@value" />
-  </xsl:template>
-
-
-  <xsl:template match="attr[@name = 'declarations' or @name = 'definitions']">
-    <simplelist>
-      <!--
-        Example:
-          opt.declarations = [ { name = "foo/bar.nix"; url = "https://github.com/....."; } ];
-      -->
-      <xsl:for-each select="list/attrs[attr[@name = 'name']]">
-        <member><filename>
-          <xsl:if test="attr[@name = 'url']">
-            <xsl:attribute name="xlink:href"><xsl:value-of select="attr[@name = 'url']/string/@value"/></xsl:attribute>
-          </xsl:if>
-          <xsl:value-of select="attr[@name = 'name']/string/@value"/>
-        </filename></member>
-      </xsl:for-each>
-
-      <!--
-        When the declarations/definitions are raw strings,
-        fall back to hardcoded location logic, specific to Nixpkgs.
-      -->
-      <xsl:for-each select="list/string">
-        <member><filename>
-          <!-- Hyperlink the filename either to the NixOS Subversion
-          repository (if it’s a module and we have a revision number),
-          or to the local filesystem. -->
-          <xsl:choose>
-            <xsl:when test="not(starts-with(@value, '/'))">
-              <xsl:choose>
-                <xsl:when test="$revision = 'local'">
-                  <xsl:attribute name="xlink:href">https://github.com/NixOS/nixpkgs/blob/master/<xsl:value-of select="@value"/></xsl:attribute>
-                </xsl:when>
-                <xsl:otherwise>
-                  <xsl:attribute name="xlink:href">https://github.com/NixOS/nixpkgs/blob/<xsl:value-of select="$revision"/>/<xsl:value-of select="@value"/></xsl:attribute>
-                </xsl:otherwise>
-              </xsl:choose>
-            </xsl:when>
-            <xsl:when test="$revision != 'local' and $program = 'nixops' and contains(@value, '/nix/')">
-              <xsl:attribute name="xlink:href">https://github.com/NixOS/nixops/blob/<xsl:value-of select="$revision"/>/nix/<xsl:value-of select="substring-after(@value, '/nix/')"/></xsl:attribute>
-            </xsl:when>
-            <xsl:otherwise>
-              <xsl:attribute name="xlink:href">file://<xsl:value-of select="@value"/></xsl:attribute>
-            </xsl:otherwise>
-          </xsl:choose>
-          <!-- Print the filename and make it user-friendly by replacing the
-          /nix/store/<hash> prefix by the default location of nixos
-          sources. -->
-          <xsl:choose>
-            <xsl:when test="not(starts-with(@value, '/'))">
-              &lt;nixpkgs/<xsl:value-of select="@value"/>&gt;
-            </xsl:when>
-            <xsl:when test="contains(@value, 'nixops') and contains(@value, '/nix/')">
-              &lt;nixops/<xsl:value-of select="substring-after(@value, '/nix/')"/>&gt;
-            </xsl:when>
-            <xsl:otherwise>
-              <xsl:value-of select="@value" />
-            </xsl:otherwise>
-          </xsl:choose>
-        </filename></member>
-      </xsl:for-each>
-    </simplelist>
-  </xsl:template>
-
-</xsl:stylesheet>
diff --git a/nixos/lib/make-options-doc/optionsJSONtoXML.nix b/nixos/lib/make-options-doc/optionsJSONtoXML.nix
deleted file mode 100644
index ba50c5f898b5..000000000000
--- a/nixos/lib/make-options-doc/optionsJSONtoXML.nix
+++ /dev/null
@@ -1,6 +0,0 @@
-{ file }:
-
-builtins.attrValues
-  (builtins.mapAttrs
-    (name: def: def // { inherit name; })
-    (builtins.fromJSON (builtins.readFile file)))
diff --git a/nixos/lib/make-options-doc/optionsToDocbook.py b/nixos/lib/make-options-doc/optionsToDocbook.py
new file mode 100644
index 000000000000..021623d10a7a
--- /dev/null
+++ b/nixos/lib/make-options-doc/optionsToDocbook.py
@@ -0,0 +1,343 @@
+import collections
+import json
+import os
+import sys
+from typing import Any, Dict, List
+from collections.abc import MutableMapping, Sequence
+import inspect
+
+# for MD conversion
+import markdown_it
+import markdown_it.renderer
+from markdown_it.token import Token
+from markdown_it.utils import OptionsDict
+from mdit_py_plugins.container import container_plugin
+from mdit_py_plugins.deflist import deflist_plugin
+from mdit_py_plugins.myst_role import myst_role_plugin
+from xml.sax.saxutils import escape, quoteattr
+
+manpage_urls = json.load(open(os.getenv('MANPAGE_URLS')))
+
+class Renderer(markdown_it.renderer.RendererProtocol):
+    __output__ = "docbook"
+    def __init__(self, parser=None):
+        self.rules = {
+            k: v
+            for k, v in inspect.getmembers(self, predicate=inspect.ismethod)
+            if not (k.startswith("render") or k.startswith("_"))
+        } | {
+            "container_{.note}_open": self._note_open,
+            "container_{.note}_close": self._note_close,
+            "container_{.important}_open": self._important_open,
+            "container_{.important}_close": self._important_close,
+            "container_{.warning}_open": self._warning_open,
+            "container_{.warning}_close": self._warning_close,
+        }
+    def render(self, tokens: Sequence[Token], options: OptionsDict, env: MutableMapping) -> str:
+        assert '-link-tag-stack' not in env
+        env['-link-tag-stack'] = []
+        assert '-deflist-stack' not in env
+        env['-deflist-stack'] = []
+        def do_one(i, token):
+            if token.type == "inline":
+                assert token.children is not None
+                return self.renderInline(token.children, options, env)
+            elif token.type in self.rules:
+                return self.rules[token.type](tokens[i], tokens, i, options, env)
+            else:
+                raise NotImplementedError("md token not supported yet", token)
+        return "".join(map(lambda arg: do_one(*arg), enumerate(tokens)))
+    def renderInline(self, tokens: Sequence[Token], options: OptionsDict, env: MutableMapping) -> str:
+        # HACK to support docbook links and xrefs. link handling is only necessary because the docbook
+        # manpage stylesheet converts - in urls to a mathematical minus, which may be somewhat incorrect.
+        for i, token in enumerate(tokens):
+            if token.type != 'link_open':
+                continue
+            token.tag = 'link'
+            # turn [](#foo) into xrefs
+            if token.attrs['href'][0:1] == '#' and tokens[i + 1].type == 'link_close':
+                token.tag = "xref"
+            # turn <x> into links without contents
+            if tokens[i + 1].type == 'text' and tokens[i + 1].content == token.attrs['href']:
+                tokens[i + 1].content = ''
+
+        def do_one(i, token):
+            if token.type in self.rules:
+                return self.rules[token.type](tokens[i], tokens, i, options, env)
+            else:
+                raise NotImplementedError("md node not supported yet", token)
+        return "".join(map(lambda arg: do_one(*arg), enumerate(tokens)))
+
+    def text(self, token, tokens, i, options, env):
+        return escape(token.content)
+    def paragraph_open(self, token, tokens, i, options, env):
+        return "<para>"
+    def paragraph_close(self, token, tokens, i, options, env):
+        return "</para>"
+    def hardbreak(self, token, tokens, i, options, env):
+        return "<literallayout>\n</literallayout>"
+    def softbreak(self, token, tokens, i, options, env):
+        # should check options.breaks() and emit hard break if so
+        return "\n"
+    def code_inline(self, token, tokens, i, options, env):
+        return f"<literal>{escape(token.content)}</literal>"
+    def code_block(self, token, tokens, i, options, env):
+        return f"<programlisting>{escape(token.content)}</programlisting>"
+    def link_open(self, token, tokens, i, options, env):
+        env['-link-tag-stack'].append(token.tag)
+        (attr, start) = ('linkend', 1) if token.attrs['href'][0] == '#' else ('xlink:href', 0)
+        return f"<{token.tag} {attr}={quoteattr(token.attrs['href'][start:])}>"
+    def link_close(self, token, tokens, i, options, env):
+        return f"</{env['-link-tag-stack'].pop()}>"
+    def list_item_open(self, token, tokens, i, options, env):
+        return "<listitem>"
+    def list_item_close(self, token, tokens, i, options, env):
+        return "</listitem>\n"
+    # HACK open and close para for docbook change size. remove soon.
+    def bullet_list_open(self, token, tokens, i, options, env):
+        return "<para><itemizedlist>\n"
+    def bullet_list_close(self, token, tokens, i, options, env):
+        return "\n</itemizedlist></para>"
+    def em_open(self, token, tokens, i, options, env):
+        return "<emphasis>"
+    def em_close(self, token, tokens, i, options, env):
+        return "</emphasis>"
+    def strong_open(self, token, tokens, i, options, env):
+        return "<emphasis role=\"strong\">"
+    def strong_close(self, token, tokens, i, options, env):
+        return "</emphasis>"
+    def fence(self, token, tokens, i, options, env):
+        info = f" language={quoteattr(token.info)}" if token.info != "" else ""
+        return f"<programlisting{info}>{escape(token.content)}</programlisting>"
+    def blockquote_open(self, token, tokens, i, options, env):
+        return "<para><blockquote>"
+    def blockquote_close(self, token, tokens, i, options, env):
+        return "</blockquote></para>"
+    def _note_open(self, token, tokens, i, options, env):
+        return "<para><note>"
+    def _note_close(self, token, tokens, i, options, env):
+        return "</note></para>"
+    def _important_open(self, token, tokens, i, options, env):
+        return "<para><important>"
+    def _important_close(self, token, tokens, i, options, env):
+        return "</important></para>"
+    def _warning_open(self, token, tokens, i, options, env):
+        return "<para><warning>"
+    def _warning_close(self, token, tokens, i, options, env):
+        return "</warning></para>"
+    # markdown-it emits tokens based on the html syntax tree, but docbook is
+    # slightly different. html has <dl>{<dt/>{<dd/>}}</dl>,
+    # docbook has <variablelist>{<varlistentry><term/><listitem/></varlistentry>}<variablelist>
+    # we have to reject multiple definitions for the same term for time being.
+    def dl_open(self, token, tokens, i, options, env):
+        env['-deflist-stack'].append({})
+        return "<para><variablelist>"
+    def dl_close(self, token, tokens, i, options, env):
+        env['-deflist-stack'].pop()
+        return "</variablelist></para>"
+    def dt_open(self, token, tokens, i, options, env):
+        env['-deflist-stack'][-1]['has-dd'] = False
+        return "<varlistentry><term>"
+    def dt_close(self, token, tokens, i, options, env):
+        return "</term>"
+    def dd_open(self, token, tokens, i, options, env):
+        if env['-deflist-stack'][-1]['has-dd']:
+            raise Exception("multiple definitions per term not supported")
+        env['-deflist-stack'][-1]['has-dd'] = True
+        return "<listitem>"
+    def dd_close(self, token, tokens, i, options, env):
+        return "</listitem></varlistentry>"
+    def myst_role(self, token, tokens, i, options, env):
+        if token.meta['name'] == 'command':
+            return f"<command>{escape(token.content)}</command>"
+        if token.meta['name'] == 'file':
+            return f"<filename>{escape(token.content)}</filename>"
+        if token.meta['name'] == 'var':
+            return f"<varname>{escape(token.content)}</varname>"
+        if token.meta['name'] == 'env':
+            return f"<envar>{escape(token.content)}</envar>"
+        if token.meta['name'] == 'option':
+            return f"<option>{escape(token.content)}</option>"
+        if token.meta['name'] == 'manpage':
+            [page, section] = [ s.strip() for s in token.content.rsplit('(', 1) ]
+            section = section[:-1]
+            man = f"{page}({section})"
+            title = f"<refentrytitle>{escape(page)}</refentrytitle>"
+            vol = f"<manvolnum>{escape(section)}</manvolnum>"
+            ref = f"<citerefentry>{title}{vol}</citerefentry>"
+            if man in manpage_urls:
+                return f"<link xlink:href={quoteattr(manpage_urls[man])}>{ref}</link>"
+            else:
+                return ref
+        raise NotImplementedError("md node not supported yet", token)
+
+md = (
+    markdown_it.MarkdownIt(renderer_cls=Renderer)
+    # TODO maybe fork the plugin and have only a single rule for all?
+    .use(container_plugin, name="{.note}")
+    .use(container_plugin, name="{.important}")
+    .use(container_plugin, name="{.warning}")
+    .use(deflist_plugin)
+    .use(myst_role_plugin)
+)
+
+# converts in-place!
+def convertMD(options: Dict[str, Any]) -> str:
+    def optionIs(option: Dict[str, Any], key: str, typ: str) -> bool:
+        if key not in option: return False
+        if type(option[key]) != dict: return False
+        if '_type' not in option[key]: return False
+        return option[key]['_type'] == typ
+
+    def convertCode(name: str, option: Dict[str, Any], key: str):
+        if optionIs(option, key, 'literalMD'):
+            option[key] = md.render(f"*{key.capitalize()}:*\n{option[key]['text']}")
+        elif optionIs(option, key, 'literalExpression'):
+            code = option[key]['text']
+            # for multi-line code blocks we only have to count ` runs at the beginning
+            # of a line, but this is much easier.
+            multiline = '\n' in code
+            longest, current = (0, 0)
+            for c in code:
+                current = current + 1 if c == '`' else 0
+                longest = max(current, longest)
+            # inline literals need a space to separate ticks from content, code blocks
+            # need newlines. inline literals need one extra tick, code blocks need three.
+            ticks, sep = ('`' * (longest + (3 if multiline else 1)), '\n' if multiline else ' ')
+            code = f"{ticks}{sep}{code}{sep}{ticks}"
+            option[key] = md.render(f"*{key.capitalize()}:*\n{code}")
+        elif optionIs(option, key, 'literalDocBook'):
+            option[key] = f"<para><emphasis>{key.capitalize()}:</emphasis> {option[key]['text']}</para>"
+        elif key in option:
+            raise Exception(f"{name} {key} has unrecognized type", option[key])
+
+    for (name, option) in options.items():
+        try:
+            if optionIs(option, 'description', 'mdDoc'):
+                option['description'] = md.render(option['description']['text'])
+            elif markdownByDefault:
+                option['description'] = md.render(option['description'])
+            else:
+                option['description'] = ("<nixos:option-description><para>" +
+                                         option['description'] +
+                                         "</para></nixos:option-description>")
+
+            convertCode(name, option, 'example')
+            convertCode(name, option, 'default')
+
+            if 'relatedPackages' in option:
+                option['relatedPackages'] = md.render(option['relatedPackages'])
+        except Exception as e:
+            raise Exception(f"Failed to render option {name}") from e
+
+    return options
+
+id_translate_table = {
+    ord('*'): ord('_'),
+    ord('<'): ord('_'),
+    ord(' '): ord('_'),
+    ord('>'): ord('_'),
+    ord('['): ord('_'),
+    ord(']'): ord('_'),
+    ord(':'): ord('_'),
+    ord('"'): ord('_'),
+}
+
+def need_env(n):
+    if n not in os.environ:
+        raise RuntimeError("required environment variable not set", n)
+    return os.environ[n]
+
+OTD_REVISION = need_env('OTD_REVISION')
+OTD_DOCUMENT_TYPE = need_env('OTD_DOCUMENT_TYPE')
+OTD_VARIABLE_LIST_ID = need_env('OTD_VARIABLE_LIST_ID')
+OTD_OPTION_ID_PREFIX = need_env('OTD_OPTION_ID_PREFIX')
+
+def print_decl_def(header, locs):
+    print(f"""<para><emphasis>{header}:</emphasis></para>""")
+    print(f"""<simplelist>""")
+    for loc in locs:
+        # locations can be either plain strings (specific to nixpkgs), or attrsets
+        # { name = "foo/bar.nix"; url = "https://github.com/....."; }
+        if isinstance(loc, str):
+            # Hyperlink the filename either to the NixOS github
+            # repository (if it’s a module and we have a revision number),
+            # or to the local filesystem.
+            if not loc.startswith('/'):
+                if OTD_REVISION == 'local':
+                    href = f"https://github.com/NixOS/nixpkgs/blob/master/{loc}"
+                else:
+                    href = f"https://github.com/NixOS/nixpkgs/blob/{OTD_REVISION}/{loc}"
+            else:
+                href = f"file://{loc}"
+            # Print the filename and make it user-friendly by replacing the
+            # /nix/store/<hash> prefix by the default location of nixos
+            # sources.
+            if not loc.startswith('/'):
+                name = f"<nixpkgs/{loc}>"
+            elif loc.contains('nixops') and loc.contains('/nix/'):
+                name = f"<nixops/{loc[loc.find('/nix/') + 5:]}>"
+            else:
+                name = loc
+            print(f"""<member><filename xlink:href={quoteattr(href)}>""")
+            print(escape(name))
+            print(f"""</filename></member>""")
+        else:
+            href = f" xlink:href={quoteattr(loc['url'])}" if 'url' in loc else ""
+            print(f"""<member><filename{href}>{escape(loc['name'])}</filename></member>""")
+    print(f"""</simplelist>""")
+
+markdownByDefault = False
+optOffset = 0
+for arg in sys.argv[1:]:
+    if arg == "--markdown-by-default":
+        optOffset += 1
+        markdownByDefault = True
+
+options = convertMD(json.load(open(sys.argv[1 + optOffset], 'r')))
+
+keys = list(options.keys())
+keys.sort(key=lambda opt: [ (0 if p.startswith("enable") else 1 if p.startswith("package") else 2, p)
+                            for p in options[opt]['loc'] ])
+
+print(f"""<?xml version="1.0" encoding="UTF-8"?>""")
+if OTD_DOCUMENT_TYPE == 'appendix':
+    print("""<appendix xmlns="http://docbook.org/ns/docbook" xml:id="appendix-configuration-options">""")
+    print("""  <title>Configuration Options</title>""")
+print(f"""<variablelist xmlns:xlink="http://www.w3.org/1999/xlink"
+                        xmlns:nixos="tag:nixos.org"
+                        xmlns="http://docbook.org/ns/docbook"
+             xml:id="{OTD_VARIABLE_LIST_ID}">""")
+
+for name in keys:
+    opt = options[name]
+    id = OTD_OPTION_ID_PREFIX + name.translate(id_translate_table)
+    print(f"""<varlistentry>""")
+    # NOTE adding extra spaces here introduces spaces into xref link expansions
+    print(f"""<term xlink:href={quoteattr("#" + id)} xml:id={quoteattr(id)}>""", end='')
+    print(f"""<option>{escape(name)}</option>""", end='')
+    print(f"""</term>""")
+    print(f"""<listitem>""")
+    print(opt['description'])
+    if typ := opt.get('type'):
+        ro = " <emphasis>(read only)</emphasis>" if opt.get('readOnly', False) else ""
+        print(f"""<para><emphasis>Type:</emphasis> {escape(typ)}{ro}</para>""")
+    if default := opt.get('default'):
+        print(default)
+    if example := opt.get('example'):
+        print(example)
+    if related := opt.get('relatedPackages'):
+        print(f"""<para>""")
+        print(f"""  <emphasis>Related packages:</emphasis>""")
+        print(f"""</para>""")
+        print(related)
+    if decl := opt.get('declarations'):
+        print_decl_def("Declared by", decl)
+    if defs := opt.get('definitions'):
+        print_decl_def("Defined by", defs)
+    print(f"""</listitem>""")
+    print(f"""</varlistentry>""")
+
+print("""</variablelist>""")
+if OTD_DOCUMENT_TYPE == 'appendix':
+    print("""</appendix>""")
diff --git a/nixos/lib/make-options-doc/sortXML.py b/nixos/lib/make-options-doc/sortXML.py
deleted file mode 100644
index e63ff3538b3f..000000000000
--- a/nixos/lib/make-options-doc/sortXML.py
+++ /dev/null
@@ -1,27 +0,0 @@
-import xml.etree.ElementTree as ET
-import sys
-
-tree = ET.parse(sys.argv[1])
-# the xml tree is of the form
-# <expr><list> {all options, each an attrs} </list></expr>
-options = list(tree.getroot().find('list'))
-
-def sortKey(opt):
-    def order(s):
-        if s.startswith("enable"):
-            return 0
-        if s.startswith("package"):
-            return 1
-        return 2
-
-    return [
-        (order(p.attrib['value']), p.attrib['value'])
-        for p in opt.findall('attr[@name="loc"]/list/string')
-    ]
-
-options.sort(key=sortKey)
-
-doc = ET.Element("expr")
-newOptions = ET.SubElement(doc, "list")
-newOptions.extend(options)
-ET.ElementTree(doc).write(sys.argv[2], encoding='utf-8')
diff --git a/nixos/lib/testing/driver.nix b/nixos/lib/testing/driver.nix
index fb181c1d7e9a..2c2ee179fede 100644
--- a/nixos/lib/testing/driver.nix
+++ b/nixos/lib/testing/driver.nix
@@ -12,7 +12,9 @@ let
   };
 
 
-  vlans = map (m: m.virtualisation.vlans) (lib.attrValues config.nodes);
+  vlans = map (m: (
+    m.virtualisation.vlans ++
+    (lib.mapAttrsToList (_: v: v.vlan) m.virtualisation.interfaces))) (lib.attrValues config.nodes);
   vms = map (m: m.system.build.vm) (lib.attrValues config.nodes);
 
   nodeHostNames =
diff --git a/nixos/lib/testing/network.nix b/nixos/lib/testing/network.nix
index 04ea9a2bc9f7..98a77f918e07 100644
--- a/nixos/lib/testing/network.nix
+++ b/nixos/lib/testing/network.nix
@@ -18,24 +18,40 @@ let
 
   networkModule = { config, nodes, pkgs, ... }:
     let
-      interfacesNumbered = zipLists config.virtualisation.vlans (range 1 255);
-      interfaces = forEach interfacesNumbered ({ fst, snd }:
-        nameValuePair "eth${toString snd}" {
-          ipv4.addresses =
-            [{
-              address = "192.168.${toString fst}.${toString config.virtualisation.test.nodeNumber}";
+      qemu-common = import ../qemu-common.nix { inherit lib pkgs; };
+
+      # Convert legacy VLANs to named interfaces and merge with explicit interfaces.
+      vlansNumbered = forEach (zipLists config.virtualisation.vlans (range 1 255)) (v: {
+        name = "eth${toString v.snd}";
+        vlan = v.fst;
+        assignIP = true;
+      });
+      explicitInterfaces = lib.mapAttrsToList (n: v: v // { name = n; }) config.virtualisation.interfaces;
+      interfaces = vlansNumbered ++ explicitInterfaces;
+      interfacesNumbered = zipLists interfaces (range 1 255);
+
+      # Automatically assign IP addresses to requested interfaces.
+      assignIPs = lib.filter (i: i.assignIP) interfaces;
+      ipInterfaces = forEach assignIPs (i:
+        nameValuePair i.name { ipv4.addresses =
+          [ { address = "192.168.${toString i.vlan}.${toString config.virtualisation.test.nodeNumber}";
               prefixLength = 24;
             }];
         });
 
+      qemuOptions = lib.flatten (forEach interfacesNumbered ({ fst, snd }:
+        qemu-common.qemuNICFlags snd fst.vlan config.virtualisation.test.nodeNumber));
+      udevRules = forEach interfacesNumbered ({ fst, snd }:
+        "SUBSYSTEM==\"net\",ACTION==\"add\",ATTR{address}==\"${qemu-common.qemuNicMac fst.vlan config.virtualisation.test.nodeNumber}\",NAME=\"${fst.name}\"");
+
       networkConfig =
         {
           networking.hostName = mkDefault config.virtualisation.test.nodeName;
 
-          networking.interfaces = listToAttrs interfaces;
+          networking.interfaces = listToAttrs ipInterfaces;
 
           networking.primaryIPAddress =
-            optionalString (interfaces != [ ]) (head (head interfaces).value.ipv4.addresses).address;
+            optionalString (ipInterfaces != [ ]) (head (head ipInterfaces).value.ipv4.addresses).address;
 
           # Put the IP addresses of all VMs in this machine's
           # /etc/hosts file.  If a machine has multiple
@@ -51,16 +67,13 @@ let
                     "${config.networking.hostName}.${config.networking.domain} " +
                   "${config.networking.hostName}\n"));
 
-          virtualisation.qemu.options =
-            let qemu-common = import ../qemu-common.nix { inherit lib pkgs; };
-            in
-            flip concatMap interfacesNumbered
-              ({ fst, snd }: qemu-common.qemuNICFlags snd fst config.virtualisation.test.nodeNumber);
+          virtualisation.qemu.options = qemuOptions;
+          boot.initrd.services.udev.rules = concatMapStrings (x: x + "\n") udevRules;
         };
 
     in
     {
-      key = "ip-address";
+      key = "network-interfaces";
       config = networkConfig // {
         # Expose the networkConfig items for tests like nixops
         # that need to recreate the network config.
diff --git a/nixos/modules/virtualisation/qemu-vm.nix b/nixos/modules/virtualisation/qemu-vm.nix
index 06210529eb8c..933a9c539e48 100644
--- a/nixos/modules/virtualisation/qemu-vm.nix
+++ b/nixos/modules/virtualisation/qemu-vm.nix
@@ -545,7 +545,8 @@ in
     virtualisation.vlans =
       mkOption {
         type = types.listOf types.ints.unsigned;
-        default = [ 1 ];
+        default = if config.virtualisation.interfaces == {} then [ 1 ] else [ ];
+        defaultText = lib.literalExpression ''if config.virtualisation.interfaces == {} then [ 1 ] else [ ]'';
         example = [ 1 2 ];
         description =
           lib.mdDoc ''
@@ -560,6 +561,35 @@ in
           '';
       };
 
+    virtualisation.interfaces = mkOption {
+      default = {};
+      example = {
+        enp1s0.vlan = 1;
+      };
+      description = lib.mdDoc ''
+        Network interfaces to add to the VM.
+      '';
+      type = with types; attrsOf (submodule {
+        options = {
+          vlan = mkOption {
+            type = types.ints.unsigned;
+            description = lib.mdDoc ''
+              VLAN to which the network interface is connected.
+            '';
+          };
+
+          assignIP = mkOption {
+            type = types.bool;
+            default = false;
+            description = lib.mdDoc ''
+              Automatically assign an IP address to the network interface using the same scheme as
+              virtualisation.vlans.
+            '';
+          };
+        };
+      });
+    };
+
     virtualisation.writableStore =
       mkOption {
         type = types.bool;
diff --git a/nixos/tests/networking.nix b/nixos/tests/networking.nix
index 71b82b871270..b16ee7d05967 100644
--- a/nixos/tests/networking.nix
+++ b/nixos/tests/networking.nix
@@ -93,18 +93,19 @@ let
       name = "Static";
       nodes.router = router;
       nodes.client = { pkgs, ... }: with pkgs.lib; {
-        virtualisation.vlans = [ 1 2 ];
+        virtualisation.interfaces.enp1s0.vlan = 1;
+        virtualisation.interfaces.enp2s0.vlan = 2;
         networking = {
           useNetworkd = networkd;
           useDHCP = false;
           defaultGateway = "192.168.1.1";
           defaultGateway6 = "fd00:1234:5678:1::1";
-          interfaces.eth1.ipv4.addresses = mkOverride 0 [
+          interfaces.enp1s0.ipv4.addresses = [
             { address = "192.168.1.2"; prefixLength = 24; }
             { address = "192.168.1.3"; prefixLength = 32; }
             { address = "192.168.1.10"; prefixLength = 32; }
           ];
-          interfaces.eth2.ipv4.addresses = mkOverride 0 [
+          interfaces.enp2s0.ipv4.addresses = [
             { address = "192.168.2.2"; prefixLength = 24; }
           ];
         };
@@ -170,12 +171,12 @@ let
         # Disable test driver default config
         networking.interfaces = lib.mkForce {};
         networking.useNetworkd = networkd;
-        virtualisation.vlans = [ 1 ];
+        virtualisation.interfaces.enp1s0.vlan = 1;
       };
       testScript = ''
         start_all()
         client.wait_for_unit("multi-user.target")
-        client.wait_until_succeeds("ip addr show dev eth1 | grep '192.168.1'")
+        client.wait_until_succeeds("ip addr show dev enp1s0 | grep '192.168.1'")
         client.shell_interact()
         client.succeed("ping -c 1 192.168.1.1")
         router.succeed("ping -c 1 192.168.1.1")
@@ -187,20 +188,13 @@ let
       name = "SimpleDHCP";
       nodes.router = router;
       nodes.client = { pkgs, ... }: with pkgs.lib; {
-        virtualisation.vlans = [ 1 2 ];
+        virtualisation.interfaces.enp1s0.vlan = 1;
+        virtualisation.interfaces.enp2s0.vlan = 2;
         networking = {
           useNetworkd = networkd;
           useDHCP = false;
-          interfaces.eth1 = {
-            ipv4.addresses = mkOverride 0 [ ];
-            ipv6.addresses = mkOverride 0 [ ];
-            useDHCP = true;
-          };
-          interfaces.eth2 = {
-            ipv4.addresses = mkOverride 0 [ ];
-            ipv6.addresses = mkOverride 0 [ ];
-            useDHCP = true;
-          };
+          interfaces.enp1s0.useDHCP = true;
+          interfaces.enp2s0.useDHCP = true;
         };
       };
       testScript = { ... }:
@@ -211,10 +205,10 @@ let
           router.wait_for_unit("network-online.target")
 
           with subtest("Wait until we have an ip address on each interface"):
-              client.wait_until_succeeds("ip addr show dev eth1 | grep -q '192.168.1'")
-              client.wait_until_succeeds("ip addr show dev eth1 | grep -q 'fd00:1234:5678:1:'")
-              client.wait_until_succeeds("ip addr show dev eth2 | grep -q '192.168.2'")
-              client.wait_until_succeeds("ip addr show dev eth2 | grep -q 'fd00:1234:5678:2:'")
+              client.wait_until_succeeds("ip addr show dev enp1s0 | grep -q '192.168.1'")
+              client.wait_until_succeeds("ip addr show dev enp1s0 | grep -q 'fd00:1234:5678:1:'")
+              client.wait_until_succeeds("ip addr show dev enp2s0 | grep -q '192.168.2'")
+              client.wait_until_succeeds("ip addr show dev enp2s0 | grep -q 'fd00:1234:5678:2:'")
 
           with subtest("Test vlan 1"):
               client.wait_until_succeeds("ping -c 1 192.168.1.1")
@@ -243,16 +237,15 @@ let
       name = "OneInterfaceDHCP";
       nodes.router = router;
       nodes.client = { pkgs, ... }: with pkgs.lib; {
-        virtualisation.vlans = [ 1 2 ];
+        virtualisation.interfaces.enp1s0.vlan = 1;
+        virtualisation.interfaces.enp2s0.vlan = 2;
         networking = {
           useNetworkd = networkd;
           useDHCP = false;
-          interfaces.eth1 = {
-            ipv4.addresses = mkOverride 0 [ ];
+          interfaces.enp1s0 = {
             mtu = 1343;
             useDHCP = true;
           };
-          interfaces.eth2.ipv4.addresses = mkOverride 0 [ ];
         };
       };
       testScript = { ... }:
@@ -264,10 +257,10 @@ let
               router.wait_for_unit("network.target")
 
           with subtest("Wait until we have an ip address on each interface"):
-              client.wait_until_succeeds("ip addr show dev eth1 | grep -q '192.168.1'")
+              client.wait_until_succeeds("ip addr show dev enp1s0 | grep -q '192.168.1'")
 
           with subtest("ensure MTU is set"):
-              assert "mtu 1343" in client.succeed("ip link show dev eth1")
+              assert "mtu 1343" in client.succeed("ip link show dev enp1s0")
 
           with subtest("Test vlan 1"):
               client.wait_until_succeeds("ping -c 1 192.168.1.1")
@@ -286,16 +279,15 @@ let
     };
     bond = let
       node = address: { pkgs, ... }: with pkgs.lib; {
-        virtualisation.vlans = [ 1 2 ];
+        virtualisation.interfaces.enp1s0.vlan = 1;
+        virtualisation.interfaces.enp2s0.vlan = 2;
         networking = {
           useNetworkd = networkd;
           useDHCP = false;
           bonds.bond0 = {
-            interfaces = [ "eth1" "eth2" ];
+            interfaces = [ "enp1s0" "enp2s0" ];
             driverOptions.mode = "802.3ad";
           };
-          interfaces.eth1.ipv4.addresses = mkOverride 0 [ ];
-          interfaces.eth2.ipv4.addresses = mkOverride 0 [ ];
           interfaces.bond0.ipv4.addresses = mkOverride 0
             [ { inherit address; prefixLength = 30; } ];
         };
@@ -326,12 +318,11 @@ let
     };
     bridge = let
       node = { address, vlan }: { pkgs, ... }: with pkgs.lib; {
-        virtualisation.vlans = [ vlan ];
+        virtualisation.interfaces.enp1s0.vlan = vlan;
         networking = {
           useNetworkd = networkd;
           useDHCP = false;
-          interfaces.eth1.ipv4.addresses = mkOverride 0
-            [ { inherit address; prefixLength = 24; } ];
+          interfaces.enp1s0.ipv4.addresses = [ { inherit address; prefixLength = 24; } ];
         };
       };
     in {
@@ -339,11 +330,12 @@ let
       nodes.client1 = node { address = "192.168.1.2"; vlan = 1; };
       nodes.client2 = node { address = "192.168.1.3"; vlan = 2; };
       nodes.router = { pkgs, ... }: with pkgs.lib; {
-        virtualisation.vlans = [ 1 2 ];
+        virtualisation.interfaces.enp1s0.vlan = 1;
+        virtualisation.interfaces.enp2s0.vlan = 2;
         networking = {
           useNetworkd = networkd;
           useDHCP = false;
-          bridges.bridge.interfaces = [ "eth1" "eth2" ];
+          bridges.bridge.interfaces = [ "enp1s0" "enp2s0" ];
           interfaces.eth1.ipv4.addresses = mkOverride 0 [ ];
           interfaces.eth2.ipv4.addresses = mkOverride 0 [ ];
           interfaces.bridge.ipv4.addresses = mkOverride 0
@@ -377,7 +369,7 @@ let
       nodes.router = router;
       nodes.client = { pkgs, ... }: with pkgs.lib; {
         environment.systemPackages = [ pkgs.iptables ]; # to debug firewall rules
-        virtualisation.vlans = [ 1 ];
+        virtualisation.interfaces.enp1s0.vlan = 1;
         networking = {
           useNetworkd = networkd;
           useDHCP = false;
@@ -385,14 +377,9 @@ let
           # reverse path filtering rules for the macvlan interface seem
           # to be incorrect, causing the test to fail. Disable temporarily.
           firewall.checkReversePath = false;
-          macvlans.macvlan.interface = "eth1";
-          interfaces.eth1 = {
-            ipv4.addresses = mkOverride 0 [ ];
-            useDHCP = true;
-          };
-          interfaces.macvlan = {
-            useDHCP = true;
-          };
+          macvlans.macvlan.interface = "enp1s0";
+          interfaces.enp1s0.useDHCP = true;
+          interfaces.macvlan.useDHCP = true;
         };
       };
       testScript = { ... }:
@@ -404,7 +391,7 @@ let
               router.wait_for_unit("network.target")
 
           with subtest("Wait until we have an ip address on each interface"):
-              client.wait_until_succeeds("ip addr show dev eth1 | grep -q '192.168.1'")
+              client.wait_until_succeeds("ip addr show dev enp1s0 | grep -q '192.168.1'")
               client.wait_until_succeeds("ip addr show dev macvlan | grep -q '192.168.1'")
 
           with subtest("Print lots of diagnostic information"):
@@ -431,23 +418,22 @@ let
     fou = {
       name = "foo-over-udp";
       nodes.machine = { ... }: {
-        virtualisation.vlans = [ 1 ];
+        virtualisation.interfaces.enp1s0.vlan = 1;
         networking = {
           useNetworkd = networkd;
           useDHCP = false;
-          interfaces.eth1.ipv4.addresses = mkOverride 0
-            [ { address = "192.168.1.1"; prefixLength = 24; } ];
+          interfaces.enp1s0.ipv4.addresses = [ { address = "192.168.1.1"; prefixLength = 24; } ];
           fooOverUDP = {
             fou1 = { port = 9001; };
             fou2 = { port = 9002; protocol = 41; };
             fou3 = mkIf (!networkd)
               { port = 9003; local.address = "192.168.1.1"; };
             fou4 = mkIf (!networkd)
-              { port = 9004; local = { address = "192.168.1.1"; dev = "eth1"; }; };
+              { port = 9004; local = { address = "192.168.1.1"; dev = "enp1s0"; }; };
           };
         };
         systemd.services = {
-          fou3-fou-encap.after = optional (!networkd) "network-addresses-eth1.service";
+          fou3-fou-encap.after = optional (!networkd) "network-addresses-enp1s0.service";
         };
       };
       testScript = { ... }:
@@ -470,20 +456,20 @@ let
               "gue": None,
               "family": "inet",
               "local": "192.168.1.1",
-              "dev": "eth1",
+              "dev": "enp1s0",
           } in fous, "fou4 exists"
         '';
     };
     sit = let
       node = { address4, remote, address6 }: { pkgs, ... }: with pkgs.lib; {
-        virtualisation.vlans = [ 1 ];
+        virtualisation.interfaces.enp1s0.vlan = 1;
         networking = {
           useNetworkd = networkd;
           useDHCP = false;
           sits.sit = {
             inherit remote;
             local = address4;
-            dev = "eth1";
+            dev = "enp1s0";
           };
           interfaces.eth1.ipv4.addresses = mkOverride 0
             [ { address = address4; prefixLength = 24; } ];
@@ -685,10 +671,10 @@ let
     vlan-ping = let
         baseIP = number: "10.10.10.${number}";
         vlanIP = number: "10.1.1.${number}";
-        baseInterface = "eth1";
+        baseInterface = "enp1s0";
         vlanInterface = "vlan42";
         node = number: {pkgs, ... }: with pkgs.lib; {
-          virtualisation.vlans = [ 1 ];
+          virtualisation.interfaces.enp1s0.vlan = 1;
           networking = {
             #useNetworkd = networkd;
             useDHCP = false;
@@ -785,12 +771,12 @@ let
     privacy = {
       name = "Privacy";
       nodes.router = { ... }: {
-        virtualisation.vlans = [ 1 ];
+        virtualisation.interfaces.enp1s0.vlan = 1;
         boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = true;
         networking = {
           useNetworkd = networkd;
           useDHCP = false;
-          interfaces.eth1.ipv6.addresses = singleton {
+          interfaces.enp1s0.ipv6.addresses = singleton {
             address = "fd00:1234:5678:1::1";
             prefixLength = 64;
           };
@@ -812,11 +798,11 @@ let
         };
       };
       nodes.client_with_privacy = { pkgs, ... }: with pkgs.lib; {
-        virtualisation.vlans = [ 1 ];
+        virtualisation.interfaces.enp1s0.vlan = 1;
         networking = {
           useNetworkd = networkd;
           useDHCP = false;
-          interfaces.eth1 = {
+          interfaces.enp1s0 = {
             tempAddress = "default";
             ipv4.addresses = mkOverride 0 [ ];
             ipv6.addresses = mkOverride 0 [ ];
@@ -825,11 +811,11 @@ let
         };
       };
       nodes.client = { pkgs, ... }: with pkgs.lib; {
-        virtualisation.vlans = [ 1 ];
+        virtualisation.interfaces.enp1s0.vlan = 1;
         networking = {
           useNetworkd = networkd;
           useDHCP = false;
-          interfaces.eth1 = {
+          interfaces.enp1s0 = {
             tempAddress = "enabled";
             ipv4.addresses = mkOverride 0 [ ];
             ipv6.addresses = mkOverride 0 [ ];
@@ -847,9 +833,9 @@ let
 
           with subtest("Wait until we have an ip address"):
               client_with_privacy.wait_until_succeeds(
-                  "ip addr show dev eth1 | grep -q 'fd00:1234:5678:1:'"
+                  "ip addr show dev enp1s0 | grep -q 'fd00:1234:5678:1:'"
               )
-              client.wait_until_succeeds("ip addr show dev eth1 | grep -q 'fd00:1234:5678:1:'")
+              client.wait_until_succeeds("ip addr show dev enp1s0 | grep -q 'fd00:1234:5678:1:'")
 
           with subtest("Test vlan 1"):
               client_with_privacy.wait_until_succeeds("ping -c 1 fd00:1234:5678:1::1")
@@ -947,7 +933,7 @@ let
             ), "The IPv6 routing table has not been properly cleaned:\n{}".format(ipv6Residue)
       '';
     };
-    rename = {
+    rename = if networkd then {
       name = "RenameInterface";
       nodes.machine = { pkgs, ... }: {
         virtualisation.vlans = [ 1 ];
@@ -955,22 +941,18 @@ let
           useNetworkd = networkd;
           useDHCP = false;
         };
-      } //
-      (if networkd
-       then { systemd.network.links."10-custom_name" = {
-                matchConfig.MACAddress = "52:54:00:12:01:01";
-                linkConfig.Name = "custom_name";
-              };
-            }
-       else { boot.initrd.services.udev.rules = ''
-               SUBSYSTEM=="net", ACTION=="add", DRIVERS=="?*", ATTR{address}=="52:54:00:12:01:01", KERNEL=="eth*", NAME="custom_name"
-              '';
-            });
+        systemd.network.links."10-custom_name" = {
+          matchConfig.MACAddress = "52:54:00:12:01:01";
+          linkConfig.Name = "custom_name";
+        };
+      };
       testScript = ''
         machine.succeed("udevadm settle")
         print(machine.succeed("ip link show dev custom_name"))
       '';
-    };
+    } else {
+      name = "RenameInterface";
+      testScript = "";
     # even with disabled networkd, systemd.network.links should work
     # (as it's handled by udev, not networkd)
     link = {
diff --git a/pkgs/applications/audio/sublime-music/default.nix b/pkgs/applications/audio/sublime-music/default.nix
index cedad6ef17e7..d469c9689a5d 100644
--- a/pkgs/applications/audio/sublime-music/default.nix
+++ b/pkgs/applications/audio/sublime-music/default.nix
@@ -1,5 +1,5 @@
-{ fetchFromGitLab
-, lib
+{ lib
+, fetchFromGitLab
 , python3Packages
 , gobject-introspection
 , gtk3
@@ -9,8 +9,10 @@
 , chromecastSupport ? false
 , serverSupport ? false
 , keyringSupport ? true
-, notifySupport ? true, libnotify
-, networkSupport ? true, networkmanager
+, notifySupport ? true
+, libnotify
+, networkSupport ? true
+, networkmanager
 }:
 
 python3Packages.buildPythonApplication rec {
@@ -21,8 +23,8 @@ python3Packages.buildPythonApplication rec {
   src = fetchFromGitLab {
     owner = "sublime-music";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-n77mTgElwwFaX3WQL8tZzbkPwnsyQ08OW9imSOjpBlg=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-n77mTgElwwFaX3WQL8tZzbkPwnsyQ08OW9imSOjpBlg=";
   };
 
   nativeBuildInputs = [
@@ -38,12 +40,21 @@ python3Packages.buildPythonApplication rec {
     "python-mpv"
   ];
 
+  postPatch = ''
+    sed -i "/--cov/d" setup.cfg
+    sed -i "/--no-cov-on-fail/d" setup.cfg
+    # https://github.com/sublime-music/sublime-music/pull/370
+    # Can be removed in later versions (probably > 0.11.16)
+    substituteInPlace pyproject.toml \
+      --replace 'python-Levenshtein = "^0.12.0"' 'Levenshtein = ">0.12.0"'
+  '';
+
   buildInputs = [
     gtk3
     pango
   ]
-   ++ lib.optional notifySupport libnotify
-   ++ lib.optional networkSupport networkmanager
+  ++ lib.optional notifySupport libnotify
+  ++ lib.optional networkSupport networkmanager
   ;
 
   propagatedBuildInputs = with python3Packages; [
@@ -59,16 +70,11 @@ python3Packages.buildPythonApplication rec {
     requests
     semver
   ]
-   ++ lib.optional chromecastSupport PyChromecast
-   ++ lib.optional keyringSupport keyring
-   ++ lib.optional serverSupport bottle
+  ++ lib.optional chromecastSupport PyChromecast
+  ++ lib.optional keyringSupport keyring
+  ++ lib.optional serverSupport bottle
   ;
 
-  postPatch = ''
-    sed -i "/--cov/d" setup.cfg
-    sed -i "/--no-cov-on-fail/d" setup.cfg
-  '';
-
   # hook for gobject-introspection doesn't like strictDeps
   # https://github.com/NixOS/nixpkgs/issues/56943
   strictDeps = false;
@@ -98,6 +104,7 @@ python3Packages.buildPythonApplication rec {
   meta = with lib; {
     description = "GTK3 Subsonic/Airsonic client";
     homepage = "https://sublimemusic.app/";
+    changelog = "https://github.com/sublime-music/sublime-music/blob/v${version}/CHANGELOG.rst";
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ albakham sumnerevans ];
   };
diff --git a/pkgs/applications/backup/vorta/default.nix b/pkgs/applications/backup/vorta/default.nix
index 3fa8e1816f80..05d3cc862635 100644
--- a/pkgs/applications/backup/vorta/default.nix
+++ b/pkgs/applications/backup/vorta/default.nix
@@ -8,13 +8,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "vorta";
-  version = "0.8.9";
+  version = "0.8.10";
 
   src = fetchFromGitHub {
     owner = "borgbase";
     repo = "vorta";
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-5RZXHMov3CX0zRprs7sgz0+cGEdESLrg4I2glRnTkcU=";
+    hash = "sha256-okxZ1kALB5l94ShStAJLfzD37MLhob8MCzhbqfVISkw=";
   };
 
   nativeBuildInputs = [ wrapQtAppsHook ];
@@ -84,10 +84,11 @@ python3Packages.buildPythonApplication rec {
   ];
 
   meta = with lib; {
-    license = licenses.gpl3Only;
-    homepage = "https://vorta.borgbase.com/";
-    maintainers = with maintainers; [ ma27 ];
+    changelog = "https://github.com/borgbase/vorta/releases/tag/v0.8.10";
     description = "Desktop Backup Client for Borg";
+    homepage = "https://vorta.borgbase.com/";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ ma27 ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/applications/editors/rednotebook/default.nix b/pkgs/applications/editors/rednotebook/default.nix
index 3f560d17e532..2018e1d5e2af 100644
--- a/pkgs/applications/editors/rednotebook/default.nix
+++ b/pkgs/applications/editors/rednotebook/default.nix
@@ -5,13 +5,13 @@
 
 buildPythonApplication rec {
   pname = "rednotebook";
-  version = "2.29";
+  version = "2.29.3";
 
   src = fetchFromGitHub {
     owner = "jendrikseipp";
     repo = "rednotebook";
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-gRmSxWAVF61svlZ0/IMTrWCmwin+uPONLBlcJOYcp2w=";
+    sha256 = "sha256-2qgWJ/bIravil/SuApA7pNXkxS5xUcdFpjVGO/ogDpw=";
   };
 
   # We have not packaged tests.
diff --git a/pkgs/applications/networking/browsers/palemoon/default.nix b/pkgs/applications/networking/browsers/palemoon/default.nix
index 9efa3e79dc05..2101306e420f 100644
--- a/pkgs/applications/networking/browsers/palemoon/default.nix
+++ b/pkgs/applications/networking/browsers/palemoon/default.nix
@@ -45,7 +45,7 @@ assert with lib.strings; (
 
 stdenv.mkDerivation rec {
   pname = "palemoon";
-  version = "31.4.2";
+  version = "32.0.0";
 
   src = fetchFromGitea {
     domain = "repo.palemoon.org";
@@ -53,7 +53,7 @@ stdenv.mkDerivation rec {
     repo = "Pale-Moon";
     rev = "${version}_Release";
     fetchSubmodules = true;
-    sha256 = "sha256-vJhjQfsa05fFNL24tUBHfKoKZG2aLXp5xBdUqqGDtAE=";
+    sha256 = "sha256-0N63Xo8cRIHwEXkT8eeot0DgZU7aPirmVq/iHJjlGRw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/cluster/rke/default.nix b/pkgs/applications/networking/cluster/rke/default.nix
index 0d76b62a8e18..b19b93e48f19 100644
--- a/pkgs/applications/networking/cluster/rke/default.nix
+++ b/pkgs/applications/networking/cluster/rke/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "rke";
-  version = "1.4.1";
+  version = "1.4.2";
 
   src = fetchFromGitHub {
     owner = "rancher";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-H5T7Hr6/YL93lbCLOxfQ+Kmv3C+FS074418mHhBV3Bs=";
+    hash = "sha256-4aT9SguxN7oaewnrxme1nCFfaQytSJ9Aeb0WEQACtUA=";
   };
 
   vendorHash = "sha256-zV1lrJhzrUAcEk6jYLCFrHcYw3CZart46qXErCTjZyQ=";
diff --git a/pkgs/applications/networking/n8n/node-packages.nix b/pkgs/applications/networking/n8n/node-packages.nix
index 991993776953..0e9f619b1ffe 100644
--- a/pkgs/applications/networking/n8n/node-packages.nix
+++ b/pkgs/applications/networking/n8n/node-packages.nix
@@ -220,13 +220,13 @@ let
         sha512 = "XqfbglUTVLdkHQ8F9UQJtKseRr3sSnr9ysboxtoswvaMVaEfvyLtMoHv9XdKUfOc0qKGzNgRFd9yRjIWVepl6Q==";
       };
     };
-    "@azure/msal-common-9.0.2" = {
+    "@azure/msal-common-9.1.1" = {
       name = "_at_azure_slash_msal-common";
       packageName = "@azure/msal-common";
-      version = "9.0.2";
+      version = "9.1.1";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@azure/msal-common/-/msal-common-9.0.2.tgz";
-        sha512 = "qzwxuF8kZAp+rNUactMCgJh8fblq9D4lSqrrIxMDzLjgSZtjN32ix7r/HBe8QdOr76II9SVVPcMkX4sPzPfQ7w==";
+        url = "https://registry.npmjs.org/@azure/msal-common/-/msal-common-9.1.1.tgz";
+        sha512 = "we9xR8lvu47fF0h+J8KyXoRy9+G/fPzm3QEa2TrdR3jaVS3LKAyE2qyMuUkNdbVkvzl8Zr9f7l+IUSP22HeqXw==";
       };
     };
     "@azure/msal-node-1.0.0-beta.6" = {
@@ -256,22 +256,22 @@ let
         sha512 = "o/Mf6lkyYG/eBW4/hXB9864RxVNmAkcKHjsGR6Inlp5hupa3exjSyH2KjO3tLO//YGA+tS+17hM2bxRl9Sn16g==";
       };
     };
-    "@babel/parser-7.20.7" = {
+    "@babel/parser-7.20.13" = {
       name = "_at_babel_slash_parser";
       packageName = "@babel/parser";
-      version = "7.20.7";
+      version = "7.20.13";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@babel/parser/-/parser-7.20.7.tgz";
-        sha512 = "T3Z9oHybU+0vZlY9CiDSJQTD5ZapcW18ZctFMi0MOAl/4BjFF4ul7NVSARLdbGO5vDqy9eQiGTV0LtKfvCYvcg==";
+        url = "https://registry.npmjs.org/@babel/parser/-/parser-7.20.13.tgz";
+        sha512 = "gFDLKMfpiXCsjt4za2JA9oTMn70CeseCehb11kRZgvd7+F67Hih3OHOK24cRrWECJ/ljfPGac6ygXAs/C8kIvw==";
       };
     };
-    "@babel/runtime-7.20.7" = {
+    "@babel/runtime-7.20.13" = {
       name = "_at_babel_slash_runtime";
       packageName = "@babel/runtime";
-      version = "7.20.7";
+      version = "7.20.13";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@babel/runtime/-/runtime-7.20.7.tgz";
-        sha512 = "UF0tvkUtxwAgZ5W/KrkHf0Rn0fdnLDU9ScxBrEVNUprE/MzirjK4MJUX1/BVDv00Sv8cljtukVK1aky++X1SjQ==";
+        url = "https://registry.npmjs.org/@babel/runtime/-/runtime-7.20.13.tgz";
+        sha512 = "gt3PKXs0DBoL9xCvOIIZ2NEqAGZqHjAnmVbfQtB620V0uReIQutpel14KcneZuer7UioY8ALKZ7iocavvzTNFA==";
       };
     };
     "@codemirror/autocomplete-6.4.0" = {
@@ -283,13 +283,13 @@ let
         sha512 = "HLF2PnZAm1s4kGs30EiqKMgD7XsYaQ0XJnMR0rofEWQ5t5D60SfqpDIkIh1ze5tiEbyUWm8+VJ6W1/erVvBMIA==";
       };
     };
-    "@codemirror/commands-6.1.3" = {
+    "@codemirror/commands-6.2.0" = {
       name = "_at_codemirror_slash_commands";
       packageName = "@codemirror/commands";
-      version = "6.1.3";
+      version = "6.2.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@codemirror/commands/-/commands-6.1.3.tgz";
-        sha512 = "wUw1+vb34Ultv0Q9m/OVB7yizGXgtoDbkI5f5ErM8bebwLyUYjicdhJTKhTvPTpgkv8dq/BK0lQ3K5pRf2DAJw==";
+        url = "https://registry.npmjs.org/@codemirror/commands/-/commands-6.2.0.tgz";
+        sha512 = "+00smmZBradoGFEkRjliN7BjqPh/Hx0KCHWOEibUmflUqZz2RwBTU0MrVovEEHozhx3AUSGcO/rl3/5f9e9Biw==";
       };
     };
     "@codemirror/lang-javascript-6.1.2" = {
@@ -382,13 +382,13 @@ let
         sha512 = "hrlQOIi7hAfzsMqlGSFyVucrx38O+j6wiGOf//H2ecvIEqYN4ADBSS2iLMh5UFyDunCNniUIPk/q3riFv45xRA==";
       };
     };
-    "@fontsource/open-sans-4.5.13" = {
+    "@fontsource/open-sans-4.5.14" = {
       name = "_at_fontsource_slash_open-sans";
       packageName = "@fontsource/open-sans";
-      version = "4.5.13";
+      version = "4.5.14";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@fontsource/open-sans/-/open-sans-4.5.13.tgz";
-        sha512 = "/UzqP7ZFk145XAq8KG4pvFPP7UQhtreDGXgqXZjagCDreKxcrhwn/x7DYz9rPcycWkLUVApIybcoczGZiM0cRg==";
+        url = "https://registry.npmjs.org/@fontsource/open-sans/-/open-sans-4.5.14.tgz";
+        sha512 = "mBXIIETBlW8q/ocuUN0hyGow2iuf75hQEHQt8R/RJ/HcphVbLg8KB7pHYGbFGDqs75W+SWvTC7JkVeAjT65BuQ==";
       };
     };
     "@fortawesome/fontawesome-common-types-0.2.36" = {
@@ -445,13 +445,13 @@ let
         sha512 = "JLmQfz6tdtwxoihXLg6lT78BorrFyCf59SAwBM6qV/0zXyVeDygJVb3fk+j5Qat+Yvcxp1buLTY5iDh1ZSAQ8w==";
       };
     };
-    "@fortawesome/vue-fontawesome-2.0.9" = {
+    "@fortawesome/vue-fontawesome-2.0.10" = {
       name = "_at_fortawesome_slash_vue-fontawesome";
       packageName = "@fortawesome/vue-fontawesome";
-      version = "2.0.9";
+      version = "2.0.10";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@fortawesome/vue-fontawesome/-/vue-fontawesome-2.0.9.tgz";
-        sha512 = "tUmO92PFHbLOplitjHNBVGMJm6S57vp16tBXJVPKSI/6CfjrgLycqKxEpC6f7qsOqUdoXs5nIv4HLUfrOMHzuw==";
+        url = "https://registry.npmjs.org/@fortawesome/vue-fontawesome/-/vue-fontawesome-2.0.10.tgz";
+        sha512 = "OTETSXz+3ygD2OK2/vy82cmUBpuJqeOAg4gfnnv+f2Rir1tDIhQg026Q3NQxznq83ZLz8iNqGG9XJm26inpDeg==";
       };
     };
     "@gar/promisify-1.1.3" = {
@@ -760,13 +760,13 @@ let
         sha512 = "OWhCpdu4QqggOPX1YPZ4XVmLLRX+lhGjXV6RNA7sogOwLqlEmSslnN/lhR5dkhcWZbKWBQH29YCrB3LDPRu/IA==";
       };
     };
-    "@oclif/core-1.24.0" = {
+    "@oclif/core-1.26.1" = {
       name = "_at_oclif_slash_core";
       packageName = "@oclif/core";
-      version = "1.24.0";
+      version = "1.26.1";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@oclif/core/-/core-1.24.0.tgz";
-        sha512 = "J41suyV4fLfLcRRySZdtgFYSjIlpYqD90SY01Fm4+ZJUMcfDh/eQAD4sogyYOsIT0bfEzYOyYCjmfHmgcoX5aA==";
+        url = "https://registry.npmjs.org/@oclif/core/-/core-1.26.1.tgz";
+        sha512 = "g+OWJcM7JOVI53caTEtq0BB1nPotWctRLUyFODPgvDqXhVR7QED+Qz3LwFAMD8dt7/Ar2ZNq15U3bnpnOv453A==";
       };
     };
     "@oclif/errors-1.3.6" = {
@@ -949,49 +949,49 @@ let
         sha512 = "gW69MEamZ4wk1OsOq1nG1jcyhXIQcnrsX5JwixVw/9xaiav8TCyjESAruu1Rz9yyInhgBXxkNwMeygKnN2uxNA==";
       };
     };
-    "@sentry/core-7.31.0" = {
+    "@sentry/core-7.33.0" = {
       name = "_at_sentry_slash_core";
       packageName = "@sentry/core";
-      version = "7.31.0";
+      version = "7.33.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@sentry/core/-/core-7.31.0.tgz";
-        sha512 = "IZS1MZznyBOPw7UEpZwq3t3aaaVhFB+r3KM4JYFSJRr7Ky9TjldXA3hadNUTztjYGgEC3u8kB9jXoRvNXM2hqA==";
+        url = "https://registry.npmjs.org/@sentry/core/-/core-7.33.0.tgz";
+        sha512 = "mrSgUnXjxHVi0cVea1lv7gC/Y66ya2a3atCHaPEij/+l+3APg5d0Ixt1zMx5YllMiZKf6wpxlZ0uwXcqdAAw+w==";
       };
     };
-    "@sentry/integrations-7.31.0" = {
+    "@sentry/integrations-7.33.0" = {
       name = "_at_sentry_slash_integrations";
       packageName = "@sentry/integrations";
-      version = "7.31.0";
+      version = "7.33.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@sentry/integrations/-/integrations-7.31.0.tgz";
-        sha512 = "pZyxY2t92gWmqULXsSEAjy5LMUyFWTA4f5AL+2gB5xmUjYXSaKT37R7sX5IQ2MVbCyrpJZERklx2LLhCrKtigw==";
+        url = "https://registry.npmjs.org/@sentry/integrations/-/integrations-7.33.0.tgz";
+        sha512 = "r67/9R+DaOZETg7gRvOuYPo5XQdzEaE8f7OaET071dUP0kyUBjO74Y7SZxZV/xjBthMXexw5TANHmLVrZQQVag==";
       };
     };
-    "@sentry/node-7.31.0" = {
+    "@sentry/node-7.33.0" = {
       name = "_at_sentry_slash_node";
       packageName = "@sentry/node";
-      version = "7.31.0";
+      version = "7.33.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@sentry/node/-/node-7.31.0.tgz";
-        sha512 = "DBjPfThZ5CIC2G9/CVFRlSOP/QqF1IoZXNpTUPZkhQ1cjShJeERT64jMkTdk+RAStSTpEfF6J0rUy1NIyHHEoQ==";
+        url = "https://registry.npmjs.org/@sentry/node/-/node-7.33.0.tgz";
+        sha512 = "isQVF9LLSG4EZLHiSJ3chgK6f3ZBdGxm8fX6YGm8HWz07CubJddes3yBPLPRNXrRLd7X3SK8pPcK5oc3LIKqAw==";
       };
     };
-    "@sentry/types-7.31.0" = {
+    "@sentry/types-7.33.0" = {
       name = "_at_sentry_slash_types";
       packageName = "@sentry/types";
-      version = "7.31.0";
+      version = "7.33.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@sentry/types/-/types-7.31.0.tgz";
-        sha512 = "nFqo7wyMnapdSEdw1MD+cavDtD9x5QQmh/bwLEOb/euM0cHFJHYyD7CveY/mQng4HyEVWY+DCtX/7E3GcQ7Bdw==";
+        url = "https://registry.npmjs.org/@sentry/types/-/types-7.33.0.tgz";
+        sha512 = "5kkmYjtBWSbPxfYGiXdZFPS6xpFBNlXvDqeX4NpCFXz6/LiEDn6tZ61kuCSFb8MZlyqyCX5WsP3aiI2FJfpGIA==";
       };
     };
-    "@sentry/utils-7.31.0" = {
+    "@sentry/utils-7.33.0" = {
       name = "_at_sentry_slash_utils";
       packageName = "@sentry/utils";
-      version = "7.31.0";
+      version = "7.33.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@sentry/utils/-/utils-7.31.0.tgz";
-        sha512 = "B1KkvdfwlaqM7sDp3/yk2No7WsbMuLEywGRVOLzXeTqTLSBRBWyyYIudqPtx2LDds9anlUHj21zs9FKY+S3eiA==";
+        url = "https://registry.npmjs.org/@sentry/utils/-/utils-7.33.0.tgz";
+        sha512 = "msp02GV1gOfaN5FjKjWxI00rtbYLXEE5cTGldhs/Dt9KI63dDk1nwPDkSLhg6joqRItAq0thlBh6un717HdWbg==";
       };
     };
     "@servie/events-1.0.0" = {
@@ -1012,22 +1012,22 @@ let
         sha512 = "Uy0+khmZqUrUGm5dmMqVlnvufZRSK0FbYzVgp0UMstm+F5+W2/jnEEQyc9vo1ZR/E5ZI/B1WjjoTqBqwJL6Krw==";
       };
     };
-    "@swc/core-1.3.27" = {
+    "@swc/core-1.3.28" = {
       name = "_at_swc_slash_core";
       packageName = "@swc/core";
-      version = "1.3.27";
+      version = "1.3.28";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@swc/core/-/core-1.3.27.tgz";
-        sha512 = "praRNgpeYGvwDIm/Cl6JU+yHMvwVraL0U6ejMgGyzvpcm1FVsZd1/EYXGqzbBJ0ALv7Gx4eK56h4GnwV6d4L0w==";
+        url = "https://registry.npmjs.org/@swc/core/-/core-1.3.28.tgz";
+        sha512 = "yzc61HbAIjHeOYTUW/IgXAywlSviMFymnUiLY7dNUELGHjMVxSp0XnIlPQN4v5UekYbwLEV8+KChaoQRACiQCw==";
       };
     };
-    "@swc/wasm-1.3.27" = {
+    "@swc/wasm-1.3.28" = {
       name = "_at_swc_slash_wasm";
       packageName = "@swc/wasm";
-      version = "1.3.27";
+      version = "1.3.28";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@swc/wasm/-/wasm-1.3.27.tgz";
-        sha512 = "bSFeKxGU2zY/xC3K7Y4sjdtHMgbv6gM2Z01PTMGoC8b2PVubPKeW+BYmprZFSf2eCOsNLZaVzVufdVTQB/ORfg==";
+        url = "https://registry.npmjs.org/@swc/wasm/-/wasm-1.3.28.tgz";
+        sha512 = "6RDkQHSi6FxaoPmGnzMq5smYxXlcEec+t6EHrv8rk4emIrnsFjSc2D2PQ0K4xoryJn2NVD3cDbAEVHe6XZX5AQ==";
       };
     };
     "@techteamer/ocsp-1.0.0" = {
@@ -1156,13 +1156,13 @@ let
         sha512 = "erqUpFXksaeR2kejKnhnjZjbFxUpGZx4Z7ydNL9ie8tEhXPiZTsLeUDJ6aR1F8j5wWUAtOAQWUqkc7givBJbBA==";
       };
     };
-    "@types/express-4.17.15" = {
+    "@types/express-4.17.16" = {
       name = "_at_types_slash_express";
       packageName = "@types/express";
-      version = "4.17.15";
+      version = "4.17.16";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@types/express/-/express-4.17.15.tgz";
-        sha512 = "Yv0k4bXGOH+8a+7bELd2PqHQsuiANB+A8a4gnQrkRWzrkKlb6KHaVvyXhqs04sVW/OWlbPyYxRgYlIXLfrufMQ==";
+        url = "https://registry.npmjs.org/@types/express/-/express-4.17.16.tgz";
+        sha512 = "LkKpqRZ7zqXJuvoELakaFYuETHjZkSol8EV6cNnyishutDBCCdv6+dsKPbKkCcIk57qRphOLY5sEgClw1bO3gA==";
       };
     };
     "@types/express-jwt-0.0.42" = {
@@ -1174,13 +1174,13 @@ let
         sha512 = "WszgUddvM1t5dPpJ3LhWNH8kfNN8GPIBrAGxgIYXVCEGx6Bx4A036aAuf/r5WH9DIEdlmp7gHOYvSM6U87B0ag==";
       };
     };
-    "@types/express-serve-static-core-4.17.32" = {
+    "@types/express-serve-static-core-4.17.33" = {
       name = "_at_types_slash_express-serve-static-core";
       packageName = "@types/express-serve-static-core";
-      version = "4.17.32";
+      version = "4.17.33";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@types/express-serve-static-core/-/express-serve-static-core-4.17.32.tgz";
-        sha512 = "aI5h/VOkxOF2Z1saPy0Zsxs5avets/iaiAJYznQFm5By/pamU31xWKL//epiF4OfUA2qTOc9PV6tCUjhO8wlZA==";
+        url = "https://registry.npmjs.org/@types/express-serve-static-core/-/express-serve-static-core-4.17.33.tgz";
+        sha512 = "TPBqmR/HRYI3eC2E5hmiivIzv+bidAfXofM+sbonAGvyDhySGw9/PQZFt2BLOrjUUR++4eJVpx6KnLQK1Fk9tA==";
       };
     };
     "@types/express-unless-2.0.1" = {
@@ -1336,13 +1336,13 @@ let
         sha512 = "sOUTGn6h1SfQ+gbgqC364jLFBw2lnFqkgF3q0WovEHRLMrVD1sd5aufqi/aJObLekJO+Aq5z646U4Oxy6shXMA==";
       };
     };
-    "@types/validator-13.7.10" = {
+    "@types/validator-13.7.11" = {
       name = "_at_types_slash_validator";
       packageName = "@types/validator";
-      version = "13.7.10";
+      version = "13.7.11";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@types/validator/-/validator-13.7.10.tgz";
-        sha512 = "t1yxFAR2n0+VO6hd/FJ9F2uezAZVWHLmpmlJzm1eX03+H7+HsuTAp7L8QJs+2pQCfWkP1+EXsGK9Z9v7o/qPVQ==";
+        url = "https://registry.npmjs.org/@types/validator/-/validator-13.7.11.tgz";
+        sha512 = "WqTos+CnAKN64YwyBMhgUYhb5VsTNKwUY6AuzG5qu9/pFZJar/RJFMZBXwX7VS+uzYi+lIAr3WkvuWqEI9F2eg==";
       };
     };
     "@types/webidl-conversions-7.0.0" = {
@@ -1381,13 +1381,13 @@ let
         sha512 = "xDWoEtxGXhH9Ku3ROYX/rzhcpt4v31hpPU5zF3UeVC/qxA3dChmqU8zvTUYoKh3j7rzpNsoFOwqsWG7XPMlaFA==";
       };
     };
-    "@vue/devtools-api-6.4.5" = {
+    "@vue/devtools-api-6.5.0" = {
       name = "_at_vue_slash_devtools-api";
       packageName = "@vue/devtools-api";
-      version = "6.4.5";
+      version = "6.5.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@vue/devtools-api/-/devtools-api-6.4.5.tgz";
-        sha512 = "JD5fcdIuFxU4fQyXUu3w2KpAJHzTVdN+p4iOX2lMWSHMOoQdMAcpFLZzm9Z/2nmsoZ1a96QEhZ26e50xLBsgOQ==";
+        url = "https://registry.npmjs.org/@vue/devtools-api/-/devtools-api-6.5.0.tgz";
+        sha512 = "o9KfBeaBmCKl10usN4crU53fYtC1r7jJwdGKjPT24t348rHxgfpZ0xL3Xm/gLUYnc0oTp8LAmrxOeLyu6tbk2Q==";
       };
     };
     "@xmldom/xmldom-0.8.6" = {
@@ -1435,13 +1435,13 @@ let
         sha512 = "PYAthTa2m2VKxuvSD3DPC/Gy+U+sOA1LAuT8mkmRuvw+NACSaeXEQ+NHcVF7rONl6qcaxV3Uuemwawk+7+SJLw==";
       };
     };
-    "acorn-8.8.1" = {
+    "acorn-8.8.2" = {
       name = "acorn";
       packageName = "acorn";
-      version = "8.8.1";
+      version = "8.8.2";
       src = fetchurl {
-        url = "https://registry.npmjs.org/acorn/-/acorn-8.8.1.tgz";
-        sha512 = "7zFpHzhnqYKrkYdUjF1HI1bzd0VygEGX8lFk4k5zVMqHEoES+P+7TKI+EvLO9WVMJ8eekdO0aDEK044xTXwPPA==";
+        url = "https://registry.npmjs.org/acorn/-/acorn-8.8.2.tgz";
+        sha512 = "xjIYgE8HBrkpd/sJqOGNspf8uHG+NOHGOw6a/Urj8taM2EXfdNAH2oFcPeIFfsv3+kz/mJrS5VuMqbNLjCa2vw==";
       };
     };
     "acorn-walk-8.2.0" = {
@@ -1867,13 +1867,13 @@ let
         sha512 = "9cYNccliXZDByFsFliVwk5GvTq058Fj513CiR4E60ndDwmuXzTJEp/Bp8FyuRmGyYupLjHLs+JA9/CBoVS4/NQ==";
       };
     };
-    "aws-sdk-2.1295.0" = {
+    "aws-sdk-2.1301.0" = {
       name = "aws-sdk";
       packageName = "aws-sdk";
-      version = "2.1295.0";
+      version = "2.1301.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/aws-sdk/-/aws-sdk-2.1295.0.tgz";
-        sha512 = "HVYoFCyfiL8gzL/c0lSRTg8tWBLfqAEDfwzGe338ww/LahpmC6C07S71SBBIvtGq3dpd7IwEobAbubZDijrA0Q==";
+        url = "https://registry.npmjs.org/aws-sdk/-/aws-sdk-2.1301.0.tgz";
+        sha512 = "AxCt0GfWV14AWC0yvN3+WEBr45JMu2X3FHb8r3H8EhZjJfHk3hWcDwu6vS5Qd8NFDATlFdWJfyQjPVU1YuaDfw==";
       };
     };
     "aws-sign2-0.7.0" = {
@@ -1921,13 +1921,13 @@ let
         sha512 = "00tXVRwKx/FZr/IDVFt4C+f9FYairX517WoGCL6dpOntqLkZofjhu43F/Xl44UOpqa+9sLFDrG/XAnFsUYgkDA==";
       };
     };
-    "axios-retry-3.3.1" = {
+    "axios-retry-3.4.0" = {
       name = "axios-retry";
       packageName = "axios-retry";
-      version = "3.3.1";
+      version = "3.4.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/axios-retry/-/axios-retry-3.3.1.tgz";
-        sha512 = "RohAUQTDxBSWLFEnoIG/6bvmy8l3TfpkclgStjl5MDCMBDgapAWCmr1r/9harQfWC8bzLC8job6UcL1A1Yc+/Q==";
+        url = "https://registry.npmjs.org/axios-retry/-/axios-retry-3.4.0.tgz";
+        sha512 = "VdgaP+gHH4iQYCCNUWF2pcqeciVOdGrBBAYUfTY+wPcO5Ltvp/37MLFNCmJKo7Gj3SHvCSdL8ouI1qLYJN3liA==";
       };
     };
     "babel-helper-vue-jsx-merge-props-2.0.3" = {
@@ -2956,13 +2956,13 @@ let
         sha512 = "Kb2wC0fvsWfQrgk8HU5lW6U/Lcs8+9aaYcy4ZFc6DDlo4nZ7n70dEgE5rtR0oG6ufKDUnrwfWL1mXR5ljDatrQ==";
       };
     };
-    "core-js-3.27.1" = {
+    "core-js-3.27.2" = {
       name = "core-js";
       packageName = "core-js";
-      version = "3.27.1";
+      version = "3.27.2";
       src = fetchurl {
-        url = "https://registry.npmjs.org/core-js/-/core-js-3.27.1.tgz";
-        sha512 = "GutwJLBChfGCpwwhbYoqfv03LAfmiz7e7D/BNxzeMxwQf10GRSzqiOjx7AmtEk+heiD/JWmBuyBPgFtx0Sg1ww==";
+        url = "https://registry.npmjs.org/core-js/-/core-js-3.27.2.tgz";
+        sha512 = "9ashVQskuh5AZEZ1JdQWp1GqSoC1e1G87MzRqg2gIfVAQ7Qn9K+uFj8EcniUFA4P2NLZfV+TOlX1SzoKfo+s7w==";
       };
     };
     "core-util-is-1.0.2" = {
@@ -4000,6 +4000,15 @@ let
         sha512 = "89/sdkq+BKBuIyykaMl/vR9grFc3WFUPTjFo0THHbu+5g+q8rA7fKeoMfz+h84yOQIBcztmJ5ZJdk5uhEls31A==";
       };
     };
+    "express-prom-bundle-6.6.0" = {
+      name = "express-prom-bundle";
+      packageName = "express-prom-bundle";
+      version = "6.6.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/express-prom-bundle/-/express-prom-bundle-6.6.0.tgz";
+        sha512 = "tZh2P2p5a8/yxQ5VbRav011Poa4R0mHqdFwn9Swe/obXDe5F0jY9wtRAfNYnqk4LXY7akyvR/nrvAHxQPWUjsQ==";
+      };
+    };
     "express-unless-2.1.3" = {
       name = "express-unless";
       packageName = "express-unless";
@@ -4486,13 +4495,13 @@ let
         sha512 = "DyFP3BM/3YHTQOCUL/w0OZHR0lpKeGrxotcHWcqNEdnltqFwXVfhEBQ94eIo34AfQpo0rGki4cyIiftY06h2Fg==";
       };
     };
-    "get-intrinsic-1.1.3" = {
+    "get-intrinsic-1.2.0" = {
       name = "get-intrinsic";
       packageName = "get-intrinsic";
-      version = "1.1.3";
+      version = "1.2.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.1.3.tgz";
-        sha512 = "QJVz1Tj7MS099PevUG5jvnt9tSkXN8K14dxQlikJuPt4uD9hHAHjLyLBiLR5zELelBdD9QNRAXZzsJx0WaDL9A==";
+        url = "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.2.0.tgz";
+        sha512 = "L049y6nFOuom5wGyRc3/gdTLO94dySVKRACj1RmJZBQXlbTMhtNIgkWkUHq+jYmZvKf14EW1EoJnnjbmoHij0Q==";
       };
     };
     "get-package-type-0.1.0" = {
@@ -5125,13 +5134,13 @@ let
         sha512 = "3GYo0GJtLqgNXj4YhrisLaNNvWSNwSS2wS4OELGfGxH8I69+XfNdnmV1AyN+ZqMh0i7eX+SWjrwFKDBDgfBC1A==";
       };
     };
-    "ioredis-5.2.5" = {
+    "ioredis-5.2.6" = {
       name = "ioredis";
       packageName = "ioredis";
-      version = "5.2.5";
+      version = "5.2.6";
       src = fetchurl {
-        url = "https://registry.npmjs.org/ioredis/-/ioredis-5.2.5.tgz";
-        sha512 = "7HKo/ClM2DGLRXdFq8ruS3Uuadensz4A76wPOU0adqlOqd1qkhoLPDaBhmVhUhNGpB+J65/bhLmNB8DDY99HJQ==";
+        url = "https://registry.npmjs.org/ioredis/-/ioredis-5.2.6.tgz";
+        sha512 = "F1xO+kYIz+TCOccvhThs2pem6sc9uTl9JsZybWpqe4FeCFDmf04XwbLQUGIqi2UWaDUuR61w2dhxx6NJEFehOA==";
       };
     };
     "ip-1.1.8" = {
@@ -6727,13 +6736,13 @@ let
         sha512 = "J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==";
       };
     };
-    "minimatch-5.1.4" = {
+    "minimatch-5.1.6" = {
       name = "minimatch";
       packageName = "minimatch";
-      version = "5.1.4";
+      version = "5.1.6";
       src = fetchurl {
-        url = "https://registry.npmjs.org/minimatch/-/minimatch-5.1.4.tgz";
-        sha512 = "U0iNYXt9wALljzfnGkhFSy5sAC6/SCR3JrHrlsdJz4kF8MvhTRQNiC59iUi1iqsitV7abrNAJWElVL9pdnoUgw==";
+        url = "https://registry.npmjs.org/minimatch/-/minimatch-5.1.6.tgz";
+        sha512 = "lKwV/1brpG6mBUFHtb7NUmtABCb2WZZmm2wNiOA5hAb8VdCS4B3dtMWyvcoViccwAW/COERjXLt0zP1zXUN26g==";
       };
     };
     "minimist-1.2.7" = {
@@ -6961,13 +6970,13 @@ let
         sha512 = "RjHwP2cCIWQ9iUIk1SziUMb9+jj5mC4OqG2w16E5yig8jySi/TwiFvKlwcjNrPsndph0HtgCtbENnk5julf3yQ==";
       };
     };
-    "msgpackr-1.8.1" = {
+    "msgpackr-1.8.2" = {
       name = "msgpackr";
       packageName = "msgpackr";
-      version = "1.8.1";
+      version = "1.8.2";
       src = fetchurl {
-        url = "https://registry.npmjs.org/msgpackr/-/msgpackr-1.8.1.tgz";
-        sha512 = "05fT4J8ZqjYlR4QcRDIhLCYKUOHXk7C/xa62GzMKj74l3up9k2QZ3LgFc6qWdsPHl91QA2WLWqWc8b8t7GLNNw==";
+        url = "https://registry.npmjs.org/msgpackr/-/msgpackr-1.8.2.tgz";
+        sha512 = "eLuPeok0DMwsGN23AvuVg32mYpx55tsQnxI87d8V1yZsdT8U5jrWhmCa1INO/joGAFQFfo/eTlM/BxVwLKbBOQ==";
       };
     };
     "mssql-7.3.5" = {
@@ -7024,13 +7033,13 @@ let
         sha512 = "z81GNO7nnYMEhrGh9LeymoE4+Yr0Wn5McHIZMK5cfQCl+NDX08sCZgUc9/6MHni9IWuFLm1Z3HTCXu2z9fN62Q==";
       };
     };
-    "n8n-core-0.151.1" = {
+    "n8n-core-0.151.2" = {
       name = "n8n-core";
       packageName = "n8n-core";
-      version = "0.151.1";
+      version = "0.151.2";
       src = fetchurl {
-        url = "https://registry.npmjs.org/n8n-core/-/n8n-core-0.151.1.tgz";
-        sha512 = "tEPdPaJVJ+Vy87UD0XXAq7yhTPYl+WuBABtS2u9mxKtfu4XyOepK6M34XJV5gJtgBXxIPy8+sNCKVaugUvSGAA==";
+        url = "https://registry.npmjs.org/n8n-core/-/n8n-core-0.151.2.tgz";
+        sha512 = "QIGNeKuRuY+G+kPxDShjXnxVjCMCEbZ6xB530+V30s2MFa+XnEKJtPdLbsCr0j8AUTHqEb/oMkHAoEyPPg8M1g==";
       };
     };
     "n8n-design-system-0.51.1" = {
@@ -7042,31 +7051,31 @@ let
         sha512 = "zK4UI/LkdRzAGZfL9K7/tZSLjxXTIKgt/72LrgEJ8CGNxYPavk0f7eYTH9Q8tbcLAaMLDjUcbcdzVEWh5YZofA==";
       };
     };
-    "n8n-editor-ui-0.177.1" = {
+    "n8n-editor-ui-0.178.1" = {
       name = "n8n-editor-ui";
       packageName = "n8n-editor-ui";
-      version = "0.177.1";
+      version = "0.178.1";
       src = fetchurl {
-        url = "https://registry.npmjs.org/n8n-editor-ui/-/n8n-editor-ui-0.177.1.tgz";
-        sha512 = "h9TnC1mKjXyBXe2V6/Yzy81KzDvll6wlBugqnFGpTAs2IwjPDZ3WGwp94mCWwM7WDE9m2Ub9LX88ajj5WG8RyQ==";
+        url = "https://registry.npmjs.org/n8n-editor-ui/-/n8n-editor-ui-0.178.1.tgz";
+        sha512 = "bpSRVRys6fIAuhsmxQrU2QXP0UaRfGan+wODcZbX8SnWSG90ANN7R++CvS6tfL+i8vKvDzLYFjWlm1y40Esbag==";
       };
     };
-    "n8n-nodes-base-0.209.1" = {
+    "n8n-nodes-base-0.210.1" = {
       name = "n8n-nodes-base";
       packageName = "n8n-nodes-base";
-      version = "0.209.1";
+      version = "0.210.1";
       src = fetchurl {
-        url = "https://registry.npmjs.org/n8n-nodes-base/-/n8n-nodes-base-0.209.1.tgz";
-        sha512 = "Ewpk1zuH1W3SZlsb1YRQJ5yOZUTD3m/VdKJE1UTTu2lwDqk+h8DhxmrLDY4AEcwm6Teyq8hjj0l1awCa1+Ppzg==";
+        url = "https://registry.npmjs.org/n8n-nodes-base/-/n8n-nodes-base-0.210.1.tgz";
+        sha512 = "UvkjbmJoBtgqHMz+ff7AJYnVcRpPLY7rh0OPQSR3B6BQ7lzE9eBaBpfTvtIopxRwKeK3vke9UUb6ztdkgDaBDw==";
       };
     };
-    "n8n-workflow-0.133.1" = {
+    "n8n-workflow-0.133.2" = {
       name = "n8n-workflow";
       packageName = "n8n-workflow";
-      version = "0.133.1";
+      version = "0.133.2";
       src = fetchurl {
-        url = "https://registry.npmjs.org/n8n-workflow/-/n8n-workflow-0.133.1.tgz";
-        sha512 = "T3Es12JyM50FpJFogz0wKbzPOUC2iCDoL8/2br3oNU1Q53i4MfGAE2Ftf9hHOMF8pU9SN+m/D5WR3ELysI0PSQ==";
+        url = "https://registry.npmjs.org/n8n-workflow/-/n8n-workflow-0.133.2.tgz";
+        sha512 = "XnNmt5idpqb/7nVFtNCS4RQUDMfIslfepl2WJfwa/0jSQYWaJmFWhV0OmIj3mJTWaLaiy1qDjAEaEYZZBaQ69A==";
       };
     };
     "named-placeholders-1.1.3" = {
@@ -8410,13 +8419,13 @@ let
         sha512 = "xL96WDdCZYdU7Slin569tFX712BxsxslWwAfAhCYjQKGTq7dAU91Lomy6nLLhh/dyGhk/YH4TwTSRxTzhuHyZg==";
       };
     };
-    "protobufjs-7.1.2" = {
+    "protobufjs-7.2.0" = {
       name = "protobufjs";
       packageName = "protobufjs";
-      version = "7.1.2";
+      version = "7.2.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/protobufjs/-/protobufjs-7.1.2.tgz";
-        sha512 = "4ZPTPkXCdel3+L81yw3dG6+Kq3umdWKh7Dc7GW/CpNk4SX3hK58iPCWeCyhVTDrbkNeKrYNZ7EojM5WDaEWTLQ==";
+        url = "https://registry.npmjs.org/protobufjs/-/protobufjs-7.2.0.tgz";
+        sha512 = "hYCqTDuII4iJ4stZqiuGCSU8xxWl5JeXYpwARGtn/tWcKCAro6h3WQz+xpsNbXW0UYqpmTQFEyFWO0G0Kjt64g==";
       };
     };
     "proxy-addr-2.0.7" = {
@@ -8500,13 +8509,13 @@ let
         sha512 = "RofWgt/7fL5wP1Y7fxE7/EmTLzQVnB0ycyibJ0OOHIlJqTNzglYFxVwETOcIoJqJmpDXJ9xImDv+Fq34F/d4Dw==";
       };
     };
-    "punycode-2.2.0" = {
+    "punycode-2.3.0" = {
       name = "punycode";
       packageName = "punycode";
-      version = "2.2.0";
+      version = "2.3.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/punycode/-/punycode-2.2.0.tgz";
-        sha512 = "LN6QV1IJ9ZhxWTNdktaPClrNfp8xdSAYS0Zk2ddX7XsXZAxckMHPCBcHRo0cTcEIgYPRiGEkmji3Idkh2yFtYw==";
+        url = "https://registry.npmjs.org/punycode/-/punycode-2.3.0.tgz";
+        sha512 = "rRV+zQD8tVFys26lAGR9WUuS4iUAngJScM+ZRSKtvl5tKeZ2t5bvdNFdNHBW9FWR4guGHlgmsZ1G7BSm2wTbuA==";
       };
     };
     "python-struct-1.1.3" = {
@@ -10462,6 +10471,15 @@ let
         sha512 = "WypcfiRhfeUP9vvF0j6rw0J3hrWrw6iZv3+22h6iRMJ/8z1Tj6XfLP4DsUix5MhMPnXpiHDoKyoZ/bdCkwBCiQ==";
       };
     };
+    "url-value-parser-2.2.0" = {
+      name = "url-value-parser";
+      packageName = "url-value-parser";
+      version = "2.2.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/url-value-parser/-/url-value-parser-2.2.0.tgz";
+        sha512 = "yIQdxJpgkPamPPAPuGdS7Q548rLhny42tg8d4vyTNzFqvOnwqrgHXvgehT09U7fwrzxi3RxCiXjoNUNnNOlQ8A==";
+      };
+    };
     "urllib-2.40.0" = {
       name = "urllib";
       packageName = "urllib";
@@ -11161,10 +11179,10 @@ in
   n8n = nodeEnv.buildNodePackage {
     name = "n8n";
     packageName = "n8n";
-    version = "0.211.1";
+    version = "0.212.1";
     src = fetchurl {
-      url = "https://registry.npmjs.org/n8n/-/n8n-0.211.1.tgz";
-      sha512 = "hD3AnzqByEYy6GMgjk//81JFdaM8UEnklcYo8Sjm4LKlDtOnjFIUFpN78KUkLVjM4WEPWkLczITFPhHuYcHCXA==";
+      url = "https://registry.npmjs.org/n8n/-/n8n-0.212.1.tgz";
+      sha512 = "9i4U/dJ84TEFIkj++nx+u3lLgpOxeco5QjopG+Ejjv6Gd3Jc+oL8MF3opN9v0JWagPX+yOnszol6aN+U4Sl8tA==";
     };
     dependencies = [
       (sources."@acuminous/bitsyntax-0.1.2" // {
@@ -11256,13 +11274,13 @@ in
       sources."@azure/ms-rest-nodeauth-3.1.1"
       (sources."@azure/msal-browser-2.32.2" // {
         dependencies = [
-          sources."@azure/msal-common-9.0.2"
+          sources."@azure/msal-common-9.1.1"
         ];
       })
       sources."@azure/msal-common-7.6.0"
       (sources."@azure/msal-node-1.14.6" // {
         dependencies = [
-          sources."@azure/msal-common-9.0.2"
+          sources."@azure/msal-common-9.1.1"
         ];
       })
       (sources."@azure/storage-blob-12.12.0" // {
@@ -11271,10 +11289,10 @@ in
           sources."tslib-2.4.1"
         ];
       })
-      sources."@babel/parser-7.20.7"
-      sources."@babel/runtime-7.20.7"
+      sources."@babel/parser-7.20.13"
+      sources."@babel/runtime-7.20.13"
       sources."@codemirror/autocomplete-6.4.0"
-      sources."@codemirror/commands-6.1.3"
+      sources."@codemirror/commands-6.2.0"
       sources."@codemirror/lang-javascript-6.1.2"
       sources."@codemirror/language-6.4.0"
       sources."@codemirror/lint-6.1.0"
@@ -11285,7 +11303,7 @@ in
       sources."@curlconverter/yargs-0.0.2"
       sources."@curlconverter/yargs-parser-0.0.1"
       sources."@dabh/diagnostics-2.0.3"
-      sources."@fontsource/open-sans-4.5.13"
+      sources."@fontsource/open-sans-4.5.14"
       sources."@fortawesome/fontawesome-common-types-0.3.0"
       sources."@fortawesome/fontawesome-svg-core-1.3.0"
       (sources."@fortawesome/free-regular-svg-icons-6.2.1" // {
@@ -11298,7 +11316,7 @@ in
           sources."@fortawesome/fontawesome-common-types-0.2.36"
         ];
       })
-      sources."@fortawesome/vue-fontawesome-2.0.9"
+      sources."@fortawesome/vue-fontawesome-2.0.10"
       sources."@gar/promisify-1.1.3"
       (sources."@google-cloud/common-3.10.0" // {
         dependencies = [
@@ -11319,7 +11337,7 @@ in
         dependencies = [
           sources."@grpc/proto-loader-0.7.4"
           sources."long-5.2.1"
-          sources."protobufjs-7.1.2"
+          sources."protobufjs-7.2.0"
           sources."yargs-16.2.0"
         ];
       })
@@ -11370,7 +11388,7 @@ in
           sources."tslib-2.4.1"
         ];
       })
-      (sources."@oclif/core-1.24.0" // {
+      (sources."@oclif/core-1.26.1" // {
         dependencies = [
           sources."supports-color-8.1.1"
           sources."tslib-2.4.1"
@@ -11422,15 +11440,15 @@ in
           sources."domhandler-5.0.3"
         ];
       })
-      sources."@sentry/core-7.31.0"
-      sources."@sentry/integrations-7.31.0"
-      sources."@sentry/node-7.31.0"
-      sources."@sentry/types-7.31.0"
-      sources."@sentry/utils-7.31.0"
+      sources."@sentry/core-7.33.0"
+      sources."@sentry/integrations-7.33.0"
+      sources."@sentry/node-7.33.0"
+      sources."@sentry/types-7.33.0"
+      sources."@sentry/utils-7.33.0"
       sources."@servie/events-1.0.0"
       sources."@sqltools/formatter-1.2.5"
-      sources."@swc/core-1.3.27"
-      sources."@swc/wasm-1.3.27"
+      sources."@swc/core-1.3.28"
+      sources."@swc/wasm-1.3.28"
       sources."@techteamer/ocsp-1.0.0"
       sources."@tediousjs/connection-string-0.3.0"
       sources."@tokenizer/token-0.3.0"
@@ -11444,9 +11462,9 @@ in
       sources."@types/connect-3.4.35"
       sources."@types/duplexify-3.6.1"
       sources."@types/es-aggregate-error-1.0.2"
-      sources."@types/express-4.17.15"
+      sources."@types/express-4.17.16"
       sources."@types/express-jwt-0.0.42"
-      sources."@types/express-serve-static-core-4.17.32"
+      sources."@types/express-serve-static-core-4.17.33"
       sources."@types/express-unless-2.0.1"
       sources."@types/js-nacl-1.3.1"
       sources."@types/json-schema-7.0.11"
@@ -11468,7 +11486,7 @@ in
       sources."@types/stoppable-1.1.1"
       sources."@types/tough-cookie-2.3.8"
       sources."@types/tunnel-0.0.3"
-      sources."@types/validator-13.7.10"
+      sources."@types/validator-13.7.11"
       sources."@types/webidl-conversions-7.0.0"
       sources."@types/whatwg-url-8.2.2"
       sources."@vue/compiler-sfc-2.7.14"
@@ -11477,13 +11495,13 @@ in
           sources."vue-2.6.14"
         ];
       })
-      sources."@vue/devtools-api-6.4.5"
+      sources."@vue/devtools-api-6.5.0"
       sources."@xmldom/xmldom-0.8.6"
       sources."a-sync-waterfall-1.0.1"
       sources."abbrev-1.1.1"
       sources."abort-controller-3.0.0"
       sources."accepts-1.3.8"
-      sources."acorn-8.8.1"
+      sources."acorn-8.8.2"
       sources."acorn-walk-8.2.0"
       (sources."adal-node-0.2.4" // {
         dependencies = [
@@ -11556,7 +11574,7 @@ in
       })
       sources."available-typed-arrays-1.0.5"
       sources."avsc-5.7.7"
-      (sources."aws-sdk-2.1295.0" // {
+      (sources."aws-sdk-2.1301.0" // {
         dependencies = [
           sources."buffer-4.9.2"
           sources."events-1.1.1"
@@ -11570,7 +11588,7 @@ in
       sources."aws-sign2-0.7.0"
       sources."aws4-1.12.0"
       sources."axios-0.21.4"
-      sources."axios-retry-3.3.1"
+      sources."axios-retry-3.4.0"
       sources."babel-helper-vue-jsx-merge-props-2.0.3"
       (sources."babel-runtime-6.26.0" // {
         dependencies = [
@@ -11749,7 +11767,7 @@ in
       })
       sources."cookie-signature-1.0.6"
       sources."copy-to-2.0.1"
-      sources."core-js-3.27.1"
+      sources."core-js-3.27.2"
       sources."core-util-is-1.0.3"
       sources."crc-32-1.2.2"
       sources."create-require-1.1.1"
@@ -11863,6 +11881,7 @@ in
           sources."path-to-regexp-6.2.1"
         ];
       })
+      sources."express-prom-bundle-6.6.0"
       sources."express-unless-2.1.3"
       sources."extend-3.0.2"
       sources."extend-shallow-2.0.1"
@@ -11890,7 +11909,7 @@ in
       sources."file-uri-to-path-2.0.0"
       (sources."filelist-1.0.4" // {
         dependencies = [
-          sources."minimatch-5.1.4"
+          sources."minimatch-5.1.6"
         ];
       })
       sources."fill-range-7.0.1"
@@ -11942,7 +11961,7 @@ in
       sources."generate-function-2.3.1"
       sources."generic-pool-3.9.0"
       sources."get-caller-file-2.0.5"
-      sources."get-intrinsic-1.1.3"
+      sources."get-intrinsic-1.2.0"
       sources."get-package-type-0.1.0"
       sources."get-port-5.1.1"
       sources."get-symbol-description-1.0.0"
@@ -12063,7 +12082,7 @@ in
       sources."inquirer-7.3.3"
       sources."internal-slot-1.0.4"
       sources."interpret-1.4.0"
-      (sources."ioredis-5.2.5" // {
+      (sources."ioredis-5.2.6" // {
         dependencies = [
           sources."denque-2.1.0"
         ];
@@ -12343,7 +12362,7 @@ in
       sources."mqtt-packet-6.10.0"
       sources."ms-2.1.2"
       sources."msal-1.4.17"
-      sources."msgpackr-1.8.1"
+      sources."msgpackr-1.8.2"
       (sources."mssql-8.1.4" // {
         dependencies = [
           sources."commander-9.5.0"
@@ -12359,25 +12378,25 @@ in
         ];
       })
       sources."mz-2.7.0"
-      (sources."n8n-core-0.151.1" // {
+      (sources."n8n-core-0.151.2" // {
         dependencies = [
           sources."concat-stream-2.0.0"
           sources."readable-stream-3.6.0"
         ];
       })
       sources."n8n-design-system-0.51.1"
-      (sources."n8n-editor-ui-0.177.1" // {
+      (sources."n8n-editor-ui-0.178.1" // {
         dependencies = [
           sources."luxon-2.5.2"
         ];
       })
-      (sources."n8n-nodes-base-0.209.1" // {
+      (sources."n8n-nodes-base-0.210.1" // {
         dependencies = [
           sources."chokidar-3.5.2"
           sources."luxon-2.3.2"
         ];
       })
-      (sources."n8n-workflow-0.133.1" // {
+      (sources."n8n-workflow-0.133.2" // {
         dependencies = [
           sources."luxon-2.3.2"
         ];
@@ -12601,7 +12620,7 @@ in
           sources."pump-2.0.1"
         ];
       })
-      sources."punycode-2.2.0"
+      sources."punycode-2.3.0"
       sources."python-struct-1.1.3"
       sources."qs-6.11.0"
       sources."query-string-7.1.3"
@@ -12974,6 +12993,7 @@ in
         ];
       })
       sources."url-parse-1.5.10"
+      sources."url-value-parser-2.2.0"
       (sources."urllib-2.40.0" // {
         dependencies = [
           sources."debug-2.6.9"
diff --git a/pkgs/applications/science/biology/igv/default.nix b/pkgs/applications/science/biology/igv/default.nix
index b330f6b41a05..f6d767235b7f 100644
--- a/pkgs/applications/science/biology/igv/default.nix
+++ b/pkgs/applications/science/biology/igv/default.nix
@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   pname = "igv";
-  version = "2.15.4";
+  version = "2.15.5";
   src = fetchzip {
     url = "https://data.broadinstitute.org/igv/projects/downloads/${lib.versions.majorMinor version}/IGV_${version}.zip";
-    sha256 = "sha256-nDD0QTtLDe//VFMsIPKIykZ6dY85p3aomrCaF1p9HQM=";
+    sha256 = "sha256-AKKMtR0hU2O84mRJxxsXNCYHeW8d6t3XJpzOKKaxAWw=";
   };
 
   installPhase = ''
diff --git a/pkgs/applications/version-management/gh/default.nix b/pkgs/applications/version-management/gh/default.nix
index cb1690872c01..284da7b4fae2 100644
--- a/pkgs/applications/version-management/gh/default.nix
+++ b/pkgs/applications/version-management/gh/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "gh";
-  version = "2.21.2";
+  version = "2.22.0";
 
   src = fetchFromGitHub {
     owner = "cli";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "sha256-syd7OMBEMv9uJUDjIIqVkJ3pvuyKnD5pubG4d3TbkY8=";
+    sha256 = "sha256-kebBochGagpg26Q2bkpUTPMYYwwBpBVx2+ZtsErJWYk=";
   };
 
-  vendorSha256 = "sha256-m9K43Ns8j82nMkz+zkmC7HueOA6q6T4mFPQ1GSdqo24=";
+  vendorSha256 = "sha256-OjTl43UQGGHqCrw0kMBShuS8aonjWczfzQGmGJLhdrU=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/applications/version-management/gource/default.nix b/pkgs/applications/version-management/gource/default.nix
index 584dd97d3e22..d0175251e6ec 100644
--- a/pkgs/applications/version-management/gource/default.nix
+++ b/pkgs/applications/version-management/gource/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gource";
-  version = "0.53";
+  version = "0.54";
 
   src = fetchurl {
     url = "https://github.com/acaudwell/Gource/releases/download/${pname}-${version}/${pname}-${version}.tar.gz";
-    hash = "sha256-PV9kwcaBL2RMMgy8mphY35e8YDb8Hl9gPKRrFbjdcjc=";
+    hash = "sha256-HcvO32XSz01p/gtjPlTCApJsCLgpvK0Lc+r54pzW+uU=";
   };
 
   postPatch = ''
diff --git a/pkgs/data/fonts/gdouros/default.nix b/pkgs/data/fonts/gdouros/default.nix
index 171520e3d12f..c12e3f8e9fd3 100644
--- a/pkgs/data/fonts/gdouros/default.nix
+++ b/pkgs/data/fonts/gdouros/default.nix
@@ -1,32 +1,36 @@
-{ fetchzip, lib }:
+{ lib, stdenvNoCC, fetchzip }:
 
 let
   fonts = {
-    aegan     = { version = "13.00"; file = "Aegean.zip";       sha256 = "sha256-1DnbfL6bKn8Upht/ZYfKIp9kuDHq7y9E+jkt2Yhr38A="; description = "Aegean"; };
-    aegyptus  = { version = "13.00"; file = "Aegyptus.zip";     sha256 = "sha256-tObgHlhaquq6Akn/HdYKNfnKHHJP42yAT7lIn5qdCzY="; description = "Egyptian Hieroglyphs, Coptic, Meroitic"; };
-    akkadian  = { version = "13.00"; file = "Akkadian.zip";     sha256 = "sha256-iHiXfxMS9FIlrRgT23MfxzCqYJMQrKuKYDShrqB74vU="; description = "Sumero-Akkadian Cuneiform"; };
-    assyrian  = { version = "13.00"; file = "Assyrian.zip";     sha256 = "sha256-YjTQjv1Vybr14Sn9pUdbGYVf4ZIjGT+cpB1qCIg1NNQ="; description = "Neo-Assyrian in Unicode with OpenType"; };
-    eemusic   = { version = "13.00"; file = "EEMusic.zip";      sha256 = "sha256-PaYBJOV+dmRV1ehY7TwDNL9dz1jPo58I3N8lWX1Vmy8="; description = "Byzantine Musical Notation in Unicode with OpenType"; };
-    maya      = { version = "13.00"; file = "Maya%20Hieroglyphs.zip"; sha256 = "sha256-9uqGo4hweV1ydI+pEp76IqmHslWvxr87rTvziQs35bQ="; description = "Maya Hieroglyphs"; };
-    symbola   = { version = "13.00"; file = "Symbola.zip";      sha256 = "sha256-C9HmforXr/Hqopb3go+bzqRFcWPv+0rz0JZsXc3mcxw="; description = "Basic Latin, Greek, Cyrillic and many Symbol blocks of Unicode"; };
-    textfonts = { version = "13.00"; file = "Textfonts.zip";    sha256 = "sha256-1bDi5mwrT2I8gx6QdhnWjXATFdNAU9nt77BiFIci6C8="; description = "Aroania, Anaktoria, Alexander, Avdira and Asea"; };
-    unidings  = { version = "13.00"; file = "Unidings.zip";     sha256 = "sha256-6lSkDb603XIrBGy4fZhY7xYDd3x0qA0PRQOlQ9Roig0="; description = "Glyphs and Icons for blocks of The Unicode Standard"; };
+    aegan     = { version = "13.00"; file = "Aegean.zip";       hash = "sha256-3HmCqCMZLN6zF1N/EirQOPnHKTGHoc4aHKoZxFYTB34="; description = "Aegean"; };
+    aegyptus  = { version = "13.00"; file = "Aegyptus.zip";     hash = "sha256-SSAK707xhpsUTq8tSBcrzNGunCYad58amtCqAWuevnY="; description = "Egyptian Hieroglyphs, Coptic, Meroitic"; };
+    akkadian  = { version = "13.00"; file = "Akkadian.zip";     hash = "sha256-wXiDYyfujAs6fklOCqXq7Ms7wP5RbPlpNVwkUy7CV4k="; description = "Sumero-Akkadian Cuneiform"; };
+    assyrian  = { version = "13.00"; file = "Assyrian.zip";     hash = "sha256-CZj1sc89OexQ0INb7pbEu5GfE/w2E5JmhjT8cosoLSg="; description = "Neo-Assyrian in Unicode with OpenType"; };
+    eemusic   = { version = "13.00"; file = "EEMusic.zip";      hash = "sha256-LxOcQOPEImw0wosxJotbOJRbe0qlK5dR+kazuhm99Kg="; description = "Byzantine Musical Notation in Unicode with OpenType"; };
+    maya      = { version = "13.00"; file = "Maya%20Hieroglyphs.zip"; hash = "sha256-PAwF1lGqm6XVf4NQCA8AFLGU40N0Xsn5Q8x9ikHJDhY="; description = "Maya Hieroglyphs"; };
+    symbola   = { version = "13.00"; file = "Symbola.zip";      hash = "sha256-TsHWmzkEyMa8JOZDyjvk7PDhm239oH/FNllizNFf398="; description = "Basic Latin, Greek, Cyrillic and many Symbol blocks of Unicode"; };
+    textfonts = { version = "13.00"; file = "Textfonts.zip";    hash = "sha256-7S3NiiyDvyYoDrLPt2z3P9bEEFOEZACv2sIHG1Tn6yI="; description = "Aroania, Anaktoria, Alexander, Avdira and Asea"; };
+    unidings  = { version = "13.00"; file = "Unidings.zip";     hash = "sha256-WUY+Ylphep6WuzqLQ3Owv+vK5Yuu/aAkn4GOFXL0uQY="; description = "Glyphs and Icons for blocks of The Unicode Standard"; };
   };
 
-  mkpkg = name_: {version, file, sha256, description}: fetchzip rec {
-    name = "${name_}-${version}";
-    url = "https://dn-works.com/wp-content/uploads/2020/UFAS-Fonts/${file}";
-    stripRoot = false;
-    postFetch = ''
-      mkdir -p $out/share/{fonts/opentype,doc/${name_}}
-      mv $out/*.otf                -t "$out/share/fonts/opentype"
-      mv $out/*.{odt,ods,pdf,xlsx}       -t "$out/share/doc/${name_}"  || true  # install docs if any
-      find $out -type d -empty -delete
-      shopt -s extglob dotglob
-      rm -rf $out/!(share)
-      shopt -u extglob dotglob
+  mkpkg = pname: { version, file, hash, description }: stdenvNoCC.mkDerivation rec {
+    inherit pname version;
+
+    src = fetchzip {
+      url = "https://dn-works.com/wp-content/uploads/2020/UFAS-Fonts/${file}";
+      stripRoot = false;
+      inherit hash;
+    };
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out/share/{fonts/opentype,doc/${pname}}
+      mv *.otf                -t "$out/share/fonts/opentype"
+      mv *.{odt,ods,pdf,xlsx}       -t "$out/share/doc/${pname}"  || true  # install docs if any
+
+      runHook postInstall
     '';
-    inherit sha256;
 
     meta = {
       inherit description;
@@ -39,4 +43,4 @@ let
     };
   };
 in
-  lib.mapAttrs mkpkg fonts
+lib.mapAttrs mkpkg fonts
diff --git a/pkgs/data/fonts/hanazono/default.nix b/pkgs/data/fonts/hanazono/default.nix
index 29c982ed8aea..fc499534d1e3 100644
--- a/pkgs/data/fonts/hanazono/default.nix
+++ b/pkgs/data/fonts/hanazono/default.nix
@@ -1,19 +1,24 @@
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-let
+stdenvNoCC.mkDerivation rec {
+  pname = "hanazono";
   version = "20170904";
-in fetchzip {
-  name = "hanazono-${version}";
 
-  url = "mirror://osdn/hanazono-font/68253/hanazono-${version}.zip";
+  src = fetchzip {
+    url = "mirror://osdn/hanazono-font/68253/hanazono-${version}.zip";
+    stripRoot = false;
+    hash = "sha256-qd0q4wQnHBGLT7C+UQIiOHnxCnRCscMZcj3P5RRxD1U=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  postFetch = ''
     mkdir -p $out/share/{doc,fonts}
-    unzip -j $downloadedFile \*.ttf -d $out/share/fonts/truetype
-    unzip -j $downloadedFile \*.txt -d $out/share/doc/hanazono
-  '';
+    install -Dm644 *.ttf -t $out/share/fonts/truetype
+    install -Dm644 *.txt -t $out/share/doc/hanazono
 
-  sha256 = "0qiyd1vk3w8kqmwc6xi5d390wdr4ln8xhfbx3n8r1hhad9iz14p6";
+    runHook postInstall
+  '';
 
   meta = with lib; {
     description = "Japanese Mincho-typeface TrueType font";
diff --git a/pkgs/data/fonts/iwona/default.nix b/pkgs/data/fonts/iwona/default.nix
index 85cf06df11fb..0d3944b2da10 100644
--- a/pkgs/data/fonts/iwona/default.nix
+++ b/pkgs/data/fonts/iwona/default.nix
@@ -1,16 +1,18 @@
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, texlive }:
 
-let
-  version = "0_995";
-in fetchzip {
-  name = "iwona-${version}";
-  url = "http://jmn.pl/pliki/Iwona-otf-${version}.zip";
+stdenvNoCC.mkDerivation {
+  pname = "iwona";
+  version = "0.995b";
 
-  postFetch = ''
-    mkdir -p $out/share/fonts/opentype
-    unzip -j $downloadedFile *.otf -d $out/share/fonts/opentype
+  src = lib.head (builtins.filter (p: p.tlType == "run") texlive.iwona.pkgs);
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm644 fonts/opentype/nowacki/iwona/*.otf -t $out/share/fonts/opentype
+
+    runHook postInstall
   '';
-  sha256 = "1dcpn13bd31dw7ir0s722bv3nk136dy6qsab0kznjbzfqd7agswa";
 
   meta = with lib; {
     description = "A two-element sans-serif typeface, created by Małgorzata Budyta";
diff --git a/pkgs/data/fonts/kochi-substitute-naga10/default.nix b/pkgs/data/fonts/kochi-substitute-naga10/default.nix
index 63ca3cf3e432..ae216a789707 100644
--- a/pkgs/data/fonts/kochi-substitute-naga10/default.nix
+++ b/pkgs/data/fonts/kochi-substitute-naga10/default.nix
@@ -1,24 +1,24 @@
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-let version = "20030809";
-in
-fetchzip {
-  name = "kochi-substitute-naga10-${version}";
+stdenvNoCC.mkDerivation rec {
+  pname = "kochi-substitute-naga10";
+  version = "20030809";
 
-  url = "mirror://osdn/efont/5411/kochi-substitute-${version}.tar.bz2";
+  src = fetchzip {
+    url = "mirror://osdn/efont/5411/kochi-substitute-${version}.tar.bz2";
+    stripRoot = false;
+    hash = "sha256-dRJAxeVGYcNjLWqJJ+9Z2FW3BHrgyGRzlgM2x5YG3AM=";
+  };
 
-  stripRoot = false;
+  installPhase = ''
+    runHook preInstall
 
-  postFetch = ''
     mkdir -p $out/share/fonts/truetype
-    mv $out/*/kochi-gothic-subst.ttf $out/share/fonts/truetype/kochi-gothic-subst-naga10.ttf
-    mv $out/*/kochi-mincho-subst.ttf $out/share/fonts/truetype/kochi-mincho-subst-naga10.ttf
-    shopt -s extglob dotglob
-    rm -rf $out/!(share)
-    shopt -u extglob dotglob
-  '';
+    mv */kochi-gothic-subst.ttf $out/share/fonts/truetype/kochi-gothic-subst-naga10.ttf
+    mv */kochi-mincho-subst.ttf $out/share/fonts/truetype/kochi-mincho-subst-naga10.ttf
 
-  sha256 = "sha256-SZ7ZJYuCYU0NxWHlEszbvFmyZxWeBtmPL204PjIrS64=";
+    runHook postInstall
+  '';
 
   meta = {
     description = "Japanese font, non-free replacement for MS Gothic and MS Mincho";
diff --git a/pkgs/data/fonts/lohit-fonts/default.nix b/pkgs/data/fonts/lohit-fonts/default.nix
index 64ae831767bb..53bccc4a40a7 100644
--- a/pkgs/data/fonts/lohit-fonts/default.nix
+++ b/pkgs/data/fonts/lohit-fonts/default.nix
@@ -1,35 +1,38 @@
-{ fetchzip, lib }:
+{ lib, stdenvNoCC, fetchurl }:
 let
   fonts = {
-    assamese        = { label = "Assamese";          version = "2.91.5"; sha256 = "06cw416kgw0m6883n5ixmpniinsd747rdmacf06z83w1hqwj2js6"; };
-    bengali         = { label = "Bengali";           version = "2.91.5"; sha256 = "1j7gfmkzzyk9mivy09a9yfqxpidw52hw48dyh4qkci304mspcbvr"; };
-    devanagari      = { label = "Devanagari script"; version = "2.95.4"; sha256 = "1c17xirzx5rf7xpmkrm94jf9xrzckyagwnqn3pyag28lyj8x67m5"; };
-    gujarati        = { label = "Gujarati";          version = "2.92.4"; sha256 = "0xdgmkikz532zxj239wr73l24qnzxhra88f52146x7fsb7gpvfb1"; };
-    gurmukhi        = { label = "Gurmukhi script";   version = "2.91.2"; sha256 = "1xk1qvc0xwcmjcavj9zmy4bbphffdlv7sldmqlk30ch5fy5r0ypb"; }; # renamed from Punjabi
-    kannada         = { label = "Kannada";           version = "2.5.4" ; sha256 = "0sax56xg98p2nf0nsvba42hhz946cs7q0gidiz9zfpb6pbgwxdgg"; };
-    malayalam       = { label = "Malayalam";         version = "2.92.2"; sha256 = "18sca59fj9zvqhagbix35i4ld2n4mwv57q04pijl5gvpyfb1abs8"; };
-    marathi         = { label = "Marathi";           version = "2.94.2"; sha256 = "0cjjxxlhqmdmhr35s4ak0ma89456daik5rqrn6pdzj39098lmci7"; };
-    nepali          = { label = "Nepali";            version = "2.94.2"; sha256 = "1p7lif136xakfqkbv6p1lb56rs391b25vn4bxrjdfvsk0r0h0ry3"; };
-    odia            = { label = "Odia";              version = "2.91.2"; sha256 = "0z5rc4f9vfrfm8h2flzf5yx44x50jqdmmzifkmjwczib3hpg2ila"; }; # renamed from Oriya
-    tamil-classical = { label = "Classical Tamil";   version = "2.5.4" ; sha256 = "0svmj3dhk0195mhdwjhi3qgwa83223irb32fp12782sj9njdvyi2"; };
-    tamil           = { label = "Tamil";             version = "2.91.3"; sha256 = "0qyw9p8alyvjryyw8a25q3gfyrhby49mjb0ydgggf5ckd07kblcm"; };
-    telugu          = { label = "Telugu";            version = "2.5.5" ; sha256 = "07p41686ypmclj9d3njp01lvrgssqxa4s5hsbrqfjrnwd3rjspzr"; };
+    assamese        = { label = "Assamese";          version = "2.91.5"; hash = "sha256-Oo/hHHFg/Nu3eaZLMdBclY90lKU2AMFUclyXHxGaAgg="; };
+    bengali         = { label = "Bengali";           version = "2.91.5"; hash = "sha256-QGf94TdQS2c9+wSSDK4Mknw5ubCGTuvg0xoNaJdirBc="; };
+    devanagari      = { label = "Devanagari script"; version = "2.95.4"; hash = "sha256-6CbOCqOei5eO1zwNQZvB+fFDkqxvJnK82z+zmClhRAE="; };
+    gujarati        = { label = "Gujarati";          version = "2.92.4"; hash = "sha256-BpwibF0/HXDvXpDEek0fj73cxo2QC1hSfQ49Q/ZOZg8="; };
+    gurmukhi        = { label = "Gurmukhi script";   version = "2.91.2"; hash = "sha256-5iLFW2FEE5LBqoALi+3sUjwC0ADntsp259TP+bYwR9g="; }; # renamed from Punjabi
+    kannada         = { label = "Kannada";           version = "2.5.4" ; hash = "sha256-7y2u0tBdNYCeY7Y+aqhxXP7Qv6GglJeVO1wvM9CzyIQ="; };
+    malayalam       = { label = "Malayalam";         version = "2.92.2"; hash = "sha256-SzM38vuAlP9OMC8kUuHQylmH8TUjCeg1y/Zcu2I2bjA="; };
+    marathi         = { label = "Marathi";           version = "2.94.2"; hash = "sha256-jK1Gwcr5gqzRNkbIxs4V/OYgUlUEpU0OYzKDTkiMlqM="; };
+    nepali          = { label = "Nepali";            version = "2.94.2"; hash = "sha256-OX1ekxeSbVGOrdbZ3Jvu4nii0zkgbuij10JIzqRcFx4="; };
+    odia            = { label = "Odia";              version = "2.91.2"; hash = "sha256-3/eczBGGZj4QPs7KY0as9zk5HaBfhgz6YgU0qmwpVcA="; }; # renamed from Oriya
+    tamil-classical = { label = "Classical Tamil";   version = "2.5.4" ; hash = "sha256-6SsddTCEUHMoF7X4+i7eXimmMuktfFAl8uz95RwM+yg="; };
+    tamil           = { label = "Tamil";             version = "2.91.3"; hash = "sha256-8lcNw87o9lhQsKwCqwBSfx7rhcrH/eEqac7EsA9/w/E="; };
+    telugu          = { label = "Telugu";            version = "2.5.5" ; hash = "sha256-cZh93NfEB+5S1JeEowtBMJ0nbZsFGpbEp2WAtzxrA8A="; };
   };
   gplfonts = {
     # GPL fonts removed from later releases
-    kashmiri        = { label = "Kashmiri";          version = "2.4.3" ; sha256 = "0c6whklad9bscymrlcbxj4fdvh4cdf40vb61ykbp6mapg6dqxwhn"; };
-    konkani         = { label = "Konkani";           version = "2.4.3" ; sha256 = "0pcb5089dabac1k6ymqnbnlyk7svy2wnb5glvhsd8glycjhrcp70"; };
-    maithili        = { label = "Maithili";          version = "2.4.3" ; sha256 = "1yfwv7pcj7k4jryz0s6mb56bq7fs15g56y7pi5yd89q1f8idk6bc"; };
-    sindhi          = { label = "Sindhi";            version = "2.4.3" ; sha256 = "1iywzyy185bvfsfi5pp11c8bzrp40kni2cpwcmxqwha7c9v8brlc"; };
+    kashmiri        = { label = "Kashmiri";          version = "2.4.3" ; hash = "sha256-6T2QaWnt3+e5nr4vbk44FouqmeWKzia1lSf8S/bvqCs="; };
+    konkani         = { label = "Konkani";           version = "2.4.3" ; hash = "sha256-hVy2rxrUTPDeNnugi3Bk7z0JqGmk4/yeUsAoI/4R7A8="; };
+    maithili        = { label = "Maithili";          version = "2.4.3" ; hash = "sha256-ikDcpJqdizAYRpgoebzqxOEeodJ6C3fO2rsqGzC0HCs="; };
+    sindhi          = { label = "Sindhi";            version = "2.4.3" ; hash = "sha256-wU3B9fh+8E1bFBMnakzmajY7eNKzed9+eYL5AOxyNQI="; };
   };
 
-  mkpkg = license: name: {label, version, sha256}: fetchzip {
-    name = "lohit-${name}-${version}";
+  mkpkg = license: pname: {label, version, hash}: stdenvNoCC.mkDerivation {
+    inherit pname version;
 
-    url = "https://releases.pagure.org/lohit/lohit-${name}-ttf-${version}.tar.gz";
+    src = fetchurl {
+      url = "https://releases.pagure.org/lohit/lohit-${pname}-ttf-${version}.tar.gz";
+      inherit hash;
+    };
 
-    postFetch = ''
-      tar -xzf $downloadedFile --strip-components=1
+    installPhase = ''
+      runHook preInstall
 
       mkdir -p $out/share/fonts/truetype
       cp -v *.ttf $out/share/fonts/truetype/
@@ -37,11 +40,11 @@ let
       mkdir -p $out/etc/fonts/conf.d
       cp -v *.conf $out/etc/fonts/conf.d
 
-      mkdir -p "$out/share/doc/lohit-${name}"
-      cp -v ChangeLog* COPYRIGHT* "$out/share/doc/lohit-${name}/"
-    '';
+      mkdir -p "$out/share/doc/lohit-${pname}"
+      cp -v ChangeLog* COPYRIGHT* "$out/share/doc/lohit-${pname}/"
 
-    inherit sha256;
+      runHook postInstall
+    '';
 
     meta = {
       inherit license;
diff --git a/pkgs/data/fonts/mplus-outline-fonts/default.nix b/pkgs/data/fonts/mplus-outline-fonts/default.nix
index c3def549aa43..93e508ecd43c 100644
--- a/pkgs/data/fonts/mplus-outline-fonts/default.nix
+++ b/pkgs/data/fonts/mplus-outline-fonts/default.nix
@@ -1,16 +1,23 @@
-{ lib, fetchzip, fetchFromGitHub }:
+{ lib, stdenvNoCC, fetchurl, fetchFromGitHub }:
 
 let pname = "mplus-outline-fonts";
-in {
-  osdnRelease = fetchzip {
-    name = "${pname}-osdn";
-    url = "mirror://osdn/mplus-fonts/62344/mplus-TESTFLIGHT-063a.tar.xz";
-    sha256 = "sha256-+VN+aFx5hMlWwtk+FM+vL6G07+yEi9kYYsoQLSfMUZo=";
-    postFetch = ''
-      install -m444 -Dt $out/share/fonts/truetype/${pname} $out/*.ttf
-      shopt -s extglob dotglob
-      rm -rf $out/!(share)
-      shopt -u extglob dotglob
+in
+{
+  osdnRelease = stdenvNoCC.mkDerivation {
+    pname = "${pname}-osdn";
+    version = "063a";
+
+    src = fetchurl {
+      url = "mirror://osdn/mplus-fonts/62344/mplus-TESTFLIGHT-063a.tar.xz";
+      hash = "sha256-ROuXO0tq/1dN5FTbEF3cI+Z0nCKUc0vZyx4Nc05M3Xk=";
+    };
+
+    installPhase = ''
+      runHook preInstall
+
+      install -m444 -Dt $out/share/fonts/truetype/${pname} *.ttf
+
+      runHook postInstall
     '';
 
     meta = with lib; {
@@ -22,19 +29,25 @@ in {
     };
   };
 
-  githubRelease = fetchFromGitHub {
-    name = "${pname}-github";
-    owner = "coz-m";
-    repo = "MPLUS_FONTS";
-    rev = "336fec4e9e7c1e61bd22b82e6364686121cf3932";
-    sha256 = "sha256-LSIyrstJOszll72mxXIC7EW4KEMTFCaQwWs59j0UScE=";
-    postFetch = ''
+  githubRelease = stdenvNoCC.mkDerivation {
+    pname = "${pname}-github";
+    version = "unstable-2022-05-19";
+
+    src = fetchFromGitHub {
+      owner = "coz-m";
+      repo = "MPLUS_FONTS";
+      rev = "336fec4e9e7c1e61bd22b82e6364686121cf3932";
+      hash = "sha256-jzDDUs1dKjqNjsMeTA2/4vm+akIisnOuE2mPQS7IDSA=";
+    };
+
+    installPhase = ''
+      runHook preInstall
+
       mkdir -p $out/share/fonts/{truetype,opentype}/${pname}
-      mv $out/fonts/ttf/* $out/share/fonts/truetype/${pname}
-      mv $out/fonts/otf/* $out/share/fonts/opentype/${pname}
-      shopt -s extglob dotglob
-      rm -rf $out/!(share)
-      shopt -u extglob dotglob
+      mv fonts/ttf/* $out/share/fonts/truetype/${pname}
+      mv fonts/otf/* $out/share/fonts/opentype/${pname}
+
+      runHook postInstall
     '';
 
     meta = with lib; {
diff --git a/pkgs/data/fonts/nerdfonts/shas.nix b/pkgs/data/fonts/nerdfonts/shas.nix
index e7ea24935d97..b8b5f490e3d6 100644
--- a/pkgs/data/fonts/nerdfonts/shas.nix
+++ b/pkgs/data/fonts/nerdfonts/shas.nix
@@ -1,55 +1,55 @@
 {
-  "3270" = "1icrqgi7i7cf4jhgpdymv2mkvwh5lgx6yfbs3lrj6jxyhyv14mjj";
-  "Agave" = "0ar50csbsx0rhm3zbi3jf2c9r7wpx20lpmij1i205p53qbiihpv1";
-  "AnonymousPro" = "1is1jgxslmjy4pag137yyh99cf6dvlbkwwnaf91i73ad2w2mm2hm";
-  "Arimo" = "0a5s4flni7wggw5cc9mcc0ipcbmm786fmh2b2y7kp2d3i92sq76x";
-  "AurulentSansMono" = "10agjvrr18ddh8gmdv3ih2lxvrklc65vwsrzzi89h0f8jcas50l5";
-  "BigBlueTerminal" = "130p26r3b2m66ycd549sirvysicr3ld3l8qmrdfw9fr4jva8767s";
-  "BitstreamVeraSansMono" = "02dwhxs7agr3nbwslimryd3wq41wxsw9as0dk3czyjwrgiiwqbzh";
-  "CascadiaCode" = "1y06c8sfwy3pbxda56z7b7awrhia30f7xylj4m1wsnqql5bkwz21";
-  "CodeNewRoman" = "07y2yv9yi35lksiinpm0pxl5jjlbhffnm3mqjqr9292k0d76wrr8";
-  "Cousine" = "1cr1l25ynis1wf9rh0hdyaj4v4cvpv8ci359qjlhhpai5vspr273";
-  "DaddyTimeMono" = "1qj1fqrass97hnn2vm9wdmhyn99w5xk1swm2b1kp70bjbp4jarvh";
-  "DejaVuSansMono" = "03z80lhg128r4ivpcixcxfradn2n9hnwdk2bnbk7z5brqskh0sfy";
-  "DroidSansMono" = "17kvbcsasvfz339ld390msw8715ydfd5vvfm8rm6lyb34rv1z53s";
-  "FantasqueSansMono" = "0whjkl0dk1w4f29vw4jnzx8zwll9fl1axxnmsch9pcm3q7rwzpb5";
-  "FiraCode" = "0wn127x4i4l64v8ql32fw64k82iv9z6q0gkf5p285dcrlbjih04x";
-  "FiraMono" = "0cl4ssdylydwm4zhms2400c7idg0mf7yzsqds2qm7im744m6gkr7";
-  "FontPatcher" = "0hidpffswnz4375s61wq76djn0wilcgcmwz4b0v5gs4hz0zj0yp2";
-  "Go-Mono" = "1w9a507lnxv50x0xlj28ypijvvgcmypk6i27i367gkwsnnn6sqpp";
-  "Gohu" = "11gd9mzj6jwkxq3mxa33i0gb3s5f3dn00lnw360pamc5dyakr6l0";
-  "Hack" = "05vp3315bigfnr6p2fb884jrw489lhhpfqp764h51rldhf6674pj";
-  "Hasklig" = "081z71gfk3i1dqmy6myjygrk65bd7ln6p761i8j6sw3jx0567ml6";
-  "HeavyData" = "1fawn2xfq5js661s5wqjpfbfksg6n38r6n4x6zcgmr47g5hpnpmn";
-  "Hermit" = "0gz6vhlgpaljg41w1fddrv58jxjrngyi101vzm2gc8gp7ym4m4ad";
-  "iA-Writer" = "09m4039hzjqinx3ilzddq2msb64iz1y0ba43k2jd33b66svpi37a";
-  "IBMPlexMono" = "0vwrqy0v2swfh63ikp1lbh6cl4f2qv2q28lk2f2dd6kzzg28p6qj";
-  "Inconsolata" = "0n4nqbry3i019b9zbcawjqn5i7kf04p542sbbmnpi6vpfiv7fi5c";
-  "InconsolataGo" = "1q2dq0jrcd1f611icj1zcwp3zbdrrfxq5882d7blkrbhnlj3jywy";
-  "InconsolataLGC" = "0y29y7vk3x2jvi0ca8lxb8z2w9ww00gpsvkh5qvwxxqxhp5qjafk";
-  "Iosevka" = "1j7bb0vf0hxvi55w4q3bnqhqwn9pp2i58mj79nz0qi59sals3qbm";
-  "JetBrainsMono" = "146w91f1x4709wf52c2rh315qcgpph61cgr07ysn154hnwg5miqj";
-  "Lekton" = "1s5dmk24n119hlsj2aw99d5g564adn40vmyrqgzi3kh72zpqlixy";
-  "LiberationMono" = "06miqkf15h8ficd44rh755lw56i2nqcyxaf0vwa2zvls0v5mk2ar";
-  "Lilex" = "0zbgkj20dqnb5hmh52cmcn175zhc55bz1h1gi3ngmfi6nwgn20vz";
-  "Meslo" = "1d94ligqlngj4lwclah1w3ksvb3wg1iqjpmgblnxl36cd965pjqm";
-  "Monofur" = "1x43siij45h7yz1cw8i32kvdqx1n6zgc9qrj179ms1jl180lj1pj";
-  "Monoid" = "183qd1gpf78j2bipr4xh43kwaidlw3sfl8czzngkfdbpymssqak4";
-  "Mononoki" = "1vpdcmwb406rxgvbarhmb3fpzaj53xgg05nagr33vhpzp7d999b1";
-  "MPlus" = "1a7pb4dvh38bsdsjpbnb01pyn07rx0pwwr287i4vy1p46i39qm9m";
-  "NerdFontsSymbolsOnly" = "0zgjvggb7ipssnjcqlw230pkb4vqpl6xzq42wqk9pcgsv7wg09nv";
-  "Noto" = "17p48ig61dgzgd7fyppw65vdj1isg85w4xcxqjkaqx1225w4k8f9";
-  "OpenDyslexic" = "0ypzyhh00vgd1ws6wh23sph9ycp193y5x9aimscxir8sdbnx3sxp";
-  "Overpass" = "19k8kj9gid1m52b55s5jn8m5kslsgm16jqdifj5as2pd2bgjpwbh";
-  "ProFont" = "1wrmh6jqkbygwba7nsfq5ycw84rqp4mpr10bd50cr7p9inkddq3n";
-  "ProggyClean" = "066k2zdihv1x6vbsdalw5cyygmw27b32jvnvq774ry9bbz8yv4l1";
-  "RobotoMono" = "1glqsz3h7rxs55jf8bycvzxd2snf7jd9qgd4ra0jn8h0qkgvsfgd";
-  "ShareTechMono" = "0j3ribfylx3hnqir7i82pgyb56qlvlzp1y1c6lwvw8k15d06y7fi";
-  "SourceCodePro" = "0zdy8xr2ka9m64d69380plz3xaq08rxwdv8idzxbkhfykrp1j3cz";
-  "SpaceMono" = "1nqkqj0jxfj54wlcs6d2618b89y2fs2pg77kvfr4bc45lrqlbxzk";
-  "Terminus" = "00qyvxjv7aa90xn4bmpygwm0llzd1rr7y0szdbv7h5n7i80yx29s";
-  "Tinos" = "11ii28g1wv6ajpkbvw51vg47s3ww4lss46mh4pd0pf0fzz54gfcc";
-  "Ubuntu" = "0vc8rfpqvajj4xd3anqrnx8g54mhnz9z2h4287g21qf2n1qqagn4";
-  "UbuntuMono" = "0rzd625krvvf1c04172ck2507szm9fq6isydgqyhhkr1kwzx5pzq";
-  "VictorMono" = "09nf02zig9kvgvqqwd6dynx3cidjnlq8sa3qxqw3b313pzia8k3i";
+  "3270" = "03rf3prn4c9q5mggbdzpp3la7in1dq12anqxjpinxwla7ngdh4rv";
+  "Agave" = "177b2yljw4fxbsmjp8yrwvjzj9186f8g0s59xnz56nrl9ndx84qm";
+  "AnonymousPro" = "0qn5xa37g9y47ski5hc2vxhvfbfpl58ranpziiw733kv83pkbkq6";
+  "Arimo" = "0b69gh5qgl0v6b1cirma7l32yxj2d53w305gpfr6flral3ljq6if";
+  "AurulentSansMono" = "165hfg67061zqbs28fl66ldi910n5pnzb6n6d39wh70pclgy2g4n";
+  "BigBlueTerminal" = "1adindb4lvihya3mphmshk4vigragskyrx6ixydrp8i1f7s9sp20";
+  "BitstreamVeraSansMono" = "0mi9j69f8s48fygwb7fz9m81871nvajh895mpch7qj69xmpp9acs";
+  "CascadiaCode" = "13vlfbagjx033j97li6ypvr0zhxbm96lcz8xcn715225mslr2ib4";
+  "CodeNewRoman" = "1r4q48p315x021m0qrd1xmfgqw4xif3snlc764hq5iy10vxdv9ni";
+  "Cousine" = "18m2dlcg6dymi0xwrky4q7ynjx4bqnr5lnvbgr9cdnyf3zz9b6rj";
+  "DaddyTimeMono" = "0qq5lb4xpqggaz0bml8c2awlgwal6xvyx9nydxqgs672jq7hn1cd";
+  "DejaVuSansMono" = "1qnl6gyfyq4cyx0nyl7f39cm3mz33rfngv9kq2g7b187n4dmawaa";
+  "DroidSansMono" = "1l2cl2ryv9p7wlg6q5zsmg5wmfp27s3h47lq75d07chydyr08vii";
+  "FantasqueSansMono" = "1m2xkr7dhfa9bn9vha0s1x7sl1n8l1kdl8f4c876cwjh1mvrwkar";
+  "FiraCode" = "02gnxi9rs25i7mpzkir62w6khvijpma0j0sm3a7gfm0kfdkqzi8j";
+  "FiraMono" = "1kn5vl90xi6ba7msfgwvv9frpfr33xv8q93r62lnqs3avfk743j9";
+  "FontPatcher" = "039yiz7clkghyc6djf4zcaq6k83w2jhxcy66z4i9zmqh3km81wlr";
+  "Go-Mono" = "0bmd7r38ss754gpkndlag0gxap5ga473y778fyrrr3ccccg6d8iv";
+  "Gohu" = "0cvfdli8kzrd9n2h152432f8zr9ffvp29vsfcf98nla3ax2p0v05";
+  "Hack" = "1q3xdlpxps41pi724697mb5bc98mmql8s2lc4xh9zwddjvchd3zl";
+  "Hasklig" = "0xmg0h5bjjiqj00pv51q2babfm7j6bl1b8r1w26z95jvrpnifi1z";
+  "HeavyData" = "1rppgk2lj95kv67c9s97wkqkbrmyp5y7qm1b0a1sk49sg7l4mljp";
+  "Hermit" = "1cw8ia9b5adb7z63cag6l25sahp82gr6bsz9qqc3p12nzi5lxsk8";
+  "iA-Writer" = "01bx8j6hqpl5zmx96d6zrwn3n6ckic5zxr53wls6zdmp01wnkg72";
+  "IBMPlexMono" = "1m1qzxls16cfsxwly5r4vlwpfv477sf3gi6yj9krvkxp0d5ymz74";
+  "Inconsolata" = "1vavavjdiwrlxy9klp0cm6pvmr0nkl7dpls7ja79zgkw7yjhsifq";
+  "InconsolataGo" = "0cp76c6s2r3q8vgild0jpc94b13ypzbyvmas9gwhq1mvf24k4jp5";
+  "InconsolataLGC" = "16a59y1idqp1zgkw9wxcdgcjg6bjlxwbj3a3a00h4gwkczlp2r42";
+  "Iosevka" = "0qg88d2rqbm1x0vfyyr495dznnviga8979dg0ik5yw27fc43hrjj";
+  "JetBrainsMono" = "19ja9dksxq2dl2hi8nyflvl7skyi2wd65s4z14jcilbynxmk2z0q";
+  "Lekton" = "03378znmbss5qq75jmc0r51qwpxsiy2ng8gi164s2mjykr83gr2n";
+  "LiberationMono" = "13r13drx8r1mkbndfw6ip48sjyhf6qw0wgrwyqlgz5dcm3z9c3gx";
+  "Lilex" = "1w2iw9ksnkmwa37a30vrlwg6sxh6l19wc95f8s5mx06sa3ywfs11";
+  "Meslo" = "0fli7njkhq89ykdmdch313mzswlb23b716d0656qw8q3fbyh9dzh";
+  "Monofur" = "0lhfm5dxh4nsq0whwvpqbr2grb27pl03wi7l7vdjbf5x1iacrpfp";
+  "Monoid" = "1jrknl6yz6k6a8l9iiw2s74xkfqckn9y9vjdk49cyf2iy3fzbi30";
+  "Mononoki" = "0jw1kx7ryakx1wdgk9jf2ygrcq65wjaar5w1bggv5zlsxpxdllis";
+  "MPlus" = "1lvmv4vcs36137fv1vbw3vnyxxar8klgngn77202lhgvgi44x60a";
+  "NerdFontsSymbolsOnly" = "0sizriiwa7xh2dscz96gyr4sg04dxxi4f3sv27qk3g46vq0ciw4w";
+  "Noto" = "0dwjj3l7ryx7ysbnp5hh81n3qqqn3yf4h8jypm4ri96vf360myad";
+  "OpenDyslexic" = "1gpmzcgp6bpidi8h1l5a0n3q912swqk04mdhqwpqskj1jn77d2hb";
+  "Overpass" = "1ywp6fphy6akdfd96a37jqcjqry9w15zr0r609vf5a11n1aq3s0w";
+  "ProFont" = "0g3qa8lcp199mln5myn3yn4hdgyx3n16ajdm8a7anjfi9im2i6ns";
+  "ProggyClean" = "0q4m7kq3k0ga6i2kr6a4k59na8b7m6zvvj9zyp61375lm6wb3bv2";
+  "RobotoMono" = "0j055qjm0x4ksy19snplykm9dm9jkmn9swsis49k96mfw7wx9mfq";
+  "ShareTechMono" = "055hg15ghd1ca8wxq3sfjpck8w4x6qnzjyn3r8rslyrbhl51v9aj";
+  "SourceCodePro" = "05fs5ralnz9m6zdck9bvzf1rjgr4f5m1fr9m51cmr60wzhag9qsz";
+  "SpaceMono" = "1m3x85qzykxg5mb56d1zgl367q55ndndxzzmsrlibmybqvc1ffq9";
+  "Terminus" = "0fkqd85qfp8dk8sbyjfxirfiwlfl9a40z8jhybzzd7ys4yrzlq1c";
+  "Tinos" = "11bbg7ssf7wndxrm6kklggsfhmyaijfg4xi6cw743kcwzfvi8kd1";
+  "Ubuntu" = "14w55vh42mz5lvbpl4p1vx31hba957c5345qfpmym5majz83hx3q";
+  "UbuntuMono" = "1xybn0q1xx5sidhllna5y7584fl75qw6v5alb2p1b6933a5czg0m";
+  "VictorMono" = "02c5c9ljnmkf4awfhbjna6g86220ckv977rrc1sh6qr7q8zci6vr";
 }
diff --git a/pkgs/data/fonts/nerdfonts/version.nix b/pkgs/data/fonts/nerdfonts/version.nix
index 78c409bb9d7d..1719346d0931 100644
--- a/pkgs/data/fonts/nerdfonts/version.nix
+++ b/pkgs/data/fonts/nerdfonts/version.nix
@@ -1 +1 @@
-"2.3.0"
+"2.3.3"
diff --git a/pkgs/data/fonts/rounded-mgenplus/default.nix b/pkgs/data/fonts/rounded-mgenplus/default.nix
index eccbddd1851d..688518150fc7 100644
--- a/pkgs/data/fonts/rounded-mgenplus/default.nix
+++ b/pkgs/data/fonts/rounded-mgenplus/default.nix
@@ -1,17 +1,25 @@
-{ lib, fetchzip, p7zip }:
+{ lib, stdenvNoCC, fetchurl, p7zip }:
 
-let
+stdenvNoCC.mkDerivation rec {
   pname = "rounded-mgenplus";
   version = "20150602";
-in fetchzip rec {
-  name = "${pname}-${version}";
 
-  url = "https://osdn.jp/downloads/users/8/8598/${name}.7z";
-  postFetch = ''
-    ${p7zip}/bin/7z x $downloadedFile
+  src = fetchurl {
+    url = "https://osdn.jp/downloads/users/8/8598/${pname}-${version}.7z";
+    hash = "sha256-7OpnZJc9k5NiOPHAbtJGMQvsMg9j81DCvbfo0f7uJcw=";
+  };
+
+  sourceRoot = ".";
+
+  nativeBuildInputs = [ p7zip ];
+
+  installPhase = ''
+    runHook preInstall
+
     install -m 444 -D -t $out/share/fonts/${pname} ${pname}-*.ttf
+
+    runHook postInstall
   '';
-  sha256 = "0vwdknagdrl5dqwpb1x5lxkbfgvbx8dpg7cb6yamgz71831l05v1";
 
   meta = with lib; {
     description = "A Japanese font based on Rounded M+ and Noto Sans Japanese";
diff --git a/pkgs/data/icons/vanilla-dmz/default.nix b/pkgs/data/icons/vanilla-dmz/default.nix
index 0d3f273d5bb2..22b66b1c65dc 100644
--- a/pkgs/data/icons/vanilla-dmz/default.nix
+++ b/pkgs/data/icons/vanilla-dmz/default.nix
@@ -25,18 +25,30 @@ stdenvNoCC.mkDerivation rec {
   dontDropIconThemeCache = true;
 
   buildPhase = ''
-    cd DMZ-White/pngs; ./make.sh; cd -
-    cd DMZ-Black/pngs; ./make.sh; cd -
+    runHook preBuild
+
+    for theme in DMZ-{White,Black}; do
+      pushd $theme/pngs
+      ./make.sh
+      popd
+    done
+
+    runHook postBuild
   '';
 
   installPhase = ''
-    install -d $out/share/icons/Vanilla-DMZ/cursors
-    cp -a DMZ-White/xcursors/* $out/share/icons/Vanilla-DMZ/cursors
-    install -Dm644 DMZ-White/index.theme $out/share/icons/Vanilla-DMZ/index.theme
+    runHook preInstall
 
-    install -d $out/share/icons/Vanilla-DMZ-AA/cursors
-    cp -a DMZ-Black/xcursors/* $out/share/icons/Vanilla-DMZ-AA/cursors
-    install -Dm644 DMZ-Black/index.theme $out/share/icons/Vanilla-DMZ-AA/index.theme
+    for theme in DMZ-{White,Black}; do
+      mkdir -p $out/share/icons/$theme/cursors
+      cp -a $theme/xcursors/* $out/share/icons/$theme/cursors/
+      install -m644 $theme/index.theme $out/share/icons/$theme/index.theme
+    done
+
+    ln -s $out/share/icons/{DMZ-White,Vanilla-DMZ}
+    ln -s $out/share/icons/{DMZ-Black,Vanilla-DMZ-AA}
+
+    runHook postInstall
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/compilers/fstar/default.nix b/pkgs/development/compilers/fstar/default.nix
index e38f416b261b..d084889dcac9 100644
--- a/pkgs/development/compilers/fstar/default.nix
+++ b/pkgs/development/compilers/fstar/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, writeScript, fetchFromGitHub, z3, ocamlPackages, makeWrapper, installShellFiles }:
+{ lib, stdenv, writeScript, fetchFromGitHub, z3, ocamlPackages, makeWrapper, installShellFiles, removeReferencesTo }:
 
 stdenv.mkDerivation rec {
   pname = "fstar";
@@ -16,6 +16,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     makeWrapper
     installShellFiles
+    removeReferencesTo
   ] ++ (with ocamlPackages; [
     ocaml
     findlib
@@ -55,6 +56,10 @@ stdenv.mkDerivation rec {
     mkdir -p $out/lib/ocaml/${ocamlPackages.ocaml.version}/site-lib/fstarlib
   '';
   postInstall = ''
+    # Remove build artifacts
+    find $out -name _build -type d | xargs -I{} rm -rf "{}"
+    remove-references-to -t '${ocamlPackages.ocaml}' $out/bin/fstar.exe
+
     wrapProgram $out/bin/fstar.exe --prefix PATH ":" "${z3}/bin"
     installShellCompletion --bash .completion/bash/fstar.exe.bash
     installShellCompletion --fish .completion/fish/fstar.exe.fish
diff --git a/pkgs/development/interpreters/bqn/cbqn/default.nix b/pkgs/development/interpreters/bqn/cbqn/default.nix
index 5dffd7f184c3..bd07f3ca7ede 100644
--- a/pkgs/development/interpreters/bqn/cbqn/default.nix
+++ b/pkgs/development/interpreters/bqn/cbqn/default.nix
@@ -82,7 +82,7 @@ stdenv.mkDerivation rec {
 
   outputs = [
     "out"
-  ] ++ lib.optionals stdenv.isLinux [
+  ] ++ lib.optionals enableLibcbqn [
     "lib"
     "dev"
   ];
diff --git a/pkgs/development/libraries/argp-standalone/default.nix b/pkgs/development/libraries/argp-standalone/default.nix
index 1a09ed84a1cb..f4fc2101e72b 100644
--- a/pkgs/development/libraries/argp-standalone/default.nix
+++ b/pkgs/development/libraries/argp-standalone/default.nix
@@ -1,62 +1,25 @@
-{ lib, stdenv, fetchurl, fetchpatch }:
+{ lib, stdenv, fetchFromGitHub, meson, ninja }:
 
-let
-  patch-argp-fmtstream = fetchpatch {
-    name = "patch-argp-fmtstream.h";
-    url = "https://raw.githubusercontent.com/Homebrew/formula-patches/b5f0ad3/argp-standalone/patch-argp-fmtstream.h";
-    sha256 = "5656273f622fdb7ca7cf1f98c0c9529bed461d23718bc2a6a85986e4f8ed1cb8";
-  };
-
-  patch-throw-in-funcdef = fetchpatch {
-    name = "argp-standalone-1.3-throw-in-funcdef.patch";
-    url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/sys-libs/argp-standalone/files/argp-standalone-1.3-throw-in-funcdef.patch?id=409d0e2a9c9c899fb1fb04cc808fe0aff3f745ca";
-    sha256 = "0b2b4l1jkvmnffl22jcn4ydzxy2i7fnmmnfim12f0yg5pb8fs43c";
-  };
-
-  patch-shared = fetchpatch {
-    name = "argp-standalone-1.3-shared.patch";
-    url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/sys-libs/argp-standalone/files/argp-standalone-1.3-shared.patch?id=409d0e2a9c9c899fb1fb04cc808fe0aff3f745ca";
-    sha256 = "1xx2zdc187a1m2x6c1qs62vcrycbycw7n0q3ks2zkxpaqzx2dgkw";
-  };
-in
 stdenv.mkDerivation rec {
   pname = "argp-standalone";
-  version = "1.3";
+  version = "1.5.0";
 
-  src = fetchurl {
-    url = "https://www.lysator.liu.se/~nisse/misc/argp-standalone-${version}.tar.gz";
-    sha256 = "dec79694da1319acd2238ce95df57f3680fea2482096e483323fddf3d818d8be";
+  src = fetchFromGitHub {
+    owner = "argp-standalone";
+    repo = "argp-standalone";
+    rev = version;
+    sha256 = "jWnoWVnUVDQlsC9ru7oB9PdtZuyCCNqGnMqF/f2m0ZY=";
   };
 
-  patches =
-       lib.optionals stdenv.hostPlatform.isDarwin [ patch-argp-fmtstream ]
-    ++ lib.optionals stdenv.hostPlatform.isLinux [ patch-throw-in-funcdef patch-shared ];
-
-  patchFlags = lib.optional stdenv.hostPlatform.isDarwin "-p0";
-
-  # For currently unknown reason, `-fPIC` has to be passed explicitly, otherwise
-  # downstream software like `elfutils` will get `recompile errors like:
-  #     libargp.a(argp-help.o): relocation R_X86_64_PC32 against symbol `program_invocation_short_name' can not be used when making a shared object; recompile with -fPIC
-  # It seems that nixpkgs's on-by-default `-fPIC` is not in effect here.
-  preConfigure = lib.optionalString stdenv.hostPlatform.isLinux "export CFLAGS='-fgnu89-inline -fPIC'";
-
-  postInstall = ''
-    mkdir -p $out/lib $out/include
-    cp libargp.a $out/lib
-    cp argp.h $out/include
-  '';
+  nativeBuildInputs = [ meson ninja ];
 
   doCheck = true;
 
-  makeFlags = [ "AR:=$(AR)" ];
-
-  enableParallelBuilding = true;
-
   meta = with lib; {
-    homepage = "https://www.lysator.liu.se/~nisse/misc/";
-    description = "Standalone version of arguments parsing functions from GLIBC";
-    platforms = with platforms; darwin ++ linux;
+    homepage = "https://github.com/argp-standalone/argp-standalone";
+    description = "Standalone version of arguments parsing functions from Glibc";
+    platforms = platforms.unix;
     maintainers = with maintainers; [ amar1729 ];
-    license = licenses.gpl2;
+    license = licenses.lgpl21Plus;
   };
 }
diff --git a/pkgs/development/libraries/libargon2/default.nix b/pkgs/development/libraries/libargon2/default.nix
index 19ca4fab4013..4eb28fb02fe2 100644
--- a/pkgs/development/libraries/libargon2/default.nix
+++ b/pkgs/development/libraries/libargon2/default.nix
@@ -44,6 +44,6 @@ stdenv.mkDerivation rec {
     license = with licenses; [ asl20 cc0 ];
     maintainers = with maintainers; [ taeer olynch ];
     mainProgram = "argon2";
-    platforms = platforms.linux ++ platforms.darwin;
+    platforms = platforms.all;
   };
 }
diff --git a/pkgs/development/libraries/libcdio/default.nix b/pkgs/development/libraries/libcdio/default.nix
index 324f0669af31..aacb7555a4b6 100644
--- a/pkgs/development/libraries/libcdio/default.nix
+++ b/pkgs/development/libraries/libcdio/default.nix
@@ -31,8 +31,10 @@ stdenv.mkDerivation rec {
   '';
 
   nativeBuildInputs = [ pkg-config help2man ];
-  buildInputs = [ libcddb ncurses ]
-    ++ lib.optionals stdenv.isDarwin [ libiconv Carbon IOKit ];
+  buildInputs = [ libcddb libiconv ncurses ]
+    ++ lib.optionals stdenv.isDarwin [ Carbon IOKit ];
+
+  enableParallelBuilding = true;
 
   doCheck = !stdenv.isDarwin;
 
@@ -46,6 +48,6 @@ stdenv.mkDerivation rec {
     '';
     homepage = "https://www.gnu.org/software/libcdio/";
     license = licenses.gpl2Plus;
-    platforms = platforms.linux ++ platforms.darwin;
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/libraries/libdatrie/default.nix b/pkgs/development/libraries/libdatrie/default.nix
index 257673b1a96d..57d30124a6fd 100644
--- a/pkgs/development/libraries/libdatrie/default.nix
+++ b/pkgs/development/libraries/libdatrie/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     installShellFiles
   ];
 
-  buildInputs = lib.optional stdenv.isDarwin libiconv;
+  buildInputs = [ libiconv ];
 
   preAutoreconf = let
     reports = "https://github.com/tlwg/libdatrie/issues";
diff --git a/pkgs/development/libraries/ntbtls/default.nix b/pkgs/development/libraries/ntbtls/default.nix
index 391f96734d23..9a6d9c7194cf 100644
--- a/pkgs/development/libraries/ntbtls/default.nix
+++ b/pkgs/development/libraries/ntbtls/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ntbtls";
-  version = "0.2.0";
+  version = "0.3.1";
 
   src = fetchurl {
     url = "mirror://gnupg/ntbtls/ntbtls-${version}.tar.bz2";
-    sha256 = "sha256-ZJ/nSjEdE+Q7FrJuuqkWZd22MpJbc5AlkurD7TBRnhc=";
+    sha256 = "sha256-iSIYH+9SO3e3FiXlYuTWlTInjqu9GLx0V52+FBNXKbo=";
   };
 
   outputs = [ "dev" "out" ];
diff --git a/pkgs/development/libraries/qrencode/default.nix b/pkgs/development/libraries/qrencode/default.nix
index c641c595e1a8..14a9b9904d9a 100644
--- a/pkgs/development/libraries/qrencode/default.nix
+++ b/pkgs/development/libraries/qrencode/default.nix
@@ -13,8 +13,8 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs = [ libpng ]
-    ++ lib.optionals stdenv.isDarwin [ libiconv libobjc ];
+  buildInputs = [ libiconv libpng ]
+    ++ lib.optionals stdenv.isDarwin [ libobjc ];
 
   configureFlags = [
     "--with-tests"
diff --git a/pkgs/development/libraries/umockdev/default.nix b/pkgs/development/libraries/umockdev/default.nix
index 53ef1286420d..da2ba16dedc1 100644
--- a/pkgs/development/libraries/umockdev/default.nix
+++ b/pkgs/development/libraries/umockdev/default.nix
@@ -20,13 +20,13 @@
 
 stdenv.mkDerivation rec {
   pname = "umockdev";
-  version = "0.17.13";
+  version = "0.17.15";
 
   outputs = [ "bin" "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "https://github.com/martinpitt/umockdev/releases/download/${version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-bG6/bmIJtqSXRuDZGkSNAntUJxurgu1woTLs8pTKE88=";
+    sha256 = "7UGO4rv7B4H0skuXKe8nCtg83czWaln/lEsFnvE2j+8=";
   };
 
   patches = [
@@ -83,6 +83,8 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
+    homepage = "https://github.com/martinpitt/umockdev";
+    changelog = "https://github.com/martinpitt/umockdev/releases/tag/${version}";
     description = "Mock hardware devices for creating unit tests";
     license = licenses.lgpl21Plus;
     maintainers = with maintainers; [ flokli ];
diff --git a/pkgs/development/libraries/umockdev/hardcode-paths.patch b/pkgs/development/libraries/umockdev/hardcode-paths.patch
index 91f1e928ec60..75a5c014a996 100644
--- a/pkgs/development/libraries/umockdev/hardcode-paths.patch
+++ b/pkgs/development/libraries/umockdev/hardcode-paths.patch
@@ -1,8 +1,8 @@
 diff --git a/meson.build b/meson.build
-index 2ed9027..1f6bbf2 100644
+index 15d9e5d..a1906dd 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -38,6 +38,7 @@ g_ir_compiler = find_program('g-ir-compiler', required: false)
+@@ -44,6 +44,7 @@ g_ir_compiler = find_program('g-ir-compiler', required: false)
  
  conf.set('PACKAGE_NAME', meson.project_name())
  conf.set_quoted('VERSION', meson.project_version())
@@ -10,7 +10,7 @@ index 2ed9027..1f6bbf2 100644
  
  # glibc versions somewhere between 2.28 and 2.34
  if cc.has_function('__fxstatat', prefix: '#include <sys/stat.h>')
-@@ -148,7 +149,7 @@ hacked_gir = custom_target('UMockdev-1.0 hacked gir',
+@@ -156,7 +157,7 @@ hacked_gir = custom_target('UMockdev-1.0 hacked gir',
  
  if g_ir_compiler.found()
  umockdev_typelib = custom_target('UMockdev-1.0 typelib',
@@ -31,28 +31,28 @@ index 5269dd0..a2ec46d 100644
  }
  
 diff --git a/src/umockdev-record.vala b/src/umockdev-record.vala
-index 8434d32..68c7f8e 100644
+index bf0e644..ff5ea59 100644
 --- a/src/umockdev-record.vala
 +++ b/src/umockdev-record.vala
-@@ -435,7 +435,7 @@ main (string[] args)
+@@ -444,7 +444,7 @@ main (string[] args)
          preload = "";
      else
          preload = preload + ":";
--    Environment.set_variable("LD_PRELOAD", preload + "libumockdev-preload.so.0", true);
-+    Environment.set_variable("LD_PRELOAD", preload + Config.LIBDIR + "/libumockdev-preload.so.0", true);
+-    checked_setenv("LD_PRELOAD", preload + "libumockdev-preload.so.0");
++    checked_setenv("LD_PRELOAD", preload + Config.LIBDIR + "/libumockdev-preload.so.0");
  
      try {
          root_dir = DirUtils.make_tmp("umockdev.XXXXXX");
 diff --git a/src/umockdev-run.vala b/src/umockdev-run.vala
-index 9a1ba10..6df2522 100644
+index 7b0753e..66b778b 100644
 --- a/src/umockdev-run.vala
 +++ b/src/umockdev-run.vala
 @@ -95,7 +95,7 @@ main (string[] args)
          preload = "";
      else
          preload = preload + ":";
--    Environment.set_variable ("LD_PRELOAD", preload + "libumockdev-preload.so.0", true);
-+    Environment.set_variable ("LD_PRELOAD", preload + Config.LIBDIR + "/libumockdev-preload.so.0", true);
+-    checked_setenv ("LD_PRELOAD", preload + "libumockdev-preload.so.0");
++    checked_setenv ("LD_PRELOAD", preload + Config.LIBDIR + "/libumockdev-preload.so.0");
  
      var testbed = new UMockdev.Testbed ();
  
diff --git a/pkgs/development/libraries/wavpack/default.nix b/pkgs/development/libraries/wavpack/default.nix
index 67d8bccf51f0..2836faf6bc79 100644
--- a/pkgs/development/libraries/wavpack/default.nix
+++ b/pkgs/development/libraries/wavpack/default.nix
@@ -7,7 +7,7 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
 
   nativeBuildInputs = [ autoreconfHook ];
-  buildInputs = lib.optional stdenv.isDarwin libiconv;
+  buildInputs = [ libiconv ];
 
   # autogen.sh:9
   preAutoreconf = "cp ${gettext}/share/gettext/config.rpath .";
diff --git a/pkgs/development/mobile/maestro/default.nix b/pkgs/development/mobile/maestro/default.nix
index 778fddc8c3bb..d0894d5ceeb5 100644
--- a/pkgs/development/mobile/maestro/default.nix
+++ b/pkgs/development/mobile/maestro/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "maestro";
-  version = "1.20.0";
+  version = "1.21.0";
 
   src = fetchurl {
     url = "https://github.com/mobile-dev-inc/maestro/releases/download/cli-${version}/maestro.zip";
-    sha256 = "0hrfnx66yr1q57875m3ff4b2blq0k641iqjxjys8kwzp3nix34w2";
+    sha256 = "13b2ykphc7szdanlkk34agf7p0lx78mavk5pjfls48d1k5hllslc";
   };
 
   dontUnpack = true;
diff --git a/pkgs/development/python-modules/google-cloud-monitoring/default.nix b/pkgs/development/python-modules/google-cloud-monitoring/default.nix
index 71e93e92c70c..2dabd36a2e93 100644
--- a/pkgs/development/python-modules/google-cloud-monitoring/default.nix
+++ b/pkgs/development/python-modules/google-cloud-monitoring/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-monitoring";
-  version = "2.14.0";
+  version = "2.14.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Fn21kQVBPjZk9pvsLO2W0vLalbXk3mSOKKn/uieudaY=";
+    hash = "sha256-FKg2nEmc5mYKSWJwV0wG09kK4ZQl+Tan+9BqbwJ/8eA=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/ha-philipsjs/default.nix b/pkgs/development/python-modules/ha-philipsjs/default.nix
index 3ba873e2e03a..3d8ff39af14b 100644
--- a/pkgs/development/python-modules/ha-philipsjs/default.nix
+++ b/pkgs/development/python-modules/ha-philipsjs/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "ha-philipsjs";
-  version = "2.9.0";
+  version = "3.0.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -20,8 +20,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "danielperna84";
     repo = pname;
-    rev = version;
-    sha256 = "sha256-B2AQoVyoG6wyE9pTWf/ASQd8iZfIrjUr078rSkoARf0=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-iJxu+TdgDHMnLuNTFj0UC8V76x3nAgGqswMLDSgmDmQ=";
   };
 
   propagatedBuildInputs = [
@@ -43,6 +43,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python library to interact with Philips TVs with jointSPACE API";
     homepage = "https://github.com/danielperna84/ha-philipsjs";
+    changelog = "https://github.com/danielperna84/ha-philipsjs/releases/tag/${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/imageio/default.nix b/pkgs/development/python-modules/imageio/default.nix
index 181c1529b7cd..45eb10658b57 100644
--- a/pkgs/development/python-modules/imageio/default.nix
+++ b/pkgs/development/python-modules/imageio/default.nix
@@ -16,11 +16,11 @@
 
 buildPythonPackage rec {
   pname = "imageio";
-  version = "2.24.0";
+  version = "2.25.0";
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
-    sha256 = "sha256-8kD4Ip9PMpoVRigRlLUtpdZpQUGlJGaP7T+BsNB3gvo=";
+    sha256 = "sha256-uAeWofjDjGl6lAoq1zl+4okA1cTlEGG5pn0WrKhn8z4=";
     inherit pname version;
   };
 
diff --git a/pkgs/development/python-modules/jedi-language-server/default.nix b/pkgs/development/python-modules/jedi-language-server/default.nix
index eb0570a2947a..35749407a36e 100644
--- a/pkgs/development/python-modules/jedi-language-server/default.nix
+++ b/pkgs/development/python-modules/jedi-language-server/default.nix
@@ -1,15 +1,17 @@
 { lib
 , buildPythonPackage
-, fetchPypi
-, fetchFromGitHub
-, poetry-core
-, pythonRelaxDepsHook
 , docstring-to-markdown
+, fetchFromGitHub
 , jedi
+, lsprotocol
+, poetry-core
 , pygls
-, pytestCheckHook
+, pydantic
 , pyhamcrest
+, pytestCheckHook
 , python-jsonrpc-server
+, pythonOlder
+, pythonRelaxDepsHook
 }:
 
 buildPythonPackage rec {
@@ -17,11 +19,13 @@ buildPythonPackage rec {
   version = "0.40.0";
   format = "pyproject";
 
+  disabled = pythonOlder "3.8";
+
   src = fetchFromGitHub {
     owner = "pappasam";
     repo = pname;
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-+3VgONZzlobgs4wujCaGTTYpIgYrWgWwYgKQqirS7t8=";
+    hash = "sha256-+3VgONZzlobgs4wujCaGTTYpIgYrWgWwYgKQqirS7t8=";
   };
 
   pythonRelaxDeps = [
@@ -36,6 +40,8 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     docstring-to-markdown
     jedi
+    lsprotocol
+    pydantic
     pygls
   ];
 
@@ -54,9 +60,9 @@ buildPythonPackage rec {
   ];
 
   meta = with lib; {
-    homepage = "https://github.com/pappasam/jedi-language-server";
-    changelog = "https://github.com/pappasam/jedi-language-server/blob/${src.rev}/CHANGELOG.md";
     description = "A Language Server for the latest version(s) of Jedi";
+    homepage = "https://github.com/pappasam/jedi-language-server";
+    changelog = "https://github.com/pappasam/jedi-language-server/blob/${version}/CHANGELOG.md";
     license = licenses.mit;
     maintainers = with maintainers; [ doronbehar ];
   };
diff --git a/pkgs/development/python-modules/lsprotocol/default.nix b/pkgs/development/python-modules/lsprotocol/default.nix
new file mode 100644
index 000000000000..e2dcd7bb9a74
--- /dev/null
+++ b/pkgs/development/python-modules/lsprotocol/default.nix
@@ -0,0 +1,66 @@
+{ lib
+, attrs
+, buildPythonPackage
+, cattrs
+, fetchFromGitHub
+, flit-core
+, jsonschema
+, nox
+, pyhamcrest
+, pytest
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "lsprotocol";
+  version = "2022.0.0a9";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "microsoft";
+    repo = pname;
+    rev = "refs/tags/${version}";
+    hash = "sha256-6XecPKuBhwtkmZrGozzO+VEryI5wwy9hlvWE1oV6ajk=";
+  };
+
+  nativeBuildInputs = [
+    flit-core
+    nox
+  ];
+
+  propagatedBuildInputs = [
+    attrs
+    cattrs
+  ];
+
+  nativeCheckInputs = [
+    pytest
+  ];
+
+  checkInputs = [
+    jsonschema
+    pyhamcrest
+  ];
+
+  checkPhase = ''
+    runHook preCheck
+
+    sed -i "/^    _install_requirements/d" noxfile.py
+    nox --session tests
+
+    runHook postCheck
+  '';
+
+  pythonImportsCheck = [
+    "lsprotocol"
+  ];
+
+  meta = with lib; {
+    description = "Python implementation of the Language Server Protocol";
+    homepage = "https://github.com/microsoft/lsprotocol";
+    license = licenses.mit;
+    maintainers = with maintainers; [ doronbehar fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/nox/default.nix b/pkgs/development/python-modules/nox/default.nix
new file mode 100644
index 000000000000..bc84559345a4
--- /dev/null
+++ b/pkgs/development/python-modules/nox/default.nix
@@ -0,0 +1,78 @@
+{ lib
+, argcomplete
+, buildPythonPackage
+, colorlog
+, fetchFromGitHub
+, fetchpatch
+, setuptools
+, importlib-metadata
+, jinja2
+, packaging
+, pytestCheckHook
+, pythonOlder
+, tox
+, typing-extensions
+, virtualenv
+}:
+
+buildPythonPackage rec {
+  pname = "nox";
+  version = "2022.11.21";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "wntrblm";
+    repo = pname;
+    rev = "refs/tags/${version}";
+    hash = "sha256-N70yBZyrtdQvgaJzkskG3goHit8eH0di9jHycuAwzfU=";
+  };
+
+  patches = [
+    # Remove rogue mocking of py._path, https://github.com/wntrblm/nox/pull/677
+    (fetchpatch {
+      name = "remove-py-pyth.patch";
+      url = "https://github.com/wntrblm/nox/commit/44d06b679761e21d76bb96b2b8ffe0ffbe3d4fd0.patch";
+      hash = "sha256-KRDVwbBMBd4GdiAcGJyS7DTNUw3Pumt0JO1igx6npnc=";
+    })
+  ];
+
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  propagatedBuildInputs = [
+    argcomplete
+    colorlog
+    packaging
+    virtualenv
+  ] ++ lib.optionals (pythonOlder "3.8") [
+    typing-extensions
+    importlib-metadata
+  ];
+
+
+  checkInputs = [
+    jinja2
+    tox
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "nox"
+  ];
+
+  disabledTestPaths = [
+    # AttributeError: module 'tox.config' has...
+    "tests/test_tox_to_nox.py"
+  ];
+
+  meta = with lib; {
+    description = "Flexible test automation for Python";
+    homepage = "https://nox.thea.codes/";
+    changelog = "https://github.com/wntrblm/nox/blob/${version}/CHANGELOG.md";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ doronbehar fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/openai-whisper/default.nix b/pkgs/development/python-modules/openai-whisper/default.nix
index 28b95d863f68..b30f218193eb 100644
--- a/pkgs/development/python-modules/openai-whisper/default.nix
+++ b/pkgs/development/python-modules/openai-whisper/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage rec {
   pname = "whisper";
-  version = "20230117";
+  version = "20230124";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "openai";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-DVYQw+h5xsgWLA6dD+qg4ud0pqFOn6oVAzTqRywE30g=";
+    hash = "sha256-+3fs/EXK5NGlISuMTk7r2ZZ4tNFKbNFNkVS2LmHBvwk=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/pygls/default.nix b/pkgs/development/python-modules/pygls/default.nix
index a4e8bca2c8b5..199082cae15e 100644
--- a/pkgs/development/python-modules/pygls/default.nix
+++ b/pkgs/development/python-modules/pygls/default.nix
@@ -3,7 +3,7 @@
 , pythonOlder
 , fetchFromGitHub
 , setuptools-scm
-, pydantic
+, lsprotocol
 , toml
 , typeguard
 , mock
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "pygls";
-  version = "0.13.0";
+  version = "1.0.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "openlawlibrary";
     repo = "pygls";
     rev = "v${version}";
-    hash = "sha256-guwOnB4EEUpucfprNLLr49Yn8EdOpRzzG+cT4NCn0rA=";
+    hash = "sha256-31J4+giK1RDBS52Q/Ia3Y/Zak7fp7gRVTQ7US/eFjtM=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
@@ -32,7 +32,7 @@ buildPythonPackage rec {
   ];
 
   propagatedBuildInputs = [
-    pydantic
+    lsprotocol
     typeguard
   ];
 
diff --git a/pkgs/development/python-modules/pytorch-metric-learning/default.nix b/pkgs/development/python-modules/pytorch-metric-learning/default.nix
index 82c3f8aa10e0..b0bd470b32b9 100644
--- a/pkgs/development/python-modules/pytorch-metric-learning/default.nix
+++ b/pkgs/development/python-modules/pytorch-metric-learning/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname   = "pytorch-metric-learning";
-  version = "1.6.3";
+  version = "1.7.2";
 
   disabled = isPy27;
 
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "KevinMusgrave";
     repo = pname;
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-7ezD3TMmNI9wRBXz5Htz10XZZaSsD0jTpEldGpIot8k=";
+    sha256 = "sha256-f+k7WuZRgSDGbWp/TvmDkDzT02WeycwDCd/1WhR3VD8=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pywbem/default.nix b/pkgs/development/python-modules/pywbem/default.nix
index 5cebdaf28f71..e02d767ce938 100644
--- a/pkgs/development/python-modules/pywbem/default.nix
+++ b/pkgs/development/python-modules/pywbem/default.nix
@@ -1,36 +1,37 @@
 { lib
 , buildPythonPackage
+, decorator
 , fetchPypi
-, libxml2
-, m2crypto
-, ply
-, pyyaml
-, six
-, pbr
-, pythonOlder
-, nocasedict
-, nocaselist
-, yamlloader
-, requests-mock
+, FormEncode
 , httpretty
+, libxml2
 , lxml
 , mock
+, nocasedict
+, nocaselist
+, pbr
+, ply
 , pytest
-, requests
-, decorator
-, FormEncode
-, testfixtures
+, pythonOlder
 , pytz
+, pyyaml
+, requests
+, requests-mock
+, six
+, testfixtures
+, yamlloader
 }:
 
 buildPythonPackage rec {
   pname = "pywbem";
-  version = "1.5.0";
+  version = "1.6.0";
   format = "setuptools";
 
+  disabled = pythonOlder "3.7";
+
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-xffkWMJTDGE1j7xjM750+vNmqs546uM3QUMSZ63zJhA=";
+    hash = "sha256-4mqwMkR17lMp10lx+UK0sxW2rA7a8njnDha1YDJ475g=";
   };
 
   propagatedBuildInputs = [
@@ -42,7 +43,7 @@ buildPythonPackage rec {
     pyyaml
     six
     yamlloader
-  ] ++ lib.optionals (pythonOlder "3.0") [ m2crypto ];
+  ];
 
   nativeCheckInputs = [
     decorator
@@ -57,9 +58,14 @@ buildPythonPackage rec {
     testfixtures
   ];
 
+  pythonImportsCheck = [
+    "pywbem"
+  ];
+
   meta = with lib; {
     description = "Support for the WBEM standard for systems management";
     homepage = "https://pywbem.github.io";
+    changelog = "https://github.com/pywbem/pywbem/blob/${version}/docs/changes.rst";
     license = licenses.lgpl21Plus;
     maintainers = with maintainers; [ peterhoeg ];
   };
diff --git a/pkgs/development/python-modules/spdx-tools/default.nix b/pkgs/development/python-modules/spdx-tools/default.nix
index 9385a1d4062c..d1e66d676464 100644
--- a/pkgs/development/python-modules/spdx-tools/default.nix
+++ b/pkgs/development/python-modules/spdx-tools/default.nix
@@ -12,13 +12,14 @@
 
 buildPythonPackage rec {
   pname = "spdx-tools";
-  version = "0.7.0a3";
+  version = "0.7.0";
+  format = "setuptools";
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-afV1W1n5ubHhqfLFpPO5fxaIy5TaZdw9eDy3JYOJ1oE=";
+    hash = "sha256-QqKMKBedWOFYF1av9IgQuyJ6b5mNhhMpIZVJdEDcAK8=";
   };
 
   propagatedBuildInputs = [
@@ -40,6 +41,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "SPDX parser and tools";
     homepage = "https://github.com/spdx/tools-python";
+    changelog = "https://github.com/spdx/tools-python/blob/v${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = teams.determinatesystems.members;
   };
diff --git a/pkgs/development/python-modules/sphinxext-opengraph/default.nix b/pkgs/development/python-modules/sphinxext-opengraph/default.nix
index ce03c0214792..4bf290328821 100644
--- a/pkgs/development/python-modules/sphinxext-opengraph/default.nix
+++ b/pkgs/development/python-modules/sphinxext-opengraph/default.nix
@@ -9,13 +9,13 @@
 
 buildPythonPackage rec {
   pname = "sphinxext-opengraph";
-  version = "0.7.4";
+  version = "0.7.5";
 
   src = fetchFromGitHub {
     owner = "wpilibsuite";
     repo = "sphinxext-opengraph";
     rev = "refs/tags/v${version}";
-    hash = "sha256-N8448GHg/lR7z7Y4F4vO7z+wAeaboo8Cj0X+HSyToAA=";
+    hash = "sha256-fNtXj7iYX7rSaGO6JcxC+PvR8WzTFl8gYwHyRExYdfI=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
diff --git a/pkgs/development/tools/castxml/default.nix b/pkgs/development/tools/castxml/default.nix
index 69e48a28a2e3..8b1685b17173 100644
--- a/pkgs/development/tools/castxml/default.nix
+++ b/pkgs/development/tools/castxml/default.nix
@@ -1,14 +1,14 @@
-{ lib,
-  stdenv,
-  fetchFromGitHub,
-  cmake,
-  libffi,
-  libxml2,
-  zlib,
-  withManual ? true,
-  withHTML ? true,
-  llvmPackages,
-  python3,
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, libffi
+, libxml2
+, zlib
+, withManual ? true
+, withHTML ? true
+, llvmPackages
+, python3
 }:
 
 let
diff --git a/pkgs/development/tools/misc/cmake-language-server/default.nix b/pkgs/development/tools/misc/cmake-language-server/default.nix
index 35ce6430ce62..e245128aa28c 100644
--- a/pkgs/development/tools/misc/cmake-language-server/default.nix
+++ b/pkgs/development/tools/misc/cmake-language-server/default.nix
@@ -1,39 +1,35 @@
 { lib
 , buildPythonApplication
 , fetchFromGitHub
-, poetry-core
-, pythonRelaxDepsHook
 , cmake-format
 , pygls
 , cmake
+, pdm-pep517
 , pytest-datadir
 , pytestCheckHook
 }:
 
 buildPythonApplication rec {
   pname = "cmake-language-server";
-  version = "0.1.6";
+  version = "unstable-2023-01-08";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "regen100";
     repo = pname;
-    rev = "refs/tags/v${version}";
-    sha256 = "sha256-B7dhCQo3g2E8+fzyl1RhaYQE6TFoqoLtp9Z7sZcv5xk=";
+    rev = "60c376a5fda29835060687569cb212350a292116";
+    hash = "sha256-vNG43sZy2wMetY5mbgxIoei5jCCj1f8vWiovWtwzbPc=";
   };
 
+  PDM_PEP517_SCM_VERSION = "2023.1";
+
   patches = [
     # Test timeouts occasionally cause the build to fail
     ./disable-test-timeouts.patch
   ];
 
-  pythonRelaxDeps = [
-    "pygls"
-  ];
-
   nativeBuildInputs = [
-    poetry-core
-    pythonRelaxDepsHook
+    pdm-pep517
   ];
 
   propagatedBuildInputs = [
@@ -49,7 +45,10 @@ buildPythonApplication rec {
   ];
 
   dontUseCmakeConfigure = true;
-  pythonImportsCheck = [ "cmake_language_server" ];
+
+  pythonImportsCheck = [
+    "cmake_language_server"
+  ];
 
   meta = with lib; {
     description = "CMake LSP Implementation";
diff --git a/pkgs/development/tools/oh-my-posh/default.nix b/pkgs/development/tools/oh-my-posh/default.nix
index 3ba0b5ff4240..31056cff3714 100644
--- a/pkgs/development/tools/oh-my-posh/default.nix
+++ b/pkgs/development/tools/oh-my-posh/default.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "oh-my-posh";
-  version = "13.3.1";
+  version = "13.6.0";
 
   src = fetchFromGitHub {
     owner = "jandedobbeleer";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-ssZbeb1UczWEjeRY1WJBQPnbG/p6XcUSWVHLdreGJkk=";
+    hash = "sha256-N24kt564/gdJ4mUIyul3zfUFTtF9y49IERfE2jVIL8Q=";
   };
 
   vendorHash = "sha256-WiH4qu8DODEhAkxUm6VDcBwFyQO7kNjaiaWPDHCHj9E=";
diff --git a/pkgs/development/tools/prospector/default.nix b/pkgs/development/tools/prospector/default.nix
index 7b81a1436f0f..e53760f54afa 100644
--- a/pkgs/development/tools/prospector/default.nix
+++ b/pkgs/development/tools/prospector/default.nix
@@ -9,14 +9,14 @@ in
 
 python3.pkgs.buildPythonApplication rec {
   pname = "prospector";
-  version = "1.8.3";
+  version = "1.8.4";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "PyCQA";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-R3Sc4Qx6bht+XJhNj+fy32akzDOgSDF5LP3WE1qEyms=";
+    hash = "sha256-g7tyn6pj5I/+b28wIitqDapR5ffk1xDEAtcYs2TpIUk=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/games/gcompris/default.nix b/pkgs/games/gcompris/default.nix
index 99ee63ed057f..af41da4a3e4f 100644
--- a/pkgs/games/gcompris/default.nix
+++ b/pkgs/games/gcompris/default.nix
@@ -1,42 +1,46 @@
-{ mkDerivation
+{ stdenv
 , cmake
 , fetchurl
 , gettext
 , gst_all_1
 , lib
 , ninja
+, wrapQtAppsHook
 , qmlbox2d
 , qtbase
+, qtcharts
 , qtdeclarative
 , qtgraphicaleffects
 , qtmultimedia
-, qtquickcontrols
+, qtquickcontrols2
 , qtsensors
 , qttools
 , qtxmlpatterns
 }:
 
-mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "gcompris";
-  version = "2.4";
+  version = "3.1";
 
   src = fetchurl {
     url = "https://download.kde.org/stable/gcompris/qt/src/gcompris-qt-${version}.tar.xz";
-    sha256 = "sha256-/QZub48rarVHcD0PgOPc6NTlOKrsEzVK/qjHb5CjWS0=";
+    hash = "sha256-wABGojMfiMgjUT5gVDfB5JmXK1SPkrIkqLT/403zUFI=";
   };
 
   cmakeFlags = [
     "-DQML_BOX2D_LIBRARY=${qmlbox2d}/${qtbase.qtQmlPrefix}/Box2D.2.1"
   ];
 
-  nativeBuildInputs = [ cmake gettext ninja qttools ];
+  nativeBuildInputs = [ cmake gettext ninja qttools wrapQtAppsHook ];
 
   buildInputs = [
     qmlbox2d
+    qtbase
+    qtcharts
     qtdeclarative
     qtgraphicaleffects
     qtmultimedia
-    qtquickcontrols
+    qtquickcontrols2
     qtsensors
     qtxmlpatterns
   ] ++ (with gst_all_1; [
diff --git a/pkgs/servers/memcached/default.nix b/pkgs/servers/memcached/default.nix
index 9d83d12f3e43..83721ed601d1 100644
--- a/pkgs/servers/memcached/default.nix
+++ b/pkgs/servers/memcached/default.nix
@@ -1,12 +1,12 @@
 {lib, stdenv, fetchurl, cyrus_sasl, libevent, nixosTests }:
 
 stdenv.mkDerivation rec {
-  version = "1.6.17";
+  version = "1.6.18";
   pname = "memcached";
 
   src = fetchurl {
     url = "https://memcached.org/files/${pname}-${version}.tar.gz";
-    sha256 = "sha256-IFXjc2E9j8IVKa/58K3OPiO5zgG6BHjTDnlB2fK9EiQ=";
+    sha256 = "sha256-y91quIEGSaxdkvzQ/LDKkx2Knb0K2MxXW0ciLu3WQVg=";
   };
 
   configureFlags = [
diff --git a/pkgs/servers/prowlarr/default.nix b/pkgs/servers/prowlarr/default.nix
index 15b98ca035d8..01eeb6fcb1aa 100644
--- a/pkgs/servers/prowlarr/default.nix
+++ b/pkgs/servers/prowlarr/default.nix
@@ -16,14 +16,14 @@ let
   }."${stdenv.hostPlatform.system}" or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
 
   hash = {
-    x64-linux_hash = "sha256-r5A7KkzugTXwLejaQuKW/EhV99e8gqj8kmgliNMi/xU=";
-    arm64-linux_hash = "sha256-HdtUSMHteFDdp0yZYFC4EHK2S3cr6dEXklyTp5bqHYQ=";
-    x64-osx_hash = "sha256-GyHiBiz5LoT+DGxcC0v7OXvdUwaLyrczda/aUkABnrs=";
+    x64-linux_hash = "sha256-w9je2dcVMDhUCG2zK9uQWpTXQh3zw+0yL/qVrl3DqzE=";
+    arm64-linux_hash = "sha256-j5pxMTLE2Mk91q76Y1n8j3pG/1aPrGkkvSjzAI8nJro=";
+    x64-osx_hash = "sha256-ILz3zNQNUwFGMLvz4sqZMzsN+tw/HNpr5mFLSIKQ4Gg=";
   }."${arch}-${os}_hash";
 
 in stdenv.mkDerivation rec {
   pname = "prowlarr";
-  version = "1.0.1.2210";
+  version = "1.1.1.2377";
 
   src = fetchurl {
     url = "https://github.com/Prowlarr/Prowlarr/releases/download/v${version}/Prowlarr.develop.${version}.${os}-core-${arch}.tar.gz";
diff --git a/pkgs/servers/spicedb/zed.nix b/pkgs/servers/spicedb/zed.nix
index efb672da5f1f..982242a0e78f 100644
--- a/pkgs/servers/spicedb/zed.nix
+++ b/pkgs/servers/spicedb/zed.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "zed";
-  version = "0.7.5";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "authzed";
     repo = "zed";
     rev = "v${version}";
-    hash = "sha256-Q12zM9GgQQBykFLZ3nwdkl8Nk/0nbXaOJzXzO8wSOXY=";
+    hash = "sha256-/tYQqS0l5Z/yeNd6GJHONtD3YeQ7nvvWcilBAahDDPA=";
   };
 
-  vendorHash = "sha256-AEU8yTG+n+JOSB7Cnmf+mztm/1c5vuarSqVr3hC/14g=";
+  vendorHash = "sha256-3JQgtWaPi2e9lSXF+3IIXDptQXjFJOBsMPfisEea8kE=";
 
   meta = with lib; {
     description = "Command line for managing SpiceDB";
diff --git a/pkgs/servers/sql/mysql/8.0.x.nix b/pkgs/servers/sql/mysql/8.0.x.nix
index 98563bda6cd0..2958cebfc9fd 100644
--- a/pkgs/servers/sql/mysql/8.0.x.nix
+++ b/pkgs/servers/sql/mysql/8.0.x.nix
@@ -6,11 +6,11 @@
 let
 self = stdenv.mkDerivation rec {
   pname = "mysql";
-  version = "8.0.31";
+  version = "8.0.32";
 
   src = fetchurl {
     url = "https://dev.mysql.com/get/Downloads/MySQL-${self.mysqlVersion}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-Z7uMunWyjpXH95SFY/AfuEUo/LsaNduoOdTORP4Bm6o=";
+    sha256 = "sha256-Hw2SojeJgkRxbdWB95k1bgc8LaY8Oy5KAeEDLL7VDig=";
   };
 
   nativeBuildInputs = [ bison cmake pkg-config ]
diff --git a/pkgs/servers/tailscale/default.nix b/pkgs/servers/tailscale/default.nix
index 7bb559efa4c7..b936fd316283 100644
--- a/pkgs/servers/tailscale/default.nix
+++ b/pkgs/servers/tailscale/default.nix
@@ -2,15 +2,15 @@
 
 buildGoModule rec {
   pname = "tailscale";
-  version = "1.34.2";
+  version = "1.36.0";
 
   src = fetchFromGitHub {
     owner = "tailscale";
     repo = "tailscale";
     rev = "v${version}";
-    sha256 = "sha256-uFr7swB7AQLvjDg+1KBCQuoLkDw454+gVe+6/iD74LM=";
+    sha256 = "sha256-hNyEABs/GdfOx6vLTVBgbOzkbFvEDYZ0y1y0a0mIsfA=";
   };
-  vendorSha256 = "sha256-//qhvzZzaAqfcj4HZIy6ZkGyfAwtRdf7ARaXI+trTe0=";
+  vendorSha256 = "sha256-Jy3kjUA8qLhcw9XLw4Xo1zhD+IWZrDNM79TsbnKpx/g=";
 
   nativeBuildInputs = lib.optionals stdenv.isLinux [ makeWrapper ];
 
diff --git a/pkgs/tools/filesystems/fatsort/default.nix b/pkgs/tools/filesystems/fatsort/default.nix
index d01ebce489c8..2ca135704e0c 100644
--- a/pkgs/tools/filesystems/fatsort/default.nix
+++ b/pkgs/tools/filesystems/fatsort/default.nix
@@ -14,12 +14,14 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-mm+JoGQLt4LYL/I6eAyfCuw9++RoLAqO2hV+CBBkLq0=";
   };
 
-  buildInputs = [ help2man ]
-    ++ lib.optionals stdenv.isDarwin [ libiconv ];
+  buildInputs = [ help2man libiconv ];
 
   makeFlags = [
     "CC=${stdenv.cc.targetPrefix}cc"
     "LD=${stdenv.cc.targetPrefix}cc"
+
+    "UNAME_O=${stdenv.hostPlatform.uname.system}"
+    "UNAME_S=${stdenv.hostPlatform.uname.system}"
   ];
 
   # make install target is broken (DESTDIR usage is insane)
@@ -35,7 +37,7 @@ stdenv.mkDerivation rec {
     homepage = "http://fatsort.sourceforge.net/";
     description = "Sorts FAT partition table, for devices that don't do sorting of files";
     maintainers = [ maintainers.kovirobi ];
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/tools/graphics/wallutils/lscollection-Add-NixOS-paths-to-DefaultWallpaperDirectories.patch b/pkgs/tools/graphics/wallutils/000-add-nixos-dirs-to-default-wallpapers.patch
similarity index 100%
rename from pkgs/tools/graphics/wallutils/lscollection-Add-NixOS-paths-to-DefaultWallpaperDirectories.patch
rename to pkgs/tools/graphics/wallutils/000-add-nixos-dirs-to-default-wallpapers.patch
diff --git a/pkgs/tools/graphics/wallutils/default.nix b/pkgs/tools/graphics/wallutils/default.nix
index 67c325eb26af..6479dba2493f 100644
--- a/pkgs/tools/graphics/wallutils/default.nix
+++ b/pkgs/tools/graphics/wallutils/default.nix
@@ -1,45 +1,58 @@
 { lib
 , buildGoModule
 , fetchFromGitHub
-, pkg-config
-, wayland
 , libX11
-, xbitmaps
 , libXcursor
 , libXmu
 , libXpm
 , libheif
+, pkg-config
+, wayland
+, xbitmaps
 }:
 
 buildGoModule rec {
   pname = "wallutils";
-  version = "5.12.4";
+  version = "5.12.5";
 
   src = fetchFromGitHub {
     owner = "xyproto";
     repo = "wallutils";
     rev = version;
-    sha256 = "sha256-NODG4Lw/7X1aoT+dDSWxWEbDX6EAQzzDJPwsWOLaJEM=";
+    hash = "sha256-qC+AF+NFXSrUZAYaiFPwvfZtsAGhKE4XFDOUcfXUAbM=";
   };
 
   vendorSha256 = null;
 
-  patches = [ ./lscollection-Add-NixOS-paths-to-DefaultWallpaperDirectories.patch ];
+  patches = [
+    ./000-add-nixos-dirs-to-default-wallpapers.patch
+  ];
 
   excludedPackages = [
     "./pkg/event/cmd" # Development tools
   ];
 
-  ldflags = [ "-s" "-w" ];
+  nativeBuildInputs = [
+    pkg-config
+  ];
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ wayland libX11 xbitmaps libXcursor libXmu libXpm libheif ];
+  buildInputs = [
+    libX11
+    libXcursor
+    libXmu
+    libXpm
+    libheif
+    wayland
+    xbitmaps
+  ];
+
+  ldflags = [ "-s" "-w" ];
 
   preCheck =
     let skippedTests = [
-      "TestClosest" # Requiring Wayland or X.
-      "TestNewSimpleEvent" # Blocking
+      "TestClosest" # Requiring Wayland or X
       "TestEveryMinute" # Blocking
+      "TestNewSimpleEvent" # Blocking
     ]; in
     ''
       export XDG_RUNTIME_DIR=`mktemp -d`
@@ -47,11 +60,12 @@ buildGoModule rec {
       buildFlagsArray+=("-run" "[^(${builtins.concatStringsSep "|" skippedTests})]")
     '';
 
-  meta = with lib; {
+  meta = {
     description = "Utilities for handling monitors, resolutions, and (timed) wallpapers";
     inherit (src.meta) homepage;
-    license = licenses.bsd3;
-    maintainers = with maintainers; [ ];
-    platforms = platforms.linux;
+    license = lib.licenses.bsd3;
+    maintainers = [ lib.maintainers.AndersonTorres ];
+    inherit (wayland.meta) platforms;
+    badPlatforms = lib.platforms.darwin;
   };
 }
diff --git a/pkgs/tools/misc/ipxe/default.nix b/pkgs/tools/misc/ipxe/default.nix
index c495e3455a29..c3a0c5aa906d 100644
--- a/pkgs/tools/misc/ipxe/default.nix
+++ b/pkgs/tools/misc/ipxe/default.nix
@@ -30,7 +30,7 @@ in
 
 stdenv.mkDerivation rec {
   pname = "ipxe";
-  version = "unstable-2022-04-06";
+  version = "unstable-2023-01-25";
 
   nativeBuildInputs = [ gnu-efi mtools openssl perl xorriso xz ] ++ lib.optional stdenv.hostPlatform.isx86 syslinux;
   depsBuildBuild = [ buildPackages.stdenv.cc ];
@@ -40,8 +40,8 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "ipxe";
     repo = "ipxe";
-    rev = "70995397e5bdfd3431e12971aa40630c7014785f";
-    sha256 = "SrTNEYk13JXAcJuogm9fZ7CrzJIDRc0aziGdjRNv96I=";
+    rev = "4bffe0f0d9d0e1496ae5cfb7579e813277c29b0f";
+    sha256 = "oDQBJz6KKV72DfhNEXjAZNeolufIUQwhroczCuYnGQA=";
   };
 
   postPatch = lib.optionalString stdenv.hostPlatform.isAarch64 ''
diff --git a/pkgs/tools/misc/minicom/default.nix b/pkgs/tools/misc/minicom/default.nix
index f5d0e5e32264..4da38a1a0c69 100644
--- a/pkgs/tools/misc/minicom/default.nix
+++ b/pkgs/tools/misc/minicom/default.nix
@@ -49,6 +49,6 @@ stdenv.mkDerivation rec {
       download.
     '';
     maintainers = with maintainers; [ peterhoeg ];
-    platforms = platforms.linux ++ platforms.darwin;
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/tools/networking/linkchecker/default.nix b/pkgs/tools/networking/linkchecker/default.nix
index 3d245abf3765..c78c12c8fa77 100644
--- a/pkgs/tools/networking/linkchecker/default.nix
+++ b/pkgs/tools/networking/linkchecker/default.nix
@@ -51,7 +51,6 @@ python3.pkgs.buildPythonApplication rec {
   ] ++ lib.optionals stdenv.isDarwin [
     "tests/checker/test_content_allows_robots.py"
     "tests/checker/test_http*.py"
-    "tests/checker/test_noproxy.py"
     "tests/test_network.py"
   ];
 
diff --git a/pkgs/tools/security/step-ca/default.nix b/pkgs/tools/security/step-ca/default.nix
index d5d84909f772..8a6cc97ff15d 100644
--- a/pkgs/tools/security/step-ca/default.nix
+++ b/pkgs/tools/security/step-ca/default.nix
@@ -46,6 +46,9 @@ buildGoModule rec {
   # Tests start http servers which need to bind to local addresses:
   # panic: httptest: failed to listen on a port: listen tcp6 [::1]:0: bind: operation not permitted
   __darwinAllowLocalNetworking = true;
+  # Tests need to run in a reproducible order, otherwise they run unreliably on
+  # (at least) x86_64-linux.
+  checkFlags = [ "-p 1" ];
 
   passthru.tests.step-ca = nixosTests.step-ca;
 
diff --git a/pkgs/tools/system/automatic-timezoned/default.nix b/pkgs/tools/system/automatic-timezoned/default.nix
index cea88a31f600..829bd30e4e94 100644
--- a/pkgs/tools/system/automatic-timezoned/default.nix
+++ b/pkgs/tools/system/automatic-timezoned/default.nix
@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "automatic-timezoned";
-  version = "1.0.55";
+  version = "1.0.57";
 
   src = fetchFromGitHub {
     owner = "maxbrunet";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-80GP7w3YF7RNMTlSI5SCQfugjkNBweX5BcYk4ODimBQ=";
+    sha256 = "sha256-Wb7X4eDG9vZLJF5b9JPb0JVjQgstFo7Zr1MnidKcuZI=";
   };
 
-  cargoHash = "sha256-WtqK8T/3Mo/y3cPn8d6kDzC59qE70JUHFdHk7mFpP1k=";
+  cargoHash = "sha256-BcIGaAGTwm8QBvrL7J91asNEpnFdsgDtRPDSWdE9JHI=";
 
   meta = with lib; {
     description = "Automatically update system timezone based on location";
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index b8c5b329e45f..8ce5080662a8 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -5538,6 +5538,8 @@ self: super: with self; {
 
   lsassy = callPackage ../development/python-modules/lsassy { };
 
+  lsprotocol = callPackage ../development/python-modules/lsprotocol { };
+
   luddite = callPackage ../development/python-modules/luddite { };
 
   ludios_wpull = callPackage ../development/python-modules/ludios_wpull { };
@@ -6160,6 +6162,8 @@ self: super: with self; {
 
   nomadnet = callPackage ../development/python-modules/nomadnet { };
 
+  nox = callPackage ../development/python-modules/nox { };
+
   nanomsg-python = callPackage ../development/python-modules/nanomsg-python {
     inherit (pkgs) nanomsg;
   };