diff --git a/doc/.gitignore b/doc/.gitignore
index e532ed0eb9c8..b08285995f66 100644
--- a/doc/.gitignore
+++ b/doc/.gitignore
@@ -8,3 +8,4 @@ manual-full.xml
 out
 result
 result-*
+media
diff --git a/doc/builders/special.xml b/doc/builders/special.xml
index c97113481981..18cf6cfd39c7 100644
--- a/doc/builders/special.xml
+++ b/doc/builders/special.xml
@@ -9,4 +9,5 @@
  <xi:include href="special/makesetuphook.section.xml" />
  <xi:include href="special/mkshell.section.xml" />
  <xi:include href="special/darwin-builder.section.xml" />
+ <xi:include href="special/vm-tools.section.xml" />
 </chapter>
diff --git a/doc/builders/special/vm-tools.section.md b/doc/builders/special/vm-tools.section.md
new file mode 100644
index 000000000000..3b6fb0d2556b
--- /dev/null
+++ b/doc/builders/special/vm-tools.section.md
@@ -0,0 +1,148 @@
+# vmTools {#sec-vm-tools}
+
+A set of VM related utilities, that help in building some packages in more advanced scenarios.
+
+## `vmTools.createEmptyImage` {#vm-tools-createEmptyImage}
+
+A bash script fragment that produces a disk image at `destination`.
+
+### Attributes
+
+* `size`. The disk size, in MiB.
+* `fullName`. Name that will be written to `${destination}/nix-support/full-name`.
+* `destination` (optional, default `$out`). Where to write the image files.
+
+## `vmTools.runInLinuxVM` {#vm-tools-runInLinuxVM}
+
+Run a derivation in a Linux virtual machine (using Qemu/KVM).
+By default, there is no disk image; the root filesystem is a `tmpfs`, and the Nix store is shared with the host (via the [9P protocol](https://wiki.qemu.org/Documentation/9p#9p_Protocol)).
+Thus, any pure Nix derivation should run unmodified.
+
+If the build fails and Nix is run with the `-K/--keep-failed` option, a script `run-vm` will be left behind in the temporary build directory that allows you to boot into the VM and debug it interactively.
+
+### Attributes
+
+* `preVM` (optional). Shell command to be evaluated *before* the VM is started (i.e., on the host).
+* `memSize` (optional, default `512`). The memory size of the VM in MiB.
+* `diskImage` (optional). A file system image to be attached to `/dev/sda`.
+  Note that currently we expect the image to contain a filesystem, not a full disk image with a partition table etc.
+
+### Examples
+
+Build the derivation hello inside a VM:
+```nix
+{ pkgs }: with pkgs; with vmTools;
+runInLinuxVM hello
+```
+
+Build inside a VM with extra memory:
+```nix
+{ pkgs }: with pkgs; with vmTools;
+runInLinuxVM (hello.overrideAttrs (_: { memSize = 1024; }))
+```
+
+Use VM with a disk image (implicitly sets `diskImage`, see [`vmTools.createEmptyImage`](#vm-tools-createEmptyImage)):
+```nix
+{ pkgs }: with pkgs; with vmTools;
+runInLinuxVM (hello.overrideAttrs (_: {
+  preVM = createEmptyImage {
+    size = 1024;
+    fullName = "vm-image";
+  };
+}))
+```
+
+## `vmTools.extractFs` {#vm-tools-extractFs}
+
+Takes a file, such as an ISO, and extracts its contents into the store.
+
+### Attributes
+
+* `file`. Path to the file to be extracted.
+  Note that currently we expect the image to contain a filesystem, not a full disk image with a partition table etc.
+* `fs` (optional). Filesystem of the contents of the file.
+
+### Examples
+
+Extract the contents of an ISO file:
+```nix
+{ pkgs }: with pkgs; with vmTools;
+extractFs { file = ./image.iso; }
+```
+
+## `vmTools.extractMTDfs` {#vm-tools-extractMTDfs}
+
+Like [](#vm-tools-extractFs), but it makes use of a [Memory Technology Device (MTD)](https://en.wikipedia.org/wiki/Memory_Technology_Device).
+
+## `vmTools.runInLinuxImage` {#vm-tools-runInLinuxImage}
+
+Like [](#vm-tools-runInLinuxVM), but instead of using `stdenv` from the Nix store, run the build using the tools provided by `/bin`, `/usr/bin`, etc. from the specified filesystem image, which typically is a filesystem containing a [FHS](https://en.wikipedia.org/wiki/Filesystem_Hierarchy_Standard)-based Linux distribution.
+
+## `vmTools.makeImageTestScript` {#vm-tools-makeImageTestScript}
+
+Generate a script that can be used to run an interactive session in the given image.
+
+### Examples
+
+Create a script for running a Fedora 27 VM:
+```nix
+{ pkgs }: with pkgs; with vmTools;
+makeImageTestScript diskImages.fedora27x86_64
+```
+
+Create a script for running an Ubuntu 20.04 VM:
+```nix
+{ pkgs }: with pkgs; with vmTools;
+makeImageTestScript diskImages.ubuntu2004x86_64
+```
+
+## `vmTools.diskImageFuns` {#vm-tools-diskImageFuns}
+
+A set of functions that build a predefined set of minimal Linux distributions images.
+
+### Images
+
+* Fedora
+  * `fedora26x86_64`
+  * `fedora27x86_64`
+* CentOS
+  * `centos6i386`
+  * `centos6x86_64`
+  * `centos7x86_64`
+* Ubuntu
+  * `ubuntu1404i386`
+  * `ubuntu1404x86_64`
+  * `ubuntu1604i386`
+  * `ubuntu1604x86_64`
+  * `ubuntu1804i386`
+  * `ubuntu1804x86_64`
+  * `ubuntu2004i386`
+  * `ubuntu2004x86_64`
+  * `ubuntu2204i386`
+  * `ubuntu2204x86_64`
+* Debian
+  * `debian10i386`
+  * `debian10x86_64`
+  * `debian11i386`
+  * `debian11x86_64`
+
+### Attributes
+
+* `size` (optional, defaults to `4096`). The size of the image, in MiB.
+* `extraPackages` (optional). A list names of additional packages from the distribution that should be included in the image.
+
+### Examples
+
+8GiB image containing Firefox in addition to the default packages:
+```nix
+{ pkgs }: with pkgs; with vmTools;
+diskImageFuns.ubuntu2004x86_64 { extraPackages = [ "firefox" ]; size = 8192; }
+```
+
+## `vmTools.diskImageExtraFuns` {#vm-tools-diskImageExtraFuns}
+
+Shorthand for `vmTools.diskImageFuns.<attr> { extraPackages = ... }`.
+
+## `vmTools.diskImages` {#vm-tools-diskImages}
+
+Shorthand for `vmTools.diskImageFuns.<attr> { }`.
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 2b7272fe496f..5e8e31d34317 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -5907,6 +5907,12 @@
       fingerprint = "F7D3 7890 228A 9074 40E1  FD48 46B9 228E 814A 2AAC";
     }];
   };
+  hacker1024 = {
+    name = "hacker1024";
+    email = "hacker1024@users.sourceforge.net";
+    github = "hacker1024";
+    githubId = 20849728;
+  };
   hagl = {
     email = "harald@glie.be";
     github = "hagl";
diff --git a/nixos/doc/manual/release-notes/rl-2305.section.md b/nixos/doc/manual/release-notes/rl-2305.section.md
index 8d3b3ffa5e0f..d60546fb74f8 100644
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@@ -334,6 +334,8 @@ In addition to numerous new and upgraded packages, this release has the followin
     [headscale's example configuration](https://github.com/juanfont/headscale/blob/main/config-example.yaml)
     can be directly written as attribute-set in Nix within this option.
 
+- `services.kubo` now unmounts `ipfsMountDir` and `ipnsMountDir` even if it is killed unexpectedly when 'autoMount` is enabled.
+
 - `nixos/lib/make-disk-image.nix` can now mutate EFI variables, run user-provided EFI firmware or variable templates. This is now extensively documented in the NixOS manual.
 
 - `services.grafana` listens only on localhost by default again. This was changed to upstreams default of `0.0.0.0` by accident in the freeform setting conversion.
diff --git a/nixos/modules/services/network-filesystems/kubo.nix b/nixos/modules/services/network-filesystems/kubo.nix
index 0cb0e126d4c5..468e47d749b7 100644
--- a/nixos/modules/services/network-filesystems/kubo.nix
+++ b/nixos/modules/services/network-filesystems/kubo.nix
@@ -319,6 +319,10 @@ in
           # change when the changes are applied. Whyyyyyy.....
           ipfs --offline config replace -
       '';
+      postStop = mkIf cfg.autoMount ''
+        # After an unclean shutdown the fuse mounts at cfg.ipnsMountDir and cfg.ipfsMountDir are locked
+        umount --quiet '${cfg.ipnsMountDir}' '${cfg.ipfsMountDir}' || true
+      '';
       serviceConfig = {
         ExecStart = [ "" "${cfg.package}/bin/ipfs daemon ${kuboFlags}" ];
         User = cfg.user;
diff --git a/nixos/tests/kubo.nix b/nixos/tests/kubo.nix
index 94aa24a9204f..3ea7c894ab3a 100644
--- a/nixos/tests/kubo.nix
+++ b/nixos/tests/kubo.nix
@@ -50,12 +50,20 @@ import ./make-test-python.nix ({ pkgs, ...} : {
     machine.succeed("test ! -e /var/lib/ipfs/")
 
     # Test FUSE mountpoint
-    ipfs_hash = fuse.succeed(
-        "echo fnord3 | ipfs --api /ip4/127.0.0.1/tcp/2324 add --quieter"
-    )
-
-    # The FUSE mount functionality is broken as of v0.13.0.
+    # The FUSE mount functionality is broken as of v0.13.0 and v0.17.0.
     # See https://github.com/ipfs/kubo/issues/9044.
-    # fuse.succeed(f"cat /ipfs/{ipfs_hash.strip()} | grep fnord3")
+    # Workaround: using CID Version 1 avoids that.
+    ipfs_hash = fuse.succeed(
+        "echo fnord3 | ipfs --api /ip4/127.0.0.1/tcp/2324 add --quieter --cid-version=1"
+    ).strip()
+
+    fuse.succeed(f"cat /ipfs/{ipfs_hash} | grep fnord3")
+
+    # Force Kubo to crash and wait for it to restart
+    # Tests the unmounting of /ipns and /ipfs
+    fuse.systemctl("kill --signal=SIGKILL ipfs.service")
+    fuse.wait_for_unit("ipfs.service", timeout = 30)
+
+    fuse.succeed(f"cat /ipfs/{ipfs_hash} | grep fnord3")
   '';
 })
diff --git a/pkgs/applications/editors/vim/plugins/nvim-treesitter/overrides.nix b/pkgs/applications/editors/vim/plugins/nvim-treesitter/overrides.nix
index bacebe9a7468..67aa37405638 100644
--- a/pkgs/applications/editors/vim/plugins/nvim-treesitter/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/nvim-treesitter/overrides.nix
@@ -27,6 +27,25 @@ let
       })
     generatedDerivations;
 
+  grammarToPlugin = grammar:
+    let
+      name = lib.pipe grammar [
+        lib.getName
+
+        # added in buildGrammar
+        (lib.removeSuffix "-grammar")
+
+        # grammars from tree-sitter.builtGrammars
+        (lib.removePrefix "tree-sitter-")
+        (lib.replaceStrings [ "-" ] [ "_" ])
+      ];
+    in
+
+    runCommand "nvim-treesitter-grammar-${name}" { } ''
+      mkdir -p $out/parser
+      ln -s ${grammar}/parser $out/parser/${name}.so
+    '';
+
   allGrammars = lib.attrValues generatedDerivations;
 
   # Usage:
@@ -35,26 +54,7 @@ let
   # pkgs.vimPlugins.nvim-treesitter.withAllGrammars
   withPlugins =
     f: self.nvim-treesitter.overrideAttrs (_: {
-      passthru.dependencies = map
-        (grammar:
-          let
-            name = lib.pipe grammar [
-              lib.getName
-
-              # added in buildGrammar
-              (lib.removeSuffix "-grammar")
-
-              # grammars from tree-sitter.builtGrammars
-              (lib.removePrefix "tree-sitter-")
-              (lib.replaceStrings [ "-" ] [ "_" ])
-            ];
-          in
-
-          runCommand "nvim-treesitter-${name}-grammar" { } ''
-            mkdir -p $out/parser
-            ln -s ${grammar}/parser $out/parser/${name}.so
-          ''
-        )
+      passthru.dependencies = map grammarToPlugin
         (f (tree-sitter.builtGrammars // builtGrammars));
     });
 
@@ -67,7 +67,9 @@ in
   '';
 
   passthru = {
-    inherit builtGrammars allGrammars withPlugins withAllGrammars;
+    inherit builtGrammars allGrammars grammarToPlugin withPlugins withAllGrammars;
+
+    grammarPlugins = lib.mapAttrs (_: grammarToPlugin) generatedDerivations;
 
     tests.check-queries =
       let
diff --git a/pkgs/applications/networking/cloudflared/default.nix b/pkgs/applications/networking/cloudflared/default.nix
index a386004c82cb..d3f76e54c936 100644
--- a/pkgs/applications/networking/cloudflared/default.nix
+++ b/pkgs/applications/networking/cloudflared/default.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "cloudflared";
-  version = "2023.3.0";
+  version = "2023.4.0";
 
   src = fetchFromGitHub {
     owner = "cloudflare";
     repo = "cloudflared";
     rev = "refs/tags/${version}";
-    hash = "sha256-LEK809MswDVwPJ6CuC13Fxb7fvliugixS/NOKBajqKM=";
+    hash = "sha256-+lmSztMstz8tYFP9rPmh99bkbCVea6wbiCrpbJUI/qc=";
   };
 
   vendorSha256 = null;
diff --git a/pkgs/applications/networking/cluster/tektoncd-cli/default.nix b/pkgs/applications/networking/cluster/tektoncd-cli/default.nix
index 1bc55b3db4ff..aee268f0a709 100644
--- a/pkgs/applications/networking/cluster/tektoncd-cli/default.nix
+++ b/pkgs/applications/networking/cluster/tektoncd-cli/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "tektoncd-cli";
-  version = "0.28.0";
+  version = "0.30.1";
 
   src = fetchFromGitHub {
     owner = "tektoncd";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "sha256-8OW0n6aS7bDDbzbrMfJLL8Yvq3vJg47qHQB4zY0xxAw=";
+    sha256 = "sha256-tn7nK5YTdEYJf9UBajOZEc8fQ0cx3qM0X/7UYnDklj8=";
   };
 
   vendorSha256 = null;
diff --git a/pkgs/applications/networking/feedreaders/newsboat/default.nix b/pkgs/applications/networking/feedreaders/newsboat/default.nix
index e2ef900ffb12..0fd6bbee8b58 100644
--- a/pkgs/applications/networking/feedreaders/newsboat/default.nix
+++ b/pkgs/applications/networking/feedreaders/newsboat/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, rustPlatform, fetchFromGitHub, stfl, sqlite, curl, gettext, pkg-config, libxml2, json_c, ncurses
-, asciidoctor, libiconv, Security, Foundation, makeWrapper }:
+, asciidoctor, libiconv, Security, Foundation, makeWrapper, nix-update-script }:
 
 rustPlatform.buildRustPackage rec {
   pname = "newsboat";
@@ -55,6 +55,10 @@ rustPlatform.buildRustPackage rec {
     done
   '';
 
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
   meta = with lib; {
     homepage    = "https://newsboat.org/";
     changelog   = "https://github.com/newsboat/newsboat/blob/${src.rev}/CHANGELOG.md";
diff --git a/pkgs/applications/networking/mailreaders/notmuch/default.nix b/pkgs/applications/networking/mailreaders/notmuch/default.nix
index d7de9e971ea3..3dccf614fb96 100644
--- a/pkgs/applications/networking/mailreaders/notmuch/default.nix
+++ b/pkgs/applications/networking/mailreaders/notmuch/default.nix
@@ -1,6 +1,6 @@
 { fetchurl, lib, stdenv
 , pkg-config, gnupg
-, xapian, gmime, talloc, zlib
+, xapian, gmime3, talloc, zlib
 , doxygen, perl, texinfo
 , notmuch
 , pythonPackages
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     gnupg                     # undefined dependencies
-    xapian gmime talloc zlib  # dependencies described in INSTALL
+    xapian gmime3 talloc zlib  # dependencies described in INSTALL
     perl
     pythonPackages.python
   ] ++ lib.optional withRuby ruby;
@@ -81,7 +81,7 @@ stdenv.mkDerivation rec {
     ln -s ${test-database} test/test-databases/database-v1.tar.xz
   '';
 
-  doCheck = !stdenv.hostPlatform.isDarwin && (lib.versionAtLeast gmime.version "3.0.3");
+  doCheck = !stdenv.hostPlatform.isDarwin && (lib.versionAtLeast gmime3.version "3.0.3");
   checkTarget = "test";
   nativeCheckInputs = [
     which dtach openssl bash
diff --git a/pkgs/applications/networking/remote/remmina/default.nix b/pkgs/applications/networking/remote/remmina/default.nix
index f1abf5834837..a76bad22c9e2 100644
--- a/pkgs/applications/networking/remote/remmina/default.nix
+++ b/pkgs/applications/networking/remote/remmina/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "remmina";
-  version = "1.4.29";
+  version = "1.4.30";
 
   src = fetchFromGitLab {
     owner  = "Remmina";
     repo   = "Remmina";
     rev    = "v${version}";
-    sha256 = "sha256-8B19rqbOYY+lS3Q/vh3Eu696KW03SOvlP9dgXPYYDiU=";
+    sha256 = "sha256-VYBolB6VJ3lT/rNl87qMW5DU5rdFCNvKezSLzx5y1JI=";
   };
 
   nativeBuildInputs = [ cmake ninja pkg-config wrapGAppsHook ];
diff --git a/pkgs/applications/radio/sdrangel/default.nix b/pkgs/applications/radio/sdrangel/default.nix
index 82627dbb6141..c8fb7da6f7a3 100644
--- a/pkgs/applications/radio/sdrangel/default.nix
+++ b/pkgs/applications/radio/sdrangel/default.nix
@@ -50,13 +50,13 @@
 
 mkDerivation rec {
   pname = "sdrangel";
-  version = "7.11.0";
+  version = "7.13.0";
 
   src = fetchFromGitHub {
     owner = "f4exb";
     repo = "sdrangel";
     rev = "v${version}";
-    hash = "sha256-zWux84a1MCK0XJXRXcaLHieJ47d4n/wO/xdwTYuuGJw=";
+    hash = "sha256-xG41FNlMfqH5MaGVFFENP0UFEkZYiWhtpNSPh2s4Irk=";
   };
 
   nativeBuildInputs = [ cmake ninja pkg-config ];
diff --git a/pkgs/development/compilers/codon/Add-a-hash-to-the-googletest-binary.patch b/pkgs/development/compilers/codon/Add-a-hash-to-the-googletest-binary.patch
new file mode 100644
index 000000000000..5183723d3d49
--- /dev/null
+++ b/pkgs/development/compilers/codon/Add-a-hash-to-the-googletest-binary.patch
@@ -0,0 +1,23 @@
+From 5c158213fc3afe39ee96be84e255c12d5886ca18 Mon Sep 17 00:00:00 2001
+From: Pavel Sobolev <paveloom@riseup.net>
+Date: Sat, 1 Apr 2023 17:38:37 +0300
+Subject: [PATCH] Add a hash to the `googletest` binary.
+
+---
+ CMakeLists.txt | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 0a06e6f..a614025 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -434,6 +434,7 @@ include(FetchContent)
+ FetchContent_Declare(
+   googletest
+   URL https://github.com/google/googletest/archive/609281088cfefc76f9d0ce82e1ff6c30cc3591e5.zip
++  URL_HASH SHA256=5cf189eb6847b4f8fc603a3ffff3b0771c08eec7dd4bd961bfd45477dd13eb73
+ )
+ # For Windows: Prevent overriding the parent project's compiler/linker settings
+ set(gtest_force_shared_crt ON CACHE BOOL "" FORCE)
+--
+2.39.2
diff --git a/pkgs/development/compilers/codon/default.nix b/pkgs/development/compilers/codon/default.nix
new file mode 100644
index 000000000000..65c177a7b957
--- /dev/null
+++ b/pkgs/development/compilers/codon/default.nix
@@ -0,0 +1,137 @@
+{ cacert
+, cmake
+, fetchFromGitHub
+, git
+, lib
+, lld
+, ninja
+, nix-update-script
+, perl
+, python3
+, stdenv
+}:
+
+let
+  version = "0.15.5";
+
+  src = fetchFromGitHub {
+    owner = "exaloop";
+    repo = "codon";
+    rev = "v${version}";
+    sha256 = "sha256-/IUGX5iSRvZzwyRdkGe0IVHp44D+GXZtbkdtswekwSU=";
+  };
+
+  depsDir = "deps";
+
+  codon-llvm = stdenv.mkDerivation {
+    pname = "codon-llvm";
+    version = "unstable-2022-09-23";
+
+    src = fetchFromGitHub {
+      owner = "exaloop";
+      repo = "llvm-project";
+      rev = "55b0b8fa1c9f9082b535628fc9fa6313280c0b9a";
+      sha256 = "sha256-03SPQgNdrpR6/JZ5aR/ntoh/FnZvCjT/6bTAcZaFafw=";
+    };
+
+    nativeBuildInputs = [
+      cmake
+      git
+      lld
+      ninja
+      python3
+    ];
+
+    cmakeFlags = [
+      "-DCMAKE_CXX_COMPILER=clang++"
+      "-DCMAKE_C_COMPILER=clang"
+      "-DLLVM_ENABLE_RTTI=ON"
+      "-DLLVM_ENABLE_TERMINFO=OFF"
+      "-DLLVM_ENABLE_ZLIB=OFF"
+      "-DLLVM_INCLUDE_TESTS=OFF"
+      "-DLLVM_TARGETS_TO_BUILD=all"
+      "-DLLVM_USE_LINKER=lld"
+      "-S ../llvm"
+    ];
+  };
+
+  codon-deps = stdenv.mkDerivation {
+    name = "codon-deps-${version}.tar.gz";
+
+    inherit src;
+
+    nativeBuildInputs = [
+      cacert
+      cmake
+      git
+      perl
+      python3
+    ];
+
+    dontBuild = true;
+
+    cmakeFlags = [
+      "-DCPM_DOWNLOAD_ALL=ON"
+      "-DCPM_SOURCE_CACHE=${depsDir}"
+      "-DLLVM_DIR=${codon-llvm}/lib/cmake/llvm"
+    ];
+
+    installPhase = ''
+      # Prune the `.git` directories
+      find ${depsDir} -name .git -type d -prune -exec rm -rf {} \;;
+      # Build a reproducible tar, per instructions at https://reproducible-builds.org/docs/archives/
+      tar --owner=0 --group=0 --numeric-owner --format=gnu \
+          --sort=name --mtime="@$SOURCE_DATE_EPOCH" \
+          -czf $out \
+            ${depsDir} \
+            cmake \
+            _deps/googletest-subbuild/googletest-populate-prefix/src/*.zip
+    '';
+
+    outputHash = "sha256-a1zGSpbMjfQBrcgW/aiIdKX8+uI3p/S9pgZjHe2HtWs=";
+    outputHashAlgo = "sha256";
+  };
+in
+stdenv.mkDerivation {
+  pname = "codon";
+
+  inherit src version;
+
+  patches = [
+    # Without the hash, CMake will try to replace the `.zip` file
+    ./Add-a-hash-to-the-googletest-binary.patch
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    git
+    lld
+    ninja
+    perl
+    python3
+  ];
+
+  postUnpack = ''
+    mkdir -p $sourceRoot/build
+    tar -xf ${codon-deps} -C $sourceRoot/build
+  '';
+
+  cmakeFlags = [
+    "-DCMAKE_BUILD_TYPE=Release"
+    "-DCMAKE_CXX_COMPILER=clang++"
+    "-DCMAKE_C_COMPILER=clang"
+    "-DCPM_SOURCE_CACHE=${depsDir}"
+    "-DLLVM_DIR=${codon-llvm}/lib/cmake/llvm"
+    "-DLLVM_USE_LINKER=lld"
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "A high-performance, zero-overhead, extensible Python compiler using LLVM";
+    homepage = "https://docs.exaloop.io/codon";
+    maintainers = [ lib.maintainers.paveloom ];
+    license = lib.licenses.bsl11;
+    platforms = lib.platforms.all;
+  };
+}
diff --git a/pkgs/development/libraries/qt-6/default.nix b/pkgs/development/libraries/qt-6/default.nix
index d790ecafbf4d..c608e859d10f 100644
--- a/pkgs/development/libraries/qt-6/default.nix
+++ b/pkgs/development/libraries/qt-6/default.nix
@@ -91,7 +91,7 @@ let
       qt5compat = callPackage ./modules/qt5compat.nix { };
       qtcharts = callPackage ./modules/qtcharts.nix { };
       qtconnectivity = callPackage ./modules/qtconnectivity.nix {
-        inherit (darwin.apple_sdk_11_0.frameworks) PCSC;
+        inherit (darwin.apple_sdk_11_0.frameworks) IOBluetooth PCSC;
       };
       qtdatavis3d = callPackage ./modules/qtdatavis3d.nix { };
       qtdeclarative = callPackage ./modules/qtdeclarative.nix { };
diff --git a/pkgs/development/libraries/qt-6/modules/qtconnectivity.nix b/pkgs/development/libraries/qt-6/modules/qtconnectivity.nix
index c62f13167fb1..976fd626f5d1 100644
--- a/pkgs/development/libraries/qt-6/modules/qtconnectivity.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtconnectivity.nix
@@ -5,6 +5,7 @@
 , qtdeclarative
 , bluez
 , pkg-config
+, IOBluetooth
 , PCSC
 }:
 
@@ -13,5 +14,5 @@ qtModule {
   qtInputs = [ qtbase qtdeclarative ];
   nativeBuildInputs = [ pkg-config ];
   buildInputs = lib.optionals stdenv.isLinux [ bluez ];
-  propagatedBuildInputs = lib.optionals stdenv.isDarwin [ PCSC ];
+  propagatedBuildInputs = lib.optionals stdenv.isDarwin [ IOBluetooth PCSC ];
 }
diff --git a/pkgs/development/python-modules/peaqevcore/default.nix b/pkgs/development/python-modules/peaqevcore/default.nix
index c6a8a1f4021e..54f099c06ee7 100644
--- a/pkgs/development/python-modules/peaqevcore/default.nix
+++ b/pkgs/development/python-modules/peaqevcore/default.nix
@@ -6,14 +6,14 @@
 
 buildPythonPackage rec {
   pname = "peaqevcore";
-  version = "15.2.1";
+  version = "15.2.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-71ea8r1g52SyWxG+aTl53WanM5z4XAj9k5E26ivpYoE=";
+    hash = "sha256-+k1G4A4bJJzRfYRISp869NeCBTsVldWb+c6Z1tNZNg0=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pytoml/default.nix b/pkgs/development/python-modules/pytoml/default.nix
deleted file mode 100644
index afa3e5244a05..000000000000
--- a/pkgs/development/python-modules/pytoml/default.nix
+++ /dev/null
@@ -1,34 +0,0 @@
-{ lib
-, buildPythonPackage
-, fetchFromGitHub
-, python
-, pytest
-}:
-
-buildPythonPackage rec {
-  pname = "pytoml";
-  version = "0.1.20";
-
-  src = fetchFromGitHub {
-    owner = "avakar";
-    repo = "pytoml";
-    rev = "v${version}";
-    fetchSubmodules = true; # ensure test submodule is available
-    sha256 = "02hjq44zhh6z0fsbm3hvz34sav6fic90sjrw8g1pkdvskzzl46mz";
-  };
-
-  nativeCheckInputs = [ pytest ];
-
-  checkPhase = ''
-    ${python.interpreter} test/test.py
-    pytest test
-  '';
-
-
-  meta = with lib; {
-    description = "A TOML parser/writer for Python";
-    homepage    = "https://github.com/avakar/pytoml";
-    license     = licenses.mit;
-    maintainers = with maintainers; [ peterhoeg ];
-  };
-}
diff --git a/pkgs/games/fheroes2/default.nix b/pkgs/games/fheroes2/default.nix
index 958ca8bb64a3..baa08a7dcd31 100644
--- a/pkgs/games/fheroes2/default.nix
+++ b/pkgs/games/fheroes2/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fheroes2";
-  version = "1.0.2";
+  version = "1.0.3";
 
   src = fetchFromGitHub {
     owner = "ihhub";
     repo = "fheroes2";
     rev = version;
-    sha256 = "sha256-Y1D9oLqO4al+1OXV9QhlzlZxSZtcQJtBQAzXqyhBFKI=";
+    sha256 = "sha256-msFuBKG/uuXxOcPf0KT3TWOiQrQ4rYHFxOcJ56QBkEU=";
   };
 
   nativeBuildInputs = [ imagemagick ];
diff --git a/pkgs/os-specific/darwin/apple-sdk-11.0/apple_sdk.nix b/pkgs/os-specific/darwin/apple-sdk-11.0/apple_sdk.nix
index 1860e150ca1a..ca23af43229c 100644
--- a/pkgs/os-specific/darwin/apple-sdk-11.0/apple_sdk.nix
+++ b/pkgs/os-specific/darwin/apple-sdk-11.0/apple_sdk.nix
@@ -233,6 +233,19 @@ in rec {
             $out/Library/Frameworks/CoreVideo.framework/Headers/CVBase.h
         '';
       });
+
+      System = lib.overrideDerivation super.System (drv: {
+        installPhase = drv.installPhase + ''
+          # Contrarily to the other frameworks, System framework's TBD file
+          # is a symlink pointing to ${MacOSX-SDK}/usr/lib/libSystem.B.tbd.
+          # This produces an error when installing the framework as:
+          #   1. The original file is not copied into the output directory
+          #   2. Even if it was copied, the relative path wouldn't match
+          # Thus, it is easier to replace the file than to fix the symlink.
+          cp --remove-destination ${MacOSX-SDK}/usr/lib/libSystem.B.tbd \
+            $out/Library/Frameworks/System.framework/Versions/B/System.tbd
+        '';
+      });
     };
 
     # Merge extraDeps into generatedDeps.
diff --git a/pkgs/os-specific/darwin/raycast/default.nix b/pkgs/os-specific/darwin/raycast/default.nix
index 99eb18a992ec..c75f1827f01c 100644
--- a/pkgs/os-specific/darwin/raycast/default.nix
+++ b/pkgs/os-specific/darwin/raycast/default.nix
@@ -6,7 +6,7 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "raycast";
-  version = "1.49.2";
+  version = "1.49.3";
 
   src = fetchurl {
     # https://github.com/NixOS/nixpkgs/pull/223495
@@ -17,7 +17,7 @@ stdenvNoCC.mkDerivation rec {
     # to host GitHub Actions to periodically check for updates
     # and re-release the `.dmg` file to Internet Archive (https://archive.org/details/raycast)
     url = "https://archive.org/download/raycast/raycast-${version}.dmg";
-    sha256 = "sha256-3evuSRSCZkhxRy/85ohzIVF1tKRlWy+G5BOmuCWF2hU=";
+    sha256 = "sha256-Irn99/49fRQg73cX8aKZ72D1o+mDPg44Q1pXAMdXrb0=";
   };
 
   dontPatch = true;
diff --git a/pkgs/servers/monitoring/prometheus/smokeping-prober.nix b/pkgs/servers/monitoring/prometheus/smokeping-prober.nix
index 8b1cbb962ade..617af9b8998e 100644
--- a/pkgs/servers/monitoring/prometheus/smokeping-prober.nix
+++ b/pkgs/servers/monitoring/prometheus/smokeping-prober.nix
@@ -1,18 +1,14 @@
 { lib, buildGoModule, fetchFromGitHub, nixosTests }:
 
-let
-  baseVersion = "0.4.2";
-  commit = "722200c4adbd6d1e5d847dfbbd9dec07aa4ca38d";
-in
 buildGoModule rec {
   pname = "smokeping_prober";
-  version = "${baseVersion}-g${commit}";
+  version = "0.4.2";
 
   ldflags = let
-    setVars = {
-      Version = baseVersion;
-      Revision = commit;
-      Branch = commit;
+    setVars = rec {
+      Version = version;
+      Revision = "722200c4adbd6d1e5d847dfbbd9dec07aa4ca38d";
+      Branch = Revision;
       BuildUser = "nix";
     };
     varFlags = lib.concatStringsSep " " (lib.mapAttrsToList (name: value: "-X github.com/prometheus/common/version.${name}=${value}") setVars);
@@ -21,9 +17,9 @@ buildGoModule rec {
   ];
 
   src = fetchFromGitHub {
-    rev = commit;
     owner = "SuperQ";
     repo = "smokeping_prober";
+    rev = "v${version}";
     sha256 = "1lpcjip6qxhalldgm6i2kgbajfqy3vwfyv9jy0jdpii13lv6mzlz";
   };
   vendorSha256 = "0p2jmlxpvpaqc445j39b4z4i3mnjrm25khv3sq6ylldcgfd31vz8";
diff --git a/pkgs/tools/admin/qovery-cli/default.nix b/pkgs/tools/admin/qovery-cli/default.nix
index 9663ce18221d..2cc041118e43 100644
--- a/pkgs/tools/admin/qovery-cli/default.nix
+++ b/pkgs/tools/admin/qovery-cli/default.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "qovery-cli";
-  version = "0.56.3";
+  version = "0.57.1";
 
   src = fetchFromGitHub {
     owner = "Qovery";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-DJkVIZBuKM5magrhW/+9IdvU5IVEFfF293X6vbFCfmI=";
+    hash = "sha256-i60u9U3SLu2EzRlLJliXrRC+SozreAsVI2Vd6gDDVE4=";
   };
 
   vendorHash = "sha256-1krHpwjs4kGhPMBF5j3iqUBo8TGKs1h+nDCmDmviPu4=";
diff --git a/pkgs/tools/backup/rustic-rs/default.nix b/pkgs/tools/backup/rustic-rs/default.nix
index 91d25cbb9859..da9803c6132b 100644
--- a/pkgs/tools/backup/rustic-rs/default.nix
+++ b/pkgs/tools/backup/rustic-rs/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rustic-rs";
-  version = "0.5.0";
+  version = "0.5.1";
 
   src = fetchFromGitHub {
     owner = "rustic-rs";
     repo = "rustic";
     rev = "refs/tags/v${version}";
-    hash = "sha256-r4hOjX/LKv2wX720FMEztUo9rf2hDBLfcHtENSZNA3U=";
+    hash = "sha256-r1h21J+pR8HiFfSxBwTVhuPFtc7HP+XnI3Xtx4oRKzY=";
   };
 
-  cargoHash = "sha256-sNxD8rDkfUw5aVhRYpYftpPMiWhiTYDdShlVZvx2BHk=";
+  cargoHash = "sha256-HiGBp79bxxZaupPo5s6cjXa4Q83O9i8VLzB9psjKSfo=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/misc/libpff/default.nix b/pkgs/tools/misc/libpff/default.nix
new file mode 100644
index 000000000000..62ee7c8f447c
--- /dev/null
+++ b/pkgs/tools/misc/libpff/default.nix
@@ -0,0 +1,28 @@
+{ stdenv
+, lib
+, fetchzip
+, pkg-config
+, autoreconfHook
+}:
+
+stdenv.mkDerivation rec {
+  pname = "libpff";
+  version = "20211114";
+
+  src = fetchzip {
+    url = "https://github.com/libyal/libpff/releases/download/${version}/libpff-alpha-${version}.tar.gz";
+    sha256 = "sha256-UmGRBgi78nDSuuOXi/WmODojWU5AbQGKNQwLseoh714=";
+  };
+
+  nativeBuildInputs = [ pkg-config autoreconfHook ];
+  outputs = [ "bin" "dev" "out" ];
+
+  meta = {
+    description = "Library and tools to access the Personal Folder File (PFF) and the Offline Folder File (OFF) format";
+    homepage = "https://github.com/libyal/libpff";
+    downloadPage = "https://github.com/libyal/libpff/releases";
+    changelog = "https://github.com/libyal/libpff/blob/${version}/ChangeLog";
+    license = lib.licenses.lgpl3Only;
+    maintainers = with lib.maintainers; [ hacker1024 ];
+  };
+}
diff --git a/pkgs/tools/misc/wasm-tools/Cargo.lock b/pkgs/tools/misc/wasm-tools/Cargo.lock
index 07b7895a6a38..e1586c4ea85f 100644
--- a/pkgs/tools/misc/wasm-tools/Cargo.lock
+++ b/pkgs/tools/misc/wasm-tools/Cargo.lock
@@ -1539,7 +1539,7 @@ checksum = "0046fef7e28c3804e5e38bfa31ea2a0f73905319b677e57ebe37e49358989b5d"
 
 [[package]]
 name = "wasm-compose"
-version = "0.2.10"
+version = "0.2.12"
 dependencies = [
  "anyhow",
  "clap 4.1.8",
@@ -1553,7 +1553,7 @@ dependencies = [
  "serde_yaml",
  "smallvec",
  "wasm-encoder",
- "wasmparser 0.102.0",
+ "wasmparser 0.103.0",
  "wasmprinter",
  "wat",
 ]
@@ -1565,25 +1565,25 @@ dependencies = [
  "anyhow",
  "leb128",
  "tempfile",
- "wasmparser 0.102.0",
+ "wasmparser 0.103.0",
 ]
 
 [[package]]
 name = "wasm-metadata"
-version = "0.3.1"
+version = "0.4.0"
 dependencies = [
  "anyhow",
  "clap 4.1.8",
  "indexmap",
  "serde",
  "wasm-encoder",
- "wasmparser 0.102.0",
+ "wasmparser 0.103.0",
  "wat",
 ]
 
 [[package]]
 name = "wasm-mutate"
-version = "0.2.21"
+version = "0.2.23"
 dependencies = [
  "anyhow",
  "clap 4.1.8",
@@ -1593,7 +1593,7 @@ dependencies = [
  "rand",
  "thiserror",
  "wasm-encoder",
- "wasmparser 0.102.0",
+ "wasmparser 0.103.0",
  "wasmprinter",
  "wat",
 ]
@@ -1611,14 +1611,14 @@ dependencies = [
  "num_cpus",
  "rand",
  "wasm-mutate",
- "wasmparser 0.102.0",
+ "wasmparser 0.103.0",
  "wasmprinter",
  "wasmtime",
 ]
 
 [[package]]
 name = "wasm-shrink"
-version = "0.1.22"
+version = "0.1.24"
 dependencies = [
  "anyhow",
  "blake3",
@@ -1627,14 +1627,14 @@ dependencies = [
  "log",
  "rand",
  "wasm-mutate",
- "wasmparser 0.102.0",
+ "wasmparser 0.103.0",
  "wasmprinter",
  "wat",
 ]
 
 [[package]]
 name = "wasm-smith"
-version = "0.12.5"
+version = "0.12.6"
 dependencies = [
  "arbitrary",
  "criterion",
@@ -1645,14 +1645,14 @@ dependencies = [
  "rand",
  "serde",
  "wasm-encoder",
- "wasmparser 0.102.0",
+ "wasmparser 0.103.0",
  "wasmprinter",
  "wat",
 ]
 
 [[package]]
 name = "wasm-tools"
-version = "1.0.27"
+version = "1.0.30"
 dependencies = [
  "anyhow",
  "arbitrary",
@@ -1676,7 +1676,7 @@ dependencies = [
  "wasm-mutate",
  "wasm-shrink",
  "wasm-smith",
- "wasmparser 0.102.0",
+ "wasmparser 0.103.0",
  "wasmprinter",
  "wast",
  "wat",
@@ -1692,7 +1692,7 @@ dependencies = [
  "wasm-mutate",
  "wasm-shrink",
  "wasm-smith",
- "wasmparser 0.102.0",
+ "wasmparser 0.103.0",
  "wasmprinter",
  "wast",
  "wat",
@@ -1711,7 +1711,7 @@ dependencies = [
  "wasm-encoder",
  "wasm-mutate",
  "wasm-smith",
- "wasmparser 0.102.0",
+ "wasmparser 0.103.0",
  "wasmprinter",
  "wasmtime",
  "wast",
@@ -1731,7 +1731,7 @@ dependencies = [
 
 [[package]]
 name = "wasmparser"
-version = "0.102.0"
+version = "0.103.0"
 dependencies = [
  "anyhow",
  "criterion",
@@ -1746,13 +1746,13 @@ dependencies = [
 
 [[package]]
 name = "wasmprinter"
-version = "0.2.53"
+version = "0.2.55"
 dependencies = [
  "anyhow",
  "diff",
  "rayon",
  "tempfile",
- "wasmparser 0.102.0",
+ "wasmparser 0.103.0",
  "wast",
  "wat",
 ]
@@ -1914,7 +1914,7 @@ dependencies = [
 
 [[package]]
 name = "wast"
-version = "55.0.0"
+version = "56.0.0"
 dependencies = [
  "anyhow",
  "leb128",
@@ -1922,13 +1922,13 @@ dependencies = [
  "rayon",
  "unicode-width",
  "wasm-encoder",
- "wasmparser 0.102.0",
+ "wasmparser 0.103.0",
  "wat",
 ]
 
 [[package]]
 name = "wat"
-version = "1.0.61"
+version = "1.0.62"
 dependencies = [
  "wast",
 ]
@@ -2100,7 +2100,7 @@ checksum = "447660ad36a13288b1db4d4248e857b510e8c3a225c822ba4fb748c0aafecffd"
 
 [[package]]
 name = "wit-component"
-version = "0.7.3"
+version = "0.8.1"
 dependencies = [
  "anyhow",
  "bitflags",
@@ -2112,7 +2112,7 @@ dependencies = [
  "url",
  "wasm-encoder",
  "wasm-metadata",
- "wasmparser 0.102.0",
+ "wasmparser 0.103.0",
  "wasmprinter",
  "wat",
  "wit-parser",
@@ -2120,7 +2120,7 @@ dependencies = [
 
 [[package]]
 name = "wit-parser"
-version = "0.6.4"
+version = "0.7.0"
 dependencies = [
  "anyhow",
  "env_logger",
diff --git a/pkgs/tools/misc/wasm-tools/default.nix b/pkgs/tools/misc/wasm-tools/default.nix
index 302f3e99c2e1..8481300470dc 100644
--- a/pkgs/tools/misc/wasm-tools/default.nix
+++ b/pkgs/tools/misc/wasm-tools/default.nix
@@ -5,13 +5,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "wasm-tools";
-  version = "1.0.27";
+  version = "1.0.30";
 
   src = fetchFromGitHub {
     owner = "bytecodealliance";
     repo = pname;
     rev = "${pname}-${version}";
-    hash = "sha256-kuTcxZLtQyDcj8SFfpJRNwto1e5iuXjxqZ46CnLOVIc=";
+    hash = "sha256-Sd4oYHywXejLPDbNmQ73bWGw48QNQ8M+2l3CjC6D6Iw=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/tools/misc/wv/default.nix b/pkgs/tools/misc/wv/default.nix
index 3b581f8ea154..ed1b39b38df4 100644
--- a/pkgs/tools/misc/wv/default.nix
+++ b/pkgs/tools/misc/wv/default.nix
@@ -22,6 +22,8 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "format" ];
 
+  enableParallelBuilding = true;
+
   # autoreconfHook fails hard if these two files do not exist
   postPatch = ''
     touch AUTHORS ChangeLog
diff --git a/pkgs/tools/networking/networkmanager/strongswan/default.nix b/pkgs/tools/networking/networkmanager/strongswan/default.nix
index e080ca17db13..545dd3d82cdc 100644
--- a/pkgs/tools/networking/networkmanager/strongswan/default.nix
+++ b/pkgs/tools/networking/networkmanager/strongswan/default.nix
@@ -38,6 +38,7 @@ stdenv.mkDerivation rec {
   ];
 
   configureFlags = [
+    "--disable-more-warnings" # disables -Werror
     "--with-charon=${strongswanNM}/libexec/ipsec/charon-nm"
     "--with-nm-libexecdir=${placeholder "out"}/libexec"
     "--with-nm-plugindir=${placeholder "out"}/lib/NetworkManager"
diff --git a/pkgs/tools/networking/nuttcp/default.nix b/pkgs/tools/networking/nuttcp/default.nix
index 1b9e9fe04e43..584ad029970e 100644
--- a/pkgs/tools/networking/nuttcp/default.nix
+++ b/pkgs/tools/networking/nuttcp/default.nix
@@ -1,32 +1,29 @@
-{ lib, stdenv, fetchurl }:
+{ lib
+, stdenv
+, fetchurl
+, installShellFiles
+}:
 
 stdenv.mkDerivation rec {
   pname = "nuttcp";
-  version = "8.1.4";
+  version = "8.2.2";
 
   src = fetchurl {
-    urls = [
-      "http://nuttcp.net/nuttcp/latest/${pname}-${version}.c"
-      "http://nuttcp.net/nuttcp/${pname}-${version}/${pname}-${version}.c"
-      "http://nuttcp.net/nuttcp/beta/${pname}-${version}.c"
-    ];
-    sha256 = "1mygfhwxfi6xg0iycivx98ckak2abc3vwndq74278kpd8g0yyqyh";
+    url = "http://nuttcp.net/nuttcp/nuttcp-${version}.tar.bz2";
+    sha256 = "sha256-fq16ieeqoFnSDjQELFihmMKYHK1ylVDROI3fyQNtOYM=";
   };
 
-  man = fetchurl {
-    url = "http://nuttcp.net/nuttcp/${pname}-${version}/nuttcp.8";
-    sha256 = "1yang94mcdqg362qbi85b63746hk6gczxrk619hyj91v5763n4vx";
-  };
-
-  dontUnpack = true;
-
-  buildPhase = ''
-    cc -O2 -o nuttcp $src
-  '';
+  nativeBuildInputs = [
+    installShellFiles
+  ];
 
   installPhase = ''
     mkdir -p $out/bin
-    cp nuttcp $out/bin
+    cp nuttcp-${version} $out/bin/nuttcp
+  '';
+
+  postInstall = ''
+    installManPage nuttcp.8
   '';
 
   meta = with lib; {
@@ -43,7 +40,7 @@ stdenv.mkDerivation rec {
       system, and wall-clock time, transmitter and receiver CPU utilization,
       and loss percentage (for UDP transfers).
     '';
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
     homepage = "http://nuttcp.net/";
     maintainers = with maintainers; [ ];
     platforms = platforms.unix;
diff --git a/pkgs/tools/networking/zap/default.nix b/pkgs/tools/networking/zap/default.nix
index c8168d22249d..0a8b3903618f 100644
--- a/pkgs/tools/networking/zap/default.nix
+++ b/pkgs/tools/networking/zap/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
     #!${runtimeShell}
     export PATH="${lib.makeBinPath [ jre ]}:\$PATH"
     export JAVA_HOME='${jre}'
-    if ! [ -f "~/.ZAP/config.xml" ];then
+    if ! [ -f "\$HOME/.ZAP/config.xml" ];then
       mkdir -p "\$HOME/.ZAP"
       head -n 2 $out/share/${pname}/xml/config.xml > "\$HOME/.ZAP/config.xml"
       echo "<version>${version_tag}</version>" >> "\$HOME/.ZAP/config.xml"
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://www.owasp.org/index.php/ZAP";
     description = "Java application for web penetration testing";
-    maintainers = with maintainers; [ mog ];
+    maintainers = with maintainers; [ mog rafael ];
     platforms = platforms.linux;
     license = licenses.asl20;
   };
diff --git a/pkgs/tools/security/pynitrokey/default.nix b/pkgs/tools/security/pynitrokey/default.nix
index 9c3eec9e9f3f..dfd9454400fc 100644
--- a/pkgs/tools/security/pynitrokey/default.nix
+++ b/pkgs/tools/security/pynitrokey/default.nix
@@ -4,12 +4,12 @@ with python3Packages;
 
 buildPythonApplication rec {
   pname = "pynitrokey";
-  version = "0.4.34";
+  version = "0.4.36";
   format = "flit";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-lMXoDkNiAmGb6e4u/vZMcmXUclwW402YUGihLjWIr+U=";
+    hash = "sha256-Y+6T1iUp9TVYbAjpXVHozC6WT061r0VYv/ifu8lcN6E=";
   };
 
   propagatedBuildInputs = [
@@ -39,6 +39,7 @@ buildPythonApplication rec {
 
   pythonRelaxDeps = [
     "cryptography"
+    "protobuf"
     "python-dateutil"
     "spsdk"
     "typing_extensions"
diff --git a/pkgs/tools/text/d2/default.nix b/pkgs/tools/text/d2/default.nix
index 14a8987af244..fab7a6441829 100644
--- a/pkgs/tools/text/d2/default.nix
+++ b/pkgs/tools/text/d2/default.nix
@@ -2,23 +2,26 @@
 , buildGoModule
 , fetchFromGitHub
 , installShellFiles
+, git
 , testers
 , d2
 }:
 
 buildGoModule rec {
   pname = "d2";
-  version = "0.3.0";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "terrastruct";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-ll6kOmHJZRsN6DkQRAUXyxz61tjwwi+p5eOuLfGDpI8=";
+    hash = "sha256-vMgOFZJwlWjNfOp4QsFoq1y9JQm16qDkP7uoOwICuTo=";
   };
 
   vendorHash = "sha256-jfGolYHWX/9Zr5JHiWl8mCfaaRT2AU8v32PtgM1KI8c=";
 
+  excludedPackages = [ "./e2etests" ];
+
   ldflags = [
     "-s"
     "-w"
@@ -31,7 +34,12 @@ buildGoModule rec {
     installManPage ci/release/template/man/d2.1
   '';
 
-  subPackages = [ "." ];
+  nativeCheckInputs = [ git ];
+
+  preCheck = ''
+    # See https://github.com/terrastruct/d2/blob/master/docs/CONTRIBUTING.md#running-tests.
+    export TESTDATA_ACCEPT=1
+  '';
 
   passthru.tests.version = testers.testVersion { package = d2; };
 
diff --git a/pkgs/tools/typesetting/tex/auctex/default.nix b/pkgs/tools/typesetting/tex/auctex/default.nix
index f19ddaebdfa1..e928608f9e22 100644
--- a/pkgs/tools/typesetting/tex/auctex/default.nix
+++ b/pkgs/tools/typesetting/tex/auctex/default.nix
@@ -17,7 +17,7 @@ let auctex = stdenv.mkDerivation ( rec {
   buildInputs = [
     emacs
     ghostscript
-    texlive.combined.scheme-basic
+    (texlive.combine { inherit (texlive) scheme-basic hypdoc;  })
   ];
 
   preConfigure = ''
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 9013115d9530..10cd2b87357e 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -9077,6 +9077,8 @@ with pkgs;
 
   libgen-cli = callPackage ../tools/misc/libgen-cli { };
 
+  libpff = callPackage ../tools/misc/libpff {};
+
   licensor = callPackage ../tools/misc/licensor { };
 
   lesspipe = callPackage ../tools/misc/lesspipe { };
@@ -14362,6 +14364,10 @@ with pkgs;
 
   ciao = callPackage ../development/compilers/ciao { };
 
+  codon = callPackage ../development/compilers/codon {
+    inherit (llvmPackages_latest) lld stdenv;
+  };
+
   colm = callPackage ../development/compilers/colm { };
 
   colmap = libsForQt5.callPackage ../applications/science/misc/colmap { cudaSupport = config.cudaSupport or false; };
@@ -32615,7 +32621,6 @@ with pkgs;
   notepadqq = libsForQt5.callPackage ../applications/editors/notepadqq { };
 
   notmuch = callPackage ../applications/networking/mailreaders/notmuch {
-    gmime = gmime3;
     pythonPackages = python3Packages;
   };
 
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 3ed3f3c76ec2..b3bd9c69d688 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -237,6 +237,7 @@ mapAliases ({
   python-subunit = subunit; # added 2021-09-10
   pytest_xdist = pytest-xdist; # added 2021-01-04
   python_simple_hipchat = python-simple-hipchat; # added 2021-07-21
+  pytoml = throw "pytoml has been removed because it is unmaintained and is superseded by toml"; # Added 2023-04-11
   pytorch = torch; # added 2022-09-30
   pytorch-bin = torch-bin; # added 2022-09-30
   pytorchWithCuda = torchWithCuda; # added 2022-09-30
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 3911f78be3f3..48c65a662d1f 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -9746,8 +9746,6 @@ self: super: with self; {
 
   pytmx = callPackage ../development/python-modules/pytmx { };
 
-  pytoml = callPackage ../development/python-modules/pytoml { };
-
   pytomlpp = callPackage ../development/python-modules/pytomlpp { };
 
   pytoolconfig = callPackage ../development/python-modules/pytoolconfig { };