diff --git a/pkgs/by-name/em/emacs-lsp-booster/package.nix b/pkgs/by-name/em/emacs-lsp-booster/package.nix
index beaa52d301b2..b3f6af1b9dc6 100644
--- a/pkgs/by-name/em/emacs-lsp-booster/package.nix
+++ b/pkgs/by-name/em/emacs-lsp-booster/package.nix
@@ -6,16 +6,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "emacs-lsp-booster";
-  version = "0.2.0";
+  version = "0.2.1";
 
   src = fetchFromGitHub {
     owner = "blahgeek";
     repo = "emacs-lsp-booster";
     rev = "v${version}";
-    hash = "sha256-DmEnuAR/OtTdKApEWCdOPAJplT29kuM6ZSHeOnQVo/c=";
+    hash = "sha256-uP/xJfXQtk8oaG5Zk+dw+C2fVFdjpUZTDASFuj1+eYs=";
   };
 
-  cargoHash = "sha256-2wXsPkBl4InjbdYUiiQ+5fZFanLA88t5ApGZ4psfDqk=";
+  cargoHash = "sha256-CvIJ56QrIzQULFeXYQXTpX9PoGx1/DWtgwzfJ+mljEI=";
 
   nativeCheckInputs = [emacs]; # tests/bytecode_test
 
diff --git a/pkgs/by-name/ma/markdown-oxide/package.nix b/pkgs/by-name/ma/markdown-oxide/package.nix
index a2739744c3a8..60c764c436bf 100644
--- a/pkgs/by-name/ma/markdown-oxide/package.nix
+++ b/pkgs/by-name/ma/markdown-oxide/package.nix
@@ -5,13 +5,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "markdown-oxide";
-  version = "0.0.16";
+  version = "0.0.17";
 
   src = fetchFromGitHub {
     owner = "Feel-ix-343";
     repo = "markdown-oxide";
     rev = "v${version}";
-    hash = "sha256-RCoyiEkaTDbLtkMWSCM9nOHURHw5D7vsnr/yl91CuVQ=";
+    hash = "sha256-bJlyzBnxUw1OyWLbVEFXgPc/YjmfyyQjfeGAA7G1QlY=";
   };
 
   cargoLock = {
diff --git a/pkgs/by-name/su/supersonic/package.nix b/pkgs/by-name/su/supersonic/package.nix
index 1189dc5ba61f..15621682aa64 100644
--- a/pkgs/by-name/su/supersonic/package.nix
+++ b/pkgs/by-name/su/supersonic/package.nix
@@ -20,16 +20,16 @@ assert waylandSupport -> stdenv.isLinux;
 
 buildGoModule rec {
   pname = "supersonic" + lib.optionalString waylandSupport "-wayland";
-  version = "0.9.1";
+  version = "0.10.0";
 
   src = fetchFromGitHub {
     owner = "dweymouth";
     repo = "supersonic";
     rev = "v${version}";
-    hash = "sha256-R9Bn+xFq8pBSuGX1okA3l/7ralKodKDxcpGov9diuxw=";
+    hash = "sha256-sleXZnJ/JPlyCMf6Js+Yym1RhtfZT7Q+qYAWLCavZFA=";
   };
 
-  vendorHash = "sha256-4Un1twPfjRfLVl91GqYJsyY8GbKgYoMIsdNESpumH5M=";
+  vendorHash = "sha256-JKihU597ZBq1VygpWB73V2m9NN/GDrquX9hNzBdszSQ=";
 
   nativeBuildInputs = [
     copyDesktopItems
diff --git a/pkgs/by-name/te/tenki/package.nix b/pkgs/by-name/te/tenki/package.nix
index cf276d6a43d2..406e49c5121e 100644
--- a/pkgs/by-name/te/tenki/package.nix
+++ b/pkgs/by-name/te/tenki/package.nix
@@ -4,16 +4,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "tenki";
-  version = "1.6.0";
+  version = "1.7.0";
 
   src = fetchFromGitHub {
     owner = "ckaznable";
     repo = "tenki";
     rev = "v${version}";
-    hash = "sha256-l2MDO0LIL+uSPiXA3+WVpan43lWJbaY9XSdQbwacRqQ=";
+    hash = "sha256-FlygsPvlftlCrAuViB/MpI9m10o1iVtfJ8djn5ycHa4=";
   };
 
-  cargoHash = "sha256-8tabXFijgq+E6YVY1J2nAhDHFahWx7QC8S401KNy2Jc=";
+  cargoHash = "sha256-mWxdZilKbC7+OygCmPB09kZJdtGbUqrGpaEZG/Bn5QQ=";
 
   meta = with lib; {
     description = "tty-clock with weather effect";
diff --git a/pkgs/by-name/ug/ugm/package.nix b/pkgs/by-name/ug/ugm/package.nix
index a8c1726327c8..cccaf83848b4 100644
--- a/pkgs/by-name/ug/ugm/package.nix
+++ b/pkgs/by-name/ug/ugm/package.nix
@@ -2,17 +2,18 @@
 , buildGoModule
 , fetchFromGitHub
 , makeWrapper
+, nix-update-script
 }:
 
 buildGoModule rec {
   pname = "ugm";
-  version = "1.4.0";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "ariasmn";
     repo = "ugm";
     rev = "v${version}";
-    hash = "sha256-Co8JN0WEc1I08My9m7iyAshtEO4aszN8/sCvoGFJv2A=";
+    hash = "sha256-Ui/JYU/ZbMP8E20vWHah1GFFVu5E4xf0RaVv9X0QnR4=";
   };
 
   vendorHash = "sha256-34D9fQnmKnOyUqshduLmFiVgcVKi7mDKBs3X5ZQxsuw=";
@@ -25,6 +26,8 @@ buildGoModule rec {
         --set RUNEWIDTH_EASTASIAN 0
   '';
 
+  passthru.updateScript = nix-update-script {};
+
   meta = with lib; {
     description = "A terminal based UNIX user and group browser";
     homepage = "https://github.com/ariasmn/ugm";
diff --git a/pkgs/development/cuda-modules/nccl/default.nix b/pkgs/development/cuda-modules/nccl/default.nix
index 9db08c722acd..8043adae4d1e 100644
--- a/pkgs/development/cuda-modules/nccl/default.nix
+++ b/pkgs/development/cuda-modules/nccl/default.nix
@@ -24,13 +24,13 @@ let
 in
 backendStdenv.mkDerivation (finalAttrs: {
   pname = "nccl";
-  version = "2.20.5-1";
+  version = "2.21.5-1";
 
   src = fetchFromGitHub {
     owner = "NVIDIA";
     repo = finalAttrs.pname;
     rev = "v${finalAttrs.version}";
-    hash = "sha256-ModIjD6RaRD/57a/PA1oTgYhZsAQPrrvhl5sNVXnO6c=";
+    hash = "sha256-IF2tILwW8XnzSmfn7N1CO7jXL95gUp02guIW5n1eaig=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/libraries/cjose/default.nix b/pkgs/development/libraries/cjose/default.nix
index 4ecca1290e35..3b0d448a3530 100644
--- a/pkgs/development/libraries/cjose/default.nix
+++ b/pkgs/development/libraries/cjose/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , autoreconfHook
 , pkg-config
 , doxygen
@@ -20,6 +21,14 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-vDvCxMpgCdteGvNxy2HCNRaxbhxOuTadL0nM2wkFHtk=";
   };
 
+  patches = [
+    # avoid using empty prototypes; support Clang 15 and XCode 14.3 - https://github.com/OpenIDC/cjose/pull/19
+    (fetchpatch {
+      url = "https://github.com/OpenIDC/cjose/commit/63e90cf464d6a470e26886435e8d7d96a66747f6.patch";
+      hash = "sha256-+C5AIejb9InOGiOgUNfuP89J18O71rnq1pXyroxEDFQ=";
+    })
+  ];
+
   nativeBuildInputs = [ autoreconfHook pkg-config doxygen ];
   buildInputs = [ jansson openssl ];
   nativeCheckInputs = [ check ];
diff --git a/pkgs/development/tools/analysis/flow/default.nix b/pkgs/development/tools/analysis/flow/default.nix
index 75452c45820c..179e57625c9e 100644
--- a/pkgs/development/tools/analysis/flow/default.nix
+++ b/pkgs/development/tools/analysis/flow/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "flow";
-  version = "0.233.0";
+  version = "0.234.0";
 
   src = fetchFromGitHub {
     owner = "facebook";
     repo = "flow";
     rev = "v${version}";
-    hash = "sha256-FMSwCou8J8gpuZ6lPKp+qO58iZWxBDOv8vcZvSdFWWE=";
+    hash = "sha256-ChAgAYvNjQ60ly8B4i4M0awjgke8IcjJK72TOQZNnzw=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/tools/build-managers/bazel/buildtools/default.nix b/pkgs/development/tools/build-managers/bazel/buildtools/default.nix
index b8c1f4d32663..8469ffd49fd0 100644
--- a/pkgs/development/tools/build-managers/bazel/buildtools/default.nix
+++ b/pkgs/development/tools/build-managers/bazel/buildtools/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "bazel-buildtools";
-  version = "7.1.0";
+  version = "7.1.1";
 
   src = fetchFromGitHub {
     owner = "bazelbuild";
     repo = "buildtools";
     rev = "v${version}";
-    hash = "sha256-/YHTMIhxFqxHpEmtYvFuQ1bjvKF6tDaYudSnBrCncPQ=";
+    hash = "sha256-funwP4D8ck7RT+0z+42MVud/3Da6HvVhFLTqQIucHrQ=";
   };
 
   vendorHash = "sha256-DigTREfI6I48wxRpGp/bfH1NbUZ4E1B5UTQXpI0LY1A=";
diff --git a/pkgs/development/tools/earthly/default.nix b/pkgs/development/tools/earthly/default.nix
index 89c47c2a238c..634f03101c83 100644
--- a/pkgs/development/tools/earthly/default.nix
+++ b/pkgs/development/tools/earthly/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "earthly";
-  version = "0.8.7";
+  version = "0.8.8";
 
   src = fetchFromGitHub {
     owner = "earthly";
     repo = "earthly";
     rev = "v${version}";
-    hash = "sha256-sLOH17OCdA5eOI4KuoVpUrKtLoOVGIzoBeWIOXt2L8k=";
+    hash = "sha256-nvjoHU+LuyZy8NxMRWYMCQlvq5E6va2x16JRDdFI+70=";
   };
 
-  vendorHash = "sha256-896P+KGaoWs0f8LvZMeeJhdtrhti9kMYuNL39/NUWWE=";
+  vendorHash = "sha256-66xN4uUeEFHpI/pAP7akG4YQhbY7ylu8AVOJnx60c7s=";
   subPackages = [ "cmd/earthly" "cmd/debugger" ];
 
   CGO_ENABLED = 0;
diff --git a/pkgs/development/tools/protoc-gen-connect-go/default.nix b/pkgs/development/tools/protoc-gen-connect-go/default.nix
index 2b963d53c672..b5a0e80f0b3e 100644
--- a/pkgs/development/tools/protoc-gen-connect-go/default.nix
+++ b/pkgs/development/tools/protoc-gen-connect-go/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "protoc-gen-connect-go";
-  version = "1.16.0";
+  version = "1.16.1";
 
   src = fetchFromGitHub {
     owner = "connectrpc";
     repo = "connect-go";
     rev = "refs/tags/v${version}";
-    hash = "sha256-TtYqJCiXZh+ELYJ55D2g19kDYCESLLbMb5B/iaUMACc=";
+    hash = "sha256-gYaOxUJzGcMKMrDdMou7mb66RVqChzSA1mc69O1zQv0=";
   };
 
   vendorHash = "sha256-+bWw4/ZqMeqnkXnV+vwq2mxgvew0KmLwNcu/xA2l4HI=";
diff --git a/pkgs/games/anki/bin.nix b/pkgs/games/anki/bin.nix
index ee293cb7c962..1ffe999c8896 100644
--- a/pkgs/games/anki/bin.nix
+++ b/pkgs/games/anki/bin.nix
@@ -1,4 +1,4 @@
-{ fetchurl, stdenv, lib, buildFHSEnv, appimageTools, writeShellScript, anki, undmg, zstd, commandLineArgs ? [] }:
+{ fetchurl, stdenv, lib, buildFHSEnv, appimageTools, writeShellScript, anki, undmg, zstd, cacert, commandLineArgs ? [] }:
 
 let
   pname = "anki-bin";
@@ -57,6 +57,8 @@ let
     profile = ''
       # anki vendors QT and mixing QT versions usually causes crashes
       unset QT_PLUGIN_PATH
+      # anki uses the system ssl cert, without it plugins do not download/update
+      export SSL_CERT_FILE="${cacert}/etc/ssl/certs/ca-bundle.crt"
     '';
 
     # Dependencies of anki
diff --git a/pkgs/servers/keycloak/default.nix b/pkgs/servers/keycloak/default.nix
index a7e7b3d8c077..afb70893f898 100644
--- a/pkgs/servers/keycloak/default.nix
+++ b/pkgs/servers/keycloak/default.nix
@@ -18,11 +18,11 @@ let
   '';
 in stdenv.mkDerivation rec {
   pname = "keycloak";
-  version = "24.0.2";
+  version = "24.0.3";
 
   src = fetchzip {
     url = "https://github.com/keycloak/keycloak/releases/download/${version}/keycloak-${version}.zip";
-    hash = "sha256-YC/fa1yxm3lMmEOZXcTOMX2F7Y5yolLKm89cGfEagH4=";
+    hash = "sha256-VlCAUAa3e8ho8s1pA935B+bz4mvziDtayu0GB9yOTI4=";
   };
 
   nativeBuildInputs = [ makeWrapper jre ];
diff --git a/pkgs/tools/networking/grpc_cli/default.nix b/pkgs/tools/networking/grpc_cli/default.nix
index 91d66f7bd020..993a0707bc80 100644
--- a/pkgs/tools/networking/grpc_cli/default.nix
+++ b/pkgs/tools/networking/grpc_cli/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "grpc_cli";
-  version = "1.62.1";
+  version = "1.62.2";
   src = fetchFromGitHub {
     owner = "grpc";
     repo = "grpc";
     rev = "v${version}";
-    hash = "sha256-L0bn6Bg36UKIRxznH9o4T7WXUqMwFjr8ybeQfbUi8xM=";
+    hash = "sha256-LHR29QP0yyfKw9hr3SzkdP0WmHP2b4boBgTXgsiAqjs=";
     fetchSubmodules = true;
   };
   nativeBuildInputs = [ automake cmake autoconf ];