diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 18b4118d6310..adaf6d0661b6 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -3855,6 +3855,12 @@
     githubId = 39825;
     name = "Dominik Honnef";
   };
+  doriath = {
+    email = "tomasz.zurkowski@gmail.com";
+    github = "doriath";
+    githubId = 150959;
+    name = "Tomasz Zurkowski";
+  };
   doronbehar = {
     email = "me@doronbehar.com";
     github = "doronbehar";
diff --git a/nixos/modules/services/matrix/appservice-discord.nix b/nixos/modules/services/matrix/appservice-discord.nix
index 15f0f0cc0cdb..f579c2529c0a 100644
--- a/nixos/modules/services/matrix/appservice-discord.nix
+++ b/nixos/modules/services/matrix/appservice-discord.nix
@@ -5,7 +5,6 @@ with lib;
 let
   dataDir = "/var/lib/matrix-appservice-discord";
   registrationFile = "${dataDir}/discord-registration.yaml";
-  appDir = "${pkgs.matrix-appservice-discord}/${pkgs.matrix-appservice-discord.passthru.nodeAppDir}";
   cfg = config.services.matrix-appservice-discord;
   opt = options.services.matrix-appservice-discord;
   # TODO: switch to configGen.json once RFC42 is implemented
@@ -16,6 +15,15 @@ in {
     services.matrix-appservice-discord = {
       enable = mkEnableOption (lib.mdDoc "a bridge between Matrix and Discord");
 
+      package = mkOption {
+        type = types.package;
+        default = pkgs.matrix-appservice-discord;
+        defaultText = literalExpression "pkgs.matrix-appservice-discord";
+        description = lib.mdDoc ''
+          Which package of matrix-appservice-discord to use.
+        '';
+      };
+
       settings = mkOption rec {
         # TODO: switch to types.config.json as prescribed by RFC42 once it's implemented
         type = types.attrs;
@@ -114,7 +122,7 @@ in {
 
       preStart = ''
         if [ ! -f '${registrationFile}' ]; then
-          ${pkgs.matrix-appservice-discord}/bin/matrix-appservice-discord \
+          ${cfg.package}/bin/matrix-appservice-discord \
             --generate-registration \
             --url=${escapeShellArg cfg.url} \
             ${optionalString (cfg.localpart != null) "--localpart=${escapeShellArg cfg.localpart}"} \
@@ -135,13 +143,13 @@ in {
 
         DynamicUser = true;
         PrivateTmp = true;
-        WorkingDirectory = appDir;
+        WorkingDirectory = "${cfg.package}/${cfg.package.passthru.nodeAppDir}";
         StateDirectory = baseNameOf dataDir;
         UMask = "0027";
         EnvironmentFile = cfg.environmentFile;
 
         ExecStart = ''
-          ${pkgs.matrix-appservice-discord}/bin/matrix-appservice-discord \
+          ${cfg.package}/bin/matrix-appservice-discord \
             --file='${registrationFile}' \
             --config='${settingsFile}' \
             --port='${toString cfg.port}'
diff --git a/pkgs/applications/emulators/dolphin-emu/default.nix b/pkgs/applications/emulators/dolphin-emu/default.nix
index ad9c470bf427..b9ef4682e87d 100644
--- a/pkgs/applications/emulators/dolphin-emu/default.nix
+++ b/pkgs/applications/emulators/dolphin-emu/default.nix
@@ -1,126 +1,190 @@
-{ stdenv
-, lib
-, fetchpatch
-, pkg-config
-, cmake
-, bluez
-, ffmpeg
-, libao
-, gtk3
-, glib
-, libGLU
-, libGL
-, gettext
-, libpthreadstubs
-, libXrandr
-, libXext
-, readline
-, openal
-, libXdmcp
-, portaudio
+{ lib
+, stdenv
 , fetchFromGitHub
-, libusb1
-, libevdev
-, wxGTK30
-, soundtouch
-, miniupnpc
-, mbedtls_2
+, cmake
+, pkg-config
+, wrapQtAppsHook
+, alsa-lib
+, bluez
+, bzip2
+, cubeb
 , curl
-, lzo
+, enet
+, ffmpeg
+, fmt_8
+, hidapi
+, libevdev
+, libGL
+, libiconv
+, libpulseaudio
+, libspng
+, libusb1
+, libXdmcp
+, libXext
+, libXrandr
+, mbedtls_2
+, mgba
+, miniupnpc
+, minizip-ng
+, openal
+, pugixml
+, qtbase
 , sfml
-, libpulseaudio ? null
+, soundtouch
+, udev
+, vulkan-loader
+, xxHash
+, xz
+
+  # Used in passthru
+, common-updater-scripts
+, dolphin-emu
+, jq
+, testers
+, writeShellScript
+
+  # Darwin-only dependencies
+, CoreBluetooth
+, ForceFeedback
+, IOKit
+, moltenvk
+, OpenGL
+, VideoToolbox
 }:
 
 stdenv.mkDerivation rec {
   pname = "dolphin-emu";
-  version = "5.0";
+  version = "5.0-18498";
 
   src = fetchFromGitHub {
     owner = "dolphin-emu";
     repo = "dolphin";
-    rev = version;
-    sha256 = "07mlfnh0hwvk6xarcg315x7z2j0qbg9g7cm040df9c8psiahc3g6";
+    rev = "46b99671d9158e0ca840c1d8ef249db0f321ced7";
+    sha256 = "sha256-K+OF8o8I1XDLQQcsWC8p8jUuWeb+RoHlBG3cEZ1aWIU=";
+    fetchSubmodules = true;
   };
 
-  patches = [
-    # Fix FTBFS with glibc 2.26
-    (fetchpatch {
-      url = "https://salsa.debian.org/games-team/dolphin-emu/raw/8c952b1fcd46259e9d8cce836df433e0a8b88f8c/debian/patches/02_glibc-2.26.patch";
-      name = "02_glibc-2.26.patch";
-      sha256 = "sha256-LBXT3rf5klwmX9YQXt4/iv06GghsWZprNhLGYlKiDqk=";
-    })
-    # Fix FTBFS with GCC 8
-    (fetchpatch {
-      url = "https://salsa.debian.org/games-team/dolphin-emu/raw/8c952b1fcd46259e9d8cce836df433e0a8b88f8c/debian/patches/03_gcc8.patch";
-      name = "03_gcc8.patch";
-      sha256 = "sha256-uWP6zMjoHYbX6K+oPSQdBn2xWQpvNyhZabMkhtYrSbU=";
-    })
-    # Fix FTBFS with SoundTouch 2.1.2
-    (fetchpatch {
-      url = "https://salsa.debian.org/games-team/dolphin-emu/raw/8c952b1fcd46259e9d8cce836df433e0a8b88f8c/debian/patches/05_soundtouch-2.1.2.patch";
-      name = "05_soundtouch-2.1.2.patch";
-      sha256 = "sha256-Y7CNM6GQC9GRhlOBLZlxkIpj1CFhIwA5L8lGXur/bwY=";
-    })
-    # Use GTK+3 wxWidgets backend
-    (fetchpatch {
-      url = "https://salsa.debian.org/games-team/dolphin-emu/raw/8c952b1fcd46259e9d8cce836df433e0a8b88f8c/debian/patches/06_gtk3.patch";
-      name = "06_gtk3.patch";
-      sha256 = "sha256-pu5Q0+8kNwmpf2DoXCXHFqxF0EGTnFXJipkBz1Vh2cs=";
-    })
-  ];
-
-  cmakeFlags = [
-    "-DENABLE_LTO=True"
-  ];
-
   nativeBuildInputs = [
-    pkg-config
     cmake
+    pkg-config
+    wrapQtAppsHook
   ];
 
   buildInputs = [
-    bluez
-    ffmpeg
-    libao
-    libGLU
-    libGL
-    gtk3
-    glib
-    gettext
-    libpthreadstubs
-    libXrandr
-    libXext
-    readline
-    openal
-    libevdev
-    libXdmcp
-    portaudio
-    libpulseaudio
-    libevdev
-    libXdmcp
-    portaudio
-    libusb1
-    libpulseaudio
-    wxGTK30
-    soundtouch
-    miniupnpc
-    mbedtls_2
+    bzip2
+    cubeb
     curl
-    lzo
+    enet
+    ffmpeg
+    fmt_8
+    hidapi
+    libGL
+    libiconv
+    libpulseaudio
+    libspng
+    libusb1
+    libXdmcp
+    mbedtls_2
+    miniupnpc
+    minizip-ng
+    openal
+    pugixml
+    qtbase
     sfml
+    soundtouch
+    xxHash
+    xz
+  ] ++ lib.optionals stdenv.isLinux [
+    alsa-lib
+    bluez
+    libevdev
+    libXext
+    libXrandr
+    mgba # Derivation doesn't support Darwin
+    udev
+    vulkan-loader
+  ] ++ lib.optionals stdenv.isDarwin [
+    CoreBluetooth
+    ForceFeedback
+    IOKit
+    moltenvk
+    OpenGL
+    VideoToolbox
   ];
 
+  cmakeFlags = [
+    "-DDISTRIBUTOR=NixOS"
+    "-DUSE_SHARED_ENET=ON"
+    "-DDOLPHIN_WC_REVISION=${src.rev}"
+    "-DDOLPHIN_WC_DESCRIBE=${version}"
+    "-DDOLPHIN_WC_BRANCH=master"
+  ] ++ lib.optionals stdenv.isDarwin [
+    "-DOSX_USE_DEFAULT_SEARCH_PATH=True"
+    "-DUSE_BUNDLED_MOLTENVK=OFF"
+    # Bundles the application folder into a standalone executable, so we cannot devendor libraries
+    "-DSKIP_POSTPROCESS_BUNDLE=ON"
+    # Needs xcode so compilation fails with it enabled. We would want the version to be fixed anyways.
+    # Note: The updater isn't available on linux, so we dont need to disable it there.
+    "-DENABLE_AUTOUPDATE=OFF"
+  ];
+
+  qtWrapperArgs = lib.optionals stdenv.isLinux [
+    "--prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ vulkan-loader ]}"
+    # https://bugs.dolphin-emu.org/issues/11807
+    # The .desktop file should already set this, but Dolphin may be launched in other ways
+    "--set QT_QPA_PLATFORM xcb"
+  ];
+
+  # https://github.com/NixOS/nixpkgs/issues/201254
+  NIX_LDFLAGS = lib.optionalString (stdenv.isLinux && stdenv.isAarch64 && stdenv.cc.isGNU) "-lgcc";
+
+  # Use nix-provided libraries instead of submodules
+  postPatch = lib.optionalString stdenv.isDarwin ''
+    substituteInPlace CMakeLists.txt \
+      --replace "if(NOT APPLE)" "if(true)" \
+      --replace "if(LIBUSB_FOUND AND NOT APPLE)" "if(LIBUSB_FOUND)"
+  '';
+
   postInstall = lib.optionalString stdenv.hostPlatform.isLinux ''
     install -D $src/Data/51-usb-device.rules $out/etc/udev/rules.d/51-usb-device.rules
+  '' + lib.optionalString stdenv.hostPlatform.isDarwin ''
+    # Only gets installed automatically if the standalone executable is used
+    mkdir -p $out/Applications
+    cp -r ./Binaries/Dolphin.app $out/Applications
+    ln -s $out/Applications/Dolphin.app/Contents/MacOS/Dolphin $out/bin
   '';
 
+  passthru = {
+    tests.version = testers.testVersion {
+      package = dolphin-emu;
+      command = "dolphin-emu-nogui --version";
+    };
+
+    updateScript = writeShellScript "dolphin-update-script" ''
+      set -eou pipefail
+      export PATH=${lib.makeBinPath [ curl jq common-updater-scripts ]}
+
+      json="$(curl -s https://dolphin-emu.org/update/latest/beta)"
+      version="$(jq -r '.shortrev' <<< "$json")"
+      rev="$(jq -r '.hash' <<< "$json")"
+      update-source-version dolphin-emu "$version" --rev="$rev"
+    '';
+  };
+
   meta = with lib; {
-    homepage = "https://dolphin-emu.org/";
+    homepage = "https://dolphin-emu.org";
     description = "Gamecube/Wii/Triforce emulator for x86_64 and ARMv8";
+    mainProgram = if stdenv.hostPlatform.isDarwin then "Dolphin" else "dolphin-emu";
+    branch = "master";
     license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ MP2E ashkitten ];
-    # x86_32 is an unsupported platform.
-    # Enable generic build if you really want a JIT-less binary.
-    platforms = [ "x86_64-linux" "aarch64-linux" ];
+    platforms = platforms.unix;
+    maintainers = with maintainers; [
+      MP2E
+      ashkitten
+      xfix
+      ivar
+    ];
+    # Requires both LLVM and SDK bump
+    broken = stdenv.isDarwin && stdenv.isx86_64;
   };
 }
diff --git a/pkgs/applications/emulators/dolphin-emu/master.nix b/pkgs/applications/emulators/dolphin-emu/master.nix
deleted file mode 100644
index 7f68b5821495..000000000000
--- a/pkgs/applications/emulators/dolphin-emu/master.nix
+++ /dev/null
@@ -1,196 +0,0 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, pkg-config
-, cmake
-, wrapQtAppsHook
-, qtbase
-, bluez
-, ffmpeg
-, libGL
-, libXrandr
-, libusb1
-, libXdmcp
-, libXext
-, openal
-, udev
-, libevdev
-, cubeb
-, curl
-, alsa-lib
-, miniupnpc
-, enet
-, mbedtls_2
-, soundtouch
-, sfml
-, minizip-ng
-, xz
-, hidapi
-, fmt_8
-, vulkan-loader
-, libpulseaudio
-, bzip2
-, libiconv
-, pugixml
-, xxHash
-
-  # Used in passthru
-, testers
-, dolphin-emu-beta
-, writeShellScript
-, common-updater-scripts
-, jq
-
-  # Darwin-only dependencies
-, CoreBluetooth
-, ForceFeedback
-, IOKit
-, VideoToolbox
-, OpenGL
-, libpng
-, moltenvk
-}:
-
-stdenv.mkDerivation rec {
-  pname = "dolphin-emu";
-  version = "5.0-17995";
-
-  src = fetchFromGitHub {
-    owner = "dolphin-emu";
-    repo = "dolphin";
-    rev = "8bad821019721b9b72701b495da95656ace5fea5";
-    sha256 = "sha256-uxHzn+tXRBr11OPpZ4ELBw7DTJH4mnqUBOeyPlXNAh8=";
-    fetchSubmodules = true;
-  };
-
-  patches = [
-    # On x86_64-darwin CMake reportedly does not work without this in some cases.
-    # See https://github.com/NixOS/nixpkgs/pull/190373#issuecomment-1241310765
-    ./minizip-external-missing-include.patch
-  ];
-
-  nativeBuildInputs = [
-    cmake
-    pkg-config
-    wrapQtAppsHook
-  ];
-
-  buildInputs = [
-    cubeb
-    curl
-    ffmpeg
-    pugixml
-    xxHash
-    libGL
-    libpulseaudio
-    openal
-    libusb1
-    libiconv
-    libpng
-    libXdmcp
-    hidapi
-    miniupnpc
-    enet
-    mbedtls_2
-    soundtouch
-    sfml
-    minizip-ng
-    xz
-    qtbase
-    fmt_8
-    bzip2
-  ] ++ lib.optionals stdenv.isLinux [
-    libXrandr
-    libXext
-    bluez
-    udev
-    libevdev
-    alsa-lib
-    vulkan-loader
-  ] ++ lib.optionals stdenv.isDarwin [
-    CoreBluetooth
-    OpenGL
-    ForceFeedback
-    IOKit
-    VideoToolbox
-    moltenvk
-  ];
-
-  cmakeFlags = [
-    "-DDISTRIBUTOR=NixOS"
-    "-DUSE_SHARED_ENET=ON"
-    "-DDOLPHIN_WC_REVISION=${src.rev}"
-    "-DDOLPHIN_WC_DESCRIBE=${version}"
-    "-DDOLPHIN_WC_BRANCH=master"
-  ] ++ lib.optionals stdenv.isDarwin [
-    "-DOSX_USE_DEFAULT_SEARCH_PATH=True"
-    "-DUSE_BUNDLED_MOLTENVK=OFF"
-    # Bundles the application folder into a standalone executable, so we cannot devendor libraries
-    "-DSKIP_POSTPROCESS_BUNDLE=ON"
-    # Needs xcode so compilation fails with it enabled. We would want the version to be fixed anyways.
-    # Note: The updater isn't available on linux, so we dont need to disable it there.
-    "-DENABLE_AUTOUPDATE=OFF"
-  ];
-
-  qtWrapperArgs = lib.optionals stdenv.isLinux [
-    "--prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ vulkan-loader ]}"
-    # https://bugs.dolphin-emu.org/issues/11807
-    # The .desktop file should already set this, but Dolphin may be launched in other ways
-    "--set QT_QPA_PLATFORM xcb"
-    # https://bugs.dolphin-emu.org/issues/12913
-    "--set QT_XCB_NO_XI2 1"
-  ];
-
-  # https://github.com/NixOS/nixpkgs/issues/201254
-  NIX_LDFLAGS = lib.optionalString (stdenv.isLinux && stdenv.isAarch64 && stdenv.cc.isGNU) "-lgcc";
-
-  # Use nix-provided libraries instead of submodules
-  postPatch = lib.optionalString stdenv.isDarwin ''
-    substituteInPlace CMakeLists.txt \
-      --replace "if(NOT APPLE)" "if(true)" \
-      --replace "if(LIBUSB_FOUND AND NOT APPLE)" "if(LIBUSB_FOUND)"
-  '';
-
-  postInstall = lib.optionalString stdenv.hostPlatform.isLinux ''
-    install -D $src/Data/51-usb-device.rules $out/etc/udev/rules.d/51-usb-device.rules
-  '' + lib.optionalString stdenv.hostPlatform.isDarwin ''
-    # Only gets installed automatically if the standalone executable is used
-    mkdir -p $out/Applications
-    cp -r ./Binaries/Dolphin.app $out/Applications
-    ln -s $out/Applications/Dolphin.app/Contents/MacOS/Dolphin $out/bin
-  '';
-
-  passthru = {
-    tests.version = testers.testVersion {
-      package = dolphin-emu-beta;
-      command = "dolphin-emu-nogui --version";
-    };
-
-    updateScript = writeShellScript "dolphin-update-script" ''
-      set -eou pipefail
-      export PATH=${lib.makeBinPath [ curl jq common-updater-scripts ]}
-
-      json="$(curl -s https://dolphin-emu.org/update/latest/beta)"
-      version="$(jq -r '.shortrev' <<< "$json")"
-      rev="$(jq -r '.hash' <<< "$json")"
-      update-source-version dolphin-emu-beta "$version" --rev="$rev"
-    '';
-  };
-
-  meta = with lib; {
-    homepage = "https://dolphin-emu.org";
-    description = "Gamecube/Wii/Triforce emulator for x86_64 and ARMv8";
-    mainProgram = if stdenv.hostPlatform.isDarwin then "Dolphin" else "dolphin-emu";
-    branch = "master";
-    license = licenses.gpl2Plus;
-    platforms = platforms.unix;
-    maintainers = with maintainers; [
-      MP2E
-      ashkitten
-      xfix
-      ivar
-    ];
-    # Requires both LLVM and SDK bump
-    broken = stdenv.isDarwin && stdenv.isx86_64;
-  };
-}
diff --git a/pkgs/applications/emulators/dolphin-emu/minizip-external-missing-include.patch b/pkgs/applications/emulators/dolphin-emu/minizip-external-missing-include.patch
deleted file mode 100644
index 7da013ecd8f6..000000000000
--- a/pkgs/applications/emulators/dolphin-emu/minizip-external-missing-include.patch
+++ /dev/null
@@ -1,18 +0,0 @@
-commit 5e0cb8066fb1653399c54e93e42375295c2562bd
-Author: Ivar Scholten <ivar.scholten@protonmail.com>
-Date:   Fri Sep 9 14:27:55 2022 +0200
-
-    Externals/minizip: add missing include to CheckFunctionExists
-
-diff --git a/Externals/minizip/CMakeLists.txt b/Externals/minizip/CMakeLists.txt
-index c3d7c5512e..f59f8b295c 100644
---- a/Externals/minizip/CMakeLists.txt
-+++ b/Externals/minizip/CMakeLists.txt
-@@ -60,6 +60,7 @@ if (HAVE_INTTYPES_H)
-   target_compile_definitions(minizip PRIVATE HAVE_INTTYPES_H)
- endif()
-
-+include(CheckFunctionExists)
- check_function_exists(fseeko HAVE_FSEEKO)
- if (NOT HAVE_FSEEKO)
-   target_compile_definitions(minizip PRIVATE NO_FSEEKO)
diff --git a/pkgs/applications/emulators/dosbox-staging/default.nix b/pkgs/applications/emulators/dosbox-staging/default.nix
index f26fb7c9d76c..d66f9136bcf1 100644
--- a/pkgs/applications/emulators/dosbox-staging/default.nix
+++ b/pkgs/applications/emulators/dosbox-staging/default.nix
@@ -1,10 +1,15 @@
-{ alsa-lib
-, copyDesktopItems
+{ lib
+, stdenv
 , fetchFromGitHub
+, SDL2
+, SDL2_image
+, SDL2_net
+, alsa-lib
+, copyDesktopItems
 , fluidsynth
 , glib
 , gtest
-, lib
+, irr1
 , libGL
 , libGLU
 , libjack2
@@ -20,22 +25,17 @@
 , ninja
 , opusfile
 , pkg-config
-, irr1
-, SDL2
-, SDL2_image
-, SDL2_net
 , speexdsp
-, stdenv
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (self: {
   pname = "dosbox-staging";
   version = "0.80.1";
 
   src = fetchFromGitHub {
-    owner = pname;
-    repo = pname;
-    rev = "v${version}";
+    owner = "dosbox-staging";
+    repo = "dosbox-staging";
+    rev = "v${self.version}";
     hash = "sha256-I90poBeLSq1c8PXyjrx7/UcbfqFNnnNiXfJdWhLPGMc=";
   };
 
@@ -49,6 +49,9 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
+    SDL2
+    SDL2_image
+    SDL2_net
     alsa-lib
     fluidsynth
     glib
@@ -63,9 +66,6 @@ stdenv.mkDerivation rec {
     libslirp
     libsndfile
     opusfile
-    SDL2
-    SDL2_image
-    SDL2_net
     speexdsp
   ];
 
@@ -91,17 +91,17 @@ stdenv.mkDerivation rec {
     # original dosbox. Doing it this way allows us to work with frontends and
     # launchers that expect the binary to be named dosbox, but get out of the
     # way of vanilla dosbox if the user desires to install that as well.
-    mv $out/bin/dosbox $out/bin/${pname}
+    mv $out/bin/dosbox $out/bin/${self.pname}
     makeWrapper $out/bin/dosbox-staging $out/bin/dosbox
 
     # Create a symlink to dosbox manual instead of merely copying it
     pushd $out/share/man/man1/
-    mv dosbox.1.gz ${pname}.1.gz
-    ln -s ${pname}.1.gz dosbox.1.gz
+    mv dosbox.1.gz ${self.pname}.1.gz
+    ln -s ${self.pname}.1.gz dosbox.1.gz
     popd
   '';
 
-  meta = with lib; {
+  meta = {
     homepage = "https://dosbox-staging.github.io/";
     description = "A modernized DOS emulator";
     longDescription = ''
@@ -110,10 +110,14 @@ stdenv.mkDerivation rec {
       existing DOSBox codebase while leveraging modern development tools and
       practices.
     '';
-    license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ joshuafern AndersonTorres ];
-    platforms = platforms.unix;
+    changelog = "https://github.com/dosbox-staging/dosbox-staging/releases/tag/v${self.version}";
+    license = lib.licenses.gpl2Plus;
+    maintainers = [
+      lib.maintainers.joshuafern
+      lib.maintainers.AndersonTorres
+    ];
+    platforms = lib.platforms.unix;
     priority = 101;
   };
-}
-# TODO: report upstream about not finding SDL2_net
+})
+# TODO: report upstream about not finding extra SDL2 libraries
diff --git a/pkgs/applications/graphics/eyedropper/default.nix b/pkgs/applications/graphics/eyedropper/default.nix
index 8b4411ad04b3..d088f633c3f3 100644
--- a/pkgs/applications/graphics/eyedropper/default.nix
+++ b/pkgs/applications/graphics/eyedropper/default.nix
@@ -50,7 +50,7 @@ stdenv.mkDerivation rec {
   ];
 
   meta = with lib; {
-    description = "An easy-to-use color picker and editor";
+    description = "A powerful color picker and formatter";
     homepage = "https://github.com/FineFindus/eyedropper";
     license = licenses.gpl3Plus;
     platforms = platforms.linux;
diff --git a/pkgs/applications/graphics/jpegoptim/default.nix b/pkgs/applications/graphics/jpegoptim/default.nix
index 951bb9d7d894..ff00d565f47d 100644
--- a/pkgs/applications/graphics/jpegoptim/default.nix
+++ b/pkgs/applications/graphics/jpegoptim/default.nix
@@ -1,14 +1,14 @@
 { lib, stdenv, fetchFromGitHub, libjpeg }:
 
 stdenv.mkDerivation rec {
-  version = "1.5.1";
+  version = "1.5.2";
   pname = "jpegoptim";
 
   src = fetchFromGitHub {
     owner = "tjko";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-QPipwBk+BS/u3YxB8ACeFXQSuoW1aynEyG3tEMrhcaE=";
+    sha256 = "sha256-PROQvOqsis8we58OOZ/kuY+L/CoV7XfnY9wvrpsTJu8=";
   };
 
   # There are no checks, it seems.
diff --git a/pkgs/applications/graphics/paraview/default.nix b/pkgs/applications/graphics/paraview/default.nix
index 7a05114a1e98..54f956981ee9 100644
--- a/pkgs/applications/graphics/paraview/default.nix
+++ b/pkgs/applications/graphics/paraview/default.nix
@@ -6,7 +6,7 @@
 }:
 
 let
-  version = "5.10.0";
+  version = "5.11.0";
 
   docFiles = [
     (fetchurl {
@@ -35,7 +35,7 @@ in stdenv.mkDerivation rec {
     owner = "paraview";
     repo = "paraview";
     rev = "v${version}";
-    sha256 = "0ipx6zq44hpic7gvv0s2jvjncak6vlmrz5sp9ypc15b15bna0gs2";
+    sha256 = "sha256-WvkKGl5lG+apX6m4ULVZZVtDsSUjEVXe/seh95b+LmI=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/graphics/tesseract/tesseract3.nix b/pkgs/applications/graphics/tesseract/tesseract3.nix
index 16365674706e..bf19d0f77eb6 100644
--- a/pkgs/applications/graphics/tesseract/tesseract3.nix
+++ b/pkgs/applications/graphics/tesseract/tesseract3.nix
@@ -3,15 +3,23 @@
 
 stdenv.mkDerivation rec {
   pname = "tesseract";
-  version = "3.05.00";
+  version = "3.05.02";
 
   src = fetchFromGitHub {
     owner = "tesseract-ocr";
     repo = "tesseract";
     rev = version;
-    hash = "sha256-YHj00gG/3SW0ILTiQwphiCxuP9OCDya27hyFQB27mYc=";
+    hash = "sha256-28osuZnVwkJpNTYkU+5D5PI8xtViFzGCMScHzkS2H20=";
   };
 
+  # leptonica 1.83 made internal structures private. using internal headers isn't
+  # great, but tesseract3's days are numbered anyway
+  postPatch = ''
+    for f in textord/devanagari_processing.cpp cube/cube_line_object.h cube/cube_line_segmenter.h cube/cube_utils.h ; do
+      sed -i '/allheaders.h/a#include "pix_internal.h"' "$f"
+    done
+  '';
+
   enableParallelBuilding = true;
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/graphics/tesseract/tesseract4.nix b/pkgs/applications/graphics/tesseract/tesseract4.nix
index 36c4c694a16a..aecdf58186d0 100644
--- a/pkgs/applications/graphics/tesseract/tesseract4.nix
+++ b/pkgs/applications/graphics/tesseract/tesseract4.nix
@@ -3,26 +3,20 @@
 
 stdenv.mkDerivation rec {
   pname = "tesseract";
-  version = "4.1.1";
+  version = "4.1.3";
 
   src = fetchFromGitHub {
     owner = "tesseract-ocr";
     repo = "tesseract";
     rev = version;
-    hash = "sha256-lu/Y5mlCI8AajhiWaID0fGo5PghEQZdgt2X0K9c/QrE=";
+    hash = "sha256-sV3w53ky13ESc0dGPutMGQ4TcmOeWJkvUwBPIyzSTc8=";
   };
 
-  patches = [
-    # https://github.com/tesseract-ocr/tesseract/issues/3447
-    (fetchpatch {
-      url = "https://github.com/tesseract-ocr/tesseract/commit/dbc79b09d195490dfa3f7d338eadac07ad6683f7.patch";
-      sha256 = "sha256-lGlg0etuU4RXfdq1QH2bYObdeGrFHKf9O8zMUAbfNIQ=";
-    })
-    (fetchpatch {
-      url = "https://github.com/tesseract-ocr/tesseract/commit/6dc4b184b1ebf2e68461f6b63f63a033bc7245f7.patch";
-      sha256 = "sha256-DwIX3r5NmeajI6WgIVHDbkhLH/ygJIjPO5XrbzWQhSw=";
-    })
-  ];
+  # leptonica 1.83 made internal structures private. using internal headers isn't
+  # great, but tesseract4's days are numbered anyway
+  postPatch = ''
+    sed -i '/allheaders.h/a#include "pix_internal.h"' src/textord/devanagari_processing.cpp
+  '';
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/applications/misc/qt-box-editor/default.nix b/pkgs/applications/misc/qt-box-editor/default.nix
index 9480a32aae3d..7987208b885a 100644
--- a/pkgs/applications/misc/qt-box-editor/default.nix
+++ b/pkgs/applications/misc/qt-box-editor/default.nix
@@ -10,23 +10,25 @@
 
 mkDerivation {
   pname = "qt-box-editor";
-  version = "unstable-2019-07-12";
+  version = "unstable-2019-07-14";
 
   src = fetchFromGitHub {
     owner = "zdenop";
     repo = "qt-box-editor";
-    rev = "75a68b466868ba41ba2886caa796057403fe1901";
-    sha256 = "0zwsyy7cnbhy5aazwlkhd9y8bnzlgy1gffqa46abajn4809b95k3";
+    rev = "cba2929dabc6c715acd1a282ba161fee914c87f6";
+    hash = "sha256-3dWnAu0CLO3atjbC1zJEnL3vzsIEecDDDhW3INMfCv4=";
   };
 
   buildInputs = [ qtbase qtsvg leptonica tesseract ];
 
   nativeBuildInputs = [ qmake ];
 
-  # remove with next release
-  # https://github.com/zdenop/qt-box-editor/pull/78
+  # https://github.com/zdenop/qt-box-editor/issues/87
   postPatch = ''
-    printf "INSTALLS += target\ntarget.path = $out/bin" >>  qt-box-editor.pro
+    sed -i '/allheaders.h/a#include <leptonica/pix_internal.h>' src/TessTools.h
+
+    substituteInPlace qt-box-editor.pro \
+      --replace '-llept' '-lleptonica'
   '';
 
   meta = with lib; {
diff --git a/pkgs/applications/networking/cluster/linkerd/edge.nix b/pkgs/applications/networking/cluster/linkerd/edge.nix
index 365016eb672d..a124d633b37d 100644
--- a/pkgs/applications/networking/cluster/linkerd/edge.nix
+++ b/pkgs/applications/networking/cluster/linkerd/edge.nix
@@ -2,7 +2,7 @@
 
 (callPackage ./generic.nix { }) {
   channel = "edge";
-  version = "23.1.2";
-  sha256 = "1c8l5zzy5pjilp1a84084g3dgdm0rxkx7hj7lqcn0iihfvhxc1xq";
-  vendorSha256 = "sha256-6dOX3SsKjpwC/dEUO2SnVna99lpav7kIEKrMUy4YfhA=";
+  version = "23.2.1";
+  sha256 = "0qjl6qxfg6bj22fwm2y01if5dqp2w79y45ibrg46r33pf6gbwjxj";
+  vendorSha256 = "sha256-YxWBjbE3aBFfCbQeSTfQv5QzP5n4IRHHqNrFwrJPQ7g=";
 }
diff --git a/pkgs/applications/networking/cluster/pluto/default.nix b/pkgs/applications/networking/cluster/pluto/default.nix
index c9af58b1a8a8..fc2aa83aa430 100644
--- a/pkgs/applications/networking/cluster/pluto/default.nix
+++ b/pkgs/applications/networking/cluster/pluto/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "pluto";
-  version = "5.12.0";
+  version = "5.13.3";
 
   src = fetchFromGitHub {
     owner = "FairwindsOps";
     repo = "pluto";
     rev = "v${version}";
-    sha256 = "sha256-WE/XWNBy5p8PEQ11s8nmW+HoVEkQB9cKoj5ZS8Suvs8=";
+    sha256 = "sha256-6kbfsqhALf7LFl0GS4VAMTVDFKP+CaEr6IPfpTZ33Fo=";
   };
 
-  vendorHash = "sha256-F5Vh9wPd53bifLStk6wEwidPZvOjN87jn4RxJbSuW4o=";
+  vendorHash = "sha256-lXW1yHrGLwZdhfkMLeu7zm0w2HxXk1DW+QEY+rfGZpE=";
 
   ldflags = [
     "-w" "-s"
diff --git a/pkgs/applications/networking/go-graft/default.nix b/pkgs/applications/networking/go-graft/default.nix
index 88319182a648..2285a11bbf02 100644
--- a/pkgs/applications/networking/go-graft/default.nix
+++ b/pkgs/applications/networking/go-graft/default.nix
@@ -2,19 +2,19 @@
 
 buildGoModule rec {
   pname = "go-graft";
-  version = "0.2.16";
+  version = "0.2.17";
 
   src = fetchFromGitHub {
     owner = "mzz2017";
     repo = "gg";
     rev = "v${version}";
-    sha256 = "sha256-zdOcQ/+WXS7pDfnvYdb/FDjMT3yJdwnS8DoH2MIDcDs=";
+    sha256 = "sha256-UhRsgUz9au7e47cS6yrIJXc/8ZxVDpMHWBjoAcw+oCM=";
   };
 
   CGO_ENABLED = 0;
 
   ldflags = [ "-X github.com/mzz2017/gg/cmd.Version=${version}" "-s" "-w" "-buildid=" ];
-  vendorHash = "sha256-kx94B1XIXWJOY9Y69lNb/sHWVjsuFuOXrdtJFJrUuAs=";
+  vendorHash = "sha256-EiBt2SxUQY05Wr7KJbK+fs3U3iSmqECJ0glS8B2Ox9Q=";
   subPackages = [ "." ];
 
   meta = with lib; {
diff --git a/pkgs/applications/networking/instant-messengers/discord/default.nix b/pkgs/applications/networking/instant-messengers/discord/default.nix
index fdfb992192b3..87eb241686c6 100644
--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@@ -3,7 +3,7 @@ let
   versions = if stdenv.isLinux then {
     stable = "0.0.24";
     ptb = "0.0.38";
-    canary = "0.0.146";
+    canary = "0.0.148";
   } else {
     stable = "0.0.264";
     ptb = "0.0.59";
@@ -22,7 +22,7 @@ let
       };
       canary = fetchurl {
         url = "https://dl-canary.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
-        sha256 = "sha256-5GiG+RGqwHUdIeSVWpbaIw3sTuZbvIQeetXSEvSqTls=";
+        sha256 = "sha256-2ZrSDyPj3AHriCWZ/bb303H3J97TTun//WjmInNEmwk=";
       };
     };
     x86_64-darwin = {
diff --git a/pkgs/applications/networking/syncthing/default.nix b/pkgs/applications/networking/syncthing/default.nix
index e74084e14c52..3b171070a573 100644
--- a/pkgs/applications/networking/syncthing/default.nix
+++ b/pkgs/applications/networking/syncthing/default.nix
@@ -4,13 +4,13 @@ let
   common = { stname, target, postInstall ? "" }:
     buildGoModule rec {
       pname = stname;
-      version = "1.23.0";
+      version = "1.23.1";
 
       src = fetchFromGitHub {
         owner = "syncthing";
         repo = "syncthing";
         rev = "v${version}";
-        hash = "sha256-Z4YVU45na4BgIbN/IlORpTCuf2EuSuOyppDRzswn3EI=";
+        hash = "sha256-Jbg56Nn+5ZjIv1KZrThkqWY+P13MglLE78E6jc0rbY0=";
       };
 
       vendorHash = "sha256-q63iaRxJRvPY0Np20O6JmdMEjSg/kxRneBfs8fRTwXk=";
diff --git a/pkgs/applications/office/paperwork/paperwork-shell.nix b/pkgs/applications/office/paperwork/paperwork-shell.nix
index ee621df4d837..ca6cab2c1e4f 100644
--- a/pkgs/applications/office/paperwork/paperwork-shell.nix
+++ b/pkgs/applications/office/paperwork/paperwork-shell.nix
@@ -11,6 +11,7 @@
 , fabulous
 , getkey
 , psutil
+, shared-mime-info
 
 , pkgs
 }:
@@ -39,6 +40,7 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
+    shared-mime-info
     openpaperwork-gtk
   ];
 
diff --git a/pkgs/applications/office/paperwork/src.nix b/pkgs/applications/office/paperwork/src.nix
index 980a4aabf7ab..6323c2c417b8 100644
--- a/pkgs/applications/office/paperwork/src.nix
+++ b/pkgs/applications/office/paperwork/src.nix
@@ -1,13 +1,13 @@
 {fetchFromGitLab}:
 rec {
-  version = "2.1.1";
+  version = "2.1.2";
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     repo = "paperwork";
     group = "World";
     owner = "OpenPaperwork";
     rev = version;
-    sha256 = "2M2eMP54F3RRDMBuAZ1gBiBoMmTRJaHTUwtTjj4ZU+4=";
+    sha256 = "/5k+zUtTE+Dr879xbHDCAYrqlEJLsbkcRSG3GbA/PCg=";
   };
   sample_documents = fetchFromGitLab {
     domain = "gitlab.gnome.org";
diff --git a/pkgs/applications/science/biology/last/default.nix b/pkgs/applications/science/biology/last/default.nix
index 7a101e6e19dc..0104a5506bc6 100644
--- a/pkgs/applications/science/biology/last/default.nix
+++ b/pkgs/applications/science/biology/last/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "last";
-  version = "1445";
+  version = "1447";
 
   src = fetchFromGitLab {
     owner = "mcfrith";
     repo = "last";
     rev = "refs/tags/${version}";
-    hash = "sha256-E3D9KmCIVcwXblwJ0wePk0wKoXwKA2UsSGqfMmRsw2A=";
+    hash = "sha256-zts1F2tFeBP7CQifpc2M4i6duK8FA7hQXTOizv8/kWM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/science/math/gap/default.nix b/pkgs/applications/science/math/gap/default.nix
index 677e7d9a0d96..7a466f8c000c 100644
--- a/pkgs/applications/science/math/gap/default.nix
+++ b/pkgs/applications/science/math/gap/default.nix
@@ -134,8 +134,6 @@ stdenv.mkDerivation rec {
     # https://github.com/NixOS/nixpkgs/pull/192548#discussion_r992824942
     rm -r "$out/share/gap/pkg"
     cp -ar pkg tst "$out/share/gap"
-
-    makeWrapper "$out/lib/gap/gap" "$out/bin/gap" --add-flags "-l $out/share/gap"
   '';
 
   preFixup = ''
diff --git a/pkgs/applications/science/math/pari/default.nix b/pkgs/applications/science/math/pari/default.nix
index 4c0032e6c8b3..41dff3adede5 100644
--- a/pkgs/applications/science/math/pari/default.nix
+++ b/pkgs/applications/science/math/pari/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchurl
+, fetchpatch
 , gmp
 , libX11
 , libpthreadstubs
@@ -25,6 +26,15 @@ stdenv.mkDerivation rec {
     hash = "sha256-sEYoER7iKHZRmksc2vsy/rqjTq+iT56B9Y+NBX++4N0=";
   };
 
+  patches = [
+    # https://pari.math.u-bordeaux.fr/cgi-bin/bugreport.cgi?bug=2441
+    (fetchpatch {
+      name = "fix-find_isogenous_from_Atkin.patch";
+      url = "https://git.sagemath.org/sage.git/plain/build/pkgs/pari/patches/bug2441.patch?id=9.8.rc0";
+      hash = "sha256-DvOUFlFDnopN+MJY6GYRPNabuoHPFch/nNn+49ygznc=";
+    })
+  ];
+
   buildInputs = [
     gmp
     libX11
diff --git a/pkgs/applications/science/math/sage/README.md b/pkgs/applications/science/math/sage/README.md
index c3a81c2109ee..c4de5da45dbf 100644
--- a/pkgs/applications/science/math/sage/README.md
+++ b/pkgs/applications/science/math/sage/README.md
@@ -10,7 +10,7 @@ First you should find out which change to nixpkgs is at fault (if you don't alre
 
 If the build broke as a result of a package update, try those solutions in order:
 
-- search the [sage trac](https://trac.sagemath.org/) for keywords like "Upgrade <package>". Maybe somebody has already proposed a patch that fixes the issue. You can then add a `fetchpatch` to `sage-src.nix`.
+- search the [sage GitHub repo](https://github.com/sagemath/sage) for keywords like "Upgrade <package>". Maybe somebody has already proposed a patch that fixes the issue. You can then add a `fetchpatch` to `sage-src.nix`.
 
 - check if [gentoo](https://github.com/cschwan/sage-on-gentoo/tree/master/sci-mathematics/sage), [debian](https://salsa.debian.org/science-team/sagemath/tree/master/debian) or [arch linux](https://git.archlinux.org/svntogit/community.git/tree/trunk?h=packages/sagemath) already solved the problem. You can then again add a `fetchpatch` to `sage-src.nix`. If applicable you should also [propose the patch upstream](#proposing-a-sage-patch).
 
@@ -19,7 +19,7 @@ If the build broke as a result of a package update, try those solutions in order
 ```
 [user@localhost ~]$ git clone https://github.com/sagemath/sage.git
 [user@localhost ~]$ cd sage
-[user@localhost sage]$ git checkout 8.2 # substitute the relevant version here
+[user@localhost sage]$ git checkout 9.8 # substitute the relevant version here
 ```
 
 Then make the needed changes and generate a patch with `git diff`:
@@ -29,42 +29,10 @@ Then make the needed changes and generate a patch with `git diff`:
 [user@localhost ~]$ git diff -u > /path/to/nixpkgs/pkgs/applications/science/math/sage/patches/name-of-patch.patch
 ```
 
-Now just add the patch to `sage-src.nix` and test your changes. If they fix the problem, [propose them upstream](#proposing-a-sage-patch) and add a link to the trac ticket.
+Now just add the patch to `sage-src.nix` and test your changes. If they fix the problem, submit a PR upstream (refer to sages [Developer's Guide](http://doc.sagemath.org/html/en/developer/index.html) for further details).
 
 - pin the package version in `default.nix` and add a note that explains why that is necessary.
 
-
-## Proposing a sage patch
-
-You can [login the sage trac using GitHub](https://trac.sagemath.org/login). Your username will then be `gh-<your-github-name>`. The only other way is to request a trac account via email. After that refer to [git the hard way](http://doc.sagemath.org/html/en/developer/manual_git.html#chapter-manual-git) in the sage documentation. The "easy way" requires a non-GitHub account (requested via email) and a special tool. The "hard way" is really not all that hard if you're a bit familiar with git.
-
-Here's the gist, assuming you want to use ssh key authentication. First, [add your public ssh key](https://trac.sagemath.org/prefs/sshkeys). Then:
-
-```
-[user@localhost ~]$ git clone https://github.com/sagemath/sage.git
-[user@localhost ~]$ cd sage
-[user@localhost sage]$ git remote add trac git@trac.sagemath.org:sage.git -t master
-[user@localhost sage]$ git checkout -b u/gh-<your-github-username>/<your-branch-name> develop
-[user@localhost sage]$ <make changes>
-[user@localhost sage]$ git add .
-[user@localhost sage]$ git commit
-[user@localhost sage]$ git show # review your changes
-[user@localhost sage]$ git push --set-upstream trac u/gh-<your-github-username>/<your-branch-name>
-```
-
-You now created a branch on the trac server (you *must* follow the naming scheme as you only have push access to branches with the `u/gh-<your-github-username>/` prefix).
-Now you can [create a new trac ticket](https://trac.sagemath.org/newticket).
-- Write a description of the change
-- set the type and component as appropriate
-- write your real name in the "Authors" field
-- write `u/gh-<your-github-username>/<your-branch-name>` in the "Branch" field
-- click "Create ticket"
-- click "Modify" on the top right of your ticket (for some reason you can only change the ticket status after you have created it)
-- set the ticket status from `new` to `needs_review`
-- click "Save changes"
-
-Refer to sages [Developer's Guide](http://doc.sagemath.org/html/en/developer/index.html) for further details.
-
 ## I want to update sage
 
 You'll need to change the `version` field in `sage-src.nix`. Afterwards just try to build and let nix tell you which patches no longer apply (hopefully because they were adopted upstream). Remove those.
@@ -74,5 +42,5 @@ If the problem is not obvious, you can try to first update sage to an intermedia
 
 ## Well, that didn't help!
 
-If you couldn't fix the problem, create a GitHub issue on the nixpkgs repo and ping @timokau (or whoever is listed in the `maintainers` list of the sage package).
+If you couldn't fix the problem, create a GitHub issue on the nixpkgs repo and ping the sage maintainers (as listed in the sage package).
 Describe what you did and why it didn't work. Afterwards it would be great if you help the next guy out and improve this documentation!
diff --git a/pkgs/applications/science/math/sage/env-locations.nix b/pkgs/applications/science/math/sage/env-locations.nix
index 1f8b33f68738..39d358a1f9a8 100644
--- a/pkgs/applications/science/math/sage/env-locations.nix
+++ b/pkgs/applications/science/math/sage/env-locations.nix
@@ -35,7 +35,8 @@ writeTextFile rec {
     export GRAPHS_DATA_DIR='${graphs}/share/graphs'
     export ELLCURVE_DATA_DIR='${elliptic_curves}/share/ellcurves'
     export POLYTOPE_DATA_DIR='${polytopes_db}/share/reflexive_polytopes'
-    export GAP_ROOT_DIR='${gap}/share/gap'
+    export GAP_LIB_DIR='${gap}/lib/gap'
+    export GAP_SHARE_DIR='${gap}/share/gap'
     export ECLDIR='${maxima.lisp-compiler}/lib/${maxima.lisp-compiler.pname}-${maxima.lisp-compiler.version}/'
     export COMBINATORIAL_DESIGN_DATA_DIR="${combinatorial_designs}/share/combinatorial_designs"
     export CREMONA_MINI_DATA_DIR="${elliptic_curves}/share/cremona"
diff --git a/pkgs/applications/science/math/sage/patches/pari-2.15.1-upgrade-rebased.patch b/pkgs/applications/science/math/sage/patches/pari-2.15.1-upgrade-rebased.patch
deleted file mode 100644
index 40bbbe23f1a3..000000000000
--- a/pkgs/applications/science/math/sage/patches/pari-2.15.1-upgrade-rebased.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-diff --git a/src/sage/geometry/polyhedron/backend_normaliz.py b/src/sage/geometry/polyhedron/backend_normaliz.py
-index 86b89632a5..ca8a43b248 100644
---- a/src/sage/geometry/polyhedron/backend_normaliz.py
-+++ b/src/sage/geometry/polyhedron/backend_normaliz.py
-@@ -53,7 +53,7 @@ def _number_field_elements_from_algebraics_list_of_lists_of_lists(listss, **kwds
-         1.732050807568878?
-         sage: from sage.geometry.polyhedron.backend_normaliz import _number_field_elements_from_algebraics_list_of_lists_of_lists
-         sage: K, results, hom = _number_field_elements_from_algebraics_list_of_lists_of_lists([[[rt2], [1]], [[rt3]], [[1], []]]); results  # optional - sage.rings.number_field
--        [[[-a^3 + 3*a], [1]], [[-a^2 + 2]], [[1], []]]
-+        [[[-a^3 + 3*a], [1]], [[a^2 - 2]], [[1], []]]
-     """
-     from sage.rings.qqbar import number_field_elements_from_algebraics
-     numbers = []
-diff --git a/src/sage/lfunctions/pari.py b/src/sage/lfunctions/pari.py
-index d2b20f1891..6c31efe239 100644
---- a/src/sage/lfunctions/pari.py
-+++ b/src/sage/lfunctions/pari.py
-@@ -339,7 +339,7 @@ def lfun_eta_quotient(scalings, exponents):
-         0.0374412812685155
- 
-         sage: lfun_eta_quotient([6],[4])
--        [[Vecsmall([7]), [Vecsmall([6]), Vecsmall([4])]], 0, [0, 1], 2, 36, 1]
-+        [[Vecsmall([7]), [Vecsmall([6]), Vecsmall([4]), 0]], 0, [0, 1], 2, 36, 1]
- 
-         sage: lfun_eta_quotient([2,1,4], [5,-2,-2])
-         Traceback (most recent call last):
diff --git a/pkgs/applications/science/math/sage/sage-src.nix b/pkgs/applications/science/math/sage/sage-src.nix
index d68a2c8a107a..5e18b7415632 100644
--- a/pkgs/applications/science/math/sage/sage-src.nix
+++ b/pkgs/applications/science/math/sage/sage-src.nix
@@ -57,14 +57,14 @@ let
   );
 in
 stdenv.mkDerivation rec {
-  version = "9.7";
+  version = "9.8";
   pname = "sage-src";
 
   src = fetchFromGitHub {
     owner = "sagemath";
     repo = "sage";
     rev = version;
-    sha256 = "sha256-MYpCp18wqKwCa+tcJ7He14p1FXDlVm1vubQqQS9g3LY=";
+    sha256 = "sha256-dDbrzJXsOBARYfJz0r7n3LbaoXHnx7Acz6HBa95NV9o=";
   };
 
   # Patches needed because of particularities of nix or the way this is packaged.
@@ -89,14 +89,6 @@ stdenv.mkDerivation rec {
     # To help debug the transient error in
     # https://trac.sagemath.org/ticket/23087 when it next occurs.
     ./patches/configurationpy-error-verbose.patch
-
-    # https://trac.sagemath.org/ticket/33907
-    (fetchSageDiff {
-      name = "interfaces-expectpy-intermittent.patch";
-      base = "9.8.beta6";
-      rev = "6f5c1c2fc8bcfb5e6555716d05ce70511795ffa1";
-      sha256 = "sha256-z8FQxtrk62MHzPjrUTad+fMAE6XV8GTsLWKgGOM3zBg=";
-    })
   ];
 
   # Patches needed because of package updates. We could just pin the versions of
@@ -119,28 +111,12 @@ stdenv.mkDerivation rec {
     # adapted from https://trac.sagemath.org/ticket/23712#comment:22
     ./patches/tachyon-renamed-focallength.patch
 
-    # https://trac.sagemath.org/ticket/34118
-    (fetchSageDiff {
-      name = "sympy-1.11-upgrade.patch";
-      base = "9.7";
-      rev = "52815744bde2b682245b6f985a112f7cb8666056";
-      sha256 = "sha256-gv6z6JkQ6S6oCJQNkVgcPVvzlplyvR1nC7pWmcUiSc0=";
-    })
-
-    # https://trac.sagemath.org/ticket/34460
-    (fetchSageDiff {
-      name = "ipywidgets-8-upgrade.patch";
-      base = "9.7";
-      rev = "2816dbacb342398a23bb3099e20c92c8020ab0fa";
-      sha256 = "sha256-tCOsMxXwPkRg3FJGVvTqDzlWdra78UfDY6nci0Nr9GI=";
-    })
-
     # https://trac.sagemath.org/ticket/34391
     (fetchSageDiff {
       name = "gap-4.12-upgrade.patch";
-      base = "9.8.beta2";
-      rev = "eb8cd42feb58963adba67599bf6e311e03424328";
-      sha256 = "sha256-0dKewOZe2n3PqSdxCJt18FkqwTdrD0VA5MXAMiTW8Tw=";
+      base = "9.8.beta7";
+      rev = "dd4a17281adcda74e11f998ef519b6bd0dafb043";
+      sha256 = "sha256-UQT9DO9xd5hh5RucvUkIm+rggPKu8bc1YaSI6LVYH98=";
     })
 
     # https://trac.sagemath.org/ticket/34701
@@ -151,46 +127,6 @@ stdenv.mkDerivation rec {
       sha256 = "sha256-9BhQLFB3wUhiXRQsK9L+I62lSjvTfrqMNi7QUIQvH4U=";
     })
 
-    # https://trac.sagemath.org/ticket/34537
-    (fetchSageDiff {
-      name = "pari-2.15.1-upgrade.patch";
-      squashed = true;
-      base = "54cd6fe6de52aee5a433e0569e8c370618cb2047"; # 9.8.beta1
-      rev = "1e86aa26790d84bf066eca67f98a60a8aa3d4d3a";
-      sha256 = "sha256-LUgcMqrKXWb72Kxl0n6MV5unLXlQSeG8ncN41F7TRSc=";
-      excludes = ["build/*"
-                  "src/sage/geometry/polyhedron/base_number_field.py"
-                  "src/sage/geometry/polyhedron/backend_normaliz.py"
-                  "src/sage/lfunctions/pari.py"];
-    })
-    # Some files were excluded from the above patch due to
-    # conflicts. The patch below contains rebased versions.
-    ./patches/pari-2.15.1-upgrade-rebased.patch
-
-    # https://trac.sagemath.org/ticket/34668
-    (fetchSageDiff {
-      name = "matplotlib-3.6-upgrade.patch";
-      base = "9.8.beta2";
-      rev = "5501e0de0dca1cff0355326dd42bd8c7e5749568";
-      sha256 = "sha256-ceJkVaecIsZewN8v/3gPQXFbFjv5Akz6zEFg/ToXdek=";
-    })
-
-    # https://trac.sagemath.org/ticket/34693
-    (fetchSageDiff {
-      name = "matplotlib-3.6-docbuilding.patch";
-      base = "9.8.beta4";
-      rev = "64589686c261d33e6b5aff2589bcae8af004bcc6";
-      sha256 = "sha256-j5AMY1TmhP+HBBBYaFZSkABJ5vtwe6iP2LRfGEgSm8Q=";
-    })
-
-    # https://trac.sagemath.org/ticket/34615
-    (fetchSageDiff {
-      name = "sphinx-5.2-upgrade.patch";
-      base = "9.8.beta1";
-      rev = "8f8af65e54d3a9962cfab40f15dc23f4e955b43f";
-      sha256 = "sha256-yhDdyxnXSSkqLcuOPBWSEBc26rk1Od3gLcWW8S2p8bY=";
-    })
-
     # temporarily paper over https://github.com/jupyter-widgets/ipywidgets/issues/3669
     ./patches/ipywidgets-on_submit-deprecationwarning.patch
 
diff --git a/pkgs/applications/terminal-emulators/foot/default.nix b/pkgs/applications/terminal-emulators/foot/default.nix
index 7ae2825f175a..bd80a15d0562 100644
--- a/pkgs/applications/terminal-emulators/foot/default.nix
+++ b/pkgs/applications/terminal-emulators/foot/default.nix
@@ -18,7 +18,7 @@
 , wayland-scanner
 , pkg-config
 , utf8proc
-, allowPgo ? true
+, allowPgo ? !stdenv.hostPlatform.isMusl
 , python3  # for PGO
 # for clang stdenv check
 , foot
diff --git a/pkgs/applications/version-management/commitizen/default.nix b/pkgs/applications/version-management/commitizen/default.nix
index f53c6fb153b4..04a810cf9e8c 100644
--- a/pkgs/applications/version-management/commitizen/default.nix
+++ b/pkgs/applications/version-management/commitizen/default.nix
@@ -26,13 +26,13 @@
 
 buildPythonApplication rec {
   pname = "commitizen";
-  version = "2.41.0";
+  version = "2.42.0";
 
   src = fetchFromGitHub {
     owner = "commitizen-tools";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-dzAIRfUdyHSefDRDuPMsr8l2Dsiall2ZUDB6GufTbXE=";
+    hash = "sha256-13WEbF6in+zYZXWYqlYA98qJkKxjmcpQY9GuGS+DDtk=";
   };
 
   format = "pyproject";
diff --git a/pkgs/applications/version-management/sapling/default.nix b/pkgs/applications/version-management/sapling/default.nix
index 8873e8c4718e..3436c1ecda6e 100644
--- a/pkgs/applications/version-management/sapling/default.nix
+++ b/pkgs/applications/version-management/sapling/default.nix
@@ -88,111 +88,93 @@ let
       runHook postInstall
     '';
   };
-
-  # Builds the main `sl` binary and its Python extensions
-  sapling = python3Packages.buildPythonPackage {
-    pname = "sapling-main";
-    inherit src version;
-
-    sourceRoot = "source/eden/scm";
-
-    # Upstream does not commit Cargo.lock
-    cargoDeps = rustPlatform.importCargoLock {
-      lockFile = ./Cargo.lock;
-      outputHashes = {
-        "cloned-0.1.0" = "sha256-DYQTK722wgeDUJtOVXHLt42G6gpe6A62rET+JH+bPKU=";
-        "deltae-0.3.0" = "sha256-a9Skaqs+tVTw8x83jga+INBr+TdaMmo35Bf2wbfR6zs=";
-        "fb303_core-0.0.0" = "sha256-YEFNTYvtgp8nc/1O7AbdyxCD3Xx2xCjbS17fTTEsUL0=";
-        "fbthrift-0.0.1+unstable" = "sha256-mDoYhXOzQIDqP7XdmiBbmq5VmAKAgggTNH/kW2kHv4k=";
-        "reqwest-0.11.11" = "sha256-uhc8XhkGW22XDNo0qreWdXeFF2cslOOZHfTRQ30IBcE=";
-        "serde_bser-0.3.1" = "sha256-/zn1NfXWytXvnalkgPsg9BdujVV97PGkXwmPtQGVeCc=";
-      };
-    };
-    postPatch = ''
-      cp ${./Cargo.lock} Cargo.lock
-    '';
-
-    # Since the derivation builder doesn't have network access to remain pure,
-    # fetch the artifacts manually and link them. Then replace the hardcoded URLs
-    # with filesystem paths for the curl calls.
-    postUnpack = ''
-      mkdir $sourceRoot/hack_pydeps
-      ${lib.concatStrings (map (li: "ln -s ${fetchurl li} $sourceRoot/hack_pydeps/${baseNameOf li.url}\n") links)}
-      sed -i "s|https://files.pythonhosted.org/packages/[[:alnum:]]*/[[:alnum:]]*/[[:alnum:]]*/|file://$NIX_BUILD_TOP/$sourceRoot/hack_pydeps/|g" $sourceRoot/setup.py
-    '';
-
-    # Now, copy the "sl web" (aka edenscm-isl) results into the output of this
-    # package, so that the command can actually work. NOTES:
-    #
-    # 1) This applies on all systems (so no conditional a la postFixup)
-    # 2) This doesn't require any kind of fixup itself, so we leave it out
-    #    of postFixup for that reason, too
-    # 3) If asked, we optionally patch in a hardcoded path to the 'nodejs' package,
-    #    so that 'sl web' always works
-    # 4) 'sl web' will still work if 'nodejs' is in $PATH, just not OOTB
-    preFixup = ''
-      sitepackages=$out/lib/${python3Packages.python.libPrefix}/site-packages
-      chmod +w $sitepackages
-      cp -r ${isl} $sitepackages/edenscm-isl
-    '' + lib.optionalString (!enableMinimal) ''
-      chmod +w $sitepackages/edenscm-isl/run-isl
-      substituteInPlace $sitepackages/edenscm-isl/run-isl \
-        --replace 'NODE=node' 'NODE=${nodejs}/bin/node'
-    '';
-
-    postFixup = lib.optionalString stdenv.isLinux ''
-      wrapProgram $out/bin/sl \
-        --set LOCALE_ARCHIVE "${glibcLocales}/lib/locale/locale-archive"
-    '';
-
-    nativeBuildInputs = [
-      curl
-      pkg-config
-    ] ++ (with rustPlatform; [
-      myCargoSetupHook
-      rust.cargo
-      rust.rustc
-    ]);
-
-    buildInputs = [
-      openssl
-    ] ++ lib.optionals stdenv.isDarwin [
-      curl
-      libiconv
-      CoreFoundation
-      CoreServices
-      Security
-    ];
-
-    doCheck = false;
-
-    HGNAME = "sl";
-    SAPLING_OSS_BUILD = "true";
-    SAPLING_VERSION = version;
-    SAPLING_VERSION_HASH = versionHash;
-  };
 in
-stdenv.mkDerivation {
+# Builds the main `sl` binary and its Python extensions
+python3Packages.buildPythonApplication {
   pname = "sapling";
-  inherit version;
+  inherit src version;
 
-  dontUnpack = true;
+  sourceRoot = "source/eden/scm";
 
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out
-    cp -r ${sapling}/* $out
-
-    runHook postInstall
+  # Upstream does not commit Cargo.lock
+  cargoDeps = rustPlatform.importCargoLock {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "cloned-0.1.0" = "sha256-DYQTK722wgeDUJtOVXHLt42G6gpe6A62rET+JH+bPKU=";
+      "deltae-0.3.0" = "sha256-a9Skaqs+tVTw8x83jga+INBr+TdaMmo35Bf2wbfR6zs=";
+      "fb303_core-0.0.0" = "sha256-YEFNTYvtgp8nc/1O7AbdyxCD3Xx2xCjbS17fTTEsUL0=";
+      "fbthrift-0.0.1+unstable" = "sha256-mDoYhXOzQIDqP7XdmiBbmq5VmAKAgggTNH/kW2kHv4k=";
+      "reqwest-0.11.11" = "sha256-uhc8XhkGW22XDNo0qreWdXeFF2cslOOZHfTRQ30IBcE=";
+      "serde_bser-0.3.1" = "sha256-/zn1NfXWytXvnalkgPsg9BdujVV97PGkXwmPtQGVeCc=";
+    };
+  };
+  postPatch = ''
+    cp ${./Cargo.lock} Cargo.lock
   '';
 
+  # Since the derivation builder doesn't have network access to remain pure,
+  # fetch the artifacts manually and link them. Then replace the hardcoded URLs
+  # with filesystem paths for the curl calls.
+  postUnpack = ''
+    mkdir $sourceRoot/hack_pydeps
+    ${lib.concatStrings (map (li: "ln -s ${fetchurl li} $sourceRoot/hack_pydeps/${baseNameOf li.url}\n") links)}
+    sed -i "s|https://files.pythonhosted.org/packages/[[:alnum:]]*/[[:alnum:]]*/[[:alnum:]]*/|file://$NIX_BUILD_TOP/$sourceRoot/hack_pydeps/|g" $sourceRoot/setup.py
+  '';
+
+  # Now, copy the "sl web" (aka edenscm-isl) results into the output of this
+  # package, so that the command can actually work. NOTES:
+  #
+  # 1) This applies on all systems (so no conditional a la postFixup)
+  # 2) This doesn't require any kind of fixup itself, so we leave it out
+  #    of postFixup for that reason, too
+  # 3) If asked, we optionally patch in a hardcoded path to the 'nodejs' package,
+  #    so that 'sl web' always works
+  # 4) 'sl web' will still work if 'nodejs' is in $PATH, just not OOTB
+  preFixup = ''
+    sitepackages=$out/lib/${python3Packages.python.libPrefix}/site-packages
+    chmod +w $sitepackages
+    cp -r ${isl} $sitepackages/edenscm-isl
+  '' + lib.optionalString (!enableMinimal) ''
+    chmod +w $sitepackages/edenscm-isl/run-isl
+    substituteInPlace $sitepackages/edenscm-isl/run-isl \
+      --replace 'NODE=node' 'NODE=${nodejs}/bin/node'
+  '';
+
+  postFixup = lib.optionalString stdenv.isLinux ''
+    wrapProgram $out/bin/sl \
+      --set LOCALE_ARCHIVE "${glibcLocales}/lib/locale/locale-archive"
+  '';
+
+  nativeBuildInputs = [
+    curl
+    pkg-config
+  ] ++ (with rustPlatform; [
+    myCargoSetupHook
+    rust.cargo
+    rust.rustc
+  ]);
+
+  buildInputs = [
+    openssl
+  ] ++ lib.optionals stdenv.isDarwin [
+    curl
+    libiconv
+    CoreFoundation
+    CoreServices
+    Security
+  ];
+
+  HGNAME = "sl";
+  SAPLING_OSS_BUILD = "true";
+  SAPLING_VERSION = version;
+  SAPLING_VERSION_HASH = versionHash;
+
   # just a simple check phase, until we have a running test suite. this should
   # help catch issues like lack of a LOCALE_ARCHIVE setting (see GH PR #202760)
   doCheck = true;
-  checkPhase = ''
+  installCheckPhase = ''
     echo -n "testing sapling version; should be \"${version}\"... "
-    ${sapling}/bin/sl version | grep -qw "${version}"
+    $out/bin/sl version | grep -qw "${version}"
     echo "OK!"
   '';
 
diff --git a/pkgs/applications/video/ccextractor/default.nix b/pkgs/applications/video/ccextractor/default.nix
index 26954375aff5..3d6238463470 100644
--- a/pkgs/applications/video/ccextractor/default.nix
+++ b/pkgs/applications/video/ccextractor/default.nix
@@ -23,7 +23,10 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-usVAKBkdd8uz9cD5eLd0hnwGonOJLscRdc+iWDlNXVc=";
   };
 
-  postPatch = lib.optionalString stdenv.isDarwin ''
+  postPatch = ''
+    # https://github.com/CCExtractor/ccextractor/issues/1467
+    sed -i '/allheaders.h/a#include <leptonica/pix_internal.h>' src/lib_ccx/ocr.c
+  '' + lib.optionalString stdenv.isDarwin ''
     substituteInPlace src/CMakeLists.txt \
     --replace 'add_definitions(-DGPAC_CONFIG_LINUX)' 'add_definitions(-DGPAC_CONFIG_DARWIN)'
   '';
diff --git a/pkgs/applications/video/mirakurun/default.nix b/pkgs/applications/video/mirakurun/default.nix
index ce4d412b77f8..bc3603922475 100644
--- a/pkgs/applications/video/mirakurun/default.nix
+++ b/pkgs/applications/video/mirakurun/default.nix
@@ -39,6 +39,9 @@ stdenvNoCC.mkDerivation rec {
     yarnLock = ./yarn.lock;
     packageJSON = ./package.json;
 
+    # workaround for https://github.com/webpack/webpack/issues/14532
+    NODE_OPTIONS = "--openssl-legacy-provider";
+
     patches = [
       # NOTE: fixes for hardcoded paths and assumptions about filesystem
       # permissions
diff --git a/pkgs/applications/video/openshot-qt/default.nix b/pkgs/applications/video/openshot-qt/default.nix
index 02270cd75e06..ec980f1bfd1b 100644
--- a/pkgs/applications/video/openshot-qt/default.nix
+++ b/pkgs/applications/video/openshot-qt/default.nix
@@ -7,6 +7,7 @@
 , gtk3
 , libopenshot
 , python3
+, qtbase
 , qtsvg
 , wrapGAppsHook
 }:
@@ -55,7 +56,7 @@ mkDerivationWith python3.pkgs.buildPythonApplication rec {
   ''
   # Fix toolbar icons on Darwin
   + lib.optionalString stdenv.isDarwin ''
-    --suffix QT_PLUGIN_PATH : "${lib.getBin qtsvg}/lib/qt-5.12.7/plugins" \
+    --suffix QT_PLUGIN_PATH : "${lib.getBin qtsvg}/${qtbase.qtPluginPrefix}" \
   '' + ''
     "''${gappsWrapperArgs[@]}" \
     "''${qtWrapperArgs[@]}"
diff --git a/pkgs/applications/video/openshot-qt/libopenshot.nix b/pkgs/applications/video/openshot-qt/libopenshot.nix
index 4214bed7167f..904f039758ca 100644
--- a/pkgs/applications/video/openshot-qt/libopenshot.nix
+++ b/pkgs/applications/video/openshot-qt/libopenshot.nix
@@ -31,8 +31,6 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     sed -i 's/{UNITTEST++_INCLUDE_DIR}/ENV{UNITTEST++_INCLUDE_DIR}/g' tests/CMakeLists.txt
-    sed -i 's/{_REL_PYTHON_MODULE_PATH}/ENV{_REL_PYTHON_MODULE_PATH}/g' bindings/python/CMakeLists.txt
-    export _REL_PYTHON_MODULE_PATH=$(toPythonPath $out)
   '';
 
   nativeBuildInputs = lib.optionals stdenv.isLinux [
@@ -62,7 +60,10 @@ stdenv.mkDerivation rec {
 
   doCheck = false;
 
-  cmakeFlags = [ "-DENABLE_RUBY=OFF" ];
+  cmakeFlags = [
+    "-DENABLE_RUBY=OFF"
+    "-DPYTHON_MODULE_PATH=${python3.sitePackages}"
+  ];
 
   meta = with lib; {
     homepage = "http://openshot.org/";
diff --git a/pkgs/applications/virtualization/singularity/packages.nix b/pkgs/applications/virtualization/singularity/packages.nix
index 06c8c4fcc0da..aa626443c538 100644
--- a/pkgs/applications/virtualization/singularity/packages.nix
+++ b/pkgs/applications/virtualization/singularity/packages.nix
@@ -7,16 +7,14 @@ let
   apptainer = callPackage
     (import ./generic.nix rec {
       pname = "apptainer";
-      # TODO: Upgrade to 1.1.4 only after https://github.com/apptainer/apptainer/pull/967 get merge
-      # and https://github.com/apptainer/apptainer/issues/958 get fixed
-      version = "1.1.3";
+      version = "1.1.5";
       projectName = "apptainer";
 
       src = fetchFromGitHub {
         owner = "apptainer";
         repo = "apptainer";
         rev = "v${version}";
-        hash = "sha256-QFg6RC77OE/a6Qlzn6Zi5I7Iaq/U3/m0eI9yLArzuNc=";
+        hash = "sha256-onJkpHJNsO0cQO2m+TmdMuMkuvH178mDhOeX41bYFic=";
       };
 
       # Update by running
diff --git a/pkgs/data/fonts/iosevka/bin.nix b/pkgs/data/fonts/iosevka/bin.nix
index 7e3a662fda80..5baa9374a544 100644
--- a/pkgs/data/fonts/iosevka/bin.nix
+++ b/pkgs/data/fonts/iosevka/bin.nix
@@ -11,7 +11,7 @@ let
     (builtins.attrNames (builtins.removeAttrs variantHashes [ "iosevka" ]));
 in stdenv.mkDerivation rec {
   pname = "${name}-bin";
-  version = "18.0.0";
+  version = "19.0.0";
 
   src = fetchurl {
     url = "https://github.com/be5invis/Iosevka/releases/download/v${version}/ttc-${name}-${version}.zip";
diff --git a/pkgs/data/fonts/iosevka/variants.nix b/pkgs/data/fonts/iosevka/variants.nix
index 6d387516e8a4..7c5525c85d00 100644
--- a/pkgs/data/fonts/iosevka/variants.nix
+++ b/pkgs/data/fonts/iosevka/variants.nix
@@ -1,95 +1,95 @@
 # This file was autogenerated. DO NOT EDIT!
 {
-  iosevka = "03f2rabj2w2l7jwqyl2awj42jhh0l3picqgyfcv3q067i34abfyn";
-  iosevka-aile = "0p1r5sysy6djfd1sx0pfxf42bv7ayqgk1nvil33jr925w96i2dp6";
-  iosevka-curly = "0r33wcgvh315avgkkic27qpf3bavrqwbig1kj4wm5rdr957ldk40";
-  iosevka-curly-slab = "0yd7grhnx7z27xmd3wr8x2xx2002hmfi1y3ndmqq1sc9gab5gcb7";
-  iosevka-etoile = "0jhd49vxxxaqi1rxfkmpc3v1q96ak1b5wyggchngqi3739pjgqy3";
-  iosevka-slab = "00wk15kj9b1nr3b0bmarx6gqx3jg8z1pm9qqf9x09s72b3ng8adm";
-  iosevka-ss01 = "1kp6zv8zyx50la7zrfz4fis68s41kplibagny61w5v3w36xpm3cs";
-  iosevka-ss02 = "1c0dl28a3wwa5g4793jyb4n4c8p5vjlyh1b8j2i5da31dqrqm9gj";
-  iosevka-ss03 = "0vs8x6l8gwqi47g1c5ainsk5fb2i6j4wv7mgdyw5j5l3blnba5yh";
-  iosevka-ss04 = "1caf4xqd1dywzbq06ip042rw88833yk9ws7y3vjvsp93g7a2r675";
-  iosevka-ss05 = "008aphj4w6ri3fgnydrxavvpm3bfywv4cym10fqi9xgd84jhm9m1";
-  iosevka-ss06 = "00dkagqiwzwzvv75zss82yx0gdcbmh9xvr8swhi5zk0y0bc3xk2y";
-  iosevka-ss07 = "1acnva081awp76xyspksq9jkvlyswh3q1jy9gnsc6kh4vyn17vjs";
-  iosevka-ss08 = "0lmkglcjlppvfd7k2pz57r476fa4c0q5l4gqzfy1mlklh0mc5hqb";
-  iosevka-ss09 = "04r2k2z54iszwfnif872p5br0dm4fvc5341cpbxv4almpzxjyqnr";
-  iosevka-ss10 = "1c6gs9g8dhywpd2ha7kx2l7g7bwj7i5a78645ipx8126f749y0y9";
-  iosevka-ss11 = "0286k56r12a2yjylxynvzd0idrcv4ykrmpkn3b5xv9f74qq6irmf";
-  iosevka-ss12 = "0ab4x5lh8spbg0djb092vcq1cnvjhazwkia8byq1q47iwiyh756l";
-  iosevka-ss13 = "0kva71mfkl9xzz8khjzgrj47zg2505rg0hv5hxflawxsqwi4iwvl";
-  iosevka-ss14 = "1gk7m3xh4v3jm6s5g2prd27w4p0r1blbxsxdy3b020bdwikxcaga";
-  iosevka-ss15 = "0frxjc3hhay8izsx4ywff4j39qxp9ljz6hvw0rjcya3vny515jq5";
-  iosevka-ss16 = "1g299yhn0kfc7vn8vbgwq4798w5lcl72j6hj91k90i1yq11lg13i";
-  iosevka-ss17 = "02z83x73bhpgf44kq0gw46bdnpqzr4vm37h78bh19vydzqaj8hg0";
-  iosevka-ss18 = "1b7vhhbspi98xzmk4hpiw08jmscm7f7nibqxhkfmppl6y0ymbm9d";
-  sgr-iosevka = "1n60dgprl2p22wwfhxpwy9v9xf6vyv3qwm2jdc0m9m0q9jwjashr";
-  sgr-iosevka-aile = "1k195vqv2wajhmyma43xgda3s2z86kl2gksgdrm95s9sx7ijns2s";
-  sgr-iosevka-curly = "15yq1fs7knp9gxgqjxslpmlx85c6kvpm31sf81llpf4k5f9dmlcp";
-  sgr-iosevka-curly-slab = "0fa68lm6iwlf2s5k8388dwgk015c55zg1wkhhhjmixwn7p8gifxz";
-  sgr-iosevka-etoile = "1ry1zc7cdx6g927d1752ipz39v4wsnfrnn8n9cfwamz8v458wld1";
-  sgr-iosevka-fixed = "173v09dx5pwsbh9jac5qxi7nk95dqyryg747hl58bchby6kmnc3k";
-  sgr-iosevka-fixed-curly = "11y8bj9vmdq48n370f1r4zsk72ci3cq7c9ff6y40hn5w40s8k379";
-  sgr-iosevka-fixed-curly-slab = "1a4gmz6sl67l23awkfl8f3xdr8hbb2mi1lsc0ain1wvvyx1bi56m";
-  sgr-iosevka-fixed-slab = "11xv18ykrfg2fdvbrlcx7k3qvp5yqbm278ks3gm0gbck1awvfckg";
-  sgr-iosevka-fixed-ss01 = "1yb96x53wjks537vs0gd7rss6piszs139k1kgb1swrpq7519awaz";
-  sgr-iosevka-fixed-ss02 = "10yy0yg2i9nm00lzpmrfbdh7jjcll37wql3fcsaxha57gcxf9nf0";
-  sgr-iosevka-fixed-ss03 = "1fpjfqlqq6lz3gya1q24nzy2xls6nxn567lhglj0ykjnh3prkll8";
-  sgr-iosevka-fixed-ss04 = "1kwa5mwd6ihsyj2y70hrrvgy41cs19i0f7nvl4khs3i69a1l58ag";
-  sgr-iosevka-fixed-ss05 = "08v8in8s8p2nayazq60w1kc1jpq48nwdwh6wbxv7ij7lfwii8xws";
-  sgr-iosevka-fixed-ss06 = "03jzylw99xa3b6hpy6bpwhyii6d9fggy9synfl54sn7smwqk08wr";
-  sgr-iosevka-fixed-ss07 = "13yzd6r51gka03fcl3bvx6d97b4m4px2cnsd724maqkqrcxkbxgb";
-  sgr-iosevka-fixed-ss08 = "1xghlj7drx9328jr1cb051nkwv47r5ykkyy6ydff1c4amc1xabsq";
-  sgr-iosevka-fixed-ss09 = "12l6lbz4m1lwyqqmv583777r9ymssy9x34rz72y3dch0mqhmjjzg";
-  sgr-iosevka-fixed-ss10 = "1flrh6a7m0dw7na30nhbxjld54517z77ff3s9fjrpmgyb9wz7i2j";
-  sgr-iosevka-fixed-ss11 = "1j4v4h6k505gkxyswcjf61kj9cfgkalxjg1arms9zb351p8rrkda";
-  sgr-iosevka-fixed-ss12 = "00qwnsxc08bm5cq3ljz2pjqsiw019ah4z0crqcwaysijicxmbckc";
-  sgr-iosevka-fixed-ss13 = "0jrw0amhfi28mc4i7a74qvgjamvymijlf3akskaw9qrmzvks8wn1";
-  sgr-iosevka-fixed-ss14 = "0rvh842zkxdrna9nh2ylsjs3q90sq39658l0mafi85b8z5asdwai";
-  sgr-iosevka-fixed-ss15 = "0j5yrr1biqfhgj6qg6359xg9rfv6qzqiqdqjgfjwbhijs6xfn8f1";
-  sgr-iosevka-fixed-ss16 = "06jrfhb257nmldnxxyc5rh869r5y62v2y034c0r9j7354s7gcq7a";
-  sgr-iosevka-fixed-ss17 = "0cgmsh0478963k1dgpkhy6j1b383gx2q09z3shr6j87knjjwqgp0";
-  sgr-iosevka-fixed-ss18 = "0r4nyd459aqgna7dyzvxnznclqihxdb888g949kdzhxykfchq53s";
-  sgr-iosevka-slab = "1bv8asz66hn80xvjxa7b0vgywha1bpmhd8q95cssc3085dprz1r6";
-  sgr-iosevka-ss01 = "0sv19w0adnddzarf8dlz0n73jzqnp0xfb2lgh4xcpjkhm66j3fhh";
-  sgr-iosevka-ss02 = "1ih10a666r77pvj57crdgyn7ll15giwxj0nis501r1fkp1bzkscn";
-  sgr-iosevka-ss03 = "180hkjzzgasf9a58vi0n0cishnbyjgbjmkh60awcpxwvh85qd4hf";
-  sgr-iosevka-ss04 = "1i4rpg9j967xaxg8h9dmachd3896f4jgwxa0mfjlizls2hfvnbsi";
-  sgr-iosevka-ss05 = "1ca2z4dincjk7jl16pa6d7dnnzq3w3il7fr2lphvrjvdrxbci615";
-  sgr-iosevka-ss06 = "08dj9dcq58grnp6lh16yvvzjqhzlm765v4ci1rys0wbjnp72xxda";
-  sgr-iosevka-ss07 = "13k6plhdgxhp5gjs8z98wb480hh5wy6p2zmc4xvhp88y93fy8kk7";
-  sgr-iosevka-ss08 = "1zfxamanq6a06fazn1jkaswh5g6iw22qnycg5dnxn4flk8nas1db";
-  sgr-iosevka-ss09 = "0qaxp4fsvl26il16h78y2l8013m49cbk2nzxcs1k9g5if11a49d3";
-  sgr-iosevka-ss10 = "1qvvm6rvhrbp83qjfb3dfsbam20f6aw52kg1i5ggfrqj35niv0hd";
-  sgr-iosevka-ss11 = "1v2b456qj8kyacm7308gsim5p25wnyg8qabyrfvdj00h81s31akl";
-  sgr-iosevka-ss12 = "1rsi6ir5vccar0n3ychisc40axiyhqj5yvcx450ppd33f3sd5rc7";
-  sgr-iosevka-ss13 = "12x4q5l1pdxi065zs913dqd7zb8qpi4bbgd43h3k5azsrwxwvixr";
-  sgr-iosevka-ss14 = "1snzdv23jqmbz25k9i2zl7px7yysk5hn74q1x251s07ghdx3nfdj";
-  sgr-iosevka-ss15 = "0hbmj6wij6cv9yh76npp4xrl7fdm8jjx03398anfcsa02gkvg8zz";
-  sgr-iosevka-ss16 = "0v6vhg0vp5ig6ngs96q5mxa2snfp08nk68a9772sm1ny61q3chrq";
-  sgr-iosevka-ss17 = "0268b85yhdfsbjyhi0vlxwrpwxa8h919np53s060z94094h6jd9x";
-  sgr-iosevka-ss18 = "13vnhh8181h36y6iz2p2x6rjgjv5w3d0gqbcdkwhgmvx7s03k122";
-  sgr-iosevka-term = "05c2sxb4aris90mhjxyfkw1b0ga0hplfas669076h7yjsimw647l";
-  sgr-iosevka-term-curly = "1j0b4fhcivkdgka9zyqf732hcxj8rchqxkwv2bwxib1a17fmwn6c";
-  sgr-iosevka-term-curly-slab = "0dvv2n3plfxm8z2xi1ihzn4rncyk1kz8xbgyprnb0lvqiyf18igy";
-  sgr-iosevka-term-slab = "0i7wrvq6c96q8v6zw9iym42b6sbm0vc04ysljghpblnnfymq5yv9";
-  sgr-iosevka-term-ss01 = "1n23qp50pr466blpn2h9dhjbn0wnbbxyzb0sz751bk8db41lpyqb";
-  sgr-iosevka-term-ss02 = "0ghvfhkdsfsjb8yjwvwlwhn66lmy8dx34126ccnvj0g77ww2nwa9";
-  sgr-iosevka-term-ss03 = "03hnmy9wijqwsc36cg5b3pxj7mb1cbyacii00pcvrpcns2w1ssbw";
-  sgr-iosevka-term-ss04 = "0fv9xhhii0h5ii4yxsdnywn45254494mgq1n5aajasq494cgxhp4";
-  sgr-iosevka-term-ss05 = "0qa4l77sjpxd9l4nb555bhgzm0f1c74w6014md2rpljjvyy2mzwg";
-  sgr-iosevka-term-ss06 = "05y7rmghvhmzw3spn7b3v6hmpcqg5p32flm437a1aljdr46sbxli";
-  sgr-iosevka-term-ss07 = "1lzqgpr1vchi4ricqp1v49nv62rl3anbdvzpvddby81wr5jcyd1y";
-  sgr-iosevka-term-ss08 = "1sxicv2gspc39fyja370dpiq12xd1bgndiw5r6cqfkkd8x8dgpdv";
-  sgr-iosevka-term-ss09 = "0ax9pgm3d171kksrqd2z8xpr68kdxkqg9h344an55gjk01q7dzay";
-  sgr-iosevka-term-ss10 = "1rgvadmvdldcaqa0r76kzmrck814qwksdqficaxcd7wk8bx64n81";
-  sgr-iosevka-term-ss11 = "02if14ff5kax4p1aa2wkbidhwlzgyxi7lxir2ildahwfkvkp971y";
-  sgr-iosevka-term-ss12 = "0sj8n12is4094nbj67wkk88953jp9235kvvr4230abql1g6s263r";
-  sgr-iosevka-term-ss13 = "006sdcj8qw247b63d647ykm8razyb0apsfd0cjmlikj9hdmyzrr2";
-  sgr-iosevka-term-ss14 = "0i7d3ldp9rj1f4kwdk8hkxq0s38df6i25qfx6hwfjj1c5bl3a843";
-  sgr-iosevka-term-ss15 = "15gjqz7zc6wwy1l61pgpnz7wwyyaij43dcrwcwyi6h10jhm8b3ia";
-  sgr-iosevka-term-ss16 = "1c1i1iyqzgh3pz4fzjp26d71lphmcgqbjp2s91yyqg3nfhwbzvyc";
-  sgr-iosevka-term-ss17 = "0kr58576vlx81nb2ia5z9226m6h0ybd5vzfj5li9b721l4q0rpky";
-  sgr-iosevka-term-ss18 = "1zjs40i4dmw2l45k8wydngl4g3a88nhbmmjwd5lsz8a40pq4bw15";
+  iosevka = "0m8z67daj1gwb3yiw8qw3n1nxp96xb11fvb5183bh02r7ncym0da";
+  iosevka-aile = "02jhyzk3bpsjng3b1jfffwvr2inhhjsm4jdahzj05j381fp717c4";
+  iosevka-curly = "1si2kzv7qhlpyaaa954vnjmfk1c5rjxjimvckinpkjz30cnvg1bl";
+  iosevka-curly-slab = "1ngk3r6kdqngksga3s3m615jkqrxdcplj8srvlb6642vcc38w6vh";
+  iosevka-etoile = "1yg38x8dk5nyyjyy71v5j4x2x701hmp8gjwvphf5scf6vn52lvxz";
+  iosevka-slab = "1bw6lyy8lg4vpalnrsrnkrm9dlyl6vm6faigy2y9bfvh7nxrd8qa";
+  iosevka-ss01 = "1p02d8mdqx6mbnycs9d2r0qwqsxjrlgbl7skf8y66dsmjn6xxd0y";
+  iosevka-ss02 = "0ds8ad38h7h8250hdm89v2imya6jdzgk1h5jgsf983ls1gqjikhc";
+  iosevka-ss03 = "1s6rc4qhlfgvr7g8ywmlmsl58hfrqx0w24ivx5zz4jr5zqj70j7l";
+  iosevka-ss04 = "1lc8kx0p8m8nm4ql6ylcw9g4iq0j65hv6x48273cclqqcmqdn4qj";
+  iosevka-ss05 = "1wx02ysbj0rpr623jp1jy64ywrj8rm3n2fqzq05f4qv996bij11k";
+  iosevka-ss06 = "1bf0qnpvbq94d42gvbzikfkk20d788cicsyk8kz1vsf5xbg37kla";
+  iosevka-ss07 = "1ybl5gfyz4dnarimamshf002p9k6148wbbrbarpswb85kab502hd";
+  iosevka-ss08 = "1llp8iryr5dixdarwls9iw8mmnhzhlr7q8fzq969p64ygk76rkn4";
+  iosevka-ss09 = "14b49k0zv49xybdwrbf0p1krrga3jjviwzy0alxrwn0zf7vlbnbi";
+  iosevka-ss10 = "1xs1dkq62pml17dii2lhsianhzr22059i17sw2b334wbszc00j7y";
+  iosevka-ss11 = "0mrjzmk74vlq69ih4gm2iza4qdzyznn42bk3jwlvpd67z5vq36ag";
+  iosevka-ss12 = "0z16a8wrydi0ch9zj0lcz6cxbvawkr0ck03bzdbb81waggk4fxin";
+  iosevka-ss13 = "1rv8n3vbhwqv7bks6v86v4w13fr4a015xpvprzfz76xp98hb9dmc";
+  iosevka-ss14 = "0m7kpvy8bknmrfsql9b24w7n15hybnkisjxzzmrxkf8a60jrydni";
+  iosevka-ss15 = "006jkgww0hdb0c1wgby0y5535xapjpk1w8vm51d3yyrp04pwr1r1";
+  iosevka-ss16 = "1mmc7cyyk64lcavb2gib64b64zcr7qcn0m3cmlwnr1zgm6nb3w64";
+  iosevka-ss17 = "0wanv1h8qg5jyx7w380h7jkbc22slg9566pzw7dv7dg1nw0h2v3k";
+  iosevka-ss18 = "1y1daxghw3jbfn785935906j76l0230yixdmwlrzyra2svyaql3w";
+  sgr-iosevka = "182nzxxrxfz8xc3w8g9bsr0can71671w4xplyvyi7b1v9f62g9f5";
+  sgr-iosevka-aile = "1arjiwx5qf8j6pzb8mpd1g46z0kn80341wvcmsnx42d97b2m64jx";
+  sgr-iosevka-curly = "1lyh0rh2pswbaxsqyxicyknhla4gm2h0jb2rg0wx9vib9h53lazn";
+  sgr-iosevka-curly-slab = "0h2j7dwcyd5v1acpwjsz9li5g4r1ssx715x5pj4gdvskq4calff4";
+  sgr-iosevka-etoile = "15ag0w6sv24rc91mxh4c89gq6jwnq37bxml6a41rvn54fy0h1jnd";
+  sgr-iosevka-fixed = "0935zbk5x0mk06al11nig74b2rv1x8zc3waxs8hvbri0ryzykzk4";
+  sgr-iosevka-fixed-curly = "1i8cqfwcdsaxdlh87kaya8bp33fwlyz984r757122qnqbywcfm30";
+  sgr-iosevka-fixed-curly-slab = "0ba77jxn8n5dssjpwj4iyvwxw3mxqizrvsz5jyv9a4f3gfvwi18k";
+  sgr-iosevka-fixed-slab = "0qfhc7pg30ashpx504lln4h2w36icrbgij7fga07z2a715qxmfq9";
+  sgr-iosevka-fixed-ss01 = "1597hn4vzh0r8j22k7866blj3kw2bhp70z7msfr2hbszpscwxwqg";
+  sgr-iosevka-fixed-ss02 = "1ygrsvamgp6f26zg5qysk6dn4fa1im02dzsrlpgpv3sl4gh0cv44";
+  sgr-iosevka-fixed-ss03 = "0936ggnzaavqn4d7fsmmf54bwp0v31sz0n1w15ky7c5bsqp9h8ja";
+  sgr-iosevka-fixed-ss04 = "1xjslygh3f5nv0k8fiby0cgg22wr0a9jh79fbzallx3zh4d60a2a";
+  sgr-iosevka-fixed-ss05 = "0vnm398zdvkzymhw41gljpf9jq52wq3vawiyw5xsdr75d4n63fpb";
+  sgr-iosevka-fixed-ss06 = "1pnk8ijb193h85sk702ar0m0wk03xz1xcnvx8iq4k52q3a3vdd40";
+  sgr-iosevka-fixed-ss07 = "0qfcf6r2gzc5zwjfrcq1hjp9c5s13fc34lwwmxkj8224d42543jn";
+  sgr-iosevka-fixed-ss08 = "1ram9wm14k2sncfqpak23vss3pyqbwd1ndhm1i4ib7bpq8skd3wi";
+  sgr-iosevka-fixed-ss09 = "0r8zy1fwih42clxm2rsjqks5rxgy1qxirz396r25gvwxng2503y4";
+  sgr-iosevka-fixed-ss10 = "1v44s7n1gwz7mcybjsi1amv6xc8z47k20miycngjcy1cccrds2da";
+  sgr-iosevka-fixed-ss11 = "1fdclqvzq45shpj97awc7636ymgrnfd69iaizwxy49y2krpa7dx9";
+  sgr-iosevka-fixed-ss12 = "07f7i0qh9z6hlgy0ak3myxmiy4rbrixcap52lhk8wwapbnf21r7l";
+  sgr-iosevka-fixed-ss13 = "07z3hfi5vynwl15dqfsldwjj5i9fldmm6i1nypm28cxbya3izj60";
+  sgr-iosevka-fixed-ss14 = "1r001yna7ydf24bkgygld2kh47pvsz1yr9s57ssvdql37q24wzf1";
+  sgr-iosevka-fixed-ss15 = "1757lzbp9payykcdywdbfilhgm1yij8gsnazc7bywpc4sv806vhz";
+  sgr-iosevka-fixed-ss16 = "18mr7wvz5q60kgz0h2k05ahd0krz3ng7wgg1amd3292cji61vxvw";
+  sgr-iosevka-fixed-ss17 = "1bykqwspssv1vbx2nns8dfckijqmd633g57glmlhjmxlavv5gxnw";
+  sgr-iosevka-fixed-ss18 = "034w2yv2ihybkz03zalcsixrmjs7as62v8jhk8xkyckqc3bk0kc7";
+  sgr-iosevka-slab = "04b1w9ij6dgy5gyvi7d47g9xadpb230mlgbdrk36fyhvfyw048y1";
+  sgr-iosevka-ss01 = "077d4dan7f41ydi64xv0z0784j5vcj98vmqagmy1c1xyr0p68dac";
+  sgr-iosevka-ss02 = "1hmy2cwnsb3f60yp66lznas78432518xkj2jmpqy8ad05d2zmmc8";
+  sgr-iosevka-ss03 = "1bs1hb6magmbc2zh4fzx7h6j6bdllbvv85fv5krs3b888w3fzjw1";
+  sgr-iosevka-ss04 = "1c3wb8nz0xz57crwn151b5sgzm320jkirsajyjf0srdaid1gkjkx";
+  sgr-iosevka-ss05 = "1dx33y8rk3nzgdfikz262javq4v3n76hvv5b7rx7kxlkxycpy8ya";
+  sgr-iosevka-ss06 = "1s54xx4w3zvbz2w7f5sl5vlqazwsm033jsq8ljrdh4c2l88mpcq3";
+  sgr-iosevka-ss07 = "03zfq3jib2df6dhj1pbmw8hq57i0fx98gkawxzk13sfgrzz1zv47";
+  sgr-iosevka-ss08 = "09k220gha919lv18bs6y2zlcjqa5j7jsq8mfqx8xddcwq1v9v094";
+  sgr-iosevka-ss09 = "0plvxhqwkr52sich4kwzqs3xq5s5x61hq7n423ar2zaskx007sjv";
+  sgr-iosevka-ss10 = "0c42h417sir120cp6fbnbhv3s1ys8pxky56v6f44h50w7p6qhlx1";
+  sgr-iosevka-ss11 = "03sp7z0s5sb9bnhxb9liainpiqmq1r0lpmigscl6wr1rpaxq2l7i";
+  sgr-iosevka-ss12 = "0y2xs0qv3b1k4s4my9c69j94ql2kwmqmm3f626vjj8rar8r0wab0";
+  sgr-iosevka-ss13 = "1pyv3i1972n5gxr16fl68gydjsxndh7kbba3d15bmkankahgll6c";
+  sgr-iosevka-ss14 = "1c7y8h8jv937wnlxkgdswb0ixa5v747z598pd0yhvwid3ksxb1px";
+  sgr-iosevka-ss15 = "08wzzkr0l0xz4l7qk9kbhvybr4favl0qz0cjr7raw0hibqkw17sp";
+  sgr-iosevka-ss16 = "0q63x71mq19gqqiaqbqsp0lvf3knhckx5d17caq6ipv5gs3xxmzr";
+  sgr-iosevka-ss17 = "04054qbvyfvp1aqs3likyh85kqyckkg2ac83s65lvkj3f46r50sg";
+  sgr-iosevka-ss18 = "1ckrfx3f4mncm1hbc2bcsbk97kkzsi524wfgvhz10jw1yk5yyd60";
+  sgr-iosevka-term = "1ygfsc86fihkxpwm2q3j2y3ibpb7lkrjwrld7dg9ymb83hah29xm";
+  sgr-iosevka-term-curly = "1qz8x2z23m5yvdpf0055a7xb5z77dabwbf3hkmh4r77rp1h6idv4";
+  sgr-iosevka-term-curly-slab = "011n7qpcx2abvp5i9z6picy5bcjvvfx7pjqy8m7sf02fdm14s2jl";
+  sgr-iosevka-term-slab = "1iwgcqnxbjf25k6bbx3iwcqy2ghwnnxvfinjp5slwr7bhjjjbl9y";
+  sgr-iosevka-term-ss01 = "09s813a8ywqpncmq0iqkjjnh1sb5zn267fzp2dz92cmw5929627s";
+  sgr-iosevka-term-ss02 = "1yyvnxdwi6caq6b6pgviad5l7b7znx4xkxdg1np23a7imr94vb1c";
+  sgr-iosevka-term-ss03 = "1hrdipmf54z2hrl7g8m8z17aq3lp5v66xy24f58qsm4c1pfab3i7";
+  sgr-iosevka-term-ss04 = "1h54glwrzblg61y4f1sxm78mci47wjry4h4gdrbpx96snf31ynbb";
+  sgr-iosevka-term-ss05 = "1xzzj36817nsw15s3a1f740d89gc4634dnczjjj6vrddli8ilann";
+  sgr-iosevka-term-ss06 = "0c07i831bmfz6y7jqaip6il4cvqzc51d0w17s2dnjrnj4x3ndgmx";
+  sgr-iosevka-term-ss07 = "0x9wzf0w4pzjmzzbmzj56nkhhz5834chvxqn9519fbq1md4pfl3b";
+  sgr-iosevka-term-ss08 = "1gf1l17d8hrf1aq4pq9ai05kan8m86z8s2d7masjkvg1zaw2lb4s";
+  sgr-iosevka-term-ss09 = "1nnhciib413ll2h7ps3vyghiayz9iwniwr7byyn9pdimm0j5vq07";
+  sgr-iosevka-term-ss10 = "0qvficwhpya5sy5myxsjjfmrn9z2d9lpzyi88l8dhz3dfvyr1yzs";
+  sgr-iosevka-term-ss11 = "0ml6swvyddhz2nvq14skfh1d9d98c3d6ir0qgf97pc0qxyqbcfp2";
+  sgr-iosevka-term-ss12 = "01nxs1m2iif6lswx22h58i45zxab0nbqpf0rzlp6v3wnb8ylpbi5";
+  sgr-iosevka-term-ss13 = "0zadj9fakpqmibnxz883hwbcgqfssjvsi6kcvzik5cnamlk2jz8c";
+  sgr-iosevka-term-ss14 = "1dwfm8lcbgf8rfw11i2alrv98f9332cqyk9zvzfrjrdp9camr7j0";
+  sgr-iosevka-term-ss15 = "0z7ad7vy2faq33kpbl1x2w6i3s4af8v8fzj05rdyadws35ra3idd";
+  sgr-iosevka-term-ss16 = "1fzzkmk7ppcbmg7s50nknc7nwavfpqsja12af8qidzba9z535w2g";
+  sgr-iosevka-term-ss17 = "1rcpfgf5blg3nbf6prw9h2ylc2ji8vl6cxqlck482kncz8ph9swk";
+  sgr-iosevka-term-ss18 = "1nksii5xyi97lsrf1hxl06m0pdlk8rnsbg1s81amkzz8fxlyhzlc";
 }
diff --git a/pkgs/data/fonts/julia-mono/default.nix b/pkgs/data/fonts/julia-mono/default.nix
index e99dfde411dc..6054066465c3 100644
--- a/pkgs/data/fonts/julia-mono/default.nix
+++ b/pkgs/data/fonts/julia-mono/default.nix
@@ -2,12 +2,12 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "JuliaMono-ttf";
-  version = "0.047";
+  version = "0.048";
 
   src = fetchzip {
     url = "https://github.com/cormullion/juliamono/releases/download/v${version}/${pname}.tar.gz";
     stripRoot = false;
-    hash = "sha256-tCZo48SBGdhcsP1wgaWkfWr3L3Yz+p/iqesLmarSWbk=";
+    hash = "sha256-KSyJMlQclEj2CR+5uSYLmPtseWiDIUuahaPDx7Tn/bw=";
   };
 
   installPhase = ''
diff --git a/pkgs/data/misc/papirus-folders/default.nix b/pkgs/data/misc/papirus-folders/default.nix
index 92bfe362bcda..24fbeb0b0e23 100644
--- a/pkgs/data/misc/papirus-folders/default.nix
+++ b/pkgs/data/misc/papirus-folders/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "papirus-folders";
-  version = "1.12.0";
+  version = "1.12.1";
 
   src = fetchFromGitHub {
     owner = "PapirusDevelopmentTeam";
     repo = "papirus-folders";
     rev = "v${version}";
-    sha256 = "sha256-ZZMEZCWO+qW76eqa+TgxWGVz69VkSCPcttLoCrH7ppY=";
+    sha256 = "sha256-Dus9f2m5Wj46Url7N3UYEvBAankppzGzdJHGPH3CT3g=";
   };
 
   buildInputs = [
diff --git a/pkgs/desktops/gnome/core/gnome-contacts/default.nix b/pkgs/desktops/gnome/core/gnome-contacts/default.nix
index 760af24880c4..560d40ddc115 100644
--- a/pkgs/desktops/gnome/core/gnome-contacts/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-contacts/default.nix
@@ -26,11 +26,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-contacts";
-  version = "43.0";
+  version = "43.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-contacts/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "VbYd9+k/Cr4f+kZeGOPF3k9JqQ8mjqnRHtyGrwbQceE=";
+    sha256 = "Ug3IjJAce4/n4SoBOhQlz+2R8vhAhIWitJ+SxnWZACA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/compilers/gnu-cim/default.nix b/pkgs/development/compilers/gnu-cim/default.nix
new file mode 100644
index 000000000000..b1cb9f08597e
--- /dev/null
+++ b/pkgs/development/compilers/gnu-cim/default.nix
@@ -0,0 +1,45 @@
+{ lib
+, stdenv
+, fetchurl
+}:
+
+stdenv.mkDerivation rec {
+  pname = "gnu-cim";
+  version = "5.1";
+
+  outputs = ["out" "lib" "man" "info"];
+
+  src = fetchurl {
+    url = "mirror://gnu/cim/cim-${version}.tar.gz";
+    hash = "sha256-uQcXtm7EAFA73WnlN+i38+ip0QbDupoIoErlc2mgaak=";
+  };
+
+  postPatch = ''
+    for fname in lib/{simulation,simset}.c; do
+      substituteInPlace "$fname" \
+        --replace \
+          '#include "../../lib/cim.h"' \
+          '#include "../lib/cim.h"'
+    done
+  '';
+
+  CFLAGS = lib.optionalString stdenv.cc.isClang "-Wno-return-type";
+
+  doCheck = true;
+
+  meta = with lib; {
+    description = "A GNU compiler for the programming language Simula";
+    longDescription = ''
+      GNU Cim is a compiler for the programming language Simula.
+      It offers a class concept, separate compilation with full type checking,
+      interface to external C routines, an application package for process
+      simulation and a coroutine concept. Commonly used with the Demos for
+      discrete event modelling.
+    '';
+    homepage = "https://www.gnu.org/software/cim/";
+    license = licenses.gpl2;
+    platforms = platforms.all;
+    badPlatforms = [ "aarch64-darwin" ];
+    maintainers = with maintainers; [ pbsds ];
+  };
+}
diff --git a/pkgs/development/compilers/zig/0.10.nix b/pkgs/development/compilers/zig/0.10.nix
index 89f23b9ca25d..6d41b63f03b2 100644
--- a/pkgs/development/compilers/zig/0.10.nix
+++ b/pkgs/development/compilers/zig/0.10.nix
@@ -47,6 +47,7 @@ stdenv.mkDerivation rec {
   cmakeFlags = [
     # file RPATH_CHANGE could not write new RPATH
     "-DCMAKE_SKIP_BUILD_RPATH=ON"
+    "-DZIG_TARGET_MCPU=baseline"
   ];
 
   doCheck = true;
diff --git a/pkgs/development/libraries/arrow-cpp/default.nix b/pkgs/development/libraries/arrow-cpp/default.nix
index 5c60723309b7..76e117e57ce9 100644
--- a/pkgs/development/libraries/arrow-cpp/default.nix
+++ b/pkgs/development/libraries/arrow-cpp/default.nix
@@ -43,7 +43,7 @@
   # non-existent in older versions
   # see https://github.com/boostorg/process/issues/55
 , enableS3 ? (!stdenv.isDarwin) || (lib.versionOlder boost.version "1.69" || lib.versionAtLeast boost.version "1.70")
-, enableGcs ? !stdenv.isDarwin # google-cloud-cpp is not supported on darwin
+, enableGcs ? (!stdenv.isDarwin) && (lib.versionAtLeast grpc.cxxStandard "17") # google-cloud-cpp is not supported on darwin, needs to support C++17
 }:
 
 assert lib.asserts.assertMsg
@@ -52,17 +52,19 @@ assert lib.asserts.assertMsg
 
 let
   arrow-testing = fetchFromGitHub {
+    name = "arrow-testing";
     owner = "apache";
     repo = "arrow-testing";
-    rev = "5bab2f264a23f5af68f69ea93d24ef1e8e77fc88";
-    hash = "sha256-Pxx8ohUpXb5u1995IvXmxQMqWiDJ+7LAll/AjQP7ph8=";
+    rev = "ecab1162cbec872e17d949ecc86181670aee045c";
+    hash = "sha256-w6rEuxfLTEO8DyXV44G6JOMeTfYtskFCOj9rHXNmj2Y=";
   };
 
   parquet-testing = fetchFromGitHub {
+    name = "parquet-testing";
     owner = "apache";
     repo = "parquet-testing";
-    rev = "aafd3fc9df431c2625a514fb46626e5614f1d199";
-    hash = "sha256-cO5t/mgsbBhbSefx8EMGTyxmgTjhZ8mFujkFQ3p/JS0=";
+    rev = "5b82793ef7196f7b3583e85669ced211cd8b5ff2";
+    hash = "sha256-gcOvk7qFHZgJWE9CpucC8zwayYw47VbC3lmSRu4JQFg=";
   };
 
   aws-sdk-cpp-arrow = aws-sdk-cpp.override {
@@ -79,11 +81,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "arrow-cpp";
-  version = "9.0.0";
+  version = "11.0.0";
 
   src = fetchurl {
     url = "mirror://apache/arrow/arrow-${version}/apache-arrow-${version}.tar.gz";
-    hash = "sha256-qaAz8KNJAomZj0WGgNGVec8HkRcXumWv3my4AHD3qbU=";
+    hash = "sha256-Ldjw6ghIpYeFYo7jpXZ1VI1QnhchOi9dcrDZALQ/VDA=";
   };
   sourceRoot = "apache-arrow-${version}/cpp";
 
@@ -108,15 +110,15 @@ stdenv.mkDerivation rec {
   ARROW_XSIMD_URL = fetchFromGitHub {
     owner = "xtensor-stack";
     repo = "xsimd";
-    rev = "8.1.0";
-    hash = "sha256-Aqs6XJkGjAjGAp0PprabSM4m+32M/UXpSHppCHdzaZk=";
+    rev = "9.0.1";
+    hash = "sha256-onALN6agtrHWigtFlCeefD9CiRZI4Y690XTzy2UDnrk=";
   };
 
   ARROW_SUBSTRAIT_URL = fetchFromGitHub {
     owner = "substrait-io";
     repo = "substrait";
-    rev = "v0.6.0";
-    hash = "sha256-hxCBomL4Qg9cHLRg9ZiO9k+JVOZXn6f4ikPtK+V9tno=";
+    rev = "v0.20.0";
+    hash = "sha256-71hAwJ0cGvpwK/ibeeQt82e9uqxcu9sM1rPtPENMPfs=";
   };
 
   patches = [
@@ -148,18 +150,17 @@ stdenv.mkDerivation rec {
     utf8proc
     zlib
     zstd
-  ] ++ lib.optionals enableShared [
-    python3.pkgs.python
-    python3.pkgs.numpy
   ] ++ lib.optionals enableFlight [
     grpc
     openssl
     protobuf
+    sqlite
   ] ++ lib.optionals enableS3 [ aws-sdk-cpp-arrow openssl ]
   ++ lib.optionals enableGcs [
     crc32c
     curl
-    google-cloud-cpp grpc
+    google-cloud-cpp
+    grpc
     nlohmann_json
   ];
 
@@ -183,16 +184,12 @@ stdenv.mkDerivation rec {
     "-DARROW_COMPUTE=ON"
     "-DARROW_CSV=ON"
     "-DARROW_DATASET=ON"
-    "-DARROW_ENGINE=ON"
     "-DARROW_FILESYSTEM=ON"
     "-DARROW_FLIGHT_SQL=${if enableFlight then "ON" else "OFF"}"
     "-DARROW_HDFS=ON"
     "-DARROW_IPC=ON"
     "-DARROW_JEMALLOC=${if enableJemalloc then "ON" else "OFF"}"
     "-DARROW_JSON=ON"
-    "-DARROW_PLASMA=ON"
-    # Disable Python for static mode because openblas is currently broken there.
-    "-DARROW_PYTHON=${if enableShared then "ON" else "OFF"}"
     "-DARROW_USE_GLOG=ON"
     "-DARROW_WITH_BACKTRACE=ON"
     "-DARROW_WITH_BROTLI=ON"
@@ -203,21 +200,21 @@ stdenv.mkDerivation rec {
     "-DARROW_WITH_ZLIB=ON"
     "-DARROW_WITH_ZSTD=ON"
     "-DARROW_MIMALLOC=ON"
-    # Parquet options:
-    "-DARROW_PARQUET=ON"
     "-DARROW_SUBSTRAIT=ON"
-    "-DPARQUET_BUILD_EXECUTABLES=ON"
     "-DARROW_FLIGHT=${if enableFlight then "ON" else "OFF"}"
     "-DARROW_FLIGHT_TESTING=${if enableFlight then "ON" else "OFF"}"
     "-DARROW_S3=${if enableS3 then "ON" else "OFF"}"
     "-DARROW_GCS=${if enableGcs then "ON" else "OFF"}"
+    # Parquet options:
+    "-DARROW_PARQUET=ON"
+    "-DPARQUET_BUILD_EXECUTABLES=ON"
+    "-DPARQUET_REQUIRE_ENCRYPTION=ON"
   ] ++ lib.optionals (!enableShared) [
     "-DARROW_TEST_LINKAGE=static"
   ] ++ lib.optionals stdenv.isDarwin [
     "-DCMAKE_INSTALL_RPATH=@loader_path/../lib" # needed for tools executables
-  ] ++ lib.optional (!stdenv.isx86_64) "-DARROW_USE_SIMD=OFF"
-  ++ lib.optional enableS3 "-DAWSSDK_CORE_HEADER_FILE=${aws-sdk-cpp-arrow}/include/aws/core/Aws.h"
-  ++ lib.optionals enableGcs [ "-DCMAKE_CXX_STANDARD=${grpc.cxxStandard}" ];
+  ] ++ lib.optionals (!stdenv.isx86_64) [ "-DARROW_USE_SIMD=OFF" ]
+  ++ lib.optionals enableS3 [ "-DAWSSDK_CORE_HEADER_FILE=${aws-sdk-cpp-arrow}/include/aws/core/Aws.h" ];
 
   doInstallCheck = true;
   ARROW_TEST_DATA = lib.optionalString doInstallCheck "${arrow-testing}/data";
@@ -239,31 +236,33 @@ stdenv.mkDerivation rec {
         "TestS3FSGeneric.*"
       ];
     in
-    lib.optionalString doInstallCheck "-${builtins.concatStringsSep ":" filteredTests}";
+    lib.optionalString doInstallCheck "-${lib.concatStringsSep ":" filteredTests}";
+
   __darwinAllowLocalNetworking = true;
-  nativeInstallCheckInputs = [ perl which sqlite ] ++ lib.optional enableS3 minio;
-  installCheckPhase =
-    let
-      excludedTests = lib.optionals stdenv.isDarwin [
-        # Some plasma tests need to be patched to use a shorter AF_UNIX socket
-        # path on Darwin. See https://github.com/NixOS/nix/pull/1085
-        "plasma-external-store-tests"
-        "plasma-client-tests"
-      ] ++ [ "arrow-gcsfs-test" ];
-    in
-    ''
-      runHook preInstallCheck
 
-      ctest -L unittest \
-        --exclude-regex '^(${builtins.concatStringsSep "|" excludedTests})$'
+  nativeInstallCheckInputs = [ perl which sqlite ]
+    ++ lib.optionals enableS3 [ minio ]
+    ++ lib.optionals enableFlight [ python3 ];
 
-      runHook postInstallCheck
-    '';
+  disabledTests = [
+    # requires networking
+    "arrow-gcsfs-test"
+    "arrow-flight-integration-test"
+  ];
+
+  installCheckPhase = ''
+    runHook preInstallCheck
+
+    ctest -L unittest --exclude-regex '^(${lib.concatStringsSep "|" disabledTests})$'
+
+    runHook postInstallCheck
+  '';
 
   meta = with lib; {
     description = "A cross-language development platform for in-memory data";
     homepage = "https://arrow.apache.org/docs/cpp/";
     license = licenses.asl20;
+    broken = (stdenv.isLinux && stdenv.isAarch64) || stdenv.isDarwin; # waiting on gtest changes in staging
     platforms = platforms.unix;
     maintainers = with maintainers; [ tobim veprbl cpcloud ];
   };
diff --git a/pkgs/development/libraries/cosmopolitan/default.nix b/pkgs/development/libraries/cosmopolitan/default.nix
index 88e5bcf5d9d7..6f4cdb1cf687 100644
--- a/pkgs/development/libraries/cosmopolitan/default.nix
+++ b/pkgs/development/libraries/cosmopolitan/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cosmopolitan";
-  version = "2.1.1";
+  version = "2.2";
 
   src = fetchFromGitHub {
     owner = "jart";
     repo = pname;
     rev = version;
-    sha256 = "sha256-2Q4lutSIQ6tBwTy01lPSMepNAww9Kb7BwNyEcsSdWZ0=";
+    sha256 = "sha256-DTL1dXH+LhaxWpiCrsNjV74Bw5+kPbhEAA2Z1NKiPDk=";
   };
 
   patches = [
@@ -34,6 +34,9 @@ stdenv.mkDerivation rec {
     rm test/libc/calls/sched_setscheduler_test.c
     rm test/libc/thread/pthread_create_test.c
     rm test/libc/calls/getgroups_test.c
+
+    # fails
+    rm test/libc/stdio/posix_spawn_test.c
   '';
 
   installPhase = ''
diff --git a/pkgs/development/libraries/example-robot-data/default.nix b/pkgs/development/libraries/example-robot-data/default.nix
index 08a650dbca00..5fbb03a9fa2b 100644
--- a/pkgs/development/libraries/example-robot-data/default.nix
+++ b/pkgs/development/libraries/example-robot-data/default.nix
@@ -8,14 +8,14 @@
 
 stdenv.mkDerivation rec {
   pname = "example-robot-data";
-  version = "4.0.3";
+  version = "4.0.4";
 
   src = fetchFromGitHub {
     owner = "Gepetto";
     repo = pname;
     rev = "v${version}";
     fetchSubmodules = true;
-    sha256 = "sha256-rxVyka8tcF/CmGTVNyh3FPR1LVa6JOAN+9zjElgqCak=";
+    sha256 = "sha256-5FqMRChv/YGeoZq/jLSEJI5iQazQIDwslT78fbERVfs=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/libraries/fizz/default.nix b/pkgs/development/libraries/fizz/default.nix
index 2addb5748263..f00980cdd9be 100644
--- a/pkgs/development/libraries/fizz/default.nix
+++ b/pkgs/development/libraries/fizz/default.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fizz";
-  version = "2023.01.30.00";
+  version = "2023.02.06.00";
 
   src = fetchFromGitHub {
     owner = "facebookincubator";
     repo = "fizz";
     rev = "v${version}";
-    sha256 = "sha256-WyqDVoByBP91qGohNadr3iGpKEwZrURjr9mEaAdbfvs=";
+    sha256 = "sha256-JwRoIiSumT1jw5/VX/TkxpTJbrmLLke27xH8UHtrs2c=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/irr1/default.nix b/pkgs/development/libraries/irr1/default.nix
index 8740919ce3ae..ba4a99b2bb80 100644
--- a/pkgs/development/libraries/irr1/default.nix
+++ b/pkgs/development/libraries/irr1/default.nix
@@ -4,25 +4,25 @@
 , cmake
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (self: {
   pname = "irr1";
   version = "1.9.4";
 
   src = fetchFromGitHub {
     owner = "berndporr";
     repo = "iir1";
-    rev = version;
+    rev = self.version;
     hash = "sha256-T8gl51IkZIGq+6D5ge4Kb3wm5aw7Rhphmnf6TTGwHbs=";
   };
 
   nativeBuildInputs = [ cmake ];
 
   meta = {
-    description = "A DSP IIR realtime filter library written in C++";
-    downloadPage = "https://github.com/berndporr/iir1";
     homepage = "http://berndporr.github.io/iir1/";
+    description = "A DSP IIR realtime filter library written in C++";
+    changelog = "https://github.com/berndporr/iir1/releases/tag/${self.version}";
     license = lib.licenses.mit;
     maintainers = [ lib.maintainers.AndersonTorres ];
     platforms = lib.platforms.unix;
   };
-}
+})
diff --git a/pkgs/development/libraries/jbig2enc/default.nix b/pkgs/development/libraries/jbig2enc/default.nix
new file mode 100644
index 000000000000..26b21aa7c957
--- /dev/null
+++ b/pkgs/development/libraries/jbig2enc/default.nix
@@ -0,0 +1,60 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, fetchpatch
+, leptonica
+, zlib
+, libwebp
+, giflib
+, libjpeg
+, libpng
+, libtiff
+, autoreconfHook
+}:
+
+stdenv.mkDerivation rec {
+  pname = "jbig2enc";
+  version = "0.29";
+
+  src = fetchFromGitHub {
+    owner = "agl";
+    repo = "jbig2enc";
+    rev = version;
+    hash = "sha256-IAL4egXgaGmCilzcryjuvOoHhahyrfGWY68GBfXXgAM=";
+  };
+
+  buildInputs = [ autoreconfHook ];
+  propagatedBuildInputs = [
+    leptonica
+    zlib
+    libwebp
+    giflib
+    libjpeg
+    libpng
+    libtiff
+  ];
+
+  patches = [
+    (fetchpatch {
+      name = "fix-build-leptonica-1.83.patch";
+      url = "https://github.com/agl/jbig2enc/commit/ea050190466f5336c69c6a11baa1cb686677fcab.patch";
+      hash = "sha256-+kScjFgDEU9F7VOUNAhm2XBjGm49fzAH8hYhmTm8xv8=";
+    })
+  ];
+
+  # This is necessary, because the resulting library has
+  # /tmp/nix-build-jbig2enc/src/.libs before /nix/store/jbig2enc/lib
+  # in its rpath, which means that patchelf --shrink-rpath removes
+  # the /nix/store one.  By cleaning up before fixup, we ensure that
+  # the /tmp/nix-build-jbig2enc/src/.libs directory is gone.
+  preFixup = ''
+    make clean
+  '';
+
+  meta = {
+    description = "Encoder for the JBIG2 image compression format";
+    license = lib.licenses.asl20;
+    platforms = lib.platforms.all;
+    homepage = "https://github.com/agl/jbig2enc";
+  };
+}
diff --git a/pkgs/development/libraries/leptonica/default.nix b/pkgs/development/libraries/leptonica/default.nix
index 448a22f54997..fd020603b523 100644
--- a/pkgs/development/libraries/leptonica/default.nix
+++ b/pkgs/development/libraries/leptonica/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "leptonica";
-  version = "1.82.0";
+  version = "1.83.0";
 
   src = fetchurl {
     url = "http://www.leptonica.org/source/${pname}-${version}.tar.gz";
-    sha256 = "sha256-FVMC7pFGaMJ7b+PKn/LaY7JF9tYvMGHI8nVjd0uK4tY=";
+    sha256 = "sha256-IGWR3VjPhO84CDba0TO1jJ0a+SSR9amCXDRqFiBEvP4=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
diff --git a/pkgs/development/libraries/physics/clhep/default.nix b/pkgs/development/libraries/physics/clhep/default.nix
index a8d853a23b04..b3ba508220f5 100644
--- a/pkgs/development/libraries/physics/clhep/default.nix
+++ b/pkgs/development/libraries/physics/clhep/default.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "clhep";
-  version = "2.4.6.3";
+  version = "2.4.6.4";
 
   src = fetchurl {
     url = "https://proj-clhep.web.cern.ch/proj-clhep/dist1/clhep-${version}.tgz";
-    hash = "sha256-/NAH8RsQukryjQJyIrYxSNDrRP96CC7uNTvfkh+caEo=";
+    hash = "sha256-SciTMPGQPvcH08XXnBanxabyyQ/CkOIDTuODSAlInlc=";
   };
 
   prePatch = ''
diff --git a/pkgs/development/libraries/pico-sdk/default.nix b/pkgs/development/libraries/pico-sdk/default.nix
index 991d2e661f14..8b5f33599cd2 100644
--- a/pkgs/development/libraries/pico-sdk/default.nix
+++ b/pkgs/development/libraries/pico-sdk/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pico-sdk";
-  version = "1.4.0";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "raspberrypi";
     repo = pname;
     rev = version;
-    sha256 = "sha256-i3IAaNcd0EfKNvU104a776O1poDAChlx1m+nP8iFn8E=";
+    sha256 = "sha256-p69go8KXQR21szPb+R1xuonyFj+ZJDunNeoU7M3zIsE=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/s2n-tls/default.nix b/pkgs/development/libraries/s2n-tls/default.nix
index f9a12322c47b..afb872287413 100644
--- a/pkgs/development/libraries/s2n-tls/default.nix
+++ b/pkgs/development/libraries/s2n-tls/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "s2n-tls";
-  version = "1.3.34";
+  version = "1.3.36";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-CaVo2OxfB7ImMOgPuyvKQFbTeEm3PqD8CV96jUEZ8U0=";
+    sha256 = "sha256-IL7+f+7Igvm7KeBpDwnIoIB8IUqg3JDEtLFQslBIENE=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/science/math/sympow/default.nix b/pkgs/development/libraries/science/math/sympow/default.nix
index c31c705d39d0..09ca356ccdc5 100644
--- a/pkgs/development/libraries/science/math/sympow/default.nix
+++ b/pkgs/development/libraries/science/math/sympow/default.nix
@@ -1,5 +1,6 @@
 { lib, stdenv
 , fetchFromGitLab
+, fetchpatch
 , makeWrapper
 , which
 , autoconf
@@ -20,7 +21,14 @@ stdenv.mkDerivation rec {
     sha256 = "132l0xv00ld1svvv9wh99wfra4zzjv2885h2sq0dsl98wiyvi5zl";
   };
 
-  patches = [ ./clean-extra-logfile-output-from-pari.patch ];
+  patches = [
+    ./clean-extra-logfile-output-from-pari.patch
+    (fetchpatch {
+      name = "null-terminate-dupdirname.patch";
+      url = "https://gitlab.com/rezozer/forks/sympow/-/merge_requests/5.diff";
+      sha256 = "sha256-yKjio+qN9teL8L+mb7WOBN/iv545vRIxW20FJU37oO4=";
+    })
+  ];
 
   postUnpack = ''
     patchShebangs .
diff --git a/pkgs/development/libraries/stfl/default.nix b/pkgs/development/libraries/stfl/default.nix
index 1ed1a05004b6..845e815be590 100644
--- a/pkgs/development/libraries/stfl/default.nix
+++ b/pkgs/development/libraries/stfl/default.nix
@@ -9,6 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "1460d5lc780p3q38l3wc9jfr2a7zlyrcra0li65aynj738cam9yl";
   };
 
+  makeFlags = [ "CC=${stdenv.cc.targetPrefix}cc" ];
+
   buildInputs = [ ncurses libiconv ];
 
   preBuild = ''
@@ -16,12 +18,22 @@ stdenv.mkDerivation rec {
     sed -i s%ncursesw/ncurses.h%ncurses.h% stfl_internals.h
   '' + lib.optionalString stdenv.isDarwin ''
     sed -i s/-soname/-install_name/ Makefile
-  '';
+  ''
+  # upstream builds shared library unconditionally. Also, it has no
+  # support for cross-compilation.
+  + lib.optionalString stdenv.hostPlatform.isStatic ''
+    sed -i 's/all:.*/all: libstfl.a stfl.pc/' Makefile
+    sed -i 's/\tar /\t${stdenv.cc.targetPrefix}ar /' Makefile
+    sed -i 's/\tranlib /\t${stdenv.cc.targetPrefix}ranlib /' Makefile
+    sed -i '/install -m 644 libstfl.so./d' Makefile
+    sed -i '/ln -fs libstfl.so./d' Makefile
+  '' ;
 
   installPhase = ''
     DESTDIR=$out prefix=\"\" make install
-
-    # some programs rely on libstfl.so.0 to be present, so link it
+  ''
+  # some programs rely on libstfl.so.0 to be present, so link it
+  + lib.optionalString (!stdenv.hostPlatform.isStatic) ''
     ln -s $out/lib/libstfl.so.0.24 $out/lib/libstfl.so.0
   '';
 
diff --git a/pkgs/development/libraries/thrift/default.nix b/pkgs/development/libraries/thrift/default.nix
index 76d8cc2ff54e..92063eb1400a 100644
--- a/pkgs/development/libraries/thrift/default.nix
+++ b/pkgs/development/libraries/thrift/default.nix
@@ -36,11 +36,14 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     boost
+  ] ++ lib.optionals (!static) [
+    (python3.withPackages (ps: [ps.twisted]))
+  ];
+
+  propagatedBuildInputs = [
     libevent
     openssl
     zlib
-  ] ++ lib.optionals (!static) [
-    (python3.withPackages (ps: [ps.twisted]))
   ];
 
   postPatch = ''
@@ -66,6 +69,11 @@ stdenv.mkDerivation rec {
       url = "https://github.com/apache/thrift/commit/c41ad9d5119e9bdae1746167e77e224f390f2c42.diff";
       hash = "sha256-FkErrg/6vXTomS4AsCsld7t+Iccc55ZiDaNjJ3W1km0=";
     })
+    (fetchpatch {
+      name = "thrift-install-FindLibevent.patch"; # https://github.com/apache/thrift/pull/2726
+      url = "https://github.com/apache/thrift/commit/2ab850824f75d448f2ba14a468fb77d2594998df.diff";
+      hash = "sha256-ejMKFG/cJgoPlAFzVDPI4vIIL7URqaG06/IWdQ2NkhY=";
+    })
   ];
 
   cmakeFlags = [
diff --git a/pkgs/development/python-modules/asf-search/default.nix b/pkgs/development/python-modules/asf-search/default.nix
index b0d2b1f72386..686a9e92cebf 100644
--- a/pkgs/development/python-modules/asf-search/default.nix
+++ b/pkgs/development/python-modules/asf-search/default.nix
@@ -1,17 +1,19 @@
 { lib
 , buildPythonPackage
-, dateparser
 , fetchFromGitHub
+, pythonOlder
+, requests
+, shapely
+, python-dateutil
+, pytz
 , importlib-metadata
 , numpy
+, dateparser
+, jinja2
+, remotezip
 , pytestCheckHook
-, python-dateutil
-, pythonOlder
-, pytz
-, requests
 , requests-mock
-, shapely
-, wktutils
+, defusedxml
 }:
 
 buildPythonPackage rec {
@@ -29,25 +31,25 @@ buildPythonPackage rec {
   };
 
   propagatedBuildInputs = [
-    dateparser
-    importlib-metadata
-    numpy
-    python-dateutil
-    pytz
     requests
     shapely
-    wktutils
+    python-dateutil
+    pytz
+    importlib-metadata
+    numpy
+    dateparser
+    jinja2
+    remotezip
   ];
 
   nativeCheckInputs = [
     pytestCheckHook
-    requests-mock
   ];
 
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace "WKTUtils==" "WKTUtils>="
-  '';
+  checkInputs = [
+    requests-mock
+    defusedxml
+  ];
 
   pythonImportsCheck = [
     "asf_search"
diff --git a/pkgs/development/python-modules/awswrangler/default.nix b/pkgs/development/python-modules/awswrangler/default.nix
new file mode 100644
index 000000000000..f1b937f3ecdc
--- /dev/null
+++ b/pkgs/development/python-modules/awswrangler/default.nix
@@ -0,0 +1,88 @@
+{ backoff
+, sparqlwrapper
+, boto3
+, buildPythonPackage
+, fetchFromGitHub
+, gremlinpython
+, jsonpath-ng
+, lib
+, moto
+, openpyxl
+, opensearch-py
+, pandas
+, pg8000
+, poetry-core
+, progressbar2
+, pyarrow
+, pymysql
+, pyodbc
+, pytestCheckHook
+, pythonOlder
+, pythonRelaxDepsHook
+, redshift-connector
+, requests-aws4auth
+}:
+
+buildPythonPackage rec {
+  pname = "awswrangler";
+  version = "2.19.0";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.7.1";
+
+  src = fetchFromGitHub {
+    owner = "aws";
+    repo = "aws-sdk-pandas";
+    rev = "refs/tags/${version}";
+    hash = "sha256-xUEytEgr/djfnoOowLxAZmbPkMS+vU0fuPY7JxZXEe0=";
+  };
+
+  nativeBuildInputs = [ poetry-core pythonRelaxDepsHook ];
+
+  propagatedBuildInputs = [
+    backoff
+    boto3
+    gremlinpython
+    jsonpath-ng
+    openpyxl
+    opensearch-py
+    pandas
+    pg8000
+    progressbar2
+    pyarrow
+    pymysql
+    redshift-connector
+    requests-aws4auth
+  ];
+
+  pythonRelaxDeps = [
+    "gremlinpython"
+    "numpy"
+    "pandas"
+    "pg8000"
+  ];
+
+  nativeCheckInputs = [ moto pytestCheckHook ];
+
+  pytestFlagsArray = [
+    # Subset of tests that run in upstream CI (many others require credentials)
+    # https://github.com/aws/aws-sdk-pandas/blob/2b7c62ac0762b1303149bb3c03979791479ba4f9/.github/workflows/minimal-tests.yml
+    "tests/test_metadata.py"
+    "tests/test_session.py"
+    "tests/test_utils.py"
+    "tests/test_moto.py"
+  ];
+
+  passthru.optional-dependencies = {
+    sqlserver = [ pyodbc ];
+    sparql = [ sparqlwrapper ];
+  };
+
+  meta = {
+    description = "Pandas on AWS";
+    homepage = "https://github.com/aws/aws-sdk-pandas";
+    changelog = "https://github.com/aws/aws-sdk-pandas/releases/tag/${version}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ mcwitt ];
+  };
+}
diff --git a/pkgs/development/python-modules/bundlewrap/default.nix b/pkgs/development/python-modules/bundlewrap/default.nix
index 8c5be6384f35..1a0ef99e7493 100644
--- a/pkgs/development/python-modules/bundlewrap/default.nix
+++ b/pkgs/development/python-modules/bundlewrap/default.nix
@@ -31,7 +31,7 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [ setuptools ];
   propagatedBuildInputs = [
-    cryptography jinja2 Mako passlib pyyaml requests tomlkit librouteros
+    setuptools cryptography jinja2 Mako passlib pyyaml requests tomlkit librouteros
   ] ++ lib.optionals (pythonOlder "3.11") [ rtoml ];
 
   pythonImportsCheck = [ "bundlewrap" ];
diff --git a/pkgs/development/python-modules/dask/default.nix b/pkgs/development/python-modules/dask/default.nix
index f859a43bd1e2..a43f1a5afb57 100644
--- a/pkgs/development/python-modules/dask/default.nix
+++ b/pkgs/development/python-modules/dask/default.nix
@@ -1,5 +1,6 @@
 { lib
 , stdenv
+, arrow-cpp
 , bokeh
 , buildPythonPackage
 , click
@@ -70,13 +71,14 @@ buildPythonPackage rec {
   };
 
   nativeCheckInputs = [
-    fastparquet
-    pyarrow
     pytestCheckHook
     pytest-rerunfailures
     pytest-xdist
     scipy
     zarr
+  ] ++ lib.optionals (!arrow-cpp.meta.broken) [ # support is sparse on aarch64
+    fastparquet
+    pyarrow
   ];
 
   dontUseSetuptoolsCheck = true;
diff --git a/pkgs/development/python-modules/effect/default.nix b/pkgs/development/python-modules/effect/default.nix
index 739ace442b95..b9c49e30a560 100644
--- a/pkgs/development/python-modules/effect/default.nix
+++ b/pkgs/development/python-modules/effect/default.nix
@@ -1,40 +1,52 @@
-{ buildPythonPackage
-, fetchPypi
-, lib
-, isPy3k
-, six
+{ lib
 , attrs
-, pytest
+, buildPythonPackage
+, fetchPypi
+, pytestCheckHook
+, pythonOlder
+, six
 , testtools
 }:
 
 buildPythonPackage rec {
-  version = "1.1.0";
   pname = "effect";
-  disabled = (!isPy3k);
+  version = "1.1.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "7affb603707c648b07b11781ebb793a4b9aee8acf1ac5764c3ed2112adf0c9ea";
+    hash = "sha256-ev+2A3B8ZIsHsReB67eTpLmu6KzxrFdkw+0hEq3wyeo=";
   };
 
+  postPatch = ''
+    substituteInPlace effect/test_do.py \
+      --replace "py.test" "pytest"
+  '';
+
+  propagatedBuildInputs = [
+    attrs
+    six
+  ];
+
   nativeCheckInputs = [
-    pytest
+    pytestCheckHook
+  ];
+
+  checkInputs = [
     testtools
   ];
 
-  propagatedBuildInputs = [
-    six
-    attrs
+  pythonImportsCheck = [
+    "effect"
   ];
 
-  checkPhase = ''
-    pytest
-  '';
-
   meta = with lib; {
     description = "Pure effects for Python";
-    homepage = "https://github.com/python-effect/effect";
+    homepage = "https://effect.readthedocs.io/";
+    changelog = "https://github.com/python-effect/effect/releases/tag/${version}";
     license = licenses.mit;
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/development/python-modules/fiona/default.nix b/pkgs/development/python-modules/fiona/default.nix
index fec7fac990cd..3e9430ef318b 100644
--- a/pkgs/development/python-modules/fiona/default.nix
+++ b/pkgs/development/python-modules/fiona/default.nix
@@ -1,29 +1,46 @@
-{ stdenv, lib, buildPythonPackage, fetchPypi, isPy3k, pythonOlder, cython
-, attrs, click, cligj, click-plugins, six, munch, enum34
-, pytestCheckHook, boto3, mock, giflib, pytz
-, gdal, certifi
+{ lib
+, buildPythonPackage
+, pythonOlder
+, fetchFromGitHub
+, cython
+, gdal
+, setuptools
+, attrs
+, certifi
+, click
+, click-plugins
+, cligj
+, munch
+, shapely
+, boto3
+, pytestCheckHook
+, pytz
 }:
 
 buildPythonPackage rec {
   pname = "fiona";
-  version = "1.9.0";
+  version = "1.9.1";
 
-  src = fetchPypi {
-    pname = "Fiona";
-    inherit version;
-    hash = "sha256-bkh8v7pahJ+98G5FFp/X4fFmL0Tz1xerS5RgRrJFfq4=";
+  disabled = pythonOlder "3.7";
+
+  format = "pyproject";
+
+  src = fetchFromGitHub {
+    owner = "Toblerity";
+    repo = "Fiona";
+    rev = "refs/tags/${version}";
+    hash = "sha256-2CGLkgnpCAh9G+ILol5tmRj9S6/XeKk8eLzGEODiyP8=";
   };
 
-  CXXFLAGS = lib.optionalString stdenv.cc.isClang "-std=c++11";
-
   nativeBuildInputs = [
     cython
     gdal # for gdal-config
+    setuptools
   ];
 
   buildInputs = [
     gdal
-  ] ++ lib.optionals stdenv.cc.isClang [ giflib ];
+  ];
 
   propagatedBuildInputs = [
     attrs
@@ -31,32 +48,33 @@ buildPythonPackage rec {
     click
     cligj
     click-plugins
-    six
     munch
-    pytz
-  ] ++ lib.optional (!isPy3k) enum34;
+    setuptools
+  ];
+
+  passthru.optional-dependencies = {
+    calc = [ shapely ];
+    s3 = [ boto3 ];
+  };
 
   nativeCheckInputs = [
     pytestCheckHook
-    boto3
-  ] ++ lib.optional (pythonOlder "3.4") mock;
+    pytz
+  ] ++ passthru.optional-dependencies.s3;
 
   preCheck = ''
     rm -r fiona # prevent importing local fiona
-    # disable gdal deprecation warnings
-    export GDAL_ENABLE_DEPRECATED_DRIVER_GTM=YES
   '';
 
   disabledTests = [
     # Some tests access network, others test packaging
     "http" "https" "wheel"
-    # https://github.com/Toblerity/Fiona/issues/1164
-    "test_no_append_driver_cannot_append"
   ];
 
   pythonImportsCheck = [ "fiona" ];
 
   meta = with lib; {
+    changelog = "https://github.com/Toblerity/Fiona/blob/${src.rev}/CHANGES.txt";
     description = "OGR's neat, nimble, no-nonsense API for Python";
     homepage = "https://fiona.readthedocs.io/";
     license = licenses.bsd3;
diff --git a/pkgs/development/python-modules/fpylll/default.nix b/pkgs/development/python-modules/fpylll/default.nix
index fb2d0b166889..e1c22cd57885 100644
--- a/pkgs/development/python-modules/fpylll/default.nix
+++ b/pkgs/development/python-modules/fpylll/default.nix
@@ -1,7 +1,6 @@
 { stdenv
 , lib
 , fetchFromGitHub
-, fetchpatch
 , buildPythonPackage
 , pkgconfig
 , gmp
@@ -16,23 +15,15 @@
 
 buildPythonPackage rec {
   pname = "fpylll";
-  version = "0.5.7";
+  version = "0.5.9";
 
   src = fetchFromGitHub {
     owner = "fplll";
     repo = "fpylll";
     rev = version;
-    sha256 = "sha256-iUPreJ8BSB8LDisbJis0xn8ld6+Nf9Z4AP8SWJlCfZg=";
+    sha256 = "sha256-T6l6hKzRDevlLyLu5H+bnEdl0OhsPer1coCDiftbPAk=";
   };
 
-  patches = [
-   (fetchpatch {
-     name = "remove-strategies-doctest.patch";
-     url = "https://github.com/fplll/fpylll/commit/3edffcd189e9d827a322d83b0f84d32e5f067442.patch";
-     sha256 = "sha256-U7qOIbVzUNwYmjOPryjnE3J+MX/vMwm3T0UyOZ5ylLc=";
-   })
-  ];
-
   buildInputs = [
     gmp
     pari
diff --git a/pkgs/development/python-modules/mediapy/default.nix b/pkgs/development/python-modules/mediapy/default.nix
index 44190b11e599..333f55ce4228 100644
--- a/pkgs/development/python-modules/mediapy/default.nix
+++ b/pkgs/development/python-modules/mediapy/default.nix
@@ -21,6 +21,8 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [ ipython matplotlib numpy pillow ];
 
+  format = "flit";
+
   pythonImportsCheck = [ "mediapy" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/pyarrow/default.nix b/pkgs/development/python-modules/pyarrow/default.nix
index 08f55e4db386..a330a9392876 100644
--- a/pkgs/development/python-modules/pyarrow/default.nix
+++ b/pkgs/development/python-modules/pyarrow/default.nix
@@ -18,18 +18,15 @@
 , pkg-config
 , scipy
 , setuptools-scm
-, six
 }:
 
 let
   zero_or_one = cond: if cond then 1 else 0;
-
-  _arrow-cpp = arrow-cpp.override { python3 = python; };
 in
 
 buildPythonPackage rec {
   pname = "pyarrow";
-  inherit (_arrow-cpp) version src;
+  inherit (arrow-cpp) version src;
 
   disabled = pythonOlder "3.7";
 
@@ -42,13 +39,14 @@ buildPythonPackage rec {
     setuptools-scm
   ];
 
+  buildInputs = [ arrow-cpp ];
+
   propagatedBuildInputs = [
     cffi
     cloudpickle
     fsspec
     numpy
     scipy
-    six
   ];
 
   nativeCheckInputs = [
@@ -61,20 +59,24 @@ buildPythonPackage rec {
   PYARROW_BUILD_TYPE = "release";
 
   PYARROW_WITH_DATASET = zero_or_one true;
-  PYARROW_WITH_FLIGHT = zero_or_one _arrow-cpp.enableFlight;
+  PYARROW_WITH_FLIGHT = zero_or_one arrow-cpp.enableFlight;
   PYARROW_WITH_HDFS = zero_or_one true;
   PYARROW_WITH_PARQUET = zero_or_one true;
-  PYARROW_WITH_PLASMA = zero_or_one (!stdenv.isDarwin);
-  PYARROW_WITH_S3 = zero_or_one _arrow-cpp.enableS3;
+  PYARROW_WITH_PARQUET_ENCRYPTION = zero_or_one true;
+  # Plasma is deprecated since arrow 10.0.0
+  PYARROW_WITH_PLASMA = zero_or_one false;
+  PYARROW_WITH_S3 = zero_or_one arrow-cpp.enableS3;
+  PYARROW_WITH_GCS = zero_or_one arrow-cpp.enableGcs;
+  PYARROW_BUNDLE_ARROW_CPP_HEADERS = zero_or_one false;
 
   PYARROW_CMAKE_OPTIONS = [
     "-DCMAKE_INSTALL_RPATH=${ARROW_HOME}/lib"
   ];
 
-  ARROW_HOME = _arrow-cpp;
-  PARQUET_HOME = _arrow-cpp;
+  ARROW_HOME = arrow-cpp;
+  PARQUET_HOME = arrow-cpp;
 
-  ARROW_TEST_DATA = lib.optionalString doCheck _arrow-cpp.ARROW_TEST_DATA;
+  ARROW_TEST_DATA = lib.optionalString doCheck arrow-cpp.ARROW_TEST_DATA;
 
   doCheck = true;
 
@@ -86,6 +88,13 @@ buildPythonPackage rec {
     export PYARROW_PARALLEL=$NIX_BUILD_CORES
   '';
 
+  postInstall = ''
+    # copy the pyarrow C++ header files to the appropriate location
+    pyarrow_include="$out/${python.sitePackages}/pyarrow/include"
+    mkdir -p "$pyarrow_include/arrow/python"
+    find "$PWD/pyarrow/src/arrow" -type f -name '*.h' -exec cp {} "$pyarrow_include/arrow/python" \;
+  '';
+
   pytestFlagsArray = [
     # Deselect a single test because pyarrow prints a 2-line error message where
     # only a single line is expected. The additional line of output comes from
@@ -103,6 +112,8 @@ buildPythonPackage rec {
     "--deselect=pyarrow/tests/test_pandas.py::test_threaded_pandas_import"
     # Flaky test, works locally but not on Hydra
     "--deselect=pyarrow/tests/test_csv.py::TestThreadedCSVTableRead::test_cancellation"
+    # expects arrow-cpp headers to be bundled
+    "--deselect=pyarrow/tests/test_cpp_internals.py::test_pyarrow_include"
   ] ++ lib.optionals stdenv.isDarwin [
     # Requires loopback networking
     "--deselect=pyarrow/tests/test_ipc.py::test_socket_"
@@ -110,11 +121,18 @@ buildPythonPackage rec {
     "--deselect=pyarrow/tests/test_flight.py::test_large_descriptor"
     "--deselect=pyarrow/tests/test_flight.py::test_large_metadata_client"
     "--deselect=pyarrow/tests/test_flight.py::test_none_action_side_effect"
+    # fails to compile
+    "--deselect=pyarrow/tests/test_cython.py::test_cython_api"
   ] ++ lib.optionals (pythonAtLeast "3.11") [
     # Repr output is printing number instead of enum name so these tests fail
     "--deselect=pyarrow/tests/test_fs.py::test_get_file_info"
+  ] ++ lib.optionals stdenv.isLinux [
+    # this test requires local networking
+    "--deselect=pyarrow/tests/test_fs.py::test_filesystem_from_uri_gcs"
   ];
 
+  disabledTests = [ "GcsFileSystem" ];
+
   dontUseSetuptoolsCheck = true;
 
   preCheck = ''
@@ -129,7 +147,7 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [
     "pyarrow"
-  ] ++ map (module: "pyarrow.${module}") ([
+  ] ++ map (module: "pyarrow.${module}") [
     "compute"
     "csv"
     "dataset"
@@ -139,9 +157,7 @@ buildPythonPackage rec {
     "hdfs"
     "json"
     "parquet"
-  ] ++ lib.optionals (!stdenv.isDarwin) [
-    "plasma"
-  ]);
+  ];
 
   meta = with lib; {
     description = "A cross-language development platform for in-memory data";
diff --git a/pkgs/development/python-modules/pyipma/default.nix b/pkgs/development/python-modules/pyipma/default.nix
index 9befc34acbb6..8d2d153ebb9c 100644
--- a/pkgs/development/python-modules/pyipma/default.nix
+++ b/pkgs/development/python-modules/pyipma/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "pyipma";
-  version = "3.0.5";
+  version = "3.0.6";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "dgomes";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-KyXHNkP/XJlTdVFdP91x3udMquQju8G2VUHLPvZymtk=";
+    hash = "sha256-BwW8gUFeinZ9Z/v1orJKRTqt2WxVMD+hQj+A3gU1LDI=";
   };
 
   propagatedBuildInputs = [
@@ -52,6 +52,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Library to retrieve information from Instituto Português do Mar e Atmosfera";
     homepage = "https://github.com/dgomes/pyipma";
+    changelog = "https://github.com/dgomes/pyipma/releases/tag/${version}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/pyflunearyou/default.nix b/pkgs/development/python-modules/pyoutbreaksnearme/default.nix
similarity index 61%
rename from pkgs/development/python-modules/pyflunearyou/default.nix
rename to pkgs/development/python-modules/pyoutbreaksnearme/default.nix
index cd04d00ee32e..ff2a4a4323c1 100644
--- a/pkgs/development/python-modules/pyflunearyou/default.nix
+++ b/pkgs/development/python-modules/pyoutbreaksnearme/default.nix
@@ -1,7 +1,6 @@
 { lib
 , aiohttp
 , aresponses
-, aiocache
 , buildPythonPackage
 , fetchFromGitHub
 , poetry-core
@@ -9,39 +8,29 @@
 , pytest-aiohttp
 , pytestCheckHook
 , pythonOlder
-, pythonRelaxDepsHook
-, msgpack
 , ujson
 }:
 
 buildPythonPackage rec {
-  pname = "pyflunearyou";
-  version = "2021.10.0";
+  pname = "pyoutbreaksnearme";
+  version = "2022.10.0";
   format = "pyproject";
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.9";
 
   src = fetchFromGitHub {
     owner = "bachya";
     repo = pname;
-    rev = version;
-    sha256 = "sha256-Q65OSE4qckpvaIvZULBR434i7hwuVM97eSq1Blb1oIU=";
+    rev = "refs/tags/${version}";
+    sha256 = "sha256-D7oXkKDSg+yF+j1WyG/VVY12hLU6oyhEtxLrF6IkMSA=";
   };
 
-  pythonRelaxDeps = [
-    "aiocache"
-    "ujson"
-  ];
-
   nativeBuildInputs = [
     poetry-core
-    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
     aiohttp
-    aiocache
-    msgpack
     ujson
   ];
 
@@ -58,12 +47,13 @@ buildPythonPackage rec {
   ];
 
   pythonImportsCheck = [
-    "pyflunearyou"
+    "pyoutbreaksnearme"
   ];
 
   meta = with lib; {
-    description = "Python library for retrieving UV-related information from Flu Near You";
-    homepage = "https://github.com/bachya/pyflunearyou";
+    description = "Library for retrieving data from for Outbreaks Near Me";
+    homepage = "https://github.com/bachya/pyoutbreaksnearme";
+    changelog = "https://github.com/bachya/pyoutbreaksnearme/releases/tag/${version}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/pyweatherflowrest/default.nix b/pkgs/development/python-modules/pyweatherflowrest/default.nix
index b1384496325b..c03a4d01b170 100644
--- a/pkgs/development/python-modules/pyweatherflowrest/default.nix
+++ b/pkgs/development/python-modules/pyweatherflowrest/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "pyweatherflowrest";
-  version = "1.0.8";
+  version = "1.0.9";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -16,8 +16,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "briis";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "1swyqdnvhwaigqhjn5a22gi8if4bl8alfrigln4qa0jl9z03kg09";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-LFA1GJCYFIWl7/YblRrYgAB4lbELpzhCJyjB8aCkJ/E=";
   };
 
   nativeBuildInputs = [
@@ -44,6 +44,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python module to get data from WeatherFlow Weather Stations";
     homepage = "https://github.com/briis/pyweatherflowrest";
+    changelog = "https://github.com/briis/pyweatherflowrest/blob/v${version}/CHANGELOG.md";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/remotezip/default.nix b/pkgs/development/python-modules/remotezip/default.nix
new file mode 100644
index 000000000000..5a79b68e6b85
--- /dev/null
+++ b/pkgs/development/python-modules/remotezip/default.nix
@@ -0,0 +1,47 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, requests
+, tabulate
+, pytestCheckHook
+, requests-mock
+}:
+
+buildPythonPackage {
+  pname = "remotezip";
+  version = "0.12.1";
+  format = "setuptools";
+
+  src = fetchFromGitHub {
+    owner = "gtsystem";
+    repo = "python-remotezip";
+    # upstream does not tag releases, determined with git blame
+    # pypi archive lacks files for tests
+    rev = "da62e115bdb2071ad08a8c91f7ae48f2c1827e0c";
+    hash = "sha256-su4dlV8KZuewf/yGdTnGHK9hNLHwGe10ditmFcne4Us=";
+  };
+
+  propagatedBuildInputs = [
+    requests
+    tabulate
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  checkInputs = [
+    requests-mock
+  ];
+
+  pythonImportsCheck = [
+    "remotezip"
+  ];
+
+  meta = with lib; {
+    description = "Python module to access single members of a zip archive without downloading the full content";
+    homepage = "https://github.com/gtsystem/python-remotezip";
+    license = licenses.mit;
+    maintainers = with maintainers; [ nickcao ];
+  };
+}
diff --git a/pkgs/development/python-modules/scmrepo/default.nix b/pkgs/development/python-modules/scmrepo/default.nix
index 0f2ffa7138e6..c2129a38bc79 100644
--- a/pkgs/development/python-modules/scmrepo/default.nix
+++ b/pkgs/development/python-modules/scmrepo/default.nix
@@ -11,11 +11,12 @@
 , pygtrie
 , pythonOlder
 , setuptools
+, shortuuid
 }:
 
 buildPythonPackage rec {
   pname = "scmrepo";
-  version = "0.1.7";
+  version = "0.1.9";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -24,7 +25,7 @@ buildPythonPackage rec {
     owner = "iterative";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-F+t/3Nfcw+LG9Kh0Je2JwPWUWBNsZXTEaQOKaTT5ig0=";
+    hash = "sha256-WXePQMHCAmcGUHNNHBaqNQisewMUR87iJC0K2ltYVBE=";
   };
 
   postPatch = ''
@@ -46,6 +47,7 @@ buildPythonPackage rec {
     pathspec
     pygit2
     pygtrie
+    shortuuid
   ];
 
   # Requires a running Docker instance
diff --git a/pkgs/development/python-modules/shortuuid/default.nix b/pkgs/development/python-modules/shortuuid/default.nix
index 34ad5aa93908..fda1e1896a50 100644
--- a/pkgs/development/python-modules/shortuuid/default.nix
+++ b/pkgs/development/python-modules/shortuuid/default.nix
@@ -28,6 +28,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Library to generate concise, unambiguous and URL-safe UUIDs";
     homepage = "https://github.com/stochastic-technologies/shortuuid/";
+    changelog = "https://github.com/skorokithakis/shortuuid/blob/v${version}/CHANGELOG.md";
     license = licenses.bsd3;
     maintainers = with maintainers; [ zagy ];
   };
diff --git a/pkgs/development/python-modules/tesserocr/default.nix b/pkgs/development/python-modules/tesserocr/default.nix
index 73b5a5727a38..9e3e1560c208 100644
--- a/pkgs/development/python-modules/tesserocr/default.nix
+++ b/pkgs/development/python-modules/tesserocr/default.nix
@@ -24,6 +24,11 @@ buildPythonPackage rec {
     sha256 = "1bmj76gi8401lcqdaaznfmz9yf11myy1bzivqwwq08z3dwzxswck";
   };
 
+  # https://github.com/sirfz/tesserocr/issues/314
+  postPatch = ''
+    sed -i '/allheaders.h/a\    pass\n\ncdef extern from "leptonica/pix_internal.h" nogil:' tesseract.pxd
+  '';
+
   nativeBuildInputs = [
     cython
     pkg-config
diff --git a/pkgs/development/python-modules/xmlschema/default.nix b/pkgs/development/python-modules/xmlschema/default.nix
index 00df9fc517c8..d306f83220e8 100644
--- a/pkgs/development/python-modules/xmlschema/default.nix
+++ b/pkgs/development/python-modules/xmlschema/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "xmlschema";
-  version = "2.2.0";
+  version = "2.2.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "sissaschool";
     repo = "xmlschema";
     rev = "refs/tags/v${version}";
-    hash = "sha256-KK1F8OVK+19ZWwu+2UtTMiVNyPPoPOv3V1qJFZAu2h4=";
+    hash = "sha256-yF2L5VxUkqJjen5JeCQis4Q1o1KCJtRJ+S52wnS5VQg=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/tools/analysis/tflint/default.nix b/pkgs/development/tools/analysis/tflint/default.nix
index bb3d37f4f876..df6a7976de3e 100644
--- a/pkgs/development/tools/analysis/tflint/default.nix
+++ b/pkgs/development/tools/analysis/tflint/default.nix
@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "tflint";
-  version = "0.44.1";
+  version = "0.45.0";
 
   src = fetchFromGitHub {
     owner = "terraform-linters";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-O758CU70NqRFlbtiy5cmfIHiHdQLxH88BHNZLQVvZ+M=";
+    sha256 = "sha256-tsnW6KoLHEWd/uDZrK2cnVZ2IWftoxZ5zGdYhRdUp9Q=";
   };
 
-  vendorSha256 = "sha256-4ODf6Er7V5KsVUdWjqjv+dfH84PPR+5T29V1AJluoJA=";
+  vendorSha256 = "sha256-crGs7j9hAnGCCFjhigIJVpTM0rr9WgvBq3/ZGt6hwqQ=";
 
   doCheck = false;
 
diff --git a/pkgs/development/tools/bpf-linker/default.nix b/pkgs/development/tools/bpf-linker/default.nix
index d1839eb86fab..49780a7772e4 100644
--- a/pkgs/development/tools/bpf-linker/default.nix
+++ b/pkgs/development/tools/bpf-linker/default.nix
@@ -2,7 +2,7 @@
 , stdenv
 , rustPlatform
 , fetchFromGitHub
-, llvmPackages_14
+, llvmPackages_15
 , zlib
 , ncurses
 , libxml2
@@ -10,21 +10,21 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "bpf-linker";
-  version = "0.9.4";
+  version = "0.9.5";
 
   src = fetchFromGitHub {
     owner = "aya-rs";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-jYuBk78aGQLUeNF6d6kjGPuMxEF22XJquHcs23WVGm0=";
+    hash = "sha256-LEZ2to1bzJ/H/XYytuh/7NT7+04aI8chpKIFxxVzM+4=";
   };
 
-  cargoHash = "sha256-X8EVpOxDHwE/wj/gly/wdZ6tsrMrz3kkDe9gEPbk6iw=";
+  cargoHash = "sha256-s8cW7lXtvgemuQueTtAywewnDVJ/WDcz8SBqsC/tO80=";
 
   buildNoDefaultFeatures = true;
   buildFeatures = [ "system-llvm" ];
 
-  nativeBuildInputs = [ llvmPackages_14.llvm ];
+  nativeBuildInputs = [ llvmPackages_15.llvm ];
   buildInputs = [ zlib ncurses libxml2 ];
 
   # fails with: couldn't find crate `core` with expected target triple bpfel-unknown-none
diff --git a/pkgs/development/tools/coder/default.nix b/pkgs/development/tools/coder/default.nix
index 30d22bc183dc..e5f017de1e1e 100644
--- a/pkgs/development/tools/coder/default.nix
+++ b/pkgs/development/tools/coder/default.nix
@@ -5,19 +5,19 @@
 }:
 buildGoModule rec {
   pname = "coder";
-  version = "0.16.0";
+  version = "0.17.1";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-3rGpyJzGkZYUEvKKDzj2I5sqrUImmmX7cXWM9UClPLY=";
+    hash = "sha256-FHBaefwSGZXwn1jdU7zK8WhwjarknvyeUJTlhmk/hPM=";
   };
 
   # integration tests require network access
   doCheck = false;
 
-  vendorHash = "sha256-bb9jBno7elO6qKGjacpX3rxgrpJpGpTxMQtdBYjBzMk=";
+  vendorHash = "sha256-+AvmJkZCFovE2+5Lg98tUvA7f2kBHUMzhl5IyrEGuy8=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/development/tools/continuous-integration/fly/default.nix b/pkgs/development/tools/continuous-integration/fly/default.nix
index 20ba407e3d03..fbdcbcde7c45 100644
--- a/pkgs/development/tools/continuous-integration/fly/default.nix
+++ b/pkgs/development/tools/continuous-integration/fly/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "fly";
-  version = "7.9.0";
+  version = "7.9.1";
 
   src = fetchFromGitHub {
     owner = "concourse";
     repo = "concourse";
     rev = "v${version}";
-    sha256 = "sha256-YatN0VG3oEUK+vzJzthRnX+EkvUgKq2uIunAoPMoRag=";
+    sha256 = "sha256-ySyarky92+VSo/KzQFrWeh35KDMTQDV34F5iFrARHJs=";
   };
 
-  vendorSha256 = "sha256-nX0r/7V+rgJb3/9O91QskYzBpWXIca7m3Do1QtGuHgg=";
+  vendorHash = "sha256-Oy1wP82ZhdpGHs/gpfdveOK/jI9yuo0D3JtxjLg+W/w=";
 
   subPackages = [ "fly" ];
 
diff --git a/pkgs/development/tools/gci/default.nix b/pkgs/development/tools/gci/default.nix
index 170b9c41dc9f..0dfd153e2199 100644
--- a/pkgs/development/tools/gci/default.nix
+++ b/pkgs/development/tools/gci/default.nix
@@ -5,16 +5,16 @@
 }:
 buildGoModule rec {
   pname = "gci";
-  version = "0.9.0";
+  version = "0.9.1";
 
   src = fetchFromGitHub {
     owner = "daixiang0";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-qWEEcIbTgYmGVnnTW+hM8e8nw5VLWN1TwzdUIZrxF3s=";
+    sha256 = "sha256-VbN4lRK+6stOApMEdtX32JhKGkCSrafMJbizpWmHRXA=";
   };
 
-  vendorSha256 = "sha256-dlt+i/pEP3RzW4JwndKTU7my2Nn7/2rLFlk8n1sFR60=";
+  vendorHash = "sha256-dlt+i/pEP3RzW4JwndKTU7my2Nn7/2rLFlk8n1sFR60=";
 
   meta = with lib; {
     description = "Controls golang package import order and makes it always deterministic";
diff --git a/pkgs/development/tools/kustomize/kustomize-sops.nix b/pkgs/development/tools/kustomize/kustomize-sops.nix
index 28c80444650d..6136c5b6cb22 100644
--- a/pkgs/development/tools/kustomize/kustomize-sops.nix
+++ b/pkgs/development/tools/kustomize/kustomize-sops.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "kustomize-sops";
-  version = "4.0.0";
+  version = "4.1.0";
 
   src = fetchFromGitHub {
     owner = "viaduct-ai";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-8CZcPZLainc7iRZ5Ul27QxW3oK7sikCjzCBEkfCeNUc=";
+    sha256 = "sha256-piCsae2B+FC+wi/vCCtPY76O4eMXJeNufFo31QkHCAU=";
   };
 
-  vendorHash = "sha256-GBjMN6pyB+48e5LNqLBbh6a5fC9P0T53CZUPGNcbBDc=";
+  vendorHash = "sha256-vTP2wM7MqiSfP+3Gd0Ab5t0al5xL8rw3kl7bOT19zU4=";
 
   installPhase = ''
     mkdir -p $out/lib/viaduct.ai/v1/ksops-exec/
diff --git a/pkgs/development/tools/misc/circleci-cli/default.nix b/pkgs/development/tools/misc/circleci-cli/default.nix
index b657a9ded93e..741edcc74871 100644
--- a/pkgs/development/tools/misc/circleci-cli/default.nix
+++ b/pkgs/development/tools/misc/circleci-cli/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "circleci-cli";
-  version = "0.1.23334";
+  version = "0.1.23391";
 
   src = fetchFromGitHub {
     owner = "CircleCI-Public";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-1+PcjameB9/1MoyM0RAxrhuE649INyLlhgxA5xJQ9Pw=";
+    sha256 = "sha256-mTqrckoYbxtlwonXp6mtbXSpmVB3WfSXaOkyycBVjx0=";
   };
 
-  vendorHash = "sha256-E24b8PUA1Hy+OepQe2n6TecCMKKicdr5KUdiJ663Td0=";
+  vendorHash = "sha256-7k5jmXvNtxezialavNz8NM7esl2vpXcjRW2n/9GAycs=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/development/tools/misc/saleae-logic-2/default.nix b/pkgs/development/tools/misc/saleae-logic-2/default.nix
index 1c049eac7aa3..6eeb47df10ab 100644
--- a/pkgs/development/tools/misc/saleae-logic-2/default.nix
+++ b/pkgs/development/tools/misc/saleae-logic-2/default.nix
@@ -1,10 +1,10 @@
 { lib, fetchurl, makeDesktopItem, appimageTools }:
 let
   name = "saleae-logic-2";
-  version = "2.4.3";
+  version = "2.4.6";
   src = fetchurl {
     url = "https://downloads.saleae.com/logic2/Logic-${version}-master.AppImage";
-    hash = "sha256-xF87Q1K25/9pUYt660RY2RCIC6u2m2ArBQb2nWhiKvw=";
+    hash = "sha256-FYLjg4lzr8M22r4yoKfMIAx2HKGi2fcD28AaV1ChkLk=";
   };
   desktopItem = makeDesktopItem {
     inherit name;
diff --git a/pkgs/development/tools/picotool/default.nix b/pkgs/development/tools/picotool/default.nix
index f76e0287b564..ecd80d626049 100644
--- a/pkgs/development/tools/picotool/default.nix
+++ b/pkgs/development/tools/picotool/default.nix
@@ -2,25 +2,19 @@
 
 stdenv.mkDerivation rec {
   pname = "picotool";
-  version = "1.1.0";
+  version = "1.1.1";
 
   src = fetchFromGitHub {
     owner = "raspberrypi";
     repo = pname;
     rev = version;
-    sha256 = "sha256-YjDHoRcDoezyli42bJ0bnfjdNNY8l6ZilrxhOudqvwE=";
+    sha256 = "sha256-KP5Cq6pYKQI5dV6S4lLapu9EcwAgLgYpK0qreNDZink=";
   };
 
   buildInputs = [ libusb1 pico-sdk ];
   nativeBuildInputs = [ cmake pkg-config ];
   cmakeFlags = [ "-DPICO_SDK_PATH=${pico-sdk}/lib/pico-sdk" ];
 
-  installPhase = ''
-    runHook preInstall
-    install -Dm755 ./picotool -t $out/bin
-    runHook postInstall
-  '';
-
   meta = with lib; {
     homepage = "https://github.com/raspberrypi/picotool";
     description = "Tool for interacting with a RP2040 device in BOOTSEL mode, or with a RP2040 binary";
diff --git a/pkgs/os-specific/darwin/xcode/default.nix b/pkgs/os-specific/darwin/xcode/default.nix
index 6d1929ef982c..ec98a0b1cfb6 100644
--- a/pkgs/os-specific/darwin/xcode/default.nix
+++ b/pkgs/os-specific/darwin/xcode/default.nix
@@ -41,31 +41,44 @@ let requireXcode = version: sha256:
   in app.overrideAttrs ( oldAttrs: oldAttrs // { inherit meta; });
 
 in lib.makeExtensible (self: {
-  xcode_8_1 = requireXcode "8.1" "18xjvfipwzia66gm3r9p770xdd4r375vak7chw5vgqnv9yyjiq2n";
-  xcode_8_2 = requireXcode "8.2" "13nd1zsfqcp9hwp15hndr0rsbb8rgprrz7zr2ablj4697qca06m2";
-  xcode_9_1 = requireXcode "9.1" "0ab1403wy84ys3yn26fj78cazhpnslmh3nzzp1wxib3mr1afjvic";
-  xcode_9_2 = requireXcode "9.2" "1bgfgdp266cbbqf2axcflz92frzvhi0qw0jdkcw6r85kdpc8dj4c";
-  xcode_9_3 = requireXcode "9.3" "12m9kb4759s2ky42b1vf7y38qqxn2j99s99adzc6ljnmy26ii12w";
-  xcode_9_4 = requireXcode "9.4" "00az1cf9pm8zmvzs6yq04prdmxp8xi3ymxw94jjh4mh7hlbkhcb7";
-  xcode_9_4_1 = requireXcode "9.4.1" "0y9kphj86c14jl6aibv57sd7ln0w06vdhzm8ysp0s98rfgyq2lbw";
-  xcode_10_1 = requireXcode "10.1" "1ssdbg4v8r11fjf4jl38pwyry2aia1qihbxyxapz0v0n5gfnp05v";
-  xcode_10_2 = requireXcode "10.2" "1xzybl1gvb3q5qwlwchanzpws4sb70i3plf0vrzvlfdp2hsb3pg7";
-  xcode_10_2_1 = requireXcode "10.2.1" "11sdb54nr0x7kp987qq839x6k5gdx7vqdxjiy5xm5279n1n47bmg";
-  xcode_10_3 = requireXcode "10.3" "1i628vfn6zad81fsz3zpc6z15chhskvyp8qnajp2wnpzvrwl6ngb";
-  xcode_11 = requireXcode "11" "1r03j3kkp4blfp2kqpn538w3dx57ms930fj8apjkq6dk7fv3jcqh";
-  xcode_11_1 = requireXcode "11.1" "1c2gzc4jhhx5a7ncg19sh1r99izhipybaqxl1ll52x5y8689awc1";
-  xcode_11_2 = requireXcode "11.2" "1lm3q8zpvm184246h5j9mw4c1y9kk9sxnr3j98kfm0312n0l98gj";
-  xcode_11_3 = requireXcode "11.3" "04rv6xlywy8xqfx9ma8ygsdw4yhckk2mq0qnklxnfly899iw4wza";
-  xcode_11_3_1 = requireXcode "11.3.1" "1p6nicj91kr6ad3rmycahd1i7z4hj7ccjs93ixsiximjzaahx3q4";
-  xcode_11_4 = requireXcode "11.4" "065rpb3rdk19nv3rwyf9bk32ccbd0lld12gj12l89cyg65mhpyy7";
-  xcode_11_5 = requireXcode "11.5" "1dizazq9nz1vjkc5gy7dd4x760mkfjiifk1hf6d9mscchdq8rfkw";
-  xcode_11_6 = requireXcode "11.6" "1y4fhw1kiphzxdb4wpv697z5r0algvaldwq5iqv266797rnfql4x";
-  xcode_11_7 = requireXcode "11.7" "0422rdc4j5qwyk59anbybxyfv0p26x0xryszm0wd8i44g66smlmj";
-  xcode_12 = requireXcode "12" "1w3xm268pyn5m04wv22invd5kr2k4jqllgrzapv6n1sxxynxrh8z";
-  xcode_12_0_1 = requireXcode "12.0.1" "1p6vd5ai0hh3cq6aflh4h21ar0shxnz8wlkaxwq7liwsdmkwzbl0";
-  xcode_12_1 = requireXcode "12.1" "1widy74dk43wx8iqgd7arzf6q4kzdmaz8pfwymzs8chnq9dqr3wp";
-  xcode_12_2 = requireXcode "12.2" "17i0wf4pwrxwfgjw7rpw9mcd59nkmys1k5h2rqsw81snzyxy9j0v";
-  xcode_12_3 = requireXcode "12.3" "0kwf1y4llysf1p0nsbqyzccn7d77my0ldagr5fi3by4k0xy3d189";
+  xcode_8_1 = requireXcode "8.1" "sha256-VuAovU/b4rcLh+xMtcsZmbTWwTk35VGfMSp+fqPbsqM=";
+  xcode_8_2 = requireXcode "8.2" "sha256-ohqgGD7JEEmXEvmfn/N9Ga2lM8jNwhIuh+ky7PQPzY4=";
+  xcode_9_1 = requireXcode "9.1" "sha256-LG7pVMh1rNh5uP/bASvV9sKvGDrSGWH90J4gzwcgYSk=";
+  xcode_9_2 = requireXcode "9.2" "sha256-jMiG2G2zoGw4m00CjkGE+2cn0qeOdSUcXosZI2577q0=";
+  xcode_9_3 = requireXcode "9.3" "sha256-XIQYjfDVSmrYbyolnZIUtmOMhj9uhyWIn0KncsiaqYo=";
+  xcode_9_4 = requireXcode "9.4" "sha256-ZzE4F4UHVgKlJIn36kfs6Pba8iUAe6P/rh/VmxwLXwE=";
+  xcode_9_4_1 = requireXcode "9.4.1" "sha256-fFGB/XMZJQ2u9qh+2LYBHFh6mj5lr6gMlSQwgyS8M3k=";
+  xcode_10_1 = requireXcode "10.1" "sha256-u4Br3SsWbPCv6r4vGHFQUQmfPb9oUEmcdCFktMlbTes=";
+  xcode_10_2 = requireXcode "10.2" "sha256-592xNBS3Obp/3sDROyI4SxPN77cKMk45Lnis/QJd/vc=";
+  xcode_10_2_1 = requireXcode "10.2.1" "sha256-r65DbLDpiFJ78VH2hvfp7ZVpehoI44PSnaeDbElZTYc=";
+  xcode_10_3 = requireXcode "10.3" "sha256-61lDed7/Wi6uVBaj6/fUELISvmH3j69dQE19Y91GwsQ=";
+  xcode_11 = requireXcode "11" "sha256-EDM5tjuzGTzlVUg6MJKup/Q2OBrFXjzFdXSRO+eQA+Q=";
+  xcode_11_1 = requireXcode "11.1" "sha256-gXGVkEG+dFEoDbRjtfyN8MeUcoA6hcfsUaVDKAn7T7A=";
+  xcode_11_2 = requireXcode "11.2" "sha256-8qFEgRVhgOomSnJk23WaM/nACK9JFmiIICjUfT/Co9I=";
+  xcode_11_3 = requireXcode "11.3" "sha256-6nPCY0rIU2c7nRYDXMWcDHrCm34eqZq6wx157mk3OxM=";
+  xcode_11_3_1 = requireXcode "11.3.1" "sha256-BI8Olfqyxh51jyNpydiRkPwTQ4OK+ZpHUybPkCSL1tw=";
+  xcode_11_4 = requireXcode "11.4" "sha256-x/sLazHPs4SoCPKJ0CgFbTEmxlzJeZ7HtinMlse6uRg=";
+  xcode_11_5 = requireXcode "11.5" "sha256-fLqMcIOM6ZqacTBMF6N0swJzOmnt+FfYlDt8m/BXP7Y=";
+  xcode_11_6 = requireXcode "11.6" "sha256-nVDsbD7pGCM2jgXzRtV+VIFc/klmX05W6x/eOAOHjvg=";
+  xcode_11_7 = requireXcode "11.7" "sha256-stKqjXmERNQ4qF/73EE34oLtfF9+WZXK9BwXSVjLQhA=";
+  xcode_12 = requireXcode "12" "sha256-H8Hcre9dB2v2VT8/SrEkU+RZ2rZRiM0JqMX6i4yoffA=";
+  xcode_12_0_1 = requireXcode "12.0.1" "sha256-gK7PZ22aR3ow72pSjr7tUIOsgoAEUqcMZgNCEFVp29w=";
+  xcode_12_1 = requireXcode "12.1" "sha256-l4+MW8IWMqR/9dxd9FVtfxJs3M/qtIcj6nyQ2cjxLfI=";
+  xcode_12_2 = requireXcode "12.2" "sha256-G8jku/9WB8Q1zgKWGbSv06bSWE385sPlc7xnfonjIJ4=";
+  xcode_12_3 = requireXcode "12.3" "sha256-CYU2fAeT+DWiK/mpRoGv57RjGfseL23BDU57SokPjk8=";
+  xcode_12_4 = requireXcode "12.4" "sha256-Qw4j+XFry85/AviHQVhjjjKLAfmRNNwMGN5G8FheJwQ=";
+  xcode_12_5 = requireXcode "12.5" "sha256-xiGffnV0P9Ojd6IrJSXILUX4oznPif7zm00WAksn3qU=";
+  xcode_12_5_1 = requireXcode "12.5.1" "sha256-zL0kS86ZzBkIrKLPKvWguDvXj9Tqbr7uR/VZaT/uZ9A=";
+  xcode_13 = requireXcode "13" "sha256-uTY6d5DBu4OOQLkxs3ExDfLXh50rE2LLlqtCbk3Qn6E=";
+  xcode_13_1 = requireXcode "13.1" "sha256-vd+4eFVaAyvXsdaExcfbDZSXOwkpt+rEbkBYSMjdUEA=";
+  xcode_13_2 = requireXcode "13.2" "sha256-guJXm/QnMfvUZwAcJwoy0QeO+DpDcUhs8AxVKvm9tYQ=";
+  xcode_13_2_1 = requireXcode "13.2.1" "sha256-r832Uu+Q8utK4zN0CtwiMCvMYT5HstWInyq4cNIaZJM=";
+  xcode_13_3 = requireXcode "13.3" "sha256-p2zaWMpmUeNHQtYOOaVdhCt3cgapvzL3l73/J+UwzCE=";
+  xcode_13_3_1 = requireXcode "13.3.1" "sha256-j71vpJVJpyj/IOlL+4+5lYgOlhf/zn+7ExIHbxL51cQ=";
+  xcode_13_4 = requireXcode "13.4" "sha256-IY1coss90GlBeJg/HQPMU8v2rOOxsqlY5q+2Qxe8nnY=";
+  xcode_13_4_1 = requireXcode "13.4.1" "sha256-Jk8fLgvnODoIhuVJqfV0KrpBBL40fRrHJbFmm44NRKE=";
+  xcode_14 = requireXcode "14" "sha256-E+wjPgQx/lbYAsauksdmGsygL5VPBA8R9pHB93eA7T0=";
+  xcode_14_1 = requireXcode "14.1" "sha256-QJGAUVIhuDYyzDNttBPv5lIGOfvkYqdOFSUAr5tlkfs=";
   xcode = self."xcode_${lib.replaceStrings ["."] ["_"] (if (stdenv.targetPlatform ? xcodeVer) then stdenv.targetPlatform.xcodeVer else "12.3")}";
 })
 
diff --git a/pkgs/os-specific/linux/dracut/default.nix b/pkgs/os-specific/linux/dracut/default.nix
index 583bd4115ac5..c6bf684f7fc8 100644
--- a/pkgs/os-specific/linux/dracut/default.nix
+++ b/pkgs/os-specific/linux/dracut/default.nix
@@ -10,24 +10,17 @@
 , bash
 , kmod
 , binutils
-, busybox
 , bzip2
 , coreutils
 , cpio
 , findutils
-, glibc
 , gnugrep
 , gnused
 , gnutar
 , gzip
-, kbd
-, lvm2
 , lz4
 , lzop
-, procps
-, rng-tools
 , squashfsTools
-, systemd
 , util-linux
 , xz
 , zstd
@@ -76,23 +69,16 @@ stdenv.mkDerivation rec {
     wrapProgram $out/bin/dracut --prefix PATH : ${lib.makeBinPath [
       coreutils
       util-linux
-    ]} --prefix DRACUT_PATH : ${lib.makeBinPath [
+    ]} --suffix DRACUT_PATH : ${lib.makeBinPath [
       bash
       binutils
       coreutils
       findutils
-      glibc
       gnugrep
       gnused
       gnutar
-      kbd
-      lvm2
-      procps
-      rng-tools
-      squashfsTools
-      systemd
+      stdenv.cc.libc  # for ldd command
       util-linux
-      busybox
     ]}
     wrapProgram $out/bin/dracut-catimages --set PATH ${lib.makeBinPath [
       coreutils
diff --git a/pkgs/servers/gemini/molly-brown/default.nix b/pkgs/servers/gemini/molly-brown/default.nix
index 354412a4b73f..351f54f21d49 100644
--- a/pkgs/servers/gemini/molly-brown/default.nix
+++ b/pkgs/servers/gemini/molly-brown/default.nix
@@ -1,19 +1,18 @@
-{ lib, buildGoPackage, fetchgit, nixosTests }:
+{ lib, buildGoModule, fetchgit, nixosTests }:
 
-buildGoPackage rec {
+buildGoModule rec {
   pname = "molly-brown";
-  version = "unstable-2020-08-19";
-  rev = "48f9a206c03c0470e1c132b9667c6daa3583dada";
-
-  goPackagePath = "tildegit.org/solderpunk/molly-brown";
+  version = "unstable-2023-02-10";
 
   src = fetchgit {
-    inherit rev;
     url = "https://tildegit.org/solderpunk/molly-brown.git";
-    sha256 = "1w79a25mbgav95p78fkdm9j62chwwpkqv0m2wmh5my03yq398gya";
+    rev = "56d8dde14abc90b784b7844602f12100af9756e0";
+    hash = "sha256-kfopRyCrDaiVjKYseyWacIT9MJ8PzB8LAs6YMgYqCrs=";
   };
 
-  goDeps = ./deps.nix;
+  vendorHash = "sha256-czfHnXS9tf5vQQNXhWH7DStmhsorSc4Di/yZuv4LHRk=";
+
+  ldflags = [ "-s" "-w" ];
 
   passthru.tests.basic = nixosTests.molly-brown;
 
diff --git a/pkgs/servers/gemini/molly-brown/deps.nix b/pkgs/servers/gemini/molly-brown/deps.nix
deleted file mode 100644
index 95427e8f7907..000000000000
--- a/pkgs/servers/gemini/molly-brown/deps.nix
+++ /dev/null
@@ -1,12 +0,0 @@
-# This file was generated by https://github.com/kamilchm/go2nix v1.3.0
-[
-  {
-    goPackagePath = "github.com/BurntSushi/toml";
-    fetch = {
-      type = "git";
-      url = "https://github.com/BurntSushi/toml";
-      rev = "3012a1dbe2e4bd1391d42b32f0577cb7bbc7f005";
-      sha256 = "1fjdwwfzyzllgiwydknf1pwjvy49qxfsczqx5gz3y0izs7as99j6";
-    };
-  }
-]
diff --git a/pkgs/servers/http/nginx/modules.nix b/pkgs/servers/http/nginx/modules.nix
index 971e04dcd365..d09c98ef2a20 100644
--- a/pkgs/servers/http/nginx/modules.nix
+++ b/pkgs/servers/http/nginx/modules.nix
@@ -351,8 +351,8 @@ let self = {
     name = "njs";
     src = fetchhg {
       url = "https://hg.nginx.org/njs";
-      rev = "0.7.8";
-      sha256 = "sha256-jsR8EOeW8tAo2utKznuUaCG4hK0oU0ZJSnnGmI5HUDk=";
+      rev = "0.7.10";
+      sha256 = "sha256-/yKzY+BUFxLk8bWo+mqKfRVRsC2moe+WvhaRYIGdr6Y=";
       name = "nginx-njs";
     };
 
diff --git a/pkgs/servers/pounce/default.nix b/pkgs/servers/pounce/default.nix
index e03d6e6827a1..7ad43825b151 100644
--- a/pkgs/servers/pounce/default.nix
+++ b/pkgs/servers/pounce/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "pounce";
-  version = "3.0";
+  version = "3.1";
 
   src = fetchzip {
     url = "https://git.causal.agency/pounce/snapshot/pounce-${version}.tar.gz";
-    sha256 = "17vmbfr7ika6kmq9jqa3rpd4cr71arapav7hlmggnj7a9yw5b9mg";
+    sha256 = "sha256-6PGiaU5sOwqO4V2PKJgIi3kI2jXsBOldEH51D7Sx9tg=";
   };
 
   buildInputs = [ libressl libxcrypt ];
diff --git a/pkgs/tools/admin/eksctl/default.nix b/pkgs/tools/admin/eksctl/default.nix
index ed9d9007a936..433b4240640d 100644
--- a/pkgs/tools/admin/eksctl/default.nix
+++ b/pkgs/tools/admin/eksctl/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "eksctl";
-  version = "0.128.0";
+  version = "0.129.0";
 
   src = fetchFromGitHub {
     owner = "weaveworks";
     repo = pname;
     rev = version;
-    sha256 = "sha256-CKtDj9Ht81i8EcpjHqluWfwkEU15a/TZd6N+jCSzIc8=";
+    sha256 = "sha256-p9haEozDc1ZTGar89Clm7eEFFLJCYcw+gBN40Zg5vi8=";
   };
 
-  vendorHash = "sha256-aSXj21JNqX/cc62oFqyedmvczmudcV7RhLyWrKsdOMQ=";
+  vendorHash = "sha256-Vb0sgOOIQI0rTJDITFoMbXJcnN7BondbFTm3AF1JTLo=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/admin/trivy/default.nix b/pkgs/tools/admin/trivy/default.nix
index e68b565d0581..ca0f9a961a15 100644
--- a/pkgs/tools/admin/trivy/default.nix
+++ b/pkgs/tools/admin/trivy/default.nix
@@ -5,17 +5,17 @@
 
 buildGoModule rec {
   pname = "trivy";
-  version = "0.37.1";
+  version = "0.37.2";
 
   src = fetchFromGitHub {
     owner = "aquasecurity";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-4kjsNaiXnmJk88ivVnpTemOOc/asKrcZLGpO8gtV0J8=";
+    sha256 = "sha256-k5S0ttOhI+vjiGJpIPVi9ro6n3f2Cxe7HiADvs14Zuo=";
   };
   # hash missmatch on across linux and darwin
   proxyVendor = true;
-  vendorSha256 = "sha256-qI29Qb8im9Xii83ayG1jZtZsrsAT0JQOcuKOM7VYro0=";
+  vendorSha256 = "sha256-EJw5DxiBF+gw5X+vqrnZsNCm2umOHEq6GeQ5V/Z0DrE=";
 
   excludedPackages = "misc";
 
diff --git a/pkgs/tools/cd-dvd/vobsub2srt/default.nix b/pkgs/tools/cd-dvd/vobsub2srt/default.nix
index 2d764d2f7da0..612f4ebf04d8 100644
--- a/pkgs/tools/cd-dvd/vobsub2srt/default.nix
+++ b/pkgs/tools/cd-dvd/vobsub2srt/default.nix
@@ -11,6 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-i6V2Owb8GcTcWowgb/BmdupOSFsYiCF2SbC9hXa26uY=";
   };
 
+  NIX_CFLAGS_COMPILE = lib.optionals stdenv.cc.isGNU [ "-std=c++11" ];
+
   nativeBuildInputs = [ cmake pkg-config ];
   buildInputs = [ libtiff ];
   propagatedBuildInputs = [ tesseract ];
diff --git a/pkgs/tools/filesystems/httm/default.nix b/pkgs/tools/filesystems/httm/default.nix
index 5a917602c43b..e1edac0c6104 100644
--- a/pkgs/tools/filesystems/httm/default.nix
+++ b/pkgs/tools/filesystems/httm/default.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "httm";
-  version = "0.20.5";
+  version = "0.21.1";
 
   src = fetchFromGitHub {
     owner = "kimono-koans";
     repo = pname;
     rev = version;
-    sha256 = "sha256-8SizRNjA+lvp8ZD14SoRcymhYmJXlwoeZQjrekIbdL4=";
+    sha256 = "sha256-uSCFm6aWNPFPcja+KB6TU7iVVYkDdD82pFjA9dOpSs8=";
   };
 
-  cargoHash = "sha256-tXV1G0qWN0jLOKlnZfHHlOZw+wUItLzQtSg4o2f96u0=";
+  cargoHash = "sha256-uxtZ+aUUhfWGCLysOcWi5En1eRui8Ja+nyD3S2WEWQM=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/graphics/jbig2enc/53ce5fe7e73d7ed95c9e12b52dd4984723f865fa.patch b/pkgs/tools/graphics/jbig2enc/53ce5fe7e73d7ed95c9e12b52dd4984723f865fa.patch
deleted file mode 100644
index 13e18fd04476..000000000000
--- a/pkgs/tools/graphics/jbig2enc/53ce5fe7e73d7ed95c9e12b52dd4984723f865fa.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-From 53ce5fe7e73d7ed95c9e12b52dd4984723f865fa Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Zdenko=20Podobn=C3=BD?= <zdenop@gmail.com>
-Date: Sun, 6 Apr 2014 21:25:27 +0200
-Subject: [PATCH] fix build with leptonica 1.70
-
----
- configure.ac |  1 +
- src/jbig2.cc | 13 +++++++++----
- 2 files changed, 10 insertions(+), 4 deletions(-)
-
-diff --git a/configure.ac b/configure.ac
-index fe37c22..753a607 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -55,6 +55,7 @@ AC_CHECK_LIB([lept], [findFileFormatStream], [], [
-			echo "Error! Leptonica not detected."
-			exit -1
-			])
-+AC_CHECK_FUNCS(expandBinaryPower2Low,,)
- # test for function - it should detect leptonica dependecies
-
- # Check for possible dependancies of leptonica.
-diff --git a/src/jbig2.cc b/src/jbig2.cc
-index e10f042..515c1ef 100644
---- a/src/jbig2.cc
-+++ b/src/jbig2.cc
-@@ -130,11 +130,16 @@ segment_image(PIX *pixb, PIX *piximg) {
-   // input color image, so we have to do it this way...
-   // is there a better way?
-   // PIX *pixd = pixExpandBinary(pixd4, 4);
--  PIX *pixd = pixCreate(piximg->w, piximg->h, 1);
--  pixCopyResolution(pixd, piximg);
--  if (verbose) pixInfo(pixd, "mask image: ");
--  expandBinaryPower2Low(pixd->data, pixd->w, pixd->h, pixd->wpl,
-+  PIX *pixd;
-+#ifdef HAVE_EXPANDBINARYPOWER2LOW
-+    pixd = pixCreate(piximg->w, piximg->h, 1);
-+    pixCopyResolution(pixd, piximg);
-+    expandBinaryPower2Low(pixd->data, pixd->w, pixd->h, pixd->wpl,
-                         pixd4->data, pixd4->w, pixd4->h, pixd4->wpl, 4);
-+#else
-+    pixd = pixExpandBinaryPower2(pixd4, 4);
-+#endif
-+  if (verbose) pixInfo(pixd, "mask image: ");
-
-   pixDestroy(&pixd4);
-   pixDestroy(&pixsf4);
diff --git a/pkgs/tools/graphics/jbig2enc/default.nix b/pkgs/tools/graphics/jbig2enc/default.nix
deleted file mode 100644
index ea5008dcf5cb..000000000000
--- a/pkgs/tools/graphics/jbig2enc/default.nix
+++ /dev/null
@@ -1,35 +0,0 @@
-{ lib, stdenv, fetchFromGitHub, leptonica, zlib, libwebp, giflib, libjpeg, libpng, libtiff }:
-
-stdenv.mkDerivation rec {
-  pname = "jbig2enc";
-  version = "0.28";
-
-  src = fetchFromGitHub {
-    owner = "agl";
-    repo = "jbig2enc";
-    rev = "${version}-dist";
-    hash = "sha256-Y3IVTjvO5tqn/O076y/llnTyenKpbx1WyT/JFZ/s0VY=";
-  };
-
-  propagatedBuildInputs = [ leptonica zlib libwebp giflib libjpeg libpng libtiff ];
-
-  patches = [
-    # https://github.com/agl/jbig2enc/commit/53ce5fe7e73d7ed95c9e12b52dd4984723f865fa
-    ./53ce5fe7e73d7ed95c9e12b52dd4984723f865fa.patch
-  ];
-
-  # This is necessary, because the resulting library has
-  # /tmp/nix-build-jbig2enc/src/.libs before /nix/store/jbig2enc/lib
-  # in its rpath, which means that patchelf --shrink-rpath removes
-  # the /nix/store one.  By cleaning up before fixup, we ensure that
-  # the /tmp/nix-build-jbig2enc/src/.libs directory is gone.
-  preFixup = ''
-    make clean
-  '';
-
-  meta = {
-    description = "Encoder for the JBIG2 image compression format";
-    license = lib.licenses.asl20;
-    platforms = lib.platforms.all;
-  };
-}
diff --git a/pkgs/tools/misc/boxxy/default.nix b/pkgs/tools/misc/boxxy/default.nix
new file mode 100644
index 000000000000..faadff736577
--- /dev/null
+++ b/pkgs/tools/misc/boxxy/default.nix
@@ -0,0 +1,26 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "boxxy";
+  version = "0.2.7";
+
+  src = fetchFromGitHub {
+    owner = "queer";
+    repo = "boxxy";
+    rev = "v${version}";
+    hash = "sha256-mvSarA0rZuOQvgf2NJXWIWoeZtvb+D/GofAHPKQDH6U=";
+  };
+
+  cargoHash = "sha256-Psc9qErqi3aangNowXxhkEXphFCR7pp+DKTKtk6tMo0=";
+
+  meta = with lib; {
+    description = "Puts bad Linux applications in a box with only their files";
+    homepage = "https://github.com/queer/boxxy";
+    license = licenses.mit;
+    maintainers = with maintainers; [ dit7ya ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/tools/misc/steampipe/default.nix b/pkgs/tools/misc/steampipe/default.nix
index 7ef202202c19..6d9ff83d75ff 100644
--- a/pkgs/tools/misc/steampipe/default.nix
+++ b/pkgs/tools/misc/steampipe/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "steampipe";
-  version = "0.18.4";
+  version = "0.18.5";
 
   src = fetchFromGitHub {
     owner = "turbot";
     repo = "steampipe";
     rev = "v${version}";
-    sha256 = "sha256-sCnKnBxZuueH8XgXPqCLrJvS4zUbraz3mZr/2Xn+7YU=";
+    sha256 = "sha256-Y/Nn2jAkz135HxRNpeotoPRvyexG9QgtvIcTdXsj034=";
   };
 
   vendorHash = "sha256-W30f7QYgm+QyLDJICpjMn7mtUIziTR1igThEbv+Aa7M=";
diff --git a/pkgs/tools/networking/frp/default.nix b/pkgs/tools/networking/frp/default.nix
index 4d6c54564bb2..030de9840fe3 100644
--- a/pkgs/tools/networking/frp/default.nix
+++ b/pkgs/tools/networking/frp/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "frp";
-  version = "0.46.1";
+  version = "0.47.0";
 
   src = fetchFromGitHub {
     owner = "fatedier";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-/itziNmIDIuj3sKpB+SEiiwvJqdH5nmTkpFdMSY5L0g=";
+    sha256 = "sha256-S2qccDzS+Kj1tEAUR4a0G/4Eu3DAF7lY7ffxU6aykVU=";
   };
 
-  vendorHash = "sha256-dU9rhYgYgP1qTPR3ykUgyg+B1bBVJwizWooyCpdpnm0=";
+  vendorHash = "sha256-ffkXNE3LkgdCGfO6K9lGxEMxT/9Q1o0m3BMtu6tDHdk=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/networking/grpc_cli/default.nix b/pkgs/tools/networking/grpc_cli/default.nix
new file mode 100644
index 000000000000..b68ff100b70b
--- /dev/null
+++ b/pkgs/tools/networking/grpc_cli/default.nix
@@ -0,0 +1,31 @@
+{ lib, stdenv, fetchFromGitHub, automake, cmake, autoconf, curl, numactl }:
+
+stdenv.mkDerivation rec {
+  pname = "grpc_cli";
+  version = "1.46.6";
+  src = fetchFromGitHub {
+    owner = "grpc";
+    repo = "grpc";
+    rev = "v${version}";
+    hash = "sha256-UPenQh6+FBryQiOoeijsXkCZjlMzYljkg2aUtSFJFL4=";
+    fetchSubmodules = true;
+  };
+  nativeBuildInputs = [ automake cmake autoconf ];
+  buildInputs = [ curl numactl ];
+  cmakeFlags = [ "-DgRPC_BUILD_TESTS=ON" ];
+  makeFlags = [ "grpc_cli" ];
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm555 grpc_cli "$out/bin/grpc_cli"
+
+    runHook postInstall
+  '';
+  meta = with lib; {
+    description = "The command line tool for interacting with grpc services.";
+    homepage = "https://github.com/grpc/grpc";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ doriath ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
diff --git a/pkgs/tools/networking/snowflake/default.nix b/pkgs/tools/networking/snowflake/default.nix
index 999d30bd9293..908166bb1542 100644
--- a/pkgs/tools/networking/snowflake/default.nix
+++ b/pkgs/tools/networking/snowflake/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "snowflake";
-  version = "2.5.0";
+  version = "2.5.1";
 
   src = fetchFromGitLab {
     domain = "gitlab.torproject.org";
@@ -10,10 +10,10 @@ buildGoModule rec {
     owner = "anti-censorship/pluggable-transports";
     repo = "snowflake";
     rev = "v${version}";
-    sha256 = "sha256-7iwRbik3hUj6Zv3tqLKqhGUIag6OnWRhpWqW6NTI+FU=";
+    sha256 = "sha256-r2NRIb6qbA1B5HlVNRqa9ongQpyiyPskhembPHX3Lgc=";
   };
 
-  vendorHash = "sha256-wHLYVf8QurMbmdLNkTFGgmncOJlJHZF8PwYTUniXOGY=";
+  vendorHash = "sha256-dnfm4KiVD89bnHV7bfw5aXWHGdcH9JBdrtvuS6s8N5w=";
 
   meta = with lib; {
     description = "System to defeat internet censorship";
diff --git a/pkgs/tools/package-management/nfpm/default.nix b/pkgs/tools/package-management/nfpm/default.nix
index 2d028a0e631e..5dc3859de56f 100644
--- a/pkgs/tools/package-management/nfpm/default.nix
+++ b/pkgs/tools/package-management/nfpm/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "nfpm";
-  version = "2.25.0";
+  version = "2.25.1";
 
   src = fetchFromGitHub {
     owner = "goreleaser";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Mu0/mWkdrhaybI0iAB/MuD7UTbDDC73ZMxr8kU7R23I=";
+    sha256 = "sha256-J5vAvF22NKMvvaftfVugWYAP6uM6pcyKEPqRDf+J9A4=";
   };
 
-  vendorHash = "sha256-YDV816jTLAqbSjiKXvbkwPbPCLPplH+NFN1SCVjWcbk=";
+  vendorHash = "sha256-GaESwr7rvDvjQ7zi/LbndiB2lQGmIELTx7wAJitj5kw=";
 
   ldflags = [ "-s" "-w" "-X main.version=${version}" ];
 
diff --git a/pkgs/tools/security/erosmb/default.nix b/pkgs/tools/security/erosmb/default.nix
index 90165b658164..b7984feac513 100644
--- a/pkgs/tools/security/erosmb/default.nix
+++ b/pkgs/tools/security/erosmb/default.nix
@@ -5,14 +5,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "erosmb";
-  version = "0.1.4";
+  version = "0.1.5";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "viktor02";
     repo = "EroSmb";
     rev = "refs/tags/v${version}";
-    hash = "sha256-ThJwBKpxoTwHP84OlVKH62gQ3kfv83J8HNs5Mizi8Ck=";
+    hash = "sha256-9Zs5Z+3JiBiJkV9Ixl5pPmLv0dUT59CT0UkQDsmneWc=";
   };
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/tools/system/ddrescue/default.nix b/pkgs/tools/system/ddrescue/default.nix
index 829d249da5b0..d18225a93b9b 100644
--- a/pkgs/tools/system/ddrescue/default.nix
+++ b/pkgs/tools/system/ddrescue/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ddrescue";
-  version = "1.26";
+  version = "1.27";
 
   src = fetchurl {
     url = "mirror://gnu/ddrescue/ddrescue-${version}.tar.lz";
-    sha256 = "sha256-5RPNOpDZgQ392RGX1AqkD23wFZe/tez9+yBd4RJ8VR8=";
+    sha256 = "sha256-OMgMmMWkTxXlNmPkUQCX/WjW7CB1jv3zqSUDfBgyMus=";
   };
 
   nativeBuildInputs = [ lzip ];
diff --git a/pkgs/tools/system/kanata/default.nix b/pkgs/tools/system/kanata/default.nix
index 2ef4d13c366b..d9b1bc06b205 100644
--- a/pkgs/tools/system/kanata/default.nix
+++ b/pkgs/tools/system/kanata/default.nix
@@ -1,4 +1,5 @@
 { fetchFromGitHub
+, fetchpatch
 , lib
 , rustPlatform
 , withCmd ? false
@@ -6,16 +7,24 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "kanata";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "jtroo";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-/v3P5C0F/FVPJqJ38dzSnAc7ua2fOs3BeX9BDoQ8bDw=";
+    sha256 = "sha256-mQSbsJ+3mKoDMg0ewwR7UvXUq+5WA9aTPKWCaTz8nDE=";
   };
 
-  cargoHash = "sha256-KXsW0fgbBy0tf/He0vH9Xq8yGuz77H/jeIabgw3ppy8=";
+  cargoHash = "sha256-Pu96OGfnXNaIse/IcwFJWxGMlKOVhZ6DtvgXJkHh+Ao=";
+
+  cargoPatches = [
+    (fetchpatch {
+      name = "serialize-cfg-parsing-tests-for-1.2.0.patch";
+      url = "https://github.com/jtroo/kanata/commit/9ef1e80fbcb40402262e08bd9196d000f73f686d.patch";
+      hash = "sha256-/FhyaYx4usDjGoVfRktf9dtwjY4oXdMQKqxLz00/NPY=";
+    })
+  ];
 
   buildFeatures = lib.optional withCmd "cmd";
 
diff --git a/pkgs/tools/text/dos2unix/default.nix b/pkgs/tools/text/dos2unix/default.nix
index 6a0c5fc57ee9..c6c92b876ffa 100644
--- a/pkgs/tools/text/dos2unix/default.nix
+++ b/pkgs/tools/text/dos2unix/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "dos2unix";
-  version = "7.4.3";
+  version = "7.4.4";
 
   src = fetchurl {
     url = "https://waterlan.home.xs4all.nl/dos2unix/${pname}-${version}.tar.gz";
-    sha256 = "sha256-to20GVba+TOChCOqMFEOAMEtKe9ZFucV6NTmlP5mynI=";
+    sha256 = "sha256-KKhB2wvVgn1kXKup2AFeOnGYPcbjmAcLUofuE3rkQ24=";
   };
 
   nativeBuildInputs = [ perl gettext ];
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index f7bcda734bb4..4ba900547a76 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -380,6 +380,7 @@ mapAliases ({
   docker_compose = throw "'docker_compose' has been renamed to/replaced by 'docker-compose'"; # Converted to throw 2022-02-22
   docker-compose_2 = throw "'docker-compose_2' has been renamed to 'docker-compose'"; # Added 2022-06-05
   docker-edge = throw "'docker-edge' has been removed, it was an alias for 'docker'"; # Added 2022-06-05
+  dolphin-emu-beta = dolphin-emu; # Added 2023-02-11
   dolphinEmu = dolphin-emu; # Added 2021-11-10
   dolphinEmuMaster = dolphin-emu-beta; # Added 2021-11-10
   dot-http = throw "'dot-http' has been removed: abandoned by upstream. Use hurl instead."; # Added 2023-01-16
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 0087b58e2f98..6a5611535d82 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2278,9 +2278,7 @@ with pkgs;
 
   ### APPLICATIONS/EMULATORS/DOLPHIN-EMU
 
-  dolphin-emu = callPackage ../applications/emulators/dolphin-emu { };
-
-  dolphin-emu-beta = qt6Packages.callPackage ../applications/emulators/dolphin-emu/master.nix {
+  dolphin-emu = qt6Packages.callPackage ../applications/emulators/dolphin-emu {
     inherit (darwin.apple_sdk_11_0.frameworks) CoreBluetooth ForceFeedback IOKit OpenGL VideoToolbox;
     inherit (darwin) moltenvk;
     stdenv =
@@ -2858,6 +2856,8 @@ with pkgs;
 
   boxes = callPackage ../tools/text/boxes { };
 
+  boxxy = callPackage ../tools/misc/boxxy { };
+
   boundary = callPackage ../tools/networking/boundary { };
 
   chamber = callPackage ../tools/admin/chamber {  };
@@ -7733,6 +7733,8 @@ with pkgs;
 
   gnucap = callPackage ../applications/science/electronics/gnucap { };
 
+  gnu-cim = callPackage ../development/compilers/gnu-cim { };
+
   gnu-cobol = callPackage ../development/compilers/gnu-cobol { };
 
   gnuclad = callPackage ../applications/graphics/gnuclad { };
@@ -7941,6 +7943,8 @@ with pkgs;
 
   grpcurl = callPackage ../tools/networking/grpcurl { };
 
+  grpc_cli = callPackage ../tools/networking/grpc_cli { };
+
   grpc-gateway = callPackage ../development/tools/grpc-gateway { };
 
   grpcui = callPackage ../tools/networking/grpcui { };
@@ -9783,7 +9787,13 @@ with pkgs;
     pythonPackages = python3Packages;
   };
 
-  mirakurun = callPackage ../applications/video/mirakurun { };
+  mirakurun = callPackage ../applications/video/mirakurun {
+    yarn = yarn.override { nodejs = nodejs-16_x; };
+    inherit (callPackage ../development/tools/yarn2nix-moretea/yarn2nix {
+      nodejs = nodejs-16_x;
+      yarn = yarn.override { nodejs = nodejs-16_x; };
+    }) mkYarnPackage;
+  };
 
   miredo = callPackage ../tools/networking/miredo { };
 
@@ -10795,8 +10805,6 @@ with pkgs;
 
   pdf-quench = callPackage ../applications/misc/pdf-quench { };
 
-  jbig2enc = callPackage ../tools/graphics/jbig2enc { };
-
   pdfarranger = callPackage ../applications/misc/pdfarranger { };
 
   briss = callPackage ../tools/graphics/briss { };
@@ -20501,6 +20509,8 @@ with pkgs;
 
   jbig2dec = callPackage ../development/libraries/jbig2dec { };
 
+  jbig2enc = callPackage ../development/libraries/jbig2enc { };
+
   jcal = callPackage ../development/libraries/jcal { };
 
   jbigkit = callPackage ../development/libraries/jbigkit { };
@@ -32091,9 +32101,7 @@ with pkgs;
 
   pavucontrol = callPackage ../applications/audio/pavucontrol { };
 
-  paraview = libsForQt5.callPackage ../applications/graphics/paraview {
-    python3 = python39;
-  };
+  paraview = libsForQt5.callPackage ../applications/graphics/paraview { };
 
   parlatype = callPackage ../applications/audio/parlatype { };
 
diff --git a/pkgs/top-level/darwin-packages.nix b/pkgs/top-level/darwin-packages.nix
index 4ee606ae5e76..9233eb5b7bc5 100644
--- a/pkgs/top-level/darwin-packages.nix
+++ b/pkgs/top-level/darwin-packages.nix
@@ -182,9 +182,12 @@ impure-cmds // appleSourcePackages // chooseLibs // {
 
   inherit (pkgs.callPackages ../os-specific/darwin/xcode { })
     xcode_8_1 xcode_8_2
-    xcode_9_1 xcode_9_2 xcode_9_4 xcode_9_4_1
-    xcode_10_2 xcode_10_2_1 xcode_10_3
-    xcode_11
+    xcode_9_1 xcode_9_2 xcode_9_3 xcode_9_4 xcode_9_4_1
+    xcode_10_1 xcode_10_2 xcode_10_2_1 xcode_10_3
+    xcode_11 xcode_11_1 xcode_11_2 xcode_11_3_1 xcode_11_4 xcode_11_5 xcode_11_6 xcode_11_7
+    xcode_12 xcode_12_0_1 xcode_12_1 xcode_12_2 xcode_12_3 xcode_12_4 xcode_12_5 xcode_12_5_1
+    xcode_13 xcode_13_1 xcode_13_2 xcode_13_3 xcode_13_3_1 xcode_13_4 xcode_13_4_1
+    xcode_14 xcode_14_1
     xcode;
 
   CoreSymbolication = callPackage ../os-specific/darwin/CoreSymbolication { };
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 04da6d141ee9..542d8414f912 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -156,6 +156,7 @@ mapAliases ({
   pycallgraph = throw "pycallgraph has been removed, it was using setuptools 2to3 translation feature, which has been removed in setuptools 58"; # added 2022-01-18
   pychef = throw "pychef has been removed because it's been archived upstream and abandoned since 2017."; # added 2022-11-14
   pycryptodome-test-vectors = throw "pycryptodome-test-vectors has been removed because it is an internal package to pycryptodome"; # added 2022-05-28
+  pyflunearyou = pyoutbreaksnearme; # added 2023-02-11
   pyialarmxr = pyialarmxr-homeassistant; # added 2022-06-07
   pyialarmxr-homeassistant = throw "The package was removed together with the component support in home-assistant 2022.7.0"; # added 2022-07-07
   PyICU = pyicu; # Added 2022-12-22
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 3710c88a2f6a..b5f87726d81e 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -853,6 +853,8 @@ self: super: with self; {
 
   awslambdaric = callPackage ../development/python-modules/awslambdaric { };
 
+  awswrangler = callPackage ../development/python-modules/awswrangler { };
+
   axis = callPackage ../development/python-modules/axis { };
 
   azure-appconfiguration = callPackage ../development/python-modules/azure-appconfiguration { };
@@ -7267,6 +7269,8 @@ self: super: with self; {
 
   pyorthanc = callPackage ../development/python-modules/pyorthanc { };
 
+  pyoutbreaksnearme = callPackage ../development/python-modules/pyoutbreaksnearme { };
+
   pyoverkiz = callPackage ../development/python-modules/pyoverkiz { };
 
   pyownet = callPackage ../development/python-modules/pyownet { };
@@ -8059,8 +8063,6 @@ self: super: with self; {
 
   pyflume = callPackage ../development/python-modules/pyflume { };
 
-  pyflunearyou = callPackage ../development/python-modules/pyflunearyou { };
-
   pyfma = callPackage ../development/python-modules/pyfma { };
 
   pyfribidi = callPackage ../development/python-modules/pyfribidi { };
@@ -9943,6 +9945,8 @@ self: super: with self; {
 
   remote-pdb = callPackage ../development/python-modules/remote-pdb { };
 
+  remotezip = callPackage ../development/python-modules/remotezip { };
+
   renault-api = callPackage ../development/python-modules/renault-api { };
 
   rencode = callPackage ../development/python-modules/rencode { };