diff --git a/doc/builders/fetchers.chapter.md b/doc/builders/fetchers.chapter.md
index 773eb3028ddb..551df86a58f4 100644
--- a/doc/builders/fetchers.chapter.md
+++ b/doc/builders/fetchers.chapter.md
@@ -163,3 +163,30 @@ or "hg"), `domain` and `fetchSubmodules`.
 If `fetchSubmodules` is `true`, `fetchFromSourcehut` uses `fetchgit`
 or `fetchhg` with `fetchSubmodules` or `fetchSubrepos` set to `true`,
 respectively. Otherwise, the fetcher uses `fetchzip`.
+
+## `requireFile` {#requirefile}
+
+`requireFile` allows requesting files that cannot be fetched automatically, but whose content is known.
+This is a useful last-resort workaround for license restrictions that prohibit redistribution, or for downloads that are only accessible after authenticating interactively in a browser.
+If the requested file is present in the Nix store, the resulting derivation will not be built, because its expected output is already available.
+Otherwise, the builder will run, but fail with a message explaining to the user how to provide the file. The following code, for example:
+
+```
+requireFile {
+  name = "jdk-${version}_linux-x64_bin.tar.gz";
+  url = "https://www.oracle.com/java/technologies/javase-jdk11-downloads.html";
+  sha256 = "94bd34f85ee38d3ef59e5289ec7450b9443b924c55625661fffe66b03f2c8de2";
+}
+```
+results in this error message:
+```
+***
+Unfortunately, we cannot download file jdk-11.0.10_linux-x64_bin.tar.gz automatically.
+Please go to https://www.oracle.com/java/technologies/javase-jdk11-downloads.html to download it yourself, and add it to the Nix store
+using either
+  nix-store --add-fixed sha256 jdk-11.0.10_linux-x64_bin.tar.gz
+or
+  nix-prefetch-url --type sha256 file:///path/to/jdk-11.0.10_linux-x64_bin.tar.gz
+
+***
+```
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 82916749f9a4..8a84b8f9786c 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -693,6 +693,15 @@
       fingerprint = "7FDB 17B3 C29B 5BA6 E5A9  8BB2 9FAA 63E0 9750 6D9D";
     }];
   };
+  Alper-Celik = {
+    email = "dev.alpercelik@gmail.com";
+    name = "Alper Çelik";
+    github = "Alper-Celik";
+    githubId = 110625473;
+    keys = [{
+      fingerprint = "6B69 19DD CEE0 FAF3 5C9F  2984 FA90 C0AB 738A B873";
+    }];
+  };
   almac = {
     email = "alma.cemerlic@gmail.com";
     github = "a1mac";
@@ -8930,8 +8939,8 @@
     githubId = 2914269;
     name = "Malo Bourgon";
   };
-  malvo = {
-    email = "malte@malvo.org";
+  malte-v = {
+    email = "nixpkgs@mal.tc";
     github = "malte-v";
     githubId = 34393802;
     name = "Malte Voos";
diff --git a/nixos/doc/manual/manpages/README.md b/nixos/doc/manual/manpages/README.md
index ed2682e5332d..9923f4823922 100644
--- a/nixos/doc/manual/manpages/README.md
+++ b/nixos/doc/manual/manpages/README.md
@@ -4,6 +4,8 @@ This is the collection of NixOS manpages, excluding `configuration.nix(5)`.
 
 Man pages are written in [`mdoc(7)` format](https://mandoc.bsd.lv/man/mdoc.7.html) and should be portable between mandoc and groff for rendering (though minor differences may occur, mandoc and groff seem to have slightly different spacing rules.)
 
+For previewing edited files, you can just run `man -l path/to/file.8` and you will see it rendered.
+
 Being written in `mdoc` these manpages use semantic markup. This file provides a guideline on where to apply which of the semantic elements of `mdoc`.
 
 ### Command lines and arguments
diff --git a/nixos/modules/programs/sway.nix b/nixos/modules/programs/sway.nix
index b0a766dd055f..3b2e69bd37c3 100644
--- a/nixos/modules/programs/sway.nix
+++ b/nixos/modules/programs/sway.nix
@@ -26,7 +26,7 @@ let
     };
   };
 
-  swayPackage = pkgs.sway.override {
+  defaultSwayPackage = pkgs.sway.override {
     extraSessionCommands = cfg.extraSessionCommands;
     extraOptions = cfg.extraOptions;
     withBaseWrapper = cfg.wrapperFeatures.base;
@@ -42,6 +42,19 @@ in {
       <https://github.com/swaywm/sway/wiki> and
       "man 5 sway" for more information'');
 
+    package = mkOption {
+      type = with types; nullOr package;
+      default = defaultSwayPackage;
+      defaultText = literalExpression "pkgs.sway";
+      description = lib.mdDoc ''
+        Sway package to use. Will override the options
+        'wrapperFeatures', 'extraSessionCommands', and 'extraOptions'.
+        Set to <code>null</code> to not add any Sway package to your
+        path. This should be done if you want to use the Home Manager Sway
+        module to install Sway.
+      '';
+    };
+
     wrapperFeatures = mkOption {
       type = wrapperOptions;
       default = { };
@@ -121,16 +134,17 @@ in {
       }
     ];
     environment = {
-      systemPackages = [ swayPackage ] ++ cfg.extraPackages;
+      systemPackages = optional (cfg.package != null) cfg.package ++ cfg.extraPackages;
       # Needed for the default wallpaper:
-      pathsToLink = [ "/share/backgrounds/sway" ];
+      pathsToLink = optionals (cfg.package != null) [ "/share/backgrounds/sway" ];
       etc = {
-        "sway/config".source = mkOptionDefault "${swayPackage}/etc/sway/config";
         "sway/config.d/nixos.conf".source = pkgs.writeText "nixos.conf" ''
           # Import the most important environment variables into the D-Bus and systemd
           # user environments (e.g. required for screen sharing and Pinentry prompts):
           exec dbus-update-activation-environment --systemd DISPLAY WAYLAND_DISPLAY SWAYSOCK XDG_CURRENT_DESKTOP
         '';
+      } // optionalAttrs (cfg.package != null) {
+        "sway/config".source = mkOptionDefault "${cfg.package}/etc/sway/config";
       };
     };
     security.polkit.enable = true;
@@ -139,7 +153,7 @@ in {
     fonts.enableDefaultFonts = mkDefault true;
     programs.dconf.enable = mkDefault true;
     # To make a Sway session available if a display manager like SDDM is enabled:
-    services.xserver.displayManager.sessionPackages = [ swayPackage ];
+    services.xserver.displayManager.sessionPackages = optionals (cfg.package != null) [ cfg.package ];
     programs.xwayland.enable = mkDefault true;
     # For screen sharing (this option only has an effect with xdg.portal.enable):
     xdg.portal.extraPortals = [ pkgs.xdg-desktop-portal-wlr ];
diff --git a/nixos/modules/services/networking/firefox-syncserver.nix b/nixos/modules/services/networking/firefox-syncserver.nix
index a06b9573a850..42924d7f6993 100644
--- a/nixos/modules/services/networking/firefox-syncserver.nix
+++ b/nixos/modules/services/networking/firefox-syncserver.nix
@@ -304,6 +304,10 @@ in
         forceSSL = cfg.singleNode.enableTLS;
         locations."/" = {
           proxyPass = "http://127.0.0.1:${toString cfg.settings.port}";
+          # We need to pass the Host header that matches the original Host header. Otherwise,
+          # Hawk authentication will fail (because it assumes that the client and server see
+          # the same value of the Host header).
+          recommendedProxySettings = true;
         };
       };
     };
diff --git a/nixos/modules/services/networking/soju.nix b/nixos/modules/services/networking/soju.nix
index d4c4ca47bc80..7f0ac3e3b8e6 100644
--- a/nixos/modules/services/networking/soju.nix
+++ b/nixos/modules/services/networking/soju.nix
@@ -120,5 +120,5 @@ in
     };
   };
 
-  meta.maintainers = with maintainers; [ malvo ];
+  meta.maintainers = with maintainers; [ malte-v ];
 }
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index a23a0413160e..7b1159d66715 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -414,7 +414,9 @@ in {
   mtp = handleTest ./mtp.nix {};
   multipass = handleTest ./multipass.nix {};
   mumble = handleTest ./mumble.nix {};
-  musescore = handleTest ./musescore.nix {};
+  # Fails on aarch64-linux at the PDF creation step - need to debug this on an
+  # aarch64 machine..
+  musescore = handleTestOn ["x86_64-linux"] ./musescore.nix {};
   munin = handleTest ./munin.nix {};
   mutableUsers = handleTest ./mutable-users.nix {};
   mxisd = handleTest ./mxisd.nix {};
diff --git a/nixos/tests/musescore.nix b/nixos/tests/musescore.nix
index ac2f4ba74c0f..6aeb0558a49d 100644
--- a/nixos/tests/musescore.nix
+++ b/nixos/tests/musescore.nix
@@ -2,13 +2,12 @@ import ./make-test-python.nix ({ pkgs, ...} :
 
 let
   # Make sure we don't have to go through the startup tutorial
-  customMuseScoreConfig = pkgs.writeText "MuseScore3.ini" ''
+  customMuseScoreConfig = pkgs.writeText "MuseScore4.ini" ''
     [application]
-    startup\firstStart=false
+    hasCompletedFirstLaunchSetup=true
 
-    [ui]
-    application\startup\showTours=false
-    application\startup\showStartCenter=false
+    [project]
+    preferredScoreCreationMode=1
     '';
 in
 {
@@ -40,51 +39,68 @@ in
     # Inject custom settings
     machine.succeed("mkdir -p /root/.config/MuseScore/")
     machine.succeed(
-        "cp ${customMuseScoreConfig} /root/.config/MuseScore/MuseScore3.ini"
+        "cp ${customMuseScoreConfig} /root/.config/MuseScore/MuseScore4.ini"
     )
 
     # Start MuseScore window
     machine.execute("DISPLAY=:0.0 mscore >&2 &")
 
     # Wait until MuseScore has launched
-    machine.wait_for_window("MuseScore")
+    machine.wait_for_window("MuseScore 4")
 
     # Wait until the window has completely initialised
-    machine.wait_for_text("MuseScore")
-
-    # Start entering notes
-    machine.send_key("n")
-    # Type the beginning of https://de.wikipedia.org/wiki/Alle_meine_Entchen
-    machine.send_chars("cdef6gg5aaaa7g")
-    # Make sure the VM catches up with all the keys
-    machine.sleep(1)
+    machine.wait_for_text("MuseScore 4")
 
     machine.screenshot("MuseScore0")
 
+    # Create a new score
+    machine.send_key("ctrl-n")
+
+    # Wait until the creation wizard appears
+    machine.wait_for_window("New score")
+
+    machine.screenshot("MuseScore1")
+
+    machine.send_key("tab")
+    machine.send_key("tab")
+    machine.send_key("tab")
+    machine.send_key("tab")
+    machine.send_key("right")
+    machine.send_key("right")
+    machine.send_key("ret")
+
+    machine.sleep(1)
+
+    # Type the beginning of https://de.wikipedia.org/wiki/Alle_meine_Entchen
+    machine.send_chars("cdef6gg5aaaa7g")
+    machine.sleep(1)
+
+    machine.screenshot("MuseScore2")
+
     # Go to the export dialogue and create a PDF
     machine.send_key("alt-f")
     machine.sleep(1)
     machine.send_key("e")
 
     # Wait until the export dialogue appears.
-    machine.wait_for_window("Export")
-    machine.screenshot("MuseScore1")
-    machine.send_key("shift-tab")
-    machine.sleep(1)
-    machine.send_key("shift-tab")
-    machine.sleep(1)
-    machine.send_key("ret")
-    machine.sleep(1)
-    machine.send_key("ret")
-
-    machine.screenshot("MuseScore2")
-
-    # Wait until PDF is exported
-    machine.wait_for_file("/root/Documents/MuseScore3/Scores/Untitled.pdf")
-
-    # Check that it contains the title of the score
-    machine.succeed("pdfgrep Title /root/Documents/MuseScore3/Scores/Untitled.pdf")
+    machine.wait_for_text("Export")
 
     machine.screenshot("MuseScore3")
+
+    machine.send_key("shift-tab")
+    machine.sleep(1)
+    machine.send_key("ret")
+    machine.sleep(1)
+    machine.send_key("ret")
+
+    machine.screenshot("MuseScore4")
+
+    # Wait until PDF is exported
+    machine.wait_for_file('"/root/Documents/MuseScore4/Scores/Untitled score.pdf"')
+
+    # Check that it contains the title of the score
+    machine.succeed('pdfgrep "Untitled score" "/root/Documents/MuseScore4/Scores/Untitled score.pdf"')
+
+    machine.screenshot("MuseScore5")
   '';
 })
diff --git a/nixos/tests/nextcloud/default.nix b/nixos/tests/nextcloud/default.nix
index 350486e8c733..b8d3ba75b51a 100644
--- a/nixos/tests/nextcloud/default.nix
+++ b/nixos/tests/nextcloud/default.nix
@@ -26,4 +26,4 @@ foldl
     };
   })
 { }
-  [ 24 25 26 ]
+  [ 24 25 ]
diff --git a/nixos/tests/vscodium.nix b/nixos/tests/vscodium.nix
index 37bb649889b4..3eda8b6cfb20 100644
--- a/nixos/tests/vscodium.nix
+++ b/nixos/tests/vscodium.nix
@@ -33,13 +33,6 @@ let
       };
       enableOCR = true;
 
-      # testScriptWithTypes:55: error: Item "function" of
-      # "Union[Callable[[Callable[..., Any]], ContextManager[Any]], ContextManager[Any]]"
-      # has no attribute "__enter__"
-      #     with codium_running:
-      #          ^
-      skipTypeCheck = true;
-
       testScript = ''
         @polling_condition
         def codium_running():
@@ -50,10 +43,10 @@ let
 
         machine.wait_for_unit('graphical.target')
 
-        codium_running.wait()
-        with codium_running:
+        codium_running.wait() # type: ignore[union-attr]
+        with codium_running: # type: ignore[union-attr]
             # Wait until vscodium is visible. "File" is in the menu bar.
-            machine.wait_for_text('Get Started')
+            machine.wait_for_text('Welcome')
             machine.screenshot('start_screen')
 
             test_string = 'testfile'
diff --git a/pkgs/applications/audio/musescore/darwin.nix b/pkgs/applications/audio/musescore/darwin.nix
index 88b5d3b74c15..652adb03b66a 100644
--- a/pkgs/applications/audio/musescore/darwin.nix
+++ b/pkgs/applications/audio/musescore/darwin.nix
@@ -1,8 +1,9 @@
 { stdenv, lib, fetchurl, undmg }:
 
 let
-  versionComponents = [ "3" "6" "2" "548020600" ];
+  versionComponents = [ "4" "0" "1" ];
   appName = "MuseScore ${builtins.head versionComponents}";
+  ref = "230121751";
 in
 
 stdenv.mkDerivation rec {
@@ -13,8 +14,8 @@ stdenv.mkDerivation rec {
   sourceRoot = "${appName}.app";
 
   src = fetchurl {
-    url = "https://github.com/musescore/MuseScore/releases/download/v${lib.concatStringsSep "." (lib.take 3 versionComponents)}/MuseScore-${version}.dmg";
-    sha256 = "sha256-lHckfhTTrDzaGwlbnZ5w0O1gMPbRmrmgATIGMY517l0=";
+    url =  "https://github.com/musescore/MuseScore/releases/download/v${version}/MuseScore-${version}.${ref}.dmg";
+    hash = "sha256-tkIEV+tCS0SYh2TlC70/zEBUEOSg//EaSKDGA7kH/vo=";
   };
 
   buildInputs = [ undmg ];
diff --git a/pkgs/applications/audio/musescore/default.nix b/pkgs/applications/audio/musescore/default.nix
index 573a78a92583..97f71a1b48f8 100644
--- a/pkgs/applications/audio/musescore/default.nix
+++ b/pkgs/applications/audio/musescore/default.nix
@@ -1,28 +1,35 @@
-{ mkDerivation, lib, fetchFromGitHub, cmake, pkg-config
+{ mkDerivation, lib, fetchFromGitHub, fetchpatch, cmake, pkg-config, ninja
 , alsa-lib, freetype, libjack2, lame, libogg, libpulseaudio, libsndfile, libvorbis
-, portaudio, portmidi, qtbase, qtdeclarative, qtgraphicaleffects
+, portaudio, portmidi, qtbase, qtdeclarative, qtgraphicaleffects, flac
 , qtquickcontrols2, qtscript, qtsvg, qttools
-, qtwebengine, qtxmlpatterns
+, qtwebengine, qtxmlpatterns, qtnetworkauth, qtx11extras
 , nixosTests
 }:
 
 mkDerivation rec {
   pname = "musescore";
-  version = "3.6.2";
+  version = "4.0.1";
 
   src = fetchFromGitHub {
     owner = "musescore";
     repo = "MuseScore";
     rev = "v${version}";
-    sha256 = "sha256-GBGAD/qdOhoNfDzI+O0EiKgeb86GFJxpci35T6tZ+2s=";
+    sha256 = "sha256-Xhjjm/pYcjfZE632eP2jujqUAmzdYNa81EPrvS5UKnQ=";
   };
-
   patches = [
-    ./remove_qtwebengine_install_hack.patch
+    # See https://github.com/musescore/MuseScore/issues/15571
+    (fetchpatch {
+      url = "https://github.com/musescore/MuseScore/commit/365be5dfb7296ebee4677cb74b67c1721bc2cf7b.patch";
+      hash = "sha256-tJ2M21i3geO9OsjUQKNatSXTkJ5U9qMT4RLNdJnyoKw=";
+    })
   ];
 
   cmakeFlags = [
     "-DMUSESCORE_BUILD_CONFIG=release"
+    # Disable the _usage_ of the `/bin/crashpad_handler` utility. See:
+    # https://github.com/musescore/MuseScore/pull/15577
+    "-DBUILD_CRASHPAD_CLIENT=OFF"
+    # Use our freetype
     "-DUSE_SYSTEM_FREETYPE=ON"
   ];
 
@@ -34,13 +41,13 @@ mkDerivation rec {
     "--set-default QT_QPA_PLATFORM xcb"
   ];
 
-  nativeBuildInputs = [ cmake pkg-config ];
+  nativeBuildInputs = [ cmake pkg-config ninja ];
 
   buildInputs = [
     alsa-lib libjack2 freetype lame libogg libpulseaudio libsndfile libvorbis
-    portaudio portmidi # tesseract
+    portaudio portmidi flac # tesseract
     qtbase qtdeclarative qtgraphicaleffects qtquickcontrols2
-    qtscript qtsvg qttools qtwebengine qtxmlpatterns
+    qtscript qtsvg qttools qtwebengine qtxmlpatterns qtnetworkauth qtx11extras
   ];
 
   passthru.tests = nixosTests.musescore;
@@ -48,8 +55,11 @@ mkDerivation rec {
   meta = with lib; {
     description = "Music notation and composition software";
     homepage = "https://musescore.org/";
-    license = licenses.gpl2;
+    license = licenses.gpl3Only;
     maintainers = with maintainers; [ vandenoever turion doronbehar ];
+    # Darwin requires CoreMIDI from SDK 11.3, we use the upstream built .dmg
+    # file in ./darwin.nix in the meantime.
     platforms = platforms.linux;
+    mainProgram = "mscore";
   };
 }
diff --git a/pkgs/applications/audio/musescore/remove_qtwebengine_install_hack.patch b/pkgs/applications/audio/musescore/remove_qtwebengine_install_hack.patch
deleted file mode 100644
index 57a6092d5852..000000000000
--- a/pkgs/applications/audio/musescore/remove_qtwebengine_install_hack.patch
+++ /dev/null
@@ -1,19 +0,0 @@
---- a/main/CMakeLists.txt
-+++ b/main/CMakeLists.txt
-@@ -220,16 +219,0 @@ else (MINGW)
--      ## install qwebengine core
--      if (NOT APPLE AND USE_WEBENGINE)
--         install(PROGRAMS
--            ${QT_INSTALL_LIBEXECS}/QtWebEngineProcess
--            DESTINATION bin
--            )
--         install(DIRECTORY
--            ${QT_INSTALL_DATA}/resources
--            DESTINATION lib/qt5
--            )
--         install(DIRECTORY
--            ${QT_INSTALL_TRANSLATIONS}/qtwebengine_locales
--            DESTINATION lib/qt5/translations
--            )
--      endif(NOT APPLE AND USE_WEBENGINE)
--
diff --git a/pkgs/applications/audio/praat/default.nix b/pkgs/applications/audio/praat/default.nix
index 519f59a1d89d..10eede334c46 100644
--- a/pkgs/applications/audio/praat/default.nix
+++ b/pkgs/applications/audio/praat/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "praat";
-  version = "6.3.05";
+  version = "6.3.06";
 
   src = fetchFromGitHub {
     owner = "praat";
     repo = "praat";
     rev = "v${version}";
-    sha256 = "sha256-0e225cmP0CSYjRYNEXi4Oqq9o8XR2N7bNS1X5x+mQKw=";
+    sha256 = "sha256-KwJ8ia1yQmmG+N44ipvGCbuoR2cL03STSTKzUwlDqms=";
   };
 
   configurePhase = ''
diff --git a/pkgs/applications/blockchains/stellar-core/default.nix b/pkgs/applications/blockchains/stellar-core/default.nix
index 8f3fd4b1c886..9d984803d219 100644
--- a/pkgs/applications/blockchains/stellar-core/default.nix
+++ b/pkgs/applications/blockchains/stellar-core/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "stellar-core";
-  version = "19.6.0";
+  version = "19.7.0";
 
   src = fetchFromGitHub {
     owner = "stellar";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-lDefmPZM8ow6t5CpNBxef+9BoT773p5UgeMhgF+em2w=";
+    sha256 = "sha256-VfaP4EIVsu5JTAV7AX0Ymo44/TD8eUB61CViwf6Hfqw=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/editors/vscode/generic.nix b/pkgs/applications/editors/vscode/generic.nix
index 1b4f4508fbf0..c2036566b384 100644
--- a/pkgs/applications/editors/vscode/generic.nix
+++ b/pkgs/applications/editors/vscode/generic.nix
@@ -135,6 +135,9 @@ let
 
       # this fixes bundled ripgrep
       chmod +x resources/app/node_modules/@vscode/ripgrep/bin/rg
+
+      # see https://github.com/gentoo/gentoo/commit/4da5959
+      chmod +x resources/app/node_modules/node-pty/build/Release/spawn-helper
     '';
 
     inherit meta;
diff --git a/pkgs/applications/editors/vscode/vscodium.nix b/pkgs/applications/editors/vscode/vscodium.nix
index 08219714061d..cd89ab7d783d 100644
--- a/pkgs/applications/editors/vscode/vscodium.nix
+++ b/pkgs/applications/editors/vscode/vscodium.nix
@@ -15,11 +15,11 @@ let
   archive_fmt = if stdenv.isDarwin then "zip" else "tar.gz";
 
   sha256 = {
-    x86_64-linux = "0mm6xa0kizgg2f6cql6jk8h83pn89h6q7rrs1kypvj3j0x6ysqsg";
-    x86_64-darwin = "1g9syvinj2mx292wrnrdn2znqhg17mrjqij0z1ilag5bi4xmzhcj";
-    aarch64-linux = "0xbq6fla0lxan08jgmsva91cbcv8rhzd7mqixrm1lsqh4h0wpssz";
-    aarch64-darwin = "1b4a56j256rib1997g9wwiak206axkppl124qg021vyab42x8rim";
-    armv7l-linux = "0gb96hi854kyh8694j9mbgl78f4y68czkwmjxhzb054l5b4adjla";
+    x86_64-linux = "1qayw19mb7f0gcgcvl57gpacrqsyx2jvc6s63vzbx8jmf5qnk71a";
+    x86_64-darwin = "02z9026kp66lx6pll46xx790jj7c7wh2ca7xim373x90k8hm4kwz";
+    aarch64-linux = "1izqhzvv46p05k1z2yg380ddwmar4w2pbrd0dyvkdysvp166y931";
+    aarch64-darwin = "1zcr653ssck4nc3vf04l6bilnjdsiqscw62g1wzbyk6s50133cx8";
+    armv7l-linux = "0n914rcfn2m9zsbnkd82cmw88qbpssv6jk3g8ig3wqlircbgrw0h";
   }.${system} or throwSystem;
 
   sourceRoot = if stdenv.isDarwin then "" else ".";
@@ -29,7 +29,7 @@ in
 
     # Please backport all compatible updates to the stable release.
     # This is important for the extension ecosystem.
-    version = "1.74.3.23010";
+    version = "1.75.0.23033";
     pname = "vscodium";
 
     executableName = "codium";
diff --git a/pkgs/applications/graphics/ImageMagick/default.nix b/pkgs/applications/graphics/ImageMagick/default.nix
index 021426b25113..7b820c0e98a4 100644
--- a/pkgs/applications/graphics/ImageMagick/default.nix
+++ b/pkgs/applications/graphics/ImageMagick/default.nix
@@ -30,6 +30,7 @@
 , Foundation
 , testers
 , imagemagick
+, python3
 }:
 
 assert libXtSupport -> libX11Support;
@@ -122,8 +123,10 @@ stdenv.mkDerivation rec {
     done
   '';
 
-  passthru.tests.version =
-    testers.testVersion { package = imagemagick; };
+  passthru.tests = {
+    version = testers.testVersion { package = imagemagick; };
+    inherit (python3.pkgs) img2pdf;
+  };
 
   meta = with lib; {
     homepage = "http://www.imagemagick.org/";
diff --git a/pkgs/applications/kde/kalendar.nix b/pkgs/applications/kde/kalendar.nix
index eb5649a32252..86589606ef07 100644
--- a/pkgs/applications/kde/kalendar.nix
+++ b/pkgs/applications/kde/kalendar.nix
@@ -97,7 +97,7 @@ mkDerivation rec {
     description = "A calendar application using Akonadi to sync with external services (Nextcloud, GMail, ...)";
     homepage = "https://apps.kde.org/kalendar/";
     license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ chuangzhu ];
+    maintainers = with maintainers; [ Thra11 ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/applications/misc/iptsd/default.nix b/pkgs/applications/misc/iptsd/default.nix
index 4a3262efa4b1..52872f3fbdb0 100644
--- a/pkgs/applications/misc/iptsd/default.nix
+++ b/pkgs/applications/misc/iptsd/default.nix
@@ -1,37 +1,67 @@
-{ lib, stdenv, fetchFromGitHub, meson, ninja, pkg-config, systemd, inih }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, meson
+, ninja
+, pkg-config
+, cli11
+, hidrd
+, inih
+, microsoft_gsl
+, spdlog
+, systemd
+}:
 
 stdenv.mkDerivation rec {
   pname = "iptsd";
-  version = "0.5.1";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "linux-surface";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-du5TC3I5+hWifjdnaeTj2QPJ6/oTXZqaOrZJkef/USU=";
+    hash = "sha256-fd/WZXRvJb6XCATNmPj2xi1UseoZqBT9IN21iwxHGLs=";
   };
 
-  nativeBuildInputs = [ meson ninja pkg-config ];
+  nativeBuildInputs = [
+    cmake
+    meson
+    ninja
+    pkg-config
+  ];
 
-  buildInputs = [ systemd inih ];
+  dontUseCmakeConfigure = true;
+
+  buildInputs = [
+    cli11
+    hidrd
+    inih
+    microsoft_gsl
+    spdlog
+    systemd
+  ];
 
   # Original installs udev rules and service config into global paths
   postPatch = ''
-    substituteInPlace meson.build \
+    substituteInPlace etc/meson.build \
       --replace "install_dir: unitdir" "install_dir: datadir" \
       --replace "install_dir: rulesdir" "install_dir: datadir" \
   '';
+
   mesonFlags = [
     "-Dservice_manager=systemd"
     "-Dsample_config=false"
-    "-Ddebug_tool=false"
+    "-Ddebug_tools="
+    "-Db_lto=false"  # plugin needed to handle lto object -> undefined reference to ...
   ];
 
   meta = with lib; {
+    changelog = "https://github.com/linux-surface/iptsd/releases/tag/${src.rev}";
     description = "Userspace daemon for Intel Precise Touch & Stylus";
     homepage = "https://github.com/linux-surface/iptsd";
-    license = licenses.gpl2Only;
-    maintainers = with maintainers; [ tomberek ];
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ tomberek dotlambda ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/applications/misc/kanboard/default.nix b/pkgs/applications/misc/kanboard/default.nix
deleted file mode 100644
index 69092b3acd5b..000000000000
--- a/pkgs/applications/misc/kanboard/default.nix
+++ /dev/null
@@ -1,27 +0,0 @@
-{ lib, stdenv, fetchFromGitHub }:
-
-stdenv.mkDerivation rec {
-  pname = "kanboard";
-  version = "1.2.26";
-
-  src = fetchFromGitHub {
-    owner = "kanboard";
-    repo = "kanboard";
-    rev = "v${version}";
-    sha256 = "sha256-/Unxl9Vh9pEWjO89sSviGGPFzUwxdb1mbOfpTFTyRL0=";
-  };
-
-  dontBuild = true;
-
-  installPhase = ''
-    mkdir -p $out/share/kanboard
-    cp -rv . $out/share/kanboard
-  '';
-
-  meta = with lib; {
-    description = "Kanban project management software";
-    homepage = "https://kanboard.org";
-    license = licenses.mit;
-    maintainers = with maintainers; [ lheckemann ];
-  };
-}
diff --git a/pkgs/applications/misc/keepass/default.nix b/pkgs/applications/misc/keepass/default.nix
index e062c35e80a6..d91f03a696a0 100644
--- a/pkgs/applications/misc/keepass/default.nix
+++ b/pkgs/applications/misc/keepass/default.nix
@@ -4,11 +4,11 @@ let
   inherit (builtins) add length readFile replaceStrings unsafeDiscardStringContext toString map;
 in buildDotnetPackage rec {
   pname = "keepass";
-  version = "2.52";
+  version = "2.53";
 
   src = fetchurl {
     url = "mirror://sourceforge/keepass/KeePass-${version}-Source.zip";
-    sha256 = "sha256-6dGCfysen26VGHIHETuNGkqHbPyeWRIEopqJa6AMzXA=";
+    hash = "sha256-wpXbLH9VyjJyb+KuQ8xmbik1jq+xqAFRxsxAuLM5MI0=";
   };
 
   sourceRoot = ".";
diff --git a/pkgs/applications/misc/klayout/default.nix b/pkgs/applications/misc/klayout/default.nix
index 0386b25ee422..dd3e5406ca32 100644
--- a/pkgs/applications/misc/klayout/default.nix
+++ b/pkgs/applications/misc/klayout/default.nix
@@ -5,13 +5,13 @@
 
 mkDerivation rec {
   pname = "klayout";
-  version = "0.28.3";
+  version = "0.28.4";
 
   src = fetchFromGitHub {
     owner = "KLayout";
     repo = "klayout";
     rev = "v${version}";
-    hash = "sha256-keC+QLV/iEEGFDdy/Vt2pCr55qbqQzcx3HokdDi+xSU=";
+    hash = "sha256-6RIzgC/PA2DqO24vKu+d/+GttufUbIH+k9GZe09M0vM=";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/misc/pgmodeler/default.nix b/pkgs/applications/misc/pgmodeler/default.nix
index 96cc51fceb78..1b42cd46a6b6 100644
--- a/pkgs/applications/misc/pgmodeler/default.nix
+++ b/pkgs/applications/misc/pgmodeler/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
     owner = "pgmodeler";
     repo = "pgmodeler";
     rev = "v${version}";
-    sha256 = "sha256-Lim9iQYdmulwZEIayoBGoAmQ7rysTEEof5iXy3kfKXs=";
+    sha256 = "sha256-aDmaKf3iLBFD28n2u/QOf/GkgE64Birn0x3Kj5Qx2sg=";
   };
 
   nativeBuildInputs = [ pkg-config qmake wrapQtAppsHook ];
diff --git a/pkgs/applications/misc/process-compose/default.nix b/pkgs/applications/misc/process-compose/default.nix
index f71841c1af9a..15aa7d2d1b96 100644
--- a/pkgs/applications/misc/process-compose/default.nix
+++ b/pkgs/applications/misc/process-compose/default.nix
@@ -8,13 +8,13 @@ let config-module = "github.com/f1bonacc1/process-compose/src/config";
 in
 buildGoModule rec {
   pname = "process-compose";
-  version = "0.40.0";
+  version = "0.40.1";
 
   src = fetchFromGitHub {
     owner = "F1bonacc1";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-8gyALVW+ort76r/zevWAhZlJ/fg5DBmwUNvjZ21wWKY=";
+    hash = "sha256-riYrvg83mNdj4W8o/2cdZO+zie/WB+HVWXORJ4Uo/CE=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
diff --git a/pkgs/applications/misc/tabula/default.nix b/pkgs/applications/misc/tabula/default.nix
index d2978ec7bd32..ec2ded975fed 100644
--- a/pkgs/applications/misc/tabula/default.nix
+++ b/pkgs/applications/misc/tabula/default.nix
@@ -36,5 +36,6 @@ stdenv.mkDerivation rec {
     license = licenses.mit;
     maintainers = [ maintainers.dpaetzel ];
     platforms = platforms.all;
+    broken = true; # on 2022-11-23 this package builds, but produces an executable that fails immediately
   };
 }
diff --git a/pkgs/applications/misc/thedesk/default.nix b/pkgs/applications/misc/thedesk/default.nix
index a7a184e80037..1fb2912d64d2 100644
--- a/pkgs/applications/misc/thedesk/default.nix
+++ b/pkgs/applications/misc/thedesk/default.nix
@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   pname = "thedesk";
-  version = "24.0.7";
+  version = "24.0.8";
 
   src = fetchurl {
     url = "https://github.com/cutls/TheDesk/releases/download/v${version}/${pname}_${version}_amd64.deb";
-    sha256 = "sha256-EG5TMhYvECXahIbB25gP40iNQpStcrgaJW3ld9x02/E=";
+    sha256 = "sha256-nxwSJ/rQJYMNrtTWSmqcrJQwMK8zRwIG4jccVyb7OsQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/tvbrowser/default.nix b/pkgs/applications/misc/tvbrowser/default.nix
index f076a020e2ee..afc810003932 100644
--- a/pkgs/applications/misc/tvbrowser/default.nix
+++ b/pkgs/applications/misc/tvbrowser/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
   version = "4.2.7";
 
   src = fetchzip {
-    url = "mirror://sourceforge/${pname}/TV-Browser%20Releases%20%28Java%20${minimalJavaVersion}%20and%20higher%29/${version}/${pname}_${version}_src.tar.gz";
+    url = "mirror://sourceforge/${pname}/TV-Browser%20Releases%20%28Java%20${minimalJavaVersion}%20and%20higher%29/${version}/${pname}_${version}_src.zip";
     hash = "sha256-dmNfI6T0MU7UtMH+C/2hiAeDwZlFCB4JofQViZezoqI=";
   };
 
diff --git a/pkgs/applications/misc/variety/default.nix b/pkgs/applications/misc/variety/default.nix
index a3af42c0fb84..5d9965c0d14a 100644
--- a/pkgs/applications/misc/variety/default.nix
+++ b/pkgs/applications/misc/variety/default.nix
@@ -21,13 +21,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "variety";
-  version = "0.8.9";
+  version = "0.8.10";
 
   src = fetchFromGitHub {
     owner = "varietywalls";
     repo = "variety";
     rev = "refs/tags/${version}";
-    hash = "sha256-Tm8RXn2S/NDUD3JWeCHKqSFkxZPJdNMojPGnU4WEpr0=";
+    hash = "sha256-Uln0uoaEZgV9FN3HEBTeFOD7d6RkAQLgQZw7bcgu26A=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/xmrig/proxy.nix b/pkgs/applications/misc/xmrig/proxy.nix
index 1040451efae0..461af3ca669e 100644
--- a/pkgs/applications/misc/xmrig/proxy.nix
+++ b/pkgs/applications/misc/xmrig/proxy.nix
@@ -1,27 +1,54 @@
-{ stdenv, lib, fetchFromGitHub, cmake, libuv, libmicrohttpd, openssl
+{ stdenv
+, lib
+, fetchFromGitHub
+, cmake
+, libuv
+, libmicrohttpd
+, openssl
+, darwin
 }:
 
+let
+  inherit (darwin.apple_sdk_11_0.frameworks) CoreServices IOKit;
+in
 stdenv.mkDerivation rec {
   pname = "xmrig-proxy";
-  version = "6.18.0";
+  version = "6.19.0";
 
   src = fetchFromGitHub {
     owner = "xmrig";
     repo = "xmrig-proxy";
     rev = "v${version}";
-    sha256 = "sha256-3Tp0wTL3uHs0N4CdlNusvpuam653b6qUZu9/KBT4HOM=";
+    hash = "sha256-0vmRwe7PQVifm6HxgpPno9mIFcBZFtxqNdDK4V637ds=";
   };
 
-  nativeBuildInputs = [ cmake ];
-  buildInputs = [ libuv libmicrohttpd openssl ];
-
   postPatch = ''
-    # Link dynamically against libuuid instead of statically
-    substituteInPlace CMakeLists.txt --replace uuid.a uuid
+    # Link dynamically against libraries instead of statically
+    substituteInPlace CMakeLists.txt \
+      --replace uuid.a uuid
+    substituteInPlace cmake/OpenSSL.cmake \
+      --replace "set(OPENSSL_USE_STATIC_LIBS TRUE)" "set(OPENSSL_USE_STATIC_LIBS FALSE)"
   '';
 
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  buildInputs = [
+    libuv
+    libmicrohttpd
+    openssl
+  ] ++ lib.optionals stdenv.isDarwin [
+    CoreServices
+    IOKit
+  ];
+
   installPhase = ''
+    runHook preInstall
+
     install -vD xmrig-proxy $out/bin/xmrig-proxy
+
+    runHook postInstall
   '';
 
   meta = with lib; {
diff --git a/pkgs/applications/misc/yewtube/default.nix b/pkgs/applications/misc/yewtube/default.nix
index f217c7b0e9a5..c7dc0b6071b0 100644
--- a/pkgs/applications/misc/yewtube/default.nix
+++ b/pkgs/applications/misc/yewtube/default.nix
@@ -2,13 +2,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "yewtube";
-  version = "2.9.0";
+  version = "2.9.2";
 
   src = fetchFromGitHub {
     owner = "iamtalhaasghar";
     repo = "yewtube";
-    rev = "v${version}";
-    hash = "sha256-8GL2ZvRHtnnLZ07nQk3irJUj+XLL+pyUUA+JJPICPRA=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-5+0OaoUan9IFEqtMvpvtkfpd7IbFJhG52oROER5TY20=";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/networking/cluster/civo/default.nix b/pkgs/applications/networking/cluster/civo/default.nix
index 2fbbc9ad1d24..36429dc84dcf 100644
--- a/pkgs/applications/networking/cluster/civo/default.nix
+++ b/pkgs/applications/networking/cluster/civo/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "civo";
-  version = "1.0.45";
+  version = "1.0.47";
 
   src = fetchFromGitHub {
     owner  = "civo";
     repo   = "cli";
     rev    = "v${version}";
-    sha256 = "sha256-wYZC4eEvxvHgtb0l+kpP2msQgt8InJu59lgS5cwGxRI=";
+    sha256 = "sha256-iowBEtO+Ol6mFJrwLaDa88wsQB8nZEe9OFPuhbH4t1s=";
   };
 
-  vendorHash = "sha256-42ZTPl4kI+dgr78s9WvLFchQU9uvkMkkio53REjvpbw=";
+  vendorHash = "sha256-QzTu6/iFK+CS8UXoXSVq3OTuwk/xcHnAX4UpCU/Scpk=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/applications/networking/cluster/k9s/default.nix b/pkgs/applications/networking/cluster/k9s/default.nix
index 141a17e34e2f..8ac275c1b928 100644
--- a/pkgs/applications/networking/cluster/k9s/default.nix
+++ b/pkgs/applications/networking/cluster/k9s/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "k9s";
-  version = "0.27.0";
+  version = "0.27.2";
 
   src = fetchFromGitHub {
     owner  = "derailed";
     repo   = "k9s";
     rev    = "v${version}";
-    sha256 = "sha256-optEMGB6izGlpcq2AJOY4lTt8igYBilE0Bg8KxE8AsU=";
+    sha256 = "sha256-9wdc3Wiqry8+q/60Y7mPzH0k4dp1nKIGinxfkYBaHJY=";
   };
 
   ldflags = [
@@ -20,7 +20,7 @@ buildGoModule rec {
 
   tags = [ "netgo" ];
 
-  vendorHash = "sha256-57JrBmund2hwcgqWkLos/h1EOgZQb9HfKUf1BX0MYGQ=";
+  vendorHash = "sha256-8H7siVl6gXifQOBOLtyCeDbYflhKjaIRmP0KOTWVJk0=";
 
   # TODO investigate why some config tests are failing
   doCheck = !(stdenv.isDarwin && stdenv.isAarch64);
diff --git a/pkgs/applications/networking/cluster/stern/default.nix b/pkgs/applications/networking/cluster/stern/default.nix
index 7459bba1697b..ee045f5782a9 100644
--- a/pkgs/applications/networking/cluster/stern/default.nix
+++ b/pkgs/applications/networking/cluster/stern/default.nix
@@ -4,16 +4,16 @@ let isCrossBuild = stdenv.hostPlatform != stdenv.buildPlatform;
 in
 buildGoModule rec {
   pname = "stern";
-  version = "1.22.0";
+  version = "1.23.0";
 
   src = fetchFromGitHub {
     owner = "stern";
     repo = "stern";
     rev = "v${version}";
-    sha256 = "sha256-xO4I4fNf14ltiSnFnAhM8VYBw4JKB0RSQziSshZOFBo=";
+    sha256 = "sha256-tqp2H8aWPBgje1zIK673cbr+DShhTQL9VQ0dEL/he7s=";
   };
 
-  vendorSha256 = "sha256-tNx1BvZBblyLavFslhqj9DCyfcgbl6HxlZ7zceK1a0w=";
+  vendorHash = "sha256-ud07lWHwQfAHgVenUApwrfxmTjJKVm+pOExdR9pZFxA=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/applications/networking/ids/zeek/avoid-broken-tests.patch b/pkgs/applications/networking/ids/zeek/avoid-broken-tests.patch
new file mode 100644
index 000000000000..4784e6790fc3
--- /dev/null
+++ b/pkgs/applications/networking/ids/zeek/avoid-broken-tests.patch
@@ -0,0 +1,16 @@
+diff --git a/auxil/spicy/spicy/hilti/toolchain/CMakeLists.txt b/auxil/spicy/spicy/hilti/toolchain/CMakeLists.txt
+index bafbabf1..0579f20a 100644
+--- a/auxil/spicy/spicy/hilti/toolchain/CMakeLists.txt
++++ b/auxil/spicy/spicy/hilti/toolchain/CMakeLists.txt
+@@ -188,11 +188,3 @@ install_headers(include hilti)
+ install_headers(${PROJECT_BINARY_DIR}/include/hilti hilti)
+ install(CODE "file(REMOVE \"\$ENV\{DESTDIR\}${CMAKE_INSTALL_FULL_INCLUDEDIR}/hilti/hilti\")"
+ )# Get rid of symlink.
+-
+-##### Tests
+-
+-add_executable(hilti-toolchain-tests tests/main.cc tests/id-base.cc tests/visitor.cc tests/util.cc)
+-hilti_link_executable_in_tree(hilti-toolchain-tests PRIVATE)
+-target_link_libraries(hilti-toolchain-tests PRIVATE doctest)
+-target_compile_options(hilti-toolchain-tests PRIVATE "-Wall")
+-add_test(NAME hilti-toolchain-tests COMMAND ${PROJECT_BINARY_DIR}/bin/hilti-toolchain-tests)
diff --git a/pkgs/applications/networking/ids/zeek/broker/0001-Fix-include-path-in-exported-CMake-targets.patch b/pkgs/applications/networking/ids/zeek/broker/0001-Fix-include-path-in-exported-CMake-targets.patch
new file mode 100644
index 000000000000..07b95960ef85
--- /dev/null
+++ b/pkgs/applications/networking/ids/zeek/broker/0001-Fix-include-path-in-exported-CMake-targets.patch
@@ -0,0 +1,75 @@
+From 889ee4dd9e778511e2fb850e6467f55a331cded9 Mon Sep 17 00:00:00 2001
+From: Tobias Mayer <tobim@fastmail.fm>
+Date: Sun, 13 Nov 2022 19:06:00 +0100
+Subject: [PATCH] Fix include path in exported CMake targets
+
+---
+ CMakeLists.txt | 23 ++++++++++++++---------
+ 1 file changed, 14 insertions(+), 9 deletions(-)
+
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index e22b77aa..77a15314 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -209,7 +209,6 @@ if (CAF_ROOT)
+   else()
+     find_package(CAF REQUIRED COMPONENTS openssl test io core net)
+   endif()
+-  list(APPEND LINK_LIBS CAF::core CAF::io CAF::net)
+   set(BROKER_USE_EXTERNAL_CAF ON)
+ else ()
+   message(STATUS "Using bundled CAF")
+@@ -243,22 +242,18 @@ endif ()
+ 
+ # Make sure there are no old header versions on disk.
+ install(
+-  CODE "MESSAGE(STATUS \"Removing: ${CMAKE_INSTALL_PREFIX}/include/broker\")"
+-  CODE "file(REMOVE_RECURSE \"${CMAKE_INSTALL_PREFIX}/include/broker\")")
++  CODE "MESSAGE(STATUS \"Removing: ${CMAKE_FULL_INSTALL_INCLUDEDIR}/broker\")"
++  CODE "file(REMOVE_RECURSE \"${CMAKE_FULL_INSTALL_INCLUDEDIR}/broker\")")
+ 
+ # Install all headers except the files from broker/internal.
+ install(DIRECTORY include/broker
+-        DESTINATION include
++        DESTINATION "${CMAKE_INSTALL_INCLUDEDIR}"
+         FILES_MATCHING PATTERN "*.hh"
+                        PATTERN "include/broker/internal" EXCLUDE)
+ 
+-include_directories(BEFORE ${CMAKE_CURRENT_SOURCE_DIR}/include)
+-
+-include_directories(${CMAKE_CURRENT_BINARY_DIR}/include)
+-
+ configure_file(${CMAKE_CURRENT_SOURCE_DIR}/src/config.hh.in
+                ${CMAKE_CURRENT_BINARY_DIR}/include/broker/config.hh)
+-install(FILES ${CMAKE_CURRENT_BINARY_DIR}/include/broker/config.hh DESTINATION include/broker)
++install(FILES ${CMAKE_CURRENT_BINARY_DIR}/include/broker/config.hh DESTINATION "${CMAKE_INSTALL_INCLUDEDIR}/broker")
+ 
+ if (NOT BROKER_EXTERNAL_SQLITE_TARGET)
+   include_directories(BEFORE ${CMAKE_CURRENT_SOURCE_DIR}/3rdparty)
+@@ -360,6 +355,11 @@ if (ENABLE_SHARED)
+                         OUTPUT_NAME broker)
+   target_link_libraries(broker PUBLIC ${LINK_LIBS})
+   target_link_libraries(broker PRIVATE CAF::core CAF::io CAF::net)
++  target_include_directories(
++    broker PUBLIC
++      $<BUILD_INTERFACE:${CMAKE_CURRENT_BINARY_DIR}/include>
++      $<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}/include>
++      $<INSTALL_INTERFACE:${CMAKE_INSTALL_INCLUDEDIR}>)
+   install(TARGETS broker
+           EXPORT BrokerTargets
+           DESTINATION ${CMAKE_INSTALL_LIBDIR})
+@@ -373,6 +373,11 @@ if (ENABLE_STATIC)
+   endif()
+   target_link_libraries(broker_static PUBLIC ${LINK_LIBS})
+   target_link_libraries(broker_static PRIVATE CAF::core CAF::io CAF::net)
++  target_include_directories(
++    broker_static PUBLIC
++      $<BUILD_INTERFACE:${CMAKE_CURRENT_BINARY_DIR}/include>
++      $<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}/include>
++      $<INSTALL_INTERFACE:${CMAKE_INSTALL_INCLUDEDIR}>)
+   install(TARGETS broker_static
+           EXPORT BrokerTargets
+           DESTINATION ${CMAKE_INSTALL_LIBDIR})
+-- 
+2.38.1
+
diff --git a/pkgs/applications/networking/ids/zeek/broker/default.nix b/pkgs/applications/networking/ids/zeek/broker/default.nix
new file mode 100644
index 000000000000..cb10e43933aa
--- /dev/null
+++ b/pkgs/applications/networking/ids/zeek/broker/default.nix
@@ -0,0 +1,88 @@
+{ stdenv
+, lib
+, callPackage
+, fetchFromGitHub
+, cmake
+, pkg-config
+, python3
+, caf
+, openssl
+}:
+let
+  inherit (stdenv.hostPlatform) isStatic;
+
+  src-cmake = fetchFromGitHub {
+    owner = "zeek";
+    repo = "cmake";
+    rev = "0b7a543554622600bc0a42b57a22f291a4fbd86c";
+    hash = "sha256-kaBOBTpfR3XyuF4PW5NQKca/UhXXxJJcXVsErFU1VYY=";
+  };
+  src-3rdparty = fetchFromGitHub {
+    owner = "zeek";
+    repo = "zeek-3rdparty";
+    rev = "eb87829547270eab13c223e6de58b25bc9a0282e";
+    hash = "sha256-AVaKcRjF5ZiSR8aPSLBzSTeWVwGWW/aSyQJcN0Yhza0=";
+  };
+  caf' = caf.overrideAttrs (old: {
+    version = "unstable-2022-11-17-zeek";
+    src = fetchFromGitHub {
+      owner = "zeek";
+      repo = "actor-framework";
+      rev = "dbb68b4573736d7aeb69268cc73aa766c998b3dd";
+      hash = "sha256-RV2mKF3B47h/hDgK/D1UJN/ll2G5rcPkHaLVY1/C/Pg=";
+    };
+    checkPhase = ''
+      runHook preCheck
+      libcaf_core/caf-core-test
+      libcaf_io/caf-io-test
+      libcaf_openssl/caf-openssl-test
+      libcaf_net/caf-net-test --not-suites='net.*'
+      runHook postCheck
+    '';
+  });
+in
+stdenv.mkDerivation rec {
+  pname = "zeek-broker";
+  version = "2.4.2";
+  outputs = [ "out" "py" ];
+
+  strictDeps = true;
+
+  src = fetchFromGitHub {
+    owner = "zeek";
+    repo = "broker";
+    rev = "v${version}";
+    hash = "sha256-y07fJEVPDGPv5VThE45SwM342VS6LnEtMvazZHadM/k=";
+  };
+  postUnpack = ''
+    rmdir $sourceRoot/cmake $sourceRoot/3rdparty
+    ln -s ${src-cmake} ''${sourceRoot}/cmake
+    ln -s ${src-3rdparty} ''${sourceRoot}/3rdparty
+
+    # Refuses to build the bindings unless this file is present, but never
+    # actually uses it.
+    touch $sourceRoot/bindings/python/3rdparty/pybind11/CMakeLists.txt
+  '';
+
+  patches = [
+    ./0001-Fix-include-path-in-exported-CMake-targets.patch
+  ];
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ openssl python3.pkgs.pybind11 ];
+  propagatedBuildInputs = [ caf' ];
+
+  cmakeFlags = [
+    "-DCAF_ROOT=${caf'}"
+    "-DENABLE_STATIC_ONLY:BOOL=${if isStatic then "ON" else "OFF"}"
+    "-DPY_MOD_INSTALL_DIR=${placeholder "py"}/${python3.sitePackages}/"
+  ];
+
+  meta = with lib; {
+    description = "Zeek's Messaging Library";
+    homepage = "https://github.com/zeek/broker";
+    license = licenses.bsd3;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ tobim ];
+  };
+}
diff --git a/pkgs/applications/networking/ids/zeek/debug-runtime-undef-fortify-source.patch b/pkgs/applications/networking/ids/zeek/debug-runtime-undef-fortify-source.patch
new file mode 100644
index 000000000000..18aef601325d
--- /dev/null
+++ b/pkgs/applications/networking/ids/zeek/debug-runtime-undef-fortify-source.patch
@@ -0,0 +1,26 @@
+diff --git a/auxil/spicy/spicy/hilti/runtime/CMakeLists.txt b/auxil/spicy/spicy/hilti/runtime/CMakeLists.txt
+index f154901c..76563717 100644
+--- a/auxil/spicy/spicy/hilti/runtime/CMakeLists.txt
++++ b/auxil/spicy/spicy/hilti/runtime/CMakeLists.txt
+@@ -69,7 +69,7 @@ target_compile_definitions(hilti-rt-objects PRIVATE "HILTI_RT_BUILD_TYPE_RELEASE
+ # Build hilti-rt-debug with debug flags.
+ string(REPLACE " " ";" cxx_flags_debug ${CMAKE_CXX_FLAGS_DEBUG})
+ target_compile_options(hilti-rt-debug-objects PRIVATE ${cxx_flags_debug})
+-target_compile_options(hilti-rt-debug-objects PRIVATE "-UNDEBUG;-O0;-Wall")
++target_compile_options(hilti-rt-debug-objects PRIVATE "-UNDEBUG;-O0;-Wall;-U_FORTIFY_SOURCE")
+ target_compile_definitions(hilti-rt-debug-objects PRIVATE "HILTI_RT_BUILD_TYPE_DEBUG")
+ 
+ add_library(hilti-rt-tests-library-dummy1 SHARED src/tests/library-dummy.cc)
+diff --git a/auxil/spicy/spicy/spicy/runtime/CMakeLists.txt b/auxil/spicy/spicy/spicy/runtime/CMakeLists.txt
+index 20e7d291..9712341f 100644
+--- a/auxil/spicy/spicy/spicy/runtime/CMakeLists.txt
++++ b/auxil/spicy/spicy/spicy/runtime/CMakeLists.txt
+@@ -48,7 +48,7 @@ target_link_libraries(spicy-rt-objects PUBLIC hilti-rt-objects)
+ # Build spicy-rt-debug with debug flags.
+ string(REPLACE " " ";" cxx_flags_debug ${CMAKE_CXX_FLAGS_DEBUG})
+ target_compile_options(spicy-rt-debug-objects PRIVATE ${cxx_flags_debug})
+-target_compile_options(spicy-rt-debug-objects PRIVATE "-UNDEBUG;-O0;-Wall")
++target_compile_options(spicy-rt-debug-objects PRIVATE "-UNDEBUG;-O0;-Wall;-U_FORTIFY_SOURCE")
+ target_compile_definitions(spicy-rt-debug-objects PRIVATE "HILTI_RT_BUILD_TYPE_DEBUG")
+ target_link_libraries(spicy-rt-debug-objects PUBLIC hilti-rt-debug-objects)
+ 
diff --git a/pkgs/applications/networking/ids/zeek/default.nix b/pkgs/applications/networking/ids/zeek/default.nix
index ddeb03698e95..0bacf8ce03c4 100644
--- a/pkgs/applications/networking/ids/zeek/default.nix
+++ b/pkgs/applications/networking/ids/zeek/default.nix
@@ -1,10 +1,13 @@
 { lib
 , stdenv
+, callPackage
 , fetchurl
 , cmake
 , flex
 , bison
+, spicy-parser-generator
 , openssl
+, libkqueue
 , libpcap
 , zlib
 , file
@@ -16,46 +19,69 @@
 , gettext
 , coreutils
 , ncurses
-, caf
 }:
 
+let
+  broker = callPackage ./broker { };
+in
 stdenv.mkDerivation rec {
   pname = "zeek";
-  version = "4.2.2";
+  version = "5.1.2";
 
   src = fetchurl {
     url = "https://download.zeek.org/zeek-${version}.tar.gz";
-    sha256 = "sha256-9Q3X24uAmnSnLUAklK+gC0Mu8eh81ZE2h/7uIVc8cAw=";
+    sha256 = "sha256-1DvXUcTbLBm9UjJXuk8DjGEj+lED+s9D+SNnSqA3bwU=";
   };
 
+  strictDeps = true;
+
+  patches = [
+    ./avoid-broken-tests.patch
+    ./debug-runtime-undef-fortify-source.patch
+    ./fix-installation.patch
+  ];
+
   nativeBuildInputs = [
     bison
     cmake
     file
     flex
+    python3
   ];
 
   buildInputs = [
+    broker
+    spicy-parser-generator
     curl
     gperftools
+    libkqueue
     libmaxminddb
     libpcap
     ncurses
     openssl
-    python3
     swig
     zlib
   ] ++ lib.optionals stdenv.isDarwin [
     gettext
   ];
 
-  outputs = [ "out" "lib" "py" ];
+  postPatch = ''
+    patchShebangs ./auxil/spicy/spicy/scripts
+
+    substituteInPlace auxil/spicy/CMakeLists.txt --replace "hilti-toolchain-tests" ""
+    substituteInPlace auxil/spicy/spicy/hilti/CMakeLists.txt --replace "hilti-toolchain-tests" ""
+  '';
 
   cmakeFlags = [
-    "-DCAF_ROOT=${caf}"
-    "-DZEEK_PYTHON_DIR=${placeholder "py"}/lib/${python3.libPrefix}/site-packages"
+    "-DBroker_ROOT=${broker}"
+    "-DSPICY_ROOT_DIR=${spicy-parser-generator}"
+    "-DLIBKQUEUE_ROOT_DIR=${libkqueue}"
     "-DENABLE_PERFTOOLS=true"
     "-DINSTALL_AUX_TOOLS=true"
+    "-DZEEK_ETC_INSTALL_DIR=/etc/zeek"
+    "-DZEEK_LOG_DIR=/var/log/zeek"
+    "-DZEEK_STATE_DIR=/var/lib/zeek"
+    "-DZEEK_SPOOL_DIR=/var/spool/zeek"
   ];
 
   postInstall = ''
@@ -70,6 +96,10 @@ stdenv.mkDerivation rec {
     done
   '';
 
+  passthru = {
+    inherit broker;
+  };
+
   meta = with lib; {
     description = "Network analysis framework much different from a typical IDS";
     homepage = "https://www.zeek.org";
diff --git a/pkgs/applications/networking/ids/zeek/fix-installation.patch b/pkgs/applications/networking/ids/zeek/fix-installation.patch
new file mode 100644
index 000000000000..6360a1173051
--- /dev/null
+++ b/pkgs/applications/networking/ids/zeek/fix-installation.patch
@@ -0,0 +1,28 @@
+From f8c42a712db42cfd00fca75be2ce63c3aad2aad1 Mon Sep 17 00:00:00 2001
+From: Tobias Mayer <tobim@fastmail.fm>
+Date: Sun, 13 Nov 2022 21:48:36 +0100
+Subject: [PATCH] Fix installation
+
+---
+ CMakeLists.txt | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 846b65efd..d8b0be169 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -81,11 +81,6 @@ if ( NOT ZEEK_LOG_DIR )
+     set(ZEEK_LOG_DIR ${ZEEK_ROOT_DIR}/logs)
+ endif ()
+ 
+-install(DIRECTORY DESTINATION ${ZEEK_ETC_INSTALL_DIR})
+-install(DIRECTORY DESTINATION ${ZEEK_STATE_DIR})
+-install(DIRECTORY DESTINATION ${ZEEK_SPOOL_DIR})
+-install(DIRECTORY DESTINATION ${ZEEK_LOG_DIR})
+-
+ configure_file(zeek-path-dev.in ${CMAKE_CURRENT_BINARY_DIR}/zeek-path-dev)
+ execute_process(COMMAND "${CMAKE_COMMAND}" -E create_symlink
+                 "${CMAKE_CURRENT_BINARY_DIR}/zeek-wrapper.in"
+-- 
+2.37.3
+
diff --git a/pkgs/applications/networking/instant-messengers/armcord/default.nix b/pkgs/applications/networking/instant-messengers/armcord/default.nix
index 0c43ffbeea91..47d6db156279 100644
--- a/pkgs/applications/networking/instant-messengers/armcord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/armcord/default.nix
@@ -33,6 +33,8 @@
 , systemd
 , xdg-utils
 , xorg
+, wayland
+, pipewire
 }:
 
 stdenv.mkDerivation rec {
@@ -97,6 +99,8 @@ stdenv.mkDerivation rec {
     xorg.libXScrnSaver
     xorg.libxshmfence
     xorg.libXtst
+    wayland
+    pipewire
   ];
 
   sourceRoot = ".";
@@ -114,9 +118,9 @@ stdenv.mkDerivation rec {
     makeWrapper $out/opt/ArmCord/armcord $out/bin/armcord \
       "''${gappsWrapperArgs[@]}" \
       --prefix XDG_DATA_DIRS : "${gtk3}/share/gsettings-schemas/${gtk3.name}/" \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform=wayland --enable-features=UseOzonePlatform --enable-features=WebRTCPipeWireCapturer }}" \
       --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath buildInputs}" \
-      --suffix PATH : ${lib.makeBinPath [ xdg-utils ]} \
-      "''${gappsWrapperArgs[@]}"
+      --suffix PATH : ${lib.makeBinPath [ xdg-utils ]}
 
     # Fix desktop link
     substituteInPlace $out/share/applications/armcord.desktop \
diff --git a/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix b/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
index 904e47695d5b..35846f4b7e45 100644
--- a/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "signalbackup-tools";
-  version = "20230128-1";
+  version = "20230203";
 
   src = fetchFromGitHub {
     owner = "bepaald";
     repo = pname;
     rev = version;
-    sha256 = "sha256-wYhftShCL9XozK0c7OLijqzveDvEvv9stpw+6CQND/Y=";
+    sha256 = "sha256-xXIdXv2U5VpRSuJ9Kl6HMDBZGpXRYGPZFBBk9QYODtU=";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/networking/irc/senpai/default.nix b/pkgs/applications/networking/irc/senpai/default.nix
index e00a177b673e..e821b7ff58e6 100644
--- a/pkgs/applications/networking/irc/senpai/default.nix
+++ b/pkgs/applications/networking/irc/senpai/default.nix
@@ -32,6 +32,6 @@ buildGoModule rec {
     description = "Your everyday IRC student";
     homepage = "https://ellidri.org/senpai";
     license = licenses.isc;
-    maintainers = with maintainers; [ malvo ];
+    maintainers = with maintainers; [ malte-v ];
   };
 }
diff --git a/pkgs/applications/networking/mailreaders/mblaze/default.nix b/pkgs/applications/networking/mailreaders/mblaze/default.nix
index de82535cd560..fb852f76045d 100644
--- a/pkgs/applications/networking/mailreaders/mblaze/default.nix
+++ b/pkgs/applications/networking/mailreaders/mblaze/default.nix
@@ -7,7 +7,7 @@ stdenv.mkDerivation rec {
   version = "1.2";
 
   nativeBuildInputs = [ installShellFiles makeWrapper ];
-  buildInputs = [ ruby ] ++ lib.optionals stdenv.isDarwin [ libiconv ];
+  buildInputs = [ libiconv ruby ];
 
   src = fetchFromGitHub {
     owner = "leahneukirchen";
diff --git a/pkgs/applications/networking/seaweedfs/default.nix b/pkgs/applications/networking/seaweedfs/default.nix
index f51c8d051a51..5036eb998bd2 100644
--- a/pkgs/applications/networking/seaweedfs/default.nix
+++ b/pkgs/applications/networking/seaweedfs/default.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "seaweedfs";
-  version = "3.40";
+  version = "3.41";
 
   src = fetchFromGitHub {
     owner = "seaweedfs";
     repo = "seaweedfs";
     rev = version;
-    hash = "sha256-eU1RnLjPSAdtv+EqVnIpOLsDfBjx4WHFnHHkGZfr130=";
+    hash = "sha256-sNeuIcRJ249F9m7NBi5Vh4HMhWwDpNHAZsit1auVI5U=";
   };
 
-  vendorHash = "sha256-tKq5QEd7f4q7q2EDNjNrlatQ7+lXF9ya9L0iTP/AXSo=";
+  vendorHash = "sha256-ZtHgZ0Mur102H2EvifsK3HYUQaI1dFMh/6eiJO09HBc=";
 
   subPackages = [ "weed" ];
 
diff --git a/pkgs/applications/networking/soju/default.nix b/pkgs/applications/networking/soju/default.nix
index ae424a1fe50a..58ffecef723a 100644
--- a/pkgs/applications/networking/soju/default.nix
+++ b/pkgs/applications/networking/soju/default.nix
@@ -60,6 +60,6 @@ buildGoModule rec {
     homepage = "https://soju.im";
     changelog = "https://git.sr.ht/~emersion/soju/refs/${src.rev}";
     license = licenses.agpl3Only;
-    maintainers = with maintainers; [ azahi malvo ];
+    maintainers = with maintainers; [ azahi malte-v ];
   };
 }
diff --git a/pkgs/applications/networking/warp/default.nix b/pkgs/applications/networking/warp/default.nix
index 0c47fc323a64..23c7916354fd 100644
--- a/pkgs/applications/networking/warp/default.nix
+++ b/pkgs/applications/networking/warp/default.nix
@@ -17,14 +17,14 @@
 
 stdenv.mkDerivation rec {
   pname = "warp";
-  version = "0.3.2";
+  version = "0.4";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "World";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-oKkZC9fi5xPnLTI00MnG2gMjzMZHMNFI77ztbR4KQo4=";
+    hash = "sha256-c8X0kedfM8DPTEQAbh8cXIfEvxG2cdUD3twVHs0/k7U";
   };
 
   postPatch = ''
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-sbyAyjxpol2SBxoLUsiPGfkP2diBPgJW0vEDHYWgmLU=";
+    hash = "sha256-TS/Q6T3bPjkk1bfINTR6bcPy8fnbAxbKJUrx2pYsPWY=";
   };
 
   nativeBuildInputs = [
@@ -62,7 +62,7 @@ stdenv.mkDerivation rec {
     description = "Fast and secure file transfer";
     homepage = "https://apps.gnome.org/app/app.drey.Warp";
     license = lib.licenses.gpl3Only;
-    maintainers = with lib.maintainers; [ dotlambda ];
+    maintainers = with lib.maintainers; [ dotlambda foo-dogsquared ];
     platforms = lib.platforms.linux;
   };
 }
diff --git a/pkgs/applications/office/paper-note/default.nix b/pkgs/applications/office/paper-note/default.nix
index e400c88df5dd..e9fdd485befd 100644
--- a/pkgs/applications/office/paper-note/default.nix
+++ b/pkgs/applications/office/paper-note/default.nix
@@ -49,13 +49,10 @@ stdenv.mkDerivation rec {
       --replace "1.2.0" "${libadwaita.version}"
   '';
 
-  postInstall = ''
-    ln -s $out/bin/io.posidon.Paper $out/bin/paper
-  '';
-
   meta = with lib; {
-    description = "Take notes in Markdown";
-    homepage = "https://posidon.io/paper/";
+    description = "A pretty note-taking app for GNOME";
+    homepage = "https://gitlab.com/posidon_software/paper";
+    mainProgram = "io.posidon.Paper";
     license = licenses.gpl3;
     platforms = platforms.unix;
     maintainers = with maintainers; [ j0lol ];
diff --git a/pkgs/applications/office/treesheets/default.nix b/pkgs/applications/office/treesheets/default.nix
index 5566906919a8..17b4089ed702 100644
--- a/pkgs/applications/office/treesheets/default.nix
+++ b/pkgs/applications/office/treesheets/default.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "treesheets";
-  version = "unstable-2023-01-23";
+  version = "unstable-2023-01-31";
 
   src = fetchFromGitHub {
     owner = "aardappel";
     repo = "treesheets";
-    rev = "f676cba7f9749825744ec705ee58b9fbea47db51";
-    sha256 = "Zx1fGicCuX+HJm2QFSYQhcd9Ibg3qj5h9NPlSNNVLag=";
+    rev = "44206849d03c8983e41d2aeca70a06e04365d88d";
+    sha256 = "bUyM0zWVO7HWBiWi0mhkDlVxgqMHoFiR78XpiG8q/V4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/radio/gridtracker/default.nix b/pkgs/applications/radio/gridtracker/default.nix
index cfb1f367ad80..9a48854ccc69 100644
--- a/pkgs/applications/radio/gridtracker/default.nix
+++ b/pkgs/applications/radio/gridtracker/default.nix
@@ -1,18 +1,19 @@
 { lib
 , stdenv
 , fetchFromGitLab
+, nix-update-script
 , nwjs
 }:
 
 stdenv.mkDerivation rec {
   pname = "gridtracker";
-  version = "1.23.0110";
+  version = "1.23.0206";
 
   src = fetchFromGitLab {
     owner = "gridtracker.org";
     repo = "gridtracker";
     rev = "v${version}";
-    sha256 = "sha256-yQWdBNt7maYTzroB+P1hsGIeivkP+soR3/b847HLYZY=";
+    sha256 = "sha256-XWjKJga9aQrMb0ZfA4ElsPU1CfMwFtwYSK1vjgtlKes=";
   };
 
   postPatch = ''
@@ -27,6 +28,8 @@ stdenv.mkDerivation rec {
 
   makeFlags = [ "DESTDIR=$(out)" "NO_DIST_INSTALL=1" ];
 
+  passthru.updateScript = nix-update-script { };
+
   meta = with lib; {
     description = "An amateur radio companion to WSJT-X or JTDX";
     longDescription = ''
diff --git a/pkgs/applications/science/astronomy/kstars/default.nix b/pkgs/applications/science/astronomy/kstars/default.nix
index d74ad2c4e878..3769948fd3ef 100644
--- a/pkgs/applications/science/astronomy/kstars/default.nix
+++ b/pkgs/applications/science/astronomy/kstars/default.nix
@@ -14,11 +14,11 @@
 
 mkDerivation rec {
   pname = "kstars";
-  version = "3.6.1";
+  version = "3.6.3";
 
   src = fetchurl {
     url = "mirror://kde/stable/kstars/kstars-${version}.tar.xz";
-    sha256 = "sha256-WWbtfqvGd13+a41z8/MjlchllpuhLX08nu15OlYUeuI=";
+    sha256 = "sha256-sve9q4iM/Y8+K64Ceby/KGx5Un5G0o5cCnIxJkXTgug=";
   };
 
   nativeBuildInputs = [ extra-cmake-modules kdoctools ];
diff --git a/pkgs/applications/science/biology/igv/default.nix b/pkgs/applications/science/biology/igv/default.nix
index f6d767235b7f..ec97f0e6aa31 100644
--- a/pkgs/applications/science/biology/igv/default.nix
+++ b/pkgs/applications/science/biology/igv/default.nix
@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   pname = "igv";
-  version = "2.15.5";
+  version = "2.16.0";
   src = fetchzip {
     url = "https://data.broadinstitute.org/igv/projects/downloads/${lib.versions.majorMinor version}/IGV_${version}.zip";
-    sha256 = "sha256-AKKMtR0hU2O84mRJxxsXNCYHeW8d6t3XJpzOKKaxAWw=";
+    sha256 = "sha256-pfFUtPgHzTWMm3sh4un8SwSYF8HM30HbAQznxlu4Irw=";
   };
 
   installPhase = ''
diff --git a/pkgs/applications/science/electronics/digital/default.nix b/pkgs/applications/science/electronics/digital/default.nix
index 0515809dffeb..72b931f1d11c 100644
--- a/pkgs/applications/science/electronics/digital/default.nix
+++ b/pkgs/applications/science/electronics/digital/default.nix
@@ -4,8 +4,8 @@
 
 let
   pkgDescription = "A digital logic designer and circuit simulator.";
-  version = "0.29";
-  buildDate = "2022-02-11T18:10:34+01:00"; # v0.29 commit date
+  version = "0.30";
+  buildDate = "2023-02-03T08:00:56+01:00"; # v0.30 commit date
 
   desktopItem = makeDesktopItem {
     type = "Application";
@@ -24,7 +24,8 @@ let
   # inspect the .git folder to find the version number we are building, we then
   # provide that version number manually as a property.
   # (see https://github.com/hneemann/Digital/issues/289#issuecomment-513721481)
-  mvnOptions = "-Pno-git-rev -Dgit.commit.id.describe=${version} -Dproject.build.outputTimestamp=${buildDate}";
+  # Also use the commit date as a build and output timestamp.
+  mvnOptions = "-Pno-git-rev -Dgit.commit.id.describe=${version} -Dproject.build.outputTimestamp=${buildDate} -DbuildTimestamp=${buildDate}";
 in
 stdenv.mkDerivation rec {
   pname = "digital";
@@ -33,20 +34,16 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "hneemann";
     repo = "Digital";
-    rev = "287dd939d6f2d4d02c0d883c6178c3425c28d39c";
-    sha256 = "o5gaExUTTbk6WgQVw7/IeXhpNkj1BLkwD752snQqjIg=";
+    rev = "932791eb6486d04f2ea938d83bcdb71b56d3a3f6";
+    sha256 = "cDykYlcFvDLFBy9UnX07iCR2LCq28SNU+h9vRT/AoJM=";
   };
 
-  # Use fixed dates in the pom.xml and upgrade the jar and assembly plugins to
-  # a version where they support reproducible builds
-  patches = [ ./pom.xml.patch ];
-
   # Fetching maven dependencies from "central" needs the network at build phase,
   # we do that in this extra derivation that explicitely specifies its
   # outputHash to ensure determinism.
   mavenDeps = stdenv.mkDerivation {
     name = "${pname}-${version}-maven-deps";
-    inherit src nativeBuildInputs version patches postPatch;
+    inherit src nativeBuildInputs version;
     dontFixup = true;
     buildPhase = ''
       mvn package ${mvnOptions} -Dmaven.repo.local=$out
@@ -62,15 +59,11 @@ stdenv.mkDerivation rec {
     '';
     outputHashAlgo = "sha256";
     outputHashMode = "recursive";
-    outputHash = "X5ppGUVwNQrMnjzD4Kin1Xmt4O3x+qr7jK4jr6E8tCI=";
+    outputHash = "1Cgw+5V2E/RENMRMm368+2yvY7y6v9gTlo+LRgrCXcE=";
   };
 
   nativeBuildInputs = [ copyDesktopItems maven makeWrapper ];
 
-  postPatch = ''
-    substituteInPlace pom.xml --subst-var-by buildDate "${buildDate}"
-  '';
-
   buildPhase = ''
     mvn package --offline ${mvnOptions} -Dmaven.repo.local=${mavenDeps}
   '';
diff --git a/pkgs/applications/science/electronics/digital/pom.xml.patch b/pkgs/applications/science/electronics/digital/pom.xml.patch
deleted file mode 100644
index cdc5a777c49d..000000000000
--- a/pkgs/applications/science/electronics/digital/pom.xml.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-diff --git a/pom.xml b/pom.xml
-index d5f8330b4..58ed18b63 100644
---- a/pom.xml
-+++ b/pom.xml
-@@ -129,7 +130,7 @@
-             <plugin>
-                 <groupId>org.apache.maven.plugins</groupId>
-                 <artifactId>maven-jar-plugin</artifactId>
--                <version>2.5</version>
-+                <version>3.2.0</version>
-                 <configuration>
-                     <archive>
-                         <manifest>
-@@ -188,6 +189,7 @@
-             <plugin>
-                 <groupId>org.apache.maven.plugins</groupId>
-                 <artifactId>maven-assembly-plugin</artifactId>
-+                <version>3.2.0</version>
-                 <configuration>
-                     <finalName>Digital</finalName>
-                     <appendAssemblyId>false</appendAssemblyId>
-@@ -202,7 +204,7 @@
-                         </manifest>
-                         <manifestEntries>
-                             <Build-SCM-Revision>${git.commit.id.describe}</Build-SCM-Revision>
--                            <Build-Time>${maven.build.timestamp}</Build-Time>
-+                            <Build-Time>@buildDate@</Build-Time>
-                             <SplashScreen-Image>icons/splash.png</SplashScreen-Image>
-                         </manifestEntries>
-                     </archive>
diff --git a/pkgs/applications/science/math/pari/default.nix b/pkgs/applications/science/math/pari/default.nix
index 91cf4ae4f389..4c0032e6c8b3 100644
--- a/pkgs/applications/science/math/pari/default.nix
+++ b/pkgs/applications/science/math/pari/default.nix
@@ -14,7 +14,7 @@ assert withThread -> libpthreadstubs != null;
 
 stdenv.mkDerivation rec {
   pname = "pari";
-  version = "2.15.1";
+  version = "2.15.2";
 
   src = fetchurl {
     urls = [
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
       # old versions are at the url below
       "https://pari.math.u-bordeaux.fr/pub/pari/OLD/${lib.versions.majorMinor version}/${pname}-${version}.tar.gz"
     ];
-    hash = "sha256-RUGdt3xmhb7mfkLg7LeOGe9WK+eq/GN8ikGXDy6Qnj0=";
+    hash = "sha256-sEYoER7iKHZRmksc2vsy/rqjTq+iT56B9Y+NBX++4N0=";
   };
 
   buildInputs = [
diff --git a/pkgs/applications/terminal-emulators/kitty/default.nix b/pkgs/applications/terminal-emulators/kitty/default.nix
index f2c146fa8db2..9725e8a4f96b 100644
--- a/pkgs/applications/terminal-emulators/kitty/default.nix
+++ b/pkgs/applications/terminal-emulators/kitty/default.nix
@@ -97,8 +97,7 @@ buildPythonApplication rec {
   hardeningDisable = lib.optional stdenv.cc.isClang "strictoverflow";
 
   CGO_ENABLED = 0;
-  GO_FLAGS = "-trimpath";
-  disallowedReferences = [ go ];
+  GOFLAGS = "-trimpath";
 
   configurePhase = let
     goModules = (buildGoModule {
diff --git a/pkgs/applications/version-management/tig/default.nix b/pkgs/applications/version-management/tig/default.nix
index cfce8a35f9e1..ada5f9fea640 100644
--- a/pkgs/applications/version-management/tig/default.nix
+++ b/pkgs/applications/version-management/tig/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "tig";
-  version = "2.5.7";
+  version = "2.5.8";
 
   src = fetchFromGitHub {
     owner = "jonas";
     repo = pname;
     rev = "${pname}-${version}";
-    sha256 = "sha256-D5NQaxkGhwyBoScI7fZxnSHC0ABmsUeRf8pZCKooV3w=";
+    sha256 = "sha256-VuuqR5fj0YvqIfVPH7N3rpAfIbcTwOx9W3H60saCToQ=";
   };
 
   nativeBuildInputs = [ makeWrapper autoreconfHook asciidoc xmlto docbook_xsl docbook_xml_dtd_45 findXMLCatalogs pkg-config ];
diff --git a/pkgs/applications/video/makemkv/default.nix b/pkgs/applications/video/makemkv/default.nix
index d083f1eda20a..110c48c1e4ab 100644
--- a/pkgs/applications/video/makemkv/default.nix
+++ b/pkgs/applications/video/makemkv/default.nix
@@ -14,21 +14,21 @@
 }:
 
 let
-  version = "1.17.2";
+  version = "1.17.3";
   # Using two URLs as the first one will break as soon as a new version is released
   src_bin = fetchurl {
     urls = [
       "http://www.makemkv.com/download/makemkv-bin-${version}.tar.gz"
       "http://www.makemkv.com/download/old/makemkv-bin-${version}.tar.gz"
     ];
-    sha256 = "sha256-gACMzJ7oZCk/INSeJaV7GnF9hy/6F9d0QDLp5jPiF4k=";
+    sha256 = "1cd633bfb381faa4f22ab57f6b75053c1b18997c223ed7988896c8c15cd1bee0";
   };
   src_oss = fetchurl {
     urls = [
       "http://www.makemkv.com/download/makemkv-oss-${version}.tar.gz"
       "http://www.makemkv.com/download/old/makemkv-oss-${version}.tar.gz"
     ];
-    sha256 = "sha256-qD+Kuz8j3vDch4PlNQYqdbffL3YSKRqKg6IfkLk/LaQ=";
+    sha256 = "16be3ee29c1dd3d5292f793e9f5efbcd30a59bf035de79586e9afbfa98a6a4cb";
   };
 
 in mkDerivation {
diff --git a/pkgs/build-support/fetchmavenartifact/default.nix b/pkgs/build-support/fetchmavenartifact/default.nix
index efdbd0decf95..b1d8593e72d4 100644
--- a/pkgs/build-support/fetchmavenartifact/default.nix
+++ b/pkgs/build-support/fetchmavenartifact/default.nix
@@ -43,13 +43,15 @@ let
       (lib.replaceStrings ["."] ["_"] artifactId) "-"
       version
     ];
+  suffix = if isNull classifier then "" else "-${classifier}";
+  filename = "${artifactId}-${version}${suffix}.jar";
   mkJarUrl = repoUrl:
     lib.concatStringsSep "/" [
       (lib.removeSuffix "/" repoUrl)
       (lib.replaceStrings ["."] ["/"] groupId)
       artifactId
       version
-      "${artifactId}-${version}${lib.optionalString (!isNull classifier) "-${classifier}"}.jar"
+      filename
     ];
   urls_ =
     if url != "" then [url]
@@ -68,7 +70,7 @@ in
     # packages packages that mention this derivation in their buildInputs.
     installPhase = ''
       mkdir -p $out/share/java
-      ln -s ${jar} $out/share/java/${artifactId}-${version}.jar
+      ln -s ${jar} $out/share/java/${filename}
     '';
     # We also add a `jar` attribute that can be used to easily obtain the path
     # to the downloaded jar file.
diff --git a/pkgs/build-support/trivial-builders.nix b/pkgs/build-support/trivial-builders.nix
index d8aa6c232444..7318d13f6bab 100644
--- a/pkgs/build-support/trivial-builders.nix
+++ b/pkgs/build-support/trivial-builders.nix
@@ -509,8 +509,8 @@ rec {
       ''
         mkdir -p $out
         for i in $(cat $pathsPath); do
-          ${lndir}/bin/lndir -silent $i $out
-        done
+          ${lndir}/bin/lndir $i $out
+        done 2>&1 | sed 's/^/symlinkJoin: warning: keeping existing file: /'
         ${postBuild}
       '';
 
diff --git a/pkgs/data/fonts/blackout/default.nix b/pkgs/data/fonts/blackout/default.nix
new file mode 100644
index 000000000000..b615aa66c59c
--- /dev/null
+++ b/pkgs/data/fonts/blackout/default.nix
@@ -0,0 +1,36 @@
+{ lib, fetchFromGitHub, stdenvNoCC }:
+
+stdenvNoCC.mkDerivation (self: {
+  pname = "blackout";
+  version = "2014-07-29";
+
+  src = fetchFromGitHub {
+    owner = "theleagueof";
+    repo = self.pname;
+    rev = "4864cfc1749590e9f78549c6e57116fe98480c0f";
+    hash = "sha256-UmJVmtuPQYW/w+mdnJw9Ql4R1xf/07l+/Ky1wX9WKqw=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D -m444 -t $out/share/fonts/truetype $src/*.ttf
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "A bad-ass, unholy-mother-shut-your-mouth stencil sans-serif";
+    longDescription = ''
+      Eats holes for breakfast lunch and dinner. Inspired by filling in
+      sans-serif newspaper headlines. Continually updated with coffee and
+      music. Makes your work louder than the next person’s.
+
+      Comes in three styles: Midnight (solid), 2AM (reversed), & Sunrise
+      (stroked).
+    '';
+    homepage = "https://www.theleagueofmoveabletype.com/blackout";
+    license = lib.licenses.ofl;
+    maintainers = with lib.maintainers; [ minijackson ];
+  };
+})
diff --git a/pkgs/data/fonts/chunk/default.nix b/pkgs/data/fonts/chunk/default.nix
new file mode 100644
index 000000000000..708393185e94
--- /dev/null
+++ b/pkgs/data/fonts/chunk/default.nix
@@ -0,0 +1,38 @@
+{ lib, fetchFromGitHub, stdenvNoCC }:
+
+stdenvNoCC.mkDerivation (self: {
+  pname = "chunk";
+  version = "2021-03-03";
+
+  src = fetchFromGitHub {
+    owner = "theleagueof";
+    repo = self.pname;
+    rev = "12a243f3fb7c7a68844901023f7d95d6eaf14104";
+    hash = "sha256-NMkRvrUgy9yzOT3a1rN6Ch/p8Cr902CwL4G0w7jVm1E=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D -m444 -t $out/share/fonts/truetype $src/*.ttf
+    install -D -m444 -t $out/share/fonts/opentype $src/*.otf
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "An ultra-bold, ultra-awesome slab serif typeface";
+    longDescription = ''
+      Chunk is an ultra-bold slab serif typeface that is reminiscent of old
+      American Western woodcuts, broadsides, and newspaper headlines. Used
+      mainly for display, the fat block lettering is unreserved yet refined for
+      contemporary use.
+
+      In 2014, a new textured style was created by Tyler Finck called Chunk
+      Five Print. It contains the same glyphs as the original.
+    '';
+    homepage = "https://www.theleagueofmoveabletype.com/chunk";
+    license = lib.licenses.ofl;
+    maintainers = with lib.maintainers; [ minijackson ];
+  };
+})
diff --git a/pkgs/data/fonts/fanwood/default.nix b/pkgs/data/fonts/fanwood/default.nix
new file mode 100644
index 000000000000..ef8be0a6522a
--- /dev/null
+++ b/pkgs/data/fonts/fanwood/default.nix
@@ -0,0 +1,32 @@
+{ lib, fetchFromGitHub, stdenvNoCC }:
+
+stdenvNoCC.mkDerivation (self: {
+  pname = "fanwood";
+  version = "2011-05-11";
+
+  src = fetchFromGitHub {
+    owner = "theleagueof";
+    repo = self.pname;
+    rev = "cbaaed9704e7d37d3dcdbdf0b472e9efd0e39432";
+    hash = "sha256-OroFhhb4RxPHkx+/8PtFnxs1GQVXMPiYTd+2vnRbIjg=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D -m444 -t $out/share/fonts/opentype $src/*.otf
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "A serif based on the work of a famous Czech-American type designer of yesteryear";
+    longDescription = ''
+      Based on work of a famous Czech-American type designer of yesteryear. The
+      package includes roman and italic.
+    '';
+    homepage = "https://www.theleagueofmoveabletype.com/fanwood";
+    license = lib.licenses.ofl;
+    maintainers = with lib.maintainers; [ minijackson ];
+  };
+})
diff --git a/pkgs/data/fonts/goudy-bookletter-1911/default.nix b/pkgs/data/fonts/goudy-bookletter-1911/default.nix
new file mode 100644
index 000000000000..3fd0352b5557
--- /dev/null
+++ b/pkgs/data/fonts/goudy-bookletter-1911/default.nix
@@ -0,0 +1,28 @@
+{ lib, fetchFromGitHub, stdenvNoCC }:
+
+stdenvNoCC.mkDerivation (self: {
+  pname = "goudy-bookletter-1911";
+  version = "2011-05-11";
+
+  src = fetchFromGitHub {
+    owner = "theleagueof";
+    repo = self.pname;
+    rev = "85ff5b834b4f63feb36fd2053949c19660580e48";
+    hash = "sha256-11axs1+SRQj+1lYTq2LYf1I65WrrvB/UnAgZkHPP1N8=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D -m444 -t $out/share/fonts/opentype $src/*.otf
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "A public domain font based on Frederic Goudy’s Kennerley Oldstyle";
+    homepage = "https://www.theleagueofmoveabletype.com/goudy-bookletter-1911";
+    license = lib.licenses.ofl;
+    maintainers = with lib.maintainers; [ minijackson ];
+  };
+})
diff --git a/pkgs/data/fonts/junction/default.nix b/pkgs/data/fonts/junction/default.nix
new file mode 100644
index 000000000000..7f5ba5c4a201
--- /dev/null
+++ b/pkgs/data/fonts/junction/default.nix
@@ -0,0 +1,34 @@
+{ lib, fetchFromGitHub, stdenvNoCC }:
+
+stdenvNoCC.mkDerivation (self: {
+  pname = "junction";
+  version = "2014-05-29";
+
+  src = fetchFromGitHub {
+    owner = "theleagueof";
+    repo = self.pname;
+    rev = "fb73260e86dd301b383cf6cc9ca8e726ef806535";
+    hash = "sha256-Zqh23HPWGed+JkADYjYdsVNRxqJDvC9xhnqAqWZ3Eu8=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D -m444 -t $out/share/fonts/opentype $src/*.otf
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Junction is a a humanist sans-serif font";
+    longDescription = ''
+      Junction is a a humanist sans-serif, and the first open-source type
+      project started by The League of Moveable Type. It has been updated
+      (2014) to include additional weights (light/bold) and expanded
+      international support.
+    '';
+    homepage = "https://www.theleagueofmoveabletype.com/junction";
+    license = lib.licenses.ofl;
+    maintainers = with lib.maintainers; [ minijackson ];
+  };
+})
diff --git a/pkgs/data/fonts/knewave/default.nix b/pkgs/data/fonts/knewave/default.nix
new file mode 100644
index 000000000000..eaadb7afc0de
--- /dev/null
+++ b/pkgs/data/fonts/knewave/default.nix
@@ -0,0 +1,32 @@
+{ lib, fetchFromGitHub, stdenvNoCC }:
+
+stdenvNoCC.mkDerivation (self: {
+  pname = "knewave";
+  version = "2012-07-30";
+
+  src = fetchFromGitHub {
+    owner = "theleagueof";
+    repo = self.pname;
+    rev = "f335d5ff1f12e4acf97d4208e1c37b4d386e57fb";
+    hash = "sha256-SaJU2GlxU7V3iJNQzFKg1YugaPsiJuSZpC8NCqtWyz0=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D -m444 -t $out/share/fonts/truetype $src/*.ttf
+    install -D -m444 -t $out/share/fonts/opentype $src/*.otf
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = " A bold, painted face for the rocker within";
+    longDescription = ''
+      Knewave is bold, painted face. Get it? Git it.
+    '';
+    homepage = "https://www.theleagueofmoveabletype.com/knewave";
+    license = lib.licenses.ofl;
+    maintainers = with lib.maintainers; [ minijackson ];
+  };
+})
diff --git a/pkgs/data/fonts/league-gothic/default.nix b/pkgs/data/fonts/league-gothic/default.nix
new file mode 100644
index 000000000000..4186eb70f6db
--- /dev/null
+++ b/pkgs/data/fonts/league-gothic/default.nix
@@ -0,0 +1,39 @@
+{ lib, fetchzip, stdenvNoCC }:
+
+stdenvNoCC.mkDerivation (self: {
+  pname = "league-gothic";
+  version = "1.601";
+
+  src = fetchzip {
+    url = "https://github.com/theleagueof/league-gothic/releases/download/${self.version}/LeagueGothic-${self.version}.tar.xz";
+    hash = "sha256-emkXKyQw4R0Zgg02oJsvBkqV0jmczP0tF0K2IKqJHMA=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D -m444 -t $out/share/fonts/truetype $src/static/TTF/*.ttf
+    install -D -m444 -t $out/share/fonts/opentype $src/static/OTF/*.otf
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "A revival of an old classic, Alternate Gothic #1";
+    longDescription = ''
+      League Gothic is a revival of an old classic, and one of our favorite
+      typefaces, Alternate Gothic #1. It was originally designed by Morris
+      Fuller Benton for the American Type Founders Company in 1903. The company
+      went bankrupt in 1993, and since the original typeface was created before
+      1923, the typeface is in the public domain.
+
+      We decided to make our own version, and contribute it to the Open Source
+      Type Movement. Thanks to a commission from the fine & patient folks over
+      at WND.com, it’s been revised & updated with contributions from Micah
+      Rich, Tyler Finck, and Dannci, who contributed extra glyphs.
+    '';
+    homepage = "https://www.theleagueofmoveabletype.com/league-gothic";
+    license = lib.licenses.ofl;
+    maintainers = with lib.maintainers; [ minijackson ];
+  };
+})
diff --git a/pkgs/data/fonts/league-of-moveable-type/default.nix b/pkgs/data/fonts/league-of-moveable-type/default.nix
index f6855dc99d66..905cf0a9adec 100644
--- a/pkgs/data/fonts/league-of-moveable-type/default.nix
+++ b/pkgs/data/fonts/league-of-moveable-type/default.nix
@@ -1,35 +1,46 @@
-{lib, stdenv, fetchurl, unzip, raleway}:
+{ lib
+, symlinkJoin
+, the-neue-black
+, blackout
+, chunk
+, fanwood
+, goudy-bookletter-1911
+, junction-font
+, knewave
+, league-gothic
+, league-script-number-one
+, league-spartan
+, linden-hill
+, orbitron
+, ostrich-sans
+, prociono
+, raleway
+, sniglet
+, sorts-mill-goudy
+}:
 
-let
+symlinkJoin {
+  name = "league-of-moveable-type";
 
-  # TO UPDATE:
-  # ./update.sh > ./fonts.nix
-  # we use the extended version of raleway (same license).
-  fonts = [raleway]
-    ++ map fetchurl (builtins.filter (f: f.name != "raleway.zip") (import ./fonts.nix));
-
-in
-stdenv.mkDerivation rec {
-
-  baseName = "league-of-moveable-type";
-  version = "2016-10-15";
-  name="${baseName}-${version}";
-
-  srcs = fonts;
-
-  nativeBuildInputs = [ unzip ];
-  sourceRoot = ".";
-
-  installPhase = ''
-    mkdir -p $out/share/fonts/opentype
-    cp */*.otf $out/share/fonts/opentype
-    # for Raleway, where the fonts are already in /share/…
-    cp */share/fonts/opentype/*.otf $out/share/fonts/opentype
-  '';
-
-  outputHashAlgo = "sha256";
-  outputHashMode = "recursive";
-  outputHash = "1gy959qhhdwm1phbrkab9isi0dmxcy0yizzncb0k49w88mc13vd0";
+  paths = [
+    the-neue-black
+    blackout
+    chunk
+    fanwood
+    goudy-bookletter-1911
+    junction-font
+    knewave
+    league-gothic
+    league-script-number-one
+    league-spartan
+    linden-hill
+    orbitron
+    ostrich-sans
+    prociono
+    raleway
+    sniglet
+    sorts-mill-goudy
+  ];
 
   meta = {
     description = "Font Collection by The League of Moveable Type";
@@ -46,6 +57,6 @@ stdenv.mkDerivation rec {
     license = lib.licenses.ofl;
 
     platforms = lib.platforms.all;
-    maintainers = with lib.maintainers; [ bergey Profpatsch ];
+    maintainers = with lib.maintainers; [ bergey minijackson Profpatsch ];
   };
 }
diff --git a/pkgs/data/fonts/league-of-moveable-type/fonts.nix b/pkgs/data/fonts/league-of-moveable-type/fonts.nix
deleted file mode 100644
index efbe6a4c41cb..000000000000
--- a/pkgs/data/fonts/league-of-moveable-type/fonts.nix
+++ /dev/null
@@ -1,82 +0,0 @@
-[
-  {
-    url = "https://www.theleagueofmoveabletype.com/league-spartan/download";
-    sha256 = "1z9pff8xm58njs7whaxb3sq4vbdkxv7llwgm9nqhwshmgr52jrm1";
-    name = "league-spartan.zip";
-  }
-  {
-    url = "https://www.theleagueofmoveabletype.com/junction/download";
-    sha256 = "1qbhfha012ma26n43lm1fh06i7z47wk50r8qsp09bpxc5yr4ypi7";
-    name = "junction.zip";
-  }
-  {
-    url = "https://www.theleagueofmoveabletype.com/ostrich-sans/download";
-    sha256 = "11ydhbgcfhmydcnim64vb035cha14krxxrbf62426dm6bvxkphp3";
-    name = "ostrich-sans.zip";
-  }
-  {
-    url = "https://www.theleagueofmoveabletype.com/league-gothic/download";
-    sha256 = "0nbwsbwhs375kbis3lpk98dw05mnh455vghjg1cq0j2fsj1zb99b";
-    name = "league-gothic.zip";
-  }
-  {
-    url = "https://www.theleagueofmoveabletype.com/blackout/download";
-    sha256 = "1r7dihnjvy4fgvaj5m4llc9dm4cpdl1l79mhg3as16qvjgazms3p";
-    name = "blackout.zip";
-  }
-  {
-    url = "https://www.theleagueofmoveabletype.com/knewave/download";
-    sha256 = "065yiakhm6h6jkmigj4pqm2qi6saph0pwb7g8s9gwkskhkk5iy57";
-    name = "knewave.zip";
-  }
-  {
-    url = "https://www.theleagueofmoveabletype.com/fanwood/download";
-    sha256 = "1023da7hik8ci8s7rcy6lh4h9p6igx1kz9y1a2cv6sizbp819w8g";
-    name = "fanwood.zip";
-  }
-  {
-    url = "https://www.theleagueofmoveabletype.com/linden-hill/download";
-    sha256 = "0rm92rz9kki91l5wcn149mdpwq1mfql4dv6d159hv534qmg3z3ks";
-    name = "linden-hill.zip";
-  }
-  {
-    url = "https://www.theleagueofmoveabletype.com/league-script-number-one/download";
-    sha256 = "056hb02a5vydrq5q0gwzanp2zkrrv1spm8sfc5wzhyfzgwd1vc76";
-    name = "league-script-number-one.zip";
-  }
-  {
-    url = "https://www.theleagueofmoveabletype.com/raleway/download";
-    sha256 = "0f6anym0adq0ankqbdqx4lyzbysx824zqdj1x60gafyisjx48y87";
-    name = "raleway.zip";
-  }
-  {
-    url = "https://www.theleagueofmoveabletype.com/prociono/download";
-    sha256 = "11hamjry5lx3cykzpjq7kwlp6h9cjqy470fmn9f2pi954b46xkdy";
-    name = "prociono.zip";
-  }
-  {
-    url = "https://www.theleagueofmoveabletype.com/orbitron/download";
-    sha256 = "156w4j324d350pvjmzdg2w8inhhdfzrvb86rhlavgd9sxx2fykk4";
-    name = "orbitron.zip";
-  }
-  {
-    url = "https://www.theleagueofmoveabletype.com/goudy-bookletter-1911/download";
-    sha256 = "01qganq5n7rgqw546lf45kj8j7ymfjr00i2bwp3qw7ibifg9pn4n";
-    name = "goudy-bookletter-1911.zip";
-  }
-  {
-    url = "https://www.theleagueofmoveabletype.com/sorts-mill-goudy/download";
-    sha256 = "11aywj5lzapk04k2yzi1g96acbbm48x902ka0v9cfwwqpn6js9ra";
-    name = "sorts-mill-goudy.zip";
-  }
-  {
-    url = "https://www.theleagueofmoveabletype.com/chunk/download";
-    sha256 = "15mbqwz90y1n4vlj2xkc8vd56va6la5qnxhiipvcmkrng5y3931j";
-    name = "chunk.zip";
-  }
-  {
-    url = "https://www.theleagueofmoveabletype.com/sniglet/download";
-    sha256 = "1lhpnjm52gyhy9s2kwbsg1rd9iyrqli5q9ngp141igx4p1bgbqkc";
-    name = "sniglet.zip";
-  }
-]
diff --git a/pkgs/data/fonts/league-of-moveable-type/update.sh b/pkgs/data/fonts/league-of-moveable-type/update.sh
deleted file mode 100644
index 4d41df4fdb85..000000000000
--- a/pkgs/data/fonts/league-of-moveable-type/update.sh
+++ /dev/null
@@ -1,25 +0,0 @@
-#!/usr/bin/env bash
-
-SITE=https://www.theleagueofmoveabletype.com
-
-# since there is no nice way to get all the fonts,
-# this fetches the homepage and extracts their names from the html …
-fonts=$(curl "$SITE" 2>/dev/null | \
-            sed -ne 's/<img.*cloudfront.*images\/\(.*\)-[[:digit:]-]\..*$/\1/p')
-
-# build an ad-hoc nixexpr list with the files & hashes
-echo "["
-for f in $fonts; do
-    url="$SITE/$f/download"
-    hash=$(nix-prefetch-url --type sha256 "$url" 2>/dev/null)
-    cat <<EOF
-  {
-    url = "$url";
-    sha256 = "$hash";
-    name = "$f.zip";
-  }
-EOF
-done
-echo "]"
-
-
diff --git a/pkgs/data/fonts/league-script-number-one/default.nix b/pkgs/data/fonts/league-script-number-one/default.nix
new file mode 100644
index 000000000000..11d7dc6173c5
--- /dev/null
+++ b/pkgs/data/fonts/league-script-number-one/default.nix
@@ -0,0 +1,35 @@
+{ lib, fetchFromGitHub, stdenvNoCC }:
+
+stdenvNoCC.mkDerivation (self: {
+  pname = "league-script-number-one";
+  version = "2011-05-25";
+
+  src = fetchFromGitHub {
+    owner = "theleagueof";
+    repo = self.pname;
+    rev = "225add0b37cf8268759ba4572e02630d9fb54ecf";
+    hash = "sha256-Z3Zrp0Os3On0tESVical1Qh6wY1H2Hc0OPTlkbtsrCI=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D -m444 -t $out/share/fonts/opentype $src/*.otf
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "A modern, coquettish script font";
+    longDescription = ''
+      This ain’t no Lucinda. League Script #1 is a modern, coquettish script
+      font that sits somewhere between your high school girlfriend’s love notes
+      and handwritten letters from the ’20s. Designed exclusively for the
+      League of Moveable Type, it includes ligatures and will act as the
+      framework for future script designs.
+    '';
+    homepage = "https://www.theleagueofmoveabletype.com/league-script";
+    license = lib.licenses.ofl;
+    maintainers = with lib.maintainers; [ minijackson ];
+  };
+})
diff --git a/pkgs/data/fonts/league-spartan/default.nix b/pkgs/data/fonts/league-spartan/default.nix
new file mode 100644
index 000000000000..599aeca8ca65
--- /dev/null
+++ b/pkgs/data/fonts/league-spartan/default.nix
@@ -0,0 +1,40 @@
+{ lib, fetchzip, stdenvNoCC }:
+
+stdenvNoCC.mkDerivation (self: {
+  pname = "league-spartan";
+  version = "2.220";
+
+  src = fetchzip {
+    url = "https://github.com/theleagueof/league-spartan/releases/download/${self.version}/LeagueSpartan-${self.version}.tar.xz";
+    hash = "sha256-dkvWRYli8vk+E0DkZ2NWCJKfSfdo4jEcGo0puQpFVVc=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D -m444 -t $out/share/fonts/truetype $src/static/TTF/*.ttf
+    install -D -m444 -t $out/share/fonts/opentype $src/static/OTF/*.otf
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "A fantastic new revival of ATF's classic Spartan, a geometric sans-serif that has no problem kicking its enemies in the chest.";
+    longDescription = ''
+      A new classic, this is a bold, modern, geometric sans-serif that has no
+      problem kicking its enemies in the chest.
+
+      Taking a strong influence from ATF's classic Spartan family, we're
+      starting our own family out with a single strong weight. We've put a few
+      unique touches into a beautiful, historical typeface, and made sure to
+      include an extensive characterset – currently totaling over 300 glyphs.
+
+      Over time, the open-source license will allow us expand League Spartan
+      into a full family, with multiple weights and styles, and we're starting
+      by releasing our first Bold style for this exciting, modern classic now.
+    '';
+    homepage = "https://www.theleagueofmoveabletype.com/league-spartan";
+    license = lib.licenses.ofl;
+    maintainers = with lib.maintainers; [ minijackson ];
+  };
+})
diff --git a/pkgs/data/fonts/linden-hill/default.nix b/pkgs/data/fonts/linden-hill/default.nix
new file mode 100644
index 000000000000..f48313fd4ac9
--- /dev/null
+++ b/pkgs/data/fonts/linden-hill/default.nix
@@ -0,0 +1,32 @@
+{ lib, fetchFromGitHub, stdenvNoCC }:
+
+stdenvNoCC.mkDerivation (self: {
+  pname = "linden-hill";
+  version = "2011-05-25";
+
+  src = fetchFromGitHub {
+    owner = "theleagueof";
+    repo = self.pname;
+    rev = "a3f7ae6c4cac1b7e5ce5269e1fcc6a2fbb9e31ee";
+    hash = "sha256-EjXcLjzVQeOJgLxGua8t0oMc+APOsONGGpG6VJVCgFw=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D -m444 -t $out/share/fonts/opentype $src/*.otf
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "A digital version of Frederic Goudy’s Deepdene";
+    longDescription = ''
+      Linden Hill is a digital version of Frederic Goudy’s Deepdene. The
+      package includes roman and italic.
+    '';
+    homepage = "https://www.theleagueofmoveabletype.com/linden-hill";
+    license = lib.licenses.ofl;
+    maintainers = with lib.maintainers; [ minijackson ];
+  };
+})
diff --git a/pkgs/data/fonts/orbitron/default.nix b/pkgs/data/fonts/orbitron/default.nix
index 973c79f667a3..dcbf0085141e 100644
--- a/pkgs/data/fonts/orbitron/default.nix
+++ b/pkgs/data/fonts/orbitron/default.nix
@@ -1,21 +1,21 @@
 { lib, stdenvNoCC, fetchFromGitHub }:
 
-stdenvNoCC.mkDerivation {
+stdenvNoCC.mkDerivation (self: {
   pname = "orbitron";
-  version = "20110526";
+  version = "2011-05-25";
 
   src = fetchFromGitHub {
     owner = "theleagueof";
-    repo = "orbitron";
-    rev = "13e6a52";
+    repo = self.pname;
+    rev = "13e6a5222aa6818d81c9acd27edd701a2d744152";
     hash = "sha256-zjNPVrDUxcQbrsg1/8fFa6Wenu1yuG/XDfKA7NVZ0rA=";
   };
 
   installPhase = ''
     runHook preInstall
 
-    install -m444 -Dt $out/share/fonts/opentype/orbitron *.otf
-    install -m444 -Dt $out/share/fonts/ttf/orbitron      *.ttf
+    install -D -m444 -t $out/share/fonts/truetype $src/*.ttf
+    install -D -m444 -t $out/share/fonts/opentype $src/*.otf
 
     runHook postInstall
   '';
@@ -43,6 +43,6 @@ stdenvNoCC.mkDerivation {
     '';
     license = licenses.ofl;
     platforms = platforms.all;
-    maintainers = [ maintainers.leenaars ];
+    maintainers = with lib.maintainers; [ leenaars minijackson ];
   };
-}
+})
diff --git a/pkgs/data/fonts/ostrich-sans/default.nix b/pkgs/data/fonts/ostrich-sans/default.nix
new file mode 100644
index 000000000000..b86727312ec1
--- /dev/null
+++ b/pkgs/data/fonts/ostrich-sans/default.nix
@@ -0,0 +1,32 @@
+{ lib, fetchFromGitHub, stdenvNoCC }:
+
+stdenvNoCC.mkDerivation (self: {
+  pname = "ostrich-sans";
+  version = "2014-04-18";
+
+  src = fetchFromGitHub {
+    owner = "theleagueof";
+    repo = self.pname;
+    rev = "a949d40d0576d12ba26e2a45e19c91fd0228c964";
+    hash = "sha256-vvTNtl+fO2zWooH1EvCmO/dPYYgCkj8Ckg5xfg1gtnw=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D -m444 -t $out/share/fonts/opentype $src/*.otf
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "A gorgeous modern sans-serif with a very long neck";
+    longDescription = ''
+      A gorgeous modern sans-serif with a very long neck. With a whole slew of
+      styles & weights.
+    '';
+    homepage = "https://www.theleagueofmoveabletype.com/ostrich-sans";
+    license = lib.licenses.ofl;
+    maintainers = with lib.maintainers; [ minijackson ];
+  };
+})
diff --git a/pkgs/data/fonts/prociono/default.nix b/pkgs/data/fonts/prociono/default.nix
new file mode 100644
index 000000000000..b5bdf4d22926
--- /dev/null
+++ b/pkgs/data/fonts/prociono/default.nix
@@ -0,0 +1,34 @@
+{ lib, fetchFromGitHub, stdenvNoCC }:
+
+stdenvNoCC.mkDerivation (self: {
+  pname = "prociono";
+  version = "2011-05-25";
+
+  src = fetchFromGitHub {
+    owner = "theleagueof";
+    repo = self.pname;
+    rev = "f9d9680de6d6f0c13939f23c9dd14cd7853cf844";
+    hash = "sha256-gC5E0Z0O2cnthoBEu+UOQLsr3/a/3/JPIx3WCPsXXtk=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D -m444 -t $out/share/fonts/truetype $src/*.ttf
+    install -D -m444 -t $out/share/fonts/opentype $src/*.otf
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "A roman serif with blackletter elements";
+    longDescription = ''
+      "Prociono" (pro-tsee-O-no) is an Esperanto word meaning either the star
+      Procyon or the animal species known as the raccoon. It is a roman serif
+      with blackletter elements.
+    '';
+    homepage = "https://www.theleagueofmoveabletype.com/prociono";
+    license = lib.licenses.ofl;
+    maintainers = with lib.maintainers; [ minijackson ];
+  };
+})
diff --git a/pkgs/data/fonts/raleway/default.nix b/pkgs/data/fonts/raleway/default.nix
index 935fde722ed9..c1d766f7d36b 100644
--- a/pkgs/data/fonts/raleway/default.nix
+++ b/pkgs/data/fonts/raleway/default.nix
@@ -1,44 +1,40 @@
-{ lib, stdenvNoCC, fetchFromGitHub }:
+{ lib, fetchzip, stdenvNoCC }:
 
-stdenvNoCC.mkDerivation {
+stdenvNoCC.mkDerivation (self: {
   pname = "raleway";
-  version = "2016-08-30";
+  version = "4.101";
 
-  src = fetchFromGitHub {
-    owner = "impallari";
-    repo = "Raleway";
-    rev = "fa27f47b087fc093c6ae11cfdeb3999ac602929a";
-    hash = "sha256-mcIpE+iqG6M43I5TT95oV+5kNgphunmyxC+Jaj0JysQ=";
+  src = fetchzip {
+    url = "https://github.com/theleagueof/raleway/releases/download/${self.version}/Raleway-${self.version}.tar.xz";
+    hash = "sha256-itNHIMoRjiaqYAJoDNetkCquv47VAfel8MAzwsd//Ww=";
   };
 
   installPhase = ''
     runHook preInstall
 
-    find . -name "*-Original.otf" -exec install -Dt $out/share/fonts/opentype {} \;
+    install -D -m444 -t $out/share/fonts/truetype $src/static/TTF/*.ttf
+    install -D -m444 -t $out/share/fonts/opentype $src/static/OTF/*.otf
 
     runHook postInstall
   '';
 
   meta = {
     description = "Raleway is an elegant sans-serif typeface family";
-
     longDescription = ''
       Initially designed by Matt McInerney as a single thin weight, it was
       expanded into a 9 weight family by Pablo Impallari and Rodrigo Fuenzalida
-      in 2012 and iKerned by Igino Marini. In 2013 the Italics where added.
+      in 2012 and iKerned by Igino Marini. In 2013 the Italics where added, and
+      most recently — a variable version.
 
-      It is a display face and the download features both old style and lining
-      numerals, standard and discretionary ligatures, a pretty complete set of
-      diacritics, as well as a stylistic alternate inspired by more geometric
-      sans-serif typefaces than its neo-grotesque inspired default character
-      set.
+      It features both old style and lining numerals, standard and
+      discretionary ligatures, a pretty complete set of diacritics, as well as
+      a stylistic alternate inspired by more geometric sans-serif typefaces
+      than its neo-grotesque inspired default character set.
 
       It also has a sister display family, Raleway Dots.
     '';
-
-    homepage = "https://github.com/impallari/Raleway";
+    homepage = "https://www.theleagueofmoveabletype.com/raleway";
     license = lib.licenses.ofl;
-
-    maintainers = with lib.maintainers; [ Profpatsch ];
+    maintainers = with lib.maintainers; [ minijackson Profpatsch ];
   };
-}
+})
diff --git a/pkgs/data/fonts/sniglet/default.nix b/pkgs/data/fonts/sniglet/default.nix
new file mode 100644
index 000000000000..a109637a9a1b
--- /dev/null
+++ b/pkgs/data/fonts/sniglet/default.nix
@@ -0,0 +1,33 @@
+{ lib, fetchFromGitHub, stdenvNoCC }:
+
+stdenvNoCC.mkDerivation (self: {
+  pname = "sniglet";
+  version = "2011-05-25";
+
+  src = fetchFromGitHub {
+    owner = "theleagueof";
+    repo = self.pname;
+    rev = "5c6b0860bdd0d8c4f16222e4de3918c384db17c4";
+    hash = "sha256-fLT2hZT9o1Ka30EB/6oWwmalhVJ+swXLRFG99yRWd2c=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D -m444 -t $out/share/fonts/truetype $src/*.ttf
+    install -D -m444 -t $out/share/fonts/opentype $src/*.otf
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "A fun rounded display face that’s great for headlines";
+    longDescription = ''
+      A rounded display face that’s great for headlines. It comes with a full
+      character set, so you can type in Icelandic or even French!
+    '';
+    homepage = "https://www.theleagueofmoveabletype.com/sniglet";
+    license = lib.licenses.ofl;
+    maintainers = with lib.maintainers; [ minijackson ];
+  };
+})
diff --git a/pkgs/data/fonts/sorts-mill-goudy/default.nix b/pkgs/data/fonts/sorts-mill-goudy/default.nix
new file mode 100644
index 000000000000..432740a9267d
--- /dev/null
+++ b/pkgs/data/fonts/sorts-mill-goudy/default.nix
@@ -0,0 +1,36 @@
+{ lib, fetchFromGitHub, stdenvNoCC }:
+
+stdenvNoCC.mkDerivation (self: {
+  pname = "sorts-mill-goudy";
+  version = "2011-05-25";
+
+  src = fetchFromGitHub {
+    owner = "theleagueof";
+    repo = self.pname;
+    rev = "06072890c7b05f274215a24f17449655ccb2c8af";
+    hash = "sha256-NEfLBJatUmdUL5gJEimJHZfOd1OtI7pxTN97eWMODyM=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D -m444 -t $out/share/fonts/truetype $src/*.ttf
+    install -D -m444 -t $out/share/fonts/opentype $src/*.otf
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "A ‘revival’ of Goudy Oldstyle and Italic";
+    longDescription = ''
+      A 'revival' of Goudy Oldstyle and Italic, with features including small
+      capitals (in the roman only), oldstyle and lining figures, superscripts
+      and subscripts, fractions, ligatures, class-based kerning, case-sensitive
+      forms, and capital spacing. There is support for many languages using
+      latin scripts.
+    '';
+    homepage = "https://www.theleagueofmoveabletype.com/sorts-mill-goudy";
+    license = lib.licenses.ofl;
+    maintainers = with lib.maintainers; [ minijackson ];
+  };
+})
diff --git a/pkgs/data/fonts/the-neue-black/default.nix b/pkgs/data/fonts/the-neue-black/default.nix
new file mode 100644
index 000000000000..af3cd639c6e9
--- /dev/null
+++ b/pkgs/data/fonts/the-neue-black/default.nix
@@ -0,0 +1,33 @@
+{ lib, fetchzip, stdenvNoCC }:
+
+stdenvNoCC.mkDerivation (self: {
+  pname = "the-neue-black";
+  version = "1.007";
+
+  src = fetchzip {
+    url = "https://github.com/theleagueof/the-neue-black/releases/download/${self.version}/TheNeueBlack-${self.version}.tar.xz";
+    hash = "sha256-AsB6w1000xdl+pOPDXqqzQhru1T/VD0hIJ4gFec7mU4=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D -m444 -t $out/share/fonts/truetype $src/static/TTF/*.ttf
+    install -D -m444 -t $out/share/fonts/opentype $src/static/OTF/*.otf
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Tré Seals’ first open-source font, a typeface based on the Chicago Freedom Movement";
+    longDescription = ''
+      The open-source release of The Neue Black is in partnership with designer
+      Tré Seals of Vocal Type Co. The Neue Black is a display sans serif with a
+      robust character set that has over 25 ligatures and various inktrap
+      alternates.
+    '';
+    homepage = "https://www.theleagueofmoveabletype.com/the-neue-black";
+    license = lib.licenses.ofl;
+    maintainers = with lib.maintainers; [ minijackson ];
+  };
+})
diff --git a/pkgs/data/fonts/vazir-fonts/default.nix b/pkgs/data/fonts/vazir-fonts/default.nix
index 787d250068b7..d65b270c881f 100755
--- a/pkgs/data/fonts/vazir-fonts/default.nix
+++ b/pkgs/data/fonts/vazir-fonts/default.nix
@@ -2,13 +2,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "vazir-fonts";
-  version = "32.0.0";
+  version = "33.003";
 
   src = fetchFromGitHub {
     owner = "rastikerdar";
     repo = "vazir-font";
     rev = "v${version}";
-    hash = "sha256-lkjlSW3Sfr1bJ9/IOsZl9yOVh9mYKhoV5XcLkqcQ71g=";
+    hash = "sha256-C1UtfrRFzz0uv/hj8e7huXe4sNd5h7ozVhirWEAyXGg=";
   };
 
   dontBuild = true;
diff --git a/pkgs/data/misc/poppler-data/default.nix b/pkgs/data/misc/poppler-data/default.nix
index 6d35279b6de2..392761a9bd25 100644
--- a/pkgs/data/misc/poppler-data/default.nix
+++ b/pkgs/data/misc/poppler-data/default.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation rec {
   pname = "poppler-data";
-  version = "0.4.11";
+  version = "0.4.12";
 
   src = fetchurl {
     url = "https://poppler.freedesktop.org/${pname}-${version}.tar.gz";
-    sha256 = "LOwFzRuwOvmKiwah4i9ubhplseLzgWyzBpuwh0gl8Iw=";
+    sha256 = "yDW2QKQM41fhuDZmqr2V7f+iTd3dSbja/2OtuFHNq3Q=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/pantheon/apps/elementary-files/default.nix b/pkgs/desktops/pantheon/apps/elementary-files/default.nix
index a5586648621f..d2ec15c09c6c 100644
--- a/pkgs/desktops/pantheon/apps/elementary-files/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-files/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , nix-update-script
 , pkg-config
 , meson
@@ -29,7 +28,7 @@
 
 stdenv.mkDerivation rec {
   pname = "elementary-files";
-  version = "6.2.1";
+  version = "6.2.2";
 
   outputs = [ "out" "dev" ];
 
@@ -37,18 +36,9 @@ stdenv.mkDerivation rec {
     owner = "elementary";
     repo = "files";
     rev = version;
-    sha256 = "sha256-pJFeMG2aGaMkS00fSoRlMR2YSg5YzwqwaQT8G7Gk5S4=";
+    sha256 = "sha256-YV7fcRaLaDwa0m6zbdhayCAqeON5nqEdQ1IUtDKu5AY=";
   };
 
-  patches = [
-    # Ensure special user directory icon used for bookmark
-    # https://github.com/elementary/files/pull/2106
-    (fetchpatch {
-      url = "https://github.com/elementary/files/commit/00b1c2a975aeab378ed6eb1d90c8988f82596add.patch";
-      sha256 = "sha256-F/Vk7dg57uBBMO4WOJ/7kKbRNMZuWZ3QfrBfEIBozbw=";
-    })
-  ];
-
   nativeBuildInputs = [
     desktop-file-utils
     meson
diff --git a/pkgs/development/libraries/bullet/default.nix b/pkgs/development/libraries/bullet/default.nix
index 5203e941b3d0..e2658423ad35 100644
--- a/pkgs/development/libraries/bullet/default.nix
+++ b/pkgs/development/libraries/bullet/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "bullet";
-  version = "3.24";
+  version = "3.25";
 
   src = fetchFromGitHub {
     owner = "bulletphysics";
     repo = "bullet3";
     rev = version;
-    sha256 = "sha256-1zQZI1MdW0Ipg5XJeiFZQi/6cI0t6Ckralc5DE3auow=";
+    sha256 = "sha256-AGP05GoxLjHqlnW63/KkZe+TjO3IKcgBi+Qb/osQuCM=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/coordgenlibs/default.nix b/pkgs/development/libraries/coordgenlibs/default.nix
index bd89b18dc756..1d89025a51fa 100644
--- a/pkgs/development/libraries/coordgenlibs/default.nix
+++ b/pkgs/development/libraries/coordgenlibs/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "coordgenlibs";
-  version = "3.0.1";
+  version = "3.0.2";
 
   src = fetchFromGitHub {
     owner = "schrodinger";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-u8UmJ4bu00t7qxiNZ3nL7cd+8AIC0LoICj5FNPboCTQ=";
+    sha256 = "sha256-casFPNbPv9mkKpzfBENW7INClypuCO1L7clLGBXvSvI=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/exempi/default.nix b/pkgs/development/libraries/exempi/default.nix
index d17ca4ea751e..54bab95992c0 100644
--- a/pkgs/development/libraries/exempi/default.nix
+++ b/pkgs/development/libraries/exempi/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "exempi";
-  version = "2.6.2";
+  version = "2.6.3";
 
   src = fetchurl {
     url = "https://libopenraw.freedesktop.org/download/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-TRfUyT3yqV2j4xcsRbelvzF90x2v0cejQBaXKMcInR0=";
+    sha256 = "sha256-sHSdsYqeeM93FzeVSoOM3NsdVBWIi6wbqcr4y6d8ZWw=";
   };
 
   configureFlags = [
diff --git a/pkgs/development/libraries/libcdio-paranoia/default.nix b/pkgs/development/libraries/libcdio-paranoia/default.nix
index 36b591b0605b..bd39cfb71cb3 100644
--- a/pkgs/development/libraries/libcdio-paranoia/default.nix
+++ b/pkgs/development/libraries/libcdio-paranoia/default.nix
@@ -32,6 +32,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl3;
     maintainers = [ ];
     mainProgram = "cd-paranoia";
-    platforms = platforms.linux ++ platforms.darwin;
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/libraries/libks/default.nix b/pkgs/development/libraries/libks/default.nix
index f1b6d18a86b2..56a8e59433cd 100644
--- a/pkgs/development/libraries/libks/default.nix
+++ b/pkgs/development/libraries/libks/default.nix
@@ -6,17 +6,18 @@
 , pkg-config
 , libuuid
 , openssl
+, libossp_uuid
 }:
 
 stdenv.mkDerivation rec {
   pname = "libks";
-  version = "1.8.0";
+  version = "1.8.2";
 
   src = fetchFromGitHub {
     owner = "signalwire";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Bfp8+jqXu1utlaYuPewm+t3zHxaTWEw+cGZu1nFzkDk=";
+    sha256 = "sha256-TJ3q97K3m3zYGB1D5lLVyrh61L3vtnP5I64lP/DYzW4=";
   };
 
   patches = [
@@ -33,16 +34,15 @@ stdenv.mkDerivation rec {
     pkg-config
   ];
 
-  buildInputs = [
-    libuuid
-    openssl
-  ];
+  buildInputs = [ openssl ]
+    ++ lib.optional stdenv.isLinux libuuid
+    ++ lib.optional stdenv.isDarwin libossp_uuid;
 
   meta = with lib; {
     description = "Foundational support for signalwire C products";
     homepage = "https://github.com/signalwire/libks";
     maintainers = with lib.maintainers; [ misuzu ];
-    platforms = platforms.linux;
+    platforms = platforms.unix;
     license = licenses.mit;
   };
 }
diff --git a/pkgs/development/libraries/libvmaf/default.nix b/pkgs/development/libraries/libvmaf/default.nix
index e7add08871a6..c0fc4d1556f3 100644
--- a/pkgs/development/libraries/libvmaf/default.nix
+++ b/pkgs/development/libraries/libvmaf/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, meson, ninja, nasm }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, meson, ninja, nasm }:
 
 stdenv.mkDerivation rec {
   pname = "libvmaf";
@@ -13,6 +13,15 @@ stdenv.mkDerivation rec {
 
   sourceRoot = "source/libvmaf";
 
+  patches = [
+    # Backport fix for non-Linux, non-Darwin platforms.
+    (fetchpatch {
+      url = "https://github.com/Netflix/vmaf/commit/f47640f9ffee9494571bd7c9622e353660c93fc4.patch";
+      stripLen = 1;
+      sha256 = "rsTKuqp8VJG5DBDpixPke3LrdfjKzUO945i+iL0n7CY=";
+    })
+  ];
+
   nativeBuildInputs = [ meson ninja nasm ];
 
   mesonFlags = [ "-Denable_avx512=true" ];
diff --git a/pkgs/development/libraries/maeparser/default.nix b/pkgs/development/libraries/maeparser/default.nix
index 73b25bb014ad..16459987c13f 100644
--- a/pkgs/development/libraries/maeparser/default.nix
+++ b/pkgs/development/libraries/maeparser/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "maeparser";
-  version = "1.3.0";
+  version = "1.3.1";
 
   src = fetchFromGitHub {
     owner = "schrodinger";
     repo = "maeparser";
     rev = "v${version}";
-    sha256 = "sha256-9KxCR/spIZzePjmZe8qihIi1hEhPvxg/9dAlYmHxZPs=";
+    sha256 = "sha256-+eCTOU0rqFQC87wcxgINGLsULfbIr/wKxQTkRR59JVc=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/magic-enum/default.nix b/pkgs/development/libraries/magic-enum/default.nix
new file mode 100644
index 000000000000..c98143dcc4d6
--- /dev/null
+++ b/pkgs/development/libraries/magic-enum/default.nix
@@ -0,0 +1,26 @@
+{ fetchFromGitHub
+, lib
+, stdenv
+, cmake
+}:
+stdenv.mkDerivation rec{
+  pname = "magic-enum";
+  version = "0.8.2";
+  src = fetchFromGitHub {
+    owner = "Neargye";
+    repo = "magic_enum";
+    rev = "v${version}";
+    sha256 = "sha256-k4zCEQxO0N/o1hDYxw5p9u0BMwP/5oIoe/4yw7oqEo0=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  doCheck = true;
+
+  meta = with lib;{
+    description = "Static reflection for enums (to string, from string, iteration) for modern C++";
+    homepage = "https://github.com/Neargye/magic_enum";
+    license = licenses.mit;
+    maintainers = with maintainers; [ Alper-Celik ];
+  };
+}
diff --git a/pkgs/development/libraries/ngtcp2/default.nix b/pkgs/development/libraries/ngtcp2/default.nix
index d6cacc0aa7f7..d61a5d2fd9a7 100644
--- a/pkgs/development/libraries/ngtcp2/default.nix
+++ b/pkgs/development/libraries/ngtcp2/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ngtcp2";
-  version = "0.12.1";
+  version = "0.13.0";
 
   src = fetchFromGitHub {
     owner = "ngtcp2";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-nUUbGNxr2pGiEoYbArHppNE29rki9SM/3MZWMS9HmqY=";
+    sha256 = "sha256-rKEF5R1GubgFiblmdTqh26PxTRxIqXUJHxj0Qwd3N00=";
   };
 
   outputs = [ "out" "dev" "doc" ];
diff --git a/pkgs/development/libraries/openvino/cmake.patch b/pkgs/development/libraries/openvino/cmake.patch
new file mode 100644
index 000000000000..0918baba918f
--- /dev/null
+++ b/pkgs/development/libraries/openvino/cmake.patch
@@ -0,0 +1,31 @@
+diff --git a/cmake/developer_package/linux_name.cmake b/cmake/developer_package/linux_name.cmake
+index 3e8c775770..2d5e00fb8b 100644
+--- a/cmake/developer_package/linux_name.cmake
++++ b/cmake/developer_package/linux_name.cmake
+@@ -6,25 +6,7 @@ include(target_flags)
+ 
+ if(LINUX)
+     function(get_linux_name res_var)
+-        if(EXISTS "/etc/lsb-release")
+-            # linux version detection using cat /etc/lsb-release
+-            file(READ "/etc/lsb-release" release_data)
+-            set(name_regex "DISTRIB_ID=([^ \n]*)\n")
+-            set(version_regex "DISTRIB_RELEASE=([0-9]+(\\.[0-9]+)?)")
+-        else()
+-            execute_process(COMMAND find -L /etc/ -maxdepth 1 -type f -name *-release -exec cat {} \;
+-                            OUTPUT_VARIABLE release_data
+-                            RESULT_VARIABLE result)
+-            string(REPLACE "Red Hat" "CentOS" release_data "${release_data}")
+-            set(name_regex "NAME=\"([^ \"\n]*).*\"\n")
+-            set(version_regex "VERSION=\"([0-9]+(\\.[0-9]+)?)[^\n]*\"")
+-        endif()
+-
+-        string(REGEX MATCH ${name_regex} name ${release_data})
+-        set(os_name ${CMAKE_MATCH_1})
+-
+-        string(REGEX MATCH ${version_regex} version ${release_data})
+-        set(os_name "${os_name} ${CMAKE_MATCH_1}")
++        set(os_name "NixOS @version@")
+ 
+         if(os_name)
+             set(${res_var} ${os_name} PARENT_SCOPE)
diff --git a/pkgs/development/libraries/openvino/default.nix b/pkgs/development/libraries/openvino/default.nix
index e3ebb97cbdff..2f8ecd5fc81e 100644
--- a/pkgs/development/libraries/openvino/default.nix
+++ b/pkgs/development/libraries/openvino/default.nix
@@ -1,115 +1,167 @@
 { lib
-, addOpenGLRunpath
-, autoPatchelfHook
 , stdenv
 , fetchFromGitHub
 , fetchpatch
+, fetchurl
+, substituteAll
+
+# build
+, addOpenGLRunpath
+, autoPatchelfHook
 , cmake
 , git
-, protobuf
-, tbb
-, opencv
-, unzip
-, shellcheck
-, srcOnly
+, libarchive
+, pkg-config
 , python
-, enablePython ? false
+, shellcheck
+
+# runtime
+, libusb1
+, libxml2
+, opencv
+, protobuf
+, pugixml
+, tbb
 }:
 
 let
-
-  onnx_src = srcOnly {
-    name = "onnx-patched";
-    src = fetchFromGitHub {
-      owner = "onnx";
-      repo = "onnx";
-      rev = "v1.8.1";
-      sha256 = "+1zNnZ4lAyVYRptfk0PV7koIX9FqcfD1Ah33qj/G2rA=";
-    };
-    patches = [
-      # Fix build with protobuf 3.18+
-      # Remove with onnx 1.9 release
-      (fetchpatch {
-        url = "https://github.com/onnx/onnx/commit/d3bc82770474761571f950347560d62a35d519d7.patch";
-        sha256 = "0vdsrklkzhdjaj8wdsl4icn93q3961g8dx35zvff0nhpr08wjb7y";
-      })
-    ];
+  # See FIRMWARE_PACKAGE_VERSION in src/plugins/intel_myriad/myriad_dependencies.cmake
+  myriad_firmware_version = "20221129_35";
+  myriad_usb_firmware = fetchurl {
+    url = "https://storage.openvinotoolkit.org/dependencies/myriad/firmware_usb-ma2x8x_${myriad_firmware_version}.zip";
+    hash = "sha256-HKNWbSlMjSafOgrS9WmenbsmeaJKRVssw0NhIwPYZ70=";
+  };
+  myriad_pcie_firmware = fetchurl {
+    url = "https://storage.openvinotoolkit.org/dependencies/myriad/firmware_pcie-ma2x8x_${myriad_firmware_version}.zip";
+    hash = "sha256-VmfrAoKQ++ySIgAxWQul+Hd0p7Y4sTF44Nz4RHpO6Mo=";
   };
 
+  # See GNA_VERSION in cmake/dependencies.cmake
+  gna_version = "03.00.00.1910";
+  gna = fetchurl {
+    url = "https://storage.openvinotoolkit.org/dependencies/gna/gna_${gna_version}.zip";
+    hash = "sha256-iU3bwK40WfBFE7hTsMq8MokN1Oo3IooCK2oyEBvbt/g=";
+  };
+
+  tbbbind_version = "2_5";
+  tbbbind = fetchurl {
+    url = "https://download.01.org/opencv/master/openvinotoolkit/thirdparty/linux/tbbbind_${tbbbind_version}_static_lin_v2.tgz";
+    hash = "sha256-hl54lMWEAiM8rw0bKIBW4OarK/fJ0AydxgVhxIS8kPQ=";
+  };
 in
+
 stdenv.mkDerivation rec {
   pname = "openvino";
-  version = "2021.2";
+  version = "2022.3.0";
 
   src = fetchFromGitHub {
     owner = "openvinotoolkit";
     repo = "openvino";
-    rev = version;
-    sha256 = "pv4WTfY1U5GbA9Yj07UOLQifvVH3oDfWptxxYW5IwVQ=";
+    rev = "refs/tags/${version}";
     fetchSubmodules = true;
+    hash = "sha256-Ie58zTNatiYZZQJ8kJh/+HlSetQjhAtf2Us83z1jGv4=";
   };
 
+  outputs = [
+    "out"
+    "python"
+  ];
+
+  nativeBuildInputs = [
+    addOpenGLRunpath
+    autoPatchelfHook
+    cmake
+    git
+    libarchive
+    pkg-config
+    (python.withPackages (ps: with ps; [
+      cython
+      pybind11
+      setuptools
+    ]))
+    shellcheck
+  ];
+
+  patches = [
+    (substituteAll {
+      src = ./cmake.patch;
+      inherit (lib) version;
+    })
+  ];
+
+  postPatch = ''
+    mkdir -p temp/vpu/firmware/{pcie,usb}-ma2x8x
+    pushd temp/vpu/firmware
+    bsdtar -xf ${myriad_pcie_firmware} -C pcie-ma2x8x
+    echo "${myriad_pcie_firmware.url}" > pcie-ma2x8x/ie_dependency.info
+    bsdtar -xf ${myriad_usb_firmware} -C usb-ma2x8x
+    echo "${myriad_usb_firmware.url}" > usb-ma2x8x/ie_dependency.info
+    popd
+
+    mkdir -p temp/gna_${gna_version}
+    pushd temp/
+    bsdtar -xf ${gna}
+    autoPatchelf gna_${gna_version}
+    echo "${gna.url}" > gna_${gna_version}/ie_dependency.info
+    popd
+
+    mkdir -p temp/tbbbind_${tbbbind_version}
+    pushd temp/tbbbind_${tbbbind_version}
+    bsdtar -xf ${tbbbind}
+    echo "${tbbbind.url}" > ie_dependency.info
+    popd
+  '';
+
   dontUseCmakeBuildDir = true;
 
   cmakeFlags = [
-    "-DNGRAPH_USE_SYSTEM_PROTOBUF:BOOL=ON"
-    "-DFETCHCONTENT_FULLY_DISCONNECTED:BOOL=ON"
-    "-DFETCHCONTENT_SOURCE_DIR_EXT_ONNX:STRING=${onnx_src}"
-    "-DENABLE_VPU:BOOL=OFF"
-    "-DTBB_DIR:STRING=${tbb}"
+    "-DCMAKE_PREFIX_PATH:PATH=${placeholder "out"}"
+    "-DCMAKE_MODULE_PATH:PATH=${placeholder "out"}/lib/cmake"
+    "-DENABLE_LTO:BOOL=ON"
+    # protobuf
+    "-DENABLE_SYSTEM_PROTOBUF:BOOL=OFF"
+    "-DProtobuf_LIBRARIES=${protobuf}/lib/libprotobuf${stdenv.hostPlatform.extensions.sharedLibrary}"
+    # tbb
+    "-DENABLE_SYSTEM_TBB:BOOL=ON"
+    # opencv
     "-DENABLE_OPENCV:BOOL=ON"
-    "-DOPENCV:STRING=${opencv}"
-    "-DENABLE_GNA:BOOL=OFF"
-    "-DENABLE_SPEECH_DEMO:BOOL=OFF"
-    "-DBUILD_TESTING:BOOL=OFF"
-    "-DENABLE_CLDNN_TESTS:BOOL=OFF"
-    "-DNGRAPH_INTERPRETER_ENABLE:BOOL=ON"
-    "-DNGRAPH_TEST_UTIL_ENABLE:BOOL=OFF"
-    "-DNGRAPH_UNIT_TEST_ENABLE:BOOL=OFF"
-    "-DENABLE_SAMPLES:BOOL=OFF"
-    "-DENABLE_CPPLINT:BOOL=OFF"
-  ] ++ lib.optionals enablePython [
+    "-DOpenCV_DIR=${opencv}/lib/cmake/opencv4/"
+    # pugixml
+    "-DENABLE_SYSTEM_PUGIXML:BOOL=ON"
+    # onednn
+    "-DENABLE_ONEDNN_FOR_GPU:BOOL=OFF"
+    # intel gna
+    "-DENABLE_INTEL_GNA:BOOL=ON"
+    # python
     "-DENABLE_PYTHON:BOOL=ON"
+    # tests
+    "-DENABLE_CPPLINT:BOOL=OFF"
+    "-DBUILD_TESTING:BOOL=OFF"
+    "-DENABLE_SAMPLES:BOOL=OFF"
   ];
 
-  preConfigure = ''
-    # To make install openvino inside /lib instead of /python
-    substituteInPlace inference-engine/ie_bridges/python/CMakeLists.txt \
-      --replace 'DESTINATION python/''${PYTHON_VERSION}/openvino' 'DESTINATION lib/''${PYTHON_VERSION}/site-packages/openvino' \
-      --replace 'DESTINATION python/''${PYTHON_VERSION}' 'DESTINATION lib/''${PYTHON_VERSION}/site-packages/openvino'
-    substituteInPlace inference-engine/ie_bridges/python/src/openvino/inference_engine/CMakeLists.txt \
-      --replace 'python/''${PYTHON_VERSION}/openvino/inference_engine' 'lib/''${PYTHON_VERSION}/site-packages/openvino/inference_engine'
-
-    # Used to download OpenCV based on Linux Distro and make it use system OpenCV
-    substituteInPlace inference-engine/cmake/dependencies.cmake \
-        --replace 'include(linux_name)' ' ' \
-        --replace 'if (ENABLE_OPENCV)' 'if (ENABLE_OPENCV AND NOT DEFINED OPENCV)'
-
-    cmakeDir=$PWD
-    mkdir ../build
-    cd ../build
-  '';
-
-  autoPatchelfIgnoreMissingDeps = [ "libngraph_backend.so" ];
-
-  nativeBuildInputs = [
-    cmake
-    autoPatchelfHook
-    addOpenGLRunpath
-    unzip
+  autoPatchelfIgnoreMissingDeps = [
+    "libngraph_backend.so"
   ];
 
   buildInputs = [
-    git
-    protobuf
+    libusb1
+    libxml2
     opencv
-    python
+    protobuf
+    pugixml
     tbb
-    shellcheck
-  ] ++ lib.optionals enablePython (with python.pkgs; [
-    cython
-    pybind11
-  ]);
+  ];
+
+  enableParallelBuilding = true;
+
+  postInstall = ''
+    pushd $out/python/python${lib.versions.majorMinor python.version}
+    mkdir -p $python
+    mv ./* $python/
+    popd
+    rm -r $out/python
+  '';
 
   postFixup = ''
     # Link to OpenCL
@@ -130,8 +182,7 @@ stdenv.mkDerivation rec {
     homepage = "https://docs.openvinotoolkit.org/";
     license = with licenses; [ asl20 ];
     platforms = platforms.all;
-    broken = (stdenv.isLinux && stdenv.isx86_64) # at 2022-09-23
-             || stdenv.isDarwin; # Cannot find macos sdk
+    broken = stdenv.isDarwin; # Cannot find macos sdk
     maintainers = with maintainers; [ tfmoraes ];
   };
 }
diff --git a/pkgs/development/libraries/poppler/default.nix b/pkgs/development/libraries/poppler/default.nix
index ccae3037e092..d99e5150678e 100644
--- a/pkgs/development/libraries/poppler/default.nix
+++ b/pkgs/development/libraries/poppler/default.nix
@@ -47,13 +47,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: rec {
   pname = "poppler-${suffix}";
-  version = "22.11.0"; # beware: updates often break cups-filters build, check texlive and scribus too!
+  version = "23.02.0"; # beware: updates often break cups-filters build, check texlive and scribus too!
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "https://poppler.freedesktop.org/poppler-${version}.tar.xz";
-    hash = "sha256-CTuphE7XdChVFzYcFeIaMbpN8nikmSY9RAPMp08tqCg=";
+    hash = "sha256-MxXdonD+KzXPH0HSdZSMOWUvqGO5DeB2b2spPZpVj8k=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/qxmpp/default.nix b/pkgs/development/libraries/qxmpp/default.nix
index 4867c67277d8..aede57810aa2 100644
--- a/pkgs/development/libraries/qxmpp/default.nix
+++ b/pkgs/development/libraries/qxmpp/default.nix
@@ -9,13 +9,13 @@
 
 mkDerivation rec {
   pname = "qxmpp";
-  version = "1.4.0";
+  version = "1.5.1";
 
   src = fetchFromGitHub {
     owner = "qxmpp-project";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1knpq1jkwk0lxdwczbmzf7qrjvlxba9yr40nbq9s5nqkcx6q1c3i";
+    sha256 = "sha256-6iI+s+iSKK8TeocvyOxou7cF9ZXlWr5prUbPhoHOoSM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/science/chemistry/openmm/default.nix b/pkgs/development/libraries/science/chemistry/openmm/default.nix
index cd105a1133d0..85072f77da12 100644
--- a/pkgs/development/libraries/science/chemistry/openmm/default.nix
+++ b/pkgs/development/libraries/science/chemistry/openmm/default.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation rec {
   pname = "openmm";
-  version = "7.7.0";
+  version = "8.0.0";
 
   src = fetchFromGitHub {
     owner = "openmm";
     repo = pname;
     rev = version;
-    hash = "sha256-2PYUGTMVQ5qVDeeABrwR45U3JIgo2xMXKlD6da7y3Dw=";
+    hash = "sha256-89ngeZHdjyL/OoGuQ+F5eaXE1/od0EEfIgw9eKdLtL8=";
   };
 
   # "This test is stochastic and may occassionally fail". It does.
diff --git a/pkgs/development/libraries/webkitgtk/default.nix b/pkgs/development/libraries/webkitgtk/default.nix
index 4e22df60f533..99ee89edcac3 100644
--- a/pkgs/development/libraries/webkitgtk/default.nix
+++ b/pkgs/development/libraries/webkitgtk/default.nix
@@ -68,7 +68,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "webkitgtk";
-  version = "2.38.3";
+  version = "2.38.4";
   name = "${finalAttrs.pname}-${finalAttrs.version}+abi=${if lib.versionAtLeast gtk3.version "4.0" then "5.0" else "4.${if lib.versions.major libsoup.version == "2" then "0" else "1"}"}";
 
   outputs = [ "out" "dev" "devdoc" ];
@@ -79,7 +79,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://webkitgtk.org/releases/webkitgtk-${finalAttrs.version}.tar.xz";
-    hash = "sha256-QfAB0e1EjGk2s5Sp8g5GQO6/g6fwgmLfKFBPdBBgSlo=";
+    hash = "sha256-T0fqKaLU1fFe7z3J4tbG8Gfo3oY6P2RFXhzPlpPMHTY=";
   };
 
   patches = lib.optionals stdenv.isLinux [
diff --git a/pkgs/development/ocaml-modules/ounit2/default.nix b/pkgs/development/ocaml-modules/ounit2/default.nix
index 7872edca5922..3b75428d0efb 100644
--- a/pkgs/development/ocaml-modules/ounit2/default.nix
+++ b/pkgs/development/ocaml-modules/ounit2/default.nix
@@ -1,22 +1,22 @@
 { lib, ocaml, buildDunePackage, fetchurl, seq, stdlib-shims, ncurses }:
 
 buildDunePackage rec {
-  minimumOCamlVersion = "4.04";
+  minimalOCamlVersion = "4.04";
 
   pname = "ounit2";
   version = "2.2.6";
 
-  useDune2 = lib.versionAtLeast ocaml.version "4.08";
+  duneVersion = if lib.versionAtLeast ocaml.version "4.08" then "2" else "1";
 
   src = fetchurl {
     url = "https://github.com/gildor478/ounit/releases/download/v${version}/ounit-${version}.tbz";
-    sha256 = "sha256-BpD7Hg6QoY7tXDVms8wYJdmLDox9UbtrhGyVxFphWRM=";
+    hash = "sha256-BpD7Hg6QoY7tXDVms8wYJdmLDox9UbtrhGyVxFphWRM=";
   };
 
   propagatedBuildInputs = [ seq stdlib-shims ];
 
   doCheck = true;
-  nativeCheckInputs = lib.optional (lib.versionOlder ocaml.version "4.07") ncurses;
+  checkInputs = lib.optional (lib.versionOlder ocaml.version "4.07") ncurses;
 
   meta = with lib; {
     homepage = "https://github.com/gildor478/ounit";
diff --git a/pkgs/development/python-modules/aiofile/default.nix b/pkgs/development/python-modules/aiofile/default.nix
index a2c4eaf5ff8e..5d79aaa1bc32 100644
--- a/pkgs/development/python-modules/aiofile/default.nix
+++ b/pkgs/development/python-modules/aiofile/default.nix
@@ -1,9 +1,9 @@
 { lib
 , aiomisc
-, asynctest
 , caio
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , pytestCheckHook
 , pythonOlder
 }:
@@ -22,13 +22,20 @@ buildPythonPackage rec {
     hash = "sha256-PIImQZ1ymazsOg8qmlO91tNYHwXqK/d8AuKPsWYvh0w=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "remove-asynctest.patch";
+      url = "https://github.com/mosquito/aiofile/commit/9253ca42022f17f630ccfb6811f67876910f8b13.patch";
+      hash = "sha256-yMRfqEbdxApFypEj27v1zTgF/4kuLf5aS/+clo3mfZo=";
+    })
+  ];
+
   propagatedBuildInputs = [
     caio
   ];
 
   nativeCheckInputs = [
     aiomisc
-    asynctest
     pytestCheckHook
   ];
 
diff --git a/pkgs/development/python-modules/aiohomekit/default.nix b/pkgs/development/python-modules/aiohomekit/default.nix
index e29f22ba3c99..e19f613e301a 100644
--- a/pkgs/development/python-modules/aiohomekit/default.nix
+++ b/pkgs/development/python-modules/aiohomekit/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "aiohomekit";
-  version = "2.4.4";
+  version = "2.4.6";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "Jc2k";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-a7i8xBlTM3DZDZBzLe/sbMR4CNx7XMxNQ6tiMI6MoTg=";
+    hash = "sha256-QCPZaxVCQSckZ7qjV9wF7YqgTOFPbRy4xOQVDvReav4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/azure-core/default.nix b/pkgs/development/python-modules/azure-core/default.nix
index 68a0409d9ead..4fca1b356a31 100644
--- a/pkgs/development/python-modules/azure-core/default.nix
+++ b/pkgs/development/python-modules/azure-core/default.nix
@@ -17,7 +17,7 @@
 , typing-extensions }:
 
 buildPythonPackage rec {
-  version = "1.26.1";
+  version = "1.26.3";
   pname = "azure-core";
   disabled = pythonOlder "3.6";
 
@@ -26,7 +26,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    sha256 = "sha256-IjsOkMvdHwPEGxlbAyOYmYQ/INAJZNu4XmQ4aHNBSi0=";
+    sha256 = "sha256-rL0NqpZ1zohiPaNcgNgZza+pFzHe5rJpXGTXyp2oLbQ=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/azure-mgmt-datalake-store/default.nix b/pkgs/development/python-modules/azure-mgmt-datalake-store/default.nix
index 18665f4dbb6e..b2b96ec2994e 100644
--- a/pkgs/development/python-modules/azure-mgmt-datalake-store/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-datalake-store/default.nix
@@ -9,12 +9,12 @@
 
 buildPythonPackage rec {
   pname = "azure-mgmt-datalake-store";
-  version = "1.0.0";
+  version = "0.5.0";
 
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    sha256 = "sha256-GrmVK97M+iojevPLVTuLmfQRLxvrHtr9DRHymJvLYHE=";
+    sha256 = "sha256-k3bTVJVmHRn4rMVgT2ewvFlJOxg1u8SA+aGVL5ABekw=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/azure-mgmt-msi/default.nix b/pkgs/development/python-modules/azure-mgmt-msi/default.nix
index 45a57d1c68a0..1f4568f3b7f3 100644
--- a/pkgs/development/python-modules/azure-mgmt-msi/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-msi/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "azure-mgmt-msi";
-  version = "6.1.0";
+  version = "7.0.0";
 
   disabled = pythonOlder "3.6";
 
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    sha256 = "sha256-lS8da3Al1z1pMLDBf6ZtWc1UFUVgkN1qpKTxt4VXdlQ=";
+    sha256 = "sha256-ctRsmmJ4PsTqthm+nRt4/+u9qhZNQG/TA/FjA/NyVrI=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/azure-servicebus/default.nix b/pkgs/development/python-modules/azure-servicebus/default.nix
index 9c7a57adc08d..95f1a127db72 100644
--- a/pkgs/development/python-modules/azure-servicebus/default.nix
+++ b/pkgs/development/python-modules/azure-servicebus/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "azure-servicebus";
-  version = "7.8.1";
+  version = "7.8.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    hash = "sha256-gI5eCyXGFkQgY0rhyGLioLXj1a4I6vV64Nm/EKyFEks=";
+    hash = "sha256-FC4AUHWV8UxvB1Lz3/+z/l/OhdTj1YSn4iLmXt+zwZo=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/azure-storage/default.nix b/pkgs/development/python-modules/azure-storage/default.nix
deleted file mode 100644
index af6652733bd5..000000000000
--- a/pkgs/development/python-modules/azure-storage/default.nix
+++ /dev/null
@@ -1,36 +0,0 @@
-{ pkgs
-, buildPythonPackage
-, fetchPypi
-, azure-common
-, cryptography
-, futures ? null
-, python-dateutil
-, requests
-, isPy3k
-}:
-
-buildPythonPackage rec {
-  version = "0.36.0";
-  pname = "azure-storage";
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "0pyasfxkin6j8j00qmky7d9cvpxgis4fi9bscgclj6yrpvf14qpv";
-  };
-
-  propagatedBuildInputs = [ azure-common cryptography python-dateutil requests ]
-                            ++ pkgs.lib.optionals (!isPy3k) [ futures ];
-
-  postPatch = ''
-    rm azure_bdist_wheel.py
-    substituteInPlace setup.cfg \
-      --replace "azure-namespace-package = azure-nspkg" ""
-  '';
-
-  meta = with pkgs.lib; {
-    description = "Microsoft Azure SDK for Python";
-    homepage = "https://github.com/Azure/azure-sdk-for-python";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ olcai ];
-  };
-}
diff --git a/pkgs/development/python-modules/bedup/default.nix b/pkgs/development/python-modules/bedup/default.nix
deleted file mode 100644
index 454a972f177b..000000000000
--- a/pkgs/development/python-modules/bedup/default.nix
+++ /dev/null
@@ -1,42 +0,0 @@
-{ lib
-, buildPythonPackage
-, fetchFromGitHub
-, btrfs-progs
-, contextlib2
-, pyxdg
-, pycparser
-, alembic
-, cffi
-, pythonOlder
-, isPyPy
-}:
-
-buildPythonPackage rec {
-  version = "0.10.1";
-  pname = "bedup";
-  disabled = pythonOlder "3.3";
-
-  src = fetchFromGitHub {
-    owner = "g2p";
-    repo = "bedup";
-    rev = "v${version}";
-    sha256 = "0sp8pmjkxcqq0alianfp41mwq7qj10rk1qy31pjjp9kiph1rn0x6";
-  };
-
-  buildInputs = [ btrfs-progs ];
-  propagatedBuildInputs = [ contextlib2 pyxdg pycparser alembic ]
-    ++ lib.optionals (!isPyPy) [ cffi ];
-
-  meta = with lib; {
-    description = "Deduplication for Btrfs";
-    longDescription = ''
-      Deduplication for Btrfs. bedup looks for new and changed files,
-      making sure that multiple copies of identical files share space
-      on disk. It integrates deeply with btrfs so that scans are
-      incremental and low-impact.
-    '';
-    homepage = "https://github.com/g2p/bedup";
-    license = licenses.gpl2;
-    maintainers = with maintainers; [ bluescreen303 ];
-  };
-}
diff --git a/pkgs/development/python-modules/django_silk/default.nix b/pkgs/development/python-modules/django_silk/default.nix
index 8a53a9d1d58f..0b420e9362c9 100644
--- a/pkgs/development/python-modules/django_silk/default.nix
+++ b/pkgs/development/python-modules/django_silk/default.nix
@@ -1,7 +1,6 @@
 { lib
 , autopep8
 , buildPythonPackage
-, contextlib2
 , django
 , factory_boy
 , fetchFromGitHub
@@ -72,7 +71,6 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     freezegun
-    contextlib2
     networkx
     pydot
     factory_boy
diff --git a/pkgs/development/python-modules/duecredit/default.nix b/pkgs/development/python-modules/duecredit/default.nix
index b9c9e65a4fe6..6e225df0fd90 100644
--- a/pkgs/development/python-modules/duecredit/default.nix
+++ b/pkgs/development/python-modules/duecredit/default.nix
@@ -2,13 +2,11 @@
 , buildPythonPackage
 , fetchPypi
 , isPy27
-, contextlib2
 , pytest
 , pytestCheckHook
 , vcrpy
 , citeproc-py
 , requests
-, setuptools
 , six
 }:
 
@@ -22,10 +20,9 @@ buildPythonPackage rec {
     sha256 = "f6192ce9315b35f6a67174761291e61d0831e496e8ff4acbc061731e7604faf8";
   };
 
-  # bin/duecredit requires setuptools at runtime
-  propagatedBuildInputs = [ citeproc-py requests setuptools six ];
+  propagatedBuildInputs = [ citeproc-py requests six ];
 
-  nativeCheckInputs = [ contextlib2 pytest pytestCheckHook vcrpy ];
+  nativeCheckInputs = [ pytest pytestCheckHook vcrpy ];
 
   preCheck = ''
     export HOME=$(mktemp -d)
diff --git a/pkgs/development/python-modules/elementpath/default.nix b/pkgs/development/python-modules/elementpath/default.nix
index 1b933d182ad9..0aa5c6583784 100644
--- a/pkgs/development/python-modules/elementpath/default.nix
+++ b/pkgs/development/python-modules/elementpath/default.nix
@@ -6,7 +6,7 @@
 
 buildPythonPackage rec {
   pname = "elementpath";
-  version = "4.0.1";
+  version = "3.0.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -15,7 +15,7 @@ buildPythonPackage rec {
     owner = "sissaschool";
     repo = "elementpath";
     rev = "refs/tags/v${version}";
-    hash = "sha256-BEnSPRuQUnKXtPAJfjxS+fwE0rpPj1U2yRK8eImKMYw=";
+    hash = "sha256-b+Th28GI2UOmfO4jy4biohAJWPiYWkvFLqqs9lgR4Vc=";
   };
 
   # avoid circular dependency with xmlschema which directly depends on this
@@ -28,7 +28,6 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "XPath 1.0/2.0 parsers and selectors for ElementTree and lxml";
     homepage = "https://github.com/sissaschool/elementpath";
-    changelog = "https://github.com/sissaschool/elementpath/blob/${version}/CHANGELOG.rst";
     license = licenses.mit;
     maintainers = with maintainers; [ jonringer ];
   };
diff --git a/pkgs/development/python-modules/gensim/default.nix b/pkgs/development/python-modules/gensim/default.nix
index 406beae748b6..183454dac89d 100644
--- a/pkgs/development/python-modules/gensim/default.nix
+++ b/pkgs/development/python-modules/gensim/default.nix
@@ -56,5 +56,8 @@ buildPythonPackage rec {
     homepage = "https://radimrehurek.com/gensim/";
     license = licenses.lgpl21Only;
     maintainers = with maintainers; [ jyp ];
+    # python310 errors as: No matching distribution found for FuzzyTM>=0.4.0
+    # python311 errors as: longintrepr.h: No such file or directory
+    broken = true; # At 2023-02-05
   };
 }
diff --git a/pkgs/development/python-modules/img2pdf/default.nix b/pkgs/development/python-modules/img2pdf/default.nix
index 93cc6453f978..0450dee30b46 100644
--- a/pkgs/development/python-modules/img2pdf/default.nix
+++ b/pkgs/development/python-modules/img2pdf/default.nix
@@ -61,6 +61,7 @@ buildPythonPackage rec {
 
   disabledTests = [
     "test_tiff_rgb"
+    "test_png_gray1"  # https://gitlab.mister-muffin.de/josch/img2pdf/issues/154
   ];
 
   pythonImportsCheck = [ "img2pdf" ];
diff --git a/pkgs/development/python-modules/llfuse/default.nix b/pkgs/development/python-modules/llfuse/default.nix
index c1039db8829c..9fa13391b6ad 100644
--- a/pkgs/development/python-modules/llfuse/default.nix
+++ b/pkgs/development/python-modules/llfuse/default.nix
@@ -3,7 +3,6 @@
 , buildPythonPackage
 , pythonOlder
 , fetchFromGitHub
-, contextlib2
 , cython
 , fuse
 , pkg-config
@@ -29,8 +28,6 @@ buildPythonPackage rec {
 
   buildInputs = [ fuse ];
 
-  propagatedBuildInputs = [ contextlib2 ];
-
   preConfigure = ''
     substituteInPlace setup.py \
         --replace "'pkg-config'" "'${stdenv.cc.targetPrefix}pkg-config'"
diff --git a/pkgs/development/python-modules/msal/default.nix b/pkgs/development/python-modules/msal/default.nix
index b00a7703cf05..336439824140 100644
--- a/pkgs/development/python-modules/msal/default.nix
+++ b/pkgs/development/python-modules/msal/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "msal";
-  version = "1.20.0";
+  version = "1.21.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-eDRM1MkdYTSlk7Xj5FVB5mbje3R/+KYxbDZo3R5qtrI=";
+    hash = "sha256-lrXIZ4MP0Rbl99DsjvGyOLTNpNGuqG2P7PUYJg4Tb78=";
   };
 
   propagatedBuildInputs = [
@@ -35,6 +35,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Library to access the Microsoft Cloud by supporting authentication of users with Microsoft Azure Active Directory accounts (AAD) and Microsoft Accounts (MSA) using industry standard OAuth2 and OpenID Connect";
     homepage = "https://github.com/AzureAD/microsoft-authentication-library-for-python";
+    changelog = "https://github.com/AzureAD/microsoft-authentication-library-for-python/releases/tag/${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ kamadorueda ];
   };
diff --git a/pkgs/development/python-modules/nltk/default.nix b/pkgs/development/python-modules/nltk/default.nix
index 9b290730be9d..77ed843d47cd 100644
--- a/pkgs/development/python-modules/nltk/default.nix
+++ b/pkgs/development/python-modules/nltk/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "nltk";
-  version = "3.8";
+  version = "3.8.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    hash = "sha256-dLMIJqN9eNU0JxBbvQN92IAlG+Jp/KZO5TCDikbtVfw=";
+    hash = "sha256-GDTaPQaCy6Tyzt4vmq1rD6+2RhukUdsO+2+cOXmNZNM=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/onnx/default.nix b/pkgs/development/python-modules/onnx/default.nix
index a6f290633edc..b21f343db32a 100644
--- a/pkgs/development/python-modules/onnx/default.nix
+++ b/pkgs/development/python-modules/onnx/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "onnx";
-  version = "1.12.0";
+  version = "1.13.0";
   format = "setuptools";
 
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-E7PnfSdSO52/TzDfyclZRVhZ1eNOkhxE9xLWm4Np7/k=";
+    sha256 = "sha256-QQs5lQNnhX+XtlCTaB/iSVouI9Y3d6is6vlsVqFtFm4=";
   };
 
   nativeBuildInputs = [
@@ -50,9 +50,13 @@ buildPythonPackage rec {
 
   postPatch = ''
     chmod +x tools/protoc-gen-mypy.sh.in
-    patchShebangs tools/protoc-gen-mypy.py
-    substituteInPlace tools/protoc-gen-mypy.sh.in \
-      --replace "/bin/bash" "${bash}/bin/bash"
+    patchShebangs tools/protoc-gen-mypy.sh.in
+  '';
+
+  # Set CMAKE_INSTALL_LIBDIR to lib explicitly, because otherwise it gets set
+  # to lib64 and cmake incorrectly looks for the protobuf library in lib64
+  preConfigure = ''
+    export CMAKE_ARGS="-DCMAKE_INSTALL_LIBDIR=lib -DONNX_USE_PROTOBUF_SHARED_LIBS=ON"
   '';
 
   preBuild = ''
diff --git a/pkgs/development/python-modules/openvino/default.nix b/pkgs/development/python-modules/openvino/default.nix
new file mode 100644
index 000000000000..20f47eb666ef
--- /dev/null
+++ b/pkgs/development/python-modules/openvino/default.nix
@@ -0,0 +1,40 @@
+{ lib
+, buildPythonPackage
+, openvino-native
+, numpy
+, python
+}:
+
+buildPythonPackage {
+  pname = "openvino";
+  inherit (openvino-native) version;
+  format = "other";
+
+  src = openvino-native.python;
+
+  propagatedBuildInputs = [
+    numpy
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/${python.sitePackages}
+    cp -Rv * $out/${python.sitePackages}/
+
+    runHook postInstall
+  '';
+
+  pythonImportsCheck = [
+    "ngraph"
+    "openvino"
+    "openvino.runtime"
+  ];
+
+  meta = with lib; {
+    description = "OpenVINO(TM) Runtime";
+    homepage = "https://github.com/openvinotoolkit/openvino";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ hexa ];
+  };
+}
diff --git a/pkgs/development/python-modules/parametrize-from-file/default.nix b/pkgs/development/python-modules/parametrize-from-file/default.nix
index e2d94ac02561..c020992bee22 100644
--- a/pkgs/development/python-modules/parametrize-from-file/default.nix
+++ b/pkgs/development/python-modules/parametrize-from-file/default.nix
@@ -1,10 +1,10 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, fetchpatch
 , pytestCheckHook
 , coveralls
 , numpy
-, contextlib2
 , decopatch
 , more-itertools
 , nestedtext
@@ -24,6 +24,14 @@ buildPythonPackage rec {
     sha256 = "1c91j869n2vplvhawxc1sv8km8l53bhlxhhms43fyjsqvy351v5j";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "replace contextlib2-with-contextlib.patch";
+      url = "https://github.com/kalekundert/parametrize_from_file/commit/edee706770a713130da7c4b38b0a07de1bd79c1b.patch";
+      hash = "sha256-VkPKGkYYTB5XCavtEEnFJ+EdNUUhITz/euwlYAPC/tQ=";
+    })
+  ];
+
   # patch out coveralls since it doesn't provide us value
   preBuild = ''
     sed -i '/coveralls/d' ./pyproject.toml
@@ -38,7 +46,6 @@ buildPythonPackage rec {
   ];
 
   propagatedBuildInputs = [
-    contextlib2
     decopatch
     more-itertools
     nestedtext
diff --git a/pkgs/development/python-modules/pdoc/default.nix b/pkgs/development/python-modules/pdoc/default.nix
index c8813208d5e8..a096973a9367 100644
--- a/pkgs/development/python-modules/pdoc/default.nix
+++ b/pkgs/development/python-modules/pdoc/default.nix
@@ -2,8 +2,8 @@
 , stdenv
 , buildPythonPackage
 , pythonOlder
-, fetchPypi
 , fetchFromGitHub
+, setuptools
 , jinja2
 , pygments
 , markupsafe
@@ -14,17 +14,23 @@
 
 buildPythonPackage rec {
   pname = "pdoc";
-  version = "12.0.2";
+  version = "12.3.1";
   disabled = pythonOlder "3.7";
 
+  format = "pyproject";
+
   # the Pypi version does not include tests
   src = fetchFromGitHub {
     owner = "mitmproxy";
     repo = "pdoc";
     rev = "v${version}";
-    sha256 = "FVfPO/QoHQQqg7QU05GMrrad0CbRR5AQVYUpBhZoRi0=";
+    sha256 = "sha256-SaLrE/eHxKnlm6BZYbcZZrbrUZMeHJ4eCcqMsFvyZ7I=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     jinja2
     pygments
@@ -48,6 +54,7 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "pdoc" ];
 
   meta = with lib; {
+    changelog = "https://github.com/mitmproxy/pdoc/blob/${src.rev}/CHANGELOG.md";
     homepage = "https://pdoc.dev/";
     description = "API Documentation for Python Projects";
     license = licenses.unlicense;
diff --git a/pkgs/development/python-modules/policy-sentry/default.nix b/pkgs/development/python-modules/policy-sentry/default.nix
index ea98a6679275..bfb804911084 100644
--- a/pkgs/development/python-modules/policy-sentry/default.nix
+++ b/pkgs/development/python-modules/policy-sentry/default.nix
@@ -12,14 +12,16 @@
 
 buildPythonPackage rec {
   pname = "policy-sentry";
-  version = "0.12.5";
-  disabled = pythonOlder "3.6";
+  version = "0.12.6";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "salesforce";
     repo = "policy_sentry";
     rev = "refs/tags/${version}";
-    sha256 = "sha256-DwWX8ztqnm/KYkiarG9KXkHcVxYE6Cc285oOMz9gkqc=";
+    hash = "sha256-odtMbPHty3NUqz+4UAw+8dsK6AMZer41/BAX8cK5Rek=";
   };
 
   propagatedBuildInputs = [
@@ -34,11 +36,14 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  pythonImportsCheck = [ "policy_sentry" ];
+  pythonImportsCheck = [
+    "policy_sentry"
+  ];
 
   meta = with lib; {
     description = "Python module for generating IAM least privilege policies";
     homepage = "https://github.com/salesforce/policy_sentry";
+    changelog = "https://github.com/salesforce/policy_sentry/releases/tag/${version}";
     license = licenses.bsd3;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/py-synologydsm-api/default.nix b/pkgs/development/python-modules/py-synologydsm-api/default.nix
index 8dab19a4f818..2437aba73a13 100644
--- a/pkgs/development/python-modules/py-synologydsm-api/default.nix
+++ b/pkgs/development/python-modules/py-synologydsm-api/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "py-synologydsm-api";
-  version = "2.1.1";
+  version = "2.1.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "mib1185";
     repo = "py-synologydsm-api";
     rev = "refs/tags/v${version}";
-    hash = "sha256-rT9KkSgIinJxTyJ40Z3VzMh23Ry9O3NFrLH4I2+NFPg=";
+    hash = "sha256-dugWA/Ruc/BhPBbo2bTXf225YndDl0t2vc+NeutaO58=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/python-box/default.nix b/pkgs/development/python-modules/python-box/default.nix
index 7fabc513e9b1..18e841f85e1d 100644
--- a/pkgs/development/python-modules/python-box/default.nix
+++ b/pkgs/development/python-modules/python-box/default.nix
@@ -1,11 +1,14 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , msgpack
+, poetry-core
 , pytestCheckHook
 , pythonOlder
 , pyyaml
 , ruamel-yaml
+, setuptools
 , toml
 , tomli
 , tomli-w
@@ -13,8 +16,8 @@
 
 buildPythonPackage rec {
   pname = "python-box";
-  version = "6.1.0";
-  format = "setuptools";
+  version = "7.0.0";
+  format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
@@ -22,9 +25,23 @@ buildPythonPackage rec {
     owner = "cdgriffith";
     repo = "Box";
     rev = "refs/tags/${version}";
-    hash = "sha256-42VDZ4aASFFWhRY3ApBQ4dq76eD1flZtxUM9hpA9iiI=";
+    hash = "sha256-CvcVN5DTaT8mSf2FtFrt7DHP+YLbVI15/5Vjfmgae34=";
   };
 
+  patches = [
+    # Switch to poetry-core, https://github.com/cdgriffith/Box/pull/247
+    (fetchpatch {
+      name = "switch-to-poetry-core.patch";
+      url = "https://github.com/cdgriffith/Box/commit/a43b98c5f5ff1074568dcef27cf17e7065d1019c.patch";
+      hash = "sha256-ul/MVSzgjN3D+Vuzn7YPITaDrtS58vDmA23hy1EVF9U=";
+    })
+  ];
+
+  nativeBuildInputs = [
+    poetry-core
+    setuptools
+  ];
+
   passthru.optional-dependencies = {
     all = [
       msgpack
@@ -64,6 +81,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python dictionaries with advanced dot notation access";
     homepage = "https://github.com/cdgriffith/Box";
+    changelog = "https://github.com/cdgriffith/Box/blob/${version}/CHANGES.rst";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/pytradfri/default.nix b/pkgs/development/python-modules/pytradfri/default.nix
index 58b3ea9f2ec9..83ab0a9879f3 100644
--- a/pkgs/development/python-modules/pytradfri/default.nix
+++ b/pkgs/development/python-modules/pytradfri/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "pytradfri";
-  version = "12.0.1";
+  version = "13.0.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "home-assistant-libs";
     repo = "pytradfri";
     rev = "refs/tags/${version}";
-    hash = "sha256-ov5Z9frYxdbPxqUedwXPYZEinCgQ0ge1jcX6UFdQMHw=";
+    hash = "sha256-CWv3ebDulZuiFP+nJ2Xr7U/HTDFTqA9VYC0USLkpWR0=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pyvicare/default.nix b/pkgs/development/python-modules/pyvicare/default.nix
index 97d2b5a83ba6..b238d82ec98d 100644
--- a/pkgs/development/python-modules/pyvicare/default.nix
+++ b/pkgs/development/python-modules/pyvicare/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "pyvicare";
-  version = "2.24.0";
+  version = "2.25.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "somm15";
     repo = "PyViCare";
     rev = version;
-    sha256 = "sha256-D0N7kRTzfKCxLNtRJML+xykvsv3Mv0WHdlA05eLHl3M=";
+    sha256 = "sha256-OZvYl8wl8kOIOfsWVn74XFKMX/jAmtoMTIEQpAZmTeo=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
diff --git a/pkgs/development/python-modules/rflink/default.nix b/pkgs/development/python-modules/rflink/default.nix
index a751ef1d4c0e..8c02dd5393ed 100644
--- a/pkgs/development/python-modules/rflink/default.nix
+++ b/pkgs/development/python-modules/rflink/default.nix
@@ -23,6 +23,15 @@ buildPythonPackage rec {
     sha256 = "sha256-BNKcXtsBB90KQe4HXmfJ7H3yepk1dEkozSEy5v8KSAA=";
   };
 
+  patches = [
+    # https://github.com/aequitas/python-rflink/pull/70
+    (fetchpatch {
+      name = "python311-compat.patch";
+      url = "https://github.com/aequitas/python-rflink/commit/ba807ddd2fde823b8d50bc50bb500a691d9e331f.patch";
+      hash = "sha256-4Wh7b7j8qsvzYKdFwaY+B5Jd8EkyjAe1awlY0BDu2YA=";
+    })
+  ];
+
   propagatedBuildInputs = [
     async-timeout
     docopt
diff --git a/pkgs/development/python-modules/schema/default.nix b/pkgs/development/python-modules/schema/default.nix
index c095ea9ca921..008813330dc8 100644
--- a/pkgs/development/python-modules/schema/default.nix
+++ b/pkgs/development/python-modules/schema/default.nix
@@ -1,10 +1,10 @@
 { lib
 , buildPythonPackage
-, contextlib2
 , fetchPypi
 , mock
 , pytestCheckHook
 , pythonOlder
+, pythonRelaxDepsHook
 }:
 
 buildPythonPackage rec {
@@ -19,8 +19,12 @@ buildPythonPackage rec {
     hash = "sha256-8GcXESxhiVyrxHB3UriHFuhCCogZ1xQEUB4RT5EEMZc=";
   };
 
-  propagatedBuildInputs = [
-    contextlib2
+  nativeBuildInputs = [
+    pythonRelaxDepsHook
+  ];
+
+  pythonRemoveDeps = [
+    "contextlib2"
   ];
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/scrapy-splash/default.nix b/pkgs/development/python-modules/scrapy-splash/default.nix
index 9be77facf08e..290637cb8abb 100644
--- a/pkgs/development/python-modules/scrapy-splash/default.nix
+++ b/pkgs/development/python-modules/scrapy-splash/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "scrapy-splash";
-  version = "0.8.0";
+  version = "0.9.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "a7c17735415151ae01f07b03c7624e7276a343779b3c5f4546f655f6133df42f";
+    sha256 = "sha256-7PEwJk3AjgxGHIYH7K13dGimStAd7bJinA+BvV/NcpU=";
   };
 
   propagatedBuildInputs = [ scrapy six ];
diff --git a/pkgs/development/python-modules/scrapy/default.nix b/pkgs/development/python-modules/scrapy/default.nix
index 646db47538bb..62756a4eab2c 100644
--- a/pkgs/development/python-modules/scrapy/default.nix
+++ b/pkgs/development/python-modules/scrapy/default.nix
@@ -31,7 +31,7 @@
 
 buildPythonPackage rec {
   pname = "scrapy";
-  version = "2.7.1";
+  version = "2.8.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -39,7 +39,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     inherit version;
     pname = "Scrapy";
-    hash = "sha256-MPpAg1PSSx35ed8upK+9GbSuAvsiB/IY0kYzLx4c8U4=";
+    hash = "sha256-gHGsbGXxhewsdv6FCflNmf6ggFGf3CBvkIqSDV4F/kM=";
   };
 
   nativeBuildInputs = [
@@ -118,12 +118,18 @@ buildPythonPackage rec {
     "test_xmliter_encoding"
     "test_download"
     "test_reactor_default_twisted_reactor_select"
+    "URIParamsSettingTest"
+    "URIParamsFeedOptionTest"
+    # flaky on darwin-aarch64
+    "test_fixed_delay"
+    "test_start_requests_laziness"
   ];
 
   postInstall = ''
     installManPage extras/scrapy.1
-    install -m 644 -D extras/scrapy_bash_completion $out/share/bash-completion/completions/scrapy
-    install -m 644 -D extras/scrapy_zsh_completion $out/share/zsh/site-functions/_scrapy
+    installShellCompletion --cmd scrapy \
+      --zsh extras/scrapy_zsh_completion \
+      --bash extras/scrapy_bash_completion
   '';
 
   pythonImportsCheck = [
@@ -143,6 +149,5 @@ buildPythonPackage rec {
     changelog = "https://github.com/scrapy/scrapy/raw/${version}/docs/news.rst";
     license = licenses.bsd3;
     maintainers = with maintainers; [ marsam ];
-    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/tools/bazelisk/default.nix b/pkgs/development/tools/bazelisk/default.nix
index fd8a78a1ac6b..aeec00e99a9b 100644
--- a/pkgs/development/tools/bazelisk/default.nix
+++ b/pkgs/development/tools/bazelisk/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "bazelisk";
-  version = "1.15.0";
+  version = "1.16.0";
 
   src = fetchFromGitHub {
     owner = "bazelbuild";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-+JAAei783S9umDSMSQq50ovYm1MCID33W6dolTxBEvU=";
+    sha256 = "sha256-ijw0JVU9jUhpIJQjcjgzAVPJDxD7WSZYiLV0OvOyS5g=";
   };
 
-  vendorSha256 = "sha256-JJdFecRjPVmpYjDmz+ZBDmyT3Vj41An3BXvI2JzisIg=";
+  vendorHash = "sha256-Hg8rMknanHQOgVLJ58QM9JOgrUYMqL7WvaHuiv9xVYw=";
 
   doCheck = false;
 
diff --git a/pkgs/development/tools/coder/default.nix b/pkgs/development/tools/coder/default.nix
index 9fd3a86f597d..30d22bc183dc 100644
--- a/pkgs/development/tools/coder/default.nix
+++ b/pkgs/development/tools/coder/default.nix
@@ -5,19 +5,19 @@
 }:
 buildGoModule rec {
   pname = "coder";
-  version = "0.15.3";
+  version = "0.16.0";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-d3Cg7G1rjxEqKMsIqxZ6ZZDEMIoisDtjZMmyixZRpF4=";
+    hash = "sha256-3rGpyJzGkZYUEvKKDzj2I5sqrUImmmX7cXWM9UClPLY=";
   };
 
   # integration tests require network access
   doCheck = false;
 
-  vendorHash = "sha256-F9r99WhL1Uv5NNVlQYpQc282BAl8bUhJI5mZZYwyEEg=";
+  vendorHash = "sha256-bb9jBno7elO6qKGjacpX3rxgrpJpGpTxMQtdBYjBzMk=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/development/tools/go-tools/default.nix b/pkgs/development/tools/go-tools/default.nix
index 3890133256ed..5077bc45b82f 100644
--- a/pkgs/development/tools/go-tools/default.nix
+++ b/pkgs/development/tools/go-tools/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "go-tools";
-  version = "2022.1.2";
+  version = "2023.1";
 
   src = fetchFromGitHub {
     owner = "dominikh";
     repo = "go-tools";
     rev = version;
-    sha256 = "sha256-pfZv/GZxb7weD+JFGCOknhRCsx8g5puQfpY9lZ4v6Rs=";
+    sha256 = "sha256-RzYaaiDu78JVM8G0zJzlZcyCd+1V9KZIyIIyVib0yZc=";
   };
 
-  vendorSha256 = "sha256-19uLCtKuuZoVwC4SUKvYGWi2ryqAQbcKXY1iNjIqyn8=";
+  vendorHash = "sha256-o9UtS6AMgRYuAkOWdktG2Kr3QDBDQTOGSlya69K2br8=";
 
   excludedPackages = [ "website" ];
 
diff --git a/pkgs/development/tools/initool/default.nix b/pkgs/development/tools/initool/default.nix
new file mode 100644
index 000000000000..ce8f769ae442
--- /dev/null
+++ b/pkgs/development/tools/initool/default.nix
@@ -0,0 +1,41 @@
+{ stdenv
+, mlton
+, lib
+, fetchFromGitHub
+}:
+
+stdenv.mkDerivation rec {
+  pname = "initool";
+  version = "0.10.0";
+
+  src = fetchFromGitHub {
+    owner = "dbohdan";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-pszlP9gy1zjQjNNr0L1NY0XViejUUuvUZH6JHtUxdJI=";
+  };
+
+  nativeBuildInputs = [ mlton ];
+
+  doCheck = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    cp initool $out/bin/
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    inherit (mlton.meta) platforms;
+
+    description = "Manipulate INI files from the command line";
+    homepage = "https://github.com/dbohdan/initool";
+    license = licenses.mit;
+    maintainers = with maintainers; [ e1mo ];
+    changelog = "https://github.com/dbohdan/initool/releases/tag/v${version}";
+  };
+}
+
diff --git a/pkgs/development/tools/kafkactl/default.nix b/pkgs/development/tools/kafkactl/default.nix
index d18b32c6f440..750e93f66557 100644
--- a/pkgs/development/tools/kafkactl/default.nix
+++ b/pkgs/development/tools/kafkactl/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "kafkactl";
-  version = "3.0.2";
+  version = "3.0.3";
 
   src = fetchFromGitHub {
     owner = "deviceinsight";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-ZEXW9nqkR0yuVIY9qr1RyKVE7tSlP59Xb4JZfdAK2To=";
+    sha256 = "sha256-rz3cAA5iqhrCZhLc+RKZhudiMlfu3m6wWYNHAnUP/kg=";
   };
 
-  vendorHash = "sha256-e7SJjDWcHPgupZujeRD3Zg6vFAudDC3V60R2B61fjGU=";
+  vendorHash = "sha256-Y3BPt3PsedrlCoKiKUObf6UQd+MuNiCGLpJUg94XSgA=";
   doCheck = false;
 
   meta = with lib; {
diff --git a/pkgs/development/tools/kubernetes-controller-tools/default.nix b/pkgs/development/tools/kubernetes-controller-tools/default.nix
index 57723da45eb3..8899d712a37d 100644
--- a/pkgs/development/tools/kubernetes-controller-tools/default.nix
+++ b/pkgs/development/tools/kubernetes-controller-tools/default.nix
@@ -2,18 +2,18 @@
 
 buildGoModule rec {
   pname = "controller-tools";
-  version = "0.11.1";
+  version = "0.11.2";
 
   src = fetchFromGitHub {
     owner = "kubernetes-sigs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-mtAP8qRfSdt2koKs6LSI9iiXsyK92q1yWOC9zV8utFg=";
+    sha256 = "sha256-gTSgfykTg2cWV7PCwNcbuFY89RRk9MoV24L4EuEd378=";
   };
 
   patches = [ ./version.patch ];
 
-  vendorSha256 = "sha256-9IGdsAqvi01Jf0FpxfL+O+LrDchh4dGgJX4JJIvL3vE=";
+  vendorHash = "sha256-nZyDoME5fVqRoAeLADjrQ7i6mVf3ujGN2+BUfrSHck8=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/development/tools/kubie/default.nix b/pkgs/development/tools/kubie/default.nix
index 4d363d4e75f4..f58b3de97740 100644
--- a/pkgs/development/tools/kubie/default.nix
+++ b/pkgs/development/tools/kubie/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "kubie";
-  version = "0.19.2";
+  version = "0.19.3";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "sbstp";
     repo = "kubie";
-    sha256 = "sha256-foY1fcIn+jywABwEVBWctx4zwLg7k2zxkpL8UAhx6kA=";
+    sha256 = "sha256-c4+ebl/tWPxAlgt/N5/xalZQZGSizKp/pDcgojbjy7A=";
   };
 
-  cargoHash = "sha256-WHaORWwR7PeKacaCtXjTYMTCyZ4ZFWo1smVx5ig+Z9U=";
+  cargoHash = "sha256-D3RjlYMD/UHfYxUMvZVSiRHOPmcLVGgsRVghoaMn9AM=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/development/tools/language-servers/millet/default.nix b/pkgs/development/tools/language-servers/millet/default.nix
index 036c5057d899..66488a607fd1 100644
--- a/pkgs/development/tools/language-servers/millet/default.nix
+++ b/pkgs/development/tools/language-servers/millet/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "millet";
-  version = "0.7.6";
+  version = "0.7.7";
 
   src = fetchFromGitHub {
     owner = "azdavis";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-7Mv1+c8X+rZQyw3y+eGvSyqVqiSPdTj1WxoUv1mynSs=";
+    hash = "sha256-1GoZbeXNG00oxBdPa2yk0aOCVguwIkK6fKrlHU6mZYc=";
   };
 
-  cargoHash = "sha256-0fJIp2zlZkeidTFg6jQs6S2mVHJL8flqiZtTvM0F9OQ=";
+  cargoHash = "sha256-arIFWJX8WQQWcJP1YpMwFy2XHU/0w+oPj1qE/IlYRF4=";
 
   postPatch = ''
     rm .cargo/config.toml
diff --git a/pkgs/development/tools/language-servers/verible/default.nix b/pkgs/development/tools/language-servers/verible/default.nix
index d39b91180f98..91ac7b7bce05 100644
--- a/pkgs/development/tools/language-servers/verible/default.nix
+++ b/pkgs/development/tools/language-servers/verible/default.nix
@@ -13,18 +13,21 @@ let
 in
 buildBazelPackage rec {
   pname = "verible";
-  version = "0.0-2472-ga80124e1";
 
   # These environment variables are read in bazel/build-version.py to create
-  # a build string. Otherwise it would attempt to extract it from .git/.
-  GIT_DATE = "2022-10-21";
-  GIT_VERSION = version;
+  # a build string shown in the tools --version output.
+  # If env variables not set, it would attempt to extract it from .git/.
+  GIT_DATE = "2023-02-02";
+  GIT_VERSION = "v0.0-2821-gb2180bfa";
+
+  # Derive nix package version from GIT_VERSION: "v1.2-345-abcde" -> "1.2.345"
+  version = builtins.concatStringsSep "." (lib.take 3 (lib.drop 1 (builtins.splitVersion GIT_VERSION)));
 
   src = fetchFromGitHub {
     owner = "chipsalliance";
     repo = "verible";
-    rev = "v${version}";
-    sha256 = "sha256:0jpdxqhnawrl80pbc8544pyggdp5s3cbc7byc423d5v0sri2f96v";
+    rev = "${GIT_VERSION}";
+    sha256 = "sha256-etcimvInhebH2zRPyZnWUq6m3VnCq44w32GJrIacULo=";
   };
 
   patches = [
@@ -46,8 +49,8 @@ buildBazelPackage rec {
     # of the output derivation ? Is there a more robust way to do this ?
     # (Hashes extracted from the ofborg build logs)
     sha256 = {
-      aarch64-linux = "sha256-6Udp7sZKGU8gcy6+5WPhkSWunf1sVkha8l5S1UQsC04=";
-      x86_64-linux = "sha256-WfhgbJFaM/ipdd1dRjPeVZ1mK2hotb0wLmKjO7e+BO4=";
+      aarch64-linux = "sha256-dYJoae3+u+gpULHS8nteFzzL974cVJ+cJzeG/Dz2HaQ=";
+      x86_64-linux = "sha256-Jd99+nhqgZ2Gwd78eyXfnSSfbl8C3hoWkiUnzJG1jqM=";
     }.${system} or (throw "No hash for system: ${system}");
   };
 
@@ -62,12 +65,9 @@ buildBazelPackage rec {
       bazel/build-version.py \
       bazel/sh_test_with_runfiles_lib.sh \
       common/lsp/dummy-ls_test.sh \
-      common/parser/move_yacc_stack_symbols.sh \
-      common/parser/record_syntax_error.sh \
       common/tools/patch_tool_test.sh \
       common/tools/verible-transform-interactive.sh \
       common/tools/verible-transform-interactive-test.sh \
-      common/util/create_version_header.sh \
       kythe-browse.sh \
       verilog/tools
   '';
diff --git a/pkgs/development/tools/language-servers/verible/remove-unused-deps.patch b/pkgs/development/tools/language-servers/verible/remove-unused-deps.patch
index 19d20309c106..57b152d9db31 100644
--- a/pkgs/development/tools/language-servers/verible/remove-unused-deps.patch
+++ b/pkgs/development/tools/language-servers/verible/remove-unused-deps.patch
@@ -1,5 +1,5 @@
 diff --git a/WORKSPACE b/WORKSPACE
-index 696cc7ef..55a5bb8a 100644
+index ad16b3a1..52b66703 100644
 --- a/WORKSPACE
 +++ b/WORKSPACE
 @@ -81,17 +81,6 @@ load("@com_github_google_rules_install//:setup.bzl", "install_rules_setup")
@@ -12,11 +12,11 @@ index 696cc7ef..55a5bb8a 100644
 -
 -win_flex_configure(
 -    name = "win_flex_bison",
--    sha256 = "095cf65cb3f12ee5888022f93109acbe6264e5f18f6ffce0bda77feb31b65bd8",
--    # bison 3.3.2, flex 2.6.4
--    url = "https://github.com/lexxmark/winflexbison/releases/download/v2.5.18/win_flex_bison-2.5.18.zip",
+-    sha256 = "8d324b62be33604b2c45ad1dd34ab93d722534448f55a16ca7292de32b6ac135",
+-    # bison 3.8.2, flex 2.6.4
+-    url = "https://github.com/lexxmark/winflexbison/releases/download/v2.5.25/win_flex_bison-2.5.25.zip",
 -)
 -
  http_archive(
      name = "rules_m4",
-     sha256 = "c67fa9891bb19e9e6c1050003ba648d35383b8cb3c9572f397ad24040fb7f0eb",
+     sha256 = "b0309baacfd1b736ed82dc2bb27b0ec38455a31a3d5d20f8d05e831ebeef1a8e",
diff --git a/pkgs/development/tools/misc/act/default.nix b/pkgs/development/tools/misc/act/default.nix
index 1c6fa49d7c1a..a8fd24ebd6a3 100644
--- a/pkgs/development/tools/misc/act/default.nix
+++ b/pkgs/development/tools/misc/act/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "act";
-  version = "0.2.41";
+  version = "0.2.42";
 
   src = fetchFromGitHub {
     owner = "nektos";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-nfMLw3fjEex1XV+Vhi84xR+ghBLrmKDtuFIIeNhP/yQ=";
+    hash = "sha256-+1ciEHBMl78aFDu/NzIAdsGtAZJOfHZRDDZCR1+YuEM=";
   };
 
   vendorHash = "sha256-qXjDeR0VZyyhASpt6zv6OyltEZDoguILhhD1ejpd0F4=";
diff --git a/pkgs/development/tools/operator-sdk/default.nix b/pkgs/development/tools/operator-sdk/default.nix
index 3b38cc97e6b8..fd8658ad0734 100644
--- a/pkgs/development/tools/operator-sdk/default.nix
+++ b/pkgs/development/tools/operator-sdk/default.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "operator-sdk";
-  version = "1.26.0";
+  version = "1.27.0";
 
   src = fetchFromGitHub {
     owner = "operator-framework";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-hIJTdTZ24+VwF1M/RvKcnQRzZga0nsjlTTUFYxZn0lo=";
+    hash = "sha256-rvLWM6G2kOOuFU0JuwdIjSCFNyjBNL+fOoEj+tIR190=";
   };
 
-  vendorHash = "sha256-1Vz+SIrNULajDqzZt53+o9wv1zLPBvKrO28BTqS4VbM=";
+  vendorHash = "sha256-L+Z1k+z/XNO9OeTQVzNJd1caRip6Ti8mPfNmXJx5D5c=";
 
   nativeBuildInputs = [
     makeWrapper
diff --git a/pkgs/development/tools/parsing/spicy/default.nix b/pkgs/development/tools/parsing/spicy/default.nix
new file mode 100644
index 000000000000..f379a1ed0517
--- /dev/null
+++ b/pkgs/development/tools/parsing/spicy/default.nix
@@ -0,0 +1,67 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, makeWrapper
+, python3
+, bison
+, flex
+, zlib
+}:
+
+stdenv.mkDerivation rec {
+  pname = "spicy";
+  version = "1.5.3";
+
+  strictDeps = true;
+
+  src = fetchFromGitHub {
+    owner = "zeek";
+    repo = "spicy";
+    rev = "v${version}";
+    hash = "sha256-eCF914QEBBqg3LfM3N22c7W0TMOhuHqLxncpAG+8FjU=";
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = [
+    cmake
+    makeWrapper
+    python3
+  ];
+
+  buildInputs = [
+    bison
+    flex
+    zlib
+  ];
+
+  postPatch = ''
+    patchShebangs scripts tests/scripts
+  '';
+
+  cmakeFlags = [
+    "-DHILTI_DEV_PRECOMPILE_HEADERS=OFF"
+  ];
+
+  preFixup = ''
+    for b in $out/bin/*
+      do wrapProgram "$b" --prefix PATH : "${lib.makeBinPath [ bison flex ]}"
+    done
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/zeek/spicy";
+    description = "A C++ parser generator for dissecting protocols & files";
+    longDescription = ''
+      Spicy is a parser generator that makes it easy to create robust C++
+      parsers for network protocols, file formats, and more. Spicy is a bit
+      like a "yacc for protocols", but it's much more than that: It's an
+      all-in-one system enabling developers to write attributed grammars that
+      describe both syntax and semantics of an input format using a single,
+      unified language. Think of Spicy as a domain-specific scripting language
+      for all your parsing needs.
+    '';
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ tobim ];
+  };
+}
diff --git a/pkgs/development/tools/pgformatter/default.nix b/pkgs/development/tools/pgformatter/default.nix
index 9e792a49733b..9704788141c7 100644
--- a/pkgs/development/tools/pgformatter/default.nix
+++ b/pkgs/development/tools/pgformatter/default.nix
@@ -2,13 +2,13 @@
 
 perlPackages.buildPerlPackage rec {
   pname = "pgformatter";
-  version = "5.4";
+  version = "5.5";
 
   src = fetchFromGitHub {
     owner = "darold";
     repo = "pgFormatter";
     rev = "v${version}";
-    sha256 = "sha256-z90V4aKp5gIZMWQha3gHpTMtpYVsGhFtPWHiJuFt3qA=";
+    hash = "sha256-4KtrsckO9Q9H0yIM0877YvWaDW02CQVAQiOKD919e9w=";
   };
 
   outputs = [ "out" ];
@@ -40,5 +40,6 @@ perlPackages.buildPerlPackage rec {
     changelog = "https://github.com/darold/pgFormatter/releases/tag/v${version}";
     maintainers = [ maintainers.marsam ];
     license = [ licenses.postgresql licenses.artistic2 ];
+    mainProgram = "pg_format";
   };
 }
diff --git a/pkgs/development/tools/rust/panamax/default.nix b/pkgs/development/tools/rust/panamax/default.nix
index 6dd1d5e32bd8..a86867eded08 100644
--- a/pkgs/development/tools/rust/panamax/default.nix
+++ b/pkgs/development/tools/rust/panamax/default.nix
@@ -11,14 +11,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "panamax";
-  version = "1.0.6";
+  version = "1.0.12";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-/JW2QB5PtwKo0TLU/QmkgsE6/ne+51EVmWyGn7Lljdw=";
+    sha256 = "sha256-nHAsKvNEhGDVrLx8K7xnm7TuCxaZcYwlQ6xjVRvDdSk=";
   };
 
-  cargoSha256 = "sha256-aKdDismdPcExqznS6S2LvAij6gv9/Hw2FBvkhr9rJGo=";
+  cargoSha256 = "sha256-ydZ0KM/g9k0ux7Zr4crlxnKCC9N/qPzn1wmzbTIyz7o=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/development/tools/swc/default.nix b/pkgs/development/tools/swc/default.nix
new file mode 100644
index 000000000000..c68542978d12
--- /dev/null
+++ b/pkgs/development/tools/swc/default.nix
@@ -0,0 +1,26 @@
+{ lib
+, rustPlatform
+, fetchCrate
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "swc";
+  version = "0.91.19";
+
+  src = fetchCrate {
+    pname = "swc_cli";
+    inherit version;
+    sha256 = "sha256-BzReetAOKSGzHhITXpm+J2Rz8d9Hq2HUagQmfst74Ag=";
+  };
+
+  cargoSha256 = "sha256-1U9YLrPYENv9iJobCxtgnQakJLDctWQwnDUtpLG3PGc=";
+
+  buildFeatures = [ "swc_core/plugin_transform_host_native" ];
+
+  meta = with lib; {
+    description = "Rust-based platform for the Web";
+    homepage = "https://github.com/swc-project/swc";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ dit7ya ];
+  };
+}
diff --git a/pkgs/games/flightgear/default.nix b/pkgs/games/flightgear/default.nix
index bf94dfa067f6..eb39b3e19a71 100644
--- a/pkgs/games/flightgear/default.nix
+++ b/pkgs/games/flightgear/default.nix
@@ -6,7 +6,7 @@
 }:
 
 let
-  version = "2020.3.13";
+  version = "2020.3.17";
   shortVersion = builtins.substring 0 6 version;
   data = stdenv.mkDerivation rec {
     pname = "flightgear-data";
@@ -14,7 +14,7 @@ let
 
     src = fetchurl {
       url = "mirror://sourceforge/flightgear/release-${shortVersion}/FlightGear-${version}-data.txz";
-      sha256 = "sha256-C3iUVA7IJQ77OdXcaBnSpDphMFjmFZmn0nozQvdxSJM=";
+      sha256 = "sha256-Kl66K5rmejaRKFgzps4/a73z8gIp9YcdfJQOFR1U2Og=";
     };
 
     dontUnpack = true;
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://sourceforge/flightgear/release-${shortVersion}/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-Zhq/r0davIz9G6tXVZRp76ZivG0D9Y6Nl3OFAD/lqow=";
+    sha256 = "sha256-ZnDe3qyiaDrKd/nwa/nR2AYq4yoqVFnd3IqgmJxfGFQ=";
   };
 
   # Of all the files in the source and data archives, there doesn't seem to be
diff --git a/pkgs/games/lunar-client/default.nix b/pkgs/games/lunar-client/default.nix
index 8bb2e0d0a6fa..3bc493f5d025 100644
--- a/pkgs/games/lunar-client/default.nix
+++ b/pkgs/games/lunar-client/default.nix
@@ -2,7 +2,7 @@
 
 let
   name = "lunar-client";
-  version = "2.10.1";
+  version = "2.15.1";
 
   desktopItem = makeDesktopItem {
     name = "lunar-client";
@@ -21,7 +21,7 @@ let
   src = fetchurl {
     url = "https://launcherupdates.lunarclientcdn.com/Lunar%20Client-${version}.AppImage";
     name = "lunar-client.AppImage";
-    hash = "sha256-3h2FFpIIRta6hEsa/H0xo8+DUvhdQyBv9dqdd/vlwZ4=";
+    hash = "sha256-8F6inLctNLCrTvO/f4IWHclpm/6vqW44NKbct0Epp4s=";
   };
 in
 appimageTools.wrapType1 rec {
diff --git a/pkgs/games/otto-matic/default.nix b/pkgs/games/otto-matic/default.nix
index 17b63b263029..a3d75bc34aa0 100644
--- a/pkgs/games/otto-matic/default.nix
+++ b/pkgs/games/otto-matic/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "OttoMatic";
-  version = "4.0.0";
+  version = "4.0.1";
 
   src = fetchFromGitHub {
     owner = "jorio";
     repo = pname;
     rev = version;
-    sha256 = "sha256-eHy5yED5qrgHqKuqq1dXhmuR2PQBE5aMhSLPoydlpPk=";
+    sha256 = "sha256-0mqOAdAmJGxKa6yXktrbmdXkoQIliimq37iy9bCBZYg=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/games/unciv/default.nix b/pkgs/games/unciv/default.nix
index b036ded0b74c..09d2d52874e2 100644
--- a/pkgs/games/unciv/default.nix
+++ b/pkgs/games/unciv/default.nix
@@ -25,11 +25,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "unciv";
-  version = "4.4.6";
+  version = "4.4.9";
 
   src = fetchurl {
     url = "https://github.com/yairm210/Unciv/releases/download/${version}/Unciv.jar";
-    sha256 = "sha256-I4EKYoN+36a65mcZ2UWH3Ws75Ojdmpw/6flKFmEuIk8=";
+    sha256 = "sha256-8OoQgiMrjYPlEjvm/9m7YkMaKyGBtNBkGavjACwY/00=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/games/unvanquished/default.nix b/pkgs/games/unvanquished/default.nix
index 5a088f34a4ce..98b8917f6e2b 100644
--- a/pkgs/games/unvanquished/default.nix
+++ b/pkgs/games/unvanquished/default.nix
@@ -33,15 +33,15 @@
 }:
 
 let
-  version = "0.53.2";
-  binary-deps-version = "6";
+  version = "0.54.0";
+  binary-deps-version = "8";
 
   src = fetchFromGitHub {
     owner = "Unvanquished";
     repo = "Unvanquished";
     rev = "v${version}";
     fetchSubmodules = true;
-    sha256 = "sha256-VqMhA6GEYh/m+dzOgXS+5Jqo4x7RrQf4qIwstdTTU+E=";
+    sha256 = "sha256-X2c6BHI4W6fOurLiBWIBZzJrZ+7RHMEwN8GJGz6e350=";
   };
 
   unvanquished-binary-deps = stdenv.mkDerivation rec {
@@ -50,8 +50,8 @@ let
     version = binary-deps-version;
 
     src = fetchzip {
-      url = "https://dl.unvanquished.net/deps/linux64-${version}.tar.bz2";
-      sha256 = "sha256-ERfg89oTf9JTtv/qRnTRIzFP+zMpHT8W4WAIxqogy9E=";
+      url = "https://dl.unvanquished.net/deps/linux-amd64-default_${version}.tar.xz ";
+      sha256 = "sha256-6r9j0HRMDC/7i8f4f5bBK4NmwsTpSChHrRWwz0ENAZo=";
     };
 
     dontPatchELF = true;
@@ -119,7 +119,7 @@ let
     pname = "unvanquished-assets";
     inherit version src;
 
-    outputHash = "sha256-MPqyqcZGc5KlkftGCspWhISBJ/h+Os29g7ZK6yWz0cQ=";
+    outputHash = "sha256-ua9Q5E5C4t8z/yNQp6qn1i9NNDAk4ohzvgpMbCBxb8Q=";
     outputHashMode = "recursive";
 
     nativeBuildInputs = [ aria2 cacert ];
@@ -135,9 +135,10 @@ in stdenv.mkDerivation rec {
   inherit version src binary-deps-version;
 
   preConfigure = ''
-    mkdir daemon/external_deps/linux64-${binary-deps-version}/
-    cp -r ${unvanquished-binary-deps}/* daemon/external_deps/linux64-${binary-deps-version}/
-    chmod +w -R daemon/external_deps/linux64-${binary-deps-version}/
+    TARGET="linux-amd64-default_${binary-deps-version}"
+    mkdir daemon/external_deps/"$TARGET"
+    cp -r ${unvanquished-binary-deps}/* daemon/external_deps/"$TARGET"/
+    chmod +w -R daemon/external_deps/"$TARGET"/
   '';
 
   nativeBuildInputs = [
@@ -202,7 +203,7 @@ in stdenv.mkDerivation rec {
     for f in daemon daemon-tty daemonded nacl_loader nacl_helper_bootstrap; do
       install -Dm0755 -t $out/lib/ $f
     done
-    install -Dm0644 -t $out/lib/ irt_core-x86_64.nexe
+    install -Dm0644 -t $out/lib/ irt_core-amd64.nexe
 
     mkdir $out/bin/
     ${wrapBinary "daemon"     "unvanquished"}
diff --git a/pkgs/os-specific/linux/ksmbd-tools/default.nix b/pkgs/os-specific/linux/ksmbd-tools/default.nix
index 5a58c198c0e4..56cfb8ef9c21 100644
--- a/pkgs/os-specific/linux/ksmbd-tools/default.nix
+++ b/pkgs/os-specific/linux/ksmbd-tools/default.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ksmbd-tools";
-  version = "3.4.6";
+  version = "3.4.7";
 
   src = fetchFromGitHub {
     owner = "cifsd-team";
     repo = pname;
     rev = version;
-    sha256 = "sha256-zquHhr+Zf4jR/TlVA0Zea3eZ9JjRjYXefcYIQs76gSw=";
+    sha256 = "sha256-uYJhjxarAqJC/aY8UUy7sjhA89LVoCG6B7/APkE0ouk=";
   };
 
   buildInputs = [ glib libnl ] ++ lib.optional withKerberos libkrb5;
diff --git a/pkgs/os-specific/linux/libzbd/default.nix b/pkgs/os-specific/linux/libzbd/default.nix
index f058e09bbd2c..c5d8e9cf80a4 100644
--- a/pkgs/os-specific/linux/libzbd/default.nix
+++ b/pkgs/os-specific/linux/libzbd/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libzbd";
-  version = "2.0.3";
+  version = "2.0.4";
 
   src = fetchFromGitHub {
     owner = "westerndigitalcorporation";
     repo = "libzbd";
     rev = "v${version}";
-    sha256 = "GoCHwuR4ylyaN/FskIqKyAPe2A2O3iFVcI3UxPlqvtk=";
+    sha256 = "sha256-iMQjOWsgsS+uI8mqoOXHRAV1+SIu1McUAcrsY+/zcu8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/servers/computing/slurm/default.nix b/pkgs/servers/computing/slurm/default.nix
index 1bee79918927..2281031a6449 100644
--- a/pkgs/servers/computing/slurm/default.nix
+++ b/pkgs/servers/computing/slurm/default.nix
@@ -14,7 +14,7 @@
 
 stdenv.mkDerivation rec {
   pname = "slurm";
-  version = "22.05.7.1";
+  version = "22.05.8.1";
 
   # N.B. We use github release tags instead of https://www.schedmd.com/downloads.php
   # because the latter does not keep older releases.
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
     repo = "slurm";
     # The release tags use - instead of .
     rev = "${pname}-${builtins.replaceStrings ["."] ["-"] version}";
-    sha256 = "1hr62c9g0z3brgpa2l68pskraqxk52dk1iq1xkb0dr5w0cwhdpij";
+    sha256 = "sha256-hL/FnHl+Fj62xGH1FVkB9jVtvrVxbPU73DlMWC6CyJ0=";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/servers/etcd/3.5.nix b/pkgs/servers/etcd/3.5.nix
index 427233278707..ede9f78e8d59 100644
--- a/pkgs/servers/etcd/3.5.nix
+++ b/pkgs/servers/etcd/3.5.nix
@@ -1,13 +1,13 @@
 { lib, buildGoModule, fetchFromGitHub, symlinkJoin }:
 
 let
-  version = "3.5.6";
+  version = "3.5.7";
 
   src = fetchFromGitHub {
     owner = "etcd-io";
     repo = "etcd";
     rev = "v${version}";
-    sha256 = "sha256-KQ3N6HBgdLnS/8UprT99gH9ttsy2cgfaWSL/ILX6t1A=";
+    hash = "sha256-VgWY622RJ8f4yA6TRC5IvatVFw2CP5lN3QBS3Xaevbc=";
   };
 
   CGO_ENABLED = 0;
@@ -25,11 +25,11 @@ let
 
     inherit CGO_ENABLED meta src version;
 
-    vendorSha256 = "sha256-u4N8YXmnVk5flPimdE4olr/1hVZoEDEgUwXRRTlX51o=";
+    vendorHash = "sha256-w/aWrQF/PAWTGMFUcpHiiDef6cvLLdYP06iwBdxrGkQ=";
 
     modRoot = "./server";
 
-    postBuild = ''
+    preInstall = ''
       mv $GOPATH/bin/{server,etcd}
     '';
 
@@ -45,7 +45,7 @@ let
 
     inherit CGO_ENABLED meta src version;
 
-    vendorSha256 = "sha256-J4qW2Dzpwk85XW3oWvT1F5ec/jzkcLbTC+1CMBztWRw=";
+    vendorHash = "sha256-Bq5vOZCflLDAhhmwSww9JCahfL/JHKa3ZT4cwNXzW90=";
 
     modRoot = "./etcdutl";
   };
@@ -55,7 +55,7 @@ let
 
     inherit CGO_ENABLED meta src version;
 
-    vendorSha256 = "sha256-+5zWXVErkFAvtkpNQtKn/jLOGUdHkXgeZWI7/RIMgMQ=";
+    vendorHash = "sha256-KUr0SrfuE5sh54THdvJwuMO/U6O+civ6onEPzNGqf18=";
 
     modRoot = "./etcdctl";
   };
diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index a2551e362a58..51a694006528 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -2,7 +2,7 @@
 # Do not edit!
 
 {
-  version = "2023.2.1";
+  version = "2023.2.2";
   components = {
     "3_day_blinds" = ps: with ps; [
     ];
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index 62e8b042815a..07bb320e7112 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -271,7 +271,7 @@ let
   extraPackagesFile = writeText "home-assistant-packages" (lib.concatMapStringsSep "\n" (pkg: pkg.pname) extraBuildInputs);
 
   # Don't forget to run parse-requirements.py after updating
-  hassVersion = "2023.2.1";
+  hassVersion = "2023.2.2";
 
 in python.pkgs.buildPythonApplication rec {
   pname = "homeassistant";
@@ -289,7 +289,7 @@ in python.pkgs.buildPythonApplication rec {
     owner = "home-assistant";
     repo = "core";
     rev = "refs/tags/${version}";
-    hash = "sha256-gWcq0E/k6c4YQJwLlU379kse2u4Yn6xvLZ5QnGXVTJA=";
+    hash = "sha256-HEL8e/2zoWPjeJL9iaCRu8aIldE3uTw9Yu9Q06Nyvz4=";
   };
 
   nativeBuildInputs = with python3.pkgs; [
diff --git a/pkgs/servers/mail/opensmtpd/filter-dkimsign/default.nix b/pkgs/servers/mail/opensmtpd/filter-dkimsign/default.nix
index a5b6cf9228d5..844eb8dc3d88 100644
--- a/pkgs/servers/mail/opensmtpd/filter-dkimsign/default.nix
+++ b/pkgs/servers/mail/opensmtpd/filter-dkimsign/default.nix
@@ -31,6 +31,6 @@ stdenv.mkDerivation rec {
     description = "OpenSMTPD filter for DKIM signing";
     homepage = "http://imperialat.at/dev/filter-dkimsign/";
     license = licenses.isc;
-    maintainers = with maintainers; [ malvo ];
+    maintainers = with maintainers; [ malte-v ];
   };
 }
diff --git a/pkgs/servers/mail/opensmtpd/libopensmtpd/default.nix b/pkgs/servers/mail/opensmtpd/libopensmtpd/default.nix
index f740a12e53f5..e9abdf0864f2 100644
--- a/pkgs/servers/mail/opensmtpd/libopensmtpd/default.nix
+++ b/pkgs/servers/mail/opensmtpd/libopensmtpd/default.nix
@@ -29,6 +29,6 @@ stdenv.mkDerivation rec {
     description = "Library for creating OpenSMTPD filters";
     homepage = "http://imperialat.at/dev/libopensmtpd/";
     license = licenses.isc;
-    maintainers = with maintainers; [ malvo ];
+    maintainers = with maintainers; [ malte-v ];
   };
 }
diff --git a/pkgs/servers/misc/oven-media-engine/default.nix b/pkgs/servers/misc/oven-media-engine/default.nix
index 0529a2bb0716..6aefa4f45342 100644
--- a/pkgs/servers/misc/oven-media-engine/default.nix
+++ b/pkgs/servers/misc/oven-media-engine/default.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation rec {
   pname = "oven-media-engine";
-  version = "0.14.18";
+  version = "0.15.0";
 
   src = fetchFromGitHub {
     owner = "AirenSoft";
     repo = "OvenMediaEngine";
     rev = "v${version}";
-    sha256 = "sha256-M204aIFbs2VmwgZbOmkpuyqOfpom/FnKc6noEVMuZfs=";
+    sha256 = "sha256-xw9X6PVXl7fLQcwIQOA3s8DbXKBQ5aqZpnKPgd47gjM=";
   };
 
   sourceRoot = "source/src";
diff --git a/pkgs/servers/monitoring/mackerel-agent/default.nix b/pkgs/servers/monitoring/mackerel-agent/default.nix
index 70ac2f3ab9fd..812bd159a5f2 100644
--- a/pkgs/servers/monitoring/mackerel-agent/default.nix
+++ b/pkgs/servers/monitoring/mackerel-agent/default.nix
@@ -2,20 +2,20 @@
 
 buildGoModule rec {
   pname = "mackerel-agent";
-  version = "0.74.1";
+  version = "0.75.0";
 
   src = fetchFromGitHub {
     owner = "mackerelio";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-c1CywtgvVORkDewFB9iz99aUT5gFi5vXWddGZGLFu7o=";
+    sha256 = "sha256-XwyBHCx3MngLItgCZfil5k/h6DfQTO+0LN3brldceXI=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
   nativeCheckInputs = lib.optionals (!stdenv.isDarwin) [ nettools ];
   buildInputs = lib.optionals (!stdenv.isDarwin) [ iproute2 ];
 
-  vendorHash = "sha256-281Qz57n5qAOoqLofTFv5UcLs0xVz8iyV9yxDdsuljE=";
+  vendorHash = "sha256-cSWyNGR1J2kk4XcaJXFEsMGx5OtyKyBoxY2FCa62x9c=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/servers/monitoring/prometheus/nut-exporter.nix b/pkgs/servers/monitoring/prometheus/nut-exporter.nix
index d05afd220533..ce859d669c6a 100644
--- a/pkgs/servers/monitoring/prometheus/nut-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/nut-exporter.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "nut-exporter";
-  version = "2.5.2";
+  version = "2.5.3";
 
   src = fetchFromGitHub {
     owner = "DRuggeri";
     repo = "nut_exporter";
     rev = "v${version}";
-    sha256 = "sha256-imO++i4bfxQnMNh+BOZRYvJAzqgehFIElpQX3NyQF+8=";
+    sha256 = "sha256-I44unG7eKBGxjm2HnCcm1ThlrDpDglXBork7meOOGiw=";
   };
 
   vendorHash = "sha256-ji8JlEYChPBakt5y6+zcm1l04VzZ0/fjfGFJ9p+1KHE=";
diff --git a/pkgs/servers/monitoring/telegraf/default.nix b/pkgs/servers/monitoring/telegraf/default.nix
index 9538872fb2c7..be3b102bfbe5 100644
--- a/pkgs/servers/monitoring/telegraf/default.nix
+++ b/pkgs/servers/monitoring/telegraf/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "telegraf";
-  version = "1.25.0";
+  version = "1.25.1";
 
   excludedPackages = "test";
 
@@ -12,10 +12,10 @@ buildGoModule rec {
     owner = "influxdata";
     repo = "telegraf";
     rev = "v${version}";
-    sha256 = "sha256-p+2nsJT3WHYmJ1toIwFi/a/I0//OaUoJIHmQcFHHJ/A=";
+    sha256 = "sha256-r+kbF4TajBkZyp0B6Tb/Y1Nm7e2zQctDYEmyn0qTqW0=";
   };
 
-  vendorSha256 = "sha256-xNio3bMFopMgDwdQdtFmkp3F0iWYHVqu9T42S5KNMU8=";
+  vendorHash = "sha256-AlmmWjwhC5xStcwo+NW0IwC+FteL4Ttwo717VgE8IHM=";
   proxyVendor = true;
 
   ldflags = [
diff --git a/pkgs/servers/monitoring/thanos/default.nix b/pkgs/servers/monitoring/thanos/default.nix
index 969292d6700b..5184d2c6408e 100644
--- a/pkgs/servers/monitoring/thanos/default.nix
+++ b/pkgs/servers/monitoring/thanos/default.nix
@@ -1,16 +1,16 @@
 { lib, buildGoModule, fetchFromGitHub }:
 buildGoModule rec {
   pname = "thanos";
-  version = "0.30.1";
+  version = "0.30.2";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "thanos-io";
     repo = "thanos";
-    sha256 = "sha256-fCH1smkgqDqs6N3ibBob5R1wsltwC3HV1elI37nfq0g=";
+    sha256 = "sha256-3IkqaWMQGJssxsAF+BZphEpufR4G5E5bYJvioSO2hJ4=";
   };
 
-  vendorHash = "sha256-OEOlyExgJoEUY2qygBbrxKRkh26sXDX/gAKReeA6Du4=";
+  vendorHash = "sha256-JtjVdr23wI5ZM5LlFApWurTTzLkLI4nzA9/bWoOrGSM=";
 
   doCheck = false;
 
diff --git a/pkgs/servers/nextcloud/default.nix b/pkgs/servers/nextcloud/default.nix
index 29edb77fabd0..391644379ef3 100644
--- a/pkgs/servers/nextcloud/default.nix
+++ b/pkgs/servers/nextcloud/default.nix
@@ -2,18 +2,17 @@
 
 let
   generic = {
-    version, hash,
+    version, sha256,
     eol ? false, extraVulnerabilities ? []
   }: let
     major = lib.versions.major version;
-    prerelease = builtins.length (lib.versions.splitVersion version) > 3;
   in stdenv.mkDerivation rec {
     pname = "nextcloud";
     inherit version;
 
     src = fetchurl {
-      url = "https://download.nextcloud.com/server/${if prerelease then "prereleases" else "release"}/${pname}-${version}.tar.bz2";
-      inherit hash;
+      url = "https://download.nextcloud.com/server/releases/${pname}-${version}.tar.bz2";
+      inherit sha256;
     };
 
     patches = [ (./patches + "/v${major}/0001-Setup-remove-custom-dbuser-creation-behavior.patch") ];
@@ -52,19 +51,14 @@ in {
 
   nextcloud24 = generic {
     version = "24.0.9";
-    hash = "sha256-WAozhMnAmu+46bQVU9IabiAAF5lUnb0lsx3qIR2X3R4=";
+    sha256 = "580a3384c9c09aefb8e9b41553d21a6e20001799549dbd25b31dea211d97dd1e";
   };
 
   nextcloud25 = generic {
     version = "25.0.3";
-    hash = "sha256-SysUI3Nu+SRpCW/iT2HCTK2Ho04HwceoGzhdPqJcAOw=";
+    sha256 = "4b2b1423736ef92469096fe24f61c24cad87a34e07c1c7a81b385d3ea25c00ec";
   };
 
-  nextcloud26 = generic {
-    version = "26.0.0beta1";
-    hash = "sha256-EfSfn0KjQzciHa3VcrDhGC/aZUw/KDjihXs+qVIcYX0=";
-  };
-
-  # tip: get hash with:
-  # nix hash to-sri --type sha256 $(curl https://download.nextcloud.com/server/releases/nextcloud-${version}.tar.bz2.sha256 | cut -d' ' -f1)
+  # tip: get the sha with:
+  # curl 'https://download.nextcloud.com/server/releases/nextcloud-${version}.tar.bz2.sha256'
 }
diff --git a/pkgs/servers/nextcloud/packages/24.json b/pkgs/servers/nextcloud/packages/24.json
index 7b45c83af8a1..0b775a81e88a 100644
--- a/pkgs/servers/nextcloud/packages/24.json
+++ b/pkgs/servers/nextcloud/packages/24.json
@@ -20,9 +20,9 @@
     ]
   },
   "contacts": {
-    "sha256": "1996f97w74slmh7ihv8p1lxl32rri5nnzp90mbb1imclpgac2i63",
-    "url": "https://github.com/nextcloud-releases/contacts/releases/download/v4.2.4/contacts-v4.2.4.tar.gz",
-    "version": "4.2.4",
+    "sha256": "0qv3c7wmf9j74562xbjvhk6kbpna6ansiw3724dh4w8j5sldqysd",
+    "url": "https://github.com/nextcloud-releases/contacts/releases/download/v4.2.3/contacts-v4.2.3.tar.gz",
+    "version": "4.2.3",
     "description": "The Nextcloud contacts app is a user interface for Nextcloud's CardDAV server. Easily sync contacts from various devices with your Nextcloud and edit them online.\n\n* 🚀 **Integration with other Nextcloud apps!** Currently Mail and Calendar – more to come.\n* 🎉 **Never forget a birthday!** You can sync birthdays and other recurring events with your Nextcloud Calendar.\n* 👥 **Sharing of Adressbooks!** You want to share your contacts with your friends or coworkers? No problem!\n* 🙈 **We’re not reinventing the wheel!** Based on the great and open SabreDAV library.",
     "homepage": "https://github.com/nextcloud/contacts#readme",
     "licenses": [
@@ -110,9 +110,9 @@
     ]
   },
   "news": {
-    "sha256": "0iz1yrl7h60yhc1d1gkalkzc5vlj8sq6lff0ggns6a6qpsdpn9c5",
-    "url": "https://github.com/nextcloud/news/releases/download/20.0.1/news.tar.gz",
-    "version": "20.0.1",
+    "sha256": "0pnriarr2iqci2v2hn6vpvszf4m4pkcxsd2i13bp7n1zqkg6swd7",
+    "url": "https://github.com/nextcloud/news/releases/download/20.0.0/news.tar.gz",
+    "version": "20.0.0",
     "description": "📰 A RSS/Atom Feed reader App for Nextcloud\n\n- 📲 Synchronize your feeds with multiple mobile or desktop [clients](https://nextcloud.github.io/news/clients/)\n- 🔄 Automatic updates of your news feeds\n- 🆓 Free and open source under AGPLv3, no ads or premium functions\n\n**System Cron is currently required for this app to work**\n\nRequirements can be found [here](https://nextcloud.github.io/news/install/#dependencies)\n\nThe Changelog is available [here](https://github.com/nextcloud/news/blob/master/CHANGELOG.md)\n\nCreate a [bug report](https://github.com/nextcloud/news/issues/new/choose)\n\nCreate a [feature request](https://github.com/nextcloud/news/discussions/new)\n\nReport a [feed issue](https://github.com/nextcloud/news/discussions/new)",
     "homepage": "https://github.com/nextcloud/news",
     "licenses": [
@@ -140,9 +140,9 @@
     ]
   },
   "polls": {
-    "sha256": "0qdm0hnljkv0df1s929awyjj1gsp3d6xv9llr52cxv66kkfx086y",
-    "url": "https://github.com/nextcloud/polls/releases/download/v3.8.4/polls.tar.gz",
-    "version": "3.8.4",
+    "sha256": "b6ef0e8b34cdb5169341e30340bc9cefaa1254a1a6020e951f86e828f8591a11",
+    "url": "https://github.com/nextcloud/polls/releases/download/v3.8.3/polls.tar.gz",
+    "version": "3.8.3",
     "description": "A polls app, similar to Doodle/Dudle with the possibility to restrict access (members, certain groups/users, hidden and public).",
     "homepage": "https://github.com/nextcloud/polls",
     "licenses": [
@@ -160,9 +160,9 @@
     ]
   },
   "spreed": {
-    "sha256": "0c5b46g5vi8fsjcd2r0wqza7iqyvbgznwww5zcyajf29a32950c6",
-    "url": "https://github.com/nextcloud-releases/spreed/releases/download/v14.0.8/spreed-v14.0.8.tar.gz",
-    "version": "14.0.8",
+    "sha256": "0frilxny4mvp34fxw0k8al3r5apy3q6vq7z35jkph3vaq1889m9k",
+    "url": "https://github.com/nextcloud-releases/spreed/releases/download/v14.0.7/spreed-v14.0.7.tar.gz",
+    "version": "14.0.7",
     "description": "Chat, video & audio-conferencing using WebRTC\n\n* 💬 **Chat integration!** Nextcloud Talk comes with a simple text chat. Allowing you to share files from your Nextcloud and mentioning other participants.\n* 👥 **Private, group, public and password protected calls!** Just invite somebody, a whole group or send a public link to invite to a call.\n* 💻 **Screen sharing!** Share your screen with participants of your call. You just need to use Firefox version 66 (or newer), latest Edge or Chrome 72 (or newer, also possible using Chrome 49 with this [Chrome extension](https://chrome.google.com/webstore/detail/screensharing-for-nextclo/kepnpjhambipllfmgmbapncekcmabkol)).\n* 🚀 **Integration with other Nextcloud apps** like Files, Contacts and Deck. More to come.\n\nAnd in the works for the [coming versions](https://github.com/nextcloud/spreed/milestones/):\n* ✋ [Federated calls](https://github.com/nextcloud/spreed/issues/21), to call people on other Nextclouds",
     "homepage": "https://github.com/nextcloud/spreed",
     "licenses": [
diff --git a/pkgs/servers/nextcloud/packages/25.json b/pkgs/servers/nextcloud/packages/25.json
index e6051ccb13b2..98ab7ebe3e24 100644
--- a/pkgs/servers/nextcloud/packages/25.json
+++ b/pkgs/servers/nextcloud/packages/25.json
@@ -10,9 +10,9 @@
     ]
   },
   "calendar": {
-    "sha256": "0yqpfp5nbzd7zar2rbcx3bhfgjxrp1sy6a57fdagndfi4y0r56hq",
-    "url": "https://github.com/nextcloud-releases/calendar/releases/download/v4.2.2/calendar-v4.2.2.tar.gz",
-    "version": "4.2.2",
+    "sha256": "04g1xm3q46j7harxr0n56r7kkkqjxvah7xijddyq5fj7icr6qf5d",
+    "url": "https://github.com/nextcloud-releases/calendar/releases/download/v4.2.1/calendar-v4.2.1.tar.gz",
+    "version": "4.2.1",
     "description": "The Calendar app is a user interface for Nextcloud's CalDAV server. Easily sync events from various devices with your Nextcloud and edit them online.\n\n* 🚀 **Integration with other Nextcloud apps!** Currently Contacts - more to come.\n* 🌐 **WebCal Support!** Want to see your favorite team’s matchdays in your calendar? No problem!\n* 🙋 **Attendees!** Invite people to your events\n* ⌚️ **Free/Busy!** See when your attendees are available to meet\n* ⏰ **Reminders!** Get alarms for events inside your browser and via email\n* 🔍 Search! Find your events at ease\n* ☑️ Tasks! See tasks with a due date directly in the calendar\n* 🙈 **We’re not reinventing the wheel!** Based on the great [c-dav library](https://github.com/nextcloud/cdav-library), [ical.js](https://github.com/mozilla-comm/ical.js) and [fullcalendar](https://github.com/fullcalendar/fullcalendar) libraries.",
     "homepage": "https://github.com/nextcloud/calendar/",
     "licenses": [
@@ -20,9 +20,9 @@
     ]
   },
   "contacts": {
-    "sha256": "181lycyz4v7v1yir6ylmblgha625sn23nf3661g3izq1whi0wgr9",
-    "url": "https://github.com/nextcloud-releases/contacts/releases/download/v5.0.3/contacts-v5.0.3.tar.gz",
-    "version": "5.0.3",
+    "sha256": "097a71if6kkc7nphfc8b6llqlsskjwp1vg83134hzgfscvllvaj8",
+    "url": "https://github.com/nextcloud-releases/contacts/releases/download/v5.0.2/contacts-v5.0.2.tar.gz",
+    "version": "5.0.2",
     "description": "The Nextcloud contacts app is a user interface for Nextcloud's CardDAV server. Easily sync contacts from various devices with your Nextcloud and edit them online.\n\n* 🚀 **Integration with other Nextcloud apps!** Currently Mail and Calendar – more to come.\n* 🎉 **Never forget a birthday!** You can sync birthdays and other recurring events with your Nextcloud Calendar.\n* 👥 **Sharing of Adressbooks!** You want to share your contacts with your friends or coworkers? No problem!\n* 🙈 **We’re not reinventing the wheel!** Based on the great and open SabreDAV library.",
     "homepage": "https://github.com/nextcloud/contacts#readme",
     "licenses": [
@@ -90,9 +90,9 @@
     ]
   },
   "news": {
-    "sha256": "0iz1yrl7h60yhc1d1gkalkzc5vlj8sq6lff0ggns6a6qpsdpn9c5",
-    "url": "https://github.com/nextcloud/news/releases/download/20.0.1/news.tar.gz",
-    "version": "20.0.1",
+    "sha256": "0pnriarr2iqci2v2hn6vpvszf4m4pkcxsd2i13bp7n1zqkg6swd7",
+    "url": "https://github.com/nextcloud/news/releases/download/20.0.0/news.tar.gz",
+    "version": "20.0.0",
     "description": "📰 A RSS/Atom Feed reader App for Nextcloud\n\n- 📲 Synchronize your feeds with multiple mobile or desktop [clients](https://nextcloud.github.io/news/clients/)\n- 🔄 Automatic updates of your news feeds\n- 🆓 Free and open source under AGPLv3, no ads or premium functions\n\n**System Cron is currently required for this app to work**\n\nRequirements can be found [here](https://nextcloud.github.io/news/install/#dependencies)\n\nThe Changelog is available [here](https://github.com/nextcloud/news/blob/master/CHANGELOG.md)\n\nCreate a [bug report](https://github.com/nextcloud/news/issues/new/choose)\n\nCreate a [feature request](https://github.com/nextcloud/news/discussions/new)\n\nReport a [feed issue](https://github.com/nextcloud/news/discussions/new)",
     "homepage": "https://github.com/nextcloud/news",
     "licenses": [
@@ -120,9 +120,9 @@
     ]
   },
   "polls": {
-    "sha256": "0mqc9zmxrm98byy6v13si3hwii8hx85998c4kv91vk6ad0sfxjhb",
-    "url": "https://github.com/nextcloud/polls/releases/download/v4.1.2/polls.tar.gz",
-    "version": "4.1.2",
+    "sha256": "1amywiw91acp4g90wazmqmnw51s7z6rf27bdrzxrcqryd8igsniq",
+    "url": "https://github.com/nextcloud/polls/releases/download/v4.1.0-beta4/polls.tar.gz",
+    "version": "4.1.0-beta4",
     "description": "A polls app, similar to Doodle/Dudle with the possibility to restrict access (members, certain groups/users, hidden and public).",
     "homepage": "https://github.com/nextcloud/polls",
     "licenses": [
@@ -140,9 +140,9 @@
     ]
   },
   "spreed": {
-    "sha256": "07nh7nlz8di69ms1156fklj29526i3phlvki5vf2mxnlcz8ihg27",
-    "url": "https://github.com/nextcloud-releases/spreed/releases/download/v15.0.3/spreed-v15.0.3.tar.gz",
-    "version": "15.0.3",
+    "sha256": "1w5v866lkd0skv666vhz75zwalr2w83shrhdvv354kill9k53awh",
+    "url": "https://github.com/nextcloud-releases/spreed/releases/download/v15.0.2/spreed-v15.0.2.tar.gz",
+    "version": "15.0.2",
     "description": "Chat, video & audio-conferencing using WebRTC\n\n* 💬 **Chat integration!** Nextcloud Talk comes with a simple text chat. Allowing you to share files from your Nextcloud and mentioning other participants.\n* 👥 **Private, group, public and password protected calls!** Just invite somebody, a whole group or send a public link to invite to a call.\n* 💻 **Screen sharing!** Share your screen with participants of your call. You just need to use Firefox version 66 (or newer), latest Edge or Chrome 72 (or newer, also possible using Chrome 49 with this [Chrome extension](https://chrome.google.com/webstore/detail/screensharing-for-nextclo/kepnpjhambipllfmgmbapncekcmabkol)).\n* 🚀 **Integration with other Nextcloud apps** like Files, Contacts and Deck. More to come.\n\nAnd in the works for the [coming versions](https://github.com/nextcloud/spreed/milestones/):\n* ✋ [Federated calls](https://github.com/nextcloud/spreed/issues/21), to call people on other Nextclouds",
     "homepage": "https://github.com/nextcloud/spreed",
     "licenses": [
diff --git a/pkgs/servers/nextcloud/packages/26.json b/pkgs/servers/nextcloud/packages/26.json
deleted file mode 100644
index e3a075c7c8e0..000000000000
--- a/pkgs/servers/nextcloud/packages/26.json
+++ /dev/null
@@ -1,62 +0,0 @@
-{
-  "calendar": {
-    "sha256": "0yqpfp5nbzd7zar2rbcx3bhfgjxrp1sy6a57fdagndfi4y0r56hq",
-    "url": "https://github.com/nextcloud-releases/calendar/releases/download/v4.2.2/calendar-v4.2.2.tar.gz",
-    "version": "4.2.2",
-    "description": "The Calendar app is a user interface for Nextcloud's CalDAV server. Easily sync events from various devices with your Nextcloud and edit them online.\n\n* 🚀 **Integration with other Nextcloud apps!** Currently Contacts - more to come.\n* 🌐 **WebCal Support!** Want to see your favorite team’s matchdays in your calendar? No problem!\n* 🙋 **Attendees!** Invite people to your events\n* ⌚️ **Free/Busy!** See when your attendees are available to meet\n* ⏰ **Reminders!** Get alarms for events inside your browser and via email\n* 🔍 Search! Find your events at ease\n* ☑️ Tasks! See tasks with a due date directly in the calendar\n* 🙈 **We’re not reinventing the wheel!** Based on the great [c-dav library](https://github.com/nextcloud/cdav-library), [ical.js](https://github.com/mozilla-comm/ical.js) and [fullcalendar](https://github.com/fullcalendar/fullcalendar) libraries.",
-    "homepage": "https://github.com/nextcloud/calendar/",
-    "licenses": [
-      "agpl"
-    ]
-  },
-  "files_texteditor": {
-    "sha256": "0rmk14iw34pd81snp3lm01k07wm5j2nh9spcd4j0m43l20b7kxss",
-    "url": "https://github.com/nextcloud-releases/files_texteditor/releases/download/v2.15.0/files_texteditor.tar.gz",
-    "version": "2.15.0",
-    "description": "This application enables Nextcloud users to open, save and edit text files in the web browser. If enabled, an entry called \"Text file\" in the \"New\" button menu at the top of the web browser appears. When clicked, a new text file opens in the browser and the file can be saved into the current Nextcloud directory. Further, when a text file is clicked in the web browser, it will be opened and editable. If the privileges allow, a user can also edit shared files and save these changes back into the web browser.\nMore information is available in the text editor documentation.",
-    "homepage": "https://github.com/nextcloud/files_texteditor",
-    "licenses": [
-      "agpl"
-    ]
-  },
-  "mail": {
-    "sha256": "",
-    "url": "https://github.com/nextcloud-releases/mail/releases/download/v2.2.2/mail-v2.2.2.tar.gz",
-    "version": "2.2.2",
-    "description": "**💌 A mail app for Nextcloud**\n\n- **🚀 Integration with other Nextcloud apps!** Currently Contacts, Calendar & Files – more to come.\n- **📥 Multiple mail accounts!** Personal and company account? No problem, and a nice unified inbox. Connect any IMAP account.\n- **🔒 Send & receive encrypted mails!** Using the great [Mailvelope](https://mailvelope.com) browser extension.\n- **🙈 We’re not reinventing the wheel!** Based on the great [Horde](https://horde.org) libraries.\n- **📬 Want to host your own mail server?** We do not have to reimplement this as you could set up [Mail-in-a-Box](https://mailinabox.email)!",
-    "homepage": "https://github.com/nextcloud/mail#readme",
-    "licenses": [
-      "agpl"
-    ]
-  },
-  "notes": {
-    "sha256": "1jcgv3awr45jq3n3qv851qlpbdl2plixba0iq2s54dmhciypdckl",
-    "url": "https://github.com/nextcloud/notes/releases/download/v4.6.0/notes.tar.gz",
-    "version": "4.6.0",
-    "description": "The Notes app is a distraction free notes taking app for [Nextcloud](https://www.nextcloud.com/). It provides categories for better organization and supports formatting using [Markdown](https://en.wikipedia.org/wiki/Markdown) syntax. Notes are saved as files in your Nextcloud, so you can view and edit them with every Nextcloud client. Furthermore, a separate [REST API](https://github.com/nextcloud/notes/blob/master/docs/api/README.md) allows for an easy integration into third-party apps (currently, there are notes apps for [Android](https://github.com/stefan-niedermann/nextcloud-notes), [iOS](https://github.com/owncloud/notes-iOS-App) and the [console](https://git.danielmoch.com/nncli/about) which allow convenient access to your Nextcloud notes). Further features include marking notes as favorites.",
-    "homepage": "https://github.com/nextcloud/notes",
-    "licenses": [
-      "agpl"
-    ]
-  },
-  "tasks": {
-    "sha256": "0jm13d6nm7cfsw27yfiq1il9xjlh0qrq8xby2yz9dmggn7lk1dx5",
-    "url": "https://github.com/nextcloud/tasks/releases/download/v0.14.5/tasks.tar.gz",
-    "version": "0.14.5",
-    "description": "Once enabled, a new Tasks menu will appear in your Nextcloud apps menu. From there you can add and delete tasks, edit their title, description, start and due dates and mark them as important. Tasks can be shared between users. Tasks can be synchronized using CalDav (each task list is linked to an Nextcloud calendar, to sync it to your local client: Thunderbird, Evolution, KDE Kontact, iCal … - just add the calendar as a remote calendar in your client). You can download your tasks as ICS files using the download button for each calendar.",
-    "homepage": "https://github.com/nextcloud/tasks/",
-    "licenses": [
-      "agpl"
-    ]
-  },
-  "unsplash": {
-    "sha256": "17qqn6kwpvkq21c92jyy3pfvjaj5xms1hr07fnn39zxg0nmwjdd8",
-    "url": "https://github.com/nextcloud/unsplash/releases/download/v2.1.1/unsplash.tar.gz",
-    "version": "2.1.1",
-    "description": "Show a new random featured nature photo in your nextcloud. Now with choosable motives!",
-    "homepage": "https://github.com/nextcloud/unsplash/",
-    "licenses": [
-      "agpl"
-    ]
-  }
-}
diff --git a/pkgs/servers/nextcloud/patches/v26/0001-Setup-remove-custom-dbuser-creation-behavior.patch b/pkgs/servers/nextcloud/patches/v26/0001-Setup-remove-custom-dbuser-creation-behavior.patch
deleted file mode 100644
index 28af5ec76580..000000000000
--- a/pkgs/servers/nextcloud/patches/v26/0001-Setup-remove-custom-dbuser-creation-behavior.patch
+++ /dev/null
@@ -1,149 +0,0 @@
-From fc3e14155b3c4300b691ab46579830e725457a54 Mon Sep 17 00:00:00 2001
-From: Maximilian Bosch <maximilian@mbosch.me>
-Date: Sat, 10 Sep 2022 15:18:05 +0200
-Subject: [PATCH] Setup: remove custom dbuser creation behavior
-
-Both PostgreSQL and MySQL can be authenticated against from Nextcloud by
-supplying a database password. Now, during setup the following things
-happen:
-
-* When using postgres and the db user has elevated permissions, a new
-  unprivileged db user is created and the settings `dbuser`/`dbpass` are
-  altered in `config.php`.
-
-* When using MySQL, the password is **always** regenerated since
-  24.0.5/23.0.9[1].
-
-I consider both cases problematic: the reason why people do configuration
-management is to have it as single source of truth! So, IMHO any
-application that silently alters config and thus causes deployed
-nodes to diverge from the configuration is harmful for that.
-
-I guess it was sheer luck that it worked for so long in NixOS because
-nobody has apparently used password authentication with a privileged
-user to operate Nextcloud (which is a good thing in fact).
-
-[1] https://github.com/nextcloud/server/pull/33513
----
- lib/private/Setup/MySQL.php      | 53 --------------------------------
- lib/private/Setup/PostgreSQL.php | 37 ----------------------
- 2 files changed, 90 deletions(-)
-
-diff --git a/lib/private/Setup/MySQL.php b/lib/private/Setup/MySQL.php
-index e3004c269bc..bc958e84e44 100644
---- a/lib/private/Setup/MySQL.php
-+++ b/lib/private/Setup/MySQL.php
-@@ -141,62 +141,6 @@
- 		$rootUser = $this->dbUser;
- 		$rootPassword = $this->dbPassword;
- 
--		//create a random password so we don't need to store the admin password in the config file
--		$saveSymbols = str_replace(['\"', '\\', '\'', '`'], '', ISecureRandom::CHAR_SYMBOLS);
--		$password = $this->random->generate(22, ISecureRandom::CHAR_ALPHANUMERIC . $saveSymbols)
--			. $this->random->generate(2, ISecureRandom::CHAR_UPPER)
--			. $this->random->generate(2, ISecureRandom::CHAR_LOWER)
--			. $this->random->generate(2, ISecureRandom::CHAR_DIGITS)
--			. $this->random->generate(2, $saveSymbols)
--		;
--		$this->dbPassword = str_shuffle($password);
--
--		try {
--			//user already specified in config
--			$oldUser = $this->config->getValue('dbuser', false);
--
--			//we don't have a dbuser specified in config
--			if ($this->dbUser !== $oldUser) {
--				//add prefix to the admin username to prevent collisions
--				$adminUser = substr('oc_' . $username, 0, 16);
--
--				$i = 1;
--				while (true) {
--					//this should be enough to check for admin rights in mysql
--					$query = 'SELECT user FROM mysql.user WHERE user=?';
--					$result = $connection->executeQuery($query, [$adminUser]);
--
--					//current dbuser has admin rights
--					$data = $result->fetchAll();
--					$result->closeCursor();
--					//new dbuser does not exist
--					if (count($data) === 0) {
--						//use the admin login data for the new database user
--						$this->dbUser = $adminUser;
--						$this->createDBUser($connection);
--
--						break;
--					} else {
--						//repeat with different username
--						$length = strlen((string)$i);
--						$adminUser = substr('oc_' . $username, 0, 16 - $length) . $i;
--						$i++;
--					}
--				}
--			} else {
--				// Reuse existing password if a database config is already present
--				$this->dbPassword = $rootPassword;
--			}
--		} catch (\Exception $ex) {
--			$this->logger->info('Can not create a new MySQL user, will continue with the provided user.', [
--				'exception' => $ex,
--				'app' => 'mysql.setup',
--			]);
--			// Restore the original credentials
--			$this->dbUser = $rootUser;
--			$this->dbPassword = $rootPassword;
--		}
--
- 		$this->config->setValues([
- 			'dbuser' => $this->dbUser,
- 			'dbpassword' => $this->dbPassword,
-diff --git a/lib/private/Setup/PostgreSQL.php b/lib/private/Setup/PostgreSQL.php
-index af816c7ad04..e49e5508e15 100644
---- a/lib/private/Setup/PostgreSQL.php
-+++ b/lib/private/Setup/PostgreSQL.php
-@@ -45,43 +45,6 @@ class PostgreSQL extends AbstractDatabase {
- 			$connection = $this->connect([
- 				'dbname' => 'postgres'
- 			]);
--			//check for roles creation rights in postgresql
--			$builder = $connection->getQueryBuilder();
--			$builder->automaticTablePrefix(false);
--			$query = $builder
--				->select('rolname')
--				->from('pg_roles')
--				->where($builder->expr()->eq('rolcreaterole', new Literal('TRUE')))
--				->andWhere($builder->expr()->eq('rolname', $builder->createNamedParameter($this->dbUser)));
--
--			try {
--				$result = $query->execute();
--				$canCreateRoles = $result->rowCount() > 0;
--			} catch (DatabaseException $e) {
--				$canCreateRoles = false;
--			}
--
--			if ($canCreateRoles) {
--				$connectionMainDatabase = $this->connect();
--				//use the admin login data for the new database user
--
--				//add prefix to the postgresql user name to prevent collisions
--				$this->dbUser = 'oc_' . strtolower($username);
--				//create a new password so we don't need to store the admin config in the config file
--				$this->dbPassword = \OC::$server->getSecureRandom()->generate(30, ISecureRandom::CHAR_ALPHANUMERIC);
--
--				$this->createDBUser($connection);
--
--				// Go to the main database and grant create on the public schema
--				// The code below is implemented to make installing possible with PostgreSQL version 15:
--				// https://www.postgresql.org/docs/release/15.0/
--				// From the release notes: For new databases having no need to defend against insider threats, granting CREATE permission will yield the behavior of prior releases
--				// Therefore we assume that the database is only used by one user/service which is Nextcloud
--				// Additional services should get installed in a separate database in order to stay secure
--				// Also see https://www.postgresql.org/docs/15/ddl-schemas.html#DDL-SCHEMAS-PATTERNS
--				$connectionMainDatabase->executeQuery('GRANT CREATE ON SCHEMA public TO ' . addslashes($this->dbUser));
--				$connectionMainDatabase->close();
--			}
- 
- 			$this->config->setValues([
- 				'dbuser' => $this->dbUser,
--- 
-2.38.1
-
diff --git a/pkgs/servers/pocketbase/default.nix b/pkgs/servers/pocketbase/default.nix
index 357da5292821..a17e2ecd3cc9 100644
--- a/pkgs/servers/pocketbase/default.nix
+++ b/pkgs/servers/pocketbase/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "pocketbase";
-  version = "0.12.0";
+  version = "0.12.2";
 
   src = fetchFromGitHub {
     owner = "pocketbase";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Ptp01SnVqQ+qFxX4Qsoyw9bkw+inm9gMSRqtmAcFlVE=";
+    sha256 = "sha256-PnbsWzuUxGhAGadKfcEWl2HzTA3L4qu3xGJWMx9N4rs=";
   };
 
   vendorHash = "sha256-8NBudXcU3cjSbo6qpGZVLtbrLedzwijwrbiTgC+OMcU=";
diff --git a/pkgs/servers/sip/freeswitch/default.nix b/pkgs/servers/sip/freeswitch/default.nix
index fb34b3c5af40..b43d31a33f22 100644
--- a/pkgs/servers/sip/freeswitch/default.nix
+++ b/pkgs/servers/sip/freeswitch/default.nix
@@ -88,12 +88,12 @@ in
 
 stdenv.mkDerivation rec {
   pname = "freeswitch";
-  version = "1.10.8";
+  version = "1.10.9";
   src = fetchFromGitHub {
     owner = "signalwire";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-66kwEN42LjTh/oEdFeOyXP2fU88tjR1K5ZWQJkKcDLQ=";
+    sha256 = "sha256-65DH2HxiF8wqzmzbIqaQZjSa/JPERHIS2FW6F18c6Pw=";
   };
 
   postPatch = ''
@@ -153,5 +153,6 @@ stdenv.mkDerivation rec {
     license = lib.licenses.mpl11;
     maintainers = with lib.maintainers; [ misuzu ];
     platforms = with lib.platforms; unix;
+    broken = stdenv.isDarwin;
   };
 }
diff --git a/pkgs/servers/snappymail/default.nix b/pkgs/servers/snappymail/default.nix
index eb8310397637..60d1fdc82f4b 100644
--- a/pkgs/servers/snappymail/default.nix
+++ b/pkgs/servers/snappymail/default.nix
@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation rec {
   pname = "snappymail";
-  version = "2.25.0";
+  version = "2.25.2";
 
   src = fetchurl {
     url = "https://github.com/the-djmaze/snappymail/releases/download/v${version}/snappymail-${version}.tar.gz";
-    sha256 = "sha256-obPWI6tvZx8HEWvNUw9euJav1ncbBYtXwY7SgEurkdQ=";
+    sha256 = "sha256-45/lE+3lbIlrrlGiZcnyqqYN61BXdBzfufQuP/6W1mk=";
   };
 
   sourceRoot = "snappymail";
diff --git a/pkgs/servers/soft-serve/default.nix b/pkgs/servers/soft-serve/default.nix
index d29453556be2..0ca7e2e76912 100644
--- a/pkgs/servers/soft-serve/default.nix
+++ b/pkgs/servers/soft-serve/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "soft-serve";
-  version = "0.4.4";
+  version = "0.4.5";
 
   src = fetchFromGitHub {
     owner = "charmbracelet";
     repo = "soft-serve";
     rev = "v${version}";
-    sha256 = "sha256-MziobrOqEUsg/XhzLChNker3OU9YAH0LmQ+i+UYoPkE=";
+    sha256 = "sha256-vNcM/eFz+vSEnJTgnvn7Cfx7ZDiXY9RlgU3zQlqYnss=";
   };
 
-  vendorSha256 = "sha256-YmAPZtGq2wWqrmTwFOPvSZ3pXa3hUFd+TQfU+Nzhlvs=";
+  vendorHash = "sha256-DZlzgoQ8F3L4hErKnBD14R49pHPJy1/Ut5k004qZzUw=";
 
   doCheck = false;
 
diff --git a/pkgs/servers/sql/mssql/jdbc/default.nix b/pkgs/servers/sql/mssql/jdbc/default.nix
index 758794ba876c..6eca03c19447 100644
--- a/pkgs/servers/sql/mssql/jdbc/default.nix
+++ b/pkgs/servers/sql/mssql/jdbc/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "mssql-jdbc";
-  version = "11.2.2";
+  version = "12.2.0";
 
   src = fetchurl {
     url = "https://github.com/Microsoft/mssql-jdbc/releases/download/v${version}/mssql-jdbc-${version}.jre8.jar";
-    sha256 = "sha256-MLB2R5ATVBewGaCle8NYPR1mZt2U3CCvEwf2dkBfNTI=";
+    sha256 = "sha256-Z0z9cDAF7TZ8IJr3Uh2xU0nK2+aNgerk5hO1kY+/wfY=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/servers/web-apps/bookstack/default.nix b/pkgs/servers/web-apps/bookstack/default.nix
index e0ec15eefba8..e96528d7cd6a 100644
--- a/pkgs/servers/web-apps/bookstack/default.nix
+++ b/pkgs/servers/web-apps/bookstack/default.nix
@@ -16,13 +16,13 @@ let
 
 in package.override rec {
   pname = "bookstack";
-  version = "23.01";
+  version = "23.01.1";
 
   src = fetchFromGitHub {
     owner = "bookstackapp";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0d2hqqa4x133ni8j0dijzn9653iq44ax4rly85g9kiwrjd0l17cw";
+    sha256 = "sha256-S4yGys1Lc2FAd3RKI4KdE9X12rsQyVcPQ+Biwwrnb0I=";
   };
 
   meta = with lib; {
diff --git a/pkgs/servers/web-apps/outline/default.nix b/pkgs/servers/web-apps/outline/default.nix
index 0f80c3f4276a..35df24afd468 100644
--- a/pkgs/servers/web-apps/outline/default.nix
+++ b/pkgs/servers/web-apps/outline/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "outline";
-  version = "0.67.1";
+  version = "0.67.2";
 
   src = fetchFromGitHub {
     owner = "outline";
     repo = "outline";
     rev = "v${version}";
-    sha256 = "sha256-oc9rG1dHi5YEU8VdwldHDv1qporMk8K7wpXOrCgcc0w=";
+    sha256 = "sha256-O5t//UwF+AVFxeBQHRIZM5RSf4+DgUE5LHWVRKxJLfc=";
   };
 
   nativeBuildInputs = [ makeWrapper yarn2nix-moretea.fixup_yarn_lock ];
@@ -56,7 +56,12 @@ stdenv.mkDerivation rec {
     runHook preInstall
 
     mkdir -p $out/bin $out/share/outline
-    mv public node_modules build $out/share/outline/
+    mv node_modules build $out/share/outline/
+    # On NixOS the WorkingDirectory is set to the build directory, as
+    # this contains files needed in the onboarding process. This folder
+    # must also contain the `public` folder for mail notifications to
+    # work, as it contains the mail templates.
+    mv public $out/share/outline/build
 
     node_modules=$out/share/outline/node_modules
     build=$out/share/outline/build
diff --git a/pkgs/servers/web-apps/outline/yarn.lock b/pkgs/servers/web-apps/outline/yarn.lock
index 4cc338dbf6f0..f5b7c69fd4d8 100644
--- a/pkgs/servers/web-apps/outline/yarn.lock
+++ b/pkgs/servers/web-apps/outline/yarn.lock
@@ -76,12 +76,12 @@
     json5 "^2.2.1"
     semver "^6.3.0"
 
-"@babel/generator@^7.18.10", "@babel/generator@^7.7.2":
-  version "7.18.12"
-  resolved "https://registry.yarnpkg.com/@babel/generator/-/generator-7.18.12.tgz#fa58daa303757bd6f5e4bbca91b342040463d9f4"
-  integrity sha512-dfQ8ebCN98SvyL7IxNMCUtZQSq5R7kxgN+r8qYTGDmmSion1hX2C0zq2yo1bsCDhXixokv1SAWTZUMYbO/V5zg==
+"@babel/generator@^7.18.10", "@babel/generator@^7.20.7", "@babel/generator@^7.7.2":
+  version "7.20.7"
+  resolved "https://registry.yarnpkg.com/@babel/generator/-/generator-7.20.7.tgz#f8ef57c8242665c5929fe2e8d82ba75460187b4a"
+  integrity sha512-7wqMOJq8doJMZmP4ApXTzLxSr7+oO2jroJURrVEp6XShrQUObV8Tq/D0NCcoYg2uHqUrjzO0zwBjoYzelxK+sw==
   dependencies:
-    "@babel/types" "^7.18.10"
+    "@babel/types" "^7.20.7"
     "@jridgewell/gen-mapping" "^0.3.2"
     jsesc "^2.5.1"
 
@@ -110,17 +110,18 @@
     browserslist "^4.20.2"
     semver "^6.3.0"
 
-"@babel/helper-create-class-features-plugin@^7.16.0", "@babel/helper-create-class-features-plugin@^7.16.7", "@babel/helper-create-class-features-plugin@^7.18.9":
-  version "7.18.9"
-  resolved "https://registry.yarnpkg.com/@babel/helper-create-class-features-plugin/-/helper-create-class-features-plugin-7.18.9.tgz#d802ee16a64a9e824fcbf0a2ffc92f19d58550ce"
-  integrity sha512-WvypNAYaVh23QcjpMR24CwZY2Nz6hqdOcFdPbNpV56hL5H6KiFheO7Xm1aPdlLQ7d5emYZX7VZwPp9x3z+2opw==
+"@babel/helper-create-class-features-plugin@^7.16.0", "@babel/helper-create-class-features-plugin@^7.16.7", "@babel/helper-create-class-features-plugin@^7.18.9", "@babel/helper-create-class-features-plugin@^7.20.7":
+  version "7.20.12"
+  resolved "https://registry.yarnpkg.com/@babel/helper-create-class-features-plugin/-/helper-create-class-features-plugin-7.20.12.tgz#4349b928e79be05ed2d1643b20b99bb87c503819"
+  integrity sha512-9OunRkbT0JQcednL0UFvbfXpAsUXiGjUk0a7sN8fUXX7Mue79cUSMjHGDRRi/Vz9vYlpIhLV5fMD5dKoMhhsNQ==
   dependencies:
     "@babel/helper-annotate-as-pure" "^7.18.6"
     "@babel/helper-environment-visitor" "^7.18.9"
-    "@babel/helper-function-name" "^7.18.9"
-    "@babel/helper-member-expression-to-functions" "^7.18.9"
+    "@babel/helper-function-name" "^7.19.0"
+    "@babel/helper-member-expression-to-functions" "^7.20.7"
     "@babel/helper-optimise-call-expression" "^7.18.6"
-    "@babel/helper-replace-supers" "^7.18.9"
+    "@babel/helper-replace-supers" "^7.20.7"
+    "@babel/helper-skip-transparent-expression-wrappers" "^7.20.0"
     "@babel/helper-split-export-declaration" "^7.18.6"
 
 "@babel/helper-create-regexp-features-plugin@^7.16.0":
@@ -157,13 +158,13 @@
   dependencies:
     "@babel/types" "^7.16.0"
 
-"@babel/helper-function-name@^7.16.0", "@babel/helper-function-name@^7.18.9":
-  version "7.18.9"
-  resolved "https://registry.yarnpkg.com/@babel/helper-function-name/-/helper-function-name-7.18.9.tgz#940e6084a55dee867d33b4e487da2676365e86b0"
-  integrity sha512-fJgWlZt7nxGksJS9a0XdSaI4XvpExnNIgRP+rVefWh5U7BL8pPuir6SJUmFKRfjWQ51OtWSzwOxhaH/EBWWc0A==
+"@babel/helper-function-name@^7.16.0", "@babel/helper-function-name@^7.18.9", "@babel/helper-function-name@^7.19.0":
+  version "7.19.0"
+  resolved "https://registry.yarnpkg.com/@babel/helper-function-name/-/helper-function-name-7.19.0.tgz#941574ed5390682e872e52d3f38ce9d1bef4648c"
+  integrity sha512-WAwHBINyrpqywkUH0nTnNgI5ina5TFn85HKS0pbPDfxFfhyR/aNQEn4hGi1P1JyT//I0t4OgXUlofzWILRvS5w==
   dependencies:
-    "@babel/template" "^7.18.6"
-    "@babel/types" "^7.18.9"
+    "@babel/template" "^7.18.10"
+    "@babel/types" "^7.19.0"
 
 "@babel/helper-hoist-variables@^7.16.0", "@babel/helper-hoist-variables@^7.18.6":
   version "7.18.6"
@@ -172,12 +173,12 @@
   dependencies:
     "@babel/types" "^7.18.6"
 
-"@babel/helper-member-expression-to-functions@^7.18.9":
-  version "7.18.9"
-  resolved "https://registry.yarnpkg.com/@babel/helper-member-expression-to-functions/-/helper-member-expression-to-functions-7.18.9.tgz#1531661e8375af843ad37ac692c132841e2fd815"
-  integrity sha512-RxifAh2ZoVU67PyKIO4AMi1wTenGfMR/O/ae0CCRqwgBAt5v7xjdtRw7UoSbsreKrQn5t7r89eruK/9JjYHuDg==
+"@babel/helper-member-expression-to-functions@^7.18.9", "@babel/helper-member-expression-to-functions@^7.20.7":
+  version "7.20.7"
+  resolved "https://registry.yarnpkg.com/@babel/helper-member-expression-to-functions/-/helper-member-expression-to-functions-7.20.7.tgz#a6f26e919582275a93c3aa6594756d71b0bb7f05"
+  integrity sha512-9J0CxJLq315fEdi4s7xK5TQaNYjZw+nDVpVqr1axNGKzdrdwYBD5b4uKv3n75aABG0rCCTK8Im8Ww7eYfMrZgw==
   dependencies:
-    "@babel/types" "^7.18.9"
+    "@babel/types" "^7.20.7"
 
 "@babel/helper-module-imports@^7.0.0", "@babel/helper-module-imports@^7.0.0-beta.49", "@babel/helper-module-imports@^7.10.4", "@babel/helper-module-imports@^7.12.13", "@babel/helper-module-imports@^7.14.5", "@babel/helper-module-imports@^7.16.0", "@babel/helper-module-imports@^7.18.6":
   version "7.18.6"
@@ -221,16 +222,17 @@
     "@babel/helper-wrap-function" "^7.16.0"
     "@babel/types" "^7.16.0"
 
-"@babel/helper-replace-supers@^7.16.0", "@babel/helper-replace-supers@^7.18.9":
-  version "7.18.9"
-  resolved "https://registry.yarnpkg.com/@babel/helper-replace-supers/-/helper-replace-supers-7.18.9.tgz#1092e002feca980fbbb0bd4d51b74a65c6a500e6"
-  integrity sha512-dNsWibVI4lNT6HiuOIBr1oyxo40HvIVmbwPUm3XZ7wMh4k2WxrxTqZwSqw/eEmXDS9np0ey5M2bz9tBmO9c+YQ==
+"@babel/helper-replace-supers@^7.16.0", "@babel/helper-replace-supers@^7.18.9", "@babel/helper-replace-supers@^7.20.7":
+  version "7.20.7"
+  resolved "https://registry.yarnpkg.com/@babel/helper-replace-supers/-/helper-replace-supers-7.20.7.tgz#243ecd2724d2071532b2c8ad2f0f9f083bcae331"
+  integrity sha512-vujDMtB6LVfNW13jhlCrp48QNslK6JXi7lQG736HVbHz/mbf4Dc7tIRh1Xf5C0rF7BP8iiSxGMCmY6Ci1ven3A==
   dependencies:
     "@babel/helper-environment-visitor" "^7.18.9"
-    "@babel/helper-member-expression-to-functions" "^7.18.9"
+    "@babel/helper-member-expression-to-functions" "^7.20.7"
     "@babel/helper-optimise-call-expression" "^7.18.6"
-    "@babel/traverse" "^7.18.9"
-    "@babel/types" "^7.18.9"
+    "@babel/template" "^7.20.7"
+    "@babel/traverse" "^7.20.7"
+    "@babel/types" "^7.20.7"
 
 "@babel/helper-simple-access@^7.17.7", "@babel/helper-simple-access@^7.18.6":
   version "7.18.6"
@@ -239,12 +241,12 @@
   dependencies:
     "@babel/types" "^7.18.6"
 
-"@babel/helper-skip-transparent-expression-wrappers@^7.16.0":
-  version "7.16.0"
-  resolved "https://registry.yarnpkg.com/@babel/helper-skip-transparent-expression-wrappers/-/helper-skip-transparent-expression-wrappers-7.16.0.tgz#0ee3388070147c3ae051e487eca3ebb0e2e8bb09"
-  integrity sha512-+il1gTy0oHwUsBQZyJvukbB4vPMdcYBrFHa0Uc4AizLxbq6BOYC51Rv4tWocX9BLBDLZ4kc6qUFpQ6HRgL+3zw==
+"@babel/helper-skip-transparent-expression-wrappers@^7.16.0", "@babel/helper-skip-transparent-expression-wrappers@^7.20.0":
+  version "7.20.0"
+  resolved "https://registry.yarnpkg.com/@babel/helper-skip-transparent-expression-wrappers/-/helper-skip-transparent-expression-wrappers-7.20.0.tgz#fbe4c52f60518cab8140d77101f0e63a8a230684"
+  integrity sha512-5y1JYeNKfvnT8sZcK9DVRtpTbGiomYIHviSP3OQWmDPU3DeH4a1ZlT/N2lyQ5P8egjcRaT/Y9aNqUxK0WsnIIg==
   dependencies:
-    "@babel/types" "^7.16.0"
+    "@babel/types" "^7.20.0"
 
 "@babel/helper-split-export-declaration@^7.16.0", "@babel/helper-split-export-declaration@^7.18.6":
   version "7.18.6"
@@ -263,7 +265,7 @@
   resolved "https://registry.yarnpkg.com/@babel/helper-validator-identifier/-/helper-validator-identifier-7.19.1.tgz#7eea834cf32901ffdc1a7ee555e2f9c27e249ca2"
   integrity sha512-awrNfaMtnHUr653GgGEs++LlAvW6w+DcPrOliSMXWCKo597CwL5Acf/wWdNkf/tfEQE3mjkeD1YOVZOUV/od1w==
 
-"@babel/helper-validator-option@^7.14.5", "@babel/helper-validator-option@^7.16.7", "@babel/helper-validator-option@^7.18.6":
+"@babel/helper-validator-option@^7.14.5", "@babel/helper-validator-option@^7.18.6":
   version "7.18.6"
   resolved "https://registry.yarnpkg.com/@babel/helper-validator-option/-/helper-validator-option-7.18.6.tgz#bf0d2b5a509b1f336099e4ff36e1a63aa5db4db8"
   integrity sha512-XO7gESt5ouv/LRJdrVjkShckw6STTaB7l9BrpBaAHDeF5YZT+01PCwmR0SJHnkW6i8OwW/EVWRShfi4j2x+KQw==
@@ -296,10 +298,10 @@
     chalk "^2.0.0"
     js-tokens "^4.0.0"
 
-"@babel/parser@^7.1.0", "@babel/parser@^7.14.7", "@babel/parser@^7.18.10", "@babel/parser@^7.18.11", "@babel/parser@^7.7.0":
-  version "7.18.11"
-  resolved "https://registry.yarnpkg.com/@babel/parser/-/parser-7.18.11.tgz#68bb07ab3d380affa9a3f96728df07969645d2d9"
-  integrity sha512-9JKn5vN+hDt0Hdqn1PiJ2guflwP+B6Ga8qbDuoF0PzzVhrzsKIJo8yGqVk6CmMHiMei9w1C1Bp9IMJSIK+HPIQ==
+"@babel/parser@^7.1.0", "@babel/parser@^7.14.7", "@babel/parser@^7.18.10", "@babel/parser@^7.18.11", "@babel/parser@^7.20.7", "@babel/parser@^7.7.0":
+  version "7.20.7"
+  resolved "https://registry.yarnpkg.com/@babel/parser/-/parser-7.20.7.tgz#66fe23b3c8569220817d5feb8b9dcdc95bb4f71b"
+  integrity sha512-T3Z9oHybU+0vZlY9CiDSJQTD5ZapcW18ZctFMi0MOAl/4BjFF4ul7NVSARLdbGO5vDqy9eQiGTV0LtKfvCYvcg==
 
 "@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression@^7.16.0":
   version "7.16.2"
@@ -582,12 +584,12 @@
   dependencies:
     "@babel/helper-plugin-utils" "^7.14.5"
 
-"@babel/plugin-syntax-typescript@^7.16.7", "@babel/plugin-syntax-typescript@^7.7.2":
-  version "7.17.10"
-  resolved "https://registry.yarnpkg.com/@babel/plugin-syntax-typescript/-/plugin-syntax-typescript-7.17.10.tgz#80031e6042cad6a95ed753f672ebd23c30933195"
-  integrity sha512-xJefea1DWXW09pW4Tm9bjwVlPDyYA2it3fWlmEjpYz6alPvTUjL0EOzNzI/FEOyI3r4/J7uVH5UqKgl1TQ5hqQ==
+"@babel/plugin-syntax-typescript@^7.20.0", "@babel/plugin-syntax-typescript@^7.7.2":
+  version "7.20.0"
+  resolved "https://registry.yarnpkg.com/@babel/plugin-syntax-typescript/-/plugin-syntax-typescript-7.20.0.tgz#4e9a0cfc769c85689b77a2e642d24e9f697fc8c7"
+  integrity sha512-rd9TkG+u1CExzS4SM1BlMEhMXwFLKVjOAFFCDx9PbX5ycJWDoWMcwdJH9RhkPu1dOgn5TrxLot/Gx6lWFuAUNQ==
   dependencies:
-    "@babel/helper-plugin-utils" "^7.16.7"
+    "@babel/helper-plugin-utils" "^7.19.0"
 
 "@babel/plugin-transform-arrow-functions@^7.16.0":
   version "7.16.0"
@@ -867,14 +869,14 @@
   dependencies:
     "@babel/helper-plugin-utils" "^7.14.5"
 
-"@babel/plugin-transform-typescript@^7.16.7":
-  version "7.16.8"
-  resolved "https://registry.yarnpkg.com/@babel/plugin-transform-typescript/-/plugin-transform-typescript-7.16.8.tgz#591ce9b6b83504903fa9dd3652c357c2ba7a1ee0"
-  integrity sha512-bHdQ9k7YpBDO2d0NVfkj51DpQcvwIzIusJ7mEUaMlbZq3Kt/U47j24inXZHQ5MDiYpCs+oZiwnXyKedE8+q7AQ==
+"@babel/plugin-transform-typescript@^7.18.6":
+  version "7.20.7"
+  resolved "https://registry.yarnpkg.com/@babel/plugin-transform-typescript/-/plugin-transform-typescript-7.20.7.tgz#673f49499cd810ae32a1ea5f3f8fab370987e055"
+  integrity sha512-m3wVKEvf6SoszD8pu4NZz3PvfKRCMgk6D6d0Qi9hNnlM5M6CFS92EgF4EiHVLKbU0r/r7ty1hg7NPZwE7WRbYw==
   dependencies:
-    "@babel/helper-create-class-features-plugin" "^7.16.7"
-    "@babel/helper-plugin-utils" "^7.16.7"
-    "@babel/plugin-syntax-typescript" "^7.16.7"
+    "@babel/helper-create-class-features-plugin" "^7.20.7"
+    "@babel/helper-plugin-utils" "^7.20.2"
+    "@babel/plugin-syntax-typescript" "^7.20.0"
 
 "@babel/plugin-transform-unicode-escapes@^7.16.0":
   version "7.16.0"
@@ -994,14 +996,14 @@
     "@babel/plugin-transform-react-jsx-development" "^7.18.6"
     "@babel/plugin-transform-react-pure-annotations" "^7.18.6"
 
-"@babel/preset-typescript@^7.16.0":
-  version "7.16.7"
-  resolved "https://registry.yarnpkg.com/@babel/preset-typescript/-/preset-typescript-7.16.7.tgz#ab114d68bb2020afc069cd51b37ff98a046a70b9"
-  integrity sha512-WbVEmgXdIyvzB77AQjGBEyYPZx+8tTsO50XtfozQrkW8QB2rLJpH2lgx0TRw5EJrBxOZQ+wCcyPVQvS8tjEHpQ==
+"@babel/preset-typescript@^7.18.6":
+  version "7.18.6"
+  resolved "https://registry.yarnpkg.com/@babel/preset-typescript/-/preset-typescript-7.18.6.tgz#ce64be3e63eddc44240c6358daefac17b3186399"
+  integrity sha512-s9ik86kXBAnD760aybBucdpnLsAt0jK1xqJn2juOn9lkOvSHV60os5hxoVJsPzMQxvnUJFAlkont2DvvaYEBtQ==
   dependencies:
-    "@babel/helper-plugin-utils" "^7.16.7"
-    "@babel/helper-validator-option" "^7.16.7"
-    "@babel/plugin-transform-typescript" "^7.16.7"
+    "@babel/helper-plugin-utils" "^7.18.6"
+    "@babel/helper-validator-option" "^7.18.6"
+    "@babel/plugin-transform-typescript" "^7.18.6"
 
 "@babel/runtime-corejs3@^7.10.2":
   version "7.12.5"
@@ -1018,35 +1020,35 @@
   dependencies:
     regenerator-runtime "^0.13.11"
 
-"@babel/template@^7.16.0", "@babel/template@^7.18.10", "@babel/template@^7.18.6", "@babel/template@^7.3.3":
-  version "7.18.10"
-  resolved "https://registry.yarnpkg.com/@babel/template/-/template-7.18.10.tgz#6f9134835970d1dbf0835c0d100c9f38de0c5e71"
-  integrity sha512-TI+rCtooWHr3QJ27kJxfjutghu44DLnasDMwpDqCXVTal9RLp3RSYNh4NdBrRP2cQAoG9A8juOQl6P6oZG4JxA==
+"@babel/template@^7.16.0", "@babel/template@^7.18.10", "@babel/template@^7.18.6", "@babel/template@^7.20.7", "@babel/template@^7.3.3":
+  version "7.20.7"
+  resolved "https://registry.yarnpkg.com/@babel/template/-/template-7.20.7.tgz#a15090c2839a83b02aa996c0b4994005841fd5a8"
+  integrity sha512-8SegXApWe6VoNw0r9JHpSteLKTpTiLZ4rMlGIm9JQ18KiCtyQiAMEazujAHrUS5flrcqYZa75ukev3P6QmUwUw==
   dependencies:
     "@babel/code-frame" "^7.18.6"
-    "@babel/parser" "^7.18.10"
-    "@babel/types" "^7.18.10"
+    "@babel/parser" "^7.20.7"
+    "@babel/types" "^7.20.7"
 
-"@babel/traverse@^7.13.0", "@babel/traverse@^7.16.0", "@babel/traverse@^7.18.10", "@babel/traverse@^7.18.9", "@babel/traverse@^7.4.5", "@babel/traverse@^7.7.0", "@babel/traverse@^7.7.2":
-  version "7.18.11"
-  resolved "https://registry.yarnpkg.com/@babel/traverse/-/traverse-7.18.11.tgz#3d51f2afbd83ecf9912bcbb5c4d94e3d2ddaa16f"
-  integrity sha512-TG9PiM2R/cWCAy6BPJKeHzNbu4lPzOSZpeMfeNErskGpTJx6trEvFaVCbDvpcxwy49BKWmEPwiW8mrysNiDvIQ==
+"@babel/traverse@^7.13.0", "@babel/traverse@^7.16.0", "@babel/traverse@^7.18.10", "@babel/traverse@^7.18.9", "@babel/traverse@^7.20.7", "@babel/traverse@^7.4.5", "@babel/traverse@^7.7.0", "@babel/traverse@^7.7.2":
+  version "7.20.12"
+  resolved "https://registry.yarnpkg.com/@babel/traverse/-/traverse-7.20.12.tgz#7f0f787b3a67ca4475adef1f56cb94f6abd4a4b5"
+  integrity sha512-MsIbFN0u+raeja38qboyF8TIT7K0BFzz/Yd/77ta4MsUsmP2RAnidIlwq7d5HFQrH/OZJecGV6B71C4zAgpoSQ==
   dependencies:
     "@babel/code-frame" "^7.18.6"
-    "@babel/generator" "^7.18.10"
+    "@babel/generator" "^7.20.7"
     "@babel/helper-environment-visitor" "^7.18.9"
-    "@babel/helper-function-name" "^7.18.9"
+    "@babel/helper-function-name" "^7.19.0"
     "@babel/helper-hoist-variables" "^7.18.6"
     "@babel/helper-split-export-declaration" "^7.18.6"
-    "@babel/parser" "^7.18.11"
-    "@babel/types" "^7.18.10"
+    "@babel/parser" "^7.20.7"
+    "@babel/types" "^7.20.7"
     debug "^4.1.0"
     globals "^11.1.0"
 
-"@babel/types@^7.0.0", "@babel/types@^7.0.0-beta.49", "@babel/types@^7.16.0", "@babel/types@^7.18.10", "@babel/types@^7.18.6", "@babel/types@^7.18.9", "@babel/types@^7.19.0", "@babel/types@^7.3.0", "@babel/types@^7.3.3", "@babel/types@^7.4.4", "@babel/types@^7.7.0":
-  version "7.20.5"
-  resolved "https://registry.yarnpkg.com/@babel/types/-/types-7.20.5.tgz#e206ae370b5393d94dfd1d04cd687cace53efa84"
-  integrity sha512-c9fst/h2/dcF7H+MJKZ2T0KjEQ8hY/BNnDk/H3XY8C4Aw/eWQXWn/lWntHF9ooUBnGmEvbfGrTgLWc+um0YDUg==
+"@babel/types@^7.0.0", "@babel/types@^7.0.0-beta.49", "@babel/types@^7.16.0", "@babel/types@^7.18.10", "@babel/types@^7.18.6", "@babel/types@^7.18.9", "@babel/types@^7.19.0", "@babel/types@^7.20.0", "@babel/types@^7.20.7", "@babel/types@^7.3.0", "@babel/types@^7.3.3", "@babel/types@^7.4.4", "@babel/types@^7.7.0":
+  version "7.20.7"
+  resolved "https://registry.yarnpkg.com/@babel/types/-/types-7.20.7.tgz#54ec75e252318423fc07fb644dc6a58a64c09b7f"
+  integrity sha512-69OnhBxSSgK0OzTJai4kyPDiKTIe3j+ctaHdIGVbRahTLAT7L3R9oeXHC2aVSuGYt3cVnoAMDmOCgJ2yaiLMvg==
   dependencies:
     "@babel/helper-string-parser" "^7.19.4"
     "@babel/helper-validator-identifier" "^7.19.1"
@@ -10062,10 +10064,10 @@ jsdom@^19.0.0:
     ws "^8.2.3"
     xml-name-validator "^4.0.0"
 
-jsdom@^20.0.3:
-  version "20.0.3"
-  resolved "https://registry.yarnpkg.com/jsdom/-/jsdom-20.0.3.tgz#886a41ba1d4726f67a8858028c99489fed6ad4db"
-  integrity sha512-SYhBvTh89tTfCD/CRdSOm13mOBa42iTaTyfyEWBdKcGdPxPtLFBXuHR8XHb33YNYaP+lLbmSvBTsnoesCNJEsQ==
+jsdom@^21.0.0:
+  version "21.0.0"
+  resolved "https://registry.yarnpkg.com/jsdom/-/jsdom-21.0.0.tgz#33e22f2fc44286e50ac853c7b7656c8864a4ea45"
+  integrity sha512-AIw+3ZakSUtDYvhwPwWHiZsUi3zHugpMEKlNPaurviseYoBqo0zBd3zqoUi3LPCNtPFlEP8FiW9MqCZdjb2IYA==
   dependencies:
     abab "^2.0.6"
     acorn "^8.8.1"
diff --git a/pkgs/servers/web-apps/outline/yarn.nix b/pkgs/servers/web-apps/outline/yarn.nix
index 8f4cbb4b8b35..6e2aa068aeab 100644
--- a/pkgs/servers/web-apps/outline/yarn.nix
+++ b/pkgs/servers/web-apps/outline/yarn.nix
@@ -58,11 +58,11 @@
       };
     }
     {
-      name = "_babel_generator___generator_7.18.12.tgz";
+      name = "_babel_generator___generator_7.20.7.tgz";
       path = fetchurl {
-        name = "_babel_generator___generator_7.18.12.tgz";
-        url  = "https://registry.yarnpkg.com/@babel/generator/-/generator-7.18.12.tgz";
-        sha512 = "dfQ8ebCN98SvyL7IxNMCUtZQSq5R7kxgN+r8qYTGDmmSion1hX2C0zq2yo1bsCDhXixokv1SAWTZUMYbO/V5zg==";
+        name = "_babel_generator___generator_7.20.7.tgz";
+        url  = "https://registry.yarnpkg.com/@babel/generator/-/generator-7.20.7.tgz";
+        sha512 = "7wqMOJq8doJMZmP4ApXTzLxSr7+oO2jroJURrVEp6XShrQUObV8Tq/D0NCcoYg2uHqUrjzO0zwBjoYzelxK+sw==";
       };
     }
     {
@@ -90,11 +90,11 @@
       };
     }
     {
-      name = "_babel_helper_create_class_features_plugin___helper_create_class_features_plugin_7.18.9.tgz";
+      name = "_babel_helper_create_class_features_plugin___helper_create_class_features_plugin_7.20.12.tgz";
       path = fetchurl {
-        name = "_babel_helper_create_class_features_plugin___helper_create_class_features_plugin_7.18.9.tgz";
-        url  = "https://registry.yarnpkg.com/@babel/helper-create-class-features-plugin/-/helper-create-class-features-plugin-7.18.9.tgz";
-        sha512 = "WvypNAYaVh23QcjpMR24CwZY2Nz6hqdOcFdPbNpV56hL5H6KiFheO7Xm1aPdlLQ7d5emYZX7VZwPp9x3z+2opw==";
+        name = "_babel_helper_create_class_features_plugin___helper_create_class_features_plugin_7.20.12.tgz";
+        url  = "https://registry.yarnpkg.com/@babel/helper-create-class-features-plugin/-/helper-create-class-features-plugin-7.20.12.tgz";
+        sha512 = "9OunRkbT0JQcednL0UFvbfXpAsUXiGjUk0a7sN8fUXX7Mue79cUSMjHGDRRi/Vz9vYlpIhLV5fMD5dKoMhhsNQ==";
       };
     }
     {
@@ -130,11 +130,11 @@
       };
     }
     {
-      name = "_babel_helper_function_name___helper_function_name_7.18.9.tgz";
+      name = "_babel_helper_function_name___helper_function_name_7.19.0.tgz";
       path = fetchurl {
-        name = "_babel_helper_function_name___helper_function_name_7.18.9.tgz";
-        url  = "https://registry.yarnpkg.com/@babel/helper-function-name/-/helper-function-name-7.18.9.tgz";
-        sha512 = "fJgWlZt7nxGksJS9a0XdSaI4XvpExnNIgRP+rVefWh5U7BL8pPuir6SJUmFKRfjWQ51OtWSzwOxhaH/EBWWc0A==";
+        name = "_babel_helper_function_name___helper_function_name_7.19.0.tgz";
+        url  = "https://registry.yarnpkg.com/@babel/helper-function-name/-/helper-function-name-7.19.0.tgz";
+        sha512 = "WAwHBINyrpqywkUH0nTnNgI5ina5TFn85HKS0pbPDfxFfhyR/aNQEn4hGi1P1JyT//I0t4OgXUlofzWILRvS5w==";
       };
     }
     {
@@ -146,11 +146,11 @@
       };
     }
     {
-      name = "_babel_helper_member_expression_to_functions___helper_member_expression_to_functions_7.18.9.tgz";
+      name = "_babel_helper_member_expression_to_functions___helper_member_expression_to_functions_7.20.7.tgz";
       path = fetchurl {
-        name = "_babel_helper_member_expression_to_functions___helper_member_expression_to_functions_7.18.9.tgz";
-        url  = "https://registry.yarnpkg.com/@babel/helper-member-expression-to-functions/-/helper-member-expression-to-functions-7.18.9.tgz";
-        sha512 = "RxifAh2ZoVU67PyKIO4AMi1wTenGfMR/O/ae0CCRqwgBAt5v7xjdtRw7UoSbsreKrQn5t7r89eruK/9JjYHuDg==";
+        name = "_babel_helper_member_expression_to_functions___helper_member_expression_to_functions_7.20.7.tgz";
+        url  = "https://registry.yarnpkg.com/@babel/helper-member-expression-to-functions/-/helper-member-expression-to-functions-7.20.7.tgz";
+        sha512 = "9J0CxJLq315fEdi4s7xK5TQaNYjZw+nDVpVqr1axNGKzdrdwYBD5b4uKv3n75aABG0rCCTK8Im8Ww7eYfMrZgw==";
       };
     }
     {
@@ -194,11 +194,11 @@
       };
     }
     {
-      name = "_babel_helper_replace_supers___helper_replace_supers_7.18.9.tgz";
+      name = "_babel_helper_replace_supers___helper_replace_supers_7.20.7.tgz";
       path = fetchurl {
-        name = "_babel_helper_replace_supers___helper_replace_supers_7.18.9.tgz";
-        url  = "https://registry.yarnpkg.com/@babel/helper-replace-supers/-/helper-replace-supers-7.18.9.tgz";
-        sha512 = "dNsWibVI4lNT6HiuOIBr1oyxo40HvIVmbwPUm3XZ7wMh4k2WxrxTqZwSqw/eEmXDS9np0ey5M2bz9tBmO9c+YQ==";
+        name = "_babel_helper_replace_supers___helper_replace_supers_7.20.7.tgz";
+        url  = "https://registry.yarnpkg.com/@babel/helper-replace-supers/-/helper-replace-supers-7.20.7.tgz";
+        sha512 = "vujDMtB6LVfNW13jhlCrp48QNslK6JXi7lQG736HVbHz/mbf4Dc7tIRh1Xf5C0rF7BP8iiSxGMCmY6Ci1ven3A==";
       };
     }
     {
@@ -210,11 +210,11 @@
       };
     }
     {
-      name = "_babel_helper_skip_transparent_expression_wrappers___helper_skip_transparent_expression_wrappers_7.16.0.tgz";
+      name = "_babel_helper_skip_transparent_expression_wrappers___helper_skip_transparent_expression_wrappers_7.20.0.tgz";
       path = fetchurl {
-        name = "_babel_helper_skip_transparent_expression_wrappers___helper_skip_transparent_expression_wrappers_7.16.0.tgz";
-        url  = "https://registry.yarnpkg.com/@babel/helper-skip-transparent-expression-wrappers/-/helper-skip-transparent-expression-wrappers-7.16.0.tgz";
-        sha512 = "+il1gTy0oHwUsBQZyJvukbB4vPMdcYBrFHa0Uc4AizLxbq6BOYC51Rv4tWocX9BLBDLZ4kc6qUFpQ6HRgL+3zw==";
+        name = "_babel_helper_skip_transparent_expression_wrappers___helper_skip_transparent_expression_wrappers_7.20.0.tgz";
+        url  = "https://registry.yarnpkg.com/@babel/helper-skip-transparent-expression-wrappers/-/helper-skip-transparent-expression-wrappers-7.20.0.tgz";
+        sha512 = "5y1JYeNKfvnT8sZcK9DVRtpTbGiomYIHviSP3OQWmDPU3DeH4a1ZlT/N2lyQ5P8egjcRaT/Y9aNqUxK0WsnIIg==";
       };
     }
     {
@@ -274,11 +274,11 @@
       };
     }
     {
-      name = "_babel_parser___parser_7.18.11.tgz";
+      name = "_babel_parser___parser_7.20.7.tgz";
       path = fetchurl {
-        name = "_babel_parser___parser_7.18.11.tgz";
-        url  = "https://registry.yarnpkg.com/@babel/parser/-/parser-7.18.11.tgz";
-        sha512 = "9JKn5vN+hDt0Hdqn1PiJ2guflwP+B6Ga8qbDuoF0PzzVhrzsKIJo8yGqVk6CmMHiMei9w1C1Bp9IMJSIK+HPIQ==";
+        name = "_babel_parser___parser_7.20.7.tgz";
+        url  = "https://registry.yarnpkg.com/@babel/parser/-/parser-7.20.7.tgz";
+        sha512 = "T3Z9oHybU+0vZlY9CiDSJQTD5ZapcW18ZctFMi0MOAl/4BjFF4ul7NVSARLdbGO5vDqy9eQiGTV0LtKfvCYvcg==";
       };
     }
     {
@@ -570,11 +570,11 @@
       };
     }
     {
-      name = "_babel_plugin_syntax_typescript___plugin_syntax_typescript_7.17.10.tgz";
+      name = "_babel_plugin_syntax_typescript___plugin_syntax_typescript_7.20.0.tgz";
       path = fetchurl {
-        name = "_babel_plugin_syntax_typescript___plugin_syntax_typescript_7.17.10.tgz";
-        url  = "https://registry.yarnpkg.com/@babel/plugin-syntax-typescript/-/plugin-syntax-typescript-7.17.10.tgz";
-        sha512 = "xJefea1DWXW09pW4Tm9bjwVlPDyYA2it3fWlmEjpYz6alPvTUjL0EOzNzI/FEOyI3r4/J7uVH5UqKgl1TQ5hqQ==";
+        name = "_babel_plugin_syntax_typescript___plugin_syntax_typescript_7.20.0.tgz";
+        url  = "https://registry.yarnpkg.com/@babel/plugin-syntax-typescript/-/plugin-syntax-typescript-7.20.0.tgz";
+        sha512 = "rd9TkG+u1CExzS4SM1BlMEhMXwFLKVjOAFFCDx9PbX5ycJWDoWMcwdJH9RhkPu1dOgn5TrxLot/Gx6lWFuAUNQ==";
       };
     }
     {
@@ -858,11 +858,11 @@
       };
     }
     {
-      name = "_babel_plugin_transform_typescript___plugin_transform_typescript_7.16.8.tgz";
+      name = "_babel_plugin_transform_typescript___plugin_transform_typescript_7.20.7.tgz";
       path = fetchurl {
-        name = "_babel_plugin_transform_typescript___plugin_transform_typescript_7.16.8.tgz";
-        url  = "https://registry.yarnpkg.com/@babel/plugin-transform-typescript/-/plugin-transform-typescript-7.16.8.tgz";
-        sha512 = "bHdQ9k7YpBDO2d0NVfkj51DpQcvwIzIusJ7mEUaMlbZq3Kt/U47j24inXZHQ5MDiYpCs+oZiwnXyKedE8+q7AQ==";
+        name = "_babel_plugin_transform_typescript___plugin_transform_typescript_7.20.7.tgz";
+        url  = "https://registry.yarnpkg.com/@babel/plugin-transform-typescript/-/plugin-transform-typescript-7.20.7.tgz";
+        sha512 = "m3wVKEvf6SoszD8pu4NZz3PvfKRCMgk6D6d0Qi9hNnlM5M6CFS92EgF4EiHVLKbU0r/r7ty1hg7NPZwE7WRbYw==";
       };
     }
     {
@@ -906,11 +906,11 @@
       };
     }
     {
-      name = "_babel_preset_typescript___preset_typescript_7.16.7.tgz";
+      name = "_babel_preset_typescript___preset_typescript_7.18.6.tgz";
       path = fetchurl {
-        name = "_babel_preset_typescript___preset_typescript_7.16.7.tgz";
-        url  = "https://registry.yarnpkg.com/@babel/preset-typescript/-/preset-typescript-7.16.7.tgz";
-        sha512 = "WbVEmgXdIyvzB77AQjGBEyYPZx+8tTsO50XtfozQrkW8QB2rLJpH2lgx0TRw5EJrBxOZQ+wCcyPVQvS8tjEHpQ==";
+        name = "_babel_preset_typescript___preset_typescript_7.18.6.tgz";
+        url  = "https://registry.yarnpkg.com/@babel/preset-typescript/-/preset-typescript-7.18.6.tgz";
+        sha512 = "s9ik86kXBAnD760aybBucdpnLsAt0jK1xqJn2juOn9lkOvSHV60os5hxoVJsPzMQxvnUJFAlkont2DvvaYEBtQ==";
       };
     }
     {
@@ -930,27 +930,27 @@
       };
     }
     {
-      name = "_babel_template___template_7.18.10.tgz";
+      name = "_babel_template___template_7.20.7.tgz";
       path = fetchurl {
-        name = "_babel_template___template_7.18.10.tgz";
-        url  = "https://registry.yarnpkg.com/@babel/template/-/template-7.18.10.tgz";
-        sha512 = "TI+rCtooWHr3QJ27kJxfjutghu44DLnasDMwpDqCXVTal9RLp3RSYNh4NdBrRP2cQAoG9A8juOQl6P6oZG4JxA==";
+        name = "_babel_template___template_7.20.7.tgz";
+        url  = "https://registry.yarnpkg.com/@babel/template/-/template-7.20.7.tgz";
+        sha512 = "8SegXApWe6VoNw0r9JHpSteLKTpTiLZ4rMlGIm9JQ18KiCtyQiAMEazujAHrUS5flrcqYZa75ukev3P6QmUwUw==";
       };
     }
     {
-      name = "_babel_traverse___traverse_7.18.11.tgz";
+      name = "_babel_traverse___traverse_7.20.12.tgz";
       path = fetchurl {
-        name = "_babel_traverse___traverse_7.18.11.tgz";
-        url  = "https://registry.yarnpkg.com/@babel/traverse/-/traverse-7.18.11.tgz";
-        sha512 = "TG9PiM2R/cWCAy6BPJKeHzNbu4lPzOSZpeMfeNErskGpTJx6trEvFaVCbDvpcxwy49BKWmEPwiW8mrysNiDvIQ==";
+        name = "_babel_traverse___traverse_7.20.12.tgz";
+        url  = "https://registry.yarnpkg.com/@babel/traverse/-/traverse-7.20.12.tgz";
+        sha512 = "MsIbFN0u+raeja38qboyF8TIT7K0BFzz/Yd/77ta4MsUsmP2RAnidIlwq7d5HFQrH/OZJecGV6B71C4zAgpoSQ==";
       };
     }
     {
-      name = "_babel_types___types_7.20.5.tgz";
+      name = "_babel_types___types_7.20.7.tgz";
       path = fetchurl {
-        name = "_babel_types___types_7.20.5.tgz";
-        url  = "https://registry.yarnpkg.com/@babel/types/-/types-7.20.5.tgz";
-        sha512 = "c9fst/h2/dcF7H+MJKZ2T0KjEQ8hY/BNnDk/H3XY8C4Aw/eWQXWn/lWntHF9ooUBnGmEvbfGrTgLWc+um0YDUg==";
+        name = "_babel_types___types_7.20.7.tgz";
+        url  = "https://registry.yarnpkg.com/@babel/types/-/types-7.20.7.tgz";
+        sha512 = "69OnhBxSSgK0OzTJai4kyPDiKTIe3j+ctaHdIGVbRahTLAT7L3R9oeXHC2aVSuGYt3cVnoAMDmOCgJ2yaiLMvg==";
       };
     }
     {
@@ -10482,11 +10482,11 @@
       };
     }
     {
-      name = "jsdom___jsdom_20.0.3.tgz";
+      name = "jsdom___jsdom_21.0.0.tgz";
       path = fetchurl {
-        name = "jsdom___jsdom_20.0.3.tgz";
-        url  = "https://registry.yarnpkg.com/jsdom/-/jsdom-20.0.3.tgz";
-        sha512 = "SYhBvTh89tTfCD/CRdSOm13mOBa42iTaTyfyEWBdKcGdPxPtLFBXuHR8XHb33YNYaP+lLbmSvBTsnoesCNJEsQ==";
+        name = "jsdom___jsdom_21.0.0.tgz";
+        url  = "https://registry.yarnpkg.com/jsdom/-/jsdom-21.0.0.tgz";
+        sha512 = "AIw+3ZakSUtDYvhwPwWHiZsUi3zHugpMEKlNPaurviseYoBqo0zBd3zqoUi3LPCNtPFlEP8FiW9MqCZdjb2IYA==";
       };
     }
     {
diff --git a/pkgs/servers/web-apps/wallabag/default.nix b/pkgs/servers/web-apps/wallabag/default.nix
index a9a81119fc1c..956f33ca7404 100644
--- a/pkgs/servers/web-apps/wallabag/default.nix
+++ b/pkgs/servers/web-apps/wallabag/default.nix
@@ -27,11 +27,19 @@ stdenv.mkDerivation {
       "https://static.wallabag.org/releases/wallabag-release-${version}.tar.gz"
       "https://github.com/wallabag/wallabag/releases/download/${version}/wallabag-${version}.tar.gz"
     ];
-    hash = "sha256-a30z9rdXcfc2eVuShEobgDWWHr9TfMwq9WwaWdrI3QU=";
+    hash = "sha256-3o5LFGPd4oFz3leKzCy7lIjQ3ELSLqZuIswptB7i24U=";
   };
 
   patches = [
     ./wallabag-data.patch # exposes $WALLABAG_DATA
+
+    # Use sendmail from php.ini instead of FHS path.
+    (fetchpatch {
+      url = "https://github.com/symfony/swiftmailer-bundle/commit/31a4fed8f621f141ba70cb42ffb8f73184995f4c.patch";
+      stripLen = 1;
+      extraPrefix = "vendor/symfony/swiftmailer-bundle/";
+      sha256 = "rxHiGhKFd/ZWnIfTt6omFLLoNFlyxOYNCHIv/UtxCho=";
+    })
   ];
 
   dontBuild = true;
diff --git a/pkgs/shells/zsh/zsh-forgit/default.nix b/pkgs/shells/zsh/zsh-forgit/default.nix
index ff1a5f7d9c75..0bfbd9cd4b73 100644
--- a/pkgs/shells/zsh/zsh-forgit/default.nix
+++ b/pkgs/shells/zsh/zsh-forgit/default.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "zsh-forgit";
-  version = "23.01.0";
+  version = "23.02.0";
 
   src = fetchFromGitHub {
     owner = "wfxr";
     repo = "forgit";
     rev = version;
-    sha256 = "sha256-guAjxFhtybbRyRRXDELDHrM2Xzmi96wPxD2nhL9Ifmk=";
+    sha256 = "sha256-PGFYw7JbuYHOVycPlYcRItElcyuKEg2cGv4wn6In5Mo=";
   };
 
   strictDeps = true;
diff --git a/pkgs/tools/admin/eksctl/default.nix b/pkgs/tools/admin/eksctl/default.nix
index e3b2ae74ca4b..ed9d9007a936 100644
--- a/pkgs/tools/admin/eksctl/default.nix
+++ b/pkgs/tools/admin/eksctl/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "eksctl";
-  version = "0.127.0";
+  version = "0.128.0";
 
   src = fetchFromGitHub {
     owner = "weaveworks";
     repo = pname;
     rev = version;
-    sha256 = "sha256-WCkVCND3c8HYLi0UrgF3zoEykIs1/D7HgeblZETvU4M=";
+    sha256 = "sha256-CKtDj9Ht81i8EcpjHqluWfwkEU15a/TZd6N+jCSzIc8=";
   };
 
-  vendorHash = "sha256-FBKwWApiIs0y0IZqJOJwzdBq1ihaPv8mqqSTO42ggi0=";
+  vendorHash = "sha256-aSXj21JNqX/cc62oFqyedmvczmudcV7RhLyWrKsdOMQ=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/admin/kics/default.nix b/pkgs/tools/admin/kics/default.nix
index 88621f236569..1471f039d395 100644
--- a/pkgs/tools/admin/kics/default.nix
+++ b/pkgs/tools/admin/kics/default.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "kics";
-  version = "1.6.8";
+  version = "1.6.9";
 
   src = fetchFromGitHub {
     owner = "Checkmarx";
     repo = "kics";
     rev = "v${version}";
-    sha256 = "sha256-s2M763M4Hoy8gjgkHT69pCUCsWepmt0zEyXYpGzYTn0=";
+    sha256 = "sha256-So6S/AyuuHpezu4FMDOXDOdJqvEexbgpmLhDnDbbUuM=";
   };
 
-  vendorHash = "sha256-JWdc0BN0GRw79uhb2uubSG1bnZlTHTVrmS0Jft1ZNh8=";
+  vendorHash = "sha256-wFKQv/9GtXMnTP+HkmmHO0RgQ98jm1GZeIGIJiqWx1I=";
 
   subPackages = [ "cmd/console" ];
 
diff --git a/pkgs/tools/admin/uacme/default.nix b/pkgs/tools/admin/uacme/default.nix
index fabc4923dd74..039c817bdf20 100644
--- a/pkgs/tools/admin/uacme/default.nix
+++ b/pkgs/tools/admin/uacme/default.nix
@@ -37,6 +37,6 @@ stdenv.mkDerivation rec {
     description = "ACMEv2 client written in plain C with minimal dependencies";
     homepage = "https://github.com/ndilieto/uacme";
     license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ malvo ];
+    maintainers = with maintainers; [ malte-v ];
   };
 }
diff --git a/pkgs/tools/archivers/arc_unpacker/default.nix b/pkgs/tools/archivers/arc_unpacker/default.nix
index 561567f8b154..ab018fde3d64 100644
--- a/pkgs/tools/archivers/arc_unpacker/default.nix
+++ b/pkgs/tools/archivers/arc_unpacker/default.nix
@@ -13,8 +13,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ cmake makeWrapper catch2 ];
-  buildInputs = [ boost libpng libjpeg zlib openssl libwebp ]
-    ++ lib.optionals stdenv.isDarwin [ libiconv ];
+  buildInputs = [ boost libiconv libjpeg libpng libwebp openssl zlib ];
 
   postPatch = ''
     cp ${catch2}/include/catch2/catch.hpp tests/test_support/catch.h
diff --git a/pkgs/tools/audio/openai-whisper-cpp/default.nix b/pkgs/tools/audio/openai-whisper-cpp/default.nix
index b59016e2c9f1..a55c83028151 100644
--- a/pkgs/tools/audio/openai-whisper-cpp/default.nix
+++ b/pkgs/tools/audio/openai-whisper-cpp/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "whisper-cpp";
-  version = "1.0.4";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "ggerganov";
     repo = "whisper.cpp";
-    rev = version;
-    sha256 = "sha256-lw+POI47bW66NlmMPJKAkqAYhOnyGaFqcS2cX5LRBbk=";
+    rev = "refs/tags/v${version}" ;
+    hash = "sha256-7/10t1yE7Gbs+cyj8I9vJoDeaxEz9Azc2j3f6QCjDGM=";
   };
 
   # The upstream download script tries to download the models to the
diff --git a/pkgs/tools/audio/openai-whisper-cpp/download-models.patch b/pkgs/tools/audio/openai-whisper-cpp/download-models.patch
index 419ddced72b9..11498e6c75ee 100644
--- a/pkgs/tools/audio/openai-whisper-cpp/download-models.patch
+++ b/pkgs/tools/audio/openai-whisper-cpp/download-models.patch
@@ -1,5 +1,5 @@
 diff --git a/models/download-ggml-model.sh b/models/download-ggml-model.sh
-index cf54623..5e9c905 100755
+index 7075080..5e9c905 100755
 --- a/models/download-ggml-model.sh
 +++ b/models/download-ggml-model.sh
 @@ -9,18 +9,6 @@
@@ -16,7 +16,7 @@ index cf54623..5e9c905 100755
 -    fi
 -}
 -
--models_path=$(get_script_path)
+-models_path="$(get_script_path)"
 -
  # Whisper models
  models=( "tiny.en" "tiny" "base.en" "base" "small.en" "small" "medium.en" "medium" "large-v1" "large" )
diff --git a/pkgs/tools/inputmethods/evdevremapkeys/default.nix b/pkgs/tools/inputmethods/evdevremapkeys/default.nix
index 73344ca26900..497a4abc5956 100644
--- a/pkgs/tools/inputmethods/evdevremapkeys/default.nix
+++ b/pkgs/tools/inputmethods/evdevremapkeys/default.nix
@@ -2,13 +2,13 @@
 
 python3Packages.buildPythonPackage rec {
   pname = "evdevremapkeys";
-  version = "0.1.0";
+  version = "unstable-2021-05-04";
 
   src = fetchFromGitHub {
     owner = "philipl";
     repo = pname;
-    rev = "68fb618b8142e1b45d7a1e19ea9a5a9bbb206144";
-    sha256 = "0c9slflakm5jqd8s1zpxm7gmrrk0335m040d7m70hnsak42jvs2f";
+    rev = "9b6f372a9bdf8b27d39f7e655b74f6b9d1a8467f";
+    sha256 = "sha256-FwRbo0RTiiV2AB7z6XOalMnwMbj15jM4Dxs41TsIOQI=";
   };
 
   propagatedBuildInputs = with python3Packages; [
@@ -16,6 +16,7 @@ python3Packages.buildPythonPackage rec {
     pyxdg
     python-daemon
     evdev
+    pyudev
   ];
 
   # hase no tests
diff --git a/pkgs/tools/misc/bdfresize/default.nix b/pkgs/tools/misc/bdfresize/default.nix
index f1ac559fb672..ef3ffc873aa9 100644
--- a/pkgs/tools/misc/bdfresize/default.nix
+++ b/pkgs/tools/misc/bdfresize/default.nix
@@ -15,6 +15,6 @@ stdenv.mkDerivation rec {
     description = "Tool to resize BDF fonts";
     homepage = "http://openlab.ring.gr.jp/efont/dist/tools/bdfresize/";
     license = licenses.gpl2Only;
-    maintainers = with maintainers; [ malvo ];
+    maintainers = with maintainers; [ malte-v ];
   };
 }
diff --git a/pkgs/tools/misc/f2/default.nix b/pkgs/tools/misc/f2/default.nix
index 943ce72cc6ce..48b14b867059 100644
--- a/pkgs/tools/misc/f2/default.nix
+++ b/pkgs/tools/misc/f2/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "f2";
-  version = "1.8.0";
+  version = "1.9.0";
 
   src = fetchFromGitHub {
     owner = "ayoisaiah";
     repo = "f2";
     rev = "v${version}";
-    sha256 = "sha256-bNcPzvjVBH7x60kNjlUILiQGG3GDmqIB5T2WP3+nZ+s=";
+    sha256 = "sha256-2+wp9hbPDH8RAeQNH1OYDfFlev+QTsEHixYb/luR9F0=";
   };
 
-  vendorSha256 = "sha256-Cahqk+7jDMUtZq0zhBll1Tfryu2zSPBN7JKscV38360=";
+  vendorHash = "sha256-sOTdP+MuOH9jB3RMajeUx84pINSuWVRw5p/9lrOj6uo=";
 
   ldflags = [ "-s" "-w" "-X=main.Version=${version}" ];
 
diff --git a/pkgs/tools/misc/jfrog-cli/default.nix b/pkgs/tools/misc/jfrog-cli/default.nix
index 3b11dfcb64fd..a3bb87d56cca 100644
--- a/pkgs/tools/misc/jfrog-cli/default.nix
+++ b/pkgs/tools/misc/jfrog-cli/default.nix
@@ -2,14 +2,14 @@
 
 buildGoModule rec {
   pname = "jfrog-cli";
-  version = "2.34.0";
-  vendorHash = "sha256-Z0ifACsdSIYevsvRD5KACFSRlvrL1jIJbrzjDFeLbEQ=";
+  version = "2.34.1";
+  vendorHash = "sha256-0C2uUq8GKM3IMjhH30Fa702uDmXbVbEDWJ6wKIWYTQw=";
 
   src = fetchFromGitHub {
     owner = "jfrog";
     repo = "jfrog-cli";
     rev = "v${version}";
-    sha256 = "sha256-SDZzbUh3wbDfzkE/5GgFstDuMYLiM8+MXRZ79jYGoaQ=";
+    sha256 = "sha256-7jkhr6fav7YwwFyO3m6mj2jl3RoX3sbS4YBBeMT/Go8=";
   };
 
   postInstall = ''
diff --git a/pkgs/tools/misc/kakoune-cr/default.nix b/pkgs/tools/misc/kakoune-cr/default.nix
index 3d71482d4ead..9a9fa5c9162a 100644
--- a/pkgs/tools/misc/kakoune-cr/default.nix
+++ b/pkgs/tools/misc/kakoune-cr/default.nix
@@ -44,7 +44,7 @@ crystal.buildCrystalPackage rec {
     homepage = "https://github.com/alexherbo2/kakoune.cr";
     description = "A command-line tool for Kakoune";
     license = licenses.unlicense;
-    maintainers = with maintainers; [ malvo ];
+    maintainers = with maintainers; [ malte-v ];
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/tools/misc/krapslog/default.nix b/pkgs/tools/misc/krapslog/default.nix
index 02e783fa1e09..ef31e582f5c1 100644
--- a/pkgs/tools/misc/krapslog/default.nix
+++ b/pkgs/tools/misc/krapslog/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "krapslog";
-  version = "0.4.2";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "acj";
     repo = "krapslog-rs";
     rev = version;
-    sha256 = "sha256-P/MxIehxj+FE5hvWge7Q2EwL57ObV8ibRZtmko0mphY=";
+    sha256 = "sha256-GSjS/6wetm3kHXdGyeenzALZ3tVi7BMM/GLS1ZhMQas=";
   };
 
-  cargoSha256 = "sha256-dQDfL5yN2ufFpQCXZ5Il0Qzhb/d7FETCVJg3DOMJPWQ=";
+  cargoHash = "sha256-dgbi0mUI8WqqXF1VNOTbHuCKcvb4B18/1vBlJZ8Jivs=";
 
   buildInputs = lib.optional stdenv.isDarwin libiconv;
 
diff --git a/pkgs/tools/misc/memtest86+/default.nix b/pkgs/tools/misc/memtest86+/default.nix
index a2dae74457df..547bbba89046 100644
--- a/pkgs/tools/misc/memtest86+/default.nix
+++ b/pkgs/tools/misc/memtest86+/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "memtest86+";
-  version = "6.01";
+  version = "6.10";
 
   src = fetchFromGitHub {
     owner = "memtest86plus";
     repo = "memtest86plus";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-BAY8hR8Sl9Hp9Zps0INL43cNqJwXX689m9rfa4dHrqs=";
+    hash = "sha256-f40blxh/On/mC4m+eLNeWzdYzYoYpFOSBndVnREx68U=";
   };
 
   # Binaries are booted directly by BIOS/UEFI or bootloader
diff --git a/pkgs/tools/misc/opentsdb/default.nix b/pkgs/tools/misc/opentsdb/default.nix
index 0429e854338b..0ad5b060119e 100644
--- a/pkgs/tools/misc/opentsdb/default.nix
+++ b/pkgs/tools/misc/opentsdb/default.nix
@@ -1,34 +1,299 @@
-{ lib, stdenv, autoconf, automake, curl, fetchurl, fetchpatch, jdk8, makeWrapper, nettools
-, python3, git
+{ lib
+, stdenv
+, autoconf
+, automake
+, bash
+, curl
+, fetchFromGitHub
+, fetchMavenArtifact
+, fetchurl
+, git
+, jdk8
+, makeWrapper
+, nettools
+, python3
 }:
 
-let jdk = jdk8; jre = jdk8.jre; in
-
-stdenv.mkDerivation rec {
+let
+  jdk = jdk8;
+  jre = jdk8.jre;
+  artifacts = {
+    apache = [
+      (fetchMavenArtifact {
+        groupId = "org.apache.commons";
+        artifactId = "commons-math3";
+        version = "3.4.1";
+        hash = "sha256-0QdbFKcQhwOLC/0Zjw992OSbWzUp2OLrqZ59nrhWXks=";
+      })
+    ];
+    guava = [
+      (fetchMavenArtifact {
+        groupId = "com.google.guava";
+        artifactId = "guava";
+        version = "18.0";
+        hash = "sha256-1mT7/APS5c6cqypE+wHx0L+d/r7MwaRzsfnqMfefb5k=";
+      })
+    ];
+    gwt = [
+      (fetchMavenArtifact {
+        groupId = "com.google.gwt";
+        artifactId = "gwt-dev";
+        version = "2.6.0";
+        hash = "sha256-4MLdI7q5fkftHTMoN7W3l5zsq1QB2R/8bF86vEqBI+A=";
+      })
+      (fetchMavenArtifact {
+        groupId = "com.google.gwt";
+        artifactId = "gwt-user";
+        version = "2.6.0";
+        hash = "sha256-HR5/aopn605inHeENNHBAqKrjkvIl9wPDM+nOwOpiEg=";
+      })
+      (fetchMavenArtifact {
+        groupId = "net.opentsdb";
+        artifactId = "opentsdb-gwt-theme";
+        version = "1.0.0";
+        hash = "sha256-JJsjcRlQmIrwpOtMweH12e/Ut5NG8R50VPiOAMMGEdc=";
+      })
+    ];
+    hamcrest = [
+      (fetchMavenArtifact {
+        url = "https://repo1.maven.org/maven2/org/hamcrest/hamcrest-core/1.3/hamcrest-core-1.3.jar";
+        groupId = "org.hamcrest";
+        artifactId = "hamcrest-core";
+        version = "1.3";
+        hash = "sha256-Zv3vkelzk0jfeglqo4SlaF9Oh1WEzOiThqekclHE2Ok=";
+      })
+    ];
+    hbase = [
+      (fetchMavenArtifact {
+        groupId = "org.hbase";
+        artifactId = "asynchbase";
+        version = "1.8.2";
+        hash = "sha256-D7mKprHMW23dE0SzdNsagv3Hp2G5HUN7sKfs1nVzQF4=";
+      })
+    ];
+    jackson = [
+      (fetchMavenArtifact {
+        groupId = "com.fasterxml.jackson.core";
+        artifactId = "jackson-annotations";
+        version = "2.9.5";
+        hash = "sha256-OKDkUASfZDVwrayZiIqjSA7C3jhXkKcJaQi/Q7/AhdY=";
+      })
+      (fetchMavenArtifact {
+        groupId = "com.fasterxml.jackson.core";
+        artifactId = "jackson-core";
+        version = "2.9.5";
+        hash = "sha256-or66oyWtJUVbAhScZ+YFI2en1/wc533gAO7ShKUhTqw=";
+      })
+      (fetchMavenArtifact {
+        groupId = "com.fasterxml.jackson.core";
+        artifactId = "jackson-databind";
+        version = "2.9.5";
+        hash = "sha256-D7TgecEY51LMlMFa0i5ngrDfxdwJFF9IE/s52C5oYEc=";
+      })
+    ];
+    javacc = [
+      (fetchMavenArtifact {
+        groupId = "net.java.dev.javacc";
+        artifactId = "javacc";
+        version = "6.1.2";
+        hash = "sha256-7Qxclglhz+tDE4LPAVKCewEVZ0fbN5LRv5PoHjLCBKs=";
+      })
+    ];
+    javassist = [
+      (fetchMavenArtifact {
+        groupId = "org.javassist";
+        artifactId = "javassist";
+        version = "3.21.0-GA";
+        hash = "sha256-eqWeAx+UGYSvB9rMbKhebcm9OkhemqJJTLwDTvoSJdA=";
+      })
+    ];
+    jexl = [
+      (fetchMavenArtifact {
+        groupId = "commons-logging";
+        artifactId = "commons-logging";
+        version = "1.1.1";
+        hash = "sha256-zm+RPK0fDbOq1wGG1lxbx//Mmpnj/o4LE3MSgZ98Ni8=";
+      })
+      (fetchMavenArtifact {
+        groupId = "org.apache.commons";
+        artifactId = "commons-jexl";
+        version = "2.1.1";
+        hash = "sha256-A8mp+uXaeM5SwL8kRnzDc1W34jGW3/SDniwP8BigEwY=";
+      })
+    ];
+    jgrapht = [
+      (fetchMavenArtifact {
+        groupId = "org.jgrapht";
+        artifactId = "jgrapht-core";
+        version = "0.9.1";
+        hash = "sha256-5u8cEVaJ7aCBQrhtUkYg2mQ7bp8BNAUletB/QtxcaXg=";
+      })
+    ];
+    junit = [
+      (fetchMavenArtifact {
+        groupId = "junit";
+        artifactId = "junit";
+        version = "4.11";
+        hash = "sha256-kKjhYD7spI5+h586+8lWBxUyKYXzmidPb2BwtD+dBv4=";
+      })
+    ];
+    kryo = [
+      (fetchMavenArtifact {
+        groupId = "org.ow2.asm";
+        artifactId = "asm";
+        version = "4.0";
+        hash = "sha256-+y3ekCCke7AkxD2d4KlOc6vveTvwjwE1TMl8stLiqVc=";
+      })
+      (fetchMavenArtifact {
+        groupId = "com.esotericsoftware.kryo";
+        artifactId = "kryo";
+        version = "2.21.1";
+        hash = "sha256-adEG73euU3sZBp9WUQNLZBN6Y3UAZXTAxjsuvDuy7q4=";
+      })
+      (fetchMavenArtifact {
+        groupId = "com.esotericsoftware.minlog";
+        artifactId = "minlog";
+        version = "1.2";
+        hash = "sha256-pnjLGqj10D2QHJksdXQYQdmKm8PVXa0C6E1lMVxOYPI=";
+      })
+      (fetchMavenArtifact {
+        groupId = "com.esotericsoftware.reflectasm";
+        artifactId = "reflectasm";
+        version = "1.07";
+        classifier = "shaded";
+        hash = "sha256-CKcOrbSydO2u/BGUwfdXBiGlGwqaoDaqFdzbe5J+fHY=";
+      })
+    ];
+    logback = [
+      (fetchMavenArtifact {
+        groupId = "ch.qos.logback";
+        artifactId = "logback-classic";
+        version = "1.0.13";
+        hash = "sha256-EsGTDKkWU0IqxJ/qM/zovhsfzS0iIM6jg8R5SXbHQY8=";
+      })
+      (fetchMavenArtifact {
+        groupId = "ch.qos.logback";
+        artifactId = "logback-core";
+        version = "1.0.13";
+        hash = "sha256-7NjyT5spQShOmPFU/zND5yDLMcj0e2dVSxRXRfWW87g=";
+      })
+    ];
+    mockito = [
+      (fetchMavenArtifact {
+        groupId = "org.mockito";
+        artifactId = "mockito-core";
+        version = "1.9.5";
+        hash = "sha256-+XSDuglEufoTOqKWOHZN2+rbUew9vAIHTFj6LK7NB/o=";
+      })
+    ];
+    netty = [
+      (fetchMavenArtifact {
+        groupId = "io.netty";
+        artifactId = "netty";
+        version = "3.10.6.Final";
+        hash = "sha256-h2ilD749k6iNjmAA6l1o4w9Q3JFbN2TDxYcPcMT7O0k=";
+      })
+    ];
+    objenesis = [
+      (fetchMavenArtifact {
+        groupId = "org.objenesis";
+        artifactId = "objenesis";
+        version = "1.3";
+        hash = "sha256-3U7z0wkQY6T+xXjLsrvmwfkhwACRuimT3Nmv0l/5REo=";
+      })
+    ];
+    powermock = [
+      (fetchMavenArtifact {
+        groupId = "org.powermock";
+        artifactId = "powermock-mockito-release-full";
+        version = "1.5.4";
+        classifier = "full";
+        hash = "sha256-GWXaFG/ZtPlc7uKrghQHNAPzEu2k5VGYCYTXIlbylb4=";
+      })
+    ];
+    protobuf = [
+      (fetchMavenArtifact {
+        groupId = "com.google.protobuf";
+        artifactId = "protobuf-java";
+        version = "2.5.0";
+        hash = "sha256-4MHGRXXABWAXJefGoCzr+eEoXoiPdWsqHXP/qNclzHQ=";
+      })
+    ];
+    slf4j = [
+      (fetchMavenArtifact {
+        groupId = "org.slf4j";
+        artifactId = "log4j-over-slf4j";
+        version = "1.7.7";
+        hash = "sha256-LjcWxCtsAm/jzd2pK7oaVZsTZjjcexj7qKQSxBiVecI=";
+      })
+      (fetchMavenArtifact {
+        groupId = "org.slf4j";
+        artifactId = "slf4j-api";
+        version = "1.7.7";
+        hash = "sha256-aZgMA4yhsTGSZWFZFhfZwl+r/Hspgor5FZfKhXDPNf4=";
+      })
+    ];
+    suasync = [
+      (fetchMavenArtifact {
+        groupId = "com.stumbleupon";
+        artifactId = "async";
+        version = "1.4.0";
+        hash = "sha256-FJ1HH68JOkjNtkShjLTJ8K4NO/A/qu88ap7J7SEndrM=";
+      })
+    ];
+    validation-api = [
+      (fetchMavenArtifact {
+        groupId = "javax.validation";
+        artifactId = "validation-api";
+        version = "1.0.0.GA";
+        hash = "sha256-5FnzE+vG2ySD+M6q05rwcIY2G0dPqS5A9ELo3l2Yldw=";
+      })
+      (fetchMavenArtifact {
+        groupId = "javax.validation";
+        artifactId = "validation-api";
+        version = "1.0.0.GA";
+        classifier = "sources";
+        hash = "sha256-o5TVKpt/4rsU8HGNKzyDCP/o836RGVYBI5jVXJ+fm1Q=";
+      })
+    ];
+    zookeeper = [
+      (fetchMavenArtifact {
+        groupId = "org.apache.zookeeper";
+        artifactId = "zookeeper";
+        version = "3.4.6";
+        hash = "sha256-ijdaHvmMvA4fbp39DZbZFLdNN60AtL+Bvrd/qPNNM64=";
+      })
+    ];
+  };
+in stdenv.mkDerivation rec {
   pname = "opentsdb";
-  version = "2.4.0";
+  version = "2.4.1";
 
-  src = fetchurl {
-    url = "https://github.com/OpenTSDB/opentsdb/releases/download/v${version}/${pname}-${version}.tar.gz";
-    sha256 = "0b0hilqmgz6n1q7irp17h48v8fjpxhjapgw1py8kyav1d51s7mm2";
+  src = fetchFromGitHub {
+    owner = "OpenTSDB";
+    repo = "opentsdb";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-899m1H0UCLsI/bnSrNFnnny4MxSw3XBzf7rgDuEajDs=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "CVE-2020-35476.patch";
-      url = "https://github.com/OpenTSDB/opentsdb/commit/b89fded4ee326dc064b9d7e471e9f29f7d1dede9.patch";
-      sha256 = "1vb9m0a4fsjqcjagiypvkngzgsw4dil8jrlhn5xbz7rwx8x96wvb";
-    })
+  nativeBuildInputs = [
+    autoconf
+    automake
+    makeWrapper
   ];
 
-  nativeBuildInputs = [ makeWrapper autoconf automake ];
   buildInputs = [ curl jdk nettools python3 git ];
 
   preConfigure = ''
+    chmod +x build-aux/fetchdep.sh.in
     patchShebangs ./build-aux/
     ./bootstrap
   '';
 
+  preBuild = lib.concatStrings (lib.mapAttrsToList (dir: lib.concatMapStrings (artifact: ''
+    ln -s ${artifact}/share/java/* third_party/${dir}
+  '')) artifacts);
+
   postInstall = ''
     wrapProgram $out/bin/tsdb \
       --set JAVA_HOME "${jre}" \
diff --git a/pkgs/tools/misc/steampipe/default.nix b/pkgs/tools/misc/steampipe/default.nix
index 517aae1f7929..3a240fce5e82 100644
--- a/pkgs/tools/misc/steampipe/default.nix
+++ b/pkgs/tools/misc/steampipe/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "steampipe";
-  version = "0.18.2";
+  version = "0.18.3";
 
   src = fetchFromGitHub {
     owner = "turbot";
     repo = "steampipe";
     rev = "v${version}";
-    sha256 = "sha256-n/5+IVhTaME4x0KFTueo4SSBkAvXgin1VJHNEe2JnPI=";
+    sha256 = "sha256-FHZMnq/7y450dME5+CfF8Nkv7jEZyVkMYBXPcinFVvM=";
   };
 
   vendorHash = "sha256-W30f7QYgm+QyLDJICpjMn7mtUIziTR1igThEbv+Aa7M=";
diff --git a/pkgs/tools/misc/topgrade/default.nix b/pkgs/tools/misc/topgrade/default.nix
index aaaa297a5598..f3094302cd68 100644
--- a/pkgs/tools/misc/topgrade/default.nix
+++ b/pkgs/tools/misc/topgrade/default.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "topgrade";
-  version = "10.3.0";
+  version = "10.3.1";
 
   src = fetchFromGitHub {
     owner = "topgrade-rs";
     repo = "topgrade";
     rev = "v${version}";
-    hash = "sha256-BKrErM1d90o+yJ/R0vVgXDBwPgQSP3Qj26x4JmB7SXw=";
+    hash = "sha256-sOXp/oo29oVdmn3qEb7HCSlYYOvbTpD21dX4JSYaqps=";
   };
 
-  cargoHash = "sha256-jm97lfWHTtd3tE+Yql9CIss78B+bW9nUQAhs5anDb6c=";
+  cargoHash = "sha256-fZjMTVn4gx1hvtiD5NRkXY2f9HNSv7Vx3HdHypne5U0=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/tools/networking/dnsmonster/default.nix b/pkgs/tools/networking/dnsmonster/default.nix
index 919469065c0b..f36fa1d2d98f 100644
--- a/pkgs/tools/networking/dnsmonster/default.nix
+++ b/pkgs/tools/networking/dnsmonster/default.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "dnsmonster";
-  version = "0.9.7";
+  version = "0.9.9";
 
   src = fetchFromGitHub {
     owner = "mosajjal";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-fpyx2/2P2tMx/n5pCZkUie3uU9jarRU2QVMBs8jEc6Q=";
+    hash = "sha256-2k/WyAM8h2P2gCLt2J9m/ZekrzCyf/LULGOQYy5bsZs=";
   };
 
-  vendorSha256 = "sha256-kZkzTi3i8J6K8x+nSjGeyzEBRPeDEP6qX5KMv/weAXg=";
+  vendorHash = "sha256-gAjR1MoudBAx1dxGObIVPqJdfehWkKckKtwM7sTP0w4=";
 
   buildInputs = [
     libpcap
diff --git a/pkgs/tools/networking/minio-client/default.nix b/pkgs/tools/networking/minio-client/default.nix
index 4f312d0e6ad0..47f106e5f2a7 100644
--- a/pkgs/tools/networking/minio-client/default.nix
+++ b/pkgs/tools/networking/minio-client/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "minio-client";
-  version = "2023-01-11T03-14-16Z";
+  version = "2023-01-28T20-29-38Z";
 
   src = fetchFromGitHub {
     owner = "minio";
     repo = "mc";
     rev = "RELEASE.${version}";
-    sha256 = "sha256-wxI4m4RAvi2YCx+RWO9HQyn927O3PUJ/A9i/5IOtbZ8=";
+    sha256 = "sha256-xlhAPJvZcd4tkaIK+xflUXcFKMbQQX8QgCSD7CTiPu8=";
   };
 
-  vendorHash = "sha256-Exhw9H+qayQnpT4qCaeOsmbTCmCy80UKk8ZxDuOOHcA=";
+  vendorHash = "sha256-fSHgwllxk10ipacOmtXXqFupEp3kuG25KIRklwmtIMU=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/tools/networking/n2n/default.nix b/pkgs/tools/networking/n2n/default.nix
index 77c7d4161d1f..08028910f82a 100644
--- a/pkgs/tools/networking/n2n/default.nix
+++ b/pkgs/tools/networking/n2n/default.nix
@@ -27,6 +27,6 @@ stdenv.mkDerivation rec {
     description = "Peer-to-peer VPN";
     homepage = "https://www.ntop.org/products/n2n/";
     license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ malvo ];
+    maintainers = with maintainers; [ malte-v ];
   };
 }
diff --git a/pkgs/tools/networking/openapi-generator-cli/default.nix b/pkgs/tools/networking/openapi-generator-cli/default.nix
index 339b2aecbaa5..69ab1b35c141 100644
--- a/pkgs/tools/networking/openapi-generator-cli/default.nix
+++ b/pkgs/tools/networking/openapi-generator-cli/default.nix
@@ -1,7 +1,7 @@
 { callPackage, lib, stdenv, fetchurl, jre, makeWrapper }:
 
 let this = stdenv.mkDerivation rec {
-  version = "6.2.1";
+  version = "6.3.0";
   pname = "openapi-generator-cli";
 
   jarfilename = "${pname}-${version}.jar";
@@ -12,7 +12,7 @@ let this = stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://maven/org/openapitools/${pname}/${version}/${jarfilename}";
-    sha256 = "sha256-8shgDywj7hEj7r9H7w9A2zhmJ+dbA0DKFhgsEPQXT6k=";
+    sha256 = "sha256-1xTXvuxQCksCT+pj4+eHyb8fAc4YcK9Tn3xIijB7P1s=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/tools/networking/pritunl-client/default.nix b/pkgs/tools/networking/pritunl-client/default.nix
index 0764c274084a..a5ecaa79e905 100644
--- a/pkgs/tools/networking/pritunl-client/default.nix
+++ b/pkgs/tools/networking/pritunl-client/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "pritunl-client";
-  version = "1.3.3420.31";
+  version = "1.3.3430.77";
 
   src = fetchFromGitHub {
     owner = "pritunl";
     repo = "pritunl-client-electron";
     rev = version;
-    sha256 = "sha256-FKLYpn2HeAVGN9OjLowv2BJRLZKReqXLPFvbin/jaBo=";
+    sha256 = "sha256-tB6BAtLIlsU7mQmJ/Ec94X2r0mmGJlefc2NkyDhQ2Ek=";
   };
 
   modRoot = "cli";
diff --git a/pkgs/tools/package-management/nfpm/default.nix b/pkgs/tools/package-management/nfpm/default.nix
index b42144762b34..2d028a0e631e 100644
--- a/pkgs/tools/package-management/nfpm/default.nix
+++ b/pkgs/tools/package-management/nfpm/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "nfpm";
-  version = "2.24.0";
+  version = "2.25.0";
 
   src = fetchFromGitHub {
     owner = "goreleaser";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-ZbKkyRCzfnX8TPBeUYZk2b5M//g1cyiksUMBg0z7nlQ=";
+    sha256 = "sha256-Mu0/mWkdrhaybI0iAB/MuD7UTbDDC73ZMxr8kU7R23I=";
   };
 
-  vendorHash = "sha256-TrJtuFzreIjq7fCw/XT1jniw9Ey9k6xmXotby6A651g=";
+  vendorHash = "sha256-YDV816jTLAqbSjiKXvbkwPbPCLPplH+NFN1SCVjWcbk=";
 
   ldflags = [ "-s" "-w" "-X main.version=${version}" ];
 
diff --git a/pkgs/tools/package-management/xbps/default.nix b/pkgs/tools/package-management/xbps/default.nix
index 46aaf4a94d66..eb71b5147809 100644
--- a/pkgs/tools/package-management/xbps/default.nix
+++ b/pkgs/tools/package-management/xbps/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, pkg-config, which, zlib, openssl, libarchive }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, pkg-config, which, zlib, openssl, libarchive }:
 
 stdenv.mkDerivation rec {
   pname = "xbps";
@@ -15,9 +15,16 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ zlib openssl libarchive ];
 
-  patches = [ ./cert-paths.patch ];
+  patches = [
+    ./cert-paths.patch
+    # fix openssl 3
+    (fetchpatch {
+      url = "https://github.com/void-linux/xbps/commit/db1766986c4389eb7e17c0e0076971b711617ef9.patch";
+      hash = "sha256-CmyZdsHStPsELdEgeJBWIbXIuVeBhv7VYb2uGYxzUWQ=";
+    })
+  ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=unused-result";
+  NIX_CFLAGS_COMPILE = "-Wno-error=unused-result -Wno-error=deprecated-declarations";
 
   postPatch = ''
     # fix unprefixed ranlib (needed on cross)
diff --git a/pkgs/tools/security/arti/default.nix b/pkgs/tools/security/arti/default.nix
index 103c8aceed82..8180f9013df8 100644
--- a/pkgs/tools/security/arti/default.nix
+++ b/pkgs/tools/security/arti/default.nix
@@ -10,7 +10,7 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "arti";
-  version = "1.1.0";
+  version = "1.1.1";
 
   src = fetchFromGitLab {
     domain = "gitlab.torproject.org";
@@ -18,10 +18,10 @@ rustPlatform.buildRustPackage rec {
     owner = "core";
     repo = "arti";
     rev = "arti-v${version}";
-    sha256 = "sha256-fvRSx/I4SM9xWhooPPKFuRLSCYOxE+scqi6jRsGFOXo=";
+    sha256 = "sha256-A5enH7JqnLZ9Tte+FMpMVqq1g1JveYJbzH1Qum5In5E=";
   };
 
-  cargoSha256 = "sha256-5wXeFomQs/aEbImmlyUzmYyDRXFp3qZSFOzk0g7pNEo=";
+  cargoHash = "sha256-LVc7CgRS57p7TUaTo8L94YArYC7eI0wegzNMcTiJrEg=";
 
   nativeBuildInputs = lib.optionals stdenv.isLinux [ pkg-config ];
 
diff --git a/pkgs/tools/security/certipy/default.nix b/pkgs/tools/security/certipy/default.nix
index 8bf3e6983b6d..589e1f97e64b 100644
--- a/pkgs/tools/security/certipy/default.nix
+++ b/pkgs/tools/security/certipy/default.nix
@@ -5,13 +5,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "certipy";
-  version = "2.0.9";
+  version = "4.3.0";
+  format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "ly4k";
     repo = "Certipy";
-    rev = version;
-    hash = "sha256-84nGRKZ0UlMDAZ1Wo5Hgy9XSAyEh0Tio9+3OZVFZG5k=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-vwlWAbA4ExYAPRInhEsjRCNuL2wqMhAmYKO78Vi4OGo=";
   };
 
   propagatedBuildInputs = with python3.pkgs; [
@@ -22,6 +23,7 @@ python3.pkgs.buildPythonApplication rec {
     ldap3
     pyasn1
     pycryptodome
+    requests_ntlm
   ];
 
   # Project has no tests
@@ -34,6 +36,7 @@ python3.pkgs.buildPythonApplication rec {
   meta = with lib; {
     description = "Tool to enumerate and abuse misconfigurations in Active Directory Certificate Services";
     homepage = "https://github.com/ly4k/Certipy";
+    changelog = "https://github.com/ly4k/Certipy/releases/tag/${version}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/tools/security/doppler/default.nix b/pkgs/tools/security/doppler/default.nix
index 3330d20ac32f..e61649c767ad 100644
--- a/pkgs/tools/security/doppler/default.nix
+++ b/pkgs/tools/security/doppler/default.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "doppler";
-  version = "3.53.1";
+  version = "3.54.0";
 
   src = fetchFromGitHub {
     owner = "dopplerhq";
     repo = "cli";
     rev = version;
-    sha256 = "sha256-ZgXUnHYaWRBjAW/k74o93SIJJbcI3zlw5GmwXE6Ri8U=";
+    sha256 = "sha256-R+mvifWHyUL8qBCKKFcn4x9eDoPi4qRuGPnoRS4QlQY=";
   };
 
   vendorHash = "sha256-TwcEH+LD0E/JcptMCYb3UycO3HhZX3igzSlBW4hS784=";
diff --git a/pkgs/tools/security/gotrue/supabase.nix b/pkgs/tools/security/gotrue/supabase.nix
index b02c6a896c39..46d296453f7d 100644
--- a/pkgs/tools/security/gotrue/supabase.nix
+++ b/pkgs/tools/security/gotrue/supabase.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "gotrue";
-  version = "2.42.2";
+  version = "2.44.0";
 
   src = fetchFromGitHub {
     owner = "supabase";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-nMSvc90oZsAbDGktvSBMWZNEAGzz/INLK5K6hawteew=";
+    hash = "sha256-LSA6h6hs5M80urBasVDWZSCNA3fWxjYjvbPRbHLOX0Y=";
   };
 
-  vendorHash = "sha256-3dXfg9tblPx9V5LzzVm3UtCwGcPIAm2MaKm9JQi69mU=";
+  vendorHash = "sha256-FIl30sKmdcXayK8KWGFl+N+lYExl4ibKZ2tcvelw8zo=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/tools/security/gpg-tui/default.nix b/pkgs/tools/security/gpg-tui/default.nix
index 4ab4d468d068..486ee7ba654a 100644
--- a/pkgs/tools/security/gpg-tui/default.nix
+++ b/pkgs/tools/security/gpg-tui/default.nix
@@ -6,6 +6,7 @@
 , libgpg-error
 , libxcb
 , libxkbcommon
+, pkg-config
 , python3
 , AppKit
 , Foundation
@@ -16,20 +17,21 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "gpg-tui";
-  version = "0.9.1";
+  version = "0.9.3";
 
   src = fetchFromGitHub {
     owner = "orhun";
     repo = "gpg-tui";
     rev = "v${version}";
-    hash = "sha256-eUUHH6bPfYjkHo7C7GWzewTpT8je7TQK9M8mTM5v59s=";
+    hash = "sha256-4Xi4ePFJL56HxCkbTlu4WiCTRzLEqvfbEk/2q9QjAd8=";
   };
 
-  cargoHash = "sha256-GtSvDfG9lRUirm4d6PSaOBLTHZJT2PH0Sx/9GVquX5M=";
+  cargoHash = "sha256-MEj7c87msMv/+D70EDWmWEHTtmQcx5DEMf2I/AXnwm8=";
 
   nativeBuildInputs = [
     gpgme # for gpgme-config
     libgpg-error # for gpg-error-config
+    pkg-config
     python3
   ];
 
diff --git a/pkgs/tools/system/s0ix-selftest-tool/default.nix b/pkgs/tools/system/s0ix-selftest-tool/default.nix
new file mode 100644
index 000000000000..193fbb0aef5f
--- /dev/null
+++ b/pkgs/tools/system/s0ix-selftest-tool/default.nix
@@ -0,0 +1,81 @@
+{
+  acpica-tools,
+  bash,
+  bc,
+  coreutils,
+  fetchFromGitHub,
+  gawk,
+  gnugrep,
+  gnused,
+  linuxPackages,
+  lib,
+  pciutils,
+  powertop,
+  resholve,
+  stdenv,
+  util-linux,
+  xorg,
+  xxd,
+}:
+resholve.mkDerivation {
+  pname = "s0ix-selftest-tool";
+  version = "unstable-2022-11-04";
+
+  src = fetchFromGitHub {
+    owner = "intel";
+    repo = "S0ixSelftestTool";
+    rev = "1b6db3c3470a3a74b052cb728a544199661d18ec";
+    hash = "sha256-w97jfdppW8kC8K8XvBntmkfntIctXDQCWmvug+H1hKA=";
+  };
+
+  # don't use the bundled turbostat binary
+  postPatch = ''
+    substituteInPlace s0ix-selftest-tool.sh --replace '"$DIR"/turbostat' 'turbostat'
+    substituteInPlace s0ix-selftest-tool.sh --replace 'sudo ' ""
+
+  '';
+
+  dontConfigure = true;
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm555 s0ix-selftest-tool.sh "$out/bin/s0ix-selftest-tool"
+    runHook postInstall
+  '';
+
+  solutions = {
+    default = {
+      scripts = ["bin/s0ix-selftest-tool"];
+      interpreter = lib.getExe bash;
+      inputs = [
+        acpica-tools
+        bc
+        coreutils
+        gawk
+        gnugrep
+        gnused
+        linuxPackages.turbostat
+        pciutils
+        powertop
+        util-linux
+        xorg.xset
+        xxd
+      ];
+      execer = [
+        "cannot:${util-linux}/bin/dmesg"
+        "cannot:${powertop}/bin/powertop"
+        "cannot:${util-linux}/bin/rtcwake"
+        "cannot:${linuxPackages.turbostat}/bin/turbostat"
+      ];
+    };
+  };
+
+  meta = with lib; {
+    homepage = "https://github.com/intel/S0ixSelftestTool";
+    description = "A tool for testing the S2idle path CPU Package C-state and S0ix failures";
+    license = licenses.gpl2Only;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [adamcstephens];
+  };
+}
diff --git a/pkgs/tools/text/difftastic/default.nix b/pkgs/tools/text/difftastic/default.nix
index 40ddc9263e8c..a8e8aa1a851d 100644
--- a/pkgs/tools/text/difftastic/default.nix
+++ b/pkgs/tools/text/difftastic/default.nix
@@ -8,13 +8,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "difftastic";
-  version = "0.43.0";
+  version = "0.43.1";
 
   src = fetchFromGitHub {
     owner = "wilfred";
     repo = pname;
     rev = version;
-    sha256 = "sha256-YL2rKsP5FSoG1gIyxQtt9kovBAyu8Flko5RxXRQy5mQ=";
+    sha256 = "sha256-UI63OJukot+MH+51h/yLnimJAcy8OFan9sUbuZaJZXc=";
   };
 
   depsExtraArgs = {
@@ -39,13 +39,7 @@ rustPlatform.buildRustPackage rec {
       popd
     '';
   };
-  cargoSha256 = "sha256-SUNBnJP8B/HvlozcCbehL1A2/WudYE20DIPc7/fYF/k=";
-
-  checkFlags = [
-    # test is broken
-    # https://github.com/Wilfred/difftastic/issues/479
-    "--skip=files::tests::test_gzip_is_binary"
-  ];
+  cargoSha256 = "sha256-IfwZ800PGbmzxQ0e6okieKR7A8jgt+II2j8FRDkiXfw=";
 
   passthru.tests.version = testers.testVersion { package = difftastic; };
 
diff --git a/pkgs/tools/text/mdbook-kroki-preprocessor/default.nix b/pkgs/tools/text/mdbook-kroki-preprocessor/default.nix
new file mode 100644
index 000000000000..c8bc79c2a6fc
--- /dev/null
+++ b/pkgs/tools/text/mdbook-kroki-preprocessor/default.nix
@@ -0,0 +1,40 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, pkg-config
+, openssl
+, stdenv
+, darwin
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "mdbook-kroki-preprocessor";
+  version = "0.1.2";
+
+  src = fetchFromGitHub {
+    owner = "joelcourtney";
+    repo = "mdbook-kroki-preprocessor";
+    rev = "v${version}";
+    hash = "sha256-1TJuUzfyMycWlOQH67LR63/ll2GDZz25I3JfScy/Jnw=";
+  };
+
+  cargoHash = "sha256-IKwDWymAQ1OMQN8Op+DcvqPikoLdOz6lltbhCgOAles=";
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    openssl
+  ] ++ lib.optionals stdenv.isDarwin [
+    darwin.apple_sdk.frameworks.CoreFoundation
+    darwin.apple_sdk.frameworks.Security
+  ];
+
+  meta = with lib; {
+    description = "Render Kroki diagrams from files or code blocks in mdbook";
+    homepage = "https://github.com/joelcourtney/mdbook-kroki-preprocessor";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ blaggacao ];
+  };
+}
diff --git a/pkgs/tools/virtualization/google-guest-agent/default.nix b/pkgs/tools/virtualization/google-guest-agent/default.nix
index 7d0da22221b0..af2258b1a206 100644
--- a/pkgs/tools/virtualization/google-guest-agent/default.nix
+++ b/pkgs/tools/virtualization/google-guest-agent/default.nix
@@ -4,13 +4,13 @@
 
 buildGoModule rec {
   pname = "guest-agent";
-  version = "20230112.00";
+  version = "20230202.00";
 
   src = fetchFromGitHub {
     owner = "GoogleCloudPlatform";
     repo = pname;
     rev = version;
-    sha256 = "sha256-uM71qepYnmE4pK+Bdx5l78upNyp2+Myo3ayOAAlRF9s=";
+    sha256 = "sha256-kPPf6KVQmxF4vUQOIGprevn7RDIjKdbUsYhKGPEearA=";
   };
 
   vendorHash = "sha256-ioejOtmsi0QnID3V5JxwAz399I5Jp5nHZqpzU9DjpQE=";
diff --git a/pkgs/tools/virtualization/google-guest-oslogin/default.nix b/pkgs/tools/virtualization/google-guest-oslogin/default.nix
index fe05078ba3e4..3fb56c6d0317 100644
--- a/pkgs/tools/virtualization/google-guest-oslogin/default.nix
+++ b/pkgs/tools/virtualization/google-guest-oslogin/default.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "google-guest-oslogin";
-  version = "20220721.00";
+  version = "20230202.00";
 
   src = fetchFromGitHub {
     owner = "GoogleCloudPlatform";
     repo = "guest-oslogin";
     rev = version;
-    sha256 = "sha256-VIbejaHN9ANk+9vjpGAYS/SjHx4Tf7SkTqRD1svJRPU=";
+    sha256 = "sha256-5+8AMm97+GJJYmzKaJ98AtDBwpVXj88d3B8KwZgMpSg=";
   };
 
   postPatch = ''
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 5da0e450a5db..34487e55c757 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -126,6 +126,7 @@ mapAliases ({
   bazel_1 = throw "bazel 1 is past end of life as it is not an lts version"; # Added 2022-05-09
   bazel_3 = throw "bazel 3 is past end of life as it is not an lts version"; # Added 2023-02-02
   bcat = throw "bcat has been removed because upstream is dead"; # Added 2021-08-22
+  bedup = throw "bedup was removed because it was broken and abandoned upstream"; # added 2023-02-04
   beetsExternalPlugins = throw "beetsExternalPlugins has been deprecated, use beetsPackages.$pluginname"; # Added 2022-05-07
   beret = throw "beret has been removed"; # Added 2021-11-16
   bin_replace_string = throw "bin_replace_string has been removed: deleted by upstream"; # Added 2022-01-07
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 9af1b242c433..baff194c4e24 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1527,6 +1527,8 @@ with pkgs;
 
   redfang = callPackage ../tools/networking/redfang { };
 
+  s0ix-selftest-tool = callPackage ../tools/system/s0ix-selftest-tool { };
+
   scarab = callPackage ../tools/games/scarab { };
 
   sdbus-cpp = callPackage ../development/libraries/sdbus-cpp { };
@@ -9043,6 +9045,8 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) CoreServices;
   };
 
+  mdbook-kroki-preprocessor = callPackage ../tools/text/mdbook-kroki-preprocessor { };
+
   mdbook-linkcheck = callPackage ../tools/text/mdbook-linkcheck {
     inherit (darwin.apple_sdk.frameworks) Security;
   };
@@ -10037,7 +10041,7 @@ with pkgs;
   grocy = callPackage ../servers/grocy { };
 
   inherit (callPackage ../servers/nextcloud {})
-    nextcloud23 nextcloud24 nextcloud25 nextcloud26;
+    nextcloud23 nextcloud24 nextcloud25;
 
   nextcloud23Packages = ( callPackage ../servers/nextcloud/packages {
     apps = lib.importJSON ../servers/nextcloud/packages/23.json;
@@ -10048,9 +10052,6 @@ with pkgs;
   nextcloud25Packages = ( callPackage ../servers/nextcloud/packages {
     apps = lib.importJSON ../servers/nextcloud/packages/25.json;
   });
-  nextcloud26Packages = ( callPackage ../servers/nextcloud/packages {
-    apps = lib.importJSON ../servers/nextcloud/packages/26.json;
-  });
 
   nextcloud-client = libsForQt5.callPackage ../applications/networking/nextcloud-client { };
 
@@ -12260,6 +12261,8 @@ with pkgs;
 
   swapview = callPackage ../os-specific/linux/swapview { };
 
+  swc = callPackage ../development/tools/swc { };
+
   swtpm = callPackage ../tools/security/swtpm { };
 
   svnfs = callPackage ../tools/filesystems/svnfs { };
@@ -18514,6 +18517,8 @@ with pkgs;
 
   speedtest-cli = with python3Packages; toPythonApplication speedtest-cli;
 
+  spicy-parser-generator = callPackage ../development/tools/parsing/spicy { };
+
   spin = callPackage ../development/tools/analysis/spin { };
 
   spirv-headers = callPackage ../development/libraries/spirv-headers { };
@@ -20410,6 +20415,8 @@ with pkgs;
 
   iniparser = callPackage ../development/libraries/iniparser { };
 
+  initool = callPackage ../development/tools/initool { };
+
   intel-gmmlib = callPackage ../development/libraries/intel-gmmlib { };
 
   intel-media-driver = callPackage ../development/libraries/intel-media-driver { };
@@ -22011,6 +22018,8 @@ with pkgs;
 
   opencl-clang = callPackage ../development/libraries/opencl-clang { };
 
+  magic-enum = callPackage ../development/libraries/magic-enum { };
+
   mapnik = callPackage ../development/libraries/mapnik {
     harfbuzz = harfbuzz.override {
       withIcu = true;
@@ -25546,8 +25555,6 @@ with pkgs;
 
   bluez = bluez5;
 
-  inherit (python3Packages) bedup;
-
   bolt = callPackage ../os-specific/linux/bolt { };
 
   bpf-linker = callPackage ../development/tools/bpf-linker { };
@@ -26886,6 +26893,8 @@ with pkgs;
 
   blackbird = callPackage ../data/themes/blackbird { };
 
+  blackout = callPackage ../data/fonts/blackout { };
+
   brise = callPackage ../data/misc/brise { };
 
   cacert = callPackage ../data/misc/cacert { };
@@ -26916,6 +26925,8 @@ with pkgs;
 
   chonburi-font = callPackage ../data/fonts/chonburi { };
 
+  chunk = callPackage ../data/fonts/chunk { };
+
   cldr-annotations = callPackage ../data/misc/cldr-annotations { };
 
   clearlooks-phenix = callPackage ../data/themes/clearlooks-phenix { };
@@ -27075,6 +27086,8 @@ with pkgs;
 
   fantasque-sans-mono = callPackage ../data/fonts/fantasque-sans-mono {};
 
+  fanwood = callPackage ../data/fonts/fanwood { };
+
   fira = callPackage ../data/fonts/fira { };
 
   fira-code = callPackage ../data/fonts/fira-code { };
@@ -27127,6 +27140,8 @@ with pkgs;
 
   go-font = callPackage ../data/fonts/go-font { };
 
+  goudy-bookletter-1911 = callPackage ../data/fonts/goudy-bookletter-1911 { };
+
   graphite-gtk-theme = callPackage ../data/themes/graphite-gtk-theme { };
 
   graphite-kde-theme = callPackage ../data/themes/graphite-kde-theme { };
@@ -27218,6 +27233,8 @@ with pkgs;
 
   joypixels = callPackage ../data/fonts/joypixels { };
 
+  junction-font = callPackage ../data/fonts/junction { };
+
   junicode = callPackage ../data/fonts/junicode { };
 
   julia-mono = callPackage ../data/fonts/julia-mono { };
@@ -27236,6 +27253,8 @@ with pkgs;
 
   khmeros = callPackage ../data/fonts/khmeros {};
 
+  knewave = callPackage ../data/fonts/knewave { };
+
   kochi-substitute = callPackage ../data/fonts/kochi-substitute {};
 
   kochi-substitute-naga10 = callPackage ../data/fonts/kochi-substitute-naga10 {};
@@ -27264,8 +27283,14 @@ with pkgs;
 
   lato = callPackage ../data/fonts/lato {};
 
+  league-gothic = callPackage ../data/fonts/league-gothic { };
+
   league-of-moveable-type = callPackage ../data/fonts/league-of-moveable-type {};
 
+  league-script-number-one = callPackage ../data/fonts/league-script-number-one { };
+
+  league-spartan = callPackage ../data/fonts/league-spartan { };
+
   ledger-udev-rules = callPackage ../os-specific/linux/ledger-udev-rules {};
 
   inherit (callPackages ../data/fonts/liberation-fonts { })
@@ -27300,6 +27325,8 @@ with pkgs;
 
   lightly-qt = libsForQt5.callPackage ../data/themes/lightly-qt { };
 
+  linden-hill = callPackage ../data/fonts/linden-hill { };
+
   line-awesome = callPackage ../data/fonts/line-awesome { };
 
   linja-pi-pu-lukin = callPackage ../data/fonts/linja-pi-pu-lukin {};
@@ -27513,6 +27540,8 @@ with pkgs;
 
   orion = callPackage ../data/themes/orion {};
 
+  ostrich-sans = callPackage ../data/fonts/ostrich-sans { };
+
   overpass = callPackage ../data/fonts/overpass { };
 
   oxygenfonts = callPackage ../data/fonts/oxygenfonts { };
@@ -27581,6 +27610,8 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) Security;
   };
 
+  prociono = callPackage ../data/fonts/prociono { };
+
   profont = callPackage ../data/fonts/profont { };
 
   proggyfonts = callPackage ../data/fonts/proggyfonts { };
@@ -27660,10 +27691,14 @@ with pkgs;
 
   snap7 = callPackage ../development/libraries/snap7 {};
 
+  sniglet = callPackage ../data/fonts/sniglet { };
+
   snowblind = callPackage ../data/themes/snowblind { };
 
   solarc-gtk-theme = callPackage ../data/themes/solarc { };
 
+  sorts-mill-goudy = callPackage ../data/fonts/sorts-mill-goudy { };
+
   soundfont-fluid = callPackage ../data/soundfonts/fluid { };
 
   soundfont-generaluser = callPackage ../data/soundfonts/generaluser { };
@@ -27783,6 +27818,8 @@ with pkgs;
 
   theano = callPackage ../data/fonts/theano { };
 
+  the-neue-black = callPackage ../data/fonts/the-neue-black { };
+
   tela-circle-icon-theme = callPackage ../data/icons/tela-circle-icon-theme {
     inherit (gnome) adwaita-icon-theme;
   };
@@ -30518,8 +30555,6 @@ with pkgs;
 
   kail = callPackage ../tools/networking/kail {  };
 
-  kanboard = callPackage ../applications/misc/kanboard { };
-
   kapitonov-plugins-pack = callPackage ../applications/audio/kapitonov-plugins-pack { };
 
   kapow = libsForQt5.callPackage ../applications/misc/kapow { };
@@ -31211,7 +31246,7 @@ with pkgs;
 
   xmrig-mo = callPackage ../applications/misc/xmrig/moneroocean.nix { };
 
-  xmrig-proxy = callPackage ../applications/misc/xmrig/proxy.nix { };
+  xmrig-proxy = darwin.apple_sdk_11_0.callPackage ../applications/misc/xmrig/proxy.nix { };
 
   molot-lite = callPackage ../applications/audio/molot-lite { };
 
@@ -31751,7 +31786,9 @@ with pkgs;
 
   netcoredbg = callPackage ../development/tools/misc/netcoredbg { };
 
-  ncdu = callPackage ../tools/misc/ncdu { };
+  ncdu = callPackage ../tools/misc/ncdu {
+    zig = zig_0_10;
+  };
 
   ncdu_1 = callPackage ../tools/misc/ncdu/1.nix { };
 
@@ -38461,9 +38498,7 @@ with pkgs;
 
   xorex = callPackage ../tools/security/xorex { };
 
-  xbps = callPackage ../tools/package-management/xbps {
-    openssl = openssl_1_1;
-  };
+  xbps = callPackage ../tools/package-management/xbps { };
 
   xcftools = callPackage ../tools/graphics/xcftools { };
 
@@ -38683,8 +38718,9 @@ with pkgs;
 
   openring = callPackage ../applications/misc/openring { };
 
-  openvino = callPackage ../development/libraries/openvino
-    { stdenv = gcc10StdenvCompat; python = python3; };
+  openvino = callPackage ../development/libraries/openvino {
+    python = python3;
+  };
 
   phonetisaurus = callPackage ../development/libraries/phonetisaurus {
     # https://github.com/AdolfVonKleist/Phonetisaurus/issues/70
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 9a09ae6663f2..04da6d141ee9 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -41,6 +41,7 @@ mapAliases ({
   asyncio-nats-client = nats-py; # added 2022-02-08
   awkward0 = throw "awkward0 has been removed, use awkward instead"; # added 2022-12-13
   Babel = babel; # added 2022-05-06
+  bedup = throw "bedup was removed because it was broken and abandoned upstream"; # added 2023-02-04
   bitcoin-price-api = throw "bitcoin-price-api has been removed, it was using setuptools 2to3 translation feautre, which has been removed in setuptools 58"; # added 2022-02-15
   blockdiagcontrib-cisco = throw "blockdiagcontrib-cisco is not compatible with blockdiag 2.0.0 and has been removed."; # added 2020-11-29
   bsblan = python-bsblan; # added 2022-11-04
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 09b0caa6397b..2464a4d153b4 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1075,8 +1075,6 @@ self: super: with self; {
 
   azure-storage-blob = callPackage ../development/python-modules/azure-storage-blob { };
 
-  azure-storage = callPackage ../development/python-modules/azure-storage { };
-
   azure-storage-common = callPackage ../development/python-modules/azure-storage-common { };
 
   azure-storage-file = callPackage ../development/python-modules/azure-storage-file { };
@@ -1216,8 +1214,6 @@ self: super: with self; {
 
   bech32 = callPackage ../development/python-modules/bech32 { };
 
-  bedup = callPackage ../development/python-modules/bedup { };
-
   behave = callPackage ../development/python-modules/behave { };
 
   bellows = callPackage ../development/python-modules/bellows { };
@@ -6696,10 +6692,11 @@ self: super: with self; {
 
   opentracing = callPackage ../development/python-modules/opentracing { };
 
-  openvino = toPythonModule (pkgs.openvino.override {
-    inherit (self) python;
-    enablePython = true;
-  });
+  openvino = callPackage ../development/python-modules/openvino {
+    openvino-native = pkgs.openvino.override {
+      inherit python;
+    };
+  };
 
   openwebifpy = callPackage ../development/python-modules/openwebifpy { };
 
@@ -12590,7 +12587,7 @@ self: super: with self; {
 
   zdaemon = callPackage ../development/python-modules/zdaemon { };
 
-  zeek = (toPythonModule (pkgs.zeek.override {
+  zeek = (toPythonModule (pkgs.zeek.broker.override {
     python3 = python;
   })).py;