diff --git a/pkgs/applications/audio/reaper/default.nix b/pkgs/applications/audio/reaper/default.nix
index 6b09e086fa3d..6858d6b1bd7d 100644
--- a/pkgs/applications/audio/reaper/default.nix
+++ b/pkgs/applications/audio/reaper/default.nix
@@ -9,6 +9,7 @@
 , ffmpeg
 , vlc
 , xdg-utils
+, xdotool
 , which
 
 , jackSupport ? true
@@ -69,7 +70,7 @@ stdenv.mkDerivation rec {
     # seem to have an effect for some plugins.
     # We opt for wrapping the executable with LD_LIBRARY_PATH prefix.
     wrapProgram $out/opt/REAPER/reaper \
-      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ lame ffmpeg vlc ]}"
+      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ lame ffmpeg vlc xdotool ]}"
 
     mkdir $out/bin
     ln -s $out/opt/REAPER/reaper $out/bin/
diff --git a/pkgs/applications/terminal-emulators/xterm/default.nix b/pkgs/applications/terminal-emulators/xterm/default.nix
index ff0856734628..24a698ba8035 100644
--- a/pkgs/applications/terminal-emulators/xterm/default.nix
+++ b/pkgs/applications/terminal-emulators/xterm/default.nix
@@ -1,17 +1,17 @@
 { lib, stdenv, fetchurl, fetchpatch, xorg, ncurses, freetype, fontconfig
-, pkg-config, makeWrapper, nixosTests, writeScript, common-updater-scripts, git
+, pkg-config, makeWrapper, nixosTests, gitUpdater
 , nixfmt, nix, gnused, coreutils, enableDecLocator ? true }:
 
 stdenv.mkDerivation rec {
   pname = "xterm";
-  version = "375";
+  version = "377";
 
   src = fetchurl {
     urls = [
       "ftp://ftp.invisible-island.net/xterm/${pname}-${version}.tgz"
       "https://invisible-mirror.net/archives/xterm/${pname}-${version}.tgz"
     ];
-    sha256 = "sha256-MCxZor+B55xqcBUl13gWGiGNEjnyFWjYnivdMcAVIX8=";
+    hash = "sha256-2xCP56Rdjtl+YEchtYRDtHNknmHiY2Mb+HWfhhipkLI=";
   };
 
   strictDeps = true;
@@ -81,37 +81,13 @@ stdenv.mkDerivation rec {
       standardTest = nixosTests.terminal-emulators.xterm;
     };
 
-    updateScript = let
+    updateScript = gitUpdater {
+      # No nicer place to find latest release.
+      url = "https://github.com/ThomasDickey/xterm-snapshots.git";
+      rev-prefix = "xterm-";
       # Tags that end in letters are unstable
-      suffixes = lib.concatStringsSep " "
-        (map (c: "-c versionsort.suffix='${c}'")
-          (lib.stringToCharacters "abcdefghijklmnopqrstuvwxyz"));
-    in writeScript "update.sh" ''
-      #!${stdenv.shell}
-      set -o errexit
-      PATH=${
-        lib.makeBinPath [
-          common-updater-scripts
-          git
-          nixfmt
-          nix
-          coreutils
-          gnused
-        ]
-      }
-
-      oldVersion="$(nix-instantiate --eval -E "with import ./. {}; lib.getVersion ${pname}" | tr -d '"')"
-      latestTag="$(git ${suffixes} ls-remote --exit-code --refs --sort='version:refname' --tags git@github.com:ThomasDickey/xterm-snapshots.git 'xterm-*' | tail --lines=1 | cut --delimiter='/' --fields=3 | sed 's|^xterm-||g')"
-
-      if [ ! "$oldVersion" = "$latestTag" ]; then
-        update-source-version ${pname} "$latestTag" --version-key=version --print-changes
-        nixpkgs="$(git rev-parse --show-toplevel)"
-        default_nix="$nixpkgs/pkgs/applications/terminal-emulators/xterm/default.nix"
-        nixfmt "$default_nix"
-      else
-        echo "${pname} is already up-to-date"
-      fi
-    '';
+      ignoredVersions = "[a-z]$";
+    };
   };
 
   meta = {
diff --git a/pkgs/applications/version-management/git-lfs/default.nix b/pkgs/applications/version-management/git-lfs/default.nix
index 45a5234accb1..bbb7d29422aa 100644
--- a/pkgs/applications/version-management/git-lfs/default.nix
+++ b/pkgs/applications/version-management/git-lfs/default.nix
@@ -1,19 +1,19 @@
-{ lib, buildGoModule, fetchFromGitHub, ronn, installShellFiles, git, testers, git-lfs }:
+{ lib, buildGoModule, fetchFromGitHub, asciidoctor, installShellFiles, git, testers, git-lfs }:
 
 buildGoModule rec {
   pname = "git-lfs";
-  version = "3.2.0";
+  version = "3.3.0";
 
   src = fetchFromGitHub {
     owner = "git-lfs";
     repo = "git-lfs";
     rev = "v${version}";
-    sha256 = "sha256-3gVUPfZs5GViEA3D7Zm5NdxhuEz9DhwPLoQqHFdGCrI=";
+    hash = "sha256-r1z97sgqo1IyR0oW5b3bMGTUHGE8U+hrWgQ0Su9FRrw=";
   };
 
-  vendorSha256 = null;
+  vendorHash = "sha256-did6qAUawmQ/juLzJWIXGzmErj9tBKgM7HROTezX+tw=";
 
-  nativeBuildInputs = [ ronn installShellFiles ];
+  nativeBuildInputs = [ asciidoctor installShellFiles ];
 
   ldflags = [
     "-s"
diff --git a/pkgs/development/libraries/grpc/default.nix b/pkgs/development/libraries/grpc/default.nix
index fd39e0d2368b..56f3cf0e7abd 100644
--- a/pkgs/development/libraries/grpc/default.nix
+++ b/pkgs/development/libraries/grpc/default.nix
@@ -21,7 +21,7 @@
 
 stdenv.mkDerivation rec {
   pname = "grpc";
-  version = "1.51.0"; # N.B: if you change this, please update:
+  version = "1.51.1"; # N.B: if you change this, please update:
     # pythonPackages.grpcio-tools
     # pythonPackages.grpcio-status
 
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     owner = "grpc";
     repo = "grpc";
     rev = "v${version}";
-    hash = "sha256-IOwwHwPogOtCnOAGi8JgW81JB47MlmL2vNG9g2Jg8Zo=";
+    hash = "sha256-o1C35mtA2lTGgugCKAQyRDNlCnutoJ1ol/DInJNobnc=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/libraries/quarto/default.nix b/pkgs/development/libraries/quarto/default.nix
index 16ad5f3534df..357675ef7dd9 100644
--- a/pkgs/development/libraries/quarto/default.nix
+++ b/pkgs/development/libraries/quarto/default.nix
@@ -13,10 +13,10 @@
 
 stdenv.mkDerivation rec {
   pname = "quarto";
-  version = "1.1.251";
+  version = "1.2.269";
   src = fetchurl {
     url = "https://github.com/quarto-dev/quarto-cli/releases/download/v${version}/quarto-${version}-linux-amd64.tar.gz";
-    sha256 = "sha256-VEYUEI4xzQPXlyTbCThAW2npBCZNPDJ5x2cWnkNz7RE=";
+    sha256 = "sha256-liZc7Ewo7HaIXdcXpdfQ3SW5JlOmZiZDawusjgJt8pE=";
   };
 
   nativeBuildInputs = [
@@ -27,6 +27,13 @@ stdenv.mkDerivation rec {
     ./fix-deno-path.patch
   ];
 
+  postPatch = ''
+    # Compat for Deno >=1.26
+    substituteInPlace bin/quarto.js \
+      --replace 'Deno.setRaw(stdin.rid, ' 'Deno.stdin.setRaw(' \
+      --replace 'Deno.setRaw(Deno.stdin.rid, ' 'Deno.stdin.setRaw('
+  '';
+
   dontStrip = true;
 
   preFixup = ''
diff --git a/pkgs/development/libraries/zydis/default.nix b/pkgs/development/libraries/zydis/default.nix
index 7009123a4528..901d32b39595 100644
--- a/pkgs/development/libraries/zydis/default.nix
+++ b/pkgs/development/libraries/zydis/default.nix
@@ -6,14 +6,14 @@
 
 stdenv.mkDerivation rec {
   pname = "zydis";
-  version = "3.2.1";
+  version = "4.0.0";
 
   src = fetchFromGitHub {
     owner = "zyantific";
     repo = "zydis";
     rev = "v${version}";
     fetchSubmodules = true;
-    sha256 = "sha256-FB7hGQ9vI3ZE376iROEpdtZm91IiccBhtAFa94JgnUY=";
+    sha256 = "sha256-WSBi8HUVj/JR0/0pBoEaUKD0kOk41gSW5ZW74fn8b4k=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/lua-modules/overrides.nix b/pkgs/development/lua-modules/overrides.nix
index c4c22170ba35..fe6e304d9f31 100644
--- a/pkgs/development/lua-modules/overrides.nix
+++ b/pkgs/development/lua-modules/overrides.nix
@@ -27,7 +27,7 @@
 , mariadb
 , mpfr
 , neovim-unwrapped
-, openssl_1_1
+, openssl
 , pcre
 , pkg-config
 , postgresql
@@ -73,8 +73,8 @@ with prev;
 
   cqueues = (prev.luaLib.overrideLuarocks prev.cqueues (drv: {
     externalDeps = [
-      { name = "CRYPTO"; dep = openssl_1_1; }
-      { name = "OPENSSL"; dep = openssl_1_1; }
+      { name = "CRYPTO"; dep = openssl; }
+      { name = "OPENSSL"; dep = openssl; }
     ];
     disabled = luaOlder "5.1" || luaAtLeast "5.4";
   })).overrideAttrs (oa: rec {
@@ -331,9 +331,8 @@ with prev;
 
   luaossl = prev.luaLib.overrideLuarocks prev.luaossl (drv: {
     externalDeps = [
-      # https://github.com/wahern/luaossl/pull/199
-      { name = "CRYPTO"; dep = openssl_1_1; }
-      { name = "OPENSSL"; dep = openssl_1_1; }
+      { name = "CRYPTO"; dep = openssl; }
+      { name = "OPENSSL"; dep = openssl; }
     ];
   });
 
@@ -345,7 +344,7 @@ with prev;
 
   luasec = prev.luaLib.overrideLuarocks prev.luasec (drv: {
     externalDeps = [
-      { name = "OPENSSL"; dep = openssl_1_1; }
+      { name = "OPENSSL"; dep = openssl; }
     ];
   });
 
diff --git a/pkgs/development/python-modules/aioaladdinconnect/default.nix b/pkgs/development/python-modules/aioaladdinconnect/default.nix
index f4ab5f9a4d5b..658a32c0b52c 100644
--- a/pkgs/development/python-modules/aioaladdinconnect/default.nix
+++ b/pkgs/development/python-modules/aioaladdinconnect/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "aioaladdinconnect";
-  version = "0.1.47";
+  version = "0.1.48";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -15,7 +15,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "AIOAladdinConnect";
     inherit version;
-    hash = "sha256-1q5CX5vtdK+rNDE6GtIobuacv6dkHhRJ+kirbX62us8=";
+    hash = "sha256-FrefWV42+DqvuAVScavwqtCfiCRXacuCruqGP0Gks6Y=";
   };
 
   propagatedBuildInputs = [
@@ -32,6 +32,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Library for controlling Genie garage doors connected to Aladdin Connect devices";
     homepage = "https://github.com/mkmer/AIOAladdinConnect";
+    changelog = "https://github.com/mkmer/AIOAladdinConnect/releases/tag/${version}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/aiohomekit/default.nix b/pkgs/development/python-modules/aiohomekit/default.nix
index 0e2fc029f2f8..8fa8343e9d22 100644
--- a/pkgs/development/python-modules/aiohomekit/default.nix
+++ b/pkgs/development/python-modules/aiohomekit/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "aiohomekit";
-  version = "2.3.1";
+  version = "2.3.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "Jc2k";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-jkLbCx9F7bDg2wIiEVGkaFPOYg5CROp5lfR8ZGvkKhY=";
+    hash = "sha256-znCW/uaD04Fb8fMClXgRAE2p2iKrobyrTn3kODUNUIo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/debugpy/default.nix b/pkgs/development/python-modules/debugpy/default.nix
index 97b06c130e22..1441dced7158 100644
--- a/pkgs/development/python-modules/debugpy/default.nix
+++ b/pkgs/development/python-modules/debugpy/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "debugpy";
-  version = "1.6.3";
+  version = "1.6.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "Microsoft";
     repo = pname;
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-ERsqs+pCJfYQInOWPBhM/7hC5TTfQAksYJwFCcd+vlk=";
+    sha256 = "sha256-THhu6Oa4x2b0chLFrJR7FF1z8X3/dsHzXosBmSqaDeI=";
   };
 
   patches = [
@@ -104,6 +104,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "An implementation of the Debug Adapter Protocol for Python";
     homepage = "https://github.com/microsoft/debugpy";
+    changelog = "https://github.com/microsoft/debugpy/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ kira-bruneau ];
     platforms = [ "x86_64-linux" "i686-linux" "aarch64-linux" "x86_64-darwin" "i686-darwin" "aarch64-darwin" ];
diff --git a/pkgs/development/python-modules/faraday-agent-parameters-types/default.nix b/pkgs/development/python-modules/faraday-agent-parameters-types/default.nix
index c5bca5712aba..bc9a9d5194ce 100644
--- a/pkgs/development/python-modules/faraday-agent-parameters-types/default.nix
+++ b/pkgs/development/python-modules/faraday-agent-parameters-types/default.nix
@@ -4,16 +4,20 @@
 , marshmallow
 , packaging
 , pytestCheckHook
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "faraday-agent-parameters-types";
-  version = "1.1.0";
+  version = "1.2.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     pname = "faraday_agent_parameters_types";
     inherit version;
-    sha256 = "sha256-7CA5YvqoNHuz9Tq9jjt40lyjrg+CJpnzI1nVnBr9Cyg=";
+    sha256 = "sha256-jQgE/eR8Gd9nMGijH9unhHCrLUn7DbWFkTauoz3O/sM=";
   };
 
   propagatedBuildInputs = [
@@ -38,6 +42,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Collection of Faraday agent parameters types";
     homepage = "https://github.com/infobyte/faraday_agent_parameters_types";
+    changelog = "https://github.com/infobyte/faraday_agent_parameters_types/blob/${version}/CHANGELOG.md";
     license = with licenses; [ gpl3Plus ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/faraday-plugins/default.nix b/pkgs/development/python-modules/faraday-plugins/default.nix
index 86d53b20c517..2807584c63db 100644
--- a/pkgs/development/python-modules/faraday-plugins/default.nix
+++ b/pkgs/development/python-modules/faraday-plugins/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "faraday-plugins";
-  version = "1.8.0";
+  version = "1.8.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "infobyte";
     repo = "faraday_plugins";
     rev = "refs/tags/${version}";
-    hash = "sha256-KAfy2AQWZYFT/+rX8dNe8aWTFI0kkGg5IaSHhwYGk3A=";
+    hash = "sha256-UnOIYYmOeBX22jQ4MkDxQKtSlxv+H/KOC83BZ39JA1E=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/grpcio-status/default.nix b/pkgs/development/python-modules/grpcio-status/default.nix
index 96d2b8aeb233..022d677cf516 100644
--- a/pkgs/development/python-modules/grpcio-status/default.nix
+++ b/pkgs/development/python-modules/grpcio-status/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "grpcio-status";
-  version = "1.51.0";
+  version = "1.51.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "5415b3fa555cd9f0dbfe51bc2b2818cf11c96b5898b103421f6df2fa65108fa2";
+    sha256 = "ac2617a3095935ebd785e2228958f24b10a0d527a0c9eb5a0863c784f648a816";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/grpcio-tools/default.nix b/pkgs/development/python-modules/grpcio-tools/default.nix
index 2e1a130c07b4..82e9315aec9a 100644
--- a/pkgs/development/python-modules/grpcio-tools/default.nix
+++ b/pkgs/development/python-modules/grpcio-tools/default.nix
@@ -2,12 +2,12 @@
 
 buildPythonPackage rec {
   pname = "grpcio-tools";
-  version = "1.51.0";
+  version = "1.51.1";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "264abafefc3240aacdc6e0c7765a8a20c284f1267ae0dd899084f07694b55095";
+    sha256 = "8e62d23d3fed9d4f81738f98dd193dbd2e21aed4a8f0dd715e75b5439e649727";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/hahomematic/default.nix b/pkgs/development/python-modules/hahomematic/default.nix
index d4e0fabc6073..376f0472e241 100644
--- a/pkgs/development/python-modules/hahomematic/default.nix
+++ b/pkgs/development/python-modules/hahomematic/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "hahomematic";
-  version = "2022.11.2";
+  version = "2022.12.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "danielperna84";
     repo = pname;
     rev = "refs/tags/${version}";
-    sha256 = "sha256-m28UDaBk2EFwulkjvuT6zpLEeVL/oofHUVSop+AKYvc=";
+    sha256 = "sha256-+Sv6yWMqJw/BNX0WyaXHpqEbTn4Ow58T1m6qE5K9Lu0=";
   };
 
   nativeBuildInputs = [
@@ -53,6 +53,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python module to interact with HomeMatic devices";
     homepage = "https://github.com/danielperna84/hahomematic";
+    changelog = "https://github.com/danielperna84/hahomematic/releases/tag/${version}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/homematicip/default.nix b/pkgs/development/python-modules/homematicip/default.nix
index 1c8cd9417827..50819a3c3444 100644
--- a/pkgs/development/python-modules/homematicip/default.nix
+++ b/pkgs/development/python-modules/homematicip/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "homematicip";
-  version = "1.0.10";
+  version = "1.0.12";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "hahn-th";
     repo = "homematicip-rest-api";
     rev = "refs/tags/${version}";
-    hash = "sha256-CnZHR5JyZm4T6Fm5VumZJujQvEdw59c7GSwcyO7EXXY=";
+    hash = "sha256-gad+sg5MZvAzy1xE+xF/4GdLClB5EiyPH39nIlhO7IQ=";
   };
 
   propagatedBuildInputs = [
@@ -53,6 +53,7 @@ buildPythonPackage rec {
     # Assert issues with datetime
     "test_contact_interface_device"
     "test_dimmer"
+    "test_external_device"
     "test_heating_failure_alert_group"
     "test_heating"
     "test_humidity_warning_rule_group"
diff --git a/pkgs/development/python-modules/p1monitor/default.nix b/pkgs/development/python-modules/p1monitor/default.nix
index 634c06352e50..bb3f750b2c5d 100644
--- a/pkgs/development/python-modules/p1monitor/default.nix
+++ b/pkgs/development/python-modules/p1monitor/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "p1monitor";
-  version = "2.1.1";
+  version = "2.2.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -20,8 +20,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "klaasnicolaas";
     repo = "python-p1monitor";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-VHY5AWxt5BZd1NQKzsgubEZBLKAlDNm8toyEazPUnDU=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-HaTwqTKqTuXZVt2fhKXyXEEYZCSau/YY6DRg6YHIhOI=";
   };
 
   nativeBuildInputs = [
@@ -52,6 +52,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Module for interacting with the P1 Monitor";
     homepage = "https://github.com/klaasnicolaas/python-p1monitor";
+    changelog = "https://github.com/klaasnicolaas/python-p1monitor/releases/tag/${version}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/patiencediff/default.nix b/pkgs/development/python-modules/patiencediff/default.nix
index 86d7fecb5758..295df5aab39c 100644
--- a/pkgs/development/python-modules/patiencediff/default.nix
+++ b/pkgs/development/python-modules/patiencediff/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "patiencediff";
-  version = "0.2.8";
+  version = "0.2.9";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -16,8 +16,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "breezy-team";
     repo = pname;
-    rev = "v${version}";
-    hash = "sha256-RmybTW2QENtZYzqe/hlMV8hKX+l0kGNS5PmEPCF/F0U=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-DvbOA/NXHTuE84zWicOUtAKgGHUmKrAWgeFW1+uA8JY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/peaqevcore/default.nix b/pkgs/development/python-modules/peaqevcore/default.nix
index f972b05d9bdf..28e1d641992c 100644
--- a/pkgs/development/python-modules/peaqevcore/default.nix
+++ b/pkgs/development/python-modules/peaqevcore/default.nix
@@ -6,14 +6,14 @@
 
 buildPythonPackage rec {
   pname = "peaqevcore";
-  version = "8.2.0";
+  version = "9.0.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-/zXfobbruhtTMeONA1fxYayMAR51S0u53TRkwx6RvsE=";
+    hash = "sha256-Zandkxbok64TopHnpmUShlGP7IOrqShStDU5RuUICNs=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pyunifiprotect/default.nix b/pkgs/development/python-modules/pyunifiprotect/default.nix
index f8faa56b5a53..af7c4b1cc52a 100644
--- a/pkgs/development/python-modules/pyunifiprotect/default.nix
+++ b/pkgs/development/python-modules/pyunifiprotect/default.nix
@@ -29,7 +29,7 @@
 
 buildPythonPackage rec {
   pname = "pyunifiprotect";
-  version = "4.4.2";
+  version = "4.5.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -38,7 +38,7 @@ buildPythonPackage rec {
     owner = "briis";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-30nQ02UUXJHvHC+hWTWHsUeU83G8cOJHK+Tgo6AE5jc=";
+    hash = "sha256-7LgAK0AzQ7uoVW7fXwoU512iI5LG0BL8N0R9f7AjFN4=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/tools/poetry2nix/poetry2nix/default.nix b/pkgs/development/tools/poetry2nix/poetry2nix/default.nix
index 153d9beb159e..4b10b3f8dd9a 100644
--- a/pkgs/development/tools/poetry2nix/poetry2nix/default.nix
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/default.nix
@@ -5,7 +5,7 @@
 }:
 let
   # Poetry2nix version
-  version = "1.36.0";
+  version = "1.37.0";
 
   inherit (poetryLib) isCompatible readTOML normalizePackageName normalizePackageSet;
 
diff --git a/pkgs/development/tools/poetry2nix/poetry2nix/mk-poetry-dep.nix b/pkgs/development/tools/poetry2nix/poetry2nix/mk-poetry-dep.nix
index 9f7936d9f829..db33ad1e6750 100644
--- a/pkgs/development/tools/poetry2nix/poetry2nix/mk-poetry-dep.nix
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/mk-poetry-dep.nix
@@ -41,6 +41,7 @@ pythonPackages.callPackage
         in
         builtins.filter (f: matchesVersion f.file && hasSupportedExtension f.file && isCompatibleEgg f.file) files;
       toPath = s: pwd + "/${s}";
+      isLocked = lib.length fileCandidates > 0;
       isSource = source != null;
       isGit = isSource && source.type == "git";
       isUrl = isSource && source.type == "url";
@@ -107,7 +108,7 @@ pythonPackages.callPackage
       nativeBuildInputs = [
         hooks.poetry2nixFixupHook
       ]
-      ++ lib.optional (!isSource && (getManyLinuxDeps fileInfo.name).str != null) autoPatchelfHook
+      ++ lib.optional (isLocked && (getManyLinuxDeps fileInfo.name).str != null) autoPatchelfHook
       ++ lib.optionals (format == "wheel") [
         hooks.wheelUnpackHook
         pythonPackages.pipInstallHook
@@ -120,7 +121,7 @@ pythonPackages.callPackage
       ];
 
       buildInputs = (
-        lib.optional (!isSource) (getManyLinuxDeps fileInfo.name).pkg
+        lib.optional (isLocked) (getManyLinuxDeps fileInfo.name).pkg
         ++ lib.optional isDirectory buildSystemPkgs
         ++ lib.optional (stdenv.buildPlatform != stdenv.hostPlatform) pythonPackages.setuptools
       );
diff --git a/pkgs/development/tools/poetry2nix/poetry2nix/overrides/build-systems.json b/pkgs/development/tools/poetry2nix/poetry2nix/overrides/build-systems.json
index e5d5c946a403..b0607e261601 100644
--- a/pkgs/development/tools/poetry2nix/poetry2nix/overrides/build-systems.json
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/overrides/build-systems.json
@@ -167,6 +167,9 @@
   "aio-georss-gdacs": [
     "setuptools"
   ],
+  "aio-pika": [
+    "setuptools"
+  ],
   "aioairq": [
     "setuptools"
   ],
@@ -444,6 +447,9 @@
     "poetry-core",
     "setuptools"
   ],
+  "aiormq": [
+    "setuptools"
+  ],
   "aiorpcx": [
     "setuptools"
   ],
@@ -900,6 +906,9 @@
   "arpeggio": [
     "setuptools"
   ],
+  "arpy": [
+    "setuptools"
+  ],
   "arrayqueues": [
     "setuptools"
   ],
@@ -1031,6 +1040,9 @@
   "astunparse": [
     "setuptools"
   ],
+  "async-cache": [
+    "setuptools"
+  ],
   "async-dns": [
     "poetry-core",
     "setuptools"
@@ -2003,6 +2015,9 @@
     "setuptools",
     "setuptools-scm"
   ],
+  "blue": [
+    "setuptools"
+  ],
   "bluemaestro-ble": [
     "poetry-core",
     "setuptools"
@@ -2081,7 +2096,8 @@
     "setuptools"
   ],
   "botocore-stubs": [
-    "poetry-core"
+    "poetry-core",
+    "setuptools"
   ],
   "bottle": [
     "setuptools"
@@ -2778,6 +2794,9 @@
   "cmdline": [
     "setuptools"
   ],
+  "cmdstanpy": [
+    "setuptools"
+  ],
   "cmigemo": [
     "setuptools"
   ],
@@ -2840,6 +2859,10 @@
     "setuptools"
   ],
   "colorama": [
+    {
+      "buildSystem": "hatchling",
+      "from": "0.4.6"
+    },
     "setuptools"
   ],
   "colorcet": [
@@ -2917,6 +2940,9 @@
   "conda": [
     "setuptools"
   ],
+  "config-formatter": [
+    "setuptools"
+  ],
   "configargparse": [
     "setuptools"
   ],
@@ -2936,6 +2962,10 @@
   "configshell": [
     "setuptools"
   ],
+  "configupdater": [
+    "setuptools",
+    "setuptools-scm"
+  ],
   "confluent-kafka": [
     "setuptools"
   ],
@@ -3082,6 +3112,9 @@
   "credstash": [
     "setuptools"
   ],
+  "crispy-bootstrap5": [
+    "setuptools"
+  ],
   "criticality-score": [
     "setuptools"
   ],
@@ -3401,11 +3434,15 @@
   "dbutils": [
     "setuptools"
   ],
+  "ddsketch": [
+    "setuptools"
+  ],
   "ddt": [
     "setuptools"
   ],
   "ddtrace": [
-    "cython"
+    "cython",
+    "setuptools"
   ],
   "deal": [
     "flit-core",
@@ -3704,6 +3741,9 @@
   "django-cockroachdb": [
     "setuptools"
   ],
+  "django-colorfield": [
+    "setuptools"
+  ],
   "django-colorful": [
     "setuptools"
   ],
@@ -3723,6 +3763,9 @@
   "django-cors-headers": [
     "setuptools"
   ],
+  "django-crispy-forms": [
+    "setuptools"
+  ],
   "django-cryptography": [
     "setuptools"
   ],
@@ -3751,6 +3794,9 @@
   "django-filter": [
     "setuptools"
   ],
+  "django-floppyforms": [
+    "setuptools"
+  ],
   "django-formtools": [
     "setuptools",
     "setuptools-scm"
@@ -3776,6 +3822,9 @@
   "django-hijack": [
     "setuptools"
   ],
+  "django-htmx": [
+    "setuptools"
+  ],
   "django-ipware": [
     "setuptools"
   ],
@@ -3807,6 +3856,9 @@
   "django-multiselectfield": [
     "setuptools"
   ],
+  "django-nested-admin": [
+    "setuptools"
+  ],
   "django-nose": [
     "setuptools"
   ],
@@ -3906,6 +3958,9 @@
   "django-treebeard": [
     "setuptools"
   ],
+  "django-types": [
+    "poetry-core"
+  ],
   "django-versatileimagefield": [
     "setuptools"
   ],
@@ -3941,6 +3996,12 @@
     "setuptools",
     "setuptools-scm"
   ],
+  "djangorestframework-stubs": [
+    "setuptools"
+  ],
+  "djangorestframework-types": [
+    "poetry"
+  ],
   "djmail": [
     "setuptools"
   ],
@@ -4439,6 +4500,9 @@
   "env-canada": [
     "setuptools"
   ],
+  "envier": [
+    "setuptools"
+  ],
   "environmental-override": [
     "setuptools"
   ],
@@ -4566,7 +4630,9 @@
   ],
   "exceptiongroup": [
     "flit-core",
+    "flit-scm",
     "flitBuildHook",
+    "flit-scm",
     "setuptools"
   ],
   "exchangelib": [
@@ -4794,6 +4860,7 @@
     "setuptools"
   ],
   "fido2": [
+    "poetry-core",
     "setuptools"
   ],
   "fields": [
@@ -4816,6 +4883,9 @@
     "setuptools",
     "setuptools-scm"
   ],
+  "filemagic": [
+    "setuptools"
+  ],
   "filetype": [
     "setuptools"
   ],
@@ -5563,6 +5633,12 @@
   "github3-py": [
     "setuptools"
   ],
+  "gitlint": [
+    "setuptools"
+  ],
+  "gitlint-core": [
+    "setuptools"
+  ],
   "gitpython": [
     "setuptools"
   ],
@@ -6368,7 +6444,18 @@
     "setuptools"
   ],
   "httpx": [
-    "setuptools"
+    {
+      "buildSystem": "hatch-fancy-pypi-readme",
+      "from": "0.23.1"
+    },
+    {
+      "buildSystem": "hatchling",
+      "from": "0.23.1"
+    },
+    {
+      "buildSystem": "setuptools",
+      "until": "0.23.1"
+    }
   ],
   "httpx-auth": [
     "setuptools"
@@ -7252,7 +7339,14 @@
     "setuptools"
   ],
   "jupyter-server": [
-    "setuptools"
+    {
+      "buildSystem": "setuptools",
+      "until": "1.21.0"
+    },
+    {
+      "buildSystem": "jupyter-packaging",
+      "from": "1.21.0"
+    }
   ],
   "jupyter-server-mathjax": [
     "jupyter-packaging",
@@ -7320,6 +7414,9 @@
     "poetry-core",
     "setuptools"
   ],
+  "justpy": [
+    "flit-core"
+  ],
   "jwcrypto": [
     "setuptools"
   ],
@@ -7416,6 +7513,9 @@
     "setuptools",
     "setuptools-scm"
   ],
+  "keyring-pass": [
+    "poetry-core"
+  ],
   "keyrings-alt": [
     "setuptools",
     "setuptools-scm"
@@ -7506,6 +7606,9 @@
     "poetry-core",
     "setuptools"
   ],
+  "language-formatters-pre-commit-hooks": [
+    "setuptools"
+  ],
   "lark": [
     "setuptools"
   ],
@@ -7613,6 +7716,9 @@
   "libasyncns": [
     "setuptools"
   ],
+  "libclang": [
+    "setuptools"
+  ],
   "libcloud": [
     "setuptools"
   ],
@@ -7793,6 +7899,9 @@
   "lmdb": [
     "setuptools"
   ],
+  "lmfit": [
+    "setuptools"
+  ],
   "lml": [
     "setuptools"
   ],
@@ -7901,6 +8010,9 @@
   "luhn": [
     "setuptools"
   ],
+  "lunarcalendar": [
+    "setuptools"
+  ],
   "lupa": [
     "cython",
     "setuptools"
@@ -7993,15 +8105,15 @@
   "malduck": [
     "setuptools"
   ],
+  "manage-fastapi": [
+    "poetry"
+  ],
   "managesieve": [
     "setuptools"
   ],
   "manhole": [
     "setuptools"
   ],
-  "manage-fastapi": [
-    "poetry"
-  ],
   "manimpango": [
     "cython",
     "setuptools"
@@ -8287,6 +8399,9 @@
   "migen": [
     "setuptools"
   ],
+  "migra": [
+    "poetry-core"
+  ],
   "mike": [
     "setuptools"
   ],
@@ -8353,6 +8468,9 @@
   "mitogen": [
     "setuptools"
   ],
+  "mixer": [
+    "setuptools"
+  ],
   "mizani": [
     "setuptools"
   ],
@@ -8400,6 +8518,10 @@
     "setuptools"
   ],
   "mkdocs-material-extensions": [
+    {
+      "buildSystem": "hatchling",
+      "from": "1.1"
+    },
     "setuptools"
   ],
   "mkdocs-minify": [
@@ -8638,9 +8760,15 @@
   "multi-key-dict": [
     "setuptools"
   ],
+  "multiaddr": [
+    "setuptools"
+  ],
   "multidict": [
     "setuptools"
   ],
+  "multihash": [
+    "setuptools"
+  ],
   "multimethod": [
     "setuptools"
   ],
@@ -8720,6 +8848,9 @@
   "mypy": [
     "setuptools"
   ],
+  "mypy-boto3-batch": [
+    "setuptools"
+  ],
   "mypy-boto3-builder": [
     "poetry-core",
     "setuptools"
@@ -8730,9 +8861,27 @@
   "mypy-boto3-cognito-idp": [
     "setuptools"
   ],
+  "mypy-boto3-dynamodb": [
+    "setuptools"
+  ],
+  "mypy-boto3-events": [
+    "setuptools"
+  ],
+  "mypy-boto3-lambda": [
+    "setuptools"
+  ],
   "mypy-boto3-s3": [
     "setuptools"
   ],
+  "mypy-boto3-s3control": [
+    "setuptools"
+  ],
+  "mypy-boto3-sns": [
+    "setuptools"
+  ],
+  "mypy-boto3-sqs": [
+    "setuptools"
+  ],
   "mypy-extensions": [
     "setuptools"
   ],
@@ -8999,6 +9148,9 @@
   "nibabel": [
     "setuptools"
   ],
+  "nicegui": [
+    "poetry-core"
+  ],
   "niko-home-control": [
     "setuptools"
   ],
@@ -9116,7 +9268,14 @@
   ],
   "notebook-shim": [
     "jupyter-packaging",
-    "setuptools"
+    {
+      "buildSystem": "setuptools",
+      "until": "0.2.0"
+    },
+    {
+      "buildSystem": "hatchling",
+      "from": "0.2.0"
+    }
   ],
   "notedown": [
     "setuptools"
@@ -10301,6 +10460,9 @@
   "plyvel": [
     "setuptools"
   ],
+  "pmdarima": [
+    "setuptools"
+  ],
   "pmsensor": [
     "setuptools"
   ],
@@ -11153,10 +11315,10 @@
   "pydenticon": [
     "setuptools"
   ],
-  "pydeps": [
+  "pydeprecate": [
     "setuptools"
   ],
-  "pydeprecate": [
+  "pydeps": [
     "setuptools"
   ],
   "pydes": [
@@ -11198,6 +11360,9 @@
   "pydot": [
     "setuptools"
   ],
+  "pydpkg": [
+    "poetry"
+  ],
   "pydrive2": [
     "setuptools"
   ],
@@ -12251,6 +12416,9 @@
   "pyramid-multiauth": [
     "setuptools"
   ],
+  "pyramid-openapi3": [
+    "poetry"
+  ],
   "pyreadability": [
     "setuptools"
   ],
@@ -13285,6 +13453,9 @@
   "python-mnist": [
     "setuptools"
   ],
+  "python-monkey-business": [
+    "setuptools"
+  ],
   "python-mpv-jsonipc": [
     "setuptools"
   ],
@@ -13566,6 +13737,9 @@
   "pytomorrowio": [
     "setuptools"
   ],
+  "pytoolconfig": [
+    "pdm-pep517"
+  ],
   "pytools": [
     "setuptools"
   ],
@@ -14675,6 +14849,9 @@
   "schema-salad": [
     "setuptools"
   ],
+  "schemainspect": [
+    "setuptools"
+  ],
   "schiene": [
     "setuptools"
   ],
@@ -14976,6 +15153,9 @@
   "shamir-mnemonic": [
     "setuptools"
   ],
+  "shap": [
+    "setuptools"
+  ],
   "shapely": [
     "cython",
     "setuptools"
@@ -14989,6 +15169,9 @@
   "sharkiqpy": [
     "setuptools"
   ],
+  "shellcheck-py": [
+    "setuptools"
+  ],
   "shellescape": [
     "setuptools"
   ],
@@ -15199,6 +15382,9 @@
   "slugid": [
     "setuptools"
   ],
+  "slumber": [
+    "setuptools"
+  ],
   "sly": [
     "setuptools"
   ],
@@ -15640,6 +15826,9 @@
   "sqlalchemy-utils": [
     "setuptools"
   ],
+  "sqlbag": [
+    "setuptools"
+  ],
   "sqlglot": [
     "setuptools"
   ],
@@ -15718,7 +15907,8 @@
     "setuptools"
   ],
   "starlette": [
-    "setuptools"
+    "setuptools",
+    "hatchling"
   ],
   "starline": [
     "setuptools"
@@ -15740,6 +15930,9 @@
   "statsd": [
     "setuptools"
   ],
+  "statsforecast": [
+    "setuptools"
+  ],
   "statsmodels": [
     "cython",
     "setuptools"
@@ -15828,7 +16021,10 @@
   ],
   "structlog": [
     "flitBuildHook",
-    "setuptools"
+    "setuptools",
+    "hatchling",
+    "hatch-fancy-pypi-readme",
+    "hatch-vcs"
   ],
   "structlog-sentry": [
     "poetry-core"
@@ -16037,6 +16233,9 @@
   "taxi": [
     "setuptools"
   ],
+  "tbats": [
+    "setuptools"
+  ],
   "tblib": [
     "setuptools"
   ],
@@ -16626,6 +16825,9 @@
   "trio-websocket": [
     "setuptools"
   ],
+  "troposphere": [
+    "setuptools"
+  ],
   "trueskill": [
     "setuptools"
   ],
@@ -16663,6 +16865,9 @@
     "flitBuildHook",
     "setuptools"
   ],
+  "tusker": [
+    "poetry"
+  ],
   "tuya-iot-py-sdk": [
     "setuptools"
   ],
@@ -16777,9 +16982,27 @@
     "flit-core",
     "setuptools"
   ],
+  "types-aiobotocore": [
+    "setuptools"
+  ],
+  "types-aiobotocore-cloudformation": [
+    "setuptools"
+  ],
+  "types-aiobotocore-ec2": [
+    "setuptools"
+  ],
+  "types-aiobotocore-elbv2": [
+    "setuptools"
+  ],
+  "types-aiobotocore-ssm": [
+    "setuptools"
+  ],
   "types-awscrt": [
     "poetry-core"
   ],
+  "types-cachetools": [
+    "setuptools"
+  ],
   "types-colorama": [
     "setuptools"
   ],
@@ -16813,6 +17036,9 @@
   "types-jsonschema": [
     "setuptools"
   ],
+  "types-markdown": [
+    "setuptools"
+  ],
   "types-protobuf": [
     "setuptools"
   ],
@@ -17948,6 +18174,9 @@
   "yubico-client": [
     "setuptools"
   ],
+  "yubikey-manager": [
+    "poetry-core"
+  ],
   "yutto": [
     "poetry-core",
     "setuptools"
diff --git a/pkgs/development/tools/poetry2nix/poetry2nix/overrides/default.nix b/pkgs/development/tools/poetry2nix/poetry2nix/overrides/default.nix
index 90533ef84978..a19095230826 100644
--- a/pkgs/development/tools/poetry2nix/poetry2nix/overrides/default.nix
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/overrides/default.nix
@@ -203,6 +203,7 @@ lib.composeManyExtensions [
         let
           getCargoHash = version: {
             "4.0.0" = "sha256-HvfRLyUhlXVuvxWrtSDKx3rMKJbjvuiMcDY6g+pYFS0=";
+            "4.0.1" = "sha256-lDWX69YENZFMu7pyBmavUZaalGvFqbHSHfkwkzmDQaY=";
           }.${version} or (
             lib.warn "Unknown bcrypt version: '${version}'. Please update getCargoHash." lib.fakeHash
           );
@@ -309,6 +310,18 @@ lib.composeManyExtensions [
           )
         );
 
+      cmdstanpy = super.cmdstanpy.overridePythonAttrs (
+        old: {
+          propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [ pkgs.cmdstan ];
+          patchPhase = ''
+            substituteInPlace cmdstanpy/model.py \
+              --replace 'cmd = [make]' \
+              'cmd = ["${pkgs.cmdstan}/bin/stan"]'
+          '';
+          CMDSTAN = "${pkgs.cmdstan}";
+        }
+      );
+
       contourpy = super.contourpy.overridePythonAttrs (
         old: {
           buildInputs = (old.buildInputs or [ ]) ++ [ self.pybind11 ];
@@ -370,6 +383,8 @@ lib.composeManyExtensions [
             "37.0.2" = "sha256-qvrxvneoBXjP96AnUPyrtfmCnZo+IriHR5HbtWQ5Gk8=";
             "37.0.4" = "sha256-f8r6QclTwkgK20CNe9i65ZOqvSUeDc4Emv6BFBhh1hI";
             "38.0.1" = "sha256-o8l13fnfEUvUdDasq3LxSPArozRHKVsZfQg9DNR6M6Q=";
+            "38.0.3" = "sha256-lzHLW1N4hZj+nn08NZiPVM/X+SEcIsuZDjEOy0OOkSc=";
+            "38.0.4" = "sha256-BN0kOblUwgHj5QBf52RY2Jx0nBn03lwoN1O5PEohbwY=";
           }.${version} or (
             lib.warn "Unknown cryptography version: '${version}'. Please update getCargoHash." lib.fakeHash
           );
@@ -420,6 +435,10 @@ lib.composeManyExtensions [
         '';
       });
 
+      darts = super.darts.override {
+        preferWheel = true;
+      };
+
       datadog-lambda = super.datadog-lambda.overridePythonAttrs (old: {
         postPatch = ''
           substituteInPlace setup.py --replace "setuptools==" "setuptools>="
@@ -1201,7 +1220,9 @@ lib.composeManyExtensions [
           buildInputs = (old.buildInputs or [ ]) ++ [
             self.types-typed-ast
             self.types-setuptools
-          ];
+          ]
+            ++ lib.optional (lib.strings.versionAtLeast old.version "0.990") self.types-psutil
+          ;
           # Compile mypy with mypyc, which makes mypy about 4 times faster. The compiled
           # version is also the default in the wheels on Pypi that include binaries.
           # is64bit: unfortunately the build would exhaust all possible memory on i686-linux.
@@ -1303,10 +1324,26 @@ lib.composeManyExtensions [
       );
 
       open3d = super.open3d.overridePythonAttrs (old: {
+        propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [ self.ipywidgets ];
         buildInputs = (old.buildInputs or [ ]) ++ [
           pkgs.udev
           pkgs.libusb1
-        ];
+        ] ++ (if lib.versionAtLeast super.open3d.version "0.16.0" then [
+          pkgs.mesa
+          (
+            pkgs.symlinkJoin {
+              name = "llvm-with-ubuntu-compatible-symlink";
+              paths = [
+                pkgs.llvm_10.lib
+                (pkgs.runCommand "llvm-ubuntu-compatible-symlink" { }
+                  ''
+                    mkdir -p "$out/lib/";
+                    ln -s "${pkgs.llvm_10.lib}/lib/libLLVM-10.so" "$out/lib/libLLVM-10.so.1"
+                  ''
+                )
+              ];
+            })
+        ] else [ ]);
         # TODO(Sem Mulder): Add overridable flags for CUDA/PyTorch/Tensorflow support.
         autoPatchelfIgnoreMissingDeps = true;
       });
@@ -1357,6 +1394,7 @@ lib.composeManyExtensions [
             "3.7.2" = "sha256-2U37IhftNYjH7sV7Nh51YpR/WjmPmmzX/aGuHsFgwf4=";
             "3.7.9" = "sha256-QHzAhjHgm4XLxY2zUdnIsd/WWMI7dJLQQAvTXC+2asQ=";
             "3.8.0" = "sha256-8k0DetamwLqkdcg8V/D2J5ja6IJSLi50CE+ZjFa7Hdc=";
+            "3.8.1" = "sha256-QXguyDxQHW9Fd3Nhmi5JzSxZQuk3HGPhhh/RGuOTZNY=";
           }.${version} or (
             lib.warn "Unknown orjson version: '${version}'. Please update getCargoHash." lib.fakeHash
           );
@@ -1508,6 +1546,12 @@ lib.composeManyExtensions [
         propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [ self.setuptools ];
       });
 
+      prophet = super.prophet.overridePythonAttrs (old: {
+        propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [ pkgs.cmdstan self.cmdstanpy ];
+        PROPHET_REPACKAGE_CMDSTAN = "false";
+        CMDSTAN = "${pkgs.cmdstan}";
+      });
+
       psycopg2 = super.psycopg2.overridePythonAttrs (
         old: {
           buildInputs = (old.buildInputs or [ ])
@@ -1754,6 +1798,34 @@ lib.composeManyExtensions [
         nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkgs.swig ];
       });
 
+      pyscard = super.pyscard.overridePythonAttrs (old:
+        # see https://github.com/NixOS/nixpkgs/blob/93568862a610dc1469dc40b15c1096a9357698ac/pkgs/development/python-modules/pyscard/default.nix
+        let
+          inherit (pkgs) PCSC pcsclite;
+          withApplePCSC = stdenv.isDarwin;
+        in
+        {
+          postPatch =
+            if withApplePCSC then ''
+              substituteInPlace smartcard/scard/winscarddll.c \
+                --replace "/System/Library/Frameworks/PCSC.framework/PCSC" \
+                          "${PCSC}/Library/Frameworks/PCSC.framework/PCSC"
+            '' else ''
+              substituteInPlace smartcard/scard/winscarddll.c \
+                --replace "libpcsclite.so.1" \
+                          "${lib.getLib pcsclite}/lib/libpcsclite${stdenv.hostPlatform.extensions.sharedLibrary}"
+            '';
+          propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ (
+            if withApplePCSC then [ PCSC ] else [ pcsclite ]
+          );
+          NIX_CFLAGS_COMPILE = lib.optionalString (! withApplePCSC)
+            "-I ${lib.getDev pcsclite}/include/PCSC";
+          nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [
+            pkgs.swig
+          ];
+        }
+      );
+
       pytaglib = super.pytaglib.overridePythonAttrs (old: {
         buildInputs = (old.buildInputs or [ ]) ++ [ pkgs.taglib ];
       });
@@ -1782,6 +1854,16 @@ lib.composeManyExtensions [
         }
       );
 
+      pytorch-lightning = super.pytorch-lightning.override {
+        unpackPhase = ''
+          # $src remains a gzipped tarball otherwise.
+          mkdir -p tmp
+          tar xvf $src --directory=tmp
+          mv tmp/pytorch-lightning*/* .
+          rm -rf tmp
+        '';
+      };
+
       pyqt5 =
         let
           qt5 = selectQt5 super.pyqt5.version;
@@ -2181,6 +2263,12 @@ lib.composeManyExtensions [
         }
       );
 
+      tensorflow-macos = super.tensorflow-macos.overridePythonAttrs (
+        old: {
+          postInstall = self.tensorflow.postInstall;
+        }
+      );
+
       tensorpack = super.tensorpack.overridePythonAttrs (
         old: {
           postPatch = ''
@@ -2311,6 +2399,7 @@ lib.composeManyExtensions [
         let
           # Watchfiles does not include Cargo.lock in tarball released on PyPi for versions up to 0.17.0
           getRepoHash = version: {
+            "0.18.0" = "sha256-biGGn0YAUbSO1hCJ4kU0ZWlqlXl/HRrBS3iIA3myRI8=";
             "0.17.0" = "1swpf265h9qq30cx55iy6jjirba3wml16wzb68k527ynrxr7hvqx";
             "0.16.1" = "1ss6gzcr6js2d2sddgz1p52gyiwpqmgrxm8r6wim7gnm4wvhav8a";
             "0.15.0" = "14k3avrj7v794kk4mk2xggn40a4s0zg8iq8wmyyyrf7va6hz29hf";
@@ -2330,6 +2419,13 @@ lib.composeManyExtensions [
             rev = "v${old.version}";
             inherit sha256;
           };
+          patchPhase = builtins.concatStringsSep "\n" [
+            (old.patchPhase or "")
+            ''
+              substituteInPlace "Cargo.lock" --replace 'version = "0.0.0"' 'version = "${old.version}"'
+              substituteInPlace "Cargo.toml" --replace 'version = "0.0.0"' 'version = "${old.version}"'
+            ''
+          ];
           cargoDeps = pkgs.rustPlatform.importCargoLock {
             lockFile = "${src.out}/Cargo.lock";
           };
diff --git a/pkgs/development/tools/poetry2nix/poetry2nix/pkgs/poetry/default.nix b/pkgs/development/tools/poetry2nix/poetry2nix/pkgs/poetry/default.nix
index 85cd8f0788f7..d175bfe01f30 100644
--- a/pkgs/development/tools/poetry2nix/poetry2nix/pkgs/poetry/default.nix
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/pkgs/poetry/default.nix
@@ -34,8 +34,8 @@ poetry2nix.mkPoetryApplication {
 
     mkdir -p "$out/share/bash-completion/completions"
     "$out/bin/poetry" completions bash > "$out/share/bash-completion/completions/poetry"
-    mkdir -p "$out/share/zsh/vendor-completions"
-    "$out/bin/poetry" completions zsh > "$out/share/zsh/vendor-completions/_poetry"
+    mkdir -p "$out/share/zsh/site-functions"
+    "$out/bin/poetry" completions zsh > "$out/share/zsh/site-functions/_poetry"
     mkdir -p "$out/share/fish/vendor_completions.d"
     "$out/bin/poetry" completions fish > "$out/share/fish/vendor_completions.d/poetry.fish"
   '';
diff --git a/pkgs/development/tools/protoc-gen-twirp_php/default.nix b/pkgs/development/tools/protoc-gen-twirp_php/default.nix
index a54c860f2957..1fb1dbfbf791 100644
--- a/pkgs/development/tools/protoc-gen-twirp_php/default.nix
+++ b/pkgs/development/tools/protoc-gen-twirp_php/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "protoc-gen-twirp_php";
-  version = "0.8.1";
+  version = "0.9.1";
 
   # fetchFromGitHub currently not possible, because go.mod and go.sum are export-ignored
   src = fetchgit {
     url = "https://github.com/twirphp/twirp.git";
     rev = "v${version}";
-    sha256 = "sha256-5PACgKqc8rWqaA6Syj5NyxHm3827yd67tm0mwVSMnWQ=";
+    sha256 = "sha256-6tA+iNcs6s4vviWSJ5gCL9hPyCa7OvYXRCCokAAO0T8=";
   };
 
-  vendorSha256 = "sha256-qQFlBviRISEnPBt0q5391RqUrPTI/QDxg3MNfwWE8MI=";
+  vendorSha256 = "sha256-Kz9tMM4XSMOUmlHb/BE5/C/ZohdE505DTeDj9lGki/I=";
 
   subPackages = [ "protoc-gen-twirp_php" ];
 
diff --git a/pkgs/development/tools/sd-local/default.nix b/pkgs/development/tools/sd-local/default.nix
index 06fe1af307c4..b6e61b41f939 100644
--- a/pkgs/development/tools/sd-local/default.nix
+++ b/pkgs/development/tools/sd-local/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "sd-local";
-  version = "1.0.45";
+  version = "1.0.46";
 
   src = fetchFromGitHub {
     owner = "screwdriver-cd";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-ziCDuGpvBPKC3p+kuPi5+Hjfkld/Kh0ZqnLKwdMrXNM=";
+    sha256 = "sha256-+Z12atz6fSM5FJFOqUhjalxkP/1Kkm3xWgwUVlB9JvM=";
   };
 
-  vendorSha256 = "sha256-43hcIIGqBscMjQzaIGdMqV5lq3od4Ls4TJdTeFGtu5Y=";
+  vendorSha256 = "sha256-sgCUho8KFt0iFEuupQdMV6IZTVCsTXsNqv2ab5jp0mI=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/development/web/nodejs/revert-arm64-pointer-auth.patch b/pkgs/development/web/nodejs/revert-arm64-pointer-auth.patch
new file mode 100644
index 000000000000..f5827983d7f2
--- /dev/null
+++ b/pkgs/development/web/nodejs/revert-arm64-pointer-auth.patch
@@ -0,0 +1,13 @@
+Fixes cross compilation to aarch64-linux by reverting
+https://github.com/nodejs/node/pull/43200
+
+--- old/configure.py
++++ new/configure.py
+@@ -1236,7 +1236,6 @@
+ 
+   # Enable branch protection for arm64
+   if target_arch == 'arm64':
+-    o['cflags']+=['-msign-return-address=all']
+     o['variables']['arm_fpu'] = options.arm_fpu or 'neon'
+ 
+   if options.node_snapshot_main is not None:
diff --git a/pkgs/development/web/nodejs/v19.nix b/pkgs/development/web/nodejs/v19.nix
index 0e30ec899bd0..cbed3bbef9aa 100644
--- a/pkgs/development/web/nodejs/v19.nix
+++ b/pkgs/development/web/nodejs/v19.nix
@@ -8,17 +8,10 @@ let
 in
 buildNodejs {
   inherit enableNpm;
-  version = "19.1.0";
-  sha256 = "sha256-Tqm6H5koFfuCOwIqYrYfU2Eh+XD+iMY5XH469OnPRqA=";
+  version = "19.2.0";
+  sha256 = "sha256-CVaw/wHy9jg4J+kWpgSBWc4r2wUhf2VKj/9U6BFtwX4=";
   patches = [
-    (fetchpatch {
-      # Fixes cross compilation to aarch64-linux by reverting https://github.com/nodejs/node/pull/43200
-      name = "revert-arm64-pointer-auth.patch";
-      url = "https://github.com/nodejs/node/pull/43200/commits/d42c42cc8ac652ab387aa93205aed6ece8a5040a.patch";
-      sha256 = "sha256-ipGzg4lEoftTJbt6sW+0QJO/AZqHvUkFKe0qlum+iLY=";
-      revert = true;
-    })
-
+    ./revert-arm64-pointer-auth.patch
     ./disable-darwin-v8-system-instrumentation-node19.patch
     ./bypass-darwin-xcrun-node16.patch
   ];
diff --git a/pkgs/games/dwarf-fortress/default.nix b/pkgs/games/dwarf-fortress/default.nix
index 382537282748..dd8e6b5503da 100644
--- a/pkgs/games/dwarf-fortress/default.nix
+++ b/pkgs/games/dwarf-fortress/default.nix
@@ -69,7 +69,7 @@ let
 
           dfhack = callPackage ./dfhack {
             inherit (perlPackages) XMLLibXML XMLLibXSLT;
-            inherit dfVersion twbt;
+            inherit dfVersion;
             stdenv = gccStdenv;
           };
 
diff --git a/pkgs/games/dwarf-fortress/dfhack/default.nix b/pkgs/games/dwarf-fortress/dfhack/default.nix
index 49e8fabd45e4..914ccbb6ab33 100644
--- a/pkgs/games/dwarf-fortress/dfhack/default.nix
+++ b/pkgs/games/dwarf-fortress/dfhack/default.nix
@@ -2,6 +2,7 @@
 , buildEnv
 , lib
 , fetchFromGitHub
+, fetchpatch
 , cmake
 , writeScriptBin
 , perl
@@ -13,8 +14,6 @@
 , allegro5
 , libGLU
 , libGL
-, enableTWBT ? true
-, twbt
 , SDL
 , dfVersion
 }:
@@ -23,24 +22,6 @@ with lib;
 
 let
   dfhack-releases = {
-    "0.43.05" = {
-      dfHackRelease = "0.43.05-r3.1";
-      sha256 = "1ds366i0qcfbn62w9qv98lsqcrm38npzgvcr35hf6ihqa6nc6xrl";
-      xmlRev = "860a9041a75305609643d465123a4b598140dd7f";
-      prerelease = false;
-    };
-    "0.44.05" = {
-      dfHackRelease = "0.44.05-r2";
-      sha256 = "1cwifdhi48a976xc472nf6q2k0ibwqffil5a4llcymcxdbgxdcc9";
-      xmlRev = "2794f8a6d7405d4858bac486a0bb17b94740c142";
-      prerelease = false;
-    };
-    "0.44.09" = {
-      dfHackRelease = "0.44.09-r1";
-      sha256 = "1nkfaa43pisbyik5inj5q2hja2vza5lwidg5z02jyh136jm64hwk";
-      xmlRev = "3c0bf63674d5430deadaf7befaec42f0ec1e8bc5";
-      prerelease = false;
-    };
     "0.44.10" = {
       dfHackRelease = "0.44.10-r2";
       sha256 = "19bxsghxzw3bilhr8sm4axz7p7z8lrvbdsd1vdjf5zbg04rs866i";
@@ -66,22 +47,24 @@ let
       prerelease = true;
     };
     "0.47.04" = {
-      dfHackRelease = "0.47.04-r2";
-      sha256 = "18ppn1dqaxi6ahjzsvb9kw70rvca106a1hibhzc4rxmraypnqb89";
-      xmlRev = "036b662a1bbc96b4911f3cbe74dfa1243b6459bc";
+      dfHackRelease = "0.47.04-r5";
+      sha256 = "sha256-0s+/LKbqsS/mrxKPDeniqykE5+Gy3ZzCa8yEDzMyssY=";
+      xmlRev = "be0444cc165a1abff053d5893dc1f780f06526b7";
       prerelease = false;
     };
     "0.47.05" = {
-      dfHackRelease = "0.47.05-r1";
-      sha256 = "sha256-B0iv7fpIcnaO8sx9wPqI7/WuyLK15p8UYlYIcF5F5bw=";
-      xmlRev = "11c379ffd31255f2a1415d98106114a46245e1c3";
+      dfHackRelease = "0.47.05-r7";
+      sha256 = "sha256-vBKUTSjfCnalkBzfjaIKcxUuqsGGOTtoJC1RHJIDlNc=";
+      xmlRev = "f5019a5c6f19ef05a28bd974c3e8668b78e6e2a4";
       prerelease = false;
     };
 
   };
 
   release =
-    if hasAttr dfVersion dfhack-releases
+    if lib.isAttrs dfVersion
+    then dfVersion
+    else if hasAttr dfVersion dfhack-releases
     then getAttr dfVersion dfhack-releases
     else throw "[DFHack] Unsupported Dwarf Fortress version: ${dfVersion}";
 
@@ -115,9 +98,9 @@ let
       exit 1
     fi
   '';
-
-  dfhack = stdenv.mkDerivation {
-    pname = "dfhack-base";
+in
+  stdenv.mkDerivation {
+    pname = "dfhack";
     inherit version;
 
     # Beware of submodules
@@ -129,10 +112,20 @@ let
       fetchSubmodules = true;
     };
 
-    patches = [ ./fix-stonesense.patch ];
+    patches = lib.optional (lib.versionOlder version "0.44.12-r3") (fetchpatch {
+      name = "fix-stonesense.patch";
+      url = "https://github.com/DFHack/stonesense/commit/f5be6fe5fb192f01ae4551ed9217e97fd7f6a0ae.patch";
+      extraPrefix = "plugins/stonesense/";
+      stripLen = 1;
+      hash = "sha256-wje6Mkct29eyMOcJnbdefwBOLJko/s4JcJe52ojuW+8=";
+    }) ++ lib.optional (lib.versionOlder version "0.47.04-r1") (fetchpatch {
+      name = "fix-protobuf.patch";
+      url = "https://github.com/DFHack/dfhack/commit/7bdf958518d2892ee89a7173224a069c4a2190d8.patch";
+      hash = "sha256-p+mKhmYbnhWKNiGPMjbYO505Gcg634n0nudqH0NX3KY=";
+    });
 
     # gcc 11 fix
-    NIX_CFLAGS_COMPILE = "-fpermissive";
+    CXXFLAGS = lib.optionalString (lib.versionOlder version "0.47.05-r3") "-fpermissive";
 
     # As of
     # https://github.com/DFHack/dfhack/commit/56e43a0dde023c5a4595a22b29d800153b31e3c4,
@@ -166,21 +159,13 @@ let
       ln -s ${ruby}/lib/libruby-*.so $out/hack/libruby.so
     '';
 
-  };
-in
+    passthru = { inherit dfVersion; };
 
-buildEnv {
-  name = "dfhack-${version}";
-
-  passthru = { inherit version dfVersion; };
-
-  paths = [ dfhack ] ++ lib.optionals enableTWBT [ twbt.lib ];
-
-  meta = with lib; {
-    description = "Memory hacking library for Dwarf Fortress and a set of tools that use it";
-    homepage = "https://github.com/DFHack/dfhack/";
-    license = licenses.zlib;
-    platforms = [ "x86_64-linux" "i686-linux" ];
-    maintainers = with maintainers; [ robbinch a1russell abbradar numinit ];
-  };
-}
+    meta = with lib; {
+      description = "Memory hacking library for Dwarf Fortress and a set of tools that use it";
+      homepage = "https://github.com/DFHack/dfhack/";
+      license = licenses.zlib;
+      platforms = [ "x86_64-linux" "i686-linux" ];
+      maintainers = with maintainers; [ robbinch a1russell abbradar numinit ncfavier ];
+    };
+  }
diff --git a/pkgs/games/dwarf-fortress/dfhack/fix-stonesense.patch b/pkgs/games/dwarf-fortress/dfhack/fix-stonesense.patch
deleted file mode 100644
index da860cd55624..000000000000
--- a/pkgs/games/dwarf-fortress/dfhack/fix-stonesense.patch
+++ /dev/null
@@ -1,23 +0,0 @@
-From f5be6fe5fb192f01ae4551ed9217e97fd7f6a0ae Mon Sep 17 00:00:00 2001
-From: Herwig Hochleitner <hhochleitner@gmail.com>
-Date: Sun, 1 Oct 2017 18:01:43 +0200
-Subject: [PATCH] include <GL/glext.h>
-
-this fixes `GLhandleARB` not being defined
----
- plugins/stonesense/common.h | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/plugins/stonesense/common.h b/plugins/stonesense/common.h
-index eb36691..ef45389 100644
---- a/plugins/stonesense/common.h
-+++ b/plugins/stonesense/common.h
-@@ -31,6 +31,8 @@ using namespace df::enums;
- #include <allegro5/allegro_opengl.h>
- #include <allegro5/utf8.h>
- 
-+#include <GL/glext.h>
-+
- // allegro leaks X headers, undef some of it here:
- #undef TileShape
- #undef None
\ No newline at end of file
diff --git a/pkgs/games/dwarf-fortress/game.nix b/pkgs/games/dwarf-fortress/game.nix
index 42f2c6ed127b..7ce837b7b0b5 100644
--- a/pkgs/games/dwarf-fortress/game.nix
+++ b/pkgs/games/dwarf-fortress/game.nix
@@ -104,6 +104,6 @@ stdenv.mkDerivation {
     homepage = "https://www.bay12games.com/dwarves/";
     license = licenses.unfreeRedistributable;
     platforms = attrNames platforms;
-    maintainers = with maintainers; [ a1russell robbinch roconnor abbradar numinit shazow ];
+    maintainers = with maintainers; [ a1russell robbinch roconnor abbradar numinit shazow ncfavier ];
   };
 }
diff --git a/pkgs/games/dwarf-fortress/lazy-pack.nix b/pkgs/games/dwarf-fortress/lazy-pack.nix
index b34dbd3c74b8..17037dbdb278 100644
--- a/pkgs/games/dwarf-fortress/lazy-pack.nix
+++ b/pkgs/games/dwarf-fortress/lazy-pack.nix
@@ -19,7 +19,7 @@
 , theme ? themes.phoebus
   # General config options:
 , enableIntro ? true
-, enableTruetype ? true
+, enableTruetype ? null # defaults to 24, see init.txt
 , enableFPS ? false
 , enableTextMode ? false
 , enableSound ? true
diff --git a/pkgs/games/dwarf-fortress/twbt/default.nix b/pkgs/games/dwarf-fortress/twbt/default.nix
index 7d2816d97a4a..311a36da2bf1 100644
--- a/pkgs/games/dwarf-fortress/twbt/default.nix
+++ b/pkgs/games/dwarf-fortress/twbt/default.nix
@@ -9,21 +9,6 @@ with lib;
 
 let
   twbt-releases = {
-    "0.43.05" = {
-      twbtRelease = "6.22";
-      sha256 = "0di5d38f6jj9smsz0wjcs1zav4zba6hrk8cbn59kwpb1wamsh5c7";
-      prerelease = false;
-    };
-    "0.44.05" = {
-      twbtRelease = "6.35";
-      sha256 = "0qjkgl7dsqzsd7pdq8a5bihhi1wplfkv1id7sj6dp3swjpsfxp8g";
-      prerelease = false;
-    };
-    "0.44.09" = {
-      twbtRelease = "6.41";
-      sha256 = "0nsq15z05pbhqjvw2xqs1a9b1n2ma0aalhc3vh3mi4cd4k7lxh44";
-      prerelease = false;
-    };
     "0.44.10" = {
       twbtRelease = "6.49";
       sha256 = "1qjkc7k33qhxj2g18njzasccjqsis5y8zrw5vl90h4rs3i8ld9xz";
@@ -46,14 +31,14 @@ let
     };
     "0.47.04" = {
       twbtRelease = "6.xx";
-      dfhackRelease = "0.47.04-r2";
-      sha256 = "092dgp8fh1j4nqr9wbzn89ib1nhscclr8m91lfxsvg0mgn7j8xlv";
+      dfhackRelease = "0.47.04-r5";
+      sha256 = "sha256-+C3g4KJShCb2VXGQ4mtkDOufXZQ1P+ebDTmUzL3tNyU=";
       prerelease = true;
     };
     "0.47.05" = {
       twbtRelease = "6.xx";
-      dfhackRelease = "0.47.05-r1";
-      sha256 = "1nqhaf7271bm9rq9dmilhhk9q7v3841d0rv4y3fid40vfi4gpi3p";
+      dfhackRelease = "0.47.05-r7";
+      sha256 = "sha256-4xMKuSP5J6pMK+hwjTAcTI0gsLJfw+Xt+vh9CopR4tk=";
       prerelease = true;
     };
   };
diff --git a/pkgs/games/dwarf-fortress/wrapper/default.nix b/pkgs/games/dwarf-fortress/wrapper/default.nix
index 0c1fbc6ca4de..89f980f8d5bc 100644
--- a/pkgs/games/dwarf-fortress/wrapper/default.nix
+++ b/pkgs/games/dwarf-fortress/wrapper/default.nix
@@ -4,6 +4,7 @@
 , substituteAll
 , runCommand
 , coreutils
+, gawk
 , dwarf-fortress
 , dwarf-therapist
 , enableDFHack ? false
@@ -16,18 +17,22 @@
 , twbt
 , themes ? { }
 , theme ? null
+, extraPackages ? [ ]
   # General config options:
 , enableIntro ? true
-, enableTruetype ? true
+, enableTruetype ? null # defaults to 24, see init.txt
 , enableFPS ? false
 , enableTextMode ? false
 , enableSound ? true
+# An attribute set of settings to override in data/init/*.txt.
+# For example, `init.FOO = true;` is translated to `[FOO:YES]` in init.txt
+, settings ? { }
+# TODO world-gen.txt, interface.txt require special logic
 }:
 
 let
   dfhack_ = dfhack.override {
     inherit enableStoneSense;
-    inherit enableTWBT;
   };
 
   ptheme =
@@ -35,27 +40,65 @@ let
     then builtins.getAttr theme themes
     else theme;
 
-  unBool = b: if b then "YES" else "NO";
+  baseEnv = buildEnv {
+    name = "dwarf-fortress-base-env-${dwarf-fortress.dfVersion}";
 
-  # These are in inverse order for first packages to override the next ones.
-  themePkg = lib.optional (theme != null) ptheme;
-  pkgs = lib.optional enableDFHack dfhack_
-    ++ lib.optional enableSoundSense soundSense
-    ++ lib.optional enableTWBT twbt.art
-    ++ [ dwarf-fortress ];
+    # These are in inverse order for first packages to override the next ones.
+    paths = extraPackages
+         ++ lib.optional (theme != null) ptheme
+         ++ lib.optional enableDFHack dfhack_
+         ++ lib.optional enableSoundSense soundSense
+         ++ lib.optionals enableTWBT [ twbt.lib twbt.art ]
+         ++ [ dwarf-fortress ];
 
-  fixup = lib.singleton (runCommand "fixup" { } (''
+    ignoreCollisions = true;
+  };
+
+  settings_ = lib.recursiveUpdate {
+    init = {
+      PRINT_MODE = if enableTextMode then "TEXT" else if enableTWBT then "TWBT" else null;
+      INTRO = enableIntro;
+      TRUETYPE = enableTruetype;
+      FPS = enableFPS;
+      SOUND = enableSound;
+    };
+  } settings;
+
+  forEach = attrs: f: lib.concatStrings (lib.mapAttrsToList f attrs);
+
+  toTxt = v:
+    if lib.isBool v then if v then "YES" else "NO"
+    else if lib.isInt v then toString v
+    else if lib.isString v then v
+    else throw "dwarf-fortress: unsupported configuration value ${toString v}";
+
+  config = runCommand "dwarf-fortress-config" {
+    nativeBuildInputs = [ gawk ];
+  } (''
     mkdir -p $out/data/init
-  '' + (if (theme != null) then ''
-    cp ${lib.head themePkg}/data/init/init.txt $out/data/init/init.txt
-  '' else ''
-    cp ${dwarf-fortress}/data/init/init.txt $out/data/init/init.txt
-  '') + lib.optionalString enableDFHack ''
+
+    edit_setting() {
+      v=''${v//'&'/'\&'}
+      if ! gawk -i inplace -v RS='\r?\n' '
+        { n += sub("\\[" ENVIRON["k"] ":[^]]*\\]", "[" ENVIRON["k"] ":" ENVIRON["v"] "]"); print }
+        END { exit(!n) }
+      ' "$out/$file"; then
+        echo "error: no setting named '$k' in $file" >&2
+        exit 1
+      fi
+    }
+  '' + forEach settings_ (file: kv: ''
+    file=data/init/${lib.escapeShellArg file}.txt
+    cp ${baseEnv}/"$file" "$out/$file"
+  '' + forEach kv (k: v: lib.optionalString (v != null) ''
+    export k=${lib.escapeShellArg k} v=${lib.escapeShellArg (toTxt v)}
+    edit_setting
+  '')) + lib.optionalString enableDFHack ''
     mkdir -p $out/hack
 
     # Patch the MD5
-    orig_md5=$(cat "${dwarf-fortress}/hash.md5.orig")
-    patched_md5=$(cat "${dwarf-fortress}/hash.md5")
+    orig_md5=$(< "${dwarf-fortress}/hash.md5.orig")
+    patched_md5=$(< "${dwarf-fortress}/hash.md5")
     input_file="${dfhack_}/hack/symbols.xml"
     output_file="$out/hack/symbols.xml"
 
@@ -66,31 +109,21 @@ let
     echo "  Replace: $patched_md5"
 
     substitute "$input_file" "$output_file" --replace "$orig_md5" "$patched_md5"
-  '' + lib.optionalString enableTWBT ''
-    substituteInPlace $out/data/init/init.txt \
-      --replace '[PRINT_MODE:2D]' '[PRINT_MODE:TWBT]'
-  '' +
-  lib.optionalString enableTextMode ''
-    substituteInPlace $out/data/init/init.txt \
-      --replace '[PRINT_MODE:2D]' '[PRINT_MODE:TEXT]'
-  '' + ''
-    substituteInPlace $out/data/init/init.txt \
-      --replace '[INTRO:YES]' '[INTRO:${unBool enableIntro}]' \
-      --replace '[TRUETYPE:YES]' '[TRUETYPE:${unBool enableTruetype}]' \
-      --replace '[FPS:NO]' '[FPS:${unBool enableFPS}]' \
-      --replace '[SOUND:YES]' '[SOUND:${unBool enableSound}]'
-  ''));
+  '');
 
+  # This is a separate environment because the config files to modify may come
+  # from any of the paths in baseEnv.
   env = buildEnv {
     name = "dwarf-fortress-env-${dwarf-fortress.dfVersion}";
-
-    paths = fixup ++ themePkg ++ pkgs;
-    pathsToLink = [ "/" "/hack" "/hack/scripts" ];
-
+    paths = [ config baseEnv ];
     ignoreCollisions = true;
   };
 in
 
+lib.throwIf (enableTWBT && !enableDFHack) "dwarf-fortress: TWBT requires DFHack to be enabled"
+lib.throwIf (enableStoneSense && !enableDFHack) "dwarf-fortress: StoneSense requires DFHack to be enabled"
+lib.throwIf (enableTextMode && enableTWBT) "dwarf-fortress: text mode and TWBT are mutually exclusive"
+
 stdenv.mkDerivation {
   pname = "dwarf-fortress";
   version = dwarf-fortress.dfVersion;
@@ -114,7 +147,10 @@ stdenv.mkDerivation {
   runDFHack = ./dfhack.in;
   runSoundSense = ./soundSense.in;
 
-  passthru = { inherit dwarf-fortress dwarf-therapist; };
+  passthru = {
+    inherit dwarf-fortress dwarf-therapist twbt env;
+    dfhack = dfhack_;
+  };
 
   buildCommand = ''
     mkdir -p $out/bin
diff --git a/pkgs/games/dwarf-fortress/wrapper/dfhack.in b/pkgs/games/dwarf-fortress/wrapper/dfhack.in
old mode 100644
new mode 100755
index 026b33ab87bf..0f74674baf29
--- a/pkgs/games/dwarf-fortress/wrapper/dfhack.in
+++ b/pkgs/games/dwarf-fortress/wrapper/dfhack.in
@@ -2,8 +2,8 @@
 
 source @dfInit@
 
-for i in dfhack.init-example dfhack-config/default hack/* stonesense/*; do
-  update_path "$i"
+for i in *.init *.init-example dfhack-config/default dfhack-config/init hack/* stonesense/*; do
+  if [ -e "$i" ]; then update_path "$i"; fi
 done
 
 cd "$DF_DIR"
diff --git a/pkgs/servers/jellyfin/default.nix b/pkgs/servers/jellyfin/default.nix
index 7b7ebc9bee62..4848dcba9f06 100644
--- a/pkgs/servers/jellyfin/default.nix
+++ b/pkgs/servers/jellyfin/default.nix
@@ -29,13 +29,13 @@ let
 in
 buildDotnetModule rec {
   pname = "jellyfin";
-  version = "10.8.7"; # ensure that jellyfin-web has matching version
+  version = "10.8.8"; # ensure that jellyfin-web has matching version
 
   src = fetchFromGitHub {
     owner = "jellyfin";
     repo = "jellyfin";
     rev = "v${version}";
-    sha256 = "GQPnQybDnWnqkA8mIBj3x69nfUkngJOJscjdZ/N08V4=";
+    sha256 = "3+JwcHZGENX9PgHdtRmzffi6p2p68Ngs3WOiEwAY8zU=";
   };
 
   patches = [
diff --git a/pkgs/servers/jellyfin/node-deps.nix b/pkgs/servers/jellyfin/node-deps.nix
index 5f8cd76c9d13..73c65f0037ae 100644
--- a/pkgs/servers/jellyfin/node-deps.nix
+++ b/pkgs/servers/jellyfin/node-deps.nix
@@ -11817,8 +11817,8 @@ let
   args = {
     name = "jellyfin-web";
     packageName = "jellyfin-web";
-    version = "10.8.7";
-    src = ../../../../../../../nix/store/krfjzr2qxxnvgafvq08if2lcf53asfxs-source;
+    version = "10.8.8";
+    src = ../../../../../../../nix/store/bbsfbkaiq91gnf5ffcyh4gl8r9mqlyc4-source;
     dependencies = [
       sources."@ampproject/remapping-2.1.2"
       (sources."@apideck/better-ajv-errors-0.3.3" // {
diff --git a/pkgs/servers/jellyfin/web.nix b/pkgs/servers/jellyfin/web.nix
index a3f32c029e67..bf7c4d25d236 100644
--- a/pkgs/servers/jellyfin/web.nix
+++ b/pkgs/servers/jellyfin/web.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "jellyfin-web";
-  version = "10.8.7";
+  version = "10.8.8";
 
   src = fetchFromGitHub {
     owner = "jellyfin";
     repo = "jellyfin-web";
     rev = "v${version}";
-    sha256 = "8WHXgNB7yay/LgKZWNKuPo30vbS7SEM9s+EPUMyhN/g=";
+    sha256 = "pIoMpNxRtIvs6bhFEoSlFU8aHZ2CBbHnZaA/FVAkGOI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/servers/monitoring/do-agent/default.nix b/pkgs/servers/monitoring/do-agent/default.nix
index 51cb6b57033b..2508e135431f 100644
--- a/pkgs/servers/monitoring/do-agent/default.nix
+++ b/pkgs/servers/monitoring/do-agent/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "do-agent";
-  version = "3.14.1";
+  version = "3.15.1";
 
   src = fetchFromGitHub {
     owner = "digitalocean";
     repo = "do-agent";
     rev = version;
-    sha256 = "sha256-hwNr/yb41vd0cuLGsGJYEbBLE6WHay9d4TUp7fbN8Es=";
+    sha256 = "sha256-a3/zwBxxTdcDQkvKb/Fj1M2U1qhKRXg7dtRzEgkKCu0=";
   };
 
   ldflags = [
diff --git a/pkgs/servers/owncast/default.nix b/pkgs/servers/owncast/default.nix
index 4b3e36928a96..428b0253e8ca 100644
--- a/pkgs/servers/owncast/default.nix
+++ b/pkgs/servers/owncast/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "owncast";
-  version = "0.0.12";
+  version = "0.0.13";
 
   src = fetchFromGitHub {
     owner = "owncast";
     repo = "owncast";
     rev = "v${version}";
-    sha256 = "sha256-i/MxF+8ytpbVzGyRLbfHx7sR2bHEvAYdiwAc5TNrafc=";
+    sha256 = "sha256-hbZtdJbCB+67KXtApSRAO7Srye+UO0FbilKftQH6ESE=";
   };
 
   vendorSha256 = "sha256-sQRNf+eT9JUbYne/3E9LoY0K+c7MlxtIbGmTa3VkHvI=";
diff --git a/pkgs/servers/roon-server/default.nix b/pkgs/servers/roon-server/default.nix
index 1558cd863b10..a1ce5c876d36 100644
--- a/pkgs/servers/roon-server/default.nix
+++ b/pkgs/servers/roon-server/default.nix
@@ -15,7 +15,7 @@
 , stdenv
 }:
 let
-  version = "2.0-1148";
+  version = "2.0-1169";
   urlVersion = builtins.replaceStrings [ "." "-" ] [ "00" "0" ] version;
 in
 stdenv.mkDerivation {
@@ -24,7 +24,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://download.roonlabs.com/updates/production/RoonServer_linuxx64_${urlVersion}.tar.bz2";
-    hash = "sha256-TTewFN2VsBcoGwBwZ4wWRQd68nF0sfNHAcAOiyK/bd8=";
+    hash = "sha256-5XOE0XYKwlAuSgZ4iRISp2QcEN54LvYfL1OTZl3eWm0=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/servers/smcroute/default.nix b/pkgs/servers/smcroute/default.nix
index be504ec62ab8..2bebb4ecfc5d 100644
--- a/pkgs/servers/smcroute/default.nix
+++ b/pkgs/servers/smcroute/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "smcroute";
-  version = "2.5.5";
+  version = "2.5.6";
 
   src = fetchFromGitHub {
     owner = "troglobit";
     repo = "smcroute";
     rev = version;
-    sha256 = "sha256-kMK2XLyI9GG83gxjVh4I7wSMEPM5iJSmgtwVJNHn9OQ=";
+    sha256 = "sha256-I9kc1F+GZf8Gl0Wx3J45Bf/RyFTyHVhwDz5l+sp/2pc=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
diff --git a/pkgs/tools/admin/eksctl/default.nix b/pkgs/tools/admin/eksctl/default.nix
index 10e942e847c4..45c6d69a5737 100644
--- a/pkgs/tools/admin/eksctl/default.nix
+++ b/pkgs/tools/admin/eksctl/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "eksctl";
-  version = "0.121.0";
+  version = "0.122.0";
 
   src = fetchFromGitHub {
     owner = "weaveworks";
     repo = pname;
     rev = version;
-    sha256 = "sha256-PeUmOFtsca8SLeHHOjYVJURAsbWpLWNfSEPUXYsQhSE=";
+    sha256 = "sha256-NvUnLnACQCBvIiM3a0dtTUhfr9P3Ra9TX5Gy4Pj0tww=";
   };
 
-  vendorSha256 = "sha256-S1gnnhI0U7OLd6vEW5qpxGAiOdORYWsEst11Vfj6pdI=";
+  vendorSha256 = "sha256-qc2i4bfasTBzndsxbMk6xRhtbgmbBAvuyBgUMeIiHaA=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/filesystems/fuse-overlayfs/default.nix b/pkgs/tools/filesystems/fuse-overlayfs/default.nix
index b874d038aa6b..067cfd5e2ed4 100644
--- a/pkgs/tools/filesystems/fuse-overlayfs/default.nix
+++ b/pkgs/tools/filesystems/fuse-overlayfs/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fuse-overlayfs";
-  version = "1.9";
+  version = "1.10";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-+LuA9gSdVmt4iEJyeg6HbddD2YsKmkV/MJQbAgg/vJQ=";
+    sha256 = "sha256-l48VZ+CNw2O66A2kcxvnyDafsXdYfBCZdFK3bMHPsCA=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
diff --git a/pkgs/tools/misc/eget/default.nix b/pkgs/tools/misc/eget/default.nix
index c989f31ef5c7..f67c77c909c6 100644
--- a/pkgs/tools/misc/eget/default.nix
+++ b/pkgs/tools/misc/eget/default.nix
@@ -10,13 +10,13 @@
 
 buildGoModule rec {
   pname = "eget";
-  version = "1.3.0";
+  version = "1.3.1";
 
   src = fetchFromGitHub {
     owner = "zyedidia";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-U4sfcmdv1LPddeLjV/eANdxysnOX8bd3PiJpMIDi6PE=";
+    sha256 = "sha256-ahmvsSBR/WhKhBSMc+GE3RfuGK6wJIKSvqXPcff1HAI=";
   };
 
   vendorSha256 = "sha256-J8weaJSC+k8BnijG2Jm2GYUZmEhASrrCDxb46ZGmCMI=";
diff --git a/pkgs/tools/misc/esphome/default.nix b/pkgs/tools/misc/esphome/default.nix
index 607db114d9fb..94f2ec3ed402 100644
--- a/pkgs/tools/misc/esphome/default.nix
+++ b/pkgs/tools/misc/esphome/default.nix
@@ -15,14 +15,14 @@ let
 in
 with python.pkgs; buildPythonApplication rec {
   pname = "esphome";
-  version = "2022.11.3";
+  version = "2022.11.4";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-Qu8QjItfFzB5uCdvmyYrsq9FRmI0S7/xH2LX1dKM28c=";
+    hash = "sha256-sQ6uKAsXNQ1mZYvrJpUcS4bYAGg1pzqp0KB2ceePbqY=";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/text/diffsitter/default.nix b/pkgs/tools/text/diffsitter/default.nix
index a3df1d6a2278..5ed1d84daffb 100644
--- a/pkgs/tools/text/diffsitter/default.nix
+++ b/pkgs/tools/text/diffsitter/default.nix
@@ -32,17 +32,17 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "diffsitter";
-  version = "0.7.1";
+  version = "0.7.2";
 
   src = fetchFromGitHub {
     owner = "afnanenayet";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-fDuJMpMseGVKfgg/ERb7dHUZ9n5McYVJLBvuroLZDqE=";
+    sha256 = "sha256-oHG2vw981r9FZSwbJ+xcLemfQSMDrk6PAr/qtyImM04=";
     fetchSubmodules = false;
   };
 
-  cargoSha256 = "sha256-HmL7Xopj0gSokjyQY4Umy+5HKUKdRdBE7glMbrsk00c=";
+  cargoSha256 = "sha256-Cj9jdeeJNR/7mquEfaQCsFgiCjyJbZaaSkOzbU64T3U=";
 
   buildNoDefaultFeatures = true;
   buildFeatures = [