diff --git a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
index 245250e70914..02201861234b 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
@@ -2130,6 +2130,13 @@ sudo mkdir /var/lib/redis-peertube
 sudo cp /var/lib/redis/dump.rdb /var/lib/redis-peertube/dump.rdb
 </programlisting>
       </listitem>
+      <listitem>
+        <para>
+          Added the <literal>keter</literal> NixOS module. Keter reverse
+          proxies requests to your loaded application based on virtual
+          hostnames.
+        </para>
+      </listitem>
       <listitem>
         <para>
           If you are using Wayland you can choose to use the Ozone
diff --git a/nixos/doc/manual/release-notes/rl-2205.section.md b/nixos/doc/manual/release-notes/rl-2205.section.md
index e83a7cd43b87..2d2140d92d59 100644
--- a/nixos/doc/manual/release-notes/rl-2205.section.md
+++ b/nixos/doc/manual/release-notes/rl-2205.section.md
@@ -778,6 +778,7 @@ In addition to numerous new and upgraded packages, this release has the followin
   sudo mkdir /var/lib/redis-peertube
   sudo cp /var/lib/redis/dump.rdb /var/lib/redis-peertube/dump.rdb
   ```
+- Added the `keter` NixOS module. Keter reverse proxies requests to your loaded application based on virtual hostnames.
 
 - If you are using Wayland you can choose to use the Ozone Wayland support
   in Chrome and several Electron apps by setting the environment variable
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 82c4d69a7880..73b7bfe9256c 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1138,6 +1138,7 @@
   ./services/web-servers/pomerium.nix
   ./services/web-servers/unit/default.nix
   ./services/web-servers/tomcat.nix
+  ./services/web-servers/keter
   ./services/web-servers/traefik.nix
   ./services/web-servers/trafficserver/default.nix
   ./services/web-servers/ttyd.nix
diff --git a/nixos/modules/services/web-servers/keter/bundle.nix b/nixos/modules/services/web-servers/keter/bundle.nix
new file mode 100644
index 000000000000..32b08c3be206
--- /dev/null
+++ b/nixos/modules/services/web-servers/keter/bundle.nix
@@ -0,0 +1,40 @@
+/* This makes a keter bundle as described on the github page:
+  https://github.com/snoyberg/keter#bundling-your-app-for-keter
+*/
+{ keterDomain
+, keterExecutable
+, gnutar
+, writeTextFile
+, lib
+, stdenv
+, ...
+}:
+
+let
+  str.stanzas = [{
+    # we just use nix as an absolute path so we're not bundling any binaries
+    type = "webapp";
+    /* Note that we're not actually putting the executable in the bundle,
+      we already can use the nix store for copying, so we just
+      symlink to the app. */
+    exec = keterExecutable;
+    host = keterDomain;
+  }];
+  configFile = writeTextFile {
+    name = "keter.yml";
+    text = (lib.generators.toYAML { } str);
+  };
+
+in
+stdenv.mkDerivation {
+  name = "keter-bundle";
+  buildCommand = ''
+    mkdir -p config
+    cp ${configFile} config/keter.yaml
+
+    echo 'create a gzipped tarball'
+    mkdir -p $out
+    tar -zcvf $out/bundle.tar.gz.keter ./.
+  '';
+  buildInputs = [ gnutar ];
+}
diff --git a/nixos/modules/services/web-servers/keter/default.nix b/nixos/modules/services/web-servers/keter/default.nix
new file mode 100644
index 000000000000..83e221add37e
--- /dev/null
+++ b/nixos/modules/services/web-servers/keter/default.nix
@@ -0,0 +1,162 @@
+{ config, pkgs, lib, ... }:
+let
+  cfg = config.services.keter;
+in
+{
+  meta = {
+    maintainers = with lib.maintainers; [ jappie ];
+  };
+
+  options.services.keter = {
+    enable = lib.mkEnableOption ''keter, a web app deployment manager.
+Note that this module only support loading of webapps:
+Keep an old app running and swap the ports when the new one is booted.
+'';
+
+    keterRoot = lib.mkOption {
+      type = lib.types.str;
+      default = "/var/lib/keter";
+      description = "Mutable state folder for keter";
+    };
+
+    keterPackage = lib.mkOption {
+      type = lib.types.package;
+      default = pkgs.haskellPackages.keter;
+      defaultText = lib.literalExpression "pkgs.haskellPackages.keter";
+      description = "The keter package to be used";
+    };
+
+    globalKeterConfig = lib.mkOption {
+      type = lib.types.attrs;
+      default = {
+        ip-from-header = true;
+        listeners = [{
+          host = "*4";
+          port = 6981;
+        }];
+      };
+      # You want that ip-from-header in the nginx setup case
+      # so it's not set to 127.0.0.1.
+      # using a port above 1024 allows you to avoid needing CAP_NET_BIND_SERVICE
+      defaultText = lib.literalExpression ''
+        {
+          ip-from-header = true;
+          listeners = [{
+            host = "*4";
+            port = 6981;
+          }];
+        }
+      '';
+      description = "Global config for keter";
+    };
+
+    bundle = {
+      appName = lib.mkOption {
+        type = lib.types.str;
+        default = "myapp";
+        description = "The name keter assigns to this bundle";
+      };
+
+      executable = lib.mkOption {
+        type = lib.types.path;
+        description = "The executable to be run";
+      };
+
+      domain = lib.mkOption {
+        type = lib.types.str;
+        default = "example.com";
+        description = "The domain keter will bind to";
+      };
+
+      publicScript = lib.mkOption {
+        type = lib.types.str;
+        default = "";
+        description = ''
+          Allows loading of public environment variables,
+          these are emitted to the log so it shouldn't contain secrets.
+        '';
+        example = "ADMIN_EMAIL=hi@example.com";
+      };
+
+      secretScript = lib.mkOption {
+        type = lib.types.str;
+        default = "";
+        description = "Allows loading of private environment variables";
+        example = "MY_AWS_KEY=$(cat /run/keys/AWS_ACCESS_KEY_ID)";
+      };
+    };
+
+  };
+
+  config = lib.mkIf cfg.enable (
+    let
+      incoming = "${cfg.keterRoot}/incoming";
+
+
+      globalKeterConfigFile = pkgs.writeTextFile {
+        name = "keter-config.yml";
+        text = (lib.generators.toYAML { } (cfg.globalKeterConfig // { root = cfg.keterRoot; }));
+      };
+
+      # If things are expected to change often, put it in the bundle!
+      bundle = pkgs.callPackage ./bundle.nix
+        (cfg.bundle // { keterExecutable = executable; keterDomain = cfg.bundle.domain; });
+
+      # This indirection is required to ensure the nix path
+      # gets copied over to the target machine in remote deployments.
+      # Furthermore, it's important that we use exec to
+      # run the binary otherwise we get process leakage due to this
+      # being executed on every change.
+      executable = pkgs.writeShellScript "bundle-wrapper" ''
+        set -e
+        ${cfg.bundle.secretScript}
+        set -xe
+        ${cfg.bundle.publicScript}
+        exec ${cfg.bundle.executable}
+      '';
+
+    in
+    {
+      systemd.services.keter = {
+        description = "keter app loader";
+        script = ''
+          set -xe
+          mkdir -p ${incoming}
+          { tail -F ${cfg.keterRoot}/log/keter/current.log -n 0 & ${cfg.keterPackage}/bin/keter ${globalKeterConfigFile}; }
+        '';
+        wantedBy = [ "multi-user.target" "nginx.service" ];
+
+        serviceConfig = {
+          Restart = "always";
+          RestartSec = "10s";
+        };
+
+        after = [
+          "network.target"
+          "local-fs.target"
+          "postgresql.service"
+        ];
+      };
+
+      # On deploy this will load our app, by moving it into the incoming dir
+      # If the bundle content changes, this will run again.
+      # Because the bundle content contains the nix path to the exectuable,
+      # we inherit nix based cache busting.
+      systemd.services.load-keter-bundle = {
+        description = "load keter bundle into incoming folder";
+        after = [ "keter.service" ];
+        wantedBy = [ "multi-user.target" ];
+        # we can't override keter bundles because it'll stop the previous app
+        # https://github.com/snoyberg/keter#deploying
+        script = ''
+          set -xe
+          cp ${bundle}/bundle.tar.gz.keter ${incoming}/${cfg.bundle.appName}.keter
+        '';
+        path = [
+          executable
+          cfg.bundle.executable
+        ]; # this is a hack to get the executable copied over to the machine.
+      };
+    }
+  );
+}
diff --git a/nixos/modules/virtualisation/libvirtd.nix b/nixos/modules/virtualisation/libvirtd.nix
index f7d0ef39c5af..817d7180a022 100644
--- a/nixos/modules/virtualisation/libvirtd.nix
+++ b/nixos/modules/virtualisation/libvirtd.nix
@@ -293,7 +293,7 @@ in
         # Copy default libvirt network config .xml files to /var/lib
         # Files modified by the user will not be overwritten
         for i in $(cd ${cfg.package}/var/lib && echo \
-            libvirt/qemu/networks/*.xml libvirt/qemu/networks/autostart/*.xml \
+            libvirt/qemu/networks/*.xml \
             libvirt/nwfilter/*.xml );
         do
             mkdir -p /var/lib/$(dirname $i) -m 755
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 43fb4d2bd238..048a3fec7278 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -267,6 +267,7 @@ in {
   kerberos = handleTest ./kerberos/default.nix {};
   kernel-generic = handleTest ./kernel-generic.nix {};
   kernel-latest-ath-user-regd = handleTest ./kernel-latest-ath-user-regd.nix {};
+  keter = handleTest ./keter.nix {};
   kexec = handleTest ./kexec.nix {};
   keycloak = discoverTests (import ./keycloak.nix);
   keymap = handleTest ./keymap.nix {};
diff --git a/nixos/tests/keter.nix b/nixos/tests/keter.nix
new file mode 100644
index 000000000000..0bfb96e1c324
--- /dev/null
+++ b/nixos/tests/keter.nix
@@ -0,0 +1,42 @@
+import ./make-test-python.nix ({ pkgs, ... }:
+let
+  port = 81;
+in
+{
+  name = "keter";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ jappie ];
+  };
+
+
+  nodes.machine = { config, pkgs, ... }: {
+    services.keter = {
+      enable = true;
+
+      globalKeterConfig = {
+        listeners = [{
+          host = "*4";
+          inherit port;
+        }];
+      };
+      bundle = {
+        appName = "test-bundle";
+        domain = "localhost";
+        executable = pkgs.writeShellScript "run" ''
+          ${pkgs.python3}/bin/python -m http.server $PORT
+        '';
+      };
+    };
+  };
+
+  testScript =
+    ''
+      machine.wait_for_unit("keter.service")
+
+      machine.wait_for_open_port(${toString port})
+      machine.wait_for_console_text("Activating app test-bundle with hosts: localhost")
+
+
+      machine.succeed("curl --fail http://localhost:${toString port}/")
+    '';
+})
diff --git a/pkgs/applications/graphics/ImageMagick/default.nix b/pkgs/applications/graphics/ImageMagick/default.nix
index 92b8164f8b65..5444bbc0bd41 100644
--- a/pkgs/applications/graphics/ImageMagick/default.nix
+++ b/pkgs/applications/graphics/ImageMagick/default.nix
@@ -46,13 +46,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "imagemagick";
-  version = "7.1.0-45";
+  version = "7.1.0-46";
 
   src = fetchFromGitHub {
     owner = "ImageMagick";
     repo = "ImageMagick";
     rev = version;
-    hash = "sha256-fiygwb15dbMyTZ62iWbhWaHpdmoK4rKeb46v0sojgpc=";
+    hash = "sha256-yts86tQMPgdF9Zk1vljVza21mlx1g3XcoHjvtsMoZhA=";
   };
 
   outputs = [ "out" "dev" "doc" ]; # bin/ isn't really big
diff --git a/pkgs/applications/misc/kanboard/default.nix b/pkgs/applications/misc/kanboard/default.nix
index 49e8688cb59c..10b08bed506d 100644
--- a/pkgs/applications/misc/kanboard/default.nix
+++ b/pkgs/applications/misc/kanboard/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Kanban project management software";
-    homepage = "https://kanboard.net";
+    homepage = "https://kanboard.org";
     license = licenses.mit;
     maintainers = with maintainers; [ lheckemann ];
   };
diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.json b/pkgs/applications/networking/browsers/chromium/upstream-info.json
index 2a617587775c..9aa1d9c8c5c6 100644
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.json
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json
@@ -1,8 +1,8 @@
 {
   "stable": {
-    "version": "104.0.5112.79",
-    "sha256": "1wxb3nl080wgg1g61g3pgzz3gaawg442iv8pxqhnayacm3qn5ilw",
-    "sha256bin64": "1m09bbh6a4sm5i0n8z2wy0hb8s7w0c2d335mpyrmndzs45py5ggx",
+    "version": "104.0.5112.101",
+    "sha256": "0nrghgngxdn9richjnxii9y94dg5zpwc3gd3vx609r4xaphibw30",
+    "sha256bin64": "1cj2mi3g5wl376wc52jgqg28h7izbsqm2gji526zkhmgb7rwq4sw",
     "deps": {
       "gn": {
         "version": "2022-06-08",
@@ -19,9 +19,9 @@
     }
   },
   "beta": {
-    "version": "105.0.5195.28",
-    "sha256": "14hy1f59ypsvqmrp0k4kv5cfcw48dizw4nkmigaxxv4bnmpwlcy1",
-    "sha256bin64": "0rgv1r94z91khzwmf1scnnsz9yqks6ygicl7bdsdbckw69njq91z",
+    "version": "105.0.5195.37",
+    "sha256": "0ffzphr66z3g3l695b5liswpfp0577knn06mzdmwq9x1lk87cwiq",
+    "sha256bin64": "1cfkjzqwj4s5djzl2rka9kbc28i6zph0xqv1534cb68hzgwy171a",
     "deps": {
       "gn": {
         "version": "2022-07-11",
diff --git a/pkgs/applications/networking/cluster/werf/default.nix b/pkgs/applications/networking/cluster/werf/default.nix
index c632df6396be..43c7b6b1396e 100644
--- a/pkgs/applications/networking/cluster/werf/default.nix
+++ b/pkgs/applications/networking/cluster/werf/default.nix
@@ -11,13 +11,13 @@
 
 buildGoModule rec {
   pname = "werf";
-  version = "1.2.154";
+  version = "1.2.160";
 
   src = fetchFromGitHub {
     owner = "werf";
     repo = "werf";
     rev = "v${version}";
-    sha256 = "sha256-5tiJRxE8W2nvkQdJ3jL8P0+7LXEfNOdL15LdDjlDWpc=";
+    sha256 = "sha256-UeZpH6A/N+frShOOVeRCsIXdBKiI0chsxQvsGJF5JwE=";
   };
 
   vendorSha256 = "sha256-XpSAFiweD2oUKleD6ztDp1+3PpfUWXfGaaE/9mzRrUQ=";
diff --git a/pkgs/applications/version-management/git-and-tools/git-machete/default.nix b/pkgs/applications/version-management/git-and-tools/git-machete/default.nix
index 9577d1c41fd0..b5c251f247af 100644
--- a/pkgs/applications/version-management/git-and-tools/git-machete/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-machete/default.nix
@@ -12,13 +12,13 @@
 
 buildPythonApplication rec {
   pname = "git-machete";
-  version = "3.11.6";
+  version = "3.12.0";
 
   src = fetchFromGitHub {
     owner = "virtuslab";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-W2OYJO3UnBcZRoIyTRj3Wz7J91zDWrrYPH5OnYvXi24=";
+    sha256 = "sha256-o4OVA9cv+/JLiTUnDEAI/yj+YmOulFrX5XmlRZAb2vw=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
diff --git a/pkgs/build-support/dotnet/build-dotnet-module/default.nix b/pkgs/build-support/dotnet/build-dotnet-module/default.nix
index 1a5d499929ac..62820e8d47ee 100644
--- a/pkgs/build-support/dotnet/build-dotnet-module/default.nix
+++ b/pkgs/build-support/dotnet/build-dotnet-module/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenvNoCC, linkFarmFromDrvs, callPackage, nuget-to-nix, writeScript, makeWrapper, fetchurl, xml2, dotnetCorePackages, dotnetPackages, mkNugetSource, mkNugetDeps, cacert, srcOnly, symlinkJoin }:
+{ lib, stdenvNoCC, linkFarmFromDrvs, callPackage, nuget-to-nix, writeScript, makeWrapper, fetchurl, xml2, dotnetCorePackages, dotnetPackages, mkNugetSource, mkNugetDeps, cacert, srcOnly, symlinkJoin, coreutils }:
 
 { name ? "${args.pname}-${args.version}"
 , pname ? name
@@ -138,6 +138,8 @@ in stdenvNoCC.mkDerivation (args // {
       exclusions = dotnet-sdk.passthru.packages { fetchNuGet = attrs: attrs.pname; };
     in writeScript "fetch-${pname}-deps" ''
       set -euo pipefail
+      export PATH="${lib.makeBinPath [ coreutils dotnet-sdk nuget-to-nix ]}"
+
       cd "$(dirname "''${BASH_SOURCE[0]}")"
 
       export HOME=$(mktemp -d)
@@ -157,7 +159,7 @@ in stdenvNoCC.mkDerivation (args // {
       mkdir -p "$HOME/nuget_pkgs"
 
       for project in "${lib.concatStringsSep "\" \"" ((lib.toList projectFile) ++ lib.optionals (testProjectFile != "") (lib.toList testProjectFile))}"; do
-        ${dotnet-sdk}/bin/dotnet restore "$project" \
+        dotnet restore "$project" \
           ${lib.optionalString (!enableParallelBuilding) "--disable-parallel"} \
           -p:ContinuousIntegrationBuild=true \
           -p:Deterministic=true \
@@ -169,7 +171,7 @@ in stdenvNoCC.mkDerivation (args // {
       echo "${lib.concatStringsSep "\n" exclusions}" > "$HOME/package_exclusions"
 
       echo "Writing lockfile..."
-      ${nuget-to-nix}/bin/nuget-to-nix "$HOME/nuget_pkgs" "$HOME/package_exclusions" > "$deps_file"
+      nuget-to-nix "$HOME/nuget_pkgs" "$HOME/package_exclusions" > "$deps_file"
       echo "Succesfully wrote lockfile to: $deps_file"
     '';
   } // args.passthru or {};
diff --git a/pkgs/data/icons/numix-icon-theme/default.nix b/pkgs/data/icons/numix-icon-theme/default.nix
index 576fa405e06f..18ba78ac24ec 100644
--- a/pkgs/data/icons/numix-icon-theme/default.nix
+++ b/pkgs/data/icons/numix-icon-theme/default.nix
@@ -1,25 +1,43 @@
-{ lib, stdenvNoCC, fetchFromGitHub, gtk3, gnome-icon-theme, hicolor-icon-theme }:
+{ lib
+, stdenvNoCC
+, fetchFromGitHub
+, gtk3
+, adwaita-icon-theme
+, breeze-icons
+, gnome-icon-theme
+, hicolor-icon-theme
+, gitUpdater
+}:
 
 stdenvNoCC.mkDerivation rec {
   pname = "numix-icon-theme";
-  version = "21.10.31";
+  version = "22.08.16";
 
   src = fetchFromGitHub {
     owner = "numixproject";
     repo = pname;
     rev = version;
-    sha256 = "sha256-wyVvXifdbKR2aiBMrki8y/H0khH4eFD1RHVSC+jAT28=";
+    sha256 = "sha256-EveIr5XYyQYhz0AqZQBql3j0LnD8taNdzB/6IV7Mz2k=";
   };
 
-  nativeBuildInputs = [ gtk3 ];
+  nativeBuildInputs = [
+    gtk3
+  ];
 
-  propagatedBuildInputs = [ gnome-icon-theme hicolor-icon-theme ];
+  propagatedBuildInputs = [
+    adwaita-icon-theme
+    breeze-icons
+    gnome-icon-theme
+    hicolor-icon-theme
+  ];
 
   dontDropIconThemeCache = true;
 
   installPhase = ''
     runHook preInstall
 
+    substituteInPlace Numix/index.theme --replace Breeze breeze
+
     mkdir -p $out/share/icons
     cp -a Numix{,-Light} $out/share/icons/
 
@@ -30,6 +48,8 @@ stdenvNoCC.mkDerivation rec {
     runHook postInstall
   '';
 
+  passthru.updateScript = gitUpdater { inherit pname version; };
+
   meta = with lib; {
     description = "Numix icon theme";
     homepage = "https://numixproject.github.io";
diff --git a/pkgs/desktops/xfce/applications/xfce4-screenshooter/default.nix b/pkgs/desktops/xfce/applications/xfce4-screenshooter/default.nix
index 1e8a9230661f..7beeb0ff87f2 100644
--- a/pkgs/desktops/xfce/applications/xfce4-screenshooter/default.nix
+++ b/pkgs/desktops/xfce/applications/xfce4-screenshooter/default.nix
@@ -1,14 +1,31 @@
-{ lib, mkXfceDerivation, exo, gtk3, libsoup, libxfce4ui, libxfce4util, xfce4-panel, glib-networking }:
+{ lib
+, mkXfceDerivation
+, exo
+, glib-networking
+, gtk3
+, libsoup
+, libxfce4ui
+, libxfce4util
+, xfce4-panel
+}:
 
 mkXfceDerivation {
   category = "apps";
   pname = "xfce4-screenshooter";
-  version = "1.9.10";
+  version = "1.9.11";
   odd-unstable = false;
 
-  sha256 = "sha256-i3QdQij58JYv3fWdESUeTV0IW3A8RVGNtmuxUc6FUMg=";
+  sha256 = "sha256-sW0SEXypCcly7MlO9lnxHTkYwIiRt+gOME5UQ++Y3JQ=";
 
-  buildInputs = [ exo gtk3 libsoup libxfce4ui libxfce4util xfce4-panel glib-networking ];
+  buildInputs = [
+    exo
+    glib-networking
+    gtk3
+    libsoup
+    libxfce4ui
+    libxfce4util
+    xfce4-panel
+  ];
 
   meta = with lib; {
     description = "Screenshot utility for the Xfce desktop";
diff --git a/pkgs/desktops/xfce/applications/xfdashboard/default.nix b/pkgs/desktops/xfce/applications/xfdashboard/default.nix
index ee09d6196c78..fd92e2c92e8f 100644
--- a/pkgs/desktops/xfce/applications/xfdashboard/default.nix
+++ b/pkgs/desktops/xfce/applications/xfdashboard/default.nix
@@ -18,11 +18,10 @@
 mkXfceDerivation {
   category = "apps";
   pname = "xfdashboard";
-  version = "0.9.5";
+  version = "1.0.0";
   rev-prefix = "";
-  odd-unstable = false;
 
-  sha256 = "sha256-nb1zY78MUjEOJF59MYIOY1rxo3JFmzH9yTJVUGsOwOA=";
+  sha256 = "sha256-iC41I0u9id9irUNyjuvRRzSldF3dzRYkaxb/fgptnq4=";
 
   buildInputs = [
     clutter
diff --git a/pkgs/desktops/xfce/core/tumbler/default.nix b/pkgs/desktops/xfce/core/tumbler/default.nix
index 26a28b9b426d..ee5413fdda5a 100644
--- a/pkgs/desktops/xfce/core/tumbler/default.nix
+++ b/pkgs/desktops/xfce/core/tumbler/default.nix
@@ -14,9 +14,9 @@
 mkXfceDerivation {
   category = "xfce";
   pname = "tumbler";
-  version = "4.16.0";
+  version = "4.16.1";
 
-  sha256 = "sha256-JLcmYjStF9obDoRHsxnZ1e9HPTeJUVKjnn5Ip1BBmPw=";
+  sha256 = "sha256-f2pCItNHTB0ggovIddpwNWEhaohfxD2otN8x9VfwR4k=";
 
   buildInputs = [
     ffmpegthumbnailer
diff --git a/pkgs/development/compilers/openjdk/17.nix b/pkgs/development/compilers/openjdk/17.nix
index 1bd6431961b8..592a204a52d6 100644
--- a/pkgs/development/compilers/openjdk/17.nix
+++ b/pkgs/development/compilers/openjdk/17.nix
@@ -11,8 +11,8 @@
 let
   version = {
     feature = "17";
-    interim = ".0.3";
-    build = "7";
+    interim = ".0.4";
+    build = "8";
   };
 
   openjdk = stdenv.mkDerivation {
@@ -23,7 +23,7 @@ let
       owner = "openjdk";
       repo = "jdk${version.feature}u";
       rev = "jdk-${version.feature}${version.interim}+${version.build}";
-      sha256 = "qxiKz8HCNZXFdfgfiA16q5z0S65cZE/u7e+QxLlplWo=";
+      sha256 = "drbljLz82ZyK29lIDLPqCkwqpBdgU/7zCTZ0ceeb1SI=";
     };
 
     nativeBuildInputs = [ pkg-config autoconf unzip ];
diff --git a/pkgs/development/libraries/ldns/default.nix b/pkgs/development/libraries/ldns/default.nix
index 6712d7c6d3c0..ba0c5e606ffc 100644
--- a/pkgs/development/libraries/ldns/default.nix
+++ b/pkgs/development/libraries/ldns/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ldns";
-  version = "1.8.1";
+  version = "1.8.3";
 
   src = fetchurl {
     url = "https://www.nlnetlabs.nl/downloads/ldns/${pname}-${version}.tar.gz";
-    sha256 = "sha256-lYIpq85NOqoZp1wNEnZmVksXIWkCGG6VLKSu9Hxtf6M=";
+    sha256 = "sha256-w/ct0QNrKQfjpW5qz537LlUSVrPBu9l4eULe7rcOeGA=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/libraries/libyang/default.nix b/pkgs/development/libraries/libyang/default.nix
index 8cc4ad06e356..45c535d81bf3 100644
--- a/pkgs/development/libraries/libyang/default.nix
+++ b/pkgs/development/libraries/libyang/default.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libyang";
-  version = "2.0.194";
+  version = "2.0.231";
 
   src = fetchFromGitHub {
     owner = "CESNET";
     repo = "libyang";
     rev = "v${version}";
-    sha256 = "sha256-5dgSBXJIeGXT+jGqT2MFqtsEFcIn+ULjybnyXz+95Gk=";
+    sha256 = "sha256-IntucM8ABJsJNH7XnZ59McwmfSIimclrWzSz4NKdMrE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/physics/geant4/default.nix b/pkgs/development/libraries/physics/geant4/default.nix
index 1bed1362bac6..3315e5a535ae 100644
--- a/pkgs/development/libraries/physics/geant4/default.nix
+++ b/pkgs/development/libraries/physics/geant4/default.nix
@@ -88,11 +88,11 @@ stdenv.mkDerivation rec {
   ];
   dontWrapQtApps = true; # no binaries
 
-  buildInputs = [ clhep libGLU xlibsWrapper libXmu ]
+  buildInputs = [ libGLU xlibsWrapper libXmu ]
     ++ lib.optionals enableInventor [ libXpm coin3d soxt motif ]
     ++ lib.optionals enablePython [ boost_python python3 ];
 
-  propagatedBuildInputs = [ expat xercesc zlib libGL ]
+  propagatedBuildInputs = [ clhep expat xercesc zlib libGL ]
     ++ lib.optionals enableXM [ motif ]
     ++ lib.optionals enableQt [ qtbase ];
 
diff --git a/pkgs/development/libraries/spectra/default.nix b/pkgs/development/libraries/spectra/default.nix
new file mode 100644
index 000000000000..1fc3ccd75765
--- /dev/null
+++ b/pkgs/development/libraries/spectra/default.nix
@@ -0,0 +1,30 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, eigen
+}:
+
+stdenv.mkDerivation rec {
+  pname = "spectra";
+  version = "1.0.1";
+
+  src = fetchFromGitHub {
+    owner = "yixuan";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-HaJmMo4jYmO/j53/nHrL3bvdQMAvp4Nuhhe8Yc7pL88=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  propagatedBuildInputs = [ eigen ];
+
+  meta = with lib; {
+    homepage = "https://spectralib.org/";
+    description = "A C++ library for large scale eigenvalue problems, built on top of Eigen";
+    license = licenses.mpl20;
+    maintainers = with maintainers; [ vonfry ];
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/development/python-modules/asdf/default.nix b/pkgs/development/python-modules/asdf/default.nix
index b34001d866eb..253ec1b71ce2 100644
--- a/pkgs/development/python-modules/asdf/default.nix
+++ b/pkgs/development/python-modules/asdf/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage rec {
   pname = "asdf";
-  version = "2.12.0";
+  version = "2.12.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-WRSDTQd7o79ouar9xka58nzl5W4cJBFn1GHe5DsQI+k=";
+    hash = "sha256-0qXRYWXKC17JiL1D+jjuGVoOGAJuGbJje7OZyd2k3o8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/fipy/default.nix b/pkgs/development/python-modules/fipy/default.nix
index 57835019d5de..7e08fa87fd58 100644
--- a/pkgs/development/python-modules/fipy/default.nix
+++ b/pkgs/development/python-modules/fipy/default.nix
@@ -3,27 +3,27 @@
 , numpy
 , scipy
 , pyamg
-, pysparse
 , future
 , matplotlib
 , tkinter
 , mpi4py
 , scikit-fmm
-, isPy27
 , gmsh
 , python
 , stdenv
 , openssh
-, fetchurl
+, fetchFromGitHub
 }:
 
 buildPythonPackage rec {
   pname = "fipy";
-  version = "3.4.2.1";
+  version = "3.4.3";
 
-  src = fetchurl {
-    url = "https://github.com/usnistgov/fipy/releases/download/${version}/FiPy-${version}.tar.gz";
-    sha256 = "0v5yk9b4hksy3176w4vm4gagb9kxqgv75zcyswlqvl371qwy1grk";
+  src = fetchFromGitHub {
+    owner = "usnistgov";
+    repo = "fipy";
+    rev = version;
+    sha256 = "sha256-oTg/5fGXqknWBh1ShdAOdOwX7lVDieIoM5aALcOWFqY=";
   };
 
   propagatedBuildInputs = [
@@ -36,14 +36,7 @@ buildPythonPackage rec {
     future
     scikit-fmm
     openssh
-  ] ++ lib.optionals isPy27 [ pysparse ]
-  ++ lib.optionals (!stdenv.isDarwin) [ gmsh ];
-
-  # Reading version string from Gmsh is broken in latest release of FiPy
-  # This issue is repaired on master branch of FiPy
-  # Fixed with: https://github.com/usnistgov/fipy/pull/848/files
-  # Remove patch with next release.
-  patches = [ ./gmsh.patch ];
+  ] ++ lib.optionals (!stdenv.isDarwin) [ gmsh ];
 
   checkInputs = lib.optionals (!stdenv.isDarwin) [ gmsh ];
 
@@ -52,6 +45,8 @@ buildPythonPackage rec {
     ${python.interpreter} setup.py test --modules
   '';
 
+  pythonImportsCheck = [ "fipy" ];
+
   meta = with lib; {
     homepage = "https://www.ctcms.nist.gov/fipy/";
     description = "A Finite Volume PDE Solver Using Python";
diff --git a/pkgs/development/python-modules/fipy/gmsh.patch b/pkgs/development/python-modules/fipy/gmsh.patch
deleted file mode 100644
index 7e7b687ac8c6..000000000000
--- a/pkgs/development/python-modules/fipy/gmsh.patch
+++ /dev/null
@@ -1,182 +0,0 @@
-diff --git a/fipy/meshes/gmshMesh.py b/fipy/meshes/gmshMesh.py
-index fc3ff6c8..d529d532 100755
---- a/fipy/meshes/gmshMesh.py
-+++ b/fipy/meshes/gmshMesh.py
-@@ -13,11 +13,11 @@ import sys
- import tempfile
- from textwrap import dedent
- import warnings
--from distutils.version import StrictVersion
- 
- from fipy.tools import numerix as nx
- from fipy.tools import parallelComm
- from fipy.tools import serialComm
-+from fipy.tools.version import Version, parse_version
- from fipy.tests.doctestPlus import register_skipper
- 
- from fipy.meshes.mesh import Mesh
-@@ -38,7 +38,7 @@ def _checkForGmsh():
-     hasGmsh = True
-     try:
-         version = _gmshVersion(communicator=parallelComm)
--        hasGmsh = version >= StrictVersion("2.0")
-+        hasGmsh = version >= Version("2.0")
-     except Exception:
-         hasGmsh = False
-     return hasGmsh
-@@ -68,6 +68,7 @@ def gmshVersion(communicator=parallelComm):
-         while True:
-             try:
-                 # gmsh returns version in stderr (Why?!?)
-+                # (newer versions of gmsh return the version in stdout)
-                 # spyder on Windows throws
-                 #   OSError: [WinError 6] The handle is invalid
-                 # if we don't PIPE stdout, too
-@@ -77,8 +78,11 @@ def gmshVersion(communicator=parallelComm):
-                 break
- 
-             try:
--                out, verStr = p.communicate()
--                verStr = verStr.decode('ascii').strip()
-+                out, err = p.communicate()
-+                verStr = err.decode('ascii').strip()
-+                if not verStr:
-+                    # newer versions of gmsh return the version in stdout
-+                    verStr = out.decode('ascii').strip()
-                 break
-             except IOError:
-                 # some weird conflict with things like PyQT can cause
-@@ -93,12 +97,12 @@ def gmshVersion(communicator=parallelComm):
- def _gmshVersion(communicator=parallelComm):
-     version = gmshVersion(communicator) or "0.0"
-     try:
--        version = StrictVersion(version)
-+        version = parse_version(version)
-     except ValueError:
-         # gmsh returns the version string in stderr,
-         # which means it's often unparsable due to irrelevant warnings
-         # assume it's OK and move on
--        version = StrictVersion("3.0")
-+        version = Version("3.0")
- 
-     return version
- 
-@@ -133,7 +137,7 @@ def openMSHFile(name, dimensions=None, coordDimensions=None, communicator=parall
- 
-     # Enforce gmsh version to be either >= 2 or 2.5, based on Nproc.
-     version = _gmshVersion(communicator=communicator)
--    if version < StrictVersion("2.0"):
-+    if version < Version("2.0"):
-         raise EnvironmentError("Gmsh version must be >= 2.0.")
- 
-     # If we're being passed a .msh file, leave it be. Otherwise,
-@@ -176,9 +180,11 @@ def openMSHFile(name, dimensions=None, coordDimensions=None, communicator=parall
-             gmshFlags = ["-%d" % dimensions, "-nopopup"]
- 
-             if communicator.Nproc > 1:
--                if not (StrictVersion("2.5") < version <= StrictVersion("4.0")):
--                    warnstr = "Cannot partition with Gmsh version < 2.5 or >= 4.0. " \
--                               + "Reverting to serial."
-+                if  ((version < Version("2.5"))
-+                     or (Version("4.0") <= version < Version("4.5.2"))):
-+                    warnstr = ("Cannot partition with Gmsh version < 2.5 "
-+                               "or 4.0 <= version < 4.5.2. "
-+                               "Reverting to serial.")
-                     warnings.warn(warnstr, RuntimeWarning, stacklevel=2)
-                     communicator = serialComm
- 
-@@ -188,13 +194,13 @@ def openMSHFile(name, dimensions=None, coordDimensions=None, communicator=parall
-                         raise ValueError("'dimensions' must be specified to generate a mesh from a geometry script")
-                 else: # gmsh version is adequate for partitioning
-                     gmshFlags += ["-part", "%d" % communicator.Nproc]
--                    if version >= StrictVersion("4.0"):
-+                    if version >= Version("4.0"):
-                         # Gmsh 4.x needs to be told to generate ghost cells
--                        # Unfortunately, the ghosts are broken
-+                        # Unfortunately, the ghosts are broken in Gmsh 4.0--4.5.1
-                         # https://gitlab.onelab.info/gmsh/gmsh/issues/733
-                         gmshFlags += ["-part_ghosts"]
- 
--            gmshFlags += ["-format", "msh2"]
-+            gmshFlags += ["-format", "msh2", "-smooth", "8"]
- 
-             if background is not None:
-                 if communicator.procID == 0:
-@@ -1387,6 +1393,11 @@ class _GmshTopology(_MeshTopology):
- class Gmsh2D(Mesh2D):
-     """Construct a 2D Mesh using Gmsh
- 
-+    If called in parallel, the mesh will be partitioned based on the value
-+    of `parallelComm.Nproc`.  If an `MSH` file is supplied, it must have
-+    been previously partitioned with the number of partitions matching
-+    `parallelComm.Nproc`.
-+
-     >>> radius = 5.
-     >>> side = 4.
-     >>> squaredCircle = Gmsh2D('''
-@@ -1875,6 +1886,11 @@ class Gmsh2D(Mesh2D):
- class Gmsh2DIn3DSpace(Gmsh2D):
-     """Create a topologically 2D Mesh in 3D coordinates using Gmsh
- 
-+    If called in parallel, the mesh will be partitioned based on the value
-+    of `parallelComm.Nproc`.  If an `MSH` file is supplied, it must have
-+    been previously partitioned with the number of partitions matching
-+    `parallelComm.Nproc`.
-+
-     Parameters
-     ----------
-     arg : str
-@@ -1959,6 +1975,11 @@ class Gmsh2DIn3DSpace(Gmsh2D):
- class Gmsh3D(Mesh):
-     """Create a 3D Mesh using Gmsh
- 
-+    If called in parallel, the mesh will be partitioned based on the value
-+    of `parallelComm.Nproc`.  If an `MSH` file is supplied, it must have
-+    been previously partitioned with the number of partitions matching
-+    `parallelComm.Nproc`.
-+
-     Parameters
-     ----------
-     arg : str
-@@ -2225,7 +2246,7 @@ class GmshGrid2D(Gmsh2D):
-         width  = nx * dx
-         numLayers = int(ny / float(dy))
- 
--        if _gmshVersion() < StrictVersion("2.7"):
-+        if _gmshVersion() < Version("2.7"):
-             # kludge: must offset cellSize by `eps` to work properly
-             eps = float(dx)/(nx * 10)
-         else:
-@@ -2299,7 +2320,7 @@ class GmshGrid3D(Gmsh3D):
-         width  = nx * dx
-         depth  = nz * dz
- 
--        if _gmshVersion() < StrictVersion("2.7"):
-+        if _gmshVersion() < Version("2.7"):
-             # kludge: must offset cellSize by `eps` to work properly
-             eps = float(dx)/(nx * 10)
-         else:
-diff --git a/fipy/tools/version.py b/fipy/tools/version.py
-new file mode 100644
-index 00000000..93d89c18
---- /dev/null
-+++ b/fipy/tools/version.py
-@@ -0,0 +1,18 @@
-+"""Shim for version checking
-+
-+`distutils.version` is deprecated, but `packaging.version` is unavailable
-+in Python 2.7
-+"""
-+from __future__ import unicode_literals
-+
-+__docformat__ = 'restructuredtext'
-+
-+
-+__all__ = ["Version", "parse_version"]
-+from future.utils import text_to_native_str
-+__all__ = [text_to_native_str(n) for n in __all__]
-+
-+try:
-+    from packaging.version import Version, parse as parse_version
-+except ImportError:
-+    from distutils.version import StrictVersion as Version, StrictVersion as parse_version    
diff --git a/pkgs/development/python-modules/nbclassic/default.nix b/pkgs/development/python-modules/nbclassic/default.nix
index fc311125c1d0..a1e16bc75219 100644
--- a/pkgs/development/python-modules/nbclassic/default.nix
+++ b/pkgs/development/python-modules/nbclassic/default.nix
@@ -1,8 +1,8 @@
 { lib
 , buildPythonPackage
-, fetchFromGitHub
-, python
+, fetchPypi
 , notebook
+, notebook-shim
 , pythonOlder
 , jupyter_server
 , pytestCheckHook
@@ -14,23 +14,13 @@ buildPythonPackage rec {
   version = "0.4.3";
   disabled = pythonOlder "3.6";
 
-  # tests only on github
-  src = fetchFromGitHub {
-    owner = "jupyterlab";
-    repo = pname;
-    rev = "refs/tags/v${version}";
-    sha256 = "sha256-5sof5EOqzK7kNHSXp7eJl3ZagZRWF74e08ahqJId2Z8=";
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-8DERss66ppuINwp7I7GbKzfJu3F2fxgozf16BH6ujt0=";
   };
 
-  propagatedBuildInputs = [ jupyter_server notebook ];
+  propagatedBuildInputs = [ jupyter_server notebook notebook-shim ];
 
-  preCheck = ''
-    cd nbclassic
-    mv conftest.py tests
-    cd tests
-
-    export PYTHONPATH=$out/${python.sitePackages}:$PYTHONPATH
-  '';
   checkInputs = [
     pytestCheckHook
     pytest-tornasync
diff --git a/pkgs/development/python-modules/notebook-shim/default.nix b/pkgs/development/python-modules/notebook-shim/default.nix
new file mode 100644
index 000000000000..a37e0cb3c679
--- /dev/null
+++ b/pkgs/development/python-modules/notebook-shim/default.nix
@@ -0,0 +1,48 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, jupyter_server
+, pytestCheckHook
+, pytest-tornasync
+}:
+
+buildPythonPackage rec {
+  pname = "notebook-shim";
+  version = "0.1.0";
+
+  src = fetchFromGitHub {
+    owner = "jupyter";
+    repo = "notebook_shim";
+    rev = "v${version}";
+    sha256 = "sha256-5oIYj8SdC4E0N/yFxsmD2p4VkStHvqrVqAwb/htyPm4=";
+  };
+
+  propagatedBuildInputs = [ jupyter_server ];
+
+  preCheck = ''
+    mv notebook_shim/conftest.py notebook_shim/tests
+    cd notebook_shim/tests
+  '';
+
+  # TODO: understand & possibly fix why tests fail. On github most testfiles
+  # have been comitted with msgs "wip" though.
+  doCheck = false;
+
+  checkInputs = [
+    pytestCheckHook
+    pytest-tornasync
+  ];
+
+  pythonImportsCheck = [ "notebook_shim" ];
+
+  meta = with lib; {
+    description = "Switch frontends to Jupyter Server";
+    longDescription = ''
+      This project provides a way for JupyterLab and other frontends to switch
+      to Jupyter Server for their Python Web application backend.
+    '';
+    homepage = "https://github.com/jupyter/notebook_shim";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ friedelino ];
+  };
+}
diff --git a/pkgs/development/python-modules/pyshark/default.nix b/pkgs/development/python-modules/pyshark/default.nix
index d92c58ec88bc..cadd47ca07b1 100644
--- a/pkgs/development/python-modules/pyshark/default.nix
+++ b/pkgs/development/python-modules/pyshark/default.nix
@@ -20,8 +20,6 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "KimiNewt";
     repo = pname;
-    # 0.4.5 was the last release which was tagged
-    # https://github.com/KimiNewt/pyshark/issues/541
     rev = "refs/tags/v${version}";
     hash = "sha256-byll2GWY2841AAf8Xh+KfaCOtMGVKabTsLCe3gCdZ1o=";
   };
@@ -36,7 +34,7 @@ buildPythonPackage rec {
   ];
 
   preCheck = ''
-    export HOME=$TMPDIR
+    export HOME=$(mktemp -d)
   '';
 
   checkInputs = [
diff --git a/pkgs/development/tools/clickable/default.nix b/pkgs/development/tools/clickable/default.nix
new file mode 100644
index 000000000000..6d3bc8663674
--- /dev/null
+++ b/pkgs/development/tools/clickable/default.nix
@@ -0,0 +1,49 @@
+{ lib
+, fetchFromGitLab
+, buildPythonPackage
+, cookiecutter
+, requests
+, pyyaml
+, jsonschema
+, argcomplete
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "clickable";
+  version = "7.4.0";
+
+  src = fetchFromGitLab {
+    owner = "clickable";
+    repo = "clickable";
+    rev = "v${version}";
+    sha256 = "sha256-QS7vi0gUQbqqRYkZwD2B+zkt6DQ6AamQO7sihD8qWS0=";
+  };
+
+  propagatedBuildInputs = [
+    cookiecutter
+    requests
+    pyyaml
+    jsonschema
+    argcomplete
+  ];
+
+  checkInputs = [ pytestCheckHook ];
+
+  disabledTests = [
+    # Test require network connection
+    "test_cpp_plugin"
+    "test_html"
+    "test_python"
+    "test_qml_only"
+    "test_rust"
+  ];
+
+  meta = {
+    description = "A build system for Ubuntu Touch apps";
+    homepage = "https://clickable-ut.dev";
+    changelog = "https://clickable-ut.dev/en/latest/changelog.html";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ ilyakooo0 ];
+  };
+}
diff --git a/pkgs/development/tools/continuous-integration/dagger/default.nix b/pkgs/development/tools/continuous-integration/dagger/default.nix
index bd05a0ec35c1..ea103f9fc28d 100644
--- a/pkgs/development/tools/continuous-integration/dagger/default.nix
+++ b/pkgs/development/tools/continuous-integration/dagger/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "dagger";
-  version = "0.2.29";
+  version = "0.2.30";
 
   src = fetchFromGitHub {
     owner = "dagger";
     repo = "dagger";
     rev = "v${version}";
-    sha256 = "sha256-IfsBrsArP5PoznepNPr7ARVJWuDnFJaiSDMm8NjaLVY=";
+    sha256 = "sha256-D/BamTjhAopoiQoEa9rqk25sGU7ZTTkze/tIKICTx5o=";
   };
 
-  vendorSha256 = "sha256-e++fNcgdQUPnbKVx7ncuf7NGc8eVdli5/rB7Jw+D/Ds=";
+  vendorSha256 = "sha256-IOLZ15Mr+IGWIE4nvMOyjbtYBYOhDMXFYFbOp8beD5w=";
 
   subPackages = [
     "cmd/dagger"
diff --git a/pkgs/development/tools/doctl/default.nix b/pkgs/development/tools/doctl/default.nix
index 9d66b6359652..04014db912cc 100644
--- a/pkgs/development/tools/doctl/default.nix
+++ b/pkgs/development/tools/doctl/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "doctl";
-  version = "1.78.0";
+  version = "1.79.0";
 
   vendorSha256 = null;
 
@@ -31,7 +31,7 @@ buildGoModule rec {
     owner = "digitalocean";
     repo = "doctl";
     rev = "v${version}";
-    sha256 = "sha256-mbUGfAqKC8g2K9pPNnXrpa7DmJUeGXs0KFaavDRMXdc=";
+    sha256 = "sha256-0tl79nVvnY2KECrfgEXQ8tOHnwEX+34uiJ/jshK5oFA=";
   };
 
   meta = with lib; {
diff --git a/pkgs/development/tools/dump_syms/default.nix b/pkgs/development/tools/dump_syms/default.nix
index 8eae712191d9..4aff90f830a3 100644
--- a/pkgs/development/tools/dump_syms/default.nix
+++ b/pkgs/development/tools/dump_syms/default.nix
@@ -11,7 +11,7 @@
 
 let
   pname = "dump_syms";
-  version = "1.0.1";
+  version = "2.0.0";
 in
 rustPlatform.buildRustPackage {
   inherit pname version;
@@ -20,10 +20,10 @@ rustPlatform.buildRustPackage {
     owner = "mozilla";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-2OSni0PA0LfamOqdFQTRLgolF55z13owgFrqYYHuNX0=";
+    hash = "sha256-ei/ORKKoh9rQg4xZ5j76qaplw1PyEV7ABkyL7e8WIlQ=";
   };
 
-  cargoSha256 = "sha256-ggJWweulbSJ8Femzv7uHLcrn1HTenw79AYIydE6y4ag=";
+  cargoSha256 = "sha256-t3AQW0j/L/qIUx6RJKqf+Fv/2BNWkWmTc0PDNFlZeaQ=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/development/web/flyctl/default.nix b/pkgs/development/web/flyctl/default.nix
index 5ecb5c5b9469..6b154210d89f 100644
--- a/pkgs/development/web/flyctl/default.nix
+++ b/pkgs/development/web/flyctl/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "flyctl";
-  version = "0.0.372";
+  version = "0.0.374";
 
   src = fetchFromGitHub {
     owner = "superfly";
     repo = "flyctl";
     rev = "v${version}";
-    sha256 = "sha256-KsSaBzAjiexyhUmYEFEHhWuRROt553Lhkm1idlT8n5s=";
+    sha256 = "sha256-rudTGh4l0wroag0yp2YU8h5NTq+noC3bjbisyP47ktI=";
   };
 
   vendorSha256 = "sha256-E6QeWu88MXMMfZAM7vMIGXpJQuduX6GTj3tXvlE9hFo=";
@@ -42,6 +42,7 @@ buildGoModule rec {
       --bash <($out/bin/flyctl completion bash) \
       --fish <($out/bin/flyctl completion fish) \
       --zsh <($out/bin/flyctl completion zsh)
+    ln -s $out/bin/flyctl $out/bin/fly
   '';
 
   passthru.tests.version = testers.testVersion {
diff --git a/pkgs/tools/admin/copilot-cli/default.nix b/pkgs/tools/admin/copilot-cli/default.nix
index c58adf042d71..149232c697a6 100644
--- a/pkgs/tools/admin/copilot-cli/default.nix
+++ b/pkgs/tools/admin/copilot-cli/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "copilot-cli";
-  version = "1.20.0";
+  version = "1.21.0";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-l6XFaM5eShXrpuZgTfzceNu8U7Z5WnKBi/qoimj/8HM=";
+    sha256 = "sha256-zGmb3EvWkGGJuq9R3GWEfHZvFn7DMC6B6Onk06mFiWI=";
   };
 
-  vendorSha256 = "sha256-AXwiccfSxeX0NDIODEK+JvVjhcBNNpnZnLKGlDPWy48=";
+  vendorSha256 = "sha256-8avzCfCBSVLsWUgBBiD4pYTWrd2X2rdruU5v+AJ3EKY=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/misc/vtm/default.nix b/pkgs/tools/misc/vtm/default.nix
index a2a52a260b60..982f383da304 100644
--- a/pkgs/tools/misc/vtm/default.nix
+++ b/pkgs/tools/misc/vtm/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vtm";
-  version = "0.7.6";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "netxs-group";
     repo = "vtm";
     rev = "v${version}";
-    sha256 = "sha256-YAS/HcgtA4Ms8EB7RRCg6ElBL4aI/FqXjqymHy/voRs=";
+    sha256 = "sha256-Ty7DC4ap2F+mPzr1xaL8XeLSjQaQQVX0oGAcPpkoag4=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/tools/misc/zellij/default.nix b/pkgs/tools/misc/zellij/default.nix
index 06fdaf193468..1521fe567630 100644
--- a/pkgs/tools/misc/zellij/default.nix
+++ b/pkgs/tools/misc/zellij/default.nix
@@ -59,7 +59,7 @@ rustPlatform.buildRustPackage rec {
   meta = with lib; {
     description = "A terminal workspace with batteries included";
     homepage = "https://zellij.dev/";
-    changelog = "https://github.com/zellij-org/zellij/blob/v${version}/Changelog.md";
+    changelog = "https://github.com/zellij-org/zellij/blob/v${version}/CHANGELOG.md";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ therealansh _0x4A6F abbe thehedgeh0g ];
   };
diff --git a/pkgs/tools/security/gpg-tui/default.nix b/pkgs/tools/security/gpg-tui/default.nix
index 7e4d6f672f7e..4ab4d468d068 100644
--- a/pkgs/tools/security/gpg-tui/default.nix
+++ b/pkgs/tools/security/gpg-tui/default.nix
@@ -16,16 +16,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "gpg-tui";
-  version = "0.9.0";
+  version = "0.9.1";
 
   src = fetchFromGitHub {
     owner = "orhun";
     repo = "gpg-tui";
     rev = "v${version}";
-    hash = "sha256-iIMpAAIw6djLNP9lnrHV7D198VcHspQP4OHcr2LNKOA=";
+    hash = "sha256-eUUHH6bPfYjkHo7C7GWzewTpT8je7TQK9M8mTM5v59s=";
   };
 
-  cargoHash = "sha256-xrv1tFzPReHDA+gr/RPCvSM7Sa7v8OKAEY+fSUjPT50=";
+  cargoHash = "sha256-GtSvDfG9lRUirm4d6PSaOBLTHZJT2PH0Sx/9GVquX5M=";
 
   nativeBuildInputs = [
     gpgme # for gpgme-config
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 90815353899b..43d4b44b044a 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -12950,6 +12950,8 @@ with pkgs;
 
   clean = callPackage ../development/compilers/clean { };
 
+  clickable = python3Packages.callPackage ../development/tools/clickable { };
+
   closurecompiler = callPackage ../development/compilers/closure { };
 
   cmdstan = callPackage ../development/compilers/cmdstan { };
@@ -25446,7 +25448,10 @@ with pkgs;
     stdenv = gccStdenv;
   };
 
-  numix-icon-theme = callPackage ../data/icons/numix-icon-theme { };
+  numix-icon-theme = callPackage ../data/icons/numix-icon-theme {
+    inherit (gnome) adwaita-icon-theme;
+    inherit (plasma5Packages) breeze-icons;
+  };
 
   numix-icon-theme-circle = callPackage ../data/icons/numix-icon-theme-circle { };
 
@@ -35604,6 +35609,8 @@ with pkgs;
 
   refind = callPackage ../tools/bootloaders/refind { };
 
+  spectra = callPackage ../development/libraries/spectra { };
+
   spectrojack = callPackage ../applications/audio/spectrojack { };
 
   sift = callPackage ../tools/text/sift { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index bc83bb11e93f..30e577fcbbb9 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -6091,6 +6091,8 @@ in {
 
   notebook = callPackage ../development/python-modules/notebook { };
 
+  notebook-shim = callPackage ../development/python-modules/notebook-shim { };
+
   notedown = callPackage ../development/python-modules/notedown { };
 
   notifications-python-client = callPackage ../development/python-modules/notifications-python-client { };