diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index a4a653b175e3..fedcd5d75f63 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -134,7 +134,9 @@
 /pkgs/development/ruby-modules      @marsam
 
 # Rust
-/pkgs/development/compilers/rust @Mic92 @LnL7 @zowoq
+/pkgs/development/compilers/rust @Mic92 @LnL7 @zowoq @winterqt @figsoda
+/pkgs/build-support/rust @zowoq @winterqt @figsoda
+/doc/languages-frameworks/rust.section.md @zowoq @winterqt @figsoda
 
 # C compilers
 /pkgs/development/compilers/gcc @matthewbauer
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 8bb2809cc148..f67493a332dd 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -2530,6 +2530,12 @@
     githubId = 89596;
     name = "Florian Friesdorf";
   };
+  ChaosAttractor = {
+    email = "lostattractor@gmail.com";
+    github = "LostAttractor";
+    githubId = 46527539;
+    name = "ChaosAttractor";
+  };
   chekoopa = {
     email = "chekoopa@mail.ru";
     github = "chekoopa";
@@ -13990,6 +13996,13 @@
     githubId = 2666479;
     name = "Y Nguyen";
   };
+  superherointj = {
+    name = "Sérgio Marcelo";
+    email = "sergiomarcelo+nixpkgs@ya.ru";
+    matrix = "@superherointj:matrix.org";
+    github = "superherointj";
+    githubId = 5861043;
+  };
   SuperSandro2000 = {
     email = "sandro.jaeckel@gmail.com";
     matrix = "@sandro:supersandro.de";
diff --git a/maintainers/team-list.nix b/maintainers/team-list.nix
index b813948db1d6..49ddf1f10be8 100644
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@@ -698,9 +698,11 @@ with lib.maintainers; {
 
   rust = {
     members = [
-      andir
+      figsoda
       lnl7
       mic92
+      tjni
+      winter
       zowoq
     ];
     scope = "Maintain the Rust compiler toolchain and nixpkgs integration.";
diff --git a/nixos/modules/services/networking/openconnect.nix b/nixos/modules/services/networking/openconnect.nix
index 5a02bd072257..7f9006053b89 100644
--- a/nixos/modules/services/networking/openconnect.nix
+++ b/nixos/modules/services/networking/openconnect.nix
@@ -90,6 +90,7 @@ let
   generateConfig = name: icfg:
     pkgs.writeText "config" ''
       interface=${name}
+      ${optionalString (icfg.protocol != null) "protocol=${icfg.protocol}"}
       ${optionalString (icfg.user != null) "user=${icfg.user}"}
       ${optionalString (icfg.passwordFile != null) "passwd-on-stdin"}
       ${optionalString (icfg.certificate != null)
diff --git a/nixos/modules/services/x11/desktop-managers/plasma5.nix b/nixos/modules/services/x11/desktop-managers/plasma5.nix
index b295b9a109b6..65b94f61c4ae 100644
--- a/nixos/modules/services/x11/desktop-managers/plasma5.nix
+++ b/nixos/modules/services/x11/desktop-managers/plasma5.nix
@@ -365,6 +365,7 @@ in
             pkgs.xdg-user-dirs # Update user dirs as described in https://freedesktop.org/wiki/Software/xdg-user-dirs/
           ];
           optionalPackages = [
+            pkgs.aha # needed by kinfocenter for fwupd support
             plasma-browser-integration
             konsole
             oxygen
diff --git a/pkgs/applications/audio/flacon/default.nix b/pkgs/applications/audio/flacon/default.nix
index 98b9faf8d24a..4564fcccc4e1 100644
--- a/pkgs/applications/audio/flacon/default.nix
+++ b/pkgs/applications/audio/flacon/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "flacon";
-  version = "9.5.1";
+  version = "10.0.0";
 
   src = fetchFromGitHub {
     owner = "flacon";
     repo = "flacon";
     rev = "v${version}";
-    sha256 = "sha256-45aA2Ib69Gb1Mg/5907rp1nfRbNyQq12pm/aFwTdgeA=";
+    sha256 = "sha256-59p5x+d7Vmxx+bdBDxrlf4+NRIdUBuRk+DqohV98XYY=";
   };
 
   nativeBuildInputs = [ cmake pkg-config wrapQtAppsHook ];
diff --git a/pkgs/applications/audio/open-stage-control/default.nix b/pkgs/applications/audio/open-stage-control/default.nix
index 3574dc2f5ac9..0860501c87c4 100644
--- a/pkgs/applications/audio/open-stage-control/default.nix
+++ b/pkgs/applications/audio/open-stage-control/default.nix
@@ -2,13 +2,13 @@
 
 buildNpmPackage rec {
   pname = "open-stage-control";
-  version = "1.21.0";
+  version = "1.22.0";
 
   src = fetchFromGitHub {
     owner = "jean-emmanuel";
     repo = "open-stage-control";
     rev = "v${version}";
-    hash = "sha256-6tRd8boVwWc8qGlklYqA/Kp76VOMvtUJlu/G/InvHkA=";
+    hash = "sha256-tfWimJ9eEFBUxPRVNjgbu8tQNokPbXOxOXO64mFuMfM=";
   };
 
   # Remove some Electron stuff from package.json
diff --git a/pkgs/applications/audio/yesplaymusic/default.nix b/pkgs/applications/audio/yesplaymusic/default.nix
new file mode 100644
index 000000000000..758dcbbd935a
--- /dev/null
+++ b/pkgs/applications/audio/yesplaymusic/default.nix
@@ -0,0 +1,120 @@
+{ lib
+, stdenv
+, fetchurl
+, undmg
+, dpkg
+, autoPatchelfHook
+, wrapGAppsHook
+, makeWrapper
+, alsa-lib
+, at-spi2-atk
+, cups
+, nspr
+, nss
+, mesa # for libgbm
+, xorg
+, xdg-utils
+, libdrm
+, libnotify
+, libsecret
+, libuuid
+, gtk3
+, systemd
+}:
+let
+  pname = "YesPlayMusic";
+  version = "0.4.5";
+
+  srcs = {
+    x86_64-linux = fetchurl {
+      url = "https://github.com/qier222/YesPlayMusic/releases/download/v${version}/yesplaymusic_${version}_amd64.deb";
+      hash = "sha256-igd2MzIjwDSOLP0Xi2mSJnEPGWendggPC/MwTDCDui0=";
+    };
+    aarch64-linux = fetchurl {
+      url = "https://github.com/qier222/YesPlayMusic/releases/download/v${version}/yesplaymusic_${version}_arm64.deb";
+      hash = "sha256-6MZrAJGXuEJ9HMUje3ppTz2rdaBydwoQKBk6af81pT0=";
+    };
+    x86_64-darwin = fetchurl {
+      url = "https://github.com/qier222/YesPlayMusic/releases/download/v${version}/YesPlayMusic-mac-${version}-x64.dmg";
+      hash = "sha256-mvmaSrDoIDeOVylkJCVY97yRUHfEI8CysmKrgBUrFGM=";
+    };
+    aarch64-darwin = fetchurl {
+      url = "https://github.com/qier222/YesPlayMusic/releases/download/v${version}/YesPlayMusic-mac-${version}-arm64.dmg";
+      hash = "sha256-Qo03rGS/qB6Sc1IunU7F81WJ/t+mWR7ZRsKYK97LHik=";
+    };
+  };
+  src = srcs.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
+
+  libraries = [
+    alsa-lib
+    at-spi2-atk
+    cups
+    nspr
+    nss
+    mesa
+    xorg.libxshmfence
+    xorg.libXScrnSaver
+    xorg.libXtst
+    xdg-utils
+    libdrm
+    libnotify
+    libsecret
+    libuuid
+    gtk3
+  ];
+
+  meta = with lib; {
+    description = "A good-looking third-party netease cloud music player";
+    homepage = "https://github.com/qier222/YesPlayMusic/";
+    license = licenses.mit;
+    maintainers = with maintainers; [ ChaosAttractor ];
+    platforms = builtins.attrNames srcs;
+  };
+in
+if stdenv.isDarwin
+then stdenv.mkDerivation {
+  inherit pname version src meta;
+
+  nativeBuildInputs = [ undmg ];
+
+  sourceRoot = ".";
+
+  installPhase = ''
+    mkdir -p $out/Applications
+    cp -r *.app $out/Applications
+  '';
+}
+else stdenv.mkDerivation {
+  inherit pname version src meta;
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+    wrapGAppsHook
+    makeWrapper
+  ];
+
+  buildInputs = libraries;
+
+  runtimeDependencies = [
+    (lib.getLib systemd)
+  ];
+
+  unpackPhase = ''
+    ${dpkg}/bin/dpkg-deb -x $src .
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    cp -r opt $out/opt
+    cp -r usr/share $out/share
+    substituteInPlace $out/share/applications/yesplaymusic.desktop \
+      --replace "/opt/YesPlayMusic/yesplaymusic" "$out/bin/yesplaymusic"
+    makeWrapper $out/opt/YesPlayMusic/yesplaymusic $out/bin/yesplaymusic \
+      --argv0 "yesplaymusic" \
+      --add-flags "$out/opt/YesPlayMusic/resources/app.asar"
+
+    runHook postInstall
+  '';
+}
diff --git a/pkgs/applications/blockchains/haven-cli/default.nix b/pkgs/applications/blockchains/haven-cli/default.nix
index 5b1d12634df5..4f53eaf580cc 100644
--- a/pkgs/applications/blockchains/haven-cli/default.nix
+++ b/pkgs/applications/blockchains/haven-cli/default.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "haven-cli";
-  version = "3.0.3";
+  version = "3.0.7";
 
   src = fetchFromGitHub {
     owner = "haven-protocol-org";
     repo = "haven-main";
     rev = "v${version}";
-    sha256 = "sha256-JbNk1TF0N3tRYGfZfSBFk+t/8GA4yjqP9G6S0ktdur8=";
+    sha256 = "sha256-HLZ9j75MtF7FkHA4uefkrYp07pVZe1Ac1wny7T0CMpA=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/graphics/eyedropper/default.nix b/pkgs/applications/graphics/eyedropper/default.nix
index 41999239af1a..8b4411ad04b3 100644
--- a/pkgs/applications/graphics/eyedropper/default.nix
+++ b/pkgs/applications/graphics/eyedropper/default.nix
@@ -15,19 +15,19 @@
 
 stdenv.mkDerivation rec {
   pname = "eyedropper";
-  version = "0.5.0";
+  version = "0.5.1";
 
   src = fetchFromGitHub {
     owner = "FineFindus";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-sDrMIryVFkjMGHbYvNDmKb1HyJNGb3Hd+muxUJKhogE=";
+    hash = "sha256-kc/UREQpmw3suA6bYEr9fCIwMzNMrEY9E5qf+rhKsC4=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-mztc44hHdqzR3WbG6tkCL38EfgBajRLlpMC8ElpXnlo=";
+    hash = "sha256-/eas1PObrj9IuDIzlBVbfhEhH8eDyZ7CD871JmAqnyY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/gremlin-console/default.nix b/pkgs/applications/misc/gremlin-console/default.nix
index 051fee4f6fb6..59f71a3f88c2 100644
--- a/pkgs/applications/misc/gremlin-console/default.nix
+++ b/pkgs/applications/misc/gremlin-console/default.nix
@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   pname = "gremlin-console";
-  version = "3.6.1";
+  version = "3.6.2";
   src = fetchzip {
     url = "https://downloads.apache.org/tinkerpop/${version}/apache-tinkerpop-gremlin-console-${version}-bin.zip";
-    sha256 = "sha256-lr3ffyAL8LBj7mt4EmN2Kq2pxvW4P7zd66gU9X4qzJw=";
+    sha256 = "sha256-c7uwXqmMrWDYZ9CpGuVoo1e5yWHsoNd0zihZKdCTg7E=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/applications/misc/josm/default.nix b/pkgs/applications/misc/josm/default.nix
index 9890ea9ad8db..360c97d4a297 100644
--- a/pkgs/applications/misc/josm/default.nix
+++ b/pkgs/applications/misc/josm/default.nix
@@ -3,15 +3,15 @@
 }:
 let
   pname = "josm";
-  version = "18622";
+  version = "18646";
   srcs = {
     jar = fetchurl {
       url = "https://josm.openstreetmap.de/download/josm-snapshot-${version}.jar";
-      hash = "sha256-AtV7Lj+z1GOCEl8xUaumYcN848pMsLIfMGmBXved6WU=";
+      hash = "sha256-nncN1cGpuVy4O3JeH56iQfwZGM5/xs3U/V+gVZbChOE=";
     };
     macosx = fetchurl {
       url = "https://josm.openstreetmap.de/download/macosx/josm-macos-${version}-java17.zip";
-      hash = "sha256-q3Kr0YWe6Jm6wO6h7fMANKLCWKfU0zDpBZjRH662eSg=";
+      hash = "sha256-ihBEOl6WnIaA7x40D2HTdVIDb30BYnhlh0sQrbNA/SU=";
     };
     pkg = fetchsvn {
       url = "https://josm.openstreetmap.de/svn/trunk/native/linux/tested";
diff --git a/pkgs/applications/misc/process-compose/default.nix b/pkgs/applications/misc/process-compose/default.nix
index 36e95ee8f098..f71841c1af9a 100644
--- a/pkgs/applications/misc/process-compose/default.nix
+++ b/pkgs/applications/misc/process-compose/default.nix
@@ -8,13 +8,13 @@ let config-module = "github.com/f1bonacc1/process-compose/src/config";
 in
 buildGoModule rec {
   pname = "process-compose";
-  version = "0.29.7";
+  version = "0.40.0";
 
   src = fetchFromGitHub {
     owner = "F1bonacc1";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-gVXil6Gc65/6VMuONfVyxU6SSV0vCbJKXDvtG4a+pbU=";
+    hash = "sha256-8gyALVW+ort76r/zevWAhZlJ/fg5DBmwUNvjZ21wWKY=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -43,7 +43,7 @@ buildGoModule rec {
     installShellFiles
   ];
 
-  vendorHash = "sha256-fL12Rx/0TF2jjciSHgfIDfrqdQxxm2JiGfgO3Dgz81M=";
+  vendorHash = "sha256-rbGKFZY9YEcBAFFxG6v3xaVLQxVoqIehN0LgINku3Xo=";
 
   doCheck = false;
 
diff --git a/pkgs/applications/misc/usql/default.nix b/pkgs/applications/misc/usql/default.nix
index 9300bc3c228d..4911556086c7 100644
--- a/pkgs/applications/misc/usql/default.nix
+++ b/pkgs/applications/misc/usql/default.nix
@@ -10,18 +10,18 @@
 
 buildGoModule rec {
   pname = "usql";
-  version = "0.13.6";
+  version = "0.13.8";
 
   src = fetchFromGitHub {
     owner = "xo";
     repo = "usql";
     rev = "v${version}";
-    hash = "sha256-FmwsiCXSnTEvA1oAScJhnl1ZG7WTfbNQyJBULnNt9/c=";
+    hash = "sha256-oNsA9VM6MN2czeZSTFGvmCWX0T3iVaAhQk1mVRyKgWw=";
   };
 
   buildInputs = [ unixODBC icu ];
 
-  vendorHash = "sha256-lla+smDg6nNNQZYEQI5xY3iRw4gm6WCDh8gDZ6N9lqk=";
+  vendorHash = "sha256-LG5gTHXB1ItDZFbTBHyZGHZLaSYb8wekIHkahTMXzkk=";
   proxyVendor = true;
 
   # Exclude broken impala & hive driver
diff --git a/pkgs/applications/misc/ydict/default.nix b/pkgs/applications/misc/ydict/default.nix
index 9440c2368100..078d6abccf50 100644
--- a/pkgs/applications/misc/ydict/default.nix
+++ b/pkgs/applications/misc/ydict/default.nix
@@ -1,4 +1,9 @@
-{ lib, fetchFromGitHub, buildGoModule }:
+{ lib
+, fetchFromGitHub
+, buildGoModule
+, makeWrapper
+, mpg123
+}:
 
 buildGoModule rec {
   pname = "ydict";
@@ -13,16 +18,26 @@ buildGoModule rec {
 
   vendorSha256 = "sha256-c5nQVQd4n978kFAAKcx5mX2Jz16ZOhS8iL/oxS1o5xs=";
 
-  ldflags = [ "-s" "-w" "-X=main.Version=${version}" ];
+  ldflags = [
+    "-s"
+    "-w"
+    "-X=main.Version=${version}"
+  ];
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  preFixup = ''
+    wrapProgram $out/bin/${pname} \
+      --prefix PATH ":" "${lib.makeBinPath [ mpg123 ]}";
+  '';
 
   # has no tests
   doCheck = false;
 
   meta = with lib; {
-    description = "A command-line Chinese dictionary";
+    description = "Yet another command-line Youdao Chinese dictionary";
     homepage = "https://github.com/TimothyYe/ydict";
     license = licenses.mit;
-    platforms = platforms.linux;
     maintainers = with maintainers; [ zendo ];
   };
 }
diff --git a/pkgs/applications/networking/browsers/firefox/wrapper.nix b/pkgs/applications/networking/browsers/firefox/wrapper.nix
index 378fe1f4039b..06bd49facb81 100644
--- a/pkgs/applications/networking/browsers/firefox/wrapper.nix
+++ b/pkgs/applications/networking/browsers/firefox/wrapper.nix
@@ -15,6 +15,7 @@
 , pciutils
 , sndio
 , libjack2
+, speechd
 }:
 
 ## configurability of the wrapper itself
@@ -82,6 +83,7 @@ let
             ++ lib.optional sndioSupport sndio
             ++ lib.optional jackSupport libjack2
             ++ lib.optional smartcardSupport opensc
+            ++ lib.optional (cfg.speechSynthesisSupport or false) speechd
             ++ pkcs11Modules;
       gtk_modules = [ libcanberra-gtk3 ];
 
diff --git a/pkgs/applications/networking/cluster/acorn/default.nix b/pkgs/applications/networking/cluster/acorn/default.nix
index ce0f07f9ec10..e30e78daf7cf 100644
--- a/pkgs/applications/networking/cluster/acorn/default.nix
+++ b/pkgs/applications/networking/cluster/acorn/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "acorn";
-  version = "0.4.2";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "acorn-io";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-IzjCYVQ9RhuAmgloue421F43ARviaHW7mTkLhLW/VPM=";
+    hash = "sha256-wrtuBme12pilFKDyzKWlZFUu99NQKgwnx2fUOfL+VAY=";
   };
 
-  vendorHash = "sha256-z2ya/CgH9AcxHe73Yt9XWbJqH4OrZWt0bRDsna5hYeo=";
+  vendorHash = "sha256-9cq64397RB4KWVatuKXi1EwjolGEpwAc+tC1zs3boQ4=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/applications/networking/cluster/argocd/default.nix b/pkgs/applications/networking/cluster/argocd/default.nix
index 8eb6d94f389c..b028512dd7c9 100644
--- a/pkgs/applications/networking/cluster/argocd/default.nix
+++ b/pkgs/applications/networking/cluster/argocd/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "argocd";
-  version = "2.5.8";
+  version = "2.5.9";
 
   src = fetchFromGitHub {
     owner = "argoproj";
     repo = "argo-cd";
     rev = "v${version}";
-    sha256 = "sha256-4L0xj4+NLThSLzXTncUnUILOsV3qr9+f8osv19OW6oI=";
+    sha256 = "sha256-RZ3bcuJmUUnucD2lhfxLU8vbrorVUowF8hAW9NGSmbI=";
   };
 
   proxyVendor = true; # darwin/linux hash mismatch
diff --git a/pkgs/applications/networking/cluster/fluxcd/default.nix b/pkgs/applications/networking/cluster/fluxcd/default.nix
index 97fff7f9bbb3..4aeb491410bd 100644
--- a/pkgs/applications/networking/cluster/fluxcd/default.nix
+++ b/pkgs/applications/networking/cluster/fluxcd/default.nix
@@ -65,7 +65,7 @@ in buildGoModule rec {
     '';
     homepage = "https://fluxcd.io";
     license = licenses.asl20;
-    maintainers = with maintainers; [ bryanasdev000 jlesquembre ];
+    maintainers = with maintainers; [ bryanasdev000 jlesquembre superherointj ];
     mainProgram = "flux";
   };
 }
diff --git a/pkgs/applications/networking/cluster/k3s/default.nix b/pkgs/applications/networking/cluster/k3s/default.nix
index 74c3e1ccdf57..74f54d28d594 100644
--- a/pkgs/applications/networking/cluster/k3s/default.nix
+++ b/pkgs/applications/networking/cluster/k3s/default.nix
@@ -75,7 +75,7 @@ let
     description = "A lightweight Kubernetes distribution";
     license = licenses.asl20;
     homepage = "https://k3s.io";
-    maintainers = with maintainers; [ euank mic92 ];
+    maintainers = with maintainers; [ euank mic92 superherointj ];
     platforms = platforms.linux;
   };
 
diff --git a/pkgs/applications/networking/cluster/k9s/default.nix b/pkgs/applications/networking/cluster/k9s/default.nix
index de9dd27b5264..141a17e34e2f 100644
--- a/pkgs/applications/networking/cluster/k9s/default.nix
+++ b/pkgs/applications/networking/cluster/k9s/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "k9s";
-  version = "0.26.7";
+  version = "0.27.0";
 
   src = fetchFromGitHub {
     owner  = "derailed";
     repo   = "k9s";
     rev    = "v${version}";
-    sha256 = "sha256-TshUQJIwGSqVP+YUJvSHSczvnvzr1kX761oIbfQzVzw=";
+    sha256 = "sha256-optEMGB6izGlpcq2AJOY4lTt8igYBilE0Bg8KxE8AsU=";
   };
 
   ldflags = [
@@ -20,7 +20,7 @@ buildGoModule rec {
 
   tags = [ "netgo" ];
 
-  vendorSha256 = "sha256-W0yU5rMUuO2JtKRZpexsCqIUy3h+2hSDRcq/lp0UHX8=";
+  vendorHash = "sha256-57JrBmund2hwcgqWkLos/h1EOgZQb9HfKUf1BX0MYGQ=";
 
   # TODO investigate why some config tests are failing
   doCheck = !(stdenv.isDarwin && stdenv.isAarch64);
diff --git a/pkgs/applications/networking/cluster/karmor/default.nix b/pkgs/applications/networking/cluster/karmor/default.nix
index bf35eac948d4..b01dac8dc17c 100644
--- a/pkgs/applications/networking/cluster/karmor/default.nix
+++ b/pkgs/applications/networking/cluster/karmor/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "karmor";
-  version = "0.11.5";
+  version = "0.11.6";
 
   src = fetchFromGitHub {
     owner = "kubearmor";
     repo = "kubearmor-client";
     rev = "v${version}";
-    hash = "sha256-xVYhZT4yqbSmxGH5DaarXzrGYMS1BuTaQ2T+huWYLBw=";
+    hash = "sha256-toN/pIvmmMwIARhY1i/2nmrC5ZVyTR7pttqkyXNuMaE=";
   };
 
-  vendorHash = "sha256-rlvAQ99/3+3VotyYAR2TgWG8ZdTKUT2XRv4hTF+QFpI=";
+  vendorHash = "sha256-TE+VPOhkTPqQTapxAcJzlQzRZfmb1J4pAWUKiTGLnZE=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/applications/networking/cluster/minikube/default.nix b/pkgs/applications/networking/cluster/minikube/default.nix
index 997b52434b82..e05e7847cfd4 100644
--- a/pkgs/applications/networking/cluster/minikube/default.nix
+++ b/pkgs/applications/networking/cluster/minikube/default.nix
@@ -12,9 +12,9 @@
 
 buildGoModule rec {
   pname = "minikube";
-  version = "1.28.0";
+  version = "1.29.0";
 
-  vendorSha256 = "sha256-CyIpzwSYHbv96UoQ/SZXOl6v3xn3pvT39ZO+RpVHU5I=";
+  vendorHash = "sha256-wRCSUDzz+1e4/ijwAnIM8a/AlnNNdVkiz3WO4Nhuy+M=";
 
   doCheck = false;
 
@@ -22,7 +22,7 @@ buildGoModule rec {
     owner = "kubernetes";
     repo = "minikube";
     rev = "v${version}";
-    sha256 = "sha256-Gn/RXZedID0sh5qTcBNg7GeLtI1JZYKXEWg2RZGXlDw=";
+    sha256 = "sha256-rdcMgL7bzdlxrelui+V1APJik0v/4YyUqj9QlMRq1nI=";
   };
 
   nativeBuildInputs = [ installShellFiles pkg-config which makeWrapper ];
diff --git a/pkgs/applications/networking/cluster/nerdctl/default.nix b/pkgs/applications/networking/cluster/nerdctl/default.nix
index e508ee0006f8..bc57c87b2f87 100644
--- a/pkgs/applications/networking/cluster/nerdctl/default.nix
+++ b/pkgs/applications/networking/cluster/nerdctl/default.nix
@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "nerdctl";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "containerd";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-i178AN8LDm1SmCx3G8uLmW1+/F3B8DQsrkawSBoefGw=";
+    hash = "sha256-6AXki9/gJVlHpA3iSS1GqkLWaUqE0c+X8alWdMyCFiU=";
   };
 
-  vendorSha256 = "sha256-0EWrFc55I3EmrAmmIYdsYtvO6xqDHbo5Uo6XC+NezZI=";
+  vendorHash = "sha256-28Wt9uQ7+PEWe+RaNv4HLz7HQbO7hXlX3O7s9SooLu8=";
 
   nativeBuildInputs = [ makeWrapper installShellFiles ];
 
diff --git a/pkgs/applications/networking/dnscontrol/default.nix b/pkgs/applications/networking/dnscontrol/default.nix
index 2a1bb79b655e..7adcfc8a9a57 100644
--- a/pkgs/applications/networking/dnscontrol/default.nix
+++ b/pkgs/applications/networking/dnscontrol/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "dnscontrol";
-  version = "3.24.0";
+  version = "3.25.0";
 
   src = fetchFromGitHub {
     owner = "StackExchange";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-+fOcFu52f2PiynF0B8r3zAW/ANypXx9inLnf4ZtwI2M=";
+    sha256 = "sha256-XH9o1DTwG5ne5TZDgsS4HfC5WqLXc16JtjkKQtiE8z0=";
   };
 
-  vendorSha256 = "sha256-+43UegjFjh86vXjH1A4jbORk8xTDZaJRc41RhFPcESk=";
+  vendorSha256 = "sha256-iVyLNPvmzkI46Cp0SgbxK6xIQspJjpYjqPf3mOMoZvU=";
 
   ldflags = [ "-s" "-w" ];
 
diff --git a/pkgs/applications/networking/instant-messengers/deltachat-desktop/default.nix b/pkgs/applications/networking/instant-messengers/deltachat-desktop/default.nix
index 805aadfc40a9..3d9fc7627b60 100644
--- a/pkgs/applications/networking/instant-messengers/deltachat-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/deltachat-desktop/default.nix
@@ -21,17 +21,17 @@
 
 let
   libdeltachat' = libdeltachat.overrideAttrs (old: rec {
-    version = "1.106.0";
+    version = "1.107.0";
     src = fetchFromGitHub {
       owner = "deltachat";
       repo = "deltachat-core-rust";
       rev = version;
-      hash = "sha256-S53ghVFb1qDI7MVNbc2ZlHqDN4VRBFQJCJg2J+w0erc=";
+      hash = "sha256-fjiS7GZy1BLgmxu4LFOWgucORcVx+9KleQcga+hRkSY=";
     };
     cargoDeps = rustPlatform.fetchCargoTarball {
       inherit src;
       name = "${old.pname}-${version}";
-      hash = "sha256-k4j814Ao7FAyd0w1nH2fuX1cJKjBkhPw0CVZqNU7Hqs=";
+      hash = "sha256-7XhSI/C0GEmsaL0UupvufB1bfPGbzSQJH720Y4/Do3o=";
     };
   });
   esbuild' = esbuild.override {
@@ -48,24 +48,16 @@ let
   };
 in buildNpmPackage rec {
   pname = "deltachat-desktop";
-  version = "1.34.2";
+  version = "1.34.3";
 
   src = fetchFromGitHub {
     owner = "deltachat";
     repo = "deltachat-desktop";
     rev = "v${version}";
-    hash = "sha256-XOGfKa0eGVZKKKC0Pm2kw48XWWcrxCyDdYzCSKp+wco=";
+    hash = "sha256-6WZJD8lMsk1WNguMkXygBCTVpOzNkNuVZJ3Ygv6VBkM=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "bump-electron-to-22.1.0.patch";
-      url = "https://github.com/deltachat/deltachat-desktop/commit/944d2735cda6cd5a95cb83c57484fbaf16720a9c.patch";
-      hash = "sha256-kaKi32eFQ3hGLZLjiXmH9qs4GXezcDQ7zTdT2+D8NcQ=";
-    })
-  ];
-
-  npmDepsHash = "sha256-J3/S/jYQvO/U8StDtYI+jozon0d4VCdeqFX6x1hHzMo=";
+  npmDepsHash = "sha256-B91yQ/xi8+uyOllqYR7lZTfLBpJvZat1cIIJk9TkM/c=";
 
   nativeBuildInputs = [
     makeWrapper
@@ -137,8 +129,6 @@ in buildNpmPackage rec {
     ];
   });
 
-  passthru.updateScript = ./update.sh;
-
   meta = with lib; {
     description = "Email-based instant messaging for Desktop";
     homepage = "https://github.com/deltachat/deltachat-desktop";
diff --git a/pkgs/applications/networking/instant-messengers/deltachat-desktop/update.sh b/pkgs/applications/networking/instant-messengers/deltachat-desktop/update.sh
deleted file mode 100755
index f31279cf4f0e..000000000000
--- a/pkgs/applications/networking/instant-messengers/deltachat-desktop/update.sh
+++ /dev/null
@@ -1,32 +0,0 @@
-#! /usr/bin/env nix-shell
-#! nix-shell -i bash -p coreutils curl gnused jq moreutils nix-prefetch prefetch-npm-deps
-
-set -euo pipefail
-cd "$(dirname "$0")"
-
-owner=deltachat
-repo=deltachat-desktop
-nixpkgs=../../../../..
-
-rev=$(
-    curl -s "https://api.github.com/repos/$owner/$repo/releases" |
-    jq 'map(select(.prerelease | not)) | .[0].tag_name' --raw-output
-)
-ver=$(echo "$rev" | sed 's/^v//')
-old_ver=$(tac default.nix | sed -n 's/.*\bversion = "\(.*\)".*/\1/p' | head -1)
-if [ "$ver" = "$old_ver" ]; then
-    echo "Up to date: $ver"
-    exit
-fi
-echo "$old_ver -> $ver"
-
-hash=$(nix-prefetch -f "$nixpkgs" deltachat-desktop --rev "$rev")
-tac default.nix \
-    | sed -e "0,/version = \".*\"/s//version = \"$ver\"/" \
-          -e "0,/hash = \".*\"/s//hash = \"${hash//\//\\/}\"/" \
-    | tac \
-    | sponge default.nix
-
-src=$(nix-build "$nixpkgs" -A deltachat-desktop.src --no-out-link)
-hash=$(prefetch-npm-deps $src/package-lock.json)
-sed -i "s,npmDepsHash = \".*\",npmDepsHash = \"$hash\"," default.nix
diff --git a/pkgs/applications/networking/instant-messengers/pidgin/default.nix b/pkgs/applications/networking/instant-messengers/pidgin/default.nix
index f5d2479bdaa1..2023997aa811 100644
--- a/pkgs/applications/networking/instant-messengers/pidgin/default.nix
+++ b/pkgs/applications/networking/instant-messengers/pidgin/default.nix
@@ -9,11 +9,11 @@
 
 let unwrapped = stdenv.mkDerivation rec {
   pname = "pidgin";
-  version = "2.14.10";
+  version = "2.14.12";
 
   src = fetchurl {
     url = "mirror://sourceforge/pidgin/pidgin-${version}.tar.bz2";
-    sha256 = "sha256-RUsbkovGvLsYM1OvMPv95VlfIkWjQjoaRubJei3yKBA=";
+    sha256 = "sha256-KwUka+IIYF7buTrp7cB5WD1EniqXENttNI0X9ZAgpLc=";
   };
 
   nativeBuildInputs = [ makeWrapper intltool ];
diff --git a/pkgs/applications/networking/mullvad-vpn/default.nix b/pkgs/applications/networking/mullvad-vpn/default.nix
index 15dc909aa646..dc8c5729ddf8 100644
--- a/pkgs/applications/networking/mullvad-vpn/default.nix
+++ b/pkgs/applications/networking/mullvad-vpn/default.nix
@@ -1,7 +1,7 @@
 { stdenv, lib, fetchurl, dpkg
 , alsa-lib, atk, cairo, cups, dbus, expat, fontconfig, freetype
 , gdk-pixbuf, glib, pango, nspr, nss, gtk3, mesa
-, xorg, autoPatchelfHook, systemd, libnotify, libappindicator
+, wayland, xorg, autoPatchelfHook, systemd, libnotify, libappindicator
 , makeWrapper
 }:
 
@@ -63,7 +63,7 @@ stdenv.mkDerivation rec {
 
   unpackPhase = "dpkg-deb -x $src .";
 
-  runtimeDependencies = [ (lib.getLib systemd) libnotify libappindicator ];
+  runtimeDependencies = [ (lib.getLib systemd) libnotify libappindicator wayland ];
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/applications/radio/urh/default.nix b/pkgs/applications/radio/urh/default.nix
index 93836cee2819..3dd7a5422537 100644
--- a/pkgs/applications/radio/urh/default.nix
+++ b/pkgs/applications/radio/urh/default.nix
@@ -6,13 +6,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "urh";
-  version = "2.9.3";
+  version = "2.9.4";
 
   src = fetchFromGitHub {
     owner = "jopohl";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-TrvyPcpSMACrbKPVOjxHsVsC28LmruiVO/CyCPh0KZ8=";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-Hi0VqBtGeaXMsibxbHk+2FN8mzfpmkuDr37JRW4Fp+s=";
   };
 
   nativeBuildInputs = [ qt5.wrapQtAppsHook ];
diff --git a/pkgs/applications/science/biology/diamond/default.nix b/pkgs/applications/science/biology/diamond/default.nix
index 8073b1bea163..6cdae4cb53a2 100644
--- a/pkgs/applications/science/biology/diamond/default.nix
+++ b/pkgs/applications/science/biology/diamond/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "diamond";
-  version = "2.0.15";
+  version = "2.1.0";
 
   src = fetchFromGitHub {
     owner = "bbuchfink";
     repo = "diamond";
     rev = "v${version}";
-    sha256 = "17z9vwj58i1zc22gv4qscx0dk3nxf5ix443gxsibh3a5zsnc6dkg";
+    sha256 = "sha256-tcUVWfb/EtJ6heJjQ3989uNjkWa6FocReJ5gjE35AMY=";
   };
 
 
diff --git a/pkgs/applications/video/cinelerra/default.nix b/pkgs/applications/video/cinelerra/default.nix
index 0ce0623ec9d9..972a68e04f03 100644
--- a/pkgs/applications/video/cinelerra/default.nix
+++ b/pkgs/applications/video/cinelerra/default.nix
@@ -44,13 +44,13 @@
 
 stdenv.mkDerivation {
   pname = "cinelerra-cv";
-  version = "unstable-2021-02-14";
+  version = "unstable-2023-01-29";
 
   src = fetchFromGitHub {
     owner = "cinelerra-cv-team";
     repo = "cinelerra-cv";
-    rev = "7d0e8ede557d0cdf3606e0a8d97166a22f88d89e";
-    sha256 = "0n84y2wp47y89drc48cm1609gads5c6saw6c6bqcf5c5wcg1yfbj";
+    rev = "bb00ac6b70fcf3cf419348b56f9b264bc01c1a89";
+    sha256 = "11965kb3d7xcvlcf8p7jlzk9swk5i78x7wja4s3043wlzmqmwv0q";
   };
 
   preConfigure = ''
diff --git a/pkgs/applications/video/mpv/scripts/mpvacious.nix b/pkgs/applications/video/mpv/scripts/mpvacious.nix
index 4052c968d2ba..af033781ac2c 100644
--- a/pkgs/applications/video/mpv/scripts/mpvacious.nix
+++ b/pkgs/applications/video/mpv/scripts/mpvacious.nix
@@ -8,13 +8,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "mpvacious";
-  version = "0.18";
+  version = "0.20";
 
   src = fetchFromGitHub {
     owner = "Ajatt-Tools";
     repo = "mpvacious";
     rev = "v${version}";
-    sha256 = "sha256-FiYEpZVaeJQVSXa9obFYSKNVASJolOBm5D3faOlCzNY=";
+    sha256 = "sha256-9Lf7MVaJ5eC5Gb1PdGBvtENU8AAVq2jsUkY3wJfztt8=";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/virtualization/conmon-rs/default.nix b/pkgs/applications/virtualization/conmon-rs/default.nix
index 59a2de96e9dd..ef25427c4a23 100644
--- a/pkgs/applications/virtualization/conmon-rs/default.nix
+++ b/pkgs/applications/virtualization/conmon-rs/default.nix
@@ -7,19 +7,19 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "conmon-rs";
-  version = "0.4.0";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-VwVJWf9tKZ5rVF8tXDf35zsS2PipqC8FPbXUpOzsw/Y=";
+    sha256 = "sha256-mngs5ivRyMJ927VV00mFNIG+nD9EuE3qLyN+OHMMkHQ=";
   };
 
   nativeBuildInputs = [ capnproto protobuf ];
   doCheck = false;
 
-  cargoSha256 = "sha256-zY9fsZK1C3HnCxeNA5dCbQQHYx3IVDMHCHYwFh5ev2k=";
+  cargoSha256 = "sha256-ruChRz2rnPalBiXcpco/WS/eDgg52ckPBLBuoQa9us4=";
 
   meta = with lib; {
     description = "An OCI container runtime monitor written in Rust";
diff --git a/pkgs/applications/window-managers/leftwm/0001-patch-version.patch b/pkgs/applications/window-managers/leftwm/0001-patch-version.patch
new file mode 100644
index 000000000000..8c28f0c22abe
--- /dev/null
+++ b/pkgs/applications/window-managers/leftwm/0001-patch-version.patch
@@ -0,0 +1,22 @@
+diff --git a/Cargo.lock b/Cargo.lock
+index ac3125a..c02b11d 100644
+--- a/Cargo.lock
++++ b/Cargo.lock
+@@ -431,7 +431,7 @@ dependencies = [
+ 
+ [[package]]
+ name = "leftwm"
+-version = "0.4.0"
++version = "0.4.1"
+ dependencies = [
+  "anyhow",
+  "clap",
+@@ -467,7 +467,7 @@ dependencies = [
+ 
+ [[package]]
+ name = "leftwm-core"
+-version = "0.4.0"
++version = "0.4.1"
+ dependencies = [
+  "dirs-next",
+  "futures",
diff --git a/pkgs/applications/window-managers/leftwm/default.nix b/pkgs/applications/window-managers/leftwm/default.nix
index fe3e46f7b47a..70d7476432a2 100644
--- a/pkgs/applications/window-managers/leftwm/default.nix
+++ b/pkgs/applications/window-managers/leftwm/default.nix
@@ -6,16 +6,20 @@ in
 
 rustPlatform.buildRustPackage rec {
   pname = "leftwm";
-  version = "0.4.0";
+  version = "0.4.1";
 
   src = fetchFromGitHub {
     owner = "leftwm";
     repo = "leftwm";
     rev = version;
-    sha256 = "sha256-4f9YOVkOXn7+TzTUZS2Lultgj9WhiOPUa/fHUeyLBUU=";
+    sha256 = "sha256-ZAlX8Vu4JAwQlwBOHT435Bz3g3qqK5ePm9v0cDqP8Q4=";
   };
 
-  cargoSha256 = "sha256-D00IFTELRlqeKQ7zheJKTvu5FBgYQXsZ+OnPnVzweC4=";
+  cargoSha256 = "sha256-nn/P9ZZNf1Zts4JiJ2kXWAAG/HT1GnlYHXcPijYiBlU=";
+
+  cargoPatches = [
+    ./0001-patch-version.patch
+  ];
 
   buildInputs = rpathLibs;
 
@@ -33,7 +37,7 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/leftwm/leftwm";
     license = licenses.mit;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ yanganto ];
     changelog = "https://github.com/leftwm/leftwm/blob/${version}/CHANGELOG";
   };
 }
diff --git a/pkgs/data/fonts/undefined-medium/default.nix b/pkgs/data/fonts/undefined-medium/default.nix
index 9c605668845b..3e3087c6abc8 100644
--- a/pkgs/data/fonts/undefined-medium/default.nix
+++ b/pkgs/data/fonts/undefined-medium/default.nix
@@ -2,11 +2,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "undefined-medium";
-  version = "1.0";
+  version = "1.1";
 
   src = fetchzip {
-    url = "https://github.com/andirueckel/undefined-medium/archive/v1.0.zip";
-    hash = "sha256-HG+V7jR7dDI6LeoiCg/8F38lW8Zdo6CyLj2DXy/ff64=";
+    url = "https://github.com/andirueckel/undefined-medium/archive/v1.1.zip";
+    hash = "sha256-iquxt7lo92y4AQZf23Ij5Qzg2U7buL3kGLksQSR6vac=";
   };
 
   installPhase = ''
diff --git a/pkgs/desktops/plasma-5/default.nix b/pkgs/desktops/plasma-5/default.nix
index 6396b7c6c51e..dcc5c7f7cf3d 100644
--- a/pkgs/desktops/plasma-5/default.nix
+++ b/pkgs/desktops/plasma-5/default.nix
@@ -130,7 +130,7 @@ let
       kdeplasma-addons = callPackage ./kdeplasma-addons.nix { };
       kgamma5 = callPackage ./kgamma5.nix { };
       khotkeys = callPackage ./khotkeys.nix { };
-      kinfocenter = callPackage ./kinfocenter.nix { };
+      kinfocenter = callPackage ./kinfocenter { };
       kmenuedit = callPackage ./kmenuedit.nix { };
       kpipewire = callPackage ./kpipewire.nix { };
       kscreen = callPackage ./kscreen.nix { };
diff --git a/pkgs/desktops/plasma-5/kinfocenter.nix b/pkgs/desktops/plasma-5/kinfocenter.nix
deleted file mode 100644
index c63d22858a55..000000000000
--- a/pkgs/desktops/plasma-5/kinfocenter.nix
+++ /dev/null
@@ -1,62 +0,0 @@
-{ mkDerivation
-, lib
-, extra-cmake-modules
-, kdoctools
-, qtbase
-, kcmutils
-, kcompletion
-, kconfig
-, kconfigwidgets
-, kcoreaddons
-, kdbusaddons
-, kdeclarative
-, ki18n
-, kiconthemes
-, kio
-, kirigami2
-, kpackage
-, kservice
-, kwayland
-, kwidgetsaddons
-, kxmlgui
-, solid
-, systemsettings
-, libraw1394
-, libGLU
-, pciutils
-}:
-
-mkDerivation {
-  pname = "kinfocenter";
-  nativeBuildInputs = [ extra-cmake-modules kdoctools ];
-  buildInputs = [
-    kcmutils
-    kcompletion
-    kconfig
-    kconfigwidgets
-    kcoreaddons
-    kdbusaddons
-    kdeclarative
-    ki18n
-    kiconthemes
-    kio
-    kirigami2
-    kpackage
-    kservice
-    kwayland
-    kwidgetsaddons
-    kxmlgui
-    solid
-    systemsettings
-
-    libraw1394
-    libGLU
-    pciutils
-  ];
-  preFixup = ''
-    # fix wrong symlink of infocenter pointing to a 'systemsettings5' binary in
-    # the same directory, while it is actually located in a completely different
-    # store path
-    ln -sf ${lib.getBin systemsettings}/bin/systemsettings5 $out/bin/kinfocenter
-  '';
-}
diff --git a/pkgs/desktops/plasma-5/kinfocenter/0001-tool-paths.patch b/pkgs/desktops/plasma-5/kinfocenter/0001-tool-paths.patch
new file mode 100644
index 000000000000..c6cf9bd8d6df
--- /dev/null
+++ b/pkgs/desktops/plasma-5/kinfocenter/0001-tool-paths.patch
@@ -0,0 +1,51 @@
+diff --git a/Modules/kwinsupportinfo/kcm_kwinsupportinfo.json.in b/Modules/kwinsupportinfo/kcm_kwinsupportinfo.json.in
+index f591b9c..e883212 100644
+--- a/Modules/kwinsupportinfo/kcm_kwinsupportinfo.json.in
++++ b/Modules/kwinsupportinfo/kcm_kwinsupportinfo.json.in
+@@ -63,6 +63,6 @@
+         "Name[x-test]": "xxWindow Managerxx",
+         "Name[zh_CN]": "窗口管理器"
+     },
+-    "TryExec": "@QtBinariesDir@/qdbus",
++    "TryExec": "@qdbus@",
+     "X-KDE-KInfoCenter-Category": "graphical_information"
+ }
+diff --git a/Modules/kwinsupportinfo/main.cpp b/Modules/kwinsupportinfo/main.cpp
+index 667c079..b727b67 100644
+--- a/Modules/kwinsupportinfo/main.cpp
++++ b/Modules/kwinsupportinfo/main.cpp
+@@ -19,7 +19,7 @@ public:
+     explicit KCMKWinSupportInfo(QObject *parent, const KPluginMetaData &data, const QVariantList &args)
+         : ConfigModule(parent, data, args)
+     {
+-        auto outputContext = new CommandOutputContext(QLibraryInfo::location(QLibraryInfo::BinariesPath) + QStringLiteral("/qdbus"),
++        auto outputContext = new CommandOutputContext(QStringLiteral("@qdbus@"),
+                                                       {QStringLiteral("org.kde.KWin"), QStringLiteral("/KWin"), QStringLiteral("supportInformation")},
+                                                       parent);
+         qmlRegisterSingletonInstance("org.kde.kinfocenter.kwinsupportinfo.private", 1, 0, "InfoOutputContext", outputContext);
+diff --git a/Modules/xserver/kcm_xserver.json b/Modules/xserver/kcm_xserver.json
+index 04acd6b..24b8f36 100644
+--- a/Modules/xserver/kcm_xserver.json
++++ b/Modules/xserver/kcm_xserver.json
+@@ -130,7 +130,7 @@
+         "Name[zh_CN]": "X 服务器",
+         "Name[zh_TW]": "X 伺服器"
+     },
+-    "TryExec": "xdpyinfo",
++    "TryExec": "@xdpyinfo@",
+     "X-DocPath": "kinfocenter/graphical.html#xserver",
+     "X-KDE-KInfoCenter-Category": "graphical_information",
+     "X-KDE-Keywords": "X,X-Server,XServer,XFree86,Display,VideoCard,System Information",
+diff --git a/Modules/xserver/main.cpp b/Modules/xserver/main.cpp
+index c406ff7..a261b90 100644
+--- a/Modules/xserver/main.cpp
++++ b/Modules/xserver/main.cpp
+@@ -17,7 +17,7 @@ public:
+     explicit KCMXServer(QObject *parent, const KPluginMetaData &data, const QVariantList &args)
+         : ConfigModule(parent, data, args)
+     {
+-        auto outputContext = new CommandOutputContext(QStringLiteral("xdpyinfo"), {}, parent);
++        auto outputContext = new CommandOutputContext(QStringLiteral("@xdpyinfo@"), {}, parent);
+         qmlRegisterSingletonInstance("org.kde.kinfocenter.xserver.private", 1, 0, "InfoOutputContext", outputContext);
+ 
+         auto *about = new KAboutData(QStringLiteral("kcm_xserver"), i18nc("@label kcm name", "X-Server"), QStringLiteral("1.0"), QString(), KAboutLicense::GPL);
diff --git a/pkgs/desktops/plasma-5/kinfocenter/default.nix b/pkgs/desktops/plasma-5/kinfocenter/default.nix
new file mode 100644
index 000000000000..222e78558264
--- /dev/null
+++ b/pkgs/desktops/plasma-5/kinfocenter/default.nix
@@ -0,0 +1,104 @@
+{ mkDerivation
+, lib
+, extra-cmake-modules
+, kdoctools
+, qtbase
+, qttools
+, kcmutils
+, kcompletion
+, kconfig
+, kconfigwidgets
+, kcoreaddons
+, kdbusaddons
+, kdeclarative
+, ki18n
+, kiconthemes
+, kio
+, kirigami2
+, kpackage
+, kservice
+, kwayland
+, kwidgetsaddons
+, kxmlgui
+, solid
+, systemsettings
+, dmidecode
+, fwupd
+, libraw1394
+, libusb1
+, libGLU
+, pciutils
+, smartmontools
+, util-linux
+, vulkan-tools
+, wayland-utils
+, xdpyinfo
+}:
+
+let
+  inherit (lib) getBin getExe;
+
+  qdbus = "${getBin qttools}/bin/qdbus";
+
+in
+mkDerivation {
+  pname = "kinfocenter";
+
+  nativeBuildInputs = [ extra-cmake-modules kdoctools ];
+
+  buildInputs = [
+    kcmutils
+    kcompletion
+    kconfig
+    kconfigwidgets
+    kcoreaddons
+    kdbusaddons
+    kdeclarative
+    ki18n
+    kiconthemes
+    kio
+    kirigami2
+    kpackage
+    kservice
+    kwayland
+    kwidgetsaddons
+    kxmlgui
+    solid
+    systemsettings
+
+    dmidecode
+    fwupd
+    libraw1394
+    libusb1
+    libGLU
+    pciutils
+    smartmontools
+    util-linux
+    vulkan-tools
+    wayland-utils
+    xdpyinfo
+  ];
+
+  patches = [
+    ./0001-tool-paths.patch
+  ];
+
+  postPatch = ''
+    for f in Modules/kwinsupportinfo/{kcm_kwinsupportinfo.json.in,main.cpp}; do
+      substituteInPlace $f \
+        --replace "@qdbus@" "${qdbus}"
+    done
+
+    for f in Modules/xserver/{kcm_xserver.json,main.cpp}; do
+      substituteInPlace $f \
+        --replace "@xdpyinfo@" "${getExe xdpyinfo}"
+    done
+  '';
+
+  # fix wrong symlink of infocenter pointing to a 'systemsettings5' binary in
+  # the same directory, while it is actually located in a completely different
+  # store path
+  preFixup = ''
+    ln -sf ${lib.getExe systemsettings} $out/bin/kinfocenter
+  '';
+}
diff --git a/pkgs/desktops/plasma-5/systemsettings.nix b/pkgs/desktops/plasma-5/systemsettings.nix
index 94d8f92ac4f9..1c438df1b82f 100644
--- a/pkgs/desktops/plasma-5/systemsettings.nix
+++ b/pkgs/desktops/plasma-5/systemsettings.nix
@@ -45,4 +45,5 @@ mkDerivation {
     plasma-workspace
   ];
   outputs = [ "bin" "dev" "out" ];
+  meta.mainProgram = "systemsettings5";
 }
diff --git a/pkgs/development/compilers/rust/cargo.nix b/pkgs/development/compilers/rust/cargo.nix
index 9b10767e5bff..d04eebe7eadf 100644
--- a/pkgs/development/compilers/rust/cargo.nix
+++ b/pkgs/development/compilers/rust/cargo.nix
@@ -76,7 +76,7 @@ rustPlatform.buildRustPackage {
   meta = with lib; {
     homepage = "https://crates.io";
     description = "Downloads your Rust project's dependencies and builds your project";
-    maintainers = with maintainers; [ retrry ];
+    maintainers = with maintainers; [ retrry ] ++ teams.rust.members;
     license = [ licenses.mit licenses.asl20 ];
     platforms = platforms.unix;
   };
diff --git a/pkgs/development/compilers/rust/rustc.nix b/pkgs/development/compilers/rust/rustc.nix
index 64254d502529..426f13778838 100644
--- a/pkgs/development/compilers/rust/rustc.nix
+++ b/pkgs/development/compilers/rust/rustc.nix
@@ -211,7 +211,7 @@ in stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://www.rust-lang.org/";
     description = "A safe, concurrent, practical language";
-    maintainers = with maintainers; [ cstrahan globin havvy ];
+    maintainers = with maintainers; [ cstrahan globin havvy ] ++ teams.rust.members;
     license = [ licenses.mit licenses.asl20 ];
     platforms = platforms.linux ++ platforms.darwin;
   };
diff --git a/pkgs/development/libraries/ace/default.nix b/pkgs/development/libraries/ace/default.nix
index 3de86d457269..2e617ef9e0ad 100644
--- a/pkgs/development/libraries/ace/default.nix
+++ b/pkgs/development/libraries/ace/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ace";
-  version = "7.0.10";
+  version = "7.0.11";
 
   src = fetchurl {
     url = "https://download.dre.vanderbilt.edu/previous_versions/ACE-${version}.tar.bz2";
-    sha256 = "sha256-G3H1MBGseD/G9kigS3r9TrwRk8TYi2KC1CueKhtlNzA=";
+    sha256 = "sha256-r+LRiu/u1qMcbrjkSr8ErnemX6zvhgvc5cLWu8AQhww=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/libraries/libdeltachat/default.nix b/pkgs/development/libraries/libdeltachat/default.nix
index 16ea50f6dd9a..7d8b1c95698a 100644
--- a/pkgs/development/libraries/libdeltachat/default.nix
+++ b/pkgs/development/libraries/libdeltachat/default.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libdeltachat";
-  version = "1.106.0";
+  version = "1.107.0";
 
   src = fetchFromGitHub {
     owner = "deltachat";
     repo = "deltachat-core-rust";
     rev = version;
-    hash = "sha256-S53ghVFb1qDI7MVNbc2ZlHqDN4VRBFQJCJg2J+w0erc=";
+    hash = "sha256-fjiS7GZy1BLgmxu4LFOWgucORcVx+9KleQcga+hRkSY=";
   };
 
   patches = [
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-k4j814Ao7FAyd0w1nH2fuX1cJKjBkhPw0CVZqNU7Hqs=";
+    hash = "sha256-7XhSI/C0GEmsaL0UupvufB1bfPGbzSQJH720Y4/Do3o=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/libgit2/default.nix b/pkgs/development/libraries/libgit2/default.nix
index 35b3fef3087d..e6808b47ab09 100644
--- a/pkgs/development/libraries/libgit2/default.nix
+++ b/pkgs/development/libraries/libgit2/default.nix
@@ -16,14 +16,14 @@
 
 stdenv.mkDerivation rec {
   pname = "libgit2";
-  version = "1.5.0";
+  version = "1.5.1";
   # also check the following packages for updates: python3.pkgs.pygit2 and libgit2-glib
 
   src = fetchFromGitHub {
     owner = "libgit2";
     repo = "libgit2";
     rev = "v${version}";
-    sha256 = "sha256-lXFQo+tt56BFoPgdkTfz6WdIngeotTm+8cAGcBP6XqY=";
+    sha256 = "sha256-KzBMwpqn6wUFhgB3KDclBS0BvZSVcasM5AG/y+L91xM=";
   };
 
   cmakeFlags = [
diff --git a/pkgs/development/libraries/liboqs/default.nix b/pkgs/development/libraries/liboqs/default.nix
new file mode 100644
index 000000000000..908554a679df
--- /dev/null
+++ b/pkgs/development/libraries/liboqs/default.nix
@@ -0,0 +1,38 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, openssl
+, enableStatic ? stdenv.hostPlatform.isStatic
+}:
+
+stdenv.mkDerivation rec {
+  pname = "liboqs";
+  version = "0.7.2";
+
+  src = fetchFromGitHub {
+    owner = "open-quantum-safe";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-cwrTHj/WFDZ9Ez2FhjpRhEx9aC5xBnh7HR/9T+zUpZc=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ openssl ];
+
+  cmakeFlags = [
+    "-DBUILD_SHARED_LIBS=${if enableStatic then "OFF" else "ON"}"
+    "-DOQS_DIST_BUILD=ON"
+    "-DOQS_BUILD_ONLY_LIB=ON"
+  ];
+
+  dontFixCmake = true; # fix CMake file will give an error
+
+  meta = with lib; {
+    description = "C library for prototyping and experimenting with quantum-resistant cryptography";
+    homepage = "https://openquantumsafe.org";
+    license = licenses.mit;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ candyc1oud ];
+  };
+}
diff --git a/pkgs/development/libraries/nghttp2/default.nix b/pkgs/development/libraries/nghttp2/default.nix
index d267960e36df..2fae8135124e 100644
--- a/pkgs/development/libraries/nghttp2/default.nix
+++ b/pkgs/development/libraries/nghttp2/default.nix
@@ -58,7 +58,10 @@ stdenv.mkDerivation rec {
     "--disable-examples"
     (lib.enableFeature enableApp "app")
   ] ++ lib.optionals (enableAsioLib) [ "--enable-asio-lib" "--with-boost-libdir=${boost}/lib" ]
-    ++ lib.optionals (enablePython) [ "--with-cython=${python3Packages.cython}/bin/cython" ];
+    ++ lib.optionals (enablePython) [
+      "--enable-python-bindings"
+      "--with-cython=${python3Packages.cython}/bin/cython"
+    ];
 
   # Unit tests require CUnit and setting TZDIR environment variable
   doCheck = enableTests;
@@ -82,6 +85,7 @@ stdenv.mkDerivation rec {
 
   passthru.tests = {
     inherit curl libsoup;
+    python-nghttp2 = python3Packages.nghttp2;
   };
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/ngtcp2/default.nix b/pkgs/development/libraries/ngtcp2/default.nix
index dda067fd499f..d6cacc0aa7f7 100644
--- a/pkgs/development/libraries/ngtcp2/default.nix
+++ b/pkgs/development/libraries/ngtcp2/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ngtcp2";
-  version = "0.12.0";
+  version = "0.12.1";
 
   src = fetchFromGitHub {
     owner = "ngtcp2";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-OnGzAUfIop/3/0qAAm5rgTlpCdZ/1fwWPJ/KLfGUy8U=";
+    sha256 = "sha256-nUUbGNxr2pGiEoYbArHppNE29rki9SM/3MZWMS9HmqY=";
   };
 
   outputs = [ "out" "dev" "doc" ];
diff --git a/pkgs/development/misc/brev-cli/default.nix b/pkgs/development/misc/brev-cli/default.nix
index d25bb93d49f4..70270a58ddf4 100644
--- a/pkgs/development/misc/brev-cli/default.nix
+++ b/pkgs/development/misc/brev-cli/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "brev-cli";
-  version = "0.6.197";
+  version = "0.6.199";
 
   src = fetchFromGitHub {
     owner = "brevdev";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-+elot37F8VW7BP18zB8wHbxTHLgnTlXLUJlr82/Y05w=";
+    sha256 = "sha256-6sEgxUDKKAFWxWQqTb8hLt+vqlkD/9f5zdj9rh3sDLM=";
   };
 
-  vendorSha256 = "sha256-uaLoh1VhJAT5liGqL77DLhAWviy5Ci8B16LuzCWuek8=";
+  vendorHash = "sha256-hpS8fyyWIw1vkWXyd1OxyorGT5j4bJ5Ey+Hh48QF0p0=";
 
   CGO_ENABLED = 0;
   subPackages = [ "." ];
diff --git a/pkgs/development/ocaml-modules/pyml/default.nix b/pkgs/development/ocaml-modules/pyml/default.nix
index 1cc85833d584..8358be50032a 100644
--- a/pkgs/development/ocaml-modules/pyml/default.nix
+++ b/pkgs/development/ocaml-modules/pyml/default.nix
@@ -28,6 +28,10 @@ buildDunePackage rec {
         "CHANGES.md"
       ];
     })
+    (fetchpatch {
+      url = "https://github.com/thierry-martinez/pyml/commit/97407473800b3f6215190643c1e6b9bd25d5caeb.patch";
+      hash = "sha256-7CrVuV4JT7fyi/ktWz4nNOG/BbqsQVCoJwCAhE2y4YU=";
+    })
   ];
 
   buildInputs = [
@@ -40,7 +44,7 @@ buildDunePackage rec {
   ];
 
   nativeCheckInputs = [
-    python3.pkgs.numpy
+    python3.pkgs.numpy python3.pkgs.ipython
   ];
 
   strictDeps = true;
diff --git a/pkgs/development/python-modules/azure-mgmt-recoveryservicesbackup/default.nix b/pkgs/development/python-modules/azure-mgmt-recoveryservicesbackup/default.nix
index d5fe92f320b0..6334df663747 100644
--- a/pkgs/development/python-modules/azure-mgmt-recoveryservicesbackup/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-recoveryservicesbackup/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "azure-mgmt-recoveryservicesbackup";
-  version = "5.0.0";
+  version = "5.1.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    hash = "sha256-BciA3sFyja5xo9yS3WVglC73y8gTfw8UejdEzbD4HYE=";
+    hash = "sha256-xl+KbNGceJWFvJKH8Aw02Ho+wMAxvxPZ4T09Qimn7OU=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/bip_utils/default.nix b/pkgs/development/python-modules/bip_utils/default.nix
index ec351457a222..16786b2e0189 100644
--- a/pkgs/development/python-modules/bip_utils/default.nix
+++ b/pkgs/development/python-modules/bip_utils/default.nix
@@ -3,7 +3,6 @@
 , fetchFromGitHub
 , pythonOlder
 , ecdsa
-, pysha3
 , coincurve
 , pynacl
 , crcmod
@@ -14,21 +13,26 @@
 }:
 
 buildPythonPackage rec {
-  pname = "bip_utils";
+  pname = "bip-utils";
   version = "2.7.0";
+  format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "ebellocchia";
-    repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-m7/CC5/T6qR2Ot4y5WQlzOAR0czz6XHCjJskES+2nns=";
+    repo = "bip_utils";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-m7/CC5/T6qR2Ot4y5WQlzOAR0czz6XHCjJskES+2nns=";
   };
 
+  postPatch = ''
+    substituteInPlace requirements.txt \
+      --replace "coincurve>=15.0.1,<18.0.0" "coincurve"
+  '';
+
   propagatedBuildInputs = [
     ecdsa
-    pysha3
     cbor2
     pynacl
     coincurve
@@ -42,10 +46,11 @@ buildPythonPackage rec {
     "bip_utils"
   ];
 
-  meta = {
+  meta = with lib; {
     description = "Implementation of BIP39, BIP32, BIP44, BIP49 and BIP84 for wallet seeds, keys and addresses generation";
     homepage = "https://github.com/ebellocchia/bip_utils";
-    license = with lib.licenses; [ mit ];
-    maintainers = with lib.maintainers; [ prusnak stargate01 ];
+    changelog = "https://github.com/ebellocchia/bip_utils/blob/v${version}/CHANGELOG.md";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ prusnak stargate01 ];
   };
 }
diff --git a/pkgs/development/python-modules/dacite/default.nix b/pkgs/development/python-modules/dacite/default.nix
index f2e0a4b2d96c..a33a26d5224d 100644
--- a/pkgs/development/python-modules/dacite/default.nix
+++ b/pkgs/development/python-modules/dacite/default.nix
@@ -2,13 +2,12 @@
 , fetchFromGitHub
 , buildPythonPackage
 , pythonOlder
-, pythonAtLeast
 , pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "dacite";
-  version = "1.7.0";
+  version = "1.8.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -17,9 +16,14 @@ buildPythonPackage rec {
     owner = "konradhalas";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-+yWvlJcOmqDkHl3JZfPnIV3C4ieSo4FiBvoUZ0+J4N0=";
+    hash = "sha256-aQwQHFWaXwTaA6GQgDcWT6ivE9YtWtHCTOtxDi503+M=";
   };
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace "--benchmark-autosave --benchmark-json=benchmark.json" ""
+  '';
+
   nativeCheckInputs = [
     pytestCheckHook
   ];
@@ -28,6 +32,10 @@ buildPythonPackage rec {
     "dacite"
   ];
 
+  disabledTestPaths = [
+    "tests/performance"
+  ];
+
   meta = with lib; {
     description = "Python helper to create data classes from dictionaries";
     homepage = "https://github.com/konradhalas/dacite";
diff --git a/pkgs/development/python-modules/humanize/default.nix b/pkgs/development/python-modules/humanize/default.nix
index aa39edd5c24d..33348ff252c7 100644
--- a/pkgs/development/python-modules/humanize/default.nix
+++ b/pkgs/development/python-modules/humanize/default.nix
@@ -11,8 +11,8 @@
 }:
 
 buildPythonPackage rec {
-  version = "4.4.0";
   pname = "humanize";
+  version = "4.5.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -20,8 +20,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "python-humanize";
     repo = pname;
-    rev = version;
-    hash = "sha256-XxlmOs3sfHOLTkrKGsHRiBWpuCIPJua2VkKxDmjOeWE=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-vTfK45sZ9m7TUQJwZpQWhOXgZzO46CwCsnNP+PI1YfA=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
@@ -57,6 +57,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python humanize utilities";
     homepage = "https://github.com/python-humanize/humanize";
+    changelog = "https://github.com/python-humanize/humanize/releases/tag/${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ rmcgibbo Luflosi ];
   };
diff --git a/pkgs/development/python-modules/internetarchive/default.nix b/pkgs/development/python-modules/internetarchive/default.nix
index 2bede522584c..e0021cbc39e0 100644
--- a/pkgs/development/python-modules/internetarchive/default.nix
+++ b/pkgs/development/python-modules/internetarchive/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "internetarchive";
-  version = "3.2.0";
+  version = "3.3.0";
 
   format = "setuptools";
 
@@ -24,7 +24,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-cB7nRDmO2NNaHjNkHCuXH0+15WZfxseS8DBdIqefSzk=";
+    sha256 = "sha256-PLf+PMIXlaoL974e7coQCQKH6cVBYODPhkDxa2vhTB0=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/jaraco-context/default.nix b/pkgs/development/python-modules/jaraco-context/default.nix
index 6a8c0fd1ea4a..7a882c80195c 100644
--- a/pkgs/development/python-modules/jaraco-context/default.nix
+++ b/pkgs/development/python-modules/jaraco-context/default.nix
@@ -7,16 +7,16 @@
 
 buildPythonPackage rec {
   pname = "jaraco-context";
-  version = "4.2.0";
+  version = "4.3.0";
   format = "pyproject";
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "jaraco";
     repo = "jaraco.context";
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-J7vL+pvwXcKEkqZn44/U01HmP1CI5kIGsJ1aJevp0I4=";
+    hash = "sha256-YdbkpKv7k62uyhmjKoxeA9uf5BWnRD/rK+z46FJN4xk=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
@@ -32,11 +32,14 @@ buildPythonPackage rec {
   # Module has no tests
   doCheck = false;
 
-  pythonImportsCheck = [ "jaraco.context" ];
+  pythonImportsCheck = [
+    "jaraco.context"
+  ];
 
   meta = with lib; {
     description = "Python module for context management";
     homepage = "https://github.com/jaraco/jaraco.context";
+    changelog = "https://github.com/jaraco/jaraco.context/blob/v${version}/CHANGES.rst";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/magic-wormhole-mailbox-server/default.nix b/pkgs/development/python-modules/magic-wormhole-mailbox-server/default.nix
index 3e4f31dff60a..0a9e26771c4a 100644
--- a/pkgs/development/python-modules/magic-wormhole-mailbox-server/default.nix
+++ b/pkgs/development/python-modules/magic-wormhole-mailbox-server/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, fetchpatch
 , six
 , attrs
 , twisted
@@ -9,17 +10,30 @@
 , autobahn
 , treq
 , mock
+, pythonOlder
 }:
 
 buildPythonPackage rec {
-  version = "0.4.1";
   pname = "magic-wormhole-mailbox-server";
+  version = "0.4.1";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
     sha256 = "1af10592909caaf519c00e706eac842c5e77f8d4356215fe9c61c7b2258a88fb";
   };
 
+  patches = [
+    (fetchpatch {
+      # Remove the 'U' open mode removed, https://github.com/magic-wormhole/magic-wormhole-mailbox-server/pull/34
+      name = "fix-for-python-3.11.patch";
+      url = "https://github.com/magic-wormhole/magic-wormhole-mailbox-server/commit/4b358859ba80de37c3dc0a5f67ec36909fd48234.patch";
+      hash = "sha256-RzZ5kD+xhmFYusVzAbGE+CODXtJVR1zN2rZ+VGApXiQ=";
+    })
+  ];
+
   propagatedBuildInputs = [
     attrs
     six
@@ -33,6 +47,7 @@ buildPythonPackage rec {
     mock
     twisted
   ];
+
   checkPhase = ''
     trial -j$NIX_BUILD_CORES wormhole_mailbox_server
   '';
@@ -40,6 +55,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Securely transfer data between computers";
     homepage = "https://github.com/warner/magic-wormhole-mailbox-server";
+    changelog = "https://github.com/magic-wormhole/magic-wormhole-mailbox-server/blob/${version}/NEWS.md";
     license = licenses.mit;
     maintainers = with maintainers; [ SuperSandro2000 ];
   };
diff --git a/pkgs/development/python-modules/mautrix/default.nix b/pkgs/development/python-modules/mautrix/default.nix
index ff92d814a099..dd3553419792 100644
--- a/pkgs/development/python-modules/mautrix/default.nix
+++ b/pkgs/development/python-modules/mautrix/default.nix
@@ -1,40 +1,67 @@
 { lib
 , buildPythonPackage
-, fetchPypi
-, aiohttp
+, fetchFromGitHub
 , pythonOlder
-, sqlalchemy
-, ruamel-yaml
-, CommonMark
-, lxml
+  # deps
+, aiohttp
+, attrs
+, yarl
+  # optional deps
+, python-magic
+, python-olm
+, unpaddedbase64
+, pycryptodome
+  # check deps
+, pytestCheckHook
+, pytest-asyncio
 , aiosqlite
+, sqlalchemy
+, asyncpg
 }:
 
 buildPythonPackage rec {
   pname = "mautrix";
-  version = "0.18.9";
+  version = "0.19.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-Ihaz/izB9L6osu3CPwBWOwLZ2JOLKhsDuqOUf/B02qI=";
+  src = fetchFromGitHub {
+    owner = "mautrix";
+    repo = "python";
+    rev = "v${version}";
+    hash = "sha256-7nvy2/DUS2BkcyQUUG8+aT/JHcPu141e5YWOiccS6cU=";
   };
 
   propagatedBuildInputs = [
     aiohttp
-
-    # defined in optional-requirements.txt
-    sqlalchemy
-    aiosqlite
-    ruamel-yaml
-    CommonMark
-    lxml
+    attrs
+    yarl
   ];
 
-  # no tests available
-  doCheck = false;
+  passthru.optional-dependencies = {
+    detect_mimetype = [
+      python-magic
+    ];
+    encryption = [
+      python-olm
+      unpaddedbase64
+      pycryptodome
+    ];
+  };
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  checkInputs = [
+    pytest-asyncio
+    aiosqlite
+    sqlalchemy
+    asyncpg
+  ] ++ passthru.optional-dependencies.encryption;
+
+  SQLALCHEMY_SILENCE_UBER_WARNING = 1;
 
   pythonImportsCheck = [
     "mautrix"
@@ -45,6 +72,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/tulir/mautrix-python";
     changelog = "https://github.com/mautrix/python/releases/tag/v${version}";
     license = licenses.mpl20;
-    maintainers = with maintainers; [ nyanloutre ma27 sumnerevans ];
+    maintainers = with maintainers; [ nyanloutre ma27 sumnerevans nickcao ];
   };
 }
diff --git a/pkgs/development/python-modules/opensearch-py/default.nix b/pkgs/development/python-modules/opensearch-py/default.nix
new file mode 100644
index 000000000000..7f9fd5c85b16
--- /dev/null
+++ b/pkgs/development/python-modules/opensearch-py/default.nix
@@ -0,0 +1,59 @@
+{ aiohttp
+, botocore
+, buildPythonPackage
+, certifi
+, fetchFromGitHub
+, lib
+, mock
+, pytest-asyncio
+, pytestCheckHook
+, pyyaml
+, requests
+, urllib3
+}:
+
+buildPythonPackage rec {
+  pname = "opensearch-py";
+  version = "2.1.1";
+  format = "setuptools";
+
+  src = fetchFromGitHub {
+    owner = "opensearch-project";
+    repo = "opensearch-py";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-uJ6fdRPDK76qKHE4E6dI01vKgvfqbc6A1RCwnOtuOTY=";
+  };
+
+  propagatedBuildInputs = [
+    botocore
+    certifi
+    requests
+    urllib3
+  ];
+
+  nativeCheckInputs = [
+    mock
+    pytest-asyncio
+    pytestCheckHook
+    pyyaml
+  ] ++ passthru.optional-dependencies.async;
+
+  disabledTestPaths = [
+    # require network
+    "test_opensearchpy/test_async/test_connection.py"
+    "test_opensearchpy/test_async/test_server"
+    "test_opensearchpy/test_connection.py"
+    "test_opensearchpy/test_server"
+    "test_opensearchpy/test_server_secured"
+  ];
+
+  passthru.optional-dependencies.async = [ aiohttp ];
+
+  meta = {
+    description = "Python low-level client for OpenSearch";
+    homepage = "https://github.com/opensearch-project/opensearch-py";
+    changelog = "https://github.com/opensearch-project/opensearch-py/releases/tag/v${version}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ mcwitt ];
+  };
+}
diff --git a/pkgs/development/python-modules/pybind11/default.nix b/pkgs/development/python-modules/pybind11/default.nix
index 1286805a918c..a5154a3e4abd 100644
--- a/pkgs/development/python-modules/pybind11/default.nix
+++ b/pkgs/development/python-modules/pybind11/default.nix
@@ -15,13 +15,13 @@
 
 buildPythonPackage rec {
   pname = "pybind11";
-  version = "2.10.2";
+  version = "2.10.3";
 
   src = fetchFromGitHub {
     owner = "pybind";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-YxAkozyWNTKMCIEk3AhHZbRHtzhRrCSB3wh/Qy9CIyU=";
+    hash = "sha256-Rlr6Ec6BEujTxQkQ9UP+6u0cYeFsJlj7U346MtRM6QM=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pyhaversion/default.nix b/pkgs/development/python-modules/pyhaversion/default.nix
index 17966ad58b21..38b71b80e782 100644
--- a/pkgs/development/python-modules/pyhaversion/default.nix
+++ b/pkgs/development/python-modules/pyhaversion/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "pyhaversion";
-  version = "22.8.0";
+  version = "23.1.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "ludeeus";
     repo = pname;
     rev = "refs/tags/${version}";
-    sha256 = "sha256-30UHbxs0WZyIVyq0ai2PsoPTkvoYawS1OBhVbV0JVN8=";
+    sha256 = "sha256-HMJqZn0yzN2dP5WTRCbem1Xw8nyH2Hy7oVP4kEKHHAo=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pyramid/default.nix b/pkgs/development/python-modules/pyramid/default.nix
index 44a7779d3a59..426459a67fb4 100644
--- a/pkgs/development/python-modules/pyramid/default.nix
+++ b/pkgs/development/python-modules/pyramid/default.nix
@@ -13,28 +13,48 @@
 , webob
 , zope_deprecation
 , zope_interface
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "pyramid";
-  version = "2.0";
+  version = "2.0.1";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "45431b387587ed0fac6213b54d6e9f0936f0cc85238a8f5af7852fc9484c5c77";
+    hash = "sha256-+r/XRQOeJq1bCRX8OW6HJcD4o9F7lB+WEezR7XbP59o=";
   };
 
-  nativeCheckInputs = [ webtest zope_component ];
+  propagatedBuildInputs = [
+    hupper
+    pastedeploy
+    plaster
+    plaster-pastedeploy
+    repoze_lru
+    translationstring
+    venusian
+    webob
+    zope_deprecation
+    zope_interface
+  ];
 
-  propagatedBuildInputs = [ hupper pastedeploy plaster plaster-pastedeploy repoze_lru translationstring venusian webob zope_deprecation zope_interface ];
+  nativeCheckInputs = [
+    webtest
+    zope_component
+  ];
 
-  pythonImportsCheck = [ "pyramid" ];
+  pythonImportsCheck = [
+    "pyramid"
+  ];
 
   meta = with lib; {
-    description = "The Pyramid Web Framework, a Pylons project";
+    description = "Python web framework";
     homepage = "https://trypyramid.com/";
+    changelog = "https://github.com/Pylons/pyramid/blob/${version}/CHANGES.rst";
     license = licenses.bsd0;
     maintainers = with maintainers; [ domenkozar ];
   };
-
 }
diff --git a/pkgs/development/python-modules/qimage2ndarray/default.nix b/pkgs/development/python-modules/qimage2ndarray/default.nix
index 431b5c9bfa10..9c54df213dc3 100644
--- a/pkgs/development/python-modules/qimage2ndarray/default.nix
+++ b/pkgs/development/python-modules/qimage2ndarray/default.nix
@@ -5,12 +5,12 @@
 
 buildPythonPackage rec {
   pname = "qimage2ndarray";
-  version = "1.9.0";
+  version = "1.10.0";
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-p5B1xtDYRDxEIu6WmlQJ5E/QJUVxYEzOqHXGyV4/Veo=";
+    sha256 = "sha256-NyUQJEbcimlrLsd1sdKvQ7E69qf56+6KNxFbuVQ6LFg=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/reportengine/default.nix b/pkgs/development/python-modules/reportengine/default.nix
index a7f0df89c34c..17720e8bec2b 100644
--- a/pkgs/development/python-modules/reportengine/default.nix
+++ b/pkgs/development/python-modules/reportengine/default.nix
@@ -16,12 +16,12 @@
 
 buildPythonPackage rec {
   pname = "reportengine";
-  version = "0.30.dev0";
+  version = "0.31";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "eb612994b7f364e872301b4569b544648e95e587d803284ddb5610efc8f2170f";
+    sha256 = "sha256-jrt+ml8o1PUidV1bY0hCyNgcPaVTBloW574/i5Pl7iE=";
   };
 
   nativeBuildInputs = [ flit ];
diff --git a/pkgs/development/tools/altair-graphql-client/default.nix b/pkgs/development/tools/altair-graphql-client/default.nix
index f9d1c4549a79..5d69cef598d0 100644
--- a/pkgs/development/tools/altair-graphql-client/default.nix
+++ b/pkgs/development/tools/altair-graphql-client/default.nix
@@ -2,11 +2,11 @@
 
 let
   pname = "altair";
-  version = "5.0.10";
+  version = "5.0.13";
 
   src = fetchurl {
     url = "https://github.com/imolorhe/altair/releases/download/v${version}/altair_${version}_x86_64_linux.AppImage";
-    sha256 = "sha256-NrFkLZiqX21BSIuE8qF7lurNWKgmf7PAa/1IpPbcUf0=";
+    sha256 = "sha256-kjAC21gZ3VKM+WFKV3tOPzIaG3t9rUSo2M3CEsA1q+I=";
   };
 
   appimageContents = appimageTools.extract { inherit pname version src; };
diff --git a/pkgs/development/tools/azcopy/default.nix b/pkgs/development/tools/azcopy/default.nix
index 55c6a3475879..1a7e13e0ec3d 100644
--- a/pkgs/development/tools/azcopy/default.nix
+++ b/pkgs/development/tools/azcopy/default.nix
@@ -2,18 +2,18 @@
 
 buildGoModule rec {
   pname = "azure-storage-azcopy";
-  version = "10.16.2";
+  version = "10.17.0";
 
   src = fetchFromGitHub {
     owner = "Azure";
     repo = "azure-storage-azcopy";
     rev = "v${version}";
-    sha256 = "sha256-Pab4IYktNWWTudAY7Zx9dI+fRp0yihD78L0MmBHxeNY=";
+    sha256 = "sha256-a25MA/fDjCvsKzEh34IM34TyXECJ0j07H9jr6JX1uc0=";
   };
 
   subPackages = [ "." ];
 
-  vendorSha256 = "sha256-OlsNFhduilo8fJs/mynrAiwuXcfCZERdaJk3VcAUCJw=";
+  vendorHash = "sha256-Cb4RVY+E8QcvxSworBujsvqSSGxFGfW0W7nFjmpfLQ8=";
 
   doCheck = false;
 
diff --git a/pkgs/development/tools/ctlptl/default.nix b/pkgs/development/tools/ctlptl/default.nix
index f4b155da7265..1759596e8f71 100644
--- a/pkgs/development/tools/ctlptl/default.nix
+++ b/pkgs/development/tools/ctlptl/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "ctlptl";
-  version = "0.8.15";
+  version = "0.8.16";
 
   src = fetchFromGitHub {
     owner = "tilt-dev";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-JCBlP8ESCiqr4pk8QyG5CVs+3qSlnvw0jYS5R0Civk0=";
+    hash = "sha256-JCBlP8ESCiqr4pk8QyG5CVs+3qSlnvw0jYS5R0Civk0=";
   };
 
-  vendorSha256 = "sha256-M9B/rfMBjYJb9szmYPVZqURlcv62qHOLJ3ka0v++z0s=";
+  vendorHash = "sha256-M9B/rfMBjYJb9szmYPVZqURlcv62qHOLJ3ka0v++z0s=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/development/tools/database/sqlcl/default.nix b/pkgs/development/tools/database/sqlcl/default.nix
index 733282cd4067..ccf3bd4a23d3 100644
--- a/pkgs/development/tools/database/sqlcl/default.nix
+++ b/pkgs/development/tools/database/sqlcl/default.nix
@@ -1,8 +1,8 @@
 { lib, stdenv, makeWrapper, requireFile, unzip, jdk }:
 
 let
-  version = "22.3.1";
-  fileVersion = "1032109-01";
+  version = "22.4.0.342.1212";
+  fileVersion = "1032835-01";
 in
   stdenv.mkDerivation {
 
@@ -37,7 +37,7 @@ in
 
         nix-prefetch-url --type sha256 file:///path/to/${name}
     '';
-    sha256 = "0yqj8m2zwl8m7zxrzjnbl2rqnl2imn5h1bfpnmklp03nkakbzjbn";
+    sha256 = "0i4xsj502s465fgmlcqn80r8rqzr11mv74x9fzrlbqmkkh5c782k";
   };
 
   nativeBuildInputs = [ makeWrapper unzip ];
diff --git a/pkgs/development/tools/jql/default.nix b/pkgs/development/tools/jql/default.nix
index 071f944a82f3..1a1c3e7a9961 100644
--- a/pkgs/development/tools/jql/default.nix
+++ b/pkgs/development/tools/jql/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "jql";
-  version = "5.1.4";
+  version = "5.1.6";
 
   src = fetchFromGitHub {
     owner = "yamafaktory";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-D6Y3I5UPChdLlTZ49iToQpE8CrHh3VjWV6PI7fRhU/A=";
+    sha256 = "sha256-ybcX2dm+gnvhWAcraCq22uGqe8NdqNd8QMNKVkqgNqY=";
   };
 
-  cargoSha256 = "sha256-GqfQD8NK/HYODEGUmfo+MMVsWg2CabZFLfBTp4UXV2Q=";
+  cargoHash = "sha256-GzRxXBDMALaXLhpklVoSn+8uCgws5AjkC+fynym0iYo=";
 
   meta = with lib; {
     description = "A JSON Query Language CLI tool built with Rust";
diff --git a/pkgs/development/tools/kafkactl/default.nix b/pkgs/development/tools/kafkactl/default.nix
index c3af6e9c1a4b..d18b32c6f440 100644
--- a/pkgs/development/tools/kafkactl/default.nix
+++ b/pkgs/development/tools/kafkactl/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "kafkactl";
-  version = "3.0.1";
+  version = "3.0.2";
 
   src = fetchFromGitHub {
     owner = "deviceinsight";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-lwyM2l4eBCtkyAtG51cEy29Jw/vakjrfYVBSZ9pIBFs=";
+    sha256 = "sha256-ZEXW9nqkR0yuVIY9qr1RyKVE7tSlP59Xb4JZfdAK2To=";
   };
 
-  vendorSha256 = "sha256-ba7amhYuCB3k1esu1qYBCgUZMjlq5iac498TMqeGuz0=";
+  vendorHash = "sha256-e7SJjDWcHPgupZujeRD3Zg6vFAudDC3V60R2B61fjGU=";
   doCheck = false;
 
   meta = with lib; {
diff --git a/pkgs/development/tools/kustomize/kustomize-sops.nix b/pkgs/development/tools/kustomize/kustomize-sops.nix
index 6efeaad63848..28c80444650d 100644
--- a/pkgs/development/tools/kustomize/kustomize-sops.nix
+++ b/pkgs/development/tools/kustomize/kustomize-sops.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "kustomize-sops";
-  version = "3.1.0";
+  version = "4.0.0";
 
   src = fetchFromGitHub {
     owner = "viaduct-ai";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-sufP/+YixgrOCJJ4P1SjmZpRlSaufRmnVDiv6H+RCyQ=";
+    sha256 = "sha256-8CZcPZLainc7iRZ5Ul27QxW3oK7sikCjzCBEkfCeNUc=";
   };
 
-  vendorHash = "sha256-WZb8VsFKpvvMys1iK3irEsWCnvKaKDzuyFertVswpdE=";
+  vendorHash = "sha256-GBjMN6pyB+48e5LNqLBbh6a5fC9P0T53CZUPGNcbBDc=";
 
   installPhase = ''
     mkdir -p $out/lib/viaduct.ai/v1/ksops-exec/
diff --git a/pkgs/development/tools/marksman/default.nix b/pkgs/development/tools/marksman/default.nix
index aa3b29275132..d31268f9cedd 100644
--- a/pkgs/development/tools/marksman/default.nix
+++ b/pkgs/development/tools/marksman/default.nix
@@ -8,13 +8,13 @@
 
 buildDotnetModule rec {
   pname = "marksman";
-  version = "2022-12-28";
+  version = "2023-01-29";
 
   src = fetchFromGitHub {
     owner = "artempyanykh";
     repo = "marksman";
     rev = version;
-    sha256 = "sha256-IOmAOO45sD0TkphbHWLCXXyouxKNJoiNYHXV/bw0xH4=";
+    sha256 = "sha256-UPPO4ueu7gMR7a573M2/xT3N0QgRSNBshJAqoyXEZpc=";
   };
 
   projectFile = "Marksman/Marksman.fsproj";
diff --git a/pkgs/development/tools/mold/default.nix b/pkgs/development/tools/mold/default.nix
index b6c018693e5e..bb55ba807964 100644
--- a/pkgs/development/tools/mold/default.nix
+++ b/pkgs/development/tools/mold/default.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mold";
-  version = "1.9.0";
+  version = "1.10.1";
 
   src = fetchFromGitHub {
     owner = "rui314";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-i4+MOEZWt+Qb05HgXcGR0uDuMoOAyMhVeLPQwnGiEw8=";
+    hash = "sha256-5zE5a+BYzQjgVb0Ti7bSQrGzTyysOTTR0NMOO5IKG68=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/games/itchiodl/default.nix b/pkgs/games/itchiodl/default.nix
index ba84b5c3e818..c68be798f4dc 100644
--- a/pkgs/games/itchiodl/default.nix
+++ b/pkgs/games/itchiodl/default.nix
@@ -5,13 +5,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "itchiodl";
-  version = "2.1.2";
+  version = "2.2.0";
 
   src = fetchFromGitHub {
     owner = "Emersont1";
     repo = "itchio";
     rev = "v${version}";
-    hash = "sha256-U9oLrocwVdTqTQ26/MMiYO++yFGdOjnn8g+ea1jCl/A=";
+    hash = "sha256-tylMEsUdeMUuLcxRMkkJE7vPAVuqc/cVJ4DB3xmV+iA=";
   };
 
   format = "pyproject";
diff --git a/pkgs/misc/dxvk/default.nix b/pkgs/misc/dxvk/default.nix
index 2c55b6b50cef..0e46011e7e10 100644
--- a/pkgs/misc/dxvk/default.nix
+++ b/pkgs/misc/dxvk/default.nix
@@ -1,75 +1,34 @@
 { lib
-, pkgs
 , stdenvNoCC
 , fetchFromGitHub
 , pkgsCross
+, stdenv
+, bash
 }:
 
 stdenvNoCC.mkDerivation (finalAttrs:
   let
-    system = lib.toLower stdenvNoCC.targetPlatform.uname.system;
-
-    # DXVK needs to be a separate derivation because it’s actually a set of DLLs for Windows that
-    # needs to be built with a cross-compiler.
-    dxvk32 = pkgsCross.mingw32.callPackage ./dxvk.nix {
-      inherit (finalAttrs) src version dxvkPatches;
-    };
-    dxvk64 = pkgsCross.mingwW64.callPackage ./dxvk.nix {
-      inherit (finalAttrs) src version dxvkPatches;
-    };
-
-    # Split out by platform to make maintenance easy in case supported versions on Darwin and other
-    # platforms diverge (due to the need for Darwin-specific patches that would fail to apply).
-    # Should that happen, set `darwin` to the last working `rev` and `hash`.
-    srcs = rec {
-      darwin = {
-        rev = "v${finalAttrs.version}";
-        hash = "sha256-T93ZylxzJGprrP+j6axZwl2d3hJowMCUOKNjIyNzkmE=";
-        version = "1.10.3";
-      };
-      default = {
-        rev = "v${finalAttrs.version}";
-        hash = "sha256-mboVLdPgZMzmqyeF0jAloEz6xqfIDiY/X98e7l2KZnw=";
-        version = "2.0";
-      };
-    };
+    dxvk32 = if stdenv.isDarwin then pkgsCross.mingw32.dxvk_1 else pkgsCross.mingw32.dxvk_2;
+    dxvk64 = if stdenv.isDarwin then pkgsCross.mingwW64.dxvk_1 else pkgsCross.mingwW64.dxvk_2;
   in
   {
     name = "dxvk";
-    inherit (srcs."${system}" or srcs.default) version;
-
-    src = fetchFromGitHub {
-      owner = "doitsujin";
-      repo = "dxvk";
-      inherit (srcs."${system}" or srcs.default) rev hash;
-    };
-
-    # Override this to patch DXVK itself (rather than the setup script).
-    dxvkPatches = lib.optionals stdenvNoCC.isDarwin [
-      # Patch DXVK to work with MoltenVK even though it doesn’t support some required features.
-      # Some games work poorly (particularly Unreal Engine 4 games), but others work pretty well.
-      ./darwin-dxvk-compat.patch
-      # Use synchronization primitives from the C++ standard library to avoid deadlocks on Darwin.
-      # See: https://www.reddit.com/r/macgaming/comments/t8liua/comment/hzsuce9/
-      ./darwin-thread-primitives.patch
-    ];
+    inherit (dxvk64) version;
 
     outputs = [ "out" "bin" "lib" ];
 
-    # Also copy `mcfgthread-12.dll` due to DXVK’s being built in a MinGW cross environment.
-    patches = [ ./mcfgthread.patch ];
-
+    dontUnpack = true;
     dontConfigure = true;
     dontBuild = true;
 
     installPhase = ''
       mkdir -p $out/bin $bin $lib
-      # Replace both basedir forms to support both DXVK 2.0 and older versions.
-      substitute setup_dxvk.sh $out/bin/setup_dxvk.sh \
+      substitute ${./setup_dxvk.sh} $out/bin/setup_dxvk.sh \
+        --subst-var-by bash ${bash} \
+        --subst-var-by dxvk32 ${dxvk32} \
+        --subst-var-by dxvk64 ${dxvk64} \
         --subst-var-by mcfgthreads32 "${pkgsCross.mingw32.windows.mcfgthreads}" \
-        --subst-var-by mcfgthreads64 "${pkgsCross.mingwW64.windows.mcfgthreads}" \
-        --replace 'basedir=$(dirname "$(readlink -f $0)")' "basedir=$bin" \
-        --replace 'basedir="$(dirname "$(readlink -f "$0")")"' "basedir=$bin"
+        --subst-var-by mcfgthreads64 "${pkgsCross.mingwW64.windows.mcfgthreads}"
       chmod a+x $out/bin/setup_dxvk.sh
       declare -A dxvks=( [x32]=${dxvk32} [x64]=${dxvk64} )
       for arch in "''${!dxvks[@]}"; do
@@ -79,7 +38,7 @@ stdenvNoCC.mkDerivation (finalAttrs:
     '';
 
     meta = {
-      description = "A Vulkan-based translation layer for Direct3D 9/10/11";
+      description = "Setup script for DXVK";
       homepage = "https://github.com/doitsujin/dxvk";
       changelog = "https://github.com/doitsujin/dxvk/releases";
       maintainers = [ lib.maintainers.reckenrode ];
diff --git a/pkgs/misc/dxvk/dxvk.nix b/pkgs/misc/dxvk/dxvk.nix
index 7607c9ee4412..793264f9b30b 100644
--- a/pkgs/misc/dxvk/dxvk.nix
+++ b/pkgs/misc/dxvk/dxvk.nix
@@ -5,31 +5,81 @@
 , meson
 , ninja
 , windows
-, src
-, version
+, dxvkVersion
 , spirv-headers
 , vulkan-headers
-, dxvkPatches
+, SDL2
+, glfw
+, pkgsBuildHost
+, sdl2Support ? true
+, glfwSupport ? false
 }:
 
+# SDL2 and GLFW support are mutually exclusive.
+assert !sdl2Support || !glfwSupport;
+
 let
   # DXVK 2.0+ no longer vendors certain dependencies. This derivation also needs to build on Darwin,
   # which does not currently support DXVK 2.0, so adapt conditionally for this situation.
-  isDxvk2 = lib.versionAtLeast version "2.0";
+  isDxvk2 = lib.versionAtLeast (srcs.${dxvkVersion}.version) "2.0";
+
+  # DXVK has effectively the same build script regardless of platform.
+  srcs = {
+    "1.10" = rec {
+      version = "1.10.3";
+      src = fetchFromGitHub {
+        owner = "doitsujin";
+        repo = "dxvk";
+        rev = "v${version}";
+        hash = "sha256-T93ZylxzJGprrP+j6axZwl2d3hJowMCUOKNjIyNzkmE=";
+      };
+      # These patches are required when using DXVK with Wine on Darwin.
+      patches = lib.optionals stdenv.buildPlatform.isDarwin [
+        # Patch DXVK to work with MoltenVK even though it doesn’t support some required features.
+        # Some games work poorly (particularly Unreal Engine 4 games), but others work pretty well.
+        ./darwin-dxvk-compat.patch
+        # Use synchronization primitives from the C++ standard library to avoid deadlocks on Darwin.
+        # See: https://www.reddit.com/r/macgaming/comments/t8liua/comment/hzsuce9/
+        ./darwin-thread-primitives.patch
+      ];
+    };
+    "2.1" = rec {
+      version = "2.1";
+      src = fetchFromGitHub {
+        owner = "doitsujin";
+        repo = "dxvk";
+        rev = "v${version}";
+        hash = "sha256-A4KR11brfQbR56dGt371MRwMN/H6HFAU8TlFC97/bRs=";
+        fetchSubmodules = true; # Needed for the DirectX headers and libdisplay-info
+      };
+      patches = [ ];
+    };
+  };
+
+  isWindows = stdenv.targetPlatform.uname.system == "Windows";
+  isCross = stdenv.hostPlatform != stdenv.targetPlatform;
 in
 stdenv.mkDerivation {
   pname = "dxvk";
-  inherit src version;
+  inherit (srcs.${dxvkVersion}) version src patches;
 
   nativeBuildInputs = [ glslang meson ninja ];
-  buildInputs = [ windows.pthreads ]
-    ++ lib.optionals isDxvk2 [ spirv-headers vulkan-headers ];
+  buildInputs = lib.optional isWindows [ windows.pthreads ]
+    ++ lib.optionals isDxvk2 (
+      [ spirv-headers vulkan-headers ]
+      ++ lib.optional (!isWindows && sdl2Support) SDL2
+      ++ lib.optional (!isWindows && glfwSupport) glfw
+    );
 
-  patches = dxvkPatches;
+  postPatch = lib.optionalString isDxvk2 ''
+    substituteInPlace "subprojects/libdisplay-info/tool/gen-search-table.py" \
+      --replace "/usr/bin/env python3" "${lib.getBin pkgsBuildHost.python3}/bin/python3"
+  '';
 
-  preConfigure = lib.optionalString isDxvk2 ''
-    ln -s ${lib.getDev spirv-headers}/include include/spirv/include
-    ln -s ${lib.getDev vulkan-headers}/include include/vulkan/include
+  # Build with the Vulkan SDK in nixpkgs.
+  preConfigure = ''
+    rm -rf include/spirv/include include/vulkan/include
+    mkdir -p include/spirv/include include/vulkan/include
   '';
 
   mesonFlags =
@@ -38,9 +88,12 @@ stdenv.mkDerivation {
     in
     [
       "--buildtype" "release"
-      "--cross-file" "build-win${arch}.txt"
       "--prefix" "${placeholder "out"}"
-    ];
+    ]
+    ++ lib.optionals isCross [ "--cross-file" "build-win${arch}.txt" ]
+    ++ lib.optional glfwSupport "-Ddxvk_native_wsi=glfw";
+
+  doCheck = isDxvk2 && !isCross;
 
   meta = {
     description = "A Vulkan-based translation layer for Direct3D 9/10/11";
@@ -48,6 +101,6 @@ stdenv.mkDerivation {
     changelog = "https://github.com/doitsujin/dxvk/releases";
     maintainers = [ lib.maintainers.reckenrode ];
     license = lib.licenses.zlib;
-    platforms = lib.platforms.windows;
+    platforms = lib.platforms.windows ++ lib.optionals isDxvk2 lib.platforms.linux;
   };
 }
diff --git a/pkgs/misc/dxvk/mcfgthread.patch b/pkgs/misc/dxvk/mcfgthread.patch
deleted file mode 100644
index 037071630172..000000000000
--- a/pkgs/misc/dxvk/mcfgthread.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-diff --git a/setup_dxvk.sh b/setup_dxvk.sh
-index 3e63ecf0..87c04f23 100755
---- a/setup_dxvk.sh
-+++ b/setup_dxvk.sh
-@@ -133,6 +133,8 @@
-         rm -v "${dstfile}"
-       fi
-       $file_cmd "${srcfile}" "${dstfile}"
-+    elif [ "${4}" = "--force" ]; then
-+      $file_cmd "${srcfile}" "${dstfile}"
-     else
-       echo "${dstfile}: File not found in wine prefix" >&2
-       return 1
-@@ -170,12 +172,12 @@
- }
- 
- install() {
--  installFile "$win64_sys_path" "$dxvk_lib64" "$1"
-+  installFile "$win64_sys_path" "$dxvk_lib64" "$1" "${2-}"
-   inst64_ret="$?"
- 
-   inst32_ret=-1
-   if $wow64; then
--    installFile "$win32_sys_path" "$dxvk_lib32" "$1"
-+    installFile "$win32_sys_path" "$dxvk_lib32" "$1" "${2-}"
-     inst32_ret="$?"
-   fi
- 
-@@ -214,3 +216,5 @@
- 
- $action d3d10core
- $action d3d11
-+
-+basedir="" dxvk_lib32=@mcfgthreads32@/bin dxvk_lib64=@mcfgthreads64@/bin $action mcfgthread-12 --force
diff --git a/pkgs/misc/dxvk/setup_dxvk.sh b/pkgs/misc/dxvk/setup_dxvk.sh
new file mode 100644
index 000000000000..8fadb264fd3d
--- /dev/null
+++ b/pkgs/misc/dxvk/setup_dxvk.sh
@@ -0,0 +1,265 @@
+#!@bash@/bin/bash -e
+
+set -eu -o pipefail
+
+dxvk32_dir=@dxvk32@/bin
+dxvk64_dir=@dxvk64@/bin
+
+mcfgthreads32_dir=@mcfgthreads32@/bin
+mcfgthreads64_dir=@mcfgthreads64@/bin
+
+## Defaults
+
+declare -A dlls=(
+    [d3d9]="dxvk/d3d9.dll"
+    [d3d10]="dxvk/d3d10.dll dxvk/d3d10_1.dll dxvk/d3d10core.dll"
+    [d3d11]="dxvk/d3d11.dll"
+    [dxgi]="dxvk/dxgi.dll"
+    [mcfgthreads]="mcfgthreads/mcfgthread-12.dll"
+)
+
+declare -A targets=([d3d9]=1 [d3d11]=1 [dxgi]=1 [mcfgthreads]=1)
+
+## Command-line Parsing
+
+usage() {
+    echo "DXVK @version@"
+    echo "Set up Wine prefix with DXVK DLLs"
+    echo
+    echo "USAGE"
+    echo "    $0 [install|uninstall] [OPTIONS]"
+    echo
+    echo "COMMANDS"
+    echo "    install                  Copy the DXVK DLLs into the prefix"
+    echo "    uninstall                Restore the backed up Wine DLLs in the prefix"
+    echo
+    echo "OPTIONS"
+    echo "    --with(out)-dxgi         Copy DXVK DXGI DLL into prefix (default: with DXGI)"
+    echo "    --with(out)-d3d10        Copy D3D10 DLLs into prefix (default: without D3D10)"
+    echo "    -s, --symlink            Symlink instead of copy"
+    echo "    -f, --force              Create a Wine prefix even if it does not exist"
+    echo "    -p, --prefix <PREFIX>    Wine prefix to manage (default: \$WINEPREFIX)"
+    exit 1
+}
+
+case "$1" in
+    uninstall|install)
+        action=$1
+        shift
+        ;;
+    -h|--help)
+        usage
+        ;;
+    *)
+        if [ ! -z "${1:-}" ]; then
+            echo "Unrecognized command: $1"
+        fi
+        usage
+        ;;
+esac
+
+
+do_symlink=false
+do_makeprefix=false
+
+while [ ! -z "${1:-}" ]; do
+    case "$1" in
+        --with-dxgi)
+            targets[dxgi]=1
+            ;;
+        --without-dxgi)
+            unset targets[dxgi]
+            ;;
+        --with-d3d10)
+            targets[d3d10]=1
+            ;;
+        --without-d3d10)
+            unset targets[d3d10]
+            ;;
+        -s|--symlink)
+            do_symlink=true
+            ;;
+        --no-symlink)
+            do_symlink=false
+            ;;
+        -f|--force)
+            do_makeprefix=true
+            ;;
+        --no-force)
+            do_makeprefix=false
+            ;;
+        -p|--prefix)
+            shift
+            if [ ! -z "${1:-}" ]; then
+                WINEPREFIX=$1
+            else
+                echo "Required PREFIX missing"
+                usage
+            fi
+            ;;
+        -h|--help)
+            usage
+            ;;
+        *)
+            echo "Unrecognized option: $1"
+            usage
+            ;;
+    esac
+    shift
+done
+
+## Get information on the Wine environment
+
+export WINEPREFIX=${WINEPREFIX:-"$HOME/.wine"}
+
+# check wine prefix before invoking wine, so that we
+# don't accidentally create one if the user screws up
+if ! $do_makeprefix && [ -n "$WINEPREFIX" ] && ! [ -f "$WINEPREFIX/system.reg" ]; then
+    echo "$WINEPREFIX: Not a valid wine prefix." >&2
+    exit 1
+fi
+
+export WINEDEBUG=-all
+# disable mscoree and mshtml to avoid downloading
+# wine gecko and mono
+export WINEDLLOVERRIDES="mscoree,mshtml="
+
+wine="wine"
+wine64="wine64"
+wineboot="wineboot"
+
+# $PATH is the way for user to control where wine is located (including custom Wine versions).
+# Pure 64-bit Wine (non Wow64) requries skipping 32-bit steps.
+# In such case, wine64 and winebooot will be present, but wine binary will be missing,
+# however it can be present in other PATHs, so it shouldn't be used, to avoid versions mixing.
+wine_path=$(dirname "$(command -v $wineboot)")
+wow64=true
+if ! [ -f "$wine_path/$wine" ]; then
+   wine=$wine64
+   wow64=false
+fi
+
+# resolve 32-bit and 64-bit system32 path
+winever=$($wine --version | grep wine)
+if [ -z "$winever" ]; then
+    echo "$wine: Not a wine executable. Check your $wine." >&2
+    exit 1
+fi
+
+# ensure wine placeholder dlls are recreated
+# if they are missing
+$wineboot -u
+
+win64_sys_path=$($wine64 winepath -u 'C:\windows\system32' 2> /dev/null)
+win64_sys_path="${win64_sys_path/$'\r'/}"
+if $wow64; then
+  win32_sys_path=$($wine winepath -u 'C:\windows\system32' 2> /dev/null)
+  win32_sys_path="${win32_sys_path/$'\r'/}"
+fi
+
+if [ -z "${win32_sys_path:-}" ] && [ -z "${win64_sys_path:-}" ]; then
+  echo 'Failed to resolve C:\windows\system32.' >&2
+  exit 1
+fi
+
+## Utility functions
+
+install_file() {
+    $do_symlink && file_cmd="ln -sv" || file_cmd="install -m 755 -v"
+
+    srcfile=$1
+    dstfile=$2
+
+    if [ -f "${srcfile}.so" ]; then
+        srcfile="${srcfile}.so"
+    fi
+
+    if ! [ -f "${srcfile}" ]; then
+        echo "${srcfile}: File not found. Skipping." >&2
+        return 1
+    fi
+
+    if [ -n "$1" ]; then
+        if [ -f "${dstfile}" ] || [ -h "${dstfile}" ]; then
+            if ! [ -f "${dstfile}.old" ]; then
+                mv -v "${dstfile}" "${dstfile}.old"
+            else
+                rm -v "${dstfile}"
+            fi
+        fi
+        $file_cmd "${srcfile}" "${dstfile}"
+    else
+        echo "${dstfile}: File not found in wine prefix" >&2
+        return 1
+    fi
+}
+
+uninstall_file() {
+    srcfile=$1
+    dstfile=$2
+
+    if [ -f "${srcfile}.so" ]; then
+        srcfile="${srcfile}.so"
+    fi
+
+    if ! [ -f "${srcfile}" ]; then
+        echo "${srcfile}: File not found. Skipping." >&2
+        return 1
+    fi
+
+    if ! [ -f "${dstfile}" ] && ! [ -h "${dstfile}" ]; then
+        echo "${dstfile}: File not found. Skipping." >&2
+        return 1
+    fi
+
+    if [ -f "${dstfile}.old" ]; then
+        rm -v "${dstfile}"
+        mv -v "${dstfile}.old" "${dstfile}"
+        return 0
+    else
+        return 1
+    fi
+}
+
+install_override() {
+    dll=$(basename "$1")
+    $wine reg add 'HKEY_CURRENT_USER\Software\Wine\DllOverrides' /v "$dll" /d native /f >/dev/null 2>&1
+    if [ $? -ne 0 ]; then
+        echo -e "Failed to add override for $dll"
+        exit 1
+    fi
+}
+
+uninstall_override() {
+    dll=$(basename "$1")
+    $wine reg delete 'HKEY_CURRENT_USER\Software\Wine\DllOverrides' /v "$dll" /f > /dev/null 2>&1
+    if [ $? -ne 0 ]; then
+        echo "Failed to remove override for $dll"
+    fi
+}
+
+## Perform the requested command
+
+declare -A paths
+
+for target in "${!targets[@]}"; do
+    [ ${targets[$target]} -eq 1 ] || continue
+    for dll in ${dlls[$target]}; do
+        dllname=$(basename "$dll")
+        basedir=$(dirname "$dll")
+
+        if [ ! -z "${win32_sys_path:-}" ]; then
+            basedir32=${basedir}32_dir
+            paths["${!basedir32}/$dllname"]="$win32_sys_path/$dllname"
+        fi
+        if [ ! -z "${win64_sys_path:-}" ]; then
+            basedir64=${basedir}64_dir
+            paths["${!basedir64}/$dllname"]="$win64_sys_path/$dllname"
+        fi
+    done
+done
+
+for srcpath in "${!paths[@]}"; do
+    ${action}_file "$srcpath" "${paths["$srcpath"]}"
+    ${action}_override "$(basename srcpath)"
+done
diff --git a/pkgs/os-specific/linux/picoprobe-udev-rules/default.nix b/pkgs/os-specific/linux/picoprobe-udev-rules/default.nix
new file mode 100644
index 000000000000..4a651bf473e5
--- /dev/null
+++ b/pkgs/os-specific/linux/picoprobe-udev-rules/default.nix
@@ -0,0 +1,32 @@
+{ lib, stdenv, fetchurl }:
+
+## Usage
+# In NixOS, simply add this package to services.udev.packages:
+#   services.udev.packages = [ pkgs.picoprobe-udev-rules ];
+
+stdenv.mkDerivation rec {
+  pname = "picoprobe-udev-rules";
+  version = "unstable-2023-01-31";
+
+  src = fetchurl {
+    url = "https://raw.githubusercontent.com/probe-rs/webpage/1cba61acc6ecb5ff96f74641269844ad88ad8ad5/static/files/69-probe-rs.rules";
+    sha256 = "sha256-vQMPX3Amttja0u03KWGnPDAVTGM9ekJ+IBTjW+xlJS0=";
+  };
+
+  dontUnpack = true;
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+    install -D $src $out/lib/udev/rules.d/69-probe-rs.rules
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    homepage = "https://probe.rs/docs/getting-started/probe-setup/#udev-rules";
+    description = "Picoprobe udev rules list";
+    platforms = platforms.linux;
+    license = licenses.gpl2Only;
+    maintainers = with maintainers; [ mglolenstine ];
+  };
+}
diff --git a/pkgs/servers/headscale/default.nix b/pkgs/servers/headscale/default.nix
index b84632746c94..c8a4b99d58e0 100644
--- a/pkgs/servers/headscale/default.nix
+++ b/pkgs/servers/headscale/default.nix
@@ -6,16 +6,16 @@
 }:
 buildGoModule rec {
   pname = "headscale";
-  version = "0.18.0";
+  version = "0.19.0";
 
   src = fetchFromGitHub {
     owner = "juanfont";
     repo = "headscale";
     rev = "v${version}";
-    hash = "sha256-0viXsBRCiaxBTTKXJngSov5M7toscQUOdXDTr1l0U3I=";
+    hash = "sha256-/KT3JZ/xYcKRynksWgsPsioCLTSxeQxr6WjRUzYXJcU=";
   };
 
-  vendorHash = "sha256-SuKT+b8g6xEK15ry2IAmpS/vwDG+zJqK9nfsWpHNXuU=";
+  vendorHash = "sha256-8p5NFxXKaZPsW4B6NMzfi0pqfVroIahSgA0fukvB3JI=";
 
   ldflags = ["-s" "-w" "-X github.com/juanfont/headscale/cmd/headscale/cli.Version=v${version}"];
 
diff --git a/pkgs/servers/heisenbridge/default.nix b/pkgs/servers/heisenbridge/default.nix
index db7d40ad35d5..1371bac15d66 100644
--- a/pkgs/servers/heisenbridge/default.nix
+++ b/pkgs/servers/heisenbridge/default.nix
@@ -4,17 +4,18 @@ let
   python = python3.override {
     packageOverrides = self: super: {
       mautrix = super.mautrix.overridePythonAttrs (oldAttrs: rec {
-        version = "0.16.3";
-        src = oldAttrs.src.override {
-          inherit (oldAttrs) pname;
-          inherit version;
-          hash = "sha256-OpHLh5pCzGooQ5yxAa0+85m/szAafV+l+OfipQcfLtU=";
+        version = "0.16.10";
+        src = fetchFromGitHub {
+          owner = "mautrix";
+          repo = "python";
+          rev = "v${version}";
+          hash = "sha256-YQsQ7M+mHcRdGUZp+mo46AlBmKSdmlgRdGieEG0Hu9k=";
         };
       });
     };
   };
-
-in python.pkgs.buildPythonApplication rec {
+in
+python.pkgs.buildPythonApplication rec {
   pname = "heisenbridge";
   version = "1.13.1";
 
@@ -30,11 +31,10 @@ in python.pkgs.buildPythonApplication rec {
   '';
 
   propagatedBuildInputs = with python.pkgs; [
-    aiohttp
     irc
+    ruamel-yaml
     mautrix
     python-socks
-    pyyaml
   ];
 
   nativeCheckInputs = with python.pkgs; [
diff --git a/pkgs/servers/jackett/default.nix b/pkgs/servers/jackett/default.nix
index 2bd89a7c143b..ba6e1cdcc7a7 100644
--- a/pkgs/servers/jackett/default.nix
+++ b/pkgs/servers/jackett/default.nix
@@ -9,13 +9,13 @@
 
 buildDotnetModule rec {
   pname = "jackett";
-  version = "0.20.2732";
+  version = "0.20.2782";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    hash = "sha512-h9vQ4OFXt3Fb7+2QSsXJh/uqy9glRFAZfZ8fdBqqna/59PV8GtItYWSJi7FhGVeFMX+WMQnsxG0/8Hq1z7akMA==";
+    hash = "sha512-qBstaZfBts2EfYVt+iU9QqIEVRfPIqt122NAMlS42yoV7iLqeXfK989Wm6FoYtTvvgtNpVJ9rLPNMSSH3AX3TQ==";
   };
 
   projectFile = "src/Jackett.Server/Jackett.Server.csproj";
diff --git a/pkgs/servers/komga/default.nix b/pkgs/servers/komga/default.nix
index 47aca84a80b2..e1db293f6499 100644
--- a/pkgs/servers/komga/default.nix
+++ b/pkgs/servers/komga/default.nix
@@ -8,11 +8,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "komga";
-  version = "0.160.0";
+  version = "0.161.0";
 
   src = fetchurl {
     url = "https://github.com/gotson/${pname}/releases/download/v${version}/${pname}-${version}.jar";
-    sha256 = "sha256-maNOiC+hFv/mniU1spZVZrUJETT5sgdi1OmbYR2smFk=";
+    sha256 = "sha256-TZ/TxX9OgDGx8zD2mI8cTDPZSqBjkYN3Uy+W9MXbJOI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/servers/mautrix-googlechat/default.nix b/pkgs/servers/mautrix-googlechat/default.nix
index db1f7c6d1f25..74389663455f 100644
--- a/pkgs/servers/mautrix-googlechat/default.nix
+++ b/pkgs/servers/mautrix-googlechat/default.nix
@@ -1,17 +1,19 @@
-{ fetchFromGitHub, fetchpatch
+{ fetchFromGitHub
+, fetchpatch
 , lib
 , python3
-, protobuf3_20
-, enableE2be ? true, enableMetrics ? true, enableSqlite ? true
+, enableE2be ? true
+, enableMetrics ? true
+, enableSqlite ? true
 }: python3.pkgs.buildPythonApplication rec {
   pname = "mautrix-googlechat";
-  version = "0.4.0";
+  version = "unstable-2023-01-25";
 
   src = fetchFromGitHub {
     owner = "mautrix";
     repo = "googlechat";
-    rev = "v${version}";
-    sha256 = "sha256-UVWYT0HTOUEkBG0n6KNhCSSO/2PAF1rIvCaw478z+q0=";
+    rev = "e2eb528745466468f059c506c22e500e0cd832aa";
+    sha256 = "sha256-FNlEHzuy89RuFUwZPmVA+4AmpQHGD+18BguGC6qBdBM=";
   };
 
   patches = [
@@ -24,13 +26,6 @@
     })
   ];
 
-  doCheck = false;
-
-  postPatch = ''
-    sed -i requirements.txt \
-      -e 's/asyncpg>=.*/asyncpg/'
-  '';
-
   baseConfigPath = "share/mautrix-googlechat/example-config.yaml";
   postInstall = ''
     rm $out/example-config.yaml
@@ -43,8 +38,12 @@
       pycryptodome
       unpaddedbase64
     ];
-    metrics = [ prometheus-client ];
-    sqlite = [ aiosqlite ];
+    metrics = [
+      prometheus-client
+    ];
+    sqlite = [
+      aiosqlite
+    ];
   };
 
   propagatedBuildInputs = with python3.pkgs; [
@@ -54,14 +53,14 @@
     ruamel-yaml
     CommonMark
     python-magic
-    (protobuf.override {
-      protobuf = protobuf3_20;
-    })
+    protobuf3
     mautrix
   ] ++ lib.optionals enableE2be passthru.optional-dependencies.e2be
   ++ lib.optionals enableMetrics passthru.optional-dependencies.metrics
   ++ lib.optionals enableSqlite passthru.optional-dependencies.sqlite;
 
+  doCheck = false;
+
   meta = with lib; {
     homepage = "https://github.com/mautrix/googlechat";
     description = "A Matrix-Google Chat puppeting bridge";
diff --git a/pkgs/servers/mautrix-signal/default.nix b/pkgs/servers/mautrix-signal/default.nix
index 7aada1e2eed5..8ff6f1d36694 100644
--- a/pkgs/servers/mautrix-signal/default.nix
+++ b/pkgs/servers/mautrix-signal/default.nix
@@ -11,6 +11,20 @@ python3.pkgs.buildPythonPackage rec {
     sha256 = "sha256-UbetU1n9zD/mVFaJc9FECDq/Zell1TI/aYPsGXGB8Js=";
   };
 
+  postPatch = ''
+    # the version mangling in mautrix_signal/get_version.py interacts badly with pythonRelaxDepsHook
+    substituteInPlace setup.py \
+      --replace 'version=version' 'version="${version}"'
+  '';
+
+  nativeBuildInputs = with python3.pkgs; [
+    pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [
+    "mautrix"
+  ];
+
   propagatedBuildInputs = with python3.pkgs; [
     CommonMark
     aiohttp
@@ -31,12 +45,6 @@ python3.pkgs.buildPythonPackage rec {
 
   doCheck = false;
 
-  postPatch = ''
-    substituteInPlace requirements.txt \
-      --replace "asyncpg>=0.20,<0.26" "asyncpg>=0.20" \
-      --replace "mautrix>=0.16.0,<0.17" "mautrix>=0.16.0"
-  '';
-
   postInstall = ''
     mkdir -p $out/bin
 
diff --git a/pkgs/servers/mautrix-telegram/default.nix b/pkgs/servers/mautrix-telegram/default.nix
index 468df32bbddd..2284a677b656 100644
--- a/pkgs/servers/mautrix-telegram/default.nix
+++ b/pkgs/servers/mautrix-telegram/default.nix
@@ -9,28 +9,31 @@ let
   python = python3.override {
     packageOverrides = self: super: {
       tulir-telethon = self.telethon.overridePythonAttrs (oldAttrs: rec {
-        version = "1.27.0a1";
+        version = "1.27.0a7";
         pname = "tulir-telethon";
         src = super.fetchPypi {
           inherit pname version;
-          sha256 = "sha256-tABAY4UlTyMK1ZafIFawegjBAtcnq3HMNbE1L6WaT3E=";
+          sha256 = "sha256-w4WILvLvJBKf3Nlj0omTCDDD4z+b0XFlCplQ/IHwIPs=";
         };
         doCheck = false;
       });
     };
   };
-in python.pkgs.buildPythonPackage rec {
+in
+python.pkgs.buildPythonPackage rec {
   pname = "mautrix-telegram";
-  version = "0.12.2";
+  version = "unstable-2023-01-28";
   disabled = python.pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "mautrix";
     repo = "telegram";
-    rev = "v${version}";
-    sha256 = "sha256-htCk0VLr6GfXbpYWF/2bmpko7gSVlkH6HwDjOMhW8is=";
+    rev = "f12abbe03846fd5897d58572ab24b70a58b337d2";
+    sha256 = "sha256-5ZZ85FOmTO26q2zhAIsF7mTlN4BLNLW2dQF+0culkUM=";
   };
 
+  format = "setuptools";
+
   patches = [ ./0001-Re-add-entrypoint.patch ];
 
   propagatedBuildInputs = with python.pkgs; ([
@@ -43,19 +46,24 @@ in python.pkgs.buildPythonPackage rec {
     tulir-telethon
     asyncpg
     Mako
-    # optional
+    # speedups
     cryptg
-    cchardet
     aiodns
     brotli
+    # qr_login
     pillow
     qrcode
+    # formattednumbers
     phonenumbers
+    # metrics
     prometheus-client
+    # sqlite
     aiosqlite
   ] ++ lib.optionals withHQthumbnails [
+    # hq_thumbnails
     moviepy
   ] ++ lib.optionals withE2BE [
+    # e2be
     python-olm
     pycryptodome
     unpaddedbase64
diff --git a/pkgs/servers/monitoring/prometheus/redis-exporter.nix b/pkgs/servers/monitoring/prometheus/redis-exporter.nix
index afe28b690f79..44d86af8957d 100644
--- a/pkgs/servers/monitoring/prometheus/redis-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/redis-exporter.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "redis_exporter";
-  version = "1.45.0";
+  version = "1.46.0";
 
   src = fetchFromGitHub {
     owner = "oliver006";
     repo = "redis_exporter";
     rev = "v${version}";
-    sha256 = "sha256-5KiqVrhb/yEaxgLJ3SB/WHNOfCbPzfJcgdPZ2kuNFEY=";
+    sha256 = "sha256-5OZ4DuGIVMw0Yvd4JC+dbX01RAUAZHmROzl+7Pd6+tc=";
   };
 
-  vendorSha256 = "sha256-SBag82QLLPeGowt10edaAnUWI36i71Ps0pdixiAXVB8=";
+  vendorHash = "sha256-p6C/j1591cmPtIvBH1022YRkfBo07KQ8fqUwJ5YIUn8=";
 
   ldflags = [
     "-X main.BuildVersion=${version}"
diff --git a/pkgs/servers/monitoring/prometheus/zfs-exporter.nix b/pkgs/servers/monitoring/prometheus/zfs-exporter.nix
index 8f0be0901e05..488d3e22e654 100644
--- a/pkgs/servers/monitoring/prometheus/zfs-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/zfs-exporter.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "zfs_exporter";
-  version = "2.2.5";
+  version = "2.2.7";
 
   src = fetchFromGitHub {
     owner = "pdf";
     repo = pname;
     rev = "v" + version;
-    hash = "sha256-FY3P2wmNWyr7mImc1PJs1G2Ae8rZvDzq0kRZfiRTzyc=";
+    hash = "sha256-bc9bmGrRGhm58JzrVLLJBUc1zaGXqz2fqx+ZphidFbc=";
   };
 
-  vendorSha256 = "sha256-jQiw3HlqWcsjdadDdovCsDMBB3rnWtacfbtzDb5rc9c=";
+  vendorHash = "sha256-jQiw3HlqWcsjdadDdovCsDMBB3rnWtacfbtzDb5rc9c=";
 
   postInstall = ''
     install -Dm444 -t $out/share/doc/${pname} *.md
diff --git a/pkgs/servers/pocketbase/default.nix b/pkgs/servers/pocketbase/default.nix
index 71b1bf567847..357da5292821 100644
--- a/pkgs/servers/pocketbase/default.nix
+++ b/pkgs/servers/pocketbase/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "pocketbase";
-  version = "0.11.3";
+  version = "0.12.0";
 
   src = fetchFromGitHub {
     owner = "pocketbase";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-M55IylFGAKy9TEIyLSHGbf9FjU5OjvoHjwYkiS31Zpk=";
+    sha256 = "sha256-Ptp01SnVqQ+qFxX4Qsoyw9bkw+inm9gMSRqtmAcFlVE=";
   };
 
-  vendorHash = "sha256-D8nFoTggxYNj7ZSY1rvA4YSJHbB7wwpPSu1g+S3c1C0=";
+  vendorHash = "sha256-8NBudXcU3cjSbo6qpGZVLtbrLedzwijwrbiTgC+OMcU=";
 
   # This is the released subpackage from upstream repo
   subPackages = [ "examples/base" ];
diff --git a/pkgs/servers/redpanda/default.nix b/pkgs/servers/redpanda/default.nix
index 84b63d5984e3..e2a265c0f5ef 100644
--- a/pkgs/servers/redpanda/default.nix
+++ b/pkgs/servers/redpanda/default.nix
@@ -1,14 +1,14 @@
 { lib, stdenv, fetchzip }:
 
 let
-  version = "22.3.5";
+  version = "22.3.11";
   platform = if stdenv.isLinux then "linux" else "darwin";
   arch = if stdenv.isAarch64 then "arm" else "amd";
   sha256s = {
-    darwin.amd = "sha256-AXk3aP1SGiHTfHTCBRTagX0DAVmdcVVIkxWaTnZxB8g=";
-    darwin.arm = "sha256-pvOVvNc8lZ2d2fVZVYWvumVWYpnLORNY/3o1t4BN2N4=";
-    linux.amd = "sha256-wsUuSCstYucjMpFsqssPGEhm3zCrAdE9Mldtkypbthg=";
-    linux.arm = "sha256-WHjYAbytiu747jFqN0KZ/CkIwAVI7fb32ywtRiQOBm8=";
+    darwin.amd = "sha256-kwAKxFg7BSNInvsQvFqgtpq8EEwSnmDeDyaF5b8L8SQ=";
+    darwin.arm = "sha256-kH5Ii672SeAIiRcWuAO3oVJVSBWp+r78RmTiR3BaDbg=";
+    linux.amd = "sha256-EKgkRKBrM4+X2YGoP2LpWRHL+fdHu44LYwCZ+O+c5ZY=";
+    linux.arm = "sha256-9b4oerRXjUVUYoswJWtnMBJSQDoCKClf673VjDQFUAw=";
   };
 in stdenv.mkDerivation rec {
   pname = "redpanda";
diff --git a/pkgs/servers/sql/postgresql/ext/pgaudit.nix b/pkgs/servers/sql/postgresql/ext/pgaudit.nix
new file mode 100644
index 000000000000..c5e536363fda
--- /dev/null
+++ b/pkgs/servers/sql/postgresql/ext/pgaudit.nix
@@ -0,0 +1,31 @@
+{ lib, stdenv, fetchFromGitHub, libkrb5, openssl, postgresql }:
+
+stdenv.mkDerivation rec {
+  pname = "pgaudit";
+  version = "1.7.0";
+
+  src = fetchFromGitHub {
+    owner = "pgaudit";
+    repo = "pgaudit";
+    rev = version;
+    hash = "sha256-8pShPr4HJaJQPjW1iPJIpj3CutTx8Tgr+rOqoXtgCcw=";
+  };
+
+  buildInputs = [ libkrb5 openssl postgresql ];
+
+  makeFlags = [ "USE_PGXS=1" ];
+
+  installPhase = ''
+    install -D -t $out/lib *.so
+    install -D -t $out/share/postgresql/extension *.sql
+    install -D -t $out/share/postgresql/extension *.control
+  '';
+
+  meta = with lib; {
+    description = "Open Source PostgreSQL Audit Logging";
+    homepage = "https://github.com/pgaudit/pgaudit";
+    maintainers = with maintainers; [ idontgetoutmuch ];
+    platforms = postgresql.meta.platforms;
+    license = licenses.postgresql;
+  };
+}
diff --git a/pkgs/servers/sql/postgresql/packages.nix b/pkgs/servers/sql/postgresql/packages.nix
index 80065bde4ba1..2bf9db061a91 100644
--- a/pkgs/servers/sql/postgresql/packages.nix
+++ b/pkgs/servers/sql/postgresql/packages.nix
@@ -24,6 +24,8 @@ self: super: {
 
     pg_similarity = super.callPackage ./ext/pg_similarity.nix { };
 
+    pgaudit = super.callPackage ./ext/pgaudit.nix { };
+
     pgroonga = super.callPackage ./ext/pgroonga.nix { };
 
     pgvector = super.callPackage ./ext/pgvector.nix { };
diff --git a/pkgs/servers/tracing/honeycomb/honeymarker/default.nix b/pkgs/servers/tracing/honeycomb/honeymarker/default.nix
index ab059b518e74..86da469e3468 100644
--- a/pkgs/servers/tracing/honeycomb/honeymarker/default.nix
+++ b/pkgs/servers/tracing/honeycomb/honeymarker/default.nix
@@ -1,13 +1,15 @@
-{ lib, buildGoModule, fetchurl }:
+{ lib, buildGoModule, fetchFromGitHub }:
 import ./versions.nix ({version, sha256}:
   buildGoModule {
   pname = "honeymarker";
   inherit version;
   vendorSha256 = "sha256-ZuDobjC/nizZ7G0o/zVTQmDfDjcdBhfPcmkhgwFc7VU=";
 
-  src = fetchurl {
-    url = "https://github.com/honeycombio/honeymarker/archive/refs/tags/v${version}.tar.gz";
-    inherit sha256;
+  src = fetchFromGitHub {
+    owner = "honeycombio";
+    repo = "honeymarker";
+    rev = "v${version}";
+    hash = sha256;
   };
   inherit (buildGoModule.go) GOOS GOARCH;
 
diff --git a/pkgs/servers/tracing/honeycomb/honeymarker/versions.nix b/pkgs/servers/tracing/honeycomb/honeymarker/versions.nix
index c7fde50e15d0..60e6a537e42e 100644
--- a/pkgs/servers/tracing/honeycomb/honeymarker/versions.nix
+++ b/pkgs/servers/tracing/honeycomb/honeymarker/versions.nix
@@ -1,6 +1,6 @@
 generic: {
   v0_2_1 = generic {
     version = "0.2.1";
-    sha256 = "0gp427bsc1y7k6j1sqgl8r3kng5b0qhmqd4bpfb9139ivmp2sykk";
+    sha256 = "sha256-tiwX94CRvXnUYpiux94XhOj2abn1Uc+wjcDOmw79ab4=";
   };
 }
diff --git a/pkgs/servers/tracing/honeycomb/honeytail/default.nix b/pkgs/servers/tracing/honeycomb/honeytail/default.nix
index cbe901f2859a..b5c21ed1d94a 100644
--- a/pkgs/servers/tracing/honeycomb/honeytail/default.nix
+++ b/pkgs/servers/tracing/honeycomb/honeytail/default.nix
@@ -1,13 +1,15 @@
-{ lib, buildGoModule, fetchurl }:
+{ lib, buildGoModule, fetchFromGitHub }:
 import ./versions.nix ({version, sha256}:
   buildGoModule {
   pname = "honeytail";
   inherit version;
   vendorSha256 = "sha256-LtiiLGLjhbfT49A6Fw5CbSbnmTHMxtcUssr+ayCVrvY=";
 
-  src = fetchurl {
-    url = "https://github.com/honeycombio/honeytail/archive/refs/tags/v${version}.tar.gz";
-    inherit sha256;
+  src = fetchFromGitHub {
+    owner = "honeycombio";
+    repo = "honeytail";
+    rev = "v${version}";
+    hash = sha256;
   };
   inherit (buildGoModule.go) GOOS GOARCH;
 
diff --git a/pkgs/servers/tracing/honeycomb/honeytail/versions.nix b/pkgs/servers/tracing/honeycomb/honeytail/versions.nix
index 370d645ab626..295cc7c6353e 100644
--- a/pkgs/servers/tracing/honeycomb/honeytail/versions.nix
+++ b/pkgs/servers/tracing/honeycomb/honeytail/versions.nix
@@ -1,6 +1,6 @@
 generic: {
   v1_6_0 = generic {
     version = "1.6.0";
-    sha256 = "039svpvqjck7s3rq86s29xgcyxl1wr0zj90s3jsyp058zk1dgwdy";
+    sha256 = "sha256-S0hIgNNzF1eNe+XJs+PT7EUIl5oJCXu+B/zQago4sf8=";
   };
 }
diff --git a/pkgs/servers/tracing/honeycomb/honeyvent/default.nix b/pkgs/servers/tracing/honeycomb/honeyvent/default.nix
index 839b8ec053f7..e1009c35a882 100644
--- a/pkgs/servers/tracing/honeycomb/honeyvent/default.nix
+++ b/pkgs/servers/tracing/honeycomb/honeyvent/default.nix
@@ -1,13 +1,15 @@
-{ lib, buildGoModule, fetchurl }:
+{ lib, buildGoModule, fetchFromGitHub }:
 import ./versions.nix ({version, sha256}:
   buildGoModule {
   pname = "honeyvent";
   inherit version;
   vendorSha256 = null;
 
-  src = fetchurl {
-    url = "https://github.com/honeycombio/honeyvent/archive/refs/tags/v${version}.tar.gz";
-    inherit sha256;
+  src = fetchFromGitHub {
+    owner = "honeycombio";
+    repo = "honeyvent";
+    rev = "v${version}";
+    hash = sha256;
   };
   inherit (buildGoModule.go) GOOS GOARCH;
 
diff --git a/pkgs/servers/tracing/honeycomb/honeyvent/versions.nix b/pkgs/servers/tracing/honeycomb/honeyvent/versions.nix
index 831de6c93372..1bf2443aa183 100644
--- a/pkgs/servers/tracing/honeycomb/honeyvent/versions.nix
+++ b/pkgs/servers/tracing/honeycomb/honeyvent/versions.nix
@@ -1,6 +1,6 @@
 generic: {
   v1_1_0 = generic {
     version = "1.1.0";
-    sha256 = "0ar2m25ngdd1wk7d70j2781wbrvhjhf9cj9qvp24jjrhqng6hvn7";
+    sha256 = "sha256-yFQEOshjaH6fRCQ7IZChANI9guZlTXk35p1NzQvxUdI=";
   };
 }
diff --git a/pkgs/servers/web-apps/discourse/plugins/all-plugins.nix b/pkgs/servers/web-apps/discourse/plugins/all-plugins.nix
index 0712a06863e5..4ddb8995b622 100644
--- a/pkgs/servers/web-apps/discourse/plugins/all-plugins.nix
+++ b/pkgs/servers/web-apps/discourse/plugins/all-plugins.nix
@@ -18,6 +18,7 @@ in
   discourse-oauth2-basic = callPackage ./discourse-oauth2-basic {};
   discourse-openid-connect = callPackage ./discourse-openid-connect {};
   discourse-prometheus = callPackage ./discourse-prometheus {};
+  discourse-reactions = callPackage ./discourse-reactions {};
   discourse-saved-searches = callPackage ./discourse-saved-searches {};
   discourse-solved = callPackage ./discourse-solved {};
   discourse-spoiler-alert = callPackage ./discourse-spoiler-alert {};
diff --git a/pkgs/servers/web-apps/discourse/plugins/discourse-reactions/default.nix b/pkgs/servers/web-apps/discourse/plugins/discourse-reactions/default.nix
new file mode 100644
index 000000000000..ac48f83ae90b
--- /dev/null
+++ b/pkgs/servers/web-apps/discourse/plugins/discourse-reactions/default.nix
@@ -0,0 +1,17 @@
+{ lib, mkDiscoursePlugin, fetchFromGitHub }:
+
+mkDiscoursePlugin {
+  name = "discourse-reactions";
+  src = fetchFromGitHub {
+    owner = "discourse";
+    repo = "discourse-reactions";
+    rev = "3afaabc8e430dfe655be4efbbcb20ab7f0c7c8d3";
+    sha256 = "sha256-CdrInrPFDpvYW7j0epIeAFUoPGTbmMOGdm2DpkIQBbs=";
+  };
+  meta = with lib; {
+    homepage = "https://github.com/discourse/discourse-reactions";
+    maintainers = with maintainers; [ bbenno ];
+    license = licenses.mit;
+    description = "Allows users to react to a post from a choice of emojis, rather than only the like heart";
+  };
+}
diff --git a/pkgs/servers/web-apps/discourse/update.py b/pkgs/servers/web-apps/discourse/update.py
index aa0ddbd60ede..2c5c8f4b44a5 100755
--- a/pkgs/servers/web-apps/discourse/update.py
+++ b/pkgs/servers/web-apps/discourse/update.py
@@ -294,8 +294,9 @@ def update_plugins():
         {'name': 'discourse-ldap-auth', 'owner': 'jonmbake'},
         {'name': 'discourse-math'},
         {'name': 'discourse-migratepassword', 'owner': 'discoursehosting'},
-        {'name': 'discourse-prometheus'},
         {'name': 'discourse-openid-connect'},
+        {'name': 'discourse-prometheus'},
+        {'name': 'discourse-reactions'},
         {'name': 'discourse-saved-searches'},
         {'name': 'discourse-solved'},
         {'name': 'discourse-spoiler-alert'},
diff --git a/pkgs/tools/admin/procs/default.nix b/pkgs/tools/admin/procs/default.nix
index efdfae8268a9..99eedf999119 100644
--- a/pkgs/tools/admin/procs/default.nix
+++ b/pkgs/tools/admin/procs/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "procs";
-  version = "0.13.3";
+  version = "0.13.4";
 
   src = fetchFromGitHub {
     owner = "dalance";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-JVxlfwCA+EetV4QYB6uEKe1yWt3sCvMPZwyIr6Td7Bw=";
+    sha256 = "sha256-PTUATmnpJGeY0Ushf7sAapsZ51VC2IdnKMzYJX5+h9A=";
   };
 
-  cargoSha256 = "sha256-uUxwQIQTzQkKgR4F4sf4J1G2LaXiGbIvA6VM55zLK2E=";
+  cargoHash = "sha256-jxGdozSEIop2jBL4lK3ZcEuuR7P8qDoQD/Lrl4yaBN0=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/admin/syft/default.nix b/pkgs/tools/admin/syft/default.nix
index 30e61e00522f..e7d13b20b60a 100644
--- a/pkgs/tools/admin/syft/default.nix
+++ b/pkgs/tools/admin/syft/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "syft";
-  version = "0.68.1";
+  version = "0.69.0";
 
   src = fetchFromGitHub {
     owner = "anchore";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-iOJnSeVRAjmJblaipmk05J9BvAkYgyS1OA8b3xDykXc=";
+    hash = "sha256-nwS5Oar8ck9StNJtbnZoRv3/v/fYKq/RXVl7CPWBfGY=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
diff --git a/pkgs/tools/archivers/xarchiver/default.nix b/pkgs/tools/archivers/xarchiver/default.nix
index 8862ad8030bf..3a3223728a7a 100644
--- a/pkgs/tools/archivers/xarchiver/default.nix
+++ b/pkgs/tools/archivers/xarchiver/default.nix
@@ -2,14 +2,14 @@
   coreutils, zip, unzip, p7zip, unar, gnutar, bzip2, gzip, lhasa, wrapGAppsHook }:
 
 stdenv.mkDerivation rec {
-  version = "0.5.4.19";
+  version = "0.5.4.20";
   pname = "xarchiver";
 
   src = fetchFromGitHub {
     owner = "ib";
     repo = "xarchiver";
     rev = version;
-    sha256 = "sha256-YCfjOGbjjv4ntNDK3E49hYCVYDhMsRBJ7zsHt8hqQ7Y=";
+    sha256 = "sha256-OzcfIFYaWez2B1lmAYvhm+knuYbyMu2ohs+kGEVG7K0=";
   };
 
   nativeBuildInputs = [ intltool pkg-config makeWrapper wrapGAppsHook ];
diff --git a/pkgs/tools/backup/pgbackrest/default.nix b/pkgs/tools/backup/pgbackrest/default.nix
index e6bdca7c92d8..d8ab7956ade7 100644
--- a/pkgs/tools/backup/pgbackrest/default.nix
+++ b/pkgs/tools/backup/pgbackrest/default.nix
@@ -13,13 +13,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "pgbackrest";
-  version = "2.43";
+  version = "2.44";
 
   src = fetchFromGitHub {
     owner = "pgbackrest";
     repo = "pgbackrest";
     rev = "release/${version}";
-    sha256 = "sha256-JZHE68d8fzqr0kI35TxoVB3Frt/v22xkZexfzhkqzBU=";
+    sha256 = "sha256-N56HUW1JZNvaqzU01xaZ8BsFA2KW4z8ixulPngYCIY0=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/tools/networking/pritunl-client/default.nix b/pkgs/tools/networking/pritunl-client/default.nix
index 09cca7d2eef2..0764c274084a 100644
--- a/pkgs/tools/networking/pritunl-client/default.nix
+++ b/pkgs/tools/networking/pritunl-client/default.nix
@@ -2,17 +2,17 @@
 
 buildGoModule rec {
   pname = "pritunl-client";
-  version = "1.3.3373.6";
+  version = "1.3.3420.31";
 
   src = fetchFromGitHub {
     owner = "pritunl";
     repo = "pritunl-client-electron";
     rev = version;
-    sha256 = "sha256-Ttg6SNDcNIQlbNnKQY32hmsrgLhzHkeQfwlmCHe0bI0=";
+    sha256 = "sha256-FKLYpn2HeAVGN9OjLowv2BJRLZKReqXLPFvbin/jaBo=";
   };
 
   modRoot = "cli";
-  vendorSha256 = "sha256-fI2RIzvfbqBgchsvY8hsiecXYItM2XX9h8oiP3zmfTA=";
+  vendorHash = "sha256-fI2RIzvfbqBgchsvY8hsiecXYItM2XX9h8oiP3zmfTA=";
 
   postInstall = ''
     mv $out/bin/cli $out/bin/pritunl-client
diff --git a/pkgs/tools/nix/info/info.sh b/pkgs/tools/nix/info/info.sh
index c309e8be1649..6ec827350469 100755
--- a/pkgs/tools/nix/info/info.sh
+++ b/pkgs/tools/nix/info/info.sh
@@ -70,7 +70,7 @@ nixev() {
 }
 
 desc_system() {
-    nixev '(import <nixpkgs> {}).stdenv.hostPlatform.system'
+    nixev 'builtins.currentSystem'
 }
 
 desc_host_os() {
@@ -98,7 +98,7 @@ desc_multi_user() {
 }
 
 desc_nixpkgs_path() {
-    nixev '<nixpkgs>'
+    nixev '<nixpkgs>' 2>/dev/null || echo "not found"
 }
 
 channel_facts() {
diff --git a/pkgs/tools/text/igrep/default.nix b/pkgs/tools/text/igrep/default.nix
index ea0ecf58a96d..1e17cda75d5f 100644
--- a/pkgs/tools/text/igrep/default.nix
+++ b/pkgs/tools/text/igrep/default.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "igrep";
-  version = "1.0.0";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "konradsz";
     repo = "igrep";
     rev = "v${version}";
-    sha256 = "sha256-pXgmbSmOLeAtI7pP0X9go4KnlLv4RChBQNCPYeG4Q84=";
+    sha256 = "sha256-g6DY3+HwBNQ+jxByXyTJK5CjAaC48FpmsDf1qGGO/Lk=";
   };
 
-  cargoHash = "sha256-n1AVD6PuZFdZbTuGxNHvR6ngoVmSAixabcJl6nIcyP0=";
+  cargoHash = "sha256-7cSUIwWyWPxFDuRWplidbI93zbBV84T7e4Q//Uwj6N4=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ Security ];
 
diff --git a/pkgs/tools/text/mdbook-open-on-gh/default.nix b/pkgs/tools/text/mdbook-open-on-gh/default.nix
index ea7fd3a22e70..cba1e97591ef 100644
--- a/pkgs/tools/text/mdbook-open-on-gh/default.nix
+++ b/pkgs/tools/text/mdbook-open-on-gh/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mdbook-open-on-gh";
-  version = "2.3.0";
+  version = "2.3.1";
 
   src = fetchFromGitHub {
     owner = "badboy";
     repo = pname;
     rev = version;
-    hash = "sha256-omQTyJ7XKRBjX8jyWLONajAYnwr93nElrwDLdvs2MxM=";
+    hash = "sha256-uXfvE34yRrTUjh/HTMvOeZVxX4Drt6sxziaazg0CR3I=";
   };
 
-  cargoHash = "sha256-57KcqALWbiGtp6HWSN42gZ0St38oHu3inZ0TT77j7go=";
+  cargoHash = "sha256-ol06ErggVLw2ThpXq9NRWEr7ymDSEBN4ae5zUmHKa7k=";
 
   meta = with lib; {
     description = "mdbook preprocessor to add a open-on-github link on every page";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 23e5f2b8a05f..10554e0e4999 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -21477,6 +21477,8 @@ with pkgs;
 
   libopusenc = callPackage ../development/libraries/libopusenc { };
 
+  liboqs = callPackage ../development/libraries/liboqs { };
+
   libosinfo = callPackage ../development/libraries/libosinfo { };
 
   libosip = callPackage ../development/libraries/osip {};
@@ -26331,6 +26333,8 @@ with pkgs;
 
   perf-tools = callPackage ../os-specific/linux/perf-tools { };
 
+  picoprobe-udev-rules = callPackage ../os-specific/linux/picoprobe-udev-rules { };
+
   pipes = callPackage ../misc/screensavers/pipes { };
 
   pipes-rs = callPackage ../misc/screensavers/pipes-rs { };
@@ -37304,6 +37308,8 @@ with pkgs;
   dump = callPackage ../tools/backup/dump { };
 
   dxvk = callPackage ../misc/dxvk { };
+  dxvk_1 = callPackage ../misc/dxvk/dxvk.nix { dxvkVersion = "1.10"; };
+  dxvk_2 = callPackage ../misc/dxvk/dxvk.nix { dxvkVersion = "2.1"; };
 
   ecdsatool = callPackage ../tools/security/ecdsatool { };
 
@@ -38873,6 +38879,8 @@ with pkgs;
 
   xmcp = callPackage ../tools/X11/xmcp { };
 
+  yesplaymusic = callPackage ../applications/audio/yesplaymusic { };
+
   ymuse = callPackage ../applications/audio/ymuse { };
 
   zk = callPackage ../applications/office/zk {};
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 15efcc8da02d..cea21c667260 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -6655,6 +6655,8 @@ self: super: with self; {
 
   openrouteservice = callPackage ../development/python-modules/openrouteservice { };
 
+  opensearch-py = callPackage ../development/python-modules/opensearch-py { };
+
   opensensemap-api = callPackage ../development/python-modules/opensensemap-api { };
 
   opensfm = callPackage ../development/python-modules/opensfm { };