diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index d48b6de7bca7..380c810281ec 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -5620,6 +5620,12 @@
     githubId = 84968;
     name = "Florian Paul Schmidt";
   };
+  fptje = {
+    email = "fpeijnenburg@gmail.com";
+    github = "FPtje";
+    githubId = 1202014;
+    name = "Falco Peijnenburg";
+  };
   fragamus = {
     email = "innovative.engineer@gmail.com";
     github = "fragamus";
@@ -15556,6 +15562,12 @@
     githubId = 6391601;
     name = "Roger Mason";
   };
+  sputn1ck = {
+    email = "kon@kon.ninja";
+    github = "sputn1ck";
+    githubId = 8904314;
+    name = "Konstantin Nick";
+  };
   squalus = {
     email = "squalus@squalus.net";
     github = "squalus";
diff --git a/nixos/modules/system/boot/stage-1.nix b/nixos/modules/system/boot/stage-1.nix
index 28b5592d9d7d..7aaa3f85bfe0 100644
--- a/nixos/modules/system/boot/stage-1.nix
+++ b/nixos/modules/system/boot/stage-1.nix
@@ -91,7 +91,7 @@ let
   # we just copy what we need from Glibc and use patchelf to make it
   # work.
   extraUtils = pkgs.runCommand "extra-utils"
-    { nativeBuildInputs = [pkgs.buildPackages.nukeReferences];
+    { nativeBuildInputs = with pkgs.buildPackages; [ nukeReferences bintools ];
       allowedReferences = [ "out" ]; # prevent accidents like glibc being included in the initrd
     }
     ''
@@ -122,7 +122,7 @@ let
         # code, using default options and effectively ignore security relevant
         # ZFS properties such as `setuid=off` and `exec=off` (unless manually
         # duplicated in `fileSystems.*.options`, defeating "zfsutil"'s purpose).
-        copy_bin_and_libs ${pkgs.util-linux.mount}/bin/mount
+        copy_bin_and_libs ${lib.getOutput "mount" pkgs.util-linux}/bin/mount
         copy_bin_and_libs ${pkgs.zfs}/bin/mount.zfs
       ''}
 
diff --git a/pkgs/applications/blockchains/aperture/default.nix b/pkgs/applications/blockchains/aperture/default.nix
new file mode 100644
index 000000000000..e208666bfe2c
--- /dev/null
+++ b/pkgs/applications/blockchains/aperture/default.nix
@@ -0,0 +1,27 @@
+{ buildGoModule
+, fetchFromGitHub
+, lib
+}:
+
+buildGoModule rec {
+  pname = "aperture";
+  version = "0.2-beta";
+
+  src = fetchFromGitHub {
+    owner = "lightninglabs";
+    repo = "aperture";
+    rev = "v${version}";
+    hash = "sha256-l1fpjCAg+1PGNotKrjFLoYOMEzRNXC1mfdjRPfE0DsY=";
+  };
+
+  vendorHash = "sha256-tWFFmRSDUZXijAUTgR8k4EERHwIEBOyZZZ9BGXso/tU=";
+
+  subPackages = [ "cmd/aperture" ];
+
+  meta = with lib; {
+    description = "L402 (Lightning HTTP 402) Reverse Proxy";
+    homepage = "https://github.com/lightninglabs/aperture";
+    license = licenses.mit;
+    maintainers = with maintainers; [ sputn1ck ];
+  };
+}
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index 989fbf258be1..b5179460e9ac 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -10470,6 +10470,18 @@ final: prev:
     meta.homepage = "https://github.com/haya14busa/vim-asterisk/";
   };
 
+  vim-astro = buildVimPluginFrom2Nix {
+    pname = "vim-astro";
+    version = "2022-08-25";
+    src = fetchFromGitHub {
+      owner = "wuelnerdotexe";
+      repo = "vim-astro";
+      rev = "34732be5e9a5c28c2409f4490edf92d46d8b55a9";
+      sha256 = "1ild33hxiphj0z8b4kpcad4rai7q7jd0lsmhpa30kfgmyj5kh90z";
+    };
+    meta.homepage = "https://github.com/wuelnerdotexe/vim-astro/";
+  };
+
   vim-asymptote = buildVimPluginFrom2Nix {
     pname = "vim-asymptote";
     version = "2014-06-26";
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index 72f09aa5a721..70c8b1ce202f 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -885,6 +885,7 @@ https://github.com/ThePrimeagen/vim-apm/,,
 https://github.com/PeterRincker/vim-argumentative/,,
 https://github.com/FooSoft/vim-argwrap/,,
 https://github.com/haya14busa/vim-asterisk/,,
+https://github.com/wuelnerdotexe/vim-astro/,HEAD,
 https://github.com/hura/vim-asymptote/,,
 https://github.com/907th/vim-auto-save/,,
 https://github.com/vim-autoformat/vim-autoformat/,,
diff --git a/pkgs/applications/misc/gtkradiant/default.nix b/pkgs/applications/misc/gtkradiant/default.nix
index a8f5c91d1eb8..7c91181e06fa 100644
--- a/pkgs/applications/misc/gtkradiant/default.nix
+++ b/pkgs/applications/misc/gtkradiant/default.nix
@@ -61,6 +61,81 @@ let
     rev = 144;
     sha256 = "sha256-JfmDIUoDY7dYdMgwwUMgcwNhWxuxsdkv1taw8DXhPY4=";
   };
+  darkPlacesPack = fetchsvn {
+    url = "svn://svn.icculus.org/gtkradiant-gamepacks/DarkPlacesPack/trunk";
+    rev = 57;
+    sha256 = "sha256-pQpattmS9VmO3ZIQUFn66az8GSmB4IvYhTTCFn6SUmo=";
+  };
+  doom3Pack = fetchsvn {
+    url = "svn://svn.icculus.org/gtkradiant-gamepacks/Doom3Pack/trunk";
+    rev = 56;
+    sha256 = "sha256-pQpattmS9VmO3ZIQUFn66az8GSmB4IvYhTTCFn6SUmo=";
+  };
+  halfLifePack = fetchsvn {
+    url = "svn://svn.icculus.org/gtkradiant-gamepacks/HalfLifePack/trunk";
+    rev = 1;
+    sha256 = "sha256-CrbN3iOG89j71y4ZJ4gNZEA5CYxphLLGbZwv6Tbjui0=";
+  };
+  her2Pack = fetchsvn {
+    url = "svn://svn.icculus.org/gtkradiant-gamepacks/Her2Pack/trunk";
+    rev = 55;
+    sha256 = "sha256-pQpattmS9VmO3ZIQUFn66az8GSmB4IvYhTTCFn6SUmo=";
+  };
+  jk2Pack = fetchsvn {
+    url = "svn://svn.icculus.org/gtkradiant-gamepacks/JK2Pack/trunk";
+    rev = 77;
+    sha256 = "sha256-3g/p9OC0j2va9CXXtsQf0lP6VJ1WyI5k2W9xNRwYjS8=";
+  };
+  nexuizPack = fetchsvn {
+    url = "svn://svn.icculus.org/gtkradiant-gamepacks/NexuizPack/trunk";
+    rev = 49;
+    sha256 = "sha256-nAV7rZKDgAxlEmu2RfBFNsHv9Xgas1IlDgioligvY+c=";
+  };
+  preyPack = fetchsvn {
+    url = "svn://svn.icculus.org/gtkradiant-gamepacks/PreyPack/trunk";
+    rev = 19;
+    sha256 = "sha256-wbKEnSaFO40HxhMsbYKy76MxXDvY9O1lTcr3M7fXxW0=";
+  };
+  q2wPack = fetchsvn {
+    url = "svn://svn.icculus.org/gtkradiant-gamepacks/Q2WPack/trunk";
+    rev = 126;
+    sha256 = "sha256-Q6IyL2qUr+6ktP34oYkFqN5MeFxCXOkcjrPg5J95ftg=";
+  };
+  q4Pack = fetchsvn {
+    url = "svn://svn.icculus.org/gtkradiant-gamepacks/Q4Pack/trunk";
+    rev = 54;
+    sha256 = "sha256-pQpattmS9VmO3ZIQUFn66az8GSmB4IvYhTTCFn6SUmo=";
+  };
+  ravenPack = fetchsvn {
+    url = "svn://svn.icculus.org/gtkradiant-gamepacks/RavenPack/trunk";
+    rev = 1;
+    sha256 = "sha256-bYRjCkdaznaO7+WDB6cgL3szTB+MXwt3IKH3L2rGjLs=";
+  };
+  reactionPack = fetchsvn {
+    url = "svn://svn.icculus.org/gtkradiant-gamepacks/ReactionPack/trunk";
+    rev = 69;
+    sha256 = "sha256-aXSM0ubyhgamLBzfNZ6RzRSdzKwfHWLt/6OS/i9mMVo=";
+  };
+  sof2Pack = fetchsvn {
+    url = "svn://svn.icculus.org/gtkradiant-gamepacks/Sof2Pack/trunk";
+    rev = 1;
+    sha256 = "sha256-EnGhYghXe6hU5vvdF+Z9geTiHDukBEr1+CQgunxxGic=";
+  };
+  tremulousPack = fetchsvn {
+    url = "svn://svn.icculus.org/gtkradiant-gamepacks/TremulousPack/trunk";
+    rev = 46;
+    sha256 = "sha256-NU+ynpqydFxdZSkh7Szm6DTqyMYVS+PU70Mp98ZjdOs=";
+  };
+  ufoaiPack = fetchsvn {
+    url = "svn://svn.icculus.org/gtkradiant-gamepacks/UFOAIPack/trunk";
+    rev = 69;
+    sha256 = "sha256-nAd7fFZJJ82rDPVlTiZkkTGXi5tw7BSKk+akFBXSWvY=";
+  };
+  warsowPack = fetchsvn {
+    url = "svn://svn.icculus.org/gtkradiant-gamepacks/WarsowPack/trunk";
+    rev = 53;
+    sha256 = "sha256-IQ12fEKnq0cJxef+ddvTXcwM8lQ8nlUoMJy81XJ7ANY=";
+  };
   packs = runCommand "gtkradiant-packs" {} ''
     mkdir -p $out
     ln -s ${q3Pack} $out/Q3Pack
@@ -74,30 +149,36 @@ let
     ln -s ${wolfPack} $out/WolfPack
     ln -s ${unvanquishedPack} $out/UnvanquishedPack
     ln -s ${q1Pack} $out/Q1Pack
+    ln -s ${darkPlacesPack} $out/DarkPlacesPack
+    ln -s ${doom3Pack} $out/Doom3Pack
+    ln -s ${halfLifePack} $out/HalfLifePack
+    ln -s ${her2Pack} $out/Her2Pack
+    ln -s ${jk2Pack} $out/JK2Pack
+    ln -s ${nexuizPack} $out/NexuizPack
+    ln -s ${preyPack} $out/PreyPack
+    ln -s ${q2wPack} $out/Q2WPack
+    ln -s ${q4Pack} $out/Q4Pack
+    ln -s ${ravenPack} $out/RavenPack
+    ln -s ${reactionPack} $out/ReactionPack
+    ln -s ${sof2Pack} $out/Sof2Pack
+    ln -s ${tremulousPack} $out/TermulousPack
+    ln -s ${ufoaiPack} $out/UFOAIPack
+    ln -s ${warsowPack} $out/WarsowPack
   '';
 
 in
 stdenv.mkDerivation rec {
   pname = "gtkradiant";
 
-  version = "unstable-2022-07-31";
+  version = "unstable-2023-04-24";
 
   src = fetchFromGitHub {
     owner = "TTimo";
     repo = "GtkRadiant";
-    rev = "5b498bfa01bde6c2c9eb60fb94cf04666e52d22d";
-    sha256 = "sha256-407faeQnhxqbWgOUunQKj2JhHeqIzPPgrhz2K5O4CaM=";
+    rev = "ddbaf03d723a633d53fa442c2f802f7ad164dd6c";
+    sha256 = "sha256-qI+KGx73AbM5PLFR2JDXKDbiqmU0gS/43rhjRKm/Gms=";
   };
 
-  # patch paths so that .game settings are put into the user's home instead of the read-only /nix/store
-  postPatch = ''
-    substituteInPlace radiant/preferences.cpp \
-      --replace 'gameFilePath += "games/";' 'gameFilePath = g_get_home_dir(); gameFilePath += "/.cache/radiant/games/";printf("gameFilePath: %s\\n", gameFilePath);' \
-      --replace 'radCreateDirectory( gameFilePath );' 'if (g_mkdir_with_parents( gameFilePath, 0777 ) == -1) {radCreateDirectory( gameFilePath );};' \
-      --replace 'strGamesPath = g_strAppPath.GetBuffer();' 'strGamesPath = g_get_home_dir();' \
-      --replace 'strGamesPath += "games";' 'strGamesPath += "/.cache/radiant/games";'
-  '';
-
   nativeBuildInputs =
     let
       python = python3.withPackages (ps: with ps; [
@@ -113,7 +194,7 @@ stdenv.mkDerivation rec {
           test -e $(readlink $3)
         elif [ "$1" = update ]; then
           # verify existence
-          test -e $(readlink $3)
+          test -e $(readlink $2)
         else
           echo "$@"
           exit 1
@@ -145,8 +226,19 @@ stdenv.mkDerivation rec {
   postInstall = ''
     mkdir -p $out/{bin,lib}
     cp -ar install $out/lib/gtkradiant
+    for pack in ${packs}/* ; do
+      name=$(basename "$pack")
+      if ! [ -e $out/lib/gtkradiant/installs/$name ]; then
+        ln -s $pack $out/lib/gtkradiant/installs/$name
+      fi
+    done
 
-    ln -s ../lib/gtkradiant/radiant.bin $out/bin/gtkradiant
+    cat >$out/bin/gtkradiant <<EOF
+    #!${runtimeShell} -e
+    export XDG_DATA_HOME="\''${XDG_DATA_HOME:-\$HOME/.local/share}"
+    exec "$out/lib/gtkradiant/radiant.bin" "\$@"
+    EOF
+    chmod +x $out/bin/gtkradiant
     ln -s ../lib/gtkradiant/{q3map2,q3map2_urt,q3data} $out/bin/
 
     mkdir -p $out/share/pixmaps
diff --git a/pkgs/applications/misc/trenchbroom/default.nix b/pkgs/applications/misc/trenchbroom/default.nix
index 9a93edb30f61..83db22260d83 100644
--- a/pkgs/applications/misc/trenchbroom/default.nix
+++ b/pkgs/applications/misc/trenchbroom/default.nix
@@ -1,6 +1,6 @@
-{ lib, stdenv, fetchFromGitHub
-, cmake, ninja, git, pandoc, pkg-config
-, libGL, libGLU, freeimage
+{ lib, stdenv, fetchFromGitHub, writeText
+, cmake, ninja, curl, git, pandoc, pkg-config, unzip, zip
+, libGL, libGLU, freeimage, freetype, assimp
 , catch2, fmt, glew, miniz, tinyxml-2, xorg
 , qtbase, wrapQtAppsHook
 , copyDesktopItems, makeDesktopItem
@@ -8,38 +8,88 @@
 
 stdenv.mkDerivation rec {
   pname = "TrenchBroom";
-  version = "2022.1";
+  version = "2023.1";
 
   src = fetchFromGitHub {
     owner = "TrenchBroom";
     repo = "TrenchBroom";
     rev = "v${version}";
-    sha256 = "sha256-FNpYBfKnY9foPq1+21+382KKXieHksr3tCox251iJn4=";
+    sha256 = "sha256-62xcFKSqxPS+J54+kLo/hewM+Wu/rVBGD8oiECDCJpA=";
     fetchSubmodules = true;
   };
+  # Manually simulate a vcpkg installation so that it can link the libraries
+  # properly.
+  postUnpack =
+    let
+      vcpkg_target = "x64-linux";
+
+      vcpkg_pkgs = [
+        "assimp"
+        "catch2"
+        "fmt"
+        "freeimage"
+        "freetype"
+        "glew"
+        "miniz"
+        "tinyxml2"
+      ];
+
+      updates_vcpkg_file = writeText "update_vcpkg_trenchbroom" (
+        lib.concatMapStringsSep "\n" (name: ''
+          Package : ${name}
+          Architecture : ${vcpkg_target}
+          Version : 1.0
+          Status : is installed
+        '') vcpkg_pkgs);
+    in ''
+      export VCPKG_ROOT="$TMP/vcpkg"
+
+      mkdir -p $VCPKG_ROOT/.vcpkg-root
+      mkdir -p $VCPKG_ROOT/installed/${vcpkg_target}/lib
+      mkdir -p $VCPKG_ROOT/installed/vcpkg/updates
+      ln -s ${updates_vcpkg_file} $VCPKG_ROOT/installed/vcpkg/status
+      mkdir -p $VCPKG_ROOT/installed/vcpkg/info
+      ${lib.concatMapStrings (name: ''
+        touch $VCPKG_ROOT/installed/vcpkg/info/${name}_1.0_${vcpkg_target}.list
+      '') vcpkg_pkgs}
+
+      ln -s ${assimp.lib}/lib/lib* $VCPKG_ROOT/installed/${vcpkg_target}/lib/
+      ln -s ${catch2}/lib/lib* $VCPKG_ROOT/installed/${vcpkg_target}/lib/
+      ln -s ${fmt}/lib/lib* $VCPKG_ROOT/installed/${vcpkg_target}/lib/
+      ln -s ${freeimage}/lib/lib* $VCPKG_ROOT/installed/${vcpkg_target}/lib/
+      ln -s ${freetype}/lib/lib* $VCPKG_ROOT/installed/${vcpkg_target}/lib/
+      ln -s ${glew.out}/lib/lib* $VCPKG_ROOT/installed/${vcpkg_target}/lib/
+      ln -s ${miniz}/lib/lib* $VCPKG_ROOT/installed/${vcpkg_target}/lib/
+      ln -s ${tinyxml-2}/lib/lib* $VCPKG_ROOT/installed/${vcpkg_target}/lib/
+    '';
   postPatch = ''
     substituteInPlace common/src/Version.h.in \
       --subst-var-by APP_VERSION_YEAR ${lib.versions.major version} \
       --subst-var-by APP_VERSION_NUMBER ${lib.versions.minor version} \
       --subst-var-by GIT_DESCRIBE v${version}
+    substituteInPlace app/CMakeLists.txt \
+      --replace 'set(CPACK_PACKAGING_INSTALL_PREFIX "/usr")' 'set(CPACK_PACKAGING_INSTALL_PREFIX "'$out'")'
   '';
 
-  nativeBuildInputs = [ cmake git pandoc wrapQtAppsHook copyDesktopItems pkg-config ];
+  nativeBuildInputs = [ cmake ninja curl git pandoc wrapQtAppsHook copyDesktopItems pkg-config unzip zip ];
   buildInputs = [
-    libGL libGLU xorg.libXxf86vm freeimage qtbase catch2 fmt glew miniz tinyxml-2
-    xorg.libSM
+    libGL libGLU xorg.libXxf86vm xorg.libSM
+    freeimage freetype qtbase catch2 fmt
+    glew miniz tinyxml-2 assimp
   ];
   QT_PLUGIN_PATH = "${qtbase}/${qtbase.qtPluginPrefix}";
   QT_QPA_PLATFORM = "offscreen";
 
   cmakeFlags = [
+    "-DCMAKE_MAKE_PROGRAM=ninja"
+    "-DCMAKE_TOOLCHAIN_FILE=vcpkg/scripts/buildsystems/vcpkg.cmake"
+    "-DVCPKG_MANIFEST_INSTALL=OFF"
     # https://github.com/TrenchBroom/TrenchBroom/issues/4002#issuecomment-1125390780
     "-DCMAKE_PREFIX_PATH=cmake/packages"
   ];
   ninjaFlags = [
     "TrenchBroom"
   ];
-  preBuild = "export HOME=$(mktemp -d)";
 
   postInstall = ''
     pushd $out/share/TrenchBroom/icons
@@ -71,5 +121,6 @@ stdenv.mkDerivation rec {
     description = "Level editor for Quake-engine based games";
     license = licenses.gpl3Only;
     maintainers = with maintainers; [ astro ];
+    platforms = [ "x86_64-linux" ];
   };
 }
diff --git a/pkgs/applications/misc/tuba/default.nix b/pkgs/applications/misc/tuba/default.nix
index af2e089a54a9..2ada229ceb7f 100644
--- a/pkgs/applications/misc/tuba/default.nix
+++ b/pkgs/applications/misc/tuba/default.nix
@@ -25,12 +25,12 @@
 
 stdenv.mkDerivation rec {
   pname = "tuba";
-  version = "0.3.2";
+  version = "0.4.0";
   src = fetchFromGitHub {
     owner = "GeopJr";
     repo = "Tuba";
     rev = "v${version}";
-    hash = "sha256-PSEPpJn/lYpeI6AN2AY73NpOcDkMm0zNqeSdELn5HvY=";
+    hash = "sha256-sLdkSIevz2spL+Q5sS+ugqEbqJTXrLxmszzijtKvY6k=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/browsers/vivaldi/ffmpeg-codecs.nix b/pkgs/applications/networking/browsers/vivaldi/ffmpeg-codecs.nix
index 68ba61e1cae0..5e49e35313ea 100644
--- a/pkgs/applications/networking/browsers/vivaldi/ffmpeg-codecs.nix
+++ b/pkgs/applications/networking/browsers/vivaldi/ffmpeg-codecs.nix
@@ -1,22 +1,24 @@
-{ dpkg, fetchurl, lib, stdenv }:
+{ squashfsTools, fetchurl, lib, stdenv }:
 
+# This derivation roughly follows the update-ffmpeg script that ships with the official Vivaldi
+# downloads at https://vivaldi.com/download/
 stdenv.mkDerivation rec {
   pname = "chromium-codecs-ffmpeg-extra";
-  version = "112.0.5615.49";
+  version = "111306";
 
   src = fetchurl {
-    url = "https://launchpadlibrarian.net/660647727/${pname}_${version}-0ubuntu0.18.04.1_amd64.deb";
-    sha256 = "sha256-mHjvjRG+toRcsOMca+JPXNZPgyQROH2qtSpBPHLmt3s=";
+    url = "https://api.snapcraft.io/api/v1/snaps/download/XXzVIXswXKHqlUATPqGCj2w2l7BxosS8_34.snap";
+    sha256 = "sha256-Dna9yFgP7JeQLAeZWvSZ+eSMX2yQbX2/+mX0QC22lYY=";
   };
 
-  buildInputs = [ dpkg ];
+  buildInputs = [ squashfsTools ];
 
   unpackPhase = ''
-    dpkg-deb -x $src .
+    unsquashfs -dest . $src
   '';
 
   installPhase = ''
-    install -vD usr/lib/chromium-browser/libffmpeg.so $out/lib/libffmpeg.so
+    install -vD chromium-ffmpeg-${version}/chromium-ffmpeg/libffmpeg.so $out/lib/libffmpeg.so
   '';
 
   meta = with lib; {
@@ -24,7 +26,7 @@ stdenv.mkDerivation rec {
     homepage    = "https://ffmpeg.org/";
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license     = licenses.lgpl21;
-    maintainers = with maintainers; [ betaboon cawilliamson lluchs ];
+    maintainers = with maintainers; [ betaboon cawilliamson fptje ];
     platforms   = [ "x86_64-linux" ];
   };
 }
diff --git a/pkgs/applications/networking/mailreaders/notmuch/muchsync.nix b/pkgs/applications/networking/mailreaders/notmuch/muchsync.nix
index 3c21b64933f5..c1db11908012 100644
--- a/pkgs/applications/networking/mailreaders/notmuch/muchsync.nix
+++ b/pkgs/applications/networking/mailreaders/notmuch/muchsync.nix
@@ -13,6 +13,7 @@ stdenv.mkDerivation rec {
   };
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ notmuch openssl sqlite xapian zlib ];
+  XAPIAN_CONFIG = "${xapian}/bin/xapian-config";
   meta = {
     description = "Synchronize maildirs and notmuch databases";
     homepage = "http://www.muchsync.org/";
diff --git a/pkgs/applications/networking/twingate/default.nix b/pkgs/applications/networking/twingate/default.nix
index e555ddacffd8..02c74cea0af7 100644
--- a/pkgs/applications/networking/twingate/default.nix
+++ b/pkgs/applications/networking/twingate/default.nix
@@ -20,10 +20,18 @@ stdenv.mkDerivation rec {
     sha256 = "b308c422af8a33ecd58e21a10a72c353351a189df67006e38d1ec029a93d5678";
   };
 
-  buildInputs = [ dbus curl libnl udev cryptsetup ];
-  nativeBuildInputs = [ dpkg autoPatchelfHook ];
+  buildInputs = [
+    dbus
+    curl
+    libnl
+    udev
+    cryptsetup
+  ];
 
-  unpackCmd = "mkdir root ; dpkg-deb -x $curSrc root";
+  nativeBuildInputs = [
+    dpkg
+    autoPatchelfHook
+  ];
 
   postPatch = ''
     while read file; do
diff --git a/pkgs/applications/office/fava/default.nix b/pkgs/applications/office/fava/default.nix
index 3a5b4c09f164..ad3601fa22bb 100644
--- a/pkgs/applications/office/fava/default.nix
+++ b/pkgs/applications/office/fava/default.nix
@@ -2,12 +2,12 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "fava";
-  version = "1.24.4";
+  version = "1.25";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-klRPe6NQMn3HVayfCGc05mB0afi3x4Wlj3EI0XdSkMc=";
+    hash = "sha256-3SxFvvYZupYOsQU/n+zq3hamyWaaN9guoiV8km9mHjM=";
   };
 
   nativeBuildInputs = with python3.pkgs; [ setuptools-scm ];
diff --git a/pkgs/data/themes/gruvbox-gtk-theme/default.nix b/pkgs/data/themes/gruvbox-gtk-theme/default.nix
index a221918ad10d..b579f71d8b8b 100644
--- a/pkgs/data/themes/gruvbox-gtk-theme/default.nix
+++ b/pkgs/data/themes/gruvbox-gtk-theme/default.nix
@@ -4,15 +4,15 @@
 , gnome-themes-extra
 , gtk-engine-murrine
 }:
-stdenvNoCC.mkDerivation rec {
+stdenvNoCC.mkDerivation {
   pname = "gruvbox-gtk-theme";
-  version = "unstable-2022-12-09";
+  version = "unstable-2023-05-26";
 
   src = fetchFromGitHub {
     owner = "Fausto-Korpsvart";
     repo = "Gruvbox-GTK-Theme";
-    rev = "c3172d8dcba66f4125a014d280d41e23f0b95cad";
-    sha256 = "1411mjlcj1d6kw3d3h1w9zsr0a08bzl5nddkkbv7w7lf67jy9b22";
+    rev = "c0b7fb501938241a3b6b5734f8cb1f0982edc6b4";
+    hash = "sha256-Y+6HuWaVkNqlYc+w5wLkS2LpKcDtpeOpdHnqBmShm5Q=";
   };
 
   propagatedUserEnvPkgs = [
diff --git a/pkgs/development/libraries/gstreamer/icamerasrc/default.nix b/pkgs/development/libraries/gstreamer/icamerasrc/default.nix
index f7ef0018cb25..b03dd953e140 100644
--- a/pkgs/development/libraries/gstreamer/icamerasrc/default.nix
+++ b/pkgs/development/libraries/gstreamer/icamerasrc/default.nix
@@ -39,6 +39,7 @@ stdenv.mkDerivation rec {
   ];
 
   NIX_CFLAGS_COMPILE = [
+    "-Wno-error"
     # gstcameradeinterlace.cpp:55:10: fatal error: gst/video/video.h: No such file or directory
     "-I${gst_all_1.gst-plugins-base.dev}/include/gstreamer-1.0"
   ];
diff --git a/pkgs/development/libraries/ipu6-camera-hal/default.nix b/pkgs/development/libraries/ipu6-camera-hal/default.nix
index 17e5ed482196..7fce11d21a43 100644
--- a/pkgs/development/libraries/ipu6-camera-hal/default.nix
+++ b/pkgs/development/libraries/ipu6-camera-hal/default.nix
@@ -38,6 +38,7 @@ stdenv.mkDerivation {
   ];
 
   NIX_CFLAGS_COMPILE = [
+    "-Wno-error"
     "-I${lib.getDev ipu6-camera-bin}/include/ia_imaging"
     "-I${lib.getDev ipu6-camera-bin}/include/ia_camera"
   ];
diff --git a/pkgs/development/libraries/libspelling/default.nix b/pkgs/development/libraries/libspelling/default.nix
new file mode 100644
index 000000000000..32c1af55a37f
--- /dev/null
+++ b/pkgs/development/libraries/libspelling/default.nix
@@ -0,0 +1,59 @@
+{ lib
+, stdenv
+, fetchFromGitLab
+, meson
+, ninja
+, pkg-config
+, gobject-introspection
+, vala
+, gi-docgen
+, glib
+, gtk4
+, gtksourceview5
+, enchant
+, icu
+}:
+
+stdenv.mkDerivation {
+  pname = "libspelling";
+  version = "unstable-2023-07-17";
+
+  outputs = [ "out" "dev" "devdoc" ];
+
+  src = fetchFromGitLab {
+    domain = "gitlab.gnome.org";
+    owner = "chergert";
+    repo = "libspelling";
+    rev = "65185023db95ec464970aeaeab766fe3ba26ae7d";
+    hash = "sha256-R3nPs16y8XGamQvMSF7wb52h0jxt17H2FZPwauLDI/c=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    gobject-introspection
+    vala
+    gi-docgen
+  ];
+
+  buildInputs = [
+    glib
+    gtk4
+    gtksourceview5
+    enchant
+    icu
+  ];
+
+  postFixup = ''
+    # Cannot be in postInstall, otherwise _multioutDocs hook in preFixup will move right back.
+    moveToOutput "share/doc" "$devdoc"
+  '';
+
+  meta = with lib; {
+    description = "Spellcheck library for GTK 4";
+    homepage = "https://gitlab.gnome.org/chergert/libspelling";
+    license = licenses.lgpl21Plus;
+    maintainers = with maintainers; [ chuangzhu ];
+  };
+}
diff --git a/pkgs/development/nim-packages/cbor/default.nix b/pkgs/development/nim-packages/cbor/default.nix
index 1688d1f6a107..2949f4c1c853 100644
--- a/pkgs/development/nim-packages/cbor/default.nix
+++ b/pkgs/development/nim-packages/cbor/default.nix
@@ -2,12 +2,12 @@
 
 buildNimPackage rec {
   pname = "cbor";
-  version = "20230310";
+  version = "20230619";
   src = fetchFromSourcehut {
     owner = "~ehmry";
     repo = "nim_${pname}";
     rev = version;
-    hash = "sha256-VmSYWgXDJLB2D2m3/ymrEytT2iW5JE56WmDz2MPHAqQ=";
+    hash = "sha256-F6T/5bUwrJyhRarTWO9cjbf7UfEOXPNWu6mfVKNZsQA=";
   };
   meta = with lib;
     src.meta // {
diff --git a/pkgs/development/nim-packages/eris/default.nix b/pkgs/development/nim-packages/eris/default.nix
index bdd7de6a463b..f6ab83da5476 100644
--- a/pkgs/development/nim-packages/eris/default.nix
+++ b/pkgs/development/nim-packages/eris/default.nix
@@ -1,27 +1,24 @@
-{ lib, buildNimPackage, fetchFromGitea, pkg-config
-, base32, coap, cbor, freedesktop_org, syndicate, tkrzw }:
+{ lib, buildNimPackage, fetchFromGitea, pkg-config, base32, coap, cbor
+, freedesktop_org, illwill, syndicate, tkrzw }:
 
 buildNimPackage rec {
   pname = "eris";
-  version = "20230201";
+  version = "20230716";
   outputs = [ "bin" "out" ];
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "eris";
     repo = "nim-${pname}";
     rev = version;
-    hash = "sha256-6vlD/woqTkbSRWhRtQD/ynk0DG+GrGwh6x+qUmo6YSQ=";
+    hash = "sha256-g2mxua4++zqKeMbe98nBWh7/+rN/IElIiPcvyX0nfEY=";
   };
   propagatedNativeBuildInputs = [ pkg-config ];
-  propagatedBuildInputs = [
-    base32
-    coap
-    cbor
-    freedesktop_org
-    syndicate
-    tkrzw
-  ];
+  propagatedBuildInputs =
+    [ base32 coap cbor freedesktop_org illwill syndicate tkrzw ];
   postInstall = ''
+    mkdir -p "$bin/share/recoll/filters"
+    mv "$bin/bin/rclerislink" "$bin/share/recoll/filters/"
+
     mkdir -p "$bin/share/applications"
     substitute "eris-open.desktop" "$bin/share/applications/eris-open.desktop"\
       --replace "Exec=eriscmd " "Exec=$bin/bin/eriscmd "
@@ -29,6 +26,7 @@ buildNimPackage rec {
     install -D "eris-link.xml" -t "$bin/share/mime/packages"
     install -D "eris48.png" "$bin/share/icons/hicolor/48x48/apps/eris.png"
   '';
+  preCheck = "rm tests/test_syndicate.nim";
   meta = src.meta // {
     license = lib.licenses.unlicense;
     maintainers = with lib.maintainers; [ ehmry ];
diff --git a/pkgs/development/nim-packages/hashlib/default.nix b/pkgs/development/nim-packages/hashlib/default.nix
new file mode 100644
index 000000000000..67fff072c182
--- /dev/null
+++ b/pkgs/development/nim-packages/hashlib/default.nix
@@ -0,0 +1,17 @@
+{ lib, buildNimPackage, fetchFromGitHub }:
+
+buildNimPackage rec {
+  pname = "hashlib";
+  version = "1.0.1";
+  src = fetchFromGitHub {
+    owner = "khchen";
+    repo = pname;
+    rev = "84e0247555e4488594975900401baaf5bbbfb531";
+    hash = "sha256-nWNThelCh0LPVU7ryZgS/23hRRvJDVL2xWbQibb+zN0=";
+  };
+  meta = src.meta // {
+    description = "Hash Library for Nim";
+    maintainers = with lib.maintainers; [ ehmry ];
+    license = lib.licenses.mit;
+  };
+}
diff --git a/pkgs/development/nim-packages/illwill/default.nix b/pkgs/development/nim-packages/illwill/default.nix
index a87588de0edd..aa5101766208 100644
--- a/pkgs/development/nim-packages/illwill/default.nix
+++ b/pkgs/development/nim-packages/illwill/default.nix
@@ -2,13 +2,13 @@
 
 buildNimPackage rec {
   pname = "illwill";
-  version = "0.3.0";
+  version = "0.3.1";
 
   src = fetchFromGitHub {
     owner = "johnnovak";
     repo = "illwill";
     rev = "v${version}";
-    hash = "sha256-9YBkad5iUKRb375caAuoYkfp5G6KQDhX/yXQ7vLu/CA=";
+    hash = "sha256-4DHGVWzN/WTAyDRBBpXlcfKnYIcbFt42/iWInaBUwi4=";
   };
 
   meta = with lib;
diff --git a/pkgs/development/nim-packages/preserves/default.nix b/pkgs/development/nim-packages/preserves/default.nix
index 251975bcad6e..d48f7830e71f 100644
--- a/pkgs/development/nim-packages/preserves/default.nix
+++ b/pkgs/development/nim-packages/preserves/default.nix
@@ -1,16 +1,17 @@
-{ lib, stdenv, buildNimPackage, fetchFromGitea, npeg }:
+{ lib, stdenv, buildNimPackage, fetchFromGitea, nim-unwrapped, npeg }:
 
 buildNimPackage rec {
   pname = "preserves";
-  version = "20221102";
+  version = "20230530";
   src = fetchFromGitea {
     domain = "git.syndicate-lang.org";
     owner = "ehmry";
     repo = "${pname}-nim";
     rev = version;
-    hash = "sha256-oRsq1ugtrOvTn23596BXRy71TQZ4h/Vv6JGqBTZdoKY=";
+    hash = "sha256-IRIBGjv4po8VyL873v++ovqz8Vg6a9Qbh/M1fxpQXvY=";
   };
   propagatedBuildInputs = [ npeg ];
+  nimFlags = [ "--path:${nim-unwrapped}/nim" ];
   doCheck = !stdenv.isDarwin;
   meta = src.meta // {
     description = "Nim implementation of the Preserves data language";
diff --git a/pkgs/development/nim-packages/syndicate/default.nix b/pkgs/development/nim-packages/syndicate/default.nix
index b172e5fbdbde..e22455ad9098 100644
--- a/pkgs/development/nim-packages/syndicate/default.nix
+++ b/pkgs/development/nim-packages/syndicate/default.nix
@@ -1,16 +1,16 @@
-{ lib, buildNimPackage, fetchFromGitea, nimSHA2, preserves }:
+{ lib, buildNimPackage, fetchFromGitea, hashlib, preserves }:
 
 buildNimPackage rec {
   pname = "syndicate";
-  version = "20221102";
+  version = "20230530";
   src = fetchFromGitea {
     domain = "git.syndicate-lang.org";
     owner = "ehmry";
     repo = "${pname}-nim";
     rev = version;
-    hash = "sha256-yTPbEsBcpEPXfmhykbWzWdnJ2ExEJxdii1L+mqx8VGQ=";
+    hash = "sha256-lUHoMSQwUlz9EDMvpFL9GlrwbwMvZDILSmuakONwe50=";
   };
-  propagatedBuildInputs = [ nimSHA2 preserves ];
+  propagatedBuildInputs = [ hashlib preserves ];
   meta = src.meta // {
     description = "Nim implementation of the Syndicated Actor model";
     license = lib.licenses.unlicense;
diff --git a/pkgs/development/nim-packages/taps/default.nix b/pkgs/development/nim-packages/taps/default.nix
index 4bf8f247977e..ce453dbaa344 100644
--- a/pkgs/development/nim-packages/taps/default.nix
+++ b/pkgs/development/nim-packages/taps/default.nix
@@ -2,12 +2,12 @@
 
 buildNimPackage rec {
   pname = "taps";
-  version = "20221228";
+  version = "20230331";
   src = fetchFromSourcehut {
     owner = "~ehmry";
     repo = "nim_${pname}";
     rev = version;
-    hash = "sha256-0EjMP5pIPJg4/3nzj6ECC68f709TS06OrJlTZ0tavEo=";
+    hash = "sha256-p2DBJWFwS82oHPq0uMCtZWFbn8GFndEJBjhkHeuPGos=";
   };
   propagatedBuildInputs = [ getdns ];
   doCheck = false;
diff --git a/pkgs/development/python-modules/albumentations/default.nix b/pkgs/development/python-modules/albumentations/default.nix
new file mode 100644
index 000000000000..e2104641b78d
--- /dev/null
+++ b/pkgs/development/python-modules/albumentations/default.nix
@@ -0,0 +1,62 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, numpy
+, opencv4
+, pyyaml
+, qudida
+, scikit-image
+, scipy
+, pytestCheckHook
+, pythonOlder
+, pythonRelaxDepsHook
+}:
+
+buildPythonPackage rec {
+  pname = "albumentations";
+  version = "1.3.1";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-pqODiP5UbFaAcejIL0FEmOhsntA8CLWOeoizHPeiRMY=";
+  };
+
+  nativeBuildInputs = [
+    pythonRelaxDepsHook
+  ];
+
+  pythonRemoveDeps = [
+    "opencv-python"
+  ];
+
+  propagatedBuildInputs = [
+    numpy
+    opencv4
+    pyyaml
+    qudida
+    scikit-image
+    scipy
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  disabledTests = [
+    # this test hangs up
+    "test_transforms"
+  ];
+
+  pythonImportsCheck = [ "albumentations" ];
+
+  meta = with lib; {
+    description = "Fast image augmentation library and easy to use wrapper around other libraries";
+    homepage = "https://github.com/albumentations-team/albumentations";
+    changelog = "https://github.com/albumentations-team/albumentations/releases/tag/${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ natsukium ];
+  };
+}
diff --git a/pkgs/development/python-modules/fiona/default.nix b/pkgs/development/python-modules/fiona/default.nix
index 409394e5fb08..5ab6dc145f9f 100644
--- a/pkgs/development/python-modules/fiona/default.nix
+++ b/pkgs/development/python-modules/fiona/default.nix
@@ -19,17 +19,16 @@
 
 buildPythonPackage rec {
   pname = "fiona";
-  version = "1.9.1";
+  version = "1.9.4";
+  format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
-  format = "pyproject";
-
   src = fetchFromGitHub {
     owner = "Toblerity";
     repo = "Fiona";
     rev = "refs/tags/${version}";
-    hash = "sha256-2CGLkgnpCAh9G+ILol5tmRj9S6/XeKk8eLzGEODiyP8=";
+    hash = "sha256-v4kTjoGu4AiEepBrGyY1e1OFC1eCk/U6f8XA/vtfY0E=";
   };
 
   nativeBuildInputs = [
@@ -49,7 +48,6 @@ buildPythonPackage rec {
     cligj
     click-plugins
     munch
-    setuptools
   ];
 
   passthru.optional-dependencies = {
@@ -66,12 +64,27 @@ buildPythonPackage rec {
     rm -r fiona # prevent importing local fiona
   '';
 
-  disabledTests = [
-    # Some tests access network, others test packaging
-    "http" "https" "wheel"
+  pytestFlagsArray = [
+    # Tests with gdal marker do not test the functionality of Fiona,
+    # but they are used to check GDAL driver capabilities.
+    "-m 'not gdal'"
   ];
 
-  pythonImportsCheck = [ "fiona" ];
+  disabledTests = [
+    # Some tests access network, others test packaging
+    "http"
+    "https"
+    "wheel"
+
+    # see: https://github.com/Toblerity/Fiona/issues/1273
+    "test_append_memoryfile_drivers"
+  ];
+
+  pythonImportsCheck = [
+    "fiona"
+  ];
+
+  doInstallCheck = true;
 
   meta = with lib; {
     changelog = "https://github.com/Toblerity/Fiona/blob/${src.rev}/CHANGES.txt";
diff --git a/pkgs/development/python-modules/notmuch2/default.nix b/pkgs/development/python-modules/notmuch2/default.nix
index 70c422b08b27..af288e2a1393 100644
--- a/pkgs/development/python-modules/notmuch2/default.nix
+++ b/pkgs/development/python-modules/notmuch2/default.nix
@@ -1,6 +1,5 @@
 { stdenv
 , lib
-
 , buildPythonPackage
 , notmuch
 , python
@@ -13,7 +12,12 @@ buildPythonPackage {
 
   sourceRoot = "notmuch-${notmuch.version}/bindings/python-cffi";
 
-  buildInputs = [ python notmuch cffi ];
+  nativeBuildInputs = [
+    cffi
+  ];
+  buildInputs = [
+    python notmuch cffi
+  ];
 
   # since notmuch 0.35, this package expects _notmuch_config.py that is
   # generated by notmuch's configure script
diff --git a/pkgs/development/python-modules/qudida/default.nix b/pkgs/development/python-modules/qudida/default.nix
new file mode 100644
index 000000000000..48d83c4d14ee
--- /dev/null
+++ b/pkgs/development/python-modules/qudida/default.nix
@@ -0,0 +1,50 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, numpy
+, opencv4
+, pythonOlder
+, pythonRelaxDepsHook
+, scikit-learn
+, typing-extensions
+}:
+
+buildPythonPackage rec {
+  pname = "qudida";
+  version = "0.0.4";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.5";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-2xmOKIerDJqgAj5WWvv/Qd+3azYfhf1eE/eA11uhjMg=";
+  };
+
+  nativeBuildInputs = [
+    pythonRelaxDepsHook
+  ];
+
+  pythonRemoveDeps = [
+    "opencv-python"
+  ];
+
+  propagatedBuildInputs = [
+    numpy
+    opencv4
+    scikit-learn
+    typing-extensions
+  ];
+
+  # upstream has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "qudida" ];
+
+  meta = with lib; {
+    description = "QUick and DIrty Domain Adaptation";
+    homepage = "https://github.com/arsenyinfo/qudida";
+    license = licenses.mit;
+    maintainers = with maintainers; [ natsukium ];
+  };
+}
diff --git a/pkgs/development/tools/diesel-cli-ext/default.nix b/pkgs/development/tools/diesel-cli-ext/default.nix
new file mode 100644
index 000000000000..3e784090398b
--- /dev/null
+++ b/pkgs/development/tools/diesel-cli-ext/default.nix
@@ -0,0 +1,24 @@
+{ lib
+, rustPlatform
+, fetchCrate
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "diesel-cli-ext";
+  version = "0.3.13";
+
+  src = fetchCrate {
+    pname = "diesel_cli_ext";
+    inherit version;
+    hash = "sha256-5AIzMxEcxL/vYWx3D/meA///Zo+1210HUMEE4dFBhkc=";
+  };
+
+  cargoHash = "sha256-Ya7RL3TuQjKkEkggK/ANChtVZRuTaooM+lE3KBZnvYU=";
+
+  meta = with lib; {
+    description = "Provides different tools for projects using the diesel_cli";
+    homepage = "https://crates.io/crates/diesel_cli_ext";
+    license = with licenses; [ asl20 mit ];
+    maintainers = with maintainers; [ siph ];
+  };
+}
diff --git a/pkgs/development/tools/esbuild/default.nix b/pkgs/development/tools/esbuild/default.nix
index 4ced87e14f5c..45a781b0544e 100644
--- a/pkgs/development/tools/esbuild/default.nix
+++ b/pkgs/development/tools/esbuild/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "esbuild";
-  version = "0.18.14";
+  version = "0.18.15";
 
   src = fetchFromGitHub {
     owner = "evanw";
     repo = "esbuild";
     rev = "v${version}";
-    hash = "sha256-E7ISDRRJKAQZkNLvyTMMUABqHHK7aupoOPAMoL8EXHc=";
+    hash = "sha256-JvGtLz9YqRQdCY2jff7T9xUeQ2+GCA/coI4MIBPupDc=";
   };
 
   vendorHash = "sha256-+BfxCyg0KkDQpHt/wycy/8CTG6YBA/VJvJFhhzUnSiQ=";
diff --git a/pkgs/development/tools/jless/default.nix b/pkgs/development/tools/jless/default.nix
index 306a271936bf..6c6c70f89092 100644
--- a/pkgs/development/tools/jless/default.nix
+++ b/pkgs/development/tools/jless/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "jless";
-  version = "0.8.0";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "PaulJuliusMartinez";
     repo = "jless";
     rev = "v${version}";
-    sha256 = "sha256-NB/s29M46mVhTsJWFYnBgJjSjUVbfdmuz69VdpVuR7c=";
+    hash = "sha256-76oFPUWROX389U8DeMjle/GkdItu+0eYxZkt1c6l0V4=";
   };
 
-  cargoSha256 = "sha256-cPj9cTRhWK/YU8Cae63p4Vm5ohB1IfGL5fu7yyFGSXA=";
+  cargoHash = "sha256-sas94liAOSIirIJGdexdApXic2gWIBDT4uJFRM3qMw0=";
 
   nativeBuildInputs = lib.optionals stdenv.isLinux [ python3 ];
 
@@ -22,7 +22,8 @@ rustPlatform.buildRustPackage rec {
   meta = with lib; {
     description = "A command-line pager for JSON data";
     homepage = "https://jless.io";
+    changelog = "https://github.com/PaulJuliusMartinez/jless/blob/${src.rev}/CHANGELOG.md";
     license = licenses.mit;
-    maintainers = with maintainers; [ jfchevrette ];
+    maintainers = with maintainers; [ figsoda jfchevrette ];
   };
 }
diff --git a/pkgs/development/tools/volta/default.nix b/pkgs/development/tools/volta/default.nix
index 125c396d1a28..b61347c05f2e 100644
--- a/pkgs/development/tools/volta/default.nix
+++ b/pkgs/development/tools/volta/default.nix
@@ -46,6 +46,9 @@ rustPlatform.buildRustPackage rec {
       switch between Nodes. You can install npm package binaries in your
       toolchain without having to periodically reinstall them or figure out why
       they’ve stopped working.
+
+      Note: Volta cannot be used on NixOS out of the box because it downloads
+      Node binaries that assume shared libraries are in FHS standard locations.
     '';
     homepage = "https://volta.sh/";
     changelog = "https://github.com/volta-cli/volta/blob/main/RELEASES.md";
diff --git a/pkgs/os-specific/darwin/moltenvk/default.nix b/pkgs/os-specific/darwin/moltenvk/default.nix
index 4d247fa58363..41f929fe90ff 100644
--- a/pkgs/os-specific/darwin/moltenvk/default.nix
+++ b/pkgs/os-specific/darwin/moltenvk/default.nix
@@ -3,6 +3,7 @@
 , stdenv
 , fetchurl
 , fetchFromGitHub
+, gitUpdater
 , cctools
 , sigtool
 , cereal
@@ -23,7 +24,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "MoltenVK";
-  version = "1.2.3";
+  version = "1.2.4";
 
   buildInputs = [
     AppKit
@@ -46,7 +47,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "KhronosGroup";
     repo = "MoltenVK";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-GPOF2lyo1eDf1GrPjcj0y1OuUHI/c80L9gSQM+4wEp0=";
+    hash = "sha256-BL46BgZHUpk0dpzmeZ/2W0msHxFwieeGDjmVB8Nb1J4=";
   };
 
   patches = [
@@ -144,8 +145,13 @@ stdenv.mkDerivation (finalAttrs: {
   postFixup = ''
     install_name_tool -id "$out/lib/libMoltenVK.dylib" "$out/lib/libMoltenVK.dylib"
     codesign -s - -f "$out/lib/libMoltenVK.dylib"
+    codesign -s - -f "$bin/bin/MoltenVKShaderConverter"
   '';
 
+  passthru.updateScript = gitUpdater {
+    rev-prefix = "v";
+  };
+
   meta = {
     description = "A Vulkan Portability implementation built on top of Apple’s Metal API";
     homepage = "https://github.com/KhronosGroup/MoltenVK";
diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index 677cc9363da4..60175f805a68 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -232,7 +232,10 @@ stdenv.mkDerivation ({
     # replicated here to apply to older versions.
     # Makes __FILE__ relative to the build directory.
     "KCPPFLAGS=-fmacro-prefix-map=$(sourceRoot)/="
-  ] ++ extraMakeFlags;
+    kernelConf.target
+  ] ++ optional isModular "modules"
+    ++ optional buildDTBs "dtbs"
+    ++ extraMakeFlags;
 
   installFlags = [
     "INSTALL_PATH=$(out)"
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index db140e7d0c9d..f14b7acd6258 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -510,8 +510,8 @@ stdenv.mkDerivation (finalAttrs: {
 
     "-Dsulogin-path=${util-linux.login}/bin/sulogin"
     "-Dnologin-path=${util-linux.login}/bin/nologin"
-    "-Dmount-path=${util-linux.mount}/bin/mount"
-    "-Dumount-path=${util-linux.mount}/bin/umount"
+    "-Dmount-path=${lib.getOutput "mount" util-linux}/bin/mount"
+    "-Dumount-path=${lib.getOutput "mount" util-linux}/bin/umount"
     "-Dcreate-log-dirs=false"
 
     # Use cgroupsv2. This is already the upstream default, but better be explicit.
@@ -562,8 +562,8 @@ stdenv.mkDerivation (finalAttrs: {
             "man/systemd-makefs@.service.xml"
           ];
         }
-        { search = "/sbin/swapon"; replacement = "${util-linux.swap}/sbin/swapon"; where = [ "src/core/swap.c" "src/basic/unit-def.h" ]; }
-        { search = "/sbin/swapoff"; replacement = "${util-linux.swap}/sbin/swapoff"; where = [ "src/core/swap.c" ]; }
+        { search = "/sbin/swapon"; replacement = "${lib.getOutput "swap" util-linux}/sbin/swapon"; where = [ "src/core/swap.c" "src/basic/unit-def.h" ]; }
+        { search = "/sbin/swapoff"; replacement = "${lib.getOutput "swap" util-linux}/sbin/swapoff"; where = [ "src/core/swap.c" ]; }
         {
           search = "/bin/echo";
           replacement = "${coreutils}/bin/echo";
diff --git a/pkgs/os-specific/linux/util-linux/default.nix b/pkgs/os-specific/linux/util-linux/default.nix
index bd87c07879c3..9a335010c872 100644
--- a/pkgs/os-specific/linux/util-linux/default.nix
+++ b/pkgs/os-specific/linux/util-linux/default.nix
@@ -55,7 +55,7 @@ stdenv.mkDerivation rec {
   # the greater util-linux toolset.
   # Compatibility is maintained by symlinking the binaries from the
   # smaller outputs in the bin output.
-  outputs = [ "bin" "dev" "out" "lib" "man" "mount" "login" "swap" ];
+  outputs = [ "bin" "dev" "out" "lib" "man" ] ++ lib.optionals stdenv.isLinux [ "mount" ] ++ [ "login" ] ++ lib.optionals stdenv.isLinux [ "swap" ];
   separateDebugInfo = true;
 
   postPatch = ''
@@ -110,20 +110,23 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  postInstall = ''
+  postInstall = lib.optionalString stdenv.isLinux ''
     moveToOutput bin/mount "$mount"
     moveToOutput bin/umount "$mount"
     ln -svf "$mount/bin/"* $bin/bin/
+    '' + ''
 
     moveToOutput sbin/nologin "$login"
     moveToOutput sbin/sulogin "$login"
     prefix=$login _moveSbin
     ln -svf "$login/bin/"* $bin/bin/
+    '' + lib.optionalString stdenv.isLinux ''
 
     moveToOutput sbin/swapon "$swap"
     moveToOutput sbin/swapoff "$swap"
     prefix=$swap _moveSbin
     ln -svf "$swap/bin/"* $bin/bin/
+    '' + ''
 
     installShellCompletion --bash bash-completion/*
   '';
diff --git a/pkgs/servers/heisenbridge/default.nix b/pkgs/servers/heisenbridge/default.nix
index 8d1e0c340a70..b983e60a6aaa 100644
--- a/pkgs/servers/heisenbridge/default.nix
+++ b/pkgs/servers/heisenbridge/default.nix
@@ -17,13 +17,13 @@ let
 in
 python.pkgs.buildPythonApplication rec {
   pname = "heisenbridge";
-  version = "1.14.2";
+  version = "1.14.3";
 
   src = fetchFromGitHub {
     owner = "hifi";
     repo = pname;
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-qp0LVcmWf5lZ52h0V58S6FoIM8RLOd6Y3FRb85j7KRg=";
+    sha256 = "sha256-IKvB3L5xgAGLkN67rw2dp4Nvv0w4XbeXMcMmY7SGeNU=";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/X11/xdg-utils/default.nix b/pkgs/tools/X11/xdg-utils/default.nix
index 49a8269b8d40..35557ce447f1 100644
--- a/pkgs/tools/X11/xdg-utils/default.nix
+++ b/pkgs/tools/X11/xdg-utils/default.nix
@@ -83,5 +83,6 @@ stdenv.mkDerivation rec {
     license = if mimiSupport then licenses.gpl2 else licenses.free;
     maintainers = [ maintainers.eelco ];
     platforms = platforms.all;
+    broken = !(stdenv.buildPlatform.canExecute stdenv.hostPlatform);
   };
 }
diff --git a/pkgs/tools/admin/qovery-cli/default.nix b/pkgs/tools/admin/qovery-cli/default.nix
index 31b05d00ecb1..5b385caae149 100644
--- a/pkgs/tools/admin/qovery-cli/default.nix
+++ b/pkgs/tools/admin/qovery-cli/default.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "qovery-cli";
-  version = "0.60.0";
+  version = "0.61.0";
 
   src = fetchFromGitHub {
     owner = "Qovery";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-fyx0JMZ/SYf3goE1kvqWNZvsVYcUkPQfUCCHOsLk3Cs=";
+    hash = "sha256-V3tKUIpSO1oGpkHjkFWAtBoe91va6q2HInZsHrjWhQ0=";
   };
 
-  vendorHash = "sha256-jdUpLnn370mIp3Ra8c7fmEb4bk8xi6KrzUUpokE2jkQ=";
+  vendorHash = "sha256-5ikOmjJ2E+Kk8FAl6/Jm+k5HKlZJ1Ik3uZ/2sD5Eqok=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/misc/twspace-crawler/default.nix b/pkgs/tools/misc/twspace-crawler/default.nix
index 2f11b5c5c2c5..a098d1af9ab9 100644
--- a/pkgs/tools/misc/twspace-crawler/default.nix
+++ b/pkgs/tools/misc/twspace-crawler/default.nix
@@ -2,16 +2,16 @@
 
 buildNpmPackage rec {
   pname = "twspace-crawler";
-  version = "1.12.3";
+  version = "1.12.4";
 
   src = fetchFromGitHub {
     owner = "HitomaruKonpaku";
     repo = "twspace-crawler";
-    rev = "d78caf0da5eb9c493e3d4d8b4ca47d434f4764bb"; # version not tagged
-    hash = "sha256-ONgPGlLRi0z2V1hB15w75GUt2Asc3hrRjuEjNSZc7Bc=";
+    rev = "339972a785a4074880a66be4ca4063e6b47ddfaa"; # version not tagged
+    hash = "sha256-YJXvBKvZ/Z1mRf6MW3JFqlK77+N+JM3OZZNSJyaaic4=";
   };
 
-  npmDepsHash = "sha256-Gq1OWJlIIIOHoP0TMscaPXaVpmfexax2EjdTCDPmeQQ=";
+  npmDepsHash = "sha256-eVh+1pBAxB+tgS6b8Bd3gtxUK887djbZVVC4wM/5zZk=";
 
   meta = with lib; {
     description = "Script to monitor & download Twitter Spaces 24/7";
diff --git a/pkgs/tools/networking/openssh/default.nix b/pkgs/tools/networking/openssh/default.nix
index e05d0ce144b2..d202ac446ba8 100644
--- a/pkgs/tools/networking/openssh/default.nix
+++ b/pkgs/tools/networking/openssh/default.nix
@@ -6,11 +6,11 @@ in
 
   openssh = common rec {
     pname = "openssh";
-    version = "9.3p1";
+    version = "9.3p2";
 
     src = fetchurl {
       url = "mirror://openbsd/OpenSSH/portable/openssh-${version}.tar.gz";
-      hash = "sha256-6bq6dwGnalHz2Fpiw4OjydzZf6kAuFm8fbEUwYaK+Kg=";
+      hash = "sha256-IA6+FH9ss/EB/QzfngJEKvfdyimN/9n0VoeOfMrGdug=";
     };
 
     extraPatches = [ ./ssh-keysign-8.5.patch ];
@@ -19,12 +19,12 @@ in
 
   openssh_hpn = common rec {
     pname = "openssh-with-hpn";
-    version = "9.3p1";
+    version = "9.3p2";
     extraDesc = " with high performance networking patches";
 
     src = fetchurl {
       url = "mirror://openbsd/OpenSSH/portable/openssh-${version}.tar.gz";
-      hash = "sha256-6bq6dwGnalHz2Fpiw4OjydzZf6kAuFm8fbEUwYaK+Kg=";
+      hash = "sha256-IA6+FH9ss/EB/QzfngJEKvfdyimN/9n0VoeOfMrGdug=";
     };
 
     extraPatches = let url = "https://raw.githubusercontent.com/freebsd/freebsd-ports/700625bcd86b74cf3fb9536aeea250d7f8cd1fd5/security/openssh-portable/files/extra-patch-hpn"; in
diff --git a/pkgs/tools/package-management/rpm/default.nix b/pkgs/tools/package-management/rpm/default.nix
index 7cb1dd91c26a..9418244212ac 100644
--- a/pkgs/tools/package-management/rpm/default.nix
+++ b/pkgs/tools/package-management/rpm/default.nix
@@ -1,22 +1,22 @@
 { stdenv, lib
-, pkg-config, autoreconfHook
+, pkg-config, autoreconfHook, pandoc
 , fetchurl, cpio, zlib, bzip2, file, elfutils, libbfd, libgcrypt, libarchive, nspr, nss, popt, db, xz, python, lua, llvmPackages
 , sqlite, zstd, libcap
 }:
 
 stdenv.mkDerivation rec {
   pname = "rpm";
-  version = "4.18.0";
+  version = "4.18.1";
 
   src = fetchurl {
     url = "https://ftp.osuosl.org/pub/rpm/releases/rpm-${lib.versions.majorMinor version}.x/rpm-${version}.tar.bz2";
-    hash = "sha256-KhcVLXGHqzDt8sL7WGRjvfY4jee1g3SAlVZZ5ekFRVQ=";
+    hash = "sha256-N/O0LAlmlB4q0/EP3jY5gkplkdBxl7qP0IacoHeeH1Y=";
   };
 
   outputs = [ "out" "dev" "man" ];
   separateDebugInfo = true;
 
-  nativeBuildInputs = [ autoreconfHook pkg-config ];
+  nativeBuildInputs = [ autoreconfHook pkg-config pandoc ];
   buildInputs = [ cpio zlib zstd bzip2 file libarchive libgcrypt nspr nss db xz python lua sqlite ]
                 ++ lib.optional stdenv.cc.isClang llvmPackages.openmp
                 ++ lib.optional stdenv.isLinux libcap;
diff --git a/pkgs/tools/security/rbw/default.nix b/pkgs/tools/security/rbw/default.nix
index 0bd208c2af0b..0b02fe7f1a22 100644
--- a/pkgs/tools/security/rbw/default.nix
+++ b/pkgs/tools/security/rbw/default.nix
@@ -24,14 +24,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rbw";
-  version = "1.8.1";
+  version = "1.8.2";
 
   src = fetchzip {
     url = "https://git.tozt.net/rbw/snapshot/rbw-${version}.tar.gz";
-    sha256 = "sha256-cRfCsuhVlTRSgndf4rZrfLG/+NgI4VshVwbQydJt2cE=";
+    sha256 = "sha256-CIQ+mU5lbw3ugjxL9i6sLaf9hZipUQUGR2HUgYNtWes=";
   };
 
-  cargoHash = "sha256-CFhBSRqWAJJJkeMNnLwp6/pLhIZHFvdlPn7pjfJFBWw=";
+  cargoHash = "sha256-eVojTcdDE6UDrmk0Ll+MRuW/UqQ7r7/SomSz84RfxxI=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 905fc2d140d1..8084e4f3c849 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -4814,6 +4814,8 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) Security;
   };
 
+  diesel-cli-ext = callPackage ../development/tools/diesel-cli-ext { };
+
   refinery-cli = callPackage ../development/tools/refinery-cli { };
 
   digitemp = callPackage ../tools/misc/digitemp { };
@@ -22435,6 +22437,8 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) AudioUnit;
   };
 
+  libspelling = callPackage ../development/libraries/libspelling { };
+
   libsystemtap = callPackage ../development/libraries/libsystemtap { };
 
   libgtop = callPackage ../development/libraries/libgtop { };
@@ -32880,6 +32884,7 @@ with pkgs;
     harfbuzz = harfbuzz.override {
       withIcu = true; withGraphite2 = true;
     };
+    boost = boost179;
   };
 
   libreoffice-qt = lowPrio (callPackage ../applications/office/libreoffice/wrapper.nix {
@@ -36421,6 +36426,8 @@ with pkgs;
     withGui = false;
   };
 
+  aperture = callPackage ../applications/blockchains/aperture { };
+
   balanceofsatoshis = nodePackages.balanceofsatoshis;
 
   bitcoin  = libsForQt5.callPackage ../applications/blockchains/bitcoin {
diff --git a/pkgs/top-level/nim-packages.nix b/pkgs/top-level/nim-packages.nix
index da443780e6f8..9b45284b5e88 100644
--- a/pkgs/top-level/nim-packages.nix
+++ b/pkgs/top-level/nim-packages.nix
@@ -45,6 +45,8 @@ lib.makeScope newScope (self:
     getdns = callPackage ../development/nim-packages/getdns {
       inherit (pkgs) getdns; };
 
+    hashlib = callPackage ../development/nim-packages/hashlib { };
+
     hts-nim = callPackage ../development/nim-packages/hts-nim { };
 
     illwill = callPackage ../development/nim-packages/illwill { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 19cdceb500c3..f7f4ebf1a6cc 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -404,6 +404,8 @@ self: super: with self; {
 
   alarmdecoder = callPackage ../development/python-modules/alarmdecoder { };
 
+  albumentations = callPackage ../development/python-modules/albumentations { };
+
   ale-py = callPackage ../development/python-modules/ale-py { };
 
   alectryon = callPackage ../development/python-modules/alectryon { };
@@ -10674,6 +10676,8 @@ self: super: with self; {
 
   quart-cors = callPackage ../development/python-modules/quart-cors { };
 
+  qudida = callPackage ../development/python-modules/qudida { };
+
   querystring_parser = callPackage ../development/python-modules/querystring-parser { };
 
   questionary = callPackage ../development/python-modules/questionary { };