diff --git a/nixos/doc/manual/release-notes/rl-2305.section.md b/nixos/doc/manual/release-notes/rl-2305.section.md
index e23f1b562e71..b13b6fc7f67f 100644
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@@ -187,6 +187,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - [services.xserver.videoDrivers](options.html#opt-services.xserver.videoDrivers) now defaults to the `modesetting` driver over device-specific ones. The `radeon`, `amdgpu` and `nouveau` drivers are still available, but effectively unmaintained and not recommended for use.
 
+- To enable the HTTP3 (QUIC) protocol for a nginx virtual host, set the `quic` attribute on it to true, e.g. `services.nginx.virtualHosts.<name>.quic = true;`.
+
 - conntrack helper autodetection has been removed from kernels 6.0 and up upstream, and an assertion was added to ensure things don't silently stop working. Migrate your configuration to assign helpers explicitly or use an older LTS kernel branch as a temporary workaround.
 
 - The `services.pipewire.config` options have been removed, as they have basically never worked correctly. All behavior defined by the default configuration can be overridden with drop-in files as necessary - see [below](#sec-release-23.05-migration-pipewire) for details.
@@ -284,6 +286,7 @@ In addition to numerous new and upgraded packages, this release has the followin
   ```
 
 - `services.dhcpcd` service now don't solicit or accept IPv6 Router Advertisements on interfaces that use static IPv6 addresses.
+  If network uses both IPv6 Unique local addresses (ULA) and global IPv6 address auto-configuration with SLAAC, must add the parameter `networking.dhcpcd.IPv6rs = true;`.
 
 - The module `services.headscale` was refactored to be compliant with [RFC 0042](https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md). To be precise, this means that the following things have changed:
 
diff --git a/nixos/modules/services/networking/ddclient.nix b/nixos/modules/services/networking/ddclient.nix
index 4d843641f58a..5e6f5217c0ce 100644
--- a/nixos/modules/services/networking/ddclient.nix
+++ b/nixos/modules/services/networking/ddclient.nix
@@ -218,6 +218,7 @@ with lib;
       wantedBy = [ "multi-user.target" ];
       after = [ "network.target" ];
       restartTriggers = optional (cfg.configFile != null) cfg.configFile;
+      path = lib.optional (lib.hasPrefix "if," cfg.use) pkgs.iproute2;
 
       serviceConfig = {
         DynamicUser = true;
diff --git a/nixos/modules/services/networking/dhcpcd.nix b/nixos/modules/services/networking/dhcpcd.nix
index 9a0b29fbe5a7..8b6d3fc55f3e 100644
--- a/nixos/modules/services/networking/dhcpcd.nix
+++ b/nixos/modules/services/networking/dhcpcd.nix
@@ -81,9 +81,12 @@ let
         noipv6
       ''}
 
-      ${cfg.extraConfig}
+      ${optionalString (config.networking.enableIPv6 && cfg.IPv6rs == null && staticIPv6Addresses != [ ]) noIPv6rs}
+      ${optionalString (config.networking.enableIPv6 && cfg.IPv6rs == false) ''
+        noipv6rs
+      ''}
 
-      ${optionalString config.networking.enableIPv6 noIPv6rs}
+      ${cfg.extraConfig}
     '';
 
   exitHook = pkgs.writeText "dhcpcd.exit-hook"
@@ -160,6 +163,16 @@ in
       '';
     };
 
+    networking.dhcpcd.IPv6rs = mkOption {
+      type = types.nullOr types.bool;
+      default = null;
+      description = lib.mdDoc ''
+        Force enable or disable solicitation and receipt of IPv6 Router Advertisements.
+        This is required, for example, when using a static unique local IPv6 address (ULA)
+        and global IPv6 address auto-configuration with SLAAC.
+      '';
+    };
+
     networking.dhcpcd.runHook = mkOption {
       type = types.lines;
       default = "";
diff --git a/nixos/modules/services/web-apps/cloudlog.nix b/nixos/modules/services/web-apps/cloudlog.nix
index 9c6284fd1b57..da2cf93d7f1c 100644
--- a/nixos/modules/services/web-apps/cloudlog.nix
+++ b/nixos/modules/services/web-apps/cloudlog.nix
@@ -36,7 +36,8 @@ let
     );
   '';
   configFile = pkgs.writeText "config.php" ''
-    ${strings.fileContents "${pkgs.cloudlog}/install/config/config.php"}
+    <?php
+    include('${pkgs.cloudlog}/install/config/config.php');
     $config['datadir'] = "${cfg.dataDir}/";
     $config['base_url'] = "${cfg.baseUrl}";
     ${cfg.extraConfig}
diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix
index 064c86a9a7e2..f2cf7a28b118 100644
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@@ -184,8 +184,9 @@ let
         brotli_types ${lib.concatStringsSep " " compressMimeTypes};
       ''}
 
-      ${optionalString cfg.recommendedGzipSettings ''
+      ${optionalString cfg.recommendedGzipSettings
         # https://docs.nginx.com/nginx/admin-guide/web-server/compression/
+      ''
         gzip on;
         gzip_static on;
         gzip_vary on;
@@ -311,12 +312,15 @@ let
             else defaultListen;
 
         listenString = { addr, port, ssl, extraParameters ? [], ... }:
-          (if ssl && vhost.http3 then "
-          # UDP listener for **QUIC+HTTP/3
-          listen ${addr}:${toString port} http3 "
+          # UDP listener for QUIC transport protocol.
+          (if ssl && vhost.quic then "
+            listen ${addr}:${toString port} quic "
           + optionalString vhost.default "default_server "
           + optionalString vhost.reuseport "reuseport "
-          + optionalString (extraParameters != []) (concatStringsSep " " extraParameters)
+          + optionalString (extraParameters != []) (concatStringsSep " " (
+            let inCompatibleParameters = [ "ssl" "proxy_protocol" "http2" ];
+                isCompatibleParameter = param: !(any (p: p == param) inCompatibleParameters);
+            in filter isCompatibleParameter extraParameters))
           + ";" else "")
           + "
 
@@ -363,6 +367,10 @@ let
         server {
           ${concatMapStringsSep "\n" listenString hostListen}
           server_name ${vhost.serverName} ${concatStringsSep " " vhost.serverAliases};
+          ${optionalString (hasSSL && vhost.quic) ''
+            http3 ${if vhost.http3 then "on" else "off"};
+            http3_hq ${if vhost.http3_hq then "on" else "off"};
+          ''}
           ${acmeLocation}
           ${optionalString (vhost.root != null) "root ${vhost.root};"}
           ${optionalString (vhost.globalRedirect != null) ''
@@ -384,9 +392,10 @@ let
             ssl_conf_command Options KTLS;
           ''}
 
-          ${optionalString (hasSSL && vhost.http3) ''
+          ${optionalString (hasSSL && vhost.quic && vhost.http3)
             # Advertise that HTTP/3 is available
-            add_header Alt-Svc 'h3=":443"; ma=86400' always;
+          ''
+            add_header Alt-Svc 'h3=":$server_port"; ma=86400';
           ''}
 
           ${mkBasicAuth vhostName vhost}
@@ -476,7 +485,8 @@ in
         default = false;
         type = types.bool;
         description = lib.mdDoc ''
-          Enable recommended brotli settings. Learn more about compression in Brotli format [here](https://github.com/google/ngx_brotli/blob/master/README.md).
+          Enable recommended brotli settings.
+          Learn more about compression in Brotli format [here](https://github.com/google/ngx_brotli/).
 
           This adds `pkgs.nginxModules.brotli` to `services.nginx.additionalModules`.
         '';
@@ -487,6 +497,18 @@ in
         type = types.bool;
         description = lib.mdDoc ''
           Enable recommended gzip settings.
+          Learn more about compression in Gzip format [here](https://docs.nginx.com/nginx/admin-guide/web-server/compression/).
+        '';
+      };
+
+      recommendedZstdSettings = mkOption {
+        default = false;
+        type = types.bool;
+        description = lib.mdDoc ''
+          Enable recommended zstd settings.
+          Learn more about compression in Zstd format [here](https://github.com/tokers/zstd-nginx-module).
+
+          This adds `pkgs.nginxModules.zstd` to `services.nginx.additionalModules`.
         '';
       };
 
@@ -498,16 +520,6 @@ in
         '';
       };
 
-      recommendedZstdSettings = mkOption {
-        default = false;
-        type = types.bool;
-        description = lib.mdDoc ''
-          Enable recommended zstd settings. Learn more about compression in Zstd format [here](https://github.com/tokers/zstd-nginx-module).
-
-          This adds `pkgs.nginxModules.zstd` to `services.nginx.additionalModules`.
-        '';
-      };
-
       proxyTimeout = mkOption {
         type = types.str;
         default = "60s";
@@ -1027,6 +1039,14 @@ in
           services.nginx.virtualHosts.<name>.useACMEHost are mutually exclusive.
         '';
       }
+
+      {
+        assertion = cfg.package.pname != "nginxQuic" -> all (host: !host.quic) (attrValues virtualHosts);
+        message = ''
+          services.nginx.service.virtualHosts.<name>.quic requires using nginxQuic package,
+          which can be achieved by setting `services.nginx.package = pkgs.nginxQuic;`.
+        '';
+      }
     ] ++ map (name: mkCertOwnershipAssertion {
       inherit (cfg) group user;
       cert = config.security.acme.certs.${name};
diff --git a/nixos/modules/services/web-servers/nginx/vhost-options.nix b/nixos/modules/services/web-servers/nginx/vhost-options.nix
index 089decb5f433..5b33694cf2da 100644
--- a/nixos/modules/services/web-servers/nginx/vhost-options.nix
+++ b/nixos/modules/services/web-servers/nginx/vhost-options.nix
@@ -188,24 +188,54 @@ with lib;
       type = types.bool;
       default = true;
       description = lib.mdDoc ''
-        Whether to enable HTTP 2.
+        Whether to enable the HTTP/2 protocol.
         Note that (as of writing) due to nginx's implementation, to disable
-        HTTP 2 you have to disable it on all vhosts that use a given
+        HTTP/2 you have to disable it on all vhosts that use a given
         IP address / port.
-        If there is one server block configured to enable http2,then it is
+        If there is one server block configured to enable http2, then it is
         enabled for all server blocks on this IP.
         See https://stackoverflow.com/a/39466948/263061.
       '';
     };
 
     http3 = mkOption {
+      type = types.bool;
+      default = true;
+      description = lib.mdDoc ''
+        Whether to enable the HTTP/3 protocol.
+        This requires using `pkgs.nginxQuic` package
+        which can be achieved by setting `services.nginx.package = pkgs.nginxQuic;`
+        and activate the QUIC transport protocol
+        `services.nginx.virtualHosts.<name>.quic = true;`.
+        Note that HTTP/3 support is experimental and
+        *not* yet recommended for production.
+        Read more at https://quic.nginx.org/
+      '';
+    };
+
+    http3_hq = mkOption {
       type = types.bool;
       default = false;
       description = lib.mdDoc ''
-        Whether to enable HTTP 3.
+        Whether to enable the HTTP/0.9 protocol negotiation used in QUIC interoperability tests.
+        This requires using `pkgs.nginxQuic` package
+        which can be achieved by setting `services.nginx.package = pkgs.nginxQuic;`
+        and activate the QUIC transport protocol
+        `services.nginx.virtualHosts.<name>.quic = true;`.
+        Note that special application protocol support is experimental and
+        *not* yet recommended for production.
+        Read more at https://quic.nginx.org/
+      '';
+    };
+
+    quic = mkOption {
+      type = types.bool;
+      default = false;
+      description = lib.mdDoc ''
+        Whether to enable the QUIC transport protocol.
         This requires using `pkgs.nginxQuic` package
         which can be achieved by setting `services.nginx.package = pkgs.nginxQuic;`.
-        Note that HTTP 3 support is experimental and
+        Note that QUIC support is experimental and
         *not* yet recommended for production.
         Read more at https://quic.nginx.org/
       '';
diff --git a/nixos/tests/nginx-http3.nix b/nixos/tests/nginx-http3.nix
index 319f6aac184a..f003130b46f5 100644
--- a/nixos/tests/nginx-http3.nix
+++ b/nixos/tests/nginx-http3.nix
@@ -36,8 +36,10 @@ in
           sslCertificateKey = ./common/acme/server/acme.test.key.pem;
           http2 = true;
           http3 = true;
+          http3_hq = false;
+          quic = true;
           reuseport = true;
-          root = lib.mkForce (pkgs.runCommandLocal "testdir2" {} ''
+          root = lib.mkForce (pkgs.runCommandLocal "testdir" {} ''
             mkdir "$out"
             cat > "$out/index.html" <<EOF
             <html><body>Hello World!</body></html>
@@ -82,6 +84,8 @@ in
 
     # Check header reading
     client.succeed("curl --verbose --http3 --head https://acme.test | grep 'content-type'")
+    client.succeed("curl --verbose --http3 --head https://acme.test | grep 'HTTP/3 200'")
+    client.succeed("curl --verbose --http3 --head https://acme.test/error | grep 'HTTP/3 404'")
 
     # Check change User-Agent
     client.succeed("curl --verbose --http3 --user-agent 'Curl test 3.0' https://acme.test")
diff --git a/pkgs/applications/audio/tone/default.nix b/pkgs/applications/audio/tone/default.nix
new file mode 100644
index 000000000000..4f02d4bd642f
--- /dev/null
+++ b/pkgs/applications/audio/tone/default.nix
@@ -0,0 +1,39 @@
+{ lib, stdenv, fetchFromGitHub, fetchNuGet, linkFarmFromDrvs, buildDotnetModule, ffmpeg-full, msbuild, dotnetCorePackages }:
+
+let
+  nugetSource = linkFarmFromDrvs "nuget-packages" (
+    import ./nuget-deps.nix { inherit fetchNuGet; }
+  );
+
+in buildDotnetModule rec {
+  pname = "tone";
+  version = "0.1.3";
+
+  src = fetchFromGitHub {
+    owner = "sandreas";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-Z3cumXAIJhUB3/EbzB08MfBCrga1JHtDKr44TmRQuno=";
+  };
+
+  projectFile = "tone/tone.csproj";
+  executables = [ "tone" ];
+  nugetDeps = ./nuget-deps.nix;
+  dotnetBuildFlags = [ "--no-self-contained" ];
+  dotnetInstallFlags = [
+    "-p:PublishSingleFile=false"
+    "-p:PublishTrimmed=false"
+    "-p:PublishReadyToRun=false"
+  ];
+
+  dotnet-sdk = dotnetCorePackages.sdk_6_0;
+  runtimeDeps = [ ffmpeg-full ];
+
+  meta = with lib; {
+    homepage = "https://github.com/sandreas/tone";
+    description = "tone is a cross platform utility to dump and modify audio metadata for a wide variety of formats";
+    license = licenses.asl20;
+    maintainers = [ maintainers.jvanbruegge ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/applications/audio/tone/nuget-deps.nix b/pkgs/applications/audio/tone/nuget-deps.nix
new file mode 100644
index 000000000000..3e9fa83c3540
--- /dev/null
+++ b/pkgs/applications/audio/tone/nuget-deps.nix
@@ -0,0 +1,55 @@
+# This file was automatically generated by passthru.fetch-deps.
+# Please dont edit it manually, your changes might get overwritten!
+
+{ fetchNuGet }: [
+  (fetchNuGet { pname = "CliWrap"; version = "3.6.0"; sha256 = "0x96awy81kn0dr8h5d376cgfzxg5bvmzd610rc017nliv152zkw2"; })
+  (fetchNuGet { pname = "CSharp.OperationResult"; version = "0.1.6"; sha256 = "127hjd30vvcks977yxxh59g89dbsf7h1khcr1vignrgk9fanvzyi"; })
+  (fetchNuGet { pname = "Esprima"; version = "3.0.0-beta-9"; sha256 = "1gwdi537832z5whyqx58474ys2akgmrkabm51sy7725c91814snz"; })
+  (fetchNuGet { pname = "grok.net"; version = "1.1.0"; sha256 = "01vm1b658dwxcxp1l4cpsplg8pwpmbs6v6fbqwg1lvrm7li9bgjz"; })
+  (fetchNuGet { pname = "Jint"; version = "3.0.0-beta-2044"; sha256 = "0sy0qy33gn54sszhq4dkiihxd224n58xhcxg46qi4p3i93qn3snl"; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Configuration"; version = "7.0.0"; sha256 = "0n1grglxql9llmrsbbnlz5chx8mxrb5cpvjngm0hfyrkgzcwz90d"; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Configuration.Abstractions"; version = "7.0.0"; sha256 = "1as8cygz0pagg17w22nsf6mb49lr2mcl1x8i3ad1wi8lyzygy1a3"; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Configuration.Binder"; version = "2.0.0"; sha256 = "1prvdbma6r18n5agbhhabv6g357p1j70gq4m9g0vs859kf44nrgc"; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Configuration.Binder"; version = "7.0.0"; sha256 = "1qifb1pv7s76lih8wnjk418wdk4qwn87q2n6dx54knfvxai410bl"; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Configuration.EnvironmentVariables"; version = "7.0.0"; sha256 = "0nhh7rnh45s39x8sjn88czg7nyfpry85pkm0g619j8b468zj8nb4"; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Configuration.FileExtensions"; version = "7.0.0"; sha256 = "1fk7dcz6gfhd1k1d8ksz22rnjvj1waqjzk29ym4i3dz73rsq8j1i"; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Configuration.Json"; version = "7.0.0"; sha256 = "05zjmrpp99l128wijp1fy8asskc11ls871qaqr4mjnz3gbfycxnj"; })
+  (fetchNuGet { pname = "Microsoft.Extensions.DependencyInjection"; version = "7.0.0"; sha256 = "121zs4jp8iimgbpzm3wsglhjwkc06irg1pxy8c1zcdlsg34cfq1p"; })
+  (fetchNuGet { pname = "Microsoft.Extensions.DependencyInjection.Abstractions"; version = "2.0.0"; sha256 = "1pwrfh9b72k9rq6mb2jab5qhhi225d5rjalzkapiayggmygc8nhz"; })
+  (fetchNuGet { pname = "Microsoft.Extensions.DependencyInjection.Abstractions"; version = "7.0.0"; sha256 = "181d7mp9307fs17lyy42f8cxnjwysddmpsalky4m0pqxcimnr6g7"; })
+  (fetchNuGet { pname = "Microsoft.Extensions.DependencyModel"; version = "3.0.0"; sha256 = "1cm0hycgb33mf1ja9q91wxi3gk13d1p462gdq7gndrya23hw2jm5"; })
+  (fetchNuGet { pname = "Microsoft.Extensions.FileProviders.Abstractions"; version = "7.0.0"; sha256 = "0ff20yklyjgyjzdyv7sybczgqhgd557m05dbwxzjznr0x41b180d"; })
+  (fetchNuGet { pname = "Microsoft.Extensions.FileProviders.Physical"; version = "7.0.0"; sha256 = "1f1h0l47abw0spssd64qkhgd7b54pyzslyb586zp21milimcfmgv"; })
+  (fetchNuGet { pname = "Microsoft.Extensions.FileSystemGlobbing"; version = "7.0.0"; sha256 = "1812vnkn8n0i4yr3k5azcxcfx1bbpcsmms95rdyxjfrzfksr05ai"; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Logging"; version = "2.0.0"; sha256 = "1jkwjcq1ld9znz1haazk8ili2g4pzfdp6i7r7rki4hg3jcadn386"; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Logging.Abstractions"; version = "2.0.0"; sha256 = "1x5isi71z02khikzvm7vaschb006pqqrsv86ky1x08a4hir4s43h"; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Options"; version = "2.0.0"; sha256 = "0g4zadlg73f507krilhaaa7h0jdga216syrzjlyf5fdk25gxmjqh"; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Options"; version = "7.0.0"; sha256 = "0b90zkrsk5dw3wr749rbynhpxlg4bgqdnd7d5vdlw2g9c7zlhgx6"; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Options.ConfigurationExtensions"; version = "7.0.0"; sha256 = "1liyprh0zha2vgmqh92n8kkjz61zwhr7g16f0gmr297z2rg1j5pj"; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Primitives"; version = "2.0.0"; sha256 = "1xppr5jbny04slyjgngxjdm0maxdh47vq481ps944d7jrfs0p3mb"; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Primitives"; version = "7.0.0"; sha256 = "1b4km9fszid9vp2zb3gya5ni9fn8bq62bzaas2ck2r7gs0sdys80"; })
+  (fetchNuGet { pname = "Microsoft.NETCore.App.Crossgen2.linux-x64"; version = "6.0.13"; sha256 = "0sjd1npl37mky8gqi4bir2fgp0bm6y3jy641asfxa0k0cidbfzwl"; })
+  (fetchNuGet { pname = "Newtonsoft.Json"; version = "13.0.2"; sha256 = "1p9splg1min274dpz7xdfgzrwkyfd3xlkygwpr1xgjvvyjvs6b0i"; })
+  (fetchNuGet { pname = "Sandreas.AudioMetadata"; version = "0.1.1"; sha256 = "11ibv23h7qj5qshibmlsqmjca51dqbhib9p1gz66c5kqhk7ci38j"; })
+  (fetchNuGet { pname = "Sandreas.Files"; version = "1.1.2"; sha256 = "08qk229q2y1dpdxdnp8xi9mgk8fgpjxrxm4z6ak8n09npp67nhn0"; })
+  (fetchNuGet { pname = "Sandreas.SpectreConsoleHelpers"; version = "0.0.2"; sha256 = "1vy2fka11n0smgrbwdxabl6cdcsg6fv1gymxrws8m0sf9qm64nd1"; })
+  (fetchNuGet { pname = "Serilog"; version = "2.12.0"; sha256 = "0lqxpc96qcjkv9pr1rln7mi4y7n7jdi4vb36c2fv3845w1vswgr4"; })
+  (fetchNuGet { pname = "Serilog.Extensions.Logging"; version = "3.1.0"; sha256 = "0lv370ks2fjdn1nsgkbzbmw6hybnincw3jabr471a5w39pp4fl1c"; })
+  (fetchNuGet { pname = "Serilog.Settings.Configuration"; version = "3.4.0"; sha256 = "1l6fyy9y5a168i1mm107aqyrwzhqmpy0cp1v13l2b89yv8dc105j"; })
+  (fetchNuGet { pname = "Serilog.Sinks.Console"; version = "4.1.0"; sha256 = "1rpkphmqfh3bv3m7v1zwz88wz4sirj4xqyff9ga0c6bqhblj6wii"; })
+  (fetchNuGet { pname = "Serilog.Sinks.File"; version = "5.0.0"; sha256 = "097rngmgcrdfy7jy8j7dq3xaq2qky8ijwg0ws6bfv5lx0f3vvb0q"; })
+  (fetchNuGet { pname = "Spectre.Console"; version = "0.46.0"; sha256 = "1fr7090f2s7q9cw1k25m439blgicsbgl9k5nhqql9xvp0b00s4n9"; })
+  (fetchNuGet { pname = "Spectre.Console.Cli"; version = "0.46.0"; sha256 = "00clv0mw97z8a9r7zam97prdv4ich33m4dhi7v8mjdqwwhj6q4jr"; })
+  (fetchNuGet { pname = "System.IO.Abstractions"; version = "19.0.1"; sha256 = "16dasj8bwsdyl5phgqgfgswkbghzdb3sq7sidigr3b5ykna6n96g"; })
+  (fetchNuGet { pname = "System.Memory"; version = "4.5.5"; sha256 = "08jsfwimcarfzrhlyvjjid61j02irx6xsklf32rv57x2aaikvx0h"; })
+  (fetchNuGet { pname = "System.Runtime.CompilerServices.Unsafe"; version = "4.4.0"; sha256 = "0a6ahgi5b148sl5qyfpyw383p3cb4yrkm802k29fsi4mxkiwir29"; })
+  (fetchNuGet { pname = "System.Runtime.CompilerServices.Unsafe"; version = "6.0.0"; sha256 = "0qm741kh4rh57wky16sq4m0v05fxmkjjr87krycf5vp9f0zbahbc"; })
+  (fetchNuGet { pname = "System.Text.Encodings.Web"; version = "7.0.0"; sha256 = "1151hbyrcf8kyg1jz8k9awpbic98lwz9x129rg7zk1wrs6vjlpxl"; })
+  (fetchNuGet { pname = "System.Text.Json"; version = "4.6.0"; sha256 = "0ism236hwi0k6axssfq58s1d8lihplwiz058pdvl8al71hagri39"; })
+  (fetchNuGet { pname = "System.Text.Json"; version = "7.0.0"; sha256 = "0scb0lp7wbgcinaa4kqiqs7b8i5nx4ppfad81138jiwd1sl37pyp"; })
+  (fetchNuGet { pname = "System.Threading.Tasks.Extensions"; version = "4.5.4"; sha256 = "0y6ncasgfcgnjrhynaf0lwpkpkmv4a07sswwkwbwb5h7riisj153"; })
+  (fetchNuGet { pname = "TestableIO.System.IO.Abstractions"; version = "19.0.1"; sha256 = "01v2wgb6y2z7df4b2dsy0jb4hnhpv5kgyxypzyqdk7h6plad2axd"; })
+  (fetchNuGet { pname = "TestableIO.System.IO.Abstractions.Wrappers"; version = "19.0.1"; sha256 = "1ms8wqar5w3z2y2qgxii9pqnsb4f1aikji2vaw01zxvnh2wry42n"; })
+  (fetchNuGet { pname = "Ude.NetStandard"; version = "1.2.0"; sha256 = "074yff6g272zpkhk0zvmbfiaaxyp3b05fl24i7ffp2jf9r8bnfpl"; })
+  (fetchNuGet { pname = "z440.atl.core"; version = "4.18.0"; sha256 = "0wwqhpl3xw9vf6c5idz1kwpd72kbg7b9fcmj6gmccxa99kcgljzk"; })
+]
diff --git a/pkgs/applications/editors/neovim/tests/default.nix b/pkgs/applications/editors/neovim/tests/default.nix
index 707a310b632a..f1c38d2915dc 100644
--- a/pkgs/applications/editors/neovim/tests/default.nix
+++ b/pkgs/applications/editors/neovim/tests/default.nix
@@ -58,12 +58,12 @@ let
   };
 
   # this plugin checks that it's ftplugin/vim.tex is loaded before $VIMRUNTIME/ftplugin/vim.tex
-  # the answer is store in `plugin_was_loaded_too_late` in the cwd
+  # $VIMRUNTIME/ftplugin/vim.tex sources $VIMRUNTIME/ftplugin/initex.vim which sets b:did_ftplugin
+  # we save b:did_ftplugin's value in a `plugin_was_loaded_too_late` file
   texFtplugin = (pkgs.runCommandLocal "tex-ftplugin" {} ''
     mkdir -p $out/ftplugin
-    echo 'call system("echo ". exists("b:did_ftplugin") . " > plugin_was_loaded_too_late")' > $out/ftplugin/tex.vim
+    echo 'call system("echo ". exists("b:did_ftplugin") . " > plugin_was_loaded_too_late")' >> $out/ftplugin/tex.vim
     echo ':q!' >> $out/ftplugin/tex.vim
-    echo '\documentclass{article}' > $out/main.tex
   '') // { pname = "test-ftplugin"; };
 
   # neovim-drv must be a wrapped neovim
@@ -141,10 +141,12 @@ rec {
   # files from $VIMRUNTIME
   run_nvim_with_ftplugin = runTest nvim_with_ftplugin ''
     export HOME=$TMPDIR
-    ${nvim_with_ftplugin}/bin/nvim ${texFtplugin}/main.tex
-    result="$(cat plugin_was_loaded_too_late)"
-    echo $result
-    [ "$result" = 0 ]
+    echo '\documentclass{article}' > main.tex
+
+    ${nvim_with_ftplugin}/bin/nvim main.tex -c "set ft?" -c quit
+    ls -l $TMPDIR
+    # if the file exists, then our plugin has been loaded instead of neovim's
+    [ ! -f plugin_was_loaded_too_late ]
   '';
 
 
@@ -260,13 +262,12 @@ rec {
       packadd dashboard-nvim-unique-for-tests-please-dont-use-opt
 
       " Try to run Dashboard again, and throw if it fails
-      try
-        Dashboard
-        echo "Dashboard found"
-      catch /^Vim\%((\a\+)\)\=:E492/
+      let res = exists(':Dashboard')
+      if res == 0
         echo "Dashboard not found, throwing error"
         cquit 1
-      endtry
+      endif
+      cquit 0
     '';
   };
 
diff --git a/pkgs/applications/file-managers/lf/ctpv.nix b/pkgs/applications/file-managers/lf/ctpv.nix
index 36a01078831a..d1e4a6633730 100644
--- a/pkgs/applications/file-managers/lf/ctpv.nix
+++ b/pkgs/applications/file-managers/lf/ctpv.nix
@@ -1,38 +1,61 @@
 { lib
-, pkgs
-, file
-, openssl
 , stdenv
 , fetchFromGitHub
-, waylandSupport ? stdenv.isLinux
-, x11Support ? stdenv.isLinux
+, makeWrapper
+, file
+, openssl
+, atool
+, bat
+, chafa
+, delta
+, ffmpeg
+, ffmpegthumbnailer
+, fontforge
+, glow
+, imagemagick
+, jq
+, ueberzug
 }:
 
 stdenv.mkDerivation rec {
   pname = "ctpv";
-  version = "1.0";
+  version = "1.1";
 
   src = fetchFromGitHub {
     owner = "NikitaIvanovV";
-    repo = "${pname}";
+    repo = pname;
     rev = "v${version}";
-    hash = "sha256-0OuskRCBVm8vMd2zH5u5EPABmCOlEv5N4ZZMdc7bAwM=";
+    hash = "sha256-3BQi4m44hBmPkJBFNCg6d9YKRbDZwLxdzBb/NDWTQP4=";
   };
 
-  nativeBuildInputs = [
+  nativeBuildInputs = [ makeWrapper ];
+
+  buildInputs = [
     file # libmagic
     openssl
   ];
 
-  buildInputs = with pkgs; [
-    ffmpegthumbnailer ffmpeg
-  ] ++ lib.optionals waylandSupport [ chafa ]
-    ++ lib.optionals x11Support [ ueberzug ];
-
   makeFlags = [ "PREFIX=$(out)" ];
 
+  preFixup = ''
+    wrapProgram $out/bin/ctpv \
+      --prefix PATH ":" "${lib.makeBinPath [
+        atool # for archive files
+        bat
+        chafa # for image files on Wayland
+        delta # for diff files
+        ffmpeg
+        ffmpegthumbnailer
+        fontforge
+        glow # for markdown files
+        imagemagick
+        jq # for json files
+        ueberzug # for image files on X11
+      ]}";
+  '';
+
   meta = with lib; {
-    description = "Image previews for lf (list files) file manager";
+    description = "File previewer for a terminal";
     homepage = "https://github.com/NikitaIvanovV/ctpv";
     license = licenses.mit;
     platforms = platforms.linux;
diff --git a/pkgs/applications/graphics/komikku/default.nix b/pkgs/applications/graphics/komikku/default.nix
index f2e0a2e76067..2e9847ca44f5 100644
--- a/pkgs/applications/graphics/komikku/default.nix
+++ b/pkgs/applications/graphics/komikku/default.nix
@@ -18,7 +18,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "komikku";
-  version = "1.16.0";
+  version = "1.17.0";
 
   format = "other";
 
@@ -26,7 +26,7 @@ python3.pkgs.buildPythonApplication rec {
     owner = "valos";
     repo = "Komikku";
     rev = "v${version}";
-    hash = "sha256-SzK86uzdGnNFNtbvw56n3AxjxcCBjHFs9wD98TVggAo=";
+    hash = "sha256-DxW9uefY6Fks3qSUeLMp3BB85SfLgzwBr4KO9do2y2o=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/graphics/paleta/default.nix b/pkgs/applications/graphics/paleta/default.nix
new file mode 100644
index 000000000000..4030cf4439a1
--- /dev/null
+++ b/pkgs/applications/graphics/paleta/default.nix
@@ -0,0 +1,59 @@
+{ lib
+, stdenv
+, rustPlatform
+, fetchFromGitHub
+, meson
+, ninja
+, pkg-config
+, wrapGAppsHook4
+, appstream-glib
+, desktop-file-utils
+, glib
+, gtk4
+, libadwaita
+}:
+
+stdenv.mkDerivation rec {
+  pname = "paleta";
+  version = "0.3.1";
+
+  src = fetchFromGitHub {
+    owner = "nate-xyz";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-c+X49bMywstRg7cSAbbpG/vd8OUB7RhdQVRumTIBDDk=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit src;
+    name = "${pname}-${version}";
+    hash = "sha256-2/ZfKvlvAY4pfUU3F9pEw+OR5oRSsSAAi3/W5x4zVs0=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    wrapGAppsHook4
+    appstream-glib
+    desktop-file-utils
+  ] ++ (with rustPlatform; [
+    cargoSetupHook
+    rust.cargo
+    rust.rustc
+  ]);
+
+  buildInputs = [
+    glib
+    gtk4
+    libadwaita
+  ];
+
+  meta = with lib; {
+    description = "Extract the dominant colors from any image";
+    homepage = "https://github.com/nate-xyz/paleta";
+    license = licenses.gpl3Only;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ zendo ];
+  };
+}
diff --git a/pkgs/applications/graphics/seamly2d/default.nix b/pkgs/applications/graphics/seamly2d/default.nix
new file mode 100644
index 000000000000..bd8316b953f0
--- /dev/null
+++ b/pkgs/applications/graphics/seamly2d/default.nix
@@ -0,0 +1,87 @@
+{ stdenv, lib, qtbase, wrapQtAppsHook, fetchFromGitHub,
+  addOpenGLRunpath, poppler_utils, qtxmlpatterns, qtsvg, mesa, gcc, xvfb-run,
+  fontconfig, freetype, xorg, ccache, qmake, python3, qttools, git
+}:
+let
+  qtPython = python3.withPackages (pkgs: with pkgs; [ pyqt5 ]);
+in
+stdenv.mkDerivation rec {
+  pname = "seamly2d";
+  version = "2022-08-15.0339";
+
+  src = fetchFromGitHub {
+    owner = "FashionFreedom";
+    repo = "Seamly2D";
+    rev = "v${version}";
+    sha256 = "13jxkg84jfz8g52zwhh5jvi23wryzkavwbsfalzr9m04blj5xnik";
+  };
+
+  buildInputs = [
+    git
+    qtPython
+    qtbase
+    poppler_utils
+    qtxmlpatterns
+    qtsvg
+    mesa
+    freetype
+    xorg.libXi
+    xorg.libXrender
+    xorg.libxcb
+  ];
+
+  nativeBuildInputs = [
+    addOpenGLRunpath
+    xvfb-run
+    fontconfig
+    wrapQtAppsHook
+    qmake
+    qttools
+  ];
+
+  postPatch = ''
+    substituteInPlace common.pri \
+      --replace '$$[QT_INSTALL_HEADERS]/QtXmlPatterns' '${lib.getDev qtxmlpatterns}/include/QtXmlPatterns' \
+      --replace '$$[QT_INSTALL_HEADERS]/QtSvg' '${lib.getDev qtsvg}/include/QtSvg' \
+      --replace '$$[QT_INSTALL_HEADERS]/' '${lib.getDev qtbase}/include/' \
+      --replace '$$[QT_INSTALL_HEADERS]' '${lib.getDev qtbase}'
+    substituteInPlace src/app/translations.pri \
+      --replace '$$[QT_INSTALL_BINS]/$$LRELEASE' '${lib.getDev qttools}/bin/lrelease'
+    substituteInPlace src/app/seamly2d/mainwindowsnogui.cpp \
+      --replace 'define PDFTOPS "pdftops"' 'define PDFTOPS "${lib.getBin poppler_utils}/bin/pdftops"'
+    substituteInPlace src/libs/vwidgets/export_format_combobox.cpp \
+      --replace 'define PDFTOPS "pdftops"' 'define PDFTOPS "${lib.getBin poppler_utils}/bin/pdftops"'
+    substituteInPlace src/app/seamlyme/mapplication.cpp \
+      --replace 'diagrams.rcc' '../share/diagrams.rcc'
+  '';
+
+  qmakeFlags = [
+    "PREFIX=/"
+    "PREFIX_LIB=/lib"
+    "Seamly2D.pro"
+    "-r"
+    "CONFIG+=noDebugSymbols"
+    "CONFIG+=no_ccache"
+  ];
+
+  installFlags = [ "INSTALL_ROOT=$(out)" ];
+
+  postInstall = ''
+    mv $out/usr/share $out/
+    rmdir $out/usr
+
+    mv $out/share/seamly2d/* $out/share/.
+    rmdir $out/share/seamly2d
+
+    mkdir -p $out/share/mime/packages
+    cp dist/debian/seamly2d.sharedmimeinfo $out/share/mime/packages/seamly2d.xml
+  '';
+
+  meta = {
+    description = "Open source patternmaking software";
+    homepage = "https://seamly.net/";
+    license = lib.licenses.gpl3;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ WhittlesJr ];
+  };
+}
diff --git a/pkgs/applications/misc/1password/default.nix b/pkgs/applications/misc/1password/default.nix
index c42ab4a25483..f7a7281496bb 100644
--- a/pkgs/applications/misc/1password/default.nix
+++ b/pkgs/applications/misc/1password/default.nix
@@ -12,12 +12,12 @@ let
     if extension == "zip" then fetchzip args else fetchurl args;
 
   pname = "1password-cli";
-  version = "2.16.0";
+  version = "2.16.1";
   sources = rec {
-    aarch64-linux = fetch "linux_arm64" "sha256-G0kn3BsgC8En4wNNr0aUSa52is+xmx3Ho+l3aMxKcKs=" "zip";
-    i686-linux = fetch "linux_386" "sha256-b5v8BGf7QkEU61TrLhCWprxcpUJp5BmUwrB9Oi+qyDI=" "zip";
-    x86_64-linux = fetch "linux_amd64" "sha256-ctHNRESQp+l7s1uXCv6AgNBARFQJydA/rLfdYDNyDXU=" "zip";
-    aarch64-darwin = fetch "apple_universal" "sha256-j+BiFJawqAhZHJhYDQx51G/aEgwAqq7mXedP65HyaGo=" "pkg";
+    aarch64-linux = fetch "linux_arm64" "sha256-8zKxd2yY8syGhgyPv06b+ag2bEfFfG19ZmQPrfi+Qh4=" "zip";
+    i686-linux = fetch "linux_386" "sha256-3OO0JMJMRqbmq/rD/VRKIMBdjYu66ebEFGNLKX9K6A8=" "zip";
+    x86_64-linux = fetch "linux_amd64" "sha256-ZCXfreBiFDc5YFd9YsMddEvzl22KwnnfSQsV6BmHqeA=" "zip";
+    aarch64-darwin = fetch "apple_universal" "sha256-vlsqvz+AgEhL7M8cJhxmjjZ6ocIVUdq7MC1EVZOExU8=" "pkg";
     x86_64-darwin = aarch64-darwin;
   };
   platforms = builtins.attrNames sources;
diff --git a/pkgs/applications/misc/golden-cheetah-bin/default.nix b/pkgs/applications/misc/golden-cheetah-bin/default.nix
new file mode 100644
index 000000000000..bfd5d5b86e94
--- /dev/null
+++ b/pkgs/applications/misc/golden-cheetah-bin/default.nix
@@ -0,0 +1,35 @@
+{ appimageTools, lib, fetchurl, stdenv }:
+let
+
+  pname = "golden-cheetah";
+  version = "3.6-RC3";
+
+  src = fetchurl {
+    url = "https://github.com/GoldenCheetah/GoldenCheetah/releases/download/v${version}/GoldenCheetah_v3.6-DEV_x64.AppImage";
+    hash = "sha256-Bp1IFql96tHc5ssg9nhTrFQqNtaM+5iYJguPGkguvns=";
+  };
+
+  appimageContents = appimageTools.extract { inherit pname src version; };
+in
+appimageTools.wrapType2 {
+  inherit pname src version;
+
+  extraPkgs = pkgs: with pkgs; [ R zlib libusb-compat-0_1 ];
+
+  extraInstallCommands = ''
+    mv $out/bin/${pname}-${version} $out/bin/GoldenCheetah
+    mkdir -p $out/share/applications
+    mkdir -p $out/share/pixmaps
+    cp ${appimageContents}/GoldenCheetah.desktop $out/share/applications/
+    cp ${appimageContents}/gc.png $out/share/pixmaps/
+  '';
+
+  meta = with lib; {
+    description = "Performance software for cyclists, runners and triathletes. This version includes the API Tokens for e.g. Strava";
+    platforms = platforms.linux;
+    broken = !stdenv.isx86_64;
+    maintainers = with maintainers; [ gador ];
+    license = licenses.gpl2Plus;
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+  };
+}
diff --git a/pkgs/applications/misc/golden-cheetah/default.nix b/pkgs/applications/misc/golden-cheetah/default.nix
index 368d6eddfe78..f13cf8a21d42 100644
--- a/pkgs/applications/misc/golden-cheetah/default.nix
+++ b/pkgs/applications/misc/golden-cheetah/default.nix
@@ -73,7 +73,7 @@ in mkDerivation rec {
   '';
 
   meta = with lib; {
-    description = "Performance software for cyclists, runners and triathletes";
+    description = "Performance software for cyclists, runners and triathletes. Built from source and without API tokens";
     platforms = platforms.linux;
     maintainers = with maintainers; [ adamcstephens ];
     license = licenses.gpl2Plus;
diff --git a/pkgs/applications/misc/libosmocore/default.nix b/pkgs/applications/misc/libosmocore/default.nix
index a3de388a52ab..5f9ce0a9a647 100644
--- a/pkgs/applications/misc/libosmocore/default.nix
+++ b/pkgs/applications/misc/libosmocore/default.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libosmocore";
-  version = "1.7.0";
+  version = "1.8.0";
 
   src = fetchFromGitHub {
     owner = "osmocom";
     repo = "libosmocore";
     rev = version;
-    hash = "sha256-Dkud3ZA9m/UVbPugbQztUJXFpkQYTWjK2mamxfto9JA=";
+    hash = "sha256-xs8XI6xIUIZ7e0b+z4+FB6jNGY08t1wI4Ud8EHdi93I=";
   };
 
   postPatch = ''
@@ -28,6 +28,7 @@ stdenv.mkDerivation rec {
 
   propagatedBuildInputs = [
     talloc
+    libmnl
   ];
 
   nativeBuildInputs = [
@@ -38,7 +39,6 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     gnutls
-    libmnl
     libusb1
     lksctp-tools
     pcsclite
diff --git a/pkgs/applications/misc/p2pool/default.nix b/pkgs/applications/misc/p2pool/default.nix
index bce7760759df..5636fa2cfb55 100644
--- a/pkgs/applications/misc/p2pool/default.nix
+++ b/pkgs/applications/misc/p2pool/default.nix
@@ -19,13 +19,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "p2pool";
-  version = "2.7";
+  version = "3.1";
 
   src = fetchFromGitHub {
     owner = "SChernykh";
     repo = "p2pool";
     rev = "v${version}";
-    sha256 = "sha256-j3SVwat/LGw/iGcyNn8acR29Ob/WXDKyeCfDTsH+gxA=";
+    sha256 = "sha256-yHxg/9QhaDNlUFzylftsJEk+pJoSoTfA0rJfcolBdTs=";
     fetchSubmodules = true;
   };
 
@@ -33,6 +33,8 @@ stdenv.mkDerivation rec {
   buildInputs = [ libuv zeromq libsodium gss hwloc openssl curl ]
     ++ lib.optionals stdenv.isDarwin [ Foundation ];
 
+  cmakeFlags = ["-DWITH_LTO=OFF"];
+
   installPhase = ''
     runHook preInstall
 
diff --git a/pkgs/applications/networking/asn/default.nix b/pkgs/applications/networking/asn/default.nix
index 14b42b930d51..fd296c531c76 100644
--- a/pkgs/applications/networking/asn/default.nix
+++ b/pkgs/applications/networking/asn/default.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "asn";
-  version = "0.73";
+  version = "0.73.1";
 
   src = fetchFromGitHub {
     owner = "nitefood";
     repo = "asn";
     rev = "v${version}";
-    sha256 = "sha256-z0vjYU6k+6p/lASqOase91aqkUvmuy8sUBjsq2OPnxE=";
+    sha256 = "sha256-W8Q6DOvLdp3iRi7OvTsvIdb8XnUatK/vt7bhtwtep/8=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/applications/networking/irc/irssi/default.nix b/pkgs/applications/networking/irc/irssi/default.nix
index f9563313f2fb..523573e3116c 100644
--- a/pkgs/applications/networking/irc/irssi/default.nix
+++ b/pkgs/applications/networking/irc/irssi/default.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "irssi";
-  version = "1.4.3";
+  version = "1.4.4";
 
   src = fetchFromGitHub {
     owner = "irssi";
     repo = "irssi";
     rev = version;
-    hash = "sha256-wRJp4KfI+2IAJ70XW7+0LR83cRvS/SGq7CpDVuc636Q=";
+    hash = "sha256-a/+9M2zoywZBdOfXHrA4O6Q9W7HJZNTthB/aseUNefA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/office/beebeep/default.nix b/pkgs/applications/office/beebeep/default.nix
new file mode 100644
index 000000000000..8fa5fc980714
--- /dev/null
+++ b/pkgs/applications/office/beebeep/default.nix
@@ -0,0 +1,43 @@
+{ lib
+, mkDerivation
+, fetchzip
+, wrapQtAppsHook
+, autoPatchelfHook
+, qtbase
+, qtmultimedia
+, qtx11extras
+}:
+
+mkDerivation rec {
+  pname = "beebeep";
+  version = "5.8.6";
+
+  src = fetchzip {
+    url = "https://netix.dl.sourceforge.net/project/beebeep/Linux/beebeep-${version}-qt5-amd64.tar.gz";
+    sha256 = "sha256-YDgFRXFBM1tjLP99mHYJadgccHJYYPAZ1kqR+FngLKU=";
+  };
+
+  nativeBuildInputs = [
+    wrapQtAppsHook
+    autoPatchelfHook
+  ];
+
+  buildInputs = [
+    qtbase
+    qtmultimedia
+    qtx11extras
+  ];
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp * $out/bin
+  '';
+
+  meta = with lib; {
+    homepage = "https://www.beebeep.net/";
+    description = "BeeBEEP is the free office messenger that is indispensable in all those places where privacy and security are an essential requirement.";
+    platforms = platforms.linux;
+    license = licenses.gpl2Only;
+    maintainers = with maintainers; [ mglolenstine ];
+  };
+}
diff --git a/pkgs/applications/office/iotas/default.nix b/pkgs/applications/office/iotas/default.nix
index acec5f7cabf7..0ec2939fa470 100644
--- a/pkgs/applications/office/iotas/default.nix
+++ b/pkgs/applications/office/iotas/default.nix
@@ -19,7 +19,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "iotas";
-  version = "0.1.9";
+  version = "0.1.11";
   format = "other";
 
   src = fetchFromGitLab {
@@ -27,7 +27,7 @@ python3.pkgs.buildPythonApplication rec {
     owner = "cheywood";
     repo = pname;
     rev = version;
-    hash = "sha256-TdsqxpJq2+hoLHcJ58JQ20TWerZMXL3wkT9oIlVkrk4=";
+    hash = "sha256-exXY0JFGuDZTbMmUEM+sFEitHXCsFBAHjybIyMmilk8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/radio/gnuradio/default.nix b/pkgs/applications/radio/gnuradio/default.nix
index aa993b302203..4a98fc0ddf8d 100644
--- a/pkgs/applications/radio/gnuradio/default.nix
+++ b/pkgs/applications/radio/gnuradio/default.nix
@@ -47,13 +47,13 @@
 , pname ? "gnuradio"
 , versionAttr ? {
   major = "3.10";
-  minor = "5";
-  patch = "1";
+  minor = "6";
+  patch = "0";
 }
 }:
 
 let
-  sourceSha256 = "sha256-D5Bsj70IHFOLPZQbaxkGdx7Lz94bXhCfnNfhZb3dDp4=";
+  sourceSha256 = "sha256-WLxb9vJBlRfo9bKWEIsCI0Zb040XkLNjYw84j6ivOrk=";
   featuresInfo = {
     # Needed always
     basic = {
diff --git a/pkgs/applications/radio/gridtracker/default.nix b/pkgs/applications/radio/gridtracker/default.nix
index 9a48854ccc69..bca163d5a2fb 100644
--- a/pkgs/applications/radio/gridtracker/default.nix
+++ b/pkgs/applications/radio/gridtracker/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gridtracker";
-  version = "1.23.0206";
+  version = "1.23.0402";
 
   src = fetchFromGitLab {
     owner = "gridtracker.org";
     repo = "gridtracker";
     rev = "v${version}";
-    sha256 = "sha256-XWjKJga9aQrMb0ZfA4ElsPU1CfMwFtwYSK1vjgtlKes=";
+    sha256 = "sha256-6SQuFN8Fi0fbWCYrQIIeSaXR2haI7uux4txCPKEoJvo=";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/version-management/gitlab/data.json b/pkgs/applications/version-management/gitlab/data.json
index 5ef18a9ea192..172975314a57 100644
--- a/pkgs/applications/version-management/gitlab/data.json
+++ b/pkgs/applications/version-management/gitlab/data.json
@@ -1,14 +1,14 @@
 {
-  "version": "15.10.0",
-  "repo_hash": "sha256-jpJd6CneCfw+Ia0CTlX5YcEMl+2Tmd2+zfw8L+hKYTk=",
+  "version": "15.10.1",
+  "repo_hash": "sha256-BETTehy2GxZDGWLgdao1I0cqm4cNaL9lhXe+JmCNi10=",
   "yarn_hash": "1il8dnjb7591ss6w14zibdihg3bylw866jjjclv1qm8cihp8k3y8",
   "owner": "gitlab-org",
   "repo": "gitlab",
-  "rev": "v15.10.0-ee",
+  "rev": "v15.10.1-ee",
   "passthru": {
-    "GITALY_SERVER_VERSION": "15.10.0",
-    "GITLAB_PAGES_VERSION": "15.10.0",
+    "GITALY_SERVER_VERSION": "15.10.1",
+    "GITLAB_PAGES_VERSION": "15.10.1",
     "GITLAB_SHELL_VERSION": "14.18.0",
-    "GITLAB_WORKHORSE_VERSION": "15.10.0"
+    "GITLAB_WORKHORSE_VERSION": "15.10.1"
   }
 }
diff --git a/pkgs/applications/version-management/gitlab/gitaly/default.nix b/pkgs/applications/version-management/gitlab/gitaly/default.nix
index 50a8bd4e2583..0a325a28e3d0 100644
--- a/pkgs/applications/version-management/gitlab/gitaly/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitaly/default.nix
@@ -11,7 +11,7 @@ let
     gemdir = ./.;
   };
 
-  version = "15.10.0";
+  version = "15.10.1";
   package_version = "v${lib.versions.major version}";
   gitaly_package = "gitlab.com/gitlab-org/gitaly/${package_version}";
 
@@ -22,7 +22,7 @@ let
       owner = "gitlab-org";
       repo = "gitaly";
       rev = "v${version}";
-      sha256 = "sha256-MHxpij4aT4sq7csWRAEr6NQ9PdFkEnrEPegVtBIXUNo=";
+      sha256 = "sha256-iGYmBMRno2qCvdklyztGTV48m0UMeozuyX7ZZdS7K/c=";
     };
 
     vendorSha256 = "sha256-knuUyJGz5JvYyKeDQ66cMQQSh2YKkkDB54iCir1QpEY=";
diff --git a/pkgs/applications/version-management/gitlab/gitlab-pages/default.nix b/pkgs/applications/version-management/gitlab/gitlab-pages/default.nix
index a0f14cc853c1..ca56a575e287 100644
--- a/pkgs/applications/version-management/gitlab/gitlab-pages/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-pages/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "gitlab-pages";
-  version = "15.10.0";
+  version = "15.10.1";
 
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-pages";
     rev = "v${version}";
-    sha256 = "sha256-LTUGWnZCqyLA5kNlCWMVGIOivfWVGb6GcAdO2tNW1/o=";
+    sha256 = "sha256-FZ7Ifb8bau1helYnmKcS90oASnjF/knxbtPsck6lwKk=";
   };
 
   vendorHash = "sha256-s3HHoz9URACuVVhePQQFviTqlQU7vCLOjTJPBlus1Vo=";
diff --git a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
index f48fea10d47a..bf6b87e1a0fa 100644
--- a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
@@ -5,7 +5,7 @@ in
 buildGoModule rec {
   pname = "gitlab-workhorse";
 
-  version = "15.10.0";
+  version = "15.10.1";
 
   src = fetchFromGitLab {
     owner = data.owner;
diff --git a/pkgs/applications/virtualization/qemu/default.nix b/pkgs/applications/virtualization/qemu/default.nix
index c20a2c53d600..a7a71977c4ae 100644
--- a/pkgs/applications/virtualization/qemu/default.nix
+++ b/pkgs/applications/virtualization/qemu/default.nix
@@ -231,8 +231,9 @@ stdenv.mkDerivation rec {
 
   # Add a ‘qemu-kvm’ wrapper for compatibility/convenience.
   postInstall = ''
-    ln -s $out/libexec/virtiofsd $out/bin
     ln -s $out/bin/qemu-system-${stdenv.hostPlatform.qemuArch} $out/bin/qemu-kvm
+  '' + lib.optionalString stdenv.isLinux ''
+    ln -s $out/libexec/virtiofsd $out/bin
   '';
 
   passthru = {
diff --git a/pkgs/data/fonts/iosevka/default.nix b/pkgs/data/fonts/iosevka/default.nix
index d7c0d619105d..c16d69f1affb 100644
--- a/pkgs/data/fonts/iosevka/default.nix
+++ b/pkgs/data/fonts/iosevka/default.nix
@@ -55,16 +55,16 @@ assert (extraParameters != null) -> set != null;
 
 buildNpmPackage rec {
   pname = if set != null then "iosevka-${set}" else "iosevka";
-  version = "20.0.0";
+  version = "22.0.0";
 
   src = fetchFromGitHub {
     owner = "be5invis";
     repo = "iosevka";
     rev = "v${version}";
-    hash = "sha256-JXlv9/P5tBAnRVNCBavG5AtM11Q6mikTN+Qu+u3pLP0=";
+    hash = "sha256-TvzUUuwmDP2K1deUsODV/FDjPTgZjVvilUdfrkeaO88=";
   };
 
-  npmDepsHash = "sha256-fecGkN6MEdBP8UokBY/w0TnPOC93KsAISEg3VW0bvHU=";
+  npmDepsHash = "sha256-G+iAGKweh5MOFTaNHLnSUwVMTSlgL/w0zrS2SrJrsJE=";
 
   nativeBuildInputs = [
     remarshal
diff --git a/pkgs/development/libraries/hunspell/dictionaries.nix b/pkgs/development/libraries/hunspell/dictionaries.nix
index 1f1f5a687a4b..7ca6efe43373 100644
--- a/pkgs/development/libraries/hunspell/dictionaries.nix
+++ b/pkgs/development/libraries/hunspell/dictionaries.nix
@@ -902,4 +902,16 @@ rec {
       platforms = platforms.all;
     };
   };
+
+  /* POLISH */
+
+  pl_PL = pl-pl;
+  pl-pl = mkDictFromLibreOffice {
+    shortName = "pl-pl";
+    dictFileName = "pl_PL";
+    shortDescription = "Polish (Poland)";
+    readmeFile = "README_en.txt";
+    # the README doesn't specify versions of licenses :/
+    license = with lib.licenses; [ gpl2Plus lgpl2Plus mpl10 asl20 cc-by-sa-25 ];
+  };
 }
diff --git a/pkgs/development/libraries/libzim/default.nix b/pkgs/development/libraries/libzim/default.nix
index 1787af0a4014..c1b7b0f11d0a 100644
--- a/pkgs/development/libraries/libzim/default.nix
+++ b/pkgs/development/libraries/libzim/default.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libzim";
-  version = "8.1.0";
+  version = "8.1.1";
 
   src = fetchFromGitHub {
     owner = "openzim";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-ab7UUF+I0/xaGChvdjylEQRHLOjmtg/wk+/JEGehGLE=";
+    hash = "sha256-t3ssScI66oJ0lT1saAFLJACAZZmfBqZP0EGUM8MykHY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/mobile/androidenv/ndk-bundle/default.nix b/pkgs/development/mobile/androidenv/ndk-bundle/default.nix
index cc99dfb2971c..a9e1aaca5508 100644
--- a/pkgs/development/mobile/androidenv/ndk-bundle/default.nix
+++ b/pkgs/development/mobile/androidenv/ndk-bundle/default.nix
@@ -7,13 +7,34 @@ let
     coreutils file findutils gawk gnugrep gnused jdk python3 which
   ]) + ":${platform-tools}/platform-tools";
 in
-deployAndroidPackage {
+deployAndroidPackage rec {
   inherit package os;
   nativeBuildInputs = [ makeWrapper ]
     ++ lib.optionals stdenv.isLinux [ autoPatchelfHook ];
   autoPatchelfIgnoreMissingDeps = true;
   buildInputs = lib.optionals (os == "linux") [ pkgs.zlib ];
-  patchInstructions = ''
+
+  patchElfBnaries = ''
+    # Patch the executables of the toolchains, but not the libraries -- they are needed for crosscompiling
+    if [ -d $out/libexec/android-sdk/ndk-bundle/toolchains/renderscript/prebuilt/linux-x86_64/lib64 ]; then
+      addAutoPatchelfSearchPath $out/libexec/android-sdk/ndk-bundle/toolchains/renderscript/prebuilt/linux-x86_64/lib64
+    fi
+
+    if [ -d $out/libexec/android-sdk/ndk-bundle/toolchains/llvm/prebuilt/linux-x86_64/lib64 ]; then
+      addAutoPatchelfSearchPath $out/libexec/android-sdk/ndk-bundle/toolchains/llvm/prebuilt/linux-x86_64/lib64
+    fi
+
+    find toolchains -type d -name bin -or -name lib64 | while read dir; do
+      autoPatchelf "$dir"
+    done
+
+    # Patch executables
+    if [ -d prebuilt/linux-x86_64 ]; then
+      autoPatchelf prebuilt/linux-x86_64
+    fi
+  '';
+
+  patchOsAgnostic = ''
     patchShebangs .
 
     # TODO: allow this stuff
@@ -22,47 +43,31 @@ deployAndroidPackage {
     # Ndk now has a prebuilt toolchains inside, the file layout has changed, we do a symlink
     # to still support the old standalone toolchains builds.
     if [ -d $out/libexec/android-sdk/ndk ] && [ ! -d $out/libexec/android-sdk/ndk-bundle ]; then
-        ln -sf $out/libexec/android-sdk/ndk/${package.revision} $out/libexec/android-sdk/ndk-bundle
+      ln -sf $out/libexec/android-sdk/ndk/${package.revision} $out/libexec/android-sdk/ndk-bundle
     elif [ ! -d $out/libexec/android-sdk/ndk-bundle ]; then
-        echo "The ndk-bundle layout has changed. The nix expressions have to be updated!"
-        exit 1
-    fi
-
-    # Patch the executables of the toolchains, but not the libraries -- they are needed for crosscompiling
-    if [ -d $out/libexec/android-sdk/ndk-bundle/toolchains/renderscript/prebuilt/linux-x86_64/lib64 ]; then
-        addAutoPatchelfSearchPath $out/libexec/android-sdk/ndk-bundle/toolchains/renderscript/prebuilt/linux-x86_64/lib64
-    fi
-
-    if [ -d $out/libexec/android-sdk/ndk-bundle/toolchains/llvm/prebuilt/linux-x86_64/lib64 ]; then
-        addAutoPatchelfSearchPath $out/libexec/android-sdk/ndk-bundle/toolchains/llvm/prebuilt/linux-x86_64/lib64
-    fi
-
-    if [ -d toolchains/llvm/prebuilt/linux-x86_64 ]; then
-        find toolchains/llvm/prebuilt/linux-x86_64 -type d -name bin -or -name lib64 | while read dir; do
-            autoPatchelf "$dir"
-        done
+      echo "The ndk-bundle layout has changed. The nix expressions have to be updated!"
+      exit 1
     fi
 
     # fix ineffective PROGDIR / MYNDKDIR determination
     for progname in ndk-build; do
-        sed -i -e 's|^PROGDIR=`dirname $0`|PROGDIR=`dirname $(readlink -f $(which $0))`|' $progname
+      sed -i -e 's|^PROGDIR=`dirname $0`|PROGDIR=`dirname $(readlink -f $(which $0))`|' $progname
     done
 
-    # Patch executables
-    if [ -d prebuilt/linux-x86_64 ]; then
-        autoPatchelf prebuilt/linux-x86_64
-    fi
-
     # wrap
     for progname in ndk-build; do
-        wrapProgram "$(pwd)/$progname" --prefix PATH : "${runtime_paths}"
+      wrapProgram "$(pwd)/$progname" --prefix PATH : "${runtime_paths}"
     done
 
     # make some executables available in PATH
     mkdir -p $out/bin
     for progname in ndk-build; do
-        ln -sf ../libexec/android-sdk/ndk-bundle/$progname $out/bin/$progname
+      ln -sf ../libexec/android-sdk/ndk-bundle/$progname $out/bin/$progname
     done
   '';
+
+  patchInstructions = patchOsAgnostic
+    + lib.optionalString stdenv.isLinux patchElfBnaries;
+
   noAuditTmpdir = true; # Audit script gets invoked by the build/ component in the path for the make standalone script
 }
diff --git a/pkgs/development/nim-packages/nimraylib-now/default.nix b/pkgs/development/nim-packages/nimraylib-now/default.nix
new file mode 100644
index 000000000000..9610ac7afa66
--- /dev/null
+++ b/pkgs/development/nim-packages/nimraylib-now/default.nix
@@ -0,0 +1,20 @@
+{ lib, nimPackages, fetchFromGitHub }:
+
+nimPackages.buildNimPackage rec {
+  pname = "nimraylib-now";
+  version = "0.15.0";
+
+  src = fetchFromGitHub {
+    owner = "greenfork";
+    repo = "nimraylib_now";
+    rev = "v${version}";
+    sha256 = "sha256-18YiAzJ46dpD5JN+gH0MWKchZ5YLPBNcm9eVFnyy2Sw=";
+  };
+
+  meta = with lib; {
+    homepage = "https://github.com/greenfork/nimraylib_now";
+    description = "The Ultimate Raylib gaming library wrapper for Nim";
+    license = licenses.mit;
+    maintainers = with maintainers; [ annaaurora ];
+  };
+}
diff --git a/pkgs/development/python-modules/adb-enhanced/default.nix b/pkgs/development/python-modules/adb-enhanced/default.nix
index 7f6c2d109801..4d7c6203a84e 100644
--- a/pkgs/development/python-modules/adb-enhanced/default.nix
+++ b/pkgs/development/python-modules/adb-enhanced/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "adb-enhanced";
-  version = "2.5.16";
+  version = "2.5.18";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "ashishb";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-+CMXKg3LLxEXGcFQ9zSqy/1HPZS9MsQ1fZxClJ0Vrnw=";
+    hash = "sha256-xsl8AentI4Tqo2mHWFRi6myyb0/MemATJz9erKN9eKQ=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/aiolifx-effects/default.nix b/pkgs/development/python-modules/aiolifx-effects/default.nix
index 0b260340ec64..282a87c43d8d 100644
--- a/pkgs/development/python-modules/aiolifx-effects/default.nix
+++ b/pkgs/development/python-modules/aiolifx-effects/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "aiolifx-effects";
-  version = "0.3.1";
+  version = "0.3.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -15,7 +15,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     inherit version;
     pname = "aiolifx_effects";
-    hash = "sha256-yh0Nv1r5a5l6unn9qnLjSqct/ZzUuPT6cNebVDMMfUw=";
+    hash = "sha256-Mhxs5PNr2W9ych56WYUZTEGck4HVTQfkil3S3zHv6Qc=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/aiolifx-themes/default.nix b/pkgs/development/python-modules/aiolifx-themes/default.nix
index cf3b8847c62c..36b7484cd621 100644
--- a/pkgs/development/python-modules/aiolifx-themes/default.nix
+++ b/pkgs/development/python-modules/aiolifx-themes/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "aiolifx-themes";
-  version = "0.4.2";
+  version = "0.4.5";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "Djelibeybi";
     repo = "aiolifx-themes";
     rev = "refs/tags/v${version}";
-    hash = "sha256-6bbhjmtgGEifYmtgXrnsCF36oU+jJDmHMPPEO5a7AKQ=";
+    hash = "sha256-df3FQdOa3C8eQfgFi+sh7+/GBpE+4B5gOI+3XDQLHEs=";
   };
 
   prePatch = ''
diff --git a/pkgs/development/python-modules/google-cloud-firestore/default.nix b/pkgs/development/python-modules/google-cloud-firestore/default.nix
index a827b841a5ef..026328da6189 100644
--- a/pkgs/development/python-modules/google-cloud-firestore/default.nix
+++ b/pkgs/development/python-modules/google-cloud-firestore/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-firestore";
-  version = "2.10.0";
+  version = "2.10.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-iCwYBZhWfheyYTOm2IQIXr3OXyoi4FWNykzzbWV+5wY=";
+    hash = "sha256-JrM4asHN40vTuigojvT2lqI2iDuC8je9Yr8i10pU1aU=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-iam/default.nix b/pkgs/development/python-modules/google-cloud-iam/default.nix
index aff4744fb01b..26247453cc7a 100644
--- a/pkgs/development/python-modules/google-cloud-iam/default.nix
+++ b/pkgs/development/python-modules/google-cloud-iam/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-iam";
-  version = "2.11.2";
+  version = "2.12.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-viN/BiIYmE83B1JMh5THgj2/HLGOeIotDVLdTODZBAg=";
+    hash = "sha256-lfT4lgW4n3k5Fs2Owng8JoHGYDwjoKTzaKhEf35O+VA=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-monitoring/default.nix b/pkgs/development/python-modules/google-cloud-monitoring/default.nix
index 2dabd36a2e93..ca2b8959d58f 100644
--- a/pkgs/development/python-modules/google-cloud-monitoring/default.nix
+++ b/pkgs/development/python-modules/google-cloud-monitoring/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-monitoring";
-  version = "2.14.1";
+  version = "2.14.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-FKg2nEmc5mYKSWJwV0wG09kK4ZQl+Tan+9BqbwJ/8eA=";
+    hash = "sha256-5v2hMJeeLo11mrcNZCe1lISBlIyW9f1KQjcLqWoRlZs=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-secret-manager/default.nix b/pkgs/development/python-modules/google-cloud-secret-manager/default.nix
index 71d99448085d..772ca69dda65 100644
--- a/pkgs/development/python-modules/google-cloud-secret-manager/default.nix
+++ b/pkgs/development/python-modules/google-cloud-secret-manager/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-secret-manager";
-  version = "2.16.0";
+  version = "2.16.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-O1K5qd82o+PnzWZ40GC+0PSgWzZvp5hl7ImFxRgx5Ww=";
+    hash = "sha256-FJ0Rzpvn6oHUrDVE0/zUxxap7bLLd12cB1IxVwsHn7s=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-securitycenter/default.nix b/pkgs/development/python-modules/google-cloud-securitycenter/default.nix
index 31d3cf1fd3b4..8159a64fffea 100644
--- a/pkgs/development/python-modules/google-cloud-securitycenter/default.nix
+++ b/pkgs/development/python-modules/google-cloud-securitycenter/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-securitycenter";
-  version = "1.19.0";
+  version = "1.19.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-97KZK9O/+Ul2hnXh1s2HeoQQd4CFcQjJ9HC6fP2ZEgc=";
+    hash = "sha256-xI9CFp3esSxOsOsO5mVWUkMROpuX2QjzKVhKCBUpDhc=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-speech/default.nix b/pkgs/development/python-modules/google-cloud-speech/default.nix
index 7116db6ca0c1..b0502854d485 100644
--- a/pkgs/development/python-modules/google-cloud-speech/default.nix
+++ b/pkgs/development/python-modules/google-cloud-speech/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-speech";
-  version = "2.18.0";
+  version = "2.19.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-MCFfkPtTc7TdN+WF4tcnHq+Kun5vQDhdSSsW97/cDzA=";
+    hash = "sha256-+k5exHjJt9bSdbeVWgTWx+IaYlJ55JrTV0wofoVWCpU=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-storage/default.nix b/pkgs/development/python-modules/google-cloud-storage/default.nix
index abd321fd8107..5c857047c8f2 100644
--- a/pkgs/development/python-modules/google-cloud-storage/default.nix
+++ b/pkgs/development/python-modules/google-cloud-storage/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-storage";
-  version = "2.7.0";
+  version = "2.8.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-GsLVjS1pPLE0HrxIZZo1J753jZ4tiYlpeidGAlko/xc=";
+    hash = "sha256-Q4jaH/W9ptcp8m28rxv6AgoqUqe5HwqBI+29pRZggCw=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-websecurityscanner/default.nix b/pkgs/development/python-modules/google-cloud-websecurityscanner/default.nix
index 69645f43d4c5..771cbcf01969 100644
--- a/pkgs/development/python-modules/google-cloud-websecurityscanner/default.nix
+++ b/pkgs/development/python-modules/google-cloud-websecurityscanner/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-websecurityscanner";
-  version = "1.12.0";
+  version = "1.12.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-od8eEY0hYr3fdImD5BTb3+EJR5IsrNm9g6m/IWscmz4=";
+    hash = "sha256-CCfxIwACFxMuFjxJG7v5e/WXvN0V4QysPYD2NtkKnEU=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/mkdocs-simple-hooks/default.nix b/pkgs/development/python-modules/mkdocs-simple-hooks/default.nix
new file mode 100644
index 000000000000..c403baebbae3
--- /dev/null
+++ b/pkgs/development/python-modules/mkdocs-simple-hooks/default.nix
@@ -0,0 +1,42 @@
+{ lib
+, buildPythonPackage
+, isPy3k
+, fetchFromGitHub
+, mkdocs
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "mkdocs-simple-hooks";
+  version = "0.1.5";
+
+  disabled = !isPy3k;
+
+  src = fetchFromGitHub {
+    owner = "aklajnert";
+    repo = "mkdocs-simple-hooks";
+    rev = "v${version}";
+    hash = "sha256-N6xZjCREjJlhR6f8m65WJswUQv/TTdTbk670+C46UWQ=";
+  };
+
+  propagatedBuildInputs = [
+    mkdocs
+  ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pytestFlagsArray = [ "tests.py" ];
+
+  # disable failing tests
+  disabledTests = [
+    "test_no_hooks_defined"
+    "test_no_attribute"
+  ];
+
+  meta = with lib; {
+    description = "Define your own hooks for mkdocs, without having to create a new package.";
+    homepage = "https://github.com/aklajnert/mkdocs-simple-hooks";
+    license = licenses.mit;
+    maintainers = with maintainers; [ arjan-s ];
+  };
+}
diff --git a/pkgs/development/python-modules/mypy-boto3-builder/default.nix b/pkgs/development/python-modules/mypy-boto3-builder/default.nix
index ba22cca45fb5..5920c2985c4f 100644
--- a/pkgs/development/python-modules/mypy-boto3-builder/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3-builder/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "mypy-boto3-builder";
-  version = "7.14.4";
+  version = "7.14.5";
   format = "pyproject";
 
   disabled = pythonOlder "3.10";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "youtype";
     repo = "mypy_boto3_builder";
     rev = "refs/tags/${version}";
-    hash = "sha256-aEmJ4jyIsgAL7CUZek/YZSPrHqW7i+S1bbZv8jH9FGc=";
+    hash = "sha256-T8BIfopprCfcOpv92soTD3S4eYoAdT70pSMSHlFbBuE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pycddl/default.nix b/pkgs/development/python-modules/pycddl/default.nix
new file mode 100644
index 000000000000..389717400670
--- /dev/null
+++ b/pkgs/development/python-modules/pycddl/default.nix
@@ -0,0 +1,53 @@
+{ lib
+, pythonOlder
+, fetchPypi
+, buildPythonPackage
+, rustPlatform
+, pytestCheckHook
+, psutil
+, cbor2
+}:
+
+buildPythonPackage rec {
+  pname = "pycddl";
+  version = "0.4.0";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-w0CGbPeiXyS74HqZXyiXhvaAMUaIj5onwjl9gWKAjqY=";
+  };
+
+  nativeBuildInputs = with rustPlatform; [ maturinBuildHook cargoSetupHook ];
+
+  postPatch = ''
+    # We don't place pytest-benchmark in the closure because we have no
+    # intention of running the benchmarks.  Make sure pip doesn't fail as a
+    # result of it being missing by removing it from the requirements list.
+    sed -i -e /pytest-benchmark/d requirements-dev.txt
+
+    # Now that we've gotten rid of pytest-benchmark we need to get rid of the
+    # benchmarks too, otherwise they fail at import time due to the missing
+    # dependency.
+    rm tests/test_benchmarks.py
+  '';
+
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit src;
+    name = "${pname}-${version}";
+    hash = "sha256-g96eeaqN9taPED4u+UKUcoitf5aTGFrW2/TOHoHEVHs=";
+  };
+
+  nativeCheckInputs = [ pytestCheckHook psutil cbor2 ];
+  pythonImportsCheck = [ "pycddl" ];
+
+  meta = with lib; {
+    description = "Python bindings for the Rust cddl crate";
+    homepage = "https://gitlab.com/tahoe-lafs/pycddl";
+    changelog = "https://gitlab.com/tahoe-lafs/pycddl/-/tree/v${version}#release-notes";
+    license = licenses.mit;
+    maintainers = [ maintainers.exarkun ];
+  };
+}
diff --git a/pkgs/development/python-modules/scikit-learn-extra/default.nix b/pkgs/development/python-modules/scikit-learn-extra/default.nix
index c14c98489a40..23718fde945a 100644
--- a/pkgs/development/python-modules/scikit-learn-extra/default.nix
+++ b/pkgs/development/python-modules/scikit-learn-extra/default.nix
@@ -11,13 +11,13 @@
 
 buildPythonPackage rec {
   pname = "scikit-learn-extra";
-  version = "0.2.0";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "scikit-learn-contrib";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "09v7a9jdycdrlqq349m1gbn8ppzv1bl5g3l72k6ywsx2xb01qw13";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-dHOwo6NIuhcvIehpuJQ621JEg5O3mnXycAhpTZKaxns=";
   };
 
   nativeBuildInputs = [ numpy cython ];
diff --git a/pkgs/development/python-modules/types-tabulate/default.nix b/pkgs/development/python-modules/types-tabulate/default.nix
index f4e129b15fa7..2be7a114282f 100644
--- a/pkgs/development/python-modules/types-tabulate/default.nix
+++ b/pkgs/development/python-modules/types-tabulate/default.nix
@@ -5,11 +5,11 @@
 
 buildPythonPackage rec {
   pname = "types-tabulate";
-  version = "0.9.0.1";
+  version = "0.9.0.2";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-5IYpLCefGSR4Zb2r6AJBl0Cg50tTRE5/eoAJ4IEp2l0=";
+    hash = "sha256-HdQyKjoUbpBzFpx0J4uPFKWOuZBcqdsNJYjfQI8nysk=";
   };
 
   # Module doesn't have tests
diff --git a/pkgs/development/tools/apksigner/default.nix b/pkgs/development/tools/apksigner/default.nix
index c2bbf65526c1..95656dd20303 100644
--- a/pkgs/development/tools/apksigner/default.nix
+++ b/pkgs/development/tools/apksigner/default.nix
@@ -2,11 +2,13 @@
 , stdenv
 , fetchgit
 , openjdk17_headless
-, gradle
+, gradle_7
 , perl
 , makeWrapper
 }:
-
+let
+  gradle = gradle_7;
+in
 stdenv.mkDerivation rec {
   pname = "apksigner";
   version = "33.0.1";
diff --git a/pkgs/development/tools/build-managers/gradle/default.nix b/pkgs/development/tools/build-managers/gradle/default.nix
index 9af80afd1111..5c81ba4b426b 100644
--- a/pkgs/development/tools/build-managers/gradle/default.nix
+++ b/pkgs/development/tools/build-managers/gradle/default.nix
@@ -126,6 +126,13 @@ rec {
   # and respect the compatibility matrix at
   # https://docs.gradle.org/current/userguide/compatibility.html
 
+  gradle_8 = gen {
+    version = "8.0.1";
+    nativeVersion = "0.22-milestone-24";
+    sha256 = "02g9i1mrpdydj8d6395cv6a4ny9fw3z7sjzr7n6l6a9zx65masqv";
+    defaultJava = jdk17;
+  };
+
   gradle_7 = gen {
     version = "7.6.1";
     nativeVersion = "0.22-milestone-24";
diff --git a/pkgs/development/tools/fastddsgen/default.nix b/pkgs/development/tools/fastddsgen/default.nix
index cbe00b1ad51f..d181c2fb8e05 100644
--- a/pkgs/development/tools/fastddsgen/default.nix
+++ b/pkgs/development/tools/fastddsgen/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, runtimeShell, writeText, fetchFromGitHub, gradle, openjdk17, git, perl, cmake }:
+{ lib, stdenv, runtimeShell, writeText, fetchFromGitHub, gradle_7, openjdk17, git, perl, cmake }:
 let
   pname = "fastddsgen";
   version = "2.3.0";
@@ -11,6 +11,8 @@ let
     hash = "sha256-lxMv1hXjHFslJts63/FJPjj0mAKTluY/pNTvf15Oo9o=";
   };
 
+  gradle = gradle_7;
+
   # fake build to pre-download deps into fixed-output derivation
   deps = stdenv.mkDerivation {
     pname = "${pname}-deps";
diff --git a/pkgs/development/tools/gammaray/default.nix b/pkgs/development/tools/gammaray/default.nix
index 22c4872f52c4..aa334bfd2e42 100644
--- a/pkgs/development/tools/gammaray/default.nix
+++ b/pkgs/development/tools/gammaray/default.nix
@@ -10,7 +10,7 @@
 }:
 
 stdenv.mkDerivation rec {
-  pname = "GammaRay";
+  pname = "gammaray";
   version = "2.11.3";
 
   src = fetchFromGitHub {
diff --git a/pkgs/development/tools/go-swag/default.nix b/pkgs/development/tools/go-swag/default.nix
index 0b310a049918..0fc2781e5fe0 100644
--- a/pkgs/development/tools/go-swag/default.nix
+++ b/pkgs/development/tools/go-swag/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "go-swag";
-  version = "1.8.11";
+  version = "1.8.12";
 
   src = fetchFromGitHub {
     owner = "swaggo";
     repo = "swag";
     rev = "v${version}";
-    sha256 = "sha256-clWYiDJN9fJLLkMfURPKb377+YX7DZzwXWZ/YDW4fLU=";
+    sha256 = "sha256-2rnaPN4C4pn9Whk5X2z1VVxm679EUpQdumJZx5uulr4=";
   };
 
-  vendorHash = "sha256-0fubBlipY4eogg68JHZVO+fOAQMRKOqhk8z0qNLvDjM=";
+  vendorHash = "sha256-yQPmiK1CQNn3sr482OEkdRLK6YP8CvPMA/nPGdVJbMc=";
 
   subPackages = [ "cmd/swag" ];
 
diff --git a/pkgs/development/tools/kube-linter/default.nix b/pkgs/development/tools/kube-linter/default.nix
index 6261cdc1b501..2b325668f9ff 100644
--- a/pkgs/development/tools/kube-linter/default.nix
+++ b/pkgs/development/tools/kube-linter/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "kube-linter";
-  version = "0.6.0";
+  version = "0.6.1";
 
   src = fetchFromGitHub {
     owner = "stackrox";
     repo = pname;
-    rev = version;
-    sha256 = "sha256-/iwNyThgdXAXu1ulf68+X7nA9wE9jEqN7F5wuT5GMwk=";
+    rev = "v${version}";
+    sha256 = "sha256-86qLCQH85GSP194nH6lUBvEfuCFs6671dne2zYDwoGc=";
   };
 
-  vendorHash = "sha256-jWXR7tHYT15h7QSxinYyPaBs5utUmdeWWm+GPpfwiA4=";
+  vendorHash = "sha256-yPB2t5Sj14uA3QU6OulwQ03LLBZzCfsilBMk1EqAv08=";
 
   ldflags = [
     "-s" "-w" "-X golang.stackrox.io/kube-linter/internal/version.version=${version}"
@@ -34,7 +34,7 @@ buildGoModule rec {
   meta = with lib; {
     description = "A static analysis tool that checks Kubernetes YAML files and Helm charts";
     homepage = "https://kubelinter.io";
-    changelog   = "https://github.com/stackrox/kube-linter/releases/tag/${version}";
+    changelog   = "https://github.com/stackrox/kube-linter/releases/tag/v${version}";
     license = licenses.asl20;
     maintainers = with maintainers; [ mtesseract stehessel ];
     platforms = platforms.all;
diff --git a/pkgs/development/tools/misc/jcli/default.nix b/pkgs/development/tools/misc/jcli/default.nix
new file mode 100644
index 000000000000..5973ffd5534b
--- /dev/null
+++ b/pkgs/development/tools/misc/jcli/default.nix
@@ -0,0 +1,28 @@
+{ lib, buildGoModule, fetchFromGitHub, fetchpatch }:
+
+buildGoModule rec {
+  pname = "jcli";
+  version = "0.0.41";
+
+  src = fetchFromGitHub {
+    owner = "jenkins-zh";
+    repo = "jenkins-cli";
+    rev = "v${version}";
+    hash = "sha256-oZtbjfquCYMMYgKe7sclRQDXnkNwAEY/GvwenGBnVk4=";
+  };
+
+  vendorHash = "sha256-bmPnxFvdKU5zuMsCDboSOxP5f7NnMRwS/gN0sW7eTRA=";
+
+  doCheck = false;
+
+  postInstall = ''
+    mv $out/bin/{jenkins-cli,jcli}
+  '';
+
+  meta = with lib; {
+    description = "Jenkins CLI allows you to manage your Jenkins in an easy way";
+    homepage = "https://jcli.jenkins-zh.cn/";
+    license = licenses.mit;
+    maintainers = with maintainers; [ sikmir ];
+  };
+}
diff --git a/pkgs/development/tools/omnisharp-roslyn/default.nix b/pkgs/development/tools/omnisharp-roslyn/default.nix
index 38a226c74f2f..60d108e17ef1 100644
--- a/pkgs/development/tools/omnisharp-roslyn/default.nix
+++ b/pkgs/development/tools/omnisharp-roslyn/default.nix
@@ -1,9 +1,7 @@
 { buildDotnetModule
 , dotnetCorePackages
 , fetchFromGitHub
-, icu
 , lib
-, patchelf
 , stdenv
 , runCommand
 , expect
@@ -25,9 +23,7 @@ let finalPackage = buildDotnetModule rec {
   projectFile = "src/OmniSharp.Stdio.Driver/OmniSharp.Stdio.Driver.csproj";
   nugetDeps = ./deps.nix;
 
-  nativeBuildInputs = [
-    patchelf
-  ];
+  useAppHost = false;
 
   dotnetInstallFlags = [ "--framework net6.0" ];
   dotnetBuildFlags = [ "--framework net6.0" "--no-self-contained" ];
@@ -53,43 +49,27 @@ let finalPackage = buildDotnetModule rec {
   '';
 
   dontDotnetFixup = true; # we'll fix it ourselves
-  postFixup = lib.optionalString stdenv.isLinux ''
-    # Emulate what .NET 7 does to its binaries while a fix doesn't land in buildDotnetModule
-    patchelf --set-interpreter $(patchelf --print-interpreter ${sdk_6_0}/dotnet) \
-      --set-rpath $(patchelf --print-rpath ${sdk_6_0}/dotnet) \
-      $out/lib/omnisharp-roslyn/OmniSharp
+  preFixup = ''
+    # We create a wrapper that will run the OmniSharp dll using the `dotnet`
+    # executable from PATH. Doing it this way allows it to run using newer SDK
+    # versions than it was build with, which allows it to properly find those SDK
+    # versions - OmniSharp only finds SDKs with the same version or newer as
+    # itself. We still provide a fallback, in case no `dotnet` is provided in
+    # PATH
+    mkdir -p "$out/bin"
 
-  '' + ''
-    # Now create a wrapper without DOTNET_ROOT
-    # we explicitly don't set DOTNET_ROOT as it should get the one from PATH
-    # as you can use any .NET SDK higher than 6 to run OmniSharp and you most
-    # likely will NOT want the .NET 6 runtime running it (as it'll use that to
-    # detect the SDKs for its own use, so it's better to let it find it in PATH).
-    makeWrapper $out/lib/omnisharp-roslyn/OmniSharp $out/bin/OmniSharp \
-      --prefix LD_LIBRARY_PATH : ${sdk_6_0.icu}/lib \
-      --set-default DOTNET_ROOT ${sdk_6_0}
+    cat << EOF > "$out/bin/OmniSharp"
+    #!${stdenv.shell}
+    export PATH="\''${PATH}:${sdk_6_0}/bin"
+    dotnet "$out/lib/omnisharp-roslyn/OmniSharp.dll" "\$@"
+    EOF
+
+    chmod +x "$out/bin/OmniSharp"
   '';
 
-  passthru.tests = {
-    no-sdk = runCommand "no-sdk" { nativeBuildInputs = [ finalPackage expect ]; meta.timeout = 60; } ''
-      HOME=$TMPDIR
-      expect <<"EOF"
-        spawn OmniSharp
-        expect_before timeout {
-          send_error "timeout!\n"
-          exit 1
-        }
-        expect "\"ERROR\",\"Name\":\"OmniSharp.MSBuild.Discovery.Providers.SdkInstanceProvider\""
-        expect eof
-        catch wait result
-        if { [lindex $result 3] == 0 } {
-          exit 1
-        }
-      EOF
-      touch $out
-    '';
-
-    with-sdk = runCommand "with-sdk" { nativeBuildInputs = [ finalPackage sdk_6_0 expect ]; meta.timeout = 60; } ''
+  passthru.tests = let
+    with-sdk = sdk: runCommand "with-${if sdk ? version then sdk.version else "no"}-sdk"
+      { nativeBuildInputs = [ finalPackage sdk expect ]; meta.timeout = 60; } ''
       HOME=$TMPDIR
       expect <<"EOF"
         spawn OmniSharp
@@ -97,6 +77,7 @@ let finalPackage = buildDotnetModule rec {
           send_error "timeout!\n"
           exit 1
         }
+        expect ".NET Core SDK ${if sdk ? version then sdk.version else sdk_6_0.version}"
         expect "{\"Event\":\"started\","
         send \x03
         expect eof
@@ -105,6 +86,11 @@ let finalPackage = buildDotnetModule rec {
       EOF
       touch $out
     '';
+  in {
+    # Make sure we can run OmniSharp with any supported SDK version, as well as without
+    with-net6-sdk = with-sdk sdk_6_0;
+    with-net7-sdk = with-sdk dotnetCorePackages.sdk_7_0;
+    no-sdk = with-sdk null;
   };
 
   meta = with lib; {
diff --git a/pkgs/development/tools/rust/typeshare/default.nix b/pkgs/development/tools/rust/typeshare/default.nix
index d8c3b80ad6f5..0f10859ae866 100644
--- a/pkgs/development/tools/rust/typeshare/default.nix
+++ b/pkgs/development/tools/rust/typeshare/default.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "typeshare";
-  version = "1.3.0";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "1password";
     repo = "typeshare";
     rev = "v${version}";
-    hash = "sha256-rP5d85/wGNimzOgsNDaX/QHZsGU5HoBAJsrETBKtRF4=";
+    hash = "sha256-TGs7Czq13ghifKUhoz+n9I4UlOrzQosWTwBqBWv572E=";
   };
 
-  cargoHash = "sha256-55DBzItGgUs6TroDeOAJPd7Koy4cyUV8SdqxUhKXwrU=";
+  cargoHash = "sha256-hF+1v9bHioKQixg0C46ligLy/ibU+iI/H85g4wQhne4=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/development/tools/scenic-view/default.nix b/pkgs/development/tools/scenic-view/default.nix
index 63ff945790e0..172fbc80804d 100644
--- a/pkgs/development/tools/scenic-view/default.nix
+++ b/pkgs/development/tools/scenic-view/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, jdk, gradle, makeDesktopItem, copyDesktopItems, perl, writeText, runtimeShell, makeWrapper }:
+{ lib, stdenv, fetchFromGitHub, jdk, gradle_7, makeDesktopItem, copyDesktopItems, perl, writeText, runtimeShell, makeWrapper }:
 let
   pname = "scenic-view";
   version = "11.0.2";
@@ -10,6 +10,8 @@ let
     sha256 = "1idfh9hxqs4fchr6gvhblhvjqk4mpl4rnpi84vn1l3yb700z7dwy";
   };
 
+  gradle = gradle_7;
+
   deps = stdenv.mkDerivation {
     name = "${pname}-deps";
     inherit src;
diff --git a/pkgs/games/snekim/default.nix b/pkgs/games/snekim/default.nix
new file mode 100644
index 000000000000..524f03252250
--- /dev/null
+++ b/pkgs/games/snekim/default.nix
@@ -0,0 +1,34 @@
+{ lib, nimPackages, fetchFromGitea, raylib }:
+
+nimPackages.buildNimPackage rec {
+  pname = "snekim";
+  version = "1.2.0";
+
+  nimBinOnly = true;
+
+  src = fetchFromGitea {
+    domain = "codeberg.org";
+    owner = "annaaurora";
+    repo = "snekim";
+    rev = "v${version}";
+    sha256 = "sha256-Qgvq4CkGvNppYFpITCCifOHtVQYRQJPEK3rTJXQkTvI=";
+  };
+
+  strictDeps = true;
+
+  buildInputs = [ nimPackages.nimraylib-now raylib ];
+
+  nimFlags = [ "-d:nimraylib_now_shared" ];
+
+  postInstall = ''
+    install -D snekim.desktop -t $out/share/applications
+    install -D icons/hicolor/48x48/snekim.svg -t $out/share/icons/hicolor/48x48/apps
+  '';
+
+  meta = with lib; {
+    homepage = "https://codeberg.org/annaaurora/snekim";
+    description = "A simple implementation of the classic snake game";
+    license = licenses.lgpl3Only;
+    maintainers = with maintainers; [ annaaurora ];
+  };
+}
diff --git a/pkgs/misc/urbit/default.nix b/pkgs/misc/urbit/default.nix
index eba9faa6beee..55eba0382a37 100644
--- a/pkgs/misc/urbit/default.nix
+++ b/pkgs/misc/urbit/default.nix
@@ -10,15 +10,15 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "urbit";
-  version = "2.0";
+  version = "2.1";
 
   src = fetchzip {
     url = "https://github.com/urbit/vere/releases/download/vere-v${version}/${platform}.tgz";
     sha256 = {
-      x86_64-linux = "sha256-GqxgbJCLjXcXHT49fJL1IUJmh9oL4Lfokt7HqzshtWw=";
-      aarch64-linux = "sha256-3+S5EnyvTBKxkFbV7fg+qVDFLr25jMeDwb+MuqDJHMg=";
-      x86_64-darwin = "sha256-VO2dnNqbgyPKvZVMC0CG15JAaBelzcnkifmbZMS+38Y=";
-      aarch64-darwin = "sha256-RbpeIA5LYCUkhyLMo3dYvUe7uLyOD4Ey7qCvIg5JQAg=";
+      x86_64-linux = "sha256-i5WofHC0aYldnA+KldeAmZQQo6yeI3yhmLHqPZOvi1c=";
+      aarch64-linux = "sha256-QRarT+BtVPX7yURsqABZXcYyzqMGweIzo/MGpC2HhEo=";
+      x86_64-darwin = "sha256-JuMjYwmcArPEjcUapdkSu9FEFKK4ZfxJxmvRVOJ3w34=";
+      aarch64-darwin = "sha256-5lpBhmdDpNVFHZ7P6TRBoFWFWKvwbJNO6ohiuoKMc6E=";
     }.${stdenv.hostPlatform.system} or (throw "unsupported system ${stdenv.hostPlatform.system}");
   };
 
diff --git a/pkgs/servers/audiobookshelf/default.nix b/pkgs/servers/audiobookshelf/default.nix
new file mode 100644
index 000000000000..fb569fc54bec
--- /dev/null
+++ b/pkgs/servers/audiobookshelf/default.nix
@@ -0,0 +1,62 @@
+{ lib, stdenv, pkgs, fetchFromGitHub, runCommand, buildNpmPackage, nodejs-16_x, tone, ffmpeg-full, util-linux, libwebp }:
+
+let
+  nodejs = nodejs-16_x;
+
+  pname = "audiobookshelf";
+  version = "2.2.15";
+
+  src = fetchFromGitHub {
+    owner = "advplyr";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-BrIXbembbcfSPOPknoY2Vn9I85eHyOQLDCMsFOMORgM=";
+  };
+
+  client = buildNpmPackage {
+    pname = "${pname}-client";
+    inherit version;
+
+    src = runCommand "cp-source" {} ''
+      cp -r ${src}/client $out
+    '';
+
+    NODE_OPTIONS = "--openssl-legacy-provider";
+
+    npmBuildScript = "generate";
+    npmDepsHash = "sha256-eyZdeBsZ5XBoO/4djXZzOOr/h9kDSUULbqgdOZJNNCg=";
+  };
+
+  wrapper = import ./wrapper.nix {
+    inherit stdenv ffmpeg-full tone pname nodejs;
+  };
+
+in buildNpmPackage {
+  inherit pname version src;
+
+  buildInputs = [ util-linux ];
+
+  dontNpmBuild = true;
+  npmInstallFlags = "--only-production";
+  npmDepsHash = "sha256-KbewULna+0mftIcdO5Z4A5rOrheBndpgzjkE1Jytfr4=";
+
+  installPhase = ''
+    mkdir -p $out/opt/client
+    cp -r index.js server package* node_modules $out/opt/
+    cp -r ${client}/lib/node_modules/${pname}-client/dist $out/opt/client/dist
+    mkdir $out/bin
+
+    echo '${wrapper}' > $out/bin/${pname}
+    echo "  exec ${nodejs}/bin/node $out/opt/index.js" >> $out/bin/${pname}
+
+    chmod +x $out/bin/${pname}
+  '';
+
+  meta = with lib; {
+    homepage = "https://www.audiobookshelf.org/";
+    description = "Self-hosted audiobook and podcast server";
+    license = licenses.gpl3;
+    maintainers = [ maintainers.jvanbruegge ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/servers/audiobookshelf/wrapper.nix b/pkgs/servers/audiobookshelf/wrapper.nix
new file mode 100644
index 000000000000..cbe7e3ebd971
--- /dev/null
+++ b/pkgs/servers/audiobookshelf/wrapper.nix
@@ -0,0 +1,61 @@
+{ stdenv, ffmpeg-full, tone, pname, nodejs }: ''
+    #!${stdenv.shell}
+
+    port=8000
+    host=0.0.0.0
+    config=$(pwd)/config
+    metadata=$(pwd)/metadata
+
+    LONGOPTS=host:,port:,config:,metadata:,help
+    args=$(getopt -l "$LONGOPTS" -o h -- "$@")
+
+    eval set -- "$args"
+
+    while [ $# -ge 1 ]; do
+      case "$1" in
+        --)
+          # No more options left.
+          shift
+          break
+          ;;
+        --host)
+          host="$2"
+          shift
+          ;;
+        --port)
+          port="$2"
+          shift
+          ;;
+        --config)
+          if [[ "''${2:0:1}" = "/" ]]; then
+            config="$2"
+          else
+            config="$(pwd)/$2"
+          fi
+          shift
+          ;;
+        --metadata)
+          if [[ "''${2:0:1}" = "/" ]]; then
+            metadata="$2"
+          else
+            metadata="$(pwd)/$2"
+          fi
+          shift
+          ;;
+        --help|-h)
+          echo "Usage: audiobookshelf [--host <host>] [--port <port>] [--metadata <dir>] [--config <dir>]"
+          shift
+          ;;
+      esac
+      shift
+    done
+
+    NODE_ENV=production \
+      SOURCE=nixpkgs \
+      FFMPEG_PATH=${ffmpeg-full}/bin/ffmpeg \
+      FFPROBE_PATH=${ffmpeg-full}/bin/ffprobe \
+      TONE_PATH=${tone}/bin/tone \
+      CONFIG_PATH="$config" \
+      METADATA_PATH="$metadata" \
+      PORT="$port" \
+      HOST="$host" \''
diff --git a/pkgs/servers/consul/default.nix b/pkgs/servers/consul/default.nix
index d41e5f0df6e6..ee8145dca40c 100644
--- a/pkgs/servers/consul/default.nix
+++ b/pkgs/servers/consul/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "consul";
-  version = "1.15.1";
+  version = "1.15.2";
   rev = "v${version}";
 
   # Note: Currently only release tags are supported, because they have the Consul UI
@@ -17,7 +17,7 @@ buildGoModule rec {
     owner = "hashicorp";
     repo = pname;
     inherit rev;
-    sha256 = "sha256-U7/et05WOBP7TT8iSXD447dBzRDzrmoeOYFofp/Cwh0=";
+    sha256 = "sha256-8C06arK7QnrT5qQZWBjamOOlejy69pxRHXKoncfMKAc=";
   };
 
   passthru.tests.consul = nixosTests.consul;
@@ -26,7 +26,7 @@ buildGoModule rec {
   # has a split module structure in one repo
   subPackages = ["." "connect/certgen"];
 
-  vendorHash = "sha256-6lYIwOpQjpw7cmeEhDtTs5FzagcAagD+NbfHCO9D/6M=";
+  vendorHash = "sha256-Vcl23cWErAycmza1CS9rl+xJ7CBuocMAdSG9AA88SrQ=";
 
   doCheck = false;
 
diff --git a/pkgs/servers/http/nginx/quic.nix b/pkgs/servers/http/nginx/quic.nix
index de5eea45c46d..7af02ceb0e72 100644
--- a/pkgs/servers/http/nginx/quic.nix
+++ b/pkgs/servers/http/nginx/quic.nix
@@ -4,10 +4,12 @@
 } @ args:
 
 callPackage ./generic.nix args {
+  pname = "nginxQuic";
+
   src = fetchhg {
     url = "https://hg.nginx.org/nginx-quic";
-    rev = "3be953161026"; # branch=quic
-    sha256 = "sha256-maWQ0RPI2pe6L8QL7TQ1YJts5ZJHhiTYG9sdwINGMDA=";
+    rev = "0af598651e33"; # branch=quic
+    sha256 = "sha256-rG0jXA+ci7anUxZCBhXZLZKwnTtzzDEAViuoImKpALA=";
   };
 
   preConfigure = ''
@@ -19,5 +21,5 @@ callPackage ./generic.nix args {
     "--with-stream_quic_module"
   ];
 
-  version = "1.23.2-quic";
+  version = "1.23.4";
 }
diff --git a/pkgs/servers/ma1sd/default.nix b/pkgs/servers/ma1sd/default.nix
index 3c8ddc799e81..1725b1ab88e6 100644
--- a/pkgs/servers/ma1sd/default.nix
+++ b/pkgs/servers/ma1sd/default.nix
@@ -4,7 +4,7 @@
 , fetchpatch
 , jre
 , git
-, gradle
+, gradle_7
 , perl
 , makeWrapper
 }:
@@ -20,6 +20,8 @@ let
     hash = "sha256-K3kaujAhWsRQuTMW3SZOnE7Rmu8+tDXaxpLrb45OI4A=";
   };
 
+  gradle = gradle_7;
+
   patches = [
     # https://github.com/ma1uta/ma1sd/pull/122
     (fetchpatch {
diff --git a/pkgs/servers/nosql/surrealdb/default.nix b/pkgs/servers/nosql/surrealdb/default.nix
index f6bca761f23f..356903aabef5 100644
--- a/pkgs/servers/nosql/surrealdb/default.nix
+++ b/pkgs/servers/nosql/surrealdb/default.nix
@@ -9,23 +9,27 @@
 , testers
 , surrealdb
 , SystemConfiguration
+, protobuf
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "surrealdb";
-  version = "1.0.0-beta.8";
+  version = "1.0.0-beta.9";
 
   src = fetchFromGitHub {
     owner = "surrealdb";
     repo = "surrealdb";
     rev = "v${version}";
-    sha256 = "sha256-zFqHwZUpwqvuqmS18bhlpAswD5EycB3pnZwSuN5Q2G4=";
+    sha256 = "sha256-GgRsRGYnaE2TssoXdubEuMEbLjM4woE3vxTxSlufquU=";
   };
 
-  cargoSha256 = "sha256-vaAfOsbIdQXpx7v4onXY1J8ANKCccVRuWxdvX5+f2no=";
+  cargoSha256 = "sha256-eLJ+sxsK45pkgNUYrNuUOAqutwIjvEhGGjsvwGzfVKI=";
 
   LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
 
+  PROTOC = "${protobuf}/bin/protoc";
+  PROTOC_INCLUDE = "${protobuf}/include";
+
   ROCKSDB_INCLUDE_DIR = "${rocksdb}/include";
   ROCKSDB_LIB_DIR = "${rocksdb}/lib";
 
diff --git a/pkgs/tools/misc/clipboard-jh/default.nix b/pkgs/tools/misc/clipboard-jh/default.nix
new file mode 100644
index 000000000000..a22043ae84fa
--- /dev/null
+++ b/pkgs/tools/misc/clipboard-jh/default.nix
@@ -0,0 +1,48 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, libffi
+, pkg-config
+, wayland-protocols
+, wayland
+, xorg
+}:
+
+stdenv.mkDerivation rec {
+  pname = "clipboard-jh";
+  version = "0.3.2";
+
+  src = fetchFromGitHub {
+    owner = "Slackadays";
+    repo = "clipboard";
+    rev = version;
+    sha256 = "sha256-xdogl2WDuQXeLFuBY1u7PSpaoVI9HKScOdxHZ3+whIg=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
+
+  buildInputs = [
+    libffi
+    wayland-protocols
+    wayland
+    xorg.libX11
+  ];
+
+  cmakeFlags = [
+    "-DCMAKE_BUILD_TYPE='MinSizeRel'"
+    "-Wno-dev"
+    "-DINSTALL_PREFIX=${placeholder "out"}"
+  ];
+
+  meta = with lib; {
+    description = "Cut, copy, and paste anything, anywhere, all from the terminal";
+    homepage = "https://github.com/Slackadays/clipboard";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ dit7ya ];
+    mainProgram = "clipboard";
+  };
+}
diff --git a/pkgs/tools/misc/goaccess/default.nix b/pkgs/tools/misc/goaccess/default.nix
index 084afb857c05..78b595fbd192 100644
--- a/pkgs/tools/misc/goaccess/default.nix
+++ b/pkgs/tools/misc/goaccess/default.nix
@@ -10,14 +10,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "1.7.1";
+  version = "1.7.2";
   pname = "goaccess";
 
   src = fetchFromGitHub {
     owner = "allinurl";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-RJQyR6nTvDvR+outbVDYKFC1Tl99O0SZW94e/SbqAO0=";
+    sha256 = "sha256-LYvdxVlGL4dVfhYkeR+TmYSvey0ArJrkC37t5BIIJfE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/package-management/deploy-rs/default.nix b/pkgs/tools/package-management/deploy-rs/default.nix
index 0b85b3d29b26..cf965b1a6915 100644
--- a/pkgs/tools/package-management/deploy-rs/default.nix
+++ b/pkgs/tools/package-management/deploy-rs/default.nix
@@ -6,18 +6,18 @@
 , SystemConfiguration
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage {
   pname = "deploy-rs";
-  version = "unstable-2022-11-18";
+  version = "unstable-2023-01-19";
 
   src = fetchFromGitHub {
     owner = "serokell";
     repo = "deploy-rs";
-    rev = "2a3c5f70eee04a465aa534d8bd4fcc9bb3c4a8ce";
-    hash = "sha256-0w6iD3GSSQbIeSFVDzAAQZB+hDq670ZTms3d9XI+BtM=";
+    rev = "8c9ea9605eed20528bf60fae35a2b613b901fd77";
+    hash = "sha256-QO1xF7stu5ZMDLbHN30LFolMAwY6TVlzYvQoUs1RD68=";
   };
 
-  cargoHash = "sha256-Ki9/mYNLUq74v3u+e3aM139+06CTrvPLJv0O+qHL9dA=";
+  cargoHash = "sha256-UKiG2Muw3cT17TCl0pZQGfzVdN5tajSZ1ULyGRaZ9tQ=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
     CoreServices
diff --git a/pkgs/tools/package-management/pdm/default.nix b/pkgs/tools/package-management/pdm/default.nix
index 53975a024b7a..08bb7fe2d2f3 100644
--- a/pkgs/tools/package-management/pdm/default.nix
+++ b/pkgs/tools/package-management/pdm/default.nix
@@ -7,6 +7,15 @@ let
     # 3. Ansible being unable to upgrade to a later version of resolvelib
     # see here for more details: https://github.com/NixOS/nixpkgs/pull/155380/files#r786255738
     packageOverrides = self: super: {
+      installer = super.installer.overridePythonAttrs (attrs: rec {
+        version = "0.6.0";
+        src = fetchFromGitHub {
+          owner = "pradyunsg";
+          repo = "installer";
+          rev = version;
+          hash = "sha256-IXznSrc/4LopgZDGFSC6cAOCbts+siKpdl5SvN1FFvA=";
+        };
+      });
       resolvelib = super.resolvelib.overridePythonAttrs (attrs: rec {
         version = "0.9.0";
         src = fetchFromGitHub {
diff --git a/pkgs/tools/security/cie-middleware-linux/default.nix b/pkgs/tools/security/cie-middleware-linux/default.nix
index 45a79029d20a..7af3e9240f1e 100644
--- a/pkgs/tools/security/cie-middleware-linux/default.nix
+++ b/pkgs/tools/security/cie-middleware-linux/default.nix
@@ -6,7 +6,7 @@
 , meson
 , ninja
 , pkg-config
-, gradle
+, gradle_7
 , curl
 , cryptopp
 , fontconfig
@@ -29,6 +29,8 @@ let
     sha256 = "sha256-Kyr9OTiY6roJ/wVJS/1aWfrrzDNQbuRTJQqo0akbMUU=";
   };
 
+  gradle = gradle_7;
+
   # Shared libraries needed by the Java application
   libraries = lib.makeLibraryPath [ ghostscript ];
 
diff --git a/pkgs/tools/security/exploitdb/default.nix b/pkgs/tools/security/exploitdb/default.nix
index 7d4adb8d3f82..2ae5262e97dc 100644
--- a/pkgs/tools/security/exploitdb/default.nix
+++ b/pkgs/tools/security/exploitdb/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "exploitdb";
-  version = "2023-03-31";
+  version = "2023-04-01";
 
   src = fetchFromGitLab {
     owner = "exploit-database";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-Xqhmkdl4f29a+ev/Dc7b/GW1PyU8oAc64dibYnhts88=";
+    hash = "sha256-9cH1zJd3r6unnJMnnpLGZZ82FGafRpiBq0rECH//PPc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/security/ghidra/build.nix b/pkgs/tools/security/ghidra/build.nix
index 169d029ef148..4226189f8c69 100644
--- a/pkgs/tools/security/ghidra/build.nix
+++ b/pkgs/tools/security/ghidra/build.nix
@@ -3,7 +3,7 @@
 , fetchurl
 , fetchFromGitHub
 , lib
-, gradle
+, gradle_7
 , perl
 , makeWrapper
 , openjdk17
@@ -28,6 +28,8 @@ let
     sha256 = "sha256-YhjKRlFlF89H05NsTS69SB108rNiiWijvZZY9fR+Ebc=";
   };
 
+  gradle = gradle_7;
+
   desktopItem = makeDesktopItem {
     name = "ghidra";
     exec = "ghidra";
diff --git a/pkgs/tools/security/rekor/default.nix b/pkgs/tools/security/rekor/default.nix
index 6fadf0c8f361..a33b1225fa2d 100644
--- a/pkgs/tools/security/rekor/default.nix
+++ b/pkgs/tools/security/rekor/default.nix
@@ -4,13 +4,13 @@ let
   generic = { pname, packageToBuild, description }:
     buildGoModule rec {
       inherit pname;
-      version = "1.0.1";
+      version = "1.1.0";
 
       src = fetchFromGitHub {
         owner = "sigstore";
         repo = "rekor";
         rev = "v${version}";
-        sha256 = "sha256-WVAIhsbxwwvUyuLQLTcMHx9B5UsJxBvmS9MXYxVNiNs=";
+        hash = "sha256-BTXw0fdmO5mjgwc5HZlUmpuKapHMrrA5BVdhxUDoqsU=";
         # populate values that require us to use git. By doing this in postFetch we
         # can delete .git afterwards and maintain better reproducibility of the src.
         leaveDotGit = true;
@@ -23,7 +23,7 @@ let
         '';
       };
 
-      vendorSha256 = "sha256-RtlSf34l68XzxJB7G/aSjpu3BBtV556sRauWj591fIk=";
+      vendorHash = "sha256-rBijR1xoXck+HoFiUTpkM2m/r/qgjoHcTB7PizN5tgg=";
 
       nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/security/scorecard/default.nix b/pkgs/tools/security/scorecard/default.nix
index b03f440a2d01..b219077c62e8 100644
--- a/pkgs/tools/security/scorecard/default.nix
+++ b/pkgs/tools/security/scorecard/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "scorecard";
-  version = "4.10.2";
+  version = "4.10.5";
 
   src = fetchFromGitHub {
     owner = "ossf";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-GQs+wBq47sn3h8I87p+HErBmLMs8Dzh9xj3xMYDsXm4=";
+    sha256 = "sha256-ysdgdU/Et87NxpdSTZuTtLJOv5uaYGVHDGyCj6kKuUQ=";
     # populate values otherwise taken care of by goreleaser,
     # unfortunately these require us to use git. By doing
     # this in postFetch we can delete .git afterwards and
@@ -22,7 +22,7 @@ buildGoModule rec {
       find "$out" -name .git -print0 | xargs -0 rm -rf
     '';
   };
-  vendorSha256 = "sha256-W213KQu4FuJcT/cJOvS+WMw1fXBcSoZ4yssI06JAIc8=";
+  vendorHash = "sha256-6wIzg9gbH+nAE4sZg+C3NZZbVzbEcovhGwajBZ7ZjdY=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/security/vault/vault-bin.nix b/pkgs/tools/security/vault/vault-bin.nix
index 967c222e36ab..7827393263a5 100644
--- a/pkgs/tools/security/vault/vault-bin.nix
+++ b/pkgs/tools/security/vault/vault-bin.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "vault-bin";
-  version = "1.13.0";
+  version = "1.13.1";
 
   src =
     let
@@ -16,11 +16,11 @@ stdenv.mkDerivation rec {
         aarch64-darwin = "darwin_arm64";
       };
       sha256 = selectSystem {
-        x86_64-linux = "sha256-UIgFgfpqsWsjmyuU3Z/dA282S8gZ2RR2vUuvZngvQQk=";
-        aarch64-linux = "sha256-IEuFgfWmRl5ewrA0GX0Rv/88EbWnuWLag2InZ1oHaiU=";
-        i686-linux = "sha256-hm9SAZOanMckINTVUBQs+bn3X8p3m7gtw9F0gdMKJXA=";
-        x86_64-darwin = "sha256-/tjJFCBgsBvGa6icNIXz8DCmiKjjcoIC9/3dcSK4400=";
-        aarch64-darwin = "sha256-xdwSjDZdrUunhyBqZJMjuaFBI961JgU5mWw6UQr3oj0=";
+        x86_64-linux = "sha256-BTJPXC5MEfNopJv1p0ONduVLrYza+0SfUcmN805JLPo=";
+        aarch64-linux = "sha256-p9TgSqPVgR7Qxu1WEuwawzbBDNznGfPGasZK8/jN7vk=";
+        i686-linux = "sha256-EbHH5Ud1c5YbcQ3qXhWEiaxx4XuslRntOLkxcf8elz8=";
+        x86_64-darwin = "sha256-JiwF8/ZBbFGqhcYP4z5aPya61+2J5HG9vEYKEDAIuC0=";
+        aarch64-darwin = "sha256-BgqqKqrqZiBSQwkMpWndiRhRq6+rR3e1IcPik5ZxCg4=";
       };
     in
     fetchzip {
diff --git a/pkgs/tools/system/rsyslog/default.nix b/pkgs/tools/system/rsyslog/default.nix
index 859f66990c56..7440047797a9 100644
--- a/pkgs/tools/system/rsyslog/default.nix
+++ b/pkgs/tools/system/rsyslog/default.nix
@@ -62,11 +62,11 @@
 
 stdenv.mkDerivation rec {
   pname = "rsyslog";
-  version = "8.2212.0";
+  version = "8.2302.0";
 
   src = fetchurl {
     url = "https://www.rsyslog.com/files/download/rsyslog/${pname}-${version}.tar.gz";
-    hash = "sha256-U7Wahy49xzhM3BSavpdEkWd29wV9kF899nItLrGwTzU=";
+    hash = "sha256-JUFfhbZiYVzjyDB31TdYAp6HQ8tZKQRL/TVk49Ymo7k=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/text/difftastic/Cargo.lock b/pkgs/tools/text/difftastic/Cargo.lock
index 9a1cd8b7af75..4b5db36d6f64 100644
--- a/pkgs/tools/text/difftastic/Cargo.lock
+++ b/pkgs/tools/text/difftastic/Cargo.lock
@@ -232,7 +232,7 @@ checksum = "6184e33543162437515c2e2b48714794e37845ec9851711914eec9d308f6ebe8"
 
 [[package]]
 name = "difftastic"
-version = "0.45.0"
+version = "0.46.0"
 dependencies = [
  "assert_cmd",
  "bumpalo",
diff --git a/pkgs/tools/text/difftastic/default.nix b/pkgs/tools/text/difftastic/default.nix
index b0f88ce32bd3..9af09d4ada87 100644
--- a/pkgs/tools/text/difftastic/default.nix
+++ b/pkgs/tools/text/difftastic/default.nix
@@ -1,44 +1,30 @@
 { lib
+, fetchpatch
 , rustPlatform
 , fetchFromGitHub
-, fetchpatch
 , testers
 , difftastic
 }:
 
+let
+  mimallocPatch = fetchpatch {
+    name = "fix-build-on-older-macos-releases.patch";
+    url = "https://github.com/microsoft/mimalloc/commit/40e0507a5959ee218f308d33aec212c3ebeef3bb.patch";
+    sha256 = "sha256-DK0LqsVXXiEVQSQCxZ5jyZMg0UJJx9a/WxzCroYSHZc=";
+  };
+in
+
 rustPlatform.buildRustPackage rec {
   pname = "difftastic";
-  version = "0.45.0";
+  version = "0.46.0";
 
   src = fetchFromGitHub {
     owner = "wilfred";
     repo = pname;
     rev = version;
-    sha256 = "sha256-AJwOft5hZoeraDDjwUBsdXn3V+4p8jOGSCYFCEOkWJA=";
+    sha256 = "sha256-uXSmEJUpcw/PQ5I9nR1b6N1fcOdCSCM4KF0XnGNJkME=";
   };
 
-  depsExtraArgs = {
-    postBuild = let
-      mimallocPatch = fetchpatch {
-        name = "mimalloc-older-macos-fixes.patch";
-        url = "https://github.com/microsoft/mimalloc/commit/40e0507a5959ee218f308d33aec212c3ebeef3bb.patch";
-        stripLen = 1;
-        extraPrefix = "libmimalloc-sys/c_src/mimalloc/";
-        sha256 = "1cqgay6ayzxsj8v1dy8405kwd8av34m4bjc84iyg9r52amlijbg4";
-      };
-    in ''
-      pushd $name
-      patch -p1 < ${mimallocPatch}
-      substituteInPlace libmimalloc-sys/.cargo-checksum.json \
-        --replace \
-          '6a2e9f0db0d3de160f9f15ddc8a870dbc42bba724f19f1e69b8c4952cb36821a' \
-          '201ab8874d9ba863406e084888e492b785a7edae00a222f395c079028d21a89a' \
-        --replace \
-          'a87a27e8432a63e5de25703ff5025588afd458e3a573e51b3c3dee2281bff0d4' \
-          'ab98a2da81d2145003a9cba7b7025efbd2c7b37c7a23c058c150705a3ec39298'
-      popd
-    '';
-  };
   cargoLock = {
     lockFile = ./Cargo.lock;
     outputHashes = {
@@ -46,6 +32,11 @@ rustPlatform.buildRustPackage rec {
     };
   };
 
+  postPatch = ''
+    patch -d $cargoDepsCopy/libmimalloc-sys-0.1.24/c_src/mimalloc \
+      -p1 < ${mimallocPatch}
+  '';
+
   passthru.tests.version = testers.testVersion { package = difftastic; };
 
   meta = with lib; {
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 0899aca5f57c..00aaf21bca81 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -316,6 +316,8 @@ with pkgs;
 
   banana-accounting = callPackage ../applications/office/banana-accounting { };
 
+  beebeep = libsForQt5.callPackage ../applications/office/beebeep {};
+
   bakelite = callPackage ../tools/backup/bakelite { };
 
   benthos = callPackage ../development/tools/benthos { };
@@ -1431,6 +1433,8 @@ with pkgs;
 
   audible-cli = callPackage ../tools/misc/audible-cli { };
 
+  audiobookshelf = callPackage ../servers/audiobookshelf { };
+
   auditwheel = callPackage ../tools/package-management/auditwheel { };
 
   amidst = callPackage ../tools/games/minecraft/amidst { };
@@ -2296,6 +2300,8 @@ with pkgs;
 
   simplenes = callPackage ../applications/emulators/simplenes { };
 
+  snekim = callPackage ../games/snekim { };
+
   snes9x = callPackage ../applications/emulators/snes9x { };
 
   snes9x-gtk = callPackage ../applications/emulators/snes9x {
@@ -8724,6 +8730,8 @@ with pkgs;
 
   jc = with python3Packages; toPythonApplication jc;
 
+  jcli = callPackage ../development/tools/misc/jcli { };
+
   jd-cli = callPackage ../tools/security/jd-cli { };
 
   jd-diff-patch = callPackage ../development/tools/jd-diff-patch { };
@@ -13816,6 +13824,8 @@ with pkgs;
 
   clipnotify = callPackage ../tools/misc/clipnotify { };
 
+  clipboard-jh = callPackage ../tools/misc/clipboard-jh { };
+
   clipbuzz = callPackage ../tools/misc/clipbuzz { };
 
   xclip = callPackage ../tools/misc/xclip { };
@@ -18182,7 +18192,8 @@ with pkgs;
   gradleGen = gradle-packages.gen;
   gradle_6 = callPackage gradle-packages.gradle_6 { };
   gradle_7 = callPackage gradle-packages.gradle_7 { };
-  gradle = gradle_7;
+  gradle_8 = callPackage gradle-packages.gradle_8 { };
+  gradle = gradle_8;
 
   grcov = callPackage ../development/tools/misc/grcov { };
 
@@ -32020,6 +32031,8 @@ with pkgs;
 
   rofi-vpn = callPackage ../applications/networking/rofi-vpn { };
 
+  seamly2d = libsForQt5.callPackage ../applications/graphics/seamly2d { };
+
   ympd = callPackage ../applications/audio/ympd { };
 
   # a somewhat more maintained fork of ympd
@@ -32656,6 +32669,8 @@ with pkgs;
   palemoon = callPackage ../applications/networking/browsers/palemoon { };
   palemoon-bin = callPackage ../applications/networking/browsers/palemoon/bin.nix { };
 
+  paleta = callPackage ../applications/graphics/paleta { };
+
   pamix = callPackage ../applications/audio/pamix { };
 
   pamixer = callPackage ../applications/audio/pamixer { };
@@ -33973,6 +33988,8 @@ with pkgs;
 
   tortoisehg = callPackage ../applications/version-management/tortoisehg { };
 
+  tone = callPackage ../applications/audio/tone { };
+
   tonelib-gfx = callPackage ../applications/audio/tonelib-gfx { };
 
   tonelib-jam = callPackage ../applications/audio/tonelib-jam { };
@@ -39376,6 +39393,8 @@ with pkgs;
 
   golden-cheetah = libsForQt5.callPackage ../applications/misc/golden-cheetah { };
 
+  golden-cheetah-bin = callPackage ../applications/misc/golden-cheetah-bin {};
+
   linkchecker = callPackage ../tools/networking/linkchecker { };
 
   tomb = callPackage ../os-specific/linux/tomb { };
diff --git a/pkgs/top-level/nim-packages.nix b/pkgs/top-level/nim-packages.nix
index 0b7eb960b7a5..9d20a473dc6a 100644
--- a/pkgs/top-level/nim-packages.nix
+++ b/pkgs/top-level/nim-packages.nix
@@ -102,6 +102,8 @@ lib.makeScope newScope (self:
     snappy =
       callPackage ../development/nim-packages/snappy { inherit (pkgs) snappy; };
 
+    nimraylib-now = callPackage ../development/nim-packages/nimraylib-now { };
+
     spry = callPackage ../development/nim-packages/spry { };
 
     spryvm = callPackage ../development/nim-packages/spryvm { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 8e060d4daadd..ce6002f37ef1 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -6081,6 +6081,7 @@ self: super: with self; {
   mkdocs-material-extensions = callPackage ../development/python-modules/mkdocs-material/mkdocs-material-extensions.nix { };
   mkdocs-minify = callPackage ../development/python-modules/mkdocs-minify { };
   mkdocs-redirects = callPackage ../development/python-modules/mkdocs-redirects { };
+  mkdocs-simple-hooks = callPackage ../development/python-modules/mkdocs-simple-hooks { };
   mkdocs-swagger-ui-tag = callPackage ../development/python-modules/mkdocs-swagger-ui-tag { };
 
   mkdocstrings = callPackage ../development/python-modules/mkdocstrings { };
@@ -7996,6 +7997,8 @@ self: super: with self; {
 
   pycategories = callPackage ../development/python-modules/pycategories { };
 
+  pycddl = callPackage ../development/python-modules/pycddl { };
+
   pycdio = callPackage ../development/python-modules/pycdio { };
 
   pycec = callPackage ../development/python-modules/pycec { };