diff --git a/.github/workflows/check-maintainers-sorted.yaml b/.github/workflows/check-maintainers-sorted.yaml
index 73987f9b9168..2c2473250d82 100644
--- a/.github/workflows/check-maintainers-sorted.yaml
+++ b/.github/workflows/check-maintainers-sorted.yaml
@@ -1,7 +1,7 @@
 name: "Check that maintainer list is sorted"
 
 on:
-  pull_request:
+  pull_request_target:
     paths:
       - 'maintainers/maintainer-list.nix'
 permissions:
@@ -13,6 +13,9 @@ jobs:
     if: github.repository_owner == 'NixOS'
     steps:
       - uses: actions/checkout@v3
+        with:
+          # pull_request_target checks out the base branch by default
+          ref: refs/pull/${{ github.event.pull_request.number }}/merge
       - uses: cachix/install-nix-action@v19
         with:
           # explicitly enable sandbox
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index cdf361cb60d8..d45dd9ccbd20 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -9168,6 +9168,11 @@
     githubId = 115218;
     name = "Felix Richter";
   };
+  MakiseKurisu = {
+    github = "MakiseKurisu";
+    githubId = 2321672;
+    name = "Makise Kurisu";
+  };
   malbarbo = {
     email = "malbarbo@gmail.com";
     github = "malbarbo";
diff --git a/nixos/doc/manual/release-notes/rl-2305.section.md b/nixos/doc/manual/release-notes/rl-2305.section.md
index e6a5a14a7772..4dbb189cc46c 100644
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@@ -130,6 +130,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - `llvmPackages_rocm.llvm` will not contain `clang` or `compiler-rt`. `llvmPackages_rocm.clang` will not contain `llvm`. `llvmPackages_rocm.clangNoCompilerRt` has been removed in favor of using `llvmPackages_rocm.clang-unwrapped`.
 
+- `services.xserver.desktopManager.plasma5.excludePackages` has been moved to `environment.plasma5.excludePackages`, for consistency with other Desktop Environments
+
 - The EC2 image module previously detected and automatically mounted ext3-formatted instance store devices and partitions in stage-1 (initramfs), storing `/tmp` on the first discovered device. This behaviour, which only catered to very specific use cases and could not be disabled, has been removed. Users relying on this should provide their own implementation, and probably use ext4 and perform the mount in stage-2.
 
 - `teleport` has been upgraded from major version 10 to major version 12. Please see upstream [upgrade instructions](https://goteleport.com/docs/setup/operations/upgrading/) and release notes for versions [11](https://goteleport.com/docs/changelog/#1100) and [12](https://goteleport.com/docs/changelog/#1201). Note that Teleport does not officially support upgrades across more than one major version at a time. If you're running Teleport server components, it is recommended to first upgrade to an intermediate 11.x version by setting `services.teleport.package = pkgs.teleport_11`. Afterwards, this option can be removed to upgrade to the default version (12).
@@ -230,6 +232,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - `mastodon` now supports connection to a remote `PostgreSQL` database.
 
+- `nextcloud` has an option to enable SSE-C in S3.
+
 - `services.peertube` now requires you to specify the secret file `secrets.secretsFile`. It can be generated by running `openssl rand -hex 32`.
   Before upgrading, read the release notes for PeerTube:
     - [Release v5.0.0](https://github.com/Chocobozzz/PeerTube/releases/tag/v5.0.0)
@@ -247,6 +251,11 @@ In addition to numerous new and upgraded packages, this release has the followin
     [headscale's example configuration](https://github.com/juanfont/headscale/blob/main/config-example.yaml)
     can be directly written as attribute-set in Nix within this option.
 
+- `hardware.video.hidpi` now provides defaults that are consistent with `fontconfig`'s documentation:
+  - antialiasing and font hinting are disabled, as they have no visible effects at high pixel densities;
+  - subpixel order isn't set: it was irrelevant with the above disabled, and the module *cannot* know the correct
+    setting for the user's screen.
+
 - `nixos/lib/make-disk-image.nix` can now mutate EFI variables, run user-provided EFI firmware or variable templates. This is now extensively documented in the NixOS manual.
 
 - `services.grafana` listens only on localhost by default again. This was changed to upstreams default of `0.0.0.0` by accident in the freeform setting conversion.
diff --git a/nixos/modules/config/console.nix b/nixos/modules/config/console.nix
index f5db5dc5dfc1..7c8a45bc5318 100644
--- a/nixos/modules/config/console.nix
+++ b/nixos/modules/config/console.nix
@@ -21,7 +21,7 @@ let
   # Sadly, systemd-vconsole-setup doesn't support binary keymaps.
   vconsoleConf = pkgs.writeText "vconsole.conf" ''
     KEYMAP=${cfg.keyMap}
-    FONT=${cfg.font}
+    ${optionalString (cfg.font != null) "FONT=${cfg.font}"}
   '';
 
   consoleEnv = kbd: pkgs.buildEnv {
@@ -45,7 +45,7 @@ in
     };
 
     font = mkOption {
-      type = with types; either str path;
+      type = with types; nullOr (either str path);
       default = "Lat2-Terminus16";
       example = "LatArCyrHeb-16";
       description = mdDoc ''
@@ -53,6 +53,13 @@ in
         whatever the {command}`setfont` program considers the
         default font.
         Can be either a font name or a path to a PSF font file.
+
+        Use `null` to let the kernel choose a built-in font.
+        The default is 8x16, and, as of Linux 5.3, Terminus 32 bold for display
+        resolutions of 2560x1080 and higher.
+        These fonts cover the [IBM437][] character set.
+
+        [IBM437]: https://en.wikipedia.org/wiki/Code_page_437
       '';
     };
 
@@ -151,7 +158,7 @@ in
           printf "\033%%${if isUnicode then "G" else "@"}" >> /dev/console
           loadkmap < ${optimizedKeymap}
 
-          ${optionalString cfg.earlySetup ''
+          ${optionalString (cfg.earlySetup && cfg.font != null) ''
             setfont -C /dev/console $extraUtils/share/consolefonts/font.psf
           ''}
         '');
@@ -168,7 +175,7 @@ in
           "${config.boot.initrd.systemd.package.kbd}/bin/setfont"
           "${config.boot.initrd.systemd.package.kbd}/bin/loadkeys"
           "${config.boot.initrd.systemd.package.kbd.gzip}/bin/gzip" # Fonts and keyboard layouts are compressed
-        ] ++ optionals (hasPrefix builtins.storeDir cfg.font) [
+        ] ++ optionals (cfg.font != null && hasPrefix builtins.storeDir cfg.font) [
           "${cfg.font}"
         ] ++ optionals (hasPrefix builtins.storeDir cfg.keyMap) [
           "${cfg.keyMap}"
@@ -195,7 +202,7 @@ in
         ];
       })
 
-      (mkIf (cfg.earlySetup && !config.boot.initrd.systemd.enable) {
+      (mkIf (cfg.earlySetup && cfg.font != null && !config.boot.initrd.systemd.enable) {
         boot.initrd.extraUtilsCommands = ''
           mkdir -p $out/share/consolefonts
           ${if substring 0 1 cfg.font == "/" then ''
diff --git a/nixos/modules/hardware/video/hidpi.nix b/nixos/modules/hardware/video/hidpi.nix
index 8c8f8bc0c265..fe63784e57f5 100644
--- a/nixos/modules/hardware/video/hidpi.nix
+++ b/nixos/modules/hardware/video/hidpi.nix
@@ -12,11 +12,12 @@ with lib;
     boot.loader.systemd-boot.consoleMode = mkDefault "1";
 
 
-    # Grayscale anti-aliasing for fonts
-    fonts.fontconfig.antialias = mkDefault true;
-    fonts.fontconfig.subpixel = {
-      rgba = mkDefault "none";
-      lcdfilter = mkDefault "none";
+    # Disable font anti-aliasing, hinting, and sub-pixel rendering by default
+    # See recommendations in fonts/fontconfig.nix
+    fonts.fontconfig = {
+      antialias = mkDefault false;
+      hinting.enable = mkDefault false;
+      subpixel.lcdfilter = mkDefault "none";
     };
 
     # TODO Find reasonable defaults X11 & wayland
diff --git a/nixos/modules/services/mail/roundcube.nix b/nixos/modules/services/mail/roundcube.nix
index 95dc2f6aa2c9..7b6d82219298 100644
--- a/nixos/modules/services/mail/roundcube.nix
+++ b/nixos/modules/services/mail/roundcube.nix
@@ -132,6 +132,8 @@ in
       $config['plugins'] = [${concatMapStringsSep "," (p: "'${p}'") cfg.plugins}];
       $config['des_key'] = file_get_contents('/var/lib/roundcube/des_key');
       $config['mime_types'] = '${pkgs.nginx}/conf/mime.types';
+      # Roundcube uses PHP-FPM which has `PrivateTmp = true;`
+      $config['temp_dir'] = '/tmp';
       $config['enable_spellcheck'] = ${if cfg.dicts == [] then "false" else "true"};
       # by default, spellchecking uses a third-party cloud services
       $config['spellcheck_engine'] = 'pspell';
diff --git a/nixos/modules/services/matrix/synapse.md b/nixos/modules/services/matrix/synapse.md
index 7a9ddf8c9daf..cad91ebf58d5 100644
--- a/nixos/modules/services/matrix/synapse.md
+++ b/nixos/modules/services/matrix/synapse.md
@@ -27,10 +27,7 @@ please refer to the
 { pkgs, lib, config, ... }:
 let
   fqdn = "${config.networking.hostName}.${config.networking.domain}";
-  clientConfig = {
-    "m.homeserver".base_url = "https://${fqdn}";
-    "m.identity_server" = {};
-  };
+  clientConfig."m.homeserver".base_url = "https://${fqdn}";
   serverConfig."m.server" = "${fqdn}:443";
   mkWellKnown = data: ''
     add_header Content-Type application/json;
diff --git a/nixos/modules/services/web-apps/nextcloud.nix b/nixos/modules/services/web-apps/nextcloud.nix
index c5e161c2516a..71cb53fb398b 100644
--- a/nixos/modules/services/web-apps/nextcloud.nix
+++ b/nixos/modules/services/web-apps/nextcloud.nix
@@ -514,6 +514,27 @@ in {
               `http://hostname.domain/bucket` instead.
             '';
           };
+          sseCKeyFile = mkOption {
+            type = types.nullOr types.path;
+            default = null;
+            example = "/var/nextcloud-objectstore-s3-sse-c-key";
+            description = lib.mdDoc ''
+              If provided this is the full path to a file that contains the key
+              to enable [server-side encryption with customer-provided keys][1]
+              (SSE-C).
+
+              The file must contain a random 32-byte key encoded as a base64
+              string, e.g. generated with the command
+
+              ```
+              openssl rand 32 | base64
+              ```
+
+              Must be readable by user `nextcloud`.
+
+              [1]: https://docs.aws.amazon.com/AmazonS3/latest/userguide/ServerSideEncryptionCustomerKeys.html
+            '';
+          };
         };
       };
     };
@@ -773,6 +794,7 @@ in {
                 'use_ssl' => ${boolToString s3.useSsl},
                 ${optionalString (s3.region != null) "'region' => '${s3.region}',"}
                 'use_path_style' => ${boolToString s3.usePathStyle},
+                ${optionalString (s3.sseCKeyFile != null) "'sse_c_key' => nix_read_secret('${s3.sseCKeyFile}'),"}
               ],
             ]
           '';
diff --git a/nixos/modules/services/x11/desktop-managers/plasma5.nix b/nixos/modules/services/x11/desktop-managers/plasma5.nix
index 6e2fec599bc1..73a864bb95fe 100644
--- a/nixos/modules/services/x11/desktop-managers/plasma5.nix
+++ b/nixos/modules/services/x11/desktop-managers/plasma5.nix
@@ -81,88 +81,90 @@ let
 in
 
 {
-  options.services.xserver.desktopManager.plasma5 = {
-    enable = mkOption {
-      type = types.bool;
-      default = false;
-      description = lib.mdDoc "Enable the Plasma 5 (KDE 5) desktop environment.";
-    };
+  options = {
+    services.xserver.desktopManager.plasma5 = {
+      enable = mkOption {
+        type = types.bool;
+        default = false;
+        description = lib.mdDoc "Enable the Plasma 5 (KDE 5) desktop environment.";
+      };
 
-    phononBackend = mkOption {
-      type = types.enum [ "gstreamer" "vlc" ];
-      default = "vlc";
-      example = "gstreamer";
-      description = lib.mdDoc "Phonon audio backend to install.";
-    };
+      phononBackend = mkOption {
+        type = types.enum [ "gstreamer" "vlc" ];
+        default = "vlc";
+        example = "gstreamer";
+        description = lib.mdDoc "Phonon audio backend to install.";
+      };
 
-    useQtScaling = mkOption {
-      type = types.bool;
-      default = false;
-      description = lib.mdDoc "Enable HiDPI scaling in Qt.";
-    };
+      useQtScaling = mkOption {
+        type = types.bool;
+        default = false;
+        description = lib.mdDoc "Enable HiDPI scaling in Qt.";
+      };
 
-    runUsingSystemd = mkOption {
-      description = lib.mdDoc "Use systemd to manage the Plasma session";
-      type = types.bool;
-      default = true;
-    };
+      runUsingSystemd = mkOption {
+        description = lib.mdDoc "Use systemd to manage the Plasma session";
+        type = types.bool;
+        default = true;
+      };
 
-    excludePackages = mkOption {
-      description = lib.mdDoc "List of default packages to exclude from the configuration";
-      type = types.listOf types.package;
-      default = [];
-      example = literalExpression "[ pkgs.plasma5Packages.oxygen ]";
-    };
+      notoPackage = mkPackageOptionMD pkgs "Noto fonts" {
+        default = [ "noto-fonts" ];
+        example = "noto-fonts-lgc-plus";
+      };
 
-    notoPackage = mkPackageOptionMD pkgs "Noto fonts" {
-      default = [ "noto-fonts" ];
-      example = "noto-fonts-lgc-plus";
-    };
+      # Internally allows configuring kdeglobals globally
+      kdeglobals = mkOption {
+        internal = true;
+        default = {};
+        type = kdeConfigurationType;
+      };
 
-    # Internally allows configuring kdeglobals globally
-    kdeglobals = mkOption {
-      internal = true;
-      default = {};
-      type = kdeConfigurationType;
-    };
+      # Internally allows configuring kwin globally
+      kwinrc = mkOption {
+        internal = true;
+        default = {};
+        type = kdeConfigurationType;
+      };
 
-    # Internally allows configuring kwin globally
-    kwinrc = mkOption {
-      internal = true;
-      default = {};
-      type = kdeConfigurationType;
-    };
+      mobile.enable = mkOption {
+        type = types.bool;
+        default = false;
+        description = lib.mdDoc ''
+          Enable support for running the Plasma Mobile shell.
+        '';
+      };
 
-    mobile.enable = mkOption {
-      type = types.bool;
-      default = false;
-      description = lib.mdDoc ''
-        Enable support for running the Plasma Mobile shell.
-      '';
-    };
+      mobile.installRecommendedSoftware = mkOption {
+        type = types.bool;
+        default = true;
+        description = lib.mdDoc ''
+          Installs software recommended for use with Plasma Mobile, but which
+          is not strictly required for Plasma Mobile to run.
+        '';
+      };
 
-    mobile.installRecommendedSoftware = mkOption {
-      type = types.bool;
-      default = true;
-      description = lib.mdDoc ''
-        Installs software recommended for use with Plasma Mobile, but which
-        is not strictly required for Plasma Mobile to run.
-      '';
-    };
-
-    bigscreen.enable = mkOption {
-      type = types.bool;
-      default = false;
-      description = lib.mdDoc ''
-        Enable support for running the Plasma Bigscreen session.
-      '';
+      bigscreen.enable = mkOption {
+        type = types.bool;
+        default = false;
+        description = lib.mdDoc ''
+          Enable support for running the Plasma Bigscreen session.
+        '';
+      };
     };
+    environment.plasma5.excludePackages = mkOption {
+        description = lib.mdDoc "List of default packages to exclude from the configuration";
+        type = types.listOf types.package;
+        default = [];
+        example = literalExpression "[ pkgs.plasma5Packages.oxygen ]";
+      };
   };
 
   imports = [
     (mkRemovedOptionModule [ "services" "xserver" "desktopManager" "plasma5" "enableQt4Support" ] "Phonon no longer supports Qt 4.")
     (mkRemovedOptionModule [ "services" "xserver" "desktopManager" "plasma5" "supportDDC" ] "DDC/CI is no longer supported upstream.")
     (mkRenamedOptionModule [ "services" "xserver" "desktopManager" "kde5" ] [ "services" "xserver" "desktopManager" "plasma5" ])
+    (mkRenamedOptionModule [ "services" "xserver" "desktopManager" "plasma5" "excludePackages" ] [ "environment" "plasma5" "excludePackages" ])
   ];
 
   config = mkMerge [
@@ -284,7 +286,7 @@ in
           ];
         in
         requiredPackages
-        ++ utils.removePackagesByName optionalPackages cfg.excludePackages
+        ++ utils.removePackagesByName optionalPackages config.environment.plasma5.excludePackages
 
         # Phonon audio backend
         ++ lib.optional (cfg.phononBackend == "gstreamer") libsForQt5.phonon-backend-gstreamer
@@ -438,7 +440,7 @@ in
             khelpcenter
             print-manager
           ];
-      in requiredPackages ++ utils.removePackagesByName optionalPackages cfg.excludePackages;
+      in requiredPackages ++ utils.removePackagesByName optionalPackages config.environment.plasma5.excludePackages;
 
       systemd.user.services = {
         plasma-run-with-systemd = {
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index dfb3ad2b3ad6..7fe516343d44 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -2501,8 +2501,8 @@ let
         mktplcRef = {
           publisher = "shd101wyy";
           name = "markdown-preview-enhanced";
-          version = "0.6.3";
-          sha256 = "dCWERQ5rHnmYLtYl12gJ+dXLnpMu55WnmF1VfdP0x34=";
+          version = "0.6.8";
+          sha256 = "9NRaHgtyiZJ0ic6h1B01MWzYhDABAl3Jm2IUPogYWr0=";
         };
         meta = {
           description = "Provides a live preview of markdown using either markdown-it or pandoc";
diff --git a/pkgs/applications/graphics/ImageMagick/default.nix b/pkgs/applications/graphics/ImageMagick/default.nix
index 60cba0410c49..be7eefddd44d 100644
--- a/pkgs/applications/graphics/ImageMagick/default.nix
+++ b/pkgs/applications/graphics/ImageMagick/default.nix
@@ -47,13 +47,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "imagemagick";
-  version = "7.1.1-2";
+  version = "7.1.1-3";
 
   src = fetchFromGitHub {
     owner = "ImageMagick";
     repo = "ImageMagick";
     rev = finalAttrs.version;
-    hash = "sha256-5B8grg05n+MkHZU76QBsrrU5Z3VZRGMRHX35HXtTbe8=";
+    hash = "sha256-UYmWNP+2FdBtBUqQtYGtIdw/XN8OKO0r5g4zgzPgbP8=";
   };
 
   outputs = [ "out" "dev" "doc" ]; # bin/ isn't really big
diff --git a/pkgs/applications/kde/akonadi-contacts.nix b/pkgs/applications/kde/akonadi-contacts.nix
index 76c4f3f2c507..d89670d7719c 100644
--- a/pkgs/applications/kde/akonadi-contacts.nix
+++ b/pkgs/applications/kde/akonadi-contacts.nix
@@ -16,10 +16,10 @@ mkDerivation {
   nativeBuildInputs = [ extra-cmake-modules ];
   buildInputs = [
     qtwebengine
-    grantlee grantleetheme
+    grantlee
     kcmutils kdbusaddons ki18n kiconthemes kio kitemmodels ktextwidgets prison
     akonadi-mime kcontacts kmime libkleo
   ];
-  propagatedBuildInputs = [ akonadi ];
+  propagatedBuildInputs = [ akonadi grantleetheme ];
   outputs = [ "out" "dev" ];
 }
diff --git a/pkgs/applications/kde/grantleetheme/default.nix b/pkgs/applications/kde/grantleetheme/default.nix
index ff4b8fc93ed9..92499645e7f4 100644
--- a/pkgs/applications/kde/grantleetheme/default.nix
+++ b/pkgs/applications/kde/grantleetheme/default.nix
@@ -10,7 +10,7 @@ mkDerivation {
     license = with lib.licenses; [ gpl2Plus lgpl21Plus fdl12Plus ];
     maintainers = kdepimTeam;
   };
-  output = [ "out" "dev" ];
+  outputs = [ "out" "dev" ];
   nativeBuildInputs = [ extra-cmake-modules kdoctools ];
   buildInputs = [
     grantlee ki18n kiconthemes knewstuff kservice kxmlgui qtbase
diff --git a/pkgs/applications/misc/authenticator/default.nix b/pkgs/applications/misc/authenticator/default.nix
index 5fb336d8de37..5f6d1c419567 100644
--- a/pkgs/applications/misc/authenticator/default.nix
+++ b/pkgs/applications/misc/authenticator/default.nix
@@ -2,7 +2,6 @@
 , stdenv
 , fetchFromGitLab
 , appstream-glib
-, clang
 , desktop-file-utils
 , meson
 , ninja
@@ -14,7 +13,6 @@
 , gst_all_1
 , gtk4
 , libadwaita
-, libclang
 , openssl
 , pipewire
 , sqlite
@@ -24,20 +22,20 @@
 
 stdenv.mkDerivation rec {
   pname = "authenticator";
-  version = "4.1.6";
+  version = "4.2.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "World";
     repo = "Authenticator";
     rev = version;
-    hash = "sha256-fv7Np3haRCJABlJocKuu+1jevHYrdo+VyiQBpRmHs2g=";
+    hash = "sha256-Nv4QE6gyh42Na/stAgTIapV8GQuUHCdL6IEO//J8dV8=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-8GddlDM1lU365GXdrKNhO331/y1p3Om5uZfVLy8TBGI=";
+    hash = "sha256-IS9jdr19VvgX6M1OqM6rjE8veujZcwBuOTuDm5mDXso=";
   };
 
   nativeBuildInputs = [
@@ -80,5 +78,8 @@ stdenv.mkDerivation rec {
     license = lib.licenses.gpl3Plus;
     maintainers = with lib.maintainers; [ austinbutler ];
     platforms = lib.platforms.linux;
+    # Fails to build on aarch64 with error
+    # "a label can only be part of a statement and a declaration is not a statement"
+    broken = stdenv.isLinux && stdenv.isAarch64;
   };
 }
diff --git a/pkgs/applications/misc/geoipupdate/default.nix b/pkgs/applications/misc/geoipupdate/default.nix
index c2f025d20ae1..822717ca1d65 100644
--- a/pkgs/applications/misc/geoipupdate/default.nix
+++ b/pkgs/applications/misc/geoipupdate/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "geoipupdate";
-  version = "4.10.0";
+  version = "4.11.1";
 
   src = fetchFromGitHub {
     owner = "maxmind";
     repo = "geoipupdate";
     rev = "v${version}";
-    sha256 = "sha256-Djr0IjRxf4kKOsL0KMTAkRjW/zo0+r63TBCjet2ZhNw=";
+    sha256 = "sha256-85xPXqvRfc6zip3tPcxFsE+niPmnnPqi9gLF+ioqbV8=";
   };
 
-  vendorSha256 = "sha256-upyblOmT1UC1epOI5H92G/nzcCuGNyh3dbIApUg2Idk=";
+  vendorHash = "sha256-cPdQ7AIYUacoq885K8XBF+zChUPwbZ7YI4aDCIBOvMY=";
 
   ldflags = [ "-X main.version=${version}" ];
 
diff --git a/pkgs/applications/misc/pgmodeler/default.nix b/pkgs/applications/misc/pgmodeler/default.nix
index ca2d75eac853..ca9387e34e65 100644
--- a/pkgs/applications/misc/pgmodeler/default.nix
+++ b/pkgs/applications/misc/pgmodeler/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pgmodeler";
-  version = "1.0.1";
+  version = "1.0.2";
 
   src = fetchFromGitHub {
     owner = "pgmodeler";
     repo = "pgmodeler";
     rev = "v${version}";
-    sha256 = "sha256-SlAYl2x1qdBBwLboO59h1uifF7Q71oX3JyhWwUogdb0=";
+    sha256 = "sha256-yvVgBfJLjEynsqxQisDfOM99C8/QM0F44RIHAmxh4uU=";
   };
 
   nativeBuildInputs = [ pkg-config qmake wrapQtAppsHook ];
diff --git a/pkgs/applications/networking/flexget/default.nix b/pkgs/applications/networking/flexget/default.nix
index 2612aef79d1d..29badfb1ca42 100644
--- a/pkgs/applications/networking/flexget/default.nix
+++ b/pkgs/applications/networking/flexget/default.nix
@@ -1,19 +1,33 @@
 { lib
-, python3Packages
+, python3
 , fetchFromGitHub
 }:
 
-python3Packages.buildPythonApplication rec {
+let
+  python = python3.override {
+    packageOverrides = self: super: {
+      sqlalchemy = super.sqlalchemy.overridePythonAttrs (old: rec {
+        version = "1.4.47";
+        src = self.fetchPypi {
+          pname = "SQLAlchemy";
+          inherit version;
+          hash = "sha256-lfwC9/wfMZmqpHqKdXQ3E0z2GOnZlMhO/9U/Uww4WG8=";
+        };
+      });
+    };
+  };
+in
+python.pkgs.buildPythonApplication rec {
   pname = "flexget";
-  version = "3.5.31";
+  version = "3.5.33";
   format = "pyproject";
 
   # Fetch from GitHub in order to use `requirements.in`
   src = fetchFromGitHub {
-    owner = "flexget";
-    repo = "flexget";
+    owner = "Flexget";
+    repo = "Flexget";
     rev = "refs/tags/v${version}";
-    hash = "sha256-v6N1isaTVPwV/LC/a2lzrboLI6V/4W586RE5esfR500=";
+    hash = "sha256-LzDXNl2IQ3+j9uP+nE6JS8E+pO0n9zwmA7wrMeKR6Ms=";
   };
 
   postPatch = ''
@@ -28,7 +42,7 @@ python3Packages.buildPythonApplication rec {
   # ~400 failures
   doCheck = false;
 
-  propagatedBuildInputs = with python3Packages; [
+  propagatedBuildInputs = with python.pkgs; [
     # See https://github.com/Flexget/Flexget/blob/master/requirements.txt
     apscheduler
     beautifulsoup4
diff --git a/pkgs/applications/networking/p2p/freenet/default.nix b/pkgs/applications/networking/p2p/freenet/default.nix
index 05cc0466264f..c7a1a02fc241 100644
--- a/pkgs/applications/networking/p2p/freenet/default.nix
+++ b/pkgs/applications/networking/p2p/freenet/default.nix
@@ -1,61 +1,118 @@
-{ lib, stdenv, fetchurl, jdk, bash, coreutils, substituteAll, nixosTests, jna }:
+{ lib, stdenv, fetchurl, fetchFromGitHub, jdk, gradle, bash, coreutils
+, substituteAll, nixosTests, perl, fetchpatch, writeText }:
 
 let
-  version = "build01494";
+  version = "01497";
+
   freenet_ext = fetchurl {
-    url = "https://github.com/freenet/fred/releases/download/${version}/freenet-ext.jar";
+    url = "https://github.com/freenet/fred/releases/download/build01495/freenet-ext.jar";
     sha256 = "sha256-MvKz1r7t9UE36i+aPr72dmbXafCWawjNF/19tZuk158=";
   };
-  bcprov = fetchurl {
-    url = "https://github.com/freenet/fred/releases/download/${version}/bcprov-jdk15on-1.59.jar";
-    sha256 = "sha256-HDHkTjMdJeRtKTs+juLQcCimfbAR50yyRDKFrtHVnIU=";
-  };
+
   seednodes = fetchurl {
     url = "https://downloads.freenetproject.org/alpha/opennet/seednodes.fref";
     sha256 = "08awwr8n80b4cdzzb3y8hf2fzkr1f2ly4nlq779d6pvi5jymqdvv";
   };
 
-  freenet-jars = stdenv.mkDerivation {
-    pname = "freenet-jars";
-    inherit version;
+  patches = [
+    # gradle 7 support
+    (fetchpatch {
+      url = "https://github.com/freenet/fred/pull/827.patch";
+      sha256 = "sha256-T1zymxRTADVhhwp2TyB+BC/J4gZsT/CUuMrT4COlpTY=";
+    })
+  ];
 
-    src = fetchurl {
-      url = "https://github.com/freenet/fred/releases/download/${version}/freenet.jar";
-      sha256 = "sha256-1Pjc8Ob4EN7N05QkGTMKBn7z3myTDaQ98N48nNSLstg=";
-    };
+in stdenv.mkDerivation rec {
+  pname = "freenet";
+  inherit version patches;
 
-    dontUnpack = true;
-
-    installPhase = ''
-      mkdir -p $out/share/freenet
-      ln -s ${bcprov} $out/share/freenet/bcprov.jar
-      ln -s ${freenet_ext} $out/share/freenet/freenet-ext.jar
-      ln -s ${jna}/share/java/jna-platform.jar $out/share/freenet/jna_platform.jar
-      ln -s ${jna}/share/java/jna.jar $out/share/freenet/jna.jar
-      ln -s $src $out/share/freenet/freenet.jar
-    '';
+  src = fetchFromGitHub {
+    owner = "freenet";
+    repo = "fred";
+    rev = "refs/tags/build${version}";
+    hash = "sha256-pywNPekofF/QotNVF28McojqK7c1Zzucds5rWV0R7BQ=";
   };
 
-in stdenv.mkDerivation {
-  pname = "freenet";
-  inherit version;
+  postPatch = ''
+    rm gradle/verification-{keyring.keys,metadata.xml}
+  '';
 
-  src = substituteAll {
+  nativeBuildInputs = [ gradle jdk ];
+
+  wrapper = substituteAll {
     src = ./freenetWrapper;
     inherit bash coreutils jdk seednodes;
-    freenet = freenet-jars;
   };
 
-  dontUnpack = true;
+  # https://github.com/freenet/fred/blob/next/build-offline.sh
+  # fake build to pre-download deps into fixed-output derivation
+  deps = stdenv.mkDerivation {
+    pname = "${pname}-deps";
+    inherit src version patches;
 
-  passthru.tests = { inherit (nixosTests) freenet; };
+    nativeBuildInputs = [ gradle perl ];
+    buildPhase = ''
+      export GRADLE_USER_HOME=$(mktemp -d)
+      gradle --no-daemon build
+    '';
+    # perl code mavenizes pathes (com.squareup.okio/okio/1.13.0/a9283170b7305c8d92d25aff02a6ab7e45d06cbe/okio-1.13.0.jar -> com/squareup/okio/okio/1.13.0/okio-1.13.0.jar)
+    installPhase = ''
+      find $GRADLE_USER_HOME/caches/modules-2 -type f -regex '.*\.\(jar\|pom\)' \
+        | perl -pe 's#(.*/([^/]+)/([^/]+)/([^/]+)/[0-9a-f]{30,40}/([^/\s]+))$# ($x = $2) =~ tr|\.|/|; "install -Dm444 $1 \$out/$x/$3/$4/''${\($5 =~ s/okio-jvm/okio/r)}" #e' \
+        | sh
+    '';
+    # Don't move info to share/
+    forceShare = [ "dummy" ];
+    outputHashMode = "recursive";
+    # Downloaded jars differ by platform
+    outputHash = "sha256-CZf5M3lI7Lz9Pl8U/lNoQ6V6Jxbmkxau8L273XFFS2E=";
+    outputHashAlgo = "sha256";
+  };
+
+  # Point to our local deps repo
+  gradleInit = writeText "init.gradle" ''
+    gradle.projectsLoaded {
+      rootProject.allprojects {
+        buildscript {
+          repositories {
+            clear()
+            maven { url '${deps}/'; metadataSources {mavenPom(); artifact()} }
+          }
+        }
+        repositories {
+          clear()
+          maven { url '${deps}/'; metadataSources {mavenPom(); artifact()} }
+        }
+      }
+    }
+
+    settingsEvaluated { settings ->
+      settings.pluginManagement {
+        repositories {
+          maven { url '${deps}/'; metadataSources {mavenPom(); artifact()} }
+        }
+      }
+    }
+  '';
+
+  buildPhase = ''
+    gradle jar -Dorg.gradle.java.home=${jdk} --offline --no-daemon --info --init-script $gradleInit
+  '';
 
   installPhase = ''
+    runHook preInstall
+    install -Dm444 build/libs/freenet.jar $out/share/freenet/freenet.jar
+    ln -s ${freenet_ext} $out/share/freenet/freenet-ext.jar
     mkdir -p $out/bin
-    install -Dm555 $src $out/bin/freenet
-    ln -s ${freenet-jars}/share $out/share
+    install -Dm555 ${wrapper} $out/bin/freenet
+    substituteInPlace $out/bin/freenet \
+      --subst-var-by outFreenet $out
+    ln -s ${deps} $out/deps
+    runHook postInstall
   '';
 
+  passthru.tests = { inherit (nixosTests) freenet; };
+
   meta = {
     description = "Decentralised and censorship-resistant network";
     homepage = "https://freenetproject.org/";
diff --git a/pkgs/applications/networking/p2p/freenet/freenetWrapper b/pkgs/applications/networking/p2p/freenet/freenetWrapper
index 76faf601e69c..f8292615de7a 100755
--- a/pkgs/applications/networking/p2p/freenet/freenetWrapper
+++ b/pkgs/applications/networking/p2p/freenet/freenetWrapper
@@ -1,7 +1,8 @@
 #! @bash@/bin/bash
 set -eo pipefail
 PATH=@coreutils@/bin:$PATH
-export CLASSPATH=@freenet@/share/freenet/bcprov.jar:@freenet@/share/freenet/freenet-ext.jar:@freenet@/share/freenet/jna_platform.jar:@freenet@/share/freenet/jna.jar:@freenet@/share/freenet/freenet.jar
+export CLASSPATH=$(find @outFreenet@/deps/ -name "*.jar"|grep -v bcprov-jdk15on-1.48.jar|tr $'\n' :)
+CLASSPATH=$CLASSPATH:@outFreenet@/share/freenet/freenet-ext.jar:@outFreenet@/share/freenet/freenet.jar
 
 export FREENET_HOME="$HOME/.local/share/freenet"
 if [ -n "$XDG_DATA_HOME" ] ; then
diff --git a/pkgs/applications/networking/pjsip/default.nix b/pkgs/applications/networking/pjsip/default.nix
index 33747e2d669b..db76d3f58611 100644
--- a/pkgs/applications/networking/pjsip/default.nix
+++ b/pkgs/applications/networking/pjsip/default.nix
@@ -7,10 +7,13 @@
 , swig
 , alsa-lib
 , AppKit
+, CoreFoundation
+, Security
 , python3
 , pythonSupport ? true
+, pjsip
+, runCommand
 }:
-
 stdenv.mkDerivation rec {
   pname = "pjsip";
   version = "2.13";
@@ -41,21 +44,23 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ openssl libsamplerate ]
     ++ lib.optional stdenv.isLinux alsa-lib
-    ++ lib.optional stdenv.isDarwin AppKit;
+    ++ lib.optionals stdenv.isDarwin [ AppKit CoreFoundation Security ];
 
   preConfigure = ''
     export LD=$CC
   '';
 
+  NIX_CFLAGS_LINK = lib.optionalString stdenv.isDarwin "-headerpad_max_install_names";
+
   postBuild = lib.optionalString pythonSupport ''
     make -C pjsip-apps/src/swig/python
   '';
 
+  configureFlags = [ "--enable-shared" ];
+
   outputs = [ "out" ]
     ++ lib.optional pythonSupport "py";
 
-  configureFlags = [ "--enable-shared" ];
-
   postInstall = ''
     mkdir -p $out/bin
     cp pjsip-apps/bin/pjsua-* $out/bin/pjsua
@@ -65,13 +70,44 @@ stdenv.mkDerivation rec {
     (cd pjsip-apps/src/swig/python && \
       python setup.py install --prefix=$py
     )
+  '' + lib.optionalString stdenv.isDarwin ''
+    # On MacOS relative paths are used to refer to libraries. All libraries use
+    # a relative path like ../lib/*.dylib or ../../lib/*.dylib. We need to
+    # rewrite these to use absolute ones.
+
+    # First, find all libraries (and their symlinks) in our outputs to define
+    # the install_name_tool -change arguments we should pass.
+    readarray -t libraries < <(
+      for outputName in $(getAllOutputNames); do
+        find "''${!outputName}" \( -name '*.dylib*' -o -name '*.so*' \)
+      done
+    )
+
+    # Determine the install_name_tool -change arguments that are going to be
+    # applied to all libraries.
+    change_args=()
+    for lib in "''${libraries[@]}"; do
+      lib_name="$(basename $lib)"
+      change_args+=(-change ../lib/$lib_name $lib)
+      change_args+=(-change ../../lib/$lib_name $lib)
+    done
+
+    # Rewrite id and library refences for all non-symlinked libraries.
+    for lib in "''${libraries[@]}"; do
+      if [ -f "$lib" ]; then
+        install_name_tool -id $lib "''${change_args[@]}" $lib
+      fi
+    done
   '';
 
   # We need the libgcc_s.so.1 loadable (for pthread_cancel to work)
   dontPatchELF = true;
 
+  passthru.tests.python-pjsua2 = runCommand "python-pjsua2" { } ''
+    ${(python3.withPackages (pkgs: [ pkgs.pjsua2 ])).interpreter} -c "import pjsua2" > $out
+  '';
+
   meta = with lib; {
-    broken = stdenv.isDarwin;
     description = "A multimedia communication library written in C, implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE";
     homepage = "https://pjsip.org/";
     license = licenses.gpl2Plus;
diff --git a/pkgs/applications/plasma-mobile/default.nix b/pkgs/applications/plasma-mobile/default.nix
index 34f28ae7ff5d..255b3828f768 100644
--- a/pkgs/applications/plasma-mobile/default.nix
+++ b/pkgs/applications/plasma-mobile/default.nix
@@ -75,7 +75,7 @@ let
       plasma-settings = callPackage ./plasma-settings.nix {};
       plasmatube = callPackage ./plasmatube {};
       qmlkonsole = callPackage ./qmlkonsole.nix {};
-      spacebar = callPackage ./spacebar.nix { inherit srcs; };
+      spacebar = callPackage ./spacebar.nix {};
       tokodon = callPackage ./tokodon.nix {};
     };
 
diff --git a/pkgs/applications/plasma-mobile/spacebar.nix b/pkgs/applications/plasma-mobile/spacebar.nix
index c120851e5b2e..659b92228d2c 100644
--- a/pkgs/applications/plasma-mobile/spacebar.nix
+++ b/pkgs/applications/plasma-mobile/spacebar.nix
@@ -1,7 +1,5 @@
 { lib
 , mkDerivation
-, gcc12Stdenv
-, srcs
 
 , cmake
 , extra-cmake-modules
@@ -17,17 +15,14 @@
 , knotifications
 , kpeople
 , libphonenumber
-, libqofono
 , modemmanager-qt
 , protobuf
 , qcoro
 , qtquickcontrols2
 }:
 
-# Workaround for AArch64 still using GCC9.
-gcc12Stdenv.mkDerivation rec {
+mkDerivation {
   pname = "spacebar";
-  inherit (srcs.spacebar) version src;
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/applications/radio/quisk/default.nix b/pkgs/applications/radio/quisk/default.nix
index 34e83ab95ca2..5fcd11a17523 100644
--- a/pkgs/applications/radio/quisk/default.nix
+++ b/pkgs/applications/radio/quisk/default.nix
@@ -1,5 +1,5 @@
 { lib, python39Packages, fetchPypi
-, fftw, alsa-lib, pulseaudio, pyusb, wxPython_4_0 }:
+, fftw, alsa-lib, pulseaudio, pyusb, wxPython_4_2 }:
 
 python39Packages.buildPythonApplication rec {
   pname = "quisk";
@@ -12,7 +12,7 @@ python39Packages.buildPythonApplication rec {
 
   buildInputs = [ fftw alsa-lib pulseaudio ];
 
-  propagatedBuildInputs = [ pyusb wxPython_4_0 ];
+  propagatedBuildInputs = [ pyusb wxPython_4_2 ];
 
   doCheck = false;
 
diff --git a/pkgs/applications/radio/sdrangel/default.nix b/pkgs/applications/radio/sdrangel/default.nix
index 0bda52d425e4..e6e867f477ba 100644
--- a/pkgs/applications/radio/sdrangel/default.nix
+++ b/pkgs/applications/radio/sdrangel/default.nix
@@ -24,14 +24,20 @@
 , libbladeRF
 , mbelib
 , mkDerivation
+, ninja
 , ocl-icd
 , opencv3
 , pkg-config
 , qtcharts
+, qtdeclarative
+, qtgraphicaleffects
 , qtlocation
 , qtmultimedia
+, qtquickcontrols
+, qtquickcontrols2
 , qtserialport
 , qtspeech
+, qttools
 , qtwebsockets
 , qtwebengine
 , rtl-sdr
@@ -39,6 +45,7 @@
 , sgp4
 , soapysdr-with-plugins
 , uhd
+, zlib
 }:
 
 mkDerivation rec {
@@ -49,10 +56,10 @@ mkDerivation rec {
     owner = "f4exb";
     repo = "sdrangel";
     rev = "v${version}";
-    sha256 = "sha256-hsYt7zGG6CSWeQ9A3GPt65efjZGPu33O5pIhnZjFgmY=";
+    hash = "sha256-hsYt7zGG6CSWeQ9A3GPt65efjZGPu33O5pIhnZjFgmY=";
   };
 
-  nativeBuildInputs = [ cmake pkg-config ];
+  nativeBuildInputs = [ cmake ninja pkg-config ];
 
   buildInputs = [
     airspy
@@ -78,10 +85,15 @@ mkDerivation rec {
     mbelib
     opencv3
     qtcharts
+    qtdeclarative
+    qtgraphicaleffects
     qtlocation
     qtmultimedia
+    qtquickcontrols
+    qtquickcontrols2
     qtserialport
     qtspeech
+    qttools
     qtwebsockets
     qtwebengine
     rtl-sdr
@@ -89,11 +101,12 @@ mkDerivation rec {
     sgp4
     soapysdr-with-plugins
     uhd
+    zlib
   ];
 
   cmakeFlags = [
     "-DAPT_DIR=${aptdec}"
-    "-DDAB_LIB=${dab_lib}"
+    "-DDAB_INCLUDE_DIR:PATH=${dab_lib}/include/dab_lib"
     "-DLIBSERIALDV_INCLUDE_DIR:PATH=${serialdv}/include/serialdv"
     "-DLIMESUITE_INCLUDE_DIR:PATH=${limesuite}/include"
     "-DLIMESUITE_LIBRARY:FILEPATH=${limesuite}/lib/libLimeSuite${stdenv.hostPlatform.extensions.sharedLibrary}"
diff --git a/pkgs/applications/science/math/sage/patches/numpy-1.24-upgrade.patch b/pkgs/applications/science/math/sage/patches/numpy-1.24-upgrade.patch
new file mode 100644
index 000000000000..93b18ce028f0
--- /dev/null
+++ b/pkgs/applications/science/math/sage/patches/numpy-1.24-upgrade.patch
@@ -0,0 +1,58 @@
+diff --git a/src/sage/misc/persist.pyx b/src/sage/misc/persist.pyx
+index 3ac5f1cc2b..cb1f327c19 100644
+--- a/src/sage/misc/persist.pyx
++++ b/src/sage/misc/persist.pyx
+@@ -157,7 +157,7 @@ def load(*filename, compress=True, verbose=True, **kwargs):
+         ....:     _ = f.write(code)
+         sage: load(t)
+         sage: hello
+-        <fortran object>
++        <fortran ...>
+     """
+     import sage.repl.load
+     if len(filename) != 1:
+diff --git a/src/sage/plot/complex_plot.pyx b/src/sage/plot/complex_plot.pyx
+index 6f0aeab87a..b77c69b2f7 100644
+--- a/src/sage/plot/complex_plot.pyx
++++ b/src/sage/plot/complex_plot.pyx
+@@ -461,6 +461,8 @@ def complex_to_rgb(z_values, contoured=False, tiled=False,
+             rgb[i, j, 2] = b
+ 
+     sig_off()
++    nan_indices = np.isnan(rgb).any(-1)     # Mask for undefined points
++    rgb[nan_indices] = 1                    # Make nan_indices white
+     return rgb
+ 
+ 
+diff --git a/src/sage/plot/histogram.py b/src/sage/plot/histogram.py
+index 3bc2b76b58..388c2d1391 100644
+--- a/src/sage/plot/histogram.py
++++ b/src/sage/plot/histogram.py
+@@ -87,13 +87,8 @@ class Histogram(GraphicPrimitive):
+ 
+         TESTS::
+ 
+-            sage: h = histogram([10,3,5], normed=True)[0]
+-            doctest:warning...:
+-            DeprecationWarning: the 'normed' option is deprecated. Use 'density' instead.
+-            See https://trac.sagemath.org/25260 for details.
++            sage: h = histogram([10,3,5], density=True)[0]
+             sage: h.get_minmax_data()
+-            doctest:warning ...
+-            ...VisibleDeprecationWarning: Passing `normed=True` on non-uniform bins has always been broken, and computes neither the probability density function nor the probability mass function. The result is only correct if the bins are uniform, when density=True will produce the same result anyway. The argument will be removed in a future version of numpy.
+             {'xmax': 10.0, 'xmin': 3.0, 'ymax': 0.476190476190..., 'ymin': 0}
+         """
+         import numpy
+diff --git a/src/sage/repl/ipython_extension.py b/src/sage/repl/ipython_extension.py
+index 798671aab4..cad6a47ca8 100644
+--- a/src/sage/repl/ipython_extension.py
++++ b/src/sage/repl/ipython_extension.py
+@@ -405,7 +405,7 @@ class SageMagics(Magics):
+             ....: C END FILE FIB1.F
+             ....: ''')
+             sage: fib
+-            <fortran object>
++            <fortran ...>
+             sage: from numpy import array
+             sage: a = array(range(10), dtype=float)
+             sage: fib(a, 10)
diff --git a/pkgs/applications/science/math/sage/sage-src.nix b/pkgs/applications/science/math/sage/sage-src.nix
index 5e18b7415632..8913d636fae9 100644
--- a/pkgs/applications/science/math/sage/sage-src.nix
+++ b/pkgs/applications/science/math/sage/sage-src.nix
@@ -127,6 +127,23 @@ stdenv.mkDerivation rec {
       sha256 = "sha256-9BhQLFB3wUhiXRQsK9L+I62lSjvTfrqMNi7QUIQvH4U=";
     })
 
+    # https://github.com/sagemath/sage/pull/35235
+    (fetchpatch {
+      name = "ipython-8.11-upgrade.patch";
+      url = "https://github.com/sagemath/sage/commit/23471e2d242c4de8789d7b1fc8b07a4b1d1e595a.diff";
+      sha256 = "sha256-wvH4BvDiaBv7jbOP8LvOE5Vs16Kcwz/C9jLpEMohzLQ=";
+    })
+
+    # positively reviewed
+    (fetchpatch {
+      name = "matplotlib-3.7.0-upgrade.patch";
+      url = "https://github.com/sagemath/sage/pull/35177.diff";
+      sha256 = "sha256-YdPnMsjXBm9ZRm6a8hH8rSynkrABjLoIzqwp3F/rKAw=";
+    })
+
+    # rebased from https://github.com/sagemath/sage/pull/34994, merged in sage 10.0.beta2
+    ./patches/numpy-1.24-upgrade.patch
+
     # temporarily paper over https://github.com/jupyter-widgets/ipywidgets/issues/3669
     ./patches/ipywidgets-on_submit-deprecationwarning.patch
 
diff --git a/pkgs/applications/science/math/sage/sagelib.nix b/pkgs/applications/science/math/sage/sagelib.nix
index 143e5a2a22b3..3d1c319a2f22 100644
--- a/pkgs/applications/science/math/sage/sagelib.nix
+++ b/pkgs/applications/science/math/sage/sagelib.nix
@@ -22,6 +22,7 @@
 , gsl
 , iml
 , jinja2
+, libpng
 , lcalc
 , lrcalc
 , gap
@@ -99,6 +100,7 @@ buildPythonPackage rec {
     gd
     readline
     iml
+    libpng
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/applications/version-management/sublime-merge/default.nix b/pkgs/applications/version-management/sublime-merge/default.nix
index 2bed38959c13..01bd8b3573ff 100644
--- a/pkgs/applications/version-management/sublime-merge/default.nix
+++ b/pkgs/applications/version-management/sublime-merge/default.nix
@@ -9,8 +9,8 @@ in {
   } {};
 
   sublime-merge-dev = common {
-    buildVersion = "2082";
-    x64sha256 = "Gl1BrLTSDLRTgrYQW/99o0XRjSIxvnNYRIViZEidcsM=";
+    buildVersion = "2085";
+    x64sha256 = "40yI6EtP2l22aPP50an3ycvdEcAqJphhGhYYoOPyHw0=";
     dev = true;
   } {};
 }
diff --git a/pkgs/desktops/plasma-5/kpipewire.nix b/pkgs/desktops/plasma-5/kpipewire.nix
index fd412711e4a2..59169cd510c8 100644
--- a/pkgs/desktops/plasma-5/kpipewire.nix
+++ b/pkgs/desktops/plasma-5/kpipewire.nix
@@ -19,10 +19,10 @@ mkDerivation {
     ki18n
     kcoreaddons
     plasma-wayland-protocols
-    libepoxy
     ffmpeg
     mesa
     pipewire
     wayland
   ];
+  propagatedBuildInputs = [ libepoxy ];
 }
diff --git a/pkgs/development/beam-modules/erlang-ls/default.nix b/pkgs/development/beam-modules/erlang-ls/default.nix
index f5390e186c08..25dd9879eeea 100644
--- a/pkgs/development/beam-modules/erlang-ls/default.nix
+++ b/pkgs/development/beam-modules/erlang-ls/default.nix
@@ -56,6 +56,7 @@ rebar3Relx {
     description = "The Erlang Language Server";
     platforms = platforms.unix;
     license = licenses.asl20;
+    mainProgram = "erlang_ls";
   };
   passthru.updateScript = writeScript "update.sh" ''
     #!/usr/bin/env nix-shell
diff --git a/pkgs/development/compilers/nim/default.nix b/pkgs/development/compilers/nim/default.nix
index bdd8022e69de..318a7ac34052 100644
--- a/pkgs/development/compilers/nim/default.nix
+++ b/pkgs/development/compilers/nim/default.nix
@@ -86,12 +86,12 @@ in {
 
   nim-unwrapped = stdenv.mkDerivation rec {
     pname = "nim-unwrapped";
-    version = "1.6.10";
+    version = "1.6.12";
     strictDeps = true;
 
     src = fetchurl {
       url = "https://nim-lang.org/download/nim-${version}.tar.xz";
-      hash = "sha256-E9dwL4tXCHur6M0FHBO8VqMXFBi6hntJxrvQmynST+o=";
+      hash = "sha256-rO8LCrdzYE1Nc5S2hRntt0+zD0aRIpSyi8J+DHtLTcI=";
     };
 
     buildInputs = [ boehmgc openssl pcre readline sqlite ];
@@ -153,14 +153,14 @@ in {
 
   nimble-unwrapped = stdenv.mkDerivation rec {
     pname = "nimble-unwrapped";
-    version = "0.13.1";
+    version = "0.14.2";
     strictDeps = true;
 
     src = fetchFromGitHub {
       owner = "nim-lang";
       repo = "nimble";
       rev = "v${version}";
-      sha256 = "1idb4r0kjbqv16r6bgmxlr13w2vgq5332hmnc8pjbxiyfwm075x8";
+      hash = "sha256-8b5yKvEl7c7wA/8cpdaN2CSvawQJzuRce6mULj3z/mI=";
     };
 
     depsBuildBuild = [ nim-unwrapped ];
diff --git a/pkgs/development/libraries/alembic/default.nix b/pkgs/development/libraries/alembic/default.nix
index bff46622d45e..4efa425ee28b 100644
--- a/pkgs/development/libraries/alembic/default.nix
+++ b/pkgs/development/libraries/alembic/default.nix
@@ -3,13 +3,13 @@
 stdenv.mkDerivation rec
 {
   pname = "alembic";
-  version = "1.8.4";
+  version = "1.8.5";
 
   src = fetchFromGitHub {
     owner = "alembic";
     repo = "alembic";
     rev = version;
-    sha256 = "sha256-8dQhOQN0t2Y2kC2wOpQUqbu6Woy4DUmiLqXjf1D+mxE=";
+    sha256 = "sha256-wJVx0rwK0Qk07jlP0DyEAZUrAD+47qcVXSnTh5ngZG8=";
   };
 
   # note: out is unused (but required for outputDoc anyway)
diff --git a/pkgs/development/libraries/grantlee/5/default.nix b/pkgs/development/libraries/grantlee/5/default.nix
index 56899b1f8978..b115e1c8d7b6 100644
--- a/pkgs/development/libraries/grantlee/5/default.nix
+++ b/pkgs/development/libraries/grantlee/5/default.nix
@@ -2,14 +2,14 @@
 
 mkDerivation rec {
   pname = "grantlee";
-  version = "5.2.0";
+  version = "5.3.1";
   grantleePluginPrefix = "lib/grantlee/${lib.versions.majorMinor version}";
 
   src = fetchFromGitHub {
     owner = "steveire";
     repo = "grantlee";
     rev = "v${version}";
-    sha256 = "sha256-mAbgzdBdIW1wOTQNBePQuyTgkKdpn1c+zR3H7mXHvgk=";
+    sha256 = "sha256-enP7b6A7Ndew2LJH569fN3IgPu2/KL5rCmU/jmKb9sY=";
   };
 
   buildInputs = [ qtbase qtscript ];
diff --git a/pkgs/development/libraries/grantlee/5/grantlee-no-canonicalize-filepath.patch b/pkgs/development/libraries/grantlee/5/grantlee-no-canonicalize-filepath.patch
index 64eb11c3f156..b29911bcfcdb 100644
--- a/pkgs/development/libraries/grantlee/5/grantlee-no-canonicalize-filepath.patch
+++ b/pkgs/development/libraries/grantlee/5/grantlee-no-canonicalize-filepath.patch
@@ -9,7 +9,7 @@ Index: grantlee-5.1.0/templates/lib/templateloader.cpp
 -    if (file.exists()
 -        && !fi.canonicalFilePath().contains(
 -            QDir(d->m_templateDirs.at(i)).canonicalPath()))
--      return Template();
+-      return {};
      ++i;
    }
 
diff --git a/pkgs/development/libraries/hunspell/dictionaries.nix b/pkgs/development/libraries/hunspell/dictionaries.nix
index 17c73c118cec..1f1f5a687a4b 100644
--- a/pkgs/development/libraries/hunspell/dictionaries.nix
+++ b/pkgs/development/libraries/hunspell/dictionaries.nix
@@ -828,14 +828,14 @@ rec {
   th_TH = th-th;
   th-th = mkDict {
     pname = "hunspell-dict-th-th";
-    version = "experimental-2021-12-20";
+    version = "experimental-2023-03-01";
     dictFileName = "th_TH";
     readmeFile = "README.md";
     src = fetchFromGitHub {
       owner = "SyafiqHadzir";
       repo = "Hunspell-TH";
-      rev = "f119e58e5f6954965d6abd683e7d4c4b9be2684f";
-      sha256 = "sha256-hwqKvuLxbtzxfyQ5YhC/sdb3QQwxCfzgDOHeatxDjxM=";
+      rev = "9c09f1b7c0eb4d04b9f6f427901686c5c3d9fa54";
+      sha256 = "1wszpnbgj31k72x1vvcfkzcpmxsncdpqsi3zagah7swilpi7cqm4";
     };
     meta = with lib; {
       description = "Hunspell dictionary for Central Thai (Thailand)";
diff --git a/pkgs/development/libraries/kde-frameworks/kiconthemes/default.nix b/pkgs/development/libraries/kde-frameworks/kiconthemes/default.nix
index f807193718d5..564e3ae25371 100644
--- a/pkgs/development/libraries/kde-frameworks/kiconthemes/default.nix
+++ b/pkgs/development/libraries/kde-frameworks/kiconthemes/default.nix
@@ -1,5 +1,5 @@
 {
-  mkDerivation,
+  mkDerivation, fetchpatch,
   extra-cmake-modules,
   breeze-icons, karchive, kcoreaddons, kconfigwidgets, ki18n, kitemviews,
   qtbase, qtsvg, qttools,
@@ -9,6 +9,12 @@ mkDerivation {
   pname = "kiconthemes";
   patches = [
     ./default-theme-breeze.patch
+
+    # fix compile error
+    (fetchpatch {
+      url = "https://invent.kde.org/frameworks/kiconthemes/-/commit/d5d04e3c3fa92fbfd95eced39c3e272b8980563d.patch";
+      hash = "sha256-8YGWJg7+LrPpezW8ubObcFovI5DCVn3gbdH7KDdEeQw=";
+    })
   ];
   nativeBuildInputs = [ extra-cmake-modules ];
   buildInputs = [
diff --git a/pkgs/development/libraries/kirigami-addons/default.nix b/pkgs/development/libraries/kirigami-addons/default.nix
index fec795c5748f..ec3c19fe31bc 100644
--- a/pkgs/development/libraries/kirigami-addons/default.nix
+++ b/pkgs/development/libraries/kirigami-addons/default.nix
@@ -12,14 +12,14 @@
 
 mkDerivation rec {
   pname = "kirigami-addons";
-  version = "0.6";
+  version = "0.7.2";
 
   src = fetchFromGitLab {
     domain = "invent.kde.org";
     owner = "libraries";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-RUu/0O/YRVRsRYeASfW8UQ/Ql2VbLOdVySVo9/hAmLw=";
+    sha256 = "sha256-2s9ShwYd2hOb18WRA2nLst6Q4UBHvFL+g7Grpjclz9I=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/ktextaddons/default.nix b/pkgs/development/libraries/ktextaddons/default.nix
new file mode 100644
index 000000000000..b7286e7bea29
--- /dev/null
+++ b/pkgs/development/libraries/ktextaddons/default.nix
@@ -0,0 +1,20 @@
+{ lib, mkDerivation, fetchurl, cmake, extra-cmake-modules, karchive, kconfigwidgets, kcoreaddons, ki18n, kxmlgui, qtkeychain }:
+mkDerivation rec {
+  pname = "ktextaddons";
+  version = "1.1.0";
+
+  src = fetchurl {
+    url = "mirror://kde/stable/${pname}/${pname}-${version}.tar.xz";
+    hash = "sha256-BV1tHCD6kGI5Zj8PRZcEanLi1O7huS+qUijjtePDvik=";
+  };
+
+  nativeBuildInputs = [ cmake extra-cmake-modules ];
+  buildInputs = [ karchive kconfigwidgets kcoreaddons ki18n kxmlgui qtkeychain ];
+
+  meta = with lib; {
+    description = "Various text handling addons for KDE applications";
+    homepage = "https://invent.kde.org/libraries/ktextaddons/";
+    license = licenses.gpl2Plus;
+    maintainers = [];
+  };
+}
diff --git a/pkgs/development/libraries/nco/default.nix b/pkgs/development/libraries/nco/default.nix
index 46861f216c88..0a8e31273431 100644
--- a/pkgs/development/libraries/nco/default.nix
+++ b/pkgs/development/libraries/nco/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "nco";
-  version = "5.1.4";
+  version = "5.1.5";
 
   src = fetchFromGitHub {
     owner = "nco";
     repo = "nco";
     rev = version;
-    sha256 = "sha256-M2GP92SIs4B92Re8McGKIIjQJ+qXAr/TwDtFKcH/zsk=";
+    sha256 = "sha256-L1aAACWDVrPdl8IHSpch3l8EhdjAxOcUAZchKMYKWqY=";
   };
 
   nativeBuildInputs = [ flex which antlr2 ];
diff --git a/pkgs/development/libraries/openmpi/default.nix b/pkgs/development/libraries/openmpi/default.nix
index 1a9a5deb0d9a..e9a0fece56fc 100644
--- a/pkgs/development/libraries/openmpi/default.nix
+++ b/pkgs/development/libraries/openmpi/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, fetchpatch, gfortran, perl, libnl
+{ lib, stdenv, fetchurl, gfortran, perl, libnl
 , rdma-core, zlib, numactl, libevent, hwloc, targetPackages, symlinkJoin
 , libpsm2, libfabric, pmix, ucx
 
@@ -25,21 +25,13 @@ let
   };
 in stdenv.mkDerivation rec {
   pname = "openmpi";
-  version = "4.1.4";
+  version = "4.1.5";
 
   src = with lib.versions; fetchurl {
     url = "https://www.open-mpi.org/software/ompi/v${major version}.${minor version}/downloads/${pname}-${version}.tar.bz2";
-    sha256 = "03ckngrff1cl0l81vfvrfhp99rbgk7s0633kr1l468yibwbjx4cj";
+    sha256 = "sha256-pkCYa8JXOJ3TeYhv2uYmTIz6VryYtxzjrj372M5h2+M=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "RDMA-osc-perform-CAS-in-shared-memory-if-possible.patch";
-      url = "https://github.com/open-mpi/ompi/pull/10513/commits/0512c135a77a0278e5288e0e119dce24c95ebed4.patch";
-      sha256 = "sha256-K1Gc+hBUkTPY1WqLP6JWo623EUhkoL4ONrqPVDNfFuE=";
-    })
-  ];
-
   postPatch = ''
     patchShebangs ./
 
diff --git a/pkgs/development/libraries/wxsqlite3/default.nix b/pkgs/development/libraries/wxsqlite3/default.nix
index f09b5277d6a1..10b5558589a6 100644
--- a/pkgs/development/libraries/wxsqlite3/default.nix
+++ b/pkgs/development/libraries/wxsqlite3/default.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "wxsqlite3";
-  version = "4.9.2";
+  version = "4.9.3";
 
   src = fetchFromGitHub {
     owner = "utelle";
     repo = "wxsqlite3";
     rev = "v${version}";
-    hash = "sha256-LYQky0tIzZrxroa4korlE+RK2MJTVLgw3T2kGZOyY2s=";
+    hash = "sha256-HdsPCdZF1wMTGYFaXzq+f4bUFjgCAklsKhhdyMKaxp8=";
   };
 
   nativeBuildInputs = [ autoreconfHook ];
diff --git a/pkgs/development/ocaml-modules/lwd/default.nix b/pkgs/development/ocaml-modules/lwd/default.nix
new file mode 100644
index 000000000000..43e13bbcc893
--- /dev/null
+++ b/pkgs/development/ocaml-modules/lwd/default.nix
@@ -0,0 +1,24 @@
+{ lib, fetchurl, buildDunePackage, seq }:
+
+buildDunePackage rec {
+  pname = "lwd";
+  version = "0.3";
+
+  minimalOCamlVersion = "4.08";
+  duneVersion = "3";
+
+  src = fetchurl {
+    url =
+      "https://github.com/let-def/lwd/releases/download/v${version}/lwd-${version}.tbz";
+    sha256 = "sha256-H/vyW2tn2OBuWwcmPs8NcINXgFe93MSxRd8dzeoXARI=";
+  };
+
+  propagatedBuildInputs = [ seq ];
+
+  meta = with lib; {
+    description = "Lightweight reactive documents";
+    license = licenses.mit;
+    maintainers = [ maintainers.alizter ];
+    homepage = "https://github.com/let-def/lwd";
+  };
+}
diff --git a/pkgs/development/ocaml-modules/lwd/nottui-lwt.nix b/pkgs/development/ocaml-modules/lwd/nottui-lwt.nix
new file mode 100644
index 000000000000..84df8db4ea37
--- /dev/null
+++ b/pkgs/development/ocaml-modules/lwd/nottui-lwt.nix
@@ -0,0 +1,19 @@
+{ lib, fetchurl, buildDunePackage, lwd, lwt, nottui }:
+
+buildDunePackage {
+  pname = "nottui-lwt";
+
+  inherit (lwd) version src;
+
+  minimalOCamlVersion = "4.08";
+  duneVersion = "3";
+
+  propagatedBuildInputs = [ lwt nottui ];
+
+  meta = with lib; {
+    description = "Run Nottui UIs in Lwt";
+    license = licenses.mit;
+    maintainers = [ maintainers.alizter ];
+    homepage = "https://github.com/let-def/lwd";
+  };
+}
diff --git a/pkgs/development/ocaml-modules/lwd/nottui-pretty.nix b/pkgs/development/ocaml-modules/lwd/nottui-pretty.nix
new file mode 100644
index 000000000000..e411255c58c4
--- /dev/null
+++ b/pkgs/development/ocaml-modules/lwd/nottui-pretty.nix
@@ -0,0 +1,19 @@
+{ lib, fetchurl, buildDunePackage, lwd, nottui }:
+
+buildDunePackage {
+  pname = "nottui-pretty";
+
+  inherit (lwd) version src;
+
+  minimalOCamlVersion = "4.08";
+  duneVersion = "3";
+
+  propagatedBuildInputs = [ nottui ];
+
+  meta = with lib; {
+    description = "A pretty-printer based on PPrint rendering UIs";
+    license = licenses.mit;
+    maintainers = [ maintainers.alizter ];
+    homepage = "https://github.com/let-def/lwd";
+  };
+}
diff --git a/pkgs/development/ocaml-modules/lwd/nottui.nix b/pkgs/development/ocaml-modules/lwd/nottui.nix
new file mode 100644
index 000000000000..6427ca9630c4
--- /dev/null
+++ b/pkgs/development/ocaml-modules/lwd/nottui.nix
@@ -0,0 +1,19 @@
+{ lib, fetchurl, buildDunePackage, lwd, notty }:
+
+buildDunePackage {
+  pname = "nottui";
+
+  inherit (lwd) version src;
+
+  minimalOCamlVersion = "4.08";
+  duneVersion = "3";
+
+  propagatedBuildInputs = [ lwd notty ];
+
+  meta = with lib; {
+    description = "UI toolkit for the terminal built on top of Notty and Lwd";
+    license = licenses.mit;
+    maintainers = [ maintainers.alizter ];
+    homepage = "https://github.com/let-def/lwd";
+  };
+}
diff --git a/pkgs/development/ocaml-modules/lwd/tyxml-lwd.nix b/pkgs/development/ocaml-modules/lwd/tyxml-lwd.nix
new file mode 100644
index 000000000000..0832847be3d6
--- /dev/null
+++ b/pkgs/development/ocaml-modules/lwd/tyxml-lwd.nix
@@ -0,0 +1,20 @@
+{ lib, fetchurl, buildDunePackage, js_of_ocaml, js_of_ocaml-ppx, lwd, tyxml }:
+
+buildDunePackage {
+  pname = "tyxml-lwd";
+
+  inherit (lwd) version src;
+
+  minimalOCamlVersion = "4.08";
+  duneVersion = "3";
+
+  buildInputs = [ js_of_ocaml-ppx ];
+  propagatedBuildInputs = [ js_of_ocaml lwd tyxml ];
+
+  meta = with lib; {
+    description = "Make reactive webpages in Js_of_ocaml using Tyxml and Lwd";
+    license = licenses.mit;
+    maintainers = [ maintainers.alizter ];
+    homepage = "https://github.com/let-def/lwd";
+  };
+}
diff --git a/pkgs/development/python-modules/mypy/default.nix b/pkgs/development/python-modules/mypy/default.nix
index e7debfaceb87..012c952a9800 100644
--- a/pkgs/development/python-modules/mypy/default.nix
+++ b/pkgs/development/python-modules/mypy/default.nix
@@ -53,8 +53,9 @@ buildPythonPackage rec {
     })
     (fetchpatch {
       # https://github.com/python/mypy/pull/14787
-      url = "https://github.com/AlexWaygood/mypy/commit/8e459eab40ac0fae9740e985ee4aeb348cde28c5.patch";
-      hash = "sha256-R7DU6MFnaeHPobUb8ADhssTKDwdPBXBhDN2mxrrQ51M=";
+      url = "https://github.com/python/mypy/commit/243f584d43e6eb316920f3155067ce7c1b65d473.patch";
+      hash = "sha256-uuh3S5ZyuJeTXyMvav2uSEao2qq23xMjK8rJjkY8RCY=";
+      includes = [ "mypyc/build.py" ];
     })
   ];
 
diff --git a/pkgs/development/python-modules/pyvista/default.nix b/pkgs/development/python-modules/pyvista/default.nix
index 58887ed32468..6b2903d7ba20 100644
--- a/pkgs/development/python-modules/pyvista/default.nix
+++ b/pkgs/development/python-modules/pyvista/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "pyvista";
-  version = "0.38.4";
+  version = "0.38.5";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-lOubi5di7K/Q/N/VMPMqC5hr3q69PR+4EgL+zde9j78=";
+    hash = "sha256-2EH9S67xj3Z2wHWAvBt7alZPZj5/K5787cQnE53lzA0=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/rpy2/default.nix b/pkgs/development/python-modules/rpy2/default.nix
index 94e5027c5b3f..58af90fe076c 100644
--- a/pkgs/development/python-modules/rpy2/default.nix
+++ b/pkgs/development/python-modules/rpy2/default.nix
@@ -24,13 +24,13 @@
 }:
 
 buildPythonPackage rec {
-    version = "3.5.9";
+    version = "3.5.10";
     pname = "rpy2";
 
     disabled = isPyPy;
     src = fetchPypi {
       inherit version pname;
-      hash = "sha256-iaDX40Bld5VVjg22v52PE5VCi6EYr5AjUV3ako5pRPA=";
+      hash = "sha256-+B8K+wHjxvUVwJVzvFhcDhx+OF7IFBXOCmImjGBex/w=";
     };
 
     patches = [
diff --git a/pkgs/development/python-modules/xml2rfc/default.nix b/pkgs/development/python-modules/xml2rfc/default.nix
index ff8451da3c08..54b462203bfd 100644
--- a/pkgs/development/python-modules/xml2rfc/default.nix
+++ b/pkgs/development/python-modules/xml2rfc/default.nix
@@ -26,7 +26,7 @@
 
 buildPythonPackage rec {
   pname = "xml2rfc";
-  version = "3.16.0";
+  version = "3.17.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -35,7 +35,7 @@ buildPythonPackage rec {
     owner = "ietf-tools";
     repo = "xml2rfc";
     rev = "refs/tags/v${version}";
-    hash = "sha256-H2m6WZTIu2xLIz3ysOZcicIibPj8mErrxYM2+F07aS0=";
+    hash = "sha256-xG0MCAOA5LmyX5LgJVOKfZS7xM7sJHs9L4kZP2lmlnY=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/tools/analysis/checkstyle/default.nix b/pkgs/development/tools/analysis/checkstyle/default.nix
index 60824f2601e7..93f26dc7d598 100644
--- a/pkgs/development/tools/analysis/checkstyle/default.nix
+++ b/pkgs/development/tools/analysis/checkstyle/default.nix
@@ -1,12 +1,12 @@
 { lib, stdenv, fetchurl, makeWrapper, jre }:
 
 stdenv.mkDerivation rec {
-  version = "10.8.1";
+  version = "10.9.2";
   pname = "checkstyle";
 
   src = fetchurl {
     url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-${version}/checkstyle-${version}-all.jar";
-    sha256 = "sha256-xVtouHBS5zR62WsPSn2mPlxce4Hn6JZLDwg2saCOrL0=";
+    sha256 = "sha256-XsWzSg/bwP+O454oQSVDrvmjWKVZpLyfGB47olqRSUY=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/development/tools/analysis/kcov/default.nix b/pkgs/development/tools/analysis/kcov/default.nix
index 6a0fb74af51f..95838c9c27fd 100644
--- a/pkgs/development/tools/analysis/kcov/default.nix
+++ b/pkgs/development/tools/analysis/kcov/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , cmake
 , pkg-config
 , zlib
@@ -10,8 +9,7 @@
 , python3
 , libiberty
 , libopcodes
-, runCommand
-, gcc
+, runCommandCC
 , rustc
 }:
 
@@ -19,25 +17,15 @@ let
   self =
     stdenv.mkDerivation rec {
       pname = "kcov";
-      version = "38";
+      version = "41";
 
       src = fetchFromGitHub {
         owner = "SimonKagstrom";
         repo = "kcov";
         rev = "v${version}";
-        sha256 = "sha256-6LoIo2/yMUz8qIpwJVcA3qZjjF+8KEM1MyHuyHsQD38=";
+        sha256 = "sha256-Kit4Yn5Qeg3uAc6+RxwlVEhDKN6at+Uc7V38yhDPrAY=";
       };
 
-      patches = [
-        # Pull upstream patch for binutils-2/39 support:
-        #   https://github.com/SimonKagstrom/kcov/pull/383
-        (fetchpatch {
-          name = "binutils-2.39.patch";
-          url = "https://github.com/SimonKagstrom/kcov/commit/fd1a4fd2f02cee49afd74e427e38c61b89154582.patch";
-          hash = "sha256-licQkC8qDg2i6No3j0yKEU6i+Owi4lhrnfGvETkzz7w=";
-        })
-      ];
-
       preConfigure = "patchShebangs src/bin-to-c-source.py";
       nativeBuildInputs = [ cmake pkg-config python3 ];
 
@@ -46,25 +34,25 @@ let
       strictDeps = true;
 
       passthru.tests = {
-        works-on-c = runCommand "works-on-c" {} ''
+        works-on-c = runCommandCC "works-on-c" { } ''
           set -ex
           cat - > a.c <<EOF
           int main() {}
           EOF
-          ${gcc}/bin/gcc a.c -o a.out
+          $CC a.c -o a.out
           ${self}/bin/kcov /tmp/kcov ./a.out
           test -e /tmp/kcov/index.html
           touch $out
           set +x
         '';
 
-        works-on-rust = runCommand "works-on-rust" {} ''
+        works-on-rust = runCommandCC "works-on-rust" { nativeBuildInputs = [ rustc ]; } ''
           set -ex
           cat - > a.rs <<EOF
           fn main() {}
           EOF
           # Put gcc in the path so that `cc` is found
-          PATH=${gcc}/bin:$PATH ${rustc}/bin/rustc a.rs -o a.out
+          rustc a.rs -o a.out
           ${self}/bin/kcov /tmp/kcov ./a.out
           test -e /tmp/kcov/index.html
           touch $out
diff --git a/pkgs/development/tools/continuous-integration/buildkite-agent/default.nix b/pkgs/development/tools/continuous-integration/buildkite-agent/default.nix
index 3d1932f3eb04..0655246fc671 100644
--- a/pkgs/development/tools/continuous-integration/buildkite-agent/default.nix
+++ b/pkgs/development/tools/continuous-integration/buildkite-agent/default.nix
@@ -3,16 +3,16 @@
   nixosTests }:
 buildGoModule rec {
   pname = "buildkite-agent";
-  version = "3.44.0";
+  version = "3.45.0";
 
   src = fetchFromGitHub {
     owner = "buildkite";
     repo = "agent";
     rev = "v${version}";
-    sha256 = "sha256-iN6Q+HXaZgUt8kXDGG5e1hY0/g/JYSHQ768YYRwZsuw=";
+    sha256 = "sha256-T1B9eo0LVN5FMI76TJQ4yxIXOfqT9wHNO5DHfVaWHBA=";
   };
 
-  vendorHash = "sha256-I+tjSBfAvRyE0bjVRloAkb5Jftb6dxoq8lNSgWHAcVk=";
+  vendorHash = "sha256-kxqwGJBm5cT0ay29TlAqq3cFWheLqMwX/MtHpaHohBc=";
 
   postPatch = ''
     substituteInPlace bootstrap/shell/shell.go --replace /bin/bash ${bash}/bin/bash
diff --git a/pkgs/development/tools/datree/default.nix b/pkgs/development/tools/datree/default.nix
index ec8dcf94a698..293fb5b1e1f6 100644
--- a/pkgs/development/tools/datree/default.nix
+++ b/pkgs/development/tools/datree/default.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "datree";
-  version = "1.8.39";
+  version = "1.8.42";
 
   src = fetchFromGitHub {
     owner = "datreeio";
     repo = "datree";
     rev = "refs/tags/${version}";
-    hash = "sha256-kTN1c16AIXnnSi1lN378u/kmuC1axZT2LAOH+LGLVbA=";
+    hash = "sha256-8oA0AgmEARlX8q1FjeFFOSMN9hing/4z3zqfqzhMyfs=";
   };
 
-  vendorHash = "sha256-mkVguYzjNGgFUdATjGfenCx3h97LS3SEOkYo3CuP9fA=";
+  vendorHash = "sha256-MrVIpr2iwddW3yUeBuDfeg+Xo9Iarr/fp4Rc4WGYGeU=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/development/tools/misc/patchelf/unstable.nix b/pkgs/development/tools/misc/patchelf/unstable.nix
index 66c14bd07e0e..3f20cb7834f5 100644
--- a/pkgs/development/tools/misc/patchelf/unstable.nix
+++ b/pkgs/development/tools/misc/patchelf/unstable.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "patchelf";
-  version = "unstable-2023-03-07";
+  version = "unstable-2023-03-18";
 
   src = fetchFromGitHub {
     owner = "NixOS";
     repo = "patchelf";
-    rev = "ea2fca765c440fff1ff74e1463444dea7b819db2";
-    sha256 = "sha256-IH80NcLhwjGpIXEjHuV+NgaSC+Y/PXquxZ/C8Bl+CLk=";
+    rev = "265b31ae22c6e1d20b01295aaa7bcf28fd31a5cf";
+    sha256 = "sha256-+iGvdjXvhk5mN8jp3u+M9fICKFqbtyZCx+WjQszaB1o=";
   };
 
   # Drop test that fails on musl (?)
diff --git a/pkgs/os-specific/linux/ch9344/default.nix b/pkgs/os-specific/linux/ch9344/default.nix
new file mode 100644
index 000000000000..25d7ecf02552
--- /dev/null
+++ b/pkgs/os-specific/linux/ch9344/default.nix
@@ -0,0 +1,48 @@
+{ stdenv, lib, fetchzip, kernel }:
+
+stdenv.mkDerivation rec {
+  pname = "ch9344";
+  version = "1.9";
+
+  src = fetchzip {
+    name = "CH9344SER_LINUX.zip";
+    url = "https://www.wch.cn/downloads/file/386.html#CH9344SER_LINUX.zip";
+    hash = "sha256-g55ftAfjKKlUFzGhI1a/O7Eqbz6rkGf1vWuEJjBZxBE=";
+  };
+
+  patches = lib.optionals (lib.versionAtLeast kernel.modDirVersion "6.1") [
+    # https://github.com/torvalds/linux/commit/a8c11c1520347be74b02312d10ef686b01b525f1
+    ./fix-incompatible-pointer-types.patch
+  ];
+
+  sourceRoot = "${src.name}/driver";
+  hardeningDisable = [ "pic" ];
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  preBuild = ''
+    substituteInPlace Makefile --replace "KERNELDIR :=" "KERNELDIR ?="
+  '';
+
+  makeFlags = [
+    "KERNELDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+  ];
+
+  installPhase = ''
+    runHook preInstall
+    install -D ch9344.ko $out/lib/modules/${kernel.modDirVersion}/usb/serial/ch9344.ko
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    homepage = "http://www.wch-ic.com/";
+    downloadPage = "https://www.wch.cn/downloads/CH9344SER_LINUX_ZIP.html";
+    description = "WCH CH9344/CH348 UART driver";
+    longDescription = ''
+      A kernel module for WinChipHead CH9344/CH348 USB To Multi Serial Ports controller.
+    '';
+    # Archive contains no license.
+    license = licenses.unfree;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ MakiseKurisu ];
+  };
+}
diff --git a/pkgs/os-specific/linux/ch9344/fix-incompatible-pointer-types.patch b/pkgs/os-specific/linux/ch9344/fix-incompatible-pointer-types.patch
new file mode 100644
index 000000000000..31088538733e
--- /dev/null
+++ b/pkgs/os-specific/linux/ch9344/fix-incompatible-pointer-types.patch
@@ -0,0 +1,22 @@
+diff --git a/ch9344.c b/ch9344.c
+index 1e37293..a16af82 100644
+--- a/ch9344.c
++++ b/ch9344.c
+@@ -79,7 +79,7 @@ static DEFINE_IDR(ch9344_minors);
+ static DEFINE_MUTEX(ch9344_minors_lock);
+ 
+ static void ch9344_tty_set_termios(struct tty_struct *tty,
+-                                   struct ktermios *termios_old);
++                                   const struct ktermios *termios_old);
+ 
+ static int ch9344_get_portnum(int index);
+ 
+@@ -1597,7 +1597,7 @@ u8 cal_recv_tmt(__le32 bd)
+ }
+ 
+ static void ch9344_tty_set_termios(struct tty_struct *tty,
+-                                   struct ktermios *termios_old)
++                                   const struct ktermios *termios_old)
+ {
+     struct ch9344 *ch9344 = tty->driver_data;
+     struct ktermios *termios = &tty->termios;
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index 4b1318d91159..7f84c53d4d64 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -283,6 +283,15 @@ let
       DRM_SIMPLEDRM = whenAtLeast "5.14" no;
     };
 
+    fonts = {
+      FONTS = yes;
+      # Default fonts enabled if FONTS is not set
+      FONT_8x8 = yes;
+      FONT_8x16 = yes;
+      # High DPI font
+      FONT_TER16x32 = whenAtLeast "5.0" yes;
+    };
+
     video = {
       DRM_LEGACY = no;
       NOUVEAU_LEGACY_CTX_SUPPORT = whenBetween "5.2" "6.3" no;
diff --git a/pkgs/servers/komga/default.nix b/pkgs/servers/komga/default.nix
index 1f651a5f46e5..7e0aeb3b2303 100644
--- a/pkgs/servers/komga/default.nix
+++ b/pkgs/servers/komga/default.nix
@@ -8,11 +8,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "komga";
-  version = "0.163.0";
+  version = "0.164.0";
 
   src = fetchurl {
     url = "https://github.com/gotson/${pname}/releases/download/v${version}/${pname}-${version}.jar";
-    sha256 = "sha256-dKbdzfjb+brY++uflVvuF1LaOIaYn1UqIGIjCsyLMv8=";
+    sha256 = "sha256-p0pBnRn++XblmOS1WdHm5VVYvg0fPz/B3QCepOvBfYk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/servers/monitoring/cockpit/default.nix b/pkgs/servers/monitoring/cockpit/default.nix
index 76f2f777f60c..3fe0c17ded93 100644
--- a/pkgs/servers/monitoring/cockpit/default.nix
+++ b/pkgs/servers/monitoring/cockpit/default.nix
@@ -47,13 +47,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "cockpit";
-  version = "284";
+  version = "287";
 
   src = fetchFromGitHub {
     owner = "cockpit-project";
     repo = "cockpit";
-    rev = "80a7c7cfed9157915067666fe95b298896f2aea8";
-    sha256 = "sha256-iAIW6nVUk1FJD2dQvDMREPVqrq0JkExJ7lVio//ALts=";
+    rev = "refs/tags/${version}";
+    sha256 = "sha256-tIZOI3jiMRaGHMXS1mA1Tom9ij3L/VuxDUJdnEc7SSc=";
     fetchSubmodules = true;
   };
 
@@ -88,23 +88,25 @@ stdenv.mkDerivation rec {
     udev
   ];
 
-  patches = [
+  postPatch = ''
     # Instead of requiring Internet access to do an npm install to generate the package-lock.json
     # it copies the package-lock.json already present in the node_modules folder fetched as a git
     # submodule.
-    ./nerf-node-modules.patch
+    echo "#!/bin/sh" > test/node_modules
 
-    # sysconfdir is $(prefix)/etc by default and it breaks the configuration file loading feature
-    # changing sysconfdir to /etc breaks the build in this part of the makefile because it tries
-    # to write to /etc inside the sandbox
-    # this patch redirects it to write to $out/etc instead of /etc
-    ./fix-makefiles.patch
-  ];
+    substituteInPlace src/tls/cockpit-certificate-helper.in \
+      --replace 'COCKPIT_CONFIG="@sysconfdir@/cockpit"' 'COCKPIT_CONFIG=/etc/cockpit'
+
+    substituteInPlace src/tls/cockpit-certificate-ensure.c \
+      --replace '#define COCKPIT_SELFSIGNED_PATH      PACKAGE_SYSCONF_DIR COCKPIT_SELFSIGNED_FILENAME' '#define COCKPIT_SELFSIGNED_PATH      "/etc" COCKPIT_SELFSIGNED_FILENAME'
+
+    substituteInPlace src/common/cockpitconf.c \
+      --replace 'const char *cockpit_config_dirs[] = { PACKAGE_SYSCONF_DIR' 'const char *cockpit_config_dirs[] = { "/etc"'
 
-  postPatch = ''
     # instruct users with problems to create a nixpkgs issue instead of nagging upstream directly
     substituteInPlace configure.ac \
       --replace 'devel@lists.cockpit-project.org' 'https://github.com/NixOS/nixpkgs/issues/new?assignees=&labels=0.kind%3A+bug&template=bug_report.md&title=cockpit%25'
+
     patchShebangs \
       test/common/pixel-tests \
       test/common/run-tests \
@@ -114,7 +116,7 @@ stdenv.mkDerivation rec {
       tools/make-compile-commands \
       tools/node-modules \
       tools/termschutz \
-      tools/webpack-make
+      tools/webpack-make.js
 
     for f in node_modules/.bin/*; do
       patchShebangs $(realpath $f)
@@ -145,7 +147,6 @@ stdenv.mkDerivation rec {
 
   configureFlags = [
     "--enable-prefix-only=yes"
-    "--sysconfdir=/etc"
     "--disable-pcp" # TODO: figure out how to package its dependency
     "--with-default-session-path=/run/wrappers/bin:/run/current-system/sw/bin"
   ];
@@ -158,7 +159,6 @@ stdenv.mkDerivation rec {
   '';
 
   postBuild = ''
-    find | grep cockpit-bridge
     chmod +x \
       src/systemd/update-motd \
       src/tls/cockpit-certificate-helper \
@@ -215,7 +215,10 @@ stdenv.mkDerivation rec {
     npm run stylelint
   '';
 
-  passthru.tests = { inherit (nixosTests) cockpit; };
+  passthru = {
+    tests = { inherit (nixosTests) cockpit; };
+    updateScript = ./update.sh;
+  };
 
   meta = with lib; {
     description = "Web-based graphical interface for servers";
diff --git a/pkgs/servers/monitoring/cockpit/fix-makefiles.patch b/pkgs/servers/monitoring/cockpit/fix-makefiles.patch
deleted file mode 100644
index a22eb9f00ea8..000000000000
--- a/pkgs/servers/monitoring/cockpit/fix-makefiles.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-diff --git a/src/systemd/Makefile.am b/src/systemd/Makefile.am
-index f28ea41df..684b82006 100644
---- a/src/systemd/Makefile.am
-+++ b/src/systemd/Makefile.am
-@@ -23,10 +23,10 @@ dist_motd_SCRIPTS = src/systemd/update-motd
- 
- # Automake: 'Variables using ... ‘sysconf’ ... are installed by install-exec.'
- install-exec-hook::
--	mkdir -p $(DESTDIR)$(sysconfdir)/motd.d
--	ln -sTfr $(DESTDIR)/run/cockpit/motd $(DESTDIR)$(sysconfdir)/motd.d/cockpit
--	mkdir -p $(DESTDIR)$(sysconfdir)/issue.d
--	ln -sTfr $(DESTDIR)/run/cockpit/motd $(DESTDIR)$(sysconfdir)/issue.d/cockpit.issue
-+	mkdir -p $(DESTDIR)$(prefix)$(sysconfdir)/motd.d
-+	ln -sTfr $(DESTDIR)$(prefix)/run/cockpit/motd $(DESTDIR)$(prefix)$(sysconfdir)/motd.d/cockpit
-+	mkdir -p $(DESTDIR)$(prefix)$(sysconfdir)/issue.d
-+	ln -sTfr $(DESTDIR)$(prefix)/run/cockpit/motd $(DESTDIR)$(prefix)$(sysconfdir)/issue.d/cockpit.issue
- 
- tempconfdir = $(prefix)/lib/tmpfiles.d
- nodist_tempconf_DATA = src/systemd/cockpit-tempfiles.conf
-diff --git a/src/ws/Makefile-ws.am b/src/ws/Makefile-ws.am
-index ed4e4363e..77a35b0e5 100644
---- a/src/ws/Makefile-ws.am
-+++ b/src/ws/Makefile-ws.am
-@@ -169,8 +169,8 @@ install-tests::
- 	$(INSTALL_DATA) mock-pam-conv-mod.so $(DESTDIR)$(pamdir)/
- 
- install-exec-hook::
--	mkdir -p $(DESTDIR)$(sysconfdir)/cockpit/ws-certs.d $(DESTDIR)$(sysconfdir)/cockpit/machines.d
--	chmod 755 $(DESTDIR)$(sysconfdir)/cockpit/ws-certs.d $(DESTDIR)$(sysconfdir)/cockpit/machines.d
-+	mkdir -p $(DESTDIR)$(prefix)$(sysconfdir)/cockpit/ws-certs.d $(DESTDIR)$(prefix)$(sysconfdir)/cockpit/machines.d
-+	chmod 755 $(DESTDIR)$(prefix)$(sysconfdir)/cockpit/ws-certs.d $(DESTDIR)$(prefix)$(sysconfdir)/cockpit/machines.d
- 
- dist_check_DATA += \
- 	src/ws/mock-combined.crt \
diff --git a/pkgs/servers/monitoring/cockpit/nerf-node-modules.patch b/pkgs/servers/monitoring/cockpit/nerf-node-modules.patch
deleted file mode 100644
index 36b0e3861a4a..000000000000
--- a/pkgs/servers/monitoring/cockpit/nerf-node-modules.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff --git a/tools/node-modules b/tools/node-modules
-index 518875d..72b51e0 100755
---- a/tools/node-modules
-+++ b/tools/node-modules
-@@ -7,6 +7,7 @@ V="${V-0}" # default to friendly messages
- 
- set -eu
- cd "${0%/*}/.."
-+exit 0
- . tools/git-utils.sh
- 
- cmd_remove() {
diff --git a/pkgs/servers/monitoring/cockpit/update.sh b/pkgs/servers/monitoring/cockpit/update.sh
new file mode 100755
index 000000000000..c1834db9d39c
--- /dev/null
+++ b/pkgs/servers/monitoring/cockpit/update.sh
@@ -0,0 +1,8 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl jq common-updater-scripts
+
+set -eu -o pipefail
+
+version="$(curl --silent "https://api.github.com/repos/cockpit-project/cockpit/releases" | jq '.[0].tag_name' --raw-output)"
+
+update-source-version cockpit "$version"
diff --git a/pkgs/servers/onlyoffice-documentserver/default.nix b/pkgs/servers/onlyoffice-documentserver/default.nix
index c79548a0e9f9..2c30cb0e18e7 100644
--- a/pkgs/servers/onlyoffice-documentserver/default.nix
+++ b/pkgs/servers/onlyoffice-documentserver/default.nix
@@ -15,11 +15,11 @@ let
   # var/www/onlyoffice/documentserver/server/DocService/docservice
   onlyoffice-documentserver = stdenv.mkDerivation rec {
     pname = "onlyoffice-documentserver";
-    version = "7.3.2";
+    version = "7.3.3";
 
     src = fetchurl {
       url = "https://github.com/ONLYOFFICE/DocumentServer/releases/download/v${lib.concatStringsSep "." (lib.take 3 (lib.splitVersion version))}/onlyoffice-documentserver_amd64.deb";
-      sha256 = "sha256-BXKf5M10/ICxSDXJDmJB+T3HSsVXzSs5gu1AApUra3I=";
+      sha256 = "sha256-WeDXIDrjICGDVnpkdGLyA9plW50Kz3bHXU48DdHReHM=";
     };
 
     preferLocalBuild = true;
diff --git a/pkgs/servers/zoneminder/default.nix b/pkgs/servers/zoneminder/default.nix
index 80ff140122fd..503f7b04cd28 100644
--- a/pkgs/servers/zoneminder/default.nix
+++ b/pkgs/servers/zoneminder/default.nix
@@ -57,13 +57,13 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "zoneminder";
-  version = "1.36.32";
+  version = "1.36.33";
 
   src = fetchFromGitHub {
     owner  = "ZoneMinder";
     repo   = "zoneminder";
     rev    = version;
-    sha256 = "sha256-8iRoGpkpZVOOr0wSY9iey2x4gPfKTfUNtt5TCHCCRIQ=";
+    sha256 = "sha256-KUhFZrF7BuLB2Z3LnTcHEEZVA6iosam6YsOd8KWvx7E=";
     fetchSubmodules = true;
   };
 
@@ -116,6 +116,12 @@ in stdenv.mkDerivation rec {
         --replace "'ffmpeg " "'${ffmpeg}/bin/ffmpeg "
     done
 
+    for f in scripts/ZoneMinder/lib/ZoneMinder/Event.pm \
+             scripts/ZoneMinder/lib/ZoneMinder/Storage.pm ; do
+      substituteInPlace $f \
+        --replace '/bin/rm' "${coreutils}/bin/rm"
+    done
+
     substituteInPlace web/includes/functions.php \
       --replace "'date " "'${coreutils}/bin/date " \
       --subst-var-by srcHash "`basename $out`"
diff --git a/pkgs/tools/admin/pulumi-packages/default.nix b/pkgs/tools/admin/pulumi-packages/default.nix
index 588214980782..5aed6b171783 100644
--- a/pkgs/tools/admin/pulumi-packages/default.nix
+++ b/pkgs/tools/admin/pulumi-packages/default.nix
@@ -7,6 +7,7 @@ in
   pulumi-aws-native = callPackage' ./pulumi-aws-native.nix { };
   pulumi-azure-native = callPackage' ./pulumi-azure-native.nix { };
   pulumi-command = callPackage' ./pulumi-command.nix { };
+  pulumi-language-go = callPackage ./pulumi-language-go.nix { };
   pulumi-language-nodejs = callPackage ./pulumi-language-nodejs.nix { };
   pulumi-language-python = callPackage ./pulumi-language-python.nix { };
   pulumi-random = callPackage' ./pulumi-random.nix { };
diff --git a/pkgs/tools/admin/pulumi-packages/pulumi-language-go.nix b/pkgs/tools/admin/pulumi-packages/pulumi-language-go.nix
new file mode 100644
index 000000000000..b43fdbe67270
--- /dev/null
+++ b/pkgs/tools/admin/pulumi-packages/pulumi-language-go.nix
@@ -0,0 +1,27 @@
+{ lib
+, buildGoModule
+, pulumi
+}:
+buildGoModule rec {
+  pname = "pulumi-language-go";
+  inherit (pulumi) version src;
+
+  sourceRoot = "${src.name}/sdk";
+
+  vendorHash = pulumi.sdkVendorHash;
+
+  subPackages = [
+    "go/pulumi-language-go"
+  ];
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/pulumi/pulumi/sdk/v3/go/common/version.Version=${version}"
+  ];
+  meta = with lib; {
+    description = "Golang language host plugin for Pulumi";
+    homepage = "https://github.com/pulumi/pulumi/tree/master/sdk/go";
+    license = licenses.asl20;
+  };
+}
diff --git a/pkgs/tools/games/steamtinkerlaunch/default.nix b/pkgs/tools/games/steamtinkerlaunch/default.nix
index d780ba1ddf61..ea64c7208bc9 100644
--- a/pkgs/tools/games/steamtinkerlaunch/default.nix
+++ b/pkgs/tools/games/steamtinkerlaunch/default.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation rec {
   pname = "steamtinkerlaunch";
-  version = "12.0";
+  version = "12.12";
 
   src = fetchFromGitHub {
     owner = "sonic2kk";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-cEGERh0INc/xetQhALqc+lp/HNDoy3JdTZr/nHlthYc=";
+    hash = "sha256-oigHNfg5rHxRabwUs66ye+chJzivmCIw8mg/GaJLPkg=";
   };
 
   # hardcode PROGCMD because #150841
diff --git a/pkgs/tools/misc/archi/default.nix b/pkgs/tools/misc/archi/default.nix
index 14465cc3a945..c9a647d000a0 100644
--- a/pkgs/tools/misc/archi/default.nix
+++ b/pkgs/tools/misc/archi/default.nix
@@ -5,6 +5,8 @@
 , makeWrapper
 , jdk
 , libsecret
+, webkitgtk
+, wrapGAppsHook
 }:
 
 stdenv.mkDerivation rec {
@@ -31,6 +33,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     makeWrapper
+    wrapGAppsHook
   ] ++ lib.optional stdenv.hostPlatform.isLinux autoPatchelfHook;
 
   installPhase =
@@ -43,6 +46,7 @@ stdenv.mkDerivation rec {
 
         install -D -m755 Archi $out/libexec/Archi
         makeWrapper $out/libexec/Archi $out/bin/Archi \
+          --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath ([ webkitgtk ])} \
           --prefix PATH : ${jdk}/bin
       ''
     else
diff --git a/pkgs/tools/misc/qmake2cmake/default.nix b/pkgs/tools/misc/qmake2cmake/default.nix
index b00d43a193a2..7ed349af31c1 100644
--- a/pkgs/tools/misc/qmake2cmake/default.nix
+++ b/pkgs/tools/misc/qmake2cmake/default.nix
@@ -3,18 +3,19 @@
 , fetchgit
 , packaging
 , portalocker
+, pyparsing
 , sympy
 , pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "qmake2cmake";
-  version = "1.0.2";
+  version = "1.0.3";
 
   src = fetchgit {
     url = "https://codereview.qt-project.org/qt/qmake2cmake";
     rev = "v${version}";
-    hash = "sha256-Ibi7tIaMI44POfoRfKsgTMR3u+Li5UzeHBUNylnc9dw=";
+    hash = "sha256-HzbygFmnKq3E2eEdWCFa4z9Qszfck7dJm2Z5s+il4I0=";
   };
 
   patches = [
@@ -24,6 +25,7 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     packaging
     portalocker
+    pyparsing
     sympy
   ];
 
diff --git a/pkgs/tools/misc/steampipe/default.nix b/pkgs/tools/misc/steampipe/default.nix
index 893602b071a3..3c72233743f4 100644
--- a/pkgs/tools/misc/steampipe/default.nix
+++ b/pkgs/tools/misc/steampipe/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "steampipe";
-  version = "0.19.1";
+  version = "0.19.2";
 
   src = fetchFromGitHub {
     owner = "turbot";
     repo = "steampipe";
     rev = "v${version}";
-    sha256 = "sha256-7UisJORLGGt3Uk7/MOOTHMdotjHgD+tZ0pWzzRbM6Ag=";
+    sha256 = "sha256-CWZ+zsWaI5JULmcJRZggewqArfYpB1G7jyjRPD4WNug=";
   };
 
   vendorHash = "sha256-XrEdaNLG46BwMEF/vhAk9+A6vH4mpbtH7vWXd01Y7ME=";
diff --git a/pkgs/tools/misc/tagref/default.nix b/pkgs/tools/misc/tagref/default.nix
index 30d00eb74d2e..aeec02654822 100644
--- a/pkgs/tools/misc/tagref/default.nix
+++ b/pkgs/tools/misc/tagref/default.nix
@@ -1,16 +1,16 @@
 { lib, fetchFromGitHub, rustPlatform }:
 rustPlatform.buildRustPackage rec {
   pname = "tagref";
-  version = "1.5.0";
+  version = "1.6.0";
 
   src = fetchFromGitHub {
     owner = "stepchowfun";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-PZ5ymYXn19PnvimofODh6su9zHdVoa3T7RCWPSO1Z6w=";
+    sha256 = "sha256-tAkRTHstXoGrSDX5h7xOpHHDOdCqdYu3AXoda84ha4g=";
   };
 
-  cargoSha256 = "sha256-6siqfAWFoOomqcRvW+iku28FbyKCHiDzMVIUwWP8hJM=";
+  cargoHash = "sha256-3pD4hocvnfQziGtDvgc4QxnCEHlmsCFK32PI1zEh9z0=";
 
   meta = with lib; {
     description = "Tagref helps you refer to other locations in your codebase.";
diff --git a/pkgs/tools/misc/tmux-mem-cpu-load/default.nix b/pkgs/tools/misc/tmux-mem-cpu-load/default.nix
index 7370a21512d0..23477e46c117 100644
--- a/pkgs/tools/misc/tmux-mem-cpu-load/default.nix
+++ b/pkgs/tools/misc/tmux-mem-cpu-load/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "tmux-mem-cpu-load";
-  version = "3.6.0";
+  version = "3.6.1";
 
   src = fetchFromGitHub {
     owner = "thewtex";
     repo = "tmux-mem-cpu-load";
     rev = "v${version}";
-    sha256 = "sha256-1smhlp30y0qihm+d9RcCKY1CFbPm5gzago+OIQQT5jE=";
+    sha256 = "sha256-DqUfThAdfwXaZ/2KCw5+68l0vxRd4Ie3lwgz/A/6l5U=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/tools/networking/miniupnpd/default.nix b/pkgs/tools/networking/miniupnpd/default.nix
index b3a10fee2c4e..0e30b2181053 100644
--- a/pkgs/tools/networking/miniupnpd/default.nix
+++ b/pkgs/tools/networking/miniupnpd/default.nix
@@ -1,10 +1,10 @@
-{ stdenv, lib, fetchurl, iptables, libuuid, openssl, pkg-config
+{ stdenv, lib, fetchurl, iptables-legacy, libuuid, openssl, pkg-config
 , which, iproute2, gnused, coreutils, gawk, makeWrapper
 , nixosTests
 }:
 
 let
-  scriptBinEnv = lib.makeBinPath [ which iproute2 iptables gnused coreutils gawk ];
+  scriptBinEnv = lib.makeBinPath [ which iproute2 iptables-legacy gnused coreutils gawk ];
 in
 stdenv.mkDerivation rec {
   pname = "miniupnpd";
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
     sha256 = "0crv975qqppnj27jba96yysq2911y49vjd74sp9vnjb54z0d9pyi";
   };
 
-  buildInputs = [ iptables libuuid openssl ];
+  buildInputs = [ iptables-legacy libuuid openssl ];
   nativeBuildInputs= [ pkg-config makeWrapper ];
 
 
@@ -34,6 +34,7 @@ stdenv.mkDerivation rec {
 
   passthru.tests = {
     bittorrent-integration = nixosTests.bittorrent;
+    inherit (nixosTests) upnp;
   };
 
   meta = with lib; {
diff --git a/pkgs/tools/networking/ooniprobe-cli/default.nix b/pkgs/tools/networking/ooniprobe-cli/default.nix
index 307fdbebd158..09d1d6e52c44 100644
--- a/pkgs/tools/networking/ooniprobe-cli/default.nix
+++ b/pkgs/tools/networking/ooniprobe-cli/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "ooniprobe-cli";
-  version = "3.17.0";
+  version = "3.17.1";
 
   src = fetchFromGitHub {
     owner = "ooni";
     repo = "probe-cli";
     rev = "v${version}";
-    hash = "sha256-xOWGRDK9HyKU/WrLSLgmKpF82UTxxgIMOL1zCQDjtpU=";
+    hash = "sha256-2BsgSsIIQPzqTfoAunBkwrshZd22aI/AXFfz2tk3/78=";
   };
 
   vendorHash = "sha256-r8kyL9gpdDesY8Mbm4lONAhWC4We26Z9uG7QMt1JT9c=";
diff --git a/pkgs/tools/networking/v2raya/default.nix b/pkgs/tools/networking/v2raya/default.nix
index 45a7838b2f6e..022a4c3df9a6 100644
--- a/pkgs/tools/networking/v2raya/default.nix
+++ b/pkgs/tools/networking/v2raya/default.nix
@@ -10,13 +10,13 @@
 }:
 let
   pname = "v2raya";
-  version = "2.0.0";
+  version = "2.0.2";
 
   src = fetchFromGitHub {
     owner = "v2rayA";
     repo = "v2rayA";
     rev = "v${version}";
-    sha256 = "sha256-1fWcrMd+TSrlS1H0z7XwVCQzZAa8DAFtlekEZNRMAPA=";
+    sha256 = "sha256-C7N23s/GA66gQ5SVXtXcM9lXIjScR3pLYCrf0w2nHfY=";
   };
 
   web = mkYarnPackage {
@@ -45,7 +45,7 @@ buildGoModule {
   inherit pname version;
 
   src = "${src}/service";
-  vendorSha256 = "sha256-Ud4pwS0lz7zSTowg3gXNllfDyj8fu33H1L20szxPcOA=";
+  vendorSha256 = "sha256-vnhqI9G/p+SLLA4sre2wfmg1RKIYZmzeL0pSTbHb+Ck=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/tools/package-management/dpkg/default.nix b/pkgs/tools/package-management/dpkg/default.nix
index f92a7b23280f..cb1c67e2e90d 100644
--- a/pkgs/tools/package-management/dpkg/default.nix
+++ b/pkgs/tools/package-management/dpkg/default.nix
@@ -1,20 +1,22 @@
-{ lib, stdenv, fetchurl, perl, zlib, bzip2, xz, zstd
-, makeWrapper, coreutils, autoreconfHook, pkg-config
+{ lib, stdenv, fetchgit, perl, gnutar, zlib, bzip2, xz, zstd
+, libmd, makeWrapper, coreutils, autoreconfHook, pkg-config
 }:
 
 stdenv.mkDerivation rec {
   pname = "dpkg";
-  version = "1.21.1ubuntu2.1";
+  version = "1.21.21ubuntu1";
 
-  src = fetchurl {
-    url = "mirror://ubuntu/pool/main/d/dpkg/dpkg_${version}.tar.xz";
-    sha256 = "sha256-YvVQbQn2MhOIOE43VO0H1QsKIYCsjNAFzKMoFeSrqZk=";
+  src = fetchgit {
+    url = "https://git.launchpad.net/ubuntu/+source/dpkg";
+    rev = "applied/${version}";
+    hash = "sha256-ZrJdf4oEvNeSMVHB8/TJgz5+YqLhih70ktLdnDurhUc=";
   };
 
   configureFlags = [
     "--disable-dselect"
     "--with-admindir=/var/lib/dpkg"
     "PERL_LIBDIR=$(out)/${perl.libPrefix}"
+    "TAR=${gnutar}/bin/tar"
     (lib.optionalString stdenv.isDarwin "--disable-linker-optimisations")
     (lib.optionalString stdenv.isDarwin "--disable-start-stop-daemon")
   ];
@@ -53,7 +55,7 @@ stdenv.mkDerivation rec {
        --replace '"diff"' \"${coreutils}/bin/diff\"
   '';
 
-  buildInputs = [ perl zlib bzip2 xz zstd ];
+  buildInputs = [ perl zlib bzip2 xz zstd libmd ];
   nativeBuildInputs = [ makeWrapper perl autoreconfHook pkg-config ];
 
   postInstall =
diff --git a/pkgs/tools/system/netdata/default.nix b/pkgs/tools/system/netdata/default.nix
index 6d2bc2c6e911..b4d012b24deb 100644
--- a/pkgs/tools/system/netdata/default.nix
+++ b/pkgs/tools/system/netdata/default.nix
@@ -107,6 +107,7 @@ stdenv.mkDerivation rec {
 
   postFixup = ''
     wrapProgram $out/bin/netdata-claim.sh --prefix PATH : ${lib.makeBinPath [ openssl ]}
+    wrapProgram $out/libexec/netdata/plugins.d/cgroup-network-helper.sh --prefix PATH : ${lib.makeBinPath [ bash ]}
   '';
 
   enableParallelBuild = true;
diff --git a/pkgs/tools/system/nsc/default.nix b/pkgs/tools/system/nsc/default.nix
index b8898fcad655..ef5fd5b3b7c6 100644
--- a/pkgs/tools/system/nsc/default.nix
+++ b/pkgs/tools/system/nsc/default.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "nsc";
-  version = "2.7.8";
+  version = "2.8.0";
 
   src = fetchFromGitHub {
     owner = "nats-io";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-cgp/kkHgH5JIWMgrUHHHyuKedbJ3n6L9xBglXCcMYms=";
+    hash = "sha256-8TBg5ByR4d/AvJOiADW068W40wN7ggRT8LbZFfHeqz4=";
   };
 
   ldflags = [
@@ -23,7 +23,7 @@ buildGoModule rec {
     "-X main.builtBy=nixpkgs"
   ];
 
-  vendorHash = "sha256-l9Fl0j8Fa/hiV/2ebmIlnFtekYLwDg3eMpY7lLBreGg=";
+  vendorHash = "sha256-Yywurr+RM96qJGH/WvuLDtf6bLzw9C5hG2d0ID9w1pQ=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/system/skeema/default.nix b/pkgs/tools/system/skeema/default.nix
index 6faf5172ca78..043285497e91 100644
--- a/pkgs/tools/system/skeema/default.nix
+++ b/pkgs/tools/system/skeema/default.nix
@@ -17,28 +17,38 @@ buildGoModule rec {
 
   ldflags = [ "-s" "-w" ];
 
-  preCheck = ''
-    # Disable tests requiring network access to gitlab.com
-    buildFlagsArray+=("-run" "[^(Test(ParseDir(Symlinks|))|DirRelPath)]")
+  preCheck =
+    let
+      skippedTests = [
+        # Tests requiring network access to gitlab.com
+        "TestDirRelPath"
+        "TestParseDirSymlinks"
 
-    # Fix tests expecting /usr/bin/printf and /bin/echo
-    substituteInPlace skeema_cmd_test.go \
-      --replace /usr/bin/printf "${coreutils}/bin/printf"
+        # Flaky tests
+        "TestShellOutTimeout"
+      ];
+    in
+    ''
+      buildFlagsArray+=("-run" "[^(${builtins.concatStringsSep "|" skippedTests})]")
 
-    substituteInPlace internal/fs/dir_test.go \
-      --replace /bin/echo "${coreutils}/bin/echo" \
-      --replace /usr/bin/printf "${coreutils}/bin/printf"
+      # Fix tests expecting /usr/bin/printf and /bin/echo
+      substituteInPlace skeema_cmd_test.go \
+        --replace /usr/bin/printf "${coreutils}/bin/printf"
 
-    substituteInPlace internal/applier/ddlstatement_test.go \
-      --replace /bin/echo "${coreutils}/bin/echo"
+      substituteInPlace internal/fs/dir_test.go \
+        --replace /bin/echo "${coreutils}/bin/echo" \
+        --replace /usr/bin/printf "${coreutils}/bin/printf"
 
-    substituteInPlace internal/util/shellout_unix_test.go \
-      --replace /bin/echo "${coreutils}/bin/echo" \
-      --replace /usr/bin/printf "${coreutils}/bin/printf"
+      substituteInPlace internal/applier/ddlstatement_test.go \
+        --replace /bin/echo "${coreutils}/bin/echo"
 
-    substituteInPlace internal/util/shellout_unix.go \
-      --replace /bin/sh "${runtimeShell}"
-  '';
+      substituteInPlace internal/util/shellout_unix_test.go \
+        --replace /bin/echo "${coreutils}/bin/echo" \
+        --replace /usr/bin/printf "${coreutils}/bin/printf"
+
+      substituteInPlace internal/util/shellout_unix.go \
+        --replace /bin/sh "${runtimeShell}"
+    '';
 
   passthru.tests.version = testers.testVersion {
     package = skeema;
diff --git a/pkgs/tools/text/crowdin-cli/default.nix b/pkgs/tools/text/crowdin-cli/default.nix
index aaafad279491..614e2523c953 100644
--- a/pkgs/tools/text/crowdin-cli/default.nix
+++ b/pkgs/tools/text/crowdin-cli/default.nix
@@ -14,11 +14,11 @@
 
 stdenv.mkDerivation rec {
   pname = "crowdin-cli";
-  version = "3.10.0";
+  version = "3.10.1";
 
   src = fetchurl {
     url = "https://github.com/crowdin/${pname}/releases/download/${version}/${pname}.zip";
-    sha256 = "sha256-4OEwee7izd2gxv7HMq5ziu88sj78QRtGH4bgooZXLow=";
+    sha256 = "sha256-kHi8rLtIHrAfu/r2vvhzIrscqNaDW1Q1F+kTEn4AicQ=";
   };
 
   nativeBuildInputs = [ installShellFiles makeWrapper unzip ];
diff --git a/pkgs/tools/text/d2/default.nix b/pkgs/tools/text/d2/default.nix
index de2857da1852..0e856d798429 100644
--- a/pkgs/tools/text/d2/default.nix
+++ b/pkgs/tools/text/d2/default.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "d2";
-  version = "0.2.4";
+  version = "0.2.5";
 
   src = fetchFromGitHub {
     owner = "terrastruct";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-aReYFw6mlPhf11bhLII5CrMG1G9d0hhPsFVrZxmt72o=";
+    hash = "sha256-nny6scwuSIFQA+G4k3WfuH9n83kMmnwmfPJMKDCIUBo=";
   };
 
-  vendorHash = "sha256-+Z8nzna5KedWzmhBKGSpsbE8ooaC9sPk6Bh5zkrzwrQ=";
+  vendorHash = "sha256-h2OGd/Ql4BTX0tt91lQBvmm41h2kzPgQXawJnrkxn8Y=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index c562879e4f98..7540920cb392 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2811,7 +2811,18 @@ with pkgs;
 
   audiowaveform = callPackage ../tools/audio/audiowaveform { };
 
-  authenticator = callPackage ../applications/misc/authenticator { };
+  authenticator = callPackage ../applications/misc/authenticator rec {
+    # Remove when GTK is upgraded past 4.8
+    # https://github.com/NixOS/nixpkgs/issues/216770
+    gtk4 = pkgs.gtk4.overrideAttrs (_: rec {
+      version = "4.9.4";
+      src = fetchurl {
+        url = "mirror://gnome/sources/gtk/${lib.versions.majorMinor version}/gtk-${version}.tar.xz";
+        sha256 = "sha256-kaOv1YQB1OXYHjCwjuPxE6R2j/EBQDNqcqMmx3JyvjA=";
+      };
+    });
+    wrapGAppsHook4 = wrapGAppsHook.override { gtk3 = gtk4; };
+   };
 
   autoflake = with python3.pkgs; toPythonApplication autoflake;
 
@@ -20891,6 +20902,8 @@ with pkgs;
 
   kronosnet = callPackage ../development/libraries/kronosnet { };
 
+  ktextaddons = libsForQt5.callPackage ../development/libraries/ktextaddons {};
+
   l-smash = callPackage ../development/libraries/l-smash {
     stdenv = gccStdenv;
   };
@@ -24700,10 +24713,7 @@ with pkgs;
 
   directx-headers = callPackage ../development/libraries/directx-headers { };
 
-  directx-shader-compiler = callPackage ../tools/graphics/directx-shader-compiler {
-    # https://github.com/NixOS/nixpkgs/issues/216294
-    stdenv = if stdenv.cc.isGNU && stdenv.isi686 then gcc11Stdenv else stdenv;
-  };
+  directx-shader-compiler = callPackage ../tools/graphics/directx-shader-compiler { };
 
   dkimproxy = callPackage ../servers/mail/dkimproxy { };
 
@@ -38567,8 +38577,8 @@ with pkgs;
 
   physlock = callPackage ../misc/screensavers/physlock { };
 
-  pjsip = callPackage ../applications/networking/pjsip {
-    inherit (darwin.apple_sdk.frameworks) AppKit;
+  pjsip = darwin.apple_sdk_11_0.callPackage ../applications/networking/pjsip {
+    inherit (darwin.apple_sdk_11_0.frameworks) AppKit CoreFoundation Security;
   };
 
   pounce = callPackage ../servers/pounce { };
diff --git a/pkgs/top-level/linux-kernels.nix b/pkgs/top-level/linux-kernels.nix
index 14767d88c1f3..a0b0f2d00ad0 100644
--- a/pkgs/top-level/linux-kernels.nix
+++ b/pkgs/top-level/linux-kernels.nix
@@ -308,6 +308,8 @@ in {
 
     bbswitch = callPackage ../os-specific/linux/bbswitch {};
 
+    ch9344 = callPackage ../os-specific/linux/ch9344 { };
+
     chipsec = callPackage ../tools/security/chipsec {
       inherit kernel;
       withDriver = true;
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 4015e0013201..28e3db6d64c9 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -787,6 +787,8 @@ let
       inherit (pkgs) file;
     };
 
+    lwd = callPackage ../development/ocaml-modules/lwd { };
+
     lwt = callPackage ../development/ocaml-modules/lwt { };
 
     lwt-canceler = callPackage ../development/ocaml-modules/lwt-canceler { };
@@ -984,6 +986,12 @@ let
 
     note = callPackage ../development/ocaml-modules/note { };
 
+    nottui = callPackage ../development/ocaml-modules/lwd/nottui.nix { };
+
+    nottui-lwt = callPackage ../development/ocaml-modules/lwd/nottui-lwt.nix { };
+
+    nottui-pretty = callPackage ../development/ocaml-modules/lwd/nottui-pretty.nix { };
+
     notty = callPackage ../development/ocaml-modules/notty { };
 
     npy = callPackage ../development/ocaml-modules/npy {
@@ -1296,6 +1304,8 @@ let
 
     tyxml = callPackage ../development/ocaml-modules/tyxml { };
 
+    tyxml-lwd = callPackage ../development/ocaml-modules/lwd/tyxml-lwd.nix { };
+
     ulex = callPackage ../development/ocaml-modules/ulex { };
 
     tls = callPackage ../development/ocaml-modules/tls { };