diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 03a68e5af690..6b8089a2f780 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -2094,15 +2094,6 @@
     githubId = 68566724;
     name = "bootstrap-prime";
   };
-  boppyt = {
-    email = "boppy@nwcpz.com";
-    github = "boppyt";
-    githubId = 71049646;
-    name = "Zack A";
-    keys = [{
-      fingerprint = "E8D7 5C19 9F65 269B 439D  F77B 6310 C97D E31D 1545";
-    }];
-  };
   borisbabic = {
     email = "boris.ivan.babic@gmail.com";
     github = "borisbabic";
@@ -13611,6 +13602,16 @@
     githubId = 17243347;
     name = "Sebastian Sellmeier";
   };
+  sefidel = {
+    name = "sefidel";
+    email = "contact@sefidel.net";
+    matrix = "@sef:exotic.sh";
+    github = "sefidel";
+    githubId = 71049646;
+    keys = [{
+      fingerprint = "8BDF DFB5 6842 2393 82A0  441B 9238 BC70 9E05 516A";
+    }];
+  };
   sei40kr = {
     name = "Seong Yong-ju";
     email = "sei40kr@gmail.com";
@@ -16176,12 +16177,6 @@
     github = "wegank";
     githubId = 9713184;
   };
-  weihua = {
-    email = "luwh364@gmail.com";
-    github = "weihua-lu";
-    githubId = 9002575;
-    name = "Weihua Lu";
-  };
   welteki = {
     email = "welteki@pm.me";
     github = "welteki";
diff --git a/maintainers/team-list.nix b/maintainers/team-list.nix
index 2201fc7f76bc..173ad98263f9 100644
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@@ -424,11 +424,14 @@ with lib.maintainers; {
 
   llvm = {
     members = [
-      ericson2314
-      sternenseemann
-      lovek323
       dtzWill
+      ericson2314
+      lovek323
       primeos
+      qyliss
+      raitobezarius
+      rrbutani
+      sternenseemann
     ];
     scope = "Maintain LLVM package sets and related packages";
     shortName = "LLVM";
diff --git a/nixos/modules/hardware/opengl.nix b/nixos/modules/hardware/opengl.nix
index 9108bcbd1652..b16315eb121f 100644
--- a/nixos/modules/hardware/opengl.nix
+++ b/nixos/modules/hardware/opengl.nix
@@ -69,21 +69,50 @@ in
       package = mkOption {
         type = types.package;
         internal = true;
+        default = cfg.mesaPackage;
         description = lib.mdDoc ''
           The package that provides the OpenGL implementation.
+
+          The default is Mesa's drivers which should cover all OpenGL-capable
+          hardware. If you want to use another Mesa version, adjust
+          {option}`mesaPackage`.
         '';
       };
-
       package32 = mkOption {
         type = types.package;
         internal = true;
+        default = cfg.mesaPackage32;
         description = lib.mdDoc ''
-          The package that provides the 32-bit OpenGL implementation on
-          64-bit systems. Used when {option}`driSupport32Bit` is
-          set.
+          Same as {option}`package` but for the 32-bit OpenGL implementation on
+          64-bit systems. Used when {option}`driSupport32Bit` is set.
         '';
       };
 
+      mesaPackage = mkOption {
+        type = types.package;
+        default = pkgs.mesa_23;
+        defaultText = literalExpression "pkgs.mesa_23";
+        example = literalExpression "pkgs.mesa_22";
+        description = lib.mdDoc ''
+          The Mesa driver package used for rendering support on the system.
+
+          You should only need to adjust this if you require a newer Mesa
+          version for your hardware or because you need to patch a bug.
+        '';
+        apply = mesa: mesa.drivers or throw "`mesa` package must have a `drivers` output.";
+      };
+      mesaPackage32 = mkOption {
+        type = types.package;
+        default = pkgs.pkgsi686Linux.mesa_23;
+        defaultText = literalExpression "pkgs.pkgsi686Linux.mesa_23";
+        example = literalExpression "pkgs.pkgsi686Linux.mesa_22";
+        description = lib.mdDoc ''
+          Same as {option}`mesaPackage` but for the 32-bit Mesa on 64-bit
+          systems. Used when {option}`driSupport32Bit` is set.
+        '';
+        apply = mesa: mesa.drivers or throw "`mesa` package must have a `drivers` output.";
+      };
+
       extraPackages = mkOption {
         type = types.listOf types.package;
         default = [];
@@ -97,7 +126,6 @@ in
           :::
         '';
       };
-
       extraPackages32 = mkOption {
         type = types.listOf types.package;
         default = [];
@@ -153,9 +181,6 @@ in
     environment.sessionVariables.LD_LIBRARY_PATH = mkIf cfg.setLdLibraryPath
       ([ "/run/opengl-driver/lib" ] ++ optional cfg.driSupport32Bit "/run/opengl-driver-32/lib");
 
-    hardware.opengl.package = mkDefault pkgs.mesa.drivers;
-    hardware.opengl.package32 = mkDefault pkgs.pkgsi686Linux.mesa.drivers;
-
     boot.extraModulePackages = optional (elem "virtualbox" videoDrivers) kernelPackages.virtualboxGuestAdditions;
   };
 }
diff --git a/pkgs/applications/audio/ebumeter/default.nix b/pkgs/applications/audio/ebumeter/default.nix
index 9ebcbec001d0..9c00f3dfcb5e 100644
--- a/pkgs/applications/audio/ebumeter/default.nix
+++ b/pkgs/applications/audio/ebumeter/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ebumeter";
-  version = "0.4.2";
+  version = "0.5.1";
 
   src = fetchurl {
-    url = "https://kokkinizita.linuxaudio.org/linuxaudio/downloads/${pname}-${version}.tar.bz2";
-    sha256 = "1wm9j1phmpicrp7jdsvdbc3mghdd92l61yl9qbps0brq2ljjyd5s";
+    url = "https://kokkinizita.linuxaudio.org/linuxaudio/downloads/${pname}-${version}.tar.xz";
+    hash = "sha256-U2ZpNfvy+X1RdA9Q4gvFYzAxlgc6kYjJpQ/0sEX0A4I=";
   };
 
   buildInputs = [
diff --git a/pkgs/applications/audio/lingot/default.nix b/pkgs/applications/audio/lingot/default.nix
index 9bedb9e016ea..234e2d675cb1 100644
--- a/pkgs/applications/audio/lingot/default.nix
+++ b/pkgs/applications/audio/lingot/default.nix
@@ -8,6 +8,7 @@
 , alsa-lib
 , libpulseaudio
 , fftw
+, fftwFloat
 , json_c
 , libjack2
 , jackSupport ? true
@@ -33,6 +34,7 @@ stdenv.mkDerivation rec {
     alsa-lib
     libpulseaudio
     fftw
+    fftwFloat
     json_c
   ] ++ lib.optional jackSupport libjack2;
 
diff --git a/pkgs/applications/editors/lite-xl/default.nix b/pkgs/applications/editors/lite-xl/default.nix
index 577ea527804c..857bc35309f2 100644
--- a/pkgs/applications/editors/lite-xl/default.nix
+++ b/pkgs/applications/editors/lite-xl/default.nix
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
     description = "A lightweight text editor written in Lua";
     homepage = "https://github.com/lite-xl/lite-xl";
     license = licenses.mit;
-    maintainers = with maintainers; [ boppyt ];
+    maintainers = with maintainers; [ sefidel ];
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/applications/emulators/snes9x/default.nix b/pkgs/applications/emulators/snes9x/default.nix
index b8ba518350a7..a504af87aba6 100644
--- a/pkgs/applications/emulators/snes9x/default.nix
+++ b/pkgs/applications/emulators/snes9x/default.nix
@@ -3,7 +3,6 @@
 , alsa-lib
 , cmake
 , fetchFromGitHub
-, fetchpatch
 , gtkmm3
 , libepoxy
 , libpng
@@ -34,25 +33,16 @@ stdenv.mkDerivation rec {
       "snes9x-gtk"
     else
       "snes9x";
-  version = "1.62";
+  version = "1.62.1";
 
   src = fetchFromGitHub {
     owner = "snes9xgit";
     repo = "snes9x";
     rev = version;
     fetchSubmodules = true;
-    hash = "sha256-RcxFNmUbJp0rUugWOqQa3Sy/Hh18ZPOeDTxC0JY5GJQ=";
+    hash = "sha256-y/tNJmmgigMEqjBWLyqxM/GQ2jcu4YXZjP0AbIjoPLg=";
   };
 
-  patches = [
-    # Fix cross-compilation, otherwise it fails to detect host compiler features
-    # Doesn't affect non CC builds
-    (fetchpatch {
-      url = "https://github.com/snes9xgit/snes9x/commit/f39ab408f4151c16d44e45470cc0736ffb2803f8.patch";
-      hash = "sha256-GMlHBsADEF+rycmEVgpWy220hZwld5D2e8fsYA7HblM=";
-    })
-  ];
-
   nativeBuildInputs = [
     pkg-config
     python3
diff --git a/pkgs/applications/finance/odoo/default.nix b/pkgs/applications/finance/odoo/default.nix
index 33b9182a4805..cfd181aa4d76 100644
--- a/pkgs/applications/finance/odoo/default.nix
+++ b/pkgs/applications/finance/odoo/default.nix
@@ -1,81 +1,53 @@
 { stdenv
 , lib
+, fetchFromGitHub
 , fetchurl
-, python39
+, python310
 , nodePackages
 , wkhtmltopdf
 , nixosTests
 }:
 
 let
-  python = python39.override {
+  python = python310.override {
     packageOverrides = self: super: {
-      click = super.click.overridePythonAttrs (old: rec {
-        version = "7.1.2";
-        src = old.src.override {
-          inherit version;
-          sha256 = "d2b5255c7c6349bc1bd1e59e08cd12acbbd63ce649f2588755783aa94dfb6b1a";
+      pypdf2 = super.pypdf2.overridePythonAttrs (old: rec {
+        version = "1.28.6";
+        format = "setuptools";
+
+        src = fetchFromGitHub {
+          owner = "py-pdf";
+          repo = "pypdf";
+          rev = version;
+          fetchSubmodules = true;
+          hash = "sha256-WnRbsy/PJcotZqY9mJPLadrYqkXykOVifLIbDyNf4s4=";
         };
+
+        nativeBuildInputs = [];
+
+        nativeCheckInputs = with self; [ pytestCheckHook pillow ];
       });
       flask = super.flask.overridePythonAttrs (old: rec {
-        version = "1.1.4";
+        version = "2.1.3";
         src = old.src.override {
           inherit version;
-          sha256 = "0fbeb6180d383a9186d0d6ed954e0042ad9f18e0e8de088b2b419d526927d196";
-        };
-      });
-      itsdangerous = super.itsdangerous.overridePythonAttrs (old: rec {
-        version = "1.1.0";
-        src = old.src.override {
-          inherit version;
-          sha256 = "321b033d07f2a4136d3ec762eac9f16a10ccd60f53c0c91af90217ace7ba1f19";
-        };
-      });
-      jinja2 = super.jinja2.overridePythonAttrs (old: rec {
-        version = "2.11.3";
-        src = old.src.override {
-          inherit version;
-          sha256 = "a6d58433de0ae800347cab1fa3043cebbabe8baa9d29e668f1c768cb87a333c6";
-        };
-      });
-      markupsafe = super.markupsafe.overridePythonAttrs (old: rec {
-        version = "2.0.1";
-        src = old.src.override {
-          inherit version;
-          sha256 = "594c67807fb16238b30c44bdf74f36c02cdf22d1c8cda91ef8a0ed8dabf5620a";
+          hash = "sha256-FZcuUBffBXXD1sCQuhaLbbkCWeYgrI1+qBOjlrrVtss=";
         };
       });
       werkzeug = super.werkzeug.overridePythonAttrs (old: rec {
-        version = "1.0.1";
+        version = "2.1.2";
         src = old.src.override {
           inherit version;
-          sha256 = "6c80b1e5ad3665290ea39320b91e1be1e0d5f60652b964a3070216de83d2e47c";
+          hash = "sha256-HOCOgJPtZ9Y41jh5/Rujc1gX96gN42dNKT9ZhPJftuY=";
         };
-        nativeCheckInputs = old.nativeCheckInputs ++ (with self; [
-          requests
-        ]);
-        disabledTests = old.disabledTests ++ [
-          # ResourceWarning: unclosed file
-          "test_basic"
-          "test_date_to_unix"
-          "test_easteregg"
-          "test_file_rfc2231_filename_continuations"
-          "test_find_terminator"
-          "test_save_to_pathlib_dst"
-        ];
-        disabledTestPaths = old.disabledTestPaths ++ [
-          # ResourceWarning: unclosed file
-          "tests/test_http.py"
-        ];
       });
     };
   };
-in python.pkgs.buildPythonApplication rec {
-  pname = "odoo";
 
   odoo_version = "15.0";
-  odoo_release = "20220506";
-
+  odoo_release = "20230317";
+in python.pkgs.buildPythonApplication rec {
+  pname = "odoo";
   version = "${odoo_version}.${odoo_release}";
 
   format = "setuptools";
@@ -84,13 +56,20 @@ in python.pkgs.buildPythonApplication rec {
   src = fetchurl {
     url = "https://nightly.odoo.com/${odoo_version}/nightly/src/odoo_${version}.tar.gz";
     name = "${pname}-${version}";
-    sha256 = "0mwlmfz5nhvg483ldrmlrjhwaf284c0c0pxf0fb0sfx2dnjjj3ib"; # odoo
+    hash = "sha256-nJEFPtZhq7DLLDCL9xt0RV75d/a45o6hBKsUlQAWh1U="; # odoo
   };
 
+  unpackPhase = ''
+    tar xfz $src
+    cd odoo*
+  '';
+
   # needs some investigation
   doCheck = false;
 
-  makeWrapperArgs = [ "--prefix" "PATH" ":" "${lib.makeBinPath [ wkhtmltopdf nodePackages.rtlcss ]}" ];
+  makeWrapperArgs = [
+    "--prefix" "PATH" ":" "${lib.makeBinPath [ wkhtmltopdf nodePackages.rtlcss ]}"
+  ];
 
   propagatedBuildInputs = with python.pkgs; [
     babel
@@ -101,7 +80,6 @@ in python.pkgs.buildPythonApplication rec {
     freezegun
     gevent
     greenlet
-    html2text
     idna
     jinja2
     libsass
@@ -127,6 +105,7 @@ in python.pkgs.buildPythonApplication rec {
     qrcode
     reportlab
     requests
+    setuptools
     vobject
     werkzeug
     xlrd
@@ -135,10 +114,8 @@ in python.pkgs.buildPythonApplication rec {
     zeep
   ];
 
-  unpackPhase = ''
-    tar xfz $src
-    cd odoo*
-  '';
+  # takes 5+ minutes and there are not files to strip
+  dontStrip = true;
 
   passthru = {
     updateScript = ./update.sh;
diff --git a/pkgs/applications/finance/odoo/update.sh b/pkgs/applications/finance/odoo/update.sh
index 3b49727867c0..1bec751ae7e7 100755
--- a/pkgs/applications/finance/odoo/update.sh
+++ b/pkgs/applications/finance/odoo/update.sh
@@ -22,6 +22,6 @@ fi
 
 cd "$(dirname "${BASH_SOURCE[0]}")"
 
-sed -ri "s| sha256.+ # odoo| sha256 = \"$(nix-prefetch-url --type sha256 "https://nightly.odoo.com/${VERSION}/nightly/src/odoo_${latestVersion}.tar.gz")\"; # odoo|g" default.nix
+sed -ri "s| hash.+ # odoo| hash = \"$(nix-prefetch-url --type sha256 "https://nightly.odoo.com/${VERSION}/nightly/src/odoo_${latestVersion}.tar.gz")\"; # odoo|g" default.nix
 sed -ri "s| odoo_version.+| odoo_version = \"$VERSION\";|" default.nix
 sed -ri "s| odoo_release.+| odoo_release = \"$RELEASE\";|" default.nix
diff --git a/pkgs/applications/misc/gallery-dl/default.nix b/pkgs/applications/misc/gallery-dl/default.nix
index aaf5ec904923..7ffe4836a393 100644
--- a/pkgs/applications/misc/gallery-dl/default.nix
+++ b/pkgs/applications/misc/gallery-dl/default.nix
@@ -2,13 +2,13 @@
 
 buildPythonApplication rec {
   pname = "gallery-dl";
-  version = "1.25.0";
+  version = "1.25.1";
   format = "setuptools";
 
   src = fetchPypi {
     inherit version;
     pname = "gallery_dl";
-    sha256 = "sha256-WxmH6uAMnbmXZWOkLh4B6rR6RV2xfSVBZ7v47AwlwRY=";
+    sha256 = "sha256-us9lzchdsCD4sY4XQ1f4j3wKuFtEZnEuBrlSa3FpDP4=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/applications/misc/logseq/default.nix b/pkgs/applications/misc/logseq/default.nix
index afd7c1309cef..125ff56b6a5c 100644
--- a/pkgs/applications/misc/logseq/default.nix
+++ b/pkgs/applications/misc/logseq/default.nix
@@ -61,7 +61,7 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/logseq/logseq";
     changelog = "https://github.com/logseq/logseq/releases/tag/${version}";
     license = licenses.agpl3Plus;
-    maintainers = with maintainers; [ weihua ];
+    maintainers = with maintainers; [ ];
     platforms = [ "x86_64-linux" ];
   };
 }
diff --git a/pkgs/applications/misc/terminal-stocks/default.nix b/pkgs/applications/misc/terminal-stocks/default.nix
index b1d4c67ac89b..b7a793d2153a 100644
--- a/pkgs/applications/misc/terminal-stocks/default.nix
+++ b/pkgs/applications/misc/terminal-stocks/default.nix
@@ -2,16 +2,16 @@
 
 buildNpmPackage rec {
   pname = "terminal-stocks";
-  version = "1.0.14";
+  version = "1.0.15";
 
   src = fetchFromGitHub {
     owner = "shweshi";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-AzLMqp5t9u1ne+xCKp0dq/3V3DKJ1Ou9riAN+KqkStg=";
+    hash = "sha256-8n+Wpkiy+XTaIBO7nuxO2m3EkkaHsmYNqtUqMin6leg=";
   };
 
-  npmDepsHash = "sha256-GOg6B8BWkWegxeYmlHSJjFNrb/frb6jdzjjNSGF38Zo=";
+  npmDepsHash = "sha256-M9a33v1R/cAgUJJLHwPs8hpPtjzzKkMps/ACnWLqUZE=";
   dontNpmBuild = true;
 
   passthru.updateScript = nix-update-script {};
diff --git a/pkgs/applications/networking/cluster/pgo-client/default.nix b/pkgs/applications/networking/cluster/pgo-client/default.nix
index c8c31c55ecdd..47062588dd61 100644
--- a/pkgs/applications/networking/cluster/pgo-client/default.nix
+++ b/pkgs/applications/networking/cluster/pgo-client/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "pgo-client";
-  version = "4.7.7";
+  version = "4.7.10";
 
   src = fetchFromGitHub {
     owner = "CrunchyData";
     repo = "postgres-operator";
     rev = "v${version}";
-    sha256 = "sha256-rHWCj25NEKbwV1kmuH6k3oWSXKelknb2GRDgLaZSb3U=";
+    sha256 = "sha256-ZwKfbmKPvhxLpCGH+IlfoQjnw8go4N6mfseY2LWCktA=";
   };
 
-  vendorSha256 = "sha256-5/mLlgNdlX/ABrpofPqowCskxFwJAEKVpbsMOvMvTWc=";
+  vendorHash = "sha256-qpS1TLShJwXgmtuhWIPOlcHMofUgOWZ8vbri36i+hpM=";
 
   subPackages = [ "cmd/pgo" ];
 
diff --git a/pkgs/applications/networking/instant-messengers/zoom-us/default.nix b/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
index 8938c05a2473..6ca1e5b2f854 100644
--- a/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
+++ b/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
@@ -48,23 +48,23 @@ let
   # and often with different versions.  We write them on three lines
   # like this (rather than using {}) so that the updater script can
   # find where to edit them.
-  versions.aarch64-darwin = "5.13.11.16405";
-  versions.x86_64-darwin = "5.13.11.16405";
-  versions.x86_64-linux = "5.13.11.1288";
+  versions.aarch64-darwin = "5.14.0.16775";
+  versions.x86_64-darwin = "5.14.0.16775";
+  versions.x86_64-linux = "5.14.0.1720";
 
   srcs = {
     aarch64-darwin = fetchurl {
       url = "https://zoom.us/client/${versions.aarch64-darwin}/zoomusInstallerFull.pkg?archType=arm64";
       name = "zoomusInstallerFull.pkg";
-      hash = "sha256-YjERJ6B06/uloHRQVyZDLyf/2Gae0P7xdk4Db9aqROs=";
+      hash = "sha256-79Jb5cv9OWYM55fB8wtP+qYJc67+gNdiw9VrqnQPJ5U=";
     };
     x86_64-darwin = fetchurl {
       url = "https://zoom.us/client/${versions.x86_64-darwin}/zoomusInstallerFull.pkg";
-      hash = "sha256-g6n4SKdord7gRwBaYUle3+yi1eB0T36ilScTaCcU8us=";
+      hash = "sha256-HetPvZ7Bv8bC4DdoNM+92bFFQnwDY26WiEniwrBNSfk=";
     };
     x86_64-linux = fetchurl {
       url = "https://zoom.us/client/${versions.x86_64-linux}/zoom_x86_64.pkg.tar.xz";
-      hash = "sha256-BdI3HEQVe9A3D6KJ45wHWsrfb+dhTZAp/xlcr9X92EU=";
+      hash = "sha256-d8R2jfol5zAaI4qcpUIVdph899d7t/LRxQImXFzXXWo=";
     };
   };
 
diff --git a/pkgs/applications/video/bombono/default.nix b/pkgs/applications/video/bombono/default.nix
index 3990aeb662f1..2fce4b544845 100644
--- a/pkgs/applications/video/bombono/default.nix
+++ b/pkgs/applications/video/bombono/default.nix
@@ -53,6 +53,11 @@ stdenv.mkDerivation rec {
     {name="fix_ffmpeg30.patch";               sha256="sha256-vKEbvbjYVRzEaVYC8XOJBPmk6FDXI/WA0X/dldRRO8c=";}
   ]);
 
+  postPatch = ''
+    substituteInPlace src/mbase/SConscript \
+      --replace "lib_mbase_env['CPPDEFINES']" "list(lib_mbase_env['CPPDEFINES'])"
+  '';
+
   nativeBuildInputs = [ wrapGAppsHook scons pkg-config gettext ];
 
   buildInputs = [
@@ -84,5 +89,6 @@ stdenv.mkDerivation rec {
     homepage = "https://www.bombono.org/";
     license = licenses.gpl2Only;
     maintainers = with maintainers; [ symphorien ];
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/desktops/gnome/extensions/EasyScreenCast/default.nix b/pkgs/desktops/gnome/extensions/EasyScreenCast/default.nix
index 32486875dc58..342f03d618ad 100644
--- a/pkgs/desktops/gnome/extensions/EasyScreenCast/default.nix
+++ b/pkgs/desktops/gnome/extensions/EasyScreenCast/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, substituteAll, glib, gnome, gettext, jq }:
+{ lib, stdenv, fetchFromGitHub, substituteAll, glib, gnome, gettext, jq, intltool }:
 
 stdenv.mkDerivation rec {
   pname = "gnome-shell-extension-EasyScreenCast";
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
   ];
 
   nativeBuildInputs = [
-    glib gettext jq
+    glib gettext jq intltool
   ];
 
   makeFlags = [ "INSTALLBASE=$(out)/share/gnome-shell/extensions" ];
diff --git a/pkgs/development/libraries/drumstick/default.nix b/pkgs/development/libraries/drumstick/default.nix
index 6d7352e87742..486d1ff997d3 100644
--- a/pkgs/development/libraries/drumstick/default.nix
+++ b/pkgs/development/libraries/drumstick/default.nix
@@ -1,15 +1,15 @@
 { lib, stdenv, fetchurl
 , cmake, docbook_xml_dtd_45, docbook_xsl, doxygen, graphviz-nox, pkg-config, qttools, wrapQtAppsHook
-, alsa-lib, fluidsynth, qtbase, qtsvg, libpulseaudio
+, alsa-lib, fluidsynth, libpulseaudio, qtbase, qtsvg, sonivox
 }:
 
 stdenv.mkDerivation rec {
   pname = "drumstick";
-  version = "2.7.0";
+  version = "2.7.2";
 
   src = fetchurl {
     url = "mirror://sourceforge/drumstick/${version}/${pname}-${version}.tar.bz2";
-    hash = "sha256-Yb5SrXJ5ZK0IJ8XbnxAGLlfqKGOrfv2VET9Ba8dKItU=";
+    hash = "sha256-5XxG5ur584fgW4oCONgMiWzV48Q02HEdmpb9+YhBFe0=";
   };
 
   patches = [
@@ -18,11 +18,6 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     substituteInPlace library/rt/backendmanager.cpp --subst-var out
-
-    # https://sourceforge.net/p/drumstick/bugs/39/
-    substituteInPlace drumstick-alsa.pc.in drumstick-file.pc.in drumstick-rt.pc.in drumstick-widgets.pc.in \
-      --replace '$'{prefix}/@CMAKE_INSTALL_LIBDIR@ @CMAKE_INSTALL_FULL_LIBDIR@ \
-      --replace '$'{prefix}/@CMAKE_INSTALL_INCLUDEDIR@ @CMAKE_INSTALL_FULL_INCLUDEDIR@
   '';
 
   outputs = [ "out" "dev" "man" ];
@@ -32,7 +27,7 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    alsa-lib fluidsynth libpulseaudio qtbase qtsvg
+    alsa-lib fluidsynth libpulseaudio qtbase qtsvg sonivox
   ];
 
   cmakeFlags = [
diff --git a/pkgs/development/libraries/libcef/default.nix b/pkgs/development/libraries/libcef/default.nix
index 3c4d317d5261..043848341ac4 100644
--- a/pkgs/development/libraries/libcef/default.nix
+++ b/pkgs/development/libraries/libcef/default.nix
@@ -66,16 +66,16 @@ let
       projectArch = "x86_64";
     };
   };
-  platforms."aarch64-linux".sha256 = "1aacq9baw0hxf3h354fmws4v6008d3axxmri23vlvhzg7hza05n1";
-  platforms."x86_64-linux".sha256 = "17wpmvrbkdhnsk63f36yk6kq0mqhx63ih0mbhf8hl0qj6yndabgc";
+  platforms."aarch64-linux".sha256 = "1mrrsj213jc3s926wc1ccz63n7052mbmb70411lsi0192xfmrpjb";
+  platforms."x86_64-linux".sha256 = "1jf4yv83xjbj75j1mqzib9f3kb9pwsnqryhv1dwqm5qi6if6g5y3";
 
   platformInfo = builtins.getAttr stdenv.targetPlatform.system platforms;
 in
 stdenv.mkDerivation rec {
   pname = "cef-binary";
-  version = "110.0.27";
-  gitRevision = "1296c82";
-  chromiumVersion = "110.0.5481.100";
+  version = "111.2.6";
+  gitRevision = "491d238";
+  chromiumVersion = "111.0.5563.65";
 
   src = fetchurl {
     url = "https://cef-builds.spotifycdn.com/cef_binary_${version}+g${gitRevision}+chromium-${chromiumVersion}_${platformInfo.platformStr}_minimal.tar.bz2";
diff --git a/pkgs/development/libraries/mesa/22.3.7.nix b/pkgs/development/libraries/mesa/22.3.7.nix
new file mode 100644
index 000000000000..1a1127dae508
--- /dev/null
+++ b/pkgs/development/libraries/mesa/22.3.7.nix
@@ -0,0 +1,4 @@
+import ./generic.nix {
+  version = "22.3.7";
+  hash = "sha256-iUzi9KHC52F3zdIoRiAZLQ2jBmskPuwvux18838TBCw=";
+}
diff --git a/pkgs/development/libraries/mesa/23.0.1.nix b/pkgs/development/libraries/mesa/23.0.1.nix
new file mode 100644
index 000000000000..0c44d72da7dc
--- /dev/null
+++ b/pkgs/development/libraries/mesa/23.0.1.nix
@@ -0,0 +1,4 @@
+import ./generic.nix {
+  version = "23.0.1";
+  hash = "sha256-6OWGhWtViTq66b3NuYtBwIHZCbsfrzcubnJiMHvzSt8=";
+}
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/generic.nix
similarity index 98%
rename from pkgs/development/libraries/mesa/default.nix
rename to pkgs/development/libraries/mesa/generic.nix
index 2676a3b740fd..b60533ca39a8 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/generic.nix
@@ -1,8 +1,10 @@
+{ version, hash }:
+
 { stdenv, lib, fetchurl
 , meson, pkg-config, ninja
 , intltool, bison, flex, file, python3Packages, wayland-scanner
 , expat, libdrm, xorg, wayland, wayland-protocols, openssl
-, llvmPackages, libffi, libomxil-bellagio, libva-minimal
+, llvmPackages_15, libffi, libomxil-bellagio, libva-minimal
 , libelf, libvdpau
 , libglvnd, libunwind
 , vulkan-loader, glslang
@@ -87,11 +89,11 @@
 let
   # Release calendar: https://www.mesa3d.org/release-calendar.html
   # Release frequency: https://www.mesa3d.org/releasing.html#schedule
-  version = "22.3.7";
-  branch  = lib.versions.major version;
+  branch = lib.versions.major version;
 
   withLibdrm = lib.meta.availableOn stdenv.hostPlatform libdrm;
 
+  llvmPackages = llvmPackages_15;
   # Align all the Mesa versions used. Required to prevent explosions when
   # two different LLVMs are loaded in the same process.
   # FIXME: these should really go into some sort of versioned LLVM package set
@@ -119,7 +121,7 @@ self = stdenv.mkDerivation {
       "ftp://ftp.freedesktop.org/pub/mesa/${version}/mesa-${version}.tar.xz"
       "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz"
     ];
-    hash = "sha256-iUzi9KHC52F3zdIoRiAZLQ2jBmskPuwvux18838TBCw=";
+    inherit hash;
   };
 
   # TODO:
diff --git a/pkgs/development/perl-modules/CatalystAuthenticationStoreHtpasswd-test-replace-DES-hash-with-bcrypt.patch b/pkgs/development/perl-modules/CatalystAuthenticationStoreHtpasswd-test-replace-DES-hash-with-bcrypt.patch
new file mode 100644
index 000000000000..f3ce028ca59a
--- /dev/null
+++ b/pkgs/development/perl-modules/CatalystAuthenticationStoreHtpasswd-test-replace-DES-hash-with-bcrypt.patch
@@ -0,0 +1,12 @@
+Replaces the legacy DES crypt hash used in tests with a stronger
+bcrypt function, as crypt() in pkgs.perl no longer supports DES
+
+# htpasswd -nbB mufasa "Circle of Life"
+
+diff --git a/t/lib/TestApp/htpasswd b/t/lib/TestApp/htpasswd
+index 6cec784..91e5375 100644
+--- a/t/lib/TestApp/htpasswd
++++ b/t/lib/TestApp/htpasswd
+@@ -1 +1 @@
+-mufasa:Y7hn4ncIVPOuI
++mufasa:$2y$05$.KPC4Gja9L5AxJATDQBzs.lCHkm49l/9dcoyPcJg0JhyIvsD6Gqza
diff --git a/pkgs/development/python-modules/asana/default.nix b/pkgs/development/python-modules/asana/default.nix
index 7fa9e1a96670..c4d78a275a6d 100644
--- a/pkgs/development/python-modules/asana/default.nix
+++ b/pkgs/development/python-modules/asana/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "asana";
-  version = "3.1.1";
+  version = "3.2.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "asana";
     repo = "python-asana";
     rev = "refs/tags/v${version}";
-    hash = "sha256-7POA3r3PqJ/PcyG7GFugg5p8o0h3OIA8zEIfsTwPxFI=";
+    hash = "sha256-qxoGi7UByHEuDKsELEjwzf01/JNEiUgUs88536TGFKo=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/denonavr/default.nix b/pkgs/development/python-modules/denonavr/default.nix
index 23a86a184c36..3bcc2990b2b8 100644
--- a/pkgs/development/python-modules/denonavr/default.nix
+++ b/pkgs/development/python-modules/denonavr/default.nix
@@ -12,12 +12,13 @@
 , pytest-httpx
 , pytest-timeout
 , pythonOlder
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "denonavr";
-  version = "0.11.1";
-  format = "setuptools";
+  version = "0.11.2";
+  format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
@@ -25,9 +26,13 @@ buildPythonPackage rec {
     owner = "ol-iver";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-iYekqqhrcN1rbclFVSbJSF5ky19WsBLKlTxAa2HULqY=";
+    hash = "sha256-Sa5pfvSzshgwHh9LGWPBVIC7pXouZbTmSMYncT46phU=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     asyncstdlib
     attrs
diff --git a/pkgs/development/python-modules/eternalegypt/default.nix b/pkgs/development/python-modules/eternalegypt/default.nix
index c5c7d8a646cf..6682ae36a6fe 100644
--- a/pkgs/development/python-modules/eternalegypt/default.nix
+++ b/pkgs/development/python-modules/eternalegypt/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "eternalegypt";
-  version = "0.0.13";
+  version = "0.0.15";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -16,8 +16,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "amelchio";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "0wi2cqd81irqm873npkqg3mvdrb57idqdsp8qw8h0s7lk0kil1wi";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-CKiv5gVHaEyO9P5x2FKgpSIm2pUiFptaEQVPZHALASk=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/fake-useragent/default.nix b/pkgs/development/python-modules/fake-useragent/default.nix
index a3fc50c350b1..37e989bd756a 100644
--- a/pkgs/development/python-modules/fake-useragent/default.nix
+++ b/pkgs/development/python-modules/fake-useragent/default.nix
@@ -10,14 +10,16 @@
 
 buildPythonPackage rec {
   pname = "fake-useragent";
-  version = "1.1.2";
+  version = "1.1.3";
   format = "pyproject";
 
+  disabled = pythonOlder "3.7";
+
   src = fetchFromGitHub {
     owner = "fake-useragent";
     repo = "fake-useragent";
     rev = "refs/tags/${version}";
-    hash = "sha256-Rz+oEpgfvSRdly+H1bYxYjNCfo1STkLcogPgZs+b8DY=";
+    hash = "sha256-8fVNko65nP/u9vLGBPfSseKW07b4JC6kCPFCPK2f6wU=";
   };
 
   postPatch = ''
@@ -42,6 +44,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Up to date simple useragent faker with real world database";
     homepage = "https://github.com/hellysmile/fake-useragent";
+    changelog = "https://github.com/fake-useragent/fake-useragent/releases/tag/${version}";
     license = licenses.asl20;
     maintainers = with maintainers; [ evanjs ];
   };
diff --git a/pkgs/development/python-modules/jupyter-cache/default.nix b/pkgs/development/python-modules/jupyter-cache/default.nix
index 7cf7fab7889d..593fb90720b2 100644
--- a/pkgs/development/python-modules/jupyter-cache/default.nix
+++ b/pkgs/development/python-modules/jupyter-cache/default.nix
@@ -10,11 +10,14 @@
 , sqlalchemy
 , tabulate
 , pythonOlder
+, setuptools
+, pythonRelaxDepsHook
 }:
 
 buildPythonPackage rec {
   pname = "jupyter-cache";
   version = "0.5.0";
+  format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
@@ -23,10 +26,10 @@ buildPythonPackage rec {
     sha256 = "87408030a4c8c14fe3f8fe62e6ceeb24c84e544c7ced20bfee45968053d07801";
   };
 
-  postPatch = ''
-    substituteInPlace setup.cfg \
-      --replace "nbclient>=0.2,<0.6" "nbclient"
-  '';
+  nativeBuildInputs = [
+    setuptools
+    pythonRelaxDepsHook
+  ];
 
   propagatedBuildInputs = [
     attrs
@@ -39,6 +42,11 @@ buildPythonPackage rec {
     tabulate
   ];
 
+  pythonRelaxDeps = [
+    "nbclient"
+    "sqlalchemy" # See https://github.com/executablebooks/jupyter-cache/pull/93
+  ];
+
   pythonImportsCheck = [ "jupyter_cache" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/onvif-zeep-async/default.nix b/pkgs/development/python-modules/onvif-zeep-async/default.nix
index d895504186cb..f336379fc60c 100644
--- a/pkgs/development/python-modules/onvif-zeep-async/default.nix
+++ b/pkgs/development/python-modules/onvif-zeep-async/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "onvif-zeep-async";
-  version = "1.2.1";
+  version = "1.2.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-bRPqbuBrC4Q0gdQGb2KAy1pTHce42WvM7gjvAspH4WE=";
+    hash = "sha256-Mq+mARZQD48M6+9XwzX7V541Jqn/vJMSeiEm5k8/YII=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/python-benedict/default.nix b/pkgs/development/python-modules/python-benedict/default.nix
index c1c10cfc902e..e26493239612 100644
--- a/pkgs/development/python-modules/python-benedict/default.nix
+++ b/pkgs/development/python-modules/python-benedict/default.nix
@@ -24,7 +24,7 @@
 
 buildPythonPackage rec {
   pname = "python-benedict";
-  version = "0.29.1";
+  version = "0.30.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -33,7 +33,7 @@ buildPythonPackage rec {
     owner = "fabiocaccamo";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-tsTd9EJkwI98ynXu/vz5hX+X55vxOkhIfeawQNn2f6Q=";
+    hash = "sha256-/LERLQw0Jb/Yuf2CfEKIZ658LtSkHjMvMxGcB00IgKs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/readchar/default.nix b/pkgs/development/python-modules/readchar/default.nix
index 60ec1cb08486..8517bb34654f 100644
--- a/pkgs/development/python-modules/readchar/default.nix
+++ b/pkgs/development/python-modules/readchar/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "readchar";
-  version = "4.0.3";
+  version = "4.0.5";
   format = "setuptools";
 
   # Don't use wheels on PyPI
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "magmax";
     repo = "python-${pname}";
     rev = "refs/tags/v${version}";
-    hash = "sha256-QMaTZRS9iOSuax706Es9WhkwU3vdcNb14dbiSt48aN0=";
+    hash = "sha256-Ru18lh+9tXtvttypnob0HNPKBiGF7E9HDL21l1AAGa8=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/types-requests/default.nix b/pkgs/development/python-modules/types-requests/default.nix
index 6b9853a7d928..b1712c818df2 100644
--- a/pkgs/development/python-modules/types-requests/default.nix
+++ b/pkgs/development/python-modules/types-requests/default.nix
@@ -6,12 +6,12 @@
 
 buildPythonPackage rec {
   pname = "types-requests";
-  version = "2.28.11.15";
+  version = "2.28.11.16";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-/I6qCcwBRpnGtjxgwuOt0MiwmkEMgYtaxuZfkqJt3gk=";
+    hash = "sha256-nUACBW3368TsHyj9cB+6gsXCJUnER3EWyyZWqjCs5ts=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/tools/goa/default.nix b/pkgs/development/tools/goa/default.nix
index 10d9e275b3a3..55abce847adf 100644
--- a/pkgs/development/tools/goa/default.nix
+++ b/pkgs/development/tools/goa/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "goa";
-  version = "3.11.2";
+  version = "3.11.3";
 
   src = fetchFromGitHub {
     owner = "goadesign";
     repo = "goa";
     rev = "v${version}";
-    sha256 = "sha256-zKiGPXkVAeWj9RXuFWvlSz1SYO+uGNBM65+ypIPZpmc=";
+    sha256 = "sha256-Po5i6pb7Qu6kYLO7rdW9SJFDf42rPx8mvSfNxtW3Qcg=";
   };
   vendorHash = "sha256-vND29xb5bG+MnBiOCP9PWC+VGqIwdUO0uVOcP5Wc4zA=";
 
diff --git a/pkgs/development/tools/gotools/default.nix b/pkgs/development/tools/gotools/default.nix
index eaa521f7a17a..e54df39b8bc1 100644
--- a/pkgs/development/tools/gotools/default.nix
+++ b/pkgs/development/tools/gotools/default.nix
@@ -1,45 +1,26 @@
-{ lib, buildGoModule, fetchgit }:
+{ lib, buildGoModule, fetchFromGitHub }:
 
 buildGoModule rec {
   pname = "gotools";
-  version = "0.1.10";
+  version = "0.7.0";
 
-  src = fetchgit {
+  # using GitHub instead of https://go.googlesource.com/tools because Gitiles UI is to basic to browse
+  src = fetchFromGitHub {
+    owner = "golang";
+    repo = "tools";
     rev = "v${version}";
-    url = "https://go.googlesource.com/tools";
-    sha256 = "sha256-r71+//VhayW18uvMl/ls/8KYNbZ7uDZw3SWoqPL3Xqk=";
+    # The gopls folder contains a Go submodule which causes a build failure
+    # and lives in its own package named gopls.
+    postFetch = ''
+      rm -r $out/gopls
+    '';
+    sha256 = "sha256-6Sdo6oKJHYXWkvJmbte7Wc7tov5AHzn70Bi1QdQ5HR4=";
   };
 
-  # The gopls folder contains a Go submodule which causes a build failure.
-  # Given that, we can't have the gopls binary be part of the gotools
-  # derivation.
-  #
-  # The attribute "gopls" provides the gopls binary.
-  #
-  # Related
-  #
-  # * https://github.com/NixOS/nixpkgs/pull/85868
-  # * https://github.com/NixOS/nixpkgs/issues/88716
-  postPatch = ''
-    rm -rf gopls
-  '';
-
-  vendorSha256 = "sha256-UJIXG8WKzazNTXoqEFlT/umC40F6z2Q5I8RfxnMbsPM=";
+  vendorSha256 = "sha256-fp0pb3EcGRDWlSpgel4pYRdsPJGk8/d57EjWJ+fzq7g=";
 
   doCheck = false;
 
-  postConfigure = ''
-    # Make the builtin tools available here
-    mkdir -p $out/bin
-    eval $(go env | grep GOTOOLDIR)
-    find $GOTOOLDIR -type f | while read x; do
-      ln -sv "$x" "$out/bin"
-    done
-    export GOTOOLDIR=$out/bin
-  '';
-
-  excludedPackages = [ "vet" "cover" ];
-
   # Set GOTOOLDIR for derivations adding this to buildInputs
   postInstall = ''
     mkdir -p $out/nix-support
@@ -47,14 +28,13 @@ buildGoModule rec {
       --subst-var-by bin $out
   '';
 
-  # Do not copy this without a good reason for enabling
-  # In this case tools is heavily coupled with go itself and embeds paths.
-  allowGoReference = true;
-
   meta = with lib; {
     description = "Additional tools for Go development";
-    homepage = "http://go.googlesource.com/tools";
+    longDescription = ''
+      This package contains tools like: godoc, goimports, callgraph, digraph, stringer or toolstash.
+    '';
+    homepage = "https://go.googlesource.com/tools";
     license = licenses.bsd3;
-    maintainers = with maintainers; [ danderson ];
+    maintainers = with maintainers; [ danderson SuperSandro2000 ];
   };
 }
diff --git a/pkgs/development/tools/misc/opengrok/default.nix b/pkgs/development/tools/misc/opengrok/default.nix
index 0c2de11eb5e4..2ddbdf666181 100644
--- a/pkgs/development/tools/misc/opengrok/default.nix
+++ b/pkgs/development/tools/misc/opengrok/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "opengrok";
-  version = "1.8.4";
+  version = "1.9.2";
 
   # binary distribution
   src = fetchurl {
     url = "https://github.com/oracle/opengrok/releases/download/${version}/${pname}-${version}.tar.gz";
-    hash = "sha256-Xy8mTpdHorGGvUGHCDKOA2HaAJY3PBWjf6Pnll4Melk=";
+    hash = "sha256-z5jqKRnxPOwj1sOFGt0m54m9t0l3xBfulvmQCYeJj40=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/development/tools/rust/cargo-vet/default.nix b/pkgs/development/tools/rust/cargo-vet/default.nix
index 93aa13a4f6ba..468a5dd04c2d 100644
--- a/pkgs/development/tools/rust/cargo-vet/default.nix
+++ b/pkgs/development/tools/rust/cargo-vet/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-vet";
-  version = "0.5.1";
+  version = "0.5.2";
 
   src = fetchFromGitHub {
     owner = "mozilla";
     repo = pname;
     rev = version;
-    sha256 = "sha256-nBhm6EDs99oKdUxT+N+IC7fY/U0yyeJyr6vbaZaiGSI=";
+    sha256 = "sha256-+Qbq3EARedsaPtSTfR/UCC/1p0b/QmvriG2AIyx8coo=";
   };
 
-  cargoSha256 = "sha256-M6CdYL8CDfFH0RaYGel6dC3LxQZzq9YbU8ecH9CWEr8=";
+  cargoSha256 = "sha256-Vij4vq+04fLpbcDpYVMBVl3QNVZprUYcVLB28mrjUOg=";
 
   buildInputs = lib.optional stdenv.isDarwin Security;
 
diff --git a/pkgs/development/tools/sentry-cli/default.nix b/pkgs/development/tools/sentry-cli/default.nix
index dd2edd57038f..7d7d1fc3ac22 100644
--- a/pkgs/development/tools/sentry-cli/default.nix
+++ b/pkgs/development/tools/sentry-cli/default.nix
@@ -9,13 +9,13 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "sentry-cli";
-  version = "2.15.2";
+  version = "2.16.0";
 
   src = fetchFromGitHub {
     owner = "getsentry";
     repo = "sentry-cli";
     rev = version;
-    sha256 = "sha256-niPQC9h/7D6nHgC+eKjY4gQwrhN0OxB5QlhKInI4LpA=";
+    sha256 = "sha256-8Dd0gz0j8kdB7/18gfrOSinALx1KAlY79tpt0jqPmdQ=";
   };
   doCheck = false;
 
@@ -25,7 +25,7 @@ rustPlatform.buildRustPackage rec {
   buildInputs = [ openssl ] ++ lib.optionals stdenv.isDarwin [ Security SystemConfiguration ];
   nativeBuildInputs = [ pkg-config ];
 
-  cargoHash = "sha256-hsVYbIfhKYAxW9hqxWJ2GrutDZGLDLR3vGhanl1PND4=";
+  cargoHash = "sha256-CIjtEgekid/ZIpVNO2R56gz7B7HLtlFHErnSNhVacWM=";
 
   meta = with lib; {
     homepage = "https://docs.sentry.io/cli/";
diff --git a/pkgs/development/web/bun/default.nix b/pkgs/development/web/bun/default.nix
index 61f6a8abf036..809397e8713a 100644
--- a/pkgs/development/web/bun/default.nix
+++ b/pkgs/development/web/bun/default.nix
@@ -12,7 +12,7 @@
 }:
 
 stdenvNoCC.mkDerivation rec {
-  version = "0.5.7";
+  version = "0.5.8";
   pname = "bun";
 
   src = passthru.sources.${stdenvNoCC.hostPlatform.system} or (throw "Unsupported system: ${stdenvNoCC.hostPlatform.system}");
@@ -33,19 +33,19 @@ stdenvNoCC.mkDerivation rec {
     sources = {
       "aarch64-darwin" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-darwin-aarch64.zip";
-        sha256 = "m0lFokGfJY3qXLYO4vnFFqKb3/IPRXWN3L6PV5DqtX0=";
+        sha256 = "phTBV0vQT7Qgf1wY9Qqc7xXrs3Cms9jKpjp1KxlTbz8=";
       };
       "aarch64-linux" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-linux-aarch64.zip";
-        sha256 = "XSUbfRkjo7yiPrPa/Mp30WolFex+Evziphut1sKflDE=";
+        sha256 = "weH+Aygh8Ud9cfMOVpZe8EjL7BWsXBlm9GDnkZa/x0c=";
       };
       "x86_64-darwin" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-darwin-x64.zip";
-        sha256 = "RuZ0T5Y7Vi9mtyFL8ul715MRO4XozDf0WS+qjayx1kg=";
+        sha256 = "pYvBjlTPLuwOlarlZKXuvn7y6wTRdyHM/leb3hOJHrY=";
       };
       "x86_64-linux" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-linux-x64.zip";
-        sha256 = "uOVHQIjvZW0Gqv/GLlvbXl5bDcnwR80AP1lUJ2v2ZoM=";
+        sha256 = "+NiZtMUQBGPtI4VbtfIb+oZX+RMjIJiTnEbvoeeCC84=";
       };
     };
     updateScript = writeShellScript "update-bun" ''
diff --git a/pkgs/games/dxx-rebirth/default.nix b/pkgs/games/dxx-rebirth/default.nix
index 7ec7ab99b566..95cf0918b52c 100644
--- a/pkgs/games/dxx-rebirth/default.nix
+++ b/pkgs/games/dxx-rebirth/default.nix
@@ -22,13 +22,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "dxx-rebirth";
-  version = "unstable-2022-09-17";
+  version = "unstable-2023-03-23";
 
   src = fetchFromGitHub {
     owner = "dxx-rebirth";
     repo = "dxx-rebirth";
-    rev = "ad46235b67a24a38dec4734f94a59eba149ad94a";
-    hash = "sha256-vIAY1O4VnOsV617J5yjg09JIL/vK4Fb/lopnX17g+uY=";
+    rev = "841ebcc11d249febe48911bc239606ade3bd78b3";
+    hash = "sha256-cr5QdkKO/HNvtc2w4ynJixuLauhPCwtsSC3UEV7+C1A=";
   };
 
   nativeBuildInputs = [ pkg-config scons ];
diff --git a/pkgs/games/opentyrian/default.nix b/pkgs/games/opentyrian/default.nix
index 5d386bce6db9..f01874ce9435 100644
--- a/pkgs/games/opentyrian/default.nix
+++ b/pkgs/games/opentyrian/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "opentyrian";
-  version = "2.1.20220318";
+  version = "2.1.20221123";
 
   src = fetchFromGitHub {
     owner = "opentyrian";
     repo = "opentyrian";
     rev = "v${version}";
-    sha256 = "01z1zxpps4ils0bnwazl9lmqdbfhfd8fkacahnh6kqyczavg40xg";
+    sha256 = "sha256-fVcc8v1c9uU72X6afEo4VoMo6YuDECQSwDQ/TQjgwUY=";
   };
 
   data = fetchzip {
diff --git a/pkgs/games/xonotic/default.nix b/pkgs/games/xonotic/default.nix
index cad021ff5705..56f1336db8da 100644
--- a/pkgs/games/xonotic/default.nix
+++ b/pkgs/games/xonotic/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchurl, fetchzip, makeWrapper, runCommand, makeDesktopItem
 , xonotic-data, copyDesktopItems
 , # required for both
-  unzip, libjpeg, zlib, libvorbis, curl
+  unzip, libjpeg, zlib, libvorbis, curl, freetype, libpng, libtheora
 , # glx
   libX11, libGLU, libGL, libXpm, libXext, libXxf86vm, alsa-lib
 , # sdl
@@ -121,14 +121,22 @@ let
       patchelf \
           --add-needed ${curl.out}/lib/libcurl.so \
           --add-needed ${libvorbis}/lib/libvorbisfile.so \
+          --add-needed ${libvorbis}/lib/libvorbisenc.so \
           --add-needed ${libvorbis}/lib/libvorbis.so \
           --add-needed ${libGL.out}/lib/libGL.so \
+          --add-needed ${freetype}/lib/libfreetype.so \
+          --add-needed ${libpng}/lib/libpng.so \
+          --add-needed ${libtheora}/lib/libtheora.so \
           $out/bin/xonotic-glx
     '' + lib.optionalString withSDL ''
       patchelf \
           --add-needed ${curl.out}/lib/libcurl.so \
           --add-needed ${libvorbis}/lib/libvorbisfile.so \
+          --add-needed ${libvorbis}/lib/libvorbisenc.so \
           --add-needed ${libvorbis}/lib/libvorbis.so \
+          --add-needed ${freetype}/lib/libfreetype.so \
+          --add-needed ${libpng}/lib/libpng.so \
+          --add-needed ${libtheora}/lib/libtheora.so \
           $out/bin/xonotic-sdl
     '';
   };
diff --git a/pkgs/os-specific/darwin/apple-source-releases/Csu/default.nix b/pkgs/os-specific/darwin/apple-source-releases/Csu/default.nix
index ac09a282f512..cc73c0ac9415 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/Csu/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/Csu/default.nix
@@ -18,6 +18,7 @@ appleDerivation' stdenv {
   '';
 
   installFlags = [ "DSTROOT=$(out)" ];
+  enableParallelInstalling = false; # cp: cannot create regular file '$out/lib/crt1.10.6.o'
 
   meta = with lib; {
     description = "Apple's common startup stubs for darwin";
diff --git a/pkgs/servers/monitoring/karma/default.nix b/pkgs/servers/monitoring/karma/default.nix
index 272680dc50d6..8980d913aecf 100644
--- a/pkgs/servers/monitoring/karma/default.nix
+++ b/pkgs/servers/monitoring/karma/default.nix
@@ -19,16 +19,16 @@ in
 
 buildGoModule rec {
   pname = "karma";
-  version = "0.113";
+  version = "0.114";
 
   src = fetchFromGitHub {
     owner = "prymitive";
     repo = "karma";
     rev = "v${version}";
-    hash = "sha256-q0RGdwZQv8ypBcjrf0UjBSp2PlaKzM0wX5q4GzUNX9o=";
+    hash = "sha256-ZstBumK2ywwdr1ksMN7P8mHdYUiMOpfpYnvt0v0Io4w=";
   };
 
-  vendorHash = "sha256-8YyTHPIr5Kk7M0LH662KQw4t2CuHZ/3jD0Rzhl8ps0M=";
+  vendorHash = "sha256-ZsXPA4KyKbc/bwkidyHNDg62mE8KlE+yIssOBZLmHVg=";
 
   nativeBuildInputs = [
     nodejs-18_x
diff --git a/pkgs/servers/monitoring/plugins/wmic-bin.nix b/pkgs/servers/monitoring/plugins/wmic-bin.nix
index 7ce7802eaf4a..4cfbcd254133 100644
--- a/pkgs/servers/monitoring/plugins/wmic-bin.nix
+++ b/pkgs/servers/monitoring/plugins/wmic-bin.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitHub, autoPatchelfHook, popt, libxcrypt }:
+{ stdenv, lib, fetchFromGitHub, autoPatchelfHook, popt, libxcrypt-legacy }:
 
 stdenv.mkDerivation rec {
   pname = "wmic-bin";
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "1w1mdbiwz37wzry1q38h8dyjaa6iggmsb9wcyhhlawwm1vj50w48";
   };
 
-  buildInputs = [ popt libxcrypt ];
+  buildInputs = [ popt libxcrypt-legacy ];
 
   nativeBuildInputs = [ autoPatchelfHook ];
 
diff --git a/pkgs/servers/web-apps/moodle/default.nix b/pkgs/servers/web-apps/moodle/default.nix
index 726552f3093b..5ffbe05e7369 100644
--- a/pkgs/servers/web-apps/moodle/default.nix
+++ b/pkgs/servers/web-apps/moodle/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchurl, writeText, plugins ? [ ], nixosTests }:
 
 let
-  version = "4.1.1";
+  version = "4.1.2";
 
   versionParts = lib.take 2 (lib.splitVersion version);
   # 4.2 -> 402, 3.11 -> 311
@@ -15,7 +15,7 @@ in stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://download.moodle.org/stable${stableVersion}/${pname}-${version}.tgz";
-    sha256 = "sha256-w6N/jFYieL+yJXlDr1/9AATChSqiatx+aJl0XSOSL0s=";
+    sha256 = "sha256-ddXldOQLefV6Kjla+IeFwD50Vye4kholJD5R6X6A2Og=";
   };
 
   phpConfig = writeText "config.php" ''
diff --git a/pkgs/tools/admin/scaleway-cli/default.nix b/pkgs/tools/admin/scaleway-cli/default.nix
index 273d22a1980c..49bd0d72ad50 100644
--- a/pkgs/tools/admin/scaleway-cli/default.nix
+++ b/pkgs/tools/admin/scaleway-cli/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "scaleway-cli";
-  version = "2.12.0";
+  version = "2.13.0";
 
   src = fetchFromGitHub {
     owner = "scaleway";
     repo = "scaleway-cli";
     rev = "v${version}";
-    sha256 = "sha256-4BIw+vk0LJL6/AWtZDtOP88UqUg1EiDASMaEP3/7Bx0=";
+    sha256 = "sha256-C8Yeq2Mwyc3oPQSby8NiNrSNHle7Mc7uexg+G17Cl3M=";
   };
 
-  vendorHash = "sha256-Wdbh7rFKvWdDULMwYxvTrWim6iO6kQaYseSkq2PBfUM=";
+  vendorHash = "sha256-1OwzvGngSv8N5IFlB+vOKyPAaPnY4h2i0vKQAcQHt5o=";
 
   ldflags = [
     "-w"
diff --git a/pkgs/tools/misc/bdf2psf/default.nix b/pkgs/tools/misc/bdf2psf/default.nix
index 0fdb2736d201..c389d9158d0f 100644
--- a/pkgs/tools/misc/bdf2psf/default.nix
+++ b/pkgs/tools/misc/bdf2psf/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "bdf2psf";
-  version = "1.217";
+  version = "1.218";
 
   src = fetchurl {
     url = "mirror://debian/pool/main/c/console-setup/bdf2psf_${version}_all.deb";
-    sha256 = "sha256-Rsud1DEsI946F8VzaF+S8nqTMih7ILWPhfx4zqa4Y9E=";
+    sha256 = "sha256-pHL3Q/qOLq8AAmMuNoGRzz+c1xQxJk/6+t6u3EdWqMY=";
   };
 
   nativeBuildInputs = [ dpkg ];
diff --git a/pkgs/tools/misc/mapcidr/default.nix b/pkgs/tools/misc/mapcidr/default.nix
index 9bed612bd598..d300a282af27 100644
--- a/pkgs/tools/misc/mapcidr/default.nix
+++ b/pkgs/tools/misc/mapcidr/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "mapcidr";
-  version = "1.1.0";
+  version = "1.1.1";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-cpNNStPgGnEtiiHgpiLUvEFu78NtyJIVgjrkh6N+dLU=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-HmX4C1DXPS/14TGxKFnw/sxxp2suU6c4GC5W7ZtzjZ8=";
   };
 
-  vendorHash = "sha256-t6bTbgOTWNz3nz/Tgwkd+TCBhN++0UaV0LqaEsO9YCI=";
+  vendorHash = "sha256-7cB+fDYWy1Qe3apEPaUMA2+6KmMpC7ANjEgIde00Pas=";
 
   modRoot = ".";
   subPackages = [
@@ -28,6 +28,7 @@ buildGoModule rec {
       operations, it can be used both as a library and as independent CLI tool.
     '';
     homepage = "https://github.com/projectdiscovery/mapcidr";
+    changelog = "https://github.com/projectdiscovery/mapcidr/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ hanemile ];
   };
diff --git a/pkgs/tools/misc/trdl-client/default.nix b/pkgs/tools/misc/trdl-client/default.nix
index 9b60199c9eb9..b5f4405e64df 100644
--- a/pkgs/tools/misc/trdl-client/default.nix
+++ b/pkgs/tools/misc/trdl-client/default.nix
@@ -7,18 +7,18 @@
 
 buildGoModule rec {
   pname = "trdl-client";
-  version = "0.6.3";
+  version = "0.6.5";
 
   src = fetchFromGitHub {
     owner = "werf";
     repo = "trdl";
     rev = "v${version}";
-    hash = "sha256-mmhbcBNHvx14Ihzq8UemPU8oYi/Gn3NK0FDZRVJvvfQ=";
+    hash = "sha256-jJwRIfxmjlhfS/0+IN2IdQPlO9FkTb64PWUiLwkarfM=";
   };
 
   sourceRoot = "source/client";
 
-  vendorHash = "sha256-3B4MYj1jlovjWGIVK233t+e/mP8eEdHHv2M3xXSHaaM=";
+  vendorHash = "sha256-f7FPeR+us3WvwqzcSQLbkKv905CCIAAm+HNV2FFF8OY=";
 
   subPackages = [ "cmd/trdl" ];
 
diff --git a/pkgs/tools/security/gopass/default.nix b/pkgs/tools/security/gopass/default.nix
index 7f7a18534734..30cc99a05925 100644
--- a/pkgs/tools/security/gopass/default.nix
+++ b/pkgs/tools/security/gopass/default.nix
@@ -53,6 +53,9 @@ buildGoModule rec {
       --prefix PATH : "${wrapperPath}" \
       --set GOPASS_NO_REMINDER true
   '';
+  passthru = {
+    inherit wrapperPath;
+  };
 
   meta = with lib; {
     description = "The slightly more awesome Standard Unix Password Manager for Teams. Written in Go";
diff --git a/pkgs/tools/security/gopass/jsonapi.nix b/pkgs/tools/security/gopass/jsonapi.nix
index 7ce9c4cc8709..febe9abf0ea7 100644
--- a/pkgs/tools/security/gopass/jsonapi.nix
+++ b/pkgs/tools/security/gopass/jsonapi.nix
@@ -29,7 +29,7 @@ buildGoModule rec {
 
   postFixup = ''
     wrapProgram $out/bin/gopass-jsonapi \
-      --prefix PATH : "${lib.makeBinPath [ gopass ]}"
+      --prefix PATH : "${gopass.wrapperPath}"
   '';
 
   meta = with lib; {
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index a9c304e302b4..195ff597b2b9 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -22484,12 +22484,24 @@ with pkgs;
   # Default libGLU
   libGLU = mesa_glu;
 
-  mesa = callPackage ../development/libraries/mesa {
-    llvmPackages = llvmPackages_15;
-    stdenv = if stdenv.isDarwin then darwin.apple_sdk_11_0.stdenv else stdenv;
+  # When a new patch is out, add a new mesa attribute with the exact patch version
+  # Remove old mesa attributes when they're unused.
+  # Try to keep the previous version around for a bit in case there are new bugs.
+  mesa_22_3_7 = darwin.apple_sdk_11_0.callPackage ../development/libraries/mesa/22.3.7.nix {
     inherit (darwin.apple_sdk_11_0.frameworks) OpenGL;
     inherit (darwin.apple_sdk_11_0.libs) Xplugin;
   };
+  mesa_23_0_1 = darwin.apple_sdk_11_0.callPackage ../development/libraries/mesa/23.0.1.nix {
+    inherit (darwin.apple_sdk_11_0.frameworks) OpenGL;
+    inherit (darwin.apple_sdk_11_0.libs) Xplugin;
+  };
+  # Bump this immediately on patches; wait a bit for minor versions
+  mesa_22 = mesa_22_3_7;
+  mesa_23 = mesa_23_0_1;
+  # Bump on staging only, tonnes of packages depend on it.
+  # See https://github.com/NixOS/nixpkgs/issues/218232
+  # Major versions should be bumped when they have proven to be reasonably stable
+  mesa = mesa_22_3_7;
 
   mesa_glu =  callPackage ../development/libraries/mesa-glu {
     inherit (darwin.apple_sdk.frameworks) ApplicationServices;
@@ -23072,7 +23084,6 @@ with pkgs;
   protobuf3_20 = callPackage ../development/libraries/protobuf/3.20.nix { };
   protobuf3_19 = callPackage ../development/libraries/protobuf/3.19.nix { };
   protobuf3_17 = callPackage ../development/libraries/protobuf/3.17.nix { };
-  protobuf3_8 = callPackage ../development/libraries/protobuf/3.8.nix { };
 
   protobufc = callPackage ../development/libraries/protobufc { };
 
@@ -28904,9 +28915,7 @@ with pkgs;
 
   bombadillo = callPackage ../applications/networking/browsers/bombadillo { };
 
-  bombono = callPackage ../applications/video/bombono {
-    scons = sconsPackages.scons_4_1_0;
-  };
+  bombono = callPackage ../applications/video/bombono { };
 
   bonzomatic = callPackage ../applications/editors/bonzomatic { };
 
@@ -35541,9 +35550,7 @@ with pkgs;
 
   dwarf-therapist = dwarf-fortress-packages.dwarf-therapist;
 
-  dxx-rebirth = callPackage ../games/dxx-rebirth {
-    scons = sconsPackages.scons_4_1_0;
-  };
+  dxx-rebirth = callPackage ../games/dxx-rebirth { };
 
   inherit (callPackages ../games/dxx-rebirth/assets.nix { })
     descent1-assets
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 8b466e0ae38d..71772fe38fe3 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -1180,6 +1180,10 @@ let
       hash = "sha256-tfr0fj+UikUoEGzLiMxxBIz+WY5bAmpEQ2i8fjk0gGc=";
     };
     propagatedBuildInputs = [ ClassAccessor CryptPasswdMD5 DigestSHA1 IOLockedFile ];
+    # Remove test files that fail after DES support was removed from crypt()
+    postPatch = ''
+      rm t/04core.t t/05edit.t
+    '';
     meta = {
       description = "Interface to read and modify Apache .htpasswd files";
       license = with lib.licenses; [ artistic1 gpl1Plus ];
@@ -2252,6 +2256,9 @@ let
     };
     buildInputs = [ ModuleBuildTiny TestLongString TestSimple13 TestWWWMechanize TestWWWMechanizeCatalyst ];
     propagatedBuildInputs = [ AuthenHtpasswd CatalystPluginAuthentication ];
+    patches = [
+      ../development/perl-modules/CatalystAuthenticationStoreHtpasswd-test-replace-DES-hash-with-bcrypt.patch
+    ];
     meta = {
       description = "Authen::Htpasswd based user storage/authentication";
       license = with lib.licenses; [ artistic1 gpl1Plus ];