diff --git a/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
index 915d98e8c2c4..964da5d58310 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
@@ -248,6 +248,14 @@
           <link linkend="opt-services.schleuder.enable">services.schleuder</link>.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          <link xlink:href="https://www.dolibarr.org/">Dolibarr</link>,
+          an enterprise resource planning and customer relationship
+          manager. Enable using
+          <link linkend="opt-services.dolibarr.enable">services.dolibarr</link>.
+        </para>
+      </listitem>
       <listitem>
         <para>
           <link xlink:href="https://www.expressvpn.com">expressvpn</link>,
diff --git a/nixos/doc/manual/release-notes/rl-2211.section.md b/nixos/doc/manual/release-notes/rl-2211.section.md
index da14a8c973db..55a5d3c13628 100644
--- a/nixos/doc/manual/release-notes/rl-2211.section.md
+++ b/nixos/doc/manual/release-notes/rl-2211.section.md
@@ -90,6 +90,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - [schleuder](https://schleuder.org/), a mailing list manager with PGP support. Enable using [services.schleuder](#opt-services.schleuder.enable).
 
+- [Dolibarr](https://www.dolibarr.org/), an enterprise resource planning and customer relationship manager. Enable using [services.dolibarr](#opt-services.dolibarr.enable).
+
 - [expressvpn](https://www.expressvpn.com), the CLI client for ExpressVPN. Available as [services.expressvpn](#opt-services.expressvpn.enable).
 
 - [Grafana Tempo](https://www.grafana.com/oss/tempo/), a distributed tracing store. Available as [services.tempo](#opt-services.tempo.enable).
diff --git a/nixos/modules/config/no-x-libs.nix b/nixos/modules/config/no-x-libs.nix
index 42e68c2eadc1..946c9bf38c47 100644
--- a/nixos/modules/config/no-x-libs.nix
+++ b/nixos/modules/config/no-x-libs.nix
@@ -27,9 +27,13 @@ with lib;
     fonts.fontconfig.enable = false;
 
     nixpkgs.overlays = singleton (const (super: {
+      beam = super.beam_nox;
       cairo = super.cairo.override { x11Support = false; };
       dbus = super.dbus.override { x11Support = false; };
-      beam = super.beam_nox;
+      ffmpeg_4 = super.ffmpeg_4.override { sdlSupport = false; vdpauSupport = false; };
+      ffmpeg_5 = super.ffmpeg_5.override { sdlSupport = false; vdpauSupport = false; };
+      gobject-introspection = super.gobject-introspection.override { x11Support = false; };
+      libva = super.libva-minimal;
       networkmanager-fortisslvpn = super.networkmanager-fortisslvpn.override { withGnome = false; };
       networkmanager-iodine = super.networkmanager-iodine.override { withGnome = false; };
       networkmanager-l2tp = super.networkmanager-l2tp.override { withGnome = false; };
@@ -37,7 +41,6 @@ with lib;
       networkmanager-openvpn = super.networkmanager-openvpn.override { withGnome = false; };
       networkmanager-sstp = super.networkmanager-vpnc.override { withGnome = false; };
       networkmanager-vpnc = super.networkmanager-vpnc.override { withGnome = false; };
-      gobject-introspection = super.gobject-introspection.override { x11Support = false; };
       qemu = super.qemu.override { gtkSupport = false; spiceSupport = false; sdlSupport = false; };
     }));
   };
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 132bbdcd933b..12692d7bfbe6 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1065,6 +1065,7 @@
   ./services/web-apps/discourse.nix
   ./services/web-apps/documize.nix
   ./services/web-apps/dokuwiki.nix
+  ./services/web-apps/dolibarr.nix
   ./services/web-apps/engelsystem.nix
   ./services/web-apps/ethercalc.nix
   ./services/web-apps/fluidd.nix
diff --git a/nixos/modules/services/networking/minidlna.nix b/nixos/modules/services/networking/minidlna.nix
index 0cac41f58da3..549f1fe5de30 100644
--- a/nixos/modules/services/networking/minidlna.nix
+++ b/nixos/modules/services/networking/minidlna.nix
@@ -1,6 +1,5 @@
 # Module for MiniDLNA, a simple DLNA server.
 { config, lib, pkgs, ... }:
-
 with lib;
 
 let
@@ -34,8 +33,7 @@ in
     default = {};
     description = lib.mdDoc ''
       The contents of MiniDLNA's configuration file.
-      When the service is activated, a basic template is generated
-      from the current options opened here.
+      When the service is activated, a basic template is generated from the current options opened here.
     '';
     type = types.submodule {
       freeformType = settingsFormat.type;
@@ -46,10 +44,8 @@ in
         example = [ "/data/media" "V,/home/alice/video" ];
         description = lib.mdDoc ''
           Directories to be scanned for media files.
-          The prefixes `A,`,`V,` and
-          `P,` restrict a directory to audio, video
-          or image files. The directories must be accessible to the
-          `minidlna` user account.
+          The `A,` `V,` `P,` prefixes restrict a directory to audio, video or image files.
+          The directories must be accessible to the `minidlna` user account.
         '';
       };
       options.notify_interval = mkOption {
@@ -57,18 +53,11 @@ in
         default = 90000;
         description = lib.mdDoc ''
           The interval between announces (in seconds).
-          Instead of waiting on announces, one can open port UDP 1900 or
-          set `openFirewall` option to use SSDP discovery.
-          Furthermore announce interval has now been set as 90000 in order
-          to prevent disconnects with certain clients and to rely solely
-          on the SSDP method.
-
-          Lower values (e.g. 60 seconds) should be used if one does not
-          want to utilize SSDP. By default miniDLNA will announce its
-          presence on the network approximately every 15 minutes. Many
-          people prefer shorter announce intervals on their home networks,
-          especially when DLNA clients are started on demand.
+          Instead of waiting for announces, you should set `openFirewall` option to use SSDP discovery.
+          Furthermore, this option has been set to 90000 in order to prevent disconnects with certain
+          clients and relies solely on the discovery.
 
+          Lower values (e.g. 30 seconds) should be used if you can't use the discovery.
           Some relevant information can be found here:
           https://sourceforge.net/p/minidlna/discussion/879957/thread/1389d197/
         '';
@@ -86,7 +75,7 @@ in
       };
       options.friendly_name = mkOption {
         type = types.str;
-        default = "${config.networking.hostName} MiniDLNA";
+        default = config.networking.hostName;
         defaultText = literalExpression "config.networking.hostName";
         example = "rpi3";
         description = lib.mdDoc "Name that the DLNA server presents to clients.";
@@ -116,7 +105,7 @@ in
       options.wide_links = mkOption {
         type = types.enum [ "yes" "no" ];
         default = "no";
-        description = lib.mdDoc "Set this to yes to allow symlinks that point outside user-defined media_dirs.";
+        description = lib.mdDoc "Set this to yes to allow symlinks that point outside user-defined `media_dir`.";
       };
     };
   };
diff --git a/nixos/modules/services/web-apps/dolibarr.nix b/nixos/modules/services/web-apps/dolibarr.nix
new file mode 100644
index 000000000000..2b2e2a6214dc
--- /dev/null
+++ b/nixos/modules/services/web-apps/dolibarr.nix
@@ -0,0 +1,320 @@
+{ config, pkgs, lib, ... }:
+let
+  inherit (lib) any boolToString concatStringsSep isBool isString literalExpression mapAttrsToList mkDefault mkEnableOption mkIf mkOption optionalAttrs types;
+
+  package = pkgs.dolibarr.override { inherit (cfg) stateDir; };
+
+  cfg = config.services.dolibarr;
+  vhostCfg = config.services.nginx.virtualHosts."${cfg.domain}";
+
+  mkConfigFile = filename: settings:
+    let
+      # hack in special logic for secrets so we read them from a separate file avoiding the nix store
+      secretKeys = [ "force_install_databasepass" "dolibarr_main_db_pass" "dolibarr_main_instance_unique_id" ];
+
+      toStr = k: v:
+        if (any (str: k == str) secretKeys) then v
+        else if isString v then "'${v}'"
+        else if isBool v then boolToString v
+        else if isNull v then "null"
+        else toString v
+      ;
+    in
+      pkgs.writeText filename ''
+        <?php
+        ${concatStringsSep "\n" (mapAttrsToList (k: v: "\$${k} = ${toStr k v};") settings)}
+      '';
+
+  # see https://github.com/Dolibarr/dolibarr/blob/develop/htdocs/install/install.forced.sample.php for all possible values
+  install = {
+    force_install_noedit = 2;
+    force_install_main_data_root = "${cfg.stateDir}/documents";
+    force_install_nophpinfo = true;
+    force_install_lockinstall = "444";
+    force_install_distrib = "nixos";
+    force_install_type = "mysqli";
+    force_install_dbserver = cfg.database.host;
+    force_install_port = toString cfg.database.port;
+    force_install_database = cfg.database.name;
+    force_install_databaselogin = cfg.database.user;
+
+    force_install_mainforcehttps = vhostCfg.forceSSL;
+    force_install_createuser = false;
+    force_install_dolibarrlogin = null;
+  } // optionalAttrs (cfg.database.passwordFile != null) {
+    force_install_databasepass = ''file_get_contents("${cfg.database.passwordFile}")'';
+  };
+in
+{
+  # interface
+  options.services.dolibarr = {
+    enable = mkEnableOption "dolibarr";
+
+    domain = mkOption {
+      type = types.str;
+      default = "localhost";
+      description = ''
+        Domain name of your server.
+      '';
+    };
+
+    user = mkOption {
+      type = types.str;
+      default = "dolibarr";
+      description = ''
+        User account under which dolibarr runs.
+
+        <note><para>
+          If left as the default value this user will automatically be created
+          on system activation, otherwise you are responsible for
+          ensuring the user exists before the dolibarr application starts.
+        </para></note>
+      '';
+    };
+
+    group = mkOption {
+      type = types.str;
+      default = "dolibarr";
+      description = ''
+        Group account under which dolibarr runs.
+
+        <note><para>
+          If left as the default value this group will automatically be created
+          on system activation, otherwise you are responsible for
+          ensuring the group exists before the dolibarr application starts.
+        </para></note>
+      '';
+    };
+
+    stateDir = mkOption {
+      type = types.str;
+      default = "/var/lib/dolibarr";
+      description = ''
+        State and configuration directory dolibarr will use.
+      '';
+    };
+
+    database = {
+      host = mkOption {
+        type = types.str;
+        default = "localhost";
+        description = "Database host address.";
+      };
+      port = mkOption {
+        type = types.port;
+        default = 3306;
+        description = "Database host port.";
+      };
+      name = mkOption {
+        type = types.str;
+        default = "dolibarr";
+        description = "Database name.";
+      };
+      user = mkOption {
+        type = types.str;
+        default = "dolibarr";
+        description = "Database username.";
+      };
+      passwordFile = mkOption {
+        type = with types; nullOr path;
+        default = null;
+        example = "/run/keys/dolibarr-dbpassword";
+        description = "Database password file.";
+      };
+      createLocally = mkOption {
+        type = types.bool;
+        default = true;
+        description = "Create the database and database user locally.";
+      };
+    };
+
+    settings = mkOption {
+      type = with types; (attrsOf (oneOf [ bool int str ]));
+      default = { };
+      description = lib.mdDoc "Dolibarr settings, see <https://github.com/Dolibarr/dolibarr/blob/develop/htdocs/conf/conf.php.example> for details.";
+    };
+
+    nginx = mkOption {
+      type = types.nullOr (types.submodule (
+        lib.recursiveUpdate
+          (import ../web-servers/nginx/vhost-options.nix { inherit config lib; })
+          {
+            # enable encryption by default,
+            # as sensitive login and Dolibarr (ERP) data should not be transmitted in clear text.
+            options.forceSSL.default = true;
+            options.enableACME.default = true;
+          }
+      ));
+      default = null;
+      example = lib.literalExpression ''
+        {
+          serverAliases = [
+            "dolibarr.''${config.networking.domain}"
+            "erp.''${config.networking.domain}"
+          ];
+          enableACME = false;
+        }
+      '';
+      description = lib.mdDoc ''
+          With this option, you can customize an nginx virtual host which already has sensible defaults for Dolibarr.
+          Set to {} if you do not need any customization to the virtual host.
+          If enabled, then by default, the {option}`serverName` is
+          `''${domain}`,
+          SSL is active, and certificates are acquired via ACME.
+          If this is set to null (the default), no nginx virtualHost will be configured.
+      '';
+    };
+
+    poolConfig = mkOption {
+      type = with types; attrsOf (oneOf [ str int bool ]);
+      default = {
+        "pm" = "dynamic";
+        "pm.max_children" = 32;
+        "pm.start_servers" = 2;
+        "pm.min_spare_servers" = 2;
+        "pm.max_spare_servers" = 4;
+        "pm.max_requests" = 500;
+      };
+      description = lib.mdDoc ''
+        Options for the Dolibarr PHP pool. See the documentation on [`php-fpm.conf`](https://www.php.net/manual/en/install.fpm.configuration.php)
+        for details on configuration directives.
+      '';
+    };
+  };
+
+  # implementation
+  config = mkIf cfg.enable {
+
+    assertions = [
+      { assertion = cfg.database.createLocally -> cfg.database.user == cfg.user;
+        message = "services.dolibarr.database.user must match services.dolibarr.user if the database is to be automatically provisioned";
+      }
+    ];
+
+    services.dolibarr.settings = {
+      dolibarr_main_url_root = "https://${cfg.domain}";
+      dolibarr_main_document_root = "${package}/htdocs";
+      dolibarr_main_url_root_alt = "/custom";
+      dolibarr_main_data_root = "${cfg.stateDir}/documents";
+
+      dolibarr_main_db_host = cfg.database.host;
+      dolibarr_main_db_port = toString cfg.database.port;
+      dolibarr_main_db_name = cfg.database.name;
+      dolibarr_main_db_prefix = "llx_";
+      dolibarr_main_db_user = cfg.database.user;
+      dolibarr_main_db_pass = mkIf (cfg.database.passwordFile != null) ''
+        file_get_contents("${cfg.database.passwordFile}")
+      '';
+      dolibarr_main_db_type = "mysqli";
+      dolibarr_main_db_character_set = mkDefault "utf8";
+      dolibarr_main_db_collation = mkDefault "utf8_unicode_ci";
+
+      # Authentication settings
+      dolibarr_main_authentication = mkDefault "dolibarr";
+
+      # Security settings
+      dolibarr_main_prod = true;
+      dolibarr_main_force_https = vhostCfg.forceSSL;
+      dolibarr_main_restrict_os_commands = "${pkgs.mariadb}/bin/mysqldump, ${pkgs.mariadb}/bin/mysql";
+      dolibarr_nocsrfcheck = false;
+      dolibarr_main_instance_unique_id = ''
+        file_get_contents("${cfg.stateDir}/dolibarr_main_instance_unique_id")
+      '';
+      dolibarr_mailing_limit_sendbyweb = false;
+    };
+
+    systemd.tmpfiles.rules = [
+      "d '${cfg.stateDir}' 0750 ${cfg.user} ${cfg.group}"
+      "d '${cfg.stateDir}/documents' 0750 ${cfg.user} ${cfg.group}"
+      "f '${cfg.stateDir}/conf.php' 0660 ${cfg.user} ${cfg.group}"
+      "L '${cfg.stateDir}/install.forced.php' - ${cfg.user} ${cfg.group} - ${mkConfigFile "install.forced.php" install}"
+    ];
+
+    services.mysql = mkIf cfg.database.createLocally {
+      enable = mkDefault true;
+      package = mkDefault pkgs.mariadb;
+      ensureDatabases = [ cfg.database.name ];
+      ensureUsers = [
+        { name = cfg.database.user;
+          ensurePermissions = { "${cfg.database.name}.*" = "ALL PRIVILEGES"; };
+        }
+      ];
+    };
+
+    services.nginx.enable = mkIf (cfg.nginx != null) true;
+    services.nginx.virtualHosts."${cfg.domain}" = mkIf (cfg.nginx != null) (lib.mkMerge [
+      cfg.nginx
+      ({
+        root = lib.mkForce "${package}/htdocs";
+        locations."/".index = "index.php";
+        locations."~ [^/]\\.php(/|$)" = {
+          extraConfig = ''
+            fastcgi_split_path_info ^(.+?\.php)(/.*)$;
+            fastcgi_pass unix:${config.services.phpfpm.pools.dolibarr.socket};
+          '';
+        };
+      })
+    ]);
+
+    systemd.services."phpfpm-dolibarr".after = mkIf cfg.database.createLocally [ "mysql.service" ];
+    services.phpfpm.pools.dolibarr = {
+      inherit (cfg) user group;
+      phpPackage = pkgs.php.buildEnv {
+        extensions = { enabled, all }: enabled ++ [ all.calendar ];
+        # recommended by dolibarr web application
+        extraConfig = ''
+          session.use_strict_mode = 1
+          session.cookie_samesite = "Lax"
+          ; open_basedir = "${package}/htdocs, ${cfg.stateDir}"
+          allow_url_fopen = 0
+          disable_functions = "pcntl_alarm, pcntl_fork, pcntl_waitpid, pcntl_wait, pcntl_wifexited, pcntl_wifstopped, pcntl_wifsignaled, pcntl_wifcontinued, pcntl_wexitstatus, pcntl_wtermsig, pcntl_wstopsig, pcntl_signal, pcntl_signal_get_handler, pcntl_signal_dispatch, pcntl_get_last_error, pcntl_strerror, pcntl_sigprocmask, pcntl_sigwaitinfo, pcntl_sigtimedwait, pcntl_exec, pcntl_getpriority, pcntl_setpriority, pcntl_async_signals"
+        '';
+      };
+
+      settings = {
+        "listen.mode" = "0660";
+        "listen.owner" = cfg.user;
+        "listen.group" = cfg.group;
+      } // cfg.poolConfig;
+    };
+
+    # there are several challenges with dolibarr and NixOS which we can address here
+    # - the dolibarr installer cannot be entirely automated, though it can partially be by including a file called install.forced.php
+    # - the dolibarr installer requires write access to its config file during installation, though not afterwards
+    # - the dolibarr config file generally holds secrets generated by the installer, though the config file is a php file so we can read and write these secrets from an external file
+    systemd.services.dolibarr-config = {
+      description = "dolibarr configuration file management via NixOS";
+      wantedBy = [ "multi-user.target" ];
+
+      script = ''
+        # extract the 'main instance unique id' secret that the dolibarr installer generated for us, store it in a file for use by our own NixOS generated configuration file
+        ${pkgs.php}/bin/php -r "include '${cfg.stateDir}/conf.php'; file_put_contents('${cfg.stateDir}/dolibarr_main_instance_unique_id', \$dolibarr_main_instance_unique_id);"
+
+        # replace configuration file generated by installer with the NixOS generated configuration file
+        install -m 644 ${mkConfigFile "conf.php" cfg.settings} '${cfg.stateDir}/conf.php'
+      '';
+
+      serviceConfig = {
+        Type = "oneshot";
+        User = cfg.user;
+        Group = cfg.group;
+        RemainAfterExit = "yes";
+      };
+
+      unitConfig = {
+        ConditionFileNotEmpty = "${cfg.stateDir}/conf.php";
+      };
+    };
+
+    users.users.dolibarr = mkIf (cfg.user == "dolibarr" ) {
+      isSystemUser = true;
+      group = cfg.group;
+    };
+
+    users.groups = optionalAttrs (cfg.group == "dolibarr") {
+      dolibarr = { };
+    };
+
+    users.users."${config.services.nginx.group}".extraGroups = [ cfg.group ];
+  };
+}
diff --git a/nixos/tests/dolibarr.nix b/nixos/tests/dolibarr.nix
new file mode 100644
index 000000000000..2f012a0c67da
--- /dev/null
+++ b/nixos/tests/dolibarr.nix
@@ -0,0 +1,59 @@
+import ./make-test-python.nix ({ pkgs, lib, ... }: {
+  name = "dolibarr";
+  meta.maintainers = [ lib.maintainers.raitobezarius ];
+
+  nodes.machine =
+    { ... }:
+    {
+      services.dolibarr = {
+        enable = true;
+        domain = "localhost";
+        nginx = {
+          forceSSL = false;
+          enableACME = false;
+        };
+      };
+
+      networking.firewall.allowedTCPPorts = [ 80 ];
+    };
+
+  testScript = ''
+    from html.parser import HTMLParser
+    start_all()
+
+    csrf_token = None
+    class TokenParser(HTMLParser):
+      def handle_starttag(self, tag, attrs):
+        attrs = dict(attrs) # attrs is an assoc list originally
+        if tag == 'input' and attrs.get('name') == 'token':
+            csrf_token = attrs.get('value')
+            print(f'[+] Caught CSRF token: {csrf_token}')
+      def handle_endtag(self, tag): pass
+      def handle_data(self, data): pass
+
+    machine.wait_for_unit("phpfpm-dolibarr.service")
+    machine.wait_for_unit("nginx.service")
+    machine.wait_for_open_port(80)
+    # Sanity checks on URLs.
+    # machine.succeed("curl -fL http://localhost/index.php")
+    # machine.succeed("curl -fL http://localhost/")
+    # Perform installation.
+    machine.succeed('curl -fL -X POST http://localhost/install/check.php -F selectlang=auto')
+    machine.succeed('curl -fL -X POST http://localhost/install/fileconf.php -F selectlang=auto')
+    # First time is to write the configuration file correctly.
+    machine.succeed('curl -fL -X POST http://localhost/install/step1.php -F "testpost=ok" -F "action=set" -F "selectlang=auto"')
+    # Now, we have a proper conf.php in $stateDir.
+    assert 'nixos' in machine.succeed("cat /var/lib/dolibarr/conf.php")
+    machine.succeed('curl -fL -X POST http://localhost/install/step2.php --data "testpost=ok&action=set&dolibarr_main_db_character_set=utf8&dolibarr_main_db_collation=utf8_unicode_ci&selectlang=auto"')
+    machine.succeed('curl -fL -X POST http://localhost/install/step4.php --data "testpost=ok&action=set&selectlang=auto"')
+    machine.succeed('curl -fL -X POST http://localhost/install/step5.php --data "testpost=ok&action=set&login=root&pass=hunter2&pass_verif=hunter2&selectlang=auto"')
+    # Now, we have installed the machine, let's verify we still have the right configuration.
+    assert 'nixos' in machine.succeed("cat /var/lib/dolibarr/conf.php")
+    # We do not want any redirect now as we have installed the machine.
+    machine.succeed('curl -f -X POST http://localhost')
+    # Test authentication to the webservice.
+    parser = TokenParser()
+    parser.feed(machine.succeed('curl -f -X GET http://localhost/index.php?mainmenu=login&username=root'))
+    machine.succeed(f'curl -f -X POST http://localhost/index.php?mainmenu=login&token={csrf_token}&username=root&password=hunter2')
+  '';
+})
diff --git a/nixos/tests/minidlna.nix b/nixos/tests/minidlna.nix
index 76039b0bb42c..32721819634e 100644
--- a/nixos/tests/minidlna.nix
+++ b/nixos/tests/minidlna.nix
@@ -6,25 +6,24 @@ import ./make-test-python.nix ({ pkgs, ... }: {
       { ... }:
       {
         imports = [ ../modules/profiles/minimal.nix ];
-        networking.firewall.allowedTCPPorts = [ 8200 ];
-        services.minidlna = {
-          enable = true;
-          loglevel = "error";
-          mediaDirs = [
-           "PV,/tmp/stuff"
+        services.minidlna.enable = true;
+        services.minidlna.openFirewall = true;
+        services.minidlna.settings = {
+          log_level = "error";
+          media_dir = [
+            "PV,/tmp/stuff"
+          ];
+          friendly_name = "rpi3";
+          root_container = "B";
+          notify_interval = 60;
+          album_art_names = [
+            "Cover.jpg/cover.jpg/AlbumArtSmall.jpg/albumartsmall.jpg"
+            "AlbumArt.jpg/albumart.jpg/Album.jpg/album.jpg"
+            "Folder.jpg/folder.jpg/Thumb.jpg/thumb.jpg"
           ];
-          friendlyName = "rpi3";
-          rootContainer = "B";
-          extraConfig =
-          ''
-            album_art_names=Cover.jpg/cover.jpg/AlbumArtSmall.jpg/albumartsmall.jpg
-            album_art_names=AlbumArt.jpg/albumart.jpg/Album.jpg/album.jpg
-            album_art_names=Folder.jpg/folder.jpg/Thumb.jpg/thumb.jpg
-            notify_interval=60
-          '';
         };
       };
-      client = { ... }: { };
+    client = { ... }: { };
   };
 
   testScript =
diff --git a/pkgs/applications/emulators/flycast/default.nix b/pkgs/applications/emulators/flycast/default.nix
index fd5123d05fa2..3243c333a335 100644
--- a/pkgs/applications/emulators/flycast/default.nix
+++ b/pkgs/applications/emulators/flycast/default.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "flycast";
-  version = "1.3";
+  version = "2.0";
 
   src = fetchFromGitHub {
     owner = "flyinghead";
     repo = "flycast";
     rev = "v${version}";
-    sha256 = "sha256-FAHm8Fu/yv2rJvWCY+g50TYH4zOT6rO7F+jTL2T6EOU=";
+    sha256 = "sha256-vSyLg2lAJBV7crKVbGRbi1PUuCwHF9GB/8pjMTlaigA=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/graphics/pineapple-pictures/default.nix b/pkgs/applications/graphics/pineapple-pictures/default.nix
index 04677a3982ac..d6e072438376 100644
--- a/pkgs/applications/graphics/pineapple-pictures/default.nix
+++ b/pkgs/applications/graphics/pineapple-pictures/default.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pineapple-pictures";
-  version = "0.6.2";
+  version = "0.6.3";
 
   src = fetchFromGitHub {
     owner = "BLumia";
     repo = "pineapple-pictures";
     rev = version;
-    sha256 = "sha256-1fsEHyepmoZfNOFEnW6RQJyccOlQr5LTp8TjRqyXkcw";
+    sha256 = "sha256-9Nlrei3TxZr3tv0BtlfsKAvDJhQHgd21FzLnzitYF3U=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/cluster/arkade/default.nix b/pkgs/applications/networking/cluster/arkade/default.nix
index 80c067c14a8f..a36620382430 100644
--- a/pkgs/applications/networking/cluster/arkade/default.nix
+++ b/pkgs/applications/networking/cluster/arkade/default.nix
@@ -7,20 +7,20 @@
 
 buildGoModule rec {
   pname = "arkade";
-  version = "0.8.38";
+  version = "0.8.39";
 
   src = fetchFromGitHub {
     owner = "alexellis";
     repo = "arkade";
     rev = version;
-    sha256 = "sha256-8C7aQCQ6kqHCGSktYS3djTlEuPyRnzb9LrXkqgfzDyY=";
+    sha256 = "sha256-ucM4Dl4ZeeZ6pCQ3qdf3Z88CWJIoreZWeo6ehKqXxI8=";
   };
 
   CGO_ENABLED = 0;
 
   nativeBuildInputs = [ installShellFiles ];
 
-  vendorSha256 = "sha256-ok8NuqVFZtzjSLpgxQI03ISojfKdHPHWyikqwtceMlo=";
+  vendorSha256 = "sha256-TUaCqHbPEwhB2xS8RSoF7RCSkKFJzQKbuV1PbxApyMQ=";
 
   # Exclude pkg/get: tests downloading of binaries which fail when sandbox=true
   subPackages = [
diff --git a/pkgs/applications/networking/cluster/kubeone/default.nix b/pkgs/applications/networking/cluster/kubeone/default.nix
index 60fc4847aa56..22e2f4764ac1 100644
--- a/pkgs/applications/networking/cluster/kubeone/default.nix
+++ b/pkgs/applications/networking/cluster/kubeone/default.nix
@@ -2,6 +2,8 @@
 , buildGoModule
 , fetchFromGitHub
 , installShellFiles
+, kubeone
+, testers
 }:
 
 buildGoModule rec {
@@ -17,6 +19,12 @@ buildGoModule rec {
 
   vendorSha256 = "sha256-w/uLR7wi28Ub7Nouxxg39NlD1OzyIE2oEP4D88Xbwu0=";
 
+  ldflags = [
+    "-s -w"
+    "-X k8c.io/kubeone/pkg/cmd.version=${version}"
+    "-X k8c.io/kubeone/pkg/cmd.date=unknown"
+  ];
+
   nativeBuildInputs = [
     installShellFiles
   ];
@@ -27,6 +35,11 @@ buildGoModule rec {
       --zsh <($out/bin/kubeone completion zsh)
   '';
 
+  passthru.tests.version = testers.testVersion {
+    package = kubeone;
+    command = "kubeone version";
+  };
+
   meta = {
     description = "Automate cluster operations on all your cloud, on-prem, edge, and IoT environments.";
     homepage = "https://kubeone.io/";
diff --git a/pkgs/applications/networking/mumble/default.nix b/pkgs/applications/networking/mumble/default.nix
index 1604188773d1..d3a02cacfb60 100644
--- a/pkgs/applications/networking/mumble/default.nix
+++ b/pkgs/applications/networking/mumble/default.nix
@@ -98,14 +98,14 @@ let
   } source;
 
   source = rec {
-    version = "unstable-1.4.231";
+    version = "1.4.274";
 
     # Needs submodules
     src = fetchFromGitHub {
       owner = "mumble-voip";
       repo = "mumble";
-      rev = "9e0e274d6a9d8a9919267e747d05d0500d150560";
-      sha256 = "0whvb4nlf7gjf2v7wsaq0ir18mshhw5wi8c9q9qz43wnh42nn2qi";
+      rev = "cc73c7679b08158f91b02272efbb0e3e5dd9c9e4";
+      sha256 = "sha256-QXczSLDhWLE4CDvBJ7NtqfL52bZJDisFo04AMHnMuN8=";
       fetchSubmodules = true;
     };
   };
diff --git a/pkgs/applications/science/biology/last/default.nix b/pkgs/applications/science/biology/last/default.nix
index 031e59619005..f3c145ec7f45 100644
--- a/pkgs/applications/science/biology/last/default.nix
+++ b/pkgs/applications/science/biology/last/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "last";
-  version = "1406";
+  version = "1409";
 
   src = fetchFromGitLab {
     owner = "mcfrith";
     repo = "last";
     rev = version;
-    sha256 = "sha256-N1B9W++4SiMRMUjDi8ZexOWF/HQpN8BBPuDKYh4bCS8=";
+    sha256 = "sha256-AFK0va1HonSWJdzJLdLraiu4LhUCJFgq6qajbbPmHuY=";
   };
 
   nativeBuildInputs = [ unzip ];
diff --git a/pkgs/applications/science/electronics/dataexplorer/default.nix b/pkgs/applications/science/electronics/dataexplorer/default.nix
new file mode 100644
index 000000000000..5745a43df26c
--- /dev/null
+++ b/pkgs/applications/science/electronics/dataexplorer/default.nix
@@ -0,0 +1,67 @@
+{ lib
+, stdenv
+, fetchurl
+, jdk
+, jre
+, ant
+, makeWrapper
+}:
+
+stdenv.mkDerivation rec {
+  pname = "dataexplorer";
+  version = "3.6.2";
+
+  src = fetchurl {
+    url = "mirror://savannah/dataexplorer/dataexplorer-${version}-src.tar.gz";
+    sha256 = "sha256-2e8qeoJh7z/RIowMtAd8PGcMPck5H8iHqel6bW7EQ0E=";
+  };
+
+  nativeBuildInputs = [ ant makeWrapper ];
+
+  buildInputs = [ jdk ];
+
+  buildPhase = ''
+    ant -f build/build.xml dist
+  '';
+
+  doCheck = false;
+  # Missing dependencies (e.g. junit). Does not work.
+  #checkPhase = ''
+  #  ant -f build/build.xml check
+  #'';
+
+  installPhase = ''
+    ant -Dprefix=$out/share/ -f build/build.xml install
+
+    # The sources contain a wrapper script in $out/share/DataExplorer/DataExplorer
+    # but it hardcodes bash shebang and does not pin the java path.
+    # So we create our own wrapper, using similar cmdline args as upstream.
+    mkdir -p $out/bin
+    makeWrapper ${jre}/bin/java $out/bin/DataExplorer \
+      --add-flags "-Dfile.encoding=UTF-8 -Xms64m -Xmx3092m -jar $out/share/DataExplorer/DataExplorer.jar" \
+      --set SWT_GTK3 0
+
+    makeWrapper ${jre}/bin/java $out/bin/DevicePropertiesEditor \
+      --add-flags "-Dfile.encoding=UTF-8 -Xms32m -Xmx512m -classpath $out/share/DataExplorer/DataExplorer.jar gde.ui.dialog.edit.DevicePropertiesEditor" \
+      --set SWT_GTK3 0 \
+      --set LIBOVERLAY_SCROLLBAR 0
+
+    install -Dvm644 build/misc/GNU_LINUX_JUNSI_ICHARER_DUO_UDEV_RULE/50-Junsi-iCharger-DUO.rules \
+      $out/etc/udev/rules.d/50-Junsi-iCharger-DUO.rules
+    install -Dvm644 build/misc/GNU_LINUX_SKYRC_UDEV_RULE/50-SkyRC-Charger.rules \
+      $out/etc/udev/rules.d/50-SkyRC-Charger.rules
+  '';
+
+  meta = with lib; {
+    description = "Graphical tool to analyze data, gathered from various hardware devices";
+    homepage = "https://www.nongnu.org/dataexplorer/index.html";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ panicgh ];
+    platforms = jdk.meta.platforms;
+    sourceProvenance = with sourceTypes; [
+      fromSource
+      binaryNativeCode  # contains RXTXcomm (JNI library with *.so files)
+      binaryBytecode    # contains thirdparty jar files, e.g. javax.json, org.glassfish.json
+    ];
+  };
+}
diff --git a/pkgs/applications/science/logic/cadical/default.nix b/pkgs/applications/science/logic/cadical/default.nix
index c6b1f6652451..7052d3fce0df 100644
--- a/pkgs/applications/science/logic/cadical/default.nix
+++ b/pkgs/applications/science/logic/cadical/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cadical";
-  version = "1.4.1";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "arminbiere";
     repo = "cadical";
     rev = "rel-${version}";
-    sha256 = "0y44z3np4gssgdh4aj5qila7pshrbphycdxn2083i8ayyyjbxshp";
+    sha256 = "sha256-Po+pGoUwk1gtBqz4Sc/QQ52rRGbA2pATebX+KPYII5o=";
   };
 
   outputs = [ "out" "dev" "lib" ];
diff --git a/pkgs/applications/window-managers/sway/swayest-workstyle/default.nix b/pkgs/applications/window-managers/sway/swayest-workstyle/default.nix
new file mode 100644
index 000000000000..1aa3dace7852
--- /dev/null
+++ b/pkgs/applications/window-managers/sway/swayest-workstyle/default.nix
@@ -0,0 +1,29 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "swayest-workstyle";
+  version = "1.3.0";
+
+  src = fetchFromGitHub {
+    owner = "Lyr-7D1h";
+    repo = "swayest_workstyle";
+    rev = version;
+    sha256 = "sha256-LciTrYbmJV0y0H6QH88vTBXbDdDSx6FQtO4J/CFLjtY=";
+  };
+
+  cargoSha256 = "sha256-34Ij3Hd1JI6d1vhv1XomFc9SFoB/6pbS39upLk+NeQM=";
+
+  doCheck = false; # No tests
+
+  meta = with lib; {
+    description = "Map sway workspace names to icons defined depending on the windows inside of the workspace";
+    homepage = "https://github.com/Lyr-7D1h/swayest_workstyle";
+    license = licenses.mit;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ miangraham ];
+    mainProgram = "sworkstyle";
+  };
+}
diff --git a/pkgs/common-updater/unstable-updater.nix b/pkgs/common-updater/unstable-updater.nix
index 2be065f410e7..f8944222a8d5 100644
--- a/pkgs/common-updater/unstable-updater.nix
+++ b/pkgs/common-updater/unstable-updater.nix
@@ -8,7 +8,7 @@
 
 # This is an updater for unstable packages that should always use the latest
 # commit.
-{ url ? null # The git url, if empty it will be set to src.url
+{ url ? null # The git url, if empty it will be set to src.gitRepoUrl
 , branch ? null
 , stableVersion ? false # Use version format according to RFC 107 (i.e. LAST_TAG+date=YYYY-MM-DD)
 , tagPrefix ? "" # strip this prefix from a tag name when using stable version
@@ -46,7 +46,7 @@ let
         esac
     done
 
-    # By default we set url to src.url
+    # By default we set url to src.gitRepoUrl
     if [[ -z "$url" ]]; then
         url="$(${nix}/bin/nix-instantiate $systemArg --eval -E \
                    "with import ./. {}; $UPDATE_NIX_ATTR_PATH.src.gitRepoUrl" \
diff --git a/pkgs/data/themes/catppuccin-gtk/default.nix b/pkgs/data/themes/catppuccin-gtk/default.nix
index b9bc042dd09c..4158d4384d47 100644
--- a/pkgs/data/themes/catppuccin-gtk/default.nix
+++ b/pkgs/data/themes/catppuccin-gtk/default.nix
@@ -5,7 +5,6 @@
 , gnome-themes-extra
 , gtk-engine-murrine
 , sassc
-, which
 , tweaks ? [ ]
 , size ? "standard"
 }:
@@ -14,9 +13,9 @@ let
   validTweaks = [ "nord" "dracula" "black" "rimless" "normal" ];
 
   unknownTweaks = lib.subtractLists validTweaks tweaks;
-  illegalMix = !(lib.elem "nord" tweaks) && !(lib.elem "dracula" tweaks);
+  illegalMix = (lib.elem "nord" tweaks) && (lib.elem "dracula" tweaks);
 
-  assertIllegal = lib.assertMsg illegalMix ''
+  assertIllegal = lib.assertMsg (!illegalMix) ''
     Tweaks "nord" and "dracula" cannot be mixed. Tweaks: ${toString tweaks}
   '';
 
@@ -37,16 +36,16 @@ assert assertUnknown;
 
 stdenvNoCC.mkDerivation rec {
   pname = "catppuccin-gtk";
-  version = "unstable-2022-08-01";
+  version = "0.2.7";
 
   src = fetchFromGitHub {
     repo = "gtk";
     owner = "catppuccin";
-    rev = "87a79fd2bf07accc694455df30a32a82b1b31f4f";
-    sha256 = "sha256-dKHTQva0BYkO6VPNfY/pzRn/V1ghX+tYqbnM9hTAMeE=";
+    rev = "v-${version}";
+    sha256 = "sha256-oTAfURHMWqlKHk4CNz5cn6vO/7GmQJM2rXXGDz2e+0w=";
   };
 
-  nativeBuildInputs = [ gtk3 sassc which ];
+  nativeBuildInputs = [ gtk3 sassc ];
 
   buildInputs = [ gnome-themes-extra ];
 
@@ -61,7 +60,6 @@ stdenvNoCC.mkDerivation rec {
 
     export HOME=$(mktemp -d)
 
-    mkdir -p $out/share/themes
     bash install.sh -d $out/share/themes -t all \
       ${lib.optionalString (size != "") "-s ${size}"} \
       ${lib.optionalString (tweaks != []) "--tweaks " + builtins.toString tweaks}
diff --git a/pkgs/development/libraries/libjaylink/default.nix b/pkgs/development/libraries/libjaylink/default.nix
index bf42624f7651..84ce6e9f2599 100644
--- a/pkgs/development/libraries/libjaylink/default.nix
+++ b/pkgs/development/libraries/libjaylink/default.nix
@@ -5,14 +5,14 @@
 
 stdenv.mkDerivation rec {
   pname = "libjaylink";
-  version = "0.3.0";
+  version = "0.3.1";
 
   src = fetchFromGitLab {
     domain = "gitlab.zapb.de";
     owner = "libjaylink";
     repo = "libjaylink";
     rev = version;
-    sha256 = "sha256-90obLaSE3oxrocyJWZ4+j4U4GuPIZEiiIQqenu4vsJg=";
+    sha256 = "sha256-odJDE1A0WZ9vBXPxaUdthjTgmbmbdHjbyY1PkaM4+vI=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
diff --git a/pkgs/development/libraries/libspatialindex/default.nix b/pkgs/development/libraries/libspatialindex/default.nix
index 2081650f90a9..455d42c3bb45 100644
--- a/pkgs/development/libraries/libspatialindex/default.nix
+++ b/pkgs/development/libraries/libspatialindex/default.nix
@@ -1,20 +1,37 @@
-{ lib, stdenv, fetchurl }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, cmake }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "libspatialindex";
-  version = "1.8.5";
+  version = "1.9.3";
 
-  src = fetchurl {
-    url = "https://download.osgeo.org/libspatialindex/spatialindex-src-${version}.tar.gz";
-    sha256 = "1vxzm7kczwnb6qdmc0hb00z8ykx11zk3sb68gc7rch4vrfi4dakw";
+  src = fetchFromGitHub {
+    owner = "libspatialindex";
+    repo = "libspatialindex";
+    rev = finalAttrs.version;
+    hash = "sha256-zsvS0IkCXyuNLCQpccKdAsFKoq0l+y66ifXlTHLNTkc=";
   };
 
-  enableParallelBuilding = true;
+  patches = [
+    # Allow building static libs
+    (fetchpatch {
+      name = "fix-static-lib-build.patch";
+      url = "https://github.com/libspatialindex/libspatialindex/commit/caee28d84685071da3ff3a4ea57ff0b6ae64fc87.patch";
+      hash = "sha256-nvTW/t9tw1ZLeycJY8nj7rQgZogxQb765Ca2b9NDvRo=";
+    })
+  ];
 
-  meta = {
+  nativeBuildInputs = [ cmake ];
+
+  cmakeFlags = [
+    "-DSIDX_BUILD_TESTS=${if finalAttrs.doCheck then "ON" else "OFF"}"
+  ];
+
+  doCheck = true;
+
+  meta = with lib; {
     description = "Extensible spatial index library in C++";
-    homepage = "http://libspatialindex.github.io/";
-    license = lib.licenses.mit;
-    platforms = lib.platforms.unix;
+    homepage = "https://libspatialindex.org";
+    license = licenses.mit;
+    platforms = platforms.unix;
   };
-}
+})
diff --git a/pkgs/development/libraries/qt-4.x/4.8/default.nix b/pkgs/development/libraries/qt-4.x/4.8/default.nix
index e581bdf5f88e..816b75039612 100644
--- a/pkgs/development/libraries/qt-4.x/4.8/default.nix
+++ b/pkgs/development/libraries/qt-4.x/4.8/default.nix
@@ -50,9 +50,6 @@ stdenv.mkDerivation rec {
   '' + lib.optionalString stdenv.cc.isClang ''
     substituteInPlace src/3rdparty/webkit/Source/WebCore/html/HTMLImageElement.cpp \
       --replace 'optionalHeight > 0' 'optionalHeight != NULL'
-
-    substituteInPlace ./tools/linguist/linguist/messagemodel.cpp \
-      --replace 'm->comment()) >= 0' 'm->comment()) != NULL'
   '';
 
   patches =
@@ -237,6 +234,6 @@ stdenv.mkDerivation rec {
     license     = lib.licenses.lgpl21Plus; # or gpl3
     maintainers = with lib.maintainers; [ orivej lovek323 sander ];
     platforms   = lib.platforms.unix;
-    badPlatforms = [ "x86_64-darwin" ];
+    badPlatforms = [ "x86_64-darwin" "aarch64-darwin" ];
   };
 }
diff --git a/pkgs/development/libraries/science/math/arpack/default.nix b/pkgs/development/libraries/science/math/arpack/default.nix
index 2413a0a25cfe..9d96368a4cda 100644
--- a/pkgs/development/libraries/science/math/arpack/default.nix
+++ b/pkgs/development/libraries/science/math/arpack/default.nix
@@ -45,10 +45,6 @@ stdenv.mkDerivation rec {
     install_name_tool -change libblas.dylib ${blas}/lib/libblas.dylib $out/lib/libarpack.dylib
   '';
 
-  # disable stackprotector on aarch64-darwin for now
-  # https://github.com/NixOS/nixpkgs/issues/127608
-  hardeningDisable = lib.optionals (stdenv.isAarch64 && stdenv.isDarwin) [ "stackprotector" ];
-
   meta = {
     homepage = "https://github.com/opencollab/arpack-ng";
     description = ''
diff --git a/pkgs/development/libraries/speechd/default.nix b/pkgs/development/libraries/speechd/default.nix
index 270894c3e554..d27eabecf465 100644
--- a/pkgs/development/libraries/speechd/default.nix
+++ b/pkgs/development/libraries/speechd/default.nix
@@ -27,11 +27,11 @@ let
   inherit (python3Packages) python pyxdg wrapPython;
 in stdenv.mkDerivation rec {
   pname = "speech-dispatcher";
-  version = "0.11.1";
+  version = "0.11.2";
 
   src = fetchurl {
     url = "https://github.com/brailcom/speechd/releases/download/${version}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-0doS7T2shPE3mbai7Dm6LTyiGoST9E3BhVvQupbC3cY=";
+    sha256 = "sha256-i0ZJkl5oy+GntMCge7BBznc4s1yQamAr+CmG2xqg82Q=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/sundials/default.nix b/pkgs/development/libraries/sundials/default.nix
index 3093c5330a88..867d109d71b2 100644
--- a/pkgs/development/libraries/sundials/default.nix
+++ b/pkgs/development/libraries/sundials/default.nix
@@ -61,21 +61,6 @@ stdenv.mkDerivation rec {
   )]
   ;
 
-  # disable stackprotector on aarch64-darwin for now
-  # https://github.com/NixOS/nixpkgs/issues/127608
-  #
-  # build error:
-  #
-  # /private/tmp/nix-build-sundials-6.3.0.drv-0/ccD2dUtR.s:21:15: error: index must be an integer in range [-256, 255].
-  #         ldr     x0, [x0, ___stack_chk_guard];momd
-  #                          ^
-  # /private/tmp/nix-build-sundials-6.3.0.drv-0/ccD2dUtR.s:46:15: error: index must be an integer in range [-256, 255].
-  #         ldr     x0, [x0, ___stack_chk_guard];momd
-  #
-  # See also a proposed solution: https://github.com/NixOS/nixpkgs/pull/151983
-
-  hardeningDisable = lib.optionals (stdenv.isAarch64 && stdenv.isDarwin) [ "stackprotector" ];
-
   doCheck = true;
   checkTarget = "test";
 
diff --git a/pkgs/development/libraries/vapoursynth/default.nix b/pkgs/development/libraries/vapoursynth/default.nix
index b0f8f5edd30b..7c7987478b80 100644
--- a/pkgs/development/libraries/vapoursynth/default.nix
+++ b/pkgs/development/libraries/vapoursynth/default.nix
@@ -50,7 +50,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    broken = stdenv.isDarwin;
+    broken = stdenv.isDarwin; # see https://github.com/NixOS/nixpkgs/pull/189446 for partial fix
     description = "A video processing framework with the future in mind";
     homepage    = "http://www.vapoursynth.com/";
     license     = licenses.lgpl21;
diff --git a/pkgs/development/misc/cppreference-doc/default.nix b/pkgs/development/misc/cppreference-doc/default.nix
new file mode 100644
index 000000000000..690ceb4276f0
--- /dev/null
+++ b/pkgs/development/misc/cppreference-doc/default.nix
@@ -0,0 +1,31 @@
+{ lib, fetchzip }:
+
+let
+  pname = "cppreference-doc";
+  version = "2022.07.30";
+  ver = builtins.replaceStrings ["."] [""] version;
+
+in fetchzip {
+  name = pname + "-" + version;
+
+  url = "https://github.com/PeterFeicht/${pname}/releases/download/v${ver}/html-book-${ver}.tar.xz";
+  sha256 = "sha256-gsYNpdxbWnmwcC9IJV1g+e0/s4Hoo5ig1MGoYPIHspw=";
+
+  stripRoot = false;
+
+  postFetch = ''
+    rm $out/cppreference-doxygen-local.tag.xml $out/cppreference-doxygen-web.tag.xml
+    mkdir -p $out/share/cppreference/doc
+    mv $out/reference $out/share/cppreference/doc/html
+  '';
+
+  passthru = { inherit pname version; };
+
+  meta = with lib; {
+    description = "C++ standard library reference";
+    homepage = "https://en.cppreference.com";
+    license = licenses.cc-by-sa-30;
+    maintainers = with maintainers; [ panicgh ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/development/tools/misc/saleae-logic-2/default.nix b/pkgs/development/tools/misc/saleae-logic-2/default.nix
index 9203eb622897..142f66f1dea0 100644
--- a/pkgs/development/tools/misc/saleae-logic-2/default.nix
+++ b/pkgs/development/tools/misc/saleae-logic-2/default.nix
@@ -1,10 +1,10 @@
 { lib, fetchurl, makeDesktopItem, appimageTools }:
 let
   name = "saleae-logic-2";
-  version = "2.3.58";
+  version = "2.3.59";
   src = fetchurl {
     url = "https://downloads.saleae.com/logic2/Logic-${version}-master.AppImage";
-    sha256 = "sha256-WQa9J+rK71+T2IFUVpPLjkYfHy9GmZ9DZTBo+U4JKfo=";
+    sha256 = "sha256-jIu/ODVD/x+TjcVSGlOw6/JWESJYDKZQrJGMAix9wTY=";
   };
   desktopItem = makeDesktopItem {
     inherit name;
diff --git a/pkgs/games/crawl/default.nix b/pkgs/games/crawl/default.nix
index 064e1d623a5f..fa409987ff81 100644
--- a/pkgs/games/crawl/default.nix
+++ b/pkgs/games/crawl/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "crawl${lib.optionalString tileMode "-tiles"}";
-  version = "0.28.0";
+  version = "0.29.0";
 
   src = fetchFromGitHub {
     owner = "crawl";
     repo = "crawl";
     rev = version;
-    sha256 = "sha256-pVEE3g+NDwpsrakyj4YIk53aE+LCiIaRhOqos4huh9A=";
+    sha256 = "sha256-SM8dSDV+88QGMqoFkITop1PHh9EakdgiV4tkXCw9pjM=";
   };
 
   # Patch hard-coded paths and remove force library builds
diff --git a/pkgs/games/xivlauncher/default.nix b/pkgs/games/xivlauncher/default.nix
index 1da8e4838956..e9f399e95a62 100644
--- a/pkgs/games/xivlauncher/default.nix
+++ b/pkgs/games/xivlauncher/default.nix
@@ -3,23 +3,23 @@
 , useSteamRun ? true }:
 
 let
-  rev = "6a1a59f687ac7b98698e2ebb97d82a94865e50f6";
+  rev = "6246fde6b54f8c7e340057fe2d940287c437153f";
 in
   buildDotnetModule rec {
     pname = "XIVLauncher";
-    version = "1.0.0.9";
+    version = "1.0.1.0";
 
     src = fetchFromGitHub {
       owner = "goatcorp";
       repo = "FFXIVQuickLauncher";
       inherit rev;
-      sha256 = "sha256-jRyYeTg73W58OH2fWmuVkjxEdyPNqDGRbEZwxBMfdCo=";
+      sha256 = "sha256-sM909/ysrlwsiVSBrMo4cOZUWxjRA3ZSwlloGythOAY=";
     };
 
     nativeBuildInputs = [ copyDesktopItems ];
 
     projectFile = "src/XIVLauncher.Core/XIVLauncher.Core.csproj";
-    nugetDeps = ./deps.nix; # File generated with `nuget-to-nix path/to/src > deps.nix`
+    nugetDeps = ./deps.nix; # File generated with `nix-build -A xivlauncher.passthru.fetch-deps`
 
     dotnetFlags = [
       "--runtime linux-x64"
diff --git a/pkgs/games/xivlauncher/deps.nix b/pkgs/games/xivlauncher/deps.nix
index 9e1f7f17c2ff..0cbfccff0c78 100644
--- a/pkgs/games/xivlauncher/deps.nix
+++ b/pkgs/games/xivlauncher/deps.nix
@@ -3,8 +3,8 @@
   (fetchNuGet { pname = "CheapLoc"; version = "1.1.6"; sha256 = "1m6cgx9yh7h3vrq2d4f99xyvsxc9jvz8zjq1q14qgylfmyq4hx4l"; })
   (fetchNuGet { pname = "Config.Net"; version = "4.19.0"; sha256 = "17iv0vy0693s6d8626lbz3w1ppn5abn77aaki7h4qi4izysizgim"; })
   (fetchNuGet { pname = "Downloader"; version = "2.2.8"; sha256 = "0farwh3pc6m8hsgqywigdpcb4gr2m9myyxm2idzjmhhkzfqghj28"; })
-  (fetchNuGet { pname = "Facepunch.Steamworks"; version = "2.3.3"; sha256 = "1r3m7cyzfy8ms9xxfa13xcwha02yk22givkaamw166im89m8wqyc"; })
   (fetchNuGet { pname = "goaaats.NativeLibraryLoader"; version = "4.9.0-beta1-g70f642e82e"; sha256 = "1bjjgsw4ry9cz8dzsgwx428hn06wms194pqz8nclwrqcwfx7gmxk"; })
+  (fetchNuGet { pname = "goaaats.Steamworks"; version = "2.3.4"; sha256 = "1khxkkjvh6af60rxc13bacxn85amdfzr8z0b9a6gfg6m1fnmlkss"; })
   (fetchNuGet { pname = "goaaats.Veldrid"; version = "4.9.0-beta1-g70f642e82e"; sha256 = "0b35bn4190hxbvrwsygpbpg00gnrj6crxyk8b0d7ian611v4jj0m"; })
   (fetchNuGet { pname = "goaaats.Veldrid.ImageSharp"; version = "4.9.0-beta1-g70f642e82e"; sha256 = "1zihi2n9qz18kfkz4qnj3412bfsqvx49809hqkknixdrgn8323i2"; })
   (fetchNuGet { pname = "goaaats.Veldrid.MetalBindings"; version = "4.9.0-beta1-g70f642e82e"; sha256 = "13cs5jr8bpkrkzziz8b71l3npr14shxryrpsiw0zm7jcx69vg2qf"; })
@@ -13,13 +13,11 @@
   (fetchNuGet { pname = "goaaats.Veldrid.StartupUtilities"; version = "4.9.0-beta1-g70f642e82e"; sha256 = "03r3x9h0fyb07d6d28ny6r5s688m50xc0lgc6zf2cy684kfnvmp5"; })
   (fetchNuGet { pname = "ImGui.NET"; version = "1.87.2"; sha256 = "0rv0n18fvz1gbh45crhzn1f8xw8zkc8qyiyj91vajjcry8mq1x7q"; })
   (fetchNuGet { pname = "KeySharp"; version = "1.0.5"; sha256 = "1ic10v0a174fw6w89iyg4yzji36bsj15573y676cj5n09n6s75d4"; })
-  (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.linux-x64"; version = "6.0.6"; sha256 = "0ndah9cqkgswhi60wrnni10j1d2hdg8jljij83lk1wbfqbng86jm"; })
   (fetchNuGet { pname = "Microsoft.CodeAnalysis.Analyzers"; version = "3.3.3"; sha256 = "09m4cpry8ivm9ga1abrxmvw16sslxhy2k5sl14zckhqb1j164im6"; })
   (fetchNuGet { pname = "Microsoft.CodeAnalysis.BannedApiAnalyzers"; version = "3.3.3"; sha256 = "1z6x0d8lpcfjr3sxy25493i17vvcg5bsay6c03qan6mnj5aqzw2k"; })
   (fetchNuGet { pname = "Microsoft.CodeAnalysis.Common"; version = "4.0.1"; sha256 = "0axjv1nhk1z9d4c51d9yxdp09l8yqqnqaifhqcwnxnv0r4y5cka9"; })
   (fetchNuGet { pname = "Microsoft.CodeAnalysis.CSharp"; version = "4.0.1"; sha256 = "1h6jfifg7pw2vacpdds4v4jqnaydg9b108irf315wzx6rh8yv9cb"; })
   (fetchNuGet { pname = "Microsoft.CodeAnalysis.NetAnalyzers"; version = "6.0.0"; sha256 = "06zy947m5lrbwb684g42ijb07r5jsqycvfnphc6cqfdrfnzqv6k9"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.linux-x64"; version = "6.0.6"; sha256 = "0fjbjh7yxqc9h47ix37y963xi9f9y99jvl26cw3x3kvjlb8x0bgj"; })
   (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "1.0.1"; sha256 = "01al6cfxp68dscl15z7rxfw9zvhm64dncsw09a1vmdkacsa2v6lr"; })
   (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "1.1.0"; sha256 = "08vh1r12g6ykjygq5d3vq09zylgb84l63k49jc4v8faw9g93iqqm"; })
   (fetchNuGet { pname = "Microsoft.NETCore.Targets"; version = "1.0.1"; sha256 = "0ppdkwy6s9p7x9jix3v4402wb171cdiibq7js7i13nxpdky7074p"; })
@@ -169,6 +167,7 @@
   (fetchNuGet { pname = "System.Security.Permissions"; version = "6.0.0"; sha256 = "0jsl4xdrkqi11iwmisi1r2f2qn5pbvl79mzq877gndw6ans2zhzw"; })
   (fetchNuGet { pname = "System.Security.Principal"; version = "4.3.0"; sha256 = "12cm2zws06z4lfc4dn31iqv7072zyi4m910d4r6wm8yx85arsfxf"; })
   (fetchNuGet { pname = "System.Security.Principal.Windows"; version = "4.3.0"; sha256 = "00a0a7c40i3v4cb20s2cmh9csb5jv2l0frvnlzyfxh848xalpdwr"; })
+  (fetchNuGet { pname = "System.Security.Principal.Windows"; version = "5.0.0"; sha256 = "1mpk7xj76lxgz97a5yg93wi8lj0l8p157a5d50mmjy3gbz1904q8"; })
   (fetchNuGet { pname = "System.Security.Principal.Windows"; version = "6.0.0-preview.5.21301.5"; sha256 = "1q3iikvjcfrm5p89p1j7qlw1szvryq680qypk023wgy9phmlwi57"; })
   (fetchNuGet { pname = "System.Text.Encoding"; version = "4.0.11"; sha256 = "1dyqv0hijg265dwxg6l7aiv74102d6xjiwplh2ar1ly6xfaa4iiw"; })
   (fetchNuGet { pname = "System.Text.Encoding"; version = "4.3.0"; sha256 = "1f04lkir4iladpp51sdgmis9dj4y8v08cka0mbmsy0frc9a4gjqr"; })
diff --git a/pkgs/misc/lilypond/unstable.nix b/pkgs/misc/lilypond/unstable.nix
index dc137ccd7e9e..a8472b66f1fa 100644
--- a/pkgs/misc/lilypond/unstable.nix
+++ b/pkgs/misc/lilypond/unstable.nix
@@ -3,9 +3,9 @@
 (lilypond.override {
   inherit guile;
 }).overrideAttrs (oldAttrs: rec {
-  version = "2.23.11";
+  version = "2.23.12";
   src = fetchurl {
     url = "https://lilypond.org/download/sources/v${lib.versions.majorMinor version}/lilypond-${version}.tar.gz";
-    sha256 = "sha256-4VjcuZvRmpPmiZ42zyk9xYPlsSN6kEsBSRe30P+raQ8=";
+    sha256 = "sha256-SLZ9/Jybltd8+1HANk8pTGHRb7MuZSJJDDY/S4Kwz/k=";
   };
 })
diff --git a/pkgs/servers/web-apps/dolibarr/default.nix b/pkgs/servers/web-apps/dolibarr/default.nix
new file mode 100644
index 000000000000..5c4256155ddc
--- /dev/null
+++ b/pkgs/servers/web-apps/dolibarr/default.nix
@@ -0,0 +1,41 @@
+{ stdenv, lib, fetchFromGitHub, nixosTests, stateDir ? "/var/lib/dolibarr" }:
+
+stdenv.mkDerivation rec {
+  pname = "dolibarr";
+  version = "15.0.3";
+
+  src = fetchFromGitHub {
+    owner = "Dolibarr";
+    repo = "dolibarr";
+    rev = version;
+    sha256 = "sha256-HMOYj93ZvqM0FQjt313yuGj/r9ELqQlnNkg/CxrBjRM=";
+  };
+
+  dontBuild = true;
+
+  postPatch = ''
+    find . -type f -name "*.php" -print0 | xargs -0 sed -i 's|/etc/dolibarr|${stateDir}|g'
+
+    substituteInPlace htdocs/filefunc.inc.php \
+      --replace '//$conffile = ' '$conffile = ' \
+      --replace '//$conffiletoshow = ' '$conffiletoshow = '
+
+    substituteInPlace htdocs/install/inc.php \
+      --replace '//$conffile = ' '$conffile = ' \
+      --replace '//$conffiletoshow = ' '$conffiletoshow = '
+  '';
+
+  installPhase = ''
+    mkdir -p "$out"
+    cp -r * $out
+  '';
+
+  passthru.tests = { inherit (nixosTests) dolibarr; };
+
+  meta = with lib; {
+    description = "A enterprise resource planning (ERP) and customer relationship manager (CRM) server";
+    homepage = "https://dolibarr.org/";
+    license = licenses.gpl3Plus;
+    maintainers = [ maintainers.raitobezarius ];
+  };
+}
diff --git a/pkgs/tools/inputmethods/fcitx5/fcitx5-lua.nix b/pkgs/tools/inputmethods/fcitx5/fcitx5-lua.nix
index f367ccd7a935..4f76a1e770a7 100644
--- a/pkgs/tools/inputmethods/fcitx5/fcitx5-lua.nix
+++ b/pkgs/tools/inputmethods/fcitx5/fcitx5-lua.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fcitx5-lua";
-  version = "5.0.9";
+  version = "5.0.10";
 
   src = fetchFromGitHub {
     owner = "fcitx";
     repo = pname;
     rev = version;
-    sha256 = "sha256-XeRMPbatXUudxo1EICL7z8V3slxkzo27f+D4xLjRtU4=";
+    sha256 = "sha256-0ESgQv8kyc+zv/tDZtBZ+QhFFswD80ApwswFlJs8tOU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/inputmethods/fcitx5/fcitx5-qt.nix b/pkgs/tools/inputmethods/fcitx5/fcitx5-qt.nix
index 79a0e7310336..0b0b3cad39d4 100644
--- a/pkgs/tools/inputmethods/fcitx5/fcitx5-qt.nix
+++ b/pkgs/tools/inputmethods/fcitx5/fcitx5-qt.nix
@@ -13,13 +13,13 @@
 
 mkDerivation rec {
   pname = "fcitx5-qt";
-  version = "5.0.14";
+  version = "5.0.15";
 
   src = fetchFromGitHub {
     owner = "fcitx";
     repo = pname;
     rev = version;
-    sha256 = "sha256-LmE6HgNLoJmgJtJmubAIjFi8Xpnmw3hgqJh6HUcakzg=";
+    sha256 = "sha256-yQFYol4rEXmQBJWoc96yWJkJc3RVP6U964tdJdkGelU=";
   };
 
   preConfigure = ''
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 87ca67e6b235..e867acdfab12 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3645,6 +3645,8 @@ with pkgs;
 
   dokuwiki = callPackage ../servers/web-apps/dokuwiki { };
 
+  dolibarr = callPackage ../servers/web-apps/dolibarr { };
+
   doppler = callPackage ../tools/security/doppler {};
 
   dosage = callPackage ../applications/graphics/dosage { };
@@ -15441,6 +15443,8 @@ with pkgs;
 
   avr8burnomat = callPackage ../development/misc/avr8-burn-omat { };
 
+  cppreference-doc = callPackage ../development/misc/cppreference-doc { };
+
   sourceFromHead = callPackage ../build-support/source-from-head-fun.nix {};
 
   jruby = callPackage ../development/interpreters/jruby { };
@@ -20216,8 +20220,8 @@ with pkgs;
     withUtils = false;
   });
 
-  libva = callPackage ../development/libraries/libva { };
-  libva-minimal = libva.override { minimal = true; };
+  libva-minimal = callPackage ../development/libraries/libva { minimal = true; };
+  libva = libva-minimal.override { minimal = false; };
   libva-utils = callPackage ../development/libraries/libva/utils.nix { };
 
   libva1 = callPackage ../development/libraries/libva/1.nix { };
@@ -28444,6 +28448,8 @@ with pkgs;
 
   swaynag-battery = callPackage ../applications/misc/swaynag-battery {};
 
+  swayest-workstyle = callPackage ../applications/window-managers/sway/swayest-workstyle { };
+
   tiramisu = callPackage ../applications/misc/tiramisu { };
 
   rlaunch = callPackage ../applications/misc/rlaunch {
@@ -34880,6 +34886,8 @@ with pkgs;
 
   csxcad = callPackage ../applications/science/electronics/csxcad { };
 
+  dataexplorer = callPackage ../applications/science/electronics/dataexplorer { };
+
   diylc = callPackage ../applications/science/electronics/diylc { };
 
   flatcam = callPackage ../applications/science/electronics/flatcam { };