diff --git a/nixos/tests/k3s/single-node.nix b/nixos/tests/k3s/single-node.nix
index c120f461ddc9..d61595d889e2 100644
--- a/nixos/tests/k3s/single-node.nix
+++ b/nixos/tests/k3s/single-node.nix
@@ -77,6 +77,9 @@ import ../make-test-python.nix ({ pkgs, lib, k3s, ... }:
       machine.succeed("k3s kubectl wait --for 'condition=Ready' pod/test")
       machine.succeed("k3s kubectl delete -f ${testPodYaml}")
 
+      # regression test for #176445
+      machine.fail("journalctl -o cat -u k3s.service | grep 'ipset utility not found'")
+
       machine.shutdown()
     '';
   })
diff --git a/pkgs/applications/networking/cluster/k3s/1_23/default.nix b/pkgs/applications/networking/cluster/k3s/1_23/default.nix
index 72fbe89dd6b3..3abe8c675539 100644
--- a/pkgs/applications/networking/cluster/k3s/1_23/default.nix
+++ b/pkgs/applications/networking/cluster/k3s/1_23/default.nix
@@ -4,6 +4,7 @@
 , socat
 , iptables
 , iproute2
+, ipset
 , bridge-utils
 , btrfs-progs
 , conntrack-tools
@@ -249,6 +250,7 @@ buildGoModule rec {
     socat
     iptables
     iproute2
+    ipset
     bridge-utils
     ethtool
     util-linux # kubelet wants 'nsenter' from util-linux: https://github.com/kubernetes/kubernetes/issues/26093#issuecomment-705994388
diff --git a/pkgs/applications/networking/cluster/k3s/1_24/default.nix b/pkgs/applications/networking/cluster/k3s/1_24/default.nix
index 11037db5b6d3..9ebac6b7448e 100644
--- a/pkgs/applications/networking/cluster/k3s/1_24/default.nix
+++ b/pkgs/applications/networking/cluster/k3s/1_24/default.nix
@@ -4,6 +4,7 @@
 , socat
 , iptables
 , iproute2
+, ipset
 , bridge-utils
 , btrfs-progs
 , conntrack-tools
@@ -249,6 +250,7 @@ buildGoModule rec {
     socat
     iptables
     iproute2
+    ipset
     bridge-utils
     ethtool
     util-linux # kubelet wants 'nsenter' from util-linux: https://github.com/kubernetes/kubernetes/issues/26093#issuecomment-705994388
diff --git a/pkgs/applications/networking/cluster/k3s/1_25/default.nix b/pkgs/applications/networking/cluster/k3s/1_25/default.nix
index b62eec692855..5b5fc097e77d 100644
--- a/pkgs/applications/networking/cluster/k3s/1_25/default.nix
+++ b/pkgs/applications/networking/cluster/k3s/1_25/default.nix
@@ -4,6 +4,7 @@
 , socat
 , iptables
 , iproute2
+, ipset
 , bridge-utils
 , btrfs-progs
 , conntrack-tools
@@ -249,6 +250,7 @@ buildGoModule rec {
     socat
     iptables
     iproute2
+    ipset
     bridge-utils
     ethtool
     util-linux # kubelet wants 'nsenter' from util-linux: https://github.com/kubernetes/kubernetes/issues/26093#issuecomment-705994388
diff --git a/pkgs/applications/networking/cluster/k3s/1_26/default.nix b/pkgs/applications/networking/cluster/k3s/1_26/default.nix
index cef2355a3da6..1b8b5a1b2a64 100644
--- a/pkgs/applications/networking/cluster/k3s/1_26/default.nix
+++ b/pkgs/applications/networking/cluster/k3s/1_26/default.nix
@@ -4,6 +4,7 @@
 , socat
 , iptables
 , iproute2
+, ipset
 , bridge-utils
 , btrfs-progs
 , conntrack-tools
@@ -249,6 +250,7 @@ buildGoModule rec {
     socat
     iptables
     iproute2
+    ipset
     bridge-utils
     ethtool
     util-linux # kubelet wants 'nsenter' from util-linux: https://github.com/kubernetes/kubernetes/issues/26093#issuecomment-705994388
diff --git a/pkgs/applications/version-management/git-chglog/default.nix b/pkgs/applications/version-management/git-chglog/default.nix
index 6259bad88063..ad0d64a6ef62 100644
--- a/pkgs/applications/version-management/git-chglog/default.nix
+++ b/pkgs/applications/version-management/git-chglog/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "git-chglog";
-  version = "0.15.2";
+  version = "0.15.4";
 
   src = fetchFromGitHub {
     owner = "git-chglog";
     repo = "git-chglog";
     rev = "v${version}";
-    sha256 = "sha256-VB3JYXz50B/SkA/q1iET7p5uhArrF8JyhAWhcxLVsg8=";
+    sha256 = "sha256-rTJn2vUrEnmG2japqCxHv3BR9MpmMfpMLO2FBP6ONbw=";
   };
 
-  vendorHash = "sha256-/5s9Dvce0JWu8DaUlrtnkN6N5esEmkFvOgq0tVLZGnM=";
+  vendorHash = "sha256-skhEHpSnxOTZrL8XLlQZL3s224mg8XRINKJnatYCQko=";
 
   ldflags = [ "-s" "-w" "-X=main.Version=v${version}" ];
 
diff --git a/pkgs/applications/virtualization/nixpacks/default.nix b/pkgs/applications/virtualization/nixpacks/default.nix
index 6631ff63ea20..c8072c903d26 100644
--- a/pkgs/applications/virtualization/nixpacks/default.nix
+++ b/pkgs/applications/virtualization/nixpacks/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "nixpacks";
-  version = "1.3.1";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "railwayapp";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-lQHJ5Y+EMhERxOX062QMNPImAX9tjamGYFXYYUmhpys=";
+    sha256 = "sha256-v9ycluLfkrPDzjsMXtv7w9UHgMaGzTsJw4lT/KfRAu4=";
   };
 
-  cargoHash = "sha256-z+DQkl/7kX5tLG9igPnEgHi9sJhB4NoutfV2/BV2U6A=";
+  cargoHash = "sha256-wVQEa1qS+JF6PHKvRrRFbSvj2qp6j14ErOQPkxP0uuA=";
 
   # skip test due FHS dependency
   doCheck = false;
diff --git a/pkgs/applications/virtualization/singularity/generic.nix b/pkgs/applications/virtualization/singularity/generic.nix
index 562781b09a31..f20735e45e3d 100644
--- a/pkgs/applications/virtualization/singularity/generic.nix
+++ b/pkgs/applications/virtualization/singularity/generic.nix
@@ -52,6 +52,9 @@ in
   # SingularityCE 3.10.0 and above requires explicit --without-seccomp when libseccomp is not available.
 , enableSeccomp ? true
   # Whether the configure script treat SUID support as default
+  # When equal to enableSuid, it supress the --with-suid / --without-suid build flag
+  # It can be set to `null` to always pass either --with-suid or --without-suided
+  # Type: null or boolean
 , defaultToSuid ? true
   # Whether to compile with SUID support
 , enableSuid ? false
@@ -131,8 +134,7 @@ buildGoModule {
     "--runstatedir=/var/run"
   ]
   ++ lib.optional (!enableSeccomp) "--without-seccomp"
-  ++ lib.optional (defaultToSuid && !enableSuid) "--without-suid"
-  ++ lib.optional (!defaultToSuid && enableSuid) "--with-suid"
+  ++ lib.optional (enableSuid != defaultToSuid) (if enableSuid then "--with-suid" else "--without-suid")
   ++ extraConfigureFlags
   ;
 
diff --git a/pkgs/applications/virtualization/singularity/packages.nix b/pkgs/applications/virtualization/singularity/packages.nix
index aa626443c538..a21066d77574 100644
--- a/pkgs/applications/virtualization/singularity/packages.nix
+++ b/pkgs/applications/virtualization/singularity/packages.nix
@@ -29,10 +29,10 @@ let
       # Apptainer doesn't depend on conmon
       conmon = null;
 
-      # defaultToSuid becomes false since Apptainer 1.1.0
-      # https://github.com/apptainer/apptainer/pull/495
-      # https://github.com/apptainer/apptainer/releases/tag/v1.1.0
-      defaultToSuid = false;
+      # Apptainer builders require explicit --with-suid / --without-suid flag
+      # when building on a system with disabled unprivileged namespace.
+      # See https://github.com/NixOS/nixpkgs/pull/215690#issuecomment-1426954601
+      defaultToSuid = null;
     };
 
   singularity = callPackage
diff --git a/pkgs/data/icons/numix-icon-theme-circle/default.nix b/pkgs/data/icons/numix-icon-theme-circle/default.nix
index 91d3426f016a..b07057ba6899 100644
--- a/pkgs/data/icons/numix-icon-theme-circle/default.nix
+++ b/pkgs/data/icons/numix-icon-theme-circle/default.nix
@@ -2,13 +2,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "numix-icon-theme-circle";
-  version = "23.02.12";
+  version = "23.02.16";
 
   src = fetchFromGitHub {
     owner = "numixproject";
     repo = pname;
     rev = version;
-    sha256 = "sha256-gQdVmF7ZzC+KjU0uQW6+sEw9Wz5940G60ebXqKHajuY=";
+    sha256 = "sha256-P/lg+7hx3WOmuWUKznFVKlPIB+MqlE3Nb/n8WK8aUM8=";
   };
 
   nativeBuildInputs = [ gtk3 ];
diff --git a/pkgs/development/embedded/fpga/lattice-diamond/default.nix b/pkgs/development/embedded/fpga/lattice-diamond/default.nix
index e8bc4c1b1be5..f80261720cf6 100644
--- a/pkgs/development/embedded/fpga/lattice-diamond/default.nix
+++ b/pkgs/development/embedded/fpga/lattice-diamond/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, rpmextract, patchelf, makeWrapper, file, requireFile, glib, zlib,
-    freetype, fontconfig, xorg, libusb-compat-0_1 }:
+    freetype, fontconfig, xorg, libusb-compat-0_1, coreutils }:
 
 stdenv.mkDerivation {
   pname = "diamond";
@@ -67,7 +67,7 @@ stdenv.mkDerivation {
     done
 
     # Patch executable ELFs.
-    for path in bin/lin64 ispfpga/bin/lin64; do
+    for path in bin/lin64 ispfpga/bin/lin64 synpbase/linux_a_64 synpbase/linux_a_64/mbin; do
         cd $out/$prefix/$path
         for f in *; do
             if ! file $f | grep -q "ELF 64-bit LSB executable" ; then
@@ -79,19 +79,22 @@ stdenv.mkDerivation {
             # dependencies from nix.
             patchelf \
                 --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-                --set-rpath "$libPath" --force-rpath \
+                --set-rpath "$libPath:$out/$prefix/bin/lin64:$out/$prefix/ispfpga/bin/lin64" \
+                --force-rpath \
                 $f
         done
     done
 
+    # Patch absolute /usr/bin/id path in script
+    sed -i -e "s#/usr/bin/id#${coreutils}/bin/id#" $out/$prefix/synpbase/bin/config/platform_set
+
     # Remove 32-bit libz.
     rm $out/$prefix/bin/lin64/libz.{so,so.1}
 
-    # Make wrappers (should these target more than the 'diamond' tool?).
-    # The purpose of these is just to call the target program using its
-    # absolute path - otherwise, it will crash.
+    # Make wrappers. The purpose of these is just to call the target program
+    # using its absolute path - otherwise, it will crash.
     mkdir -p bin
-    for tool in diamond ; do
+    for tool in diamond pnmainc ddtcmd ; do
         makeWrapper $out/$prefix/bin/lin64/$tool $out/bin/$tool
     done
   '';
diff --git a/pkgs/development/libraries/librsync/default.nix b/pkgs/development/libraries/librsync/default.nix
index cc9778a3ba7d..5139c397de3a 100644
--- a/pkgs/development/libraries/librsync/default.nix
+++ b/pkgs/development/libraries/librsync/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "librsync";
-  version = "2.3.2";
+  version = "2.3.4";
 
   src = fetchFromGitHub {
     owner = "librsync";
     repo = "librsync";
     rev = "v${version}";
-    sha256 = "sha256-GNwOIZ2UjvsYIthotiPDBrabYzCGFG/YVEbwVa9Nwi4=";
+    sha256 = "sha256-fiOby8tOhv0KJ+ZwAWfh/ynqHlYC9kNqKfxNl3IhzR8=";
   };
 
   nativeBuildInputs = [ cmake ];
@@ -19,6 +19,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Implementation of the rsync remote-delta algorithm";
     homepage = "https://librsync.sourceforge.net/";
+    changelog = "https://github.com/librsync/librsync/releases/tag/v${version}";
     license = licenses.lgpl2Plus;
     mainProgram = "rdiff";
     platforms = platforms.unix;
diff --git a/pkgs/development/libraries/s2n-tls/default.nix b/pkgs/development/libraries/s2n-tls/default.nix
index afb872287413..ddf4257afeee 100644
--- a/pkgs/development/libraries/s2n-tls/default.nix
+++ b/pkgs/development/libraries/s2n-tls/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "s2n-tls";
-  version = "1.3.36";
+  version = "1.3.37";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-IL7+f+7Igvm7KeBpDwnIoIB8IUqg3JDEtLFQslBIENE=";
+    sha256 = "sha256-NqOr2R61s4aUjHWI2QkyLpxUm/+c4vkAUg+UDduu3j4=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/spandsp/default.nix b/pkgs/development/libraries/spandsp/default.nix
index f2bc63d4f6d6..2c96e60c6d37 100644
--- a/pkgs/development/libraries/spandsp/default.nix
+++ b/pkgs/development/libraries/spandsp/default.nix
@@ -10,6 +10,7 @@ stdenv.mkDerivation rec {
   outputs = [ "out" "dev" ];
   makeFlags = [
     "CC=${stdenv.cc.targetPrefix}cc"
+    "CC_FOR_BUILD=${buildPackages.stdenv.cc}/bin/cc"
   ];
 
   configureFlags = [
diff --git a/pkgs/development/python-modules/asyncssh/default.nix b/pkgs/development/python-modules/asyncssh/default.nix
index 4165db53b128..a597c1bdf2c7 100644
--- a/pkgs/development/python-modules/asyncssh/default.nix
+++ b/pkgs/development/python-modules/asyncssh/default.nix
@@ -78,7 +78,6 @@ buildPythonPackage rec {
   ];
 
   meta = with lib; {
-    broken = stdenv.isDarwin;
     description = "Asynchronous SSHv2 Python client and server library";
     homepage = "https://asyncssh.readthedocs.io/";
     changelog = "https://github.com/ronf/asyncssh/blob/v${version}/docs/changes.rst";
diff --git a/pkgs/development/python-modules/frozendict/default.nix b/pkgs/development/python-modules/frozendict/default.nix
index 8c6c79c3ec6e..6e3aac99828e 100644
--- a/pkgs/development/python-modules/frozendict/default.nix
+++ b/pkgs/development/python-modules/frozendict/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "frozendict";
-  version = "2.3.4";
+  version = "2.3.5";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "Marco-Sulla";
     repo = "python-frozendict";
     rev = "refs/tags/v${version}";
-    hash = "sha256-rDorFoVHiwbkRsIIA2MLKPHJ9HWJw2FKZ5iFHEiqzhg=";
+    hash = "sha256-IlKhqQvNaYz4+U8UJ/fGUNNTC3RjyGKCJUzJ6J431Vw=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/gdown/default.nix b/pkgs/development/python-modules/gdown/default.nix
index 7f802a10b10f..7db92fffc88f 100644
--- a/pkgs/development/python-modules/gdown/default.nix
+++ b/pkgs/development/python-modules/gdown/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "gdown";
-  version = "4.6.2";
+  version = "4.6.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-/2pPAymq6dek2NsInD+ga+CYOTG7BPgWGNm7Iwp2GHg=";
+    hash = "sha256-7G6pIu9ONhagVAc2VtmqLNxxf729CpTS931S0yOUMwc=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/itanium-demangler/default.nix b/pkgs/development/python-modules/itanium-demangler/default.nix
index d1251449af5c..67b71c9bf217 100644
--- a/pkgs/development/python-modules/itanium-demangler/default.nix
+++ b/pkgs/development/python-modules/itanium-demangler/default.nix
@@ -15,7 +15,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "whitequark";
     repo = "python-itanium_demangler";
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
     hash = "sha256-I6NUfckt2cocQt5dZSFadpshTCuA/6bVNauNXypWh+A=";
   };
 
@@ -28,7 +28,7 @@ buildPythonPackage rec {
   ];
 
   pythonImportsCheck = [
-    " itanium_demangler "
+    "itanium_demangler"
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/pulumi-aws/default.nix b/pkgs/development/python-modules/pulumi-aws/default.nix
index 8c52852b98c6..ae388396fd3f 100644
--- a/pkgs/development/python-modules/pulumi-aws/default.nix
+++ b/pkgs/development/python-modules/pulumi-aws/default.nix
@@ -12,7 +12,7 @@
 buildPythonPackage rec {
   pname = "pulumi-aws";
   # Version is independant of pulumi's.
-  version = "5.29.1";
+  version = "5.30.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "pulumi";
     repo = "pulumi-aws";
     rev = "refs/tags/v${version}";
-    hash = "sha256-sdefoQgZ58re2VtIvNQjbjAb9aateZlGSeTAiVO6JGo=";
+    hash = "sha256-XRn5kMbbbbk5+X8vah44cAHv2MMySK0ToO8ga5FWSuA=";
   };
 
   sourceRoot = "${src.name}/sdk/python";
diff --git a/pkgs/development/python-modules/rokuecp/default.nix b/pkgs/development/python-modules/rokuecp/default.nix
index 44ea38934b9f..d272d07ff19f 100644
--- a/pkgs/development/python-modules/rokuecp/default.nix
+++ b/pkgs/development/python-modules/rokuecp/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "rokuecp";
-  version = "0.17.0";
+  version = "0.17.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -25,8 +25,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "ctalkington";
     repo = "python-rokuecp";
-    rev = version;
-    hash = "sha256-M4eZzFphhc96Pf1bspD+Hvl9SUN1N72xnxdtVFiPc78=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-3GHG4FBGMiF5kNk2gl05xiX9+5tcrUyi4SUCXTa6Qco=";
   };
 
   nativeBuildInputs = [
@@ -73,6 +73,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Asynchronous Python client for Roku (ECP)";
     homepage = "https://github.com/ctalkington/python-rokuecp";
+    changelog = "https://github.com/ctalkington/python-rokuecp/releases/tag/${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/txtorcon/default.nix b/pkgs/development/python-modules/txtorcon/default.nix
index 85385347b96f..e412b9a87027 100644
--- a/pkgs/development/python-modules/txtorcon/default.nix
+++ b/pkgs/development/python-modules/txtorcon/default.nix
@@ -1,30 +1,33 @@
 { lib
 , stdenv
-, python
-, buildPythonPackage
-, pythonOlder
-, fetchPypi
-, cryptography
-, incremental
-, twisted
 , automat
-, zope_interface
-, idna
-, pyopenssl
-, service-identity
-, pytestCheckHook
-, mock
-, lsof
+, buildPythonPackage
+, cryptography
+, fetchPypi
 , GeoIP
+, idna
+, incremental
+, lsof
+, mock
+, pyopenssl
+, pytestCheckHook
+, python
+, pythonOlder
+, service-identity
+, twisted
+, zope_interface
 }:
 
 buildPythonPackage rec {
   pname = "txtorcon";
-  version = "22.0.0";
+  version = "23.0.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-iaG2XjKks2nWfmwWY4f7xGjMXQUidEjSOaXn6XGKoFM=";
+    hash = "sha256-AiX/rWdokTeEmtmtNK21abDYj5rwRQMABnpfkB6ZQyU=";
   };
 
   propagatedBuildInputs = [
@@ -35,14 +38,20 @@ buildPythonPackage rec {
     zope_interface
   ] ++ twisted.optional-dependencies.tls;
 
-  nativeCheckInputs = [ pytestCheckHook mock lsof GeoIP ];
+  nativeCheckInputs = [
+    pytestCheckHook
+    mock
+    lsof
+    GeoIP
+  ];
 
   doCheck = !(stdenv.isDarwin && stdenv.isAarch64);
 
-  meta = {
+  meta = with lib; {
     description = "Twisted-based Tor controller client, with state-tracking and configuration abstractions";
     homepage = "https://github.com/meejah/txtorcon";
-    maintainers = with lib.maintainers; [ jluttine exarkun ];
-    license = lib.licenses.mit;
+    changelog = "https://github.com/meejah/txtorcon/releases/tag/v${version}";
+    maintainers = with maintainers; [ jluttine exarkun ];
+    license = licenses.mit;
   };
 }
diff --git a/pkgs/development/python-modules/types-docutils/default.nix b/pkgs/development/python-modules/types-docutils/default.nix
index 33e80f489521..a2ca0732797a 100644
--- a/pkgs/development/python-modules/types-docutils/default.nix
+++ b/pkgs/development/python-modules/types-docutils/default.nix
@@ -5,12 +5,12 @@
 
 buildPythonPackage rec {
   pname = "types-docutils";
-  version = "0.19.1.3";
+  version = "0.19.1.4";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Nv4w3lbx7OGp96mQ1H2qeBta+DHSs/Lct9/QG4V8w9Q=";
+    hash = "sha256-G2SyG2Cf8fx3kdPZMPFLVrNq0JAp/ZfkXjTMiJ1nG18=";
   };
 
   # Module doesn't have tests
diff --git a/pkgs/development/tools/sentry-cli/default.nix b/pkgs/development/tools/sentry-cli/default.nix
index f4fac6644646..9f1d0f592f4e 100644
--- a/pkgs/development/tools/sentry-cli/default.nix
+++ b/pkgs/development/tools/sentry-cli/default.nix
@@ -9,13 +9,13 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "sentry-cli";
-  version = "2.12.0";
+  version = "2.13.0";
 
   src = fetchFromGitHub {
     owner = "getsentry";
     repo = "sentry-cli";
     rev = version;
-    sha256 = "sha256-HkaCaOVbEEy8H6gN9hoiDEEQM+XWyUJ4gYPxTlbBGgA=";
+    sha256 = "sha256-U6L2JQk/fYuxmZdt3CvPSaaEDRgZby0CiPT0nJGuVwA=";
   };
   doCheck = false;
 
@@ -25,7 +25,7 @@ rustPlatform.buildRustPackage rec {
   buildInputs = [ openssl ] ++ lib.optionals stdenv.isDarwin [ Security SystemConfiguration ];
   nativeBuildInputs = [ pkg-config ];
 
-  cargoHash = "sha256-4RUeUwixb5omcHT4jJHJKF2lYZE/4014DnrR2j7sen0=";
+  cargoHash = "sha256-gF3a8oCHmnNgatvbM1DeOQknXMMcHgerx2OcDdyqC8U=";
 
   meta = with lib; {
     homepage = "https://docs.sentry.io/cli/";
diff --git a/pkgs/os-specific/linux/ell/default.nix b/pkgs/os-specific/linux/ell/default.nix
index e4ac8c3929d6..6243076a2111 100644
--- a/pkgs/os-specific/linux/ell/default.nix
+++ b/pkgs/os-specific/linux/ell/default.nix
@@ -28,7 +28,8 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  doCheck = true;
+  # tests sporadically fail on musl
+  doCheck = !stdenv.hostPlatform.isMusl;
 
   meta = with lib; {
     homepage = "https://git.kernel.org/pub/scm/libs/ell/ell.git";
diff --git a/pkgs/os-specific/linux/ena/default.nix b/pkgs/os-specific/linux/ena/default.nix
index fe056be74a7e..e3529c97e7ba 100644
--- a/pkgs/os-specific/linux/ena/default.nix
+++ b/pkgs/os-specific/linux/ena/default.nix
@@ -1,14 +1,14 @@
 { lib, stdenv, fetchFromGitHub, kernel }:
 
 stdenv.mkDerivation rec {
-  version = "2.8.2";
+  version = "2.8.3";
   name = "ena-${version}-${kernel.version}";
 
   src = fetchFromGitHub {
     owner = "amzn";
     repo = "amzn-drivers";
     rev = "ena_linux_${version}";
-    sha256 = "sha256-KlRNI2lnUbNeQGY1G+Qm683yXRTNCJwWIri51+PAi9o=";
+    sha256 = "sha256-Z5BCqqC4FNKHqpocJ6CsHwhh5sszj5QfxiN6+Dkaqek=";
   };
 
   hardeningDisable = [ "pic" ];
diff --git a/pkgs/os-specific/linux/firejail/default.nix b/pkgs/os-specific/linux/firejail/default.nix
index 9ab8eac772ce..64607c5653eb 100644
--- a/pkgs/os-specific/linux/firejail/default.nix
+++ b/pkgs/os-specific/linux/firejail/default.nix
@@ -47,6 +47,12 @@ stdenv.mkDerivation rec {
     # Fix the path to 'xdg-dbus-proxy' hardcoded in the 'common.h' file
     substituteInPlace src/include/common.h \
       --replace '/usr/bin/xdg-dbus-proxy' '${xdg-dbus-proxy}/bin/xdg-dbus-proxy'
+
+    # Workaround for regression introduced in 0.9.72 preventing usage of
+    # end-of-options indicator "--"
+    # See https://github.com/netblue30/firejail/issues/5659
+    substituteInPlace src/firejail/sandbox.c \
+      --replace " && !arg_doubledash" ""
   '';
 
   preConfigure = ''
diff --git a/pkgs/servers/matrix-synapse/matrix-hookshot/default.nix b/pkgs/servers/matrix-synapse/matrix-hookshot/default.nix
new file mode 100644
index 000000000000..9903dbb1184e
--- /dev/null
+++ b/pkgs/servers/matrix-synapse/matrix-hookshot/default.nix
@@ -0,0 +1,76 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, fetchYarnDeps
+, makeWrapper
+, matrix-sdk-crypto-nodejs
+, mkYarnPackage
+, rust
+, rustPlatform
+, napi-rs-cli
+, nodejs
+}:
+
+let
+  data = lib.importJSON ./pin.json;
+in
+mkYarnPackage rec {
+  pname = "matrix-hookshot";
+  version = data.version;
+
+  src = fetchFromGitHub {
+    owner = "matrix-org";
+    repo = "matrix-hookshot";
+    rev = data.version;
+    sha256 = data.srcHash;
+  };
+
+  packageJSON = ./package.json;
+
+  offlineCache = fetchYarnDeps {
+    yarnLock = src + "/yarn.lock";
+    sha256 = data.yarnHash;
+  };
+
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit src;
+    name = "${pname}-${version}";
+    hash = "sha256-WolkDSS5wPxtltKzq4Er2nAQ0GrsF3imim3/Ge4eguQ=";
+  };
+
+  packageResolutions = {
+    "@matrix-org/matrix-sdk-crypto-nodejs" = "${matrix-sdk-crypto-nodejs}/lib/node_modules/@matrix-org/matrix-sdk-crypto-nodejs";
+  };
+
+  nativeBuildInputs = [
+    rustPlatform.cargoSetupHook
+    rustPlatform.rust.cargo
+    rustPlatform.rust.rustc
+    napi-rs-cli
+    makeWrapper
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+    cd deps/${pname}
+    napi build --target ${rust.toRustTargetSpec stdenv.targetPlatform} --dts ../src/libRs.d.ts --release ./lib
+    yarn run build:app:fix-defs
+    yarn run build:app
+    yarn run build:web
+    cd ../..
+    runHook postBuild
+  '';
+
+  postInstall = ''
+    makeWrapper '${nodejs}/bin/node' "$out/bin/matrix-hookshot" --add-flags \
+        "$out/libexec/matrix-hookshot/deps/matrix-hookshot/lib/App/BridgeApp.js"
+  '';
+
+  doDist = false;
+
+  meta = with lib; {
+    description = "A bridge between Matrix and multiple project management services, such as GitHub, GitLab and JIRA";
+    maintainers = with maintainers; [ chvp ];
+    license = licenses.asl20;
+  };
+}
diff --git a/pkgs/servers/matrix-synapse/matrix-hookshot/package.json b/pkgs/servers/matrix-synapse/matrix-hookshot/package.json
new file mode 100644
index 000000000000..6676f3bb9c30
--- /dev/null
+++ b/pkgs/servers/matrix-synapse/matrix-hookshot/package.json
@@ -0,0 +1,111 @@
+{
+  "name": "matrix-hookshot",
+  "version": "2.7.0",
+  "description": "A bridge between Matrix and multiple project management services, such as GitHub, GitLab and JIRA.",
+  "main": "lib/app.js",
+  "repository": "https://github.com/matrix-org/matrix-hookshot",
+  "author": "matrix.org",
+  "license": "Apache-2.0",
+  "napi": {
+    "name": "matrix-hookshot-rs"
+  },
+  "engines": {
+    "node": ">=16"
+  },
+  "scripts": {
+    "build:web": "vite build",
+    "build:app": "tsc --project tsconfig.json",
+    "build:app:rs": "napi build --dts ../src/libRs.d.ts --release ./lib",
+    "build:app:fix-defs": "ts-node scripts/definitions-fixer.ts src/libRs.d.ts",
+    "build:docs": "ts-node scripts/build-metrics-docs.ts > docs/metrics.md && mdbook build",
+    "dev:web": "vite dev",
+    "build": "scripts/build-app.sh",
+    "clean:web": "rimraf public/",
+    "clean:app": "tsc --build tsconfig.json --clean",
+    "clean:app:rs": "rimraf src/libRs.d.ts target/",
+    "clean:docs": "mdbook clean",
+    "clean": "scripts/clean.sh",
+    "prepare": "yarn build",
+    "start": "node --require source-map-support/register lib/App/BridgeApp.js",
+    "start:app": "node --require source-map-support/register lib/App/BridgeApp.js",
+    "start:webhooks": "node --require source-map-support/register lib/App/GithubWebhookApp.js",
+    "start:matrixsender": "node --require source-map-support/register lib/App/MatrixSenderApp.js",
+    "test": "mocha -r ts-node/register tests/init.ts tests/*.ts  tests/**/*.ts",
+    "test:cover": "nyc --reporter=lcov --reporter=text yarn test",
+    "lint": "yarn run lint:js && yarn run lint:rs",
+    "lint:js": "eslint -c .eslintrc.js 'src/**/*.ts' 'tests/**/*.ts' 'web/**/*.ts' 'web/**/*.tsx'",
+    "lint:rs": "cargo fmt --all -- --check",
+    "generate-default-config": "ts-node src/Config/Defaults.ts --config > config.sample.yml",
+    "validate-config": "ts-node src/Config/Config.ts"
+  },
+  "dependencies": {
+    "@alloc/quick-lru": "^5.2.0",
+    "@octokit/auth-app": "^3.3.0",
+    "@octokit/auth-token": "^2.4.5",
+    "@octokit/rest": "^18.10.0",
+    "@octokit/webhooks": "^9.1.2",
+    "ajv": "^8.11.0",
+    "axios": "^0.24.0",
+    "cors": "^2.8.5",
+    "express": "^4.17.3",
+    "figma-js": "^1.14.0",
+    "http-status-codes": "^2.2.0",
+    "ioredis": "^5.2.3",
+    "jira-client": "^8.0.0",
+    "markdown-it": "^12.3.2",
+    "matrix-appservice-bridge": "^6.0.0",
+    "matrix-bot-sdk": "npm:@vector-im/matrix-bot-sdk@^0.6.3-element.0",
+    "matrix-widget-api": "^1.0.0",
+    "micromatch": "^4.0.4",
+    "mime": "^3.0.0",
+    "node-emoji": "^1.11.0",
+    "nyc": "^15.1.0",
+    "p-queue": "^6.6.2",
+    "prom-client": "^14.0.1",
+    "reflect-metadata": "^0.1.13",
+    "rss-parser": "^3.12.0",
+    "source-map-support": "^0.5.21",
+    "string-argv": "^0.3.1",
+    "tiny-typed-emitter": "^2.1.0",
+    "uuid": "^8.3.2",
+    "vm2": "^3.9.11",
+    "winston": "^3.3.3",
+    "xml2js": "^0.4.23",
+    "yaml": "^1.10.2"
+  },
+  "devDependencies": {
+    "@codemirror/lang-javascript": "^6.0.2",
+    "@napi-rs/cli": "^2.2.0",
+    "@preact/preset-vite": "^2.2.0",
+    "@tsconfig/node16": "^1.0.3",
+    "@types/ajv": "^1.0.0",
+    "@types/chai": "^4.2.22",
+    "@types/cors": "^2.8.12",
+    "@types/express": "^4.17.14",
+    "@types/jira-client": "^7.1.0",
+    "@types/markdown-it": "^12.2.3",
+    "@types/micromatch": "^4.0.1",
+    "@types/mime": "^2.0.3",
+    "@types/mocha": "^9.0.0",
+    "@types/node": "^16",
+    "@types/node-emoji": "^1.8.1",
+    "@types/uuid": "^8.3.3",
+    "@types/xml2js": "^0.4.11",
+    "@typescript-eslint/eslint-plugin": "^5.4.0",
+    "@typescript-eslint/parser": "^5.4.0",
+    "@uiw/react-codemirror": "^4.12.3",
+    "chai": "^4.3.4",
+    "eslint": "^8.3.0",
+    "eslint-config-preact": "^1.3.0",
+    "eslint-plugin-mocha": "^9.0.0",
+    "mini.css": "^3.0.1",
+    "mocha": "^8.2.1",
+    "preact": "^10.5.15",
+    "rimraf": "^3.0.2",
+    "sass": "^1.51.0",
+    "ts-node": "^10.4.0",
+    "typescript": "^4.5.2",
+    "vite": "^2.9.13",
+    "vite-svg-loader": "^3.4.0"
+  }
+}
diff --git a/pkgs/servers/matrix-synapse/matrix-hookshot/pin.json b/pkgs/servers/matrix-synapse/matrix-hookshot/pin.json
new file mode 100644
index 000000000000..d726307eeb00
--- /dev/null
+++ b/pkgs/servers/matrix-synapse/matrix-hookshot/pin.json
@@ -0,0 +1,5 @@
+{
+  "version": "2.7.0",
+  "srcHash": "rW5fqKshnF2S4w55V2GaAa2RFVM+YbwRum9OwTTpYuA=",
+  "yarnHash": "0q71901ra9m9rbbczal1imqfba4b07bpr8hkpw1d1r9ghc2xjay4"
+}
diff --git a/pkgs/servers/matrix-synapse/matrix-hookshot/update.sh b/pkgs/servers/matrix-synapse/matrix-hookshot/update.sh
new file mode 100755
index 000000000000..4d91ec753329
--- /dev/null
+++ b/pkgs/servers/matrix-synapse/matrix-hookshot/update.sh
@@ -0,0 +1,35 @@
+#!/usr/bin/env -S nix shell nixpkgs#nix nixpkgs#curl nixpkgs#jq nixpkgs#prefetch-yarn-deps nixpkgs#nix-prefetch-github nixpkgs#nix-prefetch-git --command bash
+
+if [ "$#" -gt 1 ] || [[ "$1" == -* ]]; then
+  echo "Regenerates packaging data for matrix-hookshot."
+  echo "Usage: $0 [git release tag]"
+  exit 1
+fi
+
+version="$1"
+
+set -euo pipefail
+
+if [ -z "$version" ]; then
+  version="$(curl "https://api.github.com/repos/matrix-org/matrix-hookshot/releases?per_page=1" | jq -r '.[0].tag_name')"
+fi
+
+src="https://raw.githubusercontent.com/matrix-org/matrix-hookshot/$version"
+src_hash=$(nix-prefetch-github matrix-org matrix-hookshot --rev ${version} | jq -r .sha256)
+
+tmpdir=$(mktemp -d)
+trap 'rm -rf "$tmpdir"' EXIT
+
+pushd $tmpdir
+curl -O "$src/yarn.lock"
+yarn_hash=$(prefetch-yarn-deps yarn.lock)
+popd
+
+curl -O "$src/package.json"
+cat > pin.json << EOF
+{
+  "version": "$version",
+  "srcHash": "$src_hash",
+  "yarnHash": "$yarn_hash"
+}
+EOF
diff --git a/pkgs/tools/admin/syft/default.nix b/pkgs/tools/admin/syft/default.nix
index 2d7f00d2d649..6c627c3464d4 100644
--- a/pkgs/tools/admin/syft/default.nix
+++ b/pkgs/tools/admin/syft/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "syft";
-  version = "0.71.0";
+  version = "0.72.0";
 
   src = fetchFromGitHub {
     owner = "anchore";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-Q02WBUMwboGkXrSjCT2C3vLYH4UlnavIudvOSb5g2bA=";
+    hash = "sha256-WpAD7/GiKD5+f9uqfRL5b3gMeUNaYHsosoNi0KdoBa0=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -22,7 +22,7 @@ buildGoModule rec {
   };
   # hash mismatch with darwin
   proxyVendor = true;
-  vendorHash = "sha256-bUSQk4uJ4TAhjLS8pjqC486sa31z/MyZf5jDsnxhtSM=";
+  vendorHash = "sha256-8ArooLNyabjFTXYlfYTn63CewtPCT+p4+DNsebFoTj4=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/filesystems/btrfs-progs/default.nix b/pkgs/tools/filesystems/btrfs-progs/default.nix
index a24481bbae9e..8c04f5d23387 100644
--- a/pkgs/tools/filesystems/btrfs-progs/default.nix
+++ b/pkgs/tools/filesystems/btrfs-progs/default.nix
@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation rec {
   pname = "btrfs-progs";
-  version = "6.1.2";
+  version = "6.1.3";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/people/kdave/btrfs-progs/btrfs-progs-v${version}.tar.xz";
-    sha256 = "sha256-a+Zn2X89ZcC6V8MxyYsL07E89g2NMfqK0liCqtnXnXo=";
+    sha256 = "sha256-03/J7E+ld4sgqnVI/nBus6MAM4wUczGCca5UAk2scWc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/misc/debian-devscripts/default.nix b/pkgs/tools/misc/debian-devscripts/default.nix
index 6b710f2e2c0d..c2b0f3fd2aef 100644
--- a/pkgs/tools/misc/debian-devscripts/default.nix
+++ b/pkgs/tools/misc/debian-devscripts/default.nix
@@ -27,7 +27,7 @@ in stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ makeWrapper pkg-config ];
   buildInputs = [ xz dpkg libxslt python setuptools curl gnupg diffutils bash-completion help2man ] ++
-    (with perlPackages; [ perl CryptSSLeay LWP TimeDate DBFile FileDesktopEntry ParseDebControl LWPProtocolHttps ]);
+    (with perlPackages; [ perl CryptSSLeay LWP TimeDate DBFile FileDesktopEntry ParseDebControl LWPProtocolHttps Moo FileHomeDir IPCRun FileDirList FileTouch ]);
 
   preConfigure = ''
     export PERL5LIB="$PERL5LIB''${PERL5LIB:+:}${dpkg}";
diff --git a/pkgs/tools/misc/tea/default.nix b/pkgs/tools/misc/tea/default.nix
index cc68fa7c55fd..a576e70a3714 100644
--- a/pkgs/tools/misc/tea/default.nix
+++ b/pkgs/tools/misc/tea/default.nix
@@ -2,14 +2,14 @@
 
 buildGoModule rec {
   pname = "tea";
-  version = "0.9.0";
+  version = "0.9.2";
 
   src = fetchFromGitea {
     domain = "gitea.com";
     owner = "gitea";
     repo = "tea";
     rev = "v${version}";
-    sha256 = "sha256-Bvee8m/BXvPtaaD8xjVg9qzorO0ln6xHP1upPgWoD+A=";
+    sha256 = "sha256-sZfg8+LIu1Ejvmr/o4X3EOz3fv+RvLhrGRf2yy+6t8c=";
   };
 
   vendorSha256 = "sha256-nb0lQEAaIYlGpodFQLhMk/24DmTgg5K3zQ4s/XY+Z1w=";
diff --git a/pkgs/tools/misc/vtm/default.nix b/pkgs/tools/misc/vtm/default.nix
index c3b5ae21f9f4..485006228b00 100644
--- a/pkgs/tools/misc/vtm/default.nix
+++ b/pkgs/tools/misc/vtm/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vtm";
-  version = "0.9.8t";
+  version = "0.9.8v";
 
   src = fetchFromGitHub {
     owner = "netxs-group";
     repo = "vtm";
     rev = "v${version}";
-    sha256 = "sha256-Q6kwGmxDThsaGIzSPhxd/kKz0nORf6K9lUJMU9CdIXU=";
+    sha256 = "sha256-7ECYbw51MXhYsbQxnuS4QUr5HN0cIUqgMx7V7D/kYTg=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/tools/security/fulcio/default.nix b/pkgs/tools/security/fulcio/default.nix
index 91ec0a5c2503..9640b0d1fc98 100644
--- a/pkgs/tools/security/fulcio/default.nix
+++ b/pkgs/tools/security/fulcio/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "fulcio";
-  version = "1.0.0";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "sigstore";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-djnDHRD/vHfsem03896qcEb6uzgW3OCMBLqMDHca9vY=";
+    sha256 = "sha256-b2rn4et7Ze8XRc1Oa/DCfpva/rihtBLapbGlpYGvOjc=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -20,7 +20,7 @@ buildGoModule rec {
       find "$out" -name .git -print0 | xargs -0 rm -rf
     '';
   };
-  vendorSha256 = "sha256-X+M/E1kWhgS408PHwMg5jnDn2ad1NW6xvlLucuOLAeg=";
+  vendorHash = "sha256-8iNXBSEaKApu+qjGIYOLU6z/sxIVQhltgBRG9eN4RXw=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/system/erdtree/default.nix b/pkgs/tools/system/erdtree/default.nix
index a60071e44739..ddca2f106b49 100644
--- a/pkgs/tools/system/erdtree/default.nix
+++ b/pkgs/tools/system/erdtree/default.nix
@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "erdtree";
-  version = "1.0.0";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "solidiquis";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-gZC90flsfH03Grc1netzlv/iX/9DH+rpaSstfXFearc=";
+    hash = "sha256-W9rTsumZZ3O0kOc+dT9TC/Z/Katb3q6yFreAVCvX5qo=";
   };
 
-  cargoHash = "sha256-0I60lUYyR4Za2Q3FqcdqJhUKFjX5+PE88G6JxxxiBXw=";
+  cargoHash = "sha256-6jFBNkiCFBQbpiYkNZ6dyXH/ZnFHZYFliMZFlE/DodM=";
 
   meta = with lib; {
     description = "File-tree visualizer and disk usage analyzer";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 788dc179f022..b76b8f73cccc 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -9070,6 +9070,8 @@ with pkgs;
 
   matrix-corporal = callPackage ../servers/matrix-corporal { };
 
+  matrix-hookshot = callPackage ../servers/matrix-synapse/matrix-hookshot {};
+
   mautrix-facebook = callPackage ../servers/mautrix-facebook { };
 
   mautrix-googlechat = callPackage ../servers/mautrix-googlechat { };
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index f115511a1183..f84085c8c3c2 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -9139,6 +9139,22 @@ let
     };
   };
 
+  FileDirList = buildPerlPackage {
+    version = "0.05";
+    pname = "File-DirList";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/T/TP/TPABA/File-DirList/File-DirList-0.05.tar.gz";
+      sha256 = "sha256-mTt9dmLlV5hEih7azLmr0oHSvSO+fquZ9Wm44pYtO8M=";
+    };
+    preCheck = ''
+      export HOME="$TMPDIR"
+    '';
+    meta = {
+      description = "Provide a sorted list of directory content";
+      license = with lib.licenses; [ artistic1 gpl1Plus ];
+    };
+  };
+
   FileFindIterator = buildPerlPackage {
     pname = "File-Find-Iterator";
     version = "0.4";