diff --git a/nixos/modules/services/web-apps/netbox.nix b/nixos/modules/services/web-apps/netbox.nix
index f09a8dfc5b21..800af234e278 100644
--- a/nixos/modules/services/web-apps/netbox.nix
+++ b/nixos/modules/services/web-apps/netbox.nix
@@ -9,6 +9,10 @@ let
     name = "configuration.py";
     text = ''
       STATIC_ROOT = '${staticDir}'
+      MEDIA_ROOT = '${cfg.dataDir}/media'
+      REPORTS_ROOT = '${cfg.dataDir}/reports'
+      SCRIPTS_ROOT = '${cfg.dataDir}/scripts'
+
       ALLOWED_HOSTS = ['*']
       DATABASE = {
         'NAME': 'netbox',
@@ -42,11 +46,10 @@ let
     installPhase = old.installPhase + ''
       ln -s ${configFile} $out/opt/netbox/netbox/netbox/configuration.py
     '' + optionalString cfg.enableLdap ''
-      ln -s ${ldapConfigPath} $out/opt/netbox/netbox/netbox/ldap_config.py
+      ln -s ${cfg.ldapConfigPath} $out/opt/netbox/netbox/netbox/ldap_config.py
     '';
   })).override {
-    plugins = ps: ((cfg.plugins ps)
-      ++ optionals cfg.enableLdap [ ps.django-auth-ldap ]);
+    inherit (cfg) plugins;
   };
   netboxManageScript = with pkgs; (writeScriptBin "netbox-manage" ''
     #!${stdenv.shell}
@@ -139,6 +142,8 @@ in {
   };
 
   config = mkIf cfg.enable {
+    services.netbox.plugins = mkIf cfg.enableLdap (ps: [ ps.django-auth-ldap ]);
+
     services.redis.servers.netbox.enable = true;
 
     services.postgresql = {
diff --git a/pkgs/applications/editors/texstudio/default.nix b/pkgs/applications/editors/texstudio/default.nix
index 6a0f498fa554..96fb32e80f36 100644
--- a/pkgs/applications/editors/texstudio/default.nix
+++ b/pkgs/applications/editors/texstudio/default.nix
@@ -3,13 +3,13 @@
 
 mkDerivation rec {
   pname = "texstudio";
-  version = "4.4.0";
+  version = "4.4.1";
 
   src = fetchFromGitHub {
     owner = "${pname}-org";
     repo = pname;
     rev = version;
-    hash = "sha256-BaTfebLilUeDNtCJZmgAx+hN+L+4MtnuL6t3wQRX/Ns=";
+    hash = "sha256-3w9JKX0tT5J3tJthIxJ+ZMlG8+gEeQAl9Gn+Zyjhmt4=";
   };
 
   nativeBuildInputs = [ qmake wrapQtAppsHook pkg-config ];
diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.json b/pkgs/applications/networking/browsers/chromium/upstream-info.json
index c7ee4b263dfb..0dcd4c96c219 100644
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.json
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json
@@ -19,9 +19,9 @@
     }
   },
   "beta": {
-    "version": "108.0.5359.48",
-    "sha256": "0nk33rv4q22kgr9197y6a4w8yazgifsm5qvmmia41nnl24sqik57",
-    "sha256bin64": "062anw2i8rfi4v8zl0jdqxzn24xzl3ny24cbiyk8dyyf55r914v0",
+    "version": "108.0.5359.71",
+    "sha256": "0pgzf6xrd71is1dld1arhq366vjp8p54x75zyx6y7vcjqj0a0v6b",
+    "sha256bin64": "14sarqyw2pdcnkk2xnsdq58wg0s576fjvqfg0ishprm7ndks1z6m",
     "deps": {
       "gn": {
         "version": "2022-10-05",
diff --git a/pkgs/applications/networking/mailreaders/mailspring/default.nix b/pkgs/applications/networking/mailreaders/mailspring/default.nix
index a5a9b3ac89b4..07de3be99651 100644
--- a/pkgs/applications/networking/mailreaders/mailspring/default.nix
+++ b/pkgs/applications/networking/mailreaders/mailspring/default.nix
@@ -21,11 +21,11 @@
 
 stdenv.mkDerivation rec {
   pname = "mailspring";
-  version = "1.10.5";
+  version = "1.10.7";
 
   src = fetchurl {
     url = "https://github.com/Foundry376/Mailspring/releases/download/${version}/mailspring-${version}-amd64.deb";
-    sha256 = "sha256-eVwb7E04DzGdqfH4T+gkvmBtvN7ja4o8u7LvHk/581I=";
+    sha256 = "sha256-r/xutH3BLYCsFmmYJ1hdphLLktCzdAeM1Uwp1l1C1LQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/plasma-5/srcs.nix b/pkgs/desktops/plasma-5/srcs.nix
index f0b263ae4cf4..ae1dd2433625 100644
--- a/pkgs/desktops/plasma-5/srcs.nix
+++ b/pkgs/desktops/plasma-5/srcs.nix
@@ -396,11 +396,11 @@
     };
   };
   plasma-workspace = {
-    version = "5.26.4";
+    version = "5.26.4.1";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.26.4/plasma-workspace-5.26.4.tar.xz";
-      sha256 = "06pbghl8gpq63gg9jj29jsizgfq7bcqj9kx48gkqcwvd9gd1q1f9";
-      name = "plasma-workspace-5.26.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.26.4/plasma-workspace-5.26.4.1.tar.xz";
+      sha256 = "7fcca23ff8de6f4aa2261f0180be54422f25047002b7ca6c648e7216459b80fc";
+      name = "plasma-workspace-5.26.4.1.tar.xz";
     };
   };
   plasma-workspace-wallpapers = {
diff --git a/pkgs/development/interpreters/racket/force-remove-codesign-then-add.patch b/pkgs/development/interpreters/racket/force-remove-codesign-then-add.patch
index 38cd7f52e237..98e2cb102db9 100644
--- a/pkgs/development/interpreters/racket/force-remove-codesign-then-add.patch
+++ b/pkgs/development/interpreters/racket/force-remove-codesign-then-add.patch
@@ -5,6 +5,6 @@
  
  (void
 - (if remove?
-+ (if #t
++ (begin
       (remove-signature file)
       (add-ad-hoc-signature file)))
diff --git a/pkgs/development/ocaml-modules/calendar/default.nix b/pkgs/development/ocaml-modules/calendar/default.nix
index 4c089b76f3ed..cf349eeb8bb1 100644
--- a/pkgs/development/ocaml-modules/calendar/default.nix
+++ b/pkgs/development/ocaml-modules/calendar/default.nix
@@ -1,27 +1,25 @@
-{ stdenv, lib, fetchurl, ocaml, findlib }:
+{ lib, buildDunePackage, fetchFromGitHub, re }:
 
-stdenv.mkDerivation rec {
-  pname = "ocaml-calendar";
-  version = "2.5";
+buildDunePackage rec {
+  pname = "calendar";
+  version = "3.0.0";
+  minimalOCamlVersion = "4.03";
 
-  src = fetchurl {
-    url = "https://forge.ocamlcore.org/frs/download.php/915/calendar-${version}.tar.bz2";
-    sha256 = "04pvhwb664g3s644c7v7419a3kvf5s3pynkhmk5j59dvlfm1yf0f";
+  src = fetchFromGitHub {
+    owner = "ocaml-community";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-+VQzi6pEMqzV1ZR84Yjdu4jsJEWtx+7bd6PQGX7TiEs=";
   };
 
-  nativeBuildInputs = [ ocaml findlib ];
+  propagatedBuildInputs = [ re ];
 
   strictDeps = true;
 
-  createFindlibDestdir = true;
-
   meta = {
-    homepage = "https://forge.ocamlcore.org/projects/calendar/";
-    description = "An Objective Caml library managing dates and times";
-    license = "LGPL";
-    platforms = ocaml.meta.platforms or [ ];
-    maintainers = [
-      lib.maintainers.gal_bolle
-    ];
+    inherit (src.meta) homepage;
+    description = "A library for handling dates and times";
+    license = lib.licenses.lgpl21Plus;
+    maintainers = [ lib.maintainers.gal_bolle ];
   };
 }
diff --git a/pkgs/development/python-modules/apprise/default.nix b/pkgs/development/python-modules/apprise/default.nix
index 864dd570209e..0eca7e2e977f 100644
--- a/pkgs/development/python-modules/apprise/default.nix
+++ b/pkgs/development/python-modules/apprise/default.nix
@@ -7,30 +7,29 @@
 , gntp
 , installShellFiles
 , markdown
-, mock
 , paho-mqtt
+, pytest-mock
+, pytest-xdist
 , pytestCheckHook
 , pythonOlder
 , pyyaml
 , requests
 , requests-oauthlib
-, slixmpp
 }:
 
 buildPythonPackage rec {
   pname = "apprise";
-  version = "1.1.0";
+  version = "1.2.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-92eoBwp3fcKb9zCBeeC2ndLeZeZpM+2JsZmef/5yO2A=";
+    hash = "sha256-bjGvoY9HRS6szVb7fug9kkUsU00V85JAftGg48RlJEs=";
   };
 
   nativeBuildInputs = [
-    babel
     installShellFiles
   ];
 
@@ -44,11 +43,12 @@ buildPythonPackage rec {
   ];
 
   checkInputs = [
+    babel
     gntp
-    mock
     paho-mqtt
+    pytest-mock
+    pytest-xdist
     pytestCheckHook
-    slixmpp
   ];
 
   disabledTests = [
diff --git a/pkgs/development/python-modules/apsw/default.nix b/pkgs/development/python-modules/apsw/default.nix
index b93a3187afe5..f8fdf1612174 100644
--- a/pkgs/development/python-modules/apsw/default.nix
+++ b/pkgs/development/python-modules/apsw/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "apsw";
-  version = "3.39.4.0";
+  version = "3.40.0.0";
   format = "setuptools";
 
   disabled = isPyPy;
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "rogerbinns";
     repo = "apsw";
     rev = "refs/tags/${version}";
-    hash = "sha256-vFPvevtAAEHG34G2ZPbETo/Erjem4G9r7xvkEoPBlLQ=";
+    hash = "sha256-Bi2pW+8vFLcYnatlqsfnwqfCpV2cjannYaTqgIlfNNM=";
   };
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/retrying/default.nix b/pkgs/development/python-modules/retrying/default.nix
index 5e2451affb90..36e76f6bc6c7 100644
--- a/pkgs/development/python-modules/retrying/default.nix
+++ b/pkgs/development/python-modules/retrying/default.nix
@@ -2,26 +2,36 @@
 , buildPythonPackage
 , fetchPypi
 , six
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "retrying";
-  version = "1.3.3";
+  version = "1.3.4";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0fwp86xv0rvkncjdvy2mwcvbglw4w9k0fva25i7zx8kd19b3kh08";
+    hash = "sha256-NF2oxXZb2YKx0ZFd65EC/T0fetFr2EqXALhfZNJOjz4=";
   };
 
-  propagatedBuildInputs = [ six ];
+  propagatedBuildInputs = [
+    six
+  ];
 
   # doesn't ship tests in tarball
   doCheck = false;
 
-  meta = with lib; {
-    homepage = "https://github.com/rholder/retrying";
-    description = "General-purpose retrying library";
-    license = licenses.asl20;
-  };
+  pythonImportsCheck = [
+    "retrying"
+  ];
 
+  meta = with lib; {
+    description = "General-purpose retrying library";
+    homepage = "https://github.com/rholder/retrying";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ ];
+  };
 }
diff --git a/pkgs/development/tools/lightningcss/default.nix b/pkgs/development/tools/lightningcss/default.nix
index 4713211454be..088b91e212ab 100644
--- a/pkgs/development/tools/lightningcss/default.nix
+++ b/pkgs/development/tools/lightningcss/default.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "lightningcss";
-  version = "1.16.1";
+  version = "1.17.0";
 
   src = fetchFromGitHub {
     owner = "parcel-bundler";
     repo = "lightningcss";
     rev = "v${version}";
-    sha256 = "sha256-Mr3sqPrP9fIuQrE+XtDe5lu8dGwYNtKElfxFvLIllb4=";
+    sha256 = "sha256-N99e3paDwsl8lerijmq2srEdKaf3oJ1FJx6RUDQbXZg=";
   };
 
-  cargoSha256 = "sha256-mF7bUcy5np/odQvhz0PEsWWgWRL2k8X0VaO9y1pDtzE=";
+  cargoSha256 = "sha256-AkAOYq8VTtKMSqH4WDq48jepc58blkCQPB4EeppuUkk=";
 
   buildFeatures = [ "cli" ];
 
diff --git a/pkgs/development/tools/rust/cargo-zigbuild/default.nix b/pkgs/development/tools/rust/cargo-zigbuild/default.nix
index 258d1d39459c..f0e7e4577e07 100644
--- a/pkgs/development/tools/rust/cargo-zigbuild/default.nix
+++ b/pkgs/development/tools/rust/cargo-zigbuild/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-zigbuild";
-  version = "0.14.1";
+  version = "0.14.2";
 
   src = fetchFromGitHub {
     owner = "messense";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-9MmIu7oNdLLOl4zsx/A1v0dEc54bN+J6T2GcLFOvMpQ=";
+    sha256 = "sha256-koEKWtcpkxK2h562ZIjM0PvvLit7TMo03Ikg2SLMEWM=";
   };
 
-  cargoSha256 = "sha256-3UNjJRpNrDdrU63R7z+6TJR7lq8waPceDscx2yo+QeE=";
+  cargoSha256 = "sha256-CAaSnnCL+F1av6UYj4QKMEEXSFIAKroBQxew4SO1oU8=";
 
   nativeBuildInputs = [ makeWrapper ];
 
@@ -23,6 +23,7 @@ rustPlatform.buildRustPackage rec {
   meta = with lib; {
     description = "A tool to compile Cargo projects with zig as the linker";
     homepage = "https://github.com/messense/cargo-zigbuild";
+    changelog = "https://github.com/messense/cargo-zigbuild/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ figsoda ];
   };
diff --git a/pkgs/os-specific/linux/bridge-utils/default.nix b/pkgs/os-specific/linux/bridge-utils/default.nix
index cbbf77c67c8a..a03cb12727ce 100644
--- a/pkgs/os-specific/linux/bridge-utils/default.nix
+++ b/pkgs/os-specific/linux/bridge-utils/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, autoreconfHook }:
+{ lib, stdenv, fetchurl, autoreconfHook, fetchpatch }:
 
 stdenv.mkDerivation rec {
   pname = "bridge-utils";
@@ -9,7 +9,15 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-ph2L5PGhQFxgyO841UTwwYwFszubB+W0sxAzU2Fl5g4=";
   };
 
-  patches = [ ./autoconf-ar.patch ];
+  patches = [
+    ./autoconf-ar.patch
+
+    (fetchpatch {
+      name = "musl-includes.patch";
+      url = "https://git.alpinelinux.org/aports/plain/main/bridge-utils/fix-PATH_MAX-on-ppc64le.patch?id=12c9046eee3a0a35665dc4e280c1f5ae2af5845d";
+      sha256 = "sha256-uY1tgJhcm1DFctg9scmC8e+mgowgz4f/oF0+k+x+jqw=";
+    })
+  ];
 
   nativeBuildInputs = [ autoreconfHook ];
 
diff --git a/pkgs/servers/web-apps/changedetection-io/default.nix b/pkgs/servers/web-apps/changedetection-io/default.nix
index 888ccf675e96..ac09e5325889 100644
--- a/pkgs/servers/web-apps/changedetection-io/default.nix
+++ b/pkgs/servers/web-apps/changedetection-io/default.nix
@@ -31,14 +31,14 @@ let
 in
 py.pkgs.buildPythonApplication rec {
   pname = "changedetection-io";
-  version = "0.39.21.1";
+  version = "0.39.22.1";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "dgtlmoon";
     repo = "changedetection.io";
     rev = version;
-    sha256 = "sha256-cX2HwlsWOJ34msEnPP38jq+kzSxOM/spe0Ja2lZ/Q7w=";
+    sha256 = "sha256-qK44m64/skmeoBgHToTyOpeWUF2kgks10OHoAoLim+k=";
   };
 
   postPatch = ''
@@ -49,33 +49,35 @@ py.pkgs.buildPythonApplication rec {
   '';
 
   propagatedBuildInputs = with py.pkgs; [
-    flask
-    flask-wtf
+    apprise
+    beautifulsoup4
+    brotli
+    chardet
+    cryptography
     eventlet
-    validators
-    timeago
-    inscriptis
     feedgen
+    flask
     flask-login
     flask-restful
+    flask-wtf
+    inscriptis
     jinja2
     jinja2-time
-    pytz
-    brotli
-    requests
-    urllib3
-    chardet
-    wtforms
     jsonpath-ng
     jq
-    apprise
-    paho-mqtt
-    cryptography
-    beautifulsoup4
     lxml
-    selenium
-    werkzeug
+    paho-mqtt
+    pillow
     playwright
+    pytz
+    requests
+    selenium
+    setuptools
+    timeago
+    urllib3
+    validators
+    werkzeug
+    wtforms
   ] ++ requests.optional-dependencies.socks;
 
   # tests can currently not be run in one pytest invocation and without docker
diff --git a/pkgs/tools/admin/trivy/default.nix b/pkgs/tools/admin/trivy/default.nix
index 245da2e199a9..9200dd917495 100644
--- a/pkgs/tools/admin/trivy/default.nix
+++ b/pkgs/tools/admin/trivy/default.nix
@@ -5,17 +5,17 @@
 
 buildGoModule rec {
   pname = "trivy";
-  version = "0.34.0";
+  version = "0.35.0";
 
   src = fetchFromGitHub {
     owner = "aquasecurity";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-6xALedNX37+xUhvsVz7lWgqDppK0b3avUJ3zA6W2n6M=";
+    sha256 = "sha256-0lEKXCQ7os6hyqEuugNI8ogZiqJZq58VGafEKrcmV3I=";
   };
   # hash missmatch on across linux and darwin
   proxyVendor = true;
-  vendorSha256 = "sha256-CBsu2p66XgpeInKw/F6f6ULyoLc6cTtlXzNv3fI41YU=";
+  vendorSha256 = "sha256-cl6EShtXhe72fbKIMbma9pEGLPBVSNZMiHWi94BbkMM=";
 
   excludedPackages = "misc";
 
diff --git a/pkgs/tools/filesystems/jfsutils/default.nix b/pkgs/tools/filesystems/jfsutils/default.nix
index 9b7b520ce3aa..599326c8fbfb 100644
--- a/pkgs/tools/filesystems/jfsutils/default.nix
+++ b/pkgs/tools/filesystems/jfsutils/default.nix
@@ -20,6 +20,12 @@ stdenv.mkDerivation rec {
       url    = "https://sources.debian.org/data/main/j/jfsutils/1.1.15-4/debian/patches/add_sysmacros.patch";
       sha256 = "1qcwvxs4d0d24w5x98z59arqfx2n7f0d9xaqhjcg6w8n34vkhnyc";
     })
+    # fix for musl
+    (fetchpatch {
+      name = "musl-fix-includes.patch";
+      url = "https://git.alpinelinux.org/aports/plain/main/jfsutils/musl-fix-includes.patch?id=567823dca7dc1f8ce919efbe99762d2d5c020124";
+      sha256 = "sha256-FjdUOI+y+MdSWxTR+csH41uR0P+PWWTfIMPwQjBfQtQ=";
+    })
   ];
 
   nativeBuildInputs = [ autoreconfHook ];
diff --git a/pkgs/tools/misc/faketty/default.nix b/pkgs/tools/misc/faketty/default.nix
index 288286aa9b30..197bddd09559 100644
--- a/pkgs/tools/misc/faketty/default.nix
+++ b/pkgs/tools/misc/faketty/default.nix
@@ -2,14 +2,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "faketty";
-  version = "1.0.10";
+  version = "1.0.11";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-Jljq22xbXakwKdf5TXBXzuKuKJOBjf6lzCy8aHrVC3U=";
+    sha256 = "sha256-HMeJNUF4VT2WdGwAW21GvCp33Bg2HB8NCHv0+3cf74U=";
   };
 
-  cargoSha256 = "sha256-K0hNnqw178b7noHW76DMR0BoYhkrQpPQeHaH6Azt3Xo=";
+  cargoSha256 = "sha256-jhSleyhBquU0PxmVPGo1CkuwrzLG7WG5ANPmZ14/ui0=";
 
   postPatch = ''
     patchShebangs tests/test.sh