diff --git a/nixos/modules/services/hardware/throttled.nix b/nixos/modules/services/hardware/throttled.nix
index 2d801a7e838f..afca24d976e1 100644
--- a/nixos/modules/services/hardware/throttled.nix
+++ b/nixos/modules/services/hardware/throttled.nix
@@ -20,7 +20,7 @@ in {
   config = mkIf cfg.enable {
     systemd.packages = [ pkgs.throttled ];
     # The upstream package has this in Install, but that's not enough, see the NixOS manual
-    systemd.services.lenovo_fix.wantedBy = [ "multi-user.target" ];
+    systemd.services.throttled.wantedBy = [ "multi-user.target" ];
 
     environment.etc."throttled.conf".source =
       if cfg.extraConfig != ""
diff --git a/nixos/modules/virtualisation/amazon-options.nix b/nixos/modules/virtualisation/amazon-options.nix
index 926fe43b0ffe..3ea4a6cf7818 100644
--- a/nixos/modules/virtualisation/amazon-options.nix
+++ b/nixos/modules/virtualisation/amazon-options.nix
@@ -28,13 +28,13 @@ in {
             options = {
               mount = lib.mkOption {
                 description = lib.mdDoc "Where to mount this dataset.";
-                type = types.nullOr types.string;
+                type = types.nullOr types.str;
                 default = null;
               };
 
               properties = lib.mkOption {
                 description = lib.mdDoc "Properties to set on this dataset.";
-                type = types.attrsOf types.string;
+                type = types.attrsOf types.str;
                 default = {};
               };
             };
diff --git a/nixos/modules/virtualisation/openstack-options.nix b/nixos/modules/virtualisation/openstack-options.nix
index c71b581b02ca..52f45de92ecb 100644
--- a/nixos/modules/virtualisation/openstack-options.nix
+++ b/nixos/modules/virtualisation/openstack-options.nix
@@ -29,13 +29,13 @@ in
             options = {
               mount = lib.mkOption {
                 description = lib.mdDoc "Where to mount this dataset.";
-                type = types.nullOr types.string;
+                type = types.nullOr types.str;
                 default = null;
               };
 
               properties = lib.mkOption {
                 description = lib.mdDoc "Properties to set on this dataset.";
-                type = types.attrsOf types.string;
+                type = types.attrsOf types.str;
                 default = { };
               };
             };
diff --git a/nixos/tests/apfs.nix b/nixos/tests/apfs.nix
index a8841fe93046..ac0459b57e9c 100644
--- a/nixos/tests/apfs.nix
+++ b/nixos/tests/apfs.nix
@@ -21,9 +21,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
     with subtest("Enable case sensitivity and normalization sensitivity"):
       machine.succeed(
           "mkapfs -s -z /dev/vdb",
-          # Triggers a bug, see https://github.com/linux-apfs/linux-apfs-rw/issues/15
-          # "mount -o cknodes,readwrite /dev/vdb /tmp/mnt",
-          "mount -o readwrite /dev/vdb /tmp/mnt",
+          "mount -o cknodes,readwrite /dev/vdb /tmp/mnt",
           "echo 'Hello World 1' > /tmp/mnt/test.txt",
           "[ ! -f /tmp/mnt/TeSt.TxT ] || false", # Test case sensitivity
           "echo 'Hello World 1' | diff - /tmp/mnt/test.txt",
@@ -36,13 +34,13 @@ import ./make-test-python.nix ({ pkgs, ... }: {
     with subtest("Disable case sensitivity and normalization sensitivity"):
       machine.succeed(
           "mkapfs /dev/vdb",
-          "mount -o readwrite /dev/vdb /tmp/mnt",
+          "mount -o cknodes,readwrite /dev/vdb /tmp/mnt",
           "echo 'bla bla bla' > /tmp/mnt/Test.txt",
           "echo -n 'Hello World' > /tmp/mnt/test.txt",
           "echo ' 1' >> /tmp/mnt/TEST.TXT",
           "umount /tmp/mnt",
           "apfsck /dev/vdb",
-          "mount -o readwrite /dev/vdb /tmp/mnt",
+          "mount -o cknodes,readwrite /dev/vdb /tmp/mnt",
           "echo 'Hello World 1' | diff - /tmp/mnt/TeSt.TxT", # Test case insensitivity
           "echo 'Hello World 2' > /tmp/mnt/\u0061\u0301.txt",
           "echo 'Hello World 2' | diff - /tmp/mnt/\u0061\u0301.txt",
diff --git a/pkgs/applications/audio/jmusicbot/default.nix b/pkgs/applications/audio/jmusicbot/default.nix
index d9d7bf19e7d6..7a1676e7873c 100644
--- a/pkgs/applications/audio/jmusicbot/default.nix
+++ b/pkgs/applications/audio/jmusicbot/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchurl, makeWrapper, jre }:
+{ stdenv, lib, fetchurl, makeWrapper, jre_headless }:
 
 stdenv.mkDerivation rec {
   pname = "JMusicBot";
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
     mkdir -p $out/lib
     cp $src $out/lib/JMusicBot
 
-    makeWrapper ${jre}/bin/java $out/bin/JMusicBot \
+    makeWrapper ${jre_headless}/bin/java $out/bin/JMusicBot \
       --add-flags "-Xmx1G -Dnogui=true -Djava.util.concurrent.ForkJoinPool.common.parallelism=1 -jar $out/lib/JMusicBot"
   '';
 
@@ -27,6 +27,6 @@ stdenv.mkDerivation rec {
     sourceProvenance = with sourceTypes; [ binaryBytecode ];
     license = licenses.asl20;
     maintainers = with maintainers; [ SuperSandro2000 ];
-    platforms = platforms.all;
+    inherit (jre_headless.meta) platforms;
   };
 }
diff --git a/pkgs/applications/audio/musikcube/default.nix b/pkgs/applications/audio/musikcube/default.nix
index 82d4be406baf..706a36b5327f 100644
--- a/pkgs/applications/audio/musikcube/default.nix
+++ b/pkgs/applications/audio/musikcube/default.nix
@@ -10,7 +10,7 @@
 , gnutls
 , lame
 , libev
-, libgme
+, game-music-emu
 , libmicrohttpd
 , libopenmpt
 , mpg123
@@ -51,7 +51,7 @@ stdenv.mkDerivation rec {
     gnutls
     lame
     libev
-    libgme
+    game-music-emu
     libmicrohttpd
     libopenmpt
     mpg123
diff --git a/pkgs/applications/blockchains/chia-dev-tools/default.nix b/pkgs/applications/blockchains/chia-dev-tools/default.nix
index d65eb37f3985..e7b92b268a64 100644
--- a/pkgs/applications/blockchains/chia-dev-tools/default.nix
+++ b/pkgs/applications/blockchains/chia-dev-tools/default.nix
@@ -37,12 +37,13 @@ python3Packages.buildPythonApplication rec {
 
   propagatedBuildInputs = with python3Packages; [
     (toPythonModule chia)
+    pytest # required at runtime by the "test" command
+    pytest-asyncio
     pytimeparse
   ];
 
   nativeCheckInputs = with python3Packages; [
     pytestCheckHook
-    pytest-asyncio
   ];
 
   preCheck = ''
diff --git a/pkgs/applications/emulators/ppsspp/default.nix b/pkgs/applications/emulators/ppsspp/default.nix
index b300dc08268a..e730131ed6ff 100644
--- a/pkgs/applications/emulators/ppsspp/default.nix
+++ b/pkgs/applications/emulators/ppsspp/default.nix
@@ -12,89 +12,92 @@
 , makeWrapper
 , pkg-config
 , python3
-, qtbase ? null
-, qtmultimedia ? null
+, qtbase
+, qtmultimedia
 , snappy
 , vulkan-loader
 , wayland
-, wrapQtAppsHook ? null
+, wrapQtAppsHook
 , zlib
+, enableQt ? false
 , enableVulkan ? true
 , forceWayland ? false
 }:
 
 let
-  enableQt = (qtbase != null);
-  frontend = if enableQt then "Qt" else "SDL and headless";
-  vulkanPath = lib.makeLibraryPath [ vulkan-loader ];
-
   # experimental, see https://github.com/hrydgard/ppsspp/issues/13845
   vulkanWayland = enableVulkan && forceWayland;
 in
-  # Only SDL front end needs to specify whether to use Wayland
-  assert forceWayland -> !enableQt;
-  stdenv.mkDerivation (finalAttrs: {
-    pname = "ppsspp"
-      + lib.optionalString enableQt "-qt"
-      + lib.optionalString (!enableQt) "-sdl"
-      + lib.optionalString forceWayland "-wayland";
-    version = "1.14.4";
+# Only SDL frontend needs to specify whether to use Wayland
+assert forceWayland -> !enableQt;
+stdenv.mkDerivation (self: {
+  pname = "ppsspp"
+          + lib.optionalString enableQt "-qt"
+          + lib.optionalString (!enableQt) "-sdl"
+          + lib.optionalString forceWayland "-wayland";
+  version = "1.14.4";
 
-    src = fetchFromGitHub {
-      owner = "hrydgard";
-      repo = "ppsspp";
-      rev = "v${finalAttrs.version}";
-      fetchSubmodules = true;
-      sha256 = "sha256-7xzhN8JIQD4LZg8sQ8rLNYZrW0nCNBfZFgzoKdoWbKc=";
-    };
+  src = fetchFromGitHub {
+    owner = "hrydgard";
+    repo = "ppsspp";
+    rev = "v${self.version}";
+    fetchSubmodules = true;
+    sha256 = "sha256-7xzhN8JIQD4LZg8sQ8rLNYZrW0nCNBfZFgzoKdoWbKc=";
+  };
 
-    postPatch = ''
-      substituteInPlace git-version.cmake --replace unknown ${finalAttrs.src.rev}
-      substituteInPlace UI/NativeApp.cpp --replace /usr/share $out/share
-    '';
+  postPatch = ''
+    substituteInPlace git-version.cmake --replace unknown ${self.src.rev}
+    substituteInPlace UI/NativeApp.cpp --replace /usr/share $out/share
+  '';
 
-    nativeBuildInputs = [
-      cmake
-      copyDesktopItems
-      makeWrapper
-      pkg-config
-      python3
-      wrapQtAppsHook
-    ];
+  nativeBuildInputs = [
+    cmake
+    copyDesktopItems
+    makeWrapper
+    pkg-config
+    python3
+  ] ++ lib.optional enableQt wrapQtAppsHook;
 
-    buildInputs = [
-      SDL2
-      ffmpeg
-      (glew.override { enableEGL = forceWayland; })
-      libzip
-      qtbase
-      qtmultimedia
-      snappy
-      zlib
-    ] ++ lib.optional enableVulkan vulkan-loader
-      ++ lib.optionals vulkanWayland [ wayland libffi ];
+  buildInputs = [
+    SDL2
+    ffmpeg
+    (glew.override { enableEGL = forceWayland; })
+    libzip
+    snappy
+    zlib
+  ] ++ lib.optionals enableQt [
+    qtbase
+    qtmultimedia
+  ] ++ lib.optional enableVulkan vulkan-loader
+  ++ lib.optionals vulkanWayland [ wayland libffi ];
 
-    cmakeFlags = [
-      "-DHEADLESS=${if enableQt then "OFF" else "ON"}"
-      "-DOpenGL_GL_PREFERENCE=GLVND"
-      "-DUSE_SYSTEM_FFMPEG=ON"
-      "-DUSE_SYSTEM_LIBZIP=ON"
-      "-DUSE_SYSTEM_SNAPPY=ON"
-      "-DUSE_WAYLAND_WSI=${if vulkanWayland then "ON" else "OFF"}"
-      "-DUSING_QT_UI=${if enableQt then "ON" else "OFF"}"
-    ];
+  cmakeFlags = [
+    "-DHEADLESS=${if enableQt then "OFF" else "ON"}"
+    "-DOpenGL_GL_PREFERENCE=GLVND"
+    "-DUSE_SYSTEM_FFMPEG=ON"
+    "-DUSE_SYSTEM_LIBZIP=ON"
+    "-DUSE_SYSTEM_SNAPPY=ON"
+    "-DUSE_WAYLAND_WSI=${if vulkanWayland then "ON" else "OFF"}"
+    "-DUSING_QT_UI=${if enableQt then "ON" else "OFF"}"
+  ];
 
-    desktopItems = [(makeDesktopItem {
+  desktopItems = [
+    (makeDesktopItem {
       desktopName = "PPSSPP";
       name = "ppsspp";
       exec = "ppsspp";
       icon = "ppsspp";
       comment = "Play PSP games on your computer";
       categories = [ "Game" "Emulator" ];
-    })];
+    })
+  ];
 
-    installPhase = ''
+  installPhase = let
+    vulkanPath = lib.makeLibraryPath [ vulkan-loader ];
+  in
+    ''
       runHook preInstall
+
       mkdir -p $out/share/{applications,ppsspp}
     '' + (if enableQt then ''
       install -Dm555 PPSSPPQt $out/bin/ppsspp
@@ -108,14 +111,16 @@ in
         --prefix LD_LIBRARY_PATH : ${vulkanPath} \
     '' + "\n" + ''
       mv assets $out/share/ppsspp
+
       runHook postInstall
     '';
 
-    meta = with lib; {
-      homepage = "https://www.ppsspp.org/";
-      description = "A HLE Playstation Portable emulator, written in C++ (${frontend})";
-      license = licenses.gpl2Plus;
-      maintainers = with maintainers; [ AndersonTorres ];
-      platforms = platforms.linux;
-    };
-  })
+  meta = with lib; {
+    homepage = "https://www.ppsspp.org/";
+    description = "A HLE Playstation Portable emulator, written in C++ ("
+                  ++ (if enableQt then "Qt" else "SDL + headless") ++ ")";
+    license = lib.licenses.gpl2Plus;
+    maintainers = [ lib.maintainers.AndersonTorres ];
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/applications/graphics/sane/xsane.nix b/pkgs/applications/graphics/sane/xsane.nix
index 007483fb5e26..cd64c7b8d44e 100644
--- a/pkgs/applications/graphics/sane/xsane.nix
+++ b/pkgs/applications/graphics/sane/xsane.nix
@@ -1,6 +1,6 @@
 { lib
 , stdenv
-, fetchurl
+, fetchFromGitLab
 , sane-backends
 , sane-frontends
 , libX11
@@ -10,15 +10,19 @@
 , libusb-compat-0_1
 , gimpSupport ? false
 , gimp
+, nix-update-script
 }:
 
 stdenv.mkDerivation rec {
   pname = "xsane";
   version = "0.999";
 
-  src = fetchurl {
-    url = "http://www.xsane.org/download/xsane-${version}.tar.gz";
-    sha256 = "0jrb918sfb9jw3vmrz0z7np4q55hgsqqffpixs0ir5nwcwzd50jp";
+  src = fetchFromGitLab {
+    owner = "frontend";
+    group = "sane-project";
+    repo = pname;
+    rev = version;
+    hash = "sha256-oOg94nUsT9LLKnHocY0S5g02Y9a1UazzZAjpEI/s+yM=";
   };
 
   preConfigure = ''
@@ -31,11 +35,13 @@ stdenv.mkDerivation rec {
   buildInputs = [ libpng libusb-compat-0_1 sane-backends sane-frontends libX11 gtk2 ]
     ++ lib.optional gimpSupport gimp;
 
+  passthru.updateScript = nix-update-script { };
+
   meta = with lib; {
     homepage = "http://www.sane-project.org/";
     description = "Graphical scanning frontend for sane";
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ melling ];
   };
 }
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index cbdbd5327dbe..2e9a94e3b33c 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -84,13 +84,13 @@
     "vendorHash": "sha256-99PwwxVHfRGC0QCQGhifRzqWFOHZ1R7Ge2ou7OjiggQ="
   },
   "auth0": {
-    "hash": "sha256-BlMYx6Ockk8YpiA0wCu2tBwhUIznFJ9b4knSeKA6M/g=",
+    "hash": "sha256-3iB/Vcv6Vzs9teulhu0npl6IuIJRsKy8FkBcIPTKw8A=",
     "homepage": "https://registry.terraform.io/providers/auth0/auth0",
     "owner": "auth0",
     "repo": "terraform-provider-auth0",
-    "rev": "v0.42.0",
+    "rev": "v0.43.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-OhtomdRIjKxELnSQGbZvrHAE1ag4VAyuSOMrZvZ5q0s="
+    "vendorHash": "sha256-pRbhgukYRn0Ej0v/ANKZ3gtkmfL8qo1E6F/fKDNf/Iw="
   },
   "avi": {
     "hash": "sha256-0FcdVd7EGVHZ0iRonoGfjwYgXpJtUhqX5i925Ejhv54=",
@@ -158,11 +158,11 @@
     "vendorHash": "sha256-3PLBs8LSE5JPtrhmdx+jQsnCrfZQQEUGA7wnf9M72yY="
   },
   "bigip": {
-    "hash": "sha256-VntKiBTQxe8lKV8Bb3A0moA/EUzyQQ7CInPjKJL4iBQ=",
+    "hash": "sha256-nlk3ckrLNtPQ9s8uQ2jvARinPVF+A2T0IUY2rBcUFDk=",
     "homepage": "https://registry.terraform.io/providers/F5Networks/bigip",
     "owner": "F5Networks",
     "repo": "terraform-provider-bigip",
-    "rev": "v1.16.1",
+    "rev": "v1.16.2",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -304,11 +304,11 @@
     "vendorHash": "sha256-BpXhKjfxyCLdGRHn1GexW0MoLj4/C6Bn7scZ76JARxQ="
   },
   "digitalocean": {
-    "hash": "sha256-l/p2HStjvxF6UB1SnY3EoGjC/3t5FdlC6LMk7jn11KI=",
+    "hash": "sha256-ZTt/lfHWD9G/SbZ7mLKPjJAsva5bgRqvvX8Lh1Ci+ts=",
     "homepage": "https://registry.terraform.io/providers/digitalocean/digitalocean",
     "owner": "digitalocean",
     "repo": "terraform-provider-digitalocean",
-    "rev": "v2.25.2",
+    "rev": "v2.26.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -368,11 +368,11 @@
     "vendorHash": "sha256-NLvw606QxUwCDViLbR5LjoWGZnk48/zG0NownEATYKM="
   },
   "exoscale": {
-    "hash": "sha256-F1tYiEy9eQ7GcgVPNfe6Jy6hXEWdFHGXA6esAnOgiQE=",
+    "hash": "sha256-48msmXj7SFmi5TA0/QYm66oIETymWi5ayF+yExyp+hk=",
     "homepage": "https://registry.terraform.io/providers/exoscale/exoscale",
     "owner": "exoscale",
     "repo": "terraform-provider-exoscale",
-    "rev": "v0.43.0",
+    "rev": "v0.44.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -1014,11 +1014,11 @@
     "vendorHash": "sha256-MIO0VHofPtKPtynbvjvEukMNr5NXHgk7BqwIhbc9+u0="
   },
   "signalfx": {
-    "hash": "sha256-UgZr2ZFN5RvB7BG+DIXK6eSvTyvaVUKoBTIQ6aAfCpY=",
+    "hash": "sha256-9cGF/uyC/sqCx7Y9aEawkKVJvHE8siGgWRWWf4ok3B0=",
     "homepage": "https://registry.terraform.io/providers/splunk-terraform/signalfx",
     "owner": "splunk-terraform",
     "repo": "terraform-provider-signalfx",
-    "rev": "v6.21.0",
+    "rev": "v6.22.0",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-Iue8P14x8P0lMa85goSF1D5mEeXw6dH1atJQhgbnZ6Y="
   },
@@ -1032,11 +1032,11 @@
     "vendorHash": null
   },
   "snowflake": {
-    "hash": "sha256-0nofzwxzf19T9klfzp+h3icyN4S92nPfq/HN+qaHK/E=",
+    "hash": "sha256-cy/rolY0Ag/8Vbfs7XERIZxUsF65sap5/EHqU2w44bM=",
     "homepage": "https://registry.terraform.io/providers/Snowflake-Labs/snowflake",
     "owner": "Snowflake-Labs",
     "repo": "terraform-provider-snowflake",
-    "rev": "v0.56.0",
+    "rev": "v0.56.1",
     "spdx": "MIT",
     "vendorHash": "sha256-ulgTRY8qQ5oXONkwYtffRl1QMNnbvyn0zYiYqqvwrUU="
   },
@@ -1104,13 +1104,13 @@
     "vendorHash": null
   },
   "tfe": {
-    "hash": "sha256-YhsAKyD3YYYWfxIHcAgMxdQc//0WQvXTsa+fVhSCG6U=",
+    "hash": "sha256-eFyRa4T+CqIeOcEYj4DQP6ypR7AROYrGDYuYSqBfKr0=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/tfe",
     "owner": "hashicorp",
     "repo": "terraform-provider-tfe",
-    "rev": "v0.41.0",
+    "rev": "v0.42.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-LgCS7W6mGGlX4vEhlPYL+Wo/urHv7aiopXWEBoEyL1c="
+    "vendorHash": "sha256-bhAoNJSbrpAzw0qCKIm84h6tFqUWT0JeBs1gJpPeJdU="
   },
   "thunder": {
     "hash": "sha256-fXvwBOIW3/76V3O9t25wff0oGViqSaSB2VgMdItXyn4=",
@@ -1250,13 +1250,13 @@
     "vendorHash": "sha256-ib1Esx2AO7b9S+v+zzuATgSVHI3HVwbzEeyqhpBz1BQ="
   },
   "yandex": {
-    "hash": "sha256-g3BdCQKBuxrTn/sScJtRMyL2EoiOF5MpMXMM6I++dEg=",
+    "hash": "sha256-aBWcxC6mHM/3GOjnN/Qi0DNoZjehh5i3C2+XRZ2Igdo=",
     "homepage": "https://registry.terraform.io/providers/yandex-cloud/yandex",
     "owner": "yandex-cloud",
     "proxyVendor": true,
     "repo": "terraform-provider-yandex",
-    "rev": "v0.84.0",
+    "rev": "v0.85.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-q9Rs2yJtI7MVqBcd9wwtyqR9PzmVkhKatbRRZwFm3po="
+    "vendorHash": "sha256-eLCFnBGAvH0ZEzOb5xVCY0Yy4U5V407AhpGSFpa9t7I="
   }
 }
diff --git a/pkgs/applications/networking/instant-messengers/dino/default.nix b/pkgs/applications/networking/instant-messengers/dino/default.nix
index 72e546286bf5..5a65b43a8acb 100644
--- a/pkgs/applications/networking/instant-messengers/dino/default.nix
+++ b/pkgs/applications/networking/instant-messengers/dino/default.nix
@@ -75,6 +75,9 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = ["-DBUILD_TESTS=yes"];
 
+  # Undefined symbols for architecture arm64: "_gpg_strerror"
+  NIX_LDFLAGS = lib.optionalString stdenv.isDarwin "-lgpg-error";
+
   doCheck = true;
   checkPhase = ''
     runHook preCheck
diff --git a/pkgs/applications/networking/instant-messengers/rambox/default.nix b/pkgs/applications/networking/instant-messengers/rambox/default.nix
index e97b6c5b3ffb..04c2fa27e559 100644
--- a/pkgs/applications/networking/instant-messengers/rambox/default.nix
+++ b/pkgs/applications/networking/instant-messengers/rambox/default.nix
@@ -2,11 +2,11 @@
 
 let
   pname = "rambox";
-  version = "2.0.9";
+  version = "2.0.10";
 
   src = fetchurl {
     url = "https://github.com/ramboxapp/download/releases/download/v${version}/Rambox-${version}-linux-x64.AppImage";
-    sha256 = "sha256-o2ydZodmMAYeU0IiczKNlzY2hgTJbzyJWO/cZSTfAuM=";
+    sha256 = "sha256-NvsrWkdINrQV7V9SLfjtlN+obgQb0u8d/QgjGpZ+fpc=";
   };
 
   desktopItem = (makeDesktopItem {
diff --git a/pkgs/applications/networking/nextdns/default.nix b/pkgs/applications/networking/nextdns/default.nix
index b6f93ede05ee..c17c65e14fe2 100644
--- a/pkgs/applications/networking/nextdns/default.nix
+++ b/pkgs/applications/networking/nextdns/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "nextdns";
-  version = "1.38.0";
+  version = "1.39.4";
 
   src = fetchFromGitHub {
     owner = "nextdns";
     repo = "nextdns";
     rev = "v${version}";
-    sha256 = "sha256-dJ/3MBEsA8M4pfE+GPT/bNnK3n4fL3Hwk0umgMTJAfY=";
+    sha256 = "sha256-7inMloKU/AL4s/p171xCzs4p4+AcLsvsbVsELK9vhFc=";
   };
 
-  vendorSha256 = "sha256-pCta8FzGVpl9fvnnjQ7/e2x/HolXAuxnz0vwKejGk98=";
+  vendorHash = "sha256-pCta8FzGVpl9fvnnjQ7/e2x/HolXAuxnz0vwKejGk98=";
 
   ldflags = [ "-s" "-w" "-X main.version=${version}" ];
 
diff --git a/pkgs/applications/office/gnumeric/default.nix b/pkgs/applications/office/gnumeric/default.nix
index e93be60741bb..1fbb9b7cbd97 100644
--- a/pkgs/applications/office/gnumeric/default.nix
+++ b/pkgs/applications/office/gnumeric/default.nix
@@ -7,11 +7,11 @@ let
   inherit (python3Packages) python pygobject3;
 in stdenv.mkDerivation rec {
   pname = "gnumeric";
-  version = "1.12.53";
+  version = "1.12.54";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "VWjkyNzqu5Ao8TYdEEVSL5Xwpx2qWelzy90tObrdTwI=";
+    sha256 = "RpBAYv0cSkyTWW0mv2eTLNcvwPjSxaZ8F5GFJ/7oK3Q=";
   };
 
   configureFlags = [ "--disable-component" ];
diff --git a/pkgs/applications/virtualization/docker/default.nix b/pkgs/applications/virtualization/docker/default.nix
index 5027a8fd5c91..1aa5071938a8 100644
--- a/pkgs/applications/virtualization/docker/default.nix
+++ b/pkgs/applications/virtualization/docker/default.nix
@@ -2,11 +2,12 @@
 
 rec {
   dockerGen = {
-      version, rev, sha256
-      , moby-src
-      , runcRev, runcSha256
-      , containerdRev, containerdSha256
-      , tiniRev, tiniSha256, buildxSupport ? true, composeSupport ? true
+      version
+      , cliRev, cliHash
+      , mobyRev, mobyHash
+      , runcRev, runcHash
+      , containerdRev, containerdHash
+      , tiniRev, tiniHash, buildxSupport ? true, composeSupport ? true
       # package dependencies
       , stdenv, fetchFromGitHub, fetchpatch, buildGoPackage
       , makeWrapper, installShellFiles, pkg-config, glibc
@@ -29,7 +30,7 @@ rec {
         owner = "opencontainers";
         repo = "runc";
         rev = runcRev;
-        sha256 = runcSha256;
+        hash = runcHash;
       };
 
       # docker/runc already include these patches / are not applicable
@@ -44,7 +45,7 @@ rec {
         owner = "containerd";
         repo = "containerd";
         rev = containerdRev;
-        sha256 = containerdSha256;
+        hash = containerdHash;
       };
 
       buildInputs = oldAttrs.buildInputs
@@ -59,7 +60,7 @@ rec {
         owner = "krallin";
         repo = "tini";
         rev = tiniRev;
-        sha256 = tiniSha256;
+        hash = tiniHash;
       };
 
       # Do not remove static from make files as we want a static binary
@@ -70,6 +71,13 @@ rec {
       NIX_CFLAGS_COMPILE = "-DMINIMAL=ON";
     });
 
+    moby-src = fetchFromGitHub {
+      owner = "moby";
+      repo = "moby";
+      rev = mobyRev;
+      hash = mobyHash;
+    };
+
     moby = buildGoPackage (lib.optionalAttrs stdenv.isLinux rec {
       pname = "moby";
       inherit version;
@@ -95,7 +103,7 @@ rec {
         (fetchpatch {
           name = "buildkit-zfs.patch";
           url = "https://github.com/moby/moby/pull/43136.patch";
-          sha256 = "1WZfpVnnqFwLMYqaHLploOodls0gHF8OCp7MrM26iX8=";
+          hash = "sha256-1WZfpVnnqFwLMYqaHLploOodls0gHF8OCp7MrM26iX8=";
         })
       ];
 
@@ -108,7 +116,7 @@ rec {
         # build engine
         cd ./go/src/${goPackagePath}
         export AUTO_GOPATH=1
-        export DOCKER_GITCOMMIT="${rev}"
+        export DOCKER_GITCOMMIT="${cliRev}"
         export VERSION="${version}"
         ./hack/make.sh dynbinary
         cd -
@@ -159,8 +167,8 @@ rec {
     src = fetchFromGitHub {
       owner = "docker";
       repo = "cli";
-      rev = "v${version}";
-      sha256 = sha256;
+      rev = cliRev;
+      hash = cliHash;
     };
 
     goPackagePath = "github.com/docker/cli";
@@ -192,7 +200,7 @@ rec {
       mkdir -p .gopath/src/github.com/docker/
       ln -sf $PWD .gopath/src/github.com/docker/cli
       export GOPATH="$PWD/.gopath:$GOPATH"
-      export GITCOMMIT="${rev}"
+      export GITCOMMIT="${cliRev}"
       export VERSION="${version}"
       export BUILDTIME="1970-01-01T00:00:00Z"
       source ./scripts/build/.variables
@@ -254,20 +262,16 @@ rec {
   # Get revisions from
   # https://github.com/moby/moby/tree/${version}/hack/dockerfile/install/*
   docker_20_10 = callPackage dockerGen rec {
-    version = "20.10.21";
-    rev = "v${version}";
-    sha256 = "sha256-hPQ1t7L2fqoFWoinqIrDwFQ1bo9TzMb4l3HmAotIUS8=";
-    moby-src = fetchFromGitHub {
-      owner = "moby";
-      repo = "moby";
-      rev = "v${version}";
-      sha256 = "sha256-BcYDh/UEmmURt7hWLWdPTKVu/Nzoeq/shE+HnUoh8b4=";
-    };
+    version = "20.10.23";
+    cliRev = "v${version}";
+    cliHash = "sha256-fNaRpstyG90Jzq3+U2A42Jj+ixb+m7tXLioIcsegPbQ=";
+    mobyRev = "v${version}";
+    mobyHash = "sha256-nBPw/M4VC9XeZ9S33HWdWSjY2J2mYpI/TPOzvLjSmJM=";
     runcRev = "v1.1.4";
-    runcSha256 = "sha256-ougJHW1Z+qZ324P8WpZqawY1QofKnn8WezP7orzRTdA=";
-    containerdRev = "v1.6.9";
-    containerdSha256 = "sha256-KvQdYQLzgt/MKPsA/mO5un6nE3/xcvVYwIveNn/uDnU=";
+    runcHash = "sha256-ougJHW1Z+qZ324P8WpZqawY1QofKnn8WezP7orzRTdA=";
+    containerdRev = "v1.6.15";
+    containerdHash = "sha256-Vlftq//mLYZPoT2R/lHJA6wLnqiuC+Cpy4lGQC8jCPA=";
     tiniRev = "v0.19.0";
-    tiniSha256 = "sha256-ZDKu/8yE5G0RYFJdhgmCdN3obJNyRWv6K/Gd17zc1sI=";
+    tiniHash = "sha256-ZDKu/8yE5G0RYFJdhgmCdN3obJNyRWv6K/Gd17zc1sI=";
   };
 }
diff --git a/pkgs/build-support/rust/build-rust-crate/configure-crate.nix b/pkgs/build-support/rust/build-rust-crate/configure-crate.nix
index 1c946764c758..5168eb6ab759 100644
--- a/pkgs/build-support/rust/build-rust-crate/configure-crate.nix
+++ b/pkgs/build-support/rust/build-rust-crate/configure-crate.nix
@@ -130,7 +130,7 @@ in ''
   export CARGO_CFG_UNIX=1
   export CARGO_CFG_TARGET_ENV="gnu"
   export CARGO_CFG_TARGET_ENDIAN=${if stdenv.hostPlatform.parsed.cpu.significantByte.name == "littleEndian" then "little" else "big"}
-  export CARGO_CFG_TARGET_POINTER_WIDTH=${toString stdenv.hostPlatform.parsed.cpu.bits}
+  export CARGO_CFG_TARGET_POINTER_WIDTH=${with stdenv.hostPlatform; toString (if isILP32 then 32 else parsed.cpu.bits)}
   export CARGO_CFG_TARGET_VENDOR=${stdenv.hostPlatform.parsed.vendor.name}
 
   export CARGO_MANIFEST_DIR=$(pwd)
diff --git a/pkgs/desktops/deepin/artwork/dde-account-faces/default.nix b/pkgs/desktops/deepin/artwork/dde-account-faces/default.nix
new file mode 100644
index 000000000000..91438a043c0a
--- /dev/null
+++ b/pkgs/desktops/deepin/artwork/dde-account-faces/default.nix
@@ -0,0 +1,26 @@
+{ stdenvNoCC
+, lib
+, fetchFromGitHub
+}:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "dde-account-faces";
+  version = "1.0.12.1";
+
+  src = fetchFromGitHub {
+    owner = "linuxdeepin";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-NWjR8qxWi2IrcP0cSF+lLxBJ/GrVpk1BfTjVH0ytinY=";
+  };
+
+  makeFlags = [ "PREFIX=${placeholder "out"}/var" ];
+
+  meta = with lib; {
+    description = "Account faces of deepin desktop environment";
+    homepage = "https://github.com/linuxdeepin/dde-account-faces";
+    license = with licenses; [ gpl3Plus cc0 ];
+    platforms = platforms.linux;
+    maintainers = teams.deepin.members;
+  };
+}
diff --git a/pkgs/desktops/deepin/artwork/deepin-gtk-theme/default.nix b/pkgs/desktops/deepin/artwork/deepin-gtk-theme/default.nix
new file mode 100644
index 000000000000..3864989196f3
--- /dev/null
+++ b/pkgs/desktops/deepin/artwork/deepin-gtk-theme/default.nix
@@ -0,0 +1,31 @@
+{ stdenvNoCC
+, lib
+, fetchFromGitHub
+, gtk-engine-murrine
+}:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "deepin-gtk-theme";
+  version = "unstable-2022-07-26";
+
+  src = fetchFromGitHub {
+    owner = "linuxdeepin";
+    repo = "deepin-gtk-theme";
+    rev = "5ac53cbdfba4e6804451605db726876a3be9fb07";
+    sha256 = "sha256-NJ5URKYs4rVzddXxkwJK9ih40f8McVEbj3G1tPFAiMs";
+  };
+
+  propagatedUserEnvPkgs = [
+    gtk-engine-murrine
+  ];
+
+  makeFlags = [ "PREFIX=${placeholder "out"}" ];
+
+  meta = with lib; {
+    description = "Deepin GTK Theme";
+    homepage = "https://github.com/linuxdeepin/deepin-gtk-theme";
+    license = licenses.gpl3Plus;
+    platforms = platforms.unix;
+    maintainers = teams.deepin.members;
+  };
+}
diff --git a/pkgs/desktops/deepin/artwork/deepin-icon-theme/default.nix b/pkgs/desktops/deepin/artwork/deepin-icon-theme/default.nix
new file mode 100644
index 000000000000..0cda82fdfcf2
--- /dev/null
+++ b/pkgs/desktops/deepin/artwork/deepin-icon-theme/default.nix
@@ -0,0 +1,46 @@
+{ stdenvNoCC
+, lib
+, fetchFromGitHub
+, gtk3
+, xcursorgen
+, papirus-icon-theme
+}:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "deepin-icon-theme";
+  version = "2021.11.24";
+
+  src = fetchFromGitHub {
+    owner = "linuxdeepin";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-UC3PbqolcCbVrIEDqMovfJ4oeofMUGJag1A6u7X3Ml8=";
+  };
+
+  makeFlags = [ "PREFIX=${placeholder "out"}" ];
+
+  nativeBuildInputs = [
+    gtk3
+    xcursorgen
+  ];
+
+  propagatedBuildInputs = [
+    papirus-icon-theme
+  ];
+
+  dontDropIconThemeCache = true;
+
+  postFixup = ''
+    for theme in $out/share/icons/*; do
+      gtk-update-icon-cache $theme
+    done
+  '';
+
+  meta = with lib; {
+    description = "Deepin Icon Theme provides the base icon themes on Deepin";
+    homepage = "https://github.com/linuxdeepin/deepin-icon-theme";
+    license = licenses.gpl3Plus;
+    platforms = platforms.linux;
+    maintainers = teams.deepin.members;
+  };
+}
diff --git a/pkgs/desktops/deepin/artwork/deepin-sound-theme/default.nix b/pkgs/desktops/deepin/artwork/deepin-sound-theme/default.nix
new file mode 100644
index 000000000000..f311339b6be0
--- /dev/null
+++ b/pkgs/desktops/deepin/artwork/deepin-sound-theme/default.nix
@@ -0,0 +1,26 @@
+{ stdenvNoCC
+, lib
+, fetchFromGitHub
+}:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "deepin-sound-theme";
+  version = "15.10.6";
+
+  src = fetchFromGitHub {
+    owner = "linuxdeepin";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-BvG/ygZfM6sDuDSzAqwCzDXGT/bbA6Srlpg3br117OU=";
+  };
+
+  makeFlags = [ "PREFIX=${placeholder "out"}" ];
+
+  meta = with lib; {
+    description = "The freedesktop sound theme for Deepin";
+    homepage = "https://github.com/linuxdeepin/deepin-sound-theme";
+    license = licenses.gpl3Plus;
+    platforms = platforms.linux;
+    maintainers = teams.deepin.members;
+  };
+}
diff --git a/pkgs/desktops/deepin/default.nix b/pkgs/desktops/deepin/default.nix
index 037cfaa3f33d..436f06ae5ae0 100644
--- a/pkgs/desktops/deepin/default.nix
+++ b/pkgs/desktops/deepin/default.nix
@@ -22,6 +22,12 @@ let
 
     #### Dtk Application
     deepin-calculator = callPackage ./apps/deepin-calculator { };
+
+    #### ARTWORK
+    dde-account-faces = callPackage ./artwork/dde-account-faces { };
+    deepin-icon-theme = callPackage ./artwork/deepin-icon-theme { };
+    deepin-gtk-theme = callPackage ./artwork/deepin-gtk-theme { };
+    deepin-sound-theme = callPackage ./artwork/deepin-sound-theme { };
   };
 in
 lib.makeScope libsForQt5.newScope packages
diff --git a/pkgs/desktops/xfce/applications/xfce4-taskmanager/default.nix b/pkgs/desktops/xfce/applications/xfce4-taskmanager/default.nix
index 9bbc524eab0f..4eb6786ffddc 100644
--- a/pkgs/desktops/xfce/applications/xfce4-taskmanager/default.nix
+++ b/pkgs/desktops/xfce/applications/xfce4-taskmanager/default.nix
@@ -1,14 +1,32 @@
-{ lib, mkXfceDerivation, exo, gtk3, libxfce4ui, xfconf, libwnck, libXmu }:
+{ lib
+, mkXfceDerivation
+, exo
+, gtk3
+, libxfce4ui
+, xfconf
+, libwnck
+, libXmu
+}:
 
 mkXfceDerivation {
   category = "apps";
   pname = "xfce4-taskmanager";
   version = "1.5.5";
+  odd-unstable = false;
 
   sha256 = "sha256-worHYB9qibRxMaCYQ0+nHA9CSTColewgahyrXiPOnQA=";
 
-  nativeBuildInputs = [ exo ];
-  buildInputs = [ gtk3 libxfce4ui xfconf libwnck libXmu ];
+  nativeBuildInputs = [
+    exo
+  ];
+
+  buildInputs = [
+    gtk3
+    libxfce4ui
+    xfconf
+    libwnck
+    libXmu
+  ];
 
   meta = with lib; {
     description = "Easy to use task manager for Xfce";
diff --git a/pkgs/desktops/xfce/core/libxfce4util/default.nix b/pkgs/desktops/xfce/core/libxfce4util/default.nix
index a2bdee37eb69..efc917ab1f28 100644
--- a/pkgs/desktops/xfce/core/libxfce4util/default.nix
+++ b/pkgs/desktops/xfce/core/libxfce4util/default.nix
@@ -3,9 +3,9 @@
 mkXfceDerivation {
   category = "xfce";
   pname = "libxfce4util";
-  version = "4.18.0";
+  version = "4.18.1";
 
-  sha256 = "sha256-m4O/vTFqzkF6rzyGVw8xdwcX7S/SyOSJo8aCZjniXAw=";
+  sha256 = "sha256-nqASXyHR7wNiNPorlz2ix+Otyir6I9KCCr1vfS6GO8E=";
 
   nativeBuildInputs = [ gobject-introspection vala ];
 
diff --git a/pkgs/desktops/xfce/core/thunar/default.nix b/pkgs/desktops/xfce/core/thunar/default.nix
index c64a69603186..f4dfebb422f7 100644
--- a/pkgs/desktops/xfce/core/thunar/default.nix
+++ b/pkgs/desktops/xfce/core/thunar/default.nix
@@ -21,9 +21,9 @@
 let unwrapped = mkXfceDerivation {
   category = "xfce";
   pname = "thunar";
-  version = "4.18.1";
+  version = "4.18.3";
 
-  sha256 = "sha256-n624TZGygFrOjkQ9fUVJUetRV8JDXYSg89tOHm4Va+M=";
+  sha256 = "sha256-sYn1gBzqEFcB3jHWxmoqqv0Cxa3mui/j0kgBqJMgJrc=";
 
   nativeBuildInputs = [
     docbook_xsl
diff --git a/pkgs/desktops/xfce/core/xfce4-panel/default.nix b/pkgs/desktops/xfce/core/xfce4-panel/default.nix
index d76523a94c3c..155e3124207c 100644
--- a/pkgs/desktops/xfce/core/xfce4-panel/default.nix
+++ b/pkgs/desktops/xfce/core/xfce4-panel/default.nix
@@ -2,7 +2,6 @@
 , mkXfceDerivation
 , exo
 , garcon
-, glib
 , gobject-introspection
 , gtk3
 , libdbusmenu-gtk3
@@ -17,9 +16,9 @@
 mkXfceDerivation {
   category = "xfce";
   pname = "xfce4-panel";
-  version = "4.18.0";
+  version = "4.18.1";
 
-  sha256 = "sha256-CnZk0Ca3IG6nmiwe7eIvPqpzJgRZHIyqeoTA5cPpU7s=";
+  sha256 = "sha256-5GJO8buOTnRGnm3+kesrZjTprCY1qiyookpW6dzI2AE=";
 
   nativeBuildInputs = [
     gobject-introspection
@@ -37,7 +36,6 @@ mkXfceDerivation {
   ];
 
   propagatedBuildInputs = [
-    glib
     gtk3
     libxfce4util
   ];
@@ -49,9 +47,6 @@ mkXfceDerivation {
        --replace "/usr/share/zoneinfo" "${tzdata}/share/zoneinfo"
   '';
 
-  # Workaround https://bugzilla.xfce.org/show_bug.cgi?id=15825
-  NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
-
   meta = with lib; {
     description = "Panel for the Xfce desktop environment";
     maintainers = with maintainers; [ ] ++ teams.xfce.members;
diff --git a/pkgs/desktops/xfce/core/xfdesktop/default.nix b/pkgs/desktops/xfce/core/xfdesktop/default.nix
index 7d6774165799..ed36d2b92b73 100644
--- a/pkgs/desktops/xfce/core/xfdesktop/default.nix
+++ b/pkgs/desktops/xfce/core/xfdesktop/default.nix
@@ -3,9 +3,9 @@
 mkXfceDerivation {
   category = "xfce";
   pname = "xfdesktop";
-  version = "4.18.0";
+  version = "4.18.1";
 
-  sha256 = "sha256-HZVu5UVLKDCWaUpw1SV8E0JLGRG946w4QLlA51rg/Bo=";
+  sha256 = "sha256-33G7X5kA3MCNJ9Aq9ZCafP0Qm/46iUmLFB8clhKwDz8=";
 
   buildInputs = [
     exo
diff --git a/pkgs/desktops/xfce/panel-plugins/xfce4-datetime-plugin/default.nix b/pkgs/desktops/xfce/panel-plugins/xfce4-datetime-plugin/default.nix
index 5202f7f54c24..eaf090c348cf 100644
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-datetime-plugin/default.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-datetime-plugin/default.nix
@@ -9,10 +9,10 @@
 mkXfceDerivation {
   category = "panel-plugins";
   pname = "xfce4-datetime-plugin";
-  version = "0.8.2";
+  version = "0.8.3";
 
   rev-prefix = "xfce4-datetime-plugin-";
-  sha256 = "sha256-ov4Wh9Pj01u0NrjDn5p+qXlD2LY3gEUC1e/jPjkn4xQ=";
+  sha256 = "sha256-dpN5ZN7VjgO1GQ6v8NXuBKACyIwIosaiVGtmLEb6auI=";
 
   nativeBuildInputs = [
     gettext
diff --git a/pkgs/desktops/xfce/panel-plugins/xfce4-whiskermenu-plugin/default.nix b/pkgs/desktops/xfce/panel-plugins/xfce4-whiskermenu-plugin/default.nix
index 0dc3d3a81aa6..a1027c752ddd 100644
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-whiskermenu-plugin/default.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-whiskermenu-plugin/default.nix
@@ -3,10 +3,10 @@
 mkXfceDerivation {
   category = "panel-plugins";
   pname = "xfce4-whiskermenu-plugin";
-  version = "2.7.1";
+  version = "2.7.2";
   rev-prefix = "v";
   odd-unstable = false;
-  sha256 = "sha256-aN8PwH5YIbjiyS5tTcU2AU4LAYC2tBStDxhCXi/dvkQ=";
+  sha256 = "sha256-yp8NpBVgqEv34qmDMKPdy53awgSLtYfeaw1JrxENFps=";
 
   nativeBuildInputs = [ cmake ];
 
diff --git a/pkgs/development/compilers/zig/0.10.nix b/pkgs/development/compilers/zig/0.10.nix
new file mode 100644
index 000000000000..89f23b9ca25d
--- /dev/null
+++ b/pkgs/development/compilers/zig/0.10.nix
@@ -0,0 +1,69 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, coreutils
+, llvmPackages
+, libxml2
+, zlib
+}:
+
+stdenv.mkDerivation rec {
+  pname = "zig";
+  version = "0.10.1";
+
+  src = fetchFromGitHub {
+    owner = "ziglang";
+    repo = pname;
+    rev = version;
+    hash = "sha256-69QIkkKzApOGfrBdgtmxFMDytRkSh+0YiaJQPbXsBeo=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    llvmPackages.llvm.dev
+  ];
+
+  buildInputs = [
+    coreutils
+    libxml2
+    zlib
+  ] ++ (with llvmPackages; [
+    libclang
+    lld
+    llvm
+  ]);
+
+  preBuild = ''
+    export HOME=$TMPDIR;
+  '';
+
+  postPatch = ''
+    # Zig's build looks at /usr/bin/env to find dynamic linking info. This
+    # doesn't work in Nix' sandbox. Use env from our coreutils instead.
+    substituteInPlace lib/std/zig/system/NativeTargetInfo.zig --replace "/usr/bin/env" "${coreutils}/bin/env"
+  '';
+
+  cmakeFlags = [
+    # file RPATH_CHANGE could not write new RPATH
+    "-DCMAKE_SKIP_BUILD_RPATH=ON"
+  ];
+
+  doCheck = true;
+  installCheckPhase = ''
+    $out/bin/zig test --cache-dir "$TMPDIR" -I $src/test $src/test/behavior.zig
+  '';
+
+  meta = with lib; {
+    homepage = "https://ziglang.org/";
+    description =
+      "General-purpose programming language and toolchain for maintaining robust, optimal, and reusable software";
+    license = licenses.mit;
+    maintainers = with maintainers; [ aiotter andrewrk AndersonTorres ];
+    platforms = platforms.unix;
+    # Build fails on Darwin on both AArch64 and x86_64:
+    # https://github.com/NixOS/nixpkgs/pull/210324#issuecomment-1381313616
+    # https://github.com/NixOS/nixpkgs/pull/210324#issuecomment-1381236045
+    broken = stdenv.isDarwin;
+  };
+}
diff --git a/pkgs/development/compilers/zig/default.nix b/pkgs/development/compilers/zig/0.9.1.nix
similarity index 100%
rename from pkgs/development/compilers/zig/default.nix
rename to pkgs/development/compilers/zig/0.9.1.nix
diff --git a/pkgs/development/libraries/dqlite/default.nix b/pkgs/development/libraries/dqlite/default.nix
index 331fe93e90de..cb7b7466d053 100644
--- a/pkgs/development/libraries/dqlite/default.nix
+++ b/pkgs/development/libraries/dqlite/default.nix
@@ -1,15 +1,15 @@
 { lib, stdenv, fetchFromGitHub, autoreconfHook, pkg-config, file, libuv
-, raft-canonical, sqlite }:
+, raft-canonical, sqlite, lxd }:
 
 stdenv.mkDerivation rec {
   pname = "dqlite";
-  version = "1.13.0";
+  version = "1.14.0";
 
   src = fetchFromGitHub {
     owner = "canonical";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-KVQa11gw/8h3Be+52V44W2M+fd7sB35emrS/aUEUGl0=";
+    hash = "sha256-x76f9Sw3BMgWSY7DLIqDjbggp/qVu8mJBtf4znTz9hA=";
   };
 
   nativeBuildInputs = [ autoreconfHook file pkg-config ];
@@ -26,6 +26,10 @@ stdenv.mkDerivation rec {
 
   outputs = [ "dev" "out" ];
 
+  passthru.tests = {
+    inherit lxd;
+  };
+
   meta = with lib; {
     description = ''
       Expose a SQLite database over the network and replicate it across a
diff --git a/pkgs/development/libraries/gdcm/default.nix b/pkgs/development/libraries/gdcm/default.nix
index d2182154f711..d21fd2501960 100644
--- a/pkgs/development/libraries/gdcm/default.nix
+++ b/pkgs/development/libraries/gdcm/default.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gdcm";
-  version = "3.0.20";
+  version = "3.0.21";
 
   src = fetchFromGitHub {
     owner = "malaterre";
     repo = "GDCM";
     rev = "v${version}";
-    sha256 = "sha256-MaQk2VlaZxZPNzVF9pUnEzMaXyN0tq2P3kodnGpl6PA=";
+    sha256 = "sha256-BmUJCqCGt+BvVpLG4bzCH4lsqmhWHU0gbOIU2CCIMGU=";
   };
 
   cmakeFlags = [
diff --git a/pkgs/development/libraries/goffice/default.nix b/pkgs/development/libraries/goffice/default.nix
index 9e2585d7ee03..1bd0d69ea6d7 100644
--- a/pkgs/development/libraries/goffice/default.nix
+++ b/pkgs/development/libraries/goffice/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "goffice";
-  version = "0.10.53";
+  version = "0.10.54";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "J/1YeW+qHNTMASDDTqhTFaCJHscfVbxnk8FOzxaKP1c=";
+    sha256 = "WDXNnVPmT3UmLAOZZu/fTYj0Vvyx8IeM5NEIgqUK1aA=";
   };
 
   nativeBuildInputs = [ pkg-config intltool ];
diff --git a/pkgs/development/libraries/raft-canonical/default.nix b/pkgs/development/libraries/raft-canonical/default.nix
index 0fc885033e64..e2dd81b13877 100644
--- a/pkgs/development/libraries/raft-canonical/default.nix
+++ b/pkgs/development/libraries/raft-canonical/default.nix
@@ -1,14 +1,14 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, pkg-config, file, libuv, lz4 }:
+{ lib, stdenv, fetchFromGitHub, autoreconfHook, pkg-config, file, libuv, lz4, lxd }:
 
 stdenv.mkDerivation rec {
   pname = "raft-canonical";
-  version = "0.16.0";
+  version = "0.17.1";
 
   src = fetchFromGitHub {
     owner = "canonical";
     repo = "raft";
     rev = "refs/tags/v${version}";
-    hash = "sha256-qDLAEhknY+BB83OC6tfi7w/ZY/K492J5ZglLNUoBwbc=";
+    hash = "sha256-P6IYl6xcsqXw1ilt6HYw757FL2syy1XePBVGbPAlz6Q=";
   };
 
   nativeBuildInputs = [ autoreconfHook file pkg-config ];
@@ -32,6 +32,10 @@ stdenv.mkDerivation rec {
 
   outputs = [ "dev" "out" ];
 
+  passthru.tests = {
+    inherit lxd;
+  };
+
   meta = with lib; {
     description = ''
       Fully asynchronous C implementation of the Raft consensus protocol
diff --git a/pkgs/development/python-modules/arcam-fmj/default.nix b/pkgs/development/python-modules/arcam-fmj/default.nix
index 2310ef1e6df9..c44126537794 100644
--- a/pkgs/development/python-modules/arcam-fmj/default.nix
+++ b/pkgs/development/python-modules/arcam-fmj/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "arcam-fmj";
-  version = "1.0.1";
+  version = "1.1.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "elupus";
     repo = "arcam_fmj";
     rev = "refs/tags/${version}";
-    hash = "sha256-Lmz701qdqFlXro279AdNx+P1o3Q/Om63jKvy854ogto=";
+    hash = "sha256-oXMoDpb4tg4iYAanTfPzeFp/IQl4bIELCTdM24hM84A=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/minidb/default.nix b/pkgs/development/python-modules/minidb/default.nix
index 16becae6f4f1..8bd0aea36ca4 100644
--- a/pkgs/development/python-modules/minidb/default.nix
+++ b/pkgs/development/python-modules/minidb/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "minidb";
-  version = "2.0.6";
+  version = "2.0.7";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -15,8 +15,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "thp";
     repo = "minidb";
-    rev = version;
-    hash = "sha256-H7W+GBapT9uJgbPlARp4ZLKTN7hZlF/FbNo7rObqDM4=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-0f2usKoHs4NO/Ir8MhyiAVZFYnUkVH5avdh3QdHzY6s=";
   };
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/plugwise/default.nix b/pkgs/development/python-modules/plugwise/default.nix
index 30306842529c..338c18967876 100644
--- a/pkgs/development/python-modules/plugwise/default.nix
+++ b/pkgs/development/python-modules/plugwise/default.nix
@@ -21,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "plugwise";
-  version = "0.27.4";
+  version = "0.27.5";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -30,7 +30,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = "python-plugwise";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Ti0ZQlWsZaGvpfCTUnGNzdKcqKO84fAtlIUWC0wiyTI=";
+    hash = "sha256-qEAXyWa5OjTpF4foi0ljHKbemIEHORPGE6vIVL57BOU=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/tools/analysis/cppcheck/default.nix b/pkgs/development/tools/analysis/cppcheck/default.nix
index 1a8183ebab8d..51fd3aefa87e 100644
--- a/pkgs/development/tools/analysis/cppcheck/default.nix
+++ b/pkgs/development/tools/analysis/cppcheck/default.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cppcheck";
-  version = "2.9.3";
+  version = "2.10";
 
   src = fetchFromGitHub {
     owner = "danmar";
     repo = "cppcheck";
     rev = version;
-    hash = "sha256-AaZzr5r+tpG5M40HSx45KCUBPhN/nSpXxS5H3FuSx2c=";
+    hash = "sha256-Ss35foFlh4sw6TxMp++0b9E5KDUjBpDPuWIHsak8OGY=";
   };
 
   buildInputs = [ pcre
diff --git a/pkgs/development/tools/goa/default.nix b/pkgs/development/tools/goa/default.nix
index da4d07bb7889..eac91732be11 100644
--- a/pkgs/development/tools/goa/default.nix
+++ b/pkgs/development/tools/goa/default.nix
@@ -5,15 +5,15 @@
 
 buildGoModule rec {
   pname = "goa";
-  version = "3.10.2";
+  version = "3.11.0";
 
   src = fetchFromGitHub {
     owner = "goadesign";
     repo = "goa";
     rev = "v${version}";
-    sha256 = "sha256-cVCzuOZf2zFY01+t20sRArEFinWqvZ461jJIQIyf0yI=";
+    sha256 = "sha256-KgCF44kpr8dAHzLgoRKXfd9warQUiFggGZ/Dy/49j1Q=";
   };
-  vendorSha256 = "sha256-xLn7qGmBtNSnIZ7Gn4h/Aa037V0lO1jT/8P9PB7bH5o=";
+  vendorHash = "sha256-d76aeiSkW0sZeFylWIkCoquWzX78s2iaDeX3VE8cYfI=";
 
   subPackages = [ "cmd/goa" ];
 
diff --git a/pkgs/development/tools/language-servers/jdt-language-server/default.nix b/pkgs/development/tools/language-servers/jdt-language-server/default.nix
index 1af69700152d..1b194814a270 100644
--- a/pkgs/development/tools/language-servers/jdt-language-server/default.nix
+++ b/pkgs/development/tools/language-servers/jdt-language-server/default.nix
@@ -7,12 +7,12 @@
 
 stdenv.mkDerivation rec {
   pname = "jdt-language-server";
-  version = "1.17.0";
-  timestamp = "202210271413";
+  version = "1.19.0";
+  timestamp = "202301171536";
 
   src = fetchurl {
     url = "https://download.eclipse.org/jdtls/milestones/${version}/jdt-language-server-${version}-${timestamp}.tar.gz";
-    sha256 = "sha256-3NVzL3o/8LXR94/3Yma42XHfwNEFEVrmUijkeMs/vL0=";
+    sha256 = "sha256-9rreuMw2pODzOVX5PBmUZoV5ixUDilQyTsrnyCQ+IHs=";
   };
 
   sourceRoot = ".";
diff --git a/pkgs/development/tools/protoc-gen-go-vtproto/default.nix b/pkgs/development/tools/protoc-gen-go-vtproto/default.nix
index ee1793f01cab..3adab620534b 100644
--- a/pkgs/development/tools/protoc-gen-go-vtproto/default.nix
+++ b/pkgs/development/tools/protoc-gen-go-vtproto/default.nix
@@ -4,16 +4,16 @@
 }:
 buildGoModule rec {
   pname = "protoc-gen-go-vtproto";
-  version = "0.3.0";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "planetscale";
     repo = "vtprotobuf";
     rev = "v${version}";
-    sha256 = "sha256-fOF7n1WeQ3s1S+o5NbAoTUnqqk5IHtKvXCb2o8LmI5U=";
+    sha256 = "sha256-WtiXoQWjjFf+TP2zpAXNH05XdcrLSpw3S0TG4lkzp2E=";
   };
 
-  vendorSha256 = "sha256-JpSVO8h7+StLG9/dJQkmrIlh9zIHABoqP1hq+X5ajVs=";
+  vendorHash = "sha256-JpSVO8h7+StLG9/dJQkmrIlh9zIHABoqP1hq+X5ajVs=";
 
   excludedPackages = [ "conformance" ];
 
diff --git a/pkgs/development/tools/quick-lint-js/default.nix b/pkgs/development/tools/quick-lint-js/default.nix
index 80adc6f30a75..aa3dd1ee8688 100644
--- a/pkgs/development/tools/quick-lint-js/default.nix
+++ b/pkgs/development/tools/quick-lint-js/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "quick-lint-js";
-  version = "2.9.0";
+  version = "2.11.0";
 
   src = fetchFromGitHub {
     owner = "quick-lint";
     repo = "quick-lint-js";
     rev = version;
-    sha256 = "sha256-hWwEaUf+TntRfxI3HjJV+hJ+dV6TRncxSCbaxE1sIjs=";
+    sha256 = "sha256-hpDVR58Qez+TcAO77GXvjuH7NfBxdRvIi8WsBIuz3nI=";
   };
 
   nativeBuildInputs = [ cmake ninja ];
diff --git a/pkgs/development/tools/ruff/default.nix b/pkgs/development/tools/ruff/default.nix
index 2789a3d608f2..f8319fe6c2ff 100644
--- a/pkgs/development/tools/ruff/default.nix
+++ b/pkgs/development/tools/ruff/default.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "ruff";
-  version = "0.0.238";
+  version = "0.0.239";
 
   src = fetchFromGitHub {
     owner = "charliermarsh";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-hsJJsPJQrkzn+otpFhsESLRhfYEcUSXJULkScWPyQNk=";
+    sha256 = "sha256-ogAy1HrkoG7PWvDd4HlqTVNjrWpyWw2B+E9DANCoJNo=";
   };
 
-  cargoSha256 = "sha256-stEPoiXKXnjYcKqlJPwcjWAV4W2GLIp2lQ0ejVd/EF8=";
+  cargoSha256 = "sha256-C5ZOV2EUiV4W3J3jXS+aDyL3w+Rjx1YGTaE8ikqB2VQ=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/development/tools/rust/cargo-zigbuild/default.nix b/pkgs/development/tools/rust/cargo-zigbuild/default.nix
index 7d58d112da31..79822a7735e5 100644
--- a/pkgs/development/tools/rust/cargo-zigbuild/default.nix
+++ b/pkgs/development/tools/rust/cargo-zigbuild/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-zigbuild";
-  version = "0.14.5";
+  version = "0.15.0";
 
   src = fetchFromGitHub {
     owner = "messense";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-+H+T/PEpJyRySTJlVGbAevLzAEZs5J8BNqwZjiXhuuU=";
+    sha256 = "sha256-4Sp3PVhUvXn7FzPHHyyRBUHY5TQYEPLFdoI4ARQ4V0k=";
   };
 
-  cargoSha256 = "sha256-IOR/G+SPGl3MgOMjmsVPpvoode8U7K52vqs7yu0BdQk=";
+  cargoSha256 = "sha256-QplcedhsqFiAwcqBrEe2ns4DdZ+R/IuoKtkx8eGk19g=";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/os-specific/linux/apfs/default.nix b/pkgs/os-specific/linux/apfs/default.nix
index da0660ad1139..e6961684d0e4 100644
--- a/pkgs/os-specific/linux/apfs/default.nix
+++ b/pkgs/os-specific/linux/apfs/default.nix
@@ -5,15 +5,18 @@
 , nixosTests
 }:
 
+let
+  tag = "0.3.0";
+in
 stdenv.mkDerivation {
   pname = "apfs";
-  version = "unstable-2022-10-20-${kernel.version}";
+  version = "${tag}-${kernel.version}";
 
   src = fetchFromGitHub {
     owner = "linux-apfs";
     repo = "linux-apfs-rw";
-    rev = "e6eb67c92d425d395eac1c4403629391bdd5064d";
-    sha256 = "sha256-6rv5qZCjOqt0FaNFhA3tYg6/SdssvoT8kPVhalajgOo=";
+    rev = "v${tag}";
+    sha256 = "sha256-ABFqkiIJuFapFsUIFHfw8+TujePZm7ZX/qHuFO2KdnQ=";
   };
 
   hardeningDisable = [ "pic" ];
@@ -29,6 +32,15 @@ stdenv.mkDerivation {
 
   meta = with lib; {
     description = "APFS module for linux";
+    longDescription = ''
+      The Apple File System (APFS) is the copy-on-write filesystem currently
+      used on all Apple devices. This module provides a degree of experimental
+      support on Linux.
+      If you make use of the write support, expect data corruption.
+      Read-only support is somewhat more complete, with sealed volumes,
+      snapshots, and all the missing compression algorithms recently added.
+      Encryption is still not in the works though.
+    '';
     homepage = "https://github.com/linux-apfs/linux-apfs-rw";
     license = licenses.gpl2Only;
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/busybox/default.nix b/pkgs/os-specific/linux/busybox/default.nix
index 3feb590eb5d6..8a510a4d0c5d 100644
--- a/pkgs/os-specific/linux/busybox/default.nix
+++ b/pkgs/os-specific/linux/busybox/default.nix
@@ -50,14 +50,14 @@ in
 
 stdenv.mkDerivation rec {
   pname = "busybox";
-  version = "1.35.0";
+  version = "1.36.0";
 
   # Note to whoever is updating busybox: please verify that:
   # nix-build pkgs/stdenv/linux/make-bootstrap-tools.nix -A test
   # still builds after the update.
   src = fetchurl {
     url = "https://busybox.net/downloads/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-+u6yRMNaNIozT0pZ5EYm7ocPsHtohNaMEK6LwZ+DppQ=";
+    sha256 = "sha256-VCdQyK98smMOIBeAtPmfPczusG9QW0eexoJBweavYaU=";
   };
 
   hardeningDisable = [ "format" "pie" ]
@@ -75,11 +75,6 @@ stdenv.mkDerivation rec {
       url = "https://git.alpinelinux.org/aports/plain/main/busybox/0002-nslookup-sanitize-all-printed-strings-with-printable.patch?id=ed92963eb55bbc8d938097b9ccb3e221a94653f4";
       sha256 = "sha256-vl1wPbsHtXY9naajjnTicQ7Uj3N+EQ8pRNnrdsiow+w=";
     })
-    (fetchurl {
-      name = "CVE-2022-30065.patch";
-      url = "https://git.alpinelinux.org/aports/plain/main/busybox/CVE-2022-30065.patch?id=4ffd996b3f8298c7dd424b912c245864c816e354";
-      sha256 = "sha256-+WSYxI6eF8S0tya/S62f9Nc6jVMnHO0q1OyM69GlNTY=";
-    })
   ] ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) ./clang-cross.patch;
 
   separateDebugInfo = true;
diff --git a/pkgs/os-specific/linux/iotop-c/default.nix b/pkgs/os-specific/linux/iotop-c/default.nix
index 39429cba4b9c..2917ace349fb 100644
--- a/pkgs/os-specific/linux/iotop-c/default.nix
+++ b/pkgs/os-specific/linux/iotop-c/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "iotop-c";
-  version = "1.22";
+  version = "1.23";
 
   src = fetchFromGitHub {
     owner = "Tomas-M";
     repo = "iotop";
     rev = "v${version}";
-    sha256 = "sha256-MHjG14vZsuDrR9/SLotb7Uc3RW8Np9E2X0GXkSM+RxE=";
+    sha256 = "sha256-4DTYtUltmZ+nkm4ZLac+6JbBW3z+qby7sP33LwEXtcQ=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/os-specific/linux/sysdig/default.nix b/pkgs/os-specific/linux/sysdig/default.nix
index 21f232d0c2da..e316423f01a0 100644
--- a/pkgs/os-specific/linux/sysdig/default.nix
+++ b/pkgs/os-specific/linux/sysdig/default.nix
@@ -3,7 +3,6 @@
 , libyamlcpp, nlohmann_json, re2
 }:
 
-with lib;
 let
   # Compare with https://github.com/draios/sysdig/blob/dev/cmake/modules/falcosecurity-libs.cmake
   libsRev = "0.9.1";
@@ -54,7 +53,7 @@ stdenv.mkDerivation rec {
     libyamlcpp
     jsoncpp
     nlohmann_json
-  ] ++ optionals (kernel != null) kernel.moduleBuildDependencies;
+  ] ++ lib.optionals (kernel != null) kernel.moduleBuildDependencies;
 
   hardeningDisable = [ "pic" ];
 
@@ -82,7 +81,7 @@ stdenv.mkDerivation rec {
     "-DUSE_BUNDLED_TBB=OFF"
     "-DUSE_BUNDLED_RE2=OFF"
     "-DCREATE_TEST_TARGETS=OFF"
-  ] ++ optional (kernel == null) "-DBUILD_DRIVER=OFF";
+  ] ++ lib.optional (kernel == null) "-DBUILD_DRIVER=OFF";
 
   # needed since luajit-2.1.0-beta3
   NIX_CFLAGS_COMPILE = "-DluaL_reg=luaL_Reg -DluaL_getn(L,i)=((int)lua_objlen(L,i))";
@@ -93,7 +92,7 @@ stdenv.mkDerivation rec {
       exit 1
     fi
     cmakeFlagsArray+=(-DCMAKE_EXE_LINKER_FLAGS="-ltbb -lcurl -labsl_synchronization")
-  '' + optionalString (kernel != null) ''
+  '' + lib.optionalString (kernel != null) ''
     export INSTALL_MOD_PATH="$out"
     export KERNELDIR="${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
   '';
@@ -106,7 +105,7 @@ stdenv.mkDerivation rec {
       rmdir $out/etc/bash_completion.d
       rmdir $out/etc
     ''
-    + optionalString (kernel != null) ''
+    + lib.optionalString (kernel != null) ''
       make install_driver
       kernel_dev=${kernel.dev}
       kernel_dev=''${kernel_dev#/nix/store/}
@@ -121,7 +120,7 @@ stdenv.mkDerivation rec {
     '';
 
 
-  meta = {
+  meta = with lib; {
     description = "A tracepoint-based system tracing tool for Linux (with clients for other OSes)";
     license = with licenses; [ asl20 gpl2 mit ];
     maintainers = [maintainers.raskin];
diff --git a/pkgs/shells/carapace/default.nix b/pkgs/shells/carapace/default.nix
index 912985c1cfed..32185663e133 100644
--- a/pkgs/shells/carapace/default.nix
+++ b/pkgs/shells/carapace/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "carapace";
-  version = "0.20.2";
+  version = "0.21.0";
 
   src = fetchFromGitHub {
     owner = "rsteube";
     repo = "${pname}-bin";
     rev = "v${version}";
-    sha256 = "sha256-UPm0B3sv2+0/tS7NdqY5fpvMbI9B7CxixWF9M74H5w0=";
+    sha256 = "sha256-vpYBgDX0CxTNphmdwrI56AtlPlf2DGf3BZ+jWwdanpw=";
   };
 
-  vendorHash = "sha256-l4DG6sZyFqu4OlxxL6mmcXTGljxY7xk5u5QlOr8dBNI=";
+  vendorHash = "sha256-Qi2fkAdO0clpKowSdoxyanIB65oagqEnw5gCqVHPJb0=";
 
   subPackages = [ "./cmd/carapace" ];
 
diff --git a/pkgs/shells/zsh/nix-zsh-completions/default.nix b/pkgs/shells/zsh/nix-zsh-completions/default.nix
index 59e9fa8d8d48..73b9b55b0b8a 100644
--- a/pkgs/shells/zsh/nix-zsh-completions/default.nix
+++ b/pkgs/shells/zsh/nix-zsh-completions/default.nix
@@ -2,26 +2,15 @@
 
 stdenv.mkDerivation rec {
   pname = "nix-zsh-completions";
-  version = "0.4.4";
+  version = "unstable-2023-01-30";
 
   src = fetchFromGitHub {
-    owner = "spwhitt";
+    owner = "nix-community";
     repo = "nix-zsh-completions";
-    rev = version;
-    sha256 = "1n9whlys95k4wc57cnz3n07p7zpkv796qkmn68a50ygkx6h3afqf";
+    rev = "6a1bfc024481bdba568f2ced65e02f3a359a7692";
+    hash = "sha256-aXetjkl5nPuYHHyuX59ywXF+4Xg+PUCV6Y2u+g18gEk=";
   };
 
-  # https://github.com/spwhitt/nix-zsh-completions/issues/42
-  #
-  # _nix completion is broken. Remove it; _nix provided by the nix
-  # package will be used instead. It is not sufficient to set low
-  # meta.priority below if nix is installed in the system profile and
-  # nix-zsh-completions in an user profile. In that case, the broken
-  # version takes precedence over the good one.
-  postPatch = ''
-    rm _nix
-  '';
-
   strictDeps = true;
   installPhase = ''
     mkdir -p $out/share/zsh/{site-functions,plugins/nix}
@@ -30,9 +19,8 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    homepage = "https://github.com/spwhitt/nix-zsh-completions";
+    homepage = "https://github.com/nix-community/nix-zsh-completions";
     description = "ZSH completions for Nix, NixOS, and NixOps";
-    priority = 6; # prevent collisions with nix 2.4's built-in completions
     license = licenses.bsd3;
     platforms = platforms.all;
     maintainers = with maintainers; [ spwhitt olejorgenb hedning ma27 ];
diff --git a/pkgs/tools/misc/dust/default.nix b/pkgs/tools/misc/dust/default.nix
index bd4452263a92..b6a17a38b5bf 100644
--- a/pkgs/tools/misc/dust/default.nix
+++ b/pkgs/tools/misc/dust/default.nix
@@ -1,14 +1,14 @@
-{ stdenv, lib, fetchFromGitHub, rustPlatform, AppKit }:
+{ stdenv, lib, fetchFromGitHub, rustPlatform, AppKit, installShellFiles }:
 
 rustPlatform.buildRustPackage rec {
   pname = "du-dust";
-  version = "0.8.3";
+  version = "0.8.4";
 
   src = fetchFromGitHub {
     owner = "bootandy";
     repo = "dust";
     rev = "v${version}";
-    sha256 = "sha256-+YcHiW4kR4JeIY6zv1WJ97dCIakvtbn8+b9tLFH+aLE=";
+    sha256 = "sha256-g1i003nBbTYIuKG4ZCQSoI8gINTVc8BKRoO3UOeHOGE=";
     # Remove unicode file names which leads to different checksums on HFS+
     # vs. other filesystems because of unicode normalisation.
     postFetch = ''
@@ -16,12 +16,19 @@ rustPlatform.buildRustPackage rec {
     '';
   };
 
-  cargoSha256 = "sha256-yKj9CBoEC6UJf4L+XO2qi69//45lSqblMe8ofnLctEw=";
+  cargoHash = "sha256-jtQ/nkD5XMD2rsq550XsRK416wOCR3OuhgGPeuC3jzc=";
+
+  nativeBuildInputs = [ installShellFiles ];
 
   buildInputs = lib.optionals stdenv.isDarwin [ AppKit ];
 
   doCheck = false;
 
+  postInstall = ''
+    installManPage man-page/dust.1
+    installShellCompletion completions/dust.{bash,fish} --zsh completions/_dust
+  '';
+
   meta = with lib; {
     description = "du + rust = dust. Like du but more intuitive";
     homepage = "https://github.com/bootandy/dust";
diff --git a/pkgs/tools/misc/iam-policy-json-to-terraform/default.nix b/pkgs/tools/misc/iam-policy-json-to-terraform/default.nix
index 4d00ffb03b4b..ed7b0ab43182 100644
--- a/pkgs/tools/misc/iam-policy-json-to-terraform/default.nix
+++ b/pkgs/tools/misc/iam-policy-json-to-terraform/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "iam-policy-json-to-terraform";
-  version = "1.8.1";
+  version = "1.8.2";
 
   src = fetchFromGitHub {
     owner = "flosell";
     repo = pname;
     rev = "${version}";
-    sha256 = "sha256-O3JlBWT2YVu3mv/BCbs65k7HMF4cRCihd59wZzeoxcI=";
+    sha256 = "sha256-ovmWZpeHt1L8zNzG7+2BohteSjpYADMivi+AP0Vm8/E=";
   };
 
-  vendorSha256 = "sha256-IXWt/yFapDamfZClI6gm5vPA5VW2gV2iEq5c/nJXiiA=";
+  vendorHash = "sha256-1WTc7peTJI3IvHJqznqRz29uQ2NG0CZpAAzlyYymZCQ=";
 
   meta = with lib; {
     description = "Small tool to convert an IAM Policy in JSON format into a Terraform aws_iam_policy_document ";
diff --git a/pkgs/tools/misc/lbdb/default.nix b/pkgs/tools/misc/lbdb/default.nix
index 3a7338221bac..43dab4772d5f 100644
--- a/pkgs/tools/misc/lbdb/default.nix
+++ b/pkgs/tools/misc/lbdb/default.nix
@@ -15,6 +15,7 @@ let
   perl' = perl.withPackages (p: with p; [
     AuthenSASL
     ConvertASN1
+    IOSocketSSL
     perlldap
   ]);
 in
diff --git a/pkgs/tools/misc/plantuml-server/default.nix b/pkgs/tools/misc/plantuml-server/default.nix
index ddbb7708ec8b..607bc53033d5 100644
--- a/pkgs/tools/misc/plantuml-server/default.nix
+++ b/pkgs/tools/misc/plantuml-server/default.nix
@@ -1,14 +1,14 @@
 { lib, stdenv, fetchurl }:
 
 let
-  version = "1.2023.0";
+  version = "1.2023.1";
 in
 stdenv.mkDerivation rec {
   pname = "plantuml-server";
   inherit version;
   src = fetchurl {
     url = "https://github.com/plantuml/plantuml-server/releases/download/v${version}/plantuml-v${version}.war";
-    sha256 = "sha256-FYyP6CZb+uarXlGEAPyt6KKvciZ5XsfjilDW0JObpDw=";
+    sha256 = "sha256-SaUk+gaMCpKF1HR9tpEhbZNmKV70LPHeH/YPsU8WGsU=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/tools/security/eid-mw/default.nix b/pkgs/tools/security/eid-mw/default.nix
index d73a93d851b7..dcd4686bb3ef 100644
--- a/pkgs/tools/security/eid-mw/default.nix
+++ b/pkgs/tools/security/eid-mw/default.nix
@@ -21,13 +21,13 @@
 stdenv.mkDerivation rec {
   pname = "eid-mw";
   # NOTE: Don't just blindly update to the latest version/tag. Releases are always for a specific OS.
-  version = "5.1.4";
+  version = "5.1.9";
 
   src = fetchFromGitHub {
     owner = "Fedict";
     repo = "eid-mw";
     rev = "v${version}";
-    sha256 = "pHzjLyQFn7UvFrPUcI/ZQHMOwVp6ndnX9YegJzlhERM=";
+    hash = "sha256-E7mNEgh8hujagqQe0ycEGcRDOlxVY7KzXw+DD8Wf9N8=";
   };
 
   nativeBuildInputs = [ autoreconfHook autoconf-archive pkg-config makeWrapper ];
diff --git a/pkgs/tools/security/proxmark3/proxmark3-rrg.nix b/pkgs/tools/security/proxmark3/proxmark3-rrg.nix
index a366dbf8224d..6b021e970277 100644
--- a/pkgs/tools/security/proxmark3/proxmark3-rrg.nix
+++ b/pkgs/tools/security/proxmark3/proxmark3-rrg.nix
@@ -7,13 +7,13 @@
 
 mkDerivation rec {
   pname = "proxmark3-rrg";
-  version = "4.15864";
+  version = "4.16191";
 
   src = fetchFromGitHub {
     owner = "RfidResearchGroup";
     repo = "proxmark3";
     rev = "v${version}";
-    sha256 = "sha256-vFebyXKC/vf8W8fGkTpSGTA0ZmfwnXSuuiOjV/u9240=";
+    sha256 = "sha256-l0aDp0s9ekUUHqkzGfVoSIf/4/GN2uiVGL/+QtKRCOs=";
   };
 
   nativeBuildInputs = [ pkg-config gcc-arm-embedded ];
diff --git a/pkgs/tools/system/throttled/default.nix b/pkgs/tools/system/throttled/default.nix
index efbc9ed3dd3f..f09c0480865f 100644
--- a/pkgs/tools/system/throttled/default.nix
+++ b/pkgs/tools/system/throttled/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, python3Packages }:
+{ lib, stdenv, fetchFromGitHub, python3Packages, pciutils }:
 
 stdenv.mkDerivation rec {
   pname = "throttled";
@@ -20,7 +20,11 @@ stdenv.mkDerivation rec {
   ];
 
   # The upstream unit both assumes the install location, and tries to run in a virtualenv
-  postPatch = ''sed -e 's|ExecStart=.*|ExecStart=${placeholder "out"}/bin/throttled.py|' -i systemd/throttled.service'';
+  postPatch = ''
+    sed -e 's|ExecStart=.*|ExecStart=${placeholder "out"}/bin/throttled.py|' -i systemd/throttled.service
+
+    substituteInPlace throttled.py --replace "'setpci'" "'${pciutils}/bin/setpci'"
+  '';
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 05ea39d42d65..5c18da67c27d 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2182,6 +2182,7 @@ with pkgs;
 
   ppsspp-qt = ppsspp.override {
     inherit (libsForQt5) qtbase qtmultimedia wrapQtAppsHook;
+    enableQt = true;
     enableVulkan = false; # https://github.com/hrydgard/ppsspp/issues/11628
   };
 
@@ -5406,9 +5407,13 @@ with pkgs;
 
   rex = callPackage ../tools/system/rex { };
 
-  river = callPackage ../applications/window-managers/river { };
+  river = callPackage ../applications/window-managers/river {
+    zig = zig_0_9;
+  };
 
-  rivercarro = callPackage ../applications/misc/rivercarro { };
+  rivercarro = callPackage ../applications/misc/rivercarro {
+    zig = zig_0_9;
+  };
 
   rmapi = callPackage ../applications/misc/remarkable/rmapi { };
 
@@ -7254,7 +7259,9 @@ with pkgs;
 
   findutils = callPackage ../tools/misc/findutils { };
 
-  findup = callPackage ../tools/misc/findup { };
+  findup = callPackage ../tools/misc/findup {
+    zig = zig_0_9;
+  };
 
   bsd-finger = callPackage ../tools/networking/bsd-finger { };
   bsd-fingerd = bsd-finger.override({ buildClient = false; });
@@ -18810,7 +18817,9 @@ with pkgs;
 
   ytt = callPackage ../development/tools/ytt {};
 
-  zls = callPackage ../development/tools/zls { };
+  zls = callPackage ../development/tools/zls {
+    zig = zig_0_9;
+  };
 
   zydis = callPackage ../development/libraries/zydis { };
 
@@ -23808,9 +23817,15 @@ with pkgs;
   libzra = callPackage ../development/libraries/libzra { };
 
   # requires a newer Apple SDK
-  zig = darwin.apple_sdk_11_0.callPackage ../development/compilers/zig {
+  zig_0_9 = darwin.apple_sdk_11_0.callPackage ../development/compilers/zig/0.9.1.nix {
     llvmPackages = llvmPackages_13;
   };
+  # requires a newer Apple SDK
+  zig_0_10 = darwin.apple_sdk_11_0.callPackage ../development/compilers/zig/0.10.nix {
+    llvmPackages = llvmPackages_15;
+  };
+  # Zig 0.10.1 is broken on Darwin, so use 0.9.1 on Darwin instead.
+  zig = if stdenv.isDarwin then zig_0_9 else zig_0_10;
 
   zimlib = callPackage ../development/libraries/zimlib { };
 
@@ -28818,7 +28833,7 @@ with pkgs;
   dunst = callPackage ../applications/misc/dunst { };
 
   du-dust = callPackage ../tools/misc/dust {
-    inherit (darwin.apple_sdk.frameworks) AppKit;
+    inherit (darwin.apple_sdk_11_0.frameworks) AppKit;
   };
 
   dutree = callPackage ../tools/misc/dutree { };
@@ -30161,7 +30176,9 @@ with pkgs;
 
   waybar = callPackage ../applications/misc/waybar {};
 
-  waylock = callPackage ../applications/misc/waylock {};
+  waylock = callPackage ../applications/misc/waylock {
+    zig = zig_0_9;
+  };
 
   wayshot = callPackage ../tools/misc/wayshot { };
 
@@ -31078,7 +31095,9 @@ with pkgs;
 
   merkaartor = libsForQt5.callPackage ../applications/misc/merkaartor { };
 
-  mepo = callPackage ../applications/misc/mepo { };
+  mepo = callPackage ../applications/misc/mepo {
+    zig = zig_0_9;
+  };
 
   meshcentral = callPackage ../tools/admin/meshcentral { };
 
@@ -31717,7 +31736,9 @@ with pkgs;
 
   netcoredbg = callPackage ../development/tools/misc/netcoredbg { };
 
-  ncdu = callPackage ../tools/misc/ncdu { };
+  ncdu = callPackage ../tools/misc/ncdu {
+    zig = zig_0_9;
+  };
   ncdu_1 = callPackage ../tools/misc/ncdu/1.nix { };
 
   ncdc = callPackage ../applications/networking/p2p/ncdc { };
@@ -34742,7 +34763,9 @@ with pkgs;
     inherit (perlPackages) PathTiny;
   };
 
-  blackshades = callPackage ../games/blackshades { };
+  blackshades = callPackage ../games/blackshades {
+    zig = zig_0_9;
+  };
 
   blobby = callPackage ../games/blobby { };