diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 50a25454e5b9..0fd3bf287ec8 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -6047,6 +6047,9 @@
     github = "gigglesquid";
     githubId = 3685154;
     name = "Jack connors";
+    keys = [{
+      fingerprint = "21DF 8034 B212 EDFF 9F19  9C19 F65B 7583 7ABF D019";
+    }];
   };
   gila = {
     email = "jeffry.molanus@gmail.com";
diff --git a/nixos/modules/services/networking/syncthing.nix b/nixos/modules/services/networking/syncthing.nix
index 69b45eb02d1d..56da95dca94d 100644
--- a/nixos/modules/services/networking/syncthing.nix
+++ b/nixos/modules/services/networking/syncthing.nix
@@ -7,25 +7,27 @@ let
   opt = options.services.syncthing;
   defaultUser = "syncthing";
   defaultGroup = defaultUser;
+  settingsFormat = pkgs.formats.json { };
+  cleanedConfig = converge (filterAttrsRecursive (_: v: v != null && v != {})) cfg.settings;
 
-  devices = mapAttrsToList (name: device: {
+  devices = mapAttrsToList (_: device: device // {
     deviceID = device.id;
-    inherit (device) name addresses introducer autoAcceptFolders;
-  }) cfg.devices;
+  }) cfg.settings.devices;
 
-  folders = mapAttrsToList ( _: folder: {
-    inherit (folder) path id label type;
-    devices = map (device: { deviceId = cfg.devices.${device}.id; }) folder.devices;
-    rescanIntervalS = folder.rescanInterval;
-    fsWatcherEnabled = folder.watch;
-    fsWatcherDelayS = folder.watchDelay;
-    ignorePerms = folder.ignorePerms;
-    ignoreDelete = folder.ignoreDelete;
-    versioning = folder.versioning;
-  }) (filterAttrs (
-    _: folder:
+  folders = mapAttrsToList (_: folder: folder //
+    throwIf (folder?rescanInterval || folder?watch || folder?watchDelay) ''
+      The options services.syncthing.settings.folders.<name>.{rescanInterval,watch,watchDelay}
+      were removed. Please use, respectively, {rescanIntervalS,fsWatcherEnabled,fsWatcherDelayS} instead.
+    '' {
+    devices = map (device:
+      if builtins.isString device then
+        { deviceId = cfg.settings.devices.${device}.id; }
+      else
+        device
+    ) folder.devices;
+  }) (filterAttrs (_: folder:
     folder.enable
-  ) cfg.folders);
+  ) cfg.settings.folders);
 
   updateConfig = pkgs.writers.writeDash "merge-syncthing-config" ''
     set -efu
@@ -54,10 +56,10 @@ let
     old_cfg=$(curl ${cfg.guiAddress}/rest/config)
 
     # generate the new config by merging with the NixOS config options
-    new_cfg=$(printf '%s\n' "$old_cfg" | ${pkgs.jq}/bin/jq -c '. * {
-        "devices": ('${escapeShellArg (builtins.toJSON devices)}'${optionalString (cfg.devices == {} || ! cfg.overrideDevices) " + .devices"}),
-        "folders": ('${escapeShellArg (builtins.toJSON folders)}'${optionalString (cfg.folders == {} || ! cfg.overrideFolders) " + .folders"})
-    } * '${escapeShellArg (builtins.toJSON cfg.extraOptions)})
+    new_cfg=$(printf '%s\n' "$old_cfg" | ${pkgs.jq}/bin/jq -c ${escapeShellArg ''. * ${builtins.toJSON cleanedConfig} * {
+        "devices": ('${escapeShellArg (builtins.toJSON devices)}'${optionalString (cfg.settings.devices == {} || ! cfg.overrideDevices) " + .devices"}),
+        "folders": ('${escapeShellArg (builtins.toJSON folders)}'${optionalString (cfg.settings.folders == {} || ! cfg.overrideFolders) " + .folders"})
+    }''})
 
     # send the new config
     curl -X PUT -d "$new_cfg" ${cfg.guiAddress}/rest/config
@@ -99,287 +101,282 @@ in {
         default = true;
         description = mdDoc ''
           Whether to delete the devices which are not configured via the
-          [devices](#opt-services.syncthing.devices) option.
+          [devices](#opt-services.syncthing.settings.devices) option.
           If set to `false`, devices added via the web
           interface will persist and will have to be deleted manually.
         '';
       };
 
-      devices = mkOption {
-        default = {};
-        description = mdDoc ''
-          Peers/devices which Syncthing should communicate with.
-
-          Note that you can still add devices manually, but those changes
-          will be reverted on restart if [overrideDevices](#opt-services.syncthing.overrideDevices)
-          is enabled.
-        '';
-        example = {
-          bigbox = {
-            id = "7CFNTQM-IMTJBHJ-3UWRDIU-ZGQJFR6-VCXZ3NB-XUH3KZO-N52ITXR-LAIYUAU";
-            addresses = [ "tcp://192.168.0.10:51820" ];
-          };
-        };
-        type = types.attrsOf (types.submodule ({ name, ... }: {
-          options = {
-
-            name = mkOption {
-              type = types.str;
-              default = name;
-              description = lib.mdDoc ''
-                The name of the device.
-              '';
-            };
-
-            addresses = mkOption {
-              type = types.listOf types.str;
-              default = [];
-              description = lib.mdDoc ''
-                The addresses used to connect to the device.
-                If this is left empty, dynamic configuration is attempted.
-              '';
-            };
-
-            id = mkOption {
-              type = types.str;
-              description = mdDoc ''
-                The device ID. See <https://docs.syncthing.net/dev/device-ids.html>.
-              '';
-            };
-
-            introducer = mkOption {
-              type = types.bool;
-              default = false;
-              description = mdDoc ''
-                Whether the device should act as an introducer and be allowed
-                to add folders on this computer.
-                See <https://docs.syncthing.net/users/introducer.html>.
-              '';
-            };
-
-            autoAcceptFolders = mkOption {
-              type = types.bool;
-              default = false;
-              description = mdDoc ''
-                Automatically create or share folders that this device advertises at the default path.
-                See <https://docs.syncthing.net/users/config.html?highlight=autoaccept#config-file-format>.
-              '';
-            };
-
-          };
-        }));
-      };
-
       overrideFolders = mkOption {
         type = types.bool;
         default = true;
         description = mdDoc ''
           Whether to delete the folders which are not configured via the
-          [folders](#opt-services.syncthing.folders) option.
+          [folders](#opt-services.syncthing.settings.folders) option.
           If set to `false`, folders added via the web
           interface will persist and will have to be deleted manually.
         '';
       };
 
-      folders = mkOption {
-        default = {};
-        description = mdDoc ''
-          Folders which should be shared by Syncthing.
-
-          Note that you can still add folders manually, but those changes
-          will be reverted on restart if [overrideFolders](#opt-services.syncthing.overrideFolders)
-          is enabled.
-        '';
-        example = literalExpression ''
-          {
-            "/home/user/sync" = {
-              id = "syncme";
-              devices = [ "bigbox" ];
-            };
-          }
-        '';
-        type = types.attrsOf (types.submodule ({ name, ... }: {
+      settings = mkOption {
+        type = types.submodule {
+          freeformType = settingsFormat.type;
           options = {
-
-            enable = mkOption {
-              type = types.bool;
-              default = true;
-              description = lib.mdDoc ''
-                Whether to share this folder.
-                This option is useful when you want to define all folders
-                in one place, but not every machine should share all folders.
-              '';
-            };
-
-            path = mkOption {
-              # TODO for release 23.05: allow relative paths again and set
-              # working directory to cfg.dataDir
-              type = types.str // {
-                check = x: types.str.check x && (substring 0 1 x == "/" || substring 0 2 x == "~/");
-                description = types.str.description + " starting with / or ~/";
-              };
-              default = name;
-              description = lib.mdDoc ''
-                The path to the folder which should be shared.
-                Only absolute paths (starting with `/`) and paths relative to
-                the [user](#opt-services.syncthing.user)'s home directory
-                (starting with `~/`) are allowed.
-              '';
-            };
-
-            id = mkOption {
-              type = types.str;
-              default = name;
-              description = lib.mdDoc ''
-                The ID of the folder. Must be the same on all devices.
-              '';
-            };
-
-            label = mkOption {
-              type = types.str;
-              default = name;
-              description = lib.mdDoc ''
-                The label of the folder.
-              '';
-            };
-
-            devices = mkOption {
-              type = types.listOf types.str;
-              default = [];
+            # global options
+            options = mkOption {
+              default = {};
               description = mdDoc ''
-                The devices this folder should be shared with. Each device must
-                be defined in the [devices](#opt-services.syncthing.devices) option.
+                The options element contains all other global configuration options
               '';
-            };
-
-            versioning = mkOption {
-              default = null;
-              description = mdDoc ''
-                How to keep changed/deleted files with Syncthing.
-                There are 4 different types of versioning with different parameters.
-                See <https://docs.syncthing.net/users/versioning.html>.
-              '';
-              example = literalExpression ''
-                [
-                  {
-                    versioning = {
-                      type = "simple";
-                      params.keep = "10";
-                    };
-                  }
-                  {
-                    versioning = {
-                      type = "trashcan";
-                      params.cleanoutDays = "1000";
-                    };
-                  }
-                  {
-                    versioning = {
-                      type = "staggered";
-                      fsPath = "/syncthing/backup";
-                      params = {
-                        cleanInterval = "3600";
-                        maxAge = "31536000";
-                      };
-                    };
-                  }
-                  {
-                    versioning = {
-                      type = "external";
-                      params.versionsPath = pkgs.writers.writeBash "backup" '''
-                        folderpath="$1"
-                        filepath="$2"
-                        rm -rf "$folderpath/$filepath"
-                      ''';
-                    };
-                  }
-                ]
-              '';
-              type = with types; nullOr (submodule {
+              type = types.submodule ({ name, ... }: {
+                freeformType = settingsFormat.type;
                 options = {
-                  type = mkOption {
-                    type = enum [ "external" "simple" "staggered" "trashcan" ];
-                    description = mdDoc ''
-                      The type of versioning.
-                      See <https://docs.syncthing.net/users/versioning.html>.
+                  localAnnounceEnabled = mkOption {
+                    type = types.nullOr types.bool;
+                    default = null;
+                    description = lib.mdDoc ''
+                      Whether to send announcements to the local LAN, also use such announcements to find other devices.
                     '';
                   };
-                  fsPath = mkOption {
-                    default = "";
-                    type = either str path;
-                    description = mdDoc ''
-                      Path to the versioning folder.
-                      See <https://docs.syncthing.net/users/versioning.html>.
+
+                  localAnnouncePort = mkOption {
+                    type = types.nullOr types.int;
+                    default = null;
+                    description = lib.mdDoc ''
+                      The port on which to listen and send IPv4 broadcast announcements to.
                     '';
                   };
-                  params = mkOption {
-                    type = attrsOf (either str path);
-                    description = mdDoc ''
-                      The parameters for versioning. Structure depends on
-                      [versioning.type](#opt-services.syncthing.folders._name_.versioning.type).
-                      See <https://docs.syncthing.net/users/versioning.html>.
+
+                  relaysEnabled = mkOption {
+                    type = types.nullOr types.bool;
+                    default = null;
+                    description = lib.mdDoc ''
+                      When true, relays will be connected to and potentially used for device to device connections.
+                    '';
+                  };
+
+                  urAccepted = mkOption {
+                    type = types.nullOr types.int;
+                    default = null;
+                    description = lib.mdDoc ''
+                      Whether the user has accepted to submit anonymous usage data.
+                      The default, 0, mean the user has not made a choice, and Syncthing will ask at some point in the future.
+                      "-1" means no, a number above zero means that that version of usage reporting has been accepted.
+                    '';
+                  };
+
+                  limitBandwidthInLan = mkOption {
+                    type = types.nullOr types.bool;
+                    default = null;
+                    description = lib.mdDoc ''
+                      Whether to apply bandwidth limits to devices in the same broadcast domain as the local device.
+                    '';
+                  };
+
+                  maxFolderConcurrency = mkOption {
+                    type = types.nullOr types.int;
+                    default = null;
+                    description = lib.mdDoc ''
+                      This option controls how many folders may concurrently be in I/O-intensive operations such as syncing or scanning.
+                      The mechanism is described in detail in a [separate chapter](https://docs.syncthing.net/advanced/option-max-concurrency.html).
                     '';
                   };
                 };
               });
             };
 
-            rescanInterval = mkOption {
-              type = types.int;
-              default = 3600;
-              description = lib.mdDoc ''
-                How often the folder should be rescanned for changes.
-              '';
-            };
-
-            type = mkOption {
-              type = types.enum [ "sendreceive" "sendonly" "receiveonly" "receiveencrypted" ];
-              default = "sendreceive";
-              description = lib.mdDoc ''
-                Whether to only send changes for this folder, only receive them
-                or both. `receiveencrypted` can be used for untrusted devices. See
-                <https://docs.syncthing.net/users/untrusted.html> for reference.
-              '';
-            };
-
-            watch = mkOption {
-              type = types.bool;
-              default = true;
-              description = lib.mdDoc ''
-                Whether the folder should be watched for changes by inotify.
-              '';
-            };
-
-            watchDelay = mkOption {
-              type = types.int;
-              default = 10;
-              description = lib.mdDoc ''
-                The delay after an inotify event is triggered.
-              '';
-            };
-
-            ignorePerms = mkOption {
-              type = types.bool;
-              default = true;
-              description = lib.mdDoc ''
-                Whether to ignore permission changes.
-              '';
-            };
-
-            ignoreDelete = mkOption {
-              type = types.bool;
-              default = false;
+            # device settings
+            devices = mkOption {
+              default = {};
               description = mdDoc ''
-                Whether to skip deleting files that are deleted by peers.
-                See <https://docs.syncthing.net/advanced/folder-ignoredelete.html>.
-              '';
-            };
-          };
-        }));
-      };
+                Peers/devices which Syncthing should communicate with.
 
-      extraOptions = mkOption {
-        type = types.addCheck (pkgs.formats.json {}).type isAttrs;
+                Note that you can still add devices manually, but those changes
+                will be reverted on restart if [overrideDevices](#opt-services.syncthing.overrideDevices)
+                is enabled.
+              '';
+              example = {
+                bigbox = {
+                  id = "7CFNTQM-IMTJBHJ-3UWRDIU-ZGQJFR6-VCXZ3NB-XUH3KZO-N52ITXR-LAIYUAU";
+                  addresses = [ "tcp://192.168.0.10:51820" ];
+                };
+              };
+              type = types.attrsOf (types.submodule ({ name, ... }: {
+                freeformType = settingsFormat.type;
+                options = {
+
+                  name = mkOption {
+                    type = types.str;
+                    default = name;
+                    description = lib.mdDoc ''
+                      The name of the device.
+                    '';
+                  };
+
+                  id = mkOption {
+                    type = types.str;
+                    description = mdDoc ''
+                      The device ID. See <https://docs.syncthing.net/dev/device-ids.html>.
+                    '';
+                  };
+
+                  autoAcceptFolders = mkOption {
+                    type = types.bool;
+                    default = false;
+                    description = mdDoc ''
+                      Automatically create or share folders that this device advertises at the default path.
+                      See <https://docs.syncthing.net/users/config.html?highlight=autoaccept#config-file-format>.
+                    '';
+                  };
+
+                };
+              }));
+            };
+
+            # folder settings
+            folders = mkOption {
+              default = {};
+              description = mdDoc ''
+                Folders which should be shared by Syncthing.
+
+                Note that you can still add folders manually, but those changes
+                will be reverted on restart if [overrideFolders](#opt-services.syncthing.overrideFolders)
+                is enabled.
+              '';
+              example = literalExpression ''
+                {
+                  "/home/user/sync" = {
+                    id = "syncme";
+                    devices = [ "bigbox" ];
+                  };
+                }
+              '';
+              type = types.attrsOf (types.submodule ({ name, ... }: {
+                freeformType = settingsFormat.type;
+                options = {
+
+                  enable = mkOption {
+                    type = types.bool;
+                    default = true;
+                    description = lib.mdDoc ''
+                      Whether to share this folder.
+                      This option is useful when you want to define all folders
+                      in one place, but not every machine should share all folders.
+                    '';
+                  };
+
+                  path = mkOption {
+                    # TODO for release 23.05: allow relative paths again and set
+                    # working directory to cfg.dataDir
+                    type = types.str // {
+                      check = x: types.str.check x && (substring 0 1 x == "/" || substring 0 2 x == "~/");
+                      description = types.str.description + " starting with / or ~/";
+                    };
+                    default = name;
+                    description = lib.mdDoc ''
+                      The path to the folder which should be shared.
+                      Only absolute paths (starting with `/`) and paths relative to
+                      the [user](#opt-services.syncthing.user)'s home directory
+                      (starting with `~/`) are allowed.
+                    '';
+                  };
+
+                  id = mkOption {
+                    type = types.str;
+                    default = name;
+                    description = lib.mdDoc ''
+                      The ID of the folder. Must be the same on all devices.
+                    '';
+                  };
+
+                  label = mkOption {
+                    type = types.str;
+                    default = name;
+                    description = lib.mdDoc ''
+                      The label of the folder.
+                    '';
+                  };
+
+                  devices = mkOption {
+                    type = types.listOf types.str;
+                    default = [];
+                    description = mdDoc ''
+                      The devices this folder should be shared with. Each device must
+                      be defined in the [devices](#opt-services.syncthing.settings.devices) option.
+                    '';
+                  };
+
+                  versioning = mkOption {
+                    default = null;
+                    description = mdDoc ''
+                      How to keep changed/deleted files with Syncthing.
+                      There are 4 different types of versioning with different parameters.
+                      See <https://docs.syncthing.net/users/versioning.html>.
+                    '';
+                    example = literalExpression ''
+                      [
+                        {
+                          versioning = {
+                            type = "simple";
+                            params.keep = "10";
+                          };
+                        }
+                        {
+                          versioning = {
+                            type = "trashcan";
+                            params.cleanoutDays = "1000";
+                          };
+                        }
+                        {
+                          versioning = {
+                            type = "staggered";
+                            fsPath = "/syncthing/backup";
+                            params = {
+                              cleanInterval = "3600";
+                              maxAge = "31536000";
+                            };
+                          };
+                        }
+                        {
+                          versioning = {
+                            type = "external";
+                            params.versionsPath = pkgs.writers.writeBash "backup" '''
+                              folderpath="$1"
+                              filepath="$2"
+                              rm -rf "$folderpath/$filepath"
+                            ''';
+                          };
+                        }
+                      ]
+                    '';
+                    type = with types; nullOr (submodule {
+                      freeformType = settingsFormat.type;
+                      options = {
+                        type = mkOption {
+                          type = enum [ "external" "simple" "staggered" "trashcan" ];
+                          description = mdDoc ''
+                            The type of versioning.
+                            See <https://docs.syncthing.net/users/versioning.html>.
+                          '';
+                        };
+                      };
+                    });
+                  };
+
+                  copyOwnershipFromParent = mkOption {
+                    type = types.bool;
+                    default = false;
+                    description = mdDoc ''
+                      On Unix systems, tries to copy file/folder ownership from the parent directory (the directory it’s located in).
+                      Requires running Syncthing as a privileged user, or granting it additional capabilities (e.g. CAP_CHOWN on Linux).
+                    '';
+                  };
+                };
+              }));
+            };
+
+          };
+        };
         default = {};
         description = mdDoc ''
           Extra configuration options for Syncthing.
@@ -530,6 +527,10 @@ in {
       This option was removed because Syncthing now has the inotify functionality included under the name "fswatcher".
       It can be enabled on a per-folder basis through the web interface.
     '')
+    (mkRenamedOptionModule [ "services" "syncthing" "extraOptions" ] [ "services" "syncthing" "settings" ])
+    (mkRenamedOptionModule [ "services" "syncthing" "folders" ] [ "services" "syncthing" "settings" "folders" ])
+    (mkRenamedOptionModule [ "services" "syncthing" "devices" ] [ "services" "syncthing" "settings" "devices" ])
+    (mkRenamedOptionModule [ "services" "syncthing" "options" ] [ "services" "syncthing" "settings" "options" ])
   ] ++ map (o:
     mkRenamedOptionModule [ "services" "syncthing" "declarative" o ] [ "services" "syncthing" o ]
   ) [ "cert" "key" "devices" "folders" "overrideDevices" "overrideFolders" "extraOptions"];
@@ -615,9 +616,7 @@ in {
           ];
         };
       };
-      syncthing-init = mkIf (
-        cfg.devices != {} || cfg.folders != {} || cfg.extraOptions != {}
-      ) {
+      syncthing-init = mkIf (cleanedConfig != {}) {
         description = "Syncthing configuration updater";
         requisite = [ "syncthing.service" ];
         after = [ "syncthing.service" ];
diff --git a/nixos/modules/services/networking/twingate.nix b/nixos/modules/services/networking/twingate.nix
index 1454a7431cd2..170d392bf213 100644
--- a/nixos/modules/services/networking/twingate.nix
+++ b/nixos/modules/services/networking/twingate.nix
@@ -12,7 +12,7 @@ in
   config = lib.mkIf cfg.enable {
     systemd.packages = [ cfg.package ];
     systemd.services.twingate = {
-      preStart = "cp -r -n ${cfg.package}/etc/twingate/. /etc/twingate/";
+      preStart = "cp -r --update=none ${cfg.package}/etc/twingate/. /etc/twingate/";
       wantedBy = [ "multi-user.target" ];
     };
 
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index a64f7c5ccbcf..80cf5cd3771b 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -728,6 +728,7 @@ in {
   switchTest = handleTest ./switch-test.nix {};
   sympa = handleTest ./sympa.nix {};
   syncthing = handleTest ./syncthing.nix {};
+  syncthing-no-settings = handleTest ./syncthing-no-settings.nix {};
   syncthing-init = handleTest ./syncthing-init.nix {};
   syncthing-relay = handleTest ./syncthing-relay.nix {};
   systemd = handleTest ./systemd.nix {};
diff --git a/nixos/tests/syncthing-init.nix b/nixos/tests/syncthing-init.nix
index 5102c0127832..195c157ffb6e 100644
--- a/nixos/tests/syncthing-init.nix
+++ b/nixos/tests/syncthing-init.nix
@@ -10,14 +10,14 @@ in {
   nodes.machine = {
     services.syncthing = {
       enable = true;
-      devices.${testName} = {
+      settings.devices.testDevice = {
         id = testId;
       };
-      folders.testFolder = {
+      settings.folders.testFolder = {
         path = "/tmp/test";
-        devices = [ testName ];
+        devices = [ "testDevice" ];
       };
-      extraOptions.gui.user = "guiUser";
+      settings.gui.user = "guiUser";
     };
   };
 
diff --git a/nixos/tests/syncthing-no-settings.nix b/nixos/tests/syncthing-no-settings.nix
new file mode 100644
index 000000000000..fee122b5e35c
--- /dev/null
+++ b/nixos/tests/syncthing-no-settings.nix
@@ -0,0 +1,18 @@
+import ./make-test-python.nix ({ lib, pkgs, ... }: {
+  name = "syncthing";
+  meta.maintainers = with pkgs.lib.maintainers; [ chkno ];
+
+  nodes = {
+    a = {
+      environment.systemPackages = with pkgs; [ curl libxml2 syncthing ];
+      services.syncthing = {
+        enable = true;
+      };
+    };
+  };
+  # Test that indeed a syncthing-init.service systemd service is not created.
+  #
+  testScript = /* python */ ''
+    a.succeed("systemctl list-unit-files | awk '$1 == \"syncthing-init.service\" {exit 1;}'")
+  '';
+})
diff --git a/pkgs/applications/misc/tint2/default.nix b/pkgs/applications/misc/tint2/default.nix
index 131cb0f22ad8..ac50a46fde6d 100644
--- a/pkgs/applications/misc/tint2/default.nix
+++ b/pkgs/applications/misc/tint2/default.nix
@@ -1,5 +1,6 @@
 { lib, stdenv
 , fetchFromGitLab
+, fetchpatch
 , pkg-config
 , cmake
 , gettext
@@ -24,15 +25,25 @@
 
 stdenv.mkDerivation rec {
   pname = "tint2";
-  version = "17.0.2";
+  version = "17.1.3";
 
   src = fetchFromGitLab {
-    owner = "o9000";
+    owner = "nick87720z";
     repo = "tint2";
     rev = version;
-    sha256 = "sha256-SqpAjclwu3HN07LAZgvXGzjMK6G+nYLDdl90o1+9aog=";
+    hash = "sha256-9sEe/Gnj+FWLPbWBtfL1YlNNC12j7/KjQ40xdkaFJVQ=";
   };
 
+  patches = [
+    # Fix crashes with glib >= 2.76
+    # https://patchespromptly.com/glib2/
+    # https://gitlab.com/nick87720z/tint2/-/issues/4
+    (fetchpatch {
+      url = "https://gitlab.com/nick87720z/tint2/uploads/7de4501a4fa4fffa5ba8bb0fa3d19f78/glib.patch";
+      hash = "sha256-K547KYlRkVl1s2THi3ZCRuM447EFJwTqUEBjKQnV8Sc=";
+    })
+  ];
+
   nativeBuildInputs = [
     pkg-config
     cmake
@@ -72,7 +83,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    homepage = "https://gitlab.com/o9000/tint2";
+    homepage = "https://gitlab.com/nick87720z/tint2";
     description = "Simple panel/taskbar unintrusive and light (memory, cpu, aestetic)";
     license = licenses.gpl2Only;
     platforms = platforms.linux;
diff --git a/pkgs/applications/networking/browsers/brave/default.nix b/pkgs/applications/networking/browsers/brave/default.nix
index 5f7d0b5ab3e8..bc6dd075ad2d 100644
--- a/pkgs/applications/networking/browsers/brave/default.nix
+++ b/pkgs/applications/networking/browsers/brave/default.nix
@@ -91,11 +91,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "brave";
-  version = "1.52.130";
+  version = "1.56.9";
 
   src = fetchurl {
     url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-    sha256 = "sha256-TKCAv1gGdAU9KDcrrREPgFjZOPNwTAfLrCh33DAf41U=";
+    sha256 = "sha256-cw41xUewYB/M6xHZhhL9nX1J9vnNGA9TFJWI/Qwdu/k=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/applications/networking/instant-messengers/teamspeak/client.nix b/pkgs/applications/networking/instant-messengers/teamspeak/client.nix
index 5a0a9006e0df..8735870e106d 100644
--- a/pkgs/applications/networking/instant-messengers/teamspeak/client.nix
+++ b/pkgs/applications/networking/instant-messengers/teamspeak/client.nix
@@ -1,19 +1,19 @@
 { lib, stdenv, fetchurl, makeWrapper, makeDesktopItem, zlib, glib, libpng, freetype, openssl
 , xorg, fontconfig, qtbase, qtwebengine, qtwebchannel, qtsvg, qtwebsockets, xkeyboard_config
-, alsa-lib, libpulseaudio ? null, libredirect, quazip, which, unzip, llvmPackages_10, writeShellScriptBin
+, alsa-lib, libpulseaudio ? null, libredirect, quazip, which, unzip, perl, llvmPackages
 }:
 
 let
 
-  arch = if stdenv.is64bit then "amd64" else "x86";
+  arch = "amd64";
 
-  libDir = if stdenv.is64bit then "lib64" else "lib";
+  libDir = "lib64";
 
   deps =
     [ zlib glib libpng freetype xorg.libSM xorg.libICE xorg.libXrender openssl
       xorg.libXrandr xorg.libXfixes xorg.libXcursor xorg.libXinerama
       xorg.libxcb fontconfig xorg.libXext xorg.libX11 alsa-lib qtbase qtwebengine qtwebchannel qtsvg
-      qtwebsockets libpulseaudio quazip llvmPackages_10.libcxx llvmPackages_10.libcxxabi # llvmPackages_11 and higher crash https://github.com/NixOS/nixpkgs/issues/161395
+      qtwebsockets libpulseaudio quazip llvmPackages.libcxx llvmPackages.libcxxabi
     ];
 
   desktopItem = makeDesktopItem {
@@ -25,21 +25,16 @@ let
     genericName = "TeamSpeak";
     categories = [ "Network" ];
   };
-
-  fakeLess = writeShellScriptBin "less" "cat";
-
 in
 
 stdenv.mkDerivation rec {
   pname = "teamspeak-client";
 
-  version = "3.5.6";
+  version = "3.6.0";
 
   src = fetchurl {
     url = "https://files.teamspeak-services.com/releases/client/${version}/TeamSpeak3-Client-linux_${arch}-${version}.run";
-    sha256 = if stdenv.is64bit
-                then "sha256:0hjai1bd4mq3g2dlyi0zkn8s4zlgxd38skw77mb78nc4di5gvgpg"
-                else "sha256:1y1c65nap91nv9xkvd96fagqbfl56p9n0rl6iac0i29bkysdmija";
+    hash = "sha256-ZbElnFoQmXdtCR9lb6eOz4dMzSwpfjC1DvG3VbDoSEA=";
   };
 
   # grab the plugin sdk for the desktop icon
@@ -48,11 +43,20 @@ stdenv.mkDerivation rec {
     sha256 = "1bywmdj54glzd0kffvr27r84n4dsd0pskkbmh59mllbxvj0qwy7f";
   };
 
-  nativeBuildInputs = [ makeWrapper fakeLess which unzip ];
+  nativeBuildInputs = [
+    makeWrapper
+    which
+    unzip
+    perl # Installer script needs `shasum`
+  ];
 
+  # This just runs the installer script. If it gets stuck at something like
+  # ++ exec
+  # + PAGER_PATH=
+  # it's looking for a dependency and didn't find it. Check the script and make sure the dep is in nativeBuildInputs.
   unpackPhase =
     ''
-      echo -e '\ny' | sh -xe $src
+      echo -e '\ny' | PAGER=cat sh -xe $src
       cd TeamSpeak*
     '';
 
@@ -110,8 +114,8 @@ stdenv.mkDerivation rec {
       url = "https://www.teamspeak.com/en/privacy-and-terms/";
       free = false;
     };
-    maintainers = with maintainers; [ lhvwb lukegb ];
-    platforms = [ "i686-linux" "x86_64-linux" ];
+    maintainers = with maintainers; [ lhvwb lukegb atemu ];
+    platforms = [ "x86_64-linux" ];
   };
 }
 
diff --git a/pkgs/applications/networking/seaweedfs/default.nix b/pkgs/applications/networking/seaweedfs/default.nix
index 160485dd0c3d..91e6fb58f49a 100644
--- a/pkgs/applications/networking/seaweedfs/default.nix
+++ b/pkgs/applications/networking/seaweedfs/default.nix
@@ -1,5 +1,6 @@
 { lib
 , fetchFromGitHub
+, fetchpatch
 , buildGoModule
 , testers
 , seaweedfs
@@ -7,16 +8,26 @@
 
 buildGoModule rec {
   pname = "seaweedfs";
-  version = "3.53";
+  version = "3.54";
 
   src = fetchFromGitHub {
     owner = "seaweedfs";
     repo = "seaweedfs";
     rev = version;
-    hash = "sha256-VfKzptMxT2ra1uVzbL52EWjEGHTxmnh5xZGiQpRivTU=";
+    hash = "sha256-2E2ANJIKWhUUxxSqk5+QROeoKnp1Akl5Bp+i8pPTkuQ=";
   };
 
-  vendorHash = "sha256-kL6huukrM4YeU7uvj7abXOEAvRhm1Nfp4JODW4BTy0A=";
+  patches = [
+    # Fix build on aarch64-darwin
+    # (remove again when v3.55 is released)
+    # https://github.com/seaweedfs/seaweedfs/pull/4679
+    (fetchpatch {
+      url = "https://github.com/seaweedfs/seaweedfs/commit/1bfc9581e0bc04f394187a0d39f319ad65df5aca.patch";
+      hash = "sha256-znQFtm8BYAjuvXa+vibawBb+uhnjOL9/o0sXNoXwLk8=";
+    })
+  ];
+
+  vendorHash = "sha256-VK7BmApGq+X1oNjcwCSYHcEvVjL87t8fgJXLNQSfy3I=";
 
   subPackages = [ "weed" ];
 
diff --git a/pkgs/applications/video/qmplay2/default.nix b/pkgs/applications/video/qmplay2/default.nix
index 72dd59613444..cf942202e5f4 100644
--- a/pkgs/applications/video/qmplay2/default.nix
+++ b/pkgs/applications/video/qmplay2/default.nix
@@ -4,7 +4,9 @@
 , alsa-lib
 , cmake
 , ffmpeg
+, fribidi
 , game-music-emu
+, libXdmcp
 , libXv
 , libass
 , libcddb
@@ -12,6 +14,7 @@
 , libpulseaudio
 , libsidplayfp
 , libva
+, libxcb
 , pkg-config
 , qtbase
 , qttools
@@ -23,14 +26,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "qmplay2";
-  version = "23.02.05";
+  version = "23.06.17";
 
   src = fetchFromGitHub {
     owner = "zaps166";
     repo = "QMPlay2";
     rev = finalAttrs.version;
-    sha256 = "sha256-ZDpUgD9qTvjopGFVrwTBSEmrXn+4aKq2zeqoTnXwmI8=";
     fetchSubmodules = true;
+    hash = "sha256-f4lIXB0eTyteCJdWFP0XnsnxGWc32CV+HlqpaCjmgOE=";
   };
 
   nativeBuildInputs = [
@@ -42,7 +45,9 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = [
     alsa-lib
     ffmpeg
+    fribidi
     game-music-emu
+    libXdmcp
     libXv
     libass
     libcddb
@@ -50,6 +55,7 @@ stdenv.mkDerivation (finalAttrs: {
     libpulseaudio
     libsidplayfp
     libva
+    libxcb
     qtbase
     qttools
     taglib
diff --git a/pkgs/applications/window-managers/sway/osd.nix b/pkgs/applications/window-managers/sway/osd.nix
index bc634d1b34be..2b210efedb9d 100644
--- a/pkgs/applications/window-managers/sway/osd.nix
+++ b/pkgs/applications/window-managers/sway/osd.nix
@@ -4,21 +4,24 @@
 , pkg-config
 , wrapGAppsHook
 , gtk-layer-shell
+, libevdev
+, libinput
 , libpulseaudio
+, udev
 }:
 
 rustPlatform.buildRustPackage {
   pname = "swayosd";
-  version = "unstable-2023-05-09";
+  version = "unstable-2023-07-18";
 
   src = fetchFromGitHub {
     owner = "ErikReider";
     repo = "SwayOSD";
-    rev = "5c2176ae6a01a18fdc2b0f5d5f593737b5765914";
-    hash = "sha256-rh42J6LWgNPOWYLaIwocU1JtQnA5P1jocN3ywVOfYoc=";
+    rev = "b14c83889c7860c174276d05dec6554169a681d9";
+    hash = "sha256-MJuTwEI599Y7q+0u0DMxRYaXsZfpksc2csgnK9Ghp/E=";
   };
 
-  cargoHash = "sha256-ZcgrUcRQTcEYhw2mpJDuYDz3I/u/2Q+O60ajXYRMeow=";
+  cargoHash = "sha256-pExpzQwuHREhgkj+eZ8drBVsh/B3WiQBBh906O6ymFw=";
 
   nativeBuildInputs = [
     wrapGAppsHook
@@ -27,7 +30,10 @@ rustPlatform.buildRustPackage {
 
   buildInputs = [
     gtk-layer-shell
+    libevdev
+    libinput
     libpulseaudio
+    udev
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/google-cloud-artifact-registry/default.nix b/pkgs/development/python-modules/google-cloud-artifact-registry/default.nix
new file mode 100644
index 000000000000..f88c5e2cef07
--- /dev/null
+++ b/pkgs/development/python-modules/google-cloud-artifact-registry/default.nix
@@ -0,0 +1,41 @@
+{ buildPythonPackage
+, fetchPypi
+, google-api-core
+, grpc-google-iam-v1
+, lib
+, pytestCheckHook
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "google-cloud-artifact-registry";
+  version = "1.8.2";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-FuuxwOMV7IB1drn5hzX7p4BwJYQCUsgnZNVR+E6XKhM=";
+  };
+
+  propagatedBuildInputs = [
+    google-api-core
+    grpc-google-iam-v1
+  ] ++ google-api-core.optional-dependencies.grpc;
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [
+    "google.cloud.artifactregistry"
+    "google.cloud.artifactregistry_v1"
+    "google.cloud.artifactregistry_v1beta2"
+  ];
+
+  meta = with lib; {
+    description = "Google Cloud Artifact Registry API client library";
+    homepage = "https://github.com/googleapis/google-cloud-python";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ samuela ];
+  };
+}
diff --git a/pkgs/development/python-modules/slack-bolt/default.nix b/pkgs/development/python-modules/slack-bolt/default.nix
new file mode 100644
index 000000000000..ca360eb0bd46
--- /dev/null
+++ b/pkgs/development/python-modules/slack-bolt/default.nix
@@ -0,0 +1,81 @@
+{ buildPythonPackage
+, chalice
+, cherrypy
+, django
+, falcon
+, fastapi
+, fetchFromGitHub
+, flask
+, flask-sockets
+, lib
+, moto
+, numpy
+, pyramid
+, pytest-asyncio
+, pytestCheckHook
+, sanic
+, sanic-testing
+, slack-sdk
+, starlette
+, tornado
+}:
+
+buildPythonPackage rec {
+  pname = "slack-bolt";
+  version = "1.18.0";
+  format = "setuptools";
+
+  src = fetchFromGitHub {
+    owner = "slackapi";
+    repo = "bolt-python";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-s9djd/MDNnyNkjkeApY6Fb1mhI6iop8RghaSJdi4eAs=";
+  };
+
+  propagatedBuildInputs = [ slack-sdk ];
+
+  nativeCheckInputs = [
+    chalice
+    cherrypy
+    django
+    falcon
+    fastapi
+    flask
+    flask-sockets
+    moto
+    pyramid
+    pytest-asyncio
+    pytestCheckHook
+    sanic
+    sanic-testing
+    starlette
+    tornado
+  ];
+
+  # Work around "Read-only file system: '/homeless-shelter'" errors
+  preCheck = ''
+    export HOME="$(mktemp -d)"
+  '';
+
+  disabledTestPaths = [
+    # boddle is not packaged as of 2023-07-15
+    "tests/adapter_tests/bottle/"
+  ];
+
+  disabledTests = [
+    # Require network access
+    "test_events"
+    "test_interactions"
+    "test_lazy_listener_calls"
+    "test_lazy_listeners"
+  ];
+
+  pythonImportsCheck = [ "slack_bolt" ];
+
+  meta = with lib; {
+    description = "A framework to build Slack apps using Python";
+    homepage = "https://github.com/slackapi/bolt-python";
+    license = licenses.mit;
+    maintainers = with maintainers; [ samuela ];
+  };
+}
diff --git a/pkgs/development/python-modules/slack-sdk/default.nix b/pkgs/development/python-modules/slack-sdk/default.nix
index 6d805c35f021..433f9ad62a85 100644
--- a/pkgs/development/python-modules/slack-sdk/default.nix
+++ b/pkgs/development/python-modules/slack-sdk/default.nix
@@ -5,7 +5,6 @@
 , boto3
 , buildPythonPackage
 , codecov
-, databases
 , fetchFromGitHub
 , flake8
 , flask-sockets
@@ -21,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "slack-sdk";
-  version = "3.20.2";
+  version = "3.21.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -30,7 +29,7 @@ buildPythonPackage rec {
     owner = "slackapi";
     repo = "python-slack-sdk";
     rev = "refs/tags/v${version}";
-    hash = "sha256-2MPXV+rVXZYMTZe11T8x8GKQmHZwUlkwarCkheVkERo=";
+    hash = "sha256-begpT/DaDqOi8HZE10FCuIIv18KSU/i5G/Z5DXKUT7Y=";
   };
 
   propagatedBuildInputs = [
@@ -44,7 +43,6 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     codecov
-    databases
     flake8
     flask-sockets
     moto
@@ -67,6 +65,7 @@ buildPythonPackage rec {
     "test_start_raises_an_error_if_rtm_ws_url_is_not_returned"
     "test_org_installation"
     "test_interactions"
+    "test_issue_690_oauth_access"
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/trimesh/default.nix b/pkgs/development/python-modules/trimesh/default.nix
index 0897c317d574..6a60b75cc194 100644
--- a/pkgs/development/python-modules/trimesh/default.nix
+++ b/pkgs/development/python-modules/trimesh/default.nix
@@ -2,18 +2,21 @@
 , buildPythonPackage
 , fetchPypi
 , setuptools
+, pythonOlder
 , numpy
 , lxml
 }:
 
 buildPythonPackage rec {
   pname = "trimesh";
-  version = "3.22.4";
+  version = "3.22.5";
   format = "pyproject";
 
+  disabled = pythonOlder "3.7";
+
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-DFOtanrrc3Jufuu5ybbbc0xJX29CVp2tFOP93QFoJeM=";
+    hash = "sha256-Lk30HShbVSBeiclfxJUkd7W2HfvLsZiUdYqebLI7otw=";
   };
 
   nativeBuildInputs = [ setuptools ];
@@ -33,6 +36,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python library for loading and using triangular meshes";
     homepage = "https://trimsh.org/";
+    changelog = "https://github.com/mikedh/trimesh/releases/tag/${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ gebner ];
   };
diff --git a/pkgs/development/python-modules/wandb/default.nix b/pkgs/development/python-modules/wandb/default.nix
index 9ccb68067b72..fa57b0072892 100644
--- a/pkgs/development/python-modules/wandb/default.nix
+++ b/pkgs/development/python-modules/wandb/default.nix
@@ -1,7 +1,10 @@
 { lib
 , stdenv
 , appdirs
+, azure-containerregistry
 , azure-core
+, azure-identity
+, azure-storage-blob
 , bokeh
 , boto3
 , buildPythonPackage
@@ -11,6 +14,7 @@
 , flask
 , git
 , gitpython
+, google-cloud-artifact-registry
 , google-cloud-compute
 , google-cloud-storage
 , hypothesis
@@ -51,7 +55,7 @@
 
 buildPythonPackage rec {
   pname = "wandb";
-  version = "0.15.3";
+  version = "0.15.5";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -60,7 +64,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-i1Lo6xbkCgRTJwRjk2bXkZ5a/JRUCzFzmEuPQlPvZf4=";
+    hash = "sha256-etS1NkkskA5Lg/38QIdzCVWgqZpjpT2LwaWF1k7WVXs=";
   };
 
   patches = [
@@ -94,10 +98,14 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
+    azure-containerregistry
     azure-core
+    azure-identity
+    azure-storage-blob
     bokeh
     boto3
     flask
+    google-cloud-artifact-registry
     google-cloud-compute
     google-cloud-storage
     hypothesis
@@ -213,17 +221,17 @@ buildPythonPackage rec {
     "tests/pytest_tests/system_tests/test_sweep/test_wandb_agent.py"
     "tests/pytest_tests/system_tests/test_sweep/test_wandb_sweep.py"
     "tests/pytest_tests/system_tests/test_system_metrics/test_open_metrics.py"
-    "tests/pytest_tests/system_tests/tests_launch/test_github_reference.py"
-    "tests/pytest_tests/system_tests/tests_launch/test_job.py"
-    "tests/pytest_tests/system_tests/tests_launch/test_launch_add.py"
-    "tests/pytest_tests/system_tests/tests_launch/test_launch_cli.py"
-    "tests/pytest_tests/system_tests/tests_launch/test_launch_kubernetes.py"
-    "tests/pytest_tests/system_tests/tests_launch/test_launch_local_container.py"
-    "tests/pytest_tests/system_tests/tests_launch/test_launch_run.py"
-    "tests/pytest_tests/system_tests/tests_launch/test_launch_sweep_cli.py"
-    "tests/pytest_tests/system_tests/tests_launch/test_launch_sweep.py"
-    "tests/pytest_tests/system_tests/tests_launch/test_launch.py"
-    "tests/pytest_tests/system_tests/tests_launch/test_wandb_reference.py"
+    "tests/pytest_tests/system_tests/test_launch/test_github_reference.py"
+    "tests/pytest_tests/system_tests/test_launch/test_job.py"
+    "tests/pytest_tests/system_tests/test_launch/test_launch_add.py"
+    "tests/pytest_tests/system_tests/test_launch/test_launch_cli.py"
+    "tests/pytest_tests/system_tests/test_launch/test_launch_kubernetes.py"
+    "tests/pytest_tests/system_tests/test_launch/test_launch_local_container.py"
+    "tests/pytest_tests/system_tests/test_launch/test_launch_run.py"
+    "tests/pytest_tests/system_tests/test_launch/test_launch_sweep_cli.py"
+    "tests/pytest_tests/system_tests/test_launch/test_launch_sweep.py"
+    "tests/pytest_tests/system_tests/test_launch/test_launch.py"
+    "tests/pytest_tests/system_tests/test_launch/test_wandb_reference.py"
 
     # Tries to access /homeless-shelter
     "tests/pytest_tests/unit_tests/test_tables.py"
diff --git a/pkgs/development/tools/capnproto-rust/default.nix b/pkgs/development/tools/capnproto-rust/default.nix
index f3015427add7..e63cca6a5e90 100644
--- a/pkgs/development/tools/capnproto-rust/default.nix
+++ b/pkgs/development/tools/capnproto-rust/default.nix
@@ -6,15 +6,20 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "capnproto-rust";
-  version = "0.17.1";
+  version = "0.17.2";
 
   src = fetchCrate {
     crateName = "capnpc";
     inherit version;
-    sha256 = "sha256-7RfJUYV3X9w0FALP3pbhmeIqrWLqlgr4oNvPnBc+RY8=";
+    hash = "sha256-WVjXVLVoTCAtA8a6+zaX4itAaPCWb2c0trtSsxBopO4=";
   };
 
-  cargoHash = "sha256-wmoXdukXWagW61jbFBODnIjlBrV6Q+wgvuFG/TqkvVk=";
+  cargoHash = "sha256-h9YArxHnY14T8eQCS4JVItjaCjv+2dorcOVBir7r6SY=";
+
+  postInstall = ''
+    mkdir -p $out/include/capnp
+    cp rust.capnp $out/include/capnp
+  '';
 
   nativeCheckInputs = [
     capnproto
@@ -24,6 +29,6 @@ rustPlatform.buildRustPackage rec {
     description = "Cap'n Proto codegen plugin for Rust";
     homepage = "https://github.com/capnproto/capnproto-rust";
     license = licenses.mit;
-    maintainers = with maintainers; [ mikroskeem ];
+    maintainers = with maintainers; [ mikroskeem solson ];
   };
 }
diff --git a/pkgs/development/tools/symfony-cli/default.nix b/pkgs/development/tools/symfony-cli/default.nix
index f17f00e79da3..aee1a2d150a6 100644
--- a/pkgs/development/tools/symfony-cli/default.nix
+++ b/pkgs/development/tools/symfony-cli/default.nix
@@ -2,14 +2,14 @@
 
 buildGoModule rec {
   pname = "symfony-cli";
-  version = "5.5.6";
-  vendorHash = "sha256-AfgDsd4W8wV0GeymD9SLeHtOeFP9qbFy+GTdMxQSkDA=";
+  version = "5.5.7";
+  vendorHash = "sha256-OXV/hTSHJvYfe2SiFamkedC01J/DOgd8I60yIpQToos=";
 
   src = fetchFromGitHub {
     owner = "symfony-cli";
     repo = "symfony-cli";
     rev = "v${version}";
-    sha256 = "sha256-lE8RBjBXucL0DJjEnBLbHqOVE6g358rwmaEUqU6QhOw=";
+    hash = "sha256-LC6QQIVHllBRu8B6XfV8SuTB3O+FmqYr+LQnVmLj2nU=";
   };
 
   ldflags = [
@@ -27,11 +27,11 @@ buildGoModule rec {
     $GOPATH/bin/symfony-cli
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Symfony CLI";
     homepage = "https://github.com/symfony-cli/symfony-cli";
-    license = licenses.agpl3Plus;
-    maintainers = with maintainers; [ drupol ];
+    license = lib.licenses.agpl3Plus;
     mainProgram = "symfony";
+    maintainers = with lib.maintainers; [ drupol ];
   };
 }
diff --git a/pkgs/os-specific/linux/fanout/default.nix b/pkgs/os-specific/linux/fanout/default.nix
new file mode 100644
index 000000000000..3352f59a05f7
--- /dev/null
+++ b/pkgs/os-specific/linux/fanout/default.nix
@@ -0,0 +1,37 @@
+{ lib, stdenv, fetchFromGitHub, kernel, kmod }:
+
+stdenv.mkDerivation rec {
+  pname = "fanout";
+  version = "unstable-2022-10-17-${kernel.version}";
+
+  src = fetchFromGitHub {
+    owner = "bob-linuxtoys";
+    repo = "fanout";
+    rev = "69b1cc69bf425d1a5f83b4e84d41272f1caa0144";
+    hash = "sha256-Q19c88KDFu0A6MejZgKYei9J2693EjRkKtR9hcRcHa0=";
+  };
+
+  preBuild = ''
+    substituteInPlace Makefile --replace "modules_install" "INSTALL_MOD_PATH=$out modules_install"
+  '';
+
+  patches = [
+    ./remove_auto_mknod.patch
+  ];
+
+  hardeningDisable = [ "format" "pic" ];
+
+  nativeBuildInputs = [ kmod ] ++ kernel.moduleBuildDependencies;
+
+  makeFlags = kernel.makeFlags ++ [
+    "KERNELDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+  ];
+
+  meta = with lib; {
+    description = "Kernel-based publish-subscribe system";
+    homepage = "https://github.com/bob-linuxtoys/fanout";
+    license = licenses.gpl2Only;
+    maintainers = with maintainers; [ therishidesai ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/fanout/remove_auto_mknod.patch b/pkgs/os-specific/linux/fanout/remove_auto_mknod.patch
new file mode 100644
index 000000000000..1f62e2b4633b
--- /dev/null
+++ b/pkgs/os-specific/linux/fanout/remove_auto_mknod.patch
@@ -0,0 +1,13 @@
+diff --git a/fanout.c b/fanout.c
+index f5d2a55..87125f4 100644
+--- a/fanout.c
++++ b/fanout.c
+@@ -13,7 +13,7 @@
+ /* Comment out to forgo the creation of /dev entries
+  * The companion udev rules 'fanout.rules' sets the special file mode
+  */
+-#define DEV_MKNOD
++// #define DEV_MKNOD
+ 
+ #include <linux/kernel.h>
+ #include <linux/module.h>
diff --git a/pkgs/servers/mastodon/default.nix b/pkgs/servers/mastodon/default.nix
index 422b3e2be5c5..1547485a0378 100644
--- a/pkgs/servers/mastodon/default.nix
+++ b/pkgs/servers/mastodon/default.nix
@@ -156,7 +156,8 @@ stdenv.mkDerivation rec {
 
   passthru = {
     tests.mastodon = nixosTests.mastodon;
-    updateScript = callPackage ./update.nix {};
+    # run with: nix-shell ./maintainers/scripts/update.nix --argstr package mastodon
+    updateScript = ./update.sh;
   };
 
   meta = with lib; {
diff --git a/pkgs/servers/mastodon/update.nix b/pkgs/servers/mastodon/update.nix
deleted file mode 100644
index f9dc8db3980a..000000000000
--- a/pkgs/servers/mastodon/update.nix
+++ /dev/null
@@ -1,29 +0,0 @@
-{ runCommand
-, lib
-, makeWrapper
-, yarn2nix
-, bundix
-, coreutils
-, diffutils
-, nix-prefetch-github
-, gnused
-, jq
-}:
-let
-  binPath = lib.makeBinPath [ yarn2nix bundix coreutils diffutils nix-prefetch-github gnused jq ];
-in
-runCommand "mastodon-update-script"
-{
-  nativeBuildInputs = [ makeWrapper ];
-
-  meta = {
-    maintainers = with lib.maintainers; [ happy-river ];
-    description = "Utility to generate Nix expressions for Mastodon's dependencies";
-    platforms = lib.platforms.unix;
-  };
-} ''
-  mkdir -p $out/bin
-  cp ${./update.sh} $out/bin/update.sh
-  patchShebangs $out/bin/update.sh
-  wrapProgram $out/bin/update.sh --prefix PATH : ${binPath}
-''
diff --git a/pkgs/servers/mastodon/update.sh b/pkgs/servers/mastodon/update.sh
index 74a1ce129ab4..4a7e6e178730 100755
--- a/pkgs/servers/mastodon/update.sh
+++ b/pkgs/servers/mastodon/update.sh
@@ -1,4 +1,5 @@
-#!/usr/bin/env bash
+#!/usr/bin/env nix-shell
+#! nix-shell -i bash -p yarn2nix bundix coreutils diffutils nix-prefetch-github gnused jq
 set -e
 
 OWNER=mastodon
@@ -41,22 +42,22 @@ while [[ $# -gt 0 ]]; do
     esac
 done
 
-if [[ -z "$VERSION" || -n "$POSITIONAL" ]]; then
-    echo "Usage: update.sh [--owner OWNER] [--repo REPO] --ver VERSION [--rev REVISION] [--patches PATCHES]"
-    echo "OWNER and repo must be paths on github."
-    echo "If VERSION is not a revision acceptable to 'git checkout', you must provide one in REVISION."
+if [[ -n "$POSITIONAL" ]]; then
+    echo "Usage: update.sh [--owner OWNER] [--repo REPO] [--ver VERSION] [--rev REVISION] [--patches PATCHES]"
+    echo "OWNER and REPO must be paths on github."
+    echo "If REVISION is not provided, the latest tag from github.com/mastodon/mastodon is fetched and VERSION is calculated from it."
     echo "If OWNER and REPO are not provided, it defaults they default to mastodon and mastodon."
     echo "PATCHES, if provided, should be one or more Nix expressions separated by spaces."
     exit 1
 fi
 
 if [[ -z "$REVISION" ]]; then
-    REVISION="$VERSION"
+    REVISION="$(curl ${GITHUB_TOKEN:+" -u \":$GITHUB_TOKEN\""} -s "https://api.github.com/repos/$OWNER/$REPO/releases" | jq -r  'map(select(.prerelease == false)) | .[0].tag_name')"
+    VERSION="$(echo "$REVISION" | cut -c2-)"
 fi
 
 rm -f gemset.nix version.nix source.nix
-TARGET_DIR="$PWD"
-
+cd "$(dirname "${BASH_SOURCE[0]}")" || exit 1
 
 WORK_DIR=$(mktemp -d)
 
@@ -85,8 +86,8 @@ cat > source.nix << EOF
 # This file was generated by pkgs.mastodon.updateScript.
 { fetchFromGitHub, applyPatches }: let
   src = fetchFromGitHub {
-    owner = "mastodon";
-    repo = "mastodon";
+    owner = "$OWNER";
+    repo = "$REPO";
     rev = "$REVISION";
     hash = "$HASH";
   };
@@ -99,4 +100,4 @@ SOURCE_DIR="$(nix-build --no-out-link -E '(import <nixpkgs> {}).callPackage ./so
 
 echo "Creating gemset.nix"
 bundix --lockfile="$SOURCE_DIR/Gemfile.lock" --gemfile="$SOURCE_DIR/Gemfile"
-echo "" >> "$TARGET_DIR/gemset.nix"  # Create trailing newline to please EditorConfig checks
+echo "" >> gemset.nix  # Create trailing newline to please EditorConfig checks
diff --git a/pkgs/servers/nosql/apache-jena/binary.nix b/pkgs/servers/nosql/apache-jena/binary.nix
index 504f970e90fc..2277c997b7a8 100644
--- a/pkgs/servers/nosql/apache-jena/binary.nix
+++ b/pkgs/servers/nosql/apache-jena/binary.nix
@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   pname = "apache-jena";
-  version = "4.8.0";
+  version = "4.9.0";
   src = fetchurl {
     url = "mirror://apache/jena/binaries/apache-jena-${version}.tar.gz";
-    hash = "sha256-kAbhH0E2C1ToxDQgFUqWxvknCeFZbtqFhOmiSJ//ciU=";
+    hash = "sha256-kUsEdEKwYjyM5G8YKTt90fWzX21hiulRj3W5jK45Keg=";
   };
   nativeBuildInputs = [
     makeWrapper
diff --git a/pkgs/servers/nosql/apache-jena/fuseki-binary.nix b/pkgs/servers/nosql/apache-jena/fuseki-binary.nix
index 9e911721a32a..ac82f7659d9c 100644
--- a/pkgs/servers/nosql/apache-jena/fuseki-binary.nix
+++ b/pkgs/servers/nosql/apache-jena/fuseki-binary.nix
@@ -1,11 +1,20 @@
-{ lib, stdenv, fetchurl, java, makeWrapper }:
+{ lib
+, stdenv
+, fetchurl
+, java
+, coreutils
+, which
+, makeWrapper
+  # For the test
+, pkgs
+}:
 
 stdenv.mkDerivation rec {
   pname = "apache-jena-fuseki";
-  version = "4.8.0";
+  version = "4.9.0";
   src = fetchurl {
     url = "mirror://apache/jena/binaries/apache-jena-fuseki-${version}.tar.gz";
-    hash = "sha256-rJCY8vG1vfEGGA0gsIqNFXKl75O2Zp4zUIWSDfplpVE=";
+    hash = "sha256-t25Q0lb+ecR12cDD1p6eZnzLxW0kZpPOFGvo5YK7AlI=";
   };
   nativeBuildInputs = [
     makeWrapper
@@ -16,11 +25,16 @@ stdenv.mkDerivation rec {
     ln -s "$out"/{fuseki-backup,fuseki-server,fuseki} "$out/bin"
     for i in "$out"/bin/*; do
       wrapProgram "$i" \
-        --prefix "PATH" : "${java}/bin/" \
+        --prefix "PATH" : "${java}/bin/:${coreutils}/bin:${which}/bin" \
         --set-default "FUSEKI_HOME" "$out" \
         ;
     done
   '';
+  passthru = {
+    tests = {
+      basic-test = pkgs.callPackage ./fuseki-test.nix { };
+    };
+  };
   meta = with lib; {
     description = "SPARQL server";
     license = licenses.asl20;
diff --git a/pkgs/servers/nosql/apache-jena/fuseki-test.nix b/pkgs/servers/nosql/apache-jena/fuseki-test.nix
new file mode 100644
index 000000000000..cdf1c2d7a147
--- /dev/null
+++ b/pkgs/servers/nosql/apache-jena/fuseki-test.nix
@@ -0,0 +1,18 @@
+{ lib, runCommandNoCC, apache-jena-fuseki, curl }:
+runCommandNoCC "fuseki-test-${apache-jena-fuseki.name}"
+{ nativeBuildInputs = [ curl apache-jena-fuseki ]; } ''
+  export FUSEKI_BASE="$PWD/fuseki-base"
+  mkdir -p "$FUSEKI_BASE/db"
+  FUSEKI_ARGS="--update --loc=$FUSEKI_BASE/db /dataset" fuseki start
+  fuseki status
+  for i in $(seq 120); do
+      if  curl http://127.0.0.1:3030/dataset/data; then
+          break;
+      fi
+      sleep 1
+  done
+  curl -d 'update=insert+data+{+<test://subject>+<test://predicate>+<test://object>+}' http://127.0.0.1:3030/dataset/update > /dev/null
+  curl http://127.0.0.1:3030/dataset/data | grep -C999 'test://predicate'
+  curl -d 'query=select+?s+?p+?o+where+{+?s+?p+?o+.+}' http://127.0.0.1:3030/dataset/query | grep -C999 'test://predicate'
+  touch $out
+''
diff --git a/pkgs/stdenv/adapters.nix b/pkgs/stdenv/adapters.nix
index 22da13f5d1eb..f29bdf671c8c 100644
--- a/pkgs/stdenv/adapters.nix
+++ b/pkgs/stdenv/adapters.nix
@@ -67,7 +67,7 @@ rec {
             "--disable-shared" # brrr...
           ];
       }));
-    } // lib.optionalAttrs (stdenv0.hostPlatform.libc == "libc") {
+    } // lib.optionalAttrs (stdenv0.hostPlatform.libc == "glibc") {
       extraBuildInputs = (old.extraBuildInputs or []) ++ [
         pkgs.glibc.static
       ];
@@ -121,9 +121,6 @@ rec {
     # Apple does not provide a static version of libSystem or crt0.o
     # So we can’t build static binaries without extensive hacks.
     ++ lib.optional (!stdenv.hostPlatform.isDarwin) makeStaticBinaries
-
-    # Glibc doesn’t come with static runtimes by default.
-    # ++ lib.optional (stdenv.hostPlatform.libc == "glibc") ((lib.flip overrideInStdenv) [ self.glibc.static ])
   );
 
 
diff --git a/pkgs/tools/security/metasploit/Gemfile b/pkgs/tools/security/metasploit/Gemfile
index b21bf4d02ea9..e5aca4f11ffe 100644
--- a/pkgs/tools/security/metasploit/Gemfile
+++ b/pkgs/tools/security/metasploit/Gemfile
@@ -1,4 +1,4 @@
 # frozen_string_literal: true
 source "https://rubygems.org"
 
-gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.3.25"
+gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.3.26"
diff --git a/pkgs/tools/security/metasploit/Gemfile.lock b/pkgs/tools/security/metasploit/Gemfile.lock
index b791e4d68b1a..3bd2348d76f0 100644
--- a/pkgs/tools/security/metasploit/Gemfile.lock
+++ b/pkgs/tools/security/metasploit/Gemfile.lock
@@ -1,9 +1,9 @@
 GIT
   remote: https://github.com/rapid7/metasploit-framework
-  revision: ba44d1810c38a63f46b3c1fb9290de4a384b802d
-  ref: refs/tags/6.3.25
+  revision: dd1f90dd6fd267d8430d8e0299ebcfe6a85327cf
+  ref: refs/tags/6.3.26
   specs:
-    metasploit-framework (6.3.25)
+    metasploit-framework (6.3.26)
       actionpack (~> 7.0)
       activerecord (~> 7.0)
       activesupport (~> 7.0)
@@ -131,22 +131,22 @@ GEM
     arel-helpers (2.14.0)
       activerecord (>= 3.1.0, < 8)
     aws-eventstream (1.2.0)
-    aws-partitions (1.785.0)
+    aws-partitions (1.790.0)
     aws-sdk-core (3.178.0)
       aws-eventstream (~> 1, >= 1.0.2)
       aws-partitions (~> 1, >= 1.651.0)
       aws-sigv4 (~> 1.5)
       jmespath (~> 1, >= 1.6.1)
-    aws-sdk-ec2 (1.389.0)
+    aws-sdk-ec2 (1.392.0)
       aws-sdk-core (~> 3, >= 3.177.0)
       aws-sigv4 (~> 1.1)
-    aws-sdk-iam (1.85.0)
+    aws-sdk-iam (1.86.0)
       aws-sdk-core (~> 3, >= 3.177.0)
       aws-sigv4 (~> 1.1)
     aws-sdk-kms (1.71.0)
       aws-sdk-core (~> 3, >= 3.177.0)
       aws-sigv4 (~> 1.1)
-    aws-sdk-s3 (1.129.0)
+    aws-sdk-s3 (1.131.0)
       aws-sdk-core (~> 3, >= 3.177.0)
       aws-sdk-kms (~> 1)
       aws-sigv4 (~> 1.6)
@@ -212,7 +212,7 @@ GEM
     i18n (1.14.1)
       concurrent-ruby (~> 1.0)
     io-console (0.6.0)
-    irb (1.7.3)
+    irb (1.7.4)
       reline (>= 0.3.6)
     jmespath (1.6.2)
     jsobfu (0.4.2)
@@ -258,7 +258,7 @@ GEM
       webrick
     metasploit_payloads-mettle (1.0.20)
     method_source (1.0.0)
-    mini_portile2 (2.8.2)
+    mini_portile2 (2.8.4)
     minitest (5.18.1)
     mqtt (0.6.0)
     msgpack (1.6.1)
diff --git a/pkgs/tools/security/metasploit/default.nix b/pkgs/tools/security/metasploit/default.nix
index fe3d5979d521..88f25a706571 100644
--- a/pkgs/tools/security/metasploit/default.nix
+++ b/pkgs/tools/security/metasploit/default.nix
@@ -15,13 +15,13 @@ let
   };
 in stdenv.mkDerivation rec {
   pname = "metasploit-framework";
-  version = "6.3.25";
+  version = "6.3.26";
 
   src = fetchFromGitHub {
     owner = "rapid7";
     repo = "metasploit-framework";
     rev = version;
-    sha256 = "sha256-ezAlfG9ZDJ1QowwNUCpkHkjxV2qKITE/qftN2sWq6CE=";
+    sha256 = "sha256-GSf+GE4LeZxmhTskiwWjWf9rc6K4wg357MuK5cbLuMs=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/security/metasploit/gemset.nix b/pkgs/tools/security/metasploit/gemset.nix
index bf050dcfffae..6cfc7da1e69e 100644
--- a/pkgs/tools/security/metasploit/gemset.nix
+++ b/pkgs/tools/security/metasploit/gemset.nix
@@ -104,10 +104,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "05m0c3h1z0jhaqiciil55fshrjvc725cf1lc0g933pf98vqflb0r";
+      sha256 = "1mjzb10zyx78hnnz6j4bjv3awpgajfi0nmavrhy9x1qsf7yc9bjd";
       type = "gem";
     };
-    version = "1.785.0";
+    version = "1.790.0";
   };
   aws-sdk-core = {
     groups = ["default"];
@@ -124,20 +124,20 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "19pfwc0884g9afjh18q76snr9ldnihksmagf36yiqchnvvk956lj";
+      sha256 = "15vb0gn23xig6alcxh487r0jl5cdxm45b6zihh3wscvfzwqq0n5n";
       type = "gem";
     };
-    version = "1.389.0";
+    version = "1.392.0";
   };
   aws-sdk-iam = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "12hk0ylwjc6jq4qvw08v27ggh9pgfyi1j24jjb0lxb1p21m8ljpi";
+      sha256 = "02bp18pi29zncznkzkjzlg5j1cl99q41xvw0z5qx9q55mcwaj7i8";
       type = "gem";
     };
-    version = "1.85.0";
+    version = "1.86.0";
   };
   aws-sdk-kms = {
     groups = ["default"];
@@ -154,10 +154,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "06hgrc39ngs8nis2f85z5gg4ihskk9x3xv6vamc4wx927nsymf42";
+      sha256 = "1855m1v6lh9rji543nvk0fjn98ma0q2978zc4f5y76qsibl7fg6c";
       type = "gem";
     };
-    version = "1.129.0";
+    version = "1.131.0";
   };
   aws-sdk-ssm = {
     groups = ["default"];
@@ -534,10 +534,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0dhwvflcssva4s7ad4sddr2zra8723l2hm1px2rg63ljnh0bgvr3";
+      sha256 = "158ca10kj3qqnql5g8f1g2arsnhgdl79mg74manpf8ldkwjjn3n8";
       type = "gem";
     };
-    version = "1.7.3";
+    version = "1.7.4";
   };
   jmespath = {
     groups = ["default"];
@@ -634,12 +634,12 @@
     platforms = [];
     source = {
       fetchSubmodules = false;
-      rev = "ba44d1810c38a63f46b3c1fb9290de4a384b802d";
-      sha256 = "08g8mb2xlkgvm4zk28cad9bz2j0ychm5038cld89s32rdxy2ac3v";
+      rev = "dd1f90dd6fd267d8430d8e0299ebcfe6a85327cf";
+      sha256 = "1jxqrg3fb2nbxkwhvhmql9rnpzsrlc2qn91vhmk9qy8b9qcgw9qr";
       type = "git";
       url = "https://github.com/rapid7/metasploit-framework";
     };
-    version = "6.3.25";
+    version = "6.3.26";
   };
   metasploit-model = {
     groups = ["default"];
@@ -696,10 +696,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0z7f38iq37h376n9xbl4gajdrnwzq284c9v1py4imw3gri2d5cj6";
+      sha256 = "02mj8mpd6ck5gpcnsimx5brzggw5h5mmmpq2djdypfq16wcw82qq";
       type = "gem";
     };
-    version = "2.8.2";
+    version = "2.8.4";
   };
   minitest = {
     groups = ["default"];
diff --git a/pkgs/top-level/linux-kernels.nix b/pkgs/top-level/linux-kernels.nix
index 8e144eac1204..8a87f9554808 100644
--- a/pkgs/top-level/linux-kernels.nix
+++ b/pkgs/top-level/linux-kernels.nix
@@ -349,6 +349,8 @@ in {
 
     evdi = callPackage ../os-specific/linux/evdi { };
 
+    fanout = callPackage ../os-specific/linux/fanout { };
+
     fwts-efi-runtime = callPackage ../os-specific/linux/fwts/module.nix { };
 
     gcadapter-oc-kmod = callPackage ../os-specific/linux/gcadapter-oc-kmod { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index d8ce44c7ce11..ea8f915774c0 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -4281,6 +4281,8 @@ self: super: with self; {
 
   google-cloud-appengine-logging = callPackage ../development/python-modules/google-cloud-appengine-logging { };
 
+  google-cloud-artifact-registry = callPackage ../development/python-modules/google-cloud-artifact-registry { };
+
   google-cloud-asset = callPackage ../development/python-modules/google-cloud-asset { };
 
   google-cloud-audit-log = callPackage ../development/python-modules/google-cloud-audit-log { };
@@ -11589,6 +11591,8 @@ self: super: with self; {
 
   skytemple-ssb-debugger = callPackage ../development/python-modules/skytemple-ssb-debugger { };
 
+  slack-bolt = callPackage ../development/python-modules/slack-bolt { };
+
   slack-sdk = callPackage ../development/python-modules/slack-sdk { };
 
   slackclient = callPackage ../development/python-modules/slackclient { };