diff --git a/nixos/doc/manual/release-notes/rl-2305.section.md b/nixos/doc/manual/release-notes/rl-2305.section.md
index f7637ac89d23..1fe577822985 100644
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@@ -105,7 +105,7 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - The EC2 image module previously detected and automatically mounted ext3-formatted instance store devices and partitions in stage-1 (initramfs), storing `/tmp` on the first discovered device. This behaviour, which only catered to very specific use cases and could not be disabled, has been removed. Users relying on this should provide their own implementation, and probably use ext4 and perform the mount in stage-2.
 
-- `teleport` has been upgraded to major version 11. Please see upstream [upgrade instructions](https://goteleport.com/docs/setup/operations/upgrading/) and [release notes](https://goteleport.com/docs/changelog/#1100).
+- `teleport` has been upgraded from major version 10 to major version 12. Please see upstream [upgrade instructions](https://goteleport.com/docs/setup/operations/upgrading/) and release notes for versions [11](https://goteleport.com/docs/changelog/#1100) and [12](https://goteleport.com/docs/changelog/#1201). Note that Teleport does not officially support upgrades across more than one major version at a time. If you're running Teleport server components, it is recommended to first upgrade to an intermediate 11.x version by setting `services.teleport.package = pkgs.teleport_11`. Afterwards, this option can be removed to upgrade to the default version (12).
 
 - The EC2 image module previously detected and activated swap-formatted instance store devices and partitions in stage-1 (initramfs). This behaviour has been removed. Users relying on this should provide their own implementation.
 
diff --git a/nixos/modules/services/misc/paperless.nix b/nixos/modules/services/misc/paperless.nix
index 667f16d98f82..4199e7713304 100644
--- a/nixos/modules/services/misc/paperless.nix
+++ b/nixos/modules/services/misc/paperless.nix
@@ -6,6 +6,7 @@ let
   pkg = cfg.package;
 
   defaultUser = "paperless";
+  nltkDir = "/var/cache/paperless/nltk";
 
   # Don't start a redis instance if the user sets a custom redis connection
   enableRedis = !hasAttr "PAPERLESS_REDIS" cfg.extraConfig;
@@ -15,6 +16,7 @@ let
     PAPERLESS_DATA_DIR = cfg.dataDir;
     PAPERLESS_MEDIA_ROOT = cfg.mediaDir;
     PAPERLESS_CONSUMPTION_DIR = cfg.consumptionDir;
+    PAPERLESS_NLTK_DIR = nltkDir;
     GUNICORN_CMD_ARGS = "--bind=${cfg.address}:${toString cfg.port}";
   } // optionalAttrs (config.time.timeZone != null) {
     PAPERLESS_TIME_ZONE = config.time.timeZone;
@@ -24,12 +26,14 @@ let
     lib.mapAttrs (_: toString) cfg.extraConfig
   );
 
-  manage = let
-    setupEnv = lib.concatStringsSep "\n" (mapAttrsToList (name: val: "export ${name}=\"${val}\"") env);
-  in pkgs.writeShellScript "manage" ''
-    ${setupEnv}
-    exec ${pkg}/bin/paperless-ngx "$@"
-  '';
+  manage =
+    let
+      setupEnv = lib.concatStringsSep "\n" (mapAttrsToList (name: val: "export ${name}=\"${val}\"") env);
+    in
+    pkgs.writeShellScript "manage" ''
+      ${setupEnv}
+      exec ${pkg}/bin/paperless-ngx "$@"
+    '';
 
   # Secure the services
   defaultServiceConfig = {
@@ -47,6 +51,7 @@ let
       cfg.dataDir
       cfg.mediaDir
     ];
+    CacheDirectory = "paperless";
     CapabilityBoundingSet = "";
     # ProtectClock adds DeviceAllow=char-rtc r
     DeviceAllow = "";
@@ -170,7 +175,7 @@ in
 
     extraConfig = mkOption {
       type = types.attrs;
-      default = {};
+      default = { };
       description = lib.mdDoc ''
         Extra paperless config options.
 
@@ -291,6 +296,33 @@ in
       };
     };
 
+    # Download NLTK corpus data
+    systemd.services.paperless-download-nltk-data = {
+      wantedBy = [ "paperless-scheduler.service" ];
+      before = [ "paperless-scheduler.service" ];
+      after = [ "network-online.target" ];
+      serviceConfig = defaultServiceConfig // {
+        User = cfg.user;
+        Type = "oneshot";
+        # Enable internet access
+        PrivateNetwork = false;
+        # Restrict write access
+        BindPaths = [];
+        BindReadOnlyPaths = [
+          "/nix/store"
+          "-/etc/resolv.conf"
+          "-/etc/nsswitch.conf"
+          "-/etc/ssl/certs"
+          "-/etc/static/ssl/certs"
+          "-/etc/hosts"
+          "-/etc/localtime"
+        ];
+        ExecStart = let pythonWithNltk = pkg.python.withPackages (ps: [ ps.nltk ]); in ''
+          ${pythonWithNltk}/bin/python -m nltk.downloader -d '${nltkDir}' punkt snowball_data stopwords
+        '';
+      };
+    };
+
     systemd.services.paperless-consumer = {
       description = "Paperless document consumer";
       # Bind to `paperless-scheduler` so that the consumer never runs
diff --git a/nixos/modules/services/networking/nftables.nix b/nixos/modules/services/networking/nftables.nix
index bd13e8c9929a..faff1dca89ba 100644
--- a/nixos/modules/services/networking/nftables.nix
+++ b/nixos/modules/services/networking/nftables.nix
@@ -28,6 +28,32 @@ in
           <https://wiki.nftables.org/wiki-nftables/index.php/Troubleshooting#Question_4._How_do_nftables_and_iptables_interact_when_used_on_the_same_system.3F>.
         '';
     };
+
+    networking.nftables.checkRuleset = mkOption {
+      type = types.bool;
+      default = true;
+      description = lib.mdDoc ''
+        Run `nft check` on the ruleset to spot syntax errors during build.
+        Because this is executed in a sandbox, the check might fail if it requires
+        access to any environmental factors or paths outside the Nix store.
+        To circumvent this, the ruleset file can be edited using the preCheckRuleset
+        option to work in the sandbox environment.
+      '';
+    };
+
+    networking.nftables.preCheckRuleset = mkOption {
+      type = types.lines;
+      default = "";
+      example = lib.literalExpression ''
+        sed 's/skgid meadow/skgid nogroup/g' -i ruleset.conf
+      '';
+      description = lib.mdDoc ''
+        This script gets run before the ruleset is checked. It can be used to
+        create additional files needed for the ruleset check to work, or modify
+        the ruleset for cases the build environment cannot cover.
+      '';
+    };
+
     networking.nftables.ruleset = mkOption {
       type = types.lines;
       default = "";
@@ -105,13 +131,24 @@ in
       wantedBy = [ "multi-user.target" ];
       reloadIfChanged = true;
       serviceConfig = let
-        rulesScript = pkgs.writeScript "nftables-rules" ''
-          #! ${pkgs.nftables}/bin/nft -f
-          flush ruleset
-          ${if cfg.rulesetFile != null then ''
-            include "${cfg.rulesetFile}"
-          '' else cfg.ruleset}
-        '';
+        rulesScript = pkgs.writeTextFile {
+          name =  "nftables-rules";
+          executable = true;
+          text = ''
+            #! ${pkgs.nftables}/bin/nft -f
+            flush ruleset
+            ${if cfg.rulesetFile != null then ''
+              include "${cfg.rulesetFile}"
+            '' else cfg.ruleset}
+          '';
+          checkPhase = lib.optionalString cfg.checkRuleset ''
+            cp $out ruleset.conf
+            ${cfg.preCheckRuleset}
+            export NIX_REDIRECTS=/etc/protocols=${pkgs.buildPackages.iana-etc}/etc/protocols:/etc/services=${pkgs.buildPackages.iana-etc}/etc/services
+            LD_PRELOAD="${pkgs.buildPackages.libredirect}/lib/libredirect.so ${pkgs.buildPackages.lklWithFirewall.lib}/lib/liblkl-hijack.so" \
+              ${pkgs.buildPackages.nftables}/bin/nft --check --file ruleset.conf
+          '';
+        };
       in {
         Type = "oneshot";
         RemainAfterExit = true;
diff --git a/nixos/modules/services/networking/teleport.nix b/nixos/modules/services/networking/teleport.nix
index 6433554f87da..399af711c0e1 100644
--- a/nixos/modules/services/networking/teleport.nix
+++ b/nixos/modules/services/networking/teleport.nix
@@ -11,6 +11,14 @@ in
     services.teleport = with lib.types; {
       enable = mkEnableOption (lib.mdDoc "the Teleport service");
 
+      package = mkOption {
+        type = types.package;
+        default = pkgs.teleport;
+        defaultText = lib.literalMD "pkgs.teleport";
+        example = lib.literalMD "pkgs.teleport_11";
+        description = lib.mdDoc "The teleport package to use";
+      };
+
       settings = mkOption {
         type = settingsYaml.type;
         default = { };
@@ -74,14 +82,14 @@ in
   };
 
   config = mkIf config.services.teleport.enable {
-    environment.systemPackages = [ pkgs.teleport ];
+    environment.systemPackages = [ cfg.package ];
 
     systemd.services.teleport = {
       wantedBy = [ "multi-user.target" ];
       after = [ "network.target" ];
       serviceConfig = {
         ExecStart = ''
-          ${pkgs.teleport}/bin/teleport start \
+          ${cfg.package}/bin/teleport start \
             ${optionalString cfg.insecure.enable "--insecure"} \
             ${optionalString cfg.diag.enable "--diag-addr=${cfg.diag.addr}:${toString cfg.diag.port}"} \
             ${optionalString (cfg.settings != { }) "--config=${settingsYaml.generate "teleport.yaml" cfg.settings}"}
diff --git a/nixos/modules/services/x11/desktop-managers/pantheon.nix b/nixos/modules/services/x11/desktop-managers/pantheon.nix
index 7791a98965d1..4d0296c8254c 100644
--- a/nixos/modules/services/x11/desktop-managers/pantheon.nix
+++ b/nixos/modules/services/x11/desktop-managers/pantheon.nix
@@ -169,6 +169,9 @@ in
       };
       services.udev.packages = [
         pkgs.pantheon.gnome-settings-daemon
+        # Force enable KMS modifiers for devices that require them.
+        # https://gitlab.gnome.org/GNOME/mutter/-/merge_requests/1443
+        pkgs.pantheon.mutter
       ];
       systemd.packages = [
         pkgs.pantheon.gnome-settings-daemon
diff --git a/nixos/tests/teleport.nix b/nixos/tests/teleport.nix
index 34bf1bc0c70d..cdf762b12844 100644
--- a/nixos/tests/teleport.nix
+++ b/nixos/tests/teleport.nix
@@ -1,18 +1,28 @@
 { system ? builtins.currentSystem
 , config ? { }
 , pkgs ? import ../.. { inherit system config; }
+, lib ? pkgs.lib
 }:
 
 with import ../lib/testing-python.nix { inherit system pkgs; };
 
 let
-  minimal = { config, ... }: {
-    services.teleport.enable = true;
+  packages = with pkgs; {
+    "default" = teleport;
+    "11" = teleport_11;
   };
 
-  client = { config, ... }: {
+  minimal = package: {
     services.teleport = {
       enable = true;
+      inherit package;
+    };
+  };
+
+  client = package: {
+    services.teleport = {
+      enable = true;
+      inherit package;
       settings = {
         teleport = {
           nodename = "client";
@@ -37,9 +47,10 @@ let
     }];
   };
 
-  server = { config, ... }: {
+  server = package: {
     services.teleport = {
       enable = true;
+      inherit package;
       settings = {
         teleport = {
           nodename = "server";
@@ -64,36 +75,41 @@ let
     };
   };
 in
-{
-  minimal = makeTest {
-    # minimal setup should always work
-    name = "teleport-minimal-setup";
-    meta.maintainers = with pkgs.lib.maintainers; [ ymatsiuk ];
-    nodes = { inherit minimal; };
+lib.concatMapAttrs
+  (name: package: {
+    "minimal_${name}" = makeTest {
+      # minimal setup should always work
+      name = "teleport-minimal-setup";
+      meta.maintainers = with pkgs.lib.maintainers; [ justinas ];
+      nodes.minimal = minimal package;
 
-    testScript = ''
-      minimal.wait_for_open_port(3025)
-      minimal.wait_for_open_port(3080)
-      minimal.wait_for_open_port(3022)
-    '';
-  };
+      testScript = ''
+        minimal.wait_for_open_port(3025)
+        minimal.wait_for_open_port(3080)
+        minimal.wait_for_open_port(3022)
+      '';
+    };
 
-  basic = makeTest {
-    # basic server and client test
-    name = "teleport-server-client";
-    meta.maintainers = with pkgs.lib.maintainers; [ ymatsiuk ];
-    nodes = { inherit server client; };
+    "basic_${name}" = makeTest {
+      # basic server and client test
+      name = "teleport-server-client";
+      meta.maintainers = with pkgs.lib.maintainers; [ justinas ];
+      nodes = {
+        server = server package;
+        client = client package;
+      };
 
-    testScript = ''
-      with subtest("teleport ready"):
-          server.wait_for_open_port(3025)
-          client.wait_for_open_port(3022)
+      testScript = ''
+        with subtest("teleport ready"):
+            server.wait_for_open_port(3025)
+            client.wait_for_open_port(3022)
 
-      with subtest("check applied configuration"):
-          server.wait_until_succeeds("tctl get nodes --format=json | ${pkgs.jq}/bin/jq -e '.[] | select(.spec.hostname==\"client\") | .metadata.labels.role==\"client\"'")
-          server.wait_for_open_port(3000)
-          client.succeed("journalctl -u teleport.service --grep='DEBU'")
-          server.succeed("journalctl -u teleport.service --grep='Starting teleport in insecure mode.'")
-    '';
-  };
-}
+        with subtest("check applied configuration"):
+            server.wait_until_succeeds("tctl get nodes --format=json | ${pkgs.jq}/bin/jq -e '.[] | select(.spec.hostname==\"client\") | .metadata.labels.role==\"client\"'")
+            server.wait_for_open_port(3000)
+            client.succeed("journalctl -u teleport.service --grep='DEBU'")
+            server.succeed("journalctl -u teleport.service --grep='Starting teleport in insecure mode.'")
+      '';
+    };
+  })
+  packages
diff --git a/pkgs/applications/blockchains/ledger-live-desktop/default.nix b/pkgs/applications/blockchains/ledger-live-desktop/default.nix
index 5aee9eaee9fe..819f14ce456f 100644
--- a/pkgs/applications/blockchains/ledger-live-desktop/default.nix
+++ b/pkgs/applications/blockchains/ledger-live-desktop/default.nix
@@ -2,11 +2,11 @@
 
 let
   pname = "ledger-live-desktop";
-  version = "2.53.2";
+  version = "2.54.0";
 
   src = fetchurl {
     url = "https://download.live.ledger.com/${pname}-${version}-linux-x86_64.AppImage";
-    hash = "sha256-RGeJWUMZagXM/8SHHOpTpcnsz+BShnGp2yvt31qo5lI=";
+    hash = "sha256-3UCsMzpoHq4gD4bw/MT1qbl8AnXQnFJqpMi1mlPvv5w=";
   };
 
   appimageContents = appimageTools.extractType2 {
@@ -27,8 +27,8 @@ appimageTools.wrapType2 rec {
   '';
 
   meta = with lib; {
-    description = "Wallet app for Ledger Nano S and Ledger Blue";
-    homepage = "https://www.ledger.com/live";
+    description = "App for Ledger hardware wallets";
+    homepage = "https://www.ledger.com/ledger-live/";
     license = licenses.mit;
     maintainers = with maintainers; [ andresilva thedavidmeister nyanloutre RaghavSood th0rgal WeebSorceress ];
     platforms = [ "x86_64-linux" ];
diff --git a/pkgs/applications/graphics/menyoki/default.nix b/pkgs/applications/graphics/menyoki/default.nix
index 1f25332e8526..e1b7087cf73b 100644
--- a/pkgs/applications/graphics/menyoki/default.nix
+++ b/pkgs/applications/graphics/menyoki/default.nix
@@ -13,16 +13,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "menyoki";
-  version = "1.6.1";
+  version = "1.7.0";
 
   src = fetchFromGitHub {
     owner = "orhun";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-z0OpRnjVfU6vcyZsxkdD2x3l+a9GkDHZcFveGunDYww=";
+    sha256 = "sha256-owP3G1Rygraifdc4iPURQ1Es0msNhYZIlfrtj0CSU6Y=";
   };
 
-  cargoSha256 = "sha256-uSoyfgPlsHeUwnTHE49ErrlB65wcfl5dxn/YrW5EKZw=";
+  cargoSha256 = "sha256-NtXjlGkX8AzSw98xHPymzdnTipMIunyDbpSr4eVowa0=";
 
   nativeBuildInputs = [ installShellFiles ]
     ++ lib.optional stdenv.isLinux pkg-config;
diff --git a/pkgs/applications/misc/anytype/default.nix b/pkgs/applications/misc/anytype/default.nix
index 5ec64fc0a55e..fd0efc3f29f5 100644
--- a/pkgs/applications/misc/anytype/default.nix
+++ b/pkgs/applications/misc/anytype/default.nix
@@ -2,13 +2,13 @@
 
 let
   pname = "anytype";
-  version = "0.30.0";
+  version = "0.31.0";
   name = "Anytype-${version}";
   nameExecutable = pname;
   src = fetchurl {
     url = "https://at9412003.fra1.digitaloceanspaces.com/Anytype-${version}.AppImage";
     name = "Anytype-${version}.AppImage";
-    sha256 = "sha256-LifJc5mLbnt5wBXGM1n1uice0B6mCY80LYf3kEFJy90=";
+    sha256 = "sha256-s8al0R9G478A+PymQcdcdRpw6tpKkG+WIZsXZYEvf/o=";
   };
   appimageContents = appimageTools.extractType2 { inherit name src; };
 in
diff --git a/pkgs/applications/misc/slstatus/default.nix b/pkgs/applications/misc/slstatus/default.nix
index ac8170ed551c..4f022d81f62c 100644
--- a/pkgs/applications/misc/slstatus/default.nix
+++ b/pkgs/applications/misc/slstatus/default.nix
@@ -21,7 +21,8 @@ stdenv.mkDerivation rec {
   };
 
   configFile = lib.optionalString (conf!=null) (writeText "config.def.h" conf);
-  preBuild = lib.optionalString (conf!=null) "cp ${configFile} config.def.h" + ''
+  preBuild = ''
+    ${lib.optionalString (conf!=null) "cp ${configFile} config.def.h"}
     makeFlagsArray+=(LDLIBS="-lX11 -lxcb -lXau -lXdmcp" CC=$CC)
   '';
 
diff --git a/pkgs/applications/networking/browsers/lagrange/default.nix b/pkgs/applications/networking/browsers/lagrange/default.nix
index b91e5b05b625..4a3d98d6474c 100644
--- a/pkgs/applications/networking/browsers/lagrange/default.nix
+++ b/pkgs/applications/networking/browsers/lagrange/default.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lagrange";
-  version = "1.15.2";
+  version = "1.15.3";
 
   src = fetchFromGitHub {
     owner = "skyjake";
     repo = "lagrange";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-NUgDaBRcgYGLKJhSJLT17VZj/mU0w6ySahIYnud5M6Y=";
+    hash = "sha256-BKDN2DtLoG+E+R+yBSBpF4PWv+pRLNYZvX/3BqEIxVQ=";
   };
 
   nativeBuildInputs = [ cmake pkg-config zip ];
diff --git a/pkgs/applications/networking/browsers/librewolf/src.json b/pkgs/applications/networking/browsers/librewolf/src.json
index 009569f9c5c3..4739c7d5a37c 100644
--- a/pkgs/applications/networking/browsers/librewolf/src.json
+++ b/pkgs/applications/networking/browsers/librewolf/src.json
@@ -1,11 +1,11 @@
 {
-  "packageVersion": "110.0-1",
+  "packageVersion": "110.0.1-1",
   "source": {
-    "rev": "110.0-1",
-    "sha256": "1fs8z7b1ly3asmgqc4lnidf8k5apaimc875rqm7rqg360bc1qg2p"
+    "rev": "110.0.1-1",
+    "sha256": "06k33gf2q77w3airgbqmki555pp2yv33cbkivbi4hgz80zl1m4i3"
   },
   "firefox": {
-    "version": "110.0",
-    "sha512": "52a37a8f59a694c4790c0a14cd81fba9e2c982f64e00191afd0897c39ae1d5e25f24cff16f74d0a0b5cdf8e93a9a0974b6042b0de605cf1a533ef4e6a3c0dcf9"
+    "version": "110.0.1",
+    "sha512": "42c6a99a3874a0f60121188c43788fb35577734d9366c3f89ad41b8328cc542ce172ec81ca35b9ea551eaa698197ccdb43922ec3215d311e0770aaaa59625d21"
   }
 }
diff --git a/pkgs/applications/networking/browsers/misc/widevine-cdm.nix b/pkgs/applications/networking/browsers/misc/widevine-cdm.nix
index 41021cfdaa7c..b9ba40a2932e 100644
--- a/pkgs/applications/networking/browsers/misc/widevine-cdm.nix
+++ b/pkgs/applications/networking/browsers/misc/widevine-cdm.nix
@@ -1,18 +1,26 @@
-{ lib, stdenv, fetchzip
+{ lib
+, stdenv
+, fetchzip
 }:
 
 stdenv.mkDerivation rec {
   pname = "widevine-cdm";
-  version = "4.10.2449.0";
+  version = "4.10.2557.0";
 
   src = fetchzip {
     url = "https://dl.google.com/widevine-cdm/${version}-linux-x64.zip";
-    sha256 = "sha256-f2kAkP+s3fB+krEZsiujEoI4oznkzSyaIB/CRJZWlXE=";
+    hash = "sha256-XxTjuPjWy06SmHC6GaIVIp3zD76isCVATWwwdZljntE=";
     stripRoot = false;
   };
 
   installPhase = ''
-    install -vD libwidevinecdm.so $out/libwidevinecdm.so
+    runHook preInstall
+
+    install -vD manifest.json $out/share/google/chrome/WidevineCdm/manifest.json
+    install -vD LICENSE.txt $out/share/google/chrome/WidevineCdm/LICENSE.txt
+    install -vD libwidevinecdm.so $out/share/google/chrome/WidevineCdm/_platform_specific/linux_x64/libwidevinecdm.so
+
+    runHook postInstall
   '';
 
   meta = with lib; {
@@ -21,6 +29,6 @@ stdenv.mkDerivation rec {
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     maintainers = with maintainers; [ jlamur ];
-    platforms   = [ "x86_64-linux" ];
+    platforms = [ "x86_64-linux" ];
   };
 }
diff --git a/pkgs/applications/networking/browsers/qutebrowser/default.nix b/pkgs/applications/networking/browsers/qutebrowser/default.nix
index a3bddd44fedb..b20cb19bf12e 100644
--- a/pkgs/applications/networking/browsers/qutebrowser/default.nix
+++ b/pkgs/applications/networking/browsers/qutebrowser/default.nix
@@ -144,7 +144,7 @@ buildPythonApplication {
       --add-flags '--backend ${backend}'
       --set QUTE_QTWEBENGINE_VERSION_OVERRIDE "${lib.getVersion qtwebengine}"
       ${lib.optionalString (pipewireSupport && backend == "webengine") ''--prefix LD_LIBRARY_PATH : ${libPath}''}
-      ${lib.optionalString enableWideVine ''--add-flags "--qt-flag widevine-path=${widevine-cdm}/libwidevinecdm.so"''}
+      ${lib.optionalString enableWideVine ''--add-flags "--qt-flag widevine-path=${widevine-cdm}/share/google/chrome/WidevineCdm/_platform_specific/linux_x64/libwidevinecdm.so"''}
     )
   '';
 
diff --git a/pkgs/applications/networking/browsers/vivaldi/default.nix b/pkgs/applications/networking/browsers/vivaldi/default.nix
index 0238fc61bcfa..ec9ba8dddb9a 100644
--- a/pkgs/applications/networking/browsers/vivaldi/default.nix
+++ b/pkgs/applications/networking/browsers/vivaldi/default.nix
@@ -11,7 +11,7 @@
 , wayland, pipewire
 , isSnapshot ? false
 , proprietaryCodecs ? false, vivaldi-ffmpeg-codecs ? null
-, enableWidevine ? false, vivaldi-widevine ? null
+, enableWidevine ? false, widevine-cdm ? null
 , commandLineArgs ? ""
 , pulseSupport ? stdenv.isLinux, libpulseaudio
 }:
@@ -95,7 +95,7 @@ in stdenv.mkDerivation rec {
       --suffix XDG_DATA_DIRS : ${gtk3}/share/gsettings-schemas/${gtk3.name}/ \
       ${lib.optionalString enableWidevine "--suffix LD_LIBRARY_PATH : ${libPath}"}
   '' + lib.optionalString enableWidevine ''
-    ln -sf ${vivaldi-widevine}/share/google/chrome/WidevineCdm $out/opt/${vivaldiName}/WidevineCdm
+    ln -sf ${widevine-cdm}/share/google/chrome/WidevineCdm $out/opt/${vivaldiName}/WidevineCdm
   '' + ''
     runHook postInstall
   '';
diff --git a/pkgs/applications/networking/browsers/vivaldi/widevine.nix b/pkgs/applications/networking/browsers/vivaldi/widevine.nix
deleted file mode 100644
index 65c58775874b..000000000000
--- a/pkgs/applications/networking/browsers/vivaldi/widevine.nix
+++ /dev/null
@@ -1,28 +0,0 @@
-{ lib, stdenv, fetchzip
-}:
-
-stdenv.mkDerivation rec {
-  pname = "widevine";
-  version = "4.10.2449.0";
-
-  src = fetchzip {
-    url = "https://dl.google.com/widevine-cdm/${version}-linux-x64.zip";
-    sha256 = "sha256-f2kAkP+s3fB+krEZsiujEoI4oznkzSyaIB/CRJZWlXE=";
-    stripRoot = false;
-  };
-
-  installPhase = ''
-    install -vD manifest.json $out/share/google/chrome/WidevineCdm/manifest.json
-    install -vD LICENSE.txt $out/share/google/chrome/WidevineCdm/LICENSE.txt
-    install -vD libwidevinecdm.so $out/share/google/chrome/WidevineCdm/_platform_specific/linux_x64/libwidevinecdm.so
-  '';
-
-  meta = with lib; {
-    description = "Widevine support for Vivaldi";
-    homepage = "https://www.widevine.com";
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    license = licenses.unfree;
-    maintainers = with maintainers; [ betaboon ];
-    platforms   = [ "x86_64-linux" ];
-  };
-}
diff --git a/pkgs/applications/networking/cloudflared/default.nix b/pkgs/applications/networking/cloudflared/default.nix
index 518a44232960..88876e9f98ff 100644
--- a/pkgs/applications/networking/cloudflared/default.nix
+++ b/pkgs/applications/networking/cloudflared/default.nix
@@ -1,19 +1,29 @@
-{ lib, buildGoModule, fetchFromGitHub, stdenv, callPackage }:
+{ lib
+, stdenv
+, buildGoModule
+, fetchFromGitHub
+, callPackage
+}:
 
 buildGoModule rec {
   pname = "cloudflared";
-  version = "2023.2.1";
+  version = "2023.2.2";
 
   src = fetchFromGitHub {
     owner = "cloudflare";
     repo = "cloudflared";
-    rev = version;
-    hash = "sha256-vhcz/uk1sBt7XytXQYcPreoPfNz7fdPVE+j+FTH7tPc=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-qZ3h8KZLGSH+sqUs0wof5arKvcps1DdqBnT+coWEiys=";
   };
 
   vendorSha256 = null;
 
-  ldflags = [ "-s" "-w" "-X main.Version=${version}" "-X github.com/cloudflare/cloudflared/cmd/cloudflared/updater.BuiltForPackageManager=nixpkgs" ];
+  ldflags = [
+    "-s"
+    "-w"
+    "-X main.Version=${version}"
+    "-X github.com/cloudflare/cloudflared/cmd/cloudflared/updater.BuiltForPackageManager=nixpkgs"
+  ];
 
   preCheck = ''
     # Workaround for: sshgen_test.go:74: mkdir /homeless-shelter/.cloudflared: no such file or directory
@@ -52,11 +62,6 @@ buildGoModule rec {
     substituteInPlace "ingress/icmp_posix_test.go" \
       --replace "TestReuseFunnel" "SkipReuseFunnel"
 
-    # Workaround for: supervisor_test.go:49:
-    #   Expected nil, but got: Could not lookup srv records on _us-v2-origintunneld._tcp.argotunnel.com: lookup _us-v2-origintunneld._tcp.argotunnel.com on [::1]:53: read udp [::1]:49342->[::1]:53: read: connection refused
-    substituteInPlace "supervisor/supervisor_test.go" \
-      --replace "Test_Initialize_Same_Protocol" "Skip_Initialize_Same_Protocol"
-
     # Workaround for: manager_test.go:197:
     #   Should be false
     substituteInPlace "datagramsession/manager_test.go" \
@@ -70,6 +75,7 @@ buildGoModule rec {
   meta = with lib; {
     description = "Cloudflare Tunnel daemon, Cloudflare Access toolkit, and DNS-over-HTTPS client";
     homepage = "https://www.cloudflare.com/products/tunnel";
+    changelog = "https://github.com/cloudflare/cloudflared/releases/tag/${version}";
     license = licenses.asl20;
     platforms = platforms.unix ++ platforms.windows;
     maintainers = with maintainers; [ bbigras enorris thoughtpolice piperswe ];
diff --git a/pkgs/applications/networking/cluster/kluctl/default.nix b/pkgs/applications/networking/cluster/kluctl/default.nix
index 6a02127405d3..6df6b472a428 100644
--- a/pkgs/applications/networking/cluster/kluctl/default.nix
+++ b/pkgs/applications/networking/cluster/kluctl/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "kluctl";
-  version = "2.19.0";
+  version = "2.19.2";
 
   src = fetchFromGitHub {
     owner = "kluctl";
     repo = "kluctl";
     rev = "v${version}";
-    hash = "sha256-2nAgJj/cMDiE5rw/YixNYQNCWnuC/8EX4BrnXN4Npao=";
+    hash = "sha256-7+hXjYaCqInhP3O8IS8IwkUTGhnmcIWRR1qqvA6UQoc=";
   };
 
   vendorHash = "sha256-xBUrY8v4yHtWGaaRXHxQRGdZHzMGoJX2hFLL+0Vb1QY=";
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 6e858269bd77..9c56b8f67b1c 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -146,11 +146,11 @@
     "vendorHash": null
   },
   "baiducloud": {
-    "hash": "sha256-CYU8PI/gMVC9lMiQaPd/M1SKjvZ6vaj5iBfLDTieZR4=",
+    "hash": "sha256-htNkDa60XHpH0aoJhMvsMiqUl8Ldqa/ZMl5dp7OKwGA=",
     "homepage": "https://registry.terraform.io/providers/baidubce/baiducloud",
     "owner": "baidubce",
     "repo": "terraform-provider-baiducloud",
-    "rev": "v1.19.4",
+    "rev": "v1.19.5",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -328,13 +328,13 @@
     "vendorHash": "sha256-Ba4J6LUchqhdZTxcJxTgP20aZVioybIzKvF4j5TDQIk="
   },
   "dnsimple": {
-    "hash": "sha256-AbNOqxZOrXUxkuScOgrZ3OyEHWpZ8+tsqqXW6lofaMc=",
+    "hash": "sha256-du0i4z7Eg/TjA/keIOXq9w+z8Oh6tNOZigV8hpbaGn4=",
     "homepage": "https://registry.terraform.io/providers/dnsimple/dnsimple",
     "owner": "dnsimple",
     "repo": "terraform-provider-dnsimple",
-    "rev": "v0.16.0",
+    "rev": "v0.16.1",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-rGcCbESdzKGy3I1FcDA3dUbblyG/uk74rizj7INRGPw="
+    "vendorHash": "sha256-Id1rL/Mu/aES7OFQ/rQRMmm3D/GSbGofZludqbWffKo="
   },
   "docker": {
     "hash": "sha256-M2K4N39vtVDA/vMp/s2KYiS/uoE+STf2e6yh6q0CS28=",
@@ -811,11 +811,11 @@
     "vendorHash": "sha256-LRIfxQGwG988HE5fftGl6JmBG7tTknvmgpm4Fu1NbWI="
   },
   "oci": {
-    "hash": "sha256-6UVsSOAh/JigJkiK+RbHsv7t/IuejouaRL+o8F0ndAo=",
+    "hash": "sha256-PsTlJY9Y4o7qmA2h+jbIARB9N7+Qku8CaOAYkQ2CKBU=",
     "homepage": "https://registry.terraform.io/providers/oracle/oci",
     "owner": "oracle",
     "repo": "terraform-provider-oci",
-    "rev": "v4.109.0",
+    "rev": "v4.110.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -847,13 +847,13 @@
     "vendorHash": "sha256-zKtBDnvlQHe+q0OZUMUGu1gNsx2wIrIoArtJrt0VaBk="
   },
   "openstack": {
-    "hash": "sha256-k5UyK9jmjZzHw8AwmDRtyCyJgILAcCK+nN+hklJ9VFw=",
+    "hash": "sha256-KUv921SV88aUAsEkJY8TUgmO1h2xC5aUcapcRN1FEys=",
     "homepage": "https://registry.terraform.io/providers/terraform-provider-openstack/openstack",
     "owner": "terraform-provider-openstack",
     "repo": "terraform-provider-openstack",
-    "rev": "v1.49.0",
+    "rev": "v1.50.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-hHwFm+gSMjN4YQEFd/dd50G0uZsxzqi21tHDf4mPBLY="
+    "vendorHash": "sha256-aoJDRzackPjWxkrsQclweUFH3Bqdcj1aTJuTHZ7Dh7g="
   },
   "opentelekomcloud": {
     "hash": "sha256-UIpzv5Tas5jxpaqg1n0KRoJhYj6vRE6DBQ2u701xgzU=",
@@ -1045,13 +1045,13 @@
     "vendorHash": "sha256-NO1r/EWLgH1Gogru+qPeZ4sW7FuDENxzNnpLSKstnE8="
   },
   "spotinst": {
-    "hash": "sha256-mbO0APaGWLHowhs5tDvloUBYKt4+pvx3qqN2gtrAzGY=",
+    "hash": "sha256-pm6KFPIMPq9jFUf9wYYA3mWMl7+pJLv53wegFmPyBZY=",
     "homepage": "https://registry.terraform.io/providers/spotinst/spotinst",
     "owner": "spotinst",
     "repo": "terraform-provider-spotinst",
-    "rev": "v1.101.0",
+    "rev": "v1.102.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-sVNtY2wDGE2ZOB4YNytx0n4V4cbNKoXAv7JCA+Ym3JU="
+    "vendorHash": "sha256-IlztpEAI/Z7DUQ5pMaGSQnXWPedAIJlS773nxsRMCYg="
   },
   "stackpath": {
     "hash": "sha256-7KQUddq+M35WYyAIAL8sxBjAaXFcsczBRO1R5HURUZg=",
diff --git a/pkgs/applications/networking/instant-messengers/discord/disable-breaking-updates.py b/pkgs/applications/networking/instant-messengers/discord/disable-breaking-updates.py
index a7217d0ad6e0..5413c93665fe 100644
--- a/pkgs/applications/networking/instant-messengers/discord/disable-breaking-updates.py
+++ b/pkgs/applications/networking/instant-messengers/discord/disable-breaking-updates.py
@@ -22,21 +22,23 @@ XDG_CONFIG_HOME = os.environ.get("XDG_CONFIG_HOME") or os.path.join(
 
 settings_path = Path(f"{XDG_CONFIG_HOME}/@configDirName@/settings.json")
 settings_path_temp = Path(f"{XDG_CONFIG_HOME}/@configDirName@/settings.json.tmp")
-try:
+
+if os.path.exists(settings_path):
     with settings_path.open(encoding="utf-8") as settings_file:
         settings = json.load(settings_file)
+else:
+    settings = {}
 
-        if settings.get("SKIP_HOST_UPDATE"):
-            print("[Nix] Disabling updates already done")
-        else:
-            skip_host_update = {"SKIP_HOST_UPDATE": True}
-            settings.update(skip_host_update)
+if settings.get("SKIP_HOST_UPDATE"):
+    print("[Nix] Disabling updates already done")
+else:
+    skip_host_update = {"SKIP_HOST_UPDATE": True}
+    settings.update(skip_host_update)
 
-            with settings_path_temp.open("w", encoding="utf-8") as settings_file_temp:
-                json.dump(settings, settings_file_temp, indent=2)
+    os.makedirs(os.path.dirname(settings_path), exist_ok=True)
 
-            settings_path_temp.rename(settings_path)
-            print("[Nix] Disabled updates")
+    with settings_path_temp.open("w", encoding="utf-8") as settings_file_temp:
+        json.dump(settings, settings_file_temp, indent=2)
 
-except IOError:
-    print("[Nix] settings.json doesn't yet exist, can't disable it yet")
+    settings_path_temp.rename(settings_path)
+    print("[Nix] Disabled updates")
diff --git a/pkgs/applications/office/paperless-ngx/default.nix b/pkgs/applications/office/paperless-ngx/default.nix
index f4535b59cf89..e2a977cb5407 100644
--- a/pkgs/applications/office/paperless-ngx/default.nix
+++ b/pkgs/applications/office/paperless-ngx/default.nix
@@ -318,7 +318,7 @@ python.pkgs.buildPythonApplication rec {
 
   meta = with lib; {
     description = "Tool to scan, index, and archive all of your physical documents";
-    homepage = "https://paperless-ngx.readthedocs.io/";
+    homepage = "https://docs.paperless-ngx.com/";
     changelog = "https://github.com/paperless-ngx/paperless-ngx/releases/tag/v${version}";
     license = licenses.gpl3Only;
     maintainers = with maintainers; [ lukegb gador erikarvstedt ];
diff --git a/pkgs/applications/virtualization/lkl/default.nix b/pkgs/applications/virtualization/lkl/default.nix
index 4a1514cd97a1..0247cd433b04 100644
--- a/pkgs/applications/virtualization/lkl/default.nix
+++ b/pkgs/applications/virtualization/lkl/default.nix
@@ -6,15 +6,15 @@
 
 stdenv.mkDerivation rec {
   pname = "lkl";
-  version = "2022-05-18";
+  version = "2023-01-27";
 
   outputs = [ "dev" "lib" "out" ];
 
   src = fetchFromGitHub {
     owner  = "lkl";
     repo   = "linux";
-    rev  = "10c7b5dee8c424cc2ab754e519ecb73350283ff9";
-    sha256 = "sha256-D3HQdKzhB172L62a+8884bNhcv7vm/c941wzbYtbf4I=";
+    rev  = "b00f0fbcd5ae24636a9315fea3af32f411cf93be";
+    sha256 = "sha256-GZpnTVdcnS5uAUHsVre539+0Qlv36Fui0WGjOPwvWrE=";
   };
 
   nativeBuildInputs = [ bc bison flex python3 ];
diff --git a/pkgs/applications/virtualization/lkl/lkl-defconfig-enable-nftables b/pkgs/applications/virtualization/lkl/lkl-defconfig-enable-nftables
index 8f133938587f..d77cb4d20b74 100644
--- a/pkgs/applications/virtualization/lkl/lkl-defconfig-enable-nftables
+++ b/pkgs/applications/virtualization/lkl/lkl-defconfig-enable-nftables
@@ -1,71 +1,68 @@
+CONFIG_IP6_NF_FILTER=y
+CONFIG_IP6_NF_IPTABLES=y
+CONFIG_IP6_NF_MANGLE=y
+CONFIG_IP6_NF_MATCH_AH=y
+CONFIG_IP6_NF_MATCH_EUI64=y
+CONFIG_IP6_NF_MATCH_FRAG=y
+CONFIG_IP6_NF_MATCH_HL=y
+CONFIG_IP6_NF_MATCH_IPV6HEADER=y
+CONFIG_IP6_NF_MATCH_MH=y
+CONFIG_IP6_NF_MATCH_OPTS=y
+CONFIG_IP6_NF_MATCH_RPFILTER=y
+CONFIG_IP6_NF_MATCH_RT=y
+CONFIG_IP6_NF_MATCH_SRH=y
+CONFIG_IP6_NF_NAT=y
+CONFIG_IP6_NF_RAW=y
+CONFIG_IP6_NF_SECURITY=y
+CONFIG_IP6_NF_TARGET_HL=y
+CONFIG_IP6_NF_TARGET_MASQUERADE=y
+CONFIG_IP6_NF_TARGET_NPT=y
+CONFIG_IP6_NF_TARGET_REJECT=y
+CONFIG_IP6_NF_TARGET_SYNPROXY=y
+CONFIG_IP_NF_ARPFILTER=y
+CONFIG_IP_NF_ARP_MANGLE=y
+CONFIG_IP_NF_ARPTABLES=y
+CONFIG_IP_NF_FILTER=y
+CONFIG_IP_NF_IPTABLES=y
+CONFIG_IP_NF_MANGLE=y
+CONFIG_IP_NF_MATCH_AH=y
+CONFIG_IP_NF_MATCH_ECN=y
+CONFIG_IP_NF_MATCH_RPFILTER=y
+CONFIG_IP_NF_MATCH_TTL=y
+CONFIG_IP_NF_NAT=y
+CONFIG_IP_NF_RAW=y
+CONFIG_IP_NF_SECURITY=y
+CONFIG_IP_NF_TARGET_CLUSTERIP=y
+CONFIG_IP_NF_TARGET_ECN=y
+CONFIG_IP_NF_TARGET_MASQUERADE=y
+CONFIG_IP_NF_TARGET_NETMAP=y
+CONFIG_IP_NF_TARGET_REDIRECT=y
+CONFIG_IP_NF_TARGET_REJECT=y
+CONFIG_IP_NF_TARGET_SYNPROXY=y
+CONFIG_IP_NF_TARGET_TTL=y
 CONFIG_NETFILTER=y
-CONFIG_NF_CONNTRACK=y
-CONFIG_NF_LOG_NETDEV=y
-CONFIG_NF_CONNTRACK_ZONES=y
-CONFIG_NF_CONNTRACK_EVENTS=y
-CONFIG_NF_CONNTRACK_TIMEOUT=y
-CONFIG_NF_CONNTRACK_TIMESTAMP=y
-CONFIG_NF_CONNTRACK_AMANDA=y
-CONFIG_NF_CONNTRACK_FTP=y
-CONFIG_NF_CONNTRACK_H323=y
-CONFIG_NF_CONNTRACK_IRC=y
-CONFIG_NF_CONNTRACK_NETBIOS_NS=y
-CONFIG_NF_CONNTRACK_SNMP=y
-CONFIG_NF_CONNTRACK_PPTP=y
-CONFIG_NF_CONNTRACK_SANE=y
-CONFIG_NF_CONNTRACK_SIP=y
-CONFIG_NF_CONNTRACK_TFTP=y
-CONFIG_NF_CT_NETLINK=y
-CONFIG_NF_CT_NETLINK_TIMEOUT=y
-CONFIG_NF_CT_NETLINK_HELPER=y
+CONFIG_NETFILTER_ADVANCED=y
+CONFIG_NETFILTER_CONNCOUNT=y
+CONFIG_NETFILTER_EGRESS=y
+CONFIG_NETFILTER_FAMILY_ARP=y
+CONFIG_NETFILTER_FAMILY_BRIDGE=y
+CONFIG_NETFILTER_INGRESS=y
+CONFIG_NETFILTER_NETLINK_ACCT=y
 CONFIG_NETFILTER_NETLINK_GLUE_CT=y
-CONFIG_NF_TABLES=y
-CONFIG_NF_TABLES_INET=y
-CONFIG_NF_TABLES_NETDEV=y
-CONFIG_NFT_NUMGEN=y
-CONFIG_NFT_CT=y
-CONFIG_NFT_COUNTER=y
-CONFIG_NFT_CONNLIMIT=y
-CONFIG_NFT_LOG=y
-CONFIG_NFT_LIMIT=y
-CONFIG_NFT_MASQ=y
-CONFIG_NFT_REDIR=y
-CONFIG_NFT_NAT=y
-CONFIG_NFT_TUNNEL=y
-CONFIG_NFT_OBJREF=y
-CONFIG_NFT_QUEUE=y
-CONFIG_NFT_QUOTA=y
-CONFIG_NFT_REJECT=y
-CONFIG_NFT_COMPAT=y
-CONFIG_NFT_HASH=y
-CONFIG_NFT_FIB_INET=y
-CONFIG_NFT_SOCKET=y
-CONFIG_NFT_OSF=y
-CONFIG_NFT_TPROXY=y
-CONFIG_NFT_SYNPROXY=y
-CONFIG_NFT_DUP_NETDEV=y
-CONFIG_NFT_FWD_NETDEV=y
-CONFIG_NFT_FIB_NETDEV=y
-CONFIG_NF_FLOW_TABLE_INET=y
-CONFIG_NF_FLOW_TABLE=y
-CONFIG_NETFILTER_XT_TARGET_CHECKSUM=y
-CONFIG_NETFILTER_XT_TARGET_CLASSIFY=y
-CONFIG_NETFILTER_XT_TARGET_CONNMARK=y
-CONFIG_NETFILTER_XT_TARGET_DSCP=y
-CONFIG_NETFILTER_XT_TARGET_HMARK=y
-CONFIG_NETFILTER_XT_TARGET_IDLETIMER=y
-CONFIG_NETFILTER_XT_TARGET_LOG=y
-CONFIG_NETFILTER_XT_TARGET_MARK=y
-CONFIG_NETFILTER_XT_TARGET_NFLOG=y
-CONFIG_NETFILTER_XT_TARGET_NFQUEUE=y
-CONFIG_NETFILTER_XT_TARGET_NOTRACK=y
-CONFIG_NETFILTER_XT_TARGET_TEE=y
-CONFIG_NETFILTER_XT_TARGET_TPROXY=y
-CONFIG_NETFILTER_XT_TARGET_TRACE=y
-CONFIG_NETFILTER_XT_TARGET_TCPMSS=y
-CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP=y
+CONFIG_NETFILTER_NETLINK_HOOK=y
+CONFIG_NETFILTER_NETLINK_LOG=y
+CONFIG_NETFILTER_NETLINK_OSF=y
+CONFIG_NETFILTER_NETLINK_QUEUE=y
+CONFIG_NETFILTER_NETLINK=y
+CONFIG_NETFILTER_SKIP_EGRESS=y
+CONFIG_NETFILTER_SYNPROXY=y
+CONFIG_NETFILTER_XTABLES_COMPAT=y
+CONFIG_NETFILTER_XTABLES=y
+CONFIG_NETFILTER_XT_CONNMARK=y
+CONFIG_NETFILTER_XT_MARK=y
 CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=y
 CONFIG_NETFILTER_XT_MATCH_BPF=y
+CONFIG_NETFILTER_XT_MATCH_CGROUP=y
 CONFIG_NETFILTER_XT_MATCH_CLUSTER=y
 CONFIG_NETFILTER_XT_MATCH_COMMENT=y
 CONFIG_NETFILTER_XT_MATCH_CONNBYTES=y
@@ -77,11 +74,14 @@ CONFIG_NETFILTER_XT_MATCH_CPU=y
 CONFIG_NETFILTER_XT_MATCH_DCCP=y
 CONFIG_NETFILTER_XT_MATCH_DEVGROUP=y
 CONFIG_NETFILTER_XT_MATCH_DSCP=y
+CONFIG_NETFILTER_XT_MATCH_ECN=y
 CONFIG_NETFILTER_XT_MATCH_ESP=y
 CONFIG_NETFILTER_XT_MATCH_HASHLIMIT=y
 CONFIG_NETFILTER_XT_MATCH_HELPER=y
+CONFIG_NETFILTER_XT_MATCH_HL=y
 CONFIG_NETFILTER_XT_MATCH_IPCOMP=y
 CONFIG_NETFILTER_XT_MATCH_IPRANGE=y
+CONFIG_NETFILTER_XT_MATCH_IPVS=y
 CONFIG_NETFILTER_XT_MATCH_L2TP=y
 CONFIG_NETFILTER_XT_MATCH_LENGTH=y
 CONFIG_NETFILTER_XT_MATCH_LIMIT=y
@@ -91,7 +91,9 @@ CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y
 CONFIG_NETFILTER_XT_MATCH_NFACCT=y
 CONFIG_NETFILTER_XT_MATCH_OSF=y
 CONFIG_NETFILTER_XT_MATCH_OWNER=y
+CONFIG_NETFILTER_XT_MATCH_PHYSDEV=y
 CONFIG_NETFILTER_XT_MATCH_PKTTYPE=y
+CONFIG_NETFILTER_XT_MATCH_POLICY=y
 CONFIG_NETFILTER_XT_MATCH_QUOTA=y
 CONFIG_NETFILTER_XT_MATCH_RATEEST=y
 CONFIG_NETFILTER_XT_MATCH_REALM=y
@@ -104,52 +106,129 @@ CONFIG_NETFILTER_XT_MATCH_STRING=y
 CONFIG_NETFILTER_XT_MATCH_TCPMSS=y
 CONFIG_NETFILTER_XT_MATCH_TIME=y
 CONFIG_NETFILTER_XT_MATCH_U32=y
-CONFIG_NFT_DUP_IPV4=y
-CONFIG_NFT_FIB_IPV4=y
-CONFIG_NF_TABLES_ARP=y
-CONFIG_NF_FLOW_TABLE_IPV4=y
-CONFIG_NF_LOG_ARP=y
-CONFIG_IP_NF_IPTABLES=y
-CONFIG_IP_NF_MATCH_AH=y
-CONFIG_IP_NF_MATCH_ECN=y
-CONFIG_IP_NF_MATCH_RPFILTER=y
-CONFIG_IP_NF_MATCH_TTL=y
-CONFIG_IP_NF_FILTER=y
-CONFIG_IP_NF_TARGET_REJECT=y
-CONFIG_IP_NF_TARGET_SYNPROXY=y
-CONFIG_IP_NF_NAT=y
-CONFIG_IP_NF_TARGET_MASQUERADE=y
-CONFIG_IP_NF_TARGET_NETMAP=y
-CONFIG_IP_NF_TARGET_REDIRECT=y
-CONFIG_IP_NF_MANGLE=y
-CONFIG_IP_NF_TARGET_CLUSTERIP=y
-CONFIG_IP_NF_TARGET_ECN=y
-CONFIG_IP_NF_TARGET_TTL=y
-CONFIG_IP_NF_RAW=y
-CONFIG_IP_NF_ARPTABLES=y
-CONFIG_IP_NF_ARPFILTER=y
-CONFIG_IP_NF_ARP_MANGLE=y
-CONFIG_NFT_DUP_IPV6=y
-CONFIG_NFT_FIB_IPV6=y
-CONFIG_NF_FLOW_TABLE_IPV6=y
-CONFIG_IP6_NF_IPTABLES=y
-CONFIG_IP6_NF_MATCH_AH=y
-CONFIG_IP6_NF_MATCH_EUI64=y
-CONFIG_IP6_NF_MATCH_FRAG=y
-CONFIG_IP6_NF_MATCH_OPTS=y
-CONFIG_IP6_NF_MATCH_HL=y
-CONFIG_IP6_NF_MATCH_IPV6HEADER=y
-CONFIG_IP6_NF_MATCH_MH=y
-CONFIG_IP6_NF_MATCH_RPFILTER=y
-CONFIG_IP6_NF_MATCH_RT=y
-CONFIG_IP6_NF_MATCH_SRH=y
-CONFIG_IP6_NF_TARGET_HL=y
-CONFIG_IP6_NF_FILTER=y
-CONFIG_IP6_NF_TARGET_REJECT=y
-CONFIG_IP6_NF_TARGET_SYNPROXY=y
-CONFIG_IP6_NF_MANGLE=y
-CONFIG_IP6_NF_RAW=y
-CONFIG_IP6_NF_NAT=y
-CONFIG_IP6_NF_TARGET_MASQUERADE=y
-CONFIG_IP6_NF_TARGET_NPT=y
+CONFIG_NETFILTER_XT_NAT=y
+CONFIG_NETFILTER_XT_SET=y
+CONFIG_NETFILTER_XT_TARGET_AUDIT=y
+CONFIG_NETFILTER_XT_TARGET_CHECKSUM=y
+CONFIG_NETFILTER_XT_TARGET_CLASSIFY=y
+CONFIG_NETFILTER_XT_TARGET_CONNMARK=y
+CONFIG_NETFILTER_XT_TARGET_CONNSECMARK=y
+CONFIG_NETFILTER_XT_TARGET_CT=y
+CONFIG_NETFILTER_XT_TARGET_DSCP=y
+CONFIG_NETFILTER_XT_TARGET_HL=y
+CONFIG_NETFILTER_XT_TARGET_HMARK=y
+CONFIG_NETFILTER_XT_TARGET_IDLETIMER=y
+CONFIG_NETFILTER_XT_TARGET_LED=y
+CONFIG_NETFILTER_XT_TARGET_LOG=y
+CONFIG_NETFILTER_XT_TARGET_MARK=y
+CONFIG_NETFILTER_XT_TARGET_MASQUERADE=y
+CONFIG_NETFILTER_XT_TARGET_NETMAP=y
+CONFIG_NETFILTER_XT_TARGET_NFLOG=y
+CONFIG_NETFILTER_XT_TARGET_NFQUEUE=y
+CONFIG_NETFILTER_XT_TARGET_NOTRACK=y
+CONFIG_NETFILTER_XT_TARGET_RATEEST=y
+CONFIG_NETFILTER_XT_TARGET_REDIRECT=y
+CONFIG_NETFILTER_XT_TARGET_SECMARK=y
+CONFIG_NETFILTER_XT_TARGET_TCPMSS=y
+CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP=y
+CONFIG_NETFILTER_XT_TARGET_TEE=y
+CONFIG_NETFILTER_XT_TARGET_TPROXY=y
+CONFIG_NETFILTER_XT_TARGET_TRACE=y
+CONFIG_NF_CONNTRACK_AMANDA=y
 CONFIG_NF_CONNTRACK_BRIDGE=y
+CONFIG_NF_CONNTRACK_BROADCAST=y
+CONFIG_NF_CONNTRACK_EVENTS=y
+CONFIG_NF_CONNTRACK_FTP=y
+CONFIG_NF_CONNTRACK_H323=y
+CONFIG_NF_CONNTRACK_IRC=y
+CONFIG_NF_CONNTRACK_LABELS=y
+CONFIG_NF_CONNTRACK_MARK=y
+CONFIG_NF_CONNTRACK_NETBIOS_NS=y
+CONFIG_NF_CONNTRACK_PPTP=y
+CONFIG_NF_CONNTRACK_SANE=y
+CONFIG_NF_CONNTRACK_SECMARK=y
+CONFIG_NF_CONNTRACK_SIP=y
+CONFIG_NF_CONNTRACK_SNMP=y
+CONFIG_NF_CONNTRACK_TFTP=y
+CONFIG_NF_CONNTRACK_TIMEOUT=y
+CONFIG_NF_CONNTRACK_TIMESTAMP=y
+CONFIG_NF_CONNTRACK=y
+CONFIG_NF_CONNTRACK_ZONES=y
+CONFIG_NF_CT_NETLINK_HELPER=y
+CONFIG_NF_CT_NETLINK_TIMEOUT=y
+CONFIG_NF_CT_NETLINK=y
+CONFIG_NF_CT_PROTO_DCCP=y
+CONFIG_NF_CT_PROTO_GRE=y
+CONFIG_NF_CT_PROTO_SCTP=y
+CONFIG_NF_CT_PROTO_UDPLITE=y
+CONFIG_NF_DEFRAG_IPV4=y
+CONFIG_NF_DEFRAG_IPV6=y
+CONFIG_NF_DUP_IPV4=y
+CONFIG_NF_DUP_IPV6=y
+CONFIG_NF_DUP_NETDEV=y
+CONFIG_NF_FLOW_TABLE_INET=y
+CONFIG_NF_FLOW_TABLE=y
+CONFIG_NF_LOG_ARP=y
+CONFIG_NF_LOG_IPV4=y
+CONFIG_NF_LOG_IPV6=y
+CONFIG_NF_LOG_SYSLOG=y
+CONFIG_NF_NAT_AMANDA=y
+CONFIG_NF_NAT_FTP=y
+CONFIG_NF_NAT_H323=y
+CONFIG_NF_NAT_IRC=y
+CONFIG_NF_NAT_MASQUERADE=y
+CONFIG_NF_NAT_PPTP=y
+CONFIG_NF_NAT_REDIRECT=y
+CONFIG_NF_NAT_SIP=y
+CONFIG_NF_NAT_SNMP_BASIC=y
+CONFIG_NF_NAT_TFTP=y
+CONFIG_NF_NAT=y
+CONFIG_NF_REJECT_IPV4=y
+CONFIG_NF_REJECT_IPV6=y
+CONFIG_NF_SOCKET_IPV4=y
+CONFIG_NF_SOCKET_IPV6=y
+CONFIG_NF_TABLES_ARP=y
+CONFIG_NF_TABLES_BRIDGE=y
+CONFIG_NF_TABLES_INET=y
+CONFIG_NF_TABLES_IPV4=y
+CONFIG_NF_TABLES_IPV6=y
+CONFIG_NF_TABLES_NETDEV=y
+CONFIG_NF_TABLES=y
+CONFIG_NFT_BRIDGE_META=y
+CONFIG_NFT_BRIDGE_REJECT=y
+CONFIG_NFT_COMPAT=y
+CONFIG_NFT_CONNLIMIT=y
+CONFIG_NFT_CT=y
+CONFIG_NFT_DUP_IPV4=y
+CONFIG_NFT_DUP_IPV6=y
+CONFIG_NFT_DUP_NETDEV=y
+CONFIG_NFT_FIB_INET=y
+CONFIG_NFT_FIB_IPV4=y
+CONFIG_NFT_FIB_IPV6=y
+CONFIG_NFT_FIB_NETDEV=y
+CONFIG_NFT_FIB=y
+CONFIG_NFT_FLOW_OFFLOAD=y
+CONFIG_NFT_FWD_NETDEV=y
+CONFIG_NFT_HASH=y
+CONFIG_NFT_LIMIT=y
+CONFIG_NFT_LOG=y
+CONFIG_NFT_MASQ=y
+CONFIG_NFT_NAT=y
+CONFIG_NFT_NUMGEN=y
+CONFIG_NFT_OBJREF=y
+CONFIG_NFT_OSF=y
+CONFIG_NF_TPROXY_IPV4=y
+CONFIG_NF_TPROXY_IPV6=y
+CONFIG_NFT_QUEUE=y
+CONFIG_NFT_QUOTA=y
+CONFIG_NFT_REDIR=y
+CONFIG_NFT_REJECT_INET=y
+CONFIG_NFT_REJECT_IPV4=y
+CONFIG_NFT_REJECT_IPV6=y
+CONFIG_NFT_REJECT_NETDEV=y
+CONFIG_NFT_REJECT=y
+CONFIG_NFT_SOCKET=y
+CONFIG_NFT_SYNPROXY=y
+CONFIG_NFT_TPROXY=y
+CONFIG_NFT_TUNNEL=y
+CONFIG_NFT_XFRM=y
diff --git a/pkgs/build-support/fetchbzr/builder.sh b/pkgs/build-support/fetchbzr/builder.sh
index 380642a5e681..991864719a07 100644
--- a/pkgs/build-support/fetchbzr/builder.sh
+++ b/pkgs/build-support/fetchbzr/builder.sh
@@ -5,4 +5,4 @@ echo "exporting \`$url' (revision $rev) into \`$out'"
 
 # Perform a lightweight checkout so that we don't end up importing
 # all the repository's history.
-BZR_LOG=/dev/null bzr -Ossl.cert_reqs=none export -r "$rev" --format=dir "$out" "$url"
+XDG_CACHE_HOME="$TMPDIR" BRZ_LOG=/dev/null bzr -Ossl.cert_reqs=none export -r "$rev" --format=dir "$out" "$url"
diff --git a/pkgs/build-support/replace-dependency.nix b/pkgs/build-support/replace-dependency.nix
index 01b93c194c39..5b4c127cdd8e 100644
--- a/pkgs/build-support/replace-dependency.nix
+++ b/pkgs/build-support/replace-dependency.nix
@@ -1,4 +1,4 @@
-{ runCommand, nix, lib }:
+{ runCommandLocal, nix, lib }:
 
 # Replace a single dependency in the requisites tree of drv, propagating
 # the change all the way up the tree, without a full rebuild. This can be
@@ -23,7 +23,7 @@ with lib;
 
 let
   warn = if verbose then builtins.trace else (x: y: y);
-  references = import (runCommand "references.nix" { exportReferencesGraph = [ "graph" drv ]; } ''
+  references = import (runCommandLocal "references.nix" { exportReferencesGraph = [ "graph" drv ]; } ''
     (echo {
     while read path
     do
@@ -61,7 +61,7 @@ let
   drvName = drv:
     discard (substring 33 (stringLength (builtins.baseNameOf drv)) (builtins.baseNameOf drv));
 
-  rewriteHashes = drv: hashes: runCommand (drvName drv) { nixStore = "${nix.out}/bin/nix-store"; } ''
+  rewriteHashes = drv: hashes: runCommandLocal (drvName drv) { nixStore = "${nix.out}/bin/nix-store"; } ''
     $nixStore --dump ${drv} | sed 's|${baseNameOf drv}|'$(basename $out)'|g' | sed -e ${
       concatStringsSep " -e " (mapAttrsToList (name: value:
         "'s|${baseNameOf name}|${baseNameOf value}|g'"
diff --git a/pkgs/build-support/rust/build-rust-package/default.nix b/pkgs/build-support/rust/build-rust-package/default.nix
index b057d1681b03..5ba166bae1a3 100644
--- a/pkgs/build-support/rust/build-rust-package/default.nix
+++ b/pkgs/build-support/rust/build-rust-package/default.nix
@@ -154,8 +154,6 @@ stdenv.mkDerivation ((removeAttrs args [ "depsExtraArgs" "cargoUpdateHook" "carg
 
   strictDeps = true;
 
-  passthru = { inherit cargoDeps; } // (args.passthru or {});
-
   meta = {
     # default to Rust's platforms
     platforms = rustc.meta.platforms;
diff --git a/pkgs/data/fonts/ibm-plex/default.nix b/pkgs/data/fonts/ibm-plex/default.nix
index 0de1f38a0ff8..21321d83af34 100644
--- a/pkgs/data/fonts/ibm-plex/default.nix
+++ b/pkgs/data/fonts/ibm-plex/default.nix
@@ -2,11 +2,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "ibm-plex";
-  version = "6.1.1";
+  version = "6.2.0";
 
   src = fetchzip {
     url = "https://github.com/IBM/plex/releases/download/v${version}/OpenType.zip";
-    hash = "sha256-PZ7KPtaXZFVD5uMc7i+GQMA4DU5PsspeAodiU/FrTpY=";
+    hash = "sha256-RvD/aeZrvltJiuAHqYMNaRsjLgTdcC1/5zqlcd4qKAA=";
   };
 
   installPhase = ''
diff --git a/pkgs/development/compilers/elm/default.nix b/pkgs/development/compilers/elm/default.nix
index e5ccffc7e76a..1005bd27469a 100644
--- a/pkgs/development/compilers/elm/default.nix
+++ b/pkgs/development/compilers/elm/default.nix
@@ -7,7 +7,8 @@ let
 
   fetchElmDeps = pkgs.callPackage ./fetchElmDeps.nix { };
 
-  hsPkgs = self: pkgs.haskell.packages.ghc810.override {
+  # Haskell packages that require ghc 8.10
+  hs810Pkgs = self: pkgs.haskell.packages.ghc810.override {
     overrides = self: super: with pkgs.haskell.lib.compose; with lib;
     let elmPkgs = rec {
       elm = overrideCabal (drv: {
@@ -31,20 +32,6 @@ let
         maintainers = with maintainers; [ domenkozar turbomack ];
       }) (self.callPackage ./packages/elm.nix { });
 
-      /*
-      The elm-format expression is updated via a script in the https://github.com/avh4/elm-format repo:
-      `package/nix/build.sh`
-      */
-      elm-format = justStaticExecutables (overrideCabal (drv: {
-        jailbreak = true;
-        doCheck = assert (drv.version == "0.8.5"); false; # golden tests fail with optparse-applicative 0.17
-
-        description = "Formats Elm source code according to a standard set of rules based on the official Elm Style Guide";
-        homepage = "https://github.com/avh4/elm-format";
-        license = licenses.bsd3;
-        maintainers = with maintainers; [ avh4 turbomack ];
-      }) (self.callPackage ./packages/elm-format.nix {}));
-
       elmi-to-json = justStaticExecutables (overrideCabal (drv: {
         prePatch = ''
           substituteInPlace package.yaml --replace "- -Werror" ""
@@ -84,23 +71,48 @@ let
       # aeson 2.0.3.0 does not build with attoparsec_0_13_2_5
       aeson = self.aeson_1_5_6_0;
 
-      # Needed for elm-format
+      # elm-instrument needs this
       indents = self.callPackage ./packages/indents.nix {};
-      bimap = self.callPackage ./packages/bimap.nix {};
+
+      # elm-instrument's tests depend on an old version of elm-format, but we set doCheck to false for other reasons above
+      elm-format = null;
+    };
+  };
+
+  # Haskell packages that require ghc 9.2
+  hs92Pkgs = self: pkgs.haskell.packages.ghc92.override {
+    overrides = self: super: with pkgs.haskell.lib.compose; with lib;
+    let elmPkgs = rec {
+      /*
+      The elm-format expression is updated via a script in the https://github.com/avh4/elm-format repo:
+      `package/nix/build.sh`
+      */
+      elm-format = justStaticExecutables (overrideCabal (drv: {
+        jailbreak = true;
+
+        description = "Formats Elm source code according to a standard set of rules based on the official Elm Style Guide";
+        homepage = "https://github.com/avh4/elm-format";
+        license = licenses.bsd3;
+        maintainers = with maintainers; [ avh4 turbomack ];
+      }) (self.callPackage ./packages/elm-format.nix {}));
+    };
+    in elmPkgs // {
+      inherit elmPkgs;
+
+      # Needed for elm-format
       avh4-lib = doJailbreak (self.callPackage ./packages/avh4-lib.nix {});
       elm-format-lib = doJailbreak (self.callPackage ./packages/elm-format-lib.nix {});
-      # We need tasty-hspec < 1.1.7 and hspec-golden < 0.2 to build elm-format-lib
-      tasty-hspec = self.tasty-hspec_1_1_6;
-      hspec-golden = self.hspec-golden_0_1_0_3;
-
-      # We need hspec hspec_core, hspec_discover < 2.8 for tasty-hspec == 1.1.6
-      hspec = self.hspec_2_7_10;
-      hspec-core = self.hspec-core_2_7_10;
-      hspec-discover = self.hspec-discover_2_7_10;
-      hspec-meta = self.hspec-meta_2_7_8;
-
       elm-format-test-lib = self.callPackage ./packages/elm-format-test-lib.nix {};
       elm-format-markdown = self.callPackage ./packages/elm-format-markdown.nix {};
+
+      # elm-format requires text >= 2.0
+      text = self.text_2_0_1;
+      # elm-format-lib requires hspec-golden < 0.2
+      hspec-golden = self.hspec-golden_0_1_0_3;
+      # unorderd-container's tests indirectly depend on text < 2.0
+      unordered-containers = overrideCabal (drv: { doCheck = false; }) super.unordered-containers;
+      # relude-1.1.0.0's tests depend on hedgehog < 1.2, which indirectly depends on text < 2.0
+      relude = overrideCabal (drv: { doCheck = false; }) super.relude;
     };
   };
 
@@ -122,7 +134,7 @@ in lib.makeScope pkgs.newScope (self: with self; {
         `patchNpmElm` function also defined in `packages/lib.nix`.
   */
   elmLib = let
-    hsElmPkgs = hsPkgs self;
+    hsElmPkgs = hs810Pkgs self;
   in import ./packages/lib.nix {
     inherit lib;
     inherit (pkgs) writeScriptBin stdenv;
@@ -141,7 +153,7 @@ in lib.makeScope pkgs.newScope (self: with self; {
       maintainers = [ maintainers.turbomack ];
     };
   };
-} // (hsPkgs self).elmPkgs // (with elmLib; with (hsPkgs self).elmPkgs; {
+} // (hs810Pkgs self).elmPkgs // (hs92Pkgs self).elmPkgs // (with elmLib; with (hs810Pkgs self).elmPkgs; {
   elm-verify-examples = patchBinwrap [elmi-to-json] nodePkgs.elm-verify-examples // {
     meta = with lib; nodePkgs.elm-verify-examples.meta // {
       description = "Verify examples in your docs";
diff --git a/pkgs/development/compilers/elm/packages/avh4-lib.nix b/pkgs/development/compilers/elm/packages/avh4-lib.nix
index cd3df7d67a96..96ee35af27c9 100644
--- a/pkgs/development/compilers/elm/packages/avh4-lib.nix
+++ b/pkgs/development/compilers/elm/packages/avh4-lib.nix
@@ -1,26 +1,26 @@
 { mkDerivation, ansi-terminal, ansi-wl-pprint, array, base, bimap
 , binary, bytestring, containers, directory, fetchgit, filepath
-, lib, mtl, process, relude, tasty, tasty-discover, tasty-hspec
-, tasty-hunit, text
+, lib, mtl, pooled-io, process, relude, tasty, tasty-discover
+, tasty-hspec, tasty-hunit, text
 }:
 mkDerivation {
   pname = "avh4-lib";
   version = "0.0.0.1";
   src = fetchgit {
     url = "https://github.com/avh4/elm-format";
-    sha256 = "0bcjkcs1dy1csz0mpk7d4b5wf93fsj9p86x8fp42mb0pipdd0bh6";
-    rev = "80f15d85ee71e1663c9b53903f2b5b2aa444a3be";
+    sha256 = "1aiq3mv2ycv6bal5hnz6k33bzmnnidzxxs5b6z9y6lvmr0lbf3j4";
+    rev = "7e80dd48dd9b30994e43f4804b2ea7118664e8e0";
     fetchSubmodules = true;
   };
   postUnpack = "sourceRoot+=/avh4-lib; echo source root reset to $sourceRoot";
   libraryHaskellDepends = [
     ansi-terminal ansi-wl-pprint array base bimap binary bytestring
-    containers directory filepath mtl process relude text
+    containers directory filepath mtl pooled-io process relude text
   ];
   testHaskellDepends = [
     ansi-terminal ansi-wl-pprint array base bimap binary bytestring
-    containers directory filepath mtl process relude tasty tasty-hspec
-    tasty-hunit text
+    containers directory filepath mtl pooled-io process relude tasty
+    tasty-hspec tasty-hunit text
   ];
   testToolDepends = [ tasty-discover ];
   doHaddock = false;
diff --git a/pkgs/development/compilers/elm/packages/elm-format-lib.nix b/pkgs/development/compilers/elm/packages/elm-format-lib.nix
index 7beb52e8006e..255e43af6917 100644
--- a/pkgs/development/compilers/elm/packages/elm-format-lib.nix
+++ b/pkgs/development/compilers/elm/packages/elm-format-lib.nix
@@ -1,30 +1,30 @@
-{ mkDerivation, ansi-terminal, ansi-wl-pprint, array, avh4-lib
-, base, bimap, binary, bytestring, containers, directory
+{ mkDerivation, aeson, ansi-terminal, ansi-wl-pprint, array
+, avh4-lib, base, bimap, binary, bytestring, containers, directory
 , elm-format-markdown, elm-format-test-lib, fetchgit, filepath
-, indents, json, lib, mtl, optparse-applicative, parsec, process
-, relude, split, tasty, tasty-discover, tasty-hspec, tasty-hunit
-, text
+, ghc-prim, hspec, lib, mtl, optparse-applicative, process, relude
+, split, tasty, tasty-discover, tasty-hspec, tasty-hunit, text
 }:
 mkDerivation {
   pname = "elm-format-lib";
   version = "0.0.0.1";
   src = fetchgit {
     url = "https://github.com/avh4/elm-format";
-    sha256 = "0bcjkcs1dy1csz0mpk7d4b5wf93fsj9p86x8fp42mb0pipdd0bh6";
-    rev = "80f15d85ee71e1663c9b53903f2b5b2aa444a3be";
+    sha256 = "1aiq3mv2ycv6bal5hnz6k33bzmnnidzxxs5b6z9y6lvmr0lbf3j4";
+    rev = "7e80dd48dd9b30994e43f4804b2ea7118664e8e0";
     fetchSubmodules = true;
   };
   postUnpack = "sourceRoot+=/elm-format-lib; echo source root reset to $sourceRoot";
   libraryHaskellDepends = [
-    ansi-terminal ansi-wl-pprint array avh4-lib base bimap binary
+    aeson ansi-terminal ansi-wl-pprint array avh4-lib base bimap binary
     bytestring containers directory elm-format-markdown filepath
-    indents json mtl optparse-applicative parsec process relude text
+    ghc-prim mtl optparse-applicative process relude text
   ];
   testHaskellDepends = [
-    ansi-terminal ansi-wl-pprint array avh4-lib base bimap binary
+    aeson ansi-terminal ansi-wl-pprint array avh4-lib base bimap binary
     bytestring containers directory elm-format-markdown
-    elm-format-test-lib filepath indents json mtl optparse-applicative
-    parsec process relude split tasty tasty-hspec tasty-hunit text
+    elm-format-test-lib filepath ghc-prim hspec mtl
+    optparse-applicative process relude split tasty tasty-hspec
+    tasty-hunit text
   ];
   testToolDepends = [ tasty-discover ];
   doHaddock = false;
diff --git a/pkgs/development/compilers/elm/packages/elm-format-markdown.nix b/pkgs/development/compilers/elm/packages/elm-format-markdown.nix
index ae3b40347dbb..f5cc03c95326 100644
--- a/pkgs/development/compilers/elm/packages/elm-format-markdown.nix
+++ b/pkgs/development/compilers/elm/packages/elm-format-markdown.nix
@@ -4,8 +4,8 @@ mkDerivation {
   version = "0.0.0.1";
   src = fetchgit {
     url = "https://github.com/avh4/elm-format";
-    sha256 = "0bcjkcs1dy1csz0mpk7d4b5wf93fsj9p86x8fp42mb0pipdd0bh6";
-    rev = "80f15d85ee71e1663c9b53903f2b5b2aa444a3be";
+    sha256 = "1aiq3mv2ycv6bal5hnz6k33bzmnnidzxxs5b6z9y6lvmr0lbf3j4";
+    rev = "7e80dd48dd9b30994e43f4804b2ea7118664e8e0";
     fetchSubmodules = true;
   };
   postUnpack = "sourceRoot+=/elm-format-markdown; echo source root reset to $sourceRoot";
diff --git a/pkgs/development/compilers/elm/packages/elm-format-test-lib.nix b/pkgs/development/compilers/elm/packages/elm-format-test-lib.nix
index 729c2d678fce..6dd8598be32b 100644
--- a/pkgs/development/compilers/elm/packages/elm-format-test-lib.nix
+++ b/pkgs/development/compilers/elm/packages/elm-format-test-lib.nix
@@ -1,24 +1,24 @@
 { mkDerivation, avh4-lib, base, containers, fetchgit, filepath
-, hspec-core, hspec-golden, lib, mtl, split, tasty, tasty-discover
-, tasty-hspec, tasty-hunit, text
+, hspec, hspec-core, hspec-golden, lib, mtl, split, tasty
+, tasty-discover, tasty-hspec, tasty-hunit, text
 }:
 mkDerivation {
   pname = "elm-format-test-lib";
   version = "0.0.0.1";
   src = fetchgit {
     url = "https://github.com/avh4/elm-format";
-    sha256 = "0bcjkcs1dy1csz0mpk7d4b5wf93fsj9p86x8fp42mb0pipdd0bh6";
-    rev = "80f15d85ee71e1663c9b53903f2b5b2aa444a3be";
+    sha256 = "1aiq3mv2ycv6bal5hnz6k33bzmnnidzxxs5b6z9y6lvmr0lbf3j4";
+    rev = "7e80dd48dd9b30994e43f4804b2ea7118664e8e0";
     fetchSubmodules = true;
   };
   postUnpack = "sourceRoot+=/elm-format-test-lib; echo source root reset to $sourceRoot";
   libraryHaskellDepends = [
-    avh4-lib base containers filepath hspec-core hspec-golden mtl split
-    tasty tasty-hspec tasty-hunit text
+    avh4-lib base containers filepath hspec hspec-core hspec-golden mtl
+    split tasty tasty-hspec tasty-hunit text
   ];
   testHaskellDepends = [
-    avh4-lib base containers filepath hspec-core hspec-golden mtl split
-    tasty tasty-hspec tasty-hunit text
+    avh4-lib base containers filepath hspec hspec-core hspec-golden mtl
+    split tasty tasty-hspec tasty-hunit text
   ];
   testToolDepends = [ tasty-discover ];
   doHaddock = false;
diff --git a/pkgs/development/compilers/elm/packages/elm-format.nix b/pkgs/development/compilers/elm/packages/elm-format.nix
index 6b583a6edde2..1f88650bd3f6 100644
--- a/pkgs/development/compilers/elm/packages/elm-format.nix
+++ b/pkgs/development/compilers/elm/packages/elm-format.nix
@@ -1,33 +1,35 @@
-{ mkDerivation, ansi-wl-pprint, avh4-lib, base, bimap, cmark
-, containers, elm-format-lib, elm-format-test-lib, fetchgit, json
-, lib, mtl, optparse-applicative, parsec, QuickCheck, quickcheck-io
-, relude, tasty, tasty-hspec, tasty-hunit, tasty-quickcheck, text
+{ mkDerivation, aeson, ansi-wl-pprint, avh4-lib, base, bimap
+, bytestring, containers, elm-format-lib, elm-format-test-lib
+, fetchgit, hspec, lib, mtl, optparse-applicative, QuickCheck
+, quickcheck-io, relude, tasty, tasty-hspec, tasty-hunit
+, tasty-quickcheck, text
 }:
 mkDerivation rec {
   pname = "elm-format";
-  version = "0.8.5";
+  version = "0.8.6";
   src = fetchgit {
     url = "https://github.com/avh4/elm-format";
-    sha256 = "0bcjkcs1dy1csz0mpk7d4b5wf93fsj9p86x8fp42mb0pipdd0bh6";
-    rev = "80f15d85ee71e1663c9b53903f2b5b2aa444a3be";
+    sha256 = "1aiq3mv2ycv6bal5hnz6k33bzmnnidzxxs5b6z9y6lvmr0lbf3j4";
+    rev = "7e80dd48dd9b30994e43f4804b2ea7118664e8e0";
     fetchSubmodules = true;
   };
   isLibrary = false;
   isExecutable = true;
   executableHaskellDepends = [
-    ansi-wl-pprint avh4-lib base containers elm-format-lib json
-    optparse-applicative relude text
+    aeson ansi-wl-pprint avh4-lib base bytestring containers
+    elm-format-lib optparse-applicative relude text
   ];
   testHaskellDepends = [
-    ansi-wl-pprint avh4-lib base bimap cmark containers elm-format-lib
-    elm-format-test-lib json mtl optparse-applicative parsec QuickCheck
-    quickcheck-io relude tasty tasty-hspec tasty-hunit tasty-quickcheck
-    text
+    aeson ansi-wl-pprint avh4-lib base bimap bytestring containers
+    elm-format-lib elm-format-test-lib hspec mtl optparse-applicative
+    QuickCheck quickcheck-io relude tasty tasty-hspec tasty-hunit
+    tasty-quickcheck text
   ];
   doHaddock = false;
   homepage = "https://elm-lang.org";
   description = "A source code formatter for Elm";
   license = lib.licenses.bsd3;
+  mainProgram = "elm-format";
   postPatch = ''
     mkdir -p ./generated
     cat <<EOHS > ./generated/Build_elm_format.hs
diff --git a/pkgs/development/compilers/llvm/15/compiler-rt/default.nix b/pkgs/development/compilers/llvm/15/compiler-rt/default.nix
index 6f20d23b32bc..b1a3b09cb72c 100644
--- a/pkgs/development/compilers/llvm/15/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/15/compiler-rt/default.nix
@@ -86,25 +86,7 @@ stdenv.mkDerivation {
     ../../common/compiler-rt/darwin-plistbuddy-workaround.patch
     # See: https://github.com/NixOS/nixpkgs/pull/194634#discussion_r999829893
     ./armv7l.patch
-  ]
-    # The `compiler-rt` build inspects `ld` to figure out whether it needs to
-    # explicitly call `codesign`:
-    # https://github.com/llvm/llvm-project/blob/27ef42bec80b6c010b7b3729ed0528619521a690/compiler-rt/cmake/Modules/AddCompilerRT.cmake#L409-L422
-    #
-    # In our case, despite (currently) having an `ld` version than 609, we don't
-    # need an explicit codesigning step because `postLinkSignHook` handles this
-    # for us.
-    #
-    # Unfortunately there isn't an easy way to override
-    # `NEED_EXPLICIT_ADHOC_CODESIGN`.
-    #
-    # Adding `codesign` as a build input also doesn't currently work because, as
-    # of this writing, `codesign` in nixpkgs doesn't support the `--sign` alias
-    # which the `compiler-rt` build uses. See here for context:
-    # https://github.com/NixOS/nixpkgs/pull/194634#issuecomment-1272116014
-    #
-    # So, for now, we patch `compiler-rt` to skip the explicit codesigning step.
-    ++ lib.optional stdenv.hostPlatform.isDarwin ./skip-explicit-codesign.patch;
+  ];
 
   # TSAN requires XPC on Darwin, which we have no public/free source files for. We can depend on the Apple frameworks
   # to get it, but they're unfree. Since LLVM is rather central to the stdenv, we patch out TSAN support so that Hydra
diff --git a/pkgs/development/compilers/llvm/15/compiler-rt/skip-explicit-codesign.patch b/pkgs/development/compilers/llvm/15/compiler-rt/skip-explicit-codesign.patch
deleted file mode 100644
index 894a74e74d46..000000000000
--- a/pkgs/development/compilers/llvm/15/compiler-rt/skip-explicit-codesign.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff --git a/cmake/Modules/AddCompilerRT.cmake b/cmake/Modules/AddCompilerRT.cmake
---- a/cmake/Modules/AddCompilerRT.cmake
-+++ b/cmake/Modules/AddCompilerRT.cmake
-@@ -406,7 +406,7 @@ function(add_compiler_rt_runtime name type)
-         if (HAD_ERROR)
-           message(FATAL_ERROR "${CMAKE_LINKER} failed with status ${HAD_ERROR}")
-         endif()
--        set(NEED_EXPLICIT_ADHOC_CODESIGN 1)
-+        set(NEED_EXPLICIT_ADHOC_CODESIGN 0) # `postLinkSignHook` handles this for us
-         if ("${LD_V_OUTPUT}" MATCHES ".*ld64-([0-9.]+).*")
-           string(REGEX REPLACE ".*ld64-([0-9.]+).*" "\\1" HOST_LINK_VERSION ${LD_V_OUTPUT})
-           if (HOST_LINK_VERSION VERSION_GREATER_EQUAL 609)
diff --git a/pkgs/development/libraries/exprtk/default.nix b/pkgs/development/libraries/exprtk/default.nix
index 3e109956c674..8dc4f7598abd 100644
--- a/pkgs/development/libraries/exprtk/default.nix
+++ b/pkgs/development/libraries/exprtk/default.nix
@@ -1,14 +1,14 @@
 { lib, stdenv, fetchFromGitHub }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
   pname = "exprtk";
-  version = "unstable-2021-12-31";
+  version = "0.0.2";
 
   src = fetchFromGitHub {
     owner = "ArashPartow";
-    repo = "exprtk";
-    rev = "806c519c91fd08ba4fa19380dbf3f6e42de9e2d1";
-    hash = "sha256-5/k+y3gNJeggfwXmtAVqmaiV+BXX+WKtWwZWcQSrQDM=";
+    repo = pname;
+    rev = version;
+    hash = "sha256-ZV5nS6wEbKfzXhfXEtVlkwaEtxpTOYQaGlaxKx3FIvE=";
   };
 
   dontBuild = true;
diff --git a/pkgs/development/libraries/libjcat/default.nix b/pkgs/development/libraries/libjcat/default.nix
index 18376f4b7f42..8c052b5ce80c 100644
--- a/pkgs/development/libraries/libjcat/default.nix
+++ b/pkgs/development/libraries/libjcat/default.nix
@@ -71,7 +71,7 @@ stdenv.mkDerivation rec {
     description = "Library for reading and writing Jcat files";
     homepage = "https://github.com/hughsie/libjcat";
     license = licenses.lgpl21Plus;
-    maintainers = with maintainers; [ jtojnar ];
+    maintainers = with maintainers; [ ];
     platforms = platforms.all;
   };
 }
diff --git a/pkgs/development/libraries/libxmlb/default.nix b/pkgs/development/libraries/libxmlb/default.nix
index 09dbcc3a0f51..2a1f0941f4db 100644
--- a/pkgs/development/libraries/libxmlb/default.nix
+++ b/pkgs/development/libraries/libxmlb/default.nix
@@ -71,7 +71,7 @@ stdenv.mkDerivation rec {
     description = "A library to help create and query binary XML blobs";
     homepage = "https://github.com/hughsie/libxmlb";
     license = licenses.lgpl21Plus;
-    maintainers = with maintainers; [ jtojnar ];
+    maintainers = with maintainers; [ ];
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/libraries/science/math/libbraiding/default.nix b/pkgs/development/libraries/science/math/libbraiding/default.nix
index cc5d3baf3442..2ee2e831f6e6 100644
--- a/pkgs/development/libraries/science/math/libbraiding/default.nix
+++ b/pkgs/development/libraries/science/math/libbraiding/default.nix
@@ -4,14 +4,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "1.1";
+  version = "1.2";
   pname = "libbraiding";
 
   src = fetchFromGitHub {
     owner = "miguelmarco";
     repo = "libbraiding";
     rev = version;
-    sha256 = "1n1j58y9jaiv0ya0y4fpfb3b05wv0h6k2babpnk2zifjw26xr366";
+    sha256 = "sha256-cgg6rvlOvFqGjgbw6i7QXS+tqvfFd1MkPCEjnW/FyFs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix b/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix
index 3fbd115edd4f..60a6f2872fe9 100644
--- a/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix
+++ b/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "appthreat-vulnerability-db";
-  version = "4.3.1";
+  version = "5.0.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "AppThreat";
     repo = "vulnerability-db";
     rev = "refs/tags/v${version}";
-    hash = "sha256-HZHHSY8a7xyJZAQLFeZ+5+CKixcquJcUkkjJTllFiyk=";
+    hash = "sha256-u5gI5agNm1RT0FzsdQaqivKwiY5k7G/mtlSWCNP4V10=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/breezy/Cargo.lock b/pkgs/development/python-modules/breezy/Cargo.lock
new file mode 100644
index 000000000000..7333bfe40f31
--- /dev/null
+++ b/pkgs/development/python-modules/breezy/Cargo.lock
@@ -0,0 +1,311 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "aho-corasick"
+version = "0.7.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cc936419f96fa211c1b9166887b38e5e40b19958e5b895be7c1f93adec7071ac"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "autocfg"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
+
+[[package]]
+name = "bitflags"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+
+[[package]]
+name = "breezy"
+version = "3.3.2"
+dependencies = [
+ "pyo3",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+
+[[package]]
+name = "indoc"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47741a8bc60fb26eb8d6e0238bbb26d8575ff623fdc97b1a2c00c050b9684ed8"
+dependencies = [
+ "indoc-impl",
+ "proc-macro-hack",
+]
+
+[[package]]
+name = "indoc-impl"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce046d161f000fffde5f432a0d034d0341dc152643b2598ed5bfce44c4f3a8f0"
+dependencies = [
+ "proc-macro-hack",
+ "proc-macro2",
+ "quote",
+ "syn",
+ "unindent",
+]
+
+[[package]]
+name = "instant"
+version = "0.1.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a5bbe824c507c5da5956355e86a746d82e0e1464f65d862cc5e71da70e94b2c"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "lazy_static"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
+
+[[package]]
+name = "libc"
+version = "0.2.139"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "201de327520df007757c1f0adce6e827fe8562fbc28bfd9c15571c66ca1f5f79"
+
+[[package]]
+name = "lock_api"
+version = "0.4.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "435011366fe56583b16cf956f9df0095b405b82d76425bc8981c0e22e60ec4df"
+dependencies = [
+ "autocfg",
+ "scopeguard",
+]
+
+[[package]]
+name = "memchr"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2dffe52ecf27772e601905b7522cb4ef790d2cc203488bbd0e2fe85fcb74566d"
+
+[[package]]
+name = "once_cell"
+version = "1.17.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7e5500299e16ebb147ae15a00a942af264cf3688f47923b8fc2cd5858f23ad3"
+
+[[package]]
+name = "parking_lot"
+version = "0.11.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d17b78036a60663b797adeaee46f5c9dfebb86948d1255007a1d6be0271ff99"
+dependencies = [
+ "instant",
+ "lock_api",
+ "parking_lot_core",
+]
+
+[[package]]
+name = "parking_lot_core"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "60a2cfe6f0ad2bfc16aefa463b497d5c7a5ecd44a23efa72aa342d90177356dc"
+dependencies = [
+ "cfg-if",
+ "instant",
+ "libc",
+ "redox_syscall",
+ "smallvec",
+ "winapi",
+]
+
+[[package]]
+name = "paste"
+version = "0.1.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "45ca20c77d80be666aef2b45486da86238fabe33e38306bd3118fe4af33fa880"
+dependencies = [
+ "paste-impl",
+ "proc-macro-hack",
+]
+
+[[package]]
+name = "paste-impl"
+version = "0.1.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d95a7db200b97ef370c8e6de0088252f7e0dfff7d047a28528e47456c0fc98b6"
+dependencies = [
+ "proc-macro-hack",
+]
+
+[[package]]
+name = "proc-macro-hack"
+version = "0.5.20+deprecated"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc375e1527247fe1a97d8b7156678dfe7c1af2fc075c9a4db3690ecd2a148068"
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.51"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d727cae5b39d21da60fa540906919ad737832fe0b1c165da3a34d6548c849d6"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "pyo3"
+version = "0.15.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d41d50a7271e08c7c8a54cd24af5d62f73ee3a6f6a314215281ebdec421d5752"
+dependencies = [
+ "cfg-if",
+ "indoc",
+ "libc",
+ "parking_lot",
+ "paste",
+ "pyo3-build-config",
+ "pyo3-macros",
+ "unindent",
+]
+
+[[package]]
+name = "pyo3-build-config"
+version = "0.15.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "779239fc40b8e18bc8416d3a37d280ca9b9fb04bda54b98037bb6748595c2410"
+dependencies = [
+ "once_cell",
+]
+
+[[package]]
+name = "pyo3-macros"
+version = "0.15.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "00b247e8c664be87998d8628e86f282c25066165f1f8dda66100c48202fdb93a"
+dependencies = [
+ "pyo3-macros-backend",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "pyo3-macros-backend"
+version = "0.15.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a8c2812c412e00e641d99eeb79dd478317d981d938aa60325dfa7157b607095"
+dependencies = [
+ "proc-macro2",
+ "pyo3-build-config",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8856d8364d252a14d474036ea1358d63c9e6965c8e5c1885c18f73d70bff9c7b"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.2.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fb5a58c1855b4b6819d59012155603f0b22ad30cad752600aadfcb695265519a"
+dependencies = [
+ "bitflags",
+]
+
+[[package]]
+name = "regex"
+version = "1.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "48aaa5748ba571fb95cd2c85c09f629215d3a6ece942baa100950af03a34f733"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.6.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "456c603be3e8d448b072f410900c09faf164fbce2d480456f50eea6e25f9c848"
+
+[[package]]
+name = "rio-py"
+version = "3.3.2"
+dependencies = [
+ "lazy_static",
+ "pyo3",
+ "regex",
+]
+
+[[package]]
+name = "scopeguard"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d29ab0c6d3fc0ee92fe66e2d99f700eab17a8d57d1c1d3b748380fb20baa78cd"
+
+[[package]]
+name = "smallvec"
+version = "1.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a507befe795404456341dfab10cef66ead4c041f62b8b11bbb92bffe5d0953e0"
+
+[[package]]
+name = "syn"
+version = "1.0.109"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "84a22b9f218b40614adcb3f4ff08b703773ad44fa9423e4e0d346d5db86e4ebc"
+
+[[package]]
+name = "unindent"
+version = "0.1.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e1766d682d402817b5ac4490b3c3002d91dfa0d22812f341609f97b08757359c"
+
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
diff --git a/pkgs/development/python-modules/breezy/default.nix b/pkgs/development/python-modules/breezy/default.nix
index c8104f1b2376..6d27908dd84f 100644
--- a/pkgs/development/python-modules/breezy/default.nix
+++ b/pkgs/development/python-modules/breezy/default.nix
@@ -1,57 +1,122 @@
 { lib
+, stdenv
 , buildPythonPackage
 , fetchPypi
 , configobj
-, patiencediff
+, cython
+, dulwich
 , fastbencode
 , fastimport
-, dulwich
+, libiconv
+, merge3
+, patiencediff
+, pyyaml
+, urllib3
+, breezy
 , launchpadlib
 , testtools
 , pythonOlder
 , installShellFiles
+, rustPlatform
+, setuptools-gettext
+, setuptools-rust
+, testers
 }:
 
 buildPythonPackage rec {
   pname = "breezy";
-  version = "3.2.2";
+  version = "3.3.2";
+  format = "pyproject";
 
   disabled = pythonOlder "3.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-GHpuRSCN0F2BdQc2cgyDcQz0gJT1R+xAgcVxJZVZpNU=";
+    sha256 = "sha256-TqaUn8uwdrl4VFsJn6xoq6011voYmd7vT2uCo9uiV8E=";
   };
 
-  nativeBuildInputs = [ installShellFiles ];
+  cargoDeps = rustPlatform.importCargoLock {
+    lockFile = ./Cargo.lock;
+  };
+
+  postPatch = ''
+    ln -s ${./Cargo.lock} Cargo.lock
+  '';
+
+  cargoHash = "sha256-xYZh/evNp036/wRlNWWUYeD2EkleM+OeY4qbYMCE00I=";
+
+  nativeBuildInputs = [
+    cython
+    installShellFiles
+    rustPlatform.cargoSetupHook
+    rustPlatform.rust.cargo
+    rustPlatform.rust.rustc
+    setuptools-gettext
+    setuptools-rust
+  ];
+
+  buildInputs = lib.optionals stdenv.isDarwin [ libiconv ];
 
   propagatedBuildInputs = [
     configobj
-    fastbencode
-    patiencediff
-    fastimport
     dulwich
-    launchpadlib
+    fastbencode
+    merge3
+    patiencediff
+    pyyaml
+    urllib3
+  ] ++ passthru.optional-dependencies.launchpad
+    ++ passthru.optional-dependencies.fastimport;
+
+  nativeCheckInputs = [
+    testtools
   ];
 
-  nativeCheckInputs = [ testtools ];
-
-  # There is a conflict with their `lazy_import` and plugin tests
+  # multiple failures on sandbox
   doCheck = false;
 
-  # symlink for bazaar compatibility
+  checkPhase = ''
+    runHook preCheck
+
+    HOME=$TMPDIR $out/bin/brz --no-plugins selftest
+
+    runHook postCheck
+  '';
+
   postInstall = ''
+    wrapProgram $out/bin/brz --prefix PYTHONPATH : "$PYTHONPATH"
+
+    # symlink for bazaar compatibility
     ln -s "$out/bin/brz" "$out/bin/bzr"
 
     installShellCompletion --cmd brz --bash contrib/bash/brz
   '';
 
-  pythonImportsCheck = [ "breezy" ];
+  pythonImportsCheck = [
+    "breezy"
+    "breezy.bzr.rio"
+  ];
+
+  passthru = {
+    tests.version = testers.testVersion {
+      package = breezy;
+      command = "HOME=$TMPDIR brz --version";
+    };
+    optional-dependencies = {
+      launchpad = [
+        launchpadlib
+      ];
+      fastimport = [
+        fastimport
+      ];
+    };
+  };
 
   meta = with lib; {
     description = "Friendly distributed version control system";
     homepage = "https://www.breezy-vcs.org/";
     license = licenses.gpl2Only;
     maintainers = [ maintainers.marsam ];
+    mainProgram = "brz";
   };
 }
diff --git a/pkgs/development/python-modules/hatch-jupyter-builder/default.nix b/pkgs/development/python-modules/hatch-jupyter-builder/default.nix
index d49c2aedb46f..8ce6f73c547b 100644
--- a/pkgs/development/python-modules/hatch-jupyter-builder/default.nix
+++ b/pkgs/development/python-modules/hatch-jupyter-builder/default.nix
@@ -2,7 +2,6 @@
 , buildPythonPackage
 , fetchFromGitHub
 , hatchling
-, hatch
 , pytest-mock
 , pytestCheckHook
 , tomli
@@ -26,7 +25,6 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
-    hatch
     pytest-mock
     pytestCheckHook
     tomli
diff --git a/pkgs/development/python-modules/jupyter-book/default.nix b/pkgs/development/python-modules/jupyter-book/default.nix
index ac2a6c8125df..12c4e08c9ae1 100644
--- a/pkgs/development/python-modules/jupyter-book/default.nix
+++ b/pkgs/development/python-modules/jupyter-book/default.nix
@@ -26,7 +26,7 @@
 
 buildPythonPackage rec {
   pname = "jupyter-book";
-  version = "0.13.2";
+  version = "0.14.0";
 
   format = "flit";
 
@@ -34,7 +34,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-wJWY0tBrlCkOFDfGZS4xWvv87sOlyrNl3fiGqgayqTs=";
+    sha256 = "sha256-BxrVrOsCqFRmx16l6YdkJplwdnU2XhRFMHd5DGy+dqE=";
   };
 
   nativeBuildInputs = [
@@ -65,8 +65,7 @@ buildPythonPackage rec {
 
   pythonRelaxDeps = [
     "docutils"
-    "myst-nb"
-    "sphinx"
+    "sphinx-book-theme"
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/merge3/default.nix b/pkgs/development/python-modules/merge3/default.nix
new file mode 100644
index 000000000000..e16a73eee3df
--- /dev/null
+++ b/pkgs/development/python-modules/merge3/default.nix
@@ -0,0 +1,35 @@
+{ lib
+, buildPythonPackage
+, pythonOlder
+, fetchPypi
+, setuptools
+}:
+
+buildPythonPackage rec {
+  pname = "merge3";
+  version = "0.0.13";
+
+  format = "pyproject";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "8abda1d2d49776323d23d09bfdd80d943a57d43d28d6152ffd2c87956a9b6b54";
+  };
+
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  pythonImportsCheck = [
+    "merge3"
+  ];
+
+  meta = with lib; {
+    description = "Python implementation of 3-way merge";
+    homepage = "https://github.com/breezy-team/merge3";
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ marsam ];
+  };
+}
diff --git a/pkgs/development/python-modules/pglast/default.nix b/pkgs/development/python-modules/pglast/default.nix
index 7c0f38b525d6..81445ebdeded 100644
--- a/pkgs/development/python-modules/pglast/default.nix
+++ b/pkgs/development/python-modules/pglast/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "pglast";
-  version = "5.0";
+  version = "5.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-bR/e5pZCrnMCUt9zEszI0aVlqezTzwR3DIdpXv/6qGM=";
+    hash = "sha256-fHWJWgy/Ven5m2Cf81rG/ZKmFFWiLJsIPVxFe+rr+ms=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/rpyc/default.nix b/pkgs/development/python-modules/rpyc/default.nix
index 5ad8494634fe..0d02b9b3d93a 100644
--- a/pkgs/development/python-modules/rpyc/default.nix
+++ b/pkgs/development/python-modules/rpyc/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "rpyc";
-  version = "5.3.0";
+  version = "5.3.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "tomerfiliba";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-gqYjCvyiLhgosmzYITrthMkjLA6WJcBbmjkTNXZKUxc=";
+    hash = "sha256-2b6ryqDqZPs5VniLhCwA1/c9+3CT+JJrr3VwP3G6tpY=";
   };
 
   nativeBuildInputs = [
@@ -56,6 +56,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Remote Python Call (RPyC), a transparent and symmetric RPC library";
     homepage = "https://rpyc.readthedocs.org";
+    changelog = "https://github.com/tomerfiliba-org/rpyc/blob/${version}/CHANGELOG.rst";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/setuptools-gettext/default.nix b/pkgs/development/python-modules/setuptools-gettext/default.nix
index f8b5d45bbc7f..882eb6d4599b 100644
--- a/pkgs/development/python-modules/setuptools-gettext/default.nix
+++ b/pkgs/development/python-modules/setuptools-gettext/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "setuptools-gettext";
-  version = "0.1.1";
+  version = "0.1.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     owner = "breezy-team";
     repo = "setuptools-gettext";
     rev = "refs/tags/v${version}";
-    hash = "sha256-MifsEuWNTEDJa9RfIbM/EDMJg0cmHXX6oJxNskKEbY4=";
+    hash = "sha256-pTjYdezNBFeLCh6cbC+YtHxQB4zrZAFTCjjNQffbHhc=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/sphinx-book-theme/default.nix b/pkgs/development/python-modules/sphinx-book-theme/default.nix
index 12a5878024b8..cb7c3a593b19 100644
--- a/pkgs/development/python-modules/sphinx-book-theme/default.nix
+++ b/pkgs/development/python-modules/sphinx-book-theme/default.nix
@@ -4,13 +4,12 @@
 , fetchPypi
 , sphinx
 , pydata-sphinx-theme
-, pyyaml
 , jupyter-book
 }:
 
 buildPythonPackage rec {
   pname = "sphinx-book-theme";
-  version = "1.0.0rc2";
+  version = "1.0.0";
 
   format = "wheel";
 
@@ -21,13 +20,12 @@ buildPythonPackage rec {
     dist = "py3";
     python = "py3";
     pname = "sphinx_book_theme";
-    sha256 = "43977402f55b79706e117c6de6f50e67dac6dad698eb9b75be07dc2e6a689bde";
+    sha256 = "sha256-9rq6eIjVpjMoohDplgp6bpUeljLXTttvzkjJ1djCh2g=";
   };
 
   propagatedBuildInputs = [
-    sphinx
     pydata-sphinx-theme
-    pyyaml
+    sphinx
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/ruby-modules/gem-config/default.nix b/pkgs/development/ruby-modules/gem-config/default.nix
index 644641a4ffdf..b6b1bb4b5d08 100644
--- a/pkgs/development/ruby-modules/gem-config/default.nix
+++ b/pkgs/development/ruby-modules/gem-config/default.nix
@@ -407,6 +407,9 @@ in
     buildFlags = [
       "--with-xml2-lib=${libxml2.out}/lib"
       "--with-xml2-include=${libxml2.dev}/include/libxml2"
+    ] ++ lib.optionals stdenv.isDarwin [
+      "--with-iconv-dir=${libiconv}"
+      "--with-opt-include=${libiconv}/include"
     ];
   };
 
diff --git a/pkgs/development/tools/analysis/codeql/default.nix b/pkgs/development/tools/analysis/codeql/default.nix
index 0f560d0b3a15..e80ac3b8e830 100644
--- a/pkgs/development/tools/analysis/codeql/default.nix
+++ b/pkgs/development/tools/analysis/codeql/default.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "codeql";
-  version = "2.12.2";
+  version = "2.12.3";
 
   dontConfigure = true;
   dontBuild = true;
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
 
   src = fetchzip {
     url = "https://github.com/github/codeql-cli-binaries/releases/download/v${version}/codeql.zip";
-    sha256 = "sha256-n36x50rGA0fzvbwrUDpzWmF7XqwTTxnAfFtBL23gEOE=";
+    sha256 = "sha256-xBTL3atnLsw7HWhkWq32LdQmSBtsQ2ydK+8On8l+OcA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/buf/default.nix b/pkgs/development/tools/buf/default.nix
index 7508e77da965..c5561b9b666f 100644
--- a/pkgs/development/tools/buf/default.nix
+++ b/pkgs/development/tools/buf/default.nix
@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "buf";
-  version = "1.14.0";
+  version = "1.15.0";
 
   src = fetchFromGitHub {
     owner = "bufbuild";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-fosvr8l/xql4j2/mGjbvbJQMUqBqBUturQJq+OQT/wM=";
+    hash = "sha256-63JWRyB586klWSQskBY/fDRTdXrQa15IygdZfmHpEqM=";
   };
 
-  vendorHash = "sha256-ZYmYLZXEzWrTt6JJOWyTmbVq8p7D8lhz07bmQ2Z7gKc=";
+  vendorHash = "sha256-XRv8AnktIPR1emRdRMmDwOh7r3kNByy0REwZbg3NYPc=";
 
   patches = [
     # Skip a test that requires networking to be available to work.
diff --git a/pkgs/development/tools/continuous-integration/buildkite-agent/default.nix b/pkgs/development/tools/continuous-integration/buildkite-agent/default.nix
index 7542ba0f94ff..3d1932f3eb04 100644
--- a/pkgs/development/tools/continuous-integration/buildkite-agent/default.nix
+++ b/pkgs/development/tools/continuous-integration/buildkite-agent/default.nix
@@ -3,16 +3,16 @@
   nixosTests }:
 buildGoModule rec {
   pname = "buildkite-agent";
-  version = "3.43.1";
+  version = "3.44.0";
 
   src = fetchFromGitHub {
     owner = "buildkite";
     repo = "agent";
     rev = "v${version}";
-    sha256 = "sha256-gTtWfqz1XVvDPULHY4hKdhJlwEWY84VYUPloAX/9afY=";
+    sha256 = "sha256-iN6Q+HXaZgUt8kXDGG5e1hY0/g/JYSHQ768YYRwZsuw=";
   };
 
-  vendorHash = "sha256-srzTHUqXxyZY2hFCx3FhhuixclXHskYrQ586W1dB334=";
+  vendorHash = "sha256-I+tjSBfAvRyE0bjVRloAkb5Jftb6dxoq8lNSgWHAcVk=";
 
   postPatch = ''
     substituteInPlace bootstrap/shell/shell.go --replace /bin/bash ${bash}/bin/bash
diff --git a/pkgs/development/tools/database/vitess/default.nix b/pkgs/development/tools/database/vitess/default.nix
index 211b20871eab..90e0613ac070 100644
--- a/pkgs/development/tools/database/vitess/default.nix
+++ b/pkgs/development/tools/database/vitess/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "vitess";
-  version = "15.0.2";
+  version = "16.0.0";
 
   src = fetchFromGitHub {
     owner = "vitessio";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-NkJqJYmUf92QiPazxRWNsxZh0Pvc73l35hP1gmk4Fv0=";
+    hash = "sha256-Gvk608nM7Uiazuf9qzmd0uzBP4vPSQfkpAWvnSeWm84=";
   };
 
-  vendorHash = "sha256-+yCznSxv0EWoKiQIgFEQ/iUxrlQ5A1HYNkoMiRDG3ik=";
+  vendorHash = "sha256-3GqEMoFYm0TZihoPINf8mwCl3Ky6Lt+LxueYLoFDj2g=";
 
   buildInputs = [ sqlite ];
 
diff --git a/pkgs/development/tools/go-toml/default.nix b/pkgs/development/tools/go-toml/default.nix
index 2c1a78fec0fd..96de13ace3e1 100644
--- a/pkgs/development/tools/go-toml/default.nix
+++ b/pkgs/development/tools/go-toml/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "go-toml";
-  version = "2.0.6";
+  version = "2.0.7";
 
   src = fetchFromGitHub {
     owner = "pelletier";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-RXKJJseRrwSTReMAkFjShKvCWGMowruYwsCovHwq4ZQ=";
+    sha256 = "sha256-bGLJSzSwcoKRMRwLSmGEWoQaC9NVwcKyFKpcEw+/Nag=";
   };
 
-  vendorSha256 = "sha256-MMCyFKqsL9aSQqK9VtPzUbgfLTFpzD5g8QYx8qIwktg=";
+  vendorHash = "sha256-MMCyFKqsL9aSQqK9VtPzUbgfLTFpzD5g8QYx8qIwktg=";
 
   excludedPackages = [ "cmd/gotoml-test-decoder" "cmd/tomltestgen" ];
 
diff --git a/pkgs/development/tools/language-servers/millet/default.nix b/pkgs/development/tools/language-servers/millet/default.nix
index 66488a607fd1..e39abae89a2c 100644
--- a/pkgs/development/tools/language-servers/millet/default.nix
+++ b/pkgs/development/tools/language-servers/millet/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "millet";
-  version = "0.7.7";
+  version = "0.7.9";
 
   src = fetchFromGitHub {
     owner = "azdavis";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-1GoZbeXNG00oxBdPa2yk0aOCVguwIkK6fKrlHU6mZYc=";
+    hash = "sha256-c4hNrswfYz/Wr59sWQJu8yuOqk594iVm+NzxYpG96Ys=";
   };
 
-  cargoHash = "sha256-arIFWJX8WQQWcJP1YpMwFy2XHU/0w+oPj1qE/IlYRF4=";
+  cargoHash = "sha256-Ja5Vjt3z0pkxEMtkyWYY+lZH0AnzVzyGxlQtlmwWbS4=";
 
   postPatch = ''
     rm .cargo/config.toml
@@ -24,7 +24,7 @@ rustPlatform.buildRustPackage rec {
   meta = with lib; {
     description = "A language server for Standard ML";
     homepage = "https://github.com/azdavis/millet";
-    changelog = "https://github.com/azdavis/millet/raw/v${version}/docs/changelog.md";
+    changelog = "https://github.com/azdavis/millet/raw/v${version}/docs/CHANGELOG.md";
     license = [ licenses.mit /* or */ licenses.asl20 ];
     maintainers = with maintainers; [ marsam ];
     mainProgram = "millet-ls";
diff --git a/pkgs/development/tools/language-servers/nil/default.nix b/pkgs/development/tools/language-servers/nil/default.nix
index ee26e81e8891..866293aba8b3 100644
--- a/pkgs/development/tools/language-servers/nil/default.nix
+++ b/pkgs/development/tools/language-servers/nil/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "nil";
-  version = "2023-02-03";
+  version = "2023-03-01";
 
   src = fetchFromGitHub {
     owner = "oxalica";
     repo = pname;
     rev = version;
-    hash = "sha256-d53add4Cuh0ik8YYncdoqqR6irQbnh/X4vg12TQ/FEQ=";
+    hash = "sha256-HGd/TV8ZHVAVBx+ndrxAfS/Nz+VHOQjNWjtKkkgYkqA=";
   };
 
-  cargoHash = "sha256-k4hw+kH447uqsCASuaZxRx2xmMkmn9LM5sHYL2AJN9k=";
+  cargoHash = "sha256-A6Go1OYAaoDvQtAcK5BL5Tz00iLPOft0VLH6usWtb9g=";
 
   CFG_RELEASE = version;
 
diff --git a/pkgs/development/tools/pgformatter/default.nix b/pkgs/development/tools/pgformatter/default.nix
index 9704788141c7..22e7116fb6cd 100644
--- a/pkgs/development/tools/pgformatter/default.nix
+++ b/pkgs/development/tools/pgformatter/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, perlPackages, fetchFromGitHub, shortenPerlShebang }:
+{ lib, stdenv, perlPackages, fetchFromGitHub, fetchpatch, shortenPerlShebang }:
 
 perlPackages.buildPerlPackage rec {
   pname = "pgformatter";
@@ -18,6 +18,14 @@ perlPackages.buildPerlPackage rec {
   # Avoid creating perllocal.pod, which contains a timestamp
   installTargets = [ "pure_install" ];
 
+  patches = [
+    # Fix an uninitialized variable error. Remove with the next release.
+    (fetchpatch {
+      url = "https://github.com/darold/pgFormatter/commit/c2622c47d48cee47effecbf58a588c3cd3a7bf1a.patch";
+      sha256 = "sha256-WnQIOvfuzL2HrwtL0HaaYObrBxhXDu82jxGcqggQVhc=";
+    })
+  ];
+
   # Makefile.PL only accepts DESTDIR and INSTALLDIRS, but we need to set more to make this work for NixOS.
   patchPhase = ''
     substituteInPlace pg_format \
diff --git a/pkgs/development/tools/rust/cargo-insta/default.nix b/pkgs/development/tools/rust/cargo-insta/default.nix
index b69c7968dcec..8c1b6d4a6514 100644
--- a/pkgs/development/tools/rust/cargo-insta/default.nix
+++ b/pkgs/development/tools/rust/cargo-insta/default.nix
@@ -1,23 +1,33 @@
-{ lib, rustPlatform, fetchFromGitHub, libiconv, stdenv }:
+{ lib
+, stdenv
+, rustPlatform
+, fetchFromGitHub
+, libiconv
+}:
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-insta";
-  version = "1.26.0";
+  version = "1.28.0";
 
   src = fetchFromGitHub {
     owner = "mitsuhiko";
     repo = "insta";
-    rev = version;
-    sha256 = "sha256-h0jRuY3GSqK85NCeFqdqjyVdNTMbdtD70zU5G3w1STc=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-GqM3b2evjACNkTOyfA6N6TInuGo9f/1retkXVTgbJ3A=";
   };
 
   sourceRoot = "source/cargo-insta";
-  cargoHash = "sha256-GC2ggTJJV3Aww3qPfsnuND0eII1l3OBoZfi5RtvhO8I=";
-  buildInputs = lib.optionals stdenv.isDarwin [ libiconv ];
+
+  cargoHash = "sha256-ZIS3O19N7w+sL+2IdoCw4/Hx9Jtjx7MYE7JcEu+PFRA=";
+
+  buildInputs = lib.optionals stdenv.isDarwin [
+    libiconv
+  ];
 
   meta = with lib; {
     description = "A Cargo subcommand for snapshot testing";
     homepage = "https://github.com/mitsuhiko/insta";
+    changelog = "https://github.com/mitsuhiko/insta/blob/${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with lib.maintainers; [ oxalica ];
   };
diff --git a/pkgs/development/tools/rust/cargo-wasi/default.nix b/pkgs/development/tools/rust/cargo-wasi/default.nix
index e26474baa1ee..cbc1e419459a 100644
--- a/pkgs/development/tools/rust/cargo-wasi/default.nix
+++ b/pkgs/development/tools/rust/cargo-wasi/default.nix
@@ -9,15 +9,15 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-wasi";
-  version = "0.1.26";
+  version = "0.1.27";
 
   src = fetchCrate {
     inherit version;
     pname = "cargo-wasi-src";
-    sha256 = "sha256-/u5GKqGwJWS6Gzc1WZ7O5ZSHHGoqBVZ4jQDEIfAyciE=";
+    sha256 = "sha256-u6+Fn/j2cvpBqTIfyPC8jltcCKGimFcu4NiMFCAfmwg=";
   };
 
-  cargoSha256 = "sha256-eF3HrulY7HrKseCYyZyC2EuWboFvmia2qLymBxvopKI=";
+  cargoHash = "sha256-Hi5Z5TmiHXp7YrqXfbwACKEximksQRhdoMGU1iLmXOk=";
 
   nativeBuildInputs = [ pkg-config ];
 
@@ -26,7 +26,7 @@ rustPlatform.buildRustPackage rec {
 
   # Checks need to be disabled here because the current test suite makes assumptions
   # about the surrounding environment that aren't Nix friendly. See these lines for specifics:
-  # https://github.com/bytecodealliance/cargo-wasi/blob/0.1.26/tests/tests/support.rs#L13-L18
+  # https://github.com/bytecodealliance/cargo-wasi/blob/0.1.27/tests/tests/support.rs#L13-L18
   doCheck = false;
 
   meta = with lib; {
diff --git a/pkgs/development/tools/yq-go/default.nix b/pkgs/development/tools/yq-go/default.nix
index 98deb602199f..f4d643e5aada 100644
--- a/pkgs/development/tools/yq-go/default.nix
+++ b/pkgs/development/tools/yq-go/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "yq-go";
-  version = "4.30.8";
+  version = "4.31.2";
 
   src = fetchFromGitHub {
     owner = "mikefarah";
     repo = "yq";
     rev = "v${version}";
-    sha256 = "sha256-x0vdPi8/Iciy+22SPBpktgkQCMxd5PT674OsWaLi+Q0=";
+    hash = "sha256-Cf9Y7sdvpflQhhnOuRZUTyYQ3fpFTLo28dZtePsayfE=";
   };
 
-  vendorHash = "sha256-VEVy8iVnUUpjTmCj7uIMcz0jaG9XGuxA3U02QfIwsYs=";
+  vendorHash = "sha256-nv1sJ5GGB2IbGF1ebGZmeKF6qHLXgFebdibcsB36juY=";
 
   nativeBuildInputs = [ installShellFiles ];
 
@@ -32,6 +32,7 @@ buildGoModule rec {
   meta = with lib; {
     description = "Portable command-line YAML processor";
     homepage = "https://mikefarah.gitbook.io/yq/";
+    changelog = "https://github.com/mikefarah/yq/raw/v${version}/release_notes.txt";
     mainProgram = "yq";
     license = [ licenses.mit ];
     maintainers = with maintainers; [ lewo SuperSandro2000 ];
diff --git a/pkgs/development/web/flyctl/default.nix b/pkgs/development/web/flyctl/default.nix
index 13c4bb5efa3b..d5ea945eef0d 100644
--- a/pkgs/development/web/flyctl/default.nix
+++ b/pkgs/development/web/flyctl/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "flyctl";
-  version = "0.0.473";
+  version = "0.0.474";
 
   src = fetchFromGitHub {
     owner = "superfly";
     repo = "flyctl";
     rev = "v${version}";
-    hash = "sha256-bTOGrg+dM+FXNvbeJ3fx1aMlT/2sPVYwGOzZaZfHVm8=";
+    hash = "sha256-uBx5exEShAVVQ8dQTYvn12FbHDehAxEFOJ4HN6jipD4=";
   };
 
-  vendorHash = "sha256-ExHzf4L0Ibb+tYfBV45hEaUJgSQhgpHk40QhHa5dpQ8=";
+  vendorHash = "sha256-m9n7687JjzOXqOTXPsBjD4jVeqlnUvoaxw7S9PGvn9M=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/misc/urbit/default.nix b/pkgs/misc/urbit/default.nix
index 211af0e6e485..8ae4df6409d5 100644
--- a/pkgs/misc/urbit/default.nix
+++ b/pkgs/misc/urbit/default.nix
@@ -10,15 +10,15 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "urbit";
-  version = "1.21";
+  version = "1.22";
 
   src = fetchzip {
     url = "https://github.com/urbit/vere/releases/download/vere-v${version}/${platform}.tgz";
     sha256 = {
-      x86_64-linux = "sha256-zHxISUJo2Li1PRjGC9LLXsDhLOHeuYejC+IM+9uDSks=";
-      aarch64-linux = "sha256-6gVuACG+/XJrYNjxJ2FxtkaEJuI2Sd8uM2Tgt4vbgkQ=";
-      x86_64-darwin = "sha256-BVDGdueu18HzL9FmaJniQp+OLQAVpSYYxxyvjlHFv3I=";
-      aarch64-darwin = "sha256-kwRezLpi5AEyAQ+Kyd992fpCerunaHOzRB4Wvb3dlY0=";
+      x86_64-linux = "sha256-wYXFromLV1BCiSWlzphtCSBOWacQ3yC7i2kxxH4y88Y=";
+      aarch64-linux = "sha256-t3waCv2hwkchWPlfx1bsKKB6imp7F6scRnZUQSwS6fI=";
+      x86_64-darwin = "sha256-x5Gr6z5ma+0AF7DEXJpqG+yg3ym+w2ULTqfpdLjfHGo=";
+      aarch64-darwin = "sha256-vvGZoN+Yi6FZDblhxwDzRneVtWaFFaOjyRG7017BzZI=";
     }.${stdenv.hostPlatform.system} or (throw "unsupported system ${stdenv.hostPlatform.system}");
   };
 
diff --git a/pkgs/os-specific/linux/firmware/fwupd/default.nix b/pkgs/os-specific/linux/firmware/fwupd/default.nix
index 8939aef06c54..335b848595ba 100644
--- a/pkgs/os-specific/linux/firmware/fwupd/default.nix
+++ b/pkgs/os-specific/linux/firmware/fwupd/default.nix
@@ -28,6 +28,7 @@
 , ninja
 , gcab
 , gnutls
+, pandoc
 , protobufc
 , python3
 , wrapGAppsNoGuiHook
@@ -79,12 +80,19 @@ let
   # Experimental
   haveFlashrom = isx86 && enableFlashrom;
 
-  runPythonCommand = name: buildCommandPython: runCommand name {
-    nativeBuildInputs = [ python3 ];
-      inherit buildCommandPython;
-  } ''
-    exec python3 -c "$buildCommandPython"
-  '';
+  runPythonCommand =
+    name:
+    buildCommandPython:
+
+    runCommand
+      name
+      {
+        nativeBuildInputs = [ python3 ];
+        inherit buildCommandPython;
+      }
+      ''
+        exec python3 -c "$buildCommandPython"
+      '';
 
   test-firmware =
     let
@@ -103,205 +111,219 @@ let
         };
       };
     in
-      src // {
-        meta = src.meta // {
-          # For update script
-          position =
-            let
-              pos = builtins.unsafeGetAttrPos "updateScript" test-firmware;
-            in
-            pos.file + ":" + toString pos.line;
-        };
+    src // {
+      meta = src.meta // {
+        # For update script
+        position =
+          let
+            pos = builtins.unsafeGetAttrPos "updateScript" test-firmware;
+          in
+          pos.file + ":" + toString pos.line;
       };
-
-
-  self = stdenv.mkDerivation rec {
-    pname = "fwupd";
-    version = "1.8.10";
-
-    # libfwupd goes to lib
-    # daemon, plug-ins and libfwupdplugin go to out
-    # CLI programs go to out
-    outputs = [ "out" "lib" "dev" "devdoc" "man" "installedTests" ];
-
-    src = fetchurl {
-      url = "https://people.freedesktop.org/~hughsient/releases/fwupd-${version}.tar.xz";
-      hash = "sha256-vvNUidNdhW9xeksjEVnkIR7CZ4oBQizZJRMFtZUq6Ow=";
     };
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "fwupd";
+  version = "1.8.10";
 
-    patches = [
-      # Since /etc is the domain of NixOS, not Nix,
-      # we cannot install files there.
-      # Let’s install the files to $prefix/etc
-      # while still reading them from /etc.
-      # NixOS module for fwupd will take take care of copying the files appropriately.
-      ./add-option-for-installation-sysconfdir.patch
+  # libfwupd goes to lib
+  # daemon, plug-ins and libfwupdplugin go to out
+  # CLI programs go to out
+  outputs = [ "out" "lib" "dev" "devdoc" "man" "installedTests" ];
 
-      # Install plug-ins and libfwupdplugin to $out output,
-      # they are not really part of the library.
-      ./install-fwupdplugin-to-out.patch
+  src = fetchFromGitHub {
+    owner = "fwupd";
+    repo = "fwupd";
+    rev = finalAttrs.version;
+    hash = "sha256-a4F7skyukl4jW3apGi1ie/EcuGlkZoszyZdtLFuJewA=";
+  };
 
-      # Installed tests are installed to different output
-      # we also cannot have fwupd-tests.conf in $out/etc since it would form a cycle.
-      ./installed-tests-path.patch
+  patches = [
+    # Since /etc is the domain of NixOS, not Nix,
+    # we cannot install files there.
+    # Let’s install the files to $prefix/etc
+    # while still reading them from /etc.
+    # NixOS module for fwupd will take take care of copying the files appropriately.
+    ./add-option-for-installation-sysconfdir.patch
 
-      # EFI capsule is located in fwupd-efi now.
-      ./efi-app-path.patch
-    ];
+    # Install plug-ins and libfwupdplugin to $out output,
+    # they are not really part of the library.
+    ./install-fwupdplugin-to-out.patch
 
-    nativeBuildInputs = [
-      # required for firmware zipping
-      ensureNewerSourcesForZipFilesHook
-      meson
-      ninja
-      gi-docgen
-      pkg-config
-      gobject-introspection
-      gettext
-      shared-mime-info
-      valgrind
-      gcab
-      gnutls
-      protobufc # for protoc
-      python
-      wrapGAppsNoGuiHook
-      vala
-    ];
+    # Installed tests are installed to different output
+    # we also cannot have fwupd-tests.conf in $out/etc since it would form a cycle.
+    ./installed-tests-path.patch
 
-    buildInputs = [
-      polkit
-      libxmlb
-      gusb
-      sqlite
-      libarchive
-      curl
-      elfutils
-      libgudev
-      colord
-      libjcat
-      libuuid
-      json-glib
-      umockdev
-      bash-completion
-      pango
-      tpm2-tss
-      efivar
-      fwupd-efi
-      protobufc
-      modemmanager
-      libmbim
-      libcbor
-      libqmi
-      xz # for liblzma
-    ] ++ lib.optionals haveDell [
-      libsmbios
-    ] ++ lib.optionals haveFlashrom [
-      flashrom
-    ];
+    # EFI capsule is located in fwupd-efi now.
+    ./efi-app-path.patch
+  ];
 
-    mesonFlags = [
-      "-Ddocs=enabled"
-      "-Dplugin_dummy=true"
-      # We are building the official releases.
-      "-Dsupported_build=enabled"
-      # Would dlopen libsoup to preserve compatibility with clients linking against older fwupd.
-      # https://github.com/fwupd/fwupd/commit/173d389fa59d8db152a5b9da7cc1171586639c97
-      "-Dsoup_session_compat=false"
-      "-Dudevdir=lib/udev"
-      "-Dsystemd_root_prefix=${placeholder "out"}"
-      "-Dinstalled_test_prefix=${placeholder "installedTests"}"
-      "--localstatedir=/var"
-      "--sysconfdir=/etc"
-      "-Dsysconfdir_install=${placeholder "out"}/etc"
-      "-Defi_os_dir=nixos"
-      "-Dplugin_modem_manager=enabled"
+  nativeBuildInputs = [
+    # required for firmware zipping
+    ensureNewerSourcesForZipFilesHook
+    meson
+    ninja
+    gi-docgen
+    pkg-config
+    gobject-introspection
+    gettext
+    shared-mime-info
+    valgrind
+    gcab
+    gnutls
+    pandoc
+    protobufc # for protoc
+    python
+    wrapGAppsNoGuiHook
+    vala
+  ];
 
-      # We do not want to place the daemon into lib (cyclic reference)
-      "--libexecdir=${placeholder "out"}/libexec"
-    ] ++ lib.optionals (!haveDell) [
-      "-Dplugin_dell=disabled"
-      "-Dplugin_synaptics_mst=disabled"
-    ] ++ lib.optionals (!haveRedfish) [
-      "-Dplugin_redfish=disabled"
-    ] ++ lib.optionals (!haveFlashrom) [
-      "-Dplugin_flashrom=disabled"
-    ] ++ lib.optionals (!haveMSR) [
-      "-Dplugin_msr=disabled"
-    ];
+  buildInputs = [
+    polkit
+    libxmlb
+    gusb
+    sqlite
+    libarchive
+    curl
+    elfutils
+    libgudev
+    colord
+    libjcat
+    libuuid
+    json-glib
+    umockdev
+    bash-completion
+    pango
+    tpm2-tss
+    efivar
+    fwupd-efi
+    protobufc
+    modemmanager
+    libmbim
+    libcbor
+    libqmi
+    xz # for liblzma
+  ] ++ lib.optionals haveDell [
+    libsmbios
+  ] ++ lib.optionals haveFlashrom [
+    flashrom
+  ];
 
-    # TODO: wrapGAppsHook wraps efi capsule even though it is not ELF
-    dontWrapGApps = true;
+  mesonFlags = [
+    "-Ddocs=enabled"
+    "-Dplugin_dummy=true"
+    # We are building the official releases.
+    "-Dsupported_build=enabled"
+    # Would dlopen libsoup to preserve compatibility with clients linking against older fwupd.
+    # https://github.com/fwupd/fwupd/commit/173d389fa59d8db152a5b9da7cc1171586639c97
+    "-Dsoup_session_compat=false"
+    "-Dudevdir=lib/udev"
+    "-Dsystemd_root_prefix=${placeholder "out"}"
+    "-Dinstalled_test_prefix=${placeholder "installedTests"}"
+    "--localstatedir=/var"
+    "--sysconfdir=/etc"
+    "-Dsysconfdir_install=${placeholder "out"}/etc"
+    "-Defi_os_dir=nixos"
+    "-Dplugin_modem_manager=enabled"
 
-    doCheck = true;
+    # We do not want to place the daemon into lib (cyclic reference)
+    "--libexecdir=${placeholder "out"}/libexec"
+  ] ++ lib.optionals (!haveDell) [
+    "-Dplugin_dell=disabled"
+    "-Dplugin_synaptics_mst=disabled"
+  ] ++ lib.optionals (!haveRedfish) [
+    "-Dplugin_redfish=disabled"
+  ] ++ lib.optionals (!haveFlashrom) [
+    "-Dplugin_flashrom=disabled"
+  ] ++ lib.optionals (!haveMSR) [
+    "-Dplugin_msr=disabled"
+  ];
 
-    # Environment variables
+  # TODO: wrapGAppsHook wraps efi capsule even though it is not ELF
+  dontWrapGApps = true;
 
-    # Fontconfig error: Cannot load default config file
-    FONTCONFIG_FILE =
-      let
-        fontsConf = makeFontsConf {
-          fontDirectories = [ freefont_ttf ];
-        };
-      in fontsConf;
+  doCheck = true;
 
-    # error: “PolicyKit files are missing”
-    # https://github.com/NixOS/nixpkgs/pull/67625#issuecomment-525788428
-    PKG_CONFIG_POLKIT_GOBJECT_1_ACTIONDIR = "/run/current-system/sw/share/polkit-1/actions";
+  # Environment variables
 
-    # Phase hooks
+  # Fontconfig error: Cannot load default config file
+  FONTCONFIG_FILE =
+    let
+      fontsConf = makeFontsConf {
+        fontDirectories = [ freefont_ttf ];
+      };
+    in
+    fontsConf;
 
-    postPatch = ''
-      patchShebangs \
-        contrib/generate-version-script.py \
-        po/test-deps
+  # error: “PolicyKit files are missing”
+  # https://github.com/NixOS/nixpkgs/pull/67625#issuecomment-525788428
+  PKG_CONFIG_POLKIT_GOBJECT_1_ACTIONDIR = "/run/current-system/sw/share/polkit-1/actions";
 
-      substituteInPlace data/installed-tests/fwupdmgr-p2p.sh \
-        --replace "gdbus" ${glib.bin}/bin/gdbus
+  # Phase hooks
 
-      # tests fail with: Failed to load SMBIOS: neither SMBIOS or DT found
-      sed -i 's/test(.*)//' plugins/lenovo-thinklmi/meson.build
-      sed -i 's/test(.*)//' plugins/mtd/meson.build
-      # fails on amd cpu
-      sed -i 's/test(.*)//' libfwupdplugin/meson.build
-      # in nixos test tries to chmod 0777 $out/share/installed-tests/fwupd/tests/redfish.conf
-      sed -i "s/get_option('tests')/false/" plugins/redfish/meson.build
-    '';
+  postPatch = ''
+    patchShebangs \
+      contrib/generate-version-script.py \
+      po/test-deps
 
-    preBuild = ''
-      # jcat-tool at buildtime requires a home directory
-      export HOME="$(mktemp -d)"
-    '';
+    substituteInPlace data/installed-tests/fwupdmgr-p2p.sh \
+      --replace "gdbus" ${glib.bin}/bin/gdbus
 
-    preCheck = ''
-      addToSearchPath XDG_DATA_DIRS "${shared-mime-info}/share"
+    # tests fail with: Failed to load SMBIOS: neither SMBIOS or DT found
+    sed -i 's/test(.*)//' plugins/lenovo-thinklmi/meson.build
+    sed -i 's/test(.*)//' plugins/mtd/meson.build
+    # fails on amd cpu
+    sed -i 's/test(.*)//' libfwupdplugin/meson.build
+    # in nixos test tries to chmod 0777 $out/share/installed-tests/fwupd/tests/redfish.conf
+    sed -i "s/get_option('tests')/false/" plugins/redfish/meson.build
 
-      echo "12345678901234567890123456789012" > machine-id
-      export NIX_REDIRECTS=/etc/machine-id=$(realpath machine-id) \
-      LD_PRELOAD=${libredirect}/lib/libredirect.so
-    '';
+    # Device tests use device emulation and need to download emulation data from
+    # the internet, which does not work on our test VMs.
+    # It's probably better to disable these tests for NixOS by setting
+    # the device-tests directory to /dev/null.
+    # For more info on device emulation, see:
+    #   https://github.com/fwupd/fwupd/blob/eeeac4e9ba8a6513428b456a551bffd95d533e50/docs/device-emulation.md
+    substituteInPlace data/installed-tests/meson.build \
+      --replace "join_paths(datadir, 'fwupd', 'device-tests')" "'/dev/null'"
+  '';
 
-    preInstall = ''
-      # We have pkexec on PATH so Meson will try to use it when installation fails
-      # due to being unable to write to e.g. /etc.
-      # Let’s pretend we already ran pkexec –
-      # the pkexec on PATH would complain it lacks setuid bit,
-      # obscuring the underlying error.
-      # https://github.com/mesonbuild/meson/blob/492cc9bf95d573e037155b588dc5110ded4d9a35/mesonbuild/minstall.py#L558
-      export PKEXEC_UID=-1
-    '';
+  preBuild = ''
+    # jcat-tool at buildtime requires a home directory
+    export HOME="$(mktemp -d)"
+  '';
 
-    postInstall = ''
-      # These files have weird licenses so they are shipped separately.
-      cp --recursive --dereference "${test-firmware}/installed-tests/tests" "$installedTests/libexec/installed-tests/fwupd"
-    '';
+  preCheck = ''
+    addToSearchPath XDG_DATA_DIRS "${shared-mime-info}/share"
 
-    preFixup = let
+    echo "12345678901234567890123456789012" > machine-id
+    export NIX_REDIRECTS=/etc/machine-id=$(realpath machine-id) \
+    LD_PRELOAD=${libredirect}/lib/libredirect.so
+  '';
+
+  preInstall = ''
+    # We have pkexec on PATH so Meson will try to use it when installation fails
+    # due to being unable to write to e.g. /etc.
+    # Let’s pretend we already ran pkexec –
+    # the pkexec on PATH would complain it lacks setuid bit,
+    # obscuring the underlying error.
+    # https://github.com/mesonbuild/meson/blob/492cc9bf95d573e037155b588dc5110ded4d9a35/mesonbuild/minstall.py#L558
+    export PKEXEC_UID=-1
+  '';
+
+  postInstall = ''
+    # These files have weird licenses so they are shipped separately.
+    cp --recursive --dereference "${test-firmware}/installed-tests/tests" "$installedTests/libexec/installed-tests/fwupd"
+  '';
+
+  preFixup =
+    let
       binPath = [
         efibootmgr
         bubblewrap
         tpm2-tools
       ];
-    in ''
+    in
+    ''
       gappsWrapperArgs+=(
         --prefix XDG_DATA_DIRS : "${shared-mime-info}/share"
         # See programs reached with fu_common_find_program_in_path in source
@@ -309,60 +331,62 @@ let
       )
     '';
 
-    postFixup = ''
-      # Since we had to disable wrapGAppsHook, we need to wrap the executables manually.
-      find -L "$out/bin" "$out/libexec" -type f -executable -print0 \
-        | while IFS= read -r -d ''' file; do
-        if [[ "$file" != *.efi ]]; then
-          echo "Wrapping program $file"
-          wrapGApp "$file"
-        fi
-      done
+  postFixup = ''
+    # Since we had to disable wrapGAppsHook, we need to wrap the executables manually.
+    find -L "$out/bin" "$out/libexec" -type f -executable -print0 \
+      | while IFS= read -r -d ''' file; do
+      if [[ "$file" != *.efi ]]; then
+        echo "Wrapping program $file"
+        wrapGApp "$file"
+      fi
+    done
 
-      # Cannot be in postInstall, otherwise _multioutDocs hook in preFixup will move right back.
-      moveToOutput "share/doc" "$devdoc"
-    '';
+    # Cannot be in postInstall, otherwise _multioutDocs hook in preFixup will move right back.
+    moveToOutput "share/doc" "$devdoc"
+  '';
 
-    separateDebugInfo = true;
+  separateDebugInfo = true;
 
-    passthru = {
-      filesInstalledToEtc = [
-        "fwupd/bios-settings.d/README.md"
-        "fwupd/daemon.conf"
-        "fwupd/remotes.d/lvfs-testing.conf"
-        "fwupd/remotes.d/lvfs.conf"
-        "fwupd/remotes.d/vendor.conf"
-        "fwupd/remotes.d/vendor-directory.conf"
-        "fwupd/uefi_capsule.conf"
-        "pki/fwupd/GPG-KEY-Linux-Foundation-Firmware"
-        "pki/fwupd/GPG-KEY-Linux-Vendor-Firmware-Service"
-        "pki/fwupd/LVFS-CA.pem"
-        "pki/fwupd-metadata/GPG-KEY-Linux-Foundation-Metadata"
-        "pki/fwupd-metadata/GPG-KEY-Linux-Vendor-Firmware-Service"
-        "pki/fwupd-metadata/LVFS-CA.pem"
-        "grub.d/35_fwupd"
-      ] ++ lib.optionals haveDell [
-        "fwupd/remotes.d/dell-esrt.conf"
-      ] ++ lib.optionals haveRedfish [
-        "fwupd/redfish.conf"
-      ] ++ lib.optionals haveMSR [
-        "fwupd/msr.conf"
-      ] ++ lib.optionals isx86 [
-        "fwupd/thunderbolt.conf"
-      ];
+  passthru = {
+    filesInstalledToEtc = [
+      "fwupd/bios-settings.d/README.md"
+      "fwupd/daemon.conf"
+      "fwupd/remotes.d/lvfs-testing.conf"
+      "fwupd/remotes.d/lvfs.conf"
+      "fwupd/remotes.d/vendor.conf"
+      "fwupd/remotes.d/vendor-directory.conf"
+      "fwupd/uefi_capsule.conf"
+      "pki/fwupd/GPG-KEY-Linux-Foundation-Firmware"
+      "pki/fwupd/GPG-KEY-Linux-Vendor-Firmware-Service"
+      "pki/fwupd/LVFS-CA.pem"
+      "pki/fwupd-metadata/GPG-KEY-Linux-Foundation-Metadata"
+      "pki/fwupd-metadata/GPG-KEY-Linux-Vendor-Firmware-Service"
+      "pki/fwupd-metadata/LVFS-CA.pem"
+      "grub.d/35_fwupd"
+    ] ++ lib.optionals haveDell [
+      "fwupd/remotes.d/dell-esrt.conf"
+    ] ++ lib.optionals haveRedfish [
+      "fwupd/redfish.conf"
+    ] ++ lib.optionals haveMSR [
+      "fwupd/msr.conf"
+    ] ++ lib.optionals isx86 [
+      "fwupd/thunderbolt.conf"
+    ];
 
-      # DisabledPlugins key in fwupd/daemon.conf
-      defaultDisabledPlugins = [
-        "test"
-        "test_ble"
-      ];
+    # DisabledPlugins key in fwupd/daemon.conf
+    defaultDisabledPlugins = [
+      "test"
+      "test_ble"
+    ];
 
-      # For updating.
-      inherit test-firmware;
+    # For updating.
+    inherit test-firmware;
 
-      tests = let
+    tests =
+      let
         listToPy = list: "[${lib.concatMapStringsSep ", " (f: "'${f}'") list}]";
-      in {
+      in
+      {
         installedTests = nixosTests.installed-tests.fwupd;
 
         passthruMatches = runPythonCommand "fwupd-test-passthru-matches" ''
@@ -371,29 +395,27 @@ let
           import os
           import pathlib
 
-          etc = '${self}/etc'
+          etc = '${finalAttrs.finalPackage}/etc'
           package_etc = set(itertools.chain.from_iterable([[os.path.relpath(os.path.join(prefix, file), etc) for file in files] for (prefix, dirs, files) in os.walk(etc)]))
-          passthru_etc = set(${listToPy passthru.filesInstalledToEtc})
+          passthru_etc = set(${listToPy finalAttrs.passthru.filesInstalledToEtc})
           assert len(package_etc - passthru_etc) == 0, f'fwupd package contains the following paths in /etc that are not listed in passthru.filesInstalledToEtc: {package_etc - passthru_etc}'
           assert len(passthru_etc - package_etc) == 0, f'fwupd package lists the following paths in passthru.filesInstalledToEtc that are not contained in /etc: {passthru_etc - package_etc}'
 
           config = configparser.RawConfigParser()
-          config.read('${self}/etc/fwupd/daemon.conf')
+          config.read('${finalAttrs.finalPackage}/etc/fwupd/daemon.conf')
           package_disabled_plugins = config.get('fwupd', 'DisabledPlugins').rstrip(';').split(';')
-          passthru_disabled_plugins = ${listToPy passthru.defaultDisabledPlugins}
+          passthru_disabled_plugins = ${listToPy finalAttrs.passthru.defaultDisabledPlugins}
           assert package_disabled_plugins == passthru_disabled_plugins, f'Default disabled plug-ins in the package {package_disabled_plugins} do not match those listed in passthru.defaultDisabledPlugins {passthru_disabled_plugins}'
 
           pathlib.Path(os.getenv('out')).touch()
         '';
       };
-    };
-
-    meta = with lib; {
-      homepage = "https://fwupd.org/";
-      maintainers = with maintainers; [ jtojnar ];
-      license = licenses.lgpl21Plus;
-      platforms = platforms.linux;
-    };
   };
 
-in self
+  meta = with lib; {
+    homepage = "https://fwupd.org/";
+    maintainers = with maintainers; [ ];
+    license = licenses.lgpl21Plus;
+    platforms = platforms.linux;
+  };
+})
diff --git a/pkgs/servers/monitoring/alertmanager-irc-relay/default.nix b/pkgs/servers/monitoring/alertmanager-irc-relay/default.nix
index fdaf7bdcb21b..7b06eed72ce6 100644
--- a/pkgs/servers/monitoring/alertmanager-irc-relay/default.nix
+++ b/pkgs/servers/monitoring/alertmanager-irc-relay/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "alertmanager-irc-relay";
-  version = "0.5.0";
+  version = "0.5.1";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "alertmanager-irc-relay";
     rev = "v${version}";
-    sha256 = "sha256-qE+cKwn/rqxL5/LUSirflmnFCow6IxjCcGvu2bbBmsk=";
+    sha256 = "sha256-Rl7o2QPa/IU1snlx/LiJxQok9pnkw9XANnJsu41vNlY=";
   };
 
-  vendorSha256 = "sha256-VLG15IXS/fXFMTCJKEqGW6qZ9aOLPhazidVsOywG+w4=";
+  vendorHash = "sha256-KX+TR0n14+95lldF+0KUo5DbqOKpUDaZNuKMBf0KHFQ=";
 
   ldflags = [ "-s" "-w" ];
 
diff --git a/pkgs/servers/monitoring/grafana/default.nix b/pkgs/servers/monitoring/grafana/default.nix
index 71377d55b7a9..b0c9a538e049 100644
--- a/pkgs/servers/monitoring/grafana/default.nix
+++ b/pkgs/servers/monitoring/grafana/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "grafana";
-  version = "9.3.6";
+  version = "9.4.2";
 
   excludedPackages = [ "alert_webhook_listener" "clean-swagger" "release_publisher" "slow_proxy" "slow_proxy_mac" "macaron" "devenv" ];
 
@@ -10,15 +10,15 @@ buildGoModule rec {
     rev = "v${version}";
     owner = "grafana";
     repo = "grafana";
-    sha256 = "sha256-7t30AvGtCyU02fOYWHYcMWgcnmkepUpZzUMR4NjIlvw=";
+    sha256 = "sha256-dSKIQiav6y4P1e/7CptIdRuOrDdXdvItCaRBcbepadE=";
   };
 
   srcStatic = fetchurl {
     url = "https://dl.grafana.com/oss/release/grafana-${version}.linux-amd64.tar.gz";
-    sha256 = "sha256-jRUPrb6ocqux4SrMm/Hw/2DuG7sj2jKhSln16ynjHwM=";
+    sha256 = "sha256-dBp6V5ozu1koSoXIecjysSIdG0hL1K5lH9Z8yougUKo=";
   };
 
-  vendorSha256 = "sha256-uGJ3D14qAvDkBUIlNxF1pCHMDYeuUoM8tPWfoEvA5o4=";
+  vendorSha256 = "sha256-atnlEdGDiUqQkslvRlPSi6VC5rEvRVV6R2Wxur3geew=";
 
   nativeBuildInputs = [ wire ];
 
@@ -28,8 +28,14 @@ buildGoModule rec {
     wire gen -tags oss ./pkg/server
     wire gen -tags oss ./pkg/cmd/grafana-cli/runner
 
-    GOARCH= CGO_ENABLED=0 go generate ./pkg/framework/coremodel
-    GOARCH= CGO_ENABLED=0 go generate ./public/app/plugins
+    GOARCH= CGO_ENABLED=0 go generate ./pkg/plugins/plugindef
+    GOARCH= CGO_ENABLED=0 go generate ./kinds/gen.go
+    GOARCH= CGO_ENABLED=0 go generate ./public/app/plugins/gen.go
+    GOARCH= CGO_ENABLED=0 go generate ./pkg/kindsys/report.go
+
+    # Work around `main module (github.com/grafana/grafana) does not contain package github.com/grafana/grafana/pkg/util/xorm`.
+    # Apparently these files confuse the dependency resolution for the go builder implemented here.
+    rm pkg/util/xorm/go.{mod,sum}
 
     # The testcase makes an API call against grafana.com:
     #
diff --git a/pkgs/servers/nfs-ganesha/default.nix b/pkgs/servers/nfs-ganesha/default.nix
index 560853b5d959..d576f1f46d56 100644
--- a/pkgs/servers/nfs-ganesha/default.nix
+++ b/pkgs/servers/nfs-ganesha/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "nfs-ganesha";
-  version = "4.3";
+  version = "4.4";
 
   src = fetchFromGitHub {
     owner = "nfs-ganesha";
     repo = "nfs-ganesha";
     rev = "V${version}";
-    sha256 = "sha256-MafP6kl3SmtT2/vLPDwy8U7+tE6hUBr/lWmiAcjsQNU=";
+    sha256 = "sha256-MEPy2TXVTegwCpuaIrMol7ag8anxxdcj11z5eYNkDqQ=";
   };
 
   preConfigure = "cd src";
diff --git a/pkgs/servers/teleport/11.nix b/pkgs/servers/teleport/11.nix
new file mode 100644
index 000000000000..ee6758053cc9
--- /dev/null
+++ b/pkgs/servers/teleport/11.nix
@@ -0,0 +1,8 @@
+{ callPackage, ... }@args:
+callPackage ./generic.nix ({
+  version = "11.3.5";
+  hash = "sha256-/InWly0jCiPBlgM/qgS6ErMv7Hhg5PW9sldda1oaUIg=";
+  vendorHash = "sha256-NkiFLEHBNjxUOSuAlVugAV14yCCo3z6yhX7LZQFKhvA=";
+  cargoHash = "sha256-02qo6i6GuRAYKDKA7k2hDq2O6ayEQbeGhFS2g3b9Wuo=";
+  yarnHash = "sha256-kvnVmDZ/jISaaS97KM0WbPJU7Y8XWOeHrDLT0iXRyfc=";
+} // builtins.removeAttrs args [ "callPackage" ])
diff --git a/pkgs/servers/teleport/12.nix b/pkgs/servers/teleport/12.nix
new file mode 100644
index 000000000000..1182df971481
--- /dev/null
+++ b/pkgs/servers/teleport/12.nix
@@ -0,0 +1,8 @@
+{ callPackage, ... }@args:
+callPackage ./generic.nix ({
+  version = "12.0.2";
+  hash = "sha256-9RD4ETQEXnj3d5YID3f3BghwitdqfcDgNhsk8ixWTW4=";
+  vendorHash = "sha256-2sOELuMyg7w/rhnWvnwDiUOsjUfb56JdAbrTGKvGnjs=";
+  cargoHash = "sha256-1ScU5ywq8vz1sWHW2idBsWcB1Xs+aylukBm96dKrwL4=";
+  yarnHash = "sha256-ItRi5EkYrwNB1MIf9l3yyK1BX6vNpL2+H1BlN3Evibg=";
+} // builtins.removeAttrs args [ "callPackage" ])
diff --git a/pkgs/servers/teleport/default.nix b/pkgs/servers/teleport/generic.nix
similarity index 92%
rename from pkgs/servers/teleport/default.nix
rename to pkgs/servers/teleport/generic.nix
index 52c21cb63674..a811204e09ab 100644
--- a/pkgs/servers/teleport/default.nix
+++ b/pkgs/servers/teleport/generic.nix
@@ -20,6 +20,12 @@
 , nixosTests
 
 , withRdpClient ? true
+
+, version
+, hash
+, vendorHash
+, cargoHash
+, yarnHash
 }:
 let
   # This repo has a private submodule "e" which fetchgit cannot handle without failing.
@@ -27,13 +33,13 @@ let
     owner = "gravitational";
     repo = "teleport";
     rev = "v${version}";
-    hash = "sha256-jJfOgcwKkNFO/5XHxMoapZxM8Tb0kEgKVA7SrMU7uW4=";
+    inherit hash;
   };
-  version = "11.3.4";
+  inherit version;
 
   rdpClient = rustPlatform.buildRustPackage rec {
     pname = "teleport-rdpclient";
-    cargoHash = "sha256-TSIwLCY01ygCWT73LR/Ch7NwPQA3a3r0PyL3hUzBNr4=";
+    inherit cargoHash;
     inherit version src;
 
     buildAndTestSubdir = "lib/srv/desktop/rdp/rdpclient";
@@ -56,7 +62,7 @@ let
 
   yarnOfflineCache = fetchYarnDeps {
     yarnLock = "${src}/yarn.lock";
-    hash = "sha256-MAGeWzA366yzpjdCY0+X6RV5MKcsHa/xD5CJu6ce1FU=";
+    hash = yarnHash;
   };
 
   webassets = stdenv.mkDerivation {
@@ -95,7 +101,7 @@ buildGoModule rec {
   pname = "teleport";
 
   inherit src version;
-  vendorHash = "sha256-NkiFLEHBNjxUOSuAlVugAV14yCCo3z6yhX7LZQFKhvA=";
+  inherit vendorHash;
   proxyVendor = true;
 
   subPackages = [ "tool/tbot" "tool/tctl" "tool/teleport" "tool/tsh" ];
diff --git a/pkgs/shells/zsh/zimfw/default.nix b/pkgs/shells/zsh/zimfw/default.nix
index 249cb1b5154d..3714f0ee364e 100644
--- a/pkgs/shells/zsh/zimfw/default.nix
+++ b/pkgs/shells/zsh/zimfw/default.nix
@@ -2,14 +2,14 @@
 
 stdenv.mkDerivation rec {
   pname = "zimfw";
-  version = "1.11.2";
+  version = "1.11.3";
   src = fetchFromGitHub {
     owner = "zimfw";
     repo = "zimfw";
     rev = "v${version}";
     ## zim only needs this one file to be installed.
     sparseCheckout = [ "zimfw.zsh" ];
-    sha256 = "sha256-FgTCdSSDp8pvscRUD4vVk/peoCI4e9FPoCuHP25wxXA=";
+    sha256 = "sha256-q3OSypjqAc+ul0kF6f3u+wnFyNEm4AKwyPBwQzlVzYU=";
   };
   strictDeps = true;
   dontConfigure = true;
diff --git a/pkgs/tools/admin/ejson2env/default.nix b/pkgs/tools/admin/ejson2env/default.nix
index e7ac6d7426da..fae0ce1f7b9a 100644
--- a/pkgs/tools/admin/ejson2env/default.nix
+++ b/pkgs/tools/admin/ejson2env/default.nix
@@ -1,4 +1,4 @@
-{ buildGoModule, fetchFromGitHub, lib }:
+{ lib, buildGoModule, fetchFromGitHub, nix-update-script }:
 
 buildGoModule rec {
   pname = "ejson2env";
@@ -14,9 +14,15 @@ buildGoModule rec {
   vendorSha256 = "sha256-agWcD8vFNde1SCdkRovMNPf+1KODxV8wW1mXvE0w/CI=";
 
   ldflags = [
+    "-s"
+    "-w"
     "-X main.version=${version}"
   ];
 
+  passthru.updateScript = nix-update-script {
+    attrPath = pname;
+  };
+
   meta = with lib; {
     description = "A tool to simplify storing secrets that should be accessible in the shell environment in your git repo.";
     homepage = "https://github.com/Shopify/ejson2env";
diff --git a/pkgs/tools/admin/eksctl/default.nix b/pkgs/tools/admin/eksctl/default.nix
index 6c090a11b346..32c71f2d1ceb 100644
--- a/pkgs/tools/admin/eksctl/default.nix
+++ b/pkgs/tools/admin/eksctl/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "eksctl";
-  version = "0.130.0";
+  version = "0.131.0";
 
   src = fetchFromGitHub {
     owner = "weaveworks";
     repo = pname;
     rev = version;
-    sha256 = "sha256-SJI9EB0k45SJmWQ/pivlZMQdiE237vpLwNB2Y33ntrw=";
+    sha256 = "sha256-xH7GUR42eMhF2SXCprFEE6ESiFBYnpGP3lLZ4sKIu5s=";
   };
 
-  vendorHash = "sha256-wrt8Mtek74ljCgp1Sxi/jKxCv61H7HqCLHXKrwS7ex4=";
+  vendorHash = "sha256-hF1J+HDpnWM55ga5ZOaApFmfx1/vF2SNl+JsDrMphtM=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/backup/borgmatic/default.nix b/pkgs/tools/backup/borgmatic/default.nix
index dcc4caaa6362..db6191b4aeb7 100644
--- a/pkgs/tools/backup/borgmatic/default.nix
+++ b/pkgs/tools/backup/borgmatic/default.nix
@@ -34,11 +34,13 @@ python3Packages.buildPythonApplication rec {
 
     mkdir -p $out/lib/systemd/system
     cp sample/systemd/borgmatic.timer $out/lib/systemd/system/
+    # there is another "sleep", so choose the one with the space after it
+    # due to https://github.com/borgmatic-collective/borgmatic/commit/2e9f70d49647d47fb4ca05f428c592b0e4319544
     substitute sample/systemd/borgmatic.service \
                $out/lib/systemd/system/borgmatic.service \
                --replace /root/.local/bin/borgmatic $out/bin/borgmatic \
                --replace systemd-inhibit ${systemd}/bin/systemd-inhibit \
-               --replace sleep ${coreutils}/bin/sleep
+               --replace "sleep " "${coreutils}/bin/sleep "
   '';
 
   passthru.tests.version = testers.testVersion { package = borgmatic; };
diff --git a/pkgs/tools/misc/goaccess/default.nix b/pkgs/tools/misc/goaccess/default.nix
index 32e45bee9031..084afb857c05 100644
--- a/pkgs/tools/misc/goaccess/default.nix
+++ b/pkgs/tools/misc/goaccess/default.nix
@@ -10,14 +10,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "1.7";
+  version = "1.7.1";
   pname = "goaccess";
 
   src = fetchFromGitHub {
     owner = "allinurl";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-5lN+57HMxPfCop2sTSldhv1TBEIaowavXvniwqnesOQ=";
+    sha256 = "sha256-RJQyR6nTvDvR+outbVDYKFC1Tl99O0SZW94e/SbqAO0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/misc/rust-motd/default.nix b/pkgs/tools/misc/rust-motd/default.nix
index b881d94438cd..7d2125a1e1ee 100644
--- a/pkgs/tools/misc/rust-motd/default.nix
+++ b/pkgs/tools/misc/rust-motd/default.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rust-motd";
-  version = "1.0.0";
+  version = "1.0.1";
 
   src = fetchFromGitHub {
     owner = "rust-motd";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-w984vvjjieSv4eM3jT8zJIIR7/7pmADhR3Esj+2dCTs=";
+    hash = "sha256-x3dx4PdYSYd7wA/GGj9QYC8rK33FWATs2SnaOagGE80=";
   };
 
-  cargoHash = "sha256-L/QdFjSYm3PekKS3tdsUl8XBVyIBE044EHOIB+aEltI=";
+  cargoHash = "sha256-7YvzVG3c10EJET+659F1fwgZ0SmBKMdAWD6LeWnGrNI=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/tools/networking/ali/default.nix b/pkgs/tools/networking/ali/default.nix
new file mode 100644
index 000000000000..53403b636785
--- /dev/null
+++ b/pkgs/tools/networking/ali/default.nix
@@ -0,0 +1,27 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
+
+buildGoModule rec {
+  pname = "ali";
+  version = "0.7.5";
+
+  src = fetchFromGitHub {
+    owner = "nakabonne";
+    repo = "ali";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-/pdHlI20IzSTX2pnsbxPiJiWmOCbp13eJWLi0Tcsueg=";
+  };
+
+  vendorHash = "sha256-YWx9K04kTMaI0FXebwRQVCt0nxIwZ6xlbtI2lk3qp0M=";
+
+  meta = with lib; {
+    description = "Generate HTTP load and plot the results in real-time";
+    homepage = "https://github.com/nakabonne/ali";
+    changelog = "https://github.com/nakabonne/ali/releases/tag/v${version}";
+    license = licenses.mit;
+    platforms = platforms.linux ++ platforms.darwin;
+    maintainers = with maintainers; [ farcaller ];
+  };
+}
diff --git a/pkgs/tools/package-management/nix-doc/default.nix b/pkgs/tools/package-management/nix-doc/default.nix
index 7b041df665ed..7d3f3a21f1b7 100644
--- a/pkgs/tools/package-management/nix-doc/default.nix
+++ b/pkgs/tools/package-management/nix-doc/default.nix
@@ -2,13 +2,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "nix-doc";
-  version = "0.5.7";
+  version = "0.5.8";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "lf-";
     repo = "nix-doc";
-    sha256 = "sha256-VSogUulfBTmZMmBbw9Ya/kfoHZlvJMujCPdjhRsjnPo=";
+    sha256 = "sha256-murez5uHLv1YXIaDDaFXCDPPggK1GAXjaSmZJhlqN80=";
   };
 
   doCheck = true;
@@ -16,7 +16,7 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ pkg-config nix ];
 
-  cargoSha256 = "sha256-DZQ1Q+4I6Qm2WFvBoPNILp0wwP+01msx6zP12EHaPQc=";
+  cargoSha256 = "sha256-+6I6+LZs84OcyebAIg/9KeAxV1UdK9IgaT7UsPJ5rWQ=";
 
   meta = with lib; {
     description = "An interactive Nix documentation tool";
diff --git a/pkgs/tools/security/exploitdb/default.nix b/pkgs/tools/security/exploitdb/default.nix
index 46852f61e970..b5b4e1454c30 100644
--- a/pkgs/tools/security/exploitdb/default.nix
+++ b/pkgs/tools/security/exploitdb/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "exploitdb";
-  version = "2023-02-28";
+  version = "2023-03-01";
 
   src = fetchFromGitLab {
     owner = "exploit-database";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-hEuOGnAWyX3oBfrUWBhT58WAjDWTWeLIYuyfUs3q0Jc=";
+    hash = "sha256-+1yu5R3JUmp6PylmkIWZlEXlq05fi9Lb1q36iBPWdso=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index efcad38414ca..04e150508ab6 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1625,6 +1625,7 @@ mapAliases ({
   virtmanager = virt-manager; # Added 2019-10-29
   virtmanager-qt = virt-manager-qt; # Added 2019-10-29
   virtviewer = throw "'virtviewer' has been renamed to/replaced by 'virt-viewer'"; # Converted to throw 2022-02-22
+  vivaldi-widevine = throw "'vivaldi-widevine' has been renamed to/replaced by 'widevine-cdm'"; # Added 2023-02-25
   vkBasalt = vkbasalt; # Added 2022-11-22
   vnc2flv = throw "vnc2flv has been removed: abandoned by upstream"; # Added 2022-03-21
   vorbisTools = throw "'vorbisTools' has been renamed to/replaced by 'vorbis-tools'"; # Converted to throw 2022-02-22
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index ef967f8e43ed..f2ff89e94ef2 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -11414,7 +11414,9 @@ with pkgs;
 
   qprint = callPackage ../tools/text/qprint { };
 
-  qscintilla = libsForQt5.callPackage ../development/libraries/qscintilla { };
+  qscintilla = darwin.apple_sdk_11_0.callPackage ../development/libraries/qscintilla {
+    inherit (libsForQt5) qmake qtbase qtmacextras;
+  };
 
   qscintilla-qt4 = callPackage ../development/libraries/qscintilla-qt4 { };
 
@@ -12570,9 +12572,13 @@ with pkgs;
 
   telegraf = callPackage ../servers/monitoring/telegraf { };
 
-  teleport = callPackage ../servers/teleport {
+  teleport_11 = callPackage ../servers/teleport/11.nix {
     inherit (darwin.apple_sdk.frameworks) CoreFoundation Security AppKit;
   };
+  teleport_12 = callPackage ../servers/teleport/12.nix {
+    inherit (darwin.apple_sdk.frameworks) CoreFoundation Security AppKit;
+  };
+  teleport = teleport_12;
 
   telepresence = callPackage ../tools/networking/telepresence {
     pythonPackages = python3Packages;
@@ -32305,8 +32311,6 @@ with pkgs;
 
   vivaldi-ffmpeg-codecs = callPackage ../applications/networking/browsers/vivaldi/ffmpeg-codecs.nix {};
 
-  vivaldi-widevine = callPackage ../applications/networking/browsers/vivaldi/widevine.nix { };
-
   libopenmpt = callPackage ../development/libraries/audio/libopenmpt { };
 
   libopenmpt-modplug = callPackage ../development/libraries/audio/libopenmpt-modplug { };
@@ -39411,4 +39415,6 @@ with pkgs;
   volantes-cursors = callPackage ../data/icons/volantes-cursors { };
 
   gnss-share = callPackage ../servers/gnss-share { };
+
+  ali = callPackage ../tools/networking/ali { };
 }
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index cef51d98405e..259f5de93347 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -5870,6 +5870,8 @@ self: super: with self; {
     python3Packages = self;
   });
 
+  merge3 = callPackage ../development/python-modules/merge3 { };
+
   mergedb = callPackage ../development/python-modules/mergedb { };
 
   mergedeep = callPackage ../development/python-modules/mergedeep { };