diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 9d5f3e608292..0b77e5429e2e 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -2769,7 +2769,7 @@
     name = "Hubert Jasudowicz";
   };
   chkno = {
-    email = "chuck@intelligence.org";
+    email = "scottworley@scottworley.com";
     github = "chkno";
     githubId = 1118859;
     name = "Scott Worley";
diff --git a/nixos/doc/manual/release-notes/rl-2305.section.md b/nixos/doc/manual/release-notes/rl-2305.section.md
index c5a29ed9f202..5c9005674bb3 100644
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@@ -199,6 +199,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 - The EC2 image module no longer fetches instance metadata in stage-1. This results in a significantly smaller initramfs, since network drivers no longer need to be included, and faster boots, since metadata fetching can happen in parallel with startup of other services.
   This breaks services which rely on metadata being present by the time stage-2 is entered. Anything which reads EC2 metadata from `/etc/ec2-metadata` should now have an `after` dependency on `fetch-ec2-metadata.service`
 
+- The mailman service now defaults to using a randomly generated REST API password instead of a hardcoded one.
+
 - `minio` removed support for its legacy filesystem backend in [RELEASE.2022-10-29T06-21-33Z](https://github.com/minio/minio/releases/tag/RELEASE.2022-10-29T06-21-33Z). This means if your storage was created with the old format, minio will no longer start. Unfortunately minio doesn't provide a an automatic migration, they only provide [instructions how to manually convert the node](https://min.io/docs/minio/windows/operations/install-deploy-manage/migrate-fs-gateway.html). To facilitate this migration we keep around the last version that still supports the old filesystem backend as `minio_legacy_fs`. Use it via `services.minio.package = minio_legacy_fs;` to export your data before switching to the new version. See the corresponding [issue](https://github.com/NixOS/nixpkgs/issues/199318) for more details.
 
 - `services.sourcehut.dispatch` and the corresponding package (`sourcehut.dispatchsrht`) have been removed due to [upstream deprecation](https://sourcehut.org/blog/2022-08-01-dispatch-deprecation-plans/).
diff --git a/nixos/modules/services/mail/mailman.nix b/nixos/modules/services/mail/mailman.nix
index 9273f71db7d5..ec2a19f58bb1 100644
--- a/nixos/modules/services/mail/mailman.nix
+++ b/nixos/modules/services/mail/mailman.nix
@@ -44,11 +44,9 @@ let
     transport_file_type: hash
   '';
 
-  mailmanCfg = lib.generators.toINI {}
-    (recursiveUpdate cfg.settings
-      ((optionalAttrs (cfg.restApiPassFile != null) {
-        webservice.admin_pass = "#NIXOS_MAILMAN_REST_API_PASS_SECRET#";
-      })));
+  mailmanCfg = lib.generators.toINI {} (recursiveUpdate cfg.settings {
+    webservice.admin_pass = "#NIXOS_MAILMAN_REST_API_PASS_SECRET#";
+  });
 
   mailmanCfgFile = pkgs.writeText "mailman-raw.cfg" mailmanCfg;
 
@@ -388,6 +386,7 @@ in {
 
     environment.etc."mailman3/settings.py".text = ''
       import os
+      from configparser import ConfigParser
 
       # Required by mailman_web.settings, but will be overridden when
       # settings_local.json is loaded.
@@ -404,10 +403,10 @@ in {
       with open('/var/lib/mailman-web/settings_local.json') as f:
           globals().update(json.load(f))
 
-      ${optionalString (cfg.restApiPassFile != null) ''
-        with open('${cfg.restApiPassFile}') as f:
-            MAILMAN_REST_API_PASS = f.read().rstrip('\n')
-      ''}
+      with open('/etc/mailman.cfg') as f:
+          config = ConfigParser()
+          config.read_file(f)
+          MAILMAN_REST_API_PASS = config['webservice']['admin_pass']
 
       ${optionalString (cfg.ldap.enable) ''
         import ldap
@@ -504,10 +503,14 @@ in {
         path = with pkgs; [ jq ];
         after = optional withPostgresql "postgresql.service";
         requires = optional withPostgresql "postgresql.service";
+        serviceConfig.RemainAfterExit = true;
         serviceConfig.Type = "oneshot";
         script = ''
           install -m0750 -o mailman -g mailman ${mailmanCfgFile} /etc/mailman.cfg
-          ${optionalString (cfg.restApiPassFile != null) ''
+          ${if cfg.restApiPassFile == null then ''
+            sed -i "s/#NIXOS_MAILMAN_REST_API_PASS_SECRET#/$(tr -dc A-Za-z0-9 < /dev/urandom | head -c 64)/g" \
+              /etc/mailman.cfg
+          '' else ''
             ${pkgs.replace-secret}/bin/replace-secret \
               '#NIXOS_MAILMAN_REST_API_PASS_SECRET#' \
               ${cfg.restApiPassFile} \
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 9df91ca6edc5..982f4315ca32 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -431,6 +431,7 @@ in {
   magnetico = handleTest ./magnetico.nix {};
   mailcatcher = handleTest ./mailcatcher.nix {};
   mailhog = handleTest ./mailhog.nix {};
+  mailman = handleTest ./mailman.nix {};
   man = handleTest ./man.nix {};
   mariadb-galera = handleTest ./mysql/mariadb-galera.nix {};
   mastodon = discoverTests (import ./web-apps/mastodon { inherit handleTestOn; });
diff --git a/nixos/tests/mailman.nix b/nixos/tests/mailman.nix
new file mode 100644
index 000000000000..2806e9166d9a
--- /dev/null
+++ b/nixos/tests/mailman.nix
@@ -0,0 +1,67 @@
+import ./make-test-python.nix {
+  name = "mailman";
+
+  nodes.machine = { pkgs, ... }: {
+    environment.systemPackages = with pkgs; [ mailutils ];
+
+    services.mailman.enable = true;
+    services.mailman.serve.enable = true;
+    services.mailman.siteOwner = "postmaster@example.com";
+    services.mailman.webHosts = [ "example.com" ];
+
+    services.postfix.enable = true;
+    services.postfix.destination = [ "example.com" "example.net" ];
+    services.postfix.relayDomains = [ "hash:/var/lib/mailman/data/postfix_domains" ];
+    services.postfix.config.local_recipient_maps = [ "hash:/var/lib/mailman/data/postfix_lmtp" "proxy:unix:passwd.byname" ];
+    services.postfix.config.transport_maps = [ "hash:/var/lib/mailman/data/postfix_lmtp" ];
+
+    users.users.user = { isNormalUser = true; };
+
+    virtualisation.memorySize = 2048;
+
+    specialisation.restApiPassFileSystem.configuration = {
+      services.mailman.restApiPassFile = "/var/lib/mailman/pass";
+    };
+  };
+
+  testScript = { nodes, ... }: let
+    restApiPassFileSystem = "${nodes.machine.system.build.toplevel}/specialisation/restApiPassFileSystem";
+  in ''
+    def check_mail(_) -> bool:
+        status, _ = machine.execute("grep -q hello /var/spool/mail/user/new/*")
+        return status == 0
+
+    def try_api(_) -> bool:
+        status, _ = machine.execute("curl -s http://localhost:8001/")
+        return status == 0
+
+    def wait_for_api():
+        with machine.nested("waiting for Mailman REST API to be available"):
+            retry(try_api)
+
+    machine.wait_for_unit("mailman.service")
+    wait_for_api()
+
+    with subtest("subscription and delivery"):
+        creds = machine.succeed("su -s /bin/sh -c 'mailman info' mailman | grep '^REST credentials: ' | sed 's/^REST credentials: //'").strip()
+        machine.succeed(f"curl --fail-with-body -sLSu {creds} -d mail_host=example.com http://localhost:8001/3.1/domains")
+        machine.succeed(f"curl --fail-with-body -sLSu {creds} -d fqdn_listname=list@example.com http://localhost:8001/3.1/lists")
+        machine.succeed(f"curl --fail-with-body -sLSu {creds} -d list_id=list.example.com -d subscriber=root@example.com -d pre_confirmed=True -d pre_verified=True -d send_welcome_message=False http://localhost:8001/3.1/members")
+        machine.succeed(f"curl --fail-with-body -sLSu {creds} -d list_id=list.example.com -d subscriber=user@example.net -d pre_confirmed=True -d pre_verified=True -d send_welcome_message=False http://localhost:8001/3.1/members")
+        machine.succeed("mail -a 'From: root@example.com' -s hello list@example.com < /dev/null")
+        with machine.nested("waiting for mail from list"):
+            retry(check_mail)
+
+    with subtest("Postorius"):
+        machine.succeed("curl --fail-with-body -sILS http://localhost/")
+
+    with subtest("restApiPassFile"):
+        machine.succeed("echo secretpassword > /var/lib/mailman/pass")
+        machine.succeed("${restApiPassFileSystem}/bin/switch-to-configuration test >&2")
+        machine.succeed("grep secretpassword /etc/mailman.cfg")
+        machine.succeed("su -s /bin/sh -c 'mailman info' mailman | grep secretpassword")
+        wait_for_api()
+        machine.succeed("curl --fail-with-body -sLSu restadmin:secretpassword http://localhost:8001/3.1/domains")
+        machine.succeed("curl --fail-with-body -sILS http://localhost/")
+  '';
+}
diff --git a/pkgs/applications/editors/vim/plugins/overrides.nix b/pkgs/applications/editors/vim/plugins/overrides.nix
index e0b07daa0f38..42a41199f747 100644
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@@ -316,6 +316,53 @@ self: super: {
     '';
   });
 
+  coq_nvim = super.coq_nvim.overrideAttrs (old: {
+    passthru.python3Dependencies = ps: with ps; [
+      pynvim
+      pyyaml
+      (buildPythonPackage {
+        pname = "pynvim_pp";
+        version = "unstable-2023-05-17";
+        format = "pyproject";
+        propagatedBuildInputs = [ setuptools pynvim ];
+        src = fetchFromGitHub {
+          owner = "ms-jpq";
+          repo = "pynvim_pp";
+          rev = "91d91ec0cb173ce19d8c93c7999f5038cf08c046";
+          fetchSubmodules = false;
+          hash = "sha256-wycN9U3f3o0onmx60Z4Ws4DbBxsNwHjLTCB9UgjssLI=";
+        };
+        meta = with lib; {
+          homepage = "https://github.com/ms-jpq/pynvim_pp";
+          license = licenses.gpl3Plus;
+          maintainers = with maintainers; [ GaetanLepage ];
+        };
+      })
+      (buildPythonPackage {
+        pname = "std2";
+        version = "unstable-2023-05-17";
+        format = "pyproject";
+        propagatedBuildInputs = [ setuptools ];
+        src = fetchFromGitHub {
+          owner = "ms-jpq";
+          repo = "std2";
+          rev = "d6a7a719ef902e243b7bbd162defed762a27416f";
+          fetchSubmodules = false;
+          hash = "sha256-dtQaeB4Xkz+wcF0UkM+SajekSkVVPdoJs9n1hHQLR1k=";
+        };
+        doCheck = true;
+        meta = with lib; {
+          homepage = "https://github.com/ms-jpq/std2";
+          license = licenses.gpl3Plus;
+          maintainers = with maintainers; [ GaetanLepage ];
+        };
+      })
+    ];
+
+    # We need some patches so it stops complaining about not being in a venv
+    patches = [ ./patches/coq_nvim/emulate-venv.patch ];
+  });
+
   cpsm = super.cpsm.overrideAttrs (old: {
     nativeBuildInputs = [ cmake ];
     buildInputs = [
diff --git a/pkgs/applications/editors/vim/plugins/patches/coq_nvim/emulate-venv.patch b/pkgs/applications/editors/vim/plugins/patches/coq_nvim/emulate-venv.patch
new file mode 100644
index 000000000000..da0222fbbe42
--- /dev/null
+++ b/pkgs/applications/editors/vim/plugins/patches/coq_nvim/emulate-venv.patch
@@ -0,0 +1,35 @@
+diff --git a/coq/__main__.py b/coq/__main__.py
+index 5a6c6fd2..e0d9eec8 100644
+--- a/coq/__main__.py
++++ b/coq/__main__.py
+@@ -78,7 +78,7 @@ _EXEC_PATH = Path(executable)
+ _EXEC_PATH = _EXEC_PATH.parent.resolve(strict=True) / _EXEC_PATH.name
+ _REQ = REQUIREMENTS.read_text()
+
+-_IN_VENV = _RT_PY == _EXEC_PATH
++_IN_VENV = True
+
+
+ if command == "deps":
+@@ -152,7 +152,7 @@ elif command == "run":
+     try:
+         if not _IN_VENV:
+             raise ImportError()
+-        elif lock != _REQ:
++        elif False:
+             raise ImportError()
+         else:
+             import pynvim_pp
+diff --git a/coq/consts.py b/coq/consts.py
+index 5a027fe9..a3e0c5a4 100644
+--- a/coq/consts.py
++++ b/coq/consts.py
+@@ -9,7 +9,7 @@ TOP_LEVEL = Path(__file__).resolve(strict=True).parent.parent
+ REQUIREMENTS = TOP_LEVEL / "requirements.txt"
+
+
+-VARS = TOP_LEVEL / ".vars"
++VARS = Path.home() / ".cache/coq_nvim/vars"
+
+ RT_DIR = VARS / "runtime"
+ RT_PY = RT_DIR / "Scripts" / "python.exe" if IS_WIN else RT_DIR / "bin" / "python3"
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 7262ecc75c24..5060a0c621c8 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -612,8 +612,8 @@ let
         mktplcRef = {
           name = "chatgpt-reborn";
           publisher = "chris-hayes";
-          version = "3.16.1";
-          sha256 = "sha256-RVPA+O0QOtFArWzcuwXMZSpwB3zrPAzVCbEjOzUNH4I=";
+          version = "3.16.3";
+          sha256 = "wkitG5gmYKYKXRw/zVW04HN1dePiTjbnynFOY/bwxfI=";
         };
       };
 
@@ -1331,8 +1331,8 @@ let
         mktplcRef = {
           name = "chatgpt-vscode";
           publisher = "genieai";
-          version = "0.0.7";
-          sha256 = "sha256-dWp9OYj9OCsNdZiYbgAWWo/OXMjBSlB7sIupdqnQTiU=";
+          version = "0.0.8";
+          sha256 = "RKvmZkegFs4y+sEVaamPRO1F1E+k4jJyI0Q9XqKowrQ=";
         };
       };
 
@@ -1340,8 +1340,8 @@ let
         mktplcRef = {
           publisher = "github";
           name = "codespaces";
-          version = "1.14.1";
-          sha256 = "sha256-oiAn/tW4jfccsY8zH6L7UzldeM7sV9tllSvgZD8c9aY=";
+          version = "1.14.7";
+          sha256 = "pcZGMxTVnMeD6rnNV0d9Wysk6MrYiYcJ+byuH9VR0ds=";
         };
         meta = { license = lib.licenses.unfree; };
       };
@@ -1350,8 +1350,8 @@ let
         mktplcRef = {
           publisher = "github";
           name = "copilot";
-          version = "1.78.9758";
-          sha256 = "sha256-qIaaM72SenMv+vtkTMBodD2JsroZLpw8qEttr5aIDQk=";
+          version = "1.86.82";
+          sha256 = "isaqjrAmu/08gnNKQPeMV4Xc8u0Hx8gB2c78WE54kYQ=";
         };
         meta = {
           description = "GitHub Copilot uses OpenAI Codex to suggest code and entire functions in real-time right from your editor.";
@@ -1404,8 +1404,8 @@ let
           # the VSCode Marketplace and use a calver scheme. We should avoid
           # using preview versions, because they can require insider versions
           # of VS Code
-          version = "0.60.0";
-          sha256 = "sha256-VAoKNRYrzUXUQSDAX8NM17aknCUxMRsTRd5adQu+w/s=";
+          version = "0.64.0";
+          sha256 = "tgQD3o5uMbWofVx7FPyWT1yaeu2e4aPxterN4yXA33U=";
         };
         meta = { license = lib.licenses.mit; };
       };
@@ -1614,8 +1614,8 @@ let
         mktplcRef = {
           name = "latex-workshop";
           publisher = "James-Yu";
-          version = "9.8.1";
-          sha256 = "sha256-89jP/kd5A6UQOcln9mb6DGvWQD8CiKcg+YYRpzZIDJQ=";
+          version = "9.10.0";
+          sha256 = "s0+8952svPSA69M4H29zuIxUWV6xNRpIqLNd8pzGJhY=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/James-Yu.latex-workshop/changelog";
diff --git a/pkgs/applications/misc/dunst/default.nix b/pkgs/applications/misc/dunst/default.nix
index 858252a840f4..ec3024d48d1d 100644
--- a/pkgs/applications/misc/dunst/default.nix
+++ b/pkgs/applications/misc/dunst/default.nix
@@ -1,5 +1,5 @@
 { stdenv, lib, fetchFromGitHub, makeWrapper
-, pkg-config, which, perl, jq, libXrandr
+, pkg-config, which, perl, jq, libXrandr, coreutils
 , cairo, dbus, systemd, gdk-pixbuf, glib, libX11, libXScrnSaver
 , wayland, wayland-protocols
 , libXinerama, libnotify, pango, xorgproto, librsvg
@@ -39,6 +39,9 @@ stdenv.mkDerivation rec {
     wrapProgram $out/bin/dunst \
       --set GDK_PIXBUF_MODULE_FILE "$GDK_PIXBUF_MODULE_FILE"
 
+    wrapProgram $out/bin/dunstctl \
+      --prefix PATH : "${lib.makeBinPath [ coreutils dbus ]}"
+
     install -D contrib/_dunst.zshcomp $out/share/zsh/site-functions/_dunst
     install -D contrib/_dunstctl.zshcomp $out/share/zsh/site-functions/_dunstctl
     substituteInPlace $out/share/zsh/site-functions/_dunstctl \
diff --git a/pkgs/applications/misc/klipperscreen/default.nix b/pkgs/applications/misc/klipperscreen/default.nix
index ef51ec96ac84..e970c2572548 100644
--- a/pkgs/applications/misc/klipperscreen/default.nix
+++ b/pkgs/applications/misc/klipperscreen/default.nix
@@ -1,28 +1,54 @@
-{ lib, stdenv, writeText, python3Packages, fetchFromGitHub, gtk3, gobject-introspection, gdk-pixbuf, wrapGAppsHook, librsvg }:
-python3Packages.buildPythonPackage rec {
+{ lib
+, python3
+, fetchFromGitHub
+, wrapGAppsHook
+, gobject-introspection
+, gitUpdater
+}: python3.pkgs.buildPythonApplication rec {
   pname = "KlipperScreen";
   version = "0.3.2";
+  format = "other";
 
   src = fetchFromGitHub {
     owner = "jordanruthe";
-    repo = pname;
+    repo = "KlipperScreen";
     rev = "v${version}";
     hash = "sha256-LweO5EVWr3OxziHrjtQDdWyUBCVUJ17afkw7RCZWgcg=";
   };
-  patches = [ ./fix-paths.diff ];
 
-  buildInputs = [ gtk3 librsvg ];
-  nativeBuildInputs = [ wrapGAppsHook gdk-pixbuf gobject-introspection ];
+  nativeBuildInputs = [
+    gobject-introspection
+    wrapGAppsHook
+  ];
 
-  propagatedBuildInputs = with python3Packages; [ jinja2 netifaces requests websocket-client pycairo pygobject3 mpv six dbus-python numpy pycairo ];
+  pythonPath = with python3.pkgs; [
+    jinja2
+    netifaces
+    requests
+    websocket-client
+    pycairo
+    pygobject3
+    mpv
+    six
+    dbus-python
+  ];
 
-  preBuild = ''
-    ln -s ${./setup.py} setup.py
+  dontWrapGApps = true;
+
+  preFixup = ''
+    mkdir -p $out/bin
+    cp -r . $out/dist
+    gappsWrapperArgs+=(--set PYTHONPATH "$PYTHONPATH")
+    wrapGApp $out/dist/screen.py
+    ln -s $out/dist/screen.py $out/bin/KlipperScreen
   '';
 
+  passthru.updateScript = gitUpdater { url = meta.homepage; };
+
   meta = with lib; {
     description = "Touchscreen GUI for the Klipper 3D printer firmware";
-    homepage = "https://github.com/jordanruthe/${pname}";
+    homepage = "https://github.com/jordanruthe/KlipperScreen";
     license = licenses.agpl3;
+    maintainers = with maintainers; [ cab404 ];
   };
 }
diff --git a/pkgs/applications/misc/klipperscreen/fix-paths.diff b/pkgs/applications/misc/klipperscreen/fix-paths.diff
deleted file mode 100644
index 71ce60fe56e8..000000000000
--- a/pkgs/applications/misc/klipperscreen/fix-paths.diff
+++ /dev/null
@@ -1,22 +0,0 @@
-diff --git a/screen.py b/screen.py
-index 4fd75cd..a10779a 100755
---- a/screen.py
-+++ b/screen.py
-@@ -48,7 +48,7 @@ PRINTER_BASE_STATUS_OBJECTS = [
-     'exclude_object',
- ]
- 
--klipperscreendir = pathlib.Path(__file__).parent.resolve()
-+klipperscreendir = pathlib.Path(functions.__file__).parent.parent.resolve()
- 
- 
- def set_text_direction(lang=None):
-@@ -254,7 +254,7 @@ class KlipperScreen(Gtk.Window):
-     def _load_panel(self, panel, *args):
-         if panel not in self.load_panel:
-             logging.debug(f"Loading panel: {panel}")
--            panel_path = os.path.join(os.path.dirname(__file__), 'panels', f"{panel}.py")
-+            panel_path = os.path.join(klipperscreendir, 'panels', f"{panel}.py")
-             logging.info(f"Panel path: {panel_path}")
-             if not os.path.exists(panel_path):
-                 logging.error(f"Panel {panel} does not exist")
diff --git a/pkgs/applications/misc/klipperscreen/setup.py b/pkgs/applications/misc/klipperscreen/setup.py
deleted file mode 100644
index 946b517b78be..000000000000
--- a/pkgs/applications/misc/klipperscreen/setup.py
+++ /dev/null
@@ -1,11 +0,0 @@
-from setuptools import setup
-
-setup(
-  name='KlipperScreen',
-  install_requires=[],
-  packages=['styles', 'panels', 'ks_includes', 'ks_includes.widgets'],
-  package_data={'ks_includes': ['defaults.conf', 'locales/**', 'emptyCursor.xbm'], 'styles': ['**']},
-  entry_points={
-      'console_scripts': ['KlipperScreen=screen:main']
-  },
-)
diff --git a/pkgs/applications/networking/browsers/polypane/default.nix b/pkgs/applications/networking/browsers/polypane/default.nix
index 6d264e9abc49..5d4978090c01 100644
--- a/pkgs/applications/networking/browsers/polypane/default.nix
+++ b/pkgs/applications/networking/browsers/polypane/default.nix
@@ -2,12 +2,12 @@
 
 let
   pname = "polypane";
-  version = "13.0.3";
+  version = "13.1.2";
 
   src = fetchurl {
     url = "https://github.com/firstversionist/${pname}/releases/download/v${version}/${pname}-${version}.AppImage";
     name = "${pname}-${version}.AppImage";
-    sha256 = "sha256-wMWO8eRH8O93m4/HaRTdG3DhyCvHWw+s3sAtN+VLBeY=";
+    sha256 = "sha256-wwZqcW+xIKKpUDoULT6gBi7Qbmumi8ZNwd+CpQqLprM=";
   };
 
   appimageContents = appimageTools.extractType2 {
diff --git a/pkgs/applications/networking/instant-messengers/signal-cli/default.nix b/pkgs/applications/networking/instant-messengers/signal-cli/default.nix
index cfe014b902e9..eeac2cfc5bb8 100644
--- a/pkgs/applications/networking/instant-messengers/signal-cli/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-cli/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "signal-cli";
-  version = "0.11.9.1";
+  version = "0.11.10";
 
   # Building from source would be preferred, but is much more involved.
   src = fetchurl {
     url = "https://github.com/AsamK/signal-cli/releases/download/v${version}/signal-cli-${version}-Linux.tar.gz";
-    hash = "sha256-LhTv3ycJXr2vt0vyXfCd1ABro4q7CfBma63Zd1osBhA=";
+    hash = "sha256-8iWUhneAialoEn3igxxTGJBmopbZHHqkvtJPZEESWM0=";
   };
 
   buildInputs = lib.optionals stdenv.isLinux [ libmatthew_java dbus dbus_java ];
diff --git a/pkgs/applications/office/treesheets/default.nix b/pkgs/applications/office/treesheets/default.nix
index d5d47c307f21..d46f9adfb0ad 100644
--- a/pkgs/applications/office/treesheets/default.nix
+++ b/pkgs/applications/office/treesheets/default.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "treesheets";
-  version = "unstable-2023-05-17";
+  version = "unstable-2023-05-18";
 
   src = fetchFromGitHub {
     owner = "aardappel";
     repo = "treesheets";
-    rev = "9c59ce89a0d9bcf6f0c65e9e9453ad433222c603";
-    sha256 = "uBoHaamFZ6m328NWkbTWMbc1OSFuyif+3OcCvwTwKfU=";
+    rev = "750530c925da889834a69689e067dda1a8d8cdeb";
+    sha256 = "4yN/ZS0f7En/LJzf2lJBqAB60Oy5+5UX+ROlUWAARKs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/video/ani-cli/default.nix b/pkgs/applications/video/ani-cli/default.nix
index bcbb680e6000..5ae2b2288433 100644
--- a/pkgs/applications/video/ani-cli/default.nix
+++ b/pkgs/applications/video/ani-cli/default.nix
@@ -12,13 +12,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "ani-cli";
-  version = "4.2";
+  version = "4.3";
 
   src = fetchFromGitHub {
     owner = "pystardust";
     repo = "ani-cli";
     rev = "v${version}";
-    hash = "sha256-XXD55sxgKg8qSdXV7mbnSCQJ4fNgWFG5IiR1QTjDkHI=";
+    hash = "sha256-Wo3ydCylrqfmB4EgYsmc7BfXLPD1BxdDFGY4KeUfGfE=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/data/fonts/alkalami/default.nix b/pkgs/data/fonts/alkalami/default.nix
index 60e31e88c2df..eb0c3ed79262 100644
--- a/pkgs/data/fonts/alkalami/default.nix
+++ b/pkgs/data/fonts/alkalami/default.nix
@@ -2,11 +2,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "alkalami";
-  version = "2.000";
+  version = "3.000";
 
   src = fetchzip {
     url = "https://software.sil.org/downloads/r/alkalami/Alkalami-${version}.zip";
-    hash = "sha256-rT0HzTFbooHr+l5BQ9GVYKxxNk7TESdkOQfWBeVpwYI=";
+    hash = "sha256-ra664VbUKc8XpULCWhLMVnc1mW4pqZvbvwuBvRQRhcY=";
   };
 
   installPhase = ''
diff --git a/pkgs/development/interpreters/wavm/default.nix b/pkgs/development/interpreters/wavm/default.nix
new file mode 100644
index 000000000000..6e73fbdf8282
--- /dev/null
+++ b/pkgs/development/interpreters/wavm/default.nix
@@ -0,0 +1,26 @@
+{ lib
+, llvmPackages
+, fetchFromGitHub
+, cmake
+}:
+
+llvmPackages.stdenv.mkDerivation rec {
+  pname = "wavm";
+  version = "2022-05-14";
+
+  src = fetchFromGitHub {
+    owner = "WAVM";
+    repo = "WAVM";
+    rev = "nightly/${version}";
+    hash = "sha256-SHz+oOOkwvVZucJYFSyZc3MnOAy1VatspmZmOAXYAWA=";
+  };
+
+  nativeBuildInputs = [ cmake llvmPackages.llvm ];
+
+  meta = with lib; {
+    description = "WebAssembly Virtual Machine";
+    homepage = "https://wavm.github.io";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ ereslibre ];
+  };
+}
diff --git a/pkgs/development/libraries/libpg_query/default.nix b/pkgs/development/libraries/libpg_query/default.nix
index 1335eb3579d7..003ec110f529 100644
--- a/pkgs/development/libraries/libpg_query/default.nix
+++ b/pkgs/development/libraries/libpg_query/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libpg_query";
-  version = "15-4.2.0";
+  version = "15-4.2.1";
 
   src = fetchFromGitHub {
     owner = "pganalyze";
     repo = "libpg_query";
     rev = version;
-    hash = "sha256-2fPdvsfuXKaRwkPjsPsBBfP0+yUgYXEUzQNFZfhyvGk=";
+    hash = "sha256-wbWW2r8Ai4Y+JBI5DbMuVx326bAxmEgQlTd6nnzqDXw=";
   };
 
   nativeBuildInputs = [ which ];
diff --git a/pkgs/development/libraries/simdjson/default.nix b/pkgs/development/libraries/simdjson/default.nix
index 1d56f7388fe6..feb9c1ad071f 100644
--- a/pkgs/development/libraries/simdjson/default.nix
+++ b/pkgs/development/libraries/simdjson/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "simdjson";
-  version = "3.1.7";
+  version = "3.1.8";
 
   src = fetchFromGitHub {
     owner = "simdjson";
     repo = "simdjson";
     rev = "v${version}";
-    sha256 = "sha256-a6I1qcuBSkwQxuU4T7tKrqouhLMJsY/rfCKqhGGvkjQ=";
+    sha256 = "sha256-j13yNzh9CnniXzjoB4oNtDwYcao6MOVgyWo9JtqT/yQ=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/mobile/maestro/default.nix b/pkgs/development/mobile/maestro/default.nix
index 83141bd8d117..82547f3e85cc 100644
--- a/pkgs/development/mobile/maestro/default.nix
+++ b/pkgs/development/mobile/maestro/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "maestro";
-  version = "1.27.0";
+  version = "1.28.0";
 
   src = fetchurl {
     url = "https://github.com/mobile-dev-inc/maestro/releases/download/cli-${version}/maestro.zip";
-    sha256 = "1ldlc8qj8nzy44h6qwgz0xiwp3a6fm0wkl05sl1r20iv7sr92grz";
+    sha256 = "15vc8w40fyzg23rj5awifxi6gpb51pbp2khamcs7dypi6263cq54";
   };
 
   dontUnpack = true;
diff --git a/pkgs/development/ocaml-modules/cmarkit/default.nix b/pkgs/development/ocaml-modules/cmarkit/default.nix
index 5015807361f2..ce6d98064a6b 100644
--- a/pkgs/development/ocaml-modules/cmarkit/default.nix
+++ b/pkgs/development/ocaml-modules/cmarkit/default.nix
@@ -14,11 +14,11 @@ else
 
 stdenv.mkDerivation rec {
   pname = "cmarkit";
-  version = "0.1.0";
+  version = "0.2.0";
 
   src = fetchurl {
     url = "https://erratique.ch/software/cmarkit/releases/cmarkit-${version}.tbz";
-    hash = "sha256-pLPCLlwJt5W5R92HPY8gGpisyjlbSaaEe0HLuJlkjuY=";
+    hash = "sha256-86RuGB5pLbw/ThPGz9+qLaZRH7xvxbYrZWFLLIkc5Mk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/aliyun-python-sdk-cdn/default.nix b/pkgs/development/python-modules/aliyun-python-sdk-cdn/default.nix
index 59f38108298c..3f29826f0a34 100644
--- a/pkgs/development/python-modules/aliyun-python-sdk-cdn/default.nix
+++ b/pkgs/development/python-modules/aliyun-python-sdk-cdn/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "aliyun-python-sdk-cdn";
-  version = "3.8.7";
+  version = "3.8.8";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-/fhHR/6nepDOKsL69lztUkPqXrV091BLMTSn7O0jvPk=";
+    hash = "sha256-LMCNvjV85TvdSM0OXean4dPzAiV8apVdRLTvUISOKec=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/cloup/default.nix b/pkgs/development/python-modules/cloup/default.nix
index 2f5fd8b49fa7..1ee2e652a5ce 100644
--- a/pkgs/development/python-modules/cloup/default.nix
+++ b/pkgs/development/python-modules/cloup/default.nix
@@ -9,13 +9,14 @@
 
 buildPythonPackage rec {
   pname = "cloup";
-  version = "2.0.0.post1";
+  version = "2.1.0";
+  format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-FDDJB1Bi4Jy2TNhKt6/l1azSit9WHWqzEJ6xl1u9e2s=";
+    hash = "sha256-3ULHyc1JP63FOkI2+WF4o/EYu72UWn+K2vzVA02CaXE=";
   };
 
   nativeBuildInputs = [
@@ -30,11 +31,14 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  pythonImportsCheck = [ "cloup" ];
+  pythonImportsCheck = [
+    "cloup"
+  ];
 
   meta = with lib; {
     homepage = "https://github.com/janLuke/cloup";
     description = "Click extended with option groups, constraints, aliases, help themes";
+    changelog = "https://github.com/janluke/cloup/releases/tag/v${version}";
     longDescription = ''
       Enriches Click with option groups, constraints, command aliases, help sections for subcommands, themes for --help and other stuff.
     '';
diff --git a/pkgs/development/python-modules/gremlinpython/default.nix b/pkgs/development/python-modules/gremlinpython/default.nix
index f4835aa47e4f..2d84cd87e08e 100644
--- a/pkgs/development/python-modules/gremlinpython/default.nix
+++ b/pkgs/development/python-modules/gremlinpython/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "gremlinpython";
-  version = "3.6.3";
+  version = "3.6.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "apache";
     repo = "tinkerpop";
     rev = "refs/tags/${version}";
-    hash = "sha256-CmVWaRebJaZHJGzhaBdYXPF3BZ8+Cvc5P/KOpsG+dX4=";
+    hash = "sha256-SQ+LcHeHDB1Hd5wXGDJBZmBG4KEZ3NsV4+4X9WgPb9E=";
   };
 
   sourceRoot = "source/gremlin-python/src/main/python";
diff --git a/pkgs/development/python-modules/nipype/default.nix b/pkgs/development/python-modules/nipype/default.nix
index 3c295a72cc29..9386729d30b7 100644
--- a/pkgs/development/python-modules/nipype/default.nix
+++ b/pkgs/development/python-modules/nipype/default.nix
@@ -42,13 +42,13 @@
 
 buildPythonPackage rec {
   pname = "nipype";
-  version = "1.8.5";
+  version = "1.8.6";
   disabled = pythonOlder "3.7";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-44QnQ/tmBGTdKd5z3Pye9m0nO+ELzGQFn/Ic1e8ellU=";
+    hash = "sha256-l3sTFej3D5QWPsB+MeVXG+g/Kt1gIxQcWgascAEm+NE=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/plugincode/default.nix b/pkgs/development/python-modules/plugincode/default.nix
index 9153c64e719a..6e49474cc63d 100644
--- a/pkgs/development/python-modules/plugincode/default.nix
+++ b/pkgs/development/python-modules/plugincode/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "plugincode";
-  version = "31.0.0";
+  version = "32.0.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-0BfdHQn/Kgct4ZT34KhMgMC3nS0unE3iL7DiWDhXDSk=";
+    hash = "sha256-QTLZOxdVJxxuImydouIET/YuvLhztelY1mqN3enzRfo=";
   };
 
   dontConfigure = true;
@@ -51,6 +51,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Library that provides plugin functionality for ScanCode toolkit";
     homepage = "https://github.com/nexB/plugincode";
+    changelog = "https://github.com/nexB/plugincode/blob/v${version}/CHANGELOG.rst";
     license = licenses.asl20;
     maintainers = [ ];
   };
diff --git a/pkgs/development/python-modules/pontos/default.nix b/pkgs/development/python-modules/pontos/default.nix
index 6f20085c41f3..d8a2a3f0ef03 100644
--- a/pkgs/development/python-modules/pontos/default.nix
+++ b/pkgs/development/python-modules/pontos/default.nix
@@ -4,6 +4,7 @@
 , fetchFromGitHub
 , git
 , httpx
+, lxml
 , packaging
 , poetry-core
 , pytestCheckHook
@@ -17,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "pontos";
-  version = "23.5.1";
+  version = "23.5.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -26,7 +27,7 @@ buildPythonPackage rec {
     owner = "greenbone";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-nUVJjBebHOY0/oN/Cl2HdaLGnDVgLsUK7Yd+johP1PM=";
+    hash = "sha256-QZJziSncO44KqvMTvpaQkIVAooLH8sKMt0TAC7L8UNs=";
   };
 
   nativeBuildInputs = [
@@ -36,6 +37,7 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     colorful
     httpx
+    lxml
     packaging
     python-dateutil
     semver
diff --git a/pkgs/development/python-modules/purepng/default.nix b/pkgs/development/python-modules/purepng/default.nix
index 29a3a2aba574..156f5d4bc222 100644
--- a/pkgs/development/python-modules/purepng/default.nix
+++ b/pkgs/development/python-modules/purepng/default.nix
@@ -32,17 +32,26 @@ buildPythonPackage {
 
   # numpy is optional - if not supplied, tests simply have less coverage
   nativeCheckInputs = [ numpy ];
+
+  postPatch = ''
+    substituteInPlace code/test_png.py \
+      --replace numpy.bool bool
+  '';
+
   # checkPhase begins by deleting source dir to force test execution against installed version
   checkPhase = ''
+    runHook preCheck
+
     rm -r code/png
     ${python.interpreter} code/test_png.py
+
+    runHook postCheck
   '';
 
   meta = with lib; {
     description = "Pure Python library for PNG image encoding/decoding";
-    homepage    = "https://github.com/scondo/purepng";
-    license     = licenses.mit;
+    homepage = "https://github.com/scondo/purepng";
+    license = licenses.mit;
     maintainers = with maintainers; [ ris ];
   };
-
 }
diff --git a/pkgs/development/python-modules/pysam/default.nix b/pkgs/development/python-modules/pysam/default.nix
index 86a81d14d747..108e2dab9124 100644
--- a/pkgs/development/python-modules/pysam/default.nix
+++ b/pkgs/development/python-modules/pysam/default.nix
@@ -8,14 +8,14 @@
 , htslib
 , libdeflate
 , xz
-, pytest
+, pytestCheckHook
 , samtools
 , zlib
 }:
 
 buildPythonPackage rec {
   pname   = "pysam";
-  version = "0.20.0";
+  version = "0.21.0";
 
   # Fetching from GitHub instead of PyPi cause the 0.13 src release on PyPi is
   # missing some files which cause test failures.
@@ -24,19 +24,21 @@ buildPythonPackage rec {
     owner = "pysam-developers";
     repo = "pysam";
     rev = "refs/tags/v${version}";
-    hash = "sha256-7yEZJ+iIw4qOxsanlKQlqt1bfi8MvyYjGJWiVDmXBrc=";
+    hash = "sha256-C4/AJwcUyLoUEUEnsATLHJb5F8mltP8X2XfktYu0OTo=";
   };
 
   nativeBuildInputs = [ samtools ];
+
   buildInputs = [
     bzip2
     curl
-    cython
     libdeflate
     xz
     zlib
   ];
 
+  propagatedBuildInputs = [ cython ];
+
   # Use nixpkgs' htslib instead of the bundled one
   # See https://pysam.readthedocs.io/en/latest/installation.html#external
   # NOTE that htslib should be version compatible with pysam
@@ -47,53 +49,17 @@ buildPythonPackage rec {
   '';
 
   nativeCheckInputs = [
-    pytest
+    pytestCheckHook
     bcftools
     htslib
   ];
 
-  # See https://github.com/NixOS/nixpkgs/pull/100823 for why we aren't using
-  # disabledTests and pytestFlagsArray through pytestCheckHook
-  checkPhase = ''
-    # Needed to avoid /homeless-shelter error
-    export HOME=$(mktemp -d)
-
-    # To avoid API incompatibilities, these should ideally show the same version
-    echo "> samtools --version"
-    samtools --version
-    echo "> htsfile --version"
-    htsfile --version
-    echo "> bcftools --version"
-    bcftools --version
-
-    # Create auxiliary test data
+  preCheck = ''
+    export HOME=$TMPDIR
     make -C tests/pysam_data
     make -C tests/cbcf_data
-
-    # Delete pysam folder in current directory to avoid importing it during testing
+    make -C tests/tabix_data
     rm -rf pysam
-
-    # Deselect tests that are known to fail due to upstream issues
-    # See https://github.com/pysam-developers/pysam/issues/961
-    py.test \
-      --deselect tests/AlignmentFileHeader_test.py::TestHeaderBAM::test_dictionary_access_works \
-      --deselect tests/AlignmentFileHeader_test.py::TestHeaderBAM::test_header_content_is_as_expected \
-      --deselect tests/AlignmentFileHeader_test.py::TestHeaderCRAM::test_dictionary_access_works \
-      --deselect tests/AlignmentFileHeader_test.py::TestHeaderCRAM::test_header_content_is_as_expected \
-      --deselect tests/AlignmentFile_test.py::TestDeNovoConstruction::testBAMWholeFile \
-      --deselect tests/AlignmentFile_test.py::TestEmptyHeader::testEmptyHeader \
-      --deselect tests/AlignmentFile_test.py::TestHeaderWithProgramOptions::testHeader \
-      --deselect tests/AlignmentFile_test.py::TestIO::testBAM2BAM \
-      --deselect tests/AlignmentFile_test.py::TestIO::testBAM2CRAM \
-      --deselect tests/AlignmentFile_test.py::TestIO::testBAM2SAM \
-      --deselect tests/AlignmentFile_test.py::TestIO::testFetchFromClosedFileObject \
-      --deselect tests/AlignmentFile_test.py::TestIO::testOpenFromFilename \
-      --deselect tests/AlignmentFile_test.py::TestIO::testSAM2BAM \
-      --deselect tests/AlignmentFile_test.py::TestIO::testWriteUncompressedBAMFile \
-      --deselect tests/AlignmentFile_test.py::TestIteratorRowAllBAM::testIterate \
-      --deselect tests/StreamFiledescriptors_test.py::StreamTest::test_text_processing \
-      --deselect tests/compile_test.py::BAMTest::testCount \
-      tests/
   '';
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/pysml/default.nix b/pkgs/development/python-modules/pysml/default.nix
index c27198a26ae1..b3a6f195a008 100644
--- a/pkgs/development/python-modules/pysml/default.nix
+++ b/pkgs/development/python-modules/pysml/default.nix
@@ -5,18 +5,21 @@
 , fetchFromGitHub
 , poetry-core
 , pyserial-asyncio
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "pysml";
-  version = "0.0.11";
+  version = "0.0.12";
   format = "pyproject";
 
+  disabled = pythonOlder "3.7";
+
   src = fetchFromGitHub {
     owner = "mtdcr";
     repo = pname;
-    rev = version;
-    hash = "sha256-RPDYh5h885/FiU2vsDpCGd8yWXNNIEpjAu6w8QXTxAA=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-DgfTSlgDC92l/hOgrMZrkZi1wzRUDY8tNl4xU3OQgJ8=";
   };
 
   nativeBuildInputs = [
@@ -32,7 +35,9 @@ buildPythonPackage rec {
   # Project has no tests
   doCheck = false;
 
-  pythonImportsCheck = [ "sml" ];
+  pythonImportsCheck = [
+    "sml"
+  ];
 
   meta = with lib; {
     description = "Python library for EDL21 smart meters using Smart Message Language (SML)";
diff --git a/pkgs/development/python-modules/pytest-ansible/default.nix b/pkgs/development/python-modules/pytest-ansible/default.nix
index f1ef205a4d8e..110db96aba93 100644
--- a/pkgs/development/python-modules/pytest-ansible/default.nix
+++ b/pkgs/development/python-modules/pytest-ansible/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "pytest-ansible";
-  version = "3.0.0";
+  version = "3.1.5";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "ansible";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-kxOp7ScpIIzEbM4VQa+3ByHzkPS8pzdYq82rggF9Fpk=";
+    hash = "sha256-stsgVJseZ02C7nG0Hm0wfAnhoLpM3qRZ2Lkr1N5hODw=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/tools/bazelisk/default.nix b/pkgs/development/tools/bazelisk/default.nix
index aeec00e99a9b..b610a7a20442 100644
--- a/pkgs/development/tools/bazelisk/default.nix
+++ b/pkgs/development/tools/bazelisk/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "bazelisk";
-  version = "1.16.0";
+  version = "1.17.0";
 
   src = fetchFromGitHub {
     owner = "bazelbuild";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-ijw0JVU9jUhpIJQjcjgzAVPJDxD7WSZYiLV0OvOyS5g=";
+    sha256 = "sha256-F3paYKK+L5mBCQvlusKlSBS1X9fVSDHFw1Ujiyo5yrc=";
   };
 
-  vendorHash = "sha256-Hg8rMknanHQOgVLJ58QM9JOgrUYMqL7WvaHuiv9xVYw=";
+  vendorHash = "sha256-V1GKZPLBjFhl0F0AvUC6MfAsrZsVToSZU3K2/hwOCVs=";
 
   doCheck = false;
 
diff --git a/pkgs/development/tools/datree/default.nix b/pkgs/development/tools/datree/default.nix
index 62d70ffc1897..6a9ee36e9f91 100644
--- a/pkgs/development/tools/datree/default.nix
+++ b/pkgs/development/tools/datree/default.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "datree";
-  version = "1.9.0";
+  version = "1.9.2";
 
   src = fetchFromGitHub {
     owner = "datreeio";
     repo = "datree";
     rev = "refs/tags/${version}";
-    hash = "sha256-FN+on/P5NyXCIwz+VydlpLC0LS7TI4IkX+mjyYrCzTI=";
+    hash = "sha256-yE2HrFhmiYriIgmYumcIQ6/ptr6m44Lm7wrfaeu8CeU=";
   };
 
-  vendorHash = "sha256-MrVIpr2iwddW3yUeBuDfeg+Xo9Iarr/fp4Rc4WGYGeU=";
+  vendorHash = "sha256-ECVKofvmLuFAFvncq63hYUaYW8/2+F4gZr8wIGQyrdU=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/development/tools/devbox/default.nix b/pkgs/development/tools/devbox/default.nix
index bd1828bc2978..595ad5b5c27f 100644
--- a/pkgs/development/tools/devbox/default.nix
+++ b/pkgs/development/tools/devbox/default.nix
@@ -5,13 +5,13 @@
 }:
 buildGoModule rec {
   pname = "devbox";
-  version = "0.4.9";
+  version = "0.5.2";
 
   src = fetchFromGitHub {
     owner = "jetpack-io";
     repo = pname;
     rev = version;
-    hash = "sha256-JxpvUlBrC00zLEZAVVhNI0lP/whd61DcY+NZAoKR55I=";
+    hash = "sha256-fC/cUtuXTxjDv35gJXN7meq/uRFH3nsVULxmOJe8WwY=";
   };
 
   ldflags = [
diff --git a/pkgs/development/tools/kustomize/default.nix b/pkgs/development/tools/kustomize/default.nix
index d69929f0ff66..d30f94bcc8ca 100644
--- a/pkgs/development/tools/kustomize/default.nix
+++ b/pkgs/development/tools/kustomize/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "kustomize";
-  version = "5.0.2";
+  version = "5.0.3";
 
   ldflags = let t = "sigs.k8s.io/kustomize/api/provenance"; in
     [
@@ -15,13 +15,13 @@ buildGoModule rec {
     owner = "kubernetes-sigs";
     repo = pname;
     rev = "kustomize/v${version}";
-    hash = "sha256-tsri90wvEZ6/UQpFz4fn7FgBQhji1IW1nPcx3jBaa3M=";
+    hash = "sha256-VKDLutzt5mFY7M9zmtEKvBjRD8+ea1Yil/NupvWBoVU=";
   };
 
   # avoid finding test and development commands
   modRoot = "kustomize";
   proxyVendor = true;
-  vendorHash = "sha256-9XOa3K5PBhnxwQo6eOPkdFcbp6axKTDYHFwzbAKxjEI=";
+  vendorHash = "sha256-FvxkQqC4LuYcgOw6HUSIbdJcYpJoJQN7TQHGquZRlZA=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/development/tools/rust/cargo-zigbuild/default.nix b/pkgs/development/tools/rust/cargo-zigbuild/default.nix
index 451e03c813ea..9dfcfc363533 100644
--- a/pkgs/development/tools/rust/cargo-zigbuild/default.nix
+++ b/pkgs/development/tools/rust/cargo-zigbuild/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-zigbuild";
-  version = "0.16.8";
+  version = "0.16.9";
 
   src = fetchFromGitHub {
     owner = "messense";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-T/npT2KUPIXbjRjNqOJP8JiOE2DpvVDnabrfwhZganY=";
+    sha256 = "sha256-AimdMEdqNbcNE47mHb4KOYQBtZqtpxFDHCnMbheynFU=";
   };
 
-  cargoSha256 = "sha256-+u1TWAzathwdo1Q+NyBGJVfRceawFBBF4HkT7AY8BZw=";
+  cargoSha256 = "sha256-k403T+31dwjEkdXEvAiwrguSUBksXGZz+pCu2BiJbsQ=";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/development/web/flyctl/default.nix b/pkgs/development/web/flyctl/default.nix
index cf15af14d6ba..cb9d18b877d8 100644
--- a/pkgs/development/web/flyctl/default.nix
+++ b/pkgs/development/web/flyctl/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "flyctl";
-  version = "0.1.2";
+  version = "0.1.8";
 
   src = fetchFromGitHub {
     owner = "superfly";
     repo = "flyctl";
     rev = "v${version}";
-    hash = "sha256-0nassGiVjBb/KLMwj/DWSDdW/ymkIJSfoA6fdLyq8YE=";
+    hash = "sha256-2OqJK+oGGZ4YiCJErFIh7laq4iLPZ8uA/SIYOVPxYuw=";
   };
 
-  vendorHash = "sha256-w/8cCtu+SKhooutKt810pnbGR1a3hWHjhNmzLVU0Zxk=";
+  vendorHash = "sha256-YMj4iRSXfQYCheGHQeJMd5PFDRlXGIVme0Y2heJMm3Y=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/games/steam/default.nix b/pkgs/games/steam/default.nix
index a304f18f5bf6..370f22268a9a 100644
--- a/pkgs/games/steam/default.nix
+++ b/pkgs/games/steam/default.nix
@@ -25,6 +25,11 @@ let
       inherit buildFHSEnv;
     };
     steam-fhsenv-small = steam-fhsenv.override { withGameSpecificLibraries = false; };
+
+    # This has to exist so Hydra tries to build all of Steam's dependencies.
+    # FIXME: Maybe we should expose it as something more generic?
+    steam-fhsenv-without-steam = steam-fhsenv.override { steam = null; };
+
     steamcmd = callPackage ./steamcmd.nix { };
   };
   keep = self: { };
diff --git a/pkgs/games/steam/fhsenv.nix b/pkgs/games/steam/fhsenv.nix
index a64aaacb0e7e..7fe40b68ecee 100644
--- a/pkgs/games/steam/fhsenv.nix
+++ b/pkgs/games/steam/fhsenv.nix
@@ -62,7 +62,7 @@ in buildFHSEnv rec {
   name = "steam";
 
   targetPkgs = pkgs: with pkgs; [
-    steamPackages.steam
+    steam
     # License agreement
     gnome.zenity
   ] ++ commonTargetPkgs pkgs;
@@ -207,10 +207,10 @@ in buildFHSEnv rec {
     libpsl
     nghttp2.lib
     rtmpdump
-  ] ++ steamPackages.steam-runtime-wrapped.overridePkgs
+  ] ++ steam-runtime-wrapped.overridePkgs
   ++ extraLibraries pkgs;
 
-  extraInstallCommands = ''
+  extraInstallCommands = lib.optionalString (steam != null) ''
     mkdir -p $out/share/applications
     ln -s ${steam}/share/icons $out/share
     ln -s ${steam}/share/pixmaps $out/share
@@ -262,9 +262,15 @@ in buildFHSEnv rec {
     exec steam ${extraArgs} "$@"
   '';
 
-  meta = steam.meta // lib.optionalAttrs (!withGameSpecificLibraries) {
-    description = steam.meta.description + " (without game specific libraries)";
-  };
+  meta =
+    if steam != null
+    then
+      steam.meta // lib.optionalAttrs (!withGameSpecificLibraries) {
+        description = steam.meta.description + " (without game specific libraries)";
+      }
+    else {
+      description = "Steam dependencies (dummy package, do not use)";
+    };
 
   # allows for some gui applications to share IPC
   # this fixes certain issues where they don't render correctly
@@ -298,7 +304,7 @@ in buildFHSEnv rec {
       exec -- "$run" "$@"
     '';
 
-    meta = steam.meta // {
+    meta = (steam.meta or {}) // {
       description = "Run commands in the same FHS environment that is used for Steam";
       name = "steam-run";
     };
diff --git a/pkgs/misc/arm-trusted-firmware/default.nix b/pkgs/misc/arm-trusted-firmware/default.nix
index a6f95adb9bef..63c9da2e8fb9 100644
--- a/pkgs/misc/arm-trusted-firmware/default.nix
+++ b/pkgs/misc/arm-trusted-firmware/default.nix
@@ -26,13 +26,13 @@ let
            stdenv.mkDerivation (rec {
 
     pname = "arm-trusted-firmware${lib.optionalString (platform != null) "-${platform}"}";
-    version = "2.7";
+    version = "2.8";
 
     src = fetchFromGitHub {
       owner = "ARM-software";
       repo = "arm-trusted-firmware";
       rev = "v${version}";
-      sha256 = "sha256-WDJMMIWZHNqxxAKeHiZDxtPjfsfQAWsbYv+0o0PiJQs=";
+      hash = "sha256-WDJMMIWZHNqxxAKeHiZDxtPjfsfQAWsbYv+0o0PiJQs=";
     };
 
     patches = lib.optionals deleteHDCPBlobBeforeBuild [
@@ -89,12 +89,11 @@ in {
   armTrustedFirmwareTools = buildArmTrustedFirmware rec {
     extraMakeFlags = [
       "HOSTCC=${stdenv.cc.targetPrefix}gcc"
-      "fiptool" "certtool" "sptool"
+      "fiptool" "certtool"
     ];
     filesToInstall = [
       "tools/fiptool/fiptool"
       "tools/cert_create/cert_create"
-      "tools/sptool/sptool"
     ];
     postInstall = ''
       mkdir -p "$out/bin"
diff --git a/pkgs/misc/fastly/default.nix b/pkgs/misc/fastly/default.nix
index 48e5fa54de7c..e06777c13251 100644
--- a/pkgs/misc/fastly/default.nix
+++ b/pkgs/misc/fastly/default.nix
@@ -10,13 +10,13 @@
 
 buildGoModule rec {
   pname = "fastly";
-  version = "9.0.3";
+  version = "10.0.1";
 
   src = fetchFromGitHub {
     owner = "fastly";
     repo = "cli";
     rev = "refs/tags/v${version}";
-    hash = "sha256-cR0XtTzdz400p/9b8NmFxWqsSMqLf3KJRekfkWbx/Zs=";
+    hash = "sha256-khGg6TcbyJMn+hiBANhHA6IU6aODTA94AV7yCaELqrs=";
     # The git commit is part of the `fastly version` original output;
     # leave that output the same in nixpkgs. Use the `.git` directory
     # to retrieve the commit SHA, and remove the directory afterwards,
@@ -33,7 +33,7 @@ buildGoModule rec {
     "cmd/fastly"
   ];
 
-  vendorHash = "sha256-Ch9TT5gPC8NpwuqkwHP+3HEFocWHrCZPC0T7+3VweVc=";
+  vendorHash = "sha256-WF66oSkH46mA+WLazJ/qgfNSTXBbeWhbeBYIcP2Q3aQ=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/servers/clickhouse/default.nix b/pkgs/servers/clickhouse/default.nix
index cab0ca1c2964..fcee2e420656 100644
--- a/pkgs/servers/clickhouse/default.nix
+++ b/pkgs/servers/clickhouse/default.nix
@@ -7,6 +7,14 @@
 , perl
 , yasm
 , nixosTests
+
+# currently for BLAKE3 hash function
+, rustSupport ? true
+
+, corrosion
+, rustc
+, cargo
+, rustPlatform
 }:
 
 stdenv.mkDerivation rec {
@@ -29,8 +37,52 @@ stdenv.mkDerivation rec {
     perl
   ] ++ lib.optionals stdenv.isx86_64 [
     yasm
+  ] ++ lib.optionals rustSupport [
+    rustc
+    cargo
+    rustPlatform.cargoSetupHook
   ];
 
+  corrosionDeps = if rustSupport then corrosion.cargoDeps else null;
+  blake3Deps = if rustSupport then rustPlatform.fetchCargoTarball {
+    inherit src;
+    name = "blake3-deps";
+    preBuild = "cd rust/BLAKE3";
+    hash = "sha256-lDMmmsyjEbTfI5NgTgT4+8QQrcUE/oUWfFgj1i19W0Q=";
+  } else null;
+  skimDeps = if rustSupport then rustPlatform.fetchCargoTarball {
+    inherit src;
+    name = "skim-deps";
+    preBuild = "cd rust/skim";
+    hash = "sha256-gEWB+U8QrM0yYyMXpwocszJZgOemdTlbSzKNkS0NbPk=";
+  } else null;
+
+  dontCargoSetupPostUnpack = true;
+  postUnpack = lib.optionalString rustSupport ''
+    pushd source
+
+    # their vendored version is too old and missing this patch: https://github.com/corrosion-rs/corrosion/pull/205
+    rm -rf contrib/corrosion
+    cp -r --no-preserve=mode ${corrosion.src} contrib/corrosion
+
+    pushd contrib/corrosion/generator
+    cargoDeps="$corrosionDeps" cargoSetupPostUnpackHook
+    corrosionDepsCopy="$cargoDepsCopy"
+    popd
+
+    pushd rust/BLAKE3
+    cargoDeps="$blake3Deps" cargoSetupPostUnpackHook
+    blake3DepsCopy="$cargoDepsCopy"
+    popd
+
+    pushd rust/skim
+    cargoDeps="$skimDeps" cargoSetupPostUnpackHook
+    skimDepsCopy="$cargoDepsCopy"
+    popd
+
+    popd
+  '';
+
   postPatch = ''
     patchShebangs src/
 
@@ -44,6 +96,21 @@ stdenv.mkDerivation rec {
       --replace 'git rev-parse --show-toplevel' '$src'
     substituteInPlace utils/check-style/check-style \
       --replace 'git rev-parse --show-toplevel' '$src'
+  '' + lib.optionalString rustSupport ''
+
+    pushd contrib/corrosion/generator
+    cargoDepsCopy="$corrosionDepsCopy" cargoSetupPostPatchHook
+    popd
+
+    pushd rust/BLAKE3
+    cargoDepsCopy="$blake3DepsCopy" cargoSetupPostPatchHook
+    popd
+
+    pushd rust/skim
+    cargoDepsCopy="$skimDepsCopy" cargoSetupPostPatchHook
+    popd
+
+    cargoSetupPostPatchHook() { true; }
   '';
 
   cmakeFlags = [
diff --git a/pkgs/tools/audio/pasystray/default.nix b/pkgs/tools/audio/pasystray/default.nix
index 8df578d03109..c01088466599 100644
--- a/pkgs/tools/audio/pasystray/default.nix
+++ b/pkgs/tools/audio/pasystray/default.nix
@@ -5,25 +5,29 @@
 
 stdenv.mkDerivation rec {
   pname = "pasystray";
-  version = "0.7.1";
+  version = "0.8.2";
 
   src = fetchFromGitHub {
     owner = "christophgysin";
     repo = "pasystray";
-    rev = "${pname}-${version}";
-    sha256 = "0xx1bm9kimgq11a359ikabdndqg5q54pn1d1dyyjnrj0s41168fk";
+    rev = version;
+    sha256 = "sha256-QaTQ8yUviJaFEQaQm2vYAUngqHliKe8TDYqfWt1Nx/0=";
   };
 
   patches = [
-    # https://github.com/christophgysin/pasystray/issues/90#issuecomment-306190701
-    ./fix-wayland.patch
-
+    # Use ayatana-appindicator instead of appindicator
     # https://github.com/christophgysin/pasystray/issues/98
     (fetchpatch {
-      url = "https://sources.debian.org/data/main/p/pasystray/0.7.1-1/debian/patches/0001-Build-against-ayatana-appindicator.patch";
-      sha256 = "0hijphrf52n2zfwdnrmxlp3a7iwznnkb79awvpzplz0ia2lqywpw";
+      url = "https://sources.debian.org/data/main/p/pasystray/0.8.1-1/debian/patches/0001-Build-against-ayatana-appindicator.patch";
+      sha256 = "sha256-/HKPqVARfHr/3Vyls6a1n8ejxqW9Ztu4+8KK4jK8MkI=";
     })
-  ];
+    # Require X11 backend
+    # https://github.com/christophgysin/pasystray/issues/90#issuecomment-361881076
+    (fetchpatch {
+      url = "https://sources.debian.org/data/main/p/pasystray/0.8.1-1/debian/patches/0002-Require-X11-backend.patch";
+      sha256 = "sha256-6njC3vqBPWFS1xAsa1katQ4C0KJdVkHAP1MCPiZ6ELM=";
+    })
+   ];
 
   nativeBuildInputs = [ pkg-config autoreconfHook wrapGAppsHook ];
   buildInputs = [
diff --git a/pkgs/tools/audio/pasystray/fix-wayland.patch b/pkgs/tools/audio/pasystray/fix-wayland.patch
deleted file mode 100644
index 17c4e2e6d658..000000000000
--- a/pkgs/tools/audio/pasystray/fix-wayland.patch
+++ /dev/null
@@ -1,34 +0,0 @@
---- a/src/x11-property.c
-+++ b/src/x11-property.c
-@@ -43,11 +43,15 @@ static Window window;
- void x11_property_init()
- {
-     display = gdk_x11_get_default_xdisplay();
-+    if (!GDK_IS_X11_DISPLAY(display)) return;
-+    Screen* scr = ScreenOfDisplay(display, 0);
-+
-     window = RootWindow(display, 0);
- }
- 
- void x11_property_set(const char* key, const char* value)
- {
-+    if (!GDK_IS_X11_DISPLAY(display)) return;
-     g_debug("[x11-property] setting '%s' to '%s'", key, value);
- 
-     Atom atom = XInternAtom(display, key, False);
-@@ -57,6 +61,7 @@ void x11_property_set(const char* key, c
- 
- void x11_property_del(const char* key)
- {
-+    if (!GDK_IS_X11_DISPLAY(display)) return;
-     g_debug("[x11-property] deleting '%s'", key);
- 
-     Atom atom = XInternAtom(display, key, False);
-@@ -65,6 +70,7 @@ void x11_property_del(const char* key)
- 
- char* x11_property_get(const char* key)
- {
-+    if (!GDK_IS_X11_DISPLAY(display)) return NULL;
-     Atom property = XInternAtom(display, key, False);
-     Atom actual_type;
-     int actual_format;
diff --git a/pkgs/tools/graphics/resvg/default.nix b/pkgs/tools/graphics/resvg/default.nix
index dd47a602a6f1..8d2f1a61b605 100644
--- a/pkgs/tools/graphics/resvg/default.nix
+++ b/pkgs/tools/graphics/resvg/default.nix
@@ -2,16 +2,26 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "resvg";
-  version = "0.32.0";
+  version = "0.33.0";
 
   src = fetchFromGitHub {
     owner = "RazrFalcon";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-tbFRonljX/vH32/18yKs9qbs+spxLa1ZOQt2QTR8Z7o=";
+    hash = "sha256-x2lsEYPv6FtARdRd5r+vvV+/S4uZkRXPhsoXmplgIAM=";
   };
 
-  cargoHash = "sha256-0SxFE6eMdVAU1wHvVLMClDk++Uf84InOISs1txXnIzo=";
+  cargoHash = "sha256-toUS1JAbJ8gbOsi87SXiqoaW0X7enAh4Iha3VeCa3WY=";
+
+  cargoBuildFlags = [
+    "--package=resvg"
+    "--package=resvg-capi"
+    "--package=usvg"
+  ];
+
+  postInstall = ''
+    install -Dm644 -t $out/include crates/c-api/*.h
+  '';
 
   meta = with lib; {
     description = "An SVG rendering library";
diff --git a/pkgs/tools/misc/bfscripts/default.nix b/pkgs/tools/misc/bfscripts/default.nix
new file mode 100644
index 000000000000..537cab8697a3
--- /dev/null
+++ b/pkgs/tools/misc/bfscripts/default.nix
@@ -0,0 +1,63 @@
+{ stdenv
+, fetchFromGitHub
+, lib
+, python3
+}:
+
+let
+  # Most of the binaries are not really useful because they have hardcoded
+  # paths that only make sense when you're running the stock BlueField OS on
+  # your BlueField. These might be patched in the future with resholve
+  # (https://github.com/abathur/resholve). If there is one that makes sense
+  # without resholving it, it can simply be uncommented and will be included in
+  # the output.
+  binaries = [
+    # "bfacpievt"
+    # "bfbootmgr"
+    # "bfcfg"
+    # "bfcpu-freq"
+    # "bfdracut"
+    # "bffamily"
+    # "bfgrubcheck"
+    # "bfhcafw"
+    # "bfinst"
+    # "bfpxe"
+    # "bfrec"
+    "bfrshlog"
+    # "bfsbdump"
+    # "bfsbkeys"
+    # "bfsbverify"
+    # "bfver"
+    # "bfvcheck"
+    "mlx-mkbfb"
+    "bfup"
+  ];
+in
+stdenv.mkDerivation rec {
+  pname = "bfscripts";
+  version = "unstable-2023-05-15";
+
+  src = fetchFromGitHub {
+    owner = "Mellanox";
+    repo = pname;
+    rev = "1da79f3ece7cdf99b2571c00e8b14d2e112504a4";
+    hash = "sha256-pTubrnZKEFmtAj/omycFYeYwrCog39zBDEszoCrsQNQ=";
+  };
+
+  buildInputs = [
+    python3
+  ];
+
+  installPhase = ''
+    ${lib.concatStringsSep "\n" (map (b: "install -D ${b} $out/bin/${b}") binaries)}
+  '';
+
+  meta = with lib;
+    {
+      description = "Collection of scripts used for BlueField SoC system management";
+      homepage = "https://github.com/Mellanox/bfscripts";
+      license = licenses.bsd2;
+      platforms = platforms.linux;
+      maintainers = with maintainers; [ nikstur ];
+    };
+}
diff --git a/pkgs/tools/misc/grub/default.nix b/pkgs/tools/misc/grub/default.nix
index 6020b38b8e09..298fe7fd036f 100644
--- a/pkgs/tools/misc/grub/default.nix
+++ b/pkgs/tools/misc/grub/default.nix
@@ -431,7 +431,7 @@ stdenv.mkDerivation rec {
   };
 
   meta = with lib; {
-    description = "GNU GRUB, the Grand Unified Boot Loader (2.x beta)";
+    description = "GNU GRUB, the Grand Unified Boot Loader";
 
     longDescription =
       '' GNU GRUB is a Multiboot boot loader. It was derived from GRUB, GRand
diff --git a/pkgs/tools/misc/plantuml-server/default.nix b/pkgs/tools/misc/plantuml-server/default.nix
index eba31269ba5f..94916f227b3a 100644
--- a/pkgs/tools/misc/plantuml-server/default.nix
+++ b/pkgs/tools/misc/plantuml-server/default.nix
@@ -1,14 +1,14 @@
 { lib, stdenv, fetchurl }:
 
 let
-  version = "1.2023.6";
+  version = "1.2023.7";
 in
 stdenv.mkDerivation rec {
   pname = "plantuml-server";
   inherit version;
   src = fetchurl {
     url = "https://github.com/plantuml/plantuml-server/releases/download/v${version}/plantuml-v${version}.war";
-    sha256 = "sha256-ECzmT6VMjuoJT91iEYOS2ov0bsmNuwIKTwBgsLqwgDI=";
+    sha256 = "sha256-JsMO2aef9DTo94uQNJN4jdiT5vnBTE8XDc4TtTTixVk=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/tools/security/flare-floss/default.nix b/pkgs/tools/security/flare-floss/default.nix
index e8fc5aeff24c..283c761680b1 100644
--- a/pkgs/tools/security/flare-floss/default.nix
+++ b/pkgs/tools/security/flare-floss/default.nix
@@ -27,14 +27,15 @@ let
 in
 py.pkgs.buildPythonPackage rec {
   pname = "flare-floss";
-  version = "2.0.0";
+  version = "2.2.0";
+  format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "mandiant";
     repo = "flare-floss";
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
     fetchSubmodules = true; # for tests
-    hash = "sha256-V4OWYcISyRdjf8x93B6h2hJwRgmRmk32hr8TrgRDu8Q=";
+    hash = "sha256-Oa0DMl7RKNfA00shcc4y1sNd2OiKCf0sA0EUC5gByBI=";
   };
 
   postPatch = ''
@@ -63,13 +64,15 @@ py.pkgs.buildPythonPackage rec {
 
   postInstall = ''
     mkdir -p $out/share/flare-floss/
-    cp -r sigs $out/share/flare-floss/
+    cp -r floss/sigs $out/share/flare-floss/
   '';
 
   meta = with lib; {
     description = "Automatically extract obfuscated strings from malware";
     homepage = "https://github.com/mandiant/flare-floss";
+    changelog = "https://github.com/mandiant/flare-floss/releases/tag/v${version}";
     license = licenses.asl20;
-    maintainers = [ ];
+    mainProgram = "floss";
+    maintainers = with maintainers; [ fab ];
   };
 }
diff --git a/pkgs/tools/security/trufflehog/default.nix b/pkgs/tools/security/trufflehog/default.nix
index d828e1b73825..54b03747adbb 100644
--- a/pkgs/tools/security/trufflehog/default.nix
+++ b/pkgs/tools/security/trufflehog/default.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "trufflehog";
-  version = "3.34.0";
+  version = "3.36.0";
 
   src = fetchFromGitHub {
     owner = "trufflesecurity";
     repo = "trufflehog";
     rev = "refs/tags/v${version}";
-    hash = "sha256-n/IzfVB40Ufr46L83WCxIyCwB9/jYVsw/J5F34/bDLg=";
+    hash = "sha256-Vp6WsbGy5h9Vd41D07KAuXnVE13cxPIQyeHJBqkAps4=";
   };
 
-  vendorHash = "sha256-wzBJjJVBT0mGJx0WQbs2D4n7ovfz1lA2NCEpz6xuqpg=";
+  vendorHash = "sha256-3096/8s50Xsbn5PryC7mW70Wn7uNFIn1THdOVBw9BHk=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/tools/security/volatility/default.nix b/pkgs/tools/security/volatility/default.nix
index 9c73f8a00195..9a4f27a0debc 100644
--- a/pkgs/tools/security/volatility/default.nix
+++ b/pkgs/tools/security/volatility/default.nix
@@ -19,6 +19,7 @@ python2Packages.buildPythonApplication rec {
     homepage = "https://www.volatilityfoundation.org/";
     description = "Advanced memory forensics framework";
     maintainers = with maintainers; [ bosu ];
-    license = lib.licenses.gpl2Plus;
+    license = licenses.gpl2Plus;
+    broken = true;
   };
 }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index ef40c1232340..6b03392cf33e 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3876,6 +3876,8 @@ with pkgs;
 
   bfr = callPackage ../tools/misc/bfr { };
 
+  bfscripts = callPackage ../tools/misc/bfscripts { };
+
   bibtool = callPackage ../tools/misc/bibtool { };
 
   bibutils = callPackage ../tools/misc/bibutils { };
@@ -36914,7 +36916,7 @@ with pkgs;
 
   stockfish = callPackage ../games/stockfish { };
 
-  steamPackages = dontRecurseIntoAttrs (callPackage ../games/steam { });
+  steamPackages = recurseIntoAttrs (callPackage ../games/steam { });
 
   steam = steamPackages.steam-fhsenv;
   steam-small = steamPackages.steam-fhsenv-small;
@@ -39797,6 +39799,8 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) CoreFoundation SystemConfiguration Security;
   };
 
+  wavm = callPackage ../development/interpreters/wavm { };
+
   yabasic = callPackage ../development/interpreters/yabasic { };
 
   wasm-pack = callPackage ../development/tools/wasm-pack {