diff --git a/nixos/modules/services/misc/klipper.nix b/nixos/modules/services/misc/klipper.nix
index 9f8539980aaa..ad881d4462a3 100644
--- a/nixos/modules/services/misc/klipper.nix
+++ b/nixos/modules/services/misc/klipper.nix
@@ -23,6 +23,16 @@ in
         description = lib.mdDoc "The Klipper package.";
       };
 
+      logFile = mkOption {
+        type = types.nullOr types.path;
+        default = null;
+        example = "/var/lib/klipper/klipper.log";
+        description = lib.mdDoc ''
+          Path of the file Klipper should log to.
+          If `null`, it logs to stdout, which is not recommended by upstream.
+        '';
+      };
+
       inputTTY = mkOption {
         type = types.path;
         default = "/run/klipper/tty";
@@ -151,7 +161,9 @@ in
     systemd.services.klipper =
       let
         klippyArgs = "--input-tty=${cfg.inputTTY}"
-          + optionalString (cfg.apiSocket != null) " --api-server=${cfg.apiSocket}";
+          + optionalString (cfg.apiSocket != null) " --api-server=${cfg.apiSocket}"
+          + optionalString (cfg.logFile != null) " --logfile=${cfg.logFile}"
+        ;
         printerConfigPath =
           if cfg.mutableConfig
           then cfg.mutableConfigFolder + "/printer.cfg"
@@ -177,7 +189,7 @@ in
         '';
 
         serviceConfig = {
-          ExecStart = "${cfg.package}/lib/klipper/klippy.py ${klippyArgs} ${printerConfigPath}";
+          ExecStart = "${cfg.package}/bin/klippy ${klippyArgs} ${printerConfigPath}";
           RuntimeDirectory = "klipper";
           StateDirectory = "klipper";
           SupplementaryGroups = [ "dialout" ];
diff --git a/nixos/modules/services/system/cloud-init.nix b/nixos/modules/services/system/cloud-init.nix
index 8c932b0e6f78..4cda06ed4248 100644
--- a/nixos/modules/services/system/cloud-init.nix
+++ b/nixos/modules/services/system/cloud-init.nix
@@ -90,7 +90,7 @@ in
 
   };
 
-  config = {
+  config = mkIf cfg.enable {
     services.cloud-init.settings = {
       system_info = mkDefault {
         distro = "nixos";
@@ -142,7 +142,6 @@ in
         "power-state-change"
       ];
     };
-  } // (mkIf cfg.enable {
 
     environment.etc."cloud/cloud.cfg" =
       if cfg.config == "" then
@@ -225,5 +224,7 @@ in
       description = "Cloud-config availability";
       requires = [ "cloud-init-local.service" "cloud-init.service" ];
     };
-  });
+  };
+
+  meta.maintainers = [ maintainers.zimbatm ];
 }
diff --git a/nixos/modules/virtualisation/nixos-containers.nix b/nixos/modules/virtualisation/nixos-containers.nix
index d54e2ed3f3ae..c3949564d4bd 100644
--- a/nixos/modules/virtualisation/nixos-containers.nix
+++ b/nixos/modules/virtualisation/nixos-containers.nix
@@ -515,6 +515,10 @@ in
                     in [ extraConfig ] ++ (map (x: x.value) defs);
                   prefix = [ "containers" name ];
                   inherit (config) specialArgs;
+
+                  # The system is inherited from the host above.
+                  # Set it to null, to remove the "legacy" entrypoint's non-hermetic default.
+                  system = null;
                 }).config;
               };
             };
diff --git a/nixos/tests/containers-imperative.nix b/nixos/tests/containers-imperative.nix
index 3007efaf8871..22b664a90e17 100644
--- a/nixos/tests/containers-imperative.nix
+++ b/nixos/tests/containers-imperative.nix
@@ -25,6 +25,10 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
               system.stateVersion = "18.03";
             };
           };
+
+          # The system is inherited from the host above.
+          # Set it to null, to remove the "legacy" entrypoint's non-hermetic default.
+          system = null;
         };
       in with pkgs; [
         stdenv stdenvNoCC emptyContainer.config.containers.foo.path
diff --git a/nixos/tests/prometheus-exporters.nix b/nixos/tests/prometheus-exporters.nix
index 82d50da63818..adc2b467be51 100644
--- a/nixos/tests/prometheus-exporters.nix
+++ b/nixos/tests/prometheus-exporters.nix
@@ -1396,7 +1396,10 @@ let
       '';
     };
 
-    wireguard = let snakeoil = import ./wireguard/snakeoil-keys.nix; in
+    wireguard = let
+      snakeoil = import ./wireguard/snakeoil-keys.nix;
+      publicKeyWithoutNewlines = replaceStrings [ "\n" ] [ "" ] snakeoil.peer1.publicKey;
+    in
       {
         exporterConfig.enable = true;
         metricProvider = {
@@ -1418,7 +1421,7 @@ let
           wait_for_unit("prometheus-wireguard-exporter.service")
           wait_for_open_port(9586)
           wait_until_succeeds(
-              "curl -sSf http://localhost:9586/metrics | grep '${snakeoil.peer1.publicKey}'"
+              "curl -sSf http://localhost:9586/metrics | grep '${publicKeyWithoutNewlines}'"
           )
         '';
       };
diff --git a/pkgs/applications/blockchains/btcpayserver/default.nix b/pkgs/applications/blockchains/btcpayserver/default.nix
index f3e81e10ff6b..ca097b1de88c 100644
--- a/pkgs/applications/blockchains/btcpayserver/default.nix
+++ b/pkgs/applications/blockchains/btcpayserver/default.nix
@@ -6,13 +6,13 @@
 
 buildDotnetModule rec {
   pname = "btcpayserver";
-  version = "1.9.2";
+  version = "1.9.3";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-N/6/a9K8ROSJ+rsip85Av1jmggI12Clr61+9Dh56Lls=";
+    sha256 = "sha256-XcpPdlDpY/RXOK8ykZ/UUVOok2Pz3vObdp4zhy9tt7w=";
   };
 
   projectFile = "BTCPayServer/BTCPayServer.csproj";
diff --git a/pkgs/applications/file-managers/nnn/default.nix b/pkgs/applications/file-managers/nnn/default.nix
index 27fbcfa4f0b7..4c3fab6484c9 100644
--- a/pkgs/applications/file-managers/nnn/default.nix
+++ b/pkgs/applications/file-managers/nnn/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , installShellFiles
 , makeWrapper
 , pkg-config
@@ -9,15 +10,17 @@
 , readline
 , which
 , musl-fts
-# options
+  # options
 , conf ? null
 , withIcons ? false
 , withNerdIcons ? false
+, withEmojis ? false
 }:
 
 # Mutually exclusive options
-assert withIcons -> withNerdIcons == false;
-assert withNerdIcons -> withIcons == false;
+assert withIcons -> (withNerdIcons == false && withEmojis == false);
+assert withNerdIcons -> (withIcons == false && withEmojis == false);
+assert withEmojis -> (withIcons == false && withNerdIcons == false);
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "nnn";
@@ -30,6 +33,14 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-QbKW2wjhUNej3zoX18LdeUHqjNLYhEKyvPH2MXzp/iQ=";
   };
 
+  patches = [
+    # FIXME: remove for next release
+    (fetchpatch {
+      url = "https://github.com/jarun/nnn/commit/20e944f5e597239ed491c213a634eef3d5be735e.patch";
+      hash = "sha256-RxG3AU8i3lRPCjRVZPnej4m1No/SKtsHwbghj9JQ7RQ=";
+    })
+  ];
+
   configFile = lib.optionalString (conf != null) (builtins.toFile "nnn.h" conf);
   preBuild = lib.optionalString (conf != null) "cp ${finalAttrs.configFile} src/nnn.h";
 
@@ -41,10 +52,13 @@ stdenv.mkDerivation (finalAttrs: {
 
   makeFlags = [ "PREFIX=$(out)" ]
     ++ lib.optionals withIcons [ "O_ICONS=1" ]
-    ++ lib.optionals withNerdIcons [ "O_NERD=1" ];
+    ++ lib.optionals withNerdIcons [ "O_NERD=1" ]
+    ++ lib.optionals withEmojis [ "O_EMOJI=1" ];
 
   binPath = lib.makeBinPath [ file which ];
 
+  installTargets = [ "install" "install-desktop" ];
+
   postInstall = ''
     installShellCompletion --bash --name nnn.bash misc/auto-completion/bash/nnn-completion.bash
     installShellCompletion --fish misc/auto-completion/fish/nnn.fish
diff --git a/pkgs/applications/misc/klipperscreen/default.nix b/pkgs/applications/misc/klipperscreen/default.nix
new file mode 100644
index 000000000000..ef51ec96ac84
--- /dev/null
+++ b/pkgs/applications/misc/klipperscreen/default.nix
@@ -0,0 +1,28 @@
+{ lib, stdenv, writeText, python3Packages, fetchFromGitHub, gtk3, gobject-introspection, gdk-pixbuf, wrapGAppsHook, librsvg }:
+python3Packages.buildPythonPackage rec {
+  pname = "KlipperScreen";
+  version = "0.3.2";
+
+  src = fetchFromGitHub {
+    owner = "jordanruthe";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-LweO5EVWr3OxziHrjtQDdWyUBCVUJ17afkw7RCZWgcg=";
+  };
+  patches = [ ./fix-paths.diff ];
+
+  buildInputs = [ gtk3 librsvg ];
+  nativeBuildInputs = [ wrapGAppsHook gdk-pixbuf gobject-introspection ];
+
+  propagatedBuildInputs = with python3Packages; [ jinja2 netifaces requests websocket-client pycairo pygobject3 mpv six dbus-python numpy pycairo ];
+
+  preBuild = ''
+    ln -s ${./setup.py} setup.py
+  '';
+
+  meta = with lib; {
+    description = "Touchscreen GUI for the Klipper 3D printer firmware";
+    homepage = "https://github.com/jordanruthe/${pname}";
+    license = licenses.agpl3;
+  };
+}
diff --git a/pkgs/applications/misc/klipperscreen/fix-paths.diff b/pkgs/applications/misc/klipperscreen/fix-paths.diff
new file mode 100644
index 000000000000..71ce60fe56e8
--- /dev/null
+++ b/pkgs/applications/misc/klipperscreen/fix-paths.diff
@@ -0,0 +1,22 @@
+diff --git a/screen.py b/screen.py
+index 4fd75cd..a10779a 100755
+--- a/screen.py
++++ b/screen.py
+@@ -48,7 +48,7 @@ PRINTER_BASE_STATUS_OBJECTS = [
+     'exclude_object',
+ ]
+ 
+-klipperscreendir = pathlib.Path(__file__).parent.resolve()
++klipperscreendir = pathlib.Path(functions.__file__).parent.parent.resolve()
+ 
+ 
+ def set_text_direction(lang=None):
+@@ -254,7 +254,7 @@ class KlipperScreen(Gtk.Window):
+     def _load_panel(self, panel, *args):
+         if panel not in self.load_panel:
+             logging.debug(f"Loading panel: {panel}")
+-            panel_path = os.path.join(os.path.dirname(__file__), 'panels', f"{panel}.py")
++            panel_path = os.path.join(klipperscreendir, 'panels', f"{panel}.py")
+             logging.info(f"Panel path: {panel_path}")
+             if not os.path.exists(panel_path):
+                 logging.error(f"Panel {panel} does not exist")
diff --git a/pkgs/applications/misc/klipperscreen/setup.py b/pkgs/applications/misc/klipperscreen/setup.py
new file mode 100644
index 000000000000..946b517b78be
--- /dev/null
+++ b/pkgs/applications/misc/klipperscreen/setup.py
@@ -0,0 +1,11 @@
+from setuptools import setup
+
+setup(
+  name='KlipperScreen',
+  install_requires=[],
+  packages=['styles', 'panels', 'ks_includes', 'ks_includes.widgets'],
+  package_data={'ks_includes': ['defaults.conf', 'locales/**', 'emptyCursor.xbm'], 'styles': ['**']},
+  entry_points={
+      'console_scripts': ['KlipperScreen=screen:main']
+  },
+)
diff --git a/pkgs/applications/misc/koreader/default.nix b/pkgs/applications/misc/koreader/default.nix
index e1785065b0a8..222e56b56619 100644
--- a/pkgs/applications/misc/koreader/default.nix
+++ b/pkgs/applications/misc/koreader/default.nix
@@ -1,24 +1,33 @@
 { lib, stdenv
 , fetchurl
 , makeWrapper
+, fetchFromGitHub
 , dpkg
 , glib
 , gnutar
 , gtk3-x11
 , luajit
 , sdcv
-, SDL2
-, noto-fonts
-, nerdfonts }:
-let font-droid = nerdfonts.override { fonts = [ "DroidSansMono" ]; };
-in stdenv.mkDerivation rec {
+, SDL2 }:
+let
+  luajit_lua52 = luajit.override { enable52Compat = true; };
+in
+stdenv.mkDerivation rec {
   pname = "koreader";
-  version = "2022.08";
+  version = "2023.04";
 
   src = fetchurl {
     url =
       "https://github.com/koreader/koreader/releases/download/v${version}/koreader-${version}-amd64.deb";
-    sha256 = "sha256-+JBJNJTAnC5gpuo8cehfe/3YwGIW5iFA8bZ8nfz9qsk=";
+    sha256 = "sha256-tRUeRB1+UcWT49dchN0YDvd0L5n1YRdtMSFc8yy6m5o=";
+  };
+
+  src_repo = fetchFromGitHub {
+    repo = "koreader";
+    owner = "koreader";
+    rev = "v${version}";
+    fetchSubmodules = true;
+    sha256 = "sha256-c3j6hs0W0H2jDg6JVfU6ov7r7kucbqrQqf9PAvYBcJ0=";
   };
 
   sourceRoot = ".";
@@ -27,7 +36,7 @@ in stdenv.mkDerivation rec {
     glib
     gnutar
     gtk3-x11
-    luajit
+    luajit_lua52
     sdcv
     SDL2
   ];
@@ -39,14 +48,11 @@ in stdenv.mkDerivation rec {
   installPhase = ''
     mkdir -p $out
     cp -R usr/* $out/
-    ln -sf ${luajit}/bin/luajit $out/lib/koreader/luajit
+    ln -sf ${luajit_lua52}/bin/luajit $out/lib/koreader/luajit
     ln -sf ${sdcv}/bin/sdcv $out/lib/koreader/sdcv
     ln -sf ${gnutar}/bin/tar $out/lib/koreader/tar
-    find $out -xtype l -delete
-    for i in ${noto-fonts}/share/fonts/truetype/noto/*; do
-        ln -s "$i" $out/lib/koreader/fonts/noto/
-    done
-    ln -s "${font-droid}/share/fonts/opentype/NerdFonts/Droid Sans Mono Nerd Font Complete Mono.otf" $out/lib/koreader/fonts/droid/DroidSansMono.ttf
+    find ${src_repo}/resources/fonts -type d -execdir cp -r '{}' $out/lib/koreader/fonts \;
+    find $out -xtype l -print -delete
     wrapProgram $out/bin/koreader --prefix LD_LIBRARY_PATH : ${
       lib.makeLibraryPath [ gtk3-x11 SDL2 glib ]
     }
diff --git a/pkgs/applications/misc/resumed/default.nix b/pkgs/applications/misc/resumed/default.nix
new file mode 100644
index 000000000000..75ee72a38b7f
--- /dev/null
+++ b/pkgs/applications/misc/resumed/default.nix
@@ -0,0 +1,22 @@
+{ lib, buildNpmPackage, fetchFromGitHub }:
+
+buildNpmPackage rec {
+  pname = "resumed";
+  version = "3.0.1";
+
+  src = fetchFromGitHub {
+    owner = "rbardini";
+    repo = "resumed";
+    rev = "v${version}";
+    hash = "sha256-X1efWl0CjbEbhNfDUNvb5SCc2exfI8v95gzqcaKU5eU=";
+  };
+
+  npmDepsHash = "sha256-b8NeO0w2UH1wEifDCkl8L48LoJM0jLStE0fO9G438dU=";
+
+  meta = with lib; {
+    description = "Lightweight JSON Resume builder, no-frills alternative to resume-cli";
+    homepage = "https://github.com/rbardini/resumed";
+    license = licenses.mit;
+    maintainers = with maintainers; [ ambroisie ];
+  };
+}
diff --git a/pkgs/applications/misc/tickrs/default.nix b/pkgs/applications/misc/tickrs/default.nix
index b28a740501ba..dcddaab34d7b 100644
--- a/pkgs/applications/misc/tickrs/default.nix
+++ b/pkgs/applications/misc/tickrs/default.nix
@@ -1,4 +1,12 @@
-{ lib, stdenv, rustPlatform, fetchFromGitHub, perl, Security }:
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, pkg-config
+, openssl
+, zlib
+, stdenv
+, darwin
+}:
 
 rustPlatform.buildRustPackage rec {
   pname = "tickrs";
@@ -13,9 +21,20 @@ rustPlatform.buildRustPackage rec {
 
   cargoHash = "sha256-fOYxOiVpgflwIz9Z6ePhQKDa7DX4D/ZCnPOwq9vWOSk=";
 
-  nativeBuildInputs = [ perl ];
+  nativeBuildInputs = [
+    pkg-config
+  ];
 
-  buildInputs = lib.optionals stdenv.isDarwin [ Security ];
+  buildInputs = [
+    openssl
+    zlib
+  ] ++ lib.optionals stdenv.isDarwin [
+    darwin.apple_sdk.frameworks.SystemConfiguration
+  ];
+
+  env = {
+    OPENSSL_NO_VENDOR = true;
+  };
 
   meta = with lib; {
     description = "Realtime ticker data in your terminal";
diff --git a/pkgs/applications/misc/topydo/default.nix b/pkgs/applications/misc/topydo/default.nix
index a20e3e2650f1..9ece11043fa0 100644
--- a/pkgs/applications/misc/topydo/default.nix
+++ b/pkgs/applications/misc/topydo/default.nix
@@ -1,28 +1,38 @@
-{ lib, python3Packages, fetchFromGitHub, glibcLocales }:
+{ lib, python3, fetchFromGitHub, fetchpatch, glibcLocales }:
 
-with python3Packages;
-
-buildPythonApplication rec {
+python3.pkgs.buildPythonApplication rec {
   pname = "topydo";
   version = "0.14";
 
   src = fetchFromGitHub {
-    owner = "bram85";
+    owner = "topydo";
     repo = pname;
     rev = version;
     sha256 = "1lpfdai0pf90ffrzgmmkadbd86rb7250i3mglpkc82aj6prjm6yb";
   };
 
-  propagatedBuildInputs = [
+  patches = [
+    # fixes a failing test
+    (fetchpatch {
+      name = "update-a-test-reference-ics-file.patch";
+      url = "https://github.com/topydo/topydo/commit/9373bb4702b512b10f0357df3576c129901e3ac6.patch";
+      hash = "sha256-JpyQfryWSoJDdyzbrESWY+RmRbDw1myvTlsFK7+39iw=";
+    })
+  ];
+
+  propagatedBuildInputs = with python3.pkgs; [
     arrow
-    icalendar
     glibcLocales
+    icalendar
     prompt-toolkit
     urwid
     watchdog
   ];
 
-  nativeCheckInputs = [ unittestCheckHook mock freezegun pylint ];
+  nativeCheckInputs = with python3.pkgs; [
+    freezegun
+    unittestCheckHook
+  ];
 
   # Skip test that has been reported multiple times upstream without result:
   # bram85/topydo#271, bram85/topydo#274.
@@ -34,7 +44,9 @@ buildPythonApplication rec {
 
   meta = with lib; {
     description = "A cli todo application compatible with the todo.txt format";
-    homepage = "https://github.com/bram85/topydo";
-    license = licenses.gpl3;
+    homepage = "https://github.com/topydo/topydo";
+    changelog = "https://github.com/topydo/topydo/blob/${src.rev}/CHANGES.md";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/applications/networking/asn/default.nix b/pkgs/applications/networking/asn/default.nix
index cf1341c43f5c..e2a62c1f8b10 100644
--- a/pkgs/applications/networking/asn/default.nix
+++ b/pkgs/applications/networking/asn/default.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "asn";
-  version = "0.73.3";
+  version = "0.74";
 
   src = fetchFromGitHub {
     owner = "nitefood";
     repo = "asn";
     rev = "v${version}";
-    sha256 = "sha256-O0Iu+7UAAf+v0gZdGTdBpdn9BZ/9OqTAA/u0WDiz9s8=";
+    sha256 = "sha256-400I8aWQaPE7qCV/HqyPzuMmKpUyLc+RK7GCVgbt7JQ=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix b/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
index 4af2f0286ded..9166dfde660b 100644
--- a/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
+++ b/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
@@ -88,7 +88,7 @@ let
   fteLibPath = lib.makeLibraryPath [ stdenv.cc.cc gmp ];
 
   # Upstream source
-  version = "12.0.5";
+  version = "12.0.6";
 
   lang = "ALL";
 
@@ -100,7 +100,7 @@ let
         "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux64-${version}_${lang}.tar.xz"
         "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux64-${version}_${lang}.tar.xz"
       ];
-      hash = "sha256-V4BUs30h0+AKNuNsHuRriDXJ0ZzrIsg2SYn4GPZS6Hs=";
+      hash = "sha256-MLy/T8A+udasITWYSzaqXSFhA3PJsG7DnKJG0b9UYvA=";
     };
 
     i686-linux = fetchurl {
@@ -110,7 +110,7 @@ let
         "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux32-${version}_${lang}.tar.xz"
         "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux32-${version}_${lang}.tar.xz"
       ];
-      hash = "sha256-TUfS31EjAi/hgVjCKT/T5Jx8iCYXB/3EXPVm1KSqXLk=";
+      hash = "sha256-njJB5k7rQxRyL7foU8fLCQxy43dJvV26oKvQ+fw6U0o=";
     };
   };
 
diff --git a/pkgs/applications/science/biology/jbrowse/default.nix b/pkgs/applications/science/biology/jbrowse/default.nix
new file mode 100644
index 000000000000..3ed6a885aa75
--- /dev/null
+++ b/pkgs/applications/science/biology/jbrowse/default.nix
@@ -0,0 +1,39 @@
+{ lib, fetchurl, appimageTools, wrapGAppsHook }:
+
+let
+  pname = "jbrowse";
+  version = "2.5.0";
+
+  src = fetchurl {
+    url = "https://github.com/GMOD/jbrowse-components/releases/download/v${version}/jbrowse-desktop-v${version}-linux.AppImage";
+    sha256 = "sha256-YLsyA+RVoFvjE4MfAtglJYdUgic487SxwdUhvolzBPc=";
+  };
+
+  appimageContents = appimageTools.extractType2 {
+    inherit pname version src;
+  };
+
+in
+appimageTools.wrapType2 {
+  inherit pname version src;
+  unshareIpc = false;
+
+  extraInstallCommands = ''
+    mkdir -p $out/bin
+    mv $out/bin/jbrowse-${version} $out/bin/jbrowse-desktop
+
+    install -m 444 -D ${appimageContents}/jbrowse-desktop.desktop $out/share/applications/jbrowse-desktop.desktop
+    install -m 444 -D ${appimageContents}/jbrowse-desktop.png \
+       $out/share/icons/hicolor/512x512/apps/jbrowse-desktop.png
+    substituteInPlace $out/share/applications/jbrowse-desktop.desktop \
+      --replace 'Exec=AppRun --no-sandbox' 'Exec=jbrowse-desktop'
+  '';
+
+  meta = with lib; {
+    description = "The next-generation genome browser";
+    homepage = "https://jbrowse.org/jb2/";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ benwbooth ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
diff --git a/pkgs/applications/virtualization/docker-slim/default.nix b/pkgs/applications/virtualization/docker-slim/default.nix
index 5eb2bade2c38..964d86a445e7 100644
--- a/pkgs/applications/virtualization/docker-slim/default.nix
+++ b/pkgs/applications/virtualization/docker-slim/default.nix
@@ -8,7 +8,7 @@ buildGoModule rec {
     owner = "slimtoolkit";
     repo = "slim";
     rev = version;
-    hash = "sha256-pRIfIgEM0olUi0LL8maB7vczcq4p67eDuWssoeOT4Tk=";
+    hash = "sha256-byB7GTw0hHY4dp3CkMCl6ga/Zn82+K6qmyWy6ezCLoE=";
   };
 
   vendorHash = null;
diff --git a/pkgs/data/icons/catppuccin-papirus-folders/default.nix b/pkgs/data/icons/catppuccin-papirus-folders/default.nix
index 263ea1f37428..70529a6337b7 100644
--- a/pkgs/data/icons/catppuccin-papirus-folders/default.nix
+++ b/pkgs/data/icons/catppuccin-papirus-folders/default.nix
@@ -16,13 +16,13 @@ in
 
   stdenvNoCC.mkDerivation {
     inherit pname;
-    version = "unstable-2022-12-04";
+    version = "unstable-2023-08-02";
 
     src = fetchFromGitHub {
       owner = "catppuccin";
       repo = "papirus-folders";
-      rev = "1a367642df9cf340770bd7097fbe85b9cea65bcb";
-      sha256 = "sha256-mFDfRVDA9WyriyFVzsI7iqmPopN56z54FvLkZDS2Dv8=";
+      rev = "fcf96737fffc343a1bf129732c37d19f2d77fa5c";
+      sha256 = "sha256-3yjIGzN+/moP2OVGDIAy4zPqUroSjx3c2mJjdZGhTsY=";
     };
 
     nativeBuildInputs = [ gtk3 ];
diff --git a/pkgs/development/compilers/c0/default.nix b/pkgs/development/compilers/c0/default.nix
new file mode 100644
index 000000000000..9722d466ae28
--- /dev/null
+++ b/pkgs/development/compilers/c0/default.nix
@@ -0,0 +1,80 @@
+{ lib
+, stdenv
+, fetchFromBitbucket
+, mlton
+, pkg-config
+, getopt
+, boehmgc
+, darwin
+, libbacktrace
+, libpng
+, ncurses
+, readline
+}:
+
+stdenv.mkDerivation rec {
+  pname = "c0";
+  version = "unstable-2022-10-25";
+
+  src = fetchFromBitbucket {
+    owner = "c0-lang";
+    repo = "c0";
+    rev = "7ef3bc9ca232ec41936e93ec8957051e48cacfba";
+    sha256 = "sha256-uahF8fOp2ZJE8EhZke46sbPmN0MNHzsLkU4EXkV710U=";
+  };
+
+  patches = [
+    ./use-system-libraries.patch
+  ];
+
+  postPatch = ''
+    substituteInPlace cc0/Makefile \
+      --replace '$(shell ./get_version.sh)' '${version}'
+    substituteInPlace cc0/compiler/bin/buildid \
+      --replace '`../get_version.sh`' '${version}' \
+      --replace '`date`' '1970-01-01T00:00:00Z' \
+      --replace '`hostname`' 'nixpkgs'
+  '' + lib.optionalString stdenv.isDarwin ''
+    for f in cc0/compiler/bin/coin-o0-support cc0/compiler/bin/cc0-o0-support; do
+      substituteInPlace $f --replace '$(brew --prefix gnu-getopt)' '${getopt}'
+    done
+  '';
+
+  preConfigure = ''
+    cd cc0/
+  '';
+
+  nativeBuildInputs = [
+    getopt
+    mlton
+    pkg-config
+  ] ++ lib.optionals stdenv.isDarwin [ darwin.sigtool ];
+
+  buildInputs = [
+    boehmgc
+    libbacktrace
+    libpng
+    ncurses
+    readline
+  ];
+
+  strictDeps = true;
+
+  installFlags = [ "PREFIX=$(out)" ];
+
+  postInstall = ''
+    mkdir -p $out/share/emacs/site-lisp
+    mv $out/c0-mode/ $out/share/emacs/site-lisp/
+  '';
+
+  meta = with lib; {
+    description = "A small safe subset of the C programming language, augmented with contracts";
+    homepage = "https://c0.cs.cmu.edu/";
+    license = licenses.mit;
+    maintainers = [ maintainers.marsam ];
+    platforms = platforms.unix;
+    # line 1: ../../bin/wrappergen: cannot execute: required file not found
+    # make[2]: *** [../../lib.mk:83:
+    broken = stdenv.isLinux;
+  };
+}
diff --git a/pkgs/development/compilers/c0/use-system-libraries.patch b/pkgs/development/compilers/c0/use-system-libraries.patch
new file mode 100644
index 000000000000..cc15ef368f33
--- /dev/null
+++ b/pkgs/development/compilers/c0/use-system-libraries.patch
@@ -0,0 +1,53 @@
+Use system libraries
+
+--- a/cc0/Makefile
++++ b/cc0/Makefile
+@@ -22,12 +22,12 @@ MLTON_BASIC = mlton $(MLTON_FLAGS) -verbose $(MLTON_VERB)  -output
+ MLTON_NATIVE := mlton -default-ann "redundantMatch error" -default-ann "sequenceNonUnit error"
+ MLTON_NATIVE += -link-opt "-lpthread -ldl -rdynamic" -cc-opt "-Iinclude" -default-ann "allowFFI true"
+ MLTON_NATIVE += -cc-opt "-I../externals/"
+-MLTON_NATIVE += -link-opt "../externals/readline/libreadline.a ../externals/readline/libhistory.a"
++MLTON_NATIVE += -link-opt "$(shell pkg-config readline --libs)"
+ MLTON_NATIVE += -link-opt "$(shell pkg-config libpng --libs)"
+ 
+ # libreadline dependencies
+ ifeq ($(PLATFORM),osx)
+-MLTON_NATIVE += -link-opt "-ltermcap"
++MLTON_NATIVE += -link-opt "-lncurses"
+ else
+ # (Assuming Linux)
+ MLTON_NATIVE += -link-opt "-ltinfo"
+@@ -122,9 +122,9 @@ endef
+ 
+ $(foreach rt,$(RUNTIMES),$(eval $(call runtime_template,$(rt))))
+ 
+-c0rt/$(call dllname,c0rt): gc libbacktrace
++c0rt/$(call dllname,c0rt):
+ 
+-unsafe/$(call dllname,unsafe): gc
++unsafe/$(call dllname,unsafe):
+ 
+ 
+ ### cc0 - the C0 compiler
+@@ -222,7 +222,6 @@ NATIVE_COIN    = $(NATIVE_CYMBOL) $(NATIVE_CALLING)
+ NATIVE_COIN += coin/c0readline.c
+ 
+ COIN_DEPS = $(CC0_DEPS) $(NATIVE_COIN) cymbol/cymbol*.cm cymbol/*.sml cymbol/*.mlb coin/coin*.cm coin/*.sml coin/*.sml
+-COIN_DEPS += readline
+ 
+ .PHONY: coin
+ coin: bin/coin
+--- a/cc0/lib.mk
++++ b/cc0/lib.mk
+@@ -15,9 +15,9 @@ TARGET = $(call dllname,$(LIBNAME))
+ endif
+ 
+ # These libs are handled specially by this file
+-NATIVELIBS = gc ncurses backtrace
++NATIVELIBS =
+ C0LIBS = $(filter-out $(NATIVELIBS),$(REQUIRES))
+-LIBS = -L$(abspath $(DEPTH)/lib) $(patsubst %,$(DEPTH)/lib/$(call dllname,%),$(C0LIBS))
++LIBS = -L$(abspath $(DEPTH)/lib)
+ LDFLAGS = 
+ 
+ # -fPIC is not supported on Windows and is not necessary there because we link statically
diff --git a/pkgs/development/python-modules/azure-eventgrid/default.nix b/pkgs/development/python-modules/azure-eventgrid/default.nix
index 4275be9bac23..962f7aae020f 100644
--- a/pkgs/development/python-modules/azure-eventgrid/default.nix
+++ b/pkgs/development/python-modules/azure-eventgrid/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "azure-eventgrid";
-  version = "4.10.0";
+  version = "4.11.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    hash = "sha256-PWl+rA/JAe0rUKU24oQuYlt7U4Cyi14T7cVlA/B60VY=";
+    hash = "sha256-qoUaKbbB2x3eO6IiXwn3kl/C6NA5biZbzRHctoNFdQE=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/base58/default.nix b/pkgs/development/python-modules/base58/default.nix
index c08ba1ccf5a8..9a4d30f6149a 100644
--- a/pkgs/development/python-modules/base58/default.nix
+++ b/pkgs/development/python-modules/base58/default.nix
@@ -1,9 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, py
 , pyhamcrest
-, pytest-benchmark
 , pytestCheckHook
 , pythonOlder
 }:
@@ -20,12 +18,16 @@ buildPythonPackage rec {
   };
 
   nativeCheckInputs = [
-    py
     pyhamcrest
-    pytest-benchmark
     pytestCheckHook
   ];
 
+  disabledTests = [
+    # avoid dependency on pytest-benchmark
+    "test_decode_random"
+    "test_encode_random"
+  ];
+
   pythonImportsCheck = [ "base58" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/cwl-upgrader/default.nix b/pkgs/development/python-modules/cwl-upgrader/default.nix
index 6dd63c2db3b7..bb8553cfe576 100644
--- a/pkgs/development/python-modules/cwl-upgrader/default.nix
+++ b/pkgs/development/python-modules/cwl-upgrader/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "cwl-upgrader";
-  version = "1.2.6";
+  version = "1.2.7";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "common-workflow-language";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-lVIy0aa+hqbi46NfwXCKWDRzszneyuyo6KXxAcr/xIA=";
+    hash = "sha256-/vCvpRpQkdMkqlK5/0jJTY56ROoB4ezvX9ma1AVWYd4=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/llfuse/default.nix b/pkgs/development/python-modules/llfuse/default.nix
index 9fa13391b6ad..04801eae96eb 100644
--- a/pkgs/development/python-modules/llfuse/default.nix
+++ b/pkgs/development/python-modules/llfuse/default.nix
@@ -8,23 +8,26 @@
 , pkg-config
 , pytestCheckHook
 , python
+, setuptools
 , which
 }:
 
 buildPythonPackage rec {
   pname = "llfuse";
-  version = "1.4.2";
+  version = "1.4.3";
+
+  format = "pyproject";
 
   disabled = pythonOlder "3.5";
 
   src = fetchFromGitHub {
     owner = "python-llfuse";
     repo = "python-llfuse";
-    rev = "release-${version}";
-    hash = "sha256-TnZnv439fLvg0WM96yx0dPSSz8Mrae6GDC9LiLFrgQ8=";
+    rev = "refs/tags/release-${version}";
+    hash = "sha256-37l6HrAKrXtEhlWTIdlw3L6wCGeOA7IW/aaJn3wf4QY=";
   };
 
-  nativeBuildInputs = [ cython pkg-config ];
+  nativeBuildInputs = [ cython pkg-config setuptools ];
 
   buildInputs = [ fuse ];
 
@@ -48,6 +51,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python bindings for the low-level FUSE API";
     homepage = "https://github.com/python-llfuse/python-llfuse";
+    changelog = "https://github.com/python-llfuse/python-llfuse/raw/release-${version}/Changes.rst";
     license = licenses.lgpl2Plus;
     platforms = platforms.unix;
     maintainers = with maintainers; [ bjornfor dotlambda ];
diff --git a/pkgs/development/python-modules/pyp/default.nix b/pkgs/development/python-modules/pyp/default.nix
index 74782267dbd7..b9bcb978be85 100644
--- a/pkgs/development/python-modules/pyp/default.nix
+++ b/pkgs/development/python-modules/pyp/default.nix
@@ -5,6 +5,7 @@
 , coreutils
 , pythonOlder
 , astunparse
+, flit-core
 , jq
 , bc
 }:
@@ -12,7 +13,7 @@
 buildPythonPackage rec {
   pname = "pyp";
   version = "1.1.0";
-  format = "setuptools";
+  format = "pyproject";
 
   disabled = pythonOlder "3.6";
 
@@ -23,6 +24,10 @@ buildPythonPackage rec {
     hash = "sha256-A1Ip41kxH17BakHEWEuymfa24eBEl5FIHAWL+iZFM4I=";
   };
 
+  nativeBuildInputs = [
+    flit-core
+  ];
+
   propagatedBuildInputs = lib.optionals (pythonOlder "3.9") [
     astunparse
   ];
diff --git a/pkgs/development/python-modules/pysml/default.nix b/pkgs/development/python-modules/pysml/default.nix
index 2719f2aef3a9..c27198a26ae1 100644
--- a/pkgs/development/python-modules/pysml/default.nix
+++ b/pkgs/development/python-modules/pysml/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "pysml";
-  version = "0.0.10";
+  version = "0.0.11";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "mtdcr";
     repo = pname;
     rev = version;
-    hash = "sha256-vC4iff38WCcdUQITPmxC0XlrA83zCNLTDGgyyXivLEY=";
+    hash = "sha256-RPDYh5h885/FiU2vsDpCGd8yWXNNIEpjAu6w8QXTxAA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/scikit-fuzzy/default.nix b/pkgs/development/python-modules/scikit-fuzzy/default.nix
index 6d44cf0a37c7..dbb5d2044e21 100644
--- a/pkgs/development/python-modules/scikit-fuzzy/default.nix
+++ b/pkgs/development/python-modules/scikit-fuzzy/default.nix
@@ -1,6 +1,6 @@
 { lib
 , buildPythonPackage
-, isPy27
+, pythonOlder
 , fetchFromGitHub
 , matplotlib
 , networkx
@@ -13,7 +13,9 @@
 buildPythonPackage rec {
   pname = "scikit-fuzzy";
   version = "unstable-2022-11-07";
-  disabled = isPy27;
+  format = "setuptools";
+
+  disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = pname;
@@ -25,6 +27,9 @@ buildPythonPackage rec {
   propagatedBuildInputs = [ networkx numpy scipy ];
   nativeCheckInputs = [ matplotlib nose pytestCheckHook ];
 
+  # numpy API breakage: "AttributeError: module 'numpy' has no attribute 'float'"
+  disabledTests = [ "test_fuzzy_compare" ];
+
   pythonImportsCheck = [ "skfuzzy" ];
 
   meta = with lib; {
diff --git a/pkgs/development/tools/gotools/default.nix b/pkgs/development/tools/gotools/default.nix
index e54df39b8bc1..167775e9eb2e 100644
--- a/pkgs/development/tools/gotools/default.nix
+++ b/pkgs/development/tools/gotools/default.nix
@@ -9,13 +9,16 @@ buildGoModule rec {
     owner = "golang";
     repo = "tools";
     rev = "v${version}";
+    sha256 = "sha256-z5XJ7tflOfDBtv4rp7WEjnHsXIyjNw205PhazEvaYcw=";
+  };
+
+  postPatch = ''
     # The gopls folder contains a Go submodule which causes a build failure
     # and lives in its own package named gopls.
-    postFetch = ''
-      rm -r $out/gopls
-    '';
-    sha256 = "sha256-6Sdo6oKJHYXWkvJmbte7Wc7tov5AHzn70Bi1QdQ5HR4=";
-  };
+    rm -r gopls
+    # getgo is an experimental go installer which adds generic named server and client binaries to $out/bin
+    rm -r cmd/getgo
+  '';
 
   vendorSha256 = "sha256-fp0pb3EcGRDWlSpgel4pYRdsPJGk8/d57EjWJ+fzq7g=";
 
diff --git a/pkgs/development/tools/misc/strace-analyzer/default.nix b/pkgs/development/tools/misc/strace-analyzer/default.nix
index a4de71138d9e..8670d9b2f8fe 100644
--- a/pkgs/development/tools/misc/strace-analyzer/default.nix
+++ b/pkgs/development/tools/misc/strace-analyzer/default.nix
@@ -2,6 +2,7 @@
 , rustPlatform
 , fetchFromGitHub
 , strace
+, stdenv
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -19,6 +20,11 @@ rustPlatform.buildRustPackage rec {
 
   nativeCheckInputs = [ strace ];
 
+  checkFlags = lib.optionals stdenv.isAarch64 [
+    # thread 'analysis::tests::analyze_dd' panicked at 'assertion failed: ...'
+    "--skip=analysis::tests::analyze_dd"
+  ];
+
   meta = with lib; {
     description = "Analyzes strace output";
     homepage = "https://github.com/wookietreiber/strace-analyzer";
diff --git a/pkgs/development/tools/rome/default.nix b/pkgs/development/tools/rome/default.nix
new file mode 100644
index 000000000000..9dd2b7067a0f
--- /dev/null
+++ b/pkgs/development/tools/rome/default.nix
@@ -0,0 +1,53 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, pkg-config
+, stdenv
+, darwin
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "rome";
+  version = "12.1.0";
+
+  src = fetchFromGitHub {
+    owner = "rome";
+    repo = "tools";
+    rev = "cli/v${version}";
+    hash = "sha256-XORu6c/9jrRObdM3qAGszhiUjo88NTzrTyrITuHyd/4=";
+  };
+
+  cargoHash = "sha256-75r280PMM1zDrqRmhuaU++5aZSCxeyqjHQls8pTzOgQ=";
+
+  cargoBuildFlags = [ "--package" "rome_cli" ];
+
+  env = {
+    RUSTFLAGS = "-C strip=symbols";
+    ROME_VERSION = "${version}";
+  };
+
+  buildInputs =
+    lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.Security ];
+
+  nativeBuildInputs = [ pkg-config ];
+
+  # need to manually unset the ROME_VERSION before checkPhase otherwise some tests fail
+  preCheck = ''
+    unset ROME_VERSION;
+  '';
+
+  # these test fail
+  checkFlags = [
+    "--skip parser::tests::uncompleted_markers_panic"
+    "--skip commands::check::fs_error_infinite_symlink_exapansion"
+    "--skip commands::check::fs_error_dereferenced_symlink"
+  ];
+
+  meta = with lib; {
+    description = "A formatter, linter, bundler, and more for JavaScript, TypeScript, JSON, HTML, Markdown, and CSS";
+    homepage = "https://rome.tools";
+    changelog = "https://github.com/rome/tools/blob/${src.rev}/CHANGELOG.md";
+    license = licenses.mit;
+    maintainers = with maintainers; [ dit7ya felschr ];
+  };
+}
diff --git a/pkgs/development/tools/rust/cargo-expand/default.nix b/pkgs/development/tools/rust/cargo-expand/default.nix
index 2cbf1e7f2a5f..ca3d800f3402 100644
--- a/pkgs/development/tools/rust/cargo-expand/default.nix
+++ b/pkgs/development/tools/rust/cargo-expand/default.nix
@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-expand";
-  version = "1.0.48";
+  version = "1.0.49";
 
   src = fetchFromGitHub {
     owner = "dtolnay";
     repo = pname;
     rev = version;
-    sha256 = "sha256-AdL14usCV4iHkrSHcNI6Jg8xeI3ZQxOABLCOCBd+Isw=";
+    sha256 = "sha256-bytGq95E8Ku+rF+al8WJdx991qudh3/sC9DxwluwmZc=";
   };
 
-  cargoHash = "sha256-7sMKstWRAXFqBaEBLbetGH0l+9N4PchZ4IYshjmtxns=";
+  cargoHash = "sha256-zIBTgIbUoUtQ4yboiW3jIprfNTOfFdg7sEgrwdMRsX8=";
 
   meta = with lib; {
     description = "A utility and Cargo subcommand designed to let people expand macros in their Rust source code";
diff --git a/pkgs/development/tools/wabt/default.nix b/pkgs/development/tools/wabt/default.nix
index 673c3dbbdad5..5c71762bd386 100644
--- a/pkgs/development/tools/wabt/default.nix
+++ b/pkgs/development/tools/wabt/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "wabt";
-  version = "1.0.32";
+  version = "1.0.33";
 
   src = fetchFromGitHub {
     owner = "WebAssembly";
     repo = "wabt";
     rev = version;
-    sha256 = "sha256-kLPs/9tQtvUEOGsLtnK0uqJnCWTHR6JU7BCwtFEmIlQ=";
+    sha256 = "sha256-zSgV+lrNpQcR+V6Icyf3cPMeAdRDfsL2EErF8pxev5c=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/games/fheroes2/default.nix b/pkgs/games/fheroes2/default.nix
index baa08a7dcd31..f61983a2c737 100644
--- a/pkgs/games/fheroes2/default.nix
+++ b/pkgs/games/fheroes2/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fheroes2";
-  version = "1.0.3";
+  version = "1.0.4";
 
   src = fetchFromGitHub {
     owner = "ihhub";
     repo = "fheroes2";
     rev = version;
-    sha256 = "sha256-msFuBKG/uuXxOcPf0KT3TWOiQrQ4rYHFxOcJ56QBkEU=";
+    sha256 = "sha256-+XlOx5gIQzYru2CwWKqTSdIlxuNfiUjDEsnvP6kDUYg=";
   };
 
   nativeBuildInputs = [ imagemagick ];
diff --git a/pkgs/os-specific/linux/kvdo/default.nix b/pkgs/os-specific/linux/kvdo/default.nix
index 7e7c765bd819..e2390b68a5ca 100644
--- a/pkgs/os-specific/linux/kvdo/default.nix
+++ b/pkgs/os-specific/linux/kvdo/default.nix
@@ -1,16 +1,19 @@
 { stdenv, lib, fetchFromGitHub, vdo, kernel }:
 
 stdenv.mkDerivation rec {
-  inherit (vdo) version;
+  inherit (vdo);
   pname = "kvdo";
+  version = "8.2.1.6"; # bump this version with vdo
 
   src = fetchFromGitHub {
     owner = "dm-vdo";
     repo = "kvdo";
     rev = version;
-    hash = "sha256-4FYTFUIvGjea3bh2GbQYG7hSswVDdNS3S+jWQ9+inpg=";
+    hash = "sha256-S5r2Rgx5pWk4IsdIwmfZkuGL/oEQ3prquyVqxjR3cO0=";
   };
 
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
   dontConfigure = true;
   enableParallelBuilding = true;
 
@@ -19,7 +22,7 @@ stdenv.mkDerivation rec {
 
   preBuild = ''
     makeFlags="$makeFlags -C ${KSRC} M=$(pwd)"
-'';
+  '';
   installTargets = [ "modules_install" ];
 
   meta = with lib; {
@@ -27,6 +30,6 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/dm-vdo/kvdo";
     description = "A pair of kernel modules which provide pools of deduplicated and/or compressed block storage";
     platforms = platforms.linux;
-    broken = kernel.kernelOlder "5.15" || kernel.kernelAtLeast "5.17";
+    broken = kernel.kernelOlder "5.15";
   };
 }
diff --git a/pkgs/os-specific/linux/vdo/default.nix b/pkgs/os-specific/linux/vdo/default.nix
index d9033e65876b..ec953d25ec1f 100644
--- a/pkgs/os-specific/linux/vdo/default.nix
+++ b/pkgs/os-specific/linux/vdo/default.nix
@@ -9,7 +9,7 @@
 
 stdenv.mkDerivation rec {
   pname = "vdo";
-  version = "8.2.0.2";  # kvdo uses this!
+  version = "8.2.0.2";  # bump this version with kvdo
 
   src = fetchFromGitHub {
     owner = "dm-vdo";
diff --git a/pkgs/servers/klipper/default.nix b/pkgs/servers/klipper/default.nix
index e8d572393e2b..a906059b1970 100644
--- a/pkgs/servers/klipper/default.nix
+++ b/pkgs/servers/klipper/default.nix
@@ -3,6 +3,7 @@
 , fetchFromGitHub
 , python3
 , unstableGitUpdater
+, makeWrapper
 }:
 
 stdenv.mkDerivation rec {
@@ -19,7 +20,10 @@ stdenv.mkDerivation rec {
   sourceRoot = "source/klippy";
 
   # NB: This is needed for the postBuild step
-  nativeBuildInputs = [ (python3.withPackages ( p: with p; [ cffi ] )) ];
+  nativeBuildInputs = [
+    (python3.withPackages ( p: with p; [ cffi ] ))
+    makeWrapper
+  ];
 
   buildInputs = [ (python3.withPackages (p: with p; [ cffi pyserial greenlet jinja2 markupsafe numpy ])) ];
 
@@ -49,7 +53,9 @@ stdenv.mkDerivation rec {
     cp -r $src/docs $out/lib/docs
     cp -r $src/config $out/lib/config
 
+    mkdir -p $out/bin
     chmod 755 $out/lib/klipper/klippy.py
+    makeWrapper $out/lib/klipper/klippy.py $out/bin/klippy --chdir $out/lib/klipper
     runHook postInstall
   '';
 
diff --git a/pkgs/servers/matrix-synapse/plugins/ldap3.nix b/pkgs/servers/matrix-synapse/plugins/ldap3.nix
index 22c187059cb9..b29dc21422e9 100644
--- a/pkgs/servers/matrix-synapse/plugins/ldap3.nix
+++ b/pkgs/servers/matrix-synapse/plugins/ldap3.nix
@@ -1,4 +1,15 @@
-{ lib, buildPythonPackage, fetchPypi, ldap3, ldaptor, matrix-synapse, pytestCheckHook, service-identity, setuptools, twisted }:
+{ lib
+, buildPythonPackage
+, fetchpatch
+, fetchPypi
+, ldap3
+, ldaptor
+, matrix-synapse
+, pytestCheckHook
+, service-identity
+, setuptools
+, twisted
+}:
 
 buildPythonPackage rec {
   pname = "matrix-synapse-ldap3";
@@ -10,6 +21,14 @@ buildPythonPackage rec {
     sha256 = "sha256-s4jZVpNIbu9pra79D9noRGPVL+F7AhSgDvyqZptzy3Q=";
   };
 
+  patches = [
+    # add support to read bind_password from file
+    (fetchpatch {
+      url = "https://github.com/matrix-org/matrix-synapse-ldap3/commit/c65e8cbd27a5cd935ce12e7c4b92143cdf795c86.patch";
+      sha256 = "sha256-0g150TW631cuupSRECXL9A261nj45HclDkHBUbKT7jE=";
+    })
+  ];
+
   nativeBuildInputs = [ setuptools ];
 
   propagatedBuildInputs = [ service-identity ldap3 twisted ];
@@ -22,6 +41,6 @@ buildPythonPackage rec {
     description = "LDAP3 auth provider for Synapse";
     homepage = "https://github.com/matrix-org/matrix-synapse-ldap3";
     license = licenses.asl20;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ ] ++ teams.c3d2.members;
   };
 }
diff --git a/pkgs/servers/monitoring/do-agent/default.nix b/pkgs/servers/monitoring/do-agent/default.nix
index 0ad3d46ed665..72abfecb725c 100644
--- a/pkgs/servers/monitoring/do-agent/default.nix
+++ b/pkgs/servers/monitoring/do-agent/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "do-agent";
-  version = "3.16.2";
+  version = "3.16.4";
 
   src = fetchFromGitHub {
     owner = "digitalocean";
     repo = "do-agent";
     rev = version;
-    sha256 = "sha256-glHrWRZqkKoCLy3nuOZQG98I35ZR4S9nL6XqBsa2rOQ=";
+    sha256 = "sha256-6pc8cbCRjZG1uPYTOBbQeRqVZ7YwFAapNzor2lqGuRE=";
   };
 
   ldflags = [
diff --git a/pkgs/tools/games/joystickwake/default.nix b/pkgs/tools/games/joystickwake/default.nix
index 203c58b8f619..9b2012857db2 100644
--- a/pkgs/tools/games/joystickwake/default.nix
+++ b/pkgs/tools/games/joystickwake/default.nix
@@ -1,13 +1,13 @@
 { lib, python3, fetchFromGitHub }:
 python3.pkgs.buildPythonApplication rec {
   pname = "joystickwake";
-  version = "0.4";
+  version = "0.4.1";
 
   src = fetchFromGitHub {
     owner = "foresto";
     repo = pname;
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-0rVVxaaAFHkmJeG3e181x7faTIeFwupplWepoyxc51g=";
+    sha256 = "sha256-qf1owRdBGyU3q9ZJAzDEcMlnHfeUMSXga4v6QXdxXO0=";
   };
 
   propagatedBuildInputs = with python3.pkgs; [ dbus-next pyudev xlib ];
diff --git a/pkgs/tools/misc/gotify-cli/default.nix b/pkgs/tools/misc/gotify-cli/default.nix
index a171ba43d6d5..296f3d19a88d 100644
--- a/pkgs/tools/misc/gotify-cli/default.nix
+++ b/pkgs/tools/misc/gotify-cli/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "gotify-cli";
-  version = "2.2.2";
+  version = "2.2.3";
 
   src = fetchFromGitHub {
     owner = "gotify";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "sha256-dkG2dzt2PvIio+1/yx8Ihui6WjwvbBHlhJcoXADZBl4=";
+    sha256 = "sha256-mOIomHNA20gKU7uh2Sf4NqqLNjNnD5hgOTUu9DuduiI=";
   };
 
-  vendorSha256 = "sha256-0Utc1rGaFpDXhxMZ8bwMCYbfAyqNiQKtyqZMdhBujMs=";
+  vendorHash = "sha256-ObJfUIy2GwogFm2/uCmShEXnIxDTqWWXCZPu9KJVFOA=";
 
   postInstall = ''
     mv $out/bin/cli $out/bin/gotify
diff --git a/pkgs/tools/misc/opentelemetry-collector/contrib.nix b/pkgs/tools/misc/opentelemetry-collector/contrib.nix
index 93b2fde32a29..7778ca59c89c 100644
--- a/pkgs/tools/misc/opentelemetry-collector/contrib.nix
+++ b/pkgs/tools/misc/opentelemetry-collector/contrib.nix
@@ -8,17 +8,17 @@
 
 buildGoModule rec {
   pname = "opentelemetry-collector-contrib";
-  version = "0.76.1";
+  version = "0.77.0";
 
   src = fetchFromGitHub {
     owner = "open-telemetry";
     repo = "opentelemetry-collector-contrib";
     rev = "v${version}";
-    sha256 = "sha256-Aeiq9IJReUxJUpeq5mSReK5foC5aY4fMSZli0ZUjYPc=";
+    sha256 = "sha256-9OFNJgzMiTNRXuK4joPxnVfCI5mVGqgfKBGI1xpnhCY=";
   };
   # proxy vendor to avoid hash missmatches between linux and macOS
   proxyVendor = true;
-  vendorSha256 = "sha256-vLbx/qmSZuteuvChnyA/wcEcIjU3zWkxSjfk8VBdgU4=";
+  vendorHash = "sha256-1an0PB2CV83DDWcw+1irT2gFLKuMkXYok5uglyyrprs=";
 
   # there is a nested go.mod
   sourceRoot = "source/cmd/otelcontribcol";
diff --git a/pkgs/tools/misc/trashy/default.nix b/pkgs/tools/misc/trashy/default.nix
index edaf1893f326..cc985b8f3b35 100644
--- a/pkgs/tools/misc/trashy/default.nix
+++ b/pkgs/tools/misc/trashy/default.nix
@@ -27,5 +27,7 @@ rustPlatform.buildRustPackage rec {
     license = with licenses; [ asl20 /* or */ mit ];
     maintainers = with maintainers; [ oberblastmeister ];
     mainProgram = "trash";
+    # darwin is unsupported due to https://github.com/Byron/trash-rs/issues/8
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/tools/misc/twitch-dl/default.nix b/pkgs/tools/misc/twitch-dl/default.nix
new file mode 100644
index 000000000000..dd24c1c64447
--- /dev/null
+++ b/pkgs/tools/misc/twitch-dl/default.nix
@@ -0,0 +1,54 @@
+{ lib
+, fetchFromGitHub
+, python3Packages
+, ffmpeg
+, installShellFiles
+, scdoc
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "twitch-dl";
+  version = "2.1.3";
+
+  format = "setuptools";
+
+  src = fetchFromGitHub {
+    owner = "ihabunek";
+    repo = "twitch-dl";
+    rev = "refs/tags/${version}";
+    hash = "sha256-uxIBt/mGmld8bxUWQvAspaX39EVfguX5qDgJ/ecz3hM=";
+  };
+
+  nativeCheckInputs = [
+    installShellFiles
+    python3Packages.pytestCheckHook
+    scdoc
+  ];
+
+  propagatedBuildInputs = with python3Packages; [
+    httpx
+    m3u8
+  ];
+
+  disabledTestPaths = [
+    # Requires network access
+    "tests/test_api.py"
+  ];
+
+  pythonImportsCheck = [
+    "twitchdl"
+  ];
+
+  postInstall = ''
+    scdoc < twitch-dl.1.scd > twitch-dl.1
+    installManPage twitch-dl.1
+  '';
+
+  meta = with lib; {
+    description = "CLI tool for downloading videos from Twitch";
+    homepage = "https://github.com/ihabunek/twitch-dl";
+    changelog = "https://github.com/ihabunek/twitch-dl/blob/${version}/CHANGELOG.md";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ marsam ];
+  };
+}
diff --git a/pkgs/tools/security/coercer/default.nix b/pkgs/tools/security/coercer/default.nix
index 0e48d4ac23d0..3d1e6cb46963 100644
--- a/pkgs/tools/security/coercer/default.nix
+++ b/pkgs/tools/security/coercer/default.nix
@@ -27,6 +27,12 @@ python3.pkgs.buildPythonApplication rec {
     "coercer"
   ];
 
+  # this file runs into issues on case-insensitive filesystems
+  # ValueError: Both <...>/coercer and <...>/coercer.py exist
+  postPatch = ''
+    rm Coercer.py
+  '';
+
   meta = with lib; {
     description = "Tool to automatically coerce a Windows server";
     homepage = "https://github.com/p0dalirius/Coercer";
diff --git a/pkgs/tools/security/vault/vault-bin.nix b/pkgs/tools/security/vault/vault-bin.nix
index 7827393263a5..a5484339b46d 100644
--- a/pkgs/tools/security/vault/vault-bin.nix
+++ b/pkgs/tools/security/vault/vault-bin.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "vault-bin";
-  version = "1.13.1";
+  version = "1.13.2";
 
   src =
     let
@@ -16,11 +16,11 @@ stdenv.mkDerivation rec {
         aarch64-darwin = "darwin_arm64";
       };
       sha256 = selectSystem {
-        x86_64-linux = "sha256-BTJPXC5MEfNopJv1p0ONduVLrYza+0SfUcmN805JLPo=";
-        aarch64-linux = "sha256-p9TgSqPVgR7Qxu1WEuwawzbBDNznGfPGasZK8/jN7vk=";
-        i686-linux = "sha256-EbHH5Ud1c5YbcQ3qXhWEiaxx4XuslRntOLkxcf8elz8=";
-        x86_64-darwin = "sha256-JiwF8/ZBbFGqhcYP4z5aPya61+2J5HG9vEYKEDAIuC0=";
-        aarch64-darwin = "sha256-BgqqKqrqZiBSQwkMpWndiRhRq6+rR3e1IcPik5ZxCg4=";
+        x86_64-linux = "sha256-RVqhObAw1M4zNK5cXzbD+cbITtsUPBXoc7O7zqVRJhI=";
+        aarch64-linux = "sha256-WLw6GKNZc5a7HGTAI4kzsel8N9EwoTWda7Z05pXNeDA=";
+        i686-linux = "sha256-v1f5yDrarKmWFtL9fIr03H5tH/bDi83XVYsTnLgLq5Q=";
+        x86_64-darwin = "sha256-f1f6KFgr/A62PxEZEzzkNkQF4YI/xISYKVczcXn3r0k=";
+        aarch64-darwin = "sha256-TQ9Wi6rBXWCYBkkvCyoMMbRiUOEBykvbwp6hdqUUO4I=";
       };
     in
     fetchzip {
diff --git a/pkgs/tools/virtualization/google-guest-agent/default.nix b/pkgs/tools/virtualization/google-guest-agent/default.nix
index 664f9405500f..2a796534d35d 100644
--- a/pkgs/tools/virtualization/google-guest-agent/default.nix
+++ b/pkgs/tools/virtualization/google-guest-agent/default.nix
@@ -4,16 +4,16 @@
 
 buildGoModule rec {
   pname = "guest-agent";
-  version = "20230221.00";
+  version = "20230510.00";
 
   src = fetchFromGitHub {
     owner = "GoogleCloudPlatform";
     repo = pname;
     rev = version;
-    sha256 = "sha256-AObN9vyEMJeGBmAMyUz7H0pHPtGf5I/oeDzYuZs4KpE=";
+    sha256 = "sha256-gYmmQzSFP/Ik4m+iYHJZyUyZil9+IXWZ3p0Pl58Uq40=";
   };
 
-  vendorHash = "sha256-ioejOtmsi0QnID3V5JxwAz399I5Jp5nHZqpzU9DjpQE=";
+  vendorHash = "sha256-ULGpgygBVC4SRLhPiUlZgBH93w84WlNbvq3S7cVHLaQ=";
 
   patches = [ ./disable-etc-mutation.patch ];
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index d54f41564b4e..e655f8b03bb5 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -5222,6 +5222,8 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) Security;
   };
 
+  klipperscreen = callPackage ../applications/misc/klipperscreen { };
+
   klog = qt5.callPackage ../applications/radio/klog { };
 
   komga = callPackage ../servers/komga { };
@@ -9503,6 +9505,8 @@ with pkgs;
 
   jbofihe = callPackage ../tools/text/jbofihe { };
 
+  jbrowse = callPackage ../applications/science/biology/jbrowse { };
+
   jumanpp = callPackage ../tools/text/jumanpp { };
 
   jump = callPackage ../tools/system/jump { };
@@ -13177,6 +13181,8 @@ with pkgs;
 
   twitch-chat-downloader = python3Packages.callPackage ../applications/misc/twitch-chat-downloader { };
 
+  twitch-dl = callPackage ../tools/misc/twitch-dl { };
+
   twitterBootstrap = callPackage ../development/web/twitter-bootstrap { };
 
   twspace-crawler = callPackage ../tools/misc/twspace-crawler { };
@@ -19003,6 +19009,8 @@ with pkgs;
 
   rolespec = callPackage ../development/tools/misc/rolespec { };
 
+  rome = callPackage ../development/tools/rome { };
+
   rr = callPackage ../development/tools/analysis/rr { };
 
   rsass = callPackage ../development/tools/misc/rsass { };
@@ -19208,6 +19216,10 @@ with pkgs;
 
   c2ffi = callPackage ../development/tools/misc/c2ffi { };
 
+  c0 = callPackage ../development/compilers/c0 {
+    stdenv = if stdenv.isDarwin then gccStdenv else stdenv;
+  };
+
   c3c = callPackage ../development/compilers/c3c { };
 
   swfmill = callPackage ../tools/video/swfmill { stdenv = gcc10StdenvCompat; };
@@ -34352,9 +34364,7 @@ with pkgs;
 
   ticker = callPackage ../applications/misc/ticker { };
 
-  tickrs = callPackage ../applications/misc/tickrs {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  tickrs = callPackage ../applications/misc/tickrs { };
 
   tilemaker = callPackage ../applications/misc/tilemaker { };
 
@@ -39028,6 +39038,10 @@ with pkgs;
                   then configuration
                   else [configuration]
                 );
+
+                # The system is inherited from the current pkgs above.
+                # Set it to null, to remove the "legacy" entrypoint's non-hermetic default.
+                system = null;
             };
       in
         c.config.system.build // c;
@@ -39208,6 +39222,8 @@ with pkgs;
 
   resp-app = libsForQt5.callPackage ../applications/misc/resp-app { };
 
+  resumed = callPackage ../applications/misc/resumed { };
+
   robin-map = callPackage ../development/libraries/robin-map { };
 
   robo3t = callPackage ../applications/misc/robo3t { };