diff --git a/nixos/modules/hardware/opengl.nix b/nixos/modules/hardware/opengl.nix
index c4b93db22bef..7b5e669d47f4 100644
--- a/nixos/modules/hardware/opengl.nix
+++ b/nixos/modules/hardware/opengl.nix
@@ -90,8 +90,8 @@ in
 
       mesaPackage = mkOption {
         type = types.package;
-        default = pkgs.mesa_23;
-        defaultText = literalExpression "pkgs.mesa_23";
+        default = pkgs.mesa;
+        defaultText = literalExpression "pkgs.mesa";
         example = literalExpression "pkgs.mesa_22";
         description = lib.mdDoc ''
           The Mesa driver package used for rendering support on the system.
@@ -103,8 +103,8 @@ in
       };
       mesaPackage32 = mkOption {
         type = types.package;
-        default = pkgs.pkgsi686Linux.mesa_23;
-        defaultText = literalExpression "pkgs.pkgsi686Linux.mesa_23";
+        default = pkgs.pkgsi686Linux.mesa;
+        defaultText = literalExpression "pkgs.pkgsi686Linux.mesa";
         example = literalExpression "pkgs.pkgsi686Linux.mesa_22";
         description = lib.mdDoc ''
           Same as {option}`mesaPackage` but for the 32-bit Mesa on 64-bit
diff --git a/pkgs/applications/misc/holochain-launcher/default.nix b/pkgs/applications/misc/holochain-launcher/default.nix
index 2173c12461c3..f4989b2c3f03 100644
--- a/pkgs/applications/misc/holochain-launcher/default.nix
+++ b/pkgs/applications/misc/holochain-launcher/default.nix
@@ -12,11 +12,11 @@
 
 stdenv.mkDerivation rec {
   name = "holochain-launcher";
-  version = "0.9.2";
+  version = "0.9.3";
 
   src = fetchurl {
     url = "https://github.com/holochain/launcher/releases/download/v${version}/holochain-launcher_${version}_amd64.deb";
-    sha256 = "sha256-ipcv1rP4DDjBEybmntsfw2ubjCgm1cGDlYM7sN0jeVo=";
+    sha256 = "sha256-hvnOB6cTL+VffwtBulrEzujxVZEQMSDoJx2HjivJ9z8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/keyleds/default.nix b/pkgs/applications/misc/keyleds/default.nix
new file mode 100644
index 000000000000..c48b30b34dc9
--- /dev/null
+++ b/pkgs/applications/misc/keyleds/default.nix
@@ -0,0 +1,66 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, fetchpatch
+, cmake
+, pkg-config
+, libuv
+, libX11
+, libXi
+, libyaml
+, luajit
+, udev
+}:
+
+stdenv.mkDerivation rec {
+  pname = "keyleds";
+  version = "unstable-2021-04-08";
+
+  src = fetchFromGitHub {
+    owner = "keyleds";
+    repo = pname;
+    rev = "171361654a64b570d747c2d196acb2da4b8dc293";
+    sha256 = "sha256-mojgHMT0gni0Po0hiZqQ8eMzqfwUipXue1uqpionihw=";
+  };
+
+  # This commit corresponds to the following open PR:
+  # https://github.com/keyleds/keyleds/pull/74
+  # According to the author of the PR, the maintainer of keyleds is unreachable.
+  # This patch fixes the build process which is broken on the current master branch of keyleds.
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/keyleds/keyleds/commit/bffed5eb181127df915002b6ed830f85f15feafd.patch";
+      sha256 = "sha256-i2N3D/K++34JVqJloNK2UcN473NarIjdjAz6PUhXcNY=";
+    })
+  ];
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
+
+  buildInputs = [
+    libuv
+    libX11
+    libXi
+    libyaml
+    luajit
+    udev
+  ];
+
+  enableParallelBuilding = true;
+
+  cmakeFlags = [
+    "-DCMAKE_BUILD_TYPE=MinSizeRel"
+  ];
+
+  meta = {
+    homepage = "https://github.com/keyleds/keyleds";
+    description = "Advanced RGB animation service for Logitech keyboards";
+    license = lib.licenses.gpl3;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+  };
+}
diff --git a/pkgs/applications/misc/yewtube/default.nix b/pkgs/applications/misc/yewtube/default.nix
index 13dabe296b3d..6f56dd8ff4e0 100644
--- a/pkgs/applications/misc/yewtube/default.nix
+++ b/pkgs/applications/misc/yewtube/default.nix
@@ -2,13 +2,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "yewtube";
-  version = "2.10.1";
+  version = "2.10.2";
 
   src = fetchFromGitHub {
     owner = "mps-youtube";
     repo = "yewtube";
     rev = "refs/tags/v${version}";
-    hash = "sha256-1qYHgMp9OZQuKDycvVwp0ADvF8xNY668JvRMVIE/dko=";
+    hash = "sha256-yqztce6t7VTtrumxbhbikYY54FiyUaegBPYSnF4wTkU=";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/networking/cluster/argocd/default.nix b/pkgs/applications/networking/cluster/argocd/default.nix
index b955f2ebdf63..f14201eab038 100644
--- a/pkgs/applications/networking/cluster/argocd/default.nix
+++ b/pkgs/applications/networking/cluster/argocd/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "argocd";
-  version = "2.6.5";
+  version = "2.6.7";
 
   src = fetchFromGitHub {
     owner = "argoproj";
     repo = "argo-cd";
     rev = "v${version}";
-    sha256 = "sha256-+3d20bD2sxck8fCrMv6Z9O70g7iWdHA5FdFVoLDtY2k=";
+    sha256 = "sha256-KvnKz+NxCiCqX/lDsm4YdrUmtK028D9KM9Ke9mxiZQw=";
   };
 
   proxyVendor = true; # darwin/linux hash mismatch
diff --git a/pkgs/applications/science/astronomy/calcmysky/default.nix b/pkgs/applications/science/astronomy/calcmysky/default.nix
index 3b66284e8b0c..bcbc90fa3717 100644
--- a/pkgs/applications/science/astronomy/calcmysky/default.nix
+++ b/pkgs/applications/science/astronomy/calcmysky/default.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "calcmysky";
-  version = "0.2.1";
+  version = "unstable-2023-02-11";
 
   src = fetchFromGitHub {
     owner = "10110111";
     repo = "CalcMySky";
-    rev = "v${version}";
-    hash = "sha256-7Yj6OlZ7weenekXYGhK5EWcME20oCHiLPOxz5KEuKy4=";
+    rev = "c5f281452816d8de775b13a70fb90e79427c93c4";
+    hash = "sha256-mzxtu6YTaZpR17m2WGiSDo/bAPXGJdQskyz7aqtxGoQ=";
   };
 
   nativeBuildInputs = [ cmake wrapQtAppsHook ];
diff --git a/pkgs/applications/science/astronomy/stellarium/default.nix b/pkgs/applications/science/astronomy/stellarium/default.nix
index 89ba8bf0e9d9..c3880b0b1d2b 100644
--- a/pkgs/applications/science/astronomy/stellarium/default.nix
+++ b/pkgs/applications/science/astronomy/stellarium/default.nix
@@ -21,13 +21,13 @@
 
 stdenv.mkDerivation rec {
   pname = "stellarium";
-  version = "1.2";
+  version = "23.1";
 
   src = fetchFromGitHub {
     owner = "Stellarium";
     repo = "stellarium";
     rev = "v${version}";
-    sha256 = "sha256-0/ZSe6QfM2zVsqcbyqefl9hiuex72KPxJvVMRNCnpZg=";
+    hash = "sha256-7jzS3pRklPsCTgCr3nrywfHCNlBDHuyuGGvrVoI9+A0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/science/logic/coq/default.nix b/pkgs/applications/science/logic/coq/default.nix
index 3740d4e39268..81fab07ecbf8 100644
--- a/pkgs/applications/science/logic/coq/default.nix
+++ b/pkgs/applications/science/logic/coq/default.nix
@@ -53,7 +53,7 @@ let
    "8.15.2".sha256     = "sha256:0qibbvzrhsvs6w3zpkhyclndp29jnr6bs9i5skjlpp431jdjjfqd";
    "8.16.0".sha256   = "sha256-3V6kL9j2rn5FHBxq1mtmWWTZS9X5cAyvtUsS6DaM+is=";
    "8.16.1".sha256   = "sha256-n7830+zfZeyYHEOGdUo57bH6bb2/SZs8zv8xJhV+iAc=";
-   "8.17+rc1".sha256   = "sha256-BsVgYa2fAYqRmQNSaY/YSiZhqkmwM+xbE5T4FHOEqkc=";
+   "8.17.0".sha256   = "sha256-TGwm7S6+vkeZ8cidvp8pkiAd9tk008jvvPvYgfEOXhM=";
   };
   releaseRev = v: "V${v}";
   fetched = import ../../../../build-support/coq/meta-fetch/default.nix
diff --git a/pkgs/applications/virtualization/podman/default.nix b/pkgs/applications/virtualization/podman/default.nix
index 8298469e1d98..52a20bb57f20 100644
--- a/pkgs/applications/virtualization/podman/default.nix
+++ b/pkgs/applications/virtualization/podman/default.nix
@@ -61,13 +61,13 @@ let
 in
 buildGoModule rec {
   pname = "podman";
-  version = "4.4.3";
+  version = "4.4.4";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "podman";
     rev = "v${version}";
-    hash = "sha256-s0aGZN4rnyyNLoO3nnAO7KbeD7MYxE9VMOHrQsKGNBk=";
+    hash = "sha256-rLXq+sveSxeoD3gyXSnfgGFx6alOBKSRCdDHGwwvPm4=";
   };
 
   patches = [
diff --git a/pkgs/applications/virtualization/vmware-workstation/default.nix b/pkgs/applications/virtualization/vmware-workstation/default.nix
index 6bcd15dc52ff..035fc9ceb2d0 100755
--- a/pkgs/applications/virtualization/vmware-workstation/default.nix
+++ b/pkgs/applications/virtualization/vmware-workstation/default.nix
@@ -16,6 +16,7 @@
 , vulkan-loader
 , alsa-lib
 , libpulseaudio
+, libxcrypt-legacy
 , libGL
 , numactl
 , libX11
@@ -86,6 +87,7 @@ stdenv.mkDerivation rec {
     vulkan-loader
     alsa-lib
     libpulseaudio
+    libxcrypt-legacy
     libGL
     numactl
     libX11
diff --git a/pkgs/desktops/deepin/apps/deepin-clone/default.nix b/pkgs/desktops/deepin/apps/deepin-clone/default.nix
new file mode 100644
index 000000000000..9252224488ee
--- /dev/null
+++ b/pkgs/desktops/deepin/apps/deepin-clone/default.nix
@@ -0,0 +1,77 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, cmake
+, qttools
+, pkg-config
+, qtbase
+, wrapQtAppsHook
+, dtkwidget
+, qt5integration
+, qt5platform-plugins
+, libuuid
+, parted
+, partclone
+}:
+
+stdenv.mkDerivation rec {
+  pname = "deepin-clone";
+  version = "5.0.11";
+
+  src = fetchFromGitHub {
+    owner = "linuxdeepin";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-ZOJc8R82R9q87Qpf/J4CXE+xL6nvbsXRIs0boNY+2uk=";
+  };
+
+  postPatch = ''
+    substituteInPlace app/{deepin-clone-ionice,deepin-clone-pkexec,deepin-clone.desktop,com.deepin.pkexec.deepin-clone.policy.tmp} \
+      --replace "/usr" "$out"
+
+    substituteInPlace app/src/corelib/ddevicediskinfo.cpp \
+      --replace "/sbin/blkid" "${libuuid}/bin/blkid"
+
+    substituteInPlace app/src/corelib/helper.cpp \
+      --replace "/bin/lsblk" "${libuuid}/bin/lsblk" \
+      --replace "/sbin/sfdisk" "${libuuid}/bin/sfdisk" \
+      --replace "/sbin/partprobe" "${parted}/bin/partprobe" \
+      --replace "/usr/sbin" "${partclone}/bin"
+  '';
+
+  nativeBuildInputs = [
+    cmake
+    qttools
+    pkg-config
+    wrapQtAppsHook
+  ];
+
+  buildInputs = [
+    qtbase
+    dtkwidget
+    qt5platform-plugins
+    libuuid
+    parted
+    partclone
+  ];
+
+  cmakeFlags = [
+    "-DDISABLE_DFM_PLUGIN=YES"
+  ];
+
+  strictDeps = true;
+
+  # qt5integration must be placed before qtsvg in QT_PLUGIN_PATH
+  qtWrapperArgs = [
+    "--prefix QT_PLUGIN_PATH : ${qt5integration}/${qtbase.qtPluginPrefix}"
+  ];
+
+  meta = with lib; {
+    description = "Disk and partition backup/restore tool";
+    homepage = "https://github.com/linuxdeepin/deepin-clone";
+    license = licenses.gpl3Plus;
+    platforms = platforms.linux;
+    maintainers = teams.deepin.members;
+  };
+}
+
diff --git a/pkgs/desktops/deepin/default.nix b/pkgs/desktops/deepin/default.nix
index 96c3d08b65dc..1c3d8db8a026 100644
--- a/pkgs/desktops/deepin/default.nix
+++ b/pkgs/desktops/deepin/default.nix
@@ -39,6 +39,7 @@ let
     deepin-calculator = callPackage ./apps/deepin-calculator { };
     deepin-camera = callPackage ./apps/deepin-camera { };
     deepin-compressor = callPackage ./apps/deepin-compressor { };
+    deepin-clone = callPackage ./apps/deepin-clone { };
     deepin-draw = callPackage ./apps/deepin-draw { };
     deepin-editor = callPackage ./apps/deepin-editor { };
     deepin-image-viewer = callPackage ./apps/deepin-image-viewer { };
diff --git a/pkgs/development/compilers/bluespec/default.nix b/pkgs/development/compilers/bluespec/default.nix
index 4970d02e32c1..6637b769dd65 100644
--- a/pkgs/development/compilers/bluespec/default.nix
+++ b/pkgs/development/compilers/bluespec/default.nix
@@ -28,18 +28,18 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "bluespec";
-  version = "2022.01";
+  version = "2023.01";
 
   src = fetchFromGitHub {
     owner = "B-Lang-org";
     repo = "bsc";
     rev = version;
-    sha256 = "sha256-ivTua3MLa8akma3MGkhsqwSdwswYX916kywKdlj7TqY=";
+    sha256 = "sha256-kFHQtRaQmZiHo+IQ+mwbW23i3kbdAh/XH0OE7P/ibd0=";
   };
 
   yices-src = fetchurl {
     url = "https://github.com/B-Lang-org/bsc/releases/download/${version}/yices-src-for-bsc-${version}.tar.gz";
-    sha256 = "sha256-ey5yIIVFZyG4EnYGqbIJqmxK1rZ70FWM0Jz+2hIoGXE=";
+    sha256 = "sha256-pyEdCJvmgwOYPMZEtw7aro76tSn/Y/2GcKTyARmIh4E=";
   };
 
   enableParallelBuilding = true;
@@ -50,8 +50,7 @@ in stdenv.mkDerivation rec {
   patches = [ ./libstp_stub_makefile.patch ];
 
   postUnpack = ''
-    mkdir -p $sourceRoot/src/vendor/yices/v2.6/yices2
-    tar -C $sourceRoot/src/vendor/yices/v2.6/yices2 -xf ${yices-src}
+    tar -C $sourceRoot/ -xf ${yices-src}
     chmod -R +rwX $sourceRoot/src/vendor/yices/v2.6/yices2
   '';
 
@@ -94,7 +93,7 @@ in stdenv.mkDerivation rec {
 
   makeFlags = [
     "release"
-    "NO_DEPS_CHECKS=1" # skip the subrepo check (this deriviation uses yices.src instead of the subrepo)
+    "NO_DEPS_CHECKS=1" # skip the subrepo check (this deriviation uses yices-src instead of the subrepo)
     "NOGIT=1" # https://github.com/B-Lang-org/bsc/issues/12
     "LDCONFIG=ldconfig" # https://github.com/B-Lang-org/bsc/pull/43
     "STP_STUB=1"
diff --git a/pkgs/development/ocaml-modules/asn1-combinators/default.nix b/pkgs/development/ocaml-modules/asn1-combinators/default.nix
index 8447c25cd707..a8e8a9cc847f 100644
--- a/pkgs/development/ocaml-modules/asn1-combinators/default.nix
+++ b/pkgs/development/ocaml-modules/asn1-combinators/default.nix
@@ -4,6 +4,7 @@
 
 buildDunePackage rec {
   minimalOCamlVersion = "4.08";
+  duneVersion = "3";
 
   pname = "asn1-combinators";
   version = "0.2.6";
diff --git a/pkgs/development/ocaml-modules/awa/default.nix b/pkgs/development/ocaml-modules/awa/default.nix
index e8ff5df1a9e5..6b52ddf01f1a 100644
--- a/pkgs/development/ocaml-modules/awa/default.nix
+++ b/pkgs/development/ocaml-modules/awa/default.nix
@@ -8,14 +8,14 @@
 
 buildDunePackage rec {
   pname = "awa";
-  version = "0.1.2";
+  version = "0.2.0";
 
   minimalOCamlVersion = "4.08";
   duneVersion = "3";
 
   src = fetchurl {
     url = "https://github.com/mirage/awa-ssh/releases/download/v${version}/awa-${version}.tbz";
-    hash = "sha256-HfIqvmvmdizPSfSHthj2syszVZXVhju7tI8yNEetc38=";
+    hash = "sha256-hsmTuoubBdsEyGe8zmfG7JihY0LFM4lErpPKUVobIX8=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/ocaml-modules/bistro/default.nix b/pkgs/development/ocaml-modules/bistro/default.nix
index 192bb470a66d..8f84a973bf0f 100644
--- a/pkgs/development/ocaml-modules/bistro/default.nix
+++ b/pkgs/development/ocaml-modules/bistro/default.nix
@@ -7,7 +7,7 @@
 , bos
 , core
 , core_kernel
-, core_unix
+, core_unix ? null
 , lwt_react
 , ocamlgraph
 , ppx_sexp_conv
diff --git a/pkgs/development/ocaml-modules/bls12-381/default.nix b/pkgs/development/ocaml-modules/bls12-381/default.nix
index 8330ce3e2bc3..20b2cd66a758 100644
--- a/pkgs/development/ocaml-modules/bls12-381/default.nix
+++ b/pkgs/development/ocaml-modules/bls12-381/default.nix
@@ -1,5 +1,8 @@
 { lib, buildDunePackage, fetchFromGitLab
-, ff-sig, zarith, zarith_stubs_js, integers_stubs_js, integers, hex
+, ff-sig, zarith
+, zarith_stubs_js ? null
+, integers_stubs_js
+, integers, hex
 , alcotest, ff-pbt
 }:
 
diff --git a/pkgs/development/ocaml-modules/callipyge/default.nix b/pkgs/development/ocaml-modules/callipyge/default.nix
index 2004f8868caf..68ba880a7987 100644
--- a/pkgs/development/ocaml-modules/callipyge/default.nix
+++ b/pkgs/development/ocaml-modules/callipyge/default.nix
@@ -1,8 +1,6 @@
 { lib
 , buildDunePackage
 , fetchurl
-, ocaml
-
 , alcotest
 , eqaf
 , fmt
@@ -14,17 +12,16 @@ buildDunePackage rec {
 
   src = fetchurl {
     url = "https://github.com/oklm-wsh/Callipyge/releases/download/v${version}/${pname}-${version}.tbz";
-    sha256 = "sha256-T/94a88xvK51TggjXecdKc9kyTE9aIyueIt5T24sZB0=";
+    hash = "sha256-T/94a88xvK51TggjXecdKc9kyTE9aIyueIt5T24sZB0=";
   };
 
-  useDune2 = true;
+  duneVersion = "3";
 
-  minimumOCamlVersion = "4.03";
+  minimalOCamlVersion = "4.08";
 
   propagatedBuildInputs = [ fmt eqaf ];
 
-  # alcotest isn't available for OCaml < 4.08 due to fmt
-  doCheck = lib.versionAtLeast ocaml.version "4.08";
+  doCheck = true;
   checkInputs = [ alcotest ];
 
   meta = {
diff --git a/pkgs/development/ocaml-modules/cohttp/async.nix b/pkgs/development/ocaml-modules/cohttp/async.nix
index 3e6ac4ae2d96..3236d4775070 100644
--- a/pkgs/development/ocaml-modules/cohttp/async.nix
+++ b/pkgs/development/ocaml-modules/cohttp/async.nix
@@ -7,7 +7,7 @@
 , async_unix
 , cohttp
 , conduit-async
-, core_unix
+, core_unix ? null
 , uri
 , uri-sexp
 , logs
diff --git a/pkgs/development/ocaml-modules/cstruct/async.nix b/pkgs/development/ocaml-modules/cstruct/async.nix
index 57647c97c416..1fe020f6490b 100644
--- a/pkgs/development/ocaml-modules/cstruct/async.nix
+++ b/pkgs/development/ocaml-modules/cstruct/async.nix
@@ -4,6 +4,8 @@ buildDunePackage rec {
   pname = "cstruct-async";
   inherit (cstruct) src version meta;
 
+  duneVersion = "3";
+
   propagatedBuildInputs = [
     async_unix
     async
diff --git a/pkgs/development/ocaml-modules/cstruct/default.nix b/pkgs/development/ocaml-modules/cstruct/default.nix
index 9efe75af70c9..9877adbcf81a 100644
--- a/pkgs/development/ocaml-modules/cstruct/default.nix
+++ b/pkgs/development/ocaml-modules/cstruct/default.nix
@@ -2,13 +2,14 @@
 
 buildDunePackage rec {
   pname = "cstruct";
-  version = "6.1.1";
+  version = "6.2.0";
 
   minimalOCamlVersion = "4.08";
+  duneVersion = "3";
 
   src = fetchurl {
     url = "https://github.com/mirage/ocaml-cstruct/releases/download/v${version}/cstruct-${version}.tbz";
-    sha256 = "sha256-G3T5hw9qfuYAiSRZBxbdUzpyijyhC7GNqf6ovkZ/UY0=";
+    hash = "sha256-mngHM5JYDoNJFI+jq0sbLpidydMNB0AbBMlrfGDwPmI=";
   };
 
   buildInputs = [ fmt ];
diff --git a/pkgs/development/ocaml-modules/cstruct/lwt.nix b/pkgs/development/ocaml-modules/cstruct/lwt.nix
index 7226193565b1..3aa70e5c9986 100644
--- a/pkgs/development/ocaml-modules/cstruct/lwt.nix
+++ b/pkgs/development/ocaml-modules/cstruct/lwt.nix
@@ -9,6 +9,7 @@ else
     inherit (cstruct) version src meta;
 
     minimalOCamlVersion = "4.08";
+    duneVersion = "3";
 
     propagatedBuildInputs = [ cstruct lwt ];
   }
diff --git a/pkgs/development/ocaml-modules/cstruct/ppx.nix b/pkgs/development/ocaml-modules/cstruct/ppx.nix
index b640c9745f3b..f2b19355b099 100644
--- a/pkgs/development/ocaml-modules/cstruct/ppx.nix
+++ b/pkgs/development/ocaml-modules/cstruct/ppx.nix
@@ -11,6 +11,7 @@ else
     inherit (cstruct) version src meta;
 
     minimalOCamlVersion = "4.08";
+    duneVersion = "3";
 
     propagatedBuildInputs = [ cstruct ppxlib sexplib stdlib-shims ];
 
diff --git a/pkgs/development/ocaml-modules/cstruct/sexp.nix b/pkgs/development/ocaml-modules/cstruct/sexp.nix
index a20911cbb299..3b28cda15afc 100644
--- a/pkgs/development/ocaml-modules/cstruct/sexp.nix
+++ b/pkgs/development/ocaml-modules/cstruct/sexp.nix
@@ -9,6 +9,7 @@ buildDunePackage rec {
   inherit (cstruct) version src meta;
 
   minimalOCamlVersion = "4.08";
+  duneVersion = "3";
 
   doCheck = true;
   checkInputs = [ alcotest ];
diff --git a/pkgs/development/ocaml-modules/cstruct/unix.nix b/pkgs/development/ocaml-modules/cstruct/unix.nix
index 064bdadb3285..40467a77a57f 100644
--- a/pkgs/development/ocaml-modules/cstruct/unix.nix
+++ b/pkgs/development/ocaml-modules/cstruct/unix.nix
@@ -9,6 +9,7 @@ else
     inherit (cstruct) version src meta;
 
     minimalOCamlVersion = "4.08";
+    duneVersion = "3";
 
     propagatedBuildInputs = [ cstruct ];
   }
diff --git a/pkgs/development/ocaml-modules/data-encoding/default.nix b/pkgs/development/ocaml-modules/data-encoding/default.nix
index 5a17abdcc532..2b4013eb46a0 100644
--- a/pkgs/development/ocaml-modules/data-encoding/default.nix
+++ b/pkgs/development/ocaml-modules/data-encoding/default.nix
@@ -5,7 +5,7 @@
 , either
 , ezjsonm
 , zarith
-, zarith_stubs_js
+, zarith_stubs_js ? null
 , hex
 , json-data-encoding
 , json-data-encoding-bson
diff --git a/pkgs/development/ocaml-modules/dbf/default.nix b/pkgs/development/ocaml-modules/dbf/default.nix
index d2dad611bf46..664cb5dead17 100644
--- a/pkgs/development/ocaml-modules/dbf/default.nix
+++ b/pkgs/development/ocaml-modules/dbf/default.nix
@@ -7,13 +7,13 @@ buildDunePackage rec {
 
   minimalOCamlVersion = "4.08";
 
-  useDune2 = true;
+  duneVersion = "3";
 
   src = fetchFromGitHub {
     owner = "pveber";
     repo = "dbf";
-    rev = "${version}";
-    sha256 = "sha256-h1K5YDLbXGEJi/quKXvSR0gZ+WkBzut7AsVFv+Bm8/g=";
+    rev = version;
+    hash = "sha256-h1K5YDLbXGEJi/quKXvSR0gZ+WkBzut7AsVFv+Bm8/g=";
   };
 
   buildInputs = [ ppx_cstruct ];
diff --git a/pkgs/development/ocaml-modules/eqaf/default.nix b/pkgs/development/ocaml-modules/eqaf/default.nix
index d3e29be3c688..d777755253c2 100644
--- a/pkgs/development/ocaml-modules/eqaf/default.nix
+++ b/pkgs/development/ocaml-modules/eqaf/default.nix
@@ -2,12 +2,13 @@
 
 buildDunePackage rec {
   minimalOCamlVersion = "4.07";
+  duneVersion = "3";
   pname = "eqaf";
   version = "0.9";
 
   src = fetchurl {
     url = "https://github.com/mirage/eqaf/releases/download/v${version}/eqaf-${version}.tbz";
-    sha256 = "sha256-7A4oqUasaBf5XVhU8FqZYa46hAi7YQ55z60BubJV3+A=";
+    hash = "sha256-7A4oqUasaBf5XVhU8FqZYa46hAi7YQ55z60BubJV3+A=";
   };
 
   propagatedBuildInputs = [ cstruct ];
diff --git a/pkgs/development/ocaml-modules/faraday/async.nix b/pkgs/development/ocaml-modules/faraday/async.nix
index 90f56c159632..f24866a815c1 100644
--- a/pkgs/development/ocaml-modules/faraday/async.nix
+++ b/pkgs/development/ocaml-modules/faraday/async.nix
@@ -1,4 +1,4 @@
-{ buildDunePackage, lib, faraday, core_unix, async }:
+{ buildDunePackage, lib, faraday, core_unix ? null, async }:
 
 buildDunePackage rec {
   pname = "faraday-async";
diff --git a/pkgs/development/ocaml-modules/git/default.nix b/pkgs/development/ocaml-modules/git/default.nix
index 1ffc95d3c225..5e1a0461abb1 100644
--- a/pkgs/development/ocaml-modules/git/default.nix
+++ b/pkgs/development/ocaml-modules/git/default.nix
@@ -8,14 +8,14 @@
 
 buildDunePackage rec {
   pname = "git";
-  version = "3.12.0";
+  version = "3.13.0";
 
   minimalOCamlVersion = "4.08";
   duneVersion = "3";
 
   src = fetchurl {
     url = "https://github.com/mirage/ocaml-git/releases/download/${version}/git-${version}.tbz";
-    hash = "sha256-qgd5fny23J6pcOdgwB3Yt1UxJii2XE25OjcSVFdLMKA=";
+    hash = "sha256-98w2Amze/B+YN/ENfSb0V8I2yyFUf8rSEOcUg1YbVdM=";
   };
 
   # remove changelog for the carton package
diff --git a/pkgs/development/ocaml-modules/git/unix.nix b/pkgs/development/ocaml-modules/git/unix.nix
index 680c77dfa39e..1079f554731d 100644
--- a/pkgs/development/ocaml-modules/git/unix.nix
+++ b/pkgs/development/ocaml-modules/git/unix.nix
@@ -14,13 +14,6 @@ buildDunePackage {
   pname = "git-unix";
   inherit (git) version src;
 
-  patches = [
-    (fetchpatch {
-      url = "https://github.com/mirage/ocaml-git/commit/b708db8319cc456a5640618210d740a1e00468e9.patch";
-      hash = "sha256-Fe+eDhU/beZT/8br8XmOhHYJowaVEha16eGqyuu2Zr4=";
-    })
-  ];
-
   minimalOCamlVersion = "4.08";
   duneVersion = "3";
 
diff --git a/pkgs/development/ocaml-modules/hack_parallel/default.nix b/pkgs/development/ocaml-modules/hack_parallel/default.nix
index 8d1414731f13..afd49b871656 100644
--- a/pkgs/development/ocaml-modules/hack_parallel/default.nix
+++ b/pkgs/development/ocaml-modules/hack_parallel/default.nix
@@ -1,4 +1,4 @@
-{ lib, fetchFromGitHub, buildDunePackage, core, core_unix, pkg-config
+{ lib, fetchFromGitHub, buildDunePackage, core, core_unix ? null, pkg-config
 , sqlite }:
 buildDunePackage rec {
   pname = "hack_parallel";
diff --git a/pkgs/development/ocaml-modules/integers_stubs_js/default.nix b/pkgs/development/ocaml-modules/integers_stubs_js/default.nix
index fc06efae7e04..59d47d2daf5f 100644
--- a/pkgs/development/ocaml-modules/integers_stubs_js/default.nix
+++ b/pkgs/development/ocaml-modules/integers_stubs_js/default.nix
@@ -1,6 +1,6 @@
 {
   lib, fetchFromGitHub, buildDunePackage
-, zarith_stubs_js
+, zarith_stubs_js ? null
 }:
 
 buildDunePackage rec {
diff --git a/pkgs/development/ocaml-modules/io-page/default.nix b/pkgs/development/ocaml-modules/io-page/default.nix
index b57628222405..79142f0e8d4d 100644
--- a/pkgs/development/ocaml-modules/io-page/default.nix
+++ b/pkgs/development/ocaml-modules/io-page/default.nix
@@ -5,10 +5,11 @@ buildDunePackage rec {
   version = "3.0.0";
 
   minimalOCamlVersion = "4.08";
+  duneVersion = "3";
 
   src = fetchurl {
     url = "https://github.com/mirage/${pname}/releases/download/v${version}/${pname}-${version}.tbz";
-    sha256 = "sha256-DjbKdNkFa6YQgJDLmLsuvyrweb4/TNvqAiggcj/3hu4=";
+    hash = "sha256-DjbKdNkFa6YQgJDLmLsuvyrweb4/TNvqAiggcj/3hu4=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/development/ocaml-modules/magic-trace/default.nix b/pkgs/development/ocaml-modules/magic-trace/default.nix
index 1f1417f67275..39bdca1119a4 100644
--- a/pkgs/development/ocaml-modules/magic-trace/default.nix
+++ b/pkgs/development/ocaml-modules/magic-trace/default.nix
@@ -1,5 +1,5 @@
-{ lib, fetchFromGitHub, buildDunePackage, async, cohttp_static_handler
-, core_unix, owee, ppx_jane, shell }:
+{ lib, fetchFromGitHub, buildDunePackage, async, cohttp_static_handler ? null
+, core_unix ? null, owee, ppx_jane, shell ? null }:
 
 buildDunePackage rec {
   pname = "magic-trace";
diff --git a/pkgs/development/ocaml-modules/mirage-block-ramdisk/default.nix b/pkgs/development/ocaml-modules/mirage-block-ramdisk/default.nix
index 78f3e48c5bd4..a6978d3d5811 100644
--- a/pkgs/development/ocaml-modules/mirage-block-ramdisk/default.nix
+++ b/pkgs/development/ocaml-modules/mirage-block-ramdisk/default.nix
@@ -16,6 +16,7 @@ buildDunePackage rec {
   '';
 
   minimalOCamlVersion = "4.06";
+  duneVersion = "3";
 
   propagatedBuildInputs = [ io-page mirage-block ];
 
diff --git a/pkgs/development/ocaml-modules/mirage-block-unix/default.nix b/pkgs/development/ocaml-modules/mirage-block-unix/default.nix
index 0d0851536b38..e32523c85eb6 100644
--- a/pkgs/development/ocaml-modules/mirage-block-unix/default.nix
+++ b/pkgs/development/ocaml-modules/mirage-block-unix/default.nix
@@ -13,6 +13,7 @@ buildDunePackage rec {
   };
 
   minimalOCamlVersion = "4.08";
+  duneVersion = "3";
 
   propagatedBuildInputs = [ cstruct-lwt logs mirage-block rresult uri ];
 
diff --git a/pkgs/development/ocaml-modules/mirage-block/combinators.nix b/pkgs/development/ocaml-modules/mirage-block/combinators.nix
index 7dee169afd5b..fc50002da1e6 100644
--- a/pkgs/development/ocaml-modules/mirage-block/combinators.nix
+++ b/pkgs/development/ocaml-modules/mirage-block/combinators.nix
@@ -1,10 +1,12 @@
-{ buildDunePackage, mirage-block, io-page, logs }:
+{ buildDunePackage, mirage-block, logs }:
 
 buildDunePackage rec {
   pname = "mirage-block-combinators";
   inherit (mirage-block) version src;
 
-  propagatedBuildInputs = [ mirage-block io-page logs ];
+  duneVersion = "3";
+
+  propagatedBuildInputs = [ mirage-block logs ];
 
   meta = mirage-block.meta // {
     description = "Block signatures and implementations for MirageOS using Lwt";
diff --git a/pkgs/development/ocaml-modules/mirage-block/default.nix b/pkgs/development/ocaml-modules/mirage-block/default.nix
index 161fd4a66ead..0cd1f1717ea6 100644
--- a/pkgs/development/ocaml-modules/mirage-block/default.nix
+++ b/pkgs/development/ocaml-modules/mirage-block/default.nix
@@ -4,11 +4,13 @@
 
 buildDunePackage rec {
   pname = "mirage-block";
-  version = "3.0.0";
+  version = "3.0.2";
+
+  duneVersion = "3";
 
   src = fetchurl {
-    url = "https://github.com/mirage/mirage-block/releases/download/v${version}/mirage-block-v${version}.tbz";
-    sha256 = "sha256-NB5nJpppMtdi0HDjKcCAqRjO4vIbAMfnP934P+SnzmU=";
+    url = "https://github.com/mirage/mirage-block/releases/download/v${version}/mirage-block-${version}.tbz";
+    hash = "sha256-UALUfeL0G1mfSsLgAb/HpQ6OV12YtY+GUOYG6yhUwAI=";
   };
 
   propagatedBuildInputs = [ cstruct lwt fmt ];
diff --git a/pkgs/development/ocaml-modules/mirage-channel/default.nix b/pkgs/development/ocaml-modules/mirage-channel/default.nix
index bdafeb430549..74ff38f9a70a 100644
--- a/pkgs/development/ocaml-modules/mirage-channel/default.nix
+++ b/pkgs/development/ocaml-modules/mirage-channel/default.nix
@@ -8,10 +8,11 @@ buildDunePackage rec {
   version = "4.1.0";
 
   minimalOCamlVersion = "4.07";
+  duneVersion = "3";
 
   src = fetchurl {
     url = "https://github.com/mirage/mirage-channel/releases/download/v${version}/mirage-channel-${version}.tbz";
-    sha256 = "sha256-sBdoUdTd9ZeNcHK0IBGBeOYDDqULM7EYX+Pz2f2nIQA=";
+    hash = "sha256-sBdoUdTd9ZeNcHK0IBGBeOYDDqULM7EYX+Pz2f2nIQA=";
   };
 
   propagatedBuildInputs = [ cstruct logs lwt mirage-flow ];
diff --git a/pkgs/development/ocaml-modules/mirage-console/default.nix b/pkgs/development/ocaml-modules/mirage-console/default.nix
index 2fcd58973bcd..b0746c54162a 100644
--- a/pkgs/development/ocaml-modules/mirage-console/default.nix
+++ b/pkgs/development/ocaml-modules/mirage-console/default.nix
@@ -7,10 +7,11 @@ buildDunePackage rec {
   version = "5.1.0";
 
   minimalOCamlVersion = "4.08";
+  duneVersion = "3";
 
   src = fetchurl {
     url = "https://github.com/mirage/mirage-console/releases/download/v${version}/mirage-console-${version}.tbz";
-    sha256 = "sha256-mjYRisbNOJbYoSuWaGoPueXakmqAwmWh0ATvLLsvpNM=";
+    hash = "sha256-mjYRisbNOJbYoSuWaGoPueXakmqAwmWh0ATvLLsvpNM=";
   };
 
   propagatedBuildInputs = [ lwt mirage-flow ];
diff --git a/pkgs/development/ocaml-modules/mirage-console/unix.nix b/pkgs/development/ocaml-modules/mirage-console/unix.nix
index 634bcc353ad3..ca8c2aeac5e3 100644
--- a/pkgs/development/ocaml-modules/mirage-console/unix.nix
+++ b/pkgs/development/ocaml-modules/mirage-console/unix.nix
@@ -5,6 +5,8 @@ buildDunePackage {
 
   inherit (mirage-console) version src;
 
+  duneVersion = "3";
+
   propagatedBuildInputs = [
     mirage-console
     cstruct
diff --git a/pkgs/development/ocaml-modules/mirage-flow/combinators.nix b/pkgs/development/ocaml-modules/mirage-flow/combinators.nix
index d4904e77430a..5500d0551253 100644
--- a/pkgs/development/ocaml-modules/mirage-flow/combinators.nix
+++ b/pkgs/development/ocaml-modules/mirage-flow/combinators.nix
@@ -1,11 +1,13 @@
-{ buildDunePackage, mirage-flow, fmt, ocaml_lwt, logs, cstruct, mirage-clock }:
+{ buildDunePackage, mirage-flow, fmt, lwt, logs, cstruct, mirage-clock }:
 
 buildDunePackage {
   pname = "mirage-flow-combinators";
 
-  inherit (mirage-flow) version useDune2 src;
+  inherit (mirage-flow) version src;
 
-  propagatedBuildInputs = [ ocaml_lwt logs cstruct mirage-clock mirage-flow ];
+  duneVersion = "3";
+
+  propagatedBuildInputs = [ lwt logs cstruct mirage-clock mirage-flow ];
 
   meta = mirage-flow.meta // {
     description = "Flow implementations and combinators for MirageOS specialized to lwt";
diff --git a/pkgs/development/ocaml-modules/mirage-flow/default.nix b/pkgs/development/ocaml-modules/mirage-flow/default.nix
index bc987eff9884..6b454512915b 100644
--- a/pkgs/development/ocaml-modules/mirage-flow/default.nix
+++ b/pkgs/development/ocaml-modules/mirage-flow/default.nix
@@ -1,18 +1,18 @@
-{ lib, buildDunePackage, fetchurl, cstruct, fmt, ocaml_lwt }:
+{ lib, buildDunePackage, fetchurl, cstruct, fmt, lwt }:
 
 buildDunePackage rec {
   pname = "mirage-flow";
   version = "3.0.0";
 
-  useDune2 = true;
-  minimumOCamlVersion = "4.05";
+  duneVersion = "3";
+  minimalOCamlVersion = "4.05";
 
   src = fetchurl {
     url = "https://github.com/mirage/mirage-flow/releases/download/v${version}/mirage-flow-v${version}.tbz";
-    sha256 = "sha256-1wvabIXsJ0e+2IvE2V8mnSgQUDuSkT8IB75SkWlhOPw=";
+    hash = "sha256-1wvabIXsJ0e+2IvE2V8mnSgQUDuSkT8IB75SkWlhOPw=";
   };
 
-  propagatedBuildInputs = [ cstruct fmt ocaml_lwt ];
+  propagatedBuildInputs = [ cstruct fmt lwt ];
 
   meta = {
     description = "Flow implementations and combinators for MirageOS";
diff --git a/pkgs/development/ocaml-modules/mirage-flow/unix.nix b/pkgs/development/ocaml-modules/mirage-flow/unix.nix
index 023896447db1..12681911a3de 100644
--- a/pkgs/development/ocaml-modules/mirage-flow/unix.nix
+++ b/pkgs/development/ocaml-modules/mirage-flow/unix.nix
@@ -5,7 +5,9 @@
 buildDunePackage {
   pname = "mirage-flow-unix";
 
-  inherit (mirage-flow) version useDune2 src;
+  inherit (mirage-flow) version src;
+
+  duneVersion = "3";
 
   # Make tests compatible with alcotest 1.4.0
   postPatch = ''
diff --git a/pkgs/development/ocaml-modules/mirage-random-test/default.nix b/pkgs/development/ocaml-modules/mirage-random-test/default.nix
index 81d75db77251..24339b49568c 100644
--- a/pkgs/development/ocaml-modules/mirage-random-test/default.nix
+++ b/pkgs/development/ocaml-modules/mirage-random-test/default.nix
@@ -6,10 +6,9 @@ buildDunePackage rec {
   pname = "mirage-random-test";
   version = "0.1.0";
 
-  minimumOCamlVersion = "4.06";
+  minimalOCamlVersion = "4.06";
 
-  # due to cstruct
-  useDune2 = true;
+  duneVersion = "3";
 
   src = fetchurl {
     url = "https://github.com/mirage/${pname}/releases/download/v${version}/${pname}-v${version}.tbz";
diff --git a/pkgs/development/ocaml-modules/mirage-random/default.nix b/pkgs/development/ocaml-modules/mirage-random/default.nix
index a119395764e5..ba70665c6ede 100644
--- a/pkgs/development/ocaml-modules/mirage-random/default.nix
+++ b/pkgs/development/ocaml-modules/mirage-random/default.nix
@@ -4,6 +4,8 @@ buildDunePackage rec {
   pname = "mirage-random";
   version = "3.0.0";
 
+  duneVersion = "3";
+
   src = fetchurl {
     url = "https://github.com/mirage/mirage-random/releases/download/v${version}/mirage-random-v${version}.tbz";
     sha256 = "sha256-Sf4/KB1kMMwXI+yr5H/JuOmynYPNXwlk9dAA+gFAZs8=";
diff --git a/pkgs/development/ocaml-modules/mldoc/default.nix b/pkgs/development/ocaml-modules/mldoc/default.nix
index 058261a78d3d..7960042ff9cc 100644
--- a/pkgs/development/ocaml-modules/mldoc/default.nix
+++ b/pkgs/development/ocaml-modules/mldoc/default.nix
@@ -6,7 +6,7 @@
 , cmdliner
 , core
 , core_bench
-, core_unix
+, core_unix ? null
 , js_of_ocaml
 , js_of_ocaml-ppx
 , ppx_deriving_yojson
diff --git a/pkgs/development/ocaml-modules/pcap-format/default.nix b/pkgs/development/ocaml-modules/pcap-format/default.nix
index ffd183787793..e73492830893 100644
--- a/pkgs/development/ocaml-modules/pcap-format/default.nix
+++ b/pkgs/development/ocaml-modules/pcap-format/default.nix
@@ -1,36 +1,32 @@
 { lib, buildDunePackage, fetchurl
-, ppx_cstruct, ppx_tools
-, cstruct, ounit, mmap, stdlib-shims
+, ppx_cstruct
+, cstruct
+, ounit
 }:
 
 buildDunePackage rec {
   pname = "pcap-format";
-  version = "0.5.2";
+  version = "0.6.0";
 
-  minimumOCamlVersion = "4.03";
-
-  # due to cstruct
-  useDune2 = true;
+  minimalOCamlVersion = "4.08";
+  duneVersion = "3";
 
   src = fetchurl {
-    url = "https://github.com/mirage/ocaml-pcap/releases/download/${version}/${pname}-${version}.tbz";
-    sha256 = "14c5rpgglyz41jic0fg0xa22d2w1syb86kva22y9fi7aqj9vm31f";
+    url = "https://github.com/mirage/ocaml-pcap/releases/download/v${version}/${pname}-${version}.tbz";
+    hash = "sha256-LUjy8Xm6VsnMq1FHKzmJg7uorkTv7cOTsoLwmtNHkaY=";
   };
 
   buildInputs = [
-    ppx_tools
     ppx_cstruct
   ];
 
   propagatedBuildInputs = [
     cstruct
-    stdlib-shims
   ];
 
   doCheck = true;
   checkInputs = [
     ounit
-    mmap
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/ocaml-modules/randomconv/default.nix b/pkgs/development/ocaml-modules/randomconv/default.nix
index 078d50da895b..45f52ba5bded 100644
--- a/pkgs/development/ocaml-modules/randomconv/default.nix
+++ b/pkgs/development/ocaml-modules/randomconv/default.nix
@@ -4,7 +4,7 @@ buildDunePackage rec {
   pname = "randomconv";
   version = "0.1.3";
 
-  useDune2 = true;
+  duneVersion = "3";
 
   src = fetchurl {
     url = "https://github.com/hannesm/randomconv/releases/download/v${version}/randomconv-v${version}.tbz";
diff --git a/pkgs/development/ocaml-modules/tsdl-image/default.nix b/pkgs/development/ocaml-modules/tsdl-image/default.nix
index d4eaaae65caa..3b0895b7b2f6 100644
--- a/pkgs/development/ocaml-modules/tsdl-image/default.nix
+++ b/pkgs/development/ocaml-modules/tsdl-image/default.nix
@@ -9,13 +9,15 @@
 
 buildDunePackage rec {
   pname = "tsdl-image";
-  version = "0.3.2";
+  version = "0.5";
+
+  duneVersion = "3";
 
   src = fetchFromGitHub {
     owner = "sanette";
     repo = pname;
     rev = version;
-    sha256 = "sha256-u6VYAwq+2oLn2Kw1+KQRVPswAqeKDSAaPfGLPrzn30s=";
+    hash = "sha256-khLhVJuiLNNWw76gTeg4W32v5XbkwAg11bIOWl67u2k=";
   };
 
   buildInputs = [
diff --git a/pkgs/development/ocaml-modules/tsdl-mixer/default.nix b/pkgs/development/ocaml-modules/tsdl-mixer/default.nix
index 24043ef4391e..d2721c5398e2 100644
--- a/pkgs/development/ocaml-modules/tsdl-mixer/default.nix
+++ b/pkgs/development/ocaml-modules/tsdl-mixer/default.nix
@@ -9,13 +9,15 @@
 
 buildDunePackage rec {
   pname = "tsdl-mixer";
-  version = "0.3.2";
+  version = "0.5";
+
+  duneVersion = "3";
 
   src = fetchFromGitHub {
     owner = "sanette";
     repo = pname;
     rev = version;
-    sha256 = "sha256-UDRhwnanrn87/PYVnacur1z/LsKuUu2G+0QQXjTw/IE=";
+    hash = "sha256-HGtO5iO3lxuVa707MDIhw0pgDZLHt9qY+Rd24sFkags=";
   };
 
   buildInputs = [
diff --git a/pkgs/development/ocaml-modules/tsdl-ttf/default.nix b/pkgs/development/ocaml-modules/tsdl-ttf/default.nix
index 0ff1963fcaf0..93bee8f10156 100644
--- a/pkgs/development/ocaml-modules/tsdl-ttf/default.nix
+++ b/pkgs/development/ocaml-modules/tsdl-ttf/default.nix
@@ -9,13 +9,15 @@
 
 buildDunePackage rec {
   pname = "tsdl-ttf";
-  version = "0.3.2";
+  version = "0.5";
+
+  duneVersion = "3";
 
   src = fetchFromGitHub {
     owner = "sanette";
     repo = pname;
     rev = version;
-    sha256 = "sha256-COBLF9K8thRROJJGeg4wxqrjB3aBa4CGYkf8HdAQ2o0";
+    hash = "sha256-ai9ChsA3HZzTxT9AuHsY1UIA2Q3U3CcOA7jRSG4MDsQ=";
   };
 
   buildInputs = [
diff --git a/pkgs/development/ocaml-modules/tsdl/default.nix b/pkgs/development/ocaml-modules/tsdl/default.nix
index 354a8ca2098a..14c29f3daee0 100644
--- a/pkgs/development/ocaml-modules/tsdl/default.nix
+++ b/pkgs/development/ocaml-modules/tsdl/default.nix
@@ -7,16 +7,17 @@ else
 
 let
   pname = "tsdl";
-  version = "0.9.9";
+  version = "1.0.0";
   webpage = "https://erratique.ch/software/${pname}";
 in
 
 stdenv.mkDerivation {
-  name = "ocaml${ocaml.version}-${pname}-${version}";
+  pname = "ocaml${ocaml.version}-${pname}";
+  inherit version;
 
   src = fetchurl {
     url = "${webpage}/releases/${pname}-${version}.tbz";
-    sha256 = "sha256-GqFz+bYG2ESkAEJyP8DKud4JFfU5MGLulzJa5Z4sptQ=";
+    hash = "sha256-XdgzCj9Uqplt/8Jk8rSFaQf8zu+9SZa8b9ZIlW/gjyE=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/ocaml-modules/vchan/default.nix b/pkgs/development/ocaml-modules/vchan/default.nix
index 872d11606ff6..e727c8667669 100644
--- a/pkgs/development/ocaml-modules/vchan/default.nix
+++ b/pkgs/development/ocaml-modules/vchan/default.nix
@@ -9,10 +9,11 @@ buildDunePackage rec {
   version = "6.0.1";
 
   minimalOCamlVersion = "4.08";
+  duneVersion = "3";
 
   src = fetchurl {
     url = "https://github.com/mirage/ocaml-vchan/releases/download/v${version}/vchan-${version}.tbz";
-    sha256 = "sha256-5E7dITMVirYoxUkp8ZamRAolyhA6avXGJNAioxeBuV0=";
+    hash = "sha256-5E7dITMVirYoxUkp8ZamRAolyhA6avXGJNAioxeBuV0=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/ocaml-modules/wayland/default.nix b/pkgs/development/ocaml-modules/wayland/default.nix
index f7ade2ec8070..9dea4a64a508 100644
--- a/pkgs/development/ocaml-modules/wayland/default.nix
+++ b/pkgs/development/ocaml-modules/wayland/default.nix
@@ -15,6 +15,7 @@ buildDunePackage rec {
   version = "1.1";
 
   minimalOCamlVersion = "4.08";
+  duneVersion = "3";
 
   src = fetchurl {
     url = "https://github.com/talex5/ocaml-wayland/releases/download/v${version}/wayland-${version}.tbz";
diff --git a/pkgs/development/ocaml-modules/xenstore-tool/default.nix b/pkgs/development/ocaml-modules/xenstore-tool/default.nix
index 4b6c0d89a82a..b3c8c241ae41 100644
--- a/pkgs/development/ocaml-modules/xenstore-tool/default.nix
+++ b/pkgs/development/ocaml-modules/xenstore-tool/default.nix
@@ -5,6 +5,8 @@ buildDunePackage {
 
   inherit (xenstore_transport) src version;
 
+  duneVersion = "3";
+
   buildInputs = [ xenstore_transport xenstore lwt ];
 
   meta = xenstore_transport.meta // {
diff --git a/pkgs/development/ocaml-modules/xenstore/default.nix b/pkgs/development/ocaml-modules/xenstore/default.nix
index a3f4e0abcdef..093ca1ffe902 100644
--- a/pkgs/development/ocaml-modules/xenstore/default.nix
+++ b/pkgs/development/ocaml-modules/xenstore/default.nix
@@ -7,6 +7,7 @@ buildDunePackage rec {
   version = "2.2.0";
 
   minimalOCamlVersion = "4.08";
+  duneVersion = "3";
 
   src = fetchurl {
     url = "https://github.com/mirage/ocaml-xenstore/releases/download/v${version}/xenstore-${version}.tbz";
diff --git a/pkgs/development/ocaml-modules/xenstore_transport/default.nix b/pkgs/development/ocaml-modules/xenstore_transport/default.nix
index a7fb853f3bec..f0867b4ec314 100644
--- a/pkgs/development/ocaml-modules/xenstore_transport/default.nix
+++ b/pkgs/development/ocaml-modules/xenstore_transport/default.nix
@@ -5,6 +5,7 @@ buildDunePackage rec {
   version = "1.3.0";
 
   minimalOCamlVersion = "4.08";
+  duneVersion = "3";
 
   src = fetchFromGitHub {
     owner = "xapi-project";
diff --git a/pkgs/development/python-modules/aiodiscover/default.nix b/pkgs/development/python-modules/aiodiscover/default.nix
index 044bbf7be6e1..aa0414fe7985 100644
--- a/pkgs/development/python-modules/aiodiscover/default.nix
+++ b/pkgs/development/python-modules/aiodiscover/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "aiodiscover";
-  version = "1.4.14";
+  version = "1.4.15";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "bdraco";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-AZ6AqobhgMRCrCqtTuCfJjmKZjFlyIIxPqMtHHH9aBA=";
+    hash = "sha256-Ee6lo1910dR02fAQEkuS+xCzM93UMKkrgbKPd/Id0Uc=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/aioesphomeapi/default.nix b/pkgs/development/python-modules/aioesphomeapi/default.nix
index dfb88f77aae3..470a600810bb 100644
--- a/pkgs/development/python-modules/aioesphomeapi/default.nix
+++ b/pkgs/development/python-modules/aioesphomeapi/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "aioesphomeapi";
-  version = "13.5.1";
+  version = "13.6.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "esphome";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-ifk1psowUGVG7XafipLq5T2+5K5+psDDsX/u/GYDXdU=";
+    hash = "sha256-M/KgQFt603V9wzd3SGexjDU7YWwStzVPZOoMBwp52/I=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/asyncua/default.nix b/pkgs/development/python-modules/asyncua/default.nix
index 8faa98cfda06..90c4a2bfc9af 100644
--- a/pkgs/development/python-modules/asyncua/default.nix
+++ b/pkgs/development/python-modules/asyncua/default.nix
@@ -1,19 +1,17 @@
 { lib
-, buildPythonPackage
-, fetchFromGitHub
-, aiosqlite
 , aiofiles
-, pytz
-, python-dateutil
-, sortedcontainers
+, aiosqlite
+, buildPythonPackage
 , cryptography
-, typing-extensions
-, importlib-metadata
-, pytestCheckHook
+, fetchFromGitHub
 , pytest-asyncio
 , pytest-mock
-, asynctest
+, pytestCheckHook
+, python-dateutil
 , pythonOlder
+, pytz
+, sortedcontainers
+, typing-extensions
 }:
 
 buildPythonPackage rec {
@@ -21,15 +19,21 @@ buildPythonPackage rec {
   version = "1.0.1";
   format = "setuptools";
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "FreeOpcUa";
     repo = "opcua-asyncio";
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
     hash = "sha256-6A4z+tiQ2oUlB9t44wlW64j5sjWFMAgqT3Xt0FdJCBs=";
   };
 
+  postPatch = ''
+    # https://github.com/FreeOpcUa/opcua-asyncio/issues/1263
+    substituteInPlace setup.py \
+      --replace ", 'asynctest'" ""
+  '';
+
   propagatedBuildInputs = [
     aiosqlite
     aiofiles
@@ -38,28 +42,27 @@ buildPythonPackage rec {
     sortedcontainers
     cryptography
     typing-extensions
-  ] ++ lib.optionals (pythonOlder "3.8") [
-    importlib-metadata
-  ];
-
-  pythonImportsCheck = [
-    "asyncua"
   ];
 
   nativeCheckInputs = [
     pytestCheckHook
     pytest-asyncio
     pytest-mock
-    asynctest
+  ];
+
+  pythonImportsCheck = [
+    "asyncua"
   ];
 
   disabledTests = [
-    "test_cli_tools_which_require_sigint" # Hard coded path only works from root of src
+    # Hard coded path only works from root of src
+    "test_cli_tools_which_require_sigint"
   ];
 
   meta = with lib; {
     description = "OPC UA / IEC 62541 Client and Server for Python";
     homepage = "https://github.com/FreeOpcUa/opcua-asyncio";
+    changelog = "https://github.com/FreeOpcUa/opcua-asyncio/releases/tag/v${version}";
     license = licenses.lgpl3Plus;
     maintainers = with maintainers; [ harvidsen ];
   };
diff --git a/pkgs/development/python-modules/azure-mgmt-containerservice/default.nix b/pkgs/development/python-modules/azure-mgmt-containerservice/default.nix
index 89cf42a6a247..f1c8f0bb54d0 100644
--- a/pkgs/development/python-modules/azure-mgmt-containerservice/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-containerservice/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "azure-mgmt-containerservice";
-  version = "21.2.0";
+  version = "22.0.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    hash = "sha256-pJLnSuSbXbarOiXwfnjSDNmyU7ZOl2IUUVaEA8mQriQ=";
+    hash = "sha256-/nHR81KW3VaeP2yOSWnCDvZGyxrzK8fAn9S/RRgBhyk=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/garminconnect/default.nix b/pkgs/development/python-modules/garminconnect/default.nix
index 1d5cd945881d..815b695ce1c2 100644
--- a/pkgs/development/python-modules/garminconnect/default.nix
+++ b/pkgs/development/python-modules/garminconnect/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "garminconnect";
-  version = "0.1.54";
+  version = "0.1.55";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "cyberjunky";
     repo = "python-garminconnect";
     rev = "refs/tags/${version}";
-    hash = "sha256-lxifhL70Yn3BIjeRPnWqOs97Oy65RD0Rrgw4bJno2kI=";
+    hash = "sha256-YPLlrlV8UyoaNtE+LgX7jpZkR7jbSe/2WRR0v0cfACY=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/goodwe/default.nix b/pkgs/development/python-modules/goodwe/default.nix
index 77698e3ace2e..a2ed64150f73 100644
--- a/pkgs/development/python-modules/goodwe/default.nix
+++ b/pkgs/development/python-modules/goodwe/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "goodwe";
-  version = "0.2.28";
+  version = "0.2.29";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "marcelblijleven";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-HkOlvZaCQOt+jbmzal17W5eU7SEq+kzTgbFd3fiTY/A=";
+    hash = "sha256-ukKMWdyaOALA3e68cYilS8TT6aHV3n8qQXobgDTeT2o=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/google-cloud-tasks/default.nix b/pkgs/development/python-modules/google-cloud-tasks/default.nix
index 3ab5abb61d90..f69cb6709fda 100644
--- a/pkgs/development/python-modules/google-cloud-tasks/default.nix
+++ b/pkgs/development/python-modules/google-cloud-tasks/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-tasks";
-  version = "2.13.0";
+  version = "2.13.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-7V57grRH2ysU765TDmqq7DOna9o8Nu9v4HjDAIf/ETA=";
+    hash = "sha256-mbhFBVx6Gye3M0lCny1vag659Am0ze7InfmeFr0ZeDM=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/nextcloudmonitor/default.nix b/pkgs/development/python-modules/nextcloudmonitor/default.nix
index 35ac2a4b6ce7..521295f53620 100644
--- a/pkgs/development/python-modules/nextcloudmonitor/default.nix
+++ b/pkgs/development/python-modules/nextcloudmonitor/default.nix
@@ -6,7 +6,7 @@
 
 buildPythonPackage rec {
   pname = "nextcloudmonitor";
-  version = "1.3.0";
+  version = "1.4.0";
 
   format = "setuptools";
 
@@ -14,7 +14,7 @@ buildPythonPackage rec {
     owner = "meichthys";
     repo = "nextcloud_monitor";
     rev = "v${version}";
-    hash = "sha256-Ivo5dqKcvE1e+1crZNzKHydprtMXkZdzDl4MsZviLQQ=";
+    hash = "sha256-jyC8oOFr5yVtIJNxVCLNTyFpJTdjHu8t6Xs4il45ysI=";
   };
 
   propagatedBuildInputs = [
@@ -27,6 +27,7 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "nextcloudmonitor" ];
 
   meta = with lib; {
+    changelog = "https://github.com/meichthys/nextcloud_monitor/blob/${src.rev}/README.md#change-log";
     description = "Python wrapper around nextcloud monitor api";
     homepage = "https://github.com/meichthys/nextcloud_monitor";
     license = licenses.mit;
diff --git a/pkgs/development/python-modules/plugwise/default.nix b/pkgs/development/python-modules/plugwise/default.nix
index 89ced453a9d3..81a81f221e26 100644
--- a/pkgs/development/python-modules/plugwise/default.nix
+++ b/pkgs/development/python-modules/plugwise/default.nix
@@ -21,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "plugwise";
-  version = "0.27.7";
+  version = "0.27.9";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -30,7 +30,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = "python-plugwise";
     rev = "refs/tags/v${version}";
-    hash = "sha256-MT6P1st3NbHPdulL23zckgliFRTgCn8h9CK3QumXVtQ=";
+    hash = "sha256-ZxVlMiSMJOr4XxCuSRvTBdcd1295m+d7yqOnNxzRiuI=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pydeps/default.nix b/pkgs/development/python-modules/pydeps/default.nix
index aefb4cc43f54..2449ecafb915 100644
--- a/pkgs/development/python-modules/pydeps/default.nix
+++ b/pkgs/development/python-modules/pydeps/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "pydeps";
-  version = "1.11.1";
+  version = "1.11.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "thebjorn";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-nFdt68QhpX1URLEQtdikR11KFK9E9Y+cTvJQn4/YZlI=";
+    hash = "sha256-6eiSzuxspWutEKL1pKBeZ0/ZQjS07BpTwgd8dyrePcM=";
   };
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/pytaglib/default.nix b/pkgs/development/python-modules/pytaglib/default.nix
index 909dad99fb8f..0b57dce5ec1a 100644
--- a/pkgs/development/python-modules/pytaglib/default.nix
+++ b/pkgs/development/python-modules/pytaglib/default.nix
@@ -4,17 +4,21 @@
 , taglib
 , cython
 , pytestCheckHook
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "pytaglib";
-  version = "1.5.0-1";
+  version = "2.0.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "supermihi";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "1nssiqzlzvzdd3pc5xd1qwgwgkyazynmq8qiljz0dhy0c8j6mkfp";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-CEpyRxC9d7EuxupMQaX7WUCZ7lhyE6LhQY7Koe0NJ1A=";
   };
 
   buildInputs = [
@@ -26,11 +30,14 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  pythonImportsCheck = [ "taglib" ];
+  pythonImportsCheck = [
+    "taglib"
+  ];
 
   meta = with lib; {
     description = "Python bindings for the Taglib audio metadata library";
     homepage = "https://github.com/supermihi/pytaglib";
+    changelog = "https://github.com/supermihi/pytaglib/blob/v${version}/CHANGELOG.md";
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ mrkkrp ];
   };
diff --git a/pkgs/development/python-modules/python-bsblan/default.nix b/pkgs/development/python-modules/python-bsblan/default.nix
index 11d3bdc3adfc..dcfed60a8c1e 100644
--- a/pkgs/development/python-modules/python-bsblan/default.nix
+++ b/pkgs/development/python-modules/python-bsblan/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "python-bsblan";
-  version = "0.5.9";
+  version = "0.5.10";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "liudger";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-9WXj/zFFzPr3YabdEYN+Xn/IwKplPFdHAFDB2S2JUEI=";
+    hash = "sha256-VOi3v5SPHHx+qgqQmbIcC+APAks9CPklFAlCmHRM1iQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/tern/default.nix b/pkgs/development/python-modules/tern/default.nix
index 3b2701960f87..592c5d72da7d 100644
--- a/pkgs/development/python-modules/tern/default.nix
+++ b/pkgs/development/python-modules/tern/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage rec {
   pname = "tern";
-  version = "2.11.0";
+  version = "2.12.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-MELPpz7UeOKSAW7hC2xDIog/bdLUflU00vvIbAePNBA=";
+    hash = "sha256-XvhKe7mf09Nr3sbpMOKOO63HQ+9thgluU02iEIdWSpg=";
   };
 
   preBuild = ''
diff --git a/pkgs/development/python-modules/types-colorama/default.nix b/pkgs/development/python-modules/types-colorama/default.nix
index 19190404a6b6..7710cdc152c0 100644
--- a/pkgs/development/python-modules/types-colorama/default.nix
+++ b/pkgs/development/python-modules/types-colorama/default.nix
@@ -5,12 +5,12 @@
 
 buildPythonPackage rec {
   pname = "types-colorama";
-  version = "0.4.15.8";
+  version = "0.4.15.9";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-xrskWqhox914w7Fr1ISEzTZhJ9YeTvoVZ26sI6zYK3Y=";
+    hash = "sha256-+25tIa07AbGHj8an0/Jm0fhFiwE9cUWTO9kI6x5mj7I=";
   };
 
   # Module has no tests
diff --git a/pkgs/development/python-modules/types-urllib3/default.nix b/pkgs/development/python-modules/types-urllib3/default.nix
index 409d6584d7f7..34306f386f6f 100644
--- a/pkgs/development/python-modules/types-urllib3/default.nix
+++ b/pkgs/development/python-modules/types-urllib3/default.nix
@@ -5,12 +5,12 @@
 
 buildPythonPackage rec {
   pname = "types-urllib3";
-  version = "1.26.25.8";
+  version = "1.26.25.9";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-7PQ8QtjuQ51zKhEQtJAekBenmjjayibwjkLIRgBpOSw=";
+    hash = "sha256-Fgcnh5vb5S8R9f7soJKkc/ONaO076Iq7RhtZzaQPubw=";
   };
 
   # Module doesn't have tests
diff --git a/pkgs/development/tools/datree/default.nix b/pkgs/development/tools/datree/default.nix
index 3f969acf89ae..09d4aaa074c3 100644
--- a/pkgs/development/tools/datree/default.nix
+++ b/pkgs/development/tools/datree/default.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "datree";
-  version = "1.8.45";
+  version = "1.8.46";
 
   src = fetchFromGitHub {
     owner = "datreeio";
     repo = "datree";
     rev = "refs/tags/${version}";
-    hash = "sha256-11bwb8Nnr5RmRes/qUAoxMJ9vpwkIyB1113X3HDjYKA=";
+    hash = "sha256-sSMJxR8ZizQtWjiDbuc8pH5GltZ7YVzZrwOuz7Ih9iw=";
   };
 
   vendorHash = "sha256-MrVIpr2iwddW3yUeBuDfeg+Xo9Iarr/fp4Rc4WGYGeU=";
diff --git a/pkgs/development/tools/symfony-cli/default.nix b/pkgs/development/tools/symfony-cli/default.nix
index 812a02b2edda..c4e81d4eca7e 100644
--- a/pkgs/development/tools/symfony-cli/default.nix
+++ b/pkgs/development/tools/symfony-cli/default.nix
@@ -2,14 +2,14 @@
 
 buildGoModule rec {
   pname = "symfony-cli";
-  version = "5.5.1";
-  vendorHash = "sha256-OMQaYvNt4VeLoNVL/syQlIlGsP4F0C2A679OLbXIXng=";
+  version = "5.5.2";
+  vendorHash = "sha256-hDr/ByBCjKE+B698IXzDFq1ovS6Nfs4O32aF7HKmrcY=";
 
   src = fetchFromGitHub {
     owner = "symfony-cli";
     repo = "symfony-cli";
     rev = "v${version}";
-    sha256 = "sha256-sTgnDe3cjisdmJPtqNkjPF5XncC25Leud4ASai9peJE=";
+    sha256 = "sha256-Bo9oT6POywVYfZwXFfSGMZTf4XhSm0hgG2cQg6W1A2U=";
   };
 
   ldflags = [
diff --git a/pkgs/misc/drivers/gutenprint/default.nix b/pkgs/misc/drivers/gutenprint/default.nix
index f5a104fd08c3..7cdf66377d8f 100644
--- a/pkgs/misc/drivers/gutenprint/default.nix
+++ b/pkgs/misc/drivers/gutenprint/default.nix
@@ -14,7 +14,9 @@ stdenv.mkDerivation rec {
     sha256 = "0s0b14hjwvbxksq7af5v8z9g2rfqv9jdmxd9d81m57f5mh6rad0p";
   };
 
-  nativeBuildInputs = [ makeWrapper pkg-config ];
+  strictDeps = true;
+  nativeBuildInputs = [ makeWrapper pkg-config ]
+    ++ lib.optional cupsSupport cups; # for cups-config
   buildInputs =
     [ ijs zlib ]
     ++ lib.optionals gimp2Support [ gimp.gtk gimp ]
diff --git a/pkgs/os-specific/linux/prl-tools/default.nix b/pkgs/os-specific/linux/prl-tools/default.nix
index b0769f70ca48..b800e2ee98de 100644
--- a/pkgs/os-specific/linux/prl-tools/default.nix
+++ b/pkgs/os-specific/linux/prl-tools/default.nix
@@ -1,28 +1,39 @@
-{ stdenv
-, lib
+{ lib
+, stdenv
+, fetchurl
+, autoPatchelfHook
+, bbe
 , makeWrapper
 , p7zip
-, gawk
-, util-linux
-, xorg
-, glib
-, dbus-glib
-, zlib
-, bbe
-, bash
-, timetrap
-, netcat
-, cups
-, kernel ? null
-, libsOnly ? false
-, fetchurl
-, undmg
 , perl
-, autoPatchelfHook
+, undmg
+, dbus-glib
+, glib
+, xorg
+, zlib
+, kernel
+, bash
+, cups
+, gawk
+, netcat
+, timetrap
+, util-linux
 }:
 
-assert (!libsOnly) -> kernel != null;
+let
+  kernelVersion = kernel.modDirVersion;
+  kernelDir = "${kernel.dev}/lib/modules/${kernelVersion}";
 
+  libPath = lib.concatStringsSep ":" [ "${glib.out}/lib" "${xorg.libXrandr}/lib" ];
+  scriptPath = lib.concatStringsSep ":" [
+    "${bash}/bin"
+    "${cups}/sbin"
+    "${gawk}/bin"
+    "${netcat}/bin"
+    "${timetrap}/bin"
+    "${util-linux}/bin"
+  ];
+in
 stdenv.mkDerivation rec {
   version = "18.2.0-53488";
   pname = "prl-tools";
@@ -36,124 +47,132 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "pic" "format" ];
 
-  nativeBuildInputs = [ p7zip undmg perl bbe autoPatchelfHook ]
-    ++ lib.optionals (!libsOnly) [ makeWrapper ] ++ kernel.moduleBuildDependencies;
+  nativeBuildInputs = [
+    autoPatchelfHook
+    bbe
+    makeWrapper
+    p7zip
+    perl
+    undmg
+  ] ++ kernel.moduleBuildDependencies;
 
-  buildInputs = with xorg; [ libXrandr libXext libX11 libXcomposite libXinerama ]
-    ++ lib.optionals (!libsOnly) [ libXi glib dbus-glib zlib ];
+  buildInputs = [
+    dbus-glib
+    glib
+    xorg.libX11
+    xorg.libXcomposite
+    xorg.libXext
+    xorg.libXrandr
+    xorg.libXi
+    xorg.libXinerama
+    zlib
+  ];
 
-  runtimeDependencies = [ glib xorg.libXrandr ];
-
-  inherit libsOnly;
+  runtimeDependencies = [
+    glib
+    xorg.libXrandr
+  ];
 
   unpackPhase = ''
+    runHook preUnpack
+
     undmg $src
     export sourceRoot=prl-tools-build
     7z x "Parallels Desktop.app/Contents/Resources/Tools/prl-tools-lin${lib.optionalString stdenv.isAarch64 "-arm"}.iso" -o$sourceRoot
-    if test -z "$libsOnly"; then
-      ( cd $sourceRoot/kmods; tar -xaf prl_mod.tar.gz )
-    fi
+    ( cd $sourceRoot/kmods; tar -xaf prl_mod.tar.gz )
+
+    runHook postUnpack
   '';
 
-  kernelVersion = lib.optionalString (!libsOnly) kernel.modDirVersion;
-  kernelDir = lib.optionalString (!libsOnly) "${kernel.dev}/lib/modules/${kernelVersion}";
-
-  libPath = lib.concatStringsSep ":" [ "${glib.out}/lib" "${xorg.libXrandr}/lib" ];
-
-  scriptPath = lib.concatStringsSep ":" (lib.optionals (!libsOnly) [
-    "${util-linux}/bin"
-    "${gawk}/bin"
-    "${bash}/bin"
-    "${timetrap}/bin"
-    "${netcat}/bin"
-    "${cups}/sbin"
-  ]);
+  env.NIX_CFLAGS_COMPILE = lib.optionalString (lib.versionAtLeast kernelVersion "6.3") "-Wno-incompatible-pointer-types";
 
   buildPhase = ''
-    if test -z "$libsOnly"; then
-      ( # kernel modules
-        cd kmods
-        make -f Makefile.kmods \
-          KSRC=$kernelDir/source \
-          HEADERS_CHECK_DIR=$kernelDir/source \
-          KERNEL_DIR=$kernelDir/build \
-          SRC=$kernelDir/build \
-          KVER=$kernelVersion
-      )
-    fi
+    runHook preBuild
+
+    ( # kernel modules
+      cd kmods
+      make -f Makefile.kmods \
+        KSRC=${kernelDir}/source \
+        HEADERS_CHECK_DIR=${kernelDir}/source \
+        KERNEL_DIR=${kernelDir}/build \
+        SRC=${kernelDir}/build \
+        KVER=${kernelVersion}
+    )
+
+    runHook postBuild
   '';
 
   installPhase = ''
-    if test -z "$libsOnly"; then
-      ( # kernel modules
-        cd kmods
-        mkdir -p $out/lib/modules/${kernelVersion}/extra
-        cp prl_fs/SharedFolders/Guest/Linux/prl_fs/prl_fs.ko $out/lib/modules/${kernelVersion}/extra
-        cp prl_fs_freeze/Snapshot/Guest/Linux/prl_freeze/prl_fs_freeze.ko $out/lib/modules/${kernelVersion}/extra
-        cp prl_tg/Toolgate/Guest/Linux/prl_tg/prl_tg.ko $out/lib/modules/${kernelVersion}/extra
-        ${lib.optionalString stdenv.isAarch64
-        "cp prl_notifier/Installation/lnx/prl_notifier/prl_notifier.ko $out/lib/modules/${kernelVersion}/extra"}
-      )
-    fi
+    runHook preInstall
+
+    ( # kernel modules
+      cd kmods
+      mkdir -p $out/lib/modules/${kernelVersion}/extra
+      cp prl_fs/SharedFolders/Guest/Linux/prl_fs/prl_fs.ko $out/lib/modules/${kernelVersion}/extra
+      cp prl_fs_freeze/Snapshot/Guest/Linux/prl_freeze/prl_fs_freeze.ko $out/lib/modules/${kernelVersion}/extra
+      cp prl_tg/Toolgate/Guest/Linux/prl_tg/prl_tg.ko $out/lib/modules/${kernelVersion}/extra
+      ${lib.optionalString stdenv.isAarch64
+      "cp prl_notifier/Installation/lnx/prl_notifier/prl_notifier.ko $out/lib/modules/${kernelVersion}/extra"}
+    )
 
     ( # tools
       cd tools/tools${if stdenv.isAarch64 then "-arm64" else if stdenv.isx86_64 then "64" else "32"}
       mkdir -p $out/lib
 
-      if test -z "$libsOnly"; then
-        # prltoolsd contains hardcoded /bin/bash path
-        # we're lucky because it uses only -c command
-        # => replace to /bin/sh
-        bbe -e "s:/bin/bash:/bin/sh\x00\x00:" -o bin/prltoolsd.tmp bin/prltoolsd
-        rm -f bin/prltoolsd
-        mv bin/prltoolsd.tmp bin/prltoolsd
+      # prltoolsd contains hardcoded /bin/bash path
+      # we're lucky because it uses only -c command
+      # => replace to /bin/sh
+      bbe -e "s:/bin/bash:/bin/sh\x00\x00:" -o bin/prltoolsd.tmp bin/prltoolsd
+      rm -f bin/prltoolsd
+      mv bin/prltoolsd.tmp bin/prltoolsd
 
-        # install binaries
-        for i in bin/* sbin/prl_nettool sbin/prl_snapshot; do
-          # also patch binaries to replace /usr/bin/XXX to XXX
-          # here a two possible cases:
-          # 1. it is uses as null terminated string and should be truncated by null;
-          # 2. it is uses inside shell script and should be truncated by space.
-          for p in bin/* sbin/prl_nettool sbin/prl_snapshot sbin/prlfsmountd; do
-            p=$(basename $p)
-            bbe -e "s:/usr/bin/$p\x00:./$p\x00\x00\x00\x00\x00\x00\x00\x00:" -o $i.tmp $i
-            bbe -e "s:/usr/sbin/$p\x00:./$p\x00\x00\x00\x00\x00\x00\x00\x00 :" -o $i $i.tmp
-            bbe -e "s:/usr/bin/$p:$p         :" -o $i.tmp $i
-            bbe -e "s:/usr/sbin/$p:$p          :" -o $i $i.tmp
-          done
-
-          install -Dm755 $i $out/$i
+      # install binaries
+      for i in bin/* sbin/prl_nettool sbin/prl_snapshot; do
+        # also patch binaries to replace /usr/bin/XXX to XXX
+        # here a two possible cases:
+        # 1. it is uses as null terminated string and should be truncated by null;
+        # 2. it is uses inside shell script and should be truncated by space.
+        for p in bin/* sbin/prl_nettool sbin/prl_snapshot sbin/prlfsmountd; do
+          p=$(basename $p)
+          bbe -e "s:/usr/bin/$p\x00:./$p\x00\x00\x00\x00\x00\x00\x00\x00:" -o $i.tmp $i
+          bbe -e "s:/usr/sbin/$p\x00:./$p\x00\x00\x00\x00\x00\x00\x00\x00 :" -o $i $i.tmp
+          bbe -e "s:/usr/bin/$p:$p         :" -o $i.tmp $i
+          bbe -e "s:/usr/sbin/$p:$p          :" -o $i $i.tmp
         done
 
-        install -Dm755 ../../tools/prlfsmountd.sh $out/sbin/prlfsmountd
-        for f in $out/bin/* $out/sbin/*; do
-          wrapProgram $f \
-            --prefix LD_LIBRARY_PATH ':' "$libPath" \
-            --prefix PATH ':' "$scriptPath"
-        done
+        install -Dm755 $i $out/$i
+      done
 
-        for i in lib/libPrl*.0.0; do
-          cp $i $out/lib
-          ln -s $out/$i $out/''${i%.0.0}
-        done
+      install -Dm755 ../../tools/prlfsmountd.sh $out/sbin/prlfsmountd
+      for f in $out/bin/* $out/sbin/*; do
+        wrapProgram $f \
+          --prefix LD_LIBRARY_PATH ':' "${libPath}" \
+          --prefix PATH ':' "${scriptPath}"
+      done
 
-        mkdir -p $out/share/man/man8
-        install -Dm644 ../mount.prl_fs.8 $out/share/man/man8
+      for i in lib/libPrl*.0.0; do
+        cp $i $out/lib
+        ln -s $out/$i $out/''${i%.0.0}
+      done
 
-        substituteInPlace ../99prltoolsd-hibernate \
-          --replace "/bin/bash" "${bash}/bin/bash"
+      mkdir -p $out/share/man/man8
+      install -Dm644 ../mount.prl_fs.8 $out/share/man/man8
 
-        mkdir -p $out/etc/pm/sleep.d
-        install -Dm644 ../99prltoolsd-hibernate $out/etc/pm/sleep.d
-      fi
+      substituteInPlace ../99prltoolsd-hibernate \
+        --replace "/bin/bash" "${bash}/bin/bash"
+
+      mkdir -p $out/etc/pm/sleep.d
+      install -Dm644 ../99prltoolsd-hibernate $out/etc/pm/sleep.d
     )
+
+    runHook postInstall
   '';
 
   meta = with lib; {
     description = "Parallels Tools for Linux guests";
     homepage = "https://parallels.com";
-    platforms = platforms.linux;
     license = licenses.unfree;
     maintainers = with maintainers; [ catap wegank ];
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/servers/honk/default.nix b/pkgs/servers/honk/default.nix
index 913b607ac843..cdcc0ddb63ac 100644
--- a/pkgs/servers/honk/default.nix
+++ b/pkgs/servers/honk/default.nix
@@ -2,11 +2,11 @@
 
 buildGoModule rec {
   pname = "honk";
-  version = "0.9.8";
+  version = "0.9.91";
 
   src = fetchurl {
     url = "https://humungus.tedunangst.com/r/honk/d/honk-${version}.tgz";
-    sha256 = "0vh8y1aj2w0y2zxmybhik4iv7myyldfzkd75nzgmlz3vycr60rh6";
+    hash = "sha256-+NFWTTMVdngWsC8/EIN2xJC/5C4naaAekk/YoA17wFk=";
   };
   vendorHash = null;
 
diff --git a/pkgs/tools/networking/brook/default.nix b/pkgs/tools/networking/brook/default.nix
index e3ca1df48023..84ad4e56755e 100644
--- a/pkgs/tools/networking/brook/default.nix
+++ b/pkgs/tools/networking/brook/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "brook";
-  version = "20230401";
+  version = "20230404";
 
   src = fetchFromGitHub {
     owner = "txthinking";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-PVkdK1wcY3PaeixEG4StV1AmYPit6pQNErcALmV2LXc=";
+    sha256 = "sha256-nh59sfOWLk4evuIxa35bWu0J6xSUIzrPv4oQHWSZInA=";
   };
 
-  vendorHash = "sha256-7h+rMfFFpcsfZa6tw/o0uRIDw4g3g+dwd9y2Ysg2NJc=";
+  vendorHash = "sha256-PYdR0vfgOgRheHDvoIC9jCFmfzCSOhxqcPFm+MqirsQ=";
 
   meta = with lib; {
     homepage = "https://github.com/txthinking/brook";
diff --git a/pkgs/tools/security/exploitdb/default.nix b/pkgs/tools/security/exploitdb/default.nix
index 42bb124c4961..55b85b95437c 100644
--- a/pkgs/tools/security/exploitdb/default.nix
+++ b/pkgs/tools/security/exploitdb/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "exploitdb";
-  version = "2023-03-26";
+  version = "2023-03-28";
 
   src = fetchFromGitLab {
     owner = "exploit-database";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-oUoQNjg14rAs8BAxTOLtYHw9iTwEAsLymObog+GrQw8=";
+    hash = "sha256-aduDgEj07Gy+P6xDa8DUT31ZHEWXHlzspi7ZY2wCl9A=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/security/trufflehog/default.nix b/pkgs/tools/security/trufflehog/default.nix
index 7bfa0e0a19ad..f4be423a269f 100644
--- a/pkgs/tools/security/trufflehog/default.nix
+++ b/pkgs/tools/security/trufflehog/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "trufflehog";
-  version = "3.29.1";
+  version = "3.30.0";
 
   src = fetchFromGitHub {
     owner = "trufflesecurity";
     repo = "trufflehog";
     rev = "refs/tags/v${version}";
-    hash = "sha256-ZCHrqvqIlANqkZ/zVYbwOsRimWVUAZ8zvBnfTaBE8qk=";
+    hash = "sha256-4h9obnh4+QNda0SoMPMFEyG0KnW4753RpXTPWi6yB34=";
   };
 
-  vendorHash = "sha256-Z1QJM2feKFQ8MEVwzYt+MkpDZHiaVWlzq2lbResWQWk=";
+  vendorHash = "sha256-VBWzqfqte7aZ03HFW2L6wsEU84NBMTVrzKvdRUFGOro=";
 
   # Test cases run git clone and require network access
   doCheck = false;
diff --git a/pkgs/tools/wayland/wayland-proxy-virtwl/default.nix b/pkgs/tools/wayland/wayland-proxy-virtwl/default.nix
index 47b59353af86..164605b3d8a2 100644
--- a/pkgs/tools/wayland/wayland-proxy-virtwl/default.nix
+++ b/pkgs/tools/wayland/wayland-proxy-virtwl/default.nix
@@ -22,8 +22,8 @@ ocamlPackages.buildDunePackage rec {
   '';
 
   minimalOCamlVersion = "4.12";
+  duneVersion = "3";
 
-  strictDeps = true;
   nativeBuildInputs = [
     pkg-config
   ];
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index bf97bef74e45..10c2165a1921 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -30628,6 +30628,8 @@ with pkgs;
 
   jay = callPackage ../applications/window-managers/jay { };
 
+  keyleds = callPackage ../applications/misc/keyleds { };
+
   keylight-controller-mschneider82 = callPackage ../applications/misc/keylight-controller-mschneider82 { };
 
   leftwm = callPackage ../applications/window-managers/leftwm { };