diff --git a/nixos/modules/services/printing/cupsd.nix b/nixos/modules/services/printing/cupsd.nix
index 9ac89e057620..f6a23fb900f0 100644
--- a/nixos/modules/services/printing/cupsd.nix
+++ b/nixos/modules/services/printing/cupsd.nix
@@ -317,6 +317,7 @@ in
     environment.etc.cups.source = "/var/lib/cups";
 
     services.dbus.packages = [ cups.out ] ++ optional polkitEnabled cups-pk-helper;
+    services.udev.packages = cfg.drivers;
 
     # Allow asswordless printer admin for members of wheel group
     security.polkit.extraConfig = mkIf polkitEnabled ''
diff --git a/pkgs/applications/misc/cpu-x/default.nix b/pkgs/applications/misc/cpu-x/default.nix
index 197e7ec86d08..d6e3bb28e18e 100644
--- a/pkgs/applications/misc/cpu-x/default.nix
+++ b/pkgs/applications/misc/cpu-x/default.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cpu-x";
-  version = "4.5.2";
+  version = "4.5.3";
 
   src = fetchFromGitHub {
     owner = "X0rg";
     repo = "CPU-X";
     rev = "v${version}";
-    sha256 = "sha256-VPmwnzoOBNLDYZsoEknbcX7QP2Tcm08pL/rw1uCK8xM=";
+    sha256 = "sha256-o48NkOPabfnwsu+nyXJOstW6g0JSUgIrEFx1nNCR7XE=";
   };
 
   nativeBuildInputs = [ cmake pkg-config wrapGAppsHook nasm makeWrapper ];
diff --git a/pkgs/applications/networking/browsers/librewolf/src.json b/pkgs/applications/networking/browsers/librewolf/src.json
index 6b32c4d80251..472bbbe27142 100644
--- a/pkgs/applications/networking/browsers/librewolf/src.json
+++ b/pkgs/applications/networking/browsers/librewolf/src.json
@@ -1,11 +1,11 @@
 {
-  "packageVersion": "112.0-1",
+  "packageVersion": "112.0.1-1",
   "source": {
-    "rev": "112.0-1",
-    "sha256": "1qjckchx20bf20z05g8m7hqm68v4hpn20fbs52l19z87irglmmfk"
+    "rev": "112.0.1-1",
+    "sha256": "0bk3idpl11n4gwk8rgfi2pilwx9n56s8dpp7y599h17mlrsw8az4"
   },
   "firefox": {
-    "version": "112.0",
-    "sha512": "6b2bc8c0c93f3109da27168fe7e8f734c6ab4efb4ca56ff2d5e3a52659da71173bba2104037a000623833be8338621fca482f39f836e3910fe2996e6d0a68b39"
+    "version": "112.0.1",
+    "sha512": "23a5cd9c1f165275d8ca7465bebce86018441c72292421f4ed56d7ad8ada9402dc8d22a08467d9d0ef3ef8c62338006dfa3bcbddf12cb8a59eafa0bd7d0cda50"
   }
 }
diff --git a/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix b/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
index cfb06eba692b..04a64b96899a 100644
--- a/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
+++ b/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
@@ -1,6 +1,7 @@
 { lib, stdenv
 , fetchurl
 , makeDesktopItem
+, writeText
 
 # Common run-time dependencies
 , zlib
@@ -112,6 +113,19 @@ let
       hash = "sha256-mi8btxI6de5iQ8HzNpvuFdJHjzi03zZJT65dsWEiDHA=";
     };
   };
+
+  distributionIni = writeText "distribution.ini" (lib.generators.toINI {} {
+    # Some light branding indicating this build uses our distro preferences
+    Global = {
+      id = "nixos";
+      version = "1.0";
+      about = "Tor Browser for NixOS";
+    };
+  });
+
+  policiesJson = writeText "policies.json" (builtins.toJSON {
+    policies.DisableAppUpdate = true;
+  });
 in
 stdenv.mkDerivation rec {
   pname = "tor-browser-bundle-bin";
@@ -132,7 +146,9 @@ stdenv.mkDerivation rec {
     categories = [ "Network" "WebBrowser" "Security" ];
   };
 
-  buildCommand = ''
+  buildPhase = ''
+    runHook preBuild
+
     # For convenience ...
     TBB_IN_STORE=$out/share/tor-browser
     interp=$(< $NIX_CC/nix-support/dynamic-linker)
@@ -209,7 +225,7 @@ stdenv.mkDerivation rec {
 
     // Insist on using IPC for communicating with Tor
     //
-    // Defaults to creating \$TBB_HOME/TorBrowser/Data/Tor/{socks,control}.socket
+    // Defaults to creating \$XDG_RUNTIME_DIR/Tor/{socks,control}.socket
     lockPref("extensions.torlauncher.control_port_use_ipc", true);
     lockPref("extensions.torlauncher.socks_port_use_ipc", true);
 
@@ -331,6 +347,7 @@ stdenv.mkDerivation rec {
       echo "user_pref(\"extensions.torlauncher.toronionauthdir_path\", \"\$HOME/TorBrowser/Data/Tor/onion-auth\");"
       echo "user_pref(\"extensions.torlauncher.torrc_path\", \"\$HOME/TorBrowser/Data/Tor/torrc\");"
       echo "user_pref(\"extensions.torlauncher.tordatadir_path\", \"\$HOME/TorBrowser/Data/Tor\");"
+      echo "user_pref(\"network.proxy.socks\", \"file://\$XDG_RUNTIME_DIR/Tor/socks.socket\");"
     } >> "\$HOME/TorBrowser/Data/Browser/profile.default/prefs.js"
 
     # Lift-off
@@ -416,6 +433,18 @@ stdenv.mkDerivation rec {
     echo "Checking tor-browser wrapper ..."
       TBB_HOME=$(mktemp -d) \
       $out/bin/tor-browser --version >/dev/null
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    # Install distribution customizations
+    install -Dvm644 ${distributionIni} $out/share/tor-browser/distribution/distribution.ini
+    install -Dvm644 ${policiesJson} $out/share/tor-browser/distribution/policies.json
+
+    runHook postInstall
   '';
 
   meta = with lib; {
diff --git a/pkgs/data/fonts/lxgw-neoxihei/default.nix b/pkgs/data/fonts/lxgw-neoxihei/default.nix
index 6b93826d4d99..234fd2c508f1 100644
--- a/pkgs/data/fonts/lxgw-neoxihei/default.nix
+++ b/pkgs/data/fonts/lxgw-neoxihei/default.nix
@@ -5,11 +5,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "lxgw-neoxihei";
-  version = "1.009";
+  version = "1.010";
 
   src = fetchurl {
     url = "https://github.com/lxgw/LxgwNeoXiHei/releases/download/v${version}/LXGWNeoXiHei.ttf";
-    hash = "sha256-Q7rrgqrjALLY2y40mNfNmzSeGwcVwhZUmDj08nlWsao=";
+    hash = "sha256-IIiQn2Qlac4ZFy/gVubrpqEpJIt0Dav2TEL29xDC7w4=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/data/fonts/sarasa-gothic/default.nix b/pkgs/data/fonts/sarasa-gothic/default.nix
index c8a3a65a00b7..3498e840eae6 100644
--- a/pkgs/data/fonts/sarasa-gothic/default.nix
+++ b/pkgs/data/fonts/sarasa-gothic/default.nix
@@ -2,13 +2,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "sarasa-gothic";
-  version = "0.40.4";
+  version = "0.40.5";
 
   src = fetchurl {
     # Use the 'ttc' files here for a smaller closure size.
     # (Using 'ttf' files gives a closure size about 15x larger, as of November 2021.)
     url = "https://github.com/be5invis/Sarasa-Gothic/releases/download/v${version}/sarasa-gothic-ttc-${version}.7z";
-    hash = "sha256-PVlozsWYomsQKp8WxHD8+pxzlTmIKGPK71HDLWMR9S0=";
+    hash = "sha256-bs3o8+LyCTCZvUYigUWfSmjFrzPg7nLzElZYxDEsQ9k=";
   };
 
   sourceRoot = ".";
diff --git a/pkgs/data/icons/tela-circle-icon-theme/default.nix b/pkgs/data/icons/tela-circle-icon-theme/default.nix
index eee3a425b709..d5c29013c51a 100644
--- a/pkgs/data/icons/tela-circle-icon-theme/default.nix
+++ b/pkgs/data/icons/tela-circle-icon-theme/default.nix
@@ -19,13 +19,13 @@ lib.checkListOfEnum "${pname}: color variants" [ "standard" "black" "blue" "brow
 
 stdenvNoCC.mkDerivation rec {
   inherit pname;
-  version = "2023-01-29";
+  version = "2023-04-16";
 
   src = fetchFromGitHub {
     owner = "vinceliuice";
     repo = pname;
     rev = version;
-    sha256 = "J3opK+5xGmV81ubA60BZw9+9IifylrRYo+5cRLWd6Xs=";
+    sha256 = "OHI/kT4HMlWUTxIeGXjtuIYBzQKM3XTGXuE9cviNDTM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/compilers/llvm/git/default.nix b/pkgs/development/compilers/llvm/git/default.nix
index c7b5e03226ef..d6d8186aecbc 100644
--- a/pkgs/development/compilers/llvm/git/default.nix
+++ b/pkgs/development/compilers/llvm/git/default.nix
@@ -3,6 +3,7 @@
 , libxml2, python3, fetchFromGitHub, overrideCC, wrapCCWith, wrapBintoolsWith
 , buildLlvmTools # tools, but from the previous stage, for cross
 , targetLlvmLibraries # libraries, but from the next stage, for cross
+, targetLlvm
 # This is the default binutils, but with *this* version of LLD rather
 # than the default LLVM verion's, if LLD is the choice. We use these for
 # the `useLLVM` bootstrapping below.
@@ -344,7 +345,7 @@ in let
     };
 
     openmp = callPackage ./openmp {
-      inherit llvm_meta;
+      inherit llvm_meta targetLlvm;
     };
   });
 
diff --git a/pkgs/development/compilers/llvm/git/libcxx/default.nix b/pkgs/development/compilers/llvm/git/libcxx/default.nix
index de4260540e92..94374c8a312d 100644
--- a/pkgs/development/compilers/llvm/git/libcxx/default.nix
+++ b/pkgs/development/compilers/llvm/git/libcxx/default.nix
@@ -17,7 +17,7 @@ let
   basename = "libcxx";
 in
 
-assert stdenv.isDarwin -> cxxabi.pname == "libcxxabi";
+assert stdenv.isDarwin -> cxxabi.libName == "c++abi";
 
 stdenv.mkDerivation rec {
   pname = basename + lib.optionalString headersOnly "-headers";
@@ -64,35 +64,33 @@ stdenv.mkDerivation rec {
 
   buildInputs = lib.optionals (!headersOnly) [ cxxabi ];
 
-  cmakeFlags = [
+  cmakeFlags = let
+    # See: https://libcxx.llvm.org/BuildingLibcxx.html#cmdoption-arg-libcxx-cxx-abi-string
+    libcxx_cxx_abi_opt = {
+      "c++abi" = "system-libcxxabi";
+      "cxxrt" = "libcxxrt";
+    }.${cxxabi.libName} or (throw "unknown cxxabi: ${cxxabi.libName} (${cxxabi.pname})");
+  in [
     "-DLLVM_ENABLE_RUNTIMES=libcxx"
-    "-DLIBCXX_CXX_ABI=${lib.optionalString (!headersOnly) "system-"}${cxxabi.pname}"
-  ] ++ lib.optional (!headersOnly && cxxabi.pname == "libcxxabi") "-DLIBCXX_CXX_ABI_INCLUDE_PATHS=${cxxabi.dev}/include/c++/v1"
+    "-DLIBCXX_CXX_ABI=${if headersOnly then "none" else libcxx_cxx_abi_opt}"
+  ] ++ lib.optional (!headersOnly && cxxabi.libName == "c++abi") "-DLIBCXX_CXX_ABI_INCLUDE_PATHS=${cxxabi.dev}/include/c++/v1"
     ++ lib.optional (stdenv.hostPlatform.isMusl || stdenv.hostPlatform.isWasi) "-DLIBCXX_HAS_MUSL_LIBC=1"
     ++ lib.optional (stdenv.hostPlatform.useLLVM or false) "-DLIBCXX_USE_COMPILER_RT=ON"
     ++ lib.optionals stdenv.hostPlatform.isWasm [
       "-DLIBCXX_ENABLE_THREADS=OFF"
       "-DLIBCXX_ENABLE_FILESYSTEM=OFF"
       "-DLIBCXX_ENABLE_EXCEPTIONS=OFF"
-    ] ++ lib.optional (!enableShared) "-DLIBCXX_ENABLE_SHARED=OFF";
+    ] ++ lib.optional (!enableShared) "-DLIBCXX_ENABLE_SHARED=OFF"
+    # If we're only building the headers we don't actually *need* a functioning
+    # C/C++ compiler:
+    ++ lib.optionals (headersOnly) [
+      "-DCMAKE_C_COMPILER_WORKS=ON"
+      "-DCMAKE_CXX_COMPILER_WORKS=ON"
+    ];
 
   ninjaFlags = lib.optional headersOnly "generate-cxx-headers";
   installTargets = lib.optional headersOnly "install-cxx-headers";
 
-  preInstall = lib.optionalString (stdenv.isDarwin && !headersOnly) ''
-    for file in lib/*.dylib; do
-      if [ -L "$file" ]; then continue; fi
-
-      baseName=$(basename $(${stdenv.cc.targetPrefix}otool -D $file | tail -n 1))
-      installName="$out/lib/$baseName"
-      abiName=$(echo "$baseName" | sed -e 's/libc++/libc++abi/')
-
-      for other in $(${stdenv.cc.targetPrefix}otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
-        ${stdenv.cc.targetPrefix}install_name_tool -change $other ${cxxabi}/lib/$abiName $file
-      done
-    done
-  '';
-
   passthru = {
     isLLVM = true;
     inherit cxxabi;
diff --git a/pkgs/development/compilers/llvm/git/llvm/default.nix b/pkgs/development/compilers/llvm/git/llvm/default.nix
index 96477c0686d4..ae8e1385bd8f 100644
--- a/pkgs/development/compilers/llvm/git/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/git/llvm/default.nix
@@ -24,10 +24,10 @@
   && (stdenv.hostPlatform == stdenv.buildPlatform)
 , enableManpages ? false
 , enableSharedLibraries ? !stdenv.hostPlatform.isStatic
-, enablePFM ? !(stdenv.isDarwin
-  || stdenv.isAarch64 # broken for Ampere eMAG 8180 (c2.large.arm on Packet) #56245
-  || stdenv.isAarch32 # broken for the armv7l builder
-)
+, enablePFM ? stdenv.isLinux /* PFM only supports Linux */
+  # broken for Ampere eMAG 8180 (c2.large.arm on Packet) #56245
+  # broken for the armv7l builder
+  && !stdenv.hostPlatform.isAarch
 , enablePolly ? true
 } @args:
 
diff --git a/pkgs/development/compilers/llvm/git/openmp/default.nix b/pkgs/development/compilers/llvm/git/openmp/default.nix
index f22101e9cade..52aeb4bd9800 100644
--- a/pkgs/development/compilers/llvm/git/openmp/default.nix
+++ b/pkgs/development/compilers/llvm/git/openmp/default.nix
@@ -6,6 +6,7 @@
 , cmake
 , ninja
 , llvm
+, targetLlvm
 , lit
 , clang-unwrapped
 , perl
@@ -34,7 +35,9 @@ stdenv.mkDerivation rec {
   outputs = [ "out" "dev" ];
 
   nativeBuildInputs = [ cmake ninja perl pkg-config lit ];
-  buildInputs = [ llvm ];
+  buildInputs = [
+    (if stdenv.buildPlatform == stdenv.hostPlatform then llvm else targetLlvm)
+  ];
 
   # Unsup:Pass:XFail:Fail
   # 26:267:16:8
diff --git a/pkgs/development/libraries/gvm-libs/default.nix b/pkgs/development/libraries/gvm-libs/default.nix
index b1499a777e6d..8e3667afc20d 100644
--- a/pkgs/development/libraries/gvm-libs/default.nix
+++ b/pkgs/development/libraries/gvm-libs/default.nix
@@ -23,13 +23,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gvm-libs";
-  version = "22.4.5";
+  version = "22.4.6";
 
   src = fetchFromGitHub {
     owner = "greenbone";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-dnR562qsDoW8Xb4TNrpcn66tn9iVmcmTaBxMbb+CX64=";
+    hash = "sha256-HG9DwUX0rTE7Fc5AOl98u/JEfvfd0iwn3fvsIG8lsfU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/libzen/default.nix b/pkgs/development/libraries/libzen/default.nix
index a0c99457d47b..12ac860320c7 100644
--- a/pkgs/development/libraries/libzen/default.nix
+++ b/pkgs/development/libraries/libzen/default.nix
@@ -1,11 +1,11 @@
 { lib, stdenv, fetchurl, autoreconfHook }:
 
 stdenv.mkDerivation rec {
-  version = "0.4.40";
+  version = "0.4.41";
   pname = "libzen";
   src = fetchurl {
     url = "https://mediaarea.net/download/source/libzen/${version}/libzen_${version}.tar.bz2";
-    sha256 = "sha256-VUPixFIUudnwuk9D3uYdApbh/58UJ+1sh53dG2K59p4=";
+    sha256 = "sha256-6yN9fT3Kbca6BocZQgon3gk0p4PMrrKGdWKzWvOQHi0=";
   };
 
   nativeBuildInputs = [ autoreconfHook ];
diff --git a/pkgs/development/libraries/science/math/ipopt/default.nix b/pkgs/development/libraries/science/math/ipopt/default.nix
index e9ca26d23958..9b26b352cdad 100644
--- a/pkgs/development/libraries/science/math/ipopt/default.nix
+++ b/pkgs/development/libraries/science/math/ipopt/default.nix
@@ -12,13 +12,13 @@ assert (!blas.isILP64) && (!lapack.isILP64);
 
 stdenv.mkDerivation rec {
   pname = "ipopt";
-  version = "3.14.11";
+  version = "3.14.12";
 
   src = fetchFromGitHub {
     owner = "coin-or";
     repo = "Ipopt";
     rev = "releases/${version}";
-    sha256 = "sha256-PzNDiTZkPORFckFJryFuvn/rsfx3wrXJ9Qde88gH5o4=";
+    sha256 = "sha256-cyV3tgmZz5AExxxdGJ12r+PPXn7v2AEhxb9icBxolS8=";
   };
 
   CXXDEFS = [ "-DHAVE_RAND" "-DHAVE_CSTRING" "-DHAVE_CSTDIO" ];
diff --git a/pkgs/development/libraries/sentencepiece/default.nix b/pkgs/development/libraries/sentencepiece/default.nix
index ea903ca58e0e..67875df02e25 100644
--- a/pkgs/development/libraries/sentencepiece/default.nix
+++ b/pkgs/development/libraries/sentencepiece/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "sentencepiece";
-  version = "0.1.97";
+  version = "0.1.98";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-T6qQtLmuPKVha0CwX4fBH7IQoAlwVj64X2qDecWd7s8=";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-afODoC4G3ibVXMLEIxusmju4wkTcOtlEzS17+EuyIZw=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/ocaml-modules/lwt/default.nix b/pkgs/development/ocaml-modules/lwt/default.nix
index 8004cfcd4bb4..cf631fd08e41 100644
--- a/pkgs/development/ocaml-modules/lwt/default.nix
+++ b/pkgs/development/ocaml-modules/lwt/default.nix
@@ -1,5 +1,5 @@
 { lib, fetchFromGitHub, libev, buildDunePackage
-, cppo, dune-configurator, ocplib-endian
+, ocaml, cppo, dune-configurator, ocplib-endian
 }:
 
 buildDunePackage rec {
@@ -15,6 +15,11 @@ buildDunePackage rec {
     sha256 = "sha256-XstKs0tMwliCyXnP0Vzi5WC27HKJGnATUYtbbQmH1TE=";
   };
 
+  postPatch = lib.optionalString (lib.versionAtLeast ocaml.version "5.0") ''
+    substituteInPlace src/unix/dune \
+      --replace "libraries bigarray lwt" "libraries lwt"
+  '';
+
   nativeBuildInputs = [ cppo ];
   buildInputs = [ dune-configurator ];
   propagatedBuildInputs = [ libev ocplib-endian ];
diff --git a/pkgs/development/ocaml-modules/ocplib-endian/default.nix b/pkgs/development/ocaml-modules/ocplib-endian/default.nix
index 1e657fce8dd1..285e8de84b39 100644
--- a/pkgs/development/ocaml-modules/ocplib-endian/default.nix
+++ b/pkgs/development/ocaml-modules/ocplib-endian/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildDunePackage, fetchFromGitHub, cppo }:
+{ lib, buildDunePackage, fetchFromGitHub, ocaml, cppo }:
 
 buildDunePackage rec {
   version = "1.2";
@@ -11,6 +11,11 @@ buildDunePackage rec {
     sha256 = "sha256-THTlhOfXAPaqTt1qBkht+D67bw6M175QLvXoUMgjks4=";
   };
 
+  postPatch = lib.optionalString (lib.versionAtLeast ocaml.version "5.0") ''
+    substituteInPlace src/dune \
+      --replace "libraries ocplib_endian bigarray" "libraries ocplib_endian"
+  '';
+
   minimalOCamlVersion = "4.03";
 
   nativeBuildInputs = [ cppo ];
diff --git a/pkgs/development/ocaml-modules/tcpip/default.nix b/pkgs/development/ocaml-modules/tcpip/default.nix
index 90100c2d5b57..30710bfae265 100644
--- a/pkgs/development/ocaml-modules/tcpip/default.nix
+++ b/pkgs/development/ocaml-modules/tcpip/default.nix
@@ -63,6 +63,7 @@ buildDunePackage rec {
     mirage-clock-unix
     ipaddr-cstruct
   ];
+  __darwinAllowLocalNetworking = true;
 
   meta = with lib; {
     description = "OCaml TCP/IP networking stack, used in MirageOS";
diff --git a/pkgs/development/python-modules/brother-ql/default.nix b/pkgs/development/python-modules/brother-ql/default.nix
index c7b727c73a5f..f6cfe5868209 100644
--- a/pkgs/development/python-modules/brother-ql/default.nix
+++ b/pkgs/development/python-modules/brother-ql/default.nix
@@ -33,5 +33,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/pklaus/brother_ql";
     license = licenses.gpl3;
     maintainers = with maintainers; [ grahamc ];
+    mainProgram = "brother_ql";
   };
 }
diff --git a/pkgs/development/python-modules/jax/default.nix b/pkgs/development/python-modules/jax/default.nix
index 26f89695ee16..12a69358b45e 100644
--- a/pkgs/development/python-modules/jax/default.nix
+++ b/pkgs/development/python-modules/jax/default.nix
@@ -5,6 +5,7 @@
 , etils
 , fetchFromGitHub
 , jaxlib
+, jaxlib-bin
 , lapack
 , matplotlib
 , numpy
@@ -13,15 +14,20 @@
 , pytest-xdist
 , pythonOlder
 , scipy
+, stdenv
 , typing-extensions
 }:
 
 let
   usingMKL = blas.implementation == "mkl" || lapack.implementation == "mkl";
+  # jaxlib is broken on aarch64-* as of 2023-03-05, but the binary wheels work
+  # fine. jaxlib is only used in the checkPhase, so switching backends does not
+  # impact package behavior. Get rid of this once jaxlib is fixed on aarch64-*.
+  jaxlib' = if jaxlib.meta.broken then jaxlib-bin else jaxlib;
 in
 buildPythonPackage rec {
   pname = "jax";
-  version = "0.4.1";
+  version = "0.4.5";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -29,14 +35,14 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "google";
     repo = pname;
-    rev = "refs/tags/jaxlib-v${version}";
-    hash = "sha256-ajLI0iD0YZRK3/uKSbhlIZGc98MdW174vA34vhoy7Iw=";
+    # google/jax contains tags for jax and jaxlib. Only use jax tags!
+    rev = "refs/tags/${pname}-v${version}";
+    hash = "sha256-UJzX8zP3qaEUIV5hPJhiGiLJO7k8p962MHWxIHDY1ZA=";
   };
 
   # jaxlib is _not_ included in propagatedBuildInputs because there are
   # different versions of jaxlib depending on the desired target hardware. The
-  # JAX project ships separate wheels for CPU, GPU, and TPU. Currently only the
-  # CPU wheel is packaged.
+  # JAX project ships separate wheels for CPU, GPU, and TPU.
   propagatedBuildInputs = [
     absl-py
     etils
@@ -47,7 +53,7 @@ buildPythonPackage rec {
   ] ++ etils.optional-dependencies.epath;
 
   nativeCheckInputs = [
-    jaxlib
+    jaxlib'
     matplotlib
     pytestCheckHook
     pytest-xdist
@@ -83,6 +89,11 @@ buildPythonPackage rec {
     "test_custom_linear_solve_cholesky"
     "test_custom_root_with_aux"
     "testEigvalsGrad_shape"
+  ] ++ lib.optionals (stdenv.isAarch64 && stdenv.isDarwin) [
+    # See https://github.com/google/jax/issues/14793.
+    "test_for_loop_fixpoint_correctly_identifies_loop_varying_residuals_unrolled_for_loop"
+    "testQdwhWithRandomMatrix3"
+    "testScanGrad_jit_scan"
   ];
 
   # See https://github.com/google/jax/issues/11722. This is a temporary fix in
diff --git a/pkgs/development/python-modules/jaxlib/bin.nix b/pkgs/development/python-modules/jaxlib/bin.nix
index 8574ed207754..c7e84e4c11a2 100644
--- a/pkgs/development/python-modules/jaxlib/bin.nix
+++ b/pkgs/development/python-modules/jaxlib/bin.nix
@@ -39,7 +39,7 @@ assert cudaSupport -> lib.versionAtLeast cudatoolkit.version "11.1";
 assert cudaSupport -> lib.versionAtLeast cudnn.version "8.2";
 
 let
-  version = "0.3.22";
+  version = "0.4.4";
 
   pythonVersion = python.pythonVersion;
 
@@ -50,21 +50,21 @@ let
   cpuSrcs = {
     "x86_64-linux" = fetchurl {
       url = "https://storage.googleapis.com/jax-releases/nocuda/jaxlib-${version}-cp310-cp310-manylinux2014_x86_64.whl";
-      hash = "sha256-w2wo0jk+1BdEkNwfSZRQbebdI4Ac8Kgn0MB0cIMcWU4=";
+      hash = "sha256-4VT909AB+ti5HzQvsaZWNY6MS/GItlVEFH9qeZnUuKQ=";
     };
     "aarch64-darwin" = fetchurl {
       url = "https://storage.googleapis.com/jax-releases/mac/jaxlib-${version}-cp310-cp310-macosx_11_0_arm64.whl";
-      hash = "sha256-7Ir55ZhBkccqfoa56WVBF8QwFAC2ws4KFHDkfVw6zm0=";
+      hash = "sha256-wuOmoCeTldslSa0MommQeTe+RYKhUMam1ZXrgSov+8U=";
     };
     "x86_64-darwin" = fetchurl {
       url = "https://storage.googleapis.com/jax-releases/mac/jaxlib-${version}-cp310-cp310-macosx_10_14_x86_64.whl";
-      hash = "sha256-bOoQI+T+YsTUNA+cDu6wwYTcq9fyyzCpK9qrdCrNVoA=";
+      hash = "sha256-arfiTw8yafJwjRwJhKby2O7y3+4ksh3PjaKW9JgJ1ok=";
     };
   };
 
   gpuSrc = fetchurl {
     url = "https://storage.googleapis.com/jax-releases/cuda11/jaxlib-${version}+cuda11.cudnn82-cp310-cp310-manylinux2014_x86_64.whl";
-    hash = "sha256-rabU62p4fF7Tu/6t8LNYZdf6YO06jGry/JtyFZeamCs=";
+    hash = "sha256-bJ62DdzuPSV311ZI2R/LJQ3fOkDibtz2+8wDKw31FLk=";
   };
 in
 buildPythonPackage rec {
@@ -77,7 +77,13 @@ buildPythonPackage rec {
   # python version.
   disabled = !(pythonVersion == "3.10");
 
-  src = if !cudaSupport then cpuSrcs."${stdenv.hostPlatform.system}" else gpuSrc;
+  # See https://discourse.nixos.org/t/ofborg-does-not-respect-meta-platforms/27019/6.
+  src =
+    if !cudaSupport then
+      (
+        cpuSrcs."${stdenv.hostPlatform.system}"
+          or (throw "jaxlib-bin is not supported on ${stdenv.hostPlatform.system}")
+      ) else gpuSrc;
 
   # Prebuilt wheels are dynamically linked against things that nix can't find.
   # Run `autoPatchelfHook` to automagically fix them.
diff --git a/pkgs/development/python-modules/jaxlib/default.nix b/pkgs/development/python-modules/jaxlib/default.nix
index ae919f66364a..cc4a7fe8b16f 100644
--- a/pkgs/development/python-modules/jaxlib/default.nix
+++ b/pkgs/development/python-modules/jaxlib/default.nix
@@ -52,7 +52,7 @@ let
   inherit (cudaPackages) backendStdenv cudatoolkit cudaFlags cudnn nccl;
 
   pname = "jaxlib";
-  version = "0.3.22";
+  version = "0.4.4";
 
   meta = with lib; {
     description = "JAX is Autograd and XLA, brought together for high-performance machine learning research.";
@@ -137,8 +137,9 @@ let
     src = fetchFromGitHub {
       owner = "google";
       repo = "jax";
-      rev = "${pname}-v${version}";
-      hash = "sha256-bnczJ8ma/UMKhA5MUQ6H4az+Tj+By14ZTG6lQQwptQs=";
+      # google/jax contains tags for jax and jaxlib. Only use jaxlib tags!
+      rev = "refs/tags/${pname}-v${version}";
+      hash = "sha256-DP68UwS9bg243iWU4MLHN0pwl8LaOcW3Sle1ZjsLOHo=";
     };
 
     nativeBuildInputs = [
@@ -242,9 +243,9 @@ let
 
       sha256 =
         if cudaSupport then
-          "sha256-4yu4y4SwSQoeaOz9yojhvCRGSC6jp61ycVDIKyIK/l8="
+          "sha256-cgsiloW77p4+TKRrYequZ/UwKwfO2jsHKtZ+aA30H7E="
         else
-          "sha256-CyRfPfJc600M7VzR3/SQX/EAyeaXRJwDQWot5h2XnFU=";
+          "sha256-D7WYG3YUaWq+4APYx8WpA191VVtoHG0fth3uEHXOeos=";
     };
 
     buildAttrs = {
diff --git a/pkgs/development/python-modules/pydeps/default.nix b/pkgs/development/python-modules/pydeps/default.nix
index 2449ecafb915..579f7600e868 100644
--- a/pkgs/development/python-modules/pydeps/default.nix
+++ b/pkgs/development/python-modules/pydeps/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "pydeps";
-  version = "1.11.2";
+  version = "1.12.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "thebjorn";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-6eiSzuxspWutEKL1pKBeZ0/ZQjS07BpTwgd8dyrePcM=";
+    hash = "sha256-lwQaU7MwFuk+VBCKl4zBNWRFo88/uW2DxXjiZNyuHAg=";
   };
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/tplink-omada-client/default.nix b/pkgs/development/python-modules/tplink-omada-client/default.nix
index 1635195b3306..33fa741bd025 100644
--- a/pkgs/development/python-modules/tplink-omada-client/default.nix
+++ b/pkgs/development/python-modules/tplink-omada-client/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "tplink-omada-client";
-  version = "1.2.3";
+  version = "1.2.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "tplink_omada_client";
     inherit version;
-    hash = "sha256-6c4xWa4XGtnEb3n7oL95oA6bqwaRrHCOn6WCi/xg3Sg=";
+    hash = "sha256-4kvFlk+4GWFRFVIAirg0wKk5se8g+kvmxQ54RiluuoU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/misc/slint-lsp/default.nix b/pkgs/development/tools/misc/slint-lsp/default.nix
index 0ecebde8c244..fcbe98003151 100644
--- a/pkgs/development/tools/misc/slint-lsp/default.nix
+++ b/pkgs/development/tools/misc/slint-lsp/default.nix
@@ -25,14 +25,14 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "slint-lsp";
-  version = "0.3.5";
+  version = "1.0.0";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-7ctzbuBP2AeBCd+/n18EdxIeCK89fCPb1ZbSRjdg8u0=";
+    sha256 = "sha256-Ua8ENLxmfYv6zF/uihT49ZpphFaC3zS882cttJ/rvc4=";
   };
 
-  cargoHash = "sha256-b5zb5YMqCfj8jAXQPQnBp6qTs0OGTrTgsd9bDGzPdus=";
+  cargoHash = "sha256-IzjOAy9zTtsD4jHjI1oVXBg7Si1AeDNH8ATK4yO8WVw=";
 
   nativeBuildInputs = [ cmake pkg-config fontconfig ];
   buildInputs = rpathLibs ++ [ xorg.libxcb.dev ]
diff --git a/pkgs/development/tools/rust/cargo-ndk/default.nix b/pkgs/development/tools/rust/cargo-ndk/default.nix
index 03117e9c1f41..148a35014fd1 100644
--- a/pkgs/development/tools/rust/cargo-ndk/default.nix
+++ b/pkgs/development/tools/rust/cargo-ndk/default.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-ndk";
-  version = "2.12.6";
+  version = "3.0.1";
 
   src = fetchFromGitHub {
     owner = "bbqsrc";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-VGdFIMyZhb7SDWAXgs7kFlblYCO4rLf+3/N7Mashc4o=";
+    sha256 = "sha256-fPN5me8+KrnFR0NkWVxWm8OXZbObUWsYKChldme0qyc=";
   };
 
-  cargoHash = "sha256-pv6t9oKj5tdQjpvBgj/Y11uKJIaIWcaA9ib/Id/s+qs=";
+  cargoHash = "sha256-UEQ+6N7D1/+vhdzYthcTP1YuVEmo5llrpndKuwmrjKc=";
 
   meta = with lib; {
     description = "Cargo extension for building Android NDK projects";
diff --git a/pkgs/games/gcompris/default.nix b/pkgs/games/gcompris/default.nix
index af41da4a3e4f..204f5b3d82e7 100644
--- a/pkgs/games/gcompris/default.nix
+++ b/pkgs/games/gcompris/default.nix
@@ -20,11 +20,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gcompris";
-  version = "3.1";
+  version = "3.2";
 
   src = fetchurl {
     url = "https://download.kde.org/stable/gcompris/qt/src/gcompris-qt-${version}.tar.xz";
-    hash = "sha256-wABGojMfiMgjUT5gVDfB5JmXK1SPkrIkqLT/403zUFI=";
+    hash = "sha256-WopJB9p7GnfCtUoEKxtzzRXCogcx03ofRjGLhkvW0Rs=";
   };
 
   cmakeFlags = [
diff --git a/pkgs/games/vintagestory/default.nix b/pkgs/games/vintagestory/default.nix
index 96c8e5ba7afb..046fbefb4318 100644
--- a/pkgs/games/vintagestory/default.nix
+++ b/pkgs/games/vintagestory/default.nix
@@ -17,11 +17,11 @@
 
 stdenv.mkDerivation rec {
   pname = "vintagestory";
-  version = "1.17.10";
+  version = "1.17.11";
 
   src = fetchurl {
     url = "https://cdn.vintagestory.at/gamefiles/stable/vs_archive_${version}.tar.gz";
-    sha256 = "sha256-1HsWby4Jf+ndE9xsDrS+vELymDedRwSgNiCDLoiPBec=";
+    sha256 = "sha256-iIQRwnJX+7GJcOqXJutInqpSX2fKlPmwFFAq6TqNWWY=";
   };
 
   nativeBuildInputs = [ makeWrapper copyDesktopItems ];
diff --git a/pkgs/misc/lilypond/unstable.nix b/pkgs/misc/lilypond/unstable.nix
index 468cd51439ec..56e6c8db79e8 100644
--- a/pkgs/misc/lilypond/unstable.nix
+++ b/pkgs/misc/lilypond/unstable.nix
@@ -1,10 +1,10 @@
 { lib, fetchurl, lilypond }:
 
 lilypond.overrideAttrs (oldAttrs: rec {
-  version = "2.25.1";
+  version = "2.25.3";
   src = fetchurl {
     url = "https://lilypond.org/download/sources/v${lib.versions.majorMinor version}/lilypond-${version}.tar.gz";
-    sha256 = "sha256-DchY+4+bWIvTZb4v9q/fAqStkbsxHhvty3eur0ZFYVs=";
+    sha256 = "sha256-CVMMzL31NWd6PKf66m0ctBXFpqHMwxQibuifaU9lftg=";
   };
 
   passthru.updateScript = {
diff --git a/pkgs/os-specific/darwin/rectangle/default.nix b/pkgs/os-specific/darwin/rectangle/default.nix
index 884a50dc6434..dcdbdde1fae1 100644
--- a/pkgs/os-specific/darwin/rectangle/default.nix
+++ b/pkgs/os-specific/darwin/rectangle/default.nix
@@ -1,23 +1,37 @@
-{ lib, stdenv, fetchurl, cpio, xar, undmg, ... }:
+{ lib
+, stdenvNoCC
+, fetchurl
+, undmg
+, gitUpdater
+}:
 
-stdenv.mkDerivation rec {
+stdenvNoCC.mkDerivation rec {
   pname = "rectangle";
-  version = "0.67";
+  version = "0.68";
 
   src = fetchurl {
     url = "https://github.com/rxhanson/Rectangle/releases/download/v${version}/Rectangle${version}.dmg";
-    hash = "sha256-tvxGDfpHu86tZt7M055ehEG/lDdmdPmZwrDc2F/yUjk=";
+    hash = "sha256-N1zSMmRo6ux/b16K4Og68A5bfht2WWi7S40Yys3QkTY=";
   };
 
-  sourceRoot = "Rectangle.app";
+  sourceRoot = ".";
 
   nativeBuildInputs = [ undmg ];
 
   installPhase = ''
-    mkdir -p $out/Applications/Rectangle.app
-    cp -R . $out/Applications/Rectangle.app
+    runHook preInstall
+
+    mkdir -p $out/Applications
+    mv Rectangle.app $out/Applications
+
+    runHook postInstall
   '';
 
+  passthru.updateScript = gitUpdater {
+    url = "https://github.com/rxhanson/Rectangle";
+    rev-prefix = "v";
+  };
+
   meta = with lib; {
     description = "Move and resize windows in macOS using keyboard shortcuts or snap areas";
     homepage = "https://rectangleapp.com/";
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 90c02d4491b7..e5620329f795 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -98,7 +98,7 @@
 , withImportd ? !stdenv.hostPlatform.isMusl
 , withKmod ? true
 , withLibBPF ? lib.versionAtLeast buildPackages.llvmPackages.clang.version "10.0"
-    && stdenv.hostPlatform.isAarch -> lib.versionAtLeast stdenv.hostPlatform.parsed.cpu.version "6" # assumes hard floats
+    && (stdenv.hostPlatform.isAarch -> lib.versionAtLeast stdenv.hostPlatform.parsed.cpu.version "6") # assumes hard floats
     && !stdenv.hostPlatform.isMips64   # see https://github.com/NixOS/nixpkgs/pull/194149#issuecomment-1266642211
 , withLibidn2 ? true
 , withLocaled ? true
diff --git a/pkgs/servers/akkoma/akkoma-fe/default.nix b/pkgs/servers/akkoma/akkoma-fe/default.nix
index 9b6dbdce521c..b4a91a36b5d5 100644
--- a/pkgs/servers/akkoma/akkoma-fe/default.nix
+++ b/pkgs/servers/akkoma/akkoma-fe/default.nix
@@ -7,14 +7,14 @@
 
 stdenv.mkDerivation rec {
   pname = "akkoma-fe";
-  version = "unstable-2023-03-11";
+  version = "unstable-2023-04-14";
 
   src = fetchFromGitea {
     domain = "akkoma.dev";
     owner = "AkkomaGang";
     repo = "akkoma-fe";
-    rev = "85abc622136c2f346f7855824290f6093afe2794";
-    hash = "sha256-EBspufZ92/mLzjdK2R5lpOyrnFataeY/2NabIU0T3Lc=";
+    rev = "9aa64d82c964265133be97b08b0cdf0e75680419";
+    hash = "sha256-WwjpYD8U+JvygPMo8VcQDdsjek3iKbpT18rXSVMPDG8=";
   };
 
   offlineCache = fetchYarnDeps {
diff --git a/pkgs/servers/akkoma/default.nix b/pkgs/servers/akkoma/default.nix
index 56770a4d3535..5c9ae060df78 100644
--- a/pkgs/servers/akkoma/default.nix
+++ b/pkgs/servers/akkoma/default.nix
@@ -9,14 +9,14 @@
 
 beamPackages.mixRelease rec {
   pname = "pleroma";
-  version = "3.7.1";
+  version = "3.8.0";
 
   src = fetchFromGitea {
     domain = "akkoma.dev";
     owner = "AkkomaGang";
     repo = "akkoma";
     rev = "v${version}";
-    hash = "sha256-Ovi2AnfkeCDlv3INomPxu8R1ARexOzZHC8dOLucrDaQ=";
+    hash = "sha256-KpaJ2xx3XEibMv1G8o9Lw7+LcnxPCUiWlmdcoi5wklQ=";
   };
 
   postPatch = ''
diff --git a/pkgs/servers/akkoma/mix.nix b/pkgs/servers/akkoma/mix.nix
index 95186f6758d0..0e88bf4a1a88 100644
--- a/pkgs/servers/akkoma/mix.nix
+++ b/pkgs/servers/akkoma/mix.nix
@@ -348,12 +348,12 @@ let
 
     ecto = buildMix rec {
       name = "ecto";
-      version = "3.9.4";
+      version = "3.9.5";
 
       src = fetchHex {
         pkg = "${name}";
         version = "${version}";
-        sha256 = "0xgfz1pzylj22k0qa8zh4idvd4139b1lwnmq33na8fia2j69hpyy";
+        sha256 = "0k5p40cy6zxi3wm885amf78724zvb5a8chmpljzw1kdsiifi3wyl";
       };
 
       beamDeps = [ decimal jason telemetry ];
@@ -478,12 +478,12 @@ let
 
     ex_doc = buildMix rec {
       name = "ex_doc";
-      version = "0.29.2";
+      version = "0.29.3";
 
       src = fetchHex {
         pkg = "${name}";
         version = "${version}";
-        sha256 = "1bq37vm5sc46k75n1m6h1n42r3czj957xqjh68z7b2m1xlwp2pbb";
+        sha256 = "1qdzflf1lbi5phg2vs8p3aznz0p8wmmx56qynp1ix008gdypiiix";
       };
 
       beamDeps = [ earmark_parser makeup_elixir makeup_erlang ];
@@ -1076,12 +1076,12 @@ let
 
     phoenix_live_view = buildMix rec {
       name = "phoenix_live_view";
-      version = "0.18.17";
+      version = "0.18.18";
 
       src = fetchHex {
         pkg = "${name}";
         version = "${version}";
-        sha256 = "0f6f7m2naw85qgzh3bsrnwy7l1lwffsbmx3s7g4qv6x234773dgl";
+        sha256 = "052jv2kbc2nb4qs4ly4idcai6q8wyfkvv59adpg9w67kf820v0d5";
       };
 
       beamDeps = [ jason phoenix phoenix_html phoenix_template phoenix_view telemetry ];
@@ -1141,12 +1141,12 @@ let
 
     plug = buildMix rec {
       name = "plug";
-      version = "1.14.0";
+      version = "1.14.2";
 
       src = fetchHex {
         pkg = "${name}";
         version = "${version}";
-        sha256 = "056wkb1b17mh5h9ncs2vbswvpjsm2iqc580nmyrvgznlqwr080mz";
+        sha256 = "04wdyv6nma74bj1m49vkm2bc5mjf8zclfg957fng8g71hw0wabw4";
       };
 
       beamDeps = [ mime plug_crypto telemetry ];
@@ -1154,12 +1154,12 @@ let
 
     plug_cowboy = buildMix rec {
       name = "plug_cowboy";
-      version = "2.6.0";
+      version = "2.6.1";
 
       src = fetchHex {
         pkg = "${name}";
         version = "${version}";
-        sha256 = "19jgv5dm53hv5aqgxxzr3fnrpgfll9ics199swp6iriwfl5z4g07";
+        sha256 = "04v6xc4v741dr2y38j66fmcc4xc037dnaxzkj2vih6j53yif2dny";
       };
 
       beamDeps = [ cowboy cowboy_telemetry plug ];
@@ -1167,12 +1167,12 @@ let
 
     plug_crypto = buildMix rec {
       name = "plug_crypto";
-      version = "1.2.4";
+      version = "1.2.5";
 
       src = fetchHex {
         pkg = "${name}";
         version = "${version}";
-        sha256 = "1k0sx7c64icxcvgvccnpcszqrjg9a75i535ym6flvjdf7zq1br2d";
+        sha256 = "0hnqgzc3zas7j7wycgnkkdhaji5farkqccy2n4p1gqj5ccfrlm16";
       };
 
       beamDeps = [];
@@ -1453,12 +1453,12 @@ let
 
     timex = buildMix rec {
       name = "timex";
-      version = "3.7.9";
+      version = "3.7.11";
 
       src = fetchHex {
         pkg = "${name}";
         version = "${version}";
-        sha256 = "1q8chs28k5my6nzzm61rhc2l9wkhzfn0kiqzf87i71xvwn11asb4";
+        sha256 = "1anijimbrb3ngdy6fdspr8c9hz6dip7nakx0gayzkfmsxzvj944b";
       };
 
       beamDeps = [ combine gettext tzdata ];
diff --git a/pkgs/tools/admin/auth0-cli/default.nix b/pkgs/tools/admin/auth0-cli/default.nix
index 0509173650de..b21f5eb4ad47 100644
--- a/pkgs/tools/admin/auth0-cli/default.nix
+++ b/pkgs/tools/admin/auth0-cli/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "auth0-cli";
-  version = "0.13.1";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "auth0";
     repo = "auth0-cli";
     rev = "v${version}";
-    hash = "sha256-FotjdMbQXDwkURSeye86sIFN60V//UlF7kZrwfkvTGY=";
+    hash = "sha256-Zrv9Dj4TqMEgnWYNvBUbrPS6Ab23AkCn66hclPKH224=";
   };
 
-  vendorHash = "sha256-2lu8mlADpTjp11S/chz9Ow5W5dw5l6llitJxamNiyLg=";
+  vendorHash = "sha256-MGMmWCe2LVIpK7O1e90Nvahbnu5sm9vK/4s0lPPpl1g=";
 
   ldflags = [
     "-s" "-w"
diff --git a/pkgs/tools/filesystems/securefs/add-macfuse-support.patch b/pkgs/tools/filesystems/securefs/add-macfuse-support.patch
deleted file mode 100644
index 217f637ff9db..000000000000
--- a/pkgs/tools/filesystems/securefs/add-macfuse-support.patch
+++ /dev/null
@@ -1,188 +0,0 @@
-From 8c65c2219976c02a68e27c28156ec0c4c02857e0 Mon Sep 17 00:00:00 2001
-From: midchildan <git@midchildan.org>
-Date: Sun, 28 Mar 2021 23:39:59 +0900
-Subject: [PATCH] Support the latest FUSE on macOS
-
-This drops osxfuse support in favor of macFUSE. macFUSE is a newer
-version of osxfuse that supports the latest release of macOS, and is a
-rebranded version of the same project.
----
- CMakeLists.txt             |  8 ++----
- LICENSE.md                 | 58 ++++++++++++++++++++------------------
- README.md                  |  2 +-
- sources/commands.cpp       |  6 ----
- 4 files changed, 33 insertions(+), 41 deletions(-)
-
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 7b5e57d..c176554 100755
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -18,12 +18,8 @@ git_describe(GIT_VERSION --tags)
- configure_file(${CMAKE_SOURCE_DIR}/sources/git-version.cpp.in ${CMAKE_BINARY_DIR}/git-version.cpp)
- 
- if (UNIX)
--    find_path(FUSE_INCLUDE_DIR fuse.h PATHS /usr/local/include PATH_SUFFIXES osxfuse)
--    if (APPLE)
--        find_library(FUSE_LIBRARIES osxfuse PATHS /usr/local/lib)
--    else()
--        find_library(FUSE_LIBRARIES fuse PATHS /usr/local/lib)
--    endif()
-+    find_path(FUSE_INCLUDE_DIR fuse.h PATHS /usr/local/include)
-+    find_library(FUSE_LIBRARIES fuse PATHS /usr/local/lib)
-     include_directories(${FUSE_INCLUDE_DIR})
-     link_libraries(${FUSE_LIBRARIES})
-     add_compile_options(-Wall -Wextra -Wno-unknown-pragmas)
-diff --git a/LICENSE.md b/LICENSE.md
-index a8f920c..b134532 100644
---- a/LICENSE.md
-+++ b/LICENSE.md
-@@ -758,13 +758,11 @@ Public License instead of this License.
- 
- ------------------------------------------------------------------------------
- 
--# [osxfuse] (https://github.com/osxfuse/osxfuse)
-+# [macFUSE] (https://github.com/osxfuse/osxfuse)
- 
--FUSE for macOS is a software developed by the osxfuse project and is covered
--under the following BSD-style license:
-+macFUSE is covered under the following license:
- 
--  Copyright (c) 2011-2016 Benjamin Fleischer
--  Copyright (c) 2011-2012 Erik Larsson
-+  Copyright (c) 2011-2021 Benjamin Fleischer
-   All rights reserved.
- 
-   Redistribution  and  use  in  source  and  binary  forms,  with   or   without
-@@ -775,9 +773,13 @@ under the following BSD-style license:
-   2. Redistributions in binary form must reproduce the above  copyright  notice,
-      this list of conditions and the following disclaimer in  the  documentation
-      and/or other materials provided with the distribution.
--  3. Neither the name of osxfuse nor the names of its contributors may  be  used
--     to endorse or promote products derived from this software without  specific
--     prior written permission.
-+  3. Neither the name of the copyright holder nor the names of its  contributors
-+     may be used to endorse or  promote  products  derived  from  this  software 
-+     without specific prior written permission.
-+  4. Redistributions in binary form, bundled with commercial software,  are  not
-+     allowed without  specific  prior  written  permission.  This  includes  the
-+     automated download or installation or  both  of  the  binary  form  in  the
-+     context of commercial software.
- 
-   THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND  CONTRIBUTORS  "AS  IS"
-   AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING,  BUT  NOT  LIMITED  TO,  THE
-@@ -791,9 +793,9 @@ under the following BSD-style license:
-   ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN  IF  ADVISED  OF  THE
-   POSSIBILITY OF SUCH DAMAGE.
- 
--FUSE for macOS is a fork of MacFUSE. MacFUSE has been developed by Google Inc..
--Additional information and the original source of MacFUSE are available on
--http://code.google.com/p/macfuse/. MacFUSE is covered under the following
-+macFUSE is a fork of the legacy Google MacFUSE software. Additional information
-+and the original source code of Google MacFUSE are available on
-+http://code.google.com/p/macfuse/. Google MacFUSE is covered under the following
- BSD-style license:
- 
-   Copyright (c) 2007—2009 Google Inc.
-@@ -830,9 +832,9 @@ BSD-style license:
- Portions of this package were derived from code developed by other authors.
- Please read further for specific details.
- 
--* Unless otherwise noted, parts of the FUSE for macOS kernel extension contain
--  code derived from the FreeBSD version of FUSE, which is covered under the
--  following BSD-style license:
-+* Unless otherwise noted, parts of the macFUSE kernel extension contain code
-+  derived from the FreeBSD version of FUSE, which is covered under the following
-+  BSD-style license:
- 
-     Copyright (C) 2005 Csaba Henk. All rights reserved.
- 
-@@ -856,12 +858,13 @@ Please read further for specific details.
-     (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT  OF  THE  USE  OF
-     THIS  SOFTWARE,  EVEN  IF  ADVISED  OF  THE  POSSIBILITY  OF  SUCH   DAMAGE.
- 
--* Parts of the FUSE for macOS kernel extension contain code derived from Tuxera
--  Inc.'s "rebel" branch. The original source of the "rebel" branch is available
--  on https://github.com/tuxera. These modifications are covered under the
--  following BSD-style license:
-+* Parts of the macFUSE kernel extension contain code derived from Tuxera's
-+  "rebel" branch. The original source code of the "rebel" branch is available on
-+  https://github.com/tuxera. These modifications are covered under the following
-+  BSD-style license:
- 
-     Copyright (c) 2010 Tuxera Inc.
-+    Copyright (c) 2011-2012 Erik Larsson
-     All rights reserved.
- 
-     Redistribution  and  use  in  source  and  binary  forms,  with  or  without
-@@ -888,9 +891,9 @@ Please read further for specific details.
-     ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED  OF  THE
-     POSSIBILITY OF SUCH DAMAGE.
- 
--* Parts of FUSE for macOS contain code derived from Fuse4X. The original source
--  of Fuse4X is available on https://github.com/fuse4x. Fuse4X is covered under
--  the following BSD-style license:
-+* Parts of macFUSE contain code derived from Fuse4X. The original source code of
-+  Fuse4X is available on https://github.com/fuse4x. Fuse4X is covered under the
-+  following BSD-style license:
- 
-     Copyright (c) 2011 Anatol Pomozov
-     All rights reserved.
-@@ -916,21 +919,20 @@ Please read further for specific details.
-     ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED  OF  THE
-     POSSIBILITY OF SUCH DAMAGE.
- 
--* Parts of the mount_osxfuse command-line program are covered under the Apple
-+* Parts of the mount_macfuse command-line program are covered under the Apple
-   Public Source License (APSL). You can read the APSL at:
- 
-     http://www.opensource.apple.com/license/apsl/
- 
--* fuse_kernel.h is an unmodified copy of the interface header from the Linux
-+* fuse_kernel.h is a modified copy of the interface header from the Linux
-   FUSE distribution (https://github.com/libfuse/libfuse). fuse_kernel.h can be
-   redistributed either under the GPL or under the BSD license. It is being
-   redistributed here under the BSD license.
- 
--* fuse_nodehash.c is a slightly modified version of HashNode.c from an
--  Apple Developer Technical Support (DTS) sample code example. The original
--  source, which is available on
--  http://developer.apple.com/library/mac/#samplecode/MFSLives/, has the
--  following disclaimer:
-+* fuse_nodehash.c is a modified version of HashNode.c from an Apple Developer
-+  Technical Support (DTS) sample code example. The original source, which is
-+  available on http://developer.apple.com/library/mac/#samplecode/MFSLives/,
-+  has the following disclaimer:
- 
-     Disclaimer: IMPORTANT: This Apple software  is  supplied  to  you  by  Apple
-     Computer, Inc.  Apple") in consideration of your agreement to the  following
-diff --git a/README.md b/README.md
-index 9085e96..6fe3592 100644
---- a/README.md
-+++ b/README.md
-@@ -28,7 +28,7 @@ There are already many encrypting filesystem in widespread use. Some notable one
- 
- ### macOS
- 
--Install with [Homebrew](https://brew.sh). [osxfuse](https://osxfuse.github.io) has to be installed beforehand.
-+Install with [Homebrew](https://brew.sh). [macFUSE](https://osxfuse.github.io) has to be installed beforehand.
- ```
- brew install securefs
- ```
-diff --git a/sources/commands.cpp b/sources/commands.cpp
-index a371212..862602b 100644
---- a/sources/commands.cpp
-+++ b/sources/commands.cpp
-@@ -1252,12 +1252,6 @@ class VersionCommand : public CommandBase
-                 printf("WinFsp %u.%u\n", vn >> 16, vn & 0xFFFFu);
-             }
-         }
--#elif defined(__APPLE__)
--        typedef const char* version_function(void);
--        auto osx_version_func
--            = reinterpret_cast<version_function*>(::dlsym(RTLD_DEFAULT, "osxfuse_version"));
--        if (osx_version_func)
--            printf("osxfuse %s\n", osx_version_func());
- #else
-         typedef int version_function(void);
-         auto fuse_version_func
-
diff --git a/pkgs/tools/filesystems/securefs/default.nix b/pkgs/tools/filesystems/securefs/default.nix
index 5fad07d87b73..791c01d8eed8 100644
--- a/pkgs/tools/filesystems/securefs/default.nix
+++ b/pkgs/tools/filesystems/securefs/default.nix
@@ -1,29 +1,22 @@
-{ lib, stdenv, fetchFromGitHub
+{ lib
+, stdenv
+, fetchFromGitHub
 , cmake
-, fuse }:
+, fuse
+}:
 
 stdenv.mkDerivation rec {
   pname = "securefs";
-  version = "0.11.1";
+  version = "0.13.1";
 
   src = fetchFromGitHub {
-    sha256 = "1sxfgqgy63ml7vg7zj3glvra4wj2qmfv9jzmpm1jqy8hq7qlqlsx";
-    rev = version;
-    repo = "securefs";
     owner = "netheril96";
+    repo = "securefs";
+    rev = version;
     fetchSubmodules = true;
+    hash = "sha256-7xjGuN7jcLgfGkaBoSj+WsBpM806PPGzeBs7DnI+fwc=";
   };
 
-  patches = [
-    # Make it build with macFUSE
-    # Backported from https://github.com/netheril96/securefs/pull/114
-    ./add-macfuse-support.patch
-  ];
-
-  postPatch = ''
-    sed -i -e '/TEST_SOURCES/d' CMakeLists.txt
-  '';
-
   nativeBuildInputs = [ cmake ];
   buildInputs = [ fuse ];
 
@@ -42,7 +35,5 @@ stdenv.mkDerivation rec {
     '';
     license = with licenses; [ bsd2 mit ];
     platforms = platforms.unix;
-    # never built on aarch64-darwin since first introduction in nixpkgs
-    broken = stdenv.isDarwin && stdenv.isAarch64;
   };
 }
diff --git a/pkgs/tools/misc/mmctl/default.nix b/pkgs/tools/misc/mmctl/default.nix
index a708e9e694eb..16b142d76cb5 100644
--- a/pkgs/tools/misc/mmctl/default.nix
+++ b/pkgs/tools/misc/mmctl/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "mmctl";
-  version = "7.5.2";
+  version = "7.10.0";
 
   src = fetchFromGitHub {
     owner = "mattermost";
     repo = "mmctl";
     rev = "v${version}";
-    sha256 = "sha256-qBt7YL4u/gt7pPjqXLvjtTH6Dhr3udcqAD1/VjxyJPg=";
+    sha256 = "sha256-ptkpPwTSoWZhcPAFfBhB73F/eubzzeGPI99K/K3ZT64=";
   };
 
-  vendorSha256 = null;
+  vendorHash = null;
 
   checkPhase = "make test";
 
diff --git a/pkgs/tools/misc/steampipe/default.nix b/pkgs/tools/misc/steampipe/default.nix
index 6968fff13e7d..ad4fdb58f714 100644
--- a/pkgs/tools/misc/steampipe/default.nix
+++ b/pkgs/tools/misc/steampipe/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "steampipe";
-  version = "0.19.3";
+  version = "0.19.4";
 
   src = fetchFromGitHub {
     owner = "turbot";
     repo = "steampipe";
     rev = "v${version}";
-    sha256 = "sha256-RbtIDgTVS/vtYQpbTQ7Yl7oBtC8c6D9Pns9SdEjUsmI=";
+    sha256 = "sha256-VfSCm+p702HgFgiKRjcRHiBOd6Dx9ld8T27U9jmuC+8=";
   };
 
   vendorHash = "sha256-XrEdaNLG46BwMEF/vhAk9+A6vH4mpbtH7vWXd01Y7ME=";
diff --git a/pkgs/tools/networking/ghz/default.nix b/pkgs/tools/networking/ghz/default.nix
index da554b5a21a9..bebc2626652a 100644
--- a/pkgs/tools/networking/ghz/default.nix
+++ b/pkgs/tools/networking/ghz/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "ghz";
-  version = "0.111.0";
+  version = "0.115.0";
 
   src = fetchFromGitHub {
     owner = "bojand";
     repo = "ghz";
     rev = "v${version}";
-    sha256 = "sha256-FXehWUdFHsWYF/WXrJtmoDIb0Smh3D4aSJS8aOpvoxg=";
+    sha256 = "sha256-Y/RvXBE2+ztAPJrSBek1APkN7F3LIWAz13TGQUgFzR0=";
   };
 
-  vendorSha256 = "sha256-VjrSUP0SwE5iOTevqIGlnSjH+TV4Ajx/PKuco9etkSc=";
+  vendorHash = "sha256-BTfdKH2FBfIeHOG4dhOopoPQWHjhlJstQWWOkMwEOGs=";
 
   subPackages = [ "cmd/ghz" "cmd/ghz-web" ];
 
diff --git a/pkgs/tools/security/cloudlist/default.nix b/pkgs/tools/security/cloudlist/default.nix
index fb9a420e3680..d9f97553b0f6 100644
--- a/pkgs/tools/security/cloudlist/default.nix
+++ b/pkgs/tools/security/cloudlist/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "cloudlist";
-  version = "1.0.1";
+  version = "1.0.3";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-CYEQ+hHFKSHuW2U//59g+oHkxRzVOZzipkOB6KueHvA=";
+    sha256 = "sha256-PWOC+Y+tCr5LqWJpSVoIeOquO2vMb06KW25pBEER3Ys=";
   };
 
-  vendorSha256 = "sha256-pZsRpvSDGpfEVgszB52cZS5Kk+REeLnw3qsyGGVZoa0=";
+  vendorHash = "sha256-FesvXH29thy6B9VXZnuvllJ+9VQR4i6q1JzrULaU82s=";
 
   meta = with lib; {
     description = "Tool for listing assets from multiple cloud providers";
diff --git a/pkgs/tools/security/cyclonedx-gomod/default.nix b/pkgs/tools/security/cyclonedx-gomod/default.nix
index 95bb35259aa3..5385fd19c8ac 100644
--- a/pkgs/tools/security/cyclonedx-gomod/default.nix
+++ b/pkgs/tools/security/cyclonedx-gomod/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "cyclonedx-gomod";
-  version = "1.3.0";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "CycloneDX";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-jUTSPsnGStP4aPfYS4kWiFiIEDnGkfg1Zm4EX+eD4Wo=";
+    hash = "sha256-GCRLOfrL1jFExGb5DbJa8s7RQv8Wn81TGktShZqeC54=";
   };
 
-  vendorHash = "sha256-ZiIift8On6vpu8IKI/GD3WFaFb2Xd54t8FJJqwR4tsM=";
+  vendorHash = "sha256-gFewqutvkFc/CVpBD3ORGcfiG5UNh5tQ1ElHpM3g5+I=";
 
   # Tests require network access and cyclonedx executable
   doCheck = false;
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 9d319aa08856..6007e7db8585 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1877,6 +1877,7 @@ mapAliases ({
     inherit (stdenvAdapters) overrideCC;
     buildLlvmTools = buildPackages.llvmPackages_git.tools;
     targetLlvmLibraries = targetPackages.llvmPackages_git.libraries or llvmPackages_git.libraries;
+    targetLlvm = targetPackages.llvmPackages_git.llvm or llvmPackages_git.llvm;
   });
 
   # Added 2022-01-28
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 8a19105bc8d0..a38548ffc593 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -12030,9 +12030,7 @@ with pkgs;
 
   secp256k1 = callPackage ../tools/security/secp256k1 { };
 
-  securefs = callPackage ../tools/filesystems/securefs {
-    stdenv = clangStdenv;
-  };
+  securefs = darwin.apple_sdk_11_0.callPackage ../tools/filesystems/securefs { };
 
   seehecht = callPackage ../tools/text/seehecht { };