diff --git a/pkgs/applications/audio/mopidy/default.nix b/pkgs/applications/audio/mopidy/default.nix
index 645817a90616..053be90621d7 100644
--- a/pkgs/applications/audio/mopidy/default.nix
+++ b/pkgs/applications/audio/mopidy/default.nix
@@ -37,6 +37,8 @@ lib.makeScope newScope (self: with self; {
 
   mopidy-soundcloud = callPackage ./soundcloud.nix { };
 
+  mopidy-tidal = callPackage ./tidal.nix { };
+
   mopidy-tunein = callPackage ./tunein.nix { };
 
   mopidy-youtube = callPackage ./youtube.nix { };
diff --git a/pkgs/applications/audio/mopidy/tidal.nix b/pkgs/applications/audio/mopidy/tidal.nix
new file mode 100644
index 000000000000..1264e5963a90
--- /dev/null
+++ b/pkgs/applications/audio/mopidy/tidal.nix
@@ -0,0 +1,35 @@
+{ lib
+, python3Packages
+, mopidy
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "Mopidy-Tidal";
+  version = "0.3.2";
+
+  src = python3Packages.fetchPypi {
+    inherit pname version;
+    hash = "sha256-ekqhzKyU2WqTOeRR1ZSZA9yW3UXsLBsC2Bk6FZrQgmc=";
+  };
+
+  propagatedBuildInputs = [
+    mopidy
+    python3Packages.tidalapi
+  ];
+
+  checkInputs = with python3Packages; [
+    pytestCheckHook
+    pytest-mock
+  ];
+
+  pytestFlagsArray = [ "tests/" ];
+
+  meta = with lib; {
+    description = "Mopidy extension for playing music from Tidal";
+    homepage = "https://github.com/tehkillerbee/mopidy-tidal";
+    license = licenses.mit;
+    maintainers = [ maintainers.rodrgz ];
+  };
+}
+
+
diff --git a/pkgs/applications/misc/eaglemode/default.nix b/pkgs/applications/misc/eaglemode/default.nix
index 056f3a4606ba..02455cf8f20e 100644
--- a/pkgs/applications/misc/eaglemode/default.nix
+++ b/pkgs/applications/misc/eaglemode/default.nix
@@ -1,5 +1,6 @@
-{ lib, stdenv, fetchurl, perl, libX11, libXinerama, libjpeg, libpng, libtiff, libwebp, pkg-config,
-librsvg, glib, gtk2, libXext, libXxf86vm, poppler, vlc, ghostscript, makeWrapper, tzdata }:
+{ lib, stdenv, fetchurl, perl, libX11, libXinerama, libjpeg, libpng, libtiff
+, libwebp, pkg-config, librsvg, glib, gtk2, libXext, libXxf86vm, poppler, vlc
+, ghostscript, makeWrapper, tzdata, makeDesktopItem, copyDesktopItems }:
 
 stdenv.mkDerivation rec {
   pname = "eaglemode";
@@ -15,15 +16,17 @@ stdenv.mkDerivation rec {
     substituteInPlace src/emClock/emTimeZonesModel.cpp --replace "/usr/share/zoneinfo" "${tzdata}/share/zoneinfo"
   '';
 
-  nativeBuildInputs = [ pkg-config makeWrapper ];
+  nativeBuildInputs = [ pkg-config makeWrapper copyDesktopItems ];
   buildInputs = [ perl libX11 libXinerama libjpeg libpng libtiff libwebp
     librsvg glib gtk2 libXxf86vm libXext poppler vlc ghostscript ];
 
   # The program tries to dlopen Xxf86vm, Xext and Xinerama, so we use the
   # trick on NIX_LDFLAGS and dontPatchELF to make it find them.
   buildPhase = ''
+    runHook preBuild
     export NIX_LDFLAGS="$NIX_LDFLAGS -lXxf86vm -lXext -lXinerama"
     perl make.pl build
+    runHook postBuild
   '';
 
   dontPatchELF = true;
@@ -31,16 +34,33 @@ stdenv.mkDerivation rec {
   forceShare = [ "man" "info" ];
 
   installPhase = ''
+    runHook preInstall
     perl make.pl install dir=$out
     wrapProgram $out/bin/eaglemode --set EM_DIR "$out" --prefix LD_LIBRARY_PATH : "$out/lib" --prefix PATH : "${ghostscript}/bin"
+    for i in 32 48 96; do
+      mkdir -p $out/share/icons/hicolor/''${i}x''${i}/apps
+      ln -s $out/res/icons/${pname}$i.png $out/share/icons/hicolor/''${i}x''${i}/apps/${pname}.png
+    done
+    runHook postInstall
   '';
 
+  desktopItems = [
+    (makeDesktopItem {
+      name = pname;
+      exec = pname;
+      icon = pname;
+      desktopName = "Eagle Mode";
+      genericName = meta.description;
+      categories = [ "Game" "Graphics" "System" "Utility" ];
+    })
+  ];
+
   meta = with lib; {
     homepage = "http://eaglemode.sourceforge.net";
     description = "Zoomable User Interface";
     changelog = "https://eaglemode.sourceforge.net/ChangeLog.html";
     license = licenses.gpl3;
-    maintainers = with maintainers; [ chuangzhu ];
+    maintainers = with maintainers; [ chuangzhu ehmry ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/applications/networking/browsers/chromium/default.nix b/pkgs/applications/networking/browsers/chromium/default.nix
index 1511459058d7..c4f2257d1b2a 100644
--- a/pkgs/applications/networking/browsers/chromium/default.nix
+++ b/pkgs/applications/networking/browsers/chromium/default.nix
@@ -197,6 +197,9 @@ in stdenv.mkDerivation {
       export CHROME_DEVEL_SANDBOX="$sandbox/bin/${sandboxExecutableName}"
     fi
 
+    # Make generated desktop shortcuts have a valid executable name.
+    export CHROME_WRAPPER='chromium'
+
   '' + lib.optionalString (libPath != "") ''
     # To avoid loading .so files from cwd, LD_LIBRARY_PATH here must not
     # contain an empty section before or after a colon.
diff --git a/pkgs/applications/networking/cluster/helm/default.nix b/pkgs/applications/networking/cluster/helm/default.nix
index 609113c72211..a7508491a2da 100644
--- a/pkgs/applications/networking/cluster/helm/default.nix
+++ b/pkgs/applications/networking/cluster/helm/default.nix
@@ -2,15 +2,15 @@
 
 buildGoModule rec {
   pname = "kubernetes-helm";
-  version = "3.10.3";
+  version = "3.11.0";
 
   src = fetchFromGitHub {
     owner = "helm";
     repo = "helm";
     rev = "v${version}";
-    sha256 = "sha256-SUPa6bbops2rrzzzYM5fH0l4DT7/rIkOqc396lTesao=";
+    sha256 = "sha256-Pes1p7rTO17Bef6qacsQWJkhb1CWilzmVYQe886EepU=";
   };
-  vendorSha256 = "sha256-vyHT/N5lat/vqM2jK4Q+jJOtZpS52YCYGcJqfa5e0KM=";
+  vendorSha256 = "sha256-LRMDrBSl5EGQqQt5FUU4JJHqdwfYt5qsVpe76jUQBVI=";
 
   subPackages = [ "cmd/helm" ];
   ldflags = [
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 107e83c4cad2..bb84ad69104c 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -66,13 +66,13 @@
     "vendorHash": "sha256-OAd8SeTqTrH0kMoM2LsK3vM2PI23b3gl57FaJYM9hM0="
   },
   "archive": {
-    "hash": "sha256-EzqsTJwjDQ6pIQxdGPOTbNom0RDurAGT0eJmuwAzO4Y=",
+    "hash": "sha256-GHHhIfBFlc5LlwsDLvpVhlJd5Fp4X2tU26h9PYjgz4Y=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/archive",
     "owner": "hashicorp",
     "repo": "terraform-provider-archive",
-    "rev": "v2.2.0",
+    "rev": "v2.3.0",
     "spdx": "MPL-2.0",
-    "vendorHash": null
+    "vendorHash": "sha256-DqAHkNxfI1txtW9PadHzgWuRCiuV/CVqq/qba+e0O7M="
   },
   "argocd": {
     "hash": "sha256-8gyNJrRmrLev53dmMMjpZ3COTwPg5FYaxYBgkrdAWXo=",
@@ -816,11 +816,11 @@
     "vendorHash": "sha256-LRIfxQGwG988HE5fftGl6JmBG7tTknvmgpm4Fu1NbWI="
   },
   "oci": {
-    "hash": "sha256-QnDamqv8Vo4MjUE15QQH75v3C6CpMBTzlJzq/EbSZ3E=",
+    "hash": "sha256-nky2PxHA9TznFh6IGrx3UvOuwrGPnQID04qlDQ4/rm4=",
     "homepage": "https://registry.terraform.io/providers/oracle/oci",
     "owner": "oracle",
     "repo": "terraform-provider-oci",
-    "rev": "v4.103.0",
+    "rev": "v4.104.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
diff --git a/pkgs/applications/networking/p2p/mldonkey/default.nix b/pkgs/applications/networking/p2p/mldonkey/default.nix
index 6c5ebdb91335..fda9d87681a9 100644
--- a/pkgs/applications/networking/p2p/mldonkey/default.nix
+++ b/pkgs/applications/networking/p2p/mldonkey/default.nix
@@ -15,6 +15,11 @@ stdenv.mkDerivation rec {
       url = "https://github.com/ygrek/mldonkey/pull/66/commits/20ff84c185396f3d759cf4ef46b9f0bd33a51060.patch";
       hash = "sha256-MCqx0jVfOaLkZhhv0b1cTdO6BK2/f6TxTWmx+NZjXME=";
     })
+    # Fixes OCaml 4.12 compat
+    (fetchpatch {
+      url = "https://github.com/ygrek/mldonkey/commit/a153f0f7a4826d86d51d4bacedc0330b70fcbc34.patch";
+      hash = "sha256-/Muk3mPFjQJ48FqaozGa7o8YSPhDLXRz9K1EyfxlzC8=";
+    })
   ];
 
   preConfigure = ''
diff --git a/pkgs/applications/version-management/git-nomad/default.nix b/pkgs/applications/version-management/git-nomad/default.nix
index 04ba2ca849a6..50d2b117ba55 100644
--- a/pkgs/applications/version-management/git-nomad/default.nix
+++ b/pkgs/applications/version-management/git-nomad/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, rustPlatform, fetchFromGitHub, SystemConfiguration }:
+{ lib, rustPlatform, fetchFromGitHub, stdenv, darwin, git }:
 
 rustPlatform.buildRustPackage rec {
   pname = "git-nomad";
@@ -11,13 +11,20 @@ rustPlatform.buildRustPackage rec {
     sha256 = "sha256-1PXAdXafkPOIVzaWjW/RlWHwYhMqPoj0Hj5JmOMUj8A=";
   };
 
-  buildInputs = lib.optionals stdenv.isDarwin [ SystemConfiguration ];
-
   cargoHash = "sha256-ULcdJRla1JwI0y6ngW9xQXjNw2wO48HuAczsNIsJJK0=";
 
+  buildInputs = lib.optionals stdenv.isDarwin [
+    darwin.apple_sdk.frameworks.SystemConfiguration
+  ];
+
+  checkInputs = [
+    git
+  ];
+
   meta = with lib; {
     description = "Synchronize work-in-progress git branches in a light weight fashion";
     homepage = "https://github.com/rraval/git-nomad";
+    changelog = "https://github.com/rraval/git-nomad/blob/v${version}/CHANGELOG.md";
     license = licenses.mit;
     maintainers = with maintainers; [ rraval ];
   };
diff --git a/pkgs/applications/video/mpv/scripts/thumbnail.nix b/pkgs/applications/video/mpv/scripts/thumbnail.nix
index a08bce6699fa..60b392a6aa27 100644
--- a/pkgs/applications/video/mpv/scripts/thumbnail.nix
+++ b/pkgs/applications/video/mpv/scripts/thumbnail.nix
@@ -2,13 +2,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "mpv-thumbnail-script";
-  version = "0.5.1";
+  version = "0.5.2";
 
   src = fetchFromGitHub {
     owner = "marzzzello";
     repo = "mpv_thumbnail_script";
     rev = version;
-    sha256 = "sha256-0nqV8vY3cBOJkLRoQ33Cc+4+vSK45i9yWbhKiQIuVSw=";
+    sha256 = "sha256-6J1eeuSYyUJmWLIl9WsQ4NzQOBJNO3Cnl5jcPEal4vM=";
   };
 
   nativeBuildInputs = [ python3 ];
@@ -29,6 +29,7 @@ stdenvNoCC.mkDerivation rec {
   meta = with lib; {
     description = "A lua script to show preview thumbnails in mpv's OSC seekbar";
     homepage = "https://github.com/marzzzello/mpv_thumbnail_script";
+    changelog = "https://github.com/marzzzello/mpv_thumbnail_script/releases/tag/${version}";
     license = licenses.gpl3Plus;
     platforms = platforms.all;
     maintainers = with maintainers; [ figsoda ];
diff --git a/pkgs/data/fonts/nerdfonts/shas.nix b/pkgs/data/fonts/nerdfonts/shas.nix
index ef4e42a5a729..e7ea24935d97 100644
--- a/pkgs/data/fonts/nerdfonts/shas.nix
+++ b/pkgs/data/fonts/nerdfonts/shas.nix
@@ -1,55 +1,55 @@
 {
-  "3270" = "0k33cnwbsi9wkrmfm4ps455gg81ihlldmk5mk4k9p7bkvxzcgpb9";
-  "Agave" = "1xnhl8idwx1ivj8k1dnz1ca4k1cx2irbazavr1b2zlixxbjq2vhq";
-  "AnonymousPro" = "01ab38j5wnkjjfh91van4p7s3qb0rmdbcah9njmxj7swqr30q66r";
-  "Arimo" = "0p3dh1sgpq1gjlz0blav8j5jf9gsrg4pg63qk0raw3kyzpwp9liq";
-  "AurulentSansMono" = "06hi0xravvpmzww2i233jzf3nrqwkxmmybbpcamwswbgxg2sakc8";
-  "BigBlueTerminal" = "0pizwa8mf2mlzh85zxfy0ns7rk1792fvjgj2ldvz4kryjj3sdi4f";
-  "BitstreamVeraSansMono" = "1664srkg1i1n7w1iv93a25bg588qxqgpdnw1prf3gryl5zxj5wcd";
-  "CascadiaCode" = "01q4kdmb6wz3rjph3i12i7rhiipj9vfzmlbxmvcmvxdvnq5g5x5l";
-  "CodeNewRoman" = "0sw4hnr36l2yb3yhgxkmrn98ch6ywkxfqybv7vdqh1g44l81fx6z";
-  "Cousine" = "1w2m7sgm0f9kzhbkd7hfb63n3y7kv4m3j97a52imp5sk6w4gc3w4";
-  "DaddyTimeMono" = "1vs0cvdhyrn7dhd1q58bnpz5vk1i0bnx31ijydkpdl09y9nfg60q";
-  "DejaVuSansMono" = "0hl4ajgqlx3vlgbdzm6817n3hq1xnyjj2gazv5xl7w3n98cvnpph";
-  "DroidSansMono" = "14i1ssd2c67dnkg67lbv4dxsnidbg9fqnn4jn4bz7ll9yz3g1zmn";
-  "FantasqueSansMono" = "1sfw2x9g30qbivn6ixlafazp2bcxndjy27wfc8xz8da7df14qdww";
-  "FiraCode" = "1653r5bcsgkrxfncv02fpp4iw9k608hg6fnqg6s8mks2gip2w610";
-  "FiraMono" = "1hrac6asm7rppm4nslfcr9vx53xhhyanqknqzcixf2zy19ggizr9";
-  "FontPatcher" = "1s9mrm3bfs1s3syx4jbqgcc7f5dx7xand3cxdcqr8p002aba9ds9";
-  "Go-Mono" = "00lcl89f3730mg4vvm4kj96v9q15wkpqqdhy5lhsxbrhzg4f3qxa";
-  "Gohu" = "1nv2s3x40rdj5bc8w65y0gbjwdxwa2fvkbxvqqaqn3slylcx95w7";
-  "Hack" = "1csr6gfkfc1zq7r6kq851apd9yy7vlyqa06dx8q4h7ym11nin0qz";
-  "Hasklig" = "00jm7dfh66ip8cmrxq9fq60hhncivijjvyayx5yc63y1vzfgp08s";
-  "HeavyData" = "12pm75w65mgjmmkfxbqv5k78k7jnvpmphywpc6k852wj72f09dl1";
-  "Hermit" = "0mqy6c94smi900zhc1liml8z4h1a5if9n0fvd0afiidpmpb7x02l";
-  "iA-Writer" = "173wdcqw7aqwnsrg1af902fa4jvyix35n0a4cwabbj4x28516liq";
-  "IBMPlexMono" = "0fadrcjiribzk3vcc3k80bddffr63b28ikrv9qrppbkwc846xiq5";
-  "Inconsolata" = "18sndnds39j7af8hj1v20jky79mln50l6rab60fgq8a5v01kbkls";
-  "InconsolataGo" = "1gbbbgyka597ygmdxd65hphsvhx1rp0g13hsr2r88rw08iavqg16";
-  "InconsolataLGC" = "1izxzlsgdiz10rbf0kbrcjc8cy7nvsnkcb4fpcq4k95n7kl6mpck";
-  "Iosevka" = "0cb9qpnnr5n0h628xv7b2ir76j1mcz9rscx9prqavasnhz963in9";
-  "JetBrainsMono" = "0yzfha4i7di90631axyqcqgbc95x3lhnp6l3a36rw5qx11c6r6wb";
-  "Lekton" = "04sgkdds9cgw60z0a2gb13sfm0vkiv172j9biv9f0a70bn0bxkda";
-  "LiberationMono" = "0aq2bjkxic78d59zn9wqnjb9yqmpr1w19lm73wh5xssaqbxr590n";
-  "Lilex" = "0b56dq7nfmx8l47cgx6p39vbhnhf0w0kh06s6zavrgv0v6g2h0rg";
-  "Meslo" = "0wjfd1kf442cw1c1zqjydf8pg2ajl2h0is3ilnvbyi1d8jr3pp59";
-  "Monofur" = "1lmkaz72yc6azk32qbcv34bwj3fwkdh2dy4ik0zaxbld186gmwyi";
-  "Monoid" = "0kay83hwbl5k2kl8ms34m5bidigclrf3cppxh73w6y82y8vgi2wz";
-  "Mononoki" = "01cxiimrsk8bznv7jbnvl1klyva6f91s7rn1sl0wzj0sjxli9lnn";
-  "MPlus" = "1z1r7i1fpbglkplpllljakms5080vzqz2yjx5f3xyggixj9c1gnw";
-  "NerdFontsSymbolsOnly" = "1nb9bhl16lwvr58phcj0hyrzdxqv45gycj6a1nl95pcqy76a06zz";
-  "Noto" = "1wjz60pjs6h1wkwrblw3afs6bafj8zmdy3fan9xlrmh9wp15l0qg";
-  "OpenDyslexic" = "07q50mdg6axs5957h0ggn6krk9hcxiyr2fh9cfw1ybnh979425fx";
-  "Overpass" = "0kxw9qqp9a9nh5ir0ll34965k15nyrs708ffry6bvccy6sl723n4";
-  "ProFont" = "04dy3rngh4c4a2yy8b6pyh0ck6xmiwxwhbbgm77bdspp40b5m9bc";
-  "ProggyClean" = "0jzs0qiav8fqiz69djl14sa06j5q3mcnprwl52gki3wbbp0inshr";
-  "RobotoMono" = "1grszlqbwdb27d02g4gcyiqbz2sigzqhs0m3fvapq7by9pp2cwq6";
-  "ShareTechMono" = "1m3hy87wbxdf2zljygns9876m30xkvf81vcv2fvd0kg79lll84vp";
-  "SourceCodePro" = "0cf7a1v5hi7wg50wh886d84fql4jbm504v1mzkzdwfy70j7l8dm7";
-  "SpaceMono" = "1a3srh177r80190sa4jswp2paqasv0fsx09i2vkzqms07pd69j7p";
-  "Terminus" = "1qa9hjjjw3xn4qk5sqifxd87q5xgawwd9d2yh62b9n1rpgi37cip";
-  "Tinos" = "14kpcimzrx1zzv4y0w78n2kdl83hm33vmprikg1cmbbypn0k2d9y";
-  "Ubuntu" = "0hc71ybi7bnbblzzn86p4l8waagzgqsa5q1pfgm534j1bhn3gr02";
-  "UbuntuMono" = "0mjcyriww7j0gc2lsmxn266x2jlly2hzzl2l70ywj83wxkv0qnva";
-  "VictorMono" = "0n46glk3036i9cjz8gnlmlyx4p7ynk10i647q1zdjlsnk6yiy9i1";
+  "3270" = "1icrqgi7i7cf4jhgpdymv2mkvwh5lgx6yfbs3lrj6jxyhyv14mjj";
+  "Agave" = "0ar50csbsx0rhm3zbi3jf2c9r7wpx20lpmij1i205p53qbiihpv1";
+  "AnonymousPro" = "1is1jgxslmjy4pag137yyh99cf6dvlbkwwnaf91i73ad2w2mm2hm";
+  "Arimo" = "0a5s4flni7wggw5cc9mcc0ipcbmm786fmh2b2y7kp2d3i92sq76x";
+  "AurulentSansMono" = "10agjvrr18ddh8gmdv3ih2lxvrklc65vwsrzzi89h0f8jcas50l5";
+  "BigBlueTerminal" = "130p26r3b2m66ycd549sirvysicr3ld3l8qmrdfw9fr4jva8767s";
+  "BitstreamVeraSansMono" = "02dwhxs7agr3nbwslimryd3wq41wxsw9as0dk3czyjwrgiiwqbzh";
+  "CascadiaCode" = "1y06c8sfwy3pbxda56z7b7awrhia30f7xylj4m1wsnqql5bkwz21";
+  "CodeNewRoman" = "07y2yv9yi35lksiinpm0pxl5jjlbhffnm3mqjqr9292k0d76wrr8";
+  "Cousine" = "1cr1l25ynis1wf9rh0hdyaj4v4cvpv8ci359qjlhhpai5vspr273";
+  "DaddyTimeMono" = "1qj1fqrass97hnn2vm9wdmhyn99w5xk1swm2b1kp70bjbp4jarvh";
+  "DejaVuSansMono" = "03z80lhg128r4ivpcixcxfradn2n9hnwdk2bnbk7z5brqskh0sfy";
+  "DroidSansMono" = "17kvbcsasvfz339ld390msw8715ydfd5vvfm8rm6lyb34rv1z53s";
+  "FantasqueSansMono" = "0whjkl0dk1w4f29vw4jnzx8zwll9fl1axxnmsch9pcm3q7rwzpb5";
+  "FiraCode" = "0wn127x4i4l64v8ql32fw64k82iv9z6q0gkf5p285dcrlbjih04x";
+  "FiraMono" = "0cl4ssdylydwm4zhms2400c7idg0mf7yzsqds2qm7im744m6gkr7";
+  "FontPatcher" = "0hidpffswnz4375s61wq76djn0wilcgcmwz4b0v5gs4hz0zj0yp2";
+  "Go-Mono" = "1w9a507lnxv50x0xlj28ypijvvgcmypk6i27i367gkwsnnn6sqpp";
+  "Gohu" = "11gd9mzj6jwkxq3mxa33i0gb3s5f3dn00lnw360pamc5dyakr6l0";
+  "Hack" = "05vp3315bigfnr6p2fb884jrw489lhhpfqp764h51rldhf6674pj";
+  "Hasklig" = "081z71gfk3i1dqmy6myjygrk65bd7ln6p761i8j6sw3jx0567ml6";
+  "HeavyData" = "1fawn2xfq5js661s5wqjpfbfksg6n38r6n4x6zcgmr47g5hpnpmn";
+  "Hermit" = "0gz6vhlgpaljg41w1fddrv58jxjrngyi101vzm2gc8gp7ym4m4ad";
+  "iA-Writer" = "09m4039hzjqinx3ilzddq2msb64iz1y0ba43k2jd33b66svpi37a";
+  "IBMPlexMono" = "0vwrqy0v2swfh63ikp1lbh6cl4f2qv2q28lk2f2dd6kzzg28p6qj";
+  "Inconsolata" = "0n4nqbry3i019b9zbcawjqn5i7kf04p542sbbmnpi6vpfiv7fi5c";
+  "InconsolataGo" = "1q2dq0jrcd1f611icj1zcwp3zbdrrfxq5882d7blkrbhnlj3jywy";
+  "InconsolataLGC" = "0y29y7vk3x2jvi0ca8lxb8z2w9ww00gpsvkh5qvwxxqxhp5qjafk";
+  "Iosevka" = "1j7bb0vf0hxvi55w4q3bnqhqwn9pp2i58mj79nz0qi59sals3qbm";
+  "JetBrainsMono" = "146w91f1x4709wf52c2rh315qcgpph61cgr07ysn154hnwg5miqj";
+  "Lekton" = "1s5dmk24n119hlsj2aw99d5g564adn40vmyrqgzi3kh72zpqlixy";
+  "LiberationMono" = "06miqkf15h8ficd44rh755lw56i2nqcyxaf0vwa2zvls0v5mk2ar";
+  "Lilex" = "0zbgkj20dqnb5hmh52cmcn175zhc55bz1h1gi3ngmfi6nwgn20vz";
+  "Meslo" = "1d94ligqlngj4lwclah1w3ksvb3wg1iqjpmgblnxl36cd965pjqm";
+  "Monofur" = "1x43siij45h7yz1cw8i32kvdqx1n6zgc9qrj179ms1jl180lj1pj";
+  "Monoid" = "183qd1gpf78j2bipr4xh43kwaidlw3sfl8czzngkfdbpymssqak4";
+  "Mononoki" = "1vpdcmwb406rxgvbarhmb3fpzaj53xgg05nagr33vhpzp7d999b1";
+  "MPlus" = "1a7pb4dvh38bsdsjpbnb01pyn07rx0pwwr287i4vy1p46i39qm9m";
+  "NerdFontsSymbolsOnly" = "0zgjvggb7ipssnjcqlw230pkb4vqpl6xzq42wqk9pcgsv7wg09nv";
+  "Noto" = "17p48ig61dgzgd7fyppw65vdj1isg85w4xcxqjkaqx1225w4k8f9";
+  "OpenDyslexic" = "0ypzyhh00vgd1ws6wh23sph9ycp193y5x9aimscxir8sdbnx3sxp";
+  "Overpass" = "19k8kj9gid1m52b55s5jn8m5kslsgm16jqdifj5as2pd2bgjpwbh";
+  "ProFont" = "1wrmh6jqkbygwba7nsfq5ycw84rqp4mpr10bd50cr7p9inkddq3n";
+  "ProggyClean" = "066k2zdihv1x6vbsdalw5cyygmw27b32jvnvq774ry9bbz8yv4l1";
+  "RobotoMono" = "1glqsz3h7rxs55jf8bycvzxd2snf7jd9qgd4ra0jn8h0qkgvsfgd";
+  "ShareTechMono" = "0j3ribfylx3hnqir7i82pgyb56qlvlzp1y1c6lwvw8k15d06y7fi";
+  "SourceCodePro" = "0zdy8xr2ka9m64d69380plz3xaq08rxwdv8idzxbkhfykrp1j3cz";
+  "SpaceMono" = "1nqkqj0jxfj54wlcs6d2618b89y2fs2pg77kvfr4bc45lrqlbxzk";
+  "Terminus" = "00qyvxjv7aa90xn4bmpygwm0llzd1rr7y0szdbv7h5n7i80yx29s";
+  "Tinos" = "11ii28g1wv6ajpkbvw51vg47s3ww4lss46mh4pd0pf0fzz54gfcc";
+  "Ubuntu" = "0vc8rfpqvajj4xd3anqrnx8g54mhnz9z2h4287g21qf2n1qqagn4";
+  "UbuntuMono" = "0rzd625krvvf1c04172ck2507szm9fq6isydgqyhhkr1kwzx5pzq";
+  "VictorMono" = "09nf02zig9kvgvqqwd6dynx3cidjnlq8sa3qxqw3b313pzia8k3i";
 }
diff --git a/pkgs/data/fonts/nerdfonts/version.nix b/pkgs/data/fonts/nerdfonts/version.nix
index 560487804678..78c409bb9d7d 100644
--- a/pkgs/data/fonts/nerdfonts/version.nix
+++ b/pkgs/data/fonts/nerdfonts/version.nix
@@ -1 +1 @@
-"2.2.2"
+"2.3.0"
diff --git a/pkgs/development/compilers/ocaml/generic.nix b/pkgs/development/compilers/ocaml/generic.nix
index d3c15b8aa4e2..ea89458c078c 100644
--- a/pkgs/development/compilers/ocaml/generic.nix
+++ b/pkgs/development/compilers/ocaml/generic.nix
@@ -11,12 +11,14 @@ in
 , aflSupport ? false
 , flambdaSupport ? false
 , spaceTimeSupport ? false
+, unsafeStringSupport ? false
 }:
 
 assert useX11 -> safeX11 stdenv;
 assert aflSupport -> lib.versionAtLeast version "4.05";
 assert flambdaSupport -> lib.versionAtLeast version "4.03";
 assert spaceTimeSupport -> lib.versionAtLeast version "4.04";
+assert unsafeStringSupport -> lib.versionAtLeast version "4.06" && lib.versionOlder version "5.0";
 
 let
   src = args.src or (fetchurl {
@@ -59,6 +61,10 @@ stdenv.mkDerivation (args // {
   ++ optional aflSupport (flags "--with-afl" "-afl-instrument")
   ++ optional flambdaSupport (flags "--enable-flambda" "-flambda")
   ++ optional spaceTimeSupport (flags "--enable-spacetime" "-spacetime")
+  ++ optionals unsafeStringSupport [
+    "--disable-force-safe-string"
+    "DEFAULT_STRING=unsafe"
+  ]
   ++ optional (stdenv.hostPlatform.isStatic && (lib.versionOlder version "4.08")) "-no-shared-libs"
   ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform && lib.versionOlder version "4.08") [
     "-host ${stdenv.hostPlatform.config}"
diff --git a/pkgs/development/libraries/libversion/default.nix b/pkgs/development/libraries/libversion/default.nix
index 14d56c4d8ca2..4efe91096576 100644
--- a/pkgs/development/libraries/libversion/default.nix
+++ b/pkgs/development/libraries/libversion/default.nix
@@ -2,26 +2,17 @@
 
 stdenv.mkDerivation rec {
   pname = "libversion";
-  version = "3.0.2";
+  version = "3.0.3";
 
   src = fetchFromGitHub {
     owner = "repology";
     repo = "libversion";
     rev = version;
-    hash = "sha256-P/ykRy+LgcfWls4Zw8noel/K9mh/PnKy3smoQtuSi00=";
+    hash = "sha256-REmXD0NFd7Af01EU/f2IGoTKiju6ErTI7WUinvrAzaA=";
   };
 
   nativeBuildInputs = [ cmake ];
 
-  cmakeFlags = [
-    # https://github.com/NixOS/nixpkgs/issues/144170
-    # the cmake package does not handle absolute CMAKE_INSTALL_INCLUDEDIR correctly
-    # (setting it to an absolute path causes include files to go to $out/$out/include,
-    #  because the absolute path is interpreted with root at $out).
-    "-DCMAKE_INSTALL_INCLUDEDIR=include"
-    "-DCMAKE_INSTALL_LIBDIR=lib"
-  ];
-
   checkTarget = "test";
   doCheck = true;
 
diff --git a/pkgs/development/python-modules/caldav/default.nix b/pkgs/development/python-modules/caldav/default.nix
index d1e520aac493..f531cb4f0efc 100644
--- a/pkgs/development/python-modules/caldav/default.nix
+++ b/pkgs/development/python-modules/caldav/default.nix
@@ -14,13 +14,13 @@
 
 buildPythonPackage rec {
   pname = "caldav";
-  version = "0.11.0";
+  version = "1.0.1";
 
   src = fetchFromGitHub {
     owner = "python-caldav";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-fTl2mxQncsITSC8XpcCBYWYmjDboiueGkNGHbQxn+F8=";
+    hash = "sha256-1BGy4h0TpeiUNtUnj/BiGSfH4T9YXP8YGJ1+4UsRGug=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/recurring-ical-events/default.nix b/pkgs/development/python-modules/recurring-ical-events/default.nix
index a40b4a089e11..989be20e4b0f 100644
--- a/pkgs/development/python-modules/recurring-ical-events/default.nix
+++ b/pkgs/development/python-modules/recurring-ical-events/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "recurring-ical-events";
-  version = "1.1.0b0";
+  version = "2.0.0";
 
   format = "setuptools";
 
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "niccokunzmann";
     repo = "python-recurring-ical-events";
     rev = "v${version}";
-    hash = "sha256-ePbyZd/l/O3p/6Mbq1kMFsktkFKpPAw/u7uUynZYP2Y=";
+    hash = "sha256-B6oLy4Ai30SGGTgGcO0V+f1mf1P1W8sMpzk7oIUtcJY=";
   };
 
   propagatedBuildInputs = [
@@ -41,6 +41,7 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "recurring_ical_events" ];
 
   meta = {
+    changelog = "https://github.com/niccokunzmann/python-recurring-ical-events/blob/${src.rev}/README.rst#changelog";
     description = "Repeat ICalendar events by RRULE, RDATE and EXDATE";
     homepage = "https://github.com/niccokunzmann/python-recurring-ical-events";
     license = lib.licenses.lgpl3Plus;
diff --git a/pkgs/development/tools/misc/act/default.nix b/pkgs/development/tools/misc/act/default.nix
index dedbb8e300ca..47e2fbc14aef 100644
--- a/pkgs/development/tools/misc/act/default.nix
+++ b/pkgs/development/tools/misc/act/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "act";
-  version = "0.2.35";
+  version = "0.2.40";
 
   src = fetchFromGitHub {
     owner = "nektos";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-igmxiPVq9aWntIkBSl7crrbXM9N9Iv4KULsj5Q2ZL2I=";
+    hash = "sha256-ZnGy/N2+/dfmtquyTqpAcuQgqKMuQnDYYR/GOHFOpc0=";
   };
 
-  vendorHash = "sha256-FKpNMZrME3HqqVlp09O3Ppb/MjEzYFuawA+WlKFUfME=";
+  vendorHash = "sha256-5uF0ZdyJtUoEHQLPEe9ZKIBukdfvZ7kF5LetJB/yel8=";
 
   doCheck = false;
 
diff --git a/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix b/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix
index 42109062b72d..a4f71f12821d 100644
--- a/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix
+++ b/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix
@@ -50,6 +50,7 @@ let
     libcharset = callPackage ./libcharset.nix {};
     libunwind = callPackage ./libunwind.nix {};
     libnetwork = callPackage ./libnetwork.nix {};
+    libpm = callPackage ./libpm.nix {};
     # Avoid introducing a new objc4 if stdenv already has one, to prevent
     # conflicting LLVM modules.
     objc4 = if stdenv ? objc4 then stdenv.objc4 else callPackage ./libobjc.nix {};
diff --git a/pkgs/os-specific/darwin/apple-sdk-11.0/libpm.nix b/pkgs/os-specific/darwin/apple-sdk-11.0/libpm.nix
new file mode 100644
index 000000000000..995f2b20ce70
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-sdk-11.0/libpm.nix
@@ -0,0 +1,23 @@
+{ stdenvNoCC, MacOSX-SDK, checkReexportsHook }:
+
+stdenvNoCC.mkDerivation {
+  pname = "libpm";
+  version = MacOSX-SDK.version;
+
+  dontUnpack = true;
+  dontBuild = true;
+
+  nativeBuildInputs = [ checkReexportsHook ];
+
+  installPhase = ''
+    mkdir -p $out/lib
+    cp ${MacOSX-SDK}/usr/lib/libpm* $out/lib
+  '';
+
+  passthru = {
+    tbdRewrites = {
+      const."/usr/lib/libpmenergy.dylib" = "${placeholder "out"}/lib/libpmenergy.dylib";
+      const."/usr/lib/libpmsample.dylib" = "${placeholder "out"}/lib/libpmsample.dylib";
+    };
+  };
+}
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index 98201ef05641..586631f6ffda 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -85,6 +85,15 @@ let
         };
       });
 
+      icalendar = super.icalendar.overridePythonAttrs (oldAttrs: rec {
+        version = "4.1.0";
+        src = self.fetchPypi {
+          inherit (oldAttrs) pname;
+          inherit version;
+          hash = "sha256-l0i3wC78xD5Y0GFa4JdqxPJl6Q2t7ptPiE3imQXBs5U=";
+        };
+      });
+
       # Pinned due to API changes in 0.1.0
       poolsense = super.poolsense.overridePythonAttrs (oldAttrs: rec {
         version = "0.0.8";
diff --git a/pkgs/tools/admin/scaleway-cli/default.nix b/pkgs/tools/admin/scaleway-cli/default.nix
index e4cbcf3c3616..b570d7134edc 100644
--- a/pkgs/tools/admin/scaleway-cli/default.nix
+++ b/pkgs/tools/admin/scaleway-cli/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "scaleway-cli";
-  version = "2.8.0";
+  version = "2.9.0";
 
   src = fetchFromGitHub {
     owner = "scaleway";
     repo = "scaleway-cli";
     rev = "v${version}";
-    sha256 = "sha256-2PDENdQmkcGU+nRjfr9QW5H3vzNPq1YStN4yew0+Ixw=";
+    sha256 = "sha256-Sh7K0PgjX2/vio2E8/qdiP+WC2SoGpS9oU4UizV+sOs=";
   };
 
-  vendorSha256 = "sha256-EzZ18jXettkGbGgMIthqnyfwJ44hEh2SCdV6XpFv3GQ=";
+  vendorHash = "sha256-sYvq502huyCxI4zpPLfPVyyKqTclrfxL9idCGW4Xops=";
 
   ldflags = [
     "-w"
diff --git a/pkgs/tools/games/weidu/default.nix b/pkgs/tools/games/weidu/default.nix
index 1464dfbbf869..91c6217d893a 100644
--- a/pkgs/tools/games/weidu/default.nix
+++ b/pkgs/tools/games/weidu/default.nix
@@ -12,12 +12,9 @@ let
   # 1. Needs ocaml >= 4.04 and <= 4.11
   # 2. ocaml 4.10 defaults to safe (immutable) strings so we need a version with
   #    that disabled as weidu is strongly dependent on mutable strings
-  ocaml' = ocaml-ng.ocamlPackages_4_11.ocaml.overrideAttrs (old: {
-    configureFlags = old.configureFlags ++ [
-      # https://github.com/WeiDUorg/weidu/issues/197
-      "--disable-force-safe-string"
-    ];
-  });
+  ocaml' = ocaml-ng.ocamlPackages_4_11.ocaml.override {
+    unsafeStringSupport = true;
+  };
 
 in
 stdenv.mkDerivation rec {
diff --git a/pkgs/tools/misc/h5utils/default.nix b/pkgs/tools/misc/h5utils/default.nix
index bb05c30ff83d..f0267608d3a9 100644
--- a/pkgs/tools/misc/h5utils/default.nix
+++ b/pkgs/tools/misc/h5utils/default.nix
@@ -5,14 +5,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "1.13.1";
+  version = "1.13.2";
   pname = "h5utils";
 
   # fetchurl is used instead of fetchFromGitHub because the git repo version requires
   # additional tools to build compared to the tarball release; see the README for details.
   src = fetchurl {
     url = "https://github.com/stevengj/h5utils/releases/download/${version}/h5utils-${version}.tar.gz";
-    sha256 = "0rbx3m8p5am8z5m0f3sryryfc41541hjpkixb1jkxakd9l36z9y5";
+    sha256 = "sha256-7qeFWoI1+st8RU5hEDCY5VZY2g3fS23luCqZLl8CQ1E=";
   };
 
   # libdf is an alternative name for libhdf (hdf4)
diff --git a/pkgs/tools/misc/onefetch/default.nix b/pkgs/tools/misc/onefetch/default.nix
index 0bb36774dcb2..934ef186ba1c 100644
--- a/pkgs/tools/misc/onefetch/default.nix
+++ b/pkgs/tools/misc/onefetch/default.nix
@@ -1,6 +1,7 @@
 { lib
 , rustPlatform
 , fetchFromGitHub
+, fetchpatch
 , cmake
 , installShellFiles
 , pkg-config
@@ -30,6 +31,14 @@ rustPlatform.buildRustPackage rec {
     ./zstd-pkg-config.patch
   ];
 
+  patches = [
+    (fetchpatch {
+      name = "use-iso-time-for-snapshot-tests";
+      url = "https://github.com/o2sh/onefetch/commit/b8b0320d2d271bb10053403092833a26e57134d1.patch";
+      hash = "sha256-LnC+UCvSwMePC4jBjrTKnbyypNvHHNevB2v4y+hv8Pc=";
+    })
+  ];
+
   nativeBuildInputs = [ cmake installShellFiles pkg-config ];
 
   buildInputs = [ zstd ]
diff --git a/pkgs/tools/package-management/nix-doc/default.nix b/pkgs/tools/package-management/nix-doc/default.nix
index 4ea66207de56..7b041df665ed 100644
--- a/pkgs/tools/package-management/nix-doc/default.nix
+++ b/pkgs/tools/package-management/nix-doc/default.nix
@@ -2,13 +2,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "nix-doc";
-  version = "0.5.6";
+  version = "0.5.7";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "lf-";
     repo = "nix-doc";
-    sha256 = "sha256-n2qmu+yMV/ext3MN5lfkfo3ebRf4Uct/WgGP3Ck72WM=";
+    sha256 = "sha256-VSogUulfBTmZMmBbw9Ya/kfoHZlvJMujCPdjhRsjnPo=";
   };
 
   doCheck = true;
@@ -16,7 +16,7 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ pkg-config nix ];
 
-  cargoSha256 = "sha256-JrfRmpRSmkL8D0UAT3nY/NWWcNapuVUcd9zNQYUPRo8=";
+  cargoSha256 = "sha256-DZQ1Q+4I6Qm2WFvBoPNILp0wwP+01msx6zP12EHaPQc=";
 
   meta = with lib; {
     description = "An interactive Nix documentation tool";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 0fa6be913949..9ca8cd7fca4f 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1771,9 +1771,7 @@ with pkgs;
 
   git-machete = python3Packages.callPackage ../applications/version-management/git-machete { };
 
-  git-nomad = callPackage ../applications/version-management/git-nomad {
-    inherit (darwin.apple_sdk.frameworks) SystemConfiguration;
-  };
+  git-nomad = callPackage ../applications/version-management/git-nomad { };
 
   git-octopus = callPackage ../applications/version-management/git-octopus { };
 
@@ -21088,9 +21086,10 @@ with pkgs;
 
   libgsf = callPackage ../development/libraries/libgsf { };
 
-  # GNU libc provides libiconv so systems with glibc don't need to build
-  # libiconv separately. Additionally, Apple forked/repackaged libiconv so we
-  # use that instead of the vanilla version on that OS.
+  # GNU libc provides libiconv so systems with glibc don't need to
+  # build libiconv separately. Additionally, Apple forked/repackaged
+  # libiconv so we use that instead of the vanilla version on that OS,
+  # and BSDs include libiconv in libc.
   #
   # We also provide `libiconvReal`, which will always be a standalone libiconv,
   # just in case you want it regardless of platform.
@@ -21101,6 +21100,8 @@ with pkgs;
         else stdenv.cc.libc)
     else if stdenv.hostPlatform.isDarwin
       then darwin.libiconv
+    else if stdenv.hostPlatform.isNetBSD
+      then null
     else libiconvReal;
 
   glibcIconv = libc: let
@@ -30883,7 +30884,9 @@ with pkgs;
   mjpg-streamer = callPackage ../applications/video/mjpg-streamer { };
 
   mldonkey = callPackage ../applications/networking/p2p/mldonkey {
-    ocamlPackages = ocaml-ng.ocamlPackages_4_08;
+    ocamlPackages = ocaml-ng.mkOcamlPackages (ocaml-ng.ocamlPackages_4_13.ocaml.override {
+      unsafeStringSupport = true;
+    });
   };
 
   mlvwm = callPackage ../applications/window-managers/mlvwm { };
@@ -30983,6 +30986,7 @@ with pkgs;
     mopidy-somafm
     mopidy-soundcloud
     mopidy-subidy
+    mopidy-tidal
     mopidy-tunein
     mopidy-youtube
     mopidy-ytmusic;
@@ -36317,7 +36321,9 @@ with pkgs;
   drat-trim = callPackage ../applications/science/logic/drat-trim {};
 
   ekrhyper = callPackage ../applications/science/logic/ekrhyper {
-    inherit (ocaml-ng.ocamlPackages_4_02) ocaml;
+    ocaml = ocaml-ng.ocamlPackages_4_14.ocaml.override {
+      unsafeStringSupport = true;
+    };
   };
 
   eprover = callPackage ../applications/science/logic/eprover { };
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 8fd6b40ef19d..03bd642550f1 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -1640,6 +1640,7 @@ let
 
 in let inherit (pkgs) callPackage; in rec
 {
+  inherit mkOcamlPackages;
 
   ocamlPackages_4_00_1 = mkOcamlPackages (callPackage ../development/compilers/ocaml/4.00.1.nix { });