diff --git a/nixos/doc/manual/release-notes/rl-2305.section.md b/nixos/doc/manual/release-notes/rl-2305.section.md
index 3e63ddced611..30c14de9539d 100644
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@@ -34,6 +34,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - [fzf](https://github.com/junegunn/fzf), a command line fuzzyfinder. Available as [programs.fzf](#opt-programs.fzf.fuzzyCompletion).
 
+- [gemstash](https://github.com/rubygems/gemstash), a RubyGems.org cache and private gem server. Available as [services.gemstash](#opt-services.gemstash.enable).
+
 - [gmediarender](https://github.com/hzeller/gmrender-resurrect), a simple, headless UPnP/DLNA renderer.  Available as [services.gmediarender](options.html#opt-services.gmediarender.enable).
 
 - [stevenblack-blocklist](https://github.com/StevenBlack/hosts), A unified hosts file with base extensions for blocking unwanted websites. Available as [networking.stevenblack](options.html#opt-networking.stevenblack.enable).
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index ef0c54de2721..954b34611f2e 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -440,6 +440,7 @@
   ./services/development/blackfire.nix
   ./services/development/bloop.nix
   ./services/development/distccd.nix
+  ./services/development/gemstash.nix
   ./services/development/hoogle.nix
   ./services/development/jupyter/default.nix
   ./services/development/jupyterhub/default.nix
diff --git a/nixos/modules/services/development/gemstash.nix b/nixos/modules/services/development/gemstash.nix
new file mode 100644
index 000000000000..eb7ccb98bde8
--- /dev/null
+++ b/nixos/modules/services/development/gemstash.nix
@@ -0,0 +1,103 @@
+{ lib, pkgs, config, ... }:
+with lib;
+
+let
+  settingsFormat = pkgs.formats.yaml { };
+
+  # gemstash uses a yaml config where the keys are ruby symbols,
+  # which means they start with ':'. This would be annoying to use
+  # on the nix side, so we rewrite plain names instead.
+  prefixColon = s: listToAttrs (map
+    (attrName: {
+      name = ":${attrName}";
+      value =
+        if isAttrs s.${attrName}
+        then prefixColon s."${attrName}"
+        else s."${attrName}";
+    })
+    (attrNames s));
+
+  # parse the port number out of the tcp://ip:port bind setting string
+  parseBindPort = bind: strings.toInt (last (strings.splitString ":" bind));
+
+  cfg = config.services.gemstash;
+in
+{
+  options.services.gemstash = {
+    enable = mkEnableOption (lib.mdDoc "gemstash service");
+
+    openFirewall = mkOption {
+      type = types.bool;
+      default = false;
+      description = lib.mdDoc ''
+        Whether to open the firewall for the port in {option}`services.gemstash.bind`.
+      '';
+    };
+
+    settings = mkOption {
+      default = {};
+      description = lib.mdDoc ''
+        Configuration for Gemstash. The details can be found at in
+        [gemstash documentation](https://github.com/rubygems/gemstash/blob/master/man/gemstash-configuration.5.md).
+        Each key set here is automatically prefixed with ":" to match the gemstash expectations.
+      '';
+      type = types.submodule {
+        freeformType = settingsFormat.type;
+        options = {
+          base_path = mkOption {
+            type = types.path;
+            default = "/var/lib/gemstash";
+            description = lib.mdDoc "Path to store the gem files and the sqlite database. If left unchanged, the directory will be created.";
+          };
+          bind = mkOption {
+            type = types.str;
+            default = "tcp://0.0.0.0:9292";
+            description = lib.mdDoc "Host and port combination for the server to listen on.";
+          };
+          db_adapter = mkOption {
+            type = types.nullOr (types.enum [ "sqlite3" "postgres" "mysql" "mysql2" ]);
+            default = null;
+            description = lib.mdDoc "Which database type to use. For choices other than sqlite3, the dbUrl has to be specified as well.";
+          };
+          db_url = mkOption {
+            type = types.nullOr types.str;
+            default = null;
+            description = lib.mdDoc "The database to connect to when using postgres, mysql, or mysql2.";
+          };
+        };
+      };
+    };
+  };
+
+  config =
+    mkIf cfg.enable {
+      users = {
+        users.gemstash = {
+          group = "gemstash";
+          isSystemUser = true;
+        };
+        groups.gemstash = { };
+      };
+
+      networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [ (parseBindPort cfg.settings.bind) ];
+
+      systemd.services.gemstash = {
+        wantedBy = [ "multi-user.target" ];
+        after = [ "network.target" ];
+        serviceConfig = mkMerge [
+          {
+            ExecStart = "${pkgs.gemstash}/bin/gemstash start --no-daemonize --config-file ${settingsFormat.generate "gemstash.yaml" (prefixColon cfg.settings)}";
+            NoNewPrivileges = true;
+            User = "gemstash";
+            Group = "gemstash";
+            PrivateTmp = true;
+            RestrictSUIDSGID = true;
+            LockPersonality = true;
+          }
+          (mkIf (cfg.settings.base_path == "/var/lib/gemstash") {
+            StateDirectory = "gemstash";
+          })
+        ];
+      };
+    };
+}
diff --git a/nixos/modules/services/monitoring/prometheus/default.nix b/nixos/modules/services/monitoring/prometheus/default.nix
index f516b75ab10f..4f197b9b5820 100644
--- a/nixos/modules/services/monitoring/prometheus/default.nix
+++ b/nixos/modules/services/monitoring/prometheus/default.nix
@@ -1408,7 +1408,7 @@ let
       '';
 
       action =
-        mkDefOpt (types.enum [ "replace" "keep" "drop" "hashmod" "labelmap" "labeldrop" "labelkeep" ]) "replace" ''
+        mkDefOpt (types.enum [ "replace" "lowercase" "uppercase" "keep" "drop" "hashmod" "labelmap" "labeldrop" "labelkeep" ]) "replace" ''
           Action to perform based on regex matching.
         '';
     };
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 37aad8246d43..8784b39a059b 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -240,6 +240,7 @@ in {
   ft2-clone = handleTest ./ft2-clone.nix {};
   mimir = handleTest ./mimir.nix {};
   garage = handleTest ./garage {};
+  gemstash = handleTest ./gemstash.nix {};
   gerrit = handleTest ./gerrit.nix {};
   geth = handleTest ./geth.nix {};
   ghostunnel = handleTest ./ghostunnel.nix {};
diff --git a/nixos/tests/gemstash.nix b/nixos/tests/gemstash.nix
new file mode 100644
index 000000000000..bc152e42e92e
--- /dev/null
+++ b/nixos/tests/gemstash.nix
@@ -0,0 +1,51 @@
+{ system ? builtins.currentSystem, config ? { }
+, pkgs ? import ../.. { inherit system config; } }:
+
+with import ../lib/testing-python.nix { inherit system pkgs; };
+with pkgs.lib;
+
+let common_meta = { maintainers = [ maintainers.viraptor ]; };
+in
+{
+  gemstash_works = makeTest {
+    name = "gemstash-works";
+    meta = common_meta;
+
+    nodes.machine = { config, pkgs, ... }: {
+      services.gemstash = {
+        enable = true;
+      };
+    };
+
+    # gemstash responds to http requests
+    testScript = ''
+      machine.wait_for_unit("gemstash.service")
+      machine.wait_for_file("/var/lib/gemstash")
+      machine.wait_for_open_port(9292)
+      machine.succeed("curl http://localhost:9292")
+    '';
+  };
+
+  gemstash_custom_port = makeTest {
+    name = "gemstash-custom-port";
+    meta = common_meta;
+
+    nodes.machine = { config, pkgs, ... }: {
+      services.gemstash = {
+        enable = true;
+        openFirewall = true;
+        settings = {
+          bind = "tcp://0.0.0.0:12345";
+        };
+      };
+    };
+
+    # gemstash responds to http requests
+    testScript = ''
+      machine.wait_for_unit("gemstash.service")
+      machine.wait_for_file("/var/lib/gemstash")
+      machine.wait_for_open_port(12345)
+      machine.succeed("curl http://localhost:12345")
+    '';
+  };
+}
diff --git a/pkgs/applications/misc/ausweisapp2/default.nix b/pkgs/applications/misc/ausweisapp2/default.nix
index 8758e5fe92f6..c7ee1885686b 100644
--- a/pkgs/applications/misc/ausweisapp2/default.nix
+++ b/pkgs/applications/misc/ausweisapp2/default.nix
@@ -3,13 +3,13 @@
 
 mkDerivation rec {
   pname = "AusweisApp2";
-  version = "1.26.2";
+  version = "1.26.3";
 
   src = fetchFromGitHub {
     owner = "Governikus";
     repo = "AusweisApp2";
     rev = version;
-    hash = "sha256-jN4xKgdNO+LyDy+ySM13M5YCaijDq8zAxS+x4Io1ThE=";
+    hash = "sha256-YI9/rMoe5Waw2e/tObvu+wi9dkmhEoG9v3ZQzkn4QH4=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
diff --git a/pkgs/applications/misc/blender/default.nix b/pkgs/applications/misc/blender/default.nix
index 01374737f585..59fd3f915656 100644
--- a/pkgs/applications/misc/blender/default.nix
+++ b/pkgs/applications/misc/blender/default.nix
@@ -95,6 +95,9 @@ stdenv.mkDerivation rec {
   cmakeFlags =
     [
       "-DWITH_ALEMBIC=ON"
+      # Blender supplies its own FindAlembic.cmake (incompatible with the Alembic-supplied config file)
+      "-DALEMBIC_INCLUDE_DIR=${lib.getDev alembic}/include"
+      "-DALEMBIC_LIBRARY=${lib.getLib alembic}/lib/libAlembic.so"
       "-DWITH_MOD_OCEANSIM=ON"
       "-DWITH_CODEC_FFMPEG=ON"
       "-DWITH_CODEC_SNDFILE=ON"
diff --git a/pkgs/applications/networking/browsers/brave/default.nix b/pkgs/applications/networking/browsers/brave/default.nix
index b5528c31b430..d7a0e1c5e6a3 100644
--- a/pkgs/applications/networking/browsers/brave/default.nix
+++ b/pkgs/applications/networking/browsers/brave/default.nix
@@ -90,11 +90,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "brave";
-  version = "1.48.171";
+  version = "1.49.120";
 
   src = fetchurl {
     url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-    sha256 = "sha256-3dFOBl+Iomn8NnCYZ2owrTPQlqqj4LFdtnN4IXhbRps=";
+    sha256 = "sha256-KSu6HaNKc7uVY1rSyzU+VZSE2dbIOOrsUx1RYKnz8yU=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/applications/networking/cluster/fluxcd/default.nix b/pkgs/applications/networking/cluster/fluxcd/default.nix
index a10761578c48..c6d79bb43188 100644
--- a/pkgs/applications/networking/cluster/fluxcd/default.nix
+++ b/pkgs/applications/networking/cluster/fluxcd/default.nix
@@ -1,9 +1,9 @@
 { lib, buildGoModule, fetchFromGitHub, fetchzip, installShellFiles, stdenv }:
 
 let
-  version = "0.40.2";
-  sha256 = "00rzd9i9dd13wsr2f8y6b7q5zphrfx3bgigfinmzcfdinydv3bm4";
-  manifestsSha256 = "05bkqkhyb3mgd68w2zr9bav6dfibfzfw65anzkz269wqrkf0d86k";
+  version = "0.41.0";
+  sha256 = "1xqgscmzq96jdlvwmckpz2zh7gsdla77xir6a6nylz509wkv3gid";
+  manifestsSha256 = "03azig0axa6d5yapzr36ziza1jsy549sqnna6ja6xa2zl0ljx33n";
 
   manifests = fetchzip {
     url =
@@ -23,7 +23,7 @@ in buildGoModule rec {
     inherit sha256;
   };
 
-  vendorSha256 = "sha256-crFBOWRjgFIm4mrX3Sf9ovodG5t8hhJUbMr2qpIt7LQ=";
+  vendorSha256 = "sha256-nQzpJX1B1zXpW27YtzkAYK2vL7rnWPgAtlZlZqdV5QI=";
 
   postUnpack = ''
     cp -r ${manifests} source/cmd/flux/manifests
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 1e581113fe29..96f5cb2a168c 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -110,13 +110,13 @@
     "vendorHash": null
   },
   "aws": {
-    "hash": "sha256-ouS+0fLs4Zo17ZIqsd7CiYUKQMSNtuwVs3qdZ52qbns=",
+    "hash": "sha256-dOcsD5yJrn+zpX5F0ImIqD9d+iC228Wem/668RtsQNY=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/aws",
     "owner": "hashicorp",
     "repo": "terraform-provider-aws",
-    "rev": "v4.57.1",
+    "rev": "v4.58.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-X4fgw0AJMDDsRuS9MlMu+pnnjxJ33P9QXnpqDXfvfuA="
+    "vendorHash": "sha256-nNQmiPBkIuQSBGDujMZI+dZMwv6xQcd8+nc1cMKrJws="
   },
   "azuread": {
     "hash": "sha256-MGCGfocs16qmJnvMRRD7TRHnPkS17h+oNUkMARAQhLs=",
@@ -382,11 +382,11 @@
     "vendorHash": "sha256-E1gzdES/YVxQq2J47E2zosvud2C/ViBeQ8+RfNHMBAg="
   },
   "fastly": {
-    "hash": "sha256-OODPVNHFW8hnpofWLvzn7qukngB8okZADYI5t9muHpQ=",
+    "hash": "sha256-XvDsL2N/S7DE+9ks8Y6ZY3hcogzUsiF7VymNK7NnmaI=",
     "homepage": "https://registry.terraform.io/providers/fastly/fastly",
     "owner": "fastly",
     "repo": "terraform-provider-fastly",
-    "rev": "v3.2.0",
+    "rev": "v4.0.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -467,13 +467,13 @@
     "vendorHash": "sha256-fqVBnAivVekV+4tpkl+E6eNA3wi8mhLevJRCs3W7L2g="
   },
   "grafana": {
-    "hash": "sha256-4K0Pk7tgnOjFdHpe6SZNSt/wU8OBzdB/y99nibW5bAY=",
+    "hash": "sha256-b6vmtr2eHm7YNhRHS96+l6BLHYHgixR8Pw7/jK0tRPI=",
     "homepage": "https://registry.terraform.io/providers/grafana/grafana",
     "owner": "grafana",
     "repo": "terraform-provider-grafana",
-    "rev": "v1.35.0",
+    "rev": "v1.36.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-oSpAq2834Nt+E8l64YhvuXdfUsoTU5rBr2I8+Yz9tkc="
+    "vendorHash": "sha256-zPO+TbJsFrgfjSaSrX5YRop/0LDDw/grNNntaIGiBU0="
   },
   "gridscale": {
     "hash": "sha256-ahYCrjrJPEItGyqbHYtgkIH/RzMyxBQkebSAyd8gwYo=",
@@ -765,13 +765,13 @@
     "vendorHash": null
   },
   "newrelic": {
-    "hash": "sha256-ReVP0droWSP+NWV0kQznfCllL/jx0uQKmaGr+CyR8iQ=",
+    "hash": "sha256-bf4t4xcA/K4atLyDVzkeLw5zm9sBz/dUBiivVaz4hNU=",
     "homepage": "https://registry.terraform.io/providers/newrelic/newrelic",
     "owner": "newrelic",
     "repo": "terraform-provider-newrelic",
-    "rev": "v3.15.0",
+    "rev": "v3.16.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-aFjsUhdGboN8Hfu2ky6djG0hC/Z9MU2tOWDFXekOGNQ="
+    "vendorHash": "sha256-yF2yk85RLbvmULakODOV2V0Z9dzKfLClUSZTnECdO3o="
   },
   "nomad": {
     "hash": "sha256-oHY+jM4JQgLlE1wd+/H9H8H2g0e9ZuxI6OMlz3Izfjg=",
@@ -856,11 +856,11 @@
     "vendorHash": "sha256-aoJDRzackPjWxkrsQclweUFH3Bqdcj1aTJuTHZ7Dh7g="
   },
   "opentelekomcloud": {
-    "hash": "sha256-UIpzv5Tas5jxpaqg1n0KRoJhYj6vRE6DBQ2u701xgzU=",
+    "hash": "sha256-fkEQ4VWGJiPFTA6Wz8AxAiL4DOW+Kewl8T9ywy/yPME=",
     "homepage": "https://registry.terraform.io/providers/opentelekomcloud/opentelekomcloud",
     "owner": "opentelekomcloud",
     "repo": "terraform-provider-opentelekomcloud",
-    "rev": "v1.33.1",
+    "rev": "v1.33.2",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-EbUHKM6fKEZk1ey4qTgAd/20OKJu0DoBF0MAOxB7y64="
   },
@@ -883,11 +883,11 @@
     "vendorHash": null
   },
   "pagerduty": {
-    "hash": "sha256-uicfk05Y8p4jQLG+Z8Cd2kI8rToI++13lsg0JUsm7Ew=",
+    "hash": "sha256-9aIYGmcbDgSZqtldLBMRjD0qKJZ3USuwNBpK3bvGrFY=",
     "homepage": "https://registry.terraform.io/providers/PagerDuty/pagerduty",
     "owner": "PagerDuty",
     "repo": "terraform-provider-pagerduty",
-    "rev": "v2.11.0",
+    "rev": "v2.11.1",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -1045,11 +1045,11 @@
     "vendorHash": "sha256-NO1r/EWLgH1Gogru+qPeZ4sW7FuDENxzNnpLSKstnE8="
   },
   "spotinst": {
-    "hash": "sha256-OroABl6G5nCatoyPxHZkM9I7qidxwMlgFjWC9Ljshik=",
+    "hash": "sha256-a/WXuEIvFsbYGoIDT0vHNM1LoFs7VlqmGXHDszON/rU=",
     "homepage": "https://registry.terraform.io/providers/spotinst/spotinst",
     "owner": "spotinst",
     "repo": "terraform-provider-spotinst",
-    "rev": "v1.104.0",
+    "rev": "v1.105.0",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-juso8uzTjqf/vxUmpiv/07WkqMJRS1CqHQhu6pHf7QY="
   },
diff --git a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
index d8f3fcb17939..22d071838869 100644
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
@@ -1,12 +1,12 @@
 { callPackage }: builtins.mapAttrs (pname: attrs: callPackage ./generic.nix (attrs // { inherit pname; })) {
   signal-desktop = {
     dir = "Signal";
-    version = "6.5.1";
-    hash = "sha256-At4ILl6nHltP1TMI5cjK7gE4NENAccS4MPMHXJoGveM=";
+    version = "6.7.0";
+    hash = "sha256-njiVPTkzYdt7QZcpohXUI3hj/o+fO4/O0ZlQrq2oP6Y=";
   };
   signal-desktop-beta = {
     dir = "Signal Beta";
-    version = "6.6.0-beta.1";
-    hash = "sha256-txSvMg7Q+r9UWJMC9Rj2XQ8y1WN3xphMruvOZok/VPk=";
+    version = "6.8.0-beta.1";
+    hash = "sha256-akQmGxDW6SBQCRLU6TgfODP8ZjEPsvaBvrkdd+6DqKs=";
   };
 }
diff --git a/pkgs/applications/networking/syncthing/default.nix b/pkgs/applications/networking/syncthing/default.nix
index d221324b205b..952851b08dba 100644
--- a/pkgs/applications/networking/syncthing/default.nix
+++ b/pkgs/applications/networking/syncthing/default.nix
@@ -4,16 +4,16 @@ let
   common = { stname, target, postInstall ? "" }:
     buildGoModule rec {
       pname = stname;
-      version = "1.23.1";
+      version = "1.23.2";
 
       src = fetchFromGitHub {
         owner = "syncthing";
         repo = "syncthing";
         rev = "v${version}";
-        hash = "sha256-Jbg56Nn+5ZjIv1KZrThkqWY+P13MglLE78E6jc0rbY0=";
+        hash = "sha256-EowUQYfSznTuAHV7OIesFPM99zRmeKkzYNp7VANtR2U=";
       };
 
-      vendorHash = "sha256-q63iaRxJRvPY0Np20O6JmdMEjSg/kxRneBfs8fRTwXk=";
+      vendorHash = "sha256-5NgflkRXkbWiIkASmxIgWliE8sF89HtlMtlIF+5u6Ic=";
 
       doCheck = false;
 
diff --git a/pkgs/applications/science/misc/root/default.nix b/pkgs/applications/science/misc/root/default.nix
index a04aa67e0f70..037b8dfa09c7 100644
--- a/pkgs/applications/science/misc/root/default.nix
+++ b/pkgs/applications/science/misc/root/default.nix
@@ -157,6 +157,9 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [
     "-Drpath=ON"
+    "-DCMAKE_INSTALL_BINDIR=bin"
+    "-DCMAKE_INSTALL_LIBDIR=lib"
+    "-DCMAKE_INSTALL_INCLUDEDIR=include"
     "-Dbuiltin_llvm=OFF"
     "-Dbuiltin_nlohmannjson=OFF"
     "-Dbuiltin_openui5=OFF"
diff --git a/pkgs/applications/video/media-downloader/default.nix b/pkgs/applications/video/media-downloader/default.nix
index 1b62c89c6ae8..ab7f9030faa8 100644
--- a/pkgs/applications/video/media-downloader/default.nix
+++ b/pkgs/applications/video/media-downloader/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "media-downloader";
-  version = "2.8.0";
+  version = "2.9.0";
 
   src = fetchFromGitHub {
     owner = "mhogomchungu";
     repo = pname;
     rev = "${version}";
-    sha256 = "sha256-RMZG+rPbwJFL2AzEZlTrc8/bQCx8CWCWppEBjCj5hnU=";
+    sha256 = "sha256-3tVOyIwdGcSVnEJWQWh6HIsjY6uEzWkTs45qf81r/+0=";
   };
 
   nativeBuildInputs = [ cmake qt5.wrapQtAppsHook ];
diff --git a/pkgs/data/fonts/sarasa-gothic/default.nix b/pkgs/data/fonts/sarasa-gothic/default.nix
index b0e341cf88f1..f87738a419d9 100644
--- a/pkgs/data/fonts/sarasa-gothic/default.nix
+++ b/pkgs/data/fonts/sarasa-gothic/default.nix
@@ -2,13 +2,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "sarasa-gothic";
-  version = "0.40.1";
+  version = "0.40.2";
 
   src = fetchurl {
     # Use the 'ttc' files here for a smaller closure size.
     # (Using 'ttf' files gives a closure size about 15x larger, as of November 2021.)
     url = "https://github.com/be5invis/Sarasa-Gothic/releases/download/v${version}/sarasa-gothic-ttc-${version}.7z";
-    hash = "sha256-cpgFOhmFSyJA2yhGCCud9jF3LEboiRKyfb3NPiRzJdQ=";
+    hash = "sha256-ZarDttwwZzBb0+iBipVHZGLf1K3lQ7xvjMR6jE3hmh8=";
   };
 
   sourceRoot = ".";
diff --git a/pkgs/development/compilers/julia/1.9.nix b/pkgs/development/compilers/julia/1.9.nix
index d13b078494ad..225c71242272 100644
--- a/pkgs/development/compilers/julia/1.9.nix
+++ b/pkgs/development/compilers/julia/1.9.nix
@@ -14,11 +14,11 @@
 
 stdenv.mkDerivation rec {
   pname = "julia";
-  version = "1.9.0-beta4";
+  version = "1.9.0-rc1";
 
   src = fetchurl {
     url = "https://github.com/JuliaLang/julia/releases/download/v${version}/julia-${version}-full.tar.gz";
-    hash = "sha256-Ipfps2wxPV30nbOxDZ0K39jFB1lNz16aXgFhIKBOquM=";
+    hash = "sha256-BjHuS1pP8S+iZndyGS8HiNzApr7xUYPRPRkX55DEy4Y=";
   };
 
   patches = [
diff --git a/pkgs/development/compilers/minimacy/default.nix b/pkgs/development/compilers/minimacy/default.nix
index e58b8ad498d6..557be6880e78 100644
--- a/pkgs/development/compilers/minimacy/default.nix
+++ b/pkgs/development/compilers/minimacy/default.nix
@@ -1,21 +1,28 @@
-{ lib, stdenv, fetchFromGitHub, makeBinaryWrapper
-, alsaLib, libX11, libXext, libGL, libGLU
+{ lib
+, stdenv
+, alsa-lib
+, fetchFromGitHub
+, libGL
+, libGLU
+, libX11
+, libXext
+, makeBinaryWrapper
 }:
 
 stdenv.mkDerivation rec {
   pname = "minimacy";
-  version = "0.6.2";
+  version = "0.6.4";
 
   src = fetchFromGitHub {
     owner = "ambermind";
     repo = pname;
     rev =  version;
-    sha256 = "i0Z1UKApX+elHmFgujwjiF7k6OmtFF37HJim464OMfU=";
+    hash = "sha256-qIK7QnXZ9FmfarMZaHktZCHhvR8cctyKVpFS8PeOpLs=";
   };
 
   nativeBuildInputs = [ makeBinaryWrapper ];
 
-  buildInputs = [ libGL libGLU ] ++ lib.optionals stdenv.isLinux [ alsaLib libX11 libXext ];
+  buildInputs = [ libGL libGLU ] ++ lib.optionals stdenv.isLinux [ alsa-lib libX11 libXext ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/libraries/alembic/default.nix b/pkgs/development/libraries/alembic/default.nix
index c7bc4894e15b..bff46622d45e 100644
--- a/pkgs/development/libraries/alembic/default.nix
+++ b/pkgs/development/libraries/alembic/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, unzip, cmake, openexr, hdf5-threadsafe }:
+{ lib, stdenv, fetchFromGitHub, cmake, openexr, hdf5-threadsafe, ilmbase }:
 
 stdenv.mkDerivation rec
 {
@@ -12,26 +12,50 @@ stdenv.mkDerivation rec
     sha256 = "sha256-8dQhOQN0t2Y2kC2wOpQUqbu6Woy4DUmiLqXjf1D+mxE=";
   };
 
+  # note: out is unused (but required for outputDoc anyway)
   outputs = [ "bin" "dev" "out" "lib" ];
 
-  nativeBuildInputs = [ unzip cmake ];
-  buildInputs = [ openexr hdf5-threadsafe ];
+  # Prevent cycle between bin and dev (only occurs on Darwin for some reason)
+  propagatedBuildOutputs = [ "lib" ];
 
-  buildPhase = ''
-    cmake -DUSE_HDF5=ON -DCMAKE_INSTALL_PREFIX=$out/ -DUSE_TESTS=OFF .
+  nativeBuildInputs = [ cmake ];
 
-    mkdir $out
-    mkdir -p $bin/bin
-    mkdir -p $dev/include
-    mkdir -p $lib/lib
+  # NOTE: Alembic also support imath instead of ilmbase, but some users of Alembic (e.g. Blender)
+  # are incompatible with the imath version of Alembic
+  buildInputs = [ openexr hdf5-threadsafe ilmbase ];
+
+  # Downstream packages trying to use Alembic via CMake need ilmbase as well
+  # For some reason this won't be picked up correctly otherwise
+  propagatedBuildInputs = [ ilmbase ];
+
+  # These flags along with the postPatch step ensure that all artifacts end up
+  # in the correct output without needing to move anything
+  #
+  # - bin: Uses CMAKE_INSTALL_BINDIR (set via CMake setup hooK)
+  # - lib (contains shared libraries): Uses ALEMBIC_LIB_INSTALL_DIR
+  # - dev (headers): Uses CMAKE_INSTALL_PREFIX
+  #   (this works because every other install rule uses an absolute DESTINATION)
+  # - dev (CMake files): Uses ConfigPackageLocation
+
+  cmakeFlags = [
+    "-DUSE_HDF5=ON"
+    "-DUSE_TESTS=ON"
+    "-DALEMBIC_LIB_INSTALL_DIR=${placeholder "lib"}/lib"
+    "-DConfigPackageLocation=${placeholder "dev"}/lib/cmake/Alembic"
+    "-DCMAKE_INSTALL_PREFIX=${placeholder "dev"}"
+    "-DQUIET=ON"
+  ];
+
+  postPatch = ''
+    find bin/ -type f -name CMakeLists.txt -print -exec \
+      sed -i 's/INSTALL(TARGETS \([a-zA-Z ]*\) DESTINATION bin)/INSTALL(TARGETS \1)/' {} \;
   '';
 
-  installPhase = ''
-    make install
-
-    mv $out/bin $bin/
-    mv $out/lib $lib/
-    mv $out/include $dev/
+  doCheck = true;
+  checkPhase = ''
+    runHook preCheck
+    ctest -j 1
+    runHook postCheck
   '';
 
   meta = with lib; {
@@ -39,6 +63,6 @@ stdenv.mkDerivation rec
     homepage = "http://alembic.io/";
     license = licenses.bsd3;
     platforms = platforms.all;
-    maintainers = [ maintainers.guibou ];
+    maintainers = with maintainers; [ guibou tmarkus ];
   };
 }
diff --git a/pkgs/development/libraries/embree/2.x.nix b/pkgs/development/libraries/embree/2.x.nix
index 12d4e2a87ccd..45f423659195 100644
--- a/pkgs/development/libraries/embree/2.x.nix
+++ b/pkgs/development/libraries/embree/2.x.nix
@@ -22,6 +22,6 @@ stdenv.mkDerivation {
     homepage = "https://embree.github.io/";
     maintainers = with maintainers; [ hodapp ];
     license = licenses.asl20;
-    platforms = platforms.linux;
+    platforms = [ "x86_64-linux" ];
   };
 }
diff --git a/pkgs/development/libraries/embree/default.nix b/pkgs/development/libraries/embree/default.nix
index 5cab69db676f..552859cd4a5d 100644
--- a/pkgs/development/libraries/embree/default.nix
+++ b/pkgs/development/libraries/embree/default.nix
@@ -39,5 +39,6 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ hodapp gebner ];
     license = licenses.asl20;
     platforms = platforms.unix;
+    badPlatforms = [ "aarch64-linux" ];
   };
 }
diff --git a/pkgs/development/libraries/libtiger/default.nix b/pkgs/development/libraries/libtiger/default.nix
index 60dee56e6a2a..7876c23bcc1d 100644
--- a/pkgs/development/libraries/libtiger/default.nix
+++ b/pkgs/development/libraries/libtiger/default.nix
@@ -1,4 +1,6 @@
-{ stdenv, lib, fetchurl, libkate, pango, cairo, pkg-config, darwin }:
+{ stdenv, lib, fetchurl, autoreconfHook, pkg-config
+, libkate, pango, cairo, darwin
+}:
 
 stdenv.mkDerivation rec {
   pname = "libtiger";
@@ -9,7 +11,15 @@ stdenv.mkDerivation rec {
     sha256 = "0rj1bmr9kngrgbxrjbn4f4f9pww0wmf6viflinq7ava7zdav4hkk";
   };
 
-  nativeBuildInputs = [ pkg-config ];
+  patches = [
+    ./pkg-config.patch
+  ];
+
+  postPatch = ''
+    substituteInPlace configure.ac --replace "-Werror" "-Wno-error"
+  '';
+
+  nativeBuildInputs = [ autoreconfHook pkg-config ];
   buildInputs = [ libkate pango cairo ]
     ++ lib.optional stdenv.isDarwin darwin.apple_sdk.frameworks.ApplicationServices;
 
diff --git a/pkgs/development/libraries/libtiger/pkg-config.patch b/pkgs/development/libraries/libtiger/pkg-config.patch
new file mode 100644
index 000000000000..68c892544615
--- /dev/null
+++ b/pkgs/development/libraries/libtiger/pkg-config.patch
@@ -0,0 +1,37 @@
+From 3ebeb0932edc01b7768216dc7d3b3c5aac21fba0 Mon Sep 17 00:00:00 2001
+From: Alyssa Ross <hi@alyssa.is>
+Date: Sun, 26 Feb 2023 17:21:48 +0000
+Subject: [PATCH] configure.ac: detect pkg-config properly
+
+When cross compiling, the relevant pkg-config program might be prefixed
+with the name of the host platform, so the previous check was not
+correct.  Detect pkg-config properly, using the appropriate macro.
+---
+ configure.ac | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/configure.ac b/configure.ac
+index 2f63684..bf2faf7 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -46,7 +46,7 @@ AC_CHECK_FUNCS([select nanosleep usleep])
+ 
+ AC_TYPE_SIZE_T
+ 
+-AC_CHECK_PROG(HAVE_PKG_CONFIG,pkg-config,yes)
++PKG_PROG_PKG_CONFIG
+ 
+ AC_ARG_ENABLE(doc, [  --disable-doc           Disable building documentation (default enabled)])
+ if test "x$enable_doc" != "xno"
+@@ -57,7 +57,7 @@ else
+ fi
+ AM_CONDITIONAL(HAVE_DOXYGEN,test "${HAVE_DOXYGEN}" = "yes")
+ 
+-if test "x$HAVE_PKG_CONFIG" = "xyes"
++if test "x$PKG_CONFIG" != "x"
+ then
+   PKG_CHECK_MODULES(KATE,kate >= 0.2.0)
+   PKG_CHECK_MODULES(PANGOCAIRO,pangocairo >= 1.16)
+-- 
+2.37.1
+
diff --git a/pkgs/development/libraries/prometheus-cpp/default.nix b/pkgs/development/libraries/prometheus-cpp/default.nix
index 521626f24646..dda515932f2c 100644
--- a/pkgs/development/libraries/prometheus-cpp/default.nix
+++ b/pkgs/development/libraries/prometheus-cpp/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "prometheus-cpp";
-  version = "1.0.1";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "jupp0r";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-F8paJhptEcOMtP0FCJ3ragC4kv7XSVPiZheM5UZChno=";
+    sha256 = "sha256-qx6oBxd0YrUyFq+7ArnKBqOwrl5X8RS9nErhRDUJ7+8=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/stduuid/default.nix b/pkgs/development/libraries/stduuid/default.nix
index 07e43bb952c4..c7e31c990087 100644
--- a/pkgs/development/libraries/stduuid/default.nix
+++ b/pkgs/development/libraries/stduuid/default.nix
@@ -1,5 +1,5 @@
 { stdenv, cmake, fetchFromGitHub, lib }: let
-  version = "1.2.2";
+  version = "1.2.3";
 in stdenv.mkDerivation {
   name = "stduuid-${version}";
 
@@ -7,7 +7,7 @@ in stdenv.mkDerivation {
     owner = "mariusbancila";
     repo = "stduuid";
     rev = "v${version}";
-    hash = "sha256-itx1OF1gmEEMy2tJlkN5dpF6o0dlesecuHYfpJdhf7c=";
+    hash = "sha256-MhpKv+gH3QxiaQMx5ImiQjDGrbKUFaaoBLj5Voh78vg=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/python-modules/jupyter-book/default.nix b/pkgs/development/python-modules/jupyter-book/default.nix
index 77ec8f2da543..4f9dc051b7eb 100644
--- a/pkgs/development/python-modules/jupyter-book/default.nix
+++ b/pkgs/development/python-modules/jupyter-book/default.nix
@@ -26,7 +26,7 @@
 
 buildPythonPackage rec {
   pname = "jupyter-book";
-  version = "0.14.0";
+  version = "0.15.0";
 
   format = "flit";
 
@@ -34,7 +34,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-BxrVrOsCqFRmx16l6YdkJplwdnU2XhRFMHd5DGy+dqE=";
+    hash = "sha256-eUw3zC+6kx/OQvMhzkG6R3b2ricX0kvC+fCBD4mkEuo=";
   };
 
   nativeBuildInputs = [
@@ -65,7 +65,6 @@ buildPythonPackage rec {
 
   pythonRelaxDeps = [
     "docutils"
-    "sphinx-book-theme"
   ];
 
   pythonImportsCheck = [
@@ -75,6 +74,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Build a book with Jupyter Notebooks and Sphinx";
     homepage = "https://jupyterbook.org/";
+    changelog = "https://github.com/executablebooks/jupyter-book/blob/v${version}/CHANGELOG.md";
     license = licenses.bsd3;
     maintainers = with maintainers; [ marsam ];
   };
diff --git a/pkgs/development/python-modules/pybalboa/default.nix b/pkgs/development/python-modules/pybalboa/default.nix
index 18d19aff5717..38435c6d22b3 100644
--- a/pkgs/development/python-modules/pybalboa/default.nix
+++ b/pkgs/development/python-modules/pybalboa/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "pybalboa";
-  version = "1.0.0";
+  version = "1.0.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     owner = "garbled1";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-08FMNRArzmfmLH6y5Z8QPcRVZJIvU3VIOvdTry3iBGI=";
+    hash = "sha256-7vjdRGnEnMf32pZwoKRxX16hxkyf0CXlncpbBJMQtfI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pydata-sphinx-theme/default.nix b/pkgs/development/python-modules/pydata-sphinx-theme/default.nix
index 3a7f780702f7..830d7bde55b6 100644
--- a/pkgs/development/python-modules/pydata-sphinx-theme/default.nix
+++ b/pkgs/development/python-modules/pydata-sphinx-theme/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "pydata-sphinx-theme";
-  version = "0.13.0";
+  version = "0.13.1";
 
   format = "wheel";
 
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     dist = "py3";
     python = "py3";
     pname = "pydata_sphinx_theme";
-    hash = "sha256-+ITUC7adMdlk/xnWBk97zqqmNBk1/bwJLVwknR/wC1I=";
+    hash = "sha256-zinB3nlh1hbfol9MOpYZgY1LstSpmF7QeDZ68pT7zMI=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pymumble/default.nix b/pkgs/development/python-modules/pymumble/default.nix
index 558d5c6bd9e5..ffb2f33b1b21 100644
--- a/pkgs/development/python-modules/pymumble/default.nix
+++ b/pkgs/development/python-modules/pymumble/default.nix
@@ -1,23 +1,26 @@
-{ buildPythonPackage
+{ lib
+, buildPythonPackage
 , fetchFromGitHub
 , isPy27
-, lib
 , opuslib
 , protobuf
 , pytestCheckHook
 , pycrypto
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "pymumble";
-  version = "1.6.1";
-  disabled = isPy27;
+  version = "1.7";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "azlux";
     repo = "pymumble";
-    rev = version;
-    sha256 = "1qbsd2zvwd9ksclgiyrl1z79ms0zximm4527mnmhvq36lykgki7s";
+    rev = "refs/tags/${version}";
+    hash = "sha256-NMp1yZ+R9vmne7old7z9UvcxSi6C044g68ZQsofT0gA=";
   };
 
   postPatch = ''
@@ -42,8 +45,9 @@ buildPythonPackage rec {
   ];
 
   meta = with lib; {
-    description = "Python 3 version of pymumble, Mumble library used for multiple uses like making mumble bot.";
+    description = "Library to create mumble bots";
     homepage = "https://github.com/azlux/pymumble";
+    changelog = "https://github.com/azlux/pymumble/releases/tag/${version}";
     license = licenses.gpl3Only;
     maintainers = with maintainers; [ thelegy infinisil ];
   };
diff --git a/pkgs/development/python-modules/questionary/default.nix b/pkgs/development/python-modules/questionary/default.nix
index 359a599b2d4a..c355022323fb 100644
--- a/pkgs/development/python-modules/questionary/default.nix
+++ b/pkgs/development/python-modules/questionary/default.nix
@@ -34,6 +34,10 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  preCheck = lib.optionalString stdenv.isDarwin ''
+    ulimit -n 1024
+  '';
+
   disabledTests = [
     # RuntimeError: no running event loop
     "test_blank_line_fix"
diff --git a/pkgs/development/python-modules/ray/default.nix b/pkgs/development/python-modules/ray/default.nix
index c6b764181875..99a62a64025d 100644
--- a/pkgs/development/python-modules/ray/default.nix
+++ b/pkgs/development/python-modules/ray/default.nix
@@ -68,7 +68,7 @@ buildPythonPackage rec {
   src =
     let
       pyShortVersion = "cp${builtins.replaceStrings ["."] [""] python.pythonVersion}";
-      binary-hash = (import ./binary-hashes.nix)."${pyShortVersion}";
+      binary-hash = (import ./binary-hashes.nix)."${pyShortVersion}" or {};
     in
     fetchPypi ({
       inherit pname version format;
diff --git a/pkgs/development/python-modules/tensorflow/bin.nix b/pkgs/development/python-modules/tensorflow/bin.nix
index dcfa8e0e964c..c9ed92712166 100644
--- a/pkgs/development/python-modules/tensorflow/bin.nix
+++ b/pkgs/development/python-modules/tensorflow/bin.nix
@@ -57,7 +57,7 @@ in buildPythonPackage {
     platform = if stdenv.isDarwin then "mac" else "linux";
     unit = if cudaSupport then "gpu" else "cpu";
     key = "${platform}_py_${pyVerNoDot}_${unit}";
-  in fetchurl packages.${key};
+  in fetchurl (packages.${key} or {});
 
   propagatedBuildInputs = [
     astunparse
diff --git a/pkgs/development/python-modules/trove-classifiers/default.nix b/pkgs/development/python-modules/trove-classifiers/default.nix
index a662d1a1a504..c8a33e9a545f 100644
--- a/pkgs/development/python-modules/trove-classifiers/default.nix
+++ b/pkgs/development/python-modules/trove-classifiers/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "trove-classifiers";
-  version = "2023.2.20";
+  version = "2023.3.9";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-hgsMDYyeDTJinKXvE36h5jdYC2NLdLpA4VOf00RkwPU=";
+    hash = "sha256-7kLy+MHUvP4190bkcvB2M1cNSF+rRUB+/8A3knCjuwM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/analysis/brakeman/Gemfile.lock b/pkgs/development/tools/analysis/brakeman/Gemfile.lock
index a2f6e818f0f2..cd37f4321390 100644
--- a/pkgs/development/tools/analysis/brakeman/Gemfile.lock
+++ b/pkgs/development/tools/analysis/brakeman/Gemfile.lock
@@ -1,7 +1,7 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    brakeman (5.4.0)
+    brakeman (5.4.1)
 
 PLATFORMS
   ruby
@@ -10,4 +10,4 @@ DEPENDENCIES
   brakeman
 
 BUNDLED WITH
-   2.3.25
+   2.4.6
diff --git a/pkgs/development/tools/analysis/brakeman/gemset.nix b/pkgs/development/tools/analysis/brakeman/gemset.nix
index 5798e37538a5..d3d827e507c1 100644
--- a/pkgs/development/tools/analysis/brakeman/gemset.nix
+++ b/pkgs/development/tools/analysis/brakeman/gemset.nix
@@ -4,9 +4,9 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0lcxxlrzgpi9z2mr2v19xda6fdysmn5psa9bsp2rksa915v91fds";
+      sha256 = "0wzvxpabnjwwjgr9s13965dbdgl3qfvwjbmhimh83p81bm5lsrnw";
       type = "gem";
     };
-    version = "5.4.0";
+    version = "5.4.1";
   };
 }
diff --git a/pkgs/development/tools/build-managers/fac/default.nix b/pkgs/development/tools/build-managers/fac/default.nix
index bb9be13ef0f2..c5253edb53e9 100644
--- a/pkgs/development/tools/build-managers/fac/default.nix
+++ b/pkgs/development/tools/build-managers/fac/default.nix
@@ -25,6 +25,9 @@ rustPlatform.buildRustPackage rec {
     substituteInPlace src/git.rs \
         --replace 'std::process::Command::new("git")' \
         'std::process::Command::new("${git}/bin/git")'
+    substituteInPlace tests/lib.rs \
+        --replace 'std::process::Command::new("git")' \
+        'std::process::Command::new("${git}/bin/git")'
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/tools/gemstash/default.nix b/pkgs/development/tools/gemstash/default.nix
index 13ab213c15e0..ce8fde604ab5 100644
--- a/pkgs/development/tools/gemstash/default.nix
+++ b/pkgs/development/tools/gemstash/default.nix
@@ -1,11 +1,14 @@
-{ lib, bundlerApp, bundlerUpdateScript }:
+{ lib, bundlerApp, bundlerUpdateScript, nixosTests }:
 
 bundlerApp rec {
   pname = "gemstash";
   gemdir = ./.;
   exes = [ pname ];
 
-  passthru.updateScript = bundlerUpdateScript pname;
+  passthru = {
+    updateScript = bundlerUpdateScript pname;
+    tests = { inherit (nixosTests) gemstash; };
+  };
 
   meta = with lib; {
     description = "A cache for RubyGems.org and a private gem server";
diff --git a/pkgs/development/tools/language-servers/lua-language-server/default.nix b/pkgs/development/tools/language-servers/lua-language-server/default.nix
index 23946af16f6b..969fda1d153d 100644
--- a/pkgs/development/tools/language-servers/lua-language-server/default.nix
+++ b/pkgs/development/tools/language-servers/lua-language-server/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "lua-language-server";
-  version = "3.6.13";
+  version = "3.6.17";
 
   src = fetchFromGitHub {
     owner = "luals";
     repo = "lua-language-server";
     rev = version;
-    sha256 = "sha256-9TFTmTjj6FfPTfcgnQaHFYUtoM1VUMSpD7Yxk/Oeul0=";
+    sha256 = "sha256-/AvyiE9r7aEPRDc486CER4B5/9NWh7BhI3y3ieDMxQU=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/tools/metal-cli/default.nix b/pkgs/development/tools/metal-cli/default.nix
index f6d5103745b7..002caa296f90 100644
--- a/pkgs/development/tools/metal-cli/default.nix
+++ b/pkgs/development/tools/metal-cli/default.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "metal-cli";
-  version = "0.13.0";
+  version = "0.14.1";
 
   src = fetchFromGitHub {
     owner = "equinix";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-v+8zfNV93nrRSwfn1u7SNYv7WYY74R8nPJFmreDb7i4=";
+    hash = "sha256-CibqkT4YHxQ7geUKROp7SMvamN0ba/FqTXFHO1TUP/k=";
   };
 
-  vendorHash = "sha256-drsNZXLNUWICLI8D+IvJE4X8GmWrP9U3dmpf9HnKCWw=";
+  vendorHash = "sha256-4hjrKlpd+gr/yLRuSq8XrOVl76uYVIMfYjTAgqkbOSw=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/development/tools/misc/blackfire/default.nix b/pkgs/development/tools/misc/blackfire/default.nix
index 6bd622a6e749..8d5a5efb20d7 100644
--- a/pkgs/development/tools/misc/blackfire/default.nix
+++ b/pkgs/development/tools/misc/blackfire/default.nix
@@ -10,7 +10,7 @@
 
 stdenv.mkDerivation rec {
   pname = "blackfire";
-  version = "2.13.2";
+  version = "2.14.0";
 
   src = passthru.sources.${stdenv.hostPlatform.system} or (throw "Unsupported platform for blackfire: ${stdenv.hostPlatform.system}");
 
@@ -57,23 +57,23 @@ stdenv.mkDerivation rec {
     sources = {
       "x86_64-linux" = fetchurl {
         url = "https://packages.blackfire.io/debian/pool/any/main/b/blackfire/blackfire_${version}_amd64.deb";
-        sha256 = "1/O1n0nO+adY7KNVnz6xkESyODiLw61x68xE84EKW+I=";
+        sha256 = "PrKJlxJhMX9ZgUGPIQFmAi7PMdcZKTuIuCUEunlYq+I=";
       };
       "i686-linux" = fetchurl {
         url = "https://packages.blackfire.io/debian/pool/any/main/b/blackfire/blackfire_${version}_i386.deb";
-        sha256 = "fy3i++HpGuKH9ijPY61O66PhFyORIpjkZV++75H5738=";
+        sha256 = "F1ners+2TVfhiIlmUSMRX7/nLVg5fEw5z6mW3kyHDnE=";
       };
       "aarch64-linux" = fetchurl {
         url = "https://packages.blackfire.io/debian/pool/any/main/b/blackfire/blackfire_${version}_arm64.deb";
-        sha256 = "zO3KWbrudhCGpbdCUBRWQkK/snvDdUOxKF9ukZC+vno=";
+        sha256 = "ux/Yc03XCZkEfnsBuY9SqhnDIESbVzuyo0OF0Mbhc44=";
       };
       "aarch64-darwin" = fetchurl {
         url = "https://packages.blackfire.io/blackfire/${version}/blackfire-darwin_arm64.pkg.tar.gz";
-        sha256 = "Sqn5tFpvlF9LbUyC1i38BsyM9B+MOmykt+5COMhuO1A=";
+        sha256 = "JXQpLnRFZNxfwE+kpzYGTiB1/gsS/lzDEIwMT88oj5U=";
       };
       "x86_64-darwin" = fetchurl {
         url = "https://packages.blackfire.io/blackfire/${version}/blackfire-darwin_amd64.pkg.tar.gz";
-        sha256 = "9vrrBiz744s1W5FV7QO8QKL7pfK6OGPinnSOJSvMIOk=";
+        sha256 = "TdYMAy2lkwA+IYKriw9d+qXSv7+Pbi9ap/M5/3DnhPw=";
       };
     };
 
diff --git a/pkgs/development/tools/moq/default.nix b/pkgs/development/tools/moq/default.nix
index b7b7ffcfd840..f62aba7b6c25 100644
--- a/pkgs/development/tools/moq/default.nix
+++ b/pkgs/development/tools/moq/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "moq";
-  version = "0.3.0";
+  version = "0.3.1";
 
   src = fetchFromGitHub {
     owner = "matryer";
     repo = "moq";
     rev = "v${version}";
-    sha256 = "sha256-RdFffcj17CZdI6kL+d5fp8B8gX493k8h0EzDq8BN+SY=";
+    sha256 = "sha256-nareKBRPL7DVmclTqZCvImxXmHxXxbus1+U1QWCeSy0=";
   };
 
-  vendorSha256 = "sha256-lfs61YK5HmUd3/qA4o9MiWeTFhu4MTAkNH+f0iGlRe0=";
+  vendorHash = "sha256-lfs61YK5HmUd3/qA4o9MiWeTFhu4MTAkNH+f0iGlRe0=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/development/tools/rust/cargo-all-features/default.nix b/pkgs/development/tools/rust/cargo-all-features/default.nix
index 3d36b42ebe7c..6b3965afc263 100644
--- a/pkgs/development/tools/rust/cargo-all-features/default.nix
+++ b/pkgs/development/tools/rust/cargo-all-features/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-all-features";
-  version = "1.6.0";
+  version = "1.7.0";
 
   src = fetchFromGitHub {
     owner = "frewsxcv";
     repo = pname;
     rev = version;
-    sha256 = "1pdr34ygc0qmh0dyrw1qcrh1vgg9jv9lm6ypl3fgjzz7npdj1dw4";
+    sha256 = "sha256-p9UQaqytqpD2u9X9zaTPIgVEloU2UbD/AxVERNs1Lt8=";
   };
 
-  cargoSha256 = "sha256-BsRJo55gYT8OkDUBepWq48sW7QPt5OZkm8RR9f7HqZY=";
+  cargoSha256 = "sha256-krtuLFQlInqdv7j8v13/X3lL0JdaMsApb9Ga5muThgw=";
 
   meta = with lib; {
     description = "A Cargo subcommand to build and test all feature flag combinations";
diff --git a/pkgs/development/tools/rust/cargo-public-api/default.nix b/pkgs/development/tools/rust/cargo-public-api/default.nix
index ba5dc4e1fc0e..2d178bda16da 100644
--- a/pkgs/development/tools/rust/cargo-public-api/default.nix
+++ b/pkgs/development/tools/rust/cargo-public-api/default.nix
@@ -9,14 +9,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-public-api";
-  version = "0.27.2";
+  version = "0.27.3";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-6LXFrLSApEQXa34zTVgqUVYMiFnGi6i7gyXnMglHtFE=";
+    hash = "sha256-s5aPzaH08XvGm+hZy+dQkvp8rVFcGWoTgniIfOzQk4E=";
   };
 
-  cargoHash = "sha256-3lMUKtHpCXN+fKDbU4QwVUol6aL6dxP5Bbf59xEkcjY=";
+  cargoHash = "sha256-q5Oq9Lg7cNteHvzaAWwzoHThYiXac/x1Y5LyFZjfSCo=";
 
   nativeBuildInputs = [ pkg-config ];
 
@@ -29,6 +29,7 @@ rustPlatform.buildRustPackage rec {
   meta = with lib; {
     description = "List and diff the public API of Rust library crates between releases and commits. Detect breaking API changes and semver violations";
     homepage = "https://github.com/Enselic/cargo-public-api";
+    changelog = "https://github.com/Enselic/cargo-public-api/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ matthiasbeyer ];
   };
diff --git a/pkgs/development/tools/sentry-cli/default.nix b/pkgs/development/tools/sentry-cli/default.nix
index 7a9f76d19c48..222aa13698f4 100644
--- a/pkgs/development/tools/sentry-cli/default.nix
+++ b/pkgs/development/tools/sentry-cli/default.nix
@@ -9,13 +9,13 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "sentry-cli";
-  version = "2.14.3";
+  version = "2.14.4";
 
   src = fetchFromGitHub {
     owner = "getsentry";
     repo = "sentry-cli";
     rev = version;
-    sha256 = "sha256-l2/gwguNQAcnBGQxVGBUecIFbp8CHrrqDrjRFxaeVe4=";
+    sha256 = "sha256-7uZPtMu6U6T5TwwnMy/xy7dKVl77Exmj1U3ue6S/rrI=";
   };
   doCheck = false;
 
@@ -25,7 +25,7 @@ rustPlatform.buildRustPackage rec {
   buildInputs = [ openssl ] ++ lib.optionals stdenv.isDarwin [ Security SystemConfiguration ];
   nativeBuildInputs = [ pkg-config ];
 
-  cargoHash = "sha256-h9rkTnGFMclTTyUy39rpKiorcy3953u2nbHiydOAmqI=";
+  cargoHash = "sha256-tezeakmPtujtdr1nc2anaJAWCJ3lS2L/LsH8qa1O3tI=";
 
   meta = with lib; {
     homepage = "https://docs.sentry.io/cli/";
diff --git a/pkgs/servers/search/qdrant/default.nix b/pkgs/servers/search/qdrant/default.nix
index 47e4f04bac89..87a73a7e850b 100644
--- a/pkgs/servers/search/qdrant/default.nix
+++ b/pkgs/servers/search/qdrant/default.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "qdrant";
-  version = "1.0.2";
+  version = "1.0.3";
 
   src = fetchFromGitHub {
     owner = "qdrant";
     repo = "qdrant";
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-AVglZr3J9fEWgE2g5UHt1j6YQud/viGp0IvuR9XRntE=";
+    sha256 = "sha256-r47mfyuM3z3SKbUi1bz8cz7BS/X8/tsIOAMKavNTgN4=";
   };
 
-  cargoSha256 = "sha256-4hzixh1/nVIMRsBSoldmbtpcpBMmvxik3lV/h4FPOrk=";
+  cargoHash = "sha256-EwB0Vz0NyKCek2rn1QHqk5zpReMjP0o46ajete9KmWk=";
 
   prePatch = lib.optionalString stdenv.isAarch64 ''
     substituteInPlace .cargo/config.toml \
diff --git a/pkgs/servers/sql/postgresql/ext/timescaledb.nix b/pkgs/servers/sql/postgresql/ext/timescaledb.nix
index 045e381edd73..a476d3e21d3a 100644
--- a/pkgs/servers/sql/postgresql/ext/timescaledb.nix
+++ b/pkgs/servers/sql/postgresql/ext/timescaledb.nix
@@ -13,7 +13,7 @@
 
 stdenv.mkDerivation rec {
   pname = "timescaledb";
-  version = "2.10.0";
+  version = "2.10.1";
 
   nativeBuildInputs = [ cmake ];
   buildInputs = [ postgresql openssl libkrb5 ];
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     owner = "timescale";
     repo = "timescaledb";
     rev = version;
-    sha256 = "sha256-3Pne4L9P8mJv2ja6EpxtpCBCYvlCP6D5CzDtkkvE23c=";
+    sha256 = "sha256-D0jo1Z9hpaJBFJQhypo76cKaahNF498OLDco2YNktA8=";
   };
 
   cmakeFlags = [ "-DSEND_TELEMETRY_DEFAULT=OFF" "-DREGRESS_CHECKS=OFF" "-DTAP_CHECKS=OFF" ]
diff --git a/pkgs/stdenv/linux/bootstrap-files/mips64el-n32.nix b/pkgs/stdenv/linux/bootstrap-files/mips64el-n32.nix
new file mode 100644
index 000000000000..cf26c2113ec8
--- /dev/null
+++ b/pkgs/stdenv/linux/bootstrap-files/mips64el-n32.nix
@@ -0,0 +1,25 @@
+#
+# Files came from this Hydra build:
+#
+#   https://hydra.nixos.org/build/188389586
+#
+# Which used nixpkgs revision 97d9c84e1df4397b43ecb39359f1bd003cd44585
+# to instantiate:
+#
+#   /nix/store/hakn8s85s9011v61r6svp5qy8x1y64fv-stdenv-bootstrap-tools-mips64el-unknown-linux-gnuabin32.drv
+#
+# and then built:
+#
+#   /nix/store/rjgybpnf3yiqyhvl2n2lx31jf800fii2-stdenv-bootstrap-tools-mips64el-unknown-linux-gnuabin32
+#
+{
+  busybox = import <nix/fetchurl.nix> {
+    url = "http://tarballs.nixos.org/stdenv-linux/mips64el-n32/97d9c84e1df4397b43ecb39359f1bd003cd44585/busybox";
+    sha256 = "sha256-4N3G1qYA7vitjhsIW17pR6UixIuzrq4vZXa8F0/X4iI=";
+    executable = true;
+  };
+  bootstrapTools = import <nix/fetchurl.nix> {
+    url = "http://tarballs.nixos.org/stdenv-linux/mips64el-n32/97d9c84e1df4397b43ecb39359f1bd003cd44585/bootstrap-tools.tar.xz";
+    sha256 = "sha256-LWrpN6su2yNVurUyhZP34OiZyzgh7MfN13fIIbou8KI=";
+  };
+}
diff --git a/pkgs/stdenv/linux/default.nix b/pkgs/stdenv/linux/default.nix
index 18a593b058df..51f217f03b27 100644
--- a/pkgs/stdenv/linux/default.nix
+++ b/pkgs/stdenv/linux/default.nix
@@ -69,7 +69,10 @@
       armv7l-linux = import ./bootstrap-files/armv7l.nix;
       aarch64-linux = import ./bootstrap-files/aarch64.nix;
       mipsel-linux = import ./bootstrap-files/loongson2f.nix;
-      mips64el-linux = import ./bootstrap-files/mips64el.nix;
+      mips64el-linux = import
+       (if localSystem.isMips64n32
+        then ./bootstrap-files/mips64el-n32.nix
+        else ./bootstrap-files/mips64el.nix);
       powerpc64le-linux = import ./bootstrap-files/powerpc64le.nix;
       riscv64-linux = import ./bootstrap-files/riscv64.nix;
     };
diff --git a/pkgs/tools/admin/scaleway-cli/default.nix b/pkgs/tools/admin/scaleway-cli/default.nix
index 918cd6bdf618..273d22a1980c 100644
--- a/pkgs/tools/admin/scaleway-cli/default.nix
+++ b/pkgs/tools/admin/scaleway-cli/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "scaleway-cli";
-  version = "2.11.1";
+  version = "2.12.0";
 
   src = fetchFromGitHub {
     owner = "scaleway";
     repo = "scaleway-cli";
     rev = "v${version}";
-    sha256 = "sha256-tE2r2d3dagMvfPq/2G61KMPZyz6YQG3jAD+MjQ3uYbg=";
+    sha256 = "sha256-4BIw+vk0LJL6/AWtZDtOP88UqUg1EiDASMaEP3/7Bx0=";
   };
 
-  vendorHash = "sha256-eqVAX6l7wsHqFjzwLiTSwryLHxl0aJqQOmjyGeM+1co=";
+  vendorHash = "sha256-Wdbh7rFKvWdDULMwYxvTrWim6iO6kQaYseSkq2PBfUM=";
 
   ldflags = [
     "-w"
diff --git a/pkgs/tools/cd-dvd/ventoy-bin/default.nix b/pkgs/tools/cd-dvd/ventoy-bin/default.nix
index 5bf4ef2df56a..0bfb1456fc51 100644
--- a/pkgs/tools/cd-dvd/ventoy-bin/default.nix
+++ b/pkgs/tools/cd-dvd/ventoy-bin/default.nix
@@ -51,13 +51,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "ventoy-bin";
-  version = "1.0.88";
+  version = "1.0.89";
 
   src = let
     inherit (finalAttrs) version;
   in fetchurl {
     url = "https://github.com/ventoy/Ventoy/releases/download/v${version}/ventoy-${version}-linux.tar.gz";
-    hash = "sha256-mg1dzXREIhO9LsoCEauuBR9ESGHM3RvoFN+5vHU0HDA=";
+    hash = "sha256-dPBMABzmITUenOe57BD5EmofZeXC9v6IpW7m+OhhYdA=";
   };
 
   patches = [
diff --git a/pkgs/tools/filesystems/httm/default.nix b/pkgs/tools/filesystems/httm/default.nix
index 81aa2630506c..9d74dbf38c78 100644
--- a/pkgs/tools/filesystems/httm/default.nix
+++ b/pkgs/tools/filesystems/httm/default.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "httm";
-  version = "0.23.2";
+  version = "0.23.3";
 
   src = fetchFromGitHub {
     owner = "kimono-koans";
     repo = pname;
     rev = version;
-    hash = "sha256-lNB7fZwIOXA4bryftHFZlAa6kJldouxCf00h7J7qQM0=";
+    hash = "sha256-yia7GEPemFVHzTkhrL7HejQsFO1zwpdUtq4DLdm4s2g=";
   };
 
-  cargoHash = "sha256-NQqipHJXvbDMO8kUMKnzEdz7atPYcjj7/uf3PSXZy0A=";
+  cargoHash = "sha256-NfuLLKt4dObggqFw8bjHMYdJPz2Rx8eXBrz5/BB7UxM=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/graphics/glmark2/default.nix b/pkgs/tools/graphics/glmark2/default.nix
index 5503e9eb38e0..bfcaa7154c0b 100644
--- a/pkgs/tools/graphics/glmark2/default.nix
+++ b/pkgs/tools/graphics/glmark2/default.nix
@@ -3,6 +3,9 @@
 , fetchFromGitHub
 , pkg-config
 , makeWrapper
+, meson
+, ninja
+, wayland-scanner
 , libjpeg
 , libpng
 , xorg
@@ -10,11 +13,9 @@
 , libGL
 , libdrm
 , udev
-, python3
 , wayland
 , wayland-protocols
 , mesa
-, wafHook
 }:
 
 stdenv.mkDerivation rec {
@@ -28,21 +29,20 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-WCvc5GqrAdpIKQ4LVqwO6ZGbzBgLCl49NxiGJynIjSQ=";
   };
 
-  nativeBuildInputs = [ pkg-config wafHook makeWrapper ];
+  depsBuildBuild = [ pkg-config ];
+  nativeBuildInputs = [ pkg-config makeWrapper meson ninja wayland-scanner ];
   buildInputs = [
     libjpeg
     libpng
-    xorg.libxcb
     libX11
     libdrm
-    python3
     udev
     wayland
     wayland-protocols
     mesa
   ];
 
-  wafConfigureFlags = [ "--with-flavors=x11-gl,x11-glesv2,drm-gl,drm-glesv2,wayland-gl,wayland-glesv2" ];
+  mesonFlags = [ "-Dflavors=drm-gl,drm-glesv2,gbm-gl,gbm-glesv2,wayland-gl,wayland-glesv2,x11-gl,x11-gl-egl,x11-glesv2" ];
 
   postInstall = ''
     for binary in $out/bin/glmark2*; do
diff --git a/pkgs/tools/misc/infracost/default.nix b/pkgs/tools/misc/infracost/default.nix
index 5bb1559af2d2..c79a9f33afe5 100644
--- a/pkgs/tools/misc/infracost/default.nix
+++ b/pkgs/tools/misc/infracost/default.nix
@@ -2,15 +2,15 @@
 
 buildGoModule rec {
   pname = "infracost";
-  version = "0.10.17";
+  version = "0.10.18";
 
   src = fetchFromGitHub {
     owner = "infracost";
     rev = "v${version}";
     repo = "infracost";
-    sha256 = "sha256-lAHZ6G7DnK2Pu3If5qZ12UF/NYNgd9utiz/dgkgJcjk=";
+    sha256 = "sha256-mvy/GFEzldRpzChF79wyfGd00K0tA6BAlRrAAAbt7Pc=";
   };
-  vendorHash = "sha256-hfJY0yKr0OsgMKtVkfkbQ6nLGPnyS+PT23qQwuXiuqs=";
+  vendorHash = "sha256-BplhgUIRZbMxYh2DWuGLpuNFmQuwen/u5oOs08fdXXY=";
 
   ldflags = [ "-s" "-w" "-X github.com/infracost/infracost/internal/version.Version=v${version}" ];
 
diff --git a/pkgs/tools/misc/skim/default.nix b/pkgs/tools/misc/skim/default.nix
index 331d307c133f..b6a77485d1ce 100644
--- a/pkgs/tools/misc/skim/default.nix
+++ b/pkgs/tools/misc/skim/default.nix
@@ -7,18 +7,18 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "skim";
-  version = "0.10.3";
+  version = "0.10.4";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-d0gzeyOc9UudgTrTFt5OhUAsTy/SYMvRMyph2yAD9H8=";
+    sha256 = "sha256-C2yK+SO8Tpw3BxXXu1jeDzYJ2548RZa7NFWaE0SdNJ0=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
 
   outputs = [ "out" "vim" ];
 
-  cargoHash = "sha256-ZLA1ZE/VLZyzQzIECcabxKup409YBZRpHdhR2k/+4lY=";
+  cargoHash = "sha256-jBcgoWbmBOgU7M71lr4OXOe2S6NAXl+I8D+ZtT45Vos=";
 
   postPatch = ''
     sed -i -e "s|expand('<sfile>:h:h')|'$out'|" plugin/skim.vim
diff --git a/pkgs/tools/networking/airgeddon/default.nix b/pkgs/tools/networking/airgeddon/default.nix
index 2b72e3fee05f..6ef64222fba8 100644
--- a/pkgs/tools/networking/airgeddon/default.nix
+++ b/pkgs/tools/networking/airgeddon/default.nix
@@ -111,13 +111,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "airgeddon";
-  version = "11.10";
+  version = "11.11";
 
   src = fetchFromGitHub {
     owner = "v1s1t0r1sh3r3";
     repo = "airgeddon";
-    rev = "v${version}";
-    hash = "sha256-0x13QmT61lcPc7b3OYs13g6AISWRipvxbSFb7XyQA5U=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-3Rx1tMRIpSk+IEJGOs+t+kDlvGHYOx1IOSi+663uzrw=";
   };
 
   strictDeps = true;
@@ -159,8 +159,9 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    description = "Multi-use TUI to audit wireless networks. ";
+    description = "Multi-use TUI to audit wireless networks";
     homepage = "https://github.com/v1s1t0r1sh3r3/airgeddon";
+    changelog = "https://github.com/v1s1t0r1sh3r3/airgeddon/blob/v${version}/CHANGELOG.md";
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ pedrohlc ];
     platforms = platforms.linux;
diff --git a/pkgs/tools/package-management/comma/default.nix b/pkgs/tools/package-management/comma/default.nix
index d980143281f4..3007a02c3d19 100644
--- a/pkgs/tools/package-management/comma/default.nix
+++ b/pkgs/tools/package-management/comma/default.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "comma";
-  version = "1.4.1";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "nix-community";
     repo = "comma";
     rev = "v${version}";
-    hash = "sha256-5M2VVrYH+IAa1P7Qz9gUPS3YNdqeVOoa1riV8eTtoYE=";
+    hash = "sha256-OonKO7D6xuNf9S6SvxWYzZXNOfoUw5ZEymfC5UmZT7Y=";
   };
 
-  cargoHash = "sha256-kdhzoExiUAevid5NCCDTkK5CO+esa/SRGOcrITlr2fo=";
+  cargoHash = "sha256-q6MbaKrGkwvKWSfL7bQjf9+RdcgKpKj3iXJtSz3FnMc=";
 
   nativeBuildInputs = [ makeBinaryWrapper ];
 
diff --git a/pkgs/tools/security/cryptomator/default.nix b/pkgs/tools/security/cryptomator/default.nix
index 1e6833f3a8b3..b6a1726dd6a3 100644
--- a/pkgs/tools/security/cryptomator/default.nix
+++ b/pkgs/tools/security/cryptomator/default.nix
@@ -116,6 +116,6 @@ in stdenv.mkDerivation rec {
     ];
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ bachp ];
-    platforms = platforms.linux;
+    platforms = [ "x86_64-linux" ];
   };
 }
diff --git a/pkgs/tools/security/keyscope/default.nix b/pkgs/tools/security/keyscope/default.nix
index 08c2ded80ad8..31d97256f0e7 100644
--- a/pkgs/tools/security/keyscope/default.nix
+++ b/pkgs/tools/security/keyscope/default.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "keyscope";
-  version = "1.2.3";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "spectralops";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-RKeEumj9HuifEXE8g5G7EsIalGD1vLRawh59s/ykUmg=";
+    sha256 = "sha256-SrBtgirg52q7gM3GZsJsV8ASACvb4sYv5HDbyItpjbk=";
   };
 
-  cargoSha256 = "sha256-8lTwczuOgPhzwGcQ2KoqK5Zf3HS3uwsok036l+12Xb0=";
+  cargoSha256 = "sha256-MFP3AqlfaclmZxRwaWFw6hsZwCQMRKJEyFEyUN+QLqo=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/tools/security/secp256k1/default.nix b/pkgs/tools/security/secp256k1/default.nix
index fa07080d2dfa..cb9cf172daa1 100644
--- a/pkgs/tools/security/secp256k1/default.nix
+++ b/pkgs/tools/security/secp256k1/default.nix
@@ -7,13 +7,13 @@
 stdenv.mkDerivation rec {
   pname = "secp256k1";
 
-  version = "0.2.0";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "bitcoin-core";
     repo = "secp256k1";
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-wYJIMCoo6ryeQN4ZnvEkJ5/332+AkaOwgplDuQQC5MU=";
+    sha256 = "sha256-ii4JuYd65L0FBWY+cqcFuUEjExZOj6Pt5T0OyaVhIEI=";
   };
 
   nativeBuildInputs = [ autoreconfHook ];
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index a358278e5ed8..9475def8a73a 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3844,7 +3844,6 @@ with pkgs;
 
   bookstack = callPackage ../servers/web-apps/bookstack { };
 
-  # Upstream recommends qt5.12 and it doesn't build with qt5.15
   boomerang = libsForQt5.callPackage ../development/tools/boomerang { };
 
   boost-build = callPackage ../development/tools/boost-build { };