diff --git a/nixos/doc/manual/release-notes/rl-2305.section.md b/nixos/doc/manual/release-notes/rl-2305.section.md
index 76e439373114..85fce98b88c0 100644
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@@ -158,7 +158,7 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - The [services.wordpress.sites.<name>.plugins](#opt-services.wordpress.sites._name_.plugins) and [services.wordpress.sites.<name>.themes](#opt-services.wordpress.sites._name_.themes) options have been converted from sets to attribute sets to allow for consumers to specify explicit install paths via attribute name.
 
-- `protonmail-bridge` package has been updated to v3.0 and the CLI executable is now named bridge instead of protonmail-bridge to be more in line with upstream.
+- `protonmail-bridge` package has been updated to major version 3.
 
 - Nebula now runs as a system user and group created for each nebula network, using the `CAP_NET_ADMIN` ambient capability on launch rather than starting as root. Ensure that any files each Nebula instance needs to access are owned by the correct user and group, by default `nebula-${networkName}`.
 
@@ -336,8 +336,6 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - The `unifi-poller` package and corresponding NixOS module have been renamed to `unpoller` to match upstream.
 
-- `protonmail-bridge` package has been updated to v3.0 and the CLI executable is now named bridge instead of protonmail-bridge to be more in line with upstream.
-
 - The new option `services.tailscale.useRoutingFeatures` controls various settings for using Tailscale features like exit nodes and subnet routers. If you wish to use your machine as an exit node, you can set this setting to `server`, otherwise if you wish to use an exit node you can set this setting to `client`. The strict RPF warning has been removed as the RPF will be loosened automatically based on the value of this setting.
 
 - `openjdk` from version 11 and above is not build with `openjfx` (i.e.: JavaFX) support by default anymore. You can re-enable it by overriding, e.g.: `openjdk11.override { enableJavaFX = true; };`.
diff --git a/nixos/modules/programs/steam.nix b/nixos/modules/programs/steam.nix
index 98269f6250db..fc63f0f187e8 100644
--- a/nixos/modules/programs/steam.nix
+++ b/nixos/modules/programs/steam.nix
@@ -9,23 +9,36 @@ in {
     enable = mkEnableOption (lib.mdDoc "steam");
 
     package = mkOption {
-      type        = types.package;
-      default     = pkgs.steam.override {
-        extraLibraries = pkgs: with config.hardware.opengl;
-          if pkgs.stdenv.hostPlatform.is64bit
-          then [ package ] ++ extraPackages
-          else [ package32 ] ++ extraPackages32;
-      };
-      defaultText = literalExpression ''
-        pkgs.steam.override {
-          extraLibraries = pkgs: with config.hardware.opengl;
+      type = types.package;
+      default = pkgs.steam;
+      defaultText = literalExpression "pkgs.steam";
+      example = literalExpression ''
+        pkgs.steam-small.override {
+          extraEnv = {
+            MANGOHUD = true;
+            OBS_VKCAPTURE = true;
+            RADV_TEX_ANISO = 16;
+          };
+          extraLibraries = p: with p; [
+            atk
+          ];
+        }
+      '';
+      apply = steam: steam.override (prev: {
+        extraLibraries = pkgs: let
+          prevLibs = if prev ? extraLibraries then prev.extraLibraries pkgs else [ ];
+          additionalLibs = with config.hardware.opengl;
             if pkgs.stdenv.hostPlatform.is64bit
             then [ package ] ++ extraPackages
             else [ package32 ] ++ extraPackages32;
-        }
-      '';
+        in prevLibs ++ additionalLibs;
+      });
       description = lib.mdDoc ''
-        steam package to use.
+        The Steam package to use. Additional libraries are added from the system
+        configuration to ensure graphics work properly.
+
+        Use this option to customise the Steam package rather than adding your
+        custom Steam to {option}`environment.systemPackages` yourself.
       '';
     };
 
diff --git a/pkgs/applications/audio/audacity/default.nix b/pkgs/applications/audio/audacity/default.nix
index 6d8f279dadbd..24d610f62d02 100644
--- a/pkgs/applications/audio/audacity/default.nix
+++ b/pkgs/applications/audio/audacity/default.nix
@@ -75,6 +75,8 @@ stdenv.mkDerivation rec {
   '' + lib.optionalString stdenv.isLinux ''
     substituteInPlace libraries/lib-files/FileNames.cpp \
       --replace /usr/include/linux/magic.h ${linuxHeaders}/include/linux/magic.h
+  '' + lib.optionalString (stdenv.isDarwin && lib.versionOlder stdenv.targetPlatform.darwinMinVersion "11.0") ''
+    sed -z -i "s/NSAppearanceName.*systemAppearance//" src/AudacityApp.mm
   '';
 
   nativeBuildInputs = [
@@ -93,9 +95,6 @@ stdenv.mkDerivation rec {
     ffmpeg_4
     file
     flac
-  ] ++ lib.optionals stdenv.isDarwin [
-    AppKit
-  ] ++ [
     gtk3
     lame
     libid3tag
@@ -135,6 +134,7 @@ stdenv.mkDerivation rec {
     libuuid
     util-linux
   ] ++ lib.optionals stdenv.isDarwin [
+    AppKit
     CoreAudioKit # for portaudio
     libpng
     libjpeg
diff --git a/pkgs/applications/audio/go-musicfox/default.nix b/pkgs/applications/audio/go-musicfox/default.nix
index da54f07dfb00..40ecd0dd21a6 100644
--- a/pkgs/applications/audio/go-musicfox/default.nix
+++ b/pkgs/applications/audio/go-musicfox/default.nix
@@ -10,13 +10,13 @@
 # gcc only supports objc on darwin
 buildGoModule.override { stdenv = clangStdenv; } rec {
   pname = "go-musicfox";
-  version = "3.7.5";
+  version = "3.7.7";
 
   src = fetchFromGitHub {
     owner = "anhoder";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-+0s+MCFLw527gFj7pfiYGfKYihthFjRLPeto2SbALw0=";
+    hash = "sha256-gQPr+mCZ7tnASs/ibow1b0Qj3ppZhdgP4U1Vxo+FfE4=";
   };
 
   deleteVendor = true;
diff --git a/pkgs/applications/blockchains/exodus/default.nix b/pkgs/applications/blockchains/exodus/default.nix
index 1bc33588c42d..709e20f476b2 100644
--- a/pkgs/applications/blockchains/exodus/default.nix
+++ b/pkgs/applications/blockchains/exodus/default.nix
@@ -4,11 +4,11 @@ cups, vivaldi-ffmpeg-codecs, libpulseaudio, at-spi2-core, libxkbcommon, mesa }:
 
 stdenv.mkDerivation rec {
   pname = "exodus";
-  version = "22.8.12";
+  version = "23.3.13";
 
   src = fetchzip {
     url = "https://downloads.exodus.com/releases/${pname}-linux-x64-${version}.zip";
-    sha256 = "sha256-jNzHh4zYhFzpFZAC9rHmwjTdFkbpROSEN3qpL7geiOU=";
+    sha256 = "sha256-/xCDtR3V++LaZZWTaNpeD3YuP5ZM5BChB1CUBH/xNcU=";
   };
 
   installPhase = ''
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index bf975ce68eba..40ff07c7d4fc 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -25,11 +25,13 @@ let
   inherit (vscode-utils) buildVscodeMarketplaceExtension;
 
   #
-  # Unless there is a good reason not to, we attempt to use the same name as the
-  # extension's unique identifier (the name the extension gets when installed
-  # from vscode under `~/.vscode`) and found on the marketplace extension page.
-  # So an extension's attribute name should be of the form:
-  # "${mktplcRef.publisher}.${mktplcRef.name}".
+  # Unless there is a good reason not to, we attempt to use the lowercase
+  # version of the extension's unique identifier. The unique identifier can be
+  # found on the marketplace extension page, and is the name under which the
+  # extension is installed by VSCode under `~/.vscode`.
+  #
+  # This means an extension should be located at
+  # ${lib.strings.toLower mktplcRef.publisher}.${lib.string.toLower mktplcRef.name}
   #
   baseExtensions = self: lib.mapAttrs (_n: lib.recurseIntoAttrs)
     {
@@ -253,7 +255,7 @@ let
         };
       };
 
-      Arjun.swagger-viewer = buildVscodeMarketplaceExtension {
+      arjun.swagger-viewer = buildVscodeMarketplaceExtension {
         mktplcRef = {
           publisher = "Arjun";
           name = "swagger-viewer";
@@ -451,18 +453,6 @@ let
         };
       };
 
-      bodil.file-browser = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "file-browser";
-          publisher = "bodil";
-          version = "0.2.11";
-          sha256 = "sha256-yPVhhsAUZxnlhj58fXkk+yhxop2q7YJ6X4W9dXGKJfo=";
-        };
-        meta = {
-          license = lib.licenses.mit;
-        };
-      };
-
       bierner.emojisense = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "emojisense";
@@ -536,6 +526,18 @@ let
         };
       };
 
+      bodil.file-browser = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "file-browser";
+          publisher = "bodil";
+          version = "0.2.11";
+          sha256 = "sha256-yPVhhsAUZxnlhj58fXkk+yhxop2q7YJ6X4W9dXGKJfo=";
+        };
+        meta = {
+          license = lib.licenses.mit;
+        };
+      };
+
       bradlc.vscode-tailwindcss = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "vscode-tailwindcss";
@@ -594,6 +596,23 @@ let
 
       chenglou92.rescript-vscode = callPackage ./chenglou92.rescript-vscode { };
 
+      chris-hayes.chatgpt-reborn = buildVscodeMarketplaceExtension {
+        meta = {
+          changelog = "https://marketplace.visualstudio.com/items/chris-hayes.chatgpt-reborn/changelog";
+          description = "A Visual Studio Code extension to support ChatGPT, GPT-3 and Codex conversations";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=chris-hayes.chatgpt-reborn";
+          homepage = "https://github.com/christopher-hayes/vscode-chatgpt-reborn";
+          license = lib.licenses.isc;
+          maintainers = [ lib.maintainers.drupol ];
+        };
+        mktplcRef = {
+          name = "chatgpt-reborn";
+          publisher = "chris-hayes";
+          version = "3.11.2";
+          sha256 = "sha256-YidcekYTgPYlzfmDHHAxywF+bJE8Da3pg/TCumK4Epo=";
+        };
+      };
+
       christian-kohler.path-intellisense = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "path-intellisense";
@@ -634,35 +653,6 @@ let
         };
       };
 
-      coenraads.bracket-pair-colorizer = buildVscodeMarketplaceExtension {
-        meta = {
-          changelog = "https://marketplace.visualstudio.com/items/CoenraadS.bracket-pair-colorizer/changelog";
-          description = "A customizable extension for colorizing matching brackets";
-          downloadPage = "https://marketplace.visualstudio.com/items?itemName=CoenraadS.bracket-pair-colorizer";
-          homepage = "https://github.com/CoenraadS/BracketPair";
-          license = lib.licenses.mit;
-          maintainers = [ ];
-        };
-        mktplcRef = {
-          name = "bracket-pair-colorizer";
-          publisher = "CoenraadS";
-          version = "1.0.61";
-          sha256 = "0r3bfp8kvhf9zpbiil7acx7zain26grk133f0r0syxqgml12i652";
-        };
-      };
-
-      coenraads.bracket-pair-colorizer-2 = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "bracket-pair-colorizer-2";
-          publisher = "CoenraadS";
-          version = "0.2.2";
-          sha256 = "0zcbs7h801agfs2cggk1cz8m8j0i2ypmgznkgw17lcx3zisll9ad";
-        };
-        meta = {
-          license = lib.licenses.mit;
-        };
-      };
-
       colejcummins.llvm-syntax-highlighting = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "llvm-syntax-highlighting";
@@ -692,23 +682,6 @@ let
         };
       };
 
-      chris-hayes.chatgpt-reborn = buildVscodeMarketplaceExtension {
-        meta = {
-          changelog = "https://marketplace.visualstudio.com/items/chris-hayes.chatgpt-reborn/changelog";
-          description = "A Visual Studio Code extension to support ChatGPT, GPT-3 and Codex conversations";
-          downloadPage = "https://marketplace.visualstudio.com/items?itemName=chris-hayes.chatgpt-reborn";
-          homepage = "https://github.com/christopher-hayes/vscode-chatgpt-reborn";
-          license = lib.licenses.isc;
-          maintainers = [ lib.maintainers.drupol ];
-        };
-        mktplcRef = {
-          name = "chatgpt-reborn";
-          publisher = "chris-hayes";
-          version = "3.11.2";
-          sha256 = "sha256-YidcekYTgPYlzfmDHHAxywF+bJE8Da3pg/TCumK4Epo=";
-        };
-      };
-
       cweijan.vscode-database-client2 = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "vscode-database-client2";
@@ -1080,23 +1053,6 @@ let
         };
       };
 
-      faustinoaq.lex-flex-yacc-bison = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "lex-flex-yacc-bison";
-          publisher = "faustinoaq";
-          version = "0.0.3";
-          sha256 = "6254f52157dc796eae7bf135ac88c1c9cc19d884625331a1e634f9768722cc3d";
-        };
-        meta = {
-          changelog = "https://marketplace.visualstudio.com/items/faustinoaq.lex-flex-yacc-bison/changelog";
-          description = "Language support for Lex, Flex, Yacc and Bison.";
-          downloadPage = "https://marketplace.visualstudio.com/items?itemName=faustinoaq.lex-flex-yacc-bison";
-          homepage = "https://github.com/faustinoaq/vscode-lex-flex-yacc-bison";
-          license = lib.licenses.mit;
-          maintainers = [ lib.maintainers.emilytrau ];
-        };
-      };
-
       file-icons.file-icons = buildVscodeMarketplaceExtension {
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/file-icons.file-icons/changelog";
@@ -1257,59 +1213,57 @@ let
         };
       };
 
-      github = {
-        codespaces = buildVscodeMarketplaceExtension {
-          mktplcRef = {
-            publisher = "github";
-            name = "codespaces";
-            version = "1.14.1";
-            sha256 = "sha256-oiAn/tW4jfccsY8zH6L7UzldeM7sV9tllSvgZD8c9aY=";
-          };
-          meta = { license = lib.licenses.unfree; };
+      github.codespaces = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          publisher = "github";
+          name = "codespaces";
+          version = "1.14.1";
+          sha256 = "sha256-oiAn/tW4jfccsY8zH6L7UzldeM7sV9tllSvgZD8c9aY=";
         };
+        meta = { license = lib.licenses.unfree; };
+      };
 
-        copilot = buildVscodeMarketplaceExtension {
-          mktplcRef = {
-            publisher = "github";
-            name = "copilot";
-            version = "1.78.9758";
-            sha256 = "sha256-qIaaM72SenMv+vtkTMBodD2JsroZLpw8qEttr5aIDQk=";
-          };
-          meta = {
-            description = "GitHub Copilot uses OpenAI Codex to suggest code and entire functions in real-time right from your editor.";
-            downloadPage = "https://marketplace.visualstudio.com/items?itemName=GitHub.copilot";
-            homepage = "https://github.com/features/copilot";
-            license = lib.licenses.unfree;
-            maintainers = [ lib.maintainers.Zimmi48 ];
-          };
+      github.copilot = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          publisher = "github";
+          name = "copilot";
+          version = "1.78.9758";
+          sha256 = "sha256-qIaaM72SenMv+vtkTMBodD2JsroZLpw8qEttr5aIDQk=";
         };
+        meta = {
+          description = "GitHub Copilot uses OpenAI Codex to suggest code and entire functions in real-time right from your editor.";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=GitHub.copilot";
+          homepage = "https://github.com/features/copilot";
+          license = lib.licenses.unfree;
+          maintainers = [ lib.maintainers.Zimmi48 ];
+        };
+      };
 
-        github-vscode-theme = buildVscodeMarketplaceExtension {
-          mktplcRef = {
-            name = "github-vscode-theme";
-            publisher = "github";
-            version = "6.3.3";
-            sha256 = "sha256-fN9ljeZlbbSNW9qggLEz5HOLZlPhHmTHNi1VsZo7Uxk=";
-          };
-          meta = {
-            description = "GitHub theme for VS Code";
-            downloadPage =
-              "https://marketplace.visualstudio.com/items?itemName=GitHub.github-vscode-theme";
-            homepage = "https://github.com/primer/github-vscode-theme";
-            license = lib.licenses.mit;
-            maintainers = [ lib.maintainers.hugolgst ];
-          };
+      github.github-vscode-theme = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "github-vscode-theme";
+          publisher = "github";
+          version = "6.3.3";
+          sha256 = "sha256-fN9ljeZlbbSNW9qggLEz5HOLZlPhHmTHNi1VsZo7Uxk=";
         };
+        meta = {
+          description = "GitHub theme for VS Code";
+          downloadPage =
+            "https://marketplace.visualstudio.com/items?itemName=GitHub.github-vscode-theme";
+          homepage = "https://github.com/primer/github-vscode-theme";
+          license = lib.licenses.mit;
+          maintainers = [ lib.maintainers.hugolgst ];
+        };
+      };
 
-        vscode-pull-request-github = buildVscodeMarketplaceExtension {
-          mktplcRef = {
-            name = "vscode-pull-request-github";
-            publisher = "github";
-            version = "0.61.2023032418";
-            sha256 = "sha256-pCFq0lAMH3fno4/BtHJHhS4hX1KqxsPf4wEmAm66Y8E=";
-          };
-          meta = { license = lib.licenses.mit; };
+      github.vscode-pull-request-github = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "vscode-pull-request-github";
+          publisher = "github";
+          version = "0.61.2023032418";
+          sha256 = "sha256-pCFq0lAMH3fno4/BtHJHhS4hX1KqxsPf4wEmAm66Y8E=";
         };
+        meta = { license = lib.licenses.mit; };
       };
 
       gitlab.gitlab-workflow = buildVscodeMarketplaceExtension {
@@ -1598,18 +1552,6 @@ let
         };
       };
 
-      jpoissonnier.vscode-styled-components = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "vscode-styled-components";
-          publisher = "jpoissonnier";
-          version = "1.4.1";
-          sha256 = "sha256-ojbeuYBCS+DjF5R0aLuBImzoSOb8mXw1s0Uh0CzggzE=";
-        };
-        meta = {
-          license = lib.licenses.mit;
-        };
-      };
-
       justusadam.language-haskell = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "language-haskell";
@@ -1809,8 +1751,6 @@ let
         meta.license = lib.licenses.mit;
       };
 
-      matklad.rust-analyzer = self.rust-lang.rust-analyzer; # Previous publisher
-
       matthewpi.caddyfile-support = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "caddyfile-support";
@@ -1990,88 +1930,6 @@ let
         };
       };
 
-      ms-vscode.anycode = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "anycode";
-          publisher = "ms-vscode";
-          version = "0.0.70";
-          sha256 = "sha256-POxgwvKF4A+DxKVIOte4I8REhAbO1U9Gu6r/S41/MmA=";
-        };
-        meta = {
-          license = lib.licenses.mit;
-        };
-      };
-
-      ms-vscode.cmake-tools = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "cmake-tools";
-          publisher = "ms-vscode";
-          version = "1.14.20";
-          sha256 = "sha256-j67Z65N9YW8wY4zIWWCtPIKgW9GYoUntBoGVBLR/H2o=";
-        };
-        meta.license = lib.licenses.mit;
-      };
-
-      ms-vscode.cpptools = callPackage ./ms-vscode.cpptools { };
-
-      ms-vscode.hexeditor = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "hexeditor";
-          publisher = "ms-vscode";
-          version = "1.9.11";
-          sha256 = "sha256-w1R8z7Q/JRAsqJ1mgcvlHJ6tywfgKtS6A6zOY2p01io=";
-        };
-        meta = {
-          license = lib.licenses.mit;
-        };
-      };
-
-      ms-vscode.makefile-tools = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "makefile-tools";
-          publisher = "ms-vscode";
-          version = "0.6.0";
-          sha256 = "07zagq5ib9hd3w67yk2g728vypr4qazw0g9dyd5bax21shnmppa9";
-        };
-        meta = {
-          license = lib.licenses.mit;
-        };
-      };
-
-      ms-vscode.PowerShell = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "PowerShell";
-          publisher = "ms-vscode";
-          version = "2023.3.1";
-          sha256 = "sha256-FJolnWU0DbuQYvMuGL3mytf0h39SH9rUPCl2ahLXLuY=";
-        };
-        meta = {
-          description = "A Visual Studio Code extension for PowerShell language support";
-          downloadPage = "https://marketplace.visualstudio.com/items?itemName=ms-vscode.PowerShell";
-          homepage = "https://github.com/PowerShell/vscode-powershell";
-          license = lib.licenses.mit;
-          maintainers = [ lib.maintainers.rhoriguchi ];
-        };
-      };
-
-      ms-vscode-remote.remote-ssh = callPackage ./ms-vscode-remote.remote-ssh { };
-
-      ms-vscode.theme-tomorrowkit = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "Theme-TomorrowKit";
-          publisher = "ms-vscode";
-          version = "0.1.4";
-          sha256 = "sha256-qakwJWak+IrIeeVcMDWV/fLPx5M8LQGCyhVt4TS/Lmc=";
-        };
-        meta = {
-          description = "Additional Tomorrow and Tomorrow Night themes for VS Code. Based on the TextMate themes.";
-          downloadPage = "https://marketplace.visualstudio.com/items?itemName=ms-vscode.Theme-TomorrowKit";
-          homepage = "https://github.com/microsoft/vscode-themes";
-          license = lib.licenses.mit;
-          maintainers = [ lib.maintainers.ratsclub ];
-        };
-      };
-
       ms-toolsai.jupyter = callPackage ./ms-toolsai.jupyter { };
 
       ms-toolsai.jupyter-keymap = buildVscodeMarketplaceExtension {
@@ -2122,20 +1980,90 @@ let
         };
       };
 
-      ms-vsliveshare.vsliveshare = callPackage ./ms-vsliveshare.vsliveshare { };
-
-      msjsdiag.debugger-for-chrome = buildVscodeMarketplaceExtension {
+      ms-vscode.anycode = buildVscodeMarketplaceExtension {
         mktplcRef = {
-          name = "debugger-for-chrome";
-          publisher = "msjsdiag";
-          version = "4.12.11";
-          sha256 = "sha256-9i3TgCFThnFF5ccwzS4ATj5c2Xoe/4tDFGv75jJxeQ4=";
+          name = "anycode";
+          publisher = "ms-vscode";
+          version = "0.0.70";
+          sha256 = "sha256-POxgwvKF4A+DxKVIOte4I8REhAbO1U9Gu6r/S41/MmA=";
         };
         meta = {
           license = lib.licenses.mit;
         };
       };
 
+      ms-vscode.cmake-tools = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "cmake-tools";
+          publisher = "ms-vscode";
+          version = "1.14.20";
+          sha256 = "sha256-j67Z65N9YW8wY4zIWWCtPIKgW9GYoUntBoGVBLR/H2o=";
+        };
+        meta.license = lib.licenses.mit;
+      };
+
+      ms-vscode.cpptools = callPackage ./ms-vscode.cpptools { };
+
+      ms-vscode.hexeditor = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "hexeditor";
+          publisher = "ms-vscode";
+          version = "1.9.11";
+          sha256 = "sha256-w1R8z7Q/JRAsqJ1mgcvlHJ6tywfgKtS6A6zOY2p01io=";
+        };
+        meta = {
+          license = lib.licenses.mit;
+        };
+      };
+
+      ms-vscode.makefile-tools = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "makefile-tools";
+          publisher = "ms-vscode";
+          version = "0.6.0";
+          sha256 = "07zagq5ib9hd3w67yk2g728vypr4qazw0g9dyd5bax21shnmppa9";
+        };
+        meta = {
+          license = lib.licenses.mit;
+        };
+      };
+
+      ms-vscode.powershell = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "PowerShell";
+          publisher = "ms-vscode";
+          version = "2023.3.1";
+          sha256 = "sha256-FJolnWU0DbuQYvMuGL3mytf0h39SH9rUPCl2ahLXLuY=";
+        };
+        meta = {
+          description = "A Visual Studio Code extension for PowerShell language support";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=ms-vscode.PowerShell";
+          homepage = "https://github.com/PowerShell/vscode-powershell";
+          license = lib.licenses.mit;
+          maintainers = [ lib.maintainers.rhoriguchi ];
+        };
+      };
+
+      ms-vscode.theme-tomorrowkit = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "Theme-TomorrowKit";
+          publisher = "ms-vscode";
+          version = "0.1.4";
+          sha256 = "sha256-qakwJWak+IrIeeVcMDWV/fLPx5M8LQGCyhVt4TS/Lmc=";
+        };
+        meta = {
+          description = "Additional Tomorrow and Tomorrow Night themes for VS Code. Based on the TextMate themes.";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=ms-vscode.Theme-TomorrowKit";
+          homepage = "https://github.com/microsoft/vscode-themes";
+          license = lib.licenses.mit;
+          maintainers = [ lib.maintainers.ratsclub ];
+        };
+      };
+
+      ms-vscode-remote.remote-ssh = callPackage ./ms-vscode-remote.remote-ssh { };
+
+      ms-vsliveshare.vsliveshare = callPackage ./ms-vsliveshare.vsliveshare { };
+
       mskelton.one-dark-theme = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "one-dark-theme";
@@ -2211,6 +2139,18 @@ let
         };
       };
 
+      octref.vetur = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "vetur";
+          publisher = "octref";
+          version = "0.37.3";
+          sha256 = "sha256-3hi1LOZto5AYaomB9ihkAt4j/mhkCDJ8Jqa16piwHIQ=";
+        };
+        meta = {
+          license = lib.licenses.mit;
+        };
+      };
+
       oderwat.indent-rainbow = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "indent-rainbow";
@@ -2227,18 +2167,6 @@ let
         };
       };
 
-      octref.vetur = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "vetur";
-          publisher = "octref";
-          version = "0.37.3";
-          sha256 = "sha256-3hi1LOZto5AYaomB9ihkAt4j/mhkCDJ8Jqa16piwHIQ=";
-        };
-        meta = {
-          license = lib.licenses.mit;
-        };
-      };
-
       phoenixframework.phoenix = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "phoenix";
@@ -2337,6 +2265,16 @@ let
         };
       };
 
+      redhat.vscode-xml = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "vscode-xml";
+          publisher = "redhat";
+          version = "0.25.2023032304";
+          sha256 = "sha256-3hU/MZU9dP91p2PVycFL6yg/nf4/x8tt76vmlkiHnE8=";
+        };
+        meta.license = lib.licenses.epl20;
+      };
+
       redhat.vscode-yaml = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "vscode-yaml";
@@ -2349,16 +2287,6 @@ let
         };
       };
 
-      redhat.vscode-xml = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "vscode-xml";
-          publisher = "redhat";
-          version = "0.25.2023032304";
-          sha256 = "sha256-3hU/MZU9dP91p2PVycFL6yg/nf4/x8tt76vmlkiHnE8=";
-        };
-        meta.license = lib.licenses.epl20;
-      };
-
       richie5um2.snake-trail = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "snake-trail";
@@ -2371,7 +2299,7 @@ let
         };
       };
 
-      rioj7.commandOnAllFiles = buildVscodeMarketplaceExtension {
+      rioj7.commandonallfiles = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "commandOnAllFiles";
           publisher = "rioj7";
@@ -2407,18 +2335,6 @@ let
         };
       };
 
-      rubymaniac.vscode-paste-and-indent = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "vscode-paste-and-indent";
-          publisher = "Rubymaniac";
-          version = "0.0.8";
-          sha256 = "0fqwcvwq37ndms6vky8jjv0zliy6fpfkh8d9raq8hkinfxq6klgl";
-        };
-        meta = {
-          license = lib.licenses.mit;
-        };
-      };
-
       rubbersheep.gi = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "gi";
@@ -2431,6 +2347,18 @@ let
         };
       };
 
+      rubymaniac.vscode-paste-and-indent = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "vscode-paste-and-indent";
+          publisher = "Rubymaniac";
+          version = "0.0.8";
+          sha256 = "0fqwcvwq37ndms6vky8jjv0zliy6fpfkh8d9raq8hkinfxq6klgl";
+        };
+        meta = {
+          license = lib.licenses.mit;
+        };
+      };
+
       rust-lang.rust-analyzer = callPackage ./rust-lang.rust-analyzer { };
 
       ryu1kn.partial-diff = buildVscodeMarketplaceExtension {
@@ -2546,18 +2474,6 @@ let
         };
       };
 
-      silvenon.mdx = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "mdx";
-          publisher = "silvenon";
-          version = "0.1.0";
-          sha256 = "1mzsqgv0zdlj886kh1yx1zr966yc8hqwmiqrb1532xbmgyy6adz3";
-        };
-        meta = {
-          license = lib.licenses.mit;
-        };
-      };
-
       skellock.just = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "just";
@@ -2688,6 +2604,22 @@ let
         };
       };
 
+      styled-components.vscode-styled-components = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "vscode-styled-components";
+          publisher = "styled-components";
+          version = "1.7.6";
+          sha256 = "sha256-ZXXXFUriu//2Wmj1N+plj7xzJauGBfj+79SyrkUZAO4=";
+        };
+        meta = {
+          changelog = "https://marketplace.visualstudio.com/items/styled-components.vscode-styled-components/changelog";
+          description = "Syntax highlighting and IntelliSense for styled-components";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=styled-components.vscode-styled-components";
+          homepage = "https://github.com/styled-components/vscode-styled-components";
+          license = lib.licenses.mit;
+        };
+      };
+
       sumneko.lua = callPackage ./sumneko.lua { };
 
       svelte.svelte-vscode = buildVscodeMarketplaceExtension {
@@ -3098,7 +3030,7 @@ let
         };
       };
 
-      WakaTime.vscode-wakatime = callPackage ./WakaTime.vscode-wakatime { };
+      wakatime.vscode-wakatime = callPackage ./WakaTime.vscode-wakatime { };
 
       wholroyd.jinja = buildVscodeMarketplaceExtension {
         mktplcRef = {
@@ -3230,10 +3162,15 @@ let
       };
     };
 
-  aliases = self: super: {
-    # aliases
+  aliases = super: {
+    Arjun.swagger-viewer = super.arjun.swagger-viewer;
     jakebecker.elixir-ls = super.elixir-lsp.vscode-elixir-ls;
-    ms-vscode = lib.recursiveUpdate super.ms-vscode { inherit (super.golang) go; };
+    jpoissonnier.vscode-styled-components = super.styled-components.vscode-styled-components;
+    matklad.rust-analyzer = super.rust-lang.rust-analyzer; # Previous publisher
+    ms-vscode.go = super.golang.go;
+    ms-vscode.PowerShell = super.ms-vscode.powershell;
+    rioj7.commandOnAllFiles = super.rioj7.commandonallfiles;
+    WakaTime.vscode-wakatime = super.wakatime.vscode-wakatime;
     _1Password = throw ''_1Password has been replaced with "1Password"'';
     _2gua = throw ''_2gua has been replaced with "2gua"'';
     _4ops = throw ''_4ops has been replaced with "4ops"'';
@@ -3243,7 +3180,9 @@ let
   # then apply extension specific modifcations to packages.
 
   # overlays will be applied left to right, overrides should come after aliases.
-  overlays = lib.optionals config.allowAliases [ aliases ];
+  overlays = lib.optionals config.allowAliases [
+    (self: super: lib.recursiveUpdate super (aliases super))
+  ];
 
   toFix = lib.foldl' (lib.flip lib.extends) baseExtensions overlays;
 in
diff --git a/pkgs/applications/misc/gum/default.nix b/pkgs/applications/misc/gum/default.nix
index d4bd7c63a722..753ff769a647 100644
--- a/pkgs/applications/misc/gum/default.nix
+++ b/pkgs/applications/misc/gum/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "gum";
-  version = "0.8.0";
+  version = "0.10.0";
 
   src = fetchFromGitHub {
     owner = "charmbracelet";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-6x1t/PLs1dqlY5XQ1F0PDqZ/TofZ0h1hTc0C1sjn3fA=";
+    sha256 = "sha256-SP8n9PGfn4Oe+3+i7gT4i2WKgO35igPu+86SGp65R7g=";
   };
 
-  vendorSha256 = "sha256-rOBwhPXo4sTSI3j3rn3c5qWGnGFgkpeFUKgtzKBltbg=";
+  vendorSha256 = "sha256-gA545IqG3us0mmWxbw3fu3mFLqJzluH/T6d3ilfnLyM=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/applications/networking/browsers/microsoft-edge/browser.nix b/pkgs/applications/networking/browsers/microsoft-edge/browser.nix
index 685bd7e42ac8..a2eda0dc3c17 100644
--- a/pkgs/applications/networking/browsers/microsoft-edge/browser.nix
+++ b/pkgs/applications/networking/browsers/microsoft-edge/browser.nix
@@ -94,9 +94,6 @@ stdenv.mkDerivation rec {
       libGLESv2 = lib.makeLibraryPath [
         xorg.libX11 xorg.libXext xorg.libxcb wayland
       ];
-      libsmartscreen = lib.makeLibraryPath [
-        libuuid stdenv.cc.cc.lib
-      ];
       libsmartscreenn = lib.makeLibraryPath [
         libuuid
       ];
@@ -131,10 +128,6 @@ stdenv.mkDerivation rec {
       --set-rpath "${libPath.libGLESv2}" \
       opt/microsoft/${shortName}/libGLESv2.so
 
-    patchelf \
-      --set-rpath "${libPath.libsmartscreen}" \
-      opt/microsoft/${shortName}/libsmartscreen.so
-
     patchelf \
       --set-rpath "${libPath.libsmartscreenn}" \
       opt/microsoft/${shortName}/libsmartscreenn.so
diff --git a/pkgs/applications/networking/browsers/microsoft-edge/default.nix b/pkgs/applications/networking/browsers/microsoft-edge/default.nix
index 7a9e69421495..c60a867055ca 100644
--- a/pkgs/applications/networking/browsers/microsoft-edge/default.nix
+++ b/pkgs/applications/networking/browsers/microsoft-edge/default.nix
@@ -1,20 +1,20 @@
 {
+  stable = import ./browser.nix {
+    channel = "stable";
+    version = "111.0.1661.44";
+    revision = "1";
+    sha256 = "sha256-ePViYQZUteMBkV7AkvsoQwPVxibMB68LDWgg7d82iIE=";
+  };
   beta = import ./browser.nix {
     channel = "beta";
-    version = "108.0.1462.20";
+    version = "112.0.1722.15";
     revision = "1";
-    sha256 = "sha256:0dfmzjfy4y07pqifyzv3rc8dbmxz8rr3v2idanla7jrks0pghcxm";
+    sha256 = "sha256-Ba6f5MOBTtY8bUxCcMySQCWqDvOiI1hLnuwcIspReq8=";
   };
   dev = import ./browser.nix {
     channel = "dev";
-    version = "109.0.1495.2";
+    version = "113.0.1741.1";
     revision = "1";
-    sha256 = "sha256:1bk7dx3mf020ahzmvr9cdgcn72rjrn2420j9g362vwcl1khyxciw";
-  };
-  stable = import ./browser.nix {
-    channel = "stable";
-    version = "107.0.1418.52";
-    revision = "1";
-    sha256 = "sha256:1k3c5r9lq3vpc190bzs5fn944bi3af6wjxzwcliy4wzzrb5g0day";
+    sha256 = "sha256-1d92bQAoiTkqWgiWdUBn3VKBYCRP1KCvPiu7cQTFVio=";
   };
 }
diff --git a/pkgs/applications/networking/coreth/default.nix b/pkgs/applications/networking/coreth/default.nix
index 5f857caee92c..1366bfa7fdf5 100644
--- a/pkgs/applications/networking/coreth/default.nix
+++ b/pkgs/applications/networking/coreth/default.nix
@@ -6,19 +6,19 @@
 
 buildGoModule rec {
   pname = "coreth";
-  version = "0.11.8";
+  version = "0.11.9";
 
   src = fetchFromGitHub {
     owner = "ava-labs";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-O6dTbhnZPWd7BKMwaPfUOPwcvwzQoHUKR9Zj7uKqtGM=";
+    hash = "sha256-i0mLyTeosGlnTpKvAUS3wDvBRFpgmnfmKXAtCnAGqE0=";
   };
 
   # go mod vendor has a bug, see: golang/go#57529
   proxyVendor = true;
 
-  vendorHash = "sha256-nJA83SfMv+5xKKyJTtaSRsro1XR+3sNiszBeXRRY5NA=";
+  vendorHash = "sha256-zX1rQ9RDBkzZIbqCDlFEgseYyKYUHYyGFApZqhOrkGU=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/applications/networking/p2p/transmission/default.nix b/pkgs/applications/networking/p2p/transmission/default.nix
index 8f44d79f817d..403b0bc9e87c 100644
--- a/pkgs/applications/networking/p2p/transmission/default.nix
+++ b/pkgs/applications/networking/p2p/transmission/default.nix
@@ -142,7 +142,7 @@ in stdenv.mkDerivation {
     '';
     homepage = "http://www.transmissionbt.com/";
     license = lib.licenses.gpl2Plus; # parts are under MIT
-    maintainers = with lib.maintainers; [ astsmtl vcunat wizeman ];
+    maintainers = with lib.maintainers; [ astsmtl vcunat ];
     platforms = lib.platforms.unix;
   };
 
diff --git a/pkgs/applications/networking/protonmail-bridge/default.nix b/pkgs/applications/networking/protonmail-bridge/default.nix
index 5dc7779e12e9..3cac4a2dcdd6 100644
--- a/pkgs/applications/networking/protonmail-bridge/default.nix
+++ b/pkgs/applications/networking/protonmail-bridge/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "protonmail-bridge";
-  version = "3.0.18";
+  version = "3.0.21";
 
   src = fetchFromGitHub {
     owner = "ProtonMail";
     repo = "proton-bridge";
     rev = "v${version}";
-    hash = "sha256-0gQnMhjwW2NEJwafqndStQ33dIu82lW6ntXFRCpbmm4=";
+    hash = "sha256-aRzVXmAWRifIGCAPWYciBhK9XMvsmtHc67XRoI19VYU=";
   };
 
-  vendorHash = "sha256-lHMcVcaoBwjE2ikEZPeZexC5XvhkAtvHnDci7UAa4vg=";
+  vendorHash = "sha256-zCE4LO6m4uyOvSzhUbzH2F9EgDs0UZH4eCl6lfRjIRQ=";
 
   nativeBuildInputs = [ pkg-config ];
 
@@ -38,7 +38,7 @@ buildGoModule rec {
   ];
 
   postInstall = ''
-    mv $out/bin/Desktop-Bridge $out/bin/bridge # The cli is named like that in the upstream repo
+    mv $out/bin/Desktop-Bridge $out/bin/protonmail-bridge # The cli is named like that in other distro packages
   '';
 
   meta = with lib; {
diff --git a/pkgs/applications/networking/syncthing/default.nix b/pkgs/applications/networking/syncthing/default.nix
index 952851b08dba..0ddf1fc8f9cc 100644
--- a/pkgs/applications/networking/syncthing/default.nix
+++ b/pkgs/applications/networking/syncthing/default.nix
@@ -1,4 +1,13 @@
-{ pkgsBuildBuild, go, buildGoModule, stdenv, lib, procps, fetchFromGitHub, nixosTests }:
+{ pkgsBuildBuild
+, go
+, buildGoModule
+, stdenv
+, lib
+, procps
+, fetchFromGitHub
+, nixosTests
+, autoSignDarwinBinariesHook
+}:
 
 let
   common = { stname, target, postInstall ? "" }:
@@ -15,6 +24,15 @@ let
 
       vendorHash = "sha256-5NgflkRXkbWiIkASmxIgWliE8sF89HtlMtlIF+5u6Ic=";
 
+      nativeBuildInputs = lib.optionals stdenv.isDarwin [
+        # Recent versions of macOS seem to require binaries to be signed when
+        # run from Launch Agents/Daemons, even on x86 devices where it has a
+        # more lax code signing policy compared to Apple Silicon. So just sign
+        # the binaries on both architectures to make it possible for launchd to
+        # auto-start Syncthing at login.
+        autoSignDarwinBinariesHook
+      ];
+
       doCheck = false;
 
       BUILD_USER = "nix";
diff --git a/pkgs/applications/science/networking/sumo/default.nix b/pkgs/applications/science/networking/sumo/default.nix
index 3caf1601084a..70f5a4a61df6 100644
--- a/pkgs/applications/science/networking/sumo/default.nix
+++ b/pkgs/applications/science/networking/sumo/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "sumo";
-  version = "1.15.0";
+  version = "1.16.0";
 
   src = fetchFromGitHub {
     owner = "eclipse";
     repo = "sumo";
     rev = "v${lib.replaceStrings ["."] ["_"] version}";
-    sha256 = "sha256-Mm8Kqb5W9h2jYvRGypI6v5IHDm4CnAeT+NcJybdU5K0=";
+    sha256 = "sha256-0aUm7sgBLTPNSJuH6/xsTDZKUzAI87wPI2G3WSi5SGA=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/virtualization/nixpacks/default.nix b/pkgs/applications/virtualization/nixpacks/default.nix
index 2de8989830c3..4143c21218da 100644
--- a/pkgs/applications/virtualization/nixpacks/default.nix
+++ b/pkgs/applications/virtualization/nixpacks/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "nixpacks";
-  version = "1.5.1";
+  version = "1.6.0";
 
   src = fetchFromGitHub {
     owner = "railwayapp";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-eAniM4o7TshGhO5jGrCZz+Rs5n5Q24tvIWMWebKAWAs=";
+    sha256 = "sha256-q+NMV0GagcGeUb+WD8BoFjAKJWgzBSq/POqwPUADAUI=";
   };
 
-  cargoHash = "sha256-0Y4hHuWB7NY7rRJImNIrxlEffrT9055ThQGqJlMeDMM=";
+  cargoHash = "sha256-m9CvMorM7uX6OOfVCtM2pZPgRcKm7fVoTk/SCt8FXyU=";
 
   # skip test due FHS dependency
   doCheck = false;
diff --git a/pkgs/build-support/build-fhs-userenv-bubblewrap/env.nix b/pkgs/build-support/build-fhs-userenv-bubblewrap/buildFHSEnv.nix
similarity index 98%
rename from pkgs/build-support/build-fhs-userenv-bubblewrap/env.nix
rename to pkgs/build-support/build-fhs-userenv-bubblewrap/buildFHSEnv.nix
index c4d967a11c69..0d98c0a2bc64 100644
--- a/pkgs/build-support/build-fhs-userenv-bubblewrap/env.nix
+++ b/pkgs/build-support/build-fhs-userenv-bubblewrap/buildFHSEnv.nix
@@ -1,6 +1,6 @@
 { stdenv, lib, buildEnv, writeText, writeShellScriptBin, pkgs, pkgsi686Linux }:
 
-{ name, profile ? ""
+args@{ name, profile ? ""
 , targetPkgs ? pkgs: [], multiPkgs ? pkgs: []
 , extraBuildCommands ? "", extraBuildCommandsMulti ? ""
 , extraOutputsToInstall ? []
@@ -216,4 +216,8 @@ in stdenv.mkDerivation {
   '';
   preferLocalBuild = true;
   allowSubstitutes = false;
+
+  passthru = {
+    inherit args multiPaths targetPaths;
+  };
 }
diff --git a/pkgs/build-support/build-fhs-userenv-bubblewrap/default.nix b/pkgs/build-support/build-fhs-userenv-bubblewrap/default.nix
index 74a22566d51c..ce807b932a19 100644
--- a/pkgs/build-support/build-fhs-userenv-bubblewrap/default.nix
+++ b/pkgs/build-support/build-fhs-userenv-bubblewrap/default.nix
@@ -20,9 +20,9 @@ args @ {
 
 with builtins;
 let
-  buildFHSEnv = callPackage ./env.nix { };
+  buildFHSEnv = callPackage ./buildFHSEnv.nix { };
 
-  env = buildFHSEnv (removeAttrs args [
+  fhsenv = buildFHSEnv (removeAttrs args [
     "runScript" "extraInstallCommands" "meta" "passthru" "extraBwrapArgs" "dieWithParent"
     "unshareUser" "unshareCgroup" "unshareUts" "unshareNet" "unsharePid" "unshareIpc"
     "version"
@@ -104,7 +104,7 @@ let
     ro_mounts=()
     symlinks=()
     etc_ignored=()
-    for i in ${env}/*; do
+    for i in ${fhsenv}/*; do
       path="/''${i##*/}"
       if [[ $path == '/etc' ]]; then
         :
@@ -117,8 +117,8 @@ let
       fi
     done
 
-    if [[ -d ${env}/etc ]]; then
-      for i in ${env}/etc/*; do
+    if [[ -d ${fhsenv}/etc ]]; then
+      for i in ${fhsenv}/etc/*; do
         path="/''${i##*/}"
         # NOTE: we're binding /etc/fonts and /etc/ssl/certs from the host so we
         # don't want to override it with a path from the FHS environment.
@@ -221,6 +221,7 @@ in runCommandLocal nameAndVersion {
       echo >&2 ""
       exit 1
     '';
+    inherit args fhsenv;
   };
 } ''
   mkdir -p $out/bin
diff --git a/pkgs/desktops/plasma-5/xdg-desktop-portal-kde.nix b/pkgs/desktops/plasma-5/xdg-desktop-portal-kde.nix
index dc5728791b60..5fa1a17c4240 100644
--- a/pkgs/desktops/plasma-5/xdg-desktop-portal-kde.nix
+++ b/pkgs/desktops/plasma-5/xdg-desktop-portal-kde.nix
@@ -19,6 +19,7 @@
 , kdeclarative
 , plasma-framework
 , plasma-wayland-protocols
+, plasma-workspace
 , kio
 , qtbase
 }:
@@ -45,5 +46,6 @@ mkDerivation {
     kdeclarative
     plasma-framework
     plasma-wayland-protocols
+    plasma-workspace
   ];
 }
diff --git a/pkgs/development/compilers/llvm/git/llvm/default.nix b/pkgs/development/compilers/llvm/git/llvm/default.nix
index 1daeb745e588..ef7ff66e7464 100644
--- a/pkgs/development/compilers/llvm/git/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/git/llvm/default.nix
@@ -4,6 +4,7 @@
 , runCommand
 , fetchpatch
 , cmake
+, darwin
 , ninja
 , python3
 , libffi
@@ -16,9 +17,10 @@
 , release_version
 , zlib
 , which
+, sysctl
 , buildLlvmTools
 , debugVersion ? false
-, doCheck ? stdenv.isLinux && (!stdenv.isx86_32) && (!stdenv.hostPlatform.isMusl)
+, doCheck ? (!stdenv.isx86_32 /* TODO: why */) && (!stdenv.hostPlatform.isMusl)
   && (stdenv.hostPlatform == stdenv.buildPlatform)
 , enableManpages ? false
 , enableSharedLibraries ? !stdenv.hostPlatform.isStatic
@@ -85,17 +87,122 @@ in stdenv.mkDerivation (rec {
 
   propagatedBuildInputs = [ ncurses zlib ];
 
-  nativeCheckInputs = [ which ];
+  nativeCheckInputs = [
+    which
+  ] ++ lib.optional stdenv.isDarwin sysctl;
 
   patches = [
     ./gnu-install-dirs.patch
-  ] ++ lib.optional enablePolly ./gnu-install-dirs-polly.patch;
+
+    # Running the tests involves invoking binaries (like `opt`) that depend on
+    # the LLVM dylibs and reference them by absolute install path (i.e. their
+    # nix store path).
+    #
+    # Because we have not yet run the install phase (we're running these tests
+    # as part of `checkPhase` instead of `installCheckPhase`) these absolute
+    # paths do not exist yet; to work around this we point the loader (`ld` on
+    # unix, `dyld` on macOS) at the `lib` directory which will later become this
+    # package's `lib` output.
+    #
+    # Previously we would just set `LD_LIBRARY_PATH` to include the build `lib`
+    # dir but:
+    #   - this doesn't generalize well to other platforms; `lit` doesn't forward
+    #     `DYLD_LIBRARY_PATH` (macOS):
+    #     + https://github.com/llvm/llvm-project/blob/0d89963df354ee309c15f67dc47c8ab3cb5d0fb2/llvm/utils/lit/lit/TestingConfig.py#L26
+    #   - even if `lit` forwarded this env var, we actually cannot set
+    #     `DYLD_LIBRARY_PATH` in the child processes `lit` launches because
+    #     `DYLD_LIBRARY_PATH` (and `DYLD_FALLBACK_LIBRARY_PATH`) is cleared for
+    #     "protected processes" (i.e. the python interpreter that runs `lit`):
+    #     https://stackoverflow.com/a/35570229
+    #   - other LLVM subprojects deal with this issue by having their `lit`
+    #     configuration set these env vars for us; it makes sense to do the same
+    #     for LLVM:
+    #     + https://github.com/llvm/llvm-project/blob/4c106cfdf7cf7eec861ad3983a3dd9a9e8f3a8ae/clang-tools-extra/test/Unit/lit.cfg.py#L22-L31
+    #
+    # !!! TODO: look into upstreaming this patch
+    ./llvm-lit-cfg-add-libs-to-dylib-path.patch
+
+    # `lit` has a mode where it executes run lines as a shell script which is
+    # constructs; this is problematic for macOS because it means that there's
+    # another process in between `lit` and the binaries being tested. As noted
+    # above, this means that `DYLD_LIBRARY_PATH` is cleared which means that our
+    # tests fail with dyld errors.
+    #
+    # To get around this we patch `lit` to reintroduce `DYLD_LIBRARY_PATH`, when
+    # present in the test configuration.
+    #
+    # It's not clear to me why this isn't an issue for LLVM developers running
+    # on macOS (nothing about this _seems_ nix specific)..
+    ./lit-shell-script-runner-set-dyld-library-path.patch
+  ] ++ lib.optionals enablePolly [
+    ./gnu-install-dirs-polly.patch
+
+    # Just like the `llvm-lit-cfg` patch, but for `polly`.
+    ./polly-lit-cfg-add-libs-to-dylib-path.patch
+  ];
 
   postPatch = optionalString stdenv.isDarwin ''
     substituteInPlace cmake/modules/AddLLVM.cmake \
       --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir)" \
       --replace 'set(_install_rpath "@loader_path/../''${CMAKE_INSTALL_LIBDIR}''${LLVM_LIBDIR_SUFFIX}" ''${extra_libdir})' ""
-  '' + ''
+    # As of LLVM 15, marked as XFAIL on arm64 macOS but lit doesn't seem to pick
+    # this up: https://github.com/llvm/llvm-project/blob/c344d97a125b18f8fed0a64aace73c49a870e079/llvm/test/MC/ELF/cfi-version.ll#L7
+    rm test/MC/ELF/cfi-version.ll
+
+    # This test tries to call `sw_vers` by absolute path (`/usr/bin/sw_vers`)
+    # and thus fails under the sandbox:
+    substituteInPlace unittests/Support/Host.cpp \
+      --replace '/usr/bin/sw_vers' "${(builtins.toString darwin.DarwinTools) + "/bin/sw_vers" }"
+   '' + optionalString (stdenv.isDarwin && stdenv.hostPlatform.isx86) ''
+    # This test tries to call the intrinsics `@llvm.roundeven.f32` and
+    # `@llvm.roundeven.f64` which seem to (incorrectly?) lower to `roundevenf`
+    # and `roundeven` on x86_64 macOS.
+    #
+    # However these functions are glibc specific so the test fails:
+    #   - https://www.gnu.org/software/gnulib/manual/html_node/roundevenf.html
+    #   - https://www.gnu.org/software/gnulib/manual/html_node/roundeven.html
+    #
+    # TODO(@rrbutani): this seems to run fine on `aarch64-darwin`, why does it
+    # pass there?
+    substituteInPlace test/ExecutionEngine/Interpreter/intrinsics.ll \
+      --replace "%roundeven32 = call float @llvm.roundeven.f32(float 0.000000e+00)" "" \
+      --replace "%roundeven64 = call double @llvm.roundeven.f64(double 0.000000e+00)" ""
+
+    # This test fails on darwin x86_64 because `sw_vers` reports a different
+    # macOS version than what LLVM finds by reading
+    # `/System/Library/CoreServices/SystemVersion.plist` (which is passed into
+    # the sandbox on macOS).
+    #
+    # The `sw_vers` provided by nixpkgs reports the macOS version associated
+    # with the `CoreFoundation` framework with which it was built. Because
+    # nixpkgs pins the SDK for `aarch64-darwin` and `x86_64-darwin` what
+    # `sw_vers` reports is not guaranteed to match the macOS version of the host
+    # that's building this derivation.
+    #
+    # Astute readers will note that we only _patch_ this test on aarch64-darwin
+    # (to use the nixpkgs provided `sw_vers`) instead of disabling it outright.
+    # So why does this test pass on aarch64?
+    #
+    # Well, it seems that `sw_vers` on aarch64 actually links against the _host_
+    # CoreFoundation framework instead of the nixpkgs provided one.
+    #
+    # Not entirely sure what the right fix is here. I'm assuming aarch64
+    # `sw_vers` doesn't intentionally link against the host `CoreFoundation`
+    # (still digging into how this ends up happening, will follow up) but that
+    # aside I think the more pertinent question is: should we be patching LLVM's
+    # macOS version detection logic to use `sw_vers` instead of reading host
+    # paths? This *is* a way in which details about builder machines can creep
+    # into the artifacts that are produced, affecting reproducibility, but it's
+    # not clear to me when/where/for what this even gets used in LLVM.
+    #
+    # TODO(@rrbutani): fix/follow-up
+    substituteInPlace unittests/Support/Host.cpp \
+      --replace "getMacOSHostVersion" "DISABLED_getMacOSHostVersion"
+
+    # This test fails with a `dysmutil` crash; have not yet dug into what's
+    # going on here (TODO(@rrbutani)).
+    rm test/tools/dsymutil/ARM/obfuscated.test
+    '' + ''
     # FileSystem permissions tests fail with various special bits
     substituteInPlace unittests/Support/CMakeLists.txt \
       --replace "Path.cpp" ""
@@ -134,12 +241,6 @@ in stdenv.mkDerivation (rec {
     )
   '';
 
-  # hacky fix: created binaries need to be run before installation
-  preBuild = ''
-    mkdir -p $out/
-    ln -sv $PWD/lib $out
-  '';
-
   # E.g. mesa.drivers use the build-id as a cache key (see #93946):
   LDFLAGS = optionalString (enableSharedLibraries && !stdenv.isDarwin) "-Wl,--build-id=sha1";
 
@@ -216,14 +317,6 @@ in stdenv.mkDerivation (rec {
     )
   ];
 
-  postBuild = ''
-    rm -fR $out
-  '';
-
-  preCheck = ''
-    export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}$PWD/lib
-  '';
-
   postInstall = ''
     mkdir -p $python/share
     mv $out/share/opt-viewer $python/share/opt-viewer
diff --git a/pkgs/development/compilers/llvm/git/llvm/lit-shell-script-runner-set-dyld-library-path.patch b/pkgs/development/compilers/llvm/git/llvm/lit-shell-script-runner-set-dyld-library-path.patch
new file mode 100644
index 000000000000..32f1d13a9dc2
--- /dev/null
+++ b/pkgs/development/compilers/llvm/git/llvm/lit-shell-script-runner-set-dyld-library-path.patch
@@ -0,0 +1,26 @@
+diff --git a/utils/lit/lit/TestRunner.py b/utils/lit/lit/TestRunner.py
+index 0242e0b75af3..d732011306f7 100644
+--- a/utils/lit/lit/TestRunner.py
++++ b/utils/lit/lit/TestRunner.py
+@@ -1029,6 +1029,12 @@ def executeScript(test, litConfig, tmpBase, commands, cwd):
+             f.write('@echo off\n')
+         f.write('\n@if %ERRORLEVEL% NEQ 0 EXIT\n'.join(commands))
+     else:
++        # This env var is *purged* when invoking subprocesses so we have to
++        # manually set it from within the bash script in order for the commands
++        # in run lines to see this var:
++        if "DYLD_LIBRARY_PATH" in test.config.environment:
++            f.write(f'export DYLD_LIBRARY_PATH="{test.config.environment["DYLD_LIBRARY_PATH"]}"\n')
++
+         for i, ln in enumerate(commands):
+             match = re.match(kPdbgRegex, ln)
+             if match:
+@@ -1363,7 +1369,7 @@ def applySubstitutions(script, substitutions, conditions={},
+         return processed
+ 
+     process = processLine if recursion_limit is None else processLineToFixedPoint
+-    
++
+     return [unescapePercents(process(ln)) for ln in script]
+ 
+ 
diff --git a/pkgs/development/compilers/llvm/git/llvm/llvm-lit-cfg-add-libs-to-dylib-path.patch b/pkgs/development/compilers/llvm/git/llvm/llvm-lit-cfg-add-libs-to-dylib-path.patch
new file mode 100644
index 000000000000..d824516c0a16
--- /dev/null
+++ b/pkgs/development/compilers/llvm/git/llvm/llvm-lit-cfg-add-libs-to-dylib-path.patch
@@ -0,0 +1,79 @@
+diff --git a/test/Unit/lit.cfg.py b/test/Unit/lit.cfg.py
+index 81e8dc04acea..479ff95681e2 100644
+--- a/test/Unit/lit.cfg.py
++++ b/test/Unit/lit.cfg.py
+@@ -3,6 +3,7 @@
+ # Configuration file for the 'lit' test runner.
+ 
+ import os
++import platform
+ import subprocess
+ 
+ import lit.formats
+@@ -55,3 +56,26 @@ if sys.platform in ['win32', 'cygwin'] and os.path.isdir(config.shlibdir):
+ # Win32 may use %SYSTEMDRIVE% during file system shell operations, so propogate.
+ if sys.platform == 'win32' and 'SYSTEMDRIVE' in os.environ:
+     config.environment['SYSTEMDRIVE'] = os.environ['SYSTEMDRIVE']
++
++# Add the LLVM dynamic libs to the platform-specific loader search path env var:
++#
++# TODO: this is copied from `clang`'s `lit.cfg.py`; should unify..
++def find_shlibpath_var():
++    if platform.system() in ['Linux', 'FreeBSD', 'NetBSD', 'OpenBSD', 'SunOS']:
++        yield 'LD_LIBRARY_PATH'
++    elif platform.system() == 'Darwin':
++        yield 'DYLD_LIBRARY_PATH'
++    elif platform.system() == 'Windows':
++        yield 'PATH'
++    elif platform.system() == 'AIX':
++        yield 'LIBPATH'
++
++for shlibpath_var in find_shlibpath_var():
++    shlibpath = os.path.pathsep.join(
++        (config.shlibdir,
++         config.environment.get(shlibpath_var, '')))
++    config.environment[shlibpath_var] = shlibpath
++    break
++else:
++    lit_config.warning("unable to inject shared library path on '{}'"
++                       .format(platform.system()))
+diff --git a/test/lit.cfg.py b/test/lit.cfg.py
+index 75a38b4c5dad..856fc75c9d74 100644
+--- a/test/lit.cfg.py
++++ b/test/lit.cfg.py
+@@ -42,6 +42,26 @@ llvm_config.with_environment('PATH', config.llvm_tools_dir, append_path=True)
+ llvm_config.with_system_environment(
+     ['HOME', 'INCLUDE', 'LIB', 'TMP', 'TEMP'])
+ 
++# Add the LLVM dynamic libs to the platform-specific loader search path env var:
++#
++# TODO: this is copied from `clang`'s `lit.cfg.py`; should unify..
++def find_shlibpath_var():
++    if platform.system() in ['Linux', 'FreeBSD', 'NetBSD', 'OpenBSD', 'SunOS']:
++        yield 'LD_LIBRARY_PATH'
++    elif platform.system() == 'Darwin':
++        yield 'DYLD_LIBRARY_PATH'
++    elif platform.system() == 'Windows':
++        yield 'PATH'
++    elif platform.system() == 'AIX':
++        yield 'LIBPATH'
++
++for shlibpath_var in find_shlibpath_var():
++    shlibpath = config.llvm_shlib_dir
++    llvm_config.with_environment(shlibpath_var, shlibpath, append_path = True)
++    break
++else:
++    lit_config.warning("unable to inject shared library path on '{}'"
++                       .format(platform.system()))
+ 
+ # Set up OCAMLPATH to include newly built OCaml libraries.
+ top_ocaml_lib = os.path.join(config.llvm_lib_dir, 'ocaml')
+@@ -318,7 +338,7 @@ def have_cxx_shared_library():
+ 
+     try:
+         readobj_cmd = subprocess.Popen(
+-            [readobj_exe, '--needed-libs', readobj_exe], stdout=subprocess.PIPE)
++            [readobj_exe, '--needed-libs', readobj_exe], stdout=subprocess.PIPE, env=config.environment)
+     except OSError:
+         print('could not exec llvm-readobj')
+         return False
diff --git a/pkgs/development/compilers/llvm/git/llvm/polly-lit-cfg-add-libs-to-dylib-path.patch b/pkgs/development/compilers/llvm/git/llvm/polly-lit-cfg-add-libs-to-dylib-path.patch
new file mode 100644
index 000000000000..1354ad267314
--- /dev/null
+++ b/pkgs/development/compilers/llvm/git/llvm/polly-lit-cfg-add-libs-to-dylib-path.patch
@@ -0,0 +1,24 @@
+diff --git a/tools/polly/test/lit.cfg b/tools/polly/test/lit.cfg
+index 41e3a589c61e..09f3b17498b0 100644
+--- a/tools/polly/test/lit.cfg
++++ b/tools/polly/test/lit.cfg
+@@ -36,9 +36,17 @@ base_paths = [config.llvm_tools_dir, config.environment['PATH']]
+ path = os.path.pathsep.join(base_paths + config.extra_paths)
+ config.environment['PATH'] = path
+ 
++# (Copied from polly/test/Unit/lit.cfg)
++if platform.system() == 'Darwin':
++    shlibpath_var = 'DYLD_LIBRARY_PATH'
++elif platform.system() == 'Windows':
++    shlibpath_var = 'PATH'
++else:
++    shlibpath_var = 'LD_LIBRARY_PATH'
++
+ path = os.path.pathsep.join((config.llvm_libs_dir,
+-                              config.environment.get('LD_LIBRARY_PATH','')))
+-config.environment['LD_LIBRARY_PATH'] = path
++                              config.environment.get(shlibpath_var,'')))
++config.environment[shlibpath_var] = path
+ 
+ llvm_config.use_default_substitutions()
+ 
diff --git a/pkgs/development/compilers/nim/default.nix b/pkgs/development/compilers/nim/default.nix
index 318a7ac34052..5518eb64bbd8 100644
--- a/pkgs/development/compilers/nim/default.nix
+++ b/pkgs/development/compilers/nim/default.nix
@@ -3,7 +3,7 @@
 
 { lib, callPackage, buildPackages, stdenv, fetchurl, fetchgit, fetchFromGitHub
 , makeWrapper, openssl, pcre, readline, boehmgc, sqlite, nim-unwrapped
-, nimble-unwrapped }:
+, nimble-unwrapped, Security }:
 
 let
   parseCpu = platform:
@@ -94,7 +94,8 @@ in {
       hash = "sha256-rO8LCrdzYE1Nc5S2hRntt0+zD0aRIpSyi8J+DHtLTcI=";
     };
 
-    buildInputs = [ boehmgc openssl pcre readline sqlite ];
+    buildInputs = [ boehmgc openssl pcre readline sqlite ]
+      ++ lib.optional stdenv.isDarwin Security;
 
     patches = [
       ./NIM_CONFIG_DIR.patch
diff --git a/pkgs/development/libraries/armadillo/default.nix b/pkgs/development/libraries/armadillo/default.nix
index d3bee03c5e19..bd147fffc99d 100644
--- a/pkgs/development/libraries/armadillo/default.nix
+++ b/pkgs/development/libraries/armadillo/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "armadillo";
-  version = "11.4.3";
+  version = "12.0.1";
 
   src = fetchurl {
     url = "mirror://sourceforge/arma/armadillo-${version}.tar.xz";
-    sha256 = "sha256-h2AyY2ZJiK9B2iyk82IF426kepKB+mz9RjEV83l6HaI=";
+    sha256 = "sha256-IwpcddqtUtxH4a3Oj1pQ+apOQ1Tg8bsY6oTvoucOIN8=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/tkrzw/default.nix b/pkgs/development/libraries/tkrzw/default.nix
index 843eb2f5b103..b3e8c8fbae28 100644
--- a/pkgs/development/libraries/tkrzw/default.nix
+++ b/pkgs/development/libraries/tkrzw/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "tkrzw";
-  version = "1.0.26";
+  version = "1.0.27";
   # TODO: defeat multi-output reference cycles
 
   src = fetchurl {
     url = "https://dbmx.net/tkrzw/pkg/tkrzw-${version}.tar.gz";
-    hash = "sha256-vbuzV4ZZnb0Vl+U9B8BorDD7mHQ7ILwkR35GaFs+aTI=";
+    hash = "sha256-DxLtDtscTPR1yzeOENyQPylKo+VxJTswUAE/MieEoXQ=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/ocaml-modules/dune-configurator/default.nix b/pkgs/development/ocaml-modules/dune-configurator/default.nix
index f5303db9a3b5..cdb1e3fc2005 100644
--- a/pkgs/development/ocaml-modules/dune-configurator/default.nix
+++ b/pkgs/development/ocaml-modules/dune-configurator/default.nix
@@ -3,11 +3,11 @@
 buildDunePackage rec {
   pname = "dune-configurator";
 
-  useDune2 = true;
-
   inherit (dune_2) src version patches;
 
-  minimumOCamlVersion = "4.03";
+  duneVersion = "2";
+
+  minimalOCamlVersion = "4.03";
 
   dontAddPrefix = true;
 
diff --git a/pkgs/development/python-modules/google-cloud-spanner/default.nix b/pkgs/development/python-modules/google-cloud-spanner/default.nix
index ce2a5366ac60..922f8163e171 100644
--- a/pkgs/development/python-modules/google-cloud-spanner/default.nix
+++ b/pkgs/development/python-modules/google-cloud-spanner/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-spanner";
-  version = "3.28.0";
+  version = "3.29.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-3WA2SUC9frxafOXiGquDinwyffNrubQ4QEnfMxxC2KE=";
+    hash = "sha256-Dk13N2SeCGBjjwXCffLGVM0iOL6fGptRcmNidbxnzQc=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/tools/continuous-integration/dagger/default.nix b/pkgs/development/tools/continuous-integration/dagger/default.nix
index 05b303878779..334c52cd47f8 100644
--- a/pkgs/development/tools/continuous-integration/dagger/default.nix
+++ b/pkgs/development/tools/continuous-integration/dagger/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "dagger";
-  version = "0.4.1";
+  version = "0.4.2";
 
   src = fetchFromGitHub {
     owner = "dagger";
     repo = "dagger";
     rev = "v${version}";
-    hash = "sha256-d7Yz5MgV5l54uGbQPmGUVZuz4xdGO+gSiI9/6Axqsb0=";
+    hash = "sha256-R9O+ilOz5AZmsSR0uoOhXLNMTUEej9sV4ONaIF6ZnVc=";
   };
 
-  vendorHash = "sha256-fRHs2B/pea9FIqPpOaR6z3do+tpnaGlKTbwfF/smC4w=";
+  vendorHash = "sha256-/ZwIuzUvs7GvpoR6CfxdCivyOS8kDOukM92NuWFXJCY=";
   proxyVendor = true;
 
   subPackages = [
diff --git a/pkgs/development/tools/golangci-lint/default.nix b/pkgs/development/tools/golangci-lint/default.nix
index 0f0c486ee617..30529f03ffdb 100644
--- a/pkgs/development/tools/golangci-lint/default.nix
+++ b/pkgs/development/tools/golangci-lint/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "golangci-lint";
-  version = "1.52.1";
+  version = "1.52.2";
 
   src = fetchFromGitHub {
     owner = "golangci";
     repo = "golangci-lint";
     rev = "v${version}";
-    hash = "sha256-Du0u31P2Ay4MVLmgrQmbAstmczuIy+ONIUAUEbbK+j4=";
+    hash = "sha256-FmNXjOMDDdGxMQvy5f1NoaqrKFpmlPWclXooMxXP8zg=";
   };
 
-  vendorHash = "sha256-N20AJaREqmvCey5P0YuUd3l/5xRzrIG+mPOiVHOUFWc=";
+  vendorHash = "sha256-BhD3a0LNc3hpiH4QC8FpmNn3swx3to8+6gfcgZT8TLg=";
 
   subPackages = [ "cmd/golangci-lint" ];
 
diff --git a/pkgs/development/tools/language-servers/svls/default.nix b/pkgs/development/tools/language-servers/svls/default.nix
index fef2306b1cd7..e568568ccdeb 100644
--- a/pkgs/development/tools/language-servers/svls/default.nix
+++ b/pkgs/development/tools/language-servers/svls/default.nix
@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "svls";
-  version = "0.2.7";
+  version = "0.2.8";
 
   src = fetchFromGitHub {
     owner = "dalance";
     repo = "svls";
     rev = "v${version}";
-    sha256 = "sha256-+auy6LfvT7OCCSM/WNjnzFsBTAHS+kcghOaMpG3f9dA=";
+    sha256 = "sha256-vUvDdeowbrmDQvUCUYRjOGQQrlyGGKrnXsYFsMWMfFw=";
   };
 
-  cargoHash = "sha256-ZNYYb0Ji4AmiXfhKMPK/4MPfFYSmnUeeeTmiq6rpBvg=";
+  cargoHash = "sha256-zb1F3bv1MrXkoBzTaVXbHcKFlg5R9Ulq6eN8mh8WKSg=";
 
   meta = with lib; {
     description = "SystemVerilog language server";
diff --git a/pkgs/games/steam/fhsenv.nix b/pkgs/games/steam/fhsenv.nix
index c50176dce790..8d461104eaac 100644
--- a/pkgs/games/steam/fhsenv.nix
+++ b/pkgs/games/steam/fhsenv.nix
@@ -1,9 +1,10 @@
-{ lib, stdenv, writeScript, buildFHSUserEnv, steam, glxinfo-i686, runtimeShell
+{ lib, stdenv, writeShellScript, buildFHSUserEnv, steam, glxinfo-i686
 , steam-runtime-wrapped, steam-runtime-wrapped-i686 ? null
 , extraPkgs ? pkgs: [ ] # extra packages to add to targetPkgs
 , extraLibraries ? pkgs: [ ] # extra packages to add to multiPkgs
 , extraProfile ? "" # string to append to profile
 , extraArgs ? "" # arguments to always pass to steam
+, extraEnv ? { } # Environment variables to pass to Steam
 , withGameSpecificLibraries ? true # exclude game specific libraries
 }:
 
@@ -52,6 +53,8 @@ let
     fi
   '';
 
+  envScript = lib.toShellVars extraEnv;
+
 in buildFHSUserEnv rec {
   name = "steam";
 
@@ -228,8 +231,7 @@ in buildFHSUserEnv rec {
     export SDL_JOYSTICK_DISABLE_UDEV=1
   '' + extraProfile;
 
-  runScript = writeScript "steam-wrapper.sh" ''
-    #!${runtimeShell}
+  runScript = writeShellScript "steam-wrapper.sh" ''
     if [ -f /host/etc/NIXOS ]; then   # Check only useful on NixOS
       ${glxinfo-i686}/bin/glxinfo >/dev/null 2>&1
       # If there was an error running glxinfo, we know something is wrong with the configuration
@@ -249,6 +251,9 @@ in buildFHSUserEnv rec {
 
     ${exportLDPath}
     ${fixBootstrap}
+
+    set -o allexport # Export the following env vars
+    ${envScript}
     exec steam ${extraArgs} "$@"
   '';
 
@@ -272,8 +277,7 @@ in buildFHSUserEnv rec {
     inherit multiPkgs profile extraInstallCommands;
     inherit unshareIpc unsharePid;
 
-    runScript = writeScript "steam-run" ''
-      #!${runtimeShell}
+    runScript = writeShellScript "steam-run" ''
       run="$1"
       if [ "$run" = "" ]; then
         echo "Usage: steam-run command-to-run args..." >&2
@@ -283,6 +287,9 @@ in buildFHSUserEnv rec {
 
       ${exportLDPath}
       ${fixBootstrap}
+
+      set -o allexport # Export the following env vars
+      ${envScript}
       exec -- "$run" "$@"
     '';
 
diff --git a/pkgs/os-specific/linux/zfs/default.nix b/pkgs/os-specific/linux/zfs/default.nix
index 750586ff1b1d..8655bd2ed323 100644
--- a/pkgs/os-specific/linux/zfs/default.nix
+++ b/pkgs/os-specific/linux/zfs/default.nix
@@ -210,7 +210,7 @@ let
         changelog = "https://github.com/openzfs/zfs/releases/tag/zfs-${version}";
         license = lib.licenses.cddl;
         platforms = lib.platforms.linux;
-        maintainers = with lib.maintainers; [ jcumming jonringer wizeman globin raitobezarius ];
+        maintainers = with lib.maintainers; [ jcumming jonringer globin raitobezarius ];
         mainProgram = "zfs";
         # If your Linux kernel version is not yet supported by zfs, try zfsUnstable.
         # On NixOS set the option boot.zfs.enableUnstable.
diff --git a/pkgs/servers/matrix-synapse/default.nix b/pkgs/servers/matrix-synapse/default.nix
index 3e9fadea76fa..0061fa71e6b8 100644
--- a/pkgs/servers/matrix-synapse/default.nix
+++ b/pkgs/servers/matrix-synapse/default.nix
@@ -12,20 +12,20 @@ in
 with python3.pkgs;
 buildPythonApplication rec {
   pname = "matrix-synapse";
-  version = "1.79.0";
+  version = "1.80.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "matrix-org";
     repo = "synapse";
     rev = "v${version}";
-    hash = "sha256-2MHP4Gu+C5yyXObbd7NLYWCy1E0L7fUwpzYsoD7ULDo=";
+    hash = "sha256-Lw6gmuI+ntOW54HQbmDoY9QYNDTu5vgtrJz6HMWWmMM=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-yDKs6KRStjJMC/48dZcyQ4OmBXY1TombjH/ZDfBJbSc=";
+    hash = "sha256-KqPpaIJ8VuVV6f6n14/7wbA+Vtk7NvWm09bUBWuAAlY=";
   };
 
   postPatch = ''
diff --git a/pkgs/servers/redpanda/default.nix b/pkgs/servers/redpanda/default.nix
index fde3454dd310..ef8335c56ccc 100644
--- a/pkgs/servers/redpanda/default.nix
+++ b/pkgs/servers/redpanda/default.nix
@@ -7,12 +7,12 @@
 , stdenv
 }:
 let
-  version = "23.1.1";
+  version = "23.1.3";
   src = fetchFromGitHub {
     owner = "redpanda-data";
     repo = "redpanda";
     rev = "v${version}";
-    sha256 = "sha256-3IRhr+XQLZXCeKhUHOlE8REwUkxLw1jcHYIataG3BaM=";
+    sha256 = "sha256-tqQl7Elslcdw0hNjayYShj19KYmVskJG0qtaijGTzm0=";
   };
   server = callPackage ./server.nix { inherit src version; };
 in
diff --git a/pkgs/shells/dash/default.nix b/pkgs/shells/dash/default.nix
index e6113c0d7696..ff4656f6650f 100644
--- a/pkgs/shells/dash/default.nix
+++ b/pkgs/shells/dash/default.nix
@@ -1,10 +1,8 @@
 { lib
 , stdenv
 , buildPackages
-, autoreconfHook
 , pkg-config
 , fetchurl
-, fetchpatch
 , libedit
 , runCommand
 , dash
@@ -12,34 +10,16 @@
 
 stdenv.mkDerivation rec {
   pname = "dash";
-  version = "0.5.11.5";
+  version = "0.5.12";
 
   src = fetchurl {
     url = "http://gondor.apana.org.au/~herbert/dash/files/${pname}-${version}.tar.gz";
-    sha256 = "sha256-23eBEIkfeTeYXym/I0EP4cXWaVAnYPWE5U4OeynhI70=";
+    sha256 = "sha256-akdKxG6LCzKRbExg32lMggWNMpfYs4W3RQgDDKSo8oo=";
   };
 
-  hardeningDisable = [ "format" ];
-
-  patches = [
-    (fetchpatch {
-      # Dash executes code when noexec ("-n") is specified
-      # https://www.openwall.com/lists/oss-security/2020/11/11/3
-      url = "https://git.kernel.org/pub/scm/utils/dash/dash.git/patch/?id=29d6f2148f10213de4e904d515e792d2cf8c968e";
-      sha256 = "0aadb7aaaan6jxmi6icv4p5gqx7k510yszaqsa29b5giyxz5l9i1";
-    })
-
-    # aarch64-darwin fix from upstream; remove on next release
-    (fetchpatch {
-      url = "https://git.kernel.org/pub/scm/utils/dash/dash.git/patch/?id=6f6d1f2da03468c0e131fdcbdcfa9771ffca2614";
-      sha256 = "16iz2ylkyhpxqq411ns8pjk8rizh6afhavvsf052wvzsnmmlvfbw";
-    })
-  ];
-
   strictDeps = true;
-  # configure.ac patched; remove on next release
-  nativeBuildInputs = [ autoreconfHook ]
-    ++ lib.optionals stdenv.hostPlatform.isStatic [ pkg-config ];
+
+  nativeBuildInputs = lib.optionals stdenv.hostPlatform.isStatic [ pkg-config ];
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
   buildInputs = [ libedit ];
diff --git a/pkgs/tools/backup/rustic-rs/default.nix b/pkgs/tools/backup/rustic-rs/default.nix
index 559fcf2a0ff9..5487a2641750 100644
--- a/pkgs/tools/backup/rustic-rs/default.nix
+++ b/pkgs/tools/backup/rustic-rs/default.nix
@@ -2,27 +2,30 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rustic-rs";
-  version = "0.4.4";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "rustic-rs";
     repo = "rustic";
     rev = "v${version}";
-    hash = "sha256-irN5enJ0nyyzrLvnLXm7YhyEJ3nz9PQukzAfUrKmOzY=";
+    hash = "sha256-r4hOjX/LKv2wX720FMEztUo9rf2hDBLfcHtENSZNA3U=";
   };
 
-  cargoHash = "sha256-wJuWeoS45ikP12S2o6aB2Iogw5HomXzCIjkFbp3rSR4=";
+  cargoHash = "sha256-sNxD8rDkfUw5aVhRYpYftpPMiWhiTYDdShlVZvx2BHk=";
 
   nativeBuildInputs = [ installShellFiles ];
 
   buildInputs = lib.optionals stdenv.isDarwin [ Security ];
 
+  ## v0.5.0 panics when trying to generate zsh completions due to a bug.
+  ## See https://github.com/rustic-rs/rustic/issues/533
+  ## and https://github.com/rustic-rs/rustic/pull/536
   postInstall = ''
-    for shell in {ba,fi,z}sh; do
+    for shell in {ba,fi}sh; do
       $out/bin/rustic completions $shell > rustic.$shell
     done
 
-    installShellCompletion rustic.{ba,fi,z}sh
+    installShellCompletion rustic.{ba,fi}sh
   '';
 
   meta = {
diff --git a/pkgs/tools/graphics/vips/default.nix b/pkgs/tools/graphics/vips/default.nix
index db44108112f3..9c4099783e0c 100644
--- a/pkgs/tools/graphics/vips/default.nix
+++ b/pkgs/tools/graphics/vips/default.nix
@@ -39,7 +39,7 @@
 
 stdenv.mkDerivation rec {
   pname = "vips";
-  version = "8.14.1";
+  version = "8.14.2";
 
   outputs = [ "bin" "out" "man" "dev" ] ++ lib.optionals (!stdenv.isDarwin) [ "devdoc" ];
 
@@ -47,7 +47,7 @@ stdenv.mkDerivation rec {
     owner = "libvips";
     repo = "libvips";
     rev = "v${version}";
-    hash = "sha256-ajGVSVjnv78S/Xd3Aqn0N87I7m39DWKZHAQjwbog+5U=";
+    hash = "sha256-QUWZ11t2JEJBdpNuIY2uRiSL/hffRbV0SV5HowxWaME=";
     # Remove unicode file names which leads to different checksums on HFS+
     # vs. other filesystems because of unicode normalisation.
     postFetch = ''
diff --git a/pkgs/tools/misc/chatgpt-cli/default.nix b/pkgs/tools/misc/chatgpt-cli/default.nix
new file mode 100644
index 000000000000..0818e860b5ce
--- /dev/null
+++ b/pkgs/tools/misc/chatgpt-cli/default.nix
@@ -0,0 +1,28 @@
+{ lib
+, fetchFromGitHub
+, buildGoModule
+,
+}:
+buildGoModule rec {
+  pname = "chatgpt";
+  version = "0.6.0-beta";
+
+  src = fetchFromGitHub {
+    owner = "j178";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-qIa0eU3aFyDC5cm/J/BmZfcJe1DARqAtmpUMqlaqsF4=";
+  };
+
+  vendorHash = "sha256-JlBAPHtMm5mq91aOtsNMDu48net9i3W/AxCiKalYkm4=";
+
+  subPackages = [ "." ];
+
+  meta = with lib; {
+    description = "Interactive CLI for ChatGPT";
+    homepage = "https://github.com/j178/chatgpt";
+    license = licenses.mit;
+    mainProgram = "chatgpt";
+    maintainers = with maintainers; [ Ruixi-rebirth ];
+  };
+}
diff --git a/pkgs/tools/misc/grub/2.0x.nix b/pkgs/tools/misc/grub/2.0x.nix
index b6125b9faf76..f44b3c7a1bcf 100644
--- a/pkgs/tools/misc/grub/2.0x.nix
+++ b/pkgs/tools/misc/grub/2.0x.nix
@@ -81,6 +81,30 @@ stdenv.mkDerivation rec {
       url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=000b5cd04fd228f9741f5dca0491636bc0b89eb8";
       sha256 = "sha256-Mex3qQ0lW7ZCv7ZI7MSSqbylJXZ5RTbR4Pv1+CJ0ciM=";
     })
+
+    # Upstreamed patches for flicker-free boot
+    # Remove these patches once a new release is cut
+    (fetchpatch {
+      # term/efi/console: Do not set colorstate until the first text output
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=9381dbe045b39bd9395c9ab4276d95b4041ec9fb";
+      sha256 = "sha256-ZFq/PdCYo6aRySZRAfZARO8BmXwGgqeXz+9uNgNJEO8=";
+    })
+    (fetchpatch {
+      # term/efi/console: Do not set cursor until the first text output
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=7c316e18301e101e4dcd8abe88c0bed0b1b78857";
+      sha256 = "sha256-WJiK7MqmdStzq77vIDsO60Fu7i9LE/jDYzF4E9FXb7c=";
+    })
+    (fetchpatch {
+      # normal/menu: Don't show "Booting `%s'" msg when auto-booting with TIMEOUT_STYLE_HIDDEN
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=5bb4f2b7d665c84bde402d1a528b652a61753380";
+      sha256 = "sha256-lwJPPyq6yj7X1C2RuHfxnwKKstFkWGxcMXuSQqd9Z4I=";
+    })
+    (fetchpatch {
+      # kern/main: Suppress the "Welcome to GRUB!" message in EFI builds
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=3e4cbbeca0ef35097301a1086f85fd0d119e64aa";
+      sha256 = "sha256-cQX4x9V5Y7SU9WACn5FzDjukL2/StAUMMoHY/DRHq+g=";
+    })
+
     (fetchpatch {
       name = "CVE-2021-3981.patch";
       url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=0adec29674561034771c13e446069b41ef41e4d4";
diff --git a/pkgs/tools/misc/shell_gpt/default.nix b/pkgs/tools/misc/shell_gpt/default.nix
new file mode 100644
index 000000000000..695ceb15fe04
--- /dev/null
+++ b/pkgs/tools/misc/shell_gpt/default.nix
@@ -0,0 +1,40 @@
+{ lib
+, python3
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "shell_gpt";
+  version = "0.7.3";
+
+  src = python3.pkgs.fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-lS8zLtsh8Uz782KJwHqifEQnWQswbCXRVIfXWAmWtvI=";
+  };
+
+  nativeBuildInputs = with python3.pkgs; [
+    python3.pkgs.pythonRelaxDepsHook
+    python3
+    pip
+  ];
+
+  propagatedBuildInputs = with python3.pkgs; [
+    markdown-it-py
+    rich
+    distro
+    typer
+    requests
+  ];
+
+  pythonRelaxDeps = [ "requests" "rich" "distro" "typer" ];
+
+  doCheck = false;
+
+  meta = with lib; {
+    mainProgram = "sgpt";
+    homepage = "https://github.com/TheR1D/shell_gpt";
+    description = "Access ChatGPT from your terminal";
+    platforms = platforms.linux;
+    license = licenses.mit;
+    maintainers = with maintainers; [ mglolenstine ];
+  };
+}
diff --git a/pkgs/tools/misc/svu/default.nix b/pkgs/tools/misc/svu/default.nix
new file mode 100644
index 000000000000..62568696c42d
--- /dev/null
+++ b/pkgs/tools/misc/svu/default.nix
@@ -0,0 +1,31 @@
+{ lib, buildGoModule, fetchFromGitHub, testers, svu }:
+
+buildGoModule rec {
+  pname = "svu";
+  version = "1.10.2";
+
+  src = fetchFromGitHub {
+    owner = "caarlos0";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "37AT+ygN7u3KfFqr26M9c7aTt15z8m4PBrSd+G5mJcE=";
+  };
+
+  vendorHash = "sha256-+e1oL08KvBSNaRepGR2SBBrEDJaGxl5V9rOBysGEfQs=";
+
+  ldflags = [ "-s" "-w" "-X=main.version=${version}" "-X=main.builtBy=nixpkgs" ];
+
+  # test assumes source directory to be a git repository
+  postPatch = ''
+    rm internal/git/git_test.go
+  '';
+
+  passthru.tests.version = testers.testVersion { package = svu; };
+
+  meta = with lib; {
+    description = "Semantic Version Util";
+    homepage = "https://github.com/caarlos0/svu";
+    maintainers = with maintainers; [ caarlos0 ];
+    license = licenses.mit;
+  };
+}
diff --git a/pkgs/tools/misc/via/default.nix b/pkgs/tools/misc/via/default.nix
index 4d1783b53acc..5fd808cd1d81 100644
--- a/pkgs/tools/misc/via/default.nix
+++ b/pkgs/tools/misc/via/default.nix
@@ -2,12 +2,12 @@
 
 let
   pname = "via";
-  version = "2.1.0";
+  version = "3.0.0";
   name = "${pname}-${version}";
   src = fetchurl {
     url = "https://github.com/the-via/releases/releases/download/v${version}/via-${version}-linux.AppImage";
     name = "via-${version}-linux.AppImage";
-    sha256 = "sha256-eVmaVD3W+ZEw3HkuZWKsd9XYhASP5+dxzVW64fOhqwk=";
+    sha256 = "sha256-+uTvmrqHK7L5VA/lUHCZZeRYPUrcVA+vjG7venxuHhs=";
   };
   appimageContents = appimageTools.extractType2 { inherit name src; };
 in
diff --git a/pkgs/tools/security/pcsc-safenet/default.nix b/pkgs/tools/security/pcsc-safenet/default.nix
index 68006a40da8d..2fcbd302e8cc 100644
--- a/pkgs/tools/security/pcsc-safenet/default.nix
+++ b/pkgs/tools/security/pcsc-safenet/default.nix
@@ -1,38 +1,45 @@
 { stdenv
 , lib
-, fetchurl
+, runCommand
+, fetchzip
 , autoPatchelfHook
 , dpkg
-, gtk2
-, openssl
+, gtk3
+, openssl_1_1
 , pcsclite
+, unzip
 }:
 
 stdenv.mkDerivation rec {
   pname = "pcsc-safenet";
-  version = "10.0.37-0";
+  version = "10.8.28";
 
-  # https://aur.archlinux.org/packages/sac-core/
-  src = fetchurl {
-    url = "https://storage.spidlas.cz/public/soft/safenet/SafenetAuthenticationClient-core-${version}_amd64.deb";
-    sha256 = "1r9739bhal7ramj1rpawaqvik45xbs1c756l1da96din638gzy5l";
-  };
+  debName = "Installation/Standard/Ubuntu-2004/safenetauthenticationclient_${version}_amd64.deb";
+
+  # extract debian package from larger zip file
+  src =
+    let
+      versionWithUnderscores = builtins.replaceStrings ["."] ["_"] version;
+    in fetchzip {
+      url = "https://www.digicert.com/StaticFiles/SAC_${versionWithUnderscores}_GA_Build.zip";
+      hash = "sha256-7XWj3T9/KnmgQ05urOJV6dqgkAS/A2G7efnqjQO2ing=";
+    };
 
   dontBuild = true;
   dontConfigure = true;
 
   unpackPhase = ''
-    dpkg-deb -x $src .
+    dpkg-deb -x "$src/$debName" .
   '';
 
   buildInputs = [
-    gtk2
-    openssl
+    gtk3
+    openssl_1_1
     pcsclite
   ];
 
   runtimeDependencies = [
-    openssl
+    openssl_1_1
   ];
 
   nativeBuildInputs = [
@@ -41,35 +48,36 @@ stdenv.mkDerivation rec {
   ];
 
   installPhase = ''
-    # Set up for pcsc drivers
+    mv usr/* .
+
     mkdir -p pcsc/drivers
-    mv usr/share/eToken/drivers/* pcsc/drivers/
-    rm -r usr/share/eToken/drivers
+    mv -- lib/pkcs11/* pcsc/drivers/
+    rmdir lib/pkcs11
 
-    # Move binaries out
-    mv usr/bin bin
+    mkdir "$out"
+    cp -r ./* "$out/"
 
-    # Move UI to bin
-    mv usr/share/SAC/SACUIProcess bin/
-    rm -r usr/share/SAC
+    # for each library like libfoo.so.1.2.3, create symlinks to it from libfoo.so, libfoo.so.1, libfoo.so.1.2
+    (
+      cd "$out/lib/" || exit
+      for f in *.so.*.*.*; do                # find library names with three-layer suffixes
+        ln -sf "$f" "''${f%.*}" || exit      # strip only one suffix layer
+        ln -sf "$f" "''${f%.*.*}" || exit    # strip two suffix layers
+        ln -sf "$f" "''${f%.*.*.*}" || exit  # strip all three suffix layers
+      done
+    ) || exit
 
-    mkdir $out
-    cp -r {bin,etc,lib,pcsc,usr,var} $out/
+    # when library links are missing in pcsc/drivers, create them
+    (
+      cd "$out/pcsc/drivers" || exit
+      for f in *; do
+        if [[ ! -e $f && -e ../../lib/$f ]]; then
+          ln -sf ../../lib/"$f" "$f" || exit
+        fi
+      done
+    ) || exit
 
-    cd "$out/lib/"
-    ln -sf libeToken.so.10.0.37 libeTPkcs11.so
-    ln -sf libeToken.so.10.0.37 libeToken.so.10.0
-    ln -sf libeToken.so.10.0.37 libeToken.so.10
-    ln -sf libeToken.so.10.0.37 libeToken.so
-    ln -sf libcardosTokenEngine.so.10.0.37 libcardosTokenEngine.so.10.0
-    ln -sf libcardosTokenEngine.so.10.0.37 libcardosTokenEngine.so.10
-    ln -sf libcardosTokenEngine.so.10.0.37 libcardosTokenEngine.so
-
-    cd $out/pcsc/drivers/aks-ifdh.bundle/Contents/Linux/
-    ln -sf libAksIfdh.so.10.0 libAksIfdh.so
-    ln -sf libAksIfdh.so.10.0 libAksIfdh.so.10
-
-    ln -sf ${lib.getLib openssl}/lib/libcrypto.so $out/lib/libcrypto.so.1.0.0
+    ln -sf ${lib.getLib openssl_1_1}/lib/libcrypto.so $out/lib/libcrypto.so.1.1.0
   '';
 
   dontAutoPatchelf = true;
diff --git a/pkgs/tools/typesetting/typst/Cargo.lock b/pkgs/tools/typesetting/typst/Cargo.lock
index fe52185931f8..c595674ad62c 100644
--- a/pkgs/tools/typesetting/typst/Cargo.lock
+++ b/pkgs/tools/typesetting/typst/Cargo.lock
@@ -58,8 +58,9 @@ checksum = "9e1b586273c5702936fe7b7d6896644d8be71e6314cfe09d3167c95f712589e8"
 
 [[package]]
 name = "biblatex"
-version = "0.6.3"
-source = "git+https://github.com/typst/biblatex#932ad283dd45dd88d4fa14dc5b9bda7a270ba027"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1bc17a7f4d461f93f5dbbae4c961746cb4aafb5c6c1a61089a86836614932a3c"
 dependencies = [
  "chrono",
  "numerals",
@@ -159,8 +160,9 @@ checksum = "3d7b894f5411737b7867f4827955924d7c254fc9f4d91a6aad6b097804b1018b"
 
 [[package]]
 name = "comemo"
-version = "0.1.0"
-source = "git+https://github.com/typst/comemo#9b520e8f5284d1c39d0bb13eb426f923972775f8"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22bf2c21093020535dd771993fedae8dd55393a4258cca501a9b55a962d350a5"
 dependencies = [
  "comemo-macros",
  "siphasher",
@@ -168,8 +170,9 @@ dependencies = [
 
 [[package]]
 name = "comemo-macros"
-version = "0.1.0"
-source = "git+https://github.com/typst/comemo#9b520e8f5284d1c39d0bb13eb426f923972775f8"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9faa23f4534253fa656b176ff524d5cd7306a6fed3048929f9cc01ab38ab5a5a"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -430,8 +433,9 @@ checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
 
 [[package]]
 name = "hayagriva"
-version = "0.1.1"
-source = "git+https://github.com/typst/hayagriva#754efb7e1034bcd4d4f1366e432197edbbfb9ed5"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "33f939b9606af811242f770582c89a2f8bb5de4e531c0a1df9d2d4906bcbc32a"
 dependencies = [
  "biblatex",
  "chrono",
@@ -844,7 +848,8 @@ checksum = "db8bcd96cb740d03149cbad5518db9fd87126a10ab519c011893b1754134c468"
 [[package]]
 name = "pixglyph"
 version = "0.1.0"
-source = "git+https://github.com/typst/pixglyph#e3ff0272d6723cdada91a00b0c99cda0e5adb56d"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9eefadd393715fe315c8cdcd587f893b818a6dfe4f6f9faeb44b764c7c38fd8b"
 dependencies = [
  "ttf-parser 0.18.1",
 ]
@@ -1500,7 +1505,8 @@ checksum = "e5464a87b239f13a63a501f2701565754bae92d243d4bb7eb12f6d57d2269bf4"
 [[package]]
 name = "unicode-math-class"
 version = "0.1.0"
-source = "git+https://github.com/typst/unicode-math-class#a7ac7dd75cd79ab2e0bdb629036cb913371608d2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d246cf599d5fae3c8d56e04b20eb519adb89a8af8d0b0fbcded369aa3647d65"
 
 [[package]]
 name = "unicode-normalization"
diff --git a/pkgs/tools/typesetting/typst/default.nix b/pkgs/tools/typesetting/typst/default.nix
index 0e4cdfcb9a30..ed5473892e4c 100644
--- a/pkgs/tools/typesetting/typst/default.nix
+++ b/pkgs/tools/typesetting/typst/default.nix
@@ -7,25 +7,20 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "typst";
-  version = "23-03-21-2";
+  version = "23-03-28";
 
   src = fetchFromGitHub {
     owner = "typst";
     repo = "typst";
     rev = "v${version}";
-    hash = "sha256-bJPGs/Bd9nKYDrCCaFT+20+1wTN4YdkV8bGrtOCR4tM=";
+    hash = "sha256-0fTGbXdpzPadABWqdReQNZf2N7OMZ8cs9U5fmhfN6m4=";
   };
 
   cargoLock = {
     lockFile = ./Cargo.lock;
     outputHashes = {
-      "biblatex-0.6.3" = "sha256-TfH2tk7B61HHqpdGY48TdPKelp4+78x+8LRFobAg8QA=";
-      "comemo-0.1.0" = "sha256-zg056kUc8sVLQ8vvT4uOuRJnyrCORsGYUvsjBJEkFPg=";
-      "hayagriva-0.1.1" = "sha256-HGQ+jNAnejxUBQNaqXPw57zfAC3qNXSWUVzDALZTXg0=";
       "iai-0.1.1" = "sha256-EdNzCPht5chg7uF9O8CtPWR/bzSYyfYIXNdLltqdlR0=";
       "lipsum-0.8.2" = "sha256-deIbpn4YM7/NeuJ5Co48ivJmxwrcsbLl6c3cP3JZxAQ=";
-      "pixglyph-0.1.0" = "sha256-8veNF3rzV21ayzk9gh2x0mQA8nHGM662ohvh084a0vk=";
-      "unicode-math-class-0.1.0" = "sha256-NkwDzj1SfUe570UcfotmVP6bIEYwiegZd0j8TPEWoOk=";
     };
   };
 
@@ -36,20 +31,13 @@ rustPlatform.buildRustPackage rec {
   cargoBuildFlags = [ "-p" "typst-cli" ];
   cargoTestFlags = [ "-p" "typst-cli" ];
 
-  # the build script tries to get the revision using git
-  # which overwrites the environment variable set below
-  postPatch = ''
-    rm cli/build.rs
-  '';
-
-  # git revision used for `--version`
-  # https://github.com/typst/typst/blob/b934a2fd83d63fc115c01f959e888c7bc1aa87e4/cli/build.rs#L7
-  TYPST_HASH = "b934a2fd";
+  # https://github.com/typst/typst/blob/056d15a/cli/src/main.rs#L164
+  TYPST_VERSION = version;
 
   meta = with lib; {
     description = "A new markup-based typesetting system that is powerful and easy to learn";
     homepage = "https://typst.app";
     license = licenses.asl20;
-    maintainers = with maintainers; [ figsoda kanashimia ];
+    maintainers = with maintainers; [ drupol figsoda kanashimia ];
   };
 }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 2a1dd423e2d1..00fd1bb285e3 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -402,6 +402,8 @@ with pkgs;
 
   cewl = callPackage ../tools/security/cewl { };
 
+  chatgpt-cli = callPackage ../tools/misc/chatgpt-cli { };
+
   checkov = callPackage ../development/tools/analysis/checkov {
     python3 = python311;
   };
@@ -12424,6 +12426,8 @@ with pkgs;
 
   svgcleaner = callPackage ../tools/graphics/svgcleaner { };
 
+  svu = callPackage ../tools/misc/svu { };
+
   ssb = callPackage ../tools/security/ssb { };
 
   ssb-patchwork = callPackage ../applications/networking/ssb-patchwork { };
@@ -15581,8 +15585,9 @@ with pkgs;
 
   muonlang = callPackage ../development/compilers/muonlang { };
 
-  inherit (callPackages ../development/compilers/nim { })
-    nim-unwrapped nimble-unwrapped nim;
+  inherit (callPackages ../development/compilers/nim
+                        { inherit (darwin) Security;  }
+          ) nim-unwrapped nimble-unwrapped nim;
   nimPackages = recurseIntoAttrs nim.pkgs;
 
   nrpl = callPackage ../development/tools/nrpl { };
@@ -28700,8 +28705,8 @@ with pkgs;
   };
   audaciousQt5 = audacious;
 
-  audacity = darwin.apple_sdk_11_0.callPackage ../applications/audio/audacity {
-    inherit (darwin.apple_sdk_11_0.frameworks) AppKit CoreAudioKit;
+  audacity = callPackage ../applications/audio/audacity {
+    inherit (darwin.apple_sdk.frameworks) AppKit CoreAudioKit;
   };
 
   audio-recorder = callPackage ../applications/audio/audio-recorder { };
@@ -33270,6 +33275,8 @@ with pkgs;
 
   shadowfox = callPackage ../tools/networking/shadowfox { };
 
+  shell_gpt = callPackage ../tools/misc/shell_gpt { };
+
   shfmt = callPackage ../tools/text/shfmt { };
 
   shipments = callPackage ../applications/misc/shipments { };
@@ -33622,6 +33629,7 @@ with pkgs;
   syncterm = callPackage ../applications/terminal-emulators/syncterm { };
 
   inherit (callPackages ../applications/networking/syncthing {
+    inherit (darwin) autoSignDarwinBinariesHook;
     buildGoModule = buildGo119Module; # go 1.20 build failure
    })
     syncthing
diff --git a/pkgs/top-level/linux-kernels.nix b/pkgs/top-level/linux-kernels.nix
index cbb4581126e5..3754c8a004ab 100644
--- a/pkgs/top-level/linux-kernels.nix
+++ b/pkgs/top-level/linux-kernels.nix
@@ -649,6 +649,7 @@ in {
   # Derive one of the default .config files
   linuxConfig = {
     src,
+    kernelPatches ? [],
     version ? (builtins.parseDrvName src.name).version,
     makeTarget ? "defconfig",
     name ? "kernel.config",
@@ -656,6 +657,7 @@ in {
     inherit name src;
     depsBuildBuild = [ buildPackages.stdenv.cc ]
       ++ lib.optionals (lib.versionAtLeast version "4.16") [ buildPackages.bison buildPackages.flex ];
+    patches = map (p: p.patch) kernelPatches;  # Patches may include new configs.
     postPatch = ''
       patchShebangs scripts/
     '';