diff --git a/nixos/modules/virtualisation/qemu-vm.nix b/nixos/modules/virtualisation/qemu-vm.nix
index d0a5ddd87ccf..74c3e1ecd03f 100644
--- a/nixos/modules/virtualisation/qemu-vm.nix
+++ b/nixos/modules/virtualisation/qemu-vm.nix
@@ -647,7 +647,7 @@ in
         import pkgs.path { system = "x86_64-darwin"; }
       '';
       description = lib.mdDoc ''
-        pkgs set to use for the host-specific packages of the vm runner.
+        Package set to use for the host-specific packages of the VM runner.
         Changing this to e.g. a Darwin package set allows running NixOS VMs on Darwin.
       '';
     };
diff --git a/pkgs/applications/audio/picard/default.nix b/pkgs/applications/audio/picard/default.nix
index a9eab5835db4..1f811c2767fc 100644
--- a/pkgs/applications/audio/picard/default.nix
+++ b/pkgs/applications/audio/picard/default.nix
@@ -1,9 +1,11 @@
 { lib
 , python3Packages
 , fetchFromGitHub
-, gettext
+
 , chromaprint
+, gettext
 , qt5
+
 , enablePlayback ? true
 , gst_all_1
 }:
@@ -19,13 +21,14 @@ let
 in
 pythonPackages.buildPythonApplication rec {
   pname = "picard";
-  version = "2.9.1";
+  version = "2.9.2";
+  format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "metabrainz";
     repo = "picard";
     rev = "refs/tags/release-${version}";
-    hash = "sha256-KCLva8pc+hyz+3MkPsghXrDYGVqP0aeffG9hOYJzI+Q=";
+    hash = "sha256-Sk4QlwJqqgCWAgguhIVscJfpf/5imoHYN9yVWv5qYG8=";
   };
 
   nativeBuildInputs = [
@@ -48,13 +51,13 @@ pythonPackages.buildPythonApplication rec {
 
   propagatedBuildInputs = with pythonPackages; [
     chromaprint
-    python-dateutil
     discid
     fasteners
-    mutagen
-    pyqt5
     markdown
+    mutagen
     pyjwt
+    pyqt5
+    python-dateutil
     pyyaml
   ];
 
@@ -67,14 +70,13 @@ pythonPackages.buildPythonApplication rec {
   # In order to spare double wrapping, we use:
   preFixup = ''
     makeWrapperArgs+=("''${qtWrapperArgs[@]}")
-  ''
-  + lib.optionalString (pyqt5.multimediaEnabled) ''
+  '' + lib.optionalString (pyqt5.multimediaEnabled) ''
     makeWrapperArgs+=(--prefix GST_PLUGIN_SYSTEM_PATH_1_0 : "$GST_PLUGIN_SYSTEM_PATH_1_0")
   '';
 
   meta = with lib; {
-    homepage = "https://picard.musicbrainz.org/";
-    changelog = "https://picard.musicbrainz.org/changelog/";
+    homepage = "https://picard.musicbrainz.org";
+    changelog = "https://picard.musicbrainz.org/changelog";
     description = "The official MusicBrainz tagger";
     maintainers = with maintainers; [ ehmry paveloom ];
     license = licenses.gpl2Plus;
diff --git a/pkgs/applications/misc/spicetify-cli/default.nix b/pkgs/applications/misc/spicetify-cli/default.nix
index 6b5d6940bff9..d90b67f1cab4 100644
--- a/pkgs/applications/misc/spicetify-cli/default.nix
+++ b/pkgs/applications/misc/spicetify-cli/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "spicetify-cli";
-  version = "2.23.0";
+  version = "2.23.2";
 
   src = fetchFromGitHub {
     owner = "spicetify";
     repo = "spicetify-cli";
     rev = "v${version}";
-    hash = "sha256-j20B980kSsAh9uEOQp9a0URA32GtRCAH5N0I5OoEzuQ=";
+    hash = "sha256-wL4aZt64NWlGabEjU885dv8WYz4MNPM4saDoraaRMjw=";
   };
 
-  vendorHash = "sha256-cRauedoHANgbN9b/VAdmm5yF/2qMuQhXjitOnJoyaDs=";
+  vendorHash = "sha256-rMMTUT7HIgYvxGcqR02VmxOh1ihE6xuIboDsnuOo09g=";
 
   ldflags = [
     "-s -w"
diff --git a/pkgs/applications/misc/tabula-java/default.nix b/pkgs/applications/misc/tabula-java/default.nix
index ebd266e66698..f8d3cc3c54be 100644
--- a/pkgs/applications/misc/tabula-java/default.nix
+++ b/pkgs/applications/misc/tabula-java/default.nix
@@ -1,24 +1,37 @@
-{ stdenv, lib, fetchurl, jre, makeWrapper }:
+{ lib
+, maven
+, fetchFromGitHub
+, makeWrapper
+, jre
+}:
 
-stdenv.mkDerivation rec {
+maven.buildMavenPackage rec {
   pname = "tabula-java";
   version = "1.0.5";
 
-  src = fetchurl {
-    url = "https://github.com/tabulapdf/tabula-java/releases/download/v${version}/tabula-${version}-jar-with-dependencies.jar";
-    sha256 = "sha256-IWHj//ZZOdfOCBJHnPnKNoYNtWl/f8H6ARYe1AkqB0U=";
+  src = fetchFromGitHub {
+    owner = "tabulapdf";
+    repo = "tabula-java";
+    rev = "v${version}";
+    hash = "sha256-lg8/diyGhfkUU0w7PEOlxb1WNpJZVDDllxMMsTIU/Cw=";
   };
 
+  mvnHash = "sha256-yULCBHgctZZU3Deod+nQujssmUy+kgdFdgE3NUuFhOw=";
+  mvnParameters = "compile assembly:single -Dmaven.test.skip=true";
+
   nativeBuildInputs = [ makeWrapper ];
 
-  dontUnpack = true;
-  dontBuild = true;
-
   installPhase = ''
-    mkdir -pv $out/share/tabula-java
-    cp -v $src $out/share/tabula-java/tabula-java.jar
+    runHook preInstall
 
-    makeWrapper ${jre}/bin/java $out/bin/tabula-java --add-flags "-jar $out/share/tabula-java/tabula-java.jar"
+    mkdir -p $out/{bin,lib}
+    cp target/tabula-${version}-jar-with-dependencies.jar $out/lib/tabula.jar
+
+    makeWrapper ${jre}/bin/java $out/bin/tabula-java \
+      --add-flags "-cp $out/lib/tabula.jar" \
+      --add-flags "technology.tabula.CommandLineApp"
+
+    runHook postInstall
   '';
 
   meta = with lib; {
@@ -29,7 +42,6 @@ stdenv.mkDerivation rec {
       programmatically extract tables from PDFs.
     '';
     homepage = "https://tabula.technology/";
-    sourceProvenance = with sourceTypes; [ binaryBytecode ];
     license = licenses.mit;
     maintainers = [ maintainers.jakewaksbaum ];
     platforms = platforms.all;
diff --git a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
index 38396ce27c45..4ddb0b6410f0 100644
--- a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
@@ -43,13 +43,13 @@ rec {
 
   thunderbird-115 = (buildMozillaMach rec {
     pname = "thunderbird";
-    version = "115.2.1";
+    version = "115.2.2";
     application = "comm/mail";
     applicationName = "Mozilla Thunderbird";
     binaryName = pname;
     src = fetchurl {
       url = "mirror://mozilla/thunderbird/releases/${version}/source/thunderbird-${version}.source.tar.xz";
-      sha512 = "375c66efe9637c41e4758fdc7477b64fa700032fecc0e5e93fb6a4659c1ceee99b2c366e19beb96252e60dbbec78ec37433c3f70f7fcc0f305a927f95d753c05";
+      sha512 = "45843709c21eb19d69d43205da6b2f943b584811a29942ffef1933c1ce7882b48046b201c2ff198658fec2c53d479311d8a353731afe6ea53f97b31674d6074a";
     };
     extraPatches = [
       # The file to be patched is different from firefox's `no-buildconfig-ffx90.patch`.
diff --git a/pkgs/applications/networking/syncthing/default.nix b/pkgs/applications/networking/syncthing/default.nix
index 965c3d5e6155..cb150fb2ed4a 100644
--- a/pkgs/applications/networking/syncthing/default.nix
+++ b/pkgs/applications/networking/syncthing/default.nix
@@ -13,16 +13,16 @@ let
   common = { stname, target, postInstall ? "" }:
     buildGoModule rec {
       pname = stname;
-      version = "1.23.7";
+      version = "1.24.0";
 
       src = fetchFromGitHub {
         owner = "syncthing";
         repo = "syncthing";
         rev = "v${version}";
-        hash = "sha256-LwjqMEfCdMvNoxn88H3+VyX31G5IlRohpfp++oNCfEc=";
+        hash = "sha256-5vr9qWMHBYpu8wHpV1JZcX1kEPi+mYeZ7ZQBqXASp9I=";
       };
 
-      vendorHash = "sha256-nk80Y5RBoUCp+xYNYYnVWVBkCLCgvgKZFpV5CfS2p/s=";
+      vendorHash = "sha256-BZwZ6npmWFU0lvynjRZOBOhtxqic0djoSUdCOLbUwjE=";
 
       nativeBuildInputs = lib.optionals stdenv.isDarwin [
         # Recent versions of macOS seem to require binaries to be signed when
diff --git a/pkgs/applications/search/recoll/default.nix b/pkgs/applications/search/recoll/default.nix
index 933b07a5d8b9..3058d83bf58c 100644
--- a/pkgs/applications/search/recoll/default.nix
+++ b/pkgs/applications/search/recoll/default.nix
@@ -5,6 +5,7 @@
 , antiword
 , bison
 , catdoc
+, catdvi
 , chmlib
 , djvulibre
 , file
@@ -43,6 +44,7 @@ let filters = {
       awk = gawk;
       antiword = antiword;
       catppt = catdoc;
+      catdvi = catdvi;
       djvused = djvulibre;
       djvutxt = djvulibre;
       egrep = gnugrep;
diff --git a/pkgs/applications/video/obs-studio/plugins/wlrobs.nix b/pkgs/applications/video/obs-studio/plugins/wlrobs.nix
index 5ee226c24827..e309447d9527 100644
--- a/pkgs/applications/video/obs-studio/plugins/wlrobs.nix
+++ b/pkgs/applications/video/obs-studio/plugins/wlrobs.nix
@@ -5,14 +5,14 @@
 
 stdenv.mkDerivation {
   pname = "wlrobs";
-  version = "unstable-2022-10-06";
+  version = "unstable-2023-08-23";
 
   src = fetchFromSourcehut {
     vc = "hg";
     owner = "~scoopta";
     repo = "wlrobs";
-    rev = "78be323b25e1365f5c8f9dcba6938063ca10f71f";
-    sha256 = "sha256-/VemJkk695BdSDsODmYIPdhPwggzIhBi/0m6P+AYfx0=";
+    rev =  "f72d5cb3cbbd3983ae6cfd86cb1940be7372681c";
+    hash = "sha256-hiM0d38SSUqbyisP3fAtKRLBDjVKZdU2U1xyXci7yNk=";
   };
 
   nativeBuildInputs = [ meson pkg-config ninja ];
diff --git a/pkgs/build-support/php/hooks/composer-install-hook.sh b/pkgs/build-support/php/hooks/composer-install-hook.sh
index 9f23b90fa401..bb6cb47e861b 100644
--- a/pkgs/build-support/php/hooks/composer-install-hook.sh
+++ b/pkgs/build-support/php/hooks/composer-install-hook.sh
@@ -106,7 +106,7 @@ composerInstallInstallHook() {
     # Create symlinks for the binaries.
     jq -r -c 'try .bin[]' composer.json | while read -r bin; do
         mkdir -p "$out"/share/php/"${pname}" "$out"/bin
-        ln -s "$out"/share/php/"${pname}"/"$bin" "$out"/bin/"$(basename "$bin")"
+        makeWrapper "$out"/share/php/"${pname}"/"$bin" "$out"/bin/"$(basename "$bin")"
     done
 
     echo "Finished composerInstallInstallHook"
diff --git a/pkgs/build-support/php/hooks/default.nix b/pkgs/build-support/php/hooks/default.nix
index 98198f012879..e7de98647c39 100644
--- a/pkgs/build-support/php/hooks/default.nix
+++ b/pkgs/build-support/php/hooks/default.nix
@@ -1,21 +1,22 @@
 { makeSetupHook
-, php
 , jq
 , moreutils
+, makeBinaryWrapper
+, php
 }:
 
 {
   composerRepositoryHook = makeSetupHook
     {
       name = "composer-repository-hook.sh";
-      propagatedBuildInputs = [ php jq moreutils ];
+      propagatedBuildInputs = [ jq moreutils php ];
       substitutions = { };
     } ./composer-repository-hook.sh;
 
   composerInstallHook = makeSetupHook
     {
       name = "composer-install-hook.sh";
-      propagatedBuildInputs = [ php jq moreutils ];
+      propagatedBuildInputs = [ jq makeBinaryWrapper moreutils php ];
       substitutions = { };
     } ./composer-install-hook.sh;
 }
diff --git a/pkgs/by-name/dj/djent/package.nix b/pkgs/by-name/dj/djent/package.nix
new file mode 100644
index 000000000000..3559410fbd29
--- /dev/null
+++ b/pkgs/by-name/dj/djent/package.nix
@@ -0,0 +1,47 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, mpfr
+}:
+
+stdenv.mkDerivation rec {
+  pname = "djent";
+  version = "1.0";
+
+  src = fetchFromGitHub {
+    owner = "dj-on-github";
+    repo = "djent";
+    rev = "${version}";
+    hash = "sha256-inMh7l/6LlrVnIin+L+fj+4Lchk0Xvt09ngVrCuvphE=";
+  };
+
+  buildInputs = [ mpfr ];
+
+  preBuild = ''
+    sed -i s/gcc/${stdenv.cc.targetPrefix}gcc/g Makefile
+  ''
+  + lib.optionalString (!stdenv.hostPlatform.isx86_64) ''
+    sed -i s/-m64//g Makefile
+  '';
+
+  makeFlags = [ "CC=${stdenv.cc.targetPrefix}cc" ];
+
+  installPhase = ''
+    runHook preInstall
+    install -D djent $out/bin/djent
+    runHook postInstall
+  '';
+
+  enableParallelBuilding = true;
+
+  meta = {
+    homepage = "http://www.deadhat.com/";
+    description = ''
+      A reimplementation of the Fourmilab/John Walker random number test program
+      ent with several improvements
+    '';
+    license = lib.licenses.gpl2Only;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ orichter thillux ];
+  };
+}
diff --git a/pkgs/by-name/he/hexbinhex/package.nix b/pkgs/by-name/he/hexbinhex/package.nix
new file mode 100644
index 000000000000..8386ee9128dd
--- /dev/null
+++ b/pkgs/by-name/he/hexbinhex/package.nix
@@ -0,0 +1,40 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+}:
+
+stdenv.mkDerivation rec {
+  pname = "hexbinhex";
+  version = "1.1";
+
+  src = fetchFromGitHub {
+    owner = "dj-on-github";
+    repo = "hexbinhex";
+    rev = "v${version}";
+    hash = "sha256-nfOmiF+t5QtAl1I7CSz26C9SGo7ZkdSziO2eiHbk6pA=";
+  };
+
+  preBuild = ''
+    substituteInPlace Makefile --replace '/usr/local' $out
+    mkdir -p $out/bin
+  ''
+  +
+  lib.optionalString (!stdenv.hostPlatform.isx86_64) ''
+    sed -i s/-m64//g Makefile
+  '';
+
+  makeFlags = [ "CC=${stdenv.cc.targetPrefix}cc" ];
+
+  enableParallelBuilding = true;
+
+  meta = {
+    homepage = "https://github.com/dj-on-github/hexbinhex";
+    description = ''
+      Six utility programs to convert between hex, binary, ascii-binary
+      and the oddball NIST format for 90B testing.
+    '';
+    license = lib.licenses.gpl2Only;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ orichter thillux ];
+  };
+}
diff --git a/pkgs/development/libraries/swiftshader/default.nix b/pkgs/development/libraries/swiftshader/default.nix
index cfcccd018f9d..36564110d283 100644
--- a/pkgs/development/libraries/swiftshader/default.nix
+++ b/pkgs/development/libraries/swiftshader/default.nix
@@ -2,22 +2,15 @@
 
 stdenv.mkDerivation rec {
   pname = "swiftshader";
-  version = "2020-11-06";
+  version = "2023-09-11";
 
   src = fetchgit {
     url = "https://swiftshader.googlesource.com/SwiftShader";
-    rev = "4ed9d3498dcffa987acba1a8007ff8dec336f263";
-    sha256 = "1gz2zflfacxf34s78djddf93brn9kyxj4byc4p2ip1pin43lh2lg";
+    rev = "4e40d502c440cc59b25fa3a5fee0eadbab7442aa";
+    sha256 = "085bdqn80s7zw5h2pz6xff3j34hmkxb9wxzgjmzdr9c24zwp2k1c";
   };
 
   nativeBuildInputs = [ cmake python3 jq ];
-  buildInputs = [ libX11 libXext zlib ];
-
-  env.NIX_CFLAGS_COMPILE = toString [
-    # Needed with GCC 12
-    "-Wno-error=array-bounds"
-    "-Wno-error=uninitialized"
-  ];
 
   # Make sure we include the drivers and icd files in the output as the cmake
   # generated install command only puts in the spirv-tools stuff.
@@ -35,35 +28,17 @@ stdenv.mkDerivation rec {
     mkdir -p "$(dirname "$vk_icd_json")"
     jq ".ICD.library_path = \"$vk_so_path\"" <Linux/vk_swiftshader_icd.json >"$vk_icd_json"
 
-    #
-    # GL driver
-    #
-    gl_so_path="$out/lib/libEGL.so"
-    mkdir -p "$(dirname "$gl_so_path")"
-    mv Linux/libEGL.so "$gl_so_path"
-
-    gl_icd_json="$out/share/glvnd/egl_vendor.d/swiftshader.json"
-    mkdir -p "$(dirname "$gl_icd_json")"
-    cat >"$gl_icd_json" <<EOF
-    {
-      "file_format_version" : "1.0.0",
-      "ICD" : {
-          "library_path" : "$gl_so_path"
-      }
-    }
-    EOF
-
     runHook postInstall
   '';
 
   meta = with lib; {
     description =
-      "A high-performance CPU-based implementation of the Vulkan, OpenGL ES, and Direct3D 9 graphics APIs";
+      "A high-performance CPU-based implementation of the Vulkan 1.3 graphics API";
     homepage = "https://opensource.google/projects/swiftshader";
     license = licenses.asl20;
     # Should be possible to support Darwin by changing the install phase with
     # 's/Linux/Darwin/' and 's/so/dylib/' or something similar.
-    platforms = [ "i686-linux" "x86_64-linux" "armv7l-linux" "mipsel-linux" ];
+    platforms = with platforms; linux;
     maintainers = with maintainers; [ expipiplus1 ];
   };
 }
diff --git a/pkgs/development/php-packages/psysh/default.nix b/pkgs/development/php-packages/psysh/default.nix
index 04b0ff69cc03..6ae05cea4d3c 100644
--- a/pkgs/development/php-packages/psysh/default.nix
+++ b/pkgs/development/php-packages/psysh/default.nix
@@ -1,35 +1,23 @@
-{ mkDerivation, fetchurl, makeWrapper, lib, php }:
+{ fetchFromGitHub, lib, php }:
 
-let
+php.buildComposerProject (finalAttrs: {
   pname = "psysh";
   version = "0.11.20";
-in
-mkDerivation {
-  inherit pname version;
 
-  src = fetchurl {
-    url = "https://github.com/bobthecow/psysh/releases/download/v${version}/psysh-v${version}.tar.gz";
-    sha256 = "sha256-1d07/qE6qamsmBkkuuxIY9YgYC7wgP21QDc5Iu9Ecv4=";
+  src = fetchFromGitHub {
+    owner = "bobthecow";
+    repo = "psysh";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-Bcpmn0rCjNMeGvF1CGg4uatakUtMY1H1o759CK15b0o=";
   };
 
-  dontUnpack = true;
+  vendorHash = "sha256-1XPDgaiWVenGSGluDciQAm9qQTL9vGJk9AqkTviRa+c=";
 
-  nativeBuildInputs = [ makeWrapper ];
-
-  installPhase = ''
-    runHook preInstall
-    mkdir -p $out/bin
-    tar -xzf $src -C $out/bin
-    chmod +x $out/bin/psysh
-    wrapProgram $out/bin/psysh --prefix PATH : "${lib.makeBinPath [ php ]}"
-    runHook postInstall
-  '';
-
-  meta = with lib; {
-    changelog = "https://github.com/bobthecow/psysh/releases/tag/v${version}";
+  meta = {
+    changelog = "https://github.com/bobthecow/psysh/releases/tag/v${finalAttrs.version}";
     description = "PsySH is a runtime developer console, interactive debugger and REPL for PHP.";
-    license = licenses.mit;
+    license = lib.licenses.mit;
     homepage = "https://psysh.org/";
-    maintainers = teams.php.members;
+    maintainers = lib.teams.php.members;
   };
-}
+})
diff --git a/pkgs/development/python-modules/censys/default.nix b/pkgs/development/python-modules/censys/default.nix
index 150a8e36747a..f0a144e646ee 100644
--- a/pkgs/development/python-modules/censys/default.nix
+++ b/pkgs/development/python-modules/censys/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "censys";
-  version = "2.2.5";
+  version = "2.2.6";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "censys";
     repo = "censys-python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-D25deUPMWc6KRlwytSfZqoPeJGmTV304slUP9gCyrUw=";
+    hash = "sha256-awe/6d6AryihS8vYCRtU8APbLUsqv9aKULBmjjaz3gM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/ckcc-protocol/default.nix b/pkgs/development/python-modules/ckcc-protocol/default.nix
index a298a166f9c8..e9654b0e67d5 100644
--- a/pkgs/development/python-modules/ckcc-protocol/default.nix
+++ b/pkgs/development/python-modules/ckcc-protocol/default.nix
@@ -10,24 +10,34 @@
 
 buildPythonPackage rec {
   pname = "ckcc-protocol";
-  version = "1.3.2";
+  version = "1.4.0";
+  format = "setuptools";
+
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-4y5pe0CFD3C1+N0kP/2j9Wser2zkn8Uf4203ci45Rq0=";
+    hash = "sha256-zZPU0+MwjqRYCqa+W0YTqCZv2WsMwa9R5xaN7ye77OU=";
   };
 
-  propagatedBuildInputs = [ click ecdsa hidapi pyaes ];
+  propagatedBuildInputs = [
+    click
+    ecdsa
+    hidapi
+    pyaes
+  ];
 
   # Project has no tests
   doCheck = false;
-  pythonImportsCheck = [ "ckcc" ];
+
+  pythonImportsCheck = [
+    "ckcc"
+  ];
 
   meta = with lib; {
     description = "Communicate with your Coldcard using Python";
     homepage = "https://github.com/Coldcard/ckcc-protocol";
     license = licenses.mit;
-    maintainers = [ maintainers.hkjn ];
+    maintainers = with maintainers; [ hkjn ];
   };
 }
diff --git a/pkgs/development/python-modules/minikerberos/default.nix b/pkgs/development/python-modules/minikerberos/default.nix
index d451c52283eb..d1c6a94d4787 100644
--- a/pkgs/development/python-modules/minikerberos/default.nix
+++ b/pkgs/development/python-modules/minikerberos/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "minikerberos";
-  version = "0.4.1";
+  version = "0.4.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-WgH+VQfPe//X03SoXwC817GCMlB5Zw37w9Ol58N5yVI=";
+    hash = "sha256-BECKWG5nxICOSfQJgXJqCki2gcv/ZRrDFo57nXHvhos=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pynetbox/default.nix b/pkgs/development/python-modules/pynetbox/default.nix
index b6de298bea56..c61063058a3d 100644
--- a/pkgs/development/python-modules/pynetbox/default.nix
+++ b/pkgs/development/python-modules/pynetbox/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "pynetbox";
-  version = "7.1.0";
+  version = "7.2.0";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "netbox-community";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-E79n4E386bSxDRzxcjCIvK0Z3r78HsFjGIXqjqQ1zyE=";
+    hash = "sha256-rYqwZIqcNeSpXsICL8WGLJ3Tcnwnnm6gvRBEJ/5iE/Q=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
diff --git a/pkgs/development/python-modules/rns/default.nix b/pkgs/development/python-modules/rns/default.nix
index 574af8aeecc9..bed7f75832d6 100644
--- a/pkgs/development/python-modules/rns/default.nix
+++ b/pkgs/development/python-modules/rns/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "rns";
-  version = "0.5.7";
+  version = "0.5.8";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "markqvist";
     repo = "Reticulum";
     rev = "refs/tags/${version}";
-    hash = "sha256-0WNgJKhxK4WjYQ0n7ofqrRxf4m9uWn2ygcZiv3uhrhM=";
+    hash = "sha256-6NGEXglo3J9Buz4Qm5tOHnXWvEf/NHSp2utfHZOPWT4=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/sentry-sdk/default.nix b/pkgs/development/python-modules/sentry-sdk/default.nix
index b3953486902e..cfa88e68230c 100644
--- a/pkgs/development/python-modules/sentry-sdk/default.nix
+++ b/pkgs/development/python-modules/sentry-sdk/default.nix
@@ -40,7 +40,7 @@
 
 buildPythonPackage rec {
   pname = "sentry-sdk";
-  version = "1.30.0";
+  version = "1.31.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -49,7 +49,7 @@ buildPythonPackage rec {
     owner = "getsentry";
     repo = "sentry-python";
     rev = "refs/tags/${version}";
-    hash = "sha256-bs2Eg9eq39/LeuAWyW8FlnPULRUvQXils7OFrAEIg0w=";
+    hash = "sha256-/TQwkk/NkQulYVuLIs30rV4hsv4LVB/VfPhqMjpq0vE=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/softlayer/default.nix b/pkgs/development/python-modules/softlayer/default.nix
index cd49c0cbc55c..d51ecb3d3e59 100644
--- a/pkgs/development/python-modules/softlayer/default.nix
+++ b/pkgs/development/python-modules/softlayer/default.nix
@@ -21,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "softlayer";
-  version = "6.1.7";
+  version = "6.1.8";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -30,7 +30,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = "softlayer-python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-WL/hv1/eB8/ynSo0XOTOYE2rGWV/4VsgSQsRioR2ACE=";
+    hash = "sha256-6LZ2vy6nkyWA7xbUl4aNi2ygRWDJTj7J9Af0GTvNLd4=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/tools/marksman/default.nix b/pkgs/development/tools/marksman/default.nix
index b40f5f2039f7..6e15d4aa6b6a 100644
--- a/pkgs/development/tools/marksman/default.nix
+++ b/pkgs/development/tools/marksman/default.nix
@@ -8,13 +8,13 @@
 
 buildDotnetModule rec {
   pname = "marksman";
-  version = "2023-03-04";
+  version = "2023-07-25";
 
   src = fetchFromGitHub {
     owner = "artempyanykh";
     repo = "marksman";
     rev = version;
-    sha256 = "sha256-jBZC2z1wtDMIssgRrKkZpl9NQ3XkRCcxo5eylwB2OBQ=";
+    sha256 = "sha256-DxubrZAj2MOF7gUMDl8rW1jGHaw70KGe5Nit1SBQBW8=";
   };
 
   projectFile = "Marksman/Marksman.fsproj";
@@ -25,8 +25,8 @@ buildDotnetModule rec {
 
   nugetDeps = ./deps.nix;
 
-  dotnet-sdk = dotnetCorePackages.sdk_6_0;
-  dotnet-runtime = dotnetCorePackages.runtime_6_0;
+  dotnet-sdk = dotnetCorePackages.sdk_7_0;
+  dotnet-runtime = dotnetCorePackages.runtime_7_0;
 
   postInstall = ''
     install -m 644 -D -t "$out/share/doc/${pname}" LICENSE
diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json
index ab62028af7bc..c024f03dd0c4 100644
--- a/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened/patches.json
@@ -32,12 +32,12 @@
     "5.15": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.15.130-hardened1.patch",
-            "sha256": "12wm6kyg63rg1lk1w9208vpcm71cjy236rjp9gf8mfx7iraqssl7",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.130-hardened1/linux-hardened-5.15.130-hardened1.patch"
+            "name": "linux-hardened-5.15.131-hardened1.patch",
+            "sha256": "06hy3v9r2rqnqxsby2204grzjcll64561m26wlnkyiz20gpl16n4",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.131-hardened1/linux-hardened-5.15.131-hardened1.patch"
         },
-        "sha256": "0qix62jsn3z9yccakac7fvqnip19zi05qn0w5wkgb7rj0x0lwimb",
-        "version": "5.15.130"
+        "sha256": "0sacnbw48lblnqaj56nybh588sq4k84gwf0r5zinzyrryj8k6z4r",
+        "version": "5.15.131"
     },
     "5.4": {
         "patch": {
@@ -52,21 +52,21 @@
     "6.1": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-6.1.51-hardened1.patch",
-            "sha256": "0nbf7j3hwlsvh8f4mmc9w2gqdcj8lyx1hxrz91y2hwlqlqjx7w4p",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.1.51-hardened1/linux-hardened-6.1.51-hardened1.patch"
+            "name": "linux-hardened-6.1.52-hardened1.patch",
+            "sha256": "1xp8m9d927g3nb8l6pc4xzm0yspxxa0kpiv6hi1x0cal5a1bwnb3",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.1.52-hardened1/linux-hardened-6.1.52-hardened1.patch"
         },
-        "sha256": "0fqhmb6v28rssd44z7jw57mwvvskpl4kabjylck0pg54irnl9c2q",
-        "version": "6.1.51"
+        "sha256": "0lis73mxnl7hxz8lyja6sfgmbym944l3k1h7dab6b4mw1nckfxsn",
+        "version": "6.1.52"
     },
     "6.4": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-6.4.14-hardened1.patch",
-            "sha256": "1cw0zyjxbfprb2m2kjrpz8s56axbzhnwj8hg9b0486nsqz5s66bs",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.4.14-hardened1/linux-hardened-6.4.14-hardened1.patch"
+            "name": "linux-hardened-6.4.15-hardened1.patch",
+            "sha256": "1r6c1yzr0cmfhqv0qirj9nbc2hgmmh43mwal1gmyhk5qisq7h1rf",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.4.15-hardened1/linux-hardened-6.4.15-hardened1.patch"
         },
-        "sha256": "1rjh0jrn5qvxwzmyg478n08vckkld8r52nkc102ppqvsfhiy7skm",
-        "version": "6.4.14"
+        "sha256": "1phlx375ln5pslw5vjqm029cdv6pzf4ang10xlrf90x5sb4fgy93",
+        "version": "6.4.15"
     }
 }
diff --git a/pkgs/os-specific/linux/kernel/linux-6.1.nix b/pkgs/os-specific/linux/kernel/linux-6.1.nix
index 9e14c7a6117e..a9de8074de49 100644
--- a/pkgs/os-specific/linux/kernel/linux-6.1.nix
+++ b/pkgs/os-specific/linux/kernel/linux-6.1.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "6.1.52";
+  version = "6.1.53";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v6.x/linux-${version}.tar.xz";
-    sha256 = "0lis73mxnl7hxz8lyja6sfgmbym944l3k1h7dab6b4mw1nckfxsn";
+    sha256 = "0zpdg3fcc12iyjhfs5w7cw75700z4i8m9jcg38mlzlhh92hf0msz";
   };
 } // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-6.4.nix b/pkgs/os-specific/linux/kernel/linux-6.4.nix
index b5d9d6451324..d41cd21fbef9 100644
--- a/pkgs/os-specific/linux/kernel/linux-6.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-6.4.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "6.4.15";
+  version = "6.4.16";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v6.x/linux-${version}.tar.xz";
-    sha256 = "1phlx375ln5pslw5vjqm029cdv6pzf4ang10xlrf90x5sb4fgy93";
+    sha256 = "0zgj1z97jyx7wf12zrnlcp0mj4cl43ais9qsy6dh1jwylf2fq9ln";
   };
 } // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-6.5.nix b/pkgs/os-specific/linux/kernel/linux-6.5.nix
index 341cc84be74d..614a07b66a28 100644
--- a/pkgs/os-specific/linux/kernel/linux-6.5.nix
+++ b/pkgs/os-specific/linux/kernel/linux-6.5.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "6.5.2";
+  version = "6.5.3";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v6.x/linux-${version}.tar.xz";
-    hash = "sha256-ICfhQFfVaK093BANrfTIhTpJsDEnBHimHYj2ARVyZQ8=";
+    hash = "sha256-TKwT97F72Nz5AyrWj5Ejq1MT1pjJ9ZQWBDFlFQdj608=";
   };
 } // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/zfs/generic.nix b/pkgs/os-specific/linux/zfs/generic.nix
index 347b4a299710..41aa909532fd 100644
--- a/pkgs/os-specific/linux/zfs/generic.nix
+++ b/pkgs/os-specific/linux/zfs/generic.nix
@@ -54,13 +54,7 @@ stdenv'.mkDerivation {
     inherit rev sha256;
   };
 
-  patches = [
-    (fetchpatch {
-      name = "musl.patch";
-      url = "https://github.com/openzfs/zfs/commit/1f19826c9ac85835cbde61a7439d9d1fefe43a4a.patch";
-      sha256 = "XEaK227ubfOwlB2s851UvZ6xp/QOtYUWYsKTkEHzmo0=";
-    })
-  ] ++ extraPatches;
+  patches = extraPatches;
 
   postPatch = optionalString buildKernel ''
     patchShebangs scripts
@@ -82,31 +76,22 @@ stdenv'.mkDerivation {
     substituteInPlace ./config/user-systemd.m4    --replace "/usr/lib/modules-load.d" "$out/etc/modules-load.d"
     substituteInPlace ./config/zfs-build.m4       --replace "\$sysconfdir/init.d"     "$out/etc/init.d" \
                                                   --replace "/etc/default"            "$out/etc/default"
-    substituteInPlace ./etc/zfs/Makefile.am       --replace "\$(sysconfdir)"          "$out/etc"
+    # TODO: drop when upgrading to 2.2.0
+    ${if isUnstable then ''
+      substituteInPlace ./contrib/initramfs/Makefile.am \
+        --replace "/usr/share/initramfs-tools" "$out/usr/share/initramfs-tools"
+      substituteInPlace ./udev/vdev_id \
+        --replace "PATH=/bin:/sbin:/usr/bin:/usr/sbin" \
+         "PATH=${makeBinPath [ coreutils gawk gnused gnugrep systemd ]}"
+    '' else ''
+      substituteInPlace ./etc/zfs/Makefile.am --replace "\$(sysconfdir)/zfs" "$out/etc/zfs"
 
-    substituteInPlace ./contrib/initramfs/hooks/Makefile.am \
-      --replace "/usr/share/initramfs-tools/hooks" "$out/usr/share/initramfs-tools/hooks"
-    substituteInPlace ./contrib/initramfs/Makefile.am \
-      --replace "/usr/share/initramfs-tools" "$out/usr/share/initramfs-tools"
-    substituteInPlace ./contrib/initramfs/scripts/Makefile.am \
-      --replace "/usr/share/initramfs-tools/scripts" "$out/usr/share/initramfs-tools/scripts"
-    substituteInPlace ./contrib/initramfs/scripts/local-top/Makefile.am \
-      --replace "/usr/share/initramfs-tools/scripts/local-top" "$out/usr/share/initramfs-tools/scripts/local-top"
-    substituteInPlace ./contrib/initramfs/scripts/Makefile.am \
-      --replace "/usr/share/initramfs-tools/scripts" "$out/usr/share/initramfs-tools/scripts"
-    substituteInPlace ./contrib/initramfs/scripts/local-top/Makefile.am \
-      --replace "/usr/share/initramfs-tools/scripts/local-top" "$out/usr/share/initramfs-tools/scripts/local-top"
-    substituteInPlace ./etc/systemd/system/Makefile.am \
-      --replace '$(DESTDIR)$(systemdunitdir)' "$out"'$(DESTDIR)$(systemdunitdir)'
+      find ./contrib/initramfs -name Makefile.am -exec sed -i -e 's|/usr/share/initramfs-tools|'$out'/share/initramfs-tools|g' {} \;
 
-    substituteInPlace ./contrib/initramfs/conf.d/Makefile.am \
-      --replace "/usr/share/initramfs-tools/conf.d" "$out/usr/share/initramfs-tools/conf.d"
-    substituteInPlace ./contrib/initramfs/conf-hooks.d/Makefile.am \
-      --replace "/usr/share/initramfs-tools/conf-hooks.d" "$out/usr/share/initramfs-tools/conf-hooks.d"
-
-    substituteInPlace ./cmd/vdev_id/vdev_id \
-      --replace "PATH=/bin:/sbin:/usr/bin:/usr/sbin" \
-      "PATH=${makeBinPath [ coreutils gawk gnused gnugrep systemd ]}"
+      substituteInPlace ./cmd/vdev_id/vdev_id \
+        --replace "PATH=/bin:/sbin:/usr/bin:/usr/sbin" \
+        "PATH=${makeBinPath [ coreutils gawk gnused gnugrep systemd ]}"
+    ''}
   '';
 
   nativeBuildInputs = [ autoreconfHook269 nukeReferences ]
@@ -168,10 +153,12 @@ stdenv'.mkDerivation {
     # Remove provided services as they are buggy
     rm $out/etc/systemd/system/zfs-import-*.service
 
-    sed -i '/zfs-import-scan.service/d' $out/etc/systemd/system/*
-
     for i in $out/etc/systemd/system/*; do
-    substituteInPlace $i --replace "zfs-import-cache.service" "zfs-import.target"
+       if [ -L $i ]; then
+         continue
+       fi
+       sed -i '/zfs-import-scan.service/d' $i
+       substituteInPlace $i --replace "zfs-import-cache.service" "zfs-import.target"
     done
 
     # Remove tests because they add a runtime dependency on gcc
@@ -232,3 +219,4 @@ stdenv'.mkDerivation {
     broken = buildKernel && (kernelCompatible != null) && !kernelCompatible;
   };
 }
+
diff --git a/pkgs/os-specific/linux/zfs/stable.nix b/pkgs/os-specific/linux/zfs/stable.nix
index 5680f93e21a0..14cda12e6f32 100644
--- a/pkgs/os-specific/linux/zfs/stable.nix
+++ b/pkgs/os-specific/linux/zfs/stable.nix
@@ -3,6 +3,7 @@
 , stdenv
 , linuxKernel
 , removeLinuxDRM ? false
+, fetchpatch
 , ...
 } @ args:
 
@@ -16,6 +17,13 @@ callPackage ./generic.nix args {
     then kernel.kernelOlder "6.4"
     else kernel.kernelOlder "6.2";
   latestCompatibleLinuxPackages = linuxKernel.packages.linux_6_1;
+  extraPatches = [
+    (fetchpatch {
+      name = "musl.patch";
+      url = "https://github.com/openzfs/zfs/commit/1f19826c9ac85835cbde61a7439d9d1fefe43a4a.patch";
+      sha256 = "XEaK227ubfOwlB2s851UvZ6xp/QOtYUWYsKTkEHzmo0=";
+    })
+  ];
 
   # this package should point to the latest release.
   version = "2.1.12";
diff --git a/pkgs/os-specific/linux/zfs/unstable.nix b/pkgs/os-specific/linux/zfs/unstable.nix
index 1bb882de7125..592d94b0030a 100644
--- a/pkgs/os-specific/linux/zfs/unstable.nix
+++ b/pkgs/os-specific/linux/zfs/unstable.nix
@@ -16,17 +16,16 @@ callPackage ./generic.nix args {
     else kernel.kernelOlder "6.2";
 
   latestCompatibleLinuxPackages = if stdenv'.isx86_64 || removeLinuxDRM
-    then linuxKernel.packages.linux_6_4
-    else linuxKernel.packages.linux_6_1;
+  then linuxKernel.packages.linux_6_4
+  else linuxKernel.packages.linux_6_1;
 
   # this package should point to a version / git revision compatible with the latest kernel release
   # IMPORTANT: Always use a tagged release candidate or commits from the
   # zfs-<version>-staging branch, because this is tested by the OpenZFS
   # maintainers.
-  version = "2.1.13-unstable-2023-08-02";
-  rev = "245850b66c1e93ec19744ca55aae143d007d2c32";
+  version = "2.2.0-rc4";
 
-  sha256 = "TtgKV02W8OfU6hssULF/IoFXAPHBTvTKXn5hJ/RGAc0=";
+  sha256 = "sha256-zTG6iujlWB2H8j6i+t59zdyztoDFk373AjgHzC8x5mQ=";
 
   isUnstable = true;
 }
diff --git a/pkgs/servers/computing/slurm/default.nix b/pkgs/servers/computing/slurm/default.nix
index fa71aefbd24a..19012ea1e1f9 100644
--- a/pkgs/servers/computing/slurm/default.nix
+++ b/pkgs/servers/computing/slurm/default.nix
@@ -14,7 +14,7 @@
 
 stdenv.mkDerivation rec {
   pname = "slurm";
-  version = "23.02.4.1";
+  version = "23.02.5.1";
 
   # N.B. We use github release tags instead of https://www.schedmd.com/downloads.php
   # because the latter does not keep older releases.
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
     repo = "slurm";
     # The release tags use - instead of .
     rev = "${pname}-${builtins.replaceStrings ["."] ["-"] version}";
-    sha256 = "sha256-sNZqC6F7Q05AqkKVVUG4mCO3JXRjVZBppt3VgRHf5+o=";
+    sha256 = "sha256-9VvZ8xySYFyBa5tZzf5WCShbEDpqE1/5t76jXX6t+bc=";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/servers/matrix-synapse/tools/synadm.nix b/pkgs/servers/matrix-synapse/tools/synadm.nix
index 0d7bd004f6bd..37023092a079 100644
--- a/pkgs/servers/matrix-synapse/tools/synadm.nix
+++ b/pkgs/servers/matrix-synapse/tools/synadm.nix
@@ -6,12 +6,12 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "synadm";
-  version = "0.42";
+  version = "0.43.1";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-nfKXg4q+fOH0IwenEQ7P5x+YgwaooWpjn0gWHxK6tcc=";
+    hash = "sha256-z8OXrra7+fptd4zs1gxJVGLR+SA8hoexK2qY9zpSowU=";
   };
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/servers/monitoring/telegraf/default.nix b/pkgs/servers/monitoring/telegraf/default.nix
index cfd723620cf9..52605250cff6 100644
--- a/pkgs/servers/monitoring/telegraf/default.nix
+++ b/pkgs/servers/monitoring/telegraf/default.nix
@@ -8,9 +8,7 @@
 
 buildGoModule rec {
   pname = "telegraf";
-  version = "1.27.4";
-
-  excludedPackages = "test";
+  version = "1.28.1";
 
   subPackages = [ "cmd/telegraf" ];
 
@@ -18,10 +16,10 @@ buildGoModule rec {
     owner = "influxdata";
     repo = "telegraf";
     rev = "v${version}";
-    hash = "sha256-HcNqvl8wWMMefrRl7cXgfE22+dzebhVmo7vKf0nEIyk=";
+    hash = "sha256-ag5Hk/LAHS2XDZ0MUAycLfDLr9awMl3T+5NoQGUIl/w=";
   };
 
-  vendorHash = "sha256-z1HNOVsSdA5bf0iZcAhbXgv/IaFpHjfoe7rqMtmscQM=";
+  vendorHash = "sha256-3hmYyUDlBPEcoM/1MhH6yoH/Kb21rITrAzy7APQpLqI=";
   proxyVendor = true;
 
   ldflags = [
diff --git a/pkgs/servers/plex/raw.nix b/pkgs/servers/plex/raw.nix
index 37bf7697481c..2f11a9a4e0ca 100644
--- a/pkgs/servers/plex/raw.nix
+++ b/pkgs/servers/plex/raw.nix
@@ -12,16 +12,16 @@
 # server, and the FHS userenv and corresponding NixOS module should
 # automatically pick up the changes.
 stdenv.mkDerivation rec {
-  version = "1.32.5.7349-8f4248874";
+  version = "1.32.6.7468-07e0d4a7e";
   pname = "plexmediaserver";
 
   # Fetch the source
   src = if stdenv.hostPlatform.system == "aarch64-linux" then fetchurl {
     url = "https://downloads.plex.tv/plex-media-server-new/${version}/debian/plexmediaserver_${version}_arm64.deb";
-    sha256 = "18j98za5498v02asyyz2sakbl4inyxd6jsa4bjz8zm2jb1knk236";
+    sha256 = "01sdhm307zsnsj893qch9h2yc07y7yijz5j0y4p223v29picr3h6";
   } else fetchurl {
     url = "https://downloads.plex.tv/plex-media-server-new/${version}/debian/plexmediaserver_${version}_amd64.deb";
-    sha256 = "0gm9i752fbplw1l0xlrhzpif5fjiwx471hv55bwbs3ywz3hp0jnb";
+    sha256 = "066hfidm25830xljj3ygq6vr142v2n4z3w94wnxfhxv2mx5fxall";
   };
 
   outputs = [ "out" "basedb" ];
diff --git a/pkgs/tools/games/minecraft/packwiz/default.nix b/pkgs/tools/games/minecraft/packwiz/default.nix
index 15c103f7396c..11d4774f0150 100644
--- a/pkgs/tools/games/minecraft/packwiz/default.nix
+++ b/pkgs/tools/games/minecraft/packwiz/default.nix
@@ -4,15 +4,15 @@
 , installShellFiles
 }:
 
-buildGoModule rec {
+buildGoModule {
   pname = "packwiz";
-  version = "unstable-2023-02-13";
+  version = "unstable-2023-08-28";
 
   src = fetchFromGitHub {
     owner = "packwiz";
     repo = "packwiz";
-    rev = "4b336e46e277d4b252c11f43080576dc23b001d2";
-    sha256 = "sha256-f6560XrnriKNq89aOxfJjN4mDdtYzMSOUlRWwItLuHk=";
+    rev = "b451a9b034fd414a2a8d9b306bb8e29fb25ad245";
+    sha256 = "sha256-Ly5z+h11yyhIgzhohjk2g8hQNEPkxxag9m7XYmTMfEQ=";
   };
 
   vendorHash = "sha256-yL5pWbVqf6mEpgYsItLnv8nwSmoMP+SE0rX/s7u2vCg=";
diff --git a/pkgs/tools/networking/connman/connman/default.nix b/pkgs/tools/networking/connman/connman/default.nix
index 3143818bac3c..7697a8efad89 100644
--- a/pkgs/tools/networking/connman/connman/default.nix
+++ b/pkgs/tools/networking/connman/connman/default.nix
@@ -71,7 +71,7 @@ stdenv.mkDerivation rec {
     ./create-libppp-compat.h.patch
   ] ++ optionals stdenv.hostPlatform.isMusl [
     # Fix Musl build by avoiding a Glibc-only API.
-    (fetchpatch {
+    (fetchurl {
       url = "https://git.alpinelinux.org/aports/plain/community/connman/libresolv.patch?id=e393ea84386878cbde3cccadd36a30396e357d1e";
       hash = "sha256-7Q1bp8rD/gGVYUqnIXqjr9vypR8jlC926p3KYWl9kLw=";
     })
diff --git a/pkgs/tools/security/katana/default.nix b/pkgs/tools/security/katana/default.nix
index a8f065e4d65b..04ae5c74ad1b 100644
--- a/pkgs/tools/security/katana/default.nix
+++ b/pkgs/tools/security/katana/default.nix
@@ -5,18 +5,16 @@
 
 buildGoModule rec {
   pname = "katana";
-  version = "1.0.3";
+  version = "1.0.4";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-0OXpA+sa97YjbHhIq3Uj65OWg53PH9y2cY8bjCqC3tQ=";
+    hash = "sha256-wpGRpgRJtywkTJ3YBk5TzXc2taPPWjOhj+Kg8hAgm7M=";
   };
 
-  vendorHash = "sha256-rb0fNAOP4y2yvJb7FIlAIfXF0uw0eLKgup75f9cwT6U=";
-
-  CGO_ENABLED = 0;
+  vendorHash = "sha256-qqivaKipe7lfUq3Neod8JMvtMVQN4O03JpDMSMHf8YY=";
 
   subPackages = [ "cmd/katana" ];
 
diff --git a/pkgs/tools/security/proxmark3/default.nix b/pkgs/tools/security/proxmark3/default.nix
index 48d0d4a0ee14..a6c59919e28f 100644
--- a/pkgs/tools/security/proxmark3/default.nix
+++ b/pkgs/tools/security/proxmark3/default.nix
@@ -9,6 +9,7 @@
 , jansson
 , whereami
 , lua
+, lz4
 , Foundation
 , AppKit
 , withGui ? true, wrapQtAppsHook, qtbase
@@ -24,13 +25,13 @@
 assert withBlueshark -> stdenv.hostPlatform.isLinux;
 stdenv.mkDerivation rec {
   pname = "proxmark3";
-  version = "4.16717";
+  version = "4.17140";
 
   src = fetchFromGitHub {
     owner = "RfidResearchGroup";
     repo = "proxmark3";
     rev = "v${version}";
-    sha256 = "sha256-rkfVgT+9fqlWvUXzLH28Nzd8HldJnU+IZz8conY8Mis=";
+    hash = "sha256-l66syIpTM4P0733eJKEjnEYHvQlIc7KKxXLcc7XBnHE=";
   };
 
   patches = [
@@ -58,6 +59,7 @@ stdenv.mkDerivation rec {
     bzip2
     openssl
     jansson
+    lz4
     whereami
     lua
   ] ++ lib.optional withGui qtbase
diff --git a/pkgs/tools/security/vault/default.nix b/pkgs/tools/security/vault/default.nix
index b793d43b1e1c..792cd4771866 100644
--- a/pkgs/tools/security/vault/default.nix
+++ b/pkgs/tools/security/vault/default.nix
@@ -47,6 +47,7 @@ buildGoModule rec {
     description = "A tool for managing secrets";
     changelog = "https://github.com/hashicorp/vault/blob/v${version}/CHANGELOG.md";
     license = licenses.mpl20;
+    mainProgram = "vault";
     maintainers = with maintainers; [ rushmorem lnl7 offline pradeepchhetri Chili-Man techknowlogick ];
   };
 }
diff --git a/pkgs/tools/typesetting/tex/catdvi/default.nix b/pkgs/tools/typesetting/tex/catdvi/default.nix
new file mode 100644
index 000000000000..ea2b49423f22
--- /dev/null
+++ b/pkgs/tools/typesetting/tex/catdvi/default.nix
@@ -0,0 +1,87 @@
+{ stdenv
+, lib
+, fetchurl
+, fetchpatch
+, texlive
+, buildPackages
+}:
+
+let
+  buildPlatformTools = [ "pse2unic" "adobe2h" ];
+  tex = texlive.combine {
+    inherit (texlive) collection-fontsrecommended;
+  };
+in
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "catdvi";
+  version = "0.14";
+  src = fetchurl {
+    url = with finalAttrs; "http://downloads.sourceforge.net/${pname}/${pname}-${version}.tar.bz2";
+    hash = "sha256-orVQVdQuRXp//OGkA7xRidNi4+J+tkw398LPZ+HX+k8=";
+  };
+
+  patches = [
+    # fix error: conflicting types for 'kpathsea_version_string'; have 'char *'
+    (fetchpatch {
+      url = "https://sources.debian.org/data/main/c/catdvi/0.14-14/debian/patches/03_kpathsea_version_string_declaration.diff";
+      hash = "sha256-d3CPDxXdVVLNtKkN0rC2G02dh/bJrRll/nVzQNggwkk=";
+    })
+  ];
+
+  hardeningDisable = [ "format" ];
+
+  outputs = [ "out" ] ++ lib.optional (with stdenv; buildPlatform.canExecute hostPlatform) "dev";
+
+  setOutputFlags = false;
+
+  enableParallelBuilding = true;
+
+  preBuild = lib.optionalString (with stdenv; !buildPlatform.canExecute hostPlatform)
+    (lib.concatMapStringsSep "\n" (tool: ''
+      cp ${lib.getDev buildPackages.catdvi}/bin/${tool} .
+    '') buildPlatformTools);
+
+  nativeBuildInputs = [
+    texlive.bin.core
+    texlive.bin.core.dev
+  ];
+
+  buildInputs = [
+    tex
+  ];
+
+  makeFlags = [
+    "catdvi"  # to avoid running tests until checkPhase
+  ] ++ lib.optionals (with stdenv; !buildPlatform.canExecute hostPlatform)
+    (map (tool: "--assume-old=${tool}") buildPlatformTools);
+
+  nativeCheckInputs = [
+    texlive
+  ];
+
+  testFlags = [
+    "all1"
+  ];
+
+  preInstall = ''
+    mkdir -p $out/{bin,man/man1}
+  '';
+
+  postInstall = lib.optionalString (with stdenv; buildPlatform.canExecute hostPlatform) ''
+    mkdir -p $dev/bin
+    ${lib.concatMapStringsSep "\n" (tool: ''
+      cp ${tool} $dev/bin/
+    '') buildPlatformTools}
+  '' + ''
+    mkdir -p $out/share
+    ln -s ${tex}/share/texmf-var $out/share/texmf
+  '';
+
+  meta = with lib; {
+    homepage = "http://catdvi.sourceforge.net";
+    description = "A DVI to plain text translator";
+    license = licenses.gpl2;
+    maintainers = [ ];
+  };
+})
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 686ba1153771..e201b1d4e946 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -5391,6 +5391,8 @@ with pkgs;
 
   blahtexml = callPackage ../tools/typesetting/tex/blahtexml { };
 
+  catdvi = callPackage ../tools/typesetting/tex/catdvi { };
+
   dblatex = callPackage ../tools/typesetting/tex/dblatex { };
 
   dblatexFull = dblatex.override { enableAllFeatures = true; };
@@ -20395,7 +20397,7 @@ with pkgs;
 
   symfony-cli = callPackage ../development/tools/symfony-cli { };
 
-  swiftshader = callPackage ../development/libraries/swiftshader { stdenv = gcc10StdenvCompat; };
+  swiftshader = callPackage ../development/libraries/swiftshader { };
 
   systemfd = callPackage ../development/tools/systemfd { };