diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 207f3e26e534..0de9af111070 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -3663,6 +3663,12 @@
     github = "Dettorer";
     githubId = 2761682;
   };
+  developer-guy = {
+    name = "Batuhan Apaydın";
+    email = "developerguyn@gmail.com";
+    github = "developer-guy";
+    githubId = 16693043;
+  };
   devhell = {
     email = ''"^"@regexmail.net'';
     github = "devhell";
@@ -10137,6 +10143,12 @@
     githubId = 3073833;
     name = "Massimo Redaelli";
   };
+  mrfreezeex = {
+    email = "arthur@cri.epita.fr";
+    github = "MrFreezeex";
+    name = "Arthur Outhenin-Chalandre";
+    githubId = 14573967;
+  };
   mrityunjaygr8 = {
     email = "mrityunjaysaxena1996@gmail.com";
     github = "mrityunjaygr8";
diff --git a/nixos/doc/manual/release-notes/rl-2305.section.md b/nixos/doc/manual/release-notes/rl-2305.section.md
index 6b9bb06fedc9..2eaedf852098 100644
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@@ -117,6 +117,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - The [services.wordpress.sites.<name>.plugins](#opt-services.wordpress.sites._name_.plugins) and [services.wordpress.sites.<name>.themes](#opt-services.wordpress.sites._name_.themes) options have been converted from sets to attribute sets to allow for consumers to specify explicit install paths via attribute name.
 
+- `protonmail-bridge` package has been updated to v3.0 and the CLI executable is now named bridge instead of protonmail-bridge to be more in line with upstream.
+
 - Nebula now runs as a system user and group created for each nebula network, using the `CAP_NET_ADMIN` ambient capability on launch rather than starting as root. Ensure that any files each Nebula instance needs to access are owned by the correct user and group, by default `nebula-${networkName}`.
 
 - In `mastodon` it is now necessary to specify location of file with `PostgreSQL` database password. In `services.mastodon.database.passwordFile` parameter default value `/var/lib/mastodon/secrets/db-password` has been changed to `null`.
@@ -257,6 +259,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - The `unifi-poller` package and corresponding NixOS module have been renamed to `unpoller` to match upstream.
 
+- `protonmail-bridge` package has been updated to v3.0 and the CLI executable is now named bridge instead of protonmail-bridge to be more in line with upstream.
+
 - The new option `services.tailscale.useRoutingFeatures` controls various settings for using Tailscale features like exit nodes and subnet routers. If you wish to use your machine as an exit node, you can set this setting to `server`, otherwise if you wish to use an exit node you can set this setting to `client`. The strict RPF warning has been removed as the RPF will be loosened automatically based on the value of this setting.
 
 - `openjdk` from version 11 and above is not build with `openjfx` (i.e.: JavaFX) support by default anymore. You can re-enable it by overriding, e.g.: `openjdk11.override { enableJavaFX = true; };`.
diff --git a/nixos/modules/installer/tools/nix-fallback-paths.nix b/nixos/modules/installer/tools/nix-fallback-paths.nix
index c9cb65dbbe5a..1058a34133b1 100644
--- a/nixos/modules/installer/tools/nix-fallback-paths.nix
+++ b/nixos/modules/installer/tools/nix-fallback-paths.nix
@@ -1,7 +1,7 @@
 {
-  x86_64-linux = "/nix/store/lsr79q5xqd9dv97wn87x12kzax8s8i1s-nix-2.13.2";
-  i686-linux = "/nix/store/wky9xjwiwzpifgk0s3f2nrg8nr67bi7x-nix-2.13.2";
-  aarch64-linux = "/nix/store/v8drr3x1ia6bdr8y4vl79mlz61xynrpm-nix-2.13.2";
-  x86_64-darwin = "/nix/store/1l14si31p4aw7c1gwgjy0nq55k38j9nj-nix-2.13.2";
-  aarch64-darwin = "/nix/store/6x7nr1r780fgn254zhkwhih3f3i8cr45-nix-2.13.2";
+  x86_64-linux = "/nix/store/mc43d38fibi94pp5crfwacl5gbslccd0-nix-2.13.3";
+  i686-linux = "/nix/store/09m966pj26cgd4ihlg8ihl1106j3vih8-nix-2.13.3";
+  aarch64-linux = "/nix/store/7f191d125akld27gc6jl0r13l8pl7x0h-nix-2.13.3";
+  x86_64-darwin = "/nix/store/1wn9jkvi2zqfjnjgg7lnp30r2q2y8whd-nix-2.13.3";
+  aarch64-darwin = "/nix/store/8w0v2mffa10chrf1h66cbvbpw86qmh85-nix-2.13.3";
 }
diff --git a/nixos/modules/misc/ids.nix b/nixos/modules/misc/ids.nix
index 108ab5d4f318..17ea04cb4ecb 100644
--- a/nixos/modules/misc/ids.nix
+++ b/nixos/modules/misc/ids.nix
@@ -392,7 +392,7 @@ in
       tape = 25;
       video = 26;
       dialout = 27;
-      polkituser = 28;
+      #polkituser = 28; # currently unused, polkitd doesn't need a group
       utmp = 29;
       # ddclient = 30; # converted to DynamicUser = true
       davfs2 = 31;
@@ -510,7 +510,6 @@ in
       #seeks = 148; # removed 2020-06-21
       prosody = 149;
       i2pd = 150;
-      systemd-coredump = 151;
       systemd-network = 152;
       systemd-resolve = 153;
       systemd-timesync = 154;
diff --git a/nixos/modules/security/polkit.nix b/nixos/modules/security/polkit.nix
index 1b6594802277..de427ccb295b 100644
--- a/nixos/modules/security/polkit.nix
+++ b/nixos/modules/security/polkit.nix
@@ -113,9 +113,7 @@ in
       group = "polkituser";
     };
 
-    users.groups.polkituser = {
-      gid = mkIf (lib.versionAtLeast config.system.stateVersion "23.05") config.ids.gids.polkituser;
-    };
+    users.groups.polkituser = {};
   };
 
 }
diff --git a/nixos/modules/services/continuous-integration/gitlab-runner.nix b/nixos/modules/services/continuous-integration/gitlab-runner.nix
index 6b44d39c224e..53f39f40daa5 100644
--- a/nixos/modules/services/continuous-integration/gitlab-runner.nix
+++ b/nixos/modules/services/continuous-integration/gitlab-runner.nix
@@ -577,7 +577,7 @@ in {
       };
     };
     # Enable periodic clear-docker-cache script
-    systemd.services.gitlab-runner-clear-docker-cache = {
+    systemd.services.gitlab-runner-clear-docker-cache = mkIf (cfg.clear-docker-cache.enable && (any (s: s.executor == "docker") (attrValues cfg.services))) {
       description = "Prune gitlab-runner docker resources";
       restartIfChanged = false;
       unitConfig.X-StopOnRemoval = false;
@@ -590,7 +590,7 @@ in {
         ${pkgs.gitlab-runner}/bin/clear-docker-cache ${toString cfg.clear-docker-cache.flags}
       '';
 
-      startAt = optional cfg.clear-docker-cache.enable cfg.clear-docker-cache.dates;
+      startAt = cfg.clear-docker-cache.dates;
     };
     # Enable docker if `docker` executor is used in any service
     virtualisation.docker.enable = mkIf (
diff --git a/nixos/modules/services/mail/postfix.nix b/nixos/modules/services/mail/postfix.nix
index d01734d61e87..852340c05aa7 100644
--- a/nixos/modules/services/mail/postfix.nix
+++ b/nixos/modules/services/mail/postfix.nix
@@ -809,7 +809,7 @@ in
       // optionalAttrs (cfg.relayHost != "") { relayhost = if cfg.lookupMX
                                                            then "${cfg.relayHost}:${toString cfg.relayPort}"
                                                            else "[${cfg.relayHost}]:${toString cfg.relayPort}"; }
-      // optionalAttrs config.networking.enableIPv6 { inet_protocols = mkDefault "all"; }
+      // optionalAttrs (!config.networking.enableIPv6) { inet_protocols = mkDefault "ipv4"; }
       // optionalAttrs (cfg.networks != null) { mynetworks = cfg.networks; }
       // optionalAttrs (cfg.networksStyle != "") { mynetworks_style = cfg.networksStyle; }
       // optionalAttrs (cfg.hostname != "") { myhostname = cfg.hostname; }
diff --git a/nixos/modules/system/boot/systemd/coredump.nix b/nixos/modules/system/boot/systemd/coredump.nix
index deaaba9bbf85..03ef00e5683c 100644
--- a/nixos/modules/system/boot/systemd/coredump.nix
+++ b/nixos/modules/system/boot/systemd/coredump.nix
@@ -66,9 +66,7 @@ in {
         uid = config.ids.uids.systemd-coredump;
         group = "systemd-coredump";
       };
-      users.groups.systemd-coredump = {
-        gid = mkIf (lib.versionAtLeast config.system.stateVersion "23.05") config.ids.gids.systemd-coredump;
-      };
+      users.groups.systemd-coredump = {};
     })
 
     (mkIf (!cfg.enable) {
diff --git a/nixos/modules/system/boot/systemd/initrd.nix b/nixos/modules/system/boot/systemd/initrd.nix
index 0c78eec8fde0..f937581b76f6 100644
--- a/nixos/modules/system/boot/systemd/initrd.nix
+++ b/nixos/modules/system/boot/systemd/initrd.nix
@@ -118,7 +118,7 @@ let
     name = "initrd-bin-env";
     paths = map getBin cfg.initrdBin;
     pathsToLink = ["/bin" "/sbin"];
-    postBuild = concatStringsSep "\n" (mapAttrsToList (n: v: "ln -s '${v}' $out/bin/'${n}'") cfg.extraBin);
+    postBuild = concatStringsSep "\n" (mapAttrsToList (n: v: "ln -sf '${v}' $out/bin/'${n}'") cfg.extraBin);
   };
 
   initialRamdisk = pkgs.makeInitrdNG {
diff --git a/nixos/tests/haproxy.nix b/nixos/tests/haproxy.nix
index b6ff4102fe68..555474d7f299 100644
--- a/nixos/tests/haproxy.nix
+++ b/nixos/tests/haproxy.nix
@@ -2,7 +2,6 @@ import ./make-test-python.nix ({ pkgs, ...}: {
   name = "haproxy";
   nodes = {
     machine = { ... }: {
-      imports = [ ../modules/profiles/minimal.nix ];
       services.haproxy = {
         enable = true;
         config = ''
diff --git a/pkgs/applications/audio/furnace/default.nix b/pkgs/applications/audio/furnace/default.nix
index e0298d8f9365..372a873ca580 100644
--- a/pkgs/applications/audio/furnace/default.nix
+++ b/pkgs/applications/audio/furnace/default.nix
@@ -21,14 +21,14 @@
 
 stdenv.mkDerivation rec {
   pname = "furnace";
-  version = "0.6pre3";
+  version = "0.6pre4-hotfix";
 
   src = fetchFromGitHub {
     owner = "tildearrow";
     repo = "furnace";
     rev = "v${version}";
     fetchSubmodules = true;
-    sha256 = "sha256-bHVeTw69k6LLcrfkmGxvjlFfR/hWiCfm/P3utknid1o=";
+    sha256 = "sha256-lJtV/0GnWN5mSjv2LaPEMnkuThaNeijBMjLGFPOJX4k=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/blockchains/lighthouse/default.nix b/pkgs/applications/blockchains/lighthouse/default.nix
index 5eddf7c1b4ef..78c503e7ee5c 100644
--- a/pkgs/applications/blockchains/lighthouse/default.nix
+++ b/pkgs/applications/blockchains/lighthouse/default.nix
@@ -20,7 +20,7 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "lighthouse";
-  version = "3.4.0";
+  version = "3.5.0";
 
   # lighthouse/common/deposit_contract/build.rs
   depositContractSpecVersion = "0.12.1";
@@ -30,10 +30,10 @@ rustPlatform.buildRustPackage rec {
     owner = "sigp";
     repo = "lighthouse";
     rev = "v${version}";
-    hash = "sha256-4auiM5+kj/HjZKu2YP7JEnwDNxHuL39XCfmV/dc5jLE=";
+    hash = "sha256-09EQr/ghgdcnek0dih0+TXyIh5qwGWmg+nhI8d9n3Jc=";
   };
 
-  cargoHash = "sha256-ihfGwdxL7Ttw86dhaVBp5meb0caXjzgbbP27Io8zv/c=";
+  cargoHash = "sha256-NWG3yIgxfD1GkiQ6TyZF4lNPy9s/i/9TaTujlOtx2NI=";
 
   buildFeatures = [ "modern" "gnosis" ];
 
diff --git a/pkgs/applications/graphics/foxotron/default.nix b/pkgs/applications/graphics/foxotron/default.nix
index 5f28236b54ea..b16025e8829c 100644
--- a/pkgs/applications/graphics/foxotron/default.nix
+++ b/pkgs/applications/graphics/foxotron/default.nix
@@ -25,14 +25,14 @@
 
 stdenv.mkDerivation rec {
   pname = "foxotron";
-  version = "2022-11-02";
+  version = "2023-02-23";
 
   src = fetchFromGitHub {
     owner = "Gargaj";
     repo = "Foxotron";
     rev = version;
     fetchSubmodules = true;
-    sha256 = "sha256-WjsVvFhwVCzclHxA+Gu2YtR2yK0Opqhncwlg9FEhOLk=";
+    sha256 = "sha256-sPIXLZdtVK3phfMsZrU8o9qisOC5RKvHH19ECXMV0t0=";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/misc/jotta-cli/default.nix b/pkgs/applications/misc/jotta-cli/default.nix
index 34ee81a2dd04..28451b3c2e4f 100644
--- a/pkgs/applications/misc/jotta-cli/default.nix
+++ b/pkgs/applications/misc/jotta-cli/default.nix
@@ -5,10 +5,10 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "jotta-cli";
-  version = "0.14.60923";
+  version = "0.15.75988";
   src = fetchzip {
       url = "https://repo.jotta.us/archives/linux/${arch}/jotta-cli-${version}_linux_${arch}.tar.gz";
-      sha256 = "sha256-9R2eml0MpOZQn8SIs8gN1d1ddQdKmTsPBEWqHCvW8yo=";
+      sha256 = "sha256-8ldr5FPbnNBlQb4YEbieIu3ZAjCzk5+MKdekq4dsNhc=";
       stripRoot = false;
     };
 
diff --git a/pkgs/applications/misc/qcad/default.nix b/pkgs/applications/misc/qcad/default.nix
index dcf941cf03aa..c630ce06b59b 100644
--- a/pkgs/applications/misc/qcad/default.nix
+++ b/pkgs/applications/misc/qcad/default.nix
@@ -18,14 +18,14 @@
 
 mkDerivation rec {
   pname = "qcad";
-  version = "3.27.8.7";
+  version = "3.27.9.2";
 
   src = fetchFromGitHub {
     name = "qcad-${version}-src";
     owner = "qcad";
     repo = "qcad";
     rev = "v${version}";
-    sha256 = "sha256-GWDDZzFDOR96ZpmNDUuE+S9zTMVSYFNJKp8z/Cx3hec=";
+    sha256 = "sha256-RpyckKXU8WN/bptKp6G5gNVSU3RzNFYnM0eWLf3E2Yg=";
   };
 
   patches = [
diff --git a/pkgs/applications/misc/thedesk/default.nix b/pkgs/applications/misc/thedesk/default.nix
index 1fb2912d64d2..8e4a671c4a64 100644
--- a/pkgs/applications/misc/thedesk/default.nix
+++ b/pkgs/applications/misc/thedesk/default.nix
@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   pname = "thedesk";
-  version = "24.0.8";
+  version = "24.0.10";
 
   src = fetchurl {
     url = "https://github.com/cutls/TheDesk/releases/download/v${version}/${pname}_${version}_amd64.deb";
-    sha256 = "sha256-nxwSJ/rQJYMNrtTWSmqcrJQwMK8zRwIG4jccVyb7OsQ=";
+    sha256 = "sha256-0ZXI3KyRgRHUcRiSNn5a4eSy5Kgcl9HAsP79J2L/vW0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/zine/default.nix b/pkgs/applications/misc/zine/default.nix
index 2946b226155e..9034d6d2f6a5 100644
--- a/pkgs/applications/misc/zine/default.nix
+++ b/pkgs/applications/misc/zine/default.nix
@@ -10,14 +10,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "zine";
-  version = "0.11.0";
+  version = "0.11.1";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-koN30s+giX4wOp4i5QtTLE/t1ZJ9mP0K0YfY0kTuDJY=";
+    sha256 = "sha256-iva66tN7pMW0LAvhTbL0Tmsvsdq1+96VciTlaNoVywI=";
   };
 
-  cargoHash = "sha256-Re/ooEJCRjQSnz1VSzz4uRWx81yOzChBEeH7gedAHJw=";
+  cargoHash = "sha256-xAA11Og5odn8eNbFNKiRUqLG/MLWPw1WSeNR9zGHs0U=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/applications/networking/browsers/google-chrome/default.nix b/pkgs/applications/networking/browsers/google-chrome/default.nix
index 208bff18e1f2..cd770b18b71a 100644
--- a/pkgs/applications/networking/browsers/google-chrome/default.nix
+++ b/pkgs/applications/networking/browsers/google-chrome/default.nix
@@ -4,7 +4,7 @@
 , glib, fontconfig, freetype, pango, cairo, libX11, libXi, atk, nss, nspr
 , libXcursor, libXext, libXfixes, libXrender, libXScrnSaver, libXcomposite, libxcb
 , alsa-lib, libXdamage, libXtst, libXrandr, libxshmfence, expat, cups
-, dbus, gtk3, gdk-pixbuf, gcc-unwrapped, at-spi2-atk, at-spi2-core
+, dbus, gtk3, gtk4, gdk-pixbuf, gcc-unwrapped, at-spi2-atk, at-spi2-core
 , libkrb5, libdrm, libglvnd, mesa
 , libxkbcommon, pipewire, wayland # ozone/wayland
 
@@ -68,7 +68,7 @@ let
     libxkbcommon pipewire wayland
   ] ++ lib.optional pulseSupport libpulseaudio
     ++ lib.optional libvaSupport libva
-    ++ [ gtk3 ];
+    ++ [ gtk3 gtk4 ];
 
   suffix = lib.optionalString (channel != "stable") "-${channel}";
 
diff --git a/pkgs/applications/networking/clash-verge/default.nix b/pkgs/applications/networking/clash-verge/default.nix
new file mode 100644
index 000000000000..96c3a5a2f25f
--- /dev/null
+++ b/pkgs/applications/networking/clash-verge/default.nix
@@ -0,0 +1,60 @@
+{ lib
+, stdenv
+, fetchurl
+, dpkg
+, wrapGAppsHook
+, autoPatchelfHook
+, openssl
+, webkitgtk
+, udev
+, libappindicator-gtk3
+, libayatana-appindicator
+}:
+
+stdenv.mkDerivation rec {
+  pname = "clash-verge";
+  version = "1.2.3";
+
+  src = fetchurl {
+    url = "https://github.com/zzzgydi/clash-verge/releases/download/v${version}/clash-verge_${version}_amd64.deb";
+    hash = "sha256-uiw9kcXJ4ZEu+naUbUrgN/zBYE2bSWVPmMQ+HiAP4D4=";
+  };
+
+  unpackPhase = "dpkg-deb -x $src .";
+
+  nativeBuildInputs = [
+    dpkg
+    wrapGAppsHook
+    autoPatchelfHook
+  ];
+
+  buildInputs = [
+    openssl
+    webkitgtk
+    stdenv.cc.cc
+  ];
+
+  runtimeDependencies = [
+    (lib.getLib udev)
+    libappindicator-gtk3
+    libayatana-appindicator
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    mv usr/* $out
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "A Clash GUI based on tauri";
+    homepage = "https://github.com/zzzgydi/clash-verge";
+    platforms = [ "x86_64-linux" ];
+    license = licenses.gpl3Plus;
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+    maintainers = with maintainers; [ zendo ];
+  };
+}
diff --git a/pkgs/applications/networking/cluster/pv-migrate/default.nix b/pkgs/applications/networking/cluster/pv-migrate/default.nix
index 0ebb08337ccf..73fb42ee373b 100644
--- a/pkgs/applications/networking/cluster/pv-migrate/default.nix
+++ b/pkgs/applications/networking/cluster/pv-migrate/default.nix
@@ -2,18 +2,18 @@
 
 buildGoModule rec {
   pname = "pv-migrate";
-  version = "1.0.1";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "utkuozdemir";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-I66J1/N8Ln7KBQfzg39wdZuM6PeJGn1HiNK2YVzDySw";
+    sha256 = "sha256-M+M2tK40d05AxBmTjYKv5rrebX7g+Za8KX+/Q3aVLwE=";
   };
 
   subPackages = [ "cmd/pv-migrate" ];
 
-  vendorSha256 = "sha256-/klqOfM0ZhbzZWOLm0pA0/RB84kvfEzFJN1OQUVSNEA";
+  vendorHash = "sha256-3uqN6RmkctlE4GuYZQbY6wbHyPBJP15O4Bm0kTtW8qo=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/applications/networking/instant-messengers/zoom-us/default.nix b/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
index cb132610d0c2..5bd11cff90ea 100644
--- a/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
+++ b/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
@@ -50,7 +50,7 @@ let
   # find where to edit them.
   versions.aarch64-darwin = "5.13.7.15481";
   versions.x86_64-darwin = "5.13.7.15481";
-  versions.x86_64-linux = "5.13.7.683";
+  versions.x86_64-linux = "5.13.10.1208";
 
   srcs = {
     aarch64-darwin = fetchurl {
@@ -64,7 +64,7 @@ let
     };
     x86_64-linux = fetchurl {
       url = "https://zoom.us/client/${versions.x86_64-linux}/zoom_x86_64.pkg.tar.xz";
-      hash = "sha256-1aA3W9eXYhjxr39PoTSAVG7mToFInF7uz8MCiJhk/10=";
+      hash = "sha256-GmDWb7HRpf5khA5DAGOD5lx5zSzOdDfTvmcOU/LwN+A=";
     };
   };
 
diff --git a/pkgs/applications/networking/kubo-migrator/all-migrations.nix b/pkgs/applications/networking/kubo-migrator/all-migrations.nix
index a9197c9db5fb..08a9967de4a0 100644
--- a/pkgs/applications/networking/kubo-migrator/all-migrations.nix
+++ b/pkgs/applications/networking/kubo-migrator/all-migrations.nix
@@ -15,6 +15,19 @@ let
     inherit (kubo-migrator-unwrapped) src;
     sourceRoot = "source/${pname}";
     vendorSha256 = null;
+    # Fix build on Go 1.17 and later: panic: qtls.ClientHelloInfo doesn't match
+    # See https://github.com/ipfs/fs-repo-migrations/pull/163
+    postPatch = lib.optionalString (lib.elem pname [ "fs-repo-10-to-11" "fs-repo-11-to-12" ]) ''
+      substituteInPlace 'vendor/github.com/marten-seemann/qtls-go1-15/common.go' \
+        --replace \
+          '"container/list"' \
+          '"container/list"
+          "context"' \
+        --replace \
+          'config *Config' \
+          'config *Config
+          ctx context.Context'
+    '';
     doCheck = false;
     meta = kubo-migrator-unwrapped.meta // {
       mainProgram = pname;
@@ -23,8 +36,9 @@ let
   };
 
   # Concatenation of the latest repo version and the version of that migration
-  version = "12.1.0.2";
+  version = "13.1.0.0";
 
+  fs-repo-12-to-13 = fs-repo-common "fs-repo-12-to-13" "1.0.0";
   fs-repo-11-to-12 = fs-repo-common "fs-repo-11-to-12" "1.0.2";
   fs-repo-10-to-11 = fs-repo-common "fs-repo-10-to-11" "1.0.1";
   fs-repo-9-to-10  = fs-repo-common "fs-repo-9-to-10"  "1.0.1";
@@ -39,6 +53,7 @@ let
   fs-repo-0-to-1   = fs-repo-common "fs-repo-0-to-1"   "1.0.1";
 
   all-migrations = [
+    fs-repo-12-to-13
     fs-repo-11-to-12
     fs-repo-10-to-11
     fs-repo-9-to-10
diff --git a/pkgs/applications/networking/kubo-migrator/unwrapped.nix b/pkgs/applications/networking/kubo-migrator/unwrapped.nix
index a99ab2b2cbb6..dcf206d5c8aa 100644
--- a/pkgs/applications/networking/kubo-migrator/unwrapped.nix
+++ b/pkgs/applications/networking/kubo-migrator/unwrapped.nix
@@ -15,13 +15,13 @@ buildGoModule rec {
     # The fs-repo-migrations code itself is the same between
     # the two versions but the migration code, which is built
     # into separate binaries, is not.
-    rev = "fs-repo-11-to-12/v1.0.2";
-    sha256 = "sha256-CG4utwH+/+Igw+SP3imhl39wijlB53UGtkJG5Mwh+Ik=";
+    rev = "fs-repo-12-to-13/v1.0.0";
+    hash = "sha256-QQone7E2Be+jVfnrwqQ1Ny4jo6mSDHhaY3ErkNdn2f8=";
   };
 
   sourceRoot = "source/fs-repo-migrations";
 
-  vendorSha256 = "sha256-/DqkBBtR/nU8gk3TFqNKY5zQU6BFMc3N8Ti+38mi/jk=";
+  vendorHash = "sha256-/DqkBBtR/nU8gk3TFqNKY5zQU6BFMc3N8Ti+38mi/jk=";
 
   doCheck = false;
 
diff --git a/pkgs/applications/networking/protonmail-bridge/default.nix b/pkgs/applications/networking/protonmail-bridge/default.nix
index bdf75f6440e2..5dc7779e12e9 100644
--- a/pkgs/applications/networking/protonmail-bridge/default.nix
+++ b/pkgs/applications/networking/protonmail-bridge/default.nix
@@ -2,44 +2,51 @@
 
 buildGoModule rec {
   pname = "protonmail-bridge";
-  version = "2.3.0";
+  version = "3.0.18";
 
   src = fetchFromGitHub {
     owner = "ProtonMail";
     repo = "proton-bridge";
-    rev = "br-${version}";
-    sha256 = "sha256-7p+Q6/BphE/dxNQe+gfcIty6TAWHUcPpvSJWfmf4OQg=";
+    rev = "v${version}";
+    hash = "sha256-0gQnMhjwW2NEJwafqndStQ33dIu82lW6ntXFRCpbmm4=";
   };
 
-  vendorSha256 = "sha256-dhrn6xQ0IJzBYeO6ko2PUCO+idopC2An0ylqCnx5jKg=";
+  vendorHash = "sha256-lHMcVcaoBwjE2ikEZPeZexC5XvhkAtvHnDci7UAa4vg=";
 
   nativeBuildInputs = [ pkg-config ];
 
   buildInputs = [ libsecret ];
 
-  buildPhase = ''
-    runHook preBuild
+  proxyVendor = true; # Bridge uses some C headers so we have to enable proxyVendor
 
+  preBuild = ''
     patchShebangs ./utils/
-    make BUILD_TIME= -j$NIX_BUILD_CORES build-nogui
-
-    runHook postBuild
+    (cd ./utils/ && ./credits.sh bridge)
   '';
 
-  installPhase = ''
-    runHook preInstall
+  ldflags =
+    let constants = "github.com/ProtonMail/proton-bridge/v3/internal/constants"; in
+    [
+      "-X ${constants}.Version=${version}"
+      "-X ${constants}.Revision=${src.rev}"
+      "-X ${constants}.buildTime=unknown"
+      "-X ${constants}.FullAppName=ProtonMailBridge" # Should be "Proton Mail Bridge", but quoting doesn't seems to work in nix's ldflags
+    ];
 
-    install -Dm555 proton-bridge $out/bin/protonmail-bridge
+  subPackages = [
+    "cmd/Desktop-Bridge"
+  ];
 
-    runHook postInstall
+  postInstall = ''
+    mv $out/bin/Desktop-Bridge $out/bin/bridge # The cli is named like that in the upstream repo
   '';
 
   meta = with lib; {
     homepage = "https://github.com/ProtonMail/proton-bridge";
-    changelog = "https://github.com/ProtonMail/proton-bridge/blob/master/Changelog.md";
+    changelog = "https://github.com/ProtonMail/proton-bridge/blob/${src.rev}/Changelog.md";
     downloadPage = "https://github.com/ProtonMail/proton-bridge/releases";
     license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ lightdiscord ];
+    maintainers = with maintainers; [ mrfreezeex ];
     description = "Use your ProtonMail account with your local e-mail client";
     longDescription = ''
       An application that runs on your computer in the background and seamlessly encrypts
diff --git a/pkgs/applications/office/onlyoffice-bin/default.nix b/pkgs/applications/office/onlyoffice-bin/default.nix
index 62e97670c2b6..e2dfb12c92f9 100644
--- a/pkgs/applications/office/onlyoffice-bin/default.nix
+++ b/pkgs/applications/office/onlyoffice-bin/default.nix
@@ -12,6 +12,7 @@
 , dconf
 , dpkg
 , fontconfig
+, gcc-unwrapped
 , gdk-pixbuf
 , glib
 , glibc
@@ -66,6 +67,7 @@ let
   runtimeLibs = lib.makeLibraryPath [
     curl
     glibc
+    gcc-unwrapped.lib
     libudev0-shim
     pulseaudio
   ];
diff --git a/pkgs/applications/office/treesheets/default.nix b/pkgs/applications/office/treesheets/default.nix
index 6b318e7a7d62..a18307c77548 100644
--- a/pkgs/applications/office/treesheets/default.nix
+++ b/pkgs/applications/office/treesheets/default.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "treesheets";
-  version = "unstable-2023-02-14";
+  version = "unstable-2023-02-25";
 
   src = fetchFromGitHub {
     owner = "aardappel";
     repo = "treesheets";
-    rev = "16d449a3bf2805c1fc683fdc183e0e8390074252";
-    sha256 = "jm6bLu+6G3VMSyB56B5qATqFZ3sXjm8s66Gx2oZyvFA=";
+    rev = "e2acd675e6aeac609ae071aa169b2661c1fbd862";
+    sha256 = "y7y9DQ6oy/1EuLl4FAkRJd0zzMRm/2OOvnfWtwpf8AU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/radio/guglielmo/default.nix b/pkgs/applications/radio/guglielmo/default.nix
index 404ec7aa96a1..41d1407a9af3 100644
--- a/pkgs/applications/radio/guglielmo/default.nix
+++ b/pkgs/applications/radio/guglielmo/default.nix
@@ -1,6 +1,6 @@
 { lib, mkDerivation, fetchFromGitHub, cmake, pkg-config
 , airspy
-, librtlsdr
+, rtl-sdr
 , fdk_aac
 , faad2
 , fftwFloat
@@ -29,7 +29,7 @@ mkDerivation rec {
   nativeBuildInputs = [ cmake pkg-config ];
   buildInputs = [
     airspy
-    librtlsdr
+    rtl-sdr
     fdk_aac
     faad2
     fftwFloat
@@ -42,7 +42,7 @@ mkDerivation rec {
 
   postFixup = ''
     # guglielmo opens SDR libraries at run time
-    patchelf --add-rpath "${airspy}/lib:${librtlsdr}/lib" $out/bin/.guglielmo-wrapped
+    patchelf --add-rpath "${airspy}/lib:${rtl-sdr}/lib" $out/bin/.guglielmo-wrapped
   '';
 
   meta = with lib; {
diff --git a/pkgs/applications/radio/sdrangel/default.nix b/pkgs/applications/radio/sdrangel/default.nix
index abba5c620498..392088eca95f 100644
--- a/pkgs/applications/radio/sdrangel/default.nix
+++ b/pkgs/applications/radio/sdrangel/default.nix
@@ -42,13 +42,13 @@
 
 mkDerivation rec {
   pname = "sdrangel";
-  version = "7.9.0";
+  version = "7.10.0";
 
   src = fetchFromGitHub {
     owner = "f4exb";
     repo = "sdrangel";
     rev = "v${version}";
-    sha256 = "sha256-lX49R1GhYH45DhxOnn3r6b4VuG8GAissCscv1Qo2GB0=";
+    sha256 = "sha256-hsYt7zGG6CSWeQ9A3GPt65efjZGPu33O5pIhnZjFgmY=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
diff --git a/pkgs/applications/radio/sdrpp/default.nix b/pkgs/applications/radio/sdrpp/default.nix
index b539426d9676..9926fab1a746 100644
--- a/pkgs/applications/radio/sdrpp/default.nix
+++ b/pkgs/applications/radio/sdrpp/default.nix
@@ -8,7 +8,7 @@
 , hackrf_source ? true, hackrf
 , limesdr_source ? false, limesuite
 , sddc_source ? false
-, rtl_sdr_source ? true, librtlsdr, libusb1
+, rtl_sdr_source ? true, rtl-sdr, libusb1
 , rtl_tcp_source ? true
 , sdrplay_source ? false, sdrplay
 , soapy_source ? true, soapysdr
@@ -62,7 +62,7 @@ stdenv.mkDerivation rec {
     ++ lib.optional bladerf_source libbladeRF
     ++ lib.optional hackrf_source hackrf
     ++ lib.optional limesdr_source limesuite
-    ++ lib.optionals rtl_sdr_source [ librtlsdr libusb1 ]
+    ++ lib.optionals rtl_sdr_source [ rtl-sdr libusb1 ]
     ++ lib.optional sdrplay_source sdrplay
     ++ lib.optional soapy_source soapysdr
     ++ lib.optionals plutosdr_source [ libiio libad9361 ]
diff --git a/pkgs/applications/science/biology/diamond/default.nix b/pkgs/applications/science/biology/diamond/default.nix
index bd878312d8de..241585b3579e 100644
--- a/pkgs/applications/science/biology/diamond/default.nix
+++ b/pkgs/applications/science/biology/diamond/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "diamond";
-  version = "2.1.1";
+  version = "2.1.3";
 
   src = fetchFromGitHub {
     owner = "bbuchfink";
     repo = "diamond";
     rev = "v${version}";
-    sha256 = "sha256-OT5Fi/rC3VmQ97SuqlXOTf8RAT0Zj4/Oy86T1v7hBkA=";
+    sha256 = "sha256-gvPftUSH+Gnn8LQeORpv7jjHewUKSeo2FVNcoaE2GKU=";
   };
 
 
diff --git a/pkgs/applications/version-management/gogs/default.nix b/pkgs/applications/version-management/gogs/default.nix
index 0549169ed1b6..824d0e056048 100644
--- a/pkgs/applications/version-management/gogs/default.nix
+++ b/pkgs/applications/version-management/gogs/default.nix
@@ -8,16 +8,16 @@ with lib;
 
 buildGoModule rec {
   pname = "gogs";
-  version = "0.12.10";
+  version = "0.13.0";
 
   src = fetchFromGitHub {
     owner = "gogs";
     repo = "gogs";
     rev = "v${version}";
-    sha256 = "sha256-EFGC94aIMW7AYJpgaHBT4W7BjXd+oijMqQPH40rIvlg=";
+    sha256 = "sha256-UfxE+NaqDr3XUXpvlV989Iwjq/lsAwpMTDAPkcOmma8=";
   };
 
-  vendorSha256 = "sha256-5AnQ7zF2UK1HNoyr6gwFdVv+KMJEGkjKPpDEpUXckUg=";
+  vendorSha256 = "sha256-ISJOEJ1DWO4nnMpDuZ36Nq528LhgekDh3XUF8adlj2w=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/applications/virtualization/crun/default.nix b/pkgs/applications/virtualization/crun/default.nix
index b37937e7461c..1c2dce886536 100644
--- a/pkgs/applications/virtualization/crun/default.nix
+++ b/pkgs/applications/virtualization/crun/default.nix
@@ -38,13 +38,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "crun";
-  version = "1.8";
+  version = "1.8.1";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = pname;
     rev = version;
-    hash = "sha256-8R9cja8Blk+7Sp25bJ9t9e0TvazD41livK+KKAwRpLg=";
+    hash = "sha256-Pm96fOfbBqf7mc9llv3sFi00Ioa3f9WNoDmLBPhB2eI=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/compilers/orc/default.nix b/pkgs/development/compilers/orc/default.nix
index 771830d8b6ac..e36eb28d465e 100644
--- a/pkgs/development/compilers/orc/default.nix
+++ b/pkgs/development/compilers/orc/default.nix
@@ -46,7 +46,8 @@ in stdenv.mkDerivation rec {
     ++ optionals buildDevDoc [ gtk-doc file docbook_xsl ]
   ;
 
-  doCheck = true;
+  # https://gitlab.freedesktop.org/gstreamer/orc/-/issues/41
+  doCheck = !(stdenv.isLinux && stdenv.isAarch64 && stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "12");
 
   passthru.tests = {
     inherit (gst_all_1) gst-plugins-good gst-plugins-bad gst-plugins-ugly;
diff --git a/pkgs/development/compilers/scryer-prolog/cargo.patch b/pkgs/development/compilers/scryer-prolog/cargo.patch
deleted file mode 100644
index 48db924ca261..000000000000
--- a/pkgs/development/compilers/scryer-prolog/cargo.patch
+++ /dev/null
@@ -1,24 +0,0 @@
-diff --git a/Cargo.lock b/Cargo.lock
-index 05e54911..3a567165 100644
---- a/Cargo.lock
-+++ b/Cargo.lock
-@@ -1826,6 +1826,7 @@ dependencies = [
-  "futures",
-  "fxhash",
-  "git-version",
-+ "gmp-mpfr-sys",
-  "hostname",
-  "hyper",
-  "hyper-tls",
-diff --git a/Cargo.toml b/Cargo.toml
-index 6e42de23..a50e3d47 100644
---- a/Cargo.toml
-+++ b/Cargo.toml
-@@ -63,6 +63,7 @@ hyper = { version = "0.14", features = ["full"] }
- hyper-tls = "0.5.0"
- tokio = { version = "1", features = ["full"] }
- futures = "0.3"
-+gmp-mpfr-sys = { version = "1.4.10", features = ["use-system-libs"] }
- 
- [dev-dependencies]
- assert_cmd = "1.0.3"
diff --git a/pkgs/development/compilers/scryer-prolog/default.nix b/pkgs/development/compilers/scryer-prolog/default.nix
index 739d600bf63d..4850f299dcbb 100644
--- a/pkgs/development/compilers/scryer-prolog/default.nix
+++ b/pkgs/development/compilers/scryer-prolog/default.nix
@@ -1,13 +1,12 @@
-{ stdenv
-, lib
-, fetchFromGitHub
+{ lib
 , rustPlatform
-, rustfmt
+, fetchFromGitHub
+, pkg-config
+, openssl
 , gmp
 , libmpc
 , mpfr
-, openssl
-, pkg-config
+, stdenv
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -21,19 +20,16 @@ rustPlatform.buildRustPackage rec {
     sha256 = "bDLVOXX9nv6Guu5czRFkviJf7dBiaqt5O8SLUJlcBZo=";
   };
 
-  cargoPatches = [
-    # Use system openssl, gmp, mpc and mpfr.
-    ./cargo.patch
-  ];
+  cargoSha256 = "sha256-tv/4GOl93nGLWyoAXY5roxRqS1twskkQTSddltH4n9U=";
 
-  cargoSha256 = "A6HtvxGTjJliDMUSGkQKB13FRyfBU4EPvrlZ97ic0Ic=";
-
-  nativeBuildInputs = [ pkg-config rustfmt];
+  nativeBuildInputs = [ pkg-config ];
   buildInputs = [ openssl gmp libmpc mpfr ];
 
+  CARGO_FEATURE_USE_SYSTEM_LIBS = true;
+
   meta = with lib; {
     broken = stdenv.isDarwin;
-    description = "A modern Prolog implementation written mostly in Rust.";
+    description = "A modern Prolog implementation written mostly in Rust";
     homepage = "https://github.com/mthom/scryer-prolog";
     license = with licenses; [ bsd3 ];
     maintainers = with maintainers; [ malbarbo ];
diff --git a/pkgs/development/interpreters/wasmtime/default.nix b/pkgs/development/interpreters/wasmtime/default.nix
index 30a4244e4f84..ecc8788ca7be 100644
--- a/pkgs/development/interpreters/wasmtime/default.nix
+++ b/pkgs/development/interpreters/wasmtime/default.nix
@@ -2,17 +2,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "wasmtime";
-  version = "5.0.0";
+  version = "6.0.0";
 
   src = fetchFromGitHub {
     owner = "bytecodealliance";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-tHGzXjOOOWgYBMA0skLRNFkVgXc3hcs3F1XNsHxDRhk=";
+    hash = "sha256-wCM+axQy5gOHUAThmwPYMt9/HWuIpGcQjMT9TSLqWbk=";
     fetchSubmodules = true;
   };
 
-  cargoHash = "sha256-92BZdbNz22cZMJkHJwE3lUik6hAhRLCBwYzm2RAvRGo=";
+  cargoHash = "sha256-0RsTE6pcbbUFn7PWg1tNOlvix6TIB5DZxiJQVKU+lKg=";
 
   cargoBuildFlags = [
     "--package wasmtime-cli"
diff --git a/pkgs/development/libraries/kde-frameworks/prison.nix b/pkgs/development/libraries/kde-frameworks/prison.nix
index c2063e22bba7..d2a7b5c1a408 100644
--- a/pkgs/development/libraries/kde-frameworks/prison.nix
+++ b/pkgs/development/libraries/kde-frameworks/prison.nix
@@ -1,13 +1,13 @@
 {
   mkDerivation,
   extra-cmake-modules,
-  libdmtx, qrencode, qtbase,
+  libdmtx, qrencode, qtbase, qtmultimedia, zxing-cpp
 }:
 
 mkDerivation {
   pname = "prison";
   nativeBuildInputs = [ extra-cmake-modules ];
-  buildInputs = [ libdmtx qrencode ];
-  propagatedBuildInputs = [ qtbase ];
+  buildInputs = [ libdmtx qrencode zxing-cpp ];
+  propagatedBuildInputs = [ qtbase qtmultimedia ];
   outputs = [ "out" "dev" ];
 }
diff --git a/pkgs/development/libraries/rocclr/default.nix b/pkgs/development/libraries/rocclr/default.nix
index b6a7b113d0a8..4137050f5d26 100644
--- a/pkgs/development/libraries/rocclr/default.nix
+++ b/pkgs/development/libraries/rocclr/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rocclr";
-  version = "5.4.2";
+  version = "5.4.3";
 
   src = fetchFromGitHub {
     owner = "ROCm-Developer-Tools";
     repo = "ROCclr";
     rev = "rocm-${finalAttrs.version}";
-    hash = "sha256-tYFoGafOsJYnRQaOLAaFix6tPD0QPTidOtOicPxP2Vk=";
+    hash = "sha256-DbN7kL8oyaPeYQB19Q96L3wX66v62TMSWl0Yor7Q4kE=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/science/math/magma/default.nix b/pkgs/development/libraries/science/math/magma/default.nix
index f70cbbcff5d8..9eb410595974 100644
--- a/pkgs/development/libraries/science/math/magma/default.nix
+++ b/pkgs/development/libraries/science/math/magma/default.nix
@@ -1,83 +1,53 @@
-{ lib
-, stdenv
-, fetchurl
-, cmake
-, ninja
-, gfortran
-, libpthreadstubs
-, lapack
-, blas
-, cudaPackages
-, hip
-, hipblas
-, hipsparse
-, openmp
-, useCUDA ? true
-, useROCM ? false
-, gpuTargets ? [ ]
+args@{ callPackage
+, lib
+, ...
 }:
 
+# Type aliases
+# Release = {
+#  version: String
+#  hash: String
+#  supportedGpuTargets: List String
+# }
+
 let
-  inherit (cudaPackages) cudatoolkit cudaFlags;
-in stdenv.mkDerivation (finalAttrs: {
-  pname = "magma";
-  version = "2.6.2";
+  inherit (lib) lists strings trivial;
 
-  src = fetchurl {
-    name = "magma-${finalAttrs.version}.tar.gz";
-    url = "https://icl.cs.utk.edu/projectsfiles/magma/downloads/magma-${finalAttrs.version}.tar.gz";
-    hash = "sha256-dbVU2rAJA+LRC5cskT5Q5/iMvGLzrkMrWghsfk7aCnE=";
+  computeName = version: "magma_${strings.replaceStrings [ "." ] [ "_" ] version}";
+
+  # buildMagmaPackage :: Release -> Derivation
+  buildMagmaPackage = magmaRelease: callPackage ./generic.nix (
+    (builtins.removeAttrs args [ "callPackage" ]) // {
+      inherit magmaRelease;
+    }
+  );
+
+  # Reverse the list to have the latest release first
+  # magmaReleases :: List Release
+  magmaReleases = lists.reverseList (builtins.import ./releases.nix);
+
+  # The latest release is the first element of the list and will be our default choice
+  # latestReleaseName :: String
+  latestReleaseName = computeName (builtins.head magmaReleases).version;
+
+  # Function to transform our releases into build attributes
+  # toBuildAttrs :: Release -> { name: String, value: Derivation }
+  toBuildAttrs = release: {
+    name = computeName release.version;
+    value = buildMagmaPackage release;
   };
 
-  nativeBuildInputs = [
-    cmake
-    ninja
-    gfortran
-  ];
+  # Add all supported builds as attributes
+  # allBuilds :: AttrSet String Derivation
+  allBuilds = builtins.listToAttrs (lists.map toBuildAttrs magmaReleases);
 
-  buildInputs = [
-    libpthreadstubs
-    lapack
-    blas
-  ] ++ lib.optionals useCUDA [
-    cudatoolkit
-  ] ++ lib.optionals useROCM [
-    hip
-    hipblas
-    hipsparse
-    openmp
-  ];
+  # The latest release will be our default build
+  # defaultBuild :: AttrSet String Derivation
+  defaultBuild.magma = allBuilds.${latestReleaseName};
 
-  cmakeFlags = lib.optionals useCUDA [
-    "-DCMAKE_C_COMPILER=${cudatoolkit.cc}/bin/gcc"
-    "-DCMAKE_CXX_COMPILER=${cudatoolkit.cc}/bin/g++"
-    "-DMAGMA_ENABLE_CUDA=ON"
-    "-DGPU_TARGET=${builtins.concatStringsSep "," cudaFlags.cudaRealArches}"
-  ] ++ lib.optionals useROCM [
-    "-DCMAKE_C_COMPILER=${hip}/bin/hipcc"
-    "-DCMAKE_CXX_COMPILER=${hip}/bin/hipcc"
-    "-DMAGMA_ENABLE_HIP=ON"
-    "-DGPU_TARGET=${builtins.concatStringsSep "," (if gpuTargets == [ ] then hip.gpuTargets else gpuTargets)}"
-  ];
+  # builds :: AttrSet String Derivation
+  builds = allBuilds // defaultBuild;
+in
 
-  buildFlags = [
-    "magma"
-    "magma_sparse"
-  ];
+builds
 
-  doCheck = false;
-
-  passthru = {
-    inherit cudatoolkit;
-  };
-
-  meta = with lib; {
-    description = "Matrix Algebra on GPU and Multicore Architectures";
-    license = licenses.bsd3;
-    homepage = "http://icl.cs.utk.edu/magma/index.html";
-    platforms = platforms.unix;
-    maintainers = with maintainers; [ tbenst ];
-    # CUDA and ROCm are mutually exclusive
-    broken = useCUDA && useROCM || useCUDA && versionOlder cudatoolkit.version "9";
-  };
-})
diff --git a/pkgs/development/libraries/science/math/magma/generic.nix b/pkgs/development/libraries/science/math/magma/generic.nix
new file mode 100644
index 000000000000..ab0a2125ec00
--- /dev/null
+++ b/pkgs/development/libraries/science/math/magma/generic.nix
@@ -0,0 +1,160 @@
+# Type aliases
+# Release = {
+#  version: String
+#  hash: String
+#  supportedGpuTargets: List String
+# }
+
+{ blas
+, cmake
+, cudaPackages
+, cudaSupport ? true
+, fetchurl
+, gfortran
+, gpuTargets ? [ ]
+, hip
+, hipblas
+, hipsparse
+, lapack
+, lib
+, libpthreadstubs
+, magmaRelease
+, ninja
+, openmp
+, rocmSupport ? false
+, stdenv
+, symlinkJoin
+}:
+
+
+let
+  inherit (lib) lists strings trivial;
+  inherit (cudaPackages) cudatoolkit cudaFlags cudaVersion;
+  inherit (magmaRelease) version hash supportedGpuTargets;
+
+  # NOTE: The lists.subtractLists function is perhaps a bit unintuitive. It subtracts the elements
+  #   of the first list *from* the second list. That means:
+  #   lists.subtractLists a b = b - a
+
+  # For CUDA
+  supportedCudaSmArches = lists.intersectLists cudaFlags.cudaRealArches supportedGpuTargets;
+  # Subtract the supported SM architectures from the real SM architectures to get the unsupported
+  # SM architectures.
+  unsupportedCudaSmArches = lists.subtractLists supportedCudaSmArches cudaFlags.cudaRealArches;
+
+  # For ROCm
+  # NOTE: The hip.gpuTargets are prefixed with "gfx" instead of "sm" like cudaFlags.cudaRealArches.
+  #   For some reason, Magma's CMakeLists.txt file does not handle the "gfx" prefix, so we must
+  #   remove it.
+  rocmArches = lists.map (x: strings.removePrefix "gfx" x) hip.gpuTargets;
+  supportedRocmArches = lists.intersectLists rocmArches supportedGpuTargets;
+  unsupportedRocmArches = lists.subtractLists supportedRocmArches rocmArches;
+
+  supportedCustomGpuTargets = lists.intersectLists gpuTargets supportedGpuTargets;
+  unsupportedCustomGpuTargets = lists.subtractLists supportedCustomGpuTargets gpuTargets;
+
+  # Use trivial.warnIf to print a warning if any unsupported GPU targets are specified.
+  gpuArchWarner = supported: unsupported:
+    trivial.throwIf (supported == [ ])
+      (
+        "No supported GPU targets specified. Requested GPU targets: "
+        + strings.concatStringsSep ", " unsupported
+      )
+      supported;
+
+  # Create the gpuTargetString.
+  gpuTargetString = strings.concatStringsSep "," (
+    if gpuTargets != [ ] then
+    # If gpuTargets is specified, it always takes priority.
+      gpuArchWarner supportedCustomGpuTargets unsupportedCustomGpuTargets
+    else if cudaSupport then
+      gpuArchWarner supportedCudaSmArches unsupportedCudaSmArches
+    else if rocmSupport then
+      gpuArchWarner supportedRocmArches unsupportedRocmArches
+    else
+      throw "No GPU targets specified"
+  );
+
+  cuda_joined = symlinkJoin {
+    name = "cuda-redist-${cudaVersion}";
+    paths = with cudaPackages; [
+      cuda_nvcc
+      cuda_cudart # cuda_runtime.h
+      libcublas
+      libcusparse
+      cuda_nvprof # <cuda_profiler_api.h>
+    ];
+  };
+in
+
+stdenv.mkDerivation {
+  pname = "magma";
+  inherit version;
+
+  src = fetchurl {
+    name = "magma-${version}.tar.gz";
+    url = "https://icl.cs.utk.edu/projectsfiles/magma/downloads/magma-${version}.tar.gz";
+    inherit hash;
+  };
+
+  nativeBuildInputs = [
+    cmake
+    ninja
+    gfortran
+  ];
+
+  buildInputs = [
+    libpthreadstubs
+    lapack
+    blas
+  ] ++ lists.optionals cudaSupport [
+    cuda_joined
+  ] ++ lists.optionals rocmSupport [
+    hip
+    hipblas
+    hipsparse
+    openmp
+  ];
+
+  cmakeFlags = lists.optionals cudaSupport [
+    "-DCMAKE_C_COMPILER=${cudatoolkit.cc}/bin/cc"
+    "-DCMAKE_CXX_COMPILER=${cudatoolkit.cc}/bin/c++"
+    "-DMAGMA_ENABLE_CUDA=ON"
+  ] ++ lists.optionals rocmSupport [
+    "-DCMAKE_C_COMPILER=${hip}/bin/hipcc"
+    "-DCMAKE_CXX_COMPILER=${hip}/bin/hipcc"
+    "-DMAGMA_ENABLE_HIP=ON"
+  ];
+
+  # NOTE: We must set GPU_TARGET in preConfigure in this way because it may contain spaces.
+  preConfigure = ''
+    cmakeFlagsArray+=("-DGPU_TARGET=${gpuTargetString}")
+  ''
+  # NOTE: The stdenv's CXX is used when compiling the CMake test to determine the version of
+  #   CUDA available. This isn't necessarily the same as cudatoolkit.cc, so we must set
+  #   CUDAHOSTCXX.
+  + strings.optionalString cudaSupport ''
+    export CUDAHOSTCXX=${cudatoolkit.cc}/bin/c++
+  '';
+
+  buildFlags = [
+    "magma"
+    "magma_sparse"
+  ];
+
+  doCheck = false;
+
+  passthru = {
+    inherit cudaPackages cudaSupport;
+  };
+
+  meta = with lib; {
+    description = "Matrix Algebra on GPU and Multicore Architectures";
+    license = licenses.bsd3;
+    homepage = "http://icl.cs.utk.edu/magma/index.html";
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ tbenst ];
+    # CUDA and ROCm are mutually exclusive
+    broken = cudaSupport && rocmSupport || cudaSupport && strings.versionOlder cudaVersion "9";
+  };
+}
diff --git a/pkgs/development/libraries/science/math/magma/releases.nix b/pkgs/development/libraries/science/math/magma/releases.nix
new file mode 100644
index 000000000000..3d08aa95d4d1
--- /dev/null
+++ b/pkgs/development/libraries/science/math/magma/releases.nix
@@ -0,0 +1,98 @@
+# NOTE: Order matters! Put the oldest version first, and the newest version last.
+# NOTE: Make sure the supportedGpuTargets are in order of oldest to newest.
+#   You can update the supportedGpuTargets by looking at the CMakeLists.txt file.
+#   CUDA starts here: https://bitbucket.org/icl/magma/src/f4ec79e2c13a2347eff8a77a3be6f83bc2daec20/CMakeLists.txt#lines-175
+#   HIP is here: https://bitbucket.org/icl/magma/src/f4ec79e2c13a2347eff8a77a3be6f83bc2daec20/CMakeLists.txt#lines-386
+[
+  {
+    version = "2.6.2";
+    hash = "sha256-dbVU2rAJA+LRC5cskT5Q5/iMvGLzrkMrWghsfk7aCnE=";
+    supportedGpuTargets = [
+      "sm_20"
+      "sm_30"
+      "sm_35"
+      "sm_37"
+      "sm_50"
+      "sm_52"
+      "sm_53"
+      "sm_60"
+      "sm_61"
+      "sm_62"
+      "sm_70"
+      "sm_71"
+      "sm_75"
+      "sm_80"
+      "700"
+      "701"
+      "702"
+      "703"
+      "704"
+      "705"
+      "801"
+      "802"
+      "803"
+      "805"
+      "810"
+      "900"
+      "902"
+      "904"
+      "906"
+      "908"
+      "909"
+      "90c"
+      "1010"
+      "1011"
+      "1012"
+      "1030"
+      "1031"
+      "1032"
+      "1033"
+    ];
+  }
+  {
+    version = "2.7.1";
+    hash = "sha256-2chxHAR6OMrhbv3nS+4uszMyF/0nEeHpuGBsu7SuGlA=";
+    supportedGpuTargets = [
+      "sm_20"
+      "sm_30"
+      "sm_35"
+      "sm_37"
+      "sm_50"
+      "sm_52"
+      "sm_53"
+      "sm_60"
+      "sm_61"
+      "sm_62"
+      "sm_70"
+      "sm_71"
+      "sm_75"
+      "sm_80"
+      "sm_90"
+      "700"
+      "701"
+      "702"
+      "703"
+      "704"
+      "705"
+      "801"
+      "802"
+      "803"
+      "805"
+      "810"
+      "900"
+      "902"
+      "904"
+      "906"
+      "908"
+      "909"
+      "90c"
+      "1010"
+      "1011"
+      "1012"
+      "1030"
+      "1031"
+      "1032"
+      "1033"
+    ];
+  }
+]
diff --git a/pkgs/development/python-modules/azure-storage-blob/default.nix b/pkgs/development/python-modules/azure-storage-blob/default.nix
index f8f7f2f403b2..1a02c11bafba 100644
--- a/pkgs/development/python-modules/azure-storage-blob/default.nix
+++ b/pkgs/development/python-modules/azure-storage-blob/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "azure-storage-blob";
-  version = "12.14.1";
+  version = "12.15.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    hash = "sha256-hg1NgphaS/x9MnHnEnWvMw9U8zCnVDVUNae6dJzN6Zc=";
+    hash = "sha256-+LjVgkknQKsWdERVQINC+45MiJe2Soo/wxdDhEciwvI=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/bundlewrap/default.nix b/pkgs/development/python-modules/bundlewrap/default.nix
index a8616c908bc7..8ed5f3baa33e 100644
--- a/pkgs/development/python-modules/bundlewrap/default.nix
+++ b/pkgs/development/python-modules/bundlewrap/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "bundlewrap";
-  version = "4.16.0";
+  version = "4.17.0";
 
   disabled = pythonOlder "3.7";
 
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "bundlewrap";
     repo = "bundlewrap";
     rev = version;
-    sha256 = "sha256-y7h43D/SeXmMm0Fxi3hOOfXgDlmeoca11HOhGeJffRA=";
+    sha256 = "sha256-hdTJcuhVMbLqtPclgj4u6XwH0A5DvnGpnkhIG6Gm8+4=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/dnspython/default.nix b/pkgs/development/python-modules/dnspython/default.nix
index 30a220fd6da8..01e3dd2cb55e 100644
--- a/pkgs/development/python-modules/dnspython/default.nix
+++ b/pkgs/development/python-modules/dnspython/default.nix
@@ -64,10 +64,8 @@ buildPythonPackage rec {
   ];
 
   checkInputs = [
-  ] ++ passthru.optional-dependencies.DNSSEC
-  ++ lib.optionals stdenv.isDarwin [
     cacert
-  ];
+  ] ++ passthru.optional-dependencies.DNSSEC;
 
   disabledTests = [
     # dns.exception.SyntaxError: protocol not found
diff --git a/pkgs/development/python-modules/fastavro/default.nix b/pkgs/development/python-modules/fastavro/default.nix
index c4070226eee6..928593c3809c 100644
--- a/pkgs/development/python-modules/fastavro/default.nix
+++ b/pkgs/development/python-modules/fastavro/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "fastavro";
-  version = "1.7.1";
+  version = "1.7.2";
 
   disabled = pythonOlder "3.6";
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "refs/tags/${version}";
-    sha256 = "sha256-oFBOHcrtJe9u/hdW4p8GgIJ2g4oiSNa+qbDFBuMB/HQ=";
+    sha256 = "sha256-IKs3uYGxiSy++tjF2XhWFrIfOo+SSl2JATUHBhCE3ZQ=";
   };
 
   preBuild = ''
diff --git a/pkgs/development/python-modules/hg-evolve/default.nix b/pkgs/development/python-modules/hg-evolve/default.nix
index accbda978f95..073637b25367 100644
--- a/pkgs/development/python-modules/hg-evolve/default.nix
+++ b/pkgs/development/python-modules/hg-evolve/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "hg-evolve";
-  version = "10.5.3";
+  version = "11.0.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-0frkG8HqzC1ZftGDMv4vk47vc9tQWGBQbL4bzFdaCL4=";
+    sha256 = "sha256-7LCsw6LSFB0r2jJt7/3X18jxRhLGsRjWmjllVLxspbU=";
   };
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/holidays/default.nix b/pkgs/development/python-modules/holidays/default.nix
index 6d98f876bc70..bab50ea617b3 100644
--- a/pkgs/development/python-modules/holidays/default.nix
+++ b/pkgs/development/python-modules/holidays/default.nix
@@ -1,24 +1,26 @@
 { lib
 , buildPythonPackage
 , convertdate
-, python-dateutil
-, fetchPypi
+, fetchFromGitHub
 , hijri-converter
 , korean-lunar-calendar
 , pytestCheckHook
+, python-dateutil
 , pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "holidays";
-  version = "0.18";
+  version = "0.20";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-6U2dNTb/Gipw1tL1bLBV65qV0LmjpfuBuej5024zN4k=";
+  src = fetchFromGitHub {
+    owner = "dr-prodigy";
+    repo = "python-holidays";
+    rev = "refs/tags/v.${version}";
+    hash = "sha256-hz0v4g94RMA1dKOLu4BSYnK5EPNl1hIWEShFJWO0F3A=";
   };
 
   propagatedBuildInputs = [
@@ -36,10 +38,6 @@ buildPythonPackage rec {
     "holidays"
   ];
 
-  disabledTestPaths = [
-    "test/test_imports.py"
-  ];
-
   meta = with lib; {
     description = "Generate and work with holidays in Python";
     homepage = "https://github.com/dr-prodigy/python-holidays";
diff --git a/pkgs/development/python-modules/ml-collections/default.nix b/pkgs/development/python-modules/ml-collections/default.nix
index ffa3a6ade32e..d317aa22cccf 100644
--- a/pkgs/development/python-modules/ml-collections/default.nix
+++ b/pkgs/development/python-modules/ml-collections/default.nix
@@ -19,13 +19,13 @@ let
 in
 buildPythonPackage rec {
   pname = "ml-collections";
-  version = "0.1.0";
+  version = "0.1.1";
 
   # ml-collections does not have any git release tags. See https://github.com/google/ml_collections/issues/8.
   src = fetchPypi {
     inherit version;
     pname = "ml_collections";
-    sha256 = "0g6gxfz8g6fh1sghys869ylxgpda9hq7ylc8jw05608l3k6pz8ar";
+    sha256 = "sha256-P+/McuxDOqHl0yMHo+R0u7Z/QFvoFOpSohZr/J2+aMw=";
   };
 
   # The pypi source archive does not include requirements.txt or
diff --git a/pkgs/development/python-modules/python-openstackclient/default.nix b/pkgs/development/python-modules/python-openstackclient/default.nix
index 6a9e24a9f8d8..8e0317dbc6d5 100644
--- a/pkgs/development/python-modules/python-openstackclient/default.nix
+++ b/pkgs/development/python-modules/python-openstackclient/default.nix
@@ -16,11 +16,11 @@
 
 buildPythonPackage rec {
   pname = "python-openstackclient";
-  version = "6.0.0";
+  version = "6.1.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-kcOsEtpLQjwWs5F2FvhKI+KWHnUPzlkNQJ7MUO4EMc4=";
+    sha256 = "sha256-7ZF5GFG/eQmvQYnVmaV8iWYPhWldJPPumlZloeJkNLg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/serialio/default.nix b/pkgs/development/python-modules/serialio/default.nix
index 56f82e449a70..2ee338c66631 100644
--- a/pkgs/development/python-modules/serialio/default.nix
+++ b/pkgs/development/python-modules/serialio/default.nix
@@ -35,7 +35,7 @@ buildPythonPackage rec {
   ];
 
   meta = with lib; {
-    description = "Library for concurrency agnostic serial connunication";
+    description = "Library for concurrency agnostic serial communication";
     homepage = "https://github.com/tiagocoutinho/serialio";
     license = with licenses; [ gpl3Plus ];
     maintainers = with maintainers; [ fab ];
diff --git a/pkgs/development/python-modules/torch/default.nix b/pkgs/development/python-modules/torch/default.nix
index fe1b005c8e3d..b00146b573fe 100644
--- a/pkgs/development/python-modules/torch/default.nix
+++ b/pkgs/development/python-modules/torch/default.nix
@@ -51,7 +51,7 @@ assert !cudaSupport || (let majorIs = lib.versions.major cudatoolkit.version;
 
 # confirm that cudatoolkits are sync'd across dependencies
 assert !(MPISupport && cudaSupport) || mpi.cudatoolkit == cudatoolkit;
-assert !cudaSupport || magma.cudatoolkit == cudatoolkit;
+assert !cudaSupport || magma.cudaPackages.cudatoolkit == cudatoolkit;
 
 let
   setBool = v: if v then "1" else "0";
diff --git a/pkgs/development/python-modules/wasmer/default.nix b/pkgs/development/python-modules/wasmer/default.nix
index 3444f541282e..0fbd9d2f8d7d 100644
--- a/pkgs/development/python-modules/wasmer/default.nix
+++ b/pkgs/development/python-modules/wasmer/default.nix
@@ -41,6 +41,12 @@ let
       nativeBuildInputs = (with rustPlatform; [ cargoSetupHook maturinBuildHook ])
         ++ extraNativeBuildInputs;
 
+      postPatch = ''
+        # Workaround for metadata, that maturin 0.14 does not accept in Cargo.toml anymore
+        substituteInPlace ${buildAndTestSubdir}/Cargo.toml \
+          --replace "package.metadata.maturin" "broken"
+      '';
+
       buildInputs = lib.optionals stdenv.isDarwin [ libiconv ]
         ++ extraBuildInputs;
 
diff --git a/pkgs/development/tools/analysis/cppcheck/default.nix b/pkgs/development/tools/analysis/cppcheck/default.nix
index ccd50c5454ec..6c526cd1dc2f 100644
--- a/pkgs/development/tools/analysis/cppcheck/default.nix
+++ b/pkgs/development/tools/analysis/cppcheck/default.nix
@@ -34,7 +34,8 @@ stdenv.mkDerivation rec {
     make DB2MAN=${docbook_xsl}/xml/xsl/docbook/manpages/docbook.xsl man
   '';
 
-  doCheck = true;
+  # test/testcondition.cpp:4949(TestCondition::alwaysTrueContainer): Assertion failed.
+  doCheck = !(stdenv.isLinux && stdenv.isAarch64);
 
   postInstall = ''
     installManPage cppcheck.1
diff --git a/pkgs/development/tools/benthos/default.nix b/pkgs/development/tools/benthos/default.nix
index 13e2effec5af..57235c3085ae 100644
--- a/pkgs/development/tools/benthos/default.nix
+++ b/pkgs/development/tools/benthos/default.nix
@@ -1,17 +1,20 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
 
 buildGoModule rec {
   pname = "benthos";
-  version = "4.11.0";
+  version = "4.12.1";
 
   src = fetchFromGitHub {
     owner = "benthosdev";
     repo = "benthos";
-    rev = "v${version}";
-    sha256 = "sha256-1pzyrXJgVN8kO3BHr/7LMpDvtnLcdioaxoRgKv/46v4=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-6qBeMQSBleZTsq6sExIqkkyxJUx1yt2YhUogKYEWii0=";
   };
 
-  vendorSha256 = "sha256-SfgdSPJ8Blra+KVWtKSjWfXmAm02tULwuYHNPbyJVpI=";
+  vendorHash = "sha256-sNqWTgVgcjYEzFlneQaV3g80NTrVKeKz+mtahEOdyIw=";
 
   doCheck = false;
 
@@ -19,11 +22,16 @@ buildGoModule rec {
     "cmd/benthos"
   ];
 
-  ldflags = [ "-s" "-w" "-X github.com/benthosdev/benthos/v4/internal/cli.Version=${version}" ];
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/benthosdev/benthos/v4/internal/cli.Version=${version}"
+  ];
 
   meta = with lib; {
     description = "Fancy stream processing made operationally mundane";
     homepage = "https://www.benthos.dev";
+    changelog = "https://github.com/benthosdev/benthos/blob/v${version}/CHANGELOG.md";
     license = licenses.mit;
     maintainers = with maintainers; [ sagikazarmark ];
   };
diff --git a/pkgs/development/tools/go-task/default.nix b/pkgs/development/tools/go-task/default.nix
index 466f0ff2a0b9..e52c36cf3976 100644
--- a/pkgs/development/tools/go-task/default.nix
+++ b/pkgs/development/tools/go-task/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "go-task";
-  version = "3.20.0";
+  version = "3.21.0";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = "task";
     rev = "v${version}";
-    sha256 = "sha256-pKvotNUpZl51r+9+YFEQGXVsUBfxsmTZLnRIdrl7UGQ=";
+    sha256 = "sha256-w46fCcUKMtmiFVSMSzgsegWBZUcTaMgOkhu9HnfYHf4=";
   };
 
-  vendorHash = "sha256-AZtkWJ/U1dH9J+wowlcg25qBVyRRo6LCzc6IBYKBkVA=";
+  vendorHash = "sha256-YC2C0/ayl0Rp8brzLLcdLB98BmhH7sP7EzLVdOIGAvQ=";
 
   doCheck = false;
 
diff --git a/pkgs/development/tools/minizinc/default.nix b/pkgs/development/tools/minizinc/default.nix
index 88b802b9aab8..2dfe33b98e6f 100644
--- a/pkgs/development/tools/minizinc/default.nix
+++ b/pkgs/development/tools/minizinc/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchFromGitHub, cmake, flex, bison }:
 stdenv.mkDerivation rec {
   pname = "minizinc";
-  version = "2.6.4";
+  version = "2.7.0";
 
   nativeBuildInputs = [ cmake flex bison ];
 
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     owner = "MiniZinc";
     repo = "libminizinc";
     rev = version;
-    sha256 = "sha256-rl+d21JcaUl4k4xuAw2zv8KHtaE96U+GENzDt2cgvH8=";
+    sha256 = "sha256-ukgzQ7ooiO13hQjWrsul/pvHPBbs1hkJJKLTQwv+cLg=";
   };
 
   meta = with lib; {
diff --git a/pkgs/development/tools/misc/slint-lsp/default.nix b/pkgs/development/tools/misc/slint-lsp/default.nix
index befeafa87a92..0ecebde8c244 100644
--- a/pkgs/development/tools/misc/slint-lsp/default.nix
+++ b/pkgs/development/tools/misc/slint-lsp/default.nix
@@ -25,14 +25,14 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "slint-lsp";
-  version = "0.3.4";
+  version = "0.3.5";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-M4rd7179hpQW8jqjCY9ce64AhE6YWOC32tJg3v+00bo=";
+    sha256 = "sha256-7ctzbuBP2AeBCd+/n18EdxIeCK89fCPb1ZbSRjdg8u0=";
   };
 
-  cargoHash = "sha256-3HcgnC2PQUyINm2gjxzqbCicvcGvpYtQn1p3qnqBzjc=";
+  cargoHash = "sha256-b5zb5YMqCfj8jAXQPQnBp6qTs0OGTrTgsd9bDGzPdus=";
 
   nativeBuildInputs = [ cmake pkg-config fontconfig ];
   buildInputs = rpathLibs ++ [ xorg.libxcb.dev ]
diff --git a/pkgs/development/tools/misc/texlab/default.nix b/pkgs/development/tools/misc/texlab/default.nix
index cfcbe1b2b94c..229438377d13 100644
--- a/pkgs/development/tools/misc/texlab/default.nix
+++ b/pkgs/development/tools/misc/texlab/default.nix
@@ -15,16 +15,16 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "texlab";
-  version = "5.2.0";
+  version = "5.3.0";
 
   src = fetchFromGitHub {
     owner = "latex-lsp";
     repo = "texlab";
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-OHfJJ3Oth6mu3UQkZeTcbxaivduIuZzmrMmkWQ8FB/4=";
+    sha256 = "sha256-DOzXsxqOLlETCAVpKpUXAxO+T0pE+2LwnOS99vU2o48=";
   };
 
-  cargoSha256 = "sha256-Vqm8KBNABYuRsn3HviRw93BQqPUj9EHD9L+ddUb1X+M=";
+  cargoSha256 = "sha256-t/4nfsED29F8v3DkLYCh2A8AJvQvZvU8z6C0PLhTFuM=";
 
   outputs = [ "out" ] ++ lib.optional (!isCross) "man";
 
@@ -41,7 +41,7 @@ rustPlatform.buildRustPackage rec {
   # generate the man page
   postInstall = lib.optionalString (!isCross) ''
     # TexLab builds man page separately in CI:
-    # https://github.com/latex-lsp/texlab/blob/v5.2.0/.github/workflows/publish.yml#L127-L131
+    # https://github.com/latex-lsp/texlab/blob/v5.3.0/.github/workflows/publish.yml#L127-L131
     help2man --no-info "$out/bin/texlab" > texlab.1
     installManPage texlab.1
   '';
diff --git a/pkgs/development/tools/nodenv/default.nix b/pkgs/development/tools/nodenv/default.nix
index d1e38d7bda74..657492966cf2 100644
--- a/pkgs/development/tools/nodenv/default.nix
+++ b/pkgs/development/tools/nodenv/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "nodenv";
-  version = "1.4.0";
+  version = "1.4.1";
 
   src = fetchFromGitHub {
     owner = "nodenv";
     repo = "nodenv";
     rev = "v${version}";
-    sha256 = "0fgc23jd95rjll3dy5hnli8ksfc7rwscw53sdgss4yaharwlg8l2";
+    sha256 = "sha256-S7Uld7wiVJjwuvfupBodIAIOO2c/ywEmFfhEHVOCcCc=";
   };
 
   buildPhase = ''
@@ -39,6 +39,6 @@ stdenv.mkDerivation rec {
     changelog = "https://github.com/nodenv/nodenv/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ alexnortung ];
-    platforms = [ "x86_64-linux" ];
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/tools/opcr-policy/default.nix b/pkgs/development/tools/opcr-policy/default.nix
index f3e8c942bf24..919c8c0a48b8 100644
--- a/pkgs/development/tools/opcr-policy/default.nix
+++ b/pkgs/development/tools/opcr-policy/default.nix
@@ -5,15 +5,15 @@
 
 buildGoModule rec {
   pname = "opcr-policy";
-  version = "0.1.47";
+  version = "0.1.50";
 
   src = fetchFromGitHub {
     owner = "opcr-io";
     repo = "policy";
     rev = "v${version}";
-    sha256 = "sha256-HjoVD3GLNg1jdCPMwEUJR/0BLJexbVxacVfmIm/P4SI=";
+    sha256 = "sha256-u7epE09WcbXAX1W+zkCOTDECnBTIOFC3gjNowtpuYtI=";
   };
-  vendorHash = "sha256-/wTLnJ3l22owDL5dFR9H/QN3UItxP7QQgU/NcmzBL6U=";
+  vendorHash = "sha256-QoD6J+is+InumLiFdbL/y1tuWwBCdBebx6RrIZ4Irik=";
 
   ldflags = [ "-s" "-w" "-X github.com/opcr-io/policy/pkg/version.ver=${version}" ];
 
diff --git a/pkgs/games/blightmud/default.nix b/pkgs/games/blightmud/default.nix
index cd37385585da..87eac661c890 100644
--- a/pkgs/games/blightmud/default.nix
+++ b/pkgs/games/blightmud/default.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "blightmud";
-  version = "5.0.0";
+  version = "5.1.0";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-AGKlkNpNdyD2cJGs350/076Qd/8M/nmRAaHJyefFRgw=";
+    sha256 = "sha256-0cvMROnblt9c4d6Kbr5iY/Qobf3hOKIhWHvOVQONhO4=";
   };
 
-  cargoSha256 = "sha256-RI0J60DCspJ501VR3TpqD6pjzO6//Qq1NgQb45d32ks=";
+  cargoSha256 = "sha256-7jSuadpAZXtlYVw4/NBATTIAFO8M6I11FuxfGFQx51Y=";
 
   buildFeatures = lib.optional withTTS "tts";
 
diff --git a/pkgs/os-specific/darwin/sketchybar/default.nix b/pkgs/os-specific/darwin/sketchybar/default.nix
index 57feb54614a0..ef5524653529 100644
--- a/pkgs/os-specific/darwin/sketchybar/default.nix
+++ b/pkgs/os-specific/darwin/sketchybar/default.nix
@@ -10,13 +10,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "sketchybar";
-  version = "2.13.2";
+  version = "2.14.1";
 
   src = fetchFromGitHub {
     owner = "FelixKratz";
     repo = "SketchyBar";
     rev = "v${version}";
-    sha256 = "sha256-EPpD1QuJXFFwWcs1gmhjf9zm6mkEM72Zr8NOAAgxI4I=";
+    hash = "sha256-TTpOFupLyCko5+EZJ3kJWu6OD35qfLpM8N7zq+eMvMM=";
   };
 
   buildInputs = [ Carbon Cocoa DisplayServices SkyLight ];
diff --git a/pkgs/os-specific/linux/semodule-utils/default.nix b/pkgs/os-specific/linux/semodule-utils/default.nix
index 999a4b2578ee..e6b8e778a77a 100644
--- a/pkgs/os-specific/linux/semodule-utils/default.nix
+++ b/pkgs/os-specific/linux/semodule-utils/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "semodule-utils";
-  version = "3.4";
+  version = "3.5";
 
   inherit (libsepol) se_url;
 
   src = fetchurl {
     url = "${se_url}/${version}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-sMrGZfLTjx+pu82A6jQYyE3YImkqmEdRdv8iyS+zjTo=";
+    sha256 = "sha256-yaVQpzcFHrrywQL2ZcfsL4XnIyhwmAqgBnmYRZtBQoM=";
   };
 
   buildInputs = [ libsepol ];
diff --git a/pkgs/servers/http/dufs/default.nix b/pkgs/servers/http/dufs/default.nix
index e7229a3d3a67..00017e753e7f 100644
--- a/pkgs/servers/http/dufs/default.nix
+++ b/pkgs/servers/http/dufs/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "dufs";
-  version = "0.31.0";
+  version = "0.32.0";
 
   src = fetchFromGitHub {
     owner = "sigoden";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-fR3CeF+ScvDoPJaevAAShUdZDDjD/ocZQl7dIk2jHso=";
+    sha256 = "sha256-kUKqZEphEohBR8f6Y5j5QEFeLI14iaivKWVPimSiLkg=";
   };
 
-  cargoSha256 = "sha256-VH/eu0qLh59J6uyj0RSqqEhlwghYg/JPp6u54BQzLPo=";
+  cargoHash = "sha256-rqMrsll82Ij0ZwYKJuC4st9sNrGFYB3x44vAOcUTtHQ=";
 
   nativeBuildInputs = lib.optionals stdenv.isLinux [
     pkg-config
diff --git a/pkgs/servers/misc/virtiofsd/default.nix b/pkgs/servers/misc/virtiofsd/default.nix
index 383b008962af..312c2a475a64 100644
--- a/pkgs/servers/misc/virtiofsd/default.nix
+++ b/pkgs/servers/misc/virtiofsd/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "virtiofsd";
-  version = "1.5.0";
+  version = "1.5.1";
 
   src = fetchFromGitLab {
     owner = "virtio-fs";
     repo = "virtiofsd";
     rev = "v${version}";
-    sha256 = "sha256-jDjP0sHzKHvat/2x6/vhi/ZtdooK3y5wDRujPgi+T4E=";
+    sha256 = "sha256-FQKZVkPD4DQKMduWW2g9vD1vvaFlU6QpNEj+g3yeE2Q=";
   };
 
-  cargoSha256 = "sha256-VFOLNl9kh1EjJaWr3chjyFJqF81vNeqbVqtVElCkZyY=";
+  cargoHash = "sha256-scKbu69lrEfUpErs6gZyZOGb3OwCzDThbs6O0ZtJX/8=";
 
   LIBCAPNG_LIB_PATH = "${lib.getLib libcap_ng}/lib";
   LIBCAPNG_LINK_TYPE =
diff --git a/pkgs/servers/shairport-sync/default.nix b/pkgs/servers/shairport-sync/default.nix
index dbe478568ac6..5bfe05a86dff 100644
--- a/pkgs/servers/shairport-sync/default.nix
+++ b/pkgs/servers/shairport-sync/default.nix
@@ -1,58 +1,106 @@
-{ lib, stdenv, fetchFromGitHub
-, autoreconfHook, pkg-config
-, openssl, avahi, alsa-lib, glib, libdaemon, popt, libconfig, libpulseaudio, soxr
-, enableDbus ? stdenv.isLinux
+{ lib
+, stdenv
+, fetchFromGitHub
+, autoreconfHook
+, pkg-config
+, openssl_1_1
+, avahi
+, alsa-lib
+, libplist
+, glib
+, libdaemon
+, libsodium
+, libgcrypt
+, ffmpeg
+, libuuid
+, unixtools
+, popt
+, libconfig
+, libpulseaudio
+, libjack2
+, pipewire
+, soxr
+, enableAirplay2 ? false
+, enableStdout ? true
+, enableAlsa ? true
+, enablePulse ? true
+, enablePipe ? true
+, enablePipewire ? true
+, enableJack ? true
 , enableMetadata ? false
 , enableMpris ? stdenv.isLinux
+, enableDbus ? stdenv.isLinux
+, enableSoxr ? true
+, enableLibdaemon ? false
 }:
 
-with lib;
 stdenv.mkDerivation rec {
-  version = "3.3.9";
+  version = "4.1.1";
   pname = "shairport-sync";
 
   src = fetchFromGitHub {
-    sha256 = "sha256-JLgnsLjswj0qus1Vd5ZtPQbbIp3dp2pI7OfQG4JrdW8=";
     rev = version;
     repo = "shairport-sync";
     owner = "mikebrady";
+    hash = "sha256-EKt5mH9GmzeR4zdPDFOt26T9STpG1khVrY4DFIv5Maw=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
 
-  buildInputs = [
-    openssl
+  buildInputs = with lib; [
+    openssl_1_1
     avahi
-    alsa-lib
-    libdaemon
     popt
     libconfig
-    libpulseaudio
-    soxr
-  ] ++ optional stdenv.isLinux glib;
+  ]
+  ++ optional enableLibdaemon libdaemon
+  ++ optional enableAlsa alsa-lib
+  ++ optional enablePulse libpulseaudio
+  ++ optional enablePipewire pipewire
+  ++ optional enableJack libjack2
+  ++ optional enableSoxr soxr
+  ++ optionals enableAirplay2 [
+    libplist
+    libsodium
+    libgcrypt
+    libuuid
+    ffmpeg
+    unixtools.xxd
+  ]
+  ++ optional stdenv.isLinux glib;
 
-  prePatch = ''
+  postPatch = ''
     sed -i -e 's/G_BUS_TYPE_SYSTEM/G_BUS_TYPE_SESSION/g' dbus-service.c
     sed -i -e 's/G_BUS_TYPE_SYSTEM/G_BUS_TYPE_SESSION/g' mpris-service.c
   '';
 
   enableParallelBuilding = true;
 
-  configureFlags = [
-    "--with-alsa" "--with-pipe" "--with-pa" "--with-stdout"
-    "--with-avahi" "--with-ssl=openssl" "--with-soxr"
+  configureFlags = with lib; [
     "--without-configfiles"
     "--sysconfdir=/etc"
+    "--with-ssl=openssl"
+    "--with-stdout"
+    "--with-avahi"
   ]
-    ++ optional enableDbus "--with-dbus-interface"
-    ++ optional enableMetadata "--with-metadata"
-    ++ optional enableMpris "--with-mpris-interface";
+  ++ optional enablePulse "--with-pa"
+  ++ optional enablePipewire "--with-pw"
+  ++ optional enableAlsa "--with-alsa"
+  ++ optional enableJack "--with-jack"
+  ++ optional enableStdout "--with-stdout"
+  ++ optional enablePipe "--with-pipe"
+  ++ optional enableSoxr "--with-soxr"
+  ++ optional enableDbus "--with-dbus-interface"
+  ++ optional enableMetadata "--with-metadata"
+  ++ optional enableMpris "--with-mpris-interface"
+  ++ optional enableLibdaemon "--with-libdaemon"
+  ++ optional enableAirplay2 "--with-airplay-2";
 
   meta = with lib; {
-    inherit (src.meta) homepage;
+    homepage = "https://github.com/mikebrady/shairport-sync";
     description = "Airtunes server and emulator with multi-room capabilities";
     license = licenses.mit;
-    maintainers =  with maintainers; [ lnl7 ];
+    maintainers = with maintainers; [ lnl7 jordanisaacs ];
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/servers/snappymail/default.nix b/pkgs/servers/snappymail/default.nix
index 89924ffd8343..4309aaadf9db 100644
--- a/pkgs/servers/snappymail/default.nix
+++ b/pkgs/servers/snappymail/default.nix
@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation rec {
   pname = "snappymail";
-  version = "2.26.0";
+  version = "2.26.3";
 
   src = fetchurl {
     url = "https://github.com/the-djmaze/snappymail/releases/download/v${version}/snappymail-${version}.tar.gz";
-    sha256 = "sha256-CNT03pqk0viHymLcmuhb25io9V3cL29y30Bz4TJ9jJY=";
+    sha256 = "sha256-kNfFQnUFfIS9x6da0nmm4cHK16ZTScQXOa7lL6QFBDQ=";
   };
 
   sourceRoot = "snappymail";
diff --git a/pkgs/servers/web-apps/hedgedoc/default.nix b/pkgs/servers/web-apps/hedgedoc/default.nix
index 8b270883050a..d2b57a96e702 100644
--- a/pkgs/servers/web-apps/hedgedoc/default.nix
+++ b/pkgs/servers/web-apps/hedgedoc/default.nix
@@ -12,14 +12,14 @@
 
 mkYarnPackage rec {
   pname = "hedgedoc";
-  version = "1.9.6";
+  version = "1.9.7";
 
   # we use the upstream compiled js files because yarn2nix cannot handle different versions of dependencies
   # in development and production and the web assets muts be compiled with js-yaml 3 while development
   # uses js-yaml 4 which breaks the text editor
   src = fetchzip {
     url = "https://github.com/hedgedoc/hedgedoc/releases/download/${version}/hedgedoc-${version}.tar.gz";
-    hash = "sha256-NoA4mv9LyvShr4fdfBSHgDoyxY59ubRC8YC6hvOimZc=";
+    hash = "sha256-tPkhnnKDS5TICsW66YCOy7xWFj5usLyDMbYMYQ3Euoc=";
   };
 
   nativeBuildInputs = [ which makeWrapper ];
@@ -30,7 +30,7 @@ mkYarnPackage rec {
 
   offlineCache = fetchYarnDeps {
     yarnLock = src + "/yarn.lock";
-    sha256 = "1xxq02mgys3bp7ivgsr9hyafd866ygw2bp3rbld2500afvayz89v";
+    sha256 = "0qkc26ks33vy00jgpv4445wzgxx1mzi70pkm1l8y9amgd9wf9aig";
   };
 
   configurePhase = ''
@@ -78,7 +78,7 @@ mkYarnPackage rec {
     description = "Realtime collaborative markdown notes on all platforms";
     license = licenses.agpl3;
     homepage = "https://hedgedoc.org";
-    maintainers = with maintainers; [ willibutz SuperSandro2000 ];
+    maintainers = with maintainers; [ SuperSandro2000 ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/servers/web-apps/hedgedoc/package.json b/pkgs/servers/web-apps/hedgedoc/package.json
index fa874dfe9378..68c35025eded 100644
--- a/pkgs/servers/web-apps/hedgedoc/package.json
+++ b/pkgs/servers/web-apps/hedgedoc/package.json
@@ -1,6 +1,6 @@
 {
   "name": "HedgeDoc",
-  "version": "1.9.6",
+  "version": "1.9.7",
   "description": "The best platform to write and share markdown.",
   "main": "app.js",
   "license": "AGPL-3.0",
@@ -27,6 +27,7 @@
     "body-parser": "^1.15.2",
     "chance": "^1.0.4",
     "cheerio": "^0.22.0",
+    "clean-webpack-plugin": "^4.0.0",
     "compression": "^1.6.2",
     "connect-flash": "^0.1.1",
     "connect-session-sequelize": "^7.1.2",
@@ -68,7 +69,7 @@
     "minio": "7.0.32",
     "moment": "^2.17.1",
     "morgan": "^1.7.0",
-    "mysql2": "^2.0.0",
+    "mysql2": "^3.0.0",
     "node-fetch": "^2.6.1",
     "passport": "^0.6.0",
     "passport-dropbox-oauth2": "^1.1.0",
@@ -89,7 +90,8 @@
     "prometheus-api-metrics": "^3.2.0",
     "randomcolor": "^0.6.0",
     "readline-sync": "^1.4.7",
-    "rimraf": "^3.0.2",
+    "rimraf": "^4.0.0",
+    "sanitize-filename": "^1.6.3",
     "scrypt-kdf": "^2.0.1",
     "sequelize": "^5.21.1",
     "shortid": "2.2.16",
@@ -134,7 +136,7 @@
     "url": "https://github.com/hedgedoc/hedgedoc.git"
   },
   "devDependencies": {
-    "abcjs": "6.1.6",
+    "abcjs": "6.1.9",
     "babel-cli": "6.26.0",
     "babel-core": "6.26.3",
     "babel-loader": "7.1.5",
@@ -144,16 +146,16 @@
     "babel-runtime": "6.26.0",
     "bootstrap": "3.4.1",
     "bootstrap-validator": "0.11.9",
-    "codemirror": "git+https://github.com/hedgedoc/CodeMirror.git",
+    "codemirror": "git+https://github.com/hedgedoc/CodeMirror.git#hedgedoc/1.9.7",
     "copy-webpack-plugin": "6.4.1",
     "css-loader": "5.2.7",
     "emojify.js": "1.1.0",
-    "esbuild-loader": "2.20.0",
+    "esbuild-loader": "3.0.1",
     "escape-html": "1.0.3",
-    "eslint": "8.27.0",
+    "eslint": "8.34.0",
     "eslint-config-standard": "17.0.0",
-    "eslint-plugin-import": "2.26.0",
-    "eslint-plugin-n": "15.5.0",
+    "eslint-plugin-import": "2.27.5",
+    "eslint-plugin-n": "15.6.1",
     "eslint-plugin-node": "11.1.0",
     "eslint-plugin-promise": "6.1.1",
     "eslint-plugin-standard": "4.1.0",
@@ -168,7 +170,7 @@
     "html-webpack-plugin": "4.5.2",
     "imports-loader": "1.2.0",
     "ionicons": "2.0.1",
-    "jquery": "3.6.1",
+    "jquery": "3.6.3",
     "jquery-mousewheel": "3.1.13",
     "jquery-ui": "1.13.2",
     "js-cookie": "3.0.1",
@@ -182,7 +184,7 @@
     "mathjax": "2.7.9",
     "mermaid": "9.1.7",
     "mini-css-extract-plugin": "1.6.2",
-    "mocha": "10.1.0",
+    "mocha": "10.2.0",
     "mock-require": "3.0.3",
     "optimize-css-assets-webpack-plugin": "6.0.1",
     "prismjs": "1.29.0",
@@ -206,6 +208,6 @@
   },
   "optionalDependencies": {
     "bufferutil": "^4.0.0",
-    "utf-8-validate": "^5.0.1"
+    "utf-8-validate": "^6.0.0"
   }
 }
diff --git a/pkgs/tools/filesystems/apfs-fuse/default.nix b/pkgs/tools/filesystems/apfs-fuse/default.nix
index b5d08770ed78..4abea4a24236 100644
--- a/pkgs/tools/filesystems/apfs-fuse/default.nix
+++ b/pkgs/tools/filesystems/apfs-fuse/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation {
   pname = "apfs-fuse-unstable";
-  version = "2020-09-28";
+  version = "2023-01-04";
 
   src = fetchFromGitHub {
     owner  = "sgan81";
     repo   = "apfs-fuse";
-    rev    = "ee71aa5c87c0831c1ae17048951fe9cd7579c3db";
-    sha256 = "0wvsx708km1lnhghny5y69k694x0zy8vlbndswkb7sq81j1r6kwx";
+    rev    = "1f041d7af5df5423832e54e9f358fd9234773fcc";
+    hash = "sha256-EmhCvIwyVJvib/ZHzCsULh8bOjhzKRu47LojX+L40qQ=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/tools/misc/asdf-vm/default.nix b/pkgs/tools/misc/asdf-vm/default.nix
index 17e3dc37a5e6..89f76afbbc5e 100644
--- a/pkgs/tools/misc/asdf-vm/default.nix
+++ b/pkgs/tools/misc/asdf-vm/default.nix
@@ -37,13 +37,13 @@ ${asdfReshimFile}
   '';
 in stdenv.mkDerivation rec {
   pname = "asdf-vm";
-  version = "0.11.1";
+  version = "0.11.2";
 
   src = fetchFromGitHub {
     owner = "asdf-vm";
     repo = "asdf";
     rev = "v${version}";
-    sha256 = "sha256-SCMDf+yEJNDIeF2EqGkgfA+xJek1OmMysxolBdIEnUM=";
+    sha256 = "sha256-ZNmqWDjPEtmQhDUTkTw0Gy2pox1PyRK4U9Q0vxjZSlw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/misc/otel-cli/default.nix b/pkgs/tools/misc/otel-cli/default.nix
index 251cf113c4e8..b9efcd250286 100644
--- a/pkgs/tools/misc/otel-cli/default.nix
+++ b/pkgs/tools/misc/otel-cli/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "otel-cli";
-  version = "0.1.0";
+  version = "0.2.0";
 
   src = fetchFromGitHub {
     owner = "equinix-labs";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-iYlyokBAS5KQUYq83zhKWH/Vulq7prQdceFpeBJN2PI=";
+    hash = "sha256-hez/jHet7W4FnOjgLb0jE1FhoNimiLGaOuTI44UWbSA=";
   };
 
-  vendorHash = "sha256-5c5uDp5KVo/DYAM5F76ivtT52+lNBheVmjAjmq6EJFk=";
+  vendorHash = "sha256-gVRgqBgiFnPU6MRZi/Igs7nDPMwJYsdln7vPAcxTvPU=";
 
   preCheck = ''
     ln -s $GOPATH/bin/otel-cli .
diff --git a/pkgs/tools/misc/trashy/default.nix b/pkgs/tools/misc/trashy/default.nix
index fb42a886fee5..edaf1893f326 100644
--- a/pkgs/tools/misc/trashy/default.nix
+++ b/pkgs/tools/misc/trashy/default.nix
@@ -1,21 +1,15 @@
-{ lib, fetchFromGitHub, rustPlatform, installShellFiles }:
+{ lib, rustPlatform, fetchCrate, installShellFiles }:
 
 rustPlatform.buildRustPackage rec {
   pname = "trashy";
   version = "2.0.0";
 
-  src = fetchFromGitHub {
-    owner = "oberblastmeister";
-    repo = "trashy";
-    rev = "v${version}";
-    sha256 = "sha256-xYSk0M8oNwbwZbKWDXMQlnt7vKi0p3+2Tr4eXCvtHEM=";
+  src = fetchCrate {
+    inherit pname version;
+    hash = "sha256-1xHyhAV8hpgMngQdamRzEliyG60t+I3KfsDJi0+180o=";
   };
 
-  cargoSha256 = "sha256-ZWqWtWzb+CLH1ravBb/oV+aPxplEyiC1wEFhvchcLqg=";
-
-  # this patch must be removed after oberblastmeister/trashy#70 is solved or new
-  # version is released.
-  cargoPatches = [ ./lock-version.patch ];
+  cargoHash = "sha256-ZWqWtWzb+CLH1ravBb/oV+aPxplEyiC1wEFhvchcLqg=";
 
   nativeBuildInputs = [ installShellFiles ];
 
@@ -27,9 +21,11 @@ rustPlatform.buildRustPackage rec {
   '';
 
   meta = with lib; {
-    description = "A simple, fast, and featureful alternative to rm and trash-cli.";
+    description = "A simple, fast, and featureful alternative to rm and trash-cli";
     homepage = "https://github.com/oberblastmeister/trashy";
+    changelog = "https://github.com/oberblastmeister/trashy/blob/v${version}/CHANGELOG.md";
     license = with licenses; [ asl20 /* or */ mit ];
     maintainers = with maintainers; [ oberblastmeister ];
+    mainProgram = "trash";
   };
 }
diff --git a/pkgs/tools/misc/trashy/lock-version.patch b/pkgs/tools/misc/trashy/lock-version.patch
deleted file mode 100644
index 3e95a3fbfdda..000000000000
--- a/pkgs/tools/misc/trashy/lock-version.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/Cargo.lock b/Cargo.lock
-index 7af0268..dc197a0 100644
---- a/Cargo.lock
-+++ b/Cargo.lock
-@@ -889,7 +889,7 @@ dependencies = [
- 
- [[package]]
- name = "trashy"
--version = "1.0.3"
-+version = "2.0.0"
- dependencies = [
-  "aho-corasick",
-  "ansi_term",
diff --git a/pkgs/tools/networking/haproxy/default.nix b/pkgs/tools/networking/haproxy/default.nix
index 1453fea66f53..7e9cec19de02 100644
--- a/pkgs/tools/networking/haproxy/default.nix
+++ b/pkgs/tools/networking/haproxy/default.nix
@@ -11,11 +11,11 @@ assert usePcre -> pcre != null;
 
 stdenv.mkDerivation rec {
   pname = "haproxy";
-  version = "2.7.2";
+  version = "2.7.3";
 
   src = fetchurl {
     url = "https://www.haproxy.org/download/${lib.versions.majorMinor version}/src/${pname}-${version}.tar.gz";
-    sha256 = "sha256-Y7xuwDAtDrvh+nacGWBmQN6DSsjLB0R7gHmctWPcDz8=";
+    sha256 = "sha256-sX5RuWUxhDtKmdLDtiGCgbyYi/Ykyf+Q4Z8MvLol0Gc=";
   };
 
   buildInputs = [ openssl zlib libxcrypt ]
diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix
index b0b4c61ee158..365ec641c138 100644
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@@ -110,8 +110,8 @@ in lib.makeExtensible (self: {
   };
 
   nix_2_12 = common {
-    version = "2.12.0";
-    sha256 = "sha256-sQ9C101CL/eVN5JgH91ozHFWU4+bXr8/Fi/8NQk6xRI=";
+    version = "2.12.1";
+    sha256 = "sha256-GmHKhq0uFtdOiJnuBwj2YwlZjvh6YTkfQZgeu4e0dLU=";
     patches = [
       ./patches/flaky-tests.patch
       patch-monitorfdhup
@@ -120,8 +120,8 @@ in lib.makeExtensible (self: {
   };
 
   nix_2_13 = common {
-    version = "2.13.2";
-    sha256 = "sha256-MtVatZVsV+dtjdD4AC4bztrnDFas+WZYHzQMt41FwzU=";
+    version = "2.13.3";
+    sha256 = "sha256-jUc2ccTR8f6MGY2pUKgujm+lxSPNGm/ZAP+toX+nMNc=";
   };
 
   stable = self.nix_2_13;
diff --git a/pkgs/tools/security/cosign/default.nix b/pkgs/tools/security/cosign/default.nix
index 8b326d5163ce..2fcde94f9003 100644
--- a/pkgs/tools/security/cosign/default.nix
+++ b/pkgs/tools/security/cosign/default.nix
@@ -72,6 +72,6 @@ buildGoModule rec {
     changelog = "https://github.com/sigstore/cosign/releases/tag/v${version}";
     description = "Container Signing CLI with support for ephemeral keys and Sigstore signing";
     license = licenses.asl20;
-    maintainers = with maintainers; [ lesuisse jk ];
+    maintainers = with maintainers; [ lesuisse jk developer-guy ];
   };
 }
diff --git a/pkgs/tools/security/rng-tools/default.nix b/pkgs/tools/security/rng-tools/default.nix
index d4fb4676e4ae..ec7a387af244 100644
--- a/pkgs/tools/security/rng-tools/default.nix
+++ b/pkgs/tools/security/rng-tools/default.nix
@@ -12,7 +12,7 @@
   # https://www.nist.gov/programs-projects/nist-randomness-beacon
 , curl, jansson, libxml2, withNistBeacon ? false
 , libp11, opensc, withPkcs11 ? true
-, librtlsdr, withRtlsdr ? true
+, rtl-sdr, withRtlsdr ? true
 }:
 
 stdenv.mkDerivation rec {
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
     ++ lib.optionals withJitterEntropy [ jitterentropy ]
     ++ lib.optionals withNistBeacon    [ curl jansson libxml2 ]
     ++ lib.optionals withPkcs11        [ libp11 libp11.passthru.openssl ]
-    ++ lib.optionals withRtlsdr        [ librtlsdr ];
+    ++ lib.optionals withRtlsdr        [ rtl-sdr ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index da8ee1258674..8408376bf706 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -4040,6 +4040,8 @@ with pkgs;
 
   clash-meta = callPackage ../tools/networking/clash-meta { };
 
+  clash-verge = callPackage ../applications/networking/clash-verge { };
+
   clevercsv = with python3Packages; toPythonApplication clevercsv;
 
   clevis = callPackage ../tools/security/clevis {
@@ -18663,7 +18665,7 @@ with pkgs;
   slimerjs = callPackage ../development/tools/slimerjs {};
 
   slint-lsp = callPackage ../development/tools/misc/slint-lsp {
-    inherit (darwin.apple_sdk.frameworks) AppKit CoreGraphics CoreServices CoreText Foundation OpenGL;
+    inherit (darwin.apple_sdk_11_0.frameworks) AppKit CoreGraphics CoreServices CoreText Foundation OpenGL;
   };
 
   sloccount = callPackage ../development/tools/misc/sloccount { };
@@ -23767,7 +23769,7 @@ with pkgs;
   vte = callPackage ../development/libraries/vte {
     # Needs GCC ≥10 but aarch64 defaults to GCC 9.
     stdenv =
-      if stdenv.isLinux && stdenv.isAarch64 && stdenv.cc.isGNU
+      if stdenv.isLinux && stdenv.isAarch64 && stdenv.cc.isGNU && lib.versionOlder stdenv.cc.version "10"
       then clangStdenv
       else stdenv;
   };
@@ -36697,18 +36699,19 @@ with pkgs;
 
   lie = callPackage ../applications/science/math/LiE { };
 
-  magma = callPackage ../development/libraries/science/math/magma {
+  inherit (callPackage ../development/libraries/science/math/magma {
     inherit (llvmPackages_rocm) openmp;
-  };
+  }) magma magma_2_7_1 magma_2_6_2;
 
   magma-cuda = magma.override {
-    useCUDA = true;
-    useROCM = false;
+    cudaSupport = true;
+    rocmSupport = false;
   };
 
-  magma-hip = magma.override {
-    useCUDA = false;
-    useROCM = true;
+  # TODO:AMD won't compile with anything newer than 2.6.2 -- it fails at the linking stage.
+  magma-hip = magma_2_6_2.override {
+    cudaSupport = false;
+    rocmSupport = true;
   };
 
   clmagma = callPackage ../development/libraries/science/math/clmagma { };