diff --git a/pkgs/applications/graphics/drawing/default.nix b/pkgs/applications/graphics/drawing/default.nix
index 40c651ac2570..cd92a0d39ec7 100644
--- a/pkgs/applications/graphics/drawing/default.nix
+++ b/pkgs/applications/graphics/drawing/default.nix
@@ -1,5 +1,6 @@
 { lib
 , fetchFromGitHub
+, fetchpatch
 , meson
 , ninja
 , pkg-config
@@ -29,6 +30,16 @@ python3.pkgs.buildPythonApplication rec {
     sha256 = "sha256-qNaljtuA5E/QaLJ9QILPRQCqOvKmX4ZGq/0z5unA8KA=";
   };
 
+  patches = [
+    # Fix build with meson 0.61, can be removed on next update.
+    # https://github.com/NixOS/nixpkgs/issues/167584
+    (fetchpatch {
+      url = "https://github.com/maoschanz/drawing/commit/6dd271089af76b69322500778e3ad6615a117dcc.patch";
+      sha256 = "sha256-4pKWm3LYstVxZ4+gGsZDfM4K+7WBY8EYjylzc/CQZmo=";
+      includes = [ "data/meson.build" "help/meson.build" ];
+    })
+  ];
+
   nativeBuildInputs = [
     appstream-glib
     desktop-file-utils
diff --git a/pkgs/applications/misc/index-fm/default.nix b/pkgs/applications/misc/index-fm/default.nix
index 4ab933aefe07..7414fb2a7e29 100644
--- a/pkgs/applications/misc/index-fm/default.nix
+++ b/pkgs/applications/misc/index-fm/default.nix
@@ -3,7 +3,6 @@
 , fetchFromGitLab
 , cmake
 , extra-cmake-modules
-, applet-window-buttons
 , karchive
 , kcoreaddons
 , ki18n
@@ -38,7 +37,6 @@ mkDerivation rec {
   ];
 
   buildInputs = [
-    applet-window-buttons
     karchive
     kcoreaddons
     ki18n
diff --git a/pkgs/applications/misc/obsidian/default.nix b/pkgs/applications/misc/obsidian/default.nix
index 3dad5c846952..ce95cf8f306e 100644
--- a/pkgs/applications/misc/obsidian/default.nix
+++ b/pkgs/applications/misc/obsidian/default.nix
@@ -2,7 +2,7 @@
 , fetchurl
 , lib
 , makeWrapper
-, electron_16
+, electron_17
 , makeDesktopItem
 , graphicsmagick
 , writeScript
@@ -49,7 +49,7 @@ let
     installPhase = ''
       runHook preInstall
       mkdir -p $out/bin
-      makeWrapper ${electron_16}/bin/electron $out/bin/obsidian \
+      makeWrapper ${electron_17}/bin/electron $out/bin/obsidian \
         --add-flags $out/share/obsidian/app.asar
       install -m 444 -D resources/app.asar $out/share/obsidian/app.asar
       install -m 444 -D resources/obsidian.asar $out/share/obsidian/obsidian.asar
diff --git a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
index 72bd18163e68..64586dcd70ef 100644
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
@@ -24,7 +24,7 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "signal-desktop";
-  version = "5.37.0"; # Please backport all updates to the stable channel.
+  version = "5.38.0"; # Please backport all updates to the stable channel.
   # All releases have a limited lifetime and "expire" 90 days after the release.
   # When releases "expire" the application becomes unusable until an update is
   # applied. The expiration date for the current release can be extracted with:
@@ -34,7 +34,7 @@ in stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://updates.signal.org/desktop/apt/pool/main/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-    sha256 = "sha256-hnRS/7CZPk1bbBjpHLAywKVu2u7jgg3p5/pxEdkzMJ8=";
+    sha256 = "sha256-PmeJ6ZNjQjxuPl1UqunQT0q6uUZxt5gDFJS/WCcHE68=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/data/fonts/material-design-icons/default.nix b/pkgs/data/fonts/material-design-icons/default.nix
index 1bf5c6aa4820..80c887f58913 100644
--- a/pkgs/data/fonts/material-design-icons/default.nix
+++ b/pkgs/data/fonts/material-design-icons/default.nix
@@ -1,7 +1,7 @@
 { lib, fetchFromGitHub }:
 
 let
-  version = "5.3.45";
+  version = "6.6.96";
 in fetchFromGitHub {
   name = "material-design-icons-${version}";
   owner  = "Templarian";
@@ -16,7 +16,7 @@ in fetchFromGitHub {
     cp fonts/*.woff $out/share/fonts/woff/
     cp fonts/*.woff2 $out/share/fonts/woff2/
   '';
-  sha256 = "1nwha6dbj97ybiwlf69la57l3ibmwgnzs0nr104bfqnqxjs471sx";
+  sha256 = "sha256-rfDb9meTF0Y0kiCQd11SgnntQnw34Ti/IXn35xaPO1M=";
 
   meta = with lib; {
     description = "4600+ Material Design Icons from the Community";
@@ -26,10 +26,7 @@ in fetchFromGitHub {
       color and size they need for any project.
     '';
     homepage = "https://materialdesignicons.com";
-    license = with licenses; [
-      asl20  # for icons from: https://github.com/google/material-design-icons
-      ofl
-    ];
+    license = licenses.asl20;
     platforms = platforms.all;
     maintainers = with maintainers; [ vlaci ];
   };
diff --git a/pkgs/desktops/gnome/core/gnome-initial-setup/default.nix b/pkgs/desktops/gnome/core/gnome-initial-setup/default.nix
index 7f6724ce63ae..d2efa4d6e2a6 100644
--- a/pkgs/desktops/gnome/core/gnome-initial-setup/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-initial-setup/default.nix
@@ -36,11 +36,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-initial-setup";
-  version = "42.0.1";
+  version = "42.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "/PQ/L75NwEw6wq5QVjP+se8w2nDKleq8YeIAaxkuXlU=";
+    sha256 = "hmE2yjKSL3zEJNOtxrHbp86+B6qWoZ+XyAdw4/Lupxs=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/applet-window-buttons/default.nix b/pkgs/development/libraries/applet-window-buttons/default.nix
index c58fb5bc240d..61187581e9aa 100644
--- a/pkgs/development/libraries/applet-window-buttons/default.nix
+++ b/pkgs/development/libraries/applet-window-buttons/default.nix
@@ -11,13 +11,13 @@
 
 mkDerivation rec {
   pname = "applet-window-buttons";
-  version = "0.10.1";
+  version = "0.11.1";
 
   src = fetchFromGitHub {
     owner = "psifidotos";
     repo = "applet-window-buttons";
     rev = version;
-    sha256 = "18h2g3jqzr88wkmws2iz71sgrz633zwkqvhn32sdi32sxxbrksgd";
+    hash = "sha256-Qww/22bEmjuq+R3o0UDcS6U+34qjaeSEy+g681/hcfE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/cloudflare/default.nix b/pkgs/development/python-modules/cloudflare/default.nix
index 4c4a6bccfcd9..e6498216aa03 100644
--- a/pkgs/development/python-modules/cloudflare/default.nix
+++ b/pkgs/development/python-modules/cloudflare/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "cloudflare";
-  version = "2.9.9";
+  version = "2.9.10";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-wou62Xro/hOU3pjGdJpe2kzY15+bcd14UOn4vsw9RcI=";
+    hash = "sha256-LsUMB0zqlelHqWsgdmJ8v+Qn/reYuxCTKTODBT9K0bg=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/scmrepo/default.nix b/pkgs/development/python-modules/scmrepo/default.nix
index 1d07c371ca2a..5d4a48411627 100644
--- a/pkgs/development/python-modules/scmrepo/default.nix
+++ b/pkgs/development/python-modules/scmrepo/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "scmrepo";
-  version = "0.0.16";
+  version = "0.0.17";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -22,8 +22,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "iterative";
     repo = pname;
-    rev = version;
-    hash = "sha256-gaZXQFZ1Vm8ruW42IXc6+fLA5856Oc0cGgtScwIr5f8=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-OMmVEBbb3BQcxpAg6+goGITu8iuHzg+ZzVs+8UdRFrg=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/tools/deadnix/default.nix b/pkgs/development/tools/deadnix/default.nix
index 34fb92973bc6..3de058fb70c3 100644
--- a/pkgs/development/tools/deadnix/default.nix
+++ b/pkgs/development/tools/deadnix/default.nix
@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "deadnix";
-  version = "0.1.3";
+  version = "0.1.5";
 
   src = fetchFromGitHub {
     owner = "astro";
     repo = "deadnix";
     rev = "v${version}";
-    sha256 = "0ddnxmcr9fncgrqg1vvqcbx49c3lccdpb40h9rvzyldzy9xynzi7";
+    sha256 = "1fyagp6m6adwfcisi1zvs5dflcvrmpx4q1fr8pqzb93zv4m3ar84";
   };
 
-  cargoSha256 = "19vgjv70vxgxssrxvdjwfl16bwdbdrpb2wzb3fg9vlz4fhbj2lv9";
+  cargoSha256 = "102akpvs2hvf5hl9rh5cspxzqly68wk7qhx0g1zhfp1ka58gnr4p";
 
   meta = with lib; {
     description = "Find and remove unused code in .nix source files";
diff --git a/pkgs/games/koules/default.nix b/pkgs/games/koules/default.nix
new file mode 100644
index 000000000000..e2c7c55cbb70
--- /dev/null
+++ b/pkgs/games/koules/default.nix
@@ -0,0 +1,76 @@
+{ stdenv
+, lib
+, fetchurl
+, fetchzip
+, makeDesktopItem
+, copyDesktopItems
+, imake
+, gccmakedep
+, libX11
+, libXext
+, installShellFiles
+}:
+
+let
+  debian-extras = fetchzip {
+    url = "mirror://debian/pool/main/k/koules/koules_1.4-27.debian.tar.xz";
+    sha256 = "0bq1rr6vxqmx2k0dhyrqnwwfiw4h2ycbj576v66vwr0jaq5plil3";
+  };
+in
+
+stdenv.mkDerivation rec {
+  pname = "koules";
+  version = "1.4";
+
+  src = fetchurl {
+    url = "https://www.ucw.cz/~hubicka/koules/packages/${pname}${version}-src.tar.gz";
+    sha256 = "06x2wkpns14kii9fxmxbmj5lma371qj00hgl7fc5kggfmzz96vy3";
+  };
+
+  nativeBuildInputs = [ imake gccmakedep installShellFiles copyDesktopItems ];
+  buildInputs = [ libX11 libXext ];
+
+  # Debian maintains lots of patches for koules. Let's include all of them.
+  prePatch = ''
+    patches="$patches $(cat ${debian-extras}/patches/series | sed 's|^|${debian-extras}/patches/|')"
+  '';
+
+  postPatch = ''
+    # We do not want to depend on that particular font to be available in the
+    # xserver, hence substitute it by a font which is always available
+    sed -ie 's:-schumacher-clean-bold-r-normal--8-80-75-75-c-80-\*iso\*:fixed:' xlib/init.c
+  '';
+
+  preBuild = ''
+    cp xkoules.6 xkoules.man  # else "make" will not succeed
+    sed -ie "s:^SOUNDDIR\s*=.*:SOUNDDIR=$out/lib:" Makefile
+    sed -ie "s:^KOULESDIR\s*=.*:KOULESDIR=$out:" Makefile
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm755 xkoules $out/bin/xkoules
+    install -Dm755 koules.sndsrv.linux $out/lib/koules.sndsrv.linux
+    install -m644 sounds/* $out/lib/
+    install -Dm644 Koules.xpm $out/share/pixmaps/koules.xpm
+    installManPage xkoules.6
+    runHook postInstall
+  '';
+
+  desktopItems = [ (makeDesktopItem {
+    desktopName = "Koules";
+    name = "koules";
+    exec = "xkoules";
+    icon = "koules";
+    comment = "Push your enemies away, but stay away from obstacles";
+    categories = [ "Game" "ArcadeGame" ];
+  }) ];
+
+  meta = with lib; {
+    description = "Fast arcade game based on the fundamental law of body attraction";
+    homepage = "https://www.ucw.cz/~hubicka/koules/English/";
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+    maintainers = [ maintainers.iblech ];
+  };
+}
diff --git a/pkgs/servers/dex/default.nix b/pkgs/servers/dex/default.nix
index c93f7316301b..92cf4cd66588 100644
--- a/pkgs/servers/dex/default.nix
+++ b/pkgs/servers/dex/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "dex";
-  version = "2.31.0";
+  version = "2.31.1";
 
   src = fetchFromGitHub {
     owner = "dexidp";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-tr7rs2ymHpMEtNwvLhgEzp94wO/k/oY814NS0N4ONsg=";
+    sha256 = "sha256-4BmZpN3k1qDYLdkXm4AX73bX5hBiyLv0nVKYVwD/HCM=";
   };
 
   vendorSha256 = "sha256-l+/qjYokg5zHAFkKxtkdX49HqVW6kfz7OHqs6SRKDYg=";
diff --git a/pkgs/tools/admin/aliyun-cli/default.nix b/pkgs/tools/admin/aliyun-cli/default.nix
index 58fb1bd27cd4..4ccb5c9fb954 100644
--- a/pkgs/tools/admin/aliyun-cli/default.nix
+++ b/pkgs/tools/admin/aliyun-cli/default.nix
@@ -2,17 +2,17 @@
 
 buildGoModule rec {
   pname = "aliyun-cli";
-  version = "3.0.113";
+  version = "3.0.115";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "aliyun";
     repo = pname;
     fetchSubmodules = true;
-    sha256 = "sha256-+ZbfWFAf7G5mwtSgfGe/oslqIbOqqiwdtP9mWx/3u4w=";
+    sha256 = "sha256-lWWycvzZaVoEzEHp392mEDGcrksC4Y9XjGZYeL9RY6s=";
   };
 
-  vendorSha256 = "sha256-FQvBq8+80h7m271gjraV445ayWcpkemOtVswfmHzUM0=";
+  vendorSha256 = "sha256-f3GXkAvTe8rPFWCR5TM4mDK/VOQWt2lrZrfJ/Wvw8Uc=";
 
   subPackages = [ "main" ];
 
diff --git a/pkgs/tools/admin/trivy/default.nix b/pkgs/tools/admin/trivy/default.nix
index 83bdea6d49ee..4dbc1c96bb9f 100644
--- a/pkgs/tools/admin/trivy/default.nix
+++ b/pkgs/tools/admin/trivy/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "trivy";
-  version = "0.25.2";
+  version = "0.25.3";
 
   src = fetchFromGitHub {
     owner = "aquasecurity";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-yDoHDOPtPX5u8K2/fnj6dgqlI+WUCsuxbdKtb/UtIRQ=";
+    sha256 = "sha256-TRcGUjmhV5vP3c4VeGfRtV+Fcnl/09HIQ+ojfAFWdm8=";
   };
 
-  vendorSha256 = "sha256-HZpGPCayrnayOg+3mB8Tw+5M2IfIpIvzP7qfY1OL7tk=";
+  vendorSha256 = "sha256-3rJj+LDHQPYpYsU52kldFFpgS7Ry1n5Kjy0IAK6q/vU=";
 
   excludedPackages = "misc";
 
diff --git a/pkgs/tools/misc/go.rice/default.nix b/pkgs/tools/misc/go.rice/default.nix
index f691221dd7be..771f3493157c 100644
--- a/pkgs/tools/misc/go.rice/default.nix
+++ b/pkgs/tools/misc/go.rice/default.nix
@@ -1,7 +1,7 @@
 { lib, buildGoModule, fetchFromGitHub }:
 
 buildGoModule rec {
-  pname = "go.rice";
+  pname = "go-rice";
   version = "1.0.2";
 
   src = fetchFromGitHub {
@@ -13,8 +13,6 @@ buildGoModule rec {
 
   vendorSha256 = "sha256-VlpdZcqg7yWUADN8oD/IAgAXVdzJeIeymx2Pu/7E21o=";
 
-  doCheck = false;
-
   subPackages = [ "." "rice" ];
 
   meta = with lib; {
@@ -24,4 +22,3 @@ buildGoModule rec {
     maintainers = with maintainers; [ blaggacao ];
   };
 }
-
diff --git a/pkgs/tools/security/fulcio/default.nix b/pkgs/tools/security/fulcio/default.nix
index 300b996524df..a9e48bdca097 100644
--- a/pkgs/tools/security/fulcio/default.nix
+++ b/pkgs/tools/security/fulcio/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "fulcio";
-  version = "0.2.0";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "sigstore";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-tCjFx9Ug8rO8cSxQb2vBG/MHSUJCx17lDeGnSGjZLcI=";
+    sha256 = "sha256-jcmjfNGruDhQPhVn5R2hdUr+d42qQnIVj8+CCX5HMMM=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -20,11 +20,13 @@ buildGoModule rec {
       find "$out" -name .git -print0 | xargs -0 rm -rf
     '';
   };
-  vendorSha256 = "sha256-CmtsReP0JacgNyRqCrYZRONwR5eluymrQgsj/ukhYNQ=";
+  vendorSha256 = "sha256-WQ0MuNEJWCxKTjkyqA66bGPoMrS/7W/YTiGU3yd+Ge8=";
 
   # install completions post-install
   nativeBuildInputs = [ installShellFiles ];
 
+  excludedPackages = [ "federation" "test/prometheus" ];
+
   ldflags = [
     "-s"
     "-w"
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index df45a0b496be..798747dbb8fe 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -31335,6 +31335,8 @@ with pkgs;
     useProprietaryAssets = false;
   };
 
+  koules = callPackage ../games/koules { };
+
   leela-zero = libsForQt5.callPackage ../games/leela-zero { };
 
   legendary-gl = python38Packages.callPackage ../games/legendary-gl { };