diff --git a/doc/builders/special/darwin-builder.section.md b/doc/builders/special/darwin-builder.section.md
index 205db14347aa..af9de5751b2c 100644
--- a/doc/builders/special/darwin-builder.section.md
+++ b/doc/builders/special/darwin-builder.section.md
@@ -39,7 +39,8 @@ nixos login:
 ```
 
 > Note: When you need to stop the VM, type `Ctrl`-`a` + `c` to open the `qemu`
-> prompt and then type `quit` followed by `Enter`
+> prompt and then type `system_powerdown` followed by `Enter`, or run `shutdown now`
+> as the `builder` user (e.g. `ssh -i keys/builder_ed25519 builder@localhost shutdown now`)
 
 To delegate builds to the remote builder, add the following options to your
 `nix.conf` file:
diff --git a/lib/systems/default.nix b/lib/systems/default.nix
index 4c1e9d9f2536..4a5e66caec7c 100644
--- a/lib/systems/default.nix
+++ b/lib/systems/default.nix
@@ -101,7 +101,14 @@ rec {
         }.${final.parsed.kernel.name} or null;
 
          # uname -m
-         processor = final.parsed.cpu.name;
+         processor =
+           if final.isPower64
+           then "ppc64${lib.optionalString final.isLittleEndian "le"}"
+           else if final.isPower
+           then "ppc${lib.optionalString final.isLittleEndian "le"}"
+           else if final.isMips64
+           then "mips64"  # endianness is *not* included on mips64
+           else final.parsed.cpu.name;
 
          # uname -r
          release = null;
@@ -135,12 +142,7 @@ rec {
         if final.isAarch32 then "arm"
         else if final.isx86_64 then "x86_64"
         else if final.isx86 then "i386"
-        else {
-          powerpc = "ppc";
-          powerpcle = "ppc";
-          powerpc64 = "ppc64";
-          powerpc64le = "ppc64le";
-        }.${final.parsed.cpu.name} or final.parsed.cpu.name;
+        else final.uname.processor;
 
       # Name used by UEFI for architectures.
       efiArch =
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 2abf15a7849c..961983433cee 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -14223,6 +14223,13 @@
     githubId = 13155277;
     name = "Tom Houle";
   };
+  tomodachi94 = {
+    email = "tomodachi94+nixpkgs@protonmail.com";
+    matrix = "@tomodachi94:matrix.org";
+    github = "tomodachi94";
+    githubId = 68489118;
+    name = "Tomodachi94";
+  };
   tomsmeets = {
     email = "tom.tsmeets@gmail.com";
     github = "TomSmeets";
diff --git a/nixos/modules/profiles/macos-builder.nix b/nixos/modules/profiles/macos-builder.nix
index a981814730a1..fddf19ad1251 100644
--- a/nixos/modules/profiles/macos-builder.nix
+++ b/nixos/modules/profiles/macos-builder.nix
@@ -9,7 +9,8 @@ let
 
 in
 
-{ imports = [
+{
+  imports = [
     ../virtualisation/qemu-vm.nix
 
     # Avoid a dependency on stateVersion
@@ -18,8 +19,7 @@ in
         ../virtualisation/nixos-containers.nix
         ../services/x11/desktop-managers/xterm.nix
       ];
-      config = {
-      };
+      config = { };
       options.boot.isContainer = lib.mkOption { default = false; internal = true; };
     }
   ];
@@ -98,11 +98,11 @@ in
       '';
 
     in
-      script.overrideAttrs (old: {
-        meta = (old.meta or { }) // {
-          platforms = lib.platforms.darwin;
-        };
-      });
+    script.overrideAttrs (old: {
+      meta = (old.meta or { }) // {
+        platforms = lib.platforms.darwin;
+      };
+    });
 
   system = {
     # To prevent gratuitous rebuilds on each change to Nixpkgs
@@ -118,10 +118,22 @@ in
     '');
   };
 
-  users.users."${user}"= {
+  users.users."${user}" = {
     isNormalUser = true;
   };
 
+  security.polkit.enable = true;
+
+  security.polkit.extraConfig = ''
+    polkit.addRule(function(action, subject) {
+      if (action.id === "org.freedesktop.login1.power-off" && subject.user === "${user}") {
+        return "yes";
+      } else {
+        return "no";
+      }
+    })
+  '';
+
   virtualisation = {
     diskSize = 20 * 1024;
 
diff --git a/pkgs/applications/audio/famistudio/default.nix b/pkgs/applications/audio/famistudio/default.nix
index 1ff08bd06b93..81a2646ad74a 100644
--- a/pkgs/applications/audio/famistudio/default.nix
+++ b/pkgs/applications/audio/famistudio/default.nix
@@ -10,12 +10,12 @@
 
 stdenv.mkDerivation rec {
   pname = "famistudio";
-  version = "4.0.4";
+  version = "4.0.6";
 
   src = fetchzip {
     url = "https://github.com/BleuBleu/FamiStudio/releases/download/${version}/FamiStudio${lib.strings.concatStrings (lib.splitVersion version)}-LinuxAMD64.zip";
     stripRoot = false;
-    sha256 = "sha256-qdSldObfwC5J1b4tpHT9S/xxJ2StBTsPA80QS7bs2vo=";
+    sha256 = "sha256-Se9EIQTjZQM5qqzlEB4hGVRHDFdu6GecNGpw9gYMbW4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/audio/mousai/default.nix b/pkgs/applications/audio/mousai/default.nix
index 96d686864fbc..51b5aa037f06 100644
--- a/pkgs/applications/audio/mousai/default.nix
+++ b/pkgs/applications/audio/mousai/default.nix
@@ -50,6 +50,7 @@ python3.pkgs.buildPythonApplication rec {
     desktop-file-utils
     gettext
     glib
+    gobject-introspection
     gtk4
     meson
     ninja
@@ -58,7 +59,6 @@ python3.pkgs.buildPythonApplication rec {
   ];
 
   buildInputs = [
-    gobject-introspection
     gst_all_1.gstreamer
     gst_all_1.gst-plugins-base
     gst_all_1.gst-plugins-good
diff --git a/pkgs/applications/editors/l3afpad/default.nix b/pkgs/applications/editors/l3afpad/default.nix
new file mode 100644
index 000000000000..e047aaa27028
--- /dev/null
+++ b/pkgs/applications/editors/l3afpad/default.nix
@@ -0,0 +1,25 @@
+{ lib, stdenv, fetchurl, intltool, pkg-config, gtk3, fetchFromGitHub
+, autoreconfHook, wrapGAppsHook }:
+
+stdenv.mkDerivation rec {
+  version = "unstable-2022-02-14";
+  pname = "l3afpad";
+
+  src = fetchFromGitHub {
+    owner = "stevenhoneyman";
+    repo = pname;
+    rev = "16f22222116b78b7f6a6fd83289937cdaabed624";
+    sha256 = "sha256-ly2w9jmRlprm/PnyC0LYjrxBVK+J0DLiSpzuTUMZpWA=";
+  };
+
+  nativeBuildInputs = [ pkg-config autoreconfHook wrapGAppsHook ];
+  buildInputs = [ intltool gtk3 ];
+
+  meta = with lib; {
+    description = "Simple text editor forked from Leafpad using GTK+ 3.x";
+    homepage = "https://github.com/stevenhoneyman/l3afpad";
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ ckie ];
+    license = licenses.gpl2;
+  };
+}
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index 16af8d0a3e74..2b2f7f25c406 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -2033,6 +2033,18 @@ final: prev:
     meta.homepage = "https://github.com/Shougo/context_filetype.vim/";
   };
 
+  copilot-cmp = buildVimPluginFrom2Nix {
+    pname = "copilot-cmp";
+    version = "2022-10-12";
+    src = fetchFromGitHub {
+      owner = "zbirenbaum";
+      repo = "copilot-cmp";
+      rev = "84d5a0e8e4d1638e7554899cb7b642fa24cf463f";
+      sha256 = "180y6d89bldlpilhfz7dakyaml6mfhspnxjn4jliwql4k45xckbi";
+    };
+    meta.homepage = "https://github.com/zbirenbaum/copilot-cmp/";
+  };
+
   copilot-lua = buildVimPluginFrom2Nix {
     pname = "copilot.lua";
     version = "2022-12-20";
@@ -2131,12 +2143,12 @@ final: prev:
 
   crates-nvim = buildVimPluginFrom2Nix {
     pname = "crates.nvim";
-    version = "2022-12-17";
+    version = "2023-01-02";
     src = fetchFromGitHub {
       owner = "saecki";
       repo = "crates.nvim";
-      rev = "a70328ae638e20548bcfc64eb9561101104b3008";
-      sha256 = "0i5bpg4sxm61200mwi3flji5cciv8izbcp38i4bkjm82ad09byzf";
+      rev = "d8657ee78e0c5cb47d4ed87aae11047af03491b9";
+      sha256 = "0s43mmcx2pmvww7vp1hzgk1xfxw2pcg7rs07wk4lm3ld5a0fyhcs";
     };
     meta.homepage = "https://github.com/saecki/crates.nvim/";
   };
@@ -5063,12 +5075,12 @@ final: prev:
 
   neoconf-nvim = buildVimPluginFrom2Nix {
     pname = "neoconf.nvim";
-    version = "2023-01-01";
+    version = "2023-01-02";
     src = fetchFromGitHub {
       owner = "folke";
       repo = "neoconf.nvim";
-      rev = "02eef4955474c026ae425d8888b17e036d93c4c2";
-      sha256 = "0w8dd3mzbhvfhyg7qdr97k4wsih81li6pzj19qp36220lzz6a3j7";
+      rev = "590ff74e81694088c43f1f73982dcb7aa51c03ff";
+      sha256 = "13bz3pdc4lcd8f2jr5g5p8fp12cwszamsvbyzbwbh6cfcj1qi9z0";
     };
     meta.homepage = "https://github.com/folke/neoconf.nvim/";
   };
@@ -5087,12 +5099,12 @@ final: prev:
 
   neodev-nvim = buildVimPluginFrom2Nix {
     pname = "neodev.nvim";
-    version = "2022-12-28";
+    version = "2023-01-02";
     src = fetchFromGitHub {
       owner = "folke";
       repo = "neodev.nvim";
-      rev = "8e06acf88e0621badd9499cfcafbce5ca97dfe8e";
-      sha256 = "1s09id5l0580ckrn7srkq8d2n0mg75dph3zknwb5wig3k11yajhz";
+      rev = "c045c0fe93b1f9c78443d0f3b88660fffbcf64a7";
+      sha256 = "1zw7shzfcjnclv1bj4agkbqv0jswpz3bv9amj9397ypjlafm25wc";
     };
     meta.homepage = "https://github.com/folke/neodev.nvim/";
   };
@@ -5255,12 +5267,12 @@ final: prev:
 
   neovim-ayu = buildVimPluginFrom2Nix {
     pname = "neovim-ayu";
-    version = "2023-01-01";
+    version = "2023-01-02";
     src = fetchFromGitHub {
       owner = "Shatur";
       repo = "neovim-ayu";
-      rev = "5dd9db767538e62005bb028a88c08ff321248aa2";
-      sha256 = "03s75winr4i9gdd9wm98g15x2h0w9iwpdrzg2xp771b43qvilxzv";
+      rev = "9fe707327c539cf092b8e6c4e7ba82e906ee0d06";
+      sha256 = "0j3aqf294967q6b55vjj96mw1ki0dx6306mjvglj52bkl9ya5nhc";
     };
     meta.homepage = "https://github.com/Shatur/neovim-ayu/";
   };
@@ -5963,12 +5975,12 @@ final: prev:
 
   nvim-lint = buildVimPluginFrom2Nix {
     pname = "nvim-lint";
-    version = "2022-12-15";
+    version = "2023-01-02";
     src = fetchFromGitHub {
       owner = "mfussenegger";
       repo = "nvim-lint";
-      rev = "d60514f14baf8eacef4166070783d26c28fe3699";
-      sha256 = "0fxk2gwq1dpmjsk9vwb8vh54xv7wh21skw1c4wg8pz9fcar3790w";
+      rev = "f6ce208ec8b84fe125a4b74566a73d817abec3a8";
+      sha256 = "002qphin2cypfwnzp51q042hi5iqmh9dkx6cd0cy0l5yyayvzjrw";
     };
     meta.homepage = "https://github.com/mfussenegger/nvim-lint/";
   };
@@ -6035,12 +6047,12 @@ final: prev:
 
   nvim-metals = buildVimPluginFrom2Nix {
     pname = "nvim-metals";
-    version = "2022-12-29";
+    version = "2023-01-02";
     src = fetchFromGitHub {
       owner = "scalameta";
       repo = "nvim-metals";
-      rev = "7fd10c569ed4eb9f7ec5355d7829ab124b4e6f99";
-      sha256 = "1jc26mh63pq5jslzxjhbihywa0x4q4qmayc5qcq9davmghdsd5hf";
+      rev = "ddc1cb77b84c96152ab2a05cd22215da49d624ba";
+      sha256 = "0fxbxi7xy19qhd1mzq2h8q5plq6sbmgy50z6kipc8n8lf57f2p5v";
     };
     meta.homepage = "https://github.com/scalameta/nvim-metals/";
   };
@@ -6071,12 +6083,12 @@ final: prev:
 
   nvim-neoclip-lua = buildVimPluginFrom2Nix {
     pname = "nvim-neoclip.lua";
-    version = "2022-10-13";
+    version = "2023-01-01";
     src = fetchFromGitHub {
       owner = "AckslD";
       repo = "nvim-neoclip.lua";
-      rev = "3e0b9a134838c7356d743f84a272c92410c47d8d";
-      sha256 = "19xwirhaw8y9blll37xwk13cn74cw6cl1j76773nkxgx5m5cynpg";
+      rev = "db50498b0e07c1fb2e5b9894e512d7b333a8bb76";
+      sha256 = "1nicrjh16d2bpqa41c0cz2wq4fqnpjlr2mmidld48p1xl4fvviin";
     };
     meta.homepage = "https://github.com/AckslD/nvim-neoclip.lua/";
   };
@@ -6191,12 +6203,12 @@ final: prev:
 
   nvim-surround = buildVimPluginFrom2Nix {
     pname = "nvim-surround";
-    version = "2022-12-30";
+    version = "2023-01-01";
     src = fetchFromGitHub {
       owner = "kylechui";
       repo = "nvim-surround";
-      rev = "64e21061953102b19bbb22e824fbb96054782799";
-      sha256 = "11m62i66gicv7spz6bcsxpdqshi19v0306bh69lcmbyawbwyli4a";
+      rev = "ad56e6234bf42fb7f7e4dccc7752e25abd5ec80e";
+      sha256 = "1fi5lk3iacjdbq1p4wm0bia93awwqfn7jiy019vpg4gngi41azrz";
     };
     meta.homepage = "https://github.com/kylechui/nvim-surround/";
   };
@@ -6231,20 +6243,20 @@ final: prev:
     src = fetchFromGitHub {
       owner = "nvim-tree";
       repo = "nvim-tree.lua";
-      rev = "e322fbb80b0be5e885268c91ab29cbfe0143cd5b";
-      sha256 = "1195sw9h1wk5p2x9xj3zqkm5a7sm6l8qq8jxhvrbq14xmw5594sm";
+      rev = "951b6e7e55da8aee9566cc0b17c11f9451cec349";
+      sha256 = "11f1m815bgj0j6xack9q8jcnaqbpzlxhlbkqalwl8ahd6w06n9qv";
     };
     meta.homepage = "https://github.com/nvim-tree/nvim-tree.lua/";
   };
 
   nvim-treesitter = buildVimPluginFrom2Nix {
     pname = "nvim-treesitter";
-    version = "2023-01-01";
+    version = "2023-01-02";
     src = fetchFromGitHub {
       owner = "nvim-treesitter";
       repo = "nvim-treesitter";
-      rev = "b67822bf58b0fbf0c496ae21a177d02fa8388edf";
-      sha256 = "01l1sl39pia8fa2b7ld0rdi76yjlrnh82rlxvgfqjivppq23k0zm";
+      rev = "12e95e160d7d45b76a36bca6303dd8447ab77490";
+      sha256 = "1vsqcl4xcy02lp8rv1fgvq3y76whb0grmj63rif7b48vrj427w94";
     };
     meta.homepage = "https://github.com/nvim-treesitter/nvim-treesitter/";
   };
diff --git a/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix b/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
index 49e115be3b7a..c6c995700075 100644
--- a/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
@@ -604,12 +604,12 @@
   };
   help = buildGrammar {
     language = "help";
-    version = "61c7505";
+    version = "9dee68e";
     source = fetchFromGitHub {
       owner = "neovim";
       repo = "tree-sitter-vimdoc";
-      rev = "61c75058299f3d1cf565697e4073d7b2cc6a6d6c";
-      hash = "sha256-MTossQzmBoHqXu933suYUUyDbmb20uO5oZlV31BYqIA=";
+      rev = "9dee68e3912d16e9878b06e3cd87e21ada3d9029";
+      hash = "sha256-6XYEC+wKrCbPtcdjFH1O0EdX84M+NpPfTO2tXGFkwtk=";
     };
     meta.homepage = "https://github.com/neovim/tree-sitter-vimdoc";
   };
@@ -1496,12 +1496,12 @@
   };
   v = buildGrammar {
     language = "v";
-    version = "f0aa56e";
+    version = "0e3725a";
     source = fetchFromGitHub {
       owner = "vlang";
       repo = "vls";
-      rev = "f0aa56eec7689f08a389c90ad8d3e5e0d18b3cd7";
-      hash = "sha256-d69SvXDWxeRk2hvou8MhXUpUrSBwYENqFDGpT/Y5UpM=";
+      rev = "0e3725a0c10d357f16b716f9a321a337bc802f02";
+      hash = "sha256-RDG/HFSMF5zxtO/elhtv2oH3OnUx47X3xYRqS1+Oz9U=";
     };
     location = "tree_sitter_v";
     meta.homepage = "https://github.com/vlang/vls";
diff --git a/pkgs/applications/editors/vim/plugins/update.py b/pkgs/applications/editors/vim/plugins/update.py
index 7e5c7380597c..20336c66ed6e 100755
--- a/pkgs/applications/editors/vim/plugins/update.py
+++ b/pkgs/applications/editors/vim/plugins/update.py
@@ -137,11 +137,15 @@ def main():
         subprocess.check_call([nvim_treesitter_dir.joinpath("update.py")])
 
         if editor.nixpkgs_repo:
-            msg = "vimPlugins.nvim-treesitter: update grammars"
-            print(f"committing to nixpkgs: {msg}")
             index = editor.nixpkgs_repo.index
-            index.add([str(nvim_treesitter_dir.joinpath("generated.nix"))])
-            index.commit(msg)
+            for diff in index.diff(None):
+                if diff.a_path == "pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix":
+                    msg = "vimPlugins.nvim-treesitter: update grammars"
+                    print(f"committing to nixpkgs: {msg}")
+                    index.add([str(nvim_treesitter_dir.joinpath("generated.nix"))])
+                    index.commit(msg)
+                    return
+            print("no updates to nvim-treesitter grammars")
 
 
 if __name__ == "__main__":
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index bf53350006c6..c1aaf4c5be2a 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -170,6 +170,7 @@ https://github.com/rhysd/conflict-marker.vim/,,
 https://github.com/Olical/conjure/,,
 https://github.com/wellle/context.vim/,,
 https://github.com/Shougo/context_filetype.vim/,,
+https://github.com/zbirenbaum/copilot-cmp/,HEAD,
 https://github.com/zbirenbaum/copilot.lua/,HEAD,
 https://github.com/github/copilot.vim/,,
 https://github.com/ms-jpq/coq.artifacts/,HEAD,
diff --git a/pkgs/applications/graphics/openimageio/2.x.nix b/pkgs/applications/graphics/openimageio/2.x.nix
index d6b710595a31..88d99a0fae76 100644
--- a/pkgs/applications/graphics/openimageio/2.x.nix
+++ b/pkgs/applications/graphics/openimageio/2.x.nix
@@ -1,5 +1,6 @@
 { lib, stdenv
 , fetchFromGitHub
+, fetchpatch
 , boost
 , cmake
 , giflib
@@ -7,7 +8,7 @@
 , libjpeg
 , libpng
 , libtiff
-, opencolorio_1
+, opencolorio
 , openexr
 , robin-map
 , unzip
@@ -16,15 +17,23 @@
 
 stdenv.mkDerivation rec {
   pname = "openimageio";
-  version = "2.2.17.0";
+  version = "2.4.6.1";
 
   src = fetchFromGitHub {
     owner = "OpenImageIO";
     repo = "oiio";
-    rev = "Release-${version}";
-    sha256 = "0jqpb1zci911wdm928addsljxx8zsh0gzbhv9vbw6man4wi93h6h";
+    rev = "v${version}";
+    sha256 = "sha256-oBICukkborxXFHXyM2rIn5qSbCWECjwDQI9MUg13IRU=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "arm-fix-signed-unsigned-simd-mismatch.patch";
+      url = "https://github.com/OpenImageIO/oiio/commit/726c51181a2888b0bd1edbef5ac8451e9cc3f893.patch";
+      hash = "sha256-G4vexf0OHZ/sbcRob5X92tajkmAv72ok8rcVQtIE9XE=";
+    })
+  ];
+
   outputs = [ "bin" "out" "dev" "doc" ];
 
   nativeBuildInputs = [
@@ -39,7 +48,7 @@ stdenv.mkDerivation rec {
     libjpeg
     libpng
     libtiff
-    opencolorio_1
+    opencolorio
     openexr
     robin-map
     fmt
@@ -58,7 +67,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    homepage = "http://www.openimageio.org";
+    homepage = "https://openimageio.org";
     description = "A library and tools for reading and writing images";
     license = licenses.bsd3;
     maintainers = with maintainers; [ goibhniu ];
diff --git a/pkgs/applications/misc/nwg-dock/default.nix b/pkgs/applications/misc/nwg-dock/default.nix
index 32361b276b20..ff12f5d159ce 100644
--- a/pkgs/applications/misc/nwg-dock/default.nix
+++ b/pkgs/applications/misc/nwg-dock/default.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "nwg-dock";
-  version = "0.3.2";
+  version = "0.3.3";
 
   src = fetchFromGitHub {
     owner = "nwg-piotr";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-X2AhzQsgUWHkPp1YoAxcbq+Oni9C6Yrnyt+Plxya8OI=";
+    sha256 = "sha256-RCVG38Y8VV7qGz/CaOZ4aw4Sg3PQdrB29zZqATjvYDQ=";
   };
 
-  vendorSha256 = "sha256-5vGfWEBiC3ZJzVTHaOPbaaK/9+yg7Nj0mpbJbYpbY/A=";
+  vendorSha256 = "sha256-WDygnKdldZda4GadfStHWsDel1KLdzjVjw0RxmnFPRE=";
 
   ldflags = [ "-s" "-w" ];
 
diff --git a/pkgs/applications/misc/scli/default.nix b/pkgs/applications/misc/scli/default.nix
index abd47c149ebb..d300691934b2 100644
--- a/pkgs/applications/misc/scli/default.nix
+++ b/pkgs/applications/misc/scli/default.nix
@@ -8,13 +8,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "scli";
-  version = "0.7.1";
+  version = "0.7.2";
 
   src = fetchFromGitHub {
     owner = "isamert";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-YEgeeoUqDeBx3jPddTeykl+68lS8gVKD+zdo+gRTaT4=";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-7yyORM77oByH1gxx/TNkjJQBsig6ZxsfeI3ijg71oBs=";
   };
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/applications/networking/cluster/kube-score/default.nix b/pkgs/applications/networking/cluster/kube-score/default.nix
index 6b3bcf54c263..492f9bcd51f4 100644
--- a/pkgs/applications/networking/cluster/kube-score/default.nix
+++ b/pkgs/applications/networking/cluster/kube-score/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "kube-score";
-  version = "1.16.0";
+  version = "1.16.1";
 
   src = fetchFromGitHub {
     owner = "zegl";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-dKvPLAT9e8gNJkKDF7dQPGLSkv9QUjQklUX8Dm8i33E=";
+    hash = "sha256-/aCuPL0bzzoNczvSdLYS8obTu8bZzO5HhBmRZ3/ArAM=";
   };
 
   vendorHash = "sha256-pcNdszOfsYKiASOUNKflbr89j/wb9ILQvjMJYsiGPWo=";
diff --git a/pkgs/applications/networking/cluster/kubent/default.nix b/pkgs/applications/networking/cluster/kubent/default.nix
index 5302917cdfff..bba56a5b058a 100644
--- a/pkgs/applications/networking/cluster/kubent/default.nix
+++ b/pkgs/applications/networking/cluster/kubent/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "kubent";
-  version = "0.6.0";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     owner = "doitintl";
     repo = "kube-no-trouble";
     rev = "${version}";
-    sha256 = "sha256-aXuBYfXQfg6IQE9cFFTBCPNmDg7IZYPAAeuAxCiU0ro=";
+    sha256 = "sha256-QIvMhKAo30gInqJBpHvhcyjgVkdRqgBKwLQ80ng/75U=";
   };
 
-  vendorSha256 = "sha256-WQwWBcwhFZxXPFO6h+5Y8VDM4urJGfZ6AOvhRoaSbpk=";
+  vendorSha256 = "sha256-XXf6CPPHVvCTZA4Ve5/wmlgXQ/gZZUW0W/jXA0bJgLA=";
 
   ldflags = [
     "-w" "-s"
diff --git a/pkgs/applications/networking/mailreaders/tutanota-desktop/default.nix b/pkgs/applications/networking/mailreaders/tutanota-desktop/default.nix
index 283091ccc57d..cc6d5ceff758 100644
--- a/pkgs/applications/networking/mailreaders/tutanota-desktop/default.nix
+++ b/pkgs/applications/networking/mailreaders/tutanota-desktop/default.nix
@@ -3,12 +3,12 @@ electron, libsecret }:
 
 stdenv.mkDerivation rec {
   pname = "tutanota-desktop";
-  version = "3.105.9";
+  version = "3.106.4";
 
   src = fetchurl {
     url = "https://github.com/tutao/tutanota/releases/download/tutanota-desktop-release-${version}/${pname}-${version}-unpacked-linux.tar.gz";
     name = "tutanota-desktop-${version}.tar.gz";
-    sha256 = "sha256-PkAxtpyL4rXJfz+YgbVteOP1V0hlF25htvOCkEGFq4k=";
+    sha256 = "sha256-RU2JEFtYOpxqA02YDuB/V4t/ZZ608EHGMPpwxVOzRz4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/soapui/default.nix b/pkgs/applications/networking/soapui/default.nix
index f3c8301a69b6..fc515590f37a 100644
--- a/pkgs/applications/networking/soapui/default.nix
+++ b/pkgs/applications/networking/soapui/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "soapui";
-  version = "5.6.0";
+  version = "5.7.0";
 
   src = fetchurl {
     url = "https://s3.amazonaws.com/downloads.eviware/soapuios/${version}/SoapUI-${version}-linux-bin.tar.gz";
-    sha256 = "0vmj11fswja0ddnbc4vb7gj1al8km7ilma9bv1waaj8h5c8qpayi";
+    sha256 = "sha256-qzhy4yHmOk13dFUd2KEZhXtWY86QwyjJgYxx9GGoN80=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
@@ -28,16 +28,16 @@ stdenv.mkDerivation rec {
     (writeText "soapui-${version}.patch" ''
       --- a/bin/soapui.sh
       +++ b/bin/soapui.sh
-      @@ -34,7 +34,7 @@ SOAPUI_CLASSPATH=$SOAPUI_HOME/bin/soapui-${version}.jar:$SOAPUI_HOME/lib/*
-       export SOAPUI_CLASSPATH
+      @@ -50,7 +50,7 @@
+       #JAVA 16
+       JAVA_OPTS="$JAVA_OPTS --illegal-access=permit"
 
-       JAVA_OPTS="-Xms128m -Xmx1024m -XX:MinHeapFreeRatio=20 -XX:MaxHeapFreeRatio=40 -Dsoapui.properties=soapui.properties -Dsoapui.home=$SOAPUI_HOME/bin -splash:SoapUI-Spashscreen.png"
       -JFXRTPATH=`java -cp $SOAPUI_CLASSPATH com.eviware.soapui.tools.JfxrtLocator`
       +JFXRTPATH=`${jdk}/bin/java -cp $SOAPUI_CLASSPATH com.eviware.soapui.tools.JfxrtLocator`
        SOAPUI_CLASSPATH=$JFXRTPATH:$SOAPUI_CLASSPATH
 
        if $darwin
-      @@ -69,4 +69,4 @@ echo = SOAPUI_HOME = $SOAPUI_HOME
+      @@ -85,4 +85,4 @@
        echo =
        echo ================================
 
diff --git a/pkgs/applications/office/qownnotes/default.nix b/pkgs/applications/office/qownnotes/default.nix
index 73c470259f14..bb27f0d4ec90 100644
--- a/pkgs/applications/office/qownnotes/default.nix
+++ b/pkgs/applications/office/qownnotes/default.nix
@@ -5,13 +5,13 @@
 
 mkDerivation rec {
   pname = "qownnotes";
-  version = "22.11.7";
+  version = "22.12.3";
 
   src = fetchurl {
     url = "https://download.tuxfamily.org/${pname}/src/${pname}-${version}.tar.xz";
     # Fetch the checksum of current version with curl:
     # curl https://download.tuxfamily.org/qownnotes/src/qownnotes-<version>.tar.xz.sha256
-    sha256 = "2fbc20f17422bc44c35dd3e78feb710ca275ecb34c550b2a9c743939531f7878";
+    sha256 = "sha256-fpI7RYOGmWwmau6tF8FPmY2/FtN9foWRX8/WgrNU6E8=";
   };
 
   nativeBuildInputs = [ qmake qttools ];
diff --git a/pkgs/applications/window-managers/dwm/dwm-status.nix b/pkgs/applications/window-managers/dwm/dwm-status.nix
index a1b790b33da8..424528e9c1aa 100644
--- a/pkgs/applications/window-managers/dwm/dwm-status.nix
+++ b/pkgs/applications/window-managers/dwm/dwm-status.nix
@@ -9,19 +9,19 @@ in
 
 rustPlatform.buildRustPackage rec {
   pname = "dwm-status";
-  version = "1.8.0";
+  version = "1.8.1";
 
   src = fetchFromGitHub {
     owner = "Gerschtli";
     repo = pname;
     rev = version;
-    sha256 = "sha256-BCnEnBB0OCUwvhh4XEI2eOzfy34VHNFzbqqW26X6If0=";
+    sha256 = "sha256-GkTPEmsnHFLUvbasAOXOQjFKs1Y9aaG87uyPvnQaT8Y=";
   };
 
   nativeBuildInputs = [ makeWrapper pkg-config ];
   buildInputs = [ dbus gdk-pixbuf libnotify xorg.libX11 ];
 
-  cargoSha256 = "sha256-ylB0XGmIPW7Dbc6eDS8FZsq1AOOqntx1byaH3XIal0I=";
+  cargoSha256 = "sha256-eRfXUnyzOfVSEiwjLCaNbETUPXVU2Ed2VUNM9FjS5YE=";
 
   postInstall = lib.optionalString (bins != [])  ''
     wrapProgram $out/bin/dwm-status --prefix "PATH" : "${lib.makeBinPath bins}"
@@ -30,6 +30,7 @@ rustPlatform.buildRustPackage rec {
   meta = with lib; {
     description = "Highly performant and configurable DWM status service";
     homepage = "https://github.com/Gerschtli/dwm-status";
+    changelog = "https://github.com/Gerschtli/dwm-status/blob/master/CHANGELOG.md";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ gerschtli ];
     mainProgram = pname;
diff --git a/pkgs/applications/window-managers/river/default.nix b/pkgs/applications/window-managers/river/default.nix
index 3231882a4fba..e4f0760b68eb 100644
--- a/pkgs/applications/window-managers/river/default.nix
+++ b/pkgs/applications/window-managers/river/default.nix
@@ -7,7 +7,7 @@
 , scdoc
 , xwayland
 , wayland-protocols
-, wlroots
+, wlroots_0_16
 , libxkbcommon
 , pixman
 , udev
@@ -20,13 +20,13 @@
 
 stdenv.mkDerivation rec {
   pname = "river";
-  version = "0.1.3";
+  version = "0.2.0";
 
   src = fetchFromGitHub {
     owner = "riverwm";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-bHfHhyDx/Wzhvhr7mAeVzJf0TBJgMTGb/ClGjWMLlQ8=";
+    sha256 = "sha256-BrOZch6wkiBB4rk0M7Aoy8sZh8uOTQFOPxd3xLyy/K0=";
     fetchSubmodules = true;
   };
 
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     wayland-protocols
-    wlroots
+    wlroots_0_16
     libxkbcommon
     pixman
     udev
@@ -69,6 +69,6 @@ stdenv.mkDerivation rec {
     description = "A dynamic tiling wayland compositor";
     license = licenses.gpl3Plus;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ fortuneteller2k ];
+    maintainers = with maintainers; [ fortuneteller2k adamcstephens ];
   };
 }
diff --git a/pkgs/development/embedded/fpga/openfpgaloader/default.nix b/pkgs/development/embedded/fpga/openfpgaloader/default.nix
index db97476dd692..b71e89f2de61 100644
--- a/pkgs/development/embedded/fpga/openfpgaloader/default.nix
+++ b/pkgs/development/embedded/fpga/openfpgaloader/default.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "openfpgaloader";
-  version = "0.9.1";
+  version = "0.10.0";
 
   src = fetchFromGitHub {
     owner = "trabucayre";
     repo = "openFPGALoader";
     rev = "v${version}";
-    sha256 = "sha256-CnJBmbvJ4FfKqdyoD8K94Eeoqly2Q6UV5wQ6EWv2isI=";
+    sha256 = "sha256-MPIFD7/jUEotY/EhuzNhaz8C3LVMxUr++fhtCpbbz0o=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
diff --git a/pkgs/development/libraries/libgpg-error/default.nix b/pkgs/development/libraries/libgpg-error/default.nix
index 4f687d41dd6e..fcd7946a1351 100644
--- a/pkgs/development/libraries/libgpg-error/default.nix
+++ b/pkgs/development/libraries/libgpg-error/default.nix
@@ -37,13 +37,21 @@ in stdenv.mkDerivation (rec {
   nativeBuildInputs = [ gettext ];
 
   postConfigure =
-    lib.optionalString stdenv.isSunOS
     # For some reason, /bin/sh on OpenIndiana leads to this at the end of the
     # `config.status' run:
     #   ./config.status[1401]: shift: (null): bad number
     # (See <https://hydra.nixos.org/build/2931046/nixlog/1/raw>.)
     # Thus, re-run it with Bash.
-      "${stdenv.shell} config.status";
+    lib.optionalString stdenv.isSunOS ''
+      ${stdenv.shell} config.status
+    ''
+    # ./configure errorneous decides to use weak symbols on pkgsStatic,
+    # which, together with other defines results in locking functions in
+    # src/posix-lock.c to be no-op, causing tests/t-lock.c to fail.
+    + lib.optionalString stdenv.hostPlatform.isStatic ''
+      sed '/USE_POSIX_THREADS_WEAK/ d' config.h
+      echo '#undef USE_POSIX_THREADS_WEAK' >> config.h
+    '';
 
   doCheck = true; # not cross
 
diff --git a/pkgs/development/libraries/libksi/default.nix b/pkgs/development/libraries/libksi/default.nix
index 015121811710..634e52b97ab6 100644
--- a/pkgs/development/libraries/libksi/default.nix
+++ b/pkgs/development/libraries/libksi/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libksi";
-  version = "3.20.3025";
+  version = "3.21.3075";
 
   src = fetchFromGitHub {
     owner = "Guardtime";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0cagysr8j92r6g7f0mwrlkpn9xz9ncz2v3jymh47j3ljxmfbagpz";
+    sha256 = "sha256-JEdjy91+8xJPNzjkumadT05SxcvtM551+SjLN1SQcAU=";
   };
 
   nativeBuildInputs = [ autoreconfHook ];
diff --git a/pkgs/development/libraries/libvgm/default.nix b/pkgs/development/libraries/libvgm/default.nix
index f7c85b292a66..a6d9a68abba5 100644
--- a/pkgs/development/libraries/libvgm/default.nix
+++ b/pkgs/development/libraries/libvgm/default.nix
@@ -42,13 +42,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "libvgm";
-  version = "unstable-2022-08-02";
+  version = "unstable-2022-11-25";
 
   src = fetchFromGitHub {
     owner = "ValleyBell";
     repo = "libvgm";
-    rev = "0e349256338144205303a1495ddc788a854be1eb";
-    sha256 = "FNNPiIfBUxkwgEbiFebPGn6ZIxv3ypDefcOzC6r94hE=";
+    rev = "fd7da37b96b5937a0bb5a41bacbae0a0ef59069f";
+    sha256 = "1tjooO/f72lRdZDxXVSxBySWsUMNWuqI2yQOipa7zFY=";
   };
 
   outputs = [
diff --git a/pkgs/development/libraries/minizip-ng/default.nix b/pkgs/development/libraries/minizip-ng/default.nix
index 8f12dc29784e..19cd07fc1601 100644
--- a/pkgs/development/libraries/minizip-ng/default.nix
+++ b/pkgs/development/libraries/minizip-ng/default.nix
@@ -51,13 +51,13 @@ stdenv.mkDerivation (finalAttrs: {
     "-DMZ_LIBCOMP=OFF"
   ];
 
-  postInstall = let
-    libext = if stdenv.hostPlatform.isStatic then ".a" else ".so";
-  in ''
+  postInstall = ''
     # make lib findable as libminizip-ng even if compat is enabled
-    if [ ! -e $out/lib/libminizip-ng${libext} ]; then
-      ln -s $out/lib/libminizip${libext} $out/lib/libminizip-ng${libext}
-    fi
+    for ext in so dylib a ; do
+      if [ -e $out/lib/libminizip.$ext ] && [ ! -e $out/lib/libminizip-ng.$ext ]; then
+        ln -s $out/lib/libminizip.$ext $out/lib/libminizip-ng.$ext
+      fi
+    done
     if [ ! -e $out/include/minizip-ng ]; then
       ln -s $out/include $out/include/minizip-ng
     fi
diff --git a/pkgs/development/libraries/opencolorio/default.nix b/pkgs/development/libraries/opencolorio/default.nix
index 53a37da01fd6..4cf75039c49e 100644
--- a/pkgs/development/libraries/opencolorio/default.nix
+++ b/pkgs/development/libraries/opencolorio/default.nix
@@ -8,6 +8,7 @@
 , ilmbase
 , pystring
 , imath
+, minizip-ng
 # Only required on Linux
 , glew
 , freeglut
@@ -21,19 +22,18 @@
 # Build apps
 , buildApps ? true # Utility applications
 , lcms2
-, openimageio2
-, openexr
+, openexr_3
 }:
 
 stdenv.mkDerivation rec {
   pname = "opencolorio";
-  version = "2.1.2";
+  version = "2.2.0";
 
   src = fetchFromGitHub {
     owner = "AcademySoftwareFoundation";
     repo = "OpenColorIO";
     rev = "v${version}";
-    sha256 = "sha256-e1PpWjjfSjtgN9Rs/+lsA45Z9S4y4T6nqrJ02DZ4vjs=";
+    sha256 = "sha256-l5UUysHdP/gb4Mn5A64XEoHOkthl6Mlb95CuI0l4vXQ=";
   };
 
   patches = [
@@ -43,8 +43,21 @@ stdenv.mkDerivation rec {
       revert = true;
       sha256 = "sha256-0DF+lwi2nfkUFG0wYvL3HYbhZS6SqGtPWoOabrFS1Eo=";
     })
+    (fetchpatch {
+      name = "pkg-config-absolute-path.patch";
+      url = "https://github.com/AcademySoftwareFoundation/OpenColorIO/commit/332462e7f5051b7e26ee3d8c22890cd5e71e7c30.patch";
+      sha256 = "sha256-7xHALhnOkKszgFBgPIbiZQaORnEJ+1M6RyoZdFgjElM=";
+    })
   ];
 
+  postPatch = lib.optionalString stdenv.isDarwin ''
+    # these tests don't like being run headless on darwin. no builtin
+    # way of skipping tests so this is what we're reduced to.
+    substituteInPlace tests/cpu/Config_tests.cpp \
+      --replace 'OCIO_ADD_TEST(Config, virtual_display)' 'static void _skip_virtual_display()' \
+      --replace 'OCIO_ADD_TEST(Config, virtual_display_with_active_displays)' 'static void _skip_virtual_display_with_active_displays()'
+  '';
+
   nativeBuildInputs = [ cmake ];
   buildInputs = [
     expat
@@ -52,25 +65,24 @@ stdenv.mkDerivation rec {
     ilmbase
     pystring
     imath
+    minizip-ng
   ] ++ lib.optionals stdenv.hostPlatform.isLinux [ glew freeglut ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [ Carbon GLUT Cocoa ]
     ++ lib.optionals pythonBindings [ python3Packages.python python3Packages.pybind11 ]
-    ++ lib.optionals buildApps [ lcms2 openimageio2 openexr ];
+    ++ lib.optionals buildApps [
+      lcms2
+      openexr_3
+    ];
 
-    cmakeFlags = [
-      "-DOCIO_INSTALL_EXT_PACKAGES=NONE"
-    ] ++ lib.optional (!pythonBindings) "-DOCIO_BUILD_PYTHON=OFF"
-      ++ lib.optional (!buildApps) "-DOCIO_BUILD_APPS=OFF";
+  cmakeFlags = [
+    "-DOCIO_INSTALL_EXT_PACKAGES=NONE"
+    # GPU test fails with: freeglut (GPU tests): failed to open display ''
+    "-DOCIO_BUILD_GPU_TESTS=OFF"
+  ] ++ lib.optional (!pythonBindings) "-DOCIO_BUILD_PYTHON=OFF"
+    ++ lib.optional (!buildApps) "-DOCIO_BUILD_APPS=OFF";
 
-  # TODO Investigate this: Python and GPU tests fail to load libOpenColorIO.so.2.0
-  # doCheck = true;
-
-  # https://github.com/AcademySoftwareFoundation/OpenColorIO/issues/1649
-  postPatch = ''
-    substituteInPlace src/OpenColorIO/CMakeLists.txt \
-      --replace '\$'{exec_prefix}/'$'{CMAKE_INSTALL_INCLUDEDIR} '$'{CMAKE_INSTALL_FULL_INCLUDEDIR} \
-      --replace '\$'{exec_prefix}/'$'{CMAKE_INSTALL_LIBDIR} '$'{CMAKE_INSTALL_FULL_LIBDIR}
-  '';
+  # precision issues on non-x86
+  doCheck = stdenv.isx86_64;
 
   meta = with lib; {
     homepage = "https://opencolorio.org";
diff --git a/pkgs/development/libraries/wolfssl/default.nix b/pkgs/development/libraries/wolfssl/default.nix
index e61a6f6c3931..a8e2259a3bc1 100644
--- a/pkgs/development/libraries/wolfssl/default.nix
+++ b/pkgs/development/libraries/wolfssl/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "wolfssl";
-  version = "5.5.3";
+  version = "5.5.4";
 
   src = fetchFromGitHub {
     owner = "wolfSSL";
     repo = "wolfssl";
     rev = "v${version}-stable";
-    hash = "sha256-36L7kZ9Dqp3pDjodqELBdSBFwrf+GnRP7KNFYrRUCuU=";
+    hash = "sha256-sR/Gjk50kLej5oJzDH1I6/V+7OIRiwtyeg5tEE3fmHk=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/afdko/default.nix b/pkgs/development/python-modules/afdko/default.nix
index 29593503252a..739198fa4aeb 100644
--- a/pkgs/development/python-modules/afdko/default.nix
+++ b/pkgs/development/python-modules/afdko/default.nix
@@ -91,6 +91,10 @@ buildPythonPackage rec {
     "test_spec"
   ] ++ lib.optionals (stdenv.hostPlatform.isi686) [
     "test_type1mm_inputs"
+  ] ++ [
+    # No longer succeeds in 2023
+    # https://github.com/adobe-type-tools/afdko/issues/1589
+    "test_ufo_fontinfo_parsing"
   ];
 
   passthru.tests = {
diff --git a/pkgs/development/python-modules/aiortm/default.nix b/pkgs/development/python-modules/aiortm/default.nix
index 83ed397e47d0..a305061984ae 100644
--- a/pkgs/development/python-modules/aiortm/default.nix
+++ b/pkgs/development/python-modules/aiortm/default.nix
@@ -1,8 +1,10 @@
 { lib
 , aiohttp
+, aioresponses
 , buildPythonPackage
 , click
 , fetchFromGitHub
+, pydantic
 , poetry-core
 , pytestCheckHook
 , pythonOlder
@@ -11,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "aiortm";
-  version = "0.3.1";
+  version = "0.4.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -20,7 +22,7 @@ buildPythonPackage rec {
     owner = "MartinHjelmare";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-DTFynPFf0NUBieXDiMKhCNwBqx3s/xzggNmnz/IKjbU=";
+    hash = "sha256-cdCKcwpQ+u3CkMiPfMf6DnH2SYc7ab8q5W72aEEnNx4=";
   };
 
   nativeBuildInputs = [
@@ -30,10 +32,12 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     aiohttp
     click
+    pydantic
     yarl
   ];
 
   checkInputs = [
+    aioresponses
     pytestCheckHook
   ];
 
@@ -49,6 +53,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Library for the Remember the Milk API";
     homepage = "https://github.com/MartinHjelmare/aiortm";
+    changelog = "https://github.com/MartinHjelmare/aiortm/blob/v${version}/CHANGELOG.md";
     license = with licenses; [ asl20 ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/azure-storage-blob/default.nix b/pkgs/development/python-modules/azure-storage-blob/default.nix
index 3b3499a780f0..f8f7f2f403b2 100644
--- a/pkgs/development/python-modules/azure-storage-blob/default.nix
+++ b/pkgs/development/python-modules/azure-storage-blob/default.nix
@@ -1,37 +1,46 @@
 { lib
-, buildPythonPackage
-, fetchPypi
 , azure-common
 , azure-core
 , azure-storage-common
+, buildPythonPackage
+, cryptography
+, fetchPypi
+, isodate
 , msrest
-, isPy3k
-, futures ? null
+, pythonOlder
+, typing-extensions
 }:
 
 buildPythonPackage rec {
   pname = "azure-storage-blob";
-  version = "12.13.1";
+  version = "12.14.1";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    sha256 = "sha256-iZxLjiZxgS0s948QdVaifbsSjKqiuwYJTnKj1YNnQK8=";
+    hash = "sha256-hg1NgphaS/x9MnHnEnWvMw9U8zCnVDVUNae6dJzN6Zc=";
   };
 
   propagatedBuildInputs = [
     azure-common
     azure-core
     azure-storage-common
+    cryptography
+    isodate
     msrest
-  ] ++ lib.optional (!isPy3k) futures;
+    typing-extensions
+  ];
 
-  # has no tests
+  # Module has no tests
   doCheck = false;
 
   meta = with lib; {
     description = "Client library for Microsoft Azure Storage services containing the blob service APIs";
     homepage = "https://github.com/Azure/azure-sdk-for-python";
+    changelog = "https://github.com/Azure/azure-sdk-for-python/blob/azure-storage-blob_${version}/sdk/storage/azure-storage-blob/CHANGELOG.md";
     license = licenses.mit;
     maintainers = with maintainers; [ cmcdragonkai maxwilson ];
   };
diff --git a/pkgs/development/python-modules/plugwise/default.nix b/pkgs/development/python-modules/plugwise/default.nix
index 5762d03e7042..e00f5fa9a619 100644
--- a/pkgs/development/python-modules/plugwise/default.nix
+++ b/pkgs/development/python-modules/plugwise/default.nix
@@ -21,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "plugwise";
-  version = "0.27.0";
+  version = "0.27.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -30,7 +30,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = "python-plugwise";
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-W6aLpm3Z0JQIZcqDu9wH2RFuXfzl0Px61zfIuhm92pk=";
+    hash = "sha256-56KJQBYaQK08o9W6ZLWHCLCVPCLHh5Q+GTZqTTexn90=";
   };
 
   propagatedBuildInputs = [
@@ -63,6 +63,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python module for Plugwise Smiles, Stretch and USB stick";
     homepage = "https://github.com/plugwise/python-plugwise";
+    changelog = "https://github.com/plugwise/python-plugwise/releases/tag/v${version}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/trezor/default.nix b/pkgs/development/python-modules/trezor/default.nix
index ae9778d91039..080792a98b5a 100644
--- a/pkgs/development/python-modules/trezor/default.nix
+++ b/pkgs/development/python-modules/trezor/default.nix
@@ -25,13 +25,13 @@
 
 buildPythonPackage rec {
   pname = "trezor";
-  version = "0.13.4";
+  version = "0.13.5";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "04a77b44005971819386bbd55242a1004b1f88fbbdb829deb039a1e0028a4af1";
+    sha256 = "sha256-jhUBca/+rDge/bFHgpKQhNZBTsd8zNyHHW8NZE/1e9g=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
diff --git a/pkgs/development/tools/winhelpcgi/default.nix b/pkgs/development/tools/winhelpcgi/default.nix
new file mode 100644
index 000000000000..cd7bfe344357
--- /dev/null
+++ b/pkgs/development/tools/winhelpcgi/default.nix
@@ -0,0 +1,23 @@
+{ stdenv, fetchurl, libwmf, libpng, pkg-config, lib }: stdenv.mkDerivation {
+  name = "winhelpcgi-1.0-rc3";
+
+  src = fetchurl {
+    url = "http://www.herdsoft.com/ftp/winhelpcgi_1.0-1.tar.gz";
+    sha256 = "sha256-9HIs50ZGoTfGixD9c/DQs0KJMQtmfsDVB8qRMnQtXNw=";
+
+  };
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [ libwmf libpng ];
+
+  meta = {
+    description = "CGI module for Linux, Solaris, MacOS X and AIX to read Windows Help Files";
+
+    homepage = "http://www.herdsoft.com/linux/produkte/winhelpcgi.html";
+
+    license = lib.licenses.gpl2Only;
+
+    maintainers = [ lib.maintainers.shlevy ];
+  };
+}
diff --git a/pkgs/games/quakespasm/default.nix b/pkgs/games/quakespasm/default.nix
index 030532b524d7..6681370c79d6 100644
--- a/pkgs/games/quakespasm/default.nix
+++ b/pkgs/games/quakespasm/default.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "quakespasm";
-  version = "0.95.0";
+  version = "0.95.1";
 
   src = fetchurl {
     url = "mirror://sourceforge/quakespasm/quakespasm-${version}.tar.gz";
-    sha256 = "sha256-pjXqOyL5ILu0Tx5sfehYXbVsL11Abt9cgZJ4xkkBrnA=";
+    sha256 = "sha256-hBmEV3s65yQysMiq4zEP4swfCgCCiT5dzZdhg7bSNOI=";
   };
 
   sourceRoot = "${pname}-${version}/Quake";
diff --git a/pkgs/os-specific/linux/kernel/linux-5.15.nix b/pkgs/os-specific/linux/kernel/linux-5.15.nix
index 561447eca00b..fa9f84a72f6b 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.15.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.15.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.15.85";
+  version = "5.15.86";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "024qhjh9mgfnanr1qd8002n6a4wpn98lajli12a0m3n9z8lsw2rc";
+    sha256 = "1vpjnmwqsx6akph2nvbsv2jl7pp8b7xns3vmwbljsl23lkpxkz40";
   };
 } // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-6.0.nix b/pkgs/os-specific/linux/kernel/linux-6.0.nix
index 6cb9aae83be3..aa194a8efdea 100644
--- a/pkgs/os-specific/linux/kernel/linux-6.0.nix
+++ b/pkgs/os-specific/linux/kernel/linux-6.0.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "6.0.15";
+  version = "6.0.16";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v6.x/linux-${version}.tar.xz";
-    sha256 = "08389890gq4b9vkvrb22lzkr4blkn3a5ma074ns19gl89wyyp16l";
+    sha256 = "1r2wf3hf7yxl7lxma7plyi8pk3dmlsrpm763rf0g1h8ilsy72844";
   };
 } // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-6.1.nix b/pkgs/os-specific/linux/kernel/linux-6.1.nix
index 594fcb45573f..fb7aff46e537 100644
--- a/pkgs/os-specific/linux/kernel/linux-6.1.nix
+++ b/pkgs/os-specific/linux/kernel/linux-6.1.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "6.1.1";
+  version = "6.1.2";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v6.x/linux-${version}.tar.xz";
-    sha256 = "1yqxjz0f722s2bcssqg5b6m6lvq5l4vrlh3bjviajda4rxvi7rm3";
+    sha256 = "1bni72q0jjg39vqckcif57kh7d1x4k4jir5a11pz9clryp2g6hgf";
   };
 } // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-libre.nix b/pkgs/os-specific/linux/kernel/linux-libre.nix
index 9900a10417ec..698ca10016ca 100644
--- a/pkgs/os-specific/linux/kernel/linux-libre.nix
+++ b/pkgs/os-specific/linux/kernel/linux-libre.nix
@@ -1,8 +1,8 @@
 { stdenv, lib, fetchsvn, linux
 , scripts ? fetchsvn {
     url = "https://www.fsfla.org/svn/fsfla/software/linux-libre/releases/branches/";
-    rev = "19007";
-    sha256 = "1f37z6xn4ikc2p06y8rdaja8cj2r9qnp9y0zrl8g8kqmdzs6c15g";
+    rev = "19027";
+    sha256 = "0g7sf48rwicwzwhjpzs82j6v3j4s17xhrgfgysdd523r07437ryv";
   }
 , ...
 }:
diff --git a/pkgs/os-specific/linux/kernel/zen-kernels.nix b/pkgs/os-specific/linux/kernel/zen-kernels.nix
index 08671e83ffc5..c061b5433792 100644
--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@@ -4,16 +4,16 @@ let
   # comments with variant added for update script
   # ./update-zen.py zen
   zenVariant = {
-    version = "6.1"; #zen
+    version = "6.1.2"; #zen
     suffix = "zen1"; #zen
-    sha256 = "1xxn6hqq2j8l57hb32sqmfdlylzgy21g6fmra73zqql4vbx4r1nb"; #zen
+    sha256 = "0wys16f4z221r3g3fc8cb5i0hcymjsk780jk657ihx5xm3anv3kf"; #zen
     isLqx = false;
   };
   # ./update-zen.py lqx
   lqxVariant = {
-    version = "6.0.13"; #lqx
-    suffix = "lqx3"; #lqx
-    sha256 = "0dc295d9dfm3j2nmvkzy21ky1k6jp7c7miqjhqgfjny9yk1b41k4"; #lqx
+    version = "6.1.2"; #lqx
+    suffix = "lqx1"; #lqx
+    sha256 = "03kwp1c3amk87sjdji9643gr396hca8crqf2z614wkd84vdwary0"; #lqx
     isLqx = true;
   };
   zenKernelsFor = { version, suffix, sha256, isLqx }: buildLinux (args // {
diff --git a/pkgs/servers/dcnnt/default.nix b/pkgs/servers/dcnnt/default.nix
index 07458c40b8f8..1140325b05f3 100644
--- a/pkgs/servers/dcnnt/default.nix
+++ b/pkgs/servers/dcnnt/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonApplication rec {
   pname = "dcnnt";
-  version = "0.7.1";
+  version = "0.9.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-vKCQgg0m58hoN79WcZ4mM6bjCJOPxhAT4ifZ3b/5bkA=";
+    sha256 = "sha256-YG+NLKI9cz8Uu2y+Ut2q+vn67ExTya00XjHlWRAksz8=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/servers/http/jetty/default.nix b/pkgs/servers/http/jetty/default.nix
index b5e1611630e4..9082dceb5021 100644
--- a/pkgs/servers/http/jetty/default.nix
+++ b/pkgs/servers/http/jetty/default.nix
@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   pname = "jetty";
-  version = "11.0.12";
+  version = "11.0.13";
   src = fetchurl {
     url = "mirror://maven/org/eclipse/jetty/jetty-home/${version}/jetty-home-${version}.tar.gz";
-    sha256 = "sha256-otRm4hOJYK5QbWYevMosQlrSbmcni4ZREvwBo751JOQ=";
+    sha256 = "sha256-RZryj2AJKKv13iwRBVwushOpPFLUj7wd4JIgJ6JVIz4=";
   };
 
   dontBuild = true;
diff --git a/pkgs/servers/http/unit/default.nix b/pkgs/servers/http/unit/default.nix
index 5ce6af5aae4a..87506287a876 100644
--- a/pkgs/servers/http/unit/default.nix
+++ b/pkgs/servers/http/unit/default.nix
@@ -30,14 +30,14 @@ let
   php81-unit = php81.override phpConfig;
 
 in stdenv.mkDerivation rec {
-  version = "1.28.0";
+  version = "1.29.0";
   pname = "unit";
 
   src = fetchFromGitHub {
     owner = "nginx";
     repo = pname;
     rev = version;
-    sha256 = "sha256-nsalloOghC8tOMRP/N/L2raOmWwA4cz6Yr6H3IHHbR4=";
+    sha256 = "sha256-Na7whutGpd1yLePlcZyiZK9a/Y4YQnv7dkC5FjENqzs=";
   };
 
   nativeBuildInputs = [ which ];
diff --git a/pkgs/servers/irc/inspircd/default.nix b/pkgs/servers/irc/inspircd/default.nix
index 8f2d607d1a44..c8a9e12631e4 100644
--- a/pkgs/servers/irc/inspircd/default.nix
+++ b/pkgs/servers/irc/inspircd/default.nix
@@ -50,6 +50,7 @@ let
     "mysql"
     "pgsql"
     "regex_pcre"
+    "regex_pcre2"
     "regex_re2"
     "regex_tre"
     "sqlite3"
@@ -69,6 +70,7 @@ in
 , postgresql
 , libmysqlclient
 , pcre
+, pcre2
 , tre
 , re2
 , sqlite
@@ -97,6 +99,7 @@ let
     mysql           = [ libmysqlclient ];
     pgsql           = [ postgresql ];
     regex_pcre      = [ pcre ];
+    regex_pcre2     = [ pcre2 ];
     regex_re2       = [ re2 ];
     regex_tre       = [ tre ];
     sqlite3         = [ sqlite ];
@@ -142,13 +145,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "inspircd";
-  version = "3.14.0";
+  version = "3.15.0";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-xrS/lvXHMVdtKta+57Vu4HygAuALFj+odJi8ScyrLGQ=";
+    sha256 = "sha256-4n9Tj+xTmPRPisiFjlyx7kYfReonIxoCWu18XWfEXY0=";
   };
 
   outputs = [ "bin" "lib" "man" "doc" "out" ];
diff --git a/pkgs/servers/nosql/redis/default.nix b/pkgs/servers/nosql/redis/default.nix
index 804070d0f0f5..f99935449cb0 100644
--- a/pkgs/servers/nosql/redis/default.nix
+++ b/pkgs/servers/nosql/redis/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, lua, pkg-config, nixosTests
-, tcl, which, ps, fetchpatch
+, tcl, which, ps, getconf, fetchpatch
 , withSystemd ? stdenv.isLinux && !stdenv.hostPlatform.isStatic, systemd
 # dependency ordering is broken at the moment when building with openssl
 , tlsSupport ? !stdenv.hostPlatform.isStatic, openssl
@@ -45,7 +45,7 @@ stdenv.mkDerivation rec {
 
   # darwin currently lacks a pure `pgrep` which is extensively used here
   doCheck = !stdenv.isDarwin;
-  checkInputs = [ which tcl ps ];
+  checkInputs = [ which tcl ps ] ++ lib.optionals stdenv.hostPlatform.isStatic [ getconf ];
   checkPhase = ''
     runHook preCheck
 
diff --git a/pkgs/servers/pocketbase/default.nix b/pkgs/servers/pocketbase/default.nix
index ae3825c3907d..fc5fc093dcd1 100644
--- a/pkgs/servers/pocketbase/default.nix
+++ b/pkgs/servers/pocketbase/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "pocketbase";
-  version = "0.10.1";
+  version = "0.10.4";
 
   src = fetchFromGitHub {
     owner = "pocketbase";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-IFyiopURkza22VYW5VM23hZ+GAKr+ykxn7r/MyQfGAI=";
+    sha256 = "sha256-ma60DvoknvB1NN+DEq6CMnhSjcR/ACWCQSOYbyRlsCs=";
   };
 
-  vendorSha256 = "sha256-5iT67xJ9pH/QhkMTKvYIU0NsMWg6KVum+trNyt2a2rg=";
+  vendorSha256 = "sha256-crVyKpvy7twZFDwwYNe+8GB0UAJ8j4F1yqYFu2CWW7o=";
 
   # This is the released subpackage from upstream repo
   subPackages = [ "examples/base" ];
diff --git a/pkgs/servers/sql/pgpool/default.nix b/pkgs/servers/sql/pgpool/default.nix
index 10b8871c5786..f6f40bcd6957 100644
--- a/pkgs/servers/sql/pgpool/default.nix
+++ b/pkgs/servers/sql/pgpool/default.nix
@@ -10,12 +10,12 @@
 
 stdenv.mkDerivation rec {
   pname = "pgpool-II";
-  version = "4.3.3";
+  version = "4.4.1";
 
   src = fetchurl {
     url = "https://www.pgpool.net/mediawiki/download.php?f=pgpool-II-${version}.tar.gz";
     name = "pgpool-II-${version}.tar.gz";
-    sha256 = "sha256-bHNDS67lgThqlVX+WWKL9GeCD31b2+M0F2g5mgOCyXk=";
+    sha256 = "sha256-Szebu6jheBKKHO5KW9GuEW3ts9phIbcowY8PVMiB8yg=";
   };
 
   buildInputs = [
diff --git a/pkgs/servers/tautulli/default.nix b/pkgs/servers/tautulli/default.nix
index eb145bccf099..e68cbf073e01 100644
--- a/pkgs/servers/tautulli/default.nix
+++ b/pkgs/servers/tautulli/default.nix
@@ -2,7 +2,7 @@
 
 buildPythonApplication rec {
   pname = "Tautulli";
-  version = "2.10.5";
+  version = "2.11.1";
   format = "other";
 
   pythonPath = [ setuptools ];
@@ -12,7 +12,7 @@ buildPythonApplication rec {
     owner = "Tautulli";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-+lXiRM4D9tOE55guond9coFRC61X7CVPS2HjRDtqiII=";
+    sha256 = "sha256-9hWTnBi8t3ZJzrDvvViQ/jYDdbNCabVAion9E9sjqRQ=";
   };
 
   installPhase = ''
@@ -48,6 +48,6 @@ buildPythonApplication rec {
     homepage = "https://tautulli.com/";
     license = licenses.gpl3Plus;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ csingley rhoriguchi ];
+    maintainers = with maintainers; [ rhoriguchi ];
   };
 }
diff --git a/pkgs/servers/tidb/default.nix b/pkgs/servers/tidb/default.nix
new file mode 100644
index 000000000000..e9fabdfbd687
--- /dev/null
+++ b/pkgs/servers/tidb/default.nix
@@ -0,0 +1,31 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "tidb";
+  version = "6.5.0";
+
+  src = fetchFromGitHub {
+    owner = "pingcap";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-U3RGQADiS3mNq+4U+Qn+LMYbX8vxkTmofnRc+yrAcIA=";
+  };
+
+  vendorSha256 = "sha256-ljPFNjnmPaUx1PHtjlJh9ubKBDS3PgvbqTce9pi3GSc=";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/pingcap/tidb/dumpling/cli.ReleaseVersion=${version}"
+    "-X github.com/pingcap/tidb/util/versioninfo.TiDBEdition=Community"
+  ];
+
+  subPackages = [ "tidb-server" ];
+
+  meta = with lib; {
+    description = "An open-source, cloud-native, distributed, MySQL-Compatible database for elastic scale and real-time analytics";
+    homepage = "https://pingcap.com";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ candyc1oud ];
+  };
+}
diff --git a/pkgs/servers/web-apps/bookstack/default.nix b/pkgs/servers/web-apps/bookstack/default.nix
index bcac0e37ffc0..75fe60e2557a 100644
--- a/pkgs/servers/web-apps/bookstack/default.nix
+++ b/pkgs/servers/web-apps/bookstack/default.nix
@@ -16,13 +16,13 @@ let
 
 in package.override rec {
   pname = "bookstack";
-  version = "22.11";
+  version = "22.11.1";
 
   src = fetchFromGitHub {
     owner = "bookstackapp";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1k82dmlrq0ni9c4wf77d4jzrf24jxi1h5zfsj7132z4ql5di5gz4";
+    sha256 = "sha256-0yofstZiTK/I6c8go5ENivq41nOfL+0mzIHgbQSEUWo=";
   };
 
   meta = with lib; {
diff --git a/pkgs/tools/filesystems/juicefs/default.nix b/pkgs/tools/filesystems/juicefs/default.nix
index 7418e858b20c..193bc25fbc91 100644
--- a/pkgs/tools/filesystems/juicefs/default.nix
+++ b/pkgs/tools/filesystems/juicefs/default.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "juicefs";
-  version = "1.0.2";
+  version = "1.0.3";
 
   src = fetchFromGitHub {
     owner = "juicedata";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-JxN8p/935k+mWkGNSKrI7jCTxcGs5TcUXcmkDjwnzZg=";
+    sha256 = "sha256-zGVOodjNPH/vCIBEjXo3MTg8McybakMv7tg0Y9ahasU=";
   };
 
-  vendorSha256 = "sha256-rYyzy6UQQu8q+ei4GAEEq+JPhAAUvHcRpIzNts150OA=";
+  vendorSha256 = "sha256-YzFGqn9r06TEMiKuuUbUkoacFpsAOPopX9MNB4mlTIM=";
 
   ldflags = [ "-s" "-w" ];
 
diff --git a/pkgs/tools/graphics/sanjuuni/default.nix b/pkgs/tools/graphics/sanjuuni/default.nix
new file mode 100644
index 000000000000..bccb336b702c
--- /dev/null
+++ b/pkgs/tools/graphics/sanjuuni/default.nix
@@ -0,0 +1,44 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, pkg-config
+, ffmpeg
+, poco
+}:
+
+stdenv.mkDerivation rec {
+  pname = "sanjuuni";
+  version = "0.2";
+
+  src = fetchFromGitHub {
+    owner = "MCJack123";
+    repo = "sanjuuni";
+    rev = version;
+    sha256 = "sha256-WWDbPwiU4YD8XCMuqLWEGinpHkq2FNJZsz3GyVqjDHQ=";
+  };
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    ffmpeg
+    poco
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm755 sanjuuni $out/bin/sanjuuni
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/MCJack123/sanjuuni";
+    description = "A command-line tool that converts images and videos into a format that can be displayed in ComputerCraft";
+    maintainers = [ maintainers.tomodachi94 ];
+    license = licenses.gpl2Plus;
+    broken = stdenv.isDarwin;
+  };
+}
diff --git a/pkgs/tools/inputmethods/remote-touchpad/default.nix b/pkgs/tools/inputmethods/remote-touchpad/default.nix
index 35e334a2fe7f..a086892caf44 100644
--- a/pkgs/tools/inputmethods/remote-touchpad/default.nix
+++ b/pkgs/tools/inputmethods/remote-touchpad/default.nix
@@ -1,27 +1,27 @@
 { buildGoModule
 , fetchFromGitHub
 , lib
-, libX11
 , libXi
+, libXrandr
 , libXt
 , libXtst
 }:
 
 buildGoModule rec {
   pname = "remote-touchpad";
-  version = "1.2.2";
+  version = "1.2.3";
 
   src = fetchFromGitHub {
     owner = "unrud";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-KkrBWrZBvALM0TdF8AlW5Zf+r8EO9I76Otkq4cA+ikg=";
+    sha256 = "sha256-Yakx4eHcw3p8UAg3zAiWVrZyOFChhC5wWa0uJIKJn5g=";
   };
 
-  buildInputs = [ libX11 libXi libXt libXtst ];
+  buildInputs = [ libXi libXrandr libXt libXtst ];
   tags = [ "portal,x11" ];
 
-  vendorSha256 = "sha256-lEl0SOqbw6PARgO1qIN20p13BbexfCeJug1ZkuahV+k=";
+  vendorSha256 = "sha256-xlGAxKr2fav8WgAO+zW6ZTL7QgkdyUqRdQIOErDjRTg=";
 
   meta = with lib; {
     description = "Control mouse and keyboard from the webbrowser of a smartphone.";
diff --git a/pkgs/tools/misc/fend/default.nix b/pkgs/tools/misc/fend/default.nix
index 453697e8a5cc..ecf2a4bf0e5a 100644
--- a/pkgs/tools/misc/fend/default.nix
+++ b/pkgs/tools/misc/fend/default.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "fend";
-  version = "1.1.1";
+  version = "1.1.3";
 
   src = fetchFromGitHub {
     owner = "printfn";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-1hoMIZ4mfXYF+ec/Eax2fSNBbx+UEY2c/jQCaRi+UqU=";
+    sha256 = "sha256-3A+MxRonN1dhF7PrsGgc6zai1TQ9K8YIyqD0lqa3/EY=";
   };
 
-  cargoSha256 = "sha256-jGPS9x4DKQCXZkaJu9qIEqoxIu+1WraqfqxGFRV5z7A=";
+  cargoSha256 = "sha256-VgueZKMDI35ERQR+V2SFxnUplHFS0LbJlGb/bRXUYWk=";
 
   nativeBuildInputs = [ pandoc installShellFiles ];
   buildInputs = lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.Security ];
diff --git a/pkgs/tools/misc/hoard/default.nix b/pkgs/tools/misc/hoard/default.nix
index e69b517b4e15..1eb1080c16b8 100644
--- a/pkgs/tools/misc/hoard/default.nix
+++ b/pkgs/tools/misc/hoard/default.nix
@@ -2,13 +2,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "hoard";
-  version = "1.0.1";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "Hyde46";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-xXZ1bbCRhS8/rb1eIErvw2wEWF1unLXSP/YKn5Z4Vwo=";
+    sha256 = "sha256-WCyu6vW0l8J2Xh8OGXMXVDBs287m2nPlRHeA0j8uvlk=";
   };
 
   buildInputs = [ ncurses openssl ]
@@ -16,7 +16,7 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  cargoSha256 = "sha256-c60yxbZG258R5iH6x0LhipbyXal/kDxddEzTfl82hCE=";
+  cargoSha256 = "sha256-Cku9NnrjWT7VmOCryb0sbCQibG+iU9CHT3Cvd6M/9f4=";
 
   meta = with lib; {
     description = "CLI command organizer written in rust";
diff --git a/pkgs/tools/misc/open-pdf-sign/default.nix b/pkgs/tools/misc/open-pdf-sign/default.nix
index 66cccb240233..ca18fb3a0466 100644
--- a/pkgs/tools/misc/open-pdf-sign/default.nix
+++ b/pkgs/tools/misc/open-pdf-sign/default.nix
@@ -1,12 +1,12 @@
 { lib, stdenv, fetchurl, makeWrapper, jre, nix-update-script }:
 
 stdenv.mkDerivation rec {
-  version = "0.1.1";
+  version = "0.1.2";
   pname = "open-pdf-sign";
 
   src = fetchurl {
     url = "https://github.com/open-pdf-sign/open-pdf-sign/releases/download/v${version}/open-pdf-sign.jar";
-    sha256 = "sha256-n8ua/wUz/PquB7viaFqBu2XX1KQYago4s6JUwYRLvNA=";
+    sha256 = "sha256-k7ECqrZj7MXbQN5HCcVNcKbLe9LjigQboYs65gf4awA=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/networking/hans/default.nix b/pkgs/tools/networking/hans/default.nix
index 04271d6ef710..86855cf6034f 100644
--- a/pkgs/tools/networking/hans/default.nix
+++ b/pkgs/tools/networking/hans/default.nix
@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   pname = "hans";
-  version = "1.0";
+  version = "1.1";
 
   src = fetchFromGitHub {
-    sha256 = "1qnfl7wr5x937b6jx3vhhvnwnrclrqvq7d7zxbfhk74pdwnjy8n4";
+    sha256 = "sha256-r6IDs8Seys94LBNnedcfVX5aW8x//ZN0Yh/DGTg8niA=";
     rev = "v${version}";
     repo = "hans";
     owner = "friedrich";
diff --git a/pkgs/tools/networking/pathvector/default.nix b/pkgs/tools/networking/pathvector/default.nix
index 4ca1504070a2..b6c0f0b05cbd 100644
--- a/pkgs/tools/networking/pathvector/default.nix
+++ b/pkgs/tools/networking/pathvector/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "pathvector";
-  version = "6.0.2";
+  version = "6.0.3";
 
   src = fetchFromGitHub {
     owner = "natesales";
     repo = "pathvector";
     rev = "v${version}";
-    sha256 = "sha256-Rr7SVvi2K20qFTd4Gd2BzBTVIa/lCeBAJHLZ6iV2aSw=";
+    sha256 = "sha256-WY9208bbJOSDJ9WaV8KIr65GZjqhFjdzwTga0u4oQo4=";
   };
 
-  vendorSha256 = "sha256-bqfYILEGgbnla7EUrzjIO2mMAuL6e4WI2OHUwOr6i+g=";
+  vendorSha256 = "sha256-R3o1L34FXbtRzJ1I2Xj4iWsiFJJWexGWYv2TmvhINe0=";
 
   CGO_ENABLED = 0;
 
diff --git a/pkgs/tools/networking/ssh-askpass-fullscreen/default.nix b/pkgs/tools/networking/ssh-askpass-fullscreen/default.nix
index beb61502ec7f..3faff612aadc 100644
--- a/pkgs/tools/networking/ssh-askpass-fullscreen/default.nix
+++ b/pkgs/tools/networking/ssh-askpass-fullscreen/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ssh-askpass-fullscreen";
-  version = "1.2";
+  version = "1.3";
 
   src = fetchFromGitHub {
     owner = "atj";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1zldhylln412974cnxyqcrrc6b4ry3m9s5ijq3dnwz2g7nz1bx9d";
+    sha256 = "sha256-1GER+SxTpbMiYLwFCwLX/hLvzCIqutyvQc9DNJ7d1C0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/networking/xray/default.nix b/pkgs/tools/networking/xray/default.nix
index e3878111d24c..29b898e8da11 100644
--- a/pkgs/tools/networking/xray/default.nix
+++ b/pkgs/tools/networking/xray/default.nix
@@ -20,16 +20,16 @@ let
 in
 buildGoModule rec {
   pname = "xray";
-  version = "1.6.6-2";
+  version = "1.7.0";
 
   src = fetchFromGitHub {
     owner = "XTLS";
     repo = "Xray-core";
     rev = "v${version}";
-    sha256 = "sha256-nNG1HNsV/ITWdM9a4KkV44Oq/P92yD/oQjO7+pSBX38=";
+    sha256 = "sha256-aNIb90obew+tvd/rYVddK1MmUqLXSqi9xAu65BQFvk0=";
   };
 
-  vendorSha256 = "sha256-64pyrhPplki0R+rsjh6pi+PCOzWVbES40r0Z1Vhk44o=";
+  vendorSha256 = "sha256-zZdUPjlul9f1jKy0Zf79KOToHIsvfgwDp6XpFPYyTzk=";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/tools/system/java-service-wrapper/default.nix b/pkgs/tools/system/java-service-wrapper/default.nix
index 93d86a75d187..e17271d50ef2 100644
--- a/pkgs/tools/system/java-service-wrapper/default.nix
+++ b/pkgs/tools/system/java-service-wrapper/default.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "java-service-wrapper";
-  version = "3.5.50";
+  version = "3.5.51";
 
   src = fetchurl {
     url = "https://wrapper.tanukisoftware.com/download/${version}/wrapper_${version}_src.tar.gz";
-    hash = "sha256-Vw5/wN0Yr39bax4XavhM5u+sCgEA7QCrhC2V3BxB7Vo=";
+    hash = "sha256-XkgzggtFLYCt3gP0F4wq38TFHCoo/x+bDzzz/TqmvB0=";
   };
 
   buildInputs = [ jdk ];
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index d2bcbe5d679f..e33e06d48e64 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3346,6 +3346,10 @@ with pkgs;
 
   wiiload = callPackage ../development/tools/wiiload { };
 
+  winhelpcgi = callPackage ../development/tools/winhelpcgi {
+    libpng = libpng12;
+  };
+
   wiimms-iso-tools = callPackage ../tools/filesystems/wiimms-iso-tools { };
 
   waypoint = callPackage ../applications/networking/cluster/waypoint { };
@@ -9084,6 +9088,8 @@ with pkgs;
 
   leafpad = callPackage ../applications/editors/leafpad { };
 
+  l3afpad = callPackage ../applications/editors/l3afpad { };
+
   leatherman = callPackage ../development/libraries/leatherman { };
 
   ledit = callPackage ../tools/misc/ledit {
@@ -11462,6 +11468,8 @@ with pkgs;
 
   sandboxfs = callPackage ../tools/filesystems/sandboxfs { };
 
+  sanjuuni = callPackage ../tools/graphics/sanjuuni { };
+
   sasquatch = callPackage ../tools/filesystems/sasquatch { };
 
   sasview = libsForQt5.callPackage ../applications/science/misc/sasview {};
@@ -12294,6 +12302,8 @@ with pkgs;
 
   tie = callPackage ../development/tools/misc/tie { };
 
+  tidb = callPackage ../servers/tidb { };
+
   tikzit = libsForQt5.callPackage ../tools/typesetting/tikzit { };
 
   tinc_pre = callPackage ../tools/networking/tinc/pre.nix { };
@@ -31381,7 +31391,7 @@ with pkgs;
     boost = boost175;
   };
 
-  openimageio2 = callPackage ../applications/graphics/openimageio/2.x.nix { };
+  openimageio2 = darwin.apple_sdk_11_0.callPackage ../applications/graphics/openimageio/2.x.nix { };
 
   openjump = callPackage ../applications/misc/openjump { };
 
diff --git a/pkgs/top-level/ruby-packages.nix b/pkgs/top-level/ruby-packages.nix
index 2b5d1349d177..4ae1a50eb757 100644
--- a/pkgs/top-level/ruby-packages.nix
+++ b/pkgs/top-level/ruby-packages.nix
@@ -1847,10 +1847,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1fpyk1965py77al7iadkn5dibwgvybknkr7r8bii2dj73wvr29rh";
+      sha256 = "sha256-bGRp797+NJYBAACjRvnTv3EOEaxGYeNTz1aFIyb7ECM=";
       type = "gem";
     };
-    version = "2.19.0";
+    version = "2.19.1";
   };
   mab = {
     groups = ["default"];
@@ -2124,10 +2124,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0cam1455nmi3fzzpa9ixn2hsim10fbprmj62ajpd6d02mwdprwwn";
+      sha256 = "sha256-0+4A8mwVF2PaFpHH/Ghx3dA+Uy90+FEB9aztwtCZ6Vg=";
       type = "gem";
     };
-    version = "1.13.9";
+    version = "1.13.10";
   };
   octokit = {
     dependencies = ["faraday" "sawyer"];