diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index a3cdffec6794..1a5642144d5c 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -4866,6 +4866,12 @@
     githubId = 50854;
     name = "edef";
   };
+  edeneast = {
+    email = "edenofest@gmail.com";
+    github = "edeneast";
+    githubId = 2746374;
+    name = "edeneast";
+  };
   ederoyd46 = {
     email = "matt@ederoyd.co.uk";
     github = "ederoyd46";
@@ -6616,11 +6622,6 @@
     githubId = 11212268;
     name = "gruve-p";
   };
-  grxnola = {
-    github = "grxnola";
-    githubId = 49906709;
-    name = "grxnola";
-  };
   gschwartz = {
     email = "gsch@pennmedicine.upenn.edu";
     github = "GregorySchwartz";
@@ -12969,6 +12970,11 @@
     githubId = 585547;
     name = "Jaka Hudoklin";
   };
+  offsetcyan = {
+    github = "offsetcyan";
+    githubId = 49906709;
+    name = "Dakota";
+  };
   oida = {
     email = "oida@posteo.de";
     github = "oida";
diff --git a/pkgs/applications/audio/bitwig-studio/bitwig-studio3.nix b/pkgs/applications/audio/bitwig-studio/bitwig-studio3.nix
index 5eb94f8445e0..5f750a885d15 100644
--- a/pkgs/applications/audio/bitwig-studio/bitwig-studio3.nix
+++ b/pkgs/applications/audio/bitwig-studio/bitwig-studio3.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "bitwig-studio";
-  version = "3.3.7";
+  version = "3.3.11";
 
   src = fetchurl {
     url = "https://downloads.bitwig.com/stable/${version}/${pname}-${version}.deb";
-    sha256 = "13jr45kzv0xjhhqk30qpq793349qyx8jpas4kl6i6bk3xfrd3fbz";
+    sha256 = "sha256-cF8gVPjM0KUcKOW09uFccp4/lzbUmZcBkVOwr/A/8Yw=";
   };
 
   nativeBuildInputs = [ dpkg makeWrapper wrapGAppsHook ];
@@ -36,11 +36,8 @@ stdenv.mkDerivation rec {
     cp -r opt/bitwig-studio $out/libexec
     ln -s $out/libexec/bitwig-studio $out/bin/bitwig-studio
     cp -r usr/share $out/share
-    substitute usr/share/applications/bitwig-studio.desktop \
-      $out/share/applications/bitwig-studio.desktop \
-      --replace /usr/bin/bitwig-studio $out/bin/bitwig-studio
 
-      runHook postInstall
+    runHook postInstall
   '';
 
   postFixup = ''
@@ -60,7 +57,6 @@ stdenv.mkDerivation rec {
         --prefix PATH : "${lib.makeBinPath [ ffmpeg ]}" \
         --suffix PATH : "${lib.makeBinPath [ xdg-utils ]}"
     done
-
   '';
 
   meta = with lib; {
diff --git a/pkgs/applications/graphics/hdrmerge/default.nix b/pkgs/applications/graphics/hdrmerge/default.nix
index d690f5e0671a..a8db24c35283 100644
--- a/pkgs/applications/graphics/hdrmerge/default.nix
+++ b/pkgs/applications/graphics/hdrmerge/default.nix
@@ -3,7 +3,6 @@
 , fetchpatch
 , fetchFromGitHub
 , cmake
-, extra-cmake-modules
 , qtbase
 , wrapQtAppsHook
 , libraw
@@ -17,12 +16,12 @@
 
 mkDerivation rec {
   pname = "hdrmerge";
-  version = "unstable-2020-11-12";
+  version = "unstable-2023-01-04";
   src = fetchFromGitHub {
     owner = "jcelaya";
     repo = "hdrmerge";
-    rev = "f5a2538cffe3e27bd9bea5d6a199fa211d05e6da";
-    sha256 = "1bzf9wawbdvdbv57hnrmh0gpjfi5hamgf2nwh2yzd4sh1ssfa8jz";
+    rev = "ca38b54f980564942a7f2b014a5f57a64c1d9019";
+    hash = "sha256-DleYgpDXP0NvbmEURXnBfe3OYnT1CaQq+Mw93JQQprE=";
   };
 
   nativeBuildInputs = [
@@ -39,17 +38,11 @@ mkDerivation rec {
   ];
 
   patches = [
+    # https://github.com/jcelaya/hdrmerge/pull/222
     (fetchpatch {
-      # patch FindAlglib.cmake to respect ALGLIB_DIR
-      # see https://github.com/jcelaya/hdrmerge/pull/213
-      name = "patch-hdrmerge-CMake.patch";
-      url = "https://github.com/mkroehnert/hdrmerge/commit/472b2dfe7d54856158aea3d5412a02d0bab1da4c.patch";
-      sha256 = "0jc713ajr4w08pfbi6bva442prj878nxp1fpl9112i3xj34x9sdi";
-    })
-    (fetchpatch {
-      name = "support-libraw-0.21.patch";
-      url = "https://github.com/jcelaya/hdrmerge/commit/779e566b3e2807280b78c79affda2cdfa64bde87.diff";
-      sha256 = "48sivCfJWEtGiBXTrO+SWTVlT9xyx92w2kkB8Wt/clk=";
+      name = "exiv2-0.28.patch";
+      url = "https://github.com/jcelaya/hdrmerge/commit/377d8e6f3c7cdd1a45b63bce2493ad177dde03fb.patch";
+      hash = "sha256-lXHML6zGkVeWKvmY5ECoJL2xjmtZz77XJd5prpgJiZo=";
     })
   ];
 
diff --git a/pkgs/applications/graphics/nufraw/default.nix b/pkgs/applications/graphics/nufraw/default.nix
index f6031bea069d..8b5966bbaf0a 100644
--- a/pkgs/applications/graphics/nufraw/default.nix
+++ b/pkgs/applications/graphics/nufraw/default.nix
@@ -1,6 +1,7 @@
-{ stdenv
+{ lib
+, stdenv
 , fetchurl
-, lib
+, fetchpatch
 
 , autoreconfHook
 , bzip2
@@ -49,14 +50,28 @@ stdenv.mkDerivation rec {
     "--enable-dst-correction"
   ];
 
+  env.NIX_CFLAGS_COMPILE = "-Wno-narrowing";
+
   postInstall = lib.optionalString addThumbnailer ''
     mkdir -p $out/share/thumbnailers
     substituteAll ${./nufraw.thumbnailer} $out/share/thumbnailers/${pname}.thumbnailer
   '';
 
-  # Fixes an upstream issue where headers with templates were included in an extern-C scope
-  # which caused the build to fail
-  patches = [ ./move-extern-c.patch ];
+  patches = [
+    # Fixes an upstream issue where headers with templates were included in an extern-C scope
+    # which caused the build to fail
+    (fetchpatch {
+      name = "0001-nufraw-glib-2.70.patch";
+      url = "https://gitlab.archlinux.org/archlinux/packaging/packages/gimp-nufraw/-/raw/3405bc864752dbd04f2d182a21b4108d6cc3aa95/0001-nufraw-glib-2.70.patch";
+      hash = "sha256-XgzgjikWTcqymHa7bKmruNZaeb2/lpN19HXoRUt5rTk=";
+    })
+  ] ++ lib.optionals (lib.versionAtLeast exiv2.version "0.28") [
+    (fetchpatch {
+      name = "0002-exiv2-error.patch";
+      url = "https://gitlab.archlinux.org/archlinux/packaging/packages/gimp-nufraw/-/raw/3405bc864752dbd04f2d182a21b4108d6cc3aa95/0002-exiv2-error.patch";
+      hash = "sha256-40/Wwk1sWiaIWp077EYgP8jFO4k1cvf30heRDMYJw3M=";
+    })
+  ];
 
   meta = with lib; {
     homepage = "https://nufraw.sourceforge.io/";
@@ -70,6 +85,6 @@ stdenv.mkDerivation rec {
       '';
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ asbachb ];
-    platforms   = [ "x86_64-linux" "i686-linux" ];
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/applications/graphics/nufraw/move-extern-c.patch b/pkgs/applications/graphics/nufraw/move-extern-c.patch
deleted file mode 100644
index 43a4942d3e62..000000000000
--- a/pkgs/applications/graphics/nufraw/move-extern-c.patch
+++ /dev/null
@@ -1,21 +0,0 @@
-diff --git a/uf_glib.h b/uf_glib.h
-index c1a17bd..8a10800 100644
---- a/uf_glib.h
-+++ b/uf_glib.h
-@@ -13,13 +13,13 @@
- #ifndef _UF_GLIB_H
- #define _UF_GLIB_H
- 
-+#include <glib.h>
-+#include <glib/gstdio.h>
-+
- #ifdef __cplusplus
- extern "C" {
- #endif
- 
--#include <glib.h>
--#include <glib/gstdio.h>
--
- // g_win32_locale_filename_from_utf8 is needed only on win32
- #ifdef _WIN32
- #define uf_win32_locale_filename_from_utf8(__some_string__) \
diff --git a/pkgs/applications/graphics/photoqt/default.nix b/pkgs/applications/graphics/photoqt/default.nix
index 3b17ce8fd4f8..fed2c944e5c5 100644
--- a/pkgs/applications/graphics/photoqt/default.nix
+++ b/pkgs/applications/graphics/photoqt/default.nix
@@ -1,28 +1,70 @@
-{ mkDerivation, lib, fetchurl, cmake, exiv2, graphicsmagick, libraw
-, qtbase, qtdeclarative, qtmultimedia, qtquickcontrols2, qttools, qtgraphicaleffects
-, extra-cmake-modules, poppler, kimageformats, libarchive, pugixml, wrapQtAppsHook}:
+{ lib
+, stdenv
+, fetchurl
+, cmake
+, extra-cmake-modules
+, qttools
+, wrapQtAppsHook
+, exiv2
+, graphicsmagick
+, kimageformats
+, libarchive
+, libraw
+, mpv
+, poppler
+, pugixml
+, qtbase
+, qtdeclarative
+, qtgraphicaleffects
+, qtmultimedia
+, qtquickcontrols
+, qtquickcontrols2
+}:
 
-mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "photoqt";
-  version = "3.1";
+  version = "3.3";
 
   src = fetchurl {
-    url = "https://${pname}.org/pkgs/${pname}-${version}.tar.gz";
-    hash = "sha256-hihfqE7XIlSAxPg3Kzld3LrYS97wDH//GGqpBpBwFm0=";
+    url = "https://photoqt.org/pkgs/photoqt-${version}.tar.gz";
+    hash = "sha256-AD+Uww/tmXRiAkmeuHBBollE6Y9L7c+fB882ALVtSXQ=";
   };
 
-  nativeBuildInputs = [ cmake extra-cmake-modules qttools wrapQtAppsHook ];
+  # error: no member named 'setlocale' in namespace 'std'; did you mean simply 'setlocale'?
+  postPatch = lib.optionalString stdenv.isDarwin ''
+    substituteInPlace cplusplus/main.cpp \
+      --replace "std::setlocale" "setlocale"
+  '';
+
+  nativeBuildInputs = [
+    cmake
+    extra-cmake-modules
+    qttools
+    wrapQtAppsHook
+  ];
 
   buildInputs = [
-    qtbase qtquickcontrols2 exiv2 graphicsmagick poppler
-    qtmultimedia qtdeclarative libraw qtgraphicaleffects
-    kimageformats libarchive pugixml
+    exiv2
+    graphicsmagick
+    kimageformats
+    libarchive
+    libraw
+    mpv
+    poppler
+    pugixml
+    qtbase
+    qtdeclarative
+    qtgraphicaleffects
+    qtmultimedia
+    qtquickcontrols
+    qtquickcontrols2
   ];
 
   cmakeFlags = [
-    "-DFREEIMAGE=OFF"
     "-DDEVIL=OFF"
     "-DCHROMECAST=OFF"
+    "-DFREEIMAGE=OFF"
+    "-DIMAGEMAGICK=OFF"
   ];
 
   preConfigure = ''
@@ -30,9 +72,11 @@ mkDerivation rec {
   '';
 
   meta = {
-    homepage = "https://photoqt.org/";
     description = "Simple, yet powerful and good looking image viewer";
+    homepage = "https://photoqt.org/";
     license = lib.licenses.gpl2Plus;
+    mainProgram = "photoqt";
+    maintainers = with lib.maintainers; [ wegank ];
     platforms = lib.platforms.unix;
   };
 }
diff --git a/pkgs/applications/graphics/phototonic/default.nix b/pkgs/applications/graphics/phototonic/default.nix
index 5044e60161cf..738f78cf347d 100644
--- a/pkgs/applications/graphics/phototonic/default.nix
+++ b/pkgs/applications/graphics/phototonic/default.nix
@@ -1,18 +1,26 @@
-{ mkDerivation, lib, fetchFromGitHub, qtbase, qmake, exiv2 }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, qmake, wrapQtAppsHook, qtbase, exiv2 }:
 
-mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "phototonic";
   version = "2.1";
 
   src = fetchFromGitHub {
-    repo = "phototonic";
     owner = "oferkv";
+    repo = "phototonic";
     rev = "v${version}";
-    sha256 = "0csidmxl1sfmn6gq81vn9f9jckb4swz3sgngnwqa4f75lr6604h7";
+    hash = "sha256-BxJgTKblOKIwt88+PT7XZE0mk0t2B4SfsdXpQHttUTM=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "exiv2-0.28.patch";
+      url = "https://gitlab.archlinux.org/archlinux/packaging/packages/phototonic/-/raw/fcfa17307ad8988750cc09200188c9365c2c0b79/exiv2-0.28.patch";
+      hash = "sha256-EayJYM4qobUWosxV2Ylj+2eiyhk1jM8OfnFZDbVdGII=";
+    })
+  ];
+
+  nativeBuildInputs = [ qmake wrapQtAppsHook ];
   buildInputs = [ qtbase exiv2 ];
-  nativeBuildInputs = [ qmake ];
 
   preConfigure = ''
     sed -i 's;/usr;$$PREFIX/;g' phototonic.pro
@@ -20,9 +28,9 @@ mkDerivation rec {
 
   meta = with lib; {
     description = "An image viewer and organizer";
-    homepage = "https://sourceforge.net/projects/phototonic/";
-    license = licenses.gpl3;
-    platforms = platforms.linux;
+    homepage = "https://github.com/oferkv/phototonic";
+    license = licenses.gpl3Plus;
     maintainers = with maintainers; [ pSub ];
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/applications/maui/booth.nix b/pkgs/applications/maui/booth.nix
index 0f753832ad14..f82055895854 100644
--- a/pkgs/applications/maui/booth.nix
+++ b/pkgs/applications/maui/booth.nix
@@ -7,6 +7,7 @@
 , kirigami2
 , mauikit
 , mauikit-filebrowsing
+, prison
 , qtgraphicaleffects
 , qtmultimedia
 , qtquickcontrols2
@@ -27,6 +28,7 @@ mkDerivation {
     kirigami2
     mauikit
     mauikit-filebrowsing
+    prison
     qtgraphicaleffects
     qtmultimedia
     qtquickcontrols2
diff --git a/pkgs/applications/maui/default.nix b/pkgs/applications/maui/default.nix
index 5379910c880f..b64a3d8455eb 100644
--- a/pkgs/applications/maui/default.nix
+++ b/pkgs/applications/maui/default.nix
@@ -61,6 +61,7 @@ let
       mauikit = callPackage ./mauikit.nix { };
       mauikit-accounts = callPackage ./mauikit-accounts.nix { };
       mauikit-calendar = callPackage ./mauikit-calendar { };
+      mauikit-documents = callPackage ./mauikit-documents.nix { };
       mauikit-filebrowsing = callPackage ./mauikit-filebrowsing.nix { };
       mauikit-imagetools = callPackage ./mauikit-imagetools.nix { };
       mauikit-terminal = callPackage ./mauikit-terminal.nix { };
diff --git a/pkgs/applications/maui/mauikit-documents.nix b/pkgs/applications/maui/mauikit-documents.nix
new file mode 100644
index 000000000000..19d8e9faa207
--- /dev/null
+++ b/pkgs/applications/maui/mauikit-documents.nix
@@ -0,0 +1,44 @@
+{ lib
+, mkDerivation
+, cmake
+, extra-cmake-modules
+, karchive
+, kconfig
+, kcoreaddons
+, kfilemetadata
+, kguiaddons
+, ki18n
+, kiconthemes
+, kio
+, mauikit
+, poppler
+}:
+
+mkDerivation {
+  pname = "mauikit-documents";
+
+  nativeBuildInputs = [
+    cmake
+    extra-cmake-modules
+  ];
+
+  buildInputs = [
+    karchive
+    kconfig
+    kcoreaddons
+    kfilemetadata
+    kguiaddons
+    ki18n
+    kiconthemes
+    kio
+    mauikit
+    poppler
+  ];
+
+  meta = {
+    homepage = "https://invent.kde.org/maui/mauikit-documents";
+    description = "MauiKit QtQuick plugins for text editing";
+    license = with lib.licenses; [ bsd2 lgpl21Plus ];
+    maintainers = with lib.maintainers; [ dotlambda ];
+  };
+}
diff --git a/pkgs/applications/maui/shelf.nix b/pkgs/applications/maui/shelf.nix
index 3942b9a34d6a..3ac804512531 100644
--- a/pkgs/applications/maui/shelf.nix
+++ b/pkgs/applications/maui/shelf.nix
@@ -9,6 +9,7 @@
 , kio
 , kirigami2
 , mauikit
+, mauikit-documents
 , mauikit-filebrowsing
 , mauikit-texteditor
 , qtmultimedia
@@ -32,6 +33,7 @@ mkDerivation {
     kio
     kirigami2
     mauikit
+    mauikit-documents
     mauikit-filebrowsing
     mauikit-texteditor
     qtmultimedia
diff --git a/pkgs/applications/maui/srcs.nix b/pkgs/applications/maui/srcs.nix
index 2221ae4a42f1..6473b9607bfd 100644
--- a/pkgs/applications/maui/srcs.nix
+++ b/pkgs/applications/maui/srcs.nix
@@ -4,19 +4,19 @@
 
 {
   agenda = {
-    version = "0.5.0";
+    version = "0.5.1";
     src = fetchurl {
-      url = "${mirror}/stable/maui/agenda/0.5.0/agenda-0.5.0.tar.xz";
-      sha256 = "1ak87cda64c05knzdjf6sxjn70chs2sa6zh2adhq3mqm3dh9flf7";
-      name = "agenda-0.5.0.tar.xz";
+      url = "${mirror}/stable/maui/agenda/0.5.1/agenda-0.5.1.tar.xz";
+      sha256 = "1c45fnlg15pjd3ljmm3w2jcrq94jirrykpq1xrvgfbv5d50796x7";
+      name = "agenda-0.5.1.tar.xz";
     };
   };
   arca = {
-    version = "0.5.0";
+    version = "0.5.1";
     src = fetchurl {
-      url = "${mirror}/stable/maui/arca/0.5.0/arca-0.5.0.tar.xz";
-      sha256 = "12bqk5dxh1rqnbj61kymkzzgmilas6jilid4rijdgjaahdahw6hk";
-      name = "arca-0.5.0.tar.xz";
+      url = "${mirror}/stable/maui/arca/0.5.1/arca-0.5.1.tar.xz";
+      sha256 = "0irbc1ysnia5wp398ddijad77qg7gd076fkm972wgk4pmqnm0rcz";
+      name = "arca-0.5.1.tar.xz";
     };
   };
   bonsai = {
@@ -28,35 +28,35 @@
     };
   };
   booth = {
-    version = "1.1.0";
+    version = "1.1.1";
     src = fetchurl {
-      url = "${mirror}/stable/maui/booth/1.1.0/booth-1.1.0.tar.xz";
-      sha256 = "1jr5iha1lvqnsh29y6k60nd63dqyh1clj8idqssfvaz09skbyk1q";
-      name = "booth-1.1.0.tar.xz";
+      url = "${mirror}/stable/maui/booth/1.1.1/booth-1.1.1.tar.xz";
+      sha256 = "1s3h083qbjjj5dmm27vc66vx0mzgpl4klhi9cc07z3apjldf1si0";
+      name = "booth-1.1.1.tar.xz";
     };
   };
   buho = {
-    version = "3.0.0";
+    version = "3.0.1";
     src = fetchurl {
-      url = "${mirror}/stable/maui/buho/3.0.0/buho-3.0.0.tar.xz";
-      sha256 = "1426b9wr8l8rzxgyahlchv9d4dgpqz5dr5nza3jax6mlh4ams507";
-      name = "buho-3.0.0.tar.xz";
+      url = "${mirror}/stable/maui/buho/3.0.1/buho-3.0.1.tar.xz";
+      sha256 = "0favgdwnb8gvmpisq58bmjvnajzgdk886z5m07vz4mfj7ipjjzbv";
+      name = "buho-3.0.1.tar.xz";
     };
   };
   clip = {
-    version = "3.0.0";
+    version = "3.0.1";
     src = fetchurl {
-      url = "${mirror}/stable/maui/clip/3.0.0/clip-3.0.0.tar.xz";
-      sha256 = "0a6z4h5rp3kmy5pp37df0abvbqxd6hx1jkss9w2sh59v8zijvrck";
-      name = "clip-3.0.0.tar.xz";
+      url = "${mirror}/stable/maui/clip/3.0.1/clip-3.0.1.tar.xz";
+      sha256 = "1acjnam8ljc6mw7xbphh99li9437kqlmdb258j7w3vgnqh2psipx";
+      name = "clip-3.0.1.tar.xz";
     };
   };
   communicator = {
-    version = "3.0.0";
+    version = "3.0.1";
     src = fetchurl {
-      url = "${mirror}/stable/maui/communicator/3.0.0/communicator-3.0.0.tar.xz";
-      sha256 = "01qgqirjax3l8sn9813dl6ppz9p2syg83ljrxqgaj94h08ll2vi0";
-      name = "communicator-3.0.0.tar.xz";
+      url = "${mirror}/stable/maui/communicator/3.0.1/communicator-3.0.1.tar.xz";
+      sha256 = "1j4yaw8w1hyvndra881r70ayz4ph00w41hhysqhgccxr36abcncl";
+      name = "communicator-3.0.1.tar.xz";
     };
   };
   era = {
@@ -68,123 +68,123 @@
     };
   };
   fiery = {
-    version = "1.1.0";
+    version = "1.1.1";
     src = fetchurl {
-      url = "${mirror}/stable/maui/fiery/1.1.0/fiery-1.1.0.tar.xz";
-      sha256 = "16kwi6gwxzrb2c8x9s97ibsflv30j3z3sp2if6ypand74ni1b4px";
-      name = "fiery-1.1.0.tar.xz";
+      url = "${mirror}/stable/maui/fiery/1.1.1/fiery-1.1.1.tar.xz";
+      sha256 = "03aszdvksx5bsrh479wl6vq28l026ddfv8p9privigjpcdbbaslk";
+      name = "fiery-1.1.1.tar.xz";
     };
   };
   index-fm = {
-    version = "3.0.0";
+    version = "3.0.1";
     src = fetchurl {
-      url = "${mirror}/stable/maui/index/3.0.0/index-fm-3.0.0.tar.xz";
-      sha256 = "1w9fdwn7yvy389300p8qhb3795zzaqkqfrc1vnxydgzn995yv80w";
-      name = "index-fm-3.0.0.tar.xz";
+      url = "${mirror}/stable/maui/index/3.0.1/index-fm-3.0.1.tar.xz";
+      sha256 = "046in0bqblpqcxp4rz417pjpy1m57p611wlzdsw8hp4dl1l2qmn9";
+      name = "index-fm-3.0.1.tar.xz";
     };
   };
   mauikit = {
-    version = "3.0.0";
+    version = "3.0.1";
     src = fetchurl {
-      url = "${mirror}/stable/maui/mauikit/3.0.0/mauikit-3.0.0.tar.xz";
-      sha256 = "1n95fcwgda9m9fmc90q0079xx4m9yh99yd51pj0nw7ynazlq2wyy";
-      name = "mauikit-3.0.0.tar.xz";
+      url = "${mirror}/stable/maui/mauikit/3.0.1/mauikit-3.0.1.tar.xz";
+      sha256 = "0vlxs13k3wk2kk3jcxrdmpa3d9gblvzp22sqqd7nys6kilq8kzdb";
+      name = "mauikit-3.0.1.tar.xz";
     };
   };
   mauikit-accounts = {
-    version = "3.0.0";
+    version = "3.0.1";
     src = fetchurl {
-      url = "${mirror}/stable/maui/mauikit-accounts/3.0.0/mauikit-accounts-3.0.0.tar.xz";
-      sha256 = "0ff7zrlvhqfsnwbfbp5bz3vgxldxl09rlaajz4g9k7n81apa0fgv";
-      name = "mauikit-accounts-3.0.0.tar.xz";
+      url = "${mirror}/stable/maui/mauikit-accounts/3.0.1/mauikit-accounts-3.0.1.tar.xz";
+      sha256 = "1b6nmnh5fh6gis7r56s41204g9y7cp5g2qmsk0r6b3a3x0ndwmqj";
+      name = "mauikit-accounts-3.0.1.tar.xz";
     };
   };
   mauikit-calendar = {
-    version = "1.1.0";
+    version = "3.0.1";
     src = fetchurl {
-      url = "${mirror}/stable/maui/mauikit-calendar/1.1.0/mauikit-calendar-1.1.0.tar.xz";
-      sha256 = "1532ndxw6a2isw1zxhp5khk0ydczm03d7b42c5smjy56fkp7xmgx";
-      name = "mauikit-calendar-1.1.0.tar.xz";
+      url = "${mirror}/stable/maui/mauikit-calendar/3.0.1/mauikit-calendar-3.0.1.tar.xz";
+      sha256 = "1s95nkbyc4k8999hsnr5aw80qhr66q4z51wq2ail3h0df7p1f700";
+      name = "mauikit-calendar-3.0.1.tar.xz";
     };
   };
   mauikit-documents = {
-    version = "1.1.0";
+    version = "3.0.1";
     src = fetchurl {
-      url = "${mirror}/stable/maui/mauikit-documents/1.1.0/mauikit-documents-1.1.0.tar.xz";
-      sha256 = "06r5jf0rmrry9hd0gbjz63a0f5r8dykkggww531jaqm898h79wrs";
-      name = "mauikit-documents-1.1.0.tar.xz";
+      url = "${mirror}/stable/maui/mauikit-documents/3.0.1/mauikit-documents-3.0.1.tar.xz";
+      sha256 = "1w2dszggxbqla5ab3739l1j79l2qa3br8drvkidivir8vwxifj3v";
+      name = "mauikit-documents-3.0.1.tar.xz";
     };
   };
   mauikit-filebrowsing = {
-    version = "3.0.0";
+    version = "3.0.1";
     src = fetchurl {
-      url = "${mirror}/stable/maui/mauikit-filebrowsing/3.0.0/mauikit-filebrowsing-3.0.0.tar.xz";
-      sha256 = "03qdiww4dh6picsfhmzg0v5mf3ygsnprwq3x6s1lzlanl5a83pyk";
-      name = "mauikit-filebrowsing-3.0.0.tar.xz";
+      url = "${mirror}/stable/maui/mauikit-filebrowsing/3.0.1/mauikit-filebrowsing-3.0.1.tar.xz";
+      sha256 = "0z8070p1m2c2mv3xdhsz4scnasbwxf698mql0svqzmjiy8vjfnn2";
+      name = "mauikit-filebrowsing-3.0.1.tar.xz";
     };
   };
   mauikit-imagetools = {
-    version = "3.0.0";
+    version = "3.0.1";
     src = fetchurl {
-      url = "${mirror}/stable/maui/mauikit-imagetools/3.0.0/mauikit-imagetools-3.0.0.tar.xz";
-      sha256 = "0lj8d6k78xiy3wcc2jhhqvdw0p5vji95280dvclkmh0ilvb7lfrd";
-      name = "mauikit-imagetools-3.0.0.tar.xz";
+      url = "${mirror}/stable/maui/mauikit-imagetools/3.0.1/mauikit-imagetools-3.0.1.tar.xz";
+      sha256 = "0aayhmmk6bd3n5p1mgm9k1jycsw8li5fs1xq7x42h93zhvxcw1va";
+      name = "mauikit-imagetools-3.0.1.tar.xz";
     };
   };
   mauikit-terminal = {
-    version = "1.1.0";
+    version = "3.0.1";
     src = fetchurl {
-      url = "${mirror}/stable/maui/mauikit-terminal/1.1.0/mauikit-terminal-1.1.0.tar.xz";
-      sha256 = "0aki6m39yy2cnq3v6mdgyzld3slp0k5qd7v5g5hqb38mrbsbl66a";
-      name = "mauikit-terminal-1.1.0.tar.xz";
+      url = "${mirror}/stable/maui/mauikit-terminal/3.0.1/mauikit-terminal-3.0.1.tar.xz";
+      sha256 = "1w7d04cdq2b4mkjl7ngj1v580dlhrpvr1n0gy5jcfv6x4ia3g8k3";
+      name = "mauikit-terminal-3.0.1.tar.xz";
     };
   };
   mauikit-texteditor = {
-    version = "3.0.0";
+    version = "3.0.1";
     src = fetchurl {
-      url = "${mirror}/stable/maui/mauikit-texteditor/3.0.0/mauikit-texteditor-3.0.0.tar.xz";
-      sha256 = "1flbgsrp91fgv9m1xvlzsng3ks94i07k79832nx2azzs4g704sgf";
-      name = "mauikit-texteditor-3.0.0.tar.xz";
+      url = "${mirror}/stable/maui/mauikit-texteditor/3.0.1/mauikit-texteditor-3.0.1.tar.xz";
+      sha256 = "063zxzc530zgamr6fm5brm2rqpmq4rx4wsq7cx7sxfgyknag52m6";
+      name = "mauikit-texteditor-3.0.1.tar.xz";
     };
   };
   mauiman = {
-    version = "1.1.0";
+    version = "3.0.1";
     src = fetchurl {
-      url = "${mirror}/stable/maui/mauiman/1.1.0/mauiman-1.1.0.tar.xz";
-      sha256 = "13s6wvp7h4zivw2m4hblsyha9qkihfqx41gh9jyw9pj8kmfp08v5";
-      name = "mauiman-1.1.0.tar.xz";
+      url = "${mirror}/stable/maui/mauiman/3.0.1/mauiman-3.0.1.tar.xz";
+      sha256 = "0nygvb0nixcidla94xhwa4rrdwi3r2kcq62m9a3sabpl0z22mppq";
+      name = "mauiman-3.0.1.tar.xz";
     };
   };
   nota = {
-    version = "3.0.0";
+    version = "3.0.1";
     src = fetchurl {
-      url = "${mirror}/stable/maui/nota/3.0.0/nota-3.0.0.tar.xz";
-      sha256 = "0jk18qxkcx6n54pnm4mr2vpnhi07hscavacr1kijk4rxf0dyxf1i";
-      name = "nota-3.0.0.tar.xz";
+      url = "${mirror}/stable/maui/nota/3.0.1/nota-3.0.1.tar.xz";
+      sha256 = "1ynnpkwjmj9xx5xzlz32y0k6mcrz2y50z1s4lq5kshiwa3vbjn61";
+      name = "nota-3.0.1.tar.xz";
     };
   };
   pix = {
-    version = "3.0.0";
+    version = "3.0.1";
     src = fetchurl {
-      url = "${mirror}/stable/maui/pix/3.0.0/pix-3.0.0.tar.xz";
-      sha256 = "1h82c3xip1s3ii5f1maq5d9invgbxzarai8ba6c274lkv70yv1ni";
-      name = "pix-3.0.0.tar.xz";
+      url = "${mirror}/stable/maui/pix/3.0.1/pix-3.0.1.tar.xz";
+      sha256 = "1c1fz21x324r606ab7qsnbqpz3xvc4b6794xbf7vm6p7cfsgkdq7";
+      name = "pix-3.0.1.tar.xz";
     };
   };
   shelf = {
-    version = "3.0.0";
+    version = "3.0.1";
     src = fetchurl {
-      url = "${mirror}/stable/maui/shelf/3.0.0/shelf-3.0.0.tar.xz";
-      sha256 = "1944626qyxyybd8asfs00mkvljykz5ndxmnmi4jiz01j0xc70dyd";
-      name = "shelf-3.0.0.tar.xz";
+      url = "${mirror}/stable/maui/shelf/3.0.1/shelf-3.0.1.tar.xz";
+      sha256 = "02qg37qpfccan3n87pbq3i7zyl22g32ipr8smbdcpwdyhxz1v00q";
+      name = "shelf-3.0.1.tar.xz";
     };
   };
   station = {
-    version = "3.0.0";
+    version = "3.0.1";
     src = fetchurl {
-      url = "${mirror}/stable/maui/station/3.0.0/station-3.0.0.tar.xz";
-      sha256 = "04kidqm8hcxf8l1r6qi5bfxg6rkdy77i4inzgsgf3i7ky6gvah96";
-      name = "station-3.0.0.tar.xz";
+      url = "${mirror}/stable/maui/station/3.0.1/station-3.0.1.tar.xz";
+      sha256 = "11nbhax5xxrypy6ly5i609yvg7n754fhwjdpbf8c5c8j7285lnbz";
+      name = "station-3.0.1.tar.xz";
     };
   };
   strike = {
@@ -196,11 +196,11 @@
     };
   };
   vvave = {
-    version = "3.0.0";
+    version = "3.0.1";
     src = fetchurl {
-      url = "${mirror}/stable/maui/vvave/3.0.0/vvave-3.0.0.tar.xz";
-      sha256 = "1x2vbmc3qk2kgx64dm8k5xm16vlvnhfnhgzv5kx1qxpr7kr3vif8";
-      name = "vvave-3.0.0.tar.xz";
+      url = "${mirror}/stable/maui/vvave/3.0.1/vvave-3.0.1.tar.xz";
+      sha256 = "0z7y27sdwcpxh0jr8k0h17rk0smljvky28ck741ysxqdv992bbk9";
+      name = "vvave-3.0.1.tar.xz";
     };
   };
 }
diff --git a/pkgs/applications/misc/joplin-desktop/default.nix b/pkgs/applications/misc/joplin-desktop/default.nix
index 7f783eb371ec..a2262134f66c 100644
--- a/pkgs/applications/misc/joplin-desktop/default.nix
+++ b/pkgs/applications/misc/joplin-desktop/default.nix
@@ -2,7 +2,7 @@
 
 let
   pname = "joplin-desktop";
-  version = "2.12.16";
+  version = "2.12.18";
   name = "${pname}-${version}";
 
   inherit (stdenv.hostPlatform) system;
@@ -17,9 +17,9 @@ let
   src = fetchurl {
     url = "https://github.com/laurent22/joplin/releases/download/v${version}/Joplin-${version}${suffix}";
     sha256 = {
-      x86_64-linux = "sha256-9ib8lymmSINqC0oXUxkKcpKfPh7qmU3YytU1/4aKMLg=";
-      x86_64-darwin = "sha256-vWc5yx3i5Ru8vrQbrTQwr43ZMBzOAb9254cxTHg6A/Q=";
-      aarch64-darwin = "sha256-dhwPqT+zfBYOVUV5JprPfgrSJR2ZNsC3LJmRHGJVM4k=";
+      x86_64-linux = "1fwcqgqni7d9x0prdy3p8ccc5lzgn57rhph4498vs1q40kyq8823";
+      x86_64-darwin = "sha256-atd7nkefLvilTq39nTLbXQhm1zzBCHOLL7MRJwlTSMk=";
+      aarch64-darwin = "sha256-xiWXD+ULSVJ80uruYz0uRFkDRT1QOUd6FSWDKK9yLMc=";
     }.${system} or throwSystem;
   };
 
diff --git a/pkgs/applications/misc/phoc/0001-handle-outputs-that-arent-in-the-layout.patch b/pkgs/applications/misc/phoc/0001-handle-outputs-that-arent-in-the-layout.patch
deleted file mode 100644
index 4555f8a8704f..000000000000
--- a/pkgs/applications/misc/phoc/0001-handle-outputs-that-arent-in-the-layout.patch
+++ /dev/null
@@ -1,14 +0,0 @@
-diff --git a/types/wlr_output_layout.c b/types/wlr_output_layout.c
-index eb672f06..f0f546da 100644
---- a/types/wlr_output_layout.c
-+++ b/types/wlr_output_layout.c
-@@ -242,6 +242,9 @@ bool wlr_output_layout_contains_point(struct wlr_output_layout *layout,
- 	if (reference) {
- 		struct wlr_output_layout_output *l_output =
- 			wlr_output_layout_get(layout, reference);
-+		if (!l_output) {
-+			return false;
-+		}
- 		struct wlr_box *box = output_layout_output_get_box(l_output);
- 		return wlr_box_contains_point(box, lx, ly);
- 	} else {
\ No newline at end of file
diff --git a/pkgs/applications/misc/phoc/default.nix b/pkgs/applications/misc/phoc/default.nix
index babd3578d25b..10342269d6fe 100644
--- a/pkgs/applications/misc/phoc/default.nix
+++ b/pkgs/applications/misc/phoc/default.nix
@@ -1,6 +1,6 @@
 { lib
 , stdenv
-, fetchFromGitLab
+, fetchurl
 , fetchpatch
 , meson
 , ninja
@@ -16,6 +16,7 @@
 , libdrm
 , libxkbcommon
 , wlroots
+, xorg
 }:
 
 let
@@ -25,43 +26,19 @@ let
       # https://source.puri.sm/Librem5/phosh/-/issues/422
       (fetchpatch {
         name = "0001-Revert-layer-shell-error-on-0-dimension-without-anch.patch";
-        url = "https://source.puri.sm/Librem5/wlroots/-/commit/4f66b0931aaaee65367102e9c4ccb736097412c7.patch";
-        hash = "sha256-2Vy5a4lWh8FP2PN6xRIZv6IlUuLZibT0MYW+EyvVULs=";
+        url = "https://gitlab.gnome.org/World/Phosh/phoc/-/raw/acb17171267ae0934f122af294d628ad68b09f88/subprojects/packagefiles/wlroots/0001-Revert-layer-shell-error-on-0-dimension-without-anch.patch";
+        hash = "sha256-uNJaYwkZImkzNUEqyLCggbXAoIRX5h2eJaGbSHj1B+o=";
       })
-
-      # xdg-activation: Deduplicate token creation code
-      (fetchpatch {
-        name = "xdg-activation-deduplicate-token-creation-code.patch";
-        url = "https://gitlab.freedesktop.org/wlroots/wlroots/-/commit/dd03d839ab56c3e5d7c607a8d76e58e0b75edb85.patch";
-        sha256 = "sha256-mxt68MISC24xpaBtVSc1F2W4cyNs5wQowtbUQH9Eqr8=";
-      })
-
-      # seat: Allow to cancel touches
-      (fetchpatch {
-        name = "seat-Allow-to-cancel-touches.patch";
-        url = "https://gitlab.freedesktop.org/wlroots/wlroots/-/commit/17b2b06633729f1826715c1d0b84614aa3cedb3a.patch";
-        sha256 = "sha256-BAeXa3ZB5TXnlq0ZP2+rZlVXEPWpLP4Wi4TLwoXjkz4=";
-      })
-
-      # From
-      # https://gitlab.freedesktop.org/wlroots/wlroots/-/commit/13fcdba75cf5f21cfd49c1a05f4fa62f77619b40
-      # which has been merged upstream, but doesn't cleanly apply on to the
-      # latest released version.
-      ./0001-handle-outputs-that-arent-in-the-layout.patch
     ];
   });
 in stdenv.mkDerivation rec {
   pname = "phoc";
-  version = "0.27.0";
+  version = "0.31.0";
 
-  src = fetchFromGitLab {
-    domain = "gitlab.gnome.org";
-    group = "World";
-    owner = "Phosh";
-    repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-4/Fxo72KXLy3gxXMS+PrTUbZl0EFt2GPMXg8+/fE7MY=";
-    fetchSubmodules = true;
+  src = fetchurl {
+    # This tarball includes the meson wrapped subproject 'gmobile'.
+    url = "https://storage.puri.sm/releases/phoc/phoc-${version}.tar.xz";
+    hash = "sha256-P7Bs9JMv6KNKo4d2ID0/Ba4+Nel6DMn8o4I7EDvY4vY=";
   };
 
   nativeBuildInputs = [
@@ -83,6 +60,7 @@ in stdenv.mkDerivation rec {
     gnome.mutter
     wayland
     phocWlroots
+    xorg.xcbutilwm
   ];
 
   mesonFlags = ["-Dembed-wlroots=disabled"];
diff --git a/pkgs/applications/misc/usql/default.nix b/pkgs/applications/misc/usql/default.nix
index 173e50d17518..66a9eedeff64 100644
--- a/pkgs/applications/misc/usql/default.nix
+++ b/pkgs/applications/misc/usql/default.nix
@@ -10,18 +10,18 @@
 
 buildGoModule rec {
   pname = "usql";
-  version = "0.15.0";
+  version = "0.15.1";
 
   src = fetchFromGitHub {
     owner = "xo";
     repo = "usql";
     rev = "v${version}";
-    hash = "sha256-YjRbrhJSbX1OLEc7A72ubg1KtzJSWY0KphD4d8dAKQ8=";
+    hash = "sha256-thpVcJ1HRhoOAli7829zM4fermEcS9FwzKX7ZjHGhZg=";
   };
 
   buildInputs = [ unixODBC icu ];
 
-  vendorHash = "sha256-OZ/eui+LR+Gn1nmu9wryGmz3jiUMuDScmTZ5G8UKWP8=";
+  vendorHash = "sha256-S7fahA+ykviQoWc7p0CcTGfouswxQNBn4HH+tbl0fbI=";
   proxyVendor = true;
 
   # Exclude broken genji, hive & impala drivers (bad group)
@@ -73,6 +73,7 @@ buildGoModule rec {
     homepage = "https://github.com/xo/usql";
     changelog = "https://github.com/xo/usql/releases/tag/v${version}";
     license = licenses.mit;
+    mainProgram = "usql";
     maintainers = with maintainers; [ georgyo anthonyroussel ];
     platforms = with platforms; linux ++ darwin;
   };
diff --git a/pkgs/applications/networking/calls/default.nix b/pkgs/applications/networking/calls/default.nix
index 250355aa4284..e062a3d15151 100644
--- a/pkgs/applications/networking/calls/default.nix
+++ b/pkgs/applications/networking/calls/default.nix
@@ -33,7 +33,7 @@
 
 stdenv.mkDerivation rec {
   pname = "calls";
-  version = "43.3";
+  version = "44.2";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
     repo = pname;
     rev = "v${version}";
     fetchSubmodules = true;
-    hash = "sha256-GNICAk9SPrLc+zm3tHVwkQdiS20j4MVktGIbNWEEMHs=";
+    hash = "sha256-mdv/yDUi6tzYc3C7dtmkAWtk4IqzHvOZVO2CA3TP9TE=";
   };
 
   outputs = [ "out" "devdoc" ];
diff --git a/pkgs/applications/networking/cluster/octant/default.nix b/pkgs/applications/networking/cluster/octant/default.nix
deleted file mode 100644
index 733e4c04a9cc..000000000000
--- a/pkgs/applications/networking/cluster/octant/default.nix
+++ /dev/null
@@ -1,67 +0,0 @@
-{ lib, stdenv, fetchzip }:
-
-stdenv.mkDerivation rec {
-  pname = "octant";
-  version = "0.25.1";
-
-  src =
-    let
-      inherit (stdenv.hostPlatform) system;
-      suffix = {
-        x86_64-linux = "Linux-64bit";
-        aarch64-linux = "Linux-arm64";
-        x86_64-darwin = "macOS-64bit";
-        aarch64-darwin = "macOS-arm64";
-      }.${system} or (throw "Unsupported system: ${system}");
-      fetchsrc = version: sha256: fetchzip {
-        url = "https://github.com/vmware-tanzu/octant/releases/download/v${version}/octant_${version}_${suffix}.tar.gz";
-        sha256 = sha256.${system};
-      };
-    in
-    fetchsrc version {
-      x86_64-linux = "sha256-bYqycTB036J8trojySPNkC+jrw76F7+N4I4puGCyalU=";
-      aarch64-linux = "sha256-DlzSIZCAASPnflXQ8ndPU7/0jXA18U4bGGOfmgLXPr0=";
-      x86_64-darwin = "sha256-FaPyrPzO7AzC6LHQP5c58NjLTqU+ei8vFffT8x6mUhQ=";
-      aarch64-darwin = "sha256-31CYhAsHYIVAenp8hFHYj8LhFf3lSiOTw7gULBu3gio=";
-    };
-
-  dontConfigure = true;
-  dontBuild = true;
-
-  installPhase = ''
-    runHook preInstall
-    install -D octant $out/bin/octant
-    runHook postInstall
-  '';
-
-  doInstallCheck = true;
-  installCheckPhase = ''
-    runHook preInstallCheck
-    $out/bin/octant --help
-    $out/bin/octant version | grep "${version}"
-    runHook postInstallCheck
-  '';
-
-  dontPatchELF = true;
-  dontPatchShebangs = true;
-
-  passthru.updateScript = ./update.sh;
-
-  meta = with lib; {
-    homepage = "https://octant.dev/";
-    changelog = "https://github.com/vmware-tanzu/octant/blob/v${version}/CHANGELOG.md";
-    description = "Highly extensible platform for developers to better understand the complexity of Kubernetes clusters";
-    longDescription = ''
-      Octant is a tool for developers to understand how applications run on a
-      Kubernetes cluster.
-      It aims to be part of the developer's toolkit for gaining insight and
-      approaching complexity found in Kubernetes. Octant offers a combination of
-      introspective tooling, cluster navigation, and object management along
-      with a plugin system to further extend its capabilities.
-    '';
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    license = licenses.asl20;
-    maintainers = with maintainers; [ jk ];
-    platforms = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" "aarch64-darwin" ];
-  };
-}
diff --git a/pkgs/applications/networking/cluster/octant/desktop.nix b/pkgs/applications/networking/cluster/octant/desktop.nix
deleted file mode 100644
index fc48ce1e9ef4..000000000000
--- a/pkgs/applications/networking/cluster/octant/desktop.nix
+++ /dev/null
@@ -1,77 +0,0 @@
-{ lib, stdenv, appimageTools, fetchurl, undmg }:
-
-let
-  pname = "octant-desktop";
-  version = "0.23.0";
-  name = "${pname}-${version}";
-
-  inherit (stdenv.hostPlatform) system;
-
-  suffix = {
-    x86_64-linux = "AppImage";
-    x86_64-darwin = "dmg";
-  }.${system} or (throw "Unsupported system: ${system}");
-
-  src = fetchurl {
-    url = "https://github.com/vmware-tanzu/octant/releases/download/v${version}/Octant-${version}.${suffix}";
-    sha256 = {
-      x86_64-linux = "sha256-K4z6SVCiuqy3xkWMWpm8KM7iYVXyKcnERljMG3NEFMw=";
-      x86_64-darwin = "sha256-WYra0yw/aPW/wUGrlIn5ud3kjFTkekYEi2LWZcYO5Nw=";
-    }.${system};
-  };
-
-  linux = appimageTools.wrapType2 {
-    inherit name src passthru meta;
-
-    profile = ''
-      export LC_ALL=C.UTF-8
-    '';
-
-    multiArch = false; # no 32bit needed
-    extraPkgs = appimageTools.defaultFhsEnvArgs.multiPkgs;
-    extraInstallCommands =
-      let appimageContents = appimageTools.extractType2 { inherit name src; }; in
-      ''
-        mv $out/bin/{${name},${pname}}
-        install -Dm444 ${appimageContents}/octant.desktop -t $out/share/applications
-        substituteInPlace $out/share/applications/octant.desktop \
-          --replace 'Exec=AppRun --no-sandbox' 'Exec=${pname}'
-        install -m 444 -D ${appimageContents}/octant.png \
-          $out/share/icons/hicolor/512x512/apps/octant.png
-      '';
-  };
-
-  darwin = stdenv.mkDerivation {
-    inherit name src passthru meta;
-
-    nativeBuildInputs = [ undmg ];
-    sourceRoot = "Octant.app";
-    installPhase = ''
-      mkdir -p $out/Applications/Octant.app
-      cp -R . $out/Applications/Octant.app
-    '';
-  };
-
-  passthru = { updateScript = ./update-desktop.sh; };
-
-  meta = with lib; {
-    homepage = "https://octant.dev/";
-    changelog = "https://github.com/vmware-tanzu/octant/blob/v${version}/CHANGELOG.md";
-    description = "Highly extensible platform for developers to better understand the complexity of Kubernetes clusters";
-    longDescription = ''
-      Octant is a tool for developers to understand how applications run on a
-      Kubernetes cluster.
-      It aims to be part of the developer's toolkit for gaining insight and
-      approaching complexity found in Kubernetes. Octant offers a combination of
-      introspective tooling, cluster navigation, and object management along
-      with a plugin system to further extend its capabilities.
-    '';
-    license = licenses.asl20;
-    maintainers = with maintainers; [ jk ];
-    platforms = [ "x86_64-linux" "x86_64-darwin" ];
-  };
-
-in
-if stdenv.isDarwin
-then darwin
-else linux
diff --git a/pkgs/applications/networking/cluster/octant/plugins/starboard-octant-plugin.nix b/pkgs/applications/networking/cluster/octant/plugins/starboard-octant-plugin.nix
deleted file mode 100644
index f59b8d26de08..000000000000
--- a/pkgs/applications/networking/cluster/octant/plugins/starboard-octant-plugin.nix
+++ /dev/null
@@ -1,31 +0,0 @@
-{ lib, buildGoModule, fetchFromGitHub }:
-
-buildGoModule rec {
-  pname = "starboard-octant-plugin";
-  version = "0.12.0";
-
-  src = fetchFromGitHub {
-    owner = "aquasecurity";
-    repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-JTSZtIRVFdUjhQsp2EMukeoVIo6nNx4xofq+3iOZUIk=";
-  };
-
-  vendorHash = "sha256-1zrB+CobUBgdpBHRJPpfDYCD6oVWY4j4Met9EqNQQbE=";
-
-  ldflags = [
-    "-s" "-w"
-  ];
-
-  meta = with lib; {
-    homepage = "https://github.com/aquasecurity/starboard-octant-plugin";
-    changelog = "https://github.com/aquasecurity/starboard-octant-plugin/releases/tag/v${version}";
-    description = "Octant plugin for viewing Starboard security information";
-    longDescription = ''
-      This is an Octant plugin for Starboard which provides visibility into vulnerability assessment reports for
-      Kubernetes workloads stored as custom security resources.
-    '';
-    license = licenses.asl20;
-    maintainers = with maintainers; [ jk ];
-  };
-}
diff --git a/pkgs/applications/networking/cluster/octant/update-desktop.sh b/pkgs/applications/networking/cluster/octant/update-desktop.sh
deleted file mode 100755
index 4450834b4b70..000000000000
--- a/pkgs/applications/networking/cluster/octant/update-desktop.sh
+++ /dev/null
@@ -1,36 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p curl gnused gawk nix-prefetch
-
-set -euo pipefail
-
-ROOT="$(dirname "$(readlink -f "$0")")"
-NIX_DRV="$ROOT/desktop.nix"
-if [ ! -f "$NIX_DRV" ]; then
-  echo "ERROR: cannot find desktop.nix in $ROOT"
-  exit 1
-fi
-
-fetch_arch() {
-  VER="$1"; SUFFIX="$2"
-  URL="https://github.com/vmware-tanzu/octant/releases/download/v${VER}/Octant-${VER}.${SUFFIX}"
-  nix-prefetch "{ stdenv, fetchurl }:
-stdenv.mkDerivation rec {
-  pname = \"octant-desktop\"; version = \"${VER}\";
-  src = fetchurl { url = \"$URL\"; };
-}
-"
-}
-
-replace_sha() {
-  sed -i "s#$1 = \"sha256-.\{44\}\"#$1 = \"$2\"#" "$NIX_DRV"
-}
-
-OCTANT_VER=$(curl -Ls -w "%{url_effective}" -o /dev/null https://github.com/vmware-tanzu/octant/releases/latest | awk -F'/' '{print $NF}' | sed 's/v//')
-
-OCTANT_DESKTOP_LINUX_X64_SHA256=$(fetch_arch "$OCTANT_VER" "AppImage")
-OCTANT_DESKTOP_DARWIN_X64_SHA256=$(fetch_arch "$OCTANT_VER" "dmg")
-
-sed -i "s/version = \".*\"/version = \"$OCTANT_VER\"/" "$NIX_DRV"
-
-replace_sha "x86_64-linux" "$OCTANT_DESKTOP_LINUX_X64_SHA256"
-replace_sha "x86_64-darwin" "$OCTANT_DESKTOP_DARWIN_X64_SHA256"
diff --git a/pkgs/applications/networking/cluster/octant/update.sh b/pkgs/applications/networking/cluster/octant/update.sh
deleted file mode 100755
index 3e2b56b7a619..000000000000
--- a/pkgs/applications/networking/cluster/octant/update.sh
+++ /dev/null
@@ -1,40 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p curl gnused gawk nix-prefetch
-
-set -euo pipefail
-
-ROOT="$(dirname "$(readlink -f "$0")")"
-NIX_DRV="$ROOT/default.nix"
-if [ ! -f "$NIX_DRV" ]; then
-  echo "ERROR: cannot find default.nix in $ROOT"
-  exit 1
-fi
-
-fetch_arch() {
-  VER="$1"; ARCH="$2"
-  URL="https://github.com/vmware-tanzu/octant/releases/download/v${VER}/octant_${VER}_${ARCH}.tar.gz"
-  nix-prefetch "{ stdenv, fetchzip }:
-stdenv.mkDerivation rec {
-  pname = \"octant\"; version = \"${VER}\";
-  src = fetchzip { url = \"$URL\"; };
-}
-"
-}
-
-replace_sha() {
-  sed -i "s#$1 = \"sha256-.\{44\}\"#$1 = \"$2\"#" "$NIX_DRV"
-}
-
-OCTANT_VER=$(curl -Ls -w "%{url_effective}" -o /dev/null https://github.com/vmware-tanzu/octant/releases/latest | awk -F'/' '{print $NF}' | sed 's/v//')
-
-OCTANT_LINUX_X64_SHA256=$(fetch_arch "$OCTANT_VER" "Linux-64bit")
-OCTANT_LINUX_AARCH64_SHA256=$(fetch_arch "$OCTANT_VER" "Linux-arm64")
-OCTANT_DARWIN_X64_SHA256=$(fetch_arch "$OCTANT_VER" "macOS-64bit")
-OCTANT_DARWIN_AARCH64_SHA256=$(fetch_arch "$OCTANT_VER" "macOS-arm64")
-
-sed -i "s/version = \".*\"/version = \"$OCTANT_VER\"/" "$NIX_DRV"
-
-replace_sha "x86_64-linux" "$OCTANT_LINUX_X64_SHA256"
-replace_sha "aarch64-linux" "$OCTANT_LINUX_AARCH64_SHA256"
-replace_sha "x86_64-darwin" "$OCTANT_DARWIN_X64_SHA256"
-replace_sha "aarch64-darwin" "$OCTANT_DARWIN_AARCH64_SHA256"
diff --git a/pkgs/applications/networking/instant-messengers/abaddon/default.nix b/pkgs/applications/networking/instant-messengers/abaddon/default.nix
index d749e3509622..4fd9a36b0f51 100644
--- a/pkgs/applications/networking/instant-messengers/abaddon/default.nix
+++ b/pkgs/applications/networking/instant-messengers/abaddon/default.nix
@@ -20,13 +20,13 @@
 
 stdenv.mkDerivation rec {
   pname = "abaddon";
-  version = "0.1.11";
+  version = "0.1.12";
 
   src = fetchFromGitHub {
     owner = "uowuo";
     repo = "abaddon";
     rev = "v${version}";
-    hash = "sha256-KrBZESYab7QFwUfpTl40cgKn/if31oqA9oCe0PwoYbs=";
+    hash = "sha256-Rz3c6RMZUiKQ0YKKQkCEkelfIGUq+xVmgNskj7uEjGI=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/networking/instant-messengers/twitch-tui/default.nix b/pkgs/applications/networking/instant-messengers/twitch-tui/default.nix
index 8d15b8e466b8..d4877da69420 100644
--- a/pkgs/applications/networking/instant-messengers/twitch-tui/default.nix
+++ b/pkgs/applications/networking/instant-messengers/twitch-tui/default.nix
@@ -36,5 +36,6 @@ rustPlatform.buildRustPackage rec {
     changelog = "https://github.com/Xithrius/twitch-tui/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = [ maintainers.taha ];
+    mainProgram = "twt";
   };
 }
diff --git a/pkgs/applications/networking/instant-messengers/zoom-us/default.nix b/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
index 089521233b77..4ed7a286c464 100644
--- a/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
+++ b/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
@@ -48,23 +48,23 @@ let
   # and often with different versions.  We write them on three lines
   # like this (rather than using {}) so that the updater script can
   # find where to edit them.
-  versions.aarch64-darwin = "5.15.12.22445";
-  versions.x86_64-darwin = "5.15.12.22445";
-  versions.x86_64-linux = "5.15.12.7665";
+  versions.aarch64-darwin = "5.16.1.23158";
+  versions.x86_64-darwin = "5.16.1.23158";
+  versions.x86_64-linux = "5.16.1.8561";
 
   srcs = {
     aarch64-darwin = fetchurl {
       url = "https://zoom.us/client/${versions.aarch64-darwin}/zoomusInstallerFull.pkg?archType=arm64";
       name = "zoomusInstallerFull.pkg";
-      hash = "sha256-pTpNbKmJGTxRIrfD/zWIrkouhCbErxu9Gjy9mDdTtHc=";
+      hash = "sha256-D3eYHbnNSLLmOh7eIT2+J7PubhBZONqHThB6ibJLqGY=";
     };
     x86_64-darwin = fetchurl {
       url = "https://zoom.us/client/${versions.x86_64-darwin}/zoomusInstallerFull.pkg";
-      hash = "sha256-EItKg22id/e7OfJaWxxJdl9B+3nDHNl6ENvfGR4QJ6Y=";
+      hash = "sha256-kvnaHwwWUiJmNsef6H5S/JHHtQgfFJd9rWwzTvi05g0=";
     };
     x86_64-linux = fetchurl {
       url = "https://zoom.us/client/${versions.x86_64-linux}/zoom_x86_64.pkg.tar.xz";
-      hash = "sha256-DMFMLwxPt1LV4Qhhrw6gdToe0z9743hGcxVWeR4O1YU=";
+      hash = "sha256-zT0qGl8ODIcBISiRQ184aVr9hE8ZHnYatolqcsS6dpo=";
     };
   };
 
diff --git a/pkgs/applications/networking/localproxy/default.nix b/pkgs/applications/networking/localproxy/default.nix
index ed2817ed10a4..019da4695124 100644
--- a/pkgs/applications/networking/localproxy/default.nix
+++ b/pkgs/applications/networking/localproxy/default.nix
@@ -3,37 +3,38 @@
 , fetchFromGitHub
 , cmake
 , openssl
-, protobuf3_19
+, protobuf3_21
 , catch2
 , boost181
 , icu
 }:
 let
   boost = boost181.override { enableStatic = true; };
+  protobuf = protobuf3_21.override { enableShared = false; };
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "localproxy";
   version = "3.1.0";
 
-    src = fetchFromGitHub {
-      owner = "aws-samples";
-      repo = "aws-iot-securetunneling-localproxy";
-      rev = "v${finalAttrs.version}";
-      hash = "sha256-ec72bvBkRBj4qlTNfzNPeQt02OfOPA8y2PoejHpP9cY=";
-    };
+  src = fetchFromGitHub {
+    owner = "aws-samples";
+    repo = "aws-iot-securetunneling-localproxy";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-ec72bvBkRBj4qlTNfzNPeQt02OfOPA8y2PoejHpP9cY=";
+  };
 
   nativeBuildInputs = [ cmake ];
 
-  buildInputs = [ openssl protobuf3_19 catch2 boost icu ];
+  buildInputs = [ openssl protobuf catch2 boost icu ];
 
   # causes redefinition of _FORTIFY_SOURCE
   hardeningDisable = [ "fortify3" ];
 
-    meta = with lib; {
-      description = "AWS IoT Secure Tunneling Local Proxy Reference Implementation C++";
-      homepage = "https://github.com/aws-samples/aws-iot-securetunneling-localproxy";
-      license = licenses.asl20;
-      maintainers = with maintainers; [spalf];
-      platforms = platforms.unix;
-    };
-  })
+  meta = with lib; {
+    description = "AWS IoT Secure Tunneling Local Proxy Reference Implementation C++";
+    homepage = "https://github.com/aws-samples/aws-iot-securetunneling-localproxy";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ spalf ];
+    platforms = platforms.unix;
+  };
+})
diff --git a/pkgs/applications/office/timeular/default.nix b/pkgs/applications/office/timeular/default.nix
index 6629c7f0ae3e..2d9148b48213 100644
--- a/pkgs/applications/office/timeular/default.nix
+++ b/pkgs/applications/office/timeular/default.nix
@@ -5,12 +5,12 @@
 }:
 
 let
-  version = "6.2.2";
+  version = "6.3.0";
   pname = "timeular";
 
   src = fetchurl {
     url = "https://s3.amazonaws.com/timeular-desktop-packages/linux/production/Timeular-${version}.AppImage";
-    sha256 = "sha256-i6VLKGHst6gykXOpkt+VFMkdm9RLAWVgAhQ2UZ7Lt5Y=";
+    sha256 = "sha256-axdkoqCLg0z1kLa/S0kS4d8yGFuKJRDPRte9c8PYniU=";
   };
 
   appimageContents = appimageTools.extractType2 {
diff --git a/pkgs/applications/science/astronomy/siril/default.nix b/pkgs/applications/science/astronomy/siril/default.nix
index db0411f1337a..255927d893d2 100644
--- a/pkgs/applications/science/astronomy/siril/default.nix
+++ b/pkgs/applications/science/astronomy/siril/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitLab, pkg-config, meson, ninja
+{ lib, stdenv, fetchFromGitLab, fetchpatch, pkg-config, meson, ninja, cmake
 , git, criterion, gtk3, libconfig, gnuplot, opencv, json-glib
 , fftwFloat, cfitsio, gsl, exiv2, librtprocess, wcslib, ffmpeg
 , libraw, libtiff, libpng, libjpeg, libheif, ffms, wrapGAppsHook
@@ -6,17 +6,25 @@
 
 stdenv.mkDerivation rec {
   pname = "siril";
-  version = "1.0.6";
+  version = "1.2.0";
 
   src = fetchFromGitLab {
     owner = "free-astro";
-    repo = pname;
+    repo = "siril";
     rev = version;
-    sha256 = "sha256-KFCA3fUMVFHmh1BdKed5/dkq0EeYcmoWec97WX9ZHUc=";
+    hash = "sha256-lCoFQ7z6cZbyNPEm5s40DNdvTwFonHK3KCd8RniqQWs=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "siril-1.2-exiv2-0.28.patch";
+      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/sci-astronomy/siril/files/siril-1.2-exiv2-0.28.patch?id=002882203ad6a2b08ce035a18b95844a9f4b85d0";
+      hash = "sha256-R1yslW6hzvJHKo0/IqBxkCuqcX6VrdRSz68gpAExxVE=";
+    })
+  ];
+
   nativeBuildInputs = [
-    meson ninja pkg-config git criterion wrapGAppsHook
+    meson ninja cmake pkg-config git criterion wrapGAppsHook
   ];
 
   buildInputs = [
@@ -26,6 +34,7 @@ stdenv.mkDerivation rec {
 
   # Necessary because project uses default build dir for flatpaks/snaps
   dontUseMesonConfigure = true;
+  dontUseCmakeConfigure = true;
 
   configureScript = ''
     ${meson}/bin/meson --buildtype release nixbld .
diff --git a/pkgs/applications/science/biology/neuron/default.nix b/pkgs/applications/science/biology/neuron/default.nix
index 5b08fbfd6704..6e5e4feb16fc 100644
--- a/pkgs/applications/science/biology/neuron/default.nix
+++ b/pkgs/applications/science/biology/neuron/default.nix
@@ -21,7 +21,7 @@
 
 stdenv.mkDerivation rec {
   pname = "neuron";
-  version = "8.2.2";
+  version = "8.2.3";
 
   # format is for pythonModule conversion
   format = "other";
@@ -83,7 +83,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://github.com/neuronsimulator/nrn/releases/download/${version}/full-src-package-${version}.tar.gz";
-    sha256 = "sha256-orGeBxu3pu4AyAW5P1EGJv8G0dOUZcSOjpUaloqicZU=";
+    sha256 = "sha256-k8+71BRfh+a73sZho6v0QFRxVmrfx6jqrgaqammdtDI=";
   };
 
   meta = with lib; {
diff --git a/pkgs/applications/science/math/ginac/default.nix b/pkgs/applications/science/math/ginac/default.nix
index 057b242e609b..d9d12cbf388d 100644
--- a/pkgs/applications/science/math/ginac/default.nix
+++ b/pkgs/applications/science/math/ginac/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ginac";
-  version = "1.8.6";
+  version = "1.8.7";
 
   src = fetchurl {
     url = "https://www.ginac.de/ginac-${version}.tar.bz2";
-    sha256 = "sha256-ALMgsRFsrlt7QzZNv/t5EkcdFx9ITYJ2RgXXFYWNl1s=";
+    sha256 = "sha256-cf9PLYoA5vB86P7mm3bcweu7cnvmdgtYfB+7XM97Yeo=";
   };
 
   propagatedBuildInputs = [ cln ];
diff --git a/pkgs/applications/version-management/git-repo/default.nix b/pkgs/applications/version-management/git-repo/default.nix
index 62be45cba27e..a5f6820342d3 100644
--- a/pkgs/applications/version-management/git-repo/default.nix
+++ b/pkgs/applications/version-management/git-repo/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "git-repo";
-  version = "2.36.1";
+  version = "2.37";
 
   src = fetchFromGitHub {
     owner = "android";
     repo = "tools_repo";
     rev = "v${version}";
-    hash = "sha256-jq9Frh3rufI9Q3auh2Qfoo89x+jKsbxBB8ojreVgmjc=";
+    hash = "sha256-6OAubRkNXIm1HaiDq4jzBPUhgbwQowSZXSqAzAe7Rv0=";
   };
 
   # Fix 'NameError: name 'ssl' is not defined'
diff --git a/pkgs/applications/window-managers/maui-shell/default.nix b/pkgs/applications/window-managers/maui-shell/default.nix
index c4060a1e6f40..215b871312a4 100644
--- a/pkgs/applications/window-managers/maui-shell/default.nix
+++ b/pkgs/applications/window-managers/maui-shell/default.nix
@@ -84,5 +84,7 @@ mkDerivation rec {
     license = licenses.lgpl3;
     maintainers = with maintainers; [ onny ];
     platforms = platforms.linux;
+    # https://github.com/Nitrux/maui-shell/issues/56
+    broken = true;
   };
 }
diff --git a/pkgs/by-name/dy/dyalog/dyalogscript.patch b/pkgs/by-name/dy/dyalog/dyalogscript.patch
new file mode 100644
index 000000000000..a65878b7adec
--- /dev/null
+++ b/pkgs/by-name/dy/dyalog/dyalogscript.patch
@@ -0,0 +1,8 @@
+--- a/scriptbin/dyalogscript
++++ b/scriptbin/dyalogscript
+@@ -5,1 +5,1 @@
+-INSTALLDIR="/opt/mdyalog/18.2/64/unicode"
++INSTALLDIR="@installdir@"
+@@ -40,1 +40,1 @@
+-: ${SCRIPTDIR:=$INSTALLDIR}
++SCRIPTDIR="@scriptdir@"
diff --git a/pkgs/by-name/dy/dyalog/mapl.patch b/pkgs/by-name/dy/dyalog/mapl.patch
new file mode 100644
index 000000000000..32424bea124e
--- /dev/null
+++ b/pkgs/by-name/dy/dyalog/mapl.patch
@@ -0,0 +1,31 @@
+diff --git a/mapl b/mapl
+index c9d3727..de24c77 100755
+--- a/mapl
++++ b/mapl
+@@ -20,26 +20,8 @@ SHORTVERSION=182U64
+ LONGVERSION="18.2 64-bit Unicode"
+ REL="`echo "${LONGVERSION}" | sed 's/ .*$//'`"
+ 
+-# Find the Dyalog installation directory
+-if [ "$(uname)" = Linux ]; then
+-	# this script location, canonical.
+-	THIS="$(readlink -f $0)"
+-else
+-	# this script location.
+-	THIS="$0"
+-fi
+-export DYALOG=$(cd $(dirname $THIS) && pwd)
+-
+ export APL_LANGUAGE_BAR_FILE=${DYALOG}/languagebar.json
+ 
+-if [ "$(uname)" = Linux ]; then
+-	if [ "x" = "x${LD_LIBRARY_PATH}" ]; then
+-		export LD_LIBRARY_PATH="${DYALOG}"
+-	else
+-		export LD_LIBRARY_PATH="${DYALOG}:${LD_LIBRARY_PATH}"
+-	fi
+-fi
+-
+ # Setup the configuration directory
+ MYCONFIGDIR=${HOME}/.dyalog
+ if [ ! -d "${MYCONFIGDIR}" ] ; then
diff --git a/pkgs/by-name/dy/dyalog/package.nix b/pkgs/by-name/dy/dyalog/package.nix
new file mode 100644
index 000000000000..c8786d5d6baa
--- /dev/null
+++ b/pkgs/by-name/dy/dyalog/package.nix
@@ -0,0 +1,225 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, fetchurl
+
+, config
+, acceptLicense ? config.dyalog.acceptLicense or false
+
+, autoPatchelfHook
+, dpkg
+, makeWrapper
+
+, copyDesktopItems
+, makeDesktopItem
+
+, glib
+, ncurses5
+
+, dotnet-sdk_6
+, dotnetSupport ? false
+
+, alsa-lib
+, gtk2
+, libXdamage
+, libXtst
+, libXScrnSaver
+, nss
+, htmlRendererSupport ? false
+
+, R
+, rPackages
+, rSupport ? false
+
+, unixODBC
+, sqaplSupport ? false
+
+, zeroFootprintRideSupport ? false
+
+, enableDocs ? false
+}:
+
+let
+  dyalogHome = "$out/lib/dyalog";
+
+  rscproxy = rPackages.buildRPackage {
+    name = "rscproxy";
+    src = fetchFromGitHub {
+      owner = "Dyalog";
+      repo = "rscproxy";
+      rev = "31de3323fb8596ff5ecbf4bacd030e542cfd8133";
+      hash = "sha256-SVoBoAWUmQ+jWaTG7hdmyRq6By4RnmmgWZXoua19/Kg=";
+    };
+  };
+
+  makeWrapperArgs = [
+    "--set DYALOG ${dyalogHome}"
+    # also needs to be set when the `-script` flag is used
+    "--add-flags DYALOG=${dyalogHome}"
+    # needed for default user commands to work
+    "--add-flags SESSION_FILE=${dyalogHome}/default.dse"
+  ]
+  ++ lib.optionals dotnetSupport [
+    # needs to be set to run .NET Bridge
+    "--set DOTNET_ROOT ${dotnet-sdk_6}"
+    # .NET Bridge files are runtime dependencies, but cannot be patchelf'd
+    "--prefix LD_LIBRARY_PATH : ${dyalogHome}"
+  ]
+  ++ lib.optionals rSupport [
+    # RConnect resolves R from PATH
+    "--prefix PATH : ${R}/bin"
+    # RConnect uses `ldd` to find `libR.so`
+    "--prefix LD_LIBRARY_PATH : ${R}/lib/R/lib"
+    # RConnect uses `rscproxy` to communicate with R
+    "--prefix R_LIBS_SITE : ${rscproxy}/library"
+  ];
+
+  licenseUrl = "https://www.dyalog.com/uploads/documents/Developer_Software_Licence.pdf";
+
+  licenseDisclaimer = ''
+    Dyalog is a licenced software. Dyalog licences do not include a licence to distribute Dyalog with your work.
+    For non-commercial purposes, a Basic Licence is granted when you accept the conditions and download a free copy of Dyalog.
+
+    More details about the license can be found here: ${licenseUrl}
+
+    If you agree to these terms, you can either override this package:
+    `dyalog.override { acceptLicense = true; }`
+
+    or you can set the following nixpkgs config option:
+    `config.dyalog.acceptLicense = true;`
+  '';
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "dyalog";
+  version = "18.2.45405";
+  shortVersion = lib.versions.majorMinor finalAttrs.version;
+
+  src =
+    assert !acceptLicense -> throw licenseDisclaimer;
+    fetchurl {
+      url = "https://download.dyalog.com/download.php?file=${finalAttrs.shortVersion}/linux_64_${finalAttrs.version}_unicode.x86_64.deb";
+      sha256 = "sha256-pA/WGTA6YvwG4MgqbiPBLKSKPtLGQM7BzK6Bmyz5pmM=";
+    };
+
+  outputs = [ "out" ] ++ lib.optional enableDocs "doc";
+
+  postUnpack = ''
+    sourceRoot=$sourceRoot/opt/mdyalog/${finalAttrs.shortVersion}/64/unicode
+  '';
+
+  patches = [ ./dyalogscript.patch ./mapl.patch ];
+
+  postPatch = lib.optionalString dotnetSupport ''
+    # Patch to use .NET 6.0 instead of .NET Core 3.1 (can be removed when Dyalog 19.0 releases)
+    substituteInPlace Dyalog.Net.Bridge.*.json --replace "3.1" "6.0"
+  '';
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+    copyDesktopItems
+    dpkg
+    makeWrapper
+  ];
+
+  buildInputs = [
+    glib # Used by Conga and .NET Bridge
+    ncurses5 # Used by the dyalog binary
+  ]
+  ++ lib.optionals htmlRendererSupport [
+    alsa-lib
+    gtk2
+    libXdamage
+    libXtst
+    libXScrnSaver
+    nss
+  ]
+  ++ lib.optionals sqaplSupport [
+    unixODBC
+  ];
+
+  # See which files are not really important: `https://github.com/Dyalog/DyalogDocker/blob/master/rmfiles.sh`
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p ${dyalogHome}
+    cp -r aplfmt aplkeys apltrans fonts Library PublicCACerts SALT StartupSession ${dyalogHome}
+    cp aplkeys.sh default.dse dyalog dyalog.rt dyalog.dcfg.template dyalog.ver.dcfg.template languagebar.json mapl startup.dyalog ${dyalogHome}
+
+    mkdir ${dyalogHome}/lib
+    cp lib/{conga34_64.so,dyalog64.so,libconga34ssl64.so} ${dyalogHome}/lib
+
+    # Only keep the most useful workspaces
+    mkdir ${dyalogHome}/ws
+    cp ws/{conga,dfns,isolate,loaddata,salt,sharpplot,util}.dws ${dyalogHome}/ws
+  ''
+  + lib.optionalString dotnetSupport ''
+    cp libnethost.so Dyalog.Net.Bridge.* ${dyalogHome}
+  ''
+  + lib.optionalString htmlRendererSupport ''
+    cp -r locales swiftshader ${dyalogHome}
+    cp libcef.so libEGL.so libGLESv2.so chrome-sandbox natives_blob.bin snapshot_blob.bin icudtl.dat v8_context_snapshot.bin *.pak ${dyalogHome}
+    cp lib/htmlrenderer.so ${dyalogHome}/lib
+  ''
+  + lib.optionalString rSupport ''
+    cp ws/rconnect.dws ${dyalogHome}/ws
+  ''
+  + lib.optionalString sqaplSupport ''
+    cp lib/cxdya64u64u.so ${dyalogHome}/lib
+    cp ws/sqapl.dws ${dyalogHome}/ws
+    cp odbc.ini.sample sqapl.err sqapl.ini ${dyalogHome}
+  ''
+  + lib.optionalString zeroFootprintRideSupport ''
+    cp -r RIDEapp ${dyalogHome}
+  ''
+  + lib.optionalString enableDocs ''
+    mkdir -p $doc/share/doc/dyalog
+    cp -r help/* $doc/share/doc/dyalog
+    ln -s $doc/share/doc/dyalog ${dyalogHome}/help
+  ''
+  + ''
+    install -Dm644 dyalog.svg $out/share/icons/hicolor/scalable/apps/dyalog.svg
+
+    makeWrapper ${dyalogHome}/dyalog $out/bin/dyalog ${lib.concatStringsSep " " makeWrapperArgs}
+    makeWrapper ${dyalogHome}/mapl $out/bin/mapl ${lib.concatStringsSep " " makeWrapperArgs}
+
+    install -Dm755 scriptbin/dyalogscript $out/bin/dyalogscript
+    substituteInPlace $out/bin/dyalogscript \
+        --subst-var-by installdir ${dyalogHome} \
+        --subst-var-by scriptdir $out/bin
+
+    runHook postInstall
+  '';
+
+  preFixup = lib.optionalString htmlRendererSupport ''
+    # `libudev.so` is a runtime dependency of CEF
+    patchelf ${dyalogHome}/libcef.so --add-needed libudev.so
+  '';
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "dyalog";
+      desktopName = "Dyalog";
+      exec = finalAttrs.meta.mainProgram;
+      comment = finalAttrs.meta.description;
+      icon = "dyalog";
+      categories = [ "Development" ];
+      genericName = "APL interpreter";
+      terminal = true;
+    })
+  ];
+
+  meta = {
+    changelog = "https://dyalog.com/dyalog/dyalog-versions/${lib.replaceStrings [ "." ] [ "" ] finalAttrs.shortVersion}.htm";
+    description = "The Dyalog APL interpreter";
+    homepage = "https://www.dyalog.com";
+    license = {
+      fullName = "Dyalog License";
+      url = licenseUrl;
+      free = false;
+    };
+    mainProgram = "dyalog";
+    maintainers = with lib.maintainers; [ tomasajt markus1189 ];
+    platforms = [ "x86_64-linux" ];
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+  };
+})
diff --git a/pkgs/by-name/gu/guile-goblins/package.nix b/pkgs/by-name/gu/guile-goblins/package.nix
index 6f05dfa5c1ad..5b1b5a797927 100644
--- a/pkgs/by-name/gu/guile-goblins/package.nix
+++ b/pkgs/by-name/gu/guile-goblins/package.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
     description = "Spritely Goblins for Guile";
     homepage = "https://spritely.institute/goblins/";
     license = licenses.asl20;
-    maintainers = with maintainers; [ grxnola ];
+    maintainers = with maintainers; [ offsetcyan ];
     platforms = guile.meta.platforms;
   };
 }
diff --git a/pkgs/by-name/ju/justbuild/package.nix b/pkgs/by-name/ju/justbuild/package.nix
index fd9acbc6dc46..3403edcaaccf 100644
--- a/pkgs/by-name/ju/justbuild/package.nix
+++ b/pkgs/by-name/ju/justbuild/package.nix
@@ -1,5 +1,5 @@
 {
-  stdenv,
+  gccStdenv,
   fetchFromGitHub,
   fetchurl,
 
@@ -23,6 +23,8 @@
   curl,
   libarchive,
 }:
+let stdenv = gccStdenv;
+in
 stdenv.mkDerivation rec {
   pname = "justbuild";
   version = "1.2.1";
@@ -31,7 +33,14 @@ stdenv.mkDerivation rec {
     owner = "just-buildsystem";
     repo = "justbuild";
     rev = "v${version}";
-    sha256 = "sha256-5Fz/ID7xKbt6pq2B5/MOS6f2xUnKGvmNAYuPboPwKJY=";
+    sha256 = "sha256-36njngcGmRtYh/U3wkZUAU6ivPQ8qP8zVj1JzI9TuDY=";
+
+    # The source contains both test/end-to-end/targets and
+    # test/end-to-end/TARGETS, causing issues on case-insensitive filesystems.
+    # Remove them, since we're not running end-to-end tests.
+    postFetch = ''
+      rm -rf $out/test/end-to-end/targets $out/test/end-to-end/TARGETS
+    '';
   };
 
   bazelapi = fetchurl {
@@ -91,6 +100,8 @@ stdenv.mkDerivation rec {
     mv etc/repos.json.patched etc/repos.json
     jq '.unknown.PATH = []' etc/toolchain/CC/TARGETS > etc/toolchain/CC/TARGETS.patched
     mv etc/toolchain/CC/TARGETS.patched etc/toolchain/CC/TARGETS
+  '' + lib.optionalString stdenv.isDarwin ''
+    sed -ie 's|-Wl,-z,stack-size=8388608|-Wl,-stack_size,0x800000|' bin/bootstrap.py
   '';
 
   /* The build phase follows the bootstrap procedure that is explained in
@@ -131,7 +142,7 @@ stdenv.mkDerivation rec {
     # Bootstrap just
     export PACKAGE=YES
     export NON_LOCAL_DEPS='[ "google_apis", "bazel_remote_apis" ]'
-    export JUST_BUILD_CONF=`echo $PATH | jq -R '{ ENV: { PATH: . }, "ADD_CFLAGS": ["-Wno-error=pedantic"], "ADD_CXXFLAGS": ["-Wno-error=pedantic"] }'`
+    export JUST_BUILD_CONF=`echo $PATH | jq -R '{ ENV: { PATH: . }, "ADD_CFLAGS": ["-Wno-error=pedantic"], "ADD_CXXFLAGS": ["-Wno-error=pedantic", "-D__unix__", "-DFMT_HEADER_ONLY"], "ARCH": "'$(uname -m)'" }'`
 
     mkdir ../build
     python3 ./bin/bootstrap.py `pwd` ../build "`pwd`/.distfiles"
diff --git a/pkgs/by-name/tu/tuxmux/package.nix b/pkgs/by-name/tu/tuxmux/package.nix
new file mode 100644
index 000000000000..9714c63696ab
--- /dev/null
+++ b/pkgs/by-name/tu/tuxmux/package.nix
@@ -0,0 +1,41 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, rustPlatform
+, openssl
+, pkg-config
+, installShellFiles
+, darwin
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "tuxmux";
+  version = "0.1.0";
+
+  src = fetchFromGitHub {
+    owner = "edeneast";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-QySDC/aEU9Fo0UbRUNvgBQLfESYzENGfS8Tl/ycn1YY=";
+  };
+
+  cargoHash = "sha256-MlLTaN+KMeF0A1hh0oujLYWqjwrbmoNzoRoXjeCUf7I=";
+
+  buildInputs = [ openssl ] ++ (lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.Security ]);
+  nativeBuildInputs = [ pkg-config installShellFiles ];
+
+  postInstall = ''
+    installShellCompletion $releaseDir/../completions/tm.{bash,fish}
+    installShellCompletion --zsh $releaseDir/../completions/_tm
+
+    installManPage $releaseDir/../man/*
+  '';
+
+  meta = with lib; {
+    description = "Tmux session manager";
+    homepage = "https://github.com/edeneast/tuxmux";
+    license = licenses.apsl20;
+    maintainers = with maintainers; [ edeneast ];
+    mainProgram = "tm";
+  };
+}
diff --git a/pkgs/development/compilers/edk2/default.nix b/pkgs/development/compilers/edk2/default.nix
index 3a039014db84..304ca30b5229 100644
--- a/pkgs/development/compilers/edk2/default.nix
+++ b/pkgs/development/compilers/edk2/default.nix
@@ -2,6 +2,7 @@
 , clangStdenv
 , fetchFromGitHub
 , fetchpatch
+, runCommand
 , libuuid
 , python3
 , bc
@@ -28,9 +29,9 @@ buildType = if stdenv.isDarwin then
   else
     "GCC5";
 
-edk2 = stdenv.mkDerivation {
+edk2 = stdenv.mkDerivation rec {
   pname = "edk2";
-  version = "202305";
+  version = "202308";
 
   patches = [
     # pass targetPrefix as an env var
@@ -40,15 +41,24 @@ edk2 = stdenv.mkDerivation {
     })
   ];
 
-  # submodules
-  src = fetchFromGitHub {
+  srcWithVendoring = fetchFromGitHub {
     owner = "tianocore";
     repo = "edk2";
     rev = "edk2-stable${edk2.version}";
     fetchSubmodules = true;
-    hash = "sha256-htOvV43Hw5K05g0SF3po69HncLyma3BtgpqYSdzRG4s=";
+    hash = "sha256-Eoi1xf/hw/Knr7n0f0rgVof7wTgrHkmvV4eJjJV1NhM=";
   };
 
+  # We don't want EDK2 to keep track of OpenSSL,
+  # they're frankly bad at it.
+  src = runCommand "edk2-unvendored-src" { } ''
+    cp --no-preserve=mode -r ${srcWithVendoring} $out
+    rm -rf $out/CryptoPkg/Library/OpensslLib/openssl
+    mkdir -p $out/CryptoPkg/Library/OpensslLib/openssl
+    tar --strip-components=1 -xf ${buildPackages.openssl.src} -C $out/CryptoPkg/Library/OpensslLib/openssl
+    chmod -R +w $out/
+  '';
+
   nativeBuildInputs = [ pythonEnv ];
   depsBuildBuild = [ buildPackages.stdenv.cc buildPackages.util-linux buildPackages.bash ];
   strictDeps = true;
@@ -69,6 +79,7 @@ edk2 = stdenv.mkDerivation {
     # patchShebangs fails to see these when cross compiling
     for i in $out/BaseTools/BinWrappers/PosixLike/*; do
       substituteInPlace $i --replace '/usr/bin/env bash' ${buildPackages.bash}/bin/bash
+      chmod +x "$i"
     done
   '';
 
diff --git a/pkgs/development/compilers/mercury/default.nix b/pkgs/development/compilers/mercury/default.nix
index 573c18cd9284..d2e15dc6fc23 100644
--- a/pkgs/development/compilers/mercury/default.nix
+++ b/pkgs/development/compilers/mercury/default.nix
@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   pname = "mercury";
-  version = "22.01.7";
+  version = "22.01.8";
 
   src = fetchurl {
     url    = "https://dl.mercurylang.org/release/mercury-srcdist-${version}.tar.gz";
-    sha256 = "sha256-PctyVKlV2cnHoBSAXjMTSPvWY7op9D6kIMypYDRgvGw=";
+    sha256 = "sha256-oJfozI7KAVLtlSfByvc+XJyD9q2h0xOiW4D+eQcvutg=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/development/libraries/ffmpeg/generic.nix b/pkgs/development/libraries/ffmpeg/generic.nix
index 31c93c52fb13..cd02c6bba15c 100644
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@@ -699,5 +699,6 @@ stdenv.mkDerivation (finalAttrs: {
     pkgConfigModules = [ "libavutil" ];
     platforms = platforms.all;
     maintainers = with maintainers; [ atemu ];
+    mainProgram = "ffmpeg";
   };
 })
diff --git a/pkgs/development/libraries/flatbuffers/default.nix b/pkgs/development/libraries/flatbuffers/default.nix
index 58bf002eb272..747a976f4c9e 100644
--- a/pkgs/development/libraries/flatbuffers/default.nix
+++ b/pkgs/development/libraries/flatbuffers/default.nix
@@ -7,22 +7,17 @@
 
 stdenv.mkDerivation rec {
   pname = "flatbuffers";
-  version = "23.3.3";
+  version = "23.5.26";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "flatbuffers";
     rev = "v${version}";
-    sha256 = "sha256-h0lF7jf1cDVVyqhUCi7D0NoZ3b4X/vWXsFplND80lGs=";
+    hash = "sha256-e+dNPNbCHYDXUS/W+hMqf/37fhVgEGzId6rhP3cToTE=";
   };
 
   nativeBuildInputs = [ cmake python3 ];
 
-  postPatch = ''
-    # Fix default value of "test_data_path" to make tests work
-    substituteInPlace tests/test.cpp --replace '"tests/";' '"../tests/";'
-  '';
-
   cmakeFlags = [
     "-DFLATBUFFERS_BUILD_TESTS=${if doCheck then "ON" else "OFF"}"
     "-DFLATBUFFERS_OSX_BUILD_UNIVERSAL=OFF"
diff --git a/pkgs/development/libraries/librtprocess/default.nix b/pkgs/development/libraries/librtprocess/default.nix
index c7e9b3895d98..dabb5e62e45d 100644
--- a/pkgs/development/libraries/librtprocess/default.nix
+++ b/pkgs/development/libraries/librtprocess/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, cmake }:
+{ lib, stdenv, fetchFromGitHub, cmake, llvmPackages }:
 
 stdenv.mkDerivation rec {
   pname = "librtprocess";
@@ -6,18 +6,20 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "CarVac";
-    repo = pname;
+    repo = "librtprocess";
     rev = version;
-    sha256 = "sha256-/1o6SWUor+ZBQ6RsK2PoDRu03jcVRG58PNYFttriH2w=";
+    hash = "sha256-/1o6SWUor+ZBQ6RsK2PoDRu03jcVRG58PNYFttriH2w=";
   };
 
   nativeBuildInputs = [ cmake ];
 
+  buildInputs = lib.optionals stdenv.isDarwin [ llvmPackages.openmp ];
+
   meta = with lib; {
-    homepage = "https://github.com/CarVac/librtprocess";
     description = "Highly optimized library for processing RAW images";
-    license = licenses.gpl3;
+    homepage = "https://github.com/CarVac/librtprocess";
+    license = licenses.gpl3Plus;
     maintainers = with maintainers; [ hjones2199 ];
-    platforms = [ "x86_64-linux" ];
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/libraries/protobuf/generic-v3-cmake.nix b/pkgs/development/libraries/protobuf/generic-v3-cmake.nix
index 53cbfab1fb24..dd31aba434ce 100644
--- a/pkgs/development/libraries/protobuf/generic-v3-cmake.nix
+++ b/pkgs/development/libraries/protobuf/generic-v3-cmake.nix
@@ -16,6 +16,7 @@
   # downstream dependencies
 , python3
 , grpc
+, enableShared ? !stdenv.hostPlatform.isStatic
 
 , ...
 }:
@@ -74,7 +75,7 @@ stdenv.mkDerivation (finalAttrs: {
   cmakeFlags = [
     "-Dprotobuf_USE_EXTERNAL_GTEST=ON"
     "-Dprotobuf_ABSL_PROVIDER=package"
-  ] ++ lib.optionals (!stdenv.targetPlatform.isStatic) [
+  ] ++ lib.optionals enableShared [
     "-Dprotobuf_BUILD_SHARED_LIBS=ON"
   ]
   # Tests fail to build on 32-bit platforms; fixed in 3.22
diff --git a/pkgs/development/python-modules/boschshcpy/default.nix b/pkgs/development/python-modules/boschshcpy/default.nix
index 5f666c1fdfc8..fe6f947ef018 100644
--- a/pkgs/development/python-modules/boschshcpy/default.nix
+++ b/pkgs/development/python-modules/boschshcpy/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "boschshcpy";
-  version = "0.2.69";
+  version = "0.2.70";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "tschamm";
     repo = pname;
     rev = version;
-    hash = "sha256-NXn92a+dhJhAfh92zvNQyrfNE7ZCCIl2er5569IXff8=";
+    hash = "sha256-oL1NgQqK/dDDImDK3RASa2vAUPrenqK8t+MCi2Wwjmk=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/chart-studio/default.nix b/pkgs/development/python-modules/chart-studio/default.nix
index 1632d41fee67..5f8117c6e586 100644
--- a/pkgs/development/python-modules/chart-studio/default.nix
+++ b/pkgs/development/python-modules/chart-studio/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "chart-studio";
-  version = "5.16.1";
+  version = "5.17.0";
 
   # chart-studio was split from plotly
   src = fetchFromGitHub {
     owner = "plotly";
     repo = "plotly.py";
     rev = "refs/tags/v${version}";
-    hash = "sha256-R94fmkz9cydOHKQbXMBR47OCdHHsR25uGiGszcr7AQQ=";
+    hash = "sha256-Vaa/MgauSoSpzNtRVXq3fQSVqMYzLTqDtIbiHBgrXQY=";
   };
 
   sourceRoot = "${src.name}/packages/python/chart-studio";
diff --git a/pkgs/development/python-modules/elasticsearch8/default.nix b/pkgs/development/python-modules/elasticsearch8/default.nix
index 6893a8353dff..5df9db98faba 100644
--- a/pkgs/development/python-modules/elasticsearch8/default.nix
+++ b/pkgs/development/python-modules/elasticsearch8/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "elasticsearch8";
-  version = "8.9.0";
+  version = "8.10.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-9j71MX3ITwfwFfIVvQIbXHu4r/3qz9SNAz8XfeAyWTc=";
+    hash = "sha256-Wb2l0FL7rm9Ck7HSWs9PmPyeShn9Hd9fCKnh/jWVy3o=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/iniconfig/default.nix b/pkgs/development/python-modules/iniconfig/default.nix
index 04f06c013d4b..b9c6e8e205fa 100644
--- a/pkgs/development/python-modules/iniconfig/default.nix
+++ b/pkgs/development/python-modules/iniconfig/default.nix
@@ -32,7 +32,9 @@ buildPythonPackage rec {
     "iniconfig"
   ];
 
-  doCheck = false; # avoid circular import with pytest
+  # Requires pytest, which in turn requires this package - causes infinite
+  # recursion. See also: https://github.com/NixOS/nixpkgs/issues/63168
+  doCheck = false;
 
   meta = with lib; {
     description = "brain-dead simple parsing of ini files";
diff --git a/pkgs/development/python-modules/meraki/default.nix b/pkgs/development/python-modules/meraki/default.nix
index 489c24252f32..cafa77c1e516 100644
--- a/pkgs/development/python-modules/meraki/default.nix
+++ b/pkgs/development/python-modules/meraki/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "meraki";
-  version = "1.37.2";
+  version = "1.37.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ffvoOxbYZzxP1cFjPNiuDWMZ2jxw7tnEEISI8t/AvY4=";
+    hash = "sha256-pq/+giQwxvMey5OS8OtKH8M5fKmDuweuod6+hviY7P8=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/meshtastic/default.nix b/pkgs/development/python-modules/meshtastic/default.nix
index 36dfaad8ab55..984f4e0329fd 100644
--- a/pkgs/development/python-modules/meshtastic/default.nix
+++ b/pkgs/development/python-modules/meshtastic/default.nix
@@ -20,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "meshtastic";
-  version = "2.2.7";
+  version = "2.2.8";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -29,7 +29,7 @@ buildPythonPackage rec {
     owner = "meshtastic";
     repo = "Meshtastic-python";
     rev = "refs/tags/${version}";
-    hash = "sha256-1XbD//nuTJkw5YefUURfMXjvjoZheadRcNI+SSIQ1LU=";
+    hash = "sha256-2VkxKeoRgBCmA59XZT8wlrzvnJ6k2Q2ZLM72TB1atEw=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/opencensus/default.nix b/pkgs/development/python-modules/opencensus/default.nix
index 5f710cfbd7d2..fa7141a8fb2e 100644
--- a/pkgs/development/python-modules/opencensus/default.nix
+++ b/pkgs/development/python-modules/opencensus/default.nix
@@ -8,11 +8,11 @@
 
 buildPythonPackage rec {
   pname = "opencensus";
-  version = "0.11.2";
+  version = "0.11.3";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-YVQEKiNrns3VWiPfuydDuz3qzQaH4+A5HsLgx0lQ1m8=";
+    hash = "sha256-r3qYvVHmOWgUTXcvNG1pbtSYoy29xL4mfNYBHEzgXag=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/primer3/default.nix b/pkgs/development/python-modules/primer3/default.nix
index 93fa56c62195..f4495d9b2c14 100644
--- a/pkgs/development/python-modules/primer3/default.nix
+++ b/pkgs/development/python-modules/primer3/default.nix
@@ -5,6 +5,7 @@
 , cython
 , gcc
 , click
+, pytestCheckHook
 , pythonOlder
 }:
 
@@ -28,10 +29,18 @@ buildPythonPackage rec {
     gcc
   ];
 
-  # pytestCheckHook leads to a circular import issue
   nativeCheckInputs = [
     click
+    pytestCheckHook
   ];
+  # We are not sure why exactly this is need. It seems `pytestCheckHook`
+  # doesn't find extension modules installed in $out/${python.sitePackages},
+  # and the tests rely upon them. This was initially reported upstream at
+  # https://github.com/libnano/primer3-py/issues/120 and we investigate this
+  # downstream at: https://github.com/NixOS/nixpkgs/issues/255262.
+  preCheck = ''
+    python setup.py build_ext --inplace
+  '';
 
   pythonImportsCheck = [
     "primer3"
diff --git a/pkgs/development/python-modules/pydrawise/default.nix b/pkgs/development/python-modules/pydrawise/default.nix
index 232680d3f4dc..263436ce5b8e 100644
--- a/pkgs/development/python-modules/pydrawise/default.nix
+++ b/pkgs/development/python-modules/pydrawise/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "pydrawise";
-  version = "2023.9.2";
+  version = "2023.9.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.10";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "dknowles2";
     repo = "pydrawise";
     rev = "refs/tags/${version}";
-    hash = "sha256-ynQu8Ow6NrGfxzrwiXwMIEx9W65kAjFuXBzQgFAby4k=";
+    hash = "sha256-hQqy2n4A3NHJAvTrAZcaHrlv3KS/yp02Nm0RCsA3Qlg=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
diff --git a/pkgs/development/python-modules/pykalman/default.nix b/pkgs/development/python-modules/pykalman/default.nix
new file mode 100644
index 000000000000..7073e9382d3d
--- /dev/null
+++ b/pkgs/development/python-modules/pykalman/default.nix
@@ -0,0 +1,44 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, numpy
+, scipy
+, pytestCheckHook
+, nose
+}:
+
+buildPythonPackage rec {
+  pname = "pykalman";
+  version = "0.9.5";
+  format = "setuptools";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-gWr0dyDZJKTGAW+nS54sjCEWWgjZFpPDIqF0Ho4H+zg=";
+  };
+
+  patches = [
+    # https://github.com/pykalman/pykalman/issues/83
+    ./fix-masked-arrays-not-supported.patch
+    # python 3.11 issues fix: https://github.com/pykalman/pykalman/pull/101
+    ./fix-p311-issues.patch
+  ];
+
+  propagatedBuildInputs = [
+    numpy
+    scipy
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    nose
+  ];
+  pythonImportsCheck = [ "pykalman" ];
+
+  meta = with lib; {
+    description = "An implementation of the Kalman Filter, Kalman Smoother, and EM algorithm in Python";
+    homepage = "https://github.com/pykalman/pykalman";
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ mbalatsko ];
+  };
+}
diff --git a/pkgs/development/python-modules/pykalman/fix-masked-arrays-not-supported.patch b/pkgs/development/python-modules/pykalman/fix-masked-arrays-not-supported.patch
new file mode 100644
index 000000000000..f6dc6679cc54
--- /dev/null
+++ b/pkgs/development/python-modules/pykalman/fix-masked-arrays-not-supported.patch
@@ -0,0 +1,14 @@
+--- a/pykalman/utils.py
++++ b/pykalman/utils.py
+@@ -70,7 +70,10 @@
+             cv_chol = linalg.cholesky(cv + min_covar * np.eye(n_dim),
+                                       lower=True)
+         cv_log_det = 2 * np.sum(np.log(np.diagonal(cv_chol)))
+-        cv_sol = solve_triangular(cv_chol, (X - mu).T, lower=True).T
++        try:
++            cv_sol = solve_triangular(cv_chol, (X - mu).T, lower=True).T
++        except ValueError:
++            cv_sol = np.linalg.solve(cv_chol, (X - mu).T).T
+         log_prob[:, c] = - .5 * (np.sum(cv_sol ** 2, axis=1) + \
+                                      n_dim * np.log(2 * np.pi) + cv_log_det)
+ 
diff --git a/pkgs/development/python-modules/pykalman/fix-p311-issues.patch b/pkgs/development/python-modules/pykalman/fix-p311-issues.patch
new file mode 100644
index 000000000000..002c8b893aad
--- /dev/null
+++ b/pkgs/development/python-modules/pykalman/fix-p311-issues.patch
@@ -0,0 +1,13 @@
+--- a/pykalman/utils.py
++++ b/pykalman/utils_copy.py
+@@ -40,6 +40,10 @@
+ from scipy import linalg
+ 
+ 
++# monkey patch
++if not hasattr(inspect, 'getargspec'):
++    inspect.getargspec = inspect.getfullargspec
++
+ def array1d(X, dtype=None, order=None):
+     """Returns at least 1-d array with data from X"""
+     return np.asarray(np.atleast_1d(X), dtype=dtype, order=order)
diff --git a/pkgs/development/python-modules/ray/default.nix b/pkgs/development/python-modules/ray/default.nix
index 702be7d2f1b0..3893ad842fdb 100644
--- a/pkgs/development/python-modules/ray/default.nix
+++ b/pkgs/development/python-modules/ray/default.nix
@@ -4,7 +4,6 @@
 , aiosignal
 , attrs
 , autoPatchelfHook
-, buildBazelPackage
 , buildPythonPackage
 , fetchPypi
 , click
@@ -18,7 +17,6 @@
 , frozenlist
 , fsspec
 , gpustat
-, grpc
 , grpcio
 , gym
 , jsonschema
@@ -32,7 +30,6 @@
 , pandas
 , py-spy
 , prometheus-client
-, protobuf3_20
 , psutil
 , pyarrow
 , pydantic
@@ -41,14 +38,12 @@
 , pythonOlder
 , pythonRelaxDepsHook
 , pyyaml
-, redis
 , requests
 , scikit-image
 , scipy
 , setproctitle
 , smart-open
 , starlette
-, stdenv
 , tabulate
 , tensorboardx
 , uvicorn
@@ -144,7 +139,6 @@ buildPythonPackage rec {
     packaging
     py-spy
     prometheus-client
-    protobuf3_20
     psutil
     pydantic
     pyyaml
diff --git a/pkgs/development/python-modules/ring-doorbell/default.nix b/pkgs/development/python-modules/ring-doorbell/default.nix
index 321615b4b85e..bd37f1c530b7 100644
--- a/pkgs/development/python-modules/ring-doorbell/default.nix
+++ b/pkgs/development/python-modules/ring-doorbell/default.nix
@@ -2,6 +2,7 @@
 , buildPythonPackage
 , fetchPypi
 , oauthlib
+, poetry-core
 , pytestCheckHook
 , pythonOlder
 , pytz
@@ -12,17 +13,21 @@
 
 buildPythonPackage rec {
   pname = "ring-doorbell";
-  version = "0.7.3";
-  format = "setuptools";
+  version = "0.7.4";
+  pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     pname = "ring_doorbell";
     inherit version;
-    hash = "sha256-HYRuQZpdtBkVfFBdqQupAjzQpLIBvKGm42cCumc03GM=";
+    hash = "sha256-hto3MwlC6ADjKkcB/4l/uFyw+0CgvLZM0sp3FF62XUA=";
   };
 
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
   propagatedBuildInputs = [
     oauthlib
     pytz
diff --git a/pkgs/development/python-modules/types-protobuf/default.nix b/pkgs/development/python-modules/types-protobuf/default.nix
index 4da64fcf8e59..e644b715544f 100644
--- a/pkgs/development/python-modules/types-protobuf/default.nix
+++ b/pkgs/development/python-modules/types-protobuf/default.nix
@@ -6,12 +6,12 @@
 
 buildPythonPackage rec {
   pname = "types-protobuf";
-  version = "4.24.0.1";
+  version = "4.24.0.2";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-kK3qO2k9akDY7wdcWP5rXMbgH+FJYwGn5vxwOY3P+S4=";
+    hash = "sha256-WYuyKQubDqZfT2NWmgneqkR17de7DYWJBXo43rCxn08=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/tools/analysis/checkov/default.nix b/pkgs/development/tools/analysis/checkov/default.nix
index e271f7272112..9c0ebfb86dac 100644
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@@ -22,14 +22,14 @@ with py.pkgs;
 
 buildPythonApplication rec {
   pname = "checkov";
-  version = "2.4.55";
+  version = "2.4.57";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-HeGrhW9QKxR3WrPMQRgRSntcpbr8UEg+D6To5Dqmfsc=";
+    hash = "sha256-f4BYbz7ldu0X18Hf4cF2HI90SlSh9m61B1BiD+8XZkQ=";
   };
 
   patches = [
diff --git a/pkgs/development/tools/flyway/default.nix b/pkgs/development/tools/flyway/default.nix
index 54f2056732b9..af3aff1e5910 100644
--- a/pkgs/development/tools/flyway/default.nix
+++ b/pkgs/development/tools/flyway/default.nix
@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "flyway";
-  version = "9.22.0";
+  version = "9.22.2";
   src = fetchurl {
     url = "mirror://maven/org/flywaydb/flyway-commandline/${finalAttrs.version}/flyway-commandline-${finalAttrs.version}.tar.gz";
-    sha256 = "sha256-vdg66ETDfa0WG1TrRWJ9XpMSCE9sd5GlYAJY2TERC5Y=";
+    sha256 = "sha256-IaURrRP1Q/Neu/HmPfCDsL6rZ59Gll5AzgniQhRK3GU=";
   };
   nativeBuildInputs = [ makeWrapper ];
   dontBuild = true;
diff --git a/pkgs/development/tools/misc/complgen/default.nix b/pkgs/development/tools/misc/complgen/default.nix
index ac49d7446bab..2bcc9391e787 100644
--- a/pkgs/development/tools/misc/complgen/default.nix
+++ b/pkgs/development/tools/misc/complgen/default.nix
@@ -5,21 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "complgen";
-  version = "0.1.3";
+  version = "0.1.4";
 
   src = fetchFromGitHub {
     owner = "adaszko";
     repo = "complgen";
     rev = "v${version}";
-    hash = "sha256-YKJleWnUZodPuJcWX8w06PH6q1SzeUXL8AjYr9i7+sY=";
+    hash = "sha256-vMmqWN6aRw5cU3/U/ttjcPZwEk/LI6Sodf1MymgWHSE=";
   };
 
-  cargoHash = "sha256-ytwhIcm4NeHDRzKNHaxo4ke+gridXKmiKHkPnACXV8o=";
-
-  # Cargo.lock is outdated
-  postConfigure = ''
-    cargo metadata --offline
-  '';
+  cargoHash = "sha256-BhBgnDR6/El0HLgWiyUDm6xsTqAPrmNM0/6WWxcUQGI=";
 
   meta = with lib; {
     description = "Generate {bash,fish,zsh} completions from a single EBNF-like grammar";
diff --git a/pkgs/development/tools/misc/orogene/default.nix b/pkgs/development/tools/misc/orogene/default.nix
index effa5e530efc..0afbcb04f2e1 100644
--- a/pkgs/development/tools/misc/orogene/default.nix
+++ b/pkgs/development/tools/misc/orogene/default.nix
@@ -9,17 +9,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "orogene";
-  version = "0.3.31";
+  version = "0.3.32";
 
   src = fetchFromGitHub {
     owner = "orogene";
     repo = "orogene";
     rev = "v${version}";
-    hash = "sha256-q6YPyxfOiTOQ6eVjBIsnV7HhwM3A3EIiRCJpDGKZRrQ=";
+    hash = "sha256-UB/FI5LUyksKzAgzsza5NTDtYWou69hqj0M2GWV/FcA=";
     fetchSubmodules = true;
   };
 
-  cargoHash = "sha256-2NAwy95C8/rEq5ssq3poBOL+crwaHJh1Vo+sYiDb6Ds=";
+  cargoHash = "sha256-/Yb1QTsye60qL6B3TM6Wd1W8n4XMxMhu42CLvJcqIYw=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/development/tools/mix2nix/default.nix b/pkgs/development/tools/mix2nix/default.nix
index 80ec10ce44ea..694afbc81207 100644
--- a/pkgs/development/tools/mix2nix/default.nix
+++ b/pkgs/development/tools/mix2nix/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mix2nix";
-  version = "0.1.5";
+  version = "0.1.8";
 
   src = fetchFromGitHub {
     owner = "ydlr";
     repo = "mix2nix";
     rev = version;
-    sha256 = "0flsw8r4x27qxyrlazzjmjq3zkkppgw9krcdcqj7wbq06r2dck3q";
+    hash = "sha256-iWy5q6ERzg8hRZs+bFtR6drZ9yI8Qh1v+47q3q2fFTM=";
   };
 
   nativeBuildInputs = [ elixir ];
diff --git a/pkgs/games/blightmud/default.nix b/pkgs/games/blightmud/default.nix
index d536aa7b8ea6..3267c36a370e 100644
--- a/pkgs/games/blightmud/default.nix
+++ b/pkgs/games/blightmud/default.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "blightmud";
-  version = "5.2.0";
+  version = "5.3.0";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-sLqkDuohCgHJTMte1WIa2Yu43oWXVvnIpeiDBoQpKY8=";
+    sha256 = "sha256-e9Uo0IJYL9/6/nNL27zfUYnsTwDaOJOcR2CY6t++jDE=";
   };
 
-  cargoHash = "sha256-ffADKoMysYY2vwX3asHnjR2EiND4RJsf/W334PWvkGs=";
+  cargoHash = "sha256-QSgTpmSojZrwZ0RsUL6c2xO310RZX3gkyGl6oNf6pYI=";
 
   buildFeatures = lib.optional withTTS "tts";
 
@@ -43,6 +43,7 @@ rustPlatform.buildRustPackage rec {
         "test_lua_script"
         "timer_test"
         "validate_assertion_fail"
+        "regex_smoke_test"
       ];
       skipFlag = test: "--skip " + test;
     in
diff --git a/pkgs/misc/lilypond/unstable.nix b/pkgs/misc/lilypond/unstable.nix
index 11e91ddb377c..a839ef5e8eb1 100644
--- a/pkgs/misc/lilypond/unstable.nix
+++ b/pkgs/misc/lilypond/unstable.nix
@@ -1,10 +1,10 @@
 { lib, fetchurl, lilypond }:
 
 lilypond.overrideAttrs (oldAttrs: rec {
-  version = "2.25.7";
+  version = "2.25.8";
   src = fetchurl {
     url = "https://lilypond.org/download/sources/v${lib.versions.majorMinor version}/lilypond-${version}.tar.gz";
-    sha256 = "sha256-b7prbe4lnUfiLGcmWbrjXTTXqJTX4PsAMBbSvZgHLwI=";
+    hash = "sha256-pycbGmVp3HVKOAGpe4gEmBWjMT2BqrSqKISsAZCEkx0=";
   };
 
   passthru.updateScript = {
diff --git a/pkgs/servers/bazarr/default.nix b/pkgs/servers/bazarr/default.nix
index 792d430a42eb..5b7bea8034ea 100644
--- a/pkgs/servers/bazarr/default.nix
+++ b/pkgs/servers/bazarr/default.nix
@@ -8,13 +8,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "bazarr";
-  version = "1.2.4";
+  version = "1.3.0";
 
   sourceRoot = ".";
 
   src = fetchurl {
     url = "https://github.com/morpheus65535/bazarr/releases/download/v${version}/bazarr.zip";
-    sha256 = "sha256-TdBazeY/w9vSEbs/OgRtdoi/riAUai1zrmM/A8ecaWA=";
+    sha256 = "sha256-f9LKJZX+dZRUGq+g/PHvCzN8UpDiBpEVvqEO6CZPoAE=";
   };
 
   nativeBuildInputs = [ unzip makeWrapper ];
diff --git a/pkgs/servers/dns/coredns/default.nix b/pkgs/servers/dns/coredns/default.nix
index 2dcfc538be45..8078018625a2 100644
--- a/pkgs/servers/dns/coredns/default.nix
+++ b/pkgs/servers/dns/coredns/default.nix
@@ -4,7 +4,7 @@
 , fetchFromGitHub
 , installShellFiles
 , externalPlugins ? []
-, vendorHash ? "sha256-TvIswNQ7DL/MtYmMSxXf+VqKHcmzZVZwohOCvRWxBkY="
+, vendorHash ? "sha256-tp22jj6DNnYFQhtAFW2uLo10ty//dyNqIDH2egDgbOw="
 }:
 
 let
@@ -14,13 +14,13 @@ let
     builtins.map ({name, repo, version}: "${repo}@${version}") attrs;
 in buildGoModule rec {
   pname = "coredns";
-  version = "1.11.0";
+  version = "1.11.1";
 
   src = fetchFromGitHub {
     owner = "coredns";
     repo = "coredns";
     rev = "v${version}";
-    sha256 = "sha256-Mn8hOsODTlnl6PJaevMcyIKkIx/1Lk2HGA7fSSizR20=";
+    sha256 = "sha256-XZoRN907PXNKV2iMn51H/lt8yPxhPupNfJ49Pymdm9Y=";
   };
 
   inherit vendorHash;
diff --git a/pkgs/servers/icingaweb2/ipl.nix b/pkgs/servers/icingaweb2/ipl.nix
index ee0ebe120f7a..b9623f47c91f 100644
--- a/pkgs/servers/icingaweb2/ipl.nix
+++ b/pkgs/servers/icingaweb2/ipl.nix
@@ -2,13 +2,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "icingaweb2-ipl";
-  version = "0.12.0";
+  version = "0.13.0";
 
   src = fetchFromGitHub {
     owner = "Icinga";
     repo = "icinga-php-library";
     rev = "v${version}";
-    hash = "sha256-Fk886oIQz9sbrPCA6AWN1OMh9uFmQPCTFWcbAUWZyXs=";
+    hash = "sha256-U3SzjjYoalejPs5hqZP2QyvlKdgdpWk9o0DkFGtWC2w=";
   };
 
   installPhase = ''
diff --git a/pkgs/servers/monitoring/prometheus/junos-czerwonk-exporter.nix b/pkgs/servers/monitoring/prometheus/junos-czerwonk-exporter.nix
index 035ee933086b..7a72ab9cb903 100644
--- a/pkgs/servers/monitoring/prometheus/junos-czerwonk-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/junos-czerwonk-exporter.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "junos-czerwonk-exporter";
-  version = "0.10.1";
+  version = "0.12.0";
 
   src = fetchFromGitHub {
     owner = "czerwonk";
     repo = "junos_exporter";
     rev = version;
-    sha256 = "sha256-XYISwq6xcVKhXUK6j22pQ5eOfuKNH0uXOEK1MUzSq90=";
+    sha256 = "sha256-9Oh1GsqoIml/SKCmLHuJSnz0k2szEYkb6ArEsU5p198=";
   };
 
-  vendorHash = "sha256-IV0FZb1rjOMLf+vkzz/ZxUBMFD8VRDS51Wdud/yz32E=";
+  vendorHash = "sha256-cQChRpjhL3plUk/J+8z2cg3u9IhMo6aTAbY8M/qlXSQ=";
 
   meta = with lib; {
     description = "Exporter for metrics from devices running JunOS";
diff --git a/pkgs/servers/monitoring/unpoller/default.nix b/pkgs/servers/monitoring/unpoller/default.nix
index e471666e588b..e3105e4b24fd 100644
--- a/pkgs/servers/monitoring/unpoller/default.nix
+++ b/pkgs/servers/monitoring/unpoller/default.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "unpoller";
-  version = "2.8.3";
+  version = "2.9.2";
 
   src = fetchFromGitHub {
     owner = "unpoller";
     repo = "unpoller";
     rev = "v${version}";
-    hash = "sha256-ONr8xwvCXLnAlJKbgt/O+lCEKbV2SJXW/1oJPYRtQ3s=";
+    hash = "sha256-8O5lu0AGLMrWtAd+Unv97CPhxSuhB/wiJXPZnoBjy2A=";
   };
 
   vendorHash = "sha256-eLHtSEINxrqjlPyJZJwfSGA0gVaxcIolhWnqJxLXkew=";
diff --git a/pkgs/servers/web-apps/snipe-it/default.nix b/pkgs/servers/web-apps/snipe-it/default.nix
index c2ff95f93da0..7cf37ea10152 100644
--- a/pkgs/servers/web-apps/snipe-it/default.nix
+++ b/pkgs/servers/web-apps/snipe-it/default.nix
@@ -36,13 +36,13 @@ let
 
 in package.override rec {
   pname = "snipe-it";
-  version = "6.1.1";
+  version = "6.2.0";
 
   src = fetchFromGitHub {
     owner = "snipe";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0kqrq0blamqbfh8dxfyvn2m4q7yphamh4yvpfs7iyb3lb7z7a75i";
+    sha256 = "0s8w98jd81cg3rr2h6i63qm72idxdbhgliz2bdka91cqq0zh6d88";
   };
 
   passthru.tests = nixosTests.snipe-it;
diff --git a/pkgs/servers/web-apps/snipe-it/php-packages.nix b/pkgs/servers/web-apps/snipe-it/php-packages.nix
index 5475e5a95210..465310daf90c 100644
--- a/pkgs/servers/web-apps/snipe-it/php-packages.nix
+++ b/pkgs/servers/web-apps/snipe-it/php-packages.nix
@@ -15,10 +15,10 @@ let
     "arietimmerman/laravel-scim-server" = {
       targetDir = "";
       src = composerEnv.buildZipPackage {
-        name = "arietimmerman-laravel-scim-server-9e8dd2d3958d3c3c05d0a99fe6475361ad9e9419";
+        name = "arietimmerman-laravel-scim-server-dda6dfb60d70fb6cca4b8d4ce1c5f4c19deaab2d";
         src = fetchurl {
-          url = "https://api.github.com/repos/grokability/laravel-scim-server/zipball/9e8dd2d3958d3c3c05d0a99fe6475361ad9e9419";
-          sha256 = "02if4yvnqagpwgrq8b0371nva24lsk0h3h06q51vjxyqjhqvc2nr";
+          url = "https://api.github.com/repos/grokability/laravel-scim-server/zipball/dda6dfb60d70fb6cca4b8d4ce1c5f4c19deaab2d";
+          sha256 = "0b08j7xfrbvp6ckv413sfpqq8v4qk59y9wcwch5kc19fb8y3dgiq";
         };
       };
     };
@@ -415,10 +415,10 @@ let
     "guzzlehttp/psr7" = {
       targetDir = "";
       src = composerEnv.buildZipPackage {
-        name = "guzzlehttp-psr7-13388f00956b1503577598873fffb5ae994b5737";
+        name = "guzzlehttp-psr7-0454e12ef0cd597ccd2adb036f7bda4e7fface66";
         src = fetchurl {
-          url = "https://api.github.com/repos/guzzle/psr7/zipball/13388f00956b1503577598873fffb5ae994b5737";
-          sha256 = "05vc1q903nxfg11y9mcnlg253lm5d81jjg6wv76hjiwx8m47lbac";
+          url = "https://api.github.com/repos/guzzle/psr7/zipball/0454e12ef0cd597ccd2adb036f7bda4e7fface66";
+          sha256 = "1vlrryjzwjigf2q1nichnrxl43r75cw3yjf17d3dy7ixhvlpnlv6";
         };
       };
     };
@@ -845,10 +845,10 @@ let
     "nyholm/psr7" = {
       targetDir = "";
       src = composerEnv.buildZipPackage {
-        name = "nyholm-psr7-f734364e38a876a23be4d906a2a089e1315be18a";
+        name = "nyholm-psr7-e874c8c4286a1e010fb4f385f3a55ac56a05cc93";
         src = fetchurl {
-          url = "https://api.github.com/repos/Nyholm/psr7/zipball/f734364e38a876a23be4d906a2a089e1315be18a";
-          sha256 = "0w8i5l1qg8dkc1zsyz1gpwn2awgkhlm295l1b8smmzabqdc65dcx";
+          url = "https://api.github.com/repos/Nyholm/psr7/zipball/e874c8c4286a1e010fb4f385f3a55ac56a05cc93";
+          sha256 = "0abjvcrg19km5p6bcjfmfhrravsb60hap71zzznpwmf83bq16l8r";
         };
       };
     };
@@ -1582,6 +1582,16 @@ let
         };
       };
     };
+    "tecnickcom/tcpdf" = {
+      targetDir = "";
+      src = composerEnv.buildZipPackage {
+        name = "tecnickcom-tcpdf-e3cffc9bcbc76e89e167e9eb0bbda0cab7518459";
+        src = fetchurl {
+          url = "https://api.github.com/repos/tecnickcom/TCPDF/zipball/e3cffc9bcbc76e89e167e9eb0bbda0cab7518459";
+          sha256 = "17769rpyfq6z8lw5bj7icvkz7003d6kbj1hiji5cixrkahvc57fy";
+        };
+      };
+    };
     "tijsverkoyen/css-to-inline-styles" = {
       targetDir = "";
       src = composerEnv.buildZipPackage {
diff --git a/pkgs/servers/web-apps/snipe-it/update.sh b/pkgs/servers/web-apps/snipe-it/update.sh
index 3e5f70f1a587..226c71af3e34 100755
--- a/pkgs/servers/web-apps/snipe-it/update.sh
+++ b/pkgs/servers/web-apps/snipe-it/update.sh
@@ -1,5 +1,43 @@
 #!/usr/bin/env nix-shell
 #! nix-shell -I nixpkgs=../../../.. -i bash -p nix curl jq nix-update
+# shellcheck shell=bash
+cd "$(dirname "$0")"
+
+usage () {
+  cat <<EOF
+# Snipe-IT Updater
+
+A small script to update Snipe-IT to the latest release
+
+Usage: $(basename "$0") [options]
+
+ -h, --help      Display this message and quit
+ -c, --commit    Create a commit after updating
+ -n, --no-build  Just update, don't build the package
+
+This script needs composer2nix in your PATH.
+https://github.com/svanderburg/composer2nix
+EOF
+}
+
+# Parse command line arguments
+while [ $# -ge 1 ]; do
+  case "$1" in
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    -c|--commit)
+      COMMIT_CHANGES=true
+      ;;
+    -d|--dont-build)
+      DONT_BUILD=true
+      ;;
+    *)
+      ;;
+  esac
+  shift
+done
 
 # check if composer2nix is installed
 if ! command -v composer2nix &> /dev/null; then
@@ -44,7 +82,18 @@ sed -e '7s/stdenv writeTextFile/stdenv lib writeTextFile/' \
 echo "" >> composition.nix
 echo "" >> php-packages.nix
 
-cd ../../../..
-nix-build -A snipe-it
+if [ -z ${DONT_BUILD+x} ]; then
+  (
+    cd ../../../..
+    nix-build -A snipe-it
+  )
+fi
+
+if [ -n "$COMMIT_CHANGES" ]; then
+  git add .
+  git commit -m "snipe-it: $CURRENT_VERSION -> $TARGET_VERSION
+
+https://github.com/snipe/snipe-it/releases/tag/v$TARGET_VERSION"
+fi
 
 exit $?
diff --git a/pkgs/shells/bash/5.nix b/pkgs/shells/bash/5.nix
index 3beb54b908e2..3c4fb83e3e4e 100644
--- a/pkgs/shells/bash/5.nix
+++ b/pkgs/shells/bash/5.nix
@@ -2,7 +2,6 @@
 , stdenv
 , buildPackages
 , fetchurl
-, binutils
 , bison
 , util-linux
 
@@ -95,7 +94,7 @@ stdenv.mkDerivation rec {
   depsBuildBuild = [ buildPackages.stdenv.cc ];
   nativeBuildInputs = [ bison ]
     ++ lib.optional withDocs texinfo
-    ++ lib.optional stdenv.hostPlatform.isDarwin binutils;
+    ++ lib.optional stdenv.hostPlatform.isDarwin stdenv.cc.bintools;
 
   buildInputs = lib.optional interactive readline;
 
diff --git a/pkgs/stdenv/linux/make-bootstrap-tools.nix b/pkgs/stdenv/linux/make-bootstrap-tools.nix
index d6c4da0ab2be..1334c13ad170 100644
--- a/pkgs/stdenv/linux/make-bootstrap-tools.nix
+++ b/pkgs/stdenv/linux/make-bootstrap-tools.nix
@@ -78,7 +78,8 @@ in with pkgs; rec {
         cp -d ${libc.out}/lib/libutil*.so* $out/lib
         cp -d ${libc.out}/lib/libnss*.so* $out/lib
         cp -d ${libc.out}/lib/libresolv*.so* $out/lib
-        cp -d ${libc.out}/lib/crt?.o $out/lib
+        # Copy all runtime files to enable non-PIE, PIE, static PIE and profile-generated builds
+        cp -d ${libc.out}/lib/*.o $out/lib
 
         # Hacky compat with our current unpack-bootstrap-tools.sh
         ln -s librt.so "$out"/lib/librt-dummy.so
diff --git a/pkgs/tools/admin/kics/default.nix b/pkgs/tools/admin/kics/default.nix
index 64f8ec24251e..205a8f42b997 100644
--- a/pkgs/tools/admin/kics/default.nix
+++ b/pkgs/tools/admin/kics/default.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "kics";
-  version = "1.7.7";
+  version = "1.7.8";
 
   src = fetchFromGitHub {
     owner = "Checkmarx";
     repo = "kics";
     rev = "v${version}";
-    hash = "sha256-qK1lq7jrej4HdM+BUDDPujhbhqEhKcli3CTAmadO5Mg=";
+    hash = "sha256-T4b4PO4NcpsosiyRa/78WJ4yYvc1Ez7t7KIbZzSlQAo=";
   };
 
   vendorHash = "sha256-gJu3B30IPp8A/xgtE5fzThQAtnFbbzr8ZwucAsObBxs=";
diff --git a/pkgs/tools/backup/bdsync/default.nix b/pkgs/tools/backup/bdsync/default.nix
index 0112ad4c9a19..bf3afacb9496 100644
--- a/pkgs/tools/backup/bdsync/default.nix
+++ b/pkgs/tools/backup/bdsync/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "bdsync";
-  version = "0.11.2";
+  version = "0.11.3";
 
   src = fetchFromGitHub {
     owner = "rolffokkens";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0kx422cp1bxr62i1mi7dzrpwmys1kdp865rcymdp4knb5rr5864k";
+    sha256 = "sha256-58yoF6s0WjH+1mTY7X5OX53YgcnDmGxoCR8Kvl6lP+A=";
   };
 
   nativeBuildInputs = [ pandoc which ];
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Fast block device synchronizing tool";
-    homepage = "https://github.com/TargetHolding/bdsync";
+    homepage = "https://github.com/rolffokkens/bdsync";
     license = licenses.gpl2;
     platforms = platforms.linux;
     maintainers = with maintainers; [ jluttine ];
diff --git a/pkgs/tools/misc/asdf-vm/default.nix b/pkgs/tools/misc/asdf-vm/default.nix
index 092607f8cbe5..1247039e8c64 100644
--- a/pkgs/tools/misc/asdf-vm/default.nix
+++ b/pkgs/tools/misc/asdf-vm/default.nix
@@ -37,13 +37,13 @@ ${asdfReshimFile}
   '';
 in stdenv.mkDerivation rec {
   pname = "asdf-vm";
-  version = "0.12.0";
+  version = "0.13.1";
 
   src = fetchFromGitHub {
     owner = "asdf-vm";
     repo = "asdf";
     rev = "v${version}";
-    sha256 = "sha256-9U8B6KRn27RrMqWXAUTTy+hrOgMv5Ii4YGsOZeX5Bl0=";
+    sha256 = "sha256-9Levs1Wr7Lohhvpy+1Xq3AYyf7+VsBalvAAA7qq6heI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/misc/edir/default.nix b/pkgs/tools/misc/edir/default.nix
index 6252710fb735..f6934bae4995 100644
--- a/pkgs/tools/misc/edir/default.nix
+++ b/pkgs/tools/misc/edir/default.nix
@@ -2,13 +2,22 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "edir";
-  version = "2.16";
+  version = "2.22";
+  format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "ro1GZkJ6xDZcMRaWTAW/a2qhFbZAxsduvGO3C4sOI+A=";
+    sha256 = "sha256-Z4p16v0J7mgl1Av8tdUZ6vSILgbOpLHs3rWx2P7AH+E=";
   };
 
+  nativeBuildInputs = with python3Packages; [
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = with python3Packages; [
+    platformdirs
+  ];
+
   meta = with lib; {
     description = "Program to rename and remove files and directories using your editor";
     homepage = "https://github.com/bulletmark/edir";
diff --git a/pkgs/tools/networking/networkmanager/openvpn/default.nix b/pkgs/tools/networking/networkmanager/openvpn/default.nix
index e988fc13528a..aeaf57a137a3 100644
--- a/pkgs/tools/networking/networkmanager/openvpn/default.nix
+++ b/pkgs/tools/networking/networkmanager/openvpn/default.nix
@@ -21,11 +21,11 @@
 
 stdenv.mkDerivation rec {
   pname = "NetworkManager-openvpn";
-  version = "1.10.0";
+  version = "1.10.2";
 
   src = fetchurl {
     url = "mirror://gnome/sources/NetworkManager-openvpn/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "V0XUEH8zmKl6+7k/aSObUQyeRet/ti1g2e0Kcpf00QE=";
+    sha256 = "YvDyqHgiIbkj8hKsKo67wQAu/WqQ7pRdrUrftW0HbSE=";
   };
 
   patches = [
diff --git a/pkgs/tools/networking/xdp-tools/default.nix b/pkgs/tools/networking/xdp-tools/default.nix
index b14dd819e434..d3eb90f258ba 100644
--- a/pkgs/tools/networking/xdp-tools/default.nix
+++ b/pkgs/tools/networking/xdp-tools/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , libbpf
 , elfutils
 , zlib
@@ -16,23 +15,15 @@
 }:
 stdenv.mkDerivation rec {
   pname = "xdp-tools";
-  version = "1.3.1";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "xdp-project";
     repo = "xdp-tools";
     rev = "v${version}";
-    sha256 = "ctggXzc3qA+m2/nJ9lmR/pERj0YyPko3MTttm8e85cU=";
+    hash = "sha256-XZGbfXQM3catiDavzi2vY5s+EMVgGHq/ju32lBIgg8E=";
   };
 
-  patches = [
-    # Fix function detection for btf__type_cnt()
-    (fetchpatch {
-      url = "https://github.com/xdp-project/xdp-tools/commit/a7df567634af77381832a2212c5f5099b07734f3.patch";
-      sha256 = "n6qG/bojSGUowrAaJWxecYpWdv9OceHkoaGlhbl81hA=";
-    })
-  ];
-
   outputs = [ "out" "lib" ];
 
   buildInputs = [
diff --git a/pkgs/tools/security/biscuit-cli/default.nix b/pkgs/tools/security/biscuit-cli/default.nix
index d7150ff353fa..74dac8b56586 100644
--- a/pkgs/tools/security/biscuit-cli/default.nix
+++ b/pkgs/tools/security/biscuit-cli/default.nix
@@ -8,20 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "biscuit-cli";
-  version = "0.4.0";
+  version = "0.4.1";
 
   src = fetchFromGitHub {
     owner = "biscuit-auth";
     repo = "biscuit-cli";
     rev = version;
-    sha256 = "sha256-Fd5wBvQe7S/UZ42FMlU+f9qTwcLIMnQrCWVRoHxOx64=";
+    sha256 = "sha256-Mvrv3BU0Pw85fs8IbjMKSQLIhtU6SKoLC0cuGdhfAYs=";
   };
 
-  cargoHash = "sha256-SHRqdKRAHkWK/pEVFYo3d+r761K4j9BkTg2angQOubk=";
-
-  # Version option does not report the correct version
-  # https://github.com/biscuit-auth/biscuit-cli/issues/44
-  patches = [ ./version-0.4.0.patch ];
+  cargoHash = "sha256-tgmM0rswIFrpFyupaASTXYvIyhVu0fXJJN+hg0p+vrQ=";
 
   passthru = {
     updateScript = nix-update-script { };
diff --git a/pkgs/tools/security/biscuit-cli/version-0.4.0.patch b/pkgs/tools/security/biscuit-cli/version-0.4.0.patch
deleted file mode 100644
index d2ed06f211ca..000000000000
--- a/pkgs/tools/security/biscuit-cli/version-0.4.0.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/src/cli.rs b/src/cli.rs
-index f40cfc7..d587eeb 100644
---- a/src/cli.rs
-+++ b/src/cli.rs
-@@ -89,7 +89,7 @@ fn parse_param(kv: &str) -> Result<Param, std::io::Error> {
- 
- /// biscuit creation and inspection CLI. Run `biscuit --help` to see what's available.
- #[derive(Parser)]
--#[clap(version = "0.2.0", author = "Clément D. <clement@delafargue.name>")]
-+#[clap(version = "0.4.0", author = "Clément D. <clement@delafargue.name>")]
- pub struct Opts {
-     #[clap(subcommand)]
-     pub subcmd: SubCommand,
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index c6af6c2c250b..534b0af4b333 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1254,6 +1254,8 @@ mapAliases ({
   ocropus = throw "ocropus has been removed: abandoned by upstream"; # Added 2022-04-24
   octoprint-plugins = throw "octoprint-plugins are now part of the octoprint.python.pkgs package set"; # Added 2021-01-24
   ocz-ssd-guru = throw "ocz-ssd-guru has been removed due to there being no source available"; # Added 2021-07-12
+  octant = throw "octant has been dropped due to being archived and vulnerable"; # Added 2023-09-29
+  octant-desktop = throw "octant-desktop has been dropped due to being archived and vulnerable"; # Added 2023-09-29
   odpdown = throw "odpdown has been removed because it lacks python3 support"; # Added 2022-04-25
   ofp = throw "ofp is not compatible with odp-dpdk";
   ogre1_9 = throw "ogre1_9 has been removed, use ogre instead"; # Added 2023-03-22
@@ -1721,6 +1723,7 @@ mapAliases ({
   ssmtp = throw "'ssmtp' has been removed due to the software being unmaintained. 'msmtp' can be used as a replacement"; # Added 2022-04-17
   ssr = throw "ssr has been removed, because it was unmaintained in nixpkgs and depended on qt4"; # Added 2022-05-26
   stanchion = throw "Stanchion was part of riak-cs which is not maintained anymore"; # added 2020-10-14
+  starboard-octant-plugin = throw "starboard-octant-plugin has been dropped due to needing octant which is archived"; # Added 2023-09-29
   steam-run-native = steam-run; # added 2022-02-21
   stride = throw "'stride' aka. Atlassian Stride is dead since 2019 (bought by Slack)"; # added 2022-06-15
   structure-synth = throw "structure-synth has been removed, because it was unmaintained"; # Added 2022-05-09
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 8360494fa4b4..5b65243c1a9f 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1304,10 +1304,6 @@ with pkgs;
 
   ociTools = callPackage ../build-support/oci-tools { };
 
-  octant = callPackage ../applications/networking/cluster/octant { };
-  octant-desktop = callPackage ../applications/networking/cluster/octant/desktop.nix { };
-  starboard-octant-plugin = callPackage ../applications/networking/cluster/octant/plugins/starboard-octant-plugin.nix { };
-
   inherit (
     callPackages ../build-support/setup-hooks/patch-rc-path-hooks { }
   ) patchRcPathBash patchRcPathCsh patchRcPathFish patchRcPathPosix;
@@ -11999,7 +11995,7 @@ with pkgs;
   pfstools = libsForQt5.callPackage ../tools/graphics/pfstools { };
 
   phoc = callPackage ../applications/misc/phoc {
-    wlroots = wlroots_0_15;
+    wlroots = wlroots_0_16;
   };
 
   phockup = callPackage ../applications/misc/phockup { };
@@ -15333,17 +15329,13 @@ with pkgs;
 
   nix-your-shell = callPackage ../shells/nix-your-shell { };
 
-  bash = lowPrio (callPackage ../shells/bash/5.nix {
-    binutils = stdenv.cc.bintools;
-  });
+  bash = lowPrio (callPackage ../shells/bash/5.nix { });
   # WARNING: this attribute is used by nix-shell so it shouldn't be removed/renamed
   bashInteractive = callPackage ../shells/bash/5.nix {
-    binutils = stdenv.cc.bintools;
     interactive = true;
     withDocs = true;
   };
   bashInteractiveFHS = callPackage ../shells/bash/5.nix {
-    binutils = stdenv.cc.bintools;
     interactive = true;
     withDocs = true;
     forFHSEnv = true;
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 42c462f4f25c..994e30b1af2e 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -9451,6 +9451,8 @@ self: super: with self; {
 
   pykaleidescape = callPackage ../development/python-modules/pykaleidescape { };
 
+  pykalman = callPackage ../development/python-modules/pykalman { };
+
   pykdl = callPackage ../development/python-modules/pykdl { };
 
   pykdtree = callPackage ../development/python-modules/pykdtree {
@@ -11210,7 +11212,7 @@ self: super: with self; {
 
   rawkit = callPackage ../development/python-modules/rawkit { };
 
-  ray = callPackage ../development/python-modules/ray { redis = pkgs.redis; };
+  ray = callPackage ../development/python-modules/ray { };
 
   razdel = callPackage ../development/python-modules/razdel { };