diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 1d23d6006169..41da5bc9ae48 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -5630,6 +5630,12 @@
     githubId = 609279;
     name = "Isaac Shapira";
   };
+  freyacodes = {
+    email = "freya@arbjerg.dev";
+    github = "freyacodes";
+    githubId = 2582617;
+    name = "Freya Arbjerg";
+  };
   fricklerhandwerk = {
     email = "valentin@fricklerhandwerk.de";
     github = "fricklerhandwerk";
@@ -13016,6 +13022,12 @@
     githubId = 1830959;
     name = "Piper McCorkle";
   };
+  piturnah = {
+    email = "peterhebden6@gmail.com";
+    github = "piturnah";
+    githubId = 20472367;
+    name = "Peter Hebden";
+  };
   pjbarnoy = {
     email = "pjbarnoy@gmail.com";
     github = "pjbarnoy";
diff --git a/nixos/doc/manual/release-notes/rl-2311.section.md b/nixos/doc/manual/release-notes/rl-2311.section.md
index 920a5f433c39..0c7080e5e98f 100644
--- a/nixos/doc/manual/release-notes/rl-2311.section.md
+++ b/nixos/doc/manual/release-notes/rl-2311.section.md
@@ -82,6 +82,8 @@
 
 - mdraid support is now optional. This reduces initramfs size and prevents the potentially undesired automatic detection and activation of software RAID pools. It is disabled by default in new configurations (determined by `stateVersion`), but the appropriate settings will be generated by `nixos-generate-config` when installing to a software RAID device, so the standard installation procedure should be unaffected. If you have custom configs relying on mdraid, ensure that you use `stateVersion` correctly or set `boot.swraid.enable` manually.
 
+- The `go-ethereum` package has been updated to v1.12.0. This drops support for proof-of-work. Its GraphQL API now encodes all numeric values as hex strings and the GraphQL UI is updated to version 2.0. The default database has changed from `leveldb` to `pebble` but `leveldb` can be forced with the --db.engine=leveldb flag. The `checkpoint-admin` command was [removed along with trusted checkpoints](https://github.com/ethereum/go-ethereum/pull/27147).
+
 ## Other Notable Changes {#sec-release-23.11-notable-changes}
 
 - The Cinnamon module now enables XDG desktop integration by default. If you are experiencing collisions related to xdg-desktop-portal-gtk you can safely remove `xdg.portal.extraPortals = [ pkgs.xdg-desktop-portal-gtk ];` from your NixOS configuration.
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 48cbc404a815..a20fbd69a2cb 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -646,6 +646,7 @@
   ./services/misc/greenclip.nix
   ./services/misc/headphones.nix
   ./services/misc/heisenbridge.nix
+  ./services/misc/homepage-dashboard.nix
   ./services/misc/ihaskell.nix
   ./services/misc/input-remapper.nix
   ./services/misc/irkerd.nix
diff --git a/nixos/modules/services/misc/homepage-dashboard.nix b/nixos/modules/services/misc/homepage-dashboard.nix
new file mode 100644
index 000000000000..e68571253433
--- /dev/null
+++ b/nixos/modules/services/misc/homepage-dashboard.nix
@@ -0,0 +1,55 @@
+{ config
+, pkgs
+, lib
+, ...
+}:
+
+let
+  cfg = config.services.homepage-dashboard;
+in
+{
+  options = {
+    services.homepage-dashboard = {
+      enable = lib.mkEnableOption (lib.mdDoc "Homepage Dashboard");
+
+      package = lib.mkPackageOptionMD pkgs "homepage-dashboard" { };
+
+      openFirewall = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = lib.mdDoc "Open ports in the firewall for Homepage.";
+      };
+
+      listenPort = lib.mkOption {
+        type = lib.types.int;
+        default = 8082;
+        description = lib.mdDoc "Port for Homepage to bind to.";
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.homepage-dashboard = {
+      description = "Homepage Dashboard";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+
+      environment = {
+        HOMEPAGE_CONFIG_DIR = "/var/lib/homepage-dashboard";
+        PORT = "${toString cfg.listenPort}";
+      };
+
+      serviceConfig = {
+        Type = "simple";
+        DynamicUser = true;
+        StateDirectory = "homepage-dashboard";
+        ExecStart = "${lib.getExe cfg.package}";
+        Restart = "on-failure";
+      };
+    };
+
+    networking.firewall = lib.mkIf cfg.openFirewall {
+      allowedTCPPorts = [ cfg.listenPort ];
+    };
+  };
+}
diff --git a/nixos/modules/services/misc/prowlarr.nix b/nixos/modules/services/misc/prowlarr.nix
index 77b8ec989479..cd2c98fc5dfb 100644
--- a/nixos/modules/services/misc/prowlarr.nix
+++ b/nixos/modules/services/misc/prowlarr.nix
@@ -11,6 +11,8 @@ in
     services.prowlarr = {
       enable = mkEnableOption (lib.mdDoc "Prowlarr");
 
+      package = mkPackageOptionMD pkgs "prowlarr" { };
+
       openFirewall = mkOption {
         type = types.bool;
         default = false;
@@ -29,7 +31,7 @@ in
         Type = "simple";
         DynamicUser = true;
         StateDirectory = "prowlarr";
-        ExecStart = "${pkgs.prowlarr}/bin/Prowlarr -nobrowser -data=/var/lib/prowlarr";
+        ExecStart = "${cfg.package}/bin/Prowlarr -nobrowser -data=/var/lib/prowlarr";
         Restart = "on-failure";
       };
     };
diff --git a/nixos/modules/services/web-apps/peering-manager.nix b/nixos/modules/services/web-apps/peering-manager.nix
index 666b82621268..641a3644614f 100644
--- a/nixos/modules/services/web-apps/peering-manager.nix
+++ b/nixos/modules/services/web-apps/peering-manager.nix
@@ -1,7 +1,5 @@
 { config, lib, pkgs, buildEnv, ... }:
 
-with lib;
-
 let
   cfg = config.services.peering-manager;
   configFile = pkgs.writeTextFile {
@@ -41,24 +39,24 @@ let
   pkg = (pkgs.peering-manager.overrideAttrs (old: {
     postInstall = ''
       ln -s ${configFile} $out/opt/peering-manager/peering_manager/configuration.py
-    '' + optionalString cfg.enableLdap ''
+    '' + lib.optionalString cfg.enableLdap ''
       ln -s ${cfg.ldapConfigPath} $out/opt/peering-manager/peering_manager/ldap_config.py
     '';
   })).override {
     inherit (cfg) plugins;
   };
-  peeringManagerManageScript = with pkgs; (writeScriptBin "peering-manager-manage" ''
-    #!${stdenv.shell}
+  peeringManagerManageScript = pkgs.writeScriptBin "peering-manager-manage" ''
+    #!${pkgs.stdenv.shell}
     export PYTHONPATH=${pkg.pythonPath}
     sudo -u peering-manager ${pkg}/bin/peering-manager "$@"
-  '');
+  '';
 
 in {
-  options.services.peering-manager = {
+  options.services.peering-manager = with lib; {
     enable = mkOption {
-      type = lib.types.bool;
+      type = types.bool;
       default = false;
-      description = lib.mdDoc ''
+      description = mdDoc ''
         Enable Peering Manager.
 
         This module requires a reverse proxy that serves `/static` separately.
@@ -69,7 +67,7 @@ in {
     listenAddress = mkOption {
       type = types.str;
       default = "[::1]";
-      description = lib.mdDoc ''
+      description = mdDoc ''
         Address the server will listen on.
       '';
     };
@@ -77,7 +75,7 @@ in {
     port = mkOption {
       type = types.port;
       default = 8001;
-      description = lib.mdDoc ''
+      description = mdDoc ''
         Port the server will listen on.
       '';
     };
@@ -88,14 +86,14 @@ in {
       defaultText = literalExpression ''
         python3Packages: with python3Packages; [];
       '';
-      description = lib.mdDoc ''
+      description = mdDoc ''
         List of plugin packages to install.
       '';
     };
 
     secretKeyFile = mkOption {
       type = types.path;
-      description = lib.mdDoc ''
+      description = mdDoc ''
         Path to a file containing the secret key.
       '';
     };
@@ -103,7 +101,7 @@ in {
     peeringdbApiKeyFile = mkOption {
       type = with types; nullOr path;
       default = null;
-      description = lib.mdDoc ''
+      description = mdDoc ''
         Path to a file containing the PeeringDB API key.
       '';
     };
@@ -111,7 +109,7 @@ in {
     extraConfig = mkOption {
       type = types.lines;
       default = "";
-      description = lib.mdDoc ''
+      description = mdDoc ''
         Additional lines of configuration appended to the `configuration.py`.
         See the [documentation](https://peering-manager.readthedocs.io/en/stable/configuration/optional-settings/) for more possible options.
       '';
@@ -120,7 +118,7 @@ in {
     enableLdap = mkOption {
       type = types.bool;
       default = false;
-      description = lib.mdDoc ''
+      description = mdDoc ''
         Enable LDAP-Authentication for Peering Manager.
 
         This requires a configuration file being pass through `ldapConfigPath`.
@@ -129,15 +127,15 @@ in {
 
     ldapConfigPath = mkOption {
       type = types.path;
-      description = lib.mdDoc ''
+      description = mdDoc ''
         Path to the Configuration-File for LDAP-Authentication, will be loaded as `ldap_config.py`.
         See the [documentation](https://peering-manager.readthedocs.io/en/stable/setup/6-ldap/#configuration) for possible options.
       '';
     };
   };
 
-  config = mkIf cfg.enable {
-    services.peering-manager.plugins = mkIf cfg.enableLdap (ps: [ ps.django-auth-ldap ]);
+  config = lib.mkIf cfg.enable {
+    services.peering-manager.plugins = lib.mkIf cfg.enableLdap (ps: [ ps.django-auth-ldap ]);
 
     system.build.peeringManagerPkg = pkg;
 
@@ -262,4 +260,6 @@ in {
     users.groups.peering-manager = {};
     users.groups."${config.services.redis.servers.peering-manager.user}".members = [ "peering-manager" ];
   };
+
+  meta.maintainers = with lib.maintainers; [ yuka ];
 }
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 790de7bbdc47..723b030072e1 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -337,6 +337,7 @@ in {
   hbase3 = handleTest ./hbase.nix { package=pkgs.hbase3; };
   hedgedoc = handleTest ./hedgedoc.nix {};
   herbstluftwm = handleTest ./herbstluftwm.nix {};
+  homepage-dashboard = handleTest ./homepage-dashboard.nix {};
   installed-tests = pkgs.recurseIntoAttrs (handleTest ./installed-tests {});
   invidious = handleTest ./invidious.nix {};
   oci-containers = handleTestOn ["aarch64-linux" "x86_64-linux"] ./oci-containers.nix {};
diff --git a/nixos/tests/homepage-dashboard.nix b/nixos/tests/homepage-dashboard.nix
new file mode 100644
index 000000000000..56e077f5ff6d
--- /dev/null
+++ b/nixos/tests/homepage-dashboard.nix
@@ -0,0 +1,14 @@
+import ./make-test-python.nix ({ lib, ... }: {
+  name = "homepage-dashboard";
+  meta.maintainers = with lib.maintainers; [ jnsgruk ];
+
+  nodes.machine = { pkgs, ... }: {
+    services.homepage-dashboard.enable = true;
+  };
+
+  testScript = ''
+    machine.wait_for_unit("homepage-dashboard.service")
+    machine.wait_for_open_port(8082)
+    machine.succeed("curl --fail http://localhost:8082/")
+  '';
+})
diff --git a/nixos/tests/web-apps/peering-manager.nix b/nixos/tests/web-apps/peering-manager.nix
index 56b7eebfadff..3f0acd560d13 100644
--- a/nixos/tests/web-apps/peering-manager.nix
+++ b/nixos/tests/web-apps/peering-manager.nix
@@ -34,7 +34,7 @@ import ../make-test-python.nix ({ lib, pkgs, ... }: {
             "sudo -u postgres psql -c 'ALTER USER \"peering-manager\" WITH SUPERUSER;'"
         )
         machine.succeed(
-            "cd ${nodes.machine.config.system.build.peeringManagerPkg}/opt/peering-manager ; peering-manager-manage test --no-input"
+            "cd ${nodes.machine.system.build.peeringManagerPkg}/opt/peering-manager ; peering-manager-manage test --no-input"
         )
   '';
 })
diff --git a/pkgs/applications/blockchains/go-ethereum/default.nix b/pkgs/applications/blockchains/go-ethereum/default.nix
index 7e00aa33a220..6c39a8eae655 100644
--- a/pkgs/applications/blockchains/go-ethereum/default.nix
+++ b/pkgs/applications/blockchains/go-ethereum/default.nix
@@ -9,16 +9,16 @@ let
 
 in buildGoModule rec {
   pname = "go-ethereum";
-  version = "1.11.6";
+  version = "1.12.0";
 
   src = fetchFromGitHub {
     owner = "ethereum";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-mZ11xan3MGgaUORbiQczKrXSrxzjvQMhZbpHnEal11Y=";
+    sha256 = "sha256-u1p9k12tY79kA/2Hu109czQZnurHuDJQf/w7J0c8SuU=";
   };
 
-  vendorHash = "sha256-rjSGR2ie5sFK2OOo4HUZ6+hrDlQuUDtyTKn0sh8jFBY=";
+  vendorHash = "sha256-k5MbOiJDvWFnaAPViNRHeqFa64XPZ3ImkkvkmTTscNA=";
 
   doCheck = false;
 
@@ -33,7 +33,6 @@ in buildGoModule rec {
     "cmd/abidump"
     "cmd/abigen"
     "cmd/bootnode"
-    "cmd/checkpoint-admin"
     "cmd/clef"
     "cmd/devp2p"
     "cmd/ethkey"
@@ -58,6 +57,6 @@ in buildGoModule rec {
     homepage = "https://geth.ethereum.org/";
     description = "Official golang implementation of the Ethereum protocol";
     license = with licenses; [ lgpl3Plus gpl3Plus ];
-    maintainers = with maintainers; [ adisbladis RaghavSood ];
+    maintainers = with maintainers; [ RaghavSood ];
   };
 }
diff --git a/pkgs/applications/editors/jetbrains/default.nix b/pkgs/applications/editors/jetbrains/default.nix
index cb356d67d15f..b78da5da3f1d 100644
--- a/pkgs/applications/editors/jetbrains/default.nix
+++ b/pkgs/applications/editors/jetbrains/default.nix
@@ -77,8 +77,6 @@ let
             --replace-needed libcrypto.so.10 libcrypto.so
 
           autoPatchelf $PWD/bin
-          wrapProgram $out/bin/clion \
-            --set CL_JDK "${jdk}"
         )
       '';
     });
diff --git a/pkgs/applications/editors/jetbrains/linux.nix b/pkgs/applications/editors/jetbrains/linux.nix
index eaaa3c4adedc..1c00e408aeac 100644
--- a/pkgs/applications/editors/jetbrains/linux.nix
+++ b/pkgs/applications/editors/jetbrains/linux.nix
@@ -71,6 +71,8 @@ with stdenv; lib.makeOverridable mkDerivation (rec {
     }
 
     rm -rf jbr
+    # When using the IDE as a remote backend using gateway, it expects the jbr directory to contain the jdk
+    ln -s ${jdk.home} jbr
 
     interpreter=$(echo ${stdenv.cc.libc}/lib/ld-linux*.so.2)
     if [[ "${stdenv.hostPlatform.system}" == "x86_64-linux" && -e bin/fsnotifier64 ]]; then
diff --git a/pkgs/applications/emulators/vbam/default.nix b/pkgs/applications/emulators/vbam/default.nix
index acf7b26d9478..2b252f0f10de 100644
--- a/pkgs/applications/emulators/vbam/default.nix
+++ b/pkgs/applications/emulators/vbam/default.nix
@@ -18,12 +18,12 @@
 
 stdenv.mkDerivation rec {
   pname = "visualboyadvance-m";
-  version = "2.1.5";
+  version = "2.1.6";
   src = fetchFromGitHub {
     owner = "visualboyadvance-m";
     repo = "visualboyadvance-m";
     rev = "v${version}";
-    sha256 = "1sc3gdn7dqkipjsvlzchgd98mia9ic11169dw8v341vr9ppb1b6m";
+    sha256 = "1fph8phbswq6d9lgw1y1767wdp316w5hn5bws6h2dj75gvsqf221";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
@@ -43,13 +43,6 @@ stdenv.mkDerivation rec {
     gtk3
   ];
 
-  patches = [
-    (fetchpatch {
-      url = "https://github.com/visualboyadvance-m/visualboyadvance-m/commit/1d7e8ae4edc53a3380dfea88329b8b8337db1c52.patch";
-      sha256 = "sha256-SV1waz2JSKiM6itwkqwlE3aOZCcOl8iyBr06tyYlefo=";
-    })
-  ];
-
   cmakeFlags = [
     "-DCMAKE_BUILD_TYPE='Release'"
     "-DENABLE_FFMPEG='true'"
diff --git a/pkgs/applications/graphics/darktable/default.nix b/pkgs/applications/graphics/darktable/default.nix
index 8488e4c6d153..1a7427772672 100644
--- a/pkgs/applications/graphics/darktable/default.nix
+++ b/pkgs/applications/graphics/darktable/default.nix
@@ -58,12 +58,12 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "4.4.0";
+  version = "4.4.1";
   pname = "darktable";
 
   src = fetchurl {
     url = "https://github.com/darktable-org/darktable/releases/download/release-${version}/darktable-${version}.tar.xz";
-    sha256 = "8887fc34abd97c4998b0888c3197e0c509d63bdeab2238906915319811f3b080";
+    sha256 = "e043d38d2e8adb67af7690b12b535a40e8ec7bea05cfa8684db8b21a626e0f0d";
   };
 
   nativeBuildInputs = [ cmake ninja llvm_13 pkg-config intltool perl desktop-file-utils wrapGAppsHook ];
@@ -147,6 +147,6 @@ stdenv.mkDerivation rec {
     homepage = "https://www.darktable.org";
     license = licenses.gpl3Plus;
     platforms = platforms.linux ++ platforms.darwin;
-    maintainers = with maintainers; [ goibhniu flosse mrVanDalo paperdigits ];
+    maintainers = with maintainers; [ goibhniu flosse mrVanDalo paperdigits freyacodes ];
   };
 }
diff --git a/pkgs/applications/graphics/komorebi/default.nix b/pkgs/applications/graphics/komorebi/default.nix
new file mode 100644
index 000000000000..2d099b5eb7c9
--- /dev/null
+++ b/pkgs/applications/graphics/komorebi/default.nix
@@ -0,0 +1,56 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, meson
+, vala
+, pkg-config
+, glib
+, gtk3
+, libgee
+, webkitgtk
+, clutter-gtk
+, clutter-gst
+, ninja
+, wrapGAppsHook
+, testers
+, komorebi
+}:
+
+stdenv.mkDerivation rec {
+  pname = "komorebi";
+  version = "2.2.1";
+
+  src = fetchFromGitHub {
+    owner = "Komorebi-Fork";
+    repo = "komorebi";
+    rev = "v${version}";
+    hash = "sha256-vER69dSxu4JuWNAADpkxHE/zjOMhQp+Fc21J+JHQ8xk=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    vala
+    pkg-config
+    ninja
+    wrapGAppsHook
+  ];
+
+  buildInputs = [
+    glib
+    gtk3
+    libgee
+    webkitgtk
+    clutter-gtk
+    clutter-gst
+  ];
+
+  passthru.tests.version = testers.testVersion { package = komorebi; };
+
+  meta = with lib; {
+    description = "A beautiful and customizable wallpaper manager for Linux";
+    homepage = "https://github.com/Komorebi-Fork/komorebi";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ kranzes ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 17141a50582c..2e5c2398dffd 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -28,13 +28,13 @@
     "vendorHash": "sha256-jK7JuARpoxq7hvq5+vTtUwcYot0YqlOZdtDwq4IqKvk="
   },
   "aiven": {
-    "hash": "sha256-rmXfUMP1CWKV7ahxfmCr2FvWYcEWKh+V3fWSQWvcUDU=",
+    "hash": "sha256-T9d1iMuFqewDVK4EOsF4uCsqZAsThMHaRa7ilGnYXCo=",
     "homepage": "https://registry.terraform.io/providers/aiven/aiven",
     "owner": "aiven",
     "repo": "terraform-provider-aiven",
-    "rev": "v4.6.0",
+    "rev": "v4.7.0",
     "spdx": "MIT",
-    "vendorHash": "sha256-oUUl7m7+r10xSklrcsTYOU8wk8n7TLu6Qt50wTKLULk="
+    "vendorHash": "sha256-Fcu4RWgbVyAUr72h8q91HT+LbUh9+4SPDz8Vc4/u5RM="
   },
   "akamai": {
     "hash": "sha256-gQZ5yH3sV5DTpSE+/bZM12+PHitmUm/TtpAdPijF+Lk=",
@@ -110,29 +110,29 @@
     "vendorHash": null
   },
   "aws": {
-    "hash": "sha256-LFOlSmsnV7opt9Z3b15Lyi8sFYjx2WkvvB8vpJBjfWQ=",
+    "hash": "sha256-VDet4IGyd0RXCzlQ+s08QwX9eby5oYfwq2eVRfSS9ME=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/aws",
     "owner": "hashicorp",
     "repo": "terraform-provider-aws",
-    "rev": "v5.7.0",
+    "rev": "v5.8.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-x8f1sTVB1FaoPKgTGEoZaNVKCpNbTrQ7F0PVfwEWe/I="
+    "vendorHash": "sha256-oNPWz/0jcSL0FYuIW9wnj8Jp94vm9dJdiC9gfhtbQiU="
   },
   "azuread": {
-    "hash": "sha256-wBNS2a6O1QJgssbAWhSRSfxaVZ35zgT/qNdpE++NQ8U=",
+    "hash": "sha256-6LSvqMi79HW1GdEG0lSVwLF2nWft/JnKyj9EQO4pMW4=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/azuread",
     "owner": "hashicorp",
     "repo": "terraform-provider-azuread",
-    "rev": "v2.39.0",
+    "rev": "v2.40.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
   "azurerm": {
-    "hash": "sha256-PwAwVpLoMq5DNIiY5wt+n9oqNGInJ+C0JfiFagtrAEA=",
+    "hash": "sha256-4cJal4GrL8OwoFNMjN0AKlicq2mC0ba3N8bYISMaY3A=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/azurerm",
     "owner": "hashicorp",
     "repo": "terraform-provider-azurerm",
-    "rev": "v3.64.0",
+    "rev": "v3.65.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -182,13 +182,13 @@
     "vendorHash": "sha256-/dOiXO2aPkuZaFiwv/6AXJdIADgx8T7eOwvJfBBoqg8="
   },
   "buildkite": {
-    "hash": "sha256-yxL08Eysj/w9uLmuqDKx1ZcYQZSy91pDgR84BdpsF88=",
+    "hash": "sha256-1cKRsOuwYu3DV8uArrrf1hJdJ+C54D2awKmJm5ECEG4=",
     "homepage": "https://registry.terraform.io/providers/buildkite/buildkite",
     "owner": "buildkite",
     "repo": "terraform-provider-buildkite",
-    "rev": "v0.19.2",
+    "rev": "v0.20.0",
     "spdx": "MIT",
-    "vendorHash": "sha256-AJcPxiuglHpsHUIa5sJMtY7MRN5JrW/tfkz3+5Bv9AU="
+    "vendorHash": "sha256-QJ8bZU6K0UAduUjFmyGHjsaHm2e5U8rlPqlK6xM8m3I="
   },
   "checkly": {
     "hash": "sha256-UXIni594P85sgS8XVLoJ0+UTBeUS0XC+oj98KJUfghg=",
@@ -445,22 +445,22 @@
     "vendorHash": "sha256-XgGNz+yP+spRA2+qFxwiZFcBRv2GQWhiYY9zoC8rZPc="
   },
   "google": {
-    "hash": "sha256-2c50Ul57IeI7NzH0qYRIw8aKoB/5edCEsurc7JcojgQ=",
+    "hash": "sha256-FlBTLc3QUsPAO1OIr8aOlb7ppePsAjtKKrBOTS+JYFI=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/google",
     "owner": "hashicorp",
     "proxyVendor": true,
     "repo": "terraform-provider-google",
-    "rev": "v4.73.0",
+    "rev": "v4.73.1",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-X+7UZM0iZzG7LvaK6nKXF3taKIiJfhWRmY1q1Uz9M4A="
   },
   "google-beta": {
-    "hash": "sha256-2fiwPrmd/PHFNksfpo/TQQsuFz7RttAea5C8LJTrMAg=",
+    "hash": "sha256-GYX0tmNut04NbpqbfXCy/5Rabn3leWf1VH+yGHTsCek=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/google-beta",
     "owner": "hashicorp",
     "proxyVendor": true,
     "repo": "terraform-provider-google-beta",
-    "rev": "v4.73.0",
+    "rev": "v4.73.1",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-X+7UZM0iZzG7LvaK6nKXF3taKIiJfhWRmY1q1Uz9M4A="
   },
@@ -700,11 +700,11 @@
     "vendorHash": "sha256-ZjS40Xc8y2UBPn4rX3EgRoSapRvMEeVMGZE6z9tpsAQ="
   },
   "lxd": {
-    "hash": "sha256-qJp/RekJBsXx5Ic6J6CKs/oBcyqHB/sSjpzjAZUf2iE=",
+    "hash": "sha256-mZ2ptpgpyNXZAS19MVxOq3cfmSjTJvTP60fbpEgk6kE=",
     "homepage": "https://registry.terraform.io/providers/terraform-lxd/lxd",
     "owner": "terraform-lxd",
     "repo": "terraform-provider-lxd",
-    "rev": "v1.10.0",
+    "rev": "v1.10.1",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-zGVatrMqYsbGahEGJ/Gt9ub76R49m7RbLLs2XeKwQJw="
   },
@@ -745,13 +745,13 @@
     "vendorHash": "sha256-4OVNcAG+/JhVQX4eW5jUkrJeIPPZatq3SvQERdRPtl0="
   },
   "mongodbatlas": {
-    "hash": "sha256-z/bRdyXrjMn98DtQAnEuuJX4dr3SItbOQlvST/p7jCY=",
+    "hash": "sha256-vhzidHQzWrLQ2fGZ0A7aGKwvrqWi6GJ3JCdoCX/dZkc=",
     "homepage": "https://registry.terraform.io/providers/mongodb/mongodbatlas",
     "owner": "mongodb",
     "repo": "terraform-provider-mongodbatlas",
-    "rev": "v1.10.0",
+    "rev": "v1.10.1",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-QSRo/lloloaUtGTv8fauO+6biroTlIteM1KsadvFZtg="
+    "vendorHash": "sha256-7wrN2BoFY0I9dV52x9LJ43PgUSOVnhJULm1EY+LEZOI="
   },
   "namecheap": {
     "hash": "sha256-cms8YUL+SjTeYyIOQibksi8ZHEBYq2JlgTEpOO1uMZE=",
@@ -863,20 +863,20 @@
     "vendorHash": "sha256-NnB8deqIeiB66Kba9LWT62fyI23HL57VcsTickoTRwI="
   },
   "opentelekomcloud": {
-    "hash": "sha256-VPXuM1w6A/dNJcdpEQsi9wmp93urJclWN5jLMBme9h8=",
+    "hash": "sha256-SM6WG7igvFlIbi5AYj/1JXxjbpGgBkz2dKUnR4ZjQb8=",
     "homepage": "https://registry.terraform.io/providers/opentelekomcloud/opentelekomcloud",
     "owner": "opentelekomcloud",
     "repo": "terraform-provider-opentelekomcloud",
-    "rev": "v1.35.2",
+    "rev": "v1.35.3",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-TKYKKw6Mrq7hhM+at9VAiVxIpjYeg7AmEIEzfDIJA5M="
+    "vendorHash": "sha256-zlviJb2EYw/9NiD64xLFY8cd4H9Nb63tSbBUzFhW8Qo="
   },
   "opsgenie": {
-    "hash": "sha256-3W53oONyPoXSp7fnB2EG512rBXac07nGVevdZ9gezig=",
+    "hash": "sha256-fZidZFpusgO1PTXArsxn/omo+DC1nfVu6649BvBzj+k=",
     "homepage": "https://registry.terraform.io/providers/opsgenie/opsgenie",
     "owner": "opsgenie",
     "repo": "terraform-provider-opsgenie",
-    "rev": "v0.6.27",
+    "rev": "v0.6.28",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -971,13 +971,13 @@
     "vendorHash": null
   },
   "scaleway": {
-    "hash": "sha256-coscd4w+x7+Klp4j1Wb9z092WqWUhZTnREEq+RdgFLw=",
+    "hash": "sha256-AA9ctS5YQ36mvxfXSU77rfOWL5UXynVN+TUjpjBR40I=",
     "homepage": "https://registry.terraform.io/providers/scaleway/scaleway",
     "owner": "scaleway",
     "repo": "terraform-provider-scaleway",
-    "rev": "v2.23.0",
+    "rev": "v2.24.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-8MjVOibZuPlZHP3fIIcr17Siz0VAZ5SX8TUpj5L/YXc="
+    "vendorHash": "sha256-g/hNdUharGRTOIJZMk8lRAwO9PdMAbwJYTNcxTpfaV0="
   },
   "secret": {
     "hash": "sha256-MmAnA/4SAPqLY/gYcJSTnEttQTsDd2kEdkQjQj6Bb+A=",
@@ -1261,12 +1261,12 @@
     "vendorHash": "sha256-itSr5HHjus6G0t5/KFs0sNiredH9m3JnQ3siLtm+NHs="
   },
   "yandex": {
-    "hash": "sha256-FsbwylRyUFDZ9n40D36bnchYCax9hKyDLTPF7UV85y4=",
+    "hash": "sha256-03lZMLD2Iq9o9ijvMD7JNnaGNdn5OpB/s3509YdYRfQ=",
     "homepage": "https://registry.terraform.io/providers/yandex-cloud/yandex",
     "owner": "yandex-cloud",
     "repo": "terraform-provider-yandex",
-    "rev": "v0.94.0",
+    "rev": "v0.95.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-/HrijkUpJmeCjk6SCH2TE9MThjnimskOjztzRygd5fE="
+    "vendorHash": "sha256-IdRgtPUAYYR55MiT/2wqGzYhuMfThUmhnGGYoPQlHW0="
   }
 }
diff --git a/pkgs/applications/networking/instant-messengers/webcord/default.nix b/pkgs/applications/networking/instant-messengers/webcord/default.nix
index 67e99f540b1d..00361a7e368a 100644
--- a/pkgs/applications/networking/instant-messengers/webcord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/webcord/default.nix
@@ -1,18 +1,28 @@
-{ lib, stdenv, buildNpmPackage, fetchFromGitHub, copyDesktopItems
-, python3, pipewire, libpulseaudio, xdg-utils, electron_24, makeDesktopItem }:
+{ lib
+, buildNpmPackage
+, fetchFromGitHub
+, copyDesktopItems
+, python3
+, pipewire
+, libpulseaudio
+, xdg-utils
+, electron_25
+, makeDesktopItem
+, nix-update-script
+}:
 
 buildNpmPackage rec {
   pname = "webcord";
-  version = "4.2.0";
+  version = "4.3.0";
 
   src = fetchFromGitHub {
     owner = "SpacingBat3";
     repo = "WebCord";
     rev = "v${version}";
-    sha256 = "sha256-530iWNvehImwSYt5HnZaqa4TAslrwxAOZi3gRm1K2/w=";
+    hash = "sha256-E/WXAVSCNTDEDaz71LXOHUf/APFO2uSpkTRhlZfQp0E=";
   };
 
-  npmDepsHash = "sha256-YguZtGn8CT4EqOQWS0GeNGBdZSC3Lj1gFR0ZiegWTJU=";
+  npmDepsHash = "sha256-vGaYjM13seVmRbVPyDIM+qhGTCj6rw/el6Dq3KMzDks=";
 
   nativeBuildInputs = [
     copyDesktopItems
@@ -46,7 +56,7 @@ buildNpmPackage rec {
     install -Dm644 sources/assets/icons/app.png $out/share/icons/hicolor/256x256/apps/webcord.png
 
     # Add xdg-utils to path via suffix, per PR #181171
-    makeWrapper '${electron_24}/bin/electron' $out/bin/webcord \
+    makeWrapper '${electron_25}/bin/electron' $out/bin/webcord \
       --prefix LD_LIBRARY_PATH : ${libPath}:$out/opt/webcord \
       --suffix PATH : "${lib.makeBinPath [ xdg-utils ]}" \
       --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform=wayland}}" \
@@ -66,6 +76,8 @@ buildNpmPackage rec {
     })
   ];
 
+  passthru.updateScript = nix-update-script { };
+
   meta = with lib; {
     description = "A Discord and Fosscord electron-based client implemented without Discord API";
     homepage = "https://github.com/SpacingBat3/WebCord";
@@ -73,6 +85,6 @@ buildNpmPackage rec {
     changelog = "https://github.com/SpacingBat3/WebCord/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ huantian ];
-    platforms = electron_24.meta.platforms;
+    platforms = electron_25.meta.platforms;
   };
 }
diff --git a/pkgs/applications/networking/instant-messengers/webcord/webcord-vencord/default.nix b/pkgs/applications/networking/instant-messengers/webcord/webcord-vencord/default.nix
index 1bac19630fc0..d55af49f1154 100644
--- a/pkgs/applications/networking/instant-messengers/webcord/webcord-vencord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/webcord/webcord-vencord/default.nix
@@ -2,8 +2,10 @@
 , substituteAll
 , lib
 , vencord-web-extension
+, electron_24
 }:
-webcord.overrideAttrs (old: {
+
+(webcord.overrideAttrs (old: {
   patches = (old.patches or [ ]) ++ [
     (substituteAll {
       src = ./add-extension.patch;
@@ -15,4 +17,8 @@ webcord.overrideAttrs (old: {
     description = "Webcord with Vencord web extension";
     maintainers = with maintainers; [ FlafyDev NotAShelf ];
   };
-})
+})).override {
+  # Webcord has updated to electron 25, but that causes a segfault
+  # when launching webcord-vencord on wayland, so downgrade it for now.
+  electron_25 = electron_24;
+}
diff --git a/pkgs/applications/networking/irc/weechat/scripts/multiline/default.nix b/pkgs/applications/networking/irc/weechat/scripts/multiline/default.nix
index 447d415c163c..f61b4391e18d 100644
--- a/pkgs/applications/networking/irc/weechat/scripts/multiline/default.nix
+++ b/pkgs/applications/networking/irc/weechat/scripts/multiline/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation {
   pname = "multiline";
-  version = "0.6.3";
+  version = "0.6.4";
 
   src = fetchurl {
-    url = "https://raw.githubusercontent.com/weechat/scripts/945315bed4bc2beaf1e47f9b946ffe8f638f77fe/perl/multiline.pl";
-    sha256 = "1smialb21ny7brhij4sbw46xvsmrdv6ig2da0ip63ga2afngwsy4";
+    url = "https://raw.githubusercontent.com/weechat/scripts/5f073d966e98d54344a91be4f5afc0ec9e2697dc/perl/multiline.pl";
+    sha256 = "sha256-TXbU2Q7Tm8iTwOQqrWpqHXuKrjoBFLyUWRsH+TsR9Lo=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/applications/version-management/gex/default.nix b/pkgs/applications/version-management/gex/default.nix
index 7bb39ef94e7f..4675b22a6192 100644
--- a/pkgs/applications/version-management/gex/default.nix
+++ b/pkgs/applications/version-management/gex/default.nix
@@ -8,24 +8,25 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "gex";
-  version = "0.4.0";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "Piturnah";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-eRforLvRVSrFWnI5UZEWr1L4UM3ABjAIvui1E1hzk5s=";
+    hash = "sha256-//sQ0s8bBQzuu5aO3RjPRjFuVYiGW6BwSPoCWKAx9DQ=";
   };
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ libgit2 ];
 
-  cargoHash = "sha256-OEaNERozmJL8gYe33V/m4HQNHi2I4KHpI6PTwFQkPSs=";
+  cargoHash = "sha256-rkhkFnRDtMTWFM+E5C4jR7TWtHdy3WUtIzvGDDLHqtE=";
 
   meta = with lib; {
     description = "Git Explorer: cross-platform git workflow improvement tool inspired by Magit";
     homepage = "https://github.com/Piturnah/gex";
+    changelog = "https://github.com/Piturnah/gex/releases/tag/${src.rev}";
     license = with licenses; [ asl20 /* or */ mit ];
-    maintainers = with maintainers; [ azd325 Br1ght0ne ];
+    maintainers = with maintainers; [ azd325 evanrichter piturnah ];
   };
 }
diff --git a/pkgs/applications/video/obs-studio/plugins/advanced-scene-switcher/default.nix b/pkgs/applications/video/obs-studio/plugins/advanced-scene-switcher/default.nix
index 428f5167907b..f2df05ceca30 100644
--- a/pkgs/applications/video/obs-studio/plugins/advanced-scene-switcher/default.nix
+++ b/pkgs/applications/video/obs-studio/plugins/advanced-scene-switcher/default.nix
@@ -44,6 +44,7 @@ stdenv.mkDerivation rec {
 
   postUnpack = ''
     cp -r ${libremidi.src}/* $sourceRoot/deps/libremidi
+    chmod -R +w $sourceRoot/deps/libremidi
   '';
 
   postInstall = ''
diff --git a/pkgs/data/fonts/iosevka/default.nix b/pkgs/data/fonts/iosevka/default.nix
index 1e92a49a96ba..47081a05a062 100644
--- a/pkgs/data/fonts/iosevka/default.nix
+++ b/pkgs/data/fonts/iosevka/default.nix
@@ -55,16 +55,16 @@ assert (extraParameters != null) -> set != null;
 
 buildNpmPackage rec {
   pname = if set != null then "iosevka-${set}" else "iosevka";
-  version = "24.1.4";
+  version = "25.0.1";
 
   src = fetchFromGitHub {
     owner = "be5invis";
     repo = "iosevka";
     rev = "v${version}";
-    hash = "sha256-+b+13D6dKHx9kvAKeN/ePcWGtDPpFB/dVwHTTprw7Co=";
+    hash = "sha256-clbqr4hGtIkbgPYovYXHGW+FUTEjAn3Oq7aoPFMgGJU=";
   };
 
-  npmDepsHash = "sha256-+LZQY64SdcEx+Mqb5qGelC7zbXdStJkDvcFWgUVTDnE=";
+  npmDepsHash = "sha256-TxMmUgwQPbSV+1qe0FEtSPAYwJRnpuQ+qOmWvrq9xKY=";
 
   nativeBuildInputs = [
     remarshal
diff --git a/pkgs/development/compilers/gcc/11/default.nix b/pkgs/development/compilers/gcc/11/default.nix
index f61e51e2cabe..92abdebe49b3 100644
--- a/pkgs/development/compilers/gcc/11/default.nix
+++ b/pkgs/development/compilers/gcc/11/default.nix
@@ -176,7 +176,8 @@ lib.pipe (stdenv.mkDerivation ({
 
   libc_dev = stdenv.cc.libc_dev;
 
-  hardeningDisable = [ "format" "pie" ];
+  hardeningDisable = [ "format" "pie" ]
+    ++ optional langAda "fortify3";
 
   postPatch = ''
     configureScripts=$(find . -name configure)
diff --git a/pkgs/development/compilers/pforth/default.nix b/pkgs/development/compilers/pforth/default.nix
index 59994b26aeed..d0766fe13768 100644
--- a/pkgs/development/compilers/pforth/default.nix
+++ b/pkgs/development/compilers/pforth/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, buildPackages
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -14,14 +15,26 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-vEjFeHSJl+yAtatYJEnu+r9hmOr/kZOgIbSUXR/c8WU=";
   };
 
-  dontConfigure = true;
-
-  preBuild = ''
-    cd platforms/unix
+  # We build the dictionary in a cross-compile compatible way.
+  # For that, we perform steps, that the Makefile would otherwise do.
+  buildPhase = ''
+    runHook preBuild
+    make -C platforms/unix pfdicapp
+    pushd fth/
+    ${stdenv.hostPlatform.emulator buildPackages} ../platforms/unix/pforth -i system.fth
+    ${stdenv.hostPlatform.emulator buildPackages} ../platforms/unix/pforth -d pforth.dic <<< "include savedicd.fth sdad bye"
+    mv pforth.dic pfdicdat.h ../platforms/unix/
+    popd
+    make -C platforms/unix pforthapp
+    runHook postBuild
   '';
 
   installPhase = ''
-    install -Dm755 pforth_standalone $out/bin/pforth
+    runHook preInstall
+    install -Dm755 platforms/unix/pforth_standalone $out/bin/pforth
+    mkdir -p $out/share/pforth
+    cp -r fth/* $out/share/pforth/
+    runHook postInstall
   '';
 
   meta = {
diff --git a/pkgs/development/libraries/libremidi/default.nix b/pkgs/development/libraries/libremidi/default.nix
index 63a7f0ce5287..d88ebeea3fb5 100644
--- a/pkgs/development/libraries/libremidi/default.nix
+++ b/pkgs/development/libraries/libremidi/default.nix
@@ -9,15 +9,15 @@
 , stdenv
 }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
   pname = "libremidi";
-  version = "unstable-2023-05-05";
+  version = "3.0";
 
   src = fetchFromGitHub {
     owner = "jcelerier";
     repo = "libremidi";
-    rev = "cd2e52d59c8ecc97d751619072c4f4271fa82455";
-    hash = "sha256-CydoCprxqDl5FXjtgT+AckaRTqQAlCDwwrnPDK17A6o=";
+    rev = "v${version}";
+    hash = "sha256-aO83a0DmzwjYXDlPIsn136EkDF0406HadTXPoGuVF6I=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/python-modules/androidtvremote2/default.nix b/pkgs/development/python-modules/androidtvremote2/default.nix
index 8cbf32a6bd6e..a876cf5e1813 100644
--- a/pkgs/development/python-modules/androidtvremote2/default.nix
+++ b/pkgs/development/python-modules/androidtvremote2/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "androidtvremote2";
-  version = "0.0.10";
+  version = "0.0.11";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "tronikos";
     repo = "androidtvremote2";
     rev = "refs/tags/v${version}";
-    hash = "sha256-LjYXQTPTFS80gI3WeJOLrKZ0C0JhGb5p1M70P7n29hc=";
+    hash = "sha256-mjhohkAC6g2UJgPbq/29Awyy6c4M8SnLqr5v5g7+IeE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/before-after/default.nix b/pkgs/development/python-modules/before-after/default.nix
new file mode 100644
index 000000000000..919914d7fd7a
--- /dev/null
+++ b/pkgs/development/python-modules/before-after/default.nix
@@ -0,0 +1,35 @@
+{ buildPythonPackage, fetchPypi, fetchpatch, pytestCheckHook, lib }:
+
+buildPythonPackage rec {
+  pname = "before-after";
+  version = "1.0.1";
+
+  src = fetchPypi {
+    pname = "before_after";
+    inherit version;
+    hash = "sha256-x9T5uLi7UgldoUxLnFnqaz9bnqn9zop7/HLsrg9aP4U=";
+  };
+
+  patches = [
+    # drop 'mock' dependency for python >=3.3
+    (fetchpatch {
+      url = "https://github.com/c-oreills/before_after/commit/cf3925148782c8c290692883d1215ae4d2c35c3c.diff";
+      hash = "sha256-FYCpLxcOLolNPiKzHlgrArCK/QKCwzag+G74wGhK4dc=";
+    })
+    (fetchpatch {
+      url = "https://github.com/c-oreills/before_after/commit/11c0ecc7e8a2f90a762831e216c1bc40abfda43a.diff";
+      hash = "sha256-8YJumF/U8H+hc7rLZLy3UhXHdYJmcuN+O8kMx8yqMJ0=";
+    })
+  ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "before_after" ];
+
+  meta = with lib; {
+    description = "sugar over the Mock library to help test race conditions";
+    homepage = "https://github.com/c-oreills/before_after";
+    maintainers = with maintainers; [ yuka ];
+    license = licenses.gpl2Only;
+  };
+}
diff --git a/pkgs/development/python-modules/devolo-plc-api/default.nix b/pkgs/development/python-modules/devolo-plc-api/default.nix
index 8170601914a5..d352925308cb 100644
--- a/pkgs/development/python-modules/devolo-plc-api/default.nix
+++ b/pkgs/development/python-modules/devolo-plc-api/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "devolo-plc-api";
-  version = "1.3.1";
+  version = "1.3.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "2Fake";
     repo = "devolo_plc_api";
     rev = "refs/tags/v${version}";
-    hash = "sha256-wJyBCQ9rk+UwjWhMIeqsIbMR8cXA9Xu+lmubJoOauEg=";
+    hash = "sha256-viOyxgFydPrTPFz6JsjJT6IiUIeoIwd+bcrAJfomDI8=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/django-cacheops/default.nix b/pkgs/development/python-modules/django-cacheops/default.nix
index 971a65eeb1d5..f7ce71a84f64 100644
--- a/pkgs/development/python-modules/django-cacheops/default.nix
+++ b/pkgs/development/python-modules/django-cacheops/default.nix
@@ -1,27 +1,40 @@
-{ lib
+{ stdenv
+, lib
 , buildPythonPackage
 , fetchPypi
+, pythonRelaxDepsHook
 , django
 , funcy
 , redis
-, pytest-django
-, pytestCheckHook
-, pythonOlder
 , six
+, pytestCheckHook
+, pytest-django
+, mock
+, dill
+, jinja2
+, before-after
+, pythonOlder
+, nettools
+, pkgs
 }:
 
 buildPythonPackage rec {
   pname = "django-cacheops";
-  version = "6.2";
+  version = "7.0.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-zHP9ChwUeZJT/yCopFeRo8jSgCIXswHnDPoIroGeQ48=";
+    hash = "sha256-Ed3qh90DlWiXikCD2JyJ37hm6lWnpI+2haaPwZiotlA=";
   };
 
+  nativeBuildInputs = [
+    pythonRelaxDepsHook
+  ];
+  pythonRelaxDeps = [ "funcy" ];
+
   propagatedBuildInputs = [
     django
     funcy
@@ -32,23 +45,21 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     pytestCheckHook
     pytest-django
+    mock
+    dill
+    jinja2
+    before-after
+    nettools
+    pkgs.redis
   ];
 
-  disabledTests = [
-    # Tests require networking
-    "test_cached_as"
-    "test_invalidation_signal"
-    "test_queryset"
-    "test_queryset_empty"
-    "test_lock"
-    "test_context_manager"
-    "test_decorator"
-    "test_in_transaction"
-    "test_nested"
-    "test_unhashable_args"
-    "test_db_agnostic_by_default"
-    "test_db_agnostic_disabled"
-  ];
+  preCheck = ''
+    redis-server &
+    while ! redis-cli --scan ; do
+      echo waiting for redis to be ready
+      sleep 1
+    done
+  '';
 
   DJANGO_SETTINGS_MODULE = "tests.settings";
 
@@ -58,8 +69,7 @@ buildPythonPackage rec {
     changelog = "https://github.com/Suor/django-cacheops/blob/${version}/CHANGELOG";
     license = licenses.bsd3;
     maintainers = with maintainers; [ onny ];
-    # No support for funcy > 2
-    # https://github.com/Suor/django-cacheops/issues/454
-    broken = true;
+    # Times out for unknown reasons
+    broken = stdenv.isDarwin;
   };
 }
diff --git a/pkgs/development/python-modules/google-cloud-pubsub/default.nix b/pkgs/development/python-modules/google-cloud-pubsub/default.nix
index 3a94d6d7ef29..6472f1fc32fa 100644
--- a/pkgs/development/python-modules/google-cloud-pubsub/default.nix
+++ b/pkgs/development/python-modules/google-cloud-pubsub/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-pubsub";
-  version = "2.17.1";
+  version = "2.18.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-BZNCjsuwJJy150G0A+lcPUIbRpfIPrftTBaE3/F2x1M=";
+    hash = "sha256-enDfQRHZy2lKJc7N0jKIJxWcUhOuHmMEyzq7OPN53Sk=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/maxminddb/default.nix b/pkgs/development/python-modules/maxminddb/default.nix
index b9ff8bf437bb..90acdef2d363 100644
--- a/pkgs/development/python-modules/maxminddb/default.nix
+++ b/pkgs/development/python-modules/maxminddb/default.nix
@@ -1,34 +1,40 @@
-{ stdenv
-, lib
+{ lib
+, stdenv
 , buildPythonPackage
-, pythonOlder
-, pythonAtLeast
 , fetchPypi
 , libmaxminddb
-, mock
-, nose
+, pytestCheckHook
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "maxminddb";
-  version = "2.3.0";
-  disabled = pythonOlder "3.6";
+  version = "2.4.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-Egkg3d2VXzKuSMIHxs72/V3Ih0qIm6lLDywfc27N8wg=";
+    hash = "sha256-geVOU0CL1QJlDllpzLoWeAr2WewdscRLLJl+QzCl7ZY=";
   };
 
-  buildInputs = [ libmaxminddb ];
+  buildInputs = [
+    libmaxminddb
+  ];
 
-  nativeCheckInputs = [ nose mock ];
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
 
-  # Tests are broken for macOS on python38
-  doCheck = !(stdenv.isDarwin && pythonAtLeast "3.8");
+  pythonImportsCheck = [
+    "maxminddb"
+  ];
 
   meta = with lib; {
     description = "Reader for the MaxMind DB format";
     homepage = "https://github.com/maxmind/MaxMind-DB-Reader-python";
+    changelog = "https://github.com/maxmind/MaxMind-DB-Reader-python/blob/v${version}/HISTORY.rst";
     license = licenses.asl20;
     maintainers = with maintainers; [ ];
   };
diff --git a/pkgs/development/python-modules/metar/default.nix b/pkgs/development/python-modules/metar/default.nix
index dca7c5359a04..b130672810ec 100644
--- a/pkgs/development/python-modules/metar/default.nix
+++ b/pkgs/development/python-modules/metar/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "metar";
-  version = "1.10.0";
+  version = "1.11.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     owner = "python-metar";
     repo = "python-metar";
     rev = "refs/tags/v${version}";
-    hash = "sha256-53vgnViEYuMVKEnIZ2BNyIUrURR2rwopx7RWyFmF5PA=";
+    hash = "sha256-ZDjlXcSTUcSP7oRdhzLpXf/fLUA7Nkc6nj2I6vovbHg=";
   };
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/mypy-boto3-s3/default.nix b/pkgs/development/python-modules/mypy-boto3-s3/default.nix
index 628d0b322090..78f7f1acfda5 100644
--- a/pkgs/development/python-modules/mypy-boto3-s3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3-s3/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "mypy-boto3-s3";
-  version = "1.28.0";
+  version = "1.28.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-J4Z8oyWoRXAKAI8/yplQBrMvLg0Yr+Z2NStJRT9HfWk=";
+    hash = "sha256-wrRUQTEmB5pkNKPgWnXLTK2UfHYk5TujhGy4KaIjDEs=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/opower/default.nix b/pkgs/development/python-modules/opower/default.nix
index f6941970a08d..26342ab42db3 100644
--- a/pkgs/development/python-modules/opower/default.nix
+++ b/pkgs/development/python-modules/opower/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "opower";
-  version = "0.0.13";
+  version = "0.0.14";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "tronikos";
     repo = "opower";
     rev = "refs/tags/v${version}";
-    hash = "sha256-WZRJnvZYycOoLNhtShXQ3HPNqyoJymUx+Xwg5gPWGKg=";
+    hash = "sha256-eTlFb/v88jaEzx5H8ofHMNkqPunDvXcXGvg5ThripeA=";
   };
 
   pythonRemoveDeps = [
diff --git a/pkgs/development/python-modules/xarray-einstats/default.nix b/pkgs/development/python-modules/xarray-einstats/default.nix
index c795568149ea..78f7c101fd3f 100644
--- a/pkgs/development/python-modules/xarray-einstats/default.nix
+++ b/pkgs/development/python-modules/xarray-einstats/default.nix
@@ -14,16 +14,16 @@
 
 buildPythonPackage rec {
   pname = "xarray-einstats";
-  version = "0.5.1";
+  version = "0.6.0";
   format = "pyproject";
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.9";
 
   src = fetchFromGitHub {
     owner = "arviz-devs";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-oDrNR7iVDg7Piti6JNaXGekfrUfK5GWJYbH/g6m4570=";
+    hash = "sha256-TXuNqXsny7VpJqV5/3riKzXLheZl+qF+zf4SCMipzmw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/yalexs-ble/default.nix b/pkgs/development/python-modules/yalexs-ble/default.nix
index 4cf4906e09eb..2431a9101a5e 100644
--- a/pkgs/development/python-modules/yalexs-ble/default.nix
+++ b/pkgs/development/python-modules/yalexs-ble/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "yalexs-ble";
-  version = "2.1.18";
+  version = "2.2.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "bdraco";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-bLxKq/MNbVIv9CV67NeOqn49cYu7gwcBnbZEtlreQzQ=";
+    hash = "sha256-ei/+QfDjuzbKFZ8Nl+KnCJB6xu7xZh0m6LnzHUEg790=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/melange/default.nix b/pkgs/development/tools/melange/default.nix
new file mode 100644
index 000000000000..f5a5eb8ee85a
--- /dev/null
+++ b/pkgs/development/tools/melange/default.nix
@@ -0,0 +1,72 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, installShellFiles
+}:
+
+buildGoModule rec {
+  pname = "melange";
+  version = "0.4.0";
+
+  src = fetchFromGitHub {
+    owner = "chainguard-dev";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-sEmbfX7W1juymAxcWwDNxI8d/o7NS2S+0TJM6Vi9aQo=";
+    # populate values that require us to use git. By doing this in postFetch we
+    # can delete .git afterwards and maintain better reproducibility of the src.
+    leaveDotGit = true;
+    postFetch = ''
+      cd "$out"
+      git rev-parse HEAD > $out/COMMIT
+      # in format of 0000-00-00T00:00:00Z
+      date -u -d "@$(git log -1 --pretty=%ct)" "+%Y-%m-%dT%H:%M:%SZ" > $out/SOURCE_DATE_EPOCH
+      find "$out" -name .git -print0 | xargs -0 rm -rf
+    '';
+  };
+
+  vendorHash = "sha256-IkbXZu6iHRXjWFsLtRBDxwJio5sVVZvHylk1al0S+/c=";
+
+  subPackages = [ "." ];
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X sigs.k8s.io/release-utils/version.gitVersion=v${version}"
+    "-X sigs.k8s.io/release-utils/version.gitTreeState=clean"
+  ];
+
+  # ldflags based on metadata from git and source
+  preBuild = ''
+    ldflags+=" -X sigs.k8s.io/release-utils/version.gitCommit=$(cat COMMIT)"
+    ldflags+=" -X sigs.k8s.io/release-utils/version.buildDate=$(cat SOURCE_DATE_EPOCH)"
+  '';
+
+  postInstall = ''
+    installShellCompletion --cmd melange \
+      --bash <($out/bin/melange completion bash) \
+      --fish <($out/bin/melange completion fish) \
+      --zsh <($out/bin/melange completion zsh)
+  '';
+
+  doInstallCheck = true;
+
+  installCheckPhase = ''
+    runHook preInstallCheck
+
+    $out/bin/melange --help
+    $out/bin/melange version 2>&1 | grep "v${version}"
+
+    runHook postInstallCheck
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/chainguard-dev/melange";
+    changelog = "https://github.com/chainguard-dev/melange/blob/${src.rev}/NEWS.md";
+    description = "Build APKs from source code";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ developer-guy ];
+  };
+}
diff --git a/pkgs/development/tools/mold/default.nix b/pkgs/development/tools/mold/default.nix
index 04ed7db71147..ac60a01a1ae9 100644
--- a/pkgs/development/tools/mold/default.nix
+++ b/pkgs/development/tools/mold/default.nix
@@ -33,6 +33,10 @@ stdenv.mkDerivation rec {
     mimalloc
   ];
 
+  patches = [
+    ./fix-debug-strip.patch # fix --debug-strip; https://github.com/rui314/mold/pull/1038
+  ];
+
   postPatch = ''
     sed -i CMakeLists.txt -e '/.*set(DEST\ .*/d'
   '';
diff --git a/pkgs/development/tools/mold/fix-debug-strip.patch b/pkgs/development/tools/mold/fix-debug-strip.patch
new file mode 100644
index 000000000000..78906efc73ac
--- /dev/null
+++ b/pkgs/development/tools/mold/fix-debug-strip.patch
@@ -0,0 +1,23 @@
+From b699b73451c57ac01c2680c0b86e1f56ca19e51c Mon Sep 17 00:00:00 2001
+From: Jakub Konka <kubkon@jakubkonka.com>
+Date: Sat, 6 May 2023 07:55:46 +0200
+Subject: [PATCH] Fix handling of --debug-strip
+
+Signed-off-by: Jakub Konka <kubkon@jakubkonka.com>
+---
+ elf/cmdline.cc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/elf/cmdline.cc b/elf/cmdline.cc
+index 3ac19f237..731af63ab 100644
+--- a/elf/cmdline.cc
++++ b/elf/cmdline.cc
+@@ -994,7 +994,7 @@ std::vector<std::string> parse_nonpositional_args(Context<E> &ctx) {
+     } else if (read_flag("strip-all") || read_flag("s")) {
+       ctx.arg.strip_all = true;
+     } else if (read_flag("strip-debug") || read_flag("S")) {
+-      ctx.arg.strip_all = true;
++      ctx.arg.strip_debug = true;
+     } else if (read_flag("warn-unresolved-symbols")) {
+       ctx.arg.unresolved_symbols = UNRESOLVED_WARN;
+     } else if (read_flag("error-unresolved-symbols")) {
diff --git a/pkgs/development/tools/yarn2nix-moretea/yarn2nix/default.nix b/pkgs/development/tools/yarn2nix-moretea/yarn2nix/default.nix
index e0bd54fd11a9..914296d70953 100644
--- a/pkgs/development/tools/yarn2nix-moretea/yarn2nix/default.nix
+++ b/pkgs/development/tools/yarn2nix-moretea/yarn2nix/default.nix
@@ -71,7 +71,7 @@ in rec {
     yarnFlags ? [ ],
     ignoreScripts ? true,
     nodejs ? inputs.nodejs,
-    yarn ? inputs.yarn.override { nodejs = nodejs; },
+    yarn ? inputs.yarn.override { inherit nodejs; },
     pkgConfig ? {},
     preBuild ? "",
     postBuild ? "",
@@ -88,7 +88,7 @@ in rec {
           (key: pkgConfig.${key}.buildInputs or [])
           (builtins.attrNames pkgConfig);
 
-      postInstall = (builtins.map (key:
+      postInstall = builtins.map (key:
         if (pkgConfig.${key} ? postInstall) then
           ''
             for f in $(find -L -path '*/node_modules/${key}' -type d); do
@@ -97,7 +97,7 @@ in rec {
           ''
         else
           ""
-      ) (builtins.attrNames pkgConfig));
+      ) (builtins.attrNames pkgConfig);
 
       # build-time JSON generation to avoid IFD
       # see https://nixos.wiki/wiki/Import_From_Derivation
@@ -180,7 +180,7 @@ in rec {
     packageJSON ? src + "/package.json",
     yarnLock ? src + "/yarn.lock",
     nodejs ? inputs.nodejs,
-    yarn ? inputs.yarn.override { nodejs = nodejs; },
+    yarn ? inputs.yarn.override { inherit nodejs; },
     packageOverrides ? {},
     ...
   }@attrs:
@@ -254,7 +254,7 @@ in rec {
     yarnNix ? mkYarnNix { inherit yarnLock; },
     offlineCache ? importOfflineCache yarnNix,
     nodejs ? inputs.nodejs,
-    yarn ? inputs.yarn.override { nodejs = nodejs; },
+    yarn ? inputs.yarn.override { inherit nodejs; },
     yarnFlags ? [ ],
     yarnPreBuild ? "",
     yarnPostBuild ? "",
@@ -267,8 +267,8 @@ in rec {
   }@attrs:
     let
       package = lib.importJSON packageJSON;
-      pname = package.name;
-      safeName = reformatPackageName pname;
+      pname = attrs.pname or package.name;
+      safeName = reformatPackageName package.name;
       version = attrs.version or package.version;
       baseName = unlessNull name "${safeName}-${version}";
 
@@ -278,14 +278,15 @@ in rec {
       );
 
       deps = mkYarnModules {
+        pname = package.name;
         name = "${safeName}-modules-${version}";
         preBuild = yarnPreBuild;
         postBuild = yarnPostBuild;
         workspaceDependencies = workspaceDependenciesTransitive;
-        inherit packageJSON pname version yarnLock offlineCache nodejs yarn yarnFlags pkgConfig packageResolutions;
+        inherit packageJSON version yarnLock offlineCache nodejs yarn yarnFlags pkgConfig packageResolutions;
       };
 
-      publishBinsFor_ = unlessNull publishBinsFor [pname];
+      publishBinsFor_ = unlessNull publishBinsFor [ package.name ];
 
       linkDirFunction = ''
         linkDirToDirLinks() {
@@ -307,17 +308,17 @@ in rec {
       workspaceDependencyCopy = lib.concatMapStringsSep "\n"
         (dep: ''
           # ensure any existing scope directory is not a symlink
-          linkDirToDirLinks "$(dirname node_modules/${dep.pname})"
-          mkdir -p "deps/${dep.pname}"
-          tar -xf "${dep}/tarballs/${dep.name}.tgz" --directory "deps/${dep.pname}" --strip-components=1
-          if [ ! -e "deps/${dep.pname}/node_modules" ]; then
-            ln -s "${deps}/deps/${dep.pname}/node_modules" "deps/${dep.pname}/node_modules"
+          linkDirToDirLinks "$(dirname node_modules/${dep.package.name})"
+          mkdir -p "deps/${dep.package.name}"
+          tar -xf "${dep}/tarballs/${dep.name}.tgz" --directory "deps/${dep.package.name}" --strip-components=1
+          if [ ! -e "deps/${dep.package.name}/node_modules" ]; then
+            ln -s "${deps}/deps/${dep.package.name}/node_modules" "deps/${dep.package.name}/node_modules"
           fi
         '')
         workspaceDependenciesTransitive;
 
     in stdenv.mkDerivation (builtins.removeAttrs attrs ["yarnNix" "pkgConfig" "workspaceDependencies" "packageResolutions"] // {
-      inherit src version pname;
+      inherit pname version src;
 
       name = baseName;
 
@@ -335,27 +336,27 @@ in rec {
           fi
         done
 
-        # move convent of . to ./deps/${pname}
+        # move convent of . to ./deps/${package.name}
         mv $PWD $NIX_BUILD_TOP/temp
-        mkdir -p "$PWD/deps/${pname}"
-        rm -fd "$PWD/deps/${pname}"
-        mv $NIX_BUILD_TOP/temp "$PWD/deps/${pname}"
+        mkdir -p "$PWD/deps/${package.name}"
+        rm -fd "$PWD/deps/${package.name}"
+        mv $NIX_BUILD_TOP/temp "$PWD/deps/${package.name}"
         cd $PWD
 
-        ln -s ${deps}/deps/${pname}/node_modules "deps/${pname}/node_modules"
+        ln -s ${deps}/deps/${package.name}/node_modules "deps/${package.name}/node_modules"
 
         cp -r $node_modules node_modules
         chmod -R +w node_modules
 
         ${linkDirFunction}
 
-        linkDirToDirLinks "$(dirname node_modules/${pname})"
-        ln -s "deps/${pname}" "node_modules/${pname}"
+        linkDirToDirLinks "$(dirname node_modules/${package.name})"
+        ln -s "deps/${package.name}" "node_modules/${package.name}"
 
         ${workspaceDependencyCopy}
 
         # Help yarn commands run in other phases find the package
-        echo "--cwd deps/${pname}" > .yarnrc
+        echo "--cwd deps/${package.name}" > .yarnrc
         runHook postConfigure
       '';
 
@@ -364,11 +365,11 @@ in rec {
       installPhase = attrs.installPhase or ''
         runHook preInstall
 
-        mkdir -p $out/{bin,libexec/${pname}}
-        mv node_modules $out/libexec/${pname}/node_modules
-        mv deps $out/libexec/${pname}/deps
+        mkdir -p $out/{bin,libexec/${package.name}}
+        mv node_modules $out/libexec/${package.name}/node_modules
+        mv deps $out/libexec/${package.name}/deps
 
-        node ${./internal/fixup_bin.js} $out/bin $out/libexec/${pname}/node_modules ${lib.concatStringsSep " " publishBinsFor_}
+        node ${./internal/fixup_bin.js} $out/bin $out/libexec/${package.name}/node_modules ${lib.concatStringsSep " " publishBinsFor_}
 
         runHook postInstall
       '';
@@ -378,13 +379,13 @@ in rec {
       distPhase = attrs.distPhase or ''
         # pack command ignores cwd option
         rm -f .yarnrc
-        cd $out/libexec/${pname}/deps/${pname}
+        cd $out/libexec/${package.name}/deps/${package.name}
         mkdir -p $out/tarballs/
         yarn pack --offline --ignore-scripts --filename $out/tarballs/${baseName}.tgz
       '';
 
       passthru = {
-        inherit pname package packageJSON deps;
+        inherit package packageJSON deps;
         workspaceDependencies = workspaceDependenciesTransitive;
       } // (attrs.passthru or {});
 
@@ -403,7 +404,7 @@ in rec {
 
         mkFilter = { dirsToInclude, filesToInclude, root }: path: type:
           let
-            inherit (pkgs.lib) any flip elem hasSuffix hasPrefix elemAt splitString;
+            inherit (lib) elem elemAt splitString;
 
             subpath = elemAt (splitString "${toString root}/" path) 1;
             spdir = elemAt (splitString "/" subpath) 0;
diff --git a/pkgs/games/doom-ports/rbdoom-3-bfg/default.nix b/pkgs/games/doom-ports/rbdoom-3-bfg/default.nix
index a6588ef4cc64..c17adb72171f 100644
--- a/pkgs/games/doom-ports/rbdoom-3-bfg/default.nix
+++ b/pkgs/games/doom-ports/rbdoom-3-bfg/default.nix
@@ -59,6 +59,9 @@ stdenv.mkDerivation rec {
     "-DUSE_SYSTEM_ZLIB=ON"
   ];
 
+  # it caused build failure
+  hardeningDisable = [ "fortify3" ];
+
   installPhase = ''
     runHook preInstall
 
diff --git a/pkgs/games/gemrb/default.nix b/pkgs/games/gemrb/default.nix
index 66b6faa32552..7768ccf76253 100644
--- a/pkgs/games/gemrb/default.nix
+++ b/pkgs/games/gemrb/default.nix
@@ -27,13 +27,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "gemrb";
-  version = "0.9.1.1";
+  version = "0.9.2";
 
   src = fetchFromGitHub {
     owner = "gemrb";
     repo = "gemrb";
     rev = "v${version}";
-    hash = "sha256-pC83LgAy1aQxUhS2qa57hm03B37bj6dcRVRn7SI5I+k=";
+    hash = "sha256-riea48Jc9zYb19mf5sBunTp5l27PGRFd/B5KdCUWr6Y=";
   };
 
   buildInputs = [
diff --git a/pkgs/os-specific/linux/intel-compute-runtime/default.nix b/pkgs/os-specific/linux/intel-compute-runtime/default.nix
index 3dba3de332c2..5be94f22f5e2 100644
--- a/pkgs/os-specific/linux/intel-compute-runtime/default.nix
+++ b/pkgs/os-specific/linux/intel-compute-runtime/default.nix
@@ -35,6 +35,9 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "drivers" ];
 
+  # causes redefinition of _FORTIFY_SOURCE
+  hardeningDisable = [ "fortify3" ];
+
   postInstall = ''
     # Avoid clash with intel-ocl
     mv $out/etc/OpenCL/vendors/intel.icd $out/etc/OpenCL/vendors/intel-neo.icd
diff --git a/pkgs/servers/dendrite/default.nix b/pkgs/servers/dendrite/default.nix
index 67b91bbe5cd6..4faa08142cf5 100644
--- a/pkgs/servers/dendrite/default.nix
+++ b/pkgs/servers/dendrite/default.nix
@@ -3,16 +3,16 @@
 
 buildGoModule rec {
   pname = "matrix-dendrite";
-  version = "0.12.0";
+  version = "0.13.1";
 
   src = fetchFromGitHub {
     owner = "matrix-org";
     repo = "dendrite";
     rev = "v${version}";
-    hash = "sha256-syOLrw4ig8rmFDkxJ9KSAuzUVO8UokekV17mT1bJNNM=";
+    hash = "sha256-2DqEfTXD3W6MxfBb6aHaKH+zpxLc2tHaGuWGQuncySo=";
   };
 
-  vendorHash = "sha256-nvGhKCUiyHSD0VpE4OtT9YQSHxv0d7iwOChCJl2D3zk=";
+  vendorHash = "sha256-dc0zpKh7J+fi2b5GD/0BQ120UXbBvJLUF74RmYMSOMw=";
 
   subPackages = [
     # The server
diff --git a/pkgs/servers/dns/pdns-recursor/default.nix b/pkgs/servers/dns/pdns-recursor/default.nix
index da0890e8e4d0..7bd5f874b143 100644
--- a/pkgs/servers/dns/pdns-recursor/default.nix
+++ b/pkgs/servers/dns/pdns-recursor/default.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "pdns-recursor";
-  version = "4.8.4";
+  version = "4.9.0";
 
   src = fetchurl {
     url = "https://downloads.powerdns.com/releases/pdns-recursor-${version}.tar.bz2";
-    sha256 = "sha256-8KY/0I4D2oL6INMz6lF50bkln0JkVGz0mVKGZ32UWMc=";
+    sha256 = "sha256-028WKEPjZ2RqZhp4XKC+zem2hVKFW/QFMq66+hA5ZvM=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/servers/dns/pdns/default.nix b/pkgs/servers/dns/pdns/default.nix
index fcd218a1f3cc..ab95b5cedbba 100644
--- a/pkgs/servers/dns/pdns/default.nix
+++ b/pkgs/servers/dns/pdns/default.nix
@@ -23,11 +23,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pdns";
-  version = "4.8.0";
+  version = "4.8.1";
 
   src = fetchurl {
     url = "https://downloads.powerdns.com/releases/pdns-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-YalruviwykmpIloiVLlEPE/44FDTN0N9ha9N6InhASc=";
+    hash = "sha256-Zt0+4mVPQrTrgCYPlOy0jjE6gYF/WBJc5IwUwtJuMJ4=";
   };
   # redact configure flags from version output to reduce closure size
   patches = [ ./version.patch ];
diff --git a/pkgs/servers/homepage-dashboard/default.nix b/pkgs/servers/homepage-dashboard/default.nix
new file mode 100644
index 000000000000..1c8c283e9c3e
--- /dev/null
+++ b/pkgs/servers/homepage-dashboard/default.nix
@@ -0,0 +1,82 @@
+{ buildNpmPackage
+, fetchFromGitHub
+, nodePackages
+, python3
+, lib
+, fetchpatch
+, makeBinaryWrapper
+, nixosTests
+}:
+
+buildNpmPackage rec {
+  pname = "homepage-dashboard";
+  version = "0.6.21";
+
+  src = fetchFromGitHub {
+    owner = "benphelps";
+    repo = "homepage";
+    rev = "v${version}";
+    hash = "sha256-kjxA02hJj/GAQ0fM1xTtXAnZSQgVyE+EMRrXis1Vr+o=";
+  };
+
+  npmDepsHash = "sha256-O6SQYx5vxscMsbWv0ynUYqdUkOp/nMtdvlZ/Mp95sBY=";
+
+  patches = [
+    (fetchpatch {
+      name = "env-config-dir.patch";
+      url = "https://github.com/benphelps/homepage/commit/ca396ce96bce52f6c06a321f292aa94a66ceeb97.patch";
+      hash = "sha256-eNnW/ce4ytoKR6jH1Ztc4UTWOmL0uGRdY6nYBIVYM6k=";
+    })
+  ];
+
+  preBuild = ''
+    mkdir -p config
+  '';
+
+  postBuild = ''
+    # Add a shebang to the server js file, then patch the shebang.
+    sed -i '1s|^|#!/usr/bin/env node\n|' .next/standalone/server.js
+    patchShebangs .next/standalone/server.js
+  '';
+
+  buildInputs = [
+    nodePackages.node-gyp-build
+  ];
+
+  env.PYTHON = "${python3}/bin/python";
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out
+    cp -r .next/standalone $out/bin
+    cp -r public $out/bin/public
+
+    mkdir -p $out/bin/.next
+    cp -r .next/static $out/bin/.next/static
+
+    mv $out/bin/server.js $out/bin/homepage
+    chmod +x $out/bin/homepage
+
+    wrapProgram $out/bin/homepage \
+      --set-default PORT 3000 \
+      --set-default HOMEPAGE_CONFIG_DIR /var/lib/homepage-dashboard
+
+    runHook postInstall
+  '';
+
+  doDist = false;
+
+  passthru.tests = {
+    inherit (nixosTests) homepage;
+  };
+
+  meta = {
+    description = "A highly customisable dashboard with Docker and service API integrations.";
+    mainProgram = "homepage";
+    homepage = "https://gethomepage.dev";
+    license = lib.licenses.gpl3;
+    maintainers = with lib.maintainers; [ jnsgruk ];
+    platforms = lib.platforms.all;
+  };
+}
diff --git a/pkgs/servers/web-apps/peering-manager/default.nix b/pkgs/servers/web-apps/peering-manager/default.nix
index 8b6e77ec0f1f..eb07edabf4de 100644
--- a/pkgs/servers/web-apps/peering-manager/default.nix
+++ b/pkgs/servers/web-apps/peering-manager/default.nix
@@ -2,6 +2,7 @@
 , fetchFromGitHub
 , fetchpatch
 , nixosTests
+, lib
 
 , plugins ? ps: []
 }:
@@ -93,4 +94,12 @@ in py.pkgs.buildPythonApplication rec {
       inherit (nixosTests) peering-manager;
     };
   };
+
+  meta = with lib; {
+    homepage = "https://peering-manager.net/";
+    license = licenses.asl20;
+    description = "BGP sessions management tool";
+    maintainers = with maintainers; [ yuka ];
+    platforms = platforms.linux;
+  };
 }
diff --git a/pkgs/tools/graphics/astc-encoder/default.nix b/pkgs/tools/graphics/astc-encoder/default.nix
index 2909a2c12510..5e63038e67db 100644
--- a/pkgs/tools/graphics/astc-encoder/default.nix
+++ b/pkgs/tools/graphics/astc-encoder/default.nix
@@ -16,11 +16,9 @@ with rec {
     else if isAarch64 then [ "NEON" ]
     else [ "NONE" ];
 
-  archFlags = lib.optionals stdenv.hostPlatform.isAarch64 [ "-DARCH=aarch64" ];
-
   # CMake Build flags for the selected ISAs. For a list of flags, see
   # https://github.com/ARM-software/astc-encoder/blob/main/Docs/Building.md
-  isaFlags = map ( isa: "-DISA_${isa}=ON" ) isas;
+  isaFlags = map ( isa: "-DASTCENC_ISA_${isa}=ON" ) isas;
 
   # The suffix of the binary to link as 'astcenc'
   mainBinary = builtins.replaceStrings
@@ -31,25 +29,26 @@ with rec {
 
 stdenv.mkDerivation rec {
   pname = "astc-encoder";
-  version = "4.4.0";
+  version = "4.5.0";
 
   src = fetchFromGitHub {
     owner = "ARM-software";
     repo = "astc-encoder";
     rev = version;
-    sha256 = "sha256-pJmMquORG+vN2uLPywAZY1iZTuHB4SdMP/eriAjnyUU=";
+    sha256 = "sha256-pNoBOp//xa5F6/T1cwtdHsAWLZeIHgxZ7UKaB60fg4M=";
   };
 
   nativeBuildInputs = [ cmake ];
 
-  cmakeFlags = isaFlags ++ archFlags ++ [
+  cmakeFlags = isaFlags ++ [
     "-DCMAKE_BUILD_TYPE=RelWithDebInfo"
+    "-DASTCENC_UNIVERSAL_BUILD=OFF"
   ];
 
   # Set a fixed build year to display within help output (otherwise, it would be 1980)
   postPatch = ''
     substituteInPlace Source/cmake_core.cmake \
-      --replace 'string(TIMESTAMP astcencoder_YEAR "%Y")' 'set(astcencoder_YEAR "2022")'
+      --replace 'string(TIMESTAMP astcencoder_YEAR "%Y")' 'set(astcencoder_YEAR "2023")'
   '';
 
   # Provide 'astcenc' link to main executable
diff --git a/pkgs/tools/misc/invoice/default.nix b/pkgs/tools/misc/invoice/default.nix
new file mode 100644
index 000000000000..cffdec4063e3
--- /dev/null
+++ b/pkgs/tools/misc/invoice/default.nix
@@ -0,0 +1,24 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "invoice";
+  version = "0.1.0";
+
+  src = fetchFromGitHub {
+    owner = "maaslalani";
+    repo = "invoice";
+    rev = "v${version}";
+    hash = "sha256-WtQ4nF31uIoplY18GZNs41ZOCxmbIu71YpEGk8aTGww=";
+  };
+
+  vendorHash = "sha256-8VhBflnpsJ5h8S6meDFZKCcS2nz5u4kPE9W710gJG4U=";
+
+  ldflags = [ "-s" "-w" ];
+
+  meta = with lib; {
+    description = "Command line invoice generator";
+    homepage = "https://github.com/maaslalani/invoice";
+    license = licenses.mit;
+    maintainers = with maintainers; [ dit7ya ];
+  };
+}
diff --git a/pkgs/tools/misc/rauc/default.nix b/pkgs/tools/misc/rauc/default.nix
index c6bb154ab229..72cc8d8945f5 100644
--- a/pkgs/tools/misc/rauc/default.nix
+++ b/pkgs/tools/misc/rauc/default.nix
@@ -18,22 +18,15 @@
 
 stdenv.mkDerivation rec {
   pname = "rauc";
-  version = "1.9";
+  version = "1.10";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-VpHcJUTRZ5aJyfYypjVsYyRNrK0+9ci42mmlZQSkWAk=";
+    sha256 = "sha256-WiN2lTS6LCVCeVyX0/2rSDLL2tKsAhWSMa95fK05UOg=";
   };
 
-  patches = [
-    (fetchpatch {
-      # Patch to install the man page when using meson, remove on package bump
-      url = "https://github.com/rauc/rauc/commit/756c677d031c435070a6900e6778d06961822261.patch";
-      hash = "sha256-QgIUagioRo61PeC0JyKjZtnauFiYP1Fz9wrxGEikBGI=";
-    })
-  ];
   passthru = {
     updateScript = nix-update-script { };
   };
diff --git a/pkgs/tools/networking/tunwg/default.nix b/pkgs/tools/networking/tunwg/default.nix
new file mode 100644
index 000000000000..25cf5a0a9be6
--- /dev/null
+++ b/pkgs/tools/networking/tunwg/default.nix
@@ -0,0 +1,27 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
+
+buildGoModule rec {
+  pname = "tunwg";
+  version = "23.06.14+dbfe3aa";
+
+  src = fetchFromGitHub {
+    owner = "ntnj";
+    repo = "tunwg";
+    rev = "v${version}";
+    hash = "sha256-w7rx2Q0VXQBETmHROcVWzh0TIEjiITpI5CR9jvtXF7E=";
+  };
+
+  vendorHash = "sha256-3vDcCOrhYTHvr8ck0WxZPRUQNsKtEVyUKTD5Epbno6I=";
+
+  ldflags = [ "-s" "-w" ];
+
+  meta = with lib; {
+    description = "Secure private tunnel to your local servers";
+    homepage = "https://github.com/ntnj/tunwg";
+    license = licenses.mit;
+    maintainers = with maintainers; [ dit7ya ];
+  };
+}
diff --git a/pkgs/tools/security/honeytrap/default.nix b/pkgs/tools/security/honeytrap/default.nix
index 91d1c367182b..e0252d06f154 100644
--- a/pkgs/tools/security/honeytrap/default.nix
+++ b/pkgs/tools/security/honeytrap/default.nix
@@ -4,21 +4,21 @@
 }:
 buildGoModule {
   pname = "honeytrap";
-  version = "unstable-2020-12-10";
+  version = "unstable-2021-12-20";
 
   src = fetchFromGitHub {
     owner = "honeytrap";
     repo = "honeytrap";
-    rev = "affd7b21a5aa1b57f086e6871753cb98ce088d76";
-    sha256 = "y1SWlBFgX3bFoSRGJ45DdC1DoIK5BfO9Vpi2h57wWtU=";
+    rev = "05965fc67deab17b48e43873abc5f509067ef098";
+    hash = "sha256-KSVqjHlXl85JaqKiW5R86HCMdtFBwTMJkxFoySOcahs=";
   };
 
+  vendorHash = "sha256-W8w66weYzCpZ+hmFyK2F6wdFz6aAZ9UxMhccNy1X1R8=";
+
   # Otherwise, will try to install a "scripts" binary; it's only used in
   # dockerize.sh, which we don't care about.
   subPackages = [ "." ];
 
-  vendorSha256 = "W8w66weYzCpZ+hmFyK2F6wdFz6aAZ9UxMhccNy1X1R8=";
-
   meta = with lib; {
     description = "Advanced Honeypot framework";
     homepage = "https://github.com/honeytrap/honeytrap";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 87ca7b7d29b6..b38eed7e6f2a 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -290,6 +290,8 @@ with pkgs;
 
   apko = callPackage ../development/tools/apko { };
 
+  melange = callPackage ../development/tools/melange { };
+
   appthreat-depscan = callPackage ../development/tools/appthreat-depscan { };
 
   activate-linux = callPackage ../applications/misc/activate-linux { };
@@ -5374,6 +5376,8 @@ with pkgs;
 
   home-manager = callPackage ../tools/package-management/home-manager { };
 
+  homepage-dashboard = callPackage ../servers/homepage-dashboard { };
+
   hostsblock = callPackage ../tools/misc/hostsblock { };
 
   hottext = callPackage ../tools/text/hottext { };
@@ -5428,6 +5432,8 @@ with pkgs;
 
   interlock = callPackage ../servers/interlock { };
 
+  invoice = callPackage ../tools/misc/invoice { };
+
   invoiceplane = callPackage ../servers/web-apps/invoiceplane { };
 
   iotas = callPackage ../applications/office/iotas { };
@@ -5508,6 +5514,8 @@ with pkgs;
 
   komga = callPackage ../servers/komga { };
 
+  komorebi = callPackage ../applications/graphics/komorebi { };
+
   krapslog = callPackage ../tools/misc/krapslog { };
 
   krelay = callPackage ../applications/networking/cluster/krelay { };
@@ -13569,6 +13577,8 @@ with pkgs;
 
   tuntox = callPackage ../tools/networking/tuntox { };
 
+  tunwg = callPackage ../tools/networking/tunwg { };
+
   omapd = callPackage ../tools/security/omapd { };
 
   ttf2pt1 = callPackage ../tools/misc/ttf2pt1 { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index ba0bc6d7a065..a94ab6135041 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1274,6 +1274,8 @@ self: super: with self; {
 
   beaker = callPackage ../development/python-modules/beaker { };
 
+  before-after = callPackage ../development/python-modules/before-after { };
+
   beancount = callPackage ../development/python-modules/beancount { };
 
   beancount-black = callPackage ../development/python-modules/beancount-black { };