Merge staging-next into staging

55 files changed, 687 insertions, 215 deletions

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 1d23d600616..41da5bc9ae4 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -5630,6 +5630,12 @@
     githubId = 609279;
     name = "Isaac Shapira";
   };
+  freyacodes = {
+    email = "freya@arbjerg.dev";
+    github = "freyacodes";
+    githubId = 2582617;
+    name = "Freya Arbjerg";
+  };
   fricklerhandwerk = {
     email = "valentin@fricklerhandwerk.de";
     github = "fricklerhandwerk";
@@ -13016,6 +13022,12 @@
     githubId = 1830959;
     name = "Piper McCorkle";
   };
+  piturnah = {
+    email = "peterhebden6@gmail.com";
+    github = "piturnah";
+    githubId = 20472367;
+    name = "Peter Hebden";
+  };
   pjbarnoy = {
     email = "pjbarnoy@gmail.com";
     github = "pjbarnoy";
diff --git a/nixos/doc/manual/release-notes/rl-2311.section.md b/nixos/doc/manual/release-notes/rl-2311.section.md
index 920a5f433c3..0c7080e5e98 100644
--- a/nixos/doc/manual/release-notes/rl-2311.section.md
+++ b/nixos/doc/manual/release-notes/rl-2311.section.md
@@ -82,6 +82,8 @@
 
 - mdraid support is now optional. This reduces initramfs size and prevents the potentially undesired automatic detection and activation of software RAID pools. It is disabled by default in new configurations (determined by `stateVersion`), but the appropriate settings will be generated by `nixos-generate-config` when installing to a software RAID device, so the standard installation procedure should be unaffected. If you have custom configs relying on mdraid, ensure that you use `stateVersion` correctly or set `boot.swraid.enable` manually.
 
+- The `go-ethereum` package has been updated to v1.12.0. This drops support for proof-of-work. Its GraphQL API now encodes all numeric values as hex strings and the GraphQL UI is updated to version 2.0. The default database has changed from `leveldb` to `pebble` but `leveldb` can be forced with the --db.engine=leveldb flag. The `checkpoint-admin` command was [removed along with trusted checkpoints](https://github.com/ethereum/go-ethereum/pull/27147).
+
 ## Other Notable Changes {#sec-release-23.11-notable-changes}
 
 - The Cinnamon module now enables XDG desktop integration by default. If you are experiencing collisions related to xdg-desktop-portal-gtk you can safely remove `xdg.portal.extraPortals = [ pkgs.xdg-desktop-portal-gtk ];` from your NixOS configuration.
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 48cbc404a81..a20fbd69a2c 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -646,6 +646,7 @@
   ./services/misc/greenclip.nix
   ./services/misc/headphones.nix
   ./services/misc/heisenbridge.nix
+  ./services/misc/homepage-dashboard.nix
   ./services/misc/ihaskell.nix
   ./services/misc/input-remapper.nix
   ./services/misc/irkerd.nix
diff --git a/nixos/modules/services/misc/homepage-dashboard.nix b/nixos/modules/services/misc/homepage-dashboard.nix
new file mode 100644
index 00000000000..e6857125343
--- /dev/null
+++ b/nixos/modules/services/misc/homepage-dashboard.nix
@@ -0,0 +1,55 @@
+{ config
+, pkgs
+, lib
+, ...
+}:
+
+let
+  cfg = config.services.homepage-dashboard;
+in
+{
+  options = {
+    services.homepage-dashboard = {
+      enable = lib.mkEnableOption (lib.mdDoc "Homepage Dashboard");
+
+      package = lib.mkPackageOptionMD pkgs "homepage-dashboard" { };
+
+      openFirewall = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = lib.mdDoc "Open ports in the firewall for Homepage.";
+      };
+
+      listenPort = lib.mkOption {
+        type = lib.types.int;
+        default = 8082;
+        description = lib.mdDoc "Port for Homepage to bind to.";
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.homepage-dashboard = {
+      description = "Homepage Dashboard";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+
+      environment = {
+        HOMEPAGE_CONFIG_DIR = "/var/lib/homepage-dashboard";
+        PORT = "${toString cfg.listenPort}";
+      };
+
+      serviceConfig = {
+        Type = "simple";
+        DynamicUser = true;
+        StateDirectory = "homepage-dashboard";
+        ExecStart = "${lib.getExe cfg.package}";
+        Restart = "on-failure";
+      };
+    };
+
+    networking.firewall = lib.mkIf cfg.openFirewall {
+      allowedTCPPorts = [ cfg.listenPort ];
+    };
+  };
+}
diff --git a/nixos/modules/services/misc/prowlarr.nix b/nixos/modules/services/misc/prowlarr.nix
index 77b8ec98947..cd2c98fc5df 100644
--- a/nixos/modules/services/misc/prowlarr.nix
+++ b/nixos/modules/services/misc/prowlarr.nix
@@ -11,6 +11,8 @@ in
     services.prowlarr = {
       enable = mkEnableOption (lib.mdDoc "Prowlarr");
 
+      package = mkPackageOptionMD pkgs "prowlarr" { };
+
       openFirewall = mkOption {
         type = types.bool;
         default = false;
@@ -29,7 +31,7 @@ in
         Type = "simple";
         DynamicUser = true;
         StateDirectory = "prowlarr";
-        ExecStart = "${pkgs.prowlarr}/bin/Prowlarr -nobrowser -data=/var/lib/prowlarr";
+        ExecStart = "${cfg.package}/bin/Prowlarr -nobrowser -data=/var/lib/prowlarr";
         Restart = "on-failure";
       };
     };
diff --git a/nixos/modules/services/web-apps/peering-manager.nix b/nixos/modules/services/web-apps/peering-manager.nix
index 666b8262126..641a3644614 100644
--- a/nixos/modules/services/web-apps/peering-manager.nix
+++ b/nixos/modules/services/web-apps/peering-manager.nix
@@ -1,7 +1,5 @@
 { config, lib, pkgs, buildEnv, ... }:
 
-with lib;
-
 let
   cfg = config.services.peering-manager;
   configFile = pkgs.writeTextFile {
@@ -41,24 +39,24 @@ let
   pkg = (pkgs.peering-manager.overrideAttrs (old: {
     postInstall = ''
       ln -s ${configFile} $out/opt/peering-manager/peering_manager/configuration.py
-    '' + optionalString cfg.enableLdap ''
+    '' + lib.optionalString cfg.enableLdap ''
       ln -s ${cfg.ldapConfigPath} $out/opt/peering-manager/peering_manager/ldap_config.py
     '';
   })).override {
     inherit (cfg) plugins;
   };
-  peeringManagerManageScript = with pkgs; (writeScriptBin "peering-manager-manage" ''
-    #!${stdenv.shell}
+  peeringManagerManageScript = pkgs.writeScriptBin "peering-manager-manage" ''
+    #!${pkgs.stdenv.shell}
     export PYTHONPATH=${pkg.pythonPath}
     sudo -u peering-manager ${pkg}/bin/peering-manager "$@"
-  '');
+  '';
 
 in {
-  options.services.peering-manager = {
+  options.services.peering-manager = with lib; {
     enable = mkOption {
-      type = lib.types.bool;
+      type = types.bool;
       default = false;
-      description = lib.mdDoc ''
+      description = mdDoc ''
         Enable Peering Manager.
 
         This module requires a reverse proxy that serves `/static` separately.
@@ -69,7 +67,7 @@ in {
     listenAddress = mkOption {
       type = types.str;
       default = "[::1]";
-      description = lib.mdDoc ''
+      description = mdDoc ''
         Address the server will listen on.
       '';
     };
@@ -77,7 +75,7 @@ in {
     port = mkOption {
       type = types.port;
       default = 8001;
-      description = lib.mdDoc ''
+      description = mdDoc ''
         Port the server will listen on.
       '';
     };
@@ -88,14 +86,14 @@ in {
       defaultText = literalExpression ''
         python3Packages: with python3Packages; [];
       '';
-      description = lib.mdDoc ''
+      description = mdDoc ''
         List of plugin packages to install.
       '';
     };
 
     secretKeyFile = mkOption {
       type = types.path;
-      description = lib.mdDoc ''
+      description = mdDoc ''
         Path to a file containing the secret key.
       '';
     };
@@ -103,7 +101,7 @@ in {
     peeringdbApiKeyFile = mkOption {
       type = with types; nullOr path;
       default = null;
-      description = lib.mdDoc ''
+      description = mdDoc ''
         Path to a file containing the PeeringDB API key.
       '';
     };
@@ -111,7 +109,7 @@ in {
     extraConfig = mkOption {
       type = types.lines;
       default = "";
-      description = lib.mdDoc ''
+      description = mdDoc ''
         Additional lines of configuration appended to the `configuration.py`.
         See the [documentation](https://peering-manager.readthedocs.io/en/stable/configuration/optional-settings/) for more possible options.
       '';
@@ -120,7 +118,7 @@ in {
     enableLdap = mkOption {
       type = types.bool;
       default = false;
-      description = lib.mdDoc ''
+      description = mdDoc ''
         Enable LDAP-Authentication for Peering Manager.
 
         This requires a configuration file being pass through `ldapConfigPath`.
@@ -129,15 +127,15 @@ in {
 
     ldapConfigPath = mkOption {
       type = types.path;
-      description = lib.mdDoc ''
+      description = mdDoc ''
         Path to the Configuration-File for LDAP-Authentication, will be loaded as `ldap_config.py`.
         See the [documentation](https://peering-manager.readthedocs.io/en/stable/setup/6-ldap/#configuration) for possible options.
       '';
     };
   };
 
-  config = mkIf cfg.enable {
-    services.peering-manager.plugins = mkIf cfg.enableLdap (ps: [ ps.django-auth-ldap ]);
+  config = lib.mkIf cfg.enable {
+    services.peering-manager.plugins = lib.mkIf cfg.enableLdap (ps: [ ps.django-auth-ldap ]);
 
     system.build.peeringManagerPkg = pkg;
 
@@ -262,4 +260,6 @@ in {
     users.groups.peering-manager = {};
     users.groups."${config.services.redis.servers.peering-manager.user}".members = [ "peering-manager" ];
   };
+
+  meta.maintainers = with lib.maintainers; [ yuka ];
 }
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 790de7bbdc4..723b030072e 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -337,6 +337,7 @@ in {
   hbase3 = handleTest ./hbase.nix { package=pkgs.hbase3; };
   hedgedoc = handleTest ./hedgedoc.nix {};
   herbstluftwm = handleTest ./herbstluftwm.nix {};
+  homepage-dashboard = handleTest ./homepage-dashboard.nix {};
   installed-tests = pkgs.recurseIntoAttrs (handleTest ./installed-tests {});
   invidious = handleTest ./invidious.nix {};
   oci-containers = handleTestOn ["aarch64-linux" "x86_64-linux"] ./oci-containers.nix {};
diff --git a/nixos/tests/homepage-dashboard.nix b/nixos/tests/homepage-dashboard.nix
new file mode 100644
index 00000000000..56e077f5ff6
--- /dev/null
+++ b/nixos/tests/homepage-dashboard.nix
@@ -0,0 +1,14 @@
+import ./make-test-python.nix ({ lib, ... }: {
+  name = "homepage-dashboard";
+  meta.maintainers = with lib.maintainers; [ jnsgruk ];
+
+  nodes.machine = { pkgs, ... }: {
+    services.homepage-dashboard.enable = true;
+  };
+
+  testScript = ''
+    machine.wait_for_unit("homepage-dashboard.service")
+    machine.wait_for_open_port(8082)
+    machine.succeed("curl --fail http://localhost:8082/")
+  '';
+})
diff --git a/nixos/tests/web-apps/peering-manager.nix b/nixos/tests/web-apps/peering-manager.nix
index 56b7eebfadf..3f0acd560d1 100644
--- a/nixos/tests/web-apps/peering-manager.nix
+++ b/nixos/tests/web-apps/peering-manager.nix
@@ -34,7 +34,7 @@ import ../make-test-python.nix ({ lib, pkgs, ... }: {
             "sudo -u postgres psql -c 'ALTER USER \"peering-manager\" WITH SUPERUSER;'"
         )
         machine.succeed(
-            "cd ${nodes.machine.config.system.build.peeringManagerPkg}/opt/peering-manager ; peering-manager-manage test --no-input"
+            "cd ${nodes.machine.system.build.peeringManagerPkg}/opt/peering-manager ; peering-manager-manage test --no-input"
         )
   '';
 })
diff --git a/pkgs/applications/blockchains/go-ethereum/default.nix b/pkgs/applications/blockchains/go-ethereum/default.nix
index 7e00aa33a22..6c39a8eae65 100644
--- a/pkgs/applications/blockchains/go-ethereum/default.nix
+++ b/pkgs/applications/blockchains/go-ethereum/default.nix
@@ -9,16 +9,16 @@ let
 
 in buildGoModule rec {
   pname = "go-ethereum";
-  version = "1.11.6";
+  version = "1.12.0";
 
   src = fetchFromGitHub {
     owner = "ethereum";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-mZ11xan3MGgaUORbiQczKrXSrxzjvQMhZbpHnEal11Y=";
+    sha256 = "sha256-u1p9k12tY79kA/2Hu109czQZnurHuDJQf/w7J0c8SuU=";
   };
 
-  vendorHash = "sha256-rjSGR2ie5sFK2OOo4HUZ6+hrDlQuUDtyTKn0sh8jFBY=";
+  vendorHash = "sha256-k5MbOiJDvWFnaAPViNRHeqFa64XPZ3ImkkvkmTTscNA=";
 
   doCheck = false;
 
@@ -33,7 +33,6 @@ in buildGoModule rec {
     "cmd/abidump"
     "cmd/abigen"
     "cmd/bootnode"
-    "cmd/checkpoint-admin"
     "cmd/clef"
     "cmd/devp2p"
     "cmd/ethkey"
@@ -58,6 +57,6 @@ in buildGoModule rec {
     homepage = "https://geth.ethereum.org/";
     description = "Official golang implementation of the Ethereum protocol";
     license = with licenses; [ lgpl3Plus gpl3Plus ];
-    maintainers = with maintainers; [ adisbladis RaghavSood ];
+    maintainers = with maintainers; [ RaghavSood ];
   };
 }
diff --git a/pkgs/applications/editors/jetbrains/default.nix b/pkgs/applications/editors/jetbrains/default.nix
index cb356d67d15..b78da5da3f1 100644
--- a/pkgs/applications/editors/jetbrains/default.nix
+++ b/pkgs/applications/editors/jetbrains/default.nix
@@ -77,8 +77,6 @@ let
             --replace-needed libcrypto.so.10 libcrypto.so
 
           autoPatchelf $PWD/bin
-          wrapProgram $out/bin/clion \
-            --set CL_JDK "${jdk}"
         )
       '';
     });
diff --git a/pkgs/applications/editors/jetbrains/linux.nix b/pkgs/applications/editors/jetbrains/linux.nix
index eaaa3c4aded..1c00e408aea 100644
--- a/pkgs/applications/editors/jetbrains/linux.nix
+++ b/pkgs/applications/editors/jetbrains/linux.nix
@@ -71,6 +71,8 @@ with stdenv; lib.makeOverridable mkDerivation (rec {
     }
 
     rm -rf jbr
+    # When using the IDE as a remote backend using gateway, it expects the jbr directory to contain the jdk
+    ln -s ${jdk.home} jbr
 
     interpreter=$(echo ${stdenv.cc.libc}/lib/ld-linux*.so.2)
     if [[ "${stdenv.hostPlatform.system}" == "x86_64-linux" && -e bin/fsnotifier64 ]]; then
diff --git a/pkgs/applications/emulators/vbam/default.nix b/pkgs/applications/emulators/vbam/default.nix
index acf7b26d947..2b252f0f10d 100644
--- a/pkgs/applications/emulators/vbam/default.nix
+++ b/pkgs/applications/emulators/vbam/default.nix
@@ -18,12 +18,12 @@
 
 stdenv.mkDerivation rec {
   pname = "visualboyadvance-m";
-  version = "2.1.5";
+  version = "2.1.6";
   src = fetchFromGitHub {
     owner = "visualboyadvance-m";
     repo = "visualboyadvance-m";
     rev = "v${version}";
-    sha256 = "1sc3gdn7dqkipjsvlzchgd98mia9ic11169dw8v341vr9ppb1b6m";
+    sha256 = "1fph8phbswq6d9lgw1y1767wdp316w5hn5bws6h2dj75gvsqf221";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
@@ -43,13 +43,6 @@ stdenv.mkDerivation rec {
     gtk3
   ];
 
-  patches = [
-    (fetchpatch {
-      url = "https://github.com/visualboyadvance-m/visualboyadvance-m/commit/1d7e8ae4edc53a3380dfea88329b8b8337db1c52.patch";
-      sha256 = "sha256-SV1waz2JSKiM6itwkqwlE3aOZCcOl8iyBr06tyYlefo=";
-    })
-  ];
-
   cmakeFlags = [
     "-DCMAKE_BUILD_TYPE='Release'"
     "-DENABLE_FFMPEG='true'"
diff --git a/pkgs/applications/graphics/darktable/default.nix b/pkgs/applications/graphics/darktable/default.nix
index 8488e4c6d15..1a742777267 100644
--- a/pkgs/applications/graphics/darktable/default.nix
+++ b/pkgs/applications/graphics/darktable/default.nix
@@ -58,12 +58,12 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "4.4.0";
+  version = "4.4.1";
   pname = "darktable";
 
   src = fetchurl {
     url = "https://github.com/darktable-org/darktable/releases/download/release-${version}/darktable-${version}.tar.xz";
-    sha256 = "8887fc34abd97c4998b0888c3197e0c509d63bdeab2238906915319811f3b080";
+    sha256 = "e043d38d2e8adb67af7690b12b535a40e8ec7bea05cfa8684db8b21a626e0f0d";
   };
 
   nativeBuildInputs = [ cmake ninja llvm_13 pkg-config intltool perl desktop-file-utils wrapGAppsHook ];
@@ -147,6 +147,6 @@ stdenv.mkDerivation rec {
     homepage = "https://www.darktable.org";
     license = licenses.gpl3Plus;
     platforms = platforms.linux ++ platforms.darwin;
-    maintainers = with maintainers; [ goibhniu flosse mrVanDalo paperdigits ];
+    maintainers = with maintainers; [ goibhniu flosse mrVanDalo paperdigits freyacodes ];
   };
 }
diff --git a/pkgs/applications/graphics/komorebi/default.nix b/pkgs/applications/graphics/komorebi/default.nix
new file mode 100644
index 00000000000..2d099b5eb7c
--- /dev/null
+++ b/pkgs/applications/graphics/komorebi/default.nix
@@ -0,0 +1,56 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, meson
+, vala
+, pkg-config
+, glib
+, gtk3
+, libgee
+, webkitgtk
+, clutter-gtk
+, clutter-gst
+, ninja
+, wrapGAppsHook
+, testers
+, komorebi
+}:
+
+stdenv.mkDerivation rec {
+  pname = "komorebi";
+  version = "2.2.1";
+
+  src = fetchFromGitHub {
+    owner = "Komorebi-Fork";
+    repo = "komorebi";
+    rev = "v${version}";
+    hash = "sha256-vER69dSxu4JuWNAADpkxHE/zjOMhQp+Fc21J+JHQ8xk=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    vala
+    pkg-config
+    ninja
+    wrapGAppsHook
+  ];
+
+  buildInputs = [
+    glib
+    gtk3
+    libgee
+    webkitgtk
+    clutter-gtk
+    clutter-gst
+  ];
+
+  passthru.tests.version = testers.testVersion { package = komorebi; };
+
+  meta = with lib; {
+    description = "A beautiful and customizable wallpaper manager for Linux";
+    homepage = "https://github.com/Komorebi-Fork/komorebi";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ kranzes ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 17141a50582..2e5c2398dff 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -28,13 +28,13 @@
     "vendorHash": "sha256-jK7JuARpoxq7hvq5+vTtUwcYot0YqlOZdtDwq4IqKvk="
   },
   "aiven": {
-    "hash": "sha256-rmXfUMP1CWKV7ahxfmCr2FvWYcEWKh+V3fWSQWvcUDU=",
+    "hash": "sha256-T9d1iMuFqewDVK4EOsF4uCsqZAsThMHaRa7ilGnYXCo=",
     "homepage": "https://registry.terraform.io/providers/aiven/aiven",
     "owner": "aiven",
     "repo": "terraform-provider-aiven",
-    "rev": "v4.6.0",
+    "rev": "v4.7.0",
     "spdx": "MIT",
-    "vendorHash": "sha256-oUUl7m7+r10xSklrcsTYOU8wk8n7TLu6Qt50wTKLULk="
+    "vendorHash": "sha256-Fcu4RWgbVyAUr72h8q91HT+LbUh9+4SPDz8Vc4/u5RM="
   },
   "akamai": {
     "hash": "sha256-gQZ5yH3sV5DTpSE+/bZM12+PHitmUm/TtpAdPijF+Lk=",
@@ -110,29 +110,29 @@
     "vendorHash": null
   },
   "aws": {
-    "hash": "sha256-LFOlSmsnV7opt9Z3b15Lyi8sFYjx2WkvvB8vpJBjfWQ=",
+    "hash": "sha256-VDet4IGyd0RXCzlQ+s08QwX9eby5oYfwq2eVRfSS9ME=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/aws",
     "owner": "hashicorp",
     "repo": "terraform-provider-aws",
-    "rev": "v5.7.0",
+    "rev": "v5.8.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-x8f1sTVB1FaoPKgTGEoZaNVKCpNbTrQ7F0PVfwEWe/I="
+    "vendorHash": "sha256-oNPWz/0jcSL0FYuIW9wnj8Jp94vm9dJdiC9gfhtbQiU="
   },
   "azuread": {
-    "hash": "sha256-wBNS2a6O1QJgssbAWhSRSfxaVZ35zgT/qNdpE++NQ8U=",
+    "hash": "sha256-6LSvqMi79HW1GdEG0lSVwLF2nWft/JnKyj9EQO4pMW4=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/azuread",
     "owner": "hashicorp",
     "repo": "terraform-provider-azuread",
-    "rev": "v2.39.0",
+    "rev": "v2.40.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
   "azurerm": {
-    "hash": "sha256-PwAwVpLoMq5DNIiY5wt+n9oqNGInJ+C0JfiFagtrAEA=",
+    "hash": "sha256-4cJal4GrL8OwoFNMjN0AKlicq2mC0ba3N8bYISMaY3A=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/azurerm",
     "owner": "hashicorp",
     "repo": "terraform-provider-azurerm",
-    "rev": "v3.64.0",
+    "rev": "v3.65.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -182,13 +182,13 @@
     "vendorHash": "sha256-/dOiXO2aPkuZaFiwv/6AXJdIADgx8T7eOwvJfBBoqg8="
   },
   "buildkite": {
-    "hash": "sha256-yxL08Eysj/w9uLmuqDKx1ZcYQZSy91pDgR84BdpsF88=",
+    "hash": "sha256-1cKRsOuwYu3DV8uArrrf1hJdJ+C54D2awKmJm5ECEG4=",
     "homepage": "https://registry.terraform.io/providers/buildkite/buildkite",
     "owner": "buildkite",
     "repo": "terraform-provider-buildkite",
-    "rev": "v0.19.2",
+    "rev": "v0.20.0",
     "spdx": "MIT",
-    "vendorHash": "sha256-AJcPxiuglHpsHUIa5sJMtY7MRN5JrW/tfkz3+5Bv9AU="
+    "vendorHash": "sha256-QJ8bZU6K0UAduUjFmyGHjsaHm2e5U8rlPqlK6xM8m3I="
   },
   "checkly": {
     "hash": "sha256-UXIni594P85sgS8XVLoJ0+UTBeUS0XC+oj98KJUfghg=",
@@ -445,22 +445,22 @@
     "vendorHash": "sha256-XgGNz+yP+spRA2+qFxwiZFcBRv2GQWhiYY9zoC8rZPc="
   },
   "google": {
-    "hash": "sha256-2c50Ul57IeI7NzH0qYRIw8aKoB/5edCEsurc7JcojgQ=",
+    "hash": "sha256-FlBTLc3QUsPAO1OIr8aOlb7ppePsAjtKKrBOTS+JYFI=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/google",
     "owner": "hashicorp",
     "proxyVendor": true,
     "repo": "terraform-provider-google",
-    "rev": "v4.73.0",
+    "rev": "v4.73.1",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-X+7UZM0iZzG7LvaK6nKXF3taKIiJfhWRmY1q1Uz9M4A="
   },
   "google-beta": {
-    "hash": "sha256-2fiwPrmd/PHFNksfpo/TQQsuFz7RttAea5C8LJTrMAg=",
+    "hash": "sha256-GYX0tmNut04NbpqbfXCy/5Rabn3leWf1VH+yGHTsCek=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/google-beta",
     "owner": "hashicorp",
     "proxyVendor": true,
     "repo": "terraform-provider-google-beta",
-    "rev": "v4.73.0",
+    "rev": "v4.73.1",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-X+7UZM0iZzG7LvaK6nKXF3taKIiJfhWRmY1q1Uz9M4A="
   },
@@ -700,11 +700,11 @@
     "vendorHash": "sha256-ZjS40Xc8y2UBPn4rX3EgRoSapRvMEeVMGZE6z9tpsAQ="
   },
   "lxd": {
-    "hash": "sha256-qJp/RekJBsXx5Ic6J6CKs/oBcyqHB/sSjpzjAZUf2iE=",
+    "hash": "sha256-mZ2ptpgpyNXZAS19MVxOq3cfmSjTJvTP60fbpEgk6kE=",
     "homepage": "https://registry.terraform.io/providers/terraform-lxd/lxd",
     "owner": "terraform-lxd",
     "repo": "terraform-provider-lxd",
-    "rev": "v1.10.0",
+    "rev": "v1.10.1",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-zGVatrMqYsbGahEGJ/Gt9ub76R49m7RbLLs2XeKwQJw="
   },
@@ -745,13 +745,13 @@
     "vendorHash": "sha256-4OVNcAG+/JhVQX4eW5jUkrJeIPPZatq3SvQERdRPtl0="
   },
   "mongodbatlas": {
-    "hash": "sha256-z/bRdyXrjMn98DtQAnEuuJX4dr3SItbOQlvST/p7jCY=",
+    "hash": "sha256-vhzidHQzWrLQ2fGZ0A7aGKwvrqWi6GJ3JCdoCX/dZkc=",
     "homepage": "https://registry.terraform.io/providers/mongodb/mongodbatlas",
     "owner": "mongodb",
     "repo": "terraform-provider-mongodbatlas",
-    "rev": "v1.10.0",
+    "rev": "v1.10.1",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-QSRo/lloloaUtGTv8fauO+6biroTlIteM1KsadvFZtg="
+    "vendorHash": "sha256-7wrN2BoFY0I9dV52x9LJ43PgUSOVnhJULm1EY+LEZOI="
   },
   "namecheap": {
     "hash": "sha256-cms8YUL+SjTeYyIOQibksi8ZHEBYq2JlgTEpOO1uMZE=",
@@ -863,20 +863,20 @@
     "vendorHash": "sha256-NnB8deqIeiB66Kba9LWT62fyI23HL57VcsTickoTRwI="
   },
   "opentelekomcloud": {
-    "hash": "sha256-VPXuM1w6A/dNJcdpEQsi9wmp93urJclWN5jLMBme9h8=",
+    "hash": "sha256-SM6WG7igvFlIbi5AYj/1JXxjbpGgBkz2dKUnR4ZjQb8=",
     "homepage": "https://registry.terraform.io/providers/opentelekomcloud/opentelekomcloud",
     "owner": "opentelekomcloud",
     "repo": "terraform-provider-opentelekomcloud",
-    "rev": "v1.35.2",
+    "rev": "v1.35.3",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-TKYKKw6Mrq7hhM+at9VAiVxIpjYeg7AmEIEzfDIJA5M="
+    "vendorHash": "sha256-zlviJb2EYw/9NiD64xLFY8cd4H9Nb63tSbBUzFhW8Qo="
   },
   "opsgenie": {
-    "hash": "sha256-3W53oONyPoXSp7fnB2EG512rBXac07nGVevdZ9gezig=",
+    "hash": "sha256-fZidZFpusgO1PTXArsxn/omo+DC1nfVu6649BvBzj+k=",
     "homepage": "https://registry.terraform.io/providers/opsgenie/opsgenie",
     "owner": "opsgenie",
     "repo": "terraform-provider-opsgenie",
-    "rev": "v0.6.27",
+    "rev": "v0.6.28",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -971,13 +971,13 @@
     "vendorHash": null
   },
   "scaleway": {
-    "hash": "sha256-coscd4w+x7+Klp4j1Wb9z092WqWUhZTnREEq+RdgFLw=",
+    "hash": "sha256-AA9ctS5YQ36mvxfXSU77rfOWL5UXynVN+TUjpjBR40I=",
     "homepage": "https://registry.terraform.io/providers/scaleway/scaleway",
     "owner": "scaleway",
     "repo": "terraform-provider-scaleway",
-    "rev": "v2.23.0",
+    "rev": "v2.24.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-8MjVOibZuPlZHP3fIIcr17Siz0VAZ5SX8TUpj5L/YXc="
+    "vendorHash": "sha256-g/hNdUharGRTOIJZMk8lRAwO9PdMAbwJYTNcxTpfaV0="
   },
   "secret": {
     "hash": "sha256-MmAnA/4SAPqLY/gYcJSTnEttQTsDd2kEdkQjQj6Bb+A=",
@@ -1261,12 +1261,12 @@
     "vendorHash": "sha256-itSr5HHjus6G0t5/KFs0sNiredH9m3JnQ3siLtm+NHs="
   },
   "yandex": {
-    "hash": "sha256-FsbwylRyUFDZ9n40D36bnchYCax9hKyDLTPF7UV85y4=",
+    "hash": "sha256-03lZMLD2Iq9o9ijvMD7JNnaGNdn5OpB/s3509YdYRfQ=",
     "homepage": "https://registry.terraform.io/providers/yandex-cloud/yandex",
     "owner": "yandex-cloud",
     "repo": "terraform-provider-yandex",
-    "rev": "v0.94.0",
+    "rev": "v0.95.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-/HrijkUpJmeCjk6SCH2TE9MThjnimskOjztzRygd5fE="
+    "vendorHash": "sha256-IdRgtPUAYYR55MiT/2wqGzYhuMfThUmhnGGYoPQlHW0="
   }
 }
diff --git a/pkgs/applications/networking/instant-messengers/webcord/default.nix b/pkgs/applications/networking/instant-messengers/webcord/default.nix
index 67e99f540b1..00361a7e368 100644
--- a/pkgs/applications/networking/instant-messengers/webcord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/webcord/default.nix
@@ -1,18 +1,28 @@
-{ lib, stdenv, buildNpmPackage, fetchFromGitHub, copyDesktopItems
-, python3, pipewire, libpulseaudio, xdg-utils, electron_24, makeDesktopItem }:
+{ lib
+, buildNpmPackage
+, fetchFromGitHub
+, copyDesktopItems
+, python3
+, pipewire
+, libpulseaudio
+, xdg-utils
+, electron_25
+, makeDesktopItem
+, nix-update-script
+}:
 
 buildNpmPackage rec {
   pname = "webcord";
-  version = "4.2.0";
+  version = "4.3.0";
 
   src = fetchFromGitHub {
     owner = "SpacingBat3";
     repo = "WebCord";
     rev = "v${version}";
-    sha256 = "sha256-530iWNvehImwSYt5HnZaqa4TAslrwxAOZi3gRm1K2/w=";
+    hash = "sha256-E/WXAVSCNTDEDaz71LXOHUf/APFO2uSpkTRhlZfQp0E=";
   };
 
-  npmDepsHash = "sha256-YguZtGn8CT4EqOQWS0GeNGBdZSC3Lj1gFR0ZiegWTJU=";
+  npmDepsHash = "sha256-vGaYjM13seVmRbVPyDIM+qhGTCj6rw/el6Dq3KMzDks=";
 
   nativeBuildInputs = [
     copyDesktopItems
@@ -46,7 +56,7 @@ buildNpmPackage rec {
     install -Dm644 sources/assets/icons/app.png $out/share/icons/hicolor/256x256/apps/webcord.png
 
     # Add xdg-utils to path via suffix, per PR #181171
-    makeWrapper '${electron_24}/bin/electron' $out/bin/webcord \
+    makeWrapper '${electron_25}/bin/electron' $out/bin/webcord \
       --prefix LD_LIBRARY_PATH : ${libPath}:$out/opt/webcord \
       --suffix PATH : "${lib.makeBinPath [ xdg-utils ]}" \
       --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform=wayland}}" \
@@ -66,6 +76,8 @@ buildNpmPackage rec {
     })
   ];
 
+  passthru.updateScript = nix-update-script { };
+
   meta = with lib; {
     description = "A Discord and Fosscord electron-based client implemented without Discord API";
     homepage = "https://github.com/SpacingBat3/WebCord";
@@ -73,6 +85,6 @@ buildNpmPackage rec {
     changelog = "https://github.com/SpacingBat3/WebCord/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ huantian ];
-    platforms = electron_24.meta.platforms;
+    platforms = electron_25.meta.platforms;
   };
 }
diff --git a/pkgs/applications/networking/instant-messengers/webcord/webcord-vencord/default.nix b/pkgs/applications/networking/instant-messengers/webcord/webcord-vencord/default.nix
index 1bac19630fc..d55af49f115 100644
--- a/pkgs/applications/networking/instant-messengers/webcord/webcord-vencord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/webcord/webcord-vencord/default.nix
@@ -2,8 +2,10 @@
 , substituteAll
 , lib
 , vencord-web-extension
+, electron_24
 }:
-webcord.overrideAttrs (old: {
+
+(webcord.overrideAttrs (old: {
   patches = (old.patches or [ ]) ++ [
     (substituteAll {
       src = ./add-extension.patch;
@@ -15,4 +17,8 @@ webcord.overrideAttrs (old: {
     description = "Webcord with Vencord web extension";
     maintainers = with maintainers; [ FlafyDev NotAShelf ];
   };
-})
+})).override {
+  # Webcord has updated to electron 25, but that causes a segfault
+  # when launching webcord-vencord on wayland, so downgrade it for now.
+  electron_25 = electron_24;
+}
diff --git a/pkgs/applications/networking/irc/weechat/scripts/multiline/default.nix b/pkgs/applications/networking/irc/weechat/scripts/multiline/default.nix
index 447d415c163..f61b4391e18 100644
--- a/pkgs/applications/networking/irc/weechat/scripts/multiline/default.nix
+++ b/pkgs/applications/networking/irc/weechat/scripts/multiline/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation {
   pname = "multiline";
-  version = "0.6.3";
+  version = "0.6.4";
 
   src = fetchurl {
-    url = "https://raw.githubusercontent.com/weechat/scripts/945315bed4bc2beaf1e47f9b946ffe8f638f77fe/perl/multiline.pl";
-    sha256 = "1smialb21ny7brhij4sbw46xvsmrdv6ig2da0ip63ga2afngwsy4";
+    url = "https://raw.githubusercontent.com/weechat/scripts/5f073d966e98d54344a91be4f5afc0ec9e2697dc/perl/multiline.pl";
+    sha256 = "sha256-TXbU2Q7Tm8iTwOQqrWpqHXuKrjoBFLyUWRsH+TsR9Lo=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/applications/version-management/gex/default.nix b/pkgs/applications/version-management/gex/default.nix
index 7bb39ef94e7..4675b22a619 100644
--- a/pkgs/applications/version-management/gex/default.nix
+++ b/pkgs/applications/version-management/gex/default.nix
@@ -8,24 +8,25 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "gex";
-  version = "0.4.0";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "Piturnah";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-eRforLvRVSrFWnI5UZEWr1L4UM3ABjAIvui1E1hzk5s=";
+    hash = "sha256-//sQ0s8bBQzuu5aO3RjPRjFuVYiGW6BwSPoCWKAx9DQ=";
   };
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ libgit2 ];
 
-  cargoHash = "sha256-OEaNERozmJL8gYe33V/m4HQNHi2I4KHpI6PTwFQkPSs=";
+  cargoHash = "sha256-rkhkFnRDtMTWFM+E5C4jR7TWtHdy3WUtIzvGDDLHqtE=";
 
   meta = with lib; {
     description = "Git Explorer: cross-platform git workflow improvement tool inspired by Magit";
     homepage = "https://github.com/Piturnah/gex";
+    changelog = "https://github.com/Piturnah/gex/releases/tag/${src.rev}";
     license = with licenses; [ asl20 /* or */ mit ];
-    maintainers = with maintainers; [ azd325 Br1ght0ne ];
+    maintainers = with maintainers; [ azd325 evanrichter piturnah ];
   };
 }
diff --git a/pkgs/applications/video/obs-studio/plugins/advanced-scene-switcher/default.nix b/pkgs/applications/video/obs-studio/plugins/advanced-scene-switcher/default.nix
index 428f5167907..f2df05ceca3 100644
--- a/pkgs/applications/video/obs-studio/plugins/advanced-scene-switcher/default.nix
+++ b/pkgs/applications/video/obs-studio/plugins/advanced-scene-switcher/default.nix
@@ -44,6 +44,7 @@ stdenv.mkDerivation rec {
 
   postUnpack = ''
     cp -r ${libremidi.src}/* $sourceRoot/deps/libremidi
+    chmod -R +w $sourceRoot/deps/libremidi
   '';
 
   postInstall = ''
diff --git a/pkgs/data/fonts/iosevka/default.nix b/pkgs/data/fonts/iosevka/default.nix
index 1e92a49a96b..47081a05a06 100644
--- a/pkgs/data/fonts/iosevka/default.nix
+++ b/pkgs/data/fonts/iosevka/default.nix
@@ -55,16 +55,16 @@ assert (extraParameters != null) -> set != null;
 
 buildNpmPackage rec {
   pname = if set != null then "iosevka-${set}" else "iosevka";
-  version = "24.1.4";
+  version = "25.0.1";
 
   src = fetchFromGitHub {
     owner = "be5invis";
     repo = "iosevka";
     rev = "v${version}";
-    hash = "sha256-+b+13D6dKHx9kvAKeN/ePcWGtDPpFB/dVwHTTprw7Co=";
+    hash = "sha256-clbqr4hGtIkbgPYovYXHGW+FUTEjAn3Oq7aoPFMgGJU=";
   };
 
-  npmDepsHash = "sha256-+LZQY64SdcEx+Mqb5qGelC7zbXdStJkDvcFWgUVTDnE=";
+  npmDepsHash = "sha256-TxMmUgwQPbSV+1qe0FEtSPAYwJRnpuQ+qOmWvrq9xKY=";
 
   nativeBuildInputs = [
     remarshal
diff --git a/pkgs/development/compilers/gcc/11/default.nix b/pkgs/development/compilers/gcc/11/default.nix
index f61e51e2cab..92abdebe49b 100644
--- a/pkgs/development/compilers/gcc/11/default.nix
+++ b/pkgs/development/compilers/gcc/11/default.nix
@@ -176,7 +176,8 @@ lib.pipe (stdenv.mkDerivation ({
 
   libc_dev = stdenv.cc.libc_dev;
 
-  hardeningDisable = [ "format" "pie" ];
+  hardeningDisable = [ "format" "pie" ]
+    ++ optional langAda "fortify3";
 
   postPatch = ''
     configureScripts=$(find . -name configure)
diff --git a/pkgs/development/compilers/pforth/default.nix b/pkgs/development/compilers/pforth/default.nix
index 59994b26aee..d0766fe1376 100644
--- a/pkgs/development/compilers/pforth/default.nix
+++ b/pkgs/development/compilers/pforth/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, buildPackages
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -14,14 +15,26 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-vEjFeHSJl+yAtatYJEnu+r9hmOr/kZOgIbSUXR/c8WU=";
   };
 
-  dontConfigure = true;
-
-  preBuild = ''
-    cd platforms/unix
+  # We build the dictionary in a cross-compile compatible way.
+  # For that, we perform steps, that the Makefile would otherwise do.
+  buildPhase = ''
+    runHook preBuild
+    make -C platforms/unix pfdicapp
+    pushd fth/
+    ${stdenv.hostPlatform.emulator buildPackages} ../platforms/unix/pforth -i system.fth
+    ${stdenv.hostPlatform.emulator buildPackages} ../platforms/unix/pforth -d pforth.dic <<< "include savedicd.fth sdad bye"
+    mv pforth.dic pfdicdat.h ../platforms/unix/
+    popd
+    make -C platforms/unix pforthapp
+    runHook postBuild
   '';
 
   installPhase = ''
-    install -Dm755 pforth_standalone $out/bin/pforth
+    runHook preInstall
+    install -Dm755 platforms/unix/pforth_standalone $out/bin/pforth
+    mkdir -p $out/share/pforth
+    cp -r fth/* $out/share/pforth/
+    runHook postInstall
   '';
 
   meta = {
diff --git a/pkgs/development/libraries/libremidi/default.nix b/pkgs/development/libraries/libremidi/default.nix
index 63a7f0ce528..d88ebeea3fb 100644
--- a/pkgs/development/libraries/libremidi/default.nix
+++ b/pkgs/development/libraries/libremidi/default.nix
@@ -9,15 +9,15 @@
 , stdenv
 }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
   pname = "libremidi";
-  version = "unstable-2023-05-05";
+  version = "3.0";
 
   src = fetchFromGitHub {
     owner = "jcelerier";
     repo = "libremidi";
-    rev = "cd2e52d59c8ecc97d751619072c4f4271fa82455";
-    hash = "sha256-CydoCprxqDl5FXjtgT+AckaRTqQAlCDwwrnPDK17A6o=";
+    rev = "v${version}";
+    hash = "sha256-aO83a0DmzwjYXDlPIsn136EkDF0406HadTXPoGuVF6I=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/python-modules/androidtvremote2/default.nix b/pkgs/development/python-modules/androidtvremote2/default.nix
index 8cbf32a6bd6..a876cf5e181 100644
--- a/pkgs/development/python-modules/androidtvremote2/default.nix
+++ b/pkgs/development/python-modules/androidtvremote2/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "androidtvremote2";
-  version = "0.0.10";
+  version = "0.0.11";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "tronikos";
     repo = "androidtvremote2";
     rev = "refs/tags/v${version}";
-    hash = "sha256-LjYXQTPTFS80gI3WeJOLrKZ0C0JhGb5p1M70P7n29hc=";
+    hash = "sha256-mjhohkAC6g2UJgPbq/29Awyy6c4M8SnLqr5v5g7+IeE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/before-after/default.nix b/pkgs/development/python-modules/before-after/default.nix
new file mode 100644
index 00000000000..919914d7fd7
--- /dev/null
+++ b/pkgs/development/python-modules/before-after/default.nix
@@ -0,0 +1,35 @@
+{ buildPythonPackage, fetchPypi, fetchpatch, pytestCheckHook, lib }:
+
+buildPythonPackage rec {
+  pname = "before-after";
+  version = "1.0.1";
+
+  src = fetchPypi {
+    pname = "before_after";
+    inherit version;
+    hash = "sha256-x9T5uLi7UgldoUxLnFnqaz9bnqn9zop7/HLsrg9aP4U=";
+  };
+
+  patches = [
+    # drop 'mock' dependency for python >=3.3
+    (fetchpatch {
+      url = "https://github.com/c-oreills/before_after/commit/cf3925148782c8c290692883d1215ae4d2c35c3c.diff";
+      hash = "sha256-FYCpLxcOLolNPiKzHlgrArCK/QKCwzag+G74wGhK4dc=";
+    })
+    (fetchpatch {
+      url = "https://github.com/c-oreills/before_after/commit/11c0ecc7e8a2f90a762831e216c1bc40abfda43a.diff";
+      hash = "sha256-8YJumF/U8H+hc7rLZLy3UhXHdYJmcuN+O8kMx8yqMJ0=";
+    })
+  ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "before_after" ];
+
+  meta = with lib; {
+    description = "sugar over the Mock library to help test race conditions";
+    homepage = "https://github.com/c-oreills/before_after";
+    maintainers = with maintainers; [ yuka ];
+    license = licenses.gpl2Only;
+  };
+}
diff --git a/pkgs/development/python-modules/devolo-plc-api/default.nix b/pkgs/development/python-modules/devolo-plc-api/default.nix
index 8170601914a..d352925308c 100644
--- a/pkgs/development/python-modules/devolo-plc-api/default.nix
+++ b/pkgs/development/python-modules/devolo-plc-api/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "devolo-plc-api";
-  version = "1.3.1";
+  version = "1.3.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "2Fake";
     repo = "devolo_plc_api";
     rev = "refs/tags/v${version}";
-    hash = "sha256-wJyBCQ9rk+UwjWhMIeqsIbMR8cXA9Xu+lmubJoOauEg=";
+    hash = "sha256-viOyxgFydPrTPFz6JsjJT6IiUIeoIwd+bcrAJfomDI8=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/django-cacheops/default.nix b/pkgs/development/python-modules/django-cacheops/default.nix
index 971a65eeb1d..f7ce71a84f6 100644
--- a/pkgs/development/python-modules/django-cacheops/default.nix
+++ b/pkgs/development/python-modules/django-cacheops/default.nix
@@ -1,27 +1,40 @@
-{ lib
+{ stdenv
+, lib
 , buildPythonPackage
 , fetchPypi
+, pythonRelaxDepsHook
 , django
 , funcy
 , redis
-, pytest-django
+, six
 , pytestCheckHook
+, pytest-django
+, mock
+, dill
+, jinja2
+, before-after
 , pythonOlder
-, six
+, nettools
+, pkgs
 }:
 
 buildPythonPackage rec {
   pname = "django-cacheops";
-  version = "6.2";
+  version = "7.0.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-zHP9ChwUeZJT/yCopFeRo8jSgCIXswHnDPoIroGeQ48=";
+    hash = "sha256-Ed3qh90DlWiXikCD2JyJ37hm6lWnpI+2haaPwZiotlA=";
   };
 
+  nativeBuildInputs = [
+    pythonRelaxDepsHook
+  ];
+  pythonRelaxDeps = [ "funcy" ];
+
   propagatedBuildInputs = [
     django
     funcy
@@ -32,23 +45,21 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     pytestCheckHook
     pytest-django
+    mock
+    dill
+    jinja2
+    before-after
+    nettools
+    pkgs.redis
   ];
 
-  disabledTests = [
-    # Tests require networking
-    "test_cached_as"
-    "test_invalidation_signal"
-    "test_queryset"
-    "test_queryset_empty"
-    "test_lock"
-    "test_context_manager"
-    "test_decorator"
-    "test_in_transaction"
-    "test_nested"
-    "test_unhashable_args"
-    "test_db_agnostic_by_default"
-    "test_db_agnostic_disabled"
-  ];
+  preCheck = ''
+    redis-server &
+    while ! redis-cli --scan ; do
+      echo waiting for redis to be ready
+      sleep 1
+    done
+  '';
 
   DJANGO_SETTINGS_MODULE = "tests.settings";
 
@@ -58,8 +69,7 @@ buildPythonPackage rec {
     changelog = "https://github.com/Suor/django-cacheops/blob/${version}/CHANGELOG";
     license = licenses.bsd3;
     maintainers = with maintainers; [ onny ];
-    # No support for funcy > 2
-    # https://github.com/Suor/django-cacheops/issues/454
-    broken = true;
+    # Times out for unknown reasons
+    broken = stdenv.isDarwin;
   };
 }
diff --git a/pkgs/development/python-modules/google-cloud-pubsub/default.nix b/pkgs/development/python-modules/google-cloud-pubsub/default.nix
index 3a94d6d7ef2..6472f1fc32f 100644
--- a/pkgs/development/python-modules/google-cloud-pubsub/default.nix
+++ b/pkgs/development/python-modules/google-cloud-pubsub/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-pubsub";
-  version = "2.17.1";
+  version = "2.18.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-BZNCjsuwJJy150G0A+lcPUIbRpfIPrftTBaE3/F2x1M=";
+    hash = "sha256-enDfQRHZy2lKJc7N0jKIJxWcUhOuHmMEyzq7OPN53Sk=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/maxminddb/default.nix b/pkgs/development/python-modules/maxminddb/default.nix
index b9ff8bf437b..90acdef2d36 100644
--- a/pkgs/development/python-modules/maxminddb/default.nix
+++ b/pkgs/development/python-modules/maxminddb/default.nix
@@ -1,34 +1,40 @@
-{ stdenv
-, lib
+{ lib
+, stdenv
 , buildPythonPackage
-, pythonOlder
-, pythonAtLeast
 , fetchPypi
 , libmaxminddb
-, mock
-, nose
+, pytestCheckHook
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "maxminddb";
-  version = "2.3.0";
-  disabled = pythonOlder "3.6";
+  version = "2.4.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-Egkg3d2VXzKuSMIHxs72/V3Ih0qIm6lLDywfc27N8wg=";
+    hash = "sha256-geVOU0CL1QJlDllpzLoWeAr2WewdscRLLJl+QzCl7ZY=";
   };
 
-  buildInputs = [ libmaxminddb ];
+  buildInputs = [
+    libmaxminddb
+  ];
 
-  nativeCheckInputs = [ nose mock ];
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
 
-  # Tests are broken for macOS on python38
-  doCheck = !(stdenv.isDarwin && pythonAtLeast "3.8");
+  pythonImportsCheck = [
+    "maxminddb"
+  ];
 
   meta = with lib; {
     description = "Reader for the MaxMind DB format";
     homepage = "https://github.com/maxmind/MaxMind-DB-Reader-python";
+    changelog = "https://github.com/maxmind/MaxMind-DB-Reader-python/blob/v${version}/HISTORY.rst";
     license = licenses.asl20;
     maintainers = with maintainers; [ ];
   };
diff --git a/pkgs/development/python-modules/metar/default.nix b/pkgs/development/python-modules/metar/default.nix
index dca7c5359a0..b130672810e 100644
--- a/pkgs/development/python-modules/metar/default.nix
+++ b/pkgs/development/python-modules/metar/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "metar";
-  version = "1.10.0";
+  version = "1.11.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     owner = "python-metar";
     repo = "python-metar";
     rev = "refs/tags/v${version}";
-    hash = "sha256-53vgnViEYuMVKEnIZ2BNyIUrURR2rwopx7RWyFmF5PA=";
+    hash = "sha256-ZDjlXcSTUcSP7oRdhzLpXf/fLUA7Nkc6nj2I6vovbHg=";
   };
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/mypy-boto3-s3/default.nix b/pkgs/development/python-modules/mypy-boto3-s3/default.nix
index 628d0b32209..78f7f1acfda 100644
--- a/pkgs/development/python-modules/mypy-boto3-s3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3-s3/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "mypy-boto3-s3";
-  version = "1.28.0";
+  version = "1.28.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-J4Z8oyWoRXAKAI8/yplQBrMvLg0Yr+Z2NStJRT9HfWk=";
+    hash = "sha256-wrRUQTEmB5pkNKPgWnXLTK2UfHYk5TujhGy4KaIjDEs=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/opower/default.nix b/pkgs/development/python-modules/opower/default.nix
index f6941970a08..26342ab42db 100644
--- a/pkgs/development/python-modules/opower/default.nix
+++ b/pkgs/development/python-modules/opower/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "opower";
-  version = "0.0.13";
+  version = "0.0.14";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "tronikos";
     repo = "opower";
     rev = "refs/tags/v${version}";
-    hash = "sha256-WZRJnvZYycOoLNhtShXQ3HPNqyoJymUx+Xwg5gPWGKg=";
+    hash = "sha256-eTlFb/v88jaEzx5H8ofHMNkqPunDvXcXGvg5ThripeA=";
   };
 
   pythonRemoveDeps = [
diff --git a/pkgs/development/python-modules/xarray-einstats/default.nix b/pkgs/development/python-modules/xarray-einstats/default.nix
index c795568149e..78f7c101fd3 100644
--- a/pkgs/development/python-modules/xarray-einstats/default.nix
+++ b/pkgs/development/python-modules/xarray-einstats/default.nix
@@ -14,16 +14,16 @@
 
 buildPythonPackage rec {
   pname = "xarray-einstats";
-  version = "0.5.1";
+  version = "0.6.0";
   format = "pyproject";
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.9";
 
   src = fetchFromGitHub {
     owner = "arviz-devs";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-oDrNR7iVDg7Piti6JNaXGekfrUfK5GWJYbH/g6m4570=";
+    hash = "sha256-TXuNqXsny7VpJqV5/3riKzXLheZl+qF+zf4SCMipzmw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/yalexs-ble/default.nix b/pkgs/development/python-modules/yalexs-ble/default.nix
index 4cf4906e09e..2431a9101a5 100644
--- a/pkgs/development/python-modules/yalexs-ble/default.nix
+++ b/pkgs/development/python-modules/yalexs-ble/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "yalexs-ble";
-  version = "2.1.18";
+  version = "2.2.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "bdraco";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-bLxKq/MNbVIv9CV67NeOqn49cYu7gwcBnbZEtlreQzQ=";
+    hash = "sha256-ei/+QfDjuzbKFZ8Nl+KnCJB6xu7xZh0m6LnzHUEg790=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/melange/default.nix b/pkgs/development/tools/melange/default.nix
new file mode 100644
index 00000000000..f5a5eb8ee85
--- /dev/null
+++ b/pkgs/development/tools/melange/default.nix
@@ -0,0 +1,72 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, installShellFiles
+}:
+
+buildGoModule rec {
+  pname = "melange";
+  version = "0.4.0";
+
+  src = fetchFromGitHub {
+    owner = "chainguard-dev";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-sEmbfX7W1juymAxcWwDNxI8d/o7NS2S+0TJM6Vi9aQo=";
+    # populate values that require us to use git. By doing this in postFetch we
+    # can delete .git afterwards and maintain better reproducibility of the src.
+    leaveDotGit = true;
+    postFetch = ''
+      cd "$out"
+      git rev-parse HEAD > $out/COMMIT
+      # in format of 0000-00-00T00:00:00Z
+      date -u -d "@$(git log -1 --pretty=%ct)" "+%Y-%m-%dT%H:%M:%SZ" > $out/SOURCE_DATE_EPOCH
+      find "$out" -name .git -print0 | xargs -0 rm -rf
+    '';
+  };
+
+  vendorHash = "sha256-IkbXZu6iHRXjWFsLtRBDxwJio5sVVZvHylk1al0S+/c=";
+
+  subPackages = [ "." ];
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X sigs.k8s.io/release-utils/version.gitVersion=v${version}"
+    "-X sigs.k8s.io/release-utils/version.gitTreeState=clean"
+  ];
+
+  # ldflags based on metadata from git and source
+  preBuild = ''
+    ldflags+=" -X sigs.k8s.io/release-utils/version.gitCommit=$(cat COMMIT)"
+    ldflags+=" -X sigs.k8s.io/release-utils/version.buildDate=$(cat SOURCE_DATE_EPOCH)"
+  '';
+
+  postInstall = ''
+    installShellCompletion --cmd melange \
+      --bash <($out/bin/melange completion bash) \
+      --fish <($out/bin/melange completion fish) \
+      --zsh <($out/bin/melange completion zsh)
+  '';
+
+  doInstallCheck = true;
+
+  installCheckPhase = ''
+    runHook preInstallCheck
+
+    $out/bin/melange --help
+    $out/bin/melange version 2>&1 | grep "v${version}"
+
+    runHook postInstallCheck
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/chainguard-dev/melange";
+    changelog = "https://github.com/chainguard-dev/melange/blob/${src.rev}/NEWS.md";
+    description = "Build APKs from source code";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ developer-guy ];
+  };
+}
diff --git a/pkgs/development/tools/mold/default.nix b/pkgs/development/tools/mold/default.nix
index 04ed7db7114..ac60a01a1ae 100644
--- a/pkgs/development/tools/mold/default.nix
+++ b/pkgs/development/tools/mold/default.nix
@@ -33,6 +33,10 @@ stdenv.mkDerivation rec {
     mimalloc
   ];
 
+  patches = [
+    ./fix-debug-strip.patch # fix --debug-strip; https://github.com/rui314/mold/pull/1038
+  ];
+
   postPatch = ''
     sed -i CMakeLists.txt -e '/.*set(DEST\ .*/d'
   '';
diff --git a/pkgs/development/tools/mold/fix-debug-strip.patch b/pkgs/development/tools/mold/fix-debug-strip.patch
new file mode 100644
index 00000000000..78906efc73a
--- /dev/null
+++ b/pkgs/development/tools/mold/fix-debug-strip.patch
@@ -0,0 +1,23 @@
+From b699b73451c57ac01c2680c0b86e1f56ca19e51c Mon Sep 17 00:00:00 2001
+From: Jakub Konka <kubkon@jakubkonka.com>
+Date: Sat, 6 May 2023 07:55:46 +0200
+Subject: [PATCH] Fix handling of --debug-strip
+
+Signed-off-by: Jakub Konka <kubkon@jakubkonka.com>
+---
+ elf/cmdline.cc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/elf/cmdline.cc b/elf/cmdline.cc
+index 3ac19f237..731af63ab 100644
+--- a/elf/cmdline.cc
++++ b/elf/cmdline.cc
+@@ -994,7 +994,7 @@ std::vector<std::string> parse_nonpositional_args(Context<E> &ctx) {
+     } else if (read_flag("strip-all") || read_flag("s")) {
+       ctx.arg.strip_all = true;
+     } else if (read_flag("strip-debug") || read_flag("S")) {
+-      ctx.arg.strip_all = true;
++      ctx.arg.strip_debug = true;
+     } else if (read_flag("warn-unresolved-symbols")) {
+       ctx.arg.unresolved_symbols = UNRESOLVED_WARN;
+     } else if (read_flag("error-unresolved-symbols")) {
diff --git a/pkgs/development/tools/yarn2nix-moretea/yarn2nix/default.nix b/pkgs/development/tools/yarn2nix-moretea/yarn2nix/default.nix
index e0bd54fd11a..914296d7095 100644
--- a/pkgs/development/tools/yarn2nix-moretea/yarn2nix/default.nix
+++ b/pkgs/development/tools/yarn2nix-moretea/yarn2nix/default.nix
@@ -71,7 +71,7 @@ in rec {
     yarnFlags ? [ ],
     ignoreScripts ? true,
     nodejs ? inputs.nodejs,
-    yarn ? inputs.yarn.override { nodejs = nodejs; },
+    yarn ? inputs.yarn.override { inherit nodejs; },
     pkgConfig ? {},
     preBuild ? "",
     postBuild ? "",
@@ -88,7 +88,7 @@ in rec {
           (key: pkgConfig.${key}.buildInputs or [])
           (builtins.attrNames pkgConfig);
 
-      postInstall = (builtins.map (key:
+      postInstall = builtins.map (key:
         if (pkgConfig.${key} ? postInstall) then
           ''
             for f in $(find -L -path '*/node_modules/${key}' -type d); do
@@ -97,7 +97,7 @@ in rec {
           ''
         else
           ""
-      ) (builtins.attrNames pkgConfig));
+      ) (builtins.attrNames pkgConfig);
 
       # build-time JSON generation to avoid IFD
       # see https://nixos.wiki/wiki/Import_From_Derivation
@@ -180,7 +180,7 @@ in rec {
     packageJSON ? src + "/package.json",
     yarnLock ? src + "/yarn.lock",
     nodejs ? inputs.nodejs,
-    yarn ? inputs.yarn.override { nodejs = nodejs; },
+    yarn ? inputs.yarn.override { inherit nodejs; },
     packageOverrides ? {},
     ...
   }@attrs:
@@ -254,7 +254,7 @@ in rec {
     yarnNix ? mkYarnNix { inherit yarnLock; },
     offlineCache ? importOfflineCache yarnNix,
     nodejs ? inputs.nodejs,
-    yarn ? inputs.yarn.override { nodejs = nodejs; },
+    yarn ? inputs.yarn.override { inherit nodejs; },
     yarnFlags ? [ ],
     yarnPreBuild ? "",
     yarnPostBuild ? "",
@@ -267,8 +267,8 @@ in rec {
   }@attrs:
     let
       package = lib.importJSON packageJSON;
-      pname = package.name;
-      safeName = reformatPackageName pname;
+      pname = attrs.pname or package.name;
+      safeName = reformatPackageName package.name;
       version = attrs.version or package.version;
       baseName = unlessNull name "${safeName}-${version}";
 
@@ -278,14 +278,15 @@ in rec {
       );
 
       deps = mkYarnModules {
+        pname = package.name;
         name = "${safeName}-modules-${version}";
         preBuild = yarnPreBuild;
         postBuild = yarnPostBuild;
         workspaceDependencies = workspaceDependenciesTransitive;
-        inherit packageJSON pname version yarnLock offlineCache nodejs yarn yarnFlags pkgConfig packageResolutions;
+        inherit packageJSON version yarnLock offlineCache nodejs yarn yarnFlags pkgConfig packageResolutions;
       };
 
-      publishBinsFor_ = unlessNull publishBinsFor [pname];
+      publishBinsFor_ = unlessNull publishBinsFor [ package.name ];
 
       linkDirFunction = ''
         linkDirToDirLinks() {
@@ -307,17 +308,17 @@ in rec {
       workspaceDependencyCopy = lib.concatMapStringsSep "\n"
         (dep: ''
           # ensure any existing scope directory is not a symlink
-          linkDirToDirLinks "$(dirname node_modules/${dep.pname})"
-          mkdir -p "deps/${dep.pname}"
-          tar -xf "${dep}/tarballs/${dep.name}.tgz" --directory "deps/${dep.pname}" --strip-components=1
-          if [ ! -e "deps/${dep.pname}/node_modules" ]; then
-            ln -s "${deps}/deps/${dep.pname}/node_modules" "deps/${dep.pname}/node_modules"
+          linkDirToDirLinks "$(dirname node_modules/${dep.package.name})"
+          mkdir -p "deps/${dep.package.name}"
+          tar -xf "${dep}/tarballs/${dep.name}.tgz" --directory "deps/${dep.package.name}" --strip-components=1
+          if [ ! -e "deps/${dep.package.name}/node_modules" ]; then
+            ln -s "${deps}/deps/${dep.package.name}/node_modules" "deps/${dep.package.name}/node_modules"
           fi
         '')
         workspaceDependenciesTransitive;
 
     in stdenv.mkDerivation (builtins.removeAttrs attrs ["yarnNix" "pkgConfig" "workspaceDependencies" "packageResolutions"] // {
-      inherit src version pname;
+      inherit pname version src;
 
       name = baseName;
 
@@ -335,27 +336,27 @@ in rec {
           fi
         done
 
-        # move convent of . to ./deps/${pname}
+        # move convent of . to ./deps/${package.name}
         mv $PWD $NIX_BUILD_TOP/temp
-        mkdir -p "$PWD/deps/${pname}"
-        rm -fd "$PWD/deps/${pname}"
-        mv $NIX_BUILD_TOP/temp "$PWD/deps/${pname}"
+        mkdir -p "$PWD/deps/${package.name}"
+        rm -fd "$PWD/deps/${package.name}"
+        mv $NIX_BUILD_TOP/temp "$PWD/deps/${package.name}"
         cd $PWD
 
-        ln -s ${deps}/deps/${pname}/node_modules "deps/${pname}/node_modules"
+        ln -s ${deps}/deps/${package.name}/node_modules "deps/${package.name}/node_modules"
 
         cp -r $node_modules node_modules
         chmod -R +w node_modules
 
         ${linkDirFunction}
 
-        linkDirToDirLinks "$(dirname node_modules/${pname})"
-        ln -s "deps/${pname}" "node_modules/${pname}"
+        linkDirToDirLinks "$(dirname node_modules/${package.name})"
+        ln -s "deps/${package.name}" "node_modules/${package.name}"
 
         ${workspaceDependencyCopy}
 
         # Help yarn commands run in other phases find the package
-        echo "--cwd deps/${pname}" > .yarnrc
+        echo "--cwd deps/${package.name}" > .yarnrc
         runHook postConfigure
       '';
 
@@ -364,11 +365,11 @@ in rec {
       installPhase = attrs.installPhase or ''
         runHook preInstall
 
-        mkdir -p $out/{bin,libexec/${pname}}
-        mv node_modules $out/libexec/${pname}/node_modules
-        mv deps $out/libexec/${pname}/deps
+        mkdir -p $out/{bin,libexec/${package.name}}
+        mv node_modules $out/libexec/${package.name}/node_modules
+        mv deps $out/libexec/${package.name}/deps
 
-        node ${./internal/fixup_bin.js} $out/bin $out/libexec/${pname}/node_modules ${lib.concatStringsSep " " publishBinsFor_}
+        node ${./internal/fixup_bin.js} $out/bin $out/libexec/${package.name}/node_modules ${lib.concatStringsSep " " publishBinsFor_}
 
         runHook postInstall
       '';
@@ -378,13 +379,13 @@ in rec {
       distPhase = attrs.distPhase or ''
         # pack command ignores cwd option
         rm -f .yarnrc
-        cd $out/libexec/${pname}/deps/${pname}
+        cd $out/libexec/${package.name}/deps/${package.name}
         mkdir -p $out/tarballs/
         yarn pack --offline --ignore-scripts --filename $out/tarballs/${baseName}.tgz
       '';
 
       passthru = {
-        inherit pname package packageJSON deps;
+        inherit package packageJSON deps;
         workspaceDependencies = workspaceDependenciesTransitive;
       } // (attrs.passthru or {});
 
@@ -403,7 +404,7 @@ in rec {
 
         mkFilter = { dirsToInclude, filesToInclude, root }: path: type:
           let
-            inherit (pkgs.lib) any flip elem hasSuffix hasPrefix elemAt splitString;
+            inherit (lib) elem elemAt splitString;
 
             subpath = elemAt (splitString "${toString root}/" path) 1;
             spdir = elemAt (splitString "/" subpath) 0;
diff --git a/pkgs/games/doom-ports/rbdoom-3-bfg/default.nix b/pkgs/games/doom-ports/rbdoom-3-bfg/default.nix
index a6588ef4cc6..c17adb72171 100644
--- a/pkgs/games/doom-ports/rbdoom-3-bfg/default.nix
+++ b/pkgs/games/doom-ports/rbdoom-3-bfg/default.nix
@@ -59,6 +59,9 @@ stdenv.mkDerivation rec {
     "-DUSE_SYSTEM_ZLIB=ON"
   ];
 
+  # it caused build failure
+  hardeningDisable = [ "fortify3" ];
+
   installPhase = ''
     runHook preInstall
 
diff --git a/pkgs/games/gemrb/default.nix b/pkgs/games/gemrb/default.nix
index 66b6faa3255..7768ccf7625 100644
--- a/pkgs/games/gemrb/default.nix
+++ b/pkgs/games/gemrb/default.nix
@@ -27,13 +27,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "gemrb";
-  version = "0.9.1.1";
+  version = "0.9.2";
 
   src = fetchFromGitHub {
     owner = "gemrb";
     repo = "gemrb";
     rev = "v${version}";
-    hash = "sha256-pC83LgAy1aQxUhS2qa57hm03B37bj6dcRVRn7SI5I+k=";
+    hash = "sha256-riea48Jc9zYb19mf5sBunTp5l27PGRFd/B5KdCUWr6Y=";
   };
 
   buildInputs = [
diff --git a/pkgs/os-specific/linux/intel-compute-runtime/default.nix b/pkgs/os-specific/linux/intel-compute-runtime/default.nix
index 3dba3de332c..5be94f22f5e 100644
--- a/pkgs/os-specific/linux/intel-compute-runtime/default.nix
+++ b/pkgs/os-specific/linux/intel-compute-runtime/default.nix
@@ -35,6 +35,9 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "drivers" ];
 
+  # causes redefinition of _FORTIFY_SOURCE
+  hardeningDisable = [ "fortify3" ];
+
   postInstall = ''
     # Avoid clash with intel-ocl
     mv $out/etc/OpenCL/vendors/intel.icd $out/etc/OpenCL/vendors/intel-neo.icd
diff --git a/pkgs/servers/dendrite/default.nix b/pkgs/servers/dendrite/default.nix
index 67b91bbe5cd..4faa08142cf 100644
--- a/pkgs/servers/dendrite/default.nix
+++ b/pkgs/servers/dendrite/default.nix
@@ -3,16 +3,16 @@
 
 buildGoModule rec {
   pname = "matrix-dendrite";
-  version = "0.12.0";
+  version = "0.13.1";
 
   src = fetchFromGitHub {
     owner = "matrix-org";
     repo = "dendrite";
     rev = "v${version}";
-    hash = "sha256-syOLrw4ig8rmFDkxJ9KSAuzUVO8UokekV17mT1bJNNM=";
+    hash = "sha256-2DqEfTXD3W6MxfBb6aHaKH+zpxLc2tHaGuWGQuncySo=";
   };
 
-  vendorHash = "sha256-nvGhKCUiyHSD0VpE4OtT9YQSHxv0d7iwOChCJl2D3zk=";
+  vendorHash = "sha256-dc0zpKh7J+fi2b5GD/0BQ120UXbBvJLUF74RmYMSOMw=";
 
   subPackages = [
     # The server
diff --git a/pkgs/servers/dns/pdns-recursor/default.nix b/pkgs/servers/dns/pdns-recursor/default.nix
index da0890e8e4d..7bd5f874b14 100644
--- a/pkgs/servers/dns/pdns-recursor/default.nix
+++ b/pkgs/servers/dns/pdns-recursor/default.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "pdns-recursor";
-  version = "4.8.4";
+  version = "4.9.0";
 
   src = fetchurl {
     url = "https://downloads.powerdns.com/releases/pdns-recursor-${version}.tar.bz2";
-    sha256 = "sha256-8KY/0I4D2oL6INMz6lF50bkln0JkVGz0mVKGZ32UWMc=";
+    sha256 = "sha256-028WKEPjZ2RqZhp4XKC+zem2hVKFW/QFMq66+hA5ZvM=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/servers/dns/pdns/default.nix b/pkgs/servers/dns/pdns/default.nix
index fcd218a1f3c..ab95b5cedbb 100644
--- a/pkgs/servers/dns/pdns/default.nix
+++ b/pkgs/servers/dns/pdns/default.nix
@@ -23,11 +23,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pdns";
-  version = "4.8.0";
+  version = "4.8.1";
 
   src = fetchurl {
     url = "https://downloads.powerdns.com/releases/pdns-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-YalruviwykmpIloiVLlEPE/44FDTN0N9ha9N6InhASc=";
+    hash = "sha256-Zt0+4mVPQrTrgCYPlOy0jjE6gYF/WBJc5IwUwtJuMJ4=";
   };
   # redact configure flags from version output to reduce closure size
   patches = [ ./version.patch ];
diff --git a/pkgs/servers/homepage-dashboard/default.nix b/pkgs/servers/homepage-dashboard/default.nix
new file mode 100644
index 00000000000..1c8c283e9c3
--- /dev/null
+++ b/pkgs/servers/homepage-dashboard/default.nix
@@ -0,0 +1,82 @@
+{ buildNpmPackage
+, fetchFromGitHub
+, nodePackages
+, python3
+, lib
+, fetchpatch
+, makeBinaryWrapper
+, nixosTests
+}:
+
+buildNpmPackage rec {
+  pname = "homepage-dashboard";
+  version = "0.6.21";
+
+  src = fetchFromGitHub {
+    owner = "benphelps";
+    repo = "homepage";
+    rev = "v${version}";
+    hash = "sha256-kjxA02hJj/GAQ0fM1xTtXAnZSQgVyE+EMRrXis1Vr+o=";
+  };
+
+  npmDepsHash = "sha256-O6SQYx5vxscMsbWv0ynUYqdUkOp/nMtdvlZ/Mp95sBY=";
+
+  patches = [
+    (fetchpatch {
+      name = "env-config-dir.patch";
+      url = "https://github.com/benphelps/homepage/commit/ca396ce96bce52f6c06a321f292aa94a66ceeb97.patch";
+      hash = "sha256-eNnW/ce4ytoKR6jH1Ztc4UTWOmL0uGRdY6nYBIVYM6k=";
+    })
+  ];
+
+  preBuild = ''
+    mkdir -p config
+  '';
+
+  postBuild = ''
+    # Add a shebang to the server js file, then patch the shebang.
+    sed -i '1s|^|#!/usr/bin/env node\n|' .next/standalone/server.js
+    patchShebangs .next/standalone/server.js
+  '';
+
+  buildInputs = [
+    nodePackages.node-gyp-build
+  ];
+
+  env.PYTHON = "${python3}/bin/python";
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out
+    cp -r .next/standalone $out/bin
+    cp -r public $out/bin/public
+
+    mkdir -p $out/bin/.next
+    cp -r .next/static $out/bin/.next/static
+
+    mv $out/bin/server.js $out/bin/homepage
+    chmod +x $out/bin/homepage
+
+    wrapProgram $out/bin/homepage \
+      --set-default PORT 3000 \
+      --set-default HOMEPAGE_CONFIG_DIR /var/lib/homepage-dashboard
+
+    runHook postInstall
+  '';
+
+  doDist = false;
+
+  passthru.tests = {
+    inherit (nixosTests) homepage;
+  };
+
+  meta = {
+    description = "A highly customisable dashboard with Docker and service API integrations.";
+    mainProgram = "homepage";
+    homepage = "https://gethomepage.dev";
+    license = lib.licenses.gpl3;
+    maintainers = with lib.maintainers; [ jnsgruk ];
+    platforms = lib.platforms.all;
+  };
+}
diff --git a/pkgs/servers/web-apps/peering-manager/default.nix b/pkgs/servers/web-apps/peering-manager/default.nix
index 8b6e77ec0f1..eb07edabf4d 100644
--- a/pkgs/servers/web-apps/peering-manager/default.nix
+++ b/pkgs/servers/web-apps/peering-manager/default.nix
@@ -2,6 +2,7 @@
 , fetchFromGitHub
 , fetchpatch
 , nixosTests
+, lib
 
 , plugins ? ps: []
 }:
@@ -93,4 +94,12 @@ in py.pkgs.buildPythonApplication rec {
       inherit (nixosTests) peering-manager;
     };
   };
+
+  meta = with lib; {
+    homepage = "https://peering-manager.net/";
+    license = licenses.asl20;
+    description = "BGP sessions management tool";
+    maintainers = with maintainers; [ yuka ];
+    platforms = platforms.linux;
+  };
 }
diff --git a/pkgs/tools/graphics/astc-encoder/default.nix b/pkgs/tools/graphics/astc-encoder/default.nix
index 2909a2c1251..5e63038e67d 100644
--- a/pkgs/tools/graphics/astc-encoder/default.nix
+++ b/pkgs/tools/graphics/astc-encoder/default.nix
@@ -16,11 +16,9 @@ with rec {
     else if isAarch64 then [ "NEON" ]
     else [ "NONE" ];
 
-  archFlags = lib.optionals stdenv.hostPlatform.isAarch64 [ "-DARCH=aarch64" ];
-
   # CMake Build flags for the selected ISAs. For a list of flags, see
   # https://github.com/ARM-software/astc-encoder/blob/main/Docs/Building.md
-  isaFlags = map ( isa: "-DISA_${isa}=ON" ) isas;
+  isaFlags = map ( isa: "-DASTCENC_ISA_${isa}=ON" ) isas;
 
   # The suffix of the binary to link as 'astcenc'
   mainBinary = builtins.replaceStrings
@@ -31,25 +29,26 @@ with rec {
 
 stdenv.mkDerivation rec {
   pname = "astc-encoder";
-  version = "4.4.0";
+  version = "4.5.0";
 
   src = fetchFromGitHub {
     owner = "ARM-software";
     repo = "astc-encoder";
     rev = version;
-    sha256 = "sha256-pJmMquORG+vN2uLPywAZY1iZTuHB4SdMP/eriAjnyUU=";
+    sha256 = "sha256-pNoBOp//xa5F6/T1cwtdHsAWLZeIHgxZ7UKaB60fg4M=";
   };
 
   nativeBuildInputs = [ cmake ];
 
-  cmakeFlags = isaFlags ++ archFlags ++ [
+  cmakeFlags = isaFlags ++ [
     "-DCMAKE_BUILD_TYPE=RelWithDebInfo"
+    "-DASTCENC_UNIVERSAL_BUILD=OFF"
   ];
 
   # Set a fixed build year to display within help output (otherwise, it would be 1980)
   postPatch = ''
     substituteInPlace Source/cmake_core.cmake \
-      --replace 'string(TIMESTAMP astcencoder_YEAR "%Y")' 'set(astcencoder_YEAR "2022")'
+      --replace 'string(TIMESTAMP astcencoder_YEAR "%Y")' 'set(astcencoder_YEAR "2023")'
   '';
 
   # Provide 'astcenc' link to main executable
diff --git a/pkgs/tools/misc/invoice/default.nix b/pkgs/tools/misc/invoice/default.nix
new file mode 100644
index 00000000000..cffdec4063e
--- /dev/null
+++ b/pkgs/tools/misc/invoice/default.nix
@@ -0,0 +1,24 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "invoice";
+  version = "0.1.0";
+
+  src = fetchFromGitHub {
+    owner = "maaslalani";
+    repo = "invoice";
+    rev = "v${version}";
+    hash = "sha256-WtQ4nF31uIoplY18GZNs41ZOCxmbIu71YpEGk8aTGww=";
+  };
+
+  vendorHash = "sha256-8VhBflnpsJ5h8S6meDFZKCcS2nz5u4kPE9W710gJG4U=";
+
+  ldflags = [ "-s" "-w" ];
+
+  meta = with lib; {
+    description = "Command line invoice generator";
+    homepage = "https://github.com/maaslalani/invoice";
+    license = licenses.mit;
+    maintainers = with maintainers; [ dit7ya ];
+  };
+}
diff --git a/pkgs/tools/misc/rauc/default.nix b/pkgs/tools/misc/rauc/default.nix
index c6bb154ab22..72cc8d8945f 100644
--- a/pkgs/tools/misc/rauc/default.nix
+++ b/pkgs/tools/misc/rauc/default.nix
@@ -18,22 +18,15 @@
 
 stdenv.mkDerivation rec {
   pname = "rauc";
-  version = "1.9";
+  version = "1.10";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-VpHcJUTRZ5aJyfYypjVsYyRNrK0+9ci42mmlZQSkWAk=";
+    sha256 = "sha256-WiN2lTS6LCVCeVyX0/2rSDLL2tKsAhWSMa95fK05UOg=";
   };
 
-  patches = [
-    (fetchpatch {
-      # Patch to install the man page when using meson, remove on package bump
-      url = "https://github.com/rauc/rauc/commit/756c677d031c435070a6900e6778d06961822261.patch";
-      hash = "sha256-QgIUagioRo61PeC0JyKjZtnauFiYP1Fz9wrxGEikBGI=";
-    })
-  ];
   passthru = {
     updateScript = nix-update-script { };
   };
diff --git a/pkgs/tools/networking/tunwg/default.nix b/pkgs/tools/networking/tunwg/default.nix
new file mode 100644
index 00000000000..25cf5a0a9be
--- /dev/null
+++ b/pkgs/tools/networking/tunwg/default.nix
@@ -0,0 +1,27 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
+
+buildGoModule rec {
+  pname = "tunwg";
+  version = "23.06.14+dbfe3aa";
+
+  src = fetchFromGitHub {
+    owner = "ntnj";
+    repo = "tunwg";
+    rev = "v${version}";
+    hash = "sha256-w7rx2Q0VXQBETmHROcVWzh0TIEjiITpI5CR9jvtXF7E=";
+  };
+
+  vendorHash = "sha256-3vDcCOrhYTHvr8ck0WxZPRUQNsKtEVyUKTD5Epbno6I=";
+
+  ldflags = [ "-s" "-w" ];
+
+  meta = with lib; {
+    description = "Secure private tunnel to your local servers";
+    homepage = "https://github.com/ntnj/tunwg";
+    license = licenses.mit;
+    maintainers = with maintainers; [ dit7ya ];
+  };
+}
diff --git a/pkgs/tools/security/honeytrap/default.nix b/pkgs/tools/security/honeytrap/default.nix
index 91d1c367182..e0252d06f15 100644
--- a/pkgs/tools/security/honeytrap/default.nix
+++ b/pkgs/tools/security/honeytrap/default.nix
@@ -4,21 +4,21 @@
 }:
 buildGoModule {
   pname = "honeytrap";
-  version = "unstable-2020-12-10";
+  version = "unstable-2021-12-20";
 
   src = fetchFromGitHub {
     owner = "honeytrap";
     repo = "honeytrap";
-    rev = "affd7b21a5aa1b57f086e6871753cb98ce088d76";
-    sha256 = "y1SWlBFgX3bFoSRGJ45DdC1DoIK5BfO9Vpi2h57wWtU=";
+    rev = "05965fc67deab17b48e43873abc5f509067ef098";
+    hash = "sha256-KSVqjHlXl85JaqKiW5R86HCMdtFBwTMJkxFoySOcahs=";
   };
 
+  vendorHash = "sha256-W8w66weYzCpZ+hmFyK2F6wdFz6aAZ9UxMhccNy1X1R8=";
+
   # Otherwise, will try to install a "scripts" binary; it's only used in
   # dockerize.sh, which we don't care about.
   subPackages = [ "." ];
 
-  vendorSha256 = "W8w66weYzCpZ+hmFyK2F6wdFz6aAZ9UxMhccNy1X1R8=";
-
   meta = with lib; {
     description = "Advanced Honeypot framework";
     homepage = "https://github.com/honeytrap/honeytrap";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 87ca7b7d29b..b38eed7e6f2 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -290,6 +290,8 @@ with pkgs;
 
   apko = callPackage ../development/tools/apko { };
 
+  melange = callPackage ../development/tools/melange { };
+
   appthreat-depscan = callPackage ../development/tools/appthreat-depscan { };
 
   activate-linux = callPackage ../applications/misc/activate-linux { };
@@ -5374,6 +5376,8 @@ with pkgs;
 
   home-manager = callPackage ../tools/package-management/home-manager { };
 
+  homepage-dashboard = callPackage ../servers/homepage-dashboard { };
+
   hostsblock = callPackage ../tools/misc/hostsblock { };
 
   hottext = callPackage ../tools/text/hottext { };
@@ -5428,6 +5432,8 @@ with pkgs;
 
   interlock = callPackage ../servers/interlock { };
 
+  invoice = callPackage ../tools/misc/invoice { };
+
   invoiceplane = callPackage ../servers/web-apps/invoiceplane { };
 
   iotas = callPackage ../applications/office/iotas { };
@@ -5508,6 +5514,8 @@ with pkgs;
 
   komga = callPackage ../servers/komga { };
 
+  komorebi = callPackage ../applications/graphics/komorebi { };
+
   krapslog = callPackage ../tools/misc/krapslog { };
 
   krelay = callPackage ../applications/networking/cluster/krelay { };
@@ -13569,6 +13577,8 @@ with pkgs;
 
   tuntox = callPackage ../tools/networking/tuntox { };
 
+  tunwg = callPackage ../tools/networking/tunwg { };
+
   omapd = callPackage ../tools/security/omapd { };
 
   ttf2pt1 = callPackage ../tools/misc/ttf2pt1 { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index ba0bc6d7a06..a94ab613504 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1274,6 +1274,8 @@ self: super: with self; {
 
   beaker = callPackage ../development/python-modules/beaker { };
 
+  before-after = callPackage ../development/python-modules/before-after { };
+
   beancount = callPackage ../development/python-modules/beancount { };
 
   beancount-black = callPackage ../development/python-modules/beancount-black { };