Merge master into staging-next

68 files changed, 709 insertions, 276 deletions

diff --git a/doc/languages-frameworks/python.section.md b/doc/languages-frameworks/python.section.md
index 7b8a804106a..0ca20617b85 100644
--- a/doc/languages-frameworks/python.section.md
+++ b/doc/languages-frameworks/python.section.md
@@ -744,17 +744,17 @@ work in any of the formats supported by `buildPythonPackage` currently,
 with the exception of `other` (see `format` in
 [`buildPythonPackage` parameters](#buildpythonpackage-parameters) for more details).
 
-### Using unittestCheckHook {#using-unittestcheckhook}
+#### Using unittestCheckHook {#using-unittestcheckhook}
 
 `unittestCheckHook` is a hook which will substitute the setuptools `test` command for a `checkPhase` which runs `python -m unittest discover`:
 
 ```
   nativeCheckInputs = [ unittestCheckHook ];
 
-  unittestFlags = [ "-s" "tests" "-v" ];
+  unittestFlagsArray = [ "-s" "tests" "-v" ];
 ```
 
-##### Using sphinxHook {#using-sphinxhook}
+#### Using sphinxHook {#using-sphinxhook}
 
 The `sphinxHook` is a helpful tool to build documentation and manpages
 using the popular Sphinx documentation generator.
diff --git a/nixos/tests/networking.nix b/nixos/tests/networking.nix
index b16ee7d0596..5d6f204ee83 100644
--- a/nixos/tests/networking.nix
+++ b/nixos/tests/networking.nix
@@ -953,6 +953,7 @@ let
     } else {
       name = "RenameInterface";
       testScript = "";
+    };
     # even with disabled networkd, systemd.network.links should work
     # (as it's handled by udev, not networkd)
     link = {
diff --git a/pkgs/applications/audio/bambootracker/default.nix b/pkgs/applications/audio/bambootracker/default.nix
index 875daa196d5..08e34791192 100644
--- a/pkgs/applications/audio/bambootracker/default.nix
+++ b/pkgs/applications/audio/bambootracker/default.nix
@@ -12,14 +12,14 @@
 
 mkDerivation rec {
   pname = "bambootracker";
-  version = "0.5.3";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "BambooTracker";
     repo = "BambooTracker";
     rev = "v${version}";
     fetchSubmodules = true;
-    sha256 = "sha256-OaktEUWWDEW+MYnQkaB8FvkuH29VDXFqBVSTEJ7Sz7A=";
+    sha256 = "sha256-yubaKTc8NFLxMY0/5c2VubRHgAGOsRlitmXJ1UHzl60=";
   };
 
   nativeBuildInputs = [ qmake qttools pkg-config ];
diff --git a/pkgs/applications/blockchains/torq/default.nix b/pkgs/applications/blockchains/torq/default.nix
index 85041accbc4..cf7722238ef 100644
--- a/pkgs/applications/blockchains/torq/default.nix
+++ b/pkgs/applications/blockchains/torq/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "torq";
-  version = "0.16.15";
+  version = "0.17.3";
 
   src = fetchFromGitHub {
     owner = "lncapital";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-ibrPq/EC61ssn4072gTNvJg9QO41+aTsU1Hhc6X6NPk=";
+    hash = "sha256-fqHJZi1NQCrZqsa+N+FVYZ8s9o0D555Sqn5qNlJ1MmI=";
   };
 
   vendorHash = "sha256-HETN2IMnpxnTyg6bQDpoD0saJu+gKocdEf0VzEi12Gs=";
diff --git a/pkgs/applications/misc/electrum/default.nix b/pkgs/applications/misc/electrum/default.nix
index 40b4569d11f..5cae20d831b 100644
--- a/pkgs/applications/misc/electrum/default.nix
+++ b/pkgs/applications/misc/electrum/default.nix
@@ -20,7 +20,7 @@
 }:
 
 let
-  version = "4.3.3";
+  version = "4.3.4";
 
   libsecp256k1_name =
     if stdenv.isLinux then "libsecp256k1.so.0"
@@ -37,7 +37,7 @@ let
     owner = "spesmilo";
     repo = "electrum";
     rev = version;
-    sha256 = "sha256-40GfOKBTAi8RAsAVrG9rv1Jr5IqM+1yro6YYRsSULxw=";
+    sha256 = "sha256-0xYGTCk+Sk7LP+E9r2Y7UJZsfbobLe6Yb+x5ZRCN40Y=";
 
     postFetch = ''
       mv $out ./all
@@ -53,7 +53,7 @@ python3.pkgs.buildPythonApplication {
 
   src = fetchurl {
     url = "https://download.electrum.org/${version}/Electrum-${version}.tar.gz";
-    sha256 = "sha256-NPXGfbEjT9l88ZnGbDcE3+oGxThTzW7YfesBzssGsbc=";
+    sha256 = "sha256-+Z4NZK/unFN6mxCuMleHBxAoD+U1PzVk3/ZnZRmOOxo=";
   };
 
   postUnpack = ''
diff --git a/pkgs/applications/misc/gallery-dl/default.nix b/pkgs/applications/misc/gallery-dl/default.nix
index 883ebc79705..4da566bcfc8 100644
--- a/pkgs/applications/misc/gallery-dl/default.nix
+++ b/pkgs/applications/misc/gallery-dl/default.nix
@@ -2,13 +2,13 @@
 
 buildPythonApplication rec {
   pname = "gallery-dl";
-  version = "1.24.4";
+  version = "1.24.5";
   format = "setuptools";
 
   src = fetchPypi {
     inherit version;
     pname = "gallery_dl";
-    sha256 = "sha256-g+nbHpbo6O4zoDJm6MRwCXY9pM73NV7RKR59s+8LM10=";
+    sha256 = "sha256-P71JiGI9PpWMAlgk5TwQa/h3AUEZSEZ6/MahY+IIy9M=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/applications/networking/freefilesync/default.nix b/pkgs/applications/networking/freefilesync/default.nix
index 5ef5feb3a16..49bc342724e 100644
--- a/pkgs/applications/networking/freefilesync/default.nix
+++ b/pkgs/applications/networking/freefilesync/default.nix
@@ -14,13 +14,13 @@
 
 gcc12Stdenv.mkDerivation rec {
   pname = "freefilesync";
-  version = "11.29";
+  version = "12.0";
 
   src = fetchFromGitHub {
     owner = "hkneptune";
     repo = "FreeFileSync";
     rev = "v${version}";
-    sha256 = "sha256-UQ+CWqtcTwMGUTn6t3N+BkXs4qxddZtxDjcq7nz5F6U=";
+    hash = "sha256-7vdhSEh43mpVbrzJzt005EkwoXfknYnAC+FZIAZF020=";
   };
 
   # Patches from ROSA Linux
diff --git a/pkgs/applications/networking/ipfs-cluster/default.nix b/pkgs/applications/networking/ipfs-cluster/default.nix
index 43bc47b17af..996677f8a11 100644
--- a/pkgs/applications/networking/ipfs-cluster/default.nix
+++ b/pkgs/applications/networking/ipfs-cluster/default.nix
@@ -2,15 +2,15 @@
 
 buildGoModule rec {
   pname = "ipfs-cluster";
-  version = "1.0.4";
+  version = "1.0.5";
 
-  vendorSha256 = "sha256-krjTtH8C1SGhaKMCtsbA2S9ognImof6mwD+vJ/qbyrM=";
+  vendorHash = "sha256-sLCgPXyOiGaigcVuwUU4+Lmb7SjopWKhCReBzrZyuRs=";
 
   src = fetchFromGitHub {
     owner = "ipfs-cluster";
     repo = "ipfs-cluster";
     rev = "v${version}";
-    sha256 = "sha256-LdcCGUbrS6te03y8R7XJJOcG1j6uU0v8uEMeUHLeidg=";
+    hash = "sha256-c0COSf4ktFxkPJwzq/0RyG1JvNUvhdWpeRlrbAirGec=";
   };
 
   meta = with lib; {
diff --git a/pkgs/applications/networking/jnetmap/default.nix b/pkgs/applications/networking/jnetmap/default.nix
index 2a686fdd8b9..8aea49decb7 100644
--- a/pkgs/applications/networking/jnetmap/default.nix
+++ b/pkgs/applications/networking/jnetmap/default.nix
@@ -2,11 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "jnetmap";
-  version = "0.5.4";
+  version = "0.5.5";
+  versionSuffix = "-703";
 
   src = fetchurl {
-    url = "mirror://sourceforge/project/jnetmap/jNetMap%20${version}/jNetMap-${version}.jar";
-    sha256 = "0nxsfa600jhazwbabxmr9j37mhwysp0fyrvczhv3f1smiy8rjanl";
+    url = "mirror://sourceforge/project/jnetmap/jNetMap%20${version}/jNetMap-${version}${versionSuffix}.jar";
+    sha256 = "sha256-e4Ssm2Sq/v1YZ7ZudAqgQ7Cz2ffwWbSmLFoKhaZvTPg=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
@@ -15,12 +16,16 @@ stdenv.mkDerivation rec {
   dontUnpack = true;
 
   installPhase = ''
+    runHook preInstall
+
     mkdir -p "$out/bin"
     mkdir -p "$out/lib"
 
     cp "${src}" "$out/lib/jnetmap.jar"
     makeWrapper "${jre}/bin/java" "$out/bin/jnetmap" \
         --add-flags "-jar \"$out/lib/jnetmap.jar\""
+
+    runHook postInstall
   '';
 
   meta = with lib; {
diff --git a/pkgs/applications/radio/gnuradio/default.nix b/pkgs/applications/radio/gnuradio/default.nix
index 6ca669a8fe9..e06e3437281 100644
--- a/pkgs/applications/radio/gnuradio/default.nix
+++ b/pkgs/applications/radio/gnuradio/default.nix
@@ -49,12 +49,12 @@
 , versionAttr ? {
   major = "3.10";
   minor = "5";
-  patch = "0";
+  patch = "1";
 }
 }:
 
 let
-  sourceSha256 = "sha256-NP7OH4kRulWpWxyHudIzCJPfjiiilgnhBlixmwOj70I=";
+  sourceSha256 = "sha256-D5Bsj70IHFOLPZQbaxkGdx7Lz94bXhCfnNfhZb3dDp4=";
   featuresInfo = {
     # Needed always
     basic = {
diff --git a/pkgs/applications/video/gpac/default.nix b/pkgs/applications/video/gpac/default.nix
index 6390558013f..afc97cd7e1a 100644
--- a/pkgs/applications/video/gpac/default.nix
+++ b/pkgs/applications/video/gpac/default.nix
@@ -1,19 +1,23 @@
-{ lib, stdenv, fetchFromGitHub, pkg-config, zlib }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, pkg-config, zlib }:
 
 stdenv.mkDerivation rec {
-  version = "2.0.0";
+  version = "2.2.0";
   pname = "gpac";
 
   src = fetchFromGitHub {
     owner = "gpac";
     repo = "gpac";
     rev = "v${version}";
-    sha256 = "sha256-MIX32lSqf/lrz9240h4wMIQp/heUmwvDJz8WN08yf6c=";
+    sha256 = "sha256-m2qXTXLGgAyU9y6GEk4Hp/7Al57IPRSqImJatIcwswQ=";
   };
 
-  postPatch = ''
-    substituteInPlace Makefile --replace 'dh_link' 'ln -s'
-  '';
+  patches = [
+    (fetchpatch {
+      name = "CVE-2023-0358.patch";
+      url = "https://github.com/gpac/gpac/commit/9971fb125cf91cefd081a080c417b90bbe4a467b.patch";
+      sha256 = "sha256-0PDQXahbJCOo1JJAC0T0N1u2mqmwAkdm87wXMJnBicM=";
+    })
+  ];
 
   # this is the bare minimum configuration, as I'm only interested in MP4Box
   # For most other functionality, this should probably be extended
@@ -41,14 +45,5 @@ stdenv.mkDerivation rec {
     license = licenses.lgpl21;
     maintainers = with maintainers; [ bluescreen303 mgdelacroix ];
     platforms = platforms.linux;
-    knownVulnerabilities = [
-      "CVE-2022-1035"
-      "CVE-2022-1172"
-      "CVE-2022-1222"
-      "CVE-2022-1795"
-      "CVE-2022-2453"
-      "CVE-2022-2454"
-      "CVE-2022-2549"
-    ];
   };
 }
diff --git a/pkgs/development/interpreters/python/default.nix b/pkgs/development/interpreters/python/default.nix
index faab3eb785e..bb709694dc6 100644
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@@ -36,8 +36,12 @@
             stdenv
           ];
           providesSetupHook = lib.attrByPath [ "provides" "setupHook"] false;
-          valid = value: !((lib.isDerivation value) && !((pythonPackages.hasPythonModule value) || (providesSetupHook value))) || (lib.elem value exceptions);
-          func = name: value: if (valid value) then value else throw "${name} should use `buildPythonPackage` or `toPythonModule` if it is to be part of the Python packages set.";
+          valid = value: pythonPackages.hasPythonModule value || providesSetupHook value || lib.elem value exceptions;
+          func = name: value:
+            if lib.isDerivation value then
+              lib.extendDerivation (valid value || throw "${name} should use `buildPythonPackage` or `toPythonModule` if it is to be part of the Python packages set.") {} value
+            else
+              value;
         in lib.mapAttrs func items;
       in ensurePythonModules (callPackage
         # Function that when called
diff --git a/pkgs/development/libraries/drogon/default.nix b/pkgs/development/libraries/drogon/default.nix
index 3df87efba19..0eca838dfce 100644
--- a/pkgs/development/libraries/drogon/default.nix
+++ b/pkgs/development/libraries/drogon/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, cmake, jsoncpp, libossp_uuid, zlib, lib
+{ stdenv, fetchFromGitHub, cmake, jsoncpp, libossp_uuid, zlib, lib, fetchpatch
 # optional but of negligible size
 , openssl, brotli, c-ares
 # optional databases
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "drogon";
-  version = "1.8.2";
+  version = "1.8.3";
 
   src = fetchFromGitHub {
     owner = "drogonframework";
     repo = "drogon";
     rev = "v${version}";
-    sha256 = "sha256-IpECYpPuheoLelEdgV+J26b+95fMfRmeQ44q6JvqRtw=";
+    sha256 = "sha256-I3f/8TMGm1G4CFMJJLyiVYso9yTHjeLefS5eaGySvC4=";
     fetchSubmodules = true;
   };
 
@@ -43,6 +43,12 @@ stdenv.mkDerivation rec {
     # this part of the test would normally fail because it attempts to configure a CMake project that uses find_package on itself
     # this patch makes drogon and trantor visible to the test
     ./fix_find_package.patch
+
+    # see https://github.com/drogonframework/drogon/issues/1491
+    (fetchpatch {
+      url = "https://github.com/drogonframework/drogon/commit/7d87d7e0b264ce53aa5ee006fb022d3516c9d666.patch";
+      sha256 = "sha256-C4zH9oNMfhkaeVNvZuBuzu1v2vNgg/t+YPitbrmHg+Y=";
+    })
   ];
 
   # modifying PATH here makes drogon_ctl visible to the test
diff --git a/pkgs/development/libraries/libgda/6.x.nix b/pkgs/development/libraries/libgda/6.x.nix
index c02c6116e64..1f551ec9b4b 100644
--- a/pkgs/development/libraries/libgda/6.x.nix
+++ b/pkgs/development/libraries/libgda/6.x.nix
@@ -50,6 +50,12 @@ stdenv.mkDerivation rec {
       url = "https://gitlab.gnome.org/GNOME/libgda/-/commit/57f618a3b2a3758ee3dcbf9bbdc566122dd8566d.patch";
       sha256 = "pyfymUd61m1kHaGyMbUQMma+szB8mlqGWwcFBBQawf8=";
     })
+
+    (fetchpatch {
+      name = "CVE-2021-39359.patch";
+      url = "https://gitlab.gnome.org/GNOME/libgda/-/commit/bebdffb4de586fb43fd07ac549121f4b22f6812d.patch";
+      sha256 = "sha256-UjHP1nhb5n6TOdaMdQeE2s828T4wv/0ycG3FAk+I1QA=";
+    })
   ];
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/libgda/default.nix b/pkgs/development/libraries/libgda/default.nix
index e29482a34d4..1ef0a397c8e 100644
--- a/pkgs/development/libraries/libgda/default.nix
+++ b/pkgs/development/libraries/libgda/default.nix
@@ -37,6 +37,11 @@ stdenv.mkDerivation rec {
       url = "https://gitlab.gnome.org/GNOME/libgda/-/commit/9859479884fad5f39e6c37e8995e57c28b11b1b9.diff";
       sha256 = "158sncc5bg9lkri1wb0i1ri1nhx4c34rzi47gbfkwphlp7qd4qqv";
     })
+    (fetchpatch {
+      name = "CVE-2021-39359.patch";
+      url = "https://src.fedoraproject.org/rpms/libgda5/raw/72bb769f12e861e27e883dac5fab34f1ba4bd97e/f/bebdffb4de586fb43fd07ac549121f4b22f6812d.patch";
+      sha256 = "sha256-hIKuY5NEqOzntdlLb541bA4xZU5ypTRmV1u765K6KbM=";
+    })
   ];
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/xtl/default.nix b/pkgs/development/libraries/xtl/default.nix
index 7bd07c2433d..694f6511f0c 100644
--- a/pkgs/development/libraries/xtl/default.nix
+++ b/pkgs/development/libraries/xtl/default.nix
@@ -2,17 +2,18 @@
 , stdenv
 , fetchFromGitHub
 , cmake
+, doctest
 , gtest
 }:
 stdenv.mkDerivation rec {
   pname = "xtl";
-  version = "0.7.2";
+  version = "0.7.5";
 
   src = fetchFromGitHub {
     owner = "xtensor-stack";
     repo = "xtl";
     rev = version;
-    sha256 = "177ym67sz544wdylksfkkpi6bqn34kagycfnb3cv0nkmpipqj9lg";
+    hash = "sha256-Vc1VKOWmG1sAw3UQpNJAhm9PvXSqJ0iO2qLjP6/xjtI=";
   };
 
   nativeBuildInputs = [ cmake ];
@@ -20,7 +21,7 @@ stdenv.mkDerivation rec {
   cmakeFlags = [ "-DBUILD_TESTS=ON" ];
 
   doCheck = true;
-  nativeCheckInputs = [ gtest ];
+  nativeCheckInputs = [ doctest ];
   checkTarget = "xtest";
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/ailment/default.nix b/pkgs/development/python-modules/ailment/default.nix
index 47fe8d1bad7..d5ec32348e7 100644
--- a/pkgs/development/python-modules/ailment/default.nix
+++ b/pkgs/development/python-modules/ailment/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "ailment";
-  version = "9.2.34";
+  version = "9.2.35";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-qFnr+HzDqzhub9MKHjmpbEI3CGMuUkpwX763ykoP9No=";
+    hash = "sha256-t4t9TATmskvi/Qr9Eje7l+tRiKa+NiwI+KVYqEiSNgo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/angr/default.nix b/pkgs/development/python-modules/angr/default.nix
index 64da0be72e2..c8b80357ca7 100644
--- a/pkgs/development/python-modules/angr/default.nix
+++ b/pkgs/development/python-modules/angr/default.nix
@@ -31,7 +31,7 @@
 
 buildPythonPackage rec {
   pname = "angr";
-  version = "9.2.34";
+  version = "9.2.35";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -40,7 +40,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-Ar74eYEUinHmAosec7r5C9Rg6iqYl2uLZo87UdOquJY=";
+    hash = "sha256-zJ3dURT2T44Nl0KPSw8bTeJO33siBLAOu/lXGaQeEdQ=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/archinfo/default.nix b/pkgs/development/python-modules/archinfo/default.nix
index 432ea73e7c3..b2824ed9ae7 100644
--- a/pkgs/development/python-modules/archinfo/default.nix
+++ b/pkgs/development/python-modules/archinfo/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "archinfo";
-  version = "9.2.34";
+  version = "9.2.35";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-RsIknVuhDzPbVJudjilNnMjBTH6cxPROQEXxRiAbDEs=";
+    hash = "sha256-/GGchV+B/1gleZM0mW8vVk/9Uwf1zYH0B7HwziAla6w=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/branca/default.nix b/pkgs/development/python-modules/branca/default.nix
index c0e19fc4868..65b80267c1d 100644
--- a/pkgs/development/python-modules/branca/default.nix
+++ b/pkgs/development/python-modules/branca/default.nix
@@ -1,31 +1,66 @@
 { lib
 , buildPythonPackage
-, fetchPypi
-, pytest
+, fetchFromGitHub
 , jinja2
+, pytestCheckHook
+, pythonOlder
+, setuptools-scm
 , selenium
-, six
-, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "branca";
   version = "0.6.0";
+  format = "setuptools";
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "sha256-VZSYVSFFBMdYO3G5oDqE3OLpaoQCdhO7U7QtBIRM4k4=";
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "python-visualization";
+    repo = pname;
+    rev = "refs/tags/v${version}";
+    hash = "sha256-bcqr+vGKBga4rR4XFRWbjtw5xL+pWkIt+ihtKlKF6Y8=";
   };
 
-  nativeCheckInputs = [ pytest selenium ];
-  propagatedBuildInputs = [ jinja2 six setuptools ];
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  postPatch = ''
+    # We don't want flake8
+    rm setup.cfg
+  '';
+
+  nativeBuildInputs = [
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = [
+    jinja2
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    selenium
+  ];
+
+  pythonImportsCheck = [
+    "branca"
+  ];
+
+  disabledTestPaths = [
+    # Some tests require a browser
+    "tests/test_utilities.py"
+  ];
 
-  # Seems to require a browser
-  doCheck = false;
+  disabledTests = [
+    "test_rendering_utf8_iframe"
+    "test_rendering_figure_notebook"
+  ];
 
-  meta = {
+  meta = with lib; {
     description = "Generate complex HTML+JS pages with Python";
     homepage = "https://github.com/python-visualization/branca";
-    license = with lib.licenses; [ mit ];
+    changelog = "https://github.com/python-visualization/branca/blob/v${version}/CHANGES.txt";
+    license = with licenses; [ mit ];
+    maintainers = with lib.maintainers; [ ];
   };
 }
diff --git a/pkgs/development/python-modules/claripy/default.nix b/pkgs/development/python-modules/claripy/default.nix
index 38c7ee4a2d7..a7b7564fd65 100644
--- a/pkgs/development/python-modules/claripy/default.nix
+++ b/pkgs/development/python-modules/claripy/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "claripy";
-  version = "9.2.34";
+  version = "9.2.35";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-2oUUIPHBT/pAAWUy+8fuEqZv0pG1OHDn6eaphOsrevE=";
+    hash = "sha256-vfyrYcwQopwSxGAA+8JFCkog0Po/s9HkGI3PJzSALSI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/cle/default.nix b/pkgs/development/python-modules/cle/default.nix
index 80f82d1ac94..0464777b516 100644
--- a/pkgs/development/python-modules/cle/default.nix
+++ b/pkgs/development/python-modules/cle/default.nix
@@ -16,7 +16,7 @@
 
 let
   # The binaries are following the argr projects release cycle
-  version = "9.2.34";
+  version = "9.2.35";
 
   # Binary files from https://github.com/angr/binaries (only used for testing and only here)
   binaries = fetchFromGitHub {
@@ -38,7 +38,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-mbYitM0ibUSxBRhbF1ecB1MOryhWRPZZ1ujRFD8iiWs=";
+    hash = "sha256-0qDSxB77kKwYCLPWt/Wb//LLTJC8WJIv0Cw+HwE21sQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/cma/default.nix b/pkgs/development/python-modules/cma/default.nix
index 5f1121c8e91..ee3a552b94f 100644
--- a/pkgs/development/python-modules/cma/default.nix
+++ b/pkgs/development/python-modules/cma/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "cma";
-  version = "3.2.2";
+  version = "3.3.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "CMA-ES";
     repo = "pycma";
     rev = "refs/tags/r${version}";
-    hash = "sha256-STF7jtLqI2KiWvvI9/reRjP1XyW8l4/qy9uAPpE9mTs=";
+    hash = "sha256-+UJI3hDVbDMfRF4bkwHED3eJCHzxS2hO4YPUzJqcoQI=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/cwl-utils/default.nix b/pkgs/development/python-modules/cwl-utils/default.nix
index 038bf395e96..2f605950bc5 100644
--- a/pkgs/development/python-modules/cwl-utils/default.nix
+++ b/pkgs/development/python-modules/cwl-utils/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "cwl-utils";
-  version = "0.21";
+  version = "0.22";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "common-workflow-language";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-y1zuYaxoE0XUk8UpCLsg4ty0sn+5Uu4ztRnUoJezO/o=";
+    hash = "sha256-vOIheOcDG8qdPtcN0kkBN3URodknDLTC7BzYGIiD2RA=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/drawille/default.nix b/pkgs/development/python-modules/drawille/default.nix
new file mode 100644
index 00000000000..a00b0b16892
--- /dev/null
+++ b/pkgs/development/python-modules/drawille/default.nix
@@ -0,0 +1,30 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+}:
+
+buildPythonPackage rec {
+  pname = "drawille";
+  version = "0.1.0";
+
+  format = "setuptools";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-t4nS8TWbEGKHibIbLfZZycPQxTiEzuJ7DYsa6Twi+8s=";
+  };
+
+  doCheck = false; # pypi package has no tests, git has no tags
+
+  pythonImportsCheck = [
+    "drawille"
+  ];
+
+  meta = with lib; {
+    description = "Drawing in terminal with unicode braille characters";
+    homepage = "https://github.com/asciimoo/drawille";
+    license = licenses.agpl3Plus;
+    maintainers = with maintainers; [ nobbz ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/development/python-modules/drawilleplot/default.nix b/pkgs/development/python-modules/drawilleplot/default.nix
new file mode 100644
index 00000000000..1ed452c1d10
--- /dev/null
+++ b/pkgs/development/python-modules/drawilleplot/default.nix
@@ -0,0 +1,37 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, drawille
+, matplotlib
+}:
+
+buildPythonPackage rec {
+  pname = "drawilleplot";
+  version = "0.1.0";
+
+  format = "setuptools";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-ZEDroo7KkI2VxdESb2QDX+dPY4UahuuK9L0EddrxJjQ=";
+  };
+
+  doCheck = false; # does not have any tests at all
+
+  propagatedBuildInputs = [
+    drawille
+    matplotlib
+  ];
+
+  pythonImportsCheck = [
+    "drawilleplot"
+  ];
+
+  meta = with lib; {
+    description = "matplotlib backend for graph output in unicode terminals using drawille";
+    homepage = "https://github.com/gooofy/drawilleplot";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ nobbz ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/development/python-modules/folium/default.nix b/pkgs/development/python-modules/folium/default.nix
index 30a2bcf7731..09c2137872d 100644
--- a/pkgs/development/python-modules/folium/default.nix
+++ b/pkgs/development/python-modules/folium/default.nix
@@ -1,42 +1,36 @@
 { lib
+, branca
 , buildPythonPackage
 , fetchFromGitHub
-, fetchpatch
-, pythonOlder
-, pytestCheckHook
-, branca
+, geopandas
 , jinja2
 , nbconvert
 , numpy
 , pandas
 , pillow
+, pytestCheckHook
+, pythonOlder
 , requests
 , selenium
 , setuptools-scm
+, xyzservices
 }:
 
 buildPythonPackage rec {
   pname = "folium";
   version = "0.14.0";
+  format = "setuptools";
 
-  disabled = pythonOlder "3.5";
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "python-visualization";
     repo = "folium";
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-zxLFj5AeTVAxE0En7ZlbBdJEm3WrcPv23MgOhyfNi14=";
+    hash = "sha256-zxLFj5AeTVAxE0En7ZlbBdJEm3WrcPv23MgOhyfNi14=";
   };
 
-  patches = [
-    # Fix test failures with latest branca
-    (fetchpatch {
-      url = "https://github.com/python-visualization/folium/commit/b410ab21cc46ec6756c2f755e5e81dcdca029c53.patch";
-      hash = "sha256-SVN4wKEep+VnAKnkJTf59rhnzHnbk6dV9XL5ntv4bog=";
-    })
-  ];
-
-  SETUPTOOLS_SCM_PRETEND_VERSION = "v${version}";
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
 
   nativeBuildInputs = [
     setuptools-scm
@@ -50,24 +44,34 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
+    geopandas
     nbconvert
-    pytestCheckHook
     pandas
     pillow
+    pytestCheckHook
     selenium
+    xyzservices
   ];
 
   disabledTests = [
-    # requires internet connection
+    # Tests require internet connection
+    "test__repr_png_is_bytes"
     "test_geojson"
     "test_heat_map_with_weights"
     "test_json_request"
     "test_notebook"
+    "test_valid_png_size"
+    "test_valid_png"
+  ];
+
+  pythonImportsCheck = [
+    "folium"
   ];
 
   meta = {
     description = "Make beautiful maps with Leaflet.js & Python";
     homepage = "https://github.com/python-visualization/folium";
+    changelog = "https://github.com/python-visualization/folium/blob/v${version}/CHANGES.txt";
     license = with lib.licenses; [ mit ];
     maintainers = with lib.maintainers; [ fridh ];
   };
diff --git a/pkgs/development/python-modules/garminconnect/default.nix b/pkgs/development/python-modules/garminconnect/default.nix
index 9a4303b1dd5..adadfc030bf 100644
--- a/pkgs/development/python-modules/garminconnect/default.nix
+++ b/pkgs/development/python-modules/garminconnect/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "garminconnect";
-  version = "0.1.51";
+  version = "0.1.53";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "cyberjunky";
     repo = "python-garminconnect";
     rev = "refs/tags/${version}";
-    hash = "sha256-SEolk0bbq3vNNMFz5B/qELaiCFCZFXJD4zTH8hBUX+Y=";
+    hash = "sha256-bUOdurCuAxpVag+mv3brxYIyNu9KhoDauL+lcrcob/k=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-nest-sdm/default.nix b/pkgs/development/python-modules/google-nest-sdm/default.nix
index 9168d3f046f..d8fe3ca62f9 100644
--- a/pkgs/development/python-modules/google-nest-sdm/default.nix
+++ b/pkgs/development/python-modules/google-nest-sdm/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "google-nest-sdm";
-  version = "2.2.2";
+  version = "2.2.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "allenporter";
     repo = "python-google-nest-sdm";
     rev = "refs/tags/${version}";
-    hash = "sha256-QeT4S8UlJQ0rCYG8+hc4cP1mM3KZlu/afFqz+LPIuVA=";
+    hash = "sha256-HQzU6no/DV2QOC+LV7kUSrygTwgAvfMSmYIKaBd/PCE=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/hledger-utils/default.nix b/pkgs/development/python-modules/hledger-utils/default.nix
new file mode 100644
index 00000000000..58fe5f3e871
--- /dev/null
+++ b/pkgs/development/python-modules/hledger-utils/default.nix
@@ -0,0 +1,68 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitLab
+, setuptools
+, setuptools-scm
+, unittestCheckHook
+, hledger
+, perl
+, rich
+, pandas
+, scipy
+, psutil
+, matplotlib
+, drawilleplot
+, asteval
+}:
+
+buildPythonPackage rec {
+  pname = "hledger-utils";
+  version = "1.12.1";
+
+  format = "pyproject";
+
+  src = fetchFromGitLab {
+    owner = "nobodyinperson";
+    repo = "hledger-utils";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-uAFqBNRET3RaWDTyV53onrBs1fjPR4b5rAvg5lweUN0=";
+  };
+
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = [
+    rich
+    pandas
+    scipy
+    psutil
+    matplotlib
+    drawilleplot
+    asteval
+  ];
+
+  checkInputs = [
+    unittestCheckHook
+  ];
+
+  nativeCheckInputs = [
+    hledger
+    perl
+  ];
+
+  preCheck = ''
+    export PATH=$out/bin:$PATH
+  '';
+
+  meta = with lib; {
+    description = "Utilities extending hledger";
+    homepage = "https://gitlab.com/nobodyinperson/hledger-utils";
+    license = with licenses; [cc0 cc-by-40 gpl3];
+    maintainers = with maintainers; [ nobbz ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/development/python-modules/huum/default.nix b/pkgs/development/python-modules/huum/default.nix
index 0df01749e95..68cba094ab3 100644
--- a/pkgs/development/python-modules/huum/default.nix
+++ b/pkgs/development/python-modules/huum/default.nix
@@ -1,22 +1,26 @@
 { lib
 , aiohttp
 , buildPythonPackage
-, fetchPypi
+, fetchFromGitHub
 , poetry-core
 , pydantic
+, pytest-asyncio
+, pytestCheckHook
 , pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "huum";
-  version = "0.6.0";
+  version = "0.7.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "sha256-PYOjfLPa/vZZP0IZuUZnQ74IrTRvizgYhKOmhd83aMQ=";
+  src = fetchFromGitHub {
+    owner = "frwickst";
+    repo = "pyhuum";
+    rev = "refs/tags/${version}";
+    hash = "sha256-vYHwcEOzxYEBav5YbmWpm+izFlivzu2UIR6hmAXXi0U=";
   };
 
   nativeBuildInputs = [
@@ -28,17 +32,19 @@ buildPythonPackage rec {
     pydantic
   ];
 
-  # Tests are not shipped and source not tagged
-  # https://github.com/frwickst/pyhuum/issues/2
-  doCheck = false;
+  nativeCheckInputs = [
+    pytest-asyncio
+    pytestCheckHook
+  ];
 
   pythonImportsCheck = [
     "huum"
   ];
 
   meta = with lib; {
-    description = "Library for for Huum saunas";
+    description = "Library for Huum saunas";
     homepage = "https://github.com/frwickst/pyhuum";
+    changelog = "https://github.com/frwickst/pyhuum/releases/tag/${version}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/openai/default.nix b/pkgs/development/python-modules/openai/default.nix
index a5529af2ab1..d4cedc80be1 100644
--- a/pkgs/development/python-modules/openai/default.nix
+++ b/pkgs/development/python-modules/openai/default.nix
@@ -23,7 +23,7 @@
 
 buildPythonPackage rec {
   pname = "openai";
-  version = "0.26.2";
+  version = "0.26.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.7.1";
@@ -32,7 +32,7 @@ buildPythonPackage rec {
     owner = "openai";
     repo = "openai-python";
     rev = "v${version}";
-    hash = "sha256-rUXwrr8hgKwqJ/ittK2DOKaqxTAs8wKyVTSdEhfiWfI=";
+    hash = "sha256-WcUH6zbb5kIH0qk67M+lUx9CbMEbYDXQm6IVzzuQo9w=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/osmnx/default.nix b/pkgs/development/python-modules/osmnx/default.nix
index 9f26c06eaf3..330385625d2 100755
--- a/pkgs/development/python-modules/osmnx/default.nix
+++ b/pkgs/development/python-modules/osmnx/default.nix
@@ -1,27 +1,63 @@
-{ lib, buildPythonPackage, fetchFromGitHub, pythonOlder, geopandas, matplotlib, networkx, numpy
-, pandas, requests, Rtree, shapely, folium, scikit-learn, scipy, gdal, rasterio}:
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, folium
+, gdal
+, geopandas
+, matplotlib
+, networkx
+, numpy
+, pandas
+, pythonOlder
+, rasterio
+, requests
+, Rtree
+, scikit-learn
+, scipy
+, shapely
+}:
 
 buildPythonPackage rec {
   pname = "osmnx";
-  version = "1.2.2";
+  version = "1.3.0";
+  format = "setuptools";
+
   disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
-    owner  = "gboeing";
-    repo   = pname;
-    rev    = "v${version}";
-    sha256 = "sha256-+dUv1QrUmCIOCyUyjYX1kJtZrPuSp3t9xz/sRV7ppgA=";
+    owner = "gboeing";
+    repo = pname;
+    rev = "refs/tags/v${version}";
+    hash = "sha256-17duWrg48Qb4ojYYFX4HBpPLeVgHn1WV84KVATvBnzY=";
   };
 
-  propagatedBuildInputs = [ geopandas matplotlib networkx numpy pandas requests Rtree shapely folium scikit-learn scipy gdal rasterio ];
+  propagatedBuildInputs = [
+    geopandas
+    matplotlib
+    networkx
+    numpy
+    pandas
+    requests
+    Rtree
+    shapely
+    folium
+    scikit-learn
+    scipy
+    gdal
+    rasterio
+  ];
 
-  # requires network
+  # Tests require network
   doCheck = false;
-  pythonImportsCheck = [ "osmnx" ];
+
+  pythonImportsCheck = [
+    "osmnx"
+  ];
 
   meta = with lib; {
     description = "A package to easily download, construct, project, visualize, and analyze complex street networks from OpenStreetMap with NetworkX.";
     homepage = "https://github.com/gboeing/osmnx";
+    changelog = "https://github.com/gboeing/osmnx/blob/v${version}/CHANGELOG.md";
     license = licenses.mit;
     maintainers = with maintainers; [ psyanticy ];
   };
diff --git a/pkgs/development/python-modules/papis/default.nix b/pkgs/development/python-modules/papis/default.nix
index 1989e844ddd..8e84896079c 100644
--- a/pkgs/development/python-modules/papis/default.nix
+++ b/pkgs/development/python-modules/papis/default.nix
@@ -27,7 +27,6 @@
 , tqdm
 , typing-extensions
 , whoosh
-, xdg-utils
 }:
 
 buildPythonPackage rec {
@@ -70,19 +69,15 @@ buildPythonPackage rec {
   ];
 
   postPatch = ''
+    # Remove when https://github.com/papis/papis/pull/478 lands in upstream
     substituteInPlace setup.py \
-      --replace "isbnlib>=3.9.1,<3.10" "isbnlib>=3.9"
+      --replace "etc/bash_completion.d/" "share/bash-completion/completions/"
     substituteInPlace setup.cfg \
       --replace "--cov=papis" ""
   '';
 
-  # Tests are failing on Python > 3.9
-  doCheck = !stdenv.isDarwin && !(pythonAtLeast "3.10");
-
-  nativeCheckInputs = ([
+  checkInputs = [
     pytestCheckHook
-  ]) ++ [
-    xdg-utils
   ];
 
   preCheck = ''
@@ -106,6 +101,8 @@ buildPythonPackage rec {
     "test_get_data"
     "test_validate_arxivid"
     "test_yaml"
+  ] ++ lib.optionals stdenv.isDarwin [
+    "test_default_opener"
   ];
 
   pythonImportsCheck = [
@@ -115,7 +112,8 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Powerful command-line document and bibliography manager";
     homepage = "https://papis.readthedocs.io/";
+    changelog = "https://github.com/papis/papis/blob/v${version}/CHANGELOG.md";
     license = licenses.gpl3Only;
-    maintainers = with maintainers; [ nico202 teto ];
+    maintainers = with maintainers; [ nico202 teto marsam ];
   };
 }
diff --git a/pkgs/development/python-modules/pyvex/default.nix b/pkgs/development/python-modules/pyvex/default.nix
index 2c69497dfbc..7c647293176 100644
--- a/pkgs/development/python-modules/pyvex/default.nix
+++ b/pkgs/development/python-modules/pyvex/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "pyvex";
-  version = "9.2.34";
+  version = "9.2.35";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-3IWhMhiaGm0LXxgVy1HgCxNIBYuGzCJKf3Nual13xe8=";
+    hash = "sha256-4qLfwzJhmcB1CwWTOvgX9qzYSfd2f3WOcXh+Aer1O3I=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/rasterio/default.nix b/pkgs/development/python-modules/rasterio/default.nix
index 48fda6557a4..16661032fff 100644
--- a/pkgs/development/python-modules/rasterio/default.nix
+++ b/pkgs/development/python-modules/rasterio/default.nix
@@ -1,45 +1,41 @@
 { lib
 , stdenv
-, buildPythonPackage
-, fetchFromGitHub
-, pythonOlder
-
-# build time
-, cython
-, gdal
-
-# runtime
 , affine
 , attrs
 , boto3
+, buildPythonPackage
 , click
 , click-plugins
 , cligj
+, certifi
+, cython
+, fetchFromGitHub
+, gdal
+, hypothesis
 , matplotlib
+, ipython
 , numpy
-, snuggs
-, setuptools
-
-# tests
-, hypothesis
 , packaging
 , pytest-randomly
 , pytestCheckHook
+, pythonOlder
+, setuptools
 , shapely
+, snuggs
 }:
 
 buildPythonPackage rec {
   pname = "rasterio";
-  version = "4"; # not x.y[ab]z, those are alpha/beta versions
+  version = "1.3.5";
   format = "pyproject";
-  disabled = pythonOlder "3.6";
 
-  # Pypi doesn't ship the tests, so we fetch directly from GitHub
+  disabled = pythonOlder "3.8";
+
   src = fetchFromGitHub {
     owner = "rasterio";
     repo = "rasterio";
-    rev = "refs/tags/release-test-${version}";
-    hash = "sha256-YO0FnmIEt+88f6k2mdXDSQg7UKq1Swr8wqVUGdRyQR4=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-VZE58xbTTAicGqkl8ktYBhN+5tFj8FoUYxg8fi05bmo=";
   };
 
   nativeBuildInputs = [
@@ -50,25 +46,32 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     affine
     attrs
-    boto3
     click
     click-plugins
     cligj
-    matplotlib
+    certifi
     numpy
     snuggs
-    setuptools # needs pkg_resources at runtime
+    setuptools
   ];
 
-  preCheck = ''
-    rm -rf rasterio
-  '';
+  passthru.optional-dependencies = {
+    ipython = [
+      ipython
+    ];
+    plot = [
+      matplotlib
+    ];
+    s3 = [
+      boto3
+    ];
+  };
 
   nativeCheckInputs = [
+    hypothesis
+    packaging
     pytest-randomly
     pytestCheckHook
-    packaging
-    hypothesis
     shapely
   ];
 
@@ -85,13 +88,15 @@ buildPythonPackage rec {
   ];
 
   doInstallCheck = true;
+
   installCheckPhase = ''
     $out/bin/rio --version | grep ${version} > /dev/null
   '';
 
   meta = with lib; {
     description = "Python package to read and write geospatial raster data";
-    homepage = "https://rasterio.readthedocs.io/en/latest/";
+    homepage = "https://rasterio.readthedocs.io/";
+    changelog = "https://github.com/rasterio/rasterio/blob/${version}/CHANGES.txt";
     license = licenses.bsd3;
     maintainers = with maintainers; [ mredaelli ];
   };
diff --git a/pkgs/development/python-modules/redshift-connector/default.nix b/pkgs/development/python-modules/redshift-connector/default.nix
new file mode 100644
index 00000000000..467d5e1340b
--- /dev/null
+++ b/pkgs/development/python-modules/redshift-connector/default.nix
@@ -0,0 +1,62 @@
+{ beautifulsoup4
+, boto3
+, buildPythonPackage
+, fetchFromGitHub
+, lib
+, lxml
+, packaging
+, pytest-mock
+, pytestCheckHook
+, pythonOlder
+, pytz
+, requests
+, scramp
+}:
+
+buildPythonPackage rec {
+  pname = "redshift-connector";
+  version = "2.0.910";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.6";
+
+  src = fetchFromGitHub {
+    owner = "aws";
+    repo = "amazon-redshift-python-driver";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-24yI6pXSHxhT30N3rJXAMtpCOhhGsBuDrwx9jMO1FW0=";
+  };
+
+  # disable test coverage
+  postPatch = ''
+    sed -i "/--cov/d" setup.cfg
+  '';
+
+  propagatedBuildInputs = [
+    beautifulsoup4
+    boto3
+    lxml
+    packaging
+    pytz
+    requests
+    scramp
+  ];
+
+  nativeCheckInputs = [
+    pytest-mock
+    pytestCheckHook
+  ];
+
+  # integration tests require a Redshift cluster
+  pytestFlagsArray = [ "test/unit" ];
+
+  __darwinAllowLocalNetworking = true; # required for tests
+
+  meta = {
+    description = "Redshift interface library";
+    homepage = "https://github.com/aws/amazon-redshift-python-driver";
+    changelog = "https://github.com/aws/amazon-redshift-python-driver/releases/tag/v${version}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ mcwitt ];
+  };
+}
diff --git a/pkgs/development/python-modules/regional/default.nix b/pkgs/development/python-modules/regional/default.nix
index 62d6ab1ea6d..0fc894e9f01 100644
--- a/pkgs/development/python-modules/regional/default.nix
+++ b/pkgs/development/python-modules/regional/default.nix
@@ -4,38 +4,48 @@
 , numpy
 , scipy
 , matplotlib
-, pytest
+, pytestCheckHook
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "regional";
   version = "1.1.2";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "freeman-lab";
     repo = pname;
     rev = "e3a29c58982e5cd3d5700131ac96e5e0b84fb981"; # no tags in repo
-    sha256 = "03qgm35q9sa5cy0kkw4bj60zfylw0isfzb96nlhdfrsigzs2zkxv";
+    hash = "sha256-u88v9H9RZ9cgtSat73QEnHr3gZGL8DmBZ0XphMuoDw8=";
   };
 
   propagatedBuildInputs = [
+    matplotlib
     numpy
     scipy
-    matplotlib
   ];
 
   nativeCheckInputs = [
-    pytest
+    pytestCheckHook
   ];
 
-  checkPhase = ''
-    pytest
-  '';
+  pythonImportsCheck = [
+    "regional"
+  ];
+
+  disabledTests = [
+    "test_dilate"
+    "test_outline"
+    "test_mask"
+  ];
 
   meta = with lib; {
     description = "Simple manipualtion and display of spatial regions";
     homepage = "https://github.com/freeman-lab/regional";
     license = licenses.mit;
-    maintainers = [ maintainers.costrouc ];
+    maintainers = with maintainers; [ costrouc ];
   };
 }
diff --git a/pkgs/development/python-modules/scikit-learn/default.nix b/pkgs/development/python-modules/scikit-learn/default.nix
index dbe2d10b780..7499eb6e9de 100644
--- a/pkgs/development/python-modules/scikit-learn/default.nix
+++ b/pkgs/development/python-modules/scikit-learn/default.nix
@@ -19,12 +19,12 @@
 
 buildPythonPackage rec {
   pname = "scikit-learn";
-  version = "1.2.0";
+  version = "1.2.1";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-aAtls8ruRpVBOF0spbA/9wQI9sYYxYOUgxLw0hJd9oA=";
+    sha256 = "sha256-+/ilyJPJtLmbzH7Y+z6FAJV6ET9BAYYDhtBmNVIPfPs=";
   };
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/tensorflow-estimator/default.nix b/pkgs/development/python-modules/tensorflow-estimator/bin.nix
index 24fb681f3b6..c7d8e4d630b 100644
--- a/pkgs/development/python-modules/tensorflow-estimator/default.nix
+++ b/pkgs/development/python-modules/tensorflow-estimator/bin.nix
@@ -6,13 +6,13 @@
 
 buildPythonPackage rec {
   pname = "tensorflow-estimator";
-  version = "2.10.0";
+  version = "2.11.0";
   format = "wheel";
 
   src = fetchPypi {
     pname = "tensorflow_estimator";
     inherit version format;
-    hash = "sha256-8yTqF81X8W4zvxiHEdUHfmsuX1oSwyjW4BoHsjiI7c0=";
+    hash = "sha256-6jtkrP/z2aJE8GF4yb3ty90/Eltn0IiNuoIpSY0GRos=";
   };
 
   propagatedBuildInputs = [ mock numpy absl-py ];
diff --git a/pkgs/development/python-modules/tensorflow/default.nix b/pkgs/development/python-modules/tensorflow/default.nix
index f0729fc28dc..fef979b70d1 100644
--- a/pkgs/development/python-modules/tensorflow/default.nix
+++ b/pkgs/development/python-modules/tensorflow/default.nix
@@ -74,7 +74,7 @@ let
 
   tfFeature = x: if x then "1" else "0";
 
-  version = "2.10.1";
+  version = "2.11.0";
   variant = if cudaSupport then "-gpu" else "";
   pname = "tensorflow${variant}";
 
@@ -187,8 +187,8 @@ let
     src = fetchFromGitHub {
       owner = "tensorflow";
       repo = "tensorflow";
-      rev = "v${version}";
-      hash = "sha256-AYHUtJEXYZdVDigKZo7mQnV+PDeQg8mi45YH18qXHZA=";
+      rev = "refs/tags/v${version}";
+      hash = "sha256-OYh61/83yv+ycivylfdS8yFUIUAk8euAPvmfjPzldGs=";
     };
 
     # On update, it can be useful to steal the changes from gentoo
@@ -372,11 +372,11 @@ let
     fetchAttrs = {
       sha256 = {
       x86_64-linux = if cudaSupport
-        then "sha256-Q6a/Q4fr5cmqqkIoL8ZBJOKfF4NXnrhqFi2VgUpHC3E="
-        else "sha256-RBrmxWBn5Yj5fIHlPYXuWOFMTqDGbgk+IvUXk7kIXHM=";
-      aarch64-linux = "sha256-MEkn2DplUW1R95q+A6uuIKNtMEBv08jU8kvTbMgIKJU=";
-      x86_64-darwin = "sha256-bqZTu0AABeg6M2IVwlkUPuF8EMsbQXurcmjWZY0EN9E=";
-      aarch64-darwin = "sha256-q1PfVqyZ3KG65aKw6l9vhxCfPoxH6Nb5y1Eh9P8Ovqk=";
+        then "sha256-/wB9EpaDPg3TrD9qggdA4vPgzvmaKc6dDnLjoYTJC5o="
+        else "sha256-QgOaUaq0V5HG9BOv9nEw8OTSlzINNFvbnyP8Vx+r9Xw=";
+      aarch64-linux = "sha256-zjnRtTG1j9cZTbP0Xnk2o/zWTNsP8T0n4Ai8IiAT3PE=";
+      x86_64-darwin = "sha256-RBLox9rzBKcZMm4NwnT7vQ/EjapWQJkqxuQ0LIdaM1E=";
+      aarch64-darwin = "sha256-BRzh79lYvMHsUMk8BEYDLHTpnmeZ9+0lrDtj4XI1YY4=";
       }.${stdenv.hostPlatform.system} or (throw "unsupported system ${stdenv.hostPlatform.system}");
     };
 
@@ -419,6 +419,7 @@ let
     };
 
     meta = with lib; {
+      changelog = "https://github.com/tensorflow/tensorflow/releases/tag/v${version}";
       description = "Computation using data flow graphs for scalable machine learning";
       homepage = "http://tensorflow.org";
       license = licenses.asl20;
@@ -438,11 +439,13 @@ in buildPythonPackage {
   src = bazel-build.python;
 
   # Adjust dependency requirements:
+  # - Drop tensorflow-io dependency until we get it to build
   # - Relax flatbuffers and gast version requirements
   # - The purpose of python3Packages.libclang is not clear at the moment and we don't have it packaged yet
   # - keras and tensorlow-io-gcs-filesystem will be considered as optional for now.
   postPatch = ''
     sed -i setup.py \
+      -e '/tensorflow-io-gcs-filesystem/,+1d' \
       -e "s/'flatbuffers[^']*',/'flatbuffers',/" \
       -e "s/'gast[^']*',/'gast',/" \
       -e "/'libclang[^']*',/d" \
diff --git a/pkgs/development/python-modules/toposort/default.nix b/pkgs/development/python-modules/toposort/default.nix
index a9722b053bf..2559399b25c 100644
--- a/pkgs/development/python-modules/toposort/default.nix
+++ b/pkgs/development/python-modules/toposort/default.nix
@@ -6,12 +6,12 @@
 
 buildPythonPackage rec {
   pname = "toposort";
-  version = "1.7";
+  version = "1.9";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-3cIYLEKRKkQFEb1/9dPmocq8Osy8Z0oyWMjEHL+7ISU=";
+    sha256 = "sha256-9Bo0SQ1Ek0tTOnva/5ee6KRyA/0tinRtuD8tWrEkWLk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/umap-learn/default.nix b/pkgs/development/python-modules/umap-learn/default.nix
index 79d7e40bbc9..001a5f1b420 100644
--- a/pkgs/development/python-modules/umap-learn/default.nix
+++ b/pkgs/development/python-modules/umap-learn/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , keras
 , numba
 , numpy
@@ -27,6 +28,22 @@ buildPythonPackage rec {
     hash = "sha256-S2+k7Ec4AxsN6d0GUGnU81oLnBgmlZp8OmUFCNaUJYw=";
   };
 
+  patches = [
+    # Fix tests with sklearn>=1.2.0
+    (fetchpatch {
+      url = "https://github.com/lmcinnes/umap/commit/a714b59bd9e2ca2e63312bc3491b2b037a42f2f2.patch";
+      hash = "sha256-WOSWNN5ewVTV7IEBEA7ZzgZYMZxctF1jAWs9ylKTyLs=";
+    })
+    (fetchpatch {
+      url = "https://github.com/lmcinnes/umap/commit/c7d05683325589ad432a55e109cacb9d631cfaa9.patch";
+      hash = "sha256-hE2Svxf7Uja+DbCmTDCnd7mZynjNbC5GUjfqg4ZRO9Y=";
+    })
+    (fetchpatch {
+      url = "https://github.com/lmcinnes/umap/commit/949abd082524fce8c45dfb147bcd8e8ef49eade3.patch";
+      hash = "sha256-8/1k8iYeF77FIaUApNtY07auPJkrt3vNRR/HTYRvq+0=";
+    })
+  ];
+
   propagatedBuildInputs = [
     numba
     numpy
diff --git a/pkgs/development/python-modules/volvooncall/default.nix b/pkgs/development/python-modules/volvooncall/default.nix
index 604901c8da7..f3df712c3d5 100644
--- a/pkgs/development/python-modules/volvooncall/default.nix
+++ b/pkgs/development/python-modules/volvooncall/default.nix
@@ -1,34 +1,43 @@
 { lib
+, aiohttp
+, amqtt
 , buildPythonPackage
-, pythonOlder
+, certifi
+, docopt
 , fetchFromGitHub
-, setuptools
+, fetchpatch
 , geopy
-, docopt
-, certifi
-, amqtt
-, websockets
-, aiohttp
-, pytestCheckHook
-, asynctest
+, mock
 , pytest-asyncio
+, pytestCheckHook
+, pythonOlder
+, setuptools
+, websockets
 }:
 
 buildPythonPackage rec {
   pname = "volvooncall";
   version = "0.10.1";
+  format = "setuptools";
 
   disabled = pythonOlder "3.8";
 
-  format = "setuptools";
-
   src = fetchFromGitHub {
     owner = "molobrakos";
     repo = "volvooncall";
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
     hash = "sha256-udYvgKj7Rlc/hA86bbeBfnoVRjKkXT4TwpceWz226cU=";
   };
 
+  patches = [
+    # Remove async, https://github.com/molobrakos/volvooncall/pull/92
+    (fetchpatch {
+      name = "remove-asnyc.patch";
+      url = "https://github.com/molobrakos/volvooncall/commit/ef0df403250288c00ed4c600e9dfa79dcba8941e.patch";
+      hash = "sha256-U+hM7vzD9JSEUumvjPSLpVQcc8jAuZHG3/1dQ3wnIcA=";
+    })
+  ];
+
   propagatedBuildInputs = [
     aiohttp
   ];
@@ -45,17 +54,20 @@ buildPythonPackage rec {
     ];
   };
 
-  nativeCheckInputs = [
-    asynctest
+  checkInputs = [
+    mock
     pytest-asyncio
     pytestCheckHook
   ] ++ passthru.optional-dependencies.mqtt;
 
-  pythonImportsCheck = [ "volvooncall" ];
+  pythonImportsCheck = [
+    "volvooncall"
+  ];
 
   meta = with lib; {
     description = "Retrieve information from the Volvo On Call web service";
     homepage = "https://github.com/molobrakos/volvooncall";
+    changelog = "https://github.com/molobrakos/volvooncall/releases/tag/v${version}";
     license = licenses.unlicense;
     maintainers = with maintainers; [ dotlambda ];
   };
diff --git a/pkgs/development/tools/ameba/default.nix b/pkgs/development/tools/ameba/default.nix
index 27068cbc4c4..303275e3b9c 100644
--- a/pkgs/development/tools/ameba/default.nix
+++ b/pkgs/development/tools/ameba/default.nix
@@ -2,13 +2,13 @@
 
 crystal.buildCrystalPackage rec {
   pname = "ameba";
-  version = "1.3.1";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "crystal-ameba";
     repo = "ameba";
     rev = "v${version}";
-    hash = "sha256-SZ2sBQeZgtPOYioH9eK5MveFtWVGPvgKMrqsCfjoRGM=";
+    hash = "sha256-9dMzT/SnO16jfUfYYiT4MOGnlgrw0jWTNL37u1Y5oBI=";
   };
 
   format = "make";
diff --git a/pkgs/development/tools/esbuild/default.nix b/pkgs/development/tools/esbuild/default.nix
index 0aebdeeb47c..34a7a166efd 100644
--- a/pkgs/development/tools/esbuild/default.nix
+++ b/pkgs/development/tools/esbuild/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "esbuild";
-  version = "0.17.3";
+  version = "0.17.5";
 
   src = fetchFromGitHub {
     owner = "evanw";
     repo = "esbuild";
     rev = "v${version}";
-    hash = "sha256-hqp5K+FOS+UzwIkUTLrw+q4PIQ9OV+8OKKx6wgXBnI0=";
+    hash = "sha256-QLV6+1se3F7naG3jgXtSfmoTR0d7cFByRznzf+xjDpk=";
   };
 
   vendorHash = "sha256-+BfxCyg0KkDQpHt/wycy/8CTG6YBA/VJvJFhhzUnSiQ=";
diff --git a/pkgs/development/tools/frugal/default.nix b/pkgs/development/tools/frugal/default.nix
index 42f76eb092b..5a68519f660 100644
--- a/pkgs/development/tools/frugal/default.nix
+++ b/pkgs/development/tools/frugal/default.nix
@@ -2,18 +2,18 @@
 
 buildGoModule rec {
   pname = "frugal";
-  version = "3.16.12";
+  version = "3.16.14";
 
   src = fetchFromGitHub {
     owner = "Workiva";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Kdy3bh76c2sgwAwSxzCs83jTVLJmnH0YcYtKH9UvJew=";
+    sha256 = "sha256-6U4mYS5ukcOaxGeIiI2UFYlz0PpjKdtQH9cOshYRUg0=";
   };
 
   subPackages = [ "." ];
 
-  vendorHash = "sha256-S45/wxwyoSBmHsttY+pQSE1Ipg7oH3RrCoBeuC1pxeo=";
+  vendorHash = "sha256-CbneZtwGab5dlGASZqa69Y70fXgt4PJzAODPJlcpJoA=";
 
   meta = with lib; {
     description = "Thrift improved";
diff --git a/pkgs/development/tools/misc/elfutils/default.nix b/pkgs/development/tools/misc/elfutils/default.nix
index ec43a3932d9..2b71fa71167 100644
--- a/pkgs/development/tools/misc/elfutils/default.nix
+++ b/pkgs/development/tools/misc/elfutils/default.nix
@@ -53,6 +53,11 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     patchShebangs tests/*.sh
+  '' + lib.optionalString stdenv.hostPlatform.isRiscV ''
+    # disable failing test:
+    #
+    # > dwfl_thread_getframes: No DWARF information found
+    sed -i s/run-backtrace-dwarf.sh//g tests/Makefile.in
   '';
 
   outputs = [ "bin" "dev" "out" "man" ];
diff --git a/pkgs/development/tools/protoc-gen-connect-go/default.nix b/pkgs/development/tools/protoc-gen-connect-go/default.nix
index a968c26ff58..5941b2cc51e 100644
--- a/pkgs/development/tools/protoc-gen-connect-go/default.nix
+++ b/pkgs/development/tools/protoc-gen-connect-go/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "protoc-gen-connect-go";
-  version = "1.4.1";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "bufbuild";
     repo = "connect-go";
     rev = "refs/tags/v${version}";
-    hash = "sha256-9dLILgDolHgQx33dAtYT3RJ0scWUVh52z+2Fh6FS+K4=";
+    hash = "sha256-lk7PcSsqm2oLYerhXGxcyqkw5VJ46JIASU87ppybd78=";
   };
 
   vendorHash = "sha256-Bh2JCWTaML/QU/sLBsxLKMzzH++K22BTGusfcVW2GBw=";
diff --git a/pkgs/development/tools/ruff/default.nix b/pkgs/development/tools/ruff/default.nix
index 72aa21aa9c7..54ff2962f98 100644
--- a/pkgs/development/tools/ruff/default.nix
+++ b/pkgs/development/tools/ruff/default.nix
@@ -1,22 +1,27 @@
 { lib
 , rustPlatform
 , fetchFromGitHub
+, installShellFiles
 , stdenv
 , darwin
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "ruff";
-  version = "0.0.236";
+  version = "0.0.237";
 
   src = fetchFromGitHub {
     owner = "charliermarsh";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-2JV0isbVkpEt6bsLdTbII9LjtvdGB22ZDSpf7bj6dto=";
+    sha256 = "sha256-c2mD03gxbBnnifTXPpdJk4kwpeHdrwckymaFGKJwDc8=";
   };
 
-  cargoSha256 = "sha256-cjMz3L24CRk1Qoz7sapk3EKtFfm8Uto+jtLy71rDGvQ=";
+  cargoSha256 = "sha256-pYOMCmNrI4uzqXkbc2D9UvNHg2PlibmEhtml+A1V1BQ=";
+
+  nativeBuildInputs = [
+    installShellFiles
+  ];
 
   buildInputs = lib.optionals stdenv.isDarwin [
     darwin.apple_sdk.frameworks.CoreServices
@@ -25,6 +30,13 @@ rustPlatform.buildRustPackage rec {
   # building tests fails with `undefined symbols`
   doCheck = false;
 
+  postInstall = ''
+    installShellCompletion --cmd ruff \
+      --bash <($out/bin/ruff generate-shell-completion bash) \
+      --fish <($out/bin/ruff generate-shell-completion fish) \
+      --zsh <($out/bin/ruff generate-shell-completion zsh)
+  '';
+
   meta = with lib; {
     description = "An extremely fast Python linter";
     homepage = "https://github.com/charliermarsh/ruff";
diff --git a/pkgs/development/tools/rust/probe-rs-cli/default.nix b/pkgs/development/tools/rust/probe-rs-cli/default.nix
index 3f26e4bd3ab..9992e09d98b 100644
--- a/pkgs/development/tools/rust/probe-rs-cli/default.nix
+++ b/pkgs/development/tools/rust/probe-rs-cli/default.nix
@@ -11,14 +11,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "probe-rs-cli";
-  version = "0.14.0";
+  version = "0.14.2";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-y9EHksRDVbw58XiV7/dKzy4p6OWWAkQ3X9LP/WDWD2c=";
+    sha256 = "sha256-CrBgj0M3slhPrAYc2+I80ZfUC/CJzcmFwLc9yX2SSR4=";
   };
 
-  cargoSha256 = "sha256-vv8XSAsGs1M97Y6cIGYevCdaxmPy3aDmHFF00exumq8=";
+  cargoSha256 = "sha256-nHjVldLsi9Xr6pPOeLpb6anvno2244g/LNIv7DnbSI4=";
 
   nativeBuildInputs = [ pkg-config ] ++ lib.optionals stdenv.isDarwin [ DarwinTools ];
 
diff --git a/pkgs/games/runescape-launcher/default.nix b/pkgs/games/runescape-launcher/default.nix
index 9fd89c062e4..44a5b95974e 100644
--- a/pkgs/games/runescape-launcher/default.nix
+++ b/pkgs/games/runescape-launcher/default.nix
@@ -1,8 +1,28 @@
-{ stdenv, lib, buildFHSUserEnv, dpkg, glibc, gcc-unwrapped, autoPatchelfHook, fetchurl, wrapGAppsHook
-, gnome2, xorg
-, libSM, libXxf86vm, libX11, glib, pango, cairo, gtk2-x11, zlib, openssl_1_1
+{ stdenv
+, lib
+, autoPatchelfHook
+, buildFHSUserEnv
+, cairo
+, dpkg
+, fetchurl
+, gcc-unwrapped
+, glib
+, glibc
+, gnome2
+, gtk2-x11
+, libGL
 , libpulseaudio
-, SDL2, xorg_sys_opengl, libGL
+, libSM
+, libXxf86vm
+, libX11
+, openssl_1_1
+, pango
+, SDL2
+, wrapGAppsHook
+, xdg-utils
+, xorg
+, xorg_sys_opengl
+, zlib
 }:
 let
 
@@ -19,30 +39,31 @@ let
 
     nativeBuildInputs = [
       autoPatchelfHook
-      wrapGAppsHook
       dpkg
+      wrapGAppsHook
     ];
 
     buildInputs = [
-      glibc
+      cairo
       gcc-unwrapped
+      glib
+      glibc
+      gtk2-x11
       libSM
       libXxf86vm
       libX11
-      glib
+      openssl_1_1
       pango
-      cairo
-      gtk2-x11
       zlib
-      openssl_1_1
     ];
 
     runtimeDependencies = [
-      libpulseaudio
       libGL
+      libpulseaudio
       SDL2
-      xorg_sys_opengl
       openssl_1_1
+      xdg-utils # The launcher uses `xdg-open` to open HTTP URLs in the user's browser
+      xorg_sys_opengl
       zlib
     ];
 
@@ -95,11 +116,24 @@ in
     name = "RuneScape";
     targetPkgs = pkgs: [
       runescape
-      dpkg glibc gcc-unwrapped
-      libSM libXxf86vm libX11 glib pango cairo gtk2-x11 zlib openssl_1_1
+      cairo
+      dpkg
+      gcc-unwrapped
+      glib
+      glibc
+      gtk2-x11
+      libGL
       libpulseaudio
+      libSM
+      libXxf86vm
+      libX11
+      openssl_1_1
+      pango
+      SDL2
+      xdg-utils
       xorg.libX11
-      SDL2 xorg_sys_opengl libGL
+      xorg_sys_opengl
+      zlib
     ];
     multiPkgs = pkgs: [ libGL ];
     runScript = "runescape-launcher";
diff --git a/pkgs/os-specific/linux/health-check/default.nix b/pkgs/os-specific/linux/health-check/default.nix
index e876808b461..9e85281ea4c 100644
--- a/pkgs/os-specific/linux/health-check/default.nix
+++ b/pkgs/os-specific/linux/health-check/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "health-check";
-  version = "0.03.10";
+  version = "0.03.11";
 
   src = fetchFromGitHub {
     owner = "ColinIanKing";
     repo = pname;
     rev = "V${version}";
-    hash = "sha256-1dm7tl7DHv1CzuLe1/UewDSUOanO0hN+STkPrAHcZmI=";
+    hash = "sha256-QLa/7kA0juefzOba7ELopDmOVfiGJReo4LCfhnxW1tk=";
   };
 
   buildInputs = [ json_c libbsd ];
diff --git a/pkgs/servers/nzbhydra2/default.nix b/pkgs/servers/nzbhydra2/default.nix
index 375224dfdc2..fa6234a34eb 100644
--- a/pkgs/servers/nzbhydra2/default.nix
+++ b/pkgs/servers/nzbhydra2/default.nix
@@ -1,16 +1,23 @@
-{ lib, stdenv, fetchzip, makeWrapper, jre, python3, unzip }:
-
+{
+  lib,
+  stdenv,
+  fetchzip,
+  makeWrapper,
+  jre,
+  python3,
+  unzip,
+}:
 stdenv.mkDerivation rec {
   pname = "nzbhydra2";
-  version = "3.14.2";
+  version = "4.7.6";
 
   src = fetchzip {
     url = "https://github.com/theotherp/${pname}/releases/download/v${version}/${pname}-${version}-linux.zip";
-    sha512 = "sha512-wC2GhCjkRt/rmLAhe6nDCdF4PsfBpOo0T4BOSdw4wlBr7eCfo4Cibt9VvK6DNLuDk7EGkUfxvw9HI9sbRJlpCw==";
+    hash = "sha512-vc+VInEnh00bASxcEwSjJcsa0QJHmtRzSz30uW60wGmA24tlaJYSk42N5KpGFbkQkOkb2ijHmKGxPogSa4izRQ==";
     stripRoot = false;
   };
 
-  nativeBuildInputs = [ jre makeWrapper unzip ];
+  nativeBuildInputs = [jre makeWrapper unzip];
 
   installPhase = ''
     runHook preInstall
@@ -30,7 +37,7 @@ stdenv.mkDerivation rec {
     description = "Usenet meta search";
     homepage = "https://github.com/theotherp/nzbhydra2";
     license = licenses.asl20;
-    maintainers = with maintainers; [ jamiemagee ];
+    maintainers = with maintainers; [jamiemagee];
     platforms = with platforms; linux;
   };
 }
diff --git a/pkgs/servers/plex/raw.nix b/pkgs/servers/plex/raw.nix
index c7d1ec7f36e..3cee78f571e 100644
--- a/pkgs/servers/plex/raw.nix
+++ b/pkgs/servers/plex/raw.nix
@@ -12,16 +12,16 @@
 # server, and the FHS userenv and corresponding NixOS module should
 # automatically pick up the changes.
 stdenv.mkDerivation rec {
-  version = "1.30.1.6562-915986d62";
+  version = "1.30.2.6563-3d4dc0cce";
   pname = "plexmediaserver";
 
   # Fetch the source
   src = if stdenv.hostPlatform.system == "aarch64-linux" then fetchurl {
     url = "https://downloads.plex.tv/plex-media-server-new/${version}/debian/plexmediaserver_${version}_arm64.deb";
-    sha256 = "sha256-fUt8fh4jeZiUbDoc8ivuSpx0Hf4ShYYcfJUJjU+GCxQ=";
+    sha256 = "0sz6xc484flh1cnlrvwin7x34bl118yy2mwj034f8p9ngiy5hrkw";
   } else fetchurl {
     url = "https://downloads.plex.tv/plex-media-server-new/${version}/debian/plexmediaserver_${version}_amd64.deb";
-    sha256 = "sha256-ho/r/ouaFsdCH0xcFuy4TWamu0c/ZBZDJO6cYQK/pW0=";
+    sha256 = "0ymxfy3s9nygv9syiy2bdwmjfqg8m4i5n8c37z1ib6393iwj8mgi";
   };
 
   outputs = [ "out" "basedb" ];
diff --git a/pkgs/servers/stayrtr/default.nix b/pkgs/servers/stayrtr/default.nix
index a168cf5b1ee..0193f3ede56 100644
--- a/pkgs/servers/stayrtr/default.nix
+++ b/pkgs/servers/stayrtr/default.nix
@@ -7,15 +7,15 @@
 
 buildGoModule rec {
   pname = "stayrtr";
-  version = "0.3.0";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "bgp";
     repo = "stayrtr";
     rev = "v${version}";
-    sha256 = "10ndb8p7znnjycwg56m63gzqf9zc6lq9mcvz4n48j0c4il5xyn8x";
+    sha256 = "sha256-oRFBvue5Tcgty1GgsZGb/CMHmKM0mIc5vWOMsL/0IfI=";
   };
-  vendorSha256 = "1nwrzbpqycr4ixk8a90pgaxcwakv5nlfnql6hmcc518qrva198wp";
+  vendorHash = "sha256-VomrmyNa5I6AVSpw5sg0e4b7w/JlFQINBYm+eh1FoNw=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/shells/oil/default.nix b/pkgs/shells/oil/default.nix
index bff43f683fa..ec290910918 100644
--- a/pkgs/shells/oil/default.nix
+++ b/pkgs/shells/oil/default.nix
@@ -1,16 +1,24 @@
-{ stdenv, lib, fetchurl, withReadline ? true, readline }:
+{ stdenv, lib, fetchurl, symlinkJoin, withReadline ? true, readline }:
 
+let
+  readline-all = symlinkJoin {
+    name = "readline-all"; paths = [ readline readline.dev ];
+  };
+in
 stdenv.mkDerivation rec {
   pname = "oil";
-  version = "0.12.9";
+  version = "0.14.0";
 
   src = fetchurl {
     url = "https://www.oilshell.org/download/oil-${version}.tar.xz";
-    hash = "sha256-HY/SZiVOfOrA69gGxEp+qdRnuTJ72XveAk9Xp45zcf8=";
+    hash = "sha256-ZrT2vHfbc0S9Q9e9lDiyptfSC3CIiQs8Co9FODil7oY=";
   };
 
   postPatch = ''
     patchShebangs build
+    # TODO: workaround for https://github.com/oilshell/oil/issues/1467
+    #       check for removability on updates :)
+    substituteInPlace configure --replace "echo '#define HAVE_READLINE 1'" "echo '#define HAVE_READLINE 1' && return 0"
   '';
 
   preInstall = ''
@@ -19,7 +27,12 @@ stdenv.mkDerivation rec {
 
   strictDeps = true;
   buildInputs = lib.optional withReadline readline;
-  configureFlags = lib.optional withReadline "--with-readline";
+  configureFlags = [
+    "--datarootdir=${placeholder "out"}"
+  ] ++ lib.optionals withReadline [
+    "--with-readline"
+    "--readline=${readline-all}"
+  ];
 
   # Stripping breaks the bundles by removing the zip file from the end.
   dontStrip = true;
diff --git a/pkgs/shells/zsh/zsh-powerlevel10k/default.nix b/pkgs/shells/zsh/zsh-powerlevel10k/default.nix
index 4f5e21ec8cf..3fd0920e9b3 100644
--- a/pkgs/shells/zsh/zsh-powerlevel10k/default.nix
+++ b/pkgs/shells/zsh/zsh-powerlevel10k/default.nix
@@ -7,25 +7,25 @@ let
   # match gitstatus version with given `gitstatus_version`:
   # https://github.com/romkatv/powerlevel10k/blob/master/gitstatus/build.info
   gitstatus = pkgs.gitstatus.overrideAttrs (oldAtttrs: rec {
-    version = "1.5.3";
+    version = "1.5.4";
 
     src = fetchFromGitHub {
       owner = "romkatv";
       repo = "gitstatus";
-      rev = "v${version}";
-      sha256 = "17giwdjrsmr71xskxxf506n8kaab8zx77fv267fx37ifi57nffk5";
+      rev = "refs/tags/v${version}";
+      hash = "sha256-mVfB3HWjvk4X8bmLEC/U8SKBRytTh/gjjuReqzN5qTk=";
     };
   });
 in
 stdenv.mkDerivation rec {
   pname = "powerlevel10k";
-  version = "1.16.1";
+  version = "1.17.0";
 
   src = fetchFromGitHub {
     owner = "romkatv";
     repo = "powerlevel10k";
-    rev = "v${version}";
-    sha256 = "0fkfh8j7rd8mkpgz6nsx4v7665d375266shl1aasdad8blgqmf0c";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-fgrwbWj6CcPoZ6GbCZ47HRUg8ZSJWOsa7aipEqYuE0Q=";
   };
 
   strictDeps = true;
@@ -47,11 +47,11 @@ stdenv.mkDerivation rec {
   '';
 
   meta = {
+    changelog = "https://github.com/romkatv/powerlevel10k/releases/tag/v${version}";
     description = "A fast reimplementation of Powerlevel9k ZSH theme";
     homepage = "https://github.com/romkatv/powerlevel10k";
     license = lib.licenses.mit;
-
     platforms = lib.platforms.unix;
-    maintainers = [ lib.maintainers.hexa ];
+    maintainers = with lib.maintainers; [ hexa ];
   };
 }
diff --git a/pkgs/tools/misc/locate-dominating-file/default.nix b/pkgs/tools/misc/locate-dominating-file/default.nix
index 8932b6f6225..c4c55ca3b06 100644
--- a/pkgs/tools/misc/locate-dominating-file/default.nix
+++ b/pkgs/tools/misc/locate-dominating-file/default.nix
@@ -15,11 +15,9 @@ stdenvNoCC.mkDerivation {
     owner = "roman";
     repo = "locate-dominating-file";
     rev = "v${version}";
-    sha256 = "sha256-gwh6fAw7BV7VFIkQN02QIhK47uxpYheMk64UeLyp2IY=";
+    hash = "sha256-gwh6fAw7BV7VFIkQN02QIhK47uxpYheMk64UeLyp2IY=";
   };
 
-  doCheck = true;
-
   postPatch = ''
     for file in $(find src tests -type f); do
       patchShebangs "$file"
@@ -28,14 +26,7 @@ stdenvNoCC.mkDerivation {
 
   buildInputs = [ getopt ];
 
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out/bin
-    cp src/locate-dominating-file.sh $out/bin/locate-dominating-file
-
-    runHook postInstall
-  '';
+  doCheck = true;
 
   checkInputs = [ (bats.withLibraries (p: [ p.bats-support p.bats-assert ])) ];
 
@@ -47,7 +38,17 @@ stdenvNoCC.mkDerivation {
     runHook postCheck
   '';
 
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    cp src/locate-dominating-file.sh $out/bin/locate-dominating-file
+
+    runHook postInstall
+  '';
+
   meta = with lib; {
+    homepage = "https://github.com/roman/locate-dominating-file";
     description = "Program that looks up in a directory hierarchy for a given filename";
     license = licenses.mit;
     maintainers = [ maintainers.roman ];
diff --git a/pkgs/tools/misc/progress/default.nix b/pkgs/tools/misc/progress/default.nix
index 9feee484170..94eeace1dc2 100644
--- a/pkgs/tools/misc/progress/default.nix
+++ b/pkgs/tools/misc/progress/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/Xfennec/progress";
     description = "Tool that shows the progress of coreutils programs";
     license = licenses.gpl3;
-    platforms = platforms.linux;
+    platforms = platforms.linux ++ platforms.darwin;
     maintainers = with maintainers; [ pSub ];
   };
 }
diff --git a/pkgs/tools/misc/usbimager/default.nix b/pkgs/tools/misc/usbimager/default.nix
index 6903039f6a5..89ce91ef3e1 100644
--- a/pkgs/tools/misc/usbimager/default.nix
+++ b/pkgs/tools/misc/usbimager/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "usbimager";
-  version = "1.0.8";
+  version = "1.0.9";
 
   src = fetchFromGitLab {
     owner = "bztsrc";
     repo = pname;
     rev = version;
-    sha256 = "1j0g1anmdwc3pap3m4kfzqjfkn7q0vpmqniii2kcz7svs5h3ybga";
+    sha256 = "sha256-CEGUXJXqXmD8uT93T9dg49Lf5vTpAzQjdnhYmbR5zTI=";
   };
 
   sourceRoot = "source/src/";
diff --git a/pkgs/tools/misc/vtm/default.nix b/pkgs/tools/misc/vtm/default.nix
index fddef03c9cf..93b451bedc8 100644
--- a/pkgs/tools/misc/vtm/default.nix
+++ b/pkgs/tools/misc/vtm/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vtm";
-  version = "0.9.8n";
+  version = "0.9.8q";
 
   src = fetchFromGitHub {
     owner = "netxs-group";
     repo = "vtm";
     rev = "v${version}";
-    sha256 = "sha256-uH4nyhc3u9yuUZfMJ8rU8cZGtyqMfL+LyNB0/h3X45E=";
+    sha256 = "sha256-oY0zmyAgxMHPcBxFNdByQfeLIquw6eQ2SSfCgTKtO7Q=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/tools/misc/xq/default.nix b/pkgs/tools/misc/xq/default.nix
index 8168f9603a5..410531d5a74 100644
--- a/pkgs/tools/misc/xq/default.nix
+++ b/pkgs/tools/misc/xq/default.nix
@@ -6,14 +6,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "xq";
-  version = "0.2.40";
+  version = "0.2.42";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-sOCdNQ+prQRdj3Oeaa4HLhufbwtClUzzhnMDwSU4SJE=";
+    sha256 = "sha256-VR2ZUt0qvQBaFZr7Gui/LywsRrPubQlzYj1PQj05xhY=";
   };
 
-  cargoSha256 = "sha256-b41D/sg+qD/SbwQvEqv3sFWuW15VQ4gEiL51I7/hOmI=";
+  cargoHash = "sha256-rX0fwJM8sHTuHIsmk9JpgWrTq1EA6Ksx7fFqWqY5R4k=";
 
   meta = with lib; {
     description = "Pure rust implementation of jq";
diff --git a/pkgs/tools/networking/chisel/default.nix b/pkgs/tools/networking/chisel/default.nix
index d7dac44b280..d14dd66e140 100644
--- a/pkgs/tools/networking/chisel/default.nix
+++ b/pkgs/tools/networking/chisel/default.nix
@@ -1,24 +1,28 @@
-{ buildGoModule
+{ lib
+, buildGoModule
 , fetchFromGitHub
-, lib
 }:
 
 buildGoModule rec {
   pname = "chisel";
-  version = "1.7.7";
+  version = "1.8.1";
 
   src = fetchFromGitHub {
     owner = "jpillora";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-3EaVUGcwkJWX0FxIaHddUehJIdbxAPfBm8esXKCUuhM=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-N2voSclNH7lGbUkZo2gkrEb6XoA5f0BzNgAzQs1lOKQ=";
   };
 
-  vendorSha256 = "sha256-Oko9nduKW76NIUCVyF0lPzEH+TFT1el9VGIbm5lQXtM=";
+  vendorHash = "sha256-p/5g4DLoUhEPFBtAbMiIgc6O4eAfbiqBjCqYkyUHy70=";
 
-  ldflags = [ "-s" "-w" "-X github.com/jpillora/chisel/share.BuildVersion=${version}" ];
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/jpillora/chisel/share.BuildVersion=${version}"
+  ];
 
-  # tests require access to the network
+  # Tests require access to the network
   doCheck = false;
 
   meta = with lib; {
@@ -30,6 +34,7 @@ buildGoModule rec {
       used to provide a secure endpoint into your network.
     '';
     homepage = "https://github.com/jpillora/chisel";
+    changelog = "https://github.com/jpillora/chisel/releases/tag/v${version}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/tools/text/crowdin-cli/default.nix b/pkgs/tools/text/crowdin-cli/default.nix
index 5d97f8195f7..aaafad27949 100644
--- a/pkgs/tools/text/crowdin-cli/default.nix
+++ b/pkgs/tools/text/crowdin-cli/default.nix
@@ -14,11 +14,11 @@
 
 stdenv.mkDerivation rec {
   pname = "crowdin-cli";
-  version = "3.9.3";
+  version = "3.10.0";
 
   src = fetchurl {
     url = "https://github.com/crowdin/${pname}/releases/download/${version}/${pname}.zip";
-    sha256 = "sha256-p8abIgCAXo/LW/AZN2esSYVkVoggQ2vj5QkAseHwXJo=";
+    sha256 = "sha256-4OEwee7izd2gxv7HMq5ziu88sj78QRtGH4bgooZXLow=";
   };
 
   nativeBuildInputs = [ installShellFiles makeWrapper unzip ];
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 23ce7f3d3bb..95bacb02b0c 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -29909,6 +29909,7 @@ with pkgs;
   hledger-interest = haskell.lib.compose.justStaticExecutables haskellPackages.hledger-interest;
   hledger-ui = haskell.lib.compose.justStaticExecutables haskellPackages.hledger-ui;
   hledger-web = haskell.lib.compose.justStaticExecutables haskellPackages.hledger-web;
+  hledger-utils = with python3.pkgs; toPythonApplication hledger-utils;
 
   homebank = callPackage ../applications/office/homebank {
     gtk = gtk3;
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 5430ab54c66..4ad9b845adc 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -218,6 +218,7 @@ mapAliases ({
   SQLAlchemy-ImageAttach = throw "sqlalchemy-imageattach has been removed as it is incompatible with sqlalchemy 1.4 and unmaintained"; # added 2022-04-23
   tensorflow-bin_2 = tensorflow-bin; # added 2021-11-25
   tensorflow-build_2 = tensorflow-build; # added 2021-11-25
+  tensorflow-estimator = tensorflow-estimator-bin; # added 2023-01-17
   tensorflow-estimator_2 = tensorflow-estimator; # added 2021-11-25
   tensorflow-tensorboard = tensorboard; # added 2022-03-06
   tensorflow-tensorboard_2 = tensorflow-tensorboard; # added 2021-11-25
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index b4d8fbb4968..455b91df38a 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2814,6 +2814,10 @@ self: super: with self; {
 
   dragonfly = callPackage ../development/python-modules/dragonfly { };
 
+  drawille = callPackage ../development/python-modules/drawille { };
+
+  drawilleplot = callPackage ../development/python-modules/drawilleplot { };
+
   dremel3dpy = callPackage ../development/python-modules/dremel3dpy { };
 
   drf-jwt = callPackage ../development/python-modules/drf-jwt { };
@@ -4321,6 +4325,8 @@ self: super: with self; {
 
   hkdf = callPackage ../development/python-modules/hkdf { };
 
+  hledger-utils = callPackage ../development/python-modules/hledger-utils { };
+
   hlk-sw16 = callPackage ../development/python-modules/hlk-sw16 { };
 
   hmmlearn = callPackage ../development/python-modules/hmmlearn { };
@@ -9856,6 +9862,8 @@ self: super: with self; {
 
   rednose = callPackage ../development/python-modules/rednose { };
 
+  redshift-connector = callPackage ../development/python-modules/redshift-connector { };
+
   reedsolo = callPackage ../development/python-modules/reedsolo { };
 
   reflink = callPackage ../development/python-modules/reflink { };
@@ -11249,7 +11257,7 @@ self: super: with self; {
 
   tensorflow-datasets = callPackage ../development/python-modules/tensorflow-datasets { };
 
-  tensorflow-estimator = callPackage ../development/python-modules/tensorflow-estimator { };
+  tensorflow-estimator-bin = callPackage ../development/python-modules/tensorflow-estimator/bin.nix { };
 
   tensorflow-metadata = callPackage ../development/python-modules/tensorflow-metadata { };