Merge staging-next into staging

42 files changed, 137 insertions, 79 deletions

diff --git a/pkgs/applications/blockchains/monero-gui/default.nix b/pkgs/applications/blockchains/monero-gui/default.nix
index dae02aba1d0..97c794cc998 100644
--- a/pkgs/applications/blockchains/monero-gui/default.nix
+++ b/pkgs/applications/blockchains/monero-gui/default.nix
@@ -99,5 +99,6 @@ stdenv.mkDerivation rec {
     license      = licenses.bsd3;
     platforms    = platforms.all;
     maintainers  = with maintainers; [ rnhmjoj ];
+    mainProgram  = "monero-wallet-gui";
   };
 }
diff --git a/pkgs/applications/graphics/drawio/headless.nix b/pkgs/applications/graphics/drawio/headless.nix
index 34959da67b4..a287c40c680 100644
--- a/pkgs/applications/graphics/drawio/headless.nix
+++ b/pkgs/applications/graphics/drawio/headless.nix
@@ -32,5 +32,6 @@ writeTextFile {
       directory.
     '';
     maintainers = with maintainers; [ qyliss tfc ];
+    mainProgram = "drawio";
   };
 }
diff --git a/pkgs/applications/misc/organicmaps/default.nix b/pkgs/applications/misc/organicmaps/default.nix
index 294d77404a3..4395cf7721d 100644
--- a/pkgs/applications/misc/organicmaps/default.nix
+++ b/pkgs/applications/misc/organicmaps/default.nix
@@ -21,13 +21,13 @@
 
 mkDerivation rec {
   pname = "organicmaps";
-  version = "2023.04.02-7";
+  version = "2023.05.08-7";
 
   src = fetchFromGitHub {
     owner = "organicmaps";
     repo = "organicmaps";
     rev = "${version}-android";
-    sha256 = "sha256-xXBzHo7IOo2f1raGnpFcsvs++crHMI5SACIc345cX7g=";
+    sha256 = "sha256-V7qTi5NiZf+1voZSHfuAyfMeTeiYfs/CoOQ2zweKmaU=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/misc/pdfarranger/default.nix b/pkgs/applications/misc/pdfarranger/default.nix
index b0268f9c18c..38f1a9e4d59 100644
--- a/pkgs/applications/misc/pdfarranger/default.nix
+++ b/pkgs/applications/misc/pdfarranger/default.nix
@@ -47,5 +47,6 @@ python3Packages.buildPythonApplication rec {
     platforms = platforms.linux;
     maintainers = with maintainers; [ symphorien ];
     license = licenses.gpl3Plus;
+    changelog = "https://github.com/pdfarranger/pdfarranger/releases/tag/${version}";
   };
 }
diff --git a/pkgs/applications/networking/cluster/argocd/default.nix b/pkgs/applications/networking/cluster/argocd/default.nix
index a23346b2c4b..2cd4eb044dc 100644
--- a/pkgs/applications/networking/cluster/argocd/default.nix
+++ b/pkgs/applications/networking/cluster/argocd/default.nix
@@ -2,17 +2,17 @@
 
 buildGoModule rec {
   pname = "argocd";
-  version = "2.7.2";
+  version = "2.7.3";
 
   src = fetchFromGitHub {
     owner = "argoproj";
     repo = "argo-cd";
     rev = "v${version}";
-    sha256 = "sha256-pmF0EJfidYRZRelvXLfwANbv+DnfgLXVeKfjRSbnKjY=";
+    sha256 = "sha256-vUidpBiCxHzCwveOrLfNpwVePQZMgX+K8qpVR0h58p0=";
   };
 
   proxyVendor = true; # darwin/linux hash mismatch
-  vendorHash = "sha256-VRbNzJANWA7MjomzxNRK19Q4L+fsztMpumUbdYszYqw=";
+  vendorHash = "sha256-+thdFvd4cxvWxi+j4awBqfQ6jq6puFYbwoWsIsbMIZI=";
 
   # Set target as ./cmd per cli-local
   # https://github.com/argoproj/argo-cd/blob/master/Makefile#L227
diff --git a/pkgs/applications/networking/gns3/gui.nix b/pkgs/applications/networking/gns3/gui.nix
index e0c45e8eede..b809d409193 100644
--- a/pkgs/applications/networking/gns3/gui.nix
+++ b/pkgs/applications/networking/gns3/gui.nix
@@ -62,5 +62,6 @@ python3.pkgs.buildPythonPackage rec {
     license = licenses.gpl3Plus;
     platforms = platforms.linux;
     maintainers = with maintainers; [ anthonyroussel ];
+    mainProgram = "gns3";
   };
 }
diff --git a/pkgs/applications/networking/p2p/gnunet/default.nix b/pkgs/applications/networking/p2p/gnunet/default.nix
index 00c62b8665a..366af7121e6 100644
--- a/pkgs/applications/networking/p2p/gnunet/default.nix
+++ b/pkgs/applications/networking/p2p/gnunet/default.nix
@@ -70,5 +70,6 @@ stdenv.mkDerivation rec {
     license = licenses.agpl3Plus;
     maintainers = with maintainers; [ pstn vrthra ];
     platforms = platforms.gnu ++ platforms.linux;
+    changelog = "https://git.gnunet.org/gnunet.git/tree/ChangeLog?h=v${version}";
   };
 }
diff --git a/pkgs/applications/video/kodi/addons/inputstream-adaptive/default.nix b/pkgs/applications/video/kodi/addons/inputstream-adaptive/default.nix
index 6f5a8cc85be..2d23f7b294d 100644
--- a/pkgs/applications/video/kodi/addons/inputstream-adaptive/default.nix
+++ b/pkgs/applications/video/kodi/addons/inputstream-adaptive/default.nix
@@ -3,20 +3,20 @@ let
   bento4 = fetchFromGitHub {
     owner = "xbmc";
     repo = "Bento4";
-    rev = "1.6.0-639-5-${rel}";
-    sha256 = "sha256-jjeBy3LmnN7hPjnbBSPcdtPD+MdbG+0kU8mekM2/ZFw=";
+    rev = "1.6.0-639-7-Omega";
+    sha256 = "sha256-d3znV88dLMbA4oUWsTZ7vS6WHOWzN7lIHgWPkR5Aixo=";
   };
 in
 buildKodiBinaryAddon rec {
   pname = "inputstream-adaptive";
   namespace = "inputstream.adaptive";
-  version = "20.3.2";
+  version = "20.3.8";
 
   src = fetchFromGitHub {
     owner = "xbmc";
     repo = "inputstream.adaptive";
     rev = "${version}-${rel}";
-    sha256 = "sha256-QG0qBRbUJJgsRLS2cQIDeTDYLjqVD0dRaZ7pCxpxNcs=";
+    sha256 = "sha256-Sv5poUW/W0sTJft+peOlRAe3Qtst7UbCTW4WgNP/bpI=";
   };
 
   extraCMakeFlags = [
diff --git a/pkgs/applications/video/mpv/scripts/mpris.nix b/pkgs/applications/video/mpv/scripts/mpris.nix
index 85caf23d001..063833297b9 100644
--- a/pkgs/applications/video/mpv/scripts/mpris.nix
+++ b/pkgs/applications/video/mpv/scripts/mpris.nix
@@ -28,5 +28,6 @@ stdenv.mkDerivation rec {
     license = licenses.mit;
     platforms = platforms.linux;
     maintainers = with maintainers; [ jfrankenau ];
+    changelog = "https://github.com/hoyon/mpv-mpris/releases/tag/${version}";
   };
 }
diff --git a/pkgs/desktops/gnome/apps/gnome-maps/default.nix b/pkgs/desktops/gnome/apps/gnome-maps/default.nix
index 7bbe0c331e2..c498974c899 100644
--- a/pkgs/desktops/gnome/apps/gnome-maps/default.nix
+++ b/pkgs/desktops/gnome/apps/gnome-maps/default.nix
@@ -27,11 +27,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-maps";
-  version = "44.1";
+  version = "44.2";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-tmeG6mr/kRH3WDVu4qEV9jR9Q3lTt77Kq+FDORnzGf8=";
+    sha256 = "sha256-3Kh/hRME2zyMDIjc1t3uhOh1fWH6k+FeLkyf4W3RjpI=";
   };
 
   doCheck = true;
diff --git a/pkgs/desktops/gnome/core/gnome-remote-desktop/default.nix b/pkgs/desktops/gnome/core/gnome-remote-desktop/default.nix
index 10a24bf2ff5..2b7bda34744 100644
--- a/pkgs/desktops/gnome/core/gnome-remote-desktop/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-remote-desktop/default.nix
@@ -30,11 +30,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-remote-desktop";
-  version = "44.1";
+  version = "44.2";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    hash = "sha256-0RB+r47hNai/8Yqv1dDtTomLEoQdBLmZxUHZ1LJO9iM=";
+    hash = "sha256-ep/9NBtfy2NtJmden2JpZQlSFj//UpUydhjMLVzIe44=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/gnome/core/gnome-software/default.nix b/pkgs/desktops/gnome/core/gnome-software/default.nix
index c12e28945fc..9bfac3ca793 100644
--- a/pkgs/desktops/gnome/core/gnome-software/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-software/default.nix
@@ -45,11 +45,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "gnome-software";
-  version = "44.1";
+  version = "44.2";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-software/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "ncZVFRLPCibQPg159JSHCmkW1DwU2CGZxDoR2cwK1ao=";
+    sha256 = "wC3OcOUrN80pwDdlCzcq2xmyfSD+RLwJIdgalZ01YWw=";
   };
 
   patches = [
diff --git a/pkgs/development/compilers/unison/default.nix b/pkgs/development/compilers/unison/default.nix
index 774f0223b10..b5031fa5897 100644
--- a/pkgs/development/compilers/unison/default.nix
+++ b/pkgs/development/compilers/unison/default.nix
@@ -43,5 +43,6 @@ stdenv.mkDerivation rec {
     license = with licenses; [ mit bsd3 ];
     maintainers = [ maintainers.virusdave ];
     platforms = [ "x86_64-darwin" "x86_64-linux" "aarch64-darwin" ];
+    mainProgram = "ucm";
   };
 }
diff --git a/pkgs/development/interpreters/wasmtime/default.nix b/pkgs/development/interpreters/wasmtime/default.nix
index 58cde0e1013..a568b364edf 100644
--- a/pkgs/development/interpreters/wasmtime/default.nix
+++ b/pkgs/development/interpreters/wasmtime/default.nix
@@ -41,9 +41,10 @@ rustPlatform.buildRustPackage rec {
   meta = with lib; {
     description =
       "Standalone JIT-style runtime for WebAssembly, using Cranelift";
-    homepage = "https://github.com/bytecodealliance/wasmtime";
+    homepage = "https://wasmtime.dev/";
     license = licenses.asl20;
     maintainers = with maintainers; [ ereslibre matthewbauer ];
     platforms = platforms.unix;
+    changelog = "https://github.com/bytecodealliance/wasmtime/blob/v${version}/RELEASES.md";
   };
 }
diff --git a/pkgs/development/libraries/enchant/2.x.nix b/pkgs/development/libraries/enchant/2.x.nix
index 63b4b901a9a..5fb09906895 100644
--- a/pkgs/development/libraries/enchant/2.x.nix
+++ b/pkgs/development/libraries/enchant/2.x.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "enchant";
-  version = "2.3.4";
+  version = "2.5.0";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "https://github.com/AbiWord/${pname}/releases/download/v${version}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-H34mdE2xyaD+ph0hafTlwc5DXPjCcxw34+QFQRnplKA=";
+    sha256 = "sha256-FJ4iTN0sqCXYdGOVeLYkbgfzfVuPOXBlijd6HvRvLhU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/hidapi/default.nix b/pkgs/development/libraries/hidapi/default.nix
index 89cff8ef427..dfba7f4e117 100644
--- a/pkgs/development/libraries/hidapi/default.nix
+++ b/pkgs/development/libraries/hidapi/default.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "hidapi";
-  version = "0.13.1";
+  version = "0.14.0";
 
   src = fetchFromGitHub {
     owner = "libusb";
     repo = "hidapi";
     rev = "${finalAttrs.pname}-${finalAttrs.version}";
-    sha256 = "sha256-CEZP5n8qEAzsqn8dz3u1nG0YoT7J1P+WfN7urkRTuVg=";
+    sha256 = "sha256-p3uzBq5VxxQbVuy1lEHEEQdxXwnhQgJDIyAAWjVWNIg=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
diff --git a/pkgs/development/libraries/libad9361/default.nix b/pkgs/development/libraries/libad9361/default.nix
index 115f3716155..f370870f71e 100644
--- a/pkgs/development/libraries/libad9361/default.nix
+++ b/pkgs/development/libraries/libad9361/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libad9361";
-  version = "0.2";
+  version = "0.3";
 
   src = fetchFromGitHub {
     owner = "analogdevicesinc";
     repo = "libad9361-iio";
     rev = "v${version}";
-    hash = "sha256-dYoFWRnREvlOC514ZpmmvoS37DmIkVqfq7JPpTXqXd8=";
+    hash = "sha256-9e66qSrKpczatZY9lPAzi/6f7lHChnl2+Pih53oa28Y=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/science/math/osqp/default.nix b/pkgs/development/libraries/science/math/osqp/default.nix
index 485ec06773b..bf22e1d74d9 100644
--- a/pkgs/development/libraries/science/math/osqp/default.nix
+++ b/pkgs/development/libraries/science/math/osqp/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "osqp";
-  version = "0.6.2";
+  version = "0.6.3";
 
   src = fetchFromGitHub {
     owner = "oxfordcontrol";
     repo = "osqp";
     rev = "v${version}";
-    sha256 = "sha256-RYk3zuZrJXPcF27eMhdoZAio4DZ+I+nFaUEg1g/aLNk=";
+    sha256 = "sha256-enkK5EFyAeLaUnHNYS3oq43HsHY5IuSLgsYP0k/GW8c=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/libraries/sqlitecpp/default.nix b/pkgs/development/libraries/sqlitecpp/default.nix
index aad1ee34e5c..4212f29e924 100644
--- a/pkgs/development/libraries/sqlitecpp/default.nix
+++ b/pkgs/development/libraries/sqlitecpp/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "sqlitecpp";
-  version = "3.2.1";
+  version = "3.3.0";
 
   src = fetchFromGitHub {
     owner = "SRombauts";
     repo = pname;
     rev = version;
-    sha256 = "sha256-uVvlW95UD1dhJfNuKgo7XvbdXrHl95OhaEpWfn0RH/E=";
+    sha256 = "sha256-3Xo/FgifbrSn0AvinriJZerUM2kbcMaoyF5ST8+1Qqw=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/nim-packages/eris/default.nix b/pkgs/development/nim-packages/eris/default.nix
index 9c5820398ac..bdd7de6a463 100644
--- a/pkgs/development/nim-packages/eris/default.nix
+++ b/pkgs/development/nim-packages/eris/default.nix
@@ -33,5 +33,6 @@ buildNimPackage rec {
     license = lib.licenses.unlicense;
     maintainers = with lib.maintainers; [ ehmry ];
     mainProgram = "eriscmd";
+    badPlatforms = lib.platforms.darwin;
   };
 }
diff --git a/pkgs/development/python-modules/keyring/default.nix b/pkgs/development/python-modules/keyring/default.nix
index 3e3cf64ce1c..f0989d493d9 100644
--- a/pkgs/development/python-modules/keyring/default.nix
+++ b/pkgs/development/python-modules/keyring/default.nix
@@ -47,7 +47,9 @@ buildPythonPackage rec {
 
   disabledTestPaths = [
     "tests/backends/test_macOS.py"
-  ];
+  ]
+  # These tests fail when sandboxing is enabled because they are unable to get a password from keychain.
+  ++ lib.optional stdenv.isDarwin "tests/test_multiprocess.py";
 
   meta = with lib; {
     description = "Store and access your passwords safely";
diff --git a/pkgs/development/python-modules/pyfuse3/default.nix b/pkgs/development/python-modules/pyfuse3/default.nix
index 19e92f9d532..8e119600264 100644
--- a/pkgs/development/python-modules/pyfuse3/default.nix
+++ b/pkgs/development/python-modules/pyfuse3/default.nix
@@ -65,5 +65,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/libfuse/pyfuse3";
     license = licenses.lgpl2Plus;
     maintainers = with maintainers; [ nyanloutre dotlambda ];
+    changelog = "https://github.com/libfuse/pyfuse3/blob/${version}/Changes.rst";
   };
 }
diff --git a/pkgs/development/python-modules/simple-salesforce/default.nix b/pkgs/development/python-modules/simple-salesforce/default.nix
index dc080836b73..f417ac32689 100644
--- a/pkgs/development/python-modules/simple-salesforce/default.nix
+++ b/pkgs/development/python-modules/simple-salesforce/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "simple-salesforce";
-  version = "1.12.3";
+  version = "1.12.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-lCZdX+gf9ROU1MIRw/ppTNO8jIGUxE1+gbHh6sK5L2s=";
+    hash = "sha256-nYL2kSDS6DSrBzAKbg7Wj6boSZ52+T/yX+NYnYQ9rQo=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/tools/analysis/flow/default.nix b/pkgs/development/tools/analysis/flow/default.nix
index 73219ed01e6..b69391f0fdc 100644
--- a/pkgs/development/tools/analysis/flow/default.nix
+++ b/pkgs/development/tools/analysis/flow/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "flow";
-  version = "0.206.0";
+  version = "0.207.0";
 
   src = fetchFromGitHub {
     owner = "facebook";
     repo = "flow";
     rev = "v${version}";
-    sha256 = "sha256-pDh43pOf/PhyxGcYRnQsuq7FBJz2Wru77QBTEYSobno=";
+    sha256 = "sha256-0qEo1drdtIxdZriaLNm+T1J00wJoeBbtox5LDmrLX4Y=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/tools/database/sqlfluff/default.nix b/pkgs/development/tools/database/sqlfluff/default.nix
index 8cc66b0e91d..abd0b1d6860 100644
--- a/pkgs/development/tools/database/sqlfluff/default.nix
+++ b/pkgs/development/tools/database/sqlfluff/default.nix
@@ -5,14 +5,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "sqlfluff";
-  version = "2.1.0";
+  version = "2.1.1";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-kUc3y9OlaQ72MsESrVd+eqm4xulFixYMKAIMeP3+NOc=";
+    hash = "sha256-WNQ9rcy3dqfZjLdqjpl5erSxLgQjYc/sy293DfzoenM=";
   };
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/development/tools/jira-cli-go/default.nix b/pkgs/development/tools/jira-cli-go/default.nix
index 5681dc16887..1394eef5fd1 100644
--- a/pkgs/development/tools/jira-cli-go/default.nix
+++ b/pkgs/development/tools/jira-cli-go/default.nix
@@ -49,5 +49,6 @@ buildGoModule rec {
     changelog = "https://github.com/ankitpokhrel/jira-cli/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ bryanasdev000 anthonyroussel ];
+    mainProgram = "jira";
   };
 }
diff --git a/pkgs/development/tools/pscale/default.nix b/pkgs/development/tools/pscale/default.nix
index 3b2fd0bfbcb..b73ddc5a68f 100644
--- a/pkgs/development/tools/pscale/default.nix
+++ b/pkgs/development/tools/pscale/default.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "pscale";
-  version = "0.144.0";
+  version = "0.145.0";
 
   src = fetchFromGitHub {
     owner = "planetscale";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "sha256-11es0U58O98tC1GKQxezav5UYGySAJDxjMFLuPtzhnw=";
+    sha256 = "sha256-0X+cYDlc7yIJTA4O06Y5roj6bL7mQlZK7jIAs0RbM7U=";
   };
 
-  vendorHash = "sha256-qJcGQXuJJ4loZinwLfXJEChHHl2OMtv9p5/mrjUWK4E=";
+  vendorHash = "sha256-brfrAD4cJ/MwT9ZiwN6a25vCWTcRMiszbuLWj3Lk2Kc=";
 
   ldflags = [
     "-s" "-w"
diff --git a/pkgs/development/tools/rbspy/default.nix b/pkgs/development/tools/rbspy/default.nix
index 2a7ced543ba..f31ec6d8c1d 100644
--- a/pkgs/development/tools/rbspy/default.nix
+++ b/pkgs/development/tools/rbspy/default.nix
@@ -4,6 +4,7 @@
 , fetchFromGitHub
 , ruby
 , which
+, nix-update-script
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -46,6 +47,8 @@ rustPlatform.buildRustPackage rec {
   nativeBuildInputs = [ ruby which ]
     ++ lib.optional stdenv.isDarwin rustPlatform.bindgenHook;
 
+  passthru.updateScript = nix-update-script { };
+
   meta = with lib; {
     homepage = "https://rbspy.github.io/";
     description = ''
diff --git a/pkgs/games/2048-cli/default.nix b/pkgs/games/2048-cli/default.nix
index 7ef923215d6..e1eb958164c 100644
--- a/pkgs/games/2048-cli/default.nix
+++ b/pkgs/games/2048-cli/default.nix
@@ -57,5 +57,6 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.mit;
     maintainers = [ lib.maintainers.AndersonTorres ];
     platforms = lib.platforms.unix;
+    mainProgram = "2048";
   };
 })
diff --git a/pkgs/games/hhexen/default.nix b/pkgs/games/hhexen/default.nix
index d677962fbe6..4b978ab5651 100644
--- a/pkgs/games/hhexen/default.nix
+++ b/pkgs/games/hhexen/default.nix
@@ -18,5 +18,6 @@ stdenv.mkDerivation rec {
     homepage = "https://hhexen.sourceforge.net/hhexen.html";
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ djanatyn ];
+    mainProgram = "hhexen-gl";
   };
 }
diff --git a/pkgs/games/mindustry/default.nix b/pkgs/games/mindustry/default.nix
index b6d1eff817e..b8c661f7f48 100644
--- a/pkgs/games/mindustry/default.nix
+++ b/pkgs/games/mindustry/default.nix
@@ -191,36 +191,41 @@ stdenv.mkDerivation rec {
     gradle --offline --no-daemon server:dist -Pbuildversion=${buildVersion}
   '';
 
-  installPhase = with lib; ''
+  installPhase = with lib; let
+    installClient = ''
+      install -Dm644 desktop/build/libs/Mindustry.jar $out/share/mindustry.jar
+      mkdir -p $out/bin
+      makeWrapper ${jdk}/bin/java $out/bin/mindustry \
+        --add-flags "-jar $out/share/mindustry.jar" \
+        --suffix LD_LIBRARY_PATH : ${lib.makeLibraryPath [libpulseaudio alsa-lib libjack2]} \
+        --set ALSA_PLUGIN_DIR ${alsa-plugins}/lib/alsa-lib/'' + optionalString enableWayland '' \
+        --set SDL_VIDEODRIVER wayland \
+        --set SDL_VIDEO_WAYLAND_WMCLASS Mindustry
+      '' + ''
+
+      # Retain runtime depends to prevent them from being cleaned up.
+      # Since a jar is a compressed archive, nix can't figure out that the dependency is actually in there,
+      # and will assume that it's not actually needed.
+      # This can cause issues.
+      # See https://github.com/NixOS/nixpkgs/issues/109798.
+      echo "# Retained runtime dependencies: " >> $out/bin/mindustry
+      for dep in ${SDL2.out} ${alsa-lib.out} ${selectedGlew.out}; do
+        echo "# $dep" >> $out/bin/mindustry
+      done
+
+      install -Dm644 core/assets/icons/icon_64.png $out/share/icons/hicolor/64x64/apps/mindustry.png
+    '';
+    installServer = ''
+      install -Dm644 server/build/libs/server-release.jar $out/share/mindustry-server.jar
+      mkdir -p $out/bin
+      makeWrapper ${jdk}/bin/java $out/bin/mindustry-server \
+        --add-flags "-jar $out/share/mindustry-server.jar"
+    '';
+  in ''
     runHook preInstall
-  '' + optionalString enableClient ''
-    install -Dm644 desktop/build/libs/Mindustry.jar $out/share/mindustry.jar
-    mkdir -p $out/bin
-    makeWrapper ${jdk}/bin/java $out/bin/mindustry \
-      --add-flags "-jar $out/share/mindustry.jar" \
-      --suffix LD_LIBRARY_PATH : ${lib.makeLibraryPath [libpulseaudio alsa-lib libjack2]} \
-      --set ALSA_PLUGIN_DIR ${alsa-plugins}/lib/alsa-lib/'' + optionalString enableWayland '' \
-      --set SDL_VIDEODRIVER wayland \
-      --set SDL_VIDEO_WAYLAND_WMCLASS Mindustry
-    '' + ''
-
-    # Retain runtime depends to prevent them from being cleaned up.
-    # Since a jar is a compressed archive, nix can't figure out that the dependency is actually in there,
-    # and will assume that it's not actually needed.
-    # This can cause issues.
-    # See https://github.com/NixOS/nixpkgs/issues/109798.
-    echo "# Retained runtime dependencies: " >> $out/bin/mindustry
-    for dep in ${SDL2.out} ${alsa-lib.out} ${selectedGlew.out}; do
-      echo "# $dep" >> $out/bin/mindustry
-    done
-
-    install -Dm644 core/assets/icons/icon_64.png $out/share/icons/hicolor/64x64/apps/mindustry.png
-  '' + optionalString enableServer ''
-    install -Dm644 server/build/libs/server-release.jar $out/share/mindustry-server.jar
-    mkdir -p $out/bin
-    makeWrapper ${jdk}/bin/java $out/bin/mindustry-server \
-      --add-flags "-jar $out/share/mindustry-server.jar"
-  '' + ''
+  '' + optionalString enableClient installClient
+     + optionalString enableServer installServer
+     + ''
     runHook postInstall
   '';
 
diff --git a/pkgs/games/openrw/default.nix b/pkgs/games/openrw/default.nix
index 23475f8a55d..6af74f264a1 100644
--- a/pkgs/games/openrw/default.nix
+++ b/pkgs/games/openrw/default.nix
@@ -48,5 +48,6 @@ stdenv.mkDerivation {
     '';
     maintainers = with maintainers; [ kragniz ];
     platforms = platforms.all;
+    mainProgram = "rwgame";
   };
 }
diff --git a/pkgs/games/sdlpop/default.nix b/pkgs/games/sdlpop/default.nix
index 52e1604acc4..5defb942e7e 100644
--- a/pkgs/games/sdlpop/default.nix
+++ b/pkgs/games/sdlpop/default.nix
@@ -67,5 +67,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ iblech ];
     platforms = platforms.unix;
+    mainProgram = "prince";
   };
 }
diff --git a/pkgs/games/vitetris/default.nix b/pkgs/games/vitetris/default.nix
index 99996ca5c32..f7e566b2208 100644
--- a/pkgs/games/vitetris/default.nix
+++ b/pkgs/games/vitetris/default.nix
@@ -20,6 +20,7 @@ stdenv.mkDerivation rec {
     homepage = "http://www.victornils.net/tetris/";
     license = lib.licenses.bsd2;
     maintainers = with lib.maintainers; [ siers ];
+    mainProgram = "tetris";
 
     longDescription = ''
       vitetris is a terminal-based Tetris clone by Victor Nilsson. Gameplay is much
diff --git a/pkgs/os-specific/linux/ena/default.nix b/pkgs/os-specific/linux/ena/default.nix
index a7843ee3894..abc116efdcb 100644
--- a/pkgs/os-specific/linux/ena/default.nix
+++ b/pkgs/os-specific/linux/ena/default.nix
@@ -1,16 +1,33 @@
-{ lib, stdenv, fetchFromGitHub, kernel }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, kernel }:
 
 stdenv.mkDerivation rec {
-  version = "2.8.3";
+  version = "2.8.6";
   name = "ena-${version}-${kernel.version}";
 
   src = fetchFromGitHub {
     owner = "amzn";
     repo = "amzn-drivers";
     rev = "ena_linux_${version}";
-    sha256 = "sha256-Z5BCqqC4FNKHqpocJ6CsHwhh5sszj5QfxiN6+Dkaqek=";
+    hash = "sha256-clRu+ecK/Je0kvlAAm6qCJqMyvZv0C88YIGDImhRhKA=";
   };
 
+  patches =
+    [ # https://github.com/amzn/amzn-drivers/issues/269#issuecomment-1552483792
+      (fetchpatch {
+        url = "https://github.com/amzn/amzn-drivers/files/11504862/phc_kernel_6_2_fix.patch";
+        hash = "sha256-/EBkISwXMd7t4WZjsG9KVP6vncFwcZq1QBsxQLXyWsY=";
+      })
+      # https://github.com/amzn/amzn-drivers/issues/270#issuecomment-1561924754
+      (fetchpatch {
+        url = "https://github.com/amzn/amzn-drivers/files/11559312/devlink_6_2_fix.patch";
+        hash = "sha256-Nc71u91G0dL+ld6ovqjHaE6X2TxduWeQYr5K0KdoA3Q=";
+      })
+      (fetchpatch {
+        url = "https://github.com/amzn/amzn-drivers/files/11559314/devlink_6_3_fix.patch";
+        hash = "sha256-aEQTbwHC1DcDrtj188eoGzi3GU9MXnwIxuJW4L7qb/I=";
+      })
+    ];
+
   hardeningDisable = [ "pic" ];
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
diff --git a/pkgs/servers/nosql/victoriametrics/default.nix b/pkgs/servers/nosql/victoriametrics/default.nix
index c9a1bf00412..c7a93f8d247 100644
--- a/pkgs/servers/nosql/victoriametrics/default.nix
+++ b/pkgs/servers/nosql/victoriametrics/default.nix
@@ -1,18 +1,31 @@
-{ lib, buildGoModule, fetchFromGitHub, nixosTests }:
+{ lib, buildGoModule, fetchFromGitHub, fetchpatch, nixosTests }:
 
 buildGoModule rec {
   pname = "VictoriaMetrics";
-  version = "1.89.1";
+  version = "1.91.0";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-s5Fo0Bsy9cAoNLRMAYjNrSLJ0vX4HdbQ+T3cj6ebNPE=";
+    hash = "sha256-ZGUJfziqQCCv/9p+z8UJpvHkg6fKOIMv1tJ679f9NTo=";
   };
 
   vendorHash = null;
 
+  patches = [
+    (fetchpatch {
+      name = "vmctl-fix-tests.patch";
+      url = "https://github.com/VictoriaMetrics/VictoriaMetrics/commit/4060f3f261cb41d97df719e6c60b71be19829301.patch";
+      hash = "sha256-SCeSdSLzZZodMiL7Kts0L8R5XD7TbOc5+/oidmithCY=";
+    })
+    (fetchpatch {
+      name = "graphite-fixes-tests-for-arm.patch";
+      url = "https://github.com/VictoriaMetrics/VictoriaMetrics/commit/228ea03bda0eda3507d782cb627d946843f29c30.patch";
+      hash = "sha256-FnN5O9H1tNtBs5Fr4tXrnyted8SZwX82ZdBmeHlIQ2Y=";
+    })
+  ];
+
   postPatch = ''
     # main module (github.com/VictoriaMetrics/VictoriaMetrics) does not contain package
     # github.com/VictoriaMetrics/VictoriaMetrics/app/vmui/packages/vmui/web
diff --git a/pkgs/tools/networking/cjdns/default.nix b/pkgs/tools/networking/cjdns/default.nix
index ccb0bf46e76..85705a27231 100644
--- a/pkgs/tools/networking/cjdns/default.nix
+++ b/pkgs/tools/networking/cjdns/default.nix
@@ -70,5 +70,6 @@ rustPlatform.buildRustPackage rec {
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ ehmry ];
     platforms = platforms.linux;
+    broken = stdenv.isAarch64;
   };
 }
diff --git a/pkgs/tools/networking/nexttrace/default.nix b/pkgs/tools/networking/nexttrace/default.nix
index 931c229ae3a..0a221772e19 100644
--- a/pkgs/tools/networking/nexttrace/default.nix
+++ b/pkgs/tools/networking/nexttrace/default.nix
@@ -2,15 +2,15 @@
 
 buildGoModule rec {
   pname = "nexttrace";
-  version = "1.1.3";
+  version = "1.1.5";
 
   src = fetchFromGitHub {
     owner = "sjlleo";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-sOTQBh6j8od24s36J0e2aKW1mWmAD/ThfY6pd1SsSlY=";
+    sha256 = "sha256-9JLJ6v8eDVgqB4mdbHtBCZ1Wm5gjk7ywjGGgYOFZFAQ=";
   };
-  vendorHash = "sha256-ckGoDV4GNp0mG+bkCKoLBO+ap53R5zrq/ZSKiFmVf9U=";
+  vendorHash = "sha256-1geVqj4W9HoMCM1OkGqpYqHj2jGoGEU9Zv6fkaHBzpk=";
 
   doCheck = false; # Tests require a network connection.
 
diff --git a/pkgs/tools/security/b3sum/default.nix b/pkgs/tools/security/b3sum/default.nix
index 9279ec1d23b..fa7b9e4e5c9 100644
--- a/pkgs/tools/security/b3sum/default.nix
+++ b/pkgs/tools/security/b3sum/default.nix
@@ -16,5 +16,6 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/BLAKE3-team/BLAKE3/";
     maintainers = with lib.maintainers; [ fpletz ivan ];
     license = with lib.licenses; [ cc0 asl20 ];
+    changelog = "https://github.com/BLAKE3-team/BLAKE3/releases/tag/${version}";
   };
 }
diff --git a/pkgs/tools/security/exploitdb/default.nix b/pkgs/tools/security/exploitdb/default.nix
index 46b2f34a4d6..edb8fec3144 100644
--- a/pkgs/tools/security/exploitdb/default.nix
+++ b/pkgs/tools/security/exploitdb/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "exploitdb";
-  version = "2023-05-25";
+  version = "2023-05-27";
 
   src = fetchFromGitLab {
     owner = "exploit-database";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-W2+54iIg2msExr9SxR8EEnsF0a0nfAgHfXI0wZN8lIw=";
+    hash = "sha256-7C4lihyGt8jiCtHXzE1iik0vsVRlsoKgvFgiV9iqtoQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/security/mitmproxy2swagger/default.nix b/pkgs/tools/security/mitmproxy2swagger/default.nix
index b9f992cbb8a..64c2f3abbc7 100644
--- a/pkgs/tools/security/mitmproxy2swagger/default.nix
+++ b/pkgs/tools/security/mitmproxy2swagger/default.nix
@@ -5,14 +5,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "mitmproxy2swagger";
-  version = "0.9.0";
+  version = "0.10.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "alufers";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-P+Gw4D+G76gifYY2OghXRzrlPiYk4KggoVMgzJbm6Is=";
+    hash = "sha256-tvlxQrZzY2r+zipNm8XFTvYgLZAbg2xzoFL6VDt+/fk=";
   };
 
   nativeBuildInputs = with python3.pkgs; [
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 782c45be3d8..bdecfddf8be 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -13577,7 +13577,7 @@ with pkgs;
   };
 
   vtm = callPackage ../tools/misc/vtm {
-    stdenv = if stdenv.isDarwin then clang16Stdenv else stdenv;
+    stdenv = if stdenv.isDarwin then llvmPackages_16.stdenv else stdenv;
   };
 
   witness = callPackage ../tools/security/witness { };