summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--maintainers/maintainer-list.nix6
-rw-r--r--nixos/doc/manual/development/what-happens-during-a-system-switch.chapter.md5
-rw-r--r--nixos/doc/manual/release-notes/rl-2311.section.md9
-rw-r--r--nixos/lib/test-driver/test_driver/machine.py4
-rw-r--r--nixos/modules/module-list.nix1
-rw-r--r--nixos/modules/security/sudo-rs.nix296
-rw-r--r--nixos/modules/security/sudo.nix169
-rw-r--r--nixos/modules/services/matrix/synapse.nix4
-rw-r--r--nixos/modules/services/misc/mbpfan.nix19
-rw-r--r--nixos/modules/services/search/typesense.nix4
-rwxr-xr-xnixos/modules/system/activation/switch-to-configuration.pl20
-rw-r--r--nixos/modules/system/boot/loader/generic-extlinux-compatible/extlinux-conf-builder.sh28
-rw-r--r--nixos/modules/system/boot/loader/raspberrypi/raspberrypi.nix1
-rw-r--r--nixos/modules/system/boot/stage-1.nix7
-rw-r--r--nixos/tests/sudo-rs.nix12
-rw-r--r--nixos/tests/switch-test.nix122
-rw-r--r--pkgs/applications/blockchains/dcrctl/default.nix2
-rw-r--r--pkgs/applications/editors/jetbrains/plugins/plugins.json100
-rw-r--r--pkgs/applications/editors/jetbrains/versions.json48
-rw-r--r--pkgs/applications/misc/madonctl/default.nix2
-rw-r--r--pkgs/applications/misc/process-compose/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/civo/default.nix6
-rw-r--r--pkgs/applications/networking/cluster/helm-docs/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/kubeshark/default.nix6
-rw-r--r--pkgs/applications/networking/drive/default.nix2
-rw-r--r--pkgs/applications/networking/gnmic/default.nix4
-rw-r--r--pkgs/applications/office/fava/default.nix4
-rw-r--r--pkgs/applications/window-managers/hyprwm/hyprland/default.nix4
-rw-r--r--pkgs/applications/window-managers/hyprwm/hyprland/wlroots.nix4
-rw-r--r--pkgs/applications/window-managers/hyprwm/xdg-desktop-portal-hyprland/default.nix10
-rw-r--r--pkgs/by-name/ba/badger/package.nix30
-rw-r--r--pkgs/by-name/le/lemminx/package.nix104
-rw-r--r--pkgs/by-name/lu/luastatus/package.nix88
-rw-r--r--pkgs/data/misc/ddccontrol-db/default.nix4
-rw-r--r--pkgs/development/compilers/circt/default.nix6
-rw-r--r--pkgs/development/compilers/ghdl/default.nix30
-rw-r--r--pkgs/development/libraries/faudio/default.nix4
-rw-r--r--pkgs/development/libraries/intel-gmmlib/default.nix14
-rw-r--r--pkgs/development/python-modules/anywidget/default.nix4
-rw-r--r--pkgs/development/python-modules/automx2/default.nix46
-rw-r--r--pkgs/development/python-modules/frozendict/default.nix8
-rw-r--r--pkgs/development/python-modules/heudiconv/default.nix4
-rw-r--r--pkgs/development/python-modules/paddleocr/default.nix6
-rw-r--r--pkgs/development/python-modules/posthog/default.nix4
-rwxr-xr-xpkgs/development/python-modules/streamlit/default.nix4
-rw-r--r--pkgs/development/python-modules/types-redis/default.nix4
-rw-r--r--pkgs/development/python-modules/userpath/default.nix4
-rw-r--r--pkgs/development/tools/amqpcat/default.nix7
-rw-r--r--pkgs/development/tools/amqpcat/shards.nix8
-rw-r--r--pkgs/development/tools/analysis/flow/default.nix4
-rw-r--r--pkgs/development/tools/continuous-integration/cirrus-cli/default.nix4
-rw-r--r--pkgs/development/tools/database/atlas/default.nix4
-rw-r--r--pkgs/development/tools/database/dbmate/default.nix6
-rw-r--r--pkgs/development/tools/doctl/default.nix4
-rw-r--r--pkgs/development/tools/gauge/default.nix6
-rw-r--r--pkgs/development/tools/gdlv/default.nix15
-rw-r--r--pkgs/development/tools/language-servers/ccls/default.nix4
-rw-r--r--pkgs/development/tools/language-servers/millet/Cargo.lock72
-rw-r--r--pkgs/development/tools/language-servers/millet/default.nix4
-rw-r--r--pkgs/development/tools/language-servers/pylyzer/default.nix6
-rw-r--r--pkgs/development/tools/mysql-shell/default.nix35
-rw-r--r--pkgs/development/tools/prettierd/default.nix6
-rw-r--r--pkgs/development/tools/prettierd/package.json17
-rw-r--r--pkgs/development/tools/rust/cargo-insta/default.nix8
-rw-r--r--pkgs/development/tools/rust/cargo-machete/default.nix6
-rw-r--r--pkgs/development/tools/trunk-io/default.nix6
-rw-r--r--pkgs/development/tools/typos/default.nix6
-rw-r--r--pkgs/games/harmonist/default.nix2
-rw-r--r--pkgs/misc/dxvk/dxvk.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/common-config.nix1
-rw-r--r--pkgs/os-specific/linux/kernel/kernels-org.json28
-rw-r--r--pkgs/os-specific/linux/kernel/linux-rt-5.10.nix6
-rw-r--r--pkgs/os-specific/linux/kernel/linux-rt-6.1.nix6
-rw-r--r--pkgs/os-specific/linux/rdma-core/default.nix4
-rw-r--r--pkgs/servers/demoit/default.nix10
-rw-r--r--pkgs/servers/matrix-synapse/plugins/s3-storage-provider.nix2
-rw-r--r--pkgs/servers/monitoring/do-agent/default.nix4
-rw-r--r--pkgs/servers/skydns/default.nix2
-rw-r--r--pkgs/servers/sql/postgresql/ext/plpgsql_check.nix4
-rw-r--r--pkgs/tools/audio/dsp/default.nix8
-rw-r--r--pkgs/tools/backup/kopia/default.nix6
-rw-r--r--pkgs/tools/filesystems/erofs-utils/default.nix8
-rw-r--r--pkgs/tools/filesystems/gcsfuse/default.nix2
-rw-r--r--pkgs/tools/filesystems/go-mtpfs/default.nix2
-rw-r--r--pkgs/tools/filesystems/mergerfs/default.nix4
-rw-r--r--pkgs/tools/games/minecraft/minecraft-server-hibernation/default.nix19
-rw-r--r--pkgs/tools/misc/claws/default.nix2
-rw-r--r--pkgs/tools/misc/dashing/default.nix2
-rw-r--r--pkgs/tools/misc/gosu/default.nix2
-rw-r--r--pkgs/tools/misc/pouf/default.nix11
-rw-r--r--pkgs/tools/misc/wakatime/default.nix2
-rw-r--r--pkgs/tools/networking/shadowsocks-rust/default.nix6
-rw-r--r--pkgs/tools/security/bitwarden/cli.nix6
-rw-r--r--pkgs/tools/security/bitwarden/default.nix134
-rw-r--r--pkgs/tools/security/hologram/default.nix2
-rw-r--r--pkgs/tools/system/jump/default.nix2
-rw-r--r--pkgs/tools/system/nkeys/default.nix4
-rw-r--r--pkgs/top-level/all-packages.nix4
-rw-r--r--pkgs/top-level/perl-packages.nix6
-rw-r--r--pkgs/top-level/python-packages.nix2
100 files changed, 1264 insertions, 542 deletions
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 044d052e9f3..bd332e7583a 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -13614,6 +13614,12 @@
     githubId = 34967;
     name = "Julius de Bruijn";
   };
+  pineapplehunter = {
+    email = "peshogo+nixpkgs@gmail.com";
+    github = "pineapplehunter";
+    githubId = 8869894;
+    name = "Shogo Takata";
+  };
   pingiun = {
     email = "nixos@pingiun.com";
     github = "pingiun";
diff --git a/nixos/doc/manual/development/what-happens-during-a-system-switch.chapter.md b/nixos/doc/manual/development/what-happens-during-a-system-switch.chapter.md
index 9cbec729803..5d6d67f1aa9 100644
--- a/nixos/doc/manual/development/what-happens-during-a-system-switch.chapter.md
+++ b/nixos/doc/manual/development/what-happens-during-a-system-switch.chapter.md
@@ -21,8 +21,9 @@ If the action is `switch` or `test`, the currently running system is inspected
 and the actions to switch to the new system are calculated. This process takes
 two data sources into account: `/etc/fstab` and the current systemd status.
 Mounts and swaps are read from `/etc/fstab` and the corresponding actions are
-generated. If a new mount is added, for example, the proper `.mount` unit is
-marked to be started. The current systemd state is inspected, the difference
+generated. If the options of a mount are modified, for example, the proper `.mount`
+unit is reloaded (or restarted if anything else changed and it's neither the root
+mount or the nix store). The current systemd state is inspected, the difference
 between the current system and the desired configuration is calculated and
 actions are generated to get to this state. There are a lot of nuances that can
 be controlled by the units which are explained here.
diff --git a/nixos/doc/manual/release-notes/rl-2311.section.md b/nixos/doc/manual/release-notes/rl-2311.section.md
index 13b8dc6e224..b7c856f7a12 100644
--- a/nixos/doc/manual/release-notes/rl-2311.section.md
+++ b/nixos/doc/manual/release-notes/rl-2311.section.md
@@ -17,8 +17,9 @@
     - Updating with `nixos-rebuild boot` and rebooting is recommended, since in some rare cases the `nixos-rebuild switch` into the new generation on a live system might fail due to missing mount units.
 
 - [`sudo-rs`], a reimplementation of `sudo` in Rust, is now supported.
-  Switching to it (via `security.sudo.package = pkgs.sudo-rs;`) introduces
-  slight changes in default behaviour, due to `sudo-rs`' current limitations:
+  An experimental new module `security.sudo-rs` was added.
+  Switching to it (via `security.sudo.enable = false; security.sudo-rs.enable = true;`) introduces
+  slight changes in sudo behaviour, due to `sudo-rs`' current limitations:
   - terminfo-related environment variables aren't preserved for `root` and `wheel`;
   - `root` and `wheel` are not given the ability to set (or preserve)
     arbitrary environment variables.
@@ -270,6 +271,8 @@ The module update takes care of the new config syntax and the data itself (user
 
 - `services.nginx` gained a `defaultListen` option at server-level with support for PROXY protocol listeners, also `proxyProtocol` is now exposed in `services.nginx.virtualHosts.<name>.listen` option. It is now possible to run PROXY listeners and non-PROXY listeners at a server-level, see [#213510](https://github.com/NixOS/nixpkgs/pull/213510/) for more details.
 
+- `generic-extlinux-compatible` bootloader (and raspberry pi with uboot) supports appending secrets to the initramfs
+
 - `services.restic.backups` now adds wrapper scripts to your system path, which set the same environment variables as the service, so restic operations can easly be run from the command line. This behavior can be disabled by setting `createWrapper` to `false`, per backup configuration.
 
 - `services.prometheus.exporters` has a new exporter to monitor electrical power consumption based on PowercapRAPL sensor called [Scaphandre](https://github.com/hubblo-org/scaphandre), see [#239803](https://github.com/NixOS/nixpkgs/pull/239803) for more details.
@@ -308,6 +311,8 @@ The module update takes care of the new config syntax and the data itself (user
 
 - New `boot.bcache.enable` (default enabled) allows completely removing `bcache` mount support.
 
+- The module `services.mbpfan` now has the option `aggressive` enabled by default for better heat moderation. You can disable it for upstream defaults.
+
 - `security.sudo` now provides two extra options, that do not change the
   module's default behaviour:
   - `defaultOptions` controls the options used for the default rules;
diff --git a/nixos/lib/test-driver/test_driver/machine.py b/nixos/lib/test-driver/test_driver/machine.py
index 06d952d64f4..2afcbc95c66 100644
--- a/nixos/lib/test-driver/test_driver/machine.py
+++ b/nixos/lib/test-driver/test_driver/machine.py
@@ -582,7 +582,9 @@ class Machine:
 
         # While sh is bash on NixOS, this is not the case for every distro.
         # We explicitly call bash here to allow for the driver to boot other distros as well.
-        out_command = f"{timeout_str} bash -c {shlex.quote(command)} 2>/dev/null | (base64 -w 0; echo)\n"
+        out_command = (
+            f"{timeout_str} bash -c {shlex.quote(command)} | (base64 -w 0; echo)\n"
+        )
 
         assert self.shell
         self.shell.send(out_command.encode())
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index e17d430e59b..22724138d5d 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -311,6 +311,7 @@
   ./security/rngd.nix
   ./security/rtkit.nix
   ./security/sudo.nix
+  ./security/sudo-rs.nix
   ./security/systemd-confinement.nix
   ./security/tpm2.nix
   ./security/wrappers/default.nix
diff --git a/nixos/modules/security/sudo-rs.nix b/nixos/modules/security/sudo-rs.nix
new file mode 100644
index 00000000000..6b8f09a8d3d
--- /dev/null
+++ b/nixos/modules/security/sudo-rs.nix
@@ -0,0 +1,296 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+
+  inherit (pkgs) sudo sudo-rs;
+
+  cfg = config.security.sudo-rs;
+
+  enableSSHAgentAuth =
+    with config.security;
+    pam.enableSSHAgentAuth && pam.sudo.sshAgentAuth;
+
+  usingMillersSudo = cfg.package.pname == sudo.pname;
+  usingSudoRs = cfg.package.pname == sudo-rs.pname;
+
+  toUserString = user: if (isInt user) then "#${toString user}" else "${user}";
+  toGroupString = group: if (isInt group) then "%#${toString group}" else "%${group}";
+
+  toCommandOptionsString = options:
+    "${concatStringsSep ":" options}${optionalString (length options != 0) ":"} ";
+
+  toCommandsString = commands:
+    concatStringsSep ", " (
+      map (command:
+        if (isString command) then
+          command
+        else
+          "${toCommandOptionsString command.options}${command.command}"
+      ) commands
+    );
+
+in
+
+{
+
+  ###### interface
+
+  options.security.sudo-rs = {
+
+    defaultOptions = mkOption {
+      type = with types; listOf str;
+      default = optional usingMillersSudo "SETENV";
+      defaultText = literalMD ''
+        `[ "SETENV" ]` if using the default `sudo` implementation
+      '';
+      description = mdDoc ''
+        Options used for the default rules, granting `root` and the
+        `wheel` group permission to run any command as any user.
+      '';
+    };
+
+    enable = mkOption {
+      type = types.bool;
+      default = false;
+      description = mdDoc ''
+        Whether to enable the {command}`sudo` command, which
+        allows non-root users to execute commands as root.
+      '';
+    };
+
+    package = mkOption {
+      type = types.package;
+      default = pkgs.sudo-rs;
+      defaultText = literalExpression "pkgs.sudo-rs";
+      description = mdDoc ''
+        Which package to use for `sudo`.
+      '';
+    };
+
+    wheelNeedsPassword = mkOption {
+      type = types.bool;
+      default = true;
+      description = mdDoc ''
+        Whether users of the `wheel` group must
+        provide a password to run commands as super user via {command}`sudo`.
+      '';
+      };
+
+    execWheelOnly = mkOption {
+      type = types.bool;
+      default = false;
+      description = mdDoc ''
+        Only allow members of the `wheel` group to execute sudo by
+        setting the executable's permissions accordingly.
+        This prevents users that are not members of `wheel` from
+        exploiting vulnerabilities in sudo such as CVE-2021-3156.
+      '';
+    };
+
+    configFile = mkOption {
+      type = types.lines;
+      # Note: if syntax errors are detected in this file, the NixOS
+      # configuration will fail to build.
+      description = mdDoc ''
+        This string contains the contents of the
+        {file}`sudoers` file.
+      '';
+    };
+
+    extraRules = mkOption {
+      description = mdDoc ''
+        Define specific rules to be in the {file}`sudoers` file.
+        More specific rules should come after more general ones in order to
+        yield the expected behavior. You can use mkBefore/mkAfter to ensure
+        this is the case when configuration options are merged.
+      '';
+      default = [];
+      example = literalExpression ''
+        [
+          # Allow execution of any command by all users in group sudo,
+          # requiring a password.
+          { groups = [ "sudo" ]; commands = [ "ALL" ]; }
+
+          # Allow execution of "/home/root/secret.sh" by user `backup`, `database`
+          # and the group with GID `1006` without a password.
+          { users = [ "backup" "database" ]; groups = [ 1006 ];
+            commands = [ { command = "/home/root/secret.sh"; options = [ "SETENV" "NOPASSWD" ]; } ]; }
+
+          # Allow all users of group `bar` to run two executables as user `foo`
+          # with arguments being pre-set.
+          { groups = [ "bar" ]; runAs = "foo";
+            commands =
+              [ "/home/baz/cmd1.sh hello-sudo"
+                  { command = '''/home/baz/cmd2.sh ""'''; options = [ "SETENV" ]; } ]; }
+        ]
+      '';
+      type = with types; listOf (submodule {
+        options = {
+          users = mkOption {
+            type = with types; listOf (either str int);
+            description = mdDoc ''
+              The usernames / UIDs this rule should apply for.
+            '';
+            default = [];
+          };
+
+          groups = mkOption {
+            type = with types; listOf (either str int);
+            description = mdDoc ''
+              The groups / GIDs this rule should apply for.
+            '';
+            default = [];
+          };
+
+          host = mkOption {
+            type = types.str;
+            default = "ALL";
+            description = mdDoc ''
+              For what host this rule should apply.
+            '';
+          };
+
+          runAs = mkOption {
+            type = with types; str;
+            default = "ALL:ALL";
+            description = mdDoc ''
+              Under which user/group the specified command is allowed to run.
+
+              A user can be specified using just the username: `"foo"`.
+              It is also possible to specify a user/group combination using `"foo:bar"`
+              or to only allow running as a specific group with `":bar"`.
+            '';
+          };
+
+          commands = mkOption {
+            description = mdDoc ''
+              The commands for which the rule should apply.
+            '';
+            type = with types; listOf (either str (submodule {
+
+              options = {
+                command = mkOption {
+                  type = with types; str;
+                  description = mdDoc ''
+                    A command being either just a path to a binary to allow any arguments,
+                    the full command with arguments pre-set or with `""` used as the argument,
+                    not allowing arguments to the command at all.
+                  '';
+                };
+
+                options = mkOption {
+                  type = with types; listOf (enum [ "NOPASSWD" "PASSWD" "NOEXEC" "EXEC" "SETENV" "NOSETENV" "LOG_INPUT" "NOLOG_INPUT" "LOG_OUTPUT" "NOLOG_OUTPUT" ]);
+                  description = mdDoc ''
+                    Options for running the command. Refer to the [sudo manual](https://www.sudo.ws/man/1.7.10/sudoers.man.html).
+                  '';
+                  default = [];
+                };
+              };
+
+            }));
+          };
+        };
+      });
+    };
+
+    extraConfig = mkOption {
+      type = types.lines;
+      default = "";
+      description = mdDoc ''
+        Extra configuration text appended to {file}`sudoers`.
+      '';
+    };
+  };
+
+
+  ###### implementation
+
+  config = mkIf cfg.enable {
+    security.sudo-rs.extraRules =
+      let
+        defaultRule = { users ? [], groups ? [], opts ? [] }: [ {
+          inherit users groups;
+          commands = [ {
+            command = "ALL";
+            options = opts ++ cfg.defaultOptions;
+          } ];
+        } ];
+      in mkMerge [
+        # This is ordered before users' `mkBefore` rules,
+        # so as not to introduce unexpected changes.
+        (mkOrder 400 (defaultRule { users = [ "root" ]; }))
+
+        # This is ordered to show before (most) other rules, but
+        # late-enough for a user to `mkBefore` it.
+        (mkOrder 600 (defaultRule {
+          groups = [ "wheel" ];
+          opts = (optional (!cfg.wheelNeedsPassword) "NOPASSWD");
+        }))
+      ];
+
+    security.sudo-rs.configFile = concatStringsSep "\n" (filter (s: s != "") [
+      ''
+        # Don't edit this file. Set the NixOS options ‘security.sudo-rs.configFile’
+        # or ‘security.sudo-rs.extraRules’ instead.
+      ''
+      (optionalString enableSSHAgentAuth ''
+        # Keep SSH_AUTH_SOCK so that pam_ssh_agent_auth.so can do its magic.
+        Defaults env_keep+=SSH_AUTH_SOCK
+      '')
+      (concatStringsSep "\n" (
+        lists.flatten (
+          map (
+            rule: optionals (length rule.commands != 0) [
+              (map (user: "${toUserString user}	${rule.host}=(${rule.runAs})	${toCommandsString rule.commands}") rule.users)
+              (map (group: "${toGroupString group}	${rule.host}=(${rule.runAs})	${toCommandsString rule.commands}") rule.groups)
+            ]
+          ) cfg.extraRules
+        )
+      ) + "\n")
+      (optionalString (cfg.extraConfig != "") ''
+        # extraConfig
+        ${cfg.extraConfig}
+      '')
+    ]);
+
+    security.wrappers = let
+      owner = "root";
+      group = if cfg.execWheelOnly then "wheel" else "root";
+      setuid = true;
+      permissions = if cfg.execWheelOnly then "u+rx,g+x" else "u+rx,g+x,o+x";
+    in {
+      sudo = {
+        source = "${cfg.package.out}/bin/sudo";
+        inherit owner group setuid permissions;
+      };
+      # sudo-rs does not yet ship a sudoedit (as of v0.2.0)
+      sudoedit = mkIf usingMillersSudo {
+        source = "${cfg.package.out}/bin/sudoedit";
+        inherit owner group setuid permissions;
+      };
+    };
+
+    environment.systemPackages = [ sudo ];
+
+    security.pam.services.sudo = { sshAgentAuth = true; usshAuth = true; };
+    security.pam.services.sudo-i = mkIf usingSudoRs
+      { sshAgentAuth = true; usshAuth = true; };
+
+    environment.etc.sudoers =
+      { source =
+          pkgs.runCommand "sudoers"
+          {
+            src = pkgs.writeText "sudoers-in" cfg.configFile;
+            preferLocalBuild = true;
+          }
+          "${pkgs.buildPackages."${cfg.package.pname}"}/bin/visudo -f $src -c && cp $src $out";
+        mode = "0440";
+      };
+
+  };
+
+  meta.maintainers = [ lib.maintainers.nicoo ];
+
+}
diff --git a/nixos/modules/security/sudo.nix b/nixos/modules/security/sudo.nix
index 4bdbe9671e6..d225442773c 100644
--- a/nixos/modules/security/sudo.nix
+++ b/nixos/modules/security/sudo.nix
@@ -4,16 +4,9 @@ with lib;
 
 let
 
-  inherit (pkgs) sudo sudo-rs;
-
   cfg = config.security.sudo;
 
-  enableSSHAgentAuth =
-    with config.security;
-    pam.enableSSHAgentAuth && pam.sudo.sshAgentAuth;
-
-  usingMillersSudo = cfg.package.pname == sudo.pname;
-  usingSudoRs = cfg.package.pname == sudo-rs.pname;
+  inherit (pkgs) sudo;
 
   toUserString = user: if (isInt user) then "#${toString user}" else "${user}";
   toGroupString = group: if (isInt group) then "%#${toString group}" else "%${group}";
@@ -37,51 +30,41 @@ in
 
   ###### interface
 
-  options.security.sudo = {
-
-    defaultOptions = mkOption {
-      type = with types; listOf str;
-      default = optional usingMillersSudo "SETENV";
-      defaultText = literalMD ''
-        `[ "SETENV" ]` if using the default `sudo` implementation
-      '';
-      description = mdDoc ''
-        Options used for the default rules, granting `root` and the
-        `wheel` group permission to run any command as any user.
-      '';
-    };
+  options = {
 
-    enable = mkOption {
+    security.sudo.enable = mkOption {
       type = types.bool;
       default = true;
-      description = mdDoc ''
-        Whether to enable the {command}`sudo` command, which
-        allows non-root users to execute commands as root.
-      '';
+      description =
+        lib.mdDoc ''
+          Whether to enable the {command}`sudo` command, which
+          allows non-root users to execute commands as root.
+        '';
     };
 
-    package = mkOption {
+    security.sudo.package = mkOption {
       type = types.package;
       default = pkgs.sudo;
       defaultText = literalExpression "pkgs.sudo";
-      description = mdDoc ''
+      description = lib.mdDoc ''
         Which package to use for `sudo`.
       '';
     };
 
-    wheelNeedsPassword = mkOption {
+    security.sudo.wheelNeedsPassword = mkOption {
       type = types.bool;
       default = true;
-      description = mdDoc ''
-        Whether users of the `wheel` group must
-        provide a password to run commands as super user via {command}`sudo`.
-      '';
+      description =
+        lib.mdDoc ''
+          Whether users of the `wheel` group must
+          provide a password to run commands as super user via {command}`sudo`.
+        '';
       };
 
-    execWheelOnly = mkOption {
+    security.sudo.execWheelOnly = mkOption {
       type = types.bool;
       default = false;
-      description = mdDoc ''
+      description = lib.mdDoc ''
         Only allow members of the `wheel` group to execute sudo by
         setting the executable's permissions accordingly.
         This prevents users that are not members of `wheel` from
@@ -89,18 +72,19 @@ in
       '';
     };
 
-    configFile = mkOption {
+    security.sudo.configFile = mkOption {
       type = types.lines;
       # Note: if syntax errors are detected in this file, the NixOS
       # configuration will fail to build.
-      description = mdDoc ''
-        This string contains the contents of the
-        {file}`sudoers` file.
-      '';
+      description =
+        lib.mdDoc ''
+          This string contains the contents of the
+          {file}`sudoers` file.
+        '';
     };
 
-    extraRules = mkOption {
-      description = mdDoc ''
+    security.sudo.extraRules = mkOption {
+      description = lib.mdDoc ''
         Define specific rules to be in the {file}`sudoers` file.
         More specific rules should come after more general ones in order to
         yield the expected behavior. You can use mkBefore/mkAfter to ensure
@@ -130,7 +114,7 @@ in
         options = {
           users = mkOption {
             type = with types; listOf (either str int);
-            description = mdDoc ''
+            description = lib.mdDoc ''
               The usernames / UIDs this rule should apply for.
             '';
             default = [];
@@ -138,7 +122,7 @@ in
 
           groups = mkOption {
             type = with types; listOf (either str int);
-            description = mdDoc ''
+            description = lib.mdDoc ''
               The groups / GIDs this rule should apply for.
             '';
             default = [];
@@ -147,7 +131,7 @@ in
           host = mkOption {
             type = types.str;
             default = "ALL";
-            description = mdDoc ''
+            description = lib.mdDoc ''
               For what host this rule should apply.
             '';
           };
@@ -155,7 +139,7 @@ in
           runAs = mkOption {
             type = with types; str;
             default = "ALL:ALL";
-            description = mdDoc ''
+            description = lib.mdDoc ''
               Under which user/group the specified command is allowed to run.
 
               A user can be specified using just the username: `"foo"`.
@@ -165,7 +149,7 @@ in
           };
 
           commands = mkOption {
-            description = mdDoc ''
+            description = lib.mdDoc ''
               The commands for which the rule should apply.
             '';
             type = with types; listOf (either str (submodule {
@@ -173,7 +157,7 @@ in
               options = {
                 command = mkOption {
                   type = with types; str;
-                  description = mdDoc ''
+                  description = lib.mdDoc ''
                     A command being either just a path to a binary to allow any arguments,
                     the full command with arguments pre-set or with `""` used as the argument,
                     not allowing arguments to the command at all.
@@ -182,7 +166,7 @@ in
 
                 options = mkOption {
                   type = with types; listOf (enum [ "NOPASSWD" "PASSWD" "NOEXEC" "EXEC" "SETENV" "NOSETENV" "LOG_INPUT" "NOLOG_INPUT" "LOG_OUTPUT" "NOLOG_OUTPUT" ]);
-                  description = mdDoc ''
+                  description = lib.mdDoc ''
                     Options for running the command. Refer to the [sudo manual](https://www.sudo.ws/man/1.7.10/sudoers.man.html).
                   '';
                   default = [];
@@ -195,10 +179,10 @@ in
       });
     };
 
-    extraConfig = mkOption {
+    security.sudo.extraConfig = mkOption {
       type = types.lines;
       default = "";
-      description = mdDoc ''
+      description = lib.mdDoc ''
         Extra configuration text appended to {file}`sudoers`.
       '';
     };
@@ -208,52 +192,44 @@ in
   ###### implementation
 
   config = mkIf cfg.enable {
-    security.sudo.extraRules =
-      let
-        defaultRule = { users ? [], groups ? [], opts ? [] }: [ {
-          inherit users groups;
-          commands = [ {
-            command = "ALL";
-            options = opts ++ cfg.defaultOptions;
-          } ];
-        } ];
-      in mkMerge [
-        # This is ordered before users' `mkBefore` rules,
-        # so as not to introduce unexpected changes.
-        (mkOrder 400 (defaultRule { users = [ "root" ]; }))
-
-        # This is ordered to show before (most) other rules, but
-        # late-enough for a user to `mkBefore` it.
-        (mkOrder 600 (defaultRule {
-          groups = [ "wheel" ];
-          opts = (optional (!cfg.wheelNeedsPassword) "NOPASSWD");
-        }))
-      ];
-
-    security.sudo.configFile = concatStringsSep "\n" (filter (s: s != "") [
+    assertions = [
+      { assertion = cfg.package.pname != "sudo-rs";
+        message = "The NixOS `sudo` module does not work with `sudo-rs` yet."; }
+    ];
+
+    # We `mkOrder 600` so that the default rule shows up first, but there is
+    # still enough room for a user to `mkBefore` it.
+    security.sudo.extraRules = mkOrder 600 [
+      { groups = [ "wheel" ];
+        commands = [ { command = "ALL"; options = (if cfg.wheelNeedsPassword then [ "SETENV" ] else [ "NOPASSWD" "SETENV" ]); } ];
+      }
+    ];
+
+    security.sudo.configFile =
       ''
         # Don't edit this file. Set the NixOS options ‘security.sudo.configFile’
         # or ‘security.sudo.extraRules’ instead.
-      ''
-      (optionalString enableSSHAgentAuth ''
+
         # Keep SSH_AUTH_SOCK so that pam_ssh_agent_auth.so can do its magic.
         Defaults env_keep+=SSH_AUTH_SOCK
-      '')
-      (concatStringsSep "\n" (
-        lists.flatten (
-          map (
-            rule: optionals (length rule.commands != 0) [
-              (map (user: "${toUserString user}	${rule.host}=(${rule.runAs})	${toCommandsString rule.commands}") rule.users)
-              (map (group: "${toGroupString group}	${rule.host}=(${rule.runAs})	${toCommandsString rule.commands}") rule.groups)
-            ]
-          ) cfg.extraRules
-        )
-      ) + "\n")
-      (optionalString (cfg.extraConfig != "") ''
-        # extraConfig
+
+        # "root" is allowed to do anything.
+        root        ALL=(ALL:ALL) SETENV: ALL
+
+        # extraRules
+        ${concatStringsSep "\n" (
+          lists.flatten (
+            map (
+              rule: optionals (length rule.commands != 0) [
+                (map (user: "${toUserString user}	${rule.host}=(${rule.runAs})	${toCommandsString rule.commands}") rule.users)
+                (map (group: "${toGroupString group}	${rule.host}=(${rule.runAs})	${toCommandsString rule.commands}") rule.groups)
+              ]
+            ) cfg.extraRules
+          )
+        )}
+
         ${cfg.extraConfig}
-      '')
-    ]);
+      '';
 
     security.wrappers = let
       owner = "root";
@@ -265,8 +241,7 @@ in
         source = "${cfg.package.out}/bin/sudo";
         inherit owner group setuid permissions;
       };
-      # sudo-rs does not yet ship a sudoedit (as of v0.2.0)
-      sudoedit = mkIf usingMillersSudo {
+      sudoedit = {
         source = "${cfg.package.out}/bin/sudoedit";
         inherit owner group setuid permissions;
       };
@@ -275,8 +250,6 @@ in
     environment.systemPackages = [ sudo ];
 
     security.pam.services.sudo = { sshAgentAuth = true; usshAuth = true; };
-    security.pam.services.sudo-i = mkIf usingSudoRs
-      { sshAgentAuth = true; usshAuth = true; };
 
     environment.etc.sudoers =
       { source =
@@ -285,12 +258,12 @@ in
             src = pkgs.writeText "sudoers-in" cfg.configFile;
             preferLocalBuild = true;
           }
-          "${cfg.package}/bin/visudo -f $src -c && cp $src $out";
+          # Make sure that the sudoers file is syntactically valid.
+          # (currently disabled - NIXOS-66)
+          "${pkgs.buildPackages.sudo}/sbin/visudo -f $src -c && cp $src $out";
         mode = "0440";
       };
 
   };
 
-  meta.maintainers = [ lib.maintainers.nicoo ];
-
 }
diff --git a/nixos/modules/services/matrix/synapse.nix b/nixos/modules/services/matrix/synapse.nix
index 5cce36f41e5..1354a8cb58b 100644
--- a/nixos/modules/services/matrix/synapse.nix
+++ b/nixos/modules/services/matrix/synapse.nix
@@ -1022,7 +1022,7 @@ in {
 
     systemd.targets.matrix-synapse = lib.mkIf hasWorkers {
       description = "Synapse Matrix parent target";
-      after = [ "network.target" ] ++ optional hasLocalPostgresDB "postgresql.service";
+      after = [ "network-online.target" ] ++ optional hasLocalPostgresDB "postgresql.service";
       wantedBy = [ "multi-user.target" ];
     };
 
@@ -1036,7 +1036,7 @@ in {
             unitConfig.ReloadPropagatedFrom = "matrix-synapse.target";
           }
           else {
-            after = [ "network.target" ] ++ optional hasLocalPostgresDB "postgresql.service";
+            after = [ "network-online.target" ] ++ optional hasLocalPostgresDB "postgresql.service";
             wantedBy = [ "multi-user.target" ];
           };
         baseServiceConfig = {
diff --git a/nixos/modules/services/misc/mbpfan.nix b/nixos/modules/services/misc/mbpfan.nix
index e75c3525414..8f64fb2d9c5 100644
--- a/nixos/modules/services/misc/mbpfan.nix
+++ b/nixos/modules/services/misc/mbpfan.nix
@@ -26,7 +26,7 @@ in {
 
     aggressive = mkOption {
       type = types.bool;
-      default = false;
+      default = true;
       description = lib.mdDoc "If true, favors higher default fan speeds.";
     };
 
@@ -38,17 +38,20 @@ in {
 
         options.general.low_temp = mkOption {
           type = types.int;
-          default = 63;
+          default = (if cfg.aggressive then 55 else 63);
+          defaultText = literalExpression "55";
           description = lib.mdDoc "If temperature is below this, fans will run at minimum speed.";
         };
         options.general.high_temp = mkOption {
           type = types.int;
-          default = 66;
+          default = (if cfg.aggressive then 58 else 66);
+          defaultText = literalExpression "58";
           description = lib.mdDoc "If temperature is above this, fan speed will gradually increase.";
         };
         options.general.max_temp = mkOption {
           type = types.int;
-          default = 86;
+          default = (if cfg.aggressive then 78 else 86);
+          defaultText = literalExpression "78";
           description = lib.mdDoc "If temperature is above this, fans will run at maximum speed.";
         };
         options.general.polling_interval = mkOption {
@@ -70,13 +73,6 @@ in {
   ];
 
   config = mkIf cfg.enable {
-    services.mbpfan.settings = mkIf cfg.aggressive {
-      general.min_fan1_speed = mkDefault 2000;
-      general.low_temp = mkDefault 55;
-      general.high_temp = mkDefault 58;
-      general.max_temp = mkDefault 70;
-    };
-
     boot.kernelModules = [ "coretemp" "applesmc" ];
     environment.systemPackages = [ cfg.package ];
     environment.etc."mbpfan.conf".source = settingsFile;
@@ -86,6 +82,7 @@ in {
       wantedBy = [ "sysinit.target" ];
       after = [ "syslog.target" "sysinit.target" ];
       restartTriggers = [ config.environment.etc."mbpfan.conf".source ];
+
       serviceConfig = {
         Type = "simple";
         ExecStart = "${cfg.package}/bin/mbpfan -f${verbose}";
diff --git a/nixos/modules/services/search/typesense.nix b/nixos/modules/services/search/typesense.nix
index 856c3cad22d..c158d04fea2 100644
--- a/nixos/modules/services/search/typesense.nix
+++ b/nixos/modules/services/search/typesense.nix
@@ -83,12 +83,12 @@ in {
         Group = "typesense";
 
         StateDirectory = "typesense";
-        StateDirectoryMode = "0700";
+        StateDirectoryMode = "0750";
 
         # Hardening
         CapabilityBoundingSet = "";
         LockPersonality = true;
-        MemoryDenyWriteExecute = true;
+        # MemoryDenyWriteExecute = true; needed since 0.25.1
         NoNewPrivileges = true;
         PrivateUsers = true;
         PrivateTmp = true;
diff --git a/nixos/modules/system/activation/switch-to-configuration.pl b/nixos/modules/system/activation/switch-to-configuration.pl
index 8bd450d7343..e05f89bb0fb 100755
--- a/nixos/modules/system/activation/switch-to-configuration.pl
+++ b/nixos/modules/system/activation/switch-to-configuration.pl
@@ -74,7 +74,7 @@ if ("@localeArchive@" ne "") {
 
 if (!defined($action) || ($action ne "switch" && $action ne "boot" && $action ne "test" && $action ne "dry-activate")) {
     print STDERR <<"EOF";
-Usage: $0 [switch|boot|test]
+Usage: $0 [switch|boot|test|dry-activate]
 
 switch:       make the configuration the boot default and activate now
 boot:         make the configuration the boot default
@@ -661,10 +661,20 @@ foreach my $mount_point (keys(%{$cur_fss})) {
         # Filesystem entry disappeared, so unmount it.
         $units_to_stop{$unit} = 1;
     } elsif ($cur->{fsType} ne $new->{fsType} || $cur->{device} ne $new->{device}) {
-        # Filesystem type or device changed, so unmount and mount it.
-        $units_to_stop{$unit} = 1;
-        $units_to_start{$unit} = 1;
-        record_unit($start_list_file, $unit);
+        if ($mount_point eq '/' or $mount_point eq '/nix') {
+            if ($cur->{options} ne $new->{options}) {
+                # Mount options changed, so remount it.
+                $units_to_reload{$unit} = 1;
+                record_unit($reload_list_file, $unit);
+            } else {
+                # Don't unmount / or /nix if the device changed
+                $units_to_skip{$unit} = 1;
+            }
+        } else {
+            # Filesystem type or device changed, so unmount and mount it.
+            $units_to_restart{$unit} = 1;
+            record_unit($restart_list_file, $unit);
+        }
     } elsif ($cur->{options} ne $new->{options}) {
         # Mount options changes, so remount it.
         $units_to_reload{$unit} = 1;
diff --git a/nixos/modules/system/boot/loader/generic-extlinux-compatible/extlinux-conf-builder.sh b/nixos/modules/system/boot/loader/generic-extlinux-compatible/extlinux-conf-builder.sh
index 1a0da005029..84a0a93ded1 100644
--- a/nixos/modules/system/boot/loader/generic-extlinux-compatible/extlinux-conf-builder.sh
+++ b/nixos/modules/system/boot/loader/generic-extlinux-compatible/extlinux-conf-builder.sh
@@ -70,13 +70,33 @@ copyToKernelsDir() {
 addEntry() {
     local path=$(readlink -f "$1")
     local tag="$2" # Generation number or 'default'
+    local current="$3" # whether this is the current/latest generation
 
     if ! test -e $path/kernel -a -e $path/initrd; then
         return
     fi
 
+    if test -e "$path/append-initrd-secrets"; then
+        local initrd="$target/nixos/$(basename "$path")-initramfs-with-secrets"
+        cp $(readlink -f "$path/initrd") "$initrd"
+        chmod 600 "${initrd}"
+        chown 0:0 "${initrd}"
+        filesCopied[$initrd]=1
+
+        "$path/append-initrd-secrets" "$initrd" || if test "${current}" = "1"; then
+            echo "failed to create initrd secrets for the current generation." >&2
+            echo "are your \`boot.initrd.secrets\` still in place?" >&2
+            exit 1
+        else
+            echo "warning: failed to create initrd secrets for \"$path\", an older generation" >&2
+            echo "note: this is normal after having removed or renamed a file in \`boot.initrd.secrets\`" >&2
+        fi
+    else
+        copyToKernelsDir "$path/initrd"; initrd=$result
+    fi
+
     copyToKernelsDir "$path/kernel"; kernel=$result
-    copyToKernelsDir "$path/initrd"; initrd=$result
+
     dtbDir=$(readlink -m "$path/dtbs")
     if [ -e "$dtbDir" ]; then
         copyToKernelsDir "$dtbDir"; dtbs=$result
@@ -130,18 +150,20 @@ MENU TITLE ------------------------------------------------------------
 TIMEOUT $timeout
 EOF
 
-addEntry $default default >> $tmpFile
+addEntry $default default 1 >> $tmpFile
 
 if [ "$numGenerations" -gt 0 ]; then
     # Add up to $numGenerations generations of the system profile to the menu,
     # in reverse (most recent to least recent) order.
+    current=1
     for generation in $(
             (cd /nix/var/nix/profiles && ls -d system-*-link) \
             | sed 's/system-\([0-9]\+\)-link/\1/' \
             | sort -n -r \
             | head -n $numGenerations); do
         link=/nix/var/nix/profiles/system-$generation-link
-        addEntry $link $generation
+        addEntry $link $generation $current
+        current=0
     done >> $tmpFile
 fi
 
diff --git a/nixos/modules/system/boot/loader/raspberrypi/raspberrypi.nix b/nixos/modules/system/boot/loader/raspberrypi/raspberrypi.nix
index 9c9bee93de8..c64ef092667 100644
--- a/nixos/modules/system/boot/loader/raspberrypi/raspberrypi.nix
+++ b/nixos/modules/system/boot/loader/raspberrypi/raspberrypi.nix
@@ -142,6 +142,7 @@ in
         assertion = !pkgs.stdenv.hostPlatform.isAarch64 || cfg.version >= 3;
         message = "Only Raspberry Pi >= 3 supports aarch64.";
       };
+      boot.loader.supportsInitrdSecrets = cfg.uboot.enable;
 
       system.build.installBootLoader = builder;
       system.boot.loader.id = "raspberrypi";
diff --git a/nixos/modules/system/boot/stage-1.nix b/nixos/modules/system/boot/stage-1.nix
index a3551f68dbe..1cf58dbe9f1 100644
--- a/nixos/modules/system/boot/stage-1.nix
+++ b/nixos/modules/system/boot/stage-1.nix
@@ -610,6 +610,13 @@ in
             path the secret should have inside the initrd, the value
             is the path it should be copied from (or null for the same
             path inside and out).
+
+            The loader `generic-extlinux-compatible` supports this. Because
+            it is not well know how different implementations react to
+            concatenated cpio archives, this is disabled by default. It can be
+            enabled by setting {option}`boot.loader.supportsInitrdSecrets`
+            to true. If this works for you, please report your findings at
+            https://github.com/NixOS/nixpkgs/issues/247145 .
           '';
         example = literalExpression
           ''
diff --git a/nixos/tests/sudo-rs.nix b/nixos/tests/sudo-rs.nix
index 150c0d5b4f1..6006863217b 100644
--- a/nixos/tests/sudo-rs.nix
+++ b/nixos/tests/sudo-rs.nix
@@ -5,7 +5,7 @@ let
   password = "helloworld";
 in
   import ./make-test-python.nix ({ lib, pkgs, ...} : {
-    name = "sudo";
+    name = "sudo-rs";
     meta.maintainers = pkgs.sudo-rs.meta.maintainers;
 
     nodes.machine =
@@ -22,7 +22,9 @@ in
           test5 = { isNormalUser = true; };
         };
 
-        security.sudo = {
+        security.sudo.enable = false;
+
+        security.sudo-rs = {
           enable = true;
           package = pkgs.sudo-rs;
           wheelNeedsPassword = false;
@@ -54,7 +56,9 @@ in
         noadmin = { isNormalUser = true; };
       };
 
-      security.sudo = {
+      security.sudo.enable = false;
+
+      security.sudo-rs = {
         package = pkgs.sudo-rs;
         enable = true;
         wheelNeedsPassword = false;
@@ -86,7 +90,7 @@ in
             machine.succeed("sudo -u test5 sudo -n -u test1 true")
 
         with subtest("test5 user should not be able to run commands under root"):
-            machine.fail("sudo -u test5 sudo -n -u root true")
+            machine.fail("sudo -u test5 sudo -n -u root true 2>/dev/null")
 
         with subtest("users in wheel should be able to run sudo despite execWheelOnly"):
             strict.succeed('faketty -- su - admin -c "sudo -u root true"')
diff --git a/nixos/tests/switch-test.nix b/nixos/tests/switch-test.nix
index 529a2086420..5ffdf180d5e 100644
--- a/nixos/tests/switch-test.nix
+++ b/nixos/tests/switch-test.nix
@@ -58,6 +58,37 @@ in {
       '');
 
       specialisation = rec {
+        brokenInitInterface.configuration.config.system.extraSystemBuilderCmds = ''
+          echo "systemd 0" > $out/init-interface-version
+        '';
+
+        modifiedSystemConf.configuration.systemd.extraConfig = ''
+          # Hello world!
+        '';
+
+        addedMount.configuration.virtualisation.fileSystems."/test" = {
+          device = "tmpfs";
+          fsType = "tmpfs";
+        };
+
+        addedMountOptsModified.configuration = {
+          imports = [ addedMount.configuration ];
+          virtualisation.fileSystems."/test".options = [ "x-test" ];
+        };
+
+        addedMountDevModified.configuration = {
+          imports = [ addedMountOptsModified.configuration ];
+          virtualisation.fileSystems."/test".device = lib.mkForce "ramfs";
+        };
+
+        storeMountModified.configuration = {
+          virtualisation.fileSystems."/".device = lib.mkForce "auto";
+        };
+
+        swap.configuration.swapDevices = lib.mkVMOverride [
+          { device = "/swapfile"; size = 1; }
+        ];
+
         simpleService.configuration = {
           systemd.services.test = {
             wantedBy = [ "multi-user.target" ];
@@ -643,6 +674,97 @@ in {
 
         # test and dry-activate actions are tested further down below
 
+        # invalid action fails the script
+        switch_to_specialisation("${machine}", "", action="broken-action", fail=True)
+        # no action fails the script
+        assert "Usage:" in machine.fail("${machine}/bin/switch-to-configuration 2>&1")
+
+    with subtest("init interface version"):
+        # Do not try to switch to an invalid init interface version
+        assert "incompatible" in switch_to_specialisation("${machine}", "brokenInitInterface", fail=True)
+
+    with subtest("systemd restarts"):
+        # systemd is restarted when its system.conf changes
+        out = switch_to_specialisation("${machine}", "modifiedSystemConf")
+        assert_contains(out, "restarting systemd...")
+
+    with subtest("continuing from an aborted switch"):
+        # An aborted switch will write into a file what it tried to start
+        # and a second switch should continue from this
+        machine.succeed("echo dbus.service > /run/nixos/start-list")
+        out = switch_to_specialisation("${machine}", "modifiedSystemConf")
+        assert_contains(out, "starting the following units: dbus.service\n")
+
+    with subtest("fstab mounts"):
+        switch_to_specialisation("${machine}", "")
+        # add a mountpoint
+        out = switch_to_specialisation("${machine}", "addedMount")
+        assert_lacks(out, "stopping the following units:")
+        assert_lacks(out, "NOT restarting the following changed units:")
+        assert_lacks(out, "\nrestarting the following units:")
+        assert_lacks(out, "\nstarting the following units:")
+        assert_contains(out, "the following new units were started: test.mount\n")
+        # modify the mountpoint's options
+        out = switch_to_specialisation("${machine}", "addedMountOptsModified")
+        assert_lacks(out, "stopping the following units:")
+        assert_lacks(out, "NOT restarting the following changed units:")
+        assert_contains(out, "reloading the following units: test.mount\n")
+        assert_lacks(out, "\nrestarting the following units:")
+        assert_lacks(out, "\nstarting the following units:")
+        assert_lacks(out, "the following new units were started:")
+        # modify the device
+        out = switch_to_specialisation("${machine}", "addedMountDevModified")
+        assert_lacks(out, "stopping the following units:")
+        assert_lacks(out, "NOT restarting the following changed units:")
+        assert_lacks(out, "reloading the following units:")
+        assert_contains(out, "\nrestarting the following units: test.mount\n")
+        assert_lacks(out, "\nstarting the following units:")
+        assert_lacks(out, "the following new units were started:")
+        # modify both
+        out = switch_to_specialisation("${machine}", "addedMount")
+        assert_lacks(out, "stopping the following units:")
+        assert_lacks(out, "NOT restarting the following changed units:")
+        assert_lacks(out, "reloading the following units:")
+        assert_contains(out, "\nrestarting the following units: test.mount\n")
+        assert_lacks(out, "\nstarting the following units:")
+        assert_lacks(out, "the following new units were started:")
+        # remove the mount
+        out = switch_to_specialisation("${machine}", "")
+        assert_contains(out, "stopping the following units: test.mount\n")
+        assert_lacks(out, "NOT restarting the following changed units:")
+        assert_contains(out, "reloading the following units: dbus.service\n")
+        assert_lacks(out, "\nrestarting the following units:")
+        assert_lacks(out, "\nstarting the following units:")
+        assert_lacks(out, "the following new units were started:")
+        # change something about the / mount
+        out = switch_to_specialisation("${machine}", "storeMountModified")
+        assert_lacks(out, "stopping the following units:")
+        assert_contains(out, "NOT restarting the following changed units: -.mount")
+        assert_contains(out, "reloading the following units: dbus.service\n")
+        assert_lacks(out, "\nrestarting the following units:")
+        assert_lacks(out, "\nstarting the following units:")
+        assert_lacks(out, "the following new units were started:")
+
+    with subtest("swaps"):
+        switch_to_specialisation("${machine}", "")
+        # add a swap
+        out = switch_to_specialisation("${machine}", "swap")
+        assert_lacks(out, "stopping the following units:")
+        assert_lacks(out, "NOT restarting the following changed units:")
+        assert_contains(out, "reloading the following units: dbus.service\n")
+        assert_lacks(out, "\nrestarting the following units:")
+        assert_lacks(out, "\nstarting the following units:")
+        assert_contains(out, "the following new units were started: swapfile.swap")
+        # remove it
+        out = switch_to_specialisation("${machine}", "")
+        assert_contains(out, "stopping swap device: /swapfile")
+        assert_lacks(out, "stopping the following units:")
+        assert_lacks(out, "NOT restarting the following changed units:")
+        assert_contains(out, "reloading the following units: dbus.service\n")
+        assert_lacks(out, "\nrestarting the following units:")
+        assert_lacks(out, "\nstarting the following units:")
+        assert_lacks(out, "the following new units were started:")
+
     with subtest("services"):
         switch_to_specialisation("${machine}", "")
         # Nothing happens when nothing is changed
diff --git a/pkgs/applications/blockchains/dcrctl/default.nix b/pkgs/applications/blockchains/dcrctl/default.nix
index 31e56254ee7..97f9b7767db 100644
--- a/pkgs/applications/blockchains/dcrctl/default.nix
+++ b/pkgs/applications/blockchains/dcrctl/default.nix
@@ -19,6 +19,6 @@ buildGoModule rec {
     homepage = "https://decred.org";
     description = "A secure Decred wallet daemon written in Go (golang)";
     license = with lib.licenses; [ isc ];
-    maintainers = with lib.maintainers; [ aaronjheng ];
+    maintainers = with lib.maintainers; [ ];
   };
 }
diff --git a/pkgs/applications/editors/jetbrains/plugins/plugins.json b/pkgs/applications/editors/jetbrains/plugins/plugins.json
index dd86e3e807e..7dacad6e7a4 100644
--- a/pkgs/applications/editors/jetbrains/plugins/plugins.json
+++ b/pkgs/applications/editors/jetbrains/plugins/plugins.json
@@ -21,12 +21,12 @@
         "232.9559.28": "https://plugins.jetbrains.com/files/164/390591/IdeaVim-2.5.1-signed.zip",
         "232.9559.58": "https://plugins.jetbrains.com/files/164/390591/IdeaVim-2.5.1-signed.zip",
         "232.9559.61": "https://plugins.jetbrains.com/files/164/390591/IdeaVim-2.5.1-signed.zip",
-        "232.9559.64": "https://plugins.jetbrains.com/files/164/390591/IdeaVim-2.5.1-signed.zip",
         "232.9921.42": "https://plugins.jetbrains.com/files/164/390591/IdeaVim-2.5.1-signed.zip",
-        "232.9921.46": "https://plugins.jetbrains.com/files/164/390591/IdeaVim-2.5.1-signed.zip",
         "232.9921.47": "https://plugins.jetbrains.com/files/164/390591/IdeaVim-2.5.1-signed.zip",
         "232.9921.48": "https://plugins.jetbrains.com/files/164/390591/IdeaVim-2.5.1-signed.zip",
-        "232.9921.53": "https://plugins.jetbrains.com/files/164/390591/IdeaVim-2.5.1-signed.zip"
+        "232.9921.53": "https://plugins.jetbrains.com/files/164/390591/IdeaVim-2.5.1-signed.zip",
+        "232.9921.55": "https://plugins.jetbrains.com/files/164/390591/IdeaVim-2.5.1-signed.zip",
+        "232.9921.62": "https://plugins.jetbrains.com/files/164/390591/IdeaVim-2.5.1-signed.zip"
       },
       "name": "ideavim"
     },
@@ -60,12 +60,12 @@
         "232.9559.28": null,
         "232.9559.58": null,
         "232.9559.61": null,
-        "232.9559.64": null,
         "232.9921.42": null,
-        "232.9921.46": null,
         "232.9921.47": null,
         "232.9921.48": null,
-        "232.9921.53": null
+        "232.9921.53": null,
+        "232.9921.55": null,
+        "232.9921.62": null
       },
       "name": "kotlin"
     },
@@ -90,12 +90,12 @@
         "232.9559.28": "https://plugins.jetbrains.com/files/6981/383851/ini-232.9559.64.zip",
         "232.9559.58": "https://plugins.jetbrains.com/files/6981/383851/ini-232.9559.64.zip",
         "232.9559.61": "https://plugins.jetbrains.com/files/6981/383851/ini-232.9559.64.zip",
-        "232.9559.64": "https://plugins.jetbrains.com/files/6981/383851/ini-232.9559.64.zip",
-        "232.9921.42": "https://plugins.jetbrains.com/files/6981/393737/ini-232.9921.36.zip",
-        "232.9921.46": "https://plugins.jetbrains.com/files/6981/393737/ini-232.9921.36.zip",
-        "232.9921.47": "https://plugins.jetbrains.com/files/6981/393737/ini-232.9921.36.zip",
-        "232.9921.48": "https://plugins.jetbrains.com/files/6981/393737/ini-232.9921.36.zip",
-        "232.9921.53": "https://plugins.jetbrains.com/files/6981/393737/ini-232.9921.36.zip"
+        "232.9921.42": "https://plugins.jetbrains.com/files/6981/398535/ini-232.9921.55.zip",
+        "232.9921.47": "https://plugins.jetbrains.com/files/6981/398535/ini-232.9921.55.zip",
+        "232.9921.48": "https://plugins.jetbrains.com/files/6981/398535/ini-232.9921.55.zip",
+        "232.9921.53": "https://plugins.jetbrains.com/files/6981/398535/ini-232.9921.55.zip",
+        "232.9921.55": "https://plugins.jetbrains.com/files/6981/398535/ini-232.9921.55.zip",
+        "232.9921.62": "https://plugins.jetbrains.com/files/6981/398535/ini-232.9921.55.zip"
       },
       "name": "ini"
     },
@@ -105,8 +105,8 @@
         "phpstorm"
       ],
       "builds": {
-        "232.9559.64": "https://plugins.jetbrains.com/files/7219/389222/Symfony_Plugin-2022.1.256.zip",
-        "232.9921.47": "https://plugins.jetbrains.com/files/7219/389222/Symfony_Plugin-2022.1.256.zip"
+        "232.9921.47": "https://plugins.jetbrains.com/files/7219/401047/Symfony_Plugin-2022.1.257.zip",
+        "232.9921.55": "https://plugins.jetbrains.com/files/7219/401047/Symfony_Plugin-2022.1.257.zip"
       },
       "name": "symfony-support"
     },
@@ -116,8 +116,8 @@
         "phpstorm"
       ],
       "builds": {
-        "232.9559.64": "https://plugins.jetbrains.com/files/7320/346181/PHP_Annotations-9.4.0.zip",
-        "232.9921.47": "https://plugins.jetbrains.com/files/7320/346181/PHP_Annotations-9.4.0.zip"
+        "232.9921.47": "https://plugins.jetbrains.com/files/7320/346181/PHP_Annotations-9.4.0.zip",
+        "232.9921.55": "https://plugins.jetbrains.com/files/7320/346181/PHP_Annotations-9.4.0.zip"
       },
       "name": "php-annotations"
     },
@@ -132,9 +132,9 @@
       "builds": {
         "232.9559.28": "https://plugins.jetbrains.com/files/7322/381781/python-ce-232.9559.62.zip",
         "232.9559.61": "https://plugins.jetbrains.com/files/7322/381781/python-ce-232.9559.62.zip",
-        "232.9921.46": "https://plugins.jetbrains.com/files/7322/395441/python-ce-232.9921.47.zip",
-        "232.9921.47": "https://plugins.jetbrains.com/files/7322/395441/python-ce-232.9921.47.zip",
-        "232.9921.53": "https://plugins.jetbrains.com/files/7322/395441/python-ce-232.9921.47.zip"
+        "232.9921.47": "https://plugins.jetbrains.com/files/7322/401058/python-ce-232.9921.77.zip",
+        "232.9921.53": "https://plugins.jetbrains.com/files/7322/401058/python-ce-232.9921.77.zip",
+        "232.9921.62": "https://plugins.jetbrains.com/files/7322/401058/python-ce-232.9921.77.zip"
       },
       "name": "python-community-edition"
     },
@@ -158,11 +158,11 @@
         "232.9559.28": "https://plugins.jetbrains.com/files/8182/395553/intellij-rust-0.4.201.5424-232.zip",
         "232.9559.58": "https://plugins.jetbrains.com/files/8182/395553/intellij-rust-0.4.201.5424-232.zip",
         "232.9559.61": "https://plugins.jetbrains.com/files/8182/395553/intellij-rust-0.4.201.5424-232.zip",
-        "232.9559.64": "https://plugins.jetbrains.com/files/8182/395553/intellij-rust-0.4.201.5424-232.zip",
         "232.9921.42": "https://plugins.jetbrains.com/files/8182/395553/intellij-rust-0.4.201.5424-232.zip",
         "232.9921.47": "https://plugins.jetbrains.com/files/8182/395553/intellij-rust-0.4.201.5424-232.zip",
         "232.9921.48": "https://plugins.jetbrains.com/files/8182/395553/intellij-rust-0.4.201.5424-232.zip",
-        "232.9921.53": "https://plugins.jetbrains.com/files/8182/395553/intellij-rust-0.4.201.5424-232.zip"
+        "232.9921.53": "https://plugins.jetbrains.com/files/8182/395553/intellij-rust-0.4.201.5424-232.zip",
+        "232.9921.55": "https://plugins.jetbrains.com/files/8182/395553/intellij-rust-0.4.201.5424-232.zip"
       },
       "name": "-deprecated-rust"
     },
@@ -186,11 +186,11 @@
         "232.9559.28": "https://plugins.jetbrains.com/files/8182/372556/intellij-rust-0.4.200.5420-232-beta.zip",
         "232.9559.58": "https://plugins.jetbrains.com/files/8182/372556/intellij-rust-0.4.200.5420-232-beta.zip",
         "232.9559.61": "https://plugins.jetbrains.com/files/8182/372556/intellij-rust-0.4.200.5420-232-beta.zip",
-        "232.9559.64": "https://plugins.jetbrains.com/files/8182/372556/intellij-rust-0.4.200.5420-232-beta.zip",
         "232.9921.42": "https://plugins.jetbrains.com/files/8182/372556/intellij-rust-0.4.200.5420-232-beta.zip",
         "232.9921.47": "https://plugins.jetbrains.com/files/8182/372556/intellij-rust-0.4.200.5420-232-beta.zip",
         "232.9921.48": "https://plugins.jetbrains.com/files/8182/372556/intellij-rust-0.4.200.5420-232-beta.zip",
-        "232.9921.53": "https://plugins.jetbrains.com/files/8182/372556/intellij-rust-0.4.200.5420-232-beta.zip"
+        "232.9921.53": "https://plugins.jetbrains.com/files/8182/372556/intellij-rust-0.4.200.5420-232-beta.zip",
+        "232.9921.55": "https://plugins.jetbrains.com/files/8182/372556/intellij-rust-0.4.200.5420-232-beta.zip"
       },
       "name": "-deprecated-rust-beta"
     },
@@ -234,12 +234,12 @@
         "232.9559.28": "https://plugins.jetbrains.com/files/8607/370632/NixIDEA-0.4.0.10.zip",
         "232.9559.58": "https://plugins.jetbrains.com/files/8607/370632/NixIDEA-0.4.0.10.zip",
         "232.9559.61": "https://plugins.jetbrains.com/files/8607/370632/NixIDEA-0.4.0.10.zip",
-        "232.9559.64": "https://plugins.jetbrains.com/files/8607/370632/NixIDEA-0.4.0.10.zip",
         "232.9921.42": "https://plugins.jetbrains.com/files/8607/370632/NixIDEA-0.4.0.10.zip",
-        "232.9921.46": "https://plugins.jetbrains.com/files/8607/370632/NixIDEA-0.4.0.10.zip",
         "232.9921.47": "https://plugins.jetbrains.com/files/8607/370632/NixIDEA-0.4.0.10.zip",
         "232.9921.48": "https://plugins.jetbrains.com/files/8607/370632/NixIDEA-0.4.0.10.zip",
-        "232.9921.53": "https://plugins.jetbrains.com/files/8607/370632/NixIDEA-0.4.0.10.zip"
+        "232.9921.53": "https://plugins.jetbrains.com/files/8607/370632/NixIDEA-0.4.0.10.zip",
+        "232.9921.55": "https://plugins.jetbrains.com/files/8607/370632/NixIDEA-0.4.0.10.zip",
+        "232.9921.62": "https://plugins.jetbrains.com/files/8607/370632/NixIDEA-0.4.0.10.zip"
       },
       "name": "nixidea"
     },
@@ -273,12 +273,12 @@
         "232.9559.28": "https://plugins.jetbrains.com/files/10037/358813/CSVEditor-3.2.1-232.zip",
         "232.9559.58": "https://plugins.jetbrains.com/files/10037/358813/CSVEditor-3.2.1-232.zip",
         "232.9559.61": "https://plugins.jetbrains.com/files/10037/358813/CSVEditor-3.2.1-232.zip",
-        "232.9559.64": "https://plugins.jetbrains.com/files/10037/358813/CSVEditor-3.2.1-232.zip",
         "232.9921.42": "https://plugins.jetbrains.com/files/10037/358813/CSVEditor-3.2.1-232.zip",
-        "232.9921.46": "https://plugins.jetbrains.com/files/10037/358813/CSVEditor-3.2.1-232.zip",
         "232.9921.47": "https://plugins.jetbrains.com/files/10037/358813/CSVEditor-3.2.1-232.zip",
         "232.9921.48": "https://plugins.jetbrains.com/files/10037/358813/CSVEditor-3.2.1-232.zip",
-        "232.9921.53": "https://plugins.jetbrains.com/files/10037/358813/CSVEditor-3.2.1-232.zip"
+        "232.9921.53": "https://plugins.jetbrains.com/files/10037/358813/CSVEditor-3.2.1-232.zip",
+        "232.9921.55": "https://plugins.jetbrains.com/files/10037/358813/CSVEditor-3.2.1-232.zip",
+        "232.9921.62": "https://plugins.jetbrains.com/files/10037/358813/CSVEditor-3.2.1-232.zip"
       },
       "name": "csv-editor"
     },
@@ -303,12 +303,12 @@
         "232.9559.28": "https://plugins.jetbrains.com/files/12062/364117/keymap-vscode-232.8660.88.zip",
         "232.9559.58": "https://plugins.jetbrains.com/files/12062/364117/keymap-vscode-232.8660.88.zip",
         "232.9559.61": "https://plugins.jetbrains.com/files/12062/364117/keymap-vscode-232.8660.88.zip",
-        "232.9559.64": "https://plugins.jetbrains.com/files/12062/364117/keymap-vscode-232.8660.88.zip",
         "232.9921.42": "https://plugins.jetbrains.com/files/12062/364117/keymap-vscode-232.8660.88.zip",
-        "232.9921.46": "https://plugins.jetbrains.com/files/12062/364117/keymap-vscode-232.8660.88.zip",
         "232.9921.47": "https://plugins.jetbrains.com/files/12062/364117/keymap-vscode-232.8660.88.zip",
         "232.9921.48": "https://plugins.jetbrains.com/files/12062/364117/keymap-vscode-232.8660.88.zip",
-        "232.9921.53": "https://plugins.jetbrains.com/files/12062/364117/keymap-vscode-232.8660.88.zip"
+        "232.9921.53": "https://plugins.jetbrains.com/files/12062/364117/keymap-vscode-232.8660.88.zip",
+        "232.9921.55": "https://plugins.jetbrains.com/files/12062/364117/keymap-vscode-232.8660.88.zip",
+        "232.9921.62": "https://plugins.jetbrains.com/files/12062/364117/keymap-vscode-232.8660.88.zip"
       },
       "name": "vscode-keymap"
     },
@@ -333,12 +333,12 @@
         "232.9559.28": "https://plugins.jetbrains.com/files/12559/364124/keymap-eclipse-232.8660.88.zip",
         "232.9559.58": "https://plugins.jetbrains.com/files/12559/364124/keymap-eclipse-232.8660.88.zip",
         "232.9559.61": "https://plugins.jetbrains.com/files/12559/364124/keymap-eclipse-232.8660.88.zip",
-        "232.9559.64": "https://plugins.jetbrains.com/files/12559/364124/keymap-eclipse-232.8660.88.zip",
         "232.9921.42": "https://plugins.jetbrains.com/files/12559/364124/keymap-eclipse-232.8660.88.zip",
-        "232.9921.46": "https://plugins.jetbrains.com/files/12559/364124/keymap-eclipse-232.8660.88.zip",
         "232.9921.47": "https://plugins.jetbrains.com/files/12559/364124/keymap-eclipse-232.8660.88.zip",
         "232.9921.48": "https://plugins.jetbrains.com/files/12559/364124/keymap-eclipse-232.8660.88.zip",
-        "232.9921.53": "https://plugins.jetbrains.com/files/12559/364124/keymap-eclipse-232.8660.88.zip"
+        "232.9921.53": "https://plugins.jetbrains.com/files/12559/364124/keymap-eclipse-232.8660.88.zip",
+        "232.9921.55": "https://plugins.jetbrains.com/files/12559/364124/keymap-eclipse-232.8660.88.zip",
+        "232.9921.62": "https://plugins.jetbrains.com/files/12559/364124/keymap-eclipse-232.8660.88.zip"
       },
       "name": "eclipse-keymap"
     },
@@ -363,12 +363,12 @@
         "232.9559.28": "https://plugins.jetbrains.com/files/13017/364038/keymap-visualStudio-232.8660.88.zip",
         "232.9559.58": "https://plugins.jetbrains.com/files/13017/364038/keymap-visualStudio-232.8660.88.zip",
         "232.9559.61": "https://plugins.jetbrains.com/files/13017/364038/keymap-visualStudio-232.8660.88.zip",
-        "232.9559.64": "https://plugins.jetbrains.com/files/13017/364038/keymap-visualStudio-232.8660.88.zip",
         "232.9921.42": "https://plugins.jetbrains.com/files/13017/364038/keymap-visualStudio-232.8660.88.zip",
-        "232.9921.46": "https://plugins.jetbrains.com/files/13017/364038/keymap-visualStudio-232.8660.88.zip",
         "232.9921.47": "https://plugins.jetbrains.com/files/13017/364038/keymap-visualStudio-232.8660.88.zip",
         "232.9921.48": "https://plugins.jetbrains.com/files/13017/364038/keymap-visualStudio-232.8660.88.zip",
-        "232.9921.53": "https://plugins.jetbrains.com/files/13017/364038/keymap-visualStudio-232.8660.88.zip"
+        "232.9921.53": "https://plugins.jetbrains.com/files/13017/364038/keymap-visualStudio-232.8660.88.zip",
+        "232.9921.55": "https://plugins.jetbrains.com/files/13017/364038/keymap-visualStudio-232.8660.88.zip",
+        "232.9921.62": "https://plugins.jetbrains.com/files/13017/364038/keymap-visualStudio-232.8660.88.zip"
       },
       "name": "visual-studio-keymap"
     },
@@ -393,12 +393,12 @@
         "232.9559.28": "https://plugins.jetbrains.com/files/14059/82616/darcula-pitch-black.jar",
         "232.9559.58": "https://plugins.jetbrains.com/files/14059/82616/darcula-pitch-black.jar",
         "232.9559.61": "https://plugins.jetbrains.com/files/14059/82616/darcula-pitch-black.jar",
-        "232.9559.64": "https://plugins.jetbrains.com/files/14059/82616/darcula-pitch-black.jar",
         "232.9921.42": "https://plugins.jetbrains.com/files/14059/82616/darcula-pitch-black.jar",
-        "232.9921.46": "https://plugins.jetbrains.com/files/14059/82616/darcula-pitch-black.jar",
         "232.9921.47": "https://plugins.jetbrains.com/files/14059/82616/darcula-pitch-black.jar",
         "232.9921.48": "https://plugins.jetbrains.com/files/14059/82616/darcula-pitch-black.jar",
-        "232.9921.53": "https://plugins.jetbrains.com/files/14059/82616/darcula-pitch-black.jar"
+        "232.9921.53": "https://plugins.jetbrains.com/files/14059/82616/darcula-pitch-black.jar",
+        "232.9921.55": "https://plugins.jetbrains.com/files/14059/82616/darcula-pitch-black.jar",
+        "232.9921.62": "https://plugins.jetbrains.com/files/14059/82616/darcula-pitch-black.jar"
       },
       "name": "darcula-pitch-black"
     },
@@ -423,12 +423,12 @@
         "232.9559.28": "https://plugins.jetbrains.com/files/17718/391768/github-copilot-intellij-1.2.22.3129.zip",
         "232.9559.58": "https://plugins.jetbrains.com/files/17718/391768/github-copilot-intellij-1.2.22.3129.zip",
         "232.9559.61": "https://plugins.jetbrains.com/files/17718/391768/github-copilot-intellij-1.2.22.3129.zip",
-        "232.9559.64": "https://plugins.jetbrains.com/files/17718/391768/github-copilot-intellij-1.2.22.3129.zip",
         "232.9921.42": "https://plugins.jetbrains.com/files/17718/391768/github-copilot-intellij-1.2.22.3129.zip",
-        "232.9921.46": "https://plugins.jetbrains.com/files/17718/391768/github-copilot-intellij-1.2.22.3129.zip",
         "232.9921.47": "https://plugins.jetbrains.com/files/17718/391768/github-copilot-intellij-1.2.22.3129.zip",
         "232.9921.48": "https://plugins.jetbrains.com/files/17718/391768/github-copilot-intellij-1.2.22.3129.zip",
-        "232.9921.53": "https://plugins.jetbrains.com/files/17718/391768/github-copilot-intellij-1.2.22.3129.zip"
+        "232.9921.53": "https://plugins.jetbrains.com/files/17718/391768/github-copilot-intellij-1.2.22.3129.zip",
+        "232.9921.55": "https://plugins.jetbrains.com/files/17718/391768/github-copilot-intellij-1.2.22.3129.zip",
+        "232.9921.62": "https://plugins.jetbrains.com/files/17718/391768/github-copilot-intellij-1.2.22.3129.zip"
       },
       "name": "github-copilot"
     },
@@ -453,12 +453,12 @@
         "232.9559.28": "https://plugins.jetbrains.com/files/18444/165585/NetBeans6.5Keymap.zip",
         "232.9559.58": "https://plugins.jetbrains.com/files/18444/165585/NetBeans6.5Keymap.zip",
         "232.9559.61": "https://plugins.jetbrains.com/files/18444/165585/NetBeans6.5Keymap.zip",
-        "232.9559.64": "https://plugins.jetbrains.com/files/18444/165585/NetBeans6.5Keymap.zip",
         "232.9921.42": "https://plugins.jetbrains.com/files/18444/165585/NetBeans6.5Keymap.zip",
-        "232.9921.46": "https://plugins.jetbrains.com/files/18444/165585/NetBeans6.5Keymap.zip",
         "232.9921.47": "https://plugins.jetbrains.com/files/18444/165585/NetBeans6.5Keymap.zip",
         "232.9921.48": "https://plugins.jetbrains.com/files/18444/165585/NetBeans6.5Keymap.zip",
-        "232.9921.53": "https://plugins.jetbrains.com/files/18444/165585/NetBeans6.5Keymap.zip"
+        "232.9921.53": "https://plugins.jetbrains.com/files/18444/165585/NetBeans6.5Keymap.zip",
+        "232.9921.55": "https://plugins.jetbrains.com/files/18444/165585/NetBeans6.5Keymap.zip",
+        "232.9921.62": "https://plugins.jetbrains.com/files/18444/165585/NetBeans6.5Keymap.zip"
       },
       "name": "netbeans-6-5-keymap"
     }
@@ -480,11 +480,11 @@
     "https://plugins.jetbrains.com/files/631/395438/python-232.9921.47.zip": "sha256-+2ow+tbZUipK92SKp0AegcRwUL1OSQuGE4FlZPOAGSk=",
     "https://plugins.jetbrains.com/files/6954/381727/kotlin-plugin-223-1.9.10-release-459-IJ8836.35.zip": "sha256-gHkNQyWh6jtY1986aI7Qo6ZNrniPy+Yq4XLLA0pKJkA=",
     "https://plugins.jetbrains.com/files/6981/383851/ini-232.9559.64.zip": "sha256-XJoRZ3ExKHkUZljuuMjMzMCcFw0A+vOyJAwtf+soHU4=",
-    "https://plugins.jetbrains.com/files/6981/393737/ini-232.9921.36.zip": "sha256-oUb3W64ZpXep3MsbL+/DG0kVzBQYEv6LG7jghb2aUQQ=",
-    "https://plugins.jetbrains.com/files/7219/389222/Symfony_Plugin-2022.1.256.zip": "sha256-PeaqtFldh89x6wMGSM1RUR2PLSnXa7mKSojOkrFM2R8=",
+    "https://plugins.jetbrains.com/files/6981/398535/ini-232.9921.55.zip": "sha256-Jntjg8pXb2HfE8yojDcECM/Lbv4k7J2AoxQ2yD2R23s=",
+    "https://plugins.jetbrains.com/files/7219/401047/Symfony_Plugin-2022.1.257.zip": "sha256-H5ZfeMT93sGUrDh/7ba9zsW/eQz37Rl/iShY6ryNM3E=",
     "https://plugins.jetbrains.com/files/7320/346181/PHP_Annotations-9.4.0.zip": "sha256-hT5K4w4lhvNwDzDMDSvsIDGj9lyaRqglfOhlbNdqpWs=",
     "https://plugins.jetbrains.com/files/7322/381781/python-ce-232.9559.62.zip": "sha256-wyqNQO4fFU9fJVbHbde/NWtY/RVOF/71o+TgWfS7VuM=",
-    "https://plugins.jetbrains.com/files/7322/395441/python-ce-232.9921.47.zip": "sha256-2oRXtVv9ima8W6vywkDX4IeUGwfVNEo4rsqYBmmWhKc=",
+    "https://plugins.jetbrains.com/files/7322/401058/python-ce-232.9921.77.zip": "sha256-cr4LxSz8xVzC+Zm+6LnWGLbF6aGBVLW56crCIQOawhc=",
     "https://plugins.jetbrains.com/files/8182/329558/intellij-rust-0.4.194.5382-223.zip": "sha256-AgaKH4ZaxLhumk1P9BVJGpvluKnpYIulCDIRQpaWlKA=",
     "https://plugins.jetbrains.com/files/8182/372556/intellij-rust-0.4.200.5420-232-beta.zip": "sha256-ZlSfPvhPixEz5JxU9qyG0nL3jiSjr4gKaf/xYcQI1vQ=",
     "https://plugins.jetbrains.com/files/8182/395553/intellij-rust-0.4.201.5424-232.zip": "sha256-pVwBEyUCx/DJET9uIm8vxFeChE8FskWyfLjDpfg2mAE=",
diff --git a/pkgs/applications/editors/jetbrains/versions.json b/pkgs/applications/editors/jetbrains/versions.json
index b627ea85505..1a1f17c54e9 100644
--- a/pkgs/applications/editors/jetbrains/versions.json
+++ b/pkgs/applications/editors/jetbrains/versions.json
@@ -67,10 +67,10 @@
     "phpstorm": {
       "update-channel": "PhpStorm RELEASE",
       "url-template": "https://download.jetbrains.com/webide/PhpStorm-{version}.tar.gz",
-      "version": "2023.2.1",
-      "sha256": "bcb506fa27078f78da44a38f4fbab0a2000cea26385f51800c931d0cbd1b47c4",
-      "url": "https://download.jetbrains.com/webide/PhpStorm-2023.2.1.tar.gz",
-      "build_number": "232.9559.64",
+      "version": "2023.2.2",
+      "sha256": "5e3dd021b82dcad0f51bded677aa87680dcc3f5d843951c48848a9191141bf1d",
+      "url": "https://download.jetbrains.com/webide/PhpStorm-2023.2.2.tar.gz",
+      "build_number": "232.9921.55",
       "version-major-minor": "2022.3"
     },
     "pycharm-community": {
@@ -108,10 +108,10 @@
     "rust-rover": {
       "update-channel": "RustRover EAP",
       "url-template": "https://download.jetbrains.com/rustrover/RustRover-{version}.tar.gz",
-      "version": "2023.2",
-      "sha256": "5a51bcae179467e9c6440bc0c31bffd27c6fc58d593a0cbecd5aeb51508d27b6",
-      "url": "https://download.jetbrains.com/rustrover/RustRover-232.9921.46.tar.gz",
-      "build_number": "232.9921.46"
+      "version": "2023.2 EAP",
+      "sha256": "1f67e1a82f5cbb7c84382c7f251ae06b1e2699fa7d2fa4129e23ec2e43251687",
+      "url": "https://download.jetbrains.com/rustrover/RustRover-232.9921.62.tar.gz",
+      "build_number": "232.9921.62"
     },
     "webstorm": {
       "update-channel": "WebStorm RELEASE",
@@ -190,10 +190,10 @@
     "phpstorm": {
       "update-channel": "PhpStorm RELEASE",
       "url-template": "https://download.jetbrains.com/webide/PhpStorm-{version}.dmg",
-      "version": "2023.2.1",
-      "sha256": "5d238f0d3ddd59762256dc406ae2430e5abf79f9a04488722a87e54b70db68ef",
-      "url": "https://download.jetbrains.com/webide/PhpStorm-2023.2.1.dmg",
-      "build_number": "232.9559.64",
+      "version": "2023.2.2",
+      "sha256": "99a9bb313a5c141ecd1810306deaca3cf52d338edf206362b3f9d9337a27890e",
+      "url": "https://download.jetbrains.com/webide/PhpStorm-2023.2.2.dmg",
+      "build_number": "232.9921.55",
       "version-major-minor": "2022.3"
     },
     "pycharm-community": {
@@ -231,10 +231,10 @@
     "rust-rover": {
       "update-channel": "RustRover EAP",
       "url-template": "https://download.jetbrains.com/rustrover/RustRover-{version}.dmg",
-      "version": "2023.2",
-      "sha256": "4c7193acf07f44b91512d8b4c04c88068b8599e76150a81dfd728046910a0929",
-      "url": "https://download.jetbrains.com/rustrover/RustRover-232.9921.46.dmg",
-      "build_number": "232.9921.46"
+      "version": "2023.2 EAP",
+      "sha256": "dfde444bff011783cb4a5aa2aafae8ea989874c19535b01da8214df5eb3174fb",
+      "url": "https://download.jetbrains.com/rustrover/RustRover-232.9921.62.dmg",
+      "build_number": "232.9921.62"
     },
     "webstorm": {
       "update-channel": "WebStorm RELEASE",
@@ -313,10 +313,10 @@
     "phpstorm": {
       "update-channel": "PhpStorm RELEASE",
       "url-template": "https://download.jetbrains.com/webide/PhpStorm-{version}-aarch64.dmg",
-      "version": "2023.2.1",
-      "sha256": "886e79089e5e783739e71f57f8f20b9ecbc2e9e7cc9b941bb99d1444181939df",
-      "url": "https://download.jetbrains.com/webide/PhpStorm-2023.2.1-aarch64.dmg",
-      "build_number": "232.9559.64",
+      "version": "2023.2.2",
+      "sha256": "a31daeddae532324436b2d11acbd5fb657721883f17c7ef4457ac76a51bd4189",
+      "url": "https://download.jetbrains.com/webide/PhpStorm-2023.2.2-aarch64.dmg",
+      "build_number": "232.9921.55",
       "version-major-minor": "2022.3"
     },
     "pycharm-community": {
@@ -354,10 +354,10 @@
     "rust-rover": {
       "update-channel": "RustRover EAP",
       "url-template": "https://download.jetbrains.com/rustrover/RustRover-{version}-aarch64.dmg",
-      "version": "2023.2",
-      "sha256": "7f01fef11d89c6c6c870a79007607babde40f7a958b7103d1028aa760ed713b7",
-      "url": "https://download.jetbrains.com/rustrover/RustRover-232.9921.46-aarch64.dmg",
-      "build_number": "232.9921.46"
+      "version": "2023.2 EAP",
+      "sha256": "35d44a4f72c027283843aaa6409de701d14274cdc5a614c3fdc53121383f9389",
+      "url": "https://download.jetbrains.com/rustrover/RustRover-232.9921.62-aarch64.dmg",
+      "build_number": "232.9921.62"
     },
     "webstorm": {
       "update-channel": "WebStorm RELEASE",
diff --git a/pkgs/applications/misc/madonctl/default.nix b/pkgs/applications/misc/madonctl/default.nix
index df783aa36a9..0e204ea8385 100644
--- a/pkgs/applications/misc/madonctl/default.nix
+++ b/pkgs/applications/misc/madonctl/default.nix
@@ -32,6 +32,6 @@ buildGoModule rec {
     description = "CLI for the Mastodon social network API";
     homepage = "https://github.com/McKael/madonctl";
     license = licenses.mit;
-    maintainers = with maintainers; [ aaronjheng ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/applications/misc/process-compose/default.nix b/pkgs/applications/misc/process-compose/default.nix
index 0e90ad933d5..8ec268c212d 100644
--- a/pkgs/applications/misc/process-compose/default.nix
+++ b/pkgs/applications/misc/process-compose/default.nix
@@ -8,13 +8,13 @@ let config-module = "github.com/f1bonacc1/process-compose/src/config";
 in
 buildGoModule rec {
   pname = "process-compose";
-  version = "0.60.0";
+  version = "0.65.1";
 
   src = fetchFromGitHub {
     owner = "F1bonacc1";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-BsDel6F09HP5Oz2p0DDXKuS7Id5XPhZZxEzwu76vVwk=";
+    hash = "sha256-wlsZV9yE9486EBbIwVOcA4KBf9tfI0Ao1JSIPjJAcEU=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
diff --git a/pkgs/applications/networking/cluster/civo/default.nix b/pkgs/applications/networking/cluster/civo/default.nix
index ac6cea0fb2b..be63630ab71 100644
--- a/pkgs/applications/networking/cluster/civo/default.nix
+++ b/pkgs/applications/networking/cluster/civo/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "civo";
-  version = "1.0.65";
+  version = "1.0.66";
 
   src = fetchFromGitHub {
     owner  = "civo";
     repo   = "cli";
     rev    = "v${version}";
-    sha256 = "sha256-zuWKU2bZM0zdEupvWi1CV3S7urEhm4dc+sFYoQmljCk=";
+    sha256 = "sha256-17dRFRG3HpYJvqE4+SFI6a6nP6umkKc61rwQu4FiG6Q=";
   };
 
-  vendorHash = "sha256-Tym9Xu+oECUm78nIAyDwYYpR88wNxT4bmoy7iUwUQTU=";
+  vendorHash = "sha256-AvAS3S7bepaTFPelE+Bj5/UuQIXEDvSAtDuFaPRC9sk=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/applications/networking/cluster/helm-docs/default.nix b/pkgs/applications/networking/cluster/helm-docs/default.nix
index 657d428912d..cf286c8dc6f 100644
--- a/pkgs/applications/networking/cluster/helm-docs/default.nix
+++ b/pkgs/applications/networking/cluster/helm-docs/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "helm-docs";
-  version = "1.11.1";
+  version = "1.11.2";
 
   src = fetchFromGitHub {
     owner = "norwoodj";
     repo = "helm-docs";
     rev = "v${version}";
-    hash = "sha256-4o3hdqaW/AtegKStMKVerE3dRr3iZxQ+Lm2Aj3aOy98=";
+    hash = "sha256-w4QV96/02Pbs/l0lTLPYY8Ag21ZDDVPdgvuveiKUCoM=";
   };
 
   vendorHash = "sha256-6byD8FdeqdRDNUZFZ7FUUdyTuFOO8s3rb6YPGKdwLB8=";
diff --git a/pkgs/applications/networking/cluster/kubeshark/default.nix b/pkgs/applications/networking/cluster/kubeshark/default.nix
index 23f43688d5c..d958e06b7ec 100644
--- a/pkgs/applications/networking/cluster/kubeshark/default.nix
+++ b/pkgs/applications/networking/cluster/kubeshark/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "kubeshark";
-  version = "50.2";
+  version = "50.4";
 
   src = fetchFromGitHub {
     owner = "kubeshark";
     repo = "kubeshark";
     rev = version;
-    sha256 = "sha256-bABPfy790cMIfunKYfZwDbEn07fhq6g0m/yqeFgJg4Y=";
+    sha256 = "sha256-+9AnzY/vnB1OGzkKmYL0sxWS17NV+MGnHNXGOtt+BKU=";
   };
 
-  vendorHash = "sha256-rcxnvKkc9zerfULRdU5eGRRqSDQQDNMYaLJ7oEMQghk=";
+  vendorHash = "sha256-Vcn1Ky/J/3QiV6M5fLedDcpkLp5WsVcXRkOEgkKPYEQ=";
 
   ldflags = let t = "github.com/kubeshark/kubeshark"; in [
    "-s" "-w"
diff --git a/pkgs/applications/networking/drive/default.nix b/pkgs/applications/networking/drive/default.nix
index b90be9e2a55..4c7b5727fba 100644
--- a/pkgs/applications/networking/drive/default.nix
+++ b/pkgs/applications/networking/drive/default.nix
@@ -29,6 +29,6 @@ buildGoModule rec {
     homepage = "https://github.com/odeke-em/drive";
     description = "Google Drive client for the commandline";
     license = licenses.asl20;
-    maintainers = with maintainers; [ aaronjheng ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/applications/networking/gnmic/default.nix b/pkgs/applications/networking/gnmic/default.nix
index 43884541cdd..4e78f0c0fcd 100644
--- a/pkgs/applications/networking/gnmic/default.nix
+++ b/pkgs/applications/networking/gnmic/default.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "gnmic";
-  version = "0.31.7";
+  version = "0.32.0";
 
   src = fetchFromGitHub {
     owner = "openconfig";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-bX8oZk0psPqoXFU8b2JQmfFaPz18yiuSVXDmhoOnpFg=";
+    hash = "sha256-aEAbIh1BH8R05SpSMSXL2IrudjIki72k7NGvjjKkxZw=";
   };
 
   vendorHash = "sha256-hIG3kG2e9Y2hnHJ+96cPLgnlp5ParsLgWQY0HZTDggY=";
diff --git a/pkgs/applications/office/fava/default.nix b/pkgs/applications/office/fava/default.nix
index a9827abf206..b7e2105a94e 100644
--- a/pkgs/applications/office/fava/default.nix
+++ b/pkgs/applications/office/fava/default.nix
@@ -2,12 +2,12 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "fava";
-  version = "1.26";
+  version = "1.26.1";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-YSxUqwmv7LQqnT9U1dau9pYaKvEEG5Tbi7orylJKkp0=";
+    hash = "sha256-pj4kaQDXahjhN7bu7xxT/ZuoCfPdGyo898482S5gnlE=";
   };
 
   nativeBuildInputs = with python3.pkgs; [ setuptools-scm ];
diff --git a/pkgs/applications/window-managers/hyprwm/hyprland/default.nix b/pkgs/applications/window-managers/hyprwm/hyprland/default.nix
index 9ee45ba883c..14a38ec9eff 100644
--- a/pkgs/applications/window-managers/hyprwm/hyprland/default.nix
+++ b/pkgs/applications/window-managers/hyprwm/hyprland/default.nix
@@ -40,13 +40,13 @@ assert lib.assertMsg (!nvidiaPatches) "The option `nvidiaPatches` has been renam
 assert lib.assertMsg (!hidpiXWayland) "The option `hidpiXWayland` has been removed. Please refer https://wiki.hyprland.org/Configuring/XWayland";
 stdenv.mkDerivation (finalAttrs: {
   pname = "hyprland" + lib.optionalString debug "-debug";
-  version = "0.29.1";
+  version = "0.30.0";
 
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = finalAttrs.pname;
     rev = "v${finalAttrs.version}";
-    hash = "sha256-j9ypIwZkotNZMyk8R/W002OzDHd0C0OHSKE7uOFpf2k=";
+    hash = "sha256-a0nqm82brOC0QroGOXxcIKxOMAfl9I6pfFOYjCeRzO0=";
   };
 
   patches = [
diff --git a/pkgs/applications/window-managers/hyprwm/hyprland/wlroots.nix b/pkgs/applications/window-managers/hyprwm/hyprland/wlroots.nix
index b5651749c41..4188a13c34d 100644
--- a/pkgs/applications/window-managers/hyprwm/hyprland/wlroots.nix
+++ b/pkgs/applications/window-managers/hyprwm/hyprland/wlroots.nix
@@ -42,8 +42,8 @@ wlroots.overrideAttrs
       domain = "gitlab.freedesktop.org";
       owner = "wlroots";
       repo = "wlroots";
-      rev = "717ded9bb0191ea31bf4368be32e7a15fe1b8294";
-      hash = "sha256-eBKkG7tMxg92NskEn8dHRFY245JwjirWRoOZzW6DnUw=";
+      rev = "98a745d926d8048bc30aef11b421df207a01c279";
+      hash = "sha256-LEIUGXvKR5DYFQUTavC3yifcObvG4XZUUHfxXmu8nEM=";
     };
 
     pname =
diff --git a/pkgs/applications/window-managers/hyprwm/xdg-desktop-portal-hyprland/default.nix b/pkgs/applications/window-managers/hyprwm/xdg-desktop-portal-hyprland/default.nix
index dd0882edc29..37c4bb03002 100644
--- a/pkgs/applications/window-managers/hyprwm/xdg-desktop-portal-hyprland/default.nix
+++ b/pkgs/applications/window-managers/hyprwm/xdg-desktop-portal-hyprland/default.nix
@@ -21,15 +21,15 @@
 , hyprland
 , slurp
 }:
-stdenv.mkDerivation {
+stdenv.mkDerivation (self: {
   pname = "xdg-desktop-portal-hyprland";
-  version = "unstable-2023-09-10";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = "xdg-desktop-portal-hyprland";
-    rev = "aca51609d4c415b30e88b96c6f49f0142cbcdae7";
-    hash = "sha256-RF6LXm4J6mBF3B8VcQuABuU4g4tCPHgMYJQSoJ3DW+8=";
+    rev = "v${self.version}";
+    hash = "sha256-K1cqx+NP4lxPwRVPLEeSUfagaMI3m5hdYvQe7sZr7BU=";
   };
 
   nativeBuildInputs = [
@@ -73,4 +73,4 @@ stdenv.mkDerivation {
     maintainers = with maintainers; [ fufexan ];
     platforms = platforms.linux;
   };
-}
+})
diff --git a/pkgs/by-name/ba/badger/package.nix b/pkgs/by-name/ba/badger/package.nix
new file mode 100644
index 00000000000..4c41b8f8849
--- /dev/null
+++ b/pkgs/by-name/ba/badger/package.nix
@@ -0,0 +1,30 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
+
+buildGoModule rec {
+  pname = "badger";
+  version = "4.2.0";
+
+  src = fetchFromGitHub {
+    owner = "dgraph-io";
+    repo = "badger";
+    rev = "v${version}";
+    hash = "sha256-+b+VTGUGmqixB51f1U2QK+XfVra4zXybW19n/CeeoAQ=";
+  };
+
+  vendorHash = "sha256-YiSmxtRt8HtYcvPL9ZKMjb2ch/MZBjZp5pIIBdqQ7Nw=";
+
+  subPackages = [ "badger" ];
+
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Fast key-value DB in Go";
+    homepage = "https://github.com/dgraph-io/badger";
+    license = licenses.asl20;
+    mainProgram = "badger";
+    maintainers = with maintainers; [ farcaller ];
+  };
+}
diff --git a/pkgs/by-name/le/lemminx/package.nix b/pkgs/by-name/le/lemminx/package.nix
new file mode 100644
index 00000000000..fe078ba84ac
--- /dev/null
+++ b/pkgs/by-name/le/lemminx/package.nix
@@ -0,0 +1,104 @@
+{ lib
+, fetchFromGitHub
+, makeWrapper
+, jre
+, maven
+, writeScript
+, lemminx
+}:
+
+maven.buildMavenPackage rec {
+  pname = "lemminx";
+  version = "0.27.0";
+
+  src = fetchFromGitHub {
+    owner = "eclipse";
+    repo = "lemminx";
+    rev = version;
+    hash = "sha256-VWYTkYlPziNRyxHdvIWVuDlABpKdzhC/F6BUBj/opks=";
+    # Lemminx reads this git information at runtime from a git.properties
+    # file on the classpath
+    leaveDotGit = true;
+    postFetch = ''
+      cat > $out/org.eclipse.lemminx/src/main/resources/git.properties << EOF
+      git.build.version=${version}
+      git.commit.id.abbrev=$(git -C $out rev-parse --short HEAD)
+      git.commit.message.short=$(git -C $out log -1 --pretty=format:%s)
+      git.branch=main
+      EOF
+      rm -rf $out/.git
+    '';
+  };
+
+  manualMvnArtifacts = [
+    "org.apache.maven.surefire:surefire-junit-platform:3.1.2"
+    "org.junit.platform:junit-platform-launcher:1.10.0"
+  ];
+
+  mvnHash = "sha256-sIiCp1AorVQXt13Tq0vw9jGioG3zcQMqqKS/Q0Tf4MQ=";
+
+  buildOffline = true;
+
+  # disable gitcommitid plugin which needs a .git folder which we
+  # don't have
+  mvnDepsParameters = "-Dmaven.gitcommitid.skip=true";
+
+  # disable failing tests which either need internet access or are flaky
+  mvnParameters = lib.escapeShellArgs [
+    "-Dmaven.gitcommitid.skip=true"
+    "-Dtest=!XMLValidationCommandTest,
+    !XMLValidationExternalResourcesBasedOnDTDTest,
+    !XMLSchemaPublishDiagnosticsTest,
+    !PlatformTest,
+    !XMLValidationExternalResourcesBasedOnXSDTest,
+    !XMLExternalTest,
+    !XMLSchemaCompletionExtensionsTest,
+    !XMLSchemaDiagnosticsTest,
+    !MissingChildElementCodeActionTest,
+    !XSDValidationExternalResourcesTest,
+    !DocumentLifecycleParticipantTest"
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin $out/share
+    install -Dm644 org.eclipse.lemminx/target/org.eclipse.lemminx-uber.jar \
+      $out/share
+
+    makeWrapper ${jre}/bin/java $out/bin/lemminx \
+      --add-flags "-jar $out/share/org.eclipse.lemminx-uber.jar"
+
+    runHook postInstall
+  '';
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  passthru.updateScript = writeScript "update-lemminx" ''
+    #!/usr/bin/env nix-shell
+    #!nix-shell -i bash -p curl pcre common-updater-scripts jq gnused
+    set -eu -o pipefail
+
+    LATEST_TAG=$(curl https://api.github.com/repos/eclipse/lemminx/tags | \
+      jq -r '[.[] | select(.name | test("^[0-9]"))] | sort_by(.name | split(".") |
+      map(tonumber)) | reverse | .[0].name')
+    update-source-version lemminx "$LATEST_TAG"
+    sed -i '0,/mvnHash *= *"[^"]*"/{s/mvnHash = "[^"]*"/mvnHash = ""/}' ${lemminx}
+
+    echo -e "\nFetching all mvn dependencies to calculate the mvnHash. This may take a while ..."
+    nix-build -A lemminx.fetchedMavenDeps 2> lemminx-stderr.log || true
+
+    NEW_MVN_HASH=$(cat lemminx-stderr.log | grep "got:" | awk '{print ''$2}')
+    rm lemminx-stderr.log
+    # escaping double quotes looks ugly but is needed for variable substitution
+    # use # instead of / as separator because the sha256 might contain the / character
+    sed -i "0,/mvnHash *= *\"[^\"]*\"/{s#mvnHash = \"[^\"]*\"#mvnHash = \"$NEW_MVN_HASH\"#}" ${lemminx}
+  '';
+
+  meta = with lib; {
+    description = "XML Language Server";
+    homepage = "https://github.com/eclipse/lemminx";
+    license = licenses.epl20;
+    maintainers = with maintainers; [ tricktron ];
+  };
+}
diff --git a/pkgs/by-name/lu/luastatus/package.nix b/pkgs/by-name/lu/luastatus/package.nix
new file mode 100644
index 00000000000..5bac2809ccf
--- /dev/null
+++ b/pkgs/by-name/lu/luastatus/package.nix
@@ -0,0 +1,88 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+# Native Build Inputs
+, cmake
+, pkg-config
+, makeWrapper
+# Dependencies
+, yajl
+, alsa-lib
+, libpulseaudio
+, glib
+, libnl
+, udev
+, libXau
+, libXdmcp
+, pcre2
+, pcre
+, util-linux
+, libselinux
+, libsepol
+, lua5
+, docutils
+, libxcb
+, libX11
+, xcbutil
+, xcbutilwm
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "luastatus";
+  version = "0.6.0";
+
+  src = fetchFromGitHub {
+    owner = "shdown";
+    repo = "luastatus";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-whO5pjUPaCwEb2GDCIPnTk39MejSQOoRRQ5kdYEQ0Pc=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    makeWrapper
+  ];
+
+  buildInputs = [
+    libxcb
+    libX11
+    xcbutil
+    xcbutilwm
+    libXdmcp
+    libXau
+    libpulseaudio
+    libnl
+    libselinux
+    libsepol
+    yajl
+    alsa-lib
+    glib
+    udev
+    pcre2
+    pcre
+    util-linux
+    lua5
+    docutils
+  ];
+
+  postInstall = ''
+    wrapProgram $out/bin/luastatus-stdout-wrapper \
+      --prefix LUASTATUS : $out/bin/luastatus
+
+    wrapProgram $out/bin/luastatus-i3-wrapper \
+      --prefix LUASTATUS : $out/bin/luastatus
+
+    wrapProgram $out/bin/luastatus-lemonbar-launcher \
+      --prefix LUASTATUS : $out/bin/luastatus
+  '';
+
+  meta = with lib; {
+    description = "Universal status bar content generator";
+    homepage = "https://github.com/shdown/luastatus";
+    changelog = "https://github.com/shdown/luastatus/releases/tag/${finalAttrs.version}";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ kashw2 ];
+    platforms = platforms.linux;
+  };
+})
diff --git a/pkgs/data/misc/ddccontrol-db/default.nix b/pkgs/data/misc/ddccontrol-db/default.nix
index efb3f021ec5..52e6c59285a 100644
--- a/pkgs/data/misc/ddccontrol-db/default.nix
+++ b/pkgs/data/misc/ddccontrol-db/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ddccontrol-db";
-  version = "20230821";
+  version = "20230911";
 
   src = fetchFromGitHub {
     owner = "ddccontrol";
     repo = pname;
     rev = version;
-    sha256 = "sha256-R+DXpT9Tgt311G/OtmKp3sqN0ex/rlLt3JuSK7kciC0=";
+    sha256 = "sha256-3lGzQ95ZS9yr9dX+wCTmX6Q+IsbMCfBa4zhcyxsG4+w=";
   };
 
   nativeBuildInputs = [ autoreconfHook intltool ];
diff --git a/pkgs/development/compilers/circt/default.nix b/pkgs/development/compilers/circt/default.nix
index c6f787078b6..f8eaae9a040 100644
--- a/pkgs/development/compilers/circt/default.nix
+++ b/pkgs/development/compilers/circt/default.nix
@@ -14,12 +14,12 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "circt";
-  version = "1.54.0";
+  version = "1.56.1";
   src = fetchFromGitHub {
     owner = "llvm";
     repo = "circt";
     rev = "firtool-${version}";
-    sha256 = "sha256-jHDQl6UJTyNGZ4PUTEiZCIN/RSRbBxlaVutkwrWbK9M=";
+    sha256 = "sha256-MOwjfSUd5Dvlvek763AMZWK29dUoc2fblb5qtByTqLA=";
     fetchSubmodules = true;
   };
 
@@ -78,7 +78,7 @@ stdenv.mkDerivation rec {
     description = "Circuit IR compilers and tools";
     homepage = "https://circt.org/";
     license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ sharzy ];
+    maintainers = with lib.maintainers; [ sharzy pineapplehunter ];
     platforms = lib.platforms.all;
   };
 }
diff --git a/pkgs/development/compilers/ghdl/default.nix b/pkgs/development/compilers/ghdl/default.nix
index 0e11c703d7b..e00294cf184 100644
--- a/pkgs/development/compilers/ghdl/default.nix
+++ b/pkgs/development/compilers/ghdl/default.nix
@@ -11,26 +11,17 @@
 
 assert backend == "mcode" || backend == "llvm";
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "ghdl-${backend}";
-  version = "2.0.0";
+  version = "3.0.0";
 
   src = fetchFromGitHub {
     owner  = "ghdl";
     repo   = "ghdl";
-    rev    = "v${version}";
-    sha256 = "sha256-B/G3FGRzYy4Y9VNNB8yM3FohiIjPJhYSVbqsTN3cL5k=";
+    rev    = "v${finalAttrs.version}";
+    hash   = "sha256-94RNtHbOpbC2q/Z+PsQplrLxXmpS3LXOCXyTBB+n9c4=";
   };
 
-  patches = [
-    # https://github.com/ghdl/ghdl/issues/2056
-    (fetchpatch {
-      name = "fix-build-gcc-12.patch";
-      url = "https://github.com/ghdl/ghdl/commit/f8b87697e8b893b6293ebbfc34670c32bfb49397.patch";
-      hash = "sha256-tVbMm8veFkNPs6WFBHvaic5Jkp1niyg0LfFufa+hT/E=";
-    })
-  ];
-
   LIBRARY_PATH = "${stdenv.cc.libc}/lib";
 
   nativeBuildInputs = [
@@ -59,8 +50,6 @@ stdenv.mkDerivation rec {
     "--with-llvm-config=${llvm.dev}/bin/llvm-config"
   ];
 
-  hardeningDisable = [ "format" ];
-
   enableParallelBuilding = true;
 
   passthru = {
@@ -72,11 +61,12 @@ stdenv.mkDerivation rec {
     };
   };
 
-  meta = with lib; {
+  meta = {
     homepage = "https://github.com/ghdl/ghdl";
     description = "VHDL 2008/93/87 simulator";
-    maintainers = with maintainers; [ lucus16 thoughtpolice ];
-    platforms = platforms.linux;
-    license = licenses.gpl2;
+    license = lib.licenses.gpl2Plus;
+    mainProgram = "ghdl";
+    maintainers = with lib.maintainers; [ eclairevoyant lucus16 thoughtpolice ];
+    platforms = lib.platforms.linux;
   };
-}
+})
diff --git a/pkgs/development/libraries/faudio/default.nix b/pkgs/development/libraries/faudio/default.nix
index af07f5854cc..7f95b999549 100644
--- a/pkgs/development/libraries/faudio/default.nix
+++ b/pkgs/development/libraries/faudio/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "faudio";
-  version = "23.08";
+  version = "23.09";
 
   src = fetchFromGitHub {
     owner = "FNA-XNA";
     repo = "FAudio";
     rev = version;
-    sha256 = "sha256-ceFnk0JQtolx7Q1FnADCO0z6fCxu1RzmN3sHohy4hzU=";
+    sha256 = "sha256-Sl+dOM1YMDwCN07ThR/JFwhNS10P7+uQJNUQAvFdYa8=";
   };
 
   nativeBuildInputs = [cmake];
diff --git a/pkgs/development/libraries/intel-gmmlib/default.nix b/pkgs/development/libraries/intel-gmmlib/default.nix
index 7faeb324ad5..331198e975e 100644
--- a/pkgs/development/libraries/intel-gmmlib/default.nix
+++ b/pkgs/development/libraries/intel-gmmlib/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , cmake
 # for passthru.tests
 , intel-compute-runtime
@@ -10,24 +9,15 @@
 
 stdenv.mkDerivation rec {
   pname = "intel-gmmlib";
-  version = "22.3.7";
+  version = "22.3.11";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "gmmlib";
     rev = "intel-gmmlib-${version}";
-    sha256 = "sha256-/iwTPWRVTZk1dhZD2Grcnc76ItgXjf2VrFD+93h8YvM=";
+    sha256 = "sha256-pweKUf/KW64neJkEZwjePh7ft8KEBu1I9zCIx/lMQT8=";
   };
 
-  patches = [
-    # fix build on i686
-    # https://github.com/intel/gmmlib/pull/104
-    (fetchpatch {
-      url = "https://github.com/intel/gmmlib/commit/2526286f29d8ad3d3a5833bdc29e23e5f3300b34.patch";
-      hash = "sha256-mChK6wprAt+bo39g6LTNy25kJeGoKabpXFq2gSDhaPw=";
-    })
-  ];
-
   nativeBuildInputs = [ cmake ];
 
   passthru.tests = {
diff --git a/pkgs/development/python-modules/anywidget/default.nix b/pkgs/development/python-modules/anywidget/default.nix
index f96ef47e733..b4c29745e55 100644
--- a/pkgs/development/python-modules/anywidget/default.nix
+++ b/pkgs/development/python-modules/anywidget/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "anywidget";
-  version = "0.6.3";
+  version = "0.6.5";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-OUKxmYceEKURJeQTVI7oLT4SdZM90V7BoZf0UykkEV4=";
+    hash = "sha256-prriSqvy2S9URnXfTEY88lssU71/cV38egSIqnLHE+Q=";
   };
 
   # We do not need the jupyterlab build dependency, because we do not need to
diff --git a/pkgs/development/python-modules/automx2/default.nix b/pkgs/development/python-modules/automx2/default.nix
new file mode 100644
index 00000000000..cfc3a8484b6
--- /dev/null
+++ b/pkgs/development/python-modules/automx2/default.nix
@@ -0,0 +1,46 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, flask
+, flask-migrate
+, ldap3
+, pytestCheckHook
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "automx2";
+  version = "unstable-2023-08-23";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "rseichter";
+    repo = pname;
+    rev = "f3e3fc8e769c3799361001d51b7d9335a6a9d1a8";
+    hash = "sha256-NkeazjjGDYUXfoydvEfww6e7SkSZ8rMRlML+oOaf374=";
+  };
+
+  propagatedBuildInputs = [
+    flask
+    flask-migrate
+    ldap3
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "automx2"
+  ];
+
+  meta = with lib; {
+    description = "Email client configuration made easy";
+    homepage = "https://rseichter.github.io/automx2/";
+    changelog = "https://github.com/rseichter/automx2/blob/${version}/CHANGELOG";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ twey ];
+  };
+}
diff --git a/pkgs/development/python-modules/frozendict/default.nix b/pkgs/development/python-modules/frozendict/default.nix
index f262710119c..3ed26a476b6 100644
--- a/pkgs/development/python-modules/frozendict/default.nix
+++ b/pkgs/development/python-modules/frozendict/default.nix
@@ -20,12 +20,6 @@ buildPythonPackage rec {
     hash = "sha256-4a0DvZOzNJqpop7wi+FagUR+8oaekz4EDNIYdUaAWC8=";
   };
 
-  postPatch = ''
-    # https://github.com/Marco-Sulla/python-frozendict/pull/69
-    substituteInPlace setup.py \
-      --replace 'if impl == "PyPy":' 'if impl == "PyPy" or not src_path.exists():'
-  '';
-
   nativeCheckInputs = [
     pytestCheckHook
   ];
@@ -48,6 +42,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/Marco-Sulla/python-frozendict";
     changelog = "https://github.com/Marco-Sulla/python-frozendict/releases/tag/v${version}";
     license = licenses.lgpl3Only;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ pbsds ];
   };
 }
diff --git a/pkgs/development/python-modules/heudiconv/default.nix b/pkgs/development/python-modules/heudiconv/default.nix
index 514d4e2477b..3cdf1463cd5 100644
--- a/pkgs/development/python-modules/heudiconv/default.nix
+++ b/pkgs/development/python-modules/heudiconv/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage rec {
   pname = "heudiconv";
-  version = "0.13.1";
+  version = "1.0.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-UUBRC6RToj4XVbJnxG+EKdue4NVpTAW31RNm9ieF1lU=";
+    hash = "sha256-cW6G2NtPZiyqqJ3w9a3Y/6blEaXtR9eGG5epPknimsw=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/paddleocr/default.nix b/pkgs/development/python-modules/paddleocr/default.nix
index 9bd81077abf..c75d6e87e07 100644
--- a/pkgs/development/python-modules/paddleocr/default.nix
+++ b/pkgs/development/python-modules/paddleocr/default.nix
@@ -28,7 +28,7 @@
 }:
 
 let
-  version = "2.7.0.1";
+  version = "2.7.0";
 in
 buildPythonPackage {
   pname = "paddleocr";
@@ -38,8 +38,8 @@ buildPythonPackage {
   src = fetchFromGitHub {
     owner = "PaddlePaddle";
     repo = "PaddleOCR";
-    rev = "254786752a2659e184822b4b2de5637a05236590";
-    hash = "sha256-M/Fpk9swX9Gds7o5poM9Iv6LOhKoZNbe0Wv9JNMPOU0=";
+    rev = "v${version}";
+    hash = "sha256-r7Y666KpY855NCSinCBBUz9PXHfZ56+oZW1/0ISpWe4=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/posthog/default.nix b/pkgs/development/python-modules/posthog/default.nix
index d6136cf7172..0f20800ece0 100644
--- a/pkgs/development/python-modules/posthog/default.nix
+++ b/pkgs/development/python-modules/posthog/default.nix
@@ -14,7 +14,7 @@
 }:
 let
   pname = "posthog";
-  version = "3.0.1";
+  version = "3.0.2";
 in
 buildPythonPackage {
   inherit pname version;
@@ -24,7 +24,7 @@ buildPythonPackage {
     owner = "PostHog";
     repo = "posthog-python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-GSHsa05DUcbIHg1HCoIn8d4NZoG+Iddqfgod2nP4fX0=";
+    hash = "sha256-QASqjphAWtYuIyhbFTYwv1gD+rXvrmp5W0Te4MFn1AA=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/streamlit/default.nix b/pkgs/development/python-modules/streamlit/default.nix
index 95a11c70592..58a10bdb148 100755
--- a/pkgs/development/python-modules/streamlit/default.nix
+++ b/pkgs/development/python-modules/streamlit/default.nix
@@ -12,7 +12,7 @@
 , packaging
 , pandas
 , pillow
-, protobuf3
+, protobuf
 , pyarrow
 , pydeck
 , pympler
@@ -60,7 +60,7 @@ buildPythonPackage rec {
     packaging
     pandas
     pillow
-    protobuf3
+    protobuf
     pyarrow
     pydeck
     pympler
diff --git a/pkgs/development/python-modules/types-redis/default.nix b/pkgs/development/python-modules/types-redis/default.nix
index 92ffba08b68..1b59386174e 100644
--- a/pkgs/development/python-modules/types-redis/default.nix
+++ b/pkgs/development/python-modules/types-redis/default.nix
@@ -7,12 +7,12 @@
 
 buildPythonPackage rec {
   pname = "types-redis";
-  version = "4.6.0.6";
+  version = "4.6.0.7";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-eGWoQ4ApN6st3KM1ecTiVb/nP4evhYJOrXpnKbqS/FI=";
+    hash = "sha256-KMQVPdtcnU8Q3vRKJFRnPDYdLV/DzYZ887sVIPP1mjg=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/userpath/default.nix b/pkgs/development/python-modules/userpath/default.nix
index edf92f57116..5f4a31d39b1 100644
--- a/pkgs/development/python-modules/userpath/default.nix
+++ b/pkgs/development/python-modules/userpath/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "userpath";
-  version = "1.9.0";
+  version = "1.9.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-heMnRUMXRHfGLVcB7UOj7xBRgkqd13aWitxBHlhkDdE=";
+    hash = "sha256-zoF2co2YyRS2QBeBvzsj/M2WjRZHU5yHiMcBA3XgJ5Y=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/amqpcat/default.nix b/pkgs/development/tools/amqpcat/default.nix
index a7c30cc9e4b..774af838b63 100644
--- a/pkgs/development/tools/amqpcat/default.nix
+++ b/pkgs/development/tools/amqpcat/default.nix
@@ -1,14 +1,14 @@
-{ stdenv, lib, fetchFromGitHub, crystal, openssl, testers, amqpcat }:
+{ lib, fetchFromGitHub, crystal, openssl, testers, amqpcat }:
 
 crystal.buildCrystalPackage rec {
   pname = "amqpcat";
-  version = "0.2.4";
+  version = "0.2.5";
 
   src = fetchFromGitHub {
     owner = "cloudamqp";
     repo = "amqpcat";
     rev = "v${version}";
-    hash = "sha256-Ec8LlOYYp3fXYgvps/ikeB4MqBEXTw1BAF5nJyL7dI0=";
+    hash = "sha256-AXX4aF5717lSIO0/2jNDPXXLtM/h//BlxO+cX71aWG4=";
   };
 
   format = "shards";
@@ -28,6 +28,5 @@ crystal.buildCrystalPackage rec {
     homepage = "https://github.com/cloudamqp/amqpcat";
     license = licenses.mit;
     maintainers = with maintainers; [ aaronjheng ];
-    broken = stdenv.isDarwin; # Linking errors. Hope someone can help fix it.
   };
 }
diff --git a/pkgs/development/tools/amqpcat/shards.nix b/pkgs/development/tools/amqpcat/shards.nix
index 3321c4c9e17..4cfa4933f11 100644
--- a/pkgs/development/tools/amqpcat/shards.nix
+++ b/pkgs/development/tools/amqpcat/shards.nix
@@ -1,12 +1,12 @@
 {
   amq-protocol = {
     url = "https://github.com/cloudamqp/amq-protocol.cr.git";
-    rev = "v0.3.24";
-    sha256 = "011xia60wkmbjsk8j4qnswx0lg1i7vrchjwnxlksjv3npp2z98a3";
+    rev = "v1.1.4";
+    sha256 = "1x10zh371wmwi55rpdymfhf7hbh900zc94b64hkk12pp20mws55r";
   };
   amqp-client = {
     url = "https://github.com/cloudamqp/amqp-client.cr.git";
-    rev = "v0.6.2";
-    sha256 = "0h9c2v7ks776msm3dn2d68y85i6mm4gm5s3jlrs8dlp36kndkplc";
+    rev = "v1.0.11";
+    sha256 = "0d08k9jjd9jw40slj71wi9p6773d1djva9zjb40pskcgg2wfirx3";
   };
 }
diff --git a/pkgs/development/tools/analysis/flow/default.nix b/pkgs/development/tools/analysis/flow/default.nix
index f59a7e9ab7d..8aa6e7e0744 100644
--- a/pkgs/development/tools/analysis/flow/default.nix
+++ b/pkgs/development/tools/analysis/flow/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "flow";
-  version = "0.216.1";
+  version = "0.217.0";
 
   src = fetchFromGitHub {
     owner = "facebook";
     repo = "flow";
     rev = "v${version}";
-    sha256 = "sha256-Nx6BAeaJGbrfjmH5dSb8Cb1TG2SDeF+lCeGOLW27cJs=";
+    sha256 = "sha256-QMgxic8fx7/Beahu8xyE247syLWgq1LZb3I5UdZp2XM=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/tools/continuous-integration/cirrus-cli/default.nix b/pkgs/development/tools/continuous-integration/cirrus-cli/default.nix
index 7c2a9302297..9defb319111 100644
--- a/pkgs/development/tools/continuous-integration/cirrus-cli/default.nix
+++ b/pkgs/development/tools/continuous-integration/cirrus-cli/default.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "cirrus-cli";
-  version = "0.103.1";
+  version = "0.104.0";
 
   src = fetchFromGitHub {
     owner = "cirruslabs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-K8uhI/lX0xCvCLKv4mpahZm0ukTInzMjFBnPumRp2gc=";
+    sha256 = "sha256-3X/VZirKSYD+y//e8Ft8f0D27vJWekdyUTmVvOgc5bQ=";
   };
 
   vendorHash = "sha256-0otC2+f0PMBZ+0Xiyq4kBd2YCJjAvDhThB3W9gIjHOY=";
diff --git a/pkgs/development/tools/database/atlas/default.nix b/pkgs/development/tools/database/atlas/default.nix
index ee5d4f89d63..337f0393dca 100644
--- a/pkgs/development/tools/database/atlas/default.nix
+++ b/pkgs/development/tools/database/atlas/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "atlas";
-  version = "0.14.0";
+  version = "0.14.1";
 
   src = fetchFromGitHub {
     owner = "ariga";
     repo = "atlas";
     rev = "v${version}";
-    hash = "sha256-6Y6b8BBfCErbKJqhR7zhltbysibUlY7KAyZe7g5mRxQ=";
+    hash = "sha256-dOqL/9sJUbaHqF3N5PEL7f6LxQQWNL0FvaH5BxQp4Xg=";
   };
 
   modRoot = "cmd/atlas";
diff --git a/pkgs/development/tools/database/dbmate/default.nix b/pkgs/development/tools/database/dbmate/default.nix
index d7eecde5e16..bad6a1644b9 100644
--- a/pkgs/development/tools/database/dbmate/default.nix
+++ b/pkgs/development/tools/database/dbmate/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "dbmate";
-  version = "2.5.0";
+  version = "2.6.0";
 
   src = fetchFromGitHub {
     owner = "amacneil";
     repo = "dbmate";
     rev = "refs/tags/v${version}";
-    hash = "sha256-s3J5Mf+eCChIGmm89nq1heoJKscCA9nINGAGe0/qxaI=";
+    hash = "sha256-5dYWCcCQymwzWGY67lds5QQzHHkKt3OGkvqXDLwt/q8=";
   };
 
-  vendorHash = "sha256-ohSwDFisNXnq+mqGD2v4X58lumHvpyTyJxME418GSMY=";
+  vendorHash = "sha256-1sfIwawsWefh+nj4auqRjU4dWuDbgpvhAc8cF8DhICg=";
 
   doCheck = false;
 
diff --git a/pkgs/development/tools/doctl/default.nix b/pkgs/development/tools/doctl/default.nix
index d3f80124bd6..31e6a3e71d5 100644
--- a/pkgs/development/tools/doctl/default.nix
+++ b/pkgs/development/tools/doctl/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "doctl";
-  version = "1.98.0";
+  version = "1.99.0";
 
   vendorHash = null;
 
@@ -31,7 +31,7 @@ buildGoModule rec {
     owner = "digitalocean";
     repo = "doctl";
     rev = "v${version}";
-    sha256 = "sha256-M9kSQoYcJudL/y/Yc6enVT/rJusd+oe3BdjkaLRQ0gU=";
+    sha256 = "sha256-xwkbekTnwisgr1gkUewMkz0E5iQg6bWgVz8tne7ME9Y=";
   };
 
   meta = with lib; {
diff --git a/pkgs/development/tools/gauge/default.nix b/pkgs/development/tools/gauge/default.nix
index d752151b356..2884ee13ee4 100644
--- a/pkgs/development/tools/gauge/default.nix
+++ b/pkgs/development/tools/gauge/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "gauge";
-  version = "1.5.2";
+  version = "1.5.4";
 
   src = fetchFromGitHub {
     owner = "getgauge";
     repo = "gauge";
     rev = "v${version}";
-    hash = "sha256-gdqb9atksAU2bjNdoOfxb3XYl3H/1F51Xnfnm78J3CQ=";
+    hash = "sha256-BJyc8umtJUsZgj4jdoYf6PSaDg41mnrZNd6rAdewWro=";
   };
 
-  vendorHash = "sha256-PmidtbtX+x5cxuop+OCrfdPP5EiJnyvFyxHveGVGAEo=";
+  vendorHash = "sha256-K0LoAJzYzQorKp3o1oH5qruMBbJiCQrduBgoZ0naaLc=";
 
   excludedPackages = [ "build" "man" ];
 
diff --git a/pkgs/development/tools/gdlv/default.nix b/pkgs/development/tools/gdlv/default.nix
index 7dfa53901c4..0992dc90b68 100644
--- a/pkgs/development/tools/gdlv/default.nix
+++ b/pkgs/development/tools/gdlv/default.nix
@@ -2,25 +2,32 @@
 , stdenv
 , buildGoModule
 , fetchFromGitHub
-, OpenGL
+, Foundation
+, CoreGraphics
+, Metal
 , AppKit
 }:
 
 buildGoModule rec {
   pname = "gdlv";
-  version = "1.8.0";
+  version = "1.10.0";
 
   src = fetchFromGitHub {
     owner = "aarzilli";
     repo = "gdlv";
     rev = "v${version}";
-    sha256 = "sha256-G1/Wbz836yfGZ/1ArICrNbWU6eh4SHXDmo4FKkjUszY=";
+    hash = "sha256-OPsQOFwV6jIX4ZOVwJmpTeQUr/zkfkqCr86HmPhYarI=";
   };
 
+  preBuild = lib.optionalString (stdenv.isDarwin && lib.versionOlder stdenv.hostPlatform.darwinMinVersion "11.0") ''
+    export MACOSX_DEPLOYMENT_TARGET=10.15
+  '';
+
   vendorHash = null;
+
   subPackages = ".";
 
-  buildInputs = lib.optionals stdenv.isDarwin [ OpenGL AppKit ];
+  buildInputs = lib.optionals stdenv.isDarwin [ Foundation CoreGraphics Metal AppKit ];
 
   meta = with lib; {
     description = "GUI frontend for Delve";
diff --git a/pkgs/development/tools/language-servers/ccls/default.nix b/pkgs/development/tools/language-servers/ccls/default.nix
index a401fc47eac..6afbc1d4d9a 100644
--- a/pkgs/development/tools/language-servers/ccls/default.nix
+++ b/pkgs/development/tools/language-servers/ccls/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ccls";
-  version = "0.20220729";
+  version = "0.20230717";
 
   src = fetchFromGitHub {
     owner = "MaskRay";
     repo = "ccls";
     rev = version;
-    sha256 = "sha256-eSWgk6KdEyjDLPc27CsOCXDU7AKMoXNyzoA6dSwZ5TI=";
+    sha256 = "sha256-u499fHd2lyqOYXJApFdiIXHQGF+QEVlQ4E8jm5VMb3w=";
   };
 
   nativeBuildInputs = [ cmake llvmPackages.llvm.dev ];
diff --git a/pkgs/development/tools/language-servers/millet/Cargo.lock b/pkgs/development/tools/language-servers/millet/Cargo.lock
index ba83ab4a9eb..3c7e5cc534f 100644
--- a/pkgs/development/tools/language-servers/millet/Cargo.lock
+++ b/pkgs/development/tools/language-servers/millet/Cargo.lock
@@ -28,7 +28,7 @@ dependencies = [
 
 [[package]]
 name = "analysis"
-version = "0.13.3"
+version = "0.13.4"
 dependencies = [
  "config",
  "diagnostic",
@@ -118,7 +118,7 @@ checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
 
 [[package]]
 name = "chain-map"
-version = "0.13.3"
+version = "0.13.4"
 dependencies = [
  "fast-hash",
  "str-util",
@@ -131,7 +131,7 @@ source = "git+https://github.com/azdavis/language-util.git#5e9a78d6f82e6129a7847
 
 [[package]]
 name = "cm-syntax"
-version = "0.13.3"
+version = "0.13.4"
 dependencies = [
  "lex-util",
  "paths",
@@ -160,7 +160,7 @@ dependencies = [
 
 [[package]]
 name = "config"
-version = "0.13.3"
+version = "0.13.4"
 dependencies = [
  "fast-hash",
  "serde",
@@ -188,7 +188,7 @@ checksum = "7704b5fdd17b18ae31c4c1da5a2e0305a2bf17b5249300a9ee9ed7b72114c636"
 
 [[package]]
 name = "cov-mark"
-version = "0.13.3"
+version = "0.13.4"
 dependencies = [
  "fast-hash",
  "once_cell",
@@ -427,7 +427,7 @@ dependencies = [
 
 [[package]]
 name = "input"
-version = "0.13.3"
+version = "0.13.4"
 dependencies = [
  "cm-syntax",
  "config",
@@ -475,7 +475,7 @@ checksum = "3752f229dcc5a481d60f385fa479ff46818033d881d2d801aa27dffcfb5e8306"
 
 [[package]]
 name = "lang-srv"
-version = "0.13.3"
+version = "0.13.4"
 dependencies = [
  "analysis",
  "anyhow",
@@ -503,7 +503,7 @@ checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
 
 [[package]]
 name = "lex-util"
-version = "0.13.3"
+version = "0.13.4"
 
 [[package]]
 name = "libc"
@@ -575,7 +575,7 @@ dependencies = [
 
 [[package]]
 name = "millet-cli"
-version = "0.13.3"
+version = "0.13.4"
 dependencies = [
  "analysis",
  "codespan-reporting",
@@ -593,7 +593,7 @@ dependencies = [
 
 [[package]]
 name = "millet-ls"
-version = "0.13.3"
+version = "0.13.4"
 dependencies = [
  "anyhow",
  "env_logger",
@@ -613,7 +613,7 @@ dependencies = [
 
 [[package]]
 name = "mlb-hir"
-version = "0.13.3"
+version = "0.13.4"
 dependencies = [
  "fast-hash",
  "paths",
@@ -624,7 +624,7 @@ dependencies = [
 
 [[package]]
 name = "mlb-statics"
-version = "0.13.3"
+version = "0.13.4"
 dependencies = [
  "config",
  "diagnostic",
@@ -648,7 +648,7 @@ dependencies = [
 
 [[package]]
 name = "mlb-syntax"
-version = "0.13.3"
+version = "0.13.4"
 dependencies = [
  "lex-util",
  "paths",
@@ -711,7 +711,7 @@ checksum = "dd8b5dd2ae5ed71462c540258bedcb51965123ad7e7ccf4b9a8cafaa4a63576d"
 
 [[package]]
 name = "panic-hook"
-version = "0.13.3"
+version = "0.13.4"
 dependencies = [
  "better-panic",
 ]
@@ -924,7 +924,7 @@ dependencies = [
 
 [[package]]
 name = "slash-var-path"
-version = "0.13.3"
+version = "0.13.4"
 dependencies = [
  "fast-hash",
  "str-util",
@@ -932,14 +932,14 @@ dependencies = [
 
 [[package]]
 name = "sml-comment"
-version = "0.13.3"
+version = "0.13.4"
 dependencies = [
  "sml-syntax",
 ]
 
 [[package]]
 name = "sml-dynamics"
-version = "0.13.3"
+version = "0.13.4"
 dependencies = [
  "fast-hash",
  "fmt-util",
@@ -950,7 +950,7 @@ dependencies = [
 
 [[package]]
 name = "sml-dynamics-tests"
-version = "0.13.3"
+version = "0.13.4"
 dependencies = [
  "config",
  "pretty_assertions",
@@ -966,7 +966,7 @@ dependencies = [
 
 [[package]]
 name = "sml-file-syntax"
-version = "0.13.3"
+version = "0.13.4"
 dependencies = [
  "config",
  "elapsed",
@@ -980,7 +980,7 @@ dependencies = [
 
 [[package]]
 name = "sml-fixity"
-version = "0.13.3"
+version = "0.13.4"
 dependencies = [
  "fast-hash",
  "once_cell",
@@ -989,7 +989,7 @@ dependencies = [
 
 [[package]]
 name = "sml-hir"
-version = "0.13.3"
+version = "0.13.4"
 dependencies = [
  "la-arena",
  "sml-lab",
@@ -1000,7 +1000,7 @@ dependencies = [
 
 [[package]]
 name = "sml-hir-lower"
-version = "0.13.3"
+version = "0.13.4"
 dependencies = [
  "config",
  "cov-mark",
@@ -1015,14 +1015,14 @@ dependencies = [
 
 [[package]]
 name = "sml-lab"
-version = "0.13.3"
+version = "0.13.4"
 dependencies = [
  "str-util",
 ]
 
 [[package]]
 name = "sml-lex"
-version = "0.13.3"
+version = "0.13.4"
 dependencies = [
  "cov-mark",
  "diagnostic",
@@ -1037,7 +1037,7 @@ source = "git+https://github.com/azdavis/sml-libs.git#0d94e3ce13f2a489dff86151f7
 
 [[package]]
 name = "sml-naive-fmt"
-version = "0.13.3"
+version = "0.13.4"
 dependencies = [
  "fast-hash",
  "sml-comment",
@@ -1046,11 +1046,11 @@ dependencies = [
 
 [[package]]
 name = "sml-namespace"
-version = "0.13.3"
+version = "0.13.4"
 
 [[package]]
 name = "sml-parse"
-version = "0.13.3"
+version = "0.13.4"
 dependencies = [
  "diagnostic",
  "event-parse",
@@ -1062,14 +1062,14 @@ dependencies = [
 
 [[package]]
 name = "sml-path"
-version = "0.13.3"
+version = "0.13.4"
 dependencies = [
  "str-util",
 ]
 
 [[package]]
 name = "sml-scon"
-version = "0.13.3"
+version = "0.13.4"
 dependencies = [
  "num-bigint",
  "num-traits",
@@ -1078,7 +1078,7 @@ dependencies = [
 
 [[package]]
 name = "sml-statics"
-version = "0.13.3"
+version = "0.13.4"
 dependencies = [
  "chain-map",
  "config",
@@ -1101,7 +1101,7 @@ dependencies = [
 
 [[package]]
 name = "sml-statics-types"
-version = "0.13.3"
+version = "0.13.4"
 dependencies = [
  "chain-map",
  "code-h2-md-map",
@@ -1120,7 +1120,7 @@ dependencies = [
 
 [[package]]
 name = "sml-symbol-kind"
-version = "0.13.3"
+version = "0.13.4"
 dependencies = [
  "sml-namespace",
  "sml-statics-types",
@@ -1128,7 +1128,7 @@ dependencies = [
 
 [[package]]
 name = "sml-syntax"
-version = "0.13.3"
+version = "0.13.4"
 dependencies = [
  "code-h2-md-map",
  "fast-hash",
@@ -1139,7 +1139,7 @@ dependencies = [
 
 [[package]]
 name = "sml-ty-var-scope"
-version = "0.13.3"
+version = "0.13.4"
 dependencies = [
  "fast-hash",
  "sml-hir",
@@ -1210,7 +1210,7 @@ dependencies = [
 
 [[package]]
 name = "tests"
-version = "0.13.3"
+version = "0.13.4"
 dependencies = [
  "analysis",
  "cm-syntax",
@@ -1554,7 +1554,7 @@ dependencies = [
 
 [[package]]
 name = "xtask"
-version = "0.13.3"
+version = "0.13.4"
 dependencies = [
  "anyhow",
  "flate2",
diff --git a/pkgs/development/tools/language-servers/millet/default.nix b/pkgs/development/tools/language-servers/millet/default.nix
index 98685dac45f..27b7a7a5675 100644
--- a/pkgs/development/tools/language-servers/millet/default.nix
+++ b/pkgs/development/tools/language-servers/millet/default.nix
@@ -2,13 +2,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "millet";
-  version = "0.13.3";
+  version = "0.13.4";
 
   src = fetchFromGitHub {
     owner = "azdavis";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-zbj1wFaPmxhPHIo+P3kbx0S0kksWDK+TgJ68ntzvcek=";
+    hash = "sha256-TLv2czZsZDOk8i8/0VxALflC/WV+MvRlbgbxB4kKsW0=";
   };
 
   cargoLock = {
diff --git a/pkgs/development/tools/language-servers/pylyzer/default.nix b/pkgs/development/tools/language-servers/pylyzer/default.nix
index 1383cfe3144..db4f582488b 100644
--- a/pkgs/development/tools/language-servers/pylyzer/default.nix
+++ b/pkgs/development/tools/language-servers/pylyzer/default.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "pylyzer";
-  version = "0.0.45";
+  version = "0.0.47";
 
   src = fetchFromGitHub {
     owner = "mtshiba";
     repo = "pylyzer";
     rev = "v${version}";
-    hash = "sha256-YEw8EU+YUBqfKL2RM1komz6D1/2GshNQtQso7rN0yCM=";
+    hash = "sha256-edLzBQvyanF7ozkDH+aqUF8j8r2cNKBKxLvEyPoCRIc=";
   };
 
-  cargoHash = "sha256-5NaeSu/9mAQoqN/7mXrZomlzR/JjUxcIy9fRdV2H8yM=";
+  cargoHash = "sha256-moTOErMKe7+3lAAOfz3F3cGzYB+xXqtNLPO3134JFl0=";
 
   nativeBuildInputs = [
     git
diff --git a/pkgs/development/tools/mysql-shell/default.nix b/pkgs/development/tools/mysql-shell/default.nix
index 837d560f4dc..b12e13d2801 100644
--- a/pkgs/development/tools/mysql-shell/default.nix
+++ b/pkgs/development/tools/mysql-shell/default.nix
@@ -36,26 +36,30 @@
 let
   pythonDeps = with python3.pkgs; [ certifi paramiko pyyaml ];
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "mysql-shell";
   version = "8.0.34";
 
   srcs = [
     (fetchurl {
-      url = "https://cdn.mysql.com//Downloads/MySQL-Shell/mysql-shell-${version}-src.tar.gz";
-      hash = "sha256-QY1PmhGw3PhqZ79+H/Xbb9uOvmrBlFQRS7idnV5OXF0=";
+      url = "https://cdn.mysql.com//Downloads/MySQL-${lib.versions.majorMinor finalAttrs.version}/mysql-${finalAttrs.version}.tar.gz";
+      hash = "sha256-5l0Do8QmGLX7+ZBCrtMyCUAumyeqYsfIdD/9R4jY2x0=";
     })
     (fetchurl {
-      url = "https://dev.mysql.com/get/Downloads/MySQL-${lib.versions.majorMinor version}/mysql-${version}.tar.gz";
-      hash = "sha256-5l0Do8QmGLX7+ZBCrtMyCUAumyeqYsfIdD/9R4jY2x0=";
+      url = "https://cdn.mysql.com//Downloads/MySQL-Shell/mysql-shell-${finalAttrs.version}-src.tar.gz";
+      hash = "sha256-QY1PmhGw3PhqZ79+H/Xbb9uOvmrBlFQRS7idnV5OXF0=";
     })
   ];
 
-  sourceRoot = "mysql-shell-${version}-src";
+  sourceRoot = "mysql-shell-${finalAttrs.version}-src";
+
+  postUnpack = ''
+    mv mysql-${finalAttrs.version} mysql
+  '';
 
   postPatch = ''
-    substituteInPlace ../mysql-${version}/cmake/libutils.cmake --replace /usr/bin/libtool libtool
-    substituteInPlace ../mysql-${version}/cmake/os/Darwin.cmake --replace /usr/bin/libtool libtool
+    substituteInPlace ../mysql/cmake/libutils.cmake --replace /usr/bin/libtool libtool
+    substituteInPlace ../mysql/cmake/os/Darwin.cmake --replace /usr/bin/libtool libtool
 
     substituteInPlace cmake/libutils.cmake --replace /usr/bin/libtool libtool
   '';
@@ -93,20 +97,19 @@ stdenv.mkDerivation rec {
     echo "Building mysqlclient mysqlxclient"
 
     cmake -DWITH_BOOST=system -DWITH_SYSTEM_LIBS=ON -DWITH_ROUTER=OFF -DWITH_UNIT_TESTS=OFF \
-      -DFORCE_UNSUPPORTED_COMPILER=1 -S ../mysql-${version} -B ../mysql-${version}/build
+      -DFORCE_UNSUPPORTED_COMPILER=1 -S ../mysql -B ../mysql/build
 
-    cmake --build ../mysql-${version}/build --parallel ''${NIX_BUILD_CORES:-1} --target mysqlclient mysqlxclient
+    cmake --build ../mysql/build --parallel ''${NIX_BUILD_CORES:-1} --target mysqlclient mysqlxclient
   '';
 
   cmakeFlags = [
-    "-DMYSQL_SOURCE_DIR=../mysql-${version}"
-    "-DMYSQL_BUILD_DIR=../mysql-${version}/build"
-    "-DMYSQL_CONFIG_EXECUTABLE=../../mysql-${version}/build/scripts/mysql_config"
+    "-DMYSQL_SOURCE_DIR=../mysql"
+    "-DMYSQL_BUILD_DIR=../mysql/build"
+    "-DMYSQL_CONFIG_EXECUTABLE=../../mysql/build/scripts/mysql_config"
     "-DWITH_ZSTD=system"
     "-DWITH_LZ4=system"
     "-DWITH_ZLIB=system"
     "-DWITH_PROTOBUF=${protobuf}"
-    "-DHAVE_V8=0" # V8 10.x required.
     "-DHAVE_PYTHON=1"
   ];
 
@@ -115,10 +118,10 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    homepage = "https://dev.mysql.com/doc/mysql-shell/${lib.versions.majorMinor version}/en/";
+    homepage = "https://dev.mysql.com/doc/mysql-shell/${lib.versions.majorMinor finalAttrs.version}/en/";
     description = "A new command line scriptable shell for MySQL";
     license = licenses.gpl2;
     maintainers = with maintainers; [ aaronjheng ];
     mainProgram = "mysqlsh";
   };
-}
+})
diff --git a/pkgs/development/tools/prettierd/default.nix b/pkgs/development/tools/prettierd/default.nix
index b3ba24db42c..7e55e5be101 100644
--- a/pkgs/development/tools/prettierd/default.nix
+++ b/pkgs/development/tools/prettierd/default.nix
@@ -8,18 +8,18 @@
 }:
 mkYarnPackage rec {
   pname = "prettierd";
-  version = "0.23.4";
+  version = "0.25.1";
 
   src = fetchFromGitHub {
     owner = "fsouza";
     repo = "prettierd";
     rev = "v${version}";
-    hash = "sha256-GTukjkA/53N9ICdfCJr5HAqhdL5T0pth6zAk8Fu/cis=";
+    hash = "sha256-aoRfZ9SJazz0ir1fyHypn3aYqK9DJOLLVPMuFcOm/20=";
   };
 
   offlineCache = fetchYarnDeps {
     yarnLock = src + "/yarn.lock";
-    hash = "sha256-32wMwkVgO5DQuROWnujVGNeCAUq1D6jJurecsD2ROOU=";
+    hash = "sha256-HsWsRIONRNY9akZ2LXlWcPhH6N5qCKnesaDX1gQp+NU=";
   };
 
   packageJSON = ./package.json;
diff --git a/pkgs/development/tools/prettierd/package.json b/pkgs/development/tools/prettierd/package.json
index 8769bac80c7..5ba4d098003 100644
--- a/pkgs/development/tools/prettierd/package.json
+++ b/pkgs/development/tools/prettierd/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@fsouza/prettierd",
-  "version": "0.23.4",
+  "version": "0.25.1",
   "description": "prettier, as a daemon",
   "bin": {
     "prettierd": "./bin/prettierd"
@@ -24,14 +24,13 @@
   },
   "homepage": "https://github.com/fsouza/prettierd",
   "devDependencies": {
-    "@types/node": "^20.2.5",
-    "@types/prettier": "^2.7.2",
-    "typescript": "^5.0.4"
+    "@types/node": "^20.6.3",
+    "@types/prettier": "^3.0.0",
+    "typescript": "^5.2.2"
   },
   "dependencies": {
-    "core_d": "^5.0.1",
-    "nanolru": "^1.0.0",
-    "prettier": "^2.8.8"
+    "core_d": "^6.0.0",
+    "prettier": "^3.0.3"
   },
   "files": [
     "bin",
@@ -40,7 +39,7 @@
     "README.md"
   ],
   "optionalDependencies": {
-    "@babel/parser": "^7.22.3",
-    "@typescript-eslint/typescript-estree": "^5.59.7"
+    "@babel/parser": "^7.22.16",
+    "@typescript-eslint/typescript-estree": "^6.7.2"
   }
 }
diff --git a/pkgs/development/tools/rust/cargo-insta/default.nix b/pkgs/development/tools/rust/cargo-insta/default.nix
index 5db787197a1..18842a94a99 100644
--- a/pkgs/development/tools/rust/cargo-insta/default.nix
+++ b/pkgs/development/tools/rust/cargo-insta/default.nix
@@ -5,24 +5,24 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-insta";
-  version = "1.31.0";
+  version = "1.32.0";
 
   src = fetchFromGitHub {
     owner = "mitsuhiko";
     repo = "insta";
     rev = "refs/tags/${version}";
-    hash = "sha256-hQaVUBw8X60DW1Ox4GzO+OCWMHmVYuCkjH5x/sMULiE=";
+    hash = "sha256-s6d0q4K2UTG+BWzvH5KOAllzYAkEapEuDoiI9KQW31I=";
   };
 
   sourceRoot = "${src.name}/cargo-insta";
 
-  cargoHash = "sha256-q6Ups4SDGjT5Zc9ujhRpRdh3uWq99lizgA7gpPVSl+A=";
+  cargoHash = "sha256-ZQUzoKE3OGaY22VYiku7GqjGN9jUNx09a0EcgCRzzcM=";
 
   meta = with lib; {
     description = "A Cargo subcommand for snapshot testing";
     homepage = "https://github.com/mitsuhiko/insta";
     changelog = "https://github.com/mitsuhiko/insta/blob/${version}/CHANGELOG.md";
     license = licenses.asl20;
-    maintainers = with lib.maintainers; [ figsoda oxalica matthiasbeyer ];
+    maintainers = with maintainers; [ figsoda oxalica matthiasbeyer ];
   };
 }
diff --git a/pkgs/development/tools/rust/cargo-machete/default.nix b/pkgs/development/tools/rust/cargo-machete/default.nix
index 5078ddf6043..75d83e7be5a 100644
--- a/pkgs/development/tools/rust/cargo-machete/default.nix
+++ b/pkgs/development/tools/rust/cargo-machete/default.nix
@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-machete";
-  version = "0.5.0";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "bnjbvr";
     repo = "cargo-machete";
     rev = "v${version}";
-    hash = "sha256-AOi4SnFkt82iQIP3bp/9JIaYiqjiEjKvJKUvrLQJTX8=";
+    hash = "sha256-LDhC/vwhyY4KD1RArCxl+nZl5IVj0zAjxlRLwWpnTvI=";
   };
 
-  cargoHash = "sha256-Q/2py0zgCYgnxFpcJD5PfNfIfIEUjtjFPjxDe25f0BQ=";
+  cargoHash = "sha256-vygAznYd/mtArSkLjoIpIxS4RiE3drRfKwNhD1w7KoY=";
 
   # tests require internet access
   doCheck = false;
diff --git a/pkgs/development/tools/trunk-io/default.nix b/pkgs/development/tools/trunk-io/default.nix
index d9be944f61f..78b5247a491 100644
--- a/pkgs/development/tools/trunk-io/default.nix
+++ b/pkgs/development/tools/trunk-io/default.nix
@@ -1,11 +1,11 @@
 { lib, stdenv, fetchurl }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "trunk-io";
   version = "1.2.7";
 
   src = fetchurl {
-    url = "https://trunk.io/releases/launcher/${version}/trunk";
+    url = "https://trunk.io/releases/launcher/${finalAttrs.version}/trunk";
     hash = "sha256-i2m+6Y6gvkHYwzESJv0DkLcHkXqz+g4e43TV6u1UTj8=";
   };
 
@@ -25,4 +25,4 @@ stdenv.mkDerivation rec {
     license = licenses.unfree;
     maintainers = with maintainers; [ aaronjheng ];
   };
-}
+})
diff --git a/pkgs/development/tools/typos/default.nix b/pkgs/development/tools/typos/default.nix
index f3752cb90a9..09de5505adb 100644
--- a/pkgs/development/tools/typos/default.nix
+++ b/pkgs/development/tools/typos/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "typos";
-  version = "1.16.12";
+  version = "1.16.13";
 
   src = fetchFromGitHub {
     owner = "crate-ci";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-zi1SVEl+EZacPOEjpOIG9KiXY2790fO63gGyc2jKNoE=";
+    hash = "sha256-ldmbPxQUEXQ8T1Gy2xIl8uCMMD/sat23esOSnnf3SWs=";
   };
 
-  cargoHash = "sha256-UQVERFAaGyrWIp+3fxZ0Bpbv7ZTPYQiTCRgaYnU8Zq0=";
+  cargoHash = "sha256-7o3xiaxuFanEplSADCRy4tFsACKNFlsNrJfNJ9HBJFg=";
 
   meta = with lib; {
     description = "Source code spell checker";
diff --git a/pkgs/games/harmonist/default.nix b/pkgs/games/harmonist/default.nix
index c08ed624959..cbb556cbc94 100644
--- a/pkgs/games/harmonist/default.nix
+++ b/pkgs/games/harmonist/default.nix
@@ -25,6 +25,6 @@ buildGoModule rec {
     '';
     homepage = "https://harmonist.tuxfamily.org/";
     license = licenses.isc;
-    maintainers = with maintainers; [ aaronjheng ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/misc/dxvk/dxvk.nix b/pkgs/misc/dxvk/dxvk.nix
index b7bc4f2fc12..129090faaf4 100644
--- a/pkgs/misc/dxvk/dxvk.nix
+++ b/pkgs/misc/dxvk/dxvk.nix
@@ -46,12 +46,12 @@ let
       ];
     };
     "default" = rec {
-      version = "2.2";
+      version = "2.3";
       src = fetchFromGitHub {
         owner = "doitsujin";
         repo = "dxvk";
         rev = "v${version}";
-        hash = "sha256-GKRd66DvcA+7p3/wDqAUi02ZLRSVZ/fvJM0PQDEKVMA=";
+        hash = "sha256-RU+B0XfphD5HHW/vSzqHLUaGS3E31d5sOLp3lMmrCB8=";
         fetchSubmodules = true; # Needed for the DirectX headers and libdisplay-info
       };
       patches = [ ];
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index 2e558267736..038a3105a18 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -1012,6 +1012,7 @@ let
 
       X86_AMD_PLATFORM_DEVICE = yes;
       X86_PLATFORM_DRIVERS_DELL = whenAtLeast "5.12" yes;
+      X86_PLATFORM_DRIVERS_HP = whenAtLeast "6.1" yes;
 
       LIRC = mkMerge [ (whenOlder "4.16" module) (whenAtLeast "4.17" yes) ];
 
diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 7b212cbdda3..0019a7c5f38 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -4,35 +4,35 @@
         "hash": "sha256:1hbva5vsfi48h82ll4kmhzm5hxp7340bj2smwgvjikam26icaj54"
     },
     "6.5": {
-        "version": "6.5.4",
-        "hash": "sha256:0s8nzd8yaq06bq8byk7aakbk95gh0rhlif26h1biw94v48anrxxx"
+        "version": "6.5.5",
+        "hash": "sha256:15gg8sb6cfgk1afwj7fl7mj4nkj14w43vzwvw0qsg3nzyxwh7wcc"
     },
     "6.4": {
         "version": "6.4.16",
         "hash": "sha256:0zgj1z97jyx7wf12zrnlcp0mj4cl43ais9qsy6dh1jwylf2fq9ln"
     },
     "6.1": {
-        "version": "6.1.54",
-        "hash": "sha256:09sfrq2l8f777mx2n9mhb6bgz1064bl04921byqnmk87si31w653"
+        "version": "6.1.55",
+        "hash": "sha256:1h0mzx52q9pvdv7rhnvb8g68i7bnlc9rf8gy9qn4alsxq4g28zm8"
     },
     "5.15": {
-        "version": "5.15.132",
-        "hash": "sha256:1b0qjsaqjw2rk86shmmrj2aasblkn27acjmc761vnjg7sv2baxs1"
+        "version": "5.15.133",
+        "hash": "sha256:1paxzzcagc7s8i491zjny43rxhfamafyly438kj8hyw96iwmx17g"
     },
     "5.10": {
-        "version": "5.10.195",
-        "hash": "sha256:0n4vg2i9sq89wnz85arlyvwysh9s83cgzs5bk2wh98bivi5fwfs1"
+        "version": "5.10.197",
+        "hash": "sha256:1awkm7lln5gf6kld9z5h4mg39bd778jsdswwlwb7iv7bn03lafhq"
     },
     "5.4": {
-        "version": "5.4.256",
-        "hash": "sha256:0fim5q9xakwnjfg48bpsic9r2r8dvrjlalqqkm9vh1rml9mhi967"
+        "version": "5.4.257",
+        "hash": "sha256:1w1x91slzg9ggakqhyxnmvz77v2cwfk8bz0knrpgz9qya9q5jxrf"
     },
     "4.19": {
-        "version": "4.19.294",
-        "hash": "sha256:03x0xsb8a369zdr81hg6xdl5n5v48k6iwnhj6r29725777lvvbfc"
+        "version": "4.19.295",
+        "hash": "sha256:1b1qslpk1kka7nxam48s22xsqd9qmp716hmibgfsjxl5y3jc4cmp"
     },
     "4.14": {
-        "version": "4.14.325",
-        "hash": "sha256:117p1mdha57f6d3kdwac9jrbmib7g77q4xhir8ghl6fmrs1f2sav"
+        "version": "4.14.326",
+        "hash": "sha256:0y0lvzidw775mgx211wnc1c6223iqv8amz5y9jkz9h7l3l7y8p2m"
     }
 }
diff --git a/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix b/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
index 19b46d87308..eb2031b129d 100644
--- a/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
@@ -6,7 +6,7 @@
 , ... } @ args:
 
 let
-  version = "5.10.186-rt91"; # updated by ./update-rt.sh
+  version = "5.10.180-rt89"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
@@ -17,14 +17,14 @@ in buildLinux (args // {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${kversion}.tar.xz";
-    sha256 = "1qqv91r13akgik1q4jybf8czskxxizk6lpv4rsvjn9sx2dm2jq0y";
+    sha256 = "0a8cicvcyl5w4vi7gxhgd59ny44gj9cbv4z5pnwn9jgny55rm0ys";
   };
 
   kernelPatches = let rt-patch = {
     name = "rt";
     patch = fetchurl {
       url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "1h5p0p3clq0gmaszvddmfll17adv02wfp2bfrd5x3aigvigwfmjb";
+      sha256 = "00m6psnjam26x70f8wpssvjp6v49dyllp356fpfbhjqmj7y142bm";
     };
   }; in [ rt-patch ] ++ kernelPatches;
 
diff --git a/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix b/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix
index d599c3bda31..f45926020b5 100644
--- a/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix
@@ -6,7 +6,7 @@
 , ... } @ args:
 
 let
-  version = "6.1.46-rt14"; # updated by ./update-rt.sh
+  version = "6.1.54-rt15"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
@@ -18,14 +18,14 @@ in buildLinux (args // {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v6.x/linux-${kversion}.tar.xz";
-    sha256 = "15m228bllks2p8gpsmvplx08yxzp7bij9fnmnafqszylrk7ppxpm";
+    sha256 = "09sfrq2l8f777mx2n9mhb6bgz1064bl04921byqnmk87si31w653";
   };
 
   kernelPatches = let rt-patch = {
     name = "rt";
     patch = fetchurl {
       url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "0mrpsy175iz0b51hwgqbj15w83lm3m57il3gqwb489gln7mpzy17";
+      sha256 = "0ihdid1ihg26kjini66j87vh4220gl8xm9dai7zignha2zh238kh";
     };
   }; in [ rt-patch ] ++ kernelPatches;
 
diff --git a/pkgs/os-specific/linux/rdma-core/default.nix b/pkgs/os-specific/linux/rdma-core/default.nix
index 98ddb7bb57b..59cbc5d83a8 100644
--- a/pkgs/os-specific/linux/rdma-core/default.nix
+++ b/pkgs/os-specific/linux/rdma-core/default.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rdma-core";
-  version = "47.0";
+  version = "48.0";
 
   src = fetchFromGitHub {
     owner = "linux-rdma";
     repo = "rdma-core";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-R+qgHDu9GRwT5ic1DCDlYe1Xb4hqi8pgitKq9iBBQNQ=";
+    hash = "sha256-/ltuZ9OiwJJ6CuAd6hqJwo+wETOgZ4UcW50BrjudF+k=";
   };
 
   strictDeps = true;
diff --git a/pkgs/servers/demoit/default.nix b/pkgs/servers/demoit/default.nix
index 1ffd5aba546..3a587230eef 100644
--- a/pkgs/servers/demoit/default.nix
+++ b/pkgs/servers/demoit/default.nix
@@ -3,17 +3,19 @@
 , fetchFromGitHub
 }:
 
-buildGoModule {
+buildGoModule rec {
   pname = "demoit";
-  version = "unstable-2022-09-03";
+  version = "1.0";
 
   src = fetchFromGitHub {
     owner = "dgageot";
     repo = "demoit";
-    rev = "258780987922e46abde8e848247af0a9435e3099";
-    sha256 = "sha256-yRfdnqk93GOTBa0zZrm4K3AkUqxGmlrwlKYcD6CtgRg=";
+    rev = "v${version}";
+    hash = "sha256-3g0k2Oau0d9tXYDtxHpUKvAQ1FnGhjRP05YVTlmgLhM=";
   };
+
   vendorHash = null;
+
   subPackages = [ "." ];
 
   meta = with lib; {
diff --git a/pkgs/servers/matrix-synapse/plugins/s3-storage-provider.nix b/pkgs/servers/matrix-synapse/plugins/s3-storage-provider.nix
index 42d62539b6b..92e111dbb62 100644
--- a/pkgs/servers/matrix-synapse/plugins/s3-storage-provider.nix
+++ b/pkgs/servers/matrix-synapse/plugins/s3-storage-provider.nix
@@ -7,6 +7,7 @@
 , pythonOlder
 , tqdm
 , twisted
+, psycopg2
 }:
 
 buildPythonPackage rec {
@@ -37,6 +38,7 @@ buildPythonPackage rec {
     humanize
     tqdm
     twisted
+    psycopg2
   ]
   # For the s3_media_upload script
   ++ matrix-synapse-unwrapped.propagatedBuildInputs;
diff --git a/pkgs/servers/monitoring/do-agent/default.nix b/pkgs/servers/monitoring/do-agent/default.nix
index d1009616a1f..51502d9e1ba 100644
--- a/pkgs/servers/monitoring/do-agent/default.nix
+++ b/pkgs/servers/monitoring/do-agent/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "do-agent";
-  version = "3.16.6";
+  version = "3.16.7";
 
   src = fetchFromGitHub {
     owner = "digitalocean";
     repo = "do-agent";
     rev = version;
-    sha256 = "sha256-2KzgIv7DMEnzEJzC0fUrHQ1VIqClCgw55huqZFlctxk=";
+    sha256 = "sha256-m1OHCaSY13L+184ju6rzJ/SO0OCIlOtMNAvdkGTXTFw=";
   };
 
   ldflags = [
diff --git a/pkgs/servers/skydns/default.nix b/pkgs/servers/skydns/default.nix
index be9e815b9ec..2ae2efbbb75 100644
--- a/pkgs/servers/skydns/default.nix
+++ b/pkgs/servers/skydns/default.nix
@@ -29,6 +29,6 @@ buildGoModule rec {
     description = "A distributed service for announcement and discovery of services";
     homepage = "https://github.com/skynetservices/skydns";
     license = lib.licenses.mit;
-    maintainers = with maintainers; [ aaronjheng ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/servers/sql/postgresql/ext/plpgsql_check.nix b/pkgs/servers/sql/postgresql/ext/plpgsql_check.nix
index 83e45606926..abbb1ac4d3e 100644
--- a/pkgs/servers/sql/postgresql/ext/plpgsql_check.nix
+++ b/pkgs/servers/sql/postgresql/ext/plpgsql_check.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "plpgsql_check";
-  version = "2.5.0";
+  version = "2.5.1";
 
   src = fetchFromGitHub {
     owner = "okbob";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-6S1YG/4KGlgtTBrxh3p6eMd/aCovK/QME4f2z0YTUxc=";
+    hash = "sha256-4J4uKcQ/jRKKgrpUUed9MXDmOJaYKYDzznt1DItr6T0=";
   };
 
   buildInputs = [ postgresql ];
diff --git a/pkgs/tools/audio/dsp/default.nix b/pkgs/tools/audio/dsp/default.nix
index 57990199dfa..e17e211d340 100644
--- a/pkgs/tools/audio/dsp/default.nix
+++ b/pkgs/tools/audio/dsp/default.nix
@@ -15,14 +15,14 @@
 , libpulseaudio
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "dsp";
   version = "1.9";
 
   src = fetchFromGitHub {
     owner = "bmc0";
     repo = "dsp";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     hash = "sha256-S1pzVQ/ceNsx0vGmzdDWw2TjPVLiRgzR4edFblWsekY=";
   };
 
@@ -47,6 +47,6 @@ stdenv.mkDerivation rec {
     description = "An audio processing program with an interactive mode";
     license = licenses.isc;
     maintainers = with maintainers; [ aaronjheng ];
-    platforms = platforms.linux ++ platforms.darwin;
+    platforms = platforms.linux;
   };
-}
+})
diff --git a/pkgs/tools/backup/kopia/default.nix b/pkgs/tools/backup/kopia/default.nix
index ffdfd8acb6c..020902c1a0c 100644
--- a/pkgs/tools/backup/kopia/default.nix
+++ b/pkgs/tools/backup/kopia/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "kopia";
-  version = "0.13.0";
+  version = "0.14.1";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-wQZzFrrxLzJ16TOrhxBlUuz+eCdqW/PmHUTuJP1Wy9Y=";
+    hash = "sha256-ELnop8/f7/4E5FnWwGrPJt3n9YhSG1jei1tAt3zr1KI=";
   };
 
-  vendorHash = "sha256-OeDgaO125y8eCQlm9Lv5RZlb1fNLTCplEQbpJ2KMVms=";
+  vendorHash = "sha256-8NTAnkIJkFKyjQL7KBoCqtSBog9Hz1vPBo81u8YcA1A=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/filesystems/erofs-utils/default.nix b/pkgs/tools/filesystems/erofs-utils/default.nix
index a10addbfa51..163439c903e 100644
--- a/pkgs/tools/filesystems/erofs-utils/default.nix
+++ b/pkgs/tools/filesystems/erofs-utils/default.nix
@@ -1,20 +1,20 @@
-{ lib, stdenv, fetchurl, autoreconfHook, pkg-config, fuse, util-linux, lz4
+{ lib, stdenv, fetchurl, autoreconfHook, pkg-config, fuse, util-linux, lz4, zlib
 , fuseSupport ? stdenv.isLinux
 }:
 
 stdenv.mkDerivation rec {
   pname = "erofs-utils";
-  version = "1.6";
+  version = "1.7";
   outputs = [ "out" "man" ];
 
   src = fetchurl {
     url =
       "https://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs-utils.git/snapshot/erofs-utils-${version}.tar.gz";
-    sha256 = "sha256-2/Gtrv8buFMrKacsip4ZGTjJOJlGdw3HY9PFnm8yBXE=";
+    hash = "sha256-tutSm7Qj6y3XecnanCYyhVSItLkeI1U6Mc4j8Rycziw=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
-  buildInputs = [ util-linux lz4 ]
+  buildInputs = [ util-linux lz4 zlib ]
     ++ lib.optionals fuseSupport [ fuse ];
 
   configureFlags = lib.optionals fuseSupport [ "--enable-fuse" ];
diff --git a/pkgs/tools/filesystems/gcsfuse/default.nix b/pkgs/tools/filesystems/gcsfuse/default.nix
index e9cb2d8912b..0af1a965fc4 100644
--- a/pkgs/tools/filesystems/gcsfuse/default.nix
+++ b/pkgs/tools/filesystems/gcsfuse/default.nix
@@ -42,6 +42,6 @@ buildGoModule rec {
     homepage = "https://cloud.google.com/storage/docs/gcs-fuse";
     changelog = "https://github.com/GoogleCloudPlatform/gcsfuse/releases/tag/v${version}";
     license = licenses.asl20;
-    maintainers = with maintainers; [ aaronjheng ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/tools/filesystems/go-mtpfs/default.nix b/pkgs/tools/filesystems/go-mtpfs/default.nix
index 115928e4979..f82e5b7c362 100644
--- a/pkgs/tools/filesystems/go-mtpfs/default.nix
+++ b/pkgs/tools/filesystems/go-mtpfs/default.nix
@@ -28,7 +28,7 @@ buildGoModule rec {
     description = "A simple FUSE filesystem for mounting Android devices as a MTP device";
     homepage = "https://github.com/hanwen/go-mtpfs";
     license = licenses.bsd3;
-    maintainers = with maintainers; [ aaronjheng ];
+    maintainers = with maintainers; [ ];
     broken = stdenv.isDarwin;
   };
 }
diff --git a/pkgs/tools/filesystems/mergerfs/default.nix b/pkgs/tools/filesystems/mergerfs/default.nix
index b48db16b8fd..e2e6e28e3b6 100644
--- a/pkgs/tools/filesystems/mergerfs/default.nix
+++ b/pkgs/tools/filesystems/mergerfs/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mergerfs";
-  version = "2.37.0";
+  version = "2.37.1";
 
   src = fetchFromGitHub {
     owner = "trapexit";
     repo = pname;
     rev = version;
-    sha256 = "sha256-IJcTzEKFMSAryG44Rpwgl0toxFxNyyJyaVC8MO1Dv7M=";
+    sha256 = "sha256-4WowGrmFDDpmZlAVH73oiKBdgQeqEkbwZCaDSd1rAEc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/games/minecraft/minecraft-server-hibernation/default.nix b/pkgs/tools/games/minecraft/minecraft-server-hibernation/default.nix
index 4e39edd83ef..ff0e7873827 100644
--- a/pkgs/tools/games/minecraft/minecraft-server-hibernation/default.nix
+++ b/pkgs/tools/games/minecraft/minecraft-server-hibernation/default.nix
@@ -2,24 +2,35 @@
 
 buildGoModule rec {
   pname = "minecraft-server-hibernation";
-  version = "2.4.10";
+  version = "2.5.0";
 
   src = fetchFromGitHub {
     owner = "gekware";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-hflPVO+gqHr0jDrhWzd7t/E6WsswiMKMHCkTUK4E05k=";
+    hash = "sha256-b6LeqjIraIasHBpaVgy8esl4NV8rdBrfO7ewgeIocS8=";
   };
 
-  vendorHash = "sha256-W6P7wz1FGL6Os1zmmqWJ7/sO8zizfnwg+TMiFWGHIOM=";
+  vendorHash = null;
 
   ldflags = [ "-s" "-w" ];
 
+  checkFlags =
+    let
+      skippedTests = [
+        # Disable tests requiring network access
+        "Test_getPing"
+        "Test_getReqType"
+        "Test_QueryBasic"
+        "Test_QueryFull"
+      ];
+    in
+    [ "-skip" "${builtins.concatStringsSep "|" skippedTests}" ];
+
   meta = with lib; {
     description = "Autostart and stop minecraft-server when players join/leave";
     homepage = "https://github.com/gekware/minecraft-server-hibernation";
     license = licenses.gpl3Only;
-    platforms = platforms.linux;
     maintainers = with maintainers; [ squarepear ];
   };
 }
diff --git a/pkgs/tools/misc/claws/default.nix b/pkgs/tools/misc/claws/default.nix
index 9d360e40c2a..5690ec74d0a 100644
--- a/pkgs/tools/misc/claws/default.nix
+++ b/pkgs/tools/misc/claws/default.nix
@@ -19,6 +19,6 @@ buildGoModule rec {
     homepage = "https://github.com/thehowl/claws";
     description = "Interactive command line client for testing websocket servers";
     license = licenses.mit;
-    maintainers = with maintainers; [ aaronjheng ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/tools/misc/dashing/default.nix b/pkgs/tools/misc/dashing/default.nix
index 4b960c3fa54..7a1541b7e94 100644
--- a/pkgs/tools/misc/dashing/default.nix
+++ b/pkgs/tools/misc/dashing/default.nix
@@ -23,6 +23,6 @@ buildGoModule rec {
     description = "A Dash Generator Script for Any HTML";
     homepage = "https://github.com/technosophos/dashing";
     license = licenses.mit;
-    maintainers = with maintainers; [ aaronjheng ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/tools/misc/gosu/default.nix b/pkgs/tools/misc/gosu/default.nix
index df42c6ea949..6f08e027d8f 100644
--- a/pkgs/tools/misc/gosu/default.nix
+++ b/pkgs/tools/misc/gosu/default.nix
@@ -23,7 +23,7 @@ buildGoModule rec {
     description = "Tool that avoids TTY and signal-forwarding behavior of sudo and su";
     homepage = "https://github.com/tianon/gosu";
     license = licenses.asl20;
-    maintainers = with maintainers; [ aaronjheng ];
+    maintainers = with maintainers; [ ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/tools/misc/pouf/default.nix b/pkgs/tools/misc/pouf/default.nix
index 6b4f812bf3b..9206e16463e 100644
--- a/pkgs/tools/misc/pouf/default.nix
+++ b/pkgs/tools/misc/pouf/default.nix
@@ -5,16 +5,21 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "pouf";
-  version = "0.5.1";
+  version = "0.6.3";
 
   src = fetchFromGitHub {
     owner = "mothsart";
     repo = pname;
     rev = version;
-    sha256 = "1zz91r37d6nqvdy29syq853krqdkigiqihwz7ww9kvagfvzvdh13";
+    hash = "sha256-tW86b9a7u1jyfmHjwjs+5DaUujRZH+VhGQsj0CBj0yk=";
   };
 
-  cargoSha256 = "1ikm9fqi37jznln2xsyzfm625lv8kwjzanpm3wglx2s1k1jkmcy9";
+  cargoHash = "sha256-rVJAaeg27SdM8cTx12rKLIGEYtXUhLHXUYpT78oVNlo=";
+
+  # Cargo.lock is outdated.
+  preConfigure = ''
+    cargo update --offline
+  '';
 
   postInstall = "make PREFIX=$out copy-data";
 
diff --git a/pkgs/tools/misc/wakatime/default.nix b/pkgs/tools/misc/wakatime/default.nix
index bf0e9657296..2ce8df19867 100644
--- a/pkgs/tools/misc/wakatime/default.nix
+++ b/pkgs/tools/misc/wakatime/default.nix
@@ -47,7 +47,7 @@ buildGoModule rec {
     homepage = "https://wakatime.com/";
     description = "WakaTime command line interface";
     license = licenses.bsd3;
-    maintainers = with maintainers; [ aaronjheng ];
+    maintainers = with maintainers; [ ];
     mainProgram = "wakatime-cli";
   };
 }
diff --git a/pkgs/tools/networking/shadowsocks-rust/default.nix b/pkgs/tools/networking/shadowsocks-rust/default.nix
index 55fc6289fe0..4dcd1ee250e 100644
--- a/pkgs/tools/networking/shadowsocks-rust/default.nix
+++ b/pkgs/tools/networking/shadowsocks-rust/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "shadowsocks-rust";
-  version = "1.16.1";
+  version = "1.16.2";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "shadowsocks";
     repo = pname;
-    hash = "sha256-h/2zHxgp8sXcUOpmtneoAX0hNt19pObfyGW3wIzQNxc=";
+    hash = "sha256-TE1pGLS77WpaT0J0rUllihmHY5nOHzxd1LMsNjptXrg=";
   };
 
-  cargoHash = "sha256-MZGd1SyTSZ6y9W9h+M3Y5cwX6hLCFiuPZb307PRtvQk=";
+  cargoHash = "sha256-Fq/EMA7PHL/1eWNwT0naRtfkIU0Hia5yzFWmsyugOFc=";
 
   nativeBuildInputs = lib.optionals stdenv.isLinux [ pkg-config ];
 
diff --git a/pkgs/tools/security/bitwarden/cli.nix b/pkgs/tools/security/bitwarden/cli.nix
index 22cfca24971..6e4ebb9d098 100644
--- a/pkgs/tools/security/bitwarden/cli.nix
+++ b/pkgs/tools/security/bitwarden/cli.nix
@@ -12,16 +12,16 @@ let
   buildNpmPackage' = buildNpmPackage.override { nodejs = nodejs_18; };
 in buildNpmPackage' rec {
   pname = "bitwarden-cli";
-  version = "2023.8.2";
+  version = "2023.9.0";
 
   src = fetchFromGitHub {
     owner = "bitwarden";
     repo = "clients";
     rev = "cli-v${version}";
-    hash = "sha256-v9ql01dwWf9kBxw75n9svQousrnbUi8NY1wkJx06teg=";
+    hash = "sha256-s9jj1qmh4aCvtVY85U4AU7pcc8ABu9essFYqwf64dns=";
   };
 
-  npmDepsHash = "sha256-RvkauNvt6MZxWMssEtaCjXP1z/3NsReywUgCefV/jjM=";
+  npmDepsHash = "sha256-0q3XoC87kfC2PYMsNse4DV8M8OXjckiLTdN3LK06lZY=";
 
   nativeBuildInputs = [
     python3
diff --git a/pkgs/tools/security/bitwarden/default.nix b/pkgs/tools/security/bitwarden/default.nix
index fae9848f482..41ce0d7e5e8 100644
--- a/pkgs/tools/security/bitwarden/default.nix
+++ b/pkgs/tools/security/bitwarden/default.nix
@@ -1,6 +1,7 @@
 { lib
 , applyPatches
 , buildNpmPackage
+, cargo
 , dbus
 , electron_24
 , fetchFromGitHub
@@ -12,11 +13,12 @@
 , makeDesktopItem
 , makeWrapper
 , moreutils
+, napi-rs-cli
 , nodejs_18
 , pkg-config
 , python3
+, rustc
 , rustPlatform
-, wrapGAppsHook
 }:
 
 let
@@ -26,56 +28,6 @@ let
   buildNpmPackage' = buildNpmPackage.override { nodejs = nodejs_18; };
   electron = electron_24;
 
-  version = "2023.8.3";
-  src = applyPatches {
-    src = fetchFromGitHub {
-      owner = "bitwarden";
-      repo = "clients";
-      rev = "desktop-v${version}";
-      hash = "sha256-ZsAc9tC087Em/VzgaVm5fU+JnI4gIsSAphxicdJWztU=";
-    };
-
-    patches = [ ];
-  };
-
-  desktop-native = rustPlatform.buildRustPackage {
-    pname = "bitwarden-desktop-native";
-    inherit src version;
-    sourceRoot = "${src.name}/apps/desktop/desktop_native";
-    cargoHash = "sha256-iBZvdBfuZtcoSgyU4B58ARIBplqUuT5bRev9qnk9LpE=";
-
-    nativeBuildInputs = [
-      pkg-config
-      wrapGAppsHook
-    ];
-
-    buildInputs = [
-      glib
-      gtk3
-      libsecret
-    ];
-
-    nativeCheckInputs = [
-      dbus
-      (gnome.gnome-keyring.override { useWrappedDaemon = false; })
-    ];
-
-    checkFlags = [
-      "--skip=password::password::tests::test"
-    ];
-
-    checkPhase = ''
-      runHook preCheck
-
-      export HOME=$(mktemp -d)
-      export -f cargoCheckHook runHook _eval _callImplicitHook
-      dbus-run-session \
-        --config-file=${dbus}/share/dbus-1/session.conf \
-        -- bash -e -c cargoCheckHook
-      runHook postCheck
-    '';
-  };
-
   desktopItem = makeDesktopItem {
     name = "bitwarden";
     exec = "bitwarden %U";
@@ -84,26 +36,48 @@ let
     desktopName = "Bitwarden";
     categories = [ "Utility" ];
   };
-
-in
-
-buildNpmPackage' {
+in buildNpmPackage' rec {
   pname = "bitwarden";
-  inherit src version;
+  version = "2023.9.0";
+
+  src = fetchFromGitHub {
+    owner = "bitwarden";
+    repo = "clients";
+    rev = "desktop-v${version}";
+    hash = "sha256-8rNJmDpKLzTre5c2wktle7tthp1owZK5WAQP80/2R0g=";
+  };
 
   makeCacheWritable = true;
-  npmBuildFlags = [
-    "--workspace apps/desktop"
-  ];
-  npmDepsHash = "sha256-ARq6iYOkL9CMyAX37g8+Wf+UQsH7hU1jCq/52I1qS9A=";
+  npmWorkspace = "apps/desktop";
+  npmDepsHash = "sha256-0q3XoC87kfC2PYMsNse4DV8M8OXjckiLTdN3LK06lZY=";
+
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    name = "${pname}-${version}";
+    inherit src;
+    sourceRoot = "${src.name}/${cargoRoot}";
+    hash = "sha256-YF3UHQWCSuWAg2frE8bo1XrLn44P6+1A7YUh4RZxwo0=";
+  };
+  cargoRoot = "apps/desktop/desktop_native";
 
-  ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
+  env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
 
   nativeBuildInputs = [
+    cargo
     jq
     makeWrapper
     moreutils
+    napi-rs-cli
+    pkg-config
     python3
+    rustc
+    rustPlatform.cargoCheckHook
+    rustPlatform.cargoSetupHook
+  ];
+
+  buildInputs = [
+    glib
+    gtk3
+    libsecret
   ];
 
   preBuild = ''
@@ -111,15 +85,14 @@ buildNpmPackage' {
       echo 'ERROR: electron version mismatch'
       exit 1
     fi
-
-    jq 'del(.scripts.postinstall)' apps/desktop/package.json | sponge apps/desktop/package.json
-    jq '.scripts.build = ""' apps/desktop/desktop_native/package.json | sponge apps/desktop/desktop_native/package.json
-    cp ${desktop-native}/lib/libdesktop_native.so apps/desktop/desktop_native/desktop_native.linux-x64-musl.node
   '';
 
   postBuild = ''
     pushd apps/desktop
 
+    # desktop_native/index.js loads a file of that name regarldess of the libc being used
+    mv desktop_native/desktop_native.* desktop_native/desktop_native.linux-x64-musl.node
+
     npm exec electron-builder -- \
       --dir \
       -c.electronDist=${electron}/libexec/electron \
@@ -128,6 +101,32 @@ buildNpmPackage' {
     popd
   '';
 
+  doCheck = true;
+
+  nativeCheckInputs = [
+    dbus
+    (gnome.gnome-keyring.override { useWrappedDaemon = false; })
+  ];
+
+  checkFlags = [
+    "--skip=password::password::tests::test"
+  ];
+
+  checkPhase = ''
+    runHook preCheck
+
+    pushd ${cargoRoot}
+    export HOME=$(mktemp -d)
+    export -f cargoCheckHook runHook _eval _callImplicitHook
+    export cargoCheckType=release
+    dbus-run-session \
+      --config-file=${dbus}/share/dbus-1/session.conf \
+      -- bash -e -c cargoCheckHook
+    popd
+
+    runHook postCheck
+  '';
+
   installPhase = ''
     mkdir $out
 
@@ -154,11 +153,12 @@ buildNpmPackage' {
     popd
   '';
 
-  meta = with lib; {
+  meta = {
+    changelog = "https://github.com/bitwarden/clients/releases/tag/${src.rev}";
     inherit description;
     homepage = "https://bitwarden.com";
     license = lib.licenses.gpl3;
-    maintainers = with maintainers; [ amarshall kiwi ];
+    maintainers = with lib.maintainers; [ amarshall kiwi ];
     platforms = [ "x86_64-linux" ];
   };
 }
diff --git a/pkgs/tools/security/hologram/default.nix b/pkgs/tools/security/hologram/default.nix
index 1a7e45c8024..86bc4293747 100644
--- a/pkgs/tools/security/hologram/default.nix
+++ b/pkgs/tools/security/hologram/default.nix
@@ -24,7 +24,7 @@ buildGoModule rec {
   meta = with lib; {
     homepage = "https://github.com/AdRoll/hologram/";
     description = "Easy, painless AWS credentials on developer laptops";
-    maintainers = with maintainers; [ aaronjheng ];
+    maintainers = with maintainers; [ ];
     license = licenses.asl20;
   };
 }
diff --git a/pkgs/tools/system/jump/default.nix b/pkgs/tools/system/jump/default.nix
index c1e625e14c1..3ff64996d01 100644
--- a/pkgs/tools/system/jump/default.nix
+++ b/pkgs/tools/system/jump/default.nix
@@ -30,6 +30,6 @@ buildGoModule rec {
     '';
     homepage = "https://github.com/gsamokovarov/jump";
     license = licenses.mit;
-    maintainers = with maintainers; [ aaronjheng ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/tools/system/nkeys/default.nix b/pkgs/tools/system/nkeys/default.nix
index 22a22157f06..9914e6f1424 100644
--- a/pkgs/tools/system/nkeys/default.nix
+++ b/pkgs/tools/system/nkeys/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "nkeys";
-  version = "0.4.4";
+  version = "0.4.5";
 
   src = fetchFromGitHub {
     owner = "nats-io";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-ePpFzwjFKcm/xgt9TBl1CVnJYxO389rV9uLONeUeX0c=";
+    hash = "sha256-txPd4Q/ApaNutt2Ik5E2478tHAQmpTJQKYnHA9niz3E=";
   };
 
   vendorHash = "sha256-ozK0vimYs7wGplw1QhSu+q8R+YsIYHU4m08a7K6i78I=";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 5a55998eab4..3577d59436b 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1078,6 +1078,7 @@ with pkgs;
     antlr = antlr4_10;
     boost = boost177; # Configure checks for specific version.
     icu =  icu69;
+    protobuf = protobuf3_21;
   };
 
   broadlink-cli = callPackage ../tools/misc/broadlink-cli { };
@@ -5678,6 +5679,7 @@ with pkgs;
   hyprdim = callPackage ../applications/misc/hyprdim { };
 
   hyprland = callPackage ../applications/window-managers/hyprwm/hyprland {
+    stdenv = gcc13Stdenv;
     wlroots = callPackage ../applications/window-managers/hyprwm/hyprland/wlroots.nix { };
     udis86 = callPackage ../applications/window-managers/hyprwm/hyprland/udis86.nix { };
   };
@@ -28583,7 +28585,7 @@ with pkgs;
   ginkgo = callPackage ../development/tools/ginkgo { };
 
   gdlv = darwin.apple_sdk_11_0.callPackage ../development/tools/gdlv {
-    inherit (darwin.apple_sdk_11_0.frameworks) OpenGL AppKit;
+    inherit (darwin.apple_sdk_11_0.frameworks) Foundation CoreGraphics Metal AppKit;
   };
 
   go-bindata = callPackage ../development/tools/go-bindata { };
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 0caac147146..2e6d5e0e898 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -19827,10 +19827,10 @@ with self; {
 
   PerlLanguageServer = buildPerlPackage {
     pname = "Perl-LanguageServer";
-    version = "2.5.0";
+    version = "2.6.1";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/G/GR/GRICHTER/Perl-LanguageServer-2.5.0.tar.gz";
-      hash = "sha256-LQYcIkepqAT1JMkSuIN6mxivz6AZkpShcRsVD1oTmQQ=";
+      url = "mirror://cpan/authors/id/G/GR/GRICHTER/Perl-LanguageServer-2.6.1.tar.gz";
+      hash = "sha256-IDM0uwsEXMeHAu9DA0CdCB87aN3XRoNEdGOIJ8NMsZg=";
     };
     propagatedBuildInputs = [ AnyEvent AnyEventAIO ClassRefresh CompilerLexer Coro DataDump HashSafeKeys IOAIO JSON Moose PadWalker ];
     meta = {
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index e0d755933ff..22cceac4325 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -910,6 +910,8 @@ self: super: with self; {
 
   automate-home = callPackage ../development/python-modules/automate-home { };
 
+  automx2 = callPackage ../development/python-modules/automx2 { };
+
   autopage = callPackage ../development/python-modules/autopage { };
 
   autopep8 = callPackage ../development/python-modules/autopep8 { };