diff --git a/doc/builders/fetchers.chapter.md b/doc/builders/fetchers.chapter.md
index 551df86a58f4..ecff01894840 100644
--- a/doc/builders/fetchers.chapter.md
+++ b/doc/builders/fetchers.chapter.md
@@ -71,6 +71,7 @@ The main difference between `fetchurl` and `fetchzip` is in how they store the c
 
 - `relative`: Similar to using `git-diff`'s `--relative` flag, only keep changes inside the specified directory, making paths relative to it.
 - `stripLen`: Remove the first `stripLen` components of pathnames in the patch.
+- `decode`: Pipe the downloaded data through this command before processing it as a patch.
 - `extraPrefix`: Prefix pathnames by this string.
 - `excludes`: Exclude files matching these patterns (applies after the above arguments).
 - `includes`: Include only files matching these patterns (applies after the above arguments).
diff --git a/nixos/modules/services/hardware/fwupd.nix b/nixos/modules/services/hardware/fwupd.nix
index 4e7d730d127b..b8c2ac94845b 100644
--- a/nixos/modules/services/hardware/fwupd.nix
+++ b/nixos/modules/services/hardware/fwupd.nix
@@ -18,6 +18,12 @@ let
         fwupd = cfg.daemonSettings;
       };
     };
+
+    "fwupd/uefi_capsule.conf" = {
+      source = format.generate "uefi_capsule.conf" {
+        uefi_capsule = cfg.uefiCapsuleSettings;
+      };
+    };
   };
 
   originalEtc =
@@ -138,6 +144,16 @@ in {
           Configurations for the fwupd daemon.
         '';
       };
+
+      uefiCapsuleSettings = mkOption {
+        type = types.submodule {
+          freeformType = format.type.nestedTypes.elemType;
+        };
+        default = {};
+        description = lib.mdDoc ''
+          UEFI capsule configurations for the fwupd daemon.
+        '';
+      };
     };
   };
 
diff --git a/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py b/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py
index 3e3683211f1e..c92451997203 100755
--- a/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py
+++ b/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py
@@ -85,18 +85,18 @@ def copy_from_profile(profile: Optional[str], generation: int, specialisation: O
     return efi_file_path
 
 
-def describe_generation(generation_dir: str) -> str:
+def describe_generation(profile: Optional[str], generation: int, specialisation: Optional[str]) -> str:
     try:
-        with open("%s/nixos-version" % generation_dir) as f:
+        with open(profile_path(profile, generation, specialisation, "nixos-version")) as f:
             nixos_version = f.read()
     except IOError:
         nixos_version = "Unknown"
 
-    kernel_dir = os.path.dirname(os.path.realpath("%s/kernel" % generation_dir))
+    kernel_dir = os.path.dirname(profile_path(profile, generation, specialisation, "kernel"))
     module_dir = glob.glob("%s/lib/modules/*" % kernel_dir)[0]
     kernel_version = os.path.basename(module_dir)
 
-    build_time = int(os.path.getctime(generation_dir))
+    build_time = int(os.path.getctime(system_dir(profile, generation, specialisation)))
     build_date = datetime.datetime.fromtimestamp(build_time).strftime('%F')
 
     description = "@distroName@ {}, Linux Kernel {}, Built on {}".format(
@@ -131,11 +131,10 @@ def write_entry(profile: Optional[str], generation: int, specialisation: Optiona
                   "or renamed a file in `boot.initrd.secrets`", file=sys.stderr)
     entry_file = "@efiSysMountPoint@/loader/entries/%s" % (
         generation_conf_filename(profile, generation, specialisation))
-    generation_dir = os.readlink(system_dir(profile, generation, specialisation))
     tmp_path = "%s.tmp" % (entry_file)
-    kernel_params = "init=%s/init " % generation_dir
+    kernel_params = "init=%s " % profile_path(profile, generation, specialisation, "init")
 
-    with open("%s/kernel-params" % (generation_dir)) as params_file:
+    with open(profile_path(profile, generation, specialisation, "kernel-params")) as params_file:
         kernel_params = kernel_params + params_file.read()
     with open(tmp_path, 'w') as f:
         f.write(BOOT_ENTRY.format(title=title,
@@ -143,7 +142,7 @@ def write_entry(profile: Optional[str], generation: int, specialisation: Optiona
                     kernel=kernel,
                     initrd=initrd,
                     kernel_params=kernel_params,
-                    description=describe_generation(generation_dir)))
+                    description=describe_generation(profile, generation, specialisation)))
         if machine_id is not None:
             f.write("machine-id %s\n" % machine_id)
     os.rename(tmp_path, entry_file)
@@ -296,7 +295,7 @@ def main() -> None:
     remove_old_entries(gens)
     for gen in gens:
         try:
-            is_default = os.readlink(system_dir(*gen)) == args.default_config
+            is_default = os.path.dirname(profile_path(*gen, "init")) == args.default_config
             write_entry(*gen, machine_id, current=is_default)
             for specialisation in get_specialisations(*gen):
                 write_entry(*specialisation, machine_id, current=is_default)
diff --git a/nixos/tests/kea.nix b/nixos/tests/kea.nix
index b1d5894cc7cd..b4095893b482 100644
--- a/nixos/tests/kea.nix
+++ b/nixos/tests/kea.nix
@@ -1,3 +1,10 @@
+# This test verifies DHCPv4 interaction between a client and a router.
+# For successful DHCP allocations a dynamic update request is sent
+# towards a nameserver to allocate a name in the lan.nixos.test zone.
+# We then verify whether client and router can ping each other, and
+# that the nameserver can resolve the clients fqdn to the correct IP
+# address.
+
 import ./make-test-python.nix ({ pkgs, lib, ...}: {
   meta.maintainers = with lib.maintainers; [ hexa ];
 
@@ -8,17 +15,17 @@ import ./make-test-python.nix ({ pkgs, lib, ...}: {
       virtualisation.vlans = [ 1 ];
 
       networking = {
-        useNetworkd = true;
         useDHCP = false;
         firewall.allowedUDPPorts = [ 67 ];
       };
 
       systemd.network = {
+        enable = true;
         networks = {
           "01-eth1" = {
             name = "eth1";
             networkConfig = {
-              Address = "10.0.0.1/30";
+              Address = "10.0.0.1/29";
             };
           };
         };
@@ -45,13 +52,115 @@ import ./make-test-python.nix ({ pkgs, lib, ...}: {
           };
 
           subnet4 = [ {
-            subnet = "10.0.0.0/30";
+            subnet = "10.0.0.0/29";
             pools = [ {
-              pool = "10.0.0.2 - 10.0.0.2";
+              pool = "10.0.0.3 - 10.0.0.3";
             } ];
           } ];
+
+          # Enable communication between dhcp4 and a local dhcp-ddns
+          # instance.
+          # https://kea.readthedocs.io/en/kea-2.2.0/arm/dhcp4-srv.html#ddns-for-dhcpv4
+          dhcp-ddns = {
+            enable-updates = true;
+          };
+
+          ddns-send-updates = true;
+          ddns-qualifying-suffix = "lan.nixos.test.";
         };
       };
+
+      services.kea.dhcp-ddns = {
+        enable = true;
+        settings = {
+          forward-ddns = {
+            # Configure updates of a forward zone named `lan.nixos.test`
+            # hosted at the nameserver at 10.0.0.2
+            # https://kea.readthedocs.io/en/kea-2.2.0/arm/ddns.html#adding-forward-dns-servers
+            ddns-domains = [ {
+              name = "lan.nixos.test.";
+              # Use a TSIG key in production!
+              key-name = "";
+              dns-servers = [ {
+                ip-address = "10.0.0.2";
+                port = 53;
+              } ];
+            } ];
+          };
+        };
+      };
+    };
+
+    nameserver = { config, pkgs, ... }: {
+      virtualisation.vlans = [ 1 ];
+
+      networking = {
+        useDHCP = false;
+        firewall.allowedUDPPorts = [ 53 ];
+      };
+
+      systemd.network = {
+        enable = true;
+        networks = {
+          "01-eth1" = {
+            name = "eth1";
+            networkConfig = {
+              Address = "10.0.0.2/29";
+            };
+          };
+        };
+      };
+
+      services.resolved.enable = false;
+
+      # Set up an authoritative nameserver, serving the `lan.nixos.test`
+      # zone and configure an ACL that allows dynamic updates from
+      # the router's ip address.
+      # This ACL is likely insufficient for production usage. Please
+      # use TSIG keys.
+      services.knot = let
+        zone = pkgs.writeTextDir "lan.nixos.test.zone" ''
+          @ SOA ns.nixos.test nox.nixos.test 0 86400 7200 3600000 172800
+          @ NS nameserver
+          nameserver A 10.0.0.3
+          router A 10.0.0.1
+        '';
+        zonesDir = pkgs.buildEnv {
+          name = "knot-zones";
+          paths = [ zone ];
+        };
+      in {
+        enable = true;
+        extraArgs = [
+          "-v"
+        ];
+        extraConfig = ''
+          server:
+              listen: 0.0.0.0@53
+
+          log:
+            - target: syslog
+              any: debug
+
+          acl:
+            - id: dhcp_ddns
+              address: 10.0.0.1
+              action: update
+
+          template:
+            - id: default
+              storage: ${zonesDir}
+              zonefile-sync: -1
+              zonefile-load: difference-no-serial
+              journal-content: all
+
+          zone:
+            - domain: lan.nixos.test
+              file: lan.nixos.test.zone
+              acl: [dhcp_ddns]
+        '';
+      };
+
     };
 
     client = { config, pkgs, ... }: {
@@ -70,6 +179,7 @@ import ./make-test-python.nix ({ pkgs, lib, ...}: {
     router.wait_for_unit("kea-dhcp4-server.service")
     client.wait_for_unit("systemd-networkd-wait-online.service")
     client.wait_until_succeeds("ping -c 5 10.0.0.1")
-    router.wait_until_succeeds("ping -c 5 10.0.0.2")
+    router.wait_until_succeeds("ping -c 5 10.0.0.3")
+    nameserver.wait_until_succeeds("kdig +short client.lan.nixos.test @10.0.0.2 | grep -q 10.0.0.3")
   '';
 })
diff --git a/nixos/tests/knot.nix b/nixos/tests/knot.nix
index 203fd03fac26..2ecbf69194bb 100644
--- a/nixos/tests/knot.nix
+++ b/nixos/tests/knot.nix
@@ -31,7 +31,7 @@ let
   # DO NOT USE pkgs.writeText IN PRODUCTION. This put secrets in the nix store!
   tsigFile = pkgs.writeText "tsig.conf" ''
     key:
-      - id: slave_key
+      - id: xfr_key
         algorithm: hmac-sha256
         secret: zOYgOgnzx3TGe5J5I/0kxd7gTcxXhLYMEq3Ek3fY37s=
   '';
@@ -43,7 +43,7 @@ in {
 
 
   nodes = {
-    master = { lib, ... }: {
+    primary = { lib, ... }: {
       imports = [ common ];
 
       # trigger sched_setaffinity syscall
@@ -64,22 +64,17 @@ in {
         server:
             listen: 0.0.0.0@53
             listen: ::@53
-
-        acl:
-          - id: slave_acl
-            address: 192.168.0.2
-            key: slave_key
-            action: transfer
+            automatic-acl: true
 
         remote:
-          - id: slave
+          - id: secondary
             address: 192.168.0.2@53
+            key: xfr_key
 
         template:
           - id: default
             storage: ${knotZonesEnv}
-            notify: [slave]
-            acl: [slave_acl]
+            notify: [secondary]
             dnssec-signing: on
             # Input-only zone files
             # https://www.knot-dns.cz/docs/2.8/html/operation.html#example-3
@@ -105,7 +100,7 @@ in {
       '';
     };
 
-    slave = { lib, ... }: {
+    secondary = { lib, ... }: {
       imports = [ common ];
       networking.interfaces.eth1 = {
         ipv4.addresses = lib.mkForce [
@@ -122,21 +117,16 @@ in {
         server:
             listen: 0.0.0.0@53
             listen: ::@53
-
-        acl:
-          - id: notify_from_master
-            address: 192.168.0.1
-            action: notify
+            automatic-acl: true
 
         remote:
-          - id: master
+          - id: primary
             address: 192.168.0.1@53
-            key: slave_key
+            key: xfr_key
 
         template:
           - id: default
-            master: master
-            acl: [notify_from_master]
+            master: primary
             # zonefileless setup
             # https://www.knot-dns.cz/docs/2.8/html/operation.html#example-2
             zonefile-sync: -1
@@ -174,19 +164,19 @@ in {
   };
 
   testScript = { nodes, ... }: let
-    master4 = (lib.head nodes.master.config.networking.interfaces.eth1.ipv4.addresses).address;
-    master6 = (lib.head nodes.master.config.networking.interfaces.eth1.ipv6.addresses).address;
+    primary4 = (lib.head nodes.primary.config.networking.interfaces.eth1.ipv4.addresses).address;
+    primary6 = (lib.head nodes.primary.config.networking.interfaces.eth1.ipv6.addresses).address;
 
-    slave4 = (lib.head nodes.slave.config.networking.interfaces.eth1.ipv4.addresses).address;
-    slave6 = (lib.head nodes.slave.config.networking.interfaces.eth1.ipv6.addresses).address;
+    secondary4 = (lib.head nodes.secondary.config.networking.interfaces.eth1.ipv4.addresses).address;
+    secondary6 = (lib.head nodes.secondary.config.networking.interfaces.eth1.ipv6.addresses).address;
   in ''
     import re
 
     start_all()
 
     client.wait_for_unit("network.target")
-    master.wait_for_unit("knot.service")
-    slave.wait_for_unit("knot.service")
+    primary.wait_for_unit("knot.service")
+    secondary.wait_for_unit("knot.service")
 
 
     def test(host, query_type, query, pattern):
@@ -195,7 +185,7 @@ in {
         assert re.search(pattern, out), f'Did not match "{pattern}"'
 
 
-    for host in ("${master4}", "${master6}", "${slave4}", "${slave6}"):
+    for host in ("${primary4}", "${primary6}", "${secondary4}", "${secondary6}"):
         with subtest(f"Interrogate {host}"):
             test(host, "SOA", "example.com", r"start of authority.*noc\.example\.com\.")
             test(host, "A", "example.com", r"has no [^ ]+ record")
@@ -211,6 +201,6 @@ in {
             test(host, "RRSIG", "www.example.com", r"RR set signature is")
             test(host, "DNSKEY", "example.com", r"DNSSEC key is")
 
-    master.log(master.succeed("systemd-analyze security knot.service | grep -v '✓'"))
+    primary.log(primary.succeed("systemd-analyze security knot.service | grep -v '✓'"))
   '';
 })
diff --git a/pkgs/applications/audio/go-musicfox/default.nix b/pkgs/applications/audio/go-musicfox/default.nix
index 66f2a1a02d12..da0eef815c50 100644
--- a/pkgs/applications/audio/go-musicfox/default.nix
+++ b/pkgs/applications/audio/go-musicfox/default.nix
@@ -10,13 +10,13 @@
 # gcc only supports objc on darwin
 buildGoModule.override { stdenv = clangStdenv; } rec {
   pname = "go-musicfox";
-  version = "3.7.2";
+  version = "3.7.3";
 
   src = fetchFromGitHub {
     owner = "anhoder";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-Wc9HFvBSLQA7jT+LJj+tyHzRbszhR2XD1/3C+SdrAGA=";
+    hash = "sha256-aM7IJGRRY2V2Rovj042ctg5254EUw1bTuoRCp9Za1FY=";
   };
 
   deleteVendor = true;
@@ -45,6 +45,6 @@ buildGoModule.override { stdenv = clangStdenv; } rec {
     homepage = "https://github.com/anhoder/go-musicfox";
     license = licenses.mit;
     mainProgram = "musicfox";
-    maintainers = with maintainers; [ zendo ];
+    maintainers = with maintainers; [ zendo Ruixi-rebirth ];
   };
 }
diff --git a/pkgs/applications/audio/mixxx/default.nix b/pkgs/applications/audio/mixxx/default.nix
index 76c5de75ef54..e72e809e9175 100644
--- a/pkgs/applications/audio/mixxx/default.nix
+++ b/pkgs/applications/audio/mixxx/default.nix
@@ -52,13 +52,13 @@
 
 mkDerivation rec {
   pname = "mixxx";
-  version = "2.3.3";
+  version = "2.3.4";
 
   src = fetchFromGitHub {
     owner = "mixxxdj";
     repo = "mixxx";
     rev = version;
-    sha256 = "sha256-NRtrEobdJMFgDXrEeb2t1zeVN8pQP7+pda2DSU/yNX8=";
+    sha256 = "sha256-1hOMU/Mdk1vT0GQipn/WX2fm9ddN0mPIq7kf2i2w3xQ=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
@@ -116,7 +116,7 @@ mkDerivation rec {
 
   # mixxx installs udev rules to DATADIR instead of SYSCONFDIR
   # let's disable this and install udev rules manually via postInstall
-  # see https://github.com/mixxxdj/mixxx/blob/2.3.3/CMakeLists.txt#L1381-L1392
+  # see https://github.com/mixxxdj/mixxx/blob/2.3.4/CMakeLists.txt#L1381-L1392
   cmakeFlags = [
     "-DINSTALL_USER_UDEV_RULES=OFF"
   ];
diff --git a/pkgs/applications/audio/mympd/default.nix b/pkgs/applications/audio/mympd/default.nix
index a1a958c3d558..d987c770c983 100644
--- a/pkgs/applications/audio/mympd/default.nix
+++ b/pkgs/applications/audio/mympd/default.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mympd";
-  version = "10.2.4";
+  version = "10.2.5";
 
   src = fetchFromGitHub {
     owner = "jcorporation";
     repo = "myMPD";
     rev = "v${version}";
-    sha256 = "sha256-12hCIAwrLQkwiU9t9nNPBdIiHfMidfErSWOA0FPfhBQ=";
+    sha256 = "sha256-ZxGMvbm9GKhhfCNZdeIYUh2FF4c3vXtvRdu24u3Zrtg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/audio/qmmp/default.nix b/pkgs/applications/audio/qmmp/default.nix
index 00931a21011c..5712eacd2a2f 100644
--- a/pkgs/applications/audio/qmmp/default.nix
+++ b/pkgs/applications/audio/qmmp/default.nix
@@ -5,16 +5,14 @@
 # input plugins
 , libmad, taglib, libvorbis, libogg, flac, libmpcdec, libmodplug, libsndfile
 , libcdio, cdparanoia, libcddb, faad2, ffmpeg, wildmidi, libbs2b, game-music-emu
+, libarchive, opusfile, soxr, wavpack
 # output plugins
-, alsa-lib, libpulseaudio, pipewire
+, alsa-lib, libpulseaudio, pipewire, libjack2
 # effect plugins
 , libsamplerate
 }:
 
 # Additional plugins that can be added:
-#  wavpack (https://www.wavpack.com/)
-#  Ogg Opus support
-#  JACK audio support
 #  ProjectM visualization plugin
 
 # To make MIDI work we must tell Qmmp what instrument configuration to use (and
@@ -45,8 +43,9 @@ stdenv.mkDerivation rec {
       # input plugins
       libmad taglib libvorbis libogg flac libmpcdec libmodplug libsndfile
       libcdio cdparanoia libcddb faad2 ffmpeg wildmidi libbs2b game-music-emu
+      libarchive opusfile soxr wavpack
       # output plugins
-      alsa-lib libpulseaudio pipewire
+      alsa-lib libpulseaudio pipewire libjack2
       # effect plugins
       libsamplerate
     ];
diff --git a/pkgs/applications/audio/tageditor/default.nix b/pkgs/applications/audio/tageditor/default.nix
index 47c6a32ad1f2..b79e9c217e51 100644
--- a/pkgs/applications/audio/tageditor/default.nix
+++ b/pkgs/applications/audio/tageditor/default.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation rec {
   pname = "tageditor";
-  version = "3.7.7";
+  version = "3.7.8";
 
   src = fetchFromGitHub {
     owner = "martchus";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-CjbV/Uwpe+x7LBDUDY+NRonUt549MrjGnlJ2olIrKQ4=";
+    hash = "sha256-/34KS6nxpIsKEklSRpO+AmGAdpJhapoGe24DCCodU38=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/editors/cudatext/default.nix b/pkgs/applications/editors/cudatext/default.nix
index 08e6d7ea447e..5ff9dd593e57 100644
--- a/pkgs/applications/editors/cudatext/default.nix
+++ b/pkgs/applications/editors/cudatext/default.nix
@@ -38,13 +38,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "cudatext";
-  version = "1.186.2";
+  version = "1.187.0";
 
   src = fetchFromGitHub {
     owner = "Alexey-T";
     repo = "CudaText";
     rev = version;
-    hash = "sha256-qpxYzman93e+u0BHxdhBUyfnZOR4hjQpTuNikGDNQCA=";
+    hash = "sha256-Ri/VTJF59GCJdhbMWRAYaQifj7FjVYSACywpq8gHKXg=";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/editors/cudatext/deps.json b/pkgs/applications/editors/cudatext/deps.json
index 86854afd4828..85cefe144463 100644
--- a/pkgs/applications/editors/cudatext/deps.json
+++ b/pkgs/applications/editors/cudatext/deps.json
@@ -11,18 +11,18 @@
   },
   "ATFlatControls": {
     "owner": "Alexey-T",
-    "rev": "2023.02.05",
-    "hash": "sha256-ZOnIhUnFd+7mBEz6YIhUOQkhBbCNeTFD0tfUILuC1x4="
+    "rev": "2023.03.10",
+    "hash": "sha256-RHNWJN+P3w67UupeikHn6GrWZCOSoGCrP7BYG7myx+A="
   },
   "ATSynEdit": {
     "owner": "Alexey-T",
-    "rev": "2023.03.02",
-    "hash": "sha256-rZzcWED8c68wtejUho71kbPtLyDyOlXpS/eg8Ti0r2A="
+    "rev": "2023.03.10",
+    "hash": "sha256-NdLg/cQNy5SaC/zPb3bLplUe6FiO7ePi1++WDIvQziI="
   },
   "ATSynEdit_Cmp": {
     "owner": "Alexey-T",
-    "rev": "2022.10.18",
-    "hash": "sha256-yaS1XF0v5rkfKj9aksSc4XimKh5wpL7yLt4ElcIKAIE="
+    "rev": "2023.03.10",
+    "hash": "sha256-KfzTO0GMFkWRFxbRSdKAh4sr7cx7A2snj/UO1nsvacI="
   },
   "EControl": {
     "owner": "Alexey-T",
diff --git a/pkgs/applications/emulators/box64/default.nix b/pkgs/applications/emulators/box64/default.nix
index 12c13bb9ae87..38ff3db999f6 100644
--- a/pkgs/applications/emulators/box64/default.nix
+++ b/pkgs/applications/emulators/box64/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , gitUpdater
 , cmake
 , python3
@@ -16,24 +15,15 @@ assert withDynarec -> stdenv.hostPlatform.isAarch64;
 
 stdenv.mkDerivation rec {
   pname = "box64";
-  version = "0.2.0";
+  version = "0.2.2";
 
   src = fetchFromGitHub {
     owner = "ptitSeb";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-eMp2eSWMRJQvLRQKUirBua6Kt7ZtyebfUnKIlibkNFU=";
+    hash = "sha256-aIvL0H0k0/lz2lCLxB17RxNm0cxVozYthy0z85/FuUE=";
   };
 
-  patches = [
-    # Fix mmx & cppThreads tests on x86_64
-    # Remove when version > 0.2.0
-    (fetchpatch {
-      url = "https://github.com/ptitSeb/box64/commit/3819aecf078fcf47b2bc73713531361406a51895.patch";
-      hash = "sha256-11hy5Ol5FSE/kNJmXAIwNLbapldhlZGKtOLIoL6pYrg=";
-    })
-  ];
-
   nativeBuildInputs = [
     cmake
     python3
diff --git a/pkgs/applications/misc/dunst/default.nix b/pkgs/applications/misc/dunst/default.nix
index 24bfaf785e1f..18110a07c374 100644
--- a/pkgs/applications/misc/dunst/default.nix
+++ b/pkgs/applications/misc/dunst/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "dunst";
-  version = "1.9.0";
+  version = "1.9.1";
 
   src = fetchFromGitHub {
     owner = "dunst-project";
     repo = "dunst";
     rev = "v${version}";
-    sha256 = "sha256-fRPhu+kpwLPvdzIpXSjXFzQTfv4xewOMv/1ZqLJw3dk=";
+    sha256 = "sha256-oCeC/rbI/sydcQ7Rv9feEzw2Gcl7mUde4OOv50dyUSg=";
   };
 
   nativeBuildInputs = [ perl pkg-config which systemd makeWrapper ];
diff --git a/pkgs/applications/misc/gallery-dl/default.nix b/pkgs/applications/misc/gallery-dl/default.nix
index 4da566bcfc82..aaf5ec904923 100644
--- a/pkgs/applications/misc/gallery-dl/default.nix
+++ b/pkgs/applications/misc/gallery-dl/default.nix
@@ -2,13 +2,13 @@
 
 buildPythonApplication rec {
   pname = "gallery-dl";
-  version = "1.24.5";
+  version = "1.25.0";
   format = "setuptools";
 
   src = fetchPypi {
     inherit version;
     pname = "gallery_dl";
-    sha256 = "sha256-P71JiGI9PpWMAlgk5TwQa/h3AUEZSEZ6/MahY+IIy9M=";
+    sha256 = "sha256-WxmH6uAMnbmXZWOkLh4B6rR6RV2xfSVBZ7v47AwlwRY=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/applications/misc/pe-bear/default.nix b/pkgs/applications/misc/pe-bear/default.nix
index 06642f7e496a..a50b53378e7d 100644
--- a/pkgs/applications/misc/pe-bear/default.nix
+++ b/pkgs/applications/misc/pe-bear/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pe-bear";
-  version = "0.6.5";
+  version = "0.6.5.2";
 
   src = fetchFromGitHub {
     owner = "hasherezade";
     repo = "pe-bear";
     rev = "v${version}";
-    sha256 = "sha256-qFEfrXX2Rpmo4eF1Z/dKBN/NxMovK3mDfQPxYp85eB8=";
+    sha256 = "sha256-00OebZZUUwQ1yruTKEUj+bNEKY/CuzdLEbejnnagPnY=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/networking/cluster/karmor/default.nix b/pkgs/applications/networking/cluster/karmor/default.nix
index 88967da07e78..31285ee70723 100644
--- a/pkgs/applications/networking/cluster/karmor/default.nix
+++ b/pkgs/applications/networking/cluster/karmor/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "karmor";
-  version = "0.11.7";
+  version = "0.12.4";
 
   src = fetchFromGitHub {
     owner = "kubearmor";
     repo = "kubearmor-client";
     rev = "v${version}";
-    hash = "sha256-sXiv+aCYuN6GJB+6/G4Z1Oe/fB3OO+jhSvCAFUaiD3g=";
+    hash = "sha256-mz4RWKq3HNpxNl7i8wE1q2PoICUQrzTUSmyZII3GhS4=";
   };
 
-  vendorHash = "sha256-9yCT9GspX2Tl6dISF8qvDF/Tm2mfwuDH+DrouFmxpj8=";
+  vendorHash = "sha256-Nxi6sNR7bDmeTcrg7Zx7UIqLvzNY6HK5qSSdfM2snj0=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/applications/networking/cluster/kluctl/default.nix b/pkgs/applications/networking/cluster/kluctl/default.nix
index 6df6b472a428..755209adc94c 100644
--- a/pkgs/applications/networking/cluster/kluctl/default.nix
+++ b/pkgs/applications/networking/cluster/kluctl/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "kluctl";
-  version = "2.19.2";
+  version = "2.19.3";
 
   src = fetchFromGitHub {
     owner = "kluctl";
     repo = "kluctl";
     rev = "v${version}";
-    hash = "sha256-7+hXjYaCqInhP3O8IS8IwkUTGhnmcIWRR1qqvA6UQoc=";
+    hash = "sha256-yp471eWrwnJiCAVwqnZzq1rN1Mt4d42ymVvsUtTyOsc=";
   };
 
-  vendorHash = "sha256-xBUrY8v4yHtWGaaRXHxQRGdZHzMGoJX2hFLL+0Vb1QY=";
+  vendorHash = "sha256-Ws0Qaw2hk8alOF/K5Wd0ZcMGr6Q3JiQIo/kHOXiGvmg=";
 
   ldflags = [ "-s" "-w" "-X main.version=v${version}" ];
 
diff --git a/pkgs/applications/networking/cluster/velero/default.nix b/pkgs/applications/networking/cluster/velero/default.nix
index dcb4dd9eb08d..3934bc224003 100644
--- a/pkgs/applications/networking/cluster/velero/default.nix
+++ b/pkgs/applications/networking/cluster/velero/default.nix
@@ -2,14 +2,14 @@
 
 buildGoModule rec {
   pname = "velero";
-  version = "1.10.1";
+  version = "1.10.2";
 
 
   src = fetchFromGitHub {
     owner = "vmware-tanzu";
     repo = "velero";
     rev = "v${version}";
-    sha256 = "sha256-jN45chUeoGJGJWD6Rj6duNE36/QCzPqci8V3h1OHtw4=";
+    sha256 = "sha256-VrzDCRZR2Sh4yk0451016zTPKzV19MSgXXeg8tXWd8o=";
   };
 
   ldflags = [
@@ -20,7 +20,7 @@ buildGoModule rec {
     "-X github.com/vmware-tanzu/velero/pkg/buildinfo.GitSHA=none"
   ];
 
-  vendorHash = "sha256-mvVwf4w/65L+F6aiTNf2jmJtaT1EpWCQJ6r9NHUUUqQ=";
+  vendorHash = "sha256-zpJ2X4+Yo5BSmlnB2f5Af36jXu8oc5saRfPupstQWC4=";
 
   excludedPackages = [ "issue-template-gen" "release-tools" "v1" "velero-restic-restore-helper" ];
 
diff --git a/pkgs/applications/networking/instant-messengers/jami/default.nix b/pkgs/applications/networking/instant-messengers/jami/default.nix
index 1c9f581d463b..d2896b82f450 100644
--- a/pkgs/applications/networking/instant-messengers/jami/default.nix
+++ b/pkgs/applications/networking/instant-messengers/jami/default.nix
@@ -64,14 +64,14 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "jami";
-  version = "20230206.0";
+  version = "20230306.0";
 
   src = fetchFromGitLab {
     domain = "git.jami.net";
     owner = "savoirfairelinux";
     repo = "jami-client-qt";
     rev = "stable/${version}";
-    hash = "sha256-MQ28UJUvgJoPk65neUgMrG+SxOcfnUl803urEFQ7468=";
+    hash = "sha256-OQo5raXl2OIAF/iLMCNT32b4xRZ/jCN0EkgH9rJXbFE=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/networking/p2p/fragments/default.nix b/pkgs/applications/networking/p2p/fragments/default.nix
index ebeba4c010e8..932cfbbbe3a2 100644
--- a/pkgs/applications/networking/p2p/fragments/default.nix
+++ b/pkgs/applications/networking/p2p/fragments/default.nix
@@ -13,7 +13,6 @@
 , ninja
 , openssl
 , pkg-config
-, python3
 , rustPlatform
 , sqlite
 , transmission
@@ -31,24 +30,22 @@ let
   });
 in stdenv.mkDerivation rec {
   pname = "fragments";
-  version = "2.0.2";
+  version = "2.1";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "World";
     repo = "Fragments";
     rev = version;
-    sha256 = "sha256-CMa1yka0kOxMhxSuazlJxTk4fzxuuwKYLBpEMwHbBUE=";
+    sha256 = "sha256-/KtUcj41s9WeHzIgGWhYQv6oD/Df7WOnJAPuS6yGLHk=";
   };
 
-  postPatch = ''
-    patchShebangs build-aux/meson/postinstall.py
-  '';
-
+  # https://github.com/gtk-rs/gtk4-rs/issues/1201
+  patches = [ ./gtk4-rs.patch ];
   cargoDeps = rustPlatform.fetchCargoTarball {
-    inherit src;
+    inherit src patches;
     name = "${pname}-${version}";
-    hash = "sha256-/rFZcbpITYkpSCEZp9XH253u90RGmuVLEBGIRNBgI/o=";
+    hash = "sha256-bhQHXx7kZFL+qb+k0gN1NZZ6LYjBUHuNqU528f0QAg0=";
   };
 
   nativeBuildInputs = [
@@ -58,7 +55,6 @@ in stdenv.mkDerivation rec {
     meson
     ninja
     pkg-config
-    python3
     wrapGAppsHook4
   ] ++ (with rustPlatform; [
     cargoSetupHook
diff --git a/pkgs/applications/networking/p2p/fragments/gtk4-rs.patch b/pkgs/applications/networking/p2p/fragments/gtk4-rs.patch
new file mode 100644
index 000000000000..4e2a73554309
--- /dev/null
+++ b/pkgs/applications/networking/p2p/fragments/gtk4-rs.patch
@@ -0,0 +1,28 @@
+diff --git a/Cargo.lock b/Cargo.lock
+index c0dfa2a..2decf88 100644
+--- a/Cargo.lock
++++ b/Cargo.lock
+@@ -1158,9 +1158,9 @@ checksum = "da5bf7748fd4cd0b2490df8debcc911809dbcbee4ece9531b96c29a9c729de5a"
+ 
+ [[package]]
+ name = "gtk4"
+-version = "0.4.8"
++version = "0.4.9"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "c64f0c2a3d80e899dc3febddad5bac193ffcf74a0fd7e31037f30dd34d6f7396"
++checksum = "4e8ae5aef2793bc3551b5e5e3fa062a5de54bb1eccf10dfa4effe9e4384fbbbc"
+ dependencies = [
+  "bitflags",
+  "cairo-rs",
+@@ -1181,9 +1181,9 @@ dependencies = [
+ 
+ [[package]]
+ name = "gtk4-macros"
+-version = "0.4.8"
++version = "0.4.9"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "fafbcc920af4eb677d7d164853e7040b9de5a22379c596f570190c675d45f7a7"
++checksum = "d9a4a8077b3a392dd7d637924529e1213d2e0c8e4d531177bc3355e86c257a54"
+ dependencies = [
+  "anyhow",
+  "proc-macro-crate 1.2.1",
diff --git a/pkgs/applications/science/biology/diamond/default.nix b/pkgs/applications/science/biology/diamond/default.nix
index 2b34f61ab2cf..c81cc35ff08e 100644
--- a/pkgs/applications/science/biology/diamond/default.nix
+++ b/pkgs/applications/science/biology/diamond/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "diamond";
-  version = "2.1.4";
+  version = "2.1.5";
 
   src = fetchFromGitHub {
     owner = "bbuchfink";
     repo = "diamond";
     rev = "v${version}";
-    sha256 = "sha256-Og1cxEMJ24cncNDD2dXwy58OZ/nJmGdqrMRr5Y6YmHo=";
+    sha256 = "sha256-ud11GNuDL1HDNaAzkNB/ebuPJR4wgWYy49zBr93BtSo=";
   };
 
 
diff --git a/pkgs/applications/virtualization/nixpacks/default.nix b/pkgs/applications/virtualization/nixpacks/default.nix
index 695cd970b7bb..861d4877e428 100644
--- a/pkgs/applications/virtualization/nixpacks/default.nix
+++ b/pkgs/applications/virtualization/nixpacks/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "nixpacks";
-  version = "1.4.1";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "railwayapp";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-zxgNHzKXekZnk0OsHw30u4L9U2mIT/MryZuAQ2EBEYg=";
+    sha256 = "sha256-1IJboAy0GYgkysY84+wHHOulA/aiux7pgCtxfr0CFV8=";
   };
 
-  cargoHash = "sha256-tsGyrU/5yp5PJ2d5HUoaw/jhGgYyDt6qBK+DvC79kmY=";
+  cargoHash = "sha256-kAou5pPOwbOZ9n8+fQJ4+Hh9x7wrY898R5XTuUEvF2o=";
 
   # skip test due FHS dependency
   doCheck = false;
diff --git a/pkgs/applications/window-managers/weston/default.nix b/pkgs/applications/window-managers/weston/default.nix
index 9886fc97af14..49a18187d76c 100644
--- a/pkgs/applications/window-managers/weston/default.nix
+++ b/pkgs/applications/window-managers/weston/default.nix
@@ -6,6 +6,7 @@
 , pipewire ? null, pango ? null, libunwind ? null, freerdp ? null, vaapi ? null
 , libva ? null, libwebp ? null, xwayland ? null
 # beware of null defaults, as the parameters *are* supplied by callPackage by default
+, buildDemo ? false
 }:
 
 stdenv.mkDerivation rec {
@@ -32,7 +33,7 @@ stdenv.mkDerivation rec {
     "-Dremoting=false" # TODO
     "-Dpipewire=${lib.boolToString (pipewire != null)}"
     "-Dimage-webp=${lib.boolToString (libwebp != null)}"
-    "-Ddemo-clients=false"
+    (lib.mesonBool "demo-clients" buildDemo)
     "-Dsimple-clients="
     "-Dtest-junit-xml=false"
     # TODO:
diff --git a/pkgs/build-support/fetchpatch/default.nix b/pkgs/build-support/fetchpatch/default.nix
index d059715cedc1..a3ca6685147d 100644
--- a/pkgs/build-support/fetchpatch/default.nix
+++ b/pkgs/build-support/fetchpatch/default.nix
@@ -8,6 +8,7 @@
 
 { relative ? null
 , stripLen ? 0
+, decode ? "cat" # custom command to decode patch e.g. base64 -d
 , extraPrefix ? null
 , excludes ? []
 , includes ? []
@@ -36,6 +37,17 @@ fetchurl ({
       exit 1
     fi
 
+    set +e
+    ${decode} < "$out" > "$tmpfile"
+    if [ $? -ne 0 ] || [ ! -s "$tmpfile" ]; then
+        echo 'Failed to decode patch with command "'${lib.escapeShellArg decode}'"' >&2
+        echo 'Fetched file was (limited to 128 bytes):' >&2
+        od -A x -t x1z -v -N 128 "$out" >&2
+        exit 1
+    fi
+    set -e
+    mv "$tmpfile" "$out"
+
     "${patchutils}/bin/lsdiff" \
       ${lib.optionalString (relative != null) "-p1 -i ${lib.escapeShellArg relative}/'*'"} \
       "$out" \
@@ -76,5 +88,6 @@ fetchurl ({
     mv "$tmpfile" "$out"
   '' + postFetch;
 } // builtins.removeAttrs args [
-  "relative" "stripLen" "extraPrefix" "excludes" "includes" "revert" "postFetch"
+  "relative" "stripLen" "decode" "extraPrefix" "excludes" "includes" "revert"
+  "postFetch"
 ])
diff --git a/pkgs/build-support/fetchpatch/tests.nix b/pkgs/build-support/fetchpatch/tests.nix
index 38bbb8ba69d2..0a27f1bc70e7 100644
--- a/pkgs/build-support/fetchpatch/tests.nix
+++ b/pkgs/build-support/fetchpatch/tests.nix
@@ -25,4 +25,11 @@ in
     revert = true;
     sha256 = if isFetchpatch2 then "sha256-+UKmEbr2rIAweCav/hR/7d4ZrYV84ht/domTrHtm8sM=" else "sha256-+UKmEbr2rIAweCav/hR/7d4ZrYV84ht/domTrHtm8sM=";
   };
+
+  decode = testers.invalidateFetcherByDrvHash fetchpatch {
+    name = "gcc.patch";
+    url = "https://chromium.googlesource.com/aosp/platform/external/libchrome/+/f37ae3b1a873d74182a2ac31d96742ead9c1f523^!?format=TEXT";
+    decode = "base64 -d";
+    sha256 = if isFetchpatch2 then "sha256-oMvPlmzE51ArI+EvFxONXkqmNee39106/O1ikG0Bdso=" else "sha256-SJHk8XrutqAyoIdORlhCpBCN626P+uzed7mjKz5eQYY=";
+  };
 }
diff --git a/pkgs/data/misc/v2ray-domain-list-community/default.nix b/pkgs/data/misc/v2ray-domain-list-community/default.nix
index 4df61f1f4120..adbbbb201e3e 100644
--- a/pkgs/data/misc/v2ray-domain-list-community/default.nix
+++ b/pkgs/data/misc/v2ray-domain-list-community/default.nix
@@ -3,12 +3,12 @@
 let
   generator = pkgsBuildBuild.buildGoModule rec {
     pname = "v2ray-domain-list-community";
-    version = "20230227064844";
+    version = "20230311145412";
     src = fetchFromGitHub {
       owner = "v2fly";
       repo = "domain-list-community";
       rev = version;
-      hash = "sha256-popSTy1BXKUhWtYePlERVqui+wiltyTaYk7071z08i8=";
+      hash = "sha256-dHXfj1f/wnv7W8e1jTclt7qaag5OzP4zCZflN8p0v3M=";
     };
     vendorHash = "sha256-wqOpZ5MSWN3L+rVKdA2E/Zbwqb/KHwMKoGlSIPBKgv0=";
     meta = with lib; {
diff --git a/pkgs/development/interpreters/luau/default.nix b/pkgs/development/interpreters/luau/default.nix
index caeef615ff68..ad45dd299fbe 100644
--- a/pkgs/development/interpreters/luau/default.nix
+++ b/pkgs/development/interpreters/luau/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "luau";
-  version = "0.563";
+  version = "0.567";
 
   src = fetchFromGitHub {
     owner = "Roblox";
     repo = "luau";
     rev = version;
-    hash = "sha256-aGduwwguzIg3kFspIa/5nDFAC836J3B10Pg63psuWto=";
+    hash = "sha256-x1P9/TZUU/XITH1/8NtPXzM46fwk0VxHNphlWqzhoog=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/interpreters/python/default.nix b/pkgs/development/interpreters/python/default.nix
index c4b95af92f28..70fd5c240df4 100644
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@@ -197,9 +197,9 @@ in {
       major = "3";
       minor = "12";
       patch = "0";
-      suffix = "a5";
+      suffix = "a6";
     };
-    hash = "sha256-1m73o0L+OjVvnO47uXrcHl+0hA9rbP994P991JX4Mjs=";
+    hash = "sha256-KYRAJSxLa04SDgFMFdcp6vird5MA3Mph1CLFN+ToXso=";
     inherit (darwin) configd;
     inherit passthruFun;
   };
diff --git a/pkgs/development/interpreters/ruby/default.nix b/pkgs/development/interpreters/ruby/default.nix
index 2bab78ecd419..05184cd7d71e 100644
--- a/pkgs/development/interpreters/ruby/default.nix
+++ b/pkgs/development/interpreters/ruby/default.nix
@@ -3,7 +3,7 @@
 , zlib, gdbm, ncurses, readline, groff, libyaml, libffi, jemalloc, autoreconfHook, bison
 , autoconf, libiconv, libobjc, libunwind, Foundation
 , buildEnv, bundler, bundix
-, makeWrapper, buildRubyGem, defaultGemConfig, removeReferencesTo
+, makeBinaryWrapper, buildRubyGem, defaultGemConfig, removeReferencesTo
 , openssl, openssl_1_1
 } @ args:
 
@@ -47,7 +47,7 @@ let
       , autoreconfHook, bison, autoconf
       , buildEnv, bundler, bundix
       , libiconv, libobjc, libunwind, Foundation
-      , makeWrapper, buildRubyGem, defaultGemConfig
+      , makeBinaryWrapper, buildRubyGem, defaultGemConfig
       , baseRuby ? buildPackages.ruby_3_1.override {
           useRailsExpress = false;
           docSupport = false;
@@ -272,7 +272,7 @@ let
           };
 
           inherit (import ../../ruby-modules/with-packages {
-            inherit lib stdenv makeWrapper buildRubyGem buildEnv;
+            inherit lib stdenv makeBinaryWrapper buildRubyGem buildEnv;
             gemConfig = defaultGemConfig;
             ruby = self;
           }) withPackages buildGems gems;
diff --git a/pkgs/development/libraries/g2o/default.nix b/pkgs/development/libraries/g2o/default.nix
index 0536ec95c6ff..1140565eefc7 100644
--- a/pkgs/development/libraries/g2o/default.nix
+++ b/pkgs/development/libraries/g2o/default.nix
@@ -3,13 +3,13 @@
 
 mkDerivation rec {
   pname = "g2o";
-  version = "20201223";
+  version = "20230223";
 
   src = fetchFromGitHub {
     owner = "RainerKuemmerle";
     repo = pname;
     rev = "${version}_git";
-    sha256 = "sha256-Ik6uBz4Z4rc5+mPNdT8vlNZSBom4Tvt8Y6myBC/s0m8=";
+    sha256 = "sha256-J2Z3oRkyiinIfywBQvnq1Q8Z5WuzQXOVTZTwN8oivf0=";
   };
 
   # Removes a reference to gcc that is only used in a debug message
@@ -20,9 +20,6 @@ mkDerivation rec {
   nativeBuildInputs = [ cmake makeWrapper ];
   buildInputs = [ eigen suitesparse blas lapack libGLU qtbase libqglviewer ];
 
-  # Silence noisy warning
-  CXXFLAGS = "-Wno-deprecated-copy";
-
   dontWrapQtApps = true;
 
   cmakeFlags = [
diff --git a/pkgs/development/libraries/hipsparse/default.nix b/pkgs/development/libraries/hipsparse/default.nix
index 0252c57aefc9..769c6da0fa8f 100644
--- a/pkgs/development/libraries/hipsparse/default.nix
+++ b/pkgs/development/libraries/hipsparse/default.nix
@@ -17,7 +17,7 @@
 # This can also use cuSPARSE as a backend instead of rocSPARSE
 stdenv.mkDerivation (finalAttrs: {
   pname = "hipsparse";
-  version = "5.4.2";
+  version = "5.4.3";
 
   outputs = [
     "out"
diff --git a/pkgs/development/libraries/httplib/default.nix b/pkgs/development/libraries/httplib/default.nix
index 3d0ef7740e7f..e18808b753d6 100644
--- a/pkgs/development/libraries/httplib/default.nix
+++ b/pkgs/development/libraries/httplib/default.nix
@@ -5,13 +5,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "httplib";
-  version = "0.12.0";
+  version = "0.12.1";
 
   src = fetchFromGitHub {
     owner = "yhirose";
     repo = "cpp-httplib";
     rev = "v${version}";
-    hash = "sha256-Qr8jaZSj5xPiTF8reur09/R2jrtDk5hxHKeVTccHbZQ=";
+    hash = "sha256-F0MXuScZP2kmyCWv+DVXOB9rRk2T7hMgum7Zbs8X7QI=";
   };
 
   # Header-only library.
diff --git a/pkgs/development/libraries/mlt/qt-5.nix b/pkgs/development/libraries/mlt/qt-5.nix
index c2d4e6aa56d8..b7a881548d38 100644
--- a/pkgs/development/libraries/mlt/qt-5.nix
+++ b/pkgs/development/libraries/mlt/qt-5.nix
@@ -27,13 +27,13 @@
 
 mkDerivation rec {
   pname = "mlt";
-  version = "7.12.0";
+  version = "7.14.0";
 
   src = fetchFromGitHub {
     owner = "mltframework";
     repo = "mlt";
     rev = "v${version}";
-    sha256 = "sha256-Y7lbfwA0lkQB3PjYQIQaQ0BeXGcgyCmMnDqqZJ8zUaA=";
+    sha256 = "sha256-BmvgDj/zgGJNpTy5A9XPOl+9001Kc0qSFSqQ3gwZPmI=";
   };
 
   buildInputs = [
diff --git a/pkgs/development/libraries/muparserx/default.nix b/pkgs/development/libraries/muparserx/default.nix
index bdc558dc1029..c6b6c75c22d8 100644
--- a/pkgs/development/libraries/muparserx/default.nix
+++ b/pkgs/development/libraries/muparserx/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "muparserx";
-  version = "4.0.11";
+  version = "4.0.12";
 
   src = fetchFromGitHub {
     owner = "beltoforion";
     repo = "muparserx";
     rev = "v${version}";
-    sha256 = "sha256-BWzHlz1mQYsvWa53EtO05Rb4rRHJBSRguJTHLtgqpPw=";
+    sha256 = "sha256-rekPXmncNdVX6LvPQP1M2Pzs3pyiCCcLPLnPFiyWJ4s=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/presage/default.nix b/pkgs/development/libraries/presage/default.nix
index b3c3c21e3046..8f7e15867099 100644
--- a/pkgs/development/libraries/presage/default.nix
+++ b/pkgs/development/libraries/presage/default.nix
@@ -26,7 +26,8 @@ stdenv.mkDerivation rec {
 
   patches = [
     (fetchpatch {
-      url = "https://git.alpinelinux.org/aports/plain/community/presage/gcc6.patch";
+      name = "gcc6.patch";
+      url = "https://git.alpinelinux.org/aports/plain/community/presage/gcc6.patch?id=40e2044c9ecb36eacb3a1fd043f09548d210dc01";
       sha256 = "0243nx1ygggmsly7057vndb4pkjxg9rpay5gyqqrq9jjzjzh63dj";
     })
     ./fixed-cppunit-detection.patch
diff --git a/pkgs/development/libraries/rapidjson/default.nix b/pkgs/development/libraries/rapidjson/default.nix
index b67824b5cc55..f73e01b64764 100644
--- a/pkgs/development/libraries/rapidjson/default.nix
+++ b/pkgs/development/libraries/rapidjson/default.nix
@@ -25,7 +25,8 @@ stdenv.mkDerivation rec {
       sha256 = "1qm62iad1xfsixv1li7qy475xc7gc04hmi2q21qdk6l69gk7mf82";
     })
     (fetchpatch {
-      url = "https://git.alpinelinux.org/aports/plain/community/rapidjson/do-not-include-gtest-src-dir.patch";
+      name = "do-not-include-gtest-src-dir.patch";
+      url = "https://git.alpinelinux.org/aports/plain/community/rapidjson/do-not-include-gtest-src-dir.patch?id=9e5eefc7a5fcf5938a8dc8a3be8c75e9e6809909";
       hash = "sha256-BjSZEwfCXA/9V+kxQ/2JPWbc26jQn35CfN8+8NW24s4=";
     })
   ];
diff --git a/pkgs/development/libraries/science/math/ipopt/default.nix b/pkgs/development/libraries/science/math/ipopt/default.nix
index c544436af8ef..e9ca26d23958 100644
--- a/pkgs/development/libraries/science/math/ipopt/default.nix
+++ b/pkgs/development/libraries/science/math/ipopt/default.nix
@@ -12,13 +12,13 @@ assert (!blas.isILP64) && (!lapack.isILP64);
 
 stdenv.mkDerivation rec {
   pname = "ipopt";
-  version = "3.14.10";
+  version = "3.14.11";
 
   src = fetchFromGitHub {
     owner = "coin-or";
     repo = "Ipopt";
     rev = "releases/${version}";
-    sha256 = "sha256-4SHmqalrGeqp1nBx2BQLRnRWEYw5lJk5Yao67GQw3qM=";
+    sha256 = "sha256-PzNDiTZkPORFckFJryFuvn/rsfx3wrXJ9Qde88gH5o4=";
   };
 
   CXXDEFS = [ "-DHAVE_RAND" "-DHAVE_CSTRING" "-DHAVE_CSTDIO" ];
diff --git a/pkgs/development/libraries/simdjson/default.nix b/pkgs/development/libraries/simdjson/default.nix
index a44dc213f6ea..ecd7bb39fe4a 100644
--- a/pkgs/development/libraries/simdjson/default.nix
+++ b/pkgs/development/libraries/simdjson/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "simdjson";
-  version = "3.1.3";
+  version = "3.1.5";
 
   src = fetchFromGitHub {
     owner = "simdjson";
     repo = "simdjson";
     rev = "v${version}";
-    sha256 = "sha256-VDwpCPyjhkXgehcMJs6srD3PFtlC2m4jurJum6wNeVY=";
+    sha256 = "sha256-gBHgPKEeoryjMVL/EonmeY/7imcJej/Yj8ovPk/moTk=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/waffle/default.nix b/pkgs/development/libraries/waffle/default.nix
index 0fc513b68f46..e2a90d2e284d 100644
--- a/pkgs/development/libraries/waffle/default.nix
+++ b/pkgs/development/libraries/waffle/default.nix
@@ -17,14 +17,14 @@
 
 stdenv.mkDerivation rec {
   pname = "waffle";
-  version = "1.7.0";
+  version = "1.7.2";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "mesa";
     repo = "waffle";
     rev = "v${version}";
-    sha256 = "iY+dAgXutD/uDFocwd9QXjq502IOsk+3RQMA2S/CMV4=";
+    sha256 = "sha256-dwDNMLgZrILb559yGs4sNA7D+nD60972+JOy0PKfL0w=";
   };
 
   buildInputs = [
diff --git a/pkgs/development/misc/brev-cli/default.nix b/pkgs/development/misc/brev-cli/default.nix
index 5a0f3138bbef..70cbbfd4ceb0 100644
--- a/pkgs/development/misc/brev-cli/default.nix
+++ b/pkgs/development/misc/brev-cli/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "brev-cli";
-  version = "0.6.208";
+  version = "0.6.211";
 
   src = fetchFromGitHub {
     owner = "brevdev";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-fgbHaY0trO7MiYxhdatq81PaOIVQpSIU3cUnrIvGI2M=";
+    sha256 = "sha256-cDG++heWXGJw6ctho/lJfHZ9eTrsmexFzh0i+tIDpMI=";
   };
 
   vendorHash = "sha256-IR/tgqh8rS4uN5jSOcopCutbHCKHSU9icUfRhOgu4t8=";
diff --git a/pkgs/development/python-modules/datasette/default.nix b/pkgs/development/python-modules/datasette/default.nix
index c6be2c6ed0e1..f552e3321615 100644
--- a/pkgs/development/python-modules/datasette/default.nix
+++ b/pkgs/development/python-modules/datasette/default.nix
@@ -29,7 +29,7 @@
 
 buildPythonPackage rec {
   pname = "datasette";
-  version = "0.64.1";
+  version = "0.64.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -38,7 +38,7 @@ buildPythonPackage rec {
     owner = "simonw";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-EXYAiXqEfQVDTwc4MFTroLPEaTZ3QYTlUsuNQ72oHpA=";
+    hash = "sha256-AxIJUJzFEAvAV59hYDB3pb5/1rS9d7T0ltl6lVWTCrE=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/dkimpy/default.nix b/pkgs/development/python-modules/dkimpy/default.nix
index 3b1fd3efb3c1..b05cfb9a088e 100644
--- a/pkgs/development/python-modules/dkimpy/default.nix
+++ b/pkgs/development/python-modules/dkimpy/default.nix
@@ -3,11 +3,11 @@
 
 buildPythonPackage rec {
   pname = "dkimpy";
-  version = "1.1.0";
+  version = "1.1.1";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-NQDukEVLfCz3ElgeA5jrRwONJ+aRSDKd9jTs2Y3YYhw=";
+    hash = "sha256-dVl0S1qQGWkZCPCgxlPiBrbL9jbIxtZuGggnz8jsf5E=";
 };
 
   nativeCheckInputs = [ pytest ];
diff --git a/pkgs/development/python-modules/holidays/default.nix b/pkgs/development/python-modules/holidays/default.nix
index bab50ea617b3..0110d038e64b 100644
--- a/pkgs/development/python-modules/holidays/default.nix
+++ b/pkgs/development/python-modules/holidays/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "holidays";
-  version = "0.20";
+  version = "0.21";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "dr-prodigy";
     repo = "python-holidays";
     rev = "refs/tags/v.${version}";
-    hash = "sha256-hz0v4g94RMA1dKOLu4BSYnK5EPNl1hIWEShFJWO0F3A=";
+    hash = "sha256-acV/m4orkOEbON7C4ThGvaQtTMpp4c8FNesC7UepJFc=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/jenkins-job-builder/default.nix b/pkgs/development/python-modules/jenkins-job-builder/default.nix
index 0bdced39c039..5e5cf339b74d 100644
--- a/pkgs/development/python-modules/jenkins-job-builder/default.nix
+++ b/pkgs/development/python-modules/jenkins-job-builder/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "jenkins-job-builder";
-  version = "4.1.0";
+  version = "4.3.0";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-5jCltdomD4u5LZrYJFUHB/sLORXYuWoeJOalAci0+XQ=";
+    hash = "sha256-pvka8TLMEclzJ2Iw4iLSiR1ioV3frzQStLu21+kSSHI=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pyrogram/default.nix b/pkgs/development/python-modules/pyrogram/default.nix
index 8897ae953578..58598e1460bd 100644
--- a/pkgs/development/python-modules/pyrogram/default.nix
+++ b/pkgs/development/python-modules/pyrogram/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "pyrogram";
-  version = "2.0.100";
+  version = "2.0.101";
 
   disabled = pythonOlder "3.7";
 
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "pyrogram";
     repo = "pyrogram";
     rev = "v${version}";
-    hash = "sha256-WlKzBhToSrBl6T8XFlqi3p0ABDufBGdhmK/0Fn7V61A=";
+    hash = "sha256-HFOT8PqK7n42j2H8EJ5c7h9PL28icQwYErPNcxPgoM8=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/python-benedict/default.nix b/pkgs/development/python-modules/python-benedict/default.nix
index 446fbfcd9c9e..c1c10cfc902e 100644
--- a/pkgs/development/python-modules/python-benedict/default.nix
+++ b/pkgs/development/python-modules/python-benedict/default.nix
@@ -24,7 +24,7 @@
 
 buildPythonPackage rec {
   pname = "python-benedict";
-  version = "0.28.3";
+  version = "0.29.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -33,7 +33,7 @@ buildPythonPackage rec {
     owner = "fabiocaccamo";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-6gzmVOuJfNpNJlea4Am20HI98mgcKkwtU/28l7qg20Y=";
+    hash = "sha256-tsTd9EJkwI98ynXu/vz5hX+X55vxOkhIfeawQNn2f6Q=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/python-rapidjson/default.nix b/pkgs/development/python-modules/python-rapidjson/default.nix
index f2cd6d285b75..9cb3baf0663d 100644
--- a/pkgs/development/python-modules/python-rapidjson/default.nix
+++ b/pkgs/development/python-modules/python-rapidjson/default.nix
@@ -21,7 +21,8 @@ let
     };
     patches = [
       (fetchpatch {
-        url = "https://git.alpinelinux.org/aports/plain/community/rapidjson/do-not-include-gtest-src-dir.patch";
+        name = "do-not-include-gtest-src-dir.patch";
+        url = "https://git.alpinelinux.org/aports/plain/community/rapidjson/do-not-include-gtest-src-dir.patch?id=9e5eefc7a5fcf5938a8dc8a3be8c75e9e6809909";
         hash = "sha256-BjSZEwfCXA/9V+kxQ/2JPWbc26jQn35CfN8+8NW24s4=";
       })
     ];
diff --git a/pkgs/development/python-modules/swift/default.nix b/pkgs/development/python-modules/swift/default.nix
index 9cba43bf55f2..4e7b496b7a54 100644
--- a/pkgs/development/python-modules/swift/default.nix
+++ b/pkgs/development/python-modules/swift/default.nix
@@ -24,11 +24,11 @@
 
 buildPythonPackage rec {
   pname = "swift";
-  version = "2.31.0";
+  version = "2.31.1";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-gU6XQKiLv6E1OtSjwDunjhNIMK36//arcSsQRwuRtTY=";
+    hash = "sha256-6CRSIv2m2pqZdzRAEJ/6Qo90PZ7LRNg1zQg50Ecq2RQ=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/unrardll/default.nix b/pkgs/development/python-modules/unrardll/default.nix
index f0a0cbbf1759..e6d746165144 100644
--- a/pkgs/development/python-modules/unrardll/default.nix
+++ b/pkgs/development/python-modules/unrardll/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "unrardll";
-  version = "0.1.5";
+  version = "0.1.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "8bebb480b96cd49d4290d814914f39cff75cf0fa0514c4790bb32b1757227c78";
+    sha256 = "sha256-4QZ/4nu03iBO+PNpLyPZPF07QpL3iyksb8fcT3V0n3Y=";
   };
 
   buildInputs = [ unrar ];
diff --git a/pkgs/development/ruby-modules/with-packages/default.nix b/pkgs/development/ruby-modules/with-packages/default.nix
index 5be820b60e30..31573bce499f 100644
--- a/pkgs/development/ruby-modules/with-packages/default.nix
+++ b/pkgs/development/ruby-modules/with-packages/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, buildEnv, buildRubyGem, ruby, gemConfig, makeWrapper }:
+{ stdenv, lib, buildEnv, buildRubyGem, ruby, gemConfig, makeBinaryWrapper }:
 
 /*
 Example usage:
@@ -43,7 +43,7 @@ let
 
       wrappedRuby = stdenv.mkDerivation {
         name = "wrapped-${ruby.name}";
-        nativeBuildInputs = [ makeWrapper ];
+        nativeBuildInputs = [ makeBinaryWrapper ];
         buildCommand = ''
           mkdir -p $out/bin
           for i in ${ruby}/bin/*; do
@@ -54,7 +54,7 @@ let
 
     in stdenv.mkDerivation {
       name = "${ruby.name}-with-packages";
-      nativeBuildInputs = [ makeWrapper ];
+      nativeBuildInputs = [ makeBinaryWrapper ];
       buildInputs = [ selected ruby ];
 
       dontUnpack = true;
diff --git a/pkgs/development/ruby-modules/with-packages/test.nix b/pkgs/development/ruby-modules/with-packages/test.nix
index ca2934b6f61c..be652747c469 100644
--- a/pkgs/development/ruby-modules/with-packages/test.nix
+++ b/pkgs/development/ruby-modules/with-packages/test.nix
@@ -15,6 +15,22 @@ let
       pkgs.ruby.gems) //
     (import ./require_exceptions.nix);
 
+  testWrapper = ruby: stdenv.mkDerivation {
+    name = "test-wrappedRuby-${ruby.name}";
+    buildInputs = [ ((ruby.withPackages (ps: [ ])).wrappedRuby) ];
+    buildCommand = ''
+      cat <<'EOF' > test-ruby
+      #!/usr/bin/env ruby
+      puts RUBY_VERSION
+      EOF
+
+      chmod +x test-ruby
+      patchShebangs test-ruby
+      [[ $(./test-ruby) = $(${ruby}/bin/ruby test-ruby) ]]
+      touch $out
+    '';
+  };
+
   tests = ruby:
     lib.mapAttrs (name: gem:
       let
@@ -39,7 +55,7 @@ let
 in
   stdenv.mkDerivation {
     name = "test-all-ruby-gems";
-    buildInputs = builtins.foldl' (sum: ruby: sum ++ ( builtins.attrValues (tests ruby) )) [] rubyVersions;
+    buildInputs = builtins.foldl' (sum: ruby: sum ++ [ (testWrapper ruby) ] ++ ( builtins.attrValues (tests ruby) )) [] rubyVersions;
     buildCommand = ''
       touch $out
     '';
diff --git a/pkgs/development/tools/analysis/hotspot/default.nix b/pkgs/development/tools/analysis/hotspot/default.nix
index 5c0a96e5d8e0..bbf91ec28fb4 100644
--- a/pkgs/development/tools/analysis/hotspot/default.nix
+++ b/pkgs/development/tools/analysis/hotspot/default.nix
@@ -62,6 +62,10 @@ mkDerivation rec {
     mkdir -p 3rdparty/{perfparser,PrefixTickLabels}/.git
   '';
 
+  qtWrapperArgs = [
+    "--prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ rustc-demangle ]}"
+  ];
+
   meta = with lib; {
     description = "A GUI for Linux perf";
     longDescription = ''
diff --git a/pkgs/development/tools/buf/default.nix b/pkgs/development/tools/buf/default.nix
index c5561b9b666f..fdf763efb26a 100644
--- a/pkgs/development/tools/buf/default.nix
+++ b/pkgs/development/tools/buf/default.nix
@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "buf";
-  version = "1.15.0";
+  version = "1.15.1";
 
   src = fetchFromGitHub {
     owner = "bufbuild";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-63JWRyB586klWSQskBY/fDRTdXrQa15IygdZfmHpEqM=";
+    hash = "sha256-XiB8ZlbtzU66abM9zJotaMCrbYScqWmDv4ulEeQS6+g=";
   };
 
-  vendorHash = "sha256-XRv8AnktIPR1emRdRMmDwOh7r3kNByy0REwZbg3NYPc=";
+  vendorHash = "sha256-bQKpy5xjUItgQ79r8TrMUOjo0Ze9E25glvOv312W1k0=";
 
   patches = [
     # Skip a test that requires networking to be available to work.
diff --git a/pkgs/development/tools/continuous-integration/github-runner/default.nix b/pkgs/development/tools/continuous-integration/github-runner/default.nix
index 8c4e52b22bb0..36931247d129 100644
--- a/pkgs/development/tools/continuous-integration/github-runner/default.nix
+++ b/pkgs/development/tools/continuous-integration/github-runner/default.nix
@@ -21,7 +21,7 @@ buildDotnetModule rec {
     owner = "actions";
     repo = "runner";
     rev = "v${version}";
-    hash = "sha256-bzCa3OI8/pE8K9U38RN0xWbLkjJPA4mUlsrbH1etpG4=";
+    hash = "sha256-gGIYlYM4Rf7Ils2rThsQHWIkLDt5Htg4NDuJhxvl1rU=";
     # Required to obtain HEAD's Git commit hash
     leaveDotGit = true;
   };
diff --git a/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix b/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix
index 9a101323fb38..6dad681809da 100644
--- a/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix
+++ b/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix
@@ -1,7 +1,7 @@
 { lib, buildGoModule, fetchFromGitLab, fetchurl, bash }:
 
 let
-  version = "15.9.0";
+  version = "15.9.1";
 in
 buildGoModule rec {
   inherit version;
@@ -23,7 +23,7 @@ buildGoModule rec {
     owner = "gitlab-org";
     repo = "gitlab-runner";
     rev = "v${version}";
-    sha256 = "sha256-wdeH1/1FNG1vwmSmXo7KjhxfQTmQk9lNAxVNoUKlLi4=";
+    sha256 = "sha256-J8wcTU2bilhEKwOAVgaJk743b66TLndYOxc1k+S/cBg=";
   };
 
   patches = [
diff --git a/pkgs/development/tools/datree/default.nix b/pkgs/development/tools/datree/default.nix
index 753cbfeef577..6c061b3bf769 100644
--- a/pkgs/development/tools/datree/default.nix
+++ b/pkgs/development/tools/datree/default.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "datree";
-  version = "1.8.36";
+  version = "1.8.37";
 
   src = fetchFromGitHub {
     owner = "datreeio";
     repo = "datree";
     rev = "refs/tags/${version}";
-    hash = "sha256-h3Bfdd5v8lder5N+75P/u9rSxxhvpw5mf/T4bNYWdOY=";
+    hash = "sha256-qcdeAVQlZ3dR/cvwOyvOQ7XQE1gflKEY1l9TdywvDBA=";
   };
 
   vendorHash = "sha256-mkVguYzjNGgFUdATjGfenCx3h97LS3SEOkYo3CuP9fA=";
diff --git a/pkgs/development/tools/go-protobuf/default.nix b/pkgs/development/tools/go-protobuf/default.nix
index 00e62c87cb32..42b4fbe1d3cd 100644
--- a/pkgs/development/tools/go-protobuf/default.nix
+++ b/pkgs/development/tools/go-protobuf/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "go-protobuf";
-  version = "1.5.2";
+  version = "1.5.3";
 
   src = fetchFromGitHub {
     owner = "golang";
     repo = "protobuf";
     rev = "v${version}";
-    sha256 = "sha256-E/6Qh8hWilaGeSojOCz8PzP9qnVqNG2DQLYJUqN3BdY=";
+    sha256 = "sha256-cRB4oicBfYvhqtzafWWmf82AuvSnB0NhHwpp0pjgwQ0=";
   };
 
-  vendorSha256 = "sha256-CcJjFMslSUiZMM0LLMM3BR53YMxyWk8m7hxjMI9tduE=";
+  vendorHash = "sha256-CcJjFMslSUiZMM0LLMM3BR53YMxyWk8m7hxjMI9tduE=";
 
   meta = with lib; {
     homepage    = "https://github.com/golang/protobuf";
diff --git a/pkgs/development/tools/kafkactl/default.nix b/pkgs/development/tools/kafkactl/default.nix
index 750e93f66557..e52eda11bb3a 100644
--- a/pkgs/development/tools/kafkactl/default.nix
+++ b/pkgs/development/tools/kafkactl/default.nix
@@ -1,21 +1,26 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
 
 buildGoModule rec {
   pname = "kafkactl";
-  version = "3.0.3";
+  version = "3.1.0";
 
   src = fetchFromGitHub {
     owner = "deviceinsight";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-rz3cAA5iqhrCZhLc+RKZhudiMlfu3m6wWYNHAnUP/kg=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-H6oSkPQx5bk9VBBoeGVg0Ri5LTCv96tR4Vq4guymAbQ=";
   };
 
   vendorHash = "sha256-Y3BPt3PsedrlCoKiKUObf6UQd+MuNiCGLpJUg94XSgA=";
+
   doCheck = false;
 
   meta = with lib; {
-    inherit (src.meta) homepage;
+    homepage = "https://github.com/deviceinsight/kafkactl";
+    changelog = "https://github.com/deviceinsight/kafkactl/blob/v${version}/CHANGELOG.md";
     description = "Command Line Tool for managing Apache Kafka";
     longDescription = ''
       A command-line interface for interaction with Apache Kafka.
diff --git a/pkgs/development/tools/misc/circleci-cli/default.nix b/pkgs/development/tools/misc/circleci-cli/default.nix
index 6a79e1ab879f..0b44b662a77f 100644
--- a/pkgs/development/tools/misc/circleci-cli/default.nix
+++ b/pkgs/development/tools/misc/circleci-cli/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "circleci-cli";
-  version = "0.1.23816";
+  version = "0.1.23845";
 
   src = fetchFromGitHub {
     owner = "CircleCI-Public";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Ab22+fEHQry8dRIElFydxQXVWOXLo4Ch8Q26F8qPUDw=";
+    sha256 = "sha256-oLjr3aWJ8+X+T7oD1NdDfNDBuufwA180AOT3K8WR/q0=";
   };
 
   vendorHash = "sha256-8HAiZ0zEJ+nnCsSUrNv0qQlvROCyNXO49fLWnKi6anE=";
diff --git a/pkgs/development/tools/misc/seer/default.nix b/pkgs/development/tools/misc/seer/default.nix
index e44d8a9ce118..ccb71310c5d8 100644
--- a/pkgs/development/tools/misc/seer/default.nix
+++ b/pkgs/development/tools/misc/seer/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "seer";
-  version = "1.14";
+  version = "1.15";
 
   src = fetchFromGitHub {
     owner = "epasveer";
     repo = "seer";
     rev = "v${version}";
-    sha256 = "sha256-IxFG+OhRhPRPSyGFJh559Tz2E7aMOtpphm9GbYS0dRA=";
+    sha256 = "sha256-TktCUO281Cok47qT60DMAO5uUIg1iDH1RKx+fBPezLs=";
   };
 
   preConfigure = ''
diff --git a/pkgs/development/tools/oh-my-posh/default.nix b/pkgs/development/tools/oh-my-posh/default.nix
index 0fc950659462..ab6dddc5e6b9 100644
--- a/pkgs/development/tools/oh-my-posh/default.nix
+++ b/pkgs/development/tools/oh-my-posh/default.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "oh-my-posh";
-  version = "14.9.2";
+  version = "14.12.0";
 
   src = fetchFromGitHub {
     owner = "jandedobbeleer";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-9ZIMAJVVrJk8ny3TgwXHSxrg713dSbPlgQnY/b0m2Ps=";
+    hash = "sha256-brwfM/IPgwLdVwMNur4EBCsubbv/DCVhTMJbAn6mbFg=";
   };
 
   vendorHash = "sha256-JZ5UiL2vGsXy/xmz+NcAKYDmp5hq7bx54/OdUyQHUp0=";
diff --git a/pkgs/development/tools/rust/cargo-zigbuild/default.nix b/pkgs/development/tools/rust/cargo-zigbuild/default.nix
index 00d4e4e6942a..37e85dc3576f 100644
--- a/pkgs/development/tools/rust/cargo-zigbuild/default.nix
+++ b/pkgs/development/tools/rust/cargo-zigbuild/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-zigbuild";
-  version = "0.16.2";
+  version = "0.16.3";
 
   src = fetchFromGitHub {
     owner = "messense";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-3PzzaZ62My+11yXGrQSWpJvKvbcKXMfy7CLDBnSVDuI=";
+    sha256 = "sha256-IqGKK3g56RB9o6i+sJjlod3KuAAB9O7RerQshKoCOfk=";
   };
 
-  cargoSha256 = "sha256-ZnsrqbB89C4E5yBDN/wgNgpSEh/aS078h2X+ewtMX8E=";
+  cargoSha256 = "sha256-RPOMc0+FwjhewqiMwVxAwg5g7GphOtXW8xMElDyTPUk=";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/development/tools/skaffold/default.nix b/pkgs/development/tools/skaffold/default.nix
index 4e1a51f5154a..cba9f174bf1e 100644
--- a/pkgs/development/tools/skaffold/default.nix
+++ b/pkgs/development/tools/skaffold/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "skaffold";
-  version = "2.1.0";
+  version = "2.2.0";
 
   src = fetchFromGitHub {
     owner = "GoogleContainerTools";
     repo = "skaffold";
     rev = "v${version}";
-    sha256 = "sha256-D0KcnxfjPBGHLGs5YLdecuKL07jIhF6w/SIr/I/W1rI=";
+    sha256 = "sha256-4/FnuyesqW+9zA4TArm/7MpTzWURGG7ZjQKh3WFghZQ=";
   };
 
-  vendorSha256 = "sha256-yy1BVorjLEcZR6PqupBiZx2plwPJ6xlxripbyB6RLek=";
+  vendorHash = "sha256-hy0xi21Lq3MzXnBB8+8FqNZsxp4fLshnaRm4v+GyLUg=";
 
   subPackages = ["cmd/skaffold"];
 
diff --git a/pkgs/development/tools/stylua/default.nix b/pkgs/development/tools/stylua/default.nix
index 60110d6c99f3..6e8b7df3cbc4 100644
--- a/pkgs/development/tools/stylua/default.nix
+++ b/pkgs/development/tools/stylua/default.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "stylua";
-  version = "0.16.1";
+  version = "0.17.0";
 
   src = fetchFromGitHub {
     owner = "johnnymorganz";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-PpkJwCVZr21P1WmU2Kid+X9JwKdJs1krY6keQoMqDvc=";
+    sha256 = "sha256-Q+0B7O769blQVHC4++G+FZTKa1llmn6xkS1UDBcFLOA=";
   };
 
-  cargoSha256 = "sha256-oCoE+Fk2zcVlV8H+f/soAWlhXNsLTysmqLXx9yjdnFY=";
+  cargoSha256 = "sha256-lnodLMqiJsxm5rO+FMbvVhzX3z9R4eyPf+ujDCDk8ow=";
 
   # remove cargo config so it can find the linker on aarch64-unknown-linux-gnu
   postPatch = ''
diff --git a/pkgs/games/sm64ex/coop.nix b/pkgs/games/sm64ex/coop.nix
index 9e34e184adb7..742f41cea361 100644
--- a/pkgs/games/sm64ex/coop.nix
+++ b/pkgs/games/sm64ex/coop.nix
@@ -7,13 +7,13 @@
 
 callPackage ./generic.nix {
   pname = "sm64ex-coop";
-  version = "0.pre+date=2022-08-05";
+  version = "unstable-2023-02-22";
 
   src = fetchFromGitHub {
     owner = "djoslin0";
     repo = "sm64ex-coop";
-    rev = "68634493de4cdd9db263e0f4f0b9b6772a60d30a";
-    sha256 = "sha256-3Ve93WGyBd8SAA0TBrpIrhj+ernjn1q7qXSi9mp36cQ=";
+    rev = "8746a503086793c87860daadfaeaaf0a31b2d6cf";
+    sha256 = "sha256-iwJsq0FN9npxveIoMiB7zL5j1V72IExtEpzGj6lwLXQ=";
   };
 
   extraNativeBuildInputs = [
diff --git a/pkgs/games/sm64ex/sm64ex.nix b/pkgs/games/sm64ex/sm64ex.nix
index 66c84dd0b13c..ddac79697c6f 100644
--- a/pkgs/games/sm64ex/sm64ex.nix
+++ b/pkgs/games/sm64ex/sm64ex.nix
@@ -4,13 +4,13 @@
 
 callPackage ./generic.nix {
   pname = "sm64ex";
-  version = "0.pre+date=2021-11-30";
+  version = "unstable-2022-12-19";
 
   src = fetchFromGitHub {
     owner = "sm64pc";
     repo = "sm64ex";
-    rev = "db9a6345baa5acb41f9d77c480510442cab26025";
-    sha256 = "sha256-q7JWDvNeNrDpcKVtIGqB1k7I0FveYwrfqu7ZZK7T8F8=";
+    rev = "afc7e8da695bdf1aea5400a0d5c8b188d16a2088";
+    sha256 = "sha256-TbA9yGPtP2uGsxN3eFaQwFeNjAjZ5hSk8Qmx1pRQxf8=";
   };
 
   extraMeta = {
diff --git a/pkgs/os-specific/linux/musl/default.nix b/pkgs/os-specific/linux/musl/default.nix
index 7a0fabf9d468..454c81747444 100644
--- a/pkgs/os-specific/linux/musl/default.nix
+++ b/pkgs/os-specific/linux/musl/default.nix
@@ -4,20 +4,24 @@
 }:
 let
   cdefs_h = fetchurl {
-    url = "http://git.alpinelinux.org/cgit/aports/plain/main/libc-dev/sys-cdefs.h";
+    name = "sys-cdefs.h";
+    url = "https://git.alpinelinux.org/aports/plain/main/libc-dev/sys-cdefs.h?id=7ca0ed62d4c0d713d9c7dd5b9a077fba78bce578";
     sha256 = "16l3dqnfq0f20rzbkhc38v74nqcsh9n3f343bpczqq8b1rz6vfrh";
   };
   queue_h = fetchurl {
-    url = "http://git.alpinelinux.org/cgit/aports/plain/main/libc-dev/sys-queue.h";
+    name = "sys-queue.h";
+    url = "http://git.alpinelinux.org/aports/plain/main/libc-dev/sys-queue.h?id=7ca0ed62d4c0d713d9c7dd5b9a077fba78bce578";
     sha256 = "12qm82id7zys92a1qh2l1qf2wqgq6jr4qlbjmqyfffz3s3nhfd61";
   };
   tree_h = fetchurl {
-    url = "http://git.alpinelinux.org/cgit/aports/plain/main/libc-dev/sys-tree.h";
+    name = "sys-tree.h";
+    url = "http://git.alpinelinux.org/aports/plain/main/libc-dev/sys-tree.h?id=7ca0ed62d4c0d713d9c7dd5b9a077fba78bce578";
     sha256 = "14igk6k00bnpfw660qhswagyhvr0gfqg4q55dxvaaq7ikfkrir71";
   };
 
   stack_chk_fail_local_c = fetchurl {
-    url = "https://git.alpinelinux.org/aports/plain/main/musl/__stack_chk_fail_local.c?h=3.10-stable";
+    name = "__stack_chk_fail_local.c";
+    url = "https://git.alpinelinux.org/aports/plain/main/musl/__stack_chk_fail_local.c?id=9afbe3cbbf4c30ff23c733218c3c03d7e8c6461d";
     sha256 = "1nhkzzy9pklgjcq2yg89d3l18jif331srd3z3vhy5qwxl1spv6i9";
   };
 
diff --git a/pkgs/servers/dns/knot-dns/default.nix b/pkgs/servers/dns/knot-dns/default.nix
index 539dbd6a8065..9ed93e623b97 100644
--- a/pkgs/servers/dns/knot-dns/default.nix
+++ b/pkgs/servers/dns/knot-dns/default.nix
@@ -59,7 +59,7 @@ stdenv.mkDerivation rec {
   passthru.tests = {
     inherit knot-resolver;
   } // lib.optionalAttrs stdenv.isLinux {
-    inherit (nixosTests) knot;
+    inherit (nixosTests) knot kea;
     # Some dependencies are very version-sensitive, so the might get dropped
     # or embedded after some update, even if the nixPackagers didn't intend to.
     # For non-linux I don't know a good replacement for `ldd`.
diff --git a/pkgs/servers/matrix-synapse/matrix-appservice-irc/default.nix b/pkgs/servers/matrix-synapse/matrix-appservice-irc/default.nix
index d96e60ba780f..8c6e8a1025ce 100644
--- a/pkgs/servers/matrix-synapse/matrix-appservice-irc/default.nix
+++ b/pkgs/servers/matrix-synapse/matrix-appservice-irc/default.nix
@@ -9,16 +9,16 @@
 
 buildNpmPackage rec {
   pname = "matrix-appservice-irc";
-  version = "0.37.0";
+  version = "0.37.1";
 
   src = fetchFromGitHub {
     owner = "matrix-org";
     repo = "matrix-appservice-irc";
     rev = "refs/tags/${version}";
-    hash = "sha256-krF/eUyGHB4M3sQVaBh7+OaHnM/g9XVaBa8gizPkLKE=";
+    hash = "sha256-d/CA27A0txnVnSCJeS/qeK90gOu1QjQaFBk+gblEdH8=";
   };
 
-  npmDepsHash = "sha256-VkVpFt3cwnBkN0AGDaE5Bd6xINGL6XugZ4TBsDONWCg=";
+  npmDepsHash = "sha256-s/b/G49HlDbYsSmwRYrm4Bcv/81tHLC8Ac1IMEwGFW8=";
 
   nativeBuildInputs = [
     python3
diff --git a/pkgs/servers/monitoring/prometheus/influxdb-exporter.nix b/pkgs/servers/monitoring/prometheus/influxdb-exporter.nix
index f4b96b1cf7a8..8f40e61bc98d 100644
--- a/pkgs/servers/monitoring/prometheus/influxdb-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/influxdb-exporter.nix
@@ -6,17 +6,17 @@
 
 buildGoModule rec {
   pname = "influxdb_exporter";
-  version = "0.11.2";
+  version = "0.11.3";
   rev = "v${version}";
 
   src = fetchFromGitHub {
     inherit rev;
     owner = "prometheus";
     repo = "influxdb_exporter";
-    hash = "sha256-UIB6/0rYOrS/B7CFffg0lPaAhSbmk0KSEogjCundXAU=";
+    hash = "sha256-jb384/i76KxQEgqnebEDkH33iPLAAzKFkA8OtmExrWc=";
   };
 
-  vendorHash = "sha256-ueE1eE0cxr7+APvIEzR26Uprx0CXN1jfNLzGVgDmJQk=";
+  vendorHash = "sha256-pD/oWbFa6pg9miNA2z6RubsBd3+X/DWRoQuaVwjuOmI=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/servers/pufferpanel/default.nix b/pkgs/servers/pufferpanel/default.nix
index d89a859b8988..bfb9106b90ea 100644
--- a/pkgs/servers/pufferpanel/default.nix
+++ b/pkgs/servers/pufferpanel/default.nix
@@ -2,23 +2,53 @@
 , buildGoModule
 , fetchFromGitHub
 , makeWrapper
-, pkgs
-, stdenv
 , fetchzip
-, jdk
-, nodejs
+, fetchpatch
 , pathDeps ? [ ]
 }:
 
 buildGoModule rec {
   pname = "pufferpanel";
-  version = "2.2.0";
+  version = "2.6.6";
+
+  patches = [
+    # Bump go-sqlite3 version to avoid a GNU C compiler error.
+    # See https://github.com/PufferPanel/PufferPanel/pull/1240
+    (fetchpatch {
+      url = "https://github.com/PufferPanel/PufferPanel/pull/1240/commits/3065dca2d9b05a56789971ccf0f43a7079a390b8.patch";
+      hash = "sha256-ygMrhJoba8swoRBBii7BEiLihqOebLUtSH7os7W3s+k=";
+    })
+
+    # Fix errors in tests.
+    # See https://github.com/PufferPanel/PufferPanel/pull/1241
+    (fetchpatch {
+      url = "https://github.com/PufferPanel/PufferPanel/pull/1241/commits/ffd21bce4bff3040c8e3e783e5b4779222e7a3a5.patch";
+      hash = "sha256-BzGfcWhzRrCHKkAhWf0uvXiiiutWqthn/ed7bN2hR8U=";
+    })
+
+    # Seems to be an anti-feature. Startup is the only place where user/group is
+    # hardcoded and checked.
+    #
+    # There is no technical reason PufferPanel cannot run as a different user,
+    # especially for simple commands like `pufferpanel version`.
+    ./disable-group-checks.patch
+
+    # Some tests do not have network requests stubbed :(
+    ./skip-network-tests.patch
+  ];
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X=github.com/pufferpanel/pufferpanel/v2.Hash=none"
+    "-X=github.com/pufferpanel/pufferpanel/v2.Version=${version}-nixpkgs"
+  ];
 
   src = fetchFromGitHub {
     owner = "pufferpanel";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1ifig8ckjlg47wj0lfk4q941dan7llb1i5l76akcpjq726b2j8lh";
+    hash = "sha256-0Vyi47Rkpe3oODHfsl/7tCerENpiEa3EWBHhfTO/uu4=";
   };
 
   # PufferPanel is split into two parts: the backend daemon and the
@@ -28,25 +58,35 @@ buildGoModule rec {
   # we just download the built frontend and package that.
   frontend = fetchzip {
     url = "https://github.com/PufferPanel/PufferPanel/releases/download/v${version}/pufferpanel_${version}_linux_arm64.zip";
-    sha256 = "0phbf4asr0dns7if84crx05kfgr44yaxrbsbihdywbhh2mb16052";
+    hash = "sha256-z7HWhiEBma37OMGEkTGaEbnF++Nat8wAZE2UeOoaO/U=";
     stripRoot = false;
-  } + "/www";
+    postFetch = ''
+      mv $out $TMPDIR/subdir
+      mv $TMPDIR/subdir/www $out
+    '';
+  };
 
   nativeBuildInputs = [ makeWrapper ];
 
-  vendorSha256 = "061l1sy0z3kd7rc2blqh333gy66nbadfxy9hyxgq07dszds4byys";
+  vendorHash = "sha256-fB8MxSl9E2W+BdO6i+drbCe9Z3bPHPi0MvpJEomU9co=";
+  proxyVendor = true;
 
   postFixup = ''
     mkdir -p $out/share/pufferpanel
     cp -r ${src}/assets/email $out/share/pufferpanel/templates
     cp -r ${frontend} $out/share/pufferpanel/www
 
-    # Wrap the binary with the path to the external files.
-    mv $out/bin/cmd $out/bin/pufferpanel
-    wrapProgram "$out/bin/pufferpanel" \
-      --set PUFFER_PANEL_EMAIL_TEMPLATES $out/share/pufferpanel/templates/emails.json \
-      --set GIN_MODE release \
-      --set PUFFER_PANEL_WEB_FILES $out/share/pufferpanel/www \
+    # Rename cmd to pufferpanel and remove other binaries.
+    mv $out/bin $TMPDIR/bin
+    mkdir $out/bin
+    mv $TMPDIR/bin/cmd $out/bin/pufferpanel
+
+    # Wrap the binary with the path to the external files, but allow setting
+    # custom paths if needed.
+    wrapProgram $out/bin/pufferpanel \
+      --set-default GIN_MODE release \
+      --set-default PUFFER_PANEL_EMAIL_TEMPLATES $out/share/pufferpanel/templates/emails.json \
+      --set-default PUFFER_PANEL_WEB_FILES $out/share/pufferpanel/www \
       --prefix PATH : ${lib.escapeShellArg (lib.makeBinPath pathDeps)}
   '';
 
@@ -55,6 +95,5 @@ buildGoModule rec {
     homepage = "https://www.pufferpanel.com/";
     license = with licenses; [ asl20 ];
     maintainers = with maintainers; [ ckie ];
-    broken = stdenv.isDarwin; # never built on Hydra https://hydra.nixos.org/job/nixpkgs/trunk/pufferpanel.x86_64-darwin
   };
 }
diff --git a/pkgs/servers/pufferpanel/disable-group-checks.patch b/pkgs/servers/pufferpanel/disable-group-checks.patch
new file mode 100644
index 000000000000..a3f0aa074b60
--- /dev/null
+++ b/pkgs/servers/pufferpanel/disable-group-checks.patch
@@ -0,0 +1,34 @@
+diff --git a/cmd/main.go b/cmd/main.go
+index f9af7038..099ff2e2 100644
+--- a/cmd/main.go
++++ b/cmd/main.go
+@@ -24,11 +24,6 @@ import (
+ )
+ 
+ func main() {
+-	if !pufferpanel.UserInGroup("pufferpanel") {
+-		fmt.Println("You do not have permission to use this command")
+-		return
+-	}
+-
+ 	defer logging.Close()
+ 
+ 	defer func() {
+diff --git a/cmd/user.go b/cmd/user.go
+index d4a27aaf..9bf21910 100644
+--- a/cmd/user.go
++++ b/cmd/user.go
+@@ -218,10 +218,9 @@ type userCreate struct {
+ }
+ 
+ func editUser(cmd *cobra.Command, args []string) {
+-	if !pufferpanel.UserInGroup() {
+-		fmt.Printf("You do not have permission to use this command")
+-		return
+-	}
++	// Keeping import to avoid merge conflicts with future updates in case
++	// PufferPanel starts using this import elsewhere in this file.
++	_ = pufferpanel.UserInGroup
+ 
+ 	db, err := database.GetConnection()
+ 	if err != nil {
diff --git a/pkgs/servers/pufferpanel/skip-network-tests.patch b/pkgs/servers/pufferpanel/skip-network-tests.patch
new file mode 100644
index 000000000000..b2bddd191d0b
--- /dev/null
+++ b/pkgs/servers/pufferpanel/skip-network-tests.patch
@@ -0,0 +1,61 @@
+diff --git a/operations/javadl/javadl_test.go b/operations/javadl/javadl_test.go
+index 3938a58c..a51e2f4a 100644
+--- a/operations/javadl/javadl_test.go
++++ b/operations/javadl/javadl_test.go
+@@ -22,6 +22,8 @@ import (
+ )
+ 
+ func Test_downloadJava(t *testing.T) {
++	t.Skip("requires network access")
++
+ 	tests := []struct {
+ 		name    string
+ 		wantErr bool
+diff --git a/operations/spongedl/spongedl_test.go b/operations/spongedl/spongedl_test.go
+index efb1665c..1b93be8c 100644
+--- a/operations/spongedl/spongedl_test.go
++++ b/operations/spongedl/spongedl_test.go
+@@ -5,6 +5,8 @@ import (
+ )
+ 
+ func TestSpongeDl_Run(t *testing.T) {
++	t.Skip("requires network access")
++
+ 	type fields struct {
+ 		Recommended      bool
+ 		SpongeType       string
+diff --git a/operations/steamgamedl/dl_test.go b/operations/steamgamedl/dl_test.go
+index f4df4bf3..f7cd9681 100644
+--- a/operations/steamgamedl/dl_test.go
++++ b/operations/steamgamedl/dl_test.go
+@@ -19,6 +19,8 @@ import (
+ )
+ 
+ func Test_downloadSteamcmd(t *testing.T) {
++	t.Skip("requires network access")
++
+ 	tests := []struct {
+ 		name    string
+ 		wantErr bool
+diff --git a/services/templates_test.go b/services/templates_test.go
+index 5305dbc0..127efc54 100644
+--- a/services/templates_test.go
++++ b/services/templates_test.go
+@@ -9,6 +9,8 @@ import (
+ )
+ 
+ func TestTemplate_GetImportableTemplates(t1 *testing.T) {
++	t1.Skip("requires network access")
++
+ 	t1.Run("GetImportableTemplates", func(t1 *testing.T) {
+ 		t := &Template{}
+ 
+@@ -26,6 +28,8 @@ func TestTemplate_GetImportableTemplates(t1 *testing.T) {
+ }
+ 
+ func TestTemplate_ImportTemplates(t1 *testing.T) {
++	t1.Skip("requires network access")
++
+ 	t1.Run("GetImportableTemplates", func(t1 *testing.T) {
+ 		db := prepareDatabase(t1)
+ 		if t1.Failed() {
diff --git a/pkgs/servers/snappymail/default.nix b/pkgs/servers/snappymail/default.nix
index 4309aaadf9db..bdc94c57bc89 100644
--- a/pkgs/servers/snappymail/default.nix
+++ b/pkgs/servers/snappymail/default.nix
@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation rec {
   pname = "snappymail";
-  version = "2.26.3";
+  version = "2.26.4";
 
   src = fetchurl {
     url = "https://github.com/the-djmaze/snappymail/releases/download/v${version}/snappymail-${version}.tar.gz";
-    sha256 = "sha256-kNfFQnUFfIS9x6da0nmm4cHK16ZTScQXOa7lL6QFBDQ=";
+    sha256 = "sha256-BWjkdzAm9/bvPTjsdg+Vr+gr0fqzEvARmaySth95fsI=";
   };
 
   sourceRoot = "snappymail";
diff --git a/pkgs/servers/spicedb/default.nix b/pkgs/servers/spicedb/default.nix
index ee6cb17ff0ff..50c6b2a5ed03 100644
--- a/pkgs/servers/spicedb/default.nix
+++ b/pkgs/servers/spicedb/default.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "spicedb";
-  version = "1.16.2";
+  version = "1.17.0";
 
   src = fetchFromGitHub {
     owner = "authzed";
     repo = "spicedb";
     rev = "v${version}";
-    hash = "sha256-OH5O0wOg36sAKWr8sFPYU8RX/S9DbbSnGJvQ1v2pXmQ=";
+    hash = "sha256-oTmEMFoSIW1JQIzhGxAuHW/VSZZk5FnzdLZvjhg90ZQ=";
   };
 
-  vendorHash = "sha256-drnVAWMj7x8HlEQXoichgl35qW07tsk3JvXU/d1ukAc=";
+  vendorHash = "sha256-tIjHgEfq7kKwyQ9iCzI51ne88WrxUATYvJYcHbVX4jQ=";
 
   subPackages = [ "cmd/spicedb" ];
 
diff --git a/pkgs/servers/web-apps/vikunja/api.nix b/pkgs/servers/web-apps/vikunja/api.nix
index 7dd98c553fc7..ea91cb2505a8 100644
--- a/pkgs/servers/web-apps/vikunja/api.nix
+++ b/pkgs/servers/web-apps/vikunja/api.nix
@@ -2,14 +2,14 @@
 
 buildGoModule rec {
   pname = "vikunja-api";
-  version = "0.20.2";
+  version = "0.20.3";
 
   src = fetchFromGitea {
     domain = "kolaente.dev";
     owner = "vikunja";
     repo = "api";
     rev = "v${version}";
-    sha256 = "sha256-VSzjP6fC9zxUnY3ZhapRUXUS4V7+BVvXJKrxm71CK4o=";
+    hash = "sha256-krmshpv7X8Ua61NUSZGTT1+avoBBNSFuxPa93go3qBY=";
   };
 
   nativeBuildInputs =
@@ -24,7 +24,7 @@ buildGoModule rec {
         '';
       in [ fakeGit mage ];
 
-  vendorSha256 = "sha256-8qaEMHBZcop1wH3tmNKAAMEYA4qrE6dlwxhRsCDeZaY=";
+  vendorSha256 = "sha256-TY6xJnz6phIrybZ2Ix7xwuMzGQ1f0xk0KwgPnaTaKYw=";
 
   # checks need to be disabled because of needed internet for some checks
   doCheck = false;
diff --git a/pkgs/servers/web-apps/vikunja/frontend.nix b/pkgs/servers/web-apps/vikunja/frontend.nix
index 14787835f79f..2ccf1b4f3f5a 100644
--- a/pkgs/servers/web-apps/vikunja/frontend.nix
+++ b/pkgs/servers/web-apps/vikunja/frontend.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "vikunja-frontend";
-  version = "0.20.3";
+  version = "0.20.4";
 
   src = fetchurl {
     url = "https://dl.vikunja.io/frontend/${pname}-${version}.zip";
-    sha256 = "sha256-+VtdgbJaXcPlO70Gqsur6osBb7iAvVnPv2iaHbs2Rmk=";
+    hash = "sha256-gkeX/2f6T8GW6jQa+qFcGc/k5cu9QoO9b3tL6B4lPOQ=";
   };
 
   nativeBuildInputs = [ unzip ];
diff --git a/pkgs/shells/fish/plugins/autopair-fish.nix b/pkgs/shells/fish/plugins/autopair-fish.nix
deleted file mode 100644
index 292d492f2046..000000000000
--- a/pkgs/shells/fish/plugins/autopair-fish.nix
+++ /dev/null
@@ -1,20 +0,0 @@
-{ lib, stdenv, buildFishPlugin, fetchFromGitHub }:
-
-buildFishPlugin rec {
-  pname = "autopair.fish";
-  version = "1.0.4";
-
-  src = fetchFromGitHub {
-    owner = "jorgebucaran";
-    repo = pname;
-    rev = version;
-    sha256 = "sha256-s1o188TlwpUQEN3X5MxUlD/2CFCpEkWu83U9O+wg3VU=";
-  };
-
-  meta = with lib; {
-    description = "Auto-complete matching pairs in the Fish command line.";
-    homepage = "https://github.com/jorgebucaran/autopair.fish";
-    license = licenses.mit;
-    maintainers = with maintainers; [ thehedgeh0g ];
-  };
-}
diff --git a/pkgs/shells/fish/plugins/autopair.nix b/pkgs/shells/fish/plugins/autopair.nix
index d1036829bfdb..50b5a30b1d93 100644
--- a/pkgs/shells/fish/plugins/autopair.nix
+++ b/pkgs/shells/fish/plugins/autopair.nix
@@ -2,19 +2,19 @@
 
 buildFishPlugin rec {
   pname = "autopair";
-  version = "1.0.3";
+  version = "1.0.4";
 
   src = fetchFromGitHub {
     owner = "jorgebucaran";
     repo = "autopair.fish";
     rev = version;
-    sha256 = "sha256-l6WJ2kjDO/TnU9FSigjxk5xFp90xl68gDfggkE/wrlM=";
+    sha256 = "sha256-s1o188TlwpUQEN3X5MxUlD/2CFCpEkWu83U9O+wg3VU=";
   };
 
   meta = with lib; {
     description = "Auto-complete matching pairs in the Fish command line";
     homepage = "https://github.com/jorgebucaran/autopair.fish";
     license = licenses.mit;
-    maintainers = with maintainers; [ kidonng ];
+    maintainers = with maintainers; [ figsoda kidonng thehedgeh0g ];
   };
 }
diff --git a/pkgs/shells/fish/plugins/default.nix b/pkgs/shells/fish/plugins/default.nix
index 718dbfec7a64..9197c4907fdf 100644
--- a/pkgs/shells/fish/plugins/default.nix
+++ b/pkgs/shells/fish/plugins/default.nix
@@ -1,10 +1,8 @@
-{ lib, newScope }:
+{ lib, newScope, config }:
 
 lib.makeScope newScope (self: with self; {
   autopair = callPackage ./autopair.nix { };
 
-  autopair-fish = callPackage ./autopair-fish.nix { };
-
   buildFishPlugin = callPackage ./build-fish-plugin.nix { };
 
   colored-man-pages = callPackage ./colored-man-pages.nix { };
@@ -41,4 +39,6 @@ lib.makeScope newScope (self: with self; {
   sponge = callPackage ./sponge.nix { };
 
   tide = callPackage ./tide.nix { };
+} // lib.optionalAttrs config.allowAliases {
+  autopair-fish = self.autopair; # Added 2023-03-10
 })
diff --git a/pkgs/test/texlive/default.nix b/pkgs/test/texlive/default.nix
index 217a862e1c56..cb607f3a1328 100644
--- a/pkgs/test/texlive/default.nix
+++ b/pkgs/test/texlive/default.nix
@@ -1,6 +1,26 @@
 { lib, runCommand, fetchurl, file, texlive, writeShellScript }:
 
 {
+
+  luaotfload-fonts = runCommand "texlive-test-lualatex" {
+    nativeBuildInputs = [
+      (with texlive; combine { inherit scheme-medium libertinus-fonts; })
+    ];
+    input = builtins.toFile "lualatex-testfile.tex" ''
+      \documentclass{article}
+      \usepackage{fontspec}
+      \setmainfont{Libertinus Serif}
+      \begin{document}
+        \LaTeX{} is great
+      \end{document}
+    '';
+  }
+  ''
+    export HOME="$(mktemp -d)"
+    lualatex -halt-on-error "$input"
+    echo success > $out
+  '';
+
   chktex = runCommand "texlive-test-chktex" {
     nativeBuildInputs = [
       (with texlive; combine { inherit scheme-infraonly chktex; })
diff --git a/pkgs/tools/admin/aws-vault/default.nix b/pkgs/tools/admin/aws-vault/default.nix
index 49c5e99a353b..cb9e3d125579 100644
--- a/pkgs/tools/admin/aws-vault/default.nix
+++ b/pkgs/tools/admin/aws-vault/default.nix
@@ -7,16 +7,16 @@
 }:
 buildGoModule rec {
   pname = "aws-vault";
-  version = "7.0.0";
+  version = "7.0.2";
 
   src = fetchFromGitHub {
     owner = "99designs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-i7wL59MvjsLhEIs3Ejc/DB2m6IfrZqLCeSs1ziPCz+0=";
+    sha256 = "sha256-uNe2dltwLoUBUH/p4CN6HCOvBsq2yASxxwkSEtkJRbQ=";
   };
 
-  vendorHash = "sha256-kcaQw2ooJupMsK9rYlYZOIAW5H4Oa346K9VGjdnaq1E=";
+  vendorHash = "sha256-CPn4JLIZz23ZNcl3LPJumx20WOXTI13s69MVo/Pof+s=";
 
   nativeBuildInputs = [ installShellFiles makeWrapper ];
 
diff --git a/pkgs/tools/admin/pulumi/default.nix b/pkgs/tools/admin/pulumi/default.nix
index 0f1cbb65f91e..2787358fdf2d 100644
--- a/pkgs/tools/admin/pulumi/default.nix
+++ b/pkgs/tools/admin/pulumi/default.nix
@@ -14,7 +14,7 @@
 
 buildGoModule rec {
   pname = "pulumi";
-  version = "3.56.0";
+  version = "3.57.1";
 
   # Used in pulumi-language packages, which inherit this prop
   sdkVendorHash = "sha256-oXsU4h4CwukJHttYLT7JiW2He8Yq5qAwnxL8+G5FIpc=";
@@ -23,12 +23,12 @@ buildGoModule rec {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-cXNYg5zNfZTTuv+EaSGuaA9mbMPq7vKTKcsxfnM3NbQ=";
+    hash = "sha256-F5mrk0Qb5Hxjx49KEXEUBN6wB52ztTuV+L37/I0tF48=";
     # Some tests rely on checkout directory name
     name = "pulumi";
   };
 
-  vendorHash = "sha256-TWpH3y+7kLknPy+CExhnjfEvaIWWs1d5JCVF3FA1Z7I=";
+  vendorHash = "sha256-G+5UuiIMWQSp5I8EnlWo32jUkg0ini/UhQYA/MTYB0Y=";
 
   sourceRoot = "${src.name}/pkg";
 
diff --git a/pkgs/tools/admin/trivy/default.nix b/pkgs/tools/admin/trivy/default.nix
index 8cd06a6fc1c1..87c31cf736bb 100644
--- a/pkgs/tools/admin/trivy/default.nix
+++ b/pkgs/tools/admin/trivy/default.nix
@@ -5,17 +5,17 @@
 
 buildGoModule rec {
   pname = "trivy";
-  version = "0.38.1";
+  version = "0.38.2";
 
   src = fetchFromGitHub {
     owner = "aquasecurity";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-b5HKYZOitn8opqlrgULEYU6fsmQjWKEHRyM0GwLH9jk=";
+    sha256 = "sha256-mQXXS3Hg7bnspdznvThRKaY7aoCB8UsBP6J1tVZKTj4=";
   };
   # hash missmatch on across linux and darwin
   proxyVendor = true;
-  vendorHash = "sha256-HBmQOd6uihGJULnHYU+biXRUYJkpL2Dw7S9EswqsbNs=";
+  vendorHash = "sha256-PTPhfgI7wheK1brr/YvDh1T01vCu7YoJX8UB+SGV3Zg=";
 
   excludedPackages = "misc";
 
diff --git a/pkgs/tools/misc/boxxy/default.nix b/pkgs/tools/misc/boxxy/default.nix
index 6e50eebe722a..117efce55071 100644
--- a/pkgs/tools/misc/boxxy/default.nix
+++ b/pkgs/tools/misc/boxxy/default.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "boxxy";
-  version = "0.3.5";
+  version = "0.3.6";
 
   src = fetchFromGitHub {
     owner = "queer";
     repo = "boxxy";
     rev = "v${version}";
-    hash = "sha256-BTVbx6Fk10A2SayXAH4hRRcUqI6+3VEW25vj3sdApqI=";
+    hash = "sha256-Iy4PDtqjAqZ8MKPAnPqLqsd+d37PB57fJE8C1fOdfQ4=";
   };
 
-  cargoHash = "sha256-eCi8dcaeNjuU7a7W4IJqz9bRbde6PLy/WJCipgancRE=";
+  cargoHash = "sha256-wBSgdVNoGksvMFcRRAvYXrIw12BlW40zSPOmboGuVhQ=";
 
   meta = with lib; {
     description = "Puts bad Linux applications in a box with only their files";
diff --git a/pkgs/tools/networking/dnsperf/default.nix b/pkgs/tools/networking/dnsperf/default.nix
index f4d6dcdb9965..d7b1dd365a27 100644
--- a/pkgs/tools/networking/dnsperf/default.nix
+++ b/pkgs/tools/networking/dnsperf/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "dnsperf";
-  version = "2.11.0";
+  version = "2.11.1";
 
   src = fetchFromGitHub {
     owner = "DNS-OARC";
     repo = "dnsperf";
     rev = "v${version}";
-    sha256 = "sha256-HLh+Z+ik7F52MBqQEMf1PuqTB32JOrpS8sHrqqln5kU=";
+    sha256 = "sha256-dgPpuX8Geo20BV8g0uhjSdsZUOoC+Dnz4Y2vdMW6KjY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/networking/frp/default.nix b/pkgs/tools/networking/frp/default.nix
index 030de9840fe3..6b09adea63b6 100644
--- a/pkgs/tools/networking/frp/default.nix
+++ b/pkgs/tools/networking/frp/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "frp";
-  version = "0.47.0";
+  version = "0.48.0";
 
   src = fetchFromGitHub {
     owner = "fatedier";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-S2qccDzS+Kj1tEAUR4a0G/4Eu3DAF7lY7ffxU6aykVU=";
+    sha256 = "sha256-e9Qof+HxSJHzAUbLb+w5oWPTOslTPxnC8BVAmtMQGlE=";
   };
 
-  vendorHash = "sha256-ffkXNE3LkgdCGfO6K9lGxEMxT/9Q1o0m3BMtu6tDHdk=";
+  vendorHash = "sha256-DhzirX+AGe8dE62M0hiE5SlWK8HqhNN0MMk9i2Ntrs8=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/networking/smartdns/default.nix b/pkgs/tools/networking/smartdns/default.nix
index d02a1ccac11e..25054fc1944d 100644
--- a/pkgs/tools/networking/smartdns/default.nix
+++ b/pkgs/tools/networking/smartdns/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "smartdns";
-  version = "40";
+  version = "41";
 
   src = fetchFromGitHub {
     owner = "pymumu";
     repo = pname;
     rev = "Release${version}";
-    sha256 = "sha256-Un4LUBWVwbWYK4rZY2+gdk6Zi+n36Xawma8Dok2Sa0U=";
+    sha256 = "sha256-FVHOjW5SEShxTPPd4IuEfPV6vvqr0RepV976eJmxqwM=";
   };
 
   buildInputs = [ openssl ];
diff --git a/pkgs/tools/security/goverview/default.nix b/pkgs/tools/security/goverview/default.nix
new file mode 100644
index 000000000000..77f46526d95d
--- /dev/null
+++ b/pkgs/tools/security/goverview/default.nix
@@ -0,0 +1,34 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
+
+buildGoModule rec {
+  pname = "goverview";
+  version = "1.0.1";
+
+  src = fetchFromGitHub {
+    owner = "j3ssie";
+    repo = "goverview";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-IgvpMuDwMK9IdPs1IRbPbpgr7xZuDX3boVT5d7Lb+3w=";
+  };
+
+  vendorHash = "sha256-i/m2s9e8PDfGmguNihynVI3Y7nAXC4weoWFXOwUVDSE=";
+
+  ldflags = [
+    "-w"
+    "-s"
+  ];
+
+  # Tests require network access
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Tool to get an overview of the list of URLs";
+    homepage = "https://github.com/j3ssie/goverview";
+    changelog = "https://github.com/j3ssie/goverview/releases/tag/v${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/tools/text/csvquote/csvquote-path.patch b/pkgs/tools/text/csvquote/csvquote-path.patch
new file mode 100644
index 000000000000..a3f87055f238
--- /dev/null
+++ b/pkgs/tools/text/csvquote/csvquote-path.patch
@@ -0,0 +1,14 @@
+--- a/csvheader
++++ b/csvheader
+@@ -29,10 +29,6 @@ while getopts "d:tq:r:" arg; do
+     esac
+ done
+ 
+-CSVQUOTE=`which csvquote` || CSVQUOTE="./csvquote"
+-if [ ! -f $CSVQUOTE ]; then
+-    echo "csvquote program not found. exiting"
+-    exit 1
+-fi
++CSVQUOTE=@out@/bin/csvquote
+ 
+ $CSVQUOTE $@ | head -n 1 | tr "$DEL" '\n' | nl -ba | $CSVQUOTE -u -d "$DEL" -q "$QUO" -r "$REC"
diff --git a/pkgs/tools/text/csvquote/default.nix b/pkgs/tools/text/csvquote/default.nix
new file mode 100644
index 000000000000..2812de208412
--- /dev/null
+++ b/pkgs/tools/text/csvquote/default.nix
@@ -0,0 +1,47 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, patsh
+}:
+
+stdenv.mkDerivation rec {
+  pname = "csvquote";
+  version = "0.1.5";
+
+  src = fetchFromGitHub {
+    owner = "dbro";
+    repo = "csvquote";
+    rev = "v${version}";
+    hash = "sha256-847JAoDEfA9K4LB8z9cqSw+GTImqmITBylB/4odLDb0=";
+  };
+
+  patches = [
+    # patch csvheader to use csvquote from the derivation
+    ./csvquote-path.patch
+  ];
+
+  nativeBuildInputs = [
+    patsh
+  ];
+
+  makeFlags = [
+    "BINDIR=$(out)/bin"
+  ];
+
+  preInstall = ''
+    mkdir -p "$out/bin"
+  '';
+
+  postInstall = ''
+    substituteAllInPlace $out/bin/csvheader
+    patsh $out/bin/csvheader -fs ${builtins.storeDir}
+  '';
+
+  meta = with lib; {
+    description = "Enables common unix utlities like cut, awk, wc, head to work correctly with csv data containing delimiters and newlines";
+    homepage = "https://github.com/dbro/csvquote";
+    license = licenses.mit;
+    maintainers = with maintainers; [ figsoda ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/tools/text/mdbook-katex/default.nix b/pkgs/tools/text/mdbook-katex/default.nix
index bb0db2740d33..40999bc71ebb 100644
--- a/pkgs/tools/text/mdbook-katex/default.nix
+++ b/pkgs/tools/text/mdbook-katex/default.nix
@@ -2,14 +2,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mdbook-katex";
-  version = "0.3.9";
+  version = "0.3.10";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-FsKHGw/6n/8eCJh1XatNsw3iCzD+siHdJ3i0dNKD5Go=";
+    hash = "sha256-oGefjf4URmE0i6mOjpZfBcSh280O+IvrAhu3vFAyntQ=";
   };
 
-  cargoHash = "sha256-nyLWbwruzQeyPGkVuMiRCTHtFE+E9nQ57ZMXxqIcLxE=";
+  cargoHash = "sha256-tkMdxkJcvmDSH2ree1nol1JlKKhI5G4x9x5Hs0peKI8=";
 
   OPENSSL_DIR = "${lib.getDev openssl}";
   OPENSSL_LIB_DIR = "${lib.getLib openssl}/lib";
diff --git a/pkgs/tools/typesetting/tex/texlive/bin.nix b/pkgs/tools/typesetting/tex/texlive/bin.nix
index 6876e4090074..255c208783f9 100644
--- a/pkgs/tools/typesetting/tex/texlive/bin.nix
+++ b/pkgs/tools/typesetting/tex/texlive/bin.nix
@@ -30,6 +30,14 @@ let
       for i in texk/kpathsea/mktex*; do
         sed -i '/^mydir=/d' "$i"
       done
+
+      # ST_NLINK_TRICK causes kpathsea to treat folders with no real subfolders
+      # as leaves, even if they contain symlinks to other folders; must be
+      # disabled to work correctly with the nix store", see section 5.3.6
+      # “Subdirectory expansion” of the kpathsea manual
+      # http://mirrors.ctan.org/systems/doc/kpathsea/kpathsea.pdf for more
+      # details
+      sed -i '/^#define ST_NLINK_TRICK/d' texk/kpathsea/config.h
     '';
 
     configureFlags = [
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 591faf456450..9e29fcf3383c 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -4315,6 +4315,8 @@ with pkgs;
 
   csvkit = callPackage ../tools/text/csvkit { };
 
+  csvquote = callPackage ../tools/text/csvquote { };
+
   csvtool = callPackage ../development/ocaml-modules/csv/csvtool.nix { };
 
   csv2latex = callPackage ../tools/misc/csv2latex { };
@@ -26611,6 +26613,8 @@ with pkgs;
 
   govendor = callPackage ../development/tools/govendor { };
 
+  goverview = callPackage ../tools/security/goverview { };
+
   go-tools = callPackage ../development/tools/go-tools { };
 
   gotest = callPackage ../development/tools/gotest { };