diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix
index 7caaf5611cc0..0c2333399e81 100644
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@@ -255,20 +255,22 @@ let
             else defaultListen;
 
         listenString = { addr, port, ssl, extraParameters ? [], ... }:
-          "listen ${addr}:${toString port} "
-          + optionalString ssl "ssl "
-          + optionalString (ssl && vhost.http2) "http2 "
-          + optionalString vhost.default "default_server "
-          + optionalString (extraParameters != []) (concatStringsSep " " extraParameters)
-          + ";"
-          + (if ssl && vhost.http3 then ''
+          (if ssl && vhost.http3 then "
           # UDP listener for **QUIC+HTTP/3
-          listen ${addr}:${toString port} http3 reuseport;
-          # Advertise that HTTP/3 is available
-          add_header Alt-Svc 'h3=":443"';
-          # Sent when QUIC was used
-          add_header QUIC-Status $quic;
-          '' else "");
+          listen ${addr}:${toString port} http3 "
+          + optionalString vhost.default "default_server "
+          + optionalString vhost.reuseport "reuseport "
+          + optionalString (extraParameters != []) (concatStringsSep " " extraParameters)
+          + ";" else "")
+          + "
+
+            listen ${addr}:${toString port} "
+          + optionalString (ssl && vhost.http2) "http2 "
+          + optionalString ssl "ssl "
+          + optionalString vhost.default "default_server "
+          + optionalString vhost.reuseport "reuseport "
+          + optionalString (extraParameters != []) (concatStringsSep " " extraParameters)
+          + ";";
 
         redirectListen = filter (x: !x.ssl) defaultListen;
 
@@ -321,6 +323,11 @@ let
             ssl_conf_command Options KTLS;
           ''}
 
+          ${optionalString (hasSSL && vhost.http3) ''
+            # Advertise that HTTP/3 is available
+            add_header Alt-Svc 'h3=":443"; ma=86400' always;
+          ''}
+
           ${mkBasicAuth vhostName vhost}
 
           ${mkLocations vhost.locations}
diff --git a/nixos/modules/services/web-servers/nginx/vhost-options.nix b/nixos/modules/services/web-servers/nginx/vhost-options.nix
index c4e8285dc48b..2c77d6ee8162 100644
--- a/nixos/modules/services/web-servers/nginx/vhost-options.nix
+++ b/nixos/modules/services/web-servers/nginx/vhost-options.nix
@@ -20,7 +20,7 @@ with lib;
     serverAliases = mkOption {
       type = types.listOf types.str;
       default = [];
-      example = ["www.example.org" "example.org"];
+      example = [ "www.example.org" "example.org" ];
       description = ''
         Additional names of virtual hosts served by this virtual host configuration.
       '';
@@ -31,11 +31,11 @@ with lib;
         addr = mkOption { type = str;  description = "IP address.";  };
         port = mkOption { type = int;  description = "Port number."; default = 80; };
         ssl  = mkOption { type = bool; description = "Enable SSL.";  default = false; };
-        extraParameters = mkOption { type = listOf str; description = "Extra parameters of this listen directive."; default = []; example = [ "reuseport" "deferred" ]; };
+        extraParameters = mkOption { type = listOf str; description = "Extra parameters of this listen directive."; default = []; example = [ "backlog=1024" "deferred" ]; };
       }; });
       default = [];
       example = [
-        { addr = "195.154.1.1"; port = 443; ssl = true;}
+        { addr = "195.154.1.1"; port = 443; ssl = true; }
         { addr = "192.154.1.1"; port = 80; }
       ];
       description = ''
@@ -207,6 +207,15 @@ with lib;
       '';
     };
 
+    reuseport = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Create an individual listening socket .
+        It is required to specify only once on one of the hosts.
+      '';
+    };
+
     root = mkOption {
       type = types.nullOr types.path;
       default = null;
diff --git a/nixos/modules/system/activation/top-level.nix b/nixos/modules/system/activation/top-level.nix
index b8aeee8c11b3..df8db7f34d0d 100644
--- a/nixos/modules/system/activation/top-level.nix
+++ b/nixos/modules/system/activation/top-level.nix
@@ -55,11 +55,15 @@ let
       substituteInPlace $out/dry-activate --subst-var out
       chmod u+x $out/activate $out/dry-activate
       unset activationScript dryActivationScript
-      ${pkgs.stdenv.shellDryRun} $out/activate
-      ${pkgs.stdenv.shellDryRun} $out/dry-activate
 
-      cp ${config.system.build.bootStage2} $out/init
-      substituteInPlace $out/init --subst-var-by systemConfig $out
+      ${if config.boot.initrd.systemd.enable then ''
+        cp ${config.system.build.bootStage2} $out/prepare-root
+        substituteInPlace $out/prepare-root --subst-var-by systemConfig $out
+        ln -s "$systemd/lib/systemd/systemd" $out/init
+      '' else ''
+        cp ${config.system.build.bootStage2} $out/init
+        substituteInPlace $out/init --subst-var-by systemConfig $out
+      ''}
 
       ln -s ${config.system.build.etc}/etc $out/etc
       ln -s ${config.system.path} $out/sw
diff --git a/nixos/modules/system/boot/stage-2-init.sh b/nixos/modules/system/boot/stage-2-init.sh
index 096a051f8684..f2a839d07868 100755
--- a/nixos/modules/system/boot/stage-2-init.sh
+++ b/nixos/modules/system/boot/stage-2-init.sh
@@ -5,28 +5,30 @@ systemConfig=@systemConfig@
 export HOME=/root PATH="@path@"
 
 
-# Process the kernel command line.
-for o in $(</proc/cmdline); do
-    case $o in
-        boot.debugtrace)
-            # Show each command.
-            set -x
-            ;;
-    esac
-done
+if [ "${IN_NIXOS_SYSTEMD_STAGE1:-}" != true ]; then
+    # Process the kernel command line.
+    for o in $(</proc/cmdline); do
+        case $o in
+            boot.debugtrace)
+                # Show each command.
+                set -x
+                ;;
+        esac
+    done
 
 
-# Print a greeting.
-echo
-echo -e "\e[1;32m<<< NixOS Stage 2 >>>\e[0m"
-echo
+    # Print a greeting.
+    echo
+    echo -e "\e[1;32m<<< NixOS Stage 2 >>>\e[0m"
+    echo
 
 
-# Normally, stage 1 mounts the root filesystem read/writable.
-# However, in some environments, stage 2 is executed directly, and the
-# root is read-only.  So make it writable here.
-if [ -z "$container" ]; then
-    mount -n -o remount,rw none /
+    # Normally, stage 1 mounts the root filesystem read/writable.
+    # However, in some environments, stage 2 is executed directly, and the
+    # root is read-only.  So make it writable here.
+    if [ -z "$container" ]; then
+        mount -n -o remount,rw none /
+    fi
 fi
 
 
@@ -39,6 +41,12 @@ if [ ! -e /proc/1 ]; then
         local options="$3"
         local fsType="$4"
 
+        # We must not overwrite this mount because it's bind-mounted
+        # from stage 1's /run
+        if [ "${IN_NIXOS_SYSTEMD_STAGE1:-}" = true ] && [ "${mountPoint}" = /run ]; then
+            return
+        fi
+
         install -m 0755 -d "$mountPoint"
         mount -n -t "$fsType" -o "$options" "$device" "$mountPoint"
     }
@@ -46,7 +54,11 @@ if [ ! -e /proc/1 ]; then
 fi
 
 
-echo "booting system configuration $systemConfig" > /dev/kmsg
+if [ "${IN_NIXOS_SYSTEMD_STAGE1:-}" = true ]; then
+    echo "booting system configuration ${systemConfig}"
+else
+    echo "booting system configuration $systemConfig" > /dev/kmsg
+fi
 
 
 # Make /nix/store a read-only bind mount to enforce immutability of
@@ -68,24 +80,26 @@ if [ -n "@readOnlyStore@" ]; then
 fi
 
 
-# Use /etc/resolv.conf supplied by systemd-nspawn, if applicable.
-if [ -n "@useHostResolvConf@" ] && [ -e /etc/resolv.conf ]; then
-    resolvconf -m 1000 -a host </etc/resolv.conf
-fi
+if [ "${IN_NIXOS_SYSTEMD_STAGE1:-}" != true ]; then
+    # Use /etc/resolv.conf supplied by systemd-nspawn, if applicable.
+    if [ -n "@useHostResolvConf@" ] && [ -e /etc/resolv.conf ]; then
+        resolvconf -m 1000 -a host </etc/resolv.conf
+    fi
 
 
-# Log the script output to /dev/kmsg or /run/log/stage-2-init.log.
-# Only at this point are all the necessary prerequisites ready for these commands.
-exec {logOutFd}>&1 {logErrFd}>&2
-if test -w /dev/kmsg; then
-    exec > >(tee -i /proc/self/fd/"$logOutFd" | while read -r line; do
-        if test -n "$line"; then
-            echo "<7>stage-2-init: $line" > /dev/kmsg
-        fi
-    done) 2>&1
-else
-    mkdir -p /run/log
-    exec > >(tee -i /run/log/stage-2-init.log) 2>&1
+    # Log the script output to /dev/kmsg or /run/log/stage-2-init.log.
+    # Only at this point are all the necessary prerequisites ready for these commands.
+    exec {logOutFd}>&1 {logErrFd}>&2
+    if test -w /dev/kmsg; then
+        exec > >(tee -i /proc/self/fd/"$logOutFd" | while read -r line; do
+            if test -n "$line"; then
+                echo "<7>stage-2-init: $line" > /dev/kmsg
+            fi
+        done) 2>&1
+    else
+        mkdir -p /run/log
+        exec > >(tee -i /run/log/stage-2-init.log) 2>&1
+    fi
 fi
 
 
@@ -116,11 +130,15 @@ ln -sfn "$systemConfig" /run/booted-system
 : >> /etc/machine-id
 
 
-# Reset the logging file descriptors.
-exec 1>&$logOutFd 2>&$logErrFd
-exec {logOutFd}>&- {logErrFd}>&-
+# No need to restore the stdout/stderr streams we never redirected and
+# especially no need to start systemd
+if [ "${IN_NIXOS_SYSTEMD_STAGE1:-}" != true ]; then
+    # Reset the logging file descriptors.
+    exec 1>&$logOutFd 2>&$logErrFd
+    exec {logOutFd}>&- {logErrFd}>&-
 
 
-# Start systemd in a clean environment.
-echo "starting systemd..."
-exec @systemdExecutable@ "$@"
+    # Start systemd in a clean environment.
+    echo "starting systemd..."
+    exec @systemdExecutable@ "$@"
+fi
diff --git a/nixos/modules/system/boot/systemd/initrd.nix b/nixos/modules/system/boot/systemd/initrd.nix
index c383486bb0bc..dab06a7b98e7 100644
--- a/nixos/modules/system/boot/systemd/initrd.nix
+++ b/nixos/modules/system/boot/systemd/initrd.nix
@@ -125,7 +125,7 @@ let
   };
 
   initrdBinEnv = pkgs.buildEnv {
-    name = "initrd-emergency-env";
+    name = "initrd-bin-env";
     paths = map getBin cfg.initrdBin;
     pathsToLink = ["/bin" "/sbin"];
     postBuild = concatStringsSep "\n" (mapAttrsToList (n: v: "ln -s '${v}' $out/bin/'${n}'") cfg.extraBin);
@@ -355,8 +355,9 @@ in {
     boot.initrd.availableKernelModules = [ "autofs4" ]; # systemd needs this for some features
 
     boot.initrd.systemd = {
-      initrdBin = [pkgs.bash pkgs.coreutils pkgs.kmod cfg.package] ++ config.system.fsPackages;
+      initrdBin = [pkgs.bash pkgs.coreutils cfg.package.kmod cfg.package] ++ config.system.fsPackages;
       extraBin = {
+        less = "${pkgs.less}/bin/less";
         mount = "${cfg.package.util-linux}/bin/mount";
         umount = "${cfg.package.util-linux}/bin/umount";
       };
@@ -367,7 +368,7 @@ in {
 
         "/etc/systemd/system.conf".text = ''
           [Manager]
-          DefaultEnvironment=PATH=/bin:/sbin
+          DefaultEnvironment=PATH=/bin:/sbin ${optionalString (isBool cfg.emergencyAccess && cfg.emergencyAccess) "SYSTEMD_SULOGIN_FORCE=1"}
         '';
 
         "/etc/fstab".source = fstab;
@@ -394,7 +395,9 @@ in {
         "${cfg.package}/lib/systemd/systemd-journald"
         "${cfg.package}/lib/systemd/systemd-makefs"
         "${cfg.package}/lib/systemd/systemd-modules-load"
+        "${cfg.package}/lib/systemd/systemd-random-seed"
         "${cfg.package}/lib/systemd/systemd-remount-fs"
+        "${cfg.package}/lib/systemd/systemd-shutdown"
         "${cfg.package}/lib/systemd/systemd-sulogin-shell"
         "${cfg.package}/lib/systemd/systemd-sysctl"
         "${cfg.package}/lib/systemd/systemd-udevd"
@@ -410,7 +413,7 @@ in {
         "${cfg.package.util-linux}/bin/sulogin"
 
         # so NSS can look up usernames
-        "${pkgs.glibc}/lib/libnss_files.so"
+        "${pkgs.glibc}/lib/libnss_files.so.2"
       ] ++ jobScripts;
 
       targets.initrd.aliases = ["default.target"];
@@ -428,9 +431,6 @@ in {
                      (v: let n = escapeSystemdPath v.where;
                          in nameValuePair "${n}.automount" (automountToUnit n v)) cfg.automounts);
 
-      services.emergency = mkIf (isBool cfg.emergencyAccess && cfg.emergencyAccess) {
-        environment.SYSTEMD_SULOGIN_FORCE = "1";
-      };
       # The unit in /run/systemd/generator shadows the unit in
       # /etc/systemd/system, but will still apply drop-ins from
       # /etc/systemd/system/foo.service.d/
@@ -445,6 +445,67 @@ in {
       '')];
       services."systemd-makefs@".unitConfig.IgnoreOnIsolate = true;
       services."systemd-growfs@".unitConfig.IgnoreOnIsolate = true;
+
+      services.initrd-nixos-activation = {
+        after = [ "initrd-fs.target" ];
+        requiredBy = [ "initrd.target" ];
+        unitConfig.AssertPathExists = "/etc/initrd-release";
+        serviceConfig.Type = "oneshot";
+        description = "NixOS Activation";
+
+        script = /* bash */ ''
+          set -uo pipefail
+          export PATH="/bin:${cfg.package.util-linux}/bin"
+
+          # Figure out what closure to boot
+          closure=
+          for o in $(< /proc/cmdline); do
+              case $o in
+                  init=*)
+                      IFS== read -r -a initParam <<< "$o"
+                      closure="$(dirname "''${initParam[1]}")"
+                      ;;
+              esac
+          done
+
+          # Sanity check
+          if [ -z "''${closure:-}" ]; then
+            echo 'No init= parameter on the kernel command line' >&2
+            exit 1
+          fi
+
+          # If we are not booting a NixOS closure (e.g. init=/bin/sh),
+          # we don't know what root to prepare so we don't do anything
+          if ! [ -x "/sysroot$closure/prepare-root" ]; then
+            echo "NEW_INIT=''${initParam[1]}" > /etc/switch-root.conf
+            echo "$closure does not look like a NixOS installation - not activating"
+            exit 0
+          fi
+          echo 'NEW_INIT=' > /etc/switch-root.conf
+
+
+          # We need to propagate /run for things like /run/booted-system
+          # and /run/current-system.
+          mkdir -p /sysroot/run
+          mount --bind /run /sysroot/run
+
+          # Initialize the system
+          export IN_NIXOS_SYSTEMD_STAGE1=true
+          exec chroot /sysroot $closure/prepare-root
+        '';
+      };
+
+      # This will either call systemctl with the new init as the last parameter (which
+      # is the case when not booting a NixOS system) or with an empty string, causing
+      # systemd to bypass its verification code that checks whether the next file is a systemd
+      # and using its compiled-in value
+      services.initrd-switch-root.serviceConfig = {
+        EnvironmentFile = "-/etc/switch-root.conf";
+        ExecStart = [
+          ""
+          ''systemctl --no-block switch-root /sysroot "''${NEW_INIT}"''
+        ];
+      };
     };
   };
 }
diff --git a/nixos/tests/systemd-initrd-simple.nix b/nixos/tests/systemd-initrd-simple.nix
index ba62cdf3bbc7..959cc87c0f26 100644
--- a/nixos/tests/systemd-initrd-simple.nix
+++ b/nixos/tests/systemd-initrd-simple.nix
@@ -14,14 +14,31 @@ import ./make-test-python.nix ({ lib, pkgs, ... }: {
   testScript = ''
     import subprocess
 
-    oldAvail = machine.succeed("df --output=avail / | sed 1d")
-    machine.shutdown()
+    with subtest("handover to stage-2 systemd works"):
+        machine.wait_for_unit("multi-user.target")
+        machine.succeed("systemd-analyze | grep -q '(initrd)'")  # direct handover
+        machine.succeed("touch /testfile")  # / is writable
+        machine.fail("touch /nix/store/testfile")  # /nix/store is not writable
+        # Special filesystems are mounted by systemd
+        machine.succeed("[ -e /run/booted-system ]") # /run
+        machine.succeed("[ -e /sys/class ]") # /sys
+        machine.succeed("[ -e /dev/null ]") # /dev
+        machine.succeed("[ -e /proc/1 ]") # /proc
+        # stage-2-init mounted more special filesystems
+        machine.succeed("[ -e /dev/shm ]") # /dev/shm
+        machine.succeed("[ -e /dev/pts/ptmx ]") # /dev/pts
+        machine.succeed("[ -e /run/keys ]") # /run/keys
 
-    subprocess.check_call(["qemu-img", "resize", "vm-state-machine/machine.qcow2", "+1G"])
 
-    machine.start()
-    newAvail = machine.succeed("df --output=avail / | sed 1d")
+    with subtest("growfs works"):
+        oldAvail = machine.succeed("df --output=avail / | sed 1d")
+        machine.shutdown()
 
-    assert int(oldAvail) < int(newAvail), "File system did not grow"
+        subprocess.check_call(["qemu-img", "resize", "vm-state-machine/machine.qcow2", "+1G"])
+
+        machine.start()
+        newAvail = machine.succeed("df --output=avail / | sed 1d")
+
+        assert int(oldAvail) < int(newAvail), "File system did not grow"
   '';
 })
diff --git a/pkgs/applications/audio/faustPhysicalModeling/default.nix b/pkgs/applications/audio/faustPhysicalModeling/default.nix
index f9dbd3f80f0c..bea08b0bfc9f 100644
--- a/pkgs/applications/audio/faustPhysicalModeling/default.nix
+++ b/pkgs/applications/audio/faustPhysicalModeling/default.nix
@@ -1,13 +1,13 @@
 { stdenv, lib, fetchFromGitHub, faust2jaqt, faust2lv2 }:
 stdenv.mkDerivation rec {
   pname = "faustPhysicalModeling";
-  version = "2.37.3";
+  version = "2.40.0";
 
   src = fetchFromGitHub {
     owner = "grame-cncm";
     repo = "faust";
     rev = version;
-    sha256 = "sha256-h6L+qRkN2chnI4821WrjD3uRFw3J0sUYVLL8w57vR1U=";
+    sha256 = "sha256-t3I3j5s2ACHfub+fxxaTwu+5ptEwH0JQpVdmHYOzbCA=";
   };
 
   buildInputs = [ faust2jaqt faust2lv2 ];
diff --git a/pkgs/applications/emulators/flycast/default.nix b/pkgs/applications/emulators/flycast/default.nix
index 67ba4590db62..fd5123d05fa2 100644
--- a/pkgs/applications/emulators/flycast/default.nix
+++ b/pkgs/applications/emulators/flycast/default.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "flycast";
-  version = "1.2";
+  version = "1.3";
 
   src = fetchFromGitHub {
     owner = "flyinghead";
     repo = "flycast";
     rev = "v${version}";
-    sha256 = "sha256-MzHAGK++oukIs84OR/l6gBwCJssdi8Iyte5Rtro2+Q0=";
+    sha256 = "sha256-FAHm8Fu/yv2rJvWCY+g50TYH4zOT6rO7F+jTL2T6EOU=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/misc/electrum-grs/default.nix b/pkgs/applications/misc/electrum-grs/default.nix
index c8fb9f84ad19..d35941ccfb1b 100644
--- a/pkgs/applications/misc/electrum-grs/default.nix
+++ b/pkgs/applications/misc/electrum-grs/default.nix
@@ -9,7 +9,7 @@
 }:
 
 let
-  version = "4.1.5";
+  version = "4.2.0";
 
   libsecp256k1_name =
     if stdenv.isLinux then "libsecp256k1.so.0"
@@ -20,19 +20,6 @@ let
     if stdenv.isLinux then "libzbar.so.0"
     else "libzbar${stdenv.hostPlatform.extensions.sharedLibrary}";
 
-  py = python3.override {
-    packageOverrides = self: super: {
-
-      aiorpcx = super.aiorpcx.overridePythonAttrs (oldAttrs: rec {
-        version = "0.18.7";
-        src = oldAttrs.src.override {
-          inherit version;
-          sha256 = "1rswrspv27x33xa5bnhrkjqzhv0sknv5kd7pl1vidw9d2z4rx2l0";
-        };
-      });
-    };
-  };
-
 in
 
 python3.pkgs.buildPythonApplication {
@@ -43,17 +30,12 @@ python3.pkgs.buildPythonApplication {
     owner = "Groestlcoin";
     repo = "electrum-grs";
     rev = "refs/tags/v${version}";
-    sha256 = "0wvbjj80r1zxpz24adkicxsdjnv3nciga6rl1wfmky463w03rca2";
+    sha256 = "15n6snrs1kgdqkhp4wgs0bxxdz6mzl8dvf8h7s0jzc6r4b74vv3n";
   };
 
-  postPatch = ''
-    substituteInPlace contrib/requirements/requirements.txt \
-      --replace "dnspython>=2.0,<2.1" "dnspython>=2.0"
-  '';
-
   nativeBuildInputs = lib.optionals enableQt [ wrapQtAppsHook ];
 
-  propagatedBuildInputs = with py.pkgs; [
+  propagatedBuildInputs = with python3.pkgs; [
     aiohttp
     aiohttp-socks
     aiorpcx
diff --git a/pkgs/applications/misc/xmrig/default.nix b/pkgs/applications/misc/xmrig/default.nix
index e40a0d7e5ade..b771bd7e6212 100644
--- a/pkgs/applications/misc/xmrig/default.nix
+++ b/pkgs/applications/misc/xmrig/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "xmrig";
-  version = "6.16.4";
+  version = "6.17.0";
 
   src = fetchFromGitHub {
     owner = "xmrig";
     repo = "xmrig";
     rev = "v${version}";
-    sha256 = "sha256-hfdKhTUGoVN4DIURO+e3MOSpsL6GWxOV3LItd0nA51Y=";
+    sha256 = "sha256-K8mN3Wzlay2Qgoo70mu3Bh4lXUXNDpXYt17aNnwWkIc=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/networking/browsers/qutebrowser/default.nix b/pkgs/applications/networking/browsers/qutebrowser/default.nix
index 6d919ce520f5..7ca37d114ea2 100644
--- a/pkgs/applications/networking/browsers/qutebrowser/default.nix
+++ b/pkgs/applications/networking/browsers/qutebrowser/default.nix
@@ -1,10 +1,12 @@
 { stdenv, lib, fetchurl, fetchzip, python3
 , mkDerivationWith, wrapQtAppsHook, wrapGAppsHook, qtbase, qtwebengine, glib-networking
-, asciidoc, docbook_xml_dtd_45, docbook_xsl, libxml2, pipewire_0_2
+, asciidoc, docbook_xml_dtd_45, docbook_xsl, libxml2
 , libxslt, gst_all_1 ? null
 , withPdfReader      ? true
 , withMediaPlayback  ? true
 , backend            ? "webengine"
+, pipewireSupport    ? stdenv.isLinux
+, pipewire_0_2
 }:
 
 assert withMediaPlayback -> gst_all_1 != null;
@@ -121,7 +123,7 @@ in mkDerivationWith python3Packages.buildPythonApplication rec {
       "''${qtWrapperArgs[@]}"
       --add-flags '--backend ${backend}'
       --set QUTE_QTWEBENGINE_VERSION_OVERRIDE "${lib.getVersion qtwebengine}"
-      ${lib.optionalString (!stdenv.isDarwin && backend == "webengine") ''--prefix LD_LIBRARY_PATH : ${libPath}''}
+      ${lib.optionalString (pipewireSupport && backend == "webengine") ''--prefix LD_LIBRARY_PATH : ${libPath}''}
     )
   '';
 
diff --git a/pkgs/applications/networking/cluster/cmctl/default.nix b/pkgs/applications/networking/cluster/cmctl/default.nix
index df34db0e1476..86c7eddd7ab0 100644
--- a/pkgs/applications/networking/cluster/cmctl/default.nix
+++ b/pkgs/applications/networking/cluster/cmctl/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "cmctl";
-  version = "1.7.2";
+  version = "1.8.0";
 
   src = fetchFromGitHub {
     owner = "cert-manager";
     repo = "cert-manager";
     rev = "v${version}";
-    sha256 = "sha256-Hx6MG5GCZyOX0tfpg1bfUT0BOI3p7Mws1VCz2PuUuw8=";
+    sha256 = "sha256-h7GyzjVrfyMHY7yuNmmsym6KGKCQr5R71gjPBTUeMCg=";
   };
 
-  vendorSha256 = "sha256-4zhdpedOmLl/i1G0QCto4ACxguWRZLzOm5HfMBMtvPY=";
+  vendorSha256 = "sha256-UYw9WdQ6VwzuuiOsa1yovkLZG7NmLYSW51p8UhmQMeI=";
 
   subPackages = [ "cmd/ctl" ];
 
diff --git a/pkgs/applications/networking/cluster/starboard/default.nix b/pkgs/applications/networking/cluster/starboard/default.nix
index 30ca2ee1cdee..96c853d21e40 100644
--- a/pkgs/applications/networking/cluster/starboard/default.nix
+++ b/pkgs/applications/networking/cluster/starboard/default.nix
@@ -2,36 +2,42 @@
 
 buildGoModule rec {
   pname = "starboard";
-  version = "0.14.1";
+  version = "0.15.3";
 
   src = fetchFromGitHub {
     owner = "aquasecurity";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-sB7C0IKadgpQ2h6HuH4D6ku/GXnFfFS+fGCW/RBSc10=";
+    sha256 = "sha256-EBjAB0uSMAyiVr6KxqrT/F+GIkntmOKNPHL1D0RBdG0=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
     postFetch = ''
       cd "$out"
-      commit="$(git rev-parse HEAD)"
-      source_date_epoch=$(git log --date=format:'%Y-%m-%dT%H:%M:%SZ' -1 --pretty=%ad)
-      substituteInPlace "$out/cmd/starboard/main.go" \
-        --replace 'commit  = "none"' "commit  = \"$commit\"" \
-        --replace 'date    = "unknown"' "date    = \"$source_date_epoch\""
+      git rev-parse HEAD > $out/COMMIT
+      # 0000-00-00T00:00:00Z
+      date -u -d "@$(git log -1 --pretty=%ct)" "+%Y-%m-%dT%H:%M:%SZ" > $out/SOURCE_DATE_EPOCH
       find "$out" -name .git -print0 | xargs -0 rm -rf
     '';
   };
-  vendorSha256 = "sha256-R7tF724y5WNIByE+9nRoNSZDZzfLtPfK/9tSBkARaN0=";
+  vendorSha256 = "sha256-BxXH+dJyAQRGAq25CljUImxYIT+nCQpmUPUjHOYF0kc=";
 
   nativeBuildInputs = [ installShellFiles ];
 
   subPackages = [ "cmd/starboard" ];
 
   ldflags = [
-    "-s" "-w" "-X main.version=v${version}"
+    "-s"
+    "-w"
+    "-X main.version=v${version}"
   ];
 
+  # ldflags based on metadata from git and source
+  preBuild = ''
+    ldflags+=" -X main.gitCommit=$(cat COMMIT)"
+    ldflags+=" -X main.buildDate=$(cat SOURCE_DATE_EPOCH)"
+  '';
+
   preCheck = ''
     # Remove test that requires networking
     rm pkg/plugin/aqua/client/client_integration_test.go
diff --git a/pkgs/applications/networking/remote/vmware-horizon-client/default.nix b/pkgs/applications/networking/remote/vmware-horizon-client/default.nix
index f114f8a3091b..f3461a426586 100644
--- a/pkgs/applications/networking/remote/vmware-horizon-client/default.nix
+++ b/pkgs/applications/networking/remote/vmware-horizon-client/default.nix
@@ -9,7 +9,7 @@
 , configText ? ""
 }:
 let
-  version = "2111";
+  version = "2203";
 
   sysArch =
     if stdenv.hostPlatform.system == "x86_64-linux" then "x64"
@@ -33,8 +33,8 @@ let
     name = "vmwareHorizonClientFiles";
     inherit version;
     src = fetchurl {
-      url = "https://download3.vmware.com/software/view/viewclients/CART22FH2/VMware-Horizon-Client-Linux-2111-8.4.0-18957622.tar.gz";
-      sha256 = "2f79d2d8d34e6f85a5d21a3350618c4763d60455e7d68647ea40715eaff486f7";
+      url = "https://download3.vmware.com/software/CART23FQ1_LIN_2203_TARBALL/VMware-Horizon-Client-Linux-2203-8.5.0-19586897.tar.gz";
+      sha256 = "27429dddaeedfa8b701d7aa7868f60ad58efa42687d7f27e84375fda9f5cd137";
     };
     nativeBuildInputs = [ makeWrapper ];
     installPhase = ''
diff --git a/pkgs/applications/radio/gnss-sdr/default.nix b/pkgs/applications/radio/gnss-sdr/default.nix
index 383c5710808f..f6e834d53fb3 100644
--- a/pkgs/applications/radio/gnss-sdr/default.nix
+++ b/pkgs/applications/radio/gnss-sdr/default.nix
@@ -1,5 +1,6 @@
 { lib
 , fetchFromGitHub
+, fetchpatch
 , armadillo
 , cmake
 , gmp
@@ -34,6 +35,11 @@ gnuradio.pkgs.mkDerivation rec {
     # cpu_features which is bundled in the source. NOTE: Perhaps this patch
     # should be sent upstream.
     ./fix_libcpu_features_install_path.patch
+    # Fixes a compilation issue, should be removed on next release.
+    (fetchpatch {
+      url = "https://github.com/gnss-sdr/gnss-sdr/commit/8a42967c854e575f2dd9ee7ca81a2522eebb864b.patch";
+      sha256 = "sha256-W8BwC08QVtW0LUj5Q+j28aYG+713s+vQIzsWyrNUs1Q=";
+    })
   ];
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/radio/gnuradio/3.9.nix b/pkgs/applications/radio/gnuradio/3.9.nix
index 638064bbd072..989722fdc3ec 100644
--- a/pkgs/applications/radio/gnuradio/3.9.nix
+++ b/pkgs/applications/radio/gnuradio/3.9.nix
@@ -46,13 +46,13 @@
 , pname ? "gnuradio"
 , versionAttr ? {
   major = "3.9";
-  minor = "5";
+  minor = "6";
   patch = "0";
 }
 }:
 
 let
-  sourceSha256 = "sha256-TWCXLoS+ImKNd2zkxMks4FXsQMvGKgcW5/MW8S1Y1TY=";
+  sourceSha256 = "sha256-0JODgv9MNOkHDQYTVCZMzjr/G542+NvGP9wlH9iwLeg=";
   featuresInfo = {
     # Needed always
     basic = {
@@ -134,6 +134,12 @@ let
       ];
       cmakeEnableFlag = "GRC";
     };
+    jsonyaml_blocks = {
+      pythonRuntime = [
+        python.pkgs.jsonschema
+      ];
+      cmakeEnableFlag = "JSONYAML_BLOCKS";
+    };
     gr-blocks = {
       cmakeEnableFlag = "GR_BLOCKS";
     };
diff --git a/pkgs/applications/radio/gnuradio/default.nix b/pkgs/applications/radio/gnuradio/default.nix
index eef1960ae1f4..14a4763259fa 100644
--- a/pkgs/applications/radio/gnuradio/default.nix
+++ b/pkgs/applications/radio/gnuradio/default.nix
@@ -48,13 +48,13 @@
 , pname ? "gnuradio"
 , versionAttr ? {
   major = "3.10";
-  minor = "1";
-  patch = "1";
+  minor = "2";
+  patch = "0";
 }
 }:
 
 let
-  sourceSha256 = "sha256-vsAK+GQzcpA9Vsa6q4RFEzVpbF7/+yZkMsemKn6VhIg=";
+  sourceSha256 = "sha256-WcfmW39wHhFdpbdBSjOfuDkxL8/fuMjjJoLUyCUud/o=";
   featuresInfo = {
     # Needed always
     basic = {
@@ -136,6 +136,12 @@ let
       ];
       cmakeEnableFlag = "GRC";
     };
+    jsonyaml_blocks = {
+      pythonRuntime = [
+        python.pkgs.jsonschema
+      ];
+      cmakeEnableFlag = "JSONYAML_BLOCKS";
+    };
     gr-blocks = {
       cmakeEnableFlag = "GR_BLOCKS";
     };
@@ -221,6 +227,7 @@ let
         setuptools
         click
         click-plugins
+        pygccxml
       ];
       cmakeEnableFlag = "GR_MODTOOL";
     };
diff --git a/pkgs/applications/radio/gqrx/default.nix b/pkgs/applications/radio/gqrx/default.nix
index 28be25920a45..d138dd350c04 100644
--- a/pkgs/applications/radio/gqrx/default.nix
+++ b/pkgs/applications/radio/gqrx/default.nix
@@ -23,13 +23,13 @@ assert !(pulseaudioSupport && portaudioSupport);
 
 gnuradio3_8Minimal.pkgs.mkDerivation rec {
   pname = "gqrx";
-  version = "2.15.8";
+  version = "2.15.9";
 
   src = fetchFromGitHub {
     owner = "gqrx-sdr";
     repo = "gqrx";
     rev = "v${version}";
-    sha256 = "sha256-RxwkiJdPHWyhU3azSpWV2M0tG5GInQBpc/ls16V1B94=";
+    sha256 = "sha256-KQBtYVEfOXpzfxNMgTu6Hup7XpjubrpvZazcFlml4Kg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/science/robotics/mavproxy/default.nix b/pkgs/applications/science/robotics/mavproxy/default.nix
index c1e5b128fc71..802fe1f946ef 100644
--- a/pkgs/applications/science/robotics/mavproxy/default.nix
+++ b/pkgs/applications/science/robotics/mavproxy/default.nix
@@ -3,11 +3,11 @@
 
 buildPythonApplication rec {
   pname = "MAVProxy";
-  version = "1.8.46";
+  version = "1.8.48";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "c740c11551af4bcb1378772bde77ca6c846c6fd261b79d932c0ecbb164afe3bd";
+    sha256 = "sha256-BigJdAz52D8hg2bQs7tngFqnITut/wENGZ0+gLlAeoY=";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/terminal-emulators/hyper/default.nix b/pkgs/applications/terminal-emulators/hyper/default.nix
index 485c1dead14c..2266e884454b 100644
--- a/pkgs/applications/terminal-emulators/hyper/default.nix
+++ b/pkgs/applications/terminal-emulators/hyper/default.nix
@@ -15,11 +15,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "hyper";
-  version = "3.2.0";
+  version = "3.2.1";
 
   src = fetchurl {
     url = "https://github.com/vercel/hyper/releases/download/v${version}/hyper_${version}_amd64.deb";
-    sha256 = "1ryw3315x0lb60j8nzz78h7zd36r2l1j39hnlfav0p7nq8dhqbpm";
+    sha256 = "sha256-nwaJ+lnuHv+Qb/QkKF/9jG8cvq1Z+urz8CPwxSsMmuA=";
   };
 
   nativeBuildInputs = [ dpkg ];
diff --git a/pkgs/applications/video/f1viewer/default.nix b/pkgs/applications/video/f1viewer/default.nix
index c241dd8a7458..2620142fb11e 100644
--- a/pkgs/applications/video/f1viewer/default.nix
+++ b/pkgs/applications/video/f1viewer/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "f1viewer";
-  version = "2.6.2";
+  version = "2.7.0";
 
   src = fetchFromGitHub {
     owner = "SoMuchForSubtlety";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Z6rnkHypk7r9NnYwqZpWQOuGPbWn/EppS+46PQHIdDM=";
+    sha256 = "sha256-jXC2dENXuqicNQqTHyZKsjibDvjta/npQmf3+uivjX0=";
   };
 
   vendorSha256 = "sha256-UNeH3zxgssXxFpJws6nAL8EgXt0DRyAQfmlJWz/qyDg=";
diff --git a/pkgs/desktops/gnome/extensions/arcmenu/default.nix b/pkgs/desktops/gnome/extensions/arcmenu/default.nix
index 6e6085485306..be4738286794 100644
--- a/pkgs/desktops/gnome/extensions/arcmenu/default.nix
+++ b/pkgs/desktops/gnome/extensions/arcmenu/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-shell-extension-arcmenu";
-  version = "27";
+  version = "30";
 
   src = fetchFromGitLab {
     owner = "arcmenu";
     repo = "ArcMenu";
     rev = "v${version}";
-    sha256 = "sha256-X5oA475Wl3SKVLLcg47Hv91VV8HGeNHhaQLfNi3xt8k=";
+    sha256 = "sha256-BKV1x/MBqVeiqFzpXYt3y8zwK4f5rcGBwFZWqSSUarg=";
   };
 
   patches = [
diff --git a/pkgs/development/compilers/fennel/default.nix b/pkgs/development/compilers/fennel/default.nix
index ec6b3d619e1c..e449b4ef098e 100644
--- a/pkgs/development/compilers/fennel/default.nix
+++ b/pkgs/development/compilers/fennel/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fennel";
-  version = "1.0.0";
+  version = "1.1.0";
 
   src = fetchFromSourcehut {
     owner = "~technomancy";
     repo = pname;
     rev = version;
-    sha256 = "sha256-HhxFTWC1gBY76pQzhn6EdgYHpYQr9zkUox0r4YC7mTQ=";
+    sha256 = "sha256-3Pfl/KNwuGCkZjG/FlF6K2IQHwJQbWsCBmJpLizr1ng=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
diff --git a/pkgs/development/coq-modules/gappalib/default.nix b/pkgs/development/coq-modules/gappalib/default.nix
index 02905dcffed5..23cbd46743b1 100644
--- a/pkgs/development/coq-modules/gappalib/default.nix
+++ b/pkgs/development/coq-modules/gappalib/default.nix
@@ -6,7 +6,8 @@ with lib; mkCoqDerivation {
   owner = "gappa";
   domain = "gitlab.inria.fr";
   inherit version;
-  defaultVersion = if versions.range "8.8" "8.14" coq.coq-version then "1.5.0" else null;
+  defaultVersion = if versions.range "8.8" "8.15" coq.coq-version then "1.5.1" else null;
+  release."1.5.1".sha256 = "1806bq1z6q5rq2ma7d5kfbqfyfr755hjg0dq7b2llry8fx9cxjsg";
   release."1.5.0".sha256 = "1i1c0gakffxqqqqw064cbvc243yl325hxd50jmczr6mk18igk41n";
   release."1.4.5".sha256 = "081hib1d9wfm29kis390qsqch8v6fs3q71g2rgbbzx5y5cf48n9k";
   release."1.4.4".sha256 = "114q2hgw64j6kqa9mg3qcp1nlf0ia46z2xadq81fnkxqm856ml7l";
diff --git a/pkgs/development/libraries/libguestfs/default.nix b/pkgs/development/libraries/libguestfs/default.nix
index 49e76a94b001..d65ead78624c 100644
--- a/pkgs/development/libraries/libguestfs/default.nix
+++ b/pkgs/development/libraries/libguestfs/default.nix
@@ -12,11 +12,11 @@ assert javaSupport -> jdk != null;
 
 stdenv.mkDerivation rec {
   pname = "libguestfs";
-  version = "1.46.2";
+  version = "1.48.0";
 
   src = fetchurl {
     url = "https://libguestfs.org/download/${lib.versions.majorMinor version}-stable/${pname}-${version}.tar.gz";
-    sha256 = "0sq092irlj2jf64m7hjx23hn5k4iypqxmlyn9g2z0q0xab56ksp6";
+    sha256 = "sha256-FoH93t/PSEym3uxUIwMwoy3vvTDCqx+BeI4lLLXQSCk=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index 648357b00cfb..8182a01cd52d 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -69,6 +69,12 @@ let
         x86_64-linux = "./Configure linux-x86_64";
         x86_64-solaris = "./Configure solaris64-x86_64-gcc";
         riscv64-linux = "./Configure linux64-riscv64";
+        mips64el-linux =
+          if stdenv.hostPlatform.isMips64n64
+          then "./Configure linux64-mips64"
+          else if stdenv.hostPlatform.isMips64n32
+          then "./Configure linux-mips64"
+          else throw "unsupported ABI for ${stdenv.hostPlatform.system}";
       }.${stdenv.hostPlatform.system} or (
         if stdenv.hostPlatform == stdenv.buildPlatform
           then "./config"
diff --git a/pkgs/development/libraries/qt-5/modules/qtwebengine.nix b/pkgs/development/libraries/qt-5/modules/qtwebengine.nix
index 01d0c5932828..3c5256908d88 100644
--- a/pkgs/development/libraries/qt-5/modules/qtwebengine.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtwebengine.nix
@@ -12,7 +12,6 @@
 , libcap
 , pciutils
 , systemd
-, pipewire_0_2
 , enableProprietaryCodecs ? true
 , gn
 , cctools, libobjc, libunwind, sandbox, xnu
@@ -23,6 +22,8 @@
 , lib, stdenv, fetchpatch
 , version ? null
 , qtCompatVersion
+, pipewireSupport ? stdenv.isLinux
+, pipewire_0_2
 }:
 
 qtModule {
@@ -137,7 +138,7 @@ qtModule {
   '';
 
   qmakeFlags = [ "--" "-system-ffmpeg" ]
-    ++ lib.optional (stdenv.isLinux && (lib.versionAtLeast qtCompatVersion "5.15")) "-webengine-webrtc-pipewire"
+    ++ lib.optional (pipewireSupport && (lib.versionAtLeast qtCompatVersion "5.15")) "-webengine-webrtc-pipewire"
     ++ lib.optional enableProprietaryCodecs "-proprietary-codecs";
 
   propagatedBuildInputs = [
@@ -171,7 +172,7 @@ qtModule {
     xorg.xrandr libXScrnSaver libXcursor libXrandr xorg.libpciaccess libXtst
     xorg.libXcomposite xorg.libXdamage libdrm xorg.libxkbfile
 
-  ] ++ lib.optionals (stdenv.isLinux && (lib.versionAtLeast qtCompatVersion "5.15")) [
+  ] ++ lib.optionals (pipewireSupport && (lib.versionAtLeast qtCompatVersion "5.15")) [
     # Pipewire
     pipewire_0_2
   ]
diff --git a/pkgs/development/python-modules/hahomematic/default.nix b/pkgs/development/python-modules/hahomematic/default.nix
index 2b35bf5c6c98..6bf0d0dff358 100644
--- a/pkgs/development/python-modules/hahomematic/default.nix
+++ b/pkgs/development/python-modules/hahomematic/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "hahomematic";
-  version = "1.1.0";
+  version = "1.1.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "danielperna84";
     repo = pname;
     rev = "refs/tags/${version}";
-    sha256 = "sha256-qdOkF8Ob2vYzmIlFM7LbrcuvMWLk4Pd+DTSe3E+8Df8=";
+    sha256 = "sha256-Wxdh9NzrZVPnDbkb6M8tTqA7RQ4enULLq3GFr0qfynY=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/jax/default.nix b/pkgs/development/python-modules/jax/default.nix
index 332cac3133cc..94be46b3aeb2 100644
--- a/pkgs/development/python-modules/jax/default.nix
+++ b/pkgs/development/python-modules/jax/default.nix
@@ -19,7 +19,7 @@ let
 in
 buildPythonPackage rec {
   pname = "jax";
-  version = "0.3.4";
+  version = "0.3.5";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "google";
     repo = pname;
     rev = "jax-v${version}";
-    sha256 = "sha256-RZqSJP2vtt8U6nmftV2VzfkMGkkk3100QqsjI7PpQbc=";
+    hash = "sha256-c+5r0Xvd2zrIVF9VG+yve5QDvCcfMiOYp6JqaabowhA=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/nose/default.nix b/pkgs/development/python-modules/nose/default.nix
index 451c71897da9..586af7a90423 100644
--- a/pkgs/development/python-modules/nose/default.nix
+++ b/pkgs/development/python-modules/nose/default.nix
@@ -23,7 +23,9 @@ buildPythonPackage rec {
       --replace "from setuptools.command.build_py import Mixin2to3" "from distutils.util import Mixin2to3"
   '';
 
-  preBuild = ''
+  preBuild = lib.optionalString
+      ((python.isPy3k or false) && (python.pname != "pypy3"))
+  ''
     2to3 -wn nose functional_tests unit_tests
   '';
 
diff --git a/pkgs/development/python-modules/pycfmodel/default.nix b/pkgs/development/python-modules/pycfmodel/default.nix
index c9e787c68aa6..2dca6e47654f 100644
--- a/pkgs/development/python-modules/pycfmodel/default.nix
+++ b/pkgs/development/python-modules/pycfmodel/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "pycfmodel";
-  version = "0.18.2";
+  version = "0.19.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "Skyscanner";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-JZRM4CwO69BJBTm0LzA41oNv/iViIdU3Mq01Fa/KlUs=";
+    hash = "sha256-u1XuUW5OFl5NDP11nd6HK17NBXjqvzLFp2jUmecWP8E=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/servefile/default.nix b/pkgs/development/python-modules/servefile/default.nix
new file mode 100644
index 000000000000..e9d87ca91273
--- /dev/null
+++ b/pkgs/development/python-modules/servefile/default.nix
@@ -0,0 +1,43 @@
+{ buildPythonPackage
+, fetchFromGitHub
+, lib
+, pyopenssl
+, pytestCheckHook
+, requests
+}:
+
+buildPythonPackage rec {
+  pname = "servefile";
+  version = "0.5.3";
+
+  src = fetchFromGitHub {
+    owner = "sebageek";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-/ZEMZIH/ImuZ2gh5bwB0FlaWnG/ELxfBGEJ2SuNSEb8=";
+  };
+
+  propagatedBuildInputs = [ pyopenssl ];
+
+  checkInputs = [ pytestCheckHook requests ];
+  # Test attempts to connect to a port on localhost which fails in nix build
+  # environment.
+  disabledTests = [
+    "test_abort_download"
+    "test_big_download"
+    "test_https_big_download"
+    "test_https"
+    "test_redirect_and_download"
+    "test_specify_port"
+    "test_upload_size_limit"
+    "test_upload"
+  ];
+  pythonImportsCheck = [ "servefile" ];
+
+  meta = with lib; {
+    description = "Serve files from shell via a small HTTP server";
+    homepage = "https://github.com/sebageek/servefile";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ samuela ];
+  };
+}
diff --git a/pkgs/development/python-modules/sphinxcontrib-bibtex/default.nix b/pkgs/development/python-modules/sphinxcontrib-bibtex/default.nix
index f7fd32a3aff4..94c545a694ef 100644
--- a/pkgs/development/python-modules/sphinxcontrib-bibtex/default.nix
+++ b/pkgs/development/python-modules/sphinxcontrib-bibtex/default.nix
@@ -1,7 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, isPy3k
+, pythonOlder
 , oset
 , pybtex
 , pybtex-docutils
@@ -9,20 +9,28 @@
 }:
 
 buildPythonPackage rec {
-  version = "2.4.1";
   pname = "sphinxcontrib-bibtex";
+  version = "2.4.2";
 
-  disabled = !isPy3k;
+  disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "282223309bbaf34cd20a8fe1ba346fe8642f403a8930607e77a8cb08ae81fc5f";
+    hash = "sha256-ZbAj7kfzXx8DrE1xyCTmfGJMfsrBuyboNiMnGgH52oY=";
   };
 
-  propagatedBuildInputs = [ oset pybtex pybtex-docutils sphinx ];
+  propagatedBuildInputs = [
+    oset
+    pybtex
+    pybtex-docutils
+    sphinx
+  ];
 
   doCheck = false;
-  pythonImportsCheck = [ "sphinxcontrib.bibtex" ];
+
+  pythonImportsCheck = [
+    "sphinxcontrib.bibtex"
+  ];
 
   meta = with lib; {
     description = "A Sphinx extension for BibTeX style citations";
diff --git a/pkgs/development/python-modules/sunpy/default.nix b/pkgs/development/python-modules/sunpy/default.nix
index 9c88dc3462ac..8f1653d91abf 100644
--- a/pkgs/development/python-modules/sunpy/default.nix
+++ b/pkgs/development/python-modules/sunpy/default.nix
@@ -31,14 +31,14 @@
 
 buildPythonPackage rec {
   pname = "sunpy";
-  version = "3.1.4";
+  version = "3.1.6";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-TDslY1KUohR9zyyJ6+B95MMMsUL1TBl49L+nSCvZ9nI=";
+    sha256 = "sha256-mI5W4EDzTk3GryTQbnmvP+ks3VJDzw4drew9wD9+tIE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/build-managers/apache-maven/default.nix b/pkgs/development/tools/build-managers/apache-maven/default.nix
index 3cc3f374045f..001d0edf49ac 100644
--- a/pkgs/development/tools/build-managers/apache-maven/default.nix
+++ b/pkgs/development/tools/build-managers/apache-maven/default.nix
@@ -4,13 +4,13 @@ assert jdk != null;
 
 stdenv.mkDerivation rec {
   pname = "apache-maven";
-  version = "3.8.4";
+  version = "3.8.5";
 
   builder = ./builder.sh;
 
   src = fetchurl {
     url = "mirror://apache/maven/maven-3/${version}/binaries/${pname}-${version}-bin.tar.gz";
-    sha256 = "sha256-LNycUZQnuyD9wlvvWpBjt5Dkq9kw57FLTp9IY9b58Tw=";
+    sha256 = "sha256-iOMHAPMqP2Dg0o0PEqNSXSm3wgxy0TAVPfW11tiQxnM=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/development/tools/misc/binutils/default.nix b/pkgs/development/tools/misc/binutils/default.nix
index 8d759457fa11..ff89f1ad493a 100644
--- a/pkgs/development/tools/misc/binutils/default.nix
+++ b/pkgs/development/tools/misc/binutils/default.nix
@@ -13,6 +13,7 @@ in
 , flex
 , texinfo
 , perl
+, substitute
 }:
 
 # configure silently disables ld.gold if it's unsupported,
@@ -95,7 +96,13 @@ stdenv.mkDerivation {
        # this comment for more information:
        # https://gitlab.haskell.org/ghc/ghc/issues/4210#note_78333
        lib.optional (stdenv.targetPlatform.isAarch32 && stdenv.hostPlatform.system != stdenv.targetPlatform.system) ./R_ARM_COPY.patch
-    ++ lib.optional stdenv.targetPlatform.isWindows ./windres-locate-gcc.patch;
+    ++ lib.optional stdenv.targetPlatform.isWindows ./windres-locate-gcc.patch
+    ++ lib.optional stdenv.targetPlatform.isMips64n64
+       # this patch is from debian:
+       # https://sources.debian.org/data/main/b/binutils/2.38-3/debian/patches/mips64-default-n64.diff
+       (if stdenv.targetPlatform.isMusl
+        then substitute { src = ./mips64-default-n64.patch; replacements = [ "--replace" "gnuabi64" "muslabi64" ]; }
+        else ./mips64-default-n64.patch);
 
   outputs = [ "out" "info" "man" ];
 
diff --git a/pkgs/development/tools/misc/binutils/mips64-default-n64.patch b/pkgs/development/tools/misc/binutils/mips64-default-n64.patch
new file mode 100644
index 000000000000..00581279f85e
--- /dev/null
+++ b/pkgs/development/tools/misc/binutils/mips64-default-n64.patch
@@ -0,0 +1,82 @@
+--- a/bfd/config.bfd
++++ b/bfd/config.bfd
+@@ -927,11 +927,21 @@ case "${targ}" in
+     targ_defvec=mips_elf32_be_vec
+     targ_selvecs="mips_elf32_le_vec mips_elf64_be_vec mips_elf64_le_vec mips_ecoff_be_vec mips_ecoff_le_vec"
+     ;;
+-  mips64*el-*-linux*)
++  mips*64*el-*-linux*-gnuabi64)
++    targ_defvec=mips_elf64_trad_le_vec
++    targ_selvecs="mips_elf32_ntrad_be_vec mips_elf32_ntrad_le_vec mips_elf32_trad_be_vec mips_elf32_trad_le_vec mips_elf64_trad_be_vec"
++    want64=true
++    ;;
++  mips*64*-*-linux*-gnuabi64)
++    targ_defvec=mips_elf64_trad_be_vec
++    targ_selvecs="mips_elf32_ntrad_be_vec mips_elf32_ntrad_le_vec mips_elf32_trad_be_vec mips_elf32_trad_le_vec mips_elf64_trad_le_vec"
++    want64=true
++    ;;
++  mips*64*el-*-linux*)
+     targ_defvec=mips_elf32_ntrad_le_vec
+     targ_selvecs="mips_elf32_ntrad_be_vec mips_elf32_trad_le_vec mips_elf32_trad_be_vec mips_elf64_trad_le_vec mips_elf64_trad_be_vec"
+     ;;
+-  mips64*-*-linux*)
++  mips*64*-*-linux*)
+     targ_defvec=mips_elf32_ntrad_be_vec
+     targ_selvecs="mips_elf32_ntrad_le_vec mips_elf32_trad_be_vec mips_elf32_trad_le_vec mips_elf64_trad_be_vec mips_elf64_trad_le_vec"
+     ;;
+--- a/binutils/testsuite/binutils-all/mips/mips-note-2-n32.d
++++ b/binutils/testsuite/binutils-all/mips/mips-note-2-n32.d
+@@ -1,4 +1,5 @@
+ #PROG: objcopy
++#as: -n32
+ #readelf: --notes --wide
+ #objcopy: --merge-notes
+ #name: MIPS merge notes section (n32)
+--- a/gas/configure
++++ b/gas/configure
+@@ -12167,6 +12167,9 @@ _ACEOF
+ 	esac
+ 	# Decide which ABI to target by default.
+ 	case ${target} in
++	  mips*64*-linux-gnuabi64)
++	    mips_default_abi=N64_ABI
++	    ;;
+ 	  mips64*-linux* | mips-sgi-irix6* | mips64*-freebsd* \
+ 	  | mips64*-kfreebsd*-gnu | mips64*-ps2-elf*)
+ 	    mips_default_abi=N32_ABI
+--- a/gas/configure.ac
++++ b/gas/configure.ac
+@@ -384,6 +384,9 @@ changequote([,])dnl
+ 	esac
+ 	# Decide which ABI to target by default.
+ 	case ${target} in
++	  mips*64*-linux-gnuabi64)
++	    mips_default_abi=N64_ABI
++	    ;;
+ 	  mips64*-linux* | mips-sgi-irix6* | mips64*-freebsd* \
+ 	  | mips64*-kfreebsd*-gnu | mips64*-ps2-elf*)
+ 	    mips_default_abi=N32_ABI
+--- a/ld/configure.tgt
++++ b/ld/configure.tgt
+@@ -543,11 +543,19 @@ mips*-*-vxworks*)	targ_emul=elf32ebmipvx
+ 			;;
+ mips*-*-windiss)	targ_emul=elf32mipswindiss
+ 			;;
+-mips64*el-*-linux-*)	targ_emul=elf32ltsmipn32
++mips*64*el-*-linux-gnuabi64)	targ_emul=elf64ltsmip
++			targ_extra_emuls="elf32btsmipn32 elf32ltsmipn32 elf32ltsmip elf32btsmip elf64btsmip"
++			targ_extra_libpath=$targ_extra_emuls
++			;;
++mips*64*el-*-linux-*)	targ_emul=elf32ltsmipn32
+ 			targ_extra_emuls="elf32btsmipn32 elf32ltsmip elf32btsmip elf64ltsmip elf64btsmip"
+ 			targ_extra_libpath=$targ_extra_emuls
+ 			;;
+-mips64*-*-linux-*)	targ_emul=elf32btsmipn32
++mips*64*-*-linux-gnuabi64)	targ_emul=elf64btsmip
++			targ_extra_emuls="elf32btsmipn32 elf32ltsmipn32 elf32btsmip elf32ltsmip elf64ltsmip"
++			targ_extra_libpath=$targ_extra_emuls
++			;;
++mips*64*-*-linux-*)	targ_emul=elf32btsmipn32
+ 			targ_extra_emuls="elf32ltsmipn32 elf32btsmip elf32ltsmip elf64btsmip elf64ltsmip"
+ 			targ_extra_libpath=$targ_extra_emuls
+ 			;;
diff --git a/pkgs/games/fheroes2/default.nix b/pkgs/games/fheroes2/default.nix
index 10d7a23aca4e..ff3537cfae99 100644
--- a/pkgs/games/fheroes2/default.nix
+++ b/pkgs/games/fheroes2/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fheroes2";
-  version = "0.9.13";
+  version = "0.9.14";
 
   src = fetchFromGitHub {
     owner = "ihhub";
     repo = "fheroes2";
     rev = version;
-    sha256 = "sha256-+VAgS7NR/D0HD/Fy7idSUTMJPp2ctpirMpcFooo+bEg=";
+    sha256 = "sha256-M5sUEOKU7KSenAAE7dUI8algB5XsbQQ1s3sDflZLsiA=";
   };
 
   buildInputs = [ gettext libpng SDL2 SDL2_image SDL2_mixer SDL2_ttf zlib ];
diff --git a/pkgs/os-specific/linux/kbd/default.nix b/pkgs/os-specific/linux/kbd/default.nix
index 23a523b15d72..4c89d8c82197 100644
--- a/pkgs/os-specific/linux/kbd/default.nix
+++ b/pkgs/os-specific/linux/kbd/default.nix
@@ -68,6 +68,7 @@ stdenv.mkDerivation rec {
   passthru.tests = {
     inherit (nixosTests) keymap kbd-setfont-decompress kbd-update-search-paths-patch;
   };
+  passthru.gzip = gzip;
 
   meta = with lib; {
     homepage = "https://kbd-project.org/";
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 73c27b0b61f0..e130abbf27ff 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -675,7 +675,7 @@ stdenv.mkDerivation {
     # runtime; otherwise we can't and we need to reboot.
     interfaceVersion = 2;
 
-    inherit withCryptsetup util-linux;
+    inherit withCryptsetup util-linux kmod kbd;
 
     tests = {
       inherit (nixosTests) switchTest;
diff --git a/pkgs/os-specific/linux/wpa_supplicant/default.nix b/pkgs/os-specific/linux/wpa_supplicant/default.nix
index 925ec71d3fa1..1d58d47cf663 100644
--- a/pkgs/os-specific/linux/wpa_supplicant/default.nix
+++ b/pkgs/os-specific/linux/wpa_supplicant/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchurl, openssl, pkg-config, libnl
 , nixosTests, wpa_supplicant_gui
-, withDbus ? true, dbus
+, dbusSupport ? true, dbus
 , withReadline ? true, readline
 , withPcsclite ? true, pcsclite
 , readOnlyModeSSIDs ? false
@@ -68,7 +68,7 @@ stdenv.mkDerivation rec {
     CONFIG_EAP_AKA=y
     CONFIG_EAP_AKA_PRIME=y
     CONFIG_PCSC=y
-  '' + optionalString withDbus ''
+  '' + optionalString dbusSupport ''
     CONFIG_CTRL_IFACE_DBUS=y
     CONFIG_CTRL_IFACE_DBUS_NEW=y
     CONFIG_CTRL_IFACE_DBUS_INTRO=y
@@ -93,7 +93,7 @@ stdenv.mkDerivation rec {
   '';
 
   buildInputs = [ openssl libnl ]
-    ++ optional withDbus dbus
+    ++ optional dbusSupport dbus
     ++ optional withReadline readline
     ++ optional withPcsclite pcsclite;
 
diff --git a/pkgs/servers/matrix-synapse/matrix-appservice-slack/default.nix b/pkgs/servers/matrix-synapse/matrix-appservice-slack/default.nix
index eb3d82e14d0b..a00d983e91bb 100644
--- a/pkgs/servers/matrix-synapse/matrix-appservice-slack/default.nix
+++ b/pkgs/servers/matrix-synapse/matrix-appservice-slack/default.nix
@@ -3,8 +3,8 @@ let
   src = fetchFromGitHub {
     owner = "matrix-org";
     repo = "matrix-appservice-slack";
-    rev = "1.10.0";
-    sha256 = "WnonduUhhrxCMuXOgLk8voNnn+f6R5CsJ7VKpEmGwzk=";
+    rev = "1.11.0";
+    sha256 = "U1EHL1ZwcpCXA9sjya6ry/3Q+gwdQWPUDFN+wp1qjrg=";
   };
 
   nodePackages = import ./node-composition.nix {
diff --git a/pkgs/servers/matrix-synapse/matrix-appservice-slack/generate-dependencies.sh b/pkgs/servers/matrix-synapse/matrix-appservice-slack/generate-dependencies.sh
index 2503d6d7ef35..1fceed1c72c1 100755
--- a/pkgs/servers/matrix-synapse/matrix-appservice-slack/generate-dependencies.sh
+++ b/pkgs/servers/matrix-synapse/matrix-appservice-slack/generate-dependencies.sh
@@ -1,9 +1,9 @@
 #!/usr/bin/env nix-shell
 #! nix-shell -i bash -p nodePackages.node2nix
 
-# Download package.json and package-lock.json from the v1.10.0 release
-curl https://raw.githubusercontent.com/matrix-org/matrix-appservice-slack/1.10.0/package.json -o package.json
-curl https://raw.githubusercontent.com/matrix-org/matrix-appservice-slack/1.10.0/package-lock.json -o package-lock.json
+# Download package.json and package-lock.json from the v1.11.0 release
+curl https://raw.githubusercontent.com/matrix-org/matrix-appservice-slack/1.11.0/package.json -o package.json
+curl https://raw.githubusercontent.com/matrix-org/matrix-appservice-slack/1.11.0/package-lock.json -o package-lock.json
 
 node2nix \
   --nodejs-12 \
diff --git a/pkgs/servers/matrix-synapse/matrix-appservice-slack/node-packages.nix b/pkgs/servers/matrix-synapse/matrix-appservice-slack/node-packages.nix
index dc0bd7b052bf..6bc864cd1089 100644
--- a/pkgs/servers/matrix-synapse/matrix-appservice-slack/node-packages.nix
+++ b/pkgs/servers/matrix-synapse/matrix-appservice-slack/node-packages.nix
@@ -762,13 +762,13 @@ let
         sha512 = "ut5vewkiu8jjGBdqpM44XxjuCjq9LAKeHVmoVfHVzy8eHgxxq8SbAVQNovDA8mVi05kP0Ea/n/UzcSHcTJQfNg==";
       };
     };
-    "axios-0.24.0" = {
+    "axios-0.26.0" = {
       name = "axios";
       packageName = "axios";
-      version = "0.24.0";
+      version = "0.26.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/axios/-/axios-0.24.0.tgz";
-        sha512 = "Q6cWsys88HoPgAaFAVUb0WpPk0O8iTeisR9IMqy9G8AbO4NlpVknrnQS03zzF9PGAWgO3cgletO3VjV/P7VztA==";
+        url = "https://registry.npmjs.org/axios/-/axios-0.26.0.tgz";
+        sha512 = "lKoGLMYtHvFrPVt3r+RBMp9nh34N0M8zEfCWqdWZx6phynIEhQqAdydpyBAAG211zlhX9Rgu08cOamy6XjE5Og==";
       };
     };
     "balanced-match-1.0.2" = {
@@ -1959,13 +1959,13 @@ let
         sha512 = "GRnmB5gPyJpAhTQdSZTSp9uaPSvl09KoYcMQtsB9rQoOmzs9dH6ffeccH+Z+cv6P68Hu5bC6JjRh4Ah/mHSNRw==";
       };
     };
-    "follow-redirects-1.14.4" = {
+    "follow-redirects-1.14.8" = {
       name = "follow-redirects";
       packageName = "follow-redirects";
-      version = "1.14.4";
+      version = "1.14.8";
       src = fetchurl {
-        url = "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.14.4.tgz";
-        sha512 = "zwGkiSXC1MUJG/qmeIFH2HBJx9u0V46QGUe3YR1fXG8bXQxq7fLj0RjLZQ5nubr9qNJUZrH+xUcwXEoXNpfS+g==";
+        url = "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.14.8.tgz";
+        sha512 = "1x0S9UVJHsQprFcEC/qnNzBLcIxsjAV905f/UkQxbclCsoTWlacCNOpQa/anodLl2uaEKFhfWOvM2Qg77+15zA==";
       };
     };
     "forever-agent-0.6.1" = {
@@ -4771,7 +4771,7 @@ let
   args = {
     name = "matrix-appservice-slack";
     packageName = "matrix-appservice-slack";
-    version = "1.10.0";
+    version = "1.11.0";
     src = ./.;
     dependencies = [
       sources."@alloc/quick-lru-5.2.0"
@@ -4895,7 +4895,7 @@ let
       sources."asynckit-0.4.0"
       sources."aws-sign2-0.7.0"
       sources."aws4-1.11.0"
-      sources."axios-0.24.0"
+      sources."axios-0.26.0"
       sources."balanced-match-1.0.2"
       sources."base-x-3.0.9"
       sources."base64-js-1.5.1"
@@ -5059,7 +5059,7 @@ let
       sources."flat-cache-3.0.4"
       sources."flatted-3.1.1"
       sources."fn.name-1.1.0"
-      sources."follow-redirects-1.14.4"
+      sources."follow-redirects-1.14.8"
       sources."forever-agent-0.6.1"
       sources."form-data-2.5.1"
       sources."forwarded-0.1.2"
diff --git a/pkgs/servers/web-apps/moodle/default.nix b/pkgs/servers/web-apps/moodle/default.nix
index 0df0b83109a4..77f02e7a78cd 100644
--- a/pkgs/servers/web-apps/moodle/default.nix
+++ b/pkgs/servers/web-apps/moodle/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchurl, writeText, plugins ? [ ] }:
 
 let
-  version = "3.11.5";
+  version = "3.11.6";
   stableVersion = lib.concatStrings (lib.take 2 (lib.splitVersion version));
 
 in stdenv.mkDerivation rec {
@@ -10,7 +10,7 @@ in stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://download.moodle.org/stable${stableVersion}/${pname}-${version}.tgz";
-    sha256 = "sha256-KFitrMThEcx7pU/+jmP8casEyg6/FlhpvjfIjf31vw0=";
+    sha256 = "sha256-g3qHYkxiXb18vJ23THUw8ej+s5SgIkJpmjQmmARwQhs=";
   };
 
   phpConfig = writeText "config.php" ''
diff --git a/pkgs/shells/powershell/default.nix b/pkgs/shells/powershell/default.nix
index 4efa2cd88a72..6dbb9fa7625b 100644
--- a/pkgs/shells/powershell/default.nix
+++ b/pkgs/shells/powershell/default.nix
@@ -9,7 +9,7 @@ let archString = if stdenv.isAarch64 then "arm64"
                      else throw "unsupported platform";
     platformSha = if (stdenv.isDarwin && stdenv.isx86_64) then "sha256-h5zjn8wtgHmsJFiGq1rja6kZTZj3Q72W2kH3AexRDQs="
                      else if (stdenv.isDarwin && stdenv.isAarch64) then "sha256-NHM9ZUpBJb59Oq0Ke7DcvaN+bZ9MjSpXBRu5Ng9OVZ0="
-                     else if (stdenv.isLinux && stdenv.isx86_64) then "sha256-kidPtDMkEZ/1r4WIApPZ/BsdJkolpSZ3f72JyDv3798="
+                     else if (stdenv.isLinux && stdenv.isx86_64) then "sha256-QSL0lmxa7rGoNOx7JB310wF3VoUy96e9ZFop5rAvdBM="
                      else if (stdenv.isLinux && stdenv.isAarch64) then "sha256-bUacA4DwjDNlIG7yooXxUGL9AysAogNWuQDvcTqo1sE="
                      else throw "unsupported platform";
     platformLdLibraryPath = if stdenv.isDarwin then "DYLD_FALLBACK_LIBRARY_PATH"
@@ -20,7 +20,7 @@ let archString = if stdenv.isAarch64 then "arm64"
 in
 stdenv.mkDerivation rec {
   pname = "powershell";
-  version = "7.2.1";
+  version = "7.2.2";
 
   src = fetchzip {
     url = "https://github.com/PowerShell/PowerShell/releases/download/v${version}/powershell-${version}-${platformString}-${archString}.tar.gz";
diff --git a/pkgs/tools/admin/ejson2env/default.nix b/pkgs/tools/admin/ejson2env/default.nix
index cb82a689e943..9e873d467e1f 100644
--- a/pkgs/tools/admin/ejson2env/default.nix
+++ b/pkgs/tools/admin/ejson2env/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "ejson2env";
-  version = "2.0.2";
+  version = "2.0.4";
 
   src = fetchFromGitHub {
     owner = "Shopify";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-1nfMmjYKRo5vjOwLb3fX9SQ0CDHme1DAz0AGGpV4piI=";
+    sha256 = "sha256-Oc0fWihOUafYN5t9SxHxaYJEv5e46CCDNe4xo+Dcjrs=";
   };
 
-  vendorSha256 = "sha256-lais54Gm4UGJN8D+iFbP8utTfDr+v8qXZKLdpNKzJi8=";
+  vendorSha256 = "sha256-BY45WirK9AVhvFGB5uqI4dLxzO2WuNNhhJbQ6nsRXao=";
 
   meta = with lib; {
     description = "A tool to simplify storing secrets that should be accessible in the shell environment in your git repo.";
diff --git a/pkgs/tools/admin/fits-cloudctl/default.nix b/pkgs/tools/admin/fits-cloudctl/default.nix
index f53315613e7c..fe0670f36aa0 100644
--- a/pkgs/tools/admin/fits-cloudctl/default.nix
+++ b/pkgs/tools/admin/fits-cloudctl/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "fits-cloudctl";
-  version = "0.10.12";
+  version = "0.10.13";
 
   src = fetchFromGitHub {
     owner = "fi-ts";
     repo = "cloudctl";
     rev = "v${version}";
-    sha256 = "sha256-nFxudeJJ5BkfZxSnRquyATHyHwI+7xwfQxiY8cedtis=";
+    sha256 = "sha256-8MSX8A/3FY95rrWuYfGYFynSi76JPcHX+N8VF9BWktM=";
   };
 
-  vendorSha256 = "sha256-f35Asf9l6ZfixpjMGzesTsxmANreilMxH2CULMH3b2o=";
+  vendorSha256 = "sha256-K6HI7aSDbrhqm2XVor7sRwHnqQPQlpZYGLgaf3SFNrU=";
 
   meta = with lib; {
     description = "Command-line client for FI-TS Finance Cloud Native services";
diff --git a/pkgs/tools/backup/discordchatexporter-cli/default.nix b/pkgs/tools/backup/discordchatexporter-cli/default.nix
index d2a9bd2563ef..8e98ea3c7c28 100644
--- a/pkgs/tools/backup/discordchatexporter-cli/default.nix
+++ b/pkgs/tools/backup/discordchatexporter-cli/default.nix
@@ -8,13 +8,13 @@
 
 buildDotnetModule rec {
   pname = "discordchatexporter-cli";
-  version = "2.33.2";
+  version = "2.34";
 
   src = fetchFromGitHub {
     owner = "tyrrrz";
     repo = "discordchatexporter";
     rev = version;
-    sha256 = "wOSa6O3O4QlGL5ecnR14ldXPYV5mDoPDlJjcwN5Lrek=";
+    sha256 = "EHpnLUFHR+FC1qlwW0TuLas9aA/CMELHkzbLlNyiwgE=";
   };
 
   dotnet-sdk = dotnetCorePackages.sdk_6_0;
diff --git a/pkgs/tools/backup/discordchatexporter-cli/deps.nix b/pkgs/tools/backup/discordchatexporter-cli/deps.nix
index 92bf39b58ef5..ecc872877763 100644
--- a/pkgs/tools/backup/discordchatexporter-cli/deps.nix
+++ b/pkgs/tools/backup/discordchatexporter-cli/deps.nix
@@ -2,9 +2,9 @@
   (fetchNuGet { pname = "CliFx"; version = "2.2.2"; sha256 = "13g5xlrbyhnbwkyzic5jlhxl0kpvkfrdmb5h2rdf9yp4gp5p9mwg"; })
   (fetchNuGet { pname = "Gress"; version = "2.0.1"; sha256 = "00xhyfkrlc38nbl6aymr7zwxc3kj0rxvx5gwk6fkfrvi1pzgq0wc"; })
   (fetchNuGet { pname = "JsonExtensions"; version = "1.2.0"; sha256 = "0g54hibabbqqfhxjlnxwv1rxagpali5agvnpymp2w3dk8h6q66xy"; })
-  (fetchNuGet { pname = "MiniRazor.CodeGen"; version = "2.2.0"; sha256 = "1rbgkm1hsamqhviw2c62g6iafiwkxcnz66qbybpd32qgz1124cx4"; })
-  (fetchNuGet { pname = "MiniRazor.Runtime"; version = "2.2.0"; sha256 = "0zm0l97jfbfy90zj0cbi7v3qbhxhfay1g8f2cw0gp829xz4yk9jr"; })
+  (fetchNuGet { pname = "MiniRazor.CodeGen"; version = "2.2.1"; sha256 = "1mrjw3vq59pbiqvayilazjgv6l87j20j8hmhcpbacz9p5bl1hvvr"; })
+  (fetchNuGet { pname = "MiniRazor.Runtime"; version = "2.2.1"; sha256 = "18qx0rzp4xz4ng9yc0c2bcpa4ky6sfiz10828y4j9ymywas7yzxw"; })
   (fetchNuGet { pname = "Polly"; version = "7.2.3"; sha256 = "1iws4jd5iqj5nlfp16fg9p5vfqqas1si0cgh8xcj64y433a933cv"; })
-  (fetchNuGet { pname = "Spectre.Console"; version = "0.43.0"; sha256 = "17yh20s17fkcs3iyb5yylqh90jvb36gdn0aaglq3d67rpmcrl5gc"; })
+  (fetchNuGet { pname = "Spectre.Console"; version = "0.44.0"; sha256 = "0f4q52rmib0q3vg7ij6z73mnymyas7c7wrm8dfdhrkdzn53zwl6p"; })
   (fetchNuGet { pname = "Superpower"; version = "3.0.0"; sha256 = "0p6riay4732j1fahc081dzgs9q4z3n2fpxrin4zfpj6q2226dhz4"; })
 ]
diff --git a/pkgs/tools/compression/zfp/default.nix b/pkgs/tools/compression/zfp/default.nix
new file mode 100644
index 000000000000..c46c58e7b404
--- /dev/null
+++ b/pkgs/tools/compression/zfp/default.nix
@@ -0,0 +1,59 @@
+{ cmake, cudatoolkit, fetchFromGitHub, gfortran, lib, llvmPackages, pythonPackages, stdenv, targetPlatform
+, enableCfp ? true
+, enableCuda ? false
+, enableExamples ? true
+, enableFortran ? builtins.elem targetPlatform.system gfortran.meta.platforms
+, enableOpenMP ? true
+, enablePython ? true
+, enableUtilities ? true }:
+
+stdenv.mkDerivation rec {
+  pname = "zfp";
+  version = "0.5.5";
+
+  src = fetchFromGitHub {
+    owner = "LLNL";
+    repo = "zfp";
+    rev = version;
+    sha256 = "19ycflz35qsrzfcvxdyy0mgbykfghfi9y5v684jb4awjp7nf562c";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  buildInputs = lib.optional enableCuda cudatoolkit
+    ++ lib.optional enableFortran gfortran
+    ++ lib.optional enableOpenMP llvmPackages.openmp
+    ++ lib.optionals enablePython [ pythonPackages.cython pythonPackages.numpy pythonPackages.python ];
+
+  cmakeFlags = [
+    # More tests not enabled by default
+    ''-DZFP_BINARY_DIR=${placeholder "out"}''
+    ''-DZFP_BUILD_TESTING_LARGE=ON''
+  ]
+    ++ lib.optionals targetPlatform.isDarwin [
+      "-DCMAKE_INSTALL_BINDIR=bin"
+      "-DCMAKE_INSTALL_LIBDIR=lib"
+    ]
+    ++ lib.optional enableCfp "-DBUILD_CFP=ON"
+    ++ lib.optional enableCuda "-DZFP_WITH_CUDA=ON"
+    ++ lib.optional enableExamples "-DBUILD_EXAMPLES=ON"
+    ++ lib.optional enableFortran "-DBUILD_ZFORP=ON"
+    ++ lib.optional enableOpenMP "-DZFP_WITH_OPENMP=ON"
+    ++ lib.optional enablePython "-DBUILD_ZFPY=ON"
+    ++ ([ "-DBUILD_UTILITIES=${if enableUtilities then "ON" else "OFF"}" ]);
+
+  preCheck = lib.optional targetPlatform.isDarwin ''
+    export DYLD_LIBRARY_PATH="$out/lib:$DYLD_LIBRARY_PATH"
+  '';
+
+  doCheck = true;
+
+  meta = with lib; {
+    homepage = "https://computing.llnl.gov/projects/zfp";
+    description = "Library for random-access compression of floating-point arrays";
+    license = licenses.bsd3;
+    maintainers = [ maintainers.spease ];
+    # 64-bit only
+    platforms = platforms.aarch64 ++ platforms.x86_64;
+  };
+}
diff --git a/pkgs/tools/graphics/astc-encoder/default.nix b/pkgs/tools/graphics/astc-encoder/default.nix
index 2b55113b4f95..e2af1494874b 100644
--- a/pkgs/tools/graphics/astc-encoder/default.nix
+++ b/pkgs/tools/graphics/astc-encoder/default.nix
@@ -31,13 +31,13 @@ with rec {
 
 gccStdenv.mkDerivation rec {
   pname = "astc-encoder";
-  version = "3.5";
+  version = "3.6";
 
   src = fetchFromGitHub {
     owner = "ARM-software";
     repo = "astc-encoder";
     rev = version;
-    sha256 = "sha256-vsnU592UDQfBuh9XWzw12wANkQBoUxznpOD9efCUKA0=";
+    sha256 = "sha256-TzVO2xQOuE87h8j4UwkpnAaFwkvy5dZge8zDNR/mVf0=";
   };
 
   nativeBuildInputs = [ cmake ];
@@ -73,5 +73,6 @@ gccStdenv.mkDerivation rec {
     platforms = platforms.unix;
     license = licenses.asl20;
     maintainers = with maintainers; [ dasisdormax ];
+    broken = !gccStdenv.is64bit;
   };
 }
diff --git a/pkgs/tools/misc/dsq/default.nix b/pkgs/tools/misc/dsq/default.nix
index 72a38cf1eaf3..f1e9d53e3fad 100644
--- a/pkgs/tools/misc/dsq/default.nix
+++ b/pkgs/tools/misc/dsq/default.nix
@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "dsq";
-  version = "0.12.0";
+  version = "0.13.0";
 
   src = fetchFromGitHub {
     owner = "multiprocessio";
     repo = "dsq";
     rev = version;
-    hash = "sha256-AxYqSCdCrhHrN21WGJtg0KIde8VAjj6bF7DzELZptj8=";
+    hash = "sha256-6Rdw/bXIcIoQ/PsVtJKSlwIhCxSlISPmmb2lGbp8vVM=";
   };
 
-  vendorSha256 = "sha256-aER7j/DG1WB5DZhvgXYrl19UwQ/lZLPRAptINVJ3rdI=";
+  vendorSha256 = "sha256-hZeI1XqW1lk9F66TVirkpvCZrJb9MO8aS1Sx/R92ddc=";
 
   nativeBuildInputs = [ diffutils ];
 
diff --git a/pkgs/tools/networking/wireguard-tools/default.nix b/pkgs/tools/networking/wireguard-tools/default.nix
index 00b91adc2738..59dafe9f9059 100644
--- a/pkgs/tools/networking/wireguard-tools/default.nix
+++ b/pkgs/tools/networking/wireguard-tools/default.nix
@@ -7,7 +7,6 @@
 , makeWrapper
 , openresolv
 , procps
-, wireguard-go
 }:
 
 stdenv.mkDerivation rec {
@@ -40,10 +39,6 @@ stdenv.mkDerivation rec {
     for f in $out/bin/*; do
       wrapProgram $f --prefix PATH : ${lib.makeBinPath [ procps iproute2 iptables openresolv ]}
     done
-  '' + lib.optionalString stdenv.isDarwin ''
-    for f in $out/bin/*; do
-      wrapProgram $f --prefix PATH : ${wireguard-go}/bin
-    done
   '';
 
   passthru = {
diff --git a/pkgs/tools/security/kubescape/default.nix b/pkgs/tools/security/kubescape/default.nix
index 377327e6571c..23f52e3b52ed 100644
--- a/pkgs/tools/security/kubescape/default.nix
+++ b/pkgs/tools/security/kubescape/default.nix
@@ -6,31 +6,38 @@
 
 buildGoModule rec {
   pname = "kubescape";
-  version = "2.0.150";
+  version = "2.0.152";
 
   src = fetchFromGitHub {
     owner = "armosec";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-1D/ixtZI7/H05MD6zRtZCF8yhW1FhvRpdPWieAPwxHs=";
+    hash = "sha256-hibXmA2JerfnkGiSnBUCMHGPm4Tefnsl/x2VAS5z0Fo=";
   };
+  vendorSha256 = "sha256-HfsQfoz1n3FEd2eVBBz3Za2jYCSrozXpL34Z8CgQsTA=";
 
   nativeBuildInputs = [
     installShellFiles
   ];
 
-  modRoot = "cmd";
-  vendorSha256 = "sha256-Nznf793OMQ7ZCWb5voVcLyMiBa1Z8Dswp7Tdn1AzlJA=";
-
   ldflags = [
     "-s"
     "-w"
-    "-X github.com/armosec/kubescape/core/cautils.BuildNumber=v${version}"
+    "-X github.com/armosec/kubescape/v2/core/cautils.BuildNumber=v${version}"
   ];
 
-  postBuild = ''
-    # kubescape/cmd should be called kubescape
-    mv $GOPATH/bin/{cmd,kubescape}
+  subPackages = [ "." ];
+
+  preCheck = ''
+    # Feed in all but the integration tests for testing
+    # This is because subPackages above limits what is built to just what we
+    # want but also limits the tests
+    # Skip httphandler tests - the checkPhase doesn't care about excludedPackages
+    getGoDirs() {
+      go list ./... | grep -v httphandler
+    }
+
+    rm core/pkg/resourcehandler/{repositoryscanner,urlloader}_test.go
   '';
 
   postInstall = ''
@@ -44,6 +51,8 @@ buildGoModule rec {
   installCheckPhase = ''
     runHook preInstallCheck
     $out/bin/kubescape --help
+    # `--version` vs `version` shows the version without checking for latest
+    # if the flag is missing the BuildNumber may have moved
     $out/bin/kubescape --version | grep "v${version}"
     runHook postInstallCheck
   '';
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index cf2854ac7ed8..8f9bd5ef4e2f 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -11566,6 +11566,8 @@ with pkgs;
 
   zerofree = callPackage ../tools/filesystems/zerofree { };
 
+  zfp = callPackage ../tools/compression/zfp {};
+
   zfs-autobackup = callPackage ../tools/backup/zfs-autobackup { };
 
   zfsbackup = callPackage ../tools/backup/zfsbackup { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index b675f9355377..48ab0c6788b7 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -9172,6 +9172,8 @@ in {
 
   serpy = callPackage ../development/python-modules/serpy { };
 
+  servefile = callPackage ../development/python-modules/servefile { };
+
   serverlessrepo = callPackage ../development/python-modules/serverlessrepo { };
 
   service-identity = callPackage ../development/python-modules/service_identity { };