diff --git a/.github/workflows/update-terraform-providers.yml b/.github/workflows/update-terraform-providers.yml
index 8580368c3e3b..3d00ed1b6773 100644
--- a/.github/workflows/update-terraform-providers.yml
+++ b/.github/workflows/update-terraform-providers.yml
@@ -34,6 +34,8 @@ jobs:
             --argstr keep-going true \
             --argstr max-workers 2 \
             --argstr path terraform-providers
+      - name: clean repo
+        run: |
           git clean -f
       - name: create PR
         uses: peter-evans/create-pull-request@v4
@@ -41,6 +43,8 @@ jobs:
           body: |
             Automatic update by [update-terraform-providers](https://github.com/NixOS/nixpkgs/blob/master/.github/workflows/update-terraform-providers.yml) action.
 
+            https://github.com/NixOS/nixpkgs/actions/runs/${{ github.run_id }}
+
             Check that all providers build with:
             ```
             @ofborg build terraform.full
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 6cfdb8c085f9..af85688b602f 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -441,6 +441,7 @@ in {
   non-default-filesystems = handleTest ./non-default-filesystems.nix {};
   noto-fonts = handleTest ./noto-fonts.nix {};
   novacomd = handleTestOn ["x86_64-linux"] ./novacomd.nix {};
+  nscd = handleTest ./nscd.nix {};
   nsd = handleTest ./nsd.nix {};
   nzbget = handleTest ./nzbget.nix {};
   nzbhydra2 = handleTest ./nzbhydra2.nix {};
@@ -531,7 +532,6 @@ in {
   rasdaemon = handleTest ./rasdaemon.nix {};
   redis = handleTest ./redis.nix {};
   redmine = handleTest ./redmine.nix {};
-  resolv = handleTest ./resolv.nix {};
   restartByActivationScript = handleTest ./restart-by-activation-script.nix {};
   restic = handleTest ./restic.nix {};
   retroarch = handleTest ./retroarch.nix {};
diff --git a/nixos/tests/nscd.nix b/nixos/tests/nscd.nix
new file mode 100644
index 000000000000..7bb6d90c3d4e
--- /dev/null
+++ b/nixos/tests/nscd.nix
@@ -0,0 +1,107 @@
+import ./make-test-python.nix ({ pkgs, ... }:
+let
+  # build a getent that itself doesn't see anything in /etc/hosts and
+  # /etc/nsswitch.conf, by using libredirect to steer its own requests to
+  # /dev/null.
+  # This means is /has/ to go via nscd to actuallly resolve any of the
+  # additionally configured hosts.
+  getent' = pkgs.writeScript "getent-without-etc-hosts" ''
+    export NIX_REDIRECTS=/etc/hosts=/dev/null:/etc/nsswitch.conf=/dev/null
+    export LD_PRELOAD=${pkgs.libredirect}/lib/libredirect.so
+    exec getent $@
+  '';
+in
+{
+  name = "nscd";
+
+  nodes.machine = { pkgs, ... }: {
+    imports = [ common/user-account.nix ];
+    networking.extraHosts = ''
+      2001:db8::1 somehost.test
+      192.0.2.1 somehost.test
+    '';
+
+    specialisation = {
+      withUnscd.configuration = { ... }: {
+        services.nscd.package = pkgs.unscd;
+      };
+    };
+  };
+
+  testScript = { nodes, ... }:
+    let
+      specialisations = "${nodes.machine.system.build.toplevel}/specialisation";
+    in
+    ''
+      # Regression test for https://github.com/NixOS/nixpkgs/issues/50273
+      def test_dynamic_user():
+          with subtest("DynamicUser actually allocates a user"):
+              assert "iamatest" in machine.succeed(
+                  "systemd-run --pty --property=Type=oneshot --property=DynamicUser=yes --property=User=iamatest whoami"
+              )
+
+      # Test resolution of somehost.test with getent', to make sure we go via nscd
+      def test_host_lookups():
+          with subtest("host lookups via nscd"):
+              # ahosts
+              output = machine.succeed("${getent'} ahosts somehost.test")
+              assert "192.0.2.1" in output
+              assert "2001:db8::1" in output
+
+              # ahostsv4
+              output = machine.succeed("${getent'} ahostsv4 somehost.test")
+              assert "192.0.2.1" in output
+              assert "2001:db8::1" not in output
+
+              # ahostsv6
+              output = machine.succeed("${getent'} ahostsv6 somehost.test")
+              assert "192.0.2.1" not in output
+              assert "2001:db8::1" in output
+
+              # reverse lookups (hosts)
+              assert "somehost.test" in machine.succeed("${getent'} hosts 2001:db8::1")
+              assert "somehost.test" in machine.succeed("${getent'} hosts 192.0.2.1")
+
+      # Test host resolution via nss modules works
+      # We rely on nss-myhostname in this case, which resolves *.localhost and
+      # _gateway.
+      # We don't need to use getent' here, as non-glibc nss modules can only be
+      # discovered via nscd.
+      def test_nss_myhostname():
+          with subtest("nss-myhostname provides hostnames (ahosts)"):
+              # ahosts
+              output = machine.succeed("getent ahosts foobar.localhost")
+              assert "::1" in output
+              assert "127.0.0.1" in output
+
+              # ahostsv4
+              output = machine.succeed("getent ahostsv4 foobar.localhost")
+              assert "::1" not in output
+              assert "127.0.0.1" in output
+
+              # ahostsv6
+              output = machine.succeed("getent ahostsv6 foobar.localhost")
+              assert "::1" in output
+              assert "127.0.0.1" not in output
+
+      start_all()
+      machine.wait_for_unit("default.target")
+
+      # Test all tests with glibc-nscd.
+      test_dynamic_user()
+      test_host_lookups()
+      test_nss_myhostname()
+
+      with subtest("unscd"):
+          machine.succeed('${specialisations}/withUnscd/bin/switch-to-configuration test')
+          machine.wait_for_unit("default.target")
+
+          # known to fail, unscd doesn't load external NSS modules
+          # test_dynamic_user()
+
+          test_host_lookups()
+
+          # known to fail, unscd doesn't load external NSS modules
+          # test_nss_myhostname()
+    '';
+})
diff --git a/nixos/tests/resolv.nix b/nixos/tests/resolv.nix
deleted file mode 100644
index f0aa7e42aaf3..000000000000
--- a/nixos/tests/resolv.nix
+++ /dev/null
@@ -1,46 +0,0 @@
-# Test whether DNS resolving returns multiple records and all address families.
-import ./make-test-python.nix ({ pkgs, ... } : {
-  name = "resolv";
-  meta = with pkgs.lib.maintainers; {
-    maintainers = [ ckauhaus ];
-  };
-
-  nodes.resolv = { ... }: {
-    networking.extraHosts = ''
-      # IPv4 only
-      192.0.2.1 host-ipv4.example.net
-      192.0.2.2 host-ipv4.example.net
-      # IP6 only
-      2001:db8::2:1 host-ipv6.example.net
-      2001:db8::2:2 host-ipv6.example.net
-      # dual stack
-      192.0.2.1 host-dual.example.net
-      192.0.2.2 host-dual.example.net
-      2001:db8::2:1 host-dual.example.net
-      2001:db8::2:2 host-dual.example.net
-    '';
-  };
-
-  testScript = ''
-    def addrs_in(hostname, addrs):
-        res = resolv.succeed("getent ahosts {}".format(hostname))
-        for addr in addrs:
-            assert addr in res, "Expected output '{}' not found in\n{}".format(addr, res)
-
-
-    start_all()
-    resolv.wait_for_unit("nscd")
-
-    ipv4 = ["192.0.2.1", "192.0.2.2"]
-    ipv6 = ["2001:db8::2:1", "2001:db8::2:2"]
-
-    with subtest("IPv4 resolves"):
-        addrs_in("host-ipv4.example.net", ipv4)
-
-    with subtest("IPv6 resolves"):
-        addrs_in("host-ipv6.example.net", ipv6)
-
-    with subtest("Dual stack resolves"):
-        addrs_in("host-dual.example.net", ipv4 + ipv6)
-  '';
-})
diff --git a/nixos/tests/systemd.nix b/nixos/tests/systemd.nix
index 3317823e03f7..3c36291b733d 100644
--- a/nixos/tests/systemd.nix
+++ b/nixos/tests/systemd.nix
@@ -87,12 +87,6 @@ import ./make-test-python.nix ({ pkgs, ... }: {
         machine.succeed("test -e /home/alice/user_conf_read")
         machine.succeed("test -z $(ls -1 /var/log/journal)")
 
-    # Regression test for https://github.com/NixOS/nixpkgs/issues/50273
-    with subtest("DynamicUser actually allocates a user"):
-        assert "iamatest" in machine.succeed(
-            "systemd-run --pty --property=Type=oneshot --property=DynamicUser=yes --property=User=iamatest whoami"
-        )
-
     with subtest("regression test for https://bugs.freedesktop.org/show_bug.cgi?id=77507"):
         retcode, output = machine.execute("systemctl status testservice1.service")
         assert retcode in [0, 3]  # https://bugs.freedesktop.org/show_bug.cgi?id=77507
diff --git a/pkgs/applications/audio/new-session-manager/default.nix b/pkgs/applications/audio/new-session-manager/default.nix
index 287b593d3eb8..5f23b9be651c 100644
--- a/pkgs/applications/audio/new-session-manager/default.nix
+++ b/pkgs/applications/audio/new-session-manager/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "new-session-manager";
-  version = "1.6.0";
+  version = "1.6.1";
 
   src = fetchFromGitHub {
     owner = "linuxaudio";
     repo = "new-session-manager";
     rev = "v${version}";
-    sha256 = "sha256-QVykRYXToeVXr7pYQy2afgEAlXrQnm68+xEUZhd+FkY=";
+    sha256 = "sha256-5G2GlBuKjC/r1SMm78JKia7bMA97YcvUR5l6zBucemw=";
   };
 
   nativeBuildInputs = [ meson pkg-config ninja ];
diff --git a/pkgs/applications/emulators/mgba/default.nix b/pkgs/applications/emulators/mgba/default.nix
index 4424bedc6f23..ce0ea6d6de8b 100644
--- a/pkgs/applications/emulators/mgba/default.nix
+++ b/pkgs/applications/emulators/mgba/default.nix
@@ -3,12 +3,14 @@
 , fetchFromGitHub
 , SDL2
 , cmake
-, libepoxy
-, ffmpeg_4
+, copyDesktopItems
+, ffmpeg
 , imagemagick
 , libedit
 , libelf
+, libepoxy
 , libzip
+, lua
 , makeDesktopItem
 , minizip
 , pkg-config
@@ -18,31 +20,33 @@
 , wrapQtAppsHook
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "mgba";
-  version = "0.9.3";
+  version = "0.10.0";
 
   src = fetchFromGitHub {
     owner = "mgba-emu";
     repo = "mgba";
-    rev = version;
-    hash = "sha256-0ZtoyyoD+YjplJlPFpZgIg5119j/6X8ZaSZP+UpX5K0=";
+    rev = finalAttrs.version;
+    hash = "sha256-2thc2v3aD8t1PrREZIjzRuYfP7b3BA7uFb6R95zxsZI=";
   };
 
   nativeBuildInputs = [
     cmake
+    copyDesktopItems
     pkg-config
     wrapQtAppsHook
   ];
 
   buildInputs = [
     SDL2
-    libepoxy
-    ffmpeg_4
+    ffmpeg
     imagemagick
     libedit
     libelf
+    libepoxy
     libzip
+    lua
     minizip
     qtbase
     qtmultimedia
@@ -79,9 +83,9 @@ stdenv.mkDerivation rec {
       runners, and a modern feature set for emulators that older emulators may
       not support.
     '';
+    changelog = "https://github.com/mgba-emu/mgba/blob/${finalAttrs.version}/CHANGES";
     license = licenses.mpl20;
     maintainers = with maintainers; [ MP2E AndersonTorres ];
     platforms = platforms.linux;
   };
-}
-# TODO: use desktopItem functions
+})
diff --git a/pkgs/applications/graphics/cyan/default.nix b/pkgs/applications/graphics/cyan/default.nix
new file mode 100644
index 000000000000..2e59c6716b71
--- /dev/null
+++ b/pkgs/applications/graphics/cyan/default.nix
@@ -0,0 +1,42 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, qt5
+, cmake
+, pkg-config
+, imagemagick
+, nix-update-script
+}:
+
+stdenv.mkDerivation rec {
+  pname = "cyan";
+  version = "1.2.4";
+
+  src = fetchFromGitHub {
+    owner = "rodlie";
+    repo = pname;
+    rev = version;
+    hash = "sha256-R5sj8AN7UT9OIeUPNrdTIUQvtEitXp1A32l/Z2qRS94=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    qt5.wrapQtAppsHook
+  ];
+
+  buildInputs = [ imagemagick ];
+
+  passthru.updateScript = nix-update-script {
+    attrPath = pname;
+  };
+
+  meta = with lib; {
+    description = "Image viewer and converter, designed for prepress (print) work";
+    homepage = "https://github.com/rodlie/cyan";
+    mainProgram = "Cyan";
+    license = licenses.cecill21;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ zendo ];
+  };
+}
diff --git a/pkgs/applications/misc/gpxsee/default.nix b/pkgs/applications/misc/gpxsee/default.nix
index 2973ac81539c..d7177906287e 100644
--- a/pkgs/applications/misc/gpxsee/default.nix
+++ b/pkgs/applications/misc/gpxsee/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gpxsee";
-  version = "11.5";
+  version = "11.6";
 
   src = fetchFromGitHub {
     owner = "tumic0";
     repo = "GPXSee";
     rev = version;
-    hash = "sha256-bA5C+BFqeOS0oFgz/qlYOFMsuh3L/U6QJbzOcRQkNhY=";
+    hash = "sha256-kwEltkLcMCZlUJyE+nyy70WboVO1FgMw0cH1hxLVtKQ=";
   };
 
   patches = (substituteAll {
diff --git a/pkgs/applications/networking/cluster/atlantis/default.nix b/pkgs/applications/networking/cluster/atlantis/default.nix
index 38408ed32ea7..8ce7b0dcae00 100644
--- a/pkgs/applications/networking/cluster/atlantis/default.nix
+++ b/pkgs/applications/networking/cluster/atlantis/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "atlantis";
-  version = "0.19.8";
+  version = "0.20.1";
 
   src = fetchFromGitHub {
     owner = "runatlantis";
     repo = "atlantis";
     rev = "v${version}";
-    sha256 = "sha256-o8lBpiR8gIo1kyOTkPOIuMnJbJsi619Zl0bAAFGYM4E=";
+    sha256 = "sha256-5zchElzEjrIgODRUvQTQwlBz5371iJU5VOpz12Xtbcg=";
   };
 
-  vendorSha256 = "sha256-aEMRCvZBaY1uwZqKtMmZ4aiPdNmtANcnuE7eykBiTQg=";
+  vendorSha256 = "sha256-n2yzqNjmPDP+8/ipiuUt6BqFYF0Oh0Y0TCdKsqCcrIQ=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/applications/networking/cluster/atmos/default.nix b/pkgs/applications/networking/cluster/atmos/default.nix
index ef7c3787bdc9..e255611a1b3f 100644
--- a/pkgs/applications/networking/cluster/atmos/default.nix
+++ b/pkgs/applications/networking/cluster/atmos/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "atmos";
-  version = "1.8.2";
+  version = "1.10.2";
 
   src = fetchFromGitHub {
     owner = "cloudposse";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-rDbnny/qRU31ciAXKLGLXS3FhgOpxmkLT4oatYCbt9g=";
+    sha256 = "sha256-/rxGAfYjV5VzYs9h8eCpz5jhmW7jPdk1XB3bXHH+oQw=";
   };
 
-  vendorSha256 = "sha256-Kfv3RlH80E/9yf/rvnY5vljaRr4cH5AhgXQn54x72Ds=";
+  vendorSha256 = "sha256-/b764auKkZF0oMqNlXmsW9aB5gcq4WFQRFjsVhNDiB4=";
 
   ldflags = [ "-s" "-w" "-X github.com/cloudposse/atmos/cmd.Version=v${version}" ];
 
diff --git a/pkgs/applications/networking/instant-messengers/slack/default.nix b/pkgs/applications/networking/instant-messengers/slack/default.nix
index 8c6572224c36..325d5330d62e 100644
--- a/pkgs/applications/networking/instant-messengers/slack/default.nix
+++ b/pkgs/applications/networking/instant-messengers/slack/default.nix
@@ -47,8 +47,8 @@ let
   x86_64-darwin-version = "4.28.182";
   x86_64-darwin-sha256 = "0x0zc45k0jh0hivgjymcxnnwc2lwyfq68rw39lbxp4i1ir2sbnxg";
 
-  x86_64-linux-version = "4.28.171";
-  x86_64-linux-sha256 = "sha256-rsHX/NLLGR0XZsg3Cc6GjNK6rSc9UmM2XkfjqwsJZV4=";
+  x86_64-linux-version = "4.28.184";
+  x86_64-linux-sha256 = "sha256-qAc9rHJbM7lmqNxOcOSnqnuib5zJ0Ry3hAGri8DKIlo=";
 
   aarch64-darwin-version = "4.28.182";
   aarch64-darwin-sha256 = "0bc8lhmpm0310gh1w9xkb8i1cpldchm4b4mzsr9h0mhvljxmvlyf";
diff --git a/pkgs/applications/office/karlender/default.nix b/pkgs/applications/office/karlender/default.nix
new file mode 100644
index 000000000000..44cd2ed0051f
--- /dev/null
+++ b/pkgs/applications/office/karlender/default.nix
@@ -0,0 +1,60 @@
+{ lib
+, rustPlatform
+, fetchFromGitLab
+, pkg-config
+, gtk4
+, libadwaita
+, wrapGAppsHook4
+, glib
+, tzdata
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "karlender";
+  version = "0.6.2";
+
+  src = fetchFromGitLab {
+    owner = "loers";
+    repo = "karlender";
+    rev = "v${version}";
+    sha256 = "sha256-YF46C+Vz7eGl4lqOQXqiQqaa6ieo1p8l6QCh4oNSJEg=";
+  };
+
+  cargoSha256 = "sha256-Kx5K2tp5PAQWac8LVrmOsk8Qf9m34SJ1vyfv7Ef2Wr0=";
+
+  nativeBuildInputs = [
+    pkg-config
+    wrapGAppsHook4
+    glib
+  ];
+  buildInputs = [
+    gtk4
+    libadwaita
+  ];
+
+  postPatch = ''
+    substituteInPlace src/domain/time.rs --replace "/usr/share/zoneinfo" "${tzdata}/share/zoneinfo"
+  '';
+
+  postInstall = ''
+    substituteInPlace target/gra-gen/data/codes.loers.Karlender.desktop \
+      --replace "Exec=codes.loers.Karlender" "Exec=karlender"
+    substituteInPlace target/gra-gen/data/codes.loers.Karlender.appdata.xml \
+      --replace "<binary>codes.loers.Karlender</binary>" "<binary>karlender</binary>"
+    install -Dm444 target/gra-gen/codes.loers.Karlender.gschema.xml -t $out/share/gsettings-schemas/$name/glib-2.0/schemas/
+    glib-compile-schemas $out/share/gsettings-schemas/$name/glib-2.0/schemas/
+    install -Dm444 target/gra-gen/data/codes.loers.Karlender.svg -t $out/share/icons/hicolor/scalable/apps/
+    install -Dm444 target/gra-gen/data/codes.loers.Karlender.64.png -T $out/share/icons/hicolor/64x64/apps/codes.loers.Karlender.png
+    install -Dm444 target/gra-gen/data/codes.loers.Karlender.128.png -T $out/share/icons/hicolor/128x128/apps/codes.loers.Karlender.png
+    install -Dm444 target/gra-gen/data/codes.loers.Karlender.desktop -t $out/share/applications/
+    install -Dm444 target/gra-gen/data/codes.loers.Karlender.appdata.xml -t $out/share/metainfo/
+  '';
+
+  meta = with lib; {
+    description = "Mobile-friendly GTK calendar application";
+    homepage = "https://gitlab.com/loers/karlender";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ chuangzhu ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/applications/science/robotics/mavproxy/default.nix b/pkgs/applications/science/robotics/mavproxy/default.nix
index 4aee366e987c..712374ef7520 100644
--- a/pkgs/applications/science/robotics/mavproxy/default.nix
+++ b/pkgs/applications/science/robotics/mavproxy/default.nix
@@ -4,11 +4,11 @@
 
 buildPythonApplication rec {
   pname = "MAVProxy";
-  version = "1.8.56";
+  version = "1.8.57";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-wyY9oYWABkXNhlZW4RFuyZy/HEnv7cGFVbXVoEnIF1Q=";
+    sha256 = "sha256-tsx3oVXPIa3OtbLWj3QWrW9leL9/jsdbbLG+Wd3nxn4=";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/version-management/git-and-tools/git-gone/default.nix b/pkgs/applications/version-management/git-and-tools/git-gone/default.nix
index 7a26b38b6b2d..5bdab4b081ee 100644
--- a/pkgs/applications/version-management/git-and-tools/git-gone/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-gone/default.nix
@@ -1,29 +1,27 @@
 { lib
 , stdenv
-, fetchFromGitea
+, fetchFromGitHub
 , rustPlatform
-, libiconv
 , Security
 , installShellFiles
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "git-gone";
-  version = "0.4.1";
+  version = "0.4.2";
 
-  src = fetchFromGitea {
-    domain = "codeberg.org";
-    owner = "flausch";
-    repo = pname;
+  src = fetchFromGitHub {
+    owner = "lunaryorn";
+    repo = "git-gone";
     rev = "v${version}";
-    sha256 = "sha256-kqKFs3xvTVHnsLpLC9gjj1dcPChhegmupNrbWy+7C6o=";
+    sha256 = "sha256-aKBNi797aMPawxD+BLpk0sazXz2g0XTzmDpR/mk07no=";
   };
 
-  cargoSha256 = "sha256-8R13eHS69fQ3r3LYlnB3nPTPX7VesUPlAUCmQEpUUdw=";
+  cargoSha256 = "sha256-vO1ePqDIy5HEBauO3OkMCovrgtIVB9biJExw/q89ivE=";
 
   nativeBuildInputs = [ installShellFiles ];
 
-  buildInputs = lib.optionals stdenv.isDarwin [ libiconv Security ];
+  buildInputs = lib.optionals stdenv.isDarwin [ Security ];
 
   postInstall = ''
     installManPage git-gone.1
@@ -31,8 +29,8 @@ rustPlatform.buildRustPackage rec {
 
   meta = with lib; {
     description = "Cleanup stale Git branches of merge requests";
-    homepage = "https://codeberg.org/flausch/git-gone";
-    changelog = "https://codeberg.org/flausch/git-gone/raw/tag/v${version}/CHANGELOG.md";
+    homepage = "https://github.com/lunaryorn/git-gone";
+    changelog = "https://github.com/lunaryorn/git-gone/raw/v${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = [ maintainers.marsam ];
   };
diff --git a/pkgs/applications/version-management/git-and-tools/git-interactive-rebase-tool/default.nix b/pkgs/applications/version-management/git-and-tools/git-interactive-rebase-tool/default.nix
index b85f6d973cf2..97e2cf0537ac 100644
--- a/pkgs/applications/version-management/git-and-tools/git-interactive-rebase-tool/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-interactive-rebase-tool/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "git-interactive-rebase-tool";
-  version = "2.2.0";
+  version = "2.2.1";
 
   src = fetchFromGitHub {
     owner = "MitMaro";
     repo = pname;
     rev = version;
-    sha256 = "sha256-++KTMzTt84dowoZP+Bc9E/jUS21YN5ybKrlpQUKCir0=";
+    sha256 = "sha256-KqItunxh24jAkvsAMnByS+dhm+wyUqmdF96qEDs/5mI=";
   };
 
-  cargoSha256 = "sha256-OUaP/nDs589FYaGYcleRMTQNu3/q/2wBjHSv2q8OyjA=";
+  cargoSha256 = "sha256-510kNtcSsuXADMmSqu2t0HsnPUS/Jedsfvjnh2k+vDs=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ libiconv Security ];
 
diff --git a/pkgs/applications/video/haruna/default.nix b/pkgs/applications/video/haruna/default.nix
index e873ac4a3bc1..0d063e707185 100644
--- a/pkgs/applications/video/haruna/default.nix
+++ b/pkgs/applications/video/haruna/default.nix
@@ -26,13 +26,13 @@
 
 mkDerivation rec {
   pname = "haruna";
-  version = "0.9.1";
+  version = "0.9.3";
 
   src = fetchFromGitLab {
     owner = "multimedia";
     repo = "haruna";
     rev = "v${version}";
-    hash = "sha256-pkskrzpKDsMg7DOC335zXknEIKh9Ku2NgyeinawQtiY=";
+    hash = "sha256-JINvLmiS6EnkAmxbqPJI+J9Wk4+ZXwZZm1x5Ew7FCBg=";
     domain = "invent.kde.org";
   };
 
diff --git a/pkgs/applications/window-managers/tinywm/default.nix b/pkgs/applications/window-managers/tinywm/default.nix
index 8fa6a84b721d..50fbae605da2 100644
--- a/pkgs/applications/window-managers/tinywm/default.nix
+++ b/pkgs/applications/window-managers/tinywm/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
   dontConfigure = true;
 
   buildPhase = ''
-    ${stdenv.cc}/bin/cc -Wall -pedantic -I${libX11}/include tinywm.c -L${libX11}/lib -lX11 -o tinywm
+    $CC -Wall -pedantic -I${libX11}/include tinywm.c -L${libX11}/lib -lX11 -o tinywm
   '';
 
   installPhase = ''
diff --git a/pkgs/build-support/cc-wrapper/default.nix b/pkgs/build-support/cc-wrapper/default.nix
index 14cd1d431391..f199b1d7e247 100644
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@@ -274,7 +274,9 @@ stdenv.mkDerivation {
 
   setupHooks = [
     ../setup-hooks/role.bash
-  ] ++ lib.optional (cc.langC or true) ./setup-hook.sh
+  ] ++ lib.optional (cc.langC or true)
+        # Temporary hack; see https://github.com/NixOS/nixpkgs/pull/191724#issuecomment-1278602576
+        (if stdenv.isLinux then ./setup-hook.sh else ./setup-hook-nonlinux.sh)
     ++ lib.optional (cc.langFortran or false) ./fortran-hook.sh;
 
   postFixup =
diff --git a/pkgs/build-support/cc-wrapper/setup-hook-nonlinux.sh b/pkgs/build-support/cc-wrapper/setup-hook-nonlinux.sh
new file mode 100644
index 000000000000..6a913cc4eac7
--- /dev/null
+++ b/pkgs/build-support/cc-wrapper/setup-hook-nonlinux.sh
@@ -0,0 +1,120 @@
+# CC Wrapper hygiene
+#
+# For at least cross compilation, we need to depend on multiple cc-wrappers at
+# once---specifically up to one per sort of dependency. This follows from having
+# different tools targeting different platforms, and different flags for those
+# tools. For example:
+#
+#   # Flags for compiling (whether or not linking) C code for the...
+#   NIX_CFLAGS_COMPILE_FOR_BUILD  # ...build platform
+#   NIX_CFLAGS_COMPILE            # ...host platform
+#   NIX_CFLAGS_COMPILE_FOR_TARGET # ...target platform
+#
+# Notice that these platforms are the 3 *relative* to the package using
+# cc-wrapper, not absolute like `x86_64-pc-linux-gnu`.
+#
+# The simplest solution would be to have separate cc-wrappers per (3 intended
+# use-cases * n absolute concrete platforms). For the use-case axis, we would
+# @-splice in 'BUILD_' '' 'TARGET_' to use the write environment variables when
+# building the cc-wrapper, and likewise prefix the binaries' names so they didn't
+# clobber each other on the PATH. But the need for 3x cc-wrappers, along with
+# non-standard name prefixes, is annoying and liable to break packages' build
+# systems.
+#
+# Instead, we opt to have just one cc-wrapper per absolute platform. Matching
+# convention, the binaries' names can just be prefixed with their target
+# platform. On the other hand, that means packages will depend on not just
+# multiple cc-wrappers, but the exact same cc-wrapper derivation multiple ways.
+# That means the exact same cc-wrapper derivation must be able to avoid
+# conflicting with itself, despite the fact that `setup-hook.sh`, the `addCvars`
+# function, and `add-flags.sh` are all communicating with each other with
+# environment variables. Yuck.
+#
+# The basic strategy is:
+#
+#  - Everyone exclusively *adds information* to relative-platform-specific
+#    environment variables, like `NIX_CFLAGS_COMPILE_FOR_TARGET`, to communicate
+#    with the wrapped binaries.
+#
+#  - The wrapped binaries will exclusively *read* cc-wrapper-derivation-specific
+#    environment variables distinguished with with `suffixSalt`, like
+#    `NIX_CFLAGS_COMPILE_@suffixSalt@`.
+#
+#  - `add-flags`, beyond its old task of reading extra flags stuck inside the
+#    cc-wrapper derivation, will convert the relative-platform-specific
+#    variables to cc-wrapper-derivation-specific variables. This conversion is
+#    the only time all but one of the cc-wrapper-derivation-specific variables
+#    are set.
+#
+# This ensures the flow of information is exclusive from
+# relative-platform-specific variables to cc-wrapper-derivation-specific
+# variables. This allows us to support the general case of a many--many relation
+# between relative platforms and cc-wrapper derivations.
+#
+# For more details, read the individual files where the mechanisms used to
+# accomplish this will be individually documented.
+
+# Skip setup hook if we're neither a build-time dep, nor, temporarily, doing a
+# native compile.
+#
+# TODO(@Ericson2314): No native exception
+[[ -z ${strictDeps-} ]] || (( "$hostOffset" < 0 )) || return 0
+
+# It's fine that any other cc-wrapper will redefine this. Bash functions close
+# over no state, and there's no @-substitutions within, so any redefined
+# function is guaranteed to be exactly the same.
+ccWrapper_addCVars () {
+    # See ../setup-hooks/role.bash
+    local role_post
+    getHostRoleEnvHook
+
+    if [ -d "$1/include" ]; then
+        export NIX_CFLAGS_COMPILE${role_post}+=" -isystem $1/include"
+    fi
+
+    if [ -d "$1/Library/Frameworks" ]; then
+        export NIX_CFLAGS_COMPILE${role_post}+=" -iframework $1/Library/Frameworks"
+    fi
+}
+
+# See ../setup-hooks/role.bash
+getTargetRole
+getTargetRoleWrapper
+
+# We use the `targetOffset` to choose the right env hook to accumulate the right
+# sort of deps (those with that offset).
+addEnvHooks "$targetOffset" ccWrapper_addCVars
+
+# Note 1: these come *after* $out in the PATH (see setup.sh).
+# Note 2: phase separation makes this look useless to shellcheck.
+
+# shellcheck disable=SC2157
+if [ -n "@cc@" ]; then
+    addToSearchPath _PATH @cc@/bin
+fi
+
+# shellcheck disable=SC2157
+if [ -n "@libc_bin@" ]; then
+    addToSearchPath _PATH @libc_bin@/bin
+fi
+
+# shellcheck disable=SC2157
+if [ -n "@coreutils_bin@" ]; then
+    addToSearchPath _PATH @coreutils_bin@/bin
+fi
+
+# Export tool environment variables so various build systems use the right ones.
+
+export NIX_CC${role_post}=@out@
+
+export CC${role_post}=@named_cc@
+export CXX${role_post}=@named_cxx@
+export CC${role_post}=@named_cc@
+export CXX${role_post}=@named_cxx@
+
+# If unset, assume the default hardening flags.
+: ${NIX_HARDENING_ENABLE="fortify stackprotector pic strictoverflow format relro bindnow"}
+export NIX_HARDENING_ENABLE
+
+# No local scope in sourced file
+unset -v role_post
diff --git a/pkgs/development/libraries/nvidia-vaapi-driver/default.nix b/pkgs/development/libraries/nvidia-vaapi-driver/default.nix
index 7225efad2f68..3554457d3f27 100644
--- a/pkgs/development/libraries/nvidia-vaapi-driver/default.nix
+++ b/pkgs/development/libraries/nvidia-vaapi-driver/default.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "nvidia-vaapi-driver";
-  version = "0.0.6";
+  version = "0.0.7";
 
   src = fetchFromGitHub {
     owner = "elFarto";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-/9PCqjs0hiIM7ZLvDesff5Bh0a1B8/w/CTw62spw+j4=";
+    sha256 = "sha256-c74XJW9e8sgjBuTpZQOgIvgEoP73aQlx6beE6bChYfw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/odpic/default.nix b/pkgs/development/libraries/odpic/default.nix
index b13aa66eb8f2..30ddc3d3b629 100644
--- a/pkgs/development/libraries/odpic/default.nix
+++ b/pkgs/development/libraries/odpic/default.nix
@@ -38,7 +38,7 @@ in stdenv.mkDerivation {
     homepage = "https://oracle.github.io/odpi/";
     maintainers = with maintainers; [ mkazulak flokli ];
     license = licenses.asl20;
-    platforms = [ "x86_64-linux" "x86_64-darwin" ];
+    platforms = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" ];
     hydraPlatforms = [];
   };
 }
diff --git a/pkgs/development/libraries/oracle-instantclient/default.nix b/pkgs/development/libraries/oracle-instantclient/default.nix
index f5a414786ac3..129874c1dfba 100644
--- a/pkgs/development/libraries/oracle-instantclient/default.nix
+++ b/pkgs/development/libraries/oracle-instantclient/default.nix
@@ -22,18 +22,32 @@ let
 
   # determine the version number, there might be different ones per architecture
   version = {
-    x86_64-linux = "19.3.0.0.0";
+    x86_64-linux = "19.16.0.0.0";
+    aarch64-linux = "19.10.0.0.0";
     x86_64-darwin = "19.3.0.0.0";
   }.${stdenv.hostPlatform.system} or throwSystem;
 
+  directory = {
+    x86_64-linux = "1916000";
+    aarch64-linux = "191000";
+    x86_64-darwin = "193000";
+  }.${stdenv.hostPlatform.system} or throwSystem;
+
   # hashes per component and architecture
   hashes = {
     x86_64-linux = {
-      basic = "1yk4ng3a9ka1mzgfph9br6rwclagbgfvmg6kja11nl5dapxdzaxy";
-      sdk = "115v1gqr0czy7dcf2idwxhc6ja5b0nind0mf1rn8iawgrw560l99";
-      sqlplus = "0zj5h84ypv4n4678kfix6jih9yakb277l9hc0819iddc0a5slbi5";
-      tools = "1q19blr0gz1c8bq0bnv1njzflrp03hf82ngid966xc6gwmqpkdsk";
-      odbc = "1g1z6pdn76dp440fh49pm8ijfgjazx4cvxdi665fsr62h62xkvch";
+      basic = "sha256-Sq1rWvbC1YME7EjSYPaP2g+1Xxxkk4ZkGaBmLo2cKcQ=";
+      sdk = "sha256-yJ8f/Hlq6vZoPxv+dfY4z1E7rWvcqlK+ou0SU0KKlEI=";
+      sqlplus = "sha256-C44srukpCB9et9UWm59daJmU83zr0HAktnWv7R42Irw=";
+      tools = "sha256-GP4E1REIoU3lctVYmLsAiwTJEvGRpCmOFlRuZk+A8HE=";
+      odbc = "sha256-JECxK7Ia1IJtve2goZJdTkvm5NJjqB2rc6k5BXUt3oA=";
+    };
+    aarch64-linux = {
+      basic = "sha256-DNntH20BAmo5kOz7uEgW2NXaNfwdvJ8l8oMnp50BOsY=";
+      sdk = "sha256-8VpkNyLyFMUfQwbZpSDV/CB95RoXfaMr8w58cRt/syw=";
+      sqlplus = "sha256-iHcyijHhAvjsAqN9R+Rxo2R47k940VvPbScc2MWYn0Q=";
+      tools = "sha256-4QY0EwcnctwPm6ZGDZLudOFM4UycLFmRIluKGXVwR0M=";
+      odbc = "sha256-T+RIIKzZ9xEg/E72pfs5xqHz2WuIWKx/oRfDrQbw3ms=";
     };
     x86_64-darwin = {
       basic = "f4335c1d53e8188a3a8cdfb97494ff87c4d0f481309284cf086dc64080a60abd";
@@ -50,11 +64,13 @@ let
   # convert platform to oracle architecture names
   arch = {
     x86_64-linux = "linux.x64";
+    aarch64-linux = "linux.arm64";
     x86_64-darwin = "macos.x64";
   }.${stdenv.hostPlatform.system} or throwSystem;
 
   shortArch = {
     x86_64-linux = "linux";
+    aarch64-linux = "linux";
     x86_64-darwin = "mac";
   }.${stdenv.hostPlatform.system} or throwSystem;
 
@@ -62,12 +78,11 @@ let
   srcFilename = component: arch: version: rel:
     "instantclient-${component}-${arch}-${version}" +
     (optionalString (rel != "") "-${rel}") +
-    (optionalString (arch == "linux.x64" || arch == "macos.x64") "dbru") + # ¯\_(ツ)_/¯
-    ".zip";
+    "dbru.zip"; # ¯\_(ツ)_/¯
 
   # fetcher for the non clickthrough artifacts
   fetcher = srcFilename: hash: fetchurl {
-    url = "https://download.oracle.com/otn_software/${shortArch}/instantclient/193000/${srcFilename}";
+    url = "https://download.oracle.com/otn_software/${shortArch}/instantclient/${directory}/${srcFilename}";
     sha256 = hash;
   };
 
@@ -127,7 +142,7 @@ stdenv.mkDerivation {
     '';
     sourceProvenance = with sourceTypes; [ binaryBytecode ];
     license = licenses.unfree;
-    platforms = [ "x86_64-linux" "x86_64-darwin" ];
+    platforms = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" ];
     maintainers = with maintainers; [ flokli ];
     hydraPlatforms = [ ];
   };
diff --git a/pkgs/development/libraries/physics/clhep/default.nix b/pkgs/development/libraries/physics/clhep/default.nix
index 6f648463c854..a3b85e36796e 100644
--- a/pkgs/development/libraries/physics/clhep/default.nix
+++ b/pkgs/development/libraries/physics/clhep/default.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "clhep";
-  version = "2.4.5.3";
+  version = "2.4.6.0";
 
   src = fetchurl {
     url = "https://proj-clhep.web.cern.ch/proj-clhep/dist1/clhep-${version}.tgz";
-    hash = "sha256-RfY+6wl/Av5nuGp9rb8Q1Am0AcKKGj4XLbNiUsMJfBM=";
+    hash = "sha256-6NFt67hM7SjkDproR4nPWgra1F+SE/usPOdYPgbKp7E=";
   };
 
   prePatch = ''
diff --git a/pkgs/development/libraries/rocksdb/default.nix b/pkgs/development/libraries/rocksdb/default.nix
index 1da9b869a0db..c915a3df521f 100644
--- a/pkgs/development/libraries/rocksdb/default.nix
+++ b/pkgs/development/libraries/rocksdb/default.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "rocksdb";
-  version = "7.7.2";
+  version = "7.7.3";
 
   src = fetchFromGitHub {
     owner = "facebook";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Cla2yat/xCrzx53mYRKjcvH9cCY0MVD8RSMjGfxVDUM=";
+    sha256 = "sha256-Np3HPTZYzyoPOKL0xgsLzcvOkceFiEQd+1nyGbg4BHo=";
   };
 
   nativeBuildInputs = [ cmake ninja ];
diff --git a/pkgs/development/python-modules/aioftp/default.nix b/pkgs/development/python-modules/aioftp/default.nix
index 8f0ef50e7fd0..df7575de0484 100644
--- a/pkgs/development/python-modules/aioftp/default.nix
+++ b/pkgs/development/python-modules/aioftp/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "aioftp";
-  version = "0.21.3";
+  version = "0.21.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-xtrlCzqgfwlbLZOoN9Y23ZPyNaqv5Ure+Cvg+OVWf9I=";
+    sha256 = "sha256-KLsm1GFsfDgaFUMoH5hwUbjS0dW/rwI9nn4sIQXFG7k=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/radish-bdd/default.nix b/pkgs/development/python-modules/radish-bdd/default.nix
index f75e5cc19ee5..258cd012716c 100644
--- a/pkgs/development/python-modules/radish-bdd/default.nix
+++ b/pkgs/development/python-modules/radish-bdd/default.nix
@@ -7,41 +7,56 @@
 , freezegun
 , humanize
 , lark
+, lxml
 , parse-type
 , pysingleton
+, pytest-mock
 , pytestCheckHook
+, pythonOlder
 , pyyaml
 , tag-expressions
-, lxml
-, pytest-mock
 }:
 
 buildPythonPackage rec {
   pname = "radish-bdd";
-  version = "0.13.4";
+  version = "0.14.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
-  # Pypi package does not have necessary test fixtures.
   src = fetchFromGitHub {
     owner = pname;
     repo = "radish";
-    rev = "v${version}";
-    sha256 = "1slfgh61648i009qj8156qipy21a6zm8qzjk00kbm5kk5z9jfryi";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-7C8XgGlpNVUONSfg9DsIS8Awpy6iDzFOLAFs1xpfHXI=";
   };
 
   propagatedBuildInputs = [
-    lark
     click
     colorful
-    tag-expressions
-    parse-type
-    humanize
-    pyyaml
     docopt
+    humanize
+    lark
+    lxml
+    parse-type
     pysingleton
+    tag-expressions
   ];
 
-  checkInputs = [ freezegun lxml pytestCheckHook pytest-mock ];
-  disabledTests = [ "test_main_cli_calls" ];
+  checkInputs = [
+    freezegun
+    pytest-mock
+    pytestCheckHook
+    pyyaml
+  ];
+
+  pythonImportsCheck = [
+    "radish"
+  ];
+
+  disabledTests = [
+    "test_main_cli_calls"
+  ];
 
   meta = with lib; {
     description = "Behaviour-Driven-Development tool for python";
diff --git a/pkgs/development/tools/analysis/rizin/cutter.nix b/pkgs/development/tools/analysis/rizin/cutter.nix
index f7c5eae72a84..3eb953bd4803 100644
--- a/pkgs/development/tools/analysis/rizin/cutter.nix
+++ b/pkgs/development/tools/analysis/rizin/cutter.nix
@@ -11,13 +11,13 @@
 
 mkDerivation rec {
   pname = "cutter";
-  version = "2.1.0";
+  version = "2.1.2";
 
   src = fetchFromGitHub {
     owner = "rizinorg";
     repo = "cutter";
     rev = "v${version}";
-    sha256 = "sha256-JfJQuEUeLXCjzm4d0ZNHRVazF0Bk6fVAsNvBb+okoXs=";
+    sha256 = "sha256-rJYnKQYrwj2zSg3dBHOI7zxwXTAO7ImAj0dkbVmUvHU=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/tools/continuous-integration/fly/default.nix b/pkgs/development/tools/continuous-integration/fly/default.nix
index 7dd67dcebd33..c0211bd17fe7 100644
--- a/pkgs/development/tools/continuous-integration/fly/default.nix
+++ b/pkgs/development/tools/continuous-integration/fly/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "fly";
-  version = "7.8.2";
+  version = "7.8.3";
 
   src = fetchFromGitHub {
     owner = "concourse";
     repo = "concourse";
     rev = "v${version}";
-    sha256 = "sha256-Lgsn5k3ITJnRnOXXZjfjlEEG+OvTZjFq+LB3Us3DH8k=";
+    sha256 = "sha256-7r9/r6gj8u3r4R5UQIxpnmJ33SGfEAuOcqRLK11khfc=";
   };
 
-  vendorSha256 = "sha256-91N6AOxXFOI6AM28avlInseAeZkqE9IfybJAX31tPDg=";
+  vendorSha256 = "sha256-tEh1D/eczqLzuVQUcHE4+7Q74jM/yomdPDt6+TVJeew=";
 
   subPackages = [ "fly" ];
 
diff --git a/pkgs/development/tools/millet/default.nix b/pkgs/development/tools/millet/default.nix
index afe20aef049b..883e88866b78 100644
--- a/pkgs/development/tools/millet/default.nix
+++ b/pkgs/development/tools/millet/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "millet";
-  version = "0.3.14";
+  version = "0.4.1";
 
   src = fetchFromGitHub {
     owner = "azdavis";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-fi0kU1+gazSfQEyL3qYcK/qeMh1UGuitGXJ9FsVAiTw=";
+    sha256 = "sha256-7CIi1a3SyuJzvBrjTE5wS7xKXEVdmUu2RUVeL3P//z8=";
   };
 
-  cargoSha256 = "sha256-ijXGXq5+OOnf4Nmg68GcSKZe/5tjG0KebOsCWU+vmHc=";
+  cargoSha256 = "sha256-Dg/dq2/q+snqbkX1fR/mgKozfKZlZOuT5vXFTuu0AiY=";
 
   postPatch = ''
     rm .cargo/config.toml
diff --git a/pkgs/development/tools/misc/terraform-ls/default.nix b/pkgs/development/tools/misc/terraform-ls/default.nix
index b60dfa7f4466..7570dd586f0a 100644
--- a/pkgs/development/tools/misc/terraform-ls/default.nix
+++ b/pkgs/development/tools/misc/terraform-ls/default.nix
@@ -2,15 +2,15 @@
 
 buildGoModule rec {
   pname = "terraform-ls";
-  version = "0.29.2";
+  version = "0.29.3";
 
   src = fetchFromGitHub {
     owner = "hashicorp";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-oPBk5mTCq8nn4olC9Z7ROvrfAUXDxnWhm8w20sh5Wkw=";
+    sha256 = "sha256-CYbeRhwoffyELM0REZL14m4tTe/66GDToqNKcEfmums=";
   };
-  vendorSha256 = "sha256-5Pb1mr3rYPcWFLjETAZp8rLW32n+RyCm7NbfooM4hZs=";
+  vendorSha256 = "sha256-wbB3/RfzL05SaLv49gs7WKrjV//dM3SjpbMNGI1yH4I=";
 
   ldflags = [ "-s" "-w" "-X main.version=v${version}" "-X main.prerelease=" ];
 
diff --git a/pkgs/development/tools/rust/cargo-pgx/default.nix b/pkgs/development/tools/rust/cargo-pgx/default.nix
index 4ad70bfa9ed4..e4ff582964fa 100644
--- a/pkgs/development/tools/rust/cargo-pgx/default.nix
+++ b/pkgs/development/tools/rust/cargo-pgx/default.nix
@@ -2,14 +2,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-pgx";
-  version = "0.4.5";
+  version = "0.5.0";
 
   src = fetchCrate {
     inherit version pname;
-    sha256 = "sha256-BcMGa/1ATwLG8VnwItfd5eqmrck/u0MEoR5sA2yuzyQ=";
+    sha256 = "sha256-5UH34l4zmKFZY2uHLDqJ1kW/QRQbII0/zmmGA3DFKB4=";
   };
 
-  cargoSha256 = "sha256-urlwqBCZMxlPEjLLPBhI2lDNTusCSZ1bZu1p8poVrtw=";
+  cargoSha256 = "sha256-1CU/VrNS3tGycjel5MV6SrZJ7LExds2YhdO+VAHgusM=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/misc/sound-of-sorting/default.nix b/pkgs/misc/sound-of-sorting/default.nix
index 6e838803dea0..4d3aec01439f 100644
--- a/pkgs/misc/sound-of-sorting/default.nix
+++ b/pkgs/misc/sound-of-sorting/default.nix
@@ -1,28 +1,24 @@
-{ lib, stdenv, fetchFromGitHub, SDL2, wxGTK } :
-
-stdenv.mkDerivation rec {
+{ lib, stdenv, fetchFromGitHub, pkg-config, SDL2, wxGTK32, Cocoa }:
 
+stdenv.mkDerivation {
   pname = "sound-of-sorting";
-  version = "2017-12-23";
+  version = "unstable-2022-10-12";
 
   src = fetchFromGitHub {
     owner = "bingmann";
     repo = "sound-of-sorting";
-    rev = "5884a357af5775fb57d89eb028d4bf150760db75";
-    sha256 = "01bpzn38cwn9zlydzvnfz9k7mxdnjnvgnbcpx7i4al8fha7x9lw8";
+    rev = "5cfcaf752593c8cbcf52555dd22745599a7d8b1b";
+    sha256 = "sha256-cBrTvFoz6WZIsh5qPPiWxQ338Z0OfcIefiI8CZF6nn8=";
   };
 
-  buildInputs =
-  [ wxGTK SDL2 ];
+  nativeBuildInputs = [ pkg-config ];
 
-  preConfigure = ''
-    export SDL_CONFIG=${SDL2.dev}/bin/sdl2-config
-  '';
+  buildInputs = [ wxGTK32 SDL2 ] ++ lib.optionals stdenv.isDarwin [ Cocoa ];
 
   meta = with lib; {
     description = "Audibilization and Visualization of Sorting Algorithms";
     homepage = "https://panthema.net/2013/sound-of-sorting/";
-    license = with licenses; gpl3;
+    license = with licenses; gpl3Plus;
     maintainers = with maintainers; [ AndersonTorres ];
   };
 }
diff --git a/pkgs/os-specific/linux/bpftools/default.nix b/pkgs/os-specific/linux/bpftools/default.nix
index ec109753c208..d3bb96afb3e7 100644
--- a/pkgs/os-specific/linux/bpftools/default.nix
+++ b/pkgs/os-specific/linux/bpftools/default.nix
@@ -15,6 +15,8 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-xDalSMcxLOb8WjRyy+rYle749ShB++fHH9jki9/isLo=";
   };
 
+  patches = [ ./strip-binary-name.patch ];
+
   nativeBuildInputs = [ python3 bison flex ];
   buildInputs = (if (lib.versionAtLeast version "5.20")
                  then [ libopcodes libbfd ]
diff --git a/pkgs/os-specific/linux/bpftools/strip-binary-name.patch b/pkgs/os-specific/linux/bpftools/strip-binary-name.patch
new file mode 100644
index 000000000000..623e90963bd9
--- /dev/null
+++ b/pkgs/os-specific/linux/bpftools/strip-binary-name.patch
@@ -0,0 +1,15 @@
+Strip path to the binary from prints.
+
+I see no sense in including the full path in outputs like bpftool --version
+Especially as argv[0] may not include it, based on calling via $PATH or not.
+--- a/tools/bpf/bpftool/main.c
++++ b/tools/bpf/bpftool/main.c
+@@ -443 +443,7 @@
+-	bin_name = argv[0];
++	/* Strip the path if any. */
++	const char *bin_name_slash = strrchr(argv[0], '/');
++	if (bin_name_slash) {
++		bin_name = bin_name_slash + 1;
++	} else {
++		bin_name = argv[0];
++	}
diff --git a/pkgs/os-specific/linux/kernel/zen-kernels.nix b/pkgs/os-specific/linux/kernel/zen-kernels.nix
index 3cb3042b0e3e..10741e7d1fd3 100644
--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@@ -4,16 +4,16 @@ let
   # comments with variant added for update script
   # ./update-zen.py zen
   zenVariant = {
-    version = "5.19.12"; #zen
-    suffix = "zen1"; #zen
-    sha256 = "001zrsgsg5yl74yn4qdmykwmys4mdwnnbiqmfpw60i3qr5ig90ap"; #zen
+    version = "6.0.1"; #zen
+    suffix = "zen2"; #zen
+    sha256 = "172xacqqkrnrbgf2sy158wny4dpb92isilq0p4x700xxrvvz4ag2"; #zen
     isLqx = false;
   };
   # ./update-zen.py lqx
   lqxVariant = {
-    version = "5.19.12"; #lqx
-    suffix = "lqx1"; #lqx
-    sha256 = "19y3znj3zjifkd1m8agb8f80kzfs1rx1ccpnq7fvkd7j4yd3khlf"; #lqx
+    version = "5.19.15"; #lqx
+    suffix = "lqx2"; #lqx
+    sha256 = "1zqfgxcba24y0v3xd249rbqvd92lcf3s888mmqwidxcdjqlj5kc8"; #lqx
     isLqx = true;
   };
   zenKernelsFor = { version, suffix, sha256, isLqx }: buildLinux (args // {
diff --git a/pkgs/servers/caddy/default.nix b/pkgs/servers/caddy/default.nix
index 51088486809a..37d6b7251a32 100644
--- a/pkgs/servers/caddy/default.nix
+++ b/pkgs/servers/caddy/default.nix
@@ -7,7 +7,7 @@
 , installShellFiles
 }:
 let
-  version = "2.6.1";
+  version = "2.6.2";
   dist = fetchFromGitHub {
     owner = "caddyserver";
     repo = "dist";
@@ -23,20 +23,16 @@ buildGoModule {
     owner = "caddyserver";
     repo = "caddy";
     rev = "v${version}";
-    sha256 = "sha256-Z8MiMhXH1er+uYvmDQiamF/jSxHbTMwjo61qbH0ioEo=";
+    sha256 = "sha256-Tbf6RB3106OEZGc/Wx7vk+I82Z8/Q3WqnID4f8uZ6z0=";
   };
 
-  vendorSha256 = "sha256-6UTErIPB/z4RfndPSLKFJDFweLB3ax8WxEDA+3G5asI=";
-
-  patches = [
-    ./inject_version.diff
-  ];
+  vendorSha256 = "sha256-YxGXk3Q1qw6uZxrGc8l2lKExP2GP+nm3eYbHDoEbgdY=";
 
   subPackages = [ "cmd/caddy" ];
 
   ldflags = [
     "-s" "-w"
-    "-X github.com/caddyserver/caddy/v2.ShortVersion=${version}"
+    "-X github.com/caddyserver/caddy/v2.CustomVersion=${version}"
   ];
 
   nativeBuildInputs = [ installShellFiles ];
diff --git a/pkgs/servers/caddy/inject_version.diff b/pkgs/servers/caddy/inject_version.diff
deleted file mode 100644
index 3636f026a77a..000000000000
--- a/pkgs/servers/caddy/inject_version.diff
+++ /dev/null
@@ -1,15 +0,0 @@
-diff --git a/caddy.go b/caddy.go
-index 584865bd..082b9b6c 100644
---- a/caddy.go
-+++ b/caddy.go
-@@ -840,7 +840,10 @@ func InstanceID() (uuid.UUID, error) {
- // and https://github.com/golang/go/issues/50603.
- //
- // This function is experimental and subject to change or removal.
-+var ShortVersion = "(devel)"
-+
- func Version() (simple, full string) {
-+	return ShortVersion, ShortVersion
- 	// the currently-recommended way to build Caddy involves
- 	// building it as a dependency so we can extract version
- 	// information from go.mod tooling; once the upstream
\ No newline at end of file
diff --git a/pkgs/servers/computing/slurm/default.nix b/pkgs/servers/computing/slurm/default.nix
index a02a6d644980..263d03616cda 100644
--- a/pkgs/servers/computing/slurm/default.nix
+++ b/pkgs/servers/computing/slurm/default.nix
@@ -14,7 +14,7 @@
 
 stdenv.mkDerivation rec {
   pname = "slurm";
-  version = "22.05.4.1";
+  version = "22.05.5.1";
 
   # N.B. We use github release tags instead of https://www.schedmd.com/downloads.php
   # because the latter does not keep older releases.
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
     repo = "slurm";
     # The release tags use - instead of .
     rev = "${pname}-${builtins.replaceStrings ["."] ["-"] version}";
-    sha256 = "100ixhpi4ahx5w7b1ncgmmg1ar48brp095lrxhcxr55fq2wqlv35";
+    sha256 = "1mw0dkll1iwwdpdbxcy26zpnjgj07prlgdz2da64krn4yyfhca30";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/servers/snappymail/default.nix b/pkgs/servers/snappymail/default.nix
index f6178dba992f..ef23614f436c 100644
--- a/pkgs/servers/snappymail/default.nix
+++ b/pkgs/servers/snappymail/default.nix
@@ -2,11 +2,11 @@
 , dataPath ? "/var/lib/snappymail" }:
 stdenv.mkDerivation rec {
   pname = "snappymail";
-  version = "2.18.5";
+  version = "2.18.6";
 
   src = fetchurl {
     url = "https://github.com/the-djmaze/snappymail/releases/download/v${version}/snappymail-${version}.tar.gz";
-    sha256 = "sha256-JfKxeXLlK4n2BQwJa2JV5VHtNfW6W9cdd+9W+MnxZZo=";
+    sha256 = "sha256-BoRumpU9HjkNDr113LvIGmpsLlRJtAmGhSBcUoGO8Vc=";
   };
 
   sourceRoot = "snappymail";
diff --git a/pkgs/servers/sql/postgresql/default.nix b/pkgs/servers/sql/postgresql/default.nix
index cc311c079cb8..975f486629ad 100644
--- a/pkgs/servers/sql/postgresql/default.nix
+++ b/pkgs/servers/sql/postgresql/default.nix
@@ -233,4 +233,13 @@ in self: {
     thisAttr = "postgresql_14";
     inherit self;
   };
+
+  postgresql_15 = self.callPackage generic {
+    version = "15.0";
+    psqlSchema = "15";
+    hash = "sha256-cux09KfBbmhPQ+pC4hVJf81MVdAopo+3LpnmH/QNpNY=";
+    this = self.postgresql_15;
+    thisAttr = "postgresql_15";
+    inherit self;
+  };
 }
diff --git a/pkgs/servers/sql/postgresql/ext/periods.nix b/pkgs/servers/sql/postgresql/ext/periods.nix
index 4d1d3326457f..9ceabbe972a1 100644
--- a/pkgs/servers/sql/postgresql/ext/periods.nix
+++ b/pkgs/servers/sql/postgresql/ext/periods.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "periods";
-  version = "1.2";
+  version = "1.2.1";
 
   src = fetchFromGitHub {
     owner = "xocolatl";
     repo = pname;
     rev = "v${version}";
-    sha256 = "13aix61qzlb7cs042dz4x0z4sc2xayg4nzi2cks46zibxm5i4gzm";
+    sha256 = "sha256-XAqjP8Cih+HzqlI8XjgCNzSVQSbaetLRvJReiwHdaIc=";
   };
 
   buildInputs = [ postgresql ];
diff --git a/pkgs/servers/sql/postgresql/ext/pg_partman.nix b/pkgs/servers/sql/postgresql/ext/pg_partman.nix
index 561c16c96459..c95e4d8174d3 100644
--- a/pkgs/servers/sql/postgresql/ext/pg_partman.nix
+++ b/pkgs/servers/sql/postgresql/ext/pg_partman.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "pg_partman";
-  version = "4.7.0";
+  version = "4.7.1";
 
   buildInputs = [ postgresql ];
 
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
     owner  = "pgpartman";
     repo   = pname;
     rev    = "refs/tags/v${version}";
-    sha256 = "sha256-Hbg3lf9XEIt5r4sYW+1r1tu6GyBgRXQxrPRWNuZPsvM=";
+    sha256 = "sha256-XewRIzue38aXhjU6GKEiuUyY+6ngtyQLhCl3/T6Al+A=";
   };
 
   installPhase = ''
diff --git a/pkgs/servers/sql/postgresql/ext/pg_repack.nix b/pkgs/servers/sql/postgresql/ext/pg_repack.nix
index 626e4e0290b1..83c3ac0796a7 100644
--- a/pkgs/servers/sql/postgresql/ext/pg_repack.nix
+++ b/pkgs/servers/sql/postgresql/ext/pg_repack.nix
@@ -2,15 +2,15 @@
 
 stdenv.mkDerivation rec {
   pname = "pg_repack";
-  version = "1.4.7";
+  version = "1.4.8";
 
   buildInputs = [ postgresql openssl zlib readline ];
 
   src = fetchFromGitHub {
     owner  = "reorg";
     repo   = "pg_repack";
-    rev    = "refs/tags/ver_${version}";
-    sha256 = "12j8crgljvkm9dz790xcsr8l7sv8ydvb2imrb0jh1jvj0r9yg1v5";
+    rev    = "f42c1bd707bd5d69a9eb33494133db2e47a2c05a"; # no release tag
+    sha256 = "sha256-pZjspnmPTXS/SbyLAd7vcoF01cbC6PnxZjuto4lUuQA=";
   };
 
   installPhase = ''
diff --git a/pkgs/servers/sql/postgresql/ext/pgjwt.nix b/pkgs/servers/sql/postgresql/ext/pgjwt.nix
index afa08a8cdce0..c0c9c3104427 100644
--- a/pkgs/servers/sql/postgresql/ext/pgjwt.nix
+++ b/pkgs/servers/sql/postgresql/ext/pgjwt.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation {
   pname = "pgjwt";
-  version = "unstable-2017-04-24";
+  version = "unstable-2021-11-13";
 
   src = fetchFromGitHub {
     owner  = "michelp";
     repo   = "pgjwt";
-    rev    = "546a2911027b716586e241be7fd4c6f1785237cd";
-    sha256 = "1riz0xvwb6y02j0fljbr9hcbqb2jqs4njlivmavy9ysbcrrv1vrf";
+    rev    = "9742dab1b2f297ad3811120db7b21451bca2d3c9";
+    sha256 = "sha256-Hw3R9bMGDmh+dMzjmqZSy/rT4mX8cPU969OJiARFg10=";
   };
 
   dontBuild = true;
diff --git a/pkgs/servers/sql/postgresql/ext/pgroonga.nix b/pkgs/servers/sql/postgresql/ext/pgroonga.nix
index 6afbacca812c..05be683f1ff7 100644
--- a/pkgs/servers/sql/postgresql/ext/pgroonga.nix
+++ b/pkgs/servers/sql/postgresql/ext/pgroonga.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "pgroonga";
-  version = "2.3.9";
+  version = "2.4.0";
 
   src = fetchurl {
     url = "https://packages.groonga.org/source/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-qCS0ndupiRUSI0+BX+o56dgDN9/jPLPdAD16N+gGHqo=";
+    sha256 = "sha256-W6quDn2B+BZ+J46aNMbtVq7OizT1q5jyKMZECAk0F7M=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/servers/sql/postgresql/ext/pgvector.nix b/pkgs/servers/sql/postgresql/ext/pgvector.nix
index ddc51e8d2b73..c04cb0c3b159 100644
--- a/pkgs/servers/sql/postgresql/ext/pgvector.nix
+++ b/pkgs/servers/sql/postgresql/ext/pgvector.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, postgresql }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, postgresql }:
 
 stdenv.mkDerivation rec {
   pname = "pgvector";
@@ -11,6 +11,14 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-kIgdr3+KC11Qxk1uBTmcN4dDaLIhfo/Fs898boESsBc=";
   };
 
+  patches = [
+    # Added support for Postgres 15. Remove with the next release.
+    (fetchpatch {
+      url = "https://github.com/pgvector/pgvector/commit/c9c6b96eede7d78758ca7ca5db98bf8b24021d0f.patch";
+      sha256 = "sha256-hgCpGtuYmqo4Ttlpn4FBskbNdZmM1wJeMQBJZ7H923g=";
+    })
+  ];
+
   buildInputs = [ postgresql ];
 
   installPhase = ''
diff --git a/pkgs/servers/sql/postgresql/ext/plpgsql_check.nix b/pkgs/servers/sql/postgresql/ext/plpgsql_check.nix
index a38b6a5ecba0..0650cf8a7b2a 100644
--- a/pkgs/servers/sql/postgresql/ext/plpgsql_check.nix
+++ b/pkgs/servers/sql/postgresql/ext/plpgsql_check.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "plpgsql_check";
-  version = "2.2.1";
+  version = "2.2.2";
 
   src = fetchFromGitHub {
     owner = "okbob";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-0x7alz0EySMcqi4yZm5z6pZeL6glf8AYHG+dVBBtnIU=";
+    sha256 = "sha256-Nxq4wpOWYt4oyoLxERWPhlEwWmLiDEk27EFyDtW/BfI=";
   };
 
   buildInputs = [ postgresql ];
diff --git a/pkgs/servers/sql/postgresql/ext/tsearch_extras.nix b/pkgs/servers/sql/postgresql/ext/tsearch_extras.nix
index 3f3b2aa4f143..582451b3ba44 100644
--- a/pkgs/servers/sql/postgresql/ext/tsearch_extras.nix
+++ b/pkgs/servers/sql/postgresql/ext/tsearch_extras.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, pkg-config, postgresql }:
+{ lib, stdenv, fetchFromGitHub, postgresql }:
 
 stdenv.mkDerivation {
   pname = "tsearch-extras";
@@ -11,7 +11,6 @@ stdenv.mkDerivation {
     sha256 = "18j0saqblg3jhrz38splk173xjwdf32c67ymm18m8n5y94h8d2ba";
   };
 
-  nativenativeBuildInputs = [ pkg-config ];
   buildInputs = [ postgresql ];
 
   installPhase = ''
diff --git a/pkgs/servers/sql/postgresql/ext/wal2json.nix b/pkgs/servers/sql/postgresql/ext/wal2json.nix
index d00e3a175328..f9e01a7bd517 100644
--- a/pkgs/servers/sql/postgresql/ext/wal2json.nix
+++ b/pkgs/servers/sql/postgresql/ext/wal2json.nix
@@ -1,14 +1,14 @@
-{ lib, stdenv, fetchFromGitHub, bison, flex, postgresql }:
+{ lib, stdenv, fetchFromGitHub, postgresql }:
 
 stdenv.mkDerivation rec {
   pname = "wal2json";
-  version = "2.4";
+  version = "2.5";
 
   src = fetchFromGitHub {
     owner = "eulerto";
     repo = "wal2json";
     rev = "wal2json_${builtins.replaceStrings ["."] ["_"] version}";
-    sha256 = "sha256-EB+tCaILWsU9fDhqosl6EyMoYBd6SHISFfyxiZ9pNOk=";
+    sha256 = "sha256-Gpc9uDKrs/dmVSFgdgHM453+TaEnhRh9t0gDbSn8FUI=";
   };
 
   buildInputs = [ postgresql ];
diff --git a/pkgs/shells/nushell/default.nix b/pkgs/shells/nushell/default.nix
index 676e1be3ec30..5c988c59f904 100644
--- a/pkgs/shells/nushell/default.nix
+++ b/pkgs/shells/nushell/default.nix
@@ -24,16 +24,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "nushell";
-  version = "0.68.1";
+  version = "0.69.1";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "sha256-PE6UewAE7z0Ie5aFocDK3Qu0Y4ppuPtpD6tDnYfM11Y=";
+    sha256 = "sha256-aEEuzl3HRWNk2zJq+Vh5ZLyT26Qk7oI3bQKUr4SlDr8=";
   };
 
-  cargoSha256 = "sha256-7guFkR/paL8jk5YwiRNMbWCyA6DqOaLGTmbWHAWDxRw=";
+  cargoSha256 = "sha256-qaBiTZUe4RSYdXAEWPVv0ATWDN/+aOYiEpq+oztwNEc=";
 
   # enable pkg-config feature of zstd
   cargoPatches = [ ./zstd-pkg-config.patch ];
@@ -66,7 +66,9 @@ rustPlatform.buildRustPackage rec {
   # TODO investigate why tests are broken on darwin
   # failures show that tests try to write to paths
   # outside of TMPDIR
-  doCheck = ! stdenv.isDarwin;
+  # doCheck = ! stdenv.isDarwin;
+  # TODO tests are not guaranteed while package is in beta
+  doCheck = false;
 
   checkPhase = ''
     runHook preCheck
diff --git a/pkgs/tools/filesystems/genimage/default.nix b/pkgs/tools/filesystems/genimage/default.nix
index b3f7a26086ee..0961ad904f3f 100644
--- a/pkgs/tools/filesystems/genimage/default.nix
+++ b/pkgs/tools/filesystems/genimage/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, pkg-config, libconfuse, gettext }:
+{ lib, stdenv, fetchurl, autoreconfHook, pkg-config, libconfuse, gettext }:
 
 stdenv.mkDerivation rec {
   pname = "genimage";
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-hp+WYtO3eMabHR/nDfZY4cnpCu2iart1P2/lXosMbnM=";
   };
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ autoreconfHook pkg-config ];
   buildInputs = [ libconfuse gettext ];
 
   postInstall = ''
diff --git a/pkgs/tools/misc/arp-scan/default.nix b/pkgs/tools/misc/arp-scan/default.nix
index 720b0a875a80..1e0ad4079d6c 100644
--- a/pkgs/tools/misc/arp-scan/default.nix
+++ b/pkgs/tools/misc/arp-scan/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "arp-scan";
-  version = "1.9.7";
+  version = "1.9.8";
 
   src = fetchFromGitHub {
     owner = "royhills";
     repo = "arp-scan";
     rev = version;
-    sha256 = "1mf7a4f9vzvnkiavc87aqyciswggsb4fpy7j05jxnvjyyxv3l7gp";
+    sha256 = "sha256-zSihemqGaQ5z6XjA/dALoSJOuAkxF5/nnV6xE+GY7KI=";
   };
 
   perlModules = with perlPackages; [
diff --git a/pkgs/tools/misc/chezmoi/default.nix b/pkgs/tools/misc/chezmoi/default.nix
index 3fa25c6d86c9..1eca3b71db0a 100644
--- a/pkgs/tools/misc/chezmoi/default.nix
+++ b/pkgs/tools/misc/chezmoi/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "chezmoi";
-  version = "2.24.0";
+  version = "2.25.0";
 
   src = fetchFromGitHub {
     owner = "twpayne";
     repo = "chezmoi";
     rev = "v${version}";
-    sha256 = "sha256-HXQdUxc622Pq9NoXa0MPk1yjmDvyYe67RxM6AJ8roN0=";
+    sha256 = "sha256-a7Qf0mKo1aWABftgIDgh94mJf49d7KAtBkemRNRash0=";
   };
 
-  vendorSha256 = "sha256-A9l4YbZWdmhoAz6PqFufWGxSnY3TbZfVqXnu+ZWLnQA=";
+  vendorSha256 = "sha256-jqK115vnEYlER3sAFVFlMFGjpMnAIMlFM+4oN8Ujad4=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/misc/csv2latex/default.nix b/pkgs/tools/misc/csv2latex/default.nix
index 035d2cb9702d..e297bc532dc1 100644
--- a/pkgs/tools/misc/csv2latex/default.nix
+++ b/pkgs/tools/misc/csv2latex/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "csv2latex";
-  version = "0.22";
+  version = "0.23.1";
 
   src = fetchurl {
     url = "http://brouits.free.fr/csv2latex/csv2latex-${version}.tar.gz";
-    sha256 = "09qih2zx6cvlii1n5phiinvm9xw1l8f4i60b5hg56pymzjhn97vy";
+    sha256 = "sha256-k1vQyrVJmfaJ7jVaoW2dkPD7GO8EoDqJY5m8O2U/kYw=";
   };
 
   installPhase = ''
diff --git a/pkgs/tools/misc/lazydocker/default.nix b/pkgs/tools/misc/lazydocker/default.nix
index 985cc4721381..b66a59c960f6 100644
--- a/pkgs/tools/misc/lazydocker/default.nix
+++ b/pkgs/tools/misc/lazydocker/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "lazydocker";
-  version = "0.18.1";
+  version = "0.19.0";
 
   src = fetchFromGitHub {
     owner = "jesseduffield";
     repo = "lazydocker";
     rev = "v${version}";
-    sha256 = "sha256-qtGPsfZVu5ZuCusO5nYgxR/qHiwyhzMmBMLMDpKzKDA=";
+    sha256 = "sha256-Ns758mqz4O8hKpu3LHFFm1U1vxF1TJZ4GKstWADXOl0=";
   };
 
   vendorSha256 = null;
diff --git a/pkgs/tools/misc/noti/default.nix b/pkgs/tools/misc/noti/default.nix
index ac3ff7a59b70..bebe77faaa7d 100644
--- a/pkgs/tools/misc/noti/default.nix
+++ b/pkgs/tools/misc/noti/default.nix
@@ -2,31 +2,21 @@
 , lib
 , buildGoModule
 , fetchFromGitHub
-, fetchurl
 , Cocoa
 , installShellFiles
 }:
 
 buildGoModule rec {
   pname = "noti";
-  version = "3.5.0";
+  version = "3.6.0";
 
   src = fetchFromGitHub {
     owner = "variadico";
     repo = "noti";
     rev = version;
-    sha256 = "12r9wawwl6x0rfv1kahwkamfa0pjq24z60az9pn9nsi2z1rrlwkd";
+    sha256 = "sha256-FhVpw6PJcm0aYQBlN7AUjOkJgCzleOHXIXumSegtxfA=";
   };
 
-  patches = [
-    # update golang.org/x/sys to fix building on aarch64-darwin
-    # using fetchurl because fetchpatch breaks the patch
-    (fetchurl {
-      url = "https://github.com/variadico/noti/commit/a90bccfdb2e6a0adc2e92f9a4e7be64133832ba9.patch";
-      sha256 = "sha256-vSAwuAR9absMSFqGOlzmRZoOGC/jpkmh8CMCVjeleUo=";
-    })
-  ];
-
   vendorSha256 = null;
 
   nativeBuildInputs = [ installShellFiles ];
@@ -39,8 +29,12 @@ buildGoModule rec {
     "-X github.com/variadico/noti/internal/command.Version=${version}"
   ];
 
+  preCheck = ''
+    export PATH=$out/bin:$PATH
+  '';
+
   postInstall = ''
-    installManPage docs/man/*
+    installManPage docs/man/dist/*
   '';
 
   meta = with lib; {
@@ -48,7 +42,8 @@ buildGoModule rec {
     longDescription = ''
       Monitor a process and trigger a notification.
 
-      Never sit and wait for some long-running process to finish. Noti can alert you when it's done. You can receive messages on your computer or phone.
+      Never sit and wait for some long-running process to finish. Noti can alert
+      you when it's done. You can receive messages on your computer or phone.
     '';
     homepage = "https://github.com/variadico/noti";
     license = licenses.mit;
diff --git a/pkgs/tools/text/diffstat/default.nix b/pkgs/tools/text/diffstat/default.nix
index 3e156cf3132d..15baee3c39d1 100644
--- a/pkgs/tools/text/diffstat/default.nix
+++ b/pkgs/tools/text/diffstat/default.nix
@@ -2,14 +2,14 @@
 
 stdenv.mkDerivation rec {
   pname = "diffstat";
-  version = "1.64";
+  version = "1.65";
 
   src = fetchurl {
     urls = [
       "ftp://ftp.invisible-island.net/diffstat/diffstat-${version}.tgz"
       "https://invisible-mirror.net/archives/diffstat/diffstat-${version}.tgz"
     ];
-    sha256 = "sha256-uK7jjZ0uHQWSbmtVgQqdLC3UB/JNaiZzh1Y6RDbj9/w=";
+    sha256 = "sha256-jPJ0JJJt682FkhdVw5FVWSiCRL0QP2LXQNxrg7VXooo=";
   };
 
   meta = with lib; {
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index a9d0b06362a7..def3efbf0ac0 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1582,7 +1582,15 @@ with pkgs;
 
   melonDS = libsForQt5.callPackage ../applications/emulators/melonDS { };
 
-  mgba = libsForQt5.callPackage ../applications/emulators/mgba { };
+  mgba = callPackage ../applications/emulators/mgba {
+    ffmpeg = ffmpeg_4;
+    lua = lua5_4;
+    inherit (libsForQt5)
+      qtbase
+      qtmultimedia
+      qttools
+      wrapQtAppsHook;
+  };
 
   mupen64plus = callPackage ../applications/emulators/mupen64plus { };
 
@@ -23964,12 +23972,14 @@ with pkgs;
     postgresql_12
     postgresql_13
     postgresql_14
+    postgresql_15
   ;
   postgresql = postgresql_14.override { this = postgresql; };
   postgresqlPackages = recurseIntoAttrs postgresql.pkgs;
   postgresql11Packages = recurseIntoAttrs postgresql_11.pkgs;
   postgresql12Packages = recurseIntoAttrs postgresql_12.pkgs;
   postgresql13Packages = recurseIntoAttrs postgresql_13.pkgs;
+  postgresql15Packages = recurseIntoAttrs postgresql_15.pkgs;
   postgresql14Packages = postgresqlPackages;
 
   postgresql_jdbc = callPackage ../development/java-modules/postgresql_jdbc { };
@@ -27353,6 +27363,8 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) Carbon;
   };
 
+  cyan = callPackage ../applications/graphics/cyan {};
+
   cyanrip = callPackage ../applications/audio/cyanrip { };
 
   centerim = callPackage ../applications/networking/instant-messengers/centerim { };
@@ -27936,6 +27948,8 @@ with pkgs;
 
   icesl = callPackage ../applications/misc/icesl { };
 
+  karlender = callPackage ../applications/office/karlender { };
+
   keepassx = callPackage ../applications/misc/keepassx { };
   keepassx2 = callPackage ../applications/misc/keepassx/2.0.nix { };
   keepassxc = libsForQt5.callPackage ../applications/misc/keepassx/community.nix { };
@@ -36871,7 +36885,9 @@ with pkgs;
 
   soundmodem = callPackage ../applications/radio/soundmodem {};
 
-  soundOfSorting = callPackage ../misc/sound-of-sorting { };
+  soundOfSorting = callPackage ../misc/sound-of-sorting {
+    inherit (darwin.apple_sdk.frameworks) Cocoa;
+  };
 
   sourceAndTags = callPackage ../misc/source-and-tags {
     hasktags = haskellPackages.hasktags;