diff --git a/README.md b/README.md
index 4c6ad635164b..d840e2a8c503 100644
--- a/README.md
+++ b/README.md
@@ -51,9 +51,9 @@ Nixpkgs and NixOS are built and tested by our continuous integration
 system, [Hydra](https://hydra.nixos.org/).
 
 * [Continuous package builds for unstable/master](https://hydra.nixos.org/jobset/nixos/trunk-combined)
-* [Continuous package builds for the NixOS 22.11 release](https://hydra.nixos.org/jobset/nixos/release-22.11)
+* [Continuous package builds for the NixOS 23.05 release](https://hydra.nixos.org/jobset/nixos/release-23.05)
 * [Tests for unstable/master](https://hydra.nixos.org/job/nixos/trunk-combined/tested#tabs-constituents)
-* [Tests for the NixOS 22.11 release](https://hydra.nixos.org/job/nixos/release-22.11/tested#tabs-constituents)
+* [Tests for the NixOS 23.05 release](https://hydra.nixos.org/job/nixos/release-23.05/tested#tabs-constituents)
 
 Artifacts successfully built with Hydra are published to cache at
 https://cache.nixos.org/. When successful build and test criteria are
diff --git a/nixos/doc/manual/installation/upgrading.chapter.md b/nixos/doc/manual/installation/upgrading.chapter.md
index 26b6b8cc23ef..d39e1b786d83 100644
--- a/nixos/doc/manual/installation/upgrading.chapter.md
+++ b/nixos/doc/manual/installation/upgrading.chapter.md
@@ -6,7 +6,7 @@ expressions and associated binaries. The NixOS channels are updated
 automatically from NixOS's Git repository after certain tests have
 passed and all packages have been built. These channels are:
 
--   *Stable channels*, such as [`nixos-22.11`](https://nixos.org/channels/nixos-22.11).
+-   *Stable channels*, such as [`nixos-23.05`](https://channels.nixos.org/nixos-23.05).
     These only get conservative bug fixes and package upgrades. For
     instance, a channel update may cause the Linux kernel on your system
     to be upgraded from 4.19.34 to 4.19.38 (a minor bug fix), but not
@@ -14,13 +14,13 @@ passed and all packages have been built. These channels are:
     Stable channels are generally maintained until the next stable
     branch is created.
 
--   The *unstable channel*, [`nixos-unstable`](https://nixos.org/channels/nixos-unstable).
+-   The *unstable channel*, [`nixos-unstable`](https://channels.nixos.org/nixos-unstable).
     This corresponds to NixOS's main development branch, and may thus see
     radical changes between channel updates. It's not recommended for
     production systems.
 
--   *Small channels*, such as [`nixos-22.11-small`](https://nixos.org/channels/nixos-22.11-small)
-    or [`nixos-unstable-small`](https://nixos.org/channels/nixos-unstable-small).
+-   *Small channels*, such as [`nixos-23.05-small`](https://channels.nixos.org/nixos-23.05-small)
+    or [`nixos-unstable-small`](https://channels.nixos.org/nixos-unstable-small).
     These are identical to the stable and unstable channels described above,
     except that they contain fewer binary packages. This means they get updated
     faster than the regular channels (for instance, when a critical security patch
@@ -28,7 +28,7 @@ passed and all packages have been built. These channels are:
     built from source than usual. They're mostly intended for server environments
     and as such contain few GUI applications.
 
-To see what channels are available, go to <https://nixos.org/channels>.
+To see what channels are available, go to <https://channels.nixos.org>.
 (Note that the URIs of the various channels redirect to a directory that
 contains the channel's latest version and includes ISO images and
 VirtualBox appliances.) Please note that during the release process,
@@ -38,38 +38,38 @@ newest supported stable release.
 
 When you first install NixOS, you're automatically subscribed to the
 NixOS channel that corresponds to your installation source. For
-instance, if you installed from a 22.11 ISO, you will be subscribed to
-the `nixos-22.11` channel. To see which NixOS channel you're subscribed
+instance, if you installed from a 23.05 ISO, you will be subscribed to
+the `nixos-23.05` channel. To see which NixOS channel you're subscribed
 to, run the following as root:
 
 ```ShellSession
 # nix-channel --list | grep nixos
-nixos https://nixos.org/channels/nixos-unstable
+nixos https://channels.nixos.org/nixos-unstable
 ```
 
 To switch to a different NixOS channel, do
 
 ```ShellSession
-# nix-channel --add https://nixos.org/channels/channel-name nixos
+# nix-channel --add https://channels.nixos.org/channel-name nixos
 ```
 
 (Be sure to include the `nixos` parameter at the end.) For instance, to
-use the NixOS 22.11 stable channel:
+use the NixOS 23.05 stable channel:
 
 ```ShellSession
-# nix-channel --add https://nixos.org/channels/nixos-22.11 nixos
+# nix-channel --add https://channels.nixos.org/nixos-23.05 nixos
 ```
 
 If you have a server, you may want to use the "small" channel instead:
 
 ```ShellSession
-# nix-channel --add https://nixos.org/channels/nixos-22.11-small nixos
+# nix-channel --add https://channels.nixos.org/nixos-23.05-small nixos
 ```
 
 And if you want to live on the bleeding edge:
 
 ```ShellSession
-# nix-channel --add https://nixos.org/channels/nixos-unstable nixos
+# nix-channel --add https://channels.nixos.org/nixos-unstable nixos
 ```
 
 You can then upgrade NixOS to the latest version in your chosen channel
@@ -114,5 +114,5 @@ the new generation contains a different kernel, initrd or kernel
 modules. You can also specify a channel explicitly, e.g.
 
 ```nix
-system.autoUpgrade.channel = https://nixos.org/channels/nixos-22.11;
+system.autoUpgrade.channel = "https://channels.nixos.org/nixos-23.05";
 ```
diff --git a/nixos/doc/manual/release-notes/rl-2305.section.md b/nixos/doc/manual/release-notes/rl-2305.section.md
index 46c2c4a77d52..4b34269712f4 100644
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@@ -12,34 +12,35 @@ To upgrade to the latest release, follow the [upgrade chapter](https://nixos.org
 
 In addition to numerous new and updated packages, this release has the following highlights:
 
-- The default Linux kernel has been updated from 5.15 to 6.1, all kernels version supported on <kernel.org> are also available.
+- The default [Nix](https://github.com/NixOS/nix) version was updated from 2.11 to 2.13. In particular, this includes a [small language alteration](https://github.com/NixOS/nix/issues/8259) in the way floats are represented in `builtins.toJSON`. See the release notes for [2.13](https://nixos.org/manual/nix/stable/release-notes/rl-2.13.html) and [2.14](https://nixos.org/manual/nix/unstable/release-notes/rl-2.14.html) for more information.
 
-- systemd has been updated from v252 to v253, see [release notes](https://github.com/systemd/systemd/blob/main/NEWS#L21-L677) for more info.
-    - Updating with `nixos-rebuild boot` and `reboot` is recommended, since in some rare cases the `switch` into the new generation on a live system might fail due to missing mount units.
+- The default [Linux Kernel](https://kernel.org/) was updated from version 5.15 to 6.1, see [Kernelnewbies](https://kernelnewbies.org/Linux_6.1) for what has changed. All currently shown Kernels shown on [kernel.org](https://kernel.org/) are available.
 
-- The glibc has been updated from 2.35 to 2.37
+- [systemd](https://systemd.io) has been updated from v252 to v253, see [the release notes](https://github.com/systemd/systemd/blob/main/NEWS#L21-L677) for more information on the changes.
+    - Updating with `nixos-rebuild boot` and rebooting is recommended, since in some rare cases the `nixos-rebuild switch` into the new generation on a live system might fail due to missing mount units.
 
-- GNOME has been updated to version 44. Please see the [release notes](https://release.gnome.org/44/) for details.
+- [glibc](https://www.gnu.org/software/libc/) has been updated from version 2.35 to 2.37, see [the release notes](https://sourceware.org/glibc/wiki/Release/2.37) for what was changed.
 
-- KDE Plasma has been updated to v5.27, see [the release notes](https://kde.org/announcements/plasma/5/5.27.0/) for what is changed.
+- [libxcrypt](https://github.com/besser82/libxcrypt), the library providing the `crypt(3)` password hashing function, is now built without support for algorithms not flagged [`strong`](https://github.com/besser82/libxcrypt/blob/v4.4.33/lib/hashes.conf#L48). This affects the availability of password hashing algorithms used for system login (`login(1)`, `passwd(1)`), but also Apache2 Basic-Auth, Samba, OpenLDAP, Dovecot, and [many other packages](https://sourcegraph.com/search?q=context:global+repo:%5Egithub%5C.com/NixOS/nixpkgs%24+libxcrypt&patternType=standard&sm=1&groupBy=path).
 
-- Cinnamon has been updated to 5.6, see [the pull request](https://github.com/NixOS/nixpkgs/pull/201328#issue-1449910204) for what is changed.
-
-- `libxcrypt`, the library providing the `crypt(3)` password hashing function, is now built without support for algorithms not flagged [`strong`](https://github.com/besser82/libxcrypt/blob/v4.4.33/lib/hashes.conf#L48). This affects the availability of password hashing algorithms used for system login (`login(1)`, `passwd(1)`), but also Apache2 Basic-Auth, Samba, OpenLDAP, Dovecot, and [many other packages](https://sourcegraph.com/search?q=context:global+repo:%5Egithub%5C.com/NixOS/nixpkgs%24+libxcrypt&patternType=standard&sm=1&groupBy=path).
-
-- NixOS now defaults to using [nsncd](https://github.com/twosigma/nsncd), a non-caching reimplementation of nscd in Rust, as its NSS lookup dispatcher. This replaces the buggy and deprecated nscd implementation provided through glibc. When you find problems, you can switch back by setting
+- NixOS now defaults to using [nsncd](https://github.com/twosigma/nsncd), a non-caching reimplementation of nscd in Rust, as its NSS lookup dispatcher. This replaces the buggy and deprecated nscd implementation provided through glibc. When you find problems, you can switch back by disabling it:
   ```nix
   services.nscd.enableNsncd = false;
   ```
-  but please open an issue in nixpkgs, so your problem can be addressed.
 
-- Python implements [PEP 668](https://peps.python.org/pep-0668/), providing better feedback to users that try to run `pip install` for system-wide or user home installations.
+- The internal option `boot.bootspec.enable` is now enabled by default because [RFC 0125](https://github.com/NixOS/rfcs/pull/125) was merged. This means you will have a bootspec document called `boot.json` generated for each system and specialisation in the top-level. This is useful to enable advanced boot use cases in NixOS, such as Secure Boot.
 
-- There have been two changes to `nixos-rebuild`:
+- Two changes to `nixos-rebuild` are important to highlight as well.
     - Support for an extra `--specialisation` option was added that can be used to change specialisation for `switch` and `test` commands.
-    - The `--target-host` and `--build-host` options no longer treat the `localhost` value specially – to build on/deploy to a local machine, omit the relevant flag.
+    - The `--target-host` and `--build-host` options no longer treat the `localhost` value specially – to build on resp. deploy to a local machine, omit the relevant flag.
 
-- `boot.bootspec.enable` (internal option) is now enabled by default because [RFC 0125](https://github.com/NixOS/rfcs/pull/125) was merged. This means you will have a bootspec document called `boot.json` generated for each system and specialisation in the top-level. This is useful to enable advanced boot use cases in NixOS, such as Secure Boot.
+- [Python](https://www.python.org) implements [PEP 668](https://peps.python.org/pep-0668/), providing better feedback to users that try to run `pip install` for system-wide or user home installations.
+
+- [Cinnamon](https://github.com/linuxmint/Cinnamon) has been updated to version 5.6, see [the pull request](https://github.com/NixOS/nixpkgs/pull/201328#issue-1449910204) for what was changed.
+
+- [GNOME](https://www.gnome.org) has been updated to version 44, see the [the release notes](https://release.gnome.org/44/) for details.
+
+- [KDE Plasma](https://kde.org/de/plasma-desktop/) has been updated to version 5.27, see [the release notes](https://kde.org/announcements/plasma/5/5.27.0/) for what was changed.
 
 ## New Services {#sec-release-23.05-new-services}
 
@@ -167,7 +168,7 @@ In addition to numerous new and updated packages, this release has the following
 
 - [woodpecker](https://woodpecker-ci.org/), a simple CI engine with great extensibility. Available as [services.woodpecker-server](#opt-services.woodpecker-server.enable) and [services.woodpecker-agents](#opt-services.woodpecker-agents.agents._name_.enable).
 
-- [wstunnel](https://github.com/erebe/wstunnel), a proxy tunnelling arbitrary TCP or UDP traffic through a WebSocket connection. Instances may be configured via [services.wstunnel](options.html#opt-services.wstunnel.enable).
+- [wstunnel](https://github.com/erebe/wstunnel), a proxy tunnelling arbitrary TCP or UDP traffic through a WebSocket connection. Available as [services.wstunnel](options.html#opt-services.wstunnel.enable).
 
 ## Backward Incompatibilities {#sec-release-23.05-incompatibilities}
 
@@ -306,12 +307,10 @@ In addition to numerous new and updated packages, this release has the following
   - Please note that an upgrade from v24 (or older) to v26 directly is not possible. Please upgrade to `nextcloud25` (or earlier) first. Nextcloud prohibits skipping major versions while upgrading. You can upgrade by declaring [`services.nextcloud.package = pkgs.nextcloud25;`](options.html#opt-services.nextcloud.package).
   - It's recommended to use the latest version available (i.e. v26) and to specify that using `services.nextcloud.package`.
 
-- .NET 5.0 and .NET 3.1 were removed due to being end-of-life, use a newer, supported .NET version - https://dotnet.microsoft.com/en-us/platform/support/policy/dotnet-core
+- .NET 5.0 and .NET 3.1 were removed due to being end-of-life, use a newer, supported .NET version. Visit the  [Support Policy](https://dotnet.microsoft.com/en-us/platform/support/policy/dotnet-core) for more information.
 
 - The iputils package, which is installed by default, no longer provides the
-  `ninfod`, `rarpd` and `rdisc` tools. See
-  [upstream's release notes](https://github.com/iputils/iputils/releases/tag/20221126)
-  for more details and available replacements.
+  `ninfod`, `rarpd` and `rdisc` tools. See [upstream's release notes](https://github.com/iputils/iputils/releases/tag/20221126) for more details and available replacements.
 
 - The ppp plugin `rp-pppoe.so` has been renamed to `pppoe.so` in ppp 2.4.9. Starting from ppp 2.5.0, there is no longer an alias for backwards compatibility. Configurations that use this plugin must be updated accordingly from `plugin rp-pppoe.so` to `plugin pppoe.so`. See [upstream change](https://github.com/ppp-project/ppp/commit/610a7bd76eb1f99f22317541b35001b1e24877ed).
 
@@ -323,7 +322,7 @@ In addition to numerous new and updated packages, this release has the following
 
 - In `services.fail2ban`, `bantime-increment.<name>` options now default to `null` (except `bantime-increment.enable`) and are used to set the corresponding option in `jail.local` only if not `null`. Also, enforce that `bantime-increment.formula` and `bantime-increment.multipliers` are not both specified.
 
-- The default Asterisk package was changed to v20 from v19. Asterisk versions 16 and 19 have been dropped due to being EOL. You may need to update /var/lib/asterisk to match the template files in `${asterisk-20}/var/lib/asterisk`.
+- The default `asterisk` package was changed to v20 from v19. Asterisk versions 16 and 19 have been dropped due to being EOL. You may need to update /var/lib/asterisk to match the template files in `${asterisk-20}/var/lib/asterisk`.
 
 - conntrack helper autodetection has been removed from kernels 6.0 and up upstream, and an assertion was added to ensure things don't silently stop working. Migrate your configuration to assign helpers explicitly or use an older LTS kernel branch as a temporary workaround.
 
@@ -341,7 +340,7 @@ In addition to numerous new and updated packages, this release has the following
 
 - The `qlandkartegt` and `garmindev` packages were removed due to being unmaintained and insecure.
 
-- `go-ethereum` package has been updated to v1.11.5 and the `puppeth` command is no longer available as of v1.11.0.
+- The `go-ethereum` package has been updated to v1.11.5 and the `puppeth` command is no longer available as of v1.11.0.
 
 - The `pnpm` package has be updated to from version 7.29.1 to version 8.1.1 and Node.js 14 support has been discontinued (though, there are workarounds if Node.js 14 is still required)
   - Migration instructions: ["Before updating pnpm to v8 in your CI, regenerate your pnpm-lock.yaml. To upgrade your lockfile, run pnpm install and commit the changes. Existing dependencies will not be updated; however, due to configuration changes in pnpm v8, some missing peer dependencies may be added to the lockfile and some packages may get deduplicated. You can commit the new lockfile even before upgrading Node.js in the CI, as pnpm v7 already supports the new lockfile format."](https://github.com/pnpm/pnpm/releases/tag/v8.0.0)
@@ -350,13 +349,19 @@ In addition to numerous new and updated packages, this release has the following
 
 - The `pict-rs` package was updated from an 0.3 alpha release to 0.3 stable, and related environment variables now require two underscores instead of one.
 
+- The `shattered-pixel-dungeon` game was updated from 1.1.2 to 2.0.2.
+  - The location of game data has changed. To migrate it, run `mv ~/.shatteredpixel ~/.local/share/.shatteredpixel`
+  - The update will delete all your in-progress games.
+
 - `espanso` has been updated to major version 2. Therefore, migration steps may need to be performed. See [the official migration instructions](https://espanso.org/docs/migration/overview/) for how to perform these migrations. Further, `espanso-wayland` can now be used for Wayland support.
 
+- Only `k3s` version 1.26 is included. Users of the `k3s_1_24` or `k3s_1_25` packages should upgrade to use the `1.26` version of the package.
+
 ## Other Notable Changes {#sec-release-23.05-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
-- A few openssh options have been moved from extraConfig to the new freeform option `settings` and renamed as follows:
+- To follow [RFC 0042](https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md) a few options of `openssh` have been moved from `extraConfig` to the new freeform option `settings` and renamed, e.g.:
   - `services.openssh.forwardX11` to `services.openssh.settings.X11Forwarding`
   - `services.openssh.kbdInteractiveAuthentication` -> `services.openssh.settings.KbdInteractiveAuthentication`
   - `services.openssh.passwordAuthentication` to `services.openssh.settings.PasswordAuthentication`
@@ -464,10 +469,7 @@ In addition to numerous new and updated packages, this release has the following
 
 - The module `services.headscale` was refactored to be compliant with [RFC 0042](https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md). To be precise, this means that the following things have changed:
 
-  - Most settings have been migrated below [services.headscale.settings](#opt-services.headscale.settings) which is a freeform attribute-set that
-    will be converted into headscale's YAML config format. This means that the configuration from
-    [headscale's example configuration](https://github.com/juanfont/headscale/blob/main/config-example.yaml)
-    can be directly written as attribute-set in Nix within this option.
+  - Most settings have been migrated below [services.headscale.settings](#opt-services.headscale.settings) which is a freeform attribute-set that will be converted into headscale's YAML config format. This means that the configuration from [headscale's example configuration](https://github.com/juanfont/headscale/blob/main/config-example.yaml) can be directly written as attribute-set in Nix within this option.
 
 - `services.kubo` now unmounts `ipfsMountDir` and `ipnsMountDir` even if it is killed unexpectedly when `autoMount` is enabled.
 
@@ -543,6 +545,8 @@ In addition to numerous new and updated packages, this release has the following
 
 - Booting from a volume managed by the Stratis storage management daemon is now supported. Use `fileSystems.<name>.stratis.poolUuid` to configure the pool containing the fs.
 
+- Only `k3s` version 1.26 is included. Users of the `k3s_1_24` or `k3s_1_25` packages should upgrade to use the version 1.26 of the package.
+
 ## Nixpkgs internals {#sec-release-23.05-nixpkgs-internals}
 
 - `buildDunePackage` now defaults to `strictDeps = true` which means that any library should go into `buildInputs` or `checkInputs`. Any executable that is run on the building machine should go into `nativeBuildInputs` or `nativeCheckInputs` respectively. Example of executables are `ocaml`, `findlib` and `menhir`. PPXs are libraries which are built by dune and should therefore not go into `nativeBuildInputs`.
diff --git a/nixos/modules/services/networking/ssh/sshd.nix b/nixos/modules/services/networking/ssh/sshd.nix
index a0904f59a72e..70dde79a198d 100644
--- a/nixos/modules/services/networking/ssh/sshd.nix
+++ b/nixos/modules/services/networking/ssh/sshd.nix
@@ -570,14 +570,26 @@ in
 
     assertions = [{ assertion = if cfg.settings.X11Forwarding then cfgc.setXAuthLocation else true;
                     message = "cannot enable X11 forwarding without setting xauth location";}
-                  { assertion = lib.lists.unique (map (x: lib.strings.toLower x) (attrNames cfg.settings))
-                      == (map (x: lib.strings.toLower x) (attrNames cfg.settings));
-                    message = "Duplicate sshd config key; does your capitalization match the option's?"; } ]
+                  (let
+                    duplicates =
+                      # Filter out the groups with more than 1 element
+                      lib.filter (l: lib.length l > 1) (
+                        # Grab the groups, we don't care about the group identifiers
+                        lib.attrValues (
+                          # Group the settings that are the same in lower case
+                          lib.groupBy lib.strings.toLower (attrNames cfg.settings)
+                        )
+                      );
+                    formattedDuplicates = lib.concatMapStringsSep ", " (dupl: "(${lib.concatStringsSep ", " dupl})") duplicates;
+                  in
+                  {
+                    assertion = lib.length duplicates == 0;
+                    message = ''Duplicate sshd config key; does your capitalization match the option's? Duplicate keys: ${formattedDuplicates}'';
+                  })]
       ++ forEach cfg.listenAddresses ({ addr, ... }: {
         assertion = addr != null;
         message = "addr must be specified in each listenAddresses entry";
       });
-
   };
 
 }
diff --git a/pkgs/applications/blockchains/besu/default.nix b/pkgs/applications/blockchains/besu/default.nix
index 183dbc9f3388..03ca6717f6ff 100644
--- a/pkgs/applications/blockchains/besu/default.nix
+++ b/pkgs/applications/blockchains/besu/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "besu";
-  version = "23.1.2";
+  version = "23.4.0";
 
   src = fetchurl {
     url = "https://hyperledger.jfrog.io/artifactory/${pname}-binaries/${pname}/${version}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-PTpwmjqrmToIAbQSpHGddOMZ+ULdwT+w8ws8SlTRJTg=";
+    sha256 = "sha256-ghaVsyVcn2RvTVJ+N0IZyWQW9JgjFSDy7sK+vtxT9aA=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/applications/editors/android-studio/default.nix b/pkgs/applications/editors/android-studio/default.nix
index c7369d56178d..38f2f63852b9 100644
--- a/pkgs/applications/editors/android-studio/default.nix
+++ b/pkgs/applications/editors/android-studio/default.nix
@@ -10,8 +10,8 @@ let
     inherit tiling_wm;
   };
   stableVersion = {
-    version = "2022.2.1.19"; # "Android Studio Flamingo (2022.2.1) Patch 1"
-    sha256Hash = "sha256-bAtPlJI3RwqQX6xpEi7S8T2IDc/39MONU3iFpfi8v3A=";
+    version = "2022.2.1.20"; # "Android Studio Flamingo (2022.2.1) Patch 2"
+    sha256Hash = "sha256-X+ZuH4cHKfQtfvOF0kLk+QjQ5AR3pTEparczHEUk+uY=";
   };
   betaVersion = {
     version = "2022.3.1.12"; # "Android Studio Giraffe (2022.3.1) Beta 1"
diff --git a/pkgs/applications/editors/emacs/generic.nix b/pkgs/applications/editors/emacs/generic.nix
index b42d5e8a1ae6..ddfdbe337186 100644
--- a/pkgs/applications/editors/emacs/generic.nix
+++ b/pkgs/applications/editors/emacs/generic.nix
@@ -89,11 +89,11 @@
 , withMotif ? false
 , withNS ? stdenv.isDarwin && !(variant == "macport" || noGui)
 , withPgtk ? false
-, withSQLite3 ? false
+, withSQLite3 ? lib.versionAtLeast version "29"
 , withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd
 , withToolkitScrollBars ? true
 , withTreeSitter ? lib.versionAtLeast version "29"
-, withWebP ? false
+, withWebP ? lib.versionAtLeast version "29"
 , withX ? !(stdenv.isDarwin || noGui || withPgtk)
 , withXinput2 ? withX && lib.versionAtLeast version "29"
 , withXwidgets ? false
diff --git a/pkgs/applications/editors/vscode/extensions/vscodeEnv.nix b/pkgs/applications/editors/vscode/extensions/vscodeEnv.nix
index 818cca51772a..c412e0110ad8 100644
--- a/pkgs/applications/editors/vscode/extensions/vscodeEnv.nix
+++ b/pkgs/applications/editors/vscode/extensions/vscodeEnv.nix
@@ -19,7 +19,7 @@
 , keybindings                      ? {}
 , createKeybindingsIfDoesNotExists ? true
 , user-data-dir ? ''"''${TMP}''${name}"/vscode-data-dir''
-# if file exists will use it and import the extensions in it into this dervation else will use empty extensions list
+# if file exists will use it and import the extensions in it into this derivation else will use empty extensions list
 # this file will be created/updated by vscodeExts2nix when vscode exists
 , mutableExtensionsFile
 }:
diff --git a/pkgs/applications/misc/otpclient/default.nix b/pkgs/applications/misc/otpclient/default.nix
index 6f7047de8c65..4821efa9223b 100644
--- a/pkgs/applications/misc/otpclient/default.nix
+++ b/pkgs/applications/misc/otpclient/default.nix
@@ -20,21 +20,40 @@
 
 stdenv.mkDerivation rec {
   pname = "otpclient";
-  version = "3.1.6";
+  version = "3.1.7";
 
   src = fetchFromGitHub {
     owner = "paolostivanin";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-v7TvdS0IlfB4oKdaEh7Z3AFJDV1bOMiX5vVD7VhIMCE=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-TklVOUkdhWDG9GqHl0Sz9fah+Xp/M8xgSuDB1q4mljM=";
   };
 
-  buildInputs = [ gtk3 jansson libgcrypt libzip libpng libcotp zbar protobuf protobufc libsecret qrencode libuuid ];
-  nativeBuildInputs = [ cmake pkg-config wrapGAppsHook ];
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    wrapGAppsHook
+  ];
+
+  buildInputs = [
+    gtk3
+    jansson
+    libcotp
+    libgcrypt
+    libpng
+    libsecret
+    libuuid
+    libzip
+    protobuf
+    protobufc
+    qrencode
+    zbar
+  ];
 
   meta = with lib; {
     description = "Highly secure and easy to use OTP client written in C/GTK that supports both TOTP and HOTP";
     homepage = "https://github.com/paolostivanin/OTPClient";
+    changelog = "https://github.com/paolostivanin/OTPClient/releases/tag/v${version}";
     license = licenses.gpl3Only;
     maintainers = with maintainers; [ alexbakker ];
     platforms = platforms.linux;
diff --git a/pkgs/applications/networking/juju/default.nix b/pkgs/applications/networking/juju/default.nix
index c412044bc951..b4f33a4e0e08 100644
--- a/pkgs/applications/networking/juju/default.nix
+++ b/pkgs/applications/networking/juju/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "juju";
-  version = "3.1.2";
+  version = "3.2.0";
 
   src = fetchFromGitHub {
     owner = "juju";
     repo = "juju";
     rev = "juju-${version}";
-    sha256 = "sha256-nleWdgIYmIltZKjjFl6axQd2fkL8UIXZRbATU96cdQ0=";
+    sha256 = "sha256-wm6yWxGFQBlNtFfL1PnUuljy6ODOboiyND4cqPjl1nM=";
   };
 
-  vendorHash = "sha256-b6C1FbVXHeJqG9Vh8dqqZ+94T42oRM9kVbDmLuOiPvA=";
+  vendorHash = "sha256-ll0qm0noD1Zox8uOlp2Rr/sFFzQlJlpss4Ot3LQn/g4=";
 
   # Disable tests because it attempts to use a mongodb instance
   doCheck = false;
diff --git a/pkgs/applications/networking/p2p/transmission/default.nix b/pkgs/applications/networking/p2p/transmission/default.nix
index 403b0bc9e87c..cc82c5038083 100644
--- a/pkgs/applications/networking/p2p/transmission/default.nix
+++ b/pkgs/applications/networking/p2p/transmission/default.nix
@@ -142,7 +142,7 @@ in stdenv.mkDerivation {
     '';
     homepage = "http://www.transmissionbt.com/";
     license = lib.licenses.gpl2Plus; # parts are under MIT
-    maintainers = with lib.maintainers; [ astsmtl vcunat ];
+    maintainers = with lib.maintainers; [ astsmtl ];
     platforms = lib.platforms.unix;
   };
 
diff --git a/pkgs/applications/science/electronics/gerbv/default.nix b/pkgs/applications/science/electronics/gerbv/default.nix
index a8eb0ac4c082..963a78bf06ff 100644
--- a/pkgs/applications/science/electronics/gerbv/default.nix
+++ b/pkgs/applications/science/electronics/gerbv/default.nix
@@ -1,31 +1,55 @@
-{ lib, stdenv, fetchFromGitHub, pkg-config, gettext, libtool, automake, autoconf, cairo, gtk2-x11, autoreconfHook }:
+{ lib
+, stdenv
+, autoconf
+, automake
+, autoreconfHook
+, cairo
+, fetchFromGitHub
+, gettext
+, gtk2-x11
+, libtool
+, pkg-config
+}:
 
 stdenv.mkDerivation rec {
   pname = "gerbv";
-  version = "2.9.6";
+  version = "2.9.7";
 
   src = fetchFromGitHub {
     owner = "gerbv";
     repo = pname;
-    rev = "v${version}";
-    hash = "sha256-HNhrnXOBlzfO/roWzTsg0RcJPb0c7RuJepankB5zNts=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-KxKNMWhWwmlIpueDOSWAWADEHFha8axywPJ6rRz0jIg=";
   };
 
   postPatch = ''
     sed -i '/AC_INIT/s/m4_esyscmd.*/${version}])/' configure.ac
   '';
 
-  nativeBuildInputs = [ autoreconfHook pkg-config automake autoconf ];
-  buildInputs = [ gettext libtool cairo gtk2-x11 ];
+  nativeBuildInputs = [
+    autoconf
+    automake
+    autoreconfHook
+    pkg-config
+  ];
 
-  configureFlags = ["--disable-update-desktop-database"];
+  buildInputs = [
+    cairo
+    gettext
+    gtk2-x11
+    libtool
+  ];
+
+  configureFlags = [
+    "--disable-update-desktop-database"
+  ];
 
   meta = with lib; {
     description = "A Gerber (RS-274X) viewer";
     homepage = "https://gerbv.github.io/";
     changelog = "https://github.com/gerbv/gerbv/releases/tag/v${version}";
+    license = licenses.gpl2Plus;
     maintainers = with maintainers; [ mog ];
     platforms = platforms.unix;
-    license = licenses.gpl2;
   };
 }
diff --git a/pkgs/applications/window-managers/cage/default.nix b/pkgs/applications/window-managers/cage/default.nix
index c1ef0a7fd268..fafad73527dc 100644
--- a/pkgs/applications/window-managers/cage/default.nix
+++ b/pkgs/applications/window-managers/cage/default.nix
@@ -29,6 +29,10 @@ stdenv.mkDerivation rec {
     systemd libGL libX11
   ];
 
+  # https://github.com/cage-kiosk/cage/issues/231
+  # cage will segfault on start with `-m last` without this
+  CFLAGS = "-O0";
+
   mesonFlags = [ "-Dxwayland=${lib.boolToString (xwayland != null)}" ];
 
   postFixup = lib.optionalString (xwayland != null) ''
diff --git a/pkgs/data/fonts/iosevka/bin.nix b/pkgs/data/fonts/iosevka/bin.nix
index 35e8bdb0e610..809aebe67adb 100644
--- a/pkgs/data/fonts/iosevka/bin.nix
+++ b/pkgs/data/fonts/iosevka/bin.nix
@@ -11,7 +11,7 @@ let
     (builtins.attrNames (builtins.removeAttrs variantHashes [ "iosevka" ]));
 in stdenv.mkDerivation rec {
   pname = "${name}-bin";
-  version = "23.0.0";
+  version = "24.1.0";
 
   src = fetchurl {
     url = "https://github.com/be5invis/Iosevka/releases/download/v${version}/ttc-${name}-${version}.zip";
diff --git a/pkgs/data/fonts/iosevka/variants.nix b/pkgs/data/fonts/iosevka/variants.nix
index 3353b103a9f3..7674feaba866 100644
--- a/pkgs/data/fonts/iosevka/variants.nix
+++ b/pkgs/data/fonts/iosevka/variants.nix
@@ -1,95 +1,95 @@
 # This file was autogenerated. DO NOT EDIT!
 {
-  iosevka = "01ps5j77h2s1s5mas5vka62c9svhc788a54l9phklyb0g4yzarlh";
-  iosevka-aile = "0q37layqr3457v62lzbx25g1hr3k8szr1ykhbxdkk1ic2q74q1v6";
-  iosevka-curly = "1sbs8c0ar4a049qdl55s5v5awf2hifzag6nzaz1r1khzrvdgc9zq";
-  iosevka-curly-slab = "0a13zc3jkskpxg7s1w74dygla5j3z11rys7wn5k80gi9kj1qvkrr";
-  iosevka-etoile = "11lka6l13p5ng4zh6rcdscaw4l3wiyw7cnkipp4j3vs1xsvn3gnv";
-  iosevka-slab = "17hnh2bvf2ikkcnschdbhg7pgi7a0ym9qsnsbjpiyzf606y9258l";
-  iosevka-ss01 = "0f77i6221s6l8bf21hjygc09r337phmalff1yvb4wmg94444l9zb";
-  iosevka-ss02 = "15lskgdb866ir760xh6mr11j8wpy19aqmf9plxxk5c593lc520dm";
-  iosevka-ss03 = "1aj1i4ym9fdpnjrzjqcbwxgkhwf38swhpn23gpnryhpwmyhwpfsq";
-  iosevka-ss04 = "1plyk72fhq54gg5ha8wwdrbwzymlblr2j10m6ckghhfvq2kq9zvm";
-  iosevka-ss05 = "1qlc5zpg6i7baf88s0jix1b2sq10kf2xrj9ja4i44p9pps2s7ym0";
-  iosevka-ss06 = "13j11qdzcqdiqxaz2b4sq52vkff61q3v4sb8bcdw7g0fsh529izd";
-  iosevka-ss07 = "17l9slmf5dm2wrslgcdc3d3jx7iwzplc8vbfpph7gmp8gvl57h2q";
-  iosevka-ss08 = "1zdcxayk5bxcfjgp4n2kc6c5w4xvdc4y4f11923b00fink74cavb";
-  iosevka-ss09 = "06byqvlrw40z3zh7lknrsjrz1dflgxca5ppa441691i9nmip6ivi";
-  iosevka-ss10 = "0fmrkfrdhcbrcrc2nrpl2cynp2l8fy9p0xmza927bghz97yvz7gv";
-  iosevka-ss11 = "033qliz9dlfg4cbgr2fv9xc1jscn52r2s198hjhlzip40q6qv4wn";
-  iosevka-ss12 = "0avv4p9nca65lm97237y09am663ry54y3lq2b7b5pcapqcy4lis0";
-  iosevka-ss13 = "0kcjb5jfzfk2r1f32s522fpz5pfmaf497miip37d5ia9cs1r7gcd";
-  iosevka-ss14 = "1j735gzbq12xlxxak0kv9bsls7wsmcy3ry1zqfhqy7ca157nnvbf";
-  iosevka-ss15 = "0kf9l05hivrjiw0dj3k4py4d351pxj4app72wz9k93m2l3sy1asj";
-  iosevka-ss16 = "0a66nmfq6nlidj3l589xgqka6vn7wbwhbhfi70wdycmvzzckda3f";
-  iosevka-ss17 = "183l3cn9rwnadc9jwha174q47f2j6622md1zm2hxlszd5p9kp55k";
-  iosevka-ss18 = "0c1nw9d0gcaa1n0ih6fda6q4kkr8g770f253mfhdfj9rpcd4vna3";
-  sgr-iosevka = "1dlglnmicm99rjmrk4amx1s6lvfj2z6w08h1zig7z83yw082fhwd";
-  sgr-iosevka-aile = "0q8hg8pfdhakxbv03c16ywlzlbvi9c3yc2k8w573d1fzd64xx5pi";
-  sgr-iosevka-curly = "12qyy41fvf15vbi42hrc9gz143fb8k2mfrsn60l6gwqcjx5vvac3";
-  sgr-iosevka-curly-slab = "1y95b4xh2zxwcahq55548bay9zk3ci52x1p4dsl52px312hb5c4g";
-  sgr-iosevka-etoile = "0vdazfxzqpb6k0zfvifrwihl9argidwkwz5xbszjzvwph9fncwss";
-  sgr-iosevka-fixed = "0mlxdjcp4a306wi2l97z3yim6wd28xmrgrbr5hh8659zmpl76idl";
-  sgr-iosevka-fixed-curly = "0plxbry5fdrmhn6hcwsy975c9288i76hmdg5g17fhqaqfv564wvb";
-  sgr-iosevka-fixed-curly-slab = "045hal14gpfkhpziabw9m1g26llrgnbxknkd8d39v2v77d9h5dlg";
-  sgr-iosevka-fixed-slab = "1whrj3rkmyprp4k6xqdy16cw3vdnjafj9cmz5xyi8ybfinj2056c";
-  sgr-iosevka-fixed-ss01 = "1cm6h0ih98dpryj1xfy9c0qwn3li2qp2a4pjkwrij8jlb9yyy5bd";
-  sgr-iosevka-fixed-ss02 = "0qx0sr8bjc79d516qz11v3cpg120yb03zpbfpyv93r2h16i1k1g6";
-  sgr-iosevka-fixed-ss03 = "0kvzgxf8j8rcbp2l1ma64kzybgkvjylb88sbwd023ani0n1f6cbw";
-  sgr-iosevka-fixed-ss04 = "1p3dcpwwjf75vlz6hjdzrwih3zchzpq6swwwwdh870y5f4wa5apy";
-  sgr-iosevka-fixed-ss05 = "1my8z8085prpsy93n6bnjfslpd23lngh1iaiba1az78cd1lz65cg";
-  sgr-iosevka-fixed-ss06 = "0fqxim4rav68ag06l76x4g0f2235svj8c178nffviz9zffdlk411";
-  sgr-iosevka-fixed-ss07 = "037xsrg6vcqz9mw8sfcmbw43lzjvfhdbavqsf29kw9xn34nq1bwd";
-  sgr-iosevka-fixed-ss08 = "06jhjisd9wphc3sgp2ai42klfbclnaya5bl3b2dkd8qzadws5w90";
-  sgr-iosevka-fixed-ss09 = "1k7wz9rgb7y3ni0yvzfsynni3z7bcwb2rbr1bshx6pj04ifwss31";
-  sgr-iosevka-fixed-ss10 = "1vx0120xyq0qdzykvffymmkfbdpa4qh6i42n41mbz5r7ga94cgsy";
-  sgr-iosevka-fixed-ss11 = "1c0b9w8n2k97f2pc1n9sz2h371256f1yhi9xb065y7cza8av7dxd";
-  sgr-iosevka-fixed-ss12 = "13yvnilwhm1g9h85m928ibpkkv2rj9ma6hbws9xxpykirx9310c1";
-  sgr-iosevka-fixed-ss13 = "06gzs2hkzisfn00rc8l0brj2j47yarlq9misarrxmv27fk0qpjk3";
-  sgr-iosevka-fixed-ss14 = "0pxhzvlyk18s63c6z8iqm5w2casbhx22g41b65chqw8sg6bvaxmf";
-  sgr-iosevka-fixed-ss15 = "1glg7gzh9kgk58mdnc1p3ynqcynv5r8mwkqgaa9bjmm8bz3fzb02";
-  sgr-iosevka-fixed-ss16 = "02pb9h18ljmyrnkv959mfnd47wzrhp017m3q60f04v11nwxrgmk2";
-  sgr-iosevka-fixed-ss17 = "01m0rw46jb5a2wik08yv5lb77c3d9z4ii16hyn3dmmn6g8zd7pij";
-  sgr-iosevka-fixed-ss18 = "1pfp0z7madsqp53mn0fqyy5gzw74vcn3xhxh0cikll2kc6f7hpfd";
-  sgr-iosevka-slab = "13g829fapi5kxl3v52fqs9h6q0qgbb4b5737r3fsfwjfhgll77jh";
-  sgr-iosevka-ss01 = "1cppwpkrzg9mk790sq0i1hd5nxm8i8ga8pm7xbbjp3zggn7mgam4";
-  sgr-iosevka-ss02 = "1il8m3i5p0mbmbnjn68ilbfz1w7cah0q0zhyzf4pn001kk6bdz3d";
-  sgr-iosevka-ss03 = "0ca37wdygw2vgl024ds564646f09xmblbhwv1xwnvqbycl8vj86l";
-  sgr-iosevka-ss04 = "1bqmwf3k5wf2iy5ylmfikqd0akk9b26r890c05pbiy2xv8hq51xw";
-  sgr-iosevka-ss05 = "0rf048x9h3b9nl1n87d66m6fvbw2dlc2shq3h87ipnra7v4iqrbc";
-  sgr-iosevka-ss06 = "0bcj47j2y91qjyk0h8whb0hrwsappsp16prvldf20cp44qmrk0n0";
-  sgr-iosevka-ss07 = "08ikzyi6zq82vq5b228jlfkac345qpr6pzwvmxgk46pm40y7slzs";
-  sgr-iosevka-ss08 = "0z197i1c5z6q45xpc94q47pqsmkzrjgrcpkxj7z9h6vpn241rcbj";
-  sgr-iosevka-ss09 = "1xbidm26r51q629lridd2gl79lcmg9v6f6v67y064mn89iwpp0dc";
-  sgr-iosevka-ss10 = "0nczij6kmshh73pw19rjwms73inm84dmxv7r7gwzfyfk3lbbcj9a";
-  sgr-iosevka-ss11 = "09jng5m8a10c1p8vabjm3bqmfmjw21pbghx5ck9w4bma84cbijvq";
-  sgr-iosevka-ss12 = "0p629lbkg6ixwzq12vpnryjsdpcvv8cqxan8avy3xg0p62pxw018";
-  sgr-iosevka-ss13 = "1i0l6qhsb21ix7yaa0y2m396i86r5811xdjsfw2r8g1yp8g3h4kw";
-  sgr-iosevka-ss14 = "04y4rq6v0dr2ydd9x4arcn911vv7f72slv2r0035aq0b0n02q401";
-  sgr-iosevka-ss15 = "0fwnxmhc2mijfzhfs9dra1npfpywdg77nmq6sw2mav6bwj29hbyb";
-  sgr-iosevka-ss16 = "01x3qb0s9dilsf3hzvybfrdl4fclx7j63y8jdnmrpnr6pvqx98gk";
-  sgr-iosevka-ss17 = "18wfpvsyyvw3lq7v8r63gzkbqda7p9f164iryf7alpamdcm16jr3";
-  sgr-iosevka-ss18 = "0mzy21qwmzz0kcncnabzx699b68qs4ycyprl2bn3yg06pclpvhcs";
-  sgr-iosevka-term = "1k5n3k3x0y607q0vd70plms3jnv8x3svrwn9wgvlijrwa11n41mf";
-  sgr-iosevka-term-curly = "0rj7h5miiri26q1kgj9m2h75ix9q3jq4m2js98wszn2inn94aggv";
-  sgr-iosevka-term-curly-slab = "18rq47yf9wmlx5d327himmr64kslpxzkj8wjwk91ps83bi4gjm3z";
-  sgr-iosevka-term-slab = "03asydj05vchzvphl82v74ydzvagplf2484r0mjgmdd5h02qp53r";
-  sgr-iosevka-term-ss01 = "1jznjiljznr6jm1b9kfal5ri0cm949b4bhsvadgha4qk0f0r8him";
-  sgr-iosevka-term-ss02 = "1pam3w1x2i0rxhdi4f6cd49b1vpg94qzzv1fqpdshfaws4qyn226";
-  sgr-iosevka-term-ss03 = "1rrdja2dpbwg127pnz92qq50d91nvzikmf810db3dbmkv1qrqz54";
-  sgr-iosevka-term-ss04 = "0wgyyri1darx1yij8s16qziwqjgl8kaby888s8vgaj586wr1kjbx";
-  sgr-iosevka-term-ss05 = "0yhg0nrxsknkf7nyxdvz58vjin2r4z253786x86ilqssijwgsddf";
-  sgr-iosevka-term-ss06 = "158zydfnjkzpkaslhjdq6ci5xgbhjvvi8wns3z0lw123rwd8g5k9";
-  sgr-iosevka-term-ss07 = "1hggj50b26gamm4gvcpk8cqb4ppr5k0996vd1jj6s736i96q526a";
-  sgr-iosevka-term-ss08 = "16ka95n7m3385pdq5v21s42138vgihn31vn604w34w1qak9waxr6";
-  sgr-iosevka-term-ss09 = "0s85afqk168qmgl6a6czbk9amzryajig2vznqqa4gh871ikjd9cp";
-  sgr-iosevka-term-ss10 = "1771952mj36r34zadawcvw74rfnjz82l4rz6gj5wiv76pv363idj";
-  sgr-iosevka-term-ss11 = "1brwab2y13acirsnb0nc3pmbx5fs1rbn8sqz36vwgd0yg7ixskr3";
-  sgr-iosevka-term-ss12 = "08v1gcl5smf1gqhqij7qbcz504x19bs1f8wmh5xks1xv7xpajs26";
-  sgr-iosevka-term-ss13 = "0pqyvjaz89pgbnxfd6n7lspb8n0y5gr0rd1g5k8i9j57ilhsdcb2";
-  sgr-iosevka-term-ss14 = "09h6l6gwn7rlwldgjyznjzq0wz31lkw1bnirsamh9nbicsmcgdxs";
-  sgr-iosevka-term-ss15 = "0sj28ynxwri9sspqfjm5vj9v14lz0nqsip9a7wakyxxrqr7qnz97";
-  sgr-iosevka-term-ss16 = "09h7r28nmc881ms17dz557m8blpj6jmvf42s3pjbzwc50d6fykn2";
-  sgr-iosevka-term-ss17 = "0nkksb99g6ciqr46cyk8xmlij7srbx8fxs4i0fng1qkm6jhfnpky";
-  sgr-iosevka-term-ss18 = "0spd16nn9lbcxyv091xkgj9c7i6hgqf4qg6bplhmf6dhxhj6kchj";
+  iosevka = "03jwgk8gd1n2rihwjgwk6zkly77pw2w9gyacs8rl0nx3v5yf1fzb";
+  iosevka-aile = "0s7dfqm731xzlqgb5vbycks8mycxd27bapxs9hd2dqa07ixk8sl5";
+  iosevka-curly = "1x2r3zhk3b69c462nj3b5fa890719rzffhl1b3pdl4bsldskdl7z";
+  iosevka-curly-slab = "1v81vqjyknr2iyzzznmr18vnzhlv94ca0mz84ki9gq977kvz6cav";
+  iosevka-etoile = "1xcyyfkrxl6a555jh6j7jlxp276qlcgmxjik86dch881ya7pz8c0";
+  iosevka-slab = "0xl16zr4lf9m5a6ni4zydns8pc9nql9fq0bkvjf716s49s24gpyb";
+  iosevka-ss01 = "122avzcwnhi25w99mvvpfxmd9y3acipc469lksvhysl0a8cbnk7q";
+  iosevka-ss02 = "0p6vak2lgkj51mfqhdfk3rv20fdch8a29kqis1rmrr75fnbh2r75";
+  iosevka-ss03 = "0zx04d82fnz9msb065y2avjvjz0fy881mafqfvc9qkl7ifzn27m7";
+  iosevka-ss04 = "1y78yjamdsldw0p5j9955mcxzpxsgmqqki65kmpg5p1ygng2489r";
+  iosevka-ss05 = "02ksvn933piqjcxbss7w60lh968vnyvxv36hn1fd67vqjdg4fi5x";
+  iosevka-ss06 = "03xn8m2qwf1hx37rjbh0wfwzhfsyzjdyarq09kqmqiba1ik0mfk3";
+  iosevka-ss07 = "0653xp8xkylvjlgzdk4drh31s3l7vr2l8yll1lbzc91mip6j4q0c";
+  iosevka-ss08 = "1v4z6c9qqnalbllkns7qvzcygpymzd62lh35g2b93x8mxj0gdrcv";
+  iosevka-ss09 = "05wc0pvrxw5ghws0g1ldaq29jm116shmfjxhk98nc2lxp3j6bbrd";
+  iosevka-ss10 = "1hrccz2rlwxcp5m4z14jm9q4ix90z0sqinayi3xjh8yns59r049s";
+  iosevka-ss11 = "1l66xyam4vgly46vavvvax54radi0r1bhgqgwp5x2r1m98l5da7i";
+  iosevka-ss12 = "013igxaqb8jfg4b1ssz2jlkyvvf60b4kn08f9z6mlh2hkcv11wwy";
+  iosevka-ss13 = "1y1w1r3ddyyvngs3x4gjk68w4shbrcka951i5qkf5236hn5hqixm";
+  iosevka-ss14 = "1gpz4fk19nd28akgsl75jqkz3jmgra1njgjrb9wx35schzbgj6rf";
+  iosevka-ss15 = "1dapsqa28pqnv3bg9j3qba8qid0kla333xbj5v7zga635qz2gnkw";
+  iosevka-ss16 = "0cdai2lf38dbn978zpmhbc5qza9s92zyrrph63zhd9dbp0l8ljiv";
+  iosevka-ss17 = "0js37r1r8swpxcfhwf7w6n5r3azhsrfviw1q6z45pcz1v5l9igph";
+  iosevka-ss18 = "1cvyi5xiqxns2apkzr806wpfdfkss0nxkwp6di2lzbxfh93q5jvc";
+  sgr-iosevka = "0020i3p6328kq29vvhmmlic06760s3gffi6pa4yz04dwxfjah3k9";
+  sgr-iosevka-aile = "1fzlgz102fhygnv4gyfkiz8wr5c6cf49m94d7gifswx6skj1jl2l";
+  sgr-iosevka-curly = "1lbdfszj2a620dlak2ffrrfzp419bfknaiw0njk98wflfb3sjncp";
+  sgr-iosevka-curly-slab = "1hfg19aq0az9qgwh4dckf0n6mr7dm8fd2jxsqxjklhhdfa3s1cbm";
+  sgr-iosevka-etoile = "0ml9y2aiwwp64dl2na7rmcylzzlmr6al4habh07pn4ijjmxd2zz2";
+  sgr-iosevka-fixed = "1c29nmbckmjqkk574cgs6hr9mdkfidp35d61gpvpxg64nsv6cvmv";
+  sgr-iosevka-fixed-curly = "0jj8i57hl7q9bz9lk5mki4ifh2w2pd2n1fs6mqk29znas3mf0djf";
+  sgr-iosevka-fixed-curly-slab = "15gl43yhch9rny5ibz56m55r48a0qrbm7an3in4pzp34l6wjk8mq";
+  sgr-iosevka-fixed-slab = "1wrw39c5yg2i1lsnz5msdql4srn0xr6lkincjkg6zgbqb22ah4lq";
+  sgr-iosevka-fixed-ss01 = "0vq1kmfd6hydkmfidc28b1dchnwlwvmfh2nnrz88f3fc2hhb02ck";
+  sgr-iosevka-fixed-ss02 = "0m36lb668qgc6jaaxizrnzm8wl4jbri6qfk107lkjz3vas0v7k4y";
+  sgr-iosevka-fixed-ss03 = "05srwzs7a5mmm9g2b67m712fsw8dgf6m7mxywc1mp9m3fhjyqxwk";
+  sgr-iosevka-fixed-ss04 = "1q4rz9q52p3zhshn8djl69b16q544x7ky8nrpdladiah9dyrimr5";
+  sgr-iosevka-fixed-ss05 = "0w5qvl2vwijvwz5wvvwaixwqlgn2dfm5x7x6p5c00nwmcrlxghn0";
+  sgr-iosevka-fixed-ss06 = "0jyyj35xz8wcrxr822f2rcq6imkc8v9d14zn4q8a3srh06d6n3mq";
+  sgr-iosevka-fixed-ss07 = "09pikb09c863sq5hmcy4zk8449js2lxj02jph2p5fvsvzqbqwda0";
+  sgr-iosevka-fixed-ss08 = "1s7n327a6lsfb845jz4zyl56dpyf6h13sn9jm65h3qhfxadcfgpp";
+  sgr-iosevka-fixed-ss09 = "1rxisww2xsa6fxh6qd4n7rxwa04rlk1rz5x8jqsh9ajrlx31dxmg";
+  sgr-iosevka-fixed-ss10 = "0xfj5c8wkw8429aj49jidwaqf53qgqms3wfqws87plshaz94r3rs";
+  sgr-iosevka-fixed-ss11 = "01zsrgxmlly1hylfpq7sd07mk1anm9si69f0p9akidaffp7ki0bz";
+  sgr-iosevka-fixed-ss12 = "1j53kbnxq3hki5hwa3y794kb7m89kg7wv5a7ml6h08dvqlqivi13";
+  sgr-iosevka-fixed-ss13 = "04yvah2nns6lk8w71jyhfnnks3bc3frkpa11a79sw46wwmn2hnr4";
+  sgr-iosevka-fixed-ss14 = "1k85xm5rrwj15iyvh4492q8ls6aqvq00xbmg1l27q6599369abjy";
+  sgr-iosevka-fixed-ss15 = "0r1ka2a3b9kdzrdkic5h22wrf2kwwhdvz29xniymlrnqgy6rq5im";
+  sgr-iosevka-fixed-ss16 = "0cls0rxc22xz11rirga4ijd1rn4l3am32agjhl11lm6z4h7rjl06";
+  sgr-iosevka-fixed-ss17 = "1sm61q99jm6bykwm03z32cskgzwpcnn1f5x12clgyw6m6m7nccm9";
+  sgr-iosevka-fixed-ss18 = "18fihrmsclbfy3vsaw6bmv0bvrjph6ik5p3k15jl9hh6i9qnhpyd";
+  sgr-iosevka-slab = "0a0a4zm2prdnzkiir1zm2clvvwcpn1l89s9crvv2qi5ll55h35pq";
+  sgr-iosevka-ss01 = "0fw9ic1zl7sd4gf1b73704n6frmagg6v4r6lc6j195ni4px6n4wx";
+  sgr-iosevka-ss02 = "1icsr5d177r7dlry80ya5522rp4kr7vy5ad35w0p11566qq9f0r6";
+  sgr-iosevka-ss03 = "0sxzmzwg6ryr6jfhvviqgzlhizfwcrl6fhmm3mmr2g0lyrc2shna";
+  sgr-iosevka-ss04 = "13b4y73s39hqm4bxk6nx439w1rd33n2q2d8zplwgsy8zpznf2v04";
+  sgr-iosevka-ss05 = "0slkzah2icshqcf8izviyid3qm9qdvnmaf65a1l0fhzamx3fsf03";
+  sgr-iosevka-ss06 = "04i88ky5139wbn4d1vglq8xl51srii12lx0329pggfrpi7xxpd8q";
+  sgr-iosevka-ss07 = "0a34k93n3cckgvirqxj6qg7qg4mqr3cm19zbwj8h6mnsndrndkhz";
+  sgr-iosevka-ss08 = "06qhv6dfs4y8601kkcqp2zg6pk61v2zfpnpxwwsbviaf45zjp74r";
+  sgr-iosevka-ss09 = "1g89ygl86iljzgs1h15p484a8m6af9n1s5rbami8cry35sx4sqmg";
+  sgr-iosevka-ss10 = "0bwx7ic6jidq3d8dkinzygjvd1z5b1zi7x926a6fvc6hm0jd1nak";
+  sgr-iosevka-ss11 = "0jx4k1kb0j09a18d43vhfwap5cr1g0z7afwmhnbj78q4g19jx04c";
+  sgr-iosevka-ss12 = "0qkp2ds57c03w0j41a4vykk0zxn26sqy4r03mzbm61j33zpp4c2v";
+  sgr-iosevka-ss13 = "0v9a3cz3m2yh7yk7q3r7rx1g4q3a8098fn8hbswz4sr7gw0niyps";
+  sgr-iosevka-ss14 = "0zd0bkzvgvj89dm6yr7bjzi7fc62k6i03zx5mqna3npyxzrxmnn0";
+  sgr-iosevka-ss15 = "0ambby6s312q9b86src5l2fq4g13cx98hjllviya9r0rp76nabdx";
+  sgr-iosevka-ss16 = "0qcpfflxzvzqm5dfx0939lqj74nf3ssxg8kprds0hxlaq076wv90";
+  sgr-iosevka-ss17 = "0f6d5gnwcpall09wn4djifg6vwv7884xc9ylklrnn8w7f6y66sj8";
+  sgr-iosevka-ss18 = "0fmmyi3iqmsfmnx18jls6fs72y8878qd3ma0afh698p06kpbnqvn";
+  sgr-iosevka-term = "1bwz17kigznwr917gs0kwc5q69d0485kgbinqbdjad4a9ig4dwl3";
+  sgr-iosevka-term-curly = "0zzg4cm6xzhvnnn3bc97pd303nzgf9r2qi450kcb2rpybnb7j4wl";
+  sgr-iosevka-term-curly-slab = "1nipn2vj6m5fz63f1jwimxjrc27bsk04f3km0lymvsabpfhr3afx";
+  sgr-iosevka-term-slab = "0f0qpz98skkc1app981ijf9ggqr3im969n53dsqw4n9vprkpg4s9";
+  sgr-iosevka-term-ss01 = "0aj94rmv5mw344vnxji0cqbzwfbigjdgj3gsbx141vdcb4mmx3i4";
+  sgr-iosevka-term-ss02 = "0l1m102c8kwa35anhvaig4fpw9c4y1b84qlja1griakvz48i34dw";
+  sgr-iosevka-term-ss03 = "1sgmmgqq1ij6lfyvlfn31dgmh0wxy4x6758sj7fybjs65gl5lrnk";
+  sgr-iosevka-term-ss04 = "0lq0vmfsp9zlmg8v97rqjyf6pk1i35q8ljzbn6f6pdhgl83004w9";
+  sgr-iosevka-term-ss05 = "01mkdp2a6qxksxn3isg0j50a3vys0syw3vmn6af7mpis46zgjpj6";
+  sgr-iosevka-term-ss06 = "0dfwvnlbmyjbvd116fhzwkyyn6jxlgrhcz01m3rhgs42gsczjhmj";
+  sgr-iosevka-term-ss07 = "0k6653cc4ldhyrzx6gam06hyssy516shswp4qmgqhcl08wx5fpbk";
+  sgr-iosevka-term-ss08 = "12faci0m988wrwa0i7lf84scpjakmfqs0m0jbbqb488l413h5l7h";
+  sgr-iosevka-term-ss09 = "05ivmp2yfjjzqwqlh5d3pin8y24hmm17fkw5q1synv7d67p6pfqy";
+  sgr-iosevka-term-ss10 = "0piiqscfxpa19v947xzqz2x1bbscin3fr9wllrkhfd22ianjaagd";
+  sgr-iosevka-term-ss11 = "0mpbv8lxbv967nmnb0csbkf9pj9zb1lawsxagmnw098fj6kc3305";
+  sgr-iosevka-term-ss12 = "1fzm2rslayd3k72fnh2j4zx86r0dh2d82r1h6k0v3wkvyi6fx9nb";
+  sgr-iosevka-term-ss13 = "0w37h547ys5xmiayphj1ihm1kwwvpvw7v4ypdmp5vdy7grih986q";
+  sgr-iosevka-term-ss14 = "0f0diws4q86190h8mlvrzww34zb7za7glvaqy252pfw6p2xyp784";
+  sgr-iosevka-term-ss15 = "11kv4hz2zsjgyakkrw77gljrvpb53p8q7xw0m75h5plbcz661gn2";
+  sgr-iosevka-term-ss16 = "1mxnhvbgrxnpvgj6bjk4g7xakw0f8iqwpnjbyswv1ykklm75rmz4";
+  sgr-iosevka-term-ss17 = "033dhx0rbkh8nlckqgjxffjcp91anjwc2n566f231asyry6jqr3m";
+  sgr-iosevka-term-ss18 = "160zd6aygzjz4hfgljg0996iifxqabmfkjd51935x3vg52ays8fa";
 }
diff --git a/pkgs/data/misc/hackage/pin.json b/pkgs/data/misc/hackage/pin.json
index 35cb5aeae7fe..219f89c8a216 100644
--- a/pkgs/data/misc/hackage/pin.json
+++ b/pkgs/data/misc/hackage/pin.json
@@ -1,6 +1,6 @@
 {
-  "commit": "149e34766e4b393af8f4b1e02b3a8cb341d22151",
-  "url": "https://github.com/commercialhaskell/all-cabal-hashes/archive/149e34766e4b393af8f4b1e02b3a8cb341d22151.tar.gz",
-  "sha256": "09acrzaqr05hbhdj2d0i5yj8j321fi7qcxfmpgws25bz9l07qand",
-  "msg": "Update from Hackage at 2023-05-28T10:08:17Z"
+  "commit": "ef5d0a2b18aa5fb9d03c1a0cadf1e90791b81f99",
+  "url": "https://github.com/commercialhaskell/all-cabal-hashes/archive/ef5d0a2b18aa5fb9d03c1a0cadf1e90791b81f99.tar.gz",
+  "sha256": "034hmgc16mn9ly7pc6d67ksv9qdpmrv7va8jwpnjsd2mf1fc9gwz",
+  "msg": "Update from Hackage at 2023-05-30T03:47:42Z"
 }
diff --git a/pkgs/desktops/xfce/applications/xfce4-screensaver/default.nix b/pkgs/desktops/xfce/applications/xfce4-screensaver/default.nix
index e7873eaa0b85..fd119592ba43 100644
--- a/pkgs/desktops/xfce/applications/xfce4-screensaver/default.nix
+++ b/pkgs/desktops/xfce/applications/xfce4-screensaver/default.nix
@@ -19,9 +19,9 @@
 mkXfceDerivation {
   category = "apps";
   pname = "xfce4-screensaver";
-  version = "4.18.1";
+  version = "4.18.2";
 
-  sha256 = "sha256-d72m2dW8jvM/EjgNSVaKsP5Ip7ioguB61/hy2cWw+dw=";
+  sha256 = "sha256-j5K5i+hl/miyHste73akZL62K6YTxXmN8mmFK9BCecs=";
 
   buildInputs = [
     dbus-glib
@@ -44,8 +44,8 @@ mkXfceDerivation {
 
   makeFlags = [ "DBUS_SESSION_SERVICE_DIR=$(out)/etc" ];
 
-  meta =  {
+  meta = with lib; {
     description = "Screensaver for Xfce";
-    maintainers = with lib.maintainers; [ symphorien ];
+    maintainers = with maintainers; [ symphorien ] ++ teams.xfce.members;
   };
 }
diff --git a/pkgs/desktops/xfce/core/xfce4-power-manager/default.nix b/pkgs/desktops/xfce/core/xfce4-power-manager/default.nix
index 3a4285b33b77..8755234cbc82 100644
--- a/pkgs/desktops/xfce/core/xfce4-power-manager/default.nix
+++ b/pkgs/desktops/xfce/core/xfce4-power-manager/default.nix
@@ -1,21 +1,30 @@
-{ lib, mkXfceDerivation, automakeAddFlags, exo, gtk3, libnotify
-, libxfce4ui, libxfce4util, upower, xfconf, xfce4-panel }:
+{ lib
+, mkXfceDerivation
+, gtk3
+, libnotify
+, libxfce4ui
+, libxfce4util
+, upower
+, xfconf
+, xfce4-panel
+}:
 
 mkXfceDerivation {
   category = "xfce";
   pname = "xfce4-power-manager";
-  version = "4.18.1";
+  version = "4.18.2";
 
-  sha256 = "sha256-H9tu94ZQLLQhXIDtIWL3qZJo/ux2xC2Y9m7uwwey8M8=";
+  sha256 = "sha256-1+DP5CACzzj96FyRTeCdVEFORnpzFT49d9Uk1iijbFs=";
 
-  nativeBuildInputs = [ automakeAddFlags exo ];
-  buildInputs = [ gtk3 libnotify libxfce4ui libxfce4util upower xfconf xfce4-panel ];
-
-  postPatch = ''
-    substituteInPlace configure.ac.in --replace gio-2.0 gio-unix-2.0
-    automakeAddFlags src/Makefile.am xfce4_power_manager_CFLAGS GIO_CFLAGS
-    automakeAddFlags settings/Makefile.am xfce4_power_manager_settings_CFLAGS GIO_CFLAGS
-  '';
+  buildInputs = [
+    gtk3
+    libnotify
+    libxfce4ui
+    libxfce4util
+    upower
+    xfconf
+    xfce4-panel
+  ];
 
   meta = with lib; {
     description = "A power manager for the Xfce Desktop Environment";
diff --git a/pkgs/development/compilers/ghc/9.6.2.nix b/pkgs/development/compilers/ghc/9.6.2.nix
new file mode 100644
index 000000000000..a0f764d016b5
--- /dev/null
+++ b/pkgs/development/compilers/ghc/9.6.2.nix
@@ -0,0 +1,4 @@
+import ./common-hadrian.nix rec {
+  version = "9.6.2";
+  sha256 = "1b510c5f8753c3ba24851702c6c9da7d81dc5e47fe3ecb7af39c7c2613abf170";
+}
diff --git a/pkgs/development/coq-modules/corn/default.nix b/pkgs/development/coq-modules/corn/default.nix
index 84bca53931cc..7a745a3df34a 100644
--- a/pkgs/development/coq-modules/corn/default.nix
+++ b/pkgs/development/coq-modules/corn/default.nix
@@ -5,7 +5,7 @@ mkCoqDerivation rec {
   inherit version;
   defaultVersion = with lib.versions; lib.switch coq.coq-version [
     { case = "8.6"; out = "8.8.1"; }
-    { case = (range "8.11" "8.16"); out = "8.16.0"; }
+    { case = (range "8.11" "8.17"); out = "8.16.0"; }
     { case = (range "8.7"  "8.15"); out = "8.13.0"; }
   ] null;
   release = {
diff --git a/pkgs/development/coq-modules/math-classes/default.nix b/pkgs/development/coq-modules/math-classes/default.nix
index d40dacd39380..6ae6956110a5 100644
--- a/pkgs/development/coq-modules/math-classes/default.nix
+++ b/pkgs/development/coq-modules/math-classes/default.nix
@@ -4,10 +4,14 @@ mkCoqDerivation {
 
   pname = "math-classes";
   inherit version;
-  defaultVersion = if lib.versions.range "8.6" "8.16" coq.coq-version then "8.15.0" else null;
+  defaultVersion = with lib.versions; lib.switch coq.coq-version [
+    { case = range "8.12" "8.17"; out = "8.17.0"; }
+    { case = range "8.6"  "8.16"; out = "8.15.0"; }
+  ] null;
   release."8.12.0".sha256 = "14nd6a08zncrl5yg2gzk0xf4iinwq4hxnsgm4fyv07ydbkxfb425";
   release."8.13.0".sha256 = "1ln7ziivfbxzbdvlhbvyg3v30jgblncmwcsam6gg3d1zz6r7cbby";
   release."8.15.0".sha256 = "10w1hm537k6jx8a8vghq1yx12rsa0sjk2ipv3scgir71ln30hllw";
+  release."8.17.0".sha256 = "sha256-WklL8pgYTd0l4TGt7h7tWj1qcFcXvoPn25+XKF1pIKA=";
 
   propagatedBuildInputs = [ bignums ];
 
diff --git a/pkgs/development/haskell-modules/configuration-common.nix b/pkgs/development/haskell-modules/configuration-common.nix
index f624348c661d..652c8ede6aab 100644
--- a/pkgs/development/haskell-modules/configuration-common.nix
+++ b/pkgs/development/haskell-modules/configuration-common.nix
@@ -61,15 +61,15 @@ self: super: {
           # not solvable short of recompiling GHC. Instead of adding
           # allowInconsistentDependencies for all reverse dependencies of hspec-core,
           # just upgrade to an hspec version without the offending dependency.
-          hspec-core = cself.hspec-core_2_11_0_1;
-          hspec-discover = cself.hspec-discover_2_11_0_1;
-          hspec = cself.hspec_2_11_0_1;
+          hspec-core = cself.hspec-core_2_11_1;
+          hspec-discover = cself.hspec-discover_2_11_1;
+          hspec = cself.hspec_2_11_1;
 
           # hspec-discover and hspec-core depend on hspec-meta for testing which
-          # we need to avoid since it depends on ghc as well. Since hspec*_2_10*
+          # we need to avoid since it depends on ghc as well. Since hspec*_2_11*
           # are overridden to take the versioned attributes as inputs, we need
           # to make sure to override the versioned attribute with this fix.
-          hspec-discover_2_11_0_1 = dontCheck csuper.hspec-discover_2_11_0_1;
+          hspec-discover_2_11_1 = dontCheck csuper.hspec-discover_2_11_1;
 
           # Prevent dependency on doctest which causes an inconsistent dependency
           # due to depending on ghc which depends on directory etc.
@@ -725,9 +725,6 @@ self: super: {
   # vector dependency < 0.12
   imagemagick = doJailbreak super.imagemagick;
 
-  # https://github.com/liyang/thyme/issues/36
-  thyme = dontCheck super.thyme;
-
   # Elm is no longer actively maintained on Hackage: https://github.com/NixOS/nixpkgs/pull/9233.
   Elm = markBroken super.Elm;
   elm-build-lib = markBroken super.elm-build-lib;
@@ -969,12 +966,12 @@ self: super: {
     testHaskellDepends = drv.testHaskellDepends or [] ++ [ self.hspec-meta_2_10_5 ];
     testToolDepends = drv.testToolDepends or [] ++ [ pkgs.git ];
   }) (super.sensei.override {
-    hspec = self.hspec_2_11_0_1;
+    hspec = self.hspec_2_11_1;
     hspec-wai = self.hspec-wai.override {
-      hspec = self.hspec_2_11_0_1;
+      hspec = self.hspec_2_11_1;
     };
     hspec-contrib = self.hspec-contrib.override {
-      hspec-core = self.hspec-core_2_11_0_1;
+      hspec-core = self.hspec-core_2_11_1;
     };
     fsnotify = self.fsnotify_0_4_1_0;
   });
@@ -1641,18 +1638,19 @@ self: super: {
   # https://github.com/biocad/servant-openapi3/issues/30
   servant-openapi3 = dontCheck super.servant-openapi3;
 
-  # Give hspec 2.10.* correct dependency versions without overrideScope
-  hspec_2_11_0_1 = doDistribute (super.hspec_2_11_0_1.override {
-    hspec-discover = self.hspec-discover_2_11_0_1;
-    hspec-core = self.hspec-core_2_11_0_1;
+  # Give latest hspec correct dependency versions without overrideScope
+  hspec_2_11_1 = doDistribute (super.hspec_2_11_1.override {
+    hspec-discover = self.hspec-discover_2_11_1;
+    hspec-core = self.hspec-core_2_11_1;
   });
-  hspec-discover_2_11_0_1 = doDistribute (super.hspec-discover_2_11_0_1.override {
+  hspec-discover_2_11_1 = doDistribute (super.hspec-discover_2_11_1.override {
     hspec-meta = self.hspec-meta_2_10_5;
   });
-  # Need to disable tests to prevent an infinite recursion if hspec-core_2_11_0_1
+  # Need to disable tests to prevent an infinite recursion if hspec-core_2_11_1
   # is overlayed to hspec-core.
-  hspec-core_2_11_0_1 = doDistribute (dontCheck (super.hspec-core_2_11_0_1.override {
+  hspec-core_2_11_1 = doDistribute (dontCheck (super.hspec-core_2_11_1.override {
     hspec-meta = self.hspec-meta_2_10_5;
+    hspec-expectations = self.hspec-expectations_0_8_3;
   }));
 
   # Point hspec 2.7.10 to correct dependencies
diff --git a/pkgs/development/haskell-modules/configuration-darwin.nix b/pkgs/development/haskell-modules/configuration-darwin.nix
index a5bac147d148..b800debe15ee 100644
--- a/pkgs/development/haskell-modules/configuration-darwin.nix
+++ b/pkgs/development/haskell-modules/configuration-darwin.nix
@@ -35,6 +35,7 @@ self: super: ({
   double-conversion = addExtraLibrary pkgs.libcxx super.double-conversion;
 
   streamly = addBuildDepend darwin.apple_sdk.frameworks.Cocoa super.streamly;
+  streamly_0_9_0 = addBuildDepend darwin.apple_sdk.frameworks.Cocoa super.streamly_0_9_0;
 
   apecs-physics = addPkgconfigDepends [
     darwin.apple_sdk.frameworks.ApplicationServices
diff --git a/pkgs/development/haskell-modules/configuration-hackage2nix/broken.yaml b/pkgs/development/haskell-modules/configuration-hackage2nix/broken.yaml
index c1e391aea738..62eb388064b3 100644
--- a/pkgs/development/haskell-modules/configuration-hackage2nix/broken.yaml
+++ b/pkgs/development/haskell-modules/configuration-hackage2nix/broken.yaml
@@ -2607,6 +2607,7 @@ broken-packages:
   - http-rfc7807
   - http-server
   - http-shed
+  - httpstan # dependency missing in job https://hydra.nixos.org/build/221916023 at 2023-05-31
   - http-wget
   - htune
   - htvm
diff --git a/pkgs/development/haskell-modules/hackage-packages.nix b/pkgs/development/haskell-modules/hackage-packages.nix
index 39e763f3f19d..9f4e09bae16e 100644
--- a/pkgs/development/haskell-modules/hackage-packages.nix
+++ b/pkgs/development/haskell-modules/hackage-packages.nix
@@ -14560,6 +14560,8 @@ self: {
        pname = "MuCheck";
        version = "0.3.0.4";
        sha256 = "183p3fmzz5d67g8wmzgv8c8yyhs0cp7x3xig4cm9s98nhrsm1j0r";
+       revision = "1";
+       editedCabalFile = "08h1jmsvy8kg3iq5x8hsjb734hhp9zf7fm8aj17v41gzn51icfrv";
        libraryHaskellDepends = [
          base directory hashable haskell-src-exts hint mtl random syb
          temporary time
@@ -26532,6 +26534,35 @@ self: {
        license = lib.licenses.bsd3;
      }) {};
 
+  "aeson-schemas_1_4_1_0" = callPackage
+    ({ mkDerivation, aeson, aeson-qq, base, criterion, deepseq
+     , directory, filepath, first-class-families, hashable, interpolate
+     , megaparsec, process, QuickCheck, raw-strings-qq, tasty
+     , tasty-golden, tasty-hunit, tasty-quickcheck, template-haskell
+     , temporary, text, th-orphans, th-test-utils, unordered-containers
+     }:
+     mkDerivation {
+       pname = "aeson-schemas";
+       version = "1.4.1.0";
+       sha256 = "0l9qdzcx6fs661zn9vrkpflr5fl92s1w16nb94cabh8v1xzbagxh";
+       libraryHaskellDepends = [
+         aeson base first-class-families hashable megaparsec
+         template-haskell text unordered-containers
+       ];
+       testHaskellDepends = [
+         aeson aeson-qq base deepseq directory filepath interpolate process
+         QuickCheck raw-strings-qq tasty tasty-golden tasty-hunit
+         tasty-quickcheck template-haskell temporary text th-orphans
+         th-test-utils
+       ];
+       benchmarkHaskellDepends = [
+         aeson base criterion deepseq template-haskell th-test-utils
+       ];
+       description = "Easily consume JSON data on-demand with type-safety";
+       license = lib.licenses.bsd3;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "aeson-serialize" = callPackage
     ({ mkDerivation, aeson, base, cereal, hspec, HUnit }:
      mkDerivation {
@@ -53255,6 +53286,8 @@ self: {
        pname = "cabal-install";
        version = "3.10.1.0";
        sha256 = "13c3qx0qw7kizaj2dpgl2y3pj86pgqvmkck20w726jalamlf6pcr";
+       revision = "1";
+       editedCabalFile = "0h1ra9kw7mk70202whiphbdyvknm7jbhqhkgw4h8abb1sgffhs3n";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [
@@ -75819,6 +75852,25 @@ self: {
        broken = true;
      }) {};
 
+  "data-diverse_4_7_1_0" = callPackage
+    ({ mkDerivation, base, containers, criterion, deepseq, ghc-prim
+     , hashable, hspec, tagged
+     }:
+     mkDerivation {
+       pname = "data-diverse";
+       version = "4.7.1.0";
+       sha256 = "102d9zmbbwwav01q6190ggdiw49jkx2j0j60zslc59nqhlm2qwlq";
+       libraryHaskellDepends = [
+         base containers deepseq ghc-prim hashable tagged
+       ];
+       testHaskellDepends = [ base hspec tagged ];
+       benchmarkHaskellDepends = [ base criterion ];
+       description = "Extensible records and polymorphic variants";
+       license = lib.licenses.bsd3;
+       hydraPlatforms = lib.platforms.none;
+       broken = true;
+     }) {};
+
   "data-diverse-lens" = callPackage
     ({ mkDerivation, base, data-diverse, data-has, hspec, lens
      , profunctors, tagged
@@ -83335,8 +83387,8 @@ self: {
      }:
      mkDerivation {
        pname = "diohsc";
-       version = "0.1.12";
-       sha256 = "0zffy3m5w9cbf2ngg8zhvpz9cgdml6r7swvkf5k8grph1zifa0sj";
+       version = "0.1.13";
+       sha256 = "0fiahbzidrwqn0hfpp6v7ja98rcd5wyxk7f2vnybhg19k50k3zri";
        isLibrary = false;
        isExecutable = true;
        executableHaskellDepends = [
@@ -131463,6 +131515,29 @@ self: {
        license = lib.licenses.lgpl21Only;
      }) {inherit (pkgs) glib; inherit (pkgs) gobject-introspection;};
 
+  "haskell-gi_0_26_5" = callPackage
+    ({ mkDerivation, ansi-terminal, attoparsec, base, bytestring, Cabal
+     , cabal-doctest, containers, directory, doctest, filepath, glib
+     , gobject-introspection, haskell-gi-base, mtl, pretty-show, process
+     , regex-tdfa, safe, text, transformers, xdg-basedir, xml-conduit
+     }:
+     mkDerivation {
+       pname = "haskell-gi";
+       version = "0.26.5";
+       sha256 = "1vwg0br0vrvq4blafv9j6l49x07ykg4jv9x0y11sjad7cm6s8k95";
+       setupHaskellDepends = [ base Cabal cabal-doctest ];
+       libraryHaskellDepends = [
+         ansi-terminal attoparsec base bytestring Cabal containers directory
+         filepath haskell-gi-base mtl pretty-show process regex-tdfa safe
+         text transformers xdg-basedir xml-conduit
+       ];
+       libraryPkgconfigDepends = [ glib gobject-introspection ];
+       testHaskellDepends = [ base doctest process ];
+       description = "Generate Haskell bindings for GObject Introspection capable libraries";
+       license = lib.licenses.lgpl21Only;
+       hydraPlatforms = lib.platforms.none;
+     }) {inherit (pkgs) glib; inherit (pkgs) gobject-introspection;};
+
   "haskell-gi-base" = callPackage
     ({ mkDerivation, base, bytestring, containers, glib, text }:
      mkDerivation {
@@ -131475,6 +131550,19 @@ self: {
        license = lib.licenses.lgpl21Only;
      }) {inherit (pkgs) glib;};
 
+  "haskell-gi-base_0_26_4" = callPackage
+    ({ mkDerivation, base, bytestring, containers, glib, text }:
+     mkDerivation {
+       pname = "haskell-gi-base";
+       version = "0.26.4";
+       sha256 = "1c5i9nwf0ldgjyqm8qir5fs66d5pkyl9ajq77rcxy5bc7r7kbyws";
+       libraryHaskellDepends = [ base bytestring containers text ];
+       libraryPkgconfigDepends = [ glib ];
+       description = "Foundation for libraries generated by haskell-gi";
+       license = lib.licenses.lgpl21Only;
+       hydraPlatforms = lib.platforms.none;
+     }) {inherit (pkgs) glib;};
+
   "haskell-gi-overloading" = callPackage
     ({ mkDerivation }:
      mkDerivation {
@@ -153362,14 +153450,14 @@ self: {
        license = lib.licenses.mit;
      }) {};
 
-  "hspec_2_11_0_1" = callPackage
+  "hspec_2_11_1" = callPackage
     ({ mkDerivation, base, hspec-core, hspec-discover
      , hspec-expectations, QuickCheck
      }:
      mkDerivation {
        pname = "hspec";
-       version = "2.11.0.1";
-       sha256 = "0sz2ishjz7fa09w2215fdxw2yj6bv1q55arr554l1jdxf6mvd7r7";
+       version = "2.11.1";
+       sha256 = "0rm2hcnhka0b8z7kdlzsd4lvk5jna29n9qfrfxzvn5a8ncj0mb71";
        libraryHaskellDepends = [
          base hspec-core hspec-discover hspec-expectations QuickCheck
        ];
@@ -153391,14 +153479,14 @@ self: {
        license = lib.licenses.mit;
      }) {};
 
-  "hspec-api_2_11_0_1" = callPackage
+  "hspec-api_2_11_1" = callPackage
     ({ mkDerivation, base, hspec, hspec-core, hspec-discover
      , transformers
      }:
      mkDerivation {
        pname = "hspec-api";
-       version = "2.11.0.1";
-       sha256 = "0zrd2kn9qwx5cs9cbn8pz9sm8jr322jnj99lpasskpg8acby3pkk";
+       version = "2.11.1";
+       sha256 = "0jq8x5rfskb29nh1hpy9y1rc7g6nwbdba8nnri5kdc3jf3jwmnff";
        libraryHaskellDepends = [ base hspec-core transformers ];
        testHaskellDepends = [ base hspec hspec-core transformers ];
        testToolDepends = [ hspec-discover ];
@@ -153523,7 +153611,7 @@ self: {
        license = lib.licenses.mit;
      }) {};
 
-  "hspec-core_2_11_0_1" = callPackage
+  "hspec-core_2_11_1" = callPackage
     ({ mkDerivation, ansi-terminal, array, base, base-orphans
      , call-stack, deepseq, directory, filepath, haskell-lexer
      , hspec-expectations, hspec-meta, HUnit, process, QuickCheck
@@ -153532,8 +153620,8 @@ self: {
      }:
      mkDerivation {
        pname = "hspec-core";
-       version = "2.11.0.1";
-       sha256 = "03fwa0y901khi3gp45qs72f6yzxils1dwkm8hpc2znl0ndaf06hq";
+       version = "2.11.1";
+       sha256 = "1r8jnhfg6yn4spq5bml4rg47ifkq7xsk6lb1mnikly7l5x91nscl";
        libraryHaskellDepends = [
          ansi-terminal array base call-stack deepseq directory filepath
          haskell-lexer hspec-expectations HUnit process QuickCheck
@@ -153560,6 +153648,8 @@ self: {
        pname = "hspec-dirstream";
        version = "1.0.0.4";
        sha256 = "10axc2rszyqzw8zwz7zjh05m5lifmghflls1w2sbyp7vlyz13iac";
+       revision = "1";
+       editedCabalFile = "1dzfiw97z0jwl8axha8r6vzpm25x25rz181i7i3i7dm8j8kanm1d";
        enableSeparateDataOutput = true;
        libraryHaskellDepends = [
          base dirstream filepath hspec hspec-core pipes pipes-safe
@@ -153614,14 +153704,14 @@ self: {
        maintainers = [ lib.maintainers.maralorn ];
      }) {};
 
-  "hspec-discover_2_11_0_1" = callPackage
+  "hspec-discover_2_11_1" = callPackage
     ({ mkDerivation, base, directory, filepath, hspec-meta, mockery
      , QuickCheck
      }:
      mkDerivation {
        pname = "hspec-discover";
-       version = "2.11.0.1";
-       sha256 = "18acqmw3zgkn718vgjiskx266ids4pp4mamb4gxlhj2934vfl656";
+       version = "2.11.1";
+       sha256 = "15jcz0dldq9jjzciv7vwnlxw9h7vbglvcgq90zwb50lpj1d9l916";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [ base directory filepath ];
@@ -153649,6 +153739,19 @@ self: {
        license = lib.licenses.mit;
      }) {};
 
+  "hspec-expectations_0_8_3" = callPackage
+    ({ mkDerivation, base, call-stack, HUnit, nanospec }:
+     mkDerivation {
+       pname = "hspec-expectations";
+       version = "0.8.3";
+       sha256 = "0wi1s0byfrlay98w1w38lj0mi0ifqzhvkl05q5dv5yr1wl50mgvi";
+       libraryHaskellDepends = [ base call-stack HUnit ];
+       testHaskellDepends = [ base call-stack HUnit nanospec ];
+       description = "Catchy combinators for HUnit";
+       license = lib.licenses.mit;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "hspec-expectations-json" = callPackage
     ({ mkDerivation, aeson, aeson-pretty, aeson-qq, base, Diff, hspec
      , HUnit, scientific, text, unordered-containers, vector
@@ -157502,6 +157605,35 @@ self: {
        hydraPlatforms = lib.platforms.none;
      }) {};
 
+  "httpstan" = callPackage
+    ({ mkDerivation, aeson, base, base64-bytestring, bytestring
+     , case-insensitive, containers, deepseq, exceptions, hspec
+     , http-api-data, http-client, http-client-tls, http-media
+     , http-types, iso8601-time, katip, microlens, mtl, network
+     , QuickCheck, random, safe-exceptions, semigroups, text, time
+     , transformers, unordered-containers, vector
+     }:
+     mkDerivation {
+       pname = "httpstan";
+       version = "0.2.0.0";
+       sha256 = "08wpigjaqjdbml7bp4rpikldzv7qkkzbxlmngp9p99zxr75d86vf";
+       libraryHaskellDepends = [
+         aeson base base64-bytestring bytestring case-insensitive containers
+         deepseq exceptions http-api-data http-client http-client-tls
+         http-media http-types iso8601-time katip microlens mtl network
+         random safe-exceptions text time transformers unordered-containers
+         vector
+       ];
+       testHaskellDepends = [
+         aeson base bytestring containers hspec iso8601-time mtl QuickCheck
+         semigroups text time transformers unordered-containers vector
+       ];
+       description = "Auto-generated httpstan API Client";
+       license = lib.licenses.bsd3;
+       hydraPlatforms = lib.platforms.none;
+       broken = true;
+     }) {};
+
   "htune" = callPackage
     ({ mkDerivation, alsa-pcm, base, carray, fft, gloss }:
      mkDerivation {
@@ -171533,20 +171665,19 @@ self: {
      }) {};
 
   "juicy-gcode" = callPackage
-    ({ mkDerivation, base, configurator, gitrev, lens, linear, matrix
-     , optparse-applicative, svg-tree, text
+    ({ mkDerivation, aeson, base, gitrev, JuicyPixels, lens, linear
+     , matrix, optparse-applicative, svg-tree, text
+     , unordered-containers, yaml
      }:
      mkDerivation {
        pname = "juicy-gcode";
-       version = "0.3.0.0";
-       sha256 = "0j2q76fwx93az2yk0pnmzl82npl0305ks2ia7gbxi7k9jwdzbp0i";
-       revision = "1";
-       editedCabalFile = "1n7hnbsiag3zzm8qbqz002g7iz074g8fifiq6inzny3y8n8x1fcy";
+       version = "1.0.0.0";
+       sha256 = "1m8mqszid40fhspm8hk8zhvrx2sp7ikfvvh46z8kfbhpgqbfq1jv";
        isLibrary = false;
        isExecutable = true;
        executableHaskellDepends = [
-         base configurator gitrev lens linear matrix optparse-applicative
-         svg-tree text
+         aeson base gitrev JuicyPixels lens linear matrix
+         optparse-applicative svg-tree text unordered-containers yaml
        ];
        description = "SVG to G-Code converter";
        license = lib.licenses.bsd3;
@@ -187715,6 +187846,8 @@ self: {
        pname = "lucid2";
        version = "0.0.20221012";
        sha256 = "00r3qmxrs3jh3v4gl5m38j86ihh78q4vmsk4bz2pbcc8gh2yficj";
+       revision = "1";
+       editedCabalFile = "029vhllgcdayrk34dssqirf1xpsr7z9jmi1lrh7qg2m061ypipxf";
        libraryHaskellDepends = [
          base blaze-builder bytestring containers mtl text transformers
        ];
@@ -206886,6 +207019,18 @@ self: {
        license = lib.licenses.bsd3;
      }) {};
 
+  "network-run_0_2_5" = callPackage
+    ({ mkDerivation, base, bytestring, network }:
+     mkDerivation {
+       pname = "network-run";
+       version = "0.2.5";
+       sha256 = "08662w7ja9w4a4fwikaawxnxcszkd0mdmaajmshas2dd25xyikwi";
+       libraryHaskellDepends = [ base bytestring network ];
+       description = "Simple network runner library";
+       license = lib.licenses.bsd3;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "network-server" = callPackage
     ({ mkDerivation, base, network, unix }:
      mkDerivation {
@@ -214825,17 +214970,17 @@ self: {
        license = lib.licenses.bsd3;
      }) {};
 
-  "optparse-applicative_0_18_0_0" = callPackage
+  "optparse-applicative_0_18_1_0" = callPackage
     ({ mkDerivation, base, prettyprinter, prettyprinter-ansi-terminal
-     , process, QuickCheck, transformers, transformers-compat
+     , process, QuickCheck, text, transformers, transformers-compat
      }:
      mkDerivation {
        pname = "optparse-applicative";
-       version = "0.18.0.0";
-       sha256 = "1ixmjb32b41d7iz87m6bjhf9a2y0k0zj5kv84qkcgmivcqd0n3fj";
+       version = "0.18.1.0";
+       sha256 = "14f4xihvklrdbc0banwzh5wwqfmyi1d34r43hsw2ks16zns1m0b3";
        libraryHaskellDepends = [
-         base prettyprinter prettyprinter-ansi-terminal process transformers
-         transformers-compat
+         base prettyprinter prettyprinter-ansi-terminal process text
+         transformers transformers-compat
        ];
        testHaskellDepends = [ base QuickCheck ];
        description = "Utilities and combinators for parsing command line options";
@@ -235804,8 +235949,8 @@ self: {
      }:
      mkDerivation {
        pname = "propellor";
-       version = "5.15";
-       sha256 = "0106ayiadnam0mz1836la0fya4s82cv591r3vc6cdyafzpjzjphk";
+       version = "5.16";
+       sha256 = "12ywc4riq4wr1ylm4gqp4fcszssfz1a6n1xa5da0mwxydklmw6l1";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [
@@ -243073,8 +243218,8 @@ self: {
      }:
      mkDerivation {
        pname = "reactive-banana-automation";
-       version = "0.5.5";
-       sha256 = "13vpmyn68ad1g9885aj6dvgyn07f5blr91k4c3gf77ymlwj1a1zn";
+       version = "0.5.6";
+       sha256 = "161blkyhkff3z0blbrmrwmclhac481njn9ikb3x4ax0yfa1lpsvq";
        libraryHaskellDepends = [
          base reactive-banana stm time transformers
        ];
@@ -248354,6 +248499,23 @@ self: {
        license = lib.licenses.bsd2;
      }) {};
 
+  "replace-attoparsec_1_5_0_0" = callPackage
+    ({ mkDerivation, attoparsec, base, bytestring, hspec, HUnit
+     , parsers, text
+     }:
+     mkDerivation {
+       pname = "replace-attoparsec";
+       version = "1.5.0.0";
+       sha256 = "1pv24qlng92ywy6xpprvn3yzcndngww4ki6nih4vpd4hzsp534zl";
+       libraryHaskellDepends = [ attoparsec base bytestring text ];
+       testHaskellDepends = [
+         attoparsec base bytestring hspec HUnit parsers text
+       ];
+       description = "Find, replace, split string patterns with Attoparsec parsers (instead of regex)";
+       license = lib.licenses.bsd2;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "replace-megaparsec" = callPackage
     ({ mkDerivation, base, bytestring, Cabal, megaparsec
      , parser-combinators, text
@@ -248371,6 +248533,24 @@ self: {
        maintainers = [ lib.maintainers.maralorn ];
      }) {};
 
+  "replace-megaparsec_1_5_0_1" = callPackage
+    ({ mkDerivation, base, bytestring, hspec, megaparsec
+     , parser-combinators, text
+     }:
+     mkDerivation {
+       pname = "replace-megaparsec";
+       version = "1.5.0.1";
+       sha256 = "134ns97fhsg0a0jn5pjfnbv9jj40p0ljinx7y572gaw0lpfwc4x1";
+       libraryHaskellDepends = [
+         base bytestring megaparsec parser-combinators text
+       ];
+       testHaskellDepends = [ base bytestring hspec megaparsec text ];
+       description = "Find, replace, split string patterns with Megaparsec parsers (instead of regex)";
+       license = lib.licenses.bsd2;
+       hydraPlatforms = lib.platforms.none;
+       maintainers = [ lib.maintainers.maralorn ];
+     }) {};
+
   "replica" = callPackage
     ({ mkDerivation, aeson, base, bytestring, containers, Diff
      , file-embed, http-types, QuickCheck, quickcheck-instances
@@ -255157,15 +255337,15 @@ self: {
      }:
      mkDerivation {
        pname = "sasha";
-       version = "0.1";
-       sha256 = "08975i8qayq2ybsk13wkz930f66j5r00l0j924lzs6bs05min81j";
+       version = "0.2";
+       sha256 = "1z99hdbn94ngfinijgsd5x4lllwpyxc8jkf67lk0f6p12jfq7qv0";
        libraryHaskellDepends = [
          base bytestring containers lattices QuickCheck template-haskell
          th-letrec wide-word word8set
        ];
        testHaskellDepends = [
          aeson array base bytestring deepseq lattices tasty tasty-bench
-         tasty-hunit tasty-quickcheck text
+         tasty-hunit tasty-quickcheck template-haskell text
        ];
        testToolDepends = [ alex ];
        description = "A staged lexer generator";
@@ -255482,7 +255662,7 @@ self: {
        license = lib.licenses.mit;
      }) {};
 
-  "sbp_4_14_0" = callPackage
+  "sbp_4_15_0" = callPackage
     ({ mkDerivation, aeson, aeson-pretty, array, base
      , base64-bytestring, basic-prelude, binary, binary-conduit
      , bytestring, cmdargs, conduit, conduit-extra, data-binary-ieee754
@@ -255491,8 +255671,8 @@ self: {
      }:
      mkDerivation {
        pname = "sbp";
-       version = "4.14.0";
-       sha256 = "1ycz6yqab4l9idsr2ks5mwa9mnbvq9vsjyki4lnxaxqg83f8a0lm";
+       version = "4.15.0";
+       sha256 = "1x8gqrrds6ci2s33vrrmw5ndzj22k271zd0wsbvfqg7wpz8ry37f";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [
@@ -266790,6 +266970,18 @@ self: {
        license = lib.licenses.bsd3;
      }) {};
 
+  "simple-prompt_0_2_0_1" = callPackage
+    ({ mkDerivation, base, exceptions, extra, haskeline, time }:
+     mkDerivation {
+       pname = "simple-prompt";
+       version = "0.2.0.1";
+       sha256 = "1bmq1x7raibnlqkjay3gnvsqiiggv2n911vk02z1glly90b5yg21";
+       libraryHaskellDepends = [ base exceptions extra haskeline time ];
+       description = "Simple commandline text prompt functions";
+       license = lib.licenses.bsd3;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "simple-reflect" = callPackage
     ({ mkDerivation, base }:
      mkDerivation {
@@ -279758,8 +279950,8 @@ self: {
     ({ mkDerivation, array, base, io-classes, stm }:
      mkDerivation {
        pname = "strict-stm";
-       version = "1.1.0.0";
-       sha256 = "15yq90fa5i0v3mgrb7yhc6c753ypzpw08lh0ramx38kpv7l1gxvx";
+       version = "1.1.0.1";
+       sha256 = "01lw137aarcwbr5vgrkjrfh1kp9bn7ql31xw9ivw9nwfdhjblz04";
        libraryHaskellDepends = [ array base io-classes stm ];
        description = "Strict STM interface polymorphic over stm implementation";
        license = lib.licenses.asl20;
@@ -289577,8 +289769,8 @@ self: {
      }:
      mkDerivation {
        pname = "terraform-http-backend-pass";
-       version = "0.1.0.0";
-       sha256 = "0cw9vzj5kigz84r2nwxmvva5fmn9r6y78g40icwi1yaby9g9s809";
+       version = "0.1.0.1";
+       sha256 = "0jxgp63b6bwa0402p03inj6sr0slm8ynhf0vin8nq346z7296aij";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [
@@ -292285,8 +292477,8 @@ self: {
        pname = "th-test-utils";
        version = "1.2.1";
        sha256 = "1vk5fj66w7smq4yc614ixh7s78n3djggpzcxmakyxfz01vz20gay";
-       revision = "1";
-       editedCabalFile = "0v8z6pzvbbxywafgmkhkrv5s3cskc1ilabwsbg1ga2hvimm4hgi9";
+       revision = "2";
+       editedCabalFile = "0sjxy0v6g567n0vs8myi3vx0hbhhmd8k3jgjwsmp7zrvhzbfyw91";
        libraryHaskellDepends = [
          base template-haskell th-orphans transformers
        ];
@@ -299356,11 +299548,11 @@ self: {
     ({ mkDerivation, base, ghc-prim, hspec, template-haskell }:
      mkDerivation {
        pname = "tuple-append";
-       version = "0.2.0.0";
-       sha256 = "18516636w3bgwvymdbzw1971fhja7lrpwx78nz5n67qq23il7rrq";
+       version = "0.3.0.0";
+       sha256 = "1zg2l5is9329b47cbkkkipgy2xnrpjwvh8mf65jrr2h8mc3bka6h";
        libraryHaskellDepends = [ base ghc-prim template-haskell ];
        testHaskellDepends = [ base ghc-prim hspec ];
-       description = "A package to append items and tuples into new tuples";
+       description = "A package to append, sequence and fold items and tuples into new tuples";
        license = lib.licenses.bsd3;
        hydraPlatforms = lib.platforms.none;
        broken = true;
diff --git a/pkgs/development/libraries/webkitgtk/default.nix b/pkgs/development/libraries/webkitgtk/default.nix
index 2d6948d2ada0..5407a74ee2ba 100644
--- a/pkgs/development/libraries/webkitgtk/default.nix
+++ b/pkgs/development/libraries/webkitgtk/default.nix
@@ -71,7 +71,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "webkitgtk";
-  version = "2.40.1";
+  version = "2.40.2";
   name = "${finalAttrs.pname}-${finalAttrs.version}+abi=${if lib.versionAtLeast gtk3.version "4.0" then "6.0" else "4.${if lib.versions.major libsoup.version == "2" then "0" else "1"}"}";
 
   outputs = [ "out" "dev" "devdoc" ];
@@ -82,7 +82,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://webkitgtk.org/releases/webkitgtk-${finalAttrs.version}.tar.xz";
-    hash = "sha256-ZOUmmE+M0hYe8DrpSa+ZwAL/Mz1hXmOGtGAWSjwbfvY=";
+    hash = "sha256-lomIcNmU2kBu56YygW3N6aO7OV7l80T8s/O4zIp34AA=";
   };
 
   patches = lib.optionals stdenv.isLinux [
@@ -173,13 +173,11 @@ stdenv.mkDerivation (finalAttrs: {
       install -Dm444 "${lib.getDev apple_sdk.sdk}"/include/libproc.h "$out"/include/libproc.h
     ''
   ) ++ lib.optionals stdenv.isLinux [
-    bubblewrap
     libseccomp
     libmanette
     wayland
     libwpe
     libwpe-fdo
-    xdg-dbus-proxy
   ] ++ lib.optionals systemdSupport [
     systemd
   ] ++ lib.optionals enableGeoLocation [
@@ -204,6 +202,11 @@ stdenv.mkDerivation (finalAttrs: {
     "-DUSE_LIBHYPHEN=OFF"
     "-DUSE_SOUP2=${cmakeBool (lib.versions.major libsoup.version == "2")}"
     "-DUSE_LIBSECRET=${cmakeBool withLibsecret}"
+  ] ++ lib.optionals stdenv.isLinux [
+    # Have to be explicitly specified when cross.
+    # https://github.com/WebKit/WebKit/commit/a84036c6d1d66d723f217a4c29eee76f2039a353
+    "-DBWRAP_EXECUTABLE=${lib.getExe bubblewrap}"
+    "-DDBUS_PROXY_EXECUTABLE=${lib.getExe xdg-dbus-proxy}"
   ] ++ lib.optionals stdenv.isDarwin [
     "-DENABLE_GAMEPAD=OFF"
     "-DENABLE_GTKDOC=OFF"
diff --git a/pkgs/development/ocaml-modules/benchmark/default.nix b/pkgs/development/ocaml-modules/benchmark/default.nix
index 6c579e127184..b0e17054eb53 100644
--- a/pkgs/development/ocaml-modules/benchmark/default.nix
+++ b/pkgs/development/ocaml-modules/benchmark/default.nix
@@ -1,26 +1,17 @@
-{ stdenv, lib, fetchzip, ocaml, findlib, ocamlbuild, ocaml_pcre }:
+{ lib, fetchurl, buildDunePackage }:
 
-stdenv.mkDerivation rec {
-  pname = "ocaml${ocaml.version}-benchmark";
-  version = "1.4";
+buildDunePackage rec {
+  pname = "benchmark";
+  version = "1.6";
 
-  src = fetchzip {
-    url = "https://github.com/Chris00/ocaml-benchmark/releases/download/${version}/benchmark-${version}.tar.gz";
-    sha256 = "16wi8ld7c3mq77ylpgbnj8qqqqimyzwxs47v06vyrwpma5pab5xa";
+  src = fetchurl {
+    url = "https://github.com/Chris00/ocaml-benchmark/releases/download/${version}/benchmark-${version}.tbz";
+    hash = "sha256-Mw19cYya/MEy52PVRYE/B6TnqCWw5tEz9CUrUfKAnPA=";
   };
 
-  strictDeps = true;
-
-  nativeBuildInputs = [ ocaml findlib ocamlbuild ];
-  buildInputs = [ ocaml_pcre ];
-
-  createFindlibDestdir = true;
-
   meta = {
-    homepage = "http://ocaml-benchmark.forge.ocamlcore.org/";
-    inherit (ocaml.meta) platforms;
+    homepage = "https://github.com/Chris00/ocaml-benchmark";
     description = "Benchmark running times of code";
     license = lib.licenses.lgpl21;
-    maintainers = with lib.maintainers; [ ];
   };
 }
diff --git a/pkgs/development/ocaml-modules/janestreet/0.15.nix b/pkgs/development/ocaml-modules/janestreet/0.15.nix
index a0d5edc7bf87..969dadb9f55a 100644
--- a/pkgs/development/ocaml-modules/janestreet/0.15.nix
+++ b/pkgs/development/ocaml-modules/janestreet/0.15.nix
@@ -1060,7 +1060,8 @@ with self;
 
   virtual_dom = janePackage {
     pname = "virtual_dom";
-    hash = "15xia9v4ighzm0gv3vbqk9nvg47cvzqmfnl2zr67yxv4b98kyzv3";
+    version = "0.15.1";
+    hash = "sha256-Uv6ZDxz2/H0nHjiycUKNQwy/zZyHHmwDEHknFHwDuDs=";
     meta.description = "OCaml bindings for the virtual-dom library";
     buildInputs = [ js_of_ocaml-ppx ];
     propagatedBuildInputs = [ core_kernel gen_js_api js_of_ocaml lambdasoup tyxml ];
diff --git a/pkgs/development/ocaml-modules/rope/default.nix b/pkgs/development/ocaml-modules/rope/default.nix
index 302237c3fe7f..ff4f304d6851 100644
--- a/pkgs/development/ocaml-modules/rope/default.nix
+++ b/pkgs/development/ocaml-modules/rope/default.nix
@@ -1,45 +1,24 @@
-{ stdenv, lib, fetchurl, ocaml, findlib, ocamlbuild, dune_2, benchmark }:
+{ lib, fetchurl, ocaml, buildDunePackage, benchmark }:
 
-let param =
-  if lib.versionAtLeast ocaml.version "4.03"
-  then rec {
-    version = "0.6.2";
-    url = "https://github.com/Chris00/ocaml-rope/releases/download/${version}/rope-${version}.tbz";
-    sha256 = "15cvfa0s1vjx7gjd07d3fkznilishqf4z4h2q5f20wm9ysjh2h2i";
-    nativeBuildInputs = [ dune_2 ];
-    extra = {
-      buildPhase = "dune build -p rope";
-      installPhase = ''
-        dune install --prefix $out --libdir $OCAMLFIND_DESTDIR rope
-      '';
-    };
-  } else {
-    version = "0.5";
-    url = "https://forge.ocamlcore.org/frs/download.php/1156/rope-0.5.tar.gz";
-    sha256 = "05fr2f5ch2rqhyaj06rv5218sbg99p1m9pq5sklk04hpslxig21f";
-    nativeBuildInputs = [ ocamlbuild ];
-    extra = { createFindlibDestdir = true; };
-  };
-in
+lib.throwIf (lib.versionAtLeast ocaml.version "5.0")
+  "rope is not available for OCaml ${ocaml.version}"
 
-stdenv.mkDerivation ({
-  pname = "ocaml${ocaml.version}-rope";
-  inherit (param) version;
+buildDunePackage rec {
+  pname = "rope";
+  version = "0.6.2";
+  minimalOCamlVersion = "4.03";
 
   src = fetchurl {
-    inherit (param) url sha256;
+    url = "https://github.com/Chris00/ocaml-rope/releases/download/${version}/rope-${version}.tbz";
+    sha256 = "15cvfa0s1vjx7gjd07d3fkznilishqf4z4h2q5f20wm9ysjh2h2i";
   };
 
-  nativeBuildInputs = [ ocaml findlib ] ++ param.nativeBuildInputs;
   buildInputs = [ benchmark ] ;
 
-  strictDeps = true;
-
   meta = {
-    homepage = "http://rope.forge.ocamlcore.org/";
-    inherit (ocaml.meta) platforms;
-    description = ''Ropes ("heavyweight strings") in OCaml'';
+    homepage = "https://github.com/Chris00/ocaml-rope";
+    description = "Ropes (“heavyweight strings”) in OCaml";
     license = lib.licenses.lgpl21;
     maintainers = with lib.maintainers; [ ];
   };
-} // param.extra)
+}
diff --git a/pkgs/development/ocaml-modules/uuidm/default.nix b/pkgs/development/ocaml-modules/uuidm/default.nix
index bece082f6418..949737d28ee0 100644
--- a/pkgs/development/ocaml-modules/uuidm/default.nix
+++ b/pkgs/development/ocaml-modules/uuidm/default.nix
@@ -11,6 +11,10 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-/GZbkJVDQu1UY8SliK282kUWAVMfOnpQadUlRT/tJrM=";
   };
 
+  postPatch = ''
+    substituteInPlace pkg/META --replace "bytes" ""
+  '';
+
   strictDeps = true;
 
   nativeBuildInputs = [ ocaml findlib ocamlbuild topkg ];
diff --git a/pkgs/development/php-packages/pdepend/default.nix b/pkgs/development/php-packages/pdepend/default.nix
index ff98ff2b8bda..9e8bdd2ee1ec 100644
--- a/pkgs/development/php-packages/pdepend/default.nix
+++ b/pkgs/development/php-packages/pdepend/default.nix
@@ -2,14 +2,14 @@
 
 let
   pname = "pdepend";
-  version = "2.13.0";
+  version = "2.14.0";
 in
 stdenv.mkDerivation {
   inherit pname version;
 
   src = fetchurl {
     url = "https://github.com/pdepend/pdepend/releases/download/${version}/pdepend.phar";
-    sha256 = "sha256-cd76PoHzAqsRxQzvklyEIsNO+4jByK8Mwx1aNu8rnnk=";
+    sha256 = "sha256-t6Yf+z/8O/tZuYoLAZo2G5bORh8XPeEMdK57dWjHsmk=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/development/python-modules/aioslimproto/default.nix b/pkgs/development/python-modules/aioslimproto/default.nix
index c790d12b1bfa..ea28ec87ae61 100644
--- a/pkgs/development/python-modules/aioslimproto/default.nix
+++ b/pkgs/development/python-modules/aioslimproto/default.nix
@@ -1,4 +1,5 @@
 { lib
+, async-timeout
 , buildPythonPackage
 , fetchFromGitHub
 , pytestCheckHook
@@ -7,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "aioslimproto";
-  version = "2.2.0";
+  version = "2.2.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
@@ -16,9 +17,13 @@ buildPythonPackage rec {
     owner = "home-assistant-libs";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-3aLAAUaoGkdzjUHFb6aiyVv0fzO8DojN0Y3DTf6h2Ow=";
+    hash = "sha256-ku96N3n71mrYuott6E6UwbloP6RzM9tiEATvYHzdYnM=";
   };
 
+  propagatedBuildInputs = [
+    async-timeout
+  ];
+
   nativeCheckInputs = [
     pytestCheckHook
   ];
diff --git a/pkgs/development/python-modules/griffe/default.nix b/pkgs/development/python-modules/griffe/default.nix
index c6f968029115..09b90556e614 100644
--- a/pkgs/development/python-modules/griffe/default.nix
+++ b/pkgs/development/python-modules/griffe/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "griffe";
-  version = "0.26.0";
+  version = "0.29.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "mkdocstrings";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-p5JYBVvKvqKdYIYFh8ZiEgepJips9jg/6ao5yZ/fbcs=";
+    hash = "sha256-WZJogwxhSScJpTFVJaMn6LyIyZtOAxTnY3232NW0bds=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/ibm-cloud-sdk-core/default.nix b/pkgs/development/python-modules/ibm-cloud-sdk-core/default.nix
index 39cab90db288..962658a15f2b 100644
--- a/pkgs/development/python-modules/ibm-cloud-sdk-core/default.nix
+++ b/pkgs/development/python-modules/ibm-cloud-sdk-core/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "ibm-cloud-sdk-core";
-  version = "3.16.5";
+  version = "3.16.6";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-wEBD1AILyVGK+ofQf/zZTu7keBUphVZ5HyOMbugvA+Y=";
+    hash = "sha256-lFpaMteVj8TBpcK1zLV95TwG3zY3PZG7QUzY0/LSF/c=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/tubeup/default.nix b/pkgs/development/python-modules/tubeup/default.nix
index f060521da90d..a61e0f33e99d 100644
--- a/pkgs/development/python-modules/tubeup/default.nix
+++ b/pkgs/development/python-modules/tubeup/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "tubeup";
-  version = "28.5.2023";
+  version = "2023.5.29";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-wsYap8OspTPW3BBtFF3a2oyRgmu3W/dywbkFuNjvzhg=";
+    sha256 = "sha256-5tvRaIXVzZcNy40uOEPwwN4EKPvvZPiR3qIdmiZSXWw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/bazel-gazelle/default.nix b/pkgs/development/tools/bazel-gazelle/default.nix
index 51fc1410c659..e31ddd0b3768 100644
--- a/pkgs/development/tools/bazel-gazelle/default.nix
+++ b/pkgs/development/tools/bazel-gazelle/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "bazel-gazelle";
-  version = "0.30.0";
+  version = "0.31.0";
 
   src = fetchFromGitHub {
     owner = "bazelbuild";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-95nA6IEuAIh/6J6G2jADz3UKpQj5wybQ1HpaHSI+QRo=";
+    sha256 = "sha256-Y1otQcGtG7jIJE5G0DET8bFRVL6AEG0r98X5PufT7Lw=";
   };
 
   vendorHash = null;
diff --git a/pkgs/development/tools/language-servers/gopls/default.nix b/pkgs/development/tools/language-servers/gopls/default.nix
index ca0a0b5638fe..f6697e6d8099 100644
--- a/pkgs/development/tools/language-servers/gopls/default.nix
+++ b/pkgs/development/tools/language-servers/gopls/default.nix
@@ -2,17 +2,17 @@
 
 buildGoModule rec {
   pname = "gopls";
-  version = "0.11.0";
+  version = "0.12.0";
 
   src = fetchFromGitHub {
     owner = "golang";
     repo = "tools";
     rev = "gopls/v${version}";
-    sha256 = "sha256-49TDAxFx4kSwCn1YGQgMn3xLG3RHCCttMzqUfm4OPtE=";
+    sha256 = "sha256-y9FgB8Qsm5wQ7dtrKrcl/bHTw04eRU1B7a+aZmA+eBE=";
   };
 
   modRoot = "gopls";
-  vendorSha256 = "sha256-1/stMvxsCs2OPMN7KGbZ61s2qGT5Yg7kHVHsWi6ekcY=";
+  vendorSha256 = "sha256-MkldIbp7BpdfyapiJ1E4h3ft6g74zMb72tt4tCJlJz8=";
 
   doCheck = false;
 
diff --git a/pkgs/development/tools/misc/opengrok/default.nix b/pkgs/development/tools/misc/opengrok/default.nix
index 8fe08ac6a609..49b0b6f3b919 100644
--- a/pkgs/development/tools/misc/opengrok/default.nix
+++ b/pkgs/development/tools/misc/opengrok/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "opengrok";
-  version = "1.12.7";
+  version = "1.12.9";
 
   # binary distribution
   src = fetchurl {
     url = "https://github.com/oracle/opengrok/releases/download/${version}/${pname}-${version}.tar.gz";
-    hash = "sha256-4Nq+/yr+MhY4D0yZZSzl3etQEUCGIJjcuaP6ZFGLMpY=";
+    hash = "sha256-8VyCMFFL85qqnkO66qobB0OzF8DWfpjkc8Jxbp8FtH0=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
@@ -26,6 +26,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Source code search and cross reference engine";
     homepage = "https://opengrok.github.io/OpenGrok/";
+    changelog = "https://github.com/oracle/opengrok/releases/tag/${version}";
     license = licenses.cddl;
     maintainers = [ ];
     platforms = platforms.all;
diff --git a/pkgs/development/tools/rust/cargo-make/default.nix b/pkgs/development/tools/rust/cargo-make/default.nix
index a4d6bad29549..67254a9ad2f5 100644
--- a/pkgs/development/tools/rust/cargo-make/default.nix
+++ b/pkgs/development/tools/rust/cargo-make/default.nix
@@ -13,11 +13,11 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-make";
-  version = "0.36.7";
+  version = "0.36.8";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-OE24RKbSWylX2dXkjBMZ8Va9ONVeMKG/BVdlZD6O+Yc=";
+    sha256 = "sha256-YLkeGLpNklXFOZ4bKn0GxWIEl9U77+PtAm8WxpDd1a4=";
   };
 
   nativeBuildInputs = [ pkg-config ];
@@ -25,7 +25,7 @@ rustPlatform.buildRustPackage rec {
   buildInputs = [ openssl ]
     ++ lib.optionals stdenv.isDarwin [ Security SystemConfiguration libiconv ];
 
-  cargoHash = "sha256-AAZYY9CbLbbvWWMhkHOc8OhzmwSFXSL9jSga3qMbkDU=";
+  cargoHash = "sha256-JSMBJYwm/QH1W6j4X+1YLnzKlGizsiu/NI2A1wTXpJk=";
 
   # Some tests fail because they need network access.
   # However, Travis ensures a proper build.
diff --git a/pkgs/os-specific/linux/kernel/linux-testing.nix b/pkgs/os-specific/linux/kernel/linux-testing.nix
index d01d9d4d78e5..e30689cdd3ea 100644
--- a/pkgs/os-specific/linux/kernel/linux-testing.nix
+++ b/pkgs/os-specific/linux/kernel/linux-testing.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "6.4-rc3";
+  version = "6.4-rc4";
   extraMeta.branch = lib.versions.majorMinor version;
 
   # modDirVersion needs to be x.y.z, will always add .0
@@ -11,7 +11,7 @@ buildLinux (args // rec {
 
   src = fetchzip {
     url = "https://git.kernel.org/torvalds/t/linux-${version}.tar.gz";
-    hash = "sha256-twGP2zNNkxJy32wCCMlkGtV1xco05FeW2s3wljwB1eM=";
+    hash = "sha256-PlxGRb4wKjamEDrSWpKXLxa7aX9lQoDgrjjrWhArisk=";
   };
 
   # Should the testing kernels ever be built on Hydra?
diff --git a/pkgs/os-specific/linux/lenovo-legion/app.nix b/pkgs/os-specific/linux/lenovo-legion/app.nix
new file mode 100644
index 000000000000..ba189767bca6
--- /dev/null
+++ b/pkgs/os-specific/linux/lenovo-legion/app.nix
@@ -0,0 +1,48 @@
+{ lib, fetchFromGitHub, xorg, libsForQt5, wrapQtAppsHook, python3 }:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "lenovo-legion-app";
+  version = "2023-04-02-16-53-51";
+
+  src = fetchFromGitHub {
+    owner = "johnfanv2";
+    repo = "LenovoLegionLinux";
+    rev = "main${version}";
+    sha256 = "sha256-s4JFFmawokdC4qoqNvZDhuJSinhQ3YKSIfAYi79VTTA=";
+  };
+
+  sourceRoot = "source/python/legion_linux";
+
+  nativeBuildInputs = [ wrapQtAppsHook ];
+
+  propagatedBuildInputs = with python3.pkgs; [
+    pyqt5
+    argcomplete
+    pyyaml
+    xorg.libxcb
+    libsForQt5.qtbase
+  ];
+
+  postInstall = ''
+    cp -r ./{legion.py,legion_cli.py,legion_gui.py} $out/${python3.sitePackages}
+    cp ./legion_logo.png $out/${python3.sitePackages}/legion_logo.png
+
+    rm -rf $out/data
+  '';
+
+  dontWrapQtApps = true;
+
+  preFixup = ''
+    makeWrapperArgs+=("''${qtWrapperArgs[@]}")
+  '';
+
+  meta = {
+    description = "An utility to control Lenovo Legion laptop";
+    homepage = "https://github.com/johnfanv2/LenovoLegionLinux";
+    license = lib.licenses.gpl2Only;
+    platforms = lib.platforms.linux;
+    maintainers = [ lib.maintainers.ulrikstrid ];
+    mainProgram = "legion_gui";
+  };
+}
+
diff --git a/pkgs/os-specific/linux/lenovo-legion/default.nix b/pkgs/os-specific/linux/lenovo-legion/default.nix
new file mode 100644
index 000000000000..375b835ac47d
--- /dev/null
+++ b/pkgs/os-specific/linux/lenovo-legion/default.nix
@@ -0,0 +1,34 @@
+{ lib, fetchurl, stdenv, kernel, bash, lenovo-legion }:
+
+stdenv.mkDerivation {
+  pname = "lenovo-legion-module";
+  inherit (lenovo-legion) version src;
+
+  sourceRoot = "source/kernel_module";
+
+  hardeningDisable = [ "pic" ];
+
+  preConfigure = ''
+    sed -i -e '/depmod/d' ./Makefile
+  '';
+
+  makeFlags = kernel.makeFlags ++ [
+    "SHELL=bash"
+    "KERNELVERSION=${kernel.modDirVersion}"
+    "KSRC=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+    "INSTALLDIR=${placeholder "out"}/lib/modules/${kernel.modDirVersion}/kernel/drivers/platform/x86"
+    "MODDESTDIR=${placeholder "out"}/lib/modules/${kernel.modDirVersion}/kernel/drivers/platform/x86"
+    "DKMSDIR=${placeholder "out"}/lib/modules/${kernel.modDirVersion}/misc"
+  ];
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  meta = {
+    description = "Linux kernel module for controlling fan and power in Lenovo Legion laptops";
+    homepage = "https://github.com/johnfanv2/LenovoLegionLinux";
+    license = lib.licenses.gpl2Only;
+    platforms = lib.platforms.linux;
+    maintainers = [ lib.maintainers.ulrikstrid ];
+    broken = kernel.kernelOlder "5.15";
+  };
+}
diff --git a/pkgs/servers/minio/default.nix b/pkgs/servers/minio/default.nix
index 37fdd28e702b..775b4353ab61 100644
--- a/pkgs/servers/minio/default.nix
+++ b/pkgs/servers/minio/default.nix
@@ -15,16 +15,16 @@ let
 in
 buildGoModule rec {
   pname = "minio";
-  version = "2023-05-18T00-05-36Z";
+  version = "2023-05-27T05-56-19Z";
 
   src = fetchFromGitHub {
     owner = "minio";
     repo = "minio";
     rev = "RELEASE.${version}";
-    sha256 = "sha256-VOv5gYjoHPO4MuiQHN7nX5IghoOeqj3/vu/vILGv/yA=";
+    sha256 = "sha256-HwyPrXywhJ0D/eelcPOE8CPrEeJkaLr7wMdW5O+8cZA=";
   };
 
-  vendorHash = "sha256-ZwkToIEzbU1PYxxQCGc+Zkiu7SkO83oJFzwi4Qyqzn0=";
+  vendorHash = "sha256-jvJM4I5ruDYwJsB258aZ3UP9FjtzYc0XSYpXdjqafMI=";
 
   doCheck = false;
 
diff --git a/pkgs/servers/radarr/default.nix b/pkgs/servers/radarr/default.nix
index 4f4773603a2d..8ba80f915291 100644
--- a/pkgs/servers/radarr/default.nix
+++ b/pkgs/servers/radarr/default.nix
@@ -9,14 +9,14 @@ let
   }."${stdenv.hostPlatform.system}" or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
 
   hash = {
-    x64-linux_hash = "sha256-Cx4cxpMoD1XY4GN3xBTCTxGwA3AbCQH3LLiqY1VyG68=";
-    arm64-linux_hash = "sha256-seJljPCfv/M6+0GpAeIyrxf9ueKy/83mMviP8Y1o390=";
-    x64-osx_hash = "sha256-J8w8ECHLWnlOcoB9X4qb8y19/W+nMQSxcPv/Ntq7FPY=";
+    x64-linux_hash = "sha256-BJKEl75VNr2dN/P1NeYuOYmrDJEIc8pGS2rszibVGbQ=";
+    arm64-linux_hash = "sha256-1qGx3rM8sjLhzCNnyUjTWs+EGLzmm12h/o08QmvXxts=";
+    x64-osx_hash = "sha256-+afi+BQGrJb+i91IDKZEqRS6xAMvU1C5XmZs6H5rgoI=";
   }."${arch}-${os}_hash";
 
 in stdenv.mkDerivation rec {
   pname = "radarr";
-  version = "4.4.4.7068";
+  version = "4.5.2.7388";
 
   src = fetchurl {
     url = "https://github.com/Radarr/Radarr/releases/download/v${version}/Radarr.master.${version}.${os}-core-${arch}.tar.gz";
diff --git a/pkgs/servers/sql/postgresql/ext/pgroonga.nix b/pkgs/servers/sql/postgresql/ext/pgroonga.nix
index 3fdc7c212ce3..4d9b0fce6f2e 100644
--- a/pkgs/servers/sql/postgresql/ext/pgroonga.nix
+++ b/pkgs/servers/sql/postgresql/ext/pgroonga.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "pgroonga";
-  version = "3.0.1";
+  version = "3.0.5";
 
   src = fetchurl {
     url = "https://packages.groonga.org/source/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-lsUtM6AM/AVjDGP9vSzj7Vxx+3+IS4cr7ctmU4C6Ml8=";
+    hash = "sha256-5cVfZk2bFop/EQjvfObiN/AF/iv3DqDIKb/BkbEyKbE=";
   };
 
   nativeBuildInputs = [ pkg-config ];
@@ -33,6 +33,7 @@ stdenv.mkDerivation rec {
       You can use super fast full text search feature against all languages by installing PGroonga into your PostgreSQL.
     '';
     homepage = "https://pgroonga.github.io/";
+    changelog = "https://github.com/pgroonga/pgroonga/releases/tag/${version}";
     license = licenses.postgresql;
     platforms = postgresql.meta.platforms;
     maintainers = with maintainers; [ DerTim1 ];
diff --git a/pkgs/tools/backup/fabs/default.nix b/pkgs/tools/backup/fabs/default.nix
index 47e36b2139fa..f6e9ec291585 100644
--- a/pkgs/tools/backup/fabs/default.nix
+++ b/pkgs/tools/backup/fabs/default.nix
@@ -58,6 +58,7 @@ python3.pkgs.buildPythonApplication rec {
     homepage = "https://github.com/openafs-contrib/fabs";
     license = with licenses; [ isc ];
     maintainers = with maintainers; [ spacefrogg ];
+    broken = lib.versionAtLeast python3.pkgs.sqlalchemy.version "2.0";
     badPlatforms = [
       "x86_64-darwin"
       "aarch64-darwin"
diff --git a/pkgs/tools/graphics/resvg/default.nix b/pkgs/tools/graphics/resvg/default.nix
index 6624d16243a1..d1cdcc3df49d 100644
--- a/pkgs/tools/graphics/resvg/default.nix
+++ b/pkgs/tools/graphics/resvg/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "resvg";
-  version = "0.34.0";
+  version = "0.34.1";
 
   src = fetchFromGitHub {
     owner = "RazrFalcon";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-S0HhaZ8zHcuMmo9mSJwmUXnDExMBsv176lrM9YmSEg8=";
+    hash = "sha256-4sjjd2IKca4NBTCTxhdqdxuzjEMKc85ckRNrNSjhUnE=";
   };
 
-  cargoHash = "sha256-SFQ2w/Um1hgpy+cz+OZoaLjvJPcOa5Wc29v66pt+k3g=";
+  cargoHash = "sha256-PEJjtrsQF4h9rCP1DFFP5EFjW/6ZMgdMCawIc9cW76s=";
 
   cargoBuildFlags = [
     "--package=resvg"
diff --git a/pkgs/tools/networking/v2ray/default.nix b/pkgs/tools/networking/v2ray/default.nix
index ffccea276ea6..b4b49c9992a2 100644
--- a/pkgs/tools/networking/v2ray/default.nix
+++ b/pkgs/tools/networking/v2ray/default.nix
@@ -6,18 +6,18 @@
 
 buildGoModule rec {
   pname = "v2ray-core";
-  version = "5.4.1";
+  version = "5.6.0";
 
   src = fetchFromGitHub {
     owner = "v2fly";
     repo = "v2ray-core";
     rev = "v${version}";
-    hash = "sha256-LrsLkuLoiZb3Y5BUkg9lB+qd0HHbgRNrixm5BdQMKck=";
+    hash = "sha256-4oaxZ+p12HRgA3OVoBYQb9czl+WSHSK1Cc+vYpeeUVM=";
   };
 
   # `nix-update` doesn't support `vendorHash` yet.
   # https://github.com/Mic92/nix-update/pull/95
-  vendorSha256 = "sha256-0uc+oncdOdIhIygr2ktT7f1qHIeyoVEnjyhzsUMjMBY=";
+  vendorSha256 = "sha256-uq0v14cRGmstJabrERsa+vFRX6Bg8+5CU6iV8swrL/I=";
 
   ldflags = [ "-s" "-w" "-buildid=" ];
 
diff --git a/pkgs/tools/package-management/apx/default.nix b/pkgs/tools/package-management/apx/default.nix
index c7e9581d99b2..e1f134a2f5f9 100644
--- a/pkgs/tools/package-management/apx/default.nix
+++ b/pkgs/tools/package-management/apx/default.nix
@@ -9,13 +9,13 @@
 
 buildGoModule rec {
   pname = "apx";
-  version = "1.7.0-1";
+  version = "1.8.2";
 
   src = fetchFromGitHub {
     owner = "Vanilla-OS";
     repo = pname;
-    rev = "v${version}";
-    hash = "sha256-tonI3S0a08MbR369qaKS2BoWc3QzXWzTuGx/zSgUz7s=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-nBhSl4r7LlgCA5/HCLpOleihE5n/JCJgf43KdCklQbg=";
   };
 
   vendorSha256 = null;
@@ -41,13 +41,14 @@ buildGoModule rec {
 
     wrapProgram $out/bin/apx --prefix PATH : ${lib.makeBinPath [ docker distrobox ]}
 
-    installManPage man/apx.1 man/es/apx.1
+    installManPage man/de/man1/apx.1 man/es/man1/apx.1 man/fr/man1/apx.1 man/it/man1/apx.1 man/man1/apx.1 man/nl/man1/apx.1 man/pl/man1/apx.1 man/pt/man1/apx.1 man/pt_BR/man1/apx.1 man/ro/man1/apx.1 man/ru/man1/apx.1 man/sv/man1/apx.1 man/tr/man1/apx.1
   '';
 
   meta = with lib; {
     description = "The Vanilla OS package manager";
     homepage = "https://github.com/Vanilla-OS/apx";
-    license = licenses.gpl3;
+    changelog = "https://github.com/Vanilla-OS/apx/releases/tag/${version}";
+    license = licenses.gpl3Only;
     maintainers = with maintainers; [ dit7ya ];
   };
 }
diff --git a/pkgs/tools/security/metasploit/Gemfile b/pkgs/tools/security/metasploit/Gemfile
index aa82c6d0fe8c..be148a4111f2 100644
--- a/pkgs/tools/security/metasploit/Gemfile
+++ b/pkgs/tools/security/metasploit/Gemfile
@@ -1,4 +1,4 @@
 # frozen_string_literal: true
 source "https://rubygems.org"
 
-gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.3.17"
+gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.3.18"
diff --git a/pkgs/tools/security/metasploit/Gemfile.lock b/pkgs/tools/security/metasploit/Gemfile.lock
index 67ae1e4e8c9a..e3563c05055c 100644
--- a/pkgs/tools/security/metasploit/Gemfile.lock
+++ b/pkgs/tools/security/metasploit/Gemfile.lock
@@ -1,9 +1,9 @@
 GIT
   remote: https://github.com/rapid7/metasploit-framework
-  revision: 3c284b7c96b88e71001fbff4c94a24ee553a8e78
-  ref: refs/tags/6.3.17
+  revision: 3641bc9666de2c52f5be49cb9e8c4a71529f8a75
+  ref: refs/tags/6.3.18
   specs:
-    metasploit-framework (6.3.17)
+    metasploit-framework (6.3.18)
       actionpack (~> 7.0)
       activerecord (~> 7.0)
       activesupport (~> 7.0)
@@ -101,25 +101,25 @@ GEM
   remote: https://rubygems.org/
   specs:
     Ascii85 (1.1.0)
-    actionpack (7.0.4.3)
-      actionview (= 7.0.4.3)
-      activesupport (= 7.0.4.3)
-      rack (~> 2.0, >= 2.2.0)
+    actionpack (7.0.5)
+      actionview (= 7.0.5)
+      activesupport (= 7.0.5)
+      rack (~> 2.0, >= 2.2.4)
       rack-test (>= 0.6.3)
       rails-dom-testing (~> 2.0)
       rails-html-sanitizer (~> 1.0, >= 1.2.0)
-    actionview (7.0.4.3)
-      activesupport (= 7.0.4.3)
+    actionview (7.0.5)
+      activesupport (= 7.0.5)
       builder (~> 3.1)
       erubi (~> 1.4)
       rails-dom-testing (~> 2.0)
       rails-html-sanitizer (~> 1.1, >= 1.2.0)
-    activemodel (7.0.4.3)
-      activesupport (= 7.0.4.3)
-    activerecord (7.0.4.3)
-      activemodel (= 7.0.4.3)
-      activesupport (= 7.0.4.3)
-    activesupport (7.0.4.3)
+    activemodel (7.0.5)
+      activesupport (= 7.0.5)
+    activerecord (7.0.5)
+      activemodel (= 7.0.5)
+      activesupport (= 7.0.5)
+    activesupport (7.0.5)
       concurrent-ruby (~> 1.0, >= 1.0.2)
       i18n (>= 1.6, < 2)
       minitest (>= 5.1)
@@ -130,8 +130,8 @@ GEM
     arel-helpers (2.14.0)
       activerecord (>= 3.1.0, < 8)
     aws-eventstream (1.2.0)
-    aws-partitions (1.767.0)
-    aws-sdk-core (3.173.0)
+    aws-partitions (1.772.0)
+    aws-sdk-core (3.173.1)
       aws-eventstream (~> 1, >= 1.0.2)
       aws-partitions (~> 1, >= 1.651.0)
       aws-sigv4 (~> 1.5)
@@ -180,7 +180,7 @@ GEM
     eventmachine (1.2.7)
     faker (3.2.0)
       i18n (>= 1.8.11, < 2)
-    faraday (2.7.4)
+    faraday (2.7.5)
       faraday-net_http (>= 2.0, < 3.1)
       ruby2_keywords (>= 0.0.4)
     faraday-net_http (3.0.2)
@@ -271,7 +271,7 @@ GEM
     network_interface (0.0.2)
     nexpose (7.3.0)
     nio4r (2.5.9)
-    nokogiri (1.15.1)
+    nokogiri (1.15.2)
       mini_portile2 (~> 2.8.2)
       racc (~> 1.4)
     nori (2.6.0)
@@ -304,11 +304,12 @@ GEM
     rails-dom-testing (2.0.3)
       activesupport (>= 4.2.0)
       nokogiri (>= 1.6)
-    rails-html-sanitizer (1.5.0)
-      loofah (~> 2.19, >= 2.19.1)
-    railties (7.0.4.3)
-      actionpack (= 7.0.4.3)
-      activesupport (= 7.0.4.3)
+    rails-html-sanitizer (1.6.0)
+      loofah (~> 2.21)
+      nokogiri (~> 1.14)
+    railties (7.0.5)
+      actionpack (= 7.0.5)
+      activesupport (= 7.0.5)
       method_source
       rake (>= 12.2)
       thor (~> 1.0)
@@ -445,4 +446,4 @@ DEPENDENCIES
   metasploit-framework!
 
 BUNDLED WITH
-   2.4.12
+   2.4.13
diff --git a/pkgs/tools/security/metasploit/default.nix b/pkgs/tools/security/metasploit/default.nix
index 8c96570d891c..a1639275472b 100644
--- a/pkgs/tools/security/metasploit/default.nix
+++ b/pkgs/tools/security/metasploit/default.nix
@@ -15,13 +15,13 @@ let
   };
 in stdenv.mkDerivation rec {
   pname = "metasploit-framework";
-  version = "6.3.17";
+  version = "6.3.18";
 
   src = fetchFromGitHub {
     owner = "rapid7";
     repo = "metasploit-framework";
     rev = version;
-    sha256 = "sha256-IXEsmLgvd0FQ5Bgs68LHWM0Vk/yIYlkR1m/olSC5CNA=";
+    sha256 = "sha256-IUUxkNLbM+98c0RVguted9t21PEq1WPrVZgfPQQ8tUQ=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/security/metasploit/gemset.nix b/pkgs/tools/security/metasploit/gemset.nix
index 396c7ac2b1db..754a8348f711 100644
--- a/pkgs/tools/security/metasploit/gemset.nix
+++ b/pkgs/tools/security/metasploit/gemset.nix
@@ -4,50 +4,50 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1cb0hqkfkc0b9s7swvi4nf64c24i3ma1gv09anr8a81k56s0rwxd";
+      sha256 = "0w717izq6k7wl2j6zn4516kg2iwg3zgdzja6b6gpk6y5nccr04hw";
       type = "gem";
     };
-    version = "7.0.4.3";
+    version = "7.0.5";
   };
   actionview = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1h9027sqzfcbc84dnzw8nxjyg15zrk1y2fc0468wg1xi9nmyw96z";
+      sha256 = "1z0xvdal339w7jvk7a5py0c1q5xh588vqrilgxizkvzm3hwf48a2";
       type = "gem";
     };
-    version = "7.0.4.3";
+    version = "7.0.5";
   };
   activemodel = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0ymhsxgdb68zgf4zp07g2bymmpgn0b9r38avn9pagz1p5zy1ql9v";
+      sha256 = "0cjbk1xl6jl2d6sczpxnr8da7zbmshmrghqhqdcwqqzl6chcy2si";
       type = "gem";
     };
-    version = "7.0.4.3";
+    version = "7.0.5";
   };
   activerecord = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "01wb98i2zsbb4jcb4i6z72vb05wiks4hv9chc66h1rsxrv0zi4dv";
+      sha256 = "04x0bz3051linhmi52cfg31nsm4sgg27m7wp9p0cxrxdwc7q0bjl";
       type = "gem";
     };
-    version = "7.0.4.3";
+    version = "7.0.5";
   };
   activesupport = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "15m0b1im6i401ab51vzr7f8nk8kys1qa0snnl741y3sir3xd07jp";
+      sha256 = "1c7k5i6531z5il4q1jnbrv7x7zcl3bgnxp5fzl71rzigk6zn53ym";
       type = "gem";
     };
-    version = "7.0.4.3";
+    version = "7.0.5";
   };
   addressable = {
     groups = ["default"];
@@ -104,20 +104,20 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "01pqjxjqc4p2bws67sbvff4kfggzfq0vwgyf9pf6pfmw4z2518m9";
+      sha256 = "18gr9x4pk8mgwgxvnbi8jc3j6dh3np5wfrck15ykpwgw4g0r1qi3";
       type = "gem";
     };
-    version = "1.767.0";
+    version = "1.772.0";
   };
   aws-sdk-core = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "10djgbz4k9w3axka8xrhf97h9yh9svi5g5xvncfwnkg6h22w2177";
+      sha256 = "1xnrn7mixwna9cszlsmps7675kqrs9vv17bsx6ywps5wjp7wyak9";
       type = "gem";
     };
-    version = "3.173.0";
+    version = "3.173.1";
   };
   aws-sdk-ec2 = {
     groups = ["default"];
@@ -364,10 +364,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1f20vjx0ywx0zdb4dfx4cpa7kd51z6vg7dw5hs35laa45dy9g9pj";
+      sha256 = "1fa3y42bhz2ahp33labk8sfw1al9wrr1pkar6i8w9mdpsccygzg4";
       type = "gem";
     };
-    version = "2.7.4";
+    version = "2.7.5";
   };
   faraday-net_http = {
     groups = ["default"];
@@ -624,12 +624,12 @@
     platforms = [];
     source = {
       fetchSubmodules = false;
-      rev = "3c284b7c96b88e71001fbff4c94a24ee553a8e78";
-      sha256 = "1l08p4h9bs3gsq8mjql8zj9ibkaqqz1fnb0qwi842xrgp2c2qw91";
+      rev = "3641bc9666de2c52f5be49cb9e8c4a71529f8a75";
+      sha256 = "0i5m7h23s7wqapmn7m9ay7a7dnvpbvmq4ma4fdyfycyvsa832i91";
       type = "git";
       url = "https://github.com/rapid7/metasploit-framework";
     };
-    version = "6.3.17";
+    version = "6.3.18";
   };
   metasploit-model = {
     groups = ["default"];
@@ -827,10 +827,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "10zmnzk0b6v48s9nyrgnidcinn06m52ph3mzzcjh5q7xrzii3mb8";
+      sha256 = "1mr2ibfk874ncv0qbdkynay738w2mfinlkhnbd5lyk5yiw5q1p10";
       type = "gem";
     };
-    version = "1.15.1";
+    version = "1.15.2";
   };
   nori = {
     groups = ["default"];
@@ -1007,20 +1007,20 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0ygav4xyq943qqyhjmi3mzirn180j565mc9h5j4css59x1sn0cmz";
+      sha256 = "1pm4z853nyz1bhhqr7fzl44alnx4bjachcr6rh6qjj375sfz3sc6";
       type = "gem";
     };
-    version = "1.5.0";
+    version = "1.6.0";
   };
   railties = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0w6pib1s0kmfnhjvxwh48flz7w4gy8y961n821w8by7d1g83vjwq";
+      sha256 = "0kn3cx00jnb7bjnh1k2q0dxk0r7nl1a0krgyk5ykxw1wcac81wyw";
       type = "gem";
     };
-    version = "7.0.4.3";
+    version = "7.0.5";
   };
   rake = {
     groups = ["default"];
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index acbd533f66d1..f9ad5d5529e4 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -32143,6 +32143,8 @@ with pkgs;
 
   lemonbar-xft = callPackage ../applications/window-managers/lemonbar/xft.nix { };
 
+  lenovo-legion = libsForQt5.callPackage ../os-specific/linux/lenovo-legion/app.nix { };
+
   legitify = callPackage ../development/tools/legitify { };
 
   lens = callPackage ../applications/networking/cluster/lens { };
diff --git a/pkgs/top-level/haskell-packages.nix b/pkgs/top-level/haskell-packages.nix
index 86da7a6bbc9f..6001039689c4 100644
--- a/pkgs/top-level/haskell-packages.nix
+++ b/pkgs/top-level/haskell-packages.nix
@@ -29,6 +29,7 @@ let
     "ghc94"
     "ghc96"
     "ghc961"
+    "ghc962"
     "ghcHEAD"
   ];
 
@@ -48,6 +49,7 @@ let
     "ghc945"
     "ghc96"
     "ghc961"
+    "ghc962"
     "ghcHEAD"
   ];
 
@@ -368,7 +370,27 @@ in {
       buildTargetLlvmPackages = pkgsBuildTarget.llvmPackages_14;
       llvmPackages = pkgs.llvmPackages_14;
     };
-    ghc96 = ghc961;
+    ghc962 = callPackage ../development/compilers/ghc/9.6.2.nix {
+      bootPkgs =
+        # For GHC 9.2 no armv7l bindists are available.
+        if stdenv.hostPlatform.isAarch32 then
+          packages.ghc924
+        else if stdenv.hostPlatform.isPower64 && stdenv.hostPlatform.isLittleEndian then
+          packages.ghc924
+        else if stdenv.isAarch64 then
+          packages.ghc924BinaryMinimal
+        else
+          packages.ghc924Binary;
+      inherit (buildPackages.python3Packages) sphinx;
+      # Need to use apple's patched xattr until
+      # https://github.com/xattr/xattr/issues/44 and
+      # https://github.com/xattr/xattr/issues/55 are solved.
+      inherit (buildPackages.darwin) xattr autoSignDarwinBinariesHook;
+      # Support range >= 11 && < 16
+      buildTargetLlvmPackages = pkgsBuildTarget.llvmPackages_15;
+      llvmPackages = pkgs.llvmPackages_15;
+    };
+    ghc96 = ghc962;
     ghcHEAD = callPackage ../development/compilers/ghc/head.nix {
       bootPkgs =
         # For GHC 9.2 no armv7l bindists are available.
@@ -536,7 +558,12 @@ in {
       ghc = bh.compiler.ghc961;
       compilerConfig = callPackage ../development/haskell-modules/configuration-ghc-9.6.x.nix { };
     };
-    ghc96 = ghc961;
+    ghc962 = callPackage ../development/haskell-modules {
+      buildHaskellPackages = bh.packages.ghc962;
+      ghc = bh.compiler.ghc962;
+      compilerConfig = callPackage ../development/haskell-modules/configuration-ghc-9.6.x.nix { };
+    };
+    ghc96 = ghc962;
     ghcHEAD = callPackage ../development/haskell-modules {
       buildHaskellPackages = bh.packages.ghcHEAD;
       ghc = bh.compiler.ghcHEAD;
diff --git a/pkgs/top-level/linux-kernels.nix b/pkgs/top-level/linux-kernels.nix
index f2fad5895ede..4c0d727f5a17 100644
--- a/pkgs/top-level/linux-kernels.nix
+++ b/pkgs/top-level/linux-kernels.nix
@@ -371,6 +371,8 @@ in {
 
     kvdo = callPackage ../os-specific/linux/kvdo {};
 
+    lenovo-legion-module = callPackage ../os-specific/linux/lenovo-legion { };
+
     liquidtux = callPackage ../os-specific/linux/liquidtux {};
 
     lkrg = callPackage ../os-specific/linux/lkrg {};
diff --git a/pkgs/top-level/release-haskell.nix b/pkgs/top-level/release-haskell.nix
index 5a16c97f7c50..09087a3c73e1 100644
--- a/pkgs/top-level/release-haskell.nix
+++ b/pkgs/top-level/release-haskell.nix
@@ -70,6 +70,7 @@ let
     ghc928
     ghc945
     ghc961
+    ghc962
   ];
 
   # packagePlatforms applied to `haskell.packages.*`
@@ -487,12 +488,15 @@ let
       Cabal-syntax_3_10_1_0 = released;
       cabal2nix = lib.subtractLists [
         compilerNames.ghc961
+        compilerNames.ghc962
       ] released;
       cabal2nix-unstable = lib.subtractLists [
         compilerNames.ghc961
+        compilerNames.ghc962
       ] released;
       funcmp = lib.subtractLists [
         compilerNames.ghc961
+        compilerNames.ghc962
       ] released;
       haskell-language-server = lib.subtractLists [
         # Support ceased as of 1.9.0.0
@@ -500,17 +504,21 @@ let
       ] released;
       hoogle = lib.subtractLists [
         compilerNames.ghc961
+        compilerNames.ghc962
       ] released;
       hlint = lib.subtractLists [
         compilerNames.ghc961
+        compilerNames.ghc962
       ] released;
       hpack = lib.subtractLists [
         compilerNames.ghc961
+        compilerNames.ghc962
       ] released;
       hsdns = released;
       jailbreak-cabal = released;
       language-nix = lib.subtractLists [
         compilerNames.ghc961
+        compilerNames.ghc962
       ] released;
       nix-paths = released;
       titlecase = released;