diff --git a/lib/licenses.nix b/lib/licenses.nix
index 00f469b61a8e..2bca8d36b560 100644
--- a/lib/licenses.nix
+++ b/lib/licenses.nix
@@ -224,6 +224,12 @@ in mkLicense lset) ({
     fullName = "Creative Commons Zero v1.0 Universal";
   };
 
+  cc-by-nc-nd-30 = {
+    spdxId = "CC-BY-NC-ND-3.0";
+    fullName = "Creative Commons Attribution Non Commercial No Derivative Works 3.0 Unported";
+    free = false;
+  };
+
   cc-by-nc-sa-20 = {
     spdxId = "CC-BY-NC-SA-2.0";
     fullName = "Creative Commons Attribution Non Commercial Share Alike 2.0";
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 183f18e3042d..eb640d2474b1 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -5256,6 +5256,12 @@
     githubId = 606000;
     name = "Gabriel Adomnicai";
   };
+  GabrielDougherty = {
+    email = "contact@gabrieldougherty.com";
+    github = "GabrielDougherty";
+    githubId = 10541219;
+    name = "Gabriel Dougherty";
+  };
   garaiza-93 = {
     email = "araizagustavo93@gmail.com";
     github = "garaiza-93";
@@ -8074,6 +8080,13 @@
     githubId = 15692230;
     name = "Muhammad Herdiansyah";
   };
+  konradmalik = {
+    email = "konrad.malik@gmail.com";
+    matrix = "@konradmalik:matrix.org";
+    name = "Konrad Malik";
+    github = "konradmalik";
+    githubId = 13033392;
+  };
   koozz = {
     email = "koozz@linux.com";
     github = "koozz";
@@ -9848,6 +9861,12 @@
     githubId = 5378535;
     name = "Milo Gertjejansen";
   };
+  milran = {
+    email = "milranmike@protonmail.com";
+    github = "milran";
+    githubId = 93639059;
+    name = "Milran Mike";
+  };
   mimame = {
     email = "miguel.madrid.mencia@gmail.com";
     github = "mimame";
diff --git a/nixos/modules/programs/waybar.nix b/nixos/modules/programs/waybar.nix
index 4697d0f7a622..2c49ae140813 100644
--- a/nixos/modules/programs/waybar.nix
+++ b/nixos/modules/programs/waybar.nix
@@ -2,17 +2,22 @@
 
 with lib;
 
+let
+  cfg = config.programs.waybar;
+in
 {
   options.programs.waybar = {
     enable = mkEnableOption (lib.mdDoc "waybar");
+    package = mkPackageOptionMD pkgs "waybar" { };
   };
 
-  config = mkIf config.programs.waybar.enable {
+  config = mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
     systemd.user.services.waybar = {
       description = "Waybar as systemd service";
       wantedBy = [ "graphical-session.target" ];
       partOf = [ "graphical-session.target" ];
-      script = "${pkgs.waybar}/bin/waybar";
+      script = "${cfg.package}/bin/waybar";
     };
   };
 
diff --git a/pkgs/applications/audio/audacious/default.nix b/pkgs/applications/audio/audacious/default.nix
index eb404041d973..19b347ab459c 100644
--- a/pkgs/applications/audio/audacious/default.nix
+++ b/pkgs/applications/audio/audacious/default.nix
@@ -12,11 +12,11 @@
 
 stdenv.mkDerivation rec {
   pname = "audacious";
-  version = "4.2";
+  version = "4.3";
 
   src = fetchurl {
     url = "http://distfiles.audacious-media-player.org/audacious-${version}.tar.bz2";
-    sha256 = "sha256-/rME5HCkgf4rPEyhycs7I+wmJUDBLQ0ebCKl62JeBLM=";
+    sha256 = "sha256-J1hNyEXH5w24ySZ5kJRfFzIqHsyA/4tFLpypFqDOkJE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/audio/audacious/plugins.nix b/pkgs/applications/audio/audacious/plugins.nix
index 902140465334..bd9bb5149747 100644
--- a/pkgs/applications/audio/audacious/plugins.nix
+++ b/pkgs/applications/audio/audacious/plugins.nix
@@ -35,6 +35,8 @@
 , neon
 , ninja
 , pkg-config
+, opusfile
+, pipewire
 , qtbase
 , qtmultimedia
 , qtx11extras
@@ -44,11 +46,11 @@
 
 stdenv.mkDerivation rec {
   pname = "audacious-plugins";
-  version = "4.2";
+  version = "4.3";
 
   src = fetchurl {
     url = "http://distfiles.audacious-media-player.org/audacious-plugins-${version}.tar.bz2";
-    sha256 = "sha256-b6D2nDoQQeuHfDcQlROrSioKVqd9nowToVgc8UOaQX8=";
+    sha256 = "sha256-Zi72yMS9cNDzX9HF8IuRVJuUNmOLZfihozlWsJ34n8Y=";
   };
 
   patches = [ ./0001-Set-plugindir-to-PREFIX-lib-audacious.patch ];
@@ -91,6 +93,8 @@ stdenv.mkDerivation rec {
     lirc
     mpg123
     neon
+    opusfile
+    pipewire
     qtbase
     qtmultimedia
     qtx11extras
diff --git a/pkgs/applications/audio/linvstmanager/default.nix b/pkgs/applications/audio/linvstmanager/default.nix
new file mode 100644
index 000000000000..dc8376c4166f
--- /dev/null
+++ b/pkgs/applications/audio/linvstmanager/default.nix
@@ -0,0 +1,36 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, qtbase
+, wrapQtAppsHook
+}:
+
+stdenv.mkDerivation rec {
+  pname = "linvstmanager";
+  version = "1.1.1";
+
+  src = fetchFromGitHub {
+    owner = "Goli4thus";
+    repo = "linvstmanager";
+    rev = "v${version}";
+    hash = "sha256-K6eugimMy/MZgHYkg+zfF8DDqUuqqoeymxHtcFGu2Uk=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    wrapQtAppsHook
+  ];
+
+  buildInputs = [
+    qtbase
+  ];
+
+  meta = with lib; {
+    description = "Graphical companion application for various bridges like LinVst, etc";
+    homepage = "https://github.com/Goli4thus/linvstmanager";
+    license = with licenses; [ gpl3 ];
+    platforms = platforms.linux;
+    maintainers = [ maintainers.GabrielDougherty ];
+  };
+}
diff --git a/pkgs/applications/audio/sonic-pi/default.nix b/pkgs/applications/audio/sonic-pi/default.nix
index 8d10b2f2a34b..89ef9d848148 100644
--- a/pkgs/applications/audio/sonic-pi/default.nix
+++ b/pkgs/applications/audio/sonic-pi/default.nix
@@ -63,6 +63,7 @@ stdenv.mkDerivation rec {
     copyDesktopItems
     cmake
     pkg-config
+    ruby
     erlang
     elixir
     beamPackages.hex
@@ -94,7 +95,6 @@ stdenv.mkDerivation rec {
 
   nativeCheckInputs = [
     parallel
-    ruby
     supercollider-with-sc3-plugins
     jack2
   ];
@@ -216,6 +216,8 @@ stdenv.mkDerivation rec {
     })
   ];
 
+  passthru.updateScript = ./update.sh;
+
   meta = with lib; {
     homepage = "https://sonic-pi.net/";
     description = "Free live coding synth for everyone originally designed to support computing and music lessons within schools";
diff --git a/pkgs/applications/audio/sonic-pi/update.sh b/pkgs/applications/audio/sonic-pi/update.sh
new file mode 100755
index 000000000000..014af49e73a8
--- /dev/null
+++ b/pkgs/applications/audio/sonic-pi/update.sh
@@ -0,0 +1,50 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p nix jq common-updater-scripts
+
+set -euo pipefail
+
+nixpkgs="$(git rev-parse --show-toplevel || (printf 'Could not find root of nixpkgs repo\nAre we running from within the nixpkgs git repo?\n' >&2; exit 1))"
+
+stripwhitespace() {
+    sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//'
+}
+
+nixeval() {
+    nix --extra-experimental-features nix-command eval --json --impure -f "$nixpkgs" "$1" | jq -r .
+}
+
+vendorhash() {
+    (nix --extra-experimental-features nix-command build --impure --argstr nixpkgs "$nixpkgs" --argstr attr "$1" --expr '{ nixpkgs, attr }: let pkgs = import nixpkgs {}; in with pkgs.lib; (getAttrFromPath (splitString "." attr) pkgs).overrideAttrs (attrs: { outputHash = fakeHash; })' --no-link 2>&1 >/dev/null | tail -n3 | grep -F got: | cut -d: -f2- | stripwhitespace) 2>/dev/null || true
+}
+
+findpath() {
+    path="$(nix --extra-experimental-features nix-command eval --json --impure -f "$nixpkgs" "$1.meta.position" | jq -r . | cut -d: -f1)"
+    outpath="$(nix --extra-experimental-features nix-command eval --json --impure --expr "builtins.fetchGit \"$nixpkgs\"")"
+
+    if [ -n "$outpath" ]; then
+        path="${path/$(echo "$outpath" | jq -r .)/$nixpkgs}"
+    fi
+
+    echo "$path"
+}
+
+attr="${UPDATE_NIX_ATTR_PATH:-sonic-pi}"
+version="$(cd "$nixpkgs" && list-git-tags --pname="$(nixeval "$attr".pname)" --attr-path="$attr" | grep '^v' | sed -e 's|^v||' | sort -V | tail -n1)"
+
+pkgpath="$(findpath "$attr")"
+
+updated="$(cd "$nixpkgs" && update-source-version "$attr" "$version" --file="$pkgpath" --print-changes | jq -r length)"
+
+if [ "$updated" -eq 0 ]; then
+    echo 'update.sh: Package version not updated, nothing to do.'
+    exit 0
+fi
+
+curhash="$(nixeval "$attr.mixFodDeps.outputHash")"
+newhash="$(vendorhash "$attr.mixFodDeps")"
+
+if [ -n "$newhash" ] && [ "$curhash" != "$newhash" ]; then
+    sed -i -e "s|\"$curhash\"|\"$newhash\"|" "$pkgpath"
+else
+    echo 'update.sh: New vendorHash same as old vendorHash, nothing to do.'
+fi
diff --git a/pkgs/applications/misc/qcad/default.nix b/pkgs/applications/misc/qcad/default.nix
index c630ce06b59b..c5791c1a1c89 100644
--- a/pkgs/applications/misc/qcad/default.nix
+++ b/pkgs/applications/misc/qcad/default.nix
@@ -18,14 +18,14 @@
 
 mkDerivation rec {
   pname = "qcad";
-  version = "3.27.9.2";
+  version = "3.27.9.3";
 
   src = fetchFromGitHub {
     name = "qcad-${version}-src";
     owner = "qcad";
     repo = "qcad";
     rev = "v${version}";
-    sha256 = "sha256-RpyckKXU8WN/bptKp6G5gNVSU3RzNFYnM0eWLf3E2Yg=";
+    sha256 = "sha256-JEUV8TtVYSlO+Gmg/ktMTmTlOmH+2zc6/fLkVHD7eBc=";
   };
 
   patches = [
diff --git a/pkgs/applications/misc/syncthingtray/default.nix b/pkgs/applications/misc/syncthingtray/default.nix
index 99404d38efee..0912fc1abcc5 100644
--- a/pkgs/applications/misc/syncthingtray/default.nix
+++ b/pkgs/applications/misc/syncthingtray/default.nix
@@ -28,14 +28,14 @@ https://github.com/NixOS/nixpkgs/issues/199596#issuecomment-1310136382 */
 }:
 
 mkDerivation rec {
-  version = "1.3.2";
+  version = "1.3.3";
   pname = "syncthingtray";
 
   src = fetchFromGitHub {
     owner = "Martchus";
     repo = "syncthingtray";
     rev = "v${version}";
-    sha256 = "sha256-zLZw6ltdgO66dvKdLXhr/a6r8UhbSAx06jXrgMARHyw=";
+    sha256 = "sha256-6H5pV7/E4MP9UqVpm59DqfcK8Z8GwknO3+oWxAcnIsk=";
   };
 
   buildInputs = [
diff --git a/pkgs/applications/misc/taskwarrior/default.nix b/pkgs/applications/misc/taskwarrior/default.nix
index ff778d4d0a4d..105d470d1358 100644
--- a/pkgs/applications/misc/taskwarrior/default.nix
+++ b/pkgs/applications/misc/taskwarrior/default.nix
@@ -34,9 +34,10 @@ stdenv.mkDerivation rec {
     rm -r $out/share/doc/task/scripts/bash
     rm -r $out/share/doc/task/scripts/fish
     # Install vim and neovim plugin
-    mkdir -p $out/share/vim-plugins $out/share/nvim/site
+    mkdir -p $out/share/vim-plugins
     mv $out/share/doc/task/scripts/vim $out/share/vim-plugins/task
-    ln -s $out/share/vim-plugins/task $out/share/nvim/site/task
+    mkdir -p $out/share/nvim
+    ln -s $out/share/vim-plugins/task $out/share/nvim/site
   '';
 
   meta = with lib; {
diff --git a/pkgs/applications/misc/tilemaker/default.nix b/pkgs/applications/misc/tilemaker/default.nix
index a158badc8843..de5a7490f5c0 100644
--- a/pkgs/applications/misc/tilemaker/default.nix
+++ b/pkgs/applications/misc/tilemaker/default.nix
@@ -3,23 +3,15 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tilemaker";
-  version = "2.2.0";
+  version = "2.3.0";
 
   src = fetchFromGitHub {
     owner = "systemed";
     repo = "tilemaker";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-st6WDCk1RZ2lbfrudtcD+zenntyTMRHrIXw3nX5FHOU=";
+    hash = "sha256-O1zoRYNUeReIH2ZpL05SiwCZrZrM2IAkwhsP30k/hHc=";
   };
 
-  patches = [
-    # Fix build with Boost >= 1.79, remove on next upstream release
-    (fetchpatch {
-      url = "https://github.com/systemed/tilemaker/commit/252e7f2ad8938e38d51783d1596307dcd27ed269.patch";
-      hash = "sha256-YSkhmpzEYk/mxVPSDYdwZclooB3zKRjDPzqamv6Nvyc=";
-    })
-  ];
-
   postPatch = ''
     substituteInPlace src/tilemaker.cpp \
       --replace "config.json" "$out/share/tilemaker/config-openmaptiles.json" \
@@ -48,6 +40,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = with lib; {
     description = "Make OpenStreetMap vector tiles without the stack";
     homepage = "https://tilemaker.org/";
+    changelog = "https://github.com/systemed/tilemaker/blob/v${version}/CHANGELOG.md";
     license = licenses.free; # FTWPL
     maintainers = with maintainers; [ sikmir ];
     platforms = platforms.unix;
diff --git a/pkgs/applications/networking/browsers/offpunk/default.nix b/pkgs/applications/networking/browsers/offpunk/default.nix
index bedf059f2714..6945ce5245a2 100644
--- a/pkgs/applications/networking/browsers/offpunk/default.nix
+++ b/pkgs/applications/networking/browsers/offpunk/default.nix
@@ -1,5 +1,6 @@
 {
   fetchFromSourcehut,
+  installShellFiles,
   less,
   lib,
   makeWrapper,
@@ -31,16 +32,16 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "offpunk";
-  version = "1.8";
+  version = "1.9";
 
   src = fetchFromSourcehut {
     owner = "~lioploum";
     repo = "offpunk";
     rev = "v${finalAttrs.version}";
-    sha256 = "0xv7b3qkwyq55sz7c0v0pknrpikhzyqgr5y4y30cwa7jd8sn423f";
+    sha256 = "sha256-sxX4/7jbNbLwHVfE1lDtjr/luby5zAf6Hy1RcwXZLBA=";
   };
 
-  nativeBuildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper installShellFiles ];
   buildInputs = otherDependencies ++ pythonDependencies;
 
   installPhase = ''
@@ -52,6 +53,7 @@ stdenv.mkDerivation (finalAttrs: {
         --set PYTHONPATH "$PYTHONPATH" \
         --set PATH ${lib.makeBinPath otherDependencies}
 
+   installManPage man/*.1
    runHook postInstall
   '';
 
diff --git a/pkgs/applications/networking/cluster/arkade/default.nix b/pkgs/applications/networking/cluster/arkade/default.nix
index d2a63475e350..020277a33e7a 100644
--- a/pkgs/applications/networking/cluster/arkade/default.nix
+++ b/pkgs/applications/networking/cluster/arkade/default.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "arkade";
-  version = "0.9.3";
+  version = "0.9.4";
 
   src = fetchFromGitHub {
     owner = "alexellis";
     repo = "arkade";
     rev = version;
-    sha256 = "sha256-UEtKjZgVaNW6GyCId9D/61mmd79IxV4kPQXbyDpDU1Y=";
+    sha256 = "sha256-r3cSHiNlWrP7JCqYOy86mn6ssfDEbm6DYerVCoARz7M=";
   };
 
   CGO_ENABLED = 0;
diff --git a/pkgs/applications/networking/cluster/glooctl/default.nix b/pkgs/applications/networking/cluster/glooctl/default.nix
index 6f54aba1f0fd..0a3069572621 100644
--- a/pkgs/applications/networking/cluster/glooctl/default.nix
+++ b/pkgs/applications/networking/cluster/glooctl/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "glooctl";
-  version = "1.13.8";
+  version = "1.13.9";
 
   src = fetchFromGitHub {
     owner = "solo-io";
     repo = "gloo";
     rev = "v${version}";
-    hash = "sha256-mflLB+fdNgOlxq/Y2muIyNZHZPFhL6Px355l9w54zC4=";
+    hash = "sha256-rlZtZC5D5wSYVjP/IHSY9eSfaGRGhtfndkC6PYDMXqg=";
   };
 
   subPackages = [ "projects/gloo/cli/cmd" ];
diff --git a/pkgs/applications/networking/cluster/pachyderm/default.nix b/pkgs/applications/networking/cluster/pachyderm/default.nix
index 029e23330335..800d34bda30e 100644
--- a/pkgs/applications/networking/cluster/pachyderm/default.nix
+++ b/pkgs/applications/networking/cluster/pachyderm/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "pachyderm";
-  version = "2.5.0";
+  version = "2.5.1";
 
   src = fetchFromGitHub {
     owner = "pachyderm";
     repo = "pachyderm";
     rev = "v${version}";
-    hash = "sha256-Gm/aUkwEbWxj76Q6My1Vw2gRn3+WVG6EJ7PLpQ1F130=";
+    hash = "sha256-HFIDss01nxBoRQI+Hu8Q02pnIg4DWe7XROl0Z33oubI=";
   };
 
   vendorHash = "sha256-MVcbeQ4qAX9zVlT81yZd5xvo1ggVNpCZJozBoql2W9o=";
diff --git a/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix b/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
index 4af046ed54be..6f6a3867fcab 100644
--- a/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
@@ -2,13 +2,13 @@
 
 (if stdenv.isDarwin then clang14Stdenv else stdenv).mkDerivation rec {
   pname = "signalbackup-tools";
-  version = "20230305";
+  version = "20230307-1";
 
   src = fetchFromGitHub {
     owner = "bepaald";
     repo = pname;
     rev = version;
-    hash = "sha256-UW7FYVU8SEGck48o6sfwEbSHPHEn5WjGJspUjf7hIAE=";
+    hash = "sha256-+FjjGsYMmleN+TDKFAsvC9o81gVhZHIrUgrWuzksxZU=";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/science/logic/tamarin-prover/default.nix b/pkgs/applications/science/logic/tamarin-prover/default.nix
index 02e60b398c38..143d11852448 100644
--- a/pkgs/applications/science/logic/tamarin-prover/default.nix
+++ b/pkgs/applications/science/logic/tamarin-prover/default.nix
@@ -80,6 +80,8 @@ mkDerivation (common "tamarin-prover" src // {
     # so that the package can be used as a vim plugin to install syntax coloration
     install -Dt $out/share/vim-plugins/tamarin-prover/syntax/ etc/syntax/spthy.vim
     install etc/filetype.vim -D $out/share/vim-plugins/tamarin-prover/ftdetect/tamarin.vim
+    mkdir -p $out/share/nvim
+    ln -s $out/share/vim-plugins/tamarin-prover $out/share/nvim/site
     # Emacs SPTHY major mode
     install -Dt $out/share/emacs/site-lisp etc/spthy-mode.el
   '';
diff --git a/pkgs/applications/virtualization/cloud-hypervisor/default.nix b/pkgs/applications/virtualization/cloud-hypervisor/default.nix
index e6f5be057371..9c47cb4254f4 100644
--- a/pkgs/applications/virtualization/cloud-hypervisor/default.nix
+++ b/pkgs/applications/virtualization/cloud-hypervisor/default.nix
@@ -2,13 +2,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cloud-hypervisor";
-  version = "29.0";
+  version = "30.0";
 
   src = fetchFromGitHub {
     owner = "cloud-hypervisor";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-UH5HGXTRYcCBGhswHpGAn8a7rfl5j7gF8GgdpGj5Cb8=";
+    sha256 = "sha256-emy4Sk/j9G+Ou/9h1Kgd70MgbpYMobAXyqAE2LJeOio=";
   };
 
   separateDebugInfo = true;
@@ -16,7 +16,7 @@ rustPlatform.buildRustPackage rec {
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ openssl ] ++ lib.optional stdenv.isAarch64 dtc;
 
-  cargoSha256 = "sha256-30pUKZgGjjXP7UFY4y7XRXlHPF09mnyGWAhx7rPgs+o=";
+  cargoHash = "sha256-/BZN4Jsk3Hv9V0FSqQGHmVrEky6gAovNCd9tfiIHofg=";
 
   OPENSSL_NO_VENDOR = true;
 
diff --git a/pkgs/desktops/deepin/library/dtkgui/default.nix b/pkgs/desktops/deepin/library/dtkgui/default.nix
index 0cc40768285a..b408055b0c37 100644
--- a/pkgs/desktops/deepin/library/dtkgui/default.nix
+++ b/pkgs/desktops/deepin/library/dtkgui/default.nix
@@ -32,13 +32,13 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     lxqt.libqtxdg
+    librsvg
+    freeimage
   ];
 
   propagatedBuildInputs = [
     dtkcore
-    librsvg
     qtimageformats
-    freeimage
   ];
 
   cmakeFlags = [
diff --git a/pkgs/development/compilers/opa/default.nix b/pkgs/development/compilers/opa/default.nix
index 2843625daef2..0eb4240d12f4 100644
--- a/pkgs/development/compilers/opa/default.nix
+++ b/pkgs/development/compilers/opa/default.nix
@@ -15,7 +15,12 @@ stdenv.mkDerivation rec {
     sha256 = "1qs91rq9xrafv2mf2v415k8lv91ab3ycz0xkpjh1mng5ca3pjlf3";
   };
 
-  patches = [ ./ocaml-4.03.patch ./ocaml-4.04.patch ];
+  patches = [
+    ./ocaml-4.03.patch
+    ./ocaml-4.04.patch
+    ./ocaml-4.14.patch
+    ./ocaml-4.14-tags.patch
+  ];
 
   # Paths so the opa compiler code generation will use the same programs as were
   # used to build opa.
@@ -37,7 +42,6 @@ stdenv.mkDerivation rec {
     export CAMLP4O=${ocamlPackages.camlp4}/bin/camlp4o
     export CAMLP4ORF=${ocamlPackages.camlp4}/bin/camlp4orf
     export OCAMLBUILD=${ocamlPackages.ocamlbuild}/bin/ocamlbuild
-    substituteInPlace _tags --replace ', warn_error_A' ""
   '';
 
   prefixKey = "-prefix ";
@@ -47,7 +51,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ gcc binutils nodejs which makeWrapper ];
   buildInputs = [ perl jdk openssl coreutils zlib ncurses
   ] ++ (with ocamlPackages; [
-    ocaml findlib ssl camlzip ulex ocamlgraph camlp4
+    ocaml findlib ssl camlzip ulex ocamlgraph camlp4 num
   ]);
 
   NIX_LDFLAGS = lib.optionalString (!stdenv.isDarwin) "-lgcc_s";
diff --git a/pkgs/development/compilers/opa/ocaml-4.14-tags.patch b/pkgs/development/compilers/opa/ocaml-4.14-tags.patch
new file mode 100644
index 000000000000..b620cd0ceaed
--- /dev/null
+++ b/pkgs/development/compilers/opa/ocaml-4.14-tags.patch
@@ -0,0 +1,191 @@
+diff --git a/Makefile b/Makefile
+index 37589e1..10d3418 100644
+--- a/Makefile
++++ b/Makefile
+@@ -14,6 +14,7 @@ OPALANG_DIR ?= .
+ 
+ MAKE ?= $_
+ OCAMLBUILD_OPT ?= -j 6
++OCAMLBUILD_OPT += -use-ocamlfind -package num
+ 
+ ifndef NO_REBUILD_OPA_PACKAGES
+ OPAOPT += --rebuild
+diff --git a/_tags b/_tags
+index 5d8d922..b6bdd5e 100644
+--- a/_tags
++++ b/_tags
+@@ -15,4 +15,4 @@
+ <{ocamllib,compiler,lib,tools}>: include
+ 
+ # Warnings
+-<**/*.ml>: warn_L, warn_Z, warn_error_A
++<**/*.ml>: warn_L, warn_Z
+diff --git a/compiler/_tags b/compiler/_tags
+index b33eeeb..7afa493 100644
+--- a/compiler/_tags
++++ b/compiler/_tags
+@@ -7,6 +7,6 @@
+ 
+ <main.ml>: use_opalib, use_opalang, use_opapasses, use_libqmlcompil, use_passlib, use_libbsl, use_qmloptions, use_qml2js, use_js_passes, use_opa
+ 
+-<main.{byte,native}>: thread, use_dynlink, use_graph, use_str, use_unix, use_nums, use_zip, use_buildinfos, use_libbase, use_ulex, use_libtrx, use_libqmlcompil, use_libbsl, use_opalib, use_opalang, use_opapasses, use_qmlfakecompiler, use_qmloptions, use_qmljsimp, use_qml2js, use_opabsl_for_compiler, use_qmlslicer, use_jslang, use_qmlcpsrewriter, use_ocamllang, use_passlib, use_compilerlib, use_pplib, use_qmlpasses, use_opacapi, use_js_passes, use_opa
++<main.{byte,native}>: thread, use_dynlink, use_graph, use_str, use_zip, use_buildinfos, use_libbase, use_ulex, use_libtrx, use_libqmlcompil, use_libbsl, use_opalib, use_opalang, use_opapasses, use_qmlfakecompiler, use_qmloptions, use_qmljsimp, use_qml2js, use_opabsl_for_compiler, use_qmlslicer, use_jslang, use_qmlcpsrewriter, use_ocamllang, use_passlib, use_compilerlib, use_pplib, use_qmlpasses, use_opacapi, use_js_passes, use_opa
+ 
+ <main.ml>: with_mlstate_debug
+diff --git a/compiler/jslang/_tags b/compiler/jslang/_tags
+index f33b592..8925703 100644
+--- a/compiler/jslang/_tags
++++ b/compiler/jslang/_tags
+@@ -4,7 +4,7 @@
+ <jsParse.ml>:           use_camlp4, camlp4orf_fixed
+ 
+ # todo: find a way to link fewer libs
+-<{jspp,jsstat,globalizer}.{byte,native}>: use_passlib, use_opacapi, use_libtrx, use_ulex, use_str, use_unix, use_buildinfos, use_libbase, use_libqmlcompil, use_compilerlib, use_graph, use_nums, use_dynlink, use_jslang, use_ocamllang, use_libbsl, use_opalang, use_pplib, use_qmloptions, use_qml2js, use_qmlcpsrewriter, use_qmlpasses
++<{jspp,jsstat,globalizer}.{byte,native}>: use_passlib, use_opacapi, use_libtrx, use_ulex, use_str, use_unix, use_buildinfos, use_libbase, use_libqmlcompil, use_compilerlib, use_graph, use_dynlink, use_jslang, use_ocamllang, use_libbsl, use_opalang, use_pplib, use_qmloptions, use_qml2js, use_qmlcpsrewriter, use_qmlpasses
+ <{jspp,jsstat,globalizer}.{ml,byte,native}>: use_qmljsimp
+ 
+ <jsstat.{ml,byte,native}>: use_libjsminify
+diff --git a/compiler/libbsl/_tags b/compiler/libbsl/_tags
+index cad1fe4..8ef238b 100644
+--- a/compiler/libbsl/_tags
++++ b/compiler/libbsl/_tags
+@@ -20,7 +20,7 @@
+ <bslRegisterParser.{ml,mli,byte,native}>: use_libtrx
+ <bslTinyShell.{ml,mli,byte,native}>: use_libtrx
+ <bslregister.*>: use_jslang
+-<bslregister.{byte,native}>: use_ulex, use_libbsl, use_dynlink, use_zip, use_nums
++<bslregister.{byte,native}>: use_ulex, use_libbsl, use_dynlink, use_zip
+ <portingBsl.{ml,byte,native}>: use_ulex, use_libbsl, use_dynlink, use_zip, use_nums
+ <bslGeneration.{ml,mli}>: use_ulex, use_dynlink, use_zip, use_nums, use_jslang
+ <bslMarshalPlugin.*>: use_jslang
+@@ -30,7 +30,7 @@
+ <tests>: ignore
+ 
+ # applications, linking
+-<*.{byte,native}>:use_buildinfos, use_ulex, use_libtrx, use_dynlink, use_unix, thread, use_graph, use_libbsl, use_passlib, use_zip, use_nums, use_opalang, use_ocamllang, use_langlang, use_jslang, use_opacapi
++<*.{byte,native}>:use_buildinfos, use_ulex, use_libtrx, use_dynlink, thread, use_graph, use_libbsl, use_passlib, use_zip, use_opalang, use_ocamllang, use_langlang, use_jslang, use_opacapi
+ 
+ # ppdebug (pl. be very specific with the use of ppdebug)
+ <bslLib.ml*>        : with_mlstate_debug
+diff --git a/compiler/opa/_tags b/compiler/opa/_tags
+index cfe97a1..702af34 100644
+--- a/compiler/opa/_tags
++++ b/compiler/opa/_tags
+@@ -62,7 +62,7 @@
+ <syntaxHelper.ml>: use_opalib, use_opalang, use_opapasses, use_libqmlcompil, use_passlib
+ 
+ # linking
+-<{opa_parse,checkopacapi,gen_opa_manpage,syntaxHelper}.{byte,native}>: thread, use_dynlink, use_graph, use_str, use_unix, use_nums, use_zip, use_buildinfos, use_libbase, use_ulex, use_libtrx, use_libqmlcompil, use_libbsl, use_opalib, use_opalang, use_opapasses, use_qmlfakecompiler, use_qmljsimp, use_qml2js, use_opabsl_for_compiler, use_qmlslicer, use_jslang, use_qmlcpsrewriter, use_ocamllang, use_passlib, use_compilerlib, use_pplib, use_qmlpasses, use_opacapi, use_qmloptions
++<{opa_parse,checkopacapi,gen_opa_manpage,syntaxHelper}.{byte,native}>: thread, use_dynlink, use_graph, use_str, use_zip, use_buildinfos, use_libbase, use_ulex, use_libtrx, use_libqmlcompil, use_libbsl, use_opalib, use_opalang, use_opapasses, use_qmlfakecompiler, use_qmljsimp, use_qml2js, use_opabsl_for_compiler, use_qmlslicer, use_jslang, use_qmlcpsrewriter, use_ocamllang, use_passlib, use_compilerlib, use_pplib, use_qmlpasses, use_opacapi, use_qmloptions
+ 
+ <opa_InsertRemote.ml>: with_mlstate_debug
+ <main_utils.ml>: with_mlstate_debug
+diff --git a/compiler/opalang/_tags b/compiler/opalang/_tags
+index 6844281..8f0eaec 100644
+--- a/compiler/opalang/_tags
++++ b/compiler/opalang/_tags
+@@ -14,7 +14,7 @@ true: warn_Z
+ <standaloneparser.ml>: use_buildinfos, use_compilerlib, use_pplib
+ <**/*.{ml,mli}>: use_libbase, use_compilerlib, use_libqmlcompil, use_passlib
+ 
+-<{opa2opa,standaloneparser}.{native,byte}>: use_unix, use_libbase, use_mutex, use_graph, use_str, use_zlib, thread, use_nums, use_libtrx, use_passlib, use_libqmlcompil, use_buildinfos, use_ulex, use_compilerlib, use_pplib, use_opacapi
++<{opa2opa,standaloneparser}.{native,byte}>: use_libbase, use_mutex, use_graph, use_str, use_zlib, thread, use_libtrx, use_passlib, use_libqmlcompil, use_buildinfos, use_ulex, use_compilerlib, use_pplib, use_opacapi
+ 
+ <opaMapToIdent.ml>: use_opacapi
+ <surfaceAstCons.ml>: use_opacapi
+diff --git a/compiler/opx2js/_tags b/compiler/opx2js/_tags
+index 7e9b9cc..3e257ea 100644
+--- a/compiler/opx2js/_tags
++++ b/compiler/opx2js/_tags
+@@ -2,7 +2,7 @@
+ 
+ <**/*.{ml,mli}>: use_buildinfos, use_libbase, use_compilerlib, use_passlib
+ 
+-<**/*.native>: thread, use_dynlink, use_graph, use_str, use_unix, use_nums, use_zip, use_buildinfos, use_libbase, use_ulex, use_libtrx, use_libqmlcompil, use_libbsl, use_opalib, use_opalang, use_opapasses, use_qmlfakecompiler, use_qmlflatcompiler, use_qmloptions, use_qmljsimp, use_qml2js, use_opabsl_for_compiler, use_qmlslicer, use_jslang, use_qmlcpsrewriter, use_ocamllang, use_passlib, use_compilerlib, use_pplib, use_qmlpasses, use_opacapi, use_libopa
++<**/*.native>: thread, use_dynlink, use_graph, use_str, use_zip, use_buildinfos, use_libbase, use_ulex, use_libtrx, use_libqmlcompil, use_libbsl, use_opalib, use_opalang, use_opapasses, use_qmlfakecompiler, use_qmlflatcompiler, use_qmloptions, use_qmljsimp, use_qml2js, use_opabsl_for_compiler, use_qmlslicer, use_jslang, use_qmlcpsrewriter, use_ocamllang, use_passlib, use_compilerlib, use_pplib, use_qmlpasses, use_opacapi, use_libopa
+ 
+ <**/opx2jsPasses.{ml,mli}>: use_jslang, use_opalib, use_opalang, use_opapasses, use_libopa, use_libqmlcompil, use_qmlpasses, use_qmlcpsrewriter, use_qmlslicer
+ 
+diff --git a/compiler/passes/_tags b/compiler/passes/_tags
+index a0daff4..9644d3a 100644
+--- a/compiler/passes/_tags
++++ b/compiler/passes/_tags
+@@ -1,7 +1,7 @@
+ # -*- conf -*- (for emacs)
+ 
+ # preprocessing
+-true: with_mlstate_debug, warn_A, warn_e, warn_error_A, warnno_48
++true: with_mlstate_debug, warn_A, warn_e, warnno_48
+ 
+ <**/*.{ml,mli}>: use_libbase, use_libqmlcompil, use_passlib, use_opalang, use_compilerlib, use_opacapi
+ <surfaceAst*.{ml,mli}>: use_opalib, use_libbsl
+diff --git a/compiler/passlib/_tags b/compiler/passlib/_tags
+index 2b9cfcf..5cb3145 100644
+--- a/compiler/passlib/_tags
++++ b/compiler/passlib/_tags
+@@ -1,6 +1,6 @@
+ # -*- conf -*- (for emacs)
+ 
+-<*.{ml,mli,byte,native}>: use_libbase, use_compilerlib, thread, use_ulex, use_unix, use_str
++<*.{ml,mli,byte,native}>: use_libbase, use_compilerlib, thread, use_ulex, use_str
+ 
+ <passHandler.ml>: use_buildinfos
+ <passdesign.{byte,native}>: use_buildinfos, use_graph
+diff --git a/compiler/qmlcompilers/_tags b/compiler/qmlcompilers/_tags
+index 087165c..87ae918 100644
+--- a/compiler/qmlcompilers/_tags
++++ b/compiler/qmlcompilers/_tags
+@@ -5,7 +5,7 @@
+ 
+ # application, linkink
+ # common
+-<{qmljs_exe}.{ml,mli,byte,native}>: thread, use_unix, use_dynlink, use_str, use_graph, use_ulex, use_libtrx, use_pplib, use_opabsl_for_compiler, use_passlib, use_nums, use_buildinfos, use_opalang, use_compilerlib, use_opacapi
++<{qmljs_exe}.{ml,mli,byte,native}>: thread, use_dynlink, use_str, use_graph, use_ulex, use_libtrx, use_pplib, use_opabsl_for_compiler, use_passlib, use_buildinfos, use_opalang, use_compilerlib, use_opacapi
+ 
+ # specific
+ <qmljs_exe.{ml,byte,native}>: use_qmljsimp, use_qml2js, use_zip
+diff --git a/ocamllib/libbase/_tags b/ocamllib/libbase/_tags
+index 42d067d..6b7e690 100644
+--- a/ocamllib/libbase/_tags
++++ b/ocamllib/libbase/_tags
+@@ -27,4 +27,4 @@
+ <mongo.ml>: with_mlstate_debug
+ 
+ 
+-<{testconsole,testfilepos}.{ml,mli,byte,native}>: thread, use_str, use_unix, use_libbase, use_ulex
++<{testconsole,testfilepos}.{ml,mli,byte,native}>: thread, use_str, use_libbase, use_ulex
+diff --git a/tools/_tags b/tools/_tags
+index 549752b..44c97b3 100644
+--- a/tools/_tags
++++ b/tools/_tags
+@@ -8,7 +8,7 @@
+ <build>: include
+ 
+ # Odep
+-<odep*.{ml,byte,native}>: thread, use_str, use_unix, use_graph, use_zip, use_libbase, use_ulex
++<odep*.{ml,byte,native}>: thread, use_str, use_graph, use_zip, use_libbase, use_ulex
+ 
+ ###
+ # Ofile
+@@ -16,7 +16,7 @@
+ <ofile.ml>: use_libbase
+ 
+ # linking
+-<ofile.{byte,native}>: use_unix, use_str, thread, use_ulex, use_libbase, use_zip
++<ofile.{byte,native}>: use_str, thread, use_ulex, use_libbase, use_zip
+ 
+ ###
+ # jschecker
+diff --git a/tools/teerex/_tags b/tools/teerex/_tags
+index d662b49..366ea01 100644
+--- a/tools/teerex/_tags
++++ b/tools/teerex/_tags
+@@ -6,6 +6,6 @@
+ 
+ <*.{ml,mli,byte,native}>: use_str, use_libbase, use_compilerlib, use_graph, use_libtrx, use_ocamllang, use_zip, use_buildinfos, use_passlib
+ 
+-<trx_ocaml.{byte,native}>: thread, use_unix
++<trx_ocaml.{byte,native}>: thread
+ <trx_ocaml_main.{byte,native}>: thread, use_unix
+-<trx_interpreter.{byte,native}>: thread, use_unix
++<trx_interpreter.{byte,native}>: thread
diff --git a/pkgs/development/compilers/opa/ocaml-4.14.patch b/pkgs/development/compilers/opa/ocaml-4.14.patch
new file mode 100644
index 000000000000..7df254f3af49
--- /dev/null
+++ b/pkgs/development/compilers/opa/ocaml-4.14.patch
@@ -0,0 +1,63 @@
+diff --git a/compiler/compilerlib/objectFiles.ml b/compiler/compilerlib/objectFiles.ml
+index d0e7223..5fee601 100644
+--- a/compiler/compilerlib/objectFiles.ml
++++ b/compiler/compilerlib/objectFiles.ml
+@@ -339,8 +339,9 @@ let dirname (package:package_name) : filename = Filename.concat !opxdir (unprefi
+ let unprefixed_dirname_plugin (package:package_name) : filename = package ^ "." ^ Name.plugin_ext
+ let dirname_plugin (package:package_name) : filename = Filename.concat !opxdir (unprefixed_dirname_plugin package)
+ let dirname_from_package ((package_name,_):package) = dirname package_name
+-let undirname filename : package_name = Filename.chop_suffix (Filename.basename filename) ("."^Name.object_ext)
+-let undirname_plugin filename : package_name = Filename.chop_suffix (Filename.basename filename) ("."^Name.plugin_ext)
++let chop_suffix name suff = try Filename.chop_suffix name suff with _ -> name
++let undirname filename : package_name = chop_suffix (Filename.basename filename) ("."^Name.object_ext)
++let undirname_plugin filename : package_name = chop_suffix (Filename.basename filename) ("."^Name.plugin_ext)
+ let filename_from_dir dir pass = Filename.concat dir pass
+ let filename_from_package package pass = filename_from_dir (dirname_from_package package) pass
+ 
+diff --git a/ocamllib/libbase/baseHashtbl.ml b/ocamllib/libbase/baseHashtbl.ml
+index 439d76c..7be6cf9 100644
+--- a/ocamllib/libbase/baseHashtbl.ml
++++ b/ocamllib/libbase/baseHashtbl.ml
+@@ -29,7 +29,6 @@ let iter = Hashtbl.iter
+ let fold = Hashtbl.fold
+ let length = Hashtbl.length
+ let hash = Hashtbl.hash
+-external hash_param : int -> int -> 'a -> int = "caml_hash_univ_param" "noalloc"
+ module type HashedType = Hashtbl.HashedType
+ 
+ (* could be done (with magic) more efficiently
+diff --git a/ocamllib/libbase/baseHashtbl.mli b/ocamllib/libbase/baseHashtbl.mli
+index 1a2b146..10e448b 100644
+--- a/ocamllib/libbase/baseHashtbl.mli
++++ b/ocamllib/libbase/baseHashtbl.mli
+@@ -41,7 +41,6 @@ end
+ module Make (H : HashedType) : S with type key = H.t
+ 
+ val hash : 'a -> int
+-external hash_param : int -> int -> 'a -> int = "caml_hash_univ_param" "noalloc"
+ 
+ (**
+    additional functions
+diff --git a/ocamllib/libbase/baseObj.mli b/ocamllib/libbase/baseObj.mli
+index da2d973..5eb77b5 100644
+--- a/ocamllib/libbase/baseObj.mli
++++ b/ocamllib/libbase/baseObj.mli
+@@ -23,7 +23,7 @@ external obj : t -> 'a = "%identity"
+ external magic : 'a -> 'b = "%identity"
+ external is_block : t -> bool = "caml_obj_is_block"
+ external is_int : t -> bool = "%obj_is_int"
+-external tag : t -> int = "caml_obj_tag"
++external tag : t -> int = "caml_obj_tag" [@@noalloc]
+ external set_tag : t -> int -> unit = "caml_obj_set_tag"
+ external size : t -> int = "%obj_size"
+ external truncate : t -> int -> unit = "caml_obj_truncate"
+@@ -49,9 +49,6 @@ val int_tag : int
+ val out_of_heap_tag : int
+ val unaligned_tag : int
+ 
+-val marshal : t -> string
+-val unmarshal : string -> int -> t * int
+-
+ (** Additional functions *)
+ 
+ val dump : ?custom:(Obj.t -> (Buffer.t -> Obj.t -> unit) option) -> ?depth:int -> 'a -> string
diff --git a/pkgs/development/interpreters/python/rustpython/default.nix b/pkgs/development/interpreters/python/rustpython/default.nix
index e3e2ca8c18cd..b00631ad71a4 100644
--- a/pkgs/development/interpreters/python/rustpython/default.nix
+++ b/pkgs/development/interpreters/python/rustpython/default.nix
@@ -4,20 +4,29 @@
 , fetchFromGitHub
 , SystemConfiguration
 , python3
+, fetchpatch
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "rustpython";
-  version = "unstable-2022-10-11";
+  version = "0.2.0";
 
   src = fetchFromGitHub {
     owner = "RustPython";
     repo = "RustPython";
-    rev = "273ffd969ca6536df06d9f69076c2badb86f8f8c";
-    sha256 = "sha256-t/3++EeP7a8t2H0IEPLogBri7+6u+2+v+lNb4/Ty1/w=";
+    rev = "v${version}";
+    hash = "sha256-RNUOBBbq4ca9yEKNj5TZTOQW0hruWOIm/G+YCHoJ19U=";
   };
 
-  cargoHash = "sha256-Pv7SK64+eoK1VUxDh1oH0g1veWoIvBhiZE9JI/alXJ4=";
+  cargoHash = "sha256-PYSsv/dZ3dxferTDbRLF9T8GGj9kZ3ixWNglQKtA3pE=";
+
+  patches = [
+    # Fix aarch64 compatibility for sqlite. Remove with the next release. https://github.com/RustPython/RustPython/pull/4499
+    (fetchpatch {
+      url = "https://github.com/RustPython/RustPython/commit/9cac89347e2276fcb309f108561e99f4be5baff2.patch";
+      hash = "sha256-vUPQI/5ec6/36Vdtt7/B2unPDsVrGh5iEiSMBRatxWU=";
+    })
+  ];
 
   # freeze the stdlib into the rustpython binary
   cargoBuildFlags = [ "--features=freeze-stdlib" ];
diff --git a/pkgs/development/libraries/cpp-utilities/default.nix b/pkgs/development/libraries/cpp-utilities/default.nix
index 9cea13e6596e..4c9551332ee4 100644
--- a/pkgs/development/libraries/cpp-utilities/default.nix
+++ b/pkgs/development/libraries/cpp-utilities/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cpp-utilities";
-  version = "5.20.0";
+  version = "5.21.0";
 
   src = fetchFromGitHub {
     owner = "Martchus";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-KOvRNo8qd8nXhh/f3uAN7jOsNMTX8dJRGUHJXP+FdEs=";
+    sha256 = "sha256-jva/mVk20xqEcHlUMnOBy2I09oGoLkKaqwRSg0kIKS0=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/fizz/default.nix b/pkgs/development/libraries/fizz/default.nix
index 6ab107497fda..c933dc35f218 100644
--- a/pkgs/development/libraries/fizz/default.nix
+++ b/pkgs/development/libraries/fizz/default.nix
@@ -19,12 +19,12 @@
 
 stdenv.mkDerivation rec {
   pname = "fizz";
-  version = "2023.02.27.00";
+  version = "2023.03.06.00";
 
   src = fetchFromGitHub {
     owner = "facebookincubator";
     repo = "fizz";
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
     hash = "sha256-zb3O5YHQc+1cPcL0K3FwhMfr+/KFQU7SDVT1bEITF6E=";
   };
 
diff --git a/pkgs/development/libraries/libdisplay-info/default.nix b/pkgs/development/libraries/libdisplay-info/default.nix
index fa499a001464..3e29f621cb04 100644
--- a/pkgs/development/libraries/libdisplay-info/default.nix
+++ b/pkgs/development/libraries/libdisplay-info/default.nix
@@ -11,14 +11,14 @@
 
 stdenv.mkDerivation rec {
   pname = "libdisplay-info";
-  version = "0.1.0";
+  version = "0.1.1";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "emersion";
     repo = pname;
     rev = version;
-    sha256 = "sha256-jfi7RpEtyQicW0WWhrQg28Fta60YWxTbpbmPHmXxDhw=";
+    sha256 = "sha256-7t1CoLus3rPba9paapM7+H3qpdsw7FlzJsSHFwM/2Lk=";
   };
 
   nativeBuildInputs = [ meson pkg-config ninja edid-decode python3 ];
diff --git a/pkgs/development/libraries/qtutilities/default.nix b/pkgs/development/libraries/qtutilities/default.nix
index c7365b422c97..984a28a2c85f 100644
--- a/pkgs/development/libraries/qtutilities/default.nix
+++ b/pkgs/development/libraries/qtutilities/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "qtutilities";
-  version = "6.10.0";
+  version = "6.11.0";
 
   src = fetchFromGitHub {
     owner = "Martchus";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-xMuiizhOeS2UtD5OprLZb1MsjGyLd85SHcfW9Wja7tg=";
+    hash = "sha256-eMQyXxBupqcLmNtAcVBgTWtAtuyRlWB9GKNpomM10B0=";
   };
 
   buildInputs = [ qtbase cpp-utilities ];
diff --git a/pkgs/development/python-modules/ailment/default.nix b/pkgs/development/python-modules/ailment/default.nix
index 17e9afe40409..0bcd1360e290 100644
--- a/pkgs/development/python-modules/ailment/default.nix
+++ b/pkgs/development/python-modules/ailment/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "ailment";
-  version = "9.2.40";
+  version = "9.2.41";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-Ykm9LuhICsnJemcAMlS0ohZM7x1ndCjF6etX9ip2IsA=";
+    hash = "sha256-KXbHD0CsQotHjc/Pbo4/y/uhCvGkbPDGn1BF8A68xBY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/aiolivisi/default.nix b/pkgs/development/python-modules/aiolivisi/default.nix
index 1f0c21a208f9..f5a24b0a6c8a 100644
--- a/pkgs/development/python-modules/aiolivisi/default.nix
+++ b/pkgs/development/python-modules/aiolivisi/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "aiolivisi";
-  version = "0.0.16";
+  version = "0.0.18";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-L7KeTdC3IPbXBLDkP86CyQ59s2bL4byxgKhl8YCmZHQ=";
+    hash = "sha256-8Cy2hhYrUBRfVb2hgil6Irk+iTJmJ8JL+5wvm4rm7kM=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/angr/default.nix b/pkgs/development/python-modules/angr/default.nix
index e3ace1940ed6..9997ab09fd40 100644
--- a/pkgs/development/python-modules/angr/default.nix
+++ b/pkgs/development/python-modules/angr/default.nix
@@ -31,7 +31,7 @@
 
 buildPythonPackage rec {
   pname = "angr";
-  version = "9.2.40";
+  version = "9.2.41";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -40,7 +40,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-PA/88T7o+oEr/U33opGu1Tcvc0zT/WhChpJJV/AvCmw=";
+    hash = "sha256-HikfqU2k7w/IO51vOKNzCLWd+MphG1hXkJal5usQZOA=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/app-model/default.nix b/pkgs/development/python-modules/app-model/default.nix
index 2ada38bfb14e..1191be3c823d 100644
--- a/pkgs/development/python-modules/app-model/default.nix
+++ b/pkgs/development/python-modules/app-model/default.nix
@@ -7,13 +7,13 @@
 , pytestCheckHook
 , pythonOlder
 , typing-extensions
-, setuptools-scm
-, setuptools
+, hatch-vcs
+, hatchling
 }:
 
 buildPythonPackage rec {
   pname = "app-model";
-  version = "0.1.1";
+  version = "0.1.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -22,14 +22,14 @@ buildPythonPackage rec {
     owner = "pyapp-kit";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-nZnIb2QHfpkPirjQPiBdLd7pc1NNn97fdjGxKs0lWQU=";
+    hash = "sha256-W1DL6HkqXkfVE9SPD0cUhPln5FBW5vPICpbQulRhaWs=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
 
   nativeBuildInputs = [
-    setuptools
-    setuptools-scm
+    hatch-vcs
+    hatchling
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/archinfo/default.nix b/pkgs/development/python-modules/archinfo/default.nix
index e88d0bb2e9b7..9042269a465c 100644
--- a/pkgs/development/python-modules/archinfo/default.nix
+++ b/pkgs/development/python-modules/archinfo/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "archinfo";
-  version = "9.2.40";
+  version = "9.2.41";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-jJFOtvcsU1bmJQT7atE6DJLcAeoN+78yWP4OiM6euWI=";
+    hash = "sha256-O2Tj5rwev5tWnaHq/GJV5/9fAlk5np7S3Yw+ehmofks=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/cemm/default.nix b/pkgs/development/python-modules/cemm/default.nix
new file mode 100644
index 000000000000..3036393344c9
--- /dev/null
+++ b/pkgs/development/python-modules/cemm/default.nix
@@ -0,0 +1,59 @@
+{ lib
+, aiohttp
+, aresponses
+, buildPythonPackage
+, fetchFromGitHub
+, poetry-core
+, pytest-asyncio
+, pytestCheckHook
+, pythonOlder
+, yarl
+}:
+
+buildPythonPackage rec {
+  pname = "cemm";
+  version = "0.5.1";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.9";
+
+  src = fetchFromGitHub {
+    owner = "klaasnicolaas";
+    repo = "python-cemm";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-BorgGHxoEeIGyJKqe9mFRDpcGHhi6/8IV7ubEI8yQE4=";
+  };
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace '"0.0.0"' '"${version}"' \
+      --replace 'addopts = "--cov"' ""
+  '';
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    aiohttp
+    yarl
+  ];
+
+  nativeCheckInputs = [
+    aresponses
+    pytest-asyncio
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "cemm"
+  ];
+
+  meta = with lib; {
+    description = "Module for interacting with CEMM devices";
+    homepage = "https://github.com/klaasnicolaas/python-cemm";
+    changelog = "https://github.com/klaasnicolaas/python-cemm/releases/tag/v${version}";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/claripy/default.nix b/pkgs/development/python-modules/claripy/default.nix
index db488dcae703..6f90b5b51ea6 100644
--- a/pkgs/development/python-modules/claripy/default.nix
+++ b/pkgs/development/python-modules/claripy/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "claripy";
-  version = "9.2.40";
+  version = "9.2.41";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-J56UP/6LoC9Tqf4zZb0Tup8la2a++9LCBwav3CclOuM=";
+    hash = "sha256-FX73LF8T6FaQNqN7EB1SCRAGZsChkEduNL2i8ATQuOE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/cle/default.nix b/pkgs/development/python-modules/cle/default.nix
index 44c5937042d0..b9712c2a8271 100644
--- a/pkgs/development/python-modules/cle/default.nix
+++ b/pkgs/development/python-modules/cle/default.nix
@@ -16,7 +16,7 @@
 
 let
   # The binaries are following the argr projects release cycle
-  version = "9.2.40";
+  version = "9.2.41";
 
   # Binary files from https://github.com/angr/binaries (only used for testing and only here)
   binaries = fetchFromGitHub {
@@ -38,7 +38,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-xNVZzw5m8OZNoK2AcbaSOEbr7uTVcMI7HCgRqylayDo=";
+    hash = "sha256-v87ma0svBpVfx2SVLw8dx7HdOLQpNzjRwVj9yQs0bR8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/eradicate/default.nix b/pkgs/development/python-modules/eradicate/default.nix
index 060041651ef9..cddeddfef8c2 100644
--- a/pkgs/development/python-modules/eradicate/default.nix
+++ b/pkgs/development/python-modules/eradicate/default.nix
@@ -1,19 +1,41 @@
-{ lib, buildPythonPackage, fetchPypi }:
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pytestCheckHook
+, pythonOlder
+}:
 
 buildPythonPackage rec {
   pname = "eradicate";
-  version = "2.1.0";
+  version = "2.2.0";
+  format = "setuptools";
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-qsc4SrJbG/IcTAEt6bS/g5iUWhTJjJEVRbLqUKtVgBQ=";
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "wemake-services";
+    repo = pname;
+    rev = "refs/tags/${version}";
+    hash = "sha256-pVjvzW3UVeLMLLYcU0SIE19GEHFmouoA/JKSweTZSGo=";
   };
 
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "eradicate"
+  ];
+
+  pytestFlagsArray = [
+    "test_eradicate.py"
+  ];
+
   meta = with lib; {
-    description = "eradicate removes commented-out code from Python files.";
+    description = "Library to remove commented-out code from Python files";
     homepage = "https://github.com/myint/eradicate";
-    license = [ licenses.mit ];
-
-    maintainers = [ maintainers.mmlb ];
+    changelog = "https://github.com/wemake-services/eradicate/releases/tag/${version}";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ mmlb ];
   };
 }
diff --git a/pkgs/development/python-modules/evtx/default.nix b/pkgs/development/python-modules/evtx/default.nix
index af6f36ec6f9e..b949864dc7aa 100644
--- a/pkgs/development/python-modules/evtx/default.nix
+++ b/pkgs/development/python-modules/evtx/default.nix
@@ -5,6 +5,7 @@
 , pytestCheckHook
 , pythonOlder
 , rustPlatform
+, libiconv
 }:
 
 buildPythonPackage rec {
@@ -32,6 +33,10 @@ buildPythonPackage rec {
     maturinBuildHook
   ];
 
+  buildInputs = lib.optionals stdenv.isDarwin [
+    libiconv
+  ];
+
   nativeCheckInputs = [
     pytestCheckHook
   ];
@@ -46,6 +51,5 @@ buildPythonPackage rec {
     changelog = "https://github.com/omerbenamram/pyevtx-rs/releases/tag/${version}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
-    broken = stdenv.isDarwin;
   };
 }
diff --git a/pkgs/development/python-modules/grpcio/default.nix b/pkgs/development/python-modules/grpcio/default.nix
index 486742ccb605..a8dade04a36f 100644
--- a/pkgs/development/python-modules/grpcio/default.nix
+++ b/pkgs/development/python-modules/grpcio/default.nix
@@ -26,7 +26,14 @@ buildPythonPackage rec {
   propagatedBuildInputs = [ six protobuf ]
     ++ lib.optionals (isPy27) [ enum34 futures ];
 
-  preBuild = lib.optionalString stdenv.isDarwin "unset AR";
+  preBuild = ''
+    export GRPC_PYTHON_BUILD_EXT_COMPILER_JOBS="$NIX_BUILD_CORES"
+    if [ -z "$enableParallelBuilding" ]; then
+      GRPC_PYTHON_BUILD_EXT_COMPILER_JOBS=1
+    fi
+  '' + lib.optionalString stdenv.isDarwin ''
+    unset AR
+  '';
 
   GRPC_BUILD_WITH_BORING_SSL_ASM = "";
   GRPC_PYTHON_BUILD_SYSTEM_OPENSSL = 1;
@@ -36,6 +43,8 @@ buildPythonPackage rec {
   # does not contain any tests
   doCheck = false;
 
+  enableParallelBuilding = true;
+
   pythonImportsCheck = [ "grpc" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/nestedtext/default.nix b/pkgs/development/python-modules/nestedtext/default.nix
index c8b0c77b7a39..5b5aa8bfc5b7 100644
--- a/pkgs/development/python-modules/nestedtext/default.nix
+++ b/pkgs/development/python-modules/nestedtext/default.nix
@@ -1,27 +1,68 @@
-{ lib, buildPythonPackage, fetchFromGitHub
-, inform
-, pytestCheckHook
+{ lib
+, buildPythonPackage
 , docopt
-, natsort
+, fetchFromGitHub
+, flitBuildHook
+, hypothesis
+, inform
+, nestedtext
+, pytestCheckHook
+, pythonOlder
+, quantiphy
 , voluptuous
 }:
 
 buildPythonPackage rec {
   pname = "nestedtext";
-  version = "1.2";
+  version = "3.5";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "KenKundert";
     repo = "nestedtext";
-    rev = "v${version}";
-    fetchSubmodules = true;
-    sha256 = "1dwks5apghg29aj90nc4qm0chk195jh881297zr1wk7mqd2n159y";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-RGCcrGsDkBhThuUZd2LuuyXG9r1S7iOA75HYRxkwUrU=";
   };
 
-  propagatedBuildInputs = [ inform ];
+  nativeBuildInputs = [
+    flitBuildHook
+  ];
 
-  nativeCheckInputs = [ pytestCheckHook docopt natsort voluptuous ];
-  pytestFlagsArray = [ "--ignore=build" ]; # Avoids an ImportMismatchError.
+  propagatedBuildInputs = [
+    inform
+  ];
+
+  nativeCheckInputs = [
+    docopt
+    hypothesis
+    quantiphy
+    pytestCheckHook
+    voluptuous
+  ];
+
+  # Tests depend on quantiphy. To avoid infinite recursion, tests are only
+  # enabled when building passthru.tests.
+  doCheck = false;
+
+  pytestFlagsArray = [
+    # Avoids an ImportMismatchError.
+    "--ignore=build"
+  ];
+
+  disabledTestPaths = [
+    # Examples are prefixed with test_
+    "examples/"
+  ];
+
+  passthru.tests = {
+    runTests = nestedtext.overrideAttrs (_: { doCheck = true; });
+  };
+
+  pythonImportsCheck = [
+    "nestedtext"
+  ];
 
   meta = with lib; {
     description = "A human friendly data format";
@@ -37,6 +78,7 @@ buildPythonPackage rec {
       non-programmers.
     '';
     homepage = "https://nestedtext.org";
+    changelog = "https://github.com/KenKundert/nestedtext/blob/v${version}/doc/releases.rst";
     license = licenses.mit;
     maintainers = with maintainers; [ jeremyschlatter ];
   };
diff --git a/pkgs/development/python-modules/parametrize-from-file/default.nix b/pkgs/development/python-modules/parametrize-from-file/default.nix
index c020992bee22..38370a1c805a 100644
--- a/pkgs/development/python-modules/parametrize-from-file/default.nix
+++ b/pkgs/development/python-modules/parametrize-from-file/default.nix
@@ -21,7 +21,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     inherit version;
     pname = "parametrize_from_file";
-    sha256 = "1c91j869n2vplvhawxc1sv8km8l53bhlxhhms43fyjsqvy351v5j";
+    hash = "sha256-suxQht9YS+8G0RXCTuEahaI60daBda7gpncLmwySIbE=";
   };
 
   patches = [
@@ -54,7 +54,14 @@ buildPythonPackage rec {
     toml
   ];
 
-  pythonImportsCheck = [ "parametrize_from_file" ];
+  pythonImportsCheck = [
+    "parametrize_from_file"
+  ];
+
+  disabledTests = [
+    # https://github.com/kalekundert/parametrize_from_file/issues/19
+    "test_load_suite_params_err"
+  ];
 
   meta = with lib; {
     description = "Read unit test parameters from config files";
diff --git a/pkgs/development/python-modules/python-otbr-api/default.nix b/pkgs/development/python-modules/python-otbr-api/default.nix
index 11f402cc7a9e..183fb31d065f 100644
--- a/pkgs/development/python-modules/python-otbr-api/default.nix
+++ b/pkgs/development/python-modules/python-otbr-api/default.nix
@@ -1,5 +1,6 @@
 { lib
 , aiohttp
+, bitstruct
 , buildPythonPackage
 , cryptography
 , fetchFromGitHub
@@ -11,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "python-otbr-api";
-  version = "1.0.5";
+  version = "1.0.7";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -20,7 +21,7 @@ buildPythonPackage rec {
     owner = "home-assistant-libs";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-yI7TzVJGSWdi+NKZ0CCOi3BC4WIqFuS7YZgihfWDBSY=";
+    hash = "sha256-R6H+h6IbyI/Qhwb6ACT2sx/YWmLDMyg4gLMJdmNj2wk=";
   };
 
   nativeBuildInputs = [
@@ -29,6 +30,7 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     aiohttp
+    bitstruct
     cryptography
     voluptuous
   ];
diff --git a/pkgs/development/python-modules/pyvex/default.nix b/pkgs/development/python-modules/pyvex/default.nix
index 628e01dde909..2b4afb7802c2 100644
--- a/pkgs/development/python-modules/pyvex/default.nix
+++ b/pkgs/development/python-modules/pyvex/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "pyvex";
-  version = "9.2.40";
+  version = "9.2.41";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-M4eo/ADLoisxl2VFbLN2/VUV8vpDOxP+T6r5STDtyaA=";
+    hash = "sha256-NYNxuWvAvx5IW1gdWv+EF321yzUPaqFBRNKVwu4ogug=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/qtile-extras/default.nix b/pkgs/development/python-modules/qtile-extras/default.nix
new file mode 100644
index 000000000000..76962bb49671
--- /dev/null
+++ b/pkgs/development/python-modules/qtile-extras/default.nix
@@ -0,0 +1,84 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, setuptools-scm
+, pytestCheckHook
+, xorgserver
+, pulseaudio
+, pytest-asyncio
+, qtile
+, keyring
+, requests
+, stravalib
+}:
+
+buildPythonPackage rec {
+  pname = "qtile-extras";
+  version = "0.22.1";
+  format = "setuptools";
+
+  src = fetchFromGitHub {
+    owner = "elParaguayo";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-2dMpGLtwIp7+aoOgYav2SAjaKMiXHmmvsWTBEIMKEW4=";
+  };
+
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  nativeBuildInputs = [ setuptools-scm ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    xorgserver
+  ];
+  checkInputs = [
+    pytest-asyncio
+    qtile.unwrapped
+    pulseaudio
+    keyring
+    requests
+    stravalib
+  ];
+  disabledTests = [
+    # AttributeError: 'ImgMask' object has no attribute '_default_size'. Did you mean: 'default_size'?
+    # cairocffi.pixbuf.ImageLoadingError: Pixbuf error: Unrecognized image file format
+    "test_draw"
+    "test_icons"
+    "1-x11-GithubNotifications-kwargs3"
+    "1-x11-SnapCast-kwargs8"
+    "1-x11-TVHWidget-kwargs10"
+    "test_tvh_widget_not_recording"
+    "test_tvh_widget_recording"
+    "test_tvh_widget_popup"
+    "test_snapcast_options"
+    # ValueError: Namespace Gdk not available
+    # AssertionError: Window never appeared...
+    "test_gloabl_menu"
+    "test_statusnotifier_menu"
+    # AttributeError: 'str' object has no attribute 'canonical'
+    "test_strava_widget_display"
+    "test_strava_widget_popup"
+    # Needs a running DBUS
+    "test_brightness_power_saving"
+    "test_upower_all_batteries"
+    "test_upower_named_battery"
+    "test_upower_low_battery"
+    "test_upower_critical_battery"
+    "test_upower_charging"
+    "test_upower_show_text"
+  ];
+  preCheck = ''
+    export HOME=$(mktemp -d)
+  '';
+
+  pythonImportsCheck = [ "qtile_extras" ];
+
+  meta = with lib; {
+    description = "Extra modules and widgets for the Qtile tiling window manager";
+    homepage = "https://github.com/elParaguayo/qtile-extras";
+    changelog = "https://github.com/elParaguayo/qtile-extras/blob/${src.rev}/CHANGELOG";
+    license = licenses.mit;
+    maintainers = with maintainers; [ arjan-s ];
+  };
+}
diff --git a/pkgs/development/python-modules/sphinxext-opengraph/default.nix b/pkgs/development/python-modules/sphinxext-opengraph/default.nix
index bcf5faedb339..4109e513dd35 100644
--- a/pkgs/development/python-modules/sphinxext-opengraph/default.nix
+++ b/pkgs/development/python-modules/sphinxext-opengraph/default.nix
@@ -2,7 +2,9 @@
 , buildPythonPackage
 , fetchFromGitHub
 , sphinx
+, matplotlib
 , pytestCheckHook
+, pythonOlder
 , beautifulsoup4
 , setuptools-scm
 }:
@@ -10,6 +12,9 @@
 buildPythonPackage rec {
   pname = "sphinxext-opengraph";
   version = "0.8.1";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "wpilibsuite";
@@ -26,6 +31,7 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     sphinx
+    matplotlib
   ];
 
   nativeCheckInputs = [
@@ -38,6 +44,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Sphinx extension to generate unique OpenGraph metadata";
     homepage = "https://github.com/wpilibsuite/sphinxext-opengraph";
+    changelog = "https://github.com/wpilibsuite/sphinxext-opengraph/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ Luflosi ];
   };
diff --git a/pkgs/development/tools/conftest/default.nix b/pkgs/development/tools/conftest/default.nix
index d122d5ea88e6..23d4e7a1b43e 100644
--- a/pkgs/development/tools/conftest/default.nix
+++ b/pkgs/development/tools/conftest/default.nix
@@ -6,15 +6,15 @@
 
 buildGoModule rec {
   pname = "conftest";
-  version = "0.39.1";
+  version = "0.39.2";
 
   src = fetchFromGitHub {
     owner = "open-policy-agent";
     repo = "conftest";
     rev = "refs/tags/v${version}";
-    hash = "sha256-CSvsHp89FugOQ0PLb26PH1nnw5bOVk7bU5q3lJh0HiU=";
+    hash = "sha256-QthFKdO68kFePAMQX239f4HJNG5ZkOyxEq6zmHuDNE4=";
   };
-  vendorHash = "sha256-HMHG7vGfic9ZseTyM9Fs2fFsJzMTKjHpz67I+WkMJXk=";
+  vendorHash = "sha256-6JYn8o696uDKayw5zLoys5UNIFS2FK2LOZw62rgP72Y=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/development/tools/gqlgenc/default.nix b/pkgs/development/tools/gqlgenc/default.nix
new file mode 100644
index 000000000000..4f81b849a9ef
--- /dev/null
+++ b/pkgs/development/tools/gqlgenc/default.nix
@@ -0,0 +1,24 @@
+{ buildGoModule, fetchFromGitHub, lib }:
+
+buildGoModule rec {
+  pname = "gqlgenc";
+  version = "0.11.3";
+
+  src = fetchFromGitHub {
+    owner = "yamashou";
+    repo = "gqlgenc";
+    rev = "v${version}";
+    sha256 = "sha256-yMM6LR5Zviwr1OduSUxsSzdzrb+Lv5ILkVjXWD0b0FU=";
+  };
+
+  excludedPackages = [ "example" ];
+
+  vendorHash = "sha256-d95w9cApLyYu+OOP4UM5/+4DDU2LqyHU8E3wSTW8c7Q=";
+
+  meta = with lib; {
+    description = "Go tool for building GraphQL client with gqlgen";
+    homepage = "https://github.com/Yamashou/gqlgenc";
+    license = licenses.mit;
+    maintainers = with maintainers; [ milran ];
+  };
+}
diff --git a/pkgs/development/tools/misc/netcoredbg/arm64.patch b/pkgs/development/tools/misc/netcoredbg/arm64.patch
new file mode 100644
index 000000000000..ac057798c248
--- /dev/null
+++ b/pkgs/development/tools/misc/netcoredbg/arm64.patch
@@ -0,0 +1,26 @@
+diff --git a/platformdefinitions.cmake b/platformdefinitions.cmake
+index ed3d9f6..6b0628f 100644
+--- a/platformdefinitions.cmake
++++ b/platformdefinitions.cmake
+@@ -7,17 +7,21 @@ if (CLR_CMAKE_PLATFORM_ARCH_AMD64)
+   add_definitions(-DAMD64)
+   add_definitions(-DBIT64=1)          # CoreClr <= 3.x
+   add_definitions(-DHOST_64BIT=1)     # CoreClr > 3.x
++  add_definitions(-DHOST_AMD64)
+ elseif (CLR_CMAKE_PLATFORM_ARCH_I386)
+   add_definitions(-D_X86_)
++  add_definitions(-DHOST_X86)
+ elseif (CLR_CMAKE_PLATFORM_ARCH_ARM)
+   add_definitions(-D_ARM_)
+   add_definitions(-DARM)
++  add_definitions(-DHOST_ARM)
+ elseif (CLR_CMAKE_PLATFORM_ARCH_ARM64)
+   add_definitions(-D_ARM64_)
+   add_definitions(-DARM64)
+   add_definitions(-D_WIN64)
+   add_definitions(-DBIT64=1)          # CoreClr <= 3.x
+   add_definitions(-DHOST_64BIT=1)     # CoreClr > 3.x
++  add_definitions(-DHOST_ARM64)
+ else ()
+   clr_unknown_arch()
+ endif ()
diff --git a/pkgs/development/tools/misc/netcoredbg/darwin.patch b/pkgs/development/tools/misc/netcoredbg/darwin.patch
new file mode 100644
index 000000000000..ece3e51554f2
--- /dev/null
+++ b/pkgs/development/tools/misc/netcoredbg/darwin.patch
@@ -0,0 +1,17 @@
+diff --git a/detectplatform.cmake b/detectplatform.cmake
+index 7b93bbf..6fa6e9e 100644
+--- a/detectplatform.cmake
++++ b/detectplatform.cmake
+@@ -56,7 +56,11 @@ endif(CMAKE_SYSTEM_NAME STREQUAL Linux)
+ 
+ if(CMAKE_SYSTEM_NAME STREQUAL Darwin)
+   set(CLR_CMAKE_PLATFORM_UNIX 1)
+-  set(CLR_CMAKE_PLATFORM_UNIX_AMD64 1)
++  if(CMAKE_SYSTEM_PROCESSOR STREQUAL arm64)
++     set(CLR_CMAKE_PLATFORM_UNIX_ARM64 1)
++   else()
++     set(CLR_CMAKE_PLATFORM_UNIX_AMD64 1)
++   endif()
+   set(CLR_CMAKE_PLATFORM_DARWIN 1)
+   if(CMAKE_VERSION VERSION_LESS "3.4.0")
+     set(CMAKE_ASM_COMPILE_OBJECT "${CMAKE_C_COMPILER} <FLAGS> <DEFINES> -o <OBJECT> -c <SOURCE>")
diff --git a/pkgs/development/tools/misc/netcoredbg/default.nix b/pkgs/development/tools/misc/netcoredbg/default.nix
index 6ea15d74d8cf..d4a167b75111 100644
--- a/pkgs/development/tools/misc/netcoredbg/default.nix
+++ b/pkgs/development/tools/misc/netcoredbg/default.nix
@@ -1,45 +1,44 @@
-{ lib, clangStdenv, stdenvNoCC, cmake, fetchFromGitHub, dotnetCorePackages, buildDotnetModule }:
+{ lib, clangStdenv, stdenv, cmake, autoPatchelfHook, fetchFromGitHub, dotnetCorePackages, buildDotnetModule }:
 let
   pname = "netcoredbg";
-  version = "2.0.0-895";
+  version = "2.2.0-961";
+  hash = "0gbjm8x40hzf787kccfxqb2wdgfks81f6hzr6rrmid42s4bfs5w7";
 
-  # according to CMakeLists.txt, this should be 3.1 even when building for .NET 5
-  coreclr-version = "3.1.19";
+  coreclr-version = "release/7.0";
   coreclr-src = fetchFromGitHub {
     owner = "dotnet";
-    repo = "coreclr";
-    rev = "v${coreclr-version}";
-    sha256 = "o1KafmXqNjX9axr6sSxPKrfUX0e+b/4ANiVQt4T2ybw=";
+    repo = "runtime";
+    rev = coreclr-version;
+    sha256 = "sha256-kBYb0Uw1IzDTpsEyd02/5sliVHoLmZdGnpybneV0u7U=";
   };
 
-  dotnet-sdk = dotnetCorePackages.sdk_6_0;
+  dotnet-sdk = dotnetCorePackages.sdk_7_0;
 
   src = fetchFromGitHub {
     owner = "Samsung";
     repo = pname;
     rev = version;
-    sha256 = "sha256-zOfChuNjD6py6KD1AmN5DgCGxD2YNH9gTyageoiN8PU=";
+    sha256 = hash;
   };
 
-  unmanaged = clangStdenv.mkDerivation rec {
+  unmanaged = clangStdenv.mkDerivation {
     inherit src pname version;
 
-    patches = [ ./limits.patch ];
+    # patch for arm from: https://github.com/Samsung/netcoredbg/pull/103#issuecomment-1446375535
+    # needed until https://github.com/dotnet/runtime/issues/78286 is resolved
+    # patch for darwin from: https://github.com/Samsung/netcoredbg/pull/103#issuecomment-1446457522
+    # needed until: ?
+    patches = [ ./arm64.patch ./darwin.patch ];
     nativeBuildInputs = [ cmake dotnet-sdk ];
 
     hardeningDisable = [ "strictoverflow" ];
 
     preConfigure = ''
       export DOTNET_SYSTEM_GLOBALIZATION_INVARIANT=1
-      dotnetVersion="$(${dotnet-sdk}/bin/dotnet --list-runtimes | grep -Po '^Microsoft.NETCore.App \K.*?(?= )')"
-
-      cmakeFlagsArray+=(
-        "-DDBGSHIM_RUNTIME_DIR=${dotnet-sdk}/shared/Microsoft.NETCore.App/$dotnetVersion"
-      )
     '';
 
     cmakeFlags = [
-      "-DCORECLR_DIR=${coreclr-src}"
+      "-DCORECLR_DIR=${coreclr-src}/src/coreclr"
       "-DDOTNET_DIR=${dotnet-sdk}"
       "-DBUILD_MANAGED=0"
     ];
@@ -51,21 +50,35 @@ let
     projectFile = "src/managed/ManagedPart.csproj";
     nugetDeps = ./deps.nix;
 
+    # include platform-specific dbgshim binary in nugetDeps
+    dotnetFlags = [ "-p:UseDbgShimDependency=true" ];
     executables = [ ];
+
+    # this passes RID down to dotnet build command
+    # and forces dotnet to include binary dependencies in the output (libdbgshim)
+    selfContainedBuild = true;
   };
 in
-stdenvNoCC.mkDerivation {
+stdenv.mkDerivation rec {
   inherit pname version;
+  # managed brings external binaries (libdbgshim.*)
+  # include source here so that autoPatchelfHook can do it's job
+  src = managed;
 
-  buildCommand = ''
+  nativeBuildInputs = lib.optionals stdenv.isLinux [ autoPatchelfHook ];
+  buildInputs = lib.optionals stdenv.isLinux [ stdenv.cc.cc.lib ];
+  installPhase = ''
     mkdir -p $out/share/netcoredbg $out/bin
     cp ${unmanaged}/* $out/share/netcoredbg
-    cp ${managed}/lib/netcoredbg/* $out/share/netcoredbg
-    ln -s $out/share/netcoredbg/netcoredbg $out/bin/netcoredbg
+    cp ./lib/netcoredbg/* $out/share/netcoredbg
+    # darwin won't work unless we link all files
+    ln -s $out/share/netcoredbg/* "$out/bin/"
   '';
 
   passthru = {
     inherit (managed) fetch-deps;
+
+    updateScript = [ ./update.sh pname version meta.homepage ];
   };
 
   meta = with lib; {
@@ -73,6 +86,6 @@ stdenvNoCC.mkDerivation {
     homepage = "https://github.com/Samsung/netcoredbg";
     license = licenses.mit;
     platforms = platforms.unix;
-    maintainers = [ maintainers.leo60228 ];
+    maintainers = with maintainers; [ leo60228 konradmalik ];
   };
 }
diff --git a/pkgs/development/tools/misc/netcoredbg/deps.nix b/pkgs/development/tools/misc/netcoredbg/deps.nix
index 8d311ab7f8bd..a073c98d5d43 100644
--- a/pkgs/development/tools/misc/netcoredbg/deps.nix
+++ b/pkgs/development/tools/misc/netcoredbg/deps.nix
@@ -8,6 +8,19 @@
   (fetchNuGet { pname = "Microsoft.CodeAnalysis.CSharp.Scripting"; version = "2.3.0"; sha256 = "121dhnfjd5jzm410dk79s8xk5jvd09xa0w5q3lbpqc7bs4wxmq4p"; })
   (fetchNuGet { pname = "Microsoft.CodeAnalysis.Scripting.Common"; version = "2.3.0"; sha256 = "11f11kvgrdgs86ykz4104jx1iw78v6af48hpdrhmr7y7h5334ziq"; })
   (fetchNuGet { pname = "Microsoft.CSharp"; version = "4.4.0"; sha256 = "1niyzqqfyhvh4zpxn8bcyyldynqlw0rfr1apwry4b3yrdnjh1hhh"; })
+  (fetchNuGet { pname = "Microsoft.Diagnostics.DbgShim"; version = "7.0.410101"; sha256 = "0az67ay2977gyksh039lamap2a7jcr4c8df4imqrdaqx1ksir993"; })
+  (fetchNuGet { pname = "Microsoft.Diagnostics.DbgShim.linux-arm"; version = "7.0.410101"; sha256 = "1x5iilp2436w2pjp9c29xwj6vlq4z43qhprz35yxvfzhg0vdsg0l"; })
+  (fetchNuGet { pname = "Microsoft.Diagnostics.DbgShim.linux-arm64"; version = "7.0.410101"; sha256 = "1zbrcr5iydbbyb48w2wksbckjgddd74z6xczcsb5b0gvyqra85sn"; })
+  (fetchNuGet { pname = "Microsoft.Diagnostics.DbgShim.linux-musl-arm"; version = "7.0.410101"; sha256 = "179xp33f6aaaf775m673ij1zzrkfk7a07jmm7hcna9nb4ils04yg"; })
+  (fetchNuGet { pname = "Microsoft.Diagnostics.DbgShim.linux-musl-arm64"; version = "7.0.410101"; sha256 = "0gjyw14ppwsy22c0f0ckxj6gan8gq8sk564bm762jgbvpj9w6br2"; })
+  (fetchNuGet { pname = "Microsoft.Diagnostics.DbgShim.linux-musl-x64"; version = "7.0.410101"; sha256 = "00yk3b7pygprgm53nlv9l6grrbykrv6dg27jmhw431dnv978wcqd"; })
+  (fetchNuGet { pname = "Microsoft.Diagnostics.DbgShim.linux-x64"; version = "7.0.410101"; sha256 = "1k3182xh0a6fc8j5vspi0qx75has4gwydcr2hrbrapc2x850xq0z"; })
+  (fetchNuGet { pname = "Microsoft.Diagnostics.DbgShim.osx-arm64"; version = "7.0.410101"; sha256 = "06mqqj2bpvqqaxh0hfa580m6db213zy349k0x8ah34whzp3bgphk"; })
+  (fetchNuGet { pname = "Microsoft.Diagnostics.DbgShim.osx-x64"; version = "7.0.410101"; sha256 = "0yxlb8k935i0yc3cxl996bnk86b4qghlqmmjrv4s8mc5qai351ws"; })
+  (fetchNuGet { pname = "Microsoft.Diagnostics.DbgShim.win-arm"; version = "7.0.410101"; sha256 = "10ad931l9vrz3sc4xjyndak8p3wi5gl92r37yp7smjx8ik09azma"; })
+  (fetchNuGet { pname = "Microsoft.Diagnostics.DbgShim.win-arm64"; version = "7.0.410101"; sha256 = "1xd85r13qbk6awbrnp2q4a5vvcpwl7rw62s404rxrl4ghy2a43xz"; })
+  (fetchNuGet { pname = "Microsoft.Diagnostics.DbgShim.win-x64"; version = "7.0.410101"; sha256 = "1zlamjlv1s4d40sf08bbr6c7157lgchcla9x2g911ac0mnh8qqbf"; })
+  (fetchNuGet { pname = "Microsoft.Diagnostics.DbgShim.win-x86"; version = "7.0.410101"; sha256 = "0sk3akxgb1vw03fkj59m3n90j6v0a5g4px83h2llda8p5q729zbr"; })
   (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "1.1.0"; sha256 = "08vh1r12g6ykjygq5d3vq09zylgb84l63k49jc4v8faw9g93iqqm"; })
   (fetchNuGet { pname = "Microsoft.NETCore.Targets"; version = "1.1.0"; sha256 = "193xwf33fbm0ni3idxzbr5fdq3i2dlfgihsac9jj7whj0gd902nh"; })
   (fetchNuGet { pname = "NETStandard.Library"; version = "2.0.3"; sha256 = "1fn9fxppfcg4jgypp2pmrpr6awl3qz1xmnri0cygpkwvyx27df1y"; })
diff --git a/pkgs/development/tools/misc/netcoredbg/limits.patch b/pkgs/development/tools/misc/netcoredbg/limits.patch
deleted file mode 100644
index 8a2dcced32c5..000000000000
--- a/pkgs/development/tools/misc/netcoredbg/limits.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff --git a/src/debugger/frames.cpp b/src/debugger/frames.cpp
-index 534936b..21366f9 100644
---- a/src/debugger/frames.cpp
-+++ b/src/debugger/frames.cpp
-@@ -9,6 +9,7 @@
- #include "utils/platform.h"
- #include "utils/logger.h"
- #include "utils/torelease.h"
-+#include <limits>
- 
- namespace netcoredbg
- {
diff --git a/pkgs/development/tools/misc/netcoredbg/update.sh b/pkgs/development/tools/misc/netcoredbg/update.sh
new file mode 100755
index 000000000000..a4dbb8f0291d
--- /dev/null
+++ b/pkgs/development/tools/misc/netcoredbg/update.sh
@@ -0,0 +1,37 @@
+#! /usr/bin/env nix-shell
+#! nix-shell -I nixpkgs=./. -i bash -p common-updater-scripts
+# shellcheck shell=bash
+
+set -euo pipefail
+
+pname=$1
+old_version=$2
+url=$3
+
+cd "$(dirname "${BASH_SOURCE[0]}")"
+
+deps_file="$(realpath "./deps.nix")"
+
+new_version="$(list-git-tags --url="$url" | sort --reverse --numeric-sort | head -n 1)"
+
+if [[ "$new_version" == "$old_version" ]]; then
+    echo "Already up to date!"
+    exit 0
+fi
+
+updateVersion() {
+    sed -i "s/version = \"$old_version\";/version = \"$new_version\";/g" default.nix
+}
+
+updateHash() {
+    hashKey="hash"
+    hash=$(nix-prefetch-url --unpack --type sha256 "$url/archive/$new_version.tar.gz")
+    sed -i "s|$hashKey = \"[a-zA-Z0-9\/+-=]*\";|$hashKey = \"$hash\";|g" default.nix
+}
+
+updateVersion
+updateHash
+
+cd ../../../../../
+
+$(nix-build -A "$pname".fetch-deps --no-out-link) "$deps_file"
diff --git a/pkgs/development/tools/misc/terracognita/default.nix b/pkgs/development/tools/misc/terracognita/default.nix
index d101e017bfdf..6734b4fd858f 100644
--- a/pkgs/development/tools/misc/terracognita/default.nix
+++ b/pkgs/development/tools/misc/terracognita/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "terracognita";
-  version = "0.8.1";
+  version = "0.8.2";
 
   src = fetchFromGitHub {
     owner = "cycloidio";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-pI/TxC+RCQjtkYBA+BwW1jlDURKh1uf45GTIqz/rih8=";
+    sha256 = "sha256-OzqIUnvWVxaUAWRIKDWaxtmTeFGqvVYAgdbG4jrph7w=";
   };
 
-  vendorSha256 = "sha256-ihoWhiK3TO1lAvk1oU8HVVDBDvLFBw+MMaK2avWfCB4=";
+  vendorHash = "sha256-LzkxVxqBJ3pRk3EI+/Lc6XSNyxhPUg61GKwI1Kmadsc=";
 
   doCheck = false;
 
diff --git a/pkgs/development/tools/typos/default.nix b/pkgs/development/tools/typos/default.nix
index 2be0b533c6f1..7a0057ce1cde 100644
--- a/pkgs/development/tools/typos/default.nix
+++ b/pkgs/development/tools/typos/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "typos";
-  version = "1.13.16";
+  version = "1.13.18";
 
   src = fetchFromGitHub {
     owner = "crate-ci";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-3LJkWpksI9nep7QtEJdiEUZmwrWLyG/JKdu9YQh3KVk=";
+    hash = "sha256-J7K7fqtHNQYk6JlcHhcyojHQlIyaQVlAsDnfJUX1Ess=";
   };
 
-  cargoHash = "sha256-Wqikf248nZE2iQ6zU4bvz10PL/Z/WJ1srImi+bZ8s5w=";
+  cargoHash = "sha256-a6ENeLG/t8Nb8oTNkcIWlquav4wJ0a3CqDEMQwTiuMM=";
 
   meta = with lib; {
     description = "Source code spell checker";
diff --git a/pkgs/development/tools/xc/default.nix b/pkgs/development/tools/xc/default.nix
index 8eb01e4dca09..9b4643435bac 100644
--- a/pkgs/development/tools/xc/default.nix
+++ b/pkgs/development/tools/xc/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "xc";
-  version = "0.0.159";
+  version = "0.0.175";
 
   src = fetchFromGitHub {
     owner = "joerdav";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-5Vw/UStMtP5CHbSCOzeD4LMJccPG34Rxw9VHc9Ut3oM=";
+    sha256 = "sha256-Uc9MTxl32xQ7u6N0mocDAoD9tgv/YOPCzhonsavX9Vo=";
   };
 
-  vendorHash = "sha256-XDJdCh6P8ScSvxY55ExKgkgFQqmBaM9fMAjAioEQ0+s=";
+  vendorHash = "sha256-cySflcTuAzbFZbtXmzZ98nfY8HUq1UedONTtKP4EICs=";
 
   meta = with lib; {
     homepage = "https://xcfile.dev/";
diff --git a/pkgs/development/tools/ytt/default.nix b/pkgs/development/tools/ytt/default.nix
index 8e33b84b364e..4bb1572cdbe5 100644
--- a/pkgs/development/tools/ytt/default.nix
+++ b/pkgs/development/tools/ytt/default.nix
@@ -1,13 +1,13 @@
 { lib, buildGoModule, fetchFromGitHub }:
 buildGoModule rec {
   pname = "ytt";
-  version = "0.44.1";
+  version = "0.45.0";
 
   src = fetchFromGitHub {
     owner = "vmware-tanzu";
     repo = "carvel-ytt";
     rev = "v${version}";
-    sha256 = "sha256-3uyMwW8v2rPguXbPKy8IyQxroNaNS6rrXEcgRP91fdU=";
+    sha256 = "sha256-G8rQEDVTv3e5YFwKSL7Rd1Is1kjBl08DL4Kl6H8aa68=";
   };
 
   vendorSha256 = null;
diff --git a/pkgs/games/katawa-shoujo/default.nix b/pkgs/games/katawa-shoujo/default.nix
new file mode 100644
index 000000000000..e549fbbcf963
--- /dev/null
+++ b/pkgs/games/katawa-shoujo/default.nix
@@ -0,0 +1,181 @@
+{ stdenvNoCC
+, lib
+, fetchurl
+, autoPatchelfHook
+, copyDesktopItems
+, freetype
+, makeDesktopItem
+, makeWrapper
+, libGL
+, libGLU
+# Darwin cannot handle these when devendored:
+# - DYLD_LIBRARY_PATH masks system libraries with similar, differently-cased names and cause missing symbol errors
+# - symlinks cause unrelated BMP image loading to fail(?)
+, devendorImageLibs ? !stdenvNoCC.hostPlatform.isDarwin
+, libjpeg
+, libpng12
+, libX11
+, libXext
+, libXi
+, libXmu
+, runtimeShell
+, SDL_compat
+, SDL_image
+, SDL_ttf
+, undmg
+, unrpa
+, zlib
+}:
+
+let
+  stdenv = stdenvNoCC;
+  srcDetails = rec {
+    x86_64-linux = {
+      urlSuffix = "%5blinux-x86%5d%5b18161880%5d.tar.bz2";
+      hash = "sha256-7FoFz88dWYHs2/pxkEwnmiFeeb3+slayrWknEJoAB9o=";
+    };
+    i686-linux = x86_64-linux;
+    x86_64-darwin = {
+      urlSuffix = "%5bmac%5d%5b1DFC84A6%5d.dmg";
+      hash = "sha256-Sc5BAlpJsffjcNrZ8+VU3n7G10DoqDKQn/leHDW32Y8=";
+    };
+  }.${stdenv.hostPlatform.system} or (throw "Don't know how to fetch source for ${stdenv.hostPlatform.system}!");
+in
+stdenv.mkDerivation rec {
+  pname = "katawa-shoujo";
+  version = "1.3.1";
+
+  src = fetchurl {
+    url = "https://dl.katawa-shoujo.com/gold_${version}/%5b4ls%5d_katawa_shoujo_${version}-${srcDetails.urlSuffix}";
+    inherit (srcDetails) hash;
+  };
+
+  # fetchzip requires a custom unpackPhase to handle dmg, fetchurl cannot handle undmg producing >1 directory without this
+  sourceRoot = ".";
+
+  nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [
+    autoPatchelfHook
+    copyDesktopItems
+    unrpa
+  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    makeWrapper
+    undmg
+  ];
+
+  buildInputs = [
+    freetype
+    SDL_compat
+    zlib
+  ] ++ lib.optionals devendorImageLibs [
+    libjpeg
+    libpng12
+  ] ++ lib.optionals stdenv.hostPlatform.isLinux [
+    libX11
+    libXext
+    libXi
+    libXmu
+    libGL
+    libGLU
+  ];
+
+  desktopItems = [(makeDesktopItem rec {
+    name = "katawa-shoujo";
+    desktopName = "Katawa Shoujo";
+    comment = meta.description;
+    exec = name;
+    icon = name;
+    categories = [ "Game" ];
+  })];
+
+  dontConfigure = true;
+  dontBuild = true;
+
+  installPhase = let
+    platformDetails = with stdenv.hostPlatform; if isDarwin then rec {
+      arch = "darwin-x86_64";
+      sourceDir = "'Katawa Shoujo'.app";
+      installDir = "$out/Applications/'Katawa Shoujo'.app";
+      dataDir = "${installDir}/Contents/Resources/autorun";
+      bin = "${installDir}/Contents/MacOS/'Katawa Shoujo'";
+    } else rec {
+      arch = "linux-${if isx86_64 then "x86_64" else "i686"}";
+      sourceDir = "'Katawa Shoujo'-${version}-linux";
+      installDir = "$out/share/katawa-shoujo";
+      dataDir = installDir;
+      bin = "${installDir}/'Katawa Shoujo'.sh";
+    };
+    libDir = with platformDetails; "${dataDir}/lib/${arch}";
+  in with platformDetails; ''
+    runHook preInstall
+
+    mkdir -p "$(dirname ${installDir})"
+    cp -R ${sourceDir} ${installDir}
+
+    # Simplify launcher script
+    cat <<EOF >${bin}
+    #!${runtimeShell}
+    exec \$RENPY_GDB ${libDir}/'Katawa Shoujo' \$RENPY_PYARGS -EO ${dataDir}/'Katawa Shoujo'.py "\$@"
+    EOF
+
+  '' + (if stdenv.hostPlatform.isDarwin then ''
+    # No autoPatchelfHook on Darwin
+    wrapProgram ${bin} \
+      --prefix DYLD_LIBRARY_PATH : ${lib.makeLibraryPath buildInputs}
+  '' else ''
+    # Extract icon for xdg desktop file
+    unrpa ${dataDir}/game/data.rpa
+    install -Dm644 ui/icon.png $out/share/icons/hicolor/512x512/apps/katawa-shoujo.png
+  '') + ''
+
+    # Delete binaries for wrong arch, autoPatchelfHook gets confused by them & less to keep in the store
+    find "$(dirname ${libDir})" -mindepth 1 -maxdepth 1 \
+      -not -name 'python*' -not -name ${arch} \
+      -exec rm -r {} \;
+
+    # Replace some bundled libs so Nixpkgs' versions are used
+    rm ${libDir}/libz*
+    rm ${libDir}/libfreetype*
+    rm ${libDir}/libSDL-1.2*
+  '' + lib.optionalString devendorImageLibs ''
+    rm ${libDir}/libjpeg*
+    rm ${libDir}/libpng12*
+  '' + ''
+
+    mkdir -p $out/share/{doc,licenses}/katawa-shoujo
+    mv ${dataDir}/'Game Manual'.pdf $out/share/doc/katawa-shoujo/
+    mv ${dataDir}/LICENSE.txt $out/share/licenses/katawa-shoujo/
+
+    mkdir -p $out/bin
+    ln -s ${bin} $out/bin/katawa-shoujo
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Bishoujo-style visual novel by Four Leaf Studios, built in Ren'Py";
+    longDescription = ''
+      Katawa Shoujo is a bishoujo-style visual novel set in the fictional Yamaku High School for disabled children,
+      located somewhere in modern Japan. Hisao Nakai, a normal boy living a normal life, has his life turned upside down
+      when a congenital heart defect forces him to move to a new school after a long hospitalization. Despite his difficulties,
+      Hisao is able to find friends—and perhaps love, if he plays his cards right. There are five main paths corresponding
+      to the 5 main female characters, each path following the storyline pertaining to that character.
+
+      The story is told through the perspective of the main character, using a first person narrative. The game uses a
+      traditional text and sprite-based visual novel model with an ADV text box.
+
+      Katawa Shoujo contains adult material, and was created using the Ren'Py scripting system. It is the product of an
+      international team of amateur developers, and is available free of charge under the Creative Commons BY-NC-ND License.
+    '';
+    homepage = "https://www.katawa-shoujo.com/";
+    # https://www.katawa-shoujo.com/about.php
+    # November 2022: Update, is it still ND?
+    # https://ks.renai.us/viewtopic.php?f=13&p=248149#p248149
+    license = with licenses; [ cc-by-nc-nd-30 ];
+    maintainers = with maintainers; [ OPNA2608 ];
+    # Building Ren'Py6 from source would allow more, but too much of a hassle
+    platforms = platforms.x86;
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+    # Needs different srcDetails & installPhase
+    broken = stdenv.hostPlatform.isWindows;
+  };
+}
diff --git a/pkgs/servers/home-automation/evcc/default.nix b/pkgs/servers/home-automation/evcc/default.nix
index faadfff26e56..04a425169207 100644
--- a/pkgs/servers/home-automation/evcc/default.nix
+++ b/pkgs/servers/home-automation/evcc/default.nix
@@ -16,16 +16,16 @@
 
 buildGo120Module rec {
   pname = "evcc";
-  version = "0.114.0";
+  version = "0.114.1";
 
   src = fetchFromGitHub {
     owner = "evcc-io";
     repo = pname;
     rev = version;
-    hash = "sha256-YPqt1UfXP2LGSopQuM4PXQJG3MmXg+5VjDpBKpV5axI=";
+    hash = "sha256-c+XHSO6waDyju8oXFWGYeaCCqyaYdU2JLXr+NDXijdU=";
   };
 
-  vendorHash = "sha256-CNBwOVykQW7RUuf6oFTxO2DU6sd5IJVqN+6FPytQh+U=";
+  vendorHash = "sha256-O58Y9mfHmNUWtHmdO3hvZQbFlcqfZs0GmQDcx2RKRUs=";
 
   npmDeps = fetchNpmDeps {
     inherit src;
diff --git a/pkgs/servers/onlyoffice-documentserver/default.nix b/pkgs/servers/onlyoffice-documentserver/default.nix
index 517d288b8f7b..c79548a0e9f9 100644
--- a/pkgs/servers/onlyoffice-documentserver/default.nix
+++ b/pkgs/servers/onlyoffice-documentserver/default.nix
@@ -15,11 +15,11 @@ let
   # var/www/onlyoffice/documentserver/server/DocService/docservice
   onlyoffice-documentserver = stdenv.mkDerivation rec {
     pname = "onlyoffice-documentserver";
-    version = "7.3.0";
+    version = "7.3.2";
 
     src = fetchurl {
       url = "https://github.com/ONLYOFFICE/DocumentServer/releases/download/v${lib.concatStringsSep "." (lib.take 3 (lib.splitVersion version))}/onlyoffice-documentserver_amd64.deb";
-      sha256 = "sha256-PBea6VYJkjBf19AQ702OtLsHJ230Sc3e3K9HAccL0BM=";
+      sha256 = "sha256-BXKf5M10/ICxSDXJDmJB+T3HSsVXzSs5gu1AApUra3I=";
     };
 
     preferLocalBuild = true;
diff --git a/pkgs/tools/admin/aws-vault/default.nix b/pkgs/tools/admin/aws-vault/default.nix
index a1aa06b4a6a5..49c5e99a353b 100644
--- a/pkgs/tools/admin/aws-vault/default.nix
+++ b/pkgs/tools/admin/aws-vault/default.nix
@@ -7,16 +7,16 @@
 }:
 buildGoModule rec {
   pname = "aws-vault";
-  version = "6.6.2";
+  version = "7.0.0";
 
   src = fetchFromGitHub {
     owner = "99designs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-BijZpk0vograOGlyuK7Wpsv8Y5DJvHUoTJVCex7VTTo=";
+    sha256 = "sha256-i7wL59MvjsLhEIs3Ejc/DB2m6IfrZqLCeSs1ziPCz+0=";
   };
 
-  vendorHash = "sha256-zC4v9TlKHGCYRWX0ZWAVdCM7yw9eaAZ/4ZIZ38sM4S0=";
+  vendorHash = "sha256-kcaQw2ooJupMsK9rYlYZOIAW5H4Oa346K9VGjdnaq1E=";
 
   nativeBuildInputs = [ installShellFiles makeWrapper ];
 
diff --git a/pkgs/tools/backup/autorestic/default.nix b/pkgs/tools/backup/autorestic/default.nix
index 163172145415..b4c873554241 100644
--- a/pkgs/tools/backup/autorestic/default.nix
+++ b/pkgs/tools/backup/autorestic/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "autorestic";
-  version = "1.7.6";
+  version = "1.7.7";
 
   src = fetchFromGitHub {
     owner = "cupcakearmy";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-jlCCARbZSAHK0ojlTdtUl7fo+MAtuQYo64lZeKyQ9ho=";
+    sha256 = "sha256-drinKUJAlgY1PEP7NHOFfmvDVib1AFjT8hRktQgxJ4A=";
   };
 
   vendorHash = "sha256-K3+5DRXcx56sJ4XHikVtmoxmpJbBeAgPkN9KtHVgvYA=";
diff --git a/pkgs/tools/misc/android-tools/default.nix b/pkgs/tools/misc/android-tools/default.nix
index 18d7bf02ed83..adc8856f1672 100644
--- a/pkgs/tools/misc/android-tools/default.nix
+++ b/pkgs/tools/misc/android-tools/default.nix
@@ -9,11 +9,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "android-tools";
-  version = "33.0.3p2";
+  version = "34.0.0";
 
   src = fetchurl {
     url = "https://github.com/nmeum/android-tools/releases/download/${version}/android-tools-${version}.tar.xz";
-    hash = "sha256-a/a1LXOJ55/JK2PMIGRR7kL8T32naddpIhk+mNdfVgQ=";
+    hash = "sha256-+I7FaGk39/svaJw7BQYSPyOZJ2oUZzFksPlUVKTHuXo=";
   };
 
   nativeBuildInputs = [ cmake pkg-config perl go ];
diff --git a/pkgs/tools/misc/fzf/default.nix b/pkgs/tools/misc/fzf/default.nix
index 7b59dd92df46..5c31c5ac9d98 100644
--- a/pkgs/tools/misc/fzf/default.nix
+++ b/pkgs/tools/misc/fzf/default.nix
@@ -66,6 +66,8 @@ buildGoModule rec {
     installManPage man/man1/fzf.1 man/man1/fzf-tmux.1
 
     install -D plugin/* -t $out/share/vim-plugins/${pname}/plugin
+    mkdir -p $out/share/nvim
+    ln -s $out/share/vim-plugins/${pname} $out/share/nvim/site
 
     # Install shell integrations
     install -D shell/* -t $out/share/fzf/
diff --git a/pkgs/tools/networking/gobgp/default.nix b/pkgs/tools/networking/gobgp/default.nix
index b0de8d09c7af..d624d1f48d75 100644
--- a/pkgs/tools/networking/gobgp/default.nix
+++ b/pkgs/tools/networking/gobgp/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "gobgp";
-  version = "3.11.0";
+  version = "3.12.0";
 
   src = fetchFromGitHub {
     owner = "osrg";
     repo = "gobgp";
     rev = "v${version}";
-    sha256 = "sha256-UGRGJqeVWrt8NVf9d5Mk7k+k2Is/fwHv2X0hmyXvTZs=";
+    sha256 = "sha256-keev3DZ3xN5UARuYKfSdox0KKBjrM5RoMD273Aw0AGY=";
   };
 
-  vendorHash = "sha256-9Vi8qrcFC2SazcGVgAf1vbKvxd8rTMgye63wSCaFonk=";
+  vendorHash = "sha256-5lRW9gWQZRRqZoVB16kI1VEnr0XsiPtLUuioK/0f8w0=";
 
   postConfigure = ''
     export CGO_ENABLED=0
diff --git a/pkgs/tools/networking/stunnel/default.nix b/pkgs/tools/networking/stunnel/default.nix
index 4be019c5fa07..5240302c1f6c 100644
--- a/pkgs/tools/networking/stunnel/default.nix
+++ b/pkgs/tools/networking/stunnel/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "stunnel";
-  version = "5.67";
+  version = "5.69";
 
   outputs = [ "out" "doc" "man" ];
 
   src = fetchurl {
     url    = "https://www.stunnel.org/archive/${lib.versions.major version}.x/${pname}-${version}.tar.gz";
-    sha256 = "3086939ee6407516c59b0ba3fbf555338f9d52f459bcab6337c0f00e91ea8456";
+    sha256 = "sha256-H/fZ8wiEx1uYyKCk4VNPp5rcraIyJjXmeHM3tOOP24E=";
     # please use the contents of "https://www.stunnel.org/downloads/stunnel-${version}.tar.gz.sha256",
     # not the output of `nix-prefetch-url`
   };
diff --git a/pkgs/tools/nix/dnadd/default.nix b/pkgs/tools/nix/dnadd/default.nix
index 3f4d76a9c4d4..59a0516629e1 100644
--- a/pkgs/tools/nix/dnadd/default.nix
+++ b/pkgs/tools/nix/dnadd/default.nix
@@ -11,6 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "1vzbgz8y9gj4lszsx4iczfbrj373sl4wi43j7rp46zfcbw323d4r";
   };
 
+  strictDeps = true;
   makeFlags = [ "PREFIX=$(out)" ];
 
   meta = with lib; {
diff --git a/pkgs/tools/nix/info/default.nix b/pkgs/tools/nix/info/default.nix
index 84bd3e891622..73c336afe045 100644
--- a/pkgs/tools/nix/info/default.nix
+++ b/pkgs/tools/nix/info/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, coreutils, findutils, gnugrep, darwin
+{ stdenv, lib, coreutils, findutils, gnugrep, darwin, bash
 # Avoid having GHC in the build-time closure of all NixOS configurations
 , doCheck ? false, shellcheck
 }:
@@ -26,7 +26,9 @@ stdenv.mkDerivation {
   '';
 
   inherit doCheck;
+  strictDeps = true;
   nativeCheckInputs = [ shellcheck ];
+  buildInputs = [ bash ];
 
   checkPhase = ''
     shellcheck ./nix-info
diff --git a/pkgs/tools/nix/nix-script/default.nix b/pkgs/tools/nix/nix-script/default.nix
index f9077ef13871..c83bfbc7a226 100644
--- a/pkgs/tools/nix/nix-script/default.nix
+++ b/pkgs/tools/nix/nix-script/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation {
     sha256 = "0yiqljamcj9x8z801bwj7r30sskrwv4rm6sdf39j83jqql1fyq7y";
   };
 
-  buildInputs  = [
+  strictDeps = true;
+  nativeBuildInputs  = [
     (haskellPackages.ghcWithPackages (hs: with hs; [ posix-escape ]))
   ];
 
diff --git a/pkgs/tools/nix/nixos-generators/default.nix b/pkgs/tools/nix/nixos-generators/default.nix
index fa4495647c6e..bf3a387c439f 100644
--- a/pkgs/tools/nix/nixos-generators/default.nix
+++ b/pkgs/tools/nix/nixos-generators/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitHub, makeWrapper, coreutils, jq, findutils, nix  }:
+{ stdenv, lib, fetchFromGitHub, makeWrapper, coreutils, jq, findutils, nix, bash }:
 
 stdenv.mkDerivation rec {
   pname = "nixos-generators";
@@ -9,7 +9,9 @@ stdenv.mkDerivation rec {
     rev = version;
     sha256 = "sha256-WecDwDY/hEcDQYzFnccCNa+5Umht0lfjx/d1qGDy/rQ=";
   };
+  strictDeps = true;
   nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ bash ];
   installFlags = [ "PREFIX=$(out)" ];
   postFixup = ''
     wrapProgram $out/bin/nixos-generate \
diff --git a/pkgs/tools/nix/nixos-option/default.nix b/pkgs/tools/nix/nixos-option/default.nix
index 9137e5a716c5..a9cc967d7680 100644
--- a/pkgs/tools/nix/nixos-option/default.nix
+++ b/pkgs/tools/nix/nixos-option/default.nix
@@ -3,6 +3,7 @@
 stdenv.mkDerivation rec {
   name = "nixos-option";
   src = ./.;
+  strictDeps = true;
   nativeBuildInputs = [ cmake pkg-config ];
   buildInputs = [ boost nix ];
   meta = with lib; {
diff --git a/pkgs/tools/security/exploitdb/default.nix b/pkgs/tools/security/exploitdb/default.nix
index b5b4e1454c30..9aa32572d60a 100644
--- a/pkgs/tools/security/exploitdb/default.nix
+++ b/pkgs/tools/security/exploitdb/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "exploitdb";
-  version = "2023-03-01";
+  version = "2023-03-06";
 
   src = fetchFromGitLab {
     owner = "exploit-database";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-+1yu5R3JUmp6PylmkIWZlEXlq05fi9Lb1q36iBPWdso=";
+    hash = "sha256-5ieCbYpQqL7+wYDJzGrnH8KWNOGvSQWkhUcIkXOhVo0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/security/kubescape/default.nix b/pkgs/tools/security/kubescape/default.nix
index e8c9aa896e77..24820d08f909 100644
--- a/pkgs/tools/security/kubescape/default.nix
+++ b/pkgs/tools/security/kubescape/default.nix
@@ -6,15 +6,17 @@
 
 buildGoModule rec {
   pname = "kubescape";
-  version = "2.0.161";
+  version = "2.2.4";
 
   src = fetchFromGitHub {
-    owner = "armosec";
+    owner = "kubescape";
     repo = pname;
-    rev = "v${version}";
-    hash = "sha256-rsO6ZTQg5fmpp+5Zx36tQnDW1vf2k+FCI3cFbGZifVM=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-poLPG8C0YbjEFjqWMKO+9plArenkVmR5lGvflgxc3Iw=";
+    fetchSubmodules = true;
   };
-  vendorSha256 = "sha256-EinrVdGdYroh0X/ACAVD2gw4k0jrPHQ3Ucb3TUYKd8Q=";
+
+  vendorHash = "sha256-KoAuM1H9FRcPLD0AipnXOCUiNHcCWnek4sV0ztu5SyI=";
 
   nativeBuildInputs = [
     installShellFiles
@@ -23,7 +25,7 @@ buildGoModule rec {
   ldflags = [
     "-s"
     "-w"
-    "-X github.com/armosec/kubescape/v2/core/cautils.BuildNumber=v${version}"
+    "-X github.com/kubescape/kubescape/v2/core/cautils.BuildNumber=v${version}"
   ];
 
   subPackages = [ "." ];
@@ -39,6 +41,7 @@ buildGoModule rec {
 
     # remove tests that use networking
     rm core/pkg/resourcehandler/urlloader_test.go
+    rm core/pkg/opaprocessor/*_test.go
 
     # remove tests that use networking
     substituteInPlace core/pkg/resourcehandler/repositoryscanner_test.go \
@@ -58,19 +61,18 @@ buildGoModule rec {
   '';
 
   doInstallCheck = true;
+
   installCheckPhase = ''
     runHook preInstallCheck
     $out/bin/kubescape --help
-    # `--version` vs `version` shows the version without checking for latest
-    # if the flag is missing the BuildNumber may have moved
-    $out/bin/kubescape --version | grep "v${version}"
+    $out/bin/kubescape version | grep "v${version}"
     runHook postInstallCheck
   '';
 
   meta = with lib; {
     description = "Tool for testing if Kubernetes is deployed securely";
-    homepage = "https://github.com/armosec/kubescape";
-    changelog = "https://github.com/armosec/kubescape/releases/tag/v${version}";
+    homepage = "https://github.com/kubescape/kubescape";
+    changelog = "https://github.com/kubescape/kubescape/releases/tag/v${version}";
     longDescription = ''
       Kubescape is the first open-source tool for testing if Kubernetes is
       deployed securely according to multiple frameworks: regulatory, customized
diff --git a/pkgs/tools/system/erdtree/default.nix b/pkgs/tools/system/erdtree/default.nix
index fd2ee51ad9be..1001fb7fdd69 100644
--- a/pkgs/tools/system/erdtree/default.nix
+++ b/pkgs/tools/system/erdtree/default.nix
@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "erdtree";
-  version = "1.2.0";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "solidiquis";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-VSIeEyMFY10aHLCRmTh0EaGa08KPqrStsPLrssDT0TE=";
+    hash = "sha256-xPMOjhp4voT2Ad30WtAyA0MT917xt3Sd++KhLHmciA0=";
   };
 
-  cargoHash = "sha256-0kDRrsiGJw4iv4CD3FRE4zIBfGO352vnp2KD1RiZafg=";
+  cargoHash = "sha256-euthKq/5X5bCxV8qAAHyMm4nPPSWCvGRCfx0a1kwr/c=";
 
   meta = with lib; {
     description = "File-tree visualizer and disk usage analyzer";
diff --git a/pkgs/tools/text/groff/default.nix b/pkgs/tools/text/groff/default.nix
index 215f7e7d25b8..f6adca208fcf 100644
--- a/pkgs/tools/text/groff/default.nix
+++ b/pkgs/tools/text/groff/default.nix
@@ -1,6 +1,8 @@
 { lib, stdenv, fetchurl, fetchpatch, perl
 , enableGhostscript ? false, ghostscript # for postscript and html output
 , enableHtml ? false, psutils, netpbm # for html output
+, enableIconv ? false, iconv
+, enableLibuchardet ? false, libuchardet # for detecting input file encoding in preconv(1)
 , buildPackages
 , autoreconfHook
 , pkg-config
@@ -57,7 +59,9 @@ stdenv.mkDerivation rec {
     ++ lib.optional (stdenv.cc.isClang && lib.versionAtLeast stdenv.cc.version "9") bison;
   buildInputs = [ perl bash ]
     ++ lib.optionals enableGhostscript [ ghostscript ]
-    ++ lib.optionals enableHtml [ psutils netpbm ];
+    ++ lib.optionals enableHtml [ psutils netpbm ]
+    ++ lib.optionals enableIconv [ iconv ]
+    ++ lib.optionals enableLibuchardet [ libuchardet ];
 
   # Builds running without a chroot environment may detect the presence
   # of /usr/X11 in the host system, leading to an impure build of the
diff --git a/pkgs/tools/text/ov/default.nix b/pkgs/tools/text/ov/default.nix
index 55c66f7a5408..ab8db6fbea45 100644
--- a/pkgs/tools/text/ov/default.nix
+++ b/pkgs/tools/text/ov/default.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "ov";
-  version = "0.14.2";
+  version = "0.15.0";
 
   src = fetchFromGitHub {
     owner = "noborus";
     repo = "ov";
     rev = "refs/tags/v${version}";
-    hash = "sha256-tbJ3Es6huu+0HcpoiNpYLbxsm0QCWYZk6bX2MdQxT2I=";
+    hash = "sha256-gL2Gz7ziy6YfAiGuvyg7P9wUBST/Hy6/vmpQN9tdv3g=";
   };
 
-  vendorHash = "sha256-EjLslvc0cgvD7LjuDa49h/qt6K4Z9DEtQjV/LYkKwKo=";
+  vendorHash = "sha256-BM9XnjAiX3qAukqwbl3Aij1scKU2+txx4SHC8aHaS/Q=";
 
   ldflags = [
     "-X main.Version=v${version}"
diff --git a/pkgs/tools/text/txr/default.nix b/pkgs/tools/text/txr/default.nix
index fd375d6b44d0..a86435575d48 100644
--- a/pkgs/tools/text/txr/default.nix
+++ b/pkgs/tools/text/txr/default.nix
@@ -49,6 +49,8 @@ stdenv.mkDerivation (finalAttrs: {
       au BufRead,BufNewFile *.txr set filetype=txr | set lisp
       au BufRead,BufNewFile *.tl,*.tlo set filetype=tl | set lisp
     EOF
+    mkdir -p $out/share/nvim
+    ln -s $out/share/vim-plugins/txr $out/share/nvim/site
   '';
 
   meta = with lib; {
diff --git a/pkgs/tools/wayland/mpvpaper/default.nix b/pkgs/tools/wayland/mpvpaper/default.nix
index 76598f4afea2..3f98e8ef8c21 100644
--- a/pkgs/tools/wayland/mpvpaper/default.nix
+++ b/pkgs/tools/wayland/mpvpaper/default.nix
@@ -6,6 +6,7 @@
 , wlroots
 , wayland
 , wayland-protocols
+, wayland-scanner
 , egl-wayland
 , glew-egl
 , mpv
@@ -26,12 +27,14 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-0LjIwOY2hBUb0nziD3HLP2Ek5+8v3ntssRFD9eQgWkc=";
   };
 
+  strictDeps = true;
   nativeBuildInputs = [
     meson
     ninja
     pkg-config
     makeWrapper
     installShellFiles
+    wayland-scanner
   ];
 
   buildInputs = [
diff --git a/pkgs/tools/wayland/proycon-wayout/default.nix b/pkgs/tools/wayland/proycon-wayout/default.nix
index 2b4dc0f54e4f..265d585ce1df 100644
--- a/pkgs/tools/wayland/proycon-wayout/default.nix
+++ b/pkgs/tools/wayland/proycon-wayout/default.nix
@@ -32,6 +32,7 @@ stdenv.mkDerivation rec {
     mv $out/bin/wayout $out/bin/proycon-wayout # Avoid conflict with shinyzenith/wayout
   '';
 
+  strictDeps = true;
   depsBuildBuild = [ pkg-config ];
   nativeBuildInputs = [ scdoc ninja meson cmake pkg-config wayland-scanner ];
   buildInputs = [ wayland-protocols wayland cairo pango ];
diff --git a/pkgs/tools/wayland/sov/default.nix b/pkgs/tools/wayland/sov/default.nix
index b9b139c7a1f9..d7415a5fa517 100644
--- a/pkgs/tools/wayland/sov/default.nix
+++ b/pkgs/tools/wayland/sov/default.nix
@@ -17,6 +17,8 @@ stdenv.mkDerivation rec {
   postPatch = ''
     substituteInPlace src/sov/main.c --replace '/usr' $out
   '';
+
+  strictDeps = true;
   nativeBuildInputs = [ meson pkg-config wayland-scanner ninja ];
   buildInputs = [ wayland wayland-protocols freetype ];
 
diff --git a/pkgs/tools/wayland/waynergy/default.nix b/pkgs/tools/wayland/waynergy/default.nix
index fce7ac6605af..83de408554db 100644
--- a/pkgs/tools/wayland/waynergy/default.nix
+++ b/pkgs/tools/wayland/waynergy/default.nix
@@ -24,8 +24,8 @@ stdenv.mkDerivation rec {
     hash = "sha256-pk1U3svy9r7O9ivFjBNXsaOmgc+nv2QTuwwHejB7B4Q=";
   };
 
-  depsBuildBuild = [ pkg-config ];
-  nativeBuildInputs = [ meson ninja ];
+  strictDeps = true;
+  nativeBuildInputs = [ pkg-config meson ninja wayland-scanner ];
   buildInputs = [ libdrm wayland wayland-protocols wl-clipboard libxkbcommon libressl ];
 
   postPatch = ''
diff --git a/pkgs/tools/wayland/wev/default.nix b/pkgs/tools/wayland/wev/default.nix
index e450de2f2dcf..506b67d14e5b 100644
--- a/pkgs/tools/wayland/wev/default.nix
+++ b/pkgs/tools/wayland/wev/default.nix
@@ -20,6 +20,7 @@ stdenv.mkDerivation rec {
     sha256 = "0l71v3fzgiiv6xkk365q1l08qvaymxd4kpaya6r2g8yzkr7i2hms";
   };
 
+  strictDeps = true;
   # for scdoc
   depsBuildBuild = [
     pkg-config
diff --git a/pkgs/tools/wayland/wlprop/default.nix b/pkgs/tools/wayland/wlprop/default.nix
index 82f80a594ad0..67c4918b371f 100644
--- a/pkgs/tools/wayland/wlprop/default.nix
+++ b/pkgs/tools/wayland/wlprop/default.nix
@@ -1,4 +1,4 @@
-{ fetchgit, gawk, jq, lib, makeWrapper, slurp, stdenv, sway }:
+{ fetchgit, gawk, jq, lib, makeWrapper, slurp, stdenv, sway, bash }:
 
 stdenv.mkDerivation rec {
   pname = "wlprop";
@@ -10,7 +10,9 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-ZJ9LYYrU2cNYikiVNTlEcI4QXcoqfl7iwk3Be+NhGG8=";
   };
 
+  strictDeps = true;
   nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ bash ];
 
   dontBuild = true;
   installPhase = ''
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 9d82d78b42cd..367001940416 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1726,17 +1726,8 @@ mapAliases ({
   # TODO(ekleog): add ‘wasm’ alias to ‘ocamlPackages.wasm’ after 19.03
   # branch-off
 
-  ocamlPackages_4_00_1 = throw "'ocamlPackages_4_00_1' has been renamed to/replaced by 'ocaml-ng.ocamlPackages_4_00_1'"; # Converted to throw 2022-02-22
-  ocamlPackages_4_01_0 = throw "'ocamlPackages_4_01_0' has been renamed to/replaced by 'ocaml-ng.ocamlPackages_4_01_0'"; # Converted to throw 2022-02-22
-  ocamlPackages_4_02 = throw "'ocamlPackages_4_02' has been renamed to/replaced by 'ocaml-ng.ocamlPackages_4_02'"; # Converted to throw 2022-02-22
-  ocamlPackages_4_03 = throw "'ocamlPackages_4_03' has been renamed to/replaced by 'ocaml-ng.ocamlPackages_4_03'"; # Converted to throw 2022-02-22
   ocamlPackages_latest = throw "'ocamlPackages_latest' has been renamed to/replaced by 'ocaml-ng.ocamlPackages_latest'"; # Converted to throw 2022-02-22
 
-  ocaml_4_00_1 = throw "'ocamlPackages_4_00_1.ocaml' has been renamed to/replaced by 'ocaml-ng.ocamlPackages_4_00_1.ocaml'"; # Converted to throw 2022-02-22
-  ocaml_4_01_0 = throw "'ocamlPackages_4_01_0.ocaml' has been renamed to/replaced by 'ocaml-ng.ocamlPackages_4_01_0.ocaml'"; # Converted to throw 2022-02-22
-  ocaml_4_02 = throw "'ocamlPackages_4_02.ocaml' has been renamed to/replaced by 'ocaml-ng.ocamlPackages_4_02.ocaml'"; # Converted to throw 2022-02-22
-  ocaml_4_03 = throw "'ocamlPackages_4_03.ocaml' has been renamed to/replaced by 'ocaml-ng.ocamlPackages_4_03.ocaml'"; # Converted to throw 2022-02-22
-
   ocamlformat_0_11_0 = throw "ocamlformat_0_11_0 has been removed in favor of newer versions"; # Added 2022-06-01
   ocamlformat_0_12 = throw "ocamlformat_0_12 has been removed in favor of newer versions"; # Added 2022-06-01
   ocamlformat_0_13_0 = throw "ocamlformat_0_13_0 has been removed in favor of newer versions"; # Added 2022-06-01
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 99611ae1cfa5..696a4c917ce2 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -15569,7 +15569,7 @@ with pkgs;
   ocsigen-i18n = callPackage ../development/tools/ocaml/ocsigen-i18n { };
 
   opa = callPackage ../development/compilers/opa {
-    ocamlPackages = ocaml-ng.ocamlPackages_4_05;
+    ocamlPackages = ocaml-ng.ocamlPackages_4_14_unsafe_string;
   };
 
   opaline = callPackage ../development/tools/ocaml/opaline { };
@@ -18450,6 +18450,10 @@ with pkgs;
 
   openai = with python3Packages; toPythonApplication openai;
 
+  openai-full = with python3Packages; toPythonApplication (openai.override {
+   withOptionalDependencies = true;
+  });
+
   openai-whisper = with python3.pkgs; toPythonApplication openai-whisper;
 
   openai-whisper-cpp = callPackage ../tools/audio/openai-whisper-cpp {
@@ -26615,6 +26619,8 @@ with pkgs;
 
   gotestsum = callPackage ../development/tools/gotestsum { };
 
+  gqlgenc = callPackage ../development/tools/gqlgenc { };
+
   impl = callPackage ../development/tools/impl { };
 
   moq = callPackage ../development/tools/moq { };
@@ -30112,6 +30118,8 @@ with pkgs;
 
   linssid = libsForQt5.callPackage ../applications/networking/linssid { };
 
+  linvstmanager = qt5.callPackage ../applications/audio/linvstmanager { };
+
   deadd-notification-center = callPackage ../applications/misc/deadd-notification-center { };
 
   lollypop = callPackage ../applications/audio/lollypop { };
@@ -35082,6 +35090,8 @@ with pkgs;
 
   jumpnbump = callPackage ../games/jumpnbump { };
 
+  katawa-shoujo = callPackage ../games/katawa-shoujo { };
+
   keeperrl = callPackage ../games/keeperrl { };
 
   ### GAMES/LGAMES
diff --git a/pkgs/top-level/dotnet-packages.nix b/pkgs/top-level/dotnet-packages.nix
index cd064113599a..bdf8faa66f0d 100644
--- a/pkgs/top-level/dotnet-packages.nix
+++ b/pkgs/top-level/dotnet-packages.nix
@@ -148,6 +148,8 @@ let self = dotnetPackages // overrides; dotnetPackages = with self; {
         install -Dt $vimdir/syntax/ Util/vim/syntax/boogie.vim
         mkdir $vimdir/ftdetect
         echo 'au BufRead,BufNewFile *.bpl set filetype=boogie' > $vimdir/ftdetect/bpl.vim
+        mkdir -p $out/share/nvim
+        ln -s $out/share/vim-plugins/boogie $out/share/nvim/site
     '';
 
     postFixup = ''
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 132eac039509..204af0eeac08 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1631,6 +1631,8 @@ self: super: with self; {
 
   cement = callPackage ../development/python-modules/cement { };
 
+  cemm = callPackage ../development/python-modules/cemm { };
+
   censys = callPackage ../development/python-modules/censys { };
 
   cexprtk = callPackage ../development/python-modules/cexprtk { };
@@ -9897,6 +9899,8 @@ self: super: with self; {
 
   qtconsole = callPackage ../development/python-modules/qtconsole { };
 
+  qtile-extras = callPackage ../development/python-modules/qtile-extras { };
+
   qtpy = callPackage ../development/python-modules/qtpy { };
 
   quadprog = callPackage ../development/python-modules/quadprog { };