diff --git a/nixos/doc/manual/release-notes/rl-2305.section.md b/nixos/doc/manual/release-notes/rl-2305.section.md
index 30c14de9539d..1bd8906cf64f 100644
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@@ -60,6 +60,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - [ulogd](https://www.netfilter.org/projects/ulogd/index.html), a userspace logging daemon for netfilter/iptables related logging. Available as [services.ulogd](options.html#opt-services.ulogd.enable).
 
+- [jellyseerr](https://github.com/Fallenbagel/jellyseerr), a web-based requests manager for Jellyfin, forked from Overseerr. Available as [services.jellyseerr](#opt-services.jellyseerr.enable).
+
 - [photoprism](https://photoprism.app/), a AI-Powered Photos App for the Decentralized Web. Available as [services.photoprism](options.html#opt-services.photoprism.enable).
 
 - [autosuspend](https://github.com/languitar/autosuspend), a python daemon that suspends a system if certain conditions are met, or not met.
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 954b34611f2e..e1e30c99a447 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -625,6 +625,7 @@
   ./services/misc/irkerd.nix
   ./services/misc/jackett.nix
   ./services/misc/jellyfin.nix
+  ./services/misc/jellyseerr.nix
   ./services/misc/klipper.nix
   ./services/misc/languagetool.nix
   ./services/misc/leaps.nix
diff --git a/nixos/modules/services/misc/gitlab.nix b/nixos/modules/services/misc/gitlab.nix
index 179359c97a3a..c7299c1ccad8 100644
--- a/nixos/modules/services/misc/gitlab.nix
+++ b/nixos/modules/services/misc/gitlab.nix
@@ -89,11 +89,6 @@ let
     };
   };
 
-  pagesArgs = [
-    "-pages-domain" gitlabConfig.production.pages.host
-    "-pages-root" "${gitlabConfig.production.shared.path}/pages"
-  ] ++ cfg.pagesExtraArgs;
-
   gitlabConfig = {
     # These are the default settings from config/gitlab.example.yml
     production = flip recursiveUpdate cfg.extraConfig {
@@ -161,6 +156,12 @@ let
       };
       extra = {};
       uploads.storage_path = cfg.statePath;
+      pages = {
+        enabled = cfg.pages.enable;
+        port = 8090;
+        host = cfg.pages.settings.pages-domain;
+        secret_file = cfg.pages.settings.api-secret-key;
+      };
     };
   };
 
@@ -246,6 +247,7 @@ in {
     (mkRenamedOptionModule [ "services" "gitlab" "backupPath" ] [ "services" "gitlab" "backup" "path" ])
     (mkRemovedOptionModule [ "services" "gitlab" "satelliteDir" ] "")
     (mkRemovedOptionModule [ "services" "gitlab" "logrotate" "extraConfig" ] "Modify services.logrotate.settings.gitlab directly instead")
+    (mkRemovedOptionModule [ "services" "gitlab" "pagesExtraArgs" ] "Use services.gitlab.pages.settings instead")
   ];
 
   options = {
@@ -667,10 +669,127 @@ in {
         };
       };
 
-      pagesExtraArgs = mkOption {
-        type = types.listOf types.str;
-        default = [ "-listen-proxy" "127.0.0.1:8090" ];
-        description = lib.mdDoc "Arguments to pass to the gitlab-pages daemon";
+      pages.enable = mkEnableOption (lib.mdDoc "the GitLab Pages service");
+
+      pages.settings = mkOption {
+        example = literalExpression ''
+          {
+            pages-domain = "example.com";
+            auth-client-id = "generated-id-xxxxxxx";
+            auth-client-secret = { _secret = "/var/keys/auth-client-secret"; };
+            auth-redirect-uri = "https://projects.example.com/auth";
+            auth-secret = { _secret = "/var/keys/auth-secret"; };
+            auth-server = "https://gitlab.example.com";
+          }
+        '';
+
+        description = lib.mdDoc ''
+          Configuration options to set in the GitLab Pages config
+          file.
+
+          Options containing secret data should be set to an attribute
+          set containing the attribute `_secret` - a string pointing
+          to a file containing the value the option should be set
+          to. See the example to get a better picture of this: in the
+          resulting configuration file, the `auth-client-secret` and
+          `auth-secret` keys will be set to the contents of the
+          {file}`/var/keys/auth-client-secret` and
+          {file}`/var/keys/auth-secret` files respectively.
+        '';
+
+        type = types.submodule {
+          freeformType = with types; attrsOf (nullOr (oneOf [ str int bool attrs ]));
+
+          options = {
+            listen-http = mkOption {
+              type = with types; listOf str;
+              apply = x: if x == [] then null else lib.concatStringsSep "," x;
+              default = [];
+              description = lib.mdDoc ''
+                The address(es) to listen on for HTTP requests.
+              '';
+            };
+
+            listen-https = mkOption {
+              type = with types; listOf str;
+              apply = x: if x == [] then null else lib.concatStringsSep "," x;
+              default = [];
+              description = lib.mdDoc ''
+                The address(es) to listen on for HTTPS requests.
+              '';
+            };
+
+            listen-proxy = mkOption {
+              type = with types; listOf str;
+              apply = x: if x == [] then null else lib.concatStringsSep "," x;
+              default = [ "127.0.0.1:8090" ];
+              description = lib.mdDoc ''
+                The address(es) to listen on for proxy requests.
+              '';
+            };
+
+            artifacts-server = mkOption {
+              type = with types; nullOr str;
+              default = "http${optionalString cfg.https "s"}://${cfg.host}/api/v4";
+              defaultText = "http(s)://<services.gitlab.host>/api/v4";
+              example = "https://gitlab.example.com/api/v4";
+              description = lib.mdDoc ''
+                API URL to proxy artifact requests to.
+              '';
+            };
+
+            gitlab-server = mkOption {
+              type = with types; nullOr str;
+              default = "http${optionalString cfg.https "s"}://${cfg.host}";
+              defaultText = "http(s)://<services.gitlab.host>";
+              example = "https://gitlab.example.com";
+              description = lib.mdDoc ''
+                Public GitLab server URL.
+              '';
+            };
+
+            internal-gitlab-server = mkOption {
+              type = with types; nullOr str;
+              default = null;
+              defaultText = "http(s)://<services.gitlab.host>";
+              example = "https://gitlab.example.internal";
+              description = lib.mdDoc ''
+                Internal GitLab server used for API requests, useful
+                if you want to send that traffic over an internal load
+                balancer. By default, the value of
+                `services.gitlab.pages.settings.gitlab-server` is
+                used.
+              '';
+            };
+
+            api-secret-key = mkOption {
+              type = with types; nullOr str;
+              default = "${cfg.statePath}/gitlab_pages_secret";
+              internal = true;
+              description = lib.mdDoc ''
+                File with secret key used to authenticate with the
+                GitLab API.
+              '';
+            };
+
+            pages-domain = mkOption {
+              type = with types; nullOr str;
+              example = "example.com";
+              description = lib.mdDoc ''
+                The domain to serve static pages on.
+              '';
+            };
+
+            pages-root = mkOption {
+              type = types.str;
+              default = "${gitlabConfig.production.shared.path}/pages";
+              defaultText = literalExpression ''config.${opt.extraConfig}.production.shared.path + "/pages"'';
+              description = lib.mdDoc ''
+                The directory where pages are stored.
+              '';
+            };
+          };
+        };
       };
 
       secrets.secretFile = mkOption {
@@ -1210,6 +1329,9 @@ in {
             umask u=rwx,g=,o=
 
             openssl rand -hex 32 > ${cfg.statePath}/gitlab_shell_secret
+            ${optionalString cfg.pages.enable ''
+                openssl rand -base64 32 > ${cfg.pages.settings.api-secret-key}
+            ''}
 
             rm -f '${cfg.statePath}/config/database.yml'
 
@@ -1359,28 +1481,66 @@ in {
       };
     };
 
-    systemd.services.gitlab-pages = mkIf (gitlabConfig.production.pages.enabled or false) {
-      description = "GitLab static pages daemon";
-      after = [ "network.target" "gitlab-config.service" ];
-      bindsTo = [ "gitlab-config.service" ];
-      wantedBy = [ "gitlab.target" ];
-      partOf = [ "gitlab.target" ];
-
-      path = [ pkgs.unzip ];
-
-      serviceConfig = {
-        Type = "simple";
-        TimeoutSec = "infinity";
-        Restart = "on-failure";
-
-        User = cfg.user;
-        Group = cfg.group;
-
-        ExecStart = "${cfg.packages.pages}/bin/gitlab-pages ${escapeShellArgs pagesArgs}";
-        WorkingDirectory = gitlabEnv.HOME;
-      };
+    services.gitlab.pages.settings = {
+      api-secret-key = "${cfg.statePath}/gitlab_pages_secret";
     };
 
+    systemd.services.gitlab-pages =
+      let
+        filteredConfig = filterAttrs (_: v: v != null) cfg.pages.settings;
+        isSecret = v: isAttrs v && v ? _secret && isString v._secret;
+        mkPagesKeyValue = lib.generators.toKeyValue {
+          mkKeyValue = lib.flip lib.generators.mkKeyValueDefault "=" rec {
+            mkValueString = v:
+              if isInt           v then toString v
+              else if isString   v then v
+              else if true  ==   v then "true"
+              else if false ==   v then "false"
+              else if isSecret   v then builtins.hashString "sha256" v._secret
+              else throw "unsupported type ${builtins.typeOf v}: ${(lib.generators.toPretty {}) v}";
+          };
+        };
+        secretPaths = lib.catAttrs "_secret" (lib.collect isSecret filteredConfig);
+        mkSecretReplacement = file: ''
+          replace-secret ${lib.escapeShellArgs [ (builtins.hashString "sha256" file) file "/run/gitlab-pages/gitlab-pages.conf" ]}
+        '';
+        secretReplacements = lib.concatMapStrings mkSecretReplacement secretPaths;
+        configFile = pkgs.writeText "gitlab-pages.conf" (mkPagesKeyValue filteredConfig);
+      in
+        mkIf cfg.pages.enable {
+          description = "GitLab static pages daemon";
+          after = [ "network.target" "gitlab-config.service" "gitlab.service" ];
+          bindsTo = [ "gitlab-config.service" "gitlab.service" ];
+          wantedBy = [ "gitlab.target" ];
+          partOf = [ "gitlab.target" ];
+
+          path = with pkgs; [
+            unzip
+            replace-secret
+          ];
+
+          serviceConfig = {
+            Type = "simple";
+            TimeoutSec = "infinity";
+            Restart = "on-failure";
+
+            User = cfg.user;
+            Group = cfg.group;
+
+            ExecStartPre = pkgs.writeShellScript "gitlab-pages-pre-start" ''
+              set -o errexit -o pipefail -o nounset
+              shopt -s dotglob nullglob inherit_errexit
+
+              install -m u=rw ${configFile} /run/gitlab-pages/gitlab-pages.conf
+              ${secretReplacements}
+            '';
+            ExecStart = "${cfg.packages.pages}/bin/gitlab-pages -config=/run/gitlab-pages/gitlab-pages.conf";
+            WorkingDirectory = gitlabEnv.HOME;
+            RuntimeDirectory = "gitlab-pages";
+            RuntimeDirectoryMode = "0700";
+          };
+        };
+
     systemd.services.gitlab-workhorse = {
       after = [ "network.target" ];
       wantedBy = [ "gitlab.target" ];
diff --git a/nixos/modules/services/misc/jellyseerr.nix b/nixos/modules/services/misc/jellyseerr.nix
new file mode 100644
index 000000000000..31e0c5beb673
--- /dev/null
+++ b/nixos/modules/services/misc/jellyseerr.nix
@@ -0,0 +1,62 @@
+{ config, pkgs, lib, ... }:
+
+with lib;
+let
+  cfg = config.services.jellyseerr;
+in
+{
+  meta.maintainers = [ maintainers.camillemndn ];
+
+  options.services.jellyseerr = {
+    enable = mkEnableOption (mdDoc ''Jellyseerr, a requests manager for Jellyfin'');
+
+    openFirewall = mkOption {
+      type = types.bool;
+      default = false;
+      description = mdDoc ''Open port in the firewall for the Jellyseerr web interface.'';
+    };
+
+    port = mkOption {
+      type = types.port;
+      default = 5055;
+      description = mdDoc ''The port which the Jellyseerr web UI should listen to.'';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.jellyseerr = {
+      description = "Jellyseerr, a requests manager for Jellyfin";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      environment.PORT = toString cfg.port;
+      serviceConfig = {
+        Type = "exec";
+        StateDirectory = "jellyseerr";
+        WorkingDirectory = "${pkgs.jellyseerr}/libexec/jellyseerr/deps/jellyseerr";
+        DynamicUser = true;
+        ExecStart = "${pkgs.jellyseerr}/bin/jellyseerr";
+        BindPaths = [ "/var/lib/jellyseerr/:${pkgs.jellyseerr}/libexec/jellyseerr/deps/jellyseerr/config/" ];
+        Restart = "on-failure";
+        ProtectHome = true;
+        ProtectSystem = "strict";
+        PrivateTmp = true;
+        PrivateDevices = true;
+        ProtectHostname = true;
+        ProtectClock = true;
+        ProtectKernelTunables = true;
+        ProtectKernelModules = true;
+        ProtectKernelLogs = true;
+        ProtectControlGroups = true;
+        NoNewPrivileges = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        RemoveIPC = true;
+        PrivateMounts = true;
+      };
+    };
+
+    networking.firewall = mkIf cfg.openFirewall {
+      allowedTCPPorts = [ cfg.port ];
+    };
+  };
+}
diff --git a/nixos/tests/gitlab.nix b/nixos/tests/gitlab.nix
index 59dbc99052a6..c2a11bada0a3 100644
--- a/nixos/tests/gitlab.nix
+++ b/nixos/tests/gitlab.nix
@@ -69,6 +69,10 @@ in {
         databasePasswordFile = pkgs.writeText "dbPassword" "xo0daiF4";
         initialRootPasswordFile = pkgs.writeText "rootPassword" initialRootPassword;
         smtp.enable = true;
+        pages = {
+          enable = true;
+          settings.pages-domain = "localhost";
+        };
         extraConfig = {
           incoming_email = {
             enabled = true;
@@ -79,11 +83,6 @@ in {
             host = "localhost";
             port = 143;
           };
-          # https://github.com/NixOS/nixpkgs/issues/132295
-          # pages = {
-          #   enabled = true;
-          #   host = "localhost";
-          # };
         };
         secrets = {
           secretFile = pkgs.writeText "secret" "Aig5zaic";
@@ -171,10 +170,9 @@ in {
       waitForServices = ''
         gitlab.wait_for_unit("gitaly.service")
         gitlab.wait_for_unit("gitlab-workhorse.service")
-        # https://github.com/NixOS/nixpkgs/issues/132295
-        # gitlab.wait_for_unit("gitlab-pages.service")
         gitlab.wait_for_unit("gitlab-mailroom.service")
         gitlab.wait_for_unit("gitlab.service")
+        gitlab.wait_for_unit("gitlab-pages.service")
         gitlab.wait_for_unit("gitlab-sidekiq.service")
         gitlab.wait_for_file("${nodes.gitlab.config.services.gitlab.statePath}/tmp/sockets/gitlab.socket")
         gitlab.wait_until_succeeds("curl -sSf http://gitlab/users/sign_in")
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 9d941f78c2ef..f62ab8e77cf7 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -1267,6 +1267,23 @@ let
         };
       };
 
+      jellyedwards.gitsweep = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          publisher = "jellyedwards";
+          name = "gitsweep";
+          version = "0.0.15";
+          sha256 = "rKAy84Uiat5VOQXd4OXToNfxAJ6SuWPT47vuiyK4qwg=";
+        };
+        meta = with lib; {
+          changelog = "https://marketplace.visualstudio.com/items/jellyedwards.gitsweep/changelog";
+          description = "VS Code extension which allows you to easily exclude modified or new files so they don't get committed accidentally";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=jellyedwards.gitsweep";
+          homepage = "https://github.com/jellyedwards/gitsweep";
+          license = licenses.mit;
+          maintainers = with maintainers; [ MatthieuBarthel ];
+        };
+      };
+
       jkillian.custom-local-formatters = buildVscodeMarketplaceExtension {
         mktplcRef = {
           publisher = "jkillian";
diff --git a/pkgs/applications/graphics/dia/default.nix b/pkgs/applications/graphics/dia/default.nix
index 6b75bf11d423..0adc585603ef 100644
--- a/pkgs/applications/graphics/dia/default.nix
+++ b/pkgs/applications/graphics/dia/default.nix
@@ -34,6 +34,9 @@ stdenv.mkDerivation {
 
   patches = [ ./poppler-22_09-build-fix.patch ];
 
+  # Required for the PDF plugin when building with clang.
+  CXXFLAGS = "-std=c++17";
+
   preConfigure = ''
     patchShebangs .
   '';
diff --git a/pkgs/applications/graphics/photoflow/CMakeLists.patch b/pkgs/applications/graphics/photoflow/CMakeLists.patch
deleted file mode 100644
index 7d3d62b41b42..000000000000
--- a/pkgs/applications/graphics/photoflow/CMakeLists.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
-index 9b48beea..078ba20d 100644
---- a/src/CMakeLists.txt
-+++ b/src/CMakeLists.txt
-@@ -603,7 +603,7 @@ ENDIF(APPLE)
- #
- # photoflow executable
- #
--add_executable(photoflow main.cc ${RESOURCE_OBJECT})
-+add_executable(photoflow main.cc version.cc ${RESOURCE_OBJECT})
- IF(APPLE)
-   set_target_properties(photoflow PROPERTIES LINK_FLAGS " -framework ApplicationServices ")
- ENDIF(APPLE)
diff --git a/pkgs/applications/graphics/photoflow/default.nix b/pkgs/applications/graphics/photoflow/default.nix
deleted file mode 100644
index 43d47cb077cb..000000000000
--- a/pkgs/applications/graphics/photoflow/default.nix
+++ /dev/null
@@ -1,101 +0,0 @@
-{ automake
-, cmake
-, exiv2
-, expat
-, fetchFromGitHub
-, fetchpatch
-, fftw
-, fftwFloat
-, gettext
-, glib
-, gobject-introspection
-, gtkmm2
-, lcms2
-, lensfun
-, libexif
-, libiptcdata
-, libjpeg
-, libraw
-, libtiff
-, libxml2
-, ninja
-, openexr
-, pcre
-, pkg-config
-, pugixml
-, lib
-, stdenv
-, swig
-, vips
-, gtk-mac-integration-gtk2
-}:
-
-stdenv.mkDerivation rec {
-  pname = "photoflow";
-  version = "2020-08-28";
-
-  src = fetchFromGitHub {
-    owner = "aferrero2707";
-    repo = pname;
-    rev = "8472024fb91175791e0eb23c434c5b58ecd250eb";
-    sha256 = "1bq4733hbh15nwpixpyhqfn3bwkg38amdj2xc0my0pii8l9ln793";
-  };
-
-  patches = [
-    (fetchpatch {
-      name = "fix-compiler-flags.patch";
-      url = "https://sources.debian.org/data/main/p/photoflow/0.2.8%2Bgit20200114-3/debian/patches/ftbfs";
-      sha256 = "sha256-DG5yG6M4FsKOykE9Eh5TGd7Z5QURGTTVbO1pIxMAlhc=";
-    })
-    ./CMakeLists.patch
-    ./fix-build.patch
-  ];
-
-  nativeBuildInputs = [
-    automake
-    cmake
-    gettext
-    glib
-    gobject-introspection
-    libxml2
-    ninja
-    pkg-config
-    swig
-  ];
-
-  buildInputs = [
-    exiv2
-    expat
-    fftw
-    fftwFloat
-    gtkmm2 # Could be build with gtk3 but proper UI theme is missing and therefore not very usable with gtk3
-    # See: https://discuss.pixls.us/t/help-needed-for-gtk3-theme/5803
-    lcms2
-    lensfun
-    libexif
-    libiptcdata
-    libjpeg
-    libraw
-    libtiff
-    openexr
-    pcre
-    pugixml
-    vips
-  ] ++ lib.optionals stdenv.isDarwin [
-    gtk-mac-integration-gtk2
-  ];
-
-  cmakeFlags = [
-    "-DBUNDLED_EXIV2=OFF"
-    "-DBUNDLED_LENSFUN=OFF"
-    "-DBUNDLED_GEXIV2=OFF"
-  ];
-
-  meta = with lib; {
-    description = "A fully non-destructive photo retouching program providing a complete RAW image editing workflow";
-    homepage = "https://aferrero2707.github.io/PhotoFlow/";
-    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ MtP wegank ];
-    platforms = platforms.unix;
-  };
-}
diff --git a/pkgs/applications/graphics/photoflow/fix-build.patch b/pkgs/applications/graphics/photoflow/fix-build.patch
deleted file mode 100644
index ac0516b203f1..000000000000
--- a/pkgs/applications/graphics/photoflow/fix-build.patch
+++ /dev/null
@@ -1,76 +0,0 @@
-diff --git a/src/external/librtprocess/src/include/librtprocess.h b/src/external/librtprocess/src/include/librtprocess.h
-index 47691a09..b1c63dbd 100644
---- a/src/external/librtprocess/src/include/librtprocess.h
-+++ b/src/external/librtprocess/src/include/librtprocess.h
-@@ -21,6 +21,7 @@
- #define _LIBRTPROCESS_
- 
- #include <functional>
-+#include <cstddef>
- 
- 
- enum rpError {RP_NO_ERROR, RP_MEMORY_ERROR, RP_WRONG_CFA, RP_CACORRECT_ERROR};
-diff --git a/src/operations/denoise.cc b/src/operations/denoise.cc
-index 10050f70..16b340c1 100644
---- a/src/operations/denoise.cc
-+++ b/src/operations/denoise.cc
-@@ -27,7 +27,7 @@
- 
-  */
- 
--#include <vips/cimg_funcs.h>
-+//#include <vips/cimg_funcs.h>
- 
- #include "../base/new_operation.hh"
- #include "convert_colorspace.hh"
-diff --git a/src/operations/gmic/gmic.cc b/src/operations/gmic/gmic.cc
-index 876e7c20..fc6a8505 100644
---- a/src/operations/gmic/gmic.cc
-+++ b/src/operations/gmic/gmic.cc
-@@ -28,13 +28,31 @@
-  */
- 
- //#include <vips/cimg_funcs.h>
-+#include <vips/vips.h>
- 
- #include "../../base/processor_imp.hh"
- #include "../convertformat.hh"
- #include "gmic.hh"
- 
--int vips_gmic(VipsImage **in, VipsImage** out, int n, int padding, double x_scale, double y_scale, const char* command, ...);
--
-+int vips_gmic(VipsImage **in, VipsImage** out, int n, int padding, double x_scale, double y_scale, const char* command, ...)
-+{
-+	VipsArrayImage *array; 
-+	va_list ap;
-+	int result;
-+
-+#ifndef NDEBUG
-+	printf("vips_gmic(): padding=%d\n", padding);
-+#endif
-+
-+	array = vips_array_image_new( in, n ); 
-+	va_start( ap, command );
-+	result = vips_call_split( "gmic", ap, array, out, 
-+		padding, x_scale, y_scale, command );
-+	va_end( ap );
-+	vips_area_unref( VIPS_AREA( array ) );
-+
-+	return( result );
-+}
- 
- PF::GMicPar::GMicPar(): 
-   OpParBase(),
-diff --git a/src/vips/gmic/gmic/src/CImg.h b/src/vips/gmic/gmic/src/CImg.h
-index 268b9e62..5a79640c 100644
---- a/src/vips/gmic/gmic/src/CImg.h
-+++ b/src/vips/gmic/gmic/src/CImg.h
-@@ -32843,7 +32843,7 @@ namespace cimg_library_suffixed {
-        \see deriche(), vanvliet().
-     **/
-     CImg<T>& blur_box(const float boxsize, const bool boundary_conditions=true) {
--      const float nboxsize = boxsize>=0?boxsize:-boxsize*std::max(_width,_height,_depth)/100;
-+      const float nboxsize = boxsize>=0?boxsize:-boxsize*std::max({_width,_height,_depth})/100;
-       return blur_box(nboxsize,nboxsize,nboxsize,boundary_conditions);
-     }
- 
diff --git a/pkgs/applications/misc/ArchiSteamFarm/default.nix b/pkgs/applications/misc/ArchiSteamFarm/default.nix
index 61b46e7081be..d7909c64a203 100644
--- a/pkgs/applications/misc/ArchiSteamFarm/default.nix
+++ b/pkgs/applications/misc/ArchiSteamFarm/default.nix
@@ -13,15 +13,20 @@
 buildDotnetModule rec {
   pname = "archisteamfarm";
   # nixpkgs-update: no auto update
-  version = "5.4.2.13";
+  version = "5.4.3.2";
 
   src = fetchFromGitHub {
     owner = "justarchinet";
     repo = pname;
     rev = version;
-    sha256 = "sha256-4DaqIsHfijA0hkhlsC6qQ1n+HC0zwdMtXiswOPOVpM4=";
+    sha256 = "sha256-SRWqe8KTjFdgVW7/EYRVUONtDWwxpcZ1GXWFPjKZzpI=";
   };
 
+  patches = [
+    # otherwise installPhase fails with NETSDK1129
+    ./fix-framework.diff
+  ];
+
   dotnet-runtime = dotnetCorePackages.aspnetcore_7_0;
   dotnet-sdk = dotnetCorePackages.sdk_7_0;
 
@@ -59,6 +64,7 @@ buildDotnetModule rec {
      }
 
      buildPlugin ArchiSteamFarm.OfficialPlugins.ItemsMatcher
+     buildPlugin ArchiSteamFarm.OfficialPlugins.MobileAuthenticator
      buildPlugin ArchiSteamFarm.OfficialPlugins.SteamTokenDumper
   '';
 
diff --git a/pkgs/applications/misc/ArchiSteamFarm/deps.nix b/pkgs/applications/misc/ArchiSteamFarm/deps.nix
index d5bbfee0b6f9..e9f36ba98481 100644
--- a/pkgs/applications/misc/ArchiSteamFarm/deps.nix
+++ b/pkgs/applications/misc/ArchiSteamFarm/deps.nix
@@ -61,7 +61,7 @@
   (fetchNuGet { pname = "Microsoft.AspNetCore.JsonPatch"; version = "7.0.0"; sha256 = "1f13vsfs1rp9bmdp3khk4mk2fif932d72yxm2wszpsr239x4s2bf"; })
   (fetchNuGet { pname = "Microsoft.AspNetCore.Mvc.NewtonsoftJson"; version = "7.0.0"; sha256 = "1w49rg0n5wb1m5wnays2mmym7qy7bsi2b1zxz97af2rkbw3s3hbd"; })
   (fetchNuGet { pname = "Microsoft.Bcl.AsyncInterfaces"; version = "6.0.0"; sha256 = "15gqy2m14fdlvy1g59207h5kisznm355kbw010gy19vh47z8gpz3"; })
-  (fetchNuGet { pname = "Microsoft.CodeCoverage"; version = "17.4.1"; sha256 = "0bf68gq6mc6kzri4zi8ydc0xrazqwqg38bhbpjpj90zmqc28kari"; })
+  (fetchNuGet { pname = "Microsoft.CodeCoverage"; version = "17.5.0"; sha256 = "0briw00gb5bz9k9kx00p6ghq47w501db7gb6ig5zzmz9hb8lw4a4"; })
   (fetchNuGet { pname = "Microsoft.CSharp"; version = "4.7.0"; sha256 = "0gd67zlw554j098kabg887b5a6pq9kzavpa3jjy5w53ccjzjfy8j"; })
   (fetchNuGet { pname = "Microsoft.Extensions.ApiDescription.Server"; version = "6.0.5"; sha256 = "1pi2bm3cm0a7jzqzmfc2r7bpcdkmk3hhjfvb2c81j7wl7xdw3624"; })
   (fetchNuGet { pname = "Microsoft.Extensions.Configuration.Abstractions"; version = "6.0.0"; sha256 = "0w6wwxv12nbc3sghvr68847wc9skkdgsicrz3fx4chgng1i3xy0j"; })
@@ -71,11 +71,11 @@
   (fetchNuGet { pname = "Microsoft.Extensions.Logging.Abstractions"; version = "6.0.0"; sha256 = "0b75fmins171zi6bfdcq1kcvyrirs8n91mknjnxy4c3ygi1rrnj0"; })
   (fetchNuGet { pname = "Microsoft.Extensions.Options"; version = "6.0.0"; sha256 = "008pnk2p50i594ahz308v81a41mbjz9mwcarqhmrjpl2d20c868g"; })
   (fetchNuGet { pname = "Microsoft.Extensions.Primitives"; version = "6.0.0"; sha256 = "1kjiw6s4yfz9gm7mx3wkhp06ghnbs95icj9hi505shz9rjrg42q2"; })
-  (fetchNuGet { pname = "Microsoft.NET.Test.Sdk"; version = "17.4.1"; sha256 = "02p1j9fncd4fb2hyp51kw49d0dz30vvazhzk24c9f5ccc00ijpra"; })
+  (fetchNuGet { pname = "Microsoft.NET.Test.Sdk"; version = "17.5.0"; sha256 = "00gz2i8kx4mlq1ywj3imvf7wc6qzh0bsnynhw06z0mgyha1a21jy"; })
   (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "5.0.0"; sha256 = "0mwpwdflidzgzfx2dlpkvvnkgkr2ayaf0s80737h4wa35gaj11rc"; })
   (fetchNuGet { pname = "Microsoft.OpenApi"; version = "1.2.3"; sha256 = "07b19k89whj69j87afkz86gp9b3iybw8jqwvlgcn43m7fb2y99rr"; })
-  (fetchNuGet { pname = "Microsoft.TestPlatform.ObjectModel"; version = "17.4.1"; sha256 = "0s68wf9yphm4hni9p6kwfk0mjld85f4hkrs93qbk5lzf6vv3kba1"; })
-  (fetchNuGet { pname = "Microsoft.TestPlatform.TestHost"; version = "17.4.1"; sha256 = "1n9ilq8n5rhyxcri06njkxb0h2818dbmzddwd2rrvav91647m2s4"; })
+  (fetchNuGet { pname = "Microsoft.TestPlatform.ObjectModel"; version = "17.5.0"; sha256 = "0qkjyf3ky6xpjg5is2sdsawm99ka7fzgid2bvpglwmmawqgm8gls"; })
+  (fetchNuGet { pname = "Microsoft.TestPlatform.TestHost"; version = "17.5.0"; sha256 = "17g0k3r5n8grba8kg4nghjyhnq9w8v0w6c2nkyyygvfh8k8x9wh3"; })
   (fetchNuGet { pname = "Microsoft.Win32.Registry"; version = "5.0.0"; sha256 = "102hvhq2gmlcbq8y2cb7hdr2dnmjzfp2k3asr1ycwrfacwyaak7n"; })
   (fetchNuGet { pname = "MSTest.TestAdapter"; version = "3.0.2"; sha256 = "1pzn95nhmprfvchwshyy87jifzjpvdny21b5yhkqafr150nxlz77"; })
   (fetchNuGet { pname = "MSTest.TestFramework"; version = "3.0.2"; sha256 = "1yiwi0hi8pn9dv90vz1yw13izap8dv13asxvr9axcliis0ad5iaq"; })
@@ -86,9 +86,9 @@
   (fetchNuGet { pname = "Nito.AsyncEx.Tasks"; version = "5.1.2"; sha256 = "11wp47kc69sjdxrbg5pgx0wlffqlp0x5kr54ggnz2v19kmjz362v"; })
   (fetchNuGet { pname = "Nito.Collections.Deque"; version = "1.1.1"; sha256 = "152564q3s0n5swfv5p5rx0ghn2sm0g2xsnbd7gv8vb9yfklv7yg8"; })
   (fetchNuGet { pname = "Nito.Disposables"; version = "2.2.1"; sha256 = "1hx5k8497j34kxxgh060bvij0vfnraw90dmm3h9bmamcdi8wp80l"; })
-  (fetchNuGet { pname = "NLog"; version = "5.1.1"; sha256 = "19m1ivp1cxz1ghlvysrxdhxlj7kzya9m7j812c3ssnxrfrr1077z"; })
-  (fetchNuGet { pname = "NLog.Extensions.Logging"; version = "5.2.1"; sha256 = "1z9ayqag1xncn4cs0cz27gxa5cqk6caq5fd81bczlj4sqff7ah4p"; })
-  (fetchNuGet { pname = "NLog.Web.AspNetCore"; version = "5.2.1"; sha256 = "10y03374lza6cjsi01xmql1v6hcjf6x2r7wfnnckzhzs70x2hhnl"; })
+  (fetchNuGet { pname = "NLog"; version = "5.1.2"; sha256 = "1hgb5lqx9c10kw6rjldrkldd70lmkzij4ssgg6msybgz7vpsyhkk"; })
+  (fetchNuGet { pname = "NLog.Extensions.Logging"; version = "5.2.2"; sha256 = "09y37z05c8w77hnj2mvzyhgprssam645llliyr0c3jycgy0ls707"; })
+  (fetchNuGet { pname = "NLog.Web.AspNetCore"; version = "5.2.2"; sha256 = "1ig6ffc1z0kadk2v6qsnrxyj945nwsral7jvddhvjhm12bd1zb6d"; })
   (fetchNuGet { pname = "NuGet.Frameworks"; version = "5.11.0"; sha256 = "0wv26gq39hfqw9md32amr5771s73f5zn1z9vs4y77cgynxr73s4z"; })
   (fetchNuGet { pname = "protobuf-net"; version = "3.0.101"; sha256 = "0594qckbc0lh61sw74ihaq4qmvf1lf133vfa88n443mh7lxm2fwf"; })
   (fetchNuGet { pname = "protobuf-net.Core"; version = "3.0.101"; sha256 = "1kvn9rnm6f0jxs0s9scyyx2f2p8rk03qzc1f6ijv1g6xgkpxkq1m"; })
@@ -112,7 +112,7 @@
   (fetchNuGet { pname = "System.Reflection.Metadata"; version = "1.6.0"; sha256 = "1wdbavrrkajy7qbdblpbpbalbdl48q3h34cchz24gvdgyrlf15r4"; })
   (fetchNuGet { pname = "System.Runtime.CompilerServices.Unsafe"; version = "6.0.0"; sha256 = "0qm741kh4rh57wky16sq4m0v05fxmkjjr87krycf5vp9f0zbahbc"; })
   (fetchNuGet { pname = "System.Security.AccessControl"; version = "5.0.0"; sha256 = "17n3lrrl6vahkqmhlpn3w20afgz09n7i6rv0r3qypngwi7wqdr5r"; })
-  (fetchNuGet { pname = "System.Security.Cryptography.ProtectedData"; version = "7.0.0"; sha256 = "15s9s6hsj9bz0nzw41mxbqdjgjd71w2djqbv0aj413gfi9amybk9"; })
+  (fetchNuGet { pname = "System.Security.Cryptography.ProtectedData"; version = "7.0.1"; sha256 = "1nq9ngkqha70rv41692c79zq09cx6m85wkp3xj9yc31s62afyl5i"; })
   (fetchNuGet { pname = "System.Security.Principal.Windows"; version = "5.0.0"; sha256 = "1mpk7xj76lxgz97a5yg93wi8lj0l8p157a5d50mmjy3gbz1904q8"; })
   (fetchNuGet { pname = "System.Text.Encoding.CodePages"; version = "6.0.0"; sha256 = "0gm2kiz2ndm9xyzxgi0jhazgwslcs427waxgfa30m7yqll1kcrww"; })
   (fetchNuGet { pname = "zxcvbn-core"; version = "7.0.92"; sha256 = "1pbi0n3za8zsnkbvq19njy4h4hy12a6rv4rknf4a2m1kdhxb3cgx"; })
diff --git a/pkgs/applications/misc/ArchiSteamFarm/fix-framework.diff b/pkgs/applications/misc/ArchiSteamFarm/fix-framework.diff
new file mode 100644
index 000000000000..6c525e735b0e
--- /dev/null
+++ b/pkgs/applications/misc/ArchiSteamFarm/fix-framework.diff
@@ -0,0 +1,24 @@
+diff --git a/Directory.Build.props b/Directory.Build.props
+index 89137fba..bce300a4 100644
+--- a/Directory.Build.props
++++ b/Directory.Build.props
+@@ -29,16 +29,16 @@
+ 		<RepositoryUrl>$(PackageProjectUrl).git</RepositoryUrl>
+ 		<RollForward>LatestMajor</RollForward>
+ 		<RuntimeIdentifiers>linux-arm;linux-arm64;linux-x64;osx-arm64;osx-x64;win-arm64;win-x64</RuntimeIdentifiers>
+-		<TargetFrameworks>net7.0</TargetFrameworks>
++		<TargetFramework>net7.0</TargetFramework>
+ 		<TargetLatestRuntimePatch>true</TargetLatestRuntimePatch>
+ 	</PropertyGroup>
+ 
+ 	<PropertyGroup Condition="'$(OS)' == 'Windows_NT' OR '$(ASFNetFramework)' != ''">
+-		<TargetFrameworks>$(TargetFrameworks);net481</TargetFrameworks>
++		<TargetFramework>$(TargetFramework);net481</TargetFramework>
+ 	</PropertyGroup>
+ 
+ 	<PropertyGroup Condition="'$(ASFNetStandard)' != ''">
+-		<TargetFrameworks>$(TargetFrameworks);netstandard2.1</TargetFrameworks>
++		<TargetFramework>$(TargetFramework);netstandard2.1</TargetFramework>
+ 	</PropertyGroup>
+ 
+ 	<ItemGroup Condition="'$(TargetFramework)' == 'net481' OR '$(TargetFramework)' == 'netstandard2.1'">
diff --git a/pkgs/applications/misc/ArchiSteamFarm/web-ui/default.nix b/pkgs/applications/misc/ArchiSteamFarm/web-ui/default.nix
index dfea7f1ffd4e..ca12a2c596d3 100644
--- a/pkgs/applications/misc/ArchiSteamFarm/web-ui/default.nix
+++ b/pkgs/applications/misc/ArchiSteamFarm/web-ui/default.nix
@@ -11,8 +11,8 @@ let
     repo = "ASF-ui";
     # updated by the update script
     # this is always the commit that should be used with asf-ui from the latest asf version
-    rev = "22692a1f115e8ca86f83fa17be55d9b20985570f";
-    sha256 = "0k0msk1r7ih092cwjngy1824bxkbjwz0d5p3k2r2l67r2p9b3lab";
+    rev = "b30b3f5bcea53019bab1d7a433a75936a63eef27";
+    sha256 = "0ba4jjf1lxhffj77lcamg390hf8z9avg9skc0iap37zw5n5myb6c";
   };
 
 in
diff --git a/pkgs/applications/misc/ArchiSteamFarm/web-ui/node-packages.nix b/pkgs/applications/misc/ArchiSteamFarm/web-ui/node-packages.nix
index b93726e1b979..6ef71a0741ad 100644
--- a/pkgs/applications/misc/ArchiSteamFarm/web-ui/node-packages.nix
+++ b/pkgs/applications/misc/ArchiSteamFarm/web-ui/node-packages.nix
@@ -4,13 +4,13 @@
 
 let
   sources = {
-    "@ampproject/remapping-2.1.1" = {
+    "@ampproject/remapping-2.2.0" = {
       name = "_at_ampproject_slash_remapping";
       packageName = "@ampproject/remapping";
-      version = "2.1.1";
+      version = "2.2.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@ampproject/remapping/-/remapping-2.1.1.tgz";
-        sha512 = "Aolwjd7HSC2PyY0fDj/wA/EimQT4HfEnFYNp5s9CQlrdhyvWTtvZ5YzrUPu6R6/1jKiUlxu8bUhkdSnKHNAHMA==";
+        url = "https://registry.npmjs.org/@ampproject/remapping/-/remapping-2.2.0.tgz";
+        sha512 = "qRmjj8nj9qmLTQXXmaR1cck3UXSRMPrbsLJAasZpF+t3riI71BXed5ebIOYwQntykeZuhjsdweEc9BxH5Jc26w==";
       };
     };
     "@babel/code-frame-7.18.6" = {
@@ -31,13 +31,13 @@ let
         sha512 = "KZXo2t10+/jxmkhNXc7pZTqRvSOIvVv/+lJwHS+B2rErwOyjuVRh60yVpb7liQ1U5t7lLJ1bz+t8tSypUZdm0g==";
       };
     };
-    "@babel/core-7.20.12" = {
+    "@babel/core-7.21.0" = {
       name = "_at_babel_slash_core";
       packageName = "@babel/core";
-      version = "7.20.12";
+      version = "7.21.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@babel/core/-/core-7.20.12.tgz";
-        sha512 = "XsMfHovsUYHFMdrIHkZphTN/2Hzzi78R08NuHfDBehym2VsPDL6Zn/JAD/JQdnRvbSsbQc4mVaU1m6JgtTEElg==";
+        url = "https://registry.npmjs.org/@babel/core/-/core-7.21.0.tgz";
+        sha512 = "PuxUbxcW6ZYe656yL3EAhpy7qXKq0DmYsrJLpbB8XrsCP9Nm+XCg9XFMb5vIDliPD7+U/+M+QJlH17XOcB7eXA==";
       };
     };
     "@babel/eslint-parser-7.19.1" = {
@@ -49,13 +49,13 @@ let
         sha512 = "AqNf2QWt1rtu2/1rLswy6CDP7H9Oh3mMhk177Y67Rg8d7RD9WfOLLv8CGn6tisFvS2htm86yIe1yLF6I1UDaGQ==";
       };
     };
-    "@babel/generator-7.20.7" = {
+    "@babel/generator-7.21.0" = {
       name = "_at_babel_slash_generator";
       packageName = "@babel/generator";
-      version = "7.20.7";
+      version = "7.21.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@babel/generator/-/generator-7.20.7.tgz";
-        sha512 = "7wqMOJq8doJMZmP4ApXTzLxSr7+oO2jroJURrVEp6XShrQUObV8Tq/D0NCcoYg2uHqUrjzO0zwBjoYzelxK+sw==";
+        url = "https://registry.npmjs.org/@babel/generator/-/generator-7.21.0.tgz";
+        sha512 = "z/zN3SePOtxN1/vPFdqrkuJGCD2Vx469+dSbNRD+4TF2+6e4Of5exHqAtcfL/2Nwu0RN0QsFwjyDBFwdUMzNSA==";
       };
     };
     "@babel/helper-annotate-as-pure-7.18.6" = {
@@ -130,13 +130,13 @@ let
         sha512 = "eyAYAsQmB80jNfg4baAtLeWAQHfHFiR483rzFK+BhETlGZaQC9bsfrugfXDCbRHLQbIA7U5NxhhOxN7p/dWIcg==";
       };
     };
-    "@babel/helper-function-name-7.19.0" = {
+    "@babel/helper-function-name-7.21.0" = {
       name = "_at_babel_slash_helper-function-name";
       packageName = "@babel/helper-function-name";
-      version = "7.19.0";
+      version = "7.21.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@babel/helper-function-name/-/helper-function-name-7.19.0.tgz";
-        sha512 = "WAwHBINyrpqywkUH0nTnNgI5ina5TFn85HKS0pbPDfxFfhyR/aNQEn4hGi1P1JyT//I0t4OgXUlofzWILRvS5w==";
+        url = "https://registry.npmjs.org/@babel/helper-function-name/-/helper-function-name-7.21.0.tgz";
+        sha512 = "HfK1aMRanKHpxemaY2gqBmL04iAPOPRj7DxtNbiDOrJK+gdwkiNRVpCpUJYbUT+aZyemKN8brqTOxzCaG6ExRg==";
       };
     };
     "@babel/helper-hoist-variables-7.18.6" = {
@@ -166,13 +166,13 @@ let
         sha512 = "0NFvs3VkuSYbFi1x2Vd6tKrywq+z/cLeYC/RJNFrIX/30Bf5aiGYbtvGXolEktzJH8o5E5KJ3tT+nkxuuZFVlA==";
       };
     };
-    "@babel/helper-module-transforms-7.20.11" = {
+    "@babel/helper-module-transforms-7.21.0" = {
       name = "_at_babel_slash_helper-module-transforms";
       packageName = "@babel/helper-module-transforms";
-      version = "7.20.11";
+      version = "7.21.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@babel/helper-module-transforms/-/helper-module-transforms-7.20.11.tgz";
-        sha512 = "uRy78kN4psmji1s2QtbtcCSaj/LILFDp0f/ymhpQH5QY3nljUZCaNWz9X1dEj/8MBdBEFECs7yRhKn8i7NjZgg==";
+        url = "https://registry.npmjs.org/@babel/helper-module-transforms/-/helper-module-transforms-7.21.0.tgz";
+        sha512 = "eD/JQ21IG2i1FraJnTMbUarAUkA7G988ofehG5MDCRXaUU91rEBJuCeSoou2Sk1y4RbLYXzqEg1QLwEmRU4qcQ==";
       };
     };
     "@babel/helper-optimise-call-expression-7.18.6" = {
@@ -274,13 +274,13 @@ let
         sha512 = "95NLBP59VWdfK2lyLKe6eTMq9xg+yWKzxzxbJ1wcYNi1Auz200+83fMDADjRxBvc2QQor5zja2yTQzXGhk2GtQ==";
       };
     };
-    "@babel/helpers-7.20.7" = {
+    "@babel/helpers-7.21.0" = {
       name = "_at_babel_slash_helpers";
       packageName = "@babel/helpers";
-      version = "7.20.7";
+      version = "7.21.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@babel/helpers/-/helpers-7.20.7.tgz";
-        sha512 = "PBPjs5BppzsGaxHQCDKnZ6Gd9s6xl8bBCluz3vEInLGRJmnZan4F6BYCeqtyXqkk4W5IlPmjK4JlOuZkpJ3xZA==";
+        url = "https://registry.npmjs.org/@babel/helpers/-/helpers-7.21.0.tgz";
+        sha512 = "XXve0CBtOW0pd7MRzzmoyuSj0e3SEzj8pgyFxnTT1NJZL38BD1MK7yYrm8yefRPIDvNNe14xR4FdbHwpInD4rA==";
       };
     };
     "@babel/highlight-7.18.6" = {
@@ -292,13 +292,13 @@ let
         sha512 = "u7stbOuYjaPezCuLj29hNW1v64M2Md2qupEKP1fHc7WdOA3DgLh37suiSrZYY7haUB7iBeQZ9P1uiRF359do3g==";
       };
     };
-    "@babel/parser-7.20.7" = {
+    "@babel/parser-7.21.0" = {
       name = "_at_babel_slash_parser";
       packageName = "@babel/parser";
-      version = "7.20.7";
+      version = "7.21.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@babel/parser/-/parser-7.20.7.tgz";
-        sha512 = "T3Z9oHybU+0vZlY9CiDSJQTD5ZapcW18ZctFMi0MOAl/4BjFF4ul7NVSARLdbGO5vDqy9eQiGTV0LtKfvCYvcg==";
+        url = "https://registry.npmjs.org/@babel/parser/-/parser-7.21.0.tgz";
+        sha512 = "ONjtg4renj14A9pj3iA5T5+r5Eijxbr2eNIkMBTC74occDSsRZUpe8vowmowAjFR1imWlkD8eEmjYXiREZpGZg==";
       };
     };
     "@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression-7.18.6" = {
@@ -913,31 +913,31 @@ let
         sha512 = "8SegXApWe6VoNw0r9JHpSteLKTpTiLZ4rMlGIm9JQ18KiCtyQiAMEazujAHrUS5flrcqYZa75ukev3P6QmUwUw==";
       };
     };
-    "@babel/traverse-7.20.12" = {
+    "@babel/traverse-7.21.0" = {
       name = "_at_babel_slash_traverse";
       packageName = "@babel/traverse";
-      version = "7.20.12";
+      version = "7.21.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@babel/traverse/-/traverse-7.20.12.tgz";
-        sha512 = "MsIbFN0u+raeja38qboyF8TIT7K0BFzz/Yd/77ta4MsUsmP2RAnidIlwq7d5HFQrH/OZJecGV6B71C4zAgpoSQ==";
+        url = "https://registry.npmjs.org/@babel/traverse/-/traverse-7.21.0.tgz";
+        sha512 = "Xdt2P1H4LKTO8ApPfnO1KmzYMFpp7D/EinoXzLYN/cHcBNrVCAkAtGUcXnHXrl/VGktureU6fkQrHSBE2URfoA==";
       };
     };
-    "@babel/types-7.20.7" = {
+    "@babel/types-7.21.0" = {
       name = "_at_babel_slash_types";
       packageName = "@babel/types";
-      version = "7.20.7";
+      version = "7.21.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@babel/types/-/types-7.20.7.tgz";
-        sha512 = "69OnhBxSSgK0OzTJai4kyPDiKTIe3j+ctaHdIGVbRahTLAT7L3R9oeXHC2aVSuGYt3cVnoAMDmOCgJ2yaiLMvg==";
+        url = "https://registry.npmjs.org/@babel/types/-/types-7.21.0.tgz";
+        sha512 = "uR7NWq2VNFnDi7EYqiRz2Jv/VQIu38tu64Zy8TX2nQFQ6etJ9V/Rr2msW8BS132mum2rL645qpDrLtAJtVpuow==";
       };
     };
-    "@discoveryjs/json-ext-0.5.5" = {
+    "@discoveryjs/json-ext-0.5.7" = {
       name = "_at_discoveryjs_slash_json-ext";
       packageName = "@discoveryjs/json-ext";
-      version = "0.5.5";
+      version = "0.5.7";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@discoveryjs/json-ext/-/json-ext-0.5.5.tgz";
-        sha512 = "6nFkfkmSeV/rqSaS4oWHgmpnYw194f6hmWF5is6b0J1naJZoiD0NTc9AiUwPHvWsowkjuHErCZT1wa0jg+BLIA==";
+        url = "https://registry.npmjs.org/@discoveryjs/json-ext/-/json-ext-0.5.7.tgz";
+        sha512 = "dBVuXR082gk3jsFp7Rd/JI4kytwGHecnCoTtXFb7DB6CNHp4rg5k1bhg0nWdLGLnOV71lmDzGQaLMy8iPLY0pw==";
       };
     };
     "@eslint/eslintrc-1.4.1" = {
@@ -949,40 +949,40 @@ let
         sha512 = "XXrH9Uarn0stsyldqDYq8r++mROmWRI1xKMXa640Bb//SY1+ECYX6VzT6Lcx5frD0V30XieqJ0oX9I2Xj5aoMA==";
       };
     };
-    "@fortawesome/fontawesome-common-types-6.2.1" = {
+    "@fortawesome/fontawesome-common-types-6.3.0" = {
       name = "_at_fortawesome_slash_fontawesome-common-types";
       packageName = "@fortawesome/fontawesome-common-types";
-      version = "6.2.1";
+      version = "6.3.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@fortawesome/fontawesome-common-types/-/fontawesome-common-types-6.2.1.tgz";
-        sha512 = "Sz07mnQrTekFWLz5BMjOzHl/+NooTdW8F8kDQxjWwbpOJcnoSg4vUDng8d/WR1wOxM0O+CY9Zw0nR054riNYtQ==";
+        url = "https://registry.npmjs.org/@fortawesome/fontawesome-common-types/-/fontawesome-common-types-6.3.0.tgz";
+        sha512 = "4BC1NMoacEBzSXRwKjZ/X/gmnbp/HU5Qqat7E8xqorUtBFZS+bwfGH5/wqOC2K6GV0rgEobp3OjGRMa5fK9pFg==";
       };
     };
-    "@fortawesome/fontawesome-svg-core-6.2.1" = {
+    "@fortawesome/fontawesome-svg-core-6.3.0" = {
       name = "_at_fortawesome_slash_fontawesome-svg-core";
       packageName = "@fortawesome/fontawesome-svg-core";
-      version = "6.2.1";
+      version = "6.3.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@fortawesome/fontawesome-svg-core/-/fontawesome-svg-core-6.2.1.tgz";
-        sha512 = "HELwwbCz6C1XEcjzyT1Jugmz2NNklMrSPjZOWMlc+ZsHIVk+XOvOXLGGQtFBwSyqfJDNgRq4xBCwWOaZ/d9DEA==";
+        url = "https://registry.npmjs.org/@fortawesome/fontawesome-svg-core/-/fontawesome-svg-core-6.3.0.tgz";
+        sha512 = "uz9YifyKlixV6AcKlOX8WNdtF7l6nakGyLYxYaCa823bEBqyj/U2ssqtctO38itNEwXb8/lMzjdoJ+aaJuOdrw==";
       };
     };
-    "@fortawesome/free-brands-svg-icons-6.2.1" = {
+    "@fortawesome/free-brands-svg-icons-6.3.0" = {
       name = "_at_fortawesome_slash_free-brands-svg-icons";
       packageName = "@fortawesome/free-brands-svg-icons";
-      version = "6.2.1";
+      version = "6.3.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@fortawesome/free-brands-svg-icons/-/free-brands-svg-icons-6.2.1.tgz";
-        sha512 = "L8l4MfdHPmZlJ72PvzdfwOwbwcCAL0vx48tJRnI6u1PJXh+j2f3yDoKyQgO3qjEsgD5Fr2tQV/cPP8F/k6aUig==";
+        url = "https://registry.npmjs.org/@fortawesome/free-brands-svg-icons/-/free-brands-svg-icons-6.3.0.tgz";
+        sha512 = "xI0c+a8xnKItAXCN8rZgCNCJQiVAd2Y7p9e2ND6zN3J3ekneu96qrePieJ7yA7073C1JxxoM3vH1RU7rYsaj8w==";
       };
     };
-    "@fortawesome/free-solid-svg-icons-6.2.1" = {
+    "@fortawesome/free-solid-svg-icons-6.3.0" = {
       name = "_at_fortawesome_slash_free-solid-svg-icons";
       packageName = "@fortawesome/free-solid-svg-icons";
-      version = "6.2.1";
+      version = "6.3.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@fortawesome/free-solid-svg-icons/-/free-solid-svg-icons-6.2.1.tgz";
-        sha512 = "oKuqrP5jbfEPJWTij4sM+/RvgX+RMFwx3QZCZcK9PrBDgxC35zuc7AOFsyMjMd/PIFPeB2JxyqDr5zs/DZFPPw==";
+        url = "https://registry.npmjs.org/@fortawesome/free-solid-svg-icons/-/free-solid-svg-icons-6.3.0.tgz";
+        sha512 = "x5tMwzF2lTH8pyv8yeZRodItP2IVlzzmBuD1M7BjawWgg9XAvktqJJ91Qjgoaf8qJpHQ8FEU9VxRfOkLhh86QA==";
       };
     };
     "@fortawesome/vue-fontawesome-2.0.10" = {
@@ -1021,6 +1021,15 @@ let
         sha512 = "ZnQMnLV4e7hDlUvw8H+U8ASL02SS2Gn6+9Ac3wGGLIe7+je2AeAOxPY+izIPJDfFDb7eDjev0Us8MO1iFRN8hA==";
       };
     };
+    "@jridgewell/gen-mapping-0.1.1" = {
+      name = "_at_jridgewell_slash_gen-mapping";
+      packageName = "@jridgewell/gen-mapping";
+      version = "0.1.1";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.1.1.tgz";
+        sha512 = "sQXCasFk+U8lWYEe66WxRDOE9PjVz4vSM51fTu3Hw+ClTpUSQb718772vH3pyS5pShp6lvQM7SxgIDXXXmOX7w==";
+      };
+    };
     "@jridgewell/gen-mapping-0.3.2" = {
       name = "_at_jridgewell_slash_gen-mapping";
       packageName = "@jridgewell/gen-mapping";
@@ -1030,13 +1039,13 @@ let
         sha512 = "mh65xKQAzI6iBcFzwv28KVWSmCkdRBWoOh+bYQGW3+6OZvbbN3TqMGo5hqYxQniRcH9F2VZIoJCm4pa3BPDK/A==";
       };
     };
-    "@jridgewell/resolve-uri-3.0.5" = {
+    "@jridgewell/resolve-uri-3.1.0" = {
       name = "_at_jridgewell_slash_resolve-uri";
       packageName = "@jridgewell/resolve-uri";
-      version = "3.0.5";
+      version = "3.1.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@jridgewell/resolve-uri/-/resolve-uri-3.0.5.tgz";
-        sha512 = "VPeQ7+wH0itvQxnG+lIzWgkysKIr3L9sslimFW55rHMdGu/qCQ5z5h9zq4gI8uBtqkpHhsF4Z/OwExufUCThew==";
+        url = "https://registry.npmjs.org/@jridgewell/resolve-uri/-/resolve-uri-3.1.0.tgz";
+        sha512 = "F2msla3tad+Mfht5cJq7LSXcdudKTWCVYUgw6pLFOOHSTtZlj6SWNYAp+AhuqLmWdBO2X5hPrLcu8cVP8fy28w==";
       };
     };
     "@jridgewell/set-array-1.1.2" = {
@@ -1048,22 +1057,22 @@ let
         sha512 = "xnkseuNADM0gt2bs+BvhO0p78Mk762YnZdsuzFV018NoG1Sj1SCQvpSqa7XUaTam5vAGasABV9qXASMKnFMwMw==";
       };
     };
-    "@jridgewell/sourcemap-codec-1.4.11" = {
+    "@jridgewell/sourcemap-codec-1.4.14" = {
       name = "_at_jridgewell_slash_sourcemap-codec";
       packageName = "@jridgewell/sourcemap-codec";
-      version = "1.4.11";
+      version = "1.4.14";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.4.11.tgz";
-        sha512 = "Fg32GrJo61m+VqYSdRSjRXMjQ06j8YIYfcTqndLYVAaHmroZHLJZCydsWBOTDqXS2v+mjxohBWEMfg97GXmYQg==";
+        url = "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.4.14.tgz";
+        sha512 = "XPSJHWmi394fuUuzDnGz1wiKqWfo1yXecHQMRf2l6hztTO+nPru658AyDngaBe7isIxEkRsPR3FZh+s7iVa4Uw==";
       };
     };
-    "@jridgewell/trace-mapping-0.3.13" = {
+    "@jridgewell/trace-mapping-0.3.17" = {
       name = "_at_jridgewell_slash_trace-mapping";
       packageName = "@jridgewell/trace-mapping";
-      version = "0.3.13";
+      version = "0.3.17";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.13.tgz";
-        sha512 = "o1xbKhp9qnIAoHJSWd6KlCZfqslL4valSF81H8ImioOAxluWYWOpWkpyktY2vnt4tbrX9XYaxovq6cgowaJp2w==";
+        url = "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.17.tgz";
+        sha512 = "MCNzAp77qzKca9+W/+I0+sEpaUnZoeasnghNeVc41VZCEKaCH73Vq3BZZ/SzWIgrqE4H4ceI+p+b6C0mHf9T4g==";
       };
     };
     "@leichtgewicht/ip-codec-2.0.3" = {
@@ -1795,13 +1804,13 @@ let
         sha512 = "DMD0KiN46eipeziST1LPP/STfDU0sufISXmjSgvVsoU2tqxctQeASejWcfNtxYKqETM1UxQ8sp2OrSBWpHY6sw==";
       };
     };
-    "axios-1.2.6" = {
+    "axios-1.3.4" = {
       name = "axios";
       packageName = "axios";
-      version = "1.2.6";
+      version = "1.3.4";
       src = fetchurl {
-        url = "https://registry.npmjs.org/axios/-/axios-1.2.6.tgz";
-        sha512 = "rC/7F08XxZwjMV4iuWv+JpD3E0Ksqg9nac4IIg6RwNuF0JTeWoCo/mBNG54+tNhhI11G3/VDRbdDQTs9hGp4pQ==";
+        url = "https://registry.npmjs.org/axios/-/axios-1.3.4.tgz";
+        sha512 = "toYm+Bsyl6VC5wSkfkbbNB6ROv7KY93PEBBL6xyDczaIHasAiv4wPqQ/c4RjoQzipxRD2W5g21cOqQulZ7rHwQ==";
       };
     };
     "babel-loader-9.1.2" = {
@@ -2740,13 +2749,13 @@ let
         sha512 = "TtpcNJ3XAzx3Gq8sWRzJaVajRs0uVxA2YAkdb1jm2YkPz4G6egUFAyA3n5vtEIZefPk5Wa4UXbKuS5fKkJWdgA==";
       };
     };
-    "eslint-8.33.0" = {
+    "eslint-8.34.0" = {
       name = "eslint";
       packageName = "eslint";
-      version = "8.33.0";
+      version = "8.34.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/eslint/-/eslint-8.33.0.tgz";
-        sha512 = "WjOpFQgKK8VrCnAtl8We0SUOy/oVZ5NHykyMiagV1M9r8IFpIJX7DduK6n1mpfhlG7T1NLWm2SuD8QB7KFySaA==";
+        url = "https://registry.npmjs.org/eslint/-/eslint-8.34.0.tgz";
+        sha512 = "1Z8iFsucw+7kSqXNZVslXS8Ioa4u2KM7GPwuKtkTFAqZ/cHMcEaR+1+Br0wLlot49cNxIiZk5wp8EAbPcYZxTg==";
       };
     };
     "eslint-config-airbnb-base-15.0.0" = {
@@ -5386,13 +5395,13 @@ let
         sha512 = "YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==";
       };
     };
-    "sass-1.57.1" = {
+    "sass-1.58.3" = {
       name = "sass";
       packageName = "sass";
-      version = "1.57.1";
+      version = "1.58.3";
       src = fetchurl {
-        url = "https://registry.npmjs.org/sass/-/sass-1.57.1.tgz";
-        sha512 = "O2+LwLS79op7GI0xZ8fqzF7X2m/m8WFfI02dHOdsK5R2ECeS5F62zrwg/relM1rjSLy7Vd/DiMNIvPrQGsA0jw==";
+        url = "https://registry.npmjs.org/sass/-/sass-1.58.3.tgz";
+        sha512 = "Q7RaEtYf6BflYrQ+buPudKR26/lH+10EmO9bBqbmPh/KeLqv8bjpTNqxe71ocONqXq+jYiCbpPUmQMS+JJPk4A==";
       };
     };
     "sass-loader-13.2.0" = {
@@ -6205,13 +6214,13 @@ let
         sha512 = "piaIaoVJlqMsPtX/+3KTTO6jfvrSYgauFVdt8cr9LTHKmcq/AMd4mhzsiP7ZF/PGRNPGA8336jldh9l2Kt2ogQ==";
       };
     };
-    "webpack-bundle-analyzer-4.7.0" = {
+    "webpack-bundle-analyzer-4.8.0" = {
       name = "webpack-bundle-analyzer";
       packageName = "webpack-bundle-analyzer";
-      version = "4.7.0";
+      version = "4.8.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/webpack-bundle-analyzer/-/webpack-bundle-analyzer-4.7.0.tgz";
-        sha512 = "j9b8ynpJS4K+zfO5GGwsAcQX4ZHpWV+yRiHDiL+bE0XHJ8NiPYLTNVQdlFYWxtpg9lfAQNlwJg16J9AJtFSXRg==";
+        url = "https://registry.npmjs.org/webpack-bundle-analyzer/-/webpack-bundle-analyzer-4.8.0.tgz";
+        sha512 = "ZzoSBePshOKhr+hd8u6oCkZVwpVaXgpw23ScGLFpR6SjYI7+7iIWYarjN6OEYOfRt8o7ZyZZQk0DuMizJ+LEIg==";
       };
     };
     "webpack-cli-4.10.0" = {
@@ -6410,10 +6419,14 @@ let
     version = "0.0.0";
     src = ./.;
     dependencies = [
-      sources."@ampproject/remapping-2.1.1"
+      (sources."@ampproject/remapping-2.2.0" // {
+        dependencies = [
+          sources."@jridgewell/gen-mapping-0.1.1"
+        ];
+      })
       sources."@babel/code-frame-7.18.6"
       sources."@babel/compat-data-7.20.5"
-      (sources."@babel/core-7.20.12" // {
+      (sources."@babel/core-7.21.0" // {
         dependencies = [
           sources."debug-4.3.4"
           sources."json5-2.2.3"
@@ -6427,7 +6440,7 @@ let
           sources."semver-6.3.0"
         ];
       })
-      sources."@babel/generator-7.20.7"
+      sources."@babel/generator-7.21.0"
       sources."@babel/helper-annotate-as-pure-7.18.6"
       sources."@babel/helper-builder-binary-assignment-operator-visitor-7.18.6"
       (sources."@babel/helper-compilation-targets-7.20.7" // {
@@ -6448,11 +6461,11 @@ let
       })
       sources."@babel/helper-environment-visitor-7.18.9"
       sources."@babel/helper-explode-assignable-expression-7.18.6"
-      sources."@babel/helper-function-name-7.19.0"
+      sources."@babel/helper-function-name-7.21.0"
       sources."@babel/helper-hoist-variables-7.18.6"
       sources."@babel/helper-member-expression-to-functions-7.18.9"
       sources."@babel/helper-module-imports-7.18.6"
-      sources."@babel/helper-module-transforms-7.20.11"
+      sources."@babel/helper-module-transforms-7.21.0"
       sources."@babel/helper-optimise-call-expression-7.18.6"
       sources."@babel/helper-plugin-utils-7.20.2"
       sources."@babel/helper-remap-async-to-generator-7.18.9"
@@ -6464,9 +6477,9 @@ let
       sources."@babel/helper-validator-identifier-7.19.1"
       sources."@babel/helper-validator-option-7.18.6"
       sources."@babel/helper-wrap-function-7.18.10"
-      sources."@babel/helpers-7.20.7"
+      sources."@babel/helpers-7.21.0"
       sources."@babel/highlight-7.18.6"
-      sources."@babel/parser-7.20.7"
+      sources."@babel/parser-7.21.0"
       sources."@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression-7.18.6"
       sources."@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining-7.18.9"
       sources."@babel/plugin-proposal-async-generator-functions-7.20.1"
@@ -6539,14 +6552,14 @@ let
       sources."@babel/preset-modules-0.1.5"
       sources."@babel/runtime-7.14.6"
       sources."@babel/template-7.20.7"
-      (sources."@babel/traverse-7.20.12" // {
+      (sources."@babel/traverse-7.21.0" // {
         dependencies = [
           sources."debug-4.3.3"
           sources."ms-2.1.2"
         ];
       })
-      sources."@babel/types-7.20.7"
-      sources."@discoveryjs/json-ext-0.5.5"
+      sources."@babel/types-7.21.0"
+      sources."@discoveryjs/json-ext-0.5.7"
       (sources."@eslint/eslintrc-1.4.1" // {
         dependencies = [
           sources."debug-4.3.3"
@@ -6554,10 +6567,10 @@ let
           sources."ms-2.1.2"
         ];
       })
-      sources."@fortawesome/fontawesome-common-types-6.2.1"
-      sources."@fortawesome/fontawesome-svg-core-6.2.1"
-      sources."@fortawesome/free-brands-svg-icons-6.2.1"
-      sources."@fortawesome/free-solid-svg-icons-6.2.1"
+      sources."@fortawesome/fontawesome-common-types-6.3.0"
+      sources."@fortawesome/fontawesome-svg-core-6.3.0"
+      sources."@fortawesome/free-brands-svg-icons-6.3.0"
+      sources."@fortawesome/free-solid-svg-icons-6.3.0"
       sources."@fortawesome/vue-fontawesome-2.0.10"
       (sources."@humanwhocodes/config-array-0.11.8" // {
         dependencies = [
@@ -6568,10 +6581,10 @@ let
       sources."@humanwhocodes/module-importer-1.0.1"
       sources."@humanwhocodes/object-schema-1.2.1"
       sources."@jridgewell/gen-mapping-0.3.2"
-      sources."@jridgewell/resolve-uri-3.0.5"
+      sources."@jridgewell/resolve-uri-3.1.0"
       sources."@jridgewell/set-array-1.1.2"
-      sources."@jridgewell/sourcemap-codec-1.4.11"
-      sources."@jridgewell/trace-mapping-0.3.13"
+      sources."@jridgewell/sourcemap-codec-1.4.14"
+      sources."@jridgewell/trace-mapping-0.3.17"
       sources."@leichtgewicht/ip-codec-2.0.3"
       sources."@nicolo-ribaudo/eslint-scope-5-internals-5.1.1-v1"
       sources."@nodelib/fs.scandir-2.1.5"
@@ -6655,7 +6668,7 @@ let
       sources."array.prototype.flatmap-1.3.1"
       sources."asynckit-0.4.0"
       sources."available-typed-arrays-1.0.5"
-      sources."axios-1.2.6"
+      sources."axios-1.3.4"
       (sources."babel-loader-9.1.2" // {
         dependencies = [
           sources."ajv-8.12.0"
@@ -6790,7 +6803,7 @@ let
       sources."escalade-3.1.1"
       sources."escape-html-1.0.3"
       sources."escape-string-regexp-1.0.5"
-      (sources."eslint-8.33.0" // {
+      (sources."eslint-8.34.0" // {
         dependencies = [
           sources."ansi-styles-4.3.0"
           sources."chalk-4.1.2"
@@ -7186,7 +7199,7 @@ let
       sources."safe-buffer-5.1.2"
       sources."safe-regex-test-1.0.0"
       sources."safer-buffer-2.1.2"
-      sources."sass-1.57.1"
+      sources."sass-1.58.3"
       sources."sass-loader-13.2.0"
       sources."schema-utils-3.1.1"
       sources."select-hose-2.0.0"
@@ -7318,7 +7331,7 @@ let
       sources."watchpack-2.4.0"
       sources."wbuf-1.7.3"
       sources."webpack-5.75.0"
-      (sources."webpack-bundle-analyzer-4.7.0" // {
+      (sources."webpack-bundle-analyzer-4.8.0" // {
         dependencies = [
           sources."ansi-styles-4.3.0"
           sources."chalk-4.1.2"
diff --git a/pkgs/applications/misc/process-viewer/default.nix b/pkgs/applications/misc/process-viewer/default.nix
index 528fe1aec0c8..f453009e0c81 100644
--- a/pkgs/applications/misc/process-viewer/default.nix
+++ b/pkgs/applications/misc/process-viewer/default.nix
@@ -9,14 +9,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "process-viewer";
-  version = "0.5.6";
+  version = "0.5.8";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-ELASfcXNhUCE/mhPKBHA78liFMbcT9RB/aoLt4ZRPa0=";
+    sha256 = "sha256-mEmtLCtHlrCurjKKJ3vEtEkLBik4LwuUED5UeQ1QLws=";
   };
 
-  cargoSha256 = "sha256-K2kyZwKRALh9ImPngijgpoHyLS+c5sDYviN74JxhJLM=";
+  cargoSha256 = "sha256-lgVByl+mpCDbhwlC1Eiw9ZkHIDYJsOR06Ds790pXOMc=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/applications/networking/browsers/lagrange/default.nix b/pkgs/applications/networking/browsers/lagrange/default.nix
index 4a3d98d6474c..601d80717921 100644
--- a/pkgs/applications/networking/browsers/lagrange/default.nix
+++ b/pkgs/applications/networking/browsers/lagrange/default.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lagrange";
-  version = "1.15.3";
+  version = "1.15.4";
 
   src = fetchFromGitHub {
     owner = "skyjake";
     repo = "lagrange";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-BKDN2DtLoG+E+R+yBSBpF4PWv+pRLNYZvX/3BqEIxVQ=";
+    hash = "sha256-l69h0+yMX4vzQ1GYB1AqhZc1ztMKF/7PthxEDarizek=";
   };
 
   nativeBuildInputs = [ cmake pkg-config zip ];
diff --git a/pkgs/applications/networking/dnscontrol/default.nix b/pkgs/applications/networking/dnscontrol/default.nix
index e9c1d3dde5ff..ef6d723f3bbe 100644
--- a/pkgs/applications/networking/dnscontrol/default.nix
+++ b/pkgs/applications/networking/dnscontrol/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "dnscontrol";
-  version = "3.27.1";
+  version = "3.27.2";
 
   src = fetchFromGitHub {
     owner = "StackExchange";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-WXYmV4QE0OPv1reYX+YrmqGdnRUDHXBt60NIUDLTDLk=";
+    sha256 = "sha256-2U5DlXnW+mCxGfdjikeMm+k+KyxDwjXmjGrH3uq4lJo=";
   };
 
-  vendorHash = "sha256-FxKmFDx5ckLm8uJB9ouYSwjX+Pu20In6ertGzhhlEwA=";
+  vendorHash = "sha256-h0n0dR1iqeVEFvcDeMlfBu7mlrSNloAih2ZhT3ML1FI=";
 
   ldflags = [ "-s" "-w" ];
 
diff --git a/pkgs/applications/networking/instant-messengers/element/element-desktop.nix b/pkgs/applications/networking/instant-messengers/element/element-desktop.nix
index 55d8227f5759..f30850d2586d 100644
--- a/pkgs/applications/networking/instant-messengers/element/element-desktop.nix
+++ b/pkgs/applications/networking/instant-messengers/element/element-desktop.nix
@@ -19,25 +19,25 @@
 }:
 
 let
-  pinData = lib.importJSON ./pin.json;
+  pinData = import ./pin.nix;
+  inherit (pinData.hashes) desktopSrcHash desktopYarnHash;
   executableName = "element-desktop";
   keytar = callPackage ./keytar { inherit Security AppKit; };
   seshat = callPackage ./seshat { inherit CoreServices; };
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: builtins.removeAttrs pinData [ "hashes" ] // {
   pname = "element-desktop";
-  inherit (pinData) version;
-  name = "${pname}-${version}";
+  name = "${finalAttrs.pname}-${finalAttrs.version}";
   src = fetchFromGitHub {
     owner = "vector-im";
     repo = "element-desktop";
-    rev = "v${version}";
-    sha256 = pinData.desktopSrcHash;
+    rev = "v${finalAttrs.version}";
+    sha256 = desktopSrcHash;
   };
 
   offlineCache = fetchYarnDeps {
-    yarnLock = src + "/yarn.lock";
-    sha256 = pinData.desktopYarnHash;
+    yarnLock = finalAttrs.src + "/yarn.lock";
+    sha256 = desktopYarnHash;
   };
 
   nativeBuildInputs = [ yarn fixup_yarn_lock nodejs makeWrapper ]
@@ -97,7 +97,7 @@ stdenv.mkDerivation rec {
 
     # desktop item
     mkdir -p "$out/share"
-    ln -s "${desktopItem}/share/applications" "$out/share/applications"
+    ln -s "${finalAttrs.desktopItem}/share/applications" "$out/share/applications"
 
     # executable wrapper
     # LD_PRELOAD workaround for sqlcipher not found: https://github.com/matrix-org/seshat/issues/102
@@ -117,7 +117,7 @@ stdenv.mkDerivation rec {
     icon = "element";
     desktopName = "Element";
     genericName = "Matrix Client";
-    comment = meta.description;
+    comment = finalAttrs.meta.description;
     categories = [ "Network" "InstantMessaging" "Chat" ];
     startupWMClass = "element";
     mimeTypes = [ "x-scheme-handler/element" ];
@@ -141,9 +141,9 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "A feature-rich client for Matrix.org";
     homepage = "https://element.io/";
-    changelog = "https://github.com/vector-im/element-desktop/blob/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/vector-im/element-desktop/blob/v${finalAttrs.version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = teams.matrix.members;
     inherit (electron.meta) platforms;
   };
-}
+})
diff --git a/pkgs/applications/networking/instant-messengers/element/element-web.nix b/pkgs/applications/networking/instant-messengers/element/element-web.nix
index b73fda72174a..e6b73d2983a6 100644
--- a/pkgs/applications/networking/instant-messengers/element/element-web.nix
+++ b/pkgs/applications/networking/instant-messengers/element/element-web.nix
@@ -12,25 +12,25 @@
 }:
 
 let
-  pinData = lib.importJSON ./pin.json;
+  pinData = import ./pin.nix;
+  inherit (pinData.hashes) webSrcHash webYarnHash;
   noPhoningHome = {
     disable_guests = true; # disable automatic guest account registration at matrix.org
   };
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: builtins.removeAttrs pinData [ "hashes" ] // {
   pname = "element-web";
-  inherit (pinData) version;
 
   src = fetchFromGitHub {
     owner = "vector-im";
-    repo = pname;
-    rev = "v${version}";
-    sha256 = pinData.webSrcHash;
+    repo = finalAttrs.pname;
+    rev = "v${finalAttrs.version}";
+    sha256 = webSrcHash;
   };
 
   offlineCache = fetchYarnDeps {
-    yarnLock = src + "/yarn.lock";
-    sha256 = pinData.webYarnHash;
+    yarnLock = finalAttrs.src + "/yarn.lock";
+    sha256 = webYarnHash;
   };
 
   nativeBuildInputs = [ yarn fixup_yarn_lock jq nodejs ];
@@ -57,7 +57,7 @@ stdenv.mkDerivation rec {
   buildPhase = ''
     runHook preBuild
 
-    export VERSION=${version}
+    export VERSION=${finalAttrs.version}
     yarn build:res --offline
     yarn build:module_system --offline
     yarn build:bundle --offline
@@ -70,7 +70,7 @@ stdenv.mkDerivation rec {
 
     cp -R webapp $out
     cp ${jitsi-meet}/libs/external_api.min.js $out/jitsi_external_api.min.js
-    echo "${version}" > "$out/version"
+    echo "${finalAttrs.version}" > "$out/version"
     jq -s '.[0] * $conf' "config.sample.json" --argjson "conf" '${builtins.toJSON noPhoningHome}' > "$out/config.json"
 
     runHook postInstall
@@ -79,9 +79,9 @@ stdenv.mkDerivation rec {
   meta = {
     description = "A glossy Matrix collaboration client for the web";
     homepage = "https://element.io/";
-    changelog = "https://github.com/vector-im/element-web/blob/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/vector-im/element-web/blob/v${finalAttrs.version}/CHANGELOG.md";
     maintainers = lib.teams.matrix.members;
     license = lib.licenses.asl20;
     platforms = lib.platforms.all;
   };
-}
+})
diff --git a/pkgs/applications/networking/instant-messengers/element/pin.json b/pkgs/applications/networking/instant-messengers/element/pin.json
deleted file mode 100644
index 05cfe1d87b67..000000000000
--- a/pkgs/applications/networking/instant-messengers/element/pin.json
+++ /dev/null
@@ -1,7 +0,0 @@
-{
-  "version": "1.11.24",
-  "desktopSrcHash": "eAcJwoifIg0yCcYyeueVOL6CeGVMwmHpbr58MOUpK9I=",
-  "desktopYarnHash": "175ln40xp4djzc9wrx2vfg6did4rxy7nyxm6vs95pcbpv1i84g97",
-  "webSrcHash": "45xyfflTGA9LQxKi2WghYdDN0+R4ntjIPONnm+CJ5Dk=",
-  "webYarnHash": "1rwlx73chgq7x4zki9w4y3br8ypvk37vi6agqhk2dvq6y4znr93y"
-}
diff --git a/pkgs/applications/networking/instant-messengers/element/pin.nix b/pkgs/applications/networking/instant-messengers/element/pin.nix
new file mode 100644
index 000000000000..b1c29d0b6180
--- /dev/null
+++ b/pkgs/applications/networking/instant-messengers/element/pin.nix
@@ -0,0 +1,9 @@
+{
+  "version" = "1.11.24";
+  "hashes" = {
+    "desktopSrcHash" = "eAcJwoifIg0yCcYyeueVOL6CeGVMwmHpbr58MOUpK9I=";
+    "desktopYarnHash" = "175ln40xp4djzc9wrx2vfg6did4rxy7nyxm6vs95pcbpv1i84g97";
+    "webSrcHash" = "45xyfflTGA9LQxKi2WghYdDN0+R4ntjIPONnm+CJ5Dk=";
+    "webYarnHash" = "1rwlx73chgq7x4zki9w4y3br8ypvk37vi6agqhk2dvq6y4znr93y";
+  };
+}
diff --git a/pkgs/applications/networking/instant-messengers/element/update.sh b/pkgs/applications/networking/instant-messengers/element/update.sh
index 976b6cb0ba8f..50051d7b1a4f 100755
--- a/pkgs/applications/networking/instant-messengers/element/update.sh
+++ b/pkgs/applications/networking/instant-messengers/element/update.sh
@@ -42,12 +42,14 @@ wget "$desktop_src/yarn.lock"
 desktop_yarn_hash=$(prefetch-yarn-deps yarn.lock)
 popd
 
-cat > pin.json << EOF
+cat > pin.nix << EOF
 {
-  "version": "$version",
-  "desktopSrcHash": "$desktop_src_hash",
-  "desktopYarnHash": "$desktop_yarn_hash",
-  "webSrcHash": "$web_src_hash",
-  "webYarnHash": "$web_yarn_hash"
+  "version" = "$version";
+  "hashes" = {
+    "desktopSrcHash" = "$desktop_src_hash";
+    "desktopYarnHash" = "$desktop_yarn_hash";
+    "webSrcHash" = "$web_src_hash";
+    "webYarnHash" = "$web_yarn_hash";
+  };
 }
 EOF
diff --git a/pkgs/servers/http/gitlab-pages/default.nix b/pkgs/applications/version-management/gitlab/gitlab-pages/default.nix
similarity index 100%
rename from pkgs/servers/http/gitlab-pages/default.nix
rename to pkgs/applications/version-management/gitlab/gitlab-pages/default.nix
diff --git a/pkgs/applications/version-management/gitlab/update.py b/pkgs/applications/version-management/gitlab/update.py
index 266ca3e4cebd..1965ce78b7a0 100755
--- a/pkgs/applications/version-management/gitlab/update.py
+++ b/pkgs/applications/version-management/gitlab/update.py
@@ -177,6 +177,14 @@ def update_gitaly():
     _call_nix_update('gitaly', gitaly_server_version)
 
 
+@cli.command('update-gitlab-pages')
+def update_gitlab_pages():
+    """Update gitlab-shell"""
+    data = _get_data_json()
+    gitlab_pages_version = data['passthru']['GITLAB_PAGES_VERSION']
+    _call_nix_update('gitlab-pages', gitlab_pages_version)
+
+
 @cli.command('update-gitlab-shell')
 def update_gitlab_shell():
     """Update gitlab-shell"""
@@ -201,6 +209,7 @@ def update_all(ctx, rev: str):
     ctx.invoke(update_data, rev=rev)
     ctx.invoke(update_rubyenv)
     ctx.invoke(update_gitaly)
+    ctx.invoke(update_gitlab_pages)
     ctx.invoke(update_gitlab_shell)
     ctx.invoke(update_gitlab_workhorse)
 
diff --git a/pkgs/development/compilers/llvm/10/default.nix b/pkgs/development/compilers/llvm/10/default.nix
index 4d46863fea1a..75985e962479 100644
--- a/pkgs/development/compilers/llvm/10/default.nix
+++ b/pkgs/development/compilers/llvm/10/default.nix
@@ -32,7 +32,17 @@ let
   llvm_meta = {
     license     = lib.licenses.ncsa;
     maintainers = lib.teams.llvm.members;
-    platforms   = lib.platforms.all;
+
+    # See llvm/cmake/config-ix.cmake.
+    platforms   =
+      lib.platforms.aarch64 ++
+      lib.platforms.arm ++
+      lib.platforms.mips ++
+      lib.platforms.power ++
+      lib.platforms.riscv ++
+      lib.platforms.s390x ++
+      lib.platforms.wasi ++
+      lib.platforms.x86;
   };
 
   tools = lib.makeExtensible (tools: let
diff --git a/pkgs/development/compilers/llvm/11/default.nix b/pkgs/development/compilers/llvm/11/default.nix
index fdaba0ca2be4..6f73f50e3183 100644
--- a/pkgs/development/compilers/llvm/11/default.nix
+++ b/pkgs/development/compilers/llvm/11/default.nix
@@ -34,7 +34,17 @@ let
   llvm_meta = {
     license     = lib.licenses.ncsa;
     maintainers = lib.teams.llvm.members;
-    platforms   = lib.platforms.all;
+
+    # See llvm/cmake/config-ix.cmake.
+    platforms   =
+      lib.platforms.aarch64 ++
+      lib.platforms.arm ++
+      lib.platforms.mips ++
+      lib.platforms.power ++
+      lib.platforms.riscv ++
+      lib.platforms.s390x ++
+      lib.platforms.wasi ++
+      lib.platforms.x86;
   };
 
   tools = lib.makeExtensible (tools: let
diff --git a/pkgs/development/compilers/llvm/12/default.nix b/pkgs/development/compilers/llvm/12/default.nix
index 73f53350206b..b936b35b155a 100644
--- a/pkgs/development/compilers/llvm/12/default.nix
+++ b/pkgs/development/compilers/llvm/12/default.nix
@@ -35,7 +35,17 @@ let
   llvm_meta = {
     license     = lib.licenses.ncsa;
     maintainers = lib.teams.llvm.members;
-    platforms   = lib.platforms.all;
+
+    # See llvm/cmake/config-ix.cmake.
+    platforms   =
+      lib.platforms.aarch64 ++
+      lib.platforms.arm ++
+      lib.platforms.mips ++
+      lib.platforms.power ++
+      lib.platforms.riscv ++
+      lib.platforms.s390x ++
+      lib.platforms.wasi ++
+      lib.platforms.x86;
   };
 
   tools = lib.makeExtensible (tools: let
diff --git a/pkgs/development/compilers/llvm/13/default.nix b/pkgs/development/compilers/llvm/13/default.nix
index 29dda832e449..0bc17119125b 100644
--- a/pkgs/development/compilers/llvm/13/default.nix
+++ b/pkgs/development/compilers/llvm/13/default.nix
@@ -37,7 +37,17 @@ let
   llvm_meta = {
     license     = lib.licenses.ncsa;
     maintainers = lib.teams.llvm.members;
-    platforms   = lib.platforms.all;
+
+    # See llvm/cmake/config-ix.cmake.
+    platforms   =
+      lib.platforms.aarch64 ++
+      lib.platforms.arm ++
+      lib.platforms.mips ++
+      lib.platforms.power ++
+      lib.platforms.riscv ++
+      lib.platforms.s390x ++
+      lib.platforms.wasi ++
+      lib.platforms.x86;
   };
 
   tools = lib.makeExtensible (tools: let
diff --git a/pkgs/development/compilers/llvm/14/default.nix b/pkgs/development/compilers/llvm/14/default.nix
index 314a882db8ef..abf9c533faac 100644
--- a/pkgs/development/compilers/llvm/14/default.nix
+++ b/pkgs/development/compilers/llvm/14/default.nix
@@ -37,7 +37,18 @@ let
   llvm_meta = {
     license     = lib.licenses.ncsa;
     maintainers = lib.teams.llvm.members;
-    platforms   = lib.platforms.all;
+
+    # See llvm/cmake/config-ix.cmake.
+    platforms   =
+      lib.platforms.aarch64 ++
+      lib.platforms.arm ++
+      lib.platforms.m68k ++
+      lib.platforms.mips ++
+      lib.platforms.power ++
+      lib.platforms.riscv ++
+      lib.platforms.s390x ++
+      lib.platforms.wasi ++
+      lib.platforms.x86;
   };
 
   tools = lib.makeExtensible (tools: let
diff --git a/pkgs/development/compilers/llvm/15/default.nix b/pkgs/development/compilers/llvm/15/default.nix
index d12e705702bd..d4fd2d9bec6d 100644
--- a/pkgs/development/compilers/llvm/15/default.nix
+++ b/pkgs/development/compilers/llvm/15/default.nix
@@ -86,7 +86,18 @@ in let
   llvm_meta = {
     license     = lib.licenses.ncsa;
     maintainers = lib.teams.llvm.members;
-    platforms   = lib.platforms.all;
+
+    # See llvm/cmake/config-ix.cmake.
+    platforms   =
+      lib.platforms.aarch64 ++
+      lib.platforms.arm ++
+      lib.platforms.m68k ++
+      lib.platforms.mips ++
+      lib.platforms.power ++
+      lib.platforms.riscv ++
+      lib.platforms.s390x ++
+      lib.platforms.wasi ++
+      lib.platforms.x86;
   };
 
   tools = lib.makeExtensible (tools: let
diff --git a/pkgs/development/compilers/llvm/5/default.nix b/pkgs/development/compilers/llvm/5/default.nix
index d446608d3535..4a8c27471acc 100644
--- a/pkgs/development/compilers/llvm/5/default.nix
+++ b/pkgs/development/compilers/llvm/5/default.nix
@@ -20,7 +20,16 @@ let
   llvm_meta = {
     license     = lib.licenses.ncsa;
     maintainers = lib.teams.llvm.members;
-    platforms   = lib.platforms.all;
+
+    # See llvm/cmake/config-ix.cmake.
+    platforms   =
+      lib.platforms.aarch64 ++
+      lib.platforms.arm ++
+      lib.platforms.mips ++
+      lib.platforms.power ++
+      lib.platforms.s390x ++
+      lib.platforms.wasi ++
+      lib.platforms.x86;
   };
 
   tools = lib.makeExtensible (tools: let
diff --git a/pkgs/development/compilers/llvm/6/default.nix b/pkgs/development/compilers/llvm/6/default.nix
index e5b5094f05cc..fef543e39d82 100644
--- a/pkgs/development/compilers/llvm/6/default.nix
+++ b/pkgs/development/compilers/llvm/6/default.nix
@@ -20,7 +20,16 @@ let
   llvm_meta = {
     license     = lib.licenses.ncsa;
     maintainers = lib.teams.llvm.members;
-    platforms   = lib.platforms.all;
+
+    # See llvm/cmake/config-ix.cmake.
+    platforms   =
+      lib.platforms.aarch64 ++
+      lib.platforms.arm ++
+      lib.platforms.mips ++
+      lib.platforms.power ++
+      lib.platforms.s390x ++
+      lib.platforms.wasi ++
+      lib.platforms.x86;
   };
 
   tools = lib.makeExtensible (tools: let
diff --git a/pkgs/development/compilers/llvm/7/default.nix b/pkgs/development/compilers/llvm/7/default.nix
index 3fc0b359ad6c..9ae8358587b9 100644
--- a/pkgs/development/compilers/llvm/7/default.nix
+++ b/pkgs/development/compilers/llvm/7/default.nix
@@ -32,7 +32,17 @@ let
   llvm_meta = {
     license     = lib.licenses.ncsa;
     maintainers = lib.teams.llvm.members;
-    platforms   = lib.platforms.all;
+
+    # See llvm/cmake/config-ix.cmake.
+    platforms   =
+      lib.platforms.aarch64 ++
+      lib.platforms.arm ++
+      lib.platforms.mips ++
+      lib.platforms.power ++
+      lib.platforms.riscv ++
+      lib.platforms.s390x ++
+      lib.platforms.wasi ++
+      lib.platforms.x86;
   };
 
   tools = lib.makeExtensible (tools: let
diff --git a/pkgs/development/compilers/llvm/8/default.nix b/pkgs/development/compilers/llvm/8/default.nix
index d628eab46509..9401bb34650a 100644
--- a/pkgs/development/compilers/llvm/8/default.nix
+++ b/pkgs/development/compilers/llvm/8/default.nix
@@ -32,7 +32,17 @@ let
   llvm_meta = {
     license     = lib.licenses.ncsa;
     maintainers = lib.teams.llvm.members;
-    platforms   = lib.platforms.all;
+
+    # See llvm/cmake/config-ix.cmake.
+    platforms   =
+      lib.platforms.aarch64 ++
+      lib.platforms.arm ++
+      lib.platforms.mips ++
+      lib.platforms.power ++
+      lib.platforms.riscv ++
+      lib.platforms.s390x ++
+      lib.platforms.wasi ++
+      lib.platforms.x86;
   };
 
   tools = lib.makeExtensible (tools: let
diff --git a/pkgs/development/compilers/llvm/9/default.nix b/pkgs/development/compilers/llvm/9/default.nix
index 57187c5ecf1e..0a803e3c3dc1 100644
--- a/pkgs/development/compilers/llvm/9/default.nix
+++ b/pkgs/development/compilers/llvm/9/default.nix
@@ -32,7 +32,17 @@ let
   llvm_meta = {
     license     = lib.licenses.ncsa;
     maintainers = lib.teams.llvm.members;
-    platforms   = lib.platforms.all;
+
+    # See llvm/cmake/config-ix.cmake.
+    platforms   =
+      lib.platforms.aarch64 ++
+      lib.platforms.arm ++
+      lib.platforms.mips ++
+      lib.platforms.power ++
+      lib.platforms.riscv ++
+      lib.platforms.s390x ++
+      lib.platforms.wasi ++
+      lib.platforms.x86;
   };
 
   tools = lib.makeExtensible (tools: let
diff --git a/pkgs/development/compilers/llvm/git/default.nix b/pkgs/development/compilers/llvm/git/default.nix
index 79cf81f0816e..a5ffc6a64092 100644
--- a/pkgs/development/compilers/llvm/git/default.nix
+++ b/pkgs/development/compilers/llvm/git/default.nix
@@ -36,7 +36,18 @@ let
   llvm_meta = {
     license     = lib.licenses.ncsa;
     maintainers = lib.teams.llvm.members;
-    platforms   = lib.platforms.all;
+
+    # See llvm/cmake/config-ix.cmake.
+    platforms   =
+      lib.platforms.aarch64 ++
+      lib.platforms.arm ++
+      lib.platforms.m68k ++
+      lib.platforms.mips ++
+      lib.platforms.power ++
+      lib.platforms.riscv ++
+      lib.platforms.s390x ++
+      lib.platforms.wasi ++
+      lib.platforms.x86;
   };
 
   tools = lib.makeExtensible (tools: let
diff --git a/pkgs/development/compilers/ponyc/default.nix b/pkgs/development/compilers/ponyc/default.nix
index 9311c3112c82..67beaf6a0a36 100644
--- a/pkgs/development/compilers/ponyc/default.nix
+++ b/pkgs/development/compilers/ponyc/default.nix
@@ -1,24 +1,39 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, makeWrapper, pcre2, coreutils, which, openssl, libxml2, cmake, z3, substituteAll, python3,
-  cc ? stdenv.cc, lto ? !stdenv.isDarwin }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, callPackage
+, cc ? stdenv.cc
+, cmake
+, coreutils
+, libxml2
+, lto ? !stdenv.isDarwin
+, makeWrapper
+, openssl
+, pcre2
+, pony-corral
+, python3
+, substituteAll
+, which
+, z3
+}:
 
 stdenv.mkDerivation (rec {
   pname = "ponyc";
-  version = "0.50.0";
+  version = "0.54.0";
 
   src = fetchFromGitHub {
     owner = "ponylang";
     repo = pname;
     rev = version;
-    sha256 = "sha256-FnzlFTiJrqoUfnys+q9is6OH9yit5ExDiRszQ679QbY=";
-
+    hash = "sha256-qFPubqGfK0WCun6QA1OveyDJj7Wf6SQpky7pEb7qsf4=";
     fetchSubmodules = true;
   };
 
   ponygbenchmark = fetchFromGitHub {
     owner = "google";
     repo = "benchmark";
-    rev = "v1.5.4";
-    sha256 = "1dbjdjzkpbsq3jl9ksyg8mw759vkac8qzq1557m73ldnavbhz48x";
+    rev = "v1.7.1";
+    hash = "sha256-gg3g/0Ki29FnGqKv9lDTs5oA9NjH23qQ+hTdVtSU+zo=";
   };
 
   nativeBuildInputs = [ cmake makeWrapper which python3 ];
@@ -32,15 +47,11 @@ stdenv.mkDerivation (rec {
       googletest = fetchFromGitHub {
         owner = "google";
         repo = "googletest";
-        rev = "release-1.10.0";
-        sha256 = "1zbmab9295scgg4z2vclgfgjchfjailjnvzc6f5x9jvlsdi3dpwz";
+        # GoogleTest follows Abseil Live at Head philosophy, use latest commit from main branch as often as possible.
+        rev = "1a727c27aa36c602b24bf170a301aec8686b88e8"; # unstable-2023-03-07
+        hash = "sha256-/FWBSxZESwj/QvdNK5BI2EfonT64DP1eGBZR4O8uJww=";
       };
     })
-    (fetchpatch {
-      name = "remove-decnet-header.patch";
-      url = "https://github.com/ponylang/ponyc/commit/e5b9b5daec5b19415d519b09954cbd3cf5f34220.patch";
-      hash = "sha256-60cOhBBwQxWLwEx+svtFtJ7POQkHzJo2LDPRJ5L/bNk=";
-    })
   ];
 
   postUnpack = ''
@@ -52,9 +63,6 @@ stdenv.mkDerivation (rec {
   dontConfigure = true;
 
   postPatch = ''
-    # Patching Vendor LLVM
-    patchShebangs --host build/build_libs/gbenchmark-prefix/src/benchmark/tools/*.py
-    patch -d lib/llvm/src/ -p1 < lib/llvm/patches/2020-07-28-01-c-exports.diff
     substituteInPlace packages/process/_test.pony \
         --replace '"/bin/' '"${coreutils}/bin/' \
         --replace '=/bin' "${coreutils}/bin"
@@ -63,7 +71,6 @@ stdenv.mkDerivation (rec {
         --replace "/opt/local/lib" ""
   '';
 
-
   preBuild = ''
     make libs build_flags=-j$NIX_BUILD_CORES
     make configure build_flags=-j$NIX_BUILD_CORES
@@ -72,17 +79,14 @@ stdenv.mkDerivation (rec {
   makeFlags = [
     "PONYC_VERSION=${version}"
     "prefix=${placeholder "out"}"
-  ]
-    ++ lib.optionals stdenv.isDarwin [ "bits=64" ]
-    ++ lib.optionals (stdenv.isDarwin && (!lto)) [ "lto=no" ];
-
-  doCheck = true;
+  ] ++ lib.optionals stdenv.isDarwin ([ "bits=64" ] ++ lib.optional (!lto) "lto=no");
 
   env.NIX_CFLAGS_COMPILE = toString [ "-Wno-error=redundant-move" "-Wno-error=implicit-fallthrough" ];
 
+  doCheck = true;
+
   installPhase = "make config=release prefix=$out "
-    + lib.optionalString stdenv.isDarwin "bits=64 "
-    + lib.optionalString (stdenv.isDarwin && (!lto)) "lto=no "
+    + lib.optionalString stdenv.isDarwin ("bits=64 " + (lib.optionalString (!lto) "lto=no "))
     + '' install
     wrapProgram $out/bin/ponyc \
       --prefix PATH ":" "${stdenv.cc}/bin" \
@@ -93,11 +97,13 @@ stdenv.mkDerivation (rec {
   # Stripping breaks linking for ponyc
   dontStrip = true;
 
+  passthru.tests.pony-corral = pony-corral;
+
   meta = with lib; {
     description = "Pony is an Object-oriented, actor-model, capabilities-secure, high performance programming language";
     homepage = "https://www.ponylang.org";
     license = licenses.bsd2;
-    maintainers = with maintainers; [ kamilchm patternspandemic redvers ];
+    maintainers = with maintainers; [ kamilchm patternspandemic redvers superherointj ];
     platforms = [ "x86_64-linux" "x86_64-darwin" "aarch64-linux" ];
   };
 })
diff --git a/pkgs/development/compilers/ponyc/make-safe-for-sandbox.patch b/pkgs/development/compilers/ponyc/make-safe-for-sandbox.patch
index 1c6c404762ff..098b61c18867 100644
--- a/pkgs/development/compilers/ponyc/make-safe-for-sandbox.patch
+++ b/pkgs/development/compilers/ponyc/make-safe-for-sandbox.patch
@@ -1,18 +1,26 @@
+From e26ae067644ea780f050fb900bd850027bb86456 Mon Sep 17 00:00:00 2001
+From: superherointj <5861043+superherointj@users.noreply.github.com>
+Date: Tue, 7 Mar 2023 14:59:31 -0300
+Subject: [PATCH] make-safe-for-sandbox.patch
+
+---
+ lib/CMakeLists.txt | 80 ++--------------------------------------------
+ 1 file changed, 2 insertions(+), 78 deletions(-)
+
 diff --git a/lib/CMakeLists.txt b/lib/CMakeLists.txt
-index dab2aaef..26b587b1 100644
+index 129e26e6..d25bdf9d 100644
 --- a/lib/CMakeLists.txt
 +++ b/lib/CMakeLists.txt
-@@ -36,7 +36,7 @@ if(${CMAKE_SYSTEM_NAME} STREQUAL "FreeBSD")
- endif()
+@@ -32,14 +32,14 @@ endif()
  
+ set(PONYC_GBENCHMARK_URL https://github.com/google/benchmark/archive/v1.7.1.tar.gz)
  ExternalProject_Add(gbenchmark
 -    URL ${PONYC_GBENCHMARK_URL}
 +    SOURCE_DIR gbenchmark-prefix/src/benchmark
-     CMAKE_ARGS -DCMAKE_BUILD_TYPE=${PONYC_LIBS_BUILD_TYPE} -DCMAKE_INSTALL_PREFIX=${CMAKE_INSTALL_PREFIX} -DBENCHMARK_ENABLE_GTEST_TESTS=OFF -DCMAKE_CXX_FLAGS=${PONY_PIC_FLAG} --no-warn-unused-cli
+     CMAKE_ARGS -DCMAKE_BUILD_TYPE=${PONYC_LIBS_BUILD_TYPE} -DCMAKE_INSTALL_PREFIX=${CMAKE_INSTALL_PREFIX} -DBENCHMARK_ENABLE_GTEST_TESTS=OFF -DBENCHMARK_ENABLE_WERROR=OFF -DCMAKE_CXX_FLAGS=${PONY_PIC_FLAG} --no-warn-unused-cli
  )
  
-@@ -46,7 +46,7 @@ if(${CMAKE_SYSTEM_NAME} STREQUAL "FreeBSD")
- endif()
+ set(PONYC_GOOGLETEST_URL https://github.com/google/googletest/archive/release-1.12.1.tar.gz)
  
  ExternalProject_Add(googletest
 -    URL ${PONYC_GOOGLETEST_URL}
@@ -20,14 +28,14 @@ index dab2aaef..26b587b1 100644
      CMAKE_ARGS -DCMAKE_BUILD_TYPE=${PONYC_LIBS_BUILD_TYPE} -DCMAKE_INSTALL_PREFIX=${CMAKE_INSTALL_PREFIX} -DCMAKE_CXX_FLAGS=${PONY_PIC_FLAG} -Dgtest_force_shared_crt=ON --no-warn-unused-cli
  )
  
-@@ -59,82 +59,6 @@ install(TARGETS blake2
+@@ -52,82 +52,6 @@ install(TARGETS blake2
      COMPONENT library
  )
  
 -find_package(Git)
 -
--set(LLVM_DESIRED_HASH "75e33f71c2dae584b13a7d1186ae0a038ba98838")
--set(PATCHES_DESIRED_HASH "a16f299fbfced16a2bbc628746db341f2a5af9ae8cc9c9ef4b1e9ca26de3c292")
+-set(LLVM_DESIRED_HASH "1f9140064dfbfb0bbda8e51306ea51080b2f7aac")
+-set(PATCHES_DESIRED_HASH "3e16c097794cb669a8f6a0bd7600b440205ac5c29a6135750c2e83263eb16a95")
 -
 -if(GIT_FOUND)
 -    if(EXISTS "${PROJECT_SOURCE_DIR}/../.git")
@@ -102,4 +110,7 @@ index dab2aaef..26b587b1 100644
 -
  message("Building targets: ${LLVM_TARGETS_TO_BUILD}")
  
- set(LLVM_ENABLE_BINDINGS OFF)
+ set(LLVM_ENABLE_BINDINGS OFF CACHE BOOL "ponyc specific override of LLVM cache entry")
+-- 
+2.39.2
+
diff --git a/pkgs/development/compilers/ponyc/pony-corral.nix b/pkgs/development/compilers/ponyc/pony-corral.nix
index a39973733474..e47bfd376c99 100644
--- a/pkgs/development/compilers/ponyc/pony-corral.nix
+++ b/pkgs/development/compilers/ponyc/pony-corral.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation ( rec {
   pname = "corral";
-  version = "0.6.1";
+  version = "unstable-2023-02-11";
 
   src = fetchFromGitHub {
     owner = "ponylang";
     repo = pname;
-    rev = "refs/tags/${version}";
-    hash = "sha256-Rv1K6kFRylWodm1uACBs8KqqEqQZh86NqAG50heNteE=";
+    rev = "f31353a9ec9cd7eab6ee89079ae6a782192fd4b5";
+    hash = "sha256-jTx/7iFvmwOdjGVf/6NUy+FTkv6Mkv8DeotJ67pvmtc=";
   };
 
   buildInputs = [ ponyc ];
@@ -24,7 +24,7 @@ stdenv.mkDerivation ( rec {
     homepage = "https://www.ponylang.io";
     changelog = "https://github.com/ponylang/corral/blob/${version}/CHANGELOG.md";
     license = licenses.bsd2;
-    maintainers = with maintainers; [ redvers ];
+    maintainers = with maintainers; [ redvers superherointj ];
     platforms = [ "x86_64-linux" "x86_64-darwin" ];
   };
 })
diff --git a/pkgs/development/embedded/openocd/default.nix b/pkgs/development/embedded/openocd/default.nix
index dea8a56f38d4..4915b6df765b 100644
--- a/pkgs/development/embedded/openocd/default.nix
+++ b/pkgs/development/embedded/openocd/default.nix
@@ -3,9 +3,13 @@
 , fetchurl
 , pkg-config
 , hidapi
-, libftdi1
 , libusb1
 , libgpiod
+
+, enableFtdi ? true, libftdi1
+
+# Allow selection the hardware targets (SBCs, JTAG Programmers, JTAG Adapters)
+, extraHardwareSupport ? []
 }:
 
 stdenv.mkDerivation rec {
@@ -24,17 +28,14 @@ stdenv.mkDerivation rec {
   configureFlags = [
     "--disable-werror"
     "--enable-jtag_vpi"
-    "--enable-usb_blaster_libftdi"
-    (lib.enableFeature (! stdenv.isDarwin) "amtjtagaccel")
-    (lib.enableFeature (! stdenv.isDarwin) "gw16012")
-    "--enable-presto_libftdi"
-    "--enable-openjtag_ftdi"
-    (lib.enableFeature (! stdenv.isDarwin) "oocd_trace")
     "--enable-buspirate"
-    (lib.enableFeature stdenv.isLinux "sysfsgpio")
-    (lib.enableFeature stdenv.isLinux "linuxgpiod")
     "--enable-remote-bitbang"
-  ];
+    (lib.enableFeature enableFtdi "ftdi")
+    (lib.enableFeature stdenv.isLinux "linuxgpiod")
+    (lib.enableFeature stdenv.isLinux "sysfsgpio")
+  ] ++
+    map (hardware: "--enable-${hardware}") extraHardwareSupport
+  ;
 
   env.NIX_CFLAGS_COMPILE = toString (lib.optionals stdenv.cc.isGNU [
     "-Wno-error=cpp"
diff --git a/pkgs/development/libraries/bc-decaf/default.nix b/pkgs/development/libraries/bc-decaf/default.nix
index acfd0e85d4f4..c73f28e4e93a 100644
--- a/pkgs/development/libraries/bc-decaf/default.nix
+++ b/pkgs/development/libraries/bc-decaf/default.nix
@@ -7,7 +7,7 @@
 
 stdenv.mkDerivation rec {
   pname = "bc-decaf";
-  version = "linphone-4.4.1";
+  version = "unstable-2022-07-20";
 
   nativeBuildInputs = [ cmake ];
   buildInputs = [
@@ -19,8 +19,8 @@ stdenv.mkDerivation rec {
     group = "BC";
     owner = "public/external";
     repo = "decaf";
-    rev = "6e78a9beb24d1e3d7050dd52a65e4f88b101a1fc";
-    sha256 = "sha256-D2SzkinloL0Ya9p25YUsc+7lKvoTMUsdkKrkv/5AEeY=";
+    rev = "876ddb4d465c94f97beba1be450e8538d866cc5d";
+    sha256 = "sha256-QFOAgLiPbG2ZdwKoCOrVD5/sPq9IH4rtAWnnk/rZWcs=";
   };
 
   # Do not build static libraries and do not enable -Werror
diff --git a/pkgs/development/libraries/libmbim/default.nix b/pkgs/development/libraries/libmbim/default.nix
index f9f15b683946..55bfc17239e2 100644
--- a/pkgs/development/libraries/libmbim/default.nix
+++ b/pkgs/development/libraries/libmbim/default.nix
@@ -9,7 +9,8 @@
 , help2man
 , systemd
 , bash-completion
-, withIntrospection ? stdenv.hostPlatform == stdenv.buildPlatform
+, buildPackages
+, withIntrospection ? stdenv.hostPlatform.emulatorAvailable buildPackages
 , gobject-introspection
 }:
 
diff --git a/pkgs/development/libraries/libnotify/default.nix b/pkgs/development/libraries/libnotify/default.nix
index e047b34fa85a..1238b91920a9 100644
--- a/pkgs/development/libraries/libnotify/default.nix
+++ b/pkgs/development/libraries/libnotify/default.nix
@@ -8,7 +8,8 @@
 , glib
 , gdk-pixbuf
 , gnome
-, withIntrospection ? (stdenv.buildPlatform == stdenv.hostPlatform)
+, buildPackages
+, withIntrospection ? stdenv.hostPlatform.emulatorAvailable buildPackages
 , gobject-introspection
 }:
 
diff --git a/pkgs/development/libraries/libvirt-glib/default.nix b/pkgs/development/libraries/libvirt-glib/default.nix
index ccf41038cca6..f1a9fbe9b2c2 100644
--- a/pkgs/development/libraries/libvirt-glib/default.nix
+++ b/pkgs/development/libraries/libvirt-glib/default.nix
@@ -10,7 +10,8 @@
 , libcap_ng
 , libvirt
 , libxml2
-, withIntrospection ? stdenv.hostPlatform == stdenv.buildPlatform
+, buildPackages
+, withIntrospection ? stdenv.hostPlatform.emulatorAvailable buildPackages
 , gobject-introspection
 , withDocs ? stdenv.hostPlatform == stdenv.buildPlatform
 , gtk-doc
diff --git a/pkgs/development/libraries/physics/hepmc3/default.nix b/pkgs/development/libraries/physics/hepmc3/default.nix
index 027100379bc9..3379e3d04d29 100644
--- a/pkgs/development/libraries/physics/hepmc3/default.nix
+++ b/pkgs/development/libraries/physics/hepmc3/default.nix
@@ -25,7 +25,8 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     cmake
-  ];
+  ]
+  ++ lib.optional withPython python.pkgs.pythonImportsCheckHook;
 
   buildInputs = [
     root_py
@@ -50,11 +51,7 @@ stdenv.mkDerivation rec {
       --replace 'readlink' '${coreutils}/bin/readlink'
   '';
 
-  doInstallCheck = withPython;
-  # prevent nix from trying to dereference a null python
-  installCheckPhase = lib.optionalString withPython ''
-    PYTHONPATH=${placeholder "out"}/${python.sitePackages} python -c 'import pyHepMC3'
-  '';
+  pythonImportsCheck = [ "pyHepMC3" ];
 
   meta = with lib; {
     description = "The HepMC package is an object oriented, C++ event record for High Energy Physics Monte Carlo generators and simulation";
diff --git a/pkgs/development/libraries/qt-5/modules/qtbase.nix b/pkgs/development/libraries/qt-5/modules/qtbase.nix
index ef1192e6b106..d74bf46dd6c8 100644
--- a/pkgs/development/libraries/qt-5/modules/qtbase.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtbase.nix
@@ -13,12 +13,15 @@
 , xcbutilimage, xcbutilkeysyms, xcbutilrenderutil, xcbutilwm , zlib, at-spi2-core
 
   # optional dependencies
-, cups ? null, libmysqlclient ? null, postgresql ? null
+, cups ? null, postgresql ? null
 , withGtk3 ? false, dconf, gtk3
 
   # options
 , libGLSupported ? !stdenv.isDarwin
 , libGL
+  # qmake detection for libmysqlclient does not seem to work when cross compiling
+, mysqlSupport ? stdenv.hostPlatform == stdenv.buildPlatform
+, libmysqlclient
 , buildExamples ? false
 , buildTests ? false
 , debug ? false
@@ -73,7 +76,7 @@ stdenv.mkDerivation (finalAttrs: {
     )
     ++ lib.optional developerBuild gdb
     ++ lib.optional (cups != null) cups
-    ++ lib.optional (libmysqlclient != null) libmysqlclient
+    ++ lib.optional (mysqlSupport) libmysqlclient
     ++ lib.optional (postgresql != null) postgresql;
 
   nativeBuildInputs = [ bison flex gperf lndir perl pkg-config which ]
@@ -258,7 +261,7 @@ stdenv.mkDerivation (finalAttrs: {
     "-L" "${lib.getLib openssl}/lib"
     "-I" "${openssl.dev}/include"
     "-system-sqlite"
-    ''-${if libmysqlclient != null then "plugin" else "no"}-sql-mysql''
+    ''-${if mysqlSupport then "plugin" else "no"}-sql-mysql''
     ''-${if postgresql != null then "plugin" else "no"}-sql-psql''
 
     "-make libs"
@@ -297,7 +300,7 @@ stdenv.mkDerivation (finalAttrs: {
     ] ++ lib.optionals (cups != null) [
       "-L" "${cups.lib}/lib"
       "-I" "${cups.dev}/include"
-    ] ++ lib.optionals (libmysqlclient != null) [
+    ] ++ lib.optionals (mysqlSupport) [
       "-L" "${libmysqlclient}/lib"
       "-I" "${libmysqlclient}/include"
     ]
diff --git a/pkgs/development/ocaml-modules/chacha/default.nix b/pkgs/development/ocaml-modules/chacha/default.nix
index ebd73b519f95..28aaad1c46d8 100644
--- a/pkgs/development/ocaml-modules/chacha/default.nix
+++ b/pkgs/development/ocaml-modules/chacha/default.nix
@@ -17,7 +17,7 @@ buildDunePackage rec {
     owner = "abeaumont";
     repo = "ocaml-chacha";
     rev = version;
-    sha256 = "sha256-PmeiFloU0k3SqOK1VjaliiCEzDzrzyMSasgnO5fJS1k=";
+    hash = "sha256-PmeiFloU0k3SqOK1VjaliiCEzDzrzyMSasgnO5fJS1k=";
   };
 
   # Ensure compatibility with cstruct ≥ 6.1.0
@@ -27,6 +27,7 @@ buildDunePackage rec {
   })];
 
   minimalOCamlVersion = "4.02";
+  duneVersion = "3";
 
   propagatedBuildInputs = [ cstruct mirage-crypto ];
 
diff --git a/pkgs/development/ocaml-modules/http-mirage-client/default.nix b/pkgs/development/ocaml-modules/http-mirage-client/default.nix
new file mode 100644
index 000000000000..08b3758d53ed
--- /dev/null
+++ b/pkgs/development/ocaml-modules/http-mirage-client/default.nix
@@ -0,0 +1,63 @@
+{ lib
+, fetchurl
+, fetchpatch
+, buildDunePackage
+, h2
+, httpaf
+, mimic-happy-eyeballs
+, mirage-clock
+, paf
+, tcpip
+, x509
+, alcotest-lwt
+, mirage-clock-unix
+, mirage-crypto-rng
+, mirage-time-unix
+}:
+
+buildDunePackage rec {
+  pname = "http-mirage-client";
+  version = "0.0.2";
+
+  duneVersion = "3";
+  minimalOCamlVersion = "4.08";
+
+  src = fetchurl {
+    url = "https://github.com/roburio/http-mirage-client/releases/download/v${version}/http-mirage-client-${version}.tbz";
+    hash = "sha256-stom13t3Kn1ehkeURem39mxhd3Lmlz8z9m3tHGcp5vY=";
+  };
+
+  # Make tests use mirage-crypto
+  patches = lib.lists.map fetchpatch [
+    { url = "https://github.com/roburio/http-mirage-client/commit/c6cd38db9c23ac23e7c3e4cf2d41420f58034e8d.patch";
+      hash = "sha256-b3rurqF0DxLpVQEhVfROwc7qyul0Fjfl3zhD8AkzemU="; }
+    { url = "https://github.com/roburio/http-mirage-client/commit/0a5367e7c6d9b7f45c88493f7a596f7a83e8c7d5.patch";
+      hash = "sha256-Q6YlfuiAfsyhty9EvoBetvekuU25KjrH5wwGwYTAAiA="; }
+    ];
+
+  propagatedBuildInputs = [
+    h2
+    httpaf
+    mimic-happy-eyeballs
+    mirage-clock
+    paf
+    tcpip
+    x509
+  ];
+
+  doCheck = true;
+  checkInputs = [
+    alcotest-lwt
+    mirage-clock-unix
+    mirage-crypto-rng
+    mirage-time-unix
+  ];
+
+  meta = {
+    description = "HTTP client for MirageOS";
+    homepage = "https://github.com/roburio/http-mirage-client";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.vbgl ];
+  };
+
+}
diff --git a/pkgs/development/ocaml-modules/letsencrypt/mirage.nix b/pkgs/development/ocaml-modules/letsencrypt/mirage.nix
new file mode 100644
index 000000000000..f43ab9812c7e
--- /dev/null
+++ b/pkgs/development/ocaml-modules/letsencrypt/mirage.nix
@@ -0,0 +1,20 @@
+{ buildDunePackage
+, letsencrypt
+, emile
+, http-mirage-client
+, paf
+}:
+
+buildDunePackage {
+  pname = "letsencrypt-mirage";
+
+  inherit (letsencrypt) version src;
+
+  duneVersion = "3";
+
+  propagatedBuildInputs = [ emile http-mirage-client letsencrypt paf ];
+
+  meta = letsencrypt.meta // {
+    description = "ACME implementation in OCaml for MirageOS";
+  };
+}
diff --git a/pkgs/development/ocaml-modules/mirage-crypto/default.nix b/pkgs/development/ocaml-modules/mirage-crypto/default.nix
index 816709b4cc78..73d0c4fee7cd 100644
--- a/pkgs/development/ocaml-modules/mirage-crypto/default.nix
+++ b/pkgs/development/ocaml-modules/mirage-crypto/default.nix
@@ -5,6 +5,7 @@
 
 buildDunePackage rec {
   minimalOCamlVersion = "4.08";
+  duneVersion = "3";
 
   pname = "mirage-crypto";
   version = "0.11.0";
diff --git a/pkgs/development/ocaml-modules/mirage-crypto/ec.nix b/pkgs/development/ocaml-modules/mirage-crypto/ec.nix
index 3afe582413f5..b17182a5efda 100644
--- a/pkgs/development/ocaml-modules/mirage-crypto/ec.nix
+++ b/pkgs/development/ocaml-modules/mirage-crypto/ec.nix
@@ -24,6 +24,8 @@ buildDunePackage rec {
     src
     version;
 
+  duneVersion = "3";
+
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [
     dune-configurator
diff --git a/pkgs/development/ocaml-modules/mirage-crypto/pk.nix b/pkgs/development/ocaml-modules/mirage-crypto/pk.nix
index b79f49c64bd4..e50838e50bbb 100644
--- a/pkgs/development/ocaml-modules/mirage-crypto/pk.nix
+++ b/pkgs/development/ocaml-modules/mirage-crypto/pk.nix
@@ -6,6 +6,8 @@ buildDunePackage rec {
 
   inherit (mirage-crypto) version src;
 
+  duneVersion = "3";
+
   buildInputs = [ gmp ];
   propagatedBuildInputs = [ cstruct mirage-crypto mirage-crypto-rng
                             zarith eqaf sexplib0 ];
diff --git a/pkgs/development/ocaml-modules/mirage-crypto/rng-async.nix b/pkgs/development/ocaml-modules/mirage-crypto/rng-async.nix
index 5752507f9ef9..b9979b446d20 100644
--- a/pkgs/development/ocaml-modules/mirage-crypto/rng-async.nix
+++ b/pkgs/development/ocaml-modules/mirage-crypto/rng-async.nix
@@ -8,6 +8,8 @@ buildDunePackage {
 
   inherit (mirage-crypto) version src;
 
+  duneVersion = "3";
+
   buildInputs = [
     dune-configurator
   ];
diff --git a/pkgs/development/ocaml-modules/mirage-crypto/rng-lwt.nix b/pkgs/development/ocaml-modules/mirage-crypto/rng-lwt.nix
index f6ec2a9e3dae..bcaac601c95c 100644
--- a/pkgs/development/ocaml-modules/mirage-crypto/rng-lwt.nix
+++ b/pkgs/development/ocaml-modules/mirage-crypto/rng-lwt.nix
@@ -1,15 +1,17 @@
 { buildDunePackage, mirage-crypto, mirage-crypto-rng, dune-configurator
-, duration, logs, mtime, ocaml_lwt }:
+, duration, logs, mtime, lwt }:
 
 buildDunePackage rec {
   pname = "mirage-crypto-rng-lwt";
 
   inherit (mirage-crypto) version src;
 
+  duneVersion = "3";
+
   doCheck = true;
 
   buildInputs = [ dune-configurator ];
-  propagatedBuildInputs = [ mirage-crypto mirage-crypto-rng duration logs mtime ocaml_lwt ];
+  propagatedBuildInputs = [ mirage-crypto mirage-crypto-rng duration logs mtime lwt ];
 
   meta = mirage-crypto-rng.meta;
 }
diff --git a/pkgs/development/ocaml-modules/mirage-crypto/rng-mirage.nix b/pkgs/development/ocaml-modules/mirage-crypto/rng-mirage.nix
index c3703a5a60ab..3e0cde29c52d 100644
--- a/pkgs/development/ocaml-modules/mirage-crypto/rng-mirage.nix
+++ b/pkgs/development/ocaml-modules/mirage-crypto/rng-mirage.nix
@@ -7,6 +7,7 @@ buildDunePackage rec {
   pname = "mirage-crypto-rng-mirage";
 
   inherit (mirage-crypto-rng) version src;
+  duneVersion = "3";
 
   doCheck = true;
   checkInputs = [ mirage-unix mirage-clock-unix mirage-time-unix ];
diff --git a/pkgs/development/ocaml-modules/mirage-crypto/rng.nix b/pkgs/development/ocaml-modules/mirage-crypto/rng.nix
index 97de946bc2cc..bbc7823e1f09 100644
--- a/pkgs/development/ocaml-modules/mirage-crypto/rng.nix
+++ b/pkgs/development/ocaml-modules/mirage-crypto/rng.nix
@@ -5,6 +5,7 @@ buildDunePackage rec {
   pname = "mirage-crypto-rng";
 
   inherit (mirage-crypto) version src;
+  duneVersion = "3";
 
   doCheck = true;
   checkInputs = [ ounit2 randomconv ];
diff --git a/pkgs/development/python-modules/adafruit-platformdetect/default.nix b/pkgs/development/python-modules/adafruit-platformdetect/default.nix
index 147e5805b806..20853b133955 100644
--- a/pkgs/development/python-modules/adafruit-platformdetect/default.nix
+++ b/pkgs/development/python-modules/adafruit-platformdetect/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "adafruit-platformdetect";
-  version = "3.40.3";
+  version = "3.41.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -15,7 +15,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "Adafruit-PlatformDetect";
     inherit version;
-    hash = "sha256-phG9DEl4JlrIN3zil0SQRZ+DnktpunK094nxVQ9Cksw=";
+    hash = "sha256-NWdY1ykuF8mYxXPCwaVq6mEkQXHrUmhEy/BXDFYn2V0=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
diff --git a/pkgs/development/python-modules/gcovr/default.nix b/pkgs/development/python-modules/gcovr/default.nix
index 2661ae1503fd..81fe8ae04295 100644
--- a/pkgs/development/python-modules/gcovr/default.nix
+++ b/pkgs/development/python-modules/gcovr/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "gcovr";
-  version = "5.2";
+  version = "6.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-IXGVCF7JQ0YpGoe3sebZz97u5WKz4PmjKyXJUws7zo8=";
+    hash = "sha256-hjjV9E3vEOOOMWbIozvvZkPsIEaH4Kx9NFzkGpjFdQs=";
   };
 
   propagatedBuildInputs = [
@@ -39,6 +39,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python script for summarizing gcov data";
     homepage = "https://www.gcovr.com/";
+    changelog = "https://github.com/gcovr/gcovr/blob/${version}/CHANGELOG.rst";
     license = licenses.bsd0;
     maintainers = with maintainers; [ ];
   };
diff --git a/pkgs/development/python-modules/mpv/default.nix b/pkgs/development/python-modules/mpv/default.nix
index 681b2618325e..c79842de3db9 100644
--- a/pkgs/development/python-modules/mpv/default.nix
+++ b/pkgs/development/python-modules/mpv/default.nix
@@ -23,7 +23,8 @@ buildPythonPackage rec {
   '';
 
   # tests impure, will error if it can't load libmpv.so
-  checkPhase = "${python.interpreter} -c 'import mpv'";
+  doCheck = false;
+  pythonImportsCheck = [ "mpv" ];
 
   meta = with lib; {
     description = "A python interface to the mpv media player";
diff --git a/pkgs/development/python-modules/r2pipe/default.nix b/pkgs/development/python-modules/r2pipe/default.nix
index 52b453a0f0d8..ad258fc123ef 100644
--- a/pkgs/development/python-modules/r2pipe/default.nix
+++ b/pkgs/development/python-modules/r2pipe/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "r2pipe";
-  version = "1.7.4";
+  version = "1.8.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -31,7 +31,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-bmr9/iqlp5GghY6DOpFhBH3k69ErqR3DHx7iAu3m6f0=";
+    hash = "sha256-T1w4QG0KBPBekETd+nMNbvPF2mgBZgQ/jhWcP9694mg=";
   };
 
   # Tiny sanity check to make sure r2pipe finds radare2 (since r2pipe doesn't
diff --git a/pkgs/development/python-modules/sip/4.x.nix b/pkgs/development/python-modules/sip/4.x.nix
index 111cd66ed22f..d90d4ff20416 100644
--- a/pkgs/development/python-modules/sip/4.x.nix
+++ b/pkgs/development/python-modules/sip/4.x.nix
@@ -21,16 +21,7 @@ buildPythonPackage rec {
 
   enableParallelBuilding = true;
 
-  installCheckPhase = let
-    modules = [
-      sip-module
-      "sipconfig"
-    ];
-    imports = lib.concatMapStrings (module: "import ${module};") modules;
-  in ''
-    echo "Checking whether modules can be imported..."
-    PYTHONPATH=$out/${python.sitePackages}:$PYTHONPATH ${python.interpreter} -c "${imports}"
-  '';
+  pythonImportsCheck = [ sip-module "sipconfig" ];
 
   doCheck = true;
 
diff --git a/pkgs/development/tools/codespell/default.nix b/pkgs/development/tools/codespell/default.nix
index 8315aa20aa19..b0497015810c 100644
--- a/pkgs/development/tools/codespell/default.nix
+++ b/pkgs/development/tools/codespell/default.nix
@@ -6,18 +6,18 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "codespell";
-  version = "2.2.2";
+  version = "2.2.4";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "codespell-project";
     repo = "codespell";
     rev = "v${version}";
-    sha256 = "sha256-zXHqaZzGIS7BOFc/kPzA4sgpoEmXuaKHdOcKpMWWeOI=";
+    sha256 = "sha256-hyTy6zAH5WrW5Jn/g0irH9xGZErnXJMSUYZaNxMvq2Y=";
   };
 
   postPatch = ''
-    substituteInPlace setup.cfg \
+    substituteInPlace pyproject.toml \
       --replace "--cov=codespell_lib" "" \
       --replace "--cov-report=" ""
   '';
diff --git a/pkgs/development/tools/language-servers/vala-language-server/default.nix b/pkgs/development/tools/language-servers/vala-language-server/default.nix
index 6c7ebabe6332..71fa107afc56 100644
--- a/pkgs/development/tools/language-servers/vala-language-server/default.nix
+++ b/pkgs/development/tools/language-servers/vala-language-server/default.nix
@@ -44,6 +44,7 @@ stdenv.mkDerivation rec {
     ninja
     pkg-config
     scdoc
+  ] ++ lib.optionals stdenv.isLinux [
     # GNOME Builder Plugin
     gnome-builder
   ];
@@ -61,6 +62,6 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/vala-lang/vala-language-server";
     license = licenses.lgpl21Plus;
     maintainers = with maintainers; [ andreasfelix ];
-    platforms = platforms.linux;
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/tools/ocaml/opam/1.2.2.nix b/pkgs/development/tools/ocaml/opam/1.2.2.nix
deleted file mode 100644
index 23a73002e6fe..000000000000
--- a/pkgs/development/tools/ocaml/opam/1.2.2.nix
+++ /dev/null
@@ -1,95 +0,0 @@
-{ stdenv, lib, fetchurl, makeWrapper,
-  ocaml, unzip, ncurses, curl, aspcud
-}:
-
-assert lib.versionAtLeast ocaml.version "3.12.1";
-
-let
-  srcs = {
-    cudf = fetchurl {
-      url = "https://gforge.inria.fr/frs/download.php/file/33593/cudf-0.7.tar.gz";
-      sha256 = "92c8a9ed730bbac73f3513abab41127d966c9b9202ab2aaffcd02358c030a701";
-    };
-    extlib = fetchurl {
-      url = "http://ocaml-extlib.googlecode.com/files/extlib-1.5.3.tar.gz";
-      sha256 = "c095eef4202a8614ff1474d4c08c50c32d6ca82d1015387785cf03d5913ec021";
-    };
-    ocaml_re = fetchurl {
-      url = "https://github.com/ocaml/ocaml-re/archive/ocaml-re-1.2.0.tar.gz";
-      sha256 = "a34dd9d6136731436a963bbab5c4bbb16e5d4e21b3b851d34887a3dec451999f";
-    };
-    ocamlgraph = fetchurl {
-      url = "http://ocamlgraph.lri.fr/download/ocamlgraph-1.8.5.tar.gz";
-      sha256 = "d167466435a155c779d5ec25b2db83ad851feb42ebc37dca8ffa345ddaefb82f";
-    };
-    dose3 = fetchurl {
-      url = "https://gforge.inria.fr/frs/download.php/file/34277/dose3-3.3.tar.gz";
-      sha256 = "8dc4dae9b1a81bb3a42abb283df785ba3eb00ade29b13875821c69f03e00680e";
-    };
-    cmdliner = fetchurl {
-      url = "https://erratique.ch/software/cmdliner/releases/cmdliner-0.9.7.tbz";
-      sha256 = "9c19893cffb5d3c3469ee0cce85e3eeeba17d309b33b9ace31aba06f68f0bf7a";
-    };
-    uutf = fetchurl {
-      url = "https://erratique.ch/software/uutf/releases/uutf-0.9.3.tbz";
-      sha256 = "1f364f89b1179e5182a4d3ad8975f57389d45548735d19054845e06a27107877";
-    };
-    jsonm = fetchurl {
-      url = "https://erratique.ch/software/jsonm/releases/jsonm-0.9.1.tbz";
-      sha256 = "3fd4dca045d82332da847e65e981d8b504883571d299a3f7e71447d46bc65f73";
-    };
-    opam = fetchurl {
-      url = "https://github.com/ocaml/opam/archive/1.2.2.zip";
-      sha256 = "c590ce55ae69ec74f46215cf16a156a02b23c5f3ecb22f23a3ad9ba3d91ddb6e";
-    };
-  };
-in stdenv.mkDerivation {
-  pname = "opam";
-  version = "1.2.2";
-
-  strictDeps = true;
-
-  nativeBuildInputs = [ makeWrapper unzip curl ocaml ];
-  buildInputs = [ ncurses ];
-
-  src = srcs.opam;
-
-  postUnpack = ''
-    ln -sv ${srcs.cudf} $sourceRoot/src_ext/${srcs.cudf.name}
-    ln -sv ${srcs.extlib} $sourceRoot/src_ext/${srcs.extlib.name}
-    ln -sv ${srcs.ocaml_re} $sourceRoot/src_ext/${srcs.ocaml_re.name}
-    ln -sv ${srcs.ocamlgraph} $sourceRoot/src_ext/${srcs.ocamlgraph.name}
-    ln -sv ${srcs.dose3} $sourceRoot/src_ext/${srcs.dose3.name}
-    ln -sv ${srcs.cmdliner} $sourceRoot/src_ext/${srcs.cmdliner.name}
-    ln -sv ${srcs.uutf} $sourceRoot/src_ext/${srcs.uutf.name}
-    ln -sv ${srcs.jsonm} $sourceRoot/src_ext/${srcs.jsonm.name}
-  '';
-
-  preConfigure = ''
-    substituteInPlace ./src_ext/Makefile --replace "%.stamp: %.download" "%.stamp:"
-  '';
-
-  postConfigure = "make lib-ext";
-
-  # Dirty, but apparently ocp-build requires a TERM
-  makeFlags = ["TERM=screen"];
-
-  # change argv0 to "opam" as a workaround for
-  # https://github.com/ocaml/opam/issues/2142
-  postInstall = ''
-    mv $out/bin/opam $out/bin/.opam-wrapped
-    makeWrapper $out/bin/.opam-wrapped $out/bin/opam \
-      --argv0 "opam" \
-      --suffix PATH : ${aspcud}/bin:${unzip}/bin:${curl}/bin
-  '';
-
-  doCheck = false;
-
-  meta = with lib; {
-    description = "A package manager for OCaml";
-    homepage = "http://opam.ocamlpro.com/";
-    maintainers = [ maintainers.henrytill ];
-    platforms = platforms.all;
-    license = licenses.lgpl21Plus;
-  };
-}
diff --git a/pkgs/os-specific/linux/intel-compute-runtime/default.nix b/pkgs/os-specific/linux/intel-compute-runtime/default.nix
index 3380eeb88166..22cb2aba5a59 100644
--- a/pkgs/os-specific/linux/intel-compute-runtime/default.nix
+++ b/pkgs/os-specific/linux/intel-compute-runtime/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , patchelf
 , cmake
 , pkg-config
@@ -13,24 +12,15 @@
 
 stdenv.mkDerivation rec {
   pname = "intel-compute-runtime";
-  version = "22.49.25018.24";
+  version = "23.05.25593.11";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "compute-runtime";
     rev = version;
-    sha256 = "sha256-/onHHIG5jWFObC8pSjpFMadjwaAN6vMNjAsj8/D3qNw=";
+    sha256 = "sha256-AsJGcyVqRGz7OBWTlQeTS412iUzMAbIsA4w6CmEf1G8=";
   };
 
-  patches = [
-    # fix compile with level-zero 1.9.4
-    (fetchpatch {
-      url = "https://github.com/intel/compute-runtime/commit/dce17d319f91b39806b2cd39b6eecd5c5cff2a68.patch";
-      excludes = [ "manifests/manifest.yml" ];
-      sha256 = "sha256-YGzS4LeNO8FO1GXowD2gARj0TL6tBFaeZJNLZOwSsWQ=";
-    })
-  ];
-
   nativeBuildInputs = [ cmake pkg-config ];
 
   buildInputs = [ intel-gmmlib intel-graphics-compiler libva level-zero ];
diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json
index 9cfcfdfe661f..d017d1e1d8e9 100644
--- a/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened/patches.json
@@ -12,51 +12,51 @@
     "4.19": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-4.19.274-hardened1.patch",
-            "sha256": "0hc2ci4jy2jhjmmqmmv6i2g6lj997d8hwgrh68qrraifzd3rjm23",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.274-hardened1/linux-hardened-4.19.274-hardened1.patch"
+            "name": "linux-hardened-4.19.275-hardened1.patch",
+            "sha256": "0ni0ig82zbmfngcm1la2frcihxjaaf0y1ki0vv6gqzxpsp5xz0nq",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.275-hardened1/linux-hardened-4.19.275-hardened1.patch"
         },
-        "sha256": "1a2w6knszfqg7ilnvxrs0kbgcviq90iqw9wp2d6y3qy9jfhnb8k4",
-        "version": "4.19.274"
+        "sha256": "02l6f5y1cbjc9997lmcak5j8dllkzr8q47nqscqsyvz2c2hnzsdg",
+        "version": "4.19.275"
     },
     "5.10": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.10.170-hardened1.patch",
-            "sha256": "0fr0rzxrpmcddzamdnc15ywpd396dl8j7ycy19a789vhfz3132bz",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.170-hardened1/linux-hardened-5.10.170-hardened1.patch"
+            "name": "linux-hardened-5.10.172-hardened1.patch",
+            "sha256": "1ik2l453bgqcpqrhdf4gy6qdlvqknz9i7s9s9pynvk4lpvva34zc",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.172-hardened1/linux-hardened-5.10.172-hardened1.patch"
         },
-        "sha256": "0pw2jnsnq2yxxvl4dkx6f7a8gczj8l484qpd4ibw737vprv1idd2",
-        "version": "5.10.170"
+        "sha256": "1c9757gma0dksd1ch8pljbsmf586bq66gxqpsv53676z8kivl3gj",
+        "version": "5.10.172"
     },
     "5.15": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.15.96-hardened1.patch",
-            "sha256": "032311r4phsp8cb4vzgdh3gsm4l5494138x1jfwfxhzkgmp4g4yh",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.96-hardened1/linux-hardened-5.15.96-hardened1.patch"
+            "name": "linux-hardened-5.15.98-hardened1.patch",
+            "sha256": "1d1jfx0m59j4b7kk476x11af5h5hy8f5n4d6h419qylnibm22573",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.98-hardened1/linux-hardened-5.15.98-hardened1.patch"
         },
-        "sha256": "167g34xjbqxr5klqp127j2j15pms4jmgs0y7gr8zipiz2i69g39l",
-        "version": "5.15.96"
+        "sha256": "11vpngxqih2f3sn9v1h8ccjywsj0m5p8i98n0fvck5azlk9jrikx",
+        "version": "5.15.98"
     },
     "5.4": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.4.233-hardened1.patch",
-            "sha256": "11df6i0v7xsp363hdqfdixadn5db41ig51pd5fhknpdh1yrpx9by",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.233-hardened1/linux-hardened-5.4.233-hardened1.patch"
+            "name": "linux-hardened-5.4.234-hardened1.patch",
+            "sha256": "06jc2060v259wblbl38dcsk5vi61lbf4y8aipppy5lqd25rpm12y",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.234-hardened1/linux-hardened-5.4.234-hardened1.patch"
         },
-        "sha256": "09vnp4qcv7kwahbbvjznnv7pxq1cvbn11n0rn5rzx97jnia5f7js",
-        "version": "5.4.233"
+        "sha256": "1489jnp4vb8p879hq1nx3xgyzjdwj1zalk3x4vcbnc9f7yrrrixc",
+        "version": "5.4.234"
     },
     "6.1": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-6.1.14-hardened1.patch",
-            "sha256": "1r76nhg11sv654hg90gf6s9bmwdbmc88jh7wbpb9cyj63dw8dliv",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.1.14-hardened1/linux-hardened-6.1.14-hardened1.patch"
+            "name": "linux-hardened-6.1.15-hardened1.patch",
+            "sha256": "14svc378i43jv9cbv97gibmmr8pwf39dcjvjaqlbwfmhiwikj975",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.1.15-hardened1/linux-hardened-6.1.15-hardened1.patch"
         },
-        "sha256": "03c1pszgm0qwwz7l5fnmbr6ank632bsl81pdx48svizy3q0pcw52",
-        "version": "6.1.14"
+        "sha256": "1zf48h34cz4chv0n12xlif0n7fdzbri2v8am1nn68bla2vidy5ic",
+        "version": "6.1.15"
     }
 }
diff --git a/pkgs/os-specific/linux/kernel/linux-5.15.nix b/pkgs/os-specific/linux/kernel/linux-5.15.nix
index da3082824719..482881facd59 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.15.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.15.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.15.97";
+  version = "5.15.99";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "1cxk1w43apw2b6w6r8m1magz08qzlljzn8ihn42jgamyn7sddp9c";
+    sha256 = "0ih3pqxv8kwc8awkd7f5cib9zdnmz6hczqfcz62s7bppjchbicwr";
   };
 } // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-6.1.nix b/pkgs/os-specific/linux/kernel/linux-6.1.nix
index d890f5fdc718..4eb27cb0af96 100644
--- a/pkgs/os-specific/linux/kernel/linux-6.1.nix
+++ b/pkgs/os-specific/linux/kernel/linux-6.1.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "6.1.15";
+  version = "6.1.16";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v6.x/linux-${version}.tar.xz";
-    sha256 = "1zf48h34cz4chv0n12xlif0n7fdzbri2v8am1nn68bla2vidy5ic";
+    sha256 = "1id3dn0p724yp3n4wqk6bhs21yjhqihiilkagfh1am8bb1arr156";
   };
 } // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-6.2.nix b/pkgs/os-specific/linux/kernel/linux-6.2.nix
index e08f21c7bbcc..1fbdb1ff9e58 100644
--- a/pkgs/os-specific/linux/kernel/linux-6.2.nix
+++ b/pkgs/os-specific/linux/kernel/linux-6.2.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "6.2.2";
+  version = "6.2.3";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v6.x/linux-${version}.tar.xz";
-    sha256 = "1c5zxkpahg92as14h8j2yilc4302w6g98zkjawsfh68fpfi5a9y1";
+    sha256 = "091r0rjj5ba50kiq96099w79ayzcdy6qyzgkmw10hxqkzia0nvdk";
   };
 } // (args.argsOverride or { }))
diff --git a/pkgs/servers/invidious/versions.json b/pkgs/servers/invidious/versions.json
index 9258e5a3f866..925fcf3eff7e 100644
--- a/pkgs/servers/invidious/versions.json
+++ b/pkgs/servers/invidious/versions.json
@@ -4,9 +4,9 @@
     "sha256": "sha256-EU6T9yQCdOLx98Io8o01rEsgxDFF/Xoy42LgPopD2/A="
   },
   "invidious": {
-    "rev": "0995e0447c2b54d80b55231830b847d41c19b404",
-    "sha256": "sha256-hXF836jxMriMJ/qcBJIF5cRvQG719PStKqTZQcIRqlw=",
-    "version": "unstable-2023-02-22"
+    "rev": "d79d6f38b20376f27b3472e7f359f286b54760a1",
+    "sha256": "sha256-bek+tUAT99WikwVTKAC9sJxTauD9NoebWujWHO006a8=",
+    "version": "unstable-2023-03-07"
   },
   "lsquic": {
     "sha256": "sha256-hG8cUvhbCNeMOsKkaJlgGpzUrIx47E/WhmPIdI5F3qM=",
diff --git a/pkgs/servers/jellyseerr/default.nix b/pkgs/servers/jellyseerr/default.nix
new file mode 100644
index 000000000000..80dffed68e34
--- /dev/null
+++ b/pkgs/servers/jellyseerr/default.nix
@@ -0,0 +1,93 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, makeWrapper
+, mkYarnPackage
+, nodejs
+, sqlite
+, fetchYarnDeps
+, python3
+, pkg-config
+, glib
+}:
+
+let
+  pin = lib.importJSON ./pin.json;
+in
+
+mkYarnPackage rec {
+  pname = "jellyseerr";
+  inherit (pin) version;
+
+  src = fetchFromGitHub {
+    owner = "Fallenbagel";
+    repo = "jellyseerr";
+    rev = "v${version}";
+    sha256 = pin.srcSha256;
+  };
+
+  packageJSON = ./package.json;
+
+  offlineCache = fetchYarnDeps {
+    yarnLock = "${src}/yarn.lock";
+    sha256 = pin.yarnSha256;
+  };
+
+  doDist = false;
+
+  nativeBuildInputs = [
+    nodejs
+    makeWrapper
+  ];
+
+  # Fixes "SQLite package has not been found installed" at launch
+  pkgConfig.sqlite3 = {
+    nativeBuildInputs = [ nodejs.pkgs.node-pre-gyp python3 ];
+    postInstall = ''
+      export CPPFLAGS="-I${nodejs}/include/node"
+      node-pre-gyp install --prefer-offline --build-from-source --nodedir=${nodejs}/include/node
+      rm -r build-tmp-napi-v6
+    '';
+  };
+
+  pkgConfig.bcrypt = {
+    nativeBuildInputs = [ nodejs.pkgs.node-pre-gyp python3 ];
+    postInstall = ''
+      export CPPFLAGS="-I${nodejs}/include/node"
+      node-pre-gyp install --prefer-offline --build-from-source --nodedir=${nodejs}/include/node
+    '';
+  };
+
+  buildPhase = ''
+    runHook preBuild
+    (
+      shopt -s dotglob
+      cd deps/jellyseerr
+      rm -r config/*
+      yarn build
+      rm -r .next/cache
+    )
+    runHook postBuild
+  '';
+
+  postInstall = ''
+    makeWrapper '${nodejs}/bin/node' "$out/bin/jellyseerr" \
+      --add-flags "$out/libexec/jellyseerr/deps/jellyseerr/dist/index.js" \
+      --set NODE_ENV production
+  '';
+
+  passthru.updateScript = ./update.sh;
+
+  meta = with lib; {
+    description = "Fork of overseerr for jellyfin support";
+    homepage = "https://github.com/Fallenbagel/jellyseerr";
+    longDescription = ''
+      Jellyseerr is a free and open source software application for managing
+      requests for your media library. It is a a fork of Overseerr built to
+      bring support for Jellyfin & Emby media servers!
+    '';
+    license = licenses.mit;
+    maintainers = with maintainers; [ camillemndn ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/servers/jellyseerr/package.json b/pkgs/servers/jellyseerr/package.json
new file mode 100644
index 000000000000..dd5fb6cf187e
--- /dev/null
+++ b/pkgs/servers/jellyseerr/package.json
@@ -0,0 +1,246 @@
+{
+  "name": "jellyseerr",
+  "version": "1.4.1",
+  "private": true,
+  "scripts": {
+    "dev": "nodemon -e ts --watch server --watch overseerr-api.yml -e .json,.ts,.yml -x ts-node -r tsconfig-paths/register --files --project server/tsconfig.json server/index.ts",
+    "build:server": "tsc --project server/tsconfig.json && copyfiles -u 2 server/templates/**/*.{html,pug} dist/templates && tsc-alias -p server/tsconfig.json",
+    "build:next": "next build",
+    "build": "yarn build:next && yarn build:server",
+    "lint": "eslint \"./server/**/*.{ts,tsx}\" \"./src/**/*.{ts,tsx}\" --cache",
+    "start": "NODE_ENV=production node dist/index.js",
+    "i18n:extract": "extract-messages -l=en -o src/i18n/locale -d en --flat true --overwriteDefault true \"./src/**/!(*.test).{ts,tsx}\"",
+    "migration:generate": "ts-node -r tsconfig-paths/register --project server/tsconfig.json ./node_modules/typeorm/cli.js migration:generate -d server/datasource.ts",
+    "migration:create": "ts-node -r tsconfig-paths/register --project server/tsconfig.json ./node_modules/typeorm/cli.js migration:create -d server/datasource.ts",
+    "migration:run": "ts-node -r tsconfig-paths/register --project server/tsconfig.json ./node_modules/typeorm/cli.js migration:run -d server/datasource.ts",
+    "format": "prettier --loglevel warn --write --cache .",
+    "format:check": "prettier --check --cache .",
+    "typecheck": "yarn typecheck:server && yarn typecheck:client",
+    "typecheck:server": "tsc --project server/tsconfig.json --noEmit",
+    "typecheck:client": "tsc --noEmit",
+    "prepare": "husky install",
+    "cypress:open": "cypress open",
+    "cypress:prepare": "ts-node -r tsconfig-paths/register --files --project server/tsconfig.json server/scripts/prepareTestDb.ts",
+    "cypress:build": "yarn build && yarn cypress:prepare"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/fallenbagel/jellyseerr.git"
+  },
+  "license": "MIT",
+  "dependencies": {
+    "@formatjs/intl-displaynames": "6.2.3",
+    "@formatjs/intl-locale": "3.0.11",
+    "@formatjs/intl-pluralrules": "5.1.8",
+    "@formatjs/intl-utils": "3.8.4",
+    "@headlessui/react": "1.7.7",
+    "@heroicons/react": "2.0.13",
+    "@supercharge/request-ip": "1.2.0",
+    "@svgr/webpack": "6.5.1",
+    "@tanem/react-nprogress": "5.0.22",
+    "ace-builds": "1.14.0",
+    "axios": "1.2.2",
+    "axios-rate-limit": "1.3.0",
+    "bcrypt": "5.1.0",
+    "bowser": "2.11.0",
+    "connect-typeorm": "1.1.4",
+    "cookie-parser": "1.4.6",
+    "copy-to-clipboard": "3.3.3",
+    "country-flag-icons": "1.5.5",
+    "cronstrue": "2.21.0",
+    "csurf": "1.11.0",
+    "date-fns": "2.29.3",
+    "dayjs": "1.11.7",
+    "email-templates": "9.0.0",
+    "email-validator": "2.0.4",
+    "express": "4.18.2",
+    "express-openapi-validator": "4.13.8",
+    "express-rate-limit": "6.7.0",
+    "express-session": "1.17.3",
+    "formik": "2.2.9",
+    "gravatar-url": "3.1.0",
+    "intl": "1.2.5",
+    "lodash": "4.17.21",
+    "next": "12.3.4",
+    "node-cache": "5.1.2",
+    "node-gyp": "9.3.1",
+    "node-schedule": "2.1.0",
+    "nodemailer": "6.8.0",
+    "openpgp": "5.5.0",
+    "plex-api": "5.3.2",
+    "pug": "3.0.2",
+    "pulltorefreshjs": "0.1.22",
+    "react": "18.2.0",
+    "react-ace": "10.1.0",
+    "react-animate-height": "2.1.2",
+    "react-aria": "3.22.0",
+    "react-dom": "18.2.0",
+    "react-intersection-observer": "9.4.1",
+    "react-intl": "6.2.5",
+    "react-markdown": "8.0.4",
+    "react-popper-tooltip": "4.4.2",
+    "react-select": "5.7.0",
+    "react-spring": "9.6.1",
+    "react-tailwindcss-datepicker-sct": "1.3.4",
+    "react-toast-notifications": "2.5.1",
+    "react-truncate-markup": "5.1.2",
+    "react-use-clipboard": "1.0.9",
+    "reflect-metadata": "0.1.13",
+    "secure-random-password": "0.2.3",
+    "semver": "7.3.8",
+    "sqlite3": "5.1.4",
+    "swagger-ui-express": "4.6.0",
+    "swr": "2.0.0",
+    "typeorm": "0.3.11",
+    "web-push": "3.5.0",
+    "winston": "3.8.2",
+    "winston-daily-rotate-file": "4.7.1",
+    "xml2js": "0.4.23",
+    "yamljs": "0.3.0",
+    "yup": "0.32.11",
+    "zod": "3.20.2"
+  },
+  "devDependencies": {
+    "@babel/cli": "7.20.7",
+    "@commitlint/cli": "17.4.0",
+    "@commitlint/config-conventional": "17.4.0",
+    "@semantic-release/changelog": "6.0.2",
+    "@semantic-release/commit-analyzer": "9.0.2",
+    "@semantic-release/exec": "6.0.3",
+    "@semantic-release/git": "10.0.1",
+    "@tailwindcss/aspect-ratio": "0.4.2",
+    "@tailwindcss/forms": "0.5.3",
+    "@tailwindcss/typography": "0.5.8",
+    "@types/bcrypt": "5.0.0",
+    "@types/cookie-parser": "1.4.3",
+    "@types/country-flag-icons": "1.2.0",
+    "@types/csurf": "1.11.2",
+    "@types/email-templates": "8.0.4",
+    "@types/express": "4.17.15",
+    "@types/express-session": "1.17.5",
+    "@types/lodash": "4.14.191",
+    "@types/node": "17.0.36",
+    "@types/node-schedule": "2.1.0",
+    "@types/nodemailer": "6.4.7",
+    "@types/pulltorefreshjs": "0.1.5",
+    "@types/react": "18.0.26",
+    "@types/react-dom": "18.0.10",
+    "@types/react-transition-group": "4.4.5",
+    "@types/secure-random-password": "0.2.1",
+    "@types/semver": "7.3.13",
+    "@types/swagger-ui-express": "4.1.3",
+    "@types/web-push": "3.3.2",
+    "@types/xml2js": "0.4.11",
+    "@types/yamljs": "0.2.31",
+    "@types/yup": "0.29.14",
+    "@typescript-eslint/eslint-plugin": "5.48.0",
+    "@typescript-eslint/parser": "5.48.0",
+    "autoprefixer": "10.4.13",
+    "babel-plugin-react-intl": "8.2.25",
+    "babel-plugin-react-intl-auto": "3.3.0",
+    "commitizen": "4.2.6",
+    "copyfiles": "2.4.1",
+    "cy-mobile-commands": "0.3.0",
+    "cypress": "12.3.0",
+    "cz-conventional-changelog": "3.3.0",
+    "eslint": "8.31.0",
+    "eslint-config-next": "12.3.4",
+    "eslint-config-prettier": "8.6.0",
+    "eslint-plugin-formatjs": "4.3.9",
+    "eslint-plugin-jsx-a11y": "6.6.1",
+    "eslint-plugin-no-relative-import-paths": "1.5.2",
+    "eslint-plugin-prettier": "4.2.1",
+    "eslint-plugin-react": "7.31.11",
+    "eslint-plugin-react-hooks": "4.6.0",
+    "extract-react-intl-messages": "4.1.1",
+    "husky": "8.0.3",
+    "lint-staged": "13.1.0",
+    "nodemon": "2.0.20",
+    "postcss": "8.4.20",
+    "prettier": "2.8.1",
+    "prettier-plugin-organize-imports": "3.2.1",
+    "prettier-plugin-tailwindcss": "0.2.1",
+    "semantic-release": "19.0.5",
+    "semantic-release-docker-buildx": "1.0.1",
+    "tailwindcss": "3.2.4",
+    "ts-node": "10.9.1",
+    "tsc-alias": "1.8.2",
+    "tsconfig-paths": "4.1.2",
+    "typescript": "4.9.4"
+  },
+  "resolutions": {
+    "sqlite3/node-gyp": "8.4.1",
+    "@types/react": "18.0.26",
+    "@types/react-dom": "18.0.10"
+  },
+  "config": {
+    "commitizen": {
+      "path": "./node_modules/cz-conventional-changelog"
+    }
+  },
+  "lint-staged": {
+    "**/*.{ts,tsx,js}": [
+      "prettier --write",
+      "eslint"
+    ],
+    "**/*.{json,md,css}": [
+      "prettier --write"
+    ]
+  },
+  "commitlint": {
+    "extends": [
+      "@commitlint/config-conventional"
+    ]
+  },
+  "release": {
+    "plugins": [
+      "@semantic-release/commit-analyzer",
+      "@semantic-release/release-notes-generator",
+      [
+        "@semantic-release/changelog",
+        {
+          "changelogFile": "CHANGELOG.md"
+        }
+      ],
+      "@semantic-release/npm",
+      [
+        "@semantic-release/git",
+        {
+          "assets": [
+            "package.json",
+            "CHANGELOG.md"
+          ],
+          "message": "chore(release): ${nextRelease.version}"
+        }
+      ],
+      "semantic-release-docker-buildx",
+      [
+        "@semantic-release/github",
+        {
+          "addReleases": "bottom"
+        }
+      ]
+    ],
+    "branches": [
+      "main"
+    ],
+    "npmPublish": false,
+    "publish": [
+      {
+        "path": "semantic-release-docker-buildx",
+        "buildArgs": {
+          "COMMIT_TAG": "$GIT_SHA"
+        },
+        "imageNames": [
+          "fallenbagel/jellyseerr"
+        ],
+        "platforms": [
+          "linux/amd64",
+          "linux/arm64",
+          "linux/arm/v7"
+        ]
+      },
+      "@semantic-release/github"
+    ]
+  }
+}
diff --git a/pkgs/servers/jellyseerr/pin.json b/pkgs/servers/jellyseerr/pin.json
new file mode 100644
index 000000000000..3681e3df6853
--- /dev/null
+++ b/pkgs/servers/jellyseerr/pin.json
@@ -0,0 +1,5 @@
+{
+  "version": "1.4.1",
+  "srcSha256": "LDqlQfy1bm2xMNn1oulImfanQmJX57P48VaZn0Jxwpk=",
+  "yarnSha256": "162aip7r5vcpfj1sn42qwwdlwnaii32bd2k0gp9py1z0zmw0lwlf"
+}
diff --git a/pkgs/servers/jellyseerr/update.sh b/pkgs/servers/jellyseerr/update.sh
new file mode 100755
index 000000000000..b1561bae217d
--- /dev/null
+++ b/pkgs/servers/jellyseerr/update.sh
@@ -0,0 +1,39 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p nix curl jq prefetch-yarn-deps nix-prefetch-github
+
+set -euo pipefail
+
+if [[ "$#" -gt 1 || "$1" == -* ]]; then
+  echo "Regenerates packaging data for jellyseerr."
+  echo "Usage: $0 [git release tag]"
+  exit 1
+fi
+
+tag="$1"
+
+if [ -z "$tag" ]; then
+  tag="$(
+    curl "https://api.github.com/repos/Fallenbagel/jellyseerr/releases?per_page=1" |
+    jq -r '.[0].tag_name'
+  )"
+fi
+
+src="https://raw.githubusercontent.com/Fallenbagel/jellyseerr/$tag"
+src_sha256=$(nix-prefetch-github Fallenbagel jellyseerr --rev ${tag} | jq -r .sha256)
+
+tmpdir=$(mktemp -d)
+trap 'rm -rf "$tmpdir"' EXIT
+
+pushd $tmpdir
+curl -O "$src/yarn.lock"
+yarn_sha256=$(prefetch-yarn-deps yarn.lock)
+popd
+
+curl -O "$src/package.json"
+cat > pin.json << EOF
+{
+  "version": "$(echo $tag | grep -P '(\d|\.)+' -o)",
+  "srcSha256": "$src_sha256",
+  "yarnSha256": "$yarn_sha256"
+}
+EOF
diff --git a/pkgs/servers/libreddit/default.nix b/pkgs/servers/libreddit/default.nix
index 442d590cf64f..f7a77c6962c5 100644
--- a/pkgs/servers/libreddit/default.nix
+++ b/pkgs/servers/libreddit/default.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "libreddit";
-  version = "0.29.4";
+  version = "0.30.0";
 
   src = fetchFromGitHub {
     owner = "libreddit";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-xGjCki0fQWXLXqCvNj6GjQ7qbFBcaJBPuPb8Aj1whLk=";
+    hash = "sha256-jV8U7znBFCYBmtI6fm+/5oKsLJ3/tQG16GUvNnBlp7A=";
   };
 
-  cargoHash = "sha256-+fEHD648za4tNEQiu1AYfFXf3Hbe9f0D3MFYJ0OCfqQ=";
+  cargoHash = "sha256-V7bT1uwSk9IW5rhKHW+6yHv+o+H3w7O/yuRpPDrcFic=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
     Security
diff --git a/pkgs/servers/misc/oven-media-engine/default.nix b/pkgs/servers/misc/oven-media-engine/default.nix
index b14efeaabecf..42d86bedfc54 100644
--- a/pkgs/servers/misc/oven-media-engine/default.nix
+++ b/pkgs/servers/misc/oven-media-engine/default.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation rec {
   pname = "oven-media-engine";
-  version = "0.15.1";
+  version = "0.15.3";
 
   src = fetchFromGitHub {
     owner = "AirenSoft";
     repo = "OvenMediaEngine";
     rev = "v${version}";
-    sha256 = "sha256-Ob+0Ak0ELyHrZfeCiACX2IHsp+6jE//iqPoW6je6GfQ=";
+    sha256 = "sha256-HbtKEWDCT6DpJYc25I+WZw6HwZeeYRUz+OzPcf8bCfw=";
   };
 
   sourceRoot = "source/src";
diff --git a/pkgs/tools/networking/gvproxy/default.nix b/pkgs/tools/networking/gvproxy/default.nix
index 59ba36c5d7f5..cec1007ddeea 100644
--- a/pkgs/tools/networking/gvproxy/default.nix
+++ b/pkgs/tools/networking/gvproxy/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "gvproxy";
-  version = "0.5.0";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "gvisor-tap-vsock";
     rev = "v${version}";
-    sha256 = "sha256-UtOOBXl063Ur28h/DT00paulZ8JzHLZ6nyxhyq4+goM=";
+    hash = "sha256-FycYBNFHo8lYI5jX5Fogu+bsJ63z40zUJTC+dIKESkA=";
   };
 
-  vendorSha256 = null;
+  vendorHash = null;
 
   buildPhase = ''
     runHook preBuild
@@ -26,6 +26,7 @@ buildGoModule rec {
   '';
 
   meta = with lib; {
+    changelog = "https://github.com/containers/gvisor-tap-vsock/releases/tag/${src.rev}";
     description = "Network stack based on gVisor";
     homepage = "https://github.com/containers/gvisor-tap-vsock";
     license = licenses.asl20;
diff --git a/pkgs/tools/system/automatic-timezoned/default.nix b/pkgs/tools/system/automatic-timezoned/default.nix
index 0f0cc9c2b770..53472de63516 100644
--- a/pkgs/tools/system/automatic-timezoned/default.nix
+++ b/pkgs/tools/system/automatic-timezoned/default.nix
@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "automatic-timezoned";
-  version = "1.0.69";
+  version = "1.0.72";
 
   src = fetchFromGitHub {
     owner = "maxbrunet";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-n2s+N69SL3nN/BIJWreWExoS1Mf5h40vqR5z5LXHh9c=";
+    sha256 = "sha256-JOf10wGpOwJTvBvaeoBPKWm6f3B6K9ZsJaKkkzwkM7Y=";
   };
 
-  cargoHash = "sha256-OoCtvSuPmRPSlV1r47DnC3CLWPTBZkeYLVdZS9NE57w=";
+  cargoHash = "sha256-4vzu77BLxJeVQgpI+g16XrqWt94r93v6Wz9wwFcbKlQ=";
 
   meta = with lib; {
     description = "Automatically update system timezone based on location";
diff --git a/pkgs/tools/text/mdbook-pagetoc/default.nix b/pkgs/tools/text/mdbook-pagetoc/default.nix
index 7ee5f8fdde4e..cd942fb922c3 100644
--- a/pkgs/tools/text/mdbook-pagetoc/default.nix
+++ b/pkgs/tools/text/mdbook-pagetoc/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mdbook-pagetoc";
-  version = "0.1.5";
+  version = "0.1.6";
 
   src = fetchFromGitHub {
     owner = "slowsage";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-SRrlyUkEdC63NbdAv+J9kb5LTCL/GBwMhnUVdTE4nas=";
+    hash = "sha256-rLnGi6s5vNBxBRcim5cvLm5ajclK1q4mfgLCJ/sT1nU=";
   };
 
-  cargoHash = "sha256-Gx6N8VFUnaOvQ290TLeeNj/pVDeK/nUWLjM/KwVAjNo=";
+  cargoHash = "sha256-q3xSngar5/+5pFdiB//spiYQuXiNuRHSWOF6UPzccIU=";
 
   meta = with lib; {
     description = "Table of contents for mdbook (in sidebar)";
diff --git a/pkgs/tools/text/mdbook/default.nix b/pkgs/tools/text/mdbook/default.nix
index 9d00c8e1fd12..155cca613a7b 100644
--- a/pkgs/tools/text/mdbook/default.nix
+++ b/pkgs/tools/text/mdbook/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mdbook";
-  version = "0.4.26";
+  version = "0.4.28";
 
   src = fetchFromGitHub {
     owner = "rust-lang";
     repo = "mdBook";
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-+K2mbVbOMQDumcPgiPtqDts/RGi+E0lF7Cftt86X/5A=";
+    sha256 = "sha256-9Otjl3JLEQo+WojUOu0XE1GH2P4LjKhaxSd1xoekXdk=";
   };
 
-  cargoHash = "sha256-C9ziW3LUBGR/K+nR3mDr62KoE9p3mn+50nfd/3NFjro=";
+  cargoHash = "sha256-TViBclvCJeoOInTt13B7297JDtRkwvOjIf6AVAbpanU=";
 
   auditable = true; # TODO: remove when this is the default
 
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 367001940416..0e8b9bddb623 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1095,6 +1095,7 @@ mapAliases ({
   odpdown = throw "odpdown has been removed because it lacks python3 support"; # Added 2022-04-25
   ofp = throw "ofp is not compatible with odp-dpdk";
   olifant = throw "olifant has been removed from nixpkgs, as it was unmaintained"; # Added 2021-08-05
+  opam_1_2 = throw "'opam_1_2' has been renamed to/replaced by 'opam'"; # Added 2023-03-08
   openafs_1_8 = openafs; # Added 2022-08-22
   openbazaar = throw "openbazzar has been removed from nixpkgs as upstream has abandoned the project"; # Added 2022-01-06
   openbazaar-client = throw "openbazzar-client has been removed from nixpkgs as upstream has abandoned the project"; # Added 2022-01-06
@@ -1153,6 +1154,7 @@ mapAliases ({
   phantomjs2 = throw "phantomjs2 has been dropped due to lack of maintenance"; # Added 2022-04-22
   philter = throw "philter has been removed: abandoned by upstream"; # Added 2022-04-26
   phodav_2_0 = throw "'phodav_2_0' has been renamed to/replaced by 'phodav'"; # Added 2023-02-21
+  photoflow = throw "photoflow was removed because it was broken and unmaintained by upstream"; # Added 2023-03-10
   phraseapp-client = throw "phraseapp-client is archived by upstream. Use phrase-cli instead"; # Added 2022-05-15
   phwmon = throw "phwmon has been removed: abandoned by upstream"; # Added 2022-04-24
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 9475def8a73a..c5ab20e61e56 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -5043,6 +5043,8 @@ with pkgs;
 
   jellyfin-web = callPackage ../servers/jellyfin/web.nix { };
 
+  jellyseerr = callPackage ../servers/jellyseerr { };
+
   jiten = callPackage ../applications/misc/jiten { };
 
   kanjidraw = callPackage ../applications/misc/kanjidraw { };
@@ -7742,6 +7744,8 @@ with pkgs;
 
   gitlab-clippy = callPackage ../development/tools/rust/gitlab-clippy { };
 
+  gitlab-pages = callPackage ../applications/version-management/gitlab/gitlab-pages { };
+
   gitlab-runner = callPackage ../development/tools/continuous-integration/gitlab-runner { };
 
   gitlab-shell = callPackage ../applications/version-management/gitlab/gitlab-shell { };
@@ -15588,9 +15592,6 @@ with pkgs;
   opam = callPackage ../development/tools/ocaml/opam {
     inherit (darwin.apple_sdk.frameworks) Foundation;
   };
-  opam_1_2 = callPackage ../development/tools/ocaml/opam/1.2.2.nix {
-    inherit (ocaml-ng.ocamlPackages_4_05) ocaml;
-  };
 
   opam-installer = callPackage ../development/tools/ocaml/opam/installer.nix { };
 
@@ -15609,8 +15610,8 @@ with pkgs;
   picat = callPackage ../development/compilers/picat { };
 
   ponyc = callPackage ../development/compilers/ponyc {
-    # Upstream pony has dropped support for versions compiled with gcc.
-    stdenv = llvmPackages_9.stdenv;
+    # Upstream pony no longer supports GCC
+    stdenv = llvmPackages.stdenv;
   };
 
   blaze = callPackage ../development/libraries/blaze { };
@@ -19380,13 +19381,9 @@ with pkgs;
 
   captive-browser = callPackage ../applications/networking/browsers/captive-browser { };
 
-  ndn-cxx = callPackage ../development/libraries/ndn-cxx {
-    openssl = openssl_1_1;
-  };
+  ndn-cxx = callPackage ../development/libraries/ndn-cxx { };
 
-  ndn-tools = callPackage ../tools/networking/ndn-tools {
-    openssl = openssl_1_1;
-  };
+  ndn-tools = callPackage ../tools/networking/ndn-tools { };
 
   nfd = callPackage ../servers/nfd { };
 
@@ -24697,8 +24694,6 @@ with pkgs;
 
   gatling = callPackage ../servers/http/gatling { };
 
-  gitlab-pages = callPackage ../servers/http/gitlab-pages { };
-
   glabels = callPackage ../applications/graphics/glabels { };
 
   nats-server = callPackage ../servers/nats-server { };
@@ -32485,8 +32480,6 @@ with pkgs;
 
   photoflare = libsForQt5.callPackage ../applications/graphics/photoflare { };
 
-  photoflow = callPackage ../applications/graphics/photoflow { };
-
   phototonic = libsForQt5.callPackage ../applications/graphics/phototonic { };
 
   phrasendrescher = callPackage ../tools/security/phrasendrescher { };
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 43e8cba683cf..e22f41a63cd2 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -569,6 +569,8 @@ let
 
     hpack = callPackage ../development/ocaml-modules/hpack { };
 
+    http-mirage-client = callPackage ../development/ocaml-modules/http-mirage-client { };
+
     hxd = callPackage ../development/ocaml-modules/hxd { };
 
     imagelib = callPackage ../development/ocaml-modules/imagelib { };
@@ -755,6 +757,8 @@ let
 
     letsencrypt-dns = callPackage ../development/ocaml-modules/letsencrypt/dns.nix { };
 
+    letsencrypt-mirage = callPackage ../development/ocaml-modules/letsencrypt/mirage.nix { };
+
     lilv = callPackage ../development/ocaml-modules/lilv {
       inherit (pkgs) lilv;
     };