diff --git a/maintainers/README.md b/maintainers/README.md
index e12881851925..5bb9c58db024 100644
--- a/maintainers/README.md
+++ b/maintainers/README.md
@@ -1,10 +1,63 @@
 # Nixpkgs Maintainers
 
-The *Nixpkgs maintainers* are people who have assigned themselves to
-maintain specific individual packages. We encourage people who care
-about a package to assign themselves as a maintainer. When a pull
-request is made against a package, OfBorg will notify the appropriate
-maintainer(s).
+Unlike other packaging ecosystems, the maintainer doesn't have exclusive
+control over the packages and modules they maintain. This more fluid approach
+is one reason why we scale to so many packages.
+
+## Definition and role of the maintainer
+
+The main responsibility of a maintainer is to keep the packages they maintain
+in a functioning state, and keep up with updates. In order to do that, they
+are empowered to make decisions over the packages they maintain.
+
+That being said, the maintainer is not alone proposing changes to the
+packages. Anybody (both bots and humans) can send PRs to bump or tweak the
+package.
+
+We also allow other non-maintainer committers to merge changes to the package,
+provided enough time and priority has been given to the maintainer.
+
+For most packages, we expect committers to wait at least a week before merging
+changes not endorsed by a package maintainer (which may be themselves). This should leave enough time
+for the maintainers to provide feedback.
+
+For critical packages, this convention needs to be negotiated with the
+maintainer. A critical package is one that causes mass-rebuild, or where an
+author is listed in the [`CODEOWNERS`](../.github/CODEOWNERS) file.
+
+In case of critical security updates, the [security team](https://nixos.org/community/teams/security) might override these
+heuristics in order to get the fixes in as fast as possible.
+
+In case of conflict, the maintainer takes priority and is allowed to revert
+the changes. This can happen for example if the maintainer was on holiday.
+
+### How to become a maintainer
+
+We encourage people who care about a package to assign themselves as a
+maintainer. Commit access to the Nixpkgs repository is not required for that.
+
+In order to do so, add yourself to the
+[`maintainer-list.nix`](./maintainer-list.nix), and then to the desired
+package's `meta.maintainers` list, and send a PR with the changes.
+
+### How to lose maintainer status
+
+Maintainers who have become inactive on a given package can be removed. This
+helps us keep an accurate view of the state of maintenance in Nixpkgs.
+
+The inactivity measure is currently not strictly enforced. We would typically
+look at it if we notice that the author hasn't reacted to package-related
+notifications for more than 3 months.
+
+Removing the maintainer happens by making a PR on the package, adding that
+person as a reviewer, and then waiting a week for a reaction.
+
+The maintainer is welcome to come back at any time.
+
+### Tools for maintainers
+
+When a pull request is made against a package, OfBorg will notify the
+appropriate maintainer(s).
 
 ## Reviewing contributions
 
diff --git a/nixos/doc/manual/release-notes/rl-2311.section.md b/nixos/doc/manual/release-notes/rl-2311.section.md
index c4ed81e0b5b6..eb6fb6fc6e45 100644
--- a/nixos/doc/manual/release-notes/rl-2311.section.md
+++ b/nixos/doc/manual/release-notes/rl-2311.section.md
@@ -221,6 +221,8 @@ The module update takes care of the new config syntax and the data itself (user
 
 - `services.prometheus.exporters` has a new [exporter](https://github.com/hipages/php-fpm_exporter) to monitor PHP-FPM processes, see [#240394](https://github.com/NixOS/nixpkgs/pull/240394) for more details.
 
+- `services.github-runner` / `services.github-runners.<name>` gained the option `nodeRuntimes`. The option defaults to `[ "node20" ]`, i.e., the service supports Node.js 20 GitHub Actions only. The list of Node.js versions accepted by `nodeRuntimes` tracks the versions the upstream GitHub Actions runner supports. See [#249103](https://github.com/NixOS/nixpkgs/pull/249103) for details.
+
 - `programs.gnupg.agent.pinentryFlavor` is now set in `/etc/gnupg/gpg-agent.conf`, and will no longer take precedence over a `pinentry-program` set in `~/.gnupg/gpg-agent.conf`.
 
 - `services.influxdb2` now supports doing an automatic initial setup and provisioning of users, organizations, buckets and authentication tokens, see [#249502](https://github.com/NixOS/nixpkgs/pull/249502) for more details.
diff --git a/nixos/modules/services/continuous-integration/github-runner/options.nix b/nixos/modules/services/continuous-integration/github-runner/options.nix
index ce8809213724..f2887c7711b3 100644
--- a/nixos/modules/services/continuous-integration/github-runner/options.nix
+++ b/nixos/modules/services/continuous-integration/github-runner/options.nix
@@ -208,4 +208,12 @@ with lib;
     '';
     default = null;
   };
+
+  nodeRuntimes = mkOption {
+    type = with types; nonEmptyListOf (enum [ "node16" "node20" ]);
+    default = [ "node20" ];
+    description = mdDoc ''
+      List of Node.js runtimes the runner should support.
+    '';
+  };
 }
diff --git a/nixos/modules/services/continuous-integration/github-runner/service.nix b/nixos/modules/services/continuous-integration/github-runner/service.nix
index 55df83362cb6..535df7f68e07 100644
--- a/nixos/modules/services/continuous-integration/github-runner/service.nix
+++ b/nixos/modules/services/continuous-integration/github-runner/service.nix
@@ -22,6 +22,7 @@ with lib;
 
 let
   workDir = if cfg.workDir == null then runtimeDir else cfg.workDir;
+  package = cfg.package.override { inherit (cfg) nodeRuntimes; };
 in
 {
   description = "GitHub Actions runner";
@@ -47,7 +48,7 @@ in
 
   serviceConfig = mkMerge [
     {
-      ExecStart = "${cfg.package}/bin/Runner.Listener run --startuptype service";
+      ExecStart = "${package}/bin/Runner.Listener run --startuptype service";
 
       # Does the following, sequentially:
       # - If the module configuration or the token has changed, purge the state directory,
@@ -149,7 +150,7 @@ in
               else
                 args+=(--token "$token")
               fi
-              ${cfg.package}/bin/Runner.Listener configure "''${args[@]}"
+              ${package}/bin/Runner.Listener configure "''${args[@]}"
               # Move the automatically created _diag dir to the logs dir
               mkdir -p  "$STATE_DIRECTORY/_diag"
               cp    -r  "$STATE_DIRECTORY/_diag/." "$LOGS_DIRECTORY/"
diff --git a/nixos/modules/services/networking/dnscrypt-proxy2.nix b/nixos/modules/services/networking/dnscrypt-proxy2.nix
index de1ca0d2f206..4592a0c2f6b3 100644
--- a/nixos/modules/services/networking/dnscrypt-proxy2.nix
+++ b/nixos/modules/services/networking/dnscrypt-proxy2.nix
@@ -11,7 +11,7 @@ in
     settings = mkOption {
       description = lib.mdDoc ''
         Attrset that is converted and passed as TOML config file.
-        For available params, see: <https://github.com/DNSCrypt/dnscrypt-proxy/blob/${pkgs.dnscrypt-proxy2.version}/dnscrypt-proxy/example-dnscrypt-proxy.toml>
+        For available params, see: <https://github.com/DNSCrypt/dnscrypt-proxy/blob/${pkgs.dnscrypt-proxy.version}/dnscrypt-proxy/example-dnscrypt-proxy.toml>
       '';
       example = literalExpression ''
         {
@@ -49,7 +49,7 @@ in
         passAsFile = [ "json" ];
       } ''
         ${if cfg.upstreamDefaults then ''
-          ${pkgs.remarshal}/bin/toml2json ${pkgs.dnscrypt-proxy2.src}/dnscrypt-proxy/example-dnscrypt-proxy.toml > example.json
+          ${pkgs.remarshal}/bin/toml2json ${pkgs.dnscrypt-proxy.src}/dnscrypt-proxy/example-dnscrypt-proxy.toml > example.json
           ${pkgs.jq}/bin/jq --slurp add example.json $jsonPath > config.json # merges the two
         '' else ''
           cp $jsonPath config.json
@@ -80,7 +80,7 @@ in
         AmbientCapabilities = "CAP_NET_BIND_SERVICE";
         CacheDirectory = "dnscrypt-proxy";
         DynamicUser = true;
-        ExecStart = "${pkgs.dnscrypt-proxy2}/bin/dnscrypt-proxy -config ${cfg.configFile}";
+        ExecStart = "${pkgs.dnscrypt-proxy}/bin/dnscrypt-proxy -config ${cfg.configFile}";
         LockPersonality = true;
         LogsDirectory = "dnscrypt-proxy";
         MemoryDenyWriteExecute = true;
diff --git a/pkgs/applications/audio/monkeys-audio/default.nix b/pkgs/applications/audio/monkeys-audio/default.nix
index ac9d4f2e26a1..f9233f56f4c4 100644
--- a/pkgs/applications/audio/monkeys-audio/default.nix
+++ b/pkgs/applications/audio/monkeys-audio/default.nix
@@ -5,13 +5,13 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "10.19";
+  version = "10.20";
   pname = "monkeys-audio";
 
   src = fetchzip {
     url = "https://monkeysaudio.com/files/MAC_${
       builtins.concatStringsSep "" (lib.strings.splitString "." version)}_SDK.zip";
-    sha256 = "sha256-kuK6Uok5PAK66OtY+Uu1R7g8T7geA9edn2Sv6LN2pXc=";
+    sha256 = "sha256-RBrWz0iGVny1YC6H9NJbFb2HhlAxRiFrTBg1Evm85B8=";
     stripRoot = false;
   };
   nativeBuildInputs = [
diff --git a/pkgs/applications/audio/muse/default.nix b/pkgs/applications/audio/muse/default.nix
index 01940bfc4f32..fb80c10f046f 100644
--- a/pkgs/applications/audio/muse/default.nix
+++ b/pkgs/applications/audio/muse/default.nix
@@ -1,33 +1,68 @@
-{ lib, stdenv, fetchFromGitHub, cmake, pkg-config, qttools, wrapQtAppsHook
-, alsa-lib, dssi, fluidsynth, ladspaH, lash, libinstpatch, libjack2, liblo
-, libsamplerate, libsndfile, lilv, lrdf, lv2, qtsvg, rtaudio, rubberband, sord, serd
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, pkg-config
+, qttools
+, wrapQtAppsHook
+, alsa-lib
+, dssi
+, fluidsynth
+, ladspaH
+, lash
+, libinstpatch
+, libjack2
+, liblo
+, libsamplerate
+, libsndfile
+, lilv
+, lrdf
+, lv2
+, qtsvg
+, rtaudio
+, rubberband
+, sord
+, serd
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "muse-sequencer";
-  version = "3.1.1";
+  version = "4.1.0";
 
   src = fetchFromGitHub {
     owner = "muse-sequencer";
     repo = "muse";
-    rev = "muse_${builtins.replaceStrings ["."] ["_"] version}";
-    sha256 = "1rasp2v1ds2aw296lbf27rzw0l9fjl0cvbvw85d5ycvh6wkm301p";
+    rev = finalAttrs.version;
+    hash = "sha256-JPvoximDL4oKO8reXW7alMegwUyUTSAcdq3ueXeUMMY=";
   };
 
-  sourceRoot = "${src.name}/muse3";
-
-  patches = [ ./fix-parallel-building.patch ];
+  sourceRoot = "${finalAttrs.src.name}/src";
 
   nativeBuildInputs = [ cmake pkg-config qttools wrapQtAppsHook ];
 
   buildInputs = [
-    alsa-lib dssi fluidsynth ladspaH lash libinstpatch libjack2 liblo
-    libsamplerate libsndfile lilv lrdf lv2 qtsvg rtaudio rubberband sord
+    alsa-lib
+    dssi
+    fluidsynth
+    ladspaH
+    lash
+    libinstpatch
+    libjack2
+    liblo
+    libsamplerate
+    libsndfile
+    lilv
+    lrdf
+    lv2
+    qtsvg
+    rtaudio
+    rubberband
+    sord
   ];
 
   env.NIX_CFLAGS_COMPILE = toString [ "-I${lib.getDev serd}/include/serd-0" ];
 
-  meta = with lib; {
+  meta = {
     homepage = "https://muse-sequencer.github.io/";
     description = "MIDI/Audio sequencer with recording and editing capabilities";
     longDescription = ''
@@ -38,7 +73,9 @@ stdenv.mkDerivation rec {
       MusE aims to be a complete multitrack virtual studio for Linux,
       it is published under the GNU General Public License.
     '';
-    license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ orivej ];
+    license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [ eclairevoyant orivej ];
+    platforms = lib.platforms.linux;
+    mainProgram = "muse4";
   };
-}
+})
diff --git a/pkgs/applications/audio/muse/fix-parallel-building.patch b/pkgs/applications/audio/muse/fix-parallel-building.patch
deleted file mode 100644
index a11970b7111a..000000000000
--- a/pkgs/applications/audio/muse/fix-parallel-building.patch
+++ /dev/null
@@ -1,93 +0,0 @@
-To confirm these dependencies, run in a fresh build tree:
-
-
-ninja muse/components/CMakeFiles/components.dir/confmport.o
-
-In file included from ../muse/components/confmport.cpp:48:
-../muse/mplugins/midifilterimpl.h:28:10: fatal error:
-ui_midifilter.h: No such file or directory
-
-
-ninja muse/waveedit/CMakeFiles/waveedit.dir/wavecanvas.o
-
-In file included from ../muse/waveedit/wavecanvas.cpp:72:
-../muse/components/copy_on_write.h:26:10: fatal error:
-ui_copy_on_write_base.h: No such file or directory
-
-
-ninja muse/instruments/CMakeFiles/instruments.dir/editinstrument.o
-
-In file included from ../muse/instruments/editinstrument.cpp:58:
-../muse/components/editevent.h:26:10: fatal error:
-ui_editnotedialogbase.h: No such file or directory
-
-
-ninja muse/liste/CMakeFiles/liste.dir/listedit.o
-
-In file included from ../muse/liste/listedit.cpp:37:
-../muse/components/editevent.h:26:10: fatal error:
-ui_editnotedialogbase.h: No such file or directory
-
-
-ninja muse/mixer/CMakeFiles/mixer.dir/rack.o
-
-In file included from ../muse/mixer/rack.cpp:49:
-../muse/components/plugindialog.h:4:10: fatal error:
-ui_plugindialogbase.h: No such file or directory
-
-
-ninja muse/midiedit/CMakeFiles/midiedit.dir/drumedit.o
-
-In file included from /build/source/muse3/muse/midiedit/drumedit.cpp:64:
-/build/source/muse3/muse/components/filedialog.h:29:10: fatal error:
-ui_fdialogbuttons.h: No such file or directory
-
-
---- a/muse/components/CMakeLists.txt
-+++ b/muse/components/CMakeLists.txt
-@@ -343,4 +343,5 @@ set_target_properties( components
- target_link_libraries ( components
-       ${QT_LIBRARIES}
-+      mplugins
-       widgets
-       xml_module
---- a/muse/waveedit/CMakeLists.txt
-+++ b/muse/waveedit/CMakeLists.txt
-@@ -79,4 +79,5 @@ set_target_properties( waveedit
- target_link_libraries( waveedit
-       ${QT_LIBRARIES}
-+      components
-       widgets
-       )
---- a/muse/instruments/CMakeLists.txt
-+++ b/muse/instruments/CMakeLists.txt
-@@ -78,4 +78,5 @@ set_target_properties( instruments
- target_link_libraries ( instruments
-       ${QT_LIBRARIES}
-+      components
-       icons
-       widgets
---- a/muse/liste/CMakeLists.txt
-+++ b/muse/liste/CMakeLists.txt
-@@ -65,4 +65,5 @@ set_target_properties( liste
- target_link_libraries ( liste
-       ${QT_LIBRARIES}
-+      components
-       awl
-       widgets
---- a/muse/mixer/CMakeLists.txt
-+++ b/muse/mixer/CMakeLists.txt
-@@ -87,4 +87,5 @@ set_target_properties ( mixer
- target_link_libraries ( mixer
-       ${QT_LIBRARIES}
-+      components
-       widgets
-       )
---- a/muse/midiedit/CMakeLists.txt
-+++ b/muse/midiedit/CMakeLists.txt
-@@ -93,4 +93,5 @@ set_target_properties( midiedit
- target_link_libraries ( midiedit
-       ${QT_LIBRARIES}
-+      components
-       al
-       ctrl
diff --git a/pkgs/applications/editors/emacs/generic.nix b/pkgs/applications/editors/emacs/generic.nix
index 77adcd27f500..b322e19098cc 100644
--- a/pkgs/applications/editors/emacs/generic.nix
+++ b/pkgs/applications/editors/emacs/generic.nix
@@ -32,6 +32,7 @@
 , libXaw
 , libXcursor
 , libXft
+, libXi
 , libXpm
 , libgccjit
 , libjpeg
@@ -274,6 +275,8 @@ mkDerivation (finalAttrs: {
     libpng
     librsvg
     libtiff
+  ] ++ lib.optionals withXinput2 [
+    libXi
   ] ++ lib.optionals withXwidgets [
     webkitgtk
   ] ++ lib.optionals stdenv.isDarwin [
diff --git a/pkgs/applications/editors/orbiton/default.nix b/pkgs/applications/editors/orbiton/default.nix
index f3a3e8b02387..41b9d0b1f9da 100644
--- a/pkgs/applications/editors/orbiton/default.nix
+++ b/pkgs/applications/editors/orbiton/default.nix
@@ -4,13 +4,13 @@
 
 buildGoModule rec {
   pname = "orbiton";
-  version = "2.63.1";
+  version = "2.64.3";
 
   src = fetchFromGitHub {
     owner = "xyproto";
     repo = "orbiton";
     rev = "v${version}";
-    hash = "sha256-ZUbWptE5BckAm/14ZPGJqTbbACC9cDOUUmzzmvuNUSA=";
+    hash = "sha256-mx6k6OXr3iTCD1FTC7J1fnz7Gs/GyggHXnVywuPo5BY=";
   };
 
   vendorHash = null;
diff --git a/pkgs/applications/emulators/uxn/default.nix b/pkgs/applications/emulators/uxn/default.nix
index 03b1fa6beb78..303e073595d7 100644
--- a/pkgs/applications/emulators/uxn/default.nix
+++ b/pkgs/applications/emulators/uxn/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "uxn";
-  version = "unstable-2023-08-10";
+  version = "unstable-2023-08-30";
 
   src = fetchFromSourcehut {
     owner = "~rabbits";
     repo = "uxn";
-    rev = "a394dcb999525ac56ea37d0563d35849964b6d6a";
-    hash = "sha256-3Q8460pkoATKCEqfa+OfpQ4Lp18Ro5i84s88pkz+uzU=";
+    rev = "cfd29ac5119e5b270d5f3e3e9e29d020dadef8d3";
+    hash = "sha256-0fE9M+IEKTBG0WLKEbXG1kAJv19TrQWTFMjedOyX8N0=";
   };
 
   outputs = [ "out" "projects" ];
diff --git a/pkgs/applications/graphics/freecad/default.nix b/pkgs/applications/graphics/freecad/default.nix
index 29f8746b38d9..f997f23d43cf 100644
--- a/pkgs/applications/graphics/freecad/default.nix
+++ b/pkgs/applications/graphics/freecad/default.nix
@@ -1,8 +1,9 @@
 { lib
+, fmt
 , stdenv
-, mkDerivation
 , fetchFromGitHub
 , cmake
+, doxygen
 , ninja
 , gitpython
 , boost
@@ -46,15 +47,15 @@
 , zlib
 }:
 
-mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "freecad";
-  version = "0.20.2";
+  version = "0.21.1";
 
   src = fetchFromGitHub {
     owner = "FreeCAD";
     repo = "FreeCAD";
-    rev = version;
-    hash = "sha256-v8hanhy0UE0o+XqqIH3ZUtVom3q0KGELcfXFRSDr0TA=";
+    rev = finalAttrs.version;
+    hash = "sha256-rwt81Z+Bp8uZlR4iuGQEDKBu/Dr9Rqg7d9SsCdofTUU=";
   };
 
   nativeBuildInputs = [
@@ -71,7 +72,9 @@ mkDerivation rec {
     gitpython # for addon manager
     boost
     coin3d
+    doxygen
     eigen
+    fmt
     gts
     hdf5
     libGLU
@@ -143,8 +146,8 @@ mkDerivation rec {
     ln -s $out/bin/FreeCADCmd $out/bin/freecadcmd
   '';
 
-  meta = with lib; {
-    homepage = "https://www.freecadweb.org/";
+  meta = {
+    homepage = "https://www.freecad.org";
     description = "General purpose Open Source 3D CAD/MCAD/CAx/CAE/PLM modeler";
     longDescription = ''
       FreeCAD is an open-source parametric 3D modeler made primarily to design
@@ -162,8 +165,8 @@ mkDerivation rec {
       programmer, an experienced CAD user, a student or a teacher, you will feel
       right at home with FreeCAD.
     '';
-    license = licenses.lgpl2Plus;
-    maintainers = with maintainers; [ viric gebner AndersonTorres ];
-    platforms = platforms.linux;
+    license = lib.licenses.lgpl2Plus;
+    maintainers = with lib.maintainers; [ viric gebner AndersonTorres ];
+    platforms = lib.platforms.linux;
   };
-}
+})
diff --git a/pkgs/applications/misc/albert/default.nix b/pkgs/applications/misc/albert/default.nix
index fddfaf70f25f..598086ff3178 100644
--- a/pkgs/applications/misc/albert/default.nix
+++ b/pkgs/applications/misc/albert/default.nix
@@ -4,23 +4,26 @@
 , cmake
 , libqalculate
 , muparser
+, libarchive
 , python3Packages
 , qtbase
 , qtscxml
 , qtsvg
+, qtdeclarative
+, qt5compat
 , wrapQtAppsHook
 , nix-update-script
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "albert";
-  version = "0.20.14";
+  version = "0.22.0";
 
   src = fetchFromGitHub {
     owner = "albertlauncher";
     repo = "albert";
-    rev = "v${version}";
-    sha256 = "sha256-c1Bp7rIloXuWv/kUzWGJJ+bh9656vpuqADy77zYZjqk=";
+    rev = "v${finalAttrs.version}";
+    sha256 = "sha256-x5H7z0rwunfMwtihXEerc47Sdkl6IvSHfavXzXMLse0=";
     fetchSubmodules = true;
   };
 
@@ -31,16 +34,19 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     libqalculate
+    libarchive
     muparser
     qtbase
     qtscxml
     qtsvg
+    qtdeclarative
+    qt5compat
   ] ++ (with python3Packages; [ python pybind11 ]);
 
   postPatch = ''
     find -type f -name CMakeLists.txt -exec sed -i {} -e '/INSTALL_RPATH/d' \;
 
-    sed -i src/nativepluginprovider.cpp \
+    sed -i src/qtpluginprovider.cpp \
       -e "/QStringList dirs = {/a    QFileInfo(\"$out/lib\").canonicalFilePath(),"
   '';
 
@@ -50,7 +56,9 @@ stdenv.mkDerivation rec {
     done
   '';
 
-  passthru.updateScript = nix-update-script { };
+  passthru = {
+    updateScript = nix-update-script { };
+  };
 
   meta = with lib; {
     description = "A fast and flexible keyboard launcher";
@@ -60,9 +68,9 @@ stdenv.mkDerivation rec {
       framework.
     '';
     homepage = "https://albertlauncher.github.io";
-    changelog = "https://github.com/albertlauncher/albert/blob/${src.rev}/CHANGELOG.md";
+    changelog = "https://github.com/albertlauncher/albert/blob/${finalAttrs.src.rev}/CHANGELOG.md";
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ ericsagnes synthetica ];
     platforms = platforms.linux;
   };
-}
+})
diff --git a/pkgs/applications/misc/josm/default.nix b/pkgs/applications/misc/josm/default.nix
index 3a920d191587..3eff3c3d79f3 100644
--- a/pkgs/applications/misc/josm/default.nix
+++ b/pkgs/applications/misc/josm/default.nix
@@ -3,15 +3,15 @@
 }:
 let
   pname = "josm";
-  version = "18789";
+  version = "18822";
   srcs = {
     jar = fetchurl {
       url = "https://josm.openstreetmap.de/download/josm-snapshot-${version}.jar";
-      hash = "sha256-0NuCdGqDNY+UCXv9AhX4oT0WJbxMc5ghkL0YvqVWXOs=";
+      hash = "sha256-pzB12lkcWGJ7sVdcfJZC2MnUowfWdElxny0pSQ5vjlw=";
     };
     macosx = fetchurl {
       url = "https://josm.openstreetmap.de/download/macosx/josm-macos-${version}-java17.zip";
-      hash = "sha256-f8VoPMF7cR6idzadkXC6/oUfzq4dnKb3UPa2JjsRNsw=";
+      hash = "sha256-MFiWbEU8C6Jvq9wkIKANQeqJh2/yC3y40ANnGEl4IF0=";
     };
     pkg = fetchsvn {
       url = "https://josm.openstreetmap.de/svn/trunk/native/linux/tested";
diff --git a/pkgs/applications/office/timeular/default.nix b/pkgs/applications/office/timeular/default.nix
index 4bbcc1346090..6629c7f0ae3e 100644
--- a/pkgs/applications/office/timeular/default.nix
+++ b/pkgs/applications/office/timeular/default.nix
@@ -5,12 +5,12 @@
 }:
 
 let
-  version = "5.9.0";
+  version = "6.2.2";
   pname = "timeular";
 
   src = fetchurl {
     url = "https://s3.amazonaws.com/timeular-desktop-packages/linux/production/Timeular-${version}.AppImage";
-    sha256 = "sha256-RbP//rrKgvChIbBVwC8ElMUe+XsGMgHxowSdw6tRWNI=";
+    sha256 = "sha256-i6VLKGHst6gykXOpkt+VFMkdm9RLAWVgAhQ2UZ7Lt5Y=";
   };
 
   appimageContents = appimageTools.extractType2 {
diff --git a/pkgs/applications/terminal-emulators/blackbox-terminal/default.nix b/pkgs/applications/terminal-emulators/blackbox-terminal/default.nix
index c54c92c2010a..e734a1e91eec 100644
--- a/pkgs/applications/terminal-emulators/blackbox-terminal/default.nix
+++ b/pkgs/applications/terminal-emulators/blackbox-terminal/default.nix
@@ -76,6 +76,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Beautiful GTK 4 terminal";
+    mainProgram = "blackbox";
     homepage = "https://gitlab.gnome.org/raggesilver/blackbox";
     changelog = "https://gitlab.gnome.org/raggesilver/blackbox/-/raw/v${version}/CHANGELOG.md";
     license = licenses.gpl3Plus;
diff --git a/pkgs/applications/video/shaka-packager/default.nix b/pkgs/applications/video/shaka-packager/default.nix
new file mode 100644
index 000000000000..0bb73ee50e76
--- /dev/null
+++ b/pkgs/applications/video/shaka-packager/default.nix
@@ -0,0 +1,62 @@
+{ lib
+, stdenv
+, fetchurl
+, runCommand
+, shaka-packager
+}:
+
+let
+  sources = {
+    "x86_64-linux" = {
+      filename = "packager-linux-x64";
+      hash = "sha256-MoMX6PEtvPmloXJwRpnC2lHlT+tozsV4dmbCqweyyI0=";
+    };
+    aarch64-linux = {
+      filename = "packager-linux-arm64";
+      hash = "sha256-6+7SfnwVRsqFwI7/1F7yqVtkJVIoOFUmhoGU3P6gdQ0=";
+    };
+    x86_64-darwin = {
+      filename = "packager-osx-x64";
+      hash = "sha256-fFBtOp/Zb37LP7TWAEB0yp0xM88cMT9QS59EwW4MrAY=";
+    };
+  };
+
+  source = sources."${stdenv.hostPlatform.system}"
+    or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "shaka-packager";
+  version = "2.6.1";
+
+  src = fetchurl {
+    url = "https://github.com/shaka-project/shaka-packager/releases/download/v${finalAttrs.version}/${source.filename}";
+    inherit (source) hash;
+  };
+
+  dontUnpack = true;
+  sourceRoot = ".";
+
+  installPhase = ''
+    runHook preInstall
+
+    install -m755 -D $src $out/bin/packager
+
+    runHook postInstall
+  '';
+
+  passthru.tests = {
+    simple = runCommand "${finalAttrs.pname}-test" { } ''
+      ${shaka-packager}/bin/packager -version | grep ${finalAttrs.version} > $out
+    '';
+  };
+
+  meta = {
+    description = "Media packaging framework for VOD and Live DASH and HLS applications";
+    homepage = "https://shaka-project.github.io/shaka-packager/html/";
+    license = lib.licenses.bsd3;
+    mainProgram = "packager";
+    maintainers = with lib.maintainers; [ ];
+    platforms = builtins.attrNames sources;
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+  };
+})
diff --git a/pkgs/applications/virtualization/tart/default.nix b/pkgs/applications/virtualization/tart/default.nix
index ad0cfa8df547..89dc9fd56834 100644
--- a/pkgs/applications/virtualization/tart/default.nix
+++ b/pkgs/applications/virtualization/tart/default.nix
@@ -40,6 +40,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     homepage = "https://tart.run";
     license = licenses.fairsource09;
     maintainers = with maintainers; [ emilytrau Enzime ];
+    mainProgram = finalAttrs.pname;
     platforms = [ "aarch64-darwin" ];
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
   };
diff --git a/pkgs/applications/window-managers/river/default.nix b/pkgs/applications/window-managers/river/default.nix
index 53714a03c5c3..453dcf14d82e 100644
--- a/pkgs/applications/window-managers/river/default.nix
+++ b/pkgs/applications/window-managers/river/default.nix
@@ -86,6 +86,7 @@ stdenv.mkDerivation (finalAttrs: {
       fortuneteller2k
       rodrgz
     ];
+    mainProgram = "river";
     platforms = lib.platforms.linux;
   };
 })
diff --git a/pkgs/development/beam-modules/elixir-ls/default.nix b/pkgs/development/beam-modules/elixir-ls/default.nix
index 037aba684819..6426091d8d43 100644
--- a/pkgs/development/beam-modules/elixir-ls/default.nix
+++ b/pkgs/development/beam-modules/elixir-ls/default.nix
@@ -70,6 +70,7 @@ mixRelease  {
     '';
     license = licenses.asl20;
     platforms = platforms.unix;
+    mainProgram = "elixir-ls";
     maintainers = teams.beam.members;
   };
   passthru.updateScript = nix-update-script { };
diff --git a/pkgs/development/interpreters/octave/default.nix b/pkgs/development/interpreters/octave/default.nix
index c2e1454aef9f..b257933e0d63 100644
--- a/pkgs/development/interpreters/octave/default.nix
+++ b/pkgs/development/interpreters/octave/default.nix
@@ -112,12 +112,12 @@ let
   };
 
   self = mkDerivation rec {
-    version = "8.2.0";
+    version = "8.3.0";
     pname = "octave";
 
     src = fetchurl {
       url = "mirror://gnu/octave/${pname}-${version}.tar.gz";
-      sha256 = "sha256-V9F/kYqUDTjKM0ghHhELNNc1oyKofbccF3xGkqSanIQ=";
+      sha256 = "sha256-K0gRHLZ7MSgX5dHz4XH1utFRK7Bn4WdLnEspKBiVuXo=";
     };
 
     buildInputs = [
diff --git a/pkgs/development/python-modules/aws-lambda-builders/default.nix b/pkgs/development/python-modules/aws-lambda-builders/default.nix
index c716a56dfb24..85a668a2c22e 100644
--- a/pkgs/development/python-modules/aws-lambda-builders/default.nix
+++ b/pkgs/development/python-modules/aws-lambda-builders/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "aws-lambda-builders";
-  version = "1.36.0";
+  version = "1.37.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "awslabs";
     repo = "aws-lambda-builders";
     rev = "refs/tags/v${version}";
-    hash = "sha256-cHpeNY0WY4yai/yWw2Oy1QLLjlj8PFNdB3BMbkP31Ds=";
+    hash = "sha256-ukHDrxx+Jxlp/Ypg1ltz7WN07X16spNdC7YygJhTBJo=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/cmaes/default.nix b/pkgs/development/python-modules/cmaes/default.nix
index fdb2a1d0fcc0..88085cd2fdf9 100644
--- a/pkgs/development/python-modules/cmaes/default.nix
+++ b/pkgs/development/python-modules/cmaes/default.nix
@@ -10,15 +10,16 @@
 
 buildPythonPackage rec {
   pname = "cmaes";
-  version = "0.9.1";
-  disabled = pythonOlder "3.7";
+  version = "0.10.0";
   format = "pyproject";
 
+  disabled = pythonOlder "3.7";
+
   src = fetchFromGitHub {
     owner = "CyberAgentAILab";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-dd5vLT4Q0cI5ts0WgBpjPtOA81exGNjWSNHEiPggYbg=";
+    hash = "sha256-1mXulG/yqNwKQKDFGBh8uxIYOPSsm8+PNp++CSswc50=";
   };
 
   nativeBuildInputs = [ setuptools ];
@@ -31,6 +32,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python library for CMA evolution strategy";
     homepage = "https://github.com/CyberAgentAILab/cmaes";
+    changelog = "https://github.com/CyberAgentAILab/cmaes/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = [ maintainers.bcdarwin ];
   };
diff --git a/pkgs/development/python-modules/heudiconv/default.nix b/pkgs/development/python-modules/heudiconv/default.nix
index 2928be6ede9a..514d4e2477b6 100644
--- a/pkgs/development/python-modules/heudiconv/default.nix
+++ b/pkgs/development/python-modules/heudiconv/default.nix
@@ -1,31 +1,45 @@
 { lib
 , buildPythonPackage
-, fetchPypi
-, pythonOlder
-, pytestCheckHook
 , datalad
-, git
 , dcm2niix
-, nibabel
-, pydicom
-, nipype
 , dcmstack
 , etelemetry
+, fetchPypi
 , filelock
+, git
+, nibabel
+, nipype
+, pydicom
+, pytestCheckHook
+, pythonOlder
+, setuptools
+, versioningit
+, wheel
 }:
 
 buildPythonPackage rec {
-  version = "0.13.1";
   pname = "heudiconv";
+  version = "0.13.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-UUBRC6RToj4XVbJnxG+EKdue4NVpTAW31RNm9ieF1lU=";
+    hash = "sha256-UUBRC6RToj4XVbJnxG+EKdue4NVpTAW31RNm9ieF1lU=";
   };
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace "versioningit ~=" "versioningit >="
+  '';
+
+  nativeBuildInputs = [
+    setuptools
+    versioningit
+    wheel
+  ];
+
   propagatedBuildInputs = [
     nibabel
     pydicom
@@ -42,7 +56,13 @@ buildPythonPackage rec {
     git
   ];
 
-  preCheck = ''export HOME=$(mktemp -d)'';
+  preCheck = ''
+    export HOME=$(mktemp -d)
+  '';
+
+  pythonImportsCheck = [
+    "heudiconv"
+  ];
 
   meta = with lib; {
     homepage = "https://heudiconv.readthedocs.io";
diff --git a/pkgs/development/python-modules/jaraco-logging/default.nix b/pkgs/development/python-modules/jaraco-logging/default.nix
index e6cd8e253dd8..5e5e60b39624 100644
--- a/pkgs/development/python-modules/jaraco-logging/default.nix
+++ b/pkgs/development/python-modules/jaraco-logging/default.nix
@@ -1,24 +1,28 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, pythonOlder
 , setuptools
 , setuptools-scm
 , tempora
-, six
 }:
 
 buildPythonPackage rec {
   pname = "jaraco-logging";
-  version = "3.1.2";
+  version = "3.2.0";
   format = "pyproject";
 
+  disabled = pythonOlder "3.8";
+
   src = fetchPypi {
     pname = "jaraco.logging";
     inherit version;
-    hash = "sha256-k6cLizdnd5rWx7Vu6YV5ztd7afFqu8rnSfYsLFnmeTE=";
+    hash = "sha256-X8ssPxI1HU1QN1trYPOJnFg3sjLxotj/y6/17NK3M+c=";
   };
 
-  pythonNamespaces = [ "jaraco" ];
+  pythonNamespaces = [
+    "jaraco"
+  ];
 
   nativeBuildInputs = [
     setuptools
@@ -27,17 +31,19 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     tempora
-    six
   ];
 
   # test no longer packaged with pypi
   doCheck = false;
 
-  pythonImportsCheck = [ "jaraco.logging" ];
+  pythonImportsCheck = [
+    "jaraco.logging"
+  ];
 
   meta = with lib; {
     description = "Support for Python logging facility";
     homepage = "https://github.com/jaraco/jaraco.logging";
+    changelog = "https://github.com/jaraco/jaraco.logging/blob/v${version}/NEWS.rst";
     license = licenses.mit;
     maintainers = with maintainers; [ ];
   };
diff --git a/pkgs/development/python-modules/json-logging/default.nix b/pkgs/development/python-modules/json-logging/default.nix
index 5a56ea4fbc02..a3ac3ff7f005 100644
--- a/pkgs/development/python-modules/json-logging/default.nix
+++ b/pkgs/development/python-modules/json-logging/default.nix
@@ -46,6 +46,11 @@ buildPythonPackage rec {
     "quart"
   ];
 
+  disabledTestPaths = [
+    # Smoke tests don't always work
+    "tests/smoketests/test_run_smoketest.py"
+  ];
+
   __darwinAllowLocalNetworking = true;
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/orange3/default.nix b/pkgs/development/python-modules/orange3/default.nix
index 6c857cc07acd..cff4a603c846 100644
--- a/pkgs/development/python-modules/orange3/default.nix
+++ b/pkgs/development/python-modules/orange3/default.nix
@@ -1,21 +1,21 @@
 { lib
-, buildPythonPackage
-, copyDesktopItems
-, fetchurl
-, makeDesktopItem
-, fetchFromGitHub
-, nix-update-script
-, python
 , baycomp
 , bottleneck
+, buildPythonPackage
 , chardet
+, copyDesktopItems
 , cython
+, fetchFromGitHub
+, fetchurl
 , httpx
 , joblib
 , keyring
 , keyrings-alt
+, makeDesktopItem
 , matplotlib
+, nix-update-script
 , numpy
+, oldest-supported-numpy
 , openpyxl
 , opentsne
 , orange-canvas-core
@@ -23,25 +23,32 @@
 , pandas
 , pyqtgraph
 , pyqtwebengine
+, python
 , python-louvain
+, pythonOlder
 , pyyaml
 , qt5
 , qtconsole
+, recommonmark
 , requests
 , scikit-learn
 , scipy
-, sphinx
 , serverfiles
+, setuptools
+, sphinx
+, wheel
 , xlrd
 , xlsxwriter
 }:
 
 let
-self = buildPythonPackage rec {
+  self = buildPythonPackage rec {
     pname = "orange3";
     version = "3.35.0";
     format = "pyproject";
 
+    disabled = pythonOlder "3.7";
+
     src = fetchFromGitHub {
       owner = "biolab";
       repo = "orange3";
@@ -50,6 +57,8 @@ self = buildPythonPackage rec {
     };
 
     postPatch = ''
+      substituteInPlace pyproject.toml \
+        --replace "setuptools>=41.0.0,<50.0" "setuptools"
       sed -i 's;\(scikit-learn\)[^$]*;\1;g' requirements-core.txt
       sed -i 's;pyqtgraph[^$]*;;g' requirements-gui.txt # TODO: remove after bump with a version greater than 0.13.1
     '';
@@ -57,8 +66,12 @@ self = buildPythonPackage rec {
     nativeBuildInputs = [
       copyDesktopItems
       cython
+      oldest-supported-numpy
       qt5.wrapQtAppsHook
+      recommonmark
+      setuptools
       sphinx
+      wheel
     ];
 
     enableParallelBuilding = true;
@@ -153,12 +166,14 @@ self = buildPythonPackage rec {
       });
     };
 
-    meta = {
-      mainProgram = "orange-canvas";
+    meta = with lib; {
       description = "Data mining and visualization toolbox for novice and expert alike";
       homepage = "https://orangedatamining.com/";
-      license = [ lib.licenses.gpl3Plus ];
-      maintainers = [ lib.maintainers.lucasew ];
+      changelog = "https://github.com/biolab/orange3/blob/${version}/CHANGELOG.md";
+      license = with licenses; [ gpl3Plus ];
+      maintainers = with maintainers; [ lucasew ];
+      mainProgram = "orange-canvas";
     };
   };
-in self
+in
+self
diff --git a/pkgs/development/python-modules/peaqevcore/default.nix b/pkgs/development/python-modules/peaqevcore/default.nix
index e92022ecd68a..b759ccfae4f8 100644
--- a/pkgs/development/python-modules/peaqevcore/default.nix
+++ b/pkgs/development/python-modules/peaqevcore/default.nix
@@ -6,14 +6,14 @@
 
 buildPythonPackage rec {
   pname = "peaqevcore";
-  version = "19.2.0";
+  version = "19.2.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-1j1QQo8hTUM7CzDUiRvOUWImb+rGIQgPWl69hTvlZUo=";
+    hash = "sha256-4HLRZSxeRqpe8xutu5sGO63LAStx+3OgkQ1qPH1CUDY=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/prettytable/default.nix b/pkgs/development/python-modules/prettytable/default.nix
index 149556c125e5..b0efbcb373d4 100644
--- a/pkgs/development/python-modules/prettytable/default.nix
+++ b/pkgs/development/python-modules/prettytable/default.nix
@@ -1,27 +1,26 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, pythonOlder
 , hatch-vcs
 , hatchling
-, wcwidth
-, importlib-metadata
 , pytest-lazy-fixture
 , pytestCheckHook
+, pythonOlder
+, wcwidth
 }:
 
 buildPythonPackage rec {
   pname = "prettytable";
-  version = "3.5.0";
+  version = "3.8.0";
   format = "pyproject";
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "jazzband";
     repo = "prettytable";
     rev = "refs/tags/${version}";
-    hash= "sha256-J6oWNug2MEkUZSi67mM5H/Nf4tdSTB/ku34plp1XWCM=";
+    hash= "sha256-JnxUjUosQJgprIbA9szSfw1Fi21Qc4WljoRAQv4x5YM=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
@@ -33,8 +32,6 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     wcwidth
-  ] ++ lib.optionals (pythonOlder "3.8") [
-    importlib-metadata
   ];
 
   nativeCheckInputs = [
@@ -47,9 +44,9 @@ buildPythonPackage rec {
   ];
 
   meta = with lib; {
-    changelog = "https://github.com/jazzband/prettytable/releases/tag/${version}";
     description = "Display tabular data in a visually appealing ASCII table format";
     homepage = "https://github.com/jazzband/prettytable";
+    changelog = "https://github.com/jazzband/prettytable/releases/tag/${version}";
     license = licenses.bsd3;
     maintainers = with maintainers; [ ];
   };
diff --git a/pkgs/development/python-modules/pyinstrument/default.nix b/pkgs/development/python-modules/pyinstrument/default.nix
index 9dfe3b82cb55..4cc60efbc637 100644
--- a/pkgs/development/python-modules/pyinstrument/default.nix
+++ b/pkgs/development/python-modules/pyinstrument/default.nix
@@ -2,19 +2,30 @@
 , lib
 , buildPythonPackage
 , fetchFromGitHub
+, pythonOlder
+, setuptools
+, wheel
 }:
 
 buildPythonPackage rec {
   pname = "pyinstrument";
-  version = "4.5.0";
+  version = "4.5.2";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "joerick";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-HvPapa3b9/Wc4ClaMOmCAIeHS7H4V9aCR9JCDol2ElE=";
+    hash = "sha256-VL/JzgMxn5zABfmol+5oofR1RjyxTdzvUi6JnwsSFao=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+    wheel
+  ];
+
   # Module import recursion
   doCheck = false;
 
@@ -25,6 +36,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Call stack profiler for Python";
     homepage = "https://github.com/joerick/pyinstrument";
+    changelog = "https://github.com/joerick/pyinstrument/releases/tag/v${version}";
     license = licenses.bsd3;
     maintainers = with maintainers; [ onny ];
   };
diff --git a/pkgs/development/python-modules/pyramid/default.nix b/pkgs/development/python-modules/pyramid/default.nix
index a5dbfd521d62..a2b24faf10db 100644
--- a/pkgs/development/python-modules/pyramid/default.nix
+++ b/pkgs/development/python-modules/pyramid/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "pyramid";
-  version = "2.0.1";
+  version = "2.0.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-+r/XRQOeJq1bCRX8OW6HJcD4o9F7lB+WEezR7XbP59o=";
+    hash = "sha256-NyE4pzjkIWU1zHbczm7d1aGqypUTDyNU+4NCZMBvGN4=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pytapo/default.nix b/pkgs/development/python-modules/pytapo/default.nix
index 7d026e0625ba..f27757b4784e 100644
--- a/pkgs/development/python-modules/pytapo/default.nix
+++ b/pkgs/development/python-modules/pytapo/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "pytapo";
-  version = "3.1.18";
+  version = "3.2.14";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-pYzp/iQHTXS+ovtWIwOoUfYg/h/46ZLNZyevK2vQHEA=";
+    hash = "sha256-V/D+eE6y1kCMZmp9rIcvS/wdcSyW3mYWEJqpCb74NtY=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pytibber/default.nix b/pkgs/development/python-modules/pytibber/default.nix
index 2701f7e64f1d..f18402db6bb0 100644
--- a/pkgs/development/python-modules/pytibber/default.nix
+++ b/pkgs/development/python-modules/pytibber/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "pytibber";
-  version = "0.28.1";
+  version = "0.28.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "Danielhiversen";
     repo = "pyTibber";
     rev = "refs/tags/${version}";
-    hash = "sha256-ZEdBV+X9Ib1JvE8nzey+er7GrQMAV79zqn8ssC+kKdU=";
+    hash = "sha256-vi5f4V0nPb9K3nwdmwMDoNE85Or6haOWjMY4d/2Fj2s=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/requirements-detector/default.nix b/pkgs/development/python-modules/requirements-detector/default.nix
index c86ed090919d..5acc7ae6ae26 100644
--- a/pkgs/development/python-modules/requirements-detector/default.nix
+++ b/pkgs/development/python-modules/requirements-detector/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "requirements-detector";
-  version = "1.1.0";
+  version = "1.2.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -20,8 +20,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "landscapeio";
     repo = pname;
-    rev = version;
-    hash = "sha256-H+h/PN1TrlpDRgI7tMWUhXlxj4CChwcxIR/BvyO261c=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-qmrHFQRypBJOI1N6W/Dtc5ss9JGqoPhFlbqrLHcb6vc=";
   };
 
   nativeBuildInputs = [
@@ -46,6 +46,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python tool to find and list requirements of a Python project";
     homepage = "https://github.com/landscapeio/requirements-detector";
+    changelog = "https://github.com/landscapeio/requirements-detector/releases/tag/${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ kamadorueda ];
   };
diff --git a/pkgs/development/python-modules/returns/default.nix b/pkgs/development/python-modules/returns/default.nix
index 0b54d62ba569..2e0275bd8040 100644
--- a/pkgs/development/python-modules/returns/default.nix
+++ b/pkgs/development/python-modules/returns/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "returns";
-  version = "0.21.0";
+  version = "0.22.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "dry-python";
     repo = "returns";
     rev = "refs/tags/${version}";
-    hash = "sha256-oYOCoh/pF2g4KGWC2mEnFD+zm2CKL+3x5JjzuZ3QHVQ=";
+    hash = "sha256-0eFirhBsj8SWfoAPWEMuFa+EvBgHKpNeKVj3qJ4L6hE=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/rich-argparse/default.nix b/pkgs/development/python-modules/rich-argparse/default.nix
index 5578acbe5b69..0fde4435543d 100644
--- a/pkgs/development/python-modules/rich-argparse/default.nix
+++ b/pkgs/development/python-modules/rich-argparse/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "rich-argparse";
-  version = "1.1.0";
+  version = "1.3.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "hamdanal";
     repo = "rich-argparse";
     rev = "v${version}";
-    hash = "sha256-Rnv4A9pZ5VHpNjrWnsKyxQ4ISCLjIUu3tbbOzP4uFuw=";
+    hash = "sha256-WAqFhH9gUwDZuORJ++fKjCmaCurdYpep3WPq68tWJ4U=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/riscv-config/default.nix b/pkgs/development/python-modules/riscv-config/default.nix
index 409c3a0d7ed1..7ded790ec53e 100644
--- a/pkgs/development/python-modules/riscv-config/default.nix
+++ b/pkgs/development/python-modules/riscv-config/default.nix
@@ -1,38 +1,44 @@
-{ buildPythonPackage
+{ lib
+, buildPythonPackage
+, cerberus
 , fetchFromGitHub
 , fetchpatch
-, lib
-, cerberus
+, pythonOlder
 , pyyaml
 , ruamel-yaml
 }:
 
 buildPythonPackage rec {
   pname = "riscv-config";
-  version = "3.5.2";
+  version = "3.13.1";
   format = "setuptools";
 
+  disabled = pythonOlder "3.7";
+
   src = fetchFromGitHub {
     owner = "riscv-software-src";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-K7W6yyqy/2c4WHyOojuvw2P/v7bND5K6WFfTujkofBw=";
+    hash = "sha256-SnUt6bsTEC7abdQr0nWyNOAJbW64B1K3yy1McfkdxAc=";
   };
 
-  patches = [
-    # Remove when updating to v3.8.0+
-    (fetchpatch {
-      name = "remove-dangling-pip-import.patch";
-      url = "https://github.com/riscv-software-src/riscv-config/commit/f75e7e13fe600b71254b0391be015ec533d3c3ef.patch";
-      hash = "sha256-oVRynBIJevq3UzlMDRh2rVuBJZoEwEYhDma3Bb/QV2E=";
-    })
+  propagatedBuildInputs = [
+    cerberus
+    pyyaml
+    ruamel-yaml
   ];
 
-  propagatedBuildInputs = [ cerberus pyyaml ruamel-yaml ];
+  # Module has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "riscv_config"
+  ];
 
   meta = with lib; {
-    homepage = "https://github.com/riscv/riscv-config";
     description = "RISC-V configuration validator";
+    homepage = "https://github.com/riscv/riscv-config";
+    changelog = "https://github.com/riscv-software-src/riscv-config/blob/${version}/CHANGELOG.md";
     maintainers = with maintainers; [ genericnerdyusername ];
     license = licenses.bsd3;
   };
diff --git a/pkgs/development/python-modules/schema-salad/default.nix b/pkgs/development/python-modules/schema-salad/default.nix
index 16d6c6120da1..b61a5e2e7bce 100644
--- a/pkgs/development/python-modules/schema-salad/default.nix
+++ b/pkgs/development/python-modules/schema-salad/default.nix
@@ -1,29 +1,30 @@
 { lib
 , black
 , buildPythonPackage
-, fetchPypi
-, setuptools-scm
 , cachecontrol
+, fetchPypi
+, importlib-resources
 , lockfile
 , mistune
 , mypy
+, pytestCheckHook
+, pythonOlder
 , rdflib
 , ruamel-yaml
 , setuptools
-, pytestCheckHook
-, pythonOlder
+, setuptools-scm
 }:
 
 buildPythonPackage rec {
   pname = "schema-salad";
-  version = "8.4.20230606143604";
+  version = "8.4.20230808163024";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-8Zo9ZhS0r+zsk7nHEh0x7gHYwaoWmyctQYRMph09mvY=";
+    hash = "sha256-ai4vv6EFX4yTR8sgRspiG+M8a8oa83LIlJPGX7q+Kd0=";
   };
 
   nativeBuildInputs = [
@@ -32,6 +33,7 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     cachecontrol
+    importlib-resources
     lockfile
     mistune
     mypy
diff --git a/pkgs/development/python-modules/slack-bolt/default.nix b/pkgs/development/python-modules/slack-bolt/default.nix
index 30cf185c1aa7..f732da1d5d3f 100644
--- a/pkgs/development/python-modules/slack-bolt/default.nix
+++ b/pkgs/development/python-modules/slack-bolt/default.nix
@@ -1,4 +1,6 @@
-{ buildPythonPackage
+{ aiohttp
+, bottle
+, buildPythonPackage
 , chalice
 , cherrypy
 , django
@@ -7,17 +9,23 @@
 , fetchFromGitHub
 , flask
 , flask-sockets
+, gunicorn
 , lib
 , moto
 , numpy
 , pyramid
 , pytest-asyncio
 , pytestCheckHook
+, pythonOlder
 , sanic
 , sanic-testing
 , slack-sdk
 , starlette
 , tornado
+, uvicorn
+, websocket-client
+, websockets
+, werkzeug
 }:
 
 buildPythonPackage rec {
@@ -25,6 +33,8 @@ buildPythonPackage rec {
   version = "1.18.0";
   format = "setuptools";
 
+  disabled = pythonOlder "3.7";
+
   src = fetchFromGitHub {
     owner = "slackapi";
     repo = "bolt-python";
@@ -40,23 +50,37 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [ slack-sdk ];
 
+  passthru.optional-dependencies = {
+    async = [
+      aiohttp
+      websockets
+    ];
+    adapter = [
+      bottle
+      chalice
+      cherrypy
+      django
+      falcon
+      fastapi
+      flask
+      flask-sockets
+      gunicorn
+      moto
+      pyramid
+      sanic
+      sanic-testing
+      starlette
+      tornado
+      uvicorn
+      websocket-client
+      werkzeug
+    ];
+  };
+
   nativeCheckInputs = [
-    chalice
-    cherrypy
-    django
-    falcon
-    fastapi
-    flask
-    flask-sockets
-    moto
-    pyramid
     pytest-asyncio
     pytestCheckHook
-    sanic
-    sanic-testing
-    starlette
-    tornado
-  ];
+  ] ++ lib.flatten (builtins.attrValues passthru.optional-dependencies);
 
   # Work around "Read-only file system: '/homeless-shelter'" errors
   preCheck = ''
@@ -66,6 +90,9 @@ buildPythonPackage rec {
   disabledTestPaths = [
     # boddle is not packaged as of 2023-07-15
     "tests/adapter_tests/bottle/"
+    # Tests are blocking at some point. Blocking could be performance-related.
+    "tests/scenario_tests_async/"
+    "tests/slack_bolt_async/"
   ];
 
   disabledTests = [
@@ -82,6 +109,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "A framework to build Slack apps using Python";
     homepage = "https://github.com/slackapi/bolt-python";
+    changelog = "https://github.com/slackapi/bolt-python/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ samuela ];
   };
diff --git a/pkgs/development/python-modules/snscrape/default.nix b/pkgs/development/python-modules/snscrape/default.nix
index 5d87fb52b2ab..cb07518e95d7 100644
--- a/pkgs/development/python-modules/snscrape/default.nix
+++ b/pkgs/development/python-modules/snscrape/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "snscrape";
-  version = "0.6.0.20230303";
+  version = "0.7.0.20230622";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "JustAnotherArchivist";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-FY8byS+0yAhNSRxWsrsQMR5kdZmnHutru5Z6SWVfpiE=";
+    hash = "sha256-9xAUMr1SWFePEvIz6DFEexk9Txex3u8wPNfMAdxEUCA=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
diff --git a/pkgs/development/python-modules/tlds/default.nix b/pkgs/development/python-modules/tlds/default.nix
index e9e71fcd5e59..1b001cd53659 100644
--- a/pkgs/development/python-modules/tlds/default.nix
+++ b/pkgs/development/python-modules/tlds/default.nix
@@ -5,14 +5,14 @@
 
 buildPythonPackage rec {
   pname = "tlds";
-  version = "2023050900";
+  version = "2023080900";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "kichik";
     repo = "tlds";
     rev = "refs/tags/${version}";
-    hash = "sha256-Fm2cRhUb1Gsr7mrcym/JjYAeG8f3RDhUnxzYIvpxmQE=";
+    hash = "sha256-n6SGOBkwGrjnH01yFd9giODUDkPGVMwB1H/fozzwQwU=";
   };
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/vncdo/default.nix b/pkgs/development/python-modules/vncdo/default.nix
index ef33a46cc34c..b6d12a67185c 100644
--- a/pkgs/development/python-modules/vncdo/default.nix
+++ b/pkgs/development/python-modules/vncdo/default.nix
@@ -6,6 +6,7 @@
 , nose
 , ptyprocess
 }:
+
 buildPythonPackage rec {
   pname = "vncdo";
   version = "0.12.0";
@@ -32,7 +33,7 @@ buildPythonPackage rec {
     description = "A command line VNC client and python library";
     license = licenses.mit;
     maintainers = with maintainers; [ elitak ];
+    mainProgram = pname;
     platforms = with platforms; linux ++ darwin;
   };
-
 }
diff --git a/pkgs/development/tools/continuous-integration/github-runner/default.nix b/pkgs/development/tools/continuous-integration/github-runner/default.nix
index 6ccc923ec30d..0b1a21c2852b 100644
--- a/pkgs/development/tools/continuous-integration/github-runner/default.nix
+++ b/pkgs/development/tools/continuous-integration/github-runner/default.nix
@@ -9,21 +9,28 @@
 , glibcLocales
 , lib
 , nixosTests
-, nodejs_16
 , stdenv
 , which
 , buildPackages
 , runtimeShell
+  # List of Node.js runtimes the package should support
+, nodeRuntimes ? [ "node20" ]
+, nodejs_16
+, nodejs_20
 }:
+
+# Node.js runtimes supported by upstream
+assert builtins.all (x: builtins.elem x [ "node16" "node20" ]) nodeRuntimes;
+
 buildDotnetModule rec {
   pname = "github-runner";
-  version = "2.307.1";
+  version = "2.308.0";
 
   src = fetchFromGitHub {
     owner = "actions";
     repo = "runner";
     rev = "v${version}";
-    hash = "sha256-h/JcOw7p/loBD6aj7NeZyqK3GtapNkjWTYw0G6OCmVQ=";
+    hash = "sha256-LrHScQbBkRPSNsfPxvE2+K9tON8xuR0e4JpKVuI+Gu0=";
     leaveDotGit = true;
     postFetch = ''
       git -C $out rev-parse --short HEAD > $out/.git-revision
@@ -31,7 +38,7 @@ buildDotnetModule rec {
     '';
   };
 
-  # The git commit is read during the build and some tests depends on a git repo to be present
+  # The git commit is read during the build and some tests depend on a git repo to be present
   # https://github.com/actions/runner/blob/22d1938ac420a4cb9e3255e47a91c2e43c38db29/src/dir.proj#L5
   unpackPhase = ''
     cp -r $src $TMPDIR/src
@@ -178,6 +185,7 @@ buildDotnetModule rec {
     ++ lib.optionals (stdenv.hostPlatform.system == "aarch64-linux") [
       # "JavaScript Actions in Alpine containers are only supported on x64 Linux runners. Detected Linux Arm64"
       "GitHub.Runner.Common.Tests.Worker.StepHostL0.DetermineNodeRuntimeVersionInAlpineContainerAsync"
+      "GitHub.Runner.Common.Tests.Worker.StepHostL0.DetermineNode20RuntimeVersionInAlpineContainerAsync"
     ]
     ++ lib.optionals DOTNET_SYSTEM_GLOBALIZATION_INVARIANT [
       "GitHub.Runner.Common.Tests.ProcessExtensionL0.SuccessReadProcessEnv"
@@ -185,13 +193,19 @@ buildDotnetModule rec {
       "GitHub.Runner.Common.Tests.Worker.VariablesL0.Constructor_SetsOrdinalIgnoreCaseComparer"
       "GitHub.Runner.Common.Tests.Worker.WorkerL0.DispatchCancellation"
       "GitHub.Runner.Common.Tests.Worker.WorkerL0.DispatchRunNewJob"
+    ]
+    ++ lib.optionals (!lib.elem "node16" nodeRuntimes) [
+      "GitHub.Runner.Common.Tests.ProcessExtensionL0.SuccessReadProcessEnv"
     ];
 
   testProjectFile = [ "src/Test/Test.csproj" ];
 
   preCheck = ''
     mkdir -p _layout/externals
+  '' + lib.optionalString (lib.elem "node16" nodeRuntimes) ''
     ln -s ${nodejs_16} _layout/externals/node16
+  '' + lib.optionalString (lib.elem "node20" nodeRuntimes) ''
+    ln -s ${nodejs_20} _layout/externals/node20
   '';
 
   postInstall = ''
@@ -224,12 +238,15 @@ buildDotnetModule rec {
       --replace './externals' "$out/lib/externals" \
       --replace './bin/RunnerService.js' "$out/lib/github-runner/RunnerService.js"
 
-    # The upstream package includes Node 16 and expects it at the path
-    # externals/node16. As opposed to the official releases, we don't
+    # The upstream package includes Node and expects it at the path
+    # externals/node$version. As opposed to the official releases, we don't
     # link the Alpine Node flavors.
     mkdir -p $out/lib/externals
+  '' + lib.optionalString (lib.elem "node16" nodeRuntimes) ''
     ln -s ${nodejs_16} $out/lib/externals/node16
-
+  '' + lib.optionalString (lib.elem "node20" nodeRuntimes) ''
+    ln -s ${nodejs_20} $out/lib/externals/node20
+  '' + ''
     # Install Nodejs scripts called from workflows
     install -D src/Misc/layoutbin/hashFiles/index.js $out/lib/github-runner/hashFiles/index.js
     mkdir -p $out/lib/github-runner/checkScripts
diff --git a/pkgs/development/tools/language-servers/verible/default.nix b/pkgs/development/tools/language-servers/verible/default.nix
index c486cf38efee..4b2731167157 100644
--- a/pkgs/development/tools/language-servers/verible/default.nix
+++ b/pkgs/development/tools/language-servers/verible/default.nix
@@ -1,10 +1,10 @@
 { lib
 , stdenv
-, fetchFromGitHub
 , buildBazelPackage
+, fetchFromGitHub
 , bazel_4
-, flex
 , bison
+, flex
 , python3
 }:
 
@@ -17,8 +17,8 @@ buildBazelPackage rec {
   # These environment variables are read in bazel/build-version.py to create
   # a build string shown in the tools --version output.
   # If env variables not set, it would attempt to extract it from .git/.
-  GIT_DATE = "2023-05-05";
-  GIT_VERSION = "v0.0-3253-gf85c768c";
+  GIT_DATE = "2023-08-29";
+  GIT_VERSION = "v0.0-3410-g398a8505";
 
   # Derive nix package version from GIT_VERSION: "v1.2-345-abcde" -> "1.2.345"
   version = builtins.concatStringsSep "." (lib.take 3 (lib.drop 1 (builtins.splitVersion GIT_VERSION)));
@@ -27,7 +27,7 @@ buildBazelPackage rec {
     owner = "chipsalliance";
     repo = "verible";
     rev = "${GIT_VERSION}";
-    sha256 = "sha256-scLYQQt6spBImJEYG60ZbIsUfKqWBj2DINjZgFKESoI=";
+    sha256 = "sha256-qi//Dssgg5ITrL5jCpZXpSrhSm2xCqe53D9ctK7SQoU=";
   };
 
   patches = [
@@ -37,6 +37,7 @@ buildBazelPackage rec {
     ./remove-unused-deps.patch
   ];
 
+  bazel = bazel_4;
   bazelFlags = [
     "--//bazel:use_local_flex_bison"
     "--javabase=@bazel_tools//tools/jdk:remote_jdk11"
@@ -49,14 +50,14 @@ buildBazelPackage rec {
     # of the output derivation ? Is there a more robust way to do this ?
     # (Hashes extracted from the ofborg build logs)
     sha256 = {
-      aarch64-linux = "sha256-BrJyFeq3BB4sHIXMMxRIaYV+VJAfTs2bvK7pnw6faBY=";
-      x86_64-linux = "sha256-G6tqHWeQBi2Ph3IDFNu2sp+UU2BO93+lcyJ+kvpuRJo=";
+      aarch64-linux = "sha256-Hf/jF5Y7QS2ZNFmSx2LIb0b6gdjditE97HwWGqQJac8=";
+      x86_64-linux = "sha256-WBp5Fi5vvKLVgRWvQ3VB7sY6ySpbwCdhU5KqZH9sLy4=";
     }.${system} or (throw "No hash for system: ${system}");
   };
 
   nativeBuildInputs = [
-    flex       # We use local flex and bison as WORKSPACE sources fail
-    bison      # .. to compile with newer glibc
+    bison      # We use local flex and bison as WORKSPACE sources fail
+    flex       # .. to compile with newer glibc
     python3
   ];
 
@@ -72,7 +73,6 @@ buildBazelPackage rec {
       verilog/tools
   '';
 
-  bazel = bazel_4;
   removeRulesCC = false;
   bazelTargets = [ ":install-binaries" ];
   bazelTestTargets = [ "//..." ];
@@ -99,10 +99,10 @@ buildBazelPackage rec {
   };
 
   meta = with lib; {
-    homepage = "https://github.com/chipsalliance/verible";
     description = "Suite of SystemVerilog developer tools. Including a style-linter, indexer, formatter, and language server.";
+    homepage = "https://github.com/chipsalliance/verible";
     license = licenses.asl20;
-    platforms = platforms.linux;
     maintainers = with maintainers; [ hzeller newam ];
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/development/tools/misc/coreboot-toolchain/default.nix b/pkgs/development/tools/misc/coreboot-toolchain/default.nix
index dc96f6e3c6ce..66eff5e2427c 100644
--- a/pkgs/development/tools/misc/coreboot-toolchain/default.nix
+++ b/pkgs/development/tools/misc/coreboot-toolchain/default.nix
@@ -17,14 +17,14 @@ let
     , withAda ? true
     }:
 
-    stdenvNoCC.mkDerivation rec {
+    stdenvNoCC.mkDerivation {
       pname = "coreboot-toolchain-${arch}";
-      version = "4.20";
+      version = "4.21";
 
       src = fetchgit {
         url = "https://review.coreboot.org/coreboot";
-        rev = "465fbbe93ee01b4576689a90b7ddbeec23cdace2";
-        hash = "sha256-vzXOl+Z8VYh9Iq6+AMNb3apMv185J3mODauKMinSOI4=";
+        rev = "c1386ef6128922f49f93de5690ccd130a26eecf2";
+        hash = "sha256-tFGyI170vbhRgJZDix69DfOD5nIY8T4chSP+qTt3kC8=";
         fetchSubmodules = false;
         leaveDotGit = true;
         postFetch = ''
diff --git a/pkgs/development/tools/misc/coreboot-toolchain/stable.nix b/pkgs/development/tools/misc/coreboot-toolchain/stable.nix
index a432aab59e78..d4419687ebee 100644
--- a/pkgs/development/tools/misc/coreboot-toolchain/stable.nix
+++ b/pkgs/development/tools/misc/coreboot-toolchain/stable.nix
@@ -21,10 +21,10 @@
     };
   }
   {
-    name = "gcc-11.3.0.tar.xz";
+    name = "gcc-11.4.0.tar.xz";
     archive = fetchurl {
-      sha256 = "0fdclcwf728wbq52vphfcjywzhpsjp3kifzj3pib3xcihs0z4z5l";
-      url = "mirror://gnu/gcc/gcc-11.3.0/gcc-11.3.0.tar.xz";
+      sha256 = "1ncd7akww0hl5kkmw1dj3qgqp3phdrr5dfnm7jia9s07n0ib4b9z";
+      url = "mirror://gnu/gcc/gcc-11.4.0/gcc-11.4.0.tar.xz";
     };
   }
   {
@@ -35,17 +35,17 @@
     };
   }
   {
-    name = "R10_20_22.tar.gz";
+    name = "R06_28_23.tar.gz";
     archive = fetchurl {
-      sha256 = "11iv3jrz27g7bv7ffyxsrgm4cq60cld2gkkl008p3lcwfyqpx88s";
-      url = "https://github.com/acpica/acpica/archive/refs/tags/R10_20_22.tar.gz";
+      sha256 = "0cadxihshyrjplrx01vna13r1m2f6lj1klw7mh8pg2m0gjdpjj12";
+      url = "https://github.com/acpica/acpica/archive/refs/tags/R06_28_23.tar.gz";
     };
   }
   {
-    name = "nasm-2.15.05.tar.bz2";
+    name = "nasm-2.16.01.tar.bz2";
     archive = fetchurl {
-      sha256 = "1l1gxs5ncdbgz91lsl4y7w5aapask3w02q9inayb2m5bwlwq6jrw";
-      url = "https://www.nasm.us/pub/nasm/releasebuilds/2.15.05/nasm-2.15.05.tar.bz2";
+      sha256 = "0bmv8xbzck7jim7fzm6jnwiahqkprbpz6wzhg53irm28w0pavdim";
+      url = "https://www.nasm.us/pub/nasm/releasebuilds/2.16.01/nasm-2.16.01.tar.bz2";
     };
   }
 ]
diff --git a/pkgs/misc/screensavers/xss-lock/default.nix b/pkgs/misc/screensavers/xss-lock/default.nix
index ec7e8f4e7e5c..88b4b6b795f3 100644
--- a/pkgs/misc/screensavers/xss-lock/default.nix
+++ b/pkgs/misc/screensavers/xss-lock/default.nix
@@ -18,6 +18,7 @@ stdenv.mkDerivation {
   meta = with lib; {
     description = "Use external locker (such as i3lock) as X screen saver";
     license = licenses.mit;
+    mainProgram = "xss-lock";
     maintainers = with maintainers; [ malyn offline ];
     platforms = platforms.linux;
   };
diff --git a/pkgs/os-specific/linux/kernel/linux-4.14.nix b/pkgs/os-specific/linux/kernel/linux-4.14.nix
index 6c18db7f7a4e..5e11b6f25a72 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.14.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.14.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "4.14.323";
+  version = "4.14.324";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1g2fh0mn1sv0kq2hh3pynmx2fjai7hdwhf4fnaspl7j5n88902kg";
+    sha256 = "1w6rw48iddawig9ga8zw1shiylcwslir2vd53qlp1wm08wbb5s14";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.19.nix b/pkgs/os-specific/linux/kernel/linux-4.19.nix
index cce6ec86f6ee..67f165a138ae 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.19.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.19.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "4.19.292";
+  version = "4.19.293";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0dr12v4jqmzxcqdghqqjny5zp3g4dx9lxqrl9d4fxz23s79ji5rl";
+    sha256 = "1w5kfq3mmjrmcpd8aqklh1zc7arnq0askf2r4gilkdzgiz5si5fd";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.10.nix b/pkgs/os-specific/linux/kernel/linux-5.10.nix
index f4d80ce0153f..3d9ac3ffa48d 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.10.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.10.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.10.192";
+  version = "5.10.193";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "1fdmn38l3hilpqwjl2sr28rjpr2k3jxd3nxs54j162p5avp123f4";
+    sha256 = "1l6yy409s32kqs7sm10hnpinm6cc1rqffhwcby60sbb18zd3ch5x";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.15.nix b/pkgs/os-specific/linux/kernel/linux-5.15.nix
index 2efbc4036510..fab60f1951bc 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.15.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.15.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.15.128";
+  version = "5.15.129";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "1pl03djrfa7bqzpcvqlfgqnwx6iby6bpr1hc7gspdzc3a62clbhg";
+    sha256 = "0ribh1jalbnapfrjzjk5kqg6nypalkn5ayin5cwkwiziwiycj3km";
   };
 } // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.4.nix b/pkgs/os-specific/linux/kernel/linux-5.4.nix
index d72ffa980e77..5be74ef225ed 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.4.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.4.254";
+  version = "5.4.255";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "1iyrm2xql15ifhy2b939ywrrc44yd41b79sjjim4vqxmc6lqsq2i";
+    sha256 = "0qd0lil0k4kd2qp4by8i861n19iz1pdvimnmp4khzna75y8fvm9l";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-6.1.nix b/pkgs/os-specific/linux/kernel/linux-6.1.nix
index 6859e537de7d..5c41f3936c66 100644
--- a/pkgs/os-specific/linux/kernel/linux-6.1.nix
+++ b/pkgs/os-specific/linux/kernel/linux-6.1.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "6.1.49";
+  version = "6.1.50";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v6.x/linux-${version}.tar.xz";
-    sha256 = "03vs0ncpxx12d2pm0glxa68lqkj17j69lcx9h8w6xjm43hii9sn9";
+    sha256 = "1328ikvzj0dsgx00g1ziyv0ddj1bh3cnf7zf8v2knmpa7r2c2ymj";
   };
 } // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-6.4.nix b/pkgs/os-specific/linux/kernel/linux-6.4.nix
index c1a9d6abff59..40224f0052b3 100644
--- a/pkgs/os-specific/linux/kernel/linux-6.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-6.4.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "6.4.12";
+  version = "6.4.13";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v6.x/linux-${version}.tar.xz";
-    sha256 = "0x56b4hslm730ghvggz41fjkbzlnxp6k8857dn7iy27yavlipafc";
+    sha256 = "1rf8bbgf1vam4m5sbmvb5ka9d8sy7jmnyx6pnn5kbzf91fsi2may";
   };
 } // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-rt-5.4.nix b/pkgs/os-specific/linux/kernel/linux-rt-5.4.nix
index 064922fb3550..cd1249605ec3 100644
--- a/pkgs/os-specific/linux/kernel/linux-rt-5.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-5.4.nix
@@ -6,7 +6,7 @@
 , ... } @ args:
 
 let
-  version = "5.4.248-rt83"; # updated by ./update-rt.sh
+  version = "5.4.254-rt85"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
@@ -14,14 +14,14 @@ in buildLinux (args // {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${kversion}.tar.xz";
-    sha256 = "0d9yn51rg59k39h0w6wmvjqz9n7najm9x8yb79rparbcwwrd3gis";
+    sha256 = "1iyrm2xql15ifhy2b939ywrrc44yd41b79sjjim4vqxmc6lqsq2i";
   };
 
   kernelPatches = let rt-patch = {
     name = "rt";
     patch = fetchurl {
       url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "1rr4vnynxwmlgnm5xq1m0xhykh72lkv2lsginbh5nk60k3qwizh2";
+      sha256 = "0vq5lrqqy7yspznbbkla2cjakz7w1n8qvg31a856qs6abynwrw6x";
     };
   }; in [ rt-patch ] ++ kernelPatches;
 
diff --git a/pkgs/os-specific/linux/nmon/default.nix b/pkgs/os-specific/linux/nmon/default.nix
index 4dfacd4404fd..768e8e43edc9 100644
--- a/pkgs/os-specific/linux/nmon/default.nix
+++ b/pkgs/os-specific/linux/nmon/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "nmon";
-  version = "16n";
+  version = "16p";
 
   src = fetchurl {
     url = "mirror://sourceforge/nmon/lmon${version}.c";
-    sha256 = "1wpm2f30414b87kpbr9hbidblr5cmfby5skwqd0fkpi5v712q0f0";
+    sha256 = "sha256-XcYEX2cl4ySalpkY+uaWY6HWaRYgh3ILq825D86eayo=";
   };
 
   buildInputs = [ ncurses ];
diff --git a/pkgs/servers/monitoring/grafana/default.nix b/pkgs/servers/monitoring/grafana/default.nix
index 980e95f57fb3..94277e9771ee 100644
--- a/pkgs/servers/monitoring/grafana/default.nix
+++ b/pkgs/servers/monitoring/grafana/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "grafana";
-  version = "10.1.0";
+  version = "10.1.1";
 
   excludedPackages = [ "alert_webhook_listener" "clean-swagger" "release_publisher" "slow_proxy" "slow_proxy_mac" "macaron" "devenv" "modowners" ];
 
@@ -10,15 +10,15 @@ buildGoModule rec {
     rev = "v${version}";
     owner = "grafana";
     repo = "grafana";
-    hash = "sha256-u+Jug4U2dq6naHRMOwpm7/18o6Kk9/6fw/42XLT7C1s=";
+    hash = "sha256-XktCIGuCyzU9RqmkFtonobwLZcSrfELZfeVcLtkM/O4=";
   };
 
   srcStatic = fetchurl {
     url = "https://dl.grafana.com/oss/release/grafana-${version}.linux-amd64.tar.gz";
-    hash = "sha256-QFRahjDyL7BNikK2cCsFLfu4/odDbkCxplf6f7yCezE=";
+    hash = "sha256-mjFoAHzFzdJsVtYSHEwWP5tgEkNch9rPPT+nkU+XaPY=";
   };
 
-  vendorHash = "sha256-mnrGnQ7clzu2dkAHyCuxfX0sGU5EcHybut6GfpmOSoU=";
+  vendorHash = "sha256-7T4ui3JhtG9CPLc8Xx3F79UUFKiTL9N1aVrAxXZhu54=";
 
   nativeBuildInputs = [ wire ];
 
diff --git a/pkgs/shells/zsh/zsh-completions/default.nix b/pkgs/shells/zsh/zsh-completions/default.nix
index a108473d373c..1873c38fb9a1 100644
--- a/pkgs/shells/zsh/zsh-completions/default.nix
+++ b/pkgs/shells/zsh/zsh-completions/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "zsh-completions";
-  version = "0.34.0";
+  version = "0.35.0";
 
   src = fetchFromGitHub {
     owner = "zsh-users";
     repo = pname;
     rev = version;
-    sha256 = "sha256-qSobM4PRXjfsvoXY6ENqJGI9NEAaFFzlij6MPeTfT0o=";
+    sha256 = "sha256-GFHlZjIHUWwyeVoCpszgn4AmLPSSE8UVNfRmisnhkpg=";
   };
 
   strictDeps = true;
diff --git a/pkgs/tools/misc/jfrog-cli/default.nix b/pkgs/tools/misc/jfrog-cli/default.nix
index cfa7ad4f47ba..d9d4d193f7c0 100644
--- a/pkgs/tools/misc/jfrog-cli/default.nix
+++ b/pkgs/tools/misc/jfrog-cli/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "jfrog-cli";
-  version = "2.45.0";
+  version = "2.46.2";
 
   src = fetchFromGitHub {
     owner = "jfrog";
     repo = "jfrog-cli";
     rev = "refs/tags/v${version}";
-    hash = "sha256-NSkSE1NZIwCCSlCo7hGWq82JvH48uI8fV2RIZHwS5JI=";
+    hash = "sha256-NPRxBcXnY1l30RrFTgR+vqvRLdH564Daw/OIqRUhTss=";
   };
 
-  vendorHash = "sha256-fk+Lhmb+LgjSuGlDfHkentF10TOgqIxbZ1VVGmAmkME=";
+  vendorHash = "sha256-dMVXpqIDL6fQc9KYN4Co6vBCrpxocnwA3EkgMEme3aI=";
 
   postInstall = ''
     # Name the output the same way as the original build script does
diff --git a/pkgs/tools/networking/dnscrypt-proxy2/default.nix b/pkgs/tools/networking/dnscrypt-proxy/default.nix
similarity index 95%
rename from pkgs/tools/networking/dnscrypt-proxy2/default.nix
rename to pkgs/tools/networking/dnscrypt-proxy/default.nix
index 24c6f7f2d31b..5227a28c1bdd 100644
--- a/pkgs/tools/networking/dnscrypt-proxy2/default.nix
+++ b/pkgs/tools/networking/dnscrypt-proxy/default.nix
@@ -1,7 +1,7 @@
 { lib, buildGoModule, fetchFromGitHub }:
 
 buildGoModule rec {
-  pname = "dnscrypt-proxy2";
+  pname = "dnscrypt-proxy";
   version = "2.1.5";
 
   vendorSha256 = null;
diff --git a/pkgs/tools/networking/ivpn/default.nix b/pkgs/tools/networking/ivpn/default.nix
index e8e33f3bc73a..f5df7e6c3845 100644
--- a/pkgs/tools/networking/ivpn/default.nix
+++ b/pkgs/tools/networking/ivpn/default.nix
@@ -7,7 +7,7 @@
 , openvpn
 , obfs4
 , iproute2
-, dnscrypt-proxy2
+, dnscrypt-proxy
 , iptables
 , gawk
 , util-linux
@@ -74,7 +74,7 @@ builtins.mapAttrs (pname: attrs: buildGoModule (attrs // rec {
         --replace 'wgToolBinaryPath = path.Join(installDir, "wireguard-tools/wg")' \
         'wgToolBinaryPath = "${wireguard-tools}/bin/wg"' \
         --replace 'dnscryptproxyBinPath = path.Join(installDir, "dnscrypt-proxy/dnscrypt-proxy")' \
-        'dnscryptproxyBinPath = "${dnscrypt-proxy2}/bin/dnscrypt-proxy"'
+        'dnscryptproxyBinPath = "${dnscrypt-proxy}/bin/dnscrypt-proxy"'
     '';
 
     postFixup = ''
diff --git a/pkgs/tools/networking/passh/default.nix b/pkgs/tools/networking/passh/default.nix
index 6534d3a1d517..060272c01a2e 100644
--- a/pkgs/tools/networking/passh/default.nix
+++ b/pkgs/tools/networking/passh/default.nix
@@ -1,18 +1,19 @@
 { lib, fetchFromGitHub, stdenv }:
-stdenv.mkDerivation rec {
+
+stdenv.mkDerivation (finalAttrs: {
   pname = "passh";
   version = "2020-03-18";
 
   src = fetchFromGitHub {
     owner = "clarkwang";
-    repo = pname;
+    repo = finalAttrs.pname;
     rev = "7112e667fc9e65f41c384f89ff6938d23e86826c";
     sha256 = "1g0rx94vqg36kp46f8v4x6jcmvdk85ds6bkrpayq772hbdm1b5z5";
   };
 
   installPhase = ''
     mkdir -p $out/bin
-    cp passh $out/bin
+    cp ${finalAttrs.pname} $out/bin
   '';
 
   meta = with lib; {
@@ -20,6 +21,7 @@ stdenv.mkDerivation rec {
     description = "An sshpass alternative for non-interactive ssh auth";
     license = licenses.gpl3;
     maintainers = [ maintainers.lovesegfault ];
+    mainProgram = finalAttrs.pname;
     platforms = platforms.unix;
   };
-}
+})
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index d05939150995..89971be105c9 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1965,7 +1965,7 @@ mapAliases ({
 
   ant-dracula-theme = throw "ant-dracula-theme is now dracula-theme, and theme name is Dracula instead of Ant-Dracula";
   dina-font-pcf = dina-font; # Added 2020-02-09
-  dnscrypt-proxy = throw "dnscrypt-proxy has been removed. Please use dnscrypt-proxy2"; # Added 2020-02-02
+  dnscrypt-proxy2 = dnscrypt-proxy; # Added 2023-02-02
   gcc-snapshot = throw "gcc-snapshot: Marked as broken for >2 years, additionally this 'snapshot' pointed to a fairly old one from gcc7";
   gnatsd = nats-server; # Added 2019-10-28
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index c453cd658b64..5bee4c980d46 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -7381,7 +7381,7 @@ with pkgs;
 
   djbdns = callPackage ../tools/networking/djbdns { };
 
-  dnscrypt-proxy2 = callPackage ../tools/networking/dnscrypt-proxy2 { };
+  dnscrypt-proxy = callPackage ../tools/networking/dnscrypt-proxy { };
 
   dnscrypt-wrapper = callPackage ../tools/networking/dnscrypt-wrapper { };
 
@@ -34138,6 +34138,8 @@ with pkgs;
     inherit lua;
   };
 
+  shaka-packager = callPackage ../applications/video/shaka-packager { };
+
   # Wraps without triggering a rebuild
   wrapMpv = callPackage ../applications/video/mpv/wrapper.nix { };
   mpv = wrapMpv mpv-unwrapped { };