diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 8784b39a059..ac644b4c093 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -690,6 +690,7 @@ in {
   terminal-emulators = handleTest ./terminal-emulators.nix {};
   tiddlywiki = handleTest ./tiddlywiki.nix {};
   tigervnc = handleTest ./tigervnc.nix {};
+  timescaledb = handleTest ./timescaledb.nix {};
   timezone = handleTest ./timezone.nix {};
   tinc = handleTest ./tinc {};
   tinydns = handleTest ./tinydns.nix {};
diff --git a/nixos/tests/timescaledb.nix b/nixos/tests/timescaledb.nix
new file mode 100644
index 00000000000..00a7f9af09f
--- /dev/null
+++ b/nixos/tests/timescaledb.nix
@@ -0,0 +1,93 @@
+# mostly copied from ./postgresql.nix as it seemed unapproriate to
+# test additional extensions for postgresql there.
+
+{ system ? builtins.currentSystem
+, config ? { }
+, pkgs ? import ../.. { inherit system config; }
+}:
+
+with import ../lib/testing-python.nix { inherit system pkgs; };
+with pkgs.lib;
+
+let
+  postgresql-versions = import ../../pkgs/servers/sql/postgresql pkgs;
+  test-sql = pkgs.writeText "postgresql-test" ''
+    CREATE EXTENSION timescaledb;
+    CREATE EXTENSION timescaledb_toolkit;
+
+    CREATE TABLE sth (
+      time TIMESTAMPTZ NOT NULL,
+      value DOUBLE PRECISION
+    );
+
+    SELECT create_hypertable('sth', 'time');
+
+    INSERT INTO sth (time, value) VALUES
+    ('2003-04-12 04:05:06 America/New_York', 1.0),
+    ('2003-04-12 04:05:07 America/New_York', 2.0),
+    ('2003-04-12 04:05:08 America/New_York', 3.0),
+    ('2003-04-12 04:05:09 America/New_York', 4.0),
+    ('2003-04-12 04:05:10 America/New_York', 5.0)
+    ;
+
+    WITH t AS (
+      SELECT
+        time_bucket('1 day'::interval, time) AS dt,
+        stats_agg(value) AS stats
+      FROM sth
+      GROUP BY time_bucket('1 day'::interval, time)
+    )
+    SELECT
+      average(stats)
+    FROM t;
+  '';
+  make-postgresql-test = postgresql-name: postgresql-package: makeTest {
+    name = postgresql-name;
+    meta = with pkgs.lib.maintainers; {
+      maintainers = [ typetetris ];
+    };
+
+    nodes.machine = { ... }:
+      {
+        services.postgresql = {
+          enable = true;
+          package = postgresql-package;
+          extraPlugins = with postgresql-package.pkgs; [
+            timescaledb
+            timescaledb_toolkit
+          ];
+          settings = { shared_preload_libraries = "timescaledb, timescaledb_toolkit"; };
+        };
+      };
+
+    testScript = ''
+      def check_count(statement, lines):
+          return 'test $(sudo -u postgres psql postgres -tAc "{}"|wc -l) -eq {}'.format(
+              statement, lines
+          )
+
+
+      machine.start()
+      machine.wait_for_unit("postgresql")
+
+      with subtest("Postgresql with extensions timescaledb and timescaledb_toolkit is available just after unit start"):
+          machine.succeed(
+              "sudo -u postgres psql -f ${test-sql}"
+          )
+
+      machine.fail(check_count("SELECT * FROM sth;", 3))
+      machine.succeed(check_count("SELECT * FROM sth;", 5))
+      machine.fail(check_count("SELECT * FROM sth;", 4))
+
+      machine.shutdown()
+    '';
+
+  };
+  applicablePostgresqlVersions = filterAttrs (_: value: versionAtLeast value.version "12") postgresql-versions;
+in
+mapAttrs'
+  (name: package: {
+    inherit name;
+    value = make-postgresql-test name package;
+  })
+  applicablePostgresqlVersions
diff --git a/pkgs/applications/emulators/ryujinx/default.nix b/pkgs/applications/emulators/ryujinx/default.nix
index c5c21ed46fe..0153a4faa8c 100644
--- a/pkgs/applications/emulators/ryujinx/default.nix
+++ b/pkgs/applications/emulators/ryujinx/default.nix
@@ -29,13 +29,13 @@
 
 buildDotnetModule rec {
   pname = "ryujinx";
-  version = "1.1.650"; # Based off of the official github actions builds: https://github.com/Ryujinx/Ryujinx/actions/workflows/release.yml
+  version = "1.1.651"; # Based off of the official github actions builds: https://github.com/Ryujinx/Ryujinx/actions/workflows/release.yml
 
   src = fetchFromGitHub {
     owner = "Ryujinx";
     repo = "Ryujinx";
-    rev = "b8556530f2b160db70ff571adf25ae26d4b8f58f";
-    sha256 = "098yx4nwmkbab595a2xq9f5libzvsj01f3wf83nsbgzndy1h85ja";
+    rev = "f0562b9c75308c8cfcaa2458dfd37ac42751a374";
+    sha256 = "1bkfncms8lagxhpnafyahrghzvpklsgxddqq7w1wzjzyxp6pxc51";
   };
 
   dotnet-sdk = dotnetCorePackages.sdk_7_0;
diff --git a/pkgs/applications/misc/gpxsee/default.nix b/pkgs/applications/misc/gpxsee/default.nix
index e71daa754ab..a5eccb239e3 100644
--- a/pkgs/applications/misc/gpxsee/default.nix
+++ b/pkgs/applications/misc/gpxsee/default.nix
@@ -10,6 +10,7 @@
 , qtlocation ? null # qt5 only
 , qtpositioning ? null # qt6 only
 , qtpbfimageplugin
+, qtserialport
 , qtsvg
 , qt5compat ? null # qt6 only
 , wrapQtAppsHook
@@ -21,13 +22,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "gpxsee";
-  version = "11.12";
+  version = "12.2";
 
   src = fetchFromGitHub {
     owner = "tumic0";
     repo = "GPXSee";
     rev = version;
-    hash = "sha256-W35KBPYvTKrSi7UnzcUz8MsUwoq8rY5g/+hL1/gVpbI=";
+    hash = "sha256-d+hQNI+eCSMRFMzq09wL+GN9TgOIt245Z8GlPe7nY8E=";
   };
 
   patches = (substituteAll {
@@ -36,7 +37,7 @@ stdenv.mkDerivation rec {
     inherit qttranslations;
   });
 
-  buildInputs = [ qtpbfimageplugin ]
+  buildInputs = [ qtpbfimageplugin qtserialport ]
     ++ (if isQt6 then [
     qtbase
     qtpositioning
@@ -55,6 +56,8 @@ stdenv.mkDerivation rec {
   postInstall = lib.optionalString stdenv.isDarwin ''
     mkdir -p $out/Applications
     mv GPXSee.app $out/Applications
+    mkdir -p $out/bin
+    ln -s $out/Applications/GPXSee.app/Contents/MacOS/GPXSee $out/bin/gpxsee
   '';
 
   passthru = {
diff --git a/pkgs/applications/networking/cluster/fluxcd/default.nix b/pkgs/applications/networking/cluster/fluxcd/default.nix
index c6d79bb4318..dbfcebfe6d9 100644
--- a/pkgs/applications/networking/cluster/fluxcd/default.nix
+++ b/pkgs/applications/networking/cluster/fluxcd/default.nix
@@ -1,9 +1,9 @@
 { lib, buildGoModule, fetchFromGitHub, fetchzip, installShellFiles, stdenv }:
 
 let
-  version = "0.41.0";
-  sha256 = "1xqgscmzq96jdlvwmckpz2zh7gsdla77xir6a6nylz509wkv3gid";
-  manifestsSha256 = "03azig0axa6d5yapzr36ziza1jsy549sqnna6ja6xa2zl0ljx33n";
+  version = "0.41.1";
+  sha256 = "0nrwhq336n0aj1c51difgxk9an8d1j4yfkxn9sgzw9dq50rrrinf";
+  manifestsSha256 = "1rrmdbaian8wskcyaa2nifp4mp4bz0nqgwz6ah5r0ywg48cfq2gm";
 
   manifests = fetchzip {
     url =
@@ -23,7 +23,7 @@ in buildGoModule rec {
     inherit sha256;
   };
 
-  vendorSha256 = "sha256-nQzpJX1B1zXpW27YtzkAYK2vL7rnWPgAtlZlZqdV5QI=";
+  vendorSha256 = "sha256-Oh1FBTHkICQZ79qf8XCL7ifi5Wd3jrIDupBKzYo+AEA=";
 
   postUnpack = ''
     cp -r ${manifests} source/cmd/flux/manifests
diff --git a/pkgs/applications/networking/shellhub-agent/default.nix b/pkgs/applications/networking/shellhub-agent/default.nix
index 8d404d4ebd2..7b908075902 100644
--- a/pkgs/applications/networking/shellhub-agent/default.nix
+++ b/pkgs/applications/networking/shellhub-agent/default.nix
@@ -1,5 +1,5 @@
 { lib
-, buildGoModule
+, buildGo120Module
 , fetchFromGitHub
 , gitUpdater
 , makeWrapper
@@ -7,20 +7,20 @@
 , libxcrypt
 }:
 
-buildGoModule rec {
+buildGo120Module rec {
   pname = "shellhub-agent";
-  version = "0.10.8";
+  version = "0.11.6";
 
   src = fetchFromGitHub {
     owner = "shellhub-io";
     repo = "shellhub";
     rev = "v${version}";
-    sha256 = "BtD22Ss5PuVx2RVLQIsUeGBJBl5lh1XHJ0vcM2bOEwk=";
+    sha256 = "eZLQzy3lWwGM6VWFbsJ6JuGC+/dZnoymZgNtM8CPBM4=";
   };
 
   modRoot = "./agent";
 
-  vendorSha256 = "sha256-tvKiTQioj999oIUDHUSXTMXOh/LKoykzu8JEUnrelws=";
+  vendorSha256 = "sha256-7kDPo24I58Nh7OiHj6Zy40jAEaXSOmbcczkgJPXBItU=";
 
   ldflags = [ "-s" "-w" "-X main.AgentVersion=v${version}" ];
 
diff --git a/pkgs/applications/office/jabref/default.nix b/pkgs/applications/office/jabref/default.nix
index 4f6ef33caec..786fa2f4623 100644
--- a/pkgs/applications/office/jabref/default.nix
+++ b/pkgs/applications/office/jabref/default.nix
@@ -12,15 +12,27 @@
 , perl
 }:
 
+let
+  versionReplace = {
+    easybind = {
+      snapshot = "2.2.1-SNAPSHOT";
+      pin = "2.2.1-20230117.075740-16";
+    };
+    afterburner = {
+      snapshot = "testmoduleinfo-SNAPSHOT";
+      pin = "0e337d8773";
+    };
+  };
+in
 stdenv.mkDerivation rec {
-  version = "5.7";
+  version = "5.9";
   pname = "jabref";
 
   src = fetchFromGitHub {
     owner = "JabRef";
     repo = "jabref";
     rev = "v${version}";
-    hash = "sha256-wzBaAaxGsMPh64uW+bBOiycYfVCW9H5FCn06r6XdxeE=";
+    hash = "sha256-uACmXas5L1NcxLwllkcbgCCt9bRicpQkiJkhkkVWDDY=";
   };
 
   desktopItems = [
@@ -39,28 +51,37 @@ stdenv.mkDerivation rec {
 
   deps = stdenv.mkDerivation {
     pname = "${pname}-deps";
-    inherit src version;
+    inherit src version postPatch;
 
     nativeBuildInputs = [ gradle perl ];
     buildPhase = ''
       export GRADLE_USER_HOME=$(mktemp -d)
-      gradle --no-daemon downloadDependencies
+      gradle --no-daemon downloadDependencies -Dos.arch=amd64
+      gradle --no-daemon downloadDependencies -Dos.arch=aarch64
     '';
     # perl code mavenizes pathes (com.squareup.okio/okio/1.13.0/a9283170b7305c8d92d25aff02a6ab7e45d06cbe/okio-1.13.0.jar -> com/squareup/okio/okio/1.13.0/okio-1.13.0.jar)
     installPhase = ''
       find $GRADLE_USER_HOME/caches/modules-2 -type f -regex '.*\.\(jar\|pom\)' \
         | perl -pe 's#(.*/([^/]+)/([^/]+)/([^/]+)/[0-9a-f]{30,40}/([^/\s]+))$# ($x = $2) =~ tr|\.|/|; "install -Dm444 $1 \$out/$x/$3/$4/''${\($5 =~ s/-jvm//r)}" #e' \
         | sh
+      mv $out/com/tobiasdiez/easybind/${versionReplace.easybind.pin} \
+        $out/com/tobiasdiez/easybind/${versionReplace.easybind.snapshot}
     '';
     # Don't move info to share/
     forceShare = [ "dummy" ];
     outputHashMode = "recursive";
-    outputHash = {
-      x86_64-linux = "sha256-OicHJVFxHGPE76bEDoLhkEhVcAJmplqjoh2I3nnVaLA=";
-      aarch64-linux = "sha256-8QWmweptL/+pSO6DhfBLaLcBrfKd4TDsDoXs4TgXvew=";
-    }.${stdenv.hostPlatform.system} or (throw "Unsupported system ${stdenv.hostPlatform.system}");
+    outputHash = "sha256-s6GA8iT3UEVuELBgpBvzPJlVX+9DpfOQrEd3KIth8eA=";
   };
 
+  postPatch = ''
+    # Pin the version
+    substituteInPlace build.gradle \
+      --replace 'com.github.JabRef:afterburner.fx:${versionReplace.afterburner.snapshot}' \
+        'com.github.JabRef:afterburner.fx:${versionReplace.afterburner.pin}' \
+      --replace 'com.tobiasdiez:easybind:${versionReplace.easybind.snapshot}' \
+        'com.tobiasdiez:easybind:${versionReplace.easybind.pin}'
+  '';
+
   preBuild = ''
     # Include CSL styles and locales in our build
     cp -r buildres/csl/* src/main/resources/
@@ -114,9 +135,13 @@ stdenv.mkDerivation rec {
     # Resources in the jar can't be found, workaround copied from AUR
     cp -r build/resources $out/share/java/jabref
 
-    # workaround for https://github.com/NixOS/nixpkgs/issues/162064
     tar xf build/distributions/JabRef-${version}.tar -C $out --strip-components=1
-    unzip $out/lib/javafx-web-*-linux${lib.optionalString stdenv.isAarch64 "-aarch64"}.jar libjfxwebkit.so -d $out/lib/
+
+    # remove openjfx libs for other platforms
+    rm $out/lib/javafx-*-win.jar ${lib.optionalString stdenv.isAarch64 "$out/lib/javafx-*-linux.jar"}
+
+    # workaround for https://github.com/NixOS/nixpkgs/issues/162064
+    unzip $out/lib/javafx-web-*.jar libjfxwebkit.so -d $out/lib/
 
     DEFAULT_JVM_OPTS=$(sed -n -E "s/^DEFAULT_JVM_OPTS='(.*)'$/\1/p" $out/bin/JabRef | sed -e "s|\$APP_HOME|$out|g" -e 's/"//g')
     rm $out/bin/*
diff --git a/pkgs/applications/office/karlender/default.nix b/pkgs/applications/office/karlender/default.nix
index ebbb0bbd9f9..84777373d2d 100644
--- a/pkgs/applications/office/karlender/default.nix
+++ b/pkgs/applications/office/karlender/default.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "karlender";
-  version = "0.9.0";
+  version = "0.9.1";
 
   src = fetchFromGitLab {
     owner = "floers";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-lmNG9B2uO/zitOY/cNjnLRjCn6mSJ3CIpXIXpChDi9A=";
+    hash = "sha256-mtkVdVxO796hZZJrGohNTeZfC43rdvEUgUZvBG92f8c=";
   };
 
-  cargoHash = "sha256-foxl8pqRqEbVwUWUGHmaTGazrwLQxcDJ/RvJE9wIszg=";
+  cargoHash = "sha256-jbdQ1dwTRJuA4F89YfxsO2PaHVef8bvxAj13veDteNM=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/applications/science/math/maxima/default.nix b/pkgs/applications/science/math/maxima/default.nix
index b42587596fa..9d1b5c09b82 100644
--- a/pkgs/applications/science/math/maxima/default.nix
+++ b/pkgs/applications/science/math/maxima/default.nix
@@ -79,12 +79,6 @@ stdenv.mkDerivation rec {
       url = "https://git.sagemath.org/sage.git/plain/build/pkgs/maxima/patches/undoing_true_false_printing_patch.patch?id=07d6c37d18811e2b377a9689790a7c5e24da16ba";
       sha256 = "0fvi3rcjv6743sqsbgdzazy9jb6r1p1yq63zyj9fx42wd1hgf7yx";
     })
-  ] ++ lib.optionals (lisp-compiler.pname == "ecl") [
-    # build fasl, needed for ECL support
-    (fetchpatch {
-      url = "https://git.sagemath.org/sage.git/plain/build/pkgs/maxima/patches/maxima.system.patch?id=07d6c37d18811e2b377a9689790a7c5e24da16ba";
-      sha256 = "18zafig8vflhkr80jq2ivk46k92dkszqlyq8cfmj0b2vcfjwwbar";
-    })
   ];
 
   # The test suite is disabled since 5.42.2 because of the following issues:
diff --git a/pkgs/applications/version-management/gfold/default.nix b/pkgs/applications/version-management/gfold/default.nix
index 0df0669c41d..831315a5778 100644
--- a/pkgs/applications/version-management/gfold/default.nix
+++ b/pkgs/applications/version-management/gfold/default.nix
@@ -12,7 +12,7 @@
 
 let
   pname = "gfold";
-  version = "4.3.1";
+  version = "4.3.2";
 in
 rustPlatform.buildRustPackage {
   inherit pname version;
@@ -21,10 +21,10 @@ rustPlatform.buildRustPackage {
     owner = "nickgerace";
     repo = pname;
     rev = version;
-    sha256 = "sha256-jlUGtTtoJ3DQbs4VEDUbYyl+s9S+bLTQ+GM6OQg6MNo=";
+    sha256 = "sha256-wZokY1KhhO3aztLIeZU/saGibzTYB9loGe003arFWEs=";
   };
 
-  cargoHash = "sha256-Mrqg0wOG3JHDdGMZMcFsifpazOukZeoMPrQh4vIfQyU=";
+  cargoHash = "sha256-yII5lm0zbP46gUsLrr3/828Tolwg5meRP5TVvEMy8Dg=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ libiconv Security ];
 
diff --git a/pkgs/applications/version-management/glab/default.nix b/pkgs/applications/version-management/glab/default.nix
index a789a35f7a5..09e5525e22c 100644
--- a/pkgs/applications/version-management/glab/default.nix
+++ b/pkgs/applications/version-management/glab/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "glab";
-  version = "1.25.3";
+  version = "1.26.0";
 
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "cli";
     rev = "v${version}";
-    hash = "sha256-x/VH6cRrJZ2t2iftBPC86FcgIwjRNzV11MwLG2y+Paw=";
+    hash = "sha256-k0wkHw12MyVsAudaihoymGkP4y5y98cR7LKa+hEC1Mc=";
   };
 
   vendorHash = "sha256-FZ1CiR8Rj/sMoCnQm6ArGQfRTlvmD14EZDmufnlTSTk=";
diff --git a/pkgs/applications/video/peek/default.nix b/pkgs/applications/video/peek/default.nix
index f2b5f6c504a..b8dff4f1af7 100644
--- a/pkgs/applications/video/peek/default.nix
+++ b/pkgs/applications/video/peek/default.nix
@@ -17,7 +17,7 @@
 , glib
 , cairo
 , keybinder3
-, ffmpeg
+, ffmpeg-full
 , python3
 , libxml2
 , gst_all_1
@@ -75,7 +75,7 @@ stdenv.mkDerivation rec {
   '';
 
   preFixup = ''
-    gappsWrapperArgs+=(--prefix PATH : ${lib.makeBinPath [ which ffmpeg gifski ]})
+    gappsWrapperArgs+=(--prefix PATH : ${lib.makeBinPath [ which ffmpeg-full gifski ]})
   '';
 
   passthru = {
diff --git a/pkgs/data/misc/v2ray-geoip/default.nix b/pkgs/data/misc/v2ray-geoip/default.nix
index ab972e0ce99..a49cbe11d36 100644
--- a/pkgs/data/misc/v2ray-geoip/default.nix
+++ b/pkgs/data/misc/v2ray-geoip/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "v2ray-geoip";
-  version = "202303020053";
+  version = "202303090050";
 
   src = fetchFromGitHub {
     owner = "v2fly";
     repo = "geoip";
-    rev = "c002daa9332a673ce2fabe61eb9c45dc6a54f3fa";
-    sha256 = "sha256-Pfny59HitidyXgXaI/1V3UNdM18X0+vVCyKP4qkL1rY=";
+    rev = "e1cd759a93ff7e65cd8099ee628803a83ab8cae0";
+    sha256 = "sha256-m6TYu6cT57MDOXXfI76ufGDWJYmxjtVZg5vSToM8btE=";
   };
 
   installPhase = ''
diff --git a/pkgs/development/compilers/ghc/8.10.7.nix b/pkgs/development/compilers/ghc/8.10.7.nix
index a582da03243..18568a47836 100644
--- a/pkgs/development/compilers/ghc/8.10.7.nix
+++ b/pkgs/development/compilers/ghc/8.10.7.nix
@@ -234,14 +234,13 @@ stdenv.mkDerivation (rec {
       sha256 = "0r4zjj0bv1x1m2dgxp3adsf2xkr94fjnyj1igsivd9ilbs5ja0b5";
     })
   ] ++ lib.optionals (stdenv.targetPlatform.isDarwin && stdenv.targetPlatform.isAarch64) [
-
     # Prevent the paths module from emitting symbols that we don't use
     # when building with separate outputs.
     #
     # These cause problems as they're not eliminated by GHC's dead code
     # elimination on aarch64-darwin. (see
     # https://github.com/NixOS/nixpkgs/issues/140774 for details).
-    ./cabal-paths.patch
+    ./Cabal-3.2-3.4-paths-fix-cycle-aarch64-darwin.patch
   ];
 
   postPatch = "patchShebangs .";
diff --git a/pkgs/development/compilers/ghc/9.0.2.nix b/pkgs/development/compilers/ghc/9.0.2.nix
index 7cd6171bb34..acbfe3bbcc2 100644
--- a/pkgs/development/compilers/ghc/9.0.2.nix
+++ b/pkgs/development/compilers/ghc/9.0.2.nix
@@ -212,14 +212,13 @@ stdenv.mkDerivation (rec {
       sha256 = "sha256-b4feGZIaKDj/UKjWTNY6/jH4s2iate0wAgMxG3rAbZI=";
     })
   ] ++ lib.optionals (stdenv.targetPlatform.isDarwin && stdenv.targetPlatform.isAarch64) [
-
     # Prevent the paths module from emitting symbols that we don't use
     # when building with separate outputs.
     #
     # These cause problems as they're not eliminated by GHC's dead code
     # elimination on aarch64-darwin. (see
     # https://github.com/NixOS/nixpkgs/issues/140774 for details).
-    ./cabal-paths.patch
+    ./Cabal-3.2-3.4-paths-fix-cycle-aarch64-darwin.patch
   ];
 
   postPatch = "patchShebangs .";
diff --git a/pkgs/development/compilers/ghc/9.2.4.nix b/pkgs/development/compilers/ghc/9.2.4.nix
index 78227eb5c9f..906f017df68 100644
--- a/pkgs/development/compilers/ghc/9.2.4.nix
+++ b/pkgs/development/compilers/ghc/9.2.4.nix
@@ -210,6 +210,14 @@ stdenv.mkDerivation (rec {
       extraPrefix = "libraries/Cabal/";
       sha256 = "sha256-yRQ6YmMiwBwiYseC5BsrEtDgFbWvst+maGgDtdD0vAY=";
     })
+  ] ++ lib.optionals (stdenv.targetPlatform.isDarwin && stdenv.targetPlatform.isAarch64) [
+    # Prevent the paths module from emitting symbols that we don't use
+    # when building with separate outputs.
+    #
+    # These cause problems as they're not eliminated by GHC's dead code
+    # elimination on aarch64-darwin. (see
+    # https://github.com/NixOS/nixpkgs/issues/140774 for details).
+    ./Cabal-3.6-paths-fix-cycle-aarch64-darwin.patch
   ];
 
   postPatch = "patchShebangs .";
diff --git a/pkgs/development/compilers/ghc/9.2.5.nix b/pkgs/development/compilers/ghc/9.2.5.nix
index 80b2e099e3a..3e7819716e7 100644
--- a/pkgs/development/compilers/ghc/9.2.5.nix
+++ b/pkgs/development/compilers/ghc/9.2.5.nix
@@ -210,6 +210,14 @@ stdenv.mkDerivation (rec {
       extraPrefix = "libraries/Cabal/";
       sha256 = "sha256-yRQ6YmMiwBwiYseC5BsrEtDgFbWvst+maGgDtdD0vAY=";
     })
+  ] ++ lib.optionals (stdenv.targetPlatform.isDarwin && stdenv.targetPlatform.isAarch64) [
+    # Prevent the paths module from emitting symbols that we don't use
+    # when building with separate outputs.
+    #
+    # These cause problems as they're not eliminated by GHC's dead code
+    # elimination on aarch64-darwin. (see
+    # https://github.com/NixOS/nixpkgs/issues/140774 for details).
+    ./Cabal-3.6-paths-fix-cycle-aarch64-darwin.patch
   ];
 
   postPatch = "patchShebangs .";
diff --git a/pkgs/development/compilers/ghc/9.2.6.nix b/pkgs/development/compilers/ghc/9.2.6.nix
index 4bcef66af45..a2523895349 100644
--- a/pkgs/development/compilers/ghc/9.2.6.nix
+++ b/pkgs/development/compilers/ghc/9.2.6.nix
@@ -210,6 +210,14 @@ stdenv.mkDerivation (rec {
       extraPrefix = "libraries/Cabal/";
       sha256 = "sha256-yRQ6YmMiwBwiYseC5BsrEtDgFbWvst+maGgDtdD0vAY=";
     })
+  ] ++ lib.optionals (stdenv.targetPlatform.isDarwin && stdenv.targetPlatform.isAarch64) [
+    # Prevent the paths module from emitting symbols that we don't use
+    # when building with separate outputs.
+    #
+    # These cause problems as they're not eliminated by GHC's dead code
+    # elimination on aarch64-darwin. (see
+    # https://github.com/NixOS/nixpkgs/issues/140774 for details).
+    ./Cabal-3.6-paths-fix-cycle-aarch64-darwin.patch
   ];
 
   postPatch = "patchShebangs .";
diff --git a/pkgs/development/compilers/ghc/9.2.7.nix b/pkgs/development/compilers/ghc/9.2.7.nix
index af5ba618c10..3cf3d80ef76 100644
--- a/pkgs/development/compilers/ghc/9.2.7.nix
+++ b/pkgs/development/compilers/ghc/9.2.7.nix
@@ -210,6 +210,14 @@ stdenv.mkDerivation (rec {
       extraPrefix = "libraries/Cabal/";
       sha256 = "sha256-yRQ6YmMiwBwiYseC5BsrEtDgFbWvst+maGgDtdD0vAY=";
     })
+  ] ++ lib.optionals (stdenv.targetPlatform.isDarwin && stdenv.targetPlatform.isAarch64) [
+    # Prevent the paths module from emitting symbols that we don't use
+    # when building with separate outputs.
+    #
+    # These cause problems as they're not eliminated by GHC's dead code
+    # elimination on aarch64-darwin. (see
+    # https://github.com/NixOS/nixpkgs/issues/140774 for details).
+    ./Cabal-3.6-paths-fix-cycle-aarch64-darwin.patch
   ];
 
   postPatch = "patchShebangs .";
diff --git a/pkgs/development/compilers/ghc/cabal-paths.patch b/pkgs/development/compilers/ghc/Cabal-3.2-3.4-paths-fix-cycle-aarch64-darwin.patch
similarity index 100%
rename from pkgs/development/compilers/ghc/cabal-paths.patch
rename to pkgs/development/compilers/ghc/Cabal-3.2-3.4-paths-fix-cycle-aarch64-darwin.patch
diff --git a/pkgs/development/compilers/ghc/Cabal-3.6-paths-fix-cycle-aarch64-darwin.patch b/pkgs/development/compilers/ghc/Cabal-3.6-paths-fix-cycle-aarch64-darwin.patch
new file mode 100644
index 00000000000..1f7a79cc688
--- /dev/null
+++ b/pkgs/development/compilers/ghc/Cabal-3.6-paths-fix-cycle-aarch64-darwin.patch
@@ -0,0 +1,602 @@
+This patch is based on https://github.com/sternenseemann/cabal/compare/982646d67b95b32813b89ab5d2d2f4d4dc03fb2b..7c49047f253e1f128e2df356400ec5da6f11066b
+and has been postprocessed with `filterdiff --strip=1 --addoldprefix=a/libraries/Cabal/ --addnewprefix=b/libraries/Cabal/`.
+Note that the base for the diff is not the Cabal 3.6.3.0 release tag, but
+982646d67b95b32813b89ab5d2d2f4d4dc03fb2b which is obtained by applying
+https://github.com/haskell/cabal/commit/6c796218c92f93c95e94d5ec2d077f6956f68e98
+on top of said release tag. That patch is applied to all our GHCs in the 9.2 series.
+
+Reasoning and explanation of the patch can be found in the comment in the diff for PathsModule.hs below.
+
+diffCabal/src/Distribution/Simple/Build/PathsModule.hs b/Cabal/src/Distribution/Simple/Build/PathsModule.hs
+index b2be7e1a8..9b63e9850 100644
+--- a/libraries/Cabal/Cabal/src/Distribution/Simple/Build/PathsModule.hs
++++ b/libraries/Cabal/Cabal/src/Distribution/Simple/Build/PathsModule.hs
+@@ -46,6 +46,7 @@ generatePathsModule pkg_descr lbi clbi = Z.render Z.Z
+     , Z.zIsWindows                  = isWindows
+     , Z.zIsI386                     = buildArch == I386
+     , Z.zIsX8664                    = buildArch == X86_64
++    , Z.zOr                         = (||)
+     , Z.zNot                        = not
+     , Z.zManglePkgName              = showPkgName
+ 
+@@ -56,8 +57,112 @@ generatePathsModule pkg_descr lbi clbi = Z.render Z.Z
+     , Z.zDatadir    = zDatadir
+     , Z.zLibexecdir = zLibexecdir
+     , Z.zSysconfdir = zSysconfdir
++
++    -- Sadly we can't be cleverer about this – we can't have literals in the template
++    , Z.zShouldEmitDataDir    = shouldEmit "DataDir"
++    , Z.zShouldEmitLibDir     = shouldEmit "LibDir"
++    , Z.zShouldEmitDynLibDir  = shouldEmit "DynLibDir"
++    , Z.zShouldEmitLibexecDir = shouldEmit "LibexecDir"
++    , Z.zShouldEmitSysconfDir = shouldEmit "SysconfDir"
++
++    , Z.zWarning           = zWarning
++    , Z.zShouldEmitWarning = zShouldEmitWarning
+     }
+   where
++    -- GHC's NCG backend for aarch64-darwin does not support link-time dead code
++    -- elimination to the extent that NCG does for other targets. Consequently,
++    -- we struggle with unnecessarily retained store path references due to the
++    -- use of `Paths_*` modules – even if `getLibDir` is not used, it'll end up
++    -- in the final library or executables we build.
++    --
++    -- When using a different output for the executables and library, this
++    -- becomes more sinister: The library will contain a reference to the bin
++    -- output and itself due to `getLibDir` and `getBinDir`, but the executables
++    -- will do so, too. Either due to linking dynamically or because the library
++    -- is linked statically into the executable and retains those references.
++    -- Since Nix disallows cyclical references between two outputs, it becomes
++    -- impossible to use the `Paths_*` module and a separate `bin` output for
++    -- aarch64-darwin.
++    --
++    -- The solution we have resorted to for now, is to trim the `Paths_*` module
++    -- dynamically depending on what references *could* be used without causing
++    -- a cyclical reference. That has the effect that any code that would not
++    -- cause a cyclical reference with dead code elimination will compile and
++    -- work for aarch64-darwin. If the code would use a `get*Dir` function that
++    -- has been omitted, this would indicate that the code would have caused a
++    -- cyclical reference anyways.
++    --
++    -- The logic for this makes some pretty big assumptions about installation
++    -- prefixes that probably only hold fully in nixpkgs with
++    -- `haskellPackages.mkDerivation`. Simple uses outside nixpkgs that have
++    -- everything below the same prefix should continue to work as expected,
++    -- though.
++    --
++    -- We assume the following:
++    --
++    -- - flat_prefix is `$out`.
++    -- - flat_libdir etc. are always below `$out`.
++    --
++    -- Since in the normal case due to static linking `$bin` and `$out` will
++    -- have the same references in libraries/executables, we need to either
++    -- prevent usage of `getBinDir` or `getLibDir` to break the cycle in case
++    -- `flat_bindir` is not below `$out`. We have decided to always allow usage
++    -- of `getBinDir`, so `getLibDir` gets dropped if a separate `bin` output is
++    -- used. This has the simple reason that `$out` which contains `flat_libdir`
++    -- tends to be quite big – we would like to have a `bin` output that doesn't
++    -- require keeping that around.
++    pathEmittable :: FilePath -> Bool
++    pathEmittable p
++      -- If the executable installation target is below `$out` the reference
++      -- cycle is within a single output (since libs are installed to `$out`)
++      -- and thus unproblematic. We can use any and all `get*Dir` functions.
++      | flat_prefix `isPrefixOf` flat_bindir = True
++      -- Otherwise, we need to disallow all `get*Dir` functions that would cause
++      -- a reference to `$out` which contains the libraries that would in turn
++      -- reference `$bin`. This always include `flat_libdir` and friends, but
++      -- can also include `flat_datadir` if no separate output for data files is
++      -- used.
++      | otherwise = not (flat_prefix `isPrefixOf` p)
++
++    -- This list maps the "name" of the directory to whether we want to include
++    -- it in the `Paths_*` module or not. `shouldEmit` performs a lookup in this.
++    dirs :: [(String, Bool)]
++    dirs =
++      map
++       (\(name, path) -> (name, pathEmittable path))
++       [ ("LibDir", flat_libdir)
++       , ("DynLibDir", flat_dynlibdir)
++       , ("DataDir", flat_datadir)
++       , ("LibexecDir", flat_libexecdir)
++       , ("SysconfDir", flat_sysconfdir)
++       ]
++
++    shouldEmit :: String -> Bool
++    shouldEmit name =
++      case lookup name dirs of
++        Just b -> b
++        Nothing -> error "panic! BUG in Cabal Paths_ patch for aarch64-darwin, report this at https://github.com/nixos/nixpkgs/issues"
++
++    -- This is a comma separated list of all functions that have been omitted.
++    -- This is included in a GHC warning which will be attached to the `Paths_*`
++    -- module in case we are dropping any `get*Dir` functions that would
++    -- normally exist.
++    --
++    -- TODO: getDataFileName is not accounted for at the moment.
++    omittedFunctions :: String
++    omittedFunctions =
++      intercalate ", "
++      $ map (("get" ++) . fst)
++      $ filter (not . snd) dirs
++
++    zWarning :: String
++    zWarning =
++      show $
++        "The following functions have been omitted by a nixpkgs-specific patch to Cabal: "
++        ++ omittedFunctions
++    zShouldEmitWarning :: Bool
++    zShouldEmitWarning = any (not . snd) dirs
++
+     supports_cpp                 = supports_language_pragma
+     supports_rebindable_syntax   = ghc_newer_than (mkVersion [7,0,1])
+     supports_language_pragma     = ghc_newer_than (mkVersion [6,6,1])
+diffCabal/src/Distribution/Simple/Build/PathsModule/Z.hs b/Cabal/src/Distribution/Simple/Build/PathsModule/Z.hs
+index 6488ea061..a6cdc8e31 100644
+--- a/libraries/Cabal/Cabal/src/Distribution/Simple/Build/PathsModule/Z.hs
++++ b/libraries/Cabal/Cabal/src/Distribution/Simple/Build/PathsModule/Z.hs
+@@ -18,6 +18,14 @@ data Z
+          zDatadir :: FilePath,
+          zLibexecdir :: FilePath,
+          zSysconfdir :: FilePath,
++         zShouldEmitLibDir :: Bool,
++         zShouldEmitDynLibDir :: Bool,
++         zShouldEmitLibexecDir :: Bool,
++         zShouldEmitDataDir :: Bool,
++         zShouldEmitSysconfDir :: Bool,
++         zShouldEmitWarning :: Bool,
++         zWarning :: String,
++         zOr :: (Bool -> Bool -> Bool),
+          zNot :: (Bool -> Bool),
+          zManglePkgName :: (PackageName -> String)}
+     deriving Generic
+@@ -45,10 +53,51 @@ render z_root = execWriter $ do
+   tell "{-# OPTIONS_GHC -w #-}\n"
+   tell "module Paths_"
+   tell (zManglePkgName z_root (zPackageName z_root))
+-  tell " (\n"
++  tell "\n"
++  tell "  "
++  if (zShouldEmitWarning z_root)
++  then do
++    tell "{-# WARNING "
++    tell (zWarning z_root)
++    tell " #-}"
++    return ()
++  else do
++    return ()
++  tell "\n"
++  tell "  (\n"
+   tell "    version,\n"
+-  tell "    getBinDir, getLibDir, getDynLibDir, getDataDir, getLibexecDir,\n"
+-  tell "    getDataFileName, getSysconfDir\n"
++  tell "    getBinDir,\n"
++  if (zOr z_root (zNot z_root (zAbsolute z_root)) (zShouldEmitLibDir z_root))
++  then do
++    tell "    getLibDir,\n"
++    return ()
++  else do
++    return ()
++  if (zOr z_root (zNot z_root (zAbsolute z_root)) (zShouldEmitDynLibDir z_root))
++  then do
++    tell "    getDynLibDir,\n"
++    return ()
++  else do
++    return ()
++  if (zOr z_root (zNot z_root (zAbsolute z_root)) (zShouldEmitLibexecDir z_root))
++  then do
++    tell "    getLibexecDir,\n"
++    return ()
++  else do
++    return ()
++  if (zOr z_root (zNot z_root (zAbsolute z_root)) (zShouldEmitDataDir z_root))
++  then do
++    tell "    getDataFileName,\n"
++    tell "    getDataDir,\n"
++    return ()
++  else do
++    return ()
++  if (zOr z_root (zNot z_root (zAbsolute z_root)) (zShouldEmitSysconfDir z_root))
++  then do
++    tell "    getSysconfDir\n"
++    return ()
++  else do
++    return ()
+   tell "  ) where\n"
+   tell "\n"
+   if (zNot z_root (zAbsolute z_root))
+@@ -97,12 +146,15 @@ render z_root = execWriter $ do
+   tell (zVersionDigits z_root)
+   tell " []\n"
+   tell "\n"
+-  tell "getDataFileName :: FilePath -> IO FilePath\n"
+-  tell "getDataFileName name = do\n"
+-  tell "  dir <- getDataDir\n"
+-  tell "  return (dir `joinFileName` name)\n"
+-  tell "\n"
+-  tell "getBinDir, getLibDir, getDynLibDir, getDataDir, getLibexecDir, getSysconfDir :: IO FilePath\n"
++  if (zOr z_root (zNot z_root (zAbsolute z_root)) (zShouldEmitDataDir z_root))
++  then do
++    tell "getDataFileName :: FilePath -> IO FilePath\n"
++    tell "getDataFileName name = do\n"
++    tell "  dir <- getDataDir\n"
++    tell "  return (dir `joinFileName` name)\n"
++    return ()
++  else do
++    return ()
+   tell "\n"
+   let
+     z_var0_function_defs = do
+@@ -130,6 +182,7 @@ render z_root = execWriter $ do
+   tell "\n"
+   if (zRelocatable z_root)
+   then do
++    tell "\n"
+     tell "\n"
+     tell "getPrefixDirReloc :: FilePath -> IO FilePath\n"
+     tell "getPrefixDirReloc dirRel = do\n"
+@@ -139,31 +192,37 @@ render z_root = execWriter $ do
+     tell (zBindir z_root)
+     tell ") `joinFileName` dirRel)\n"
+     tell "\n"
++    tell "getBinDir     :: IO FilePath\n"
+     tell "getBinDir     = catchIO (getEnv \""
+     tell (zManglePkgName z_root (zPackageName z_root))
+     tell "_bindir\")     (\\_ -> getPrefixDirReloc $ "
+     tell (zBindir z_root)
+     tell ")\n"
++    tell "getLibDir     :: IO FilePath\n"
+     tell "getLibDir     = catchIO (getEnv \""
+     tell (zManglePkgName z_root (zPackageName z_root))
+     tell "_libdir\")     (\\_ -> getPrefixDirReloc $ "
+     tell (zLibdir z_root)
+     tell ")\n"
++    tell "getDynLibDir  :: IO FilePath\n"
+     tell "getDynLibDir  = catchIO (getEnv \""
+     tell (zManglePkgName z_root (zPackageName z_root))
+     tell "_dynlibdir\")  (\\_ -> getPrefixDirReloc $ "
+     tell (zDynlibdir z_root)
+     tell ")\n"
++    tell "getDataDir    :: IO FilePath\n"
+     tell "getDataDir    = catchIO (getEnv \""
+     tell (zManglePkgName z_root (zPackageName z_root))
+     tell "_datadir\")    (\\_ -> getPrefixDirReloc $ "
+     tell (zDatadir z_root)
+     tell ")\n"
++    tell "getLibexecDir :: IO FilePath\n"
+     tell "getLibexecDir = catchIO (getEnv \""
+     tell (zManglePkgName z_root (zPackageName z_root))
+     tell "_libexecdir\") (\\_ -> getPrefixDirReloc $ "
+     tell (zLibexecdir z_root)
+     tell ")\n"
++    tell "getSysconfDir :: IO FilePath\n"
+     tell "getSysconfDir = catchIO (getEnv \""
+     tell (zManglePkgName z_root (zPackageName z_root))
+     tell "_sysconfdir\") (\\_ -> getPrefixDirReloc $ "
+@@ -177,72 +236,119 @@ render z_root = execWriter $ do
+     if (zAbsolute z_root)
+     then do
+       tell "\n"
+-      tell "bindir, libdir, dynlibdir, datadir, libexecdir, sysconfdir :: FilePath\n"
++      tell "bindir     :: FilePath\n"
+       tell "bindir     = "
+       tell (zBindir z_root)
+       tell "\n"
+-      tell "libdir     = "
+-      tell (zLibdir z_root)
+-      tell "\n"
+-      tell "dynlibdir  = "
+-      tell (zDynlibdir z_root)
++      tell "getBinDir     :: IO FilePath\n"
++      tell "getBinDir     = catchIO (getEnv \""
++      tell (zManglePkgName z_root (zPackageName z_root))
++      tell "_bindir\")     (\\_ -> return bindir)\n"
+       tell "\n"
+-      tell "datadir    = "
+-      tell (zDatadir z_root)
++      if (zShouldEmitLibDir z_root)
++      then do
++        tell "libdir     :: FilePath\n"
++        tell "libdir     = "
++        tell (zLibdir z_root)
++        tell "\n"
++        tell "getLibDir     :: IO FilePath\n"
++        tell "getLibDir     = catchIO (getEnv \""
++        tell (zManglePkgName z_root (zPackageName z_root))
++        tell "_libdir\")     (\\_ -> return libdir)\n"
++        return ()
++      else do
++        return ()
+       tell "\n"
+-      tell "libexecdir = "
+-      tell (zLibexecdir z_root)
++      if (zShouldEmitDynLibDir z_root)
++      then do
++        tell "dynlibdir  :: FilePath\n"
++        tell "dynlibdir  = "
++        tell (zDynlibdir z_root)
++        tell "\n"
++        tell "getDynLibDir  :: IO FilePath\n"
++        tell "getDynLibDir  = catchIO (getEnv \""
++        tell (zManglePkgName z_root (zPackageName z_root))
++        tell "_dynlibdir\")  (\\_ -> return dynlibdir)\n"
++        return ()
++      else do
++        return ()
+       tell "\n"
+-      tell "sysconfdir = "
+-      tell (zSysconfdir z_root)
++      if (zShouldEmitDataDir z_root)
++      then do
++        tell "datadir    :: FilePath\n"
++        tell "datadir    = "
++        tell (zDatadir z_root)
++        tell "\n"
++        tell "getDataDir    :: IO FilePath\n"
++        tell "getDataDir    = catchIO (getEnv \""
++        tell (zManglePkgName z_root (zPackageName z_root))
++        tell "_datadir\")    (\\_ -> return datadir)\n"
++        return ()
++      else do
++        return ()
+       tell "\n"
++      if (zShouldEmitLibexecDir z_root)
++      then do
++        tell "libexecdir :: FilePath\n"
++        tell "libexecdir = "
++        tell (zLibexecdir z_root)
++        tell "\n"
++        tell "getLibexecDir :: IO FilePath\n"
++        tell "getLibexecDir = catchIO (getEnv \""
++        tell (zManglePkgName z_root (zPackageName z_root))
++        tell "_libexecdir\") (\\_ -> return libexecdir)\n"
++        return ()
++      else do
++        return ()
+       tell "\n"
+-      tell "getBinDir     = catchIO (getEnv \""
+-      tell (zManglePkgName z_root (zPackageName z_root))
+-      tell "_bindir\")     (\\_ -> return bindir)\n"
+-      tell "getLibDir     = catchIO (getEnv \""
+-      tell (zManglePkgName z_root (zPackageName z_root))
+-      tell "_libdir\")     (\\_ -> return libdir)\n"
+-      tell "getDynLibDir  = catchIO (getEnv \""
+-      tell (zManglePkgName z_root (zPackageName z_root))
+-      tell "_dynlibdir\")  (\\_ -> return dynlibdir)\n"
+-      tell "getDataDir    = catchIO (getEnv \""
+-      tell (zManglePkgName z_root (zPackageName z_root))
+-      tell "_datadir\")    (\\_ -> return datadir)\n"
+-      tell "getLibexecDir = catchIO (getEnv \""
+-      tell (zManglePkgName z_root (zPackageName z_root))
+-      tell "_libexecdir\") (\\_ -> return libexecdir)\n"
+-      tell "getSysconfDir = catchIO (getEnv \""
+-      tell (zManglePkgName z_root (zPackageName z_root))
+-      tell "_sysconfdir\") (\\_ -> return sysconfdir)\n"
++      if (zShouldEmitSysconfDir z_root)
++      then do
++        tell "sysconfdir :: FilePath\n"
++        tell "sysconfdir = "
++        tell (zSysconfdir z_root)
++        tell "\n"
++        tell "getSysconfDir :: IO FilePath\n"
++        tell "getSysconfDir = catchIO (getEnv \""
++        tell (zManglePkgName z_root (zPackageName z_root))
++        tell "_sysconfdir\") (\\_ -> return sysconfdir)\n"
++        return ()
++      else do
++        return ()
+       tell "\n"
+       return ()
+     else do
+       if (zIsWindows z_root)
+       then do
++        tell "\n"
+         tell "\n"
+         tell "prefix :: FilePath\n"
+         tell "prefix = "
+         tell (zPrefix z_root)
+         tell "\n"
+         tell "\n"
++        tell "getBinDir     :: IO FilePath\n"
+         tell "getBinDir     = getPrefixDirRel $ "
+         tell (zBindir z_root)
+         tell "\n"
++        tell "getLibDir     :: IO FilePath\n"
+         tell "getLibDir     = "
+         tell (zLibdir z_root)
+         tell "\n"
++        tell "getDynLibDir  :: IO FilePath\n"
+         tell "getDynLibDir  = "
+         tell (zDynlibdir z_root)
+         tell "\n"
++        tell "getDataDir    :: IO FilePath\n"
+         tell "getDataDir    = catchIO (getEnv \""
+         tell (zManglePkgName z_root (zPackageName z_root))
+         tell "_datadir\")    (\\_ -> "
+         tell (zDatadir z_root)
+         tell ")\n"
++        tell "getLibexecDir :: IO FilePath\n"
+         tell "getLibexecDir = "
+         tell (zLibexecdir z_root)
+         tell "\n"
++        tell "getSysconfDir :: IO FilePath\n"
+         tell "getSysconfDir = "
+         tell (zSysconfdir z_root)
+         tell "\n"
+diffcabal-dev-scripts/src/GenPathsModule.hs b/cabal-dev-scripts/src/GenPathsModule.hs
+index e4b930635..9b978f284 100644
+--- a/libraries/Cabal/cabal-dev-scripts/src/GenPathsModule.hs
++++ b/libraries/Cabal/cabal-dev-scripts/src/GenPathsModule.hs
+@@ -41,6 +41,16 @@ $(capture "decls" [d|
+         , zLibexecdir :: FilePath
+         , zSysconfdir :: FilePath
+ 
++        , zShouldEmitLibDir     :: Bool
++        , zShouldEmitDynLibDir  :: Bool
++        , zShouldEmitLibexecDir :: Bool
++        , zShouldEmitDataDir    :: Bool
++        , zShouldEmitSysconfDir :: Bool
++
++        , zShouldEmitWarning :: Bool
++        , zWarning           :: String
++
++        , zOr                         :: Bool -> Bool -> Bool
+         , zNot                        :: Bool -> Bool
+         , zManglePkgName              :: PackageName -> String
+         }
+difftemplates/Paths_pkg.template.hs b/templates/Paths_pkg.template.hs
+index 6bc6b7875..aa90a9382 100644
+--- a/libraries/Cabal/templates/Paths_pkg.template.hs
++++ b/libraries/Cabal/templates/Paths_pkg.template.hs
+@@ -9,10 +9,31 @@
+ {% endif %}
+ {-# OPTIONS_GHC -fno-warn-missing-import-lists #-}
+ {-# OPTIONS_GHC -w #-}
+-module Paths_{{ manglePkgName packageName }} (
++module Paths_{{ manglePkgName packageName }}
++  {% if shouldEmitWarning %}{-# WARNING {{ warning }} #-}{% endif %}
++  (
+     version,
+-    getBinDir, getLibDir, getDynLibDir, getDataDir, getLibexecDir,
+-    getDataFileName, getSysconfDir
++    getBinDir,
++{# We only care about the absolute case for our emit logic, since only in this
++   case references are incurred. We are not going to hit isWindows and relocatable
++   has no absolute references to begin with.
++#}
++{% if or (not absolute) shouldEmitLibDir %}
++    getLibDir,
++{% endif %}
++{% if or (not absolute) shouldEmitDynLibDir %}
++    getDynLibDir,
++{% endif %}
++{% if or (not absolute) shouldEmitLibexecDir %}
++    getLibexecDir,
++{% endif %}
++{% if or (not absolute) shouldEmitDataDir %}
++    getDataFileName,
++    getDataDir,
++{% endif %}
++{% if or (not absolute) shouldEmitSysconfDir %}
++    getSysconfDir
++{% endif %}
+   ) where
+ 
+ {% if not absolute %}
+@@ -51,12 +72,12 @@ catchIO = Exception.catch
+ version :: Version
+ version = Version {{ versionDigits }} []
+ 
++{% if or (not absolute) shouldEmitDataDir %}
+ getDataFileName :: FilePath -> IO FilePath
+ getDataFileName name = do
+   dir <- getDataDir
+   return (dir `joinFileName` name)
+-
+-getBinDir, getLibDir, getDynLibDir, getDataDir, getLibexecDir, getSysconfDir :: IO FilePath
++{% endif %}
+ 
+ {% defblock function_defs %}
+ minusFileName :: FilePath -> String -> FilePath
+@@ -85,48 +106,93 @@ splitFileName p = (reverse (path2++drive), reverse fname)
+ 
+ {% if relocatable %}
+ 
++{# Relocatable can not incur any absolute references, so we can ignore it.
++   Additionally, --enable-relocatable is virtually useless in Nix builds
++#}
++
+ getPrefixDirReloc :: FilePath -> IO FilePath
+ getPrefixDirReloc dirRel = do
+   exePath <- getExecutablePath
+   let (dir,_) = splitFileName exePath
+   return ((dir `minusFileName` {{ bindir }}) `joinFileName` dirRel)
+ 
++getBinDir     :: IO FilePath
+ getBinDir     = catchIO (getEnv "{{ manglePkgName packageName }}_bindir")     (\_ -> getPrefixDirReloc $ {{ bindir }})
++getLibDir     :: IO FilePath
+ getLibDir     = catchIO (getEnv "{{ manglePkgName packageName }}_libdir")     (\_ -> getPrefixDirReloc $ {{ libdir }})
++getDynLibDir  :: IO FilePath
+ getDynLibDir  = catchIO (getEnv "{{ manglePkgName packageName }}_dynlibdir")  (\_ -> getPrefixDirReloc $ {{ dynlibdir }})
++getDataDir    :: IO FilePath
+ getDataDir    = catchIO (getEnv "{{ manglePkgName packageName }}_datadir")    (\_ -> getPrefixDirReloc $ {{ datadir }})
++getLibexecDir :: IO FilePath
+ getLibexecDir = catchIO (getEnv "{{ manglePkgName packageName }}_libexecdir") (\_ -> getPrefixDirReloc $ {{ libexecdir }})
++getSysconfDir :: IO FilePath
+ getSysconfDir = catchIO (getEnv "{{ manglePkgName packageName }}_sysconfdir") (\_ -> getPrefixDirReloc $ {{ sysconfdir }})
+ 
+ {% useblock function_defs %}
+ 
+ {% elif absolute %}
+ 
+-bindir, libdir, dynlibdir, datadir, libexecdir, sysconfdir :: FilePath
++bindir     :: FilePath
+ bindir     = {{ bindir }}
+-libdir     = {{ libdir }}
+-dynlibdir  = {{ dynlibdir }}
+-datadir    = {{ datadir }}
+-libexecdir = {{ libexecdir }}
+-sysconfdir = {{ sysconfdir }}
+-
++getBinDir     :: IO FilePath
+ getBinDir     = catchIO (getEnv "{{ manglePkgName packageName }}_bindir")     (\_ -> return bindir)
++
++{% if shouldEmitLibDir %}
++libdir     :: FilePath
++libdir     = {{ libdir }}
++getLibDir     :: IO FilePath
+ getLibDir     = catchIO (getEnv "{{ manglePkgName packageName }}_libdir")     (\_ -> return libdir)
++{% endif %}
++
++{% if shouldEmitDynLibDir %}
++dynlibdir  :: FilePath
++dynlibdir  = {{ dynlibdir }}
++getDynLibDir  :: IO FilePath
+ getDynLibDir  = catchIO (getEnv "{{ manglePkgName packageName }}_dynlibdir")  (\_ -> return dynlibdir)
++{% endif %}
++
++{% if shouldEmitDataDir %}
++datadir    :: FilePath
++datadir    = {{ datadir }}
++getDataDir    :: IO FilePath
+ getDataDir    = catchIO (getEnv "{{ manglePkgName packageName }}_datadir")    (\_ -> return datadir)
++{% endif %}
++
++{% if shouldEmitLibexecDir %}
++libexecdir :: FilePath
++libexecdir = {{ libexecdir }}
++getLibexecDir :: IO FilePath
+ getLibexecDir = catchIO (getEnv "{{ manglePkgName packageName }}_libexecdir") (\_ -> return libexecdir)
++{% endif %}
++
++{% if shouldEmitSysconfDir %}
++sysconfdir :: FilePath
++sysconfdir = {{ sysconfdir }}
++getSysconfDir :: IO FilePath
+ getSysconfDir = catchIO (getEnv "{{ manglePkgName packageName }}_sysconfdir") (\_ -> return sysconfdir)
++{% endif %}
+ 
+ {% elif isWindows %}
+ 
++{# We are only trying to fix the problem for aarch64-darwin with this patch,
++   so let's ignore Windows which we can reach via pkgsCross, for example.
++#}
++
+ prefix :: FilePath
+ prefix = {{ prefix }}
+ 
++getBinDir     :: IO FilePath
+ getBinDir     = getPrefixDirRel $ {{ bindir }}
++getLibDir     :: IO FilePath
+ getLibDir     = {{ libdir }}
++getDynLibDir  :: IO FilePath
+ getDynLibDir  = {{ dynlibdir }}
++getDataDir    :: IO FilePath
+ getDataDir    = catchIO (getEnv "{{ manglePkgName packageName }}_datadir")    (\_ -> {{ datadir }})
++getLibexecDir :: IO FilePath
+ getLibexecDir = {{ libexecdir }}
++getSysconfDir :: IO FilePath
+ getSysconfDir = {{ sysconfdir }}
+ 
+ getPrefixDirRel :: FilePath -> IO FilePath
diff --git a/pkgs/development/compilers/purescript/purescript/default.nix b/pkgs/development/compilers/purescript/purescript/default.nix
index acd889ce85b..348d2963421 100644
--- a/pkgs/development/compilers/purescript/purescript/default.nix
+++ b/pkgs/development/compilers/purescript/purescript/default.nix
@@ -18,7 +18,7 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "purescript";
-  version = "0.15.7";
+  version = "0.15.8";
 
   # These hashes can be updated automatically by running the ./update.sh script.
   src =
@@ -26,12 +26,12 @@ in stdenv.mkDerivation rec {
     then
     fetchurl {
       url = "https://github.com/${pname}/${pname}/releases/download/v${version}/macos.tar.gz";
-      sha256 = "0aq5sr93z6c5l76sqbj3g48z6yrhxfqxri0x1ajmjwhcwjg79d6v";
+      sha256 = "0aq6b8yw2ll3qgmc21ap2pxfnr7glqhrjx3ggc21q4gwq3zxrrrp";
     }
     else
     fetchurl {
       url = "https://github.com/${pname}/${pname}/releases/download/v${version}/linux64.tar.gz";
-      sha256 = "032jqrk46k9zbq058ms8rnrq0209rd8vkxwj73vqrlgqvpzlfl5k";
+      sha256 = "192px9a4ja1iazhahc6ilgxk0x2bjp59qxd9zaww4pldj1b7z20y";
     };
 
 
diff --git a/pkgs/development/haskell-modules/configuration-darwin.nix b/pkgs/development/haskell-modules/configuration-darwin.nix
index c54e2dd03d3..1dbb3172b02 100644
--- a/pkgs/development/haskell-modules/configuration-darwin.nix
+++ b/pkgs/development/haskell-modules/configuration-darwin.nix
@@ -318,6 +318,11 @@ self: super: ({
   # https://github.com/NixOS/nixpkgs/issues/149692
   Agda = removeConfigureFlag "-foptimise-heavily" super.Agda;
 
+  # regex-rure's test suite fails with a dylib not loaded error due to some
+  # rpath issue.
+  regex-rure = dontDistribute (markBroken super.regex-rure);
+  jacinda = dontDistribute super.jacinda;
+
 } // lib.optionalAttrs pkgs.stdenv.isx86_64 {  # x86_64-darwin
 
   # tests appear to be failing to link or something:
diff --git a/pkgs/development/ocaml-modules/ffmpeg/ffmpeg-avdevice.nix b/pkgs/development/ocaml-modules/ffmpeg/ffmpeg-avdevice.nix
index 64ebc1affee..b2537bd25be 100644
--- a/pkgs/development/ocaml-modules/ffmpeg/ffmpeg-avdevice.nix
+++ b/pkgs/development/ocaml-modules/ffmpeg/ffmpeg-avdevice.nix
@@ -1,6 +1,7 @@
 { lib, buildDunePackage, dune-configurator, pkg-config, fetchFromGitHub, callPackage
 , AppKit
 , AudioToolbox
+, AVFoundation
 , Cocoa
 , CoreImage
 , ForceFeedback
@@ -20,7 +21,17 @@ buildDunePackage {
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ dune-configurator ]
-    ++ lib.optionals stdenv.isDarwin [ AppKit AudioToolbox Cocoa CoreImage ForceFeedback OpenGL VideoToolbox ];
+  ++ lib.optionals stdenv.isDarwin [
+    AppKit
+    AudioToolbox
+    AVFoundation
+    Cocoa
+    CoreImage
+    ForceFeedback
+    OpenGL
+    VideoToolbox
+  ];
+
   propagatedBuildInputs = [ ffmpeg-av ffmpeg.dev ];
 
   doCheck = true;
diff --git a/pkgs/development/python-modules/bandit/default.nix b/pkgs/development/python-modules/bandit/default.nix
index 73de9a4688d..79c19ba765b 100644
--- a/pkgs/development/python-modules/bandit/default.nix
+++ b/pkgs/development/python-modules/bandit/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "bandit";
-  version = "1.7.4";
+  version = "1.7.5";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-LWOoxXNBe64ziWLUubBvvGCA907NlVoJKEnh5lxxe9I=";
+    hash = "sha256-vfxzm6oDuIDC0V0EMbMcZY/8NI6Qf+GX5U4Did1Z4R4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/ipwhois/default.nix b/pkgs/development/python-modules/ipwhois/default.nix
new file mode 100644
index 00000000000..676ec23081a
--- /dev/null
+++ b/pkgs/development/python-modules/ipwhois/default.nix
@@ -0,0 +1,71 @@
+{ lib
+, stdenv
+, buildPythonPackage
+, dnspython
+, fetchFromGitHub
+, iana-etc
+, libredirect
+, pytestCheckHook
+, pythonOlder
+, pythonRelaxDepsHook
+}:
+
+buildPythonPackage rec {
+  pname = "ipwhois";
+  version = "1.2.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "secynic";
+    repo = pname;
+    rev = "refs/tags/v${version}";
+    hash = "sha256-2CfRRHlIIaycUtzKeMBKi6pVPeBCb1nW3/1hoxQU1YM=";
+  };
+
+  pythonRelaxDeps = [
+    "dnspython"
+  ];
+
+  nativeBuildInputs = [
+    pythonRelaxDepsHook
+  ];
+
+  propagatedBuildInputs = [
+    dnspython
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "ipwhois"
+  ];
+
+  preCheck = lib.optionalString stdenv.isLinux ''
+    echo "nameserver 127.0.0.1" > resolv.conf
+    export NIX_REDIRECTS=/etc/protocols=${iana-etc}/etc/protocols:/etc/resolv.conf=$(realpath resolv.conf) \
+      LD_PRELOAD=${libredirect}/lib/libredirect.so
+  '';
+
+  disabledTestPaths = [
+    # Tests require network access
+    "ipwhois/tests/online/"
+  ];
+
+  disabledTests = [
+    "test_lookup"
+    "test_unique_addresses"
+    "test_get_http_json"
+  ];
+
+  meta = with lib; {
+    description = "Library to retrieve and parse whois data";
+    homepage = "https://github.com/secynic/ipwhois";
+    changelog = "https://github.com/secynic/ipwhois/blob/v${version}/CHANGES.rst";
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/rangehttpserver/default.nix b/pkgs/development/python-modules/rangehttpserver/default.nix
index 673661b07b9..010b959edad 100644
--- a/pkgs/development/python-modules/rangehttpserver/default.nix
+++ b/pkgs/development/python-modules/rangehttpserver/default.nix
@@ -2,20 +2,20 @@
 , buildPythonPackage
 , fetchFromGitHub
 , setuptools
-, nose
+, pytestCheckHook
 , requests
 }:
 
 buildPythonPackage rec {
   pname = "rangehttpserver";
-  version = "1.2.0";
+  version = "1.3.3";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "danvk";
     repo = "RangeHTTPServer";
-    rev = version;
-    sha256 = "1sy9j6y8kp5jiwv2vd652v94kspp1yd4dwxrfqfn6zwnfyv2mzv5";
+    rev = "refs/tags/${version}";
+    hash = "sha256-ZXEbis37QO8t05JQ2qQQf5rkUSxq3DwzR3khAJkZ5W0=";
   };
 
   nativeBuildInputs = [
@@ -23,16 +23,10 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
-    nose
+    pytestCheckHook
     requests
   ];
 
-  checkPhase = ''
-    runHook preCheck
-    nosetests
-    runHook postCheck
-  '';
-
   pythonImportsCheck = [
     "RangeHTTPServer"
   ];
@@ -40,6 +34,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "SimpleHTTPServer with support for Range requests";
     homepage = "https://github.com/danvk/RangeHTTPServer";
+    changelog = "https://github.com/danvk/RangeHTTPServer/releases/tag/${version}";
     license = licenses.asl20;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/tools/hclfmt/default.nix b/pkgs/development/tools/hclfmt/default.nix
index 002d9b9548d..63042f8c382 100644
--- a/pkgs/development/tools/hclfmt/default.nix
+++ b/pkgs/development/tools/hclfmt/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "hclfmt";
-  version = "2.16.1";
+  version = "2.16.2";
 
   src = fetchFromGitHub {
     owner = "hashicorp";
     repo = "hcl";
     rev = "v${version}";
-    hash = "sha256-EsqOpVCsn0bD0BAOoFifH1hfEF8Wu8bUpM0/BSXAewY=";
+    hash = "sha256-7RHRUIZhF6UOZDi85HAzQhzD7c8Y4aPjt4Ly3KUM26k=";
   };
 
   vendorHash = "sha256-QZzDFVAmmjkm7n/KpMxDMAjShKiVVGZbZB1W3/TeVjs=";
diff --git a/pkgs/development/tools/protoc-gen-go-grpc/default.nix b/pkgs/development/tools/protoc-gen-go-grpc/default.nix
index b880921e1e0..fab6bfec12f 100644
--- a/pkgs/development/tools/protoc-gen-go-grpc/default.nix
+++ b/pkgs/development/tools/protoc-gen-go-grpc/default.nix
@@ -5,17 +5,17 @@
 
 buildGoModule rec {
   pname = "protoc-gen-go-grpc";
-  version = "1.2.0";
+  version = "1.3.0";
   modRoot = "cmd/protoc-gen-go-grpc";
 
   src = fetchFromGitHub {
     owner = "grpc";
     repo = "grpc-go";
     rev = "cmd/protoc-gen-go-grpc/v${version}";
-    sha256 = "sha256-pIHMykwwyu052rqwSV5Js0+JCKCNLrFVN6XQ3xjlEOI=";
+    sha256 = "sha256-Zy0k5X/KFzCao9xAGt5DNb0MMGEyqmEsDj+uvXI4xH4=";
   };
 
-  vendorSha256 = "sha256-yxOfgTA5IIczehpWMM1kreMqJYKgRT5HEGbJ3SeQ/Lg=";
+  vendorHash = "sha256-y+/hjYUTFZuq55YAZ5M4T1cwIR+XFQBmWVE+Cg1Y7PI=";
 
   meta = with lib; {
     description = "The Go language implementation of gRPC. HTTP/2 based RPC";
diff --git a/pkgs/development/tools/rust/cargo-pgx/buildPgxExtension.nix b/pkgs/development/tools/rust/cargo-pgx/buildPgxExtension.nix
new file mode 100644
index 00000000000..4b4f7f9d748
--- /dev/null
+++ b/pkgs/development/tools/rust/cargo-pgx/buildPgxExtension.nix
@@ -0,0 +1,160 @@
+# preBuildAndTest and some small other bits
+# taken from https://github.com/tcdi/pgx/blob/v0.4.5/nix/extension.nix
+# (but now heavily modified)
+# which uses MIT License with the following license file
+#
+# MIT License
+#
+# Portions Copyright 2019-2021 ZomboDB, LLC.
+# Portions Copyright 2021-2022 Technology Concepts & Design, Inc. <support@tcdi.com>.
+# All rights reserved.
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in all
+# copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+
+{ lib
+, cargo-pgx
+, pkg-config
+, rustPlatform
+, stdenv
+, Security
+, writeShellScriptBin
+}:
+
+# The idea behind: Use it mostly like rustPlatform.buildRustPackage and so
+# we hand most of the arguments down.
+#
+# Additional arguments are:
+#   - `postgresql` postgresql package of the version of postgresql this extension should be build for.
+#                  Needs to be the build platform variant.
+#   - `useFakeRustfmt` Whether to use a noop fake command as rustfmt. cargo-pgx tries to call rustfmt.
+#                      If the generated rust bindings aren't needed to use the extension, its a
+#                      unnecessary and heavy dependency. If you set this to true, you also
+#                      have to add `rustfmt` to `nativeBuildInputs`.
+
+{ buildAndTestSubdir ? null
+, buildType ? "release"
+, buildFeatures ? [ ]
+, cargoBuildFlags ? [ ]
+, postgresql
+# cargo-pgx calls rustfmt on generated bindings, this is not strictly necessary, so we avoid the
+# dependency here. Set to false and provide rustfmt in nativeBuildInputs, if you need it, e.g.
+# if you include the generated code in the output via postInstall.
+, useFakeRustfmt ? true
+, ...
+} @ args:
+let
+  rustfmtInNativeBuildInputs = lib.lists.any (dep: lib.getName dep == "rustfmt") (args.nativeBuildInputs or []);
+in
+
+assert lib.asserts.assertMsg ((args.installPhase or "") == "")
+  "buildPgxExtensions overwrites the installPhase, so providing one does nothing";
+assert lib.asserts.assertMsg ((args.buildPhase or "") == "")
+  "buildPgxExtensions overwrites the buildPhase, so providing one does nothing";
+assert lib.asserts.assertMsg (useFakeRustfmt -> !rustfmtInNativeBuildInputs)
+  "The parameter useFakeRustfmt is set to true, but rustfmt is included in nativeBuildInputs. Either set useFakeRustfmt to false or remove rustfmt from nativeBuildInputs.";
+assert lib.asserts.assertMsg (!useFakeRustfmt -> rustfmtInNativeBuildInputs)
+  "The parameter useFakeRustfmt is set to false, but rustfmt is not included in nativeBuildInputs. Either set useFakeRustfmt to true or add rustfmt from nativeBuildInputs.";
+
+let
+  fakeRustfmt = writeShellScriptBin "rustfmt" ''
+    exit 0
+    '';
+  maybeDebugFlag = lib.optionalString (buildType != "release") "--debug";
+  maybeEnterBuildAndTestSubdir = lib.optionalString (buildAndTestSubdir != null) ''
+    export CARGO_TARGET_DIR="$(pwd)/target"
+    pushd "${buildAndTestSubdir}"
+  '';
+  maybeLeaveBuildAndTestSubdir = lib.optionalString (buildAndTestSubdir != null) "popd";
+
+  pgxPostgresMajor = lib.versions.major postgresql.version;
+  preBuildAndTest = ''
+    export PGX_HOME=$(mktemp -d)
+    export PGDATA="$PGX_HOME/data-${pgxPostgresMajor}/"
+    cargo-pgx pgx init "--pg${pgxPostgresMajor}" ${postgresql}/bin/pg_config
+    echo "unix_socket_directories = '$(mktemp -d)'" > "$PGDATA/postgresql.conf"
+
+    # This is primarily for Mac or other Nix systems that don't use the nixbld user.
+    export USER="$(whoami)"
+    pg_ctl start
+    createuser -h localhost --superuser --createdb "$USER" || true
+    pg_ctl stop
+  '';
+
+  argsForBuildRustPackage = builtins.removeAttrs args [ "postgresql" "useFakeRustfmt" ];
+
+  # so we don't accidentally `(rustPlatform.buildRustPackage argsForBuildRustPackage) // { ... }` because
+  # we forgot parentheses
+  finalArgs = argsForBuildRustPackage // {
+    buildInputs = (args.buildInputs or [ ]) ++ lib.optionals stdenv.isDarwin [ Security ];
+
+    nativeBuildInputs = (args.nativeBuildInputs or [ ]) ++ [
+      cargo-pgx
+      postgresql
+      pkg-config
+      rustPlatform.bindgenHook
+    ] ++ lib.optionals useFakeRustfmt [ fakeRustfmt ];
+
+    buildPhase = ''
+      runHook preBuild
+
+      echo "Executing cargo-pgx buildPhase"
+      ${preBuildAndTest}
+      ${maybeEnterBuildAndTestSubdir}
+
+      NIX_PGLIBDIR="${postgresql}/lib" \
+      PGX_BUILD_FLAGS="--frozen -j $NIX_BUILD_CORES ${builtins.concatStringsSep " " cargoBuildFlags}" \
+      cargo-pgx pgx package \
+        --pg-config ${postgresql}/bin/pg_config \
+        ${maybeDebugFlag} \
+        --features "${builtins.concatStringsSep " " buildFeatures}" \
+        --out-dir "$out"
+
+      ${maybeLeaveBuildAndTestSubdir}
+
+      runHook postBuild
+    '';
+
+    preCheck = preBuildAndTest + args.preCheck or "";
+
+    installPhase = ''
+      runHook preInstall
+
+      echo "Executing buildPgxExtension install"
+
+      ${maybeEnterBuildAndTestSubdir}
+
+      cargo-pgx pgx stop all
+
+      mv $out/${postgresql}/* $out
+      rm -rf $out/nix
+
+      ${maybeLeaveBuildAndTestSubdir}
+
+      runHook postInstall
+    '';
+
+    PGX_PG_SYS_SKIP_BINDING_REWRITE = "1";
+    CARGO_BUILD_INCREMENTAL = "false";
+    RUST_BACKTRACE = "full";
+
+    checkNoDefaultFeatures = true;
+    checkFeatures = (args.checkFeatures or [ ]) ++ [ "pg_test pg${pgxPostgresMajor}" ];
+  };
+in
+rustPlatform.buildRustPackage finalArgs
diff --git a/pkgs/development/tools/rust/cargo-update/default.nix b/pkgs/development/tools/rust/cargo-update/default.nix
index 61dc0d655fb..519e160e672 100644
--- a/pkgs/development/tools/rust/cargo-update/default.nix
+++ b/pkgs/development/tools/rust/cargo-update/default.nix
@@ -15,14 +15,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-update";
-  version = "11.1.1";
+  version = "11.1.2";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-ml+LqfnDld+I3G6+LaPJOeZa+swCtuu0ndW0yJraSxs=";
+    sha256 = "sha256-Hil4v9EUVEH1j7LV1icct6ggFzGVy3f8p+LuFrlBOVA=";
   };
 
-  cargoSha256 = "sha256-0exatgmksg07KQO/3s9BD4uIZRHwjytQPtaRv+JydPc=";
+  cargoHash = "sha256-gOhZUJHBYti/kqfhyopRsY1PbXZdiGJZpjohMUbO/28=";
 
   nativeBuildInputs = [ cmake installShellFiles pkg-config ronn ];
 
diff --git a/pkgs/misc/cups/filters.nix b/pkgs/misc/cups/filters.nix
index e44c9634b0f..6da2226fa65 100644
--- a/pkgs/misc/cups/filters.nix
+++ b/pkgs/misc/cups/filters.nix
@@ -75,6 +75,9 @@ stdenv.mkDerivation rec {
 
   makeFlags = [ "CUPS_SERVERBIN=$(out)/lib/cups" "CUPS_DATADIR=$(out)/share/cups" "CUPS_SERVERROOT=$(out)/etc/cups" ];
 
+  # https://github.com/OpenPrinting/cups-filters/issues/512
+  env.NIX_CFLAGS_COMPILE = "-std=c++17";
+
   postConfigure =
     ''
       # Ensure that bannertopdf can find the PDF templates in
diff --git a/pkgs/servers/monitoring/prometheus/statsd-exporter.nix b/pkgs/servers/monitoring/prometheus/statsd-exporter.nix
index 6930398407c..309ccfd4dfa 100644
--- a/pkgs/servers/monitoring/prometheus/statsd-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/statsd-exporter.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "statsd_exporter";
-  version = "0.23.0";
+  version = "0.23.1";
 
   src = fetchFromGitHub {
     owner = "prometheus";
     repo = "statsd_exporter";
     rev = "v${version}";
-    hash = "sha256-7atRLwucO09yN2odu0uNe7xrtKLq9kmy6JyI1y4Sww8=";
+    hash = "sha256-JbRkLRXTQo40wBynfG6BRR4+yPqy7VLJ33vsjus5okg=";
   };
 
-  vendorHash = "sha256-H0f7bDnSddlabpRbMpk9tInlne2tI5J+MQ23mw1N71E=";
+  vendorHash = "sha256-YzcgEQ1S2qn7v2SVSBiodprtc+D4cSZOFBJwpq3jz8Y=";
 
   meta = with lib; {
     description = "Receives StatsD-style metrics and exports them to Prometheus";
diff --git a/pkgs/servers/sql/postgresql/ext/timescaledb_toolkit.nix b/pkgs/servers/sql/postgresql/ext/timescaledb_toolkit.nix
new file mode 100644
index 00000000000..d672928cd3d
--- /dev/null
+++ b/pkgs/servers/sql/postgresql/ext/timescaledb_toolkit.nix
@@ -0,0 +1,42 @@
+{ lib
+, fetchFromGitHub
+, buildPgxExtension
+, postgresql
+, stdenv
+, nixosTests
+}:
+
+buildPgxExtension rec {
+  inherit postgresql;
+
+  pname = "timescaledb_toolkit";
+  version = "1.14.0";
+
+  src = fetchFromGitHub {
+    owner = "timescale";
+    repo = "timescaledb-toolkit";
+    rev = version;
+    sha256 = "sha256-ADmYALsCzZGqTX0XSkCif7ndvXwa8nEqddQpty4hbZ0=";
+  };
+
+  cargoSha256 = "sha256-ukjJ11LmfG+k8D20rj68i43gOWUN80nf3hIAjUWXihI=";
+  buildAndTestSubdir = "extension";
+
+  passthru.tests = {
+    timescaledb_toolkit = nixosTests.timescaledb;
+  };
+
+  # tests take really long
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Provide additional tools to ease all things analytic when using TimescaleDB";
+    homepage = "https://github.com/timescale/timescaledb-toolkit";
+    maintainers = with maintainers; [ typetetris ];
+    platforms = postgresql.meta.platforms;
+    license = licenses.asl20;
+
+    # as it needs to be used with timescaledb, simply use the condition from there
+    broken = versionOlder postgresql.version "12";
+  };
+}
diff --git a/pkgs/servers/sql/postgresql/packages.nix b/pkgs/servers/sql/postgresql/packages.nix
index 2bf9db061a9..b6fc6480aec 100644
--- a/pkgs/servers/sql/postgresql/packages.nix
+++ b/pkgs/servers/sql/postgresql/packages.nix
@@ -56,6 +56,8 @@ self: super: {
 
     timescaledb = super.callPackage ./ext/timescaledb.nix { };
 
+    timescaledb_toolkit = super.callPackage ./ext/timescaledb_toolkit.nix { };
+
     tsearch_extras = super.callPackage ./ext/tsearch_extras.nix { };
 
     tds_fdw = super.callPackage ./ext/tds_fdw.nix { };
diff --git a/pkgs/tools/admin/eksctl/default.nix b/pkgs/tools/admin/eksctl/default.nix
index b00d8327b41..8cea35d5ace 100644
--- a/pkgs/tools/admin/eksctl/default.nix
+++ b/pkgs/tools/admin/eksctl/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "eksctl";
-  version = "0.132.0";
+  version = "0.133.0";
 
   src = fetchFromGitHub {
     owner = "weaveworks";
     repo = pname;
     rev = version;
-    sha256 = "sha256-wKTESd+YKJd94yUuqm1v4biyGCABbhwTlKLzbiOg6H0=";
+    sha256 = "sha256-QRm0a7x39vhxRT29+tTrpr3ZyPPHtHtxLWiyqTgPYCM=";
   };
 
-  vendorHash = "sha256-A06vwsadznqe1xraMZnseRAJkrpCdciKBxPUBus39ws=";
+  vendorHash = "sha256-R/VFq+SO/ZWf9ztg/75ASidqznCkO47T2PFsgKJwEWM=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/games/scarab/default.nix b/pkgs/tools/games/scarab/default.nix
index 56e94807fec..7cdac9e5114 100644
--- a/pkgs/tools/games/scarab/default.nix
+++ b/pkgs/tools/games/scarab/default.nix
@@ -17,13 +17,13 @@
 
 buildDotnetModule rec {
   pname = "scarab";
-  version = "1.20.0.0";
+  version = "1.31.0.0";
 
   src = fetchFromGitHub {
     owner = "fifty-six";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-VfXIxir4SaELuF2QpqbVzTvlkYxwERa0ddGEn1OAh04=";
+    sha256 = "sha256-oReU0kL0wPR6oqhq/uzO7nD1qo74h36w/gyvgffwzns=";
   };
 
   nugetDeps = ./deps.nix;
diff --git a/pkgs/tools/misc/geekbench/4.nix b/pkgs/tools/misc/geekbench/4.nix
index d7b6152e078..789f92babf8 100644
--- a/pkgs/tools/misc/geekbench/4.nix
+++ b/pkgs/tools/misc/geekbench/4.nix
@@ -1,4 +1,12 @@
-{ lib, stdenv, fetchurl, makeWrapper, ocl-icd, vulkan-loader, linuxPackages }:
+{ lib
+, stdenv
+, fetchurl
+, autoPatchelfHook
+, addOpenGLRunpath
+, makeWrapper
+, ocl-icd
+, vulkan-loader
+}:
 
 stdenv.mkDerivation rec {
   pname = "geekbench";
@@ -12,23 +20,25 @@ stdenv.mkDerivation rec {
   dontConfigure = true;
   dontBuild = true;
 
-  nativeBuildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ autoPatchelfHook makeWrapper ];
+  buildInputs = [ stdenv.cc.cc ];
 
   installPhase = ''
-    mkdir -p $out/bin $out/lib
+    runHook preInstall
+
+    mkdir -p $out/bin
     cp -r geekbench.plar geekbench4 geekbench_x86_64 $out/bin
 
-    # needed for compute benchmark
-    ln -s ${linuxPackages.nvidia_x11}/lib/libcuda.so $out/lib/
-    ln -s ${ocl-icd}/lib/libOpenCL.so $out/lib/
-    ln -s ${ocl-icd}/lib/libOpenCL.so.1 $out/lib/
-    ln -s ${vulkan-loader}/lib/libvulkan.so $out/lib/
-    ln -s ${vulkan-loader}/lib/libvulkan.so.1 $out/lib/
-
     for f in geekbench4 geekbench_x86_64 ; do
-      patchelf --set-interpreter $(cat ${stdenv.cc}/nix-support/dynamic-linker) $out/bin/$f
-      wrapProgram $out/bin/$f --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ stdenv.cc.cc.lib ]}:$out/lib/"
+      wrapProgram $out/bin/$f \
+        --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [
+          addOpenGLRunpath.driverLink
+          ocl-icd
+          vulkan-loader
+       ]}"
     done
+
+    runHook postInstall
   '';
 
   meta = with lib; {
@@ -38,5 +48,6 @@ stdenv.mkDerivation rec {
     license = licenses.unfree;
     maintainers = [ maintainers.michalrus ];
     platforms = [ "x86_64-linux" ];
+    mainProgram = "geekbench4";
   };
 }
diff --git a/pkgs/tools/misc/geekbench/5.nix b/pkgs/tools/misc/geekbench/5.nix
new file mode 100644
index 00000000000..1fc28f8c021
--- /dev/null
+++ b/pkgs/tools/misc/geekbench/5.nix
@@ -0,0 +1,52 @@
+{ lib
+, stdenv
+, fetchurl
+, autoPatchelfHook
+, addOpenGLRunpath
+, makeWrapper
+, ocl-icd
+, vulkan-loader
+}:
+
+stdenv.mkDerivation rec {
+  pname = "geekbench";
+  version = "5.5.1";
+
+  src = fetchurl {
+    url = "https://cdn.geekbench.com/Geekbench-${version}-Linux.tar.gz";
+    sha256 = "sha256-MgN+VcPcjzYP4Wt/uxiNMTh+p1mA5I2M8CgzDjI5xAQ=";
+  };
+
+  dontConfigure = true;
+  dontBuild = true;
+
+  nativeBuildInputs = [ autoPatchelfHook makeWrapper ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    cp -r geekbench.plar geekbench5 geekbench_x86_64 $out/bin
+
+    for f in geekbench5 geekbench_x86_64 ; do
+      wrapProgram $out/bin/$f \
+        --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [
+          addOpenGLRunpath.driverLink
+          ocl-icd
+          vulkan-loader
+       ]}"
+    done
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Cross-platform benchmark";
+    homepage = "https://geekbench.com/";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+    license = licenses.unfree;
+    maintainers = [ maintainers.michalrus ];
+    platforms = [ "x86_64-linux" ];
+    mainProgram = "geekbench5";
+  };
+}
diff --git a/pkgs/tools/misc/geekbench/6.nix b/pkgs/tools/misc/geekbench/6.nix
new file mode 100644
index 00000000000..46b1cbe7196
--- /dev/null
+++ b/pkgs/tools/misc/geekbench/6.nix
@@ -0,0 +1,52 @@
+{ lib
+, stdenv
+, fetchurl
+, autoPatchelfHook
+, addOpenGLRunpath
+, makeWrapper
+, ocl-icd
+, vulkan-loader
+}:
+
+stdenv.mkDerivation rec {
+  pname = "geekbench";
+  version = "6.0.1";
+
+  src = fetchurl {
+    url = "https://cdn.geekbench.com/Geekbench-${version}-Linux.tar.gz";
+    hash = "sha256-RrfyB7RvYWkVCbjblLIPOFcZjUR/fJHk1Em1HP74kmY=";
+  };
+
+  dontConfigure = true;
+  dontBuild = true;
+
+  nativeBuildInputs = [ autoPatchelfHook makeWrapper ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    cp -r geekbench.plar geekbench-workload.plar geekbench6 geekbench_x86_64 geekbench_avx2 $out/bin
+
+    for f in geekbench6 geekbench_x86_64 geekbench_avx2 ; do
+      wrapProgram $out/bin/$f \
+        --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [
+          addOpenGLRunpath.driverLink
+          ocl-icd
+          vulkan-loader
+        ]}"
+    done
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Cross-platform benchmark";
+    homepage = "https://geekbench.com/";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+    license = licenses.unfree;
+    maintainers = [ maintainers.michalrus ];
+    platforms = [ "x86_64-linux" ];
+    mainProgram = "geekbench6";
+  };
+}
diff --git a/pkgs/tools/misc/geekbench/default.nix b/pkgs/tools/misc/geekbench/default.nix
deleted file mode 100644
index 77be76f2d2e..00000000000
--- a/pkgs/tools/misc/geekbench/default.nix
+++ /dev/null
@@ -1,42 +0,0 @@
-{ lib, stdenv, fetchurl, makeWrapper, ocl-icd, vulkan-loader, linuxPackages }:
-
-stdenv.mkDerivation rec {
-  pname = "geekbench";
-  version = "5.4.6";
-
-  src = fetchurl {
-    url = "https://cdn.geekbench.com/Geekbench-${version}-Linux.tar.gz";
-    sha256 = "sha256-fCS6cSD3w2EbLL1yNfH+NKxswRUY4zyCR07gKGXW4Yc=";
-  };
-
-  dontConfigure = true;
-  dontBuild = true;
-
-  nativeBuildInputs = [ makeWrapper ];
-
-  installPhase = ''
-    mkdir -p $out/bin $out/lib
-    cp -r geekbench.plar geekbench5 geekbench_x86_64 $out/bin
-
-    # needed for compute benchmark
-    ln -s ${linuxPackages.nvidia_x11}/lib/libcuda.so $out/lib/
-    ln -s ${ocl-icd}/lib/libOpenCL.so $out/lib/
-    ln -s ${ocl-icd}/lib/libOpenCL.so.1 $out/lib/
-    ln -s ${vulkan-loader}/lib/libvulkan.so $out/lib/
-    ln -s ${vulkan-loader}/lib/libvulkan.so.1 $out/lib/
-
-    for f in geekbench5 geekbench_x86_64 ; do
-      patchelf --set-interpreter $(cat ${stdenv.cc}/nix-support/dynamic-linker) $out/bin/$f
-      wrapProgram $out/bin/$f --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ stdenv.cc.cc.lib ]}:$out/lib/"
-    done
-  '';
-
-  meta = with lib; {
-    description = "Cross-platform benchmark";
-    homepage = "https://geekbench.com/";
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    license = licenses.unfree;
-    maintainers = [ maintainers.michalrus ];
-    platforms = [ "x86_64-linux" ];
-  };
-}
diff --git a/pkgs/tools/misc/turbo/default.nix b/pkgs/tools/misc/turbo/default.nix
index 5aca983252d..520a4553b47 100644
--- a/pkgs/tools/misc/turbo/default.nix
+++ b/pkgs/tools/misc/turbo/default.nix
@@ -14,12 +14,12 @@
 , go
 }:
 let
-  version = "1.7.0";
+  version = "1.8.3";
   src = fetchFromGitHub {
     owner = "vercel";
     repo = "turbo";
     rev = "v${version}";
-    sha256 = "YTuEv2S3jNV2o7HJML+P6OMazgwgRhUPnd/zaTWfDWs=";
+    sha256 = "sha256-aqe9ze6xZ5RUJJGT19nABhorrL9+ctSTS+ov97hG30o=";
   };
 
   go-turbo = buildGoModule rec {
@@ -27,7 +27,7 @@ let
     pname = "go-turbo";
     modRoot = "cli";
 
-    vendorSha256 = "Kx/CLFv23h2TmGe8Jwu+S3QcONfqeHk2fCW1na75c0s=";
+    vendorSha256 = "sha256-lqumN+xqJXEPI+nVnWSNfAyvQQ6fS9ao8uhwA1EbWWM=";
 
     nativeBuildInputs = [
       git
@@ -64,7 +64,7 @@ rustPlatform.buildRustPackage rec {
   ];
   RELEASE_TURBO_CLI = "true";
 
-  cargoSha256 = "ENw6NU3Fedd+OJEEWgL8A54aowNqjn3iv7rxlr+/4ZE=";
+  cargoSha256 = "sha256-zUz/u89VtiK0bFpyoQMMXUoXQpqPNOLR+PN3EbXSAC0=";
   RUSTC_BOOTSTRAP = 1;
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/tools/networking/netbird/default.nix b/pkgs/tools/networking/netbird/default.nix
index dc306a0d603..80cc4f097a2 100644
--- a/pkgs/tools/networking/netbird/default.nix
+++ b/pkgs/tools/networking/netbird/default.nix
@@ -14,16 +14,16 @@ let
 in
 buildGoModule rec {
   pname = "netbird";
-  version = "0.14.2";
+  version = "0.14.4";
 
   src = fetchFromGitHub {
     owner = "netbirdio";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-qrXD/jRLyQR4T3tffCs+Nby+cvRPVvGNHy0NQAmYYAg=";
+    sha256 = "sha256-AzWYJGYlUsgR5ihXwY9ZyN/pL5avionql/jwqhYKsxc=";
   };
 
-  vendorHash = "sha256-2/kk4qTO85fYnNO5vXIFxxFR55xZ5wenogJTMsLfYsg=";
+  vendorHash = "sha256-8cVEujVKwKvO81H+ukVxQouVVH7uZm/FwK9RAKJLN2c=";
 
   nativeBuildInputs = [ installShellFiles ] ++ lib.optional ui pkg-config;
 
diff --git a/pkgs/tools/security/trufflehog/default.nix b/pkgs/tools/security/trufflehog/default.nix
index 70082c1e562..7bfa0e0a19a 100644
--- a/pkgs/tools/security/trufflehog/default.nix
+++ b/pkgs/tools/security/trufflehog/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "trufflehog";
-  version = "3.29.0";
+  version = "3.29.1";
 
   src = fetchFromGitHub {
     owner = "trufflesecurity";
     repo = "trufflehog";
     rev = "refs/tags/v${version}";
-    hash = "sha256-iu6MrfRWlfUeVsCoqxp/jFT8gcOieDplx1Jdjk8txOU=";
+    hash = "sha256-ZCHrqvqIlANqkZ/zVYbwOsRimWVUAZ8zvBnfTaBE8qk=";
   };
 
   vendorHash = "sha256-Z1QJM2feKFQ8MEVwzYt+MkpDZHiaVWlzq2lbResWQWk=";
diff --git a/pkgs/tools/security/vals/default.nix b/pkgs/tools/security/vals/default.nix
index b029b710fc1..c9fad8b068e 100644
--- a/pkgs/tools/security/vals/default.nix
+++ b/pkgs/tools/security/vals/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "vals";
-  version = "0.22.0";
+  version = "0.23.0";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "variantdev";
     repo = pname;
-    sha256 = "sha256-/XBjGbpQIeO7UehcZv2kN4k2ZOsfhduUteURAqaUpwQ=";
+    sha256 = "sha256-YIzy8WPguIrhkg1HW2X714Xp9b+eL6bej/oXN62kyus=";
   };
 
-  vendorHash = "sha256-l837w2K3GsDTb9EEeYPfyrnkRSkv0FyoPr29Ud+iiJ8=";
+  vendorHash = "sha256-CzfAUNKskEbxWmVGz/XHItUS9Mp12zjTJ3z9X7YBjR4=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/tools/text/vale/default.nix b/pkgs/tools/text/vale/default.nix
index 20c9226efd9..f1aaf769f66 100644
--- a/pkgs/tools/text/vale/default.nix
+++ b/pkgs/tools/text/vale/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "vale";
-  version = "2.23.3";
+  version = "2.24.0";
 
   subPackages = [ "cmd/vale" ];
   outputs = [ "out" "data" ];
@@ -11,7 +11,7 @@ buildGoModule rec {
     owner = "errata-ai";
     repo = "vale";
     rev = "v${version}";
-    hash = "sha256-M4tq/gUpI0tGMJJOHE2TtGIbFzbv9/pP6yZGDf68VHI=";
+    hash = "sha256-mUZ9ktqy6zLwPNjr8raJHwn6/UL4kzlT1baE+HrwPgo=";
   };
 
   vendorHash = "sha256-ZgBt4BgZWViNqYCuqb/Wt1zVjFM9h1UsmsYox7kMJ1A=";
diff --git a/pkgs/tools/wayland/cliphist/default.nix b/pkgs/tools/wayland/cliphist/default.nix
index 473c6fabc5a..9ca747ca46b 100644
--- a/pkgs/tools/wayland/cliphist/default.nix
+++ b/pkgs/tools/wayland/cliphist/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "cliphist";
-  version = "0.3.1";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "sentriz";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-kmXR8xzjAphgaC2Yd55VwZIJ4ehxP1LEA24hgyAbM7A=";
+    sha256 = "sha256-V115xsdSAsxp1RQpCVoGqkkb8J6Rvj5NNNtPMwT9IAg=";
   };
 
-  vendorSha256 = "sha256-LZnefa0FjYG39YJrSN9ef6OnXHXgSrlSL4LvRqLxFx4=";
+  vendorHash = "sha256-/xu1kcSOBOVz7XNxe4Jl905HtFWFOaZHKkLNFaLMVEs=";
 
   meta = with lib; {
     description = "Wayland clipboard manager";
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 0e8b9bddb62..dd2c8c7735c 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -511,6 +511,8 @@ mapAliases ({
   gdal_1_11 = throw "gdal_1_11 was removed. Use gdal instead"; # Added 2021-04-03
   gdb-multitarget = throw "'gdb-multitarget' has been renamed to/replaced by 'gdb'"; # Converted to throw 2022-02-22
   gdk_pixbuf = throw "'gdk_pixbuf' has been renamed to/replaced by 'gdk-pixbuf'"; # Converted to throw 2022-02-22
+  geekbench4 = throw "'geekbench4' has been renamed to 'geekbench_4'"; # Added 2023-03-10
+  geekbench5 = throw "'geekbench5' has been renamed to 'geekbench_5'"; # Added 2023-03-10
   getmail = throw "getmail has been removed from nixpkgs, migrate to getmail6"; # Added 2022-01-12
   gettextWithExpat = throw "'gettextWithExpat' has been renamed to/replaced by 'gettext'"; # Converted to throw 2022-02-22
   gfm = throw "gfm has been removed"; # Added 2021-01-15
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 8400982f2cc..4190117b38a 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -4837,9 +4837,10 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) Security;
   };
 
-  geekbench4 = callPackage ../tools/misc/geekbench/4.nix { };
-  geekbench5 = callPackage ../tools/misc/geekbench { };
-  geekbench = geekbench5;
+  geekbench_4 = callPackage ../tools/misc/geekbench/4.nix { };
+  geekbench_5 = callPackage ../tools/misc/geekbench/5.nix { };
+  geekbench_6 = callPackage ../tools/misc/geekbench/6.nix { };
+  geekbench = geekbench_6;
 
   gencfsm = callPackage ../tools/security/gencfsm { };
 
@@ -15936,6 +15937,9 @@ with pkgs;
   cargo-pgx = callPackage ../development/tools/rust/cargo-pgx {
     inherit (darwin.apple_sdk.frameworks) Security;
   };
+  buildPgxExtension = callPackage ../development/tools/rust/cargo-pgx/buildPgxExtension.nix {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
   cargo-release = callPackage ../development/tools/rust/cargo-release { };
   cargo-rr = callPackage ../development/tools/rust/cargo-rr { };
   cargo-tarpaulin = callPackage ../development/tools/analysis/cargo-tarpaulin {
@@ -30889,7 +30893,8 @@ with pkgs;
   };
 
   jabref = callPackage ../applications/office/jabref {
-    jdk = javaPackages.compiler.openjdk18;
+    jdk = jdk19.override { enableJavaFX = true; };
+    gradle = gradle_7;
   };
 
   jack_capture = callPackage ../applications/audio/jack-capture { };
diff --git a/pkgs/top-level/dotnet-packages.nix b/pkgs/top-level/dotnet-packages.nix
index bdf8faa66f0..d62ebf95184 100644
--- a/pkgs/top-level/dotnet-packages.nix
+++ b/pkgs/top-level/dotnet-packages.nix
@@ -333,13 +333,13 @@ let self = dotnetPackages // overrides; dotnetPackages = with self; {
 
   Nuget = buildDotnetPackage rec {
     pname = "Nuget";
-    version = "5.6.0.6489";
+    version = "6.3.1.1";
 
     src = fetchFromGitHub {
       owner = "mono";
       repo = "linux-packaging-nuget";
       rev = "upstream/${version}.bin";
-      sha256 = "sha256-71vjM7a+F0DNTY+dML3UBSkrVyXv/k5rdl7iXBKSpNM=";
+      sha256 = "sha256-D7F4B23HK5ElY68PYKVDsyi8OF0DLqqUqQzj5CpMfkc=";
     };
 
     # configurePhase breaks the binary and results in
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index e22f41a63cd..ac8af28fbcc 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -483,7 +483,7 @@ let
     };
     ffmpeg-avdevice = callPackage ../development/ocaml-modules/ffmpeg/ffmpeg-avdevice.nix {
       inherit (pkgs) ffmpeg;
-      inherit (pkgs.darwin.apple_sdk.frameworks) AppKit AudioToolbox Cocoa CoreImage ForceFeedback OpenGL VideoToolbox;
+      inherit (pkgs.darwin.apple_sdk.frameworks) AppKit AudioToolbox AVFoundation Cocoa CoreImage ForceFeedback OpenGL VideoToolbox;
     };
 
     fiber = callPackage ../development/ocaml-modules/fiber { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index c62145b17f4..ceb79506874 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -4793,6 +4793,8 @@ self: super: with self; {
 
   ipwhl = callPackage ../development/python-modules/ipwhl { };
 
+  ipwhois = callPackage ../development/python-modules/ipwhois { };
+
   ipy = callPackage ../development/python-modules/IPy { };
 
   ipydatawidgets = callPackage ../development/python-modules/ipydatawidgets { };