diff --git a/doc/stdenv/meta.chapter.md b/doc/stdenv/meta.chapter.md
index 46114dacb45..1fca829aa59 100644
--- a/doc/stdenv/meta.chapter.md
+++ b/doc/stdenv/meta.chapter.md
@@ -66,7 +66,7 @@ For details, see [Licenses](#sec-meta-license).
 
 ### `maintainers` {#var-meta-maintainers}
 
-A list of the maintainers of this Nix expression. Maintainers are defined in [`nixpkgs/maintainers/maintainer-list.nix`](https://github.com/NixOS/nixpkgs/blob/master/maintainers/maintainer-list.nix). There is no restriction to becoming a maintainer, just add yourself to that list in a separate commit titled “maintainers: add alice”, and reference maintainers with `maintainers = with lib.maintainers; [ alice bob ]`.
+A list of the maintainers of this Nix expression. Maintainers are defined in [`nixpkgs/maintainers/maintainer-list.nix`](https://github.com/NixOS/nixpkgs/blob/master/maintainers/maintainer-list.nix). There is no restriction to becoming a maintainer, just add yourself to that list in a separate commit titled “maintainers: add alice” in the same pull request, and reference maintainers with `maintainers = with lib.maintainers; [ alice bob ]`.
 
 ### `mainProgram` {#var-meta-mainProgram}
 
diff --git a/nixos/modules/installer/tools/nixos-enter.sh b/nixos/modules/installer/tools/nixos-enter.sh
old mode 100644
new mode 100755
index 30113ee0050..60a86d89abb
--- a/nixos/modules/installer/tools/nixos-enter.sh
+++ b/nixos/modules/installer/tools/nixos-enter.sh
@@ -100,8 +100,9 @@ chroot_add_resolv_conf "$mountPoint" || echo "$0: failed to set up resolv.conf"
     # Run the activation script. Set $LOCALE_ARCHIVE to supress some Perl locale warnings.
     LOCALE_ARCHIVE="$system/sw/lib/locale/locale-archive" IN_NIXOS_ENTER=1 chroot "$mountPoint" "$system/activate" 1>&2 || true
 
-    # Create /tmp
-    chroot "$mountPoint" "$system/sw/bin/systemd-tmpfiles" --create --remove --exclude-prefix=/dev 1>&2 || true
+    # Create /tmp. This is needed for nix-build and the NixOS activation script to work.
+    # Hide the unhelpful "failed to replace specifiers" errors caused by missing /etc/machine-id.
+    chroot "$mountPoint" "$system/sw/bin/systemd-tmpfiles" --create --remove -E 2> /dev/null || true
 )
 
 unset TMPDIR
diff --git a/nixos/modules/programs/xastir.nix b/nixos/modules/programs/xastir.nix
index 0977668d837..6d5fc59aac5 100644
--- a/nixos/modules/programs/xastir.nix
+++ b/nixos/modules/programs/xastir.nix
@@ -8,7 +8,7 @@ in {
   meta.maintainers = with maintainers; [ melling ];
 
   options.programs.xastir = {
-    enable = mkEnableOption (mdDoc "Enable Xastir Graphical APRS client");
+    enable = mkEnableOption (mdDoc "Xastir Graphical APRS client");
   };
 
   config = mkIf cfg.enable {
diff --git a/nixos/modules/services/monitoring/grafana.nix b/nixos/modules/services/monitoring/grafana.nix
index 9cce4c71d96..ba3f89e24dd 100644
--- a/nixos/modules/services/monitoring/grafana.nix
+++ b/nixos/modules/services/monitoring/grafana.nix
@@ -56,7 +56,7 @@ let
   provisionConfDir = pkgs.runCommand "grafana-provisioning" { nativeBuildInputs = [ pkgs.xorg.lndir ]; } ''
     mkdir -p $out/{datasources,dashboards,notifiers,alerting}
     ${ln { src = datasourceFileOrDir;    dir = "datasources"; filename = "datasource"; }}
-    ${ln { src = dashboardFileOrDir;     dir = "dashboards";  filename = "dashbaord"; }}
+    ${ln { src = dashboardFileOrDir;     dir = "dashboards";  filename = "dashboard"; }}
     ${ln { src = notifierFileOrDir;      dir = "notifiers";   filename = "notifier"; }}
     ${ln { src = rulesFileOrDir;         dir = "alerting";    filename = "rules"; }}
     ${ln { src = contactPointsFileOrDir; dir = "alerting";    filename = "contactPoints"; }}
diff --git a/nixos/tests/installer.nix b/nixos/tests/installer.nix
index 5f3f61632f0..70f5c9fa009 100644
--- a/nixos/tests/installer.nix
+++ b/nixos/tests/installer.nix
@@ -49,6 +49,8 @@ let
           boot.loader.systemd-boot.enable = true;
         ''}
 
+        boot.initrd.secrets."/etc/secret" = /etc/nixos/secret;
+
         users.users.alice = {
           isNormalUser = true;
           home = "/home/alice";
@@ -124,6 +126,7 @@ let
               }",
               "/mnt/etc/nixos/configuration.nix",
           )
+          machine.copy_from_host("${pkgs.writeText "secret" "secret"}", "/mnt/etc/nixos/secret")
 
       with subtest("Perform the installation"):
           machine.succeed("nixos-install < /dev/null >&2")
@@ -131,6 +134,19 @@ let
       with subtest("Do it again to make sure it's idempotent"):
           machine.succeed("nixos-install < /dev/null >&2")
 
+      with subtest("Check that we can build things in nixos-enter"):
+          machine.succeed(
+              """
+              nixos-enter -- nix-build --option substitute false -E 'derivation {
+                  name = "t";
+                  builder = "/bin/sh";
+                  args = ["-c" "echo nixos-enter build > $out"];
+                  system = builtins.currentSystem;
+                  preferLocalBuild = true;
+              }'
+              """
+          )
+
       with subtest("Shutdown system after installation"):
           machine.succeed("umount /mnt/boot || true")
           machine.succeed("umount /mnt")
diff --git a/pkgs/applications/editors/vscode/generic.nix b/pkgs/applications/editors/vscode/generic.nix
index ef9d49c5d15..1b4f4508fbf 100644
--- a/pkgs/applications/editors/vscode/generic.nix
+++ b/pkgs/applications/editors/vscode/generic.nix
@@ -1,5 +1,5 @@
 { stdenv, lib, makeDesktopItem
-, unzip, libsecret, libXScrnSaver, libxshmfence, wrapGAppsHook, makeWrapper
+, unzip, libsecret, libXScrnSaver, libxshmfence, buildPackages
 , atomEnv, at-spi2-atk, autoPatchelfHook
 , systemd, fontconfig, libdbusmenu, glib, buildFHSUserEnvBubblewrap, wayland
 
@@ -72,7 +72,8 @@ let
       ++ lib.optionals stdenv.isLinux [
         autoPatchelfHook
         nodePackages.asar
-        (wrapGAppsHook.override { inherit makeWrapper; })
+        # override doesn't preserve splicing https://github.com/NixOS/nixpkgs/issues/132651
+        (buildPackages.wrapGAppsHook.override { inherit (buildPackages) makeWrapper; })
       ];
 
     dontBuild = true;
diff --git a/pkgs/applications/misc/obsidian/default.nix b/pkgs/applications/misc/obsidian/default.nix
index 55aba845b0c..51841f9852a 100644
--- a/pkgs/applications/misc/obsidian/default.nix
+++ b/pkgs/applications/misc/obsidian/default.nix
@@ -12,7 +12,7 @@
 let
   inherit (stdenv.hostPlatform) system;
   pname = "obsidian";
-  version = "1.0.3";
+  version = "1.1.9";
   appname = "Obsidian";
   meta = with lib; {
     description = "A powerful knowledge base that works on top of a local folder of plain text Markdown files";
@@ -25,7 +25,7 @@ let
   filename = if stdenv.isDarwin then "Obsidian-${version}-universal.dmg" else "obsidian-${version}.tar.gz";
   src = fetchurl {
     url = "https://github.com/obsidianmd/obsidian-releases/releases/download/v${version}/${filename}";
-    sha256 = if stdenv.isDarwin then "sha256-DYF9fEpZaP4tD/eeZAegDahR7UZyroqNB9bn2U7sgXs=" else "sha256-MpQk5g4184ZkCAjLU5Ug0ReWgVADskS1QuMcnPdNofs=";
+    sha256 = if stdenv.isDarwin then "sha256-x+9WG938YQFP/HF7B9xENOXFSdOrPFOJ1ufxXj3kXps=" else "sha256-dFR7LaDRJwpxrNyPNseGi66gIAHOKf5Au2VXl7SBGSE=";
   };
 
   icon = fetchurl {
diff --git a/pkgs/applications/misc/oxker/default.nix b/pkgs/applications/misc/oxker/default.nix
index f518acd24a2..3d6e42bd628 100644
--- a/pkgs/applications/misc/oxker/default.nix
+++ b/pkgs/applications/misc/oxker/default.nix
@@ -2,14 +2,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "oxker";
-  version = "0.1.10";
+  version = "0.1.11";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-2NX2iW3cT9027j2gUsDTtdIFDmJKIGPfSzrGGwvK/VA=";
+    sha256 = "sha256-O4fVEYstDkVHn7fBVOGu1ok9K9xiO9uLx0+vb6qMZoA=";
   };
 
-  cargoSha256 = "sha256-//GI+roOsCLkKgMDUDK0YhJWmeIaYCMBt9r14+Rz8UQ=";
+  cargoHash = "sha256-LSMAE24E8Is/ejUE/2vogP0GmpF+9oO2pJoQOZ8OfU8=";
 
   meta = with lib; {
     description = "A simple tui to view & control docker containers";
diff --git a/pkgs/applications/misc/waylock/default.nix b/pkgs/applications/misc/waylock/default.nix
index 2a29eab2973..9ae1b348e3d 100644
--- a/pkgs/applications/misc/waylock/default.nix
+++ b/pkgs/applications/misc/waylock/default.nix
@@ -1,28 +1,27 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  zig,
-  wayland,
-  pkg-config,
-  scdoc,
-  wayland-protocols,
-  libxkbcommon,
-  pam,
+{ lib
+, stdenv
+, fetchFromGitHub
+, zig
+, wayland
+, pkg-config
+, scdoc
+, wayland-protocols
+, libxkbcommon
+, pam
 }:
 stdenv.mkDerivation rec {
   pname = "waylock";
-  version = "0.4.2";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "ifreund";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-yWjWcnGa4a+Dpc82H65yr8H7v88g/tDq0FSguubhbEI=";
+    hash = "sha256-AujBvDy10e5HhezCQcXpBUVlktRKNseLxRKdI+gtH6w=";
     fetchSubmodules = true;
   };
 
-  nativeBuildInputs = [zig wayland scdoc pkg-config];
+  nativeBuildInputs = [ zig wayland scdoc pkg-config ];
 
   buildInputs = [
     wayland-protocols
@@ -38,7 +37,7 @@ stdenv.mkDerivation rec {
 
   installPhase = ''
     runHook preInstall
-    zig build -Drelease-safe -Dman-pages --prefix $out install
+    zig build -Drelease-safe -Dman-pages -Dcpu=baseline --prefix $out install
     runHook postInstall
   '';
 
@@ -47,6 +46,6 @@ stdenv.mkDerivation rec {
     description = "A small screenlocker for Wayland compositors";
     license = licenses.isc;
     platforms = platforms.linux;
-    maintainers = with maintainers; [jordanisaacs];
+    maintainers = with maintainers; [ jordanisaacs ];
   };
 }
diff --git a/pkgs/applications/networking/cluster/roxctl/default.nix b/pkgs/applications/networking/cluster/roxctl/default.nix
index e2426fc7d56..877dddfa1e2 100644
--- a/pkgs/applications/networking/cluster/roxctl/default.nix
+++ b/pkgs/applications/networking/cluster/roxctl/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "roxctl";
-  version = "3.72.2";
+  version = "3.73.1";
 
   src = fetchFromGitHub {
     owner = "stackrox";
     repo = "stackrox";
     rev = version;
-    sha256 = "sha256-qw45Ifp8JcJyKaKL1St0HAQGS7JiUestiPGyZcV3gx8=";
+    sha256 = "sha256-A/jEw29c2WbBlPZZACjI3NjM7a0JxCEob8GOoGx13Hs=";
   };
 
-  vendorSha256 = "sha256-FmpnRgU3w2zthgUJuAG5AqLl2UxMb0yywN5Sk9WoWBI=";
+  vendorHash = "sha256-YRNOOn/Ei0rHLZrTtQxlBBn48pePDHllnI65Iil160k=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/applications/networking/cluster/werf/default.nix b/pkgs/applications/networking/cluster/werf/default.nix
index b1a77272077..271d82f4d86 100644
--- a/pkgs/applications/networking/cluster/werf/default.nix
+++ b/pkgs/applications/networking/cluster/werf/default.nix
@@ -10,13 +10,13 @@
 
 buildGoModule rec {
   pname = "werf";
-  version = "1.2.193";
+  version = "1.2.195";
 
   src = fetchFromGitHub {
     owner = "werf";
     repo = "werf";
     rev = "v${version}";
-    hash = "sha256-4q+LtPwJa3gioOY90gUfCL4F/8jmtfkBKxBShg2xQas=";
+    hash = "sha256-rNhCZO4Axeuc5jEAndjma7/jnst1kDNdtb/h/jD2rtE=";
   };
 
   vendorHash = "sha256-GjcmpHyjhjCWE5gQR/oTHfhHYg5WRu8uhgAuWhdxlYk=";
diff --git a/pkgs/applications/networking/instant-messengers/deltachat-desktop/default.nix b/pkgs/applications/networking/instant-messengers/deltachat-desktop/default.nix
index eb4be8d98d2..c113618bbb7 100644
--- a/pkgs/applications/networking/instant-messengers/deltachat-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/deltachat-desktop/default.nix
@@ -43,7 +43,7 @@ let
         rev = "v${version}";
         hash = "sha256-qCtpy69ROCspRgPKmCV0YY/EOSWiNU/xwDblU0bQp4w=";
       };
-      vendorSha256 = "sha256-+BfxCyg0KkDQpHt/wycy/8CTG6YBA/VJvJFhhzUnSiQ=";
+      vendorHash = "sha256-+BfxCyg0KkDQpHt/wycy/8CTG6YBA/VJvJFhhzUnSiQ=";
     });
   };
 in buildNpmPackage rec {
diff --git a/pkgs/applications/networking/instant-messengers/gajim/default.nix b/pkgs/applications/networking/instant-messengers/gajim/default.nix
index e8ac07b50cf..67f294ea6a5 100644
--- a/pkgs/applications/networking/instant-messengers/gajim/default.nix
+++ b/pkgs/applications/networking/instant-messengers/gajim/default.nix
@@ -22,11 +22,11 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "gajim";
-  version = "1.5.4";
+  version = "1.6.0";
 
   src = fetchurl {
     url = "https://gajim.org/downloads/${lib.versions.majorMinor version}/gajim-${version}.tar.gz";
-    sha256 = "sha256-uIzOKiCbHiSVRlXcpE0B/+Ats3cfw4u7eA+KyPriwhk=";
+    hash = "sha256-gHRB3thDH+CKRXTgrD37e2zf0rVDIVl4Zhxf5lsLjyc=";
   };
 
   buildInputs = [
diff --git a/pkgs/applications/networking/instant-messengers/zulip/default.nix b/pkgs/applications/networking/instant-messengers/zulip/default.nix
index d7e7a94a511..241828fdfc3 100644
--- a/pkgs/applications/networking/instant-messengers/zulip/default.nix
+++ b/pkgs/applications/networking/instant-messengers/zulip/default.nix
@@ -6,7 +6,6 @@
 let
   pname = "zulip";
   version = "5.9.4";
-  name = "${pname}-${version}";
 
   src = fetchurl {
     url = "https://github.com/zulip/zulip-desktop/releases/download/v${version}/Zulip-${version}-x86_64.AppImage";
@@ -15,14 +14,14 @@ let
   };
 
   appimageContents = appimageTools.extractType2 {
-    inherit name src;
+    inherit pname version src;
   };
 
 in appimageTools.wrapType2 {
-  inherit name src;
+  inherit pname version src;
 
   extraInstallCommands = ''
-    mv $out/bin/${name} $out/bin/${pname}
+    mv "$out/bin/${pname}-${version}" "$out/bin/${pname}"
     install -m 444 -D ${appimageContents}/zulip.desktop $out/share/applications/zulip.desktop
     install -m 444 -D ${appimageContents}/usr/share/icons/hicolor/512x512/apps/zulip.png \
       $out/share/icons/hicolor/512x512/apps/zulip.png
diff --git a/pkgs/applications/networking/seaweedfs/default.nix b/pkgs/applications/networking/seaweedfs/default.nix
index 3757d57df81..28c6580d891 100644
--- a/pkgs/applications/networking/seaweedfs/default.nix
+++ b/pkgs/applications/networking/seaweedfs/default.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "seaweedfs";
-  version = "3.38";
+  version = "3.39";
 
   src = fetchFromGitHub {
     owner = "seaweedfs";
     repo = "seaweedfs";
     rev = version;
-    hash = "sha256-LYMGkv1rgUtA/TwulBhgw0w+8kbICtEgr7/K6exalxM=";
+    hash = "sha256-mbeTdrKptPaMw1OA3jFftjJPOmUnJcjbv81yDSlFeaU=";
   };
 
   vendorHash = "sha256-mwfs/tdq1Qq2auEwz24emf7pjpIJAncI78oxhAn2WkI=";
diff --git a/pkgs/applications/office/qownnotes/default.nix b/pkgs/applications/office/qownnotes/default.nix
index bb27f0d4ec9..158c2389a31 100644
--- a/pkgs/applications/office/qownnotes/default.nix
+++ b/pkgs/applications/office/qownnotes/default.nix
@@ -1,29 +1,66 @@
-{ mkDerivation, lib, stdenv, fetchurl
-, qmake, qttools, qtbase, qtsvg, qtdeclarative, qtxmlpatterns, qtwebsockets
-, qtx11extras, qtwayland
+{ lib
+, stdenv
+, fetchurl
+, qmake
+, qttools
+, qtbase
+, qtdeclarative
+, qtsvg
+, qtwayland
+, qtwebsockets
+, qtx11extras
+, qtxmlpatterns
+, makeWrapper
+, wrapQtAppsHook
 }:
 
-mkDerivation rec {
+let
   pname = "qownnotes";
-  version = "22.12.3";
+  appname = "QOwnNotes";
+  version = "23.1.0";
+in
+stdenv.mkDerivation {
+  inherit pname appname version;
 
   src = fetchurl {
     url = "https://download.tuxfamily.org/${pname}/src/${pname}-${version}.tar.xz";
-    # Fetch the checksum of current version with curl:
-    # curl https://download.tuxfamily.org/qownnotes/src/qownnotes-<version>.tar.xz.sha256
-    sha256 = "sha256-fpI7RYOGmWwmau6tF8FPmY2/FtN9foWRX8/WgrNU6E8=";
+    sha256 = "sha256-HMs8DTL2BDSDmchadpVvbShjJMPP6W587F38uiixCuQ=";
   };
 
-  nativeBuildInputs = [ qmake qttools ];
+  nativeBuildInputs = [
+    qmake
+    qttools
+    wrapQtAppsHook
+  ] ++ lib.optionals stdenv.isDarwin [ makeWrapper ];
 
-  buildInputs = [ qtbase qtsvg qtdeclarative qtxmlpatterns qtwebsockets qtx11extras ]
-    ++ lib.optionals stdenv.isLinux [ qtwayland ];
+  buildInputs = [
+    qtbase
+    qtdeclarative
+    qtsvg
+    qtwebsockets
+    qtx11extras
+    qtxmlpatterns
+  ] ++ lib.optionals stdenv.isLinux [ qtwayland ];
+
+  postInstall =
+  # Create a lowercase symlink for Linux
+  lib.optionalString stdenv.isLinux ''
+    ln -s $out/bin/${appname} $out/bin/${pname}
+  ''
+  # Wrap application for macOS as lowercase binary
+  + lib.optionalString stdenv.isDarwin ''
+    mkdir -p $out/Applications
+    mv $out/bin/${appname}.app $out/Applications
+    makeWrapper $out/Applications/${appname}.app/Contents/MacOS/${appname} $out/bin/${pname}
+  '';
 
   meta = with lib; {
     description = "Plain-text file notepad and todo-list manager with markdown support and Nextcloud/ownCloud integration";
     homepage = "https://www.qownnotes.org/";
+    changelog = "https://www.qownnotes.org/changelog.html";
+    downloadPage = "https://github.com/pbek/QOwnNotes/releases/tag/v${version}";
     license = licenses.gpl2Only;
     maintainers = with maintainers; [ totoroot ];
-    platforms = platforms.linux;
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/applications/science/biology/ants/default.nix b/pkgs/applications/science/biology/ants/default.nix
index 8a143d36a29..e117af03b57 100644
--- a/pkgs/applications/science/biology/ants/default.nix
+++ b/pkgs/applications/science/biology/ants/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname    = "ANTs";
-  version = "2.4.2";
+  version = "2.4.3";
 
   src = fetchFromGitHub {
     owner  = "ANTsX";
     repo   = "ANTs";
     rev    = "v${version}";
-    sha256 = "sha256-edkvTkgBNaC87Q0N/Fsebr9nRLMhDo4mrSGoMICdnwU=";
+    sha256 = "sha256-S4HYhsqof27UXEYjKvbod8N7PkZDmwLdwcEAvJD0W5g=";
   };
 
   nativeBuildInputs = [ cmake makeWrapper ];
diff --git a/pkgs/applications/science/logic/cubicle/default.nix b/pkgs/applications/science/logic/cubicle/default.nix
index aa3fba635ff..4719a69c012 100644
--- a/pkgs/applications/science/logic/cubicle/default.nix
+++ b/pkgs/applications/science/logic/cubicle/default.nix
@@ -1,18 +1,40 @@
-{ lib, stdenv, fetchurl, ocamlPackages }:
+{ lib
+, stdenv
+, fetchurl
+, autoreconfHook
+, which
+, ocamlPackages
+}:
 
 stdenv.mkDerivation rec {
   pname = "cubicle";
-  version = "1.1.2";
+  version = "1.2.0";
   src = fetchurl {
-    url = "http://cubicle.lri.fr/cubicle-${version}.tar.gz";
-    sha256 = "10kk80jdmpdvql88sdjsh7vqzlpaphd8vip2lp47aarxjkwjlz1q";
+    url = "https://github.com/cubicle-model-checker/cubicle/archive/refs/tags/${version}.tar.gz";
+    hash = "sha256-/EtbXpyXqRm0jGcMfGLAEwdr92061edjFys1V7/w6/Y=";
   };
 
+  # https://github.com/cubicle-model-checker/cubicle/issues/1
   postPatch = ''
-    substituteInPlace Makefile.in --replace "\\n" ""
+    substituteInPlace Makefile.in \
+      --replace "@OCAMLC@" "ocamlfind ocamlc -package num" \
+      --replace "@OCAMLOPT@" "ocamlfind ocamlopt -package num"
   '';
 
-  buildInputs = with ocamlPackages; [ ocaml findlib functory ];
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    autoreconfHook
+    which
+  ] ++ (with ocamlPackages; [
+    findlib
+    ocaml
+  ]);
+
+  buildInputs = with ocamlPackages; [
+    functory
+    num
+  ];
 
   meta = with lib; {
     description = "An open source model checker for verifying safety properties of array-based systems";
diff --git a/pkgs/applications/version-management/subgit/default.nix b/pkgs/applications/version-management/subgit/default.nix
index 0ec06aeaaa6..a7288aa24e6 100644
--- a/pkgs/applications/version-management/subgit/default.nix
+++ b/pkgs/applications/version-management/subgit/default.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "subgit";
-  version = "3.3.15";
+  version = "3.3.16";
 
   meta = {
     description = "A tool for a smooth, stress-free SVN to Git migration";
@@ -22,6 +22,6 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://subgit.com/download/subgit-${version}.zip";
-    sha256 = "sha256-2/J/d4GrlLXR/7QBxgIMepzP+xxkeLvrCBwLl7Ke8wI=";
+    sha256 = "sha256-p7uBEG43N4Hed+8HYf3I9lQEvmYLV61oIyRrPHuGmUA=";
   };
 }
diff --git a/pkgs/applications/virtualization/pods/default.nix b/pkgs/applications/virtualization/pods/default.nix
index 4963949927b..18472f03d85 100644
--- a/pkgs/applications/virtualization/pods/default.nix
+++ b/pkgs/applications/virtualization/pods/default.nix
@@ -17,19 +17,19 @@
 
 stdenv.mkDerivation rec {
   pname = "pods";
-  version = "1.0.1";
+  version = "1.0.2";
 
   src = fetchFromGitHub {
     owner = "marhkb";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-oa7A0RMF7kPQXydysGpzAICgGoIRLWUMRibXdiftYyk=";
+    sha256 = "sha256-Kjonyd0xL0QLjPS+U3xDC6AhOOxQmVAZ3STLXaa8eXc=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    sha256 = "sha256-RMxk7e/z+YneNWI/xsZDmXr7DqB7qHEY8HPvTCeSLjg=";
+    sha256 = "sha256-K5oOpo3xJiNg7F549JLGs83658MYcoGfuIcNoF88Njc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/build-support/dotnet/build-dotnet-module/default.nix b/pkgs/build-support/dotnet/build-dotnet-module/default.nix
index 7f05a3a4eec..514255f324a 100644
--- a/pkgs/build-support/dotnet/build-dotnet-module/default.nix
+++ b/pkgs/build-support/dotnet/build-dotnet-module/default.nix
@@ -190,7 +190,13 @@ stdenvNoCC.mkDerivation (args // {
             esac
         done
 
-        export tmp=$(mktemp -td "${pname}-tmp-XXXXXX")
+        if [[ ''${TMPDIR:-} == /run/user/* ]]; then
+           # /run/user is usually a tmpfs in RAM, which may be too small
+           # to store all downloaded dotnet packages
+           TMPDIR=
+        fi
+
+        export tmp=$(mktemp -td "deps-${pname}-XXXXXX")
         HOME=$tmp/home
 
         exitTrap() {
diff --git a/pkgs/data/icons/colloid-icon-theme/default.nix b/pkgs/data/icons/colloid-icon-theme/default.nix
index 744db4f3d16..5c0a3817f32 100644
--- a/pkgs/data/icons/colloid-icon-theme/default.nix
+++ b/pkgs/data/icons/colloid-icon-theme/default.nix
@@ -18,13 +18,13 @@ lib.checkListOfEnum "${pname}: color variants" [ "default" "purple" "pink" "red"
 
 stdenvNoCC.mkDerivation rec {
   inherit pname;
-  version = "2022-10-26";
+  version = "2023-01-08";
 
   src = fetchFromGitHub {
     owner = "vinceliuice";
     repo = pname;
     rev = version;
-    hash = "sha256-eHLfWrtY69S37OPvQdLwI/PRvoKCheF2MRsHG5+5BR0=";
+    hash = "sha256-n4kMOIp7AD5Ue4qY4G3ja/VTyYF7cqhdI0uuk9b6o5c=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/data/misc/v2ray-domain-list-community/default.nix b/pkgs/data/misc/v2ray-domain-list-community/default.nix
index 3d44e34f2b0..14299bdc522 100644
--- a/pkgs/data/misc/v2ray-domain-list-community/default.nix
+++ b/pkgs/data/misc/v2ray-domain-list-community/default.nix
@@ -3,12 +3,12 @@
 let
   generator = pkgsBuildBuild.buildGoModule rec {
     pname = "v2ray-domain-list-community";
-    version = "20221223102220";
+    version = "20230106031328";
     src = fetchFromGitHub {
       owner = "v2fly";
       repo = "domain-list-community";
       rev = version;
-      sha256 = "sha256-bvTNxJcogF3KxZbC8jW0PMIiJJZnzubWybDcNK7id8s=";
+      sha256 = "sha256-17yAIJQdxZAsNZ8W3HaW+EVKcPYy9fBOsSxU/0GEJuU=";
     };
     vendorSha256 = "sha256-CCY3CgjA1w4svzmkaI2Jt272Rrt5UOt5sbVDAWRRfzk=";
     meta = with lib; {
diff --git a/pkgs/data/misc/v2ray-geoip/default.nix b/pkgs/data/misc/v2ray-geoip/default.nix
index 4cb78dcf7c9..f00e67dfdca 100644
--- a/pkgs/data/misc/v2ray-geoip/default.nix
+++ b/pkgs/data/misc/v2ray-geoip/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "v2ray-geoip";
-  version = "202212220043";
+  version = "202301050046";
 
   src = fetchFromGitHub {
     owner = "v2fly";
     repo = "geoip";
-    rev = "4a54320369805321b90c7c5ca4cdda4f12bdd295";
-    sha256 = "sha256-PFbjzzjeCKL9aak45B+R5Y+H3fTBzdXpyEvvEEdInbQ=";
+    rev = "6bb07558ac223b3decdff985d5737f4384b34238";
+    sha256 = "sha256-KXLIIs1W+8TC2GtW3m/YA5WQ13Pq5kxC5Zc9jDzW/tU=";
   };
 
   installPhase = ''
diff --git a/pkgs/development/libraries/libquotient/default.nix b/pkgs/development/libraries/libquotient/default.nix
index 0f75c8d1f4e..c112f0a3348 100644
--- a/pkgs/development/libraries/libquotient/default.nix
+++ b/pkgs/development/libraries/libquotient/default.nix
@@ -1,25 +1,20 @@
-{ mkDerivation, lib, fetchFromGitHub, cmake, qtmultimedia }:
+{ mkDerivation, lib, fetchFromGitHub, cmake, qtmultimedia, qtkeychain }:
 
 mkDerivation rec {
   pname = "libquotient";
-  version = "0.6.11";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     owner = "quotient-im";
     repo = "libQuotient";
     rev = version;
-    sha256 = "sha256-FPtxeZOfChIPi4e/h/eZkByH1QL3Fn0OJxe0dnMcTRw=";
+    sha256 = "sha256-9NAWphpAI7/qWDMjsx26s+hOaQh0hbzjePfESC7PtXc=";
   };
 
-  buildInputs = [ qtmultimedia ];
+  buildInputs = [ qtmultimedia qtkeychain ];
 
   nativeBuildInputs = [ cmake ];
 
-  cmakeFlags = [
-    # we need libqtolm for this
-    "-DQuotient_ENABLE_E2EE=OFF"
-  ];
-
   # https://github.com/quotient-im/libQuotient/issues/551
   postPatch = ''
     substituteInPlace Quotient.pc.in \
diff --git a/pkgs/development/libraries/libxlsxwriter/default.nix b/pkgs/development/libraries/libxlsxwriter/default.nix
index a2f506de013..5d9b50e7251 100644
--- a/pkgs/development/libraries/libxlsxwriter/default.nix
+++ b/pkgs/development/libraries/libxlsxwriter/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , minizip
 , python3
 , zlib
@@ -9,23 +8,15 @@
 
 stdenv.mkDerivation rec {
   pname = "libxlsxwriter";
-  version = "1.1.4";
+  version = "1.1.5";
 
   src = fetchFromGitHub {
     owner = "jmcnamara";
     repo = "libxlsxwriter";
     rev = "RELEASE_${version}";
-    sha256 = "sha256-Ef1CipwUEJW/VYx/q98lN0PSxj8c3DbIuql8qU6mTRs=";
+    hash = "sha256-fC03LwZIUkEsAs9TN0n2z0iSOGPAtVCeuW5rxC7Ek7Q=";
   };
 
-  patches = [
-    # https://github.com/jmcnamara/libxlsxwriter/pull/357
-    (fetchpatch {
-      url = "https://github.com/jmcnamara/libxlsxwriter/commit/723629976ede5e6ec9b03ef970381fed06ef95f0.patch";
-      sha256 = "14aw698b5svvbhvadc2vr71isck3k02zdv8xjsa7c33n8331h20g";
-    })
-  ];
-
   nativeBuildInputs = [
     python3.pkgs.pytest
   ];
diff --git a/pkgs/development/libraries/mapbox-gl-qml/default.nix b/pkgs/development/libraries/mapbox-gl-qml/default.nix
index a9a2ad64d7a..1d068a90d3b 100644
--- a/pkgs/development/libraries/mapbox-gl-qml/default.nix
+++ b/pkgs/development/libraries/mapbox-gl-qml/default.nix
@@ -11,13 +11,13 @@
 
 mkDerivation rec {
   pname = "mapbox-gl-qml";
-  version = "2.0.1";
+  version = "2.1.1";
 
   src = fetchFromGitHub {
     owner = "rinigus";
     repo = "mapbox-gl-qml";
     rev = version;
-    hash = "sha256-EVZbQXV8pI0QTqFDTTynVglsqX1O5oK0Pl5Y/wp+/q0=";
+    hash = "sha256-zZcD85nOZZ067FRvSuzE8lr2gyuVxpcZGp44D4ayc3Q=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
diff --git a/pkgs/development/libraries/maplibre-gl-native/default.nix b/pkgs/development/libraries/maplibre-gl-native/default.nix
index c680f6822b5..568f3fbe64e 100644
--- a/pkgs/development/libraries/maplibre-gl-native/default.nix
+++ b/pkgs/development/libraries/maplibre-gl-native/default.nix
@@ -13,14 +13,14 @@
 
 mkDerivation rec {
   pname = "maplibre-gl-native";
-  version = "unstable-2022-04-07";
+  version = "2.0.1";
 
   src = fetchFromGitHub {
     owner = "maplibre";
     repo = "maplibre-gl-native";
-    rev = "225f8a4bfe7ad30fd59d693c1fb3ca0ba70d2806";
+    rev = "qt-v${version}";
     fetchSubmodules = true;
-    hash = "sha256-NLtpi+bDLTHlnzMZ4YFQyF5B1xt9lzHyZPvEQLlBAnY=";
+    hash = "sha256-g5J873U/6mrl27iquPl3BdEGhMxkOdfP15dHr27wa48=";
   };
 
   patches = [
@@ -61,6 +61,5 @@ mkDerivation rec {
     license = licenses.bsd2;
     maintainers = with maintainers; [ dotlambda ];
     platforms = platforms.linux;
-    broken = lib.versionOlder qtbase.version "5.15";
   };
 }
diff --git a/pkgs/development/perl-modules/strip-nondeterminism/default.nix b/pkgs/development/perl-modules/strip-nondeterminism/default.nix
index ba2134d1b97..d2b28afd612 100644
--- a/pkgs/development/perl-modules/strip-nondeterminism/default.nix
+++ b/pkgs/development/perl-modules/strip-nondeterminism/default.nix
@@ -1,8 +1,17 @@
-{ lib, stdenv, file, fetchFromGitLab, buildPerlPackage, ArchiveZip, ArchiveCpio, shortenPerlShebang }:
+{ lib
+, stdenv
+, file
+, fetchFromGitLab
+, buildPerlPackage
+, ArchiveZip
+, ArchiveCpio
+, SubOverride
+, shortenPerlShebang
+}:
 
 buildPerlPackage rec {
   pname = "strip-nondeterminism";
-  version = "1.0.0";
+  version = "1.13.0";
 
   outputs = [ "out" "dev" ]; # no "devdoc"
 
@@ -11,30 +20,42 @@ buildPerlPackage rec {
     repo = "strip-nondeterminism";
     domain = "salsa.debian.org";
     rev = version;
-    sha256 = "1pwar1fyadqxmvb7x4zyw2iawbi5lsfjcg0ps9n9rdjb6an7vv64";
+    sha256 = "sha256-KZQeoJYBPJzUvz4wlUZbiGODbpCp7/52dsg5OemKDkI=";
   };
 
-  # stray test failure
-  doCheck = false;
-
+  strictDeps = true;
   nativeBuildInputs = lib.optionals stdenv.isDarwin [ shortenPerlShebang ];
-  buildInputs = [ ArchiveZip ArchiveCpio ];
-  propagatedNativeBuildInputs = [ file ];
+  buildInputs = [
+    ArchiveZip
+    ArchiveCpio
+  ];
 
-  perlPostHook = ''
+  checkInputs = [ SubOverride ];
+
+  postPatch = ''
+    substituteInPlace lib/File/StripNondeterminism.pm \
+      --replace "exec('file'" "exec('${lib.getExe file}'"
+  '';
+
+
+  postBuild = ''
+    patchShebangs ./bin
+  '' + lib.optionalString stdenv.isDarwin ''
+    shortenPerlShebang bin/strip-nondeterminism
+  '';
+
+  postInstall = ''
     # we don’t need the debhelper script
     rm $out/bin/dh_strip_nondeterminism
-    rm $out/share/man/man1/dh_strip_nondeterminism.1.gz
+    rm $out/share/man/man1/dh_strip_nondeterminism.1
   '';
 
-  postInstall = lib.optionalString stdenv.isDarwin ''
-    shortenPerlShebang $out/bin/strip-nondeterminism
-  '';
+  doCheck = true;
 
   meta = with lib; {
     description = "A Perl module for stripping bits of non-deterministic information";
     homepage = "https://reproducible-builds.org/";
     license = licenses.gpl3Only;
-    maintainers = with maintainers; [ pSub ];
+    maintainers = with maintainers; [ pSub artturin ];
   };
 }
diff --git a/pkgs/development/python-modules/aioesphomeapi/default.nix b/pkgs/development/python-modules/aioesphomeapi/default.nix
index e98c0f44e0c..33247ba3fe4 100644
--- a/pkgs/development/python-modules/aioesphomeapi/default.nix
+++ b/pkgs/development/python-modules/aioesphomeapi/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "aioesphomeapi";
-  version = "13.0.3";
+  version = "13.0.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "esphome";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-gDz0eylyUae8fB+ssMZk8Mot/K9RlIIzn+B0LNdMmPs=";
+    hash = "sha256-pqCg4LAFIr5BEDqRWMaNc3M36bUmou5cZdarQ/0W77Y=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/debugpy/default.nix b/pkgs/development/python-modules/debugpy/default.nix
index 1441dced715..d5f500cb405 100644
--- a/pkgs/development/python-modules/debugpy/default.nix
+++ b/pkgs/development/python-modules/debugpy/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "debugpy";
-  version = "1.6.4";
+  version = "1.6.5";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "Microsoft";
     repo = pname;
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-THhu6Oa4x2b0chLFrJR7FF1z8X3/dsHzXosBmSqaDeI=";
+    sha256 = "sha256-98hyNer2Xtx6D2R3pFhLC3tb/2DFTawXO36xfwhIfEg=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/gb-io/default.nix b/pkgs/development/python-modules/gb-io/default.nix
index 6a44b758d29..fe719bedb8f 100644
--- a/pkgs/development/python-modules/gb-io/default.nix
+++ b/pkgs/development/python-modules/gb-io/default.nix
@@ -9,19 +9,19 @@
 
 buildPythonPackage rec {
   pname = "gb-io";
-  version = "0.1.1";
+  version = "0.2.1";
 
   src = fetchFromGitHub {
     owner = "althonos";
     repo = "gb-io.py";
     rev = "v${version}";
-    sha256 = "05fpz11rqqjrb8lc8id6ssv7sni9i1h7x1ra5v5flw9ghpf29ncm";
+    sha256 = "sha256-1B7BUJ8H+pTtmDtazfPfYtlXzL/x4rAHtRIFAAsSoWs=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src sourceRoot;
     name = "${pname}-${version}";
-    sha256 = "1qh31jysg475f2qc70b3bczmzywmg9987kn2vsmk88h8sx4nnwc5";
+    sha256 = "sha256-lPnOFbEJgcaPPl9bTngugubhW//AUFp9RAjyiFHxC70=";
   };
 
   sourceRoot = "source";
diff --git a/pkgs/development/python-modules/imageio/default.nix b/pkgs/development/python-modules/imageio/default.nix
index 1437b28a06b..efad94b13df 100644
--- a/pkgs/development/python-modules/imageio/default.nix
+++ b/pkgs/development/python-modules/imageio/default.nix
@@ -16,11 +16,11 @@
 
 buildPythonPackage rec {
   pname = "imageio";
-  version = "2.23.0";
+  version = "2.24.0";
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
-    sha256 = "sha256-y2NXCXZeUnyUiQtPu2hw5ZIT/hgqHICG0WfrNiYHPL0=";
+    sha256 = "sha256-8kD4Ip9PMpoVRigRlLUtpdZpQUGlJGaP7T+BsNB3gvo=";
     inherit pname version;
   };
 
diff --git a/pkgs/development/python-modules/mat2/default.nix b/pkgs/development/python-modules/mat2/default.nix
index 6e2b1a02402..be6c2912dfe 100644
--- a/pkgs/development/python-modules/mat2/default.nix
+++ b/pkgs/development/python-modules/mat2/default.nix
@@ -4,7 +4,6 @@
 , unittestCheckHook
 , pythonOlder
 , fetchFromGitLab
-, fetchpatch
 , substituteAll
 , bubblewrap
 , exiftool
@@ -24,7 +23,7 @@
 
 buildPythonPackage rec {
   pname = "mat2";
-  version = "0.13.0";
+  version = "0.13.1";
 
   disabled = pythonOlder "3.5";
 
@@ -33,7 +32,7 @@ buildPythonPackage rec {
     owner = "jvoisin";
     repo = "mat2";
     rev = version;
-    hash = "sha256-H3l8w2F+ZcJ1P/Dg0ZVBJPUK0itLocL7a0jeSrG3Ws8=";
+    hash = "sha256-/HcWVXguZf9cCGY0xlC7uMnLkSAqZ0DIAC6JUw2KKDs=";
   };
 
   patches = [
@@ -49,16 +48,6 @@ buildPythonPackage rec {
     ./executable-name.patch
     # hardcode path to mat2 executable
     ./tests.patch
-    # fix gobject-introspection typelib path for Nautilus extension
-    (substituteAll {
-      src = ./fix_poppler.patch;
-      poppler_path = "${poppler_gi}/lib/girepository-1.0";
-    })
-    # https://0xacab.org/jvoisin/mat2/-/issues/178
-    (fetchpatch {
-      url = "https://0xacab.org/jvoisin/mat2/-/commit/618e0a8e3984fd534b95ef3dbdcb8a76502c90b5.patch";
-      hash = "sha256-l9UFim3hGj+d2uKITiDG1OnqGeo2McBIiRSmK0Vidg8=";
-    })
   ] ++ lib.optionals (stdenv.hostPlatform.isLinux) [
     (substituteAll {
       src = ./bubblewrap-path.patch;
@@ -92,9 +81,6 @@ buildPythonPackage rec {
   postInstall = ''
     install -Dm 444 data/mat2.svg -t "$out/share/icons/hicolor/scalable/apps"
     install -Dm 444 doc/mat2.1 -t "$out/share/man/man1"
-    install -Dm 444 nautilus/mat2.py -t "$out/share/nautilus-python/extensions"
-    buildPythonPath "$out $pythonPath $propagatedBuildInputs"
-    patchPythonScript "$out/share/nautilus-python/extensions/mat2.py"
   '' + lib.optionalString dolphinIntegration ''
     install -Dm 444 dolphin/mat2.desktop -t "$out/share/kservices5/ServiceMenus"
   '';
diff --git a/pkgs/development/python-modules/mat2/fix_poppler.patch b/pkgs/development/python-modules/mat2/fix_poppler.patch
deleted file mode 100644
index 02bdbb6345d..00000000000
--- a/pkgs/development/python-modules/mat2/fix_poppler.patch
+++ /dev/null
@@ -1,14 +0,0 @@
-diff --git a/nautilus/mat2.py b/nautilus/mat2.py
-index 11e6986..5a0e68f 100644
---- a/nautilus/mat2.py
-+++ b/nautilus/mat2.py
-@@ -22,6 +22,9 @@ import gi
- gi.require_version('Nautilus', '3.0')
- gi.require_version('Gtk', '3.0')
- gi.require_version('GdkPixbuf', '2.0')
-+gi.require_version('GIRepository', '2.0')
-+from gi.repository import GIRepository
-+GIRepository.Repository.prepend_search_path('@poppler_path@')
- from gi.repository import Nautilus, GObject, Gtk, Gio, GLib, GdkPixbuf
- 
- from libmat2 import parser_factory
diff --git a/pkgs/development/python-modules/mat2/paths.patch b/pkgs/development/python-modules/mat2/paths.patch
index 784e04cda38..53f72ce9463 100644
--- a/pkgs/development/python-modules/mat2/paths.patch
+++ b/pkgs/development/python-modules/mat2/paths.patch
@@ -13,7 +13,7 @@ index 41c8de4..11df258 100644
 +Exec=@kdialog@ --yesno  "$( @mat2@ -s %F )" --title "Clean Metadata?" && @mat2@ %U
 +Exec[de]=@kdialog@ --yesno  "$( @mat2@ -s %F )" --title "Metadaten löschen?" && @mat2@ %U
 diff --git a/libmat2/exiftool.py b/libmat2/exiftool.py
-index eb65b2a..51a0fa1 100644
+index cdfce3d..1e83520 100644
 --- a/libmat2/exiftool.py
 +++ b/libmat2/exiftool.py
 @@ -1,8 +1,6 @@
@@ -23,13 +23,13 @@ index eb65b2a..51a0fa1 100644
  import os
 -import shutil
  import subprocess
- from typing import Dict, Union, Set
+ from typing import Union
  
-@@ -70,14 +68,5 @@ class ExiftoolParser(abstract.AbstractParser):
+@@ -67,14 +65,5 @@ class ExiftoolParser(abstract.AbstractParser):
              return False
          return True
  
--@functools.lru_cache()
+-@functools.lru_cache
  def _get_exiftool_path() -> str:  # pragma: no cover
 -    which_path = shutil.which('exiftool')
 -    if which_path:
@@ -42,7 +42,7 @@ index eb65b2a..51a0fa1 100644
 -    raise RuntimeError("Unable to find exiftool")
 +    return '@exiftool@'
 diff --git a/libmat2/video.py b/libmat2/video.py
-index ae9e463..2acc65c 100644
+index 4d33aa4..6388664 100644
 --- a/libmat2/video.py
 +++ b/libmat2/video.py
 @@ -1,6 +1,4 @@
@@ -51,7 +51,7 @@ index ae9e463..2acc65c 100644
 -import shutil
  import logging
  
- from typing import Dict, Union
+ from typing import Union
 @@ -135,10 +133,5 @@ class MP4Parser(AbstractFFmpegParser):
      }
  
diff --git a/pkgs/development/python-modules/nbxmpp/default.nix b/pkgs/development/python-modules/nbxmpp/default.nix
index 8367074ef6c..1ce72428c10 100644
--- a/pkgs/development/python-modules/nbxmpp/default.nix
+++ b/pkgs/development/python-modules/nbxmpp/default.nix
@@ -4,7 +4,7 @@
 , fetchFromGitLab
 , gobject-introspection
 , idna
-, libsoup
+, libsoup_3
 , precis-i18n
 , pygobject3
 , pyopenssl
@@ -13,16 +13,16 @@
 
 buildPythonPackage rec {
   pname = "nbxmpp";
-  version = "3.2.5";
+  version = "4.0.0";
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.10";
 
   src = fetchFromGitLab {
     domain = "dev.gajim.org";
     owner = "gajim";
     repo = "python-nbxmpp";
     rev = version;
-    sha256 = "sha256-HIPvZu8Zj69k1FCbkrlSeGtur5cT0TNIYfdXcRbYLwQ=";
+    hash = "sha256-6PYJGlNOZMwHMXwf05IWekJ+haMfg+ooH5On+aYOWSI=";
   };
 
   nativeBuildInputs = [
@@ -37,7 +37,7 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     gobject-introspection
     idna
-    libsoup
+    libsoup_3
     pygobject3
     pyopenssl
   ];
diff --git a/pkgs/development/python-modules/oslo-db/default.nix b/pkgs/development/python-modules/oslo-db/default.nix
index 65d98db529e..f9f0883b81d 100644
--- a/pkgs/development/python-modules/oslo-db/default.nix
+++ b/pkgs/development/python-modules/oslo-db/default.nix
@@ -16,12 +16,12 @@
 
 buildPythonPackage rec {
   pname = "oslo-db";
-  version = "12.2.0";
+  version = "12.3.0";
 
   src = fetchPypi {
     pname = "oslo.db";
     inherit version;
-    sha256 = "sha256-wAA/+oqFjUfbFYIxSWWC9jgFpgqvIg4AlKhVM3MwGuc=";
+    sha256 = "sha256-egL5k/Y99DLYhGsvC3t0dluwFJRe21sBWI5qG5Gzuck=";
   };
 
   nativeBuildInputs = [ pbr ];
diff --git a/pkgs/development/python-modules/peaqevcore/default.nix b/pkgs/development/python-modules/peaqevcore/default.nix
index 5a1f6af2760..94479a12141 100644
--- a/pkgs/development/python-modules/peaqevcore/default.nix
+++ b/pkgs/development/python-modules/peaqevcore/default.nix
@@ -6,14 +6,14 @@
 
 buildPythonPackage rec {
   pname = "peaqevcore";
-  version = "10.1.4";
+  version = "10.2.6";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-h3kNmWa9ZOpI0DG49H3n1MPZu753nrdzSIh8V5N3H6I=";
+    hash = "sha256-uQPz7IB14dFrupZIA87jG5P7USaGKs0WWlgbaLAEPp4=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/polars/default.nix b/pkgs/development/python-modules/polars/default.nix
index dd9dbc114b2..583ce81fa40 100644
--- a/pkgs/development/python-modules/polars/default.nix
+++ b/pkgs/development/python-modules/polars/default.nix
@@ -5,13 +5,14 @@
 , rustPlatform
 , libiconv
 , fetchzip
+, typing-extensions
 }:
 let
   pname = "polars";
-  version = "0.13.19";
+  version = "0.15.13";
   rootSource = fetchzip {
-    url = "https://github.com/pola-rs/${pname}/archive/refs/tags/py-polars-v${version}.tar.gz";
-    sha256 = "sha256-JOHjxTTPzS9Dd/ODp4r0ebU9hEonxrbjURJoq0BQCyI=";
+    url = "https://github.com/pola-rs/${pname}/archive/refs/tags/py-${version}.tar.gz";
+    sha256 = "sha256-bk2opNLN3L+fkzXVfUU5O37UmA27ijmnAElCHjsuI+o=";
   };
 in
 buildPythonPackage {
@@ -19,8 +20,13 @@ buildPythonPackage {
   format = "pyproject";
   disabled = pythonOlder "3.6";
   src = rootSource;
+
+  # Cargo.lock files is sometimes behind actual release which throws an error,
+  # thus the `sed` command
+  # Make sure to check that the right substitutions are made when updating the package
   preBuild = ''
       cd py-polars
+      sed -i 's/version = "0.15.11"/version = "${version}"/g' Cargo.lock
   '';
 
   cargoDeps = rustPlatform.fetchCargoTarball {
@@ -29,10 +35,15 @@ buildPythonPackage {
         cd py-polars
     '';
     name = "${pname}-${version}";
-    sha256 = "sha256-KEt8lITY4El2afuh2cxnrDkXGN3MZgfKQU3Pe2jECF0=";
+    sha256 = "sha256-u7ascftUPz8K+gWwjjxdXXFJf++M+8P9QE/KVJkO5DM=";
   };
   cargoRoot = "py-polars";
 
+  # Revisit this whenever package or Rust is upgraded
+  RUSTC_BOOTSTRAP = 1;
+
+  propagatedBuildInputs = if pythonOlder "3.10" then [ typing-extensions ] else [];
+
   nativeBuildInputs = with rustPlatform; [ cargoSetupHook maturinBuildHook ];
 
   buildInputs = lib.optionals stdenv.isDarwin [ libiconv ];
@@ -49,36 +60,7 @@ buildPythonPackage {
   # ];
 
   meta = with lib; {
-    # Adding cmake to nativeBuildInputs and using `dontUseCmakeConfigure = true;`
-    # The following error still happens
-
-    # Compiling arrow2 v0.10.1 (https://github.com/ritchie46/arrow2?branch=polars#da703ae3)
-    # error[E0554]: `#![feature]` may not be used on the stable release channel
-    #  --> /build/polars-0.13.19-vendor.tar.gz/arrow2/src/lib.rs:8:39
-    #   |
-    # 8 | #![cfg_attr(feature = "simd", feature(portable_simd))]
-    #   |                                       ^^^^^^^^^^^^^
-    # error: aborting due to previous error
-    # For more information about this error, try `rustc --explain E0554`.
-    # error: could not compile `arrow2` due to 2 previous errors
-    # warning: build failed, waiting for other jobs to finish...
-    #  maturin failed
-    #   Caused by: Failed to build a native library through cargo
-    #   Caused by: Cargo build finished with "exit status: 101": `cargo rustc --message-format json --manifest-path Cargo.toml -j 8 --frozen --target x86_64-unknown-linux-gnu --release --lib -- -C link-arg=-s`
-    # error: builder for '/nix/store/qfnqi5hs3x4xdb6d4f6rpaf63n1w74yn-python3.10-polars-0.13.19.drv' failed with exit code 1;
-    #        last 10 log lines:
-    #        > error: aborting due to previous error
-    #        >
-    #        >
-    #        > For more information about this error, try `rustc --explain E0554`.
-    #        >
-    #        > error: could not compile `arrow2` due to 2 previous errors
-    #        > warning: build failed, waiting for other jobs to finish...
-    #        >  maturin failed
-    #        >   Caused by: Failed to build a native library through cargo
-    #        >   Caused by: Cargo build finished with "exit status: 101": `cargo rustc --message-format json --manifest-path Cargo.toml -j 8 --frozen --target x86_64-unknown-linux-gnu --release --lib -- -C link-arg=-s`
-    #        For full logs, run 'nix log /nix/store/qfnqi5hs3x4xdb6d4f6rpaf63n1w74yn-python3.10-polars-0.13.19.drv'.
-    broken = true;
+    broken = (stdenv.isLinux && stdenv.isAarch64) || stdenv.isDarwin;
     description = "Fast multi-threaded DataFrame library in Rust | Python | Node.js ";
     homepage = "https://github.com/pola-rs/polars";
     license = licenses.asl20;
diff --git a/pkgs/development/python-modules/whois/default.nix b/pkgs/development/python-modules/whois/default.nix
index 85dc1bcff1d..793565da680 100644
--- a/pkgs/development/python-modules/whois/default.nix
+++ b/pkgs/development/python-modules/whois/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "whois";
-  version = "0.9.21";
+  version = "0.9.22";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     owner = "DannyCork";
     repo = "python-whois";
     rev = "refs/tags/${version}";
-    hash = "sha256-gsWvmAnzlm31UHT//VbXvryKWN8m/+hvLoKxLmQOK5k=";
+    hash = "sha256-k1pvElqZTWJp8PTvQJCFeJqfzHW/QJQXCd4zBAtU0G4=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/tools/icr/default.nix b/pkgs/development/tools/icr/default.nix
index 095055cbedc..50a496d9382 100644
--- a/pkgs/development/tools/icr/default.nix
+++ b/pkgs/development/tools/icr/default.nix
@@ -33,7 +33,7 @@ crystal.buildCrystalPackage rec {
 
   postFixup = ''
     wrapProgram $out/bin/icr \
-      --prefix PATH : ${lib.makeBinPath [ crystal shards makeWrapper which ]}
+      --prefix PATH : ${lib.makeBinPath [ crystal shards which ]}
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/tools/rust/cargo-llvm-cov/default.nix b/pkgs/development/tools/rust/cargo-llvm-cov/default.nix
index b57f6f29f4c..df204220b5b 100644
--- a/pkgs/development/tools/rust/cargo-llvm-cov/default.nix
+++ b/pkgs/development/tools/rust/cargo-llvm-cov/default.nix
@@ -6,13 +6,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-llvm-cov";
-  version = "0.5.2";
+  version = "0.5.4";
 
   src = fetchzip {
     url = "https://crates.io/api/v1/crates/${pname}/${version}/download#${pname}-${version}.tar.gz";
-    sha256 = "sha256-K6r2YHQq3MEqq9aobJLZBH9COPXpW3TmX1GB1qfnV60=";
+    sha256 = "sha256-xBWp9+Vv1Ho63WWlvbvLU+h0dh5CpUamlRQtmX6rOeY=";
   };
-  cargoSha256 = "sha256-oMisrS+fDzSdT6JmkAMk8kztOgw2XUOrkhehmd9gxL0=";
+  cargoSha256 = "sha256-GKrqB6BtRbhtOlD2YeEMh6aqblPNEJjkR+tAsSpOFig=";
 
   # skip tests which require llvm-tools-preview
   checkFlags = [
diff --git a/pkgs/development/tools/rust/cargo-public-api/default.nix b/pkgs/development/tools/rust/cargo-public-api/default.nix
index d5627993e29..4ebb819623f 100644
--- a/pkgs/development/tools/rust/cargo-public-api/default.nix
+++ b/pkgs/development/tools/rust/cargo-public-api/default.nix
@@ -4,22 +4,24 @@
 , pkg-config
 , openssl
 , stdenv
+, darwin
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-public-api";
-  version = "0.24.1";
+  version = "0.26.0";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-xXwJ6MXnSgqIQ5IuqfDm/TUXgkppKCPG3TB7veza/H8=";
+    sha256 = "sha256-BiGVdWgDi+g+mxdM3+z5RN1pGJz9NIKVm8sTZf2ObCc=";
   };
 
-  cargoSha256 = "sha256-1sSvK8oZspIxDcMAl2MyAQzuijAxj1kpiZf1QwwyYDs=";
+  cargoSha256 = "sha256-QvZBWo/u+WtIG5zlDVTC2+5bq/mqZftXU5m8oqN25GM=";
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs = [ openssl ];
+  buildInputs = [ openssl ]
+    ++ lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.Security ];
 
   # Tests fail
   doCheck = false;
diff --git a/pkgs/development/tools/zed/default.nix b/pkgs/development/tools/zed/default.nix
index 54ba458bbb6..36658b506a4 100644
--- a/pkgs/development/tools/zed/default.nix
+++ b/pkgs/development/tools/zed/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "zed";
-  version = "1.3.0";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "brimdata";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-DVQoWam5szELJ3OeIKHYF0CBZ0AJlhuIJRrdhqmyhQM=";
+    sha256 = "sha256-ias2HKwZo5Q/0M4YZI4wLgzMVWmannruXlhp8IsOuyU=";
   };
 
-  vendorSha256 = "sha256-2zSSjAoeb+7Nk/dxpvp5P2/bSJXgkA0TieTQHK4ym1Y=";
+  vendorHash = "sha256-h5NYx6xhIh4i/tS5cGHXBomnVZCUn8jJuzL6k1+IdKk=";
 
   subPackages = [ "cmd/zed" "cmd/zq" ];
 
diff --git a/pkgs/misc/ananicy-cpp/default.nix b/pkgs/misc/ananicy-cpp/default.nix
index 30e3341294f..96284ba03ae 100644
--- a/pkgs/misc/ananicy-cpp/default.nix
+++ b/pkgs/misc/ananicy-cpp/default.nix
@@ -10,14 +10,14 @@
 
 stdenv.mkDerivation rec {
   pname = "ananicy-cpp";
-  version = "1.0.1";
+  version = "1.0.2";
 
   src = fetchFromGitLab {
     owner = "ananicy-cpp";
     repo = "ananicy-cpp";
     rev = "v${version}";
     fetchSubmodules = true;
-    sha256 = "sha256-07LWIC2y6b1iiPCVa8mlBYAnSmahm0oJ2d3/uW4rC94=";
+    sha256 = "sha256-iR7yIIGJbRwu62GIEYi70PjtlKXmkPYqSJtMddspBKA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/os-specific/darwin/apple-source-releases/generate-sdk-packages.sh b/pkgs/os-specific/darwin/apple-source-releases/generate-sdk-packages.sh
index d7c3fc89c52..418a1d625d6 100755
--- a/pkgs/os-specific/darwin/apple-source-releases/generate-sdk-packages.sh
+++ b/pkgs/os-specific/darwin/apple-source-releases/generate-sdk-packages.sh
@@ -1,8 +1,16 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p curl
+#!nix-shell -i bash -p curl jq
 
-# usage:
-#   generate-sdk-packages.sh macos 11.0.1
+usage() {
+    cat <<EOF
+usage: $0 macos 11.0.1
+EOF
+}
+
+if [ "$#" != 2 ]; then
+    usage
+    exit 1
+fi
 
 cd $(dirname "$0")
 
@@ -16,14 +24,14 @@ outfile="$sdkName.nix"
 {"
 
 parse_line() {
-    readarray -t -d$'\t' package <<<$2
+    readarray -t -d$'-' package < <(printf "%s" $2)
     local pname=${package[0]} version=${package[1]}
 
     if [ -d $pname ]; then
-        sha256=$(nix-prefetch-url "https://opensource.apple.com/tarballs/$pname/$pname-$version.tar.gz")
+        sha256=$(nix-prefetch-url "https://github.com/apple-oss-distributions/$pname/archive/refs/tags/$pname-$version.tar.gz")
         >>$outfile echo "$pname = applePackage' \"$pname\" \"$version\" \"$sdkName\" \"$sha256\" {};"
     fi
 }
-readarray -s1 -c1 -C parse_line < <(curl -sS "https://opensource.apple.com/text/${sdkName//./}.txt")
+readarray -s1 -c1 -C parse_line < <(curl -sSL "https://github.com/apple-oss-distributions/distribution-${1//-/_}/raw/${sdkName//./}/release.json" | jq -r ".projects[].tag")
 
 >>$outfile echo '}'
diff --git a/pkgs/os-specific/linux/firmware/sof-firmware/default.nix b/pkgs/os-specific/linux/firmware/sof-firmware/default.nix
index cccdf997dbd..9823e8c7ad5 100644
--- a/pkgs/os-specific/linux/firmware/sof-firmware/default.nix
+++ b/pkgs/os-specific/linux/firmware/sof-firmware/default.nix
@@ -5,11 +5,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "sof-firmware";
-  version = "2.2.3";
+  version = "2.2.4";
 
   src = fetchurl {
     url = "https://github.com/thesofproject/sof-bin/releases/download/v${version}/sof-bin-v${version}.tar.gz";
-    sha256 = "sha256-WR/9ZvHisycDjJHt88hQK0FywdyFDP5EBQ6t+OT620I=";
+    sha256 = "sha256-zoquuhA6pWqCZiVSsPM/M6hZqhAI2L+8LCLwzPyMazo=";
   };
 
   dontFixup = true; # binaries must not be stripped or patchelfed
diff --git a/pkgs/servers/invidious/versions.json b/pkgs/servers/invidious/versions.json
index 615517b0b19..b41eddff1e4 100644
--- a/pkgs/servers/invidious/versions.json
+++ b/pkgs/servers/invidious/versions.json
@@ -4,9 +4,9 @@
     "sha256": "sha256-EU6T9yQCdOLx98Io8o01rEsgxDFF/Xoy42LgPopD2/A="
   },
   "invidious": {
-    "rev": "5160d8bae39dc5cc5d51abee90571a03c08d0f2b",
-    "sha256": "sha256-cM/5xnzO5wyzudXHeud9k3M5BsralRUgO4vSoebYRZ8=",
-    "version": "unstable-2022-11-22"
+    "rev": "927c37ce3eb306fe6a02c0fdb9e3ee0a837e84d2",
+    "sha256": "sha256-l5DDSopd4ueA0IoPovIPjGqCm3LZE8802Sh2EduLtuU=",
+    "version": "unstable-2023-01-08"
   },
   "lsquic": {
     "sha256": "sha256-hG8cUvhbCNeMOsKkaJlgGpzUrIx47E/WhmPIdI5F3qM=",
diff --git a/pkgs/servers/klipper/default.nix b/pkgs/servers/klipper/default.nix
index 0ba3df96f30..7c9117f91c1 100644
--- a/pkgs/servers/klipper/default.nix
+++ b/pkgs/servers/klipper/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "klipper";
-  version = "unstable-2022-11-21";
+  version = "unstable-2023-01-07";
 
   src = fetchFromGitHub {
     owner = "KevinOConnor";
     repo = "klipper";
-    rev = "c51f169c06921152a2e9c386016660d0bb09f767";
-    sha256 = "sha256-l5dOj4cKrKdQ0grmbIdXm5dmkrQv6L+NqCMN1i3z3SE=";
+    rev = "f1203d56f6bc2c84d00605a76525be4c13430324";
+    sha256 = "sha256-7FJ+omzXpj49AThcv0xDilIekCyehtvpvck1+nrMS70=";
   };
 
   sourceRoot = "source/klippy";
diff --git a/pkgs/servers/monitoring/karma/default.nix b/pkgs/servers/monitoring/karma/default.nix
index 999f3176815..1b87942af4a 100644
--- a/pkgs/servers/monitoring/karma/default.nix
+++ b/pkgs/servers/monitoring/karma/default.nix
@@ -19,16 +19,16 @@ in
 
 buildGoModule rec {
   pname = "karma";
-  version = "0.108";
+  version = "0.111";
 
   src = fetchFromGitHub {
     owner = "prymitive";
     repo = "karma";
     rev = "v${version}";
-    hash = "sha256-Hw+6zBBbVw8uGkZQvmS3gB1opZdg8wQ5LydIAWhXUXY=";
+    hash = "sha256-jcJ8rdggM4kDCVTsEBDtZ9nNnutl+RwABx7zHY39tDs=";
   };
 
-  vendorHash = "sha256-gW8q425ZgFL+uJ8UiSVEX7R890LR9jgxfbNIdhNJge4=";
+  vendorHash = "sha256-MYHgLKDSB/g/k4i+deBNeaeZ3BbHRnymwsNTTA7qNdU=";
 
   nativeBuildInputs = [
     nodejs-18_x
diff --git a/pkgs/servers/uxplay/default.nix b/pkgs/servers/uxplay/default.nix
index 8d128971a55..789f3ba8d67 100644
--- a/pkgs/servers/uxplay/default.nix
+++ b/pkgs/servers/uxplay/default.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "uxplay";
-  version = "1.60";
+  version = "1.61.1";
 
   src = fetchFromGitHub {
     owner = "FDH2";
     repo = "UxPlay";
     rev = "v${version}";
-    sha256 = "sha256-ERHn6kd/ZAo34iums2dudAqh9CdwUv2dLcn2YC7oBM0=";
+    sha256 = "sha256-eLTIpRmKewBghUYFot8I3iTeiI6wlU7WNs8/X3w+U80=";
   };
 
   postPatch = ''
diff --git a/pkgs/shells/fish/default.nix b/pkgs/shells/fish/default.nix
index f391076900e..7c9d90aa01a 100644
--- a/pkgs/shells/fish/default.nix
+++ b/pkgs/shells/fish/default.nix
@@ -135,7 +135,7 @@ let
 
   fish = stdenv.mkDerivation rec {
     pname = "fish";
-    version = "3.5.1";
+    version = "3.6.0";
 
     src = fetchurl {
       # There are differences between the release tarball and the tarball GitHub
@@ -145,7 +145,7 @@ let
       # --version`), as well as the local documentation for all builtins (and
       # maybe other things).
       url = "https://github.com/fish-shell/fish-shell/releases/download/${version}/${pname}-${version}.tar.xz";
-      sha256 = "sha256-ptRbPcWkXdMXcuf439/sq8BjmG6PZ9YL18pgzIHbaSg=";
+      hash = "sha512-oR6nYa2s4C73+IsliTMoAFzvB/ktNi+8eUVA3KJunPyXCHjQMSyuvRnWRIPp88PiStbCffziZNF3+T1lx+9plg==";
     };
 
     # Fix FHS paths in tests
diff --git a/pkgs/tools/graphics/gfxreconstruct/default.nix b/pkgs/tools/graphics/gfxreconstruct/default.nix
index 31ced64c46a..9dfd0def4a9 100644
--- a/pkgs/tools/graphics/gfxreconstruct/default.nix
+++ b/pkgs/tools/graphics/gfxreconstruct/default.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gfxreconstruct";
-  version = "0.9.15";
+  version = "0.9.16.1";
 
   src = fetchFromGitHub {
     owner = "LunarG";
     repo = "gfxreconstruct";
     rev = "v${version}";
-    hash = "sha256-hIzQ5L0Payj8hlyy5UI7RXgnyhQBPqG7nfbvW2VYvTg=";
+    hash = "sha256-6yUWXIJlfwaPT1SDVjSfO7Sj10DcpOLAbzASC4dLS1E=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/tools/misc/vtm/default.nix b/pkgs/tools/misc/vtm/default.nix
index 45a23b28707..fb68b5191b2 100644
--- a/pkgs/tools/misc/vtm/default.nix
+++ b/pkgs/tools/misc/vtm/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vtm";
-  version = "0.9.8g";
+  version = "0.9.8l";
 
   src = fetchFromGitHub {
     owner = "netxs-group";
     repo = "vtm";
     rev = "v${version}";
-    sha256 = "sha256-Q+QPRIk7EtcSZBrm9RCxSbz9cgznZQBnPwm9Qm+gH24=";
+    sha256 = "sha256-6hZvnZXnoS97uQKxBbSJmMN1bGp42p0v4kJH7F+3mjU=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/tools/networking/darkstat/default.nix b/pkgs/tools/networking/darkstat/default.nix
index 2da581776d2..22fdbb3e650 100644
--- a/pkgs/tools/networking/darkstat/default.nix
+++ b/pkgs/tools/networking/darkstat/default.nix
@@ -1,12 +1,21 @@
-{ lib, stdenv, fetchpatch, fetchurl, libpcap, zlib }:
+{ lib
+, stdenv
+, autoreconfHook
+, fetchFromGitHub
+, fetchpatch
+, libpcap
+, zlib
+}:
 
 stdenv.mkDerivation rec {
-  version = "3.0.719";
   pname = "darkstat";
+  version = "3.0.721";
 
-  src = fetchurl {
-    url = "${meta.homepage}/${pname}-${version}.tar.bz2";
-    sha256 = "1mzddlim6dhd7jhr4smh0n2fa511nvyjhlx76b03vx7phnar1bxf";
+  src = fetchFromGitHub {
+    owner = "emikulic";
+    repo = pname;
+    rev = "refs/tags/${version}";
+    hash = "sha256-kKj4fCgphoe3lojJfARwpITxQh7E6ehUew9FVEW63uQ=";
   };
 
   patches = [
@@ -18,7 +27,14 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  buildInputs = [ libpcap zlib ];
+  nativeBuildInputs = [
+    autoreconfHook
+  ];
+
+  buildInputs = [
+    libpcap
+    zlib
+  ];
 
   enableParallelBuilding = true;
 
@@ -34,7 +50,8 @@ stdenv.mkDerivation rec {
       - Supports IPv6.
     '';
     homepage = "http://unix4lyfe.org/darkstat";
-    license = licenses.gpl2;
+    changelog = "https://github.com/emikulic/darkstat/releases/tag/${version}";
+    license = licenses.gpl2Only;
     platforms = with platforms; unix;
   };
 }
diff --git a/pkgs/tools/networking/getmail6/default.nix b/pkgs/tools/networking/getmail6/default.nix
index 965ef759ff6..6a8e7abd100 100644
--- a/pkgs/tools/networking/getmail6/default.nix
+++ b/pkgs/tools/networking/getmail6/default.nix
@@ -5,13 +5,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "getmail6";
-  version = "6.18.10";
+  version = "6.18.11";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-nRi0HUq8jEugFogerFD7Xu9fgn1njfumbwhChz2t4t8=";
+    hash = "sha256-EJ1lnSeawWezOYZxAHx3QX9kWGoayWZ2vkFY21l+Ijc=";
   };
 
   # needs a Docker setup
diff --git a/pkgs/tools/networking/pathvector/default.nix b/pkgs/tools/networking/pathvector/default.nix
index b6c0f0b05cb..4b39e6cd19d 100644
--- a/pkgs/tools/networking/pathvector/default.nix
+++ b/pkgs/tools/networking/pathvector/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "pathvector";
-  version = "6.0.3";
+  version = "6.1.0";
 
   src = fetchFromGitHub {
     owner = "natesales";
     repo = "pathvector";
     rev = "v${version}";
-    sha256 = "sha256-WY9208bbJOSDJ9WaV8KIr65GZjqhFjdzwTga0u4oQo4=";
+    sha256 = "sha256-tMcoL+nvvMBCWSVD+l42e6IlOIj8ERP9pgBHcJBtegY=";
   };
 
-  vendorSha256 = "sha256-R3o1L34FXbtRzJ1I2Xj4iWsiFJJWexGWYv2TmvhINe0=";
+  vendorHash = "sha256-+GML6a9LzHZfByHv7ODp7fHBauExsZTzUccMEeeOFNg=";
 
   CGO_ENABLED = 0;
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 89f95690f48..5e1d17b31f9 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -13384,8 +13384,9 @@ with pkgs;
 
   yarn = callPackage ../development/tools/yarn  { };
 
-  yarn2nix-moretea = callPackage ../development/tools/yarn2nix-moretea/yarn2nix { };
+  yarn2nix-moretea = callPackage ../development/tools/yarn2nix-moretea/yarn2nix { pkgs = pkgs.__splicedPackages; };
   yarn2nix-moretea-openssl_1_1 = callPackage ../development/tools/yarn2nix-moretea/yarn2nix {
+    pkgs = pkgs.__splicedPackages;
     nodejs = nodejs.override { openssl = openssl_1_1; };
   };
 
@@ -34921,7 +34922,7 @@ with pkgs;
 
   otto-matic = callPackage ../games/otto-matic { };
 
-  openraPackages = import ../games/openra pkgs;
+  openraPackages = import ../games/openra pkgs.__splicedPackages;
 
   openra = openraPackages.engines.release;
 
@@ -36215,9 +36216,7 @@ with pkgs;
 
   crypto-org-wallet = callPackage ../applications/blockchains/crypto-org-wallet { };
 
-  cubicle = callPackage ../applications/science/logic/cubicle {
-    ocamlPackages = ocaml-ng.ocamlPackages_4_05;
-  };
+  cubicle = callPackage ../applications/science/logic/cubicle { };
 
   cvc3 = callPackage ../applications/science/logic/cvc3 {
     gmp = lib.overrideDerivation gmp (_: { dontDisableStatic = true; });