diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index f5fd13ad89d..cdf361cb60d 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -7804,7 +7804,6 @@
     name = "Claudius Holeksa";
   };
   ken-matsui = {
-    email = "nix@kmatsui.me";
     github = "ken-matsui";
     githubId = 26405363;
     name = "Ken Matsui";
@@ -9255,6 +9254,12 @@
     github = "marius851000";
     githubId = 22586596;
   };
+  markbeep = {
+    email = "mrkswrn@gmail.com";
+    github = "markbeep";
+    githubId = 20665331;
+    name = "Mark";
+  };
   markus1189 = {
     email = "markus1189@gmail.com";
     github = "markus1189";
diff --git a/nixos/tests/pomerium.nix b/nixos/tests/pomerium.nix
index 7af82832644..abaf56c518e 100644
--- a/nixos/tests/pomerium.nix
+++ b/nixos/tests/pomerium.nix
@@ -20,6 +20,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
   }; in {
     pomerium = { pkgs, lib, ... }: {
       imports = [ (base "192.168.1.1") ];
+      environment.systemPackages = with pkgs; [ chromium ];
       services.pomerium = {
         enable = true;
         settings = {
@@ -98,5 +99,11 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
         pomerium.succeed(
             "curl -L --resolve login.required:80:127.0.0.1 http://login.required | grep 'hello I am login page'"
         )
+
+    with subtest("ui"):
+        pomerium.succeed(
+          # check for a string that only appears if the UI is displayed correctly
+            "chromium --no-sandbox --headless --disable-gpu --dump-dom --host-resolver-rules='MAP login.required 127.0.0.1:80' http://login.required/.pomerium | grep 'contact your administrator'"
+        )
   '';
 })
diff --git a/pkgs/applications/networking/instant-messengers/chatterino2/default.nix b/pkgs/applications/networking/instant-messengers/chatterino2/default.nix
index f1fc9917708..acda0581edb 100644
--- a/pkgs/applications/networking/instant-messengers/chatterino2/default.nix
+++ b/pkgs/applications/networking/instant-messengers/chatterino2/default.nix
@@ -1,17 +1,17 @@
-{ stdenv, lib, cmake, pkg-config, fetchFromGitHub, qtbase, qtsvg, qtmultimedia, qtimageformats, qttools, boost, openssl, wrapQtAppsHook }:
+{ stdenv, lib, cmake, pkg-config, fetchFromGitHub, qtbase, qtsvg, qtmultimedia, qtimageformats, qttools, boost, openssl, wrapQtAppsHook, libsecret }:
 
 stdenv.mkDerivation rec {
   pname = "chatterino2";
-  version = "2.4.0";
+  version = "2.4.2";
   src = fetchFromGitHub {
     owner = "Chatterino";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-6t7Or2heyV0B5zdWZpN80iADe52faNVlIEZYtcixpZo=";
+    sha256 = "sha256-d/rsY4pgPpA4JcMmoD6AG1DzHovfSERaeuYkMY603kA=";
     fetchSubmodules = true;
   };
   nativeBuildInputs = [ cmake pkg-config wrapQtAppsHook ];
-  buildInputs = [ qtbase qtsvg qtmultimedia qtimageformats qttools boost openssl ];
+  buildInputs = [ qtbase qtsvg qtmultimedia qtimageformats qttools boost openssl libsecret ];
   postInstall = lib.optionalString stdenv.isDarwin ''
     mkdir -p "$out/Applications"
     mv bin/chatterino.app "$out/Applications/"
diff --git a/pkgs/applications/radio/sdrangel/default.nix b/pkgs/applications/radio/sdrangel/default.nix
index 392088eca95..0bda52d425e 100644
--- a/pkgs/applications/radio/sdrangel/default.nix
+++ b/pkgs/applications/radio/sdrangel/default.nix
@@ -1,4 +1,6 @@
-{ airspy
+{ lib
+, stdenv
+, airspy
 , airspyhf
 , aptdec
 , boost
@@ -13,7 +15,6 @@
 , glew
 , hackrf
 , hidapi
-, lib
 , ffmpeg
 , libiio
 , libopus
@@ -95,7 +96,7 @@ mkDerivation rec {
     "-DDAB_LIB=${dab_lib}"
     "-DLIBSERIALDV_INCLUDE_DIR:PATH=${serialdv}/include/serialdv"
     "-DLIMESUITE_INCLUDE_DIR:PATH=${limesuite}/include"
-    "-DLIMESUITE_LIBRARY:FILEPATH=${limesuite}/lib/libLimeSuite.so"
+    "-DLIMESUITE_LIBRARY:FILEPATH=${limesuite}/lib/libLimeSuite${stdenv.hostPlatform.extensions.sharedLibrary}"
     "-DSGP4_DIR=${sgp4}"
     "-DSOAPYSDR_DIR=${soapysdr-with-plugins}"
   ];
@@ -110,6 +111,6 @@ mkDerivation rec {
     homepage = "https://github.com/f4exb/sdrangel";
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ alkeryn ];
-    platforms = platforms.linux;
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/applications/science/biology/nest/default.nix b/pkgs/applications/science/biology/nest/default.nix
index f26f06a1f29..912fecff177 100644
--- a/pkgs/applications/science/biology/nest/default.nix
+++ b/pkgs/applications/science/biology/nest/default.nix
@@ -20,13 +20,13 @@
 
 stdenv.mkDerivation rec {
   pname = "nest";
-  version = "3.3";
+  version = "3.4";
 
   src = fetchFromGitHub {
     owner = "nest";
     repo = "nest-simulator";
     rev = "v${version}";
-    sha256 = "sha256-wmn5LOOHlSuyPdV6O6v7j10dxdcvqpym6MfveZdL+dU=";
+    hash = "sha256-+wjsZxW2l0WGyGTm/6vyzPEeqCfyxJml9oP/zn6W1L0=";
   };
 
   postPatch = ''
@@ -67,7 +67,7 @@ stdenv.mkDerivation rec {
   postInstall = ''
     # Alternative to autoPatchElf, moves libraries where
     # Nest expects them to be
-    find $out/lib/nest -type f -exec ln -s {} $out/lib \;
+    find $out/lib/nest -exec ln -s {} $out/lib \;
   '';
 
   passthru.tests.version = testers.testVersion {
@@ -78,7 +78,8 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "NEST is a command line tool for simulating neural networks";
     homepage = "https://www.nest-simulator.org/";
-    license = licenses.gpl2;
+    changelog = "https://github.com/nest/nest-simulator/releases/tag/v${version}";
+    license = licenses.gpl2Plus;
     maintainers = with maintainers; [ jiegec davidcromp ];
     platforms = platforms.unix;
   };
diff --git a/pkgs/build-support/trivial-builders/test/references.nix b/pkgs/build-support/trivial-builders/test/references.nix
index 3e1eb16eecd..7c8ea83f3c8 100644
--- a/pkgs/build-support/trivial-builders/test/references.nix
+++ b/pkgs/build-support/trivial-builders/test/references.nix
@@ -45,10 +45,8 @@ testers.nixosTest {
       """)
     '';
   meta = {
-    license = lib.licenses.mit; # nixpkgs license
     maintainers = with lib.maintainers; [
       roberth
     ];
-    description = "Run the Nixpkgs trivial builders tests";
   };
 }
diff --git a/pkgs/data/themes/orchis-theme/default.nix b/pkgs/data/themes/orchis-theme/default.nix
index 3f964cba350..44270189085 100644
--- a/pkgs/data/themes/orchis-theme/default.nix
+++ b/pkgs/data/themes/orchis-theme/default.nix
@@ -26,13 +26,13 @@ lib.checkListOfEnum "${pname}: theme tweaks" validTweaks tweaks
 stdenvNoCC.mkDerivation
 rec {
   inherit pname;
-  version = "2023-02-26";
+  version = "2023-03-18";
 
   src = fetchFromGitHub {
     repo = "Orchis-theme";
     owner = "vinceliuice";
     rev = version;
-    sha256 = "sha256-Qk5MK8S8rIcwO7Kmze6eAl5qcwnrGsiWbn0WNIPjRnA=";
+    hash = "sha256-ixVHQRJXoXuPEsrbWOVMC/qdF3szpxYzC/8kKe47Bs8=";
   };
 
   nativeBuildInputs = [ gtk3 sassc ];
diff --git a/pkgs/development/embedded/bossa/default.nix b/pkgs/development/embedded/bossa/default.nix
index f53e49edaed..58ee0642fb3 100644
--- a/pkgs/development/embedded/bossa/default.nix
+++ b/pkgs/development/embedded/bossa/default.nix
@@ -1,4 +1,11 @@
-{ lib, stdenv, fetchFromGitHub, wxGTK, libX11, readline }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, wxGTK32
+, libX11
+, readline
+, darwin
+}:
 
 let
   # BOSSA needs a "bin2c" program to embed images.
@@ -24,11 +31,27 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-8M3MU/+Y1L6SaQ1yoC9Z27A/gGruZdopLnL1z7h7YJw=";
   };
 
-  nativeBuildInputs = [ bin2c ];
-  buildInputs = [ wxGTK libX11 readline ];
+  postPatch = ''
+    substituteInPlace Makefile \
+      --replace "-arch x86_64" ""
+  '';
 
-  # Explicitly specify targets so they don't get stripped.
-  makeFlags = [ "bin/bossac" "bin/bossash" "bin/bossa" ];
+  nativeBuildInputs = [ bin2c ];
+  buildInputs = [
+    wxGTK32
+    libX11
+    readline
+  ] ++ lib.optionals stdenv.isDarwin [
+    darwin.apple_sdk.frameworks.Cocoa
+  ];
+
+  makeFlags = [
+    "WXVERSION=3.2"
+    # Explicitly specify targets so they don't get stripped.
+    "bin/bossac"
+    "bin/bossash"
+    "bin/bossa"
+  ];
   env.NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations";
 
   installPhase = ''
@@ -47,6 +70,6 @@ stdenv.mkDerivation rec {
     '';
     homepage = "http://www.shumatech.com/web/products/bossa";
     license = licenses.bsd3;
-    platforms = platforms.linux;
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/libraries/aptdec/default.nix b/pkgs/development/libraries/aptdec/default.nix
index 5f1db6d3559..dce52f7e668 100644
--- a/pkgs/development/libraries/aptdec/default.nix
+++ b/pkgs/development/libraries/aptdec/default.nix
@@ -26,6 +26,6 @@ stdenv.mkDerivation {
     homepage = "https://github.com/Xerbo/aptdec";
     license = licenses.gpl2;
     maintainers = with maintainers; [ alexwinter ];
-    platforms = platforms.linux;
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/libraries/cm256cc/default.nix b/pkgs/development/libraries/cm256cc/default.nix
index 3a2538898cc..4b49bcbbcc9 100644
--- a/pkgs/development/libraries/cm256cc/default.nix
+++ b/pkgs/development/libraries/cm256cc/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Fast GF(256) Cauchy MDS Block Erasure Codec in C++";
     homepage = "https://github.com/f4exb/cm256cc";
-    platforms = platforms.linux;
+    platforms = platforms.unix;
     maintainers = with maintainers; [ alkeryn ];
     license = licenses.gpl3;
   };
diff --git a/pkgs/development/libraries/dab_lib/default.nix b/pkgs/development/libraries/dab_lib/default.nix
index 7570d8aaca7..019456b3c5d 100644
--- a/pkgs/development/libraries/dab_lib/default.nix
+++ b/pkgs/development/libraries/dab_lib/default.nix
@@ -23,6 +23,6 @@ stdenv.mkDerivation {
     homepage = "https://github.com/JvanKatwijk/dab-cmdline";
     license = licenses.gpl2;
     maintainers = with maintainers; [ alexwinter ];
-    platforms = platforms.linux;
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/libraries/dsdcc/default.nix b/pkgs/development/libraries/dsdcc/default.nix
index a992eac27cb..3bc8d6c49a8 100644
--- a/pkgs/development/libraries/dsdcc/default.nix
+++ b/pkgs/development/libraries/dsdcc/default.nix
@@ -30,6 +30,6 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/f4exb/dsdcc";
     license = licenses.gpl3;
     maintainers = with maintainers; [ alexwinter ];
-    platforms = platforms.linux;
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/libraries/opencv/3.x.nix b/pkgs/development/libraries/opencv/3.x.nix
index 75d8c712df1..45d55542c82 100644
--- a/pkgs/development/libraries/opencv/3.x.nix
+++ b/pkgs/development/libraries/opencv/3.x.nix
@@ -32,7 +32,7 @@
 , enableDC1394    ? false, libdc1394
 , enableDocs      ? false, doxygen, graphviz-nox
 
-, AVFoundation, Cocoa, VideoDecodeAcceleration, bzip2
+, AVFoundation, Cocoa, VideoDecodeAcceleration, bzip2, CoreMedia, MediaToolbox
 }:
 
 assert blas.implementation == "openblas" && lapack.implementation == "openblas";
@@ -211,7 +211,7 @@ stdenv.mkDerivation {
     # tesseract & leptonica.
     ++ lib.optionals enableTesseract [ tesseract leptonica ]
     ++ lib.optional enableTbb tbb
-    ++ lib.optionals stdenv.isDarwin [ bzip2 AVFoundation Cocoa VideoDecodeAcceleration ]
+    ++ lib.optionals stdenv.isDarwin [ bzip2 AVFoundation Cocoa VideoDecodeAcceleration CoreMedia MediaToolbox ]
     ++ lib.optionals enableDocs [ doxygen graphviz-nox ];
 
   propagatedBuildInputs = lib.optional enablePython pythonPackages.numpy
@@ -250,7 +250,6 @@ stdenv.mkDerivation {
   ] ++ lib.optionals stdenv.isDarwin [
     "-DWITH_OPENCL=OFF"
     "-DWITH_LAPACK=OFF"
-    "-DBUILD_opencv_videoio=OFF"
   ] ++ lib.optionals enablePython [
     "-DOPENCV_SKIP_PYTHON_LOADER=ON"
   ] ++ lib.optionals enableEigen [
diff --git a/pkgs/development/libraries/qt-5/modules/qtspeech.nix b/pkgs/development/libraries/qt-5/modules/qtspeech.nix
index a1ecb48f0d9..371162324c0 100644
--- a/pkgs/development/libraries/qt-5/modules/qtspeech.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtspeech.nix
@@ -1,9 +1,9 @@
-{ qtModule, speechd, pkg-config }:
+{ lib, qtModule, stdenv, speechd, pkg-config }:
 
 qtModule {
   pname = "qtspeech";
   qtInputs = [ ];
-  buildInputs = [ speechd ];
+  buildInputs = lib.optionals stdenv.isLinux [ speechd ];
   nativeBuildInputs = [ pkg-config ];
   outputs = [ "out" "dev" ];
 }
diff --git a/pkgs/development/libraries/qt-5/modules/qtwebengine.nix b/pkgs/development/libraries/qt-5/modules/qtwebengine.nix
index bebfe37f686..60899e50535 100644
--- a/pkgs/development/libraries/qt-5/modules/qtwebengine.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtwebengine.nix
@@ -221,6 +221,7 @@ qtModule {
     Prefix = ..
     EOF
 
+  '' + ''
     # Fix for out-of-sync QtWebEngine and Qt releases (since 5.15.3)
     sed 's/${lib.head (lib.splitString "-" version)} /${qtCompatVersion} /' -i "$out"/lib/cmake/*/*Config.cmake
   '';
diff --git a/pkgs/development/libraries/serialdv/default.nix b/pkgs/development/libraries/serialdv/default.nix
index d1d9c6299b3..bff7a107eeb 100644
--- a/pkgs/development/libraries/serialdv/default.nix
+++ b/pkgs/development/libraries/serialdv/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "C++ Minimal interface to encode and decode audio with AMBE3000 based devices in packet mode over a serial link";
     homepage = "https://github.com/f4exb/serialdv";
-    platforms = platforms.linux;
+    platforms = platforms.unix;
     maintainers = with maintainers; [ alkeryn ];
     license = licenses.gpl3;
   };
diff --git a/pkgs/development/libraries/sgp4/default.nix b/pkgs/development/libraries/sgp4/default.nix
index 98c62f9cd34..166e3c08fd3 100644
--- a/pkgs/development/libraries/sgp4/default.nix
+++ b/pkgs/development/libraries/sgp4/default.nix
@@ -18,6 +18,6 @@ stdenv.mkDerivation {
     homepage = "https://github.com/dnwrnr/sgp4";
     license = licenses.asl20;
     maintainers = with maintainers; [ alexwinter ];
-    platforms = platforms.linux;
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/python-modules/peaqevcore/default.nix b/pkgs/development/python-modules/peaqevcore/default.nix
index 0df291e4578..2c65ef85183 100644
--- a/pkgs/development/python-modules/peaqevcore/default.nix
+++ b/pkgs/development/python-modules/peaqevcore/default.nix
@@ -6,14 +6,14 @@
 
 buildPythonPackage rec {
   pname = "peaqevcore";
-  version = "13.2.0";
+  version = "13.2.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-fu4NL5m8+eae2+sTyi1yNA1J2qQfjfSlbIQyorlXZ6Y=";
+    hash = "sha256-N/tLoZNiMY1rzzToVvE9U4buUsmsDEcnKPOuifh7qg0=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pyobihai/default.nix b/pkgs/development/python-modules/pyobihai/default.nix
index 45f12b49b96..2a06d1f4f32 100644
--- a/pkgs/development/python-modules/pyobihai/default.nix
+++ b/pkgs/development/python-modules/pyobihai/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "pyobihai";
-  version = "1.4.0";
+  version = "1.4.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
   # GitHub release, https://github.com/dshokouhi/pyobihai/issues/10
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-P6tKpssey59SdjS/QWpuv1UUagjR7RVAl6rse/O79mg=";
+    hash = "sha256-L/AQy9IxsBDeSlu+45j+/86jjMFzTjAkPGwZoa1QYho=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/python-lsp-server/default.nix b/pkgs/development/python-modules/python-lsp-server/default.nix
index a026eb15fa2..5034d9939c1 100644
--- a/pkgs/development/python-modules/python-lsp-server/default.nix
+++ b/pkgs/development/python-modules/python-lsp-server/default.nix
@@ -161,5 +161,6 @@ buildPythonPackage rec {
     changelog = "https://github.com/python-lsp/python-lsp-server/blob/v${version}/CHANGELOG.md";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
+    mainProgram = "pylsp";
   };
 }
diff --git a/pkgs/development/tools/analysis/codeql/default.nix b/pkgs/development/tools/analysis/codeql/default.nix
index e80ac3b8e83..20d16066f28 100644
--- a/pkgs/development/tools/analysis/codeql/default.nix
+++ b/pkgs/development/tools/analysis/codeql/default.nix
@@ -1,8 +1,8 @@
-{ lib, stdenv, fetchzip, zlib, xorg, freetype, jdk11, curl }:
+{ lib, stdenv, fetchzip, zlib, xorg, freetype, jdk17, curl }:
 
 stdenv.mkDerivation rec {
   pname = "codeql";
-  version = "2.12.3";
+  version = "2.12.4";
 
   dontConfigure = true;
   dontBuild = true;
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
 
   src = fetchzip {
     url = "https://github.com/github/codeql-cli-binaries/releases/download/v${version}/codeql.zip";
-    sha256 = "sha256-xBTL3atnLsw7HWhkWq32LdQmSBtsQ2ydK+8On8l+OcA=";
+    sha256 = "sha256-Rmz35iyLXmNePHFVN8QmjeoKbR3eRy7nrY1FJpTfL7o=";
   };
 
   nativeBuildInputs = [
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     xorg.libXtst
     xorg.libXrender
     freetype
-    jdk11
+    jdk17
     stdenv.cc.cc.lib
     curl
   ];
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
 
     ln -sf $out/codeql/tools/linux64/lib64trace.so $out/codeql/tools/linux64/libtrace.so
 
-    sed -i 's%\$CODEQL_DIST/tools/\$CODEQL_PLATFORM/java%\${jdk11}%g' $out/codeql/codeql
+    sed -i 's%\$CODEQL_DIST/tools/\$CODEQL_PLATFORM/java%\${jdk17}%g' $out/codeql/codeql
 
     ln -s $out/codeql/codeql $out/bin/
   '';
diff --git a/pkgs/development/tools/buf/default.nix b/pkgs/development/tools/buf/default.nix
index fdf763efb26..b006db4b4d5 100644
--- a/pkgs/development/tools/buf/default.nix
+++ b/pkgs/development/tools/buf/default.nix
@@ -44,6 +44,9 @@ buildGoModule rec {
     export CI=true
   '';
 
+  # Allow tests that bind or connect to localhost on macOS.
+  __darwinAllowLocalNetworking = true;
+
   installPhase = ''
     runHook preInstall
 
diff --git a/pkgs/development/tools/esbuild/default.nix b/pkgs/development/tools/esbuild/default.nix
index fae82784e45..aa705c5ea8c 100644
--- a/pkgs/development/tools/esbuild/default.nix
+++ b/pkgs/development/tools/esbuild/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "esbuild";
-  version = "0.17.11";
+  version = "0.17.12";
 
   src = fetchFromGitHub {
     owner = "evanw";
     repo = "esbuild";
     rev = "v${version}";
-    hash = "sha256-k7bXEDAmxyn2u/cniqKtr9zbrWnzwbhTZkL35/igctM=";
+    hash = "sha256-75qDQWAp6cmuXtq90oIIQCj5IKUoQxNARxhFo2Sm5mk=";
   };
 
   vendorHash = "sha256-+BfxCyg0KkDQpHt/wycy/8CTG6YBA/VJvJFhhzUnSiQ=";
diff --git a/pkgs/development/tools/golangci-lint/default.nix b/pkgs/development/tools/golangci-lint/default.nix
index b3d12204367..1f11f96af37 100644
--- a/pkgs/development/tools/golangci-lint/default.nix
+++ b/pkgs/development/tools/golangci-lint/default.nix
@@ -2,18 +2,16 @@
 
 buildGoModule rec {
   pname = "golangci-lint";
-  version = "1.51.2";
+  version = "1.52.0";
 
   src = fetchFromGitHub {
     owner = "golangci";
     repo = "golangci-lint";
     rev = "v${version}";
-    hash = "sha256-F2rkVZ5ia9/wyTw1WIeizFnuaHoS2A8VzVOGDcshy64=";
+    hash = "sha256-XcrWBHmxsDwsP/+H0OTmGKVG9NgBwR5dBY9sJZWo+K8=";
   };
 
-  vendorHash = "sha256-JO/mRJB3gRTtBj6pW1267/xXUtalTJo0p3q5e34vqTs=";
-
-  doCheck = false;
+  vendorHash = "sha256-N20AJaREqmvCey5P0YuUd3l/5xRzrIG+mPOiVHOUFWc=";
 
   subPackages = [ "cmd/golangci-lint" ];
 
diff --git a/pkgs/games/itchiodl/default.nix b/pkgs/games/itchiodl/default.nix
index c68be798f4d..57a5d1473e1 100644
--- a/pkgs/games/itchiodl/default.nix
+++ b/pkgs/games/itchiodl/default.nix
@@ -5,13 +5,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "itchiodl";
-  version = "2.2.0";
+  version = "2.3.0";
 
   src = fetchFromGitHub {
     owner = "Emersont1";
     repo = "itchio";
     rev = "v${version}";
-    hash = "sha256-tylMEsUdeMUuLcxRMkkJE7vPAVuqc/cVJ4DB3xmV+iA=";
+    hash = "sha256-XuNkqTAT9LlSwruchGQbombAKHZvKhpnqLfvJdDcrj0=";
   };
 
   format = "pyproject";
diff --git a/pkgs/servers/http/pomerium/default.nix b/pkgs/servers/http/pomerium/default.nix
index 8e41aa8590b..d78a4cc74c0 100644
--- a/pkgs/servers/http/pomerium/default.nix
+++ b/pkgs/servers/http/pomerium/default.nix
@@ -14,25 +14,24 @@ let
 in
 buildGoModule rec {
   pname = "pomerium";
-  version = "0.20.0";
+  version = "0.21.2";
   src = fetchFromGitHub {
     owner = "pomerium";
     repo = "pomerium";
     rev = "v${version}";
-    sha256 = "sha256-J8ediRreV80lzPcKIOSl1CNHp04ZW9ePyNyejlN50cE=";
+    sha256 = "sha256-wsfbG4VAS3U3voDdry35QlWknlWIfThZQalf9S/9GO0=";
   };
 
-  vendorSha256 = "sha256-V8asyi1Nm+h3KK/loBRZQN6atfEGUEdRydeZsp9wyQY=";
+  vendorSha256 = "sha256-8g3jhxKIT0EGUXh0hrvDbw3i04khqlAfGzM6k4q3O8g=";
 
   ui = mkYarnPackage {
     inherit version;
     src = "${src}/ui";
 
-    # update pomerium-ui-package.json when updating package, sourced from ui/package.json
-    packageJSON = ./pomerium-ui-package.json;
+    packageJSON = ./package.json;
     offlineCache = fetchYarnDeps {
       yarnLock = "${src}/ui/yarn.lock";
-      sha256 = "sha256:1n6swanrds9hbd4yyfjzpnfhsb8fzj1pwvvcg3w7b1cgnihclrmv";
+      sha256 = lib.fileContents ./yarn-hash;
     };
 
     buildPhase = ''
@@ -111,9 +110,12 @@ buildGoModule rec {
     install -Dm0755 $GOPATH/bin/pomerium $out/bin/pomerium
   '';
 
-  passthru.tests = {
-    inherit (nixosTests) pomerium;
-    inherit pomerium-cli;
+  passthru = {
+    tests = {
+      inherit (nixosTests) pomerium;
+      inherit pomerium-cli;
+    };
+    updateScript = ./updater.sh;
   };
 
   meta = with lib; {
diff --git a/pkgs/servers/http/pomerium/pomerium-ui-package.json b/pkgs/servers/http/pomerium/package.json
similarity index 98%
rename from pkgs/servers/http/pomerium/pomerium-ui-package.json
rename to pkgs/servers/http/pomerium/package.json
index 6b9dcf4a3e8..37227248672 100644
--- a/pkgs/servers/http/pomerium/pomerium-ui-package.json
+++ b/pkgs/servers/http/pomerium/package.json
@@ -29,7 +29,7 @@
     "@fontsource/dm-sans": "^4.5.1",
     "@mui/icons-material": "^5.3.1",
     "@mui/material": "^5.4.0",
-    "luxon": "^2.3.0",
+    "luxon": "^2.5.2",
     "markdown-to-jsx": "^7.1.7",
     "react": "^17.0.2",
     "react-dom": "^17.0.2",
diff --git a/pkgs/servers/http/pomerium/updater.sh b/pkgs/servers/http/pomerium/updater.sh
new file mode 100755
index 00000000000..0df47268ca9
--- /dev/null
+++ b/pkgs/servers/http/pomerium/updater.sh
@@ -0,0 +1,23 @@
+#! /usr/bin/env nix-shell
+#! nix-shell -i bash -p gnugrep coreutils curl wget jq nix-update prefetch-yarn-deps
+
+set -euo pipefail
+pushd "$(dirname "${BASH_SOURCE[0]}")"
+
+owner="pomerium"
+repo="pomerium"
+version=`curl -s "https://api.github.com/repos/$owner/$repo/tags" | jq -r .[0].name | grep -oP "^v\K.*"`
+url="https://raw.githubusercontent.com/$owner/$repo/v$version/"
+
+if [[ "$UPDATE_NIX_OLD_VERSION" == "$version" ]]; then
+    echo "Already up to date!"
+    exit 0
+fi
+
+rm -f package.json yarn.lock
+wget "$url/ui/yarn.lock" "$url/ui/package.json"
+echo $(prefetch-yarn-deps) > yarn-hash
+rm -f yarn.lock
+
+popd
+nix-update pomerium --version $version
diff --git a/pkgs/servers/http/pomerium/yarn-hash b/pkgs/servers/http/pomerium/yarn-hash
new file mode 100644
index 00000000000..fec5f1f3c7e
--- /dev/null
+++ b/pkgs/servers/http/pomerium/yarn-hash
@@ -0,0 +1 @@
+085nghha82q30b3vgzs76xsa85kbxqk7mjrknxxc5z7awrjhdmkb
diff --git a/pkgs/servers/klipper/klipper-firmware.nix b/pkgs/servers/klipper/klipper-firmware.nix
index 4c9e4e29354..fba5331d5b8 100644
--- a/pkgs/servers/klipper/klipper-firmware.nix
+++ b/pkgs/servers/klipper/klipper-firmware.nix
@@ -5,7 +5,7 @@
 , bintools-unwrapped
 , libffi
 , libusb1
-, wxGTK30
+, wxGTK32
 , python3
 , gcc-arm-embedded
 , klipper
@@ -28,7 +28,7 @@
     avrdude
     stm32flash
     pkg-config
-    wxGTK30 # Required for bossac
+    wxGTK32 # Required for bossac
   ];
 
   preBuild = "cp ${firmwareConfig} ./.config";
@@ -40,6 +40,7 @@
   makeFlags = [
     "V=1"
     "KCONFIG_CONFIG=${firmwareConfig}"
+    "WXVERSION=3.2"
   ];
 
   installPhase = ''
diff --git a/pkgs/tools/X11/xpra/default.nix b/pkgs/tools/X11/xpra/default.nix
index e182fe5e8c1..f70f2efa071 100644
--- a/pkgs/tools/X11/xpra/default.nix
+++ b/pkgs/tools/X11/xpra/default.nix
@@ -190,6 +190,7 @@ in buildPythonApplication rec {
   postInstall = ''
     # append module paths to xorg.conf
     cat ${xorgModulePaths} >> $out/etc/xpra/xorg.conf
+    cat ${xorgModulePaths} >> $out/etc/xpra/xorg-uinput.conf
 
     # make application icon visible to desktop environemnts
     icon_dir="$out/share/icons/hicolor/64x64/apps"
diff --git a/pkgs/tools/misc/ramfetch/default.nix b/pkgs/tools/misc/ramfetch/default.nix
new file mode 100644
index 00000000000..a5708866d9f
--- /dev/null
+++ b/pkgs/tools/misc/ramfetch/default.nix
@@ -0,0 +1,33 @@
+{ lib
+, stdenv
+, fetchgit
+}:
+
+stdenv.mkDerivation rec {
+  name = "ramfetch";
+  version = "1.1.0";
+
+  src = fetchgit {
+    url = "https://codeberg.org/o69mar/ramfetch.git";
+    rev = "v${version}";
+    hash = "sha256-XUph+rTbw5LXWRq+OSKl0EjFac+MQAx3NBu4rWdWR3w=";
+  };
+
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D ramfetch $out/bin/ramfetch
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "A tool which displays memory information";
+    homepage = "https://codeberg.org/o69mar/ramfetch";
+    platforms = lib.platforms.linux;
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.markbeep ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 4dbb57860a3..6bdc275e473 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -11543,6 +11543,8 @@ with pkgs;
 
   rambox = callPackage ../applications/networking/instant-messengers/rambox { };
 
+  ramfetch = callPackage ../tools/misc/ramfetch { };
+
   rar = callPackage ../tools/archivers/rar { };
 
   rarcrack = callPackage ../tools/security/rarcrack { };
@@ -17559,9 +17561,7 @@ with pkgs;
 
   bloop = callPackage ../development/tools/build-managers/bloop { };
 
-  bossa = callPackage ../development/embedded/bossa {
-    wxGTK = wxGTK30;
-  };
+  bossa = callPackage ../development/embedded/bossa { };
 
   bossa-arduino = callPackage ../development/embedded/bossa/arduino.nix { };
 
@@ -22815,7 +22815,7 @@ with pkgs;
   };
 
   opencv3 = callPackage ../development/libraries/opencv/3.x.nix {
-    inherit (darwin.apple_sdk.frameworks) AVFoundation Cocoa VideoDecodeAcceleration;
+    inherit (darwin.apple_sdk.frameworks) AVFoundation Cocoa VideoDecodeAcceleration CoreMedia MediaToolbox;
     ffmpeg = ffmpeg_4;
   };
 
diff --git a/pkgs/top-level/pkg-config/test-defaultPkgConfigPackages.nix b/pkgs/top-level/pkg-config/test-defaultPkgConfigPackages.nix
index 37687117987..108a2b67504 100644
--- a/pkgs/top-level/pkg-config/test-defaultPkgConfigPackages.nix
+++ b/pkgs/top-level/pkg-config/test-defaultPkgConfigPackages.nix
@@ -4,7 +4,8 @@
 let
   inherit (lib.strings) escapeNixIdentifier;
 
-  allTests = lib.mapAttrs (k: v: if v == null then null else makePkgConfigTestMaybe k v) defaultPkgConfigPackages;
+  allTests = lib.mapAttrs (k: v: if v == null then null else makePkgConfigTestMaybe k v)
+    (builtins.removeAttrs defaultPkgConfigPackages ["recurseForDerivations"]);
 
   # nix-build rejects attribute names with periods
   # This will build those regardless.