diff --git a/lib/modules.nix b/lib/modules.nix
index a7fbec93a2f..204a2cc1ac1 100644
--- a/lib/modules.nix
+++ b/lib/modules.nix
@@ -1135,10 +1135,10 @@ rec {
         type = toType;
       });
       config = mkMerge [
-        {
+        (optionalAttrs (options ? warnings) {
           warnings = optional (warn && fromOpt.isDefined)
             "The option `${showOption from}' defined in ${showFiles fromOpt.files} has been renamed to `${showOption to}'.";
-        }
+        })
         (if withPriority
           then mkAliasAndWrapDefsWithPriority (setAttrByPath to) fromOpt
           else mkAliasAndWrapDefinitions (setAttrByPath to) fromOpt)
diff --git a/lib/tests/modules.sh b/lib/tests/modules.sh
index c9ea674ee10..6d2eb24db55 100755
--- a/lib/tests/modules.sh
+++ b/lib/tests/modules.sh
@@ -348,6 +348,13 @@ checkConfigOutput 'ok' config.freeformItems.foo.bar ./adhoc-freeformType-survive
 # because of an `extendModules` bug, issue 168767.
 checkConfigOutput '^1$' config.sub.specialisation.value ./extendModules-168767-imports.nix
 
+# doRename works when `warnings` does not exist.
+checkConfigOutput '^1234$' config.c.d.e ./doRename-basic.nix
+# doRename adds a warning.
+checkConfigOutput '^"The option `a\.b. defined in `.*/doRename-warnings\.nix. has been renamed to `c\.d\.e.\."$' \
+  config.result \
+  ./doRename-warnings.nix
+
 cat <<EOF
 ====== module tests ======
 $pass Pass
diff --git a/lib/tests/modules/doRename-basic.nix b/lib/tests/modules/doRename-basic.nix
new file mode 100644
index 00000000000..9d79fa4f26a
--- /dev/null
+++ b/lib/tests/modules/doRename-basic.nix
@@ -0,0 +1,11 @@
+{ lib, ... }: {
+  imports = [
+    (lib.doRename { from = ["a" "b"]; to = ["c" "d" "e"]; warn = true; use = x: x; visible = true; })
+  ];
+  options = {
+    c.d.e = lib.mkOption {};
+  };
+  config = {
+    a.b = 1234;
+  };
+}
diff --git a/lib/tests/modules/doRename-warnings.nix b/lib/tests/modules/doRename-warnings.nix
new file mode 100644
index 00000000000..6f0f1e87e3a
--- /dev/null
+++ b/lib/tests/modules/doRename-warnings.nix
@@ -0,0 +1,14 @@
+{ lib, config, ... }: {
+  imports = [
+    (lib.doRename { from = ["a" "b"]; to = ["c" "d" "e"]; warn = true; use = x: x; visible = true; })
+  ];
+  options = {
+    warnings = lib.mkOption { type = lib.types.listOf lib.types.str; };
+    c.d.e = lib.mkOption {};
+    result = lib.mkOption {};
+  };
+  config = {
+    a.b = 1234;
+    result = lib.concatStringsSep "%" config.warnings;
+  };
+}
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index bc38c663a2a..0b95bedb823 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -4450,6 +4450,13 @@
     githubId = 9959940;
     name = "Andreas Fehn";
   };
+  felipeqq2 = {
+    name = "Felipe Silva";
+    email = "felipeqq2@outlook.com";
+    github = "felipeqq2";
+    githubId = 71830138;
+    keys = [{ fingerprint = "F5F0 2BCE 3580 BF2B 707A  AA8C 2FD3 4A9E 2671 91B8"; }];
+  };
   felixscheinost = {
     name = "Felix Scheinost";
     email = "felix.scheinost@posteo.de";
diff --git a/pkgs/applications/audio/netease-cloud-music-gtk/default.nix b/pkgs/applications/audio/netease-cloud-music-gtk/default.nix
index 7811125bd24..524f89a26ac 100644
--- a/pkgs/applications/audio/netease-cloud-music-gtk/default.nix
+++ b/pkgs/applications/audio/netease-cloud-music-gtk/default.nix
@@ -1,6 +1,5 @@
 { lib
 , stdenv
-, fetchpatch
 , fetchFromGitHub
 , rustPlatform
 , meson
@@ -22,26 +21,18 @@
 
 stdenv.mkDerivation rec {
   pname = "netease-cloud-music-gtk";
-  version = "2.0.2";
+  version = "2.0.3";
 
   src = fetchFromGitHub {
     owner = "gmg137";
     repo = pname;
     rev = version;
-    hash = "sha256-0pmuzdRQBdUS4ORh3zJQWb/hbhk7SY3P4QMwoy4Mgp8=";
+    hash = "sha256-A3mvf6TZ3+aiWA6rg9G5NMaDKvO0VQzwIM1t0MaTpTc=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "add-cargo-lock-for-2.0.2.patch";
-      url = "https://github.com/gmg137/netease-cloud-music-gtk/commit/21b5d40d49e661fe7bd35ed10bb8b883ef7fcd9f.patch";
-      hash = "sha256-pSgc+yJQMNyLPYUMc1Kp/Kr+++2tH8srIM5PgVeoZ+E=";
-    })
-  ];
-
   cargoDeps = rustPlatform.fetchCargoTarball {
-    inherit src patches;
-    hash = "sha256-7Z5i5Xqtk4ZbBXSVYg1e05ENa2swC88Ctd2paE60Yyo=";
+    inherit src;
+    hash = "sha256-Y7rZTbg0zd/eoo6E8TmV8JJPs1N0bLlBjvB6W07Kelg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/audio/tagger/default.nix b/pkgs/applications/audio/tagger/default.nix
index 5d4052a8efa..992934cd8cc 100644
--- a/pkgs/applications/audio/tagger/default.nix
+++ b/pkgs/applications/audio/tagger/default.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation rec {
   pname = "tagger";
-  version = "2022.10.5";
+  version = "2022.10.6";
 
   src = fetchFromGitHub {
     owner = "nlogozzo";
     repo = "NickvisionTagger";
     rev = version;
-    hash = "sha256-rkpeecJUOBom0clrwftBa/VxACTihfMfWVmfbZhMQ50=";
+    hash = "sha256-eo7H2pNtSChUAqjO0ocFjsGt4I0e8ZOHbZ/GoZgUva8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/dstask/default.nix b/pkgs/applications/misc/dstask/default.nix
index 4e03059a8cc..5cfb8c7039e 100644
--- a/pkgs/applications/misc/dstask/default.nix
+++ b/pkgs/applications/misc/dstask/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "dstask";
-  version = "0.23.1";
+  version = "0.25";
 
   src = fetchFromGitHub {
     owner = "naggie";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0rfz8jim0xqcwdb5n28942v9r3hbvhjrwdgzvbwc9f9psqg2s8d2";
+    sha256 = "sha256-nsEn9ZhrSWO0kltyEXaehMcFpqVbivSsXOxu/AX7A9U=";
   };
 
   # Set vendorSha256 to null because dstask vendors its dependencies (meaning
@@ -30,8 +30,6 @@ buildGoModule rec {
     "-X github.com/naggie/dstask.GIT_COMMIT=v${version}"
   ];
 
-  subPackages = [ "cmd/dstask.go" ];
-
   meta = with lib; {
     description = "Command line todo list with super-reliable git sync";
     homepage = src.meta.homepage;
diff --git a/pkgs/applications/networking/cluster/glooctl/default.nix b/pkgs/applications/networking/cluster/glooctl/default.nix
index 203b0f37a3b..0728a03e976 100644
--- a/pkgs/applications/networking/cluster/glooctl/default.nix
+++ b/pkgs/applications/networking/cluster/glooctl/default.nix
@@ -2,17 +2,17 @@
 
 buildGoModule rec {
   pname = "glooctl";
-  version = "1.12.31";
+  version = "1.12.33";
 
   src = fetchFromGitHub {
     owner = "solo-io";
     repo = "gloo";
     rev = "v${version}";
-    hash = "sha256-t/i1UhPfhT7+HAhVBhZKQezqpFrBrzimUHjIozQeJnk=";
+    hash = "sha256-T/fkQxRcwDYppGpAu1sBg8Oe8dAa4Bk/jt4jYMikPBE=";
   };
 
   subPackages = [ "projects/gloo/cli/cmd" ];
-  vendorSha256 = "sha256-MRBnwpuqYElxA4V1x7F4wccKV3T51RopfT37QUr7G4Y=";
+  vendorSha256 = "sha256-G26BfTdXMQP0U4FDRYkJNfUOGfqow714WPNBnBrXLZQ=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/applications/networking/cluster/temporal-cli/default.nix b/pkgs/applications/networking/cluster/temporal-cli/default.nix
index 6d86bc79e6b..abaff42f3a3 100644
--- a/pkgs/applications/networking/cluster/temporal-cli/default.nix
+++ b/pkgs/applications/networking/cluster/temporal-cli/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "temporal-cli";
-  version = "1.17.0";
+  version = "1.17.1";
 
   src = fetchFromGitHub {
     owner = "temporalio";
     repo = "tctl";
     rev = "v${version}";
-    sha256 = "sha256-XEN4Ntt7yHng1+3E5SlxthEWPXJ+kSx9L1GbW9bV03Y=";
+    sha256 = "sha256-rdDtgSM2wZsHYv9tBNdcSHYXdvvEk5wqdLr1KjoPz1E=";
   };
 
   vendorSha256 = "sha256-9bgovXVj+qddfDSI4DTaNYH4H8Uc4DZqeVYG5TWXTNw=";
diff --git a/pkgs/applications/networking/synology-cloud-sync-decryption-tool/default.nix b/pkgs/applications/networking/synology-cloud-sync-decryption-tool/default.nix
new file mode 100644
index 00000000000..3ceb5c0e1af
--- /dev/null
+++ b/pkgs/applications/networking/synology-cloud-sync-decryption-tool/default.nix
@@ -0,0 +1,43 @@
+{ lib, writeScript, qt5, fetchurl, autoPatchelfHook }:
+
+qt5.mkDerivation rec {
+  pname = "synology-cloud-sync-decryption-tool";
+  version = "027";
+
+  src = fetchurl {
+    url = "https://global.download.synology.com/download/Utility/SynologyCloudSyncDecryptionTool/${version}/Linux/x86_64/SynologyCloudSyncDecryptionTool-${version}_x64.tar.gz";
+    sha256 = "sha256-EWxADvkfhnMwHIauJj3pH6SvSkkrc4cwAhsf1pWOOWQ=";
+  };
+
+  nativeBuildInputs = [ autoPatchelfHook ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    cp $NIX_BUILD_TOP/SynologyCloudSyncDecryptionTool $out/bin
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = writeScript "update-synology-cloud-sync-decryption-tool" ''
+    #!/usr/bin/env nix-shell
+    #!nix-shell -i bash -p curl common-updater-scripts
+
+    set -euo pipefail
+
+    version="$(curl -s https://www.synology.com/en-uk/releaseNote/SynologyCloudSyncDecryptionTool \
+             | grep -oP '(?<=data-version=")\d+' \
+             | head -1)"
+    update-source-version synology-cloud-sync-decryption-tool "$version"
+  '';
+
+  meta = with lib; {
+    description = "A desktop tool to decrypt data encrypted by Cloud Sync.";
+    homepage = "https://kb.synology.com/en-global/DSM/help/SynologyCloudSyncDecryptionTool/synologycloudsyncdecryptiontool";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+    license = licenses.unfree;
+    maintainers = with maintainers; [ kalbasit ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
diff --git a/pkgs/data/fonts/go-font/default.nix b/pkgs/data/fonts/go-font/default.nix
index 02e90ff1c40..45041bb805d 100644
--- a/pkgs/data/fonts/go-font/default.nix
+++ b/pkgs/data/fonts/go-font/default.nix
@@ -1,20 +1,18 @@
-{ lib, fetchgit }:
+{ lib, fetchzip }:
 
 let
   version = "2.010";
-in (fetchgit {
-  name = "go-font-${version}";
-  url = "https://go.googlesource.com/image";
   rev = "41969df76e82aeec85fa3821b1e24955ea993001";
+in (fetchzip {
+  name = "go-font-${version}";
+  url = "https://go.googlesource.com/image/+archive/${rev}/font/gofont/ttfs.tar.gz";
+  stripRoot = false;
 
   postFetch = ''
-    mv $out source
-    cd source
-
     mkdir -p $out/share/fonts/truetype
     mkdir -p $out/share/doc/go-font
-    cp font/gofont/ttfs/* $out/share/fonts/truetype
-    mv $out/share/fonts/truetype/README $out/share/doc/go-font/LICENSE
+    mv $out/*.ttf $out/share/fonts/truetype
+    mv $out/README $out/share/doc/go-font/LICENSE
   '';
 
   sha256 = "175jwq16qjnd2k923n9gcbjizchy7yv4n41dm691sjwrhbl0b13x";
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index cf045179070..24ce9ff2077 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -9,7 +9,7 @@
 , galliumDrivers ? ["auto"]
 , vulkanDrivers ? ["auto"]
 , eglPlatforms ? [ "x11" ] ++ lib.optionals stdenv.isLinux [ "wayland" ]
-, vulkanLayers ? [ "device-select" "overlay" ]
+, vulkanLayers ? lib.optionals (!stdenv.isDarwin) [ "device-select" "overlay" ] # No Vulkan support on Darwin
 , OpenGL, Xplugin
 , withValgrind ? lib.meta.availableOn stdenv.hostPlatform valgrind-light && !valgrind-light.meta.broken, valgrind-light
 , enableGalliumNine ? stdenv.isLinux
diff --git a/pkgs/development/mobile/maestro/default.nix b/pkgs/development/mobile/maestro/default.nix
new file mode 100644
index 00000000000..1c3e6f1a8f3
--- /dev/null
+++ b/pkgs/development/mobile/maestro/default.nix
@@ -0,0 +1,33 @@
+{ lib, stdenv, fetchurl, unzip, makeWrapper, jre_headless }:
+
+stdenv.mkDerivation rec {
+  pname = "maestro";
+  version = "1.11.3";
+
+  src = fetchurl {
+    url = "https://github.com/mobile-dev-inc/maestro/releases/download/cli-${version}/maestro-${version}.zip";
+    sha256 = "0hjsrwp6d1k68p0qhn7v9689ihy06ssnfpi8dj61jw6r64c234m4";
+  };
+
+  dontUnpack = true;
+  nativeBuildInputs = [ unzip makeWrapper ];
+
+  installPhase = ''
+    mkdir $out
+    unzip $src -d $out
+    mv $out/maestro-$version/* $out
+    rm -rf $out/maestro-$version
+  '';
+
+  postFixup = ''
+    wrapProgram $out/bin/maestro --prefix PATH : "${lib.makeBinPath [ jre_headless ]}"
+  '';
+
+  meta = with lib; {
+    description = "Mobile UI Automation tool";
+    homepage = "https://maestro.mobile.dev/";
+    license = licenses.asl20;
+    platforms = lib.platforms.all;
+    maintainers = with maintainers; [ SubhrajyotiSen ];
+  };
+}
diff --git a/pkgs/development/python-modules/dinghy/default.nix b/pkgs/development/python-modules/dinghy/default.nix
index 1949fb6714f..f117cd3381a 100644
--- a/pkgs/development/python-modules/dinghy/default.nix
+++ b/pkgs/development/python-modules/dinghy/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "dinghy";
-  version = "0.13.4";
+  version = "0.14.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "nedbat";
     repo = pname;
     rev = version;
-    hash = "sha256-H3AFKKtSiFD3LqyWaIYB4LncPaH2/eptuKS4BN0cNBQ=";
+    hash = "sha256-zhSSEI5h7ZCQeytAFbevowhITghaG4vu81C4pDb6xUg=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/junos-eznc/default.nix b/pkgs/development/python-modules/junos-eznc/default.nix
index 9830d29789b..2cd29ba4da4 100644
--- a/pkgs/development/python-modules/junos-eznc/default.nix
+++ b/pkgs/development/python-modules/junos-eznc/default.nix
@@ -26,29 +26,16 @@
 
 buildPythonPackage rec {
   pname = "junos-eznc";
-  version = "2.6.3";
+  version = "2.6.5";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "Juniper";
     repo = "py-junos-eznc";
     rev = version;
-    hash = "sha256-XhQJwtS518AzSwyaWE392nfNdYe9+iYHvXxQsjJfzI8=";
+    hash = "sha256-BoHT6ejccInfREbYtW6psm3fvsQxLS1vpj/aPDqqpnY=";
   };
 
-  patches = [
-    (fetchpatch {
-      # Fixes tests with lxml>=4.8.0; remove > 2.6.3
-      url = "https://github.com/Juniper/py-junos-eznc/commit/048f750bb7357b6f6b9db8ad64bea479298c74fb.patch";
-      hash = "sha256-DYVj0BNPwDSbxDrzHhaq4F4kz1bliXB6Au3I63mRauc=";
-    })
-  ];
-
-  postPatch = ''
-    substituteInPlace requirements.txt \
-      --replace "ncclient==0.6.9" "ncclient"
-  '';
-
   propagatedBuildInputs = [
     jinja2
     lxml
diff --git a/pkgs/development/python-modules/pipdeptree/default.nix b/pkgs/development/python-modules/pipdeptree/default.nix
index 945093dffd0..0132ff4db34 100644
--- a/pkgs/development/python-modules/pipdeptree/default.nix
+++ b/pkgs/development/python-modules/pipdeptree/default.nix
@@ -14,16 +14,16 @@
 
 buildPythonPackage rec {
   pname = "pipdeptree";
-  version = "2.3.1";
+  version = "2.3.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
-    owner = "naiquevin";
+    owner = "tox-dev";
     repo = "pipdeptree";
     rev = "refs/tags/${version}";
-    hash = "sha256-X3SVQzBg+QjBSewRsfiyLqIea0duhe1nUf8ancWLvcI=";
+    hash = "sha256-ivqu9b+4FhGa5y+WnKRk4nF6MR4Vj62pSs2d7ycIZMc=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
@@ -38,7 +38,9 @@ buildPythonPackage rec {
   ];
 
   passthru.optional-dependencies = {
-    graphviz = [ graphviz ];
+    graphviz = [
+      graphviz
+    ];
   };
 
   checkInputs = [
@@ -54,7 +56,8 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "Command line utility to show dependency tree of packages";
-    homepage = "https://github.com/naiquevin/pipdeptree";
+    homepage = "https://github.com/tox-dev/pipdeptree";
+    changelog = "https://github.com/tox-dev/pipdeptree/releases/tag/${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ charlesbaynham ];
   };
diff --git a/pkgs/development/tools/analysis/checkstyle/default.nix b/pkgs/development/tools/analysis/checkstyle/default.nix
index 17f7ec81be3..4575b06c572 100644
--- a/pkgs/development/tools/analysis/checkstyle/default.nix
+++ b/pkgs/development/tools/analysis/checkstyle/default.nix
@@ -1,12 +1,12 @@
 { lib, stdenv, fetchurl, makeWrapper, jre }:
 
 stdenv.mkDerivation rec {
-  version = "10.3.4";
+  version = "10.4";
   pname = "checkstyle";
 
   src = fetchurl {
     url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-${version}/checkstyle-${version}-all.jar";
-    sha256 = "sha256-HOKEbBU2jo7AJmSMVG2j1yM4VfcdN+Tl/MiazxtKYHw=";
+    sha256 = "sha256-x/13rqb3NOP4ML2HoddkmRrEwBAsG97Z2iLLoJCu2PQ=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/development/tools/continuous-integration/github-runner/default.nix b/pkgs/development/tools/continuous-integration/github-runner/default.nix
index a318ad48cdb..e460ffd2590 100644
--- a/pkgs/development/tools/continuous-integration/github-runner/default.nix
+++ b/pkgs/development/tools/continuous-integration/github-runner/default.nix
@@ -46,7 +46,7 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "github-runner";
-  version = "2.299.0";
+  version = "2.299.1";
 
   inherit sdkSource;
 
@@ -54,7 +54,7 @@ stdenv.mkDerivation rec {
     owner = "actions";
     repo = "runner";
     rev = "v${version}";
-    hash = "sha256-/grYaWhpd6jZx/gkWC3L+BoZcB6WKVMZzMGfwDhBRr0=";
+    hash = "sha256-o6N7GDfSEWX6QaEga5hQpbpDcBh7Alcy9mK3QlODTbs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/esbuild/default.nix b/pkgs/development/tools/esbuild/default.nix
index 8a8562af65e..03b0b362682 100644
--- a/pkgs/development/tools/esbuild/default.nix
+++ b/pkgs/development/tools/esbuild/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "esbuild";
-  version = "0.15.12";
+  version = "0.15.13";
 
   src = fetchFromGitHub {
     owner = "evanw";
     repo = "esbuild";
     rev = "v${version}";
-    sha256 = "sha256-NyujxnBi55wMmLW488gmimcywfeO6WWAnx/y0KqhR7o=";
+    sha256 = "sha256-iQei9YSJIKnqsWK26Eh6l3yafvRKPZ2YdHhQqybsfVg=";
   };
 
   vendorSha256 = "sha256-+BfxCyg0KkDQpHt/wycy/8CTG6YBA/VJvJFhhzUnSiQ=";
diff --git a/pkgs/development/tools/jo/default.nix b/pkgs/development/tools/jo/default.nix
index 8ec8deaefe0..b63bf46f606 100644
--- a/pkgs/development/tools/jo/default.nix
+++ b/pkgs/development/tools/jo/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "jo";
-  version = "1.6";
+  version = "1.7";
 
   src = fetchFromGitHub {
     owner  = "jpmens";
     repo = "jo";
     rev = version;
-    sha256 ="sha256-aATCeJV0x+XHOQbwulutxivPzGVQ0mJj90vA+6IM124=";
+    sha256 ="sha256-uJUbe593k7ENfbKCFhmm4Io0CPB109LF9EH8Qw0BFiY=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/tools/ruff/default.nix b/pkgs/development/tools/ruff/default.nix
index 3c0bf53c382..e1f48288008 100644
--- a/pkgs/development/tools/ruff/default.nix
+++ b/pkgs/development/tools/ruff/default.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "ruff";
-  version = "0.0.94";
+  version = "0.0.97";
 
   src = fetchFromGitHub {
     owner = "charliermarsh";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-ux6AeETHFVCapBBKn32NlMhXMWTi5tEbnSqGd6K5r0A=";
+    sha256 = "sha256-e/tPGjkg/PXbFoaWhzTzf8XbeLll8H9ru1SpdejQjIA=";
   };
 
-  cargoSha256 = "sha256-7eB6DaD4/ivAGip3Vsb1RZBQ38Hxn4y/oz9/jjI3A1g=";
+  cargoSha256 = "sha256-iVH9MVv0NYezbWcvVLvgGFMoIhDLnoeGl3pVcDk/M40=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
     CoreServices
diff --git a/pkgs/development/tools/rust/cargo-deny/default.nix b/pkgs/development/tools/rust/cargo-deny/default.nix
index 6d32c8b311f..92fea837742 100644
--- a/pkgs/development/tools/rust/cargo-deny/default.nix
+++ b/pkgs/development/tools/rust/cargo-deny/default.nix
@@ -11,19 +11,19 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-deny";
-  version = "0.13.2";
+  version = "0.13.3";
 
   src = fetchFromGitHub {
     owner = "EmbarkStudios";
     repo = pname;
     rev = version;
-    sha256 = "sha256-5JQ4G8wyKf//KU5NRr3fLLDUKsla+965wLj3nWeaEOo=";
+    sha256 = "sha256-INRQy7udhrc21Hy5HQ83LAoc2sjUE5AU5uf7mHJPkpo=";
   };
 
   # enable pkg-config feature of zstd
   cargoPatches = [ ./zstd-pkg-config.patch ];
 
-  cargoSha256 = "sha256-dNFwPP/qCyL1JWeE8y8hJR+b30tj0AQFFa42s2XjSzg=";
+  cargoSha256 = "sha256-JRciz40mSAXy3SoXVegudK4ehRjTBvSqrSFRDt7O/uQ=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/servers/etcd/3.4.nix b/pkgs/servers/etcd/3.4.nix
index bbf7d3a0d52..a5725b98a8d 100644
--- a/pkgs/servers/etcd/3.4.nix
+++ b/pkgs/servers/etcd/3.4.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "etcd";
-  version = "3.4.21";
+  version = "3.4.22";
 
   vendorSha256 = "sha256-P3EQTraMdZ2fAHDue5cKAxyHbh6nNeFV9ykT0rH7KPs=";
 
@@ -12,7 +12,7 @@ buildGoModule rec {
     owner = "etcd-io";
     repo = "etcd";
     rev = "v${version}";
-    sha256 = "sha256-+IU1l23sN9v48ZhJLGncUa3t5kPHBFcqQ/ojaZXzMU4=";
+    sha256 = "sha256-LIhAvW/oIlPp6U4VVUvUlmOHCduIbzYnrKc4PyfcXQQ=";
   };
 
   buildPhase = ''
diff --git a/pkgs/servers/monitoring/grafana-agent/default.nix b/pkgs/servers/monitoring/grafana-agent/default.nix
index 60a7333fe0d..a966fbeaf9b 100644
--- a/pkgs/servers/monitoring/grafana-agent/default.nix
+++ b/pkgs/servers/monitoring/grafana-agent/default.nix
@@ -1,27 +1,46 @@
-{ lib, buildGoModule, fetchFromGitHub, systemd, nixosTests }:
+{ lib, buildGoModule, fetchFromGitHub, systemd, nixosTests, bcc }:
 
 buildGoModule rec {
   pname = "grafana-agent";
-  version = "0.25.1";
+  version = "0.28.0";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "grafana";
     repo = "agent";
-    sha256 = "sha256-VbcWYH3eSKfYlSoN9HpxvhtvW36M1aYn9nLDfEbIzTY=";
+    sha256 = "sha256-UuDRnpb9JpghGDFsrlU7+iMboqiWVyT7qFSSPlLSFGs=";
   };
 
-  vendorSha256 = "sha256-VFTz9+nf4qH8bbFijpT1uIHSAhJy/aMMlIjkvnzzAD4=";
+  vendorSha256 = "sha256-UEQYZbP3dzi7wZwX+InJrgHrFB1wfSUNmUMkit+Y1Lo=";
+
+  ldflags = let
+    prefix = "github.com/grafana/agent/pkg/build";
+  in [
+    "-s" "-w"
+    # https://github.com/grafana/agent/blob/d672eba4ca8cb010ad8a9caef4f8b66ea6ee3ef2/Makefile#L125
+    "-X ${prefix}.Version=${version}"
+    "-X ${prefix}.Branch=v${version}"
+    "-X ${prefix}.Revision=v${version}"
+    "-X ${prefix}.BuildUser=nix"
+    "-X ${prefix}.BuildDate=1980-01-01T00:00:00Z"
+  ];
 
   tags = [
     "nonetwork"
     "nodocker"
   ];
 
+  subPackages = [
+    "cmd/agent"
+    "cmd/agentctl"
+  ];
+
   # uses go-systemd, which uses libsystemd headers
   # https://github.com/coreos/go-systemd/issues/351
   NIX_CFLAGS_COMPILE = [ "-I${lib.getDev systemd}/include" ];
 
+  buildInputs = [ bcc ];
+
   # tries to access /sys: https://github.com/grafana/agent/issues/333
   preBuild = ''
     rm pkg/integrations/node_exporter/node_exporter_test.go
diff --git a/pkgs/tools/admin/awscli2/default.nix b/pkgs/tools/admin/awscli2/default.nix
index 0aedc30da23..f9914483dc9 100644
--- a/pkgs/tools/admin/awscli2/default.nix
+++ b/pkgs/tools/admin/awscli2/default.nix
@@ -32,14 +32,14 @@ let
 in
 with py.pkgs; buildPythonApplication rec {
   pname = "awscli2";
-  version = "2.8.7"; # N.B: if you change this, check if overrides are still up-to-date
+  version = "2.8.8"; # N.B: if you change this, check if overrides are still up-to-date
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "aws-cli";
     rev = version;
-    sha256 = "sha256-AFVIHDWgBuM9aGFY7sEvoU6NmSBYQa/dXgz/qW/3rUY=";
+    sha256 = "sha256-F8FqsLh+KU6YR1BsE1+UPOsLkr7ie10kXCYJS0DfDCQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/admin/copilot-cli/default.nix b/pkgs/tools/admin/copilot-cli/default.nix
index bac1cbd375f..a1c9117ae51 100644
--- a/pkgs/tools/admin/copilot-cli/default.nix
+++ b/pkgs/tools/admin/copilot-cli/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "copilot-cli";
-  version = "1.22.1";
+  version = "1.23.0";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Jm4UTwWuqbtckIoXD7YVQk2MQlvzdfRbLW7YA+CmhDE=";
+    sha256 = "sha256-K+OWAZudk/xxKZw0zdsJfMj1jRhzOamBI7wd5ttmaiY=";
   };
 
-  vendorSha256 = "sha256-MOFPuxn6LwPUw0A14OXhZefAgvtm+9qcDTR3kfwCtjQ=";
+  vendorSha256 = "sha256-DCjJJZKVDFyZXItWRzBsxb8xLZNDLWI2kAp4KKKn9yA=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/audio/unflac/default.nix b/pkgs/tools/audio/unflac/default.nix
new file mode 100644
index 00000000000..2e22b81cc59
--- /dev/null
+++ b/pkgs/tools/audio/unflac/default.nix
@@ -0,0 +1,34 @@
+{ lib
+, buildGoModule
+, fetchFromSourcehut
+, ffmpeg
+, makeWrapper
+}:
+
+buildGoModule rec {
+  pname = "unflac";
+  version = "1.0";
+
+  src = fetchFromSourcehut {
+    owner = "~ft";
+    repo = pname;
+    rev = version;
+    sha256 = "1vlwlm895mcvmxaxcid3vfji1zi9wjchz7divm096na4whj35cc4";
+  };
+
+  vendorSha256 = "sha256-QqLjz1X4uVpxhYXb/xIBwuLUhRaqwz2GDUPjBTS4ut0=";
+
+  nativeBuildInputs = [ makeWrapper ];
+  postFixup = ''
+    wrapProgram $out/bin/unflac --prefix PATH : "${lib.makeBinPath [ffmpeg]}"
+  '';
+
+  meta = with lib; {
+    description =
+      "A command line tool for fast frame accurate audio image + cue sheet splitting";
+    homepage = "https://sr.ht/~ft/unflac/";
+    license = licenses.mit;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ felipeqq2 ];
+  };
+}
diff --git a/pkgs/tools/security/sudo/default.nix b/pkgs/tools/security/sudo/default.nix
index 12a872c643f..aa032467f48 100644
--- a/pkgs/tools/security/sudo/default.nix
+++ b/pkgs/tools/security/sudo/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchurl
+, fetchpatch
 , buildPackages
 , coreutils
 , pam
@@ -21,6 +22,14 @@ stdenv.mkDerivation rec {
     hash = "sha256-3hVzOIgXDFaDTar9NL+YPbEPshA5dC/Pw5a9MhaNY2I=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2022-43995.patch";
+      url = "https://github.com/sudo-project/sudo/commit/bd209b9f16fcd1270c13db27ae3329c677d48050.patch";
+      sha256 = "sha256-JUdoStoSyv6KBPsyzxuMIxqwZMZsjUPj8zUqOSvmZ1A=";
+    })
+  ];
+
   prePatch = ''
     # do not set sticky bit in nix store
     substituteInPlace src/Makefile.in --replace 04755 0755
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 7e5ed41963f..6abae9d38f8 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -456,6 +456,8 @@ with pkgs;
 
   dhallToNix = callPackage ../build-support/dhall/to-nix.nix { };
 
+  dinghy = with python3Packages; toPythonApplication dinghy;
+
   deadcode = callPackage ../development/tools/deadcode { };
 
   deadnix = callPackage ../development/tools/deadnix { };
@@ -1431,6 +1433,8 @@ with pkgs;
 
   ttchat = callPackage ../tools/misc/ttchat { };
 
+  unflac = callPackage ../tools/audio/unflac { };
+
   veikk-linux-driver-gui = libsForQt5.callPackage ../tools/misc/veikk-linux-driver-gui { };
 
   ventoy-bin = callPackage ../tools/cd-dvd/ventoy-bin {
@@ -23549,9 +23553,7 @@ with pkgs;
   grafana = callPackage ../servers/monitoring/grafana { };
   grafanaPlugins = callPackages ../servers/monitoring/grafana/plugins { };
 
-  grafana-agent = callPackage ../servers/monitoring/grafana-agent {
-    buildGoModule = buildGo118Module; # tests fail with 1.19
-  };
+  grafana-agent = callPackage ../servers/monitoring/grafana-agent {};
 
   grafana-loki = callPackage ../servers/monitoring/loki { };
   promtail = callPackage ../servers/monitoring/loki/promtail.nix { };
@@ -31795,10 +31797,14 @@ with pkgs;
 
   synology-drive-client = callPackage ../applications/networking/synology-drive-client { };
 
+  synology-cloud-sync-decryption-tool = callPackage ../applications/networking/synology-cloud-sync-decryption-tool { };
+
   maestral = with python3Packages; toPythonApplication maestral;
 
   maestral-gui = libsForQt5.callPackage ../applications/networking/maestral-qt { };
 
+  maestro = callPackage ../development/mobile/maestro { };
+
   myfitnesspal = with python3Packages; toPythonApplication myfitnesspal;
 
   insync = callPackage ../applications/networking/insync { };