diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index a12a1bc2106..1bde953126d 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -1627,6 +1627,12 @@
     githubId = 13324165;
     name = "Bill Ewanick";
   };
+  billhuang = {
+    email = "bill.huang2001@gmail.com";
+    github = "BillHuang2001";
+    githubId = 11801831;
+    name = "Bill Huang";
+  };
   binarin = {
     email = "binarin@binarin.ru";
     github = "binarin";
diff --git a/nixos/modules/tasks/filesystems/zfs.nix b/nixos/modules/tasks/filesystems/zfs.nix
index c8bbfe9769b..05174e03754 100644
--- a/nixos/modules/tasks/filesystems/zfs.nix
+++ b/nixos/modules/tasks/filesystems/zfs.nix
@@ -549,7 +549,7 @@ in
                 zfs load-key -a
               ''
               else concatMapStrings (fs: ''
-                zfs load-key ${fs}
+                zfs load-key -- ${escapeShellArg fs}
               '') cfgZfs.requestEncryptionCredentials}
         '') rootPools));
 
@@ -701,7 +701,7 @@ in
           # expand every pool. Otherwise we want to enumerate
           # just the specifically provided list of pools.
           poolListProvider = if cfgExpandOnBoot == "all"
-            then "$(zpool list -H | awk '{print $1}')"
+            then "$(zpool list -H -o name)"
             else lib.escapeShellArgs cfgExpandOnBoot;
         in
         {
diff --git a/pkgs/applications/misc/junction/default.nix b/pkgs/applications/misc/junction/default.nix
new file mode 100644
index 00000000000..34002c54716
--- /dev/null
+++ b/pkgs/applications/misc/junction/default.nix
@@ -0,0 +1,57 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, appstream-glib
+, desktop-file-utils
+, gobject-introspection
+, meson
+, ninja
+, pkg-config
+, wrapGAppsHook4
+, gjs
+, gtk4
+, libadwaita
+, libportal-gtk4
+}:
+
+stdenv.mkDerivation rec {
+  pname = "junction";
+  version = "1.5.0";
+
+  src = fetchFromGitHub {
+    owner = "sonnyp";
+    repo = "junction";
+    rev = "v${version}";
+    sha256 = "sha256-jS4SHh1BB8jk/4EP070X44C4n3GjyCz8ozgK8v5lbqc=";
+  };
+
+  nativeBuildInputs = [
+    appstream-glib
+    desktop-file-utils
+    gobject-introspection
+    meson
+    ninja
+    pkg-config
+    wrapGAppsHook4
+  ];
+
+  buildInputs = [
+    gjs
+    gtk4
+    libadwaita
+    libportal-gtk4
+  ];
+
+  postInstall = ''
+    # autoPatchShebangs does not like "/usr/bin/env -S gjs"
+    substituteInPlace $out/bin/re.sonny.Junction --replace "/usr/bin/env -S gjs" "/usr/bin/gjs"
+  '';
+
+  meta = with lib; {
+    description = "Choose the application to open files and links";
+    homepage = "https://apps.gnome.org/en/app/re.sonny.Junction/";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ hqurve ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/applications/misc/remarkable/remarkable-mouse/default.nix b/pkgs/applications/misc/remarkable/remarkable-mouse/default.nix
index 5734adc1b7d..7f5bf8862d5 100644
--- a/pkgs/applications/misc/remarkable/remarkable-mouse/default.nix
+++ b/pkgs/applications/misc/remarkable/remarkable-mouse/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonApplication rec {
   pname = "remarkable-mouse";
-  version = "7.0.1";
+  version = "7.0.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-kpKA3vrQo45Y6Qy6mcjJxJY3dpXV0ckNIfKdDVS5qhM=";
+    sha256 = "sha256-R/sQwVt+YHENkG9U2R205+YADovB8P58eMrUD/WnPic=";
   };
 
   propagatedBuildInputs = with python3Packages; [ screeninfo paramiko pynput libevdev ];
diff --git a/pkgs/applications/misc/rofi-rbw/default.nix b/pkgs/applications/misc/rofi-rbw/default.nix
index 561bf1f166c..a02d486ca9e 100644
--- a/pkgs/applications/misc/rofi-rbw/default.nix
+++ b/pkgs/applications/misc/rofi-rbw/default.nix
@@ -2,14 +2,14 @@
 
 buildPythonApplication rec {
   pname = "rofi-rbw";
-  version = "1.0.0";
+  version = "1.0.1";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "fdw";
     repo = "rofi-rbw";
     rev = "refs/tags/${version}";
-    hash = "sha256-BL7aLHKhLAGAT5+NXqzAW2g17XB1PjgRgJuxLh8fFk8=";
+    hash = "sha256-YDL0pMl3BX59kzjuykn0lQHu2RMvPhsBrlSiqdcZAXs=";
   };
 
   propagatedBuildInputs = [ configargparse ];
diff --git a/pkgs/applications/networking/instant-messengers/feishu/default.nix b/pkgs/applications/networking/instant-messengers/feishu/default.nix
new file mode 100644
index 00000000000..4dfd048b1b8
--- /dev/null
+++ b/pkgs/applications/networking/instant-messengers/feishu/default.nix
@@ -0,0 +1,173 @@
+{ alsa-lib
+, at-spi2-atk
+, at-spi2-core
+, atk
+, autoPatchelfHook
+, cairo
+, cups
+, dbus
+, dpkg
+, expat
+, fetchurl
+, fontconfig
+, freetype
+, gdk-pixbuf
+, glib
+, glibc
+, gnutls
+, gtk3
+, lib
+, libGL
+, libX11
+, libXScrnSaver
+, libXcomposite
+, libXcursor
+, libXdamage
+, libXext
+, libXfixes
+, libXi
+, libXrandr
+, libXrender
+, libXtst
+, libappindicator-gtk3
+, libcxx
+, libdbusmenu
+, libdrm
+, libgcrypt
+, libglvnd
+, libnotify
+, libuuid
+, libxcb
+, libxkbcommon
+, libxkbfile
+, libxshmfence
+, makeShellWrapper
+, mesa
+, nspr
+, nss
+, pango
+, pciutils
+, pipewire
+, pixman
+, stdenv
+, systemd
+, wayland
+, wrapGAppsHook
+, xdg-utils
+}:
+
+stdenv.mkDerivation rec {
+  version = "5.9.18";
+  pname = "feishu";
+  packageHash = "5db94058d7ad"; # A hash value used in the download url
+
+  src = fetchurl {
+    url = "https://sf3-cn.feishucdn.com/obj/ee-appcenter/${packageHash}/Feishu-linux_x64-${version}.deb";
+    sha256 = "ffb29b5a184b025d4e4ea468a8f684a7067ab5bfd45867abc370e59be63892c7";
+  };
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+    makeShellWrapper
+    dpkg
+  ];
+
+  buildInputs = [
+    gtk3
+
+    # for autopatchelf
+    alsa-lib
+    cups
+    libXdamage
+    libdrm
+    libxshmfence
+    mesa
+    nspr
+    nss
+  ];
+
+  rpath = lib.makeLibraryPath [
+    alsa-lib
+    at-spi2-atk
+    at-spi2-core
+    atk
+    cairo
+    cups
+    dbus
+    expat
+    fontconfig
+    freetype
+    gdk-pixbuf
+    glib
+    glibc
+    gnutls
+    libGL
+    libX11
+    libXScrnSaver
+    libXcomposite
+    libXcursor
+    libXdamage
+    libXext
+    libXfixes
+    libXi
+    libXrandr
+    libXrender
+    libXtst
+    libappindicator-gtk3
+    libcxx
+    libdbusmenu
+    libdrm
+    libgcrypt
+    libglvnd
+    libnotify
+    libuuid
+    libxcb
+    libxkbcommon
+    libxkbfile
+    libxshmfence
+    mesa
+    nspr
+    nss
+    pango
+    pciutils
+    pipewire
+    pixman
+    stdenv.cc.cc
+    systemd
+    wayland
+    xdg-utils
+  ];
+
+  dontUnpack = true;
+  installPhase = ''
+    # This deb file contains a setuid binary,
+    # so 'dpkg -x' doesn't work here.
+    dpkg --fsys-tarfile $src | tar --extract
+    mkdir -p $out
+    mv usr/share $out/
+    mv opt/ $out/
+    chmod -R g-w $out
+
+    substituteInPlace $out/share/applications/bytedance-feishu.desktop \
+      --replace /usr/bin/bytedance-feishu-stable $out/opt/bytedance/feishu/bytedance-feishu
+
+    wrapProgram $out/opt/bytedance/feishu/feishu \
+      --prefix XDG_DATA_DIRS : "$XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH" \
+      --prefix LD_LIBRARY_PATH : ${rpath}:$out/opt/bytedance/feishu
+
+    mkdir -p $out/share/icons/hicolor
+    base="$out/opt/bytedance/feishu"
+    for size in 16 24 32 48 64 128 256; do
+      mkdir -p $out/share/icons/hicolor/''${size}x''${size}/apps
+      ln -s $base/product_logo_$size.png $out/share/icons/hicolor/''${size}x''${size}/apps/bytedance-feishu.png
+    done
+  '';
+
+  meta = with lib; {
+    description = "An all-in-one collaboration suite";
+    homepage = "https://www.feishu.cn/en/";
+    downloadPage = "https://www.feishu.cn/en/#en_home_download_block";
+    license = licenses.unfree;
+    platforms = [ "x86_64-linux" ];
+  };
+}
diff --git a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
index 53b7f8417ca..37493fca09d 100644
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
@@ -5,26 +5,11 @@
 , cups, expat, libuuid, at-spi2-core, libappindicator-gtk3, mesa
 # Runtime dependencies:
 , systemd, libnotify, libdbusmenu, libpulseaudio, xdg-utils
-# Unfortunately this also overwrites the UI language (not just the spell
-# checking language!):
-, hunspellDicts, spellcheckerLanguage ? null # E.g. "de_DE"
-# For a full list of available languages:
-# $ cat pkgs/development/libraries/hunspell/dictionaries.nix | grep "dictFileName =" | awk '{ print $3 }'
 }:
 
-let
-  customLanguageWrapperArgs = (with lib;
-    let
-      # E.g. "de_DE" -> "de-de" (spellcheckerLanguage -> hunspellDict)
-      spellLangComponents = splitString "_" spellcheckerLanguage;
-      hunspellDict = elemAt spellLangComponents 0 + "-" + toLower (elemAt spellLangComponents 1);
-    in lib.optionalString (spellcheckerLanguage != null) ''
-      --set HUNSPELL_DICTIONARIES "${hunspellDicts.${hunspellDict}}/share/hunspell" \
-      --set LC_MESSAGES "${spellcheckerLanguage}"'');
-
-in stdenv.mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "signal-desktop";
-  version = "5.47.0"; # Please backport all updates to the stable channel.
+  version = "5.48.0"; # Please backport all updates to the stable channel.
   # All releases have a limited lifetime and "expire" 90 days after the release.
   # When releases "expire" the application becomes unusable until an update is
   # applied. The expiration date for the current release can be extracted with:
@@ -34,7 +19,7 @@ in stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://updates.signal.org/desktop/apt/pool/main/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-    sha256 = "sha256-aQpylo4/pbHP2an1w6DEhRmU3uvntN/tnYhvaWtNGGg=";
+    sha256 = "sha256-SJ3wO3lDEDyKuNuT8sadLfd3AcxB+DR2J5yKlkBUv24=";
   };
 
   nativeBuildInputs = [
@@ -123,7 +108,6 @@ in stdenv.mkDerivation rec {
   preFixup = ''
     gappsWrapperArgs+=(
       --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ stdenv.cc.cc ] }"
-      ${customLanguageWrapperArgs}
       --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--enable-features=UseOzonePlatform --ozone-platform=wayland}}"
       --suffix PATH : ${lib.makeBinPath [ xdg-utils ]}
     )
diff --git a/pkgs/applications/networking/protonvpn-gui/default.nix b/pkgs/applications/networking/protonvpn-gui/default.nix
index 46ac403b0d8..ef128932f7c 100644
--- a/pkgs/applications/networking/protonvpn-gui/default.nix
+++ b/pkgs/applications/networking/protonvpn-gui/default.nix
@@ -3,6 +3,7 @@
 , fetchFromGitHub
 , wrapGAppsHook
 , gdk-pixbuf
+, glib-networking
 , gobject-introspection
 , imagemagick
 , librsvg
@@ -34,6 +35,7 @@ buildPythonApplication rec {
   ];
 
   propagatedBuildInputs = [
+    glib-networking # needed for the login captcha
     protonvpn-nm-lib
     psutil
   ];
diff --git a/pkgs/applications/video/aegisub/default.nix b/pkgs/applications/video/aegisub/default.nix
index f6e4b22e721..82d1adfeec0 100644
--- a/pkgs/applications/video/aegisub/default.nix
+++ b/pkgs/applications/video/aegisub/default.nix
@@ -2,13 +2,17 @@
 , config
 , stdenv
 , fetchFromGitHub
-, autoreconfHook
 , boost
+, cmake
+, expat
+, harfbuzz
 , ffmpeg
 , ffms
 , fftw
 , fontconfig
 , freetype
+, fribidi
+, glib
 , icu
 , intltool
 , libGL
@@ -17,17 +21,23 @@
 , libass
 , libiconv
 , libuchardet
+, luajit
+, pcre
 , pkg-config
 , which
 , wxGTK
 , zlib
 
+, CoreText
+, CoreFoundation
+, AppKit
+, Carbon
+, IOKit
+, Cocoa
+
 , spellcheckSupport ? true
 , hunspell ? null
 
-, automationSupport ? true
-, luajit ? null
-
 , openalSupport ? false
 , openal ? null
 
@@ -40,10 +50,10 @@
 , portaudioSupport ? false
 , portaudio ? null
 
+, useBundledLuaJIT ? false
 }:
 
 assert spellcheckSupport -> (hunspell != null);
-assert automationSupport -> (luajit != null);
 assert openalSupport -> (openal != null);
 assert alsaSupport -> (alsa-lib != null);
 assert pulseaudioSupport -> (libpulseaudio != null);
@@ -55,31 +65,34 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "aegisub";
-  version = "3.3.2";
+  version = "3.3.2-20220612";
 
   src = fetchFromGitHub {
     owner = "wangqr";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-Er0g8fJyx7zjNVpKw7zUHE40hU10BdYlZohlqJq2LE0=";
+    rev = "91f8b5f91eb960bad19899c10af08aca34f9b697";
+    sha256 = "sha256-lPkPWSsncsBKJHDnma9cUXsQJynruT9JpPkMTHdQ/e8=";
   };
 
-  patches = [ ./no-git.patch ];
-
   nativeBuildInputs = [
-    autoreconfHook
     intltool
     luajit52
     pkg-config
     which
+    cmake
   ];
+
   buildInputs = [
     boost
+    expat
     ffmpeg
     ffms
     fftw
     fontconfig
     freetype
+    fribidi
+    glib
+    harfbuzz
     icu
     libGL
     libGLU
@@ -87,23 +100,25 @@ stdenv.mkDerivation rec {
     libass
     libiconv
     libuchardet
+    pcre
     wxGTK
     zlib
   ]
+  ++ lib.optionals stdenv.isDarwin [
+    CoreText
+    CoreFoundation
+    AppKit
+    Carbon
+    IOKit
+    Cocoa
+  ]
   ++ optional alsaSupport alsa-lib
-  ++ optional automationSupport luajit52
   ++ optional openalSupport openal
   ++ optional portaudioSupport portaudio
   ++ optional pulseaudioSupport libpulseaudio
   ++ optional spellcheckSupport hunspell
   ;
 
-  configureFlags = [
-    "--with-boost-libdir=${boost.out}/lib"
-    "--with-system-luajit"
-    "FORCE_GIT_VERSION=${version}"
-  ];
-
   enableParallelBuilding = true;
 
   hardeningDisable = [
@@ -111,7 +126,20 @@ stdenv.mkDerivation rec {
     "relro"
   ];
 
-  postInstall = "ln -s $out/bin/aegisub-* $out/bin/aegisub";
+  patches = lib.optionals (!useBundledLuaJIT) [
+    ./remove-bundled-luajit.patch
+  ];
+
+  NIX_CFLAGS_COMPILE = "-I${luajit52}/include";
+  NIX_CFLAGS_LINK = "-L${luajit52}/lib";
+
+  configurePhase = ''
+    export FORCE_GIT_VERSION=${version}
+    # Workaround for a Nixpkgs bug; remove when the fix arrives
+    mkdir build-dir
+    cd build-dir
+    cmake -DCMAKE_INSTALL_PREFIX=$out ..
+  '';
 
   meta = with lib; {
     homepage = "https://github.com/wangqr/Aegisub";
@@ -126,6 +154,6 @@ stdenv.mkDerivation rec {
     # softwares - so the resulting program will be GPL
     license = licenses.bsd3;
     maintainers = [ maintainers.AndersonTorres ];
-    platforms = [ "i686-linux" "x86_64-linux" ];
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/applications/video/aegisub/no-git.patch b/pkgs/applications/video/aegisub/no-git.patch
deleted file mode 100644
index c98467ca652..00000000000
--- a/pkgs/applications/video/aegisub/no-git.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-Modified from <https://github.com/wangqr/Aegisub/commit/f8dca9f6386299ec2f90158e2d923a8fb30e3466>
-to patch cleanly to v3.3.2. Necessary for building without git.
-Upstream and will be in next release.
-
-diff --git a/build/version.sh b/build/version.sh
-index 8cea0a3f3..d505341e4 100755
---- a/build/version.sh
-+++ b/build/version.sh
-@@ -10,13 +10,13 @@ if ! test -d "${srcdir}/.git"; then
-     done < "${version_h_path}"
-     if test x$BUILD_GIT_VERSION_NUMBER != x -a x$BUILD_GIT_VERSION_STRING != x; then
-       export VERSION_SOURCE="from cached git_version.h"
--      return 0
-+      exit 0
-     else
-       echo "invalid git_version.h"
-       exit 2
-     fi
--  else
--    echo "git repo not found and no cached git_version.h"
-+  elif [ -z "$FORCE_GIT_VERSION" ]; then
-+    echo "git repo not found and no cached git_version.h - use FORCE_GIT_VERSION to override"
-     exit 2
-   fi
- fi
-@@ -25,13 +25,13 @@ last_svn_revision=6962
- last_svn_hash="16cd907fe7482cb54a7374cd28b8501f138116be"
- 
- git_revision=$(expr $last_svn_revision + $(git log --pretty=oneline $last_svn_hash..HEAD 2>/dev/null | wc -l))
--git_version_str=$(git describe --exact-match 2> /dev/null)
-+git_version_str=${FORCE_GIT_VERSION:-$(git describe --exact-match 2> /dev/null)}
- installer_version='0.0.0'
- resource_version='0, 0, 0'
- if test x$git_version_str != x; then
-   git_version_str="${git_version_str##v}"
-   tagged_release=1
--  if [ $(echo $git_version_str | grep '\d\.\d\.\d') ]; then
-+  if [ $(echo $git_version_str | grep '[0-9].[0-9].[0-9]') ]; then
-     installer_version=$git_version_str
-     resource_version=$(echo $git_version_str | sed 's/\./, /g')
-   fi
diff --git a/pkgs/applications/video/aegisub/remove-bundled-luajit.patch b/pkgs/applications/video/aegisub/remove-bundled-luajit.patch
new file mode 100644
index 00000000000..d2b7dd0b575
--- /dev/null
+++ b/pkgs/applications/video/aegisub/remove-bundled-luajit.patch
@@ -0,0 +1,271 @@
+diff --git a/CMakeLists.test.txt b/CMakeLists.test.txt
+index 4d1a03177..62fab05c9 100644
+--- a/CMakeLists.test.txt
++++ b/CMakeLists.test.txt
+@@ -2,7 +2,7 @@ if(UNIX)
+     add_executable(aegisub-lua EXCLUDE_FROM_ALL
+         automation/tests/aegisub.cpp
+     )
+-    target_link_libraries(aegisub-lua PRIVATE libaegisub luabins luajit "Boost::locale" "ICU::in")
++    target_link_libraries(aegisub-lua PRIVATE libaegisub luabins luajit-5.1 "Boost::locale" "ICU::in")
+     add_custom_target(test-automation
+         COMMAND sh -c "$(luarocks path); ${PROJECT_BINARY_DIR}/aegisub-lua tests/busted.lua -p moon tests/modules"
+         VERBATIM
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index ce2e355ff..4d4396451 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -13,210 +13,6 @@ if(NOT CMAKE_BUILD_TYPE)
+     set(CMAKE_BUILD_TYPE Release)
+ endif()
+ 
+-## Build bundled LuaJIT with aegisub specific patches
+-add_executable(luajit-minilua vendor/luajit/src/host/minilua.c)
+-if(NOT WIN32)
+-    target_link_libraries(luajit-minilua m)
+-endif()
+-if(WIN32)
+-    if(CMAKE_SIZEOF_VOID_P EQUAL 8)
+-        add_custom_command(
+-            OUTPUT "${CMAKE_CURRENT_BINARY_DIR}/vendor/luajit/src/gen/buildvm_arch.h"
+-            COMMAND ${CMAKE_COMMAND} -E make_directory "${CMAKE_CURRENT_BINARY_DIR}/vendor/luajit/src/gen"
+-            COMMAND luajit-minilua ../dynasm/dynasm.lua -LN -D WIN -D JIT -D FFI -D P64 -o "${CMAKE_CURRENT_BINARY_DIR}/vendor/luajit/src/gen/buildvm_arch.h" vm_x86.dasc
+-            WORKING_DIRECTORY ${PROJECT_SOURCE_DIR}/vendor/luajit/src
+-        )
+-    else()
+-        add_custom_command(
+-            OUTPUT "${CMAKE_CURRENT_BINARY_DIR}/vendor/luajit/src/gen/buildvm_arch.h"
+-            COMMAND ${CMAKE_COMMAND} -E make_directory "${CMAKE_CURRENT_BINARY_DIR}/vendor/luajit/src/gen"
+-            COMMAND luajit-minilua ../dynasm/dynasm.lua -LN -D WIN -D JIT -D FFI -o "${CMAKE_CURRENT_BINARY_DIR}/vendor/luajit/src/gen/buildvm_arch.h" vm_x86.dasc
+-            WORKING_DIRECTORY ${PROJECT_SOURCE_DIR}/vendor/luajit/src
+-        )
+-    endif()
+-elseif(APPLE)
+-    if(CMAKE_HOST_SYSTEM_PROCESSOR STREQUAL "arm64")
+-        add_custom_command(
+-            OUTPUT "${CMAKE_CURRENT_BINARY_DIR}/vendor/luajit/src/gen/buildvm_arch.h"
+-            COMMAND ${CMAKE_COMMAND} -E make_directory "${CMAKE_CURRENT_BINARY_DIR}/vendor/luajit/src/gen"
+-            COMMAND luajit-minilua ../dynasm/dynasm.lua -D ENDIAN_LE -D P64 -D FFI -D DUALNUM -D FPU -D HFABI -D NO_UNWIND -D VER=80 -o "${CMAKE_CURRENT_BINARY_DIR}/vendor/luajit/src/gen/buildvm_arch.h" vm_arm64.dasc
+-            WORKING_DIRECTORY ${PROJECT_SOURCE_DIR}/vendor/luajit/src
+-        )
+-    else()
+-        add_custom_command(
+-            OUTPUT "${CMAKE_CURRENT_BINARY_DIR}/vendor/luajit/src/gen/buildvm_arch.h"
+-            COMMAND ${CMAKE_COMMAND} -E make_directory "${CMAKE_CURRENT_BINARY_DIR}/vendor/luajit/src/gen"
+-            COMMAND luajit-minilua ../dynasm/dynasm.lua -D P64 -D JIT -D FFI -D FPU -D HFABI -D VER= -o "${CMAKE_CURRENT_BINARY_DIR}/vendor/luajit/src/gen/buildvm_arch.h" vm_x64.dasc
+-            WORKING_DIRECTORY ${PROJECT_SOURCE_DIR}/vendor/luajit/src
+-        )
+-    endif()
+-else()
+-    if(CMAKE_SIZEOF_VOID_P EQUAL 8)
+-        add_custom_command(
+-            OUTPUT "${CMAKE_CURRENT_BINARY_DIR}/vendor/luajit/src/gen/buildvm_arch.h"
+-            COMMAND ${CMAKE_COMMAND} -E make_directory "${CMAKE_CURRENT_BINARY_DIR}/vendor/luajit/src/gen"
+-            COMMAND luajit-minilua ../dynasm/dynasm.lua -D P64 -D JIT -D FFI -D FPU -D HFABI -D VER= -o "${CMAKE_CURRENT_BINARY_DIR}/vendor/luajit/src/gen/buildvm_arch.h" vm_x86.dasc
+-            WORKING_DIRECTORY ${PROJECT_SOURCE_DIR}/vendor/luajit/src
+-        )
+-    else()
+-        add_custom_command(
+-            OUTPUT "${CMAKE_CURRENT_BINARY_DIR}/vendor/luajit/src/gen/buildvm_arch.h"
+-            COMMAND ${CMAKE_COMMAND} -E make_directory "${CMAKE_CURRENT_BINARY_DIR}/vendor/luajit/src/gen"
+-            COMMAND luajit-minilua ../dynasm/dynasm.lua -D JIT -D FFI -D FPU -D HFABI -D VER= -o "${CMAKE_CURRENT_BINARY_DIR}/vendor/luajit/src/gen/buildvm_arch.h" vm_x86.dasc
+-            WORKING_DIRECTORY ${PROJECT_SOURCE_DIR}/vendor/luajit/src
+-        )
+-    endif()
+-endif()
+-
+-add_executable(luajit-buildvm
+-    vendor/luajit/src/host/buildvm.c
+-    vendor/luajit/src/host/buildvm_asm.c
+-    vendor/luajit/src/host/buildvm_peobj.c
+-    vendor/luajit/src/host/buildvm_lib.c
+-    vendor/luajit/src/host/buildvm_fold.c
+-
+-    "${CMAKE_CURRENT_BINARY_DIR}/vendor/luajit/src/gen/buildvm_arch.h"
+-)
+-target_compile_definitions(luajit-buildvm PRIVATE LUAJIT_ENABLE_LUA52COMPAT)
+-target_include_directories(luajit-buildvm PRIVATE vendor/luajit/src "${CMAKE_CURRENT_BINARY_DIR}/vendor/luajit/src/gen")
+-
+-if(APPLE)
+-    add_custom_command(
+-        OUTPUT "${CMAKE_CURRENT_BINARY_DIR}/vendor/luajit/src/lj_vm.s"
+-        COMMAND luajit-buildvm -m machasm -o "${CMAKE_CURRENT_BINARY_DIR}/vendor/luajit/src/lj_vm.s"
+-    )
+-elseif(UNIX)
+-    add_custom_command(
+-        OUTPUT "${CMAKE_CURRENT_BINARY_DIR}/vendor/luajit/src/lj_vm.s"
+-        COMMAND luajit-buildvm -m elfasm -o "${CMAKE_CURRENT_BINARY_DIR}/vendor/luajit/src/lj_vm.s"
+-    )
+-elseif(MSVC)
+-    add_custom_command(
+-        OUTPUT "${CMAKE_CURRENT_BINARY_DIR}/vendor/luajit/src/lj_vm.obj"
+-        COMMAND luajit-buildvm -m peobj -o "${CMAKE_CURRENT_BINARY_DIR}/vendor/luajit/src/lj_vm.obj"
+-    )
+-endif()
+-add_custom_command(
+-    OUTPUT "${CMAKE_CURRENT_BINARY_DIR}/vendor/luajit/src/gen/lj_ffdef.h"
+-    COMMAND luajit-buildvm -m ffdef -o "${CMAKE_CURRENT_BINARY_DIR}/vendor/luajit/src/gen/lj_ffdef.h" lib_base.c lib_math.c lib_bit.c lib_string.c lib_table.c lib_io.c lib_os.c lib_package.c lib_debug.c lib_jit.c lib_ffi.c
+-    WORKING_DIRECTORY ${PROJECT_SOURCE_DIR}/vendor/luajit/src
+-)
+-add_custom_command(
+-    OUTPUT "${CMAKE_CURRENT_BINARY_DIR}/vendor/luajit/src/gen/lj_bcdef.h"
+-    COMMAND luajit-buildvm -m bcdef -o "${CMAKE_CURRENT_BINARY_DIR}/vendor/luajit/src/gen/lj_bcdef.h" lib_base.c lib_math.c lib_bit.c lib_string.c lib_table.c lib_io.c lib_os.c lib_package.c lib_debug.c lib_jit.c lib_ffi.c
+-    WORKING_DIRECTORY ${PROJECT_SOURCE_DIR}/vendor/luajit/src
+-)
+-add_custom_command(
+-    OUTPUT "${CMAKE_CURRENT_BINARY_DIR}/vendor/luajit/src/gen/lj_folddef.h"
+-    COMMAND luajit-buildvm -m folddef -o "${CMAKE_CURRENT_BINARY_DIR}/vendor/luajit/src/gen/lj_folddef.h" lj_opt_fold.c
+-    WORKING_DIRECTORY ${PROJECT_SOURCE_DIR}/vendor/luajit/src
+-)
+-add_custom_command(
+-    OUTPUT "${CMAKE_CURRENT_BINARY_DIR}/vendor/luajit/src/gen/lj_recdef.h"
+-    COMMAND luajit-buildvm -m recdef -o "${CMAKE_CURRENT_BINARY_DIR}/vendor/luajit/src/gen/lj_recdef.h" lib_base.c lib_math.c lib_bit.c lib_string.c lib_table.c lib_io.c lib_os.c lib_package.c lib_debug.c lib_jit.c lib_ffi.c
+-    WORKING_DIRECTORY ${PROJECT_SOURCE_DIR}/vendor/luajit/src
+-)
+-add_custom_command(
+-    OUTPUT "${CMAKE_CURRENT_BINARY_DIR}/vendor/luajit/src/gen/lj_libdef.h"
+-    COMMAND luajit-buildvm -m libdef -o "${CMAKE_CURRENT_BINARY_DIR}/vendor/luajit/src/gen/lj_libdef.h" lib_base.c lib_math.c lib_bit.c lib_string.c lib_table.c lib_io.c lib_os.c lib_package.c lib_debug.c lib_jit.c lib_ffi.c
+-    WORKING_DIRECTORY ${PROJECT_SOURCE_DIR}/vendor/luajit/src
+-)
+-add_custom_command(
+-    OUTPUT "${CMAKE_CURRENT_BINARY_DIR}/vendor/luajit/src/jit/vmdef.lua"
+-    COMMAND luajit-buildvm -m vmdef -o "${CMAKE_CURRENT_BINARY_DIR}/vendor/luajit/src/jit/vmdef.lua" lib_base.c lib_math.c lib_bit.c lib_string.c lib_table.c lib_io.c lib_os.c lib_package.c lib_debug.c lib_jit.c lib_ffi.c
+-    WORKING_DIRECTORY ${PROJECT_SOURCE_DIR}/vendor/luajit/src
+-)
+-
+-add_library(luajit STATIC
+-    vendor/luajit/src/lib_base.c
+-    vendor/luajit/src/lib_math.c
+-    vendor/luajit/src/lib_bit.c
+-    vendor/luajit/src/lib_string.c
+-    vendor/luajit/src/lib_table.c
+-    vendor/luajit/src/lib_io.c
+-    vendor/luajit/src/lib_os.c
+-    vendor/luajit/src/lib_package.c
+-    vendor/luajit/src/lib_debug.c
+-    vendor/luajit/src/lib_jit.c
+-    vendor/luajit/src/lib_ffi.c
+-    vendor/luajit/src/lj_gc.c
+-    vendor/luajit/src/lj_err.c
+-    vendor/luajit/src/lj_char.c
+-    vendor/luajit/src/lj_bc.c
+-    vendor/luajit/src/lj_obj.c
+-    vendor/luajit/src/lj_buf.c
+-    vendor/luajit/src/lj_str.c
+-    vendor/luajit/src/lj_tab.c
+-    vendor/luajit/src/lj_func.c
+-    vendor/luajit/src/lj_udata.c
+-    vendor/luajit/src/lj_meta.c
+-    vendor/luajit/src/lj_debug.c
+-    vendor/luajit/src/lj_state.c
+-    vendor/luajit/src/lj_dispatch.c
+-    vendor/luajit/src/lj_vmevent.c
+-    vendor/luajit/src/lj_vmmath.c
+-    vendor/luajit/src/lj_strscan.c
+-    vendor/luajit/src/lj_strfmt.c
+-    vendor/luajit/src/lj_strfmt_num.c
+-    vendor/luajit/src/lj_api.c
+-    vendor/luajit/src/lj_profile.c
+-    vendor/luajit/src/lj_lex.c
+-    vendor/luajit/src/lj_parse.c
+-    vendor/luajit/src/lj_bcread.c
+-    vendor/luajit/src/lj_bcwrite.c
+-    vendor/luajit/src/lj_load.c
+-    vendor/luajit/src/lj_ir.c
+-    vendor/luajit/src/lj_opt_mem.c
+-    vendor/luajit/src/lj_opt_fold.c
+-    vendor/luajit/src/lj_opt_narrow.c
+-    vendor/luajit/src/lj_opt_dce.c
+-    vendor/luajit/src/lj_opt_loop.c
+-    vendor/luajit/src/lj_opt_split.c
+-    vendor/luajit/src/lj_opt_sink.c
+-    vendor/luajit/src/lj_mcode.c
+-    vendor/luajit/src/lj_snap.c
+-    vendor/luajit/src/lj_record.c
+-    vendor/luajit/src/lj_crecord.c
+-    vendor/luajit/src/lj_ffrecord.c
+-    vendor/luajit/src/lj_asm.c
+-    vendor/luajit/src/lj_trace.c
+-    vendor/luajit/src/lj_gdbjit.c
+-    vendor/luajit/src/lj_ctype.c
+-    vendor/luajit/src/lj_cdata.c
+-    vendor/luajit/src/lj_cconv.c
+-    vendor/luajit/src/lj_ccall.c
+-    vendor/luajit/src/lj_ccallback.c
+-    vendor/luajit/src/lj_carith.c
+-    vendor/luajit/src/lj_clib.c
+-    vendor/luajit/src/lj_cparse.c
+-    vendor/luajit/src/lj_lib.c
+-    vendor/luajit/src/lj_alloc.c
+-    vendor/luajit/src/lib_aux.c
+-    vendor/luajit/src/lib_init.c
+-
+-    "${CMAKE_CURRENT_BINARY_DIR}/vendor/luajit/src/gen/lj_ffdef.h"
+-    "${CMAKE_CURRENT_BINARY_DIR}/vendor/luajit/src/gen/lj_bcdef.h"
+-    "${CMAKE_CURRENT_BINARY_DIR}/vendor/luajit/src/gen/lj_folddef.h"
+-    "${CMAKE_CURRENT_BINARY_DIR}/vendor/luajit/src/gen/lj_recdef.h"
+-    "${CMAKE_CURRENT_BINARY_DIR}/vendor/luajit/src/gen/lj_libdef.h"
+-    # "${CMAKE_CURRENT_BINARY_DIR}/vendor/luajit/src/jit/vmdef.lua"
+-)
+-target_compile_definitions(luajit PRIVATE LUAJIT_ENABLE_LUA52COMPAT)
+-target_include_directories(luajit PRIVATE "${CMAKE_CURRENT_BINARY_DIR}/vendor/luajit/src/gen" PUBLIC "vendor/luajit/src")
+-if(WIN32)
+-    target_sources(luajit PRIVATE "${CMAKE_CURRENT_BINARY_DIR}/vendor/luajit/src/lj_vm.obj")
+-else()
+-    enable_language(ASM)
+-    target_sources(luajit PRIVATE "${CMAKE_CURRENT_BINARY_DIR}/vendor/luajit/src/lj_vm.s")
+-    target_link_libraries(luajit ${CMAKE_DL_LIBS})
+-endif()
+-if(APPLE)
+-    if(NOT CMAKE_HOST_SYSTEM_PROCESSOR STREQUAL "arm64")
+-        target_compile_definitions(luajit-buildvm PRIVATE LUAJIT_ENABLE_GC64)
+-        target_compile_definitions(luajit PRIVATE LUAJIT_ENABLE_GC64)
+-    endif()
+-endif()
+-
+ add_subdirectory(vendor/luabins)
+ 
+ ## libaegisub
+@@ -310,18 +106,18 @@ if(APPLE)
+ else()
+     target_precompile_headers(libaegisub PRIVATE "libaegisub/lagi_pre.h")
+ endif()
+-target_link_libraries(libaegisub PRIVATE luajit luabins)
++target_link_libraries(libaegisub PRIVATE luajit-5.1 luabins)
+ 
+ add_custom_command(
+     OUTPUT "${CMAKE_CURRENT_BINARY_DIR}/src/libresrc/default_config.cpp" "${CMAKE_CURRENT_BINARY_DIR}/src/libresrc/default_config.h"
+     DEPENDS "${CMAKE_CURRENT_BINARY_DIR}/src/libresrc/default_config_platform.json"
+-    COMMAND luajit-minilua "${PROJECT_SOURCE_DIR}/tools/respack.lua" manifest.respack default_config.cpp default_config.h
++    COMMAND luajit "${PROJECT_SOURCE_DIR}/tools/respack.lua" manifest.respack default_config.cpp default_config.h
+     WORKING_DIRECTORY "${CMAKE_CURRENT_BINARY_DIR}/src/libresrc"
+ )
+ 
+ add_custom_command(
+     OUTPUT "${CMAKE_CURRENT_BINARY_DIR}/src/libresrc/bitmap.cpp" "${CMAKE_CURRENT_BINARY_DIR}/src/libresrc/bitmap.h"
+-    COMMAND luajit-minilua ../../tools/respack.lua manifest.respack "${CMAKE_CURRENT_BINARY_DIR}/src/libresrc/bitmap.cpp" "${CMAKE_CURRENT_BINARY_DIR}/src/libresrc/bitmap.h"
++    COMMAND luajit ../../tools/respack.lua manifest.respack "${CMAKE_CURRENT_BINARY_DIR}/src/libresrc/bitmap.cpp" "${CMAKE_CURRENT_BINARY_DIR}/src/libresrc/bitmap.h"
+     WORKING_DIRECTORY ${PROJECT_SOURCE_DIR}/src/bitmaps
+ )
+ 
+@@ -496,7 +292,7 @@ add_executable(Aegisub WIN32
+     src/video_slider.cpp
+     src/visual_feature.cpp
+ )
+-target_link_libraries(Aegisub PRIVATE ${CMAKE_DL_LIBS} libaegisub luajit)
++target_link_libraries(Aegisub PRIVATE ${CMAKE_DL_LIBS} libaegisub luajit-5.1)
+ target_compile_definitions(Aegisub PRIVATE CMAKE_BUILD)
+ target_include_directories(Aegisub PRIVATE "src/libresrc" "${CMAKE_CURRENT_BINARY_DIR}/src/libresrc")
+ if(APPLE)
+diff --git a/vendor/luabins/CMakeLists.txt b/vendor/luabins/CMakeLists.txt
+index 1fe1d2031..e2761527b 100644
+--- a/vendor/luabins/CMakeLists.txt
++++ b/vendor/luabins/CMakeLists.txt
+@@ -36,4 +36,4 @@ add_library(luabins STATIC
+     src/savebuffer.c
+     src/write.c
+ )
+-target_link_libraries(luabins PRIVATE luajit)
+\ No newline at end of file
++target_link_libraries(luabins PRIVATE luajit-5.1)
+\ No newline at end of file
diff --git a/pkgs/applications/video/obs-studio/plugins/obs-nvfbc.nix b/pkgs/applications/video/obs-studio/plugins/obs-nvfbc.nix
index 936f418191a..4d8ffb831a6 100644
--- a/pkgs/applications/video/obs-studio/plugins/obs-nvfbc.nix
+++ b/pkgs/applications/video/obs-studio/plugins/obs-nvfbc.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "obs-nvfbc";
-  version = "0.0.5";
+  version = "0.0.6";
 
   src = fetchFromGitLab {
     owner = "fzwoch";
     repo = "obs-nvfbc";
     rev = "v${version}";
-    sha256 = "sha256-Si+TGYWpNPtUUFT+M571lCYslPyeYX92MdYV9EGgcyQ=";
+    sha256 = "sha256-WoqtppgIcjE0n9atsvAZrXvBVi2rWCIIFDXTgblQK9I=";
   };
 
   nativeBuildInputs = [ meson pkg-config ninja ];
@@ -18,6 +18,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "OBS Studio source plugin for NVIDIA FBC API";
+    homepage = "https://gitlab.com/fzwoch/obs-nvfbc";
     license = licenses.gpl2Only;
     maintainers = with maintainers; [ babbaj ];
     platforms = [ "x86_64-linux" ];
diff --git a/pkgs/desktops/gnome/core/zenity/default.nix b/pkgs/desktops/gnome/core/zenity/default.nix
index 8429282ab36..cd6a9c59c74 100644
--- a/pkgs/desktops/gnome/core/zenity/default.nix
+++ b/pkgs/desktops/gnome/core/zenity/default.nix
@@ -15,11 +15,11 @@
 
 stdenv.mkDerivation rec {
   pname = "zenity";
-  version = "3.42.1";
+  version = "3.43.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/zenity/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "oI4MjmJmFe4sI/90Yo66b4tIaHXdVDccp+LXYFtyqHw=";
+    sha256 = "sNfKHgwYaPoY8FwhAmDYp74fCO4Tt/XP26ubYfoW+DM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/compilers/unison/default.nix b/pkgs/development/compilers/unison/default.nix
index 8baa5baeccc..a3df686e9d6 100644
--- a/pkgs/development/compilers/unison/default.nix
+++ b/pkgs/development/compilers/unison/default.nix
@@ -6,18 +6,18 @@
 
 stdenv.mkDerivation rec {
   pname = "unison-code-manager";
-  milestone_id = "M2l";
+  milestone_id = "M3";
   version = "1.0.${milestone_id}-alpha";
 
   src = if (stdenv.isDarwin) then
     fetchurl {
       url = "https://github.com/unisonweb/unison/releases/download/release/${milestone_id}/ucm-macos.tar.gz";
-      sha256 = "sha256-1jwDICm1tt//92S+ybHhRcNQjeCc5DaM6+RMInLWzFE=";
+      sha256 = "sha256-xshqqERBr60vz1qEnewlgNIvd24aE6/VtK5iBlanQHg=";
     }
   else
     fetchurl {
       url = "https://github.com/unisonweb/unison/releases/download/release/${milestone_id}/ucm-linux.tar.gz";
-      sha256 = "sha256-ECpg6iNxSVkt/VuspFYTdVyUO/+XxGwB1NmgfMOhb5A=";
+      sha256 = "sha256-rt8Y1ZEQVHH6gk4JV3lH38H10TDwdLDnbnqjG2vyyy4=";
     };
 
   # The tarball is just the prebuilt binary, in the archive root.
diff --git a/pkgs/development/embedded/fpga/openfpgaloader/default.nix b/pkgs/development/embedded/fpga/openfpgaloader/default.nix
index b44f78c03c4..5256cf5cf13 100644
--- a/pkgs/development/embedded/fpga/openfpgaloader/default.nix
+++ b/pkgs/development/embedded/fpga/openfpgaloader/default.nix
@@ -6,17 +6,19 @@
 , libftdi1
 , libusb1
 , udev
+, hidapi
+, zlib
 }:
 
 stdenv.mkDerivation rec {
   pname = "openfpgaloader";
-  version = "0.6.0";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "trabucayre";
     repo = "openFPGALoader";
     rev = "v${version}";
-    sha256 = "sha256-gPRBHy7WVra4IlGvzrhNqbEbOQtYtUC+zQ+SnJTMvRA=";
+    sha256 = "sha256-8AP4EJ+msOf1lstahyOyalI5dtS2ri7djN4zdN36Kfg=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
@@ -25,6 +27,8 @@ stdenv.mkDerivation rec {
     libftdi1
     libusb1
     udev
+    hidapi
+    zlib
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/gtk/4.x.nix b/pkgs/development/libraries/gtk/4.x.nix
index bb9c431de3c..fc3e39b0226 100644
--- a/pkgs/development/libraries/gtk/4.x.nix
+++ b/pkgs/development/libraries/gtk/4.x.nix
@@ -62,7 +62,7 @@ in
 
 stdenv.mkDerivation rec {
   pname = "gtk4";
-  version = "4.6.5";
+  version = "4.6.6";
 
   outputs = [ "out" "dev" ] ++ lib.optionals x11Support [ "devdoc" ];
   outputBin = "dev";
@@ -74,7 +74,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/gtk/${lib.versions.majorMinor version}/gtk-${version}.tar.xz";
-    sha256 = "+kLDcfSckJFnEeFVkdh9S+5EOMJ78GknFVgYB2KL6cI=";
+    sha256 = "e7/k0TVp98KX7UmDSscmPjGLe/EC0ycctGbVlx9ZrnA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/ocaml-modules/duff/default.nix b/pkgs/development/ocaml-modules/duff/default.nix
index a57f8564d9e..27fb981de4d 100644
--- a/pkgs/development/ocaml-modules/duff/default.nix
+++ b/pkgs/development/ocaml-modules/duff/default.nix
@@ -1,22 +1,20 @@
-{ lib, fetchurl, buildDunePackage, fetchpatch
-, stdlib-shims, bigarray-compat, fmt
+{ lib, fetchurl, buildDunePackage, ocaml
+, fmt
 , alcotest, hxd, crowbar, bigstringaf
 }:
 
 buildDunePackage rec {
   pname = "duff";
-  version = "0.4";
-
-  useDune2 = true;
+  version = "0.5";
 
   src = fetchurl {
-    url = "https://github.com/mirage/duff/releases/download/v${version}/duff-v${version}.tbz";
-    sha256 = "4795e8344a2c2562e0ef6c44ab742334b5cd807637354715889741b20a461da4";
+    url = "https://github.com/mirage/duff/releases/download/v${version}/duff-${version}.tbz";
+    sha256 = "sha256-0eqpfPWNOHYjkcjXRnZUTUFF0/L9E+TNoOqKCETN5hI=";
   };
 
-  propagatedBuildInputs = [ stdlib-shims bigarray-compat fmt ];
+  propagatedBuildInputs = [ fmt ];
 
-  doCheck = true;
+  doCheck = lib.versionAtLeast ocaml.version "4.08";
   checkInputs = [
     alcotest
     crowbar
diff --git a/pkgs/development/ocaml-modules/fmt/default.nix b/pkgs/development/ocaml-modules/fmt/default.nix
index bd562981652..401d08ddf6a 100644
--- a/pkgs/development/ocaml-modules/fmt/default.nix
+++ b/pkgs/development/ocaml-modules/fmt/default.nix
@@ -5,12 +5,12 @@ then throw "fmt is not available for OCaml ${ocaml.version}"
 else
 
 stdenv.mkDerivation rec {
-  version = "0.8.9";
+  version = "0.9.0";
   pname = "ocaml${ocaml.version}-fmt";
 
   src = fetchurl {
     url = "https://erratique.ch/software/fmt/releases/fmt-${version}.tbz";
-    sha256 = "0gkkkj4x678vxdda4xaw2dd44qjacavsvn5nx8gydfwah6pjbkxk";
+    sha256 = "sha256-8fsggFoi3XWhN9cnBKNw53ic9r32OUjmgX0cImwUEmE=";
   };
 
   nativeBuildInputs = [ ocaml findlib ocamlbuild topkg ];
diff --git a/pkgs/development/ocaml-modules/mirage-channel/default.nix b/pkgs/development/ocaml-modules/mirage-channel/default.nix
index 227e821e192..bdafeb43054 100644
--- a/pkgs/development/ocaml-modules/mirage-channel/default.nix
+++ b/pkgs/development/ocaml-modules/mirage-channel/default.nix
@@ -5,20 +5,15 @@
 
 buildDunePackage rec {
   pname = "mirage-channel";
-  version = "4.0.1";
+  version = "4.1.0";
 
-  useDune2 = true;
+  minimalOCamlVersion = "4.07";
 
   src = fetchurl {
-    url = "https://github.com/mirage/mirage-channel/releases/download/v${version}/mirage-channel-v${version}.tbz";
-    sha256 = "0wmb2zhiyp8n78xgcspcsyd19bhcml3kyli2caw3778wc1gyvfpc";
+    url = "https://github.com/mirage/mirage-channel/releases/download/v${version}/mirage-channel-${version}.tbz";
+    sha256 = "sha256-sBdoUdTd9ZeNcHK0IBGBeOYDDqULM7EYX+Pz2f2nIQA=";
   };
 
-  # Make tests compatible with alcotest 1.4.0
-  postPatch = ''
-    substituteInPlace test/test_channel.ml --replace 'Fmt.kstrf Alcotest.fail' 'Fmt.kstrf (fun s -> Alcotest.fail s)'
-  '';
-
   propagatedBuildInputs = [ cstruct logs lwt mirage-flow ];
 
   doCheck = true;
diff --git a/pkgs/development/ocaml-modules/mirage-console/default.nix b/pkgs/development/ocaml-modules/mirage-console/default.nix
index 986084c3f54..2fcd58973bc 100644
--- a/pkgs/development/ocaml-modules/mirage-console/default.nix
+++ b/pkgs/development/ocaml-modules/mirage-console/default.nix
@@ -1,21 +1,19 @@
 { lib, fetchurl, buildDunePackage
-, lwt, mirage-device, mirage-flow
+, lwt, mirage-flow
 }:
 
 buildDunePackage rec {
   pname = "mirage-console";
-  version = "4.0.0";
+  version = "5.1.0";
 
-  minimumOCamlVersion = "4.08";
-
-  useDune2 = true;
+  minimalOCamlVersion = "4.08";
 
   src = fetchurl {
-    url = "https://github.com/mirage/mirage-console/releases/download/v${version}/mirage-console-v${version}.tbz";
-    sha256 = "11nwfd4kmmdzkrkhbakdi3cxhk8vi98l17960rgcf85c602gw6vp";
+    url = "https://github.com/mirage/mirage-console/releases/download/v${version}/mirage-console-${version}.tbz";
+    sha256 = "sha256-mjYRisbNOJbYoSuWaGoPueXakmqAwmWh0ATvLLsvpNM=";
   };
 
-  propagatedBuildInputs = [ lwt mirage-device mirage-flow ];
+  propagatedBuildInputs = [ lwt mirage-flow ];
 
   meta = {
     description = "Implementations of Mirage console devices";
diff --git a/pkgs/development/ocaml-modules/mirage-console/unix.nix b/pkgs/development/ocaml-modules/mirage-console/unix.nix
index dea613511a2..634bcc353ad 100644
--- a/pkgs/development/ocaml-modules/mirage-console/unix.nix
+++ b/pkgs/development/ocaml-modules/mirage-console/unix.nix
@@ -3,7 +3,7 @@
 buildDunePackage {
   pname = "mirage-console-unix";
 
-  inherit (mirage-console) version src useDune2 minimumOCamlVersion;
+  inherit (mirage-console) version src;
 
   propagatedBuildInputs = [
     mirage-console
diff --git a/pkgs/development/ocaml-modules/optint/default.nix b/pkgs/development/ocaml-modules/optint/default.nix
index 2227f6e033c..06729bb8799 100644
--- a/pkgs/development/ocaml-modules/optint/default.nix
+++ b/pkgs/development/ocaml-modules/optint/default.nix
@@ -1,16 +1,14 @@
 { lib, buildDunePackage, fetchurl }:
 
 buildDunePackage rec {
-  minimumOCamlVersion = "4.07";
-  version = "0.1.0";
+  minimalOCamlVersion = "4.07";
+  version = "0.2.0";
   pname = "optint";
   src = fetchurl {
-    url = "https://github.com/mirage/optint/releases/download/v${version}/optint-v${version}.tbz";
-    sha256 = "27847660223c16cc7eaf8fcd9d5589a0b802114330a2529578f8007d3b01185d";
+    url = "https://github.com/mirage/optint/releases/download/v${version}/optint-${version}.tbz";
+    sha256 = "sha256-HcvgtrYDH3fbMwKMhxOP2zv5D5KRXjtmKd3rMKDTAAs=";
   };
 
-  useDune2 = true;
-
   meta = {
     homepage = "https://github.com/mirage/optint";
     description = "Abstract type of integer between x64 and x86 architecture";
diff --git a/pkgs/development/tools/build-managers/mill/default.nix b/pkgs/development/tools/build-managers/mill/default.nix
index 9e3f9fc3e53..496ca7a5606 100644
--- a/pkgs/development/tools/build-managers/mill/default.nix
+++ b/pkgs/development/tools/build-managers/mill/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "mill";
-  version = "0.10.4";
+  version = "0.10.5";
 
   src = fetchurl {
     url = "https://github.com/com-lihaoyi/mill/releases/download/${version}/${version}-assembly";
-    hash = "sha256-psSbz5ZcgLDkS/9Q/PLe4Ufj7GOR8Sv1rLhA2Hs3zsw=";
+    hash = "sha256-oz61tJYNwGQEImeg2fMIKHIKVA2Ic6nF5VG5eQt3cAY=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/development/tools/kotlin-language-server/default.nix b/pkgs/development/tools/kotlin-language-server/default.nix
index 802763fc67a..6f3ea5cb46b 100644
--- a/pkgs/development/tools/kotlin-language-server/default.nix
+++ b/pkgs/development/tools/kotlin-language-server/default.nix
@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   pname = "kotlin-language-server";
-  version = "1.3.0";
+  version = "1.3.1";
   src = fetchzip {
     url = "https://github.com/fwcd/kotlin-language-server/releases/download/${version}/server.zip";
-    hash = "sha256-nqrZoSntomNLUMTni/yoiVhDOJFSFmZeGze8IJhITu0=";
+    hash = "sha256-FxpNA4OGSgFdILl0yKBDTtVdQl6Bw9tm2eURbsJdZzI=";
   };
 
   dontBuild = true;
diff --git a/pkgs/development/tools/ktlint/default.nix b/pkgs/development/tools/ktlint/default.nix
index 0f75662d707..d2ac8f5cd73 100644
--- a/pkgs/development/tools/ktlint/default.nix
+++ b/pkgs/development/tools/ktlint/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ktlint";
-  version = "0.45.2";
+  version = "0.46.1";
 
   src = fetchurl {
     url = "https://github.com/pinterest/ktlint/releases/download/${version}/ktlint";
-    sha256 = "sha256-iUkeqGXTabOc+sotz2Czitvc10mF9eAXDAu3MDQAATU=";
+    sha256 = "sha256-RcXhEESQsvKjQtO33dlImOp24mfJmRAL5AeR/3JCdq0=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/os-specific/linux/pam_tmpdir/default.nix b/pkgs/os-specific/linux/pam_tmpdir/default.nix
new file mode 100644
index 00000000000..859ebedc334
--- /dev/null
+++ b/pkgs/os-specific/linux/pam_tmpdir/default.nix
@@ -0,0 +1,36 @@
+{ lib, stdenv, fetchurl, autoreconfHook, pam }:
+
+stdenv.mkDerivation rec {
+  pname = "pam_tmpdir";
+  version = "0.09";
+
+  src = fetchurl {
+    url = "http://deb.debian.org/debian/pool/main/p/pam-tmpdir/pam-tmpdir_${version}.tar.gz";
+    hash = "sha256-MXa1CY6alD83E/Q+MJmsv8NaImWd0pPJKZd/7nbe4J8=";
+  };
+
+  postPatch = ''
+    substituteInPlace pam_tmpdir.c \
+      --replace /sbin/pam-tmpdir-helper $out/sbin/pam-tmpdir-helper
+
+    # chmod/chown fails on files in /nix/store
+    sed -i -E -e '/^\s*(chmod|chown)/d' Makefile.{am,in}
+
+    # the symlinks in m4 assume FHS
+    rm -rf m4
+  '';
+
+  nativeBuildInputs = [ autoreconfHook ];
+
+  buildInputs = [ pam ];
+
+  enableParallelBuilding = true;
+
+  meta = with lib; {
+    homepage = "https://tracker.debian.org/pkg/pam-tmpdir";
+    description = "PAM module for creating safe per-user temporary directories";
+    license = licenses.gpl2Only;
+    maintainers = with maintainers; [ peterhoeg ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/servers/matrix-conduit/default.nix b/pkgs/servers/matrix-conduit/default.nix
index ab5276a758e..4eced54bc72 100644
--- a/pkgs/servers/matrix-conduit/default.nix
+++ b/pkgs/servers/matrix-conduit/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "matrix-conduit";
-  version = "0.3.0";
+  version = "0.4.0";
 
   src = fetchFromGitLab {
     owner = "famedly";
     repo = "conduit";
     rev = "v${version}";
-    sha256 = "sha256-jCBvenwXPgYms5Tbu16q/F8UNpvaw0Shao9kLEZLbHM=";
+    sha256 = "sha256-QTXDIvGz12ZxsWmPiMiJ8mBUWoJ2wnaeTZdXcwBh35o=";
   };
 
-  cargoSha256 = "sha256-fpjzc2HiWP6nV8YZOwxsIOhy4ht/tQqcvCkcLMIFUaQ=";
+  cargoSha256 = "sha256-vE44I8lQ5VAfZB4WKLRv/xudoZJaFJGTT/UuumTePBU=";
 
   nativeBuildInputs = with pkgs; [
     rustPlatform.bindgenHook
diff --git a/pkgs/tools/misc/page/default.nix b/pkgs/tools/misc/page/default.nix
index 9d1d6d5abe6..386dcb05e0c 100644
--- a/pkgs/tools/misc/page/default.nix
+++ b/pkgs/tools/misc/page/default.nix
@@ -2,25 +2,24 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "page";
-  version = "2.3.5";
+  version = "3.0.0";
 
   src = fetchFromGitHub {
     owner = "I60R";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1pk3iclmwbkg4nvsgarq4qjpzapjhsl7b7z6zw6havp1zmx9h806";
+    sha256 = "sha256-CCjF0KwXd0XSga6/wlWpUPU+Xr0hjWIVVXIP0M8Hh5g=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
   postInstall = ''
     completions_dir=$(find "target" -name "shell_completions" -type d -printf "%T+\t%p\n" | sort | awk 'NR==1{print $2}')
-
     installShellCompletion --bash $completions_dir/page.bash
     installShellCompletion --fish $completions_dir/page.fish
     installShellCompletion --zsh $completions_dir/_page
   '';
 
-  cargoSha256 = "19ff5h8z34z15wdnd3mj8bwlqcixwbimys77gfjmzb3w1g9ivlks";
+  cargoSha256 = "sha256-MFNc4U6DAb5UscqxKz7RORoPeqne2pdkL/+mLLL+pKM=";
 
   meta = with lib; {
     description = "Use neovim as pager";
diff --git a/pkgs/tools/networking/mu/default.nix b/pkgs/tools/networking/mu/default.nix
index 1a1a8d3c673..3e68b54b9b5 100644
--- a/pkgs/tools/networking/mu/default.nix
+++ b/pkgs/tools/networking/mu/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mu";
-  version = "1.8.2";
+  version = "1.8.3";
 
   src = fetchFromGitHub {
     owner = "djcb";
     repo = "mu";
     rev = "v${version}";
-    sha256 = "wpyolNXm5JloKMJarYzSbs2yMcrkl73vOw6951Ol8Rs=";
+    sha256 = "gEqhk600pYHOcYhwr8LGvXHH8KcinX5MbMqYGyYOsnY=";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/networking/openconnect/default.nix b/pkgs/tools/networking/openconnect/default.nix
index b561d8cf43d..e0e0b6078f7 100644
--- a/pkgs/tools/networking/openconnect/default.nix
+++ b/pkgs/tools/networking/openconnect/default.nix
@@ -5,10 +5,10 @@ let
   };
 in rec {
   openconnect = common rec {
-    version = "8.20";
+    version = "9.01";
     src = fetchurl {
       url = "ftp://ftp.infradead.org/pub/openconnect/openconnect-${version}.tar.gz";
-      sha256 = "sha256-wUUjhMb3lrruRdTpGa4b/CgdbIiGLh9kaizFE/xE5Ys=";
+      sha256 = "sha256-s9f6+DDpeTKZ1qQegdhM1KPieJwUjJ5ZjkWFAQCQ5Mc=";
     };
   };
 
diff --git a/pkgs/tools/security/eid-mw/default.nix b/pkgs/tools/security/eid-mw/default.nix
index e05f96ef4be..d73a93d851b 100644
--- a/pkgs/tools/security/eid-mw/default.nix
+++ b/pkgs/tools/security/eid-mw/default.nix
@@ -21,13 +21,13 @@
 stdenv.mkDerivation rec {
   pname = "eid-mw";
   # NOTE: Don't just blindly update to the latest version/tag. Releases are always for a specific OS.
-  version = "5.0.28";
+  version = "5.1.4";
 
   src = fetchFromGitHub {
     owner = "Fedict";
     repo = "eid-mw";
     rev = "v${version}";
-    sha256 = "rrrzw8i271ZZkwY3L6aRw2Nlz+GmDr/1ahYYlUBvtzo=";
+    sha256 = "pHzjLyQFn7UvFrPUcI/ZQHMOwVp6ndnX9YegJzlhERM=";
   };
 
   nativeBuildInputs = [ autoreconfHook autoconf-archive pkg-config makeWrapper ];
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 3f7b9b3f30c..e6f9d11e332 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1045,7 +1045,8 @@ with pkgs;
   aefs = callPackage ../tools/filesystems/aefs { };
 
   aegisub = callPackage ../applications/video/aegisub ({
-    wxGTK = wxGTK30;
+    wxGTK = wxGTK31;
+    inherit (darwin.apple_sdk.frameworks) CoreText CoreFoundation AppKit Carbon IOKit Cocoa;
   } // (config.aegisub or {}));
 
   aerc = callPackage ../applications/networking/mailreaders/aerc { };
@@ -23965,6 +23966,8 @@ with pkgs;
 
   pam_ssh_agent_auth = callPackage ../os-specific/linux/pam_ssh_agent_auth { };
 
+  pam_tmpdir = callPackage ../os-specific/linux/pam_tmpdir { };
+
   pam_u2f = callPackage ../os-specific/linux/pam_u2f { };
 
   pam_usb = callPackage ../os-specific/linux/pam_usb { };
@@ -26867,6 +26870,8 @@ with pkgs;
 
   feh = callPackage ../applications/graphics/feh { };
 
+  feishu = callPackage ../applications/networking/instant-messengers/feishu {};
+
   filezilla = callPackage ../applications/networking/ftp/filezilla { };
 
   buildMozillaMach = opts: callPackage (import ../applications/networking/browsers/firefox/common.nix opts) {};
@@ -27139,6 +27144,8 @@ with pkgs;
 
   jmusicbot = callPackage ../applications/audio/jmusicbot { };
 
+  junction = callPackage ../applications/misc/junction { };
+
   lemonade = callPackage ../applications/misc/lemonade { };
 
   libquvi = callPackage ../applications/video/quvi/library.nix { };