diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 05bb679373471..2d1903458b403 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -3533,6 +3533,12 @@
       fingerprint = "5B08 313C 6853 E5BF FA91  A817 0176 0B4F 9F53 F154";
     }];
   };
+  davisrichard437 = {
+    email = "davisrichard437@gmail.com";
+    github = "davisrichard437";
+    githubId = 85075437;
+    name = "Richard Davis";
+  };
   davorb = {
     email = "davor@davor.se";
     github = "davorb";
@@ -8415,6 +8421,12 @@
     githubId = 2422454;
     name = "Kai Wohlfahrt";
   };
+  kylehendricks = {
+    name = "Kyle Hendricks";
+    email = "kyle-github@mail.hendricks.nu";
+    github = "kylehendricks";
+    githubId = 981958;
+  };
   kyleondy = {
     email = "kyle@ondy.org";
     github = "KyleOndy";
diff --git a/nixos/modules/installer/tools/nixos-generate-config.pl b/nixos/modules/installer/tools/nixos-generate-config.pl
index 946e73dac5864..74972c0994bed 100644
--- a/nixos/modules/installer/tools/nixos-generate-config.pl
+++ b/nixos/modules/installer/tools/nixos-generate-config.pl
@@ -473,7 +473,7 @@ sub in {
     }
 
     # Don't emit tmpfs entry for /tmp, because it most likely comes from the
-    # boot.tmpOnTmpfs option in configuration.nix (managed declaratively).
+    # boot.tmp.useTmpfs option in configuration.nix (managed declaratively).
     next if ($mountPoint eq "/tmp" && $fsType eq "tmpfs");
 
     # Emit the filesystem.
diff --git a/nixos/modules/services/cluster/kubernetes/kubelet.nix b/nixos/modules/services/cluster/kubernetes/kubelet.nix
index 8e935d621be4e..eebacb3f3ef39 100644
--- a/nixos/modules/services/cluster/kubernetes/kubelet.nix
+++ b/nixos/modules/services/cluster/kubernetes/kubelet.nix
@@ -63,6 +63,7 @@ in
     (mkRemovedOptionModule [ "services" "kubernetes" "kubelet" "cadvisorPort" ] "")
     (mkRemovedOptionModule [ "services" "kubernetes" "kubelet" "allowPrivileged" ] "")
     (mkRemovedOptionModule [ "services" "kubernetes" "kubelet" "networkPlugin" ] "")
+    (mkRemovedOptionModule [ "services" "kubernetes" "kubelet" "containerRuntime" ] "")
   ];
 
   ###### interface
@@ -134,12 +135,6 @@ in
       };
     };
 
-    containerRuntime = mkOption {
-      description = lib.mdDoc "Which container runtime type to use";
-      type = enum ["docker" "remote"];
-      default = "remote";
-    };
-
     containerRuntimeEndpoint = mkOption {
       description = lib.mdDoc "Endpoint at which to find the container runtime api interface/socket";
       type = str;
@@ -331,7 +326,6 @@ in
             ${optionalString (cfg.tlsKeyFile != null)
               "--tls-private-key-file=${cfg.tlsKeyFile}"} \
             ${optionalString (cfg.verbosity != null) "--v=${toString cfg.verbosity}"} \
-            --container-runtime=${cfg.containerRuntime} \
             --container-runtime-endpoint=${cfg.containerRuntimeEndpoint} \
             --cgroup-driver=systemd \
             ${cfg.extraOpts}
diff --git a/nixos/modules/services/networking/go-neb.nix b/nixos/modules/services/networking/go-neb.nix
index 8c04542c47cc1..b65bb5f548ee8 100644
--- a/nixos/modules/services/networking/go-neb.nix
+++ b/nixos/modules/services/networking/go-neb.nix
@@ -60,13 +60,12 @@ in {
 
       serviceConfig = {
         ExecStartPre = lib.optional (cfg.secretFile != null)
-          (pkgs.writeShellScript "pre-start" ''
+          ("+" + pkgs.writeShellScript "pre-start" ''
             umask 077
             export $(xargs < ${cfg.secretFile})
             ${pkgs.envsubst}/bin/envsubst -i "${configFile}" > ${finalConfigFile}
             chown go-neb ${finalConfigFile}
           '');
-        PermissionsStartOnly = true;
         RuntimeDirectory = "go-neb";
         ExecStart = "${pkgs.go-neb}/bin/go-neb";
         User = "go-neb";
diff --git a/nixos/modules/services/web-apps/mastodon.nix b/nixos/modules/services/web-apps/mastodon.nix
index 3e1286dc475d3..cf5329be489c1 100644
--- a/nixos/modules/services/web-apps/mastodon.nix
+++ b/nixos/modules/services/web-apps/mastodon.nix
@@ -587,6 +587,13 @@ in {
             <option>services.mastodon.smtp.authenticate</option> is enabled.
         '';
       }
+      {
+        assertion = 1 == builtins.length
+          (lib.mapAttrsToList
+            (_: v: builtins.elem "scheduler" v.jobClasses || v.jobClasses == [ ])
+            cfg.sidekiqProcesses);
+        message = "There must be one and only one Sidekiq queue in services.mastodon.sidekiqProcesses with jobClass \"scheduler\".";
+      }
     ];
 
     environment.systemPackages = [ mastodonTootctl ];
diff --git a/nixos/modules/system/boot/tmp.nix b/nixos/modules/system/boot/tmp.nix
index 1f9431710aec4..fd16cd3fba429 100644
--- a/nixos/modules/system/boot/tmp.nix
+++ b/nixos/modules/system/boot/tmp.nix
@@ -3,62 +3,67 @@
 with lib;
 
 let
-  cfg = config.boot;
+  cfg = config.boot.tmp;
 in
 {
-
-  ###### interface
+  imports = [
+    (mkRenamedOptionModule [ "boot" "cleanTmpDir" ] [ "boot" "tmp" "cleanOnBoot" ])
+    (mkRenamedOptionModule [ "boot" "tmpOnTmpfs" ] [ "boot" "tmp" "useTmpfs" ])
+    (mkRenamedOptionModule [ "boot" "tmpOnTmpfsSize" ] [ "boot" "tmp" "tmpfsSize" ])
+  ];
 
   options = {
+    boot.tmp = {
+      cleanOnBoot = mkOption {
+        type = types.bool;
+        default = false;
+        description = lib.mdDoc ''
+          Whether to delete all files in {file}`/tmp` during boot.
+        '';
+      };
 
-    boot.cleanTmpDir = mkOption {
-      type = types.bool;
-      default = false;
-      description = lib.mdDoc ''
-        Whether to delete all files in {file}`/tmp` during boot.
-      '';
-    };
+      tmpfsSize = mkOption {
+        type = types.oneOf [ types.str types.types.ints.positive ];
+        default = "50%";
+        description = lib.mdDoc ''
+          Size of tmpfs in percentage.
+          Percentage is defined by systemd.
+        '';
+      };
 
-    boot.tmpOnTmpfs = mkOption {
-      type = types.bool;
-      default = false;
-      description = lib.mdDoc ''
-         Whether to mount a tmpfs on {file}`/tmp` during boot.
-      '';
-    };
+      useTmpfs = mkOption {
+        type = types.bool;
+        default = false;
+        description = lib.mdDoc ''
+           Whether to mount a tmpfs on {file}`/tmp` during boot.
 
-    boot.tmpOnTmpfsSize = mkOption {
-      type = types.oneOf [ types.str types.types.ints.positive ];
-      default = "50%";
-      description = lib.mdDoc ''
-        Size of tmpfs in percentage.
-        Percentage is defined by systemd.
-      '';
+           ::: {.note}
+           Large Nix builds can fail if the mounted tmpfs is not large enough.
+           In such a case either increase the tmpfsSize or disable this option.
+           :::
+        '';
+      };
     };
-
   };
 
-  ###### implementation
-
   config = {
-
     # When changing remember to update /tmp mount in virtualisation/qemu-vm.nix
-    systemd.mounts = mkIf cfg.tmpOnTmpfs [
+    systemd.mounts = mkIf cfg.useTmpfs [
       {
         what = "tmpfs";
         where = "/tmp";
         type = "tmpfs";
-        mountConfig.Options = concatStringsSep "," [ "mode=1777"
-                                                     "strictatime"
-                                                     "rw"
-                                                     "nosuid"
-                                                     "nodev"
-                                                     "size=${toString cfg.tmpOnTmpfsSize}" ];
+        mountConfig.Options = concatStringsSep "," [
+          "mode=1777"
+          "strictatime"
+          "rw"
+          "nosuid"
+          "nodev"
+          "size=${toString cfg.tmpfsSize}"
+        ];
       }
     ];
 
-    systemd.tmpfiles.rules = optional config.boot.cleanTmpDir "D! /tmp 1777 root root";
-
+    systemd.tmpfiles.rules = optional cfg.cleanOnBoot "D! /tmp 1777 root root";
   };
-
 }
diff --git a/nixos/modules/virtualisation/qemu-vm.nix b/nixos/modules/virtualisation/qemu-vm.nix
index a55a21a46a538..89772019284cb 100644
--- a/nixos/modules/virtualisation/qemu-vm.nix
+++ b/nixos/modules/virtualisation/qemu-vm.nix
@@ -1069,12 +1069,12 @@ in
           fsType = "ext4";
           autoFormat = true;
         });
-        "/tmp" = lib.mkIf config.boot.tmpOnTmpfs {
+        "/tmp" = lib.mkIf config.boot.tmp.useTmpfs {
           device = "tmpfs";
           fsType = "tmpfs";
           neededForBoot = true;
           # Sync with systemd's tmp.mount;
-          options = [ "mode=1777" "strictatime" "nosuid" "nodev" "size=${toString config.boot.tmpOnTmpfsSize}" ];
+          options = [ "mode=1777" "strictatime" "nosuid" "nodev" "size=${toString config.boot.tmp.tmpfsSize}" ];
         };
         "/nix/${if cfg.writableStore then ".ro-store" else "store"}" = lib.mkIf cfg.useNixStoreImage {
           device = "${lookupDriveDeviceName "nix-store" cfg.qemu.drives}";
diff --git a/nixos/tests/ihatemoney/default.nix b/nixos/tests/ihatemoney/default.nix
index 894a97d43d35e..d172bf79b8c60 100644
--- a/nixos/tests/ihatemoney/default.nix
+++ b/nixos/tests/ihatemoney/default.nix
@@ -17,7 +17,7 @@ let
           http = ":8000";
         };
       };
-      boot.cleanTmpDir = true;
+      boot.tmp.cleanOnBoot = true;
       # for exchange rates
       security.pki.certificateFiles = [ ./server.crt ];
       networking.extraHosts = "127.0.0.1 api.exchangerate.host";
diff --git a/pkgs/applications/editors/emacs/elisp-packages/manual-packages.nix b/pkgs/applications/editors/emacs/elisp-packages/manual-packages.nix
index b58465e20ec33..4a718dd96d853 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages.nix
@@ -25,8 +25,6 @@ in
 
   emacspeak = callPackage ./manual-packages/emacspeak { };
 
-  ement = callPackage ./manual-packages/ement { };
-
   ess-R-object-popup = callPackage ./manual-packages/ess-R-object-popup { };
 
   evil-markdown = callPackage ./manual-packages/evil-markdown { };
diff --git a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/ement/default.nix b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/ement/default.nix
deleted file mode 100644
index c43d0d7765443..0000000000000
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/ement/default.nix
+++ /dev/null
@@ -1,43 +0,0 @@
-{ trivialBuild
-, lib
-, fetchFromGitHub
-, plz
-, cl-lib
-, ts
-, magit-section
-, taxy-magit-section
-, taxy
-, svg-lib
-}:
-
-trivialBuild {
-  pname = "ement";
-  version = "unstable-2022-09-01";
-
-  src = fetchFromGitHub {
-    owner = "alphapapa";
-    repo = "ement.el";
-    rev = "4ec2107e6a90ed962ddd3875d47caa523eb466b9";
-    sha256 = "sha256-zKkBpaOj3qb/Oy89rt7BxmWZDZzDzMIJjjOm+1rrnnc=";
-  };
-
-  packageRequires = [
-    plz
-    cl-lib
-    ts
-    magit-section
-    taxy-magit-section
-    taxy
-    svg-lib
-  ];
-
-  patches = [
-    ./handle-nil-images.patch
-  ];
-
-  meta = {
-    description = "Ement.el is a Matrix client for Emacs";
-    license = lib.licenses.gpl3Only;
-    platforms = lib.platforms.all;
-  };
-}
diff --git a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/ement/handle-nil-images.patch b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/ement/handle-nil-images.patch
deleted file mode 100644
index 271e1cd2dbac7..0000000000000
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/ement/handle-nil-images.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-diff --git a/ement-lib.el b/ement-lib.el
-index f0b2738..025a191 100644
---- a/ement-lib.el
-+++ b/ement-lib.el
-@@ -644,14 +644,15 @@ can cause undesirable underlining."
-   "Return a copy of IMAGE set to MAX-WIDTH and MAX-HEIGHT.
- IMAGE should be one as created by, e.g. `create-image'."
-   ;; It would be nice if the image library had some simple functions to do this sort of thing.
--  (let ((new-image (cl-copy-list image)))
--    (when (fboundp 'imagemagick-types)
--      ;; Only do this when ImageMagick is supported.
--      ;; FIXME: When requiring Emacs 27+, remove this (I guess?).
--      (setf (image-property new-image :type) 'imagemagick))
--    (setf (image-property new-image :max-width) max-width
--          (image-property new-image :max-height) max-height)
--    new-image))
-+  (when image
-+    (let ((new-image (cl-copy-list image)))
-+      (when (fboundp 'imagemagick-types)
-+        ;; Only do this when ImageMagick is supported.
-+        ;; FIXME: When requiring Emacs 27+, remove this (I guess?).
-+        (setf (image-property new-image :type) 'imagemagick))
-+      (setf (image-property new-image :max-width) max-width
-+            (image-property new-image :max-height) max-height)
-+      new-image)))
- 
- (defun ement--room-alias (room)
-   "Return latest m.room.canonical_alias event in ROOM."
diff --git a/pkgs/applications/graphics/gnome-decoder/default.nix b/pkgs/applications/graphics/gnome-decoder/default.nix
index 47cd856c79ba3..f957a8c291e89 100644
--- a/pkgs/applications/graphics/gnome-decoder/default.nix
+++ b/pkgs/applications/graphics/gnome-decoder/default.nix
@@ -11,6 +11,7 @@
 , libadwaita
 , zbar
 , sqlite
+, openssl
 , pipewire
 , gstreamer
 , gst-plugins-base
@@ -22,20 +23,20 @@
 
 clangStdenv.mkDerivation rec {
   pname = "gnome-decoder";
-  version = "0.3.1";
+  version = "0.3.3";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "World";
     repo = "decoder";
     rev = version;
-    hash = "sha256-WJIOaYSesvLmOzF1Q6o6aLr4KJanXVaNa+r+2LlpKHQ=";
+    hash = "sha256-eMyPN3UxptqavY9tEATW2AP+kpoWaLwUKCwhNQrarVc=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-RMHVrv/0q42qFUXyd5BSymzx+BxiyqTX0Jzmxnlhyr4=";
+    hash = "sha256-3j1hoFffQzWBy4IKtmoMkLBJmNbntpyn0sjv1K0MmDo=";
   };
 
   nativeBuildInputs = [
@@ -57,6 +58,7 @@ clangStdenv.mkDerivation rec {
     libadwaita
     zbar
     sqlite
+    openssl
     pipewire
     gstreamer
     gst-plugins-base
@@ -65,12 +67,6 @@ clangStdenv.mkDerivation rec {
 
   LIBCLANG_PATH = "${libclang.lib}/lib";
 
-  # FIXME: workaround for Pipewire 0.3.64 deprecated API change, remove when fixed upstream
-  # https://gitlab.freedesktop.org/pipewire/pipewire-rs/-/issues/55
-  preBuild = ''
-    export BINDGEN_EXTRA_CLANG_ARGS="$BINDGEN_EXTRA_CLANG_ARGS -DPW_ENABLE_DEPRECATED"
-  '';
-
   meta = with lib; {
     description = "Scan and Generate QR Codes";
     homepage = "https://gitlab.gnome.org/World/decoder";
@@ -78,6 +74,5 @@ clangStdenv.mkDerivation rec {
     platforms = platforms.linux;
     mainProgram = "decoder";
     maintainers = with maintainers; [ zendo ];
-    broken = true;
   };
 }
diff --git a/pkgs/applications/graphics/gscreenshot/0001-Changing-paths-to-be-nix-compatible.patch b/pkgs/applications/graphics/gscreenshot/0001-Changing-paths-to-be-nix-compatible.patch
new file mode 100644
index 0000000000000..187d4a0154ba2
--- /dev/null
+++ b/pkgs/applications/graphics/gscreenshot/0001-Changing-paths-to-be-nix-compatible.patch
@@ -0,0 +1,25 @@
+From a4822ee9e894f5f5b3110f41f65a698dd845a41d Mon Sep 17 00:00:00 2001
+From: Richard Davis <davisrichard437@gmail.com>
+Date: Fri, 24 Mar 2023 11:45:23 -0400
+Subject: [PATCH] Changing paths to be nix-compatible.
+
+---
+ dist/desktop/gscreenshot.desktop | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/dist/desktop/gscreenshot.desktop b/dist/desktop/gscreenshot.desktop
+index a5d2bcd..9d289e2 100644
+--- a/dist/desktop/gscreenshot.desktop
++++ b/dist/desktop/gscreenshot.desktop
+@@ -2,7 +2,7 @@
+ Type=Application
+ Name=gscreenshot
+ Comment=A simple screenshot utility
+-TryExec=/usr/bin/gscreenshot
++TryExec=gscreenshot
+ Exec=gscreenshot
+ Icon=gscreenshot
+ Categories=Graphics;
+-- 
+2.39.2
+
diff --git a/pkgs/applications/graphics/gscreenshot/default.nix b/pkgs/applications/graphics/gscreenshot/default.nix
new file mode 100644
index 0000000000000..0847bc87cfd33
--- /dev/null
+++ b/pkgs/applications/graphics/gscreenshot/default.nix
@@ -0,0 +1,90 @@
+{ lib
+, fetchFromGitHub
+, python3Packages
+, gettext
+, gobject-introspection
+, gtk3
+, wrapGAppsHook
+, xdg-utils
+, scrot
+, slop
+, xclip
+, grim
+, slurp
+, wl-clipboard
+, waylandSupport ? true
+, x11Support ? true
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "gscreenshot";
+  version = "3.4.0";
+
+  src = fetchFromGitHub {
+    owner = "thenaterhood";
+    repo = "${pname}";
+    rev = "v${version}";
+    sha256 = "YuISiTUReX9IQpckIgbt03CY7klnog/IeOtfBoQ1DZM=";
+  };
+
+  # needed for wrapGAppsHook to function
+  strictDeps = false;
+  # tests require a display and fail
+  doCheck = false;
+
+  nativeBuildInputs = [ wrapGAppsHook ];
+  propagatedBuildInputs = [
+    gettext
+    gobject-introspection
+    gtk3
+    xdg-utils
+  ] ++ lib.optionals waylandSupport [
+    # wayland deps
+    grim
+    slurp
+    wl-clipboard
+  ] ++ lib.optionals x11Support [
+    # X11 deps
+    scrot
+    slop
+    xclip
+    python3Packages.xlib
+  ] ++ (with python3Packages; [
+    pillow
+    pygobject3
+    setuptools
+  ]);
+
+  patches = [ ./0001-Changing-paths-to-be-nix-compatible.patch ];
+
+  meta = {
+    description = "A screenshot frontend (CLI and GUI) for a variety of screenshot backends";
+
+    longDescription = ''
+      gscreenshot provides a common frontend and expanded functionality to a
+      number of X11 and Wayland screenshot and region selection utilties.
+
+      In a nutshell, gscreenshot supports the following:
+
+      - Capturing a full-screen screenshot
+      - Capturing a region of the screen interactively
+      - Capturing a window interactively
+      - Capturing the cursor
+      - Capturing the cursor, using an alternate cursor glyph
+      - Capturing a screenshot with a delay
+      - Showing a notification when a screenshot is taken
+      - Capturing a screenshot from the command line or a custom script
+      - Capturing a screenshot using a GUI
+      - Saving to a variety of image formats including 'bmp', 'eps', 'gif', 'jpeg', 'pcx', 'pdf', 'ppm', 'tiff', 'png', and 'webp'.
+      - Copying a screenshot to the system clipboard
+      - Opening a screenshot in the configured application after capture
+
+      Other than region selection, gscreenshot's CLI is non-interactive and is suitable for use in scripts.
+    '';
+
+    homepage = "https://github.com/thenaterhood/gscreenshot";
+    license = lib.licenses.gpl2Only;
+    platforms = lib.platforms.linux;
+    maintainers = [ lib.maintainers.davisrichard437 ];
+  };
+}
diff --git a/pkgs/applications/misc/notable/default.nix b/pkgs/applications/misc/notable/default.nix
index 9e701cdb33f6b..e51e49fd89319 100644
--- a/pkgs/applications/misc/notable/default.nix
+++ b/pkgs/applications/misc/notable/default.nix
@@ -1,4 +1,4 @@
-{ appimageTools, fetchurl, lib }:
+{ appimageTools, makeWrapper, fetchurl, lib }:
 
 let
   pname = "notable";
@@ -16,10 +16,11 @@ let
     inherit name src;
   };
 
+  nativeBuildInputs = [ makeWrapper ];
 in
 appimageTools.wrapType2 rec {
 
-  inherit name src;
+  inherit pname version src;
 
   profile = ''
     export LC_ALL=C.UTF-8
@@ -34,6 +35,9 @@ appimageTools.wrapType2 rec {
       $out/share/icons/hicolor/1024x1024/apps/notable.png
     substituteInPlace $out/share/applications/notable.desktop \
       --replace 'Exec=AppRun' 'Exec=${pname}'
+    source "${makeWrapper}/nix-support/setup-hook"
+    wrapProgram "$out/bin/${pname}" \
+      --add-flags "--disable-seccomp-filter-sandbox"
   '';
 
   meta = with lib; {
diff --git a/pkgs/applications/networking/cluster/kubernetes/default.nix b/pkgs/applications/networking/cluster/kubernetes/default.nix
index da77a82bd8454..dd71b53584fc1 100644
--- a/pkgs/applications/networking/cluster/kubernetes/default.nix
+++ b/pkgs/applications/networking/cluster/kubernetes/default.nix
@@ -20,13 +20,13 @@
 
 buildGoModule rec {
   pname = "kubernetes";
-  version = "1.26.3";
+  version = "1.27.0";
 
   src = fetchFromGitHub {
     owner = "kubernetes";
     repo = "kubernetes";
     rev = "v${version}";
-    hash = "sha256-dJMfnd82JIPxyVisr5o9s/bC3ZDiolF841pmV4c9LN8=";
+    hash = "sha256-9xRsC6QghmoH/+K6Gs8k4BFHQ8ltCtG8TZpAJGRC2e4=";
   };
 
   vendorHash = null;
diff --git a/pkgs/applications/networking/cluster/terraform/default.nix b/pkgs/applications/networking/cluster/terraform/default.nix
index 0182a4ce50de4..a3d906cdf445e 100644
--- a/pkgs/applications/networking/cluster/terraform/default.nix
+++ b/pkgs/applications/networking/cluster/terraform/default.nix
@@ -166,8 +166,8 @@ rec {
   mkTerraform = attrs: pluggable (generic attrs);
 
   terraform_1 = mkTerraform {
-    version = "1.4.4";
-    hash = "sha256-Fg9NDV063gWi9Na144jjkK7E8ysE2GR4IYT6qjTgnqw=";
+    version = "1.4.5";
+    hash = "sha256-mnJ9d3UHAZxmz0i7PH0JF5gA3m3nJxM2NyAn0J0L6u8=";
     vendorHash = "sha256-3ZQcWatJlQ6NVoPL/7cKQO6+YCSM3Ld77iLEQK3jBDE=";
     patches = [ ./provider-path-0_15.patch ];
     passthru = {
diff --git a/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix b/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix
index 705f1ffe66b03..2ea2de235bb2a 100644
--- a/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix
+++ b/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "teams-for-linux";
-  version = "1.0.53";
+  version = "1.0.59";
 
   src = fetchFromGitHub {
     owner = "IsmaelMartinez";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-zigcOshtRQuQxJBXPWVmTjj5+4AorR5WW8lHVInUKFg=";
+    sha256 = "sha256-82uRZEktKHMQhozG5Zpa2DFu1VZOEDBWpsbfgMzoXY8=";
   };
 
   offlineCache = fetchYarnDeps {
@@ -89,6 +89,8 @@ stdenv.mkDerivation rec {
     categories = [ "Network" "InstantMessaging" "Chat" ];
   })];
 
+  passthru.updateScript = ./update.sh;
+
   meta = with lib; {
     description = "Unofficial Microsoft Teams client for Linux";
     homepage = "https://github.com/IsmaelMartinez/teams-for-linux";
diff --git a/pkgs/applications/networking/instant-messengers/teams-for-linux/update.sh b/pkgs/applications/networking/instant-messengers/teams-for-linux/update.sh
new file mode 100755
index 0000000000000..650edf188611f
--- /dev/null
+++ b/pkgs/applications/networking/instant-messengers/teams-for-linux/update.sh
@@ -0,0 +1,50 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p nix jq common-updater-scripts
+
+set -euo pipefail
+
+nixpkgs="$(git rev-parse --show-toplevel || (printf 'Could not find root of nixpkgs repo\nAre we running from within the nixpkgs git repo?\n' >&2; exit 1))"
+
+stripwhitespace() {
+    sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//'
+}
+
+nixeval() {
+    nix --extra-experimental-features nix-command eval --json --impure -f "$nixpkgs" "$1" | jq -r .
+}
+
+vendorhash() {
+    (nix --extra-experimental-features nix-command build --impure --argstr nixpkgs "$nixpkgs" --argstr attr "$1" --expr '{ nixpkgs, attr }: let pkgs = import nixpkgs {}; in with pkgs.lib; (getAttrFromPath (splitString "." attr) pkgs).overrideAttrs (attrs: { outputHash = fakeHash; })' --no-link 2>&1 >/dev/null | tail -n3 | grep -F got: | cut -d: -f2- | stripwhitespace) 2>/dev/null || true
+}
+
+findpath() {
+    path="$(nix --extra-experimental-features nix-command eval --json --impure -f "$nixpkgs" "$1.meta.position" | jq -r . | cut -d: -f1)"
+    outpath="$(nix --extra-experimental-features nix-command eval --json --impure --expr "builtins.fetchGit \"$nixpkgs\"")"
+
+    if [ -n "$outpath" ]; then
+        path="${path/$(echo "$outpath" | jq -r .)/$nixpkgs}"
+    fi
+
+    echo "$path"
+}
+
+attr="${UPDATE_NIX_ATTR_PATH:-teams-for-linux}"
+version="$(cd "$nixpkgs" && list-git-tags --pname="$(nixeval "$attr".pname)" --attr-path="$attr" | grep '^v' | sed -e 's|^v||' | sort -V | tail -n1)"
+
+pkgpath="$(findpath "$attr")"
+
+updated="$(cd "$nixpkgs" && update-source-version "$attr" "$version" --file="$pkgpath" --print-changes | jq -r length)"
+
+if [ "$updated" -eq 0 ]; then
+    echo 'update.sh: Package version not updated, nothing to do.'
+    exit 0
+fi
+
+curhash="$(nixeval "$attr.offlineCache.outputHash")"
+newhash="$(vendorhash "$attr.offlineCache")"
+
+if [ -n "$newhash" ] && [ "$curhash" != "$newhash" ]; then
+    sed -i -e "s|\"$curhash\"|\"$newhash\"|" "$pkgpath"
+else
+    echo 'update.sh: New vendorHash same as old vendorHash, nothing to do.'
+fi
diff --git a/pkgs/applications/networking/remote/anydesk/default.nix b/pkgs/applications/networking/remote/anydesk/default.nix
index 7d7009e02431f..f9668a9eeaef1 100644
--- a/pkgs/applications/networking/remote/anydesk/default.nix
+++ b/pkgs/applications/networking/remote/anydesk/default.nix
@@ -8,7 +8,7 @@ let
 
   desktopItem = makeDesktopItem {
     name = "AnyDesk";
-    exec = "@out@/bin/anydesk";
+    exec = "@out@/bin/anydesk %u";
     icon = "anydesk";
     desktopName = "AnyDesk";
     genericName = description;
@@ -18,14 +18,14 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "anydesk";
-  version = "6.2.0";
+  version = "6.2.1";
 
   src = fetchurl {
     urls = [
       "https://download.anydesk.com/linux/${pname}-${version}-amd64.tar.gz"
       "https://download.anydesk.com/linux/generic-linux/${pname}-${version}-amd64.tar.gz"
     ];
-    sha256 = "k85nQH2FWyEXDgB+Pd4yStfNCjkiIGE2vA/YTXLaK4o=";
+    hash = "sha256-lqfe0hROza/zgcNOSe7jJ1yqqsAIR+kav153g3BsmJw=";
   };
 
   passthru = {
@@ -86,6 +86,6 @@ in stdenv.mkDerivation rec {
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     platforms = [ "x86_64-linux" ];
-    maintainers = with maintainers; [ shyim ];
+    maintainers = with maintainers; [ shyim cheriimoya ];
   };
 }
diff --git a/pkgs/applications/science/biology/samtools/default.nix b/pkgs/applications/science/biology/samtools/default.nix
index c72dd1b19077d..5e18d5ead58a5 100644
--- a/pkgs/applications/science/biology/samtools/default.nix
+++ b/pkgs/applications/science/biology/samtools/default.nix
@@ -2,22 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "samtools";
-  version = "1.13";
+  version = "1.17";
 
   src = fetchurl {
     url = "https://github.com/samtools/samtools/releases/download/${version}/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-YWyi4FHMgAmh6cAc/Yx8r4twkW3f9m87dpFAeUZfjGA=";
+    sha256 = "sha256-Ot85C2KCGf1kCPFGAqTEqpDmPhizldrXIqtRlDiipyk";
   };
 
-  patches = [
-    # Pull upstream patch for ncurses-6.3 support
-    (fetchpatch {
-      name = "ncurses-6.3.patch";
-      url = "https://github.com/samtools/samtools/commit/396ef20eb0854d6b223c3223b60bb7efe42301f7.patch";
-      sha256 = "sha256-p0l9ymXK9nqL2w8EytbW+qeaI7dD86IQgIVxacBj838=";
-    })
-  ];
-
   # tests require `bgzip` from the htslib package
   nativeCheckInputs = [ htslib ];
 
diff --git a/pkgs/build-support/rust/build-rust-crate/default.nix b/pkgs/build-support/rust/build-rust-crate/default.nix
index c4d1ef7b209e5..17ce3f75fb1bb 100644
--- a/pkgs/build-support/rust/build-rust-crate/default.nix
+++ b/pkgs/build-support/rust/build-rust-crate/default.nix
@@ -352,6 +352,7 @@ crate_: lib.makeOverridable
           metadata hasCrateBin crateBin verbose colors
           extraRustcOpts buildTests codegenUnits;
       };
+      dontStrip = !release;
       installPhase = installCrate crateName metadata buildTests;
 
       # depending on the test setting we are either producing something with bins
diff --git a/pkgs/desktops/plasma-5/plasma-vault/0004-gocryptfs-path.patch b/pkgs/desktops/plasma-5/plasma-vault/0004-gocryptfs-path.patch
new file mode 100644
index 0000000000000..8790f877ff07e
--- /dev/null
+++ b/pkgs/desktops/plasma-5/plasma-vault/0004-gocryptfs-path.patch
@@ -0,0 +1,13 @@
+diff --git a/kded/engine/backends/gocryptfs/gocryptfsbackend.cpp b/kded/engine/backends/gocryptfs/gocryptfsbackend.cpp
+index 2d6df94..3e8ec9a 100644
+--- a/kded/engine/backends/gocryptfs/gocryptfsbackend.cpp
++++ b/kded/engine/backends/gocryptfs/gocryptfsbackend.cpp
+@@ -202,7 +202,7 @@ QProcess *GocryptfsBackend::gocryptfs(const QStringList &arguments) const
+     auto config = KSharedConfig::openConfig(PLASMAVAULT_CONFIG_FILE);
+     KConfigGroup backendConfig(config, "GocryptfsBackend");
+ 
+-    return process("gocryptfs", arguments + backendConfig.readEntry("extraMountOptions", QStringList{}), {});
++    return process(NIXPKGS_GOCRYPTFS, arguments + backendConfig.readEntry("extraMountOptions", QStringList{}), {});
+ }
+ 
+ QString GocryptfsBackend::getConfigFilePath(const Device &device) const
diff --git a/pkgs/desktops/plasma-5/plasma-vault/default.nix b/pkgs/desktops/plasma-5/plasma-vault/default.nix
index ba1def5304762..3bc432b0d5095 100644
--- a/pkgs/desktops/plasma-5/plasma-vault/default.nix
+++ b/pkgs/desktops/plasma-5/plasma-vault/default.nix
@@ -9,6 +9,7 @@
 , encfs
 , cryfs
 , fuse
+, gocryptfs
 }:
 
 mkDerivation {
@@ -19,6 +20,7 @@ mkDerivation {
     ./0001-encfs-path.patch
     ./0002-cryfs-path.patch
     ./0003-fusermount-path.patch
+    ./0004-gocryptfs-path.patch
   ];
 
   buildInputs = [
@@ -32,10 +34,9 @@ mkDerivation {
   CXXFLAGS = [
     ''-DNIXPKGS_ENCFS=\"${lib.getBin encfs}/bin/encfs\"''
     ''-DNIXPKGS_ENCFSCTL=\"${lib.getBin encfs}/bin/encfsctl\"''
-
     ''-DNIXPKGS_CRYFS=\"${lib.getBin cryfs}/bin/cryfs\"''
-
     ''-DNIXPKGS_FUSERMOUNT=\"${lib.getBin fuse}/bin/fusermount\"''
+    ''-DNIXPKGS_GOCRYPTFS=\"${lib.getBin gocryptfs}/bin/gocryptfs\"''
   ];
 
 }
diff --git a/pkgs/development/libraries/luabind/0.9.1_boost_1.57_fix.patch b/pkgs/development/libraries/luabind/0.9.1_boost_1.57_fix.patch
deleted file mode 100644
index 7ac495777b546..0000000000000
--- a/pkgs/development/libraries/luabind/0.9.1_boost_1.57_fix.patch
+++ /dev/null
@@ -1,23 +0,0 @@
-diff --git a/luabind/object.hpp b/luabind/object.hpp
-index f7b7ca5..1c18e04 100644
---- a/luabind/object.hpp
-+++ b/luabind/object.hpp
-@@ -536,6 +536,8 @@ namespace detail
-       handle m_key;
-   };
- 
-+#if BOOST_VERSION < 105700
-+
- // Needed because of some strange ADL issues.
- 
- #define LUABIND_OPERATOR_ADL_WKND(op) \
-@@ -557,7 +559,8 @@ namespace detail
-   LUABIND_OPERATOR_ADL_WKND(!=)
- 
- #undef LUABIND_OPERATOR_ADL_WKND
-- 
-+
-+#endif // BOOST_VERSION < 105700 
- } // namespace detail
- 
- namespace adl
diff --git a/pkgs/development/libraries/luabind/0.9.1_discover_luajit.patch b/pkgs/development/libraries/luabind/0.9.1_discover_luajit.patch
deleted file mode 100644
index 6e5fe6aa6f82d..0000000000000
--- a/pkgs/development/libraries/luabind/0.9.1_discover_luajit.patch
+++ /dev/null
@@ -1,22 +0,0 @@
-diff --git a/Jamroot b/Jamroot
-index 94494bf..83dfcbb 100755
---- a/Jamroot
-+++ b/Jamroot
-@@ -64,7 +64,7 @@ else if [ os.name ] in LINUX MACOSX FREEBSD
-         $(LUA_PATH) $(HOME)/Library/Frameworks /Library/Frameworks /usr /usr/local /opt/local /opt ;
- 
-     local possible-suffixes =
--        include/lua5.1 include/lua51 include/lua include ;
-+        include/lua5.1 include/lua51 include/lua include include/luajit-2.0 ;
- 
-     local includes = [ GLOB $(possible-prefixes)/$(possible-suffixes) : lua.h ] ;
- 
-@@ -83,7 +83,7 @@ else if [ os.name ] in LINUX MACOSX FREEBSD
- 
-     local lib = $(prefix)/lib ;
- 
--    local names = liblua5.1 liblua51 liblua ;
-+    local names = liblua5.1 liblua51 liblua libluajit-5.1 ;
-     local extensions = .a .so ;
- 
-     library = [ GLOB $(lib)/lua51 $(lib)/lua5.1 $(lib)/lua $(lib) :
diff --git a/pkgs/development/libraries/luabind/0.9.1_modern_boost_fix.patch b/pkgs/development/libraries/luabind/0.9.1_modern_boost_fix.patch
deleted file mode 100644
index 92e32828a03c6..0000000000000
--- a/pkgs/development/libraries/luabind/0.9.1_modern_boost_fix.patch
+++ /dev/null
@@ -1,59 +0,0 @@
-diff --git luabind-0.9.1/luabind/detail/call_function.hpp luabind-0.9.1-fixed/luabind/detail/call_function.hpp
-index 1b45ec1..8f5afff 100644
---- luabind-0.9.1/luabind/detail/call_function.hpp
-+++ luabind-0.9.1-fixed/luabind/detail/call_function.hpp
-@@ -323,7 +323,8 @@ namespace luabind
- 
- #endif // LUABIND_CALL_FUNCTION_HPP_INCLUDED
- 
--#elif BOOST_PP_ITERATION_FLAGS() == 1
-+#else
-+#if BOOST_PP_ITERATION_FLAGS() == 1
- 
- #define LUABIND_TUPLE_PARAMS(z, n, data) const A##n *
- #define LUABIND_OPERATOR_PARAMS(z, n, data) const A##n & a##n
-@@ -440,4 +441,5 @@ namespace luabind
- 
- 
- #endif
-+#endif
- 
-diff --git luabind-0.9.1/luabind/detail/call_member.hpp luabind-0.9.1-fixed/luabind/detail/call_member.hpp
-index de8d563..e63555b 100644
---- luabind-0.9.1/luabind/detail/call_member.hpp
-+++ luabind-0.9.1-fixed/luabind/detail/call_member.hpp
-@@ -316,7 +316,8 @@ namespace luabind
- 
- #endif // LUABIND_CALL_MEMBER_HPP_INCLUDED
- 
--#elif BOOST_PP_ITERATION_FLAGS() == 1
-+#else
-+#if BOOST_PP_ITERATION_FLAGS() == 1
- 
- #define LUABIND_TUPLE_PARAMS(z, n, data) const A##n *
- #define LUABIND_OPERATOR_PARAMS(z, n, data) const A##n & a##n
-@@ -360,4 +361,5 @@ namespace luabind
- #undef LUABIND_TUPLE_PARAMS
- 
- #endif
-+#endif
- 
-diff --git luabind-0.9.1/luabind/wrapper_base.hpp luabind-0.9.1-fixed/luabind/wrapper_base.hpp
-index d54c668..0f88cc5 100755
---- luabind-0.9.1/luabind/wrapper_base.hpp
-+++ luabind-0.9.1-fixed/luabind/wrapper_base.hpp
-@@ -89,7 +89,8 @@ namespace luabind
- 
- #endif // LUABIND_WRAPPER_BASE_HPP_INCLUDED
- 
--#elif BOOST_PP_ITERATION_FLAGS() == 1
-+#else
-+#if BOOST_PP_ITERATION_FLAGS() == 1
- 
- #define LUABIND_TUPLE_PARAMS(z, n, data) const A##n *
- #define LUABIND_OPERATOR_PARAMS(z, n, data) const A##n & a##n
-@@ -188,3 +189,4 @@ namespace luabind
- #undef N
- 
- #endif
-+#endif
diff --git a/pkgs/development/libraries/luabind/default.nix b/pkgs/development/libraries/luabind/default.nix
index b36e6f34c8262..069e13ddde117 100644
--- a/pkgs/development/libraries/luabind/default.nix
+++ b/pkgs/development/libraries/luabind/default.nix
@@ -1,26 +1,22 @@
-{ lib, stdenv, fetchFromGitHub, boost-build, lua, boost }:
+{ lib, stdenv, fetchFromGitHub, lua, boost, cmake }:
 
 stdenv.mkDerivation rec {
   pname = "luabind";
   version = "0.9.1";
 
   src = fetchFromGitHub {
-    owner = "luabind";
+    owner = "Oberon00";
     repo = "luabind";
-    rev = "v${version}";
-    sha256 = "sha256-sK1ca2Oj9yXdmxyXeDO3k8YZ1g+HxIXLhvdTWdPDdag=";
+    rev = "49814f6b47ed99e273edc5198a6ebd7fa19e813a";
+    sha256 = "sha256-JcOsoQHRvdzF2rsZBW6egOwIy7+7C4wy0LiYmbV590Q";
   };
 
-  patches = [ ./0.9.1_modern_boost_fix.patch ./0.9.1_boost_1.57_fix.patch ./0.9.1_discover_luajit.patch ];
+  nativeBuildInputs = [ cmake ];
 
-  buildInputs = [ boost-build lua boost ];
+  buildInputs = [ boost ];
 
   propagatedBuildInputs = [ lua ];
 
-  buildPhase = "LUA_PATH=${lua} bjam release";
-
-  installPhase = "LUA_PATH=${lua} bjam --prefix=$out release install";
-
   passthru = {
     inherit lua;
   };
@@ -29,6 +25,6 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/luabind/luabind";
     description = "A library that helps you create bindings between C++ and Lua";
     license = lib.licenses.mit;
-    platforms = lib.platforms.linux;
+    platforms = lib.platforms.unix;
   };
 }
diff --git a/pkgs/development/libraries/qt-5/5.15/default.nix b/pkgs/development/libraries/qt-5/5.15/default.nix
index 46a60f5403f48..3b2979d3abcea 100644
--- a/pkgs/development/libraries/qt-5/5.15/default.nix
+++ b/pkgs/development/libraries/qt-5/5.15/default.nix
@@ -185,7 +185,7 @@ let
         inherit (darwin.apple_sdk_11_0.libs) sandbox;
         inherit (darwin.apple_sdk_11_0.frameworks) ApplicationServices AVFoundation Foundation ForceFeedback GameController AppKit
           ImageCaptureCore CoreBluetooth IOBluetooth CoreWLAN Quartz Cocoa LocalAuthentication
-          MediaPlayer MediaAccessibility SecurityInterface Vision CoreML;
+          MediaPlayer MediaAccessibility SecurityInterface Vision CoreML OpenDirectory Accelerate;
         libobjc = darwin.apple_sdk_11_0.objc4;
       };
       qtwebglplugin = callPackage ../modules/qtwebglplugin.nix {};
diff --git a/pkgs/development/libraries/qt-5/modules/qtwebengine.nix b/pkgs/development/libraries/qt-5/modules/qtwebengine.nix
index 60899e50535fa..d8d394444028e 100644
--- a/pkgs/development/libraries/qt-5/modules/qtwebengine.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtwebengine.nix
@@ -17,7 +17,7 @@
 , cctools, libobjc, libpm, libunwind, sandbox, xnu
 , ApplicationServices, AVFoundation, Foundation, ForceFeedback, GameController, AppKit
 , ImageCaptureCore, CoreBluetooth, IOBluetooth, CoreWLAN, Quartz, Cocoa, LocalAuthentication
-, MediaPlayer, MediaAccessibility, SecurityInterface, Vision, CoreML
+, MediaPlayer, MediaAccessibility, SecurityInterface, Vision, CoreML, OpenDirectory, Accelerate
 , cups, openbsm, runCommand, xcbuild, writeScriptBin
 , ffmpeg_4 ? null
 , lib, stdenv, fetchpatch
@@ -186,6 +186,8 @@ qtModule {
     SecurityInterface
     Vision
     CoreML
+    OpenDirectory
+    Accelerate
 
     openbsm
     libunwind
diff --git a/pkgs/development/libraries/science/biology/htslib/default.nix b/pkgs/development/libraries/science/biology/htslib/default.nix
index 219c06ce57ad0..a3b35d55c9e8a 100644
--- a/pkgs/development/libraries/science/biology/htslib/default.nix
+++ b/pkgs/development/libraries/science/biology/htslib/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "htslib";
-  version = "1.16";
+  version = "1.17";
 
   src = fetchurl {
     url = "https://github.com/samtools/htslib/releases/download/${version}/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-YGt8ev9zc0zwM+zRVvQFKfpXkvVFJJUqKJOMoIkNeSQ=";
+    sha256 = "sha256-djd5KIxA8HZG7HrZi5bDeMc5Fx0WKtmDmIaHg7chg58";
   };
 
   # perl is only used during the check phase.
diff --git a/pkgs/development/python-modules/django-allauth/default.nix b/pkgs/development/python-modules/django-allauth/default.nix
index 0cc201169d80c..439c4c2cb564f 100644
--- a/pkgs/development/python-modules/django-allauth/default.nix
+++ b/pkgs/development/python-modules/django-allauth/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "django-allauth";
-  version = "0.51.0";
+  version = "0.54.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "pennersr";
     repo = pname;
     rev = version;
-    hash = "sha256-o8EoayMMwxoJTrUA3Jo1Dfu1XFgC+Mcpa8yMwXlKAKY=";
+    hash = "sha256-0yJsHJhYeiCHQg/QzFD/metb97rcUJ+LYlsl7fGYmuM=";
   };
 
   postPatch = ''
@@ -52,6 +52,6 @@ buildPythonPackage rec {
     description = "Integrated set of Django applications addressing authentication, registration, account management as well as 3rd party (social) account authentication";
     homepage = "https://www.intenct.nl/projects/django-allauth";
     license = licenses.mit;
-    maintainers = with maintainers; [ SuperSandro2000 ];
+    maintainers = with maintainers; [ derdennisop ];
   };
 }
diff --git a/pkgs/development/python-modules/espeak-phonemizer/cdll.patch b/pkgs/development/python-modules/espeak-phonemizer/cdll.patch
index 3ce5df122d50e..48207c3f95d05 100644
--- a/pkgs/development/python-modules/espeak-phonemizer/cdll.patch
+++ b/pkgs/development/python-modules/espeak-phonemizer/cdll.patch
@@ -1,15 +1,11 @@
 diff --git a/espeak_phonemizer/__init__.py b/espeak_phonemizer/__init__.py
-index a09472e..730a7f9 100644
+index 44cd943..adeaeba 100644
 --- a/espeak_phonemizer/__init__.py
 +++ b/espeak_phonemizer/__init__.py
-@@ -163,14 +163,10 @@ class Phonemizer:
+@@ -150,11 +150,7 @@ class Phonemizer:
              # Already initialized
              return
  
--        self.libc = ctypes.cdll.LoadLibrary("libc.so.6")
-+        self.libc = ctypes.cdll.LoadLibrary("@libc@")
-         self.libc.open_memstream.restype = ctypes.POINTER(ctypes.c_char)
- 
 -        try:
 -            self.lib_espeak = ctypes.cdll.LoadLibrary("libespeak-ng.so")
 -        except OSError:
diff --git a/pkgs/development/python-modules/espeak-phonemizer/default.nix b/pkgs/development/python-modules/espeak-phonemizer/default.nix
index d8c5ba1bb6445..2398f421e0da3 100644
--- a/pkgs/development/python-modules/espeak-phonemizer/default.nix
+++ b/pkgs/development/python-modules/espeak-phonemizer/default.nix
@@ -2,27 +2,25 @@
 , buildPythonPackage
 , fetchFromGitHub
 , substituteAll
-, glibc
 , espeak-ng
 , pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "espeak-phonemizer";
-  version = "1.1.0";
+  version = "1.2.0";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "rhasspy";
     repo = "espeak-phonemizer";
     rev = "refs/tags/v${version}";
-    hash = "sha256-qnJtS5iIARdg+umolzLHT3/nLon9syjxfTnMWHOmYPU=";
+    hash = "sha256-FiajWpxSDRxTiCj8xGHea4e0voqOvaX6oQYB72FkVbw=";
   };
 
   patches = [
     (substituteAll {
       src = ./cdll.patch;
-      libc = "${lib.getLib glibc}/lib/libc.so.6";
       libespeak_ng = "${lib.getLib espeak-ng}/lib/libespeak-ng.so";
     })
   ];
diff --git a/pkgs/development/python-modules/pyngrok/default.nix b/pkgs/development/python-modules/pyngrok/default.nix
index db4ec105d87c0..4e99c7e62ff8c 100644
--- a/pkgs/development/python-modules/pyngrok/default.nix
+++ b/pkgs/development/python-modules/pyngrok/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "pyngrok";
-  version = "5.2.1";
+  version = "5.2.2";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-dws4Z4LzgkkOGTS5LZn/MU8ZKr70n4PWocezsDhxeT4=";
+    hash = "sha256-MfpuafEUhFNtEegvihCLmsnHYFBu8kKghfPRp3oqlb8=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pytest-describe/default.nix b/pkgs/development/python-modules/pytest-describe/default.nix
index b659445267ca3..a7c389202ee9a 100644
--- a/pkgs/development/python-modules/pytest-describe/default.nix
+++ b/pkgs/development/python-modules/pytest-describe/default.nix
@@ -6,13 +6,12 @@
 , pytest
 
 # tests
-, py
 , pytestCheckHook
 }:
 
 let
   pname = "pytest-describe";
-  version = "2.0.1";
+  version = "2.1.0";
 in
 buildPythonPackage {
   inherit pname version;
@@ -20,7 +19,7 @@ buildPythonPackage {
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-5cuqMRafAGA0itXKAZECfl8fQfPyf97vIINl4JxV65o=";
+    hash = "sha256-BjDJWsSUKrjc2OdmI2+GQ2tJhIltsMBZ/CNP72b+lzI=";
   };
 
   buildInputs = [
@@ -28,7 +27,6 @@ buildPythonPackage {
   ];
 
   nativeCheckInputs = [
-    py
     pytestCheckHook
   ];
 
diff --git a/pkgs/development/python-modules/torch/default.nix b/pkgs/development/python-modules/torch/default.nix
index d9cf4e5760d88..576e6b1bfac9c 100644
--- a/pkgs/development/python-modules/torch/default.nix
+++ b/pkgs/development/python-modules/torch/default.nix
@@ -182,6 +182,13 @@ in buildPythonPackage rec {
     substituteInPlace cmake/public/LoadHIP.cmake \
       --replace "set(ROCM_PATH \$ENV{ROCM_PATH})" \
         "set(ROCM_PATH \$ENV{ROCM_PATH})''\nset(ROCM_VERSION ${lib.concatStrings (lib.intersperse "0" (lib.splitString "." hip.version))})"
+  ''
+  # error: no member named 'aligned_alloc' in the global namespace; did you mean simply 'aligned_alloc'
+  # This lib overrided aligned_alloc hence the error message. Tltr: his function is linkable but not in header.
+  + lib.optionalString (stdenv.isDarwin && lib.versionOlder stdenv.targetPlatform.darwinSdkVersion "11.0") ''
+    substituteInPlace third_party/pocketfft/pocketfft_hdronly.h --replace '#if __cplusplus >= 201703L
+    inline void *aligned_alloc(size_t align, size_t size)' '#if __cplusplus >= 201703L && 0
+    inline void *aligned_alloc(size_t align, size_t size)'
   '';
 
   preConfigure = lib.optionalString cudaSupport ''
diff --git a/pkgs/development/tools/sca2d/default.nix b/pkgs/development/tools/sca2d/default.nix
new file mode 100644
index 0000000000000..eb28e7acb026c
--- /dev/null
+++ b/pkgs/development/tools/sca2d/default.nix
@@ -0,0 +1,48 @@
+{ lib
+, python3
+, fetchFromGitLab
+, fetchFromGitHub
+}:
+let
+  python = python3.override {
+    packageOverrides = self: super: {
+      lark010 = super.lark.overridePythonAttrs (old: rec {
+        version = "0.10.0";
+
+        src = fetchFromGitHub {
+          owner = "lark-parser";
+          repo = "lark";
+          rev = "refs/tags/${version}";
+          sha256 = "sha256-ctdPPKPSD4weidyhyj7RCV89baIhmuxucF3/Ojx1Efo=";
+        };
+
+        disabledTestPaths = [ "tests/test_nearley/test_nearley.py" ];
+      });
+    };
+    self = python;
+  };
+in
+python.pkgs.buildPythonApplication rec {
+  pname = "sca2d";
+  version = "0.2.0";
+  format = "setuptools";
+
+  src = fetchFromGitLab {
+    owner = "bath_open_instrumentation_group";
+    repo = "sca2d";
+    rev = "v${version}";
+    hash = "sha256-P+7g57AH8H7q0hBE2I9w8A+bN5M6MPbc9gA0b889aoQ=";
+  };
+
+  propagatedBuildInputs = with python.pkgs; [ lark010 colorama ];
+
+  pythonImportsCheck = [ "sca2d" ];
+
+  meta = with lib; {
+    description = "An experimental static code analyser for OpenSCAD";
+    homepage = "https://gitlab.com/bath_open_instrumentation_group/sca2d";
+    changelog = "https://gitlab.com/bath_open_instrumentation_group/sca2d/-/blob/${src.rev}/CHANGELOG.md";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ traxys ];
+  };
+}
diff --git a/pkgs/games/papermc/default.nix b/pkgs/games/papermc/default.nix
index 66754073db5cf..930b4462a7bd9 100644
--- a/pkgs/games/papermc/default.nix
+++ b/pkgs/games/papermc/default.nix
@@ -1,14 +1,16 @@
 { lib, stdenv, fetchurl, bash, jre }:
-let
-  mcVersion = "1.19.3";
-  buildNum = "375";
-  jar = fetchurl {
+
+stdenv.mkDerivation rec {
+  pname = "papermc";
+  version = "1.19.3.375";
+
+  jar = let
+    mcVersion = lib.versions.pad 3 version;
+    buildNum = builtins.elemAt (lib.versions.splitVersion version) 3;
+  in fetchurl {
     url = "https://papermc.io/api/v2/projects/paper/versions/${mcVersion}/builds/${buildNum}/downloads/paper-${mcVersion}-${buildNum}.jar";
     sha256 = "sha256-NAl4+mCkO6xQQpIx2pd9tYX2N8VQa+2dmFwyBNbDa10=";
   };
-in stdenv.mkDerivation {
-  pname = "papermc";
-  version = "${mcVersion}r${buildNum}";
 
   preferLocalBuild = true;
 
diff --git a/pkgs/os-specific/linux/gasket/default.nix b/pkgs/os-specific/linux/gasket/default.nix
new file mode 100644
index 0000000000000..1f9d60ad7b606
--- /dev/null
+++ b/pkgs/os-specific/linux/gasket/default.nix
@@ -0,0 +1,35 @@
+{ stdenv, lib, fetchFromGitHub, kernel }:
+
+stdenv.mkDerivation rec {
+  pname = "gasket";
+  version = "1.0-18";
+
+  src = fetchFromGitHub {
+    owner = "google";
+    repo = "gasket-driver";
+    rev = "97aeba584efd18983850c36dcf7384b0185284b3";
+    sha256 = "pJwrrI7jVKFts4+bl2xmPIAD01VKFta2SRuElerQnTo=";
+  };
+
+  makeFlags = [
+    "-C"
+    "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+    "M=$(PWD)"
+  ];
+  buildFlags = [ "modules" ];
+
+  installFlags = [ "INSTALL_MOD_PATH=${placeholder "out"}" ];
+  installTargets = [ "modules_install" ];
+
+  sourceRoot = "source/src";
+  hardeningDisable = [ "pic" "format" ];
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  meta = with lib; {
+    description = "The Coral Gasket Driver allows usage of the Coral EdgeTPU on Linux systems.";
+    homepage = "https://github.com/google/gasket-driver";
+    license = licenses.gpl2;
+    maintainers = [ lib.maintainers.kylehendricks ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/kernel/linux-testing.nix b/pkgs/os-specific/linux/kernel/linux-testing.nix
index 7cb8108c45176..71a5d81351211 100644
--- a/pkgs/os-specific/linux/kernel/linux-testing.nix
+++ b/pkgs/os-specific/linux/kernel/linux-testing.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "6.3-rc5";
+  version = "6.3-rc6";
   extraMeta.branch = lib.versions.majorMinor version;
 
   # modDirVersion needs to be x.y.z, will always add .0
@@ -11,7 +11,7 @@ buildLinux (args // rec {
 
   src = fetchzip {
     url = "https://git.kernel.org/torvalds/t/linux-${version}.tar.gz";
-    hash = "sha256-HKKDSOK45jT5vUaE3xd7nlxRgy1fw9xXBhqrICy/12Y=";
+    hash = "sha256-AXgHjWuGt2XQHVS7d/o9IbohfxHp9grtuYp5+EumlH4=";
   };
 
   # Should the testing kernels ever be built on Hydra?
diff --git a/pkgs/servers/matrix-synapse/matrix-appservice-irc/default.nix b/pkgs/servers/matrix-synapse/matrix-appservice-irc/default.nix
index 8c6e8a1025ce2..69696cbf91957 100644
--- a/pkgs/servers/matrix-synapse/matrix-appservice-irc/default.nix
+++ b/pkgs/servers/matrix-synapse/matrix-appservice-irc/default.nix
@@ -9,16 +9,16 @@
 
 buildNpmPackage rec {
   pname = "matrix-appservice-irc";
-  version = "0.37.1";
+  version = "0.38.0";
 
   src = fetchFromGitHub {
     owner = "matrix-org";
     repo = "matrix-appservice-irc";
     rev = "refs/tags/${version}";
-    hash = "sha256-d/CA27A0txnVnSCJeS/qeK90gOu1QjQaFBk+gblEdH8=";
+    hash = "sha256-rV4B9OQl1Ht26X4e7sqCe1PR5RpzIcjj4OvWG6udJWo=";
   };
 
-  npmDepsHash = "sha256-s/b/G49HlDbYsSmwRYrm4Bcv/81tHLC8Ac1IMEwGFW8=";
+  npmDepsHash = "sha256-iZuPr3a1BPtRfkEoxOs4oRL/nCfy3PLx5T9dX49/B0s=";
 
   nativeBuildInputs = [
     python3
diff --git a/pkgs/servers/osrm-backend/darwin.patch b/pkgs/servers/osrm-backend/darwin.patch
new file mode 100644
index 0000000000000..0aa57e4e1b816
--- /dev/null
+++ b/pkgs/servers/osrm-backend/darwin.patch
@@ -0,0 +1,30 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index e49fac2..25e3302 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -34,6 +34,14 @@ option(ENABLE_GLIBC_WORKAROUND "Workaround GLIBC symbol exports" OFF)
+ 
+ list(APPEND CMAKE_MODULE_PATH "${CMAKE_CURRENT_SOURCE_DIR}/cmake")
+ 
++IF(APPLE)
++    set(CMAKE_THREAD_LIBS_INIT "-lpthread")
++    set(CMAKE_HAVE_THREADS_LIBRARY 1)
++    set(CMAKE_USE_WIN32_THREADS_INIT 0)
++    set(CMAKE_USE_PTHREADS_INIT 1)
++    set(THREADS_PREFER_PTHREAD_FLAG ON)
++ENDIF()
++
+ if(ENABLE_MASON)
+   # versions in use
+   set(MASON_BOOST_VERSION "1.65.1")
+@@ -405,7 +413,8 @@ endif()
+ if(APPLE)
+   set(CMAKE_OSX_DEPLOYMENT_TARGET "10.10")
+   execute_process(COMMAND xcrun --sdk macosx --show-sdk-path OUTPUT_VARIABLE CMAKE_OSX_SYSROOT OUTPUT_STRIP_TRAILING_WHITESPACE)
++  execute_process(COMMAND uname -m OUTPUT_VARIABLE JAMBA_OSX_NATIVE_ARCHITECTURE OUTPUT_STRIP_TRAILING_WHITESPACE)
+-  set(CMAKE_OSX_ARCHITECTURES "x86_64")
++  set(CMAKE_OSX_ARCHITECTURES "${JAMBA_OSX_NATIVE_ARCHITECTURE}")
++  message(STATUS "Set Architecture to ${JAMBA_OSX_NATIVE_ARCHITECTURE} on OS X")
+-  message(STATUS "Set Architecture to x64 on OS X")
+   exec_program(uname ARGS -v  OUTPUT_VARIABLE DARWIN_VERSION)
+   string(REGEX MATCH "[0-9]+" DARWIN_VERSION ${DARWIN_VERSION})
diff --git a/pkgs/servers/osrm-backend/default.nix b/pkgs/servers/osrm-backend/default.nix
index 452163ee82cf0..b76db692a7830 100644
--- a/pkgs/servers/osrm-backend/default.nix
+++ b/pkgs/servers/osrm-backend/default.nix
@@ -15,6 +15,8 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ bzip2 libxml2 libzip boost lua luabind tbb expat ];
 
+  patches = [ ./darwin.patch ];
+
   env.NIX_CFLAGS_COMPILE = toString [
     # Needed with GCC 12
     "-Wno-error=stringop-overflow"
@@ -28,6 +30,6 @@ stdenv.mkDerivation rec {
     description = "Open Source Routing Machine computes shortest paths in a graph. It was designed to run well with map data from the Openstreetmap Project";
     license = lib.licenses.bsd2;
     maintainers = with lib.maintainers;[ erictapen ];
-    platforms = lib.platforms.linux;
+    platforms = lib.platforms.unix;
   };
 }
diff --git a/pkgs/servers/redpanda/default.nix b/pkgs/servers/redpanda/default.nix
index ef8335c56ccca..5292cfd715664 100644
--- a/pkgs/servers/redpanda/default.nix
+++ b/pkgs/servers/redpanda/default.nix
@@ -7,12 +7,12 @@
 , stdenv
 }:
 let
-  version = "23.1.3";
+  version = "23.1.6";
   src = fetchFromGitHub {
     owner = "redpanda-data";
     repo = "redpanda";
     rev = "v${version}";
-    sha256 = "sha256-tqQl7Elslcdw0hNjayYShj19KYmVskJG0qtaijGTzm0=";
+    sha256 = "sha256-ZZsZjOuHTwzhfKBd4VPNxfxrcvL6C5Uhv16xA0eUN60=";
   };
   server = callPackage ./server.nix { inherit src version; };
 in
diff --git a/pkgs/servers/sunshine/default.nix b/pkgs/servers/sunshine/default.nix
index 21ffb28a25cab..deb9e738b94b0 100644
--- a/pkgs/servers/sunshine/default.nix
+++ b/pkgs/servers/sunshine/default.nix
@@ -3,6 +3,7 @@
 , callPackage
 , fetchFromGitHub
 , fetchurl
+, fetchpatch
 , autoPatchelfHook
 , makeWrapper
 , buildNpmPackage
@@ -29,6 +30,7 @@
 , amf-headers
 , svt-av1
 , vulkan-loader
+, libappindicator
 , cudaSupport ? false
 , cudaPackages ? {}
 }:
@@ -42,28 +44,35 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "sunshine";
-  version = "0.18.4";
+  version = "0.19.1";
 
   src = fetchFromGitHub {
     owner = "LizardByte";
     repo = "Sunshine";
     rev = "v${version}";
-    sha256 = "sha256-nPUWBka/fl1oTB0vTv6qyL7EHh7ptFnxwfV/jYtloTc=";
+    sha256 = "sha256-fifwctVrSkAcMK8juAirIbIP64H7GKEwC+sUR/U6Q3Y=";
     fetchSubmodules = true;
   };
 
   # remove pre-built ffmpeg; use ffmpeg from nixpkgs
-  patches = [ ./ffmpeg.diff ];
+  patches = [
+    ./ffmpeg.diff
+    # fix for X11 not being added to libraries unless prebuilt FFmpeg is used: https://github.com/LizardByte/Sunshine/pull/1166
+    (fetchpatch {
+      url = "https://github.com/LizardByte/Sunshine/commit/a067da6cae72cf36f76acc06fcf1e814032af886.patch";
+      sha256 = "sha256-HMxM7luiFBEmFkvQtkdAMMSjAaYPEFX3LL0T/ActUhM=";
+    })
+  ];
 
   # fetch node_modules needed for webui
   ui = buildNpmPackage {
     inherit src version;
     pname = "sunshine-ui";
-    npmDepsHash = "sha256-k8Vfi/57AbGxYFPYSNh8bv4KqHnZjk3BDp8SJQHzuR8=";
+    npmDepsHash = "sha256-sdwvM/Irejo8DgMHJWWCxwOykOK9foqLFFd/tuzrkxI=";
 
     dontNpmBuild = true;
 
-    # use generated package-lock.json upstream does not provide one
+    # use generated package-lock.json as upstream does not provide one
     postPatch = ''
       cp ${./package-lock.json} ./package-lock.json
     '';
@@ -94,6 +103,7 @@ stdenv.mkDerivation rec {
     xorg.libXfixes
     xorg.libXrandr
     xorg.libXtst
+    xorg.libXi
     openssl
     libopus
     boost
@@ -110,6 +120,7 @@ stdenv.mkDerivation rec {
     mesa
     amf-headers
     svt-av1
+    libappindicator
   ] ++ lib.optionals cudaSupport [
     cudaPackages.cudatoolkit
   ];
@@ -121,21 +132,18 @@ stdenv.mkDerivation rec {
     libxcb
   ];
 
-  CXXFLAGS = [
-    "-Wno-format-security"
-  ];
-  CFLAGS = [
-    "-Wno-format-security"
-  ];
-
   cmakeFlags = [
     "-Wno-dev"
   ];
 
   postPatch = ''
-    # fix hardcoded libevdev path
+    # fix hardcoded libevdev and icon path
     substituteInPlace CMakeLists.txt \
-      --replace '/usr/include/libevdev-1.0' '${libevdev}/include/libevdev-1.0'
+      --replace '/usr/include/libevdev-1.0' '${libevdev}/include/libevdev-1.0' \
+      --replace '/usr/share' "$out/share"
+
+    substituteInPlace packaging/linux/sunshine.desktop \
+      --replace '@PROJECT_NAME@' 'Sunshine'
 
     # add FindFFMPEG to source tree
     cp ${findFfmpeg} cmake/FindFFMPEG.cmake
@@ -153,6 +161,12 @@ stdenv.mkDerivation rec {
       --set LD_LIBRARY_PATH ${lib.makeLibraryPath [ vulkan-loader ]}
   '';
 
+  postInstall = ''
+    install -Dm644 ../packaging/linux/${pname}.desktop $out/share/applications/${pname}.desktop
+  '';
+
+  passthru.updateScript = ./updater.sh;
+
   meta = with lib; {
     description = "Sunshine is a Game stream host for Moonlight.";
     homepage = "https://github.com/LizardByte/Sunshine";
diff --git a/pkgs/servers/sunshine/package-lock.json b/pkgs/servers/sunshine/package-lock.json
index 41f61a5f0abd0..a4678e38f4cfb 100644
--- a/pkgs/servers/sunshine/package-lock.json
+++ b/pkgs/servers/sunshine/package-lock.json
@@ -1,28 +1,28 @@
 {
-  "name": "Sunshine",
-  "lockfileVersion": 2,
+  "name": "sunshine",
+  "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "dependencies": {
-        "@fortawesome/fontawesome-free": "6.2.1",
+        "@fortawesome/fontawesome-free": "6.4.0",
         "bootstrap": "5.2.3",
         "vue": "2.6.12"
       }
     },
     "node_modules/@fortawesome/fontawesome-free": {
-      "version": "6.2.1",
-      "resolved": "https://registry.npmjs.org/@fortawesome/fontawesome-free/-/fontawesome-free-6.2.1.tgz",
-      "integrity": "sha512-viouXhegu/TjkvYQoiRZK3aax69dGXxgEjpvZW81wIJdxm5Fnvp3VVIP4VHKqX4SvFw6qpmkILkD4RJWAdrt7A==",
+      "version": "6.4.0",
+      "resolved": "https://registry.npmjs.org/@fortawesome/fontawesome-free/-/fontawesome-free-6.4.0.tgz",
+      "integrity": "sha512-0NyytTlPJwB/BF5LtRV8rrABDbe3TdTXqNB3PdZ+UUUZAEIrdOJdmABqKjt4AXwIoJNaRVVZEXxpNrqvE1GAYQ==",
       "hasInstallScript": true,
       "engines": {
         "node": ">=6"
       }
     },
     "node_modules/@popperjs/core": {
-      "version": "2.11.6",
-      "resolved": "https://registry.npmjs.org/@popperjs/core/-/core-2.11.6.tgz",
-      "integrity": "sha512-50/17A98tWUfQ176raKiOGXuYpLyyVMkxxG6oylzL3BPOlA6ADGdK7EYunSa4I064xerltq9TGXs8HmOk5E+vw==",
+      "version": "2.11.7",
+      "resolved": "https://registry.npmjs.org/@popperjs/core/-/core-2.11.7.tgz",
+      "integrity": "sha512-Cr4OjIkipTtcXKjAsm8agyleBuDHvxzeBoa1v543lbv1YaIwQjESsVcmjiWiPEbC1FIeHOG/Op9kdCmAmiS3Kw==",
       "peer": true,
       "funding": {
         "type": "opencollective",
@@ -52,29 +52,5 @@
       "resolved": "https://registry.npmjs.org/vue/-/vue-2.6.12.tgz",
       "integrity": "sha512-uhmLFETqPPNyuLLbsKz6ioJ4q7AZHzD8ZVFNATNyICSZouqP2Sz0rotWQC8UNBF6VGSCs5abnKJoStA6JbCbfg=="
     }
-  },
-  "dependencies": {
-    "@fortawesome/fontawesome-free": {
-      "version": "6.2.1",
-      "resolved": "https://registry.npmjs.org/@fortawesome/fontawesome-free/-/fontawesome-free-6.2.1.tgz",
-      "integrity": "sha512-viouXhegu/TjkvYQoiRZK3aax69dGXxgEjpvZW81wIJdxm5Fnvp3VVIP4VHKqX4SvFw6qpmkILkD4RJWAdrt7A=="
-    },
-    "@popperjs/core": {
-      "version": "2.11.6",
-      "resolved": "https://registry.npmjs.org/@popperjs/core/-/core-2.11.6.tgz",
-      "integrity": "sha512-50/17A98tWUfQ176raKiOGXuYpLyyVMkxxG6oylzL3BPOlA6ADGdK7EYunSa4I064xerltq9TGXs8HmOk5E+vw==",
-      "peer": true
-    },
-    "bootstrap": {
-      "version": "5.2.3",
-      "resolved": "https://registry.npmjs.org/bootstrap/-/bootstrap-5.2.3.tgz",
-      "integrity": "sha512-cEKPM+fwb3cT8NzQZYEu4HilJ3anCrWqh3CHAok1p9jXqMPsPTBhU25fBckEJHJ/p+tTxTFTsFQGM+gaHpi3QQ==",
-      "requires": {}
-    },
-    "vue": {
-      "version": "2.6.12",
-      "resolved": "https://registry.npmjs.org/vue/-/vue-2.6.12.tgz",
-      "integrity": "sha512-uhmLFETqPPNyuLLbsKz6ioJ4q7AZHzD8ZVFNATNyICSZouqP2Sz0rotWQC8UNBF6VGSCs5abnKJoStA6JbCbfg=="
-    }
   }
 }
diff --git a/pkgs/servers/sunshine/updater.sh b/pkgs/servers/sunshine/updater.sh
new file mode 100755
index 0000000000000..43ae46ab6f2f9
--- /dev/null
+++ b/pkgs/servers/sunshine/updater.sh
@@ -0,0 +1,23 @@
+#! /usr/bin/env nix-shell
+#! nix-shell -i bash -p gnugrep gnused coreutils curl wget jq nix-update prefetch-npm-deps nodejs
+
+set -euo pipefail
+pushd "$(dirname "${BASH_SOURCE[0]}")"
+
+version=$(curl -s "https://api.github.com/repos/LizardByte/sunshine/tags" | jq -r .[0].name | grep -oP "^v\K.*")
+url="https://raw.githubusercontent.com/LizardByte/sunshine/v$version/"
+
+if [[ "$UPDATE_NIX_OLD_VERSION" == "$version" ]]; then
+    echo "Already up to date!"
+    exit 0
+fi
+
+rm -f package-lock.json package.json
+wget "$url/package.json"
+npm i --package-lock-only
+npm_hash=$(prefetch-npm-deps package-lock.json)
+sed -i 's#npmDepsHash = "[^"]*"#npmDepsHash = "'"$npm_hash"'"#' default.nix
+rm -f package.json
+
+popd
+nix-update sunshine --version $version
diff --git a/pkgs/stdenv/adapters.nix b/pkgs/stdenv/adapters.nix
index eaf497f335f58..0c5645e5a487f 100644
--- a/pkgs/stdenv/adapters.nix
+++ b/pkgs/stdenv/adapters.nix
@@ -176,7 +176,7 @@ rec {
     stdenv.override (old: {
       mkDerivationFromStdenv = extendMkDerivationArgs old (args: {
         dontStrip = true;
-        env = (args.env or {}) // { NIX_CFLAGS_COMPILE = toString (args.NIX_CFLAGS_COMPILE or "") + " -ggdb -Og"; };
+        env = (args.env or {}) // { NIX_CFLAGS_COMPILE = toString (args.env.NIX_CFLAGS_COMPILE or "") + " -ggdb -Og"; };
       });
     });
 
@@ -219,7 +219,7 @@ rec {
   impureUseNativeOptimizations = stdenv:
     stdenv.override (old: {
       mkDerivationFromStdenv = extendMkDerivationArgs old (args: {
-        env = (args.env or {}) // { NIX_CFLAGS_COMPILE = toString (args.NIX_CFLAGS_COMPILE or "") + " -march=native"; };
+        env = (args.env or {}) // { NIX_CFLAGS_COMPILE = toString (args.env.NIX_CFLAGS_COMPILE or "") + " -march=native"; };
 
         NIX_ENFORCE_NO_NATIVE = false;
 
@@ -245,7 +245,7 @@ rec {
   withCFlags = compilerFlags: stdenv:
     stdenv.override (old: {
       mkDerivationFromStdenv = extendMkDerivationArgs old (args: {
-        env = (args.env or {}) // { NIX_CFLAGS_COMPILE = toString (args.NIX_CFLAGS_COMPILE or "") + " ${toString compilerFlags}"; };
+        env = (args.env or {}) // { NIX_CFLAGS_COMPILE = toString (args.env.NIX_CFLAGS_COMPILE or "") + " ${toString compilerFlags}"; };
       });
     });
 }
diff --git a/pkgs/tools/misc/esphome/default.nix b/pkgs/tools/misc/esphome/default.nix
index 97ab9718b885e..783bf2b3f1826 100644
--- a/pkgs/tools/misc/esphome/default.nix
+++ b/pkgs/tools/misc/esphome/default.nix
@@ -16,14 +16,14 @@ let
 in
 python.pkgs.buildPythonApplication rec {
   pname = "esphome";
-  version = "2023.3.1";
+  version = "2023.3.2";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-h35V6tg6TewqJiZ4T5t6RNNaT2JEzqhbnJgH6xqqqzs=";
+    hash = "sha256-MfipnmBxCz8R0bNyJDRBP2R8JeOtgIm6Mu6SFPGkDc0=";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/misc/shell_gpt/default.nix b/pkgs/tools/misc/shell_gpt/default.nix
index b8b3fbb1af515..9e3000a3cf722 100644
--- a/pkgs/tools/misc/shell_gpt/default.nix
+++ b/pkgs/tools/misc/shell_gpt/default.nix
@@ -1,14 +1,15 @@
 { lib
 , python3
+, nix-update-script
 }:
 
 python3.pkgs.buildPythonApplication rec {
   pname = "shell_gpt";
-  version = "0.7.3";
+  version = "0.8.8";
 
   src = python3.pkgs.fetchPypi {
     inherit pname version;
-    sha256 = "sha256-lS8zLtsh8Uz782KJwHqifEQnWQswbCXRVIfXWAmWtvI=";
+    sha256 = "sha256-KuaSAiXlqWRhFtX4C6vibbUiq43L83pZX+yM9L7Ej68=";
   };
 
   nativeBuildInputs = with python3.pkgs; [
@@ -27,6 +28,8 @@ python3.pkgs.buildPythonApplication rec {
 
   pythonRelaxDeps = [ "requests" "rich" "distro" "typer" ];
 
+  passthru.updateScript = nix-update-script { };
+
   doCheck = false;
 
   meta = with lib; {
diff --git a/pkgs/tools/networking/i2p/default.nix b/pkgs/tools/networking/i2p/default.nix
index 6cc64a171d53c..e1b73f1b3e691 100644
--- a/pkgs/tools/networking/i2p/default.nix
+++ b/pkgs/tools/networking/i2p/default.nix
@@ -11,13 +11,17 @@
 , java-service-wrapper
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "i2p";
-  version = "2.1.0";
+  version = "2.2.0";
 
   src = fetchurl {
-    url = "https://files.i2p-projekt.de/${version}/i2psource_${version}.tar.bz2";
-    sha256 = "sha256-gwmMEncgTFVpKEsys37xN2VrJ7/hXvkD7KLafCaSiNE=";
+    urls = map (mirror: "${mirror}/${finalAttrs.version}/i2psource_${finalAttrs.version}.tar.bz2") [
+      "https://download.i2p2.de/releases"
+      "https://files.i2p-projekt.de"
+      "https://download.i2p2.no/releases"
+    ];
+    sha256 = "sha256-5LoGpuKTWheZDwV6crjXnkUqJVamzv5QEtXdY0Zv7r8=";
   };
 
   buildInputs = [ jdk ant gettext which ];
@@ -64,4 +68,4 @@ stdenv.mkDerivation rec {
     platforms = [ "x86_64-linux" "i686-linux" ];
     maintainers = with maintainers; [ joelmo ];
   };
-}
+})
diff --git a/pkgs/tools/security/feroxbuster/default.nix b/pkgs/tools/security/feroxbuster/default.nix
index bc927a522aa75..8667064e153da 100644
--- a/pkgs/tools/security/feroxbuster/default.nix
+++ b/pkgs/tools/security/feroxbuster/default.nix
@@ -9,13 +9,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "feroxbuster";
-  version = "2.9.2";
+  version = "2.9.3";
 
   src = fetchFromGitHub {
     owner = "epi052";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-HSZqqZngXs5ACsk9xzaqBWK5mUxPyGx3qJOtTURXPgg=";
+    hash = "sha256-Z97CAfGnNTQmJd2zMlvGfk5jW9zHAB/efqYoYgVRfMc=";
   };
 
   # disable linker overrides on aarch64-linux
@@ -23,7 +23,7 @@ rustPlatform.buildRustPackage rec {
     rm .cargo/config
   '';
 
-  cargoHash = "sha256-pisMqSgW6uPlBXgTUqJBJya84dRmbOJbEYYezuut6Wo=";
+  cargoHash = "sha256-siLyPPSTBaZ4vpfzeKVlrqIdFMI5z3hRA8c2lRsBAGM=";
 
   OPENSSL_NO_VENDOR = true;
 
diff --git a/pkgs/tools/security/vault/default.nix b/pkgs/tools/security/vault/default.nix
index 266ed3f5c8837..42eca27fb5943 100644
--- a/pkgs/tools/security/vault/default.nix
+++ b/pkgs/tools/security/vault/default.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "vault";
-  version = "1.13.0";
+  version = "1.13.1";
 
   src = fetchFromGitHub {
     owner = "hashicorp";
     repo = "vault";
     rev = "v${version}";
-    sha256 = "sha256-F9Ki+3jMkJ+CI2yQmrnqT98xJqSSKQTtYHxQTYdfNbQ=";
+    sha256 = "sha256-bYZghlQi2p3XnKWH3H2sehds/XSMW8pbzBophNMa5q4=";
   };
 
-  vendorHash = "sha256-Ny4TTa67x/mwTclZrtPoWU6nHu5q4KafP1s4rvk21Hs=";
+  vendorHash = "sha256-mNnStWxrSR455zGWkj4dLDFk/kdOXYgk8LKB0wy7K5M=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 2ac264a61347c..bda9ad0a47bf2 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -18811,6 +18811,8 @@ with pkgs;
 
   semantik = libsForQt5.callPackage ../applications/office/semantik { };
 
+  sca2d = callPackage ../development/tools/sca2d {  };
+
   sconsPackages = dontRecurseIntoAttrs (callPackage ../development/tools/build-managers/scons { });
   scons = sconsPackages.scons_latest;
 
@@ -26360,6 +26362,10 @@ with pkgs;
 
   fwts = callPackage ../os-specific/linux/fwts { };
 
+  gasket = callPackage ../os-specific/linux/gasket {
+    inherit (linuxPackages) kernel;
+  };
+
   gobi_loader = callPackage ../os-specific/linux/gobi_loader { };
 
   libossp_uuid = callPackage ../development/libraries/libossp-uuid { };
@@ -30621,6 +30627,8 @@ with pkgs;
 
   grisbi = callPackage ../applications/office/grisbi { gtk = gtk3; };
 
+  gscreenshot = callPackage ../applications/graphics/gscreenshot { };
+
   gtkpod = callPackage ../applications/audio/gtkpod { };
 
   q4wine = libsForQt5.callPackage ../applications/misc/q4wine { };