diff --git a/doc/hooks/postgresql-test-hook.section.md b/doc/hooks/postgresql-test-hook.section.md
index c53d841883e5..8b37ca1e4b3e 100644
--- a/doc/hooks/postgresql-test-hook.section.md
+++ b/doc/hooks/postgresql-test-hook.section.md
@@ -46,6 +46,12 @@ Bash-only variables:
  - `postgresqlEnableTCP`: set to `1` to enable TCP listening. Flaky; not recommended.
  - `postgresqlStartCommands`: defaults to `pg_ctl start`.
 
+## Hooks {#sec-postgresqlTestHook-hooks}
+
+A number of additional hooks are ran in postgresqlTestHook
+
+ - `postgresqlTestSetupPost`: ran after postgresql has been set up.
+
 ## TCP and the Nix sandbox {#sec-postgresqlTestHook-tcp}
 
 `postgresqlEnableTCP` relies on network sandboxing, which is not available on macOS and some custom Nix installations, resulting in flaky tests.
diff --git a/lib/attrsets.nix b/lib/attrsets.nix
index 1a7b90593b1d..1a51225a80ed 100644
--- a/lib/attrsets.nix
+++ b/lib/attrsets.nix
@@ -480,8 +480,13 @@ rec {
 
 
   /* Like `mapAttrs`, except that it recursively applies itself to
-     attribute sets.  Also, the first argument of the argument
-     function is a *list* of the names of the containing attributes.
+     the *leaf* attributes of a potentially-nested attribute set:
+     the second argument of the function will never be an attrset.
+     Also, the first argument of the argument function is a *list*
+     of the attribute names that form the path to the leaf attribute.
+
+     For a function that gives you control over what counts as a leaf,
+     see `mapAttrsRecursiveCond`.
 
      Example:
        mapAttrsRecursive (path: value: concatStringsSep "-" (path ++ [value]))
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index e11e93f9735b..7311dadb1eef 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -3747,12 +3747,6 @@
       fingerprint = "A8DF 1326 9E5D 9A38 E57C  FAC2 9D20 F650 3E33 8888";
     }];
   };
-  doublec = {
-    email = "chris.double@double.co.nz";
-    github = "doublec";
-    githubId = 16599;
-    name = "Chris Double";
-  };
   dpaetzel = {
     email = "david.paetzel@posteo.de";
     github = "dpaetzel";
@@ -9150,6 +9144,12 @@
       fingerprint = "D709 03C8 0BE9 ACDC 14F0  3BFB 77BF E531 397E DE94";
     }];
   };
+  mdr = {
+    email = "MattRussellUK@gmail.com";
+    github = "mdr";
+    githubId = 241257;
+    name = "Matt Russell";
+  };
   meain = {
     email = "mail@meain.io";
     matrix = "@meain:matrix.org";
diff --git a/pkgs/applications/graphics/json-plot/default.nix b/pkgs/applications/graphics/json-plot/default.nix
index 9b43518a87d2..39c4b45cd1d6 100644
--- a/pkgs/applications/graphics/json-plot/default.nix
+++ b/pkgs/applications/graphics/json-plot/default.nix
@@ -1,10 +1,9 @@
 { lib
 , fetchFromGitHub
-, buildGoPackage
+, fetchpatch
+, buildGoModule
 }:
-# upstream is pretty stale, but it still works, so until they merge module
-# support we have to use gopath: see sgreben/jp#29
-buildGoPackage rec {
+buildGoModule rec {
   pname = "json-plot";
   version = "1.1.12";
 
@@ -15,7 +14,17 @@ buildGoPackage rec {
     hash = "sha256-WWARAh/CF3lGli3VLRzAGaCA8xQyryPi8WcuwvdInjk=";
   };
 
-  goPackagePath = "github.com/sgreben/jp";
+  vendorHash = "sha256-EPrlaUHAGATNFv3qgWKGmJdu9EHsV/0DJKEvQck+fWc=";
+
+  patches = [
+    # Add Go Modules support
+    (fetchpatch {
+      url = "https://github.com/sgreben/jp/commit/9516fb4d7c5b011071b4063ea8e8e9667e57a777.patch";
+      hash = "sha256-Vz5HnStrCpMN1L7dne7JDX5F57up3EBPPf/9hN9opRc=";
+    })
+  ];
+
+  ldflags = [ "-s" "-w" ];
 
   meta = with lib; {
     description = "Dead simple terminal plots from JSON (or CSV) data. Bar charts, line charts, scatter plots, histograms and heatmaps are supported.";
diff --git a/pkgs/applications/graphics/lazpaint/default.nix b/pkgs/applications/graphics/lazpaint/default.nix
index 37ad3387f834..91562bb5d49e 100644
--- a/pkgs/applications/graphics/lazpaint/default.nix
+++ b/pkgs/applications/graphics/lazpaint/default.nix
@@ -7,24 +7,24 @@ let
   bgrabitmap = fetchFromGitHub {
     owner = "bgrabitmap";
     repo = "bgrabitmap";
-    rev = "v11.2.5";
-    sha256 = "0w5pdihsxn039kalkf4cx23j69hz5r09qmhd358h2n74irv1r3x1";
+    rev = "v11.5.3";
+    sha256 = "sha256-qjBD9TVZQy1tKWHFWkuu6vdLjASzQb3+HRy0FLdd9a8=";
   };
   bgracontrols = fetchFromGitHub {
     owner = "bgrabitmap";
     repo = "bgracontrols";
-    rev = "v7.0";
-    sha256 = "0qz3cscrc9jvhrix1hbmzhdxv6mxk0mz9azr46canflsydda8fjy";
+    rev = "v7.6";
+    sha256 = "sha256-btg9DMdYg+C8h0H7MU+uoo2Kb4OeLHoxFYHAv7LbLBA=";
   };
 in stdenv.mkDerivation rec {
   pname = "lazpaint";
-  version = "7.1.5";
+  version = "7.2.2";
 
   src = fetchFromGitHub {
     owner = "bgrabitmap";
     repo = "lazpaint";
     rev = "v${version}";
-    sha256 = "0bpk3rlqzbxvgrxmrzs0hcrgwhsqnpjqv1kdd9cp09knimmksvy5";
+    sha256 = "sha256-J6s0GnGJ7twEYW5+B72bB3EX4AYvLnhSPLbdhZWzlkw=";
   };
 
   nativeBuildInputs = [ lazarus fpc makeWrapper ];
@@ -33,6 +33,10 @@ in stdenv.mkDerivation rec {
 
   NIX_LDFLAGS = "--as-needed -rpath ${lib.makeLibraryPath buildInputs}";
 
+  preConfigure = ''
+    patchShebangs configure
+  '';
+
   buildPhase = ''
     cp -r --no-preserve=mode ${bgrabitmap} bgrabitmap
     cp -r --no-preserve=mode ${bgracontrols} bgracontrols
@@ -47,6 +51,7 @@ in stdenv.mkDerivation rec {
 
   installPhase = ''
     # Reuse existing install script
+    substituteInPlace Makefile --replace "/bin/bash" $BASH
     cd lazpaint/release/debian
     substituteInPlace makedeb.sh --replace "rm -rf" "ls"
     patchShebangs ./makedeb.sh
@@ -64,6 +69,5 @@ in stdenv.mkDerivation rec {
     license = licenses.gpl3;
     platforms = platforms.linux;
     maintainers = with maintainers; [ ];
-    broken = true; # 2022-11-16
   };
 }
diff --git a/pkgs/applications/networking/instant-messengers/armcord/default.nix b/pkgs/applications/networking/instant-messengers/armcord/default.nix
index bfe7ca2fcbd8..0c43ffbeea91 100644
--- a/pkgs/applications/networking/instant-messengers/armcord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/armcord/default.nix
@@ -4,6 +4,7 @@
 , autoPatchelfHook
 , dpkg
 , makeWrapper
+, wrapGAppsHook
 , alsa-lib
 , at-spi2-atk
 , at-spi2-core
@@ -53,7 +54,9 @@ stdenv.mkDerivation rec {
         };
       }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
 
-  nativeBuildInputs = [ autoPatchelfHook dpkg makeWrapper ];
+  nativeBuildInputs = [ autoPatchelfHook dpkg makeWrapper wrapGAppsHook ];
+
+  dontWrapGApps = true;
 
   buildInputs = [
     alsa-lib
@@ -109,6 +112,8 @@ stdenv.mkDerivation rec {
 
     # Wrap the startup command
     makeWrapper $out/opt/ArmCord/armcord $out/bin/armcord \
+      "''${gappsWrapperArgs[@]}" \
+      --prefix XDG_DATA_DIRS : "${gtk3}/share/gsettings-schemas/${gtk3.name}/" \
       --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath buildInputs}" \
       --suffix PATH : ${lib.makeBinPath [ xdg-utils ]} \
       "''${gappsWrapperArgs[@]}"
diff --git a/pkgs/applications/networking/instant-messengers/discord/openasar.nix b/pkgs/applications/networking/instant-messengers/discord/openasar.nix
index 50ca9a3a0fb6..95f1625f1af1 100644
--- a/pkgs/applications/networking/instant-messengers/discord/openasar.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/openasar.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "openasar";
-  version = "unstable-2022-12-11";
+  version = "unstable-2023-01-13";
 
   src = fetchFromGitHub {
     owner = "GooseMod";
     repo = "OpenAsar";
-    rev = "0b1d4685cb2c94f42441fc616eb24e69eda04647";
-    hash = "sha256-cRYXgVgA5B9MaDGJIACJYjFNDAMajReKud0akiGBR4Q=";
+    rev = "40b27dd1b8dd48277207db1b165c220c3441484c";
+    hash = "sha256-tDJxcnbX0REu8DX+bQ7i4JzvLl6lRyB7+/dnAJI18Ss=";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/networking/instant-messengers/session-desktop/default.nix b/pkgs/applications/networking/instant-messengers/session-desktop/default.nix
index 6d2d79c6c7a2..bb7c49c3106a 100644
--- a/pkgs/applications/networking/instant-messengers/session-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/session-desktop/default.nix
@@ -8,12 +8,12 @@
 }:
 
 let
-  version = "1.10.3";
+  version = "1.10.4";
   pname = "session-desktop";
 
   src = fetchurl {
     url = "https://github.com/oxen-io/session-desktop/releases/download/v${version}/session-desktop-linux-x86_64-${version}.AppImage";
-    sha256 = "sha256-I9YyzfI8EqH8LZe5E5BnD9lGPAdQo++l3yRClfN7+pY=";
+    sha256 = "sha256-pSVTfZvjqWVgx3FAbIJO6e26GHZbhZBppxEptEuozQo=";
   };
   appimage = appimageTools.wrapType2 {
     inherit version pname src;
diff --git a/pkgs/applications/science/logic/ott/default.nix b/pkgs/applications/science/logic/ott/default.nix
index 4b7166ad9986..bbc96b2b681c 100644
--- a/pkgs/applications/science/logic/ott/default.nix
+++ b/pkgs/applications/science/logic/ott/default.nix
@@ -1,18 +1,18 @@
-{ lib, stdenv, fetchFromGitHub, pkg-config, ocaml, opaline }:
+{ lib, stdenv, fetchFromGitHub, pkg-config, ocamlPackages, opaline }:
 
 stdenv.mkDerivation rec {
   pname = "ott";
-  version = "0.32";
+  version = "0.33";
 
   src = fetchFromGitHub {
     owner = "ott-lang";
     repo = "ott";
     rev = version;
-    sha256 = "sha256-vdDsfsIi1gRW1Sowf29VyQ4C5UKyQZaVgS2uTb8VeW4=";
+    hash = "sha256-GzeEiok5kigcmfqf/K/UxvlKkl55zy0vOyiRZ2HyMiE=";
   };
 
   nativeBuildInputs = [ pkg-config opaline ];
-  buildInputs = [ ocaml ];
+  buildInputs = with ocamlPackages; [ ocaml findlib ocamlgraph ];
 
   installTargets = "ott.install";
 
diff --git a/pkgs/applications/version-management/smartgithg/default.nix b/pkgs/applications/version-management/smartgithg/default.nix
index 15d26406bb8d..a9aabd7a87da 100644
--- a/pkgs/applications/version-management/smartgithg/default.nix
+++ b/pkgs/applications/version-management/smartgithg/default.nix
@@ -13,11 +13,11 @@
 
 stdenv.mkDerivation rec {
   pname = "smartgithg";
-  version = "22.1.1";
+  version = "22.1.3";
 
   src = fetchurl {
     url = "https://www.syntevo.com/downloads/smartgit/smartgit-linux-${builtins.replaceStrings [ "." ] [ "_" ] version}.tar.gz";
-    sha256 = "sha256-twN1Clnj17A2IUOOhvs8hs6PuvC81j9GqF0yKIk3IkQ=";
+    sha256 = "sha256-TnpjRFInqmlY02fGi7oxoS4P1DzahryFvNLitJ5NjM4=";
   };
 
   nativeBuildInputs = [ wrapGAppsHook ];
@@ -87,6 +87,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "GUI for Git, Mercurial, Subversion";
     homepage = "https://www.syntevo.com/smartgit/";
+    changelog = "https://www.syntevo.com/smartgit/changelog.txt";
     license = licenses.unfree;
     platforms = platforms.linux;
     maintainers = with lib.maintainers; [ jraygauthier ];
diff --git a/pkgs/build-support/setup-hooks/postgresql-test-hook/postgresql-test-hook.sh b/pkgs/build-support/setup-hooks/postgresql-test-hook/postgresql-test-hook.sh
index b85d4203480f..3eec67d60feb 100644
--- a/pkgs/build-support/setup-hooks/postgresql-test-hook/postgresql-test-hook.sh
+++ b/pkgs/build-support/setup-hooks/postgresql-test-hook/postgresql-test-hook.sh
@@ -71,6 +71,8 @@ EOF
   echo 'setting up postgresql'
   eval "$postgresqlTestSetupCommands"
 
+  runHook postgresqlTestSetupPost
+
 }
 
 postgresqlStop() {
diff --git a/pkgs/build-support/setup-hooks/postgresql-test-hook/test.nix b/pkgs/build-support/setup-hooks/postgresql-test-hook/test.nix
index adb65fca7ca6..9881ed1016cc 100644
--- a/pkgs/build-support/setup-hooks/postgresql-test-hook/test.nix
+++ b/pkgs/build-support/setup-hooks/postgresql-test-hook/test.nix
@@ -14,6 +14,9 @@ stdenv.mkDerivation {
     INSERT INTO hello VALUES ('it '||'worked');
     SELECT * FROM hello;
   '';
+  postgresqlTestSetupPost = ''
+    TEST_POST_HOOK_RAN=1
+  '';
   checkPhase = ''
     runHook preCheck
     psql <$sqlPath | grep 'it worked'
@@ -21,7 +24,7 @@ stdenv.mkDerivation {
     runHook postCheck
   '';
   installPhase = ''
-    [[ $TEST_RAN == 1 ]]
+    [[ $TEST_RAN == 1 && $TEST_POST_HOOK_RAN == 1 ]]
     touch $out
   '';
 }
diff --git a/pkgs/desktops/pantheon/apps/appcenter/default.nix b/pkgs/desktops/pantheon/apps/appcenter/default.nix
index 6516db101eb5..4fb9768ef7ee 100644
--- a/pkgs/desktops/pantheon/apps/appcenter/default.nix
+++ b/pkgs/desktops/pantheon/apps/appcenter/default.nix
@@ -25,15 +25,21 @@
 
 stdenv.mkDerivation rec {
   pname = "appcenter";
-  version = "4.0.0";
+  version = "7.0.0";
 
   src = fetchFromGitHub {
     owner = "elementary";
     repo = pname;
     rev = version;
-    sha256 = "sha256-6QWvDBhOxoK8HjmygV92WPDgq2Jbk4igWDbXrXc7/FQ=";
+    sha256 = "sha256-fRurEkatWbtGiTRNe6tA2NyYk1IRCBW8SKBSUm4FrO4=";
   };
 
+  patches = [
+    # Having a working nix packagekit backend will supersede this.
+    # https://github.com/NixOS/nixpkgs/issues/177946
+    ./disable-packagekit-backend.patch
+  ];
+
   nativeBuildInputs = [
     dbus # for pkg-config
     meson
diff --git a/pkgs/desktops/pantheon/apps/appcenter/disable-packagekit-backend.patch b/pkgs/desktops/pantheon/apps/appcenter/disable-packagekit-backend.patch
new file mode 100644
index 000000000000..76d6245628b7
--- /dev/null
+++ b/pkgs/desktops/pantheon/apps/appcenter/disable-packagekit-backend.patch
@@ -0,0 +1,167 @@
+diff --git a/src/Application.vala b/src/Application.vala
+index a1c4e0d4..35555946 100644
+--- a/src/Application.vala
++++ b/src/Application.vala
+@@ -180,9 +180,6 @@ public class AppCenter.App : Gtk.Application {
+     }
+ 
+     public override void activate () {
+-        if (fake_update_packages != null) {
+-            AppCenterCore.PackageKitBackend.get_default ().fake_packages = fake_update_packages;
+-        }
+ 
+         var client = AppCenterCore.Client.get_default ();
+ 
+@@ -200,12 +197,6 @@ public class AppCenter.App : Gtk.Application {
+ 
+         if (local_path != null) {
+             var file = File.new_for_commandline_arg (local_path);
+-
+-            try {
+-                local_package = AppCenterCore.PackageKitBackend.get_default ().add_local_component_file (file);
+-            } catch (Error e) {
+-                warning ("Failed to load local AppStream XML file: %s", e.message);
+-            }
+         }
+ 
+         if (active_window == null) {
+diff --git a/src/Core/BackendAggregator.vala b/src/Core/BackendAggregator.vala
+index 1747cd3b..20077394 100644
+--- a/src/Core/BackendAggregator.vala
++++ b/src/Core/BackendAggregator.vala
+@@ -26,8 +26,6 @@ public class AppCenterCore.BackendAggregator : Backend, Object {
+ 
+     construct {
+         backends = new Gee.ArrayList<unowned Backend> ();
+-        backends.add (PackageKitBackend.get_default ());
+-        backends.add (UbuntuDriversBackend.get_default ());
+         backends.add (FlatpakBackend.get_default ());
+ 
+         unowned Gtk.Application app = (Gtk.Application) GLib.Application.get_default ();
+diff --git a/src/Core/Package.vala b/src/Core/Package.vala
+index 40fa8262..e6b90dd9 100644
+--- a/src/Core/Package.vala
++++ b/src/Core/Package.vala
+@@ -327,23 +327,13 @@ public class AppCenterCore.Package : Object {
+     public string origin_description {
+         owned get {
+             unowned string origin = component.get_origin ();
+-            if (backend is PackageKitBackend) {
+-                if (origin == APPCENTER_PACKAGE_ORIGIN) {
+-                    return _("AppCenter");
+-                } else if (origin == ELEMENTARY_STABLE_PACKAGE_ORIGIN) {
+-                    return _("elementary Updates");
+-                } else if (origin.has_prefix ("ubuntu-")) {
+-                    return _("Ubuntu (non-curated)");
+-                }
+-            } else if (backend is FlatpakBackend) {
++            if (backend is FlatpakBackend) {
+                 var fp_package = this as FlatpakPackage;
+                 if (fp_package == null) {
+                     return origin;
+                 }
+ 
+                 return fp_package.remote_title;
+-            } else if (backend is UbuntuDriversBackend) {
+-                return _("Ubuntu Drivers");
+             }
+ 
+             return _("Unknown Origin (non-curated)");
+@@ -435,9 +425,7 @@ public class AppCenterCore.Package : Object {
+ 
+         // The version on a PackageKit package comes from the package not AppStream, so only reset the version
+         // on other backends
+-        if (!(backend is PackageKitBackend)) {
+-            _latest_version = null;
+-        }
++        _latest_version = null;
+ 
+         this.component = component;
+     }
+diff --git a/src/Core/UpdateManager.vala b/src/Core/UpdateManager.vala
+index 4d844abc..457137eb 100644
+--- a/src/Core/UpdateManager.vala
++++ b/src/Core/UpdateManager.vala
+@@ -71,35 +71,9 @@ public class AppCenterCore.UpdateManager : Object {
+             installed_package.update_state ();
+         }
+ 
+-        Pk.Results pk_updates;
+-        unowned PackageKitBackend client = PackageKitBackend.get_default ();
+-        try {
+-            pk_updates = yield client.get_updates (cancellable);
+-        } catch (Error e) {
+-            warning ("Unable to get updates from PackageKit backend: %s", e.message);
+-            return 0;
+-        }
+-
+         uint os_count = 0;
+         string os_desc = "";
+ 
+-        var package_array = pk_updates.get_package_array ();
+-        debug ("PackageKit backend reports %d updates", package_array.length);
+-
+-        package_array.foreach ((pk_package) => {
+-            var pkg_name = pk_package.get_name ();
+-            debug ("Added %s to OS updates", pkg_name);
+-            os_count++;
+-            unowned string pkg_summary = pk_package.get_summary ();
+-            unowned string pkg_version = pk_package.get_version ();
+-            os_desc += Markup.printf_escaped (
+-                " • %s\n\t%s\n\t%s\n",
+-                pkg_name,
+-                pkg_summary,
+-                _("Version: %s").printf (pkg_version)
+-            );
+-        });
+-
+         os_updates.component.set_pkgnames ({});
+         os_updates.change_information.clear_update_info ();
+ 
+@@ -207,30 +181,13 @@ public class AppCenterCore.UpdateManager : Object {
+             count += 1;
+         }
+ 
+-        pk_updates.get_details_array ().foreach ((pk_detail) => {
+-            var pk_package = new Pk.Package ();
+-            try {
+-                pk_package.set_id (pk_detail.get_package_id ());
+-                var pkg_name = pk_package.get_name ();
+-
+-                var pkgnames = os_updates.component.pkgnames;
+-                pkgnames += pkg_name;
+-                os_updates.component.pkgnames = pkgnames;
+-
+-                os_updates.change_information.updatable_packages.@set (client, pk_package.get_id ());
+-                os_updates.change_information.size += pk_detail.size;
+-            } catch (Error e) {
+-                critical (e.message);
+-            }
+-        });
+-
+         os_updates.update_state ();
+         runtime_updates.update_state ();
+         return count;
+     }
+ 
+     public void update_restart_state () {
+-        var should_restart = restart_file.query_exists () || PackageKitBackend.get_default ().is_restart_required ();
++        var should_restart = restart_file.query_exists ();
+ 
+         if (should_restart) {
+             if (!restart_required) {
+diff --git a/src/meson.build b/src/meson.build
+index e0ef5342..14319492 100644
+--- a/src/meson.build
++++ b/src/meson.build
+@@ -12,10 +12,8 @@ appcenter_files = files(
+     'Core/FlatpakBackend.vala',
+     'Core/Job.vala',
+     'Core/Package.vala',
+-    'Core/PackageKitBackend.vala',
+     'Core/ScreenshotCache.vala',
+     'Core/Task.vala',
+-    'Core/UbuntuDriversBackend.vala',
+     'Core/UpdateManager.vala',
+     'Dialogs/InstallFailDialog.vala',
+     'Dialogs/StripeDialog.vala',
diff --git a/pkgs/desktops/pantheon/apps/elementary-code/default.nix b/pkgs/desktops/pantheon/apps/elementary-code/default.nix
index 4a33fc2e04a3..388feb83cfe7 100644
--- a/pkgs/desktops/pantheon/apps/elementary-code/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-code/default.nix
@@ -28,21 +28,21 @@
 
 stdenv.mkDerivation rec {
   pname = "elementary-code";
-  version = "6.2.0";
+  version = "7.0.0";
 
   src = fetchFromGitHub {
     owner = "elementary";
     repo = "code";
     rev = version;
-    sha256 = "sha256-QhJNRhYgGbPMd7B1X3kG+pnC/lGUoF7gc7O1PdG49LI=";
+    sha256 = "sha256-6ZOdlOCIDy5aWQre15+SrTH/vhY9OeTffY/uTSroELc=";
   };
 
   patches = [
-    # Fix drag and drop of accented text and between tabs
-    # https://github.com/elementary/code/pull/1194
+    # Fix global search action disabled at startup
+    # https://github.com/elementary/code/pull/1254
     (fetchpatch {
-      url = "https://github.com/elementary/code/commit/1ed7b590768ea9cb5b4658e27d9dc7ac224442ae.patch";
-      sha256 = "sha256-VrYcEbkzQKi5gFB/Vw/0NITZvSXKXfuEv2R3m0VALVM=";
+      url = "https://github.com/elementary/code/commit/1e75388b07c060cc10ecd612076f235b1833fab8.patch";
+      sha256 = "sha256-8Djh1orMcmICdYwQFENJCaYlXK0E52NhCmuhlHCz7oM=";
     })
   ];
 
diff --git a/pkgs/development/compilers/go/1.18.nix b/pkgs/development/compilers/go/1.18.nix
index 4a1e516ff1ce..3c089f02920a 100644
--- a/pkgs/development/compilers/go/1.18.nix
+++ b/pkgs/development/compilers/go/1.18.nix
@@ -18,7 +18,7 @@
 
 let
   useGccGoBootstrap = stdenv.buildPlatform.isMusl || stdenv.buildPlatform.isRiscV;
-  goBootstrap = if useGccGoBootstrap then buildPackages.gccgo else buildPackages.callPackage ./bootstrap116.nix { };
+  goBootstrap = if useGccGoBootstrap then buildPackages.gccgo12 else buildPackages.callPackage ./bootstrap116.nix { };
 
   skopeoTest = skopeo.override { buildGoModule = buildGo118Module; };
 
diff --git a/pkgs/development/compilers/go/1.19.nix b/pkgs/development/compilers/go/1.19.nix
index b1d45536321e..84a6059581e7 100644
--- a/pkgs/development/compilers/go/1.19.nix
+++ b/pkgs/development/compilers/go/1.19.nix
@@ -18,7 +18,7 @@
 
 let
   useGccGoBootstrap = stdenv.buildPlatform.isMusl || stdenv.buildPlatform.isRiscV;
-  goBootstrap = if useGccGoBootstrap then buildPackages.gccgo else buildPackages.callPackage ./bootstrap116.nix { };
+  goBootstrap = if useGccGoBootstrap then buildPackages.gccgo12 else buildPackages.callPackage ./bootstrap116.nix { };
 
   skopeoTest = skopeo.override { buildGoModule = buildGo119Module; };
 
diff --git a/pkgs/development/compilers/go/1.20.nix b/pkgs/development/compilers/go/1.20.nix
index ec2669ed868f..be569ed688c9 100644
--- a/pkgs/development/compilers/go/1.20.nix
+++ b/pkgs/development/compilers/go/1.20.nix
@@ -18,7 +18,7 @@
 
 let
   useGccGoBootstrap = stdenv.buildPlatform.isMusl || stdenv.buildPlatform.isRiscV;
-  goBootstrap = if useGccGoBootstrap then buildPackages.gccgo else buildPackages.callPackage ./bootstrap117.nix { };
+  goBootstrap = if useGccGoBootstrap then buildPackages.gccgo12 else buildPackages.callPackage ./bootstrap117.nix { };
 
   skopeoTest = skopeo.override { buildGoModule = buildGo120Module; };
 
diff --git a/pkgs/development/embedded/platformio/default.nix b/pkgs/development/embedded/platformio/default.nix
index 241914fa3e1e..6fd8592a12cf 100644
--- a/pkgs/development/embedded/platformio/default.nix
+++ b/pkgs/development/embedded/platformio/default.nix
@@ -3,14 +3,14 @@
 let
   callPackage = newScope self;
 
-  version = "6.1.5";
+  version = "6.1.6";
 
   # pypi tarballs don't contain tests - https://github.com/platformio/platformio-core/issues/1964
   src = fetchFromGitHub {
     owner = "platformio";
     repo = "platformio-core";
     rev = "v${version}";
-    sha256 = "sha256-7Wx3O2zL5Dlbk7rooiHutpN63kAjhuYijgsZru+oaOI=";
+    sha256 = "sha256-BEeMfdmAWqFbQUu8YKKrookQVgmhfZBqXnzeb2gfhms=";
   };
 
   self = {
diff --git a/pkgs/development/embedded/platformio/use-local-spdx-license-list.patch b/pkgs/development/embedded/platformio/use-local-spdx-license-list.patch
index 1f809822cb58..6db8585a55f3 100644
--- a/pkgs/development/embedded/platformio/use-local-spdx-license-list.patch
+++ b/pkgs/development/embedded/platformio/use-local-spdx-license-list.patch
@@ -6,13 +6,13 @@ index 1e5f935a..26d1ac6a 100644
      @staticmethod
      @memoized(expire="1h")
      def load_spdx_licenses():
--        version = "3.18"
+-        version = "3.19"
 -        spdx_data_url = (
 -            "https://raw.githubusercontent.com/spdx/license-list-data/"
 -            "v%s/json/licenses.json" % version
 -        )
 -        return json.loads(fetch_remote_content(spdx_data_url))
-+        # version = "3.18"
++        # version = "3.19"
 +        # spdx_data_url = (
 +            # "https://raw.githubusercontent.com/spdx/license-list-data/"
 +            # "v%s/json/licenses.json" % version
diff --git a/pkgs/development/interpreters/self/default.nix b/pkgs/development/interpreters/self/default.nix
index 58cac6bbe9b1..0da843d3f1a3 100644
--- a/pkgs/development/interpreters/self/default.nix
+++ b/pkgs/development/interpreters/self/default.nix
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
     description = "A prototype-based dynamic object-oriented programming language, environment, and virtual machine";
     homepage = "https://selflanguage.org/";
     license = licenses.bsd3;
-    maintainers = [ maintainers.doublec ];
+    maintainers = [ ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/development/libraries/libpcap/default.nix b/pkgs/development/libraries/libpcap/default.nix
index 443e4de04d9e..312e1dbf87cd 100644
--- a/pkgs/development/libraries/libpcap/default.nix
+++ b/pkgs/development/libraries/libpcap/default.nix
@@ -10,8 +10,6 @@
 , withRemote ? false
 }:
 
-with lib;
-
 stdenv.mkDerivation rec {
   pname = "libpcap";
   version = "1.10.1";
@@ -21,20 +19,20 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-7ShfSsyvBTRPkJdXV7Pb/ncrpB0cQBwmSLf6RbcRvdQ=";
   };
 
-  buildInputs = optionals withRemote [ libxcrypt ];
+  buildInputs = lib.optionals withRemote [ libxcrypt ];
 
   nativeBuildInputs = [ flex bison ]
-    ++ optionals withBluez [ bluez.dev pkg-config ];
+    ++ lib.optionals withBluez [ bluez.dev pkg-config ];
 
   # We need to force the autodetection because detection doesn't
   # work in pure build environments.
   configureFlags = [
     "--with-pcap=${if stdenv.isLinux then "linux" else "bpf"}"
-  ] ++ optionals stdenv.isDarwin [
+  ] ++ lib.optionals stdenv.isDarwin [
     "--disable-universal"
-  ] ++ optionals withRemote [
+  ] ++ lib.optionals withRemote [
     "--enable-remote"
-  ] ++ optionals (stdenv.hostPlatform == stdenv.buildPlatform)
+  ] ++ lib.optionals (stdenv.hostPlatform == stdenv.buildPlatform)
     [ "ac_cv_linux_vers=2" ];
 
   postInstall = ''
@@ -43,7 +41,7 @@ stdenv.mkDerivation rec {
     fi
   '';
 
-  meta = {
+  meta = with lib; {
     homepage = "https://www.tcpdump.org";
     description = "Packet Capture Library";
     platforms = platforms.unix;
diff --git a/pkgs/development/libraries/mdds/default.nix b/pkgs/development/libraries/mdds/default.nix
index edce9518c3c5..23059b91e7c0 100644
--- a/pkgs/development/libraries/mdds/default.nix
+++ b/pkgs/development/libraries/mdds/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mdds";
-  version = "2.1.0";
+  version = "2.0.3";
 
   src = fetchFromGitLab {
     owner = "mdds";
     repo = "mdds";
     rev = finalAttrs.version;
-    hash = "sha256-RZ2wGwle4raWlogc5X+VEeriPGS0Nqs7CWGENFEotvs=";
+    hash = "sha256-Y9uBJKM34UTEj/3c1w69QHhvwFcMNlAohEco0O0B+xI=";
   };
 
   nativeBuildInputs = [ autoreconfHook ];
diff --git a/pkgs/development/ocaml-modules/ca-certs/default.nix b/pkgs/development/ocaml-modules/ca-certs/default.nix
index 6c6fb87cf3dc..963989cb2236 100644
--- a/pkgs/development/ocaml-modules/ca-certs/default.nix
+++ b/pkgs/development/ocaml-modules/ca-certs/default.nix
@@ -5,21 +5,20 @@
 
 buildDunePackage rec {
   pname = "ca-certs";
-  version = "0.2.2";
+  version = "0.2.3";
 
-  minimumOCamlVersion = "4.07";
+  minimalOCamlVersion = "4.08";
 
   src = fetchurl {
-    url = "https://github.com/mirage/ca-certs/releases/download/v${version}/ca-certs-v${version}.tbz";
-    sha256 = "sha256-Tx53zBJemZh3ODh/8izahxDoJvXvNFLyAA8LMM1mhlI=";
+    url = "https://github.com/mirage/ca-certs/releases/download/v${version}/ca-certs-${version}.tbz";
+    hash = "sha256-0tjWRX2RXvbXg974Lzvl7C9W+S4gIU9Y7dY8nC/GDpw=";
   };
 
-  useDune2 = true;
+  duneVersion = "3";
 
   propagatedBuildInputs = [ bos fpath ptime mirage-crypto x509 astring logs ];
 
-  # Assumes nss-cacert < 3.74 https://github.com/mirage/ca-certs/issues/21
-  doCheck = false;
+  doCheck = true;
   nativeCheckInputs = [
     cacert    # for /etc/ssl/certs/ca-bundle.crt
     alcotest
diff --git a/pkgs/development/ocaml-modules/lutils/default.nix b/pkgs/development/ocaml-modules/lutils/default.nix
index c462eb9fe15d..38bd10077ce0 100644
--- a/pkgs/development/ocaml-modules/lutils/default.nix
+++ b/pkgs/development/ocaml-modules/lutils/default.nix
@@ -1,25 +1,24 @@
-{ lib, buildDunePackage, fetchurl, num }:
+{ lib, buildDunePackage, fetchurl, camlp-streams, num }:
 
 buildDunePackage rec {
   pname = "lutils";
-  version = "1.51.2";
-
-  useDune2 = true;
+  version = "1.54.1";
 
   minimalOCamlVersion = "4.02";
 
   src = fetchurl {
-    url = "http://www-verimag.imag.fr/DIST-TOOLS/SYNCHRONE/pool/lutils.1.51.2.tgz";
-    sha512 = "f94696be379c62e888410ec3d940c888ca4b607cf59c2e364e93a2a694da65ebe6d531107198b795e80eecc3c6865eedb02659c7e7c4e15c9b28d74aa35d09f8";
+    url = "http://www-verimag.imag.fr/DIST-TOOLS/SYNCHRONE/pool/lutils.v${version}.tgz";
+    hash = "sha512:d3c3b80286b1aa236ba922d9e18a133721fc80126c8b89520fb811dce9400e217aaa75b5d49e03988be7f6bf5f2e1a391d02ceeaa5ec0a0cd5ce218083a29514";
   };
 
   propagatedBuildInputs = [
-    num
+    camlp-streams num
   ];
 
   meta = with lib; {
     homepage = "https://gricad-gitlab.univ-grenoble-alpes.fr/verimag/synchrone/lutils/";
     description = "Tools and libs shared by Verimag/synchronous tools (lustre, lutin, rdbg)";
+    changelog = "https://gricad-gitlab.univ-grenoble-alpes.fr/verimag/synchrone/lutils/-/releases/v${version}";
     license = lib.licenses.cecill21;
     mainProgram = "gnuplot-rif";
   };
diff --git a/pkgs/development/python-modules/anybadge/default.nix b/pkgs/development/python-modules/anybadge/default.nix
index fd17aa0c11e7..0418de37a251 100644
--- a/pkgs/development/python-modules/anybadge/default.nix
+++ b/pkgs/development/python-modules/anybadge/default.nix
@@ -1,7 +1,10 @@
 { lib
-, fetchFromGitHub
 , buildPythonPackage
+, fetchFromGitHub
+, packaging
 , pytestCheckHook
+, pythonOlder
+, requests
 }:
 
 buildPythonPackage rec {
@@ -9,18 +12,35 @@ buildPythonPackage rec {
   version = "1.14.0";
   format = "setuptools";
 
+  disabled = pythonOlder "3.7";
+
   src = fetchFromGitHub {
     owner = "jongracecox";
     repo = pname;
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-+CkkFCShCYtxKiCWRQcgTFcekc/g7ujQj9MdnG1+a0A=";
+    hash = "sha256-+CkkFCShCYtxKiCWRQcgTFcekc/g7ujQj9MdnG1+a0A=";
   };
 
   # setup.py reads its version from the TRAVIS_TAG environment variable
   TRAVIS_TAG = "v${version}";
 
+  propagatedBuildInputs = [
+    packaging
+  ];
+
   nativeCheckInputs = [
     pytestCheckHook
+    requests
+  ];
+
+  disabledTests = [
+    # Comparison of CLI output fails
+    "test_module_same_output_as_main_cli"
+  ];
+
+  disabledTestPaths = [
+    # No anybadge-server
+    "tests/test_server.py"
   ];
 
   pythonImportsCheck = [
@@ -30,6 +50,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python tool for generating badges for your projects";
     homepage = "https://github.com/jongracecox/anybadge";
+    changelog = "https://github.com/jongracecox/anybadge/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ fabiangd ];
   };
diff --git a/pkgs/development/python-modules/bthome-ble/default.nix b/pkgs/development/python-modules/bthome-ble/default.nix
index adef9006fb7e..9baacd74d9b4 100644
--- a/pkgs/development/python-modules/bthome-ble/default.nix
+++ b/pkgs/development/python-modules/bthome-ble/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "bthome-ble";
-  version = "2.5.0";
+  version = "2.5.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-nNvPSp1Ij7JPXVFt8ediNtJaiuIDxRQFl3gySivJdqs=";
+    hash = "sha256-xxdCuTSpGe89TjF0YPmD4i1Fx1WfaQTTataFRnbcaos=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/denonavr/default.nix b/pkgs/development/python-modules/denonavr/default.nix
index 0e4b9b60bc71..14fe85c6af51 100644
--- a/pkgs/development/python-modules/denonavr/default.nix
+++ b/pkgs/development/python-modules/denonavr/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "denonavr";
-  version = "0.10.12";
+  version = "0.11.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "scarface-4711";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-QNiDoPjOuwwAgUqDzXHzn0BE9bwXQrQKAIFlHCywl88=";
+    hash = "sha256-0zclIoEGKjA8Ro8k+HYX/d77U+ntQZv0vq6gC4Sa7zE=";
   };
 
   propagatedBuildInputs = [
@@ -49,6 +49,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Automation Library for Denon AVR receivers";
     homepage = "https://github.com/scarface-4711/denonavr";
+    changelog = "https://github.com/ol-iver/denonavr/releases/tag/${version}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ colemickens ];
   };
diff --git a/pkgs/development/python-modules/fakeredis/default.nix b/pkgs/development/python-modules/fakeredis/default.nix
index 0352a4e7d174..e2c64333df02 100644
--- a/pkgs/development/python-modules/fakeredis/default.nix
+++ b/pkgs/development/python-modules/fakeredis/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "fakeredis";
-  version = "2.4.0";
+  version = "2.5.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "dsoftwareinc";
     repo = "fakeredis-py";
     rev = "refs/tags/v${version}";
-    hash = "sha256-LKUDwx3EEcOQFhUjTe5xm3AQRuwTGsYY27Vmg2R9ofc=";
+    hash = "sha256-yb6Tuko7swrrFRQmtXAhm1kl16O813epOOCzOMEg58E=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/flowlogs_reader/default.nix b/pkgs/development/python-modules/flowlogs_reader/default.nix
index accc4472b43c..50bcdc78e14f 100644
--- a/pkgs/development/python-modules/flowlogs_reader/default.nix
+++ b/pkgs/development/python-modules/flowlogs_reader/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "flowlogs-reader";
-  version = "4.0.0";
+  version = "5.0.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     repo = pname;
     # https://github.com/obsrvbl/flowlogs-reader/issues/57
     rev = "refs/tags/v${version}";
-    hash = "sha256-PGyuzOhq1TC/nGsGJYQYTDpcsYzcwNPiaHWd66tfzQQ=";
+    hash = "sha256-XHRibTSzFzWPz50elz+KdbCwTrd1DKfVMSg6UamNbzc=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/geoalchemy2/default.nix b/pkgs/development/python-modules/geoalchemy2/default.nix
index 4b375abe89eb..0e18c64f44af 100644
--- a/pkgs/development/python-modules/geoalchemy2/default.nix
+++ b/pkgs/development/python-modules/geoalchemy2/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "geoalchemy2";
-  version = "0.12.5";
+  version = "0.13.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "GeoAlchemy2";
     inherit version;
-    hash = "sha256-McJQLc4xe1ezNeTrh1YtUB+jnkbHKL5RTZuGCR4I3Wc=";
+    hash = "sha256-VyRtRK6pC0xS+EwAb2dY0OGVHrkBjxBAmocUHwIVmxM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-asset/default.nix b/pkgs/development/python-modules/google-cloud-asset/default.nix
index de650d07ac1a..e32bcf970264 100644
--- a/pkgs/development/python-modules/google-cloud-asset/default.nix
+++ b/pkgs/development/python-modules/google-cloud-asset/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-asset";
-  version = "3.17.0";
+  version = "3.17.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-CsTfdEgDeHdrYWLqMt3WpYOcxT9BuQ2M8sqg0ZIwmvM=";
+    hash = "sha256-EFMiiPlHwKkc7tjOcbqiAlnb+3oBsTBlg6Ey0vvs+Mc=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-bigquery-datatransfer/default.nix b/pkgs/development/python-modules/google-cloud-bigquery-datatransfer/default.nix
index 32c3b74bec35..2c5d0a9a5474 100644
--- a/pkgs/development/python-modules/google-cloud-bigquery-datatransfer/default.nix
+++ b/pkgs/development/python-modules/google-cloud-bigquery-datatransfer/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-bigquery-datatransfer";
-  version = "3.10.0";
+  version = "3.10.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-R6CIL1CA3UR81kUeIlFGJaxDGO33GBKOzT4Qo2LWlQk=";
+    hash = "sha256-GcgJhFT3L5TlVZYXjQQ9eENRcv/V176hF86BSsN7K/A=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-datastore/default.nix b/pkgs/development/python-modules/google-cloud-datastore/default.nix
index 70e73d20aa1f..553b7a7dd143 100644
--- a/pkgs/development/python-modules/google-cloud-datastore/default.nix
+++ b/pkgs/development/python-modules/google-cloud-datastore/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-datastore";
-  version = "2.11.0";
+  version = "2.13.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-PSk6IYBfGL7g0FBCqUgT4T8k1IYprtLGQQQEybEO99o=";
+    hash = "sha256-ikstW53KrRr4vnmtbr0AOG8/kHaF8excJFbwclhCA7A=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-org-policy/default.nix b/pkgs/development/python-modules/google-cloud-org-policy/default.nix
index 17e1006b3d54..43b5b09810e1 100644
--- a/pkgs/development/python-modules/google-cloud-org-policy/default.nix
+++ b/pkgs/development/python-modules/google-cloud-org-policy/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-org-policy";
-  version = "1.7.0";
+  version = "1.7.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-V1Fpm8P4XD0USNNG1oD6OFrOeDcJyEvYPaHcWKQhLCQ=";
+    hash = "sha256-ivlerguhDb7zhRfizIPGQWwwLOUhyoj2xWAy9inSklQ=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-videointelligence/default.nix b/pkgs/development/python-modules/google-cloud-videointelligence/default.nix
index 093d728d33f1..b8019c03cc5f 100644
--- a/pkgs/development/python-modules/google-cloud-videointelligence/default.nix
+++ b/pkgs/development/python-modules/google-cloud-videointelligence/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-videointelligence";
-  version = "2.10.0";
+  version = "2.10.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-SzCzTYyvf85E7BDBV0lX4g0hiNyZ5Ebo1m+WR4AjoBk=";
+    hash = "sha256-HlmuzMOaCl7z9NBVI5HoCH1vltQCeel30B5roX/+2HE=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/graphene-django/default.nix b/pkgs/development/python-modules/graphene-django/default.nix
index 12ef2cc19a6b..3e8625ca6d41 100644
--- a/pkgs/development/python-modules/graphene-django/default.nix
+++ b/pkgs/development/python-modules/graphene-django/default.nix
@@ -1,5 +1,6 @@
 { lib
 , buildPythonPackage
+, pythonAtLeast
 , pythonOlder
 , fetchFromGitHub
 
@@ -22,6 +23,7 @@ buildPythonPackage rec {
   pname = "graphene-django";
   version = "3.0.0";
   format = "setuptools";
+
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
@@ -58,9 +60,18 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  disabledTests = lib.optionals (pythonAtLeast "3.11") [
+    # Pèython 3.11 support, https://github.com/graphql-python/graphene-django/pull/1365
+    "test_django_objecttype_convert_choices_enum_naming_collisions"
+    "test_django_objecttype_choices_custom_enum_name"
+    "test_django_objecttype_convert_choices_enum_list"
+    "test_schema_representation"
+  ];
+
   meta = with lib; {
     description = "Integrate GraphQL into your Django project";
     homepage = "https://github.com/graphql-python/graphene-django";
+    changelog = "https://github.com/graphql-python/graphene-django/releases/tag/v{version}";
     license = licenses.mit;
     maintainers = with maintainers; [ hexa ];
   };
diff --git a/pkgs/development/python-modules/hahomematic/default.nix b/pkgs/development/python-modules/hahomematic/default.nix
index 6181aa106a41..a5b2a8fffc28 100644
--- a/pkgs/development/python-modules/hahomematic/default.nix
+++ b/pkgs/development/python-modules/hahomematic/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "hahomematic";
-  version = "2023.1.6";
+  version = "2023.1.7";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "danielperna84";
     repo = pname;
     rev = "refs/tags/${version}";
-    sha256 = "sha256-bjONfnxJuqo0d/9K4VKyIurcpw5+RgyAij1Hm/mTeUc=";
+    sha256 = "sha256-n/j884ttxFCkNnpRuHquzDeWsJchHS0A13CR2CtO4lo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/jupyterlab/default.nix b/pkgs/development/python-modules/jupyterlab/default.nix
index 37f46414b91d..8ac600083f59 100644
--- a/pkgs/development/python-modules/jupyterlab/default.nix
+++ b/pkgs/development/python-modules/jupyterlab/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "jupyterlab";
-  version = "3.5.2";
+  version = "3.5.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-EKwJQhX/uHLd/74pgr8cA5p5/swybhkefMXv2E8zHa0=";
+    hash = "sha256-UeiJRIrhlO7vjlD2P1xPSH9yj0d77+Q26XSWcvdRHb4=";
   };
 
   nativeBuildInputs = [
@@ -44,6 +44,7 @@ buildPythonPackage rec {
   ];
 
   meta = with lib; {
+    changelog = "https://github.com/jupyterlab/jupyterlab/releases/tag/v${version}";
     description = "Jupyter lab environment notebook server extension";
     license = with licenses; [ bsd3 ];
     homepage = "https://jupyter.org/";
diff --git a/pkgs/development/python-modules/lightgbm/default.nix b/pkgs/development/python-modules/lightgbm/default.nix
index c59f28d6939d..01be9fb86511 100644
--- a/pkgs/development/python-modules/lightgbm/default.nix
+++ b/pkgs/development/python-modules/lightgbm/default.nix
@@ -1,4 +1,5 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , buildPythonPackage
 , fetchPypi
 , cmake
@@ -6,15 +7,19 @@
 , scipy
 , scikit-learn
 , llvmPackages ? null
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "lightgbm";
-  version = "3.3.3";
+  version = "3.3.5";
+  format = "other";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-hX5VmuhKIpY84rYhaCkpadIa3TC8kkaoTU5+7a5nlm0=";
+    hash = "sha256-ELj73PhR5PaKHwLzjZm9xEx8f7mxpi3PkkoNKf9zOVw=";
   };
 
   nativeBuildInputs = [
@@ -23,7 +28,10 @@ buildPythonPackage rec {
 
   dontUseCmakeConfigure = true;
 
-  buildInputs = lib.optionals stdenv.cc.isClang [ llvmPackages.openmp ];
+  buildInputs = lib.optionals stdenv.cc.isClang [
+    llvmPackages.openmp
+  ];
+
   propagatedBuildInputs = [
     numpy
     scipy
@@ -38,11 +46,15 @@ buildPythonPackage rec {
   # repository. It contains c++ tests which don't seem to wired up to
   # `make check`.
   doCheck = false;
-  pythonImportsCheck = [ "lightgbm" ];
+
+  pythonImportsCheck = [
+    "lightgbm"
+  ];
 
   meta = with lib; {
     description = "A fast, distributed, high performance gradient boosting (GBDT, GBRT, GBM or MART) framework";
     homepage = "https://github.com/Microsoft/LightGBM";
+    changelog = "https://github.com/microsoft/LightGBM/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ teh costrouc ];
   };
diff --git a/pkgs/development/python-modules/mailchecker/default.nix b/pkgs/development/python-modules/mailchecker/default.nix
index 3a58e64beaa8..24ed5999a78e 100644
--- a/pkgs/development/python-modules/mailchecker/default.nix
+++ b/pkgs/development/python-modules/mailchecker/default.nix
@@ -6,14 +6,14 @@
 
 buildPythonPackage rec {
   pname = "mailchecker";
-  version = "5.0.6";
+  version = "5.0.7";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-g70FjY0tc4KjgdVweuBBkFrByt8xlGPJEPz/OvTtjZk=";
+    hash = "sha256-u5htHCI10mn6AQDlAShMpbyI4PcqiRgpRvsy5Q3km+0=";
   };
 
   # Module has no tests
diff --git a/pkgs/development/python-modules/openai/default.nix b/pkgs/development/python-modules/openai/default.nix
index 8aa091a25c71..a5529af2ab15 100644
--- a/pkgs/development/python-modules/openai/default.nix
+++ b/pkgs/development/python-modules/openai/default.nix
@@ -23,7 +23,7 @@
 
 buildPythonPackage rec {
   pname = "openai";
-  version = "0.26.1";
+  version = "0.26.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7.1";
@@ -32,7 +32,7 @@ buildPythonPackage rec {
     owner = "openai";
     repo = "openai-python";
     rev = "v${version}";
-    hash = "sha256-M6ZaYTOBAwLogWPafSnBYw3rUry+sS9VwQWAM9tDfr8=";
+    hash = "sha256-rUXwrr8hgKwqJ/ittK2DOKaqxTAs8wKyVTSdEhfiWfI=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/promise/default.nix b/pkgs/development/python-modules/promise/default.nix
index a4797ff6d6cc..a9c4c416b7fc 100644
--- a/pkgs/development/python-modules/promise/default.nix
+++ b/pkgs/development/python-modules/promise/default.nix
@@ -1,23 +1,37 @@
-{ buildPythonPackage
+{ lib
+, buildPythonPackage
 , fetchFromGitHub
-, lib
-, six
-, pytestCheckHook
+, fetchpatch
 , mock
 , pytest-asyncio
+, pytestCheckHook
+, pythonOlder
+, six
 }:
 
 buildPythonPackage rec {
   pname = "promise";
   version = "2.3.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "syrusakbary";
     repo = "promise";
-    rev = "v${version}";
-    sha256 = "17mq1bm78xfl0x1g50ng502m5ldq6421rzz35hlqafsj0cq8dkp6";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-5s6GMANSO4UpLOP/HAQxuNFSBSjPgvJCB9R1dOoKuJ4=";
   };
 
+  patches = [
+    # Convert @asyncio.coroutine to async def, https://github.com/syrusakbary/promise/pull/99
+    (fetchpatch {
+      name = "use-async-def.patch";
+      url = "https://github.com/syrusakbary/promise/commit/3cde549d30b38dcff81b308e18c7f61783003791.patch";
+      hash = "sha256-XCbTo6RCv75nNrpbK3TFdV0h7tBJ0QK+WOAR8S8w9as=";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace tests/test_extra.py \
       --replace "assert_exc.traceback[-1].path.strpath" "str(assert_exc.traceback[-1].path)"
@@ -28,21 +42,24 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
-    pytestCheckHook
     mock
     pytest-asyncio
+    pytestCheckHook
   ];
 
   disabledTestPaths = [
     "tests/test_benchmark.py"
   ];
 
+  pythonImportsCheck = [
+    "promise"
+  ];
+
   meta = with lib; {
     description = "Ultra-performant Promise implementation in Python";
     homepage = "https://github.com/syrusakbary/promise";
+    changelog = "https://github.com/syrusakbary/promise/releases/tag/v${version}";
     license = licenses.mit;
-    maintainers = with maintainers; [
-      kamadorueda
-    ];
+    maintainers = with maintainers; [ kamadorueda ];
   };
 }
diff --git a/pkgs/development/python-modules/pylsp-mypy/default.nix b/pkgs/development/python-modules/pylsp-mypy/default.nix
index d5d03eb3ab44..02139d368247 100644
--- a/pkgs/development/python-modules/pylsp-mypy/default.nix
+++ b/pkgs/development/python-modules/pylsp-mypy/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "pylsp-mypy";
-  version = "0.6.4";
+  version = "0.6.5";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "Richardk2n";
     repo = "pylsp-mypy";
     rev = "refs/tags/${version}";
-    hash = "sha256-BpYg2noReHFgJ/5iQI09XUWNAN7UdcYgqpZ/IPr17Ao=";
+    hash = "sha256-LQ9Kw/dG3XA67WaVObE72fxERb21eZzk+MCqIp2Qy0o=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pynetbox/default.nix b/pkgs/development/python-modules/pynetbox/default.nix
index af1e0c171357..333f88e3f563 100644
--- a/pkgs/development/python-modules/pynetbox/default.nix
+++ b/pkgs/development/python-modules/pynetbox/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "pynetbox";
-  version = "7.0.0";
+  version = "7.0.1";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "netbox-community";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-PFSnINbXSnEo1gvntjfH6KCVa/LeaNrsiuWM4H+fOvQ=";
+    hash = "sha256-RAUM79lDz7oNV7Li987Sz7JoNz/feO6BsEcWO0u/Ub8=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
diff --git a/pkgs/development/python-modules/pyroute2/default.nix b/pkgs/development/python-modules/pyroute2/default.nix
index 2d9efdf39e2d..b232a0bd8f41 100644
--- a/pkgs/development/python-modules/pyroute2/default.nix
+++ b/pkgs/development/python-modules/pyroute2/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "pyroute2";
-  version = "0.7.3";
+  version = "0.7.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-cEEEDbHC0Yf7zNFRSFsSRMQddYvoIXhYR5RjcOtrtwY=";
+    hash = "sha256-d1rO/vTSrOdZHmIAAL3zg8cMi3lpgEhw9sLYIE+iF+A=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/python-engineio/default.nix b/pkgs/development/python-modules/python-engineio/default.nix
index 0337029e248e..f1a079d5896e 100644
--- a/pkgs/development/python-modules/python-engineio/default.nix
+++ b/pkgs/development/python-modules/python-engineio/default.nix
@@ -4,6 +4,7 @@
 , buildPythonPackage
 , eventlet
 , fetchFromGitHub
+, fetchpatch
 , iana-etc
 , libredirect
 , mock
@@ -24,10 +25,19 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "miguelgrinberg";
     repo = "python-engineio";
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
     hash = "sha256-fymO9WqkYaRsHKCJHQJpySHqZor2t8BfVrfYUfYoJno=";
   };
 
+  patches = [
+    # Address Python 3.11 mocking issue, https://github.com/miguelgrinberg/python-engineio/issues/279
+    (fetchpatch {
+      name = "mocking-issue-py311.patch";
+      url = "https://github.com/miguelgrinberg/python-engineio/commit/ac3911356fbe933afa7c11d56141f0e228c01528.patch";
+      hash = "sha256-LNMhjX8kqOI3y8XugCHxCPEC6lF83NROfIczXWiLuqY=";
+    })
+  ];
+
   nativeCheckInputs = [
     aiohttp
     eventlet
diff --git a/pkgs/development/python-modules/pyunifiprotect/default.nix b/pkgs/development/python-modules/pyunifiprotect/default.nix
index eaceb6eb31fe..e75e99ceb340 100644
--- a/pkgs/development/python-modules/pyunifiprotect/default.nix
+++ b/pkgs/development/python-modules/pyunifiprotect/default.nix
@@ -31,7 +31,7 @@
 
 buildPythonPackage rec {
   pname = "pyunifiprotect";
-  version = "4.6.1";
+  version = "4.6.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -40,7 +40,7 @@ buildPythonPackage rec {
     owner = "briis";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-5xHU4WC7HPDEJsfCX4bVsK3p6SWZ/fHH7APbFtDGC40=";
+    hash = "sha256-sEIjR6ScJNliJJJET06e22x5GMDrmB6fZAzyHr847sk=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/requests-aws4auth/default.nix b/pkgs/development/python-modules/requests-aws4auth/default.nix
index 9d074ca74c87..9819c3df60e8 100644
--- a/pkgs/development/python-modules/requests-aws4auth/default.nix
+++ b/pkgs/development/python-modules/requests-aws4auth/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "requests-aws4auth";
-  version = "1.1.2";
+  version = "1.2.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -19,8 +19,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "tedder";
     repo = pname;
-    rev = "v${version}";
-    hash = "sha256-/SqU/ojP9I4JXzR0c5tLzxx9UyNaVsON7LG/dbdeiH0=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-a3OY0Z5GGr3gYa5m4V6ukqQmjZuqtgZjmLGJxmFOPqU=";
   };
 
   propagatedBuildInputs = [
@@ -29,7 +29,9 @@ buildPythonPackage rec {
   ];
 
   passthru.optional-dependencies = {
-    httpx = [ httpx ];
+    httpx = [
+      httpx
+    ];
   };
 
   nativeCheckInputs = [
@@ -43,6 +45,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Amazon Web Services version 4 authentication for the Python Requests library";
     homepage = "https://github.com/sam-washington/requests-aws4auth";
+    changelog = "https://github.com/tedder/requests-aws4auth/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ basvandijk ];
   };
diff --git a/pkgs/development/python-modules/sfrbox-api/default.nix b/pkgs/development/python-modules/sfrbox-api/default.nix
index 12bf293a77d2..208e8b13a427 100644
--- a/pkgs/development/python-modules/sfrbox-api/default.nix
+++ b/pkgs/development/python-modules/sfrbox-api/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "sfrbox-api";
-  version = "0.0.4";
+  version = "0.0.5";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "hacf-fr";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-mdE7H17vbKwQS7JloYasap8qAjaacdLuDPvIPxJSUXI=";
+    hash = "sha256-6SwZAAWBnxeeunZwUAVQJBU8904czNVheBlRFg5yrOw=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/stone/default.nix b/pkgs/development/python-modules/stone/default.nix
index 1e20409b0ec9..a0d07fa51542 100644
--- a/pkgs/development/python-modules/stone/default.nix
+++ b/pkgs/development/python-modules/stone/default.nix
@@ -5,43 +5,53 @@
 , ply
 , pytestCheckHook
 , six
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "stone";
   version = "3.3.1";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
-  # pypi sdist misses requirements.txt
   src = fetchFromGitHub {
     owner = "dropbox";
     repo = pname;
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
     hash = "sha256-0FWdYbv+paVU3Wj6g9OrSNUB0pH8fLwTkhVIBPeFB/U=";
   };
 
   postPatch = ''
-    sed -i '/pytest-runner/d' setup.py
+    # https://github.com/dropbox/stone/issues/288
+    substituteInPlace stone/frontend/ir_generator.py \
+      --replace "inspect.getargspec" "inspect.getfullargspec"
+    substituteInPlace setup.py \
+      --replace "'pytest-runner == 5.2.0'," ""
   '';
 
-  propagatedBuildInputs = [ ply six ];
-
-  nativeCheckInputs = [ pytestCheckHook mock ];
-
-  # try to import from `test` directory, which is exported by the python interpreter
-  # and cannot be overridden without removing some py3 to py2 support
-  disabledTestPaths = [
-    "test/test_tsd_types.py"
-    "test/test_js_client.py"
+  propagatedBuildInputs = [
+    ply
+    six
   ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    mock
+  ];
+
   disabledTests = [
     "test_type_name_with_module"
   ];
 
-  pythonImportsCheck = [ "stone" ];
+  pythonImportsCheck = [
+    "stone"
+  ];
 
   meta = with lib; {
     description = "Official Api Spec Language for Dropbox";
     homepage = "https://github.com/dropbox/stone";
+    changelog = "https://github.com/dropbox/stone/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ jonringer ];
   };
diff --git a/pkgs/development/python-modules/types-pyyaml/default.nix b/pkgs/development/python-modules/types-pyyaml/default.nix
index 7198e4e923bd..f0b4056e2b58 100644
--- a/pkgs/development/python-modules/types-pyyaml/default.nix
+++ b/pkgs/development/python-modules/types-pyyaml/default.nix
@@ -5,13 +5,13 @@
 
 buildPythonPackage rec {
   pname = "types-pyyaml";
-  version = "6.0.12.2";
+  version = "6.0.12.3";
   format = "setuptools";
 
   src = fetchPypi {
     pname = "types-PyYAML";
     inherit version;
-    sha256 = "sha256-aECBmHHJLe6+aiBn+4AMEbigY2MutOPnVZFOerNgToM=";
+    sha256 = "sha256-F84Xs+rY8G5BajsdW43cbLgqQiuyACVN2LRpQ0sEX/w=";
   };
 
   # Module doesn't have tests
diff --git a/pkgs/development/tools/detekt/default.nix b/pkgs/development/tools/detekt/default.nix
new file mode 100644
index 000000000000..0c67c5dd66a9
--- /dev/null
+++ b/pkgs/development/tools/detekt/default.nix
@@ -0,0 +1,38 @@
+{ detekt, lib, stdenv, fetchurl, makeWrapper, jre_headless, testers }:
+stdenv.mkDerivation rec {
+  pname = "detekt";
+  version = "1.22.0";
+
+  jarfilename = "${pname}-${version}-executable.jar";
+
+  src = fetchurl {
+    url = "https://github.com/detekt/detekt/releases/download/v${version}/detekt-cli-${version}-all.jar";
+    sha256 = "sha256-NCOMBcAtk7cOlP3H8Bz/hfR/305j/DfaoFrwc504b/4=";
+  };
+
+  dontUnpack = true;
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D "$src" "$out/share/java/${jarfilename}"
+
+    makeWrapper ${jre_headless}/bin/java $out/bin/detekt \
+      --add-flags "-jar $out/share/java/${jarfilename}"
+
+    runHook postInstall
+  '';
+
+  passthru.tests.version = testers.testVersion { package = detekt; };
+
+  meta = with lib; {
+    description = "Static code analysis for Kotlin";
+    homepage = "https://detekt.dev/";
+    license = licenses.asl20;
+    platforms = jre_headless.meta.platforms;
+    maintainers = with maintainers; [ mdr ];
+    sourceProvenance = with sourceTypes; [ binaryBytecode ];
+  };
+}
diff --git a/pkgs/development/tools/gotags/default.nix b/pkgs/development/tools/gotags/default.nix
index c4c0b7cbb06f..9fa71187aa31 100644
--- a/pkgs/development/tools/gotags/default.nix
+++ b/pkgs/development/tools/gotags/default.nix
@@ -1,6 +1,6 @@
-{ lib, buildGoPackage, fetchFromGitHub }:
+{ lib, buildGoModule, fetchFromGitHub, fetchpatch }:
 
-buildGoPackage rec {
+buildGoModule rec {
   pname = "gotags";
   version = "1.4.1";
 
@@ -8,10 +8,20 @@ buildGoPackage rec {
     owner = "jstemmer";
     repo = pname;
     rev = "4c0c4330071a994fbdfdff68f412d768fbcca313";
-    sha256 = "sha256-cHTgt+zW6S6NDWBE6NxSXNPdn84CLD8WmqBe+uXN8sA=";
+    hash = "sha256-cHTgt+zW6S6NDWBE6NxSXNPdn84CLD8WmqBe+uXN8sA=";
   };
 
-  goPackagePath = "github.com/jstemmer/gotags";
+  vendorHash = null;
+
+  patches = [
+    # Add Go Modules support
+    (fetchpatch {
+      url = "https://github.com/jstemmer/gotags/commit/9146999bce9a88e15b5f123d1aa1613926dd9a9c.patch";
+      hash = "sha256-6v/Ws15y50S6iCI1c0kEw5WHSg+1WqVT4mwdQKoi5G8=";
+    })
+  ];
+
+  ldflags = [ "-s" "-w" ];
 
   meta = with lib; {
     description = "ctags-compatible tag generator for Go";
diff --git a/pkgs/development/tools/manifest-tool/default.nix b/pkgs/development/tools/manifest-tool/default.nix
new file mode 100644
index 000000000000..6282619535b9
--- /dev/null
+++ b/pkgs/development/tools/manifest-tool/default.nix
@@ -0,0 +1,51 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, git
+, stdenv
+, testers
+, manifest-tool
+}:
+
+buildGoModule rec {
+  pname = "manifest-tool";
+  version = "2.0.6";
+  gitCommit = "2ed9312726765567a84f2acc44a0c8a6e50f4b7a";
+  modRoot = "v2";
+
+  src = fetchFromGitHub {
+    owner = "estesp";
+    repo = "manifest-tool";
+    rev = "v${version}";
+    sha256 = "sha256-oopk++IdNF6msxOszT0fKxQABgWKbaQZ2aNH9chqWU0=";
+    leaveDotGit = true;
+    postFetch = ''
+      git -C $out rev-parse HEAD > $out/.git-revision
+      rm -rf $out/.git
+    '';
+  };
+
+  vendorHash = null;
+
+  nativeBuildInputs = [ git ];
+
+  preConfigure = ''
+    ldflags="-X main.gitCommit=$(cat .git-revision)"
+  '';
+
+  CGO_ENABLED = if stdenv.hostPlatform.isStatic then "0" else "1";
+  GO_EXTLINK_ENABLED = if stdenv.hostPlatform.isStatic then "0" else "1";
+  ldflags = lib.optionals stdenv.hostPlatform.isStatic [ "-w" "-extldflags" "-static" ];
+  tags = lib.optionals stdenv.hostPlatform.isStatic [ "netgo" ];
+
+  passthru.tests.version = testers.testVersion {
+    package = manifest-tool;
+  };
+
+  meta = with lib; {
+    description = "Command line tool to create and query container image manifest list/indexes";
+    homepage = "https://github.com/estesp/manifest-tool";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ tricktron ];
+  };
+}
diff --git a/pkgs/development/web/nodejs/v19.nix b/pkgs/development/web/nodejs/v19.nix
index 454d647dad2c..b9cd476a1941 100644
--- a/pkgs/development/web/nodejs/v19.nix
+++ b/pkgs/development/web/nodejs/v19.nix
@@ -9,8 +9,8 @@ let
 in
 buildNodejs {
   inherit enableNpm;
-  version = "19.4.0";
-  sha256 = "0qdj67dgxbjpllm2z9vm46c50s3dqk8a34hbp81vsa7mf3b42182";
+  version = "19.5.0";
+  sha256 = "sha256-KBMXvce6iVITi/jw9fB2SV95+G6FGmWb4fmD3sM8pXc=";
   patches = [
     ./revert-arm64-pointer-auth.patch
     ./disable-darwin-v8-system-instrumentation-node19.patch
diff --git a/pkgs/games/dwarf-fortress/wrapper/default.nix b/pkgs/games/dwarf-fortress/wrapper/default.nix
index 89f980f8d5bc..a4433821d20d 100644
--- a/pkgs/games/dwarf-fortress/wrapper/default.nix
+++ b/pkgs/games/dwarf-fortress/wrapper/default.nix
@@ -56,7 +56,11 @@ let
 
   settings_ = lib.recursiveUpdate {
     init = {
-      PRINT_MODE = if enableTextMode then "TEXT" else if enableTWBT then "TWBT" else null;
+      PRINT_MODE =
+        if enableTextMode then "TEXT"
+        else if enableTWBT then "TWBT"
+        else if stdenv.hostPlatform.isDarwin then "STANDARD" # https://www.bay12games.com/dwarves/mantisbt/view.php?id=11680
+        else null;
       INTRO = enableIntro;
       TRUETYPE = enableTruetype;
       FPS = enableFPS;
diff --git a/pkgs/os-specific/linux/waydroid/default.nix b/pkgs/os-specific/linux/waydroid/default.nix
index efa21cfb26b5..8955bcfa5126 100644
--- a/pkgs/os-specific/linux/waydroid/default.nix
+++ b/pkgs/os-specific/linux/waydroid/default.nix
@@ -4,12 +4,15 @@
 , dnsmasq
 , gawk
 , getent
+, gobject-introspection
+, gtk3
 , kmod
 , lxc
 , iproute2
 , nftables
 , util-linux
 , which
+, wrapGAppsHook
 , xclip
 }:
 
@@ -25,6 +28,15 @@ python3Packages.buildPythonApplication rec {
     sha256 = "sha256-0GBob9BUwiE5cFGdK8AdwsTjTOdc+AIWqUGN/gFfOqI=";
   };
 
+  buildInputs = [
+    gtk3
+  ];
+
+  nativeBuildInputs = [
+    gobject-introspection
+    wrapGAppsHook
+  ];
+
   propagatedBuildInputs = with python3Packages; [
     gbinder-python
     pyclip
@@ -35,9 +47,14 @@ python3Packages.buildPythonApplication rec {
   dontUsePipInstall = true;
   dontUseSetuptoolsCheck = true;
   dontWrapPythonPrograms = true;
+  dontWrapGApps = true;
 
   installPhase = ''
     make install PREFIX=$out USE_SYSTEMD=0 USE_NFTABLES=1
+  '';
+
+  preFixup = ''
+    makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
 
     wrapProgram $out/lib/waydroid/data/scripts/waydroid-net.sh \
        --prefix PATH ":" ${lib.makeBinPath [ dnsmasq getent iproute2 nftables ]}
diff --git a/pkgs/servers/eris-go/default.nix b/pkgs/servers/eris-go/default.nix
index 554aecfacbf8..3dbc3994e6d6 100644
--- a/pkgs/servers/eris-go/default.nix
+++ b/pkgs/servers/eris-go/default.nix
@@ -2,17 +2,17 @@
 
 buildGoModule rec {
   pname = "eris-go";
-  version = "20230114";
+  version = "20230123";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "eris";
     repo = pname;
     rev = version;
-    hash = "sha256-cJvSIeS9fKUJP5p7ZTH7Wi+UcBXeCS32Twhv6jBT+9Q=";
+    hash = "sha256-jdeh5lhbu2hxVNdnU0GiMsdXRi8004Xgu2/tgFhqPao=";
   };
 
-  vendorHash = "sha256-DDV7LUnGnf24qQ2I9I4MDUx87s1+yDhisVz/Jw4XU6k=";
+  vendorHash = "sha256-mLyPaX5rDw0rR4PXtzpLMOrsYwTH3Y+COcrvwH7/qdo=";
 
   postInstall = "ln -s $out/bin/eris-get $out/bin/eris-put";
   # eris-get is a multicall binary
diff --git a/pkgs/tools/admin/awscli2/default.nix b/pkgs/tools/admin/awscli2/default.nix
index 61d2e1ee1d8a..b1add5d14252 100644
--- a/pkgs/tools/admin/awscli2/default.nix
+++ b/pkgs/tools/admin/awscli2/default.nix
@@ -25,14 +25,14 @@ let
 in
 with py.pkgs; buildPythonApplication rec {
   pname = "awscli2";
-  version = "2.9.15"; # N.B: if you change this, check if overrides are still up-to-date
+  version = "2.9.17"; # N.B: if you change this, check if overrides are still up-to-date
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "aws-cli";
     rev = version;
-    hash = "sha256-yOqxz6ZsBV7iNKjG3NlV8SUHaezlchiUx8RRShRU6xo=";
+    hash = "sha256-5d/XEkM01SJj9M3e+5qbJrwWX+CU8fb097D45+Hp/Qc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/filesystems/gcsfuse/default.nix b/pkgs/tools/filesystems/gcsfuse/default.nix
index c0cd784aed47..02fa3de810b2 100644
--- a/pkgs/tools/filesystems/gcsfuse/default.nix
+++ b/pkgs/tools/filesystems/gcsfuse/default.nix
@@ -5,33 +5,28 @@
 
 buildGoModule rec {
   pname = "gcsfuse";
-  version = "0.41.10";
+  version = "0.41.12";
 
   src = fetchFromGitHub {
     owner = "googlecloudplatform";
     repo = "gcsfuse";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-rtBqXC1CTkbKDP6pzkRQ7GnM5f4xt6eUMW3n9wZu0hc=";
+    rev = "v${version}";
+    hash = "sha256-s28vtcNodc5IL8SnZLTgSQBTPUf0FiIAv3TxZXMDuYE=";
   };
 
-  vendorSha256 = null;
+  vendorHash = null;
 
-  subPackages = [
-    "."
-    "tools/mount_gcsfuse"
-  ];
+  subPackages = [ "." "tools/mount_gcsfuse" ];
 
-  ldflags = [
-    "-s"
-    "-w"
-    "-X main.gcsfuseVersion=${version}"
-  ];
+  ldflags = [ "-s" "-w" "-X main.gcsfuseVersion=${version}" ];
 
   preCheck =
-    let skippedTests = [
-      "Test_Main"
-      "TestFlags"
-    ]; in
+    let
+      skippedTests = [
+        "Test_Main"
+        "TestFlags"
+      ];
+    in
     ''
       # Disable flaky tests
       buildFlagsArray+=("-run" "[^(${builtins.concatStringsSep "|" skippedTests})]")
@@ -42,7 +37,7 @@ buildGoModule rec {
     ln -s $out/bin/mount_gcsfuse $out/bin/mount.fuse.gcsfuse
   '';
 
-  meta = with lib;{
+  meta = with lib; {
     description = "A user-space file system for interacting with Google Cloud Storage";
     homepage = "https://cloud.google.com/storage/docs/gcs-fuse";
     changelog = "https://github.com/GoogleCloudPlatform/gcsfuse/releases/tag/v${version}";
diff --git a/pkgs/tools/graphics/gmic-qt/default.nix b/pkgs/tools/graphics/gmic-qt/default.nix
index a937ea51784a..0e6d0b0adb4e 100644
--- a/pkgs/tools/graphics/gmic-qt/default.nix
+++ b/pkgs/tools/graphics/gmic-qt/default.nix
@@ -2,7 +2,6 @@
 , mkDerivation
 , variant ? "standalone"
 , fetchFromGitHub
-, fetchpatch
 , cmake
 , pkg-config
 , ninja
@@ -59,13 +58,13 @@ assert lib.assertMsg (builtins.all (d: d != null) variants.${variant}.extraDeps
 
 mkDerivation rec {
   pname = "gmic-qt${lib.optionalString (variant != "standalone") "-${variant}"}";
-  version = "3.1.6";
+  version = "3.2.0";
 
   src = fetchFromGitHub {
     owner = "c-koi";
     repo = "gmic-qt";
     rev = "v.${version}";
-    sha256 = "sha256-/5wDHvJSMgEheg8YV4W40wUiHz25emIoFnGdfO8i92g=";
+    sha256 = "sha256-I5XC7zbDyBPFj4zul9rshoyeVV0hRQQ3aZQzEvYrgdc=";
   };
 
   nativeBuildInputs = [
@@ -95,15 +94,6 @@ mkDerivation rec {
     "-DENABLE_SYSTEM_GMIC:BOOL=ON"
   ];
 
-  patches = [
-    # NOTE: this should be removed when a new version is released.
-    (fetchpatch {
-      name = "fix_filter_translation_scripts.patch";
-      url = "https://github.com/c-koi/gmic-qt/commit/ccb9f29eda239d0c80663593cd90a6548c935b39.patch";
-      sha256 = "sha256-OzuJ6yGuDJweQ+1uin/pmJqZV79bN9E1Zuo+0iciwzg=";
-    })
-  ];
-
   postPatch = ''
     patchShebangs \
       translations/filters/csv2ts.sh \
diff --git a/pkgs/tools/graphics/gmic/default.nix b/pkgs/tools/graphics/gmic/default.nix
index 8f66d054cde6..6e811e1aa3df 100644
--- a/pkgs/tools/graphics/gmic/default.nix
+++ b/pkgs/tools/graphics/gmic/default.nix
@@ -25,15 +25,15 @@
 
 stdenv.mkDerivation rec {
   pname = "gmic";
-  version = "3.1.6";
+  version = "3.2.0";
 
   outputs = [ "out" "lib" "dev" "man" ];
 
   src = fetchFromGitHub {
     owner = "dtschump";
     repo = "gmic";
-    rev = "326ea9b7dc320b3624fe660d7b7d81669ca12e6d";
-    sha256 = "RRCzYMN/IXViiUNnacJV3DNpku3hIHQkHbIrtixExT0=";
+    rev = "v.${version}";
+    hash = "sha256-lrIlzxXWqv046G5uRkBQnjvysaIcv+iDKxjuUEJWqcs=";
   };
 
   # TODO: build this from source
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
   gmic_stdlib = fetchurl {
     name = "gmic_stdlib.h";
     url = "http://gmic.eu/gmic_stdlib${lib.replaceStrings ["."] [""] version}.h";
-    sha256 = "adObp8s+2TWaS+X/bQSphWRK6o85h+DGwlIDol6XN/4=";
+    hash = "sha256-kWHzA1Dk7F4IROq/gk+RJllry3BABMbssJxhkQ6Cp2M=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/misc/compdb/default.nix b/pkgs/tools/misc/compdb/default.nix
new file mode 100644
index 000000000000..c6d6d75283d9
--- /dev/null
+++ b/pkgs/tools/misc/compdb/default.nix
@@ -0,0 +1,23 @@
+{ lib
+, fetchFromGitHub
+, python3
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "compdb";
+  version = "0.2.0";
+
+  src = fetchFromGitHub {
+    owner = "Sarcasm";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-nFAgTrup6V5oE+LP4UWDOCgTVCv2v9HbQbkGW+oDnTg=";
+  };
+
+  meta = with lib; {
+    description = "Command line tool to manipulate compilation databases";
+    license = licenses.mit;
+    homepage = "https://github.com/Sarcasm/compdb";
+    maintainers = [ maintainers.detegr ];
+  };
+}
diff --git a/pkgs/tools/misc/rmate-sh/default.nix b/pkgs/tools/misc/rmate-sh/default.nix
new file mode 100644
index 000000000000..7fb51344edd1
--- /dev/null
+++ b/pkgs/tools/misc/rmate-sh/default.nix
@@ -0,0 +1,54 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, patsh
+, hostname
+}:
+
+stdenv.mkDerivation rec {
+  pname = "rmate";
+  version = "1.0.2";
+
+  src = fetchFromGitHub {
+    owner = "aurora";
+    repo = pname;
+    rev = "refs/tags/v${version}";
+    hash = "sha256-fmK6h9bqZ0zO3HWfZvPdYuZ6i/0HZ1CA3FUnkS+E9ns=";
+  };
+
+  nativeBuildInputs = [ patsh ];
+
+  buildPhase = ''
+    runHook preBuild
+
+    substituteInPlace rmate \
+      --replace \
+        'echo "hostname"' \
+        'echo "${hostname}/bin/hostname"'
+    patsh -f rmate -s ${builtins.storeDir}
+
+    runHook preBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm755 rmate $out/bin/rmate
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Remote TextMate 2 implemented as shell script";
+    longDescription = ''
+      TextMate 2 has a nice feature where it is possible to edit
+      files on a remote server using a helper script called 'rmate',
+      which feeds the file back to the editor over a reverse tunnel.
+      This is a rmate implementation in shell!
+    '';
+    homepage = "https://github.com/aurora/rmate";
+    platforms = platforms.linux;
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ pbsds ];
+  };
+}
diff --git a/pkgs/tools/networking/eternal-terminal/default.nix b/pkgs/tools/networking/eternal-terminal/default.nix
index 900d54dc745c..22ed2dcb80e7 100644
--- a/pkgs/tools/networking/eternal-terminal/default.nix
+++ b/pkgs/tools/networking/eternal-terminal/default.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "eternal-terminal";
-  version = "6.2.1";
+  version = "6.2.4";
 
   src = fetchFromGitHub {
     owner = "MisterTea";
     repo = "EternalTerminal";
-    rev = "et-v${version}";
-    hash = "sha256-YQ8Qx6RTmDoNWY8AQlnBJJendQl+tF1QA+Z6h/ar9qs=";
+    rev = "refs/tags/et-v${version}";
+    hash = "sha256-9W9Pz0VrFU+HNpf98I3CLrn8+kpjjNLOUK8gGcDJcI8=";
   };
 
   nativeBuildInputs = [
@@ -52,6 +52,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Remote shell that automatically reconnects without interrupting the session";
     homepage = "https://eternalterminal.dev/";
+    changelog = "https://github.com/MisterTea/EternalTerminal/releases/tag/et-v${version}";
     license = licenses.asl20;
     maintainers = with maintainers; [ dezgeg ];
     platforms = platforms.linux ++ platforms.darwin;
diff --git a/pkgs/tools/networking/haproxy/default.nix b/pkgs/tools/networking/haproxy/default.nix
index 7928905762e5..1453fea66f53 100644
--- a/pkgs/tools/networking/haproxy/default.nix
+++ b/pkgs/tools/networking/haproxy/default.nix
@@ -11,11 +11,11 @@ assert usePcre -> pcre != null;
 
 stdenv.mkDerivation rec {
   pname = "haproxy";
-  version = "2.6.6";
+  version = "2.7.2";
 
   src = fetchurl {
     url = "https://www.haproxy.org/download/${lib.versions.majorMinor version}/src/${pname}-${version}.tar.gz";
-    sha256 = "sha256-0MgMkMBK55WYtYuXSdU3h/APe1FRdefYID8nluamWU0=";
+    sha256 = "sha256-Y7xuwDAtDrvh+nacGWBmQN6DSsjLB0R7gHmctWPcDz8=";
   };
 
   buildInputs = [ openssl zlib libxcrypt ]
diff --git a/pkgs/tools/package-management/apx/default.nix b/pkgs/tools/package-management/apx/default.nix
new file mode 100644
index 000000000000..77fed6e67e7d
--- /dev/null
+++ b/pkgs/tools/package-management/apx/default.nix
@@ -0,0 +1,53 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, makeWrapper
+, installShellFiles
+, docker
+, distrobox
+}:
+
+buildGoModule rec {
+  pname = "apx";
+  version = "1.4.2";
+
+  src = fetchFromGitHub {
+    owner = "Vanilla-OS";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-BswX4Jo/RReM/tXo29V9rIvKjN8ylECPe0oo0FCQcGY=";
+  };
+
+  vendorSha256 = null;
+
+  ldflags = [ "-s" "-w" ];
+
+  nativeBuildInputs = [
+    makeWrapper
+    installShellFiles
+  ];
+
+  postInstall = ''
+    mkdir -p $out/etc/apx
+
+    cat > "$out/etc/apx/config.json" <<EOF
+    {
+      "containername": "apx_managed",
+      "image": "docker.io/library/ubuntu",
+      "pkgmanager": "apt",
+      "distroboxpath": "${distrobox}/bin/distrobox"
+    }
+    EOF
+
+    wrapProgram $out/bin/apx --prefix PATH : ${lib.makeBinPath [ docker distrobox ]}
+
+    installManPage man/apx.1 man/es/apx.1
+  '';
+
+  meta = with lib; {
+    description = "The Vanilla OS package manager";
+    homepage = "https://github.com/Vanilla-OS/apx";
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ dit7ya ];
+  };
+}
diff --git a/pkgs/tools/security/nuclei/default.nix b/pkgs/tools/security/nuclei/default.nix
index de0e4be7bffc..579f79329793 100644
--- a/pkgs/tools/security/nuclei/default.nix
+++ b/pkgs/tools/security/nuclei/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "nuclei";
-  version = "2.8.7";
+  version = "2.8.8";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-kEc56cT8EgrQ8qHRHcVjf8L+DwFeK4UDEXhGqs24lJM=";
+    hash = "sha256-limgyp13eh2FuD1MzqQn+NQ30fOJsvr8UT4kZrxnIPM=";
   };
 
-  vendorHash = "sha256-cEgJOL4qpbxdWBwGzVviI/+3Exe746Mu749vtrSjOVU=";
+  vendorHash = "sha256-nmZpYShVNAqBO8adxCSt9t3ocB3elWna06pIBG6dQNY=";
 
   modRoot = "./v2";
   subPackages = [
diff --git a/pkgs/tools/security/trufflehog/default.nix b/pkgs/tools/security/trufflehog/default.nix
index 43a97f8c8005..c5b83d3d5f62 100644
--- a/pkgs/tools/security/trufflehog/default.nix
+++ b/pkgs/tools/security/trufflehog/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "trufflehog";
-  version = "3.25.2";
+  version = "3.25.3";
 
   src = fetchFromGitHub {
     owner = "trufflesecurity";
     repo = "trufflehog";
     rev = "refs/tags/v${version}";
-    hash = "sha256-0cYaW55BF05tXCci76Eivn2rHMMJdjXl5WUkxvXbbnk=";
+    hash = "sha256-w2Wz1mGlpC7EQ7Xos1zDd88HVcLN0TITx3IEn4qyc0s=";
   };
 
-  vendorHash = "sha256-UqoFEvixSk42UTMswc8tUDVxYVkfgkern3NeDyiUMMw=";
+  vendorHash = "sha256-71gPd42kaJaLpyXH1FpCf6sRiKmyGNuGxkX3QV8vvHY=";
 
   # Test cases run git clone and require network access
   doCheck = false;
diff --git a/pkgs/tools/system/awstats/default.nix b/pkgs/tools/system/awstats/default.nix
index e0fb92b519f7..21b76adf3e59 100644
--- a/pkgs/tools/system/awstats/default.nix
+++ b/pkgs/tools/system/awstats/default.nix
@@ -1,12 +1,16 @@
-{ lib, fetchurl, perlPackages, jdk }:
+{ lib
+, fetchurl
+, perlPackages
+, jdk
+}:
 
 perlPackages.buildPerlPackage rec {
   pname = "awstats";
-  version = "7.8";
+  version = "7.9";
 
   src = fetchurl {
     url = "mirror://sourceforge/awstats/${pname}-${version}.tar.gz";
-    sha256 = "1f6l0hd01jmz7hpg0py8qixxiq50n8gl37iypayskxmy05z8craa";
+    sha256 = "sha256-YVF47TE9NDFfFaUi2xpdEsqcOV43hbsGKAq/+V2aBUY=";
   };
 
   postPatch = ''
@@ -15,6 +19,7 @@ perlPackages.buildPerlPackage rec {
   '';
 
   outputs = [ "bin" "out" "doc" ]; # bin just links the user-run executable
+
   propagatedBuildOutputs = [ ]; # otherwise out propagates bin -> cycle
 
   buildInputs = with perlPackages; [ ]; # plugins will need some
@@ -53,10 +58,10 @@ perlPackages.buildPerlPackage rec {
   '';
 
   meta = with lib; {
+    changelog = "https://www.awstats.org/docs/awstats_changelog.txt";
     description = "Real-time logfile analyzer to get advanced statistics";
     homepage = "https://awstats.org";
     license = licenses.gpl3Plus;
     platforms = platforms.unix;
   };
 }
-
diff --git a/pkgs/tools/text/comrak/default.nix b/pkgs/tools/text/comrak/default.nix
index f4ad0f485e40..3f751dc4d7e6 100644
--- a/pkgs/tools/text/comrak/default.nix
+++ b/pkgs/tools/text/comrak/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "comrak";
-  version = "0.15.0";
+  version = "0.16.0";
 
   src = fetchFromGitHub {
     owner = "kivikakk";
     repo = pname;
     rev = version;
-    sha256 = "sha256-F6MZxbB3FYEJ8tzJ0tp9/s0aLaH35QUnOJS6mCVfzUQ=";
+    sha256 = "sha256-ZKIqjeRsNTQYaa5itBSnqQ1w54Yq/iY2EQfDN713KGM=";
   };
 
-  cargoSha256 = "sha256-+QPzwfoxt6+gpb4bDMd++1dBKoXOTON0z2EDdgmyy60=";
+  cargoSha256 = "sha256-Xafdt4AGympN6CLctOWfbCNfhwp4XN6XmSYESgjhRPk=";
 
   meta = with lib; {
     description = "A CommonMark-compatible GitHub Flavored Markdown parser and formatter";
diff --git a/pkgs/tools/text/sift/default.nix b/pkgs/tools/text/sift/default.nix
index f282c28f8fe1..1e79570622c0 100644
--- a/pkgs/tools/text/sift/default.nix
+++ b/pkgs/tools/text/sift/default.nix
@@ -1,27 +1,34 @@
-{ lib, buildGoPackage, fetchFromGitHub, installShellFiles }:
+{ lib, buildGoModule, fetchFromGitHub, fetchpatch, installShellFiles }:
 
-buildGoPackage rec {
+buildGoModule rec {
   pname = "sift";
   version = "0.9.0";
-  rev = "v${version}";
 
-  goPackagePath = "github.com/svent/sift";
+  src = fetchFromGitHub {
+    owner = "svent";
+    repo = "sift";
+    rev = "v${version}";
+    hash = "sha256-IZ4Hwg5NzdSXtrIDNxtkzquuiHQOmLV1HSx8gpwE/i0=";
+  };
+
+  vendorHash = "sha256-y883la4R4jhsS99/ohgBC9SHggybAq9hreda6quG3IY=";
+
+  patches = [
+    # Add Go Modules support
+    (fetchpatch {
+      url = "https://github.com/svent/sift/commit/b56fb3d0fd914c8a6c08b148e15dd8a07c7d8a5a.patch";
+      hash = "sha256-mFCEpkgQ8XDPRQ3yKDZ5qY9tKGSuHs+RnhMeAlx33Ng=";
+    })
+  ];
 
   nativeBuildInputs = [ installShellFiles ];
 
-  src = fetchFromGitHub {
-    inherit rev;
-    owner = "svent";
-    repo = "sift";
-    sha256 = "0bgy0jf84z1c3msvb60ffj4axayfchdkf0xjnsbx9kad1v10g7i1";
-  };
+  ldflags = [ "-s" "-w" ];
 
   postInstall = ''
-    installShellCompletion --cmd sift --bash go/src/github.com/svent/sift/sift-completion.bash
+    installShellCompletion --cmd sift --bash sift-completion.bash
   '';
 
-  goDeps = ./deps.nix;
-
   meta = with lib; {
     description = "A fast and powerful alternative to grep";
     homepage = "https://sift-tool.org";
diff --git a/pkgs/tools/text/sift/deps.nix b/pkgs/tools/text/sift/deps.nix
deleted file mode 100644
index 038555fa3cab..000000000000
--- a/pkgs/tools/text/sift/deps.nix
+++ /dev/null
@@ -1,29 +0,0 @@
-[
-  {
-    goPackagePath = "golang.org/x/crypto";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/crypto";
-      rev = "575fdbe86e5dd89229707ebec0575ce7d088a4a6";
-      sha256 = "1kgv1mkw9y404pk3lcwbs0vgl133mwyp294i18jg9hp10s5d56xa";
-    };
-  }
-  {
-    goPackagePath = "github.com/svent/go-flags";
-    fetch = {
-      type = "git";
-      url = "https://github.com/svent/go-flags";
-      rev = "4bcbad344f0318adaf7aabc16929701459009aa3";
-      sha256 = "1gb416fgxl9gq4q6wsv3i2grq1mzbi7lvfvmfdqbxqbv9vizzh34";
-    };
-  }
-  {
-    goPackagePath = "github.com/svent/go-nbreader";
-    fetch = {
-      type = "git";
-      url = "https://github.com/svent/go-nbreader";
-      rev = "7cef48da76dca6a496faa7fe63e39ed665cbd219";
-      sha256 = "0hw11jj5r3f6qwydg41nc3c6aadlbkhc1qpxra2609lis0qa9h4r";
-    };
-  }
-]
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 8c9f27f24020..57cc3aeea516 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -424,6 +424,8 @@ with pkgs;
 
   commix = callPackage ../tools/security/commix { };
 
+  compdb = callPackage ../tools/misc/compdb { };
+
   conserver = callPackage ../tools/misc/conserver { };
 
   containerpilot = callPackage ../applications/networking/cluster/containerpilot { };
@@ -5377,6 +5379,8 @@ with pkgs;
 
   rmapi = callPackage ../applications/misc/remarkable/rmapi { };
 
+  rmate-sh = callPackage ../tools/misc/rmate-sh { };
+
   rmview = libsForQt5.callPackage ../applications/misc/remarkable/rmview { };
 
   rm-improved = callPackage ../applications/misc/rm-improved { };
@@ -8932,6 +8936,8 @@ with pkgs;
 
   mani = callPackage ../development/tools/mani { };
 
+  manifest-tool = callPackage ../development/tools/manifest-tool { };
+
   mask = callPackage ../development/tools/mask { };
 
   mathpix-snipping-tool = callPackage ../tools/misc/mathpix-snipping-tool { };
@@ -14583,13 +14589,28 @@ with pkgs;
 
   gnu-smalltalk = callPackage ../development/compilers/gnu-smalltalk { };
 
-  gccgo = wrapCC ((if stdenv.hostPlatform.isMusl then gcc_latest else gcc).cc.override {
+  gccgo = wrapCC (gcc.cc.override {
     name = "gccgo";
     langCC = true; #required for go.
     langC = true;
     langGo = true;
     langJit = true;
     profiledCompiler = false;
+  } // {
+    # not supported on darwin: https://github.com/golang/go/issues/463
+    meta.broken = stdenv.hostPlatform.isDarwin;
+  });
+
+  gccgo12 = wrapCC (gcc12.cc.override {
+    name = "gccgo";
+    langCC = true; #required for go.
+    langC = true;
+    langGo = true;
+    langJit = true;
+    profiledCompiler = false;
+  } // {
+    # not supported on darwin: https://github.com/golang/go/issues/463
+    meta.broken = stdenv.hostPlatform.isDarwin;
   });
 
   ghdl = ghdl-mcode;
@@ -17441,6 +17462,8 @@ with pkgs;
 
   datree = callPackage ../development/tools/datree { };
 
+  detekt = callPackage ../development/tools/detekt { };
+
   dcadec = callPackage ../development/tools/dcadec { };
 
   dejagnu = callPackage ../development/tools/misc/dejagnu { };
@@ -37181,6 +37204,8 @@ with pkgs;
 
   apt = callPackage ../tools/package-management/apt { };
 
+  apx = callPackage ../tools/package-management/apx { };
+
   dpkg = callPackage ../tools/package-management/dpkg { };
 
   dumb = callPackage ../misc/dumb { };