diff --git a/lib/generators.nix b/lib/generators.nix
index 968331a0ebde..4357a0353398 100644
--- a/lib/generators.nix
+++ b/lib/generators.nix
@@ -422,7 +422,7 @@ ${expr "" v}
       (if v then "True" else "False")
     else if isFunction v then
       abort "generators.toDhall: cannot convert a function to Dhall"
-    else if isNull v then
+    else if v == null then
       abort "generators.toDhall: cannot convert a null to Dhall"
     else
       builtins.toJSON v;
diff --git a/maintainers/scripts/haskell/dependencies.nix b/maintainers/scripts/haskell/dependencies.nix
index f0620902c0ee..fd8338c0029a 100644
--- a/maintainers/scripts/haskell/dependencies.nix
+++ b/maintainers/scripts/haskell/dependencies.nix
@@ -3,7 +3,7 @@ let
   pkgs = import ../../.. {};
   inherit (pkgs) lib;
   getDeps = _: pkg: {
-    deps = builtins.filter (x: !isNull x) (map (x: x.pname or null) (pkg.propagatedBuildInputs or []));
+    deps = builtins.filter (x: x != null) (map (x: x.pname or null) (pkg.propagatedBuildInputs or []));
     broken = (pkg.meta.hydraPlatforms or [null]) == [];
   };
 in
diff --git a/nixos/lib/test-driver/test_driver/driver.py b/nixos/lib/test-driver/test_driver/driver.py
index de6abbb4679e..ad52f365737c 100644
--- a/nixos/lib/test-driver/test_driver/driver.py
+++ b/nixos/lib/test-driver/test_driver/driver.py
@@ -179,7 +179,6 @@ class Driver:
             start_command=cmd,
             name=name,
             keep_vm_state=args.get("keep_vm_state", False),
-            allow_reboot=args.get("allow_reboot", False),
         )
 
     def serial_stdout_on(self) -> None:
diff --git a/nixos/lib/test-driver/test_driver/machine.py b/nixos/lib/test-driver/test_driver/machine.py
index 0db7930f496b..4929f2048ecc 100644
--- a/nixos/lib/test-driver/test_driver/machine.py
+++ b/nixos/lib/test-driver/test_driver/machine.py
@@ -144,7 +144,7 @@ class StartCommand:
         self,
         monitor_socket_path: Path,
         shell_socket_path: Path,
-        allow_reboot: bool = False,  # TODO: unused, legacy?
+        allow_reboot: bool = False,
     ) -> str:
         display_opts = ""
         display_available = any(x in os.environ for x in ["DISPLAY", "WAYLAND_DISPLAY"])
@@ -152,16 +152,14 @@ class StartCommand:
             display_opts += " -nographic"
 
         # qemu options
-        qemu_opts = ""
-        qemu_opts += (
-            ""
-            if allow_reboot
-            else " -no-reboot"
+        qemu_opts = (
             " -device virtio-serial"
             " -device virtconsole,chardev=shell"
             " -device virtio-rng-pci"
             " -serial stdio"
         )
+        if not allow_reboot:
+            qemu_opts += " -no-reboot"
         # TODO: qemu script already catpures this env variable, legacy?
         qemu_opts += " " + os.environ.get("QEMU_OPTS", "")
 
@@ -195,9 +193,10 @@ class StartCommand:
         shared_dir: Path,
         monitor_socket_path: Path,
         shell_socket_path: Path,
+        allow_reboot: bool,
     ) -> subprocess.Popen:
         return subprocess.Popen(
-            self.cmd(monitor_socket_path, shell_socket_path),
+            self.cmd(monitor_socket_path, shell_socket_path, allow_reboot),
             stdin=subprocess.PIPE,
             stdout=subprocess.PIPE,
             stderr=subprocess.STDOUT,
@@ -312,7 +311,6 @@ class Machine:
 
     start_command: StartCommand
     keep_vm_state: bool
-    allow_reboot: bool
 
     process: Optional[subprocess.Popen]
     pid: Optional[int]
@@ -337,13 +335,11 @@ class Machine:
         start_command: StartCommand,
         name: str = "machine",
         keep_vm_state: bool = False,
-        allow_reboot: bool = False,
         callbacks: Optional[List[Callable]] = None,
     ) -> None:
         self.out_dir = out_dir
         self.tmp_dir = tmp_dir
         self.keep_vm_state = keep_vm_state
-        self.allow_reboot = allow_reboot
         self.name = name
         self.start_command = start_command
         self.callbacks = callbacks if callbacks is not None else []
@@ -874,7 +870,7 @@ class Machine:
         self.process.stdin.write(chars.encode())
         self.process.stdin.flush()
 
-    def start(self) -> None:
+    def start(self, allow_reboot: bool = False) -> None:
         if self.booted:
             return
 
@@ -898,6 +894,7 @@ class Machine:
             self.shared_dir,
             self.monitor_path,
             self.shell_path,
+            allow_reboot,
         )
         self.monitor, _ = monitor_socket.accept()
         self.shell, _ = shell_socket.accept()
@@ -946,6 +943,15 @@ class Machine:
         self.send_monitor_command("quit")
         self.wait_for_shutdown()
 
+    def reboot(self) -> None:
+        """Press Ctrl+Alt+Delete in the guest.
+
+        Prepares the machine to be reconnected which is useful if the
+        machine was started with `allow_reboot = True`
+        """
+        self.send_key(f"ctrl-alt-delete")
+        self.connected = False
+
     def wait_for_x(self) -> None:
         """Wait until it is possible to connect to the X server.  Note that
         testing the existence of /tmp/.X11-unix/X0 is insufficient.
diff --git a/nixos/modules/hardware/device-tree.nix b/nixos/modules/hardware/device-tree.nix
index 2807313a5a9c..c568f52ab677 100644
--- a/nixos/modules/hardware/device-tree.nix
+++ b/nixos/modules/hardware/device-tree.nix
@@ -65,7 +65,7 @@ let
     };
   };
 
-  filterDTBs = src: if isNull cfg.filter
+  filterDTBs = src: if cfg.filter == null
     then "${src}/dtbs"
     else
       pkgs.runCommand "dtbs-filtered" {} ''
@@ -93,8 +93,8 @@ let
   # Fill in `dtboFile` for each overlay if not set already.
   # Existence of one of these is guarded by assertion below
   withDTBOs = xs: flip map xs (o: o // { dtboFile =
-    if isNull o.dtboFile then
-      if !isNull o.dtsFile then compileDTS o.name o.dtsFile
+    if o.dtboFile == null then
+      if o.dtsFile != null then compileDTS o.name o.dtsFile
       else compileDTS o.name (pkgs.writeText "dts" o.dtsText)
     else o.dtboFile; } );
 
@@ -181,7 +181,7 @@ in
   config = mkIf (cfg.enable) {
 
     assertions = let
-      invalidOverlay = o: isNull o.dtsFile && isNull o.dtsText && isNull o.dtboFile;
+      invalidOverlay = o: (o.dtsFile == null) && (o.dtsText == null) && (o.dtboFile == null);
     in lib.singleton {
       assertion = lib.all (o: !invalidOverlay o) cfg.overlays;
       message = ''
diff --git a/nixos/modules/security/doas.nix b/nixos/modules/security/doas.nix
index 4d15ed9a8025..be30a6b92e26 100644
--- a/nixos/modules/security/doas.nix
+++ b/nixos/modules/security/doas.nix
@@ -19,7 +19,7 @@ let
   ];
 
   mkArgs = rule:
-    if (isNull rule.args) then ""
+    if (rule.args == null) then ""
     else if (length rule.args == 0) then "args"
     else "args ${concatStringsSep " " rule.args}";
 
@@ -27,9 +27,9 @@ let
     let
       opts = mkOpts rule;
 
-      as = optionalString (!isNull rule.runAs) "as ${rule.runAs}";
+      as = optionalString (rule.runAs != null) "as ${rule.runAs}";
 
-      cmd = optionalString (!isNull rule.cmd) "cmd ${rule.cmd}";
+      cmd = optionalString (rule.cmd != null) "cmd ${rule.cmd}";
 
       args = mkArgs rule;
     in
diff --git a/nixos/modules/security/pam.nix b/nixos/modules/security/pam.nix
index d57dec36c328..6e8be412de83 100644
--- a/nixos/modules/security/pam.nix
+++ b/nixos/modules/security/pam.nix
@@ -793,7 +793,7 @@ let
     };
   }));
 
-  motd = if isNull config.users.motdFile
+  motd = if config.users.motdFile == null
          then pkgs.writeText "motd" config.users.motd
          else config.users.motdFile;
 
@@ -1233,7 +1233,7 @@ in
   config = {
     assertions = [
       {
-        assertion = isNull config.users.motd || isNull config.users.motdFile;
+        assertion = config.users.motd == null || config.users.motdFile == null;
         message = ''
           Only one of users.motd and users.motdFile can be set.
         '';
diff --git a/nixos/modules/services/cluster/kubernetes/pki.nix b/nixos/modules/services/cluster/kubernetes/pki.nix
index 26fe0f5e9e09..38682701ea15 100644
--- a/nixos/modules/services/cluster/kubernetes/pki.nix
+++ b/nixos/modules/services/cluster/kubernetes/pki.nix
@@ -270,7 +270,7 @@ in
           '';
         })]);
 
-      environment.etc.${cfg.etcClusterAdminKubeconfig}.source = mkIf (!isNull cfg.etcClusterAdminKubeconfig)
+      environment.etc.${cfg.etcClusterAdminKubeconfig}.source = mkIf (cfg.etcClusterAdminKubeconfig != null)
         clusterAdminKubeconfig;
 
       environment.systemPackages = mkIf (top.kubelet.enable || top.proxy.enable) [
diff --git a/nixos/modules/services/hardware/undervolt.nix b/nixos/modules/services/hardware/undervolt.nix
index c49d944cdc18..944777475401 100644
--- a/nixos/modules/services/hardware/undervolt.nix
+++ b/nixos/modules/services/hardware/undervolt.nix
@@ -5,8 +5,8 @@ let
   cfg = config.services.undervolt;
 
   mkPLimit = limit: window:
-    if (isNull limit && isNull window) then null
-    else assert asserts.assertMsg (!isNull limit && !isNull window) "Both power limit and window must be set";
+    if (limit == null && window == null) then null
+    else assert asserts.assertMsg (limit != null && window != null) "Both power limit and window must be set";
       "${toString limit} ${toString window}";
   cliArgs = lib.cli.toGNUCommandLine {} {
     inherit (cfg)
diff --git a/nixos/modules/services/home-automation/home-assistant.nix b/nixos/modules/services/home-automation/home-assistant.nix
index 6adc58ec58ec..cea8a2b14cc2 100644
--- a/nixos/modules/services/home-automation/home-assistant.nix
+++ b/nixos/modules/services/home-automation/home-assistant.nix
@@ -362,7 +362,7 @@ in {
   config = mkIf cfg.enable {
     assertions = [
       {
-        assertion = cfg.openFirewall -> !isNull cfg.config;
+        assertion = cfg.openFirewall -> cfg.config != null;
         message = "openFirewall can only be used with a declarative config";
       }
     ];
diff --git a/nixos/modules/services/networking/multipath.nix b/nixos/modules/services/networking/multipath.nix
index b20ec76ddf59..bd403e109c2a 100644
--- a/nixos/modules/services/networking/multipath.nix
+++ b/nixos/modules/services/networking/multipath.nix
@@ -513,22 +513,22 @@ in {
         ${indentLines 2 devices}
         }
 
-        ${optionalString (!isNull defaults) ''
+        ${optionalString (defaults != null) ''
           defaults {
           ${indentLines 2 defaults}
           }
         ''}
-        ${optionalString (!isNull blacklist) ''
+        ${optionalString (blacklist != null) ''
           blacklist {
           ${indentLines 2 blacklist}
           }
         ''}
-        ${optionalString (!isNull blacklist_exceptions) ''
+        ${optionalString (blacklist_exceptions != null) ''
           blacklist_exceptions {
           ${indentLines 2 blacklist_exceptions}
           }
         ''}
-        ${optionalString (!isNull overrides) ''
+        ${optionalString (overrides != null) ''
           overrides {
           ${indentLines 2 overrides}
           }
diff --git a/nixos/modules/services/networking/radicale.nix b/nixos/modules/services/networking/radicale.nix
index 8e4789c7ca59..00dbd6bbe386 100644
--- a/nixos/modules/services/networking/radicale.nix
+++ b/nixos/modules/services/networking/radicale.nix
@@ -9,7 +9,7 @@ let
     listToValue = concatMapStringsSep ", " (generators.mkValueStringDefault { });
   };
 
-  pkg = if isNull cfg.package then
+  pkg = if cfg.package == null then
     pkgs.radicale
   else
     cfg.package;
@@ -117,13 +117,13 @@ in {
       }
     ];
 
-    warnings = optional (isNull cfg.package && versionOlder config.system.stateVersion "17.09") ''
+    warnings = optional (cfg.package == null && versionOlder config.system.stateVersion "17.09") ''
       The configuration and storage formats of your existing Radicale
       installation might be incompatible with the newest version.
       For upgrade instructions see
       https://radicale.org/2.1.html#documentation/migration-from-1xx-to-2xx.
       Set services.radicale.package to suppress this warning.
-    '' ++ optional (isNull cfg.package && versionOlder config.system.stateVersion "20.09") ''
+    '' ++ optional (cfg.package == null && versionOlder config.system.stateVersion "20.09") ''
       The configuration format of your existing Radicale installation might be
       incompatible with the newest version.  For upgrade instructions see
       https://github.com/Kozea/Radicale/blob/3.0.6/NEWS.md#upgrade-checklist.
diff --git a/nixos/modules/services/system/self-deploy.nix b/nixos/modules/services/system/self-deploy.nix
index 16a793a42253..5f9ee06124cb 100644
--- a/nixos/modules/services/system/self-deploy.nix
+++ b/nixos/modules/services/system/self-deploy.nix
@@ -132,7 +132,7 @@ in
 
       requires = lib.mkIf (!(isPathType cfg.repository)) [ "network-online.target" ];
 
-      environment.GIT_SSH_COMMAND = lib.mkIf (!(isNull cfg.sshKeyFile))
+      environment.GIT_SSH_COMMAND = lib.mkIf (cfg.sshKeyFile != null)
         "${pkgs.openssh}/bin/ssh -i ${lib.escapeShellArg cfg.sshKeyFile}";
 
       restartIfChanged = false;
diff --git a/nixos/modules/services/web-apps/dolibarr.nix b/nixos/modules/services/web-apps/dolibarr.nix
index a9df391128ee..453229c130c2 100644
--- a/nixos/modules/services/web-apps/dolibarr.nix
+++ b/nixos/modules/services/web-apps/dolibarr.nix
@@ -16,7 +16,7 @@ let
         if (any (str: k == str) secretKeys) then v
         else if isString v then "'${v}'"
         else if isBool v then boolToString v
-        else if isNull v then "null"
+        else if v == null then "null"
         else toString v
       ;
     in
diff --git a/nixos/modules/services/web-apps/writefreely.nix b/nixos/modules/services/web-apps/writefreely.nix
index dec00b46f335..a7671aa717f4 100644
--- a/nixos/modules/services/web-apps/writefreely.nix
+++ b/nixos/modules/services/web-apps/writefreely.nix
@@ -10,12 +10,11 @@ let
   format = pkgs.formats.ini {
     mkKeyValue = key: value:
       let
-        value' = if builtins.isNull value then
-          ""
-        else if builtins.isBool value then
-          if value == true then "true" else "false"
-        else
-          toString value;
+        value' = lib.optionalString (value != null)
+          (if builtins.isBool value then
+            if value == true then "true" else "false"
+          else
+            toString value);
       in "${key} = ${value'}";
   };
 
diff --git a/nixos/tests/login.nix b/nixos/tests/login.nix
index 2cff38d20059..67f5764a0a16 100644
--- a/nixos/tests/login.nix
+++ b/nixos/tests/login.nix
@@ -13,6 +13,8 @@ import ./make-test-python.nix ({ pkgs, latestKernel ? false, ... }:
     };
 
   testScript = ''
+      machine.start(allow_reboot = True)
+
       machine.wait_for_unit("multi-user.target")
       machine.wait_until_succeeds("pgrep -f 'agetty.*tty1'")
       machine.screenshot("postboot")
@@ -53,7 +55,14 @@ import ./make-test-python.nix ({ pkgs, latestKernel ? false, ... }:
           machine.screenshot("getty")
 
       with subtest("Check whether ctrl-alt-delete works"):
-          machine.send_key("ctrl-alt-delete")
-          machine.wait_for_shutdown()
+          boot_id1 = machine.succeed("cat /proc/sys/kernel/random/boot_id").strip()
+          assert boot_id1 != ""
+
+          machine.reboot()
+
+          boot_id2 = machine.succeed("cat /proc/sys/kernel/random/boot_id").strip()
+          assert boot_id2 != ""
+
+          assert boot_id1 != boot_id2
   '';
 })
diff --git a/pkgs/applications/audio/ardour/default.nix b/pkgs/applications/audio/ardour/default.nix
index 44b54111fd36..376e8e418cce 100644
--- a/pkgs/applications/audio/ardour/default.nix
+++ b/pkgs/applications/audio/ardour/default.nix
@@ -58,14 +58,14 @@
 }:
 stdenv.mkDerivation rec {
   pname = "ardour";
-  version = "7.1";
+  version = "7.3";
 
   # We can't use `fetchFromGitea` here, as attempting to fetch release archives from git.ardour.org
   # result in an empty archive. See https://tracker.ardour.org/view.php?id=7328 for more info.
   src = fetchgit {
     url = "git://git.ardour.org/ardour/ardour.git";
     rev = version;
-    hash = "sha256-eLF9n71tjdPA+ks0B8UonmPZqRgcZEA7ok79+m9PioU=";
+    hash = "sha256-fDZGmKQ6qgENkq8NY/J67Jym+IXoOYs8DT4xyPXLcC4=";
   };
 
   bundledContent = fetchzip {
diff --git a/pkgs/applications/audio/cmus/default.nix b/pkgs/applications/audio/cmus/default.nix
index 6d37e33b5eee..a3f859ca0ea4 100644
--- a/pkgs/applications/audio/cmus/default.nix
+++ b/pkgs/applications/audio/cmus/default.nix
@@ -20,7 +20,7 @@
 , cddbSupport ? true, libcddb ? null
 , cdioSupport ? true, libcdio ? null, libcdio-paranoia ? null
 , cueSupport ? true, libcue ? null
-, discidSupport ? (!stdenv.isDarwin), libdiscid ? null
+, discidSupport ? false, libdiscid ? null
 , ffmpegSupport ? true, ffmpeg ? null
 , flacSupport ? true, flac ? null
 , madSupport ? true, libmad ? null
diff --git a/pkgs/applications/editors/emacs/elisp-packages/libgenerated.nix b/pkgs/applications/editors/emacs/elisp-packages/libgenerated.nix
index f45aadfa67b4..36576f7c1239 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/libgenerated.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/libgenerated.nix
@@ -73,28 +73,28 @@ in {
         error = sourceArgs.error or args.error or null;
         hasSource = lib.hasAttr variant args;
         pname = builtins.replaceStrings [ "@" ] [ "at" ] ename;
-        broken = ! isNull error;
+        broken = error != null;
       in
       if hasSource then
         lib.nameValuePair ename (
           self.callPackage ({ melpaBuild, fetchurl, ... }@pkgargs:
           melpaBuild {
             inherit pname ename commit;
-            version = if isNull version then "" else
-              lib.concatStringsSep "." (map toString
+            version = lib.optionalString (version != null)
+              (lib.concatStringsSep "." (map toString
                 # Hack: Melpa archives contains versions with parse errors such as [ 4 4 -4 413 ] which should be 4.4-413
                 # This filter method is still technically wrong, but it's computationally cheap enough and tapers over the issue
-                (builtins.filter (n: n >= 0) version));
+                (builtins.filter (n: n >= 0) version)));
             # TODO: Broken should not result in src being null (hack to avoid eval errors)
-            src = if (isNull sha256 || broken) then null else
+            src = if (sha256 == null || broken) then null else
               lib.getAttr fetcher (fetcherGenerators args sourceArgs);
-            recipe = if isNull commit then null else
+            recipe = if commit == null then null else
               fetchurl {
                 name = pname + "-recipe";
                 url = "https://raw.githubusercontent.com/melpa/melpa/${commit}/recipes/${ename}";
                 inherit sha256;
               };
-            packageRequires = lib.optionals (! isNull deps)
+            packageRequires = lib.optionals (deps != null)
               (map (dep: pkgargs.${dep} or self.${dep} or null)
                    deps);
             meta = (sourceArgs.meta or {}) // {
diff --git a/pkgs/applications/editors/okteta/default.nix b/pkgs/applications/editors/okteta/default.nix
index e27c80052f29..c4fd772d35a4 100644
--- a/pkgs/applications/editors/okteta/default.nix
+++ b/pkgs/applications/editors/okteta/default.nix
@@ -4,11 +4,11 @@
 
 mkDerivation rec {
   pname = "okteta";
-  version = "0.26.9";
+  version = "0.26.10";
 
   src = fetchurl {
     url = "mirror://kde/stable/okteta/${version}/src/${pname}-${version}.tar.xz";
-    sha256 = "sha256-FoVMTU6Ug4IZrjEVpCujhf2lyH3GyYZayQ03dPjQX/s=";
+    sha256 = "sha256-KKYU9+DDK0kXperKfgxuysqHsTGRq1NKtAT1Vps8M/o=";
   };
 
   nativeBuildInputs = [ qtscript extra-cmake-modules kdoctools ];
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index bacad2865a77..3a320a5452a4 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -753,8 +753,8 @@ let
         mktplcRef = {
           name = "vscode-eslint";
           publisher = "dbaeumer";
-          version = "2.2.6";
-          sha256 = "sha256-1yZeyLrXuubhKzobWcd00F/CdU824uJDTkB6qlHkJlQ=";
+          version = "2.4.0";
+          sha256 = "sha256-7MUQJkLPOF3oO0kpmfP3bWbS3aT7J0RF7f74LW55BQs=";
         };
         meta = with lib; {
           changelog = "https://marketplace.visualstudio.com/items/dbaeumer.vscode-eslint/changelog";
@@ -927,8 +927,12 @@ let
         mktplcRef = {
           name = "gitlens";
           publisher = "eamodio";
-          version = "2023.3.1505";
-          sha256 = "sha256-USAbI2x6UftNfIEJy2Pbqa/BTYJnUBCNjsdm0Pfrz0o=";
+          # Stable versions are listed on the GitHub releases page and use a
+          # semver scheme, contrary to preview versions which are listed on
+          # the VSCode Marketplace and use a calver scheme. We should avoid
+          # using preview versions, because they expire after two weeks.
+          version = "13.3.2";
+          sha256 = "sha256-4o4dmjio/I531szcoeGPVtfrNAyRAPJRrmsNny/PY2w=";
         };
         meta = with lib; {
           changelog = "https://marketplace.visualstudio.com/items/eamodio.gitlens/changelog";
diff --git a/pkgs/applications/editors/vscode/extensions/ms-vsliveshare-vsliveshare/default.nix b/pkgs/applications/editors/vscode/extensions/ms-vsliveshare-vsliveshare/default.nix
index f1ce06b7ca0f..3c20aa299b6e 100644
--- a/pkgs/applications/editors/vscode/extensions/ms-vsliveshare-vsliveshare/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/ms-vsliveshare-vsliveshare/default.nix
@@ -2,20 +2,14 @@
 #  -  <https://github.com/msteen/nixos-vsliveshare/blob/master/pkgs/vsliveshare/default.nix>
 #  -  <https://github.com/NixOS/nixpkgs/issues/41189>
 { lib, gccStdenv, vscode-utils
-, jq, autoPatchelfHook, bash, makeWrapper
-, dotnet-sdk_3, curl, gcc, icu, libkrb5, libsecret, libunwind, libX11, lttng-ust, openssl, util-linux, zlib
-, desktop-file-utils, xprop, xsel
+, autoPatchelfHook, bash, makeWrapper
+, curl, gcc, libsecret, libunwind, libX11, lttng-ust, util-linux
+, desktop-file-utils, xsel
 }:
 
 let
   # https://docs.microsoft.com/en-us/visualstudio/liveshare/reference/linux#install-prerequisites-manually
   libs = [
-    # .NET Core
-    openssl
-    libkrb5
-    zlib
-    icu
-
     # Credential Storage
     libsecret
 
@@ -36,91 +30,20 @@ in ((vscode-utils.override { stdenv = gccStdenv; }).buildVscodeMarketplaceExtens
   mktplcRef = {
     name = "vsliveshare";
     publisher = "ms-vsliveshare";
-    version = "1.0.5043";
-    sha256 = "OdFOFvidUV/trySHvF8iELPNVP2kq8+vZQ4q4Nf7SiQ=";
+    version = "1.0.5834";
+    sha256 = "sha256-+KfivY8W1VtUxhdXuUKI5e1elo6Ert1Tsf4xVXsKB3Y=";
   };
-}).overrideAttrs({ nativeBuildInputs ? [], buildInputs ? [], ... }: {
-  nativeBuildInputs = nativeBuildInputs ++ [
-    jq
-    autoPatchelfHook
-    makeWrapper
-  ];
+}).overrideAttrs({ buildInputs ? [], ... }: {
   buildInputs = buildInputs ++ libs;
 
   # Using a patch file won't work, because the file changes too often, causing the patch to fail on most updates.
   # Rather than patching the calls to functions, we modify the functions to return what we want,
   # which is less likely to break in the future.
   postPatch = ''
-    sed -i \
-      -e 's/updateExecutablePermissionsAsync() {/& return;/' \
-      -e 's/isInstallCorrupt(traceSource, manifest) {/& return false;/' \
-      out/prod/extension-prod.js
-
-    declare ext_unique_id
-    ext_unique_id="$(basename "$out")"
-
-    # Fix extension attempting to write to 'modifiedInternalSettings.json'.
-    # Move this write to the tmp directory indexed by the nix store basename.
-    substituteInPlace out/prod/extension-prod.js \
-      --replace "path.resolve(constants_1.EXTENSION_ROOT_PATH, './modifiedInternalSettings.json')" \
-                "path.join(os.tmpdir(), '$ext_unique_id-modifiedInternalSettings.json')"
-
-    # Fix extension attempting to write to 'vsls-agent.lock'.
-    # Move this write to the tmp directory indexed by the nix store basename.
-    substituteInPlace out/prod/extension-prod.js \
-      --replace "path + '.lock'" \
-                "__webpack_require__('path').join(__webpack_require__('os').tmpdir(), '$ext_unique_id-vsls-agent.lock')"
-
-    # Hardcode executable paths
-    echo '#!/bin/sh' >node_modules/@vsliveshare/vscode-launcher-linux/check-reqs.sh
-    substituteInPlace node_modules/@vsliveshare/vscode-launcher-linux/install.sh \
-      --replace desktop-file-install ${desktop-file-utils}/bin/desktop-file-install
-    substituteInPlace node_modules/@vsliveshare/vscode-launcher-linux/uninstall.sh \
-      --replace update-desktop-database ${desktop-file-utils}/bin/update-desktop-database
-    substituteInPlace node_modules/@vsliveshare/vscode-launcher-linux/vsls-launcher \
-      --replace /bin/bash ${bash}/bin/bash
-    substituteInPlace out/prod/extension-prod.js \
-      --replace xprop ${xprop}/bin/xprop \
+    substituteInPlace extension.js \
       --replace "'xsel'" "'${xsel}/bin/xsel'"
   '';
 
-  postInstall = ''
-    cd $out/share/vscode/extensions/ms-vsliveshare.vsliveshare
-
-    bash -s <<ENDSUBSHELL
-    shopt -s extglob
-
-    # A workaround to prevent the journal filling up due to diagnostic logging.
-    # See: https://github.com/MicrosoftDocs/live-share/issues/1272
-    # See: https://unix.stackexchange.com/questions/481799/how-to-prevent-a-process-from-writing-to-the-systemd-journal
-    gcc -fPIC -shared -ldl -o dotnet_modules/noop-syslog.so ${./noop-syslog.c}
-
-    # Normally the copying of the right executables is done externally at a later time,
-    # but we want it done at installation time.
-    cp dotnet_modules/exes/linux-x64/* dotnet_modules
-
-    # The required executables are already copied over,
-    # and the other runtimes won't be used and thus are just a waste of space.
-    rm -r dotnet_modules/exes dotnet_modules/runtimes/!(linux-x64|unix)
-
-    # Not all executables and libraries are executable, so make sure that they are.
-    jq <package.json '.executables.linux[]' -r | xargs chmod +x
-
-    # Lock the extension downloader.
-    touch install-linux.Lock externalDeps-linux.Lock
-    ENDSUBSHELL
-  '';
-
-  postFixup = ''
-    # We cannot use `wrapProgram`, because it will generate a relative path,
-    # which will break when copying over the files.
-    mv dotnet_modules/vsls-agent{,-wrapped}
-    makeWrapper $PWD/dotnet_modules/vsls-agent{-wrapped,} \
-      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath libs}" \
-      --set LD_PRELOAD $PWD/dotnet_modules/noop-syslog.so \
-      --set DOTNET_ROOT ${dotnet-sdk_3}
-  '';
-
   meta = with lib; {
     description = "Live Share lets you achieve greater confidence at speed by streamlining collaborative editing, debugging, and more in real-time during development";
     homepage = "https://aka.ms/vsls-docs";
diff --git a/pkgs/applications/editors/vscode/extensions/ms-vsliveshare-vsliveshare/noop-syslog.c b/pkgs/applications/editors/vscode/extensions/ms-vsliveshare-vsliveshare/noop-syslog.c
deleted file mode 100644
index c76ec57a3820..000000000000
--- a/pkgs/applications/editors/vscode/extensions/ms-vsliveshare-vsliveshare/noop-syslog.c
+++ /dev/null
@@ -1 +0,0 @@
-void syslog(int priority, const char *format, ...) { }
diff --git a/pkgs/applications/graphics/shotwell/default.nix b/pkgs/applications/graphics/shotwell/default.nix
index a566d9da788c..623a8d783f76 100644
--- a/pkgs/applications/graphics/shotwell/default.nix
+++ b/pkgs/applications/graphics/shotwell/default.nix
@@ -1,5 +1,7 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchurl
+, fetchpatch2
 , meson
 , ninja
 , gtk3
@@ -31,6 +33,7 @@
 , gobject-introspection
 , itstool
 , libsecret
+, libportal-gtk3
 , gsettings-desktop-schemas
 , python3
 }:
@@ -39,13 +42,22 @@
 
 stdenv.mkDerivation rec {
   pname = "shotwell";
-  version = "0.31.5";
+  version = "0.31.7";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-OwSPxs6ZsjLR4OqbjbB0CDyGyI07bWMTaiz4IXqkXBk=";
+    sha256 = "sha256-gPCj2HVS+L3vpeNig77XZ9AFdtqMyWpEo9NKQjXEmeA=";
   };
 
+  patches = [
+    # Fix build with vala 0.56.4, can be removed on next update
+    # https://gitlab.gnome.org/GNOME/shotwell/-/merge_requests/69
+    (fetchpatch2 {
+      url = "https://gitlab.gnome.org/GNOME/shotwell/-/commit/cd82759231e5ece2fa0dea40397c9051d15fd5c2.patch";
+      hash = "sha256-Vy2kvUlmPdEEuPB1RTcI5pGYNveeiQ+lId0YVlWo4wU=";
+    })
+  ];
+
   nativeBuildInputs = [
     meson
     ninja
@@ -86,6 +98,7 @@ stdenv.mkDerivation rec {
     gcr
     gnome.adwaita-icon-theme
     libsecret
+    libportal-gtk3
   ];
 
   postPatch = ''
diff --git a/pkgs/applications/misc/qMasterPassword/default.nix b/pkgs/applications/misc/qMasterPassword/default.nix
index 2cdc3bdd9f3a..8ac8ae5f4f55 100644
--- a/pkgs/applications/misc/qMasterPassword/default.nix
+++ b/pkgs/applications/misc/qMasterPassword/default.nix
@@ -6,7 +6,6 @@
 , qmake
 , qtbase
 , qttools
-, qtwayland
 , openssl
 , libscrypt
 , wrapQtAppsHook
@@ -23,7 +22,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-VQ1ZkXaZ5sUbtWa/GreTr5uXvnZ2Go6owJ2ZBK25zns=";
   };
 
-  buildInputs = [ qtbase qtwayland libX11 libXtst openssl libscrypt ];
+  buildInputs = [ qtbase libX11 libXtst openssl libscrypt ];
   nativeBuildInputs = [ qmake qttools wrapQtAppsHook ];
 
   # Upstream install is mostly defunct. It hardcodes target.path and doesn't
diff --git a/pkgs/applications/networking/instant-messengers/qq/default.nix b/pkgs/applications/networking/instant-messengers/qq/default.nix
index bc7b973c7b9b..dcfe5424a93c 100644
--- a/pkgs/applications/networking/instant-messengers/qq/default.nix
+++ b/pkgs/applications/networking/instant-messengers/qq/default.nix
@@ -20,15 +20,15 @@
 }:
 
 let
-  version = "3.0.0-571";
+  version = "3.1.0-9572";
   srcs = {
     x86_64-linux = fetchurl {
-      url = "https://dldir1.qq.com/qqfile/qq/QQNT/c005c911/linuxqq_${version}_amd64.deb";
-      sha256 = "sha256-8KcUhZwgeFzGyrQITWnJUzEPGZOCj0LIHLmRuKqkgmQ=";
+      url = "https://dldir1.qq.com/qqfile/qq/QQNT/4b2e3220/linuxqq_${version}_amd64.deb";
+      sha256 = "sha256-xqbyyU4JSlYbAkJ/tqLoVPKfQvxYnMySRx7yV1EtDhM=";
     };
     aarch64-linux = fetchurl {
-      url = "https://dldir1.qq.com/qqfile/qq/QQNT/c005c911/linuxqq_${version}_arm64.deb";
-      sha256 = "sha256-LvE+Pryq4KLu+BFYVrGiTwBdgOrBguPHQd73MMFlfiY=";
+      url = "https://dldir1.qq.com/qqfile/qq/QQNT/4b2e3220/linuxqq_${version}_arm64.deb";
+      sha256 = "sha256-ItZqhV9OmycdfRhlzP2llrzcIZvaiUC/LJiDJ/kNIkE=";
     };
   };
   src = srcs.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
diff --git a/pkgs/applications/networking/instant-messengers/slack/default.nix b/pkgs/applications/networking/instant-messengers/slack/default.nix
index 23571658a24b..bb2f64212fc0 100644
--- a/pkgs/applications/networking/instant-messengers/slack/default.nix
+++ b/pkgs/applications/networking/instant-messengers/slack/default.nix
@@ -41,7 +41,7 @@
 
 let
   inherit (stdenv.hostPlatform) system;
-  throwSystem = throw "Unsupported system: ${system}";
+  throwSystem = throw "slack does not support system: ${system}";
 
   pname = "slack";
 
diff --git a/pkgs/applications/networking/instant-messengers/telegram/kotatogram-desktop/default.nix b/pkgs/applications/networking/instant-messengers/telegram/kotatogram-desktop/default.nix
index d780ddad3448..36b2b6bc50bf 100644
--- a/pkgs/applications/networking/instant-messengers/telegram/kotatogram-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/kotatogram-desktop/default.nix
@@ -220,6 +220,6 @@ stdenv.mkDerivation rec {
     changelog = "https://github.com/kotatogram/kotatogram-desktop/releases/tag/k{version}";
     maintainers = with maintainers; [ ilya-fedin ];
     # never built on aarch64-darwin since first introduction in nixpkgs
-    broken = (stdenv.isDarwin && stdenv.isAarch64) || (stdenv.isLinux && stdenv.isAarch64);
+    broken = stdenv.isDarwin && stdenv.isAarch64;
   };
 }
diff --git a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
index 2b3678de2726..d55b7f5d87fa 100644
--- a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
@@ -5,13 +5,13 @@ rec {
 
   thunderbird-102 = (buildMozillaMach rec {
     pname = "thunderbird";
-    version = "102.8.0";
+    version = "102.9.0";
     application = "comm/mail";
     applicationName = "Mozilla Thunderbird";
     binaryName = pname;
     src = fetchurl {
       url = "mirror://mozilla/thunderbird/releases/${version}/source/thunderbird-${version}.source.tar.xz";
-      sha512 = "2431eb8799184b261609c96bed3c9368bec9035a831aa5f744fa89e48aedb130385b268dd90f03bbddfec449dc3e5fad1b5f8727fe9e11e1d1f123a81b97ddf8";
+      sha512 = "0de88cef22e7b239804e27705b577dd34a86487512bb2af29804b358d056628c14034a34cbbdded75612bda984fac2c04d116cca8040b9212a7fb0206c07c440";
     };
     extraPatches = [
       # The file to be patched is different from firefox's `no-buildconfig-ffx90.patch`.
diff --git a/pkgs/applications/science/electronics/horizon-eda/default.nix b/pkgs/applications/science/electronics/horizon-eda/default.nix
index fb9f226cf39e..fa2f68b82adc 100644
--- a/pkgs/applications/science/electronics/horizon-eda/default.nix
+++ b/pkgs/applications/science/electronics/horizon-eda/default.nix
@@ -13,7 +13,7 @@
 , librsvg
 , libspnav
 , libuuid
-, opencascade
+, opencascade-occt
 , pkg-config
 , podofo
 , python3
@@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
     librsvg
     libspnav
     libuuid
-    opencascade
+    opencascade-occt
     podofo
     python3
     sqlite
@@ -57,7 +57,7 @@ stdenv.mkDerivation rec {
     wrapGAppsHook
   ];
 
-  CASROOT = opencascade;
+  CASROOT = opencascade-occt;
 
   installFlags = [
     "INSTALL=${coreutils}/bin/install"
diff --git a/pkgs/applications/science/geometry/gama/default.nix b/pkgs/applications/science/geometry/gama/default.nix
index 121d9bf2e20b..c00ab9c340b4 100644
--- a/pkgs/applications/science/geometry/gama/default.nix
+++ b/pkgs/applications/science/geometry/gama/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, lib, expat, octave, libxml2, texinfo, zip }:
 stdenv.mkDerivation rec {
   pname = "gama";
-  version = "2.23";
+  version = "2.24";
 
   src = fetchurl {
     url = "mirror://gnu/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-OKVAgmHdhQoS3kCwclE9ljON3H2NVCCvpR2hgwfqnA0=";
+    sha256 = "sha256-AIRqBSO71c26TeQwxjfAGIy8YQddF4tq+ZnWztroyRM=";
   };
 
   buildInputs = [ expat ];
diff --git a/pkgs/applications/science/logic/coq/default.nix b/pkgs/applications/science/logic/coq/default.nix
index 49c9fc47fef2..3740d4e39268 100644
--- a/pkgs/applications/science/logic/coq/default.nix
+++ b/pkgs/applications/science/logic/coq/default.nix
@@ -70,7 +70,7 @@ let
     substituteInPlace plugins/micromega/sos.ml --replace "; csdp" "; ${csdp}/bin/csdp"
     substituteInPlace plugins/micromega/coq_micromega.ml --replace "System.is_in_system_path \"csdp\"" "true"
   '';
-  ocamlPackages = if !isNull customOCamlPackages then customOCamlPackages
+  ocamlPackages = if customOCamlPackages != null then customOCamlPackages
     else with versions; switch coq-version [
       { case = range "8.16" "8.17"; out = ocamlPackages_4_14; }
       { case = range "8.14" "8.15"; out = ocamlPackages_4_12; }
diff --git a/pkgs/applications/virtualization/singularity/generic.nix b/pkgs/applications/virtualization/singularity/generic.nix
index f20735e45e3d..5312dbdda0ff 100644
--- a/pkgs/applications/virtualization/singularity/generic.nix
+++ b/pkgs/applications/virtualization/singularity/generic.nix
@@ -76,7 +76,7 @@ in
 
 let
   defaultPathOriginal = "/bin:/usr/bin:/sbin:/usr/sbin:/usr/local/bin:/usr/local/sbin";
-  privileged-un-utils = if ((isNull newuidmapPath) && (isNull newgidmapPath)) then null else
+  privileged-un-utils = if ((newuidmapPath == null) && (newgidmapPath == null)) then null else
   (runCommandLocal "privileged-un-utils" { } ''
     mkdir -p "$out/bin"
     ln -s ${lib.escapeShellArg newuidmapPath} "$out/bin/newuidmap"
@@ -212,10 +212,10 @@ buildGoModule {
         rm "$file"
       done
     ''}
-    ${lib.optionalString enableSuid (lib.warnIf (isNull starterSuidPath) "${projectName}: Null starterSuidPath when enableSuid produces non-SUID-ed starter-suid and run-time permission denial." ''
+    ${lib.optionalString enableSuid (lib.warnIf (starterSuidPath == null) "${projectName}: Null starterSuidPath when enableSuid produces non-SUID-ed starter-suid and run-time permission denial." ''
       chmod +x $out/libexec/${projectName}/bin/starter-suid
     '')}
-    ${lib.optionalString (enableSuid && !isNull starterSuidPath) ''
+    ${lib.optionalString (enableSuid && (starterSuidPath != null)) ''
       mv "$out"/libexec/${projectName}/bin/starter-suid{,.orig}
       ln -s ${lib.escapeShellArg starterSuidPath} "$out/libexec/${projectName}/bin/starter-suid"
     ''}
diff --git a/pkgs/applications/window-managers/picom/picom-next.nix b/pkgs/applications/window-managers/picom/picom-next.nix
index 378897435548..e5b0176a4e45 100644
--- a/pkgs/applications/window-managers/picom/picom-next.nix
+++ b/pkgs/applications/window-managers/picom/picom-next.nix
@@ -1,14 +1,14 @@
-{ pcre, pcre2, picom, lib, fetchFromGitHub }:
+{ pcre, pcre2, libXinerama, picom, lib, fetchFromGitHub }:
 
 picom.overrideAttrs (oldAttrs: rec {
   pname = "picom-next";
-  version = "unstable-2022-12-23";
-  buildInputs = [ pcre2 ] ++ lib.remove pcre oldAttrs.buildInputs;
+  version = "unstable-2023-01-29";
+  buildInputs = [ pcre2 ] ++ lib.remove libXinerama (lib.remove pcre oldAttrs.buildInputs);
   src = fetchFromGitHub {
     owner = "yshui";
     repo = "picom";
-    rev = "60ac2b64db78363fe04189cc734daea3d721d87e";
-    sha256 = "09s8kgczks01xbvg3qxqi2rz3lkzgdfyvhrj30mg6n11b6xfgi0d";
+    rev = "cee12875625465292bc11bf09dc8ab117cae75f4";
+    sha256 = "sha256-lVwBwOvzn4ro1jInRuNvn1vQuwUHUp4MYrDaFRmW9pc=";
   };
   meta.maintainers = with lib.maintainers; oldAttrs.meta.maintainers ++ [ GKasparov ];
 })
diff --git a/pkgs/build-support/coq/default.nix b/pkgs/build-support/coq/default.nix
index e26504a66f10..eb045ddf6865 100644
--- a/pkgs/build-support/coq/default.nix
+++ b/pkgs/build-support/coq/default.nix
@@ -52,7 +52,7 @@ let
       inherit release releaseRev;
       location = { inherit domain owner repo; };
     } // optionalAttrs (args?fetcher) {inherit fetcher;});
-  fetched = fetch (if !isNull version then version else defaultVersion);
+  fetched = fetch (if version != null then version else defaultVersion);
   display-pkg = n: sep: v:
     let d = displayVersion.${n} or (if sep == "" then ".." else true); in
     n + optionalString (v != "" && v != null) (switch d [
diff --git a/pkgs/build-support/coq/meta-fetch/default.nix b/pkgs/build-support/coq/meta-fetch/default.nix
index d5fe31c6ccf7..82c29fb760b7 100644
--- a/pkgs/build-support/coq/meta-fetch/default.nix
+++ b/pkgs/build-support/coq/meta-fetch/default.nix
@@ -8,13 +8,13 @@ let
         fmt = if args?sha256 then "zip" else "tarball";
         pr  = match "^#(.*)$" rev;
         url = switch-if [
-          { cond = isNull pr && !isNull (match "^github.*" domain);
+          { cond = pr == null && (match "^github.*" domain) != null;
             out = "https://${domain}/${owner}/${repo}/archive/${rev}.${ext}"; }
-          { cond = !isNull pr && !isNull (match "^github.*" domain);
+          { cond = pr != null && (match "^github.*" domain) != null;
             out = "https://api.${domain}/repos/${owner}/${repo}/${fmt}/pull/${head pr}/head"; }
-          { cond = isNull pr && !isNull (match "^gitlab.*" domain);
+          { cond = pr == null && (match "^gitlab.*" domain) != null;
             out = "https://${domain}/${owner}/${repo}/-/archive/${rev}/${repo}-${rev}.${ext}"; }
-          { cond = !isNull (match "(www.)?mpi-sws.org" domain);
+          { cond = (match "(www.)?mpi-sws.org" domain) != null;
             out = "https://www.mpi-sws.org/~${owner}/${repo}/download/${repo}-${rev}.${ext}";}
         ] (throw "meta-fetch: no fetcher found for domain ${domain} on ${rev}");
         fetch = x: if args?sha256 then fetchzip (x // { inherit sha256; }) else fetchTarball x;
diff --git a/pkgs/build-support/make-desktopitem/default.nix b/pkgs/build-support/make-desktopitem/default.nix
index af314aa338c8..ccceb23256b6 100644
--- a/pkgs/build-support/make-desktopitem/default.nix
+++ b/pkgs/build-support/make-desktopitem/default.nix
@@ -89,7 +89,7 @@ let
   renderSection = sectionName: attrs:
     lib.pipe attrs [
       (lib.mapAttrsToList renderLine)
-      (builtins.filter (v: !isNull v))
+      (builtins.filter (v: v != null))
       (builtins.concatStringsSep "\n")
       (section: ''
         [${sectionName}]
diff --git a/pkgs/data/themes/orchis-theme/default.nix b/pkgs/data/themes/orchis-theme/default.nix
index bb196b26fb57..3f964cba350b 100644
--- a/pkgs/data/themes/orchis-theme/default.nix
+++ b/pkgs/data/themes/orchis-theme/default.nix
@@ -49,7 +49,7 @@ rec {
     runHook preInstall
     bash install.sh -d $out/share/themes -t all \
       ${lib.optionalString (tweaks != []) "--tweaks " + builtins.toString tweaks} \
-      ${lib.optionalString (!isNull border-radius) ("--round " + builtins.toString border-radius + "px")}
+      ${lib.optionalString (border-radius != null) ("--round " + builtins.toString border-radius + "px")}
     ${lib.optionalString withWallpapers ''
       mkdir -p $out/share/backgrounds
       cp src/wallpaper/{1080p,2k,4k}.jpg $out/share/backgrounds
diff --git a/pkgs/development/interpreters/dart/default.nix b/pkgs/development/compilers/dart/default.nix
similarity index 73%
rename from pkgs/development/interpreters/dart/default.nix
rename to pkgs/development/compilers/dart/default.nix
index d01a0d1aac53..461e359d3711 100644
--- a/pkgs/development/interpreters/dart/default.nix
+++ b/pkgs/development/compilers/dart/default.nix
@@ -2,16 +2,18 @@
 , lib
 , fetchurl
 , unzip
-, version ? "2.18.0"
+, runCommand
+, darwin
+# we need a way to build other dart versions
+# than the latest, because flutter might want
+# another version
+, version ? "2.19.3"
 , sources ? let
     base = "https://storage.googleapis.com/dart-archive/channels";
     x86_64 = "x64";
     i686 = "ia32";
     aarch64 = "arm64";
-    # Make sure that if the user overrides version parameter they're
-    # also need to override sources, to avoid mistakes
-    version = "2.18.0";
-  in
+in
   {
     "${version}-aarch64-darwin" = fetchurl {
       url = "${base}/stable/release/${version}/sdk/dartsdk-macos-${aarch64}-release.zip";
@@ -39,7 +41,7 @@
 assert version != null && version != "";
 assert sources != null && (builtins.isAttrs sources);
 
-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
   pname = "dart";
   inherit version;
 
@@ -56,9 +58,30 @@ stdenv.mkDerivation {
   '';
 
   libPath = lib.makeLibraryPath [ stdenv.cc.cc ];
-
   dontStrip = true;
+  passthru.tests = {
+    testCreate = runCommand "dart-test-create" { nativeBuildInputs = [ finalAttrs.finalPackage ]; } ''
+      PROJECTNAME="dart_test_project"
+      dart create --no-pub $PROJECTNAME
 
+      [[ -d $PROJECTNAME ]]
+      [[ -f $PROJECTNAME/bin/$PROJECTNAME.dart ]]
+      touch $out
+    '';
+
+    testCompile = runCommand "dart-test-compile" {
+      nativeBuildInputs = [ finalAttrs.finalPackage ]
+        ++ lib.optionals stdenv.isDarwin [ darwin.cctools darwin.sigtool ];
+    } ''
+      HELLO_MESSAGE="Hello, world!"
+      echo "void main() => print('$HELLO_MESSAGE');" > hello.dart
+      dart compile exe hello.dart
+      PROGRAM_OUT=$(./hello.exe)
+
+      [[ "$PROGRAM_OUT" == "$HELLO_MESSAGE" ]]
+      touch $out
+    '';
+  };
   meta = with lib; {
     homepage = "https://www.dartlang.org/";
     maintainers = with maintainers; [ grburst ];
@@ -72,4 +95,4 @@ stdenv.mkDerivation {
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.bsd3;
   };
-}
+})
diff --git a/pkgs/development/interpreters/tcl/8.5.nix b/pkgs/development/interpreters/tcl/8.5.nix
index 9daf67fe2bd0..7676fbfc187d 100644
--- a/pkgs/development/interpreters/tcl/8.5.nix
+++ b/pkgs/development/interpreters/tcl/8.5.nix
@@ -2,12 +2,12 @@
 
 callPackage ./generic.nix (args // rec {
   release = "8.5";
-  version = "${release}.18";
+  version = "${release}.19";
 
   # Note: when updating, the hash in pkgs/development/libraries/tk/8.5.nix must also be updated!
 
   src = fetchurl {
     url = "mirror://sourceforge/tcl/tcl${version}-src.tar.gz";
-    sha256 = "1jfkqp2fr0xh6xvaqx134hkfa5kh7agaqbxm6lhjbpvvc1xfaaq3";
+    sha256 = "066vlr9k5f44w9gl9382hlxnryq00d5p6c7w5vq1fgc7v9b49w6k";
   };
 })
diff --git a/pkgs/development/libraries/libdiscid/default.nix b/pkgs/development/libraries/libdiscid/default.nix
index 7a073b143b93..11cbdc1d8961 100644
--- a/pkgs/development/libraries/libdiscid/default.nix
+++ b/pkgs/development/libraries/libdiscid/default.nix
@@ -2,15 +2,15 @@
 
 stdenv.mkDerivation rec {
   pname = "libdiscid";
-  version = "0.6.2";
+  version = "0.6.4";
 
   nativeBuildInputs = [ cmake pkg-config ];
 
   buildInputs = lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.IOKit ];
 
   src = fetchurl {
-    url = "http://ftp.musicbrainz.org/pub/musicbrainz/libdiscid/${pname}-${version}.tar.gz";
-    sha256 = "1f9irlj3dpb5gyfdnb1m4skbjvx4d4hwiz2152f83m0d9jn47r7r";
+    url = "http://ftp.musicbrainz.org/pub/musicbrainz/${pname}/${pname}-${version}.tar.gz";
+    sha256 = "sha256-3V6PHJrq1ELiO3SanMkzY3LmLoitcHmitiiVsDkMsoI=";
   };
 
   NIX_LDFLAGS = lib.optionalString stdenv.isDarwin "-framework CoreFoundation -framework IOKit";
diff --git a/pkgs/development/libraries/mpich/default.nix b/pkgs/development/libraries/mpich/default.nix
index c4d26e009275..cce568731878 100644
--- a/pkgs/development/libraries/mpich/default.nix
+++ b/pkgs/development/libraries/mpich/default.nix
@@ -11,11 +11,11 @@ assert (ch4backend.pname == "ucx" || ch4backend.pname == "libfabric");
 
 stdenv.mkDerivation  rec {
   pname = "mpich";
-  version = "4.1";
+  version = "4.1.1";
 
   src = fetchurl {
     url = "https://www.mpich.org/static/downloads/${version}/mpich-${version}.tar.gz";
-    sha256 = "sha256-ix7GO8RMfKoq+7RXvFs81KcNvka6unABI9Z8SNxatqA=";
+    sha256 = "sha256-7jBHGzXvh/TIj4caXirTgRzZxN8y/U8ThEMHL/QoTKI=";
   };
 
   configureFlags = [
diff --git a/pkgs/development/libraries/tk/8.5.nix b/pkgs/development/libraries/tk/8.5.nix
index c5d5c478c670..afd575915f85 100644
--- a/pkgs/development/libraries/tk/8.5.nix
+++ b/pkgs/development/libraries/tk/8.5.nix
@@ -11,7 +11,7 @@ callPackage ./generic.nix (args // {
 
   src = fetchurl {
     url = "mirror://sourceforge/tcl/tk${tcl.version}-src.tar.gz";
-    sha256 = "0an3wqkjzlyyq6l9l3nawz76axsrsppbyylx0zk9lkv7llrala03";
+    sha256 = "1yhgcalldrjlc5q614rlzg1crgd3b52dhrk1pncdaxvl2vgg2yj0";
   };
 
   patches = lib.optionals stdenv.isDarwin [
diff --git a/pkgs/development/libraries/volk/2.5.0.nix b/pkgs/development/libraries/volk/2.5.0.nix
index 76dbf133be9a..8270c8d315eb 100644
--- a/pkgs/development/libraries/volk/2.5.0.nix
+++ b/pkgs/development/libraries/volk/2.5.0.nix
@@ -45,7 +45,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     cmake
     python3
-    python3.pkgs.Mako
+    python3.pkgs.mako
   ];
 
   doCheck = true;
diff --git a/pkgs/development/nim-packages/build-nim-package/default.nix b/pkgs/development/nim-packages/build-nim-package/default.nix
index 5ad181252df4..5c64b7b745c2 100644
--- a/pkgs/development/nim-packages/build-nim-package/default.nix
+++ b/pkgs/development/nim-packages/build-nim-package/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation (attrs // {
   depsBuildBuild = [ nim_builder ] ++ depsBuildBuild;
   nativeBuildInputs = [ nim ] ++ nativeBuildInputs;
 
-  configurePhase = if isNull configurePhase then ''
+  configurePhase = if (configurePhase == null) then ''
     runHook preConfigure
     export NIX_NIM_BUILD_INPUTS=''${pkgsHostTarget[@]} $NIX_NIM_BUILD_INPUTS
     nim_builder --phase:configure
@@ -17,21 +17,21 @@ stdenv.mkDerivation (attrs // {
   '' else
     configurePhase;
 
-  buildPhase = if isNull buildPhase then ''
+  buildPhase = if (buildPhase == null) then ''
     runHook preBuild
     nim_builder --phase:build
     runHook postBuild
   '' else
     buildPhase;
 
-  checkPhase = if isNull checkPhase then ''
+  checkPhase = if (checkPhase == null) then ''
     runHook preCheck
     nim_builder --phase:check
     runHook postCheck
   '' else
     checkPhase;
 
-  installPhase = if isNull installPhase then ''
+  installPhase = if (installPhase == null) then ''
     runHook preInstall
     nim_builder --phase:install
     runHook postInstall
diff --git a/pkgs/development/ocaml-modules/data-encoding/default.nix b/pkgs/development/ocaml-modules/data-encoding/default.nix
index 7bd01ff83157..5a17abdcc532 100644
--- a/pkgs/development/ocaml-modules/data-encoding/default.nix
+++ b/pkgs/development/ocaml-modules/data-encoding/default.nix
@@ -14,15 +14,18 @@
 , ppx_expect
 }:
 
-buildDunePackage {
+buildDunePackage rec {
   pname = "data-encoding";
-  version = "0.5.3";
+  version = "0.6";
+
+  duneVersion = "3";
+  minimalOCamlVersion = "4.10";
 
   src = fetchFromGitLab {
     owner = "nomadic-labs";
     repo = "data-encoding";
-    rev = "v0.5.3";
-    sha256 = "sha256-HMNpjh5x7vU/kXQNRjJtOvShEENoNuxjNNPBJfm+Rhg=";
+    rev = "v${version}";
+    hash = "sha256-oQEV7lTG+/q1UcPsepPM4yN4qia6tEtRPkTkTVdGXE0=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/ocaml-modules/lru/default.nix b/pkgs/development/ocaml-modules/lru/default.nix
index 678023bb8f3d..2c8a3e99df57 100644
--- a/pkgs/development/ocaml-modules/lru/default.nix
+++ b/pkgs/development/ocaml-modules/lru/default.nix
@@ -4,6 +4,8 @@ buildDunePackage rec {
   pname = "lru";
   version = "0.3.1";
 
+  duneVersion = "3";
+
   src = fetchurl {
     url = "https://github.com/pqwy/lru/releases/download/v${version}/lru-${version}.tbz";
     hash = "sha256-bL4j0np9WyRPhpwLiBQNR/cPQTpkYu81wACTJdSyNv0=";
diff --git a/pkgs/development/ocaml-modules/psq/default.nix b/pkgs/development/ocaml-modules/psq/default.nix
index ea9a0615b414..f1c8ab92af44 100644
--- a/pkgs/development/ocaml-modules/psq/default.nix
+++ b/pkgs/development/ocaml-modules/psq/default.nix
@@ -1,15 +1,15 @@
 { lib, buildDunePackage, ocaml, fetchurl, seq, qcheck-alcotest }:
 
 buildDunePackage rec {
-  minimumOCamlVersion = "4.03";
+  minimalOCamlVersion = "4.03";
   pname = "psq";
-  version = "0.2.0";
+  version = "0.2.1";
 
-  useDune2 = true;
+  duneVersion = "3";
 
   src = fetchurl {
-    url = "https://github.com/pqwy/psq/releases/download/v${version}/psq-v${version}.tbz";
-    sha256 = "1j4lqkq17rskhgcrpgr4n1m1a2b1x35mlxj6f9g05rhpmgvgvknk";
+    url = "https://github.com/pqwy/psq/releases/download/v${version}/psq-${version}.tbz";
+    hash = "sha256-QgBfUz6r50sXme4yuJBWVM1moivtSvK9Jmso2EYs00Q=";
   };
 
   propagatedBuildInputs = [ seq ];
diff --git a/pkgs/development/ocaml-modules/terminal_size/default.nix b/pkgs/development/ocaml-modules/terminal_size/default.nix
index fa6bd003eaec..228a6f222efc 100644
--- a/pkgs/development/ocaml-modules/terminal_size/default.nix
+++ b/pkgs/development/ocaml-modules/terminal_size/default.nix
@@ -2,13 +2,13 @@
 
 buildDunePackage rec {
   pname = "terminal_size";
-  version = "0.1.4";
+  version = "0.2.0";
 
-  useDune2 = true;
+  duneVersion = "3";
 
   src = fetchurl {
-    url = "https://github.com/cryptosense/terminal_size/releases/download/v${version}/terminal_size-v${version}.tbz";
-    sha256 = "fdca1fee7d872c4a8e5ab003d9915b6782b272e2a3661ca877f2d78dd25371a7";
+    url = "https://github.com/cryptosense/terminal_size/releases/download/v${version}/terminal_size-${version}.tbz";
+    hash = "sha256-1rYs0oxAcayFypUoCIdFwSTJCU7+rpFyJRRzb5lzsPs=";
   };
 
   checkInputs = [ alcotest ];
diff --git a/pkgs/development/python-modules/aioesphomeapi/default.nix b/pkgs/development/python-modules/aioesphomeapi/default.nix
index 866d597ae8b5..dfb88f77aae3 100644
--- a/pkgs/development/python-modules/aioesphomeapi/default.nix
+++ b/pkgs/development/python-modules/aioesphomeapi/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "aioesphomeapi";
-  version = "13.5.0";
+  version = "13.5.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "esphome";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-e0gkjri3PknwY2Si6vJV8S2LNZI/0EBDC7mliI33aTU=";
+    hash = "sha256-ifk1psowUGVG7XafipLq5T2+5K5+psDDsX/u/GYDXdU=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/mip/default.nix b/pkgs/development/python-modules/mip/default.nix
index 42353bdab723..00be8547c73d 100644
--- a/pkgs/development/python-modules/mip/default.nix
+++ b/pkgs/development/python-modules/mip/default.nix
@@ -35,7 +35,7 @@ buildPythonPackage rec {
     cffi
   ] ++ lib.optionals gurobiSupport ([
     gurobipy
-  ] ++ lib.optional (builtins.isNull gurobiHome) gurobi);
+  ] ++ lib.optional (gurobiHome == null) gurobi);
 
   # Source files have CRLF terminators, which make patch error out when supplied
   # with diffs made on *nix machines
@@ -58,7 +58,7 @@ buildPythonPackage rec {
 
   # Make MIP use the Gurobi solver, if configured to do so
   makeWrapperArgs = lib.optional gurobiSupport
-    "--set GUROBI_HOME ${if builtins.isNull gurobiHome then gurobi.outPath else gurobiHome}";
+    "--set GUROBI_HOME ${if gurobiHome == null then gurobi.outPath else gurobiHome}";
 
   # Tests that rely on Gurobi are activated only when Gurobi support is enabled
   disabledTests = lib.optional (!gurobiSupport) "gurobi";
diff --git a/pkgs/development/python-modules/qtawesome/default.nix b/pkgs/development/python-modules/qtawesome/default.nix
index 234a0689cc1f..7b4bcb01384f 100644
--- a/pkgs/development/python-modules/qtawesome/default.nix
+++ b/pkgs/development/python-modules/qtawesome/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "qtawesome";
-  version = "1.2.2";
+  version = "1.2.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "spyder-ide";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-zXwIwYG76aCKPTE8mGiAOK8kQUCzJbqnjJszmIqByaA=";
+    hash = "sha256-cndmxdo00TLq1Cy66IFwcT5CKBavaFAfknkpLZCYvUQ=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/tensorflow-probability/default.nix b/pkgs/development/python-modules/tensorflow-probability/default.nix
index bd447bd4325a..b85eea444358 100644
--- a/pkgs/development/python-modules/tensorflow-probability/default.nix
+++ b/pkgs/development/python-modules/tensorflow-probability/default.nix
@@ -54,7 +54,7 @@ let
     LIBTOOL = lib.optionalString stdenv.isDarwin "${cctools}/bin/libtool";
 
     fetchAttrs = {
-      sha256 = "sha256-pST4R45mWC5j0ngkkRe+hmostaMploW0+BN3WKPt0t0=";
+      sha256 = "sha256-9i0ExaIeNz7+ddNAoU2ak8JY7lI2aY6eBDiPzJYuJUk=";
     };
 
     buildAttrs = {
diff --git a/pkgs/development/python-modules/textual/default.nix b/pkgs/development/python-modules/textual/default.nix
index e983b4e56d10..3465fdc974fe 100644
--- a/pkgs/development/python-modules/textual/default.nix
+++ b/pkgs/development/python-modules/textual/default.nix
@@ -22,7 +22,7 @@
 
 buildPythonPackage rec {
   pname = "textual";
-  version = "0.12.1";
+  version = "0.15.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -31,7 +31,7 @@ buildPythonPackage rec {
     owner = "Textualize";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-7QyUARXvPgGzXvIdkh9/WO07I8wfMQF23xdrxPjO8e8=";
+    hash = "sha256-UT+ApD/TTb5cxIdgK+n3B2J3z/nEwVXtuyPHpGCv6Tg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/build-managers/bazel/bazel_6/default.nix b/pkgs/development/tools/build-managers/bazel/bazel_6/default.nix
index 63d500e8247e..5fd6d8cbff0d 100644
--- a/pkgs/development/tools/build-managers/bazel/bazel_6/default.nix
+++ b/pkgs/development/tools/build-managers/bazel/bazel_6/default.nix
@@ -24,16 +24,19 @@
 }:
 
 let
-  version = "6.0.0";
+  version = "6.1.0";
   sourceRoot = ".";
 
   src = fetchurl {
     url = "https://github.com/bazelbuild/bazel/releases/download/${version}/bazel-${version}-dist.zip";
-    hash = "sha256-e8DFFFwZpW2CoI/OaQjF4aDnXk+/s7bxK03q5/SzjLw=";
+    hash = "sha256-xLhWdVQc9m7ny3FRQJf91sX8DgJSckNhek8gymtPKTI=";
   };
 
-  # Update with `eval $(nix-build -A bazel_6.updater)`,
-  # then add new dependencies from the dict in ./src-deps.json as required.
+  # Update with
+  # 1. export BAZEL_SELF=$(nix-build -A bazel_6)
+  # 2. update version and hash for sources above
+  # 3. `eval $(nix-build -A bazel_6.updater)`
+  # 4. add new dependencies from the dict in ./src-deps.json if required by failing build
   srcDeps = lib.attrsets.attrValues srcDepsSet;
   srcDepsSet =
     let
@@ -334,8 +337,8 @@ stdenv.mkDerivation rec {
     #!${runtimeShell}
     (cd "${src_for_updater}" &&
         BAZEL_USE_CPP_ONLY_TOOLCHAIN=1 \
-        "${bazel_self}"/bin/bazel \
-            query 'kind(http_archive, //external:all) + kind(http_file, //external:all) + kind(distdir_tar, //external:all) + kind(git_repository, //external:all)' \
+        "$BAZEL_SELF"/bin/bazel \
+            query 'kind(http_archive, //external:*) + kind(http_file, //external:*) + kind(distdir_tar, //external:*) + kind(git_repository, //external:*)' \
             --loading_phase_threads=1 \
             --output build) \
     | "${python3}"/bin/python3 "${./update-srcDeps.py}" \
diff --git a/pkgs/development/tools/build-managers/bazel/bazel_6/no-arc.patch b/pkgs/development/tools/build-managers/bazel/bazel_6/no-arc.patch
index 95d70a9db38e..e7a4498839dc 100644
--- a/pkgs/development/tools/build-managers/bazel/bazel_6/no-arc.patch
+++ b/pkgs/development/tools/build-managers/bazel/bazel_6/no-arc.patch
@@ -6,9 +6,9 @@ index 990afe3e8c..cd5b7b1b7a 100644
  ])
  
  DARWIN_XCODE_LOCATOR_COMPILE_COMMAND = """
--  /usr/bin/xcrun --sdk macosx clang -mmacosx-version-min=10.9 -fobjc-arc -framework CoreServices \
+-  /usr/bin/xcrun --sdk macosx clang -mmacosx-version-min=10.13 -fobjc-arc -framework CoreServices \
 -      -framework Foundation -arch arm64 -arch x86_64 -Wl,-no_adhoc_codesign -Wl,-no_uuid -o $@ $< && \
-+  /usr/bin/xcrun --sdk macosx clang -mmacosx-version-min=10.9 -framework CoreServices \
++  /usr/bin/xcrun --sdk macosx clang -mmacosx-version-min=10.13 -framework CoreServices \
 +      -framework Foundation -arch @multiBinPatch@ -Wl,-no_uuid -o $@ $< && \
    env -i codesign --identifier $@ --force --sign - $@
  """
@@ -20,7 +20,7 @@ index 2b819f07ec..a98ce37673 100644
 @@ -127,7 +127,6 @@ def run_xcode_locator(repository_ctx, xcode_locator_src_label):
          "macosx",
          "clang",
-         "-mmacosx-version-min=10.9",
+         "-mmacosx-version-min=10.13",
 -        "-fobjc-arc",
          "-framework",
          "CoreServices",
diff --git a/pkgs/development/tools/build-managers/bazel/bazel_6/src-deps.json b/pkgs/development/tools/build-managers/bazel/bazel_6/src-deps.json
index ae10299be916..59153bd99af1 100644
--- a/pkgs/development/tools/build-managers/bazel/bazel_6/src-deps.json
+++ b/pkgs/development/tools/build-managers/bazel/bazel_6/src-deps.json
@@ -88,9 +88,11 @@
         ]
     },
     "android_tools": {
+        "generator_function": "maybe",
+        "generator_name": "android_tools",
         "name": "android_tools",
-        "sha256": "ed5290594244c2eeab41f0104519bcef51e27c699ff4b379fcbd25215270513e",
-        "url": "https://mirror.bazel.build/bazel_android_tools/android_tools_pkg-0.23.0.tar.gz"
+        "sha256": "1afa4b7e13c82523c8b69e87f8d598c891ec7e2baa41d9e24e08becd723edb4d",
+        "url": "https://mirror.bazel.build/bazel_android_tools/android_tools_pkg-0.27.0.tar.gz"
     },
     "android_tools_for_testing": {
         "name": "android_tools_for_testing",
@@ -1101,20 +1103,40 @@
         ]
     },
     "remote_coverage_tools": {
+        "generator_function": "dist_http_archive",
+        "generator_name": "remote_coverage_tools",
         "name": "remote_coverage_tools",
-        "sha256": "cd14f1cb4559e4723e63b7e7b06d09fcc3bd7ba58d03f354cdff1439bd936a7d",
+        "patch_cmds": [
+            "test -f BUILD && chmod u+w BUILD || true",
+            "echo >> BUILD",
+            "echo 'exports_files([\"WORKSPACE\"], visibility = [\"//visibility:public\"])' >> BUILD"
+        ],
+        "patch_cmds_win": [
+            "Add-Content -Path BUILD -Value \"`nexports_files([`\"WORKSPACE`\"], visibility = [`\"//visibility:public`\"])`n\" -Force"
+        ],
+        "sha256": "7006375f6756819b7013ca875eab70a541cf7d89142d9c511ed78ea4fefa38af",
         "urls": [
-            "https://mirror.bazel.build/bazel_coverage_output_generator/releases/coverage_output_generator-v2.5.zip"
+            "https://mirror.bazel.build/bazel_coverage_output_generator/releases/coverage_output_generator-v2.6.zip"
+        ]
+    },
+    "remote_java_tools": {
+        "generator_function": "maybe",
+        "generator_name": "remote_java_tools",
+        "name": "remote_java_tools",
+        "sha256": "5cd59ea6bf938a1efc1e11ea562d37b39c82f76781211b7cd941a2346ea8484d",
+        "urls": [
+            "https://mirror.bazel.build/bazel_java_tools/releases/java/v11.9/java_tools-v11.9.zip",
+            "https://github.com/bazelbuild/java_tools/releases/download/java_v11.9/java_tools-v11.9.zip"
         ]
     },
     "remote_java_tools_darwin": {
         "generator_function": "maybe",
         "generator_name": "remote_java_tools_darwin",
         "name": "remote_java_tools_darwin",
-        "sha256": "d15b05d2061382748f779dc566537ea567a46bcba6fa34b56d7cb6e6d668adab",
+        "sha256": "b9e962c6a836ba1d7573f2473fab3a897c6370d4c2724bde4017b40932ff4fe4",
         "urls": [
-            "https://mirror.bazel.build/bazel_java_tools/releases/javac11/v10.6/java_tools_javac11_darwin-v10.6.zip",
-            "https://github.com/bazelbuild/java_tools/releases/download/javac11_v10.6/java_tools_javac11_darwin-v10.6.zip"
+            "https://mirror.bazel.build/bazel_java_tools/releases/java/v11.9/java_tools_darwin-v11.9.zip",
+            "https://github.com/bazelbuild/java_tools/releases/download/java_v11.9/java_tools_darwin-v11.9.zip"
         ]
     },
     "remote_java_tools_darwin_for_testing": {
@@ -1157,10 +1179,10 @@
         "generator_function": "maybe",
         "generator_name": "remote_java_tools_linux",
         "name": "remote_java_tools_linux",
-        "sha256": "085c0ba53ba764e81d4c195524f3c596085cbf9cdc01dd8e6d2ae677e726af35",
+        "sha256": "512582cac5b7ea7974a77b0da4581b21f546c9478f206eedf54687eeac035989",
         "urls": [
-            "https://mirror.bazel.build/bazel_java_tools/releases/javac11/v10.6/java_tools_javac11_linux-v10.6.zip",
-            "https://github.com/bazelbuild/java_tools/releases/download/javac11_v10.6/java_tools_javac11_linux-v10.6.zip"
+            "https://mirror.bazel.build/bazel_java_tools/releases/java/v11.9/java_tools_linux-v11.9.zip",
+            "https://github.com/bazelbuild/java_tools/releases/download/java_v11.9/java_tools_linux-v11.9.zip"
         ]
     },
     "remote_java_tools_linux_for_testing": {
@@ -1257,10 +1279,10 @@
         "generator_function": "maybe",
         "generator_name": "remote_java_tools_windows",
         "name": "remote_java_tools_windows",
-        "sha256": "873f1e53d1fa9c8e46b717673816cd822bb7acc474a194a18ff849fd8fa6ff00",
+        "sha256": "677ab910046205020fd715489147c2bcfad8a35d9f5d94fdc998d217545bd87a",
         "urls": [
-            "https://mirror.bazel.build/bazel_java_tools/releases/javac11/v10.6/java_tools_javac11_windows-v10.6.zip",
-            "https://github.com/bazelbuild/java_tools/releases/download/javac11_v10.6/java_tools_javac11_windows-v10.6.zip"
+            "https://mirror.bazel.build/bazel_java_tools/releases/java/v11.9/java_tools_windows-v11.9.zip",
+            "https://github.com/bazelbuild/java_tools/releases/download/java_v11.9/java_tools_windows-v11.9.zip"
         ]
     },
     "remote_java_tools_windows_for_testing": {
@@ -1286,10 +1308,11 @@
         "generator_function": "maybe",
         "generator_name": "remotejdk11_linux",
         "name": "remotejdk11_linux",
-        "sha256": "360626cc19063bc411bfed2914301b908a8f77a7919aaea007a977fa8fb3cde1",
-        "strip_prefix": "zulu11.37.17-ca-jdk11.0.6-linux_x64",
+        "sha256": "e064b61d93304012351242bf0823c6a2e41d9e28add7ea7f05378b7243d34247",
+        "strip_prefix": "zulu11.56.19-ca-jdk11.0.15-linux_x64",
         "urls": [
-            "https://mirror.bazel.build/openjdk/azul-zulu11.37.17-ca-jdk11.0.6/zulu11.37.17-ca-jdk11.0.6-linux_x64.tar.gz"
+            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu11.56.19-ca-jdk11.0.15-linux_x64.tar.gz",
+            "https://cdn.azul.com/zulu/bin/zulu11.56.19-ca-jdk11.0.15-linux_x64.tar.gz"
         ]
     },
     "remotejdk11_linux_aarch64": {
@@ -1297,10 +1320,11 @@
         "generator_function": "maybe",
         "generator_name": "remotejdk11_linux_aarch64",
         "name": "remotejdk11_linux_aarch64",
-        "sha256": "a452f1b9682d9f83c1c14e54d1446e1c51b5173a3a05dcb013d380f9508562e4",
-        "strip_prefix": "zulu11.37.48-ca-jdk11.0.6-linux_aarch64",
+        "sha256": "fc7c41a0005180d4ca471c90d01e049469e0614cf774566d4cf383caa29d1a97",
+        "strip_prefix": "zulu11.56.19-ca-jdk11.0.15-linux_aarch64",
         "urls": [
-            "https://mirror.bazel.build/openjdk/azul-zulu11.37.48-ca-jdk11.0.6/zulu11.37.48-ca-jdk11.0.6-linux_aarch64.tar.gz"
+            "https://mirror.bazel.build/cdn.azul.com/zulu-embedded/bin/zulu11.56.19-ca-jdk11.0.15-linux_aarch64.tar.gz",
+            "https://cdn.azul.com/zulu-embedded/bin/zulu11.56.19-ca-jdk11.0.15-linux_aarch64.tar.gz"
         ]
     },
     "remotejdk11_linux_aarch64_for_testing": {
@@ -1348,11 +1372,11 @@
         "generator_function": "maybe",
         "generator_name": "remotejdk11_linux_ppc64le",
         "name": "remotejdk11_linux_ppc64le",
-        "sha256": "a417db0295b1f4b538ecbaf7c774f3a177fab9657a665940170936c0eca4e71a",
-        "strip_prefix": "jdk-11.0.7+10",
+        "sha256": "a8fba686f6eb8ae1d1a9566821dbd5a85a1108b96ad857fdbac5c1e4649fc56f",
+        "strip_prefix": "jdk-11.0.15+10",
         "urls": [
-            "https://mirror.bazel.build/openjdk/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.7+10/OpenJDK11U-jdk_ppc64le_linux_hotspot_11.0.7_10.tar.gz",
-            "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.7+10/OpenJDK11U-jdk_ppc64le_linux_hotspot_11.0.7_10.tar.gz"
+            "https://mirror.bazel.build/github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.15+10/OpenJDK11U-jdk_ppc64le_linux_hotspot_11.0.15_10.tar.gz",
+            "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.15+10/OpenJDK11U-jdk_ppc64le_linux_hotspot_11.0.15_10.tar.gz"
         ]
     },
     "remotejdk11_linux_ppc64le_for_testing": {
@@ -1380,11 +1404,11 @@
         "generator_function": "maybe",
         "generator_name": "remotejdk11_linux_s390x",
         "name": "remotejdk11_linux_s390x",
-        "sha256": "d9b72e87a1d3ebc0c9552f72ae5eb150fffc0298a7cb841f1ce7bfc70dcd1059",
-        "strip_prefix": "jdk-11.0.7+10",
+        "sha256": "a58fc0361966af0a5d5a31a2d8a208e3c9bb0f54f345596fd80b99ea9a39788b",
+        "strip_prefix": "jdk-11.0.15+10",
         "urls": [
-            "https://mirror.bazel.build/github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.7+10/OpenJDK11U-jdk_s390x_linux_hotspot_11.0.7_10.tar.gz",
-            "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.7+10/OpenJDK11U-jdk_s390x_linux_hotspot_11.0.7_10.tar.gz"
+            "https://mirror.bazel.build/github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.15+10/OpenJDK11U-jdk_s390x_linux_hotspot_11.0.15_10.tar.gz",
+            "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.15+10/OpenJDK11U-jdk_s390x_linux_hotspot_11.0.15_10.tar.gz"
         ]
     },
     "remotejdk11_linux_s390x_for_testing": {
@@ -1412,10 +1436,11 @@
         "generator_function": "maybe",
         "generator_name": "remotejdk11_macos",
         "name": "remotejdk11_macos",
-        "sha256": "e1fe56769f32e2aaac95e0a8f86b5a323da5af3a3b4bba73f3086391a6cc056f",
-        "strip_prefix": "zulu11.37.17-ca-jdk11.0.6-macosx_x64",
+        "sha256": "2614e5c5de8e989d4d81759de4c333aa5b867b17ab9ee78754309ba65c7f6f55",
+        "strip_prefix": "zulu11.56.19-ca-jdk11.0.15-macosx_x64",
         "urls": [
-            "https://mirror.bazel.build/openjdk/azul-zulu11.37.17-ca-jdk11.0.6/zulu11.37.17-ca-jdk11.0.6-macosx_x64.tar.gz"
+            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu11.56.19-ca-jdk11.0.15-macosx_x64.tar.gz",
+            "https://cdn.azul.com/zulu/bin/zulu11.56.19-ca-jdk11.0.15-macosx_x64.tar.gz"
         ]
     },
     "remotejdk11_macos_aarch64": {
@@ -1423,11 +1448,11 @@
         "generator_function": "maybe",
         "generator_name": "remotejdk11_macos_aarch64",
         "name": "remotejdk11_macos_aarch64",
-        "sha256": "3dcc636e64ae58b922269c2dc9f20f6f967bee90e3f6847d643c4a566f1e8d8a",
-        "strip_prefix": "zulu11.45.27-ca-jdk11.0.10-macosx_aarch64",
+        "sha256": "6bb0d2c6e8a29dcd9c577bbb2986352ba12481a9549ac2c0bcfd00ed60e538d2",
+        "strip_prefix": "zulu11.56.19-ca-jdk11.0.15-macosx_aarch64",
         "urls": [
-            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu11.45.27-ca-jdk11.0.10-macosx_aarch64.tar.gz",
-            "https://cdn.azul.com/zulu/bin/zulu11.45.27-ca-jdk11.0.10-macosx_aarch64.tar.gz"
+            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu11.56.19-ca-jdk11.0.15-macosx_aarch64.tar.gz",
+            "https://cdn.azul.com/zulu/bin/zulu11.56.19-ca-jdk11.0.15-macosx_aarch64.tar.gz"
         ]
     },
     "remotejdk11_macos_aarch64_for_testing": {
@@ -1475,10 +1500,22 @@
         "generator_function": "maybe",
         "generator_name": "remotejdk11_win",
         "name": "remotejdk11_win",
-        "sha256": "a9695617b8374bfa171f166951214965b1d1d08f43218db9a2a780b71c665c18",
-        "strip_prefix": "zulu11.37.17-ca-jdk11.0.6-win_x64",
+        "sha256": "a106c77389a63b6bd963a087d5f01171bd32aa3ee7377ecef87531390dcb9050",
+        "strip_prefix": "zulu11.56.19-ca-jdk11.0.15-win_x64",
         "urls": [
-            "https://mirror.bazel.build/openjdk/azul-zulu11.37.17-ca-jdk11.0.6/zulu11.37.17-ca-jdk11.0.6-win_x64.zip"
+            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu11.56.19-ca-jdk11.0.15-win_x64.zip",
+            "https://cdn.azul.com/zulu/bin/zulu11.56.19-ca-jdk11.0.15-win_x64.zip"
+        ]
+    },
+    "remotejdk11_win_arm64": {
+        "build_file": "@bazel_tools//tools/jdk:jdk.BUILD",
+        "generator_function": "maybe",
+        "generator_name": "remotejdk11_win_arm64",
+        "name": "remotejdk11_win_arm64",
+        "sha256": "b8a28e6e767d90acf793ea6f5bed0bb595ba0ba5ebdf8b99f395266161e53ec2",
+        "strip_prefix": "jdk-11.0.13+8",
+        "urls": [
+            "https://mirror.bazel.build/aka.ms/download-jdk/microsoft-jdk-11.0.13.8.1-windows-aarch64.zip"
         ]
     },
     "remotejdk11_win_arm64_for_testing": {
@@ -1520,85 +1557,28 @@
             "https://cdn.azul.com/zulu/bin/zulu11.56.19-ca-jdk11.0.15-win_x64.zip"
         ]
     },
-    "remotejdk14_linux": {
+    "remotejdk17_linux": {
         "build_file": "@bazel_tools//tools/jdk:jdk.BUILD",
         "generator_function": "maybe",
-        "generator_name": "remotejdk14_linux",
-        "name": "remotejdk14_linux",
-        "sha256": "48bb8947034cd079ad1ef83335e7634db4b12a26743a0dc314b6b861480777aa",
-        "strip_prefix": "zulu14.28.21-ca-jdk14.0.1-linux_x64",
+        "generator_name": "remotejdk17_linux",
+        "name": "remotejdk17_linux",
+        "sha256": "73d5c4bae20325ca41b606f7eae64669db3aac638c5b3ead4a975055846ad6de",
+        "strip_prefix": "zulu17.32.13-ca-jdk17.0.2-linux_x64",
         "urls": [
-            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu14.28.21-ca-jdk14.0.1-linux_x64.tar.gz"
+            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu17.32.13-ca-jdk17.0.2-linux_x64.tar.gz",
+            "https://cdn.azul.com/zulu/bin/zulu17.32.13-ca-jdk17.0.2-linux_x64.tar.gz"
         ]
     },
-    "remotejdk14_macos": {
+    "remotejdk17_linux_aarch64": {
         "build_file": "@bazel_tools//tools/jdk:jdk.BUILD",
         "generator_function": "maybe",
-        "generator_name": "remotejdk14_macos",
-        "name": "remotejdk14_macos",
-        "sha256": "088bd4d0890acc9f032b738283bf0f26b2a55c50b02d1c8a12c451d8ddf080dd",
-        "strip_prefix": "zulu14.28.21-ca-jdk14.0.1-macosx_x64",
+        "generator_name": "remotejdk17_linux_aarch64",
+        "name": "remotejdk17_linux_aarch64",
+        "sha256": "2b8066bbdbc5cff422bb6b6db1b8f8d362b576340cce8492f1255502af632b06",
+        "strip_prefix": "zulu17.32.13-ca-jdk17.0.2-linux_aarch64",
         "urls": [
-            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu14.28.21-ca-jdk14.0.1-macosx_x64.tar.gz"
-        ]
-    },
-    "remotejdk14_win": {
-        "build_file": "@bazel_tools//tools/jdk:jdk.BUILD",
-        "generator_function": "maybe",
-        "generator_name": "remotejdk14_win",
-        "name": "remotejdk14_win",
-        "sha256": "9cb078b5026a900d61239c866161f0d9558ec759aa15c5b4c7e905370e868284",
-        "strip_prefix": "zulu14.28.21-ca-jdk14.0.1-win_x64",
-        "urls": [
-            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu14.28.21-ca-jdk14.0.1-win_x64.zip"
-        ]
-    },
-    "remotejdk15_linux": {
-        "build_file": "@bazel_tools//tools/jdk:jdk.BUILD",
-        "generator_function": "maybe",
-        "generator_name": "remotejdk15_linux",
-        "name": "remotejdk15_linux",
-        "sha256": "0a38f1138c15a4f243b75eb82f8ef40855afcc402e3c2a6de97ce8235011b1ad",
-        "strip_prefix": "zulu15.27.17-ca-jdk15.0.0-linux_x64",
-        "urls": [
-            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu15.27.17-ca-jdk15.0.0-linux_x64.tar.gz",
-            "https://cdn.azul.com/zulu/bin/zulu15.27.17-ca-jdk15.0.0-linux_x64.tar.gz"
-        ]
-    },
-    "remotejdk15_macos": {
-        "build_file": "@bazel_tools//tools/jdk:jdk.BUILD",
-        "generator_function": "maybe",
-        "generator_name": "remotejdk15_macos",
-        "name": "remotejdk15_macos",
-        "sha256": "f80b2e0512d9d8a92be24497334c974bfecc8c898fc215ce0e76594f00437482",
-        "strip_prefix": "zulu15.27.17-ca-jdk15.0.0-macosx_x64",
-        "urls": [
-            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu15.27.17-ca-jdk15.0.0-macosx_x64.tar.gz",
-            "https://cdn.azul.com/zulu/bin/zulu15.27.17-ca-jdk15.0.0-macosx_x64.tar.gz"
-        ]
-    },
-    "remotejdk15_macos_aarch64": {
-        "build_file": "@bazel_tools//tools/jdk:jdk.BUILD",
-        "generator_function": "maybe",
-        "generator_name": "remotejdk15_macos_aarch64",
-        "name": "remotejdk15_macos_aarch64",
-        "sha256": "2613c3f15eef6b6ecd0fd102da92282b985e4573905dc902f1783d8059c1efc5",
-        "strip_prefix": "zulu15.29.15-ca-jdk15.0.2-macosx_aarch64",
-        "urls": [
-            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu15.29.15-ca-jdk15.0.2-macosx_aarch64.tar.gz",
-            "https://cdn.azul.com/zulu/bin/zulu15.29.15-ca-jdk15.0.2-macosx_aarch64.tar.gz"
-        ]
-    },
-    "remotejdk15_win": {
-        "build_file": "@bazel_tools//tools/jdk:jdk.BUILD",
-        "generator_function": "maybe",
-        "generator_name": "remotejdk15_win",
-        "name": "remotejdk15_win",
-        "sha256": "f535a530151e6c20de8a3078057e332b08887cb3ba1a4735717357e72765cad6",
-        "strip_prefix": "zulu15.27.17-ca-jdk15.0.0-win_x64",
-        "urls": [
-            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu15.27.17-ca-jdk15.0.0-win_x64.zip",
-            "https://cdn.azul.com/zulu/bin/zulu15.27.17-ca-jdk15.0.0-win_x64.zip"
+            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu17.32.13-ca-jdk17.0.2-linux_aarch64.tar.gz",
+            "https://cdn.azul.com/zulu/bin/zulu17.32.13-ca-jdk17.0.2-linux_aarch64.tar.gz"
         ]
     },
     "remotejdk17_linux_for_testing": {
@@ -1621,6 +1601,30 @@
             "https://cdn.azul.com/zulu/bin/zulu17.32.13-ca-jdk17.0.2-linux_x64.tar.gz"
         ]
     },
+    "remotejdk17_macos": {
+        "build_file": "@bazel_tools//tools/jdk:jdk.BUILD",
+        "generator_function": "maybe",
+        "generator_name": "remotejdk17_macos",
+        "name": "remotejdk17_macos",
+        "sha256": "89d04b2d99b05dcb25114178e65f6a1c5ca742e125cab0a63d87e7e42f3fcb80",
+        "strip_prefix": "zulu17.32.13-ca-jdk17.0.2-macosx_x64",
+        "urls": [
+            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu17.32.13-ca-jdk17.0.2-macosx_x64.tar.gz",
+            "https://cdn.azul.com/zulu/bin/zulu17.32.13-ca-jdk17.0.2-macosx_x64.tar.gz"
+        ]
+    },
+    "remotejdk17_macos_aarch64": {
+        "build_file": "@bazel_tools//tools/jdk:jdk.BUILD",
+        "generator_function": "maybe",
+        "generator_name": "remotejdk17_macos_aarch64",
+        "name": "remotejdk17_macos_aarch64",
+        "sha256": "54247dde248ffbcd3c048675504b1c503b81daf2dc0d64a79e353c48d383c977",
+        "strip_prefix": "zulu17.32.13-ca-jdk17.0.2-macosx_aarch64",
+        "urls": [
+            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu17.32.13-ca-jdk17.0.2-macosx_aarch64.tar.gz",
+            "https://cdn.azul.com/zulu/bin/zulu17.32.13-ca-jdk17.0.2-macosx_aarch64.tar.gz"
+        ]
+    },
     "remotejdk17_macos_aarch64_for_testing": {
         "build_file": "@local_jdk//:BUILD.bazel",
         "generator_function": "dist_http_archive",
@@ -1661,6 +1665,30 @@
             "https://cdn.azul.com/zulu/bin/zulu17.32.13-ca-jdk17.0.2-macosx_x64.tar.gz"
         ]
     },
+    "remotejdk17_win": {
+        "build_file": "@bazel_tools//tools/jdk:jdk.BUILD",
+        "generator_function": "maybe",
+        "generator_name": "remotejdk17_win",
+        "name": "remotejdk17_win",
+        "sha256": "e965aa0ea7a0661a3446cf8f10ee00684b851f883b803315289f26b4aa907fdb",
+        "strip_prefix": "zulu17.32.13-ca-jdk17.0.2-win_x64",
+        "urls": [
+            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu17.32.13-ca-jdk17.0.2-win_x64.zip",
+            "https://cdn.azul.com/zulu/bin/zulu17.32.13-ca-jdk17.0.2-win_x64.zip"
+        ]
+    },
+    "remotejdk17_win_arm64": {
+        "build_file": "@bazel_tools//tools/jdk:jdk.BUILD",
+        "generator_function": "maybe",
+        "generator_name": "remotejdk17_win_arm64",
+        "name": "remotejdk17_win_arm64",
+        "sha256": "811d7e7591bac4f081dfb00ba6bd15b6fc5969e1f89f0f327ef75147027c3877",
+        "strip_prefix": "zulu17.30.15-ca-jdk17.0.1-win_aarch64",
+        "urls": [
+            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu17.30.15-ca-jdk17.0.1-win_aarch64.zip",
+            "https://cdn.azul.com/zulu/bin/zulu17.30.15-ca-jdk17.0.1-win_aarch64.zip"
+        ]
+    },
     "remotejdk17_win_arm64_for_testing": {
         "build_file": "@local_jdk//:BUILD.bazel",
         "generator_function": "dist_http_archive",
@@ -1701,6 +1729,30 @@
             "https://cdn.azul.com/zulu/bin/zulu17.32.13-ca-jdk17.0.2-win_x64.zip"
         ]
     },
+    "remotejdk18_linux": {
+        "build_file": "@bazel_tools//tools/jdk:jdk.BUILD",
+        "generator_function": "maybe",
+        "generator_name": "remotejdk18_linux",
+        "name": "remotejdk18_linux",
+        "sha256": "959a94ca4097dcaabc7886784cec10dfdf2b0a3bff890ea8943cc09c5fff29cb",
+        "strip_prefix": "zulu18.28.13-ca-jdk18.0.0-linux_x64",
+        "urls": [
+            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu18.28.13-ca-jdk18.0.0-linux_x64.tar.gz",
+            "https://cdn.azul.com/zulu/bin/zulu18.28.13-ca-jdk18.0.0-linux_x64.tar.gz"
+        ]
+    },
+    "remotejdk18_linux_aarch64": {
+        "build_file": "@bazel_tools//tools/jdk:jdk.BUILD",
+        "generator_function": "maybe",
+        "generator_name": "remotejdk18_linux_aarch64",
+        "name": "remotejdk18_linux_aarch64",
+        "sha256": "a1d5f78172f32f819d08e9043b0f82fa7af738b37c55c6ca8d6092c61d204d53",
+        "strip_prefix": "zulu18.28.13-ca-jdk18.0.0-linux_aarch64",
+        "urls": [
+            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu18.28.13-ca-jdk18.0.0-linux_aarch64.tar.gz",
+            "https://cdn.azul.com/zulu/bin/zulu18.28.13-ca-jdk18.0.0-linux_aarch64.tar.gz"
+        ]
+    },
     "remotejdk18_linux_for_testing": {
         "build_file": "@local_jdk//:BUILD.bazel",
         "generator_function": "dist_http_archive",
@@ -1721,6 +1773,30 @@
             "https://cdn.azul.com/zulu/bin/zulu18.28.13-ca-jdk18.0.0-linux_x64.tar.gz"
         ]
     },
+    "remotejdk18_macos": {
+        "build_file": "@bazel_tools//tools/jdk:jdk.BUILD",
+        "generator_function": "maybe",
+        "generator_name": "remotejdk18_macos",
+        "name": "remotejdk18_macos",
+        "sha256": "780a9aa4bda95a6793bf41d13f837c59ef915e9bfd0e0c5fd4c70e4cdaa88541",
+        "strip_prefix": "zulu18.28.13-ca-jdk18.0.0-macosx_x64",
+        "urls": [
+            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu18.28.13-ca-jdk18.0.0-macosx_x64.tar.gz",
+            "https://cdn.azul.com/zulu/bin/zulu18.28.13-ca-jdk18.0.0-macosx_x64.tar.gz"
+        ]
+    },
+    "remotejdk18_macos_aarch64": {
+        "build_file": "@bazel_tools//tools/jdk:jdk.BUILD",
+        "generator_function": "maybe",
+        "generator_name": "remotejdk18_macos_aarch64",
+        "name": "remotejdk18_macos_aarch64",
+        "sha256": "9595e001451e201fdf33c1952777968a3ac18fe37273bdeaea5b5ed2c4950432",
+        "strip_prefix": "zulu18.28.13-ca-jdk18.0.0-macosx_aarch64",
+        "urls": [
+            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu18.28.13-ca-jdk18.0.0-macosx_aarch64.tar.gz",
+            "https://cdn.azul.com/zulu/bin/zulu18.28.13-ca-jdk18.0.0-macosx_aarch64.tar.gz"
+        ]
+    },
     "remotejdk18_macos_aarch64_for_testing": {
         "build_file": "@local_jdk//:BUILD.bazel",
         "generator_function": "dist_http_archive",
@@ -1761,6 +1837,30 @@
             "https://cdn.azul.com/zulu/bin/zulu18.28.13-ca-jdk18.0.0-macosx_x64.tar.gz"
         ]
     },
+    "remotejdk18_win": {
+        "build_file": "@bazel_tools//tools/jdk:jdk.BUILD",
+        "generator_function": "maybe",
+        "generator_name": "remotejdk18_win",
+        "name": "remotejdk18_win",
+        "sha256": "6c75498163b047595386fdb909cb6d4e04282c3a81799743c5e1f9316391fe16",
+        "strip_prefix": "zulu18.28.13-ca-jdk18.0.0-win_x64",
+        "urls": [
+            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu18.28.13-ca-jdk18.0.0-win_x64.zip",
+            "https://cdn.azul.com/zulu/bin/zulu18.28.13-ca-jdk18.0.0-win_x64.zip"
+        ]
+    },
+    "remotejdk18_win_arm64": {
+        "build_file": "@bazel_tools//tools/jdk:jdk.BUILD",
+        "generator_function": "maybe",
+        "generator_name": "remotejdk18_win_arm64",
+        "name": "remotejdk18_win_arm64",
+        "sha256": "9b52b259516e4140ee56b91f77750667bffbc543e78ad8c39082449d4c377b54",
+        "strip_prefix": "zulu18.28.13-ca-jdk18.0.0-win_aarch64",
+        "urls": [
+            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu18.28.13-ca-jdk18.0.0-win_aarch64.zip",
+            "https://cdn.azul.com/zulu/bin/zulu18.28.13-ca-jdk18.0.0-win_aarch64.zip"
+        ]
+    },
     "remotejdk18_win_arm64_for_testing": {
         "build_file": "@local_jdk//:BUILD.bazel",
         "generator_function": "dist_http_archive",
diff --git a/pkgs/development/tools/build-managers/waf/default.nix b/pkgs/development/tools/build-managers/waf/default.nix
index 4e42927d0293..218783fd4926 100644
--- a/pkgs/development/tools/build-managers/waf/default.nix
+++ b/pkgs/development/tools/build-managers/waf/default.nix
@@ -4,7 +4,7 @@
 }:
 let
   wafToolsArg = with lib.strings;
-    optionalString (!isNull withTools) " --tools=\"${concatStringsSep "," withTools}\"";
+    optionalString (withTools != null) " --tools=\"${concatStringsSep "," withTools}\"";
 in
 stdenv.mkDerivation rec {
   pname = "waf";
diff --git a/pkgs/development/tools/language-servers/jdt-language-server/default.nix b/pkgs/development/tools/language-servers/jdt-language-server/default.nix
index 1b194814a270..6d77d43accc5 100644
--- a/pkgs/development/tools/language-servers/jdt-language-server/default.nix
+++ b/pkgs/development/tools/language-servers/jdt-language-server/default.nix
@@ -7,12 +7,12 @@
 
 stdenv.mkDerivation rec {
   pname = "jdt-language-server";
-  version = "1.19.0";
-  timestamp = "202301171536";
+  version = "1.20.0";
+  timestamp = "202302201605";
 
   src = fetchurl {
     url = "https://download.eclipse.org/jdtls/milestones/${version}/jdt-language-server-${version}-${timestamp}.tar.gz";
-    sha256 = "sha256-9rreuMw2pODzOVX5PBmUZoV5ixUDilQyTsrnyCQ+IHs=";
+    sha256 = "sha256-5izNGPZ3jXtJEPWIFzrwZsNi8esxh4PUn7xIWp4TV2U=";
   };
 
   sourceRoot = ".";
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
       # The application ships with config directories for linux and mac
       configDir = if stdenv.isDarwin then "config_mac" else "config_linux";
     in
-    ''
+      ''
       # Copy jars
       install -D -t $out/share/java/plugins/ plugins/*.jar
 
diff --git a/pkgs/development/tools/misc/opengrok/default.nix b/pkgs/development/tools/misc/opengrok/default.nix
index 0a2bbc30fb52..0c2de11eb5e4 100644
--- a/pkgs/development/tools/misc/opengrok/default.nix
+++ b/pkgs/development/tools/misc/opengrok/default.nix
@@ -1,26 +1,26 @@
-{ lib, stdenv, fetchurl, jre, ctags, makeWrapper, coreutils, git, runtimeShell }:
+{ lib, stdenv, fetchurl, jre, makeWrapper }:
 
 stdenv.mkDerivation rec {
   pname = "opengrok";
-  version = "1.0";
+  version = "1.8.4";
 
   # binary distribution
   src = fetchurl {
     url = "https://github.com/oracle/opengrok/releases/download/${version}/${pname}-${version}.tar.gz";
-    sha256 = "0h4rwfh8m41b7ij931gcbmkihri25m48373qf6ig0714s66xwc4i";
+    hash = "sha256-Xy8mTpdHorGGvUGHCDKOA2HaAJY3PBWjf6Pnll4Melk=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
+    runHook preInstall
+
     mkdir -p $out
     cp -a * $out/
-    substituteInPlace $out/bin/OpenGrok --replace "/bin/uname" "${coreutils}/bin/uname"
-    substituteInPlace $out/bin/Messages --replace "#!/bin/ksh" "#!${runtimeShell}"
-    wrapProgram $out/bin/OpenGrok \
-      --prefix PATH : "${lib.makeBinPath [ ctags git ]}" \
-      --set JAVA_HOME "${jre}" \
-      --set OPENGROK_TOMCAT_BASE "/var/tomcat"
+    makeWrapper ${jre}/bin/java $out/bin/opengrok \
+      --add-flags "-jar $out/lib/opengrok.jar"
+
+    runHook postInstall
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/tools/poetry2nix/poetry2nix/overrides/default.nix b/pkgs/development/tools/poetry2nix/poetry2nix/overrides/default.nix
index a5bb46309f4c..cb5bda0bba76 100644
--- a/pkgs/development/tools/poetry2nix/poetry2nix/overrides/default.nix
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/overrides/default.nix
@@ -50,7 +50,7 @@ let
             {
               nativeBuildInputs =
                 (old.nativeBuildInputs or [ ])
-                ++ lib.optionals (!(builtins.isNull buildSystem)) [ buildSystem ]
+                ++ lib.optionals (buildSystem != null) [ buildSystem ]
                 ++ map (a: self.${a}) extraAttrs;
             }
         )
diff --git a/pkgs/development/tools/protoc-gen-grpc-web/default.nix b/pkgs/development/tools/protoc-gen-grpc-web/default.nix
index 0b7eca7e1deb..15d2e9ec0cae 100644
--- a/pkgs/development/tools/protoc-gen-grpc-web/default.nix
+++ b/pkgs/development/tools/protoc-gen-grpc-web/default.nix
@@ -1,27 +1,31 @@
-{ lib, stdenv, fetchFromGitHub, protobuf }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, protobuf
+, isStatic ? stdenv.hostPlatform.isStatic
+}:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "protoc-gen-grpc-web";
-  version = "1.3.1";
+  version = "1.4.2";
 
   src = fetchFromGitHub {
     owner = "grpc";
     repo = "grpc-web";
-    rev = version;
-    sha256 = "sha256-NRShN4X9JmCjqPVY/q9oSxSOvv1bP//vM9iOZ6ap5vc=";
+    rev = finalAttrs.version;
+    sha256 = "sha256-OetDAZ6zC8r7e82FILpQQnM+JHG9eludwhEuPaklrnw=";
   };
 
   sourceRoot = "source/javascript/net/grpc/web/generator";
 
+  enableParallelBuilding = true;
   strictDeps = true;
   nativeBuildInputs = [ protobuf ];
   buildInputs = [ protobuf ];
 
-  makeFlags = [ "PREFIX=$(out)" "STATIC=no" ];
-
-  patches = [
-    # https://github.com/grpc/grpc-web/pull/1210
-    ./optional-static.patch
+  makeFlags = [
+    "PREFIX=$(out)"
+    "STATIC=${if isStatic then "yes" else "no"}"
   ];
 
   doCheck = true;
@@ -33,7 +37,7 @@ stdenv.mkDerivation rec {
     mkdir -p "$CHECK_TMPDIR"
 
     protoc \
-      --proto_path="${src}/packages/grpc-web/test/protos" \
+      --proto_path="$src/packages/grpc-web/test/protos" \
       --plugin="./protoc-gen-grpc-web" \
       --grpc-web_out="import_style=commonjs,mode=grpcwebtext:$CHECK_TMPDIR" \
       echo.proto
@@ -46,10 +50,10 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     homepage = "https://github.com/grpc/grpc-web";
-    changelog = "https://github.com/grpc/grpc-web/blob/${version}/CHANGELOG.md";
+    changelog = "https://github.com/grpc/grpc-web/blob/${finalAttrs.version}/CHANGELOG.md";
     description = "gRPC web support for Google's protocol buffers";
     license = licenses.asl20;
     maintainers = with maintainers; [ jk ];
     platforms = platforms.unix;
   };
-}
+})
diff --git a/pkgs/development/tools/protoc-gen-grpc-web/optional-static.patch b/pkgs/development/tools/protoc-gen-grpc-web/optional-static.patch
deleted file mode 100644
index a7ca112749c1..000000000000
--- a/pkgs/development/tools/protoc-gen-grpc-web/optional-static.patch
+++ /dev/null
@@ -1,19 +0,0 @@
---- a/Makefile
-+++ b/Makefile
-@@ -18,12 +18,15 @@ CXXFLAGS += -std=c++11
- LDFLAGS += -L/usr/local/lib -lprotoc -lprotobuf -lpthread -ldl
- PREFIX ?= /usr/local
- MIN_MACOS_VERSION := 10.7 # Supports OS X Lion
-+STATIC ?= yes
-
- UNAME_S := $(shell uname -s)
- ifeq ($(UNAME_S),Darwin)
-   CXXFLAGS += -stdlib=libc++ -mmacosx-version-min=$(MIN_MACOS_VERSION)
- else ifeq ($(UNAME_S),Linux)
--  LDFLAGS += -static
-+  ifeq ($(STATIC),yes)
-+    LDFLAGS += -static
-+  endif
- endif
-
- all: protoc-gen-grpc-web
diff --git a/pkgs/development/tools/revive/default.nix b/pkgs/development/tools/revive/default.nix
index 9b75282fbf08..b5bc7c111cb3 100644
--- a/pkgs/development/tools/revive/default.nix
+++ b/pkgs/development/tools/revive/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "revive";
-  version = "1.2.5";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "mgechev";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-pWX3dZqZ9UZ/k8c1K0xAgonsxZVrutWJ1PROQusO9vQ=";
+    sha256 = "sha256-J+LAv0cLG+ucvOywLhaL/LObMO4tPUcLEv+dItHcPBI=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -18,7 +18,7 @@ buildGoModule rec {
       rm -rf $out/.git
     '';
   };
-  vendorHash = "sha256-IfayKnHCe1HHSi7YPNz8Wlz1TSAiVGs0rxpY9HYG3s8=";
+  vendorHash = "sha256-FHm4TjsAYu4VM2WAHdd2xPP3/54YM6ei6cppHWF8LDc=";
 
   ldflags = [
     "-s"
@@ -35,7 +35,7 @@ buildGoModule rec {
 
   # The following tests fail when built by nix:
   #
-  # $ nix log /nix/store/build-revive.1.2.5.drv | grep FAIL
+  # $ nix log /nix/store/build-revive.1.3.0.drv | grep FAIL
   #
   # --- FAIL: TestAll (0.01s)
   # --- FAIL: TestTimeEqual (0.00s)
diff --git a/pkgs/games/cataclysm-dda/pkgs/default.nix b/pkgs/games/cataclysm-dda/pkgs/default.nix
index 39abad809c5b..72b2c814389a 100644
--- a/pkgs/games/cataclysm-dda/pkgs/default.nix
+++ b/pkgs/games/cataclysm-dda/pkgs/default.nix
@@ -16,7 +16,7 @@ let
   pkgs' = lib.mapAttrs (_: mods: lib.filterAttrs isAvailable mods) pkgs;
 
   isAvailable = _: mod:
-  if isNull build then
+  if (build == null) then
     true
   else if build.isTiles then
     mod.forTiles or false
diff --git a/pkgs/games/curseofwar/default.nix b/pkgs/games/curseofwar/default.nix
index 6271a60f5b9c..fef456816ff2 100644
--- a/pkgs/games/curseofwar/default.nix
+++ b/pkgs/games/curseofwar/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
     SDL
   ];
 
-  makeFlags = (if isNull SDL then [] else [ "SDL=yes" ]) ++ [
+  makeFlags = (lib.optionals (SDL != null) [ "SDL=yes" ]) ++ [
     "PREFIX=$(out)"
     # force platform's cc on darwin, otherwise gcc is used
     "CC=${stdenv.cc.targetPrefix}cc"
diff --git a/pkgs/games/lgames/lbreakouthd/default.nix b/pkgs/games/lgames/lbreakouthd/default.nix
index 65280e3c9ae6..78000279c7c5 100644
--- a/pkgs/games/lgames/lbreakouthd/default.nix
+++ b/pkgs/games/lgames/lbreakouthd/default.nix
@@ -1,20 +1,20 @@
 { lib
 , stdenv
 , fetchurl
+, directoryListingUpdater
 , SDL2
 , SDL2_image
 , SDL2_mixer
 , SDL2_ttf
-, directoryListingUpdater
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (self: {
   pname = "lbreakouthd";
-  version = "1.1";
+  version = "1.1.1";
 
   src = fetchurl {
-    url = "mirror://sourceforge/lgames/${pname}-${version}.tar.gz";
-    hash = "sha256-5hjS0aJ5f8Oe0aSuVgcV10h5OmWsaMHF5B9wYVFrlDY=";
+    url = "mirror://sourceforge/lgames/lbreakouthd-${self.version}.tar.gz";
+    hash = "sha256-ljnZpuV9HPPR5bgdbyE8gUtb4m+JppxGm3MV691sw7E=";
   };
 
   buildInputs = [
@@ -27,17 +27,17 @@ stdenv.mkDerivation rec {
   hardeningDisable = [ "format" ];
 
   passthru.updateScript = directoryListingUpdater {
-    inherit pname version;
+    inherit (self) pname version;
     url = "https://lgames.sourceforge.io/LBreakoutHD/";
     extraRegex = "(?!.*-win(32|64)).*";
   };
 
-  meta = with lib; {
-    broken = stdenv.isDarwin;
+  meta = {
     homepage = "https://lgames.sourceforge.io/LBreakoutHD/";
     description = "A widescreen Breakout clone";
-    license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ AndersonTorres ];
+    license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [ AndersonTorres ];
     inherit (SDL2.meta) platforms;
+    broken = stdenv.isDarwin;
   };
-}
+})
diff --git a/pkgs/games/tetrio-desktop/default.nix b/pkgs/games/tetrio-desktop/default.nix
index 221f0160ca95..a48f2b22138a 100644
--- a/pkgs/games/tetrio-desktop/default.nix
+++ b/pkgs/games/tetrio-desktop/default.nix
@@ -1,6 +1,7 @@
 { stdenv
 , lib
 , fetchurl
+, dpkg
 , autoPatchelfHook
 , wrapGAppsHook
 , alsa-lib
@@ -29,10 +30,13 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [
+    dpkg
     autoPatchelfHook
     wrapGAppsHook
   ];
 
+  dontWrapGApps = true;
+
   buildInputs = [
     alsa-lib
     cups
@@ -44,24 +48,20 @@ stdenv.mkDerivation rec {
     gtk3
   ];
 
-  dontWrapGApps = true;
-
   libPath = lib.makeLibraryPath [
     libpulseaudio
     systemd
   ];
 
-  unpackPhase = ''
-    mkdir -p $TMP/tetrio-desktop $out/bin
-    cp $src $TMP/tetrio-desktop.deb
-    ar vx $TMP/tetrio-desktop.deb
-    tar --no-overwrite-dir -xvf data.tar.xz -C $TMP/tetrio-desktop/
-  '';
+  unpackCmd = "dpkg -x $curSrc src";
 
   installPhase = ''
     runHook preInstall
 
-    cp -R $TMP/tetrio-desktop/{usr/share,opt} $out/
+    mkdir $out
+    cp -r opt/ usr/share/ $out
+
+    mkdir $out/bin
     ln -s $out/opt/TETR.IO/tetrio-desktop $out/bin/
 
     substituteInPlace $out/share/applications/tetrio-desktop.desktop \
@@ -71,8 +71,8 @@ stdenv.mkDerivation rec {
   '';
 
   postInstall = lib.strings.optionalString withTetrioPlus ''
-      cp ${tetrio-plus} $out/opt/TETR.IO/resources/app.asar
-    '';
+    cp ${tetrio-plus} $out/opt/TETR.IO/resources/app.asar
+  '';
 
   postFixup = ''
     wrapProgram $out/opt/TETR.IO/tetrio-desktop \
diff --git a/pkgs/games/tetrio-desktop/tetrio-plus.nix b/pkgs/games/tetrio-desktop/tetrio-plus.nix
index 04e2f4673a5c..64f5dd5d85cc 100644
--- a/pkgs/games/tetrio-desktop/tetrio-plus.nix
+++ b/pkgs/games/tetrio-desktop/tetrio-plus.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "tetrio-plus";
-  version = "0.25.2";
+  version = "0.25.3";
 
   src = fetchzip {
-    url = "https://gitlab.com/UniQMG/tetrio-plus/uploads/5c720489d2bcd35629b4f8a1f36d28b1/tetrio-plus_0.25.2_app.asar.zip";
-    sha256 = "sha256-8Xc2wftRYIMZ2ee67IJEIGGrAAS02CL0XzDqQ/luYVE=";
+    url = "https://gitlab.com/UniQMG/tetrio-plus/uploads/684477053451cd0819e2c84e145966eb/tetrio-plus_0.25.3_app.asar.zip";
+    sha256 = "sha256-GQgt4GZNeKx/uzmVsuKppW2zg8AAiGqsk2JYJIkqfVE=";
   };
 
   installPhase = ''
diff --git a/pkgs/os-specific/linux/firmware/ipu6-camera-bins/default.nix b/pkgs/os-specific/linux/firmware/ipu6-camera-bins/default.nix
index b8c9d9d0d436..bad61f02ad94 100644
--- a/pkgs/os-specific/linux/firmware/ipu6-camera-bins/default.nix
+++ b/pkgs/os-specific/linux/firmware/ipu6-camera-bins/default.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation {
       include \
       $out/
 
-    install -D ../LICENSE $out/share/doc
+    install -m 0644 -D ../LICENSE $out/share/doc/LICENSE
 
     runHook postInstall
   '';
diff --git a/pkgs/os-specific/linux/mwprocapture/default.nix b/pkgs/os-specific/linux/mwprocapture/default.nix
index 0eedc5e08a1f..681307a00b29 100644
--- a/pkgs/os-specific/linux/mwprocapture/default.nix
+++ b/pkgs/os-specific/linux/mwprocapture/default.nix
@@ -12,12 +12,12 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "mwprocapture";
-  subVersion = "4236";
+  subVersion = "4328";
   version = "1.3.0.${subVersion}-${kernel.version}";
 
   src = fetchurl {
     url = "https://www.magewell.com/files/drivers/ProCaptureForLinux_${subVersion}.tar.gz";
-    sha256 = "1mfgj84km276sq5i8dny1vqp2ycqpvgplrmpbqwnk230d0w3qs74";
+    sha256 = "197l86ad52ijmmq5an6891gd1chhkxqiagamcchirrky4c50qs36";
   };
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
@@ -33,8 +33,6 @@ stdenv.mkDerivation rec {
     "KERNELDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
   ];
 
-  patches = [ ./pci.patch ];
-
   env.NIX_CFLAGS_COMPILE = "-Wno-error=implicit-fallthrough";
 
   postInstall = ''
@@ -59,7 +57,6 @@ stdenv.mkDerivation rec {
   '';
 
   meta = {
-    broken = kernel.kernelAtLeast "5.16";
     homepage = "https://www.magewell.com/";
     description = "Linux driver for the Magewell Pro Capture family";
     license = licenses.unfreeRedistributable;
diff --git a/pkgs/os-specific/linux/mwprocapture/pci.patch b/pkgs/os-specific/linux/mwprocapture/pci.patch
deleted file mode 100644
index b6b22d6143bf..000000000000
--- a/pkgs/os-specific/linux/mwprocapture/pci.patch
+++ /dev/null
@@ -1,20 +0,0 @@
-diff --git a/src/sources/avstream/capture.c b/src/sources/avstream/capture.c
-index f5d256d..a104f62 100644
---- a/src/sources/avstream/capture.c
-+++ b/src/sources/avstream/capture.c
-@@ -288,12 +288,12 @@ static int xi_cap_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
-     }
- 
-     if ((sizeof(dma_addr_t) > 4) &&
--            !pci_set_dma_mask(pdev, DMA_BIT_MASK(64))) {
-+            !dma_set_mask(&pdev->dev, DMA_BIT_MASK(64))) {
-         xi_debug(1, "dma 64 OK!\n");
-     } else {
-         xi_debug(1, "dma 64 not OK!\n");
--        if ((pci_set_dma_mask(pdev, DMA_BIT_MASK(64)) < 0) &&
--                (pci_set_dma_mask(pdev, DMA_BIT_MASK(32))) < 0) {
-+        if ((dma_set_mask(&pdev->dev, DMA_BIT_MASK(64)) < 0) &&
-+                (dma_set_mask(&pdev->dev, DMA_BIT_MASK(32))) < 0) {
-             xi_debug(0, "DMA configuration failed\n");
-             goto disable_pci;
-         }
diff --git a/pkgs/servers/http/apache-modules/mod_tile/default.nix b/pkgs/servers/http/apache-modules/mod_tile/default.nix
index 33d02f07093c..359dc17b390d 100644
--- a/pkgs/servers/http/apache-modules/mod_tile/default.nix
+++ b/pkgs/servers/http/apache-modules/mod_tile/default.nix
@@ -1,77 +1,66 @@
-{ lib
+{ fetchFromGitHub
+, lib
 , stdenv
-, fetchFromGitHub
-, fetchpatch
-, autoreconfHook
+, cmake
+, pkg-config
 , apacheHttpd
 , apr
-, cairo
-, iniparser
-, mapnik
+, aprutil
 , boost
-, icu
+, cairo
+, curl
+, glib
+, gtk2
 , harfbuzz
-, libjpeg
-, libtiff
-, libwebp
-, proj
-, sqlite
+, icu
+, iniparser
+, libmemcached
+, mapnik
 }:
 
 stdenv.mkDerivation rec {
   pname = "mod_tile";
-  version = "unstable-2017-01-08";
+  version = "0.6.1+unstable=2023-03-09";
 
   src = fetchFromGitHub {
     owner = "openstreetmap";
     repo = "mod_tile";
-    rev = "e25bfdba1c1f2103c69529f1a30b22a14ce311f1";
-    sha256 = "12c96avka1dfb9wxqmjd57j30w9h8yx4y4w34kyq6xnf6lwnkcxp";
+    rev = "f521540df1003bb000d7367a59ad612161eab0f0";
+    sha256 = "sha256-jIqeplAQt4W97PNKm6ZDGPDUc/PEiLM5yEdPeI+H03A=";
   };
 
-  patches = [
-    # Pull upstream fix for -fno-common toolchains:
-    #  https://github.com/openstreetmap/mod_tile/pull/202
-    (fetchpatch {
-      name = "fno-common";
-      url = "https://github.com/openstreetmap/mod_tile/commit/a22065b8ae3c018820a5ca9bf8e2b2bb0a0bfeb4.patch";
-      sha256 = "1ywfa14xn9aa96vx1adn1ndi29qpflca06x986bx9c5pqk761yz3";
-    })
+  nativeBuildInputs = [
+    cmake
+    pkg-config
   ];
 
-  # test is broken and I couldn't figure out a better way to disable it.
-  postPatch = ''
-    echo "int main(){return 0;}" > src/gen_tile_test.cpp
-  '';
-
-  nativeBuildInputs = [ autoreconfHook ];
   buildInputs = [
     apacheHttpd
     apr
-    cairo
-    iniparser
-    mapnik
+    aprutil
     boost
-    icu
+    cairo
+    curl
+    glib
     harfbuzz
-    libjpeg
-    libtiff
-    libwebp
-    proj
-    sqlite
+    icu
+    iniparser
+    libmemcached
+    mapnik
   ];
 
-  configureFlags = [
-    "--with-apxs=${apacheHttpd.dev}/bin/apxs"
-  ];
-
-  installPhase = ''
-    mkdir -p $out/modules
-    make install-mod_tile DESTDIR=$out
-    mv $out${apacheHttpd}/* $out
-    rm -rf $out/nix
+  # the install script wants to install mod_tile.so into apache's modules dir
+  postPatch = ''
+    sed -i "s|\''${HTTPD_MODULES_DIR}|$out/modules|" CMakeLists.txt
   '';
 
+  enableParallelBuilding = true;
+
+  # We need to either disable the `render_speedtest` and `download_tile` tests
+  # or fix the URLs they try to download from
+  #cmakeFlags = [ "-DENABLE_TESTS=1" ];
+  #doCheck = true;
+
   meta = with lib; {
     homepage = "https://github.com/openstreetmap/mod_tile";
     description = "Efficiently render and serve OpenStreetMap tiles using Apache and Mapnik";
diff --git a/pkgs/servers/http/lighttpd/default.nix b/pkgs/servers/http/lighttpd/default.nix
index 2cb6e6cfdd7a..ec727c464954 100644
--- a/pkgs/servers/http/lighttpd/default.nix
+++ b/pkgs/servers/http/lighttpd/default.nix
@@ -15,11 +15,11 @@
 
 stdenv.mkDerivation rec {
   pname = "lighttpd";
-  version = "1.4.68";
+  version = "1.4.69";
 
   src = fetchurl {
     url = "https://download.lighttpd.net/lighttpd/releases-${lib.versions.majorMinor version}.x/${pname}-${version}.tar.xz";
-    sha256 = "sha256-5W83rlK2PhraTXbOeABa/7blbuova9sM4X1tNulYM4Q=";
+    sha256 = "sha256-FqyNuV5xlim6YZSbmfiib+upRqgdGFIVsoN5u0EWsLQ=";
   };
 
   postPatch = ''
diff --git a/pkgs/servers/nosql/arangodb/default.nix b/pkgs/servers/nosql/arangodb/default.nix
index 3d15654300ca..443fdeffb10a 100644
--- a/pkgs/servers/nosql/arangodb/default.nix
+++ b/pkgs/servers/nosql/arangodb/default.nix
@@ -25,7 +25,7 @@ let
     else "core";
 
   targetArch =
-    if isNull targetArchitecture
+    if targetArchitecture == null
     then defaultTargetArchitecture
     else targetArchitecture;
 in
diff --git a/pkgs/stdenv/generic/make-derivation.nix b/pkgs/stdenv/generic/make-derivation.nix
index 7d8c311edce2..50d4b58615b5 100644
--- a/pkgs/stdenv/generic/make-derivation.nix
+++ b/pkgs/stdenv/generic/make-derivation.nix
@@ -214,7 +214,7 @@ let
 
   checkDependencyList = checkDependencyList' [];
   checkDependencyList' = positions: name: deps: lib.flip lib.imap1 deps (index: dep:
-    if lib.isDerivation dep || isNull dep || builtins.typeOf dep == "string" || builtins.typeOf dep == "path" then dep
+    if lib.isDerivation dep || dep == null || builtins.typeOf dep == "string" || builtins.typeOf dep == "path" then dep
     else if lib.isList dep then checkDependencyList' ([index] ++ positions) name dep
     else throw "Dependency is not of a valid type: ${lib.concatMapStrings (ix: "element ${toString ix} of ") ([index] ++ positions)}${name} for ${attrs.name or attrs.pname}");
 in if builtins.length erroneousHardeningFlags != 0
diff --git a/pkgs/tools/admin/azure-cli/default.nix b/pkgs/tools/admin/azure-cli/default.nix
index bd3afcb53213..5b3f087f7018 100644
--- a/pkgs/tools/admin/azure-cli/default.nix
+++ b/pkgs/tools/admin/azure-cli/default.nix
@@ -27,7 +27,9 @@ py.pkgs.toPythonApplication (py.pkgs.buildAzureCliPackage {
     substituteInPlace setup.py \
       --replace "chardet~=3.0.4" "chardet" \
       --replace "javaproperties~=0.5.1" "javaproperties" \
-      --replace "scp~=0.13.2" "scp"
+      --replace "scp~=0.13.2" "scp" \
+      --replace "packaging>=20.9,<22.0" "packaging" \
+      --replace "fabric~=2.4" "fabric"
 
     # remove namespace hacks
     # remove urllib3 because it was added as 'urllib3[secure]', which doesn't get handled well
diff --git a/pkgs/tools/admin/azure-cli/python-packages.nix b/pkgs/tools/admin/azure-cli/python-packages.nix
index 9450365019da..5417425c06fb 100644
--- a/pkgs/tools/admin/azure-cli/python-packages.nix
+++ b/pkgs/tools/admin/azure-cli/python-packages.nix
@@ -62,7 +62,8 @@ let
           substituteInPlace setup.py \
             --replace "requests[socks]~=2.25.1" "requests[socks]~=2.25" \
             --replace "cryptography>=3.2,<3.4" "cryptography" \
-            --replace "msal-extensions>=0.3.1,<0.4" "msal-extensions"
+            --replace "msal-extensions>=0.3.1,<0.4" "msal-extensions" \
+            --replace "packaging>=20.9,<22.0" "packaging"
         '';
         nativeCheckInputs = with self; [ pytest ];
         doCheck = stdenv.isLinux;
diff --git a/pkgs/tools/compression/orz/default.nix b/pkgs/tools/compression/orz/default.nix
new file mode 100644
index 000000000000..a0c9a4653ca5
--- /dev/null
+++ b/pkgs/tools/compression/orz/default.nix
@@ -0,0 +1,39 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, rust-cbindgen
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "orz";
+  version = "1.6.2";
+
+  src = fetchFromGitHub {
+    owner = "richox";
+    repo = "orz";
+    rev = "v${version}";
+    hash = "sha256-Yro+iXlg18Pj/AkU4IjvgA88xctK65yStfTilz+IRs0=";
+  };
+
+  cargoHash = "sha256-aUsRbIajBP6esjW7Wj7mqIkbYUCbZ2GgxjRXMPTnHYg=";
+
+  outputs = [ "out" "dev" "lib" ];
+
+  nativeBuildInputs = [
+    rust-cbindgen
+  ];
+
+  postInstall = ''
+    cbindgen -o $dev/include/orz.h
+
+    mkdir -p $lib
+    mv $out/lib "$lib"
+  '';
+
+  meta = with lib; {
+    description = "A high performance, general purpose data compressor written in rust";
+    homepage = "https://github.com/richox/orz";
+    license = licenses.mit;
+    maintainers = with maintainers; [ figsoda ];
+  };
+}
diff --git a/pkgs/tools/graphics/dpic/default.nix b/pkgs/tools/graphics/dpic/default.nix
index 59518942963f..ca43d2f4c772 100644
--- a/pkgs/tools/graphics/dpic/default.nix
+++ b/pkgs/tools/graphics/dpic/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "dpic";
-  version = "2021.11.01";
+  version = "2023.02.01";
 
   src = fetchurl {
     url = "https://ece.uwaterloo.ca/~aplevich/dpic/${pname}-${version}.tar.gz";
-    sha256 = "sha256-TkMc5tG+sPHfjiCxli5bIteJfq5ZG36+HaqZOk/v6oI=";
+    sha256 = "sha256-0Fn/KMBFUgZsFk+xRv7o4BAblT5G51kZs9z6qZsDGuY=";
   };
 
   # The prefix passed to configure is not used.
diff --git a/pkgs/tools/misc/plfit/default.nix b/pkgs/tools/misc/plfit/default.nix
index 60d08e69d457..78e7c3572b6f 100644
--- a/pkgs/tools/misc/plfit/default.nix
+++ b/pkgs/tools/misc/plfit/default.nix
@@ -20,14 +20,14 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     cmake
-  ] ++ lib.optionals (!isNull python) [
+  ] ++ lib.optionals (python != null) [
     python
     swig
   ];
 
   cmakeFlags = [
     "-DPLFIT_USE_OPENMP=ON"
-  ] ++ lib.optionals (!isNull python) [
+  ] ++ lib.optionals (python != null) [
     "-DPLFIT_COMPILE_PYTHON_MODULE=ON"
   ];
 
diff --git a/pkgs/tools/security/sudo/default.nix b/pkgs/tools/security/sudo/default.nix
index 0acc6e6a971e..8aaea88579f6 100644
--- a/pkgs/tools/security/sudo/default.nix
+++ b/pkgs/tools/security/sudo/default.nix
@@ -14,11 +14,11 @@
 
 stdenv.mkDerivation rec {
   pname = "sudo";
-  version = "1.9.13";
+  version = "1.9.13p3";
 
   src = fetchurl {
     url = "https://www.sudo.ws/dist/${pname}-${version}.tar.gz";
-    hash = "sha256-P1VFW0btsKEp2SXcw5ly8S98f7eNDMq2AX7hbIF35DY=";
+    hash = "sha256-kjNKEruT4MBWsJ9T4lXMt9b2fGNQ4oE82Vk87sp4Vgs=";
   };
 
   prePatch = ''
diff --git a/pkgs/tools/text/gawk/gawkextlib.nix b/pkgs/tools/text/gawk/gawkextlib.nix
index d15d5ce75f41..e050c9939269 100644
--- a/pkgs/tools/text/gawk/gawkextlib.nix
+++ b/pkgs/tools/text/gawk/gawkextlib.nix
@@ -6,7 +6,7 @@
 let
   buildExtension = lib.makeOverridable
     ({ name, gawkextlib, extraBuildInputs ? [ ], doCheck ? true }:
-      let is_extension = !isNull gawkextlib;
+      let is_extension = gawkextlib != null;
       in stdenv.mkDerivation rec {
         pname = "gawkextlib-${name}";
         version = "unstable-2019-11-21";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 0abec68b1f0d..6a8e18e53225 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2665,10 +2665,7 @@ with pkgs;
 
   android-backup-extractor = callPackage ../tools/backup/android-backup-extractor { };
 
-  android-tools = lowPrio (darwin.apple_sdk_11_0.callPackage ../tools/misc/android-tools
-    (lib.optionalAttrs (stdenv.targetPlatform.isAarch64 && stdenv.targetPlatform.isLinux) {
-      stdenv = gcc10Stdenv;
-    }));
+  android-tools = lowPrio (darwin.apple_sdk_11_0.callPackage ../tools/misc/android-tools { });
 
   anewer = callPackage ../tools/text/anewer { };
 
@@ -10745,6 +10742,8 @@ with pkgs;
     autoreconfHook = buildPackages.autoreconfHook269;
   };
 
+  orz = callPackage ../tools/compression/orz { };
+
   os-prober = callPackage ../tools/misc/os-prober { };
 
   oshka = callPackage ../development/tools/oshka { };
@@ -31104,10 +31103,9 @@ with pkgs;
       Carbon AudioToolbox VideoToolbox VideoDecodeAcceleration AVFoundation CoreAudio CoreVideo
       CoreMediaIO QuartzCore AppKit CoreWLAN WebKit IOKit GSS MediaPlayer IOSurface Metal MetalKit;
 
-    # C++20 is required, aarch64 has gcc 9 by default
     stdenv = if stdenv.isDarwin
       then darwin.apple_sdk_11_0.stdenv
-      else if stdenv.isAarch64 then gcc10Stdenv else stdenv;
+      else stdenv;
 
     # tdesktop has random crashes when jemalloc is built with gcc.
     # Apparently, it triggers some bug due to usage of gcc's builtin
@@ -38532,7 +38530,7 @@ with pkgs;
     gtk2 = gtk2-x11;
   };
 
-  qMasterPassword = qt6Packages.callPackage ../applications/misc/qMasterPassword { };
+  qMasterPassword = libsForQt5.callPackage ../applications/misc/qMasterPassword { };
 
   qmake2cmake = python3Packages.callPackage ../tools/misc/qmake2cmake { };
 
@@ -39160,7 +39158,7 @@ with pkgs;
 
   spdlog = spdlog_1;
 
-  dart = callPackage ../development/interpreters/dart { };
+  dart = callPackage ../development/compilers/dart { };
 
   httrack = callPackage ../tools/backup/httrack { };
 
diff --git a/pkgs/top-level/release.nix b/pkgs/top-level/release.nix
index e14e1bee7e6d..ba6b4ea4e386 100644
--- a/pkgs/top-level/release.nix
+++ b/pkgs/top-level/release.nix
@@ -130,8 +130,7 @@ let
               jobs.tests.stdenv.hooks.patch-shebangs.x86_64-linux
               */
             ]
-            # FIXME: reintroduce aarch64-darwin after this builds again
-            ++ lib.collect lib.isDerivation (removeAttrs jobs.stdenvBootstrapTools [ "aarch64-darwin" ])
+            ++ lib.collect lib.isDerivation jobs.stdenvBootstrapTools
             ++ lib.optionals supportDarwin.x86_64 [
               jobs.stdenv.x86_64-darwin
               jobs.cargo.x86_64-darwin