diff --git a/lib/options.nix b/lib/options.nix
index b88af070513c..20e8fb8d5ed3 100644
--- a/lib/options.nix
+++ b/lib/options.nix
@@ -36,6 +36,9 @@ let
   inherit (lib.types)
     mkOptionType
     ;
+  inherit (lib.lists)
+    last
+    ;
   prioritySuggestion = ''
    Use `lib.mkForce value` or `lib.mkDefault value` to change the priority on any of these definitions.
   '';
@@ -107,17 +110,28 @@ rec {
   /* Creates an Option attribute set for an option that specifies the
      package a module should use for some purpose.
 
-     The package is specified as a list of strings representing its attribute path in nixpkgs.
+     Type: mkPackageOption :: pkgs -> (string|[string]) ->
+      { default? :: [string], example? :: null|string|[string], extraDescription? :: string } ->
+      option
 
-     Because of this, you need to pass nixpkgs itself as the first argument.
+     The package is specified in the third argument under `default` as a list of strings
+     representing its attribute path in nixpkgs (or another package set).
+     Because of this, you need to pass nixpkgs itself (or a subset) as the first argument.
 
-     The second argument is the name of the option, used in the description "The <name> package to use.".
+     The second argument may be either a string or a list of strings.
+     It provides the display name of the package in the description of the generated option
+     (using only the last element if the passed value is a list)
+     and serves as the fallback value for the `default` argument.
 
-     You can also pass an example value, either a literal string or a package's attribute path.
+     To include extra information in the description, pass `extraDescription` to
+     append arbitrary text to the generated description.
+     You can also pass an `example` value, either a literal string or an attribute path.
 
-     You can omit the default path if the name of the option is also attribute path in nixpkgs.
+     The default argument can be omitted if the provided name is
+     an attribute of pkgs (if name is a string) or a
+     valid attribute path in pkgs (if name is a list).
 
-     Type: mkPackageOption :: pkgs -> string -> { default :: [string]; example :: null | string | [string]; } -> option
+     If you wish to explicitly provide no default, pass `null` as `default`.
 
      Example:
        mkPackageOption pkgs "hello" { }
@@ -129,27 +143,46 @@ rec {
          example = "pkgs.haskell.packages.ghc92.ghc.withPackages (hkgs: [ hkgs.primes ])";
        }
        => { _type = "option"; default = «derivation /nix/store/jxx55cxsjrf8kyh3fp2ya17q99w7541r-ghc-8.10.7.drv»; defaultText = { ... }; description = "The GHC package to use."; example = { ... }; type = { ... }; }
+
+     Example:
+       mkPackageOption pkgs [ "python39Packages" "pytorch" ] {
+         extraDescription = "This is an example and doesn't actually do anything.";
+       }
+       => { _type = "option"; default = «derivation /nix/store/gvqgsnc4fif9whvwd9ppa568yxbkmvk8-python3.9-pytorch-1.10.2.drv»; defaultText = { ... }; description = "The pytorch package to use. This is an example and doesn't actually do anything."; type = { ... }; }
+
   */
   mkPackageOption =
-    # Package set (a specific version of nixpkgs)
+    # Package set (a specific version of nixpkgs or a subset)
     pkgs:
       # Name for the package, shown in option description
       name:
-      { default ? [ name ], example ? null }:
-      let default' = if !isList default then [ default ] else default;
+      {
+        # The attribute path where the default package is located
+        default ? name,
+        # A string or an attribute path to use as an example
+        example ? null,
+        # Additional text to include in the option description
+        extraDescription ? "",
+      }:
+      let
+        name' = if isList name then last name else name;
+        default' = if isList default then default else [ default ];
+        defaultPath = concatStringsSep "." default';
+        defaultValue = attrByPath default'
+          (throw "${defaultPath} cannot be found in pkgs") pkgs;
       in mkOption {
+        defaultText = literalExpression ("pkgs." + defaultPath);
         type = lib.types.package;
-        description = "The ${name} package to use.";
-        default = attrByPath default'
-          (throw "${concatStringsSep "." default'} cannot be found in pkgs") pkgs;
-        defaultText = literalExpression ("pkgs." + concatStringsSep "." default');
+        description = "The ${name'} package to use."
+          + (if extraDescription == "" then "" else " ") + extraDescription;
+        ${if default != null then "default" else null} = defaultValue;
         ${if example != null then "example" else null} = literalExpression
           (if isList example then "pkgs." + concatStringsSep "." example else example);
       };
 
   /* Like mkPackageOption, but emit an mdDoc description instead of DocBook. */
-  mkPackageOptionMD = args: name: extra:
-    let option = mkPackageOption args name extra;
+  mkPackageOptionMD = pkgs: name: extra:
+    let option = mkPackageOption pkgs name extra;
     in option // { description = lib.mdDoc option.description; };
 
   /* This option accepts anything, but it does not produce any result.
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 151453a2378e..d77092b06b57 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -6903,6 +6903,12 @@
     githubId = 10786794;
     name = "Markus Hihn";
   };
+  jessemoore = {
+    email = "jesse@jessemoore.dev";
+    github = "jesseDMoore1994";
+    githubId = 30251156;
+    name = "Jesse Moore";
+  };
   jethro = {
     email = "jethrokuan95@gmail.com";
     github = "jethrokuan";
diff --git a/nixos/doc/manual/development/option-declarations.section.md b/nixos/doc/manual/development/option-declarations.section.md
index 59470bf1bc11..f6fed3e16837 100644
--- a/nixos/doc/manual/development/option-declarations.section.md
+++ b/nixos/doc/manual/development/option-declarations.section.md
@@ -101,11 +101,24 @@ Creates an Option attribute set for an option that specifies the package a modul
 
 **Note**: You shouldn’t necessarily make package options for all of your modules. You can always overwrite a specific package throughout nixpkgs by using [nixpkgs overlays](https://nixos.org/manual/nixpkgs/stable/#chap-overlays).
 
-The default package is specified as a list of strings representing its attribute path in nixpkgs. Because of this, you need to pass nixpkgs itself as the first argument.
+The package is specified in the third argument under `default` as a list of strings
+representing its attribute path in nixpkgs (or another package set).
+Because of this, you need to pass nixpkgs itself (or a subset) as the first argument.
 
-The second argument is the name of the option, used in the description "The \<name\> package to use.". You can also pass an example value, either a literal string or a package's attribute path.
+The second argument may be either a string or a list of strings.
+It provides the display name of the package in the description of the generated option
+(using only the last element if the passed value is a list)
+and serves as the fallback value for the `default` argument.
 
-You can omit the default path if the name of the option is also attribute path in nixpkgs.
+To include extra information in the description, pass `extraDescription` to
+append arbitrary text to the generated description.
+You can also pass an `example` value, either a literal string or an attribute path.
+
+The default argument can be omitted if the provided name is
+an attribute of pkgs (if name is a string) or a
+valid attribute path in pkgs (if name is a list).
+
+If you wish to explicitly provide no default, pass `null` as `default`.
 
 During the transition to CommonMark documentation `mkPackageOption` creates an option with a DocBook description attribute, once the transition is completed it will create a CommonMark description instead. `mkPackageOptionMD` always creates an option with a CommonMark description attribute and will be removed some time after the transition is completed.
 
@@ -142,6 +155,21 @@ lib.mkOption {
 ```
 :::
 
+::: {#ex-options-declarations-util-mkPackageOption-extraDescription .example}
+```nix
+mkPackageOption pkgs [ "python39Packages" "pytorch" ] {
+  extraDescription = "This is an example and doesn't actually do anything.";
+}
+# is like
+lib.mkOption {
+  type = lib.types.package;
+  default = pkgs.python39Packages.pytorch;
+  defaultText = lib.literalExpression "pkgs.python39Packages.pytorch";
+  description = "The pytorch package to use. This is an example and doesn't actually do anything.";
+}
+```
+:::
+
 ## Extensible Option Types {#sec-option-declarations-eot}
 
 Extensible option types is a feature that allow to extend certain types
diff --git a/nixos/modules/security/polkit.nix b/nixos/modules/security/polkit.nix
index 903bbbcab072..1b6594802277 100644
--- a/nixos/modules/security/polkit.nix
+++ b/nixos/modules/security/polkit.nix
@@ -113,7 +113,9 @@ in
       group = "polkituser";
     };
 
-    users.groups.polkituser.gid = config.ids.gids.polkituser;
+    users.groups.polkituser = {
+      gid = mkIf (lib.versionAtLeast config.system.stateVersion "23.05") config.ids.gids.polkituser;
+    };
   };
 
 }
diff --git a/nixos/modules/system/boot/systemd/coredump.nix b/nixos/modules/system/boot/systemd/coredump.nix
index 2dbc95e38ee3..deaaba9bbf85 100644
--- a/nixos/modules/system/boot/systemd/coredump.nix
+++ b/nixos/modules/system/boot/systemd/coredump.nix
@@ -67,7 +67,7 @@ in {
         group = "systemd-coredump";
       };
       users.groups.systemd-coredump = {
-        gid = config.ids.gids.systemd-coredump;
+        gid = mkIf (lib.versionAtLeast config.system.stateVersion "23.05") config.ids.gids.systemd-coredump;
       };
     })
 
diff --git a/pkgs/applications/misc/neo4j-desktop/default.nix b/pkgs/applications/misc/neo4j-desktop/default.nix
index 2f0286a5c233..728463dba609 100644
--- a/pkgs/applications/misc/neo4j-desktop/default.nix
+++ b/pkgs/applications/misc/neo4j-desktop/default.nix
@@ -1,12 +1,12 @@
 { appimageTools, lib, fetchurl }:
 let
   pname = "neo4j-desktop";
-  version = "1.5.6";
+  version = "1.5.7";
   name = "${pname}-${version}";
 
   src = fetchurl {
     url = "https://s3-eu-west-1.amazonaws.com/dist.neo4j.org/${pname}/linux-offline/${name}-x86_64.AppImage";
-    hash = "sha256-0/jS1LaaIam6w7RbLXSKXiXlpocZMTMuTZvFRU4qypg=";
+    hash = "sha256-5sIlLPfcoX5I4TBGKR8+WAo/xC6b9RP6ljhyTil1xJM=";
   };
 
   appimageContents = appimageTools.extract { inherit name src; };
diff --git a/pkgs/applications/misc/nwg-bar/default.nix b/pkgs/applications/misc/nwg-bar/default.nix
index e124671e848d..0d96b3cdc78f 100644
--- a/pkgs/applications/misc/nwg-bar/default.nix
+++ b/pkgs/applications/misc/nwg-bar/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "nwg-bar";
-  version = "0.1.0";
+  version = "0.1.1";
 
   src = fetchFromGitHub {
     owner = "nwg-piotr";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-3uDEmIrfvUD/QGwgFYYWQUeYq35XJdpSVL9nHBl11kY=";
+    sha256 = "sha256-XeRQhDQeobO1xNThdNgBkoGvnO3PMAxrNwTljC1GKPM=";
   };
 
   patches = [ ./fix-paths.patch ];
@@ -17,7 +17,7 @@ buildGoModule rec {
     substituteInPlace tools.go --subst-var out
   '';
 
-  vendorSha256 = "sha256-dgOwflNRb+11umFykozL8DQ50dLbhbMCmCyKmLlW7rw=";
+  vendorHash = "sha256-EewEhkX7Bwnz+J1ptO31HKHU4NHo76r4NqMbcrWdiu4=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/applications/misc/vhs/default.nix b/pkgs/applications/misc/vhs/default.nix
index bb498c7ee237..a86ddda288be 100644
--- a/pkgs/applications/misc/vhs/default.nix
+++ b/pkgs/applications/misc/vhs/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "vhs";
-  version = "0.2.0";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "charmbracelet";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-t6n4uID7KTu/BqsmndJOft0ifxZNfv9lfqlzFX0ApKw=";
+    hash = "sha256-62FS/FBhQNpj3dAfKfIUKY+IJeeaONzqRu7mG49li+o";
   };
 
-  vendorHash = "sha256-9nkRr5Jh1nbI+XXbPj9KB0ZbLybv5JUVovpB311fO38=";
+  vendorHash = "sha256-+BLZ+Ni2dqboqlOEjFNF6oB/vNDlNRCb6AiDH1uSsLw";
 
   nativeBuildInputs = [ installShellFiles makeWrapper ];
 
@@ -32,6 +32,6 @@ buildGoModule rec {
     homepage = "https://github.com/charmbracelet/vhs";
     changelog = "https://github.com/charmbracelet/vhs/releases/tag/v${version}";
     license = licenses.mit;
-    maintainers = with maintainers; [ maaslalani ];
+    maintainers = with maintainers; [ maaslalani penguwin ];
   };
 }
diff --git a/pkgs/applications/networking/browsers/polypane/default.nix b/pkgs/applications/networking/browsers/polypane/default.nix
index 7a4650143ef7..40c7fda9dbad 100644
--- a/pkgs/applications/networking/browsers/polypane/default.nix
+++ b/pkgs/applications/networking/browsers/polypane/default.nix
@@ -2,12 +2,12 @@
 
 let
   pname = "polypane";
-  version = "13.0.2";
+  version = "13.0.3";
 
   src = fetchurl {
     url = "https://github.com/firstversionist/${pname}/releases/download/v${version}/${pname}-${version}.AppImage";
     name = "${pname}-${version}.AppImage";
-    sha256 = "sha256-+44a9dPQOV1D2rnsuy+GyJqZz/UCbITmMuunwHc4JFY=";
+    sha256 = "sha256-wMWO8eRH8O93m4/HaRTdG3DhyCvHWw+s3sAtN+VLBeY=";
   };
 
   appimageContents = appimageTools.extractType2 {
diff --git a/pkgs/applications/networking/cluster/kubelogin/default.nix b/pkgs/applications/networking/cluster/kubelogin/default.nix
index 9726edcf5f09..474a27238f20 100644
--- a/pkgs/applications/networking/cluster/kubelogin/default.nix
+++ b/pkgs/applications/networking/cluster/kubelogin/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "kubelogin";
-  version = "0.0.26";
+  version = "0.0.27";
 
   src = fetchFromGitHub {
     owner = "Azure";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-FDcNrtdAMiSvY84I4zdVEEfOf48n7vE26yQf3IZ69xg=";
+    sha256 = "sha256-yC0J6uXL0W00o0BGIrrZ9WjThSgIu5fEgQdyH2vZESs=";
   };
 
-  vendorHash = "sha256-mjIB0ITf296yDQJP46EI6pLYkZfyU3yzD9iwP0iIXvQ=";
+  vendorHash = "sha256-QGzaKtku7fm14ijmE68nqgqoX86IgmEsemlQltZECI0=";
 
   ldflags = [
     "-X main.version=${version}"
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 144c40fd3ab5..4b544e358307 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -164,13 +164,13 @@
     "vendorHash": null
   },
   "bitbucket": {
-    "hash": "sha256-7+xLUvm69SbK8baX3imuhLwf5yfQIxYlmoHvl3yXcUk=",
+    "hash": "sha256-FrKNPpwPCpL7GuPkjYCPqHit/VPJG5Fe0Ew4WMzp1AI=",
     "homepage": "https://registry.terraform.io/providers/DrFaust92/bitbucket",
     "owner": "DrFaust92",
     "repo": "terraform-provider-bitbucket",
-    "rev": "v2.30.1",
+    "rev": "v2.30.2",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-C3OR++DrbVFCReoqtLmRJ37YKxA8oTdPUO9Q80T4vJI="
+    "vendorHash": "sha256-rtPbHItqsgHoHs85QO6Uix2yvJkHE6B2XYMOdcJvoGc="
   },
   "brightbox": {
     "hash": "sha256-YmgzzDLNJg7zm8smboI0gE2kOgjb2RwPf5v1CbzgvGA=",
diff --git a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix b/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
index dbcb872d161e..3066a3aa745b 100644
--- a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
@@ -75,7 +75,7 @@ let
 in
 env.mkDerivation rec {
   pname = "telegram-desktop";
-  version = "4.6.3";
+  version = "4.6.5";
   # Note: Update via pkgs/applications/networking/instant-messengers/telegram/tdesktop/update.py
 
   # Telegram-Desktop with submodules
@@ -84,7 +84,7 @@ env.mkDerivation rec {
     repo = "tdesktop";
     rev = "v${version}";
     fetchSubmodules = true;
-    sha256 = "1kv7aqj4d85iz6vbgvfplyfr9y3rw31xhdgwiskrdfv8mqb0mr5v";
+    sha256 = "0c65ry82ffmh1qzc2lnsyjs78r9jllv62p9vglpz0ikg86zf36sk";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/networking/seahub/default.nix b/pkgs/applications/networking/seahub/default.nix
index 31af7b140f2c..677405c5a295 100644
--- a/pkgs/applications/networking/seahub/default.nix
+++ b/pkgs/applications/networking/seahub/default.nix
@@ -20,14 +20,14 @@ let
 in
 python.pkgs.buildPythonApplication rec {
   pname = "seahub";
-  version = "9.0.6";
+  version = "9.0.10";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "haiwen";
     repo = "seahub";
-    rev = "876b7ba9b680fc668e89706aff535593772ae921"; # using a fixed revision because upstream may re-tag releases :/
-    sha256 = "sha256-GHvJlm5DVt3IVJnqJu8YobNNqbjdPd08s4DCdQQRQds=";
+    rev = "5971bf25fe67d94ec4d9f53b785c15a098113620"; # using a fixed revision because upstream may re-tag releases :/
+    sha256 = "sha256-7Exvm3EShb/1EqwA4wzWB9zCdv0P/ISmjKSoqtOMnqk=";
   };
 
   dontBuild = true;
@@ -61,6 +61,8 @@ python.pkgs.buildPythonApplication rec {
     pysearpc
     seaserv
     gunicorn
+    markdown
+    bleach
   ];
 
   installPhase = ''
diff --git a/pkgs/applications/networking/sniffnet/default.nix b/pkgs/applications/networking/sniffnet/default.nix
index 074d636ff821..a5c0c73fac92 100644
--- a/pkgs/applications/networking/sniffnet/default.nix
+++ b/pkgs/applications/networking/sniffnet/default.nix
@@ -14,16 +14,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "sniffnet";
-  version = "1.1.0";
+  version = "1.1.1";
 
   src = fetchFromGitHub {
     owner = "gyulyvgc";
     repo = "sniffnet";
     rev = "v${version}";
-    hash = "sha256-zqk0N1S0vylleyyXaSflIZyWncZV0+wbSy1oAbyLx/4=";
+    hash = "sha256-o971F3JxZUfTCaLRPYxCsU5UZ2VcvZftVEl/sZAQwpA=";
   };
 
-  cargoHash = "sha256-9CTA7Yh2O5S8DvRjwvkrb4ye0/8f+l0tsTxNBMmxLpQ=";
+  cargoHash = "sha256-Otn5FvZZkzO0MHiopjU2/+redyusituDQb7DT5bdbPE=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/build-support/rust/import-cargo-lock.nix b/pkgs/build-support/rust/import-cargo-lock.nix
index 42e448b8246f..9ff9c2f6289c 100644
--- a/pkgs/build-support/rust/import-cargo-lock.nix
+++ b/pkgs/build-support/rust/import-cargo-lock.nix
@@ -36,7 +36,9 @@ let
     then builtins.readFile lockFile
     else args.lockFileContents;
 
-  packages = (builtins.fromTOML lockFileContents).package;
+  parsedLockFile = builtins.fromTOML lockFileContents;
+
+  packages = parsedLockFile.package;
 
   # There is no source attribute for the source package itself. But
   # since we do not want to vendor the source package anyway, we can
@@ -79,17 +81,16 @@ let
   # We can't use the existing fetchCrate function, since it uses a
   # recursive hash of the unpacked crate.
   fetchCrate = pkg:
-    assert lib.assertMsg (pkg ? checksum) ''
+    let
+      checksum = pkg.checksum or parsedLockFile.metadata."checksum ${pkg.name} ${pkg.version} (${pkg.source})";
+    in
+    assert lib.assertMsg (checksum != null) ''
       Package ${pkg.name} does not have a checksum.
-      Please note that the Cargo.lock format where checksums used to be listed
-      under [metadata] is not supported.
-      If that is the case, running `cargo update` with a recent toolchain will
-      automatically update the format along with the crate's depenendencies.
     '';
     fetchurl {
       name = "crate-${pkg.name}-${pkg.version}.tar.gz";
       url = "https://crates.io/api/v1/crates/${pkg.name}/${pkg.version}/download";
-      sha256 = pkg.checksum;
+      sha256 = checksum;
     };
 
   # Fetch and unpack a crate.
@@ -105,7 +106,7 @@ let
         tar xf "${crateTarball}" -C $out --strip-components=1
 
         # Cargo is happy with largely empty metadata.
-        printf '{"files":{},"package":"${pkg.checksum}"}' > "$out/.cargo-checksum.json"
+        printf '{"files":{},"package":"${crateTarball.outputHash}"}' > "$out/.cargo-checksum.json"
       ''
       else if gitParts != null then
       let
@@ -183,10 +184,15 @@ let
       ''
       else throw "Cannot handle crate source: ${pkg.source}";
 
-  vendorDir = runCommand "cargo-vendor-dir" (lib.optionalAttrs (lockFile == null) {
-    inherit lockFileContents;
-    passAsFile = [ "lockFileContents" ];
-  }) ''
+  vendorDir = runCommand "cargo-vendor-dir"
+    (if lockFile == null then {
+      inherit lockFileContents;
+      passAsFile = [ "lockFileContents" ];
+    } else {
+      passthru = {
+        inherit lockFile;
+      };
+    }) ''
     mkdir -p $out/.cargo
 
     ${
diff --git a/pkgs/build-support/rust/test/import-cargo-lock/default.nix b/pkgs/build-support/rust/test/import-cargo-lock/default.nix
index c5c7b2f1c931..74be68b2c356 100644
--- a/pkgs/build-support/rust/test/import-cargo-lock/default.nix
+++ b/pkgs/build-support/rust/test/import-cargo-lock/default.nix
@@ -11,4 +11,5 @@
   gitDependencyTag = callPackage ./git-dependency-tag { };
   gitDependencyBranch = callPackage ./git-dependency-branch { };
   maturin = callPackage ./maturin { };
+  v1 = callPackage ./v1 { };
 }
diff --git a/pkgs/build-support/rust/test/import-cargo-lock/v1/Cargo.lock b/pkgs/build-support/rust/test/import-cargo-lock/v1/Cargo.lock
new file mode 100644
index 000000000000..fe976f090aac
--- /dev/null
+++ b/pkgs/build-support/rust/test/import-cargo-lock/v1/Cargo.lock
@@ -0,0 +1,85 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+[[package]]
+name = "cfg-if"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+
+[[package]]
+name = "getrandom"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+dependencies = [
+ "cfg-if 1.0.0 (registry+https://github.com/rust-lang/crates.io-index)",
+ "libc 0.2.94 (registry+https://github.com/rust-lang/crates.io-index)",
+ "wasi 0.10.2+wasi-snapshot-preview1 (registry+https://github.com/rust-lang/crates.io-index)",
+]
+
+[[package]]
+name = "libc"
+version = "0.2.94"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+
+[[package]]
+name = "ppv-lite86"
+version = "0.2.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+
+[[package]]
+name = "rand"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+dependencies = [
+ "libc 0.2.94 (registry+https://github.com/rust-lang/crates.io-index)",
+ "rand_chacha 0.3.0 (registry+https://github.com/rust-lang/crates.io-index)",
+ "rand_core 0.6.2 (registry+https://github.com/rust-lang/crates.io-index)",
+ "rand_hc 0.3.0 (registry+https://github.com/rust-lang/crates.io-index)",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+dependencies = [
+ "ppv-lite86 0.2.10 (registry+https://github.com/rust-lang/crates.io-index)",
+ "rand_core 0.6.2 (registry+https://github.com/rust-lang/crates.io-index)",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+dependencies = [
+ "getrandom 0.2.2 (registry+https://github.com/rust-lang/crates.io-index)",
+]
+
+[[package]]
+name = "rand_hc"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+dependencies = [
+ "rand_core 0.6.2 (registry+https://github.com/rust-lang/crates.io-index)",
+]
+
+[[package]]
+name = "v1"
+version = "0.1.0"
+dependencies = [
+ "rand 0.8.3 (registry+https://github.com/rust-lang/crates.io-index)",
+]
+
+[[package]]
+name = "wasi"
+version = "0.10.2+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+
+[metadata]
+"checksum cfg-if 1.0.0 (registry+https://github.com/rust-lang/crates.io-index)" = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+"checksum getrandom 0.2.2 (registry+https://github.com/rust-lang/crates.io-index)" = "c9495705279e7140bf035dde1f6e750c162df8b625267cd52cc44e0b156732c8"
+"checksum libc 0.2.94 (registry+https://github.com/rust-lang/crates.io-index)" = "18794a8ad5b29321f790b55d93dfba91e125cb1a9edbd4f8e3150acc771c1a5e"
+"checksum ppv-lite86 0.2.10 (registry+https://github.com/rust-lang/crates.io-index)" = "ac74c624d6b2d21f425f752262f42188365d7b8ff1aff74c82e45136510a4857"
+"checksum rand 0.8.3 (registry+https://github.com/rust-lang/crates.io-index)" = "0ef9e7e66b4468674bfcb0c81af8b7fa0bb154fa9f28eb840da5c447baeb8d7e"
+"checksum rand_chacha 0.3.0 (registry+https://github.com/rust-lang/crates.io-index)" = "e12735cf05c9e10bf21534da50a147b924d555dc7a547c42e6bb2d5b6017ae0d"
+"checksum rand_core 0.6.2 (registry+https://github.com/rust-lang/crates.io-index)" = "34cf66eb183df1c5876e2dcf6b13d57340741e8dc255b48e40a26de954d06ae7"
+"checksum rand_hc 0.3.0 (registry+https://github.com/rust-lang/crates.io-index)" = "3190ef7066a446f2e7f42e239d161e905420ccab01eb967c9eb27d21b2322a73"
+"checksum wasi 0.10.2+wasi-snapshot-preview1 (registry+https://github.com/rust-lang/crates.io-index)" = "fd6fbd9a79829dd1ad0cc20627bf1ed606756a7f77edff7b66b7064f9cb327c6"
diff --git a/pkgs/build-support/rust/test/import-cargo-lock/v1/Cargo.toml b/pkgs/build-support/rust/test/import-cargo-lock/v1/Cargo.toml
new file mode 100644
index 000000000000..4b825c45cadc
--- /dev/null
+++ b/pkgs/build-support/rust/test/import-cargo-lock/v1/Cargo.toml
@@ -0,0 +1,8 @@
+[package]
+name = "v1"
+version = "0.1.0"
+authors = ["Daniël de Kok <me@danieldk.eu>"]
+edition = "2018"
+
+[dependencies]
+rand = "0.8"
diff --git a/pkgs/build-support/rust/test/import-cargo-lock/v1/default.nix b/pkgs/build-support/rust/test/import-cargo-lock/v1/default.nix
new file mode 100644
index 000000000000..d13d468ae7f9
--- /dev/null
+++ b/pkgs/build-support/rust/test/import-cargo-lock/v1/default.nix
@@ -0,0 +1,18 @@
+{ rustPlatform }:
+
+rustPlatform.buildRustPackage {
+  pname = "v1";
+  version = "0.1.0";
+
+  src = ./.;
+
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+  };
+
+  doInstallCheck = true;
+
+  installCheckPhase = ''
+    $out/bin/v1
+  '';
+}
diff --git a/pkgs/build-support/rust/test/import-cargo-lock/v1/src/main.rs b/pkgs/build-support/rust/test/import-cargo-lock/v1/src/main.rs
new file mode 100644
index 000000000000..50b4ed799e43
--- /dev/null
+++ b/pkgs/build-support/rust/test/import-cargo-lock/v1/src/main.rs
@@ -0,0 +1,9 @@
+use rand::Rng;
+
+fn main() {
+    let mut rng = rand::thread_rng();
+
+    // Always draw zero :).
+    let roll: u8 = rng.gen_range(0..1);
+    assert_eq!(roll, 0);
+}
diff --git a/pkgs/data/icons/numix-icon-theme-circle/default.nix b/pkgs/data/icons/numix-icon-theme-circle/default.nix
index b07057ba6899..17c5b7fa36df 100644
--- a/pkgs/data/icons/numix-icon-theme-circle/default.nix
+++ b/pkgs/data/icons/numix-icon-theme-circle/default.nix
@@ -2,13 +2,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "numix-icon-theme-circle";
-  version = "23.02.16";
+  version = "23.02.25";
 
   src = fetchFromGitHub {
     owner = "numixproject";
     repo = pname;
     rev = version;
-    sha256 = "sha256-P/lg+7hx3WOmuWUKznFVKlPIB+MqlE3Nb/n8WK8aUM8=";
+    sha256 = "sha256-JQK4GjL3piztBVXRnIMNxdB+XTXNaNvWg0wLLui4tRE=";
   };
 
   nativeBuildInputs = [ gtk3 ];
diff --git a/pkgs/data/misc/sing-geoip/default.nix b/pkgs/data/misc/sing-geoip/default.nix
new file mode 100644
index 000000000000..e8ea5ddd4428
--- /dev/null
+++ b/pkgs/data/misc/sing-geoip/default.nix
@@ -0,0 +1,66 @@
+{ lib
+, stdenvNoCC
+, buildGoModule
+, fetchFromGitHub
+, clash-geoip
+}:
+
+let
+  generator = buildGoModule rec {
+    pname = "sing-geoip";
+    version = "unstable-2022-07-05";
+
+    src = fetchFromGitHub {
+      owner = "SagerNet";
+      repo = pname;
+      rev = "2ced72c94da4c9259c40353c375319d9d28a78f3";
+      hash = "sha256-z8aP+OfTuzQNwOT3EEnI9uze/vbHTJLEiCPqIrnNUHw=";
+    };
+
+    vendorHash = "sha256-lr0XMLFxJmLqIqCuGgmsFh324jmZVj71blmStMn41Rs=";
+
+    postPatch = ''
+      # The codes args should start from the third args
+      substituteInPlace main.go --replace "os.Args[2:]" "os.Args[3:]"
+    '';
+
+    meta = with lib; {
+      description = "GeoIP data for sing-box";
+      homepage = "https://github.com/SagerNet/sing-geoip";
+      license = licenses.gpl3Plus;
+      maintainers = with maintainers; [ linsui ];
+    };
+  };
+in
+stdenvNoCC.mkDerivation rec {
+  inherit (generator) pname;
+  inherit (clash-geoip) version;
+
+  dontUnpack = true;
+
+  nativeBuildInputs = [ generator ];
+
+  buildPhase = ''
+    runHook preBuild
+
+    ${pname} ${clash-geoip}/etc/clash/Country.mmdb geoip.db
+    ${pname} ${clash-geoip}/etc/clash/Country.mmdb geoip-cn.db cn
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm644 geoip.db $out/share/sing-box/geoip.db
+    install -Dm644 geoip-cn.db $out/share/sing-box/geoip-cn.db
+
+    runHook postInstall
+  '';
+
+  passthru = { inherit generator; };
+
+  meta = generator.meta // {
+    inherit (clash-geoip.meta) license;
+  };
+}
diff --git a/pkgs/development/compilers/gcc/12/default.nix b/pkgs/development/compilers/gcc/12/default.nix
index 562d7113b6a2..baa8351830e0 100644
--- a/pkgs/development/compilers/gcc/12/default.nix
+++ b/pkgs/development/compilers/gcc/12/default.nix
@@ -66,7 +66,10 @@ let majorVersion = "12";
         ../gnat-cflags-11.patch
         ../gcc-12-gfortran-driving.patch
         ../ppc-musl.patch
-      ] ++ optional (stdenv.isDarwin && stdenv.isAarch64) (fetchpatch {
+      ]
+      # We only apply this patch when building a native toolchain for aarch64-darwin, as it breaks building
+      # a foreign one: https://github.com/iains/gcc-12-branch/issues/18
+      ++ optional (stdenv.isDarwin && stdenv.isAarch64 && buildPlatform == hostPlatform && hostPlatform == targetPlatform) (fetchpatch {
         name = "gcc-12-darwin-aarch64-support.patch";
         url = "https://github.com/Homebrew/formula-patches/raw/1d184289/gcc/gcc-12.2.0-arm.diff";
         sha256 = "sha256-omclLslGi/2yCV4pNBMaIpPDMW3tcz/RXdupbNbeOHA=";
diff --git a/pkgs/development/libraries/libdeltachat/default.nix b/pkgs/development/libraries/libdeltachat/default.nix
index 7efb7d755ad4..e1f4ff6373d6 100644
--- a/pkgs/development/libraries/libdeltachat/default.nix
+++ b/pkgs/development/libraries/libdeltachat/default.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libdeltachat";
-  version = "1.109.0";
+  version = "1.110.0";
 
   src = fetchFromGitHub {
     owner = "deltachat";
     repo = "deltachat-core-rust";
-    rev = version;
-    hash = "sha256-6zlXa9N7gaF1ta6mjszsA25+QRrHF8m1brKoSiL5OHo=";
+    rev = "v${version}";
+    hash = "sha256-SPBuStrBp9fnrLfFT2ec9yYItZsvQF9BHdJxi+plbgw=";
   };
 
   patches = [
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-Z7CLKhKWqAaLhsXi81OOKWmwQddHCebCJibbKiNNptk=";
+    hash = "sha256-Y4+CkaV9njHqmmiZnDtfZ5OwMVk583FtncxOgAqACkA=";
   };
 
   nativeBuildInputs = [
@@ -68,7 +68,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Delta Chat Rust Core library";
     homepage = "https://github.com/deltachat/deltachat-core-rust/";
-    changelog = "https://github.com/deltachat/deltachat-core-rust/blob/${version}/CHANGELOG.md";
+    changelog = "https://github.com/deltachat/deltachat-core-rust/blob/${src.rev}/CHANGELOG.md";
     license = licenses.mpl20;
     maintainers = with maintainers; [ dotlambda ];
     platforms = platforms.unix;
diff --git a/pkgs/development/libraries/libgpiod/default.nix b/pkgs/development/libraries/libgpiod/default.nix
index ccf1c4703647..ce5a4ac2833d 100644
--- a/pkgs/development/libraries/libgpiod/default.nix
+++ b/pkgs/development/libraries/libgpiod/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libgpiod";
-  version = "1.6.3";
+  version = "1.6.4";
 
   src = fetchurl {
     url = "https://git.kernel.org/pub/scm/libs/libgpiod/libgpiod.git/snapshot/libgpiod-${version}.tar.gz";
-    sha256 = "sha256-60RgcL4URP19MtMrvKU8Lzu7CiEZPbhhmM9gULeihEE=";
+    sha256 = "sha256-gp1KwmjfB4U2CdZ8/H9HbpqnNssqaKYwvpno+tGXvgo=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/libjcat/default.nix b/pkgs/development/libraries/libjcat/default.nix
index 99de3acb38c7..18376f4b7f42 100644
--- a/pkgs/development/libraries/libjcat/default.nix
+++ b/pkgs/development/libraries/libjcat/default.nix
@@ -19,7 +19,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libjcat";
-  version = "0.1.12";
+  version = "0.1.13";
 
   outputs = [ "bin" "out" "dev" "devdoc" "man" "installedTests" ];
 
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
     owner = "hughsie";
     repo = "libjcat";
     rev = version;
-    sha256 = "sha256-9+wtCJzvT9uAXRXj/koFG7asxm5JIDw0Ffp4wK6tbDk=";
+    sha256 = "sha256-VfI40dfZzNqR5sqTY4KvkYL8+3sLV0Z0u7w+QA34uek=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/aiosomecomfort/default.nix b/pkgs/development/python-modules/aiosomecomfort/default.nix
index cfb41c7c1fdf..6026db49d587 100644
--- a/pkgs/development/python-modules/aiosomecomfort/default.nix
+++ b/pkgs/development/python-modules/aiosomecomfort/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "aiosomecomfort";
-  version = "0.0.8";
+  version = "0.0.10";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "mkmer";
     repo = "AIOSomecomfort";
     rev = "refs/tags/${version}";
-    hash = "sha256-SwNHLDizkpOP+zSDzn84J2l8ltZi/ponnptzuVJMHUA=";
+    hash = "sha256-w9rD/8fb9CoN9esHY0UEjIs98i9OGp+suiz6I5Uj3ok=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/aliyun-python-sdk-cdn/default.nix b/pkgs/development/python-modules/aliyun-python-sdk-cdn/default.nix
index ddbd7f1e2891..aa4edc45fc27 100644
--- a/pkgs/development/python-modules/aliyun-python-sdk-cdn/default.nix
+++ b/pkgs/development/python-modules/aliyun-python-sdk-cdn/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "aliyun-python-sdk-cdn";
-  version = "3.8.2";
+  version = "3.8.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-pNWqow396BB5cC1dOhDelykjqeWFN+IKosKEDu5nB1o=";
+    hash = "sha256-LsB3u35PLI/3PcuNbdgcxRoEFZ5CpyINEJa4Nw64NPA=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/bthome-ble/default.nix b/pkgs/development/python-modules/bthome-ble/default.nix
index 20b43178ceab..c3f6a9766dab 100644
--- a/pkgs/development/python-modules/bthome-ble/default.nix
+++ b/pkgs/development/python-modules/bthome-ble/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "bthome-ble";
-  version = "2.6.0";
+  version = "2.7.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-+8NM/lyXeO1/kkotGuTwYbzmTbmriiQPXeqmT13iRXg=";
+    hash = "sha256-wt/TA8bymjYgYSb63Viqf6ToUE1ffa2a3SEVFuTHh94=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/deltachat/default.nix b/pkgs/development/python-modules/deltachat/default.nix
index 11e652b3826b..92777f73e7ad 100644
--- a/pkgs/development/python-modules/deltachat/default.nix
+++ b/pkgs/development/python-modules/deltachat/default.nix
@@ -42,7 +42,6 @@ buildPythonPackage rec {
     imap-tools
     pluggy
     requests
-    setuptools # for pkg_resources
   ];
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/evtx/default.nix b/pkgs/development/python-modules/evtx/default.nix
index 7f15ee79a805..af6f36ec6f9e 100644
--- a/pkgs/development/python-modules/evtx/default.nix
+++ b/pkgs/development/python-modules/evtx/default.nix
@@ -9,22 +9,22 @@
 
 buildPythonPackage rec {
   pname = "evtx";
-  version = "0.8.1";
+  version = "0.8.2";
   format = "pyproject";
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "omerbenamram";
     repo = "pyevtx-rs";
-    rev = version;
-    sha256 = "sha256-MSQYp/qkntFcnGqGhJ+0i4eMGzcDJcSZ44qFARMYM2I=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-t//oNvD+7wnv5KkriKBX4xgGS8pQpZgCsKxAEXsj0X8=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    sha256 = "sha256-kzv2ppRjkmXgMxJviBwRVXMiGWBlhBqLXEmmRvwlw98=";
+    hash = "sha256-DPEL36cYNV5v4iW3+Fg1eEeuBuK9S7Qe78xOzZs8aJw=";
   };
 
   nativeBuildInputs = with rustPlatform; [
@@ -41,10 +41,11 @@ buildPythonPackage rec {
   ];
 
   meta = with lib; {
-    broken = stdenv.isDarwin;
     description = "Bindings for evtx";
     homepage = "https://github.com/omerbenamram/pyevtx-rs";
+    changelog = "https://github.com/omerbenamram/pyevtx-rs/releases/tag/${version}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
+    broken = stdenv.isDarwin;
   };
 }
diff --git a/pkgs/development/python-modules/pytest-cases/default.nix b/pkgs/development/python-modules/pytest-cases/default.nix
index 6697db4746e5..b72063a2336f 100644
--- a/pkgs/development/python-modules/pytest-cases/default.nix
+++ b/pkgs/development/python-modules/pytest-cases/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "pytest-cases";
-  version = "3.6.13";
+  version = "3.6.14";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-e1hEMyMSgLFqdPNNm6H1CrzGuXPTujrakFPCxBoR+3c=";
+    sha256 = "sha256-dFXmylelRMG/3YtWrOCMHBzkxlcqiquPG9NR3CWhC2s=";
   };
 
   nativeBuildInputs = [
@@ -50,6 +50,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Separate test code from test cases in pytest";
     homepage = "https://github.com/smarie/python-pytest-cases";
+    changelog = "https://github.com/smarie/python-pytest-cases/releases/tag/${version}";
     license = licenses.bsd3;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/returns/default.nix b/pkgs/development/python-modules/returns/default.nix
new file mode 100644
index 000000000000..5a5ce355feed
--- /dev/null
+++ b/pkgs/development/python-modules/returns/default.nix
@@ -0,0 +1,65 @@
+{ lib
+, anyio
+, curio
+, buildPythonPackage
+, fetchFromGitHub
+, httpx
+, hypothesis
+, mypy
+, poetry-core
+, pytestCheckHook
+, pytest-aio
+, pytest-cov
+, pytest-mypy
+, pytest-mypy-plugins
+, pytest-subtests
+, setuptools
+, trio
+, typing-extensions
+}:
+
+buildPythonPackage rec {
+  pname = "returns";
+  version = "0.19.0";
+  format = "pyproject";
+
+  src = fetchFromGitHub {
+    owner = "dry-python";
+    repo = "returns";
+    rev = "refs/tags/${version}";
+    hash = "sha256-yKlW5M7LlK9xF4GiCKtUVrZwwSmFVjCnDhnzaNFcAsU=";
+  };
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    typing-extensions
+  ];
+
+  nativeCheckInputs = [
+    anyio
+    curio
+    httpx
+    hypothesis
+    mypy
+    pytestCheckHook
+    pytest-aio
+    pytest-cov
+    pytest-mypy
+    pytest-mypy-plugins
+    pytest-subtests
+    setuptools
+    trio
+  ];
+
+  pytestFlagsArray = [ "--ignore=typesafety" ];
+
+  meta = with lib; {
+    description = "Make your functions return something meaningful, typed, and safe!";
+    homepage = "returns.rtfd.io";
+    license = licenses.bsd2;
+    maintainers = [ maintainers.jessemoore ];
+  };
+}
diff --git a/pkgs/development/python-modules/total-connect-client/default.nix b/pkgs/development/python-modules/total-connect-client/default.nix
index 0d65d0ade19f..5e87993f991a 100644
--- a/pkgs/development/python-modules/total-connect-client/default.nix
+++ b/pkgs/development/python-modules/total-connect-client/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "total-connect-client";
-  version = "2023.1";
+  version = "2023.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "craigjmidwinter";
     repo = "total-connect-client";
     rev = "refs/tags/${version}";
-    hash = "sha256-BZEL/cIAeiwxQor3TbzY8cJ08PYSkXxMl/4XkIEXncg=";
+    hash = "sha256-sZA+3UjYSHZnN87KUNukRCQ/kG7aobcPVWnhqNOLwJw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/conftest/default.nix b/pkgs/development/tools/conftest/default.nix
index 13d99813c767..d122d5ea88e6 100644
--- a/pkgs/development/tools/conftest/default.nix
+++ b/pkgs/development/tools/conftest/default.nix
@@ -6,15 +6,15 @@
 
 buildGoModule rec {
   pname = "conftest";
-  version = "0.39.0";
+  version = "0.39.1";
 
   src = fetchFromGitHub {
     owner = "open-policy-agent";
     repo = "conftest";
     rev = "refs/tags/v${version}";
-    hash = "sha256-FVY4mcf08az3poA2AabqnMnQsJ1Jbqqo5oKUNft+XRk=";
+    hash = "sha256-CSvsHp89FugOQ0PLb26PH1nnw5bOVk7bU5q3lJh0HiU=";
   };
-  vendorHash = "sha256-IzWb5TvZp9wfzjtk3wYWsJepwJU7qeOAoLFt91rqMRQ=";
+  vendorHash = "sha256-HMHG7vGfic9ZseTyM9Fs2fFsJzMTKjHpz67I+WkMJXk=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/development/tools/cpm-cmake/default.nix b/pkgs/development/tools/cpm-cmake/default.nix
index f4f814f2d9f0..a8b53faf0a54 100644
--- a/pkgs/development/tools/cpm-cmake/default.nix
+++ b/pkgs/development/tools/cpm-cmake/default.nix
@@ -5,13 +5,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "cpm-cmake";
-  version = "0.37.0";
+  version = "0.38.0";
 
   src = fetchFromGitHub {
     owner = "cpm-cmake";
     repo = "cpm.cmake";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-zZUk0brG9dAfQRN1LzKRo5/ZAG35TblY0nZvVhy6azE=";
+    hash = "sha256-oNM455CEZZmnmkHNtponWqT1BZltl53FFFVKL3L+SsE=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/development/tools/pypi-mirror/default.nix b/pkgs/development/tools/pypi-mirror/default.nix
index 015100a682f7..d992ac23da02 100644
--- a/pkgs/development/tools/pypi-mirror/default.nix
+++ b/pkgs/development/tools/pypi-mirror/default.nix
@@ -4,13 +4,13 @@
 }:
 python3.pkgs.buildPythonApplication rec {
   pname = "pypi-mirror";
-  version = "5.0.1";
+  version = "5.0.2";
 
   src = fetchFromGitHub {
     owner = "montag451";
     repo = pname;
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-x0to3VrnuON1Ghj6LlMOjJfqSVh9eF3Yg6Cdcxtpbc8=";
+    sha256 = "sha256-AqE3lAcqWq5CGsgwm8jLa1wX93deFC4mKn+oaVhO508=";
   };
 
   pythonImportsCheck = [ "pypi_mirror" ];
diff --git a/pkgs/development/tools/rust/cargo-zigbuild/default.nix b/pkgs/development/tools/rust/cargo-zigbuild/default.nix
index 02b2ea5430b1..3b1cae5c1fcf 100644
--- a/pkgs/development/tools/rust/cargo-zigbuild/default.nix
+++ b/pkgs/development/tools/rust/cargo-zigbuild/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-zigbuild";
-  version = "0.16.0";
+  version = "0.16.1";
 
   src = fetchFromGitHub {
     owner = "messense";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-ITevZv/4Q21y3o9N4WSqD2vONQfNEXKHE/Af/f6T8vw=";
+    sha256 = "sha256-CuQ9bMsLyCDS7KZeG5975Cc5Mvy0VURo25RM+wNUAC4=";
   };
 
-  cargoSha256 = "sha256-e5MIaX4R/z41x11SyZaiOERokCllC10J+rLra2I1N9c=";
+  cargoSha256 = "sha256-X8a6WDTsgT/vWhP3FU30l4IgIihcxW3E+m3bICVjlbs=";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/servers/krill/default.nix b/pkgs/servers/krill/default.nix
index e9562a082afd..abe468ce7f3f 100644
--- a/pkgs/servers/krill/default.nix
+++ b/pkgs/servers/krill/default.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "krill";
-  version = "0.12.1";
+  version = "0.12.2";
 
   src = fetchFromGitHub {
     owner = "NLnetLabs";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-JDLY+TjhPgOieVgvzFCDygzXwMCca/fJNZPfx4WNeO0=";
+    hash = "sha256-IT4Rc74G8EFp+AbJCRWMKIvi5sZg/h7QT0M7U9B0Fu4=";
   };
 
-  cargoHash = "sha256-2kQcTiOqculnDbd4MKBJXNn03d5Ppm+DliIEh8YV2pU=";
+  cargoHash = "sha256-AvOE6SvsztqutGDfew0fkluercpF+lQQlJ1E7/YKtBM=";
 
   buildInputs = [ openssl ] ++ lib.optional stdenv.isDarwin Security;
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/servers/monitoring/nagios/plugins/check_ssl_cert.nix b/pkgs/servers/monitoring/nagios/plugins/check_ssl_cert.nix
index a734c6543310..1708ff4cb518 100644
--- a/pkgs/servers/monitoring/nagios/plugins/check_ssl_cert.nix
+++ b/pkgs/servers/monitoring/nagios/plugins/check_ssl_cert.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation rec {
   pname = "check_ssl_cert";
-  version = "2.58.0";
+  version = "2.60.0";
 
   src = fetchFromGitHub {
     owner = "matteocorti";
     repo = "check_ssl_cert";
     rev = "v${version}";
-    hash = "sha256-nQE3UMZcIR063JuZkTN49imDYQGGnNzE1yaeR4k4mWY=";
+    hash = "sha256-BWzhsIiEjRb4Yq8vf3N1lnwT3uU1Unr/ThxfhEiMBtw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/servers/monitoring/prometheus/redis-exporter.nix b/pkgs/servers/monitoring/prometheus/redis-exporter.nix
index 44d86af8957d..a4590277acc9 100644
--- a/pkgs/servers/monitoring/prometheus/redis-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/redis-exporter.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "redis_exporter";
-  version = "1.46.0";
+  version = "1.47.0";
 
   src = fetchFromGitHub {
     owner = "oliver006";
     repo = "redis_exporter";
     rev = "v${version}";
-    sha256 = "sha256-5OZ4DuGIVMw0Yvd4JC+dbX01RAUAZHmROzl+7Pd6+tc=";
+    sha256 = "sha256-pSLFfArmG4DIgYUD8qz71P+7RYIQuUycnYzNFXNhZ8A=";
   };
 
-  vendorHash = "sha256-p6C/j1591cmPtIvBH1022YRkfBo07KQ8fqUwJ5YIUn8=";
+  vendorHash = "sha256-Owfxy7WkucQ6BM8yjnZg9/8CgopGTtbQTTUuxoT3RRE=";
 
   ldflags = [
     "-X main.BuildVersion=${version}"
diff --git a/pkgs/servers/pocketbase/default.nix b/pkgs/servers/pocketbase/default.nix
index a17e2ecd3cc9..c8da1b233c21 100644
--- a/pkgs/servers/pocketbase/default.nix
+++ b/pkgs/servers/pocketbase/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "pocketbase";
-  version = "0.12.2";
+  version = "0.12.3";
 
   src = fetchFromGitHub {
     owner = "pocketbase";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-PnbsWzuUxGhAGadKfcEWl2HzTA3L4qu3xGJWMx9N4rs=";
+    sha256 = "sha256-/uqUOuNHFyah6nrQI3lRNkB2vpV9vKXJog1ck0zoruo=";
   };
 
   vendorHash = "sha256-8NBudXcU3cjSbo6qpGZVLtbrLedzwijwrbiTgC+OMcU=";
diff --git a/pkgs/servers/rtsp-simple-server/default.nix b/pkgs/servers/rtsp-simple-server/default.nix
index 668f6f8fdf84..526dcde57f19 100644
--- a/pkgs/servers/rtsp-simple-server/default.nix
+++ b/pkgs/servers/rtsp-simple-server/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "rtsp-simple-server";
-  version = "0.21.4";
+  version = "0.21.5";
 
   src = fetchFromGitHub {
     owner = "aler9";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-56BHSRwiYxQHo32d0ZVKJB44GCEG6GRwrjQq6GlIHBc=";
+    hash = "sha256-BwifUZxTM5/7UdSCN7glPU1MWLu7yBxfVAHInGLf4yA=";
   };
 
-  vendorHash = "sha256-HYuW129TQjcG+JGO6OtweIwjcs6hmgaikDaaM4VFSd0=";
+  vendorHash = "sha256-OO4Ak+dmf6yOCZmV/lVhrHnseWoi2MysUh+NKpwrZxI=";
 
   # Tests need docker
   doCheck = false;
diff --git a/pkgs/tools/admin/aws-sso-creds/default.nix b/pkgs/tools/admin/aws-sso-creds/default.nix
index ec91c33a0448..d4ca59da7137 100644
--- a/pkgs/tools/admin/aws-sso-creds/default.nix
+++ b/pkgs/tools/admin/aws-sso-creds/default.nix
@@ -6,15 +6,15 @@
 }:
 buildGoModule rec {
   pname = "aws-sso-creds";
-  version = "1.4.0";
+  version = "1.4.1";
 
   src = fetchFromGitHub {
     owner = "jaxxstorm";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-iyTdVvbqewLPLJB0LjeMB0HvLTi4B3B/HDCvgSlZoNE=";
+    sha256 = "sha256-V50t1L4+LZnMaET3LTp1nt7frNpu95KjgbQ5Onqt5sI=";
   };
-  vendorSha256 = "sha256-SIsM3S9i5YKj8DvE90DxxinqZkav+1gIha1xZiDBuHQ=";
+  vendorHash = "sha256-0jXZpdiSHMn94MT3mPNtbfV7owluWhy1iAvQIBdebdE=";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/tools/admin/cli53/default.nix b/pkgs/tools/admin/cli53/default.nix
index 44752c09fb23..230ce913b591 100644
--- a/pkgs/tools/admin/cli53/default.nix
+++ b/pkgs/tools/admin/cli53/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "cli53";
-  version = "0.8.18";
+  version = "0.8.21";
 
   src = fetchFromGitHub {
     owner = "barnybug";
     repo = "cli53";
     rev = version;
-    sha256 = "sha256-RgU4+/FQEqNpVxBktZUwoVD9ilLrTm5ZT7D8jbt2sRM=";
+    sha256 = "sha256-N7FZfc3kxbMY2ooj+ztlj6xILF3gzT60Yb/puWg58V4=";
   };
 
-  vendorSha256 = "sha256-uqBa2YrQwXdTemP9yB2otkSFWJqDxw/NAvIvlEbhk90=";
+  vendorHash = "sha256-LKJXoXZS866UfJ+Edwf6AkAZmTV2Q1OI1mZfbsxHb3s=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/tools/audio/spotdl/default.nix b/pkgs/tools/audio/spotdl/default.nix
index c76dd693ad8d..e8ceaee81925 100644
--- a/pkgs/tools/audio/spotdl/default.nix
+++ b/pkgs/tools/audio/spotdl/default.nix
@@ -6,7 +6,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "spotdl";
-  version = "4.0.6";
+  version = "4.0.7";
 
   format = "pyproject";
 
@@ -14,7 +14,7 @@ python3.pkgs.buildPythonApplication rec {
     owner = "spotDL";
     repo = "spotify-downloader";
     rev = "refs/tags/v${version}";
-    hash = "sha256-oZyEh76nNKMeEenz0dNLQ5Hd9jRaot6He8toxDSZZ/8=";
+    hash = "sha256-+hkdrPi3INs16SeAl+iXOE9KFDzG/TYXB3CDd8Tigwk=";
   };
 
   nativeBuildInputs = with python3.pkgs; [
@@ -39,6 +39,8 @@ python3.pkgs.buildPythonApplication rec {
     pydantic
     fastapi
     platformdirs
+    pykakasi
+    syncedlyrics
   ];
 
   nativeCheckInputs = with python3.pkgs; [
@@ -87,6 +89,7 @@ python3.pkgs.buildPythonApplication rec {
   meta = with lib; {
     description = "Download your Spotify playlists and songs along with album art and metadata";
     homepage = "https://github.com/spotDL/spotify-downloader";
+    changelog = "https://github.com/spotDL/spotify-downloader/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ dotlambda ];
   };
diff --git a/pkgs/tools/misc/codevis/default.nix b/pkgs/tools/misc/codevis/default.nix
index 6ec698910c39..d160c214454d 100644
--- a/pkgs/tools/misc/codevis/default.nix
+++ b/pkgs/tools/misc/codevis/default.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "codevis";
-  version = "0.5.1";
+  version = "0.6.1";
 
   src = fetchFromGitHub {
     owner = "sloganking";
     repo = "codevis";
     rev = "v${version}";
-    hash = "sha256-dkzBLDZK0BJ069mlkXMGtuDodZr9sxFmpEXjp5Nf0Qk=";
+    hash = "sha256-iw5ULK67AHLoffveZghk57lPQwE2oX+iwlO0dmdpE4E=";
   };
 
-  cargoHash = "sha256-/2sBd2RAOjGTgXMocuKea1qhkXj81vM8PlRhYsJKx5g=";
+  cargoHash = "sha256-IxQ8rnB+2xTBiFvxy2yo27HtBu0zLvbQzyoxH/4waxQ=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/tools/networking/lychee/default.nix b/pkgs/tools/networking/lychee/default.nix
index 8cca06ca95ff..a0eebed8e851 100644
--- a/pkgs/tools/networking/lychee/default.nix
+++ b/pkgs/tools/networking/lychee/default.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "lychee";
-  version = "0.10.3";
+  version = "0.11.1";
 
   src = fetchFromGitHub {
     owner = "lycheeverse";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-gnHeG1LaW10HmVF/+0OmOgaMz3X4ub4UpBiFQaGIah0=";
+    sha256 = "sha256-fOD28O6ycRIniQz841PGJzEFGtYord/y44mdqyAmNDg=";
   };
 
-  cargoSha256 = "sha256-+hTXkPf4r+PF+k0+miY634sQ9RONHmtyF2hVowl/zuk=";
+  cargoHash = "sha256-r089P2VOeIIW0FjkO4oqVXbrxDND4loagVfVMm5EtaE=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/tools/networking/oha/default.nix b/pkgs/tools/networking/oha/default.nix
index 62e30f93992e..35bef11e6441 100644
--- a/pkgs/tools/networking/oha/default.nix
+++ b/pkgs/tools/networking/oha/default.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "oha";
-  version = "0.5.6";
+  version = "0.5.7";
 
   src = fetchFromGitHub {
     owner = "hatoo";
     repo = pname;
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-0Z8+dpZs0KMknyuw4Brkr8UosTDk75Kvy6zA/d91xgE=";
+    sha256 = "sha256-lk4CePSvJb8W/3TAWyRhMcUUi7ZRdIs097Ny0ipXIuc=";
   };
 
-  cargoSha256 = "sha256-isrfxnZbkIqQJ+jipYXvl1QgQ6hwRMdGA1kKFM1saDQ=";
+  cargoSha256 = "sha256-cBtK/38b+W4GKiH+u9ouT52tapGUcPsHfC4DlNDHyjg=";
 
   nativeBuildInputs = lib.optionals stdenv.isLinux [
     pkg-config
diff --git a/pkgs/tools/security/ghidra/build.nix b/pkgs/tools/security/ghidra/build.nix
index 2857019612d5..169d029ef148 100644
--- a/pkgs/tools/security/ghidra/build.nix
+++ b/pkgs/tools/security/ghidra/build.nix
@@ -19,13 +19,13 @@
 let
   pkg_path = "$out/lib/ghidra";
   pname = "ghidra";
-  version = "10.2.2";
+  version = "10.2.3";
 
   src = fetchFromGitHub {
     owner = "NationalSecurityAgency";
     repo = "Ghidra";
     rev = "Ghidra_${version}_build";
-    sha256 = "sha256-AiyY6mGM+jHu9n39t/cYj+I5CE+a3vA4P0THNEFoZrk=";
+    sha256 = "sha256-YhjKRlFlF89H05NsTS69SB108rNiiWijvZZY9fR+Ebc=";
   };
 
   desktopItem = makeDesktopItem {
diff --git a/pkgs/tools/security/gitleaks/default.nix b/pkgs/tools/security/gitleaks/default.nix
index adae9873010e..83f819a8974e 100644
--- a/pkgs/tools/security/gitleaks/default.nix
+++ b/pkgs/tools/security/gitleaks/default.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "gitleaks";
-  version = "8.15.3";
+  version = "8.15.4";
 
   src = fetchFromGitHub {
     owner = "zricethezav";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-eY4RqXDeEsriSdVtEQQKw3NPBOe/UzhXjh1TkW3fWp0=";
+    hash = "sha256-VhOepelAX4Pa/SoL0kH7vPGG1nI5oA5JrhI5T09hKCw=";
   };
 
   vendorHash = "sha256-Ev0/CSpwJDmc+Dvu/bFDzsgsq80rWImJWXNAUqYHgoE=";
diff --git a/pkgs/tools/security/osv-scanner/default.nix b/pkgs/tools/security/osv-scanner/default.nix
index 3057f6fa896a..588370bd3a4b 100644
--- a/pkgs/tools/security/osv-scanner/default.nix
+++ b/pkgs/tools/security/osv-scanner/default.nix
@@ -6,16 +6,16 @@
 }:
 buildGoModule rec {
   pname = "osv-scanner";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-wU42911t4L2tsVBdmNnc1ABu3zEv94SRi9Z0/8zfUJs=";
+    hash = "sha256-5078mJbqiWu+Q0oOWaCJ8YUlSTRDLjmztAhtVyFlvN8=";
   };
 
-  vendorHash = "sha256-8z/oRR2ru4SNdxgqelAQGmAPvOEvh9jlLl17k7Cv20g=";
+  vendorHash = "sha256-LxwP1eK88H/XsGsu8YA3ksZnYJcOr7OzqWmZDRHO5kU=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/tools/text/mdbook-admonish/default.nix b/pkgs/tools/text/mdbook-admonish/default.nix
index c7303fc2fd84..c2f45425076f 100644
--- a/pkgs/tools/text/mdbook-admonish/default.nix
+++ b/pkgs/tools/text/mdbook-admonish/default.nix
@@ -1,33 +1,24 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, rustPlatform, CoreServices }:
+{ lib, stdenv, fetchFromGitHub, rustPlatform, CoreServices }:
 
 rustPlatform.buildRustPackage rec {
   pname = "mdbook-admonish";
-  version = "1.7.0";
+  version = "1.8.0";
 
   src = fetchFromGitHub {
     owner = "tommilligan";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-AGOq05NevkRU8qHsJIWd2WfZ4i7w/wexf6c0fUAaoLg=";
+    hash = "sha256-jo5kR1fzSRQq8fvblJaK3IEHfxeN7h0ZdT6vvPBXTXM=";
   };
 
-  cargoPatches = [
-    # https://github.com/tommilligan/mdbook-admonish/pull/33
-    (fetchpatch {
-      name = "update-mdbook-for-rust-1.64.patch";
-      url = "https://github.com/tommilligan/mdbook-admonish/commit/650123645b18a3f8ed170738c7c1813315095ed9.patch";
-      hash = "sha256-8LMk+Dgz9k0g9fbGGC0X2byyJtfDDgvdGxO06mD6GDI=";
-    })
-  ];
-
-  cargoHash = "sha256-5PWfze00/mWmzYqP5M1pAPt+SuknpU9dc0B7RSikuTE=";
+  cargoHash = "sha256-N0zkdaVWas9jK9IXn9T85s18mNTjoEl8OUF2HA2CuHg=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ CoreServices ];
 
   meta = with lib; {
     description = "A preprocessor for mdbook to add Material Design admonishments";
     license = licenses.mit;
-    maintainers = with maintainers; [ jmgilman ];
+    maintainers = with maintainers; [ jmgilman Frostman ];
     homepage = "https://github.com/tommilligan/mdbook-admonish";
   };
 }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index fc764ea1007c..cf8f38415be2 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -4811,7 +4811,8 @@ with pkgs;
 
   ghdorker = callPackage ../tools/security/ghdorker { };
 
-  ghidra = callPackage ../tools/security/ghidra/build.nix { };
+  ghidra = if stdenv.isDarwin then darwin.apple_sdk_11_0.callPackage ../tools/security/ghidra/build.nix {}
+  else callPackage ../tools/security/ghidra/build.nix {};
 
   ghidra-bin = callPackage ../tools/security/ghidra { };
 
@@ -12023,6 +12024,8 @@ with pkgs;
 
   sing-geosite = callPackage ../data/misc/sing-geosite { };
 
+  sing-geoip = callPackage ../data/misc/sing-geoip { };
+
   sipcalc = callPackage ../tools/networking/sipcalc { };
 
   skribilo = callPackage ../tools/typesetting/skribilo {
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 1031f51fcd4c..758084b00183 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -10072,6 +10072,8 @@ self: super: with self; {
 
   retrying = callPackage ../development/python-modules/retrying { };
 
+  returns = callPackage ../development/python-modules/returns { };
+
   retworkx = callPackage ../development/python-modules/retworkx { };
 
   rfc3339 = callPackage ../development/python-modules/rfc3339 { };