diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 23e585871ace..149ea5179439 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -9841,6 +9841,11 @@
       fingerprint = "1147 43F1 E707 6F3E 6F4B  2C96 B9A8 B592 F126 F8E8";
     }];
   };
+  mac-chaffee = {
+    name = "Mac Chaffee";
+    github = "mac-chaffee";
+    githubId = 7581860;
+  };
   maddiethecafebabe = {
     email = "maddie@cafebabe.date";
     github = "maddiethecafebabe";
diff --git a/nixos/doc/manual/release-notes/rl-2311.section.md b/nixos/doc/manual/release-notes/rl-2311.section.md
index 3bcf98f242ee..3d161d8bb64b 100644
--- a/nixos/doc/manual/release-notes/rl-2311.section.md
+++ b/nixos/doc/manual/release-notes/rl-2311.section.md
@@ -38,6 +38,8 @@
 
 - `etcd` has been updated to 3.5, you will want to read the [3.3 to 3.4](https://etcd.io/docs/v3.5/upgrades/upgrade_3_4/) and [3.4 to 3.5](https://etcd.io/docs/v3.5/upgrades/upgrade_3_5/) upgrade guides
 
+- `consul` has been updated to `1.16.0`. See the [release note](https://github.com/hashicorp/consul/releases/tag/v1.16.0) for more details. Once a new Consul version has started and upgraded its data directory, it generally cannot be downgraded to the previous version.
+
 - `himalaya` has been updated to `0.8.0`, which drops the native TLS support (in favor of Rustls) and add OAuth 2.0 support. See the [release note](https://github.com/soywod/himalaya/releases/tag/v0.8.0) for more details.
 
 - The [services.caddy.acmeCA](#opt-services.caddy.acmeCA) option now defaults to `null` instead of `"https://acme-v02.api.letsencrypt.org/directory"`, to use all of Caddy's default ACME CAs and enable Caddy's automatic issuer fallback feature by default, as recommended by upstream.
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index e728dcb3f192..12c854335efe 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1282,6 +1282,7 @@
   ./services/web-servers/pomerium.nix
   ./services/web-servers/rustus.nix
   ./services/web-servers/stargazer.nix
+  ./services/web-servers/static-web-server.nix
   ./services/web-servers/tomcat.nix
   ./services/web-servers/traefik.nix
   ./services/web-servers/trafficserver/default.nix
diff --git a/nixos/modules/services/web-servers/static-web-server.nix b/nixos/modules/services/web-servers/static-web-server.nix
new file mode 100644
index 000000000000..07187f00fecc
--- /dev/null
+++ b/nixos/modules/services/web-servers/static-web-server.nix
@@ -0,0 +1,68 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.services.static-web-server;
+  toml = pkgs.formats.toml {};
+  configFilePath = toml.generate "config.toml" cfg.configuration;
+in {
+  options = {
+    services.static-web-server = {
+      enable = lib.mkEnableOption (lib.mdDoc ''Static Web Server'');
+      listen = lib.mkOption {
+        default = "[::]:8787";
+        type = lib.types.str;
+        description = lib.mdDoc ''
+          The "ListenStream" used in static-web-server.socket.
+          This is equivalent to SWS's "host" and "port" options.
+          See here for specific syntax: <https://www.freedesktop.org/software/systemd/man/systemd.socket.html#ListenStream=>
+        '';
+      };
+      root = lib.mkOption {
+        type = lib.types.path;
+        description = lib.mdDoc ''
+          The location of files for SWS to serve. Equivalent to SWS's "root" config value.
+          NOTE: This folder must exist before starting SWS.
+        '';
+      };
+      configuration = lib.mkOption {
+        default = { };
+        type = toml.type;
+        example = {
+          general = { log-level = "error"; directory-listing = true; };
+        };
+        description = lib.mdDoc ''
+          Configuration for Static Web Server. See
+          <https://static-web-server.net/configuration/config-file/>.
+          NOTE: Don't set "host", "port", or "root" here. They will be ignored.
+          Use the top-level "listen" and "root" options instead.
+        '';
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ pkgs.static-web-server ];
+    systemd.packages = [ pkgs.static-web-server ];
+    # Have to set wantedBy since systemd.packages ignores the "Install" section
+    systemd.sockets.static-web-server = {
+      wantedBy = [ "sockets.target" ];
+      # Start with empty string to reset upstream option
+      listenStreams = [ "" cfg.listen ];
+    };
+    systemd.services.static-web-server = {
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        # Remove upstream sample environment file; use config.toml exclusively
+        EnvironmentFile = [ "" ];
+        ExecStart = [ "" "${pkgs.static-web-server}/bin/static-web-server --fd 0 --config-file ${configFilePath} --root ${cfg.root}" ];
+        # Supplementary groups doesn't work unless we create the group ourselves
+        SupplementaryGroups = [ "" ];
+        # If the user is serving files from their home dir, override ProtectHome to allow that
+        ProtectHome = if lib.hasPrefix "/home" cfg.root then "tmpfs" else "true";
+        BindReadOnlyPaths = cfg.root;
+      };
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ mac-chaffee ];
+}
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 02bef2039075..d62a4dd49fbf 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -709,6 +709,7 @@ in {
   sssd-ldap = handleTestOn ["x86_64-linux"] ./sssd-ldap.nix {};
   stargazer = runTest ./web-servers/stargazer.nix;
   starship = handleTest ./starship.nix {};
+  static-web-server = handleTest ./web-servers/static-web-server.nix {};
   step-ca = handleTestOn ["x86_64-linux"] ./step-ca.nix {};
   stratis = handleTest ./stratis {};
   strongswan-swanctl = handleTest ./strongswan-swanctl.nix {};
diff --git a/nixos/tests/kafka.nix b/nixos/tests/kafka.nix
index 79af02710c32..864253fd8c73 100644
--- a/nixos/tests/kafka.nix
+++ b/nixos/tests/kafka.nix
@@ -72,5 +72,7 @@ in with pkgs; {
   kafka_3_1  = makeKafkaTest "kafka_3_1"  apacheKafka_3_1;
   kafka_3_2  = makeKafkaTest "kafka_3_2"  apacheKafka_3_2;
   kafka_3_3  = makeKafkaTest "kafka_3_3"  apacheKafka_3_3;
+  kafka_3_4  = makeKafkaTest "kafka_3_4"  apacheKafka_3_4;
+  kafka_3_5  = makeKafkaTest "kafka_3_5"  apacheKafka_3_5;
   kafka  = makeKafkaTest "kafka"  apacheKafka;
 }
diff --git a/nixos/tests/web-servers/static-web-server.nix b/nixos/tests/web-servers/static-web-server.nix
new file mode 100644
index 000000000000..da1a9bdec5d2
--- /dev/null
+++ b/nixos/tests/web-servers/static-web-server.nix
@@ -0,0 +1,32 @@
+import ../make-test-python.nix ({ pkgs, lib, ... } : {
+  name = "static-web-server";
+  meta = {
+    maintainers = with lib.maintainers; [ mac-chaffee ];
+  };
+
+  nodes.machine = { pkgs, ... }: {
+    services.static-web-server = {
+      enable = true;
+      listen = "[::]:8080";
+      root = toString (pkgs.writeTextDir "nixos-test.html" ''
+        <h1>Hello NixOS!</h1>
+      '');
+      configuration = {
+        general = { directory-listing = true; };
+      };
+    };
+  };
+
+  testScript = ''
+    machine.start()
+    machine.wait_for_unit("static-web-server.socket")
+    machine.wait_for_open_port(8080)
+    # We don't use wait_until_succeeds() because we're testing socket
+    # activation which better work on the first request
+    response = machine.succeed("curl -fsS localhost:8080")
+    assert "nixos-test.html" in response, "The directory listing page did not include a link to our nixos-test.html file"
+    response = machine.succeed("curl -fsS localhost:8080/nixos-test.html")
+    assert "Hello NixOS!" in response
+    machine.wait_for_unit("static-web-server.service")
+  '';
+})
diff --git a/pkgs/applications/audio/gtkcord4/default.nix b/pkgs/applications/audio/gtkcord4/default.nix
index fde6a0632691..ce9d26229c6c 100644
--- a/pkgs/applications/audio/gtkcord4/default.nix
+++ b/pkgs/applications/audio/gtkcord4/default.nix
@@ -18,13 +18,13 @@
 
 buildGoModule rec {
   pname = "gtkcord4";
-  version = "0.0.11";
+  version = "0.0.11-1";
 
   src = fetchFromGitHub {
     owner = "diamondburned";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-0d656gjfFlgNdKbPJK+6KIU7zvp88j3bGIlGPwJNRdM=";
+    hash = "sha256-GkjUURmPS1KOwgYn7kO9/oGIUX9fnSgYjyU7PHXtE5w=";
   };
 
   nativeBuildInputs = [
@@ -57,7 +57,7 @@ buildGoModule rec {
     install -D -m 444 internal/icons/png/logo.png $out/share/icons/hicolor/256x256/apps/gtkcord4.png
   '';
 
-  vendorHash = "sha256-+zbaRaGOF6w8C7lmtd3k5Rh/0a+OnqTL9Qhg1ErTHBo=";
+  vendorHash = "sha256-RJ6dLa5EzfLMPR3LMIplFhmph+tcdsieiB5Uv95lqIs=";
 
   meta = with lib; {
     description = "GTK4 Discord client in Go, attempt #4.";
diff --git a/pkgs/applications/audio/ncpamixer/default.nix b/pkgs/applications/audio/ncpamixer/default.nix
index d557a7d2da7c..db5aa416b0ce 100644
--- a/pkgs/applications/audio/ncpamixer/default.nix
+++ b/pkgs/applications/audio/ncpamixer/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ncpamixer";
-  version = "1.3.3.3";
+  version = "1.3.3.4";
 
   src = fetchFromGitHub {
     owner = "fulhax";
     repo = "ncpamixer";
     rev = version;
-    sha256 = "sha256-TxSfiBSsCAImzCXv6o64Jy7tSefpYCkU0xtuHx26Ss4=";
+    sha256 = "sha256-JvIxq9CYFR/4p03e2LeJbLn3NUNwhRNF0GlqN6aPfMo=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
diff --git a/pkgs/applications/blockchains/ledger-live-desktop/default.nix b/pkgs/applications/blockchains/ledger-live-desktop/default.nix
index 8531456a73d3..858931058fce 100644
--- a/pkgs/applications/blockchains/ledger-live-desktop/default.nix
+++ b/pkgs/applications/blockchains/ledger-live-desktop/default.nix
@@ -2,13 +2,14 @@
 
 let
   pname = "ledger-live-desktop";
-  version = "2.60.0";
+  version = "2.62.2";
 
   src = fetchurl {
     url = "https://download.live.ledger.com/${pname}-${version}-linux-x86_64.AppImage";
-    hash = "sha256-dR6F6elUxZW3EuH71d5P9SOSDq5f5lAsYnrfWrsj2KA=";
+    hash = "sha256-Rb611v2QirGmJ01lZj6F3iHLTPI2eJp5acZDEQ4Ude0==";
   };
 
+
   appimageContents = appimageTools.extractType2 {
     inherit pname version src;
   };
diff --git a/pkgs/applications/file-managers/projectable/default.nix b/pkgs/applications/file-managers/projectable/default.nix
index 7ef32c5c48af..8f2a131ce7c9 100644
--- a/pkgs/applications/file-managers/projectable/default.nix
+++ b/pkgs/applications/file-managers/projectable/default.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "projectable";
-  version = "1.2.0";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "dzfrias";
     repo = "projectable";
     rev = version;
-    hash = "sha256-mN8kqh17qGJWOwrdH9fCPApFQBbgCs6FaVg38SNJGP0=";
+    hash = "sha256-yN4OA3glRCzjk87tTadwlhytMoh6FM/ke37BsX4rStQ=";
   };
 
-  cargoHash = "sha256-SQ117gFkqex3GFl7RnorSfPo7e0Eefg1l3L0Vyi/tpU=";
+  cargoHash = "sha256-GGoL681Lv3sXnao2WfhLy4VMgtJFFttzn68lArQO1Uc=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/applications/misc/calibre/default.nix b/pkgs/applications/misc/calibre/default.nix
index f24c4432dd5b..1e90b17eced4 100644
--- a/pkgs/applications/misc/calibre/default.nix
+++ b/pkgs/applications/misc/calibre/default.nix
@@ -32,11 +32,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "calibre";
-  version = "6.21.0";
+  version = "6.22.0";
 
   src = fetchurl {
     url = "https://download.calibre-ebook.com/${finalAttrs.version}/calibre-${finalAttrs.version}.tar.xz";
-    hash = "sha256-gGgXnJbGbp6uK9tFK6wqHBKf+zWidF5u5wI2lclrJGk=";
+    hash = "sha256-TBXdEf6MBP64heY6uAaVJtZc+SnhF4BNJghcCuTopUc=";
   };
 
   # https://sources.debian.org/patches/calibre/${finalAttrs.version}+dfsg-1
diff --git a/pkgs/applications/networking/cluster/func/default.nix b/pkgs/applications/networking/cluster/func/default.nix
index 306ce8ba25e4..7145d1277c9b 100644
--- a/pkgs/applications/networking/cluster/func/default.nix
+++ b/pkgs/applications/networking/cluster/func/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "func";
-  version = "1.7.0";
+  version = "1.10.0";
 
   src = fetchFromGitHub {
     owner = "knative";
     repo = "func";
     rev = "knative-v${version}";
-    sha256 = "sha256-LrWRY22deh+YL/cLb+ZwK93okVPgysBoMCmo2MrbqIs=";
+    hash = "sha256-x/SrRkgeLvjcd9LNgMGOf5TLU1GXpjY2Z2MyxrBZckc=";
   };
 
-  vendorSha256 = null;
+  vendorHash = null;
 
   subPackages = [ "cmd/func" ];
 
diff --git a/pkgs/applications/networking/cluster/kbst/default.nix b/pkgs/applications/networking/cluster/kbst/default.nix
index 9a949bc8c800..30207b07457f 100644
--- a/pkgs/applications/networking/cluster/kbst/default.nix
+++ b/pkgs/applications/networking/cluster/kbst/default.nix
@@ -2,15 +2,17 @@
 
 buildGoModule rec {
   pname = "kbst";
-  version = "0.1.5";
+  version = "0.2.1";
 
   src = fetchFromGitHub{
     owner = "kbst";
     repo = "kbst";
     rev = "v${version}";
-    sha256 = "0cz327fl6cqj9rdi8zw6xrazzigjymhn1hsbjr9xxvfvfnn67xz2";
+    hash = "sha256-tbSYNJp/gzEz+wEAe3bvIiZL5axZvW+bxqTOBkYSpMY=";
   };
 
+  vendorHash = "sha256-+FY6KGX606CfTVKM1HeHxCm9PkaqfnT5XeOEXUX3Q5I=";
+
   ldflags =
     let package_url = "github.com/kbst/kbst"; in
     [
@@ -22,8 +24,6 @@ buildGoModule rec {
       "-X ${package_url}.gitTreeState=clean"
     ];
 
-  vendorSha256 = "sha256-DZ47Bj8aFfBnxU9+e1jZiTMF75rCJtcj4yUfZRJWCic=";
-
   doCheck = false;
 
   doPostInstallCheck = true;
diff --git a/pkgs/applications/networking/instant-messengers/discord/default.nix b/pkgs/applications/networking/instant-messengers/discord/default.nix
index db408e10b0f9..e6d237ee5817 100644
--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@@ -3,7 +3,7 @@ let
   versions = if stdenv.isLinux then {
     stable = "0.0.27";
     ptb = "0.0.43";
-    canary = "0.0.161";
+    canary = "0.0.162";
     development = "0.0.217";
   } else {
     stable = "0.0.273";
@@ -24,7 +24,7 @@ let
       };
       canary = fetchurl {
         url = "https://dl-canary.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
-        sha256 = "sha256-jX7+tDACTzDqDIzL2VuQPHcdMBth6wbHJ4zfVJJmJ68=";
+        sha256 = "sha256-eSWcwSw46hKJmDLxHtolBZgKrIS2QnTbVoYe0EI4Njs=";
       };
       development = fetchurl {
         url = "https://dl-development.discordapp.net/apps/linux/${version}/discord-development-${version}.tar.gz";
diff --git a/pkgs/applications/networking/mailreaders/evolution/evolution/default.nix b/pkgs/applications/networking/mailreaders/evolution/evolution/default.nix
index d2bfc24662fc..fd0e436ec45c 100644
--- a/pkgs/applications/networking/mailreaders/evolution/evolution/default.nix
+++ b/pkgs/applications/networking/mailreaders/evolution/evolution/default.nix
@@ -44,11 +44,11 @@
 
 stdenv.mkDerivation rec {
   pname = "evolution";
-  version = "3.48.3";
+  version = "3.48.4";
 
   src = fetchurl {
     url = "mirror://gnome/sources/evolution/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "ZhJexH/XcBcRdNDAhYZu/7aoNEQBW34sdkEpUtbLDiM=";
+    sha256 = "oC+Z66BQp3HyxH1D/FLgCyJg/IbQYyD79S68fozni7c=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/synology-drive-client/default.nix b/pkgs/applications/networking/synology-drive-client/default.nix
index 850692f18547..34d33e326ab4 100644
--- a/pkgs/applications/networking/synology-drive-client/default.nix
+++ b/pkgs/applications/networking/synology-drive-client/default.nix
@@ -2,7 +2,7 @@
 let
   pname = "synology-drive-client";
   baseUrl = "https://global.download.synology.com/download/Utility/SynologyDriveClient";
-  version = "3.2.1-13272";
+  version = "3.3.0-15082";
   buildNumber = with lib; last (splitString "-" version);
   meta = with lib; {
     description = "Desktop application to synchronize files and folders between the computer and the Synology Drive server.";
@@ -29,7 +29,7 @@ let
 
     src = fetchurl {
       url = "${baseUrl}/${version}/Ubuntu/Installer/x86_64/synology-drive-client-${buildNumber}.x86_64.deb";
-      sha256 = "sha256-olORBipyAv3jYQ7Gv8i4dHoCAdMcTcJR72/UYCPAVt0=";
+      sha256 = "sha256-ha3KRpEIT7w6pUVUwZV011W1F/v/hNq9f3ArfzU0ZGc=";
     };
 
     nativeBuildInputs = [ autoPatchelfHook dpkg ];
@@ -59,7 +59,7 @@ let
 
     src = fetchurl {
       url = "${baseUrl}/${version}/Mac/Installer/synology-drive-client-${buildNumber}.dmg";
-      sha256 = "sha256-oNo/2Fim63xiWiVuY99Q18dHOPHydQJr7C9tib8LLOE=";
+      sha256 = "sha256-dxmpB31ZjO1uAnAbY13OjVR81CCDLf9vJC20iZaPZJ4=";
     };
 
     nativeBuildInputs = [ cpio xar undmg ];
diff --git a/pkgs/applications/office/homebank/default.nix b/pkgs/applications/office/homebank/default.nix
index 17a9cbb59244..e82aa82edd1d 100644
--- a/pkgs/applications/office/homebank/default.nix
+++ b/pkgs/applications/office/homebank/default.nix
@@ -3,10 +3,10 @@
 
 stdenv.mkDerivation rec {
   pname = "homebank";
-  version = "5.5.6";
+  version = "5.6.5";
   src = fetchurl {
-    url = "http://homebank.free.fr/public/homebank-${version}.tar.gz";
-    sha256 = "sha256-Rg6OjHLkwVIDnXqzqPXA8DxqSdrh2T6V/gLBND8vx9o=";
+    url = "http://homebank.free.fr/public/sources/homebank-${version}.tar.gz";
+    hash = "sha256-tUlN/Ph9eoVyaWoq+ioESWunnjhXzT47GKwDvRttLKg=";
   };
 
   nativeBuildInputs = [ pkg-config wrapGAppsHook intltool ];
diff --git a/pkgs/applications/office/morgen/default.nix b/pkgs/applications/office/morgen/default.nix
index 1bdc378b11c0..30cc891d0999 100644
--- a/pkgs/applications/office/morgen/default.nix
+++ b/pkgs/applications/office/morgen/default.nix
@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   pname = "morgen";
-  version = "2.7.3";
+  version = "2.7.4";
 
   src = fetchurl {
     url = "https://download.todesktop.com/210203cqcj00tw1/morgen-${version}.deb";
-    sha256 = "sha256-8cGL2xQI4NYDPGqnvlnVVvha3wXFT8IcjRWTTGO7OJQ=";
+    sha256 = "sha256-jrDu4tXuYl2ttTRHpKHZDucqWO4mYc6zwAdRd0rQht4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/terminal-emulators/alacritty/default.nix b/pkgs/applications/terminal-emulators/alacritty/default.nix
index 2a6f958b1a27..be1ccdc354ea 100644
--- a/pkgs/applications/terminal-emulators/alacritty/default.nix
+++ b/pkgs/applications/terminal-emulators/alacritty/default.nix
@@ -49,16 +49,16 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "alacritty";
-  version = "0.12.1";
+  version = "0.12.2";
 
   src = fetchFromGitHub {
     owner = "alacritty";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-jw66pBKIhvvaQ+Q6tDV6i7ALa7Z0Pw7dp6gAVPqy5bs=";
+    hash = "sha256-X3Z+f5r8surBW9FSsmWKZ/fr82ThXBUkS8fr/sTYR50=";
   };
 
-  cargoHash = "sha256-rDcNliuUDGsd4VA2H9k+AiJTf1ylmFyqCUzxwCtM3T8=";
+  cargoHash = "sha256-JOmDmJl/y4WNsBnCixJykl4PgYgb5cSyo6MCdYmQAzQ=";
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/applications/version-management/commitizen/default.nix b/pkgs/applications/version-management/commitizen/default.nix
index ab15b09a4d18..7cdcc5bf812b 100644
--- a/pkgs/applications/version-management/commitizen/default.nix
+++ b/pkgs/applications/version-management/commitizen/default.nix
@@ -1,79 +1,60 @@
-{ buildPythonApplication
-, charset-normalizer
-, colorama
+{ lib
 , commitizen
-, decli
 , fetchFromGitHub
 , git
-, jinja2
-, lib
-, packaging
-, poetry-core
-, py
-, pytest-freezer
-, pytest-mock
-, pytest-regressions
-, pytestCheckHook
-, pyyaml
-, questionary
-, termcolor
+, python3
 , testers
-, tomlkit
-, typing-extensions
-, argcomplete
-, nix-update-script
-, pre-commit
 }:
 
-buildPythonApplication rec {
+python3.pkgs.buildPythonApplication rec {
   pname = "commitizen";
-  version = "2.42.1";
+  version = "3.5.2";
+  format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "commitizen-tools";
     repo = pname;
-    rev = "v${version}";
-    hash = "sha256-lrZfMqmslwx3B2WkvFosm3EmCHgpZEA/fOzR6UYf6f8=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-4m3NCnGUX9lHCk6czwzxXLqf8GLi2u2A/crBZYTyplA=";
   };
 
-  format = "pyproject";
+  pythonRelaxDeps = [
+    "decli"
+  ];
 
-  nativeBuildInputs = [ poetry-core ];
+  nativeBuildInputs = with python3.pkgs; [
+    poetry-core
+    pythonRelaxDepsHook
+  ];
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace 'charset-normalizer = "^2.1.0"' 'charset-normalizer = "*"' \
-      --replace 'argcomplete = ">=1.12.1,<2.1"' 'argcomplete = ">=1.12.1"'
-  '';
-
-  propagatedBuildInputs = [
+  propagatedBuildInputs = with python3.pkgs; [
+    argcomplete
     charset-normalizer
-    termcolor
-    questionary
     colorama
     decli
-    tomlkit
+    importlib-metadata
     jinja2
-    pyyaml
-    argcomplete
-    typing-extensions
     packaging
+    pyyaml
+    questionary
+    termcolor
+    tomlkit
+  ];
+
+  nativeCheckInputs = with python3.pkgs; [
+    argcomplete
+    deprecated
+    git
+    py
+    pytest-freezer
+    pytest-mock
+    pytest-regressions
+    pytestCheckHook
   ];
 
   doCheck = true;
 
-  nativeCheckInputs = [
-    pre-commit
-    py
-    pytestCheckHook
-    pytest-freezer
-    pytest-mock
-    pytest-regressions
-    argcomplete
-    git
-  ];
-
-  # the tests require a functional git installation
+  # The tests require a functional git installation
   # which requires a valid HOME directory.
   preCheck = ''
     export HOME="$(mktemp -d)"
@@ -101,7 +82,6 @@ buildPythonApplication rec {
       package = commitizen;
       command = "cz version";
     };
-    updateScript = nix-update-script { };
   };
 
   meta = with lib; {
diff --git a/pkgs/build-support/trivial-builders/default.nix b/pkgs/build-support/trivial-builders/default.nix
index 2af36008c7a5..871f9722a4a2 100644
--- a/pkgs/build-support/trivial-builders/default.nix
+++ b/pkgs/build-support/trivial-builders/default.nix
@@ -624,6 +624,10 @@ rec {
     script:
     runCommand name
       (substitutions // {
+        # TODO(@Artturin:) substitutions should be inside the env attrset
+        # but users are likely passing non-substitution arguments through substitutions
+        # turn off __structuredAttrs to unbreak substituteAll
+        __structuredAttrs = false;
         inherit meta;
         inherit depsTargetTargetPropagated;
         propagatedBuildInputs =
diff --git a/pkgs/desktops/gnome/core/epiphany/default.nix b/pkgs/desktops/gnome/core/epiphany/default.nix
index 52711726ec5e..ee31ca4fa565 100644
--- a/pkgs/desktops/gnome/core/epiphany/default.nix
+++ b/pkgs/desktops/gnome/core/epiphany/default.nix
@@ -36,11 +36,11 @@
 
 stdenv.mkDerivation rec {
   pname = "epiphany";
-  version = "44.3";
+  version = "44.5";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "9ekEsuUQIQTYt/46YVA0rdeN4DEWSStUy968ooC92Jk=";
+    sha256 = "PEdeBO0qD0EMtEuWk3VjaXB5GTrJt6UMkUhfubCDFas=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/gnome/core/evolution-data-server/default.nix b/pkgs/desktops/gnome/core/evolution-data-server/default.nix
index 950be481eced..a604efb9cc59 100644
--- a/pkgs/desktops/gnome/core/evolution-data-server/default.nix
+++ b/pkgs/desktops/gnome/core/evolution-data-server/default.nix
@@ -50,13 +50,13 @@
 
 stdenv.mkDerivation rec {
   pname = "evolution-data-server";
-  version = "3.48.3";
+  version = "3.48.4";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/evolution-data-server/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "tx5BLlL1Z8gzlLWSbfkrT09tLN3rrThKUXxyBnH62ZY=";
+    sha256 = "mX4/k7F++wr/zAF77oeAul+iwAnjZVG7yRoIrlUtbWA=";
   };
 
   patches = [
diff --git a/pkgs/desktops/gnome/core/gnome-control-center/default.nix b/pkgs/desktops/gnome/core/gnome-control-center/default.nix
index 2eee6813a0a2..e9fd74c9222d 100644
--- a/pkgs/desktops/gnome/core/gnome-control-center/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-control-center/default.nix
@@ -65,11 +65,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-control-center";
-  version = "44.2";
+  version = "44.3";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-BiPX0hz+lw0u80QgYjVFpZRbmJLmQfmgEc7Owhr9oQw=";
+    sha256 = "sha256-BmplBS/D7ProYAJehfeX5qsrh6WMT4q5xm7CBxioDHo=";
   };
 
   patches = [
diff --git a/pkgs/desktops/gnome/core/gnome-software/default.nix b/pkgs/desktops/gnome/core/gnome-software/default.nix
index 9bfac3ca793d..bee1f9e86db5 100644
--- a/pkgs/desktops/gnome/core/gnome-software/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-software/default.nix
@@ -45,11 +45,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "gnome-software";
-  version = "44.2";
+  version = "44.3";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-software/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "wC3OcOUrN80pwDdlCzcq2xmyfSD+RLwJIdgalZ01YWw=";
+    sha256 = "Mlq7ciyrILaqZ/FY6i/y6omYMMoKiD4kWU2d74X9FiI=";
   };
 
   patches = [
diff --git a/pkgs/development/compilers/nim/default.nix b/pkgs/development/compilers/nim/default.nix
index 43274b3d9d16..692f5331d0b8 100644
--- a/pkgs/development/compilers/nim/default.nix
+++ b/pkgs/development/compilers/nim/default.nix
@@ -86,12 +86,12 @@ in {
 
   nim-unwrapped = stdenv.mkDerivation rec {
     pname = "nim-unwrapped";
-    version = "1.6.12";
+    version = "1.6.14";
     strictDeps = true;
 
     src = fetchurl {
       url = "https://nim-lang.org/download/nim-${version}.tar.xz";
-      hash = "sha256-rO8LCrdzYE1Nc5S2hRntt0+zD0aRIpSyi8J+DHtLTcI=";
+      hash = "sha256-0HDS8oriQA33/kpJ7OufRc1TmQaxB0gYVqCveo+oLck=";
     };
 
     buildInputs = [ boehmgc openssl pcre readline sqlite ]
diff --git a/pkgs/development/interpreters/elixir/1.15.nix b/pkgs/development/interpreters/elixir/1.15.nix
index 6dada168cc37..578db897fce5 100644
--- a/pkgs/development/interpreters/elixir/1.15.nix
+++ b/pkgs/development/interpreters/elixir/1.15.nix
@@ -1,7 +1,7 @@
 { mkDerivation }:
 mkDerivation {
-  version = "1.15.0";
-  sha256 = "sha256-o5MfA0UG8vpnPCH1EYspzcN62yKZQcz5uVUY47hOL9w=";
+  version = "1.15.1";
+  sha256 = "sha256-TP97vnhX+ZZGmOzAfqKf0dSqObPMh+34xcVpFnSb11w=";
   # https://hexdocs.pm/elixir/1.15.0/compatibility-and-deprecations.html#compatibility-between-elixir-and-erlang-otp
   minimumOTPVersion = "24";
   escriptPath = "lib/elixir/scripts/generate_app.escript";
diff --git a/pkgs/development/libraries/fpattern/default.nix b/pkgs/development/libraries/fpattern/default.nix
new file mode 100644
index 000000000000..b0ab2c3d2cea
--- /dev/null
+++ b/pkgs/development/libraries/fpattern/default.nix
@@ -0,0 +1,29 @@
+{ stdenv, lib, fetchFromGitHub }:
+
+stdenv.mkDerivation (finalAttrs: {
+  version = "1.9";
+  pname = "fpattern";
+  outputs = [ "out" "dev" ];
+
+  src = fetchFromGitHub {
+    owner = "Loadmaster";
+    repo = finalAttrs.pname;
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-/QvMQCmoocaXfDm3/c3IAPyfZqR6d7IiJ9UoFKZTpVI=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out $dev/include
+    cp *.c *.h $dev/include
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/Loadmaster/fpattern";
+    description = "Filename pattern matching library functions for DOS, Windows, and Unix";
+    license = licenses.mit;
+    maintainers = with maintainers; [ hughobrien ];
+    platforms = with platforms; linux;
+  };
+})
diff --git a/pkgs/development/libraries/libamqpcpp/default.nix b/pkgs/development/libraries/libamqpcpp/default.nix
index 180a8874e50e..98fc4ae1774d 100644
--- a/pkgs/development/libraries/libamqpcpp/default.nix
+++ b/pkgs/development/libraries/libamqpcpp/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libamqpcpp";
-  version = "4.3.24";
+  version = "4.3.25";
 
   src = fetchFromGitHub {
     owner = "CopernicaMarketingSoftware";
     repo = "AMQP-CPP";
     rev = "v${version}";
-    sha256 = "sha256-65/LsH1ZDkeBrtQUmKc5/5C2ce4nw4nSHXnJqZMKenI=";
+    sha256 = "sha256-9nqp7VM5korICwzZF0XTlC4uKwjSY5MoILVJBzKulPk=";
   };
 
   buildInputs = [ openssl ];
diff --git a/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix b/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix
index eb1a5bdf50aa..0a2dd009f6a4 100644
--- a/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix
+++ b/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix
@@ -11,13 +11,14 @@
 , pythonOlder
 , pythonRelaxDepsHook
 , semver
+, setuptools
 , tabulate
 }:
 
 buildPythonPackage rec {
   pname = "appthreat-vulnerability-db";
-  version = "5.1.4";
-  format = "setuptools";
+  version = "5.2.0";
+  format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
@@ -25,15 +26,12 @@ buildPythonPackage rec {
     owner = "AppThreat";
     repo = "vulnerability-db";
     rev = "refs/tags/v${version}";
-    hash = "sha256-IOQyQ78u9Pr27UKchjSqzCl47UajknI8MYZZy2DheSk=";
+    hash = "sha256-OtaoyqYRsZVoWezrTAy3zROyNeRLbZmCT+z7YCwf9Ow=";
   };
 
   postPatch = ''
     substituteInPlace pytest.ini \
       --replace " --cov-append --cov-report term --cov vdb" ""
-    # https://github.com/AppThreat/vulnerability-db/pull/48
-    substituteInPlace vdb/lib/utils.py \
-      --replace "isvalid(" "is_valid("
   '';
 
   pythonRelaxDeps = [
@@ -42,6 +40,7 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     pythonRelaxDepsHook
+    setuptools
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/auth0-python/default.nix b/pkgs/development/python-modules/auth0-python/default.nix
index f1294133dc5a..19066c748d04 100644
--- a/pkgs/development/python-modules/auth0-python/default.nix
+++ b/pkgs/development/python-modules/auth0-python/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "auth0-python";
-  version = "4.2.0";
+  version = "4.3.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-DyFRCQGjyv75YVBPN+1xWjKQtPUv29xblYu2TehkkVo=";
+    hash = "sha256-enSG8rO0gMpSaf6otdx94xncyxc6Uv570VKVVQkit1g=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/calmjs-types/default.nix b/pkgs/development/python-modules/calmjs-types/default.nix
new file mode 100644
index 000000000000..9f940e92c502
--- /dev/null
+++ b/pkgs/development/python-modules/calmjs-types/default.nix
@@ -0,0 +1,28 @@
+{ lib
+, fetchPypi
+, buildPythonPackage
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "calmjs-types";
+  version = "1.0.1";
+
+  src = fetchPypi {
+    pname = "calmjs.types";
+    inherit version;
+    sha256 = "sha256-EGWYv9mx3RPqs9dnB5t3Bu3hiujL2y/XxyMP7JkjjAQ=";
+    extension = "zip";
+  };
+
+  checkInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "calmjs.types" ];
+
+  meta = with lib; {
+    description = "Types for the calmjs framework";
+    homepage = "https://github.com/calmjs/calmjs.types";
+    license = licenses.mit;
+    maintainers = with maintainers; [ onny ];
+  };
+}
diff --git a/pkgs/development/python-modules/calmjs/default.nix b/pkgs/development/python-modules/calmjs/default.nix
new file mode 100644
index 000000000000..2f27dbc98523
--- /dev/null
+++ b/pkgs/development/python-modules/calmjs/default.nix
@@ -0,0 +1,54 @@
+{ lib
+, fetchPypi
+, buildPythonPackage
+, calmjs-types
+, calmjs-parse
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "calmjs";
+  version = "3.4.4";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-73NQiY1RMdBrMIlm/VTvHY4dCHL1pQoj6a48CWRos3o=";
+    extension = "zip";
+  };
+
+  propagatedBuildInputs = [
+    calmjs-parse
+    calmjs-types
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  # ModuleNotFoundError: No module named 'calmjs.types'
+  # Not yet clear how to run these tests correctly
+  # https://github.com/calmjs/calmjs/issues/63
+  # https://github.com/NixOS/nixpkgs/pull/186298
+  disabledTestPaths = [
+    "src/calmjs/tests/test_dist.py"
+    "src/calmjs/tests/test_testing.py"
+    "src/calmjs/tests/test_artifact.py"
+    "src/calmjs/tests/test_interrogate.py"
+    "src/calmjs/tests/test_loaderplugin.py"
+    "src/calmjs/tests/test_npm.py"
+    "src/calmjs/tests/test_runtime.py"
+    "src/calmjs/tests/test_toolchain.py"
+    "src/calmjs/tests/test_vlqsm.py"
+    "src/calmjs/tests/test_yarn.py"
+    "src/calmjs/tests/test_command.py"
+  ];
+
+  pythonImportsCheck = [ "calmjs" ];
+
+  meta = with lib; {
+    description = "Framework for building toolchains and utilities for working with the Node.js ecosystem";
+    homepage = "https://github.com/calmjs/calmjs";
+    license = licenses.gpl2;
+    maintainers = with maintainers; [ onny ];
+  };
+}
diff --git a/pkgs/development/python-modules/crc/default.nix b/pkgs/development/python-modules/crc/default.nix
index 6117ad4c5aea..eee1f058366f 100644
--- a/pkgs/development/python-modules/crc/default.nix
+++ b/pkgs/development/python-modules/crc/default.nix
@@ -3,27 +3,38 @@
 , fetchFromGitHub
 , poetry-core
 , pytestCheckHook
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "crc";
-  version = "4.2.0";
+  version = "4.3.0";
   format = "pyproject";
 
+  disabled = pythonOlder "3.8";
+
   src = fetchFromGitHub {
     owner = "Nicoretti";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-h/RVMIJX+Lyted0FHNBcKY54EiirSclkBXCpAQSATq8=";
+    hash = "sha256-rH/jc6/gxww3NSCYrhu+InZX1HTTdJFfa52ioU8AclY=";
   };
 
-  nativeBuildInputs = [ poetry-core ];
+  nativeBuildInputs = [
+    poetry-core
+  ];
 
-  pythonImportsCheck = [ "crc" ];
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  pythonImportsCheck = [
+    "crc"
+  ];
 
-  disabledTestPaths = [ "test/bench" ];
+  disabledTestPaths = [
+    "test/bench"
+  ];
 
   meta = with lib; {
     changelog = "https://github.com/Nicoretti/crc/releases/tag/${version}";
diff --git a/pkgs/development/python-modules/decli/default.nix b/pkgs/development/python-modules/decli/default.nix
index 2926d2d10287..a1d6e0db2ead 100644
--- a/pkgs/development/python-modules/decli/default.nix
+++ b/pkgs/development/python-modules/decli/default.nix
@@ -1,22 +1,41 @@
-{ buildPythonPackage
-, lib
-, fetchPypi
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pytestCheckHook
+, pythonOlder
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "decli";
-  version = "0.5.2";
+  version = "0.6.1";
+  format = "pyproject";
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-8s3lUDSnXIGcYwx2VahExhLyWYxCwhKZFgRl32rUY60=";
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "woile";
+    repo = pname;
+    rev = "refs/tags/v${version}";
+    hash = "sha256-FZYKNKkQExx/YBn5y/W0+0aMlenuwEctYTL7LAXMZGE=";
   };
 
-  pythonImportsCheck = [ "decli" ];
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "decli"
+  ];
 
   meta = with lib; {
     description = "Minimal, easy to use, declarative command line interface tool";
     homepage = "https://github.com/Woile/decli";
+    changelog = "https://github.com/woile/decli/blob/v${version}/CHANGELOG.md";
     license = licenses.mit;
     maintainers = with maintainers; [ lovesegfault ];
   };
diff --git a/pkgs/development/python-modules/django-compressor/default.nix b/pkgs/development/python-modules/django-compressor/default.nix
index 0df2ebc96239..a8d367e854af 100644
--- a/pkgs/development/python-modules/django-compressor/default.nix
+++ b/pkgs/development/python-modules/django-compressor/default.nix
@@ -7,48 +7,58 @@
 , beautifulsoup4
 , brotli
 , pytestCheckHook
+, django-sekizai
+, pytest-django
+, csscompressor
+, calmjs
+, jinja2
+, python
 }:
 
 buildPythonPackage rec {
   pname = "django-compressor";
-  version = "4.3.1";
+  version = "4.4";
   format = "setuptools";
 
   src = fetchPypi {
     pname = "django_compressor";
     inherit version;
-    hash = "sha256-aIWMDabMCZzCmgIthsO6iu0RTanXCe7OsNe4GBtfiUI=";
+    hash = "sha256-GwrMnPup9pvDjnxB2psNcKILyVWHtkP/75YJz0YGT2c=";
   };
 
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace "rcssmin == 1.1.0" "rcssmin>=1.1.0" \
-      --replace "rjsmin == 1.2.0" "rjsmin>=1.2.0"
-  '';
-
   propagatedBuildInputs = [
+    beautifulsoup4
+    calmjs
+    django-appconf
+    jinja2
     rcssmin
     rjsmin
-    django-appconf
   ];
 
-  pythonImportsCheck = [
-    "compressor"
-  ];
-
-  doCheck = false; # missing package django-sekizai
-
-  nativeCheckInputs = [
+  checkInputs = [
     beautifulsoup4
     brotli
+    csscompressor
+    django-sekizai
     pytestCheckHook
+    pytest-django
   ];
 
+  # Getting error: compressor.exceptions.OfflineGenerationError: You have
+  # offline compression enabled but key "..." is missing from offline manifest.
+  # You may need to run "python manage.py compress"
+  disabledTestPaths = [
+    "compressor/tests/test_offline.py"
+  ];
+
+  pythonImportsCheck = [ "compressor" ];
+
   DJANGO_SETTINGS_MODULE = "compressor.test_settings";
 
   meta = with lib; {
     description = "Compresses linked and inline JavaScript or CSS into single cached files";
-    homepage = "https://django-compressor.readthedocs.org/en/latest/";
+    homepage = "https://django-compressor.readthedocs.org/";
+    changelog = "https://github.com/django-compressor/django-compressor/blob/${version}/docs/changelog.txt";
     license = licenses.mit;
     maintainers = with maintainers; [ desiderius ];
   };
diff --git a/pkgs/development/python-modules/django-sekizai/default.nix b/pkgs/development/python-modules/django-sekizai/default.nix
new file mode 100644
index 000000000000..3c4e351f25b4
--- /dev/null
+++ b/pkgs/development/python-modules/django-sekizai/default.nix
@@ -0,0 +1,37 @@
+{ lib
+, fetchPypi
+, buildPythonPackage
+, django_classytags
+, pytestCheckHook
+, pytest-django
+}:
+
+buildPythonPackage rec {
+  pname = "django-sekizai";
+  version = "4.1.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-Kso2y64LXAzv7ZVlQW7EQjNXZ/sxRb/xHlhiL8ZTza0=";
+  };
+
+  propagatedBuildInputs = [
+    django_classytags
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+    pytest-django
+  ];
+
+  pythonImportsCheck = [ "sekizai" ];
+
+  DJANGO_SETTINGS_MODULE = "tests.settings";
+
+  meta = with lib; {
+    description = "Define placeholders where your blocks get rendered and append to those blocks";
+    homepage = "https://github.com/django-cms/django-sekizai";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ onny ];
+  };
+}
diff --git a/pkgs/development/python-modules/google/default.nix b/pkgs/development/python-modules/google/default.nix
new file mode 100644
index 000000000000..7dc34933d452
--- /dev/null
+++ b/pkgs/development/python-modules/google/default.nix
@@ -0,0 +1,37 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, beautifulsoup4
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "google";
+  version = "3.0.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-FDUwEi7lEwUJrV6YnwUS98shiy1O3br7rUD9EOjYzL4=";
+  };
+
+  propagatedBuildInputs = [
+    beautifulsoup4
+  ];
+
+  # Module has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "googlesearch"
+  ];
+
+  meta = with lib; {
+    description = "Python bindings to the Google search engine";
+    homepage = "https://pypi.org/project/google/";
+    license = with licenses; [ bsd3 ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/jaraco-email/default.nix b/pkgs/development/python-modules/jaraco-email/default.nix
index b99eff746f47..6e036379b5ce 100644
--- a/pkgs/development/python-modules/jaraco-email/default.nix
+++ b/pkgs/development/python-modules/jaraco-email/default.nix
@@ -3,6 +3,7 @@
 , buildPythonPackage
 , pythonOlder
 , fetchFromGitHub
+, fetchpatch
 , setuptools
 , setuptools-scm
 , jaraco_text
@@ -26,6 +27,19 @@ buildPythonPackage rec {
     hash = "sha256-MR/SX5jmZvEMULgvQbh0JBZjIosNCPWl1wvEoJbdw4Y=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "dos2unix-line-endings.patch";
+      url = "https://github.com/jaraco/jaraco.email/commit/ab9643598e26cca9c9cdbd34b00c972f547b9236.patch";
+      hash = "sha256-Z2WOnR+ELzQciVyUiUq4jaP+Vnc4aseLP7+LWJZoOU8=";
+    })
+    (fetchpatch {
+      name = "jaraco-collections-4-compatibility.patch";
+      url = "https://github.com/jaraco/jaraco.email/commit/e65e5fed0178ddcd009d16883b381c5582f1a9df.patch";
+      hash = "sha256-mKxa0ZU1JFeQPemrjQl94buLNY5gXnMCCRKBxdO870M=";
+    })
+  ];
+
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/jaraco_collections/default.nix b/pkgs/development/python-modules/jaraco_collections/default.nix
index e60da3771297..07cc11ec92e6 100644
--- a/pkgs/development/python-modules/jaraco_collections/default.nix
+++ b/pkgs/development/python-modules/jaraco_collections/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, setuptools
 , setuptools-scm
 , jaraco_classes
 , jaraco_text
@@ -8,12 +9,12 @@
 
 buildPythonPackage rec {
   pname = "jaraco.collections";
-  version = "3.8.0";
+  version = "4.3.0";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-VjBP1L1OuNWFzgys4KyAQYeRsUCFHjdIElQbCqJ8kdA=";
+    hash = "sha256-dP/CP8z+5N4KLr9VajNnW2o8AD1jNZR9MSKgvIgiyOQ=";
   };
 
   postPatch = ''
@@ -22,9 +23,12 @@ buildPythonPackage rec {
   '';
 
   nativeBuildInputs = [
+    setuptools
     setuptools-scm
   ];
 
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
   propagatedBuildInputs = [
     jaraco_classes
     jaraco_text
@@ -39,6 +43,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Models and classes to supplement the stdlib 'collections' module";
     homepage = "https://github.com/jaraco/jaraco.collections";
+    changelog = "https://github.com/jaraco/jaraco.collections/blob/v${version}/NEWS.rst";
     license = licenses.mit;
     maintainers = with maintainers; [ ];
   };
diff --git a/pkgs/development/python-modules/lightning-utilities/default.nix b/pkgs/development/python-modules/lightning-utilities/default.nix
index 22a312d26630..e03e005ad7b2 100644
--- a/pkgs/development/python-modules/lightning-utilities/default.nix
+++ b/pkgs/development/python-modules/lightning-utilities/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "lightning-utilities";
-  version = "0.8.0";
+  version = "0.9.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "Lightning-AI";
     repo = "utilities";
     rev = "refs/tags/v${version}";
-    hash = "sha256-uwmX+/SK2zBkZQbN/t/DZ3i+XbdAJ/RM+Q649QwMUz0=";
+    hash = "sha256-vSeHtvsIt4L4qJCVlTPVjIjd62+08JWBnr9+9+ujOfw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/natsort/default.nix b/pkgs/development/python-modules/natsort/default.nix
index 975e4a8d2eca..fc5d5ab4d590 100644
--- a/pkgs/development/python-modules/natsort/default.nix
+++ b/pkgs/development/python-modules/natsort/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "natsort";
-  version = "8.3.1";
+  version = "8.4.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-UXWVSS3eVwpP1ranb2REQMG6UeIzjIpnHX8Edf2o+f0=";
+    hash = "sha256-RTEsSg5VB1k9oZPe3QSrsUaSU7YB7K9jRFrYDwoepYE=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/openaiauth/default.nix b/pkgs/development/python-modules/openaiauth/default.nix
index 7cc6e6d99e9a..68eead616b47 100644
--- a/pkgs/development/python-modules/openaiauth/default.nix
+++ b/pkgs/development/python-modules/openaiauth/default.nix
@@ -1,21 +1,28 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, pythonOlder
 , requests
 }:
 
 buildPythonPackage rec {
   pname = "openaiauth";
-  version = "1.0.2";
+  version = "2.0.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit version;
     pname = "OpenAIAuth";
-    hash = "sha256-0Vd8gvE2guHNlrPBahu23NpUFrJHvm6Q6NSNawX9gbY=";
+    hash = "sha256-wmVR+cN/uJ75l62uzmHqpvEcnjzi6CU0kQ2e/5LxkBw=";
   };
 
-  propagatedBuildInputs = [ requests ];
+  propagatedBuildInputs = [
+    requests
+  ];
 
+  # Module has no tests
   doCheck = false;
 
   pythonImportsCheck = [
@@ -23,10 +30,10 @@ buildPythonPackage rec {
   ];
 
   meta = with lib; {
-    description = "A Python library for authenticating with the OpenAI API";
-    license = licenses.mit;
-    maintainers = with maintainers; [ realsnick ];
+    description = "Library for authenticating with the OpenAI API";
     homepage = "https://github.com/acheong08/OpenAIAuth";
     changelog = "https://github.com/acheong08/OpenAIAuth/releases/tag/${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ realsnick ];
   };
 }
diff --git a/pkgs/development/python-modules/pycookiecheat/default.nix b/pkgs/development/python-modules/pycookiecheat/default.nix
new file mode 100644
index 000000000000..a8898e4b627e
--- /dev/null
+++ b/pkgs/development/python-modules/pycookiecheat/default.nix
@@ -0,0 +1,66 @@
+{ lib
+, buildPythonPackage
+, cryptography
+, fetchFromGitHub
+, keyring
+, pytestCheckHook
+, pythonOlder
+, pythonRelaxDepsHook
+, playwright
+, setuptools
+, setuptools-scm
+}:
+
+buildPythonPackage rec {
+  pname = "pycookiecheat";
+  version = "0.5.0";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "n8henrie";
+    repo = "pycookiecheat";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-3I7iw/dwF4lRqmVM3OR402InZCFoV9gzKpRQrx4F9KA=";
+  };
+
+  pythonRelaxDeps = [
+    "cryptography"
+    "keyring"
+  ];
+
+  nativeBuildInputs = [
+    pythonRelaxDepsHook
+    setuptools
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = [
+    cryptography
+    keyring
+  ];
+
+  nativeCheckInputs = [
+    playwright
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "pycookiecheat"
+  ];
+
+  disabledTests = [
+    # Tests want to use playwright executable
+    "test_no_cookies"
+    "test_fake_cookie"
+  ];
+
+  meta = with lib; {
+    description = "Borrow cookies from your browser's authenticated session for use in Python scripts";
+    homepage = "https://github.com/n8henrie/pycookiecheat";
+    changelog = "https://github.com/n8henrie/pycookiecheat/blob/v${version}/CHANGELOG.md";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/pyopencl/default.nix b/pkgs/development/python-modules/pyopencl/default.nix
index 03549ea2977d..c5336d788560 100644
--- a/pkgs/development/python-modules/pyopencl/default.nix
+++ b/pkgs/development/python-modules/pyopencl/default.nix
@@ -24,13 +24,13 @@ let
     if stdenv.isDarwin then [ mesa_drivers.dev ] else [ ocl-icd ];
 in buildPythonPackage rec {
   pname = "pyopencl";
-  version = "2023.1";
+  version = "2023.1.1";
 
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-2d5gcnKRmlB6nCTD3+7q/nLAX3zWyeN7IRno7jxTqJE=";
+    hash = "sha256-CtkleKlKC+De3Vyk/Lbie1p13k5frHV/BMkES9nUJEQ=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/rabbitpy/default.nix b/pkgs/development/python-modules/rabbitpy/default.nix
deleted file mode 100644
index 9287c72441cc..000000000000
--- a/pkgs/development/python-modules/rabbitpy/default.nix
+++ /dev/null
@@ -1,47 +0,0 @@
-{ lib
-, buildPythonPackage
-, fetchFromGitHub
-, mock
-, nose
-, pamqp
-}:
-
-buildPythonPackage rec {
-  version = "2.0.1";
-  pname = "rabbitpy";
-
-  # No tests in the pypi tarball, so we directly fetch from git
-  src = fetchFromGitHub {
-    owner = "gmr";
-    repo = pname;
-    rev = version;
-    sha256 = "0m5z3i3d5adrz1wh6y35xjlls3cq6p4y9p1mzghw3k7hdvg26cck";
-  };
-
-  propagatedBuildInputs = [ pamqp ];
-  nativeCheckInputs = [ mock nose ];
-
-  checkPhase = ''
-    runHook preCheck
-    rm tests/integration_tests.py # Impure tests requiring network
-    nosetests tests
-    runHook postCheck
-  '';
-
-  postPatch = ''
-    # See: https://github.com/gmr/rabbitpy/issues/118
-    substituteInPlace setup.py \
-      --replace 'pamqp>=2,<3' 'pamqp'
-  '';
-
-  meta = with lib; {
-    description = "A pure python, thread-safe, minimalistic and pythonic RabbitMQ client library";
-    homepage = "https://pypi.python.org/pypi/rabbitpy";
-    license = licenses.bsd3;
-
-    # broken by pamqp==3, tracked in
-    # https://github.com/gmr/rabbitpy/issues/125
-    broken = true;
-  };
-
-}
diff --git a/pkgs/development/python-modules/wagtail-localize/default.nix b/pkgs/development/python-modules/wagtail-localize/default.nix
index fdd2e0e39a0e..085eca293d11 100644
--- a/pkgs/development/python-modules/wagtail-localize/default.nix
+++ b/pkgs/development/python-modules/wagtail-localize/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "wagtail-localize";
-  version = "1.5";
+  version = "1.5.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     repo = pname;
     owner = "wagtail";
     rev = "refs/tags/v${version}";
-    hash = "sha256-aNz4OoUUXWMCahMxuYBxvNWnw7Inxd5svBgwLgoirW8=";
+    hash = "sha256-RjJyx3sr69voJxa3lH8Nq/liZ3eMoTfZ4phykj7neZA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/bearer/default.nix b/pkgs/development/tools/bearer/default.nix
index 718015ace1a9..aece15601314 100644
--- a/pkgs/development/tools/bearer/default.nix
+++ b/pkgs/development/tools/bearer/default.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "bearer";
-  version = "1.14.0";
+  version = "1.15.0";
 
   src = fetchFromGitHub {
     owner = "bearer";
     repo = "bearer";
     rev = "refs/tags/v${version}";
-    hash = "sha256-7h+7lP4K4Dbf5V2HDrb2lJKWqINtOpqybBAyae0S6EE=";
+    hash = "sha256-fmEvXSiWtQuFCsaUxiruEi+pU8FnHg23Z1YXtpKyCy8=";
   };
 
-  vendorHash = "sha256-D8LdufbOx3ogLbeSwBTsDnQ4NpZF+Ro2QiUg4hPGGYI=";
+  vendorHash = "sha256-NkqMmMwm6CvJn8rPyG1gFmBiayws28kgobTVPJh2l5o=";
 
   subPackages = [
     "cmd/bearer"
diff --git a/pkgs/development/tools/buf/default.nix b/pkgs/development/tools/buf/default.nix
index 7342697ca32c..02feb124c519 100644
--- a/pkgs/development/tools/buf/default.nix
+++ b/pkgs/development/tools/buf/default.nix
@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "buf";
-  version = "1.21.0";
+  version = "1.23.1";
 
   src = fetchFromGitHub {
     owner = "bufbuild";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-7aS48tfONrDdE+NoTpoz+5TOBDQfEgCwKKkoBnrUTW8=";
+    hash = "sha256-6Zp4QuH0wJQCt8w2230Ugrds8tFmnCcICxgWJiqTBWc=";
   };
 
-  vendorHash = "sha256-zk7cj3DwfaZg7PRS50qw0tS8lguX4yWcCiPk+2HYah8=";
+  vendorHash = "sha256-e4frrLrG6OxOUcr5iqY+QEokdy95glmc3Rw2HPWUPEI=";
 
   patches = [
     # Skip a test that requires networking to be available to work.
diff --git a/pkgs/development/tools/database/vitess/default.nix b/pkgs/development/tools/database/vitess/default.nix
index e5743e8e2e4b..192b29c15227 100644
--- a/pkgs/development/tools/database/vitess/default.nix
+++ b/pkgs/development/tools/database/vitess/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "vitess";
-  version = "16.0.2";
+  version = "17.0.0";
 
   src = fetchFromGitHub {
     owner = "vitessio";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-8nFvNO+zb7Z0g2BMnlk+obDolCQrlfClOIg0mPW8gAU=";
+    hash = "sha256-J/lvOP8MsHOWnq7kKRqIktME0ewtilkyOv8pD1wSnPc=";
   };
 
-  vendorHash = "sha256-hC0skrEDXn6SXjH75ur77I0pHnGSURErAy97lmVvqro=";
+  vendorHash = "sha256-QcCgDOqKSI+NPCdQJY4v6qU31nLQPIF8fs2qkLOk+DU=";
 
   buildInputs = [ sqlite ];
 
diff --git a/pkgs/development/tools/ktlint/default.nix b/pkgs/development/tools/ktlint/default.nix
index 8eefc895864b..1718821d2102 100644
--- a/pkgs/development/tools/ktlint/default.nix
+++ b/pkgs/development/tools/ktlint/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ktlint";
-  version = "0.49.1";
+  version = "0.50.0";
 
   src = fetchurl {
     url = "https://github.com/pinterest/ktlint/releases/download/${version}/ktlint";
-    sha256 = "1k2byxqvgr2xll4jj0ck8w3qdgkvjhwkag18inxjakcl99knygrb";
+    sha256 = "01qh85kclksgv484cwma7jyaxlz8rgk14l4mxcvzp2flprdnzgd2";
   };
 
   nativeBuildInputs = [ makeWrapper ];
@@ -28,5 +28,6 @@ stdenv.mkDerivation rec {
     platforms = jre_headless.meta.platforms;
     changelog = "https://github.com/pinterest/ktlint/blob/master/CHANGELOG.md";
     maintainers = with maintainers; [ tadfisher SubhrajyotiSen ];
+    sourceProvenance = with sourceTypes; [ binaryBytecode ];
   };
 }
diff --git a/pkgs/development/tools/misc/global/default.nix b/pkgs/development/tools/misc/global/default.nix
index 70ec9278ae13..ed0596fef8a0 100644
--- a/pkgs/development/tools/misc/global/default.nix
+++ b/pkgs/development/tools/misc/global/default.nix
@@ -6,24 +6,24 @@ let
   pygments = python3Packages.pygments;
 in stdenv.mkDerivation rec {
   pname = "global";
-  version = "6.6.7";
+  version = "6.6.10";
 
   src = fetchurl {
     url = "mirror://gnu/global/${pname}-${version}.tar.gz";
-    sha256 = "sha256-aaD3f1OCfFVoF2wdOCFm3zYedCY6BH8LMFiqLyrVijw=";
+    hash = "sha256-LdHmqUXpPAE5D7lBpOaU9McbvXVp1kFJwE6Se79NzOg=";
   };
 
   nativeBuildInputs = [ libtool makeWrapper ];
 
-  buildInputs = [ ncurses ];
+  buildInputs = [ ncurses sqlite ];
 
   propagatedBuildInputs = [ pygments ];
 
   configureFlags = [
     "--with-ltdl-include=${libtool}/include"
     "--with-ltdl-lib=${libtool.lib}/lib"
-    "--with-ncurses=${ncurses.dev}"
-    "--with-sqlite3=${sqlite.dev}"
+    "--with-ncurses=${ncurses}"
+    "--with-sqlite3"
     "--with-exuberant-ctags=${ctags}/bin/ctags"
     "--with-universal-ctags=${universal-ctags}/bin/ctags"
     "--with-posix-sort=${coreutils}/bin/sort"
@@ -57,5 +57,6 @@ in stdenv.mkDerivation rec {
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ pSub peterhoeg ];
     platforms = platforms.unix;
+    changelog = "https://cvs.savannah.gnu.org/viewvc/global/global/NEWS?view=markup&pathrev=VERSION-${lib.replaceStrings [ "." ] [ "_" ] version}";
   };
 }
diff --git a/pkgs/development/tools/misc/protox/default.nix b/pkgs/development/tools/misc/protox/default.nix
new file mode 100644
index 000000000000..6875292d241b
--- /dev/null
+++ b/pkgs/development/tools/misc/protox/default.nix
@@ -0,0 +1,29 @@
+{ lib
+, rustPlatform
+, fetchCrate
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "protox";
+  version = "0.4.1";
+
+  src = fetchCrate {
+    inherit pname version;
+    hash = "sha256-n72Fvdo6LLk8pzYS2/5zk+dbsLRPAm6NZ5DsMRyHCTY=";
+  };
+
+  cargoHash = "sha256-wW4UcC3QAtriLEiXPndP+tZATftWP7ySavpIV6cGVCA=";
+
+  buildFeatures = [ "bin" ];
+
+  # tests are not included in the crate source
+  doCheck = false;
+
+  meta = with lib; {
+    description = "A rust implementation of the protobuf compiler";
+    homepage = "https://github.com/andrewhickman/protox";
+    changelog = "https://github.com/andrewhickman/protox/blob/${version}/CHANGELOG.md";
+    license = with licenses; [ asl20 mit ];
+    maintainers = with maintainers; [ figsoda ];
+  };
+}
diff --git a/pkgs/os-specific/darwin/raycast/default.nix b/pkgs/os-specific/darwin/raycast/default.nix
index d37cdff0ca86..df6c5c36d7a3 100644
--- a/pkgs/os-specific/darwin/raycast/default.nix
+++ b/pkgs/os-specific/darwin/raycast/default.nix
@@ -4,14 +4,14 @@
 , undmg
 }:
 
-stdenvNoCC.mkDerivation rec {
+stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "raycast";
-  version = "1.53.4";
+  version = "1.54.1";
 
   src = fetchurl {
     name = "Raycast.dmg";
-    url = "https://releases.raycast.com/releases/${version}/download?build=universal";
-    sha256 = "sha256-bkNlGHCpYnHlKdzDyKGPF5jnoq2cSe1sdg9W2DwVrWc=";
+    url = "https://releases.raycast.com/releases/${finalAttrs.version}/download?build=universal";
+    hash = "sha256-lnP0wSTC7oCji24RSk1fY+QSwoYioMPtvOb4Ey1MzVY=";
   };
 
   dontPatch = true;
@@ -35,9 +35,9 @@ stdenvNoCC.mkDerivation rec {
   meta = with lib; {
     description = "Control your tools with a few keystrokes";
     homepage = "https://raycast.app/";
-    license = licenses.unfree;
+    license = with licenses; [ unfree ];
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     maintainers = with maintainers; [ lovesegfault stepbrobd ];
-    platforms = platforms.darwin;
+    platforms = [ "aarch64-darwin" "x86_64-darwin" ];
   };
-}
+})
diff --git a/pkgs/os-specific/darwin/raycast/update.sh b/pkgs/os-specific/darwin/raycast/update.sh
index f338f5f278fc..6c81c02b8f97 100755
--- a/pkgs/os-specific/darwin/raycast/update.sh
+++ b/pkgs/os-specific/darwin/raycast/update.sh
@@ -3,7 +3,7 @@
 
 set -eo pipefail
 
-new_version=$(curl --silent https://releases.raycast.com/releases/latest | jq -r '.version')
+new_version=$(curl --silent https://releases.raycast.com/releases/latest?build=universal | jq -r '.version')
 old_version=$(sed -nE 's/\s*version = "(.*)".*/\1/p' ./default.nix)
 
 if [[ $new_version == $old_version ]]; then
@@ -16,5 +16,5 @@ else
 fi
 
 hash=$(nix --extra-experimental-features nix-command store prefetch-file --json --hash-type sha256 "https://releases.raycast.com/releases/$new_version/download?build=universal" | jq -r '.hash')
-sed -Ei.bak '/ *sha256 = /{N;N; s@("sha256-)[^;"]+@"'"$hash"'@}' ./default.nix
+sed -Ei.bak '/ *hash = /{N;N; s@("sha256-)[^;"]+@"'"$hash"'@}' ./default.nix
 rm ./default.nix.bak
diff --git a/pkgs/os-specific/linux/intel-compute-runtime/default.nix b/pkgs/os-specific/linux/intel-compute-runtime/default.nix
index fe1bb139a10b..3dba3de332c2 100644
--- a/pkgs/os-specific/linux/intel-compute-runtime/default.nix
+++ b/pkgs/os-specific/linux/intel-compute-runtime/default.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "intel-compute-runtime";
-  version = "23.17.26241.15";
+  version = "23.17.26241.24";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "compute-runtime";
     rev = version;
-    sha256 = "sha256-A0gtSM6e+VcfcGG/6zReV2LIXq6tGbWIwDQFlQ2TW28=";
+    sha256 = "sha256-FcI9bBJc23UlPP7qSBUc+t4e1X3UEJTYiy86N3KVWrs=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
diff --git a/pkgs/servers/apache-kafka/default.nix b/pkgs/servers/apache-kafka/default.nix
index cb3691460bd7..114a0ce96f0e 100644
--- a/pkgs/servers/apache-kafka/default.nix
+++ b/pkgs/servers/apache-kafka/default.nix
@@ -3,10 +3,22 @@
 
 let
   versionMap = {
-    "3.3" = {
-      kafkaVersion = "3.3.1";
+    "3.5" = {
+      kafkaVersion = "3.5.0";
       scalaVersion = "2.13";
-      sha256 = "sha256-GK2KNl+xEd4knTu4vzyWzRrwYOyPs+PR/Ep64Q2QQt4=";
+      sha256 = "sha256-KjpGjgab5XDxbWEqgZbC96kge36shlvpNNIM4SUusvg=";
+      jre = jdk17_headless;
+    };
+    "3.4" = {
+      kafkaVersion = "3.4.1";
+      scalaVersion = "2.13";
+      sha256 = "sha256-p28XpSuPLNMd4RVx/zZqcUggtuTgKJOwFZ0J2w7a+Zg=";
+      jre = jdk17_headless;
+    };
+    "3.3" = {
+      kafkaVersion = "3.3.2";
+      scalaVersion = "2.13";
+      sha256 = "sha256-Gv5XrpXnEajH8fSbcfIfURz+QPcqTrJ1oe3SGXYLNRc=";
       jre = jdk17_headless;
     };
     "3.2" = {
diff --git a/pkgs/servers/consul/default.nix b/pkgs/servers/consul/default.nix
index 171724598d44..1f9b68060321 100644
--- a/pkgs/servers/consul/default.nix
+++ b/pkgs/servers/consul/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "consul";
-  version = "1.15.3";
+  version = "1.16.0";
   rev = "v${version}";
 
   # Note: Currently only release tags are supported, because they have the Consul UI
@@ -17,7 +17,7 @@ buildGoModule rec {
     owner = "hashicorp";
     repo = pname;
     inherit rev;
-    sha256 = "sha256-Xe+baALN8Ow6vjneWAvC65cBSsrMAsdxjEQRBcvWxCw=";
+    hash = "sha256-7F0kutAWyi22OxI242P8m1Aoj+l/7F91wmxDSt4ttyA=";
   };
 
   passthru.tests.consul = nixosTests.consul;
@@ -26,7 +26,7 @@ buildGoModule rec {
   # has a split module structure in one repo
   subPackages = ["." "connect/certgen"];
 
-  vendorHash = "sha256-tbwX/uF9+yIhd+KSGF2v7HjxGtfaZYSm+1GIspQmC9A=";
+  vendorHash = "sha256-aZRW+z9oW7if+yMOrETNXFC521Wo0feq1FDv8/Q4ejY=";
 
   doCheck = false;
 
diff --git a/pkgs/servers/home-automation/evcc/default.nix b/pkgs/servers/home-automation/evcc/default.nix
index 77e9d73d078c..d2d25006fa88 100644
--- a/pkgs/servers/home-automation/evcc/default.nix
+++ b/pkgs/servers/home-automation/evcc/default.nix
@@ -16,20 +16,20 @@
 
 buildGoModule rec {
   pname = "evcc";
-  version = "0.118.1";
+  version = "0.118.2";
 
   src = fetchFromGitHub {
     owner = "evcc-io";
     repo = pname;
     rev = version;
-    hash = "sha256-EAvY+JNk1V4oWW5mbbEIRjaUqTOib6zY8hab0Mw2hUk=";
+    hash = "sha256-4zbXNXNWrnsghbL2cvatCShuio7uIXbLtLmG0o4PGq0=";
   };
 
-  vendorHash = "sha256-CkJpTXbjHRXcZp+FWGal91kkFkIMoKZ6/zmY+8Udmos=";
+  vendorHash = "sha256-SFs7Bua3/bgTcdzvSisTn3Xx+7jD84LrMdaUhDXp9VI=";
 
   npmDeps = fetchNpmDeps {
     inherit src;
-    hash = "sha256-w2xMG0vHx4g9AAvNWRwR3u9w6PrHtQV7TETnDRkmkBk=";
+    hash = "sha256-Kwt6YzaqJhEF90+r4+BjYwgmD5xXQBSEzwp6dg3X9GQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/servers/owntracks-recorder/default.nix b/pkgs/servers/owntracks-recorder/default.nix
new file mode 100644
index 000000000000..47b3b696fd4c
--- /dev/null
+++ b/pkgs/servers/owntracks-recorder/default.nix
@@ -0,0 +1,82 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, pkg-config
+, mosquitto
+, curl
+, openssl
+, lmdb
+, lua
+, libsodium
+, libuuid
+, libconfig
+, testers
+, owntracks-recorder
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "owntracks-recorder";
+  version = "0.9.3";
+
+  src = fetchFromGitHub {
+    owner = "owntracks";
+    repo = "recorder";
+    rev = finalAttrs.version;
+    hash = "sha256-w0wk69hERGz6fs6uXBYiomcVlQeeTGCfTICu2q7ryNg=";
+  };
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    (lib.getDev curl)
+    (lib.getLib libconfig)
+    (lib.getDev openssl)
+    (lib.getDev lmdb)
+    (lib.getDev mosquitto)
+    (lib.getDev libuuid)
+    (lib.getDev lua)
+    (lib.getDev libsodium)
+  ];
+
+  configurePhase = ''
+    runHook preConfigure
+
+    cp config.mk.in config.mk
+
+    substituteInPlace config.mk \
+      --replace "INSTALLDIR = /usr/local" "INSTALLDIR = $out" \
+      --replace "WITH_LUA ?= no" "WITH_LUA ?= yes" \
+      --replace "WITH_ENCRYPT ?= no" "WITH_ENCRYPT ?= yes"
+
+    runHook postConfigure
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+
+    install -m 0755 ot-recorder $out/bin
+    install -m 0755 ocat $out/bin
+
+    runHook postInstall
+  '';
+
+  passthru.tests.version = testers.testVersion {
+    package = owntracks-recorder;
+    command = "ocat --version";
+    version = finalAttrs.version;
+  };
+
+  meta = with lib; {
+    description = "Store and access data published by OwnTracks apps";
+    homepage = "https://github.com/owntracks/recorder";
+    changelog = "https://github.com/owntracks/recorder/blob/master/Changelog";
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ gaelreyrol ];
+    mainProgram = "ot-recorder";
+  };
+})
diff --git a/pkgs/servers/rustypaste/default.nix b/pkgs/servers/rustypaste/default.nix
index 725cf317980e..b7b4e3c4ee6e 100644
--- a/pkgs/servers/rustypaste/default.nix
+++ b/pkgs/servers/rustypaste/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rustypaste";
-  version = "0.10.1";
+  version = "0.11.1";
 
   src = fetchFromGitHub {
     owner = "orhun";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-WLuMG9gC2kSdyrYa0CNnInjetXph0OL/Jmjskih4tuw=";
+    sha256 = "sha256-5yttOaDsWcRCFBzziOW4H1Nrs7/X/pGFlnPNUQRf+w8=";
   };
 
-  cargoHash = "sha256-A651PTooQjITjxCLKPhnFSCxa27uesTOP8ZbAlRbOUk=";
+  cargoHash = "sha256-8lv0AGcV4LW6r+K0rIZNV0NPhX4j3+wbMw4JeJkNuXw=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
     darwin.apple_sdk.frameworks.CoreServices
@@ -20,11 +20,14 @@ rustPlatform.buildRustPackage rec {
   # Some tests need network
   checkFlags = [
     "--skip=paste::tests::test_paste_data"
+    "--skip=server::tests::test_index_with_landing_page_file_not_found"
     "--skip=server::tests::test_upload_file"
     "--skip=server::tests::test_upload_remote_file"
     "--skip=util::tests::test_get_expired_files"
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   meta = with lib; {
     description = "A minimal file upload/pastebin service";
     homepage = "https://github.com/orhun/rustypaste";
diff --git a/pkgs/servers/static-web-server/default.nix b/pkgs/servers/static-web-server/default.nix
index 0cedcd50768d..24024d235ff0 100644
--- a/pkgs/servers/static-web-server/default.nix
+++ b/pkgs/servers/static-web-server/default.nix
@@ -1,4 +1,4 @@
-{ lib, rustPlatform, fetchFromGitHub, stdenv, darwin }:
+{ lib, rustPlatform, fetchFromGitHub, stdenv, darwin, nixosTests }:
 
 rustPlatform.buildRustPackage rec {
   pname = "static-web-server";
@@ -24,6 +24,13 @@ rustPlatform.buildRustPackage rec {
     "--skip=handle_precondition"
   ];
 
+  # Need to copy in the systemd units for systemd.packages to discover them
+  postInstall = ''
+    install -Dm444 -t $out/lib/systemd/system/ systemd/static-web-server.{service,socket}
+  '';
+
+  passthru.tests = { inherit (nixosTests) static-web-server; };
+
   meta = with lib; {
     description = "An asynchronus web server for static files-serving";
     homepage = "https://static-web-server.net/";
diff --git a/pkgs/servers/web-apps/netbox/default.nix b/pkgs/servers/web-apps/netbox/default.nix
index 5903c5183335..0e2c4c999cf0 100644
--- a/pkgs/servers/web-apps/netbox/default.nix
+++ b/pkgs/servers/web-apps/netbox/default.nix
@@ -23,8 +23,8 @@ in
   };
 
   netbox = callPackage generic {
-    version = "3.5.3";
-    hash = "sha256-F8rsTOOxARI3ll545AF0+HFaG4wNO+RWwsl5y9kAyE4=";
+    version = "3.5.4";
+    hash = "sha256-CJ7NgKDDEmOFFULaG6wjP5pvGieyU4YRsvmIvqve5qg=";
     extraPatches = [
       # Allow setting the STATIC_ROOT from within the configuration and setting a custom redis URL
       ./config.patch
diff --git a/pkgs/tools/X11/ckbcomp/default.nix b/pkgs/tools/X11/ckbcomp/default.nix
index c418d2f8ad0c..c5f44792c3b1 100644
--- a/pkgs/tools/X11/ckbcomp/default.nix
+++ b/pkgs/tools/X11/ckbcomp/default.nix
@@ -2,14 +2,14 @@
 
 stdenv.mkDerivation rec {
   pname = "ckbcomp";
-  version = "1.221";
+  version = "1.222";
 
   src = fetchFromGitLab {
     domain = "salsa.debian.org";
     owner = "installer-team";
     repo = "console-setup";
     rev = version;
-    sha256 = "sha256-4/g2RR3jDeEjntEC9IySn3hHofK23zKb8+kvTcbnpTI=";
+    sha256 = "sha256-2HviEt/PJS3QFgGPa8WsUeDhotGaHRLs51LlSimfTYQ=";
   };
 
   buildInputs = [ perl ];
diff --git a/pkgs/tools/admin/pulsarctl/default.nix b/pkgs/tools/admin/pulsarctl/default.nix
new file mode 100644
index 000000000000..400e6dc7ae04
--- /dev/null
+++ b/pkgs/tools/admin/pulsarctl/default.nix
@@ -0,0 +1,76 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, installShellFiles
+, nix-update-script
+, testers
+, pulsarctl
+}:
+
+buildGoModule rec {
+  pname = "pulsarctl";
+  version = "2.10.3.3";
+
+  src = fetchFromGitHub {
+    owner = "streamnative";
+    repo = "pulsarctl";
+    rev = "v${version}";
+    hash = "sha256-BOVFBIG+XKBOmLOx/IzseEArcPeriJWzn30FOERBy9s=";
+  };
+
+  vendorHash = "sha256-ao8Bxaq9LHvC6Zdd1isyMKxoTJ0MGelSPPxwgqVJcK8=";
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  preBuild = let
+    buildVars = {
+      ReleaseVersion = version;
+      BuildTS = "None";
+      GitHash = src.rev;
+      GitBranch = "None";
+      GoVersion = "$(go version | egrep -o 'go[0-9]+[.][^ ]*')";
+    };
+    buildVarsFlags = lib.concatStringsSep " " (lib.mapAttrsToList (k: v: "-X github.com/streamnative/pulsarctl/pkg/cmdutils.${k}=${v}") buildVars);
+  in
+  ''
+    buildFlagsArray+=("-ldflags=${buildVarsFlags}")
+  '';
+
+  excludedPackages = [
+    "./pkg/test"
+    "./pkg/test/bookkeeper"
+    "./pkg/test/bookkeeper/containers"
+    "./pkg/test/pulsar"
+    "./pkg/test/pulsar/containers"
+    "./site/gen-pulsarctldocs"
+    "./site/gen-pulsarctldocs/generators"
+  ];
+
+  doCheck = false;
+
+  postInstall = ''
+    installShellCompletion --cmd pulsarctl \
+      --bash <($out/bin/pulsarctl completion bash) \
+      --fish <($out/bin/pulsarctl completion fish) \
+      --zsh <($out/bin/pulsarctl completion zsh)
+  '';
+
+  passthru = {
+    updateScript = nix-update-script { };
+    tests.version = testers.testVersion {
+      package = pulsarctl;
+      command = "pulsarctl --version";
+      version = "v${version}";
+    };
+  };
+
+  meta = with lib; {
+    description = " a CLI for Apache Pulsar written in Go";
+    homepage = "https://github.com/streamnative/pulsarctl";
+    license = with licenses; [ asl20 ];
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ gaelreyrol ];
+    mainProgram = "pulsarctl";
+  };
+}
+
diff --git a/pkgs/tools/audio/vgmtools/default.nix b/pkgs/tools/audio/vgmtools/default.nix
index 2300609beea1..857bf7c503f3 100644
--- a/pkgs/tools/audio/vgmtools/default.nix
+++ b/pkgs/tools/audio/vgmtools/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vgmtools";
-  version = "unstable-2023-05-04";
+  version = "unstable-2023-06-29";
 
   src = fetchFromGitHub {
     owner = "vgmrips";
     repo = "vgmtools";
-    rev = "0a7814304b9664ff1cf167e209ff354d222773a4";
-    hash = "sha256-YEOuT5RN0zFT7rU4KfxYS0Ec+rUL3Flsgx9IrELnhGg=";
+    rev = "e1f3e053e390bde6bd53b81bd853a0298ccb0ab4";
+    hash = "sha256-evIvW9Nk9g7R+EmaQXLmr0ecpAS5Ashditk3komBwyw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/graphics/enblend-enfuse/default.nix b/pkgs/tools/graphics/enblend-enfuse/default.nix
index 4cf5970c5a69..2fffa3bfa9c7 100644
--- a/pkgs/tools/graphics/enblend-enfuse/default.nix
+++ b/pkgs/tools/graphics/enblend-enfuse/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchzip
+{ lib, stdenv, fetchhg
 , autoreconfHook
 , boost
 , freeglut
@@ -20,10 +20,10 @@ stdenv.mkDerivation rec {
   pname = "enblend-enfuse";
   version = "unstable-2022-03-06";
 
-  src = fetchzip {
-    url = "https://sourceforge.net/code-snapshots/hg/e/en/enblend/code/enblend-code-0f423c72e51872698fe2985ca3bd453961ffe4e0.zip";
+  src = fetchhg {
+    url = "http://hg.code.sf.net/p/enblend/code";
+    rev = "0f423c72e51872698fe2985ca3bd453961ffe4e0";
     sha256 = "sha256-0gCUSdg3HR3YeIbOByEBCZh2zGlYur6DeCOzUM53fdc=";
-    stripRoot = true;
   };
 
   buildInputs = [ boost freeglut glew gsl lcms2 libpng libtiff libGLU libGL vigra ];
diff --git a/pkgs/tools/misc/flowgger/default.nix b/pkgs/tools/misc/flowgger/default.nix
new file mode 100644
index 000000000000..a57398ae660b
--- /dev/null
+++ b/pkgs/tools/misc/flowgger/default.nix
@@ -0,0 +1,42 @@
+{ lib
+, rustPlatform
+, stdenv
+, fetchCrate
+, pkg-config
+, openssl
+, capnproto
+, CoreServices
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "flowgger";
+  version = "0.3.1";
+
+  src = fetchCrate {
+    inherit pname version;
+    hash = "sha256-PRlcfSVfQWt+rQEJjblY7/AMrjhGYO2/G7EX60aGApA=";
+  };
+
+  cargoHash = "sha256-hp2LrEVWo0gk95dPROqVcHEEG5N9fWms0mZkY9QILg0=";
+
+  nativeBuildInputs = [
+    pkg-config
+    capnproto
+  ];
+
+  buildInputs = [ openssl ]
+    ++ lib.optional stdenv.isDarwin CoreServices;
+
+  checkFlags = [
+    # test failed
+    "--skip=flowgger::encoder::ltsv_encoder::test_ltsv_full_encode_multiple_sd"
+    "--skip=flowgger::encoder::ltsv_encoder::test_ltsv_full_encode_no_sd"
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/awslabs/flowgger";
+    description = "A fast, simple and lightweight data collector written in Rust";
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ earthengine ];
+  };
+}
diff --git a/pkgs/tools/misc/parquet-tools/default.nix b/pkgs/tools/misc/parquet-tools/default.nix
index 38a71dd02a13..10247064cd97 100644
--- a/pkgs/tools/misc/parquet-tools/default.nix
+++ b/pkgs/tools/misc/parquet-tools/default.nix
@@ -56,6 +56,8 @@ buildPythonApplication rec {
     # These tests try to read Python code as parquet and fail
     "test_local_wildcard"
     "test_local_and_s3_wildcard_files"
+    # test file is 2 bytes bigger than expected
+    "test_excute_simple"
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/tools/misc/rustypaste-cli/default.nix b/pkgs/tools/misc/rustypaste-cli/default.nix
index e82465afcd47..dc0c03fdc819 100644
--- a/pkgs/tools/misc/rustypaste-cli/default.nix
+++ b/pkgs/tools/misc/rustypaste-cli/default.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rustypaste-cli";
-  version = "0.4.0";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "orhun";
     repo = "rustypaste-cli";
     rev = "v${version}";
-    hash = "sha256-Jl7fytDIW6MLY6VX7rDuX9PcZaIqENQbUTMUJKCa8Mg=";
+    hash = "sha256-lMXd/wllk/67W3dJr/ps36s/p+tMCyu2HU9gWYubejw=";
   };
 
-  cargoHash = "sha256-hICwrgzNpyYmNW1gEKgTsSjWyqCaOHc4X37O0R2oSzY=";
+  cargoHash = "sha256-6ddjSP072+jYjPVcTZcQndM1pElUE30hU3M/sf5Lnsk=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
     darwin.apple_sdk.frameworks.Security
diff --git a/pkgs/tools/misc/tailer/default.nix b/pkgs/tools/misc/tailer/default.nix
index 7f39dfd5815f..f3c4d3545252 100644
--- a/pkgs/tools/misc/tailer/default.nix
+++ b/pkgs/tools/misc/tailer/default.nix
@@ -1,22 +1,34 @@
 { lib
 , buildGoModule
 , fetchFromGitHub
+, testers
+, tailer
 }:
 
-buildGoModule {
+buildGoModule rec {
   pname = "tailer";
-  version = "unstable-2023-06-26";
+  version = "0.1.1";
 
   src = fetchFromGitHub {
     owner = "hionay";
     repo = "tailer";
-    rev = "2f32e2640a220c990ae419d1562889971c9ed535";
-    hash = "sha256-L+5HlUv6g2o6ghqp8URfR7k5NlWqFhVBmEIsEjGy7aU=";
+    rev = "v${version}";
+    hash = "sha256-gPezz2ksqdCffgdAHwU2NMTar2glp5YGfA5C+tMYPtE=";
   };
 
   vendorHash = "sha256-nQqSvfN+ed/g5VkbD6XhZNA1G3CGGfwFDdadJ5+WoD0=";
 
-  ldflags = [ "-s" "-w" ];
+  ldflags = [
+    "-s"
+    "-w"
+    "-X=main.version=${version}"
+  ];
+
+  passthru.tests = {
+    version = testers.testVersion {
+      package = tailer;
+    };
+  };
 
   meta = with lib; {
     description = "A CLI tool to insert lines when command output stops";
diff --git a/pkgs/tools/networking/aardvark-dns/default.nix b/pkgs/tools/networking/aardvark-dns/default.nix
index 3689a4fb127f..106fac53d682 100644
--- a/pkgs/tools/networking/aardvark-dns/default.nix
+++ b/pkgs/tools/networking/aardvark-dns/default.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "aardvark-dns";
-  version = "1.6.0";
+  version = "1.7.0";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-l240kejJjv3rVb4S9ngXo88kmByuS/Co3AB/SSv+iIA=";
+    hash = "sha256-bScL8hFV/Kot7P9nJRMDDhB8pllPUsejtJpbjmQ8skI=";
   };
 
-  cargoHash = "sha256-d3u/He8+Ei+tX37EgYTGW5gjcalawlTdPekV9iLK7XI=";
+  cargoHash = "sha256-rrn+ZTAsFs7UTP4xQL3Cy8G6RG7vwT0wMKnXHHIkB90=";
 
   passthru.tests = { inherit (nixosTests) podman; };
 
diff --git a/pkgs/tools/networking/ghz/default.nix b/pkgs/tools/networking/ghz/default.nix
index bebc2626652a..495d9dd3a1f3 100644
--- a/pkgs/tools/networking/ghz/default.nix
+++ b/pkgs/tools/networking/ghz/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "ghz";
-  version = "0.115.0";
+  version = "0.117.0";
 
   src = fetchFromGitHub {
     owner = "bojand";
     repo = "ghz";
     rev = "v${version}";
-    sha256 = "sha256-Y/RvXBE2+ztAPJrSBek1APkN7F3LIWAz13TGQUgFzR0=";
+    sha256 = "sha256-aAqbSPcz7qQID4H0Vu3VTnbECvlj+We9K5F656k9jTw=";
   };
 
-  vendorHash = "sha256-BTfdKH2FBfIeHOG4dhOopoPQWHjhlJstQWWOkMwEOGs=";
+  vendorHash = "sha256-jtzCOF5TAHv3PiGxBx65IR/3x6JpqMzsWW8amab8hqQ=";
 
   subPackages = [ "cmd/ghz" "cmd/ghz-web" ];
 
diff --git a/pkgs/tools/networking/gvproxy/default.nix b/pkgs/tools/networking/gvproxy/default.nix
index 0a8ec3d44bc0..4c6e69c600b4 100644
--- a/pkgs/tools/networking/gvproxy/default.nix
+++ b/pkgs/tools/networking/gvproxy/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "gvproxy";
-  version = "0.6.1";
+  version = "0.6.2";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "gvisor-tap-vsock";
     rev = "v${version}";
-    hash = "sha256-LkSKJVnWwqWSId/qdb7hTIiryxdazjW4oluZZN47orQ=";
+    hash = "sha256-3WBL+ByYSiYKXzFkeoUnCxTdhvy3XxLKUHgJ2hO6oIo=";
   };
 
   vendorHash = null;
diff --git a/pkgs/tools/networking/netavark/default.nix b/pkgs/tools/networking/netavark/default.nix
index c205f4d35eb2..f1a0aafe0f2c 100644
--- a/pkgs/tools/networking/netavark/default.nix
+++ b/pkgs/tools/networking/netavark/default.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "netavark";
-  version = "1.6.0";
+  version = "1.7.0";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-USGmYLBv2ynnLx5jg+WkRle0AMtO7dDgf41VIepoHN0=";
+    hash = "sha256-amvy8sR2gpTYU7wcfkFeYyaTvrhZC558zidNdHwxqaI=";
   };
 
-  cargoHash = "sha256-zj1eE7f4/wSVe+78abMePqsIrCPl6Uhtavn8hq7+ZRY=";
+  cargoHash = "sha256-v8djyU+MvBmg929oFVPZlRPtj7zK8eZg3/KmCsFNWpw=";
 
   nativeBuildInputs = [ installShellFiles mandown protobuf ];
 
diff --git a/pkgs/tools/security/arti/default.nix b/pkgs/tools/security/arti/default.nix
index f7945cdedd3d..e0b553a8e441 100644
--- a/pkgs/tools/security/arti/default.nix
+++ b/pkgs/tools/security/arti/default.nix
@@ -10,7 +10,7 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "arti";
-  version = "1.1.5";
+  version = "1.1.6";
 
   src = fetchFromGitLab {
     domain = "gitlab.torproject.org";
@@ -18,10 +18,10 @@ rustPlatform.buildRustPackage rec {
     owner = "core";
     repo = "arti";
     rev = "arti-v${version}";
-    sha256 = "sha256-FrawcoE+cUhRq9NPpSspUuk0ZPjnJcmDHD25syV/18E=";
+    sha256 = "sha256-6VmpBt1KxWRdZJLVPNeqETQnZITGoX+rz29eIiOnHnU=";
   };
 
-  cargoHash = "sha256-34qNdizJ89fo/6AQXuB8FqvYSv/Zy5N+gXX9Yl5sywM=";
+  cargoHash = "sha256-Q/1zgfF1v3D5Mg+JhS0K9mF4BN9xHV2tf7AtsBHZGh0=";
 
   nativeBuildInputs = lib.optionals stdenv.isLinux [ pkg-config ];
 
diff --git a/pkgs/tools/security/pentestgpt/default.nix b/pkgs/tools/security/pentestgpt/default.nix
new file mode 100644
index 000000000000..328ba0ca9a8f
--- /dev/null
+++ b/pkgs/tools/security/pentestgpt/default.nix
@@ -0,0 +1,57 @@
+{ lib
+, fetchFromGitHub
+, python3
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "pentestgpt";
+  version = "unstable-2023-06-27";
+  format = "setuptools";
+
+  src = fetchFromGitHub {
+    owner = "GreyDGL";
+    repo = "PentestGPT";
+    rev = "e63a91f466a035e036827e8f492bc47c5c1135af";
+    hash = "sha256-m0R/kMmbr5Ixuqvw6ZRoaAGCnI3j86Iwk4+TYqv0WbU=";
+  };
+
+  postPatch = ''
+    substituteInPlace requirements.txt \
+      --replace "playwright==1.28.0" "playwright" \
+      --replace "beautifulsoup4~=4.11.2" "" \
+      --replace "black" "" \
+      --replace "pytest" ""
+  '';
+
+  propagatedBuildInputs = with python3.pkgs; [
+    beautifulsoup4
+    colorama
+    google
+    langchain
+    loguru
+    openai
+    playwright
+    prompt-toolkit
+    pycookiecheat
+    pyyaml
+    requests
+    rich
+    sqlmap
+    tiktoken
+  ];
+
+  # Tests require network access
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "pentestgpt"
+  ];
+
+  meta = with lib; {
+    description = "GPT-empowered penetration testing tool";
+    homepage = "https://github.com/GreyDGL/PentestGPT";
+    changelog = "https://github.com/GreyDGL/PentestGPT/releases/tag/v${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/tools/security/verifpal/default.nix b/pkgs/tools/security/verifpal/default.nix
index 821118f598c5..2c02e1249d14 100644
--- a/pkgs/tools/security/verifpal/default.nix
+++ b/pkgs/tools/security/verifpal/default.nix
@@ -6,15 +6,15 @@
 
 buildGoModule rec {
   pname = "verifpal";
-  version = "0.26.1";
+  version = "0.27.0";
 
   src = fetchgit {
     url = "https://source.symbolic.software/verifpal/verifpal.git";
     rev = "v${version}";
-    sha256 = "sha256-y07RXv2QSyUJpGuFsLJ2sGNo4YzhoCYQr3PkUj4eIOY=";
+    hash = "sha256-rihY5p6nJ1PKjI+gn3NNXy+uzeBG2UNyRYy3UjScf2Q=";
   };
 
-  vendorSha256 = "sha256-gUpgnd/xiLqRNl1bPzVp+0GM/J5GEx0VhUfo6JsX8N8=";
+  vendorHash = "sha256-XOCRwh2nEIC+GjGwqd7nhGWQD7vBMLEZZ2FNxs0NX+E=";
 
   nativeBuildInputs = [ pigeon ];
 
diff --git a/pkgs/tools/text/gtree/default.nix b/pkgs/tools/text/gtree/default.nix
index a79656f18ba6..5e67358bbe3a 100644
--- a/pkgs/tools/text/gtree/default.nix
+++ b/pkgs/tools/text/gtree/default.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "gtree";
-  version = "1.8.3";
+  version = "1.8.4";
 
   src = fetchFromGitHub {
     owner = "ddddddO";
     repo = "gtree";
     rev = "v${version}";
-    hash = "sha256-7ABfmSKHdCDR1vLsyQd5bysHk0lNsjgpDINibSpVyOc=";
+    hash = "sha256-FbJc12hr4lmz1jEsfWdLZpd9Z17HDFgLBUMw9noakqM=";
   };
 
   vendorHash = "sha256-BMfJFR4sqJNNlJ7Y3q2GlXWjMDH+DXhuFQVX5I9Czkc=";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 9357c0743388..ae6f3be59fef 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -4414,7 +4414,7 @@ with pkgs;
 
   comma = callPackage ../tools/package-management/comma { };
 
-  commitizen = python3Packages.callPackage ../applications/version-management/commitizen { };
+  commitizen = callPackage ../applications/version-management/commitizen { };
 
   common-licenses = callPackage ../data/misc/common-licenses { };
 
@@ -5037,6 +5037,10 @@ with pkgs;
 
   flitter = callPackage ../tools/misc/flitter { };
 
+  flowgger = callPackage ../tools/misc/flowgger {
+    inherit (darwin.apple_sdk.frameworks) CoreServices;
+  };
+
   frangipanni = callPackage ../tools/text/frangipanni { };
 
   frawk = callPackage ../tools/text/frawk { };
@@ -5873,6 +5877,8 @@ with pkgs;
 
   pscale = callPackage ../development/tools/pscale { };
 
+  pulsarctl = callPackage ../tools/admin/pulsarctl { };
+
   psstop = callPackage ../tools/system/psstop { };
 
   precice = callPackage ../development/libraries/precice { };
@@ -7868,6 +7874,8 @@ with pkgs;
 
   fpart = callPackage ../tools/misc/fpart { };
 
+  fpattern = callPackage ../development/libraries/fpattern { };
+
   fping = callPackage ../tools/networking/fping { };
 
   fpm = callPackage ../tools/package-management/fpm { };
@@ -11121,6 +11129,8 @@ with pkgs;
 
   owncast = callPackage ../servers/owncast { };
 
+  owntracks-recorder = callPackage ../servers/owntracks-recorder { };
+
   update-dotdee = with python3Packages; toPythonApplication update-dotdee;
 
   update-nix-fetchgit = haskell.lib.compose.justStaticExecutables haskellPackages.update-nix-fetchgit;
@@ -18020,12 +18030,14 @@ with pkgs;
   apacheAnt_1_9 = callPackage ../development/tools/build-managers/apache-ant/1.9.nix { };
   ant = apacheAnt;
 
-  apacheKafka = apacheKafka_3_3;
+  apacheKafka = apacheKafka_3_5;
   apacheKafka_2_8 = callPackage ../servers/apache-kafka { majorVersion = "2.8"; };
   apacheKafka_3_0 = callPackage ../servers/apache-kafka { majorVersion = "3.0"; };
   apacheKafka_3_1 = callPackage ../servers/apache-kafka { majorVersion = "3.1"; };
   apacheKafka_3_2 = callPackage ../servers/apache-kafka { majorVersion = "3.2"; };
   apacheKafka_3_3 = callPackage ../servers/apache-kafka { majorVersion = "3.3"; };
+  apacheKafka_3_4 = callPackage ../servers/apache-kafka { majorVersion = "3.4"; };
+  apacheKafka_3_5 = callPackage ../servers/apache-kafka { majorVersion = "3.5"; };
 
   kt = callPackage ../tools/misc/kt { };
 
@@ -19369,6 +19381,8 @@ with pkgs;
 
   procodile = callPackage ../tools/system/procodile { };
 
+  protox = callPackage ../development/tools/misc/protox { };
+
   proxmove = callPackage ../tools/admin/proxmove { };
 
   pry = callPackage ../development/tools/pry { };
@@ -33861,6 +33875,8 @@ with pkgs;
   pencil = callPackage ../applications/graphics/pencil {
   };
 
+  pentestgpt = callPackage ../tools/security/pentestgpt { };
+
   perseus = callPackage ../applications/science/math/perseus { };
 
   petrifoo = callPackage ../applications/audio/petrifoo {
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 5d4a015ff530..91e78eae47f2 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -283,6 +283,7 @@ mapAliases ({
   qasm2image = throw "qasm2image is no longer maintained (since November 2018), and is not compatible with the latest pythonPackages.qiskit versions."; # added 2020-12-09
   Quandl = quandl; # added 2023-02-19
   qiskit-aqua = throw "qiskit-aqua has been removed due to deprecation, with its functionality moved to different qiskit packages";
+  rabbitpy = throw "rabbitpy has been removed, since it is unmaintained and broken"; # added 2023-07-01
   rdflib-jsonld = throw "rdflib-jsonld is not compatible with rdflib 6"; # added 2021-11-05
   retworkx = rustworkx; # added 2023-05-14
   repeated_test = repeated-test; # added 2022-11-15
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 4c96209231f2..539eb0a8c959 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1637,8 +1637,12 @@ self: super: with self; {
 
   callee = callPackage ../development/python-modules/callee { };
 
+  calmjs = callPackage ../development/python-modules/calmjs { };
+
   calmjs-parse = callPackage ../development/python-modules/calmjs-parse { };
 
+  calmjs-types = callPackage ../development/python-modules/calmjs-types { };
+
   calysto = callPackage ../development/python-modules/calysto { };
 
   calysto-scheme = callPackage ../development/python-modules/calysto-scheme { };
@@ -2875,6 +2879,8 @@ self: super: with self; {
 
   django-reversion = callPackage ../development/python-modules/django-reversion { };
 
+  django-sekizai = callPackage ../development/python-modules/django-sekizai { };
+
   django-sesame = callPackage ../development/python-modules/django-sesame { };
 
   django_silk = callPackage ../development/python-modules/django_silk { };
@@ -4191,6 +4197,8 @@ self: super: with self; {
 
   goodwe = callPackage ../development/python-modules/goodwe { };
 
+  google = callPackage ../development/python-modules/google { };
+
   google-ai-generativelanguage = callPackage ../development/python-modules/google-ai-generativelanguage { };
 
   google-api-core = callPackage ../development/python-modules/google-api-core { };
@@ -7797,6 +7805,8 @@ self: super: with self; {
 
   pycontrol4 = callPackage ../development/python-modules/pycontrol4 { };
 
+  pycookiecheat = callPackage ../development/python-modules/pycookiecheat { };
+
   pycoolmasternet-async = callPackage ../development/python-modules/pycoolmasternet-async { };
 
   pyfibaro = callPackage ../development/python-modules/pyfibaro { };
@@ -10500,8 +10510,6 @@ self: super: with self; {
 
   r2pipe = callPackage ../development/python-modules/r2pipe { };
 
-  rabbitpy = callPackage ../development/python-modules/rabbitpy { };
-
   rachiopy = callPackage ../development/python-modules/rachiopy { };
 
   radicale_infcloud = callPackage ../development/python-modules/radicale_infcloud {