diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 2aec66efa9be..4b4f462a5cd5 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -12402,6 +12402,12 @@
     githubId = 61306;
     name = "Rene Treffer";
   };
+  rumpelsepp = {
+    name = "Stefan Tatschner";
+    email = "stefan@rumpelsepp.org";
+    github = "rumpelsepp";
+    githubId = 1961699;
+  };
   rushmorem = {
     email = "rushmore@webenchanter.com";
     github = "rushmorem";
diff --git a/nixos/modules/services/misc/octoprint.nix b/nixos/modules/services/misc/octoprint.nix
index c216c6fa2b77..43e0ce0c21d3 100644
--- a/nixos/modules/services/misc/octoprint.nix
+++ b/nixos/modules/services/misc/octoprint.nix
@@ -106,6 +106,9 @@ in
 
     systemd.tmpfiles.rules = [
       "d '${cfg.stateDir}' - ${cfg.user} ${cfg.group} - -"
+      # this will allow octoprint access to raspberry specific hardware to check for throttling
+      # read-only will not work: "VCHI initialization failed" error
+      "a /dev/vchiq - - - - u:octoprint:rw"
     ];
 
     systemd.services.octoprint = {
diff --git a/pkgs/applications/misc/octoprint/default.nix b/pkgs/applications/misc/octoprint/default.nix
index 4b445c6b3083..12d0a5e38fe6 100644
--- a/pkgs/applications/misc/octoprint/default.nix
+++ b/pkgs/applications/misc/octoprint/default.nix
@@ -82,6 +82,10 @@ let
 
               # requires octoprint itself during tests
               doCheck = false;
+              postPatch = ''
+                substituteInPlace octoprint_pi_support/__init__.py \
+                  --replace /usr/bin/vcgencmd ${self.pkgs.libraspberrypi}/bin/vcgencmd
+              '';
             };
           }
         )
diff --git a/pkgs/applications/misc/pure-maps/default.nix b/pkgs/applications/misc/pure-maps/default.nix
index 793e5291d5b5..0220778277c1 100644
--- a/pkgs/applications/misc/pure-maps/default.nix
+++ b/pkgs/applications/misc/pure-maps/default.nix
@@ -6,13 +6,13 @@
 
 mkDerivation rec {
   pname = "pure-maps";
-  version = "3.1.1";
+  version = "3.2.0";
 
   src = fetchFromGitHub {
     owner = "rinigus";
     repo = "pure-maps";
     rev = version;
-    hash = "sha256-ZPW2hNnaRfv5aTXqku7hPShN0leOuVEJ3T/OOTzwgXQ=";
+    hash = "sha256-07Jk5ufYbBAa/UY1B0IoyuOAVt15rGCxCRXu3OeYyWU=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/networking/feedreaders/rssguard/default.nix b/pkgs/applications/networking/feedreaders/rssguard/default.nix
index a5debadc8005..f1225f87eefb 100644
--- a/pkgs/applications/networking/feedreaders/rssguard/default.nix
+++ b/pkgs/applications/networking/feedreaders/rssguard/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "rssguard";
-  version = "4.2.7";
+  version = "4.3.1";
 
   src = fetchFromGitHub {
     owner = "martinrotter";
     repo = pname;
     rev = version;
-    sha256 = "sha256-X5hZspl9IekhC8XXpZS285cmVZek2oxIV3tYOz/ZBec=";
+    sha256 = "sha256-hfUtxPGPhPC2VgGLLIaYHlEMpXHAPZ5fkLL0glhyQcY=";
   };
 
   buildInputs =  [ qtwebengine qttools ];
diff --git a/pkgs/applications/networking/gdrive/default.nix b/pkgs/applications/networking/gdrive/default.nix
index b62bda3c469f..20ef4e682c7e 100644
--- a/pkgs/applications/networking/gdrive/default.nix
+++ b/pkgs/applications/networking/gdrive/default.nix
@@ -1,24 +1,34 @@
-{ lib, buildGoPackage, fetchFromGitHub }:
+{ lib, buildGoModule, fetchFromGitHub, fetchpatch }:
 
-buildGoPackage rec {
+buildGoModule rec {
   pname = "gdrive";
-  version = "2.1.0";
-  rev     = version;
-
-  goPackagePath = "github.com/prasmussen/gdrive";
+  version = "2.1.1";
 
   src = fetchFromGitHub {
-    owner  = "prasmussen";
-    repo   = "gdrive";
-    sha256 = "0ywm4gdmrqzb1a99vg66a641r74p7lglavcpgkm6cc2gdwzjjfg7";
-    inherit rev;
+    owner = "prasmussen";
+    repo = "gdrive";
+    rev = version;
+    hash = "sha256-2dJmGFHfGSroucn4WgiV2NExBs5wtMDe2kX1jDBwbRs=";
   };
 
+  deleteVendor = true;
+  vendorHash = "sha256-sHNP1YwnZYu0UfgLx5+gxJmesY8Brt7rr9cptlyk9Bk=";
+
+  patches = [
+    # Add Go Modules support
+    (fetchpatch {
+      url = "https://github.com/prasmussen/gdrive/pull/585/commits/faa6fc3dc104236900caa75eb22e9ed2e5ecad42.patch";
+      hash = "sha256-W8o2ZfhQFJISHfPavjx9sw5UB6xOZ7qRW4L0bHNddS8=";
+    })
+  ];
+
+  ldflags = [ "-s" "-w" ];
+
   meta = with lib; {
-    homepage    = "https://github.com/prasmussen/gdrive";
+    homepage = "https://github.com/prasmussen/gdrive";
     description = "A command line utility for interacting with Google Drive";
-    platforms   = platforms.unix;
-    license     = licenses.mit;
+    license = licenses.mit;
+    platforms = platforms.unix;
     maintainers = [ maintainers.rzetterberg ];
   };
 }
diff --git a/pkgs/applications/networking/instant-messengers/deltachat-desktop/default.nix b/pkgs/applications/networking/instant-messengers/deltachat-desktop/default.nix
index bd3d75bd66bb..805aadfc40a9 100644
--- a/pkgs/applications/networking/instant-messengers/deltachat-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/deltachat-desktop/default.nix
@@ -1,7 +1,7 @@
 { lib
 , buildNpmPackage
 , copyDesktopItems
-, electron_18
+, electron_22
 , buildGoModule
 , esbuild
 , fetchFromGitHub
@@ -57,7 +57,15 @@ in buildNpmPackage rec {
     hash = "sha256-XOGfKa0eGVZKKKC0Pm2kw48XWWcrxCyDdYzCSKp+wco=";
   };
 
-  npmDepsHash = "sha256-ZMXXBDVT5rHTzHOrKAUAezL/1UTMdzbBllG69kxg55M=";
+  patches = [
+    (fetchpatch {
+      name = "bump-electron-to-22.1.0.patch";
+      url = "https://github.com/deltachat/deltachat-desktop/commit/944d2735cda6cd5a95cb83c57484fbaf16720a9c.patch";
+      hash = "sha256-kaKi32eFQ3hGLZLjiXmH9qs4GXezcDQ7zTdT2+D8NcQ=";
+    })
+  ];
+
+  npmDepsHash = "sha256-J3/S/jYQvO/U8StDtYI+jozon0d4VCdeqFX6x1hHzMo=";
 
   nativeBuildInputs = [
     makeWrapper
@@ -105,7 +113,7 @@ in buildNpmPackage rec {
         $out/lib/node_modules/deltachat-desktop/html-dist/fonts
     done
 
-    makeWrapper ${electron_18}/bin/electron $out/bin/deltachat \
+    makeWrapper ${electron_22}/bin/electron $out/bin/deltachat \
       --set LD_PRELOAD ${sqlcipher}/lib/libsqlcipher${stdenv.hostPlatform.extensions.sharedLibrary} \
       --add-flags $out/lib/node_modules/deltachat-desktop
 
diff --git a/pkgs/applications/science/electronics/kicad/default.nix b/pkgs/applications/science/electronics/kicad/default.nix
index dcc13cf99cc6..9765d2fcc1e4 100644
--- a/pkgs/applications/science/electronics/kicad/default.nix
+++ b/pkgs/applications/science/electronics/kicad/default.nix
@@ -15,7 +15,7 @@
 , pname ? "kicad"
 , stable ? true
 , withOCC ? true
-, withNgspice ? true
+, withNgspice ? !stdenv.isDarwin
 , libngspice
 , withScripting ? true
 , python3
@@ -170,6 +170,7 @@ stdenv.mkDerivation rec {
   # $out and $program_PYTHONPATH don't exist when makeWrapperArgs gets set?
   installPhase =
     let
+      bin = if stdenv.isDarwin then "*.app/Contents/MacOS" else "bin";
       tools = [ "kicad" "pcbnew" "eeschema" "gerbview" "pcb_calculator" "pl_editor" "bitmap2component" ];
       utils = [ "dxf2idf" "idf2vrml" "idfcyl" "idfrect" "kicad2step" ];
     in
@@ -181,13 +182,13 @@ stdenv.mkDerivation rec {
 
         # wrap each of the directly usable tools
         (map
-          (tool: "makeWrapper ${base}/bin/${tool} $out/bin/${tool} $makeWrapperArgs"
+          (tool: "makeWrapper ${base}/${bin}/${tool} $out/bin/${tool} $makeWrapperArgs"
             + optionalString (withScripting) " --set PYTHONPATH \"$program_PYTHONPATH\""
           )
           tools)
 
         # link in the CLI utils
-        (map (util: "ln -s ${base}/bin/${util} $out/bin/${util}") utils)
+        (map (util: "ln -s ${base}/${bin}/${util} $out/bin/${util}") utils)
 
         "runHook postInstall"
       ])
diff --git a/pkgs/applications/version-management/git-chglog/default.nix b/pkgs/applications/version-management/git-chglog/default.nix
index b427acf960ec..6259bad88063 100644
--- a/pkgs/applications/version-management/git-chglog/default.nix
+++ b/pkgs/applications/version-management/git-chglog/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "git-chglog";
-  version = "0.15.1";
+  version = "0.15.2";
 
   src = fetchFromGitHub {
     owner = "git-chglog";
     repo = "git-chglog";
     rev = "v${version}";
-    sha256 = "sha256-UlhJ004ceXpdB/9296cL2sbBYsjV8D+3YS1vmFgnko8=";
+    sha256 = "sha256-VB3JYXz50B/SkA/q1iET7p5uhArrF8JyhAWhcxLVsg8=";
   };
 
-  vendorSha256 = "sha256-FLFPcmkrhZ+/UX1xpexsDv3cgC/Ocj4qTFJOX+rmdyQ=";
+  vendorHash = "sha256-/5s9Dvce0JWu8DaUlrtnkN6N5esEmkFvOgq0tVLZGnM=";
 
   ldflags = [ "-s" "-w" "-X=main.Version=v${version}" ];
 
diff --git a/pkgs/applications/virtualization/containerd/default.nix b/pkgs/applications/virtualization/containerd/default.nix
index 40a1e671cc56..d95b37ef1d30 100644
--- a/pkgs/applications/virtualization/containerd/default.nix
+++ b/pkgs/applications/virtualization/containerd/default.nix
@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "containerd";
-  version = "1.6.15";
+  version = "1.6.16";
 
   src = fetchFromGitHub {
     owner = "containerd";
     repo = "containerd";
     rev = "v${version}";
-    sha256 = "sha256-Vlftq//mLYZPoT2R/lHJA6wLnqiuC+Cpy4lGQC8jCPA=";
+    hash = "sha256-p2I188MGoxnd7dBAMQ0bM5+GT8z3y9S4cZW2Q99DyzY=";
   };
 
-  vendorSha256 = null;
+  vendorHash = null;
 
   nativeBuildInputs = [ go-md2man installShellFiles util-linux ];
 
diff --git a/pkgs/applications/window-managers/pekwm/default.nix b/pkgs/applications/window-managers/pekwm/default.nix
index 6f1a37f9379a..2ec46e42cbf3 100644
--- a/pkgs/applications/window-managers/pekwm/default.nix
+++ b/pkgs/applications/window-managers/pekwm/default.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pekwm";
-  version = "0.2.1";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "pekdon";
     repo = "pekwm";
     rev = "release-${version}";
-    hash= "sha256-voHPstdcd4CHnAdD3PMxca0A6MyMYJi8Ik0UlFB0vG0=";
+    hash= "sha256-hA+TBAs9NMcc5DKIkzyUHWck3Xht+yeCO54xJ6oXXuQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/data/fonts/lxgw-neoxihei/default.nix b/pkgs/data/fonts/lxgw-neoxihei/default.nix
new file mode 100644
index 000000000000..9d05689657e0
--- /dev/null
+++ b/pkgs/data/fonts/lxgw-neoxihei/default.nix
@@ -0,0 +1,32 @@
+{ lib
+, fetchurl
+, stdenvNoCC
+}:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "lxgw-neoxihei";
+  version = "1.005";
+
+  src = fetchurl {
+    url = "https://github.com/lxgw/LxgwNeoXiHei/releases/download/v${version}/LXGWNeoXiHei.ttf";
+    hash = "sha256-IvbbeBjpFz9zHt3mHu5vY8sLETKnvOMv7eHjANQ2GlA=";
+  };
+
+  dontUnpack = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm644 $src $out/share/fonts/truetype/LXGWNeoXiHei.ttf
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "A Simplified Chinese sans-serif font derived from IPAex Gothic";
+    homepage = "https://github.com/lxgw/LxgwNeoXiHei";
+    license = licenses.ipa;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ zendo ];
+  };
+}
diff --git a/pkgs/desktops/pantheon/apps/appcenter/default.nix b/pkgs/desktops/pantheon/apps/appcenter/default.nix
index 4fb9768ef7ee..4d3c09a9f204 100644
--- a/pkgs/desktops/pantheon/apps/appcenter/default.nix
+++ b/pkgs/desktops/pantheon/apps/appcenter/default.nix
@@ -25,13 +25,13 @@
 
 stdenv.mkDerivation rec {
   pname = "appcenter";
-  version = "7.0.0";
+  version = "7.1.0";
 
   src = fetchFromGitHub {
     owner = "elementary";
     repo = pname;
     rev = version;
-    sha256 = "sha256-fRurEkatWbtGiTRNe6tA2NyYk1IRCBW8SKBSUm4FrO4=";
+    sha256 = "sha256-ToRY27qB/cNKjKW22MTEojxxOXMBfO1LUusy/pXKJ9A=";
   };
 
   patches = [
diff --git a/pkgs/development/interpreters/nelua/default.nix b/pkgs/development/interpreters/nelua/default.nix
index 85a980958da3..8030980b7788 100644
--- a/pkgs/development/interpreters/nelua/default.nix
+++ b/pkgs/development/interpreters/nelua/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation {
   pname = "nelua";
-  version = "unstable-2022-11-20";
+  version = "unstable-2023-01-21";
 
   src = fetchFromGitHub {
     owner = "edubart";
     repo = "nelua-lang";
-    rev = "63909dc834708a5bd7c21d65a6633880f40295db";
-    hash = "sha256-GeknXYsdRUzihzF3qHcCgbcB3w8geiWe5O1Az+4UqMs=";
+    rev = "d10cc61bc54050b07874a8597f8df20534885105";
+    hash = "sha256-HyNYqhPCQVBJqEcAUUXfvycXE8tWIMIUJJMTIV48ne8=";
   };
 
   makeFlags = [ "PREFIX=$(out)" ];
diff --git a/pkgs/development/libraries/composable_kernel/default.nix b/pkgs/development/libraries/composable_kernel/default.nix
index 9ced4e0a44d5..8b0ac955810e 100644
--- a/pkgs/development/libraries/composable_kernel/default.nix
+++ b/pkgs/development/libraries/composable_kernel/default.nix
@@ -28,8 +28,7 @@ let
       "example"
     ];
 
-    # There is now a release, but it's cpu-only it seems to be for a very specific purpose
-    # Thus, we're sticking with the develop branch for now...
+    # ROCm 5.6 should release composable_kernel as stable with a tag in the future
     src = fetchFromGitHub {
       owner = "ROCmSoftwarePlatform";
       repo = "composable_kernel";
@@ -53,6 +52,7 @@ let
       "-DCMAKE_CXX_COMPILER=hipcc"
     ] ++ lib.optionals (gpuTargets != [ ]) [
       "-DGPU_TARGETS=${lib.concatStringsSep ";" gpuTargets}"
+      "-DAMDGPU_TARGETS=${lib.concatStringsSep ";" gpuTargets}"
     ] ++ lib.optionals buildTests [
       "-DGOOGLETEST_DIR=${gtest.src}" # Custom linker names
     ];
@@ -82,7 +82,6 @@ let
       license = with licenses; [ mit ];
       maintainers = teams.rocm.members;
       platforms = platforms.linux;
-      broken = buildExamples; # bin/example_grouped_gemm_xdl_bfp16] Error 139
     };
   });
 
@@ -93,6 +92,7 @@ in stdenv.mkDerivation {
   inherit (ck) pname version outputs src passthru meta;
 
   dontUnpack = true;
+  dontPatch = true;
   dontConfigure = true;
   dontBuild = true;
 
@@ -109,4 +109,10 @@ in stdenv.mkDerivation {
   '' + ''
     runHook postInstall
   '';
+
+  # Fix paths
+  preFixup = ''
+    substituteInPlace $out/lib/cmake/composable_kernel/*.cmake \
+      --replace "${ck}" "$out"
+  '';
 }
diff --git a/pkgs/development/libraries/discord-gamesdk/default.nix b/pkgs/development/libraries/discord-gamesdk/default.nix
new file mode 100644
index 000000000000..513eebe7124f
--- /dev/null
+++ b/pkgs/development/libraries/discord-gamesdk/default.nix
@@ -0,0 +1,41 @@
+{ lib
+, stdenv
+, fetchzip
+, autoPatchelfHook
+}:
+
+stdenv.mkDerivation rec {
+  pname = "discord-gamesdk";
+  version = "3.2.1";
+
+  src = fetchzip {
+    url = "https://dl-game-sdk.discordapp.net/${version}/discord_game_sdk.zip";
+    sha256 = "sha256-83DgL9y3lHLLJ8vgL3EOVk2Tjcue64N+iuDj/UpSdLc=";
+    stripRoot = false;
+  };
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+  ];
+
+  installPhase =
+    let
+      processor = stdenv.hostPlatform.uname.processor;
+      sharedLibrary = stdenv.hostPlatform.extensions.sharedLibrary;
+    in
+    ''
+      runHook preInstall
+
+      install -Dm555 lib/${processor}/discord_game_sdk${sharedLibrary} $out/lib/discord_game_sdk${sharedLibrary}
+
+      runHook postInstall
+    '';
+
+  meta = with lib; {
+    homepage = "https://discord.com/developers/docs/game-sdk/sdk-starter-guide";
+    description = "Library to allow other programs to interact with the Discord desktop application";
+    license = licenses.unfree;
+    maintainers = with maintainers; [ tomodachi94 ];
+    platforms = [ "x86_64-linux" "x86_64-darwin" "aarch64-darwin" "x86_64-windows" ];
+  };
+}
diff --git a/pkgs/development/libraries/libvirt-glib/default.nix b/pkgs/development/libraries/libvirt-glib/default.nix
index 8f84cd0eab80..566a1c1b83fa 100644
--- a/pkgs/development/libraries/libvirt-glib/default.nix
+++ b/pkgs/development/libraries/libvirt-glib/default.nix
@@ -5,21 +5,23 @@
 , meson
 , ninja
 , pkg-config
-, gobject-introspection
 , gettext
-, gtk-doc
-, docbook-xsl-nons
 , vala
 , libcap_ng
 , libvirt
 , libxml2
+, withIntrospection ? stdenv.hostPlatform == stdenv.buildPlatform
+, gobject-introspection
+, withDocs ? stdenv.hostPlatform == stdenv.buildPlatform
+, gtk-doc
+, docbook-xsl-nons
 }:
 
 stdenv.mkDerivation rec {
   pname = "libvirt-glib";
   version = "4.0.0";
 
-  outputs = [ "out" "dev" "devdoc" ];
+  outputs = [ "out" "dev" ] ++ lib.optional withDocs "devdoc";
 
   src = fetchurl {
     url = "https://libvirt.org/sources/glib/${pname}-${version}.tar.xz";
@@ -39,22 +41,35 @@ stdenv.mkDerivation rec {
     ninja
     pkg-config
     gettext
-    gtk-doc
-    docbook-xsl-nons
     vala
     gobject-introspection
+  ] ++ lib.optionals withIntrospection [
+    gobject-introspection
+  ] ++ lib.optionals withDocs [
+    gtk-doc
+    docbook-xsl-nons
   ];
 
-  buildInputs = (lib.optionals stdenv.isLinux [
-    libcap_ng
-  ]) ++ [
+  buildInputs = [
     libvirt
     libxml2
+  ] ++ lib.optionals stdenv.isLinux [
+    libcap_ng
+  ] ++ lib.optionals withIntrospection [
     gobject-introspection
   ];
 
   strictDeps = true;
 
+  # The build system won't let us build with docs or introspection
+  # unless we're building natively, but will still do a mandatory
+  # check for the dependencies for those things unless we explicitly
+  # disable the options.
+  mesonFlags = [
+    (lib.mesonEnable "docs" withDocs)
+    (lib.mesonEnable "introspection" withIntrospection)
+  ];
+
   # https://gitlab.com/libvirt/libvirt-glib/-/issues/4
   NIX_CFLAGS_COMPILE = [ "-Wno-error=pointer-sign" ];
 
diff --git a/pkgs/development/libraries/rapidjson/default.nix b/pkgs/development/libraries/rapidjson/default.nix
index 9d8db78e0215..b67824b5cc55 100644
--- a/pkgs/development/libraries/rapidjson/default.nix
+++ b/pkgs/development/libraries/rapidjson/default.nix
@@ -43,7 +43,7 @@ stdenv.mkDerivation rec {
   cmakeFlags = [ "-DGTEST_SOURCE_DIR=${gtest.dev}/include" ];
 
   nativeCheckInputs = [ valgrind ];
-  doCheck = !stdenv.hostPlatform.isStatic;
+  doCheck = !stdenv.hostPlatform.isStatic && !stdenv.isDarwin;
 
   meta = with lib; {
     description = "Fast JSON parser/generator for C++ with both SAX/DOM style API";
diff --git a/pkgs/development/libraries/rocfft/default.nix b/pkgs/development/libraries/rocfft/default.nix
index 375e6a7b432e..39d714ce84e8 100644
--- a/pkgs/development/libraries/rocfft/default.nix
+++ b/pkgs/development/libraries/rocfft/default.nix
@@ -135,6 +135,7 @@ in stdenv.mkDerivation {
   inherit (rocfft) pname version outputs src passthru meta;
 
   dontUnpack = true;
+  dontPatch = true;
   dontConfigure = true;
   dontBuild = true;
 
@@ -155,4 +156,22 @@ in stdenv.mkDerivation {
   '' + ''
     runHook postInstall
   '';
+
+  # Fix paths
+  preFixup = ''
+    substituteInPlace $out/include/*.h $out/rocfft/include/*.h \
+      --replace "${rocfft}" "$out"
+
+    patchelf --set-rpath \
+      $(patchelf --print-rpath $out/lib/librocfft.so | sed 's,${rocfft}/lib,'"$out/lib"',') \
+      $out/lib/librocfft.so
+  '' + lib.optionalString buildTests ''
+    patchelf --set-rpath \
+      $(patchelf --print-rpath $test/bin/rocfft-test | sed 's,${rocfft}/lib,'"$out/lib"',') \
+      $test/bin/rocfft-test
+  '' + lib.optionalString buildBenchmarks ''
+    patchelf --set-rpath \
+      $(patchelf --print-rpath $benchmark/bin/rocfft-rider | sed 's,${rocfft}/lib,'"$out/lib"',') \
+      $benchmark/bin/rocfft-rider
+  '';
 }
diff --git a/pkgs/development/libraries/wayland/default.nix b/pkgs/development/libraries/wayland/default.nix
index bb764d641436..8d229678a3c8 100644
--- a/pkgs/development/libraries/wayland/default.nix
+++ b/pkgs/development/libraries/wayland/default.nix
@@ -8,7 +8,7 @@
 , wayland-scanner
 , expat
 , libxml2
-, withLibraries ? stdenv.isLinux
+, withLibraries ? true
 , libffi
 , withDocumentation ? withLibraries && stdenv.hostPlatform == stdenv.buildPlatform
 , graphviz-nox
diff --git a/pkgs/development/ocaml-modules/ca-certs-nss/default.nix b/pkgs/development/ocaml-modules/ca-certs-nss/default.nix
index 3e5119b1739e..73f6838501a6 100644
--- a/pkgs/development/ocaml-modules/ca-certs-nss/default.nix
+++ b/pkgs/development/ocaml-modules/ca-certs-nss/default.nix
@@ -14,17 +14,16 @@
 
 buildDunePackage rec {
   pname = "ca-certs-nss";
-  version = "3.77";
+  version = "3.86";
 
-  minimumOCamlVersion = "4.08";
+  minimalOCamlVersion = "4.08";
+  duneVersion = "3";
 
   src = fetchurl {
     url = "https://github.com/mirage/ca-certs-nss/releases/download/v${version}/ca-certs-nss-${version}.tbz";
-    sha256 = "sha256-Ezos9A2AQOo43R9akVbJ5l+euTDtguzMfH63YXo9hvc=";
+    hash = "sha256-3b20vYBP9T2uR17Vxyilfs/9C72WVUrgR7T582V++lQ=";
   };
 
-  useDune2 = true;
-
   propagatedBuildInputs = [
     mirage-crypto
     mirage-clock
diff --git a/pkgs/development/ocaml-modules/x509/default.nix b/pkgs/development/ocaml-modules/x509/default.nix
index 91a478df8844..9bfe9489444c 100644
--- a/pkgs/development/ocaml-modules/x509/default.nix
+++ b/pkgs/development/ocaml-modules/x509/default.nix
@@ -10,9 +10,11 @@ buildDunePackage rec {
   pname = "x509";
   version = "0.16.2";
 
+  duneVersion = "3";
+
   src = fetchurl {
     url = "https://github.com/mirleft/ocaml-x509/releases/download/v${version}/x509-${version}.tbz";
-    sha256 = "sha256-Zf/ZZjUAkeWe04XLmqMKgbxN/qe/Z1mpKM82veXVf2I=";
+    hash = "sha256-Zf/ZZjUAkeWe04XLmqMKgbxN/qe/Z1mpKM82veXVf2I=";
   };
 
   nativeCheckInputs = [ alcotest cstruct-unix ];
diff --git a/pkgs/development/python-modules/altair/default.nix b/pkgs/development/python-modules/altair/default.nix
index 55925b8e0a92..63ee77d22163 100644
--- a/pkgs/development/python-modules/altair/default.nix
+++ b/pkgs/development/python-modules/altair/default.nix
@@ -18,12 +18,12 @@
 
 buildPythonPackage rec {
   pname = "altair";
-  version = "4.2.0";
+  version = "4.2.2";
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "d87d9372e63b48cd96b2a6415f0cf9457f50162ab79dc7a31cd7e024dd840026";
+    sha256 = "sha256-OTmaJnxJsw0QLBBBHmerJjdBVqhLGuufzRUUBCm6ScU=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/boschshcpy/default.nix b/pkgs/development/python-modules/boschshcpy/default.nix
index 4f17d17c0d52..1c614663209e 100644
--- a/pkgs/development/python-modules/boschshcpy/default.nix
+++ b/pkgs/development/python-modules/boschshcpy/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "boschshcpy";
-  version = "0.2.48";
+  version = "0.2.51";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "tschamm";
     repo = pname;
     rev = version;
-    sha256 = "sha256-EPS9kqlognIoMnpgmFl32FVT1ahyliizLzGfgE3N24Y=";
+    sha256 = "sha256-HTVs1fC+Rex3U96R66zY43Q4GnRKZlfaY4D9Lbv5aQg=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/fastparquet/default.nix b/pkgs/development/python-modules/fastparquet/default.nix
index 92bc5100256f..16e3bd7ed229 100644
--- a/pkgs/development/python-modules/fastparquet/default.nix
+++ b/pkgs/development/python-modules/fastparquet/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "fastparquet";
-  version = "2022.12.0";
+  version = "2023.1.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "dask";
     repo = pname;
     rev = version;
-    hash = "sha256-/DSe2vZwrHHTuAXWJh9M1wCes5c4/QAVUnJVEI4Evyw=";
+    hash = "sha256-p8JydnrDEl9W4clrOkd+np0NYGP3hVnq+lyyF/zaVk8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/govee-ble/default.nix b/pkgs/development/python-modules/govee-ble/default.nix
index 3e1bb1c8a7d1..233d0bbbce81 100644
--- a/pkgs/development/python-modules/govee-ble/default.nix
+++ b/pkgs/development/python-modules/govee-ble/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "govee-ble";
-  version = "0.21.1";
+  version = "0.22.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-F5BUt+A5IF010PT/OvkINrMyK8tZ+uqml3CqNWpaM0c=";
+    hash = "sha256-HAUHNxO7dfocazGhcvvcqbZot/RkAP50DrsEkocOugI=";
   };
 
   nativeBuildInputs = [
@@ -51,6 +51,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Library for Govee BLE devices";
     homepage = "https://github.com/Bluetooth-Devices/govee-ble";
+    changelog = "https://github.com/bluetooth-devices/govee-ble/blob/v${version}/CHANGELOG.md";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/graphite-web/default.nix b/pkgs/development/python-modules/graphite-web/default.nix
index 91def6f2886b..221b1cfbfae1 100644
--- a/pkgs/development/python-modules/graphite-web/default.nix
+++ b/pkgs/development/python-modules/graphite-web/default.nix
@@ -1,11 +1,14 @@
 { lib
 , stdenv
 , buildPythonPackage
+, python
 , cairocffi
 , django
 , django_tagging
-, fetchPypi
+, fetchFromGitHub
+, fetchpatch
 , gunicorn
+, mock
 , pyparsing
 , python-memcached
 , pythonOlder
@@ -14,7 +17,6 @@
 , txamqp
 , urllib3
 , whisper
-, whitenoise
 }:
 
 buildPythonPackage rec {
@@ -24,11 +26,26 @@ buildPythonPackage rec {
 
   disabled = pythonOlder "3.7";
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-Pxho1QWo2jJZYAMJx999bbELDVMr7Wp7wsssYPkc01o=";
+  src = fetchFromGitHub {
+    owner = "graphite-project";
+    repo = pname;
+    rev = version;
+    hash = "sha256-2HgCBKwLfxJLKMopoIdsEW5k/j3kNAiifWDnJ98a7Qo=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2022-4730.CVE-2022-4729.CVE-2022-4728.part-1.patch";
+      url = "https://github.com/graphite-project/graphite-web/commit/9c626006eea36a9fd785e8f811359aebc9774970.patch";
+      sha256 = "sha256-JMmdhLqsaRhUG2FsH+yPNl+cR7O2YLfKFliL2GU0aAk=";
+    })
+    (fetchpatch {
+      name = "CVE-2022-4730.CVE-2022-4729.CVE-2022-4728.part-2.patch";
+      url = "https://github.com/graphite-project/graphite-web/commit/2f178f490e10efc03cd1d27c72f64ecab224eb23.patch";
+      sha256 = "sha256-NL7K5uekf3NlLa58aFFRPJT9ktjqBeNlWC4Htd0fRQ0=";
+    })
+  ];
+
   propagatedBuildInputs = [
     cairocffi
     django
@@ -41,7 +58,6 @@ buildPythonPackage rec {
     txamqp
     urllib3
     whisper
-    whitenoise
   ];
 
   postPatch = ''
@@ -59,12 +75,28 @@ buildPythonPackage rec {
       --replace "join(WEBAPP_DIR, 'content')" "join('$out', 'webapp', 'content')"
   '';
 
+  checkInputs = [ mock ];
+  checkPhase = ''
+    runHook preCheck
+
+    pushd webapp/
+    # avoid confusion with installed module
+    rm -r graphite
+    # redis not practical in test environment
+    substituteInPlace tests/test_tags.py \
+      --replace test_redis_tagdb _dont_test_redis_tagdb
+
+    DJANGO_SETTINGS_MODULE=tests.settings ${python.interpreter} manage.py test
+    popd
+
+    runHook postCheck
+  '';
+
   pythonImportsCheck = [
     "graphite"
   ];
 
   meta = with lib; {
-    broken = (stdenv.isLinux && stdenv.isAarch64) || stdenv.isDarwin;
     description = "Enterprise scalable realtime graphing";
     homepage = "http://graphiteapp.org/";
     license = licenses.asl20;
diff --git a/pkgs/development/python-modules/identify/default.nix b/pkgs/development/python-modules/identify/default.nix
index 00b6e6ba9aba..c0db14ca1fdd 100644
--- a/pkgs/development/python-modules/identify/default.nix
+++ b/pkgs/development/python-modules/identify/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "identify";
-  version = "2.5.15";
+  version = "2.5.16";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "pre-commit";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-5M51eWdER9/K15H2yUQjvXMjzYNwx9BLIKSW/ToDU5g=";
+    sha256 = "sha256-4A+3O3z2bdJ/bUcIy9H8HTxaARxWJ7uDM4gD+dRFLtE=";
   };
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/prayer-times-calculator/default.nix b/pkgs/development/python-modules/prayer-times-calculator/default.nix
index d686ac3bd0b0..7e96bf4196b4 100644
--- a/pkgs/development/python-modules/prayer-times-calculator/default.nix
+++ b/pkgs/development/python-modules/prayer-times-calculator/default.nix
@@ -7,14 +7,16 @@
 
 buildPythonPackage rec {
   pname = "prayer-times-calculator";
-  version = "0.0.7";
+  version = "0.0.8";
+  format = "setuptools";
+
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "uchagani";
     repo = pname;
     rev = "refs/tags/${version}";
-    sha256 = "sha256-fIfv10oi5Lv1dj5Y5CYI94/UdWG3bAY/ENCiMTkO0RE=";
+    hash = "sha256-Zk7lzZUfojJrsrLRS9cf9AhEfGGsxZJo2MnIIOv6Ezk=";
   };
 
   propagatedBuildInputs = [
@@ -24,11 +26,14 @@ buildPythonPackage rec {
   # Project has no tests
   doCheck = false;
 
-  pythonImportsCheck = [ "prayer_times_calculator" ];
+  pythonImportsCheck = [
+    "prayer_times_calculator"
+  ];
 
   meta = with lib; {
     description = "Python client for the Prayer Times API";
     homepage = "https://github.com/uchagani/prayer-times-calculator";
+    changelog = "https://github.com/uchagani/prayer-times-calculator/releases/tag/${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/pytautulli/default.nix b/pkgs/development/python-modules/pytautulli/default.nix
index 849d1e29a172..a9e5ff4510c0 100644
--- a/pkgs/development/python-modules/pytautulli/default.nix
+++ b/pkgs/development/python-modules/pytautulli/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "pytautulli";
-  version = "21.11.0";
+  version = "23.1.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -18,8 +18,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "ludeeus";
     repo = pname;
-    rev = version;
-    sha256 = "sha256-zODU3aN+8Fdw/GQ/EfZhn6kOuLDARKgLULzRw2+b2BM=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-wNR97rGmm/Tmx/o0+r6BTL1muNv25nq9nZaE8/SAi14=";
   };
 
   postPatch = ''
@@ -34,9 +34,12 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  checkInputs = [
     aresponses
     pytest-asyncio
-    pytestCheckHook
   ];
 
   pytestFlagsArray = [
@@ -50,6 +53,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python module to get information from Tautulli";
     homepage = "https://github.com/ludeeus/pytautulli";
+    changelog = "https://github.com/ludeeus/pytautulli/releases/tag/${version}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/pytradfri/default.nix b/pkgs/development/python-modules/pytradfri/default.nix
index 46e9b3843af5..58b3ea9f2ec9 100644
--- a/pkgs/development/python-modules/pytradfri/default.nix
+++ b/pkgs/development/python-modules/pytradfri/default.nix
@@ -10,16 +10,16 @@
 
 buildPythonPackage rec {
   pname = "pytradfri";
-  version = "11.0.0";
+  version = "12.0.1";
   format = "setuptools";
 
-  disabled = pythonOlder "3.8";
+  disabled = pythonOlder "3.9";
 
   src = fetchFromGitHub {
     owner = "home-assistant-libs";
     repo = "pytradfri";
     rev = "refs/tags/${version}";
-    hash = "sha256-+OOmoh2HLKiHAqOIH2aB4CZcW/ND/0bszgkcdRMYBlc=";
+    hash = "sha256-ov5Z9frYxdbPxqUedwXPYZEinCgQ0ge1jcX6UFdQMHw=";
   };
 
   propagatedBuildInputs = [
@@ -45,6 +45,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python package to communicate with the IKEA Trådfri ZigBee Gateway";
     homepage = "https://github.com/home-assistant-libs/pytradfri";
+    changelog = "https://github.com/home-assistant-libs/pytradfri/releases/tag/${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ dotlambda ];
   };
diff --git a/pkgs/development/python-modules/pyuptimerobot/default.nix b/pkgs/development/python-modules/pyuptimerobot/default.nix
index 8dc976fa8c40..8b6af6dc5d92 100644
--- a/pkgs/development/python-modules/pyuptimerobot/default.nix
+++ b/pkgs/development/python-modules/pyuptimerobot/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "pyuptimerobot";
-  version = "22.2.0";
+  version = "23.1.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -18,10 +18,16 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "ludeeus";
     repo = pname;
-    rev = version;
-    sha256 = "sha256-QZm8FlUm17Vv80hB3iai54QcVlhSrq2AvbdBaRWDyok=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-hy/hmXxxEb44X8JUszoA1YF/41y7GkQqC4uS+Pax6WA=";
   };
 
+  postPatch = ''
+    # Upstream doesn't set version in the repo
+    substituteInPlace setup.py \
+      --replace 'version="main",' 'version="${version}",'
+  '';
+
   propagatedBuildInputs = [
     aiohttp
   ];
@@ -32,12 +38,6 @@ buildPythonPackage rec {
     pytest-asyncio
   ];
 
-  postPatch = ''
-    # Upstream doesn't set version in the repo
-    substituteInPlace setup.py \
-      --replace 'version="main",' 'version="${version}",'
-  '';
-
   pythonImportsCheck = [
     "pyuptimerobot"
   ];
@@ -45,6 +45,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python API wrapper for Uptime Robot";
     homepage = "https://github.com/ludeeus/pyuptimerobot";
+    changelog = "https://github.com/ludeeus/pyuptimerobot/releases/tag/${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/scooby/default.nix b/pkgs/development/python-modules/scooby/default.nix
index bdcc62963a73..0bd037a74fc7 100644
--- a/pkgs/development/python-modules/scooby/default.nix
+++ b/pkgs/development/python-modules/scooby/default.nix
@@ -1,27 +1,65 @@
 { lib
+, beautifulsoup4
 , buildPythonPackage
-, fetchPypi
+, fetchFromGitHub
+, numpy
+, pytest-console-scripts
+, pytestCheckHook
+, pythonOlder
+, pyvips
+, scipy
 , setuptools-scm
 }:
 
 buildPythonPackage rec {
   pname = "scooby";
-  version = "0.7.0";
+  version = "0.7.1";
+  format = "setuptools";
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "sha256-scD/uuAtepatt8Yn7b6PJMfSj9AT7iOy0HuVHyVvEhk=";
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "banesullivan";
+    repo = pname;
+    rev = "refs/tags/v${version}";
+    hash = "sha256-wKbCIA6Xp+VYhcQ5ZpHo5usB+ksnMAJyv5naBvl4Cxo=";
   };
 
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
   nativeBuildInputs = [
     setuptools-scm
   ];
 
-  pythonImportsCheck = [ "scooby" ];
+  nativeCheckInputs = [
+    beautifulsoup4
+    numpy
+    pytest-console-scripts
+    pytestCheckHook
+    pyvips
+    scipy
+  ];
+
+  preCheck = ''
+    export PATH="$PATH:$out/bin";
+  '';
+
+  pythonImportsCheck = [
+    "scooby"
+  ];
+
+  disabledTests = [
+    # Tests have additions requirements (e.g., time and module)
+    "test_get_version"
+    "test_tracking"
+    "test_import_os_error"
+    "test_import_time"
+  ];
 
   meta = with lib; {
-    homepage = "https://github.com/banesullivan/scooby";
+    changelog = "https://github.com/banesullivan/scooby/releases/tag/v${version}";
     description = "A lightweight tool for reporting Python package versions and hardware resources";
+    homepage = "https://github.com/banesullivan/scooby";
     license = licenses.mit;
     maintainers = with maintainers; [ wegank ];
   };
diff --git a/pkgs/development/python-modules/upb-lib/default.nix b/pkgs/development/python-modules/upb-lib/default.nix
index 310480a49ab4..50b4d7a4d0a5 100644
--- a/pkgs/development/python-modules/upb-lib/default.nix
+++ b/pkgs/development/python-modules/upb-lib/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "upb-lib";
-  version = "0.5.2";
+  version = "0.5.3";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     pname = "upb_lib";
     inherit version;
-    hash = "sha256-/TNKsno0JJtxBY9HCPQfp7OhlfkOP6sJI51rgp2ujDg=";
+    hash = "sha256-I1lnIr8ptDCyK8r0bvFWFPUGRwoMsQcNnSCSwzdt1Bc=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/tools/build-managers/bmake/default.nix b/pkgs/development/tools/build-managers/bmake/default.nix
index cac4b3c650b8..fbe933f6b6d4 100644
--- a/pkgs/development/tools/build-managers/bmake/default.nix
+++ b/pkgs/development/tools/build-managers/bmake/default.nix
@@ -8,13 +8,13 @@
 , pkgsMusl # for passthru.tests
 }:
 
-stdenv.mkDerivation (finalAttrs: {
+stdenv.mkDerivation (self: {
   pname = "bmake";
-  version = "20220928";
+  version = "20230126";
 
   src = fetchurl {
-    url = "http://www.crufty.net/ftp/pub/sjg/${finalAttrs.pname}-${finalAttrs.version}.tar.gz";
-    hash = "sha256-yAS3feP+uOMd7ipMn7Hp7CTFo0dk56KBXIi07QFlDpA=";
+    url = "http://www.crufty.net/ftp/pub/sjg/${self.pname}-${self.version}.tar.gz";
+    hash = "sha256-hk9yGFgs95Dsc7ILcQVCXLn/ozUiJUF3LwMTMGtqC8Q=";
   };
 
   # Make tests work with musl
diff --git a/pkgs/development/tools/build-managers/mill/default.nix b/pkgs/development/tools/build-managers/mill/default.nix
index 966937deffa8..6ede440cc611 100644
--- a/pkgs/development/tools/build-managers/mill/default.nix
+++ b/pkgs/development/tools/build-managers/mill/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "mill";
-  version = "0.10.10";
+  version = "0.10.11";
 
   src = fetchurl {
     url = "https://github.com/com-lihaoyi/mill/releases/download/${version}/${version}-assembly";
-    hash = "sha256-Qen3z2qbgyHHYUscBh7Udc1/c82WDLnDIsZJF+tcR5M=";
+    hash = "sha256-B47C7sqOqiHa/2kC5lk/J1pXK61l1M5umVKaCfVO7cc=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/development/tools/csvq/default.nix b/pkgs/development/tools/csvq/default.nix
new file mode 100644
index 000000000000..badc9aba08b3
--- /dev/null
+++ b/pkgs/development/tools/csvq/default.nix
@@ -0,0 +1,23 @@
+{ buildGoModule, fetchFromGitHub, lib }:
+
+buildGoModule rec {
+  pname = "csvq";
+  version = "1.17.11";
+
+  src = fetchFromGitHub {
+    owner = "mithrandie";
+    repo = "csvq";
+    rev = "v${version}";
+    sha256 = "sha256-jhj03xpWBcLVCCk1S9nsi8O6x1/IVwNT3voGfWBg2iw=";
+  };
+
+  vendorSha256 = "sha256-C+KQHSp4aho+DPlkaYegjYSaoSHaLiQOa1WJXIn9FdQ=";
+
+  meta = with lib; {
+    description = "SQL-like query language for CSV";
+    homepage = "https://mithrandie.github.io/csvq/";
+    changelog = "https://github.com/mithrandie/csvq/releases/tag/v${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ tomodachi94 ];
+  };
+}
diff --git a/pkgs/development/tools/godot/4/default.nix b/pkgs/development/tools/godot/4/default.nix
index abf87bd0ba19..5732b8f44f62 100644
--- a/pkgs/development/tools/godot/4/default.nix
+++ b/pkgs/development/tools/godot/4/default.nix
@@ -1,11 +1,12 @@
 { stdenv
 , lib
 , fetchFromGitHub
-, installShellFiles
-, autoPatchelfHook
 , pkg-config
+, autoPatchelfHook
+, installShellFiles
 , scons
 , vulkan-loader
+, libGL
 , libX11
 , libXcursor
 , libXinerama
@@ -14,7 +15,7 @@
 , libXrender
 , libXi
 , libXfixes
-, freetype
+, libxkbcommon
 , alsa-lib
 , libpulseaudio
 , dbus
@@ -24,9 +25,9 @@
 , withPlatform ? "linuxbsd"
 , withTarget ? "editor"
 , withPrecision ? "single"
-, withPulseaudio ? false
+, withPulseaudio ? true
 , withDbus ? true
-, withSpeechd ? false
+, withSpeechd ? true
 , withFontconfig ? true
 , withUdev ? true
 , withTouch ? true
@@ -42,7 +43,7 @@ let
     precision = withPrecision; # Floating-point precision level
 
     # Options from 'godot/platform/linuxbsd/detect.py'
-    pulseaudio = withPulseaudio;
+    pulseaudio = withPulseaudio; # Use PulseAudio
     dbus = withDbus; # Use D-Bus to handle screensaver and portal desktop settings
     speechd = withSpeechd; # Use Speech Dispatcher for Text-to-Speech support
     fontconfig = withFontconfig; # Use fontconfig for system fonts support
@@ -52,13 +53,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "godot";
-  version = "4.0-beta14";
+  version = "4.0-beta16";
 
   src = fetchFromGitHub {
     owner = "godotengine";
     repo = "godot";
-    rev = "28a24639c3c6a95b5b9828f5f02bf0dc2f5ce54b";
-    sha256 = "sha256-qAotCc2YUg8FMK+JFHi5B4OL/cAtvWO/pYRRz8RcNUY=";
+    rev = "518b9e5801a19229805fe837d7d0cf92920ad413";
+    sha256 = "sha256-45x4moHOn/PWRazuJ/CBb3WYaPZqv4Sn8ZIugUSaVjY=";
   };
 
   nativeBuildInputs = [
@@ -69,10 +70,11 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     scons
-  ]
-  ++ runtimeDependencies;
+  ];
 
   runtimeDependencies = [
+    vulkan-loader
+    libGL
     libX11
     libXcursor
     libXinerama
@@ -81,8 +83,8 @@ stdenv.mkDerivation rec {
     libXrender
     libXi
     libXfixes
+    libxkbcommon
     alsa-lib
-    vulkan-loader
   ]
   ++ lib.optional withPulseaudio libpulseaudio
   ++ lib.optional withDbus dbus
@@ -92,12 +94,6 @@ stdenv.mkDerivation rec {
   ++ lib.optional withFontconfig fontconfig.lib
   ++ lib.optional withUdev udev;
 
-  patches = [
-    # Godot expects to find xfixes inside xi, but nix's pkg-config only
-    # gives the libs for the requested package (ignoring the propagated-build-inputs)
-    ./xfixes.patch
-  ];
-
   enableParallelBuilding = true;
 
   # Options from 'godot/SConstruct' and 'godot/platform/linuxbsd/detect.py'
diff --git a/pkgs/development/tools/godot/4/xfixes.patch b/pkgs/development/tools/godot/4/xfixes.patch
deleted file mode 100644
index df5c914d7fd6..000000000000
--- a/pkgs/development/tools/godot/4/xfixes.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff --git a/platform/linuxbsd/detect.py b/platform/linuxbsd/detect.py
-index 844b15e9fb..0c8bee1757 100644
---- a/platform/linuxbsd/detect.py
-+++ b/platform/linuxbsd/detect.py
-@@ -192,6 +192,7 @@ def configure(env: "Environment"):
-         env.ParseConfig("pkg-config xrandr --cflags")
-         env.ParseConfig("pkg-config xrender --cflags")
-         env.ParseConfig("pkg-config xi --cflags")
-+        env.ParseConfig("pkg-config xfixes --cflags")
- 
-     if env["touch"]:
-         env.Append(CPPDEFINES=["TOUCH_ENABLED"])
diff --git a/pkgs/development/tools/profiling/systemtap/default.nix b/pkgs/development/tools/profiling/systemtap/default.nix
index cadf9b9eeb16..84f1670e6dff 100644
--- a/pkgs/development/tools/profiling/systemtap/default.nix
+++ b/pkgs/development/tools/profiling/systemtap/default.nix
@@ -42,7 +42,7 @@ in runCommand "systemtap-${kernel.version}-${version}" {
     homepage = "https://sourceware.org/systemtap/";
     description = "Provides a scripting language for instrumentation on a live kernel plus user-space";
     license = lib.licenses.gpl2;
-    platforms = lib.platforms.linux;
+    platforms = lib.systems.inspect.patterns.isGnu;
   };
 } ''
   mkdir -p $out/bin
diff --git a/pkgs/development/tools/rust/cargo-embed/default.nix b/pkgs/development/tools/rust/cargo-embed/default.nix
index 03eecf8a31ba..098f2ab41395 100644
--- a/pkgs/development/tools/rust/cargo-embed/default.nix
+++ b/pkgs/development/tools/rust/cargo-embed/default.nix
@@ -1,28 +1,27 @@
 { lib
 , stdenv
 , rustPlatform
-, fetchFromGitHub
+, fetchCrate
 , libusb1
 , libftdi1
 , pkg-config
-, rustfmt
+, DarwinTools
 , AppKit
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-embed";
-  version = "0.13.0";
+  version = "0.14.2";
 
-  src = fetchFromGitHub {
-    owner = "probe-rs";
-    repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-UlQ7KJmzPWu0vVsYPIkYeqkFFhxe7mEMfUVN7iMaUw0=";
+  src = fetchCrate {
+    inherit pname version;
+    sha256 = "sha256-rSixQ9ZGO5iqreW+WKdHx0vlwacJzJ2L7qPWVjT3Xls=";
   };
 
-  cargoSha256 = "sha256-RkYX5z764Kkr0xK7yYQ0lCw0/7KpmdJmKWqLzwkj4hs=";
+  cargoSha256 = "sha256-O/vMXWyNUdMyH2Pb6DK2AbqOMagmsMNgp5OyIyAiiqg=";
+
+  nativeBuildInputs = [ pkg-config ] ++ lib.optionals stdenv.isDarwin [ DarwinTools ];
 
-  nativeBuildInputs = [ pkg-config rustfmt ];
   buildInputs = [ libusb1 libftdi1 ] ++ lib.optionals stdenv.isDarwin [ AppKit ];
 
   buildFeatures = [ "ftdi" ];
@@ -30,7 +29,7 @@ rustPlatform.buildRustPackage rec {
   meta = with lib; {
     description = "A cargo extension for working with microcontrollers";
     homepage = "https://probe.rs/";
-    changelog = "https://github.com/probe-rs/cargo-embed/blob/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/probe-rs/probe-rs/blob/v${version}/cargo-embed/CHANGELOG.md";
     license = with licenses; [ asl20 /* or */ mit ];
     maintainers = with maintainers; [ fooker newam ];
   };
diff --git a/pkgs/development/tools/rust/cargo-flash/default.nix b/pkgs/development/tools/rust/cargo-flash/default.nix
index 537392a65bbe..86b0a7ed6fbf 100644
--- a/pkgs/development/tools/rust/cargo-flash/default.nix
+++ b/pkgs/development/tools/rust/cargo-flash/default.nix
@@ -1,33 +1,31 @@
 { lib
 , stdenv
 , rustPlatform
-, fetchFromGitHub
+, fetchCrate
 , libusb1
 , pkg-config
-, rustfmt
+, DarwinTools
 , AppKit
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-flash";
-  version = "0.13.0";
+  version = "0.14.2";
 
-  src = fetchFromGitHub {
-    owner = "probe-rs";
-    repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-O6T1Wul0nJaTVp9MEOj9FT+FUt4oYfqR5pGFaAxuK30=";
+  src = fetchCrate {
+    inherit pname version;
+    sha256 = "sha256-7sWfMFFjFUdnoMV1O8mzyHAAS8Pvvf1xsY717ZeD7i8=";
   };
 
-  cargoSha256 = "sha256-E2gBkr50hjkzY+ZVgMm7tpdwr9yuyFh65Ht6FAPvxYg=";
+  cargoSha256 = "sha256-yae+hh2jrQn6ryn/WPFZmiZrq7d+osegD/MyBk8OOLg=";
 
-  nativeBuildInputs = [ pkg-config rustfmt ];
+  nativeBuildInputs = [ pkg-config ] ++ lib.optionals stdenv.isDarwin [ DarwinTools ];
   buildInputs = [ libusb1 ] ++ lib.optionals stdenv.isDarwin [ AppKit ];
 
   meta = with lib; {
     description = "A cargo extension for working with microcontrollers";
     homepage = "https://probe.rs/";
-    changelog = "https://github.com/probe-rs/cargo-flash/blob/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/probe-rs/probe-rs/blob/v${version}/cargo-flash/CHANGELOG.md";
     license = with licenses; [ asl20 /* or */ mit ];
     maintainers = with maintainers; [ fooker newam ];
   };
diff --git a/pkgs/games/bugdom/default.nix b/pkgs/games/bugdom/default.nix
index 75bcad2f0db1..9bceef012907 100644
--- a/pkgs/games/bugdom/default.nix
+++ b/pkgs/games/bugdom/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "bugdom";
-  version = "1.3.2";
+  version = "1.3.3";
 
   src = fetchFromGitHub {
     owner = "jorio";
     repo = pname;
     rev = version;
-    sha256 = "sha256-pgms2mipW1zol35LVCuU5+7mN7CBiVGFvu1CJ3CrGU0=";
+    hash = "sha256-oe7xxvoL82YF+EoIJDK6AfN3PmpqeGRlIsbaGx8xGeM=";
     fetchSubmodules = true;
   };
 
@@ -17,6 +17,8 @@ stdenv.mkDerivation rec {
     # Passing this in cmakeFlags doesn't work because the path is hard-coded for Darwin
     substituteInPlace cmake/FindSDL2.cmake \
       --replace 'set(SDL2_LIBRARIES' 'set(SDL2_LIBRARIES "${SDL2}/lib/libSDL2.dylib") #'
+    # Expects plutil, which we don't have
+    sed -i '/plutil/d' CMakeLists.txt
   '';
 
   buildInputs = [
@@ -43,7 +45,7 @@ stdenv.mkDerivation rec {
   '' + (if stdenv.hostPlatform.isDarwin then ''
     mkdir -p $out/{bin,Applications}
     mv {,$out/Applications/}Bugdom.app
-    ln -s $out/{Applications/Bugdom.app/Contents/MacOS,bin}/Bugdom
+    makeWrapper $out/{Applications/Bugdom.app/Contents/MacOS,bin}/Bugdom
   '' else ''
     mkdir -p $out/share/bugdom
     mv Data $out/share/bugdom
diff --git a/pkgs/os-specific/linux/kernel/perf/default.nix b/pkgs/os-specific/linux/kernel/perf/default.nix
index ae028b980ce2..c1f6fd03a2e1 100644
--- a/pkgs/os-specific/linux/kernel/perf/default.nix
+++ b/pkgs/os-specific/linux/kernel/perf/default.nix
@@ -108,7 +108,6 @@ stdenv.mkDerivation {
     libunwind
     zlib
     openssl
-    systemtap.stapBuild
     numactl
     python3
     perl
@@ -116,6 +115,7 @@ stdenv.mkDerivation {
   ] ++ (if (lib.versionAtLeast kernel.version "5.19")
   then [ libbfd libopcodes ]
   else [ libbfd_2_38 libopcodes_2_38 ])
+  ++ lib.optional (lib.meta.availableOn stdenv.hostPlatform systemtap) systemtap.stapBuild
   ++ lib.optional withGtk gtk2
   ++ lib.optional withZstd zstd
   ++ lib.optional withLibcap libcap
diff --git a/pkgs/tools/audio/tts/default.nix b/pkgs/tools/audio/tts/default.nix
index 0a084498a96d..3e6bed334c29 100644
--- a/pkgs/tools/audio/tts/default.nix
+++ b/pkgs/tools/audio/tts/default.nix
@@ -1,6 +1,7 @@
 { lib
 , python3
 , fetchFromGitHub
+, fetchpatch
 , espeak-ng
 }:
 
@@ -24,7 +25,7 @@ let
         src = super.fetchPypi {
           pname = "librosa";
           inherit version;
-          sha256 = "c53d05e768ae4a3e553ae21c2e5015293e5efbfd5c12d497f1104cb519cca6b3";
+          hash = "sha256-xT0F52iuSj5VOuIcLlAVKT5e+/1cEtSX8RBMtRnMprM=";
         };
       });
     };
@@ -32,16 +33,29 @@ let
 in
 python.pkgs.buildPythonApplication rec {
   pname = "tts";
-  version = "0.9.0";
+  version = "0.10.2";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "coqui-ai";
     repo = "TTS";
-    rev = "v${version}";
-    sha256 = "sha256-p4I583Rs/4eig7cnOcJjri2ugOLAeF2nvPIvMZrN1Ss=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-IcuRhsURgEYIuS7ldZtxAy4Z/XNDehTGsOfYW+DhScg=";
   };
 
+  patches = [
+    # Use packaging.version for version comparisons
+    (fetchpatch {
+      url = "https://github.com/coqui-ai/TTS/commit/77a9ef8ac97ea1b0f7f8d8287dba69a74fdf22ce.patch";
+      hash = "sha256-zWJmINyxw2efhR9KIVkDPHao5703zlpCKwdzOh/1APY=";
+    })
+    # Fix espeak version detection logic
+    (fetchpatch {
+      url = "https://github.com/coqui-ai/TTS/commit/0031df0143b069d7db59ba04d1adfafcc1a92f47.patch";
+      hash = "sha256-6cL9YqWrB+0QomINpA9BxdYmEDpXF03udGEchydQmBA=";
+    })
+  ];
+
   postPatch = let
     relaxedConstraints = [
       "cython"
@@ -64,6 +78,7 @@ python.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = with python.pkgs; [
     cython
+    packaging
   ];
 
   propagatedBuildInputs = with python.pkgs; [
@@ -82,6 +97,7 @@ python.pkgs.buildPythonApplication rec {
     mecab-python3
     nltk
     numba
+    packaging
     pandas
     pypinyin
     pysbd
@@ -134,6 +150,8 @@ python.pkgs.buildPythonApplication rec {
     "test_run_all_models"
     "test_synthesize"
     "test_voice_conversion"
+    "test_multi_speaker_multi_lingual_model"
+    "test_single_speaker_model"
     # Mismatch between phonemes
     "test_text_to_ids_phonemes_with_eos_bos_and_blank"
     # Takes too long
@@ -151,6 +169,7 @@ python.pkgs.buildPythonApplication rec {
     "tests/tts_tests/test_glow_tts_d-vectors_train.py"
     "tests/tts_tests/test_glow_tts_speaker_emb_train.py"
     "tests/tts_tests/test_glow_tts_train.py"
+    "tests/tts_tests/test_overflow_train.py"
     "tests/tts_tests/test_speedy_speech_train.py"
     "tests/tts_tests/test_tacotron2_d-vectors_train.py"
     "tests/tts_tests/test_tacotron2_speaker_emb_train.py"
diff --git a/pkgs/tools/graphics/netpbm/default.nix b/pkgs/tools/graphics/netpbm/default.nix
index eb0a6ec11fc9..c0c770631032 100644
--- a/pkgs/tools/graphics/netpbm/default.nix
+++ b/pkgs/tools/graphics/netpbm/default.nix
@@ -20,14 +20,14 @@ stdenv.mkDerivation {
   # Determine version and revision from:
   # https://sourceforge.net/p/netpbm/code/HEAD/log/?path=/advanced
   pname = "netpbm";
-  version = "11.0.2";
+  version = "11.1.0";
 
   outputs = [ "bin" "out" "dev" ];
 
   src = fetchsvn {
     url = "https://svn.code.sf.net/p/netpbm/code/advanced";
-    rev = "4468";
-    sha256 = "EW96q9DsM1lQ3QZAmp0hZhQ6icsZFDGa3wYmjCQmBRE=";
+    rev = "4489";
+    sha256 = "00qagNgNZ+9sedBme0WmJfedF4WST8EFeqUJ5Wx3yEQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/networking/bgpq4/default.nix b/pkgs/tools/networking/bgpq4/default.nix
index 8b8659f28151..0ec15e9c35c3 100644
--- a/pkgs/tools/networking/bgpq4/default.nix
+++ b/pkgs/tools/networking/bgpq4/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "bgpq4";
-  version = "1.7";
+  version = "1.8";
 
   src = fetchFromGitHub {
     owner = "bgp";
     repo = pname;
     rev = version;
-    sha256 = "sha256-0gqd/bEj8ZDpf/3J2iZnGswTO6k8aJOuRiZXMZLm7zo=";
+    sha256 = "sha256-y1Btpp1xzjAezLaIJBF2+ghMgC/p8mHS/hStGIaKb1o=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/networking/htpdate/default.nix b/pkgs/tools/networking/htpdate/default.nix
index e821163f2298..936e582a1a4f 100644
--- a/pkgs/tools/networking/htpdate/default.nix
+++ b/pkgs/tools/networking/htpdate/default.nix
@@ -1,14 +1,14 @@
 { stdenv, lib, fetchFromGitHub }:
 
 stdenv.mkDerivation rec {
-  version = "1.3.6";
+  version = "1.3.7";
   pname = "htpdate";
 
   src = fetchFromGitHub {
     owner = "twekkel";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-0NLlBNYTJ+hmQLH/UYwIOIbq3G1sDo/A03xFHsXdzig=";
+    sha256 = "sha256-XdqQQw87gvWvdx150fQhnCio478PNCQBMw/g/l/T1ZA=";
   };
 
   makeFlags = [
diff --git a/pkgs/tools/security/gallia/default.nix b/pkgs/tools/security/gallia/default.nix
index 0f5051db0a4d..f86d807d4309 100644
--- a/pkgs/tools/security/gallia/default.nix
+++ b/pkgs/tools/security/gallia/default.nix
@@ -2,18 +2,19 @@
 , stdenv
 , fetchFromGitHub
 , python3
+, cacert
 }:
 
 python3.pkgs.buildPythonApplication rec {
   pname = "gallia";
-  version = "1.0.3";
+  version = "1.1.4";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "Fraunhofer-AISEC";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-CoZ3niGuEjcaSyIGc0MIy95v64nTbhgqW/0uz4a/f1o=";
+    hash = "sha256-McHzHK404kDB992T2f84dZHDxujpPIz4qglYMmv3kTw=";
   };
 
   nativeBuildInputs = with python3.pkgs; [
@@ -29,22 +30,19 @@ python3.pkgs.buildPythonApplication rec {
     construct
     msgspec
     pydantic
+    pygit2
     tabulate
-    tomlkit
-    xdg
+    tomli
     zstandard
   ];
 
+  SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
+
   nativeCheckInputs = with python3.pkgs; [
     pytestCheckHook
+    pytest-asyncio
   ];
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace 'aiofiles = "^0.8.0"' 'aiofiles = ">=0.8.0"' \
-      --replace 'zstandard = "^0.17.0"' 'zstandard = "*"'
-  '';
-
   pythonImportsCheck = [
     "gallia"
   ];
@@ -54,10 +52,10 @@ python3.pkgs.buildPythonApplication rec {
   '';
 
   meta = with lib; {
-    description = "Pentesting framework with the focus on the automotive domain";
+    description = "Extendable Pentesting Framework for the Automotive Domain";
     homepage = "https://github.com/Fraunhofer-AISEC/gallia";
     license = with licenses; [ asl20 ];
-    maintainers = with maintainers; [ fab ];
-    broken = stdenv.isDarwin;
+    maintainers = with maintainers; [ fab rumpelsepp ];
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/tools/video/rav1e/default.nix b/pkgs/tools/video/rav1e/default.nix
index f75c38111a57..32d9cc9d3d7d 100644
--- a/pkgs/tools/video/rav1e/default.nix
+++ b/pkgs/tools/video/rav1e/default.nix
@@ -3,8 +3,11 @@
 , stdenv
 , rustPlatform
 , fetchCrate
-, nasm
+, pkg-config
 , cargo-c
+, libgit2
+, nasm
+, zlib
 , libiconv
 , Security
 }:
@@ -24,7 +27,9 @@ in rustPlatform.buildRustPackage rec {
 
   auditable = true; # TODO: remove when this is the default
 
-  nativeBuildInputs = [ nasm cargo-c ];
+  depsBuildBuild = [ pkg-config ];
+
+  nativeBuildInputs = [ cargo-c libgit2 nasm zlib ];
 
   buildInputs = lib.optionals stdenv.isDarwin [
     libiconv
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index ca75840a82aa..c67b4fa0d586 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -4215,6 +4215,8 @@ with pkgs;
 
   csv2latex = callPackage ../tools/misc/csv2latex { };
 
+  csvq = callPackage ../development/tools/csvq { };
+
   csvs-to-sqlite = callPackage ../tools/misc/csvs-to-sqlite { };
 
   cucumber = callPackage ../development/tools/cucumber {};
@@ -9050,7 +9052,17 @@ with pkgs;
 
   memtester = callPackage ../tools/system/memtester { };
 
-  mesa-demos = callPackage ../tools/graphics/mesa-demos { };
+  mesa-demos =
+    let
+      wayland' = wayland.override { withLibraries = stdenv.isLinux; };
+    in
+    callPackage ../tools/graphics/mesa-demos {
+      wayland = wayland';
+      wayland-protocols = wayland-protocols.override {
+        wayland = wayland';
+        wayland-scanner = wayland'.bin;
+      };
+    };
 
   mhonarc = perlPackages.MHonArc;
 
@@ -15705,6 +15717,7 @@ with pkgs;
   cargo-diet = callPackage ../development/tools/rust/cargo-diet { };
   cargo-embed = callPackage ../development/tools/rust/cargo-embed {
     inherit (darwin.apple_sdk.frameworks) AppKit;
+    inherit (darwin) DarwinTools;
   };
   cargo-espmonitor = callPackage ../development/tools/rust/cargo-espmonitor { };
   cargo-expand = callPackage ../development/tools/rust/cargo-expand { };
@@ -15712,6 +15725,7 @@ with pkgs;
   cargo-feature = callPackage ../development/tools/rust/cargo-feature { };
   cargo-flash = callPackage ../development/tools/rust/cargo-flash {
     inherit (darwin.apple_sdk.frameworks) AppKit;
+    inherit (darwin) DarwinTools;
   };
   cargo-fund = callPackage ../development/tools/rust/cargo-fund {
     inherit (darwin.apple_sdk.frameworks) Security;
@@ -19344,6 +19358,8 @@ with pkgs;
 
   discordchatexporter-cli = callPackage ../tools/backup/discordchatexporter-cli { };
 
+  discord-gamesdk = callPackage ../development/libraries/discord-gamesdk { };
+
   discord-rpc = callPackage ../development/libraries/discord-rpc {
     inherit (darwin.apple_sdk.frameworks) AppKit;
   };
@@ -23297,7 +23313,7 @@ with pkgs;
 
   subtitleeditor = callPackage ../applications/video/subtitleeditor { };
 
-  suil = callPackage ../development/libraries/audio/suil { };
+  suil = darwin.apple_sdk_11_0.callPackage ../development/libraries/audio/suil { };
 
   sundials = callPackage ../development/libraries/sundials {
     python = python3;
@@ -27281,6 +27297,8 @@ with pkgs;
     inherit (plasma5Packages) breeze-icons;
   };
 
+  lxgw-neoxihei = callPackage ../data/fonts/lxgw-neoxihei { };
+
   lxgw-wenkai = callPackage ../data/fonts/lxgw-wenkai { };
 
   maia-icon-theme = libsForQt5.callPackage ../data/icons/maia-icon-theme { };
diff --git a/pkgs/top-level/ruby-packages.nix b/pkgs/top-level/ruby-packages.nix
index 4ae1a50eb757..d1bf5cf7b69e 100644
--- a/pkgs/top-level/ruby-packages.nix
+++ b/pkgs/top-level/ruby-packages.nix
@@ -1013,10 +1013,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1l6mvn60qa215rjy0zjymvjb0vcgnbi4vj9d80v4qq1n6b9ld9xy";
+      sha256 = "sha256-bkSvvD2SClHJ5FyERpyqZaWp0im7NNhn+wplbmnZD84=";
       type = "gem";
     };
-    version = "1.12.0";
+    version = "1.13.1";
   };
   github-pages = {
     dependencies = ["github-pages-health-check" "jekyll" "jekyll-avatar" "jekyll-coffeescript" "jekyll-commonmark-ghpages" "jekyll-default-layout" "jekyll-feed" "jekyll-gist" "jekyll-github-metadata" "jekyll-include-cache" "jekyll-mentions" "jekyll-optional-front-matter" "jekyll-paginate" "jekyll-readme-index" "jekyll-redirect-from" "jekyll-relative-links" "jekyll-remote-theme" "jekyll-sass-converter" "jekyll-seo-tag" "jekyll-sitemap" "jekyll-swiss" "jekyll-theme-architect" "jekyll-theme-cayman" "jekyll-theme-dinky" "jekyll-theme-hacker" "jekyll-theme-leap-day" "jekyll-theme-merlot" "jekyll-theme-midnight" "jekyll-theme-minimal" "jekyll-theme-modernist" "jekyll-theme-primer" "jekyll-theme-slate" "jekyll-theme-tactile" "jekyll-theme-time-machine" "jekyll-titles-from-headings" "jemoji" "kramdown" "kramdown-parser-gfm" "liquid" "mercenary" "minima" "nokogiri" "rouge" "terminal-table"];