diff --git a/nixos/doc/manual/release-notes/rl-2305.section.md b/nixos/doc/manual/release-notes/rl-2305.section.md
index 47c41ea8f4b4..1a55693b9afd 100644
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@@ -49,6 +49,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - [gmediarender](https://github.com/hzeller/gmrender-resurrect), a simple, headless UPnP/DLNA renderer.  Available as [services.gmediarender](options.html#opt-services.gmediarender.enable).
 
+- [hyprland](https://github.com/hyprwm/hyprland), a dynamic tiling Wayland compositor that doesn't sacrifice on its looks. Available as [programs.hyprland](#opt-programs.hyprland.enable).
+
 - [stevenblack-blocklist](https://github.com/StevenBlack/hosts), A unified hosts file with base extensions for blocking unwanted websites. Available as [networking.stevenblack](options.html#opt-networking.stevenblack.enable).
 
 - [Budgie Desktop](https://github.com/BuddiesOfBudgie/budgie-desktop), a familiar, modern desktop environment. Availabe as [services.xserver.desktopManager.budgie](options.html#opt-services.xserver.desktopManager.budgie).
@@ -219,6 +221,9 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - `go-ethereum` package has been updated to v1.11.5 and the `puppeth` command is no longer available as of v1.11.0.
 
+- The `pnpm` package has be updated to from version 7.29.1 to version 8.1.1 and Node.js 14 support has been discontinued (though, there are workarounds if Node.js 14 is still required)
+  - Migration instructions: ["Before updating pnpm to v8 in your CI, regenerate your pnpm-lock.yaml. To upgrade your lockfile, run pnpm install and commit the changes. Existing dependencies will not be updated; however, due to configuration changes in pnpm v8, some missing peer dependencies may be added to the lockfile and some packages may get deduplicated. You can commit the new lockfile even before upgrading Node.js in the CI, as pnpm v7 already supports the new lockfile format."](https://github.com/pnpm/pnpm/releases/tag/v8.0.0)
+
 ## Other Notable Changes {#sec-release-23.05-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 89bef0601778..148722b6ad66 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -179,6 +179,7 @@
   ./programs/haguichi.nix
   ./programs/hamster.nix
   ./programs/htop.nix
+  ./programs/hyprland.nix
   ./programs/iay.nix
   ./programs/iftop.nix
   ./programs/i3lock.nix
diff --git a/nixos/modules/programs/hyprland.nix b/nixos/modules/programs/hyprland.nix
new file mode 100644
index 000000000000..b14f1f77fcf8
--- /dev/null
+++ b/nixos/modules/programs/hyprland.nix
@@ -0,0 +1,84 @@
+{ config
+, lib
+, pkgs
+, ...
+}:
+with lib; let
+  cfg = config.programs.hyprland;
+
+  defaultHyprlandPackage = pkgs.hyprland.override {
+    enableXWayland = cfg.xwayland.enable;
+    hidpiXWayland = cfg.xwayland.hidpi;
+    nvidiaPatches = cfg.nvidiaPatches;
+  };
+in
+{
+  options.programs.hyprland = {
+    enable = mkEnableOption null // {
+      description = mdDoc ''
+        Hyprland, the dynamic tiling Wayland compositor that doesn't sacrifice on its looks.
+
+        You can manually launch Hyprland by executing {command}`Hyprland` on a TTY.
+
+        A configuration file will be generated in {file}`~/.config/hypr/hyprland.conf`.
+        See <https://wiki.hyprland.org> for more information.
+      '';
+    };
+
+    package = mkOption {
+      type = types.path;
+      default = defaultHyprlandPackage;
+      defaultText = literalExpression ''
+        pkgs.hyprland.override {
+          enableXWayland = config.programs.hyprland.xwayland.enable;
+          hidpiXWayland = config.programs.hyprland.xwayland.hidpi;
+          nvidiaPatches = config.programs.hyprland.nvidiaPatches;
+        }
+      '';
+      example = literalExpression "<Hyprland flake>.packages.<system>.default";
+      description = mdDoc ''
+        The Hyprland package to use.
+        Setting this option will make {option}`programs.hyprland.xwayland` and
+        {option}`programs.hyprland.nvidiaPatches` not work.
+      '';
+    };
+
+    xwayland = {
+      enable = mkEnableOption (mdDoc "XWayland") // { default = true; };
+      hidpi = mkEnableOption null // {
+        description = mdDoc ''
+          Enable HiDPI XWayland, based on [XWayland MR 733](https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/733).
+          See <https://wiki.hyprland.org/Nix/Options-Overrides/#xwayland-hidpi> for more info.
+        '';
+      };
+    };
+
+    nvidiaPatches = mkEnableOption (mdDoc "patching wlroots for better Nvidia support");
+  };
+
+  config = mkIf cfg.enable {
+    environment = {
+      systemPackages = [ cfg.package ];
+
+    };
+
+    fonts.enableDefaultFonts = mkDefault true;
+    hardware.opengl.enable = mkDefault true;
+
+    programs = {
+      dconf.enable = mkDefault true;
+      xwayland.enable = mkDefault true;
+    };
+
+    security.polkit.enable = true;
+
+    services.xserver.displayManager.sessionPackages = [ cfg.package ];
+
+    xdg.portal = {
+      enable = mkDefault true;
+      extraPortals = [
+        pkgs.xdg-desktop-portal-hyprland
+      ];
+    };
+  };
+}
diff --git a/pkgs/applications/misc/copyq/default.nix b/pkgs/applications/misc/copyq/default.nix
index a66b4cec245e..d7919d2a71d1 100644
--- a/pkgs/applications/misc/copyq/default.nix
+++ b/pkgs/applications/misc/copyq/default.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation rec {
   pname = "CopyQ";
-  version = "6.4.0";
+  version = "7.0.0";
 
   src = fetchFromGitHub {
     owner = "hluk";
     repo = "CopyQ";
     rev = "v${version}";
-    hash = "sha256-HpWzIABzg0oJqzIehIGpeATLs3ZlmLgtRKaiMIUNAFI=";
+    hash = "sha256-Wk1kTbL6LYgs1edazU39LlNZMAAm6wDbEPjuXvb5EkE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/slmenu/default.nix b/pkgs/applications/misc/slmenu/default.nix
deleted file mode 100644
index 80aedd574187..000000000000
--- a/pkgs/applications/misc/slmenu/default.nix
+++ /dev/null
@@ -1,19 +0,0 @@
-{lib, stdenv, fetchhg}:
-
-stdenv.mkDerivation {
-  pname = "slmenu";
-  version = "hg-2012-02-01";
-
-  src = fetchhg {
-    url = "https://bitbucket.org/rafaelgg/slmenu/";
-    rev = "7e74fa5db73e8b018da48d50dbbaf11cb5c62d13";
-    sha256 = "0zb7mm8344d3xmvrl62psazcabfk75pp083jqkmywdsrikgjagv6";
-  };
-  makeFlags = [ "PREFIX=$(out)" ];
-  meta = with lib; {
-    description = "A console dmenu-like tool";
-    license = licenses.mit;
-    maintainers = with maintainers; [ raskin ];
-    platforms = platforms.linux;
-  };
-}
diff --git a/pkgs/applications/misc/syncthingtray/default.nix b/pkgs/applications/misc/syncthingtray/default.nix
index 0912fc1abcc5..2822d1374549 100644
--- a/pkgs/applications/misc/syncthingtray/default.nix
+++ b/pkgs/applications/misc/syncthingtray/default.nix
@@ -28,14 +28,14 @@ https://github.com/NixOS/nixpkgs/issues/199596#issuecomment-1310136382 */
 }:
 
 mkDerivation rec {
-  version = "1.3.3";
+  version = "1.4.1";
   pname = "syncthingtray";
 
   src = fetchFromGitHub {
     owner = "Martchus";
     repo = "syncthingtray";
     rev = "v${version}";
-    sha256 = "sha256-6H5pV7/E4MP9UqVpm59DqfcK8Z8GwknO3+oWxAcnIsk=";
+    sha256 = "sha256-6s78vytYxU7FWGQRO56qgmtZBlHbXMz3iVAbBXycDmI=";
   };
 
   buildInputs = [
diff --git a/pkgs/applications/office/ledger/default.nix b/pkgs/applications/office/ledger/default.nix
index 18257a34c32e..2e8336660be7 100644
--- a/pkgs/applications/office/ledger/default.nix
+++ b/pkgs/applications/office/ledger/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ledger";
-  version = "3.3.1";
+  version = "3.3.2";
 
   src = fetchFromGitHub {
     owner  = "ledger";
     repo   = "ledger";
     rev    = "v${version}";
-    hash   = "sha256-CnMzsFKBNiXmatgY7aiK8UCqIL6qifA4KbV6BJaza40=";
+    hash   = "sha256-Uym4s8EyzXHlISZqThcb6P1H5bdgD9vmdIOLkk5ikG0=";
   };
 
   outputs = [ "out" "dev" ] ++ lib.optionals usePython [ "py" ];
diff --git a/pkgs/desktops/deepin/apps/deepin-album/default.nix b/pkgs/desktops/deepin/apps/deepin-album/default.nix
index 44cafeb6fb1a..49e2919c2fc0 100644
--- a/pkgs/desktops/deepin/apps/deepin-album/default.nix
+++ b/pkgs/desktops/deepin/apps/deepin-album/default.nix
@@ -8,6 +8,8 @@
 , dtkwidget
 , qt5integration
 , qt5platform-plugins
+, qtbase
+, qtsvg
 , udisks2-qt5
 , gio-qt
 , image-editor
@@ -16,7 +18,6 @@
 , opencv
 , ffmpeg
 , ffmpegthumbnailer
-, qtbase
 }:
 
 stdenv.mkDerivation rec {
@@ -35,9 +36,7 @@ stdenv.mkDerivation rec {
     substituteInPlace libUnionImage/CMakeLists.txt \
       --replace "/usr" "$out"
     substituteInPlace src/CMakeLists.txt \
-      --replace "set(PREFIX /usr)" "set(PREFIX $out)" \
-      --replace "/usr/bin" "$out/bin" \
-      --replace "/usr/share/deepin-manual/manual-assets/application/)" "share/deepin-manual/manual-assets/application/)"
+      --replace "/usr" "$out"
   '';
 
   nativeBuildInputs = [
@@ -49,7 +48,10 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     dtkwidget
+    qt5integration
     qt5platform-plugins
+    qtbase
+    qtsvg
     udisks2-qt5
     gio-qt
     image-editor
@@ -60,10 +62,7 @@ stdenv.mkDerivation rec {
     ffmpegthumbnailer
   ];
 
-  # qt5integration must be placed before qtsvg in QT_PLUGIN_PATH
-  qtWrapperArgs = [
-    "--prefix QT_PLUGIN_PATH : ${qt5integration}/${qtbase.qtPluginPrefix}"
-  ];
+  strictDeps = true;
 
   cmakeFlags = [ "-DVERSION=${version}" ];
 
diff --git a/pkgs/desktops/deepin/apps/deepin-calculator/default.nix b/pkgs/desktops/deepin/apps/deepin-calculator/default.nix
index e565eabe1821..af3c39a149a1 100644
--- a/pkgs/desktops/deepin/apps/deepin-calculator/default.nix
+++ b/pkgs/desktops/deepin/apps/deepin-calculator/default.nix
@@ -4,9 +4,10 @@
 , dtkwidget
 , qt5integration
 , qt5platform-plugins
+, qtbase
+, qtsvg
 , dde-qt-dbus-factory
 , cmake
-, qtbase
 , qttools
 , pkg-config
 , wrapQtAppsHook
@@ -33,14 +34,15 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     dtkwidget
+    qt5integration
+    qt5platform-plugins
+    qtbase
+    qtsvg
     dde-qt-dbus-factory
     gtest
   ];
 
-  qtWrapperArgs = [
-    "--prefix QT_PLUGIN_PATH : ${qt5integration}/${qtbase.qtPluginPrefix}"
-    "--prefix QT_QPA_PLATFORM_PLUGIN_PATH : ${qt5platform-plugins}/${qtbase.qtPluginPrefix}"
-  ];
+  strictDeps = true;
 
   cmakeFlags = [ "-DVERSION=${version}" ];
 
diff --git a/pkgs/desktops/deepin/apps/deepin-camera/default.nix b/pkgs/desktops/deepin/apps/deepin-camera/default.nix
index 95e1c9eeb49f..4e28ff9a20b1 100644
--- a/pkgs/desktops/deepin/apps/deepin-camera/default.nix
+++ b/pkgs/desktops/deepin/apps/deepin-camera/default.nix
@@ -36,11 +36,11 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     substituteInPlace src/CMakeLists.txt \
-      --replace "/usr/share/libimagevisualresult/filter_cube" "${image-editor}/share/libimagevisualresult/filter_cube" \
+      --replace "/usr/share/libimagevisualresult" "${image-editor}/share/libimagevisualresult" \
       --replace "/usr/include/libusb-1.0" "${lib.getDev libusb1}/include/libusb-1.0"
     substituteInPlace src/com.deepin.Camera.service \
       --replace "/usr/bin/qdbus" "${lib.getBin qttools}/bin/qdbus" \
-      --replace "/usr/share/applications/deepin-camera.desktop" "$out/share/applications/deepin-camera.desktop"
+      --replace "/usr/share" "$out/share"
   '';
 
   nativeBuildInputs = [
@@ -52,6 +52,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     dtkwidget
+    qt5integration
     qt5platform-plugins
     image-editor
     qtbase
@@ -70,14 +71,14 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [ "-DVERSION=${version}" ];
 
+  strictDeps = true;
+
   env.NIX_CFLAGS_COMPILE = toString [
     "-I${gst_all_1.gstreamer.dev}/include/gstreamer-1.0"
     "-I${gst_all_1.gst-plugins-base.dev}/include/gstreamer-1.0"
   ];
 
-  # qt5integration must be placed before qtsvg in QT_PLUGIN_PATH
   qtWrapperArgs = [
-    "--prefix QT_PLUGIN_PATH : ${qt5integration}/${qtbase.qtPluginPrefix}"
     "--prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ ffmpeg ffmpegthumbnailer gst_all_1.gstreamer gst_all_1.gst-plugins-base libusb1 libv4l portaudio systemd ]}"
   ];
 
diff --git a/pkgs/desktops/deepin/apps/deepin-clone/default.nix b/pkgs/desktops/deepin/apps/deepin-clone/default.nix
index 9252224488ee..533d2562e625 100644
--- a/pkgs/desktops/deepin/apps/deepin-clone/default.nix
+++ b/pkgs/desktops/deepin/apps/deepin-clone/default.nix
@@ -49,6 +49,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     qtbase
     dtkwidget
+    qt5integration
     qt5platform-plugins
     libuuid
     parted
@@ -61,11 +62,6 @@ stdenv.mkDerivation rec {
 
   strictDeps = true;
 
-  # qt5integration must be placed before qtsvg in QT_PLUGIN_PATH
-  qtWrapperArgs = [
-    "--prefix QT_PLUGIN_PATH : ${qt5integration}/${qtbase.qtPluginPrefix}"
-  ];
-
   meta = with lib; {
     description = "Disk and partition backup/restore tool";
     homepage = "https://github.com/linuxdeepin/deepin-clone";
diff --git a/pkgs/desktops/deepin/apps/deepin-compressor/default.nix b/pkgs/desktops/deepin/apps/deepin-compressor/default.nix
index 0a7c2e82d621..4aa3612b2ea3 100644
--- a/pkgs/desktops/deepin/apps/deepin-compressor/default.nix
+++ b/pkgs/desktops/deepin/apps/deepin-compressor/default.nix
@@ -44,6 +44,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     dtkwidget
+    qt5integration
     qt5platform-plugins
     udisks2-qt5
     kcodecs
@@ -60,11 +61,6 @@ stdenv.mkDerivation rec {
 
   strictDeps = true;
 
-  # qt5integration must be placed before qtsvg in QT_PLUGIN_PATH
-  qtWrapperArgs = [
-    "--prefix QT_PLUGIN_PATH : ${qt5integration}/${qtbase.qtPluginPrefix}"
-  ];
-
   meta = with lib; {
     description = "A fast and lightweight application for creating and extracting archives";
     homepage = "https://github.com/linuxdeepin/deepin-compressor";
diff --git a/pkgs/desktops/deepin/apps/deepin-draw/default.nix b/pkgs/desktops/deepin/apps/deepin-draw/default.nix
index c43cc77b5108..b8c89e0999b9 100644
--- a/pkgs/desktops/deepin/apps/deepin-draw/default.nix
+++ b/pkgs/desktops/deepin/apps/deepin-draw/default.nix
@@ -46,6 +46,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     qtbase
+    qt5integration
     qtsvg
     dtkwidget
     qt5platform-plugins
@@ -55,11 +56,6 @@ stdenv.mkDerivation rec {
 
   strictDeps = true;
 
-  # qt5integration must be placed before qtsvg in QT_PLUGIN_PATH
-  qtWrapperArgs = [
-    "--prefix QT_PLUGIN_PATH : ${qt5integration}/${qtbase.qtPluginPrefix}"
-  ];
-
   meta = with lib; {
     description = "Lightweight drawing tool for users to freely draw and simply edit images";
     homepage = "https://github.com/linuxdeepin/deepin-draw";
diff --git a/pkgs/desktops/deepin/apps/deepin-editor/default.nix b/pkgs/desktops/deepin/apps/deepin-editor/default.nix
index 01a26d58f289..1f26134e9a1c 100644
--- a/pkgs/desktops/deepin/apps/deepin-editor/default.nix
+++ b/pkgs/desktops/deepin/apps/deepin-editor/default.nix
@@ -54,6 +54,7 @@ stdenv.mkDerivation rec {
     qtbase
     qtsvg
     dtkwidget
+    qt5integration
     qt5platform-plugins
     dde-qt-dbus-factory
     kcodecs
@@ -68,11 +69,6 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [ "-DVERSION=${version}" ];
 
-  # qt5integration must be placed before qtsvg in QT_PLUGIN_PATH
-  qtWrapperArgs = [
-    "--prefix QT_PLUGIN_PATH : ${qt5integration}/${qtbase.qtPluginPrefix}"
-  ];
-
   meta = with lib; {
     description = "A desktop text editor that supports common text editing features";
     homepage = "https://github.com/linuxdeepin/deepin-editor";
diff --git a/pkgs/desktops/deepin/apps/deepin-image-viewer/default.nix b/pkgs/desktops/deepin/apps/deepin-image-viewer/default.nix
index 50ba4584c8b9..a19776b25536 100644
--- a/pkgs/desktops/deepin/apps/deepin-image-viewer/default.nix
+++ b/pkgs/desktops/deepin/apps/deepin-image-viewer/default.nix
@@ -59,6 +59,7 @@ stdenv.mkDerivation rec {
     qtbase
     qtsvg
     dtkwidget
+    qt5integration
     qt5platform-plugins
     gio-qt
     udisks2-qt5
@@ -71,11 +72,6 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [ "-DVERSION=${version}" ];
 
-  # qt5integration must be placed before qtsvg in QT_PLUGIN_PATH
-  qtWrapperArgs = [
-    "--prefix QT_PLUGIN_PATH : ${qt5integration}/${qtbase.qtPluginPrefix}"
-  ];
-
   meta = with lib; {
     description = "An image viewing tool with fashion interface and smooth performance";
     homepage = "https://github.com/linuxdeepin/deepin-image-viewer";
diff --git a/pkgs/desktops/deepin/apps/deepin-movie-reborn/default.nix b/pkgs/desktops/deepin/apps/deepin-movie-reborn/default.nix
index eaeeae989299..f70cbfbf9f7b 100644
--- a/pkgs/desktops/deepin/apps/deepin-movie-reborn/default.nix
+++ b/pkgs/desktops/deepin/apps/deepin-movie-reborn/default.nix
@@ -73,6 +73,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     dtkwidget
+    qt5integration
     qt5platform-plugins
     qtx11extras
     qtmultimedia
@@ -99,12 +100,6 @@ stdenv.mkDerivation rec {
     gst-plugins-base
   ]);
 
-  # qt5integration must be placed before qtsvg in QT_PLUGIN_PATH
-  qtWrapperArgs = [
-    "--prefix QT_PLUGIN_PATH : ${qt5integration}/${qtbase.qtPluginPrefix}"
-    "--prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ mpv ffmpeg ffmpegthumbnailer gst_all_1.gstreamer gst_all_1.gst-plugins-base ]}"
-  ];
-
   env.NIX_CFLAGS_COMPILE = toString [
     "-I${gst_all_1.gstreamer.dev}/include/gstreamer-1.0"
     "-I${gst_all_1.gst-plugins-base.dev}/include/gstreamer-1.0"
@@ -114,6 +109,12 @@ stdenv.mkDerivation rec {
     "-DVERSION=${version}"
   ];
 
+  strictDeps = true;
+
+  qtWrapperArgs = [
+    "--prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ mpv ffmpeg ffmpegthumbnailer gst_all_1.gstreamer gst_all_1.gst-plugins-base ]}"
+  ];
+
   preFixup = ''
     glib-compile-schemas ${glib.makeSchemaPath "$out" "${pname}-${version}"}
     qtWrapperArgs+=(--prefix GST_PLUGIN_SYSTEM_PATH_1_0 : "$GST_PLUGIN_SYSTEM_PATH_1_0")
diff --git a/pkgs/desktops/deepin/apps/deepin-music/default.nix b/pkgs/desktops/deepin/apps/deepin-music/default.nix
index 04b7b46443e2..6ac8a91b8e9f 100644
--- a/pkgs/desktops/deepin/apps/deepin-music/default.nix
+++ b/pkgs/desktops/deepin/apps/deepin-music/default.nix
@@ -38,8 +38,7 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     substituteInPlace src/music-player/CMakeLists.txt \
-      --replace "include_directories(/usr/include/vlc)" "include_directories(${libvlc}/include/vlc)" \
-      --replace "include_directories(/usr/include/vlc/plugins)" "include_directories(${libvlc}/include/vlc/plugins)" \
+      --replace "/usr/include/vlc" "${libvlc}/include/vlc" \
       --replace "/usr/share" "$out/share"
     substituteInPlace src/libmusic-plugin/CMakeLists.txt \
       --replace "/usr/lib/deepin-aiassistant" "$out/lib/deepin-aiassistant"
@@ -56,6 +55,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     dtkwidget
+    qt5integration
     qt5platform-plugins
     dde-qt-dbus-factory
     udisks2-qt5
@@ -76,15 +76,12 @@ stdenv.mkDerivation rec {
     gst-plugins-good
   ]);
 
-  # qt5integration must be placed before qtsvg in QT_PLUGIN_PATH
-  qtWrapperArgs = [
-    "--prefix QT_PLUGIN_PATH : ${qt5integration}/${qtbase.qtPluginPrefix}"
-  ];
-
   cmakeFlags = [
     "-DVERSION=${version}"
   ];
 
+  strictDeps = true;
+
   preFixup = ''
     qtWrapperArgs+=(--prefix GST_PLUGIN_SYSTEM_PATH_1_0 : "$GST_PLUGIN_SYSTEM_PATH_1_0")
   '';
diff --git a/pkgs/desktops/deepin/apps/deepin-reader/default.nix b/pkgs/desktops/deepin/apps/deepin-reader/default.nix
index b72ae4b60356..952a626b9fb7 100644
--- a/pkgs/desktops/deepin/apps/deepin-reader/default.nix
+++ b/pkgs/desktops/deepin/apps/deepin-reader/default.nix
@@ -46,6 +46,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     dtkwidget
+    qt5integration
     qt5platform-plugins
     dde-qt-dbus-factory
     qtwebengine
@@ -61,11 +62,6 @@ stdenv.mkDerivation rec {
     "DEFINES+=VERSION=${version}"
   ];
 
-  # qt5integration must be placed before qtsvg in QT_PLUGIN_PATH
-  qtWrapperArgs = [
-    "--prefix QT_PLUGIN_PATH : ${qt5integration}/${qtbase.qtPluginPrefix}"
-  ];
-
   meta = with lib; {
     description = "A simple memo software with texts and voice recordings";
     homepage = "https://github.com/linuxdeepin/deepin-reader";
diff --git a/pkgs/desktops/deepin/apps/deepin-shortcut-viewer/default.nix b/pkgs/desktops/deepin/apps/deepin-shortcut-viewer/default.nix
index dcc8a2e41c8e..a9e1f8d7e977 100644
--- a/pkgs/desktops/deepin/apps/deepin-shortcut-viewer/default.nix
+++ b/pkgs/desktops/deepin/apps/deepin-shortcut-viewer/default.nix
@@ -32,6 +32,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     qtbase
     dtkwidget
+    qt5integration
     qt5platform-plugins
   ];
 
@@ -40,11 +41,6 @@ stdenv.mkDerivation rec {
     "PREFIX=${placeholder "out"}"
   ];
 
-  # qt5integration must be placed before qtsvg in QT_PLUGIN_PATH
-  qtWrapperArgs = [
-    "--prefix QT_PLUGIN_PATH : ${qt5integration}/${qtbase.qtPluginPrefix}"
-  ];
-
   meta = with lib; {
     description = "Deepin Shortcut Viewer";
     homepage = "https://github.com/linuxdeepin/deepin-shortcut-viewer";
diff --git a/pkgs/desktops/deepin/apps/deepin-terminal/default.nix b/pkgs/desktops/deepin/apps/deepin-terminal/default.nix
index 91373b9598c3..a50069b74320 100644
--- a/pkgs/desktops/deepin/apps/deepin-terminal/default.nix
+++ b/pkgs/desktops/deepin/apps/deepin-terminal/default.nix
@@ -53,6 +53,7 @@ stdenv.mkDerivation rec {
     qtbase
     qtsvg
     dtkwidget
+    qt5integration
     qt5platform-plugins
     dde-qt-dbus-factory
     qtx11extras
@@ -64,11 +65,6 @@ stdenv.mkDerivation rec {
 
   strictDeps = true;
 
-  # qt5integration must be placed before qtsvg in QT_PLUGIN_PATH
-  qtWrapperArgs = [
-    "--prefix QT_PLUGIN_PATH : ${qt5integration}/${qtbase.qtPluginPrefix}"
-  ];
-
   meta = with lib; {
     description = "Terminal emulator with workspace, multiple windows, remote management, quake mode and other features";
     homepage = "https://github.com/linuxdeepin/deepin-terminal";
diff --git a/pkgs/desktops/deepin/apps/deepin-voice-note/default.nix b/pkgs/desktops/deepin/apps/deepin-voice-note/default.nix
index 992705d451c4..599baa24e436 100644
--- a/pkgs/desktops/deepin/apps/deepin-voice-note/default.nix
+++ b/pkgs/desktops/deepin/apps/deepin-voice-note/default.nix
@@ -44,6 +44,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     qtbase
     dtkwidget
+    qt5integration
     qt5platform-plugins
     dde-qt-dbus-factory
     qtmultimedia
@@ -62,11 +63,6 @@ stdenv.mkDerivation rec {
 
   env.NIX_CFLAGS_COMPILE = "-I${dde-qt-dbus-factory}/include/libdframeworkdbus-2.0";
 
-  # qt5integration must be placed before qtsvg in QT_PLUGIN_PATH
-  qtWrapperArgs = [
-    "--prefix QT_PLUGIN_PATH : ${qt5integration}/${qtbase.qtPluginPrefix}"
-  ];
-
   preFixup = ''
     qtWrapperArgs+=(--prefix GST_PLUGIN_SYSTEM_PATH_1_0 : "$GST_PLUGIN_SYSTEM_PATH_1_0")
   '';
diff --git a/pkgs/development/compilers/cudatoolkit/common.nix b/pkgs/development/compilers/cudatoolkit/common.nix
index 02eda05de80d..c05c1d20282e 100644
--- a/pkgs/development/compilers/cudatoolkit/common.nix
+++ b/pkgs/development/compilers/cudatoolkit/common.nix
@@ -29,6 +29,7 @@ args@
 , python3 # FIXME: CUDAToolkit 10 may still need python27
 , pulseaudio
 , requireFile
+, stdenv
 , backendStdenv # E.g. gcc11Stdenv, set in extension.nix
 , unixODBC
 , wayland
@@ -136,8 +137,8 @@ backendStdenv.mkDerivation rec {
     (placeholder "lib")
     (placeholder "out")
     "${placeholder "out"}/nvvm"
-    # Is it not handled by autoPatchelf automatically?
-    "${lib.getLib backendStdenv.cc.cc}/lib64"
+    # NOTE: use the same libstdc++ as the rest of nixpkgs, not from backendStdenv
+    "${lib.getLib stdenv.cc.cc}/lib64"
     "${placeholder "out"}/jre/lib/amd64/jli"
     "${placeholder "out"}/lib64"
     "${placeholder "out"}/nvvm/lib64"
@@ -219,6 +220,7 @@ backendStdenv.mkDerivation rec {
 
       mv pkg/builds/nsight_systems/target-linux-x64 $out/target-linux-x64
       mv pkg/builds/nsight_systems/host-linux-x64 $out/host-linux-x64
+      rm $out/host-linux-x64/libstdc++.so*
     ''}
       ${lib.optionalString (lib.versionAtLeast version "11.8")
       # error: auto-patchelf could not satisfy dependency libtiff.so.5 wanted by /nix/store/.......-cudatoolkit-12.0.1/host-linux-x64/Plugins/imageformats/libqtiff.so
diff --git a/pkgs/development/compilers/cudatoolkit/extension.nix b/pkgs/development/compilers/cudatoolkit/extension.nix
index dd6f7ff2abe7..7ed3e0426180 100644
--- a/pkgs/development/compilers/cudatoolkit/extension.nix
+++ b/pkgs/development/compilers/cudatoolkit/extension.nix
@@ -10,11 +10,17 @@ final: prev: let
   finalVersion = cudatoolkitVersions.${final.cudaVersion};
 
   # Exposed as cudaPackages.backendStdenv.
-  # We don't call it just "stdenv" to avoid confusion: e.g. this toolchain doesn't contain nvcc.
-  # Instead, it's the back-end toolchain for nvcc to use.
-  # We also use this to link a compatible libstdc++ (backendStdenv.cc.cc.lib)
+  # This is what nvcc uses as a backend,
+  # and it has to be an officially supported one (e.g. gcc11 for cuda11).
+  #
+  # It, however, propagates current stdenv's libstdc++ to avoid "GLIBCXX_* not found errors"
+  # when linked with other C++ libraries.
+  # E.g. for cudaPackages_11_8 we use gcc11 with gcc12's libstdc++
   # Cf. https://github.com/NixOS/nixpkgs/pull/218265 for context
-  backendStdenv = prev.pkgs."${finalVersion.gcc}Stdenv";
+  backendStdenv = final.callPackage ./stdenv.nix {
+    nixpkgsStdenv = prev.pkgs.stdenv;
+    nvccCompatibleStdenv = prev.pkgs.buildPackages."${finalVersion.gcc}Stdenv";
+  };
 
   ### Add classic cudatoolkit package
   cudatoolkit =
diff --git a/pkgs/development/compilers/cudatoolkit/redist/build-cuda-redist-package.nix b/pkgs/development/compilers/cudatoolkit/redist/build-cuda-redist-package.nix
index 1b216ee625a8..a0242a91a03b 100644
--- a/pkgs/development/compilers/cudatoolkit/redist/build-cuda-redist-package.nix
+++ b/pkgs/development/compilers/cudatoolkit/redist/build-cuda-redist-package.nix
@@ -1,4 +1,5 @@
 { lib
+, stdenv
 , backendStdenv
 , fetchurl
 , autoPatchelfHook
@@ -30,11 +31,11 @@ backendStdenv.mkDerivation {
   ];
 
   buildInputs = [
-    # autoPatchelfHook will search for a libstdc++ and we're giving it a
-    # "compatible" libstdc++ from the same toolchain that NVCC uses.
-    #
+    # autoPatchelfHook will search for a libstdc++ and we're giving it
+    # one that is compatible with the rest of nixpkgs, even when
+    # nvcc forces us to use an older gcc
     # NB: We don't actually know if this is the right thing to do
-    backendStdenv.cc.cc.lib
+    stdenv.cc.cc.lib
   ];
 
   dontBuild = true;
diff --git a/pkgs/development/compilers/cudatoolkit/stdenv.nix b/pkgs/development/compilers/cudatoolkit/stdenv.nix
new file mode 100644
index 000000000000..42ee7f7b3317
--- /dev/null
+++ b/pkgs/development/compilers/cudatoolkit/stdenv.nix
@@ -0,0 +1,17 @@
+{ nixpkgsStdenv
+, nvccCompatibleStdenv
+, overrideCC
+, wrapCCWith
+}:
+
+overrideCC nixpkgsStdenv (wrapCCWith {
+  cc = nvccCompatibleStdenv.cc.cc;
+
+  # This option is for clang's libcxx, but we (ab)use it for gcc's libstdc++.
+  # Note that libstdc++ maintains forward-compatibility: if we load a newer
+  # libstdc++ into the process, we can still use libraries built against an
+  # older libstdc++. This, in practice, means that we should use libstdc++ from
+  # the same stdenv that the rest of nixpkgs uses.
+  # We currently do not try to support anything other than gcc and linux.
+  libcxx = nixpkgsStdenv.cc.cc.lib;
+})
diff --git a/pkgs/development/compilers/hare/hare/default.nix b/pkgs/development/compilers/hare/hare/default.nix
index c1d5e7800c95..546bb61bbc63 100644
--- a/pkgs/development/compilers/hare/hare/default.nix
+++ b/pkgs/development/compilers/hare/hare/default.nix
@@ -14,13 +14,13 @@ let
 in
 stdenv.mkDerivation (self: {
   pname = "hare";
-  version = "unstable-2023-02-10";
+  version = "unstable-2023-03-15";
 
   src = fetchFromSourcehut {
     owner = "~sircmpwn";
     repo = "hare";
-    rev = "52b3f2d0c7a85e04a79666a954101e527b7f1272";
-    hash = "sha256-/zP8LbZ113Ar06MZF1zP20LKMGko+4HcOXSntLVAQAU=";
+    rev = "488771bc8cef15557a44815eb6f7808df40a09f7";
+    hash = "sha256-1cSXWD8jpW1VJZDTDOkIabczqbaDCOWsyaUSGtsKsUM=";
   };
 
   patches = [
diff --git a/pkgs/development/compilers/hare/harec/default.nix b/pkgs/development/compilers/hare/harec/default.nix
index b29f53151ae4..e7902f6c29a5 100644
--- a/pkgs/development/compilers/hare/harec/default.nix
+++ b/pkgs/development/compilers/hare/harec/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation (self: {
   pname = "harec";
-  version = "unstable-2023-02-08";
+  version = "unstable-2023-02-18";
 
   src = fetchFromSourcehut {
     owner = "~sircmpwn";
     repo = "harec";
-    rev = "4730fa6b835f08c44bd7991cc8b264fbc27d752b";
-    hash = "sha256-XOhZWdmkMAuXbj7svILJI3wI7RF9OAb/OE1uGel4/vE=";
+    rev = "dd50ca7740408e3c6e41c0ca48b59b9f7f5911f2";
+    hash = "sha256-616mPMdy4yHHuwGcq+aDdEOteEiWgufRzreXHGhmHr0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/interpreters/quickjs/default.nix b/pkgs/development/interpreters/quickjs/default.nix
index cc5487183db3..2f6370cc4420 100644
--- a/pkgs/development/interpreters/quickjs/default.nix
+++ b/pkgs/development/interpreters/quickjs/default.nix
@@ -15,6 +15,10 @@ stdenv.mkDerivation rec {
     hash = "sha256-VMaxVVQuJ3DAwYrC14uJqlRBg0//ugYvtyhOXsTUbCA=";
   };
 
+  postPatch = lib.optionalString stdenv.isDarwin ''
+    substituteInPlace Makefile --replace "CONFIG_LTO=y" ""
+  '';
+
   makeFlags = [ "prefix=${placeholder "out"}" ];
   enableParallelBuilding = true;
 
@@ -45,15 +49,15 @@ stdenv.mkDerivation rec {
     temp=$(mktemp).js
     echo "console.log('Output from compiled program');" > "$temp"
     set -o verbose
-    out=$(mktemp) && qjsc         "$temp" -o "$out" && "$out" | grep -q "Output from compiled program"
-    out=$(mktemp) && qjsc   -flto "$temp" -o "$out" && "$out" | grep -q "Output from compiled program"
+    out=$(mktemp) && qjsc         -o "$out" "$temp" && "$out" | grep -q "Output from compiled program"
+    out=$(mktemp) && qjsc   -flto -o "$out" "$temp" && "$out" | grep -q "Output from compiled program"
   '';
 
   meta = with lib; {
     description = "A small and embeddable Javascript engine";
     homepage = "https://bellard.org/quickjs/";
     maintainers = with maintainers; [ stesie AndersonTorres ];
-    platforms = platforms.linux;
+    platforms = platforms.unix;
     license = licenses.mit;
     mainProgram = "qjs";
   };
diff --git a/pkgs/development/libraries/cpp-utilities/default.nix b/pkgs/development/libraries/cpp-utilities/default.nix
index 4c9551332ee4..8fc767530caf 100644
--- a/pkgs/development/libraries/cpp-utilities/default.nix
+++ b/pkgs/development/libraries/cpp-utilities/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cpp-utilities";
-  version = "5.21.0";
+  version = "5.22.0";
 
   src = fetchFromGitHub {
     owner = "Martchus";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-jva/mVk20xqEcHlUMnOBy2I09oGoLkKaqwRSg0kIKS0=";
+    sha256 = "sha256-c36FzKDAaalKVIrqVSCoslrKVopW77cGdGwfiMbaXe4=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/qtutilities/default.nix b/pkgs/development/libraries/qtutilities/default.nix
index 984a28a2c85f..cc68ae8d9276 100644
--- a/pkgs/development/libraries/qtutilities/default.nix
+++ b/pkgs/development/libraries/qtutilities/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "qtutilities";
-  version = "6.11.0";
+  version = "6.12.0";
 
   src = fetchFromGitHub {
     owner = "Martchus";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-eMQyXxBupqcLmNtAcVBgTWtAtuyRlWB9GKNpomM10B0=";
+    hash = "sha256-zkuVD6TH3eHFMu31PmKF2qlQ3itwWHMzVp0ZjdspWTk=";
   };
 
   buildInputs = [ qtbase cpp-utilities ];
diff --git a/pkgs/development/libraries/science/math/cudnn/generic.nix b/pkgs/development/libraries/science/math/cudnn/generic.nix
index b2844ae6b074..cdfa924b2242 100644
--- a/pkgs/development/libraries/science/math/cudnn/generic.nix
+++ b/pkgs/development/libraries/science/math/cudnn/generic.nix
@@ -1,4 +1,4 @@
-{
+{ stdenv,
   backendStdenv,
   lib,
   zlib,
@@ -26,7 +26,6 @@
   maxCudaVersion,
 }:
 assert useCudatoolkitRunfile || (libcublas != null); let
-  inherit (backendStdenv) cc;
   inherit (lib) lists strings trivial versions;
 
   # majorMinorPatch :: String -> String
@@ -63,7 +62,10 @@ in
 
     # Used by autoPatchelfHook
     buildInputs = [
-      cc.cc.lib # libstdc++
+      # Note this libstdc++ isn't from the (possibly older) nvcc-compatible
+      # stdenv, but from the (newer) stdenv that the rest of nixpkgs uses
+      stdenv.cc.cc.lib
+
       zlib
       cudatoolkit_root
     ];
diff --git a/pkgs/development/libraries/science/math/faiss/default.nix b/pkgs/development/libraries/science/math/faiss/default.nix
index 2a6f144d862f..9d0265a9ce88 100644
--- a/pkgs/development/libraries/science/math/faiss/default.nix
+++ b/pkgs/development/libraries/science/math/faiss/default.nix
@@ -25,7 +25,7 @@
   builtins.head optLevels
 , faiss # To run demos in the tests
 , runCommand
-}:
+}@inputs:
 
 assert cudaSupport -> nvidia-thrust.cudaSupport;
 
@@ -33,9 +33,11 @@ let
   pname = "faiss";
   version = "1.7.2";
 
-  inherit (cudaPackages) cudaFlags;
+  inherit (cudaPackages) cudaFlags backendStdenv;
   inherit (cudaFlags) cudaCapabilities dropDot;
 
+  stdenv = if cudaSupport then backendStdenv else inputs.stdenv;
+
   cudaJoined = symlinkJoin {
     name = "cuda-packages-unsplit";
     paths = with cudaPackages; [
diff --git a/pkgs/development/node-packages/node-packages.nix b/pkgs/development/node-packages/node-packages.nix
index ebbf0ae2d25c..1976b4fe40b9 100644
--- a/pkgs/development/node-packages/node-packages.nix
+++ b/pkgs/development/node-packages/node-packages.nix
@@ -131006,10 +131006,10 @@ in
   pnpm = nodeEnv.buildNodePackage {
     name = "pnpm";
     packageName = "pnpm";
-    version = "7.29.1";
+    version = "8.1.1";
     src = fetchurl {
-      url = "https://registry.npmjs.org/pnpm/-/pnpm-7.29.1.tgz";
-      sha512 = "dn+65B2XpMIin7sQZvBIJ2Zyx8Z7LK95qyAvgEPE8qXkWYL/LuwpfMfK9Muc7+zNnpPwiQgtGEsxgOtuabFibQ==";
+      url = "https://registry.npmjs.org/pnpm/-/pnpm-8.1.1.tgz";
+      sha512 = "XLzcc4O8YrqfQ1+qjPtHGDFcdUeno2Zk+kuuSc9CagIiY8y4uhnqQ2B7jW8tgwQDNmehewGZuqrAoskgCkbTnw==";
     };
     buildInputs = globalBuildInputs;
     meta = {
diff --git a/pkgs/development/python-modules/pydevtool/default.nix b/pkgs/development/python-modules/pydevtool/default.nix
new file mode 100644
index 000000000000..c9a0d67fcebf
--- /dev/null
+++ b/pkgs/development/python-modules/pydevtool/default.nix
@@ -0,0 +1,37 @@
+{ lib
+, fetchPypi
+, setuptools
+, buildPythonPackage
+, doit
+}:
+
+buildPythonPackage rec {
+  pname = "pydevtool";
+  version = "0.3.0";
+  format = "pyproject";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-JeO6Tz0zzKwz7iuXdZlYSNSemzGLehRkd/tdUveG/Io=";
+  };
+
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  propagatedBuildInputs = [
+    doit
+  ];
+
+  pythonImportsCheck = [
+    "pydevtool"
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/pydoit/pydevtool";
+    description = "CLI dev tools powered by pydoit";
+    license = licenses.mit;
+    maintainers = with maintainers; [ doronbehar ];
+  };
+
+}
diff --git a/pkgs/development/python-modules/pyephember/default.nix b/pkgs/development/python-modules/pyephember/default.nix
index a6f8d405f617..48cad7bc1954 100644
--- a/pkgs/development/python-modules/pyephember/default.nix
+++ b/pkgs/development/python-modules/pyephember/default.nix
@@ -1,23 +1,25 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, paho-mqtt
 , pythonOlder
 , requests
 }:
 
 buildPythonPackage rec {
   pname = "pyephember";
-  version = "0.3.1";
+  version = "0.4.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "3eMdkP7u3TTg1AUK4OR7AGZkD0FxUUPp/etvZ2Rw74E=";
+    sha256 = "sha256-j3SftxXKs9EZwdio26W5U0y5owH4yTteS4RUmzkZkoE=";
   };
 
   propagatedBuildInputs = [
+    paho-mqtt
     requests
   ];
 
diff --git a/pkgs/development/python-modules/pykulersky/default.nix b/pkgs/development/python-modules/pykulersky/default.nix
index 51973fde07a1..6c1d9bf00fae 100644
--- a/pkgs/development/python-modules/pykulersky/default.nix
+++ b/pkgs/development/python-modules/pykulersky/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "pykulersky";
-  version = "0.5.4";
+  version = "0.5.5";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "emlove";
     repo = pname;
     rev = version;
-    hash = "sha256-voD4tR+k5TKGjLXFK94GJy4+wUoP2cSFc5BWkCiinOg=";
+    hash = "sha256-coO+WBnv5HT14ym719qr3Plm1JuiaNdAvD1QVPj65oU=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pyzerproc/default.nix b/pkgs/development/python-modules/pyzerproc/default.nix
index d79ed3320814..a453014fe8be 100644
--- a/pkgs/development/python-modules/pyzerproc/default.nix
+++ b/pkgs/development/python-modules/pyzerproc/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "pyzerproc";
-  version = "0.4.11";
+  version = "0.4.12";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "emlove";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-FNiq/dbh5PMTxnKCKDSHEvllehAEUYvWZS+OyP3lSW8=";
+    hash = "sha256-vS0sk/KjDhWispZvCuGlmVLLfeFymHqxwNzNqNRhg6k=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/tools/conftest/default.nix b/pkgs/development/tools/conftest/default.nix
index 0c13401c5bc7..a20f9f5989bd 100644
--- a/pkgs/development/tools/conftest/default.nix
+++ b/pkgs/development/tools/conftest/default.nix
@@ -6,15 +6,15 @@
 
 buildGoModule rec {
   pname = "conftest";
-  version = "0.40.0";
+  version = "0.41.0";
 
   src = fetchFromGitHub {
     owner = "open-policy-agent";
     repo = "conftest";
     rev = "refs/tags/v${version}";
-    hash = "sha256-4rAu81f2ZkYbK+DQHXlAwFexauWWEo+XaPfcrP2/pbQ=";
+    hash = "sha256-uT0IpoBC4gxshjiKMwzZUApudHCGGh1AF+d6DKJ9GXo=";
   };
-  vendorHash = "sha256-4geHr4bbvnKViC754YznhR33wXbkUxwlV5NNjwhpssY=";
+  vendorHash = "sha256-ucHMCKwtei+2r8P5BdcRPyLqYNStBo8jYOdVI+0adas=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/development/tools/oh-my-posh/default.nix b/pkgs/development/tools/oh-my-posh/default.nix
index 05ac41f3b915..24e56c0bfd20 100644
--- a/pkgs/development/tools/oh-my-posh/default.nix
+++ b/pkgs/development/tools/oh-my-posh/default.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "oh-my-posh";
-  version = "14.22.0";
+  version = "14.27.0";
 
   src = fetchFromGitHub {
     owner = "jandedobbeleer";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-kyASLWzjTFc10XWDLbc66+kaXjBaYmlgBc0Y8fF23Jk=";
+    hash = "sha256-aOUhKETwrPJWPvxkuLdpmSbD38RxMeQywmKq6j617Dk=";
   };
 
   vendorHash = "sha256-MM6WwEs2BMkfpTsDFIqwpIROMs8zbbT5OsP6FXwRvy8=";
diff --git a/pkgs/development/tools/out-of-tree/default.nix b/pkgs/development/tools/out-of-tree/default.nix
index 597d680cc2bb..f76c96dd6f81 100644
--- a/pkgs/development/tools/out-of-tree/default.nix
+++ b/pkgs/development/tools/out-of-tree/default.nix
@@ -2,23 +2,23 @@
 
 buildGoModule rec {
   pname = "out-of-tree";
-  version = "1.4.0";
+  version = "2.0.4";
 
   nativeBuildInputs = [ makeWrapper ];
 
   src = fetchgit {
     rev = "refs/tags/v${version}";
     url = "https://code.dumpstack.io/tools/${pname}.git";
-    sha256 = "1rn824l3dzh3xjxsbzzj053qg1abhzjimc8l73r0n5qrl44k2qk2";
+    sha256 = "sha256-D2LiSDnF7g1h0XTulctCnZ+I6FZSLA0XRd9LQLOMP9c=";
   };
 
-  vendorSha256 = "0kg5c4h7xnwfcfshrh5n76xv98wzr73kxzr8q65iphsjimbxcpy3";
+  vendorSha256 = "sha256-p1dqzng3ak9lrnzrEABhE1TP1lM2Ikc8bmvp5L3nUp0=";
 
   doCheck = false;
 
   postFixup = ''
     wrapProgram $out/bin/out-of-tree \
-      --prefix PATH : "${lib.makeBinPath [ qemu docker which ]}"
+      --prefix PATH : "${lib.makeBinPath [ qemu ]}"
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/tools/rust/cargo-deny/default.nix b/pkgs/development/tools/rust/cargo-deny/default.nix
index 531772889558..65f3fce55f69 100644
--- a/pkgs/development/tools/rust/cargo-deny/default.nix
+++ b/pkgs/development/tools/rust/cargo-deny/default.nix
@@ -2,36 +2,46 @@
 , rustPlatform
 , fetchFromGitHub
 , pkg-config
+, libgit2_1_5
 , openssl
+, zlib
 , zstd
 , stdenv
 , curl
-, Security
+, darwin
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-deny";
-  version = "0.13.7";
+  version = "0.13.8";
 
   src = fetchFromGitHub {
     owner = "EmbarkStudios";
     repo = pname;
     rev = version;
-    sha256 = "sha256-E9tFzac6WkEGfsXj1nykQAR20+5Pi5xMd82MeDed9qg=";
+    hash = "sha256-6RmC54DsL31/SBrA16p+iub7VTQvc1nG+ml+6Xaj0NM=";
   };
 
-  # enable pkg-config feature of zstd
-  cargoPatches = [ ./zstd-pkg-config.patch ];
-
-  cargoSha256 = "sha256-E3Gg7PwBNVkvX2vqtbCxz0kbe1ZWrcAWxj6OJtENBe0=";
+  cargoHash = "sha256-u3hv1phSwZ4oILFMWIAqWhdt0jI8ao3gje1WZA3ZFo8=";
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs = [ openssl zstd ]
-    ++ lib.optionals stdenv.isDarwin [ curl Security ];
+  buildInputs = [
+    libgit2_1_5
+    openssl
+    zlib
+    zstd
+  ] ++ lib.optionals stdenv.isDarwin [
+    curl
+    darwin.apple_sdk.frameworks.Security
+  ];
 
   buildNoDefaultFeatures = true;
 
+  env = {
+    ZSTD_SYS_USE_PKG_CONFIG = true;
+  };
+
   # tests require internet access
   doCheck = false;
 
diff --git a/pkgs/development/tools/rust/cargo-deny/zstd-pkg-config.patch b/pkgs/development/tools/rust/cargo-deny/zstd-pkg-config.patch
deleted file mode 100644
index 346d49e26d04..000000000000
--- a/pkgs/development/tools/rust/cargo-deny/zstd-pkg-config.patch
+++ /dev/null
@@ -1,29 +0,0 @@
---- a/Cargo.lock
-+++ b/Cargo.lock
-@@ -242,6 +242,7 @@ dependencies = [
-  "toml_edit",
-  "twox-hash",
-  "url",
-+ "zstd",
- ]
- 
- [[package]]
-@@ -1904,4 +1905,5 @@ checksum = "2141bed8922b427761470e6bbfeff255da94fa20b0bbeab0d9297fcaf71e3aa7"
- dependencies = [
-  "cc",
-  "libc",
-+ "pkg-config",
- ]
-diff --git a/Cargo.toml b/Cargo.toml
-index 8f24673..b59c350 100644
---- a/Cargo.toml
-+++ b/Cargo.toml
-@@ -92,6 +92,8 @@ twox-hash = { version = "1.5", default-features = false }
- # Url parsing/manipulation
- url = "2.1"
- 
-+zstd = { version = "*", features = ["pkg-config"] }
-+
- [dev-dependencies]
- # Avoid loading license check many times
- lazy_static = "1.4.0"
diff --git a/pkgs/development/tools/rust/cargo-zigbuild/default.nix b/pkgs/development/tools/rust/cargo-zigbuild/default.nix
index 9ae762a7d733..b1292ec69dcc 100644
--- a/pkgs/development/tools/rust/cargo-zigbuild/default.nix
+++ b/pkgs/development/tools/rust/cargo-zigbuild/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-zigbuild";
-  version = "0.16.5";
+  version = "0.16.6";
 
   src = fetchFromGitHub {
     owner = "messense";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-KyfwH2zdKUUazIZoea8XVOo+vGbPrx5x00IceUuAPXM=";
+    sha256 = "sha256-0YrEhzZUkstlc2Y3VVfmSsOl4H8oFISMbviW0BzdTB4=";
   };
 
-  cargoSha256 = "sha256-z+NTfF+7zbfRt5/uvno4Z2hA6onVBWKR6Tje2KClkc0=";
+  cargoSha256 = "sha256-xPtW1vfkhe1CIZSgpNwLVn3kNr3M/Dbk5fRBqxUlFd8=";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/misc/drivers/utsushi/networkscan.nix b/pkgs/misc/drivers/utsushi/networkscan.nix
index c0416a11be3c..b9aa1cbe904f 100644
--- a/pkgs/misc/drivers/utsushi/networkscan.nix
+++ b/pkgs/misc/drivers/utsushi/networkscan.nix
@@ -6,7 +6,10 @@ stdenv.mkDerivation rec {
   version = "1.1.4";
 
   src = fetchurl {
-    url = "https://download2.ebz.epson.net/imagescanv3/fedora/latest1/rpm/x64/imagescan-bundle-fedora-32-${imagescanVersion}.x64.rpm.tar.gz";
+    urls = [
+      "https://buzo.eu/mirror/epson/imagescan-bundle-fedora-32-${imagescanVersion}.x64.rpm.tar.gz"
+      "https://web.archive.org/web/20221027001620if_/https://download2.ebz.epson.net/imagescanv3/fedora/latest1/rpm/x64/imagescan-bundle-fedora-32-${imagescanVersion}.x64.rpm.tar.gz"
+    ];
     sha256 = "sha256-fxi63sV+YJOlv1aVTfCPIXOPfNAo+R7zNPvA11sFmMk=";
   };
 
diff --git a/pkgs/servers/sql/postgresql/ext/plv8/default.nix b/pkgs/servers/sql/postgresql/ext/plv8/default.nix
index be743401f2c9..e4492c4e5186 100644
--- a/pkgs/servers/sql/postgresql/ext/plv8/default.nix
+++ b/pkgs/servers/sql/postgresql/ext/plv8/default.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "plv8";
-  version = "3.1.4";
+  version = "3.1.5";
 
   src = fetchFromGitHub {
     owner = "plv8";
     repo = "plv8";
     rev = "v${finalAttrs.version}";
-    sha256 = "GoPP2nAeDItBt3Lug49s+brD0gIy3iDlJpbyHRuMcZ4=";
+    hash = "sha256-LodC2eQJSm5fLckrjm2RuejZhmOyQMJTv9b0iPCnzKQ=";
   };
 
   patches = [
diff --git a/pkgs/tools/admin/qovery-cli/default.nix b/pkgs/tools/admin/qovery-cli/default.nix
index 786a540f6f1a..9663ce18221d 100644
--- a/pkgs/tools/admin/qovery-cli/default.nix
+++ b/pkgs/tools/admin/qovery-cli/default.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "qovery-cli";
-  version = "0.56.0";
+  version = "0.56.3";
 
   src = fetchFromGitHub {
     owner = "Qovery";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-hbFE2gj4fLA8N8Gh5QvwxfOlPfWTpLlia1lsfQ+RkaU=";
+    hash = "sha256-DJkVIZBuKM5magrhW/+9IdvU5IVEFfF293X6vbFCfmI=";
   };
 
   vendorHash = "sha256-1krHpwjs4kGhPMBF5j3iqUBo8TGKs1h+nDCmDmviPu4=";
diff --git a/pkgs/tools/filesystems/glusterfs/default.nix b/pkgs/tools/filesystems/glusterfs/default.nix
index a1d09df7e609..ccaabf5f2841 100644
--- a/pkgs/tools/filesystems/glusterfs/default.nix
+++ b/pkgs/tools/filesystems/glusterfs/default.nix
@@ -55,13 +55,13 @@ let
   ];
 in stdenv.mkDerivation rec {
   pname = "glusterfs";
-  version = "10.1";
+  version = "10.3";
 
   src = fetchFromGitHub {
     owner = "gluster";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-vVFC2kQNneaOwrezPehOX32dpJb88ZhGHBApEXc9MOg=";
+    sha256 = "sha256-2+zdEbvXwfjAyeWpy0TAWRE0kvqSUqebmRyuhdfzYd0=";
   };
   inherit buildInputs propagatedBuildInputs;
 
diff --git a/pkgs/tools/filesystems/glusterfs/ssl_cert_path.patch b/pkgs/tools/filesystems/glusterfs/ssl_cert_path.patch
index 5964e14787e7..71b632e12eae 100644
--- a/pkgs/tools/filesystems/glusterfs/ssl_cert_path.patch
+++ b/pkgs/tools/filesystems/glusterfs/ssl_cert_path.patch
@@ -7,7 +7,7 @@ index fb8db11e9e..4c40683057 100644
  dnl Find out OpenSSL trusted certificates path
  AC_MSG_CHECKING([for OpenSSL trusted certificates path])
 -SSL_CERT_PATH=$(openssl version -d | sed -e 's|OPENSSLDIR: "\(.*\)".*|\1|')
--if test -d $SSL_CERT_PATH 1>/dev/null 2>&1; then
+-if test -d "${SSL_CERT_PATH}" 1>/dev/null 2>&1; then
 -   AC_MSG_RESULT([$SSL_CERT_PATH])
 -   AC_DEFINE_UNQUOTED(SSL_CERT_PATH, ["$SSL_CERT_PATH"], [Path to OpenSSL trusted certificates.])
 -   AC_SUBST(SSL_CERT_PATH)
diff --git a/pkgs/tools/typesetting/hayagriva/default.nix b/pkgs/tools/typesetting/hayagriva/default.nix
new file mode 100644
index 000000000000..9f33ae6006e2
--- /dev/null
+++ b/pkgs/tools/typesetting/hayagriva/default.nix
@@ -0,0 +1,26 @@
+{ lib
+, rustPlatform
+, fetchCrate
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "hayagriva";
+  version = "0.3.0";
+
+  src = fetchCrate {
+    inherit pname version;
+    hash = "sha256-zp7YfMmp16YRWNcOf5aVt1vXnL+23+DyFeFn7Gow7wM=";
+  };
+
+  cargoHash = "sha256-jsVd4vyST563HiXvqCfiZ2oUhNXF4E8Y2HBLl5AtvRw=";
+
+  buildFeatures = [ "cli" ];
+
+  meta = with lib; {
+    description = "Work with references: Literature database management, storage, and citation formatting";
+    homepage = "https://github.com/typst/hayagriva";
+    changelog = "https://github.com/typst/hayagriva/releases/tag/v${version}";
+    license = with licenses; [ asl20 mit ];
+    maintainers = with maintainers; [ figsoda ];
+  };
+}
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 5aeaefb0a2cf..f595980a54a3 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1472,6 +1472,7 @@ mapAliases ({
   slack-dark = slack; # Added 2020-03-27
   sleepyhead = throw "'sleepyhead' has been renamed to/replaced by 'OSCAR'"; # Added 2022-11-20
   slic3r-prusa3d = throw "'slic3r-prusa3d' has been renamed to/replaced by 'prusa-slicer'"; # Converted to throw 2022-02-22
+  slmenu = throw "slmenu has been removed (upstream is gone)"; # Added 2023-04-06
   slurm-full = throw "'slurm-full' has been renamed to/replaced by 'slurm'"; # Converted to throw 2022-02-22
   slurm-llnl = slurm; # renamed July 2017
   slurm-llnl-full = slurm-full; # renamed July 2017
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 250edaf15294..6635791945f4 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -8308,6 +8308,8 @@ with pkgs;
 
   harmonia = callPackage ../tools/package-management/harmonia { };
 
+  hayagriva = callPackage ../tools/typesetting/hayagriva { };
+
   hcl2json = callPackage ../applications/misc/hcl2json { };
 
   hcxtools = callPackage ../tools/security/hcxtools { };
@@ -16023,9 +16025,7 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) Security SystemConfiguration CoreFoundation;
   };
   cargo-cross = callPackage ../development/tools/rust/cargo-cross { };
-  cargo-deny = callPackage ../development/tools/rust/cargo-deny {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  cargo-deny = callPackage ../development/tools/rust/cargo-deny { };
   cargo-depgraph = callPackage ../development/tools/rust/cargo-depgraph { };
   cargo-dephell = callPackage ../development/tools/rust/cargo-dephell {
     inherit (darwin.apple_sdk.frameworks) Security;
@@ -33525,8 +33525,6 @@ with pkgs;
 
   SkypeExport = callPackage ../applications/networking/instant-messengers/SkypeExport { };
 
-  slmenu = callPackage ../applications/misc/slmenu { };
-
   slop = callPackage ../tools/misc/slop { };
 
   slowhttptest = callPackage ../tools/security/slowhttptest { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index ed33c371e4ee..f92e2243fd1e 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -8134,6 +8134,8 @@ self: super: with self; {
 
   pydevd = callPackage ../development/python-modules/pydevd { };
 
+  pydevtool = callPackage ../development/python-modules/pydevtool { };
+
   pydexcom = callPackage ../development/python-modules/pydexcom { };
 
   pydicom = callPackage ../development/python-modules/pydicom { };