diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index aae3ad24214f..88a4f7a881c9 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -6403,6 +6403,15 @@
     githubId = 6074754;
     name = "Hlodver Sigurdsson";
   };
+  hmajid2301 = {
+    name = "Haseeb Majid";
+    email = "hello@haseebmajid.dev";
+    github = "hmajid2301";
+    githubId = 998807;
+    keys = [{
+      fingerprint = "A236 785D 59F1 9076 1E9C E8EC 7828 3DB3 D233 E1F9";
+    }];
+  };
   hmenke = {
     name = "Henri Menke";
     email = "henri@henrimenke.de";
diff --git a/nixos/doc/manual/release-notes/rl-2305.section.md b/nixos/doc/manual/release-notes/rl-2305.section.md
index 6bf560c6017a..770c65f9d10d 100644
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@@ -194,6 +194,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - `graylog` has been updated to version 5, which can not be upgraded directly from the previously packaged version 3.3. If you had installed the previously packaged version 3.3, please follow the [upgrade path](https://go2docs.graylog.org/5-0/upgrading_graylog/upgrade_path.htm) from 3.3 to 4.0 to 4.3 to 5.0.
 
+- `buildFHSUserEnv` is now called `buildFHSEnv` and uses FlatPak's Bubblewrap sandboxing tool rather than Nixpkgs' own chrootenv. The old chrootenv-based implemenation is still available via `buildFHSEnvChrootenv` but is considered deprecated and will be removed when the remaining uses inside Nixpkgs have been migrated. If your FHSEnv-wrapped application misbehaves when using the new bubblewrap implementation, please create an issue in Nixpkgs.
+
 - `nushell` has been updated to at least version 0.77.0, which includes potential breaking changes in aliases. The old aliases are now available as `old-alias` but it is recommended you migrate to the new format. See [Reworked aliases](https://www.nushell.sh/blog/2023-03-14-nushell_0_77.html#reworked-aliases-breaking-changes-kubouch).
 
 - `gajim` has been updated to version 1.7.3 which has disabled legacy ciphers. See [changelog for version 1.7.0](https://dev.gajim.org/gajim/gajim/-/releases/1.7.0).
diff --git a/nixos/modules/services/x11/window-managers/default.nix b/nixos/modules/services/x11/window-managers/default.nix
index 48b413beaa86..ce1d4115f225 100644
--- a/nixos/modules/services/x11/window-managers/default.nix
+++ b/nixos/modules/services/x11/window-managers/default.nix
@@ -14,6 +14,7 @@ in
     ./bspwm.nix
     ./cwm.nix
     ./clfswm.nix
+    ./dk.nix
     ./dwm.nix
     ./e16.nix
     ./evilwm.nix
diff --git a/nixos/modules/services/x11/window-managers/dk.nix b/nixos/modules/services/x11/window-managers/dk.nix
new file mode 100644
index 000000000000..152c7bc8117b
--- /dev/null
+++ b/nixos/modules/services/x11/window-managers/dk.nix
@@ -0,0 +1,27 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.services.xserver.windowManager.dk;
+in
+
+{
+  options = {
+    services.xserver.windowManager.dk = {
+      enable = lib.mkEnableOption (lib.mdDoc "dk");
+
+      package = lib.mkPackageOptionMD pkgs "dk" { };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.xserver.windowManager.session = lib.singleton {
+      name = "dk";
+      start = ''
+        export _JAVA_AWT_WM_NONREPARENTING=1
+        ${cfg.package}/bin/dk &
+        waitPID=$!
+      '';
+    };
+    environment.systemPackages = [ cfg.package ];
+  };
+}
diff --git a/nixos/modules/system/boot/systemd/logind.nix b/nixos/modules/system/boot/systemd/logind.nix
index b0c927f19f9d..cf01c1882857 100644
--- a/nixos/modules/system/boot/systemd/logind.nix
+++ b/nixos/modules/system/boot/systemd/logind.nix
@@ -11,64 +11,145 @@ let
   ];
 in
 {
-  options = {
-    services.logind.extraConfig = mkOption {
+  options.services.logind = {
+    extraConfig = mkOption {
       default = "";
       type = types.lines;
       example = "IdleAction=lock";
       description = lib.mdDoc ''
-        Extra config options for systemd-logind. See
-        [
-        logind.conf(5)](https://www.freedesktop.org/software/systemd/man/logind.conf.html) for available options.
+        Extra config options for systemd-logind.
+        See [logind.conf(5)](https://www.freedesktop.org/software/systemd/man/logind.conf.html)
+        for available options.
       '';
     };
 
-    services.logind.killUserProcesses = mkOption {
+    killUserProcesses = mkOption {
       default = false;
       type = types.bool;
       description = lib.mdDoc ''
         Specifies whether the processes of a user should be killed
         when the user logs out.  If true, the scope unit corresponding
         to the session and all processes inside that scope will be
-        terminated.  If false, the scope is "abandoned" (see
-        [systemd.scope(5)](https://www.freedesktop.org/software/systemd/man/systemd.scope.html#)), and processes are not killed.
+        terminated.  If false, the scope is "abandoned"
+        (see [systemd.scope(5)](https://www.freedesktop.org/software/systemd/man/systemd.scope.html#)),
+        and processes are not killed.
 
         See [logind.conf(5)](https://www.freedesktop.org/software/systemd/man/logind.conf.html#KillUserProcesses=)
         for more details.
       '';
     };
 
-    services.logind.lidSwitch = mkOption {
+    powerKey = mkOption {
+      default = "poweroff";
+      example = "ignore";
+      type = logindHandlerType;
+
+      description = lib.mdDoc ''
+        Specifies what to do when the power key is pressed.
+      '';
+    };
+
+    powerKeyLongPress = mkOption {
+      default = "ignore";
+      example = "reboot";
+      type = logindHandlerType;
+
+      description = lib.mdDoc ''
+        Specifies what to do when the power key is long-pressed.
+      '';
+    };
+
+    rebootKey = mkOption {
+      default = "reboot";
+      example = "ignore";
+      type = logindHandlerType;
+
+      description = lib.mdDoc ''
+        Specifies what to do when the reboot key is pressed.
+      '';
+    };
+
+    rebootKeyLongPress = mkOption {
+      default = "poweroff";
+      example = "ignore";
+      type = logindHandlerType;
+
+      description = lib.mdDoc ''
+        Specifies what to do when the reboot key is long-pressed.
+      '';
+    };
+
+    suspendKey = mkOption {
       default = "suspend";
       example = "ignore";
       type = logindHandlerType;
 
       description = lib.mdDoc ''
-        Specifies what to be done when the laptop lid is closed.
+        Specifies what to do when the suspend key is pressed.
       '';
     };
 
-    services.logind.lidSwitchDocked = mkOption {
+    suspendKeyLongPress = mkOption {
+      default = "hibernate";
+      example = "ignore";
+      type = logindHandlerType;
+
+      description = lib.mdDoc ''
+        Specifies what to do when the suspend key is long-pressed.
+      '';
+    };
+
+    hibernateKey = mkOption {
+      default = "hibernate";
+      example = "ignore";
+      type = logindHandlerType;
+
+      description = lib.mdDoc ''
+        Specifies what to do when the hibernate key is pressed.
+      '';
+    };
+
+    hibernateKeyLongPress = mkOption {
       default = "ignore";
       example = "suspend";
       type = logindHandlerType;
 
       description = lib.mdDoc ''
-        Specifies what to be done when the laptop lid is closed
-        and another screen is added.
+        Specifies what to do when the hibernate key is long-pressed.
       '';
     };
 
-    services.logind.lidSwitchExternalPower = mkOption {
+    lidSwitch = mkOption {
+      default = "suspend";
+      example = "ignore";
+      type = logindHandlerType;
+
+      description = lib.mdDoc ''
+        Specifies what to do when the laptop lid is closed.
+      '';
+    };
+
+    lidSwitchExternalPower = mkOption {
       default = cfg.lidSwitch;
       defaultText = literalExpression "services.logind.lidSwitch";
       example = "ignore";
       type = logindHandlerType;
 
       description = lib.mdDoc ''
-        Specifies what to do when the laptop lid is closed and the system is
-        on external power. By default use the same action as specified in
-        services.logind.lidSwitch.
+        Specifies what to do when the laptop lid is closed
+        and the system is on external power. By default use
+        the same action as specified in services.logind.lidSwitch.
+      '';
+    };
+
+    lidSwitchDocked = mkOption {
+      default = "ignore";
+      example = "suspend";
+      type = logindHandlerType;
+
+      description = lib.mdDoc ''
+        Specifies what to do when the laptop lid is closed
+        and another screen is added.
       '';
     };
   };
@@ -94,9 +175,17 @@ in
       "systemd/logind.conf".text = ''
         [Login]
         KillUserProcesses=${if cfg.killUserProcesses then "yes" else "no"}
+        HandlePowerKey=${cfg.powerKey}
+        HandlePowerKeyLongPress=${cfg.powerKeyLongPress}
+        HandleRebootKey=${cfg.rebootKey}
+        HandleRebootKeyLongPress=${cfg.rebootKeyLongPress}
+        HandleSuspendKey=${cfg.suspendKey}
+        HandleSuspendKeyLongPress=${cfg.suspendKeyLongPress}
+        HandleHibernateKey=${cfg.hibernateKey}
+        HandleHibernateKeyLongPress=${cfg.hibernateKeyLongPress}
         HandleLidSwitch=${cfg.lidSwitch}
-        HandleLidSwitchDocked=${cfg.lidSwitchDocked}
         HandleLidSwitchExternalPower=${cfg.lidSwitchExternalPower}
+        HandleLidSwitchDocked=${cfg.lidSwitchDocked}
         ${cfg.extraConfig}
       '';
     };
diff --git a/pkgs/applications/audio/furnace/default.nix b/pkgs/applications/audio/furnace/default.nix
index 372a873ca580..d916e68292e2 100644
--- a/pkgs/applications/audio/furnace/default.nix
+++ b/pkgs/applications/audio/furnace/default.nix
@@ -10,6 +10,7 @@
 , fftw
 , fmt_8
 , libsndfile
+, libX11
 , rtmidi
 , SDL2
 , zlib
@@ -21,16 +22,23 @@
 
 stdenv.mkDerivation rec {
   pname = "furnace";
-  version = "0.6pre4-hotfix";
+  version = "0.6pre5";
 
   src = fetchFromGitHub {
     owner = "tildearrow";
     repo = "furnace";
     rev = "v${version}";
     fetchSubmodules = true;
-    sha256 = "sha256-lJtV/0GnWN5mSjv2LaPEMnkuThaNeijBMjLGFPOJX4k=";
+    sha256 = "sha256-6KiG7nfQUdPW+EkBW3PPM141kOmolAgrrqhEGH/Azg4=";
   };
 
+  postPatch = lib.optionalString stdenv.hostPlatform.isLinux ''
+    # To offer scaling detection on X11, furnace checks if libX11.so is available via dlopen and uses some of its functions
+    # But it's being linked against a versioned libX11.so.VERSION via SDL, so the unversioned one is not on the rpath
+    substituteInPlace src/gui/scaling.cpp \
+      --replace 'libX11.so' '${lib.getLib libX11}/lib/libX11.so'
+  '';
+
   nativeBuildInputs = [
     cmake
     pkg-config
@@ -97,6 +105,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Multi-system chiptune tracker compatible with DefleMask modules";
     homepage = "https://github.com/tildearrow/furnace";
+    changelog = "https://github.com/tildearrow/furnace/releases/tag/v${version}";
     license = with licenses; [ gpl2Plus ];
     maintainers = with maintainers; [ OPNA2608 ];
     platforms = platforms.all;
diff --git a/pkgs/applications/audio/musikcube/default.nix b/pkgs/applications/audio/musikcube/default.nix
index 92b12140c47b..9c6c8d30f4c5 100644
--- a/pkgs/applications/audio/musikcube/default.nix
+++ b/pkgs/applications/audio/musikcube/default.nix
@@ -32,13 +32,13 @@
 
 stdenv.mkDerivation rec {
   pname = "musikcube";
-  version = "3.0.0";
+  version = "3.0.1";
 
   src = fetchFromGitHub {
     owner = "clangen";
     repo = pname;
     rev = version;
-    hash = "sha512-W+Zug1SiOGJ+o6FBf2jeDGHFj87vudR4drtjyXiOzdoM8fUCnCj4pp7+70eZGilg6CvBi7CYkbVn53LXJf5qWA==";
+    hash = "sha512-ahKPmChHRVpOQcgt0fOYumlsMApeN4MWwywE9F0edeN0Xr3Vp830mWGzEBJvMvGI/lnU/1rd7tREaHfm1vCJaw==";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/applications/editors/neovim/default.nix b/pkgs/applications/editors/neovim/default.nix
index cdc274604d2c..9294e7423159 100644
--- a/pkgs/applications/editors/neovim/default.nix
+++ b/pkgs/applications/editors/neovim/default.nix
@@ -1,5 +1,4 @@
 { lib, stdenv, fetchFromGitHub, cmake, gettext, msgpack, libtermkey, libiconv
-, fetchpatch
 , libuv, lua, ncurses, pkg-config
 , unibilium, gperf
 , libvterm-neovim
@@ -37,13 +36,13 @@ let
 in
   stdenv.mkDerivation rec {
     pname = "neovim-unwrapped";
-    version = "0.9.0";
+    version = "0.9.1";
 
     src = fetchFromGitHub {
       owner = "neovim";
       repo = "neovim";
       rev = "v${version}";
-      hash = "sha256-4uCPWnjSMU7ac6Q3LT+Em8lVk1MuSegxHMLGQRtFqAs=";
+      hash = "sha256-G51qD7GklEn0JrneKSSqDDx0Odi7W2FjdQc0ZDE9ZK4=";
     };
 
     patches = [
@@ -51,14 +50,6 @@ in
       # necessary so that nix can handle `UpdateRemotePlugins` for the plugins
       # it installs. See https://github.com/neovim/neovim/issues/9413.
       ./system_rplugin_manifest.patch
-
-      # fix bug with the gsub directive
-      # https://github.com/neovim/neovim/pull/23015
-      (fetchpatch {
-        name = "use-the-correct-replacement-args-for-gsub-directive.patch";
-        url = "https://github.com/neovim/neovim/commit/ccc0980f86c6ef9a86b0e5a3a691f37cea8eb776.patch";
-        hash = "sha256-sZWM6M8jCL1e72H0bAc51a6FrH0mFFqTV1gGLwKT7Zo=";
-      })
     ];
 
     dontFixCmake = true;
diff --git a/pkgs/applications/misc/swaynotificationcenter/default.nix b/pkgs/applications/misc/swaynotificationcenter/default.nix
index e9d9a9ef3872..639edced0fba 100644
--- a/pkgs/applications/misc/swaynotificationcenter/default.nix
+++ b/pkgs/applications/misc/swaynotificationcenter/default.nix
@@ -28,13 +28,13 @@
 
 stdenv.mkDerivation (finalAttrs: rec {
   pname = "SwayNotificationCenter";
-  version = "0.8.0";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "ErikReider";
-    repo = "SwayNotificationCenter";
+    repo = pname;
     rev = "v${version}";
-    hash = "sha256-E9CjNx/xzkkOZ39XbfIb1nJFheZVFpj/lwmITKtpb7A=";
+    hash = "sha256-mwwSTs4d9jUXUy33nSYJCRFlpH6naCmbRUSpfVacMBE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/cluster/kyverno/default.nix b/pkgs/applications/networking/cluster/kyverno/default.nix
index e604eb58fced..002dd8c02f7f 100644
--- a/pkgs/applications/networking/cluster/kyverno/default.nix
+++ b/pkgs/applications/networking/cluster/kyverno/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "kyverno";
-  version = "1.9.4";
+  version = "1.9.5";
 
   src = fetchFromGitHub {
     owner = "kyverno";
     repo = "kyverno";
     rev = "v${version}";
-    sha256 = "sha256-rpqhDnXxbWKa1WB7WBS6Ri7XiPWv3e0evCXFSBcaD6c=";
+    sha256 = "sha256-e/CZ5XiJFvj/HVSBPTyLybu5ZZNVte3Bf/qGhEK7k80=";
   };
 
   ldflags = [
diff --git a/pkgs/applications/networking/instant-messengers/slack/default.nix b/pkgs/applications/networking/instant-messengers/slack/default.nix
index 57892ba31d46..4d8c1d4aee98 100644
--- a/pkgs/applications/networking/instant-messengers/slack/default.nix
+++ b/pkgs/applications/networking/instant-messengers/slack/default.nix
@@ -45,14 +45,14 @@ let
 
   pname = "slack";
 
-  x86_64-darwin-version = "4.29.149";
-  x86_64-darwin-sha256 = "sha256-E0YnOPnaWFe17gCpFywxu5uHs1pEktA1tUu4QqvKhYw=";
+  x86_64-darwin-version = "4.32.122";
+  x86_64-darwin-sha256 = "sha256-aKvMtuo3cNJsw42RNezmETsLAtl6G2yqYGOGp2Pt32U=3";
 
-  x86_64-linux-version = "4.29.149";
-  x86_64-linux-sha256 = "sha256-ulXIGLp2ql47ZS6IeaMuqye39deDtukOB1dxy5BNCwI=";
+  x86_64-linux-version = "4.32.122";
+  x86_64-linux-sha256 = "sha256-ViJHG7s7xqnatNOss5mfa7GqqlHbBrLGHBzTqqo7W/w=";
 
-  aarch64-darwin-version = "4.29.149";
-  aarch64-darwin-sha256 = "sha256-Nn+dFD3H/By+aBPLDxnPneNXuFl+tHdLhxJXeYBMORg=";
+  aarch64-darwin-version = "4.32.122";
+  aarch64-darwin-sha256 = "sha256-j3PbH/5cKN5+vUiLvXaxyPYilt6GX6FsGo+1hlJKrls=";
 
   version = {
     x86_64-darwin = x86_64-darwin-version;
diff --git a/pkgs/applications/version-management/lefthook/default.nix b/pkgs/applications/version-management/lefthook/default.nix
index 1e35634216fa..91cf55b59086 100644
--- a/pkgs/applications/version-management/lefthook/default.nix
+++ b/pkgs/applications/version-management/lefthook/default.nix
@@ -6,7 +6,7 @@
 
 let
   pname = "lefthook";
-  version = "1.4.0";
+  version = "1.4.1";
 in
 buildGoModule rec {
   inherit pname version;
@@ -15,10 +15,10 @@ buildGoModule rec {
     owner = "evilmartians";
     repo = "lefthook";
     rev = "v${version}";
-    hash = "sha256-nov/0iPlMsqFWh//0Mc7JVNiLzX1I0qmkey0fkm+2k8=";
+    hash = "sha256-odcgO7n39sPUdLaAEQqxx2dZrgmvH3fpqmUYB41GZAE=";
   };
 
-  vendorHash = "sha256-dWJ8B51zk3uhe8j60wP0PJz/4YhAL7OJbk/96eoLdSs=";
+  vendorHash = "sha256-V94g7Ua8GWUOWM8Z4ENXmZlHXRUMHb8cKuoTztjHtnc=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/applications/video/manim/default.nix b/pkgs/applications/video/manim/default.nix
index bcb6eca16321..c4443af00dbe 100644
--- a/pkgs/applications/video/manim/default.nix
+++ b/pkgs/applications/video/manim/default.nix
@@ -1,5 +1,6 @@
 { lib
 , fetchFromGitHub
+, fetchPypi
 
 , cairo
 , ffmpeg
@@ -42,7 +43,30 @@ let
     fundus-calligra microtype wasysym physics dvisvgm jknapltx wasy cm-super
     babel-english gnu-freefont mathastext cbfonts-fd;
   };
-in python3.pkgs.buildPythonApplication rec {
+
+  python = python3.override {
+    packageOverrides = self: super: {
+      networkx = super.networkx.overridePythonAttrs (oldAttrs: rec {
+        pname = "networkx";
+        version = "2.8.8";
+        src = fetchPypi {
+          inherit pname version;
+          hash = "sha256-Iw04gRevhw/OVkejxSQB/PdT6Ucg5uprQZelNVZIiF4=";
+        };
+      });
+
+      watchdog = super.watchdog.overridePythonAttrs (oldAttrs: rec{
+        pname = "watchdog";
+        version = "2.3.1";
+        src = fetchPypi {
+          inherit pname version;
+          hash = "sha256-2fntJu0iqdMxggqEMsNoBwfqi1QSHdzJ3H2fLO6zaQY=";
+        };
+      });
+    };
+  };
+
+in python.pkgs.buildPythonApplication rec {
   pname = "manim";
   format = "pyproject";
   version = "0.16.0.post0";
@@ -55,8 +79,8 @@ in python3.pkgs.buildPythonApplication rec {
     sha256 = "sha256-iXiPnI6lTP51P1X3iLp75ArRP66o8WAANBLoStPrz4M=";
   };
 
-  nativeBuildInputs = [
-    python3.pkgs.poetry-core
+  nativeBuildInputs = with python.pkgs; [
+    poetry-core
   ];
 
   postPatch = ''
@@ -69,7 +93,7 @@ in python3.pkgs.buildPythonApplication rec {
 
   buildInputs = [ cairo ];
 
-  propagatedBuildInputs = with python3.pkgs; [
+  propagatedBuildInputs = with python.pkgs; [
     click
     click-default-group
     cloup
@@ -106,14 +130,13 @@ in python3.pkgs.buildPythonApplication rec {
     ])
   ];
 
-
   nativeCheckInputs = [
-    python3.pkgs.pytest-xdist
-    python3.pkgs.pytestCheckHook
-
     ffmpeg
     (texlive.combine manim-tinytex)
-  ];
+  ] ++ (with python.pkgs; [
+    pytest-xdist
+    pytestCheckHook
+  ]);
 
   # about 55 of ~600 tests failing mostly due to demand for display
   disabledTests = import ./failing_tests.nix;
diff --git a/pkgs/applications/video/manim/failing_tests.nix b/pkgs/applications/video/manim/failing_tests.nix
index 571ddebc74a1..70c3efbb610c 100644
--- a/pkgs/applications/video/manim/failing_tests.nix
+++ b/pkgs/applications/video/manim/failing_tests.nix
@@ -1,5 +1,5 @@
-# reason for failure: tests try to open display
 [
+  # reason for failure: tests try to open display
   "test_background_color"
   "test_scene_add_remove"
   "test_Circle"
@@ -46,31 +46,29 @@
   "test_force_window_opengl_render_with_format"
   "test_get_frame_with_preview_disabled"
   "test_get_frame_with_preview_enabled"
-] ++
 
-# reason for failure: tests try to reach network
-[
+  # reason for failure: tests try to reach network
   "test_logging_to_file"
   "test_plugin_function_like"
   "test_plugin_no_all"
   "test_plugin_with_all"
-] ++
 
-# failing with:
-# E           AssertionError:
-# E           Not equal to tolerance rtol=1e-07, atol=1.01
-# E           Frame no -1. You can use --show_diff to visually show the difference.
-# E           Mismatched elements: 18525 / 1639680 (1.13%)
-# E           Max absolute difference: 255
-# E           Max relative difference: 255.
-[
+  # failing with:
+  # E           AssertionError:
+  # E           Not equal to tolerance rtol=1e-07, atol=1.01
+  # E           Frame no -1. You can use --show_diff to visually show the difference.
+  # E           Mismatched elements: 18525 / 1639680 (1.13%)
+  # E           Max absolute difference: 255
+  # E           Max relative difference: 255.
   "test_Text2Color"
   "test_PointCloudDot"
   "test_Torus"
-] ++
 
-# failing with:
-# TypeError: __init__() got an unexpected keyword argument 'msg' - maybe you meant pytest.mark.skipif?
-[
+  # failing with:
+  # TypeError: __init__() got an unexpected keyword argument 'msg' - maybe you meant pytest.mark.skipif?
   "test_force_window_opengl_render_with_movies"
+
+  # mismatching expecation on the new commandline
+  "test_manim_new_command"
+
 ]
diff --git a/pkgs/applications/video/srt-live-server/add-ctime-include.patch b/pkgs/applications/video/srt-live-server/add-ctime-include.patch
new file mode 100644
index 000000000000..2e1931ab1222
--- /dev/null
+++ b/pkgs/applications/video/srt-live-server/add-ctime-include.patch
@@ -0,0 +1,11 @@
+diff --git a/slscore/common.hpp b/slscore/common.hpp
+index 30aeeea..bed0e62 100644
+--- a/slscore/common.hpp
++++ b/slscore/common.hpp
+@@ -29,6 +29,7 @@
+ #include <stddef.h>
+ #include <stdint.h>
+ #include <string>
++#include <ctime>
+ #include <vector>
+ #include <unistd.h>
diff --git a/pkgs/applications/video/srt-live-server/default.nix b/pkgs/applications/video/srt-live-server/default.nix
index e02d15a595bf..8bc3cd330b65 100644
--- a/pkgs/applications/video/srt-live-server/default.nix
+++ b/pkgs/applications/video/srt-live-server/default.nix
@@ -19,6 +19,9 @@ stdenv.mkDerivation rec {
   patches = [
     # https://github.com/Edward-Wu/srt-live-server/pull/94
     ./fix-insecure-printfs.patch
+
+    # https://github.com/Edward-Wu/srt-live-server/pull/127  # adds `#include <ctime>`
+    ./add-ctime-include.patch
   ];
 
   buildInputs = [ srt zlib ];
diff --git a/pkgs/applications/window-managers/dk/default.nix b/pkgs/applications/window-managers/dk/default.nix
new file mode 100644
index 000000000000..761f9029c9ee
--- /dev/null
+++ b/pkgs/applications/window-managers/dk/default.nix
@@ -0,0 +1,45 @@
+{ lib
+, stdenv
+, fetchFromBitbucket
+, xcbutil
+, xcbutilkeysyms
+, xcbutilwm
+, xcb-util-cursor
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "dk";
+  version = "1.9";
+
+  src = fetchFromBitbucket {
+    owner = "natemaia";
+    repo = "dk";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-OodD2z9C4oGTK6ynAXRlEZSzzdzIkVjmq5vLdUcht1U=";
+  };
+
+  buildInputs = [
+    xcbutil
+    xcbutilkeysyms
+    xcbutilwm
+    xcb-util-cursor
+  ];
+
+  postPatch = ''
+    substituteInPlace Makefile \
+      --replace "-L/usr/X11R6/lib" "" \
+      --replace "-I/usr/X11R6/include" ""
+  '';
+
+  makeFlags = [ "PREFIX=$(out)" "SES=$(out)/share/xsessions" ];
+
+  enableParallelBuilding = true;
+
+  meta = {
+    homepage = "https://bitbucket.org/natemaia/dk";
+    description = "A list based tiling window manager in the vein of dwm, bspwm, and xmonad";
+    license = lib.licenses.x11;
+    maintainers = with lib.maintainers; [ _3JlOy-PYCCKUi ];
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/build-support/trivial-builders/default.nix b/pkgs/build-support/trivial-builders/default.nix
index d3cb22a1f535..7152f9a1be41 100644
--- a/pkgs/build-support/trivial-builders/default.nix
+++ b/pkgs/build-support/trivial-builders/default.nix
@@ -141,7 +141,7 @@ rec {
     runCommand name
       { inherit text executable checkPhase allowSubstitutes preferLocalBuild;
         passAsFile = [ "text" ];
-        meta = lib.optionalAttrs (executable && matches != null) {
+        meta = lib.optionalAttrs (toString executable != "" && matches != null) {
           mainProgram = lib.head matches;
         } // meta;
       }
diff --git a/pkgs/development/compilers/dtc/0001-Depend-on-.a-instead-of-.so-when-building-static.patch b/pkgs/development/compilers/dtc/0001-Depend-on-.a-instead-of-.so-when-building-static.patch
deleted file mode 100644
index dcc3a08c1eda..000000000000
--- a/pkgs/development/compilers/dtc/0001-Depend-on-.a-instead-of-.so-when-building-static.patch
+++ /dev/null
@@ -1,90 +0,0 @@
-From c1d426bdd477ffeb3dfa03501de089a341b85d0b Mon Sep 17 00:00:00 2001
-From: Tero Tervala <tero.tervala@unikie.com>
-Date: Wed, 15 Jun 2022 13:44:55 +0300
-Subject: [PATCH] Depend on .a instead of .so when building static
-
-Static build needs to be indicated with environment variable:
-STATIC_BUILD=1
-
-Checks are skipped on static builds
-
-Signed-off-by: Tero Tervala <tero.tervala@unikie.com>
----
- Makefile             | 12 +++++++++---
- tests/Makefile.tests | 11 ++++++++---
- 2 files changed, 17 insertions(+), 6 deletions(-)
-
-diff --git a/Makefile b/Makefile
-index ee77115..9f550b4 100644
---- a/Makefile
-+++ b/Makefile
-@@ -198,6 +198,12 @@ LIBFDT_lib = $(LIBFDT_dir)/$(LIBFDT_LIB)
- LIBFDT_include = $(addprefix $(LIBFDT_dir)/,$(LIBFDT_INCLUDES))
- LIBFDT_version = $(addprefix $(LIBFDT_dir)/,$(LIBFDT_VERSION))
- 
-+ifeq ($(STATIC_BUILD),1)
-+	LIBFDT_dep = $(LIBFDT_archive)
-+else
-+	LIBFDT_dep = $(LIBFDT_lib)
-+endif
-+
- include $(LIBFDT_dir)/Makefile.libfdt
- 
- .PHONY: libfdt
-@@ -261,11 +267,11 @@ convert-dtsv0: $(CONVERT_OBJS)
- 
- fdtdump:	$(FDTDUMP_OBJS)
- 
--fdtget:	$(FDTGET_OBJS) $(LIBFDT_lib)
-+fdtget:	$(FDTGET_OBJS) $(LIBFDT_dep)
- 
--fdtput:	$(FDTPUT_OBJS) $(LIBFDT_lib)
-+fdtput:	$(FDTPUT_OBJS) $(LIBFDT_dep)
- 
--fdtoverlay: $(FDTOVERLAY_OBJS) $(LIBFDT_lib)
-+fdtoverlay: $(FDTOVERLAY_OBJS) $(LIBFDT_dep)
- 
- dist:
- 	git archive --format=tar --prefix=dtc-$(dtc_version)/ HEAD \
-diff --git a/tests/Makefile.tests b/tests/Makefile.tests
-index 2f78952..f13b16d 100644
---- a/tests/Makefile.tests
-+++ b/tests/Makefile.tests
-@@ -60,17 +60,17 @@ TESTS_CLEANDIRS = $(TESTS_CLEANDIRS_L:%=$(TESTS_PREFIX)%)
- .PHONY: tests
- tests:	$(TESTS) $(TESTS_TREES)
- 
--$(LIB_TESTS): %: $(TESTS_PREFIX)testutils.o util.o $(LIBFDT_lib)
-+$(LIB_TESTS): %: $(TESTS_PREFIX)testutils.o util.o $(LIBFDT_dep)
- 
- # Not necessary on all platforms; allow -ldl to be excluded instead of forcing
- # other platforms to patch it out.
- LIBDL = -ldl
--$(DL_LIB_TESTS): %: %.o $(TESTS_PREFIX)testutils.o util.o $(LIBFDT_lib)
-+$(DL_LIB_TESTS): %: %.o $(TESTS_PREFIX)testutils.o util.o $(LIBFDT_dep)
- 	@$(VECHO) LD [libdl] $@
- 	$(LINK.c) -o $@ $^ $(LIBDL)
- 
- $(LIBTREE_TESTS): %: $(TESTS_PREFIX)testutils.o $(TESTS_PREFIX)trees.o \
--		util.o $(LIBFDT_lib)
-+		util.o $(LIBFDT_dep)
- 
- $(TESTS_PREFIX)dumptrees: $(TESTS_PREFIX)trees.o
- 
-@@ -83,8 +83,13 @@ tests_clean:
- 	rm -f $(TESTS_CLEANFILES)
- 	rm -rf $(TESTS_CLEANDIRS)
- 
-+ifeq ($(STATIC_BUILD),1)
-+check:
-+	@echo Skipping checks for static build
-+else
- check:	tests ${TESTS_BIN} $(TESTS_PYLIBFDT)
- 	cd $(TESTS_PREFIX); ./run_tests.sh
-+endif
- 
- ifeq ($(NO_VALGRIND),1)
- checkm:
--- 
-2.33.3
-
diff --git a/pkgs/development/compilers/dtc/default.nix b/pkgs/development/compilers/dtc/default.nix
index eab95e2de8c7..8669a3c7894b 100644
--- a/pkgs/development/compilers/dtc/default.nix
+++ b/pkgs/development/compilers/dtc/default.nix
@@ -2,6 +2,8 @@
 , lib
 , fetchgit
 , fetchpatch
+, meson
+, ninja
 , flex
 , bison
 , pkg-config
@@ -14,35 +16,68 @@
 
 stdenv.mkDerivation rec {
   pname = "dtc";
-  version = "1.6.1";
+  version = "1.7.0";
 
   src = fetchgit {
     url = "https://git.kernel.org/pub/scm/utils/dtc/dtc.git";
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-gx9LG3U9etWhPxm7Ox7rOu9X5272qGeHqZtOe68zFs4=";
+    sha256 = "sha256-FMh3VvlY3fUK8fbd0M+aCmlUrmG9YegiOOQ7MOByffc=";
   };
 
   patches = [
-    # fix python 3.10 compatibility
-    # based on without requiring the setup.py rework
-    # https://git.kernel.org/pub/scm/utils/dtc/dtc.git/commit/?id=383e148b70a47ab15f97a19bb999d54f9c3e810f
-    ./python-3.10.patch
+    # meson: Fix cell overflow tests when running from meson
+    (fetchpatch {
+      url = "https://github.com/dgibson/dtc/commit/32174a66efa4ad19fc6a2a6422e4af2ae4f055cb.patch";
+      sha256 = "sha256-C7OzwY0zq+2CV3SB5unI7Ill2M3deF7FXeQE3B/Kx2s=";
+    })
 
-    # fix dtc static building
-    ./0001-Depend-on-.a-instead-of-.so-when-building-static.patch
+    # meson.build: bump version to 1.7.0
+    (fetchpatch {
+      url = "https://github.com/dgibson/dtc/commit/64a907f08b9bedd89833c1eee674148cff2343c6.patch";
+      sha256 = "sha256-p2KGS5GW+3uIPgXfuIx6aDC54csM+5FZDkK03t58AL8=";
+    })
+
+    # Fix version in libfdt/meson.build
+    (fetchpatch {
+      url = "https://github.com/dgibson/dtc/commit/723545ebe9933b90ea58dc125e4987c6bcb04ade.patch";
+      sha256 = "sha256-5Oq7q+62ZObj3e7rguN9jhSpYoQkwjSfo/N893229dQ=";
+    })
+
+    # Use #ifdef NO_VALGRIND
+    (fetchpatch {
+      url = "https://github.com/dgibson/dtc/commit/41821821101ad8a9f83746b96b163e5bcbdbe804.patch";
+      sha256 = "sha256-7QEFDtap2DWbUGqtyT/RgJZJFldKB8oSubKiCtLZ0w4=";
+    })
   ];
 
-  nativeBuildInputs = [ flex bison pkg-config which ]
-    ++ lib.optionals pythonSupport [ python swig ];
+  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    flex
+    bison
+    pkg-config
+    which
+  ] ++ lib.optionals pythonSupport [
+    python
+    python.pkgs.setuptools-scm
+    swig
+  ];
 
   buildInputs = [ libyaml ];
 
   postPatch = ''
-    patchShebangs pylibfdt/
+    patchShebangs setup.py
   '';
 
-  makeFlags = [ "PYTHON=python" "STATIC_BUILD=${toString stdenv.hostPlatform.isStatic}" ];
-  installFlags = [ "INSTALL=install" "PREFIX=$(out)" "SETUP_PREFIX=$(out)" ];
+  # Required for installation of Python library and is innocuous otherwise.
+  env.DESTDIR = "/";
+
+  mesonAutoFeatures = "auto";
+  mesonFlags = [
+    (lib.mesonBool "static-build" stdenv.hostPlatform.isStatic)
+  ];
 
   postFixup = lib.optionalString stdenv.isDarwin ''
     install_name_tool -id $out/lib/libfdt.dylib $out/lib/libfdt-${version}.dylib
diff --git a/pkgs/development/compilers/dtc/python-3.10.patch b/pkgs/development/compilers/dtc/python-3.10.patch
deleted file mode 100644
index e6725a6831f1..000000000000
--- a/pkgs/development/compilers/dtc/python-3.10.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-diff --git a/pylibfdt/libfdt.i b/pylibfdt/libfdt.i
-index 51ee801..075ef70 100644
---- a/pylibfdt/libfdt.i
-+++ b/pylibfdt/libfdt.i
-@@ -1044,9 +1044,9 @@ typedef uint32_t fdt32_t;
- 		$result = Py_None;
- 	else
-         %#if PY_VERSION_HEX >= 0x03000000
--            $result = Py_BuildValue("y#", $1, *arg4);
-+            $result = Py_BuildValue("y#", $1, (Py_ssize_t)*arg4);
-         %#else
--            $result = Py_BuildValue("s#", $1, *arg4);
-+            $result = Py_BuildValue("s#", $1, (Py_ssize_t)*arg4);
-         %#endif
- }
- 
-diff --git a/pylibfdt/setup.py b/pylibfdt/setup.py
-index ef40f15..81e161a 100755
---- a/pylibfdt/setup.py
-+++ b/pylibfdt/setup.py
-@@ -42,6 +42,7 @@ def get_version():
- libfdt_module = Extension(
-     '_libfdt',
-     sources=[os.path.join(srcdir, 'libfdt.i')],
-+    define_macros=[('PY_SSIZE_T_CLEAN', None)],
-     include_dirs=[os.path.join(srcdir, '../libfdt')],
-     libraries=['fdt'],
-     library_dirs=[os.path.join(top_builddir, 'libfdt')],
diff --git a/pkgs/development/libraries/ftxui/default.nix b/pkgs/development/libraries/ftxui/default.nix
index f3be2b9c272e..e9ae2524ca02 100644
--- a/pkgs/development/libraries/ftxui/default.nix
+++ b/pkgs/development/libraries/ftxui/default.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ftxui";
-  version = "4.1.0";
+  version = "4.1.1";
 
   src = fetchFromGitHub {
     owner = "ArthurSonzogni";
     repo = "ftxui";
     rev = "v${version}";
-    sha256 = "sha256-6uPlJXuWcTUnpk+xe6EWDYvDLsfy7hGkEMO/2j3Dz0o=";
+    sha256 = "sha256-qFgCLV7sgGxlL18sThqpl+vyXL68GXcbYqMG7mXhsB4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/gstreamer/rs/default.nix b/pkgs/development/libraries/gstreamer/rs/default.nix
index b50d7d45180f..698be758ad3c 100644
--- a/pkgs/development/libraries/gstreamer/rs/default.nix
+++ b/pkgs/development/libraries/gstreamer/rs/default.nix
@@ -97,6 +97,7 @@ let
   selectedPlugins = if plugins != null then lib.unique (lib.sort lib.lessThan plugins) else lib.subtractLists (
     [
       "csound" # tests have weird failure on x86, does not currently work on arm or darwin
+      "livesync" # tests have suspicious intermittent failure, see https://gitlab.freedesktop.org/gstreamer/gst-plugins-rs/-/issues/357
     ] ++ lib.optionals stdenv.isDarwin [
       "reqwest" # tests hang on darwin
       "threadshare" # tests cannot bind to localhost on darwin
@@ -213,7 +214,7 @@ stdenv.mkDerivation rec {
   checkPhase = ''
     runHook preCheck
 
-    meson test --no-rebuild --verbose --timeout-multiplier 6
+    meson test --no-rebuild --verbose --timeout-multiplier 12
 
     runHook postCheck
   '';
diff --git a/pkgs/development/python-modules/boa-api/default.nix b/pkgs/development/python-modules/boa-api/default.nix
index 038d9b2c65ab..d96b64522622 100644
--- a/pkgs/development/python-modules/boa-api/default.nix
+++ b/pkgs/development/python-modules/boa-api/default.nix
@@ -1,24 +1,34 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "boa-api";
   version = "0.1.14";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "boalang";
     repo = "api-python";
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
     sha256 = "sha256-8tt68NLi5ewSKiHdu3gDawTBPylbDmB4zlUUqa7EQuY=";
   };
 
-  pythonImportsCheck = [ "boaapi" ];
+  # upstream has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "boaapi"
+  ];
 
   meta = {
     homepage = "https://github.com/boalang/api-python";
     description = "Python client API for communicating with Boa's (https://boa.cs.iastate.edu/) XML-RPC based services";
+    changelog = "https://github.com/boalang/api-python/blob/${src.rev}/Changes.txt";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ swflint ];
   };
diff --git a/pkgs/development/python-modules/bx-py-utils/default.nix b/pkgs/development/python-modules/bx-py-utils/default.nix
index f6a70a3adecf..6dd705585f3d 100644
--- a/pkgs/development/python-modules/bx-py-utils/default.nix
+++ b/pkgs/development/python-modules/bx-py-utils/default.nix
@@ -1,4 +1,5 @@
 { lib
+, stdenv
 , buildPythonPackage
 , pythonOlder
 , fetchFromGitHub
@@ -72,11 +73,16 @@ buildPythonPackage rec {
 
   disabledTestPaths = [
     "bx_py_utils_tests/tests/test_project_setup.py"
+  ] ++ lib.optionals stdenv.isDarwin [
+    # processify() doesn't work under darwin
+    # https://github.com/boxine/bx_py_utils/issues/80
+    "bx_py_utils_tests/tests/test_processify.py"
   ];
 
   meta = {
     description = "Various Python utility functions";
     homepage = "https://github.com/boxine/bx_py_utils";
+    changelog = "https://github.com/boxine/bx_py_utils/releases/tag/${src.rev}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ dotlambda ];
   };
diff --git a/pkgs/development/python-modules/filterpy/default.nix b/pkgs/development/python-modules/filterpy/default.nix
index 877bd02ed31b..86ea56f33347 100644
--- a/pkgs/development/python-modules/filterpy/default.nix
+++ b/pkgs/development/python-modules/filterpy/default.nix
@@ -1,32 +1,36 @@
 { lib
 , buildPythonPackage
-, fetchPypi
+, fetchFromGitHub
 , numpy
 , scipy
 , matplotlib
-, pytest
+, pytestCheckHook
 , isPy3k
 }:
 
-buildPythonPackage rec {
-  version = "1.4.5";
+buildPythonPackage {
   pname = "filterpy";
+  version = "unstable-2022-08-23";
+  format = "setuptools";
+
   disabled = !isPy3k;
 
-  src = fetchPypi {
-    inherit pname version;
-    extension = "zip";
-    sha256 = "4f2a4d39e4ea601b9ab42b2db08b5918a9538c168cff1c6895ae26646f3d73b1";
+  src = fetchFromGitHub {
+    owner = "rlabbe";
+    repo = "filterpy";
+    rev = "3b51149ebcff0401ff1e10bf08ffca7b6bbc4a33";
+    hash = "sha256-KuuVu0tqrmQuNKYmDmdy+TU6BnnhDxh4G8n9BGzjGag=";
   };
 
-  nativeCheckInputs = [ pytest ];
-  propagatedBuildInputs = [ numpy scipy matplotlib ];
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
 
-  # single test fails (even on master branch of repository)
-  # project does not use CI
-  checkPhase = ''
-    pytest --ignore=filterpy/common/tests/test_discretization.py
-  '';
+  propagatedBuildInputs = [
+    numpy
+    scipy
+    matplotlib
+  ];
 
   meta = with lib; {
     homepage = "https://github.com/rlabbe/filterpy";
diff --git a/pkgs/development/python-modules/jupyterhub/default.nix b/pkgs/development/python-modules/jupyterhub/default.nix
index 8424d5add916..9dea973b042f 100644
--- a/pkgs/development/python-modules/jupyterhub/default.nix
+++ b/pkgs/development/python-modules/jupyterhub/default.nix
@@ -154,8 +154,7 @@ buildPythonPackage rec {
   ];
 
   meta = with lib; {
-    # darwin: E   OSError: dlopen(/nix/store/43zml0mlr17r5jsagxr00xxx91hz9lky-openpam-20170430/lib/libpam.so, 6): image not found
-    broken = (stdenv.isLinux && stdenv.isAarch64) || stdenv.isDarwin;
+    broken = lib.versionAtLeast sqlalchemy.version "2.0";
     description = "Serves multiple Jupyter notebook instances";
     homepage = "https://jupyter.org/";
     changelog = "https://github.com/jupyterhub/jupyterhub/blob/${version}/docs/source/changelog.md";
diff --git a/pkgs/development/python-modules/pontos/default.nix b/pkgs/development/python-modules/pontos/default.nix
index d8a2a3f0ef03..b069d8e1598d 100644
--- a/pkgs/development/python-modules/pontos/default.nix
+++ b/pkgs/development/python-modules/pontos/default.nix
@@ -65,6 +65,8 @@ buildPythonPackage rec {
     # Network access
     "test_fail_sign_on_upload_fail"
     "test_successfully_sign"
+    # calls git log, but our fetcher removes .git
+    "test_git_error"
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/tools/analysis/checkstyle/default.nix b/pkgs/development/tools/analysis/checkstyle/default.nix
index 87d2c776bdd9..d07b73f48fc2 100644
--- a/pkgs/development/tools/analysis/checkstyle/default.nix
+++ b/pkgs/development/tools/analysis/checkstyle/default.nix
@@ -1,12 +1,12 @@
 { lib, stdenv, fetchurl, makeWrapper, jre }:
 
 stdenv.mkDerivation rec {
-  version = "10.11.0";
+  version = "10.12.0";
   pname = "checkstyle";
 
   src = fetchurl {
     url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-${version}/checkstyle-${version}-all.jar";
-    sha256 = "sha256-Fw8sG3iAnFXbdzGgbDJEoGGGdd+dSxCrS4KTLunEyjA=";
+    sha256 = "sha256-pA1K58kBZ3lZVgzg0NFYt+vA1JHOW+yW41t0ARlqvJE=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/development/tools/bearer/default.nix b/pkgs/development/tools/bearer/default.nix
index 015dae93adbb..8f78f21e4da3 100644
--- a/pkgs/development/tools/bearer/default.nix
+++ b/pkgs/development/tools/bearer/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "bearer";
-  version = "1.8.0";
+  version = "1.8.1";
 
   src = fetchFromGitHub {
     owner = "bearer";
     repo = "bearer";
     rev = "refs/tags/v${version}";
-    hash = "sha256-RwLYBz51zfJltsHOqRi7GJLP2ncPiqRqo229wv5jvdc=";
+    hash = "sha256-5Vd6knHm9r2VicHuvPKE7jzRGcNog8THNwDQmW2MJ5Q=";
   };
 
   vendorHash = "sha256-FRB01Tfz87MZp4V0HPeiEgYV8KEPcbzkeUM0uIBh6DU=";
diff --git a/pkgs/development/tools/kustomize/kustomize-sops.nix b/pkgs/development/tools/kustomize/kustomize-sops.nix
index a4057f4e4d39..ee6c8d0b5c4b 100644
--- a/pkgs/development/tools/kustomize/kustomize-sops.nix
+++ b/pkgs/development/tools/kustomize/kustomize-sops.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "kustomize-sops";
-  version = "4.2.0";
+  version = "4.2.1";
 
   src = fetchFromGitHub {
     owner = "viaduct-ai";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-vIFq42wp5Do4+Wc52D+abxRxtk+NrJ+mRxRzIY7ZcQA=";
+    sha256 = "sha256-Jm4mA91fyXQ8eScvRGDAmCBFVqT2GP57XIBZQo/bApg=";
   };
 
   vendorHash = "sha256-tNYPgXFDJuNRlrVE0ywg77goNzfoWHFVzOG9mHqK3q8=";
diff --git a/pkgs/development/tools/mani/default.nix b/pkgs/development/tools/mani/default.nix
index 66fbb4dc7311..06c7bcc84214 100644
--- a/pkgs/development/tools/mani/default.nix
+++ b/pkgs/development/tools/mani/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "mani";
-  version = "0.23.0";
+  version = "0.24.0";
 
   src = fetchFromGitHub {
     owner = "alajmo";
     repo = "mani";
     rev = "v${version}";
-    sha256 = "sha256-PuoGuweuDcSM1qfjXABSdoqbMLc5a+lYGFr0kZZkgVE=";
+    sha256 = "sha256-ROFqeRa43qDjO+xwC68gJJqLeLSRiX+L/gf2o8kURaI=";
   };
 
-  vendorHash = "sha256-9DP6SRcvHtZhkk2XoYesC1mhfq06KsLs0X02AG9vwJ8=";
+  vendorHash = "sha256-mFan09oJ+BPVJHAxoROj282WJ+4e7TD0ZqeQH1kDabQ=";
 
   nativeBuildInputs = [ installShellFiles makeWrapper ];
 
diff --git a/pkgs/development/tools/okteto/default.nix b/pkgs/development/tools/okteto/default.nix
index 3e30b14f9b44..6270f8f6b668 100644
--- a/pkgs/development/tools/okteto/default.nix
+++ b/pkgs/development/tools/okteto/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "okteto";
-  version = "2.15.3";
+  version = "2.15.4";
 
   src = fetchFromGitHub {
     owner = "okteto";
     repo = "okteto";
     rev = version;
-    hash = "sha256-BzyKmM5Yp9zdNonkDZoJBAmy8jSDwt85Wr9/1nbD7V8=";
+    hash = "sha256-sTlbub315MePIUjXKrdBUTplcOk10yIz0N8RejOf2FQ=";
   };
 
   vendorHash = "sha256-dZ6gzW5R5na5qcHFQqQvKfYb0Bu0kVvVMOaRdtTgkhE=";
diff --git a/pkgs/servers/http/nginx/modules.nix b/pkgs/servers/http/nginx/modules.nix
index 0861f29965db..30d9ae748f1c 100644
--- a/pkgs/servers/http/nginx/modules.nix
+++ b/pkgs/servers/http/nginx/modules.nix
@@ -1004,15 +1004,15 @@ let self = {
       name = "vts";
       owner = "vozlt";
       repo = "nginx-module-vts";
-      rev = "v0.2.1";
-      sha256 = "sha256-x4ry5ljPeJQY+7Mp04/xYIGf22d6Nee7CSqHezdK4gQ=";
+      rev = "v0.2.2";
+      sha256 = "sha256-ReTmYGVSOwtnYDMkQDMWwxw09vT4iHYfYZvgd8iBotk=";
     };
 
     meta = with lib; {
       description = "Virtual host traffic status module";
       homepage = "https://github.com/vozlt/nginx-module-vts";
       license = with licenses; [ bsd2 ];
-      maintainers = with maintainers; [ ];
+      maintainers = with maintainers; [ SuperSandro2000 ];
     };
   };
 
@@ -1032,7 +1032,7 @@ let self = {
       description = "Nginx modules for the Zstandard compression";
       homepage = "https://github.com/tokers/zstd-nginx-module";
       license = with licenses; [ bsd2 ];
-      maintainers = with maintainers; [ ];
+      maintainers = with maintainers; [ SuperSandro2000 ];
     };
   };
 }; in self // lib.optionalAttrs config.allowAliases {
diff --git a/pkgs/servers/mir/default.nix b/pkgs/servers/mir/default.nix
index 98b5fd39e5f7..013c3190e3b8 100644
--- a/pkgs/servers/mir/default.nix
+++ b/pkgs/servers/mir/default.nix
@@ -3,6 +3,7 @@
 , fetchFromGitHub
 , fetchpatch
 , gitUpdater
+, testers
 , cmake
 , pkg-config
 , python3
@@ -35,26 +36,17 @@
 , gtest
 , umockdev
 , wlcs
+, validatePkgConfig
 }:
 
-let
-  doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
-  pythonEnv = python3.withPackages(ps: with ps; [
-    pillow
-  ] ++ lib.optionals doCheck [
-    pygobject3
-    python-dbusmock
-  ]);
-in
-
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "mir";
   version = "2.13.0";
 
   src = fetchFromGitHub {
     owner = "MirServer";
     repo = "mir";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     hash = "sha256-Ip8p4mjcgmZQJTU4MNvWkTTtSJc+cCL3x1mMDFlZrVY=";
   };
 
@@ -109,7 +101,13 @@ stdenv.mkDerivation rec {
     libxslt
     lttng-ust # lttng-gen-tp
     pkg-config
-    pythonEnv
+    (python3.withPackages (ps: with ps; [
+      pillow
+    ] ++ lib.optionals finalAttrs.doCheck [
+      pygobject3
+      python-dbusmock
+    ]))
+    validatePkgConfig
   ];
 
   buildInputs = [
@@ -138,21 +136,23 @@ stdenv.mkDerivation rec {
     xorg.libXcursor
     xorg.xorgproto
     xwayland
-  ] ++ lib.optionals doCheck [
-    gtest
-    umockdev
-    wlcs
   ];
 
   nativeCheckInputs = [
     dbus
   ];
 
+  checkInputs = [
+    gtest
+    umockdev
+    wlcs
+  ];
+
   buildFlags = [ "all" "doc" ];
 
   cmakeFlags = [
     "-DMIR_PLATFORM='gbm-kms;x11;eglstream-kms;wayland'"
-    "-DMIR_ENABLE_TESTS=${if doCheck then "ON" else "OFF"}"
+    "-DMIR_ENABLE_TESTS=${if finalAttrs.doCheck then "ON" else "OFF"}"
     # BadBufferTest.test_truncated_shm_file *doesn't* throw an error as the test expected, mark as such
     # https://github.com/MirServer/mir/pull/1947#issuecomment-811810872
     "-DMIR_SIGBUS_HANDLER_ENVIRONMENT_BROKEN=ON"
@@ -163,7 +163,7 @@ stdenv.mkDerivation rec {
     "-DMIR_BUILD_PLATFORM_TEST_HARNESS=OFF"
   ];
 
-  inherit doCheck;
+  doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
 
   preCheck = ''
     # Needs to be exactly /tmp so some failing tests don't get run, don't know why they fail yet
@@ -174,6 +174,7 @@ stdenv.mkDerivation rec {
   outputs = [ "out" "dev" "doc" ];
 
   passthru = {
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
     updateScript = gitUpdater {
       rev-prefix = "v";
     };
@@ -190,8 +191,22 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "A display server and Wayland compositor developed by Canonical";
     homepage = "https://mir-server.io";
+    changelog = "https://github.com/MirServer/mir/releases/tag/v${finalAttrs.version}";
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ onny OPNA2608 ];
     platforms = platforms.linux;
+    pkgConfigModules = [
+      "miral"
+      "mircommon"
+      "mircookie"
+      "mircore"
+      "miroil"
+      "mirplatform"
+      "mir-renderer-gl-dev"
+      "mirrenderer"
+      "mirserver"
+      "mirtest"
+      "mirwayland"
+    ];
   };
-}
+})
diff --git a/pkgs/servers/nitter/default.nix b/pkgs/servers/nitter/default.nix
index aceceae83bc0..97966eed147f 100644
--- a/pkgs/servers/nitter/default.nix
+++ b/pkgs/servers/nitter/default.nix
@@ -7,13 +7,13 @@
 
 nimPackages.buildNimPackage rec {
   pname = "nitter";
-  version = "unstable-2023-04-21";
+  version = "unstable-2023-05-19";
 
   src = fetchFromGitHub {
     owner = "zedeus";
     repo = "nitter";
-    rev = "2254a0728c587ebcec51ff08da0bf145606a629e";
-    hash = "sha256-d4KYBCcYbfvEtOqa1umcXmYsBRvhLgpHVoCUfY0XdXI=";
+    rev = "e3b3b38a2d43a83b5fc2239ab41e864ee686fb2f";
+    hash = "sha256-1BEZcrraPc9qOWLy3Bq8M8G5P4fUmb2IX+T+cStHpmQ=";
   };
 
   patches = [
diff --git a/pkgs/tools/graphics/ueberzugpp/default.nix b/pkgs/tools/graphics/ueberzugpp/default.nix
index 70d51a142f48..152cf32f8690 100644
--- a/pkgs/tools/graphics/ueberzugpp/default.nix
+++ b/pkgs/tools/graphics/ueberzugpp/default.nix
@@ -32,13 +32,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ueberzugpp";
-  version = "2.8.5";
+  version = "2.8.6";
 
   src = fetchFromGitHub {
     owner = "jstkdng";
     repo = "ueberzugpp";
     rev = "v${version}";
-    hash = "sha256-WnrKwbh7m84xlKMuixkB8LLw8Pzb8+mZV9cHWiI6cBY=";
+    hash = "sha256-FNDFNPNiTLAB90dRpVX3XmbzB5pkkJmnhENmsPRldVE=";
   };
 
   # error: no member named 'ranges' in namespace 'std'
diff --git a/pkgs/tools/misc/charasay/default.nix b/pkgs/tools/misc/charasay/default.nix
new file mode 100644
index 000000000000..3ce3073ecd74
--- /dev/null
+++ b/pkgs/tools/misc/charasay/default.nix
@@ -0,0 +1,39 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, installShellFiles
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "charasay";
+  version = "2.0.0";
+
+  src = fetchFromGitHub {
+    owner = "latipun7";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-99lMXgSHgxKc0GHnRRciMoZ+rQJyMAx+27fj6NkXxds=";
+  };
+
+  cargoHash = "sha256-0la16XinseOXPH2mvdYD7ZquvF2dju4UPBwl5VrTEZA=";
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  postPatch = ''
+    rm .cargo/config.toml
+  '';
+
+  postInstall = ''
+    installShellCompletion --cmd himalaya \
+      --bash <($out/bin/chara completion --shell bash) \
+      --fish <($out/bin/chara completion --shell fish) \
+      --zsh <($out/bin/chara completion --shell zsh)
+  '';
+
+  meta = with lib; {
+    description = "The future of cowsay - Colorful characters saying something";
+    homepage = "https://github.com/latipun7/charasay";
+    license = licenses.mit;
+    maintainers = with maintainers; [ hmajid2301 ];
+  };
+}
diff --git a/pkgs/tools/misc/fluent-bit/default.nix b/pkgs/tools/misc/fluent-bit/default.nix
index cc91faa8ba20..14b9d21ad3e1 100644
--- a/pkgs/tools/misc/fluent-bit/default.nix
+++ b/pkgs/tools/misc/fluent-bit/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fluent-bit";
-  version = "2.1.3";
+  version = "2.1.4";
 
   src = fetchFromGitHub {
     owner = "fluent";
     repo = "fluent-bit";
     rev = "v${version}";
-    sha256 = "sha256-zNNqJbMVFNq82SKmlvU1rhjg549eH6rzrm2/mb1jM7E=";
+    sha256 = "sha256-WaIGTQiBVbLpSw17rBd1KbllkGEnSSXAPdO0CcbSNSI=";
   };
 
   nativeBuildInputs = [ cmake flex bison ];
diff --git a/pkgs/tools/misc/xcp/default.nix b/pkgs/tools/misc/xcp/default.nix
index 7bf9860e7eda..b8e93c3f7b67 100644
--- a/pkgs/tools/misc/xcp/default.nix
+++ b/pkgs/tools/misc/xcp/default.nix
@@ -2,19 +2,19 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "xcp";
-  version = "0.9.4";
+  version = "0.10.0";
 
   src = fetchFromGitHub {
     owner = "tarka";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-MvtMgdlMVMp2qWN+EbAKZwBwW0TA8aivlJY8KZm+7jM=";
+    sha256 = "sha256-DrB7eVo7nFsp2jGVygbBvj7zOztJ8jDkLODRFfxXhjY=";
   };
 
   # no such file or directory errors
   doCheck = false;
 
-  cargoHash = "sha256-vxfoJnyG0wWgkcZpQYiKkQaHl01VDuQ0kA26MXVCgY8=";
+  cargoHash = "sha256-O16aY+s27LBMcbefz4ug5+EuGAAiNsD7D0nv5KPg+Us=";
 
   meta = with lib; {
     description = "An extended cp(1)";
diff --git a/pkgs/tools/networking/piknik/default.nix b/pkgs/tools/networking/piknik/default.nix
new file mode 100644
index 000000000000..7b5b1a5e04c3
--- /dev/null
+++ b/pkgs/tools/networking/piknik/default.nix
@@ -0,0 +1,37 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, testers
+, piknik
+}:
+
+buildGoModule rec {
+  pname = "piknik";
+  version = "0.10.1";
+
+  src = fetchFromGitHub {
+    owner = "jedisct1";
+    repo = "piknik";
+    rev = version;
+    hash = "sha256-3yvr2H1a9YtgOEEBwn1HlGXIWFzRwQPBw9+KQxW3/jo=";
+  };
+
+  vendorHash = null;
+
+  ldflags = [ "-s" "-w" ];
+
+  passthru.tests = {
+    version = testers.testVersion {
+      package = piknik;
+      version = "v${version}";
+    };
+  };
+
+  meta = with lib; {
+    description = "Copy/paste anything over the network";
+    homepage = "https://github.com/jedisct1/piknik";
+    changelog = "https://github.com/jedisct1/piknik/blob/${src.rev}/ChangeLog";
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ figsoda ];
+  };
+}
diff --git a/pkgs/tools/networking/trurl/default.nix b/pkgs/tools/networking/trurl/default.nix
index 9d1b24a71cd3..5253e06b2a41 100644
--- a/pkgs/tools/networking/trurl/default.nix
+++ b/pkgs/tools/networking/trurl/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "trurl";
-  version = "0.6";
+  version = "0.7";
 
   src = fetchFromGitHub {
     owner = "curl";
     repo = pname;
     rev = "${pname}-${version}";
-    hash = "sha256-/Gf7T67LPzVPhjAqTvbLiJOqfKeWvwH/WHelJZTH4ZI=";
+    hash = "sha256-2F/01FUsOa8ZqU1YHrxTD4KcJul2OEoW/RJCXoLfywg=";
   };
 
   outputs = [ "out" "dev" "man" ];
diff --git a/pkgs/tools/security/nuclei/default.nix b/pkgs/tools/security/nuclei/default.nix
index e28a529020f6..951d153894b5 100644
--- a/pkgs/tools/security/nuclei/default.nix
+++ b/pkgs/tools/security/nuclei/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "nuclei";
-  version = "2.9.4";
+  version = "2.9.5";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-WqbJlpKwkbYWvSwVqhcPyIeKdlaNOvxmJh3XKi7b/Do=";
+    hash = "sha256-+ndLh4T9Kznzx6Qgh2EQm/cSvRb6+1goOMELS8sUHPc=";
   };
 
-  vendorHash = "sha256-yIGK7Fyr616XrZ5tQCdzontlCFegn9utrV8ZXhUQzp4=";
+  vendorHash = "sha256-vAzyqFUluqEKeYw8unUjmyuw/c7yQYTGjLpHdYI5es8=";
 
   modRoot = "./v2";
   subPackages = [
diff --git a/pkgs/tools/text/topfew/default.nix b/pkgs/tools/text/topfew/default.nix
new file mode 100644
index 000000000000..967e4e1403a2
--- /dev/null
+++ b/pkgs/tools/text/topfew/default.nix
@@ -0,0 +1,37 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, installShellFiles
+}:
+
+buildGoModule rec {
+  pname = "topfew";
+  version = "0.9.0";
+
+  src = fetchFromGitHub {
+    owner = "timbray";
+    repo = "topfew";
+    rev = version;
+    hash = "sha256-6ydi/4LyqTLKpR00f4zpcrTnCorlhnsBOxdhzBMNcRI=";
+  };
+
+  vendorHash = null;
+
+  nativeBuildInputs = [
+    installShellFiles
+  ];
+
+  ldflags = [ "-s" "-w" ];
+
+  postInstall = ''
+    installManPage doc/tf.1
+  '';
+
+  meta = with lib; {
+    description = "Finds the fields (or combinations of fields) which appear most often in a stream of records";
+    homepage = "https://github.com/timbray/topfew";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ figsoda ];
+    mainProgram = "tf";
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 3ad420098109..f751bd56501f 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -11276,6 +11276,8 @@ with pkgs;
 
   phosh-mobile-settings = callPackage ../applications/window-managers/phosh/phosh-mobile-settings.nix { };
 
+  piknik = callPackage ../tools/networking/piknik { };
+
   pinentry = libsForQt5.callPackage ../tools/security/pinentry { };
 
   pinentry-curses = (lib.getOutput "curses" pinentry);
@@ -13112,6 +13114,8 @@ with pkgs;
 
   toml2nix = callPackage ../development/tools/toml2nix { };
 
+  topfew = callPackage ../tools/text/topfew { };
+
   topfew-rs = callPackage ../tools/text/topfew-rs { };
 
   topgrade = callPackage ../tools/misc/topgrade {
@@ -30069,6 +30073,8 @@ with pkgs;
 
   amazon-ecr-credential-helper = callPackage ../tools/admin/amazon-ecr-credential-helper { };
 
+  dk = callPackage ../applications/window-managers/dk { };
+
   docker-credential-gcr = callPackage ../tools/admin/docker-credential-gcr { };
 
   docker-credential-helpers = callPackage ../tools/admin/docker-credential-helpers { };
@@ -40715,4 +40721,6 @@ with pkgs;
   isolate = callPackage ../tools/security/isolate { };
 
   reindeer = callPackage ../development/tools/reindeer { };
+
+  charasay = callPackage ../tools/misc/charasay { };
 }