diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 0083993e7ef..3b70ccedd7e 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -12168,6 +12168,12 @@
     githubId = 12984845;
     name = "Subhrajyoti Sen";
   };
+  sudosubin = {
+    email = "sudosubin@gmail.com";
+    github = "sudosubin";
+    githubId = 32478597;
+    name = "Subin Kim";
+  };
   suhr = {
     email = "suhr@i2pmail.org";
     github = "suhr";
diff --git a/nixos/modules/services/mail/postfix.nix b/nixos/modules/services/mail/postfix.nix
index da14b6eef7e..de00c87b95a 100644
--- a/nixos/modules/services/mail/postfix.nix
+++ b/nixos/modules/services/mail/postfix.nix
@@ -725,6 +725,7 @@ in
 
       systemd.services.postfix-setup =
         { description = "Setup for Postfix mail server";
+          serviceConfig.RemainAfterExit = true;
           serviceConfig.Type = "oneshot";
           script = ''
             # Backwards compatibility
diff --git a/nixos/modules/services/misc/gitlab.nix b/nixos/modules/services/misc/gitlab.nix
index 0811b34156e..24eefb7bf30 100644
--- a/nixos/modules/services/misc/gitlab.nix
+++ b/nixos/modules/services/misc/gitlab.nix
@@ -17,8 +17,8 @@ let
   gitalySocket = "${cfg.statePath}/tmp/sockets/gitaly.socket";
   pathUrlQuote = url: replaceStrings ["/"] ["%2F"] url;
 
-  databaseConfig = {
-    production = {
+  databaseConfig = let
+    val = {
       adapter = "postgresql";
       database = cfg.databaseName;
       host = cfg.databaseHost;
@@ -26,6 +26,10 @@ let
       encoding = "utf8";
       pool = cfg.databasePool;
     } // cfg.extraDatabaseConfig;
+  in if lib.versionAtLeast (lib.getVersion cfg.packages.gitlab) "15.0" then {
+    production.main = val;
+  } else {
+    production = val;
   };
 
   # We only want to create a database if we're actually going to connect to it.
@@ -1184,7 +1188,7 @@ in {
                 fi
 
                 jq <${pkgs.writeText "database.yml" (builtins.toJSON databaseConfig)} \
-                   '.production.password = $ENV.db_password' \
+                   '.${if lib.versionAtLeast (lib.getVersion cfg.packages.gitlab) "15.0" then "production.main" else "production"}.password = $ENV.db_password' \
                    >'${cfg.statePath}/config/database.yml'
               ''
               else ''
diff --git a/pkgs/applications/editors/neovim/default.nix b/pkgs/applications/editors/neovim/default.nix
index b4858b21eee..cd046b1871f 100644
--- a/pkgs/applications/editors/neovim/default.nix
+++ b/pkgs/applications/editors/neovim/default.nix
@@ -3,6 +3,7 @@
 , unibilium, gperf
 , libvterm-neovim
 , tree-sitter
+, CoreServices
 , glibcLocales ? null, procps ? null
 
 # now defaults to false because some tests can be flaky (clipboard etc), see
@@ -60,7 +61,7 @@ in
       neovimLuaEnv
       tree-sitter
       unibilium
-    ] ++ optional stdenv.isDarwin libiconv
+    ] ++ optionals stdenv.isDarwin [ libiconv CoreServices ]
       ++ optionals doCheck [ glibcLocales procps ]
     ;
 
diff --git a/pkgs/applications/editors/vscode/vscode.nix b/pkgs/applications/editors/vscode/vscode.nix
index 1604cc901e4..3f4555430a6 100644
--- a/pkgs/applications/editors/vscode/vscode.nix
+++ b/pkgs/applications/editors/vscode/vscode.nix
@@ -14,17 +14,17 @@ let
   archive_fmt = if stdenv.isDarwin then "zip" else "tar.gz";
 
   sha256 = {
-    x86_64-linux = "1db5vwcwi3w11zm2b72cvddn5k9yav65rg7ii9wq4a0dym39f8ql";
-    x86_64-darwin = "1q5vjisdc0q5vigb1lwq8fkxbaar73jnk4ac0fqlhc4gqacz3cs3";
-    aarch64-linux = "01lcvjw9nfgp93ydl16bp91gbkivd23jn8pan220fjvdsgvcbg48";
-    aarch64-darwin = "06p6p2c9a3rav9c23pvfn8mmd77wc9z7pavpmkgm1f3wplx48q8q";
-    armv7l-linux = "0pzim9r2zzwyim3g6f8ixgqllgz4cijaiw76czi0wmz4dxxdljrw";
+    x86_64-linux = "0yahcv64jblmz5q0ylgg1sghcnyam4nq47var3y18ndjpaqyb1fl";
+    x86_64-darwin = "0zsizwrhc0na9dfics27i48q4x3kz0qq5m2vdjvrgi69y2iy5z4c";
+    aarch64-linux = "01wpi9pdf1fjxfx8w5g5da31q561qw7ykjm9spb3arvnivq20dp2";
+    aarch64-darwin = "0qk22jyn0vypsx8x4cmpab5wrmhqx6hdkm314k8k06mz5cg1v4r3";
+    armv7l-linux = "04r0x31flahzw8y0kkbzqnvcwllifaa0ysr163bb5b8kiyc189kk";
   }.${system};
 in
   callPackage ./generic.nix rec {
     # Please backport all compatible updates to the stable release.
     # This is important for the extension ecosystem.
-    version = "1.67.1";
+    version = "1.67.2";
     pname = "vscode";
 
     executableName = "code" + lib.optionalString isInsiders "-insiders";
diff --git a/pkgs/applications/editors/vscode/vscodium.nix b/pkgs/applications/editors/vscode/vscodium.nix
index 9fde99f3f58..4686c532373 100644
--- a/pkgs/applications/editors/vscode/vscodium.nix
+++ b/pkgs/applications/editors/vscode/vscodium.nix
@@ -14,11 +14,11 @@ let
   archive_fmt = if stdenv.isDarwin then "zip" else "tar.gz";
 
   sha256 = {
-    x86_64-linux = "0hsq3b8j58xjl8pkrd5x3qh0lsl9gwbd9wgvhzlnx2h94iasr1v5";
-    x86_64-darwin = "04fbl8kp3af7xcicx17ay2piwy4y3yiyn9723hlmmf7s359rr1wn";
-    aarch64-linux = "0jljsa61zr3symfdsjx9jj4s3y1kqslxh8gc1gqx45zlm5rzr7k8";
-    aarch64-darwin = "1swkc0qb1xif8hj6cjp3jq1iqdfqsa681hhp7mxvrpqg0i2zppk3";
-    armv7l-linux = "1ssbdc4b11xmd45m7bzhdh6szx331pzah2mjpqjg7cz3ray3xvwy";
+    x86_64-linux = "1ns4cpkihbrwgh8pvn1kjlnipssinjkxy28szidnz6q71zyvsjyw";
+    x86_64-darwin = "05v0gxal74igc29qjy0ficlyna17bzh1lpfqvyxdpg22is894h2l";
+    aarch64-linux = "1x6lhcvdly3a2n0shp2vlgk3s2pj9byxn9dc9pjg4k5ff24dql7l";
+    aarch64-darwin = "03knkj0y6n45lin0v6288zbq1nz5qh81ijyw1w3zrpd7pijn9j0x";
+    armv7l-linux = "0iwlr5q1qwq3jgldrhz4bbyl3xmdhd4ss690x1lqb4vxm2m7v5jw";
   }.${system};
 
   sourceRoot = if stdenv.isDarwin then "" else ".";
@@ -28,7 +28,7 @@ in
 
     # Please backport all compatible updates to the stable release.
     # This is important for the extension ecosystem.
-    version = "1.67.1";
+    version = "1.67.2";
     pname = "vscodium";
 
     executableName = "codium";
diff --git a/pkgs/applications/networking/cluster/nomad/1.1.nix b/pkgs/applications/networking/cluster/nomad/1.1.nix
index bbc1dc9949b..aa5d723b70c 100644
--- a/pkgs/applications/networking/cluster/nomad/1.1.nix
+++ b/pkgs/applications/networking/cluster/nomad/1.1.nix
@@ -6,7 +6,7 @@
 
 callPackage ./generic.nix {
   inherit buildGoModule nvidia_x11 nvidiaGpuSupport;
-  version = "1.1.12";
-  sha256 = "19y52sn4qz0vx9s188nf7rkr7y2cbq6h33l98sr4w85kmainn86s";
-  vendorSha256 = "0p582y2q6zpyn7vmv1p8p8r2gbh786pqc6lpipgr7rpxbnxf5v4b";
+  version = "1.1.14";
+  sha256 = "0jzcmv6kw555lz7mrm673qgjfmzm4pznibbz9qn3w1jj4x9ddncy";
+  vendorSha256 = "04nyd37viz521qb3frcy39alha0bpx029cy3kswldhh7wbyp7284";
 }
diff --git a/pkgs/applications/networking/cluster/nomad/1.2.nix b/pkgs/applications/networking/cluster/nomad/1.2.nix
index a45d5b2e98d..c888581ae4d 100644
--- a/pkgs/applications/networking/cluster/nomad/1.2.nix
+++ b/pkgs/applications/networking/cluster/nomad/1.2.nix
@@ -6,7 +6,7 @@
 
 callPackage ./generic.nix {
   inherit buildGoModule nvidia_x11 nvidiaGpuSupport;
-  version = "1.2.7";
-  sha256 = "13whyjl0shr00mn46f361ybz90zwkiyab9ygcs0hrs75lgvkmfm9";
-  vendorSha256 = "177gv0h8bhxd5j78sf4is86zzq8xl9schg1hbyh0hmwg4whhqm8a";
+  version = "1.2.8";
+  sha256 = "11yn8g9wsdb35q97wn5vy93kgbn5462k0a33wxlfdz14i5h00yj8";
+  vendorSha256 = "06wyfnlm37qjvd1pwzygflfpcp9p52f61wgi6pb9l7hnqy2ph6j5";
 }
diff --git a/pkgs/applications/networking/cluster/nomad/1.3.nix b/pkgs/applications/networking/cluster/nomad/1.3.nix
index 932bbc7270f..6670b35f67e 100644
--- a/pkgs/applications/networking/cluster/nomad/1.3.nix
+++ b/pkgs/applications/networking/cluster/nomad/1.3.nix
@@ -6,7 +6,7 @@
 
 callPackage ./generic.nix {
   inherit buildGoModule nvidia_x11 nvidiaGpuSupport;
-  version = "1.3.0";
-  sha256 = "098sg7jl257r6zfi2fsp9dwm0rrzi8m2k85bb097q14n3p4s3pna";
-  vendorSha256 = "037bdgnyv8gkm2hz7h727ss46adnkywg28j6i1canmdacpi3qv5c";
+  version = "1.3.1";
+  sha256 = "03ckhqh5xznvhbk380ka0g9w9hrvsi389h5maw68f3g3acx68jm7";
+  vendorSha256 = "08k5dxaq4r2q0km6y9mc14haski6l7hmhmzn5wjb961hwf5hkfgh";
 }
diff --git a/pkgs/applications/networking/instant-messengers/gajim/default.nix b/pkgs/applications/networking/instant-messengers/gajim/default.nix
index 118a35381a6..aad4b24d740 100644
--- a/pkgs/applications/networking/instant-messengers/gajim/default.nix
+++ b/pkgs/applications/networking/instant-messengers/gajim/default.nix
@@ -2,6 +2,7 @@
 
 # Native dependencies
 , python3, gtk3, gobject-introspection, gnome
+, gtksourceview4
 , glib-networking
 
 # Test dependencies
@@ -21,15 +22,16 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "gajim";
-  version = "1.3.3";
+  version = "1.4.1";
 
   src = fetchurl {
     url = "https://gajim.org/downloads/${lib.versions.majorMinor version}/gajim-${version}.tar.gz";
-    sha256 = "1337qkpcv7j0fgws9scnk82mn2l7s17060vmrbh3ihinmxmbxg6x";
+    sha256 = "sha256:0mbx7s1d2xgk7bkhwqcdss6ynshkqdiwh3qgv7d45frb4c3k33l2";
   };
 
   buildInputs = [
     gobject-introspection gtk3 gnome.adwaita-icon-theme
+    gtksourceview4
     glib-networking
   ] ++ lib.optionals enableJingle [ farstream gstreamer gst-plugins-base gst-libav gst-plugins-good libnice ]
     ++ lib.optional enableSecrets libsecret
@@ -74,7 +76,7 @@ python3.pkgs.buildPythonApplication rec {
   checkPhase = ''
     xvfb-run dbus-run-session \
       --config-file=${dbus.daemon}/share/dbus-1/session.conf \
-      ${python3.interpreter} -m unittest discover -s test/unit -v
+      ${python3.interpreter} -m unittest discover -s test/gtk -v
     ${python3.interpreter} -m unittest discover -s test/no_gui -v
   '';
 
diff --git a/pkgs/applications/networking/pjsip/default.nix b/pkgs/applications/networking/pjsip/default.nix
index 6406337541f..ba9081e25aa 100644
--- a/pkgs/applications/networking/pjsip/default.nix
+++ b/pkgs/applications/networking/pjsip/default.nix
@@ -2,22 +2,17 @@
 
 stdenv.mkDerivation rec {
   pname = "pjsip";
-  version = "2.12";
+  version = "2.12.1";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = "pjproject";
     rev = version;
-    sha256 = "sha256-snp9+PlffU9Ay8o42PM8SqyP60hu9nozp457HM+0bM8=";
+    sha256 = "sha256-HIDL4xzzTu3irzrIOf8qSNCAvHGOMpi8EDeqZb8mMnc=";
   };
 
   patches = [
     ./fix-aarch64.patch
-    (fetchpatch {
-      name = "CVE-2022-24764.patch";
-      url = "https://github.com/pjsip/pjproject/commit/560a1346f87aabe126509bb24930106dea292b00.patch";
-      sha256 = "1fy78v3clm0gby7qcq3ny6f7d7f4qnn01lkqq67bf2s85k2phisg";
-    })
   ];
 
   buildInputs = [ openssl libsamplerate ]
diff --git a/pkgs/applications/version-management/gitlab/data.json b/pkgs/applications/version-management/gitlab/data.json
index cc8cd00b7d1..40d678bf7bb 100644
--- a/pkgs/applications/version-management/gitlab/data.json
+++ b/pkgs/applications/version-management/gitlab/data.json
@@ -1,14 +1,14 @@
 {
-  "version": "14.10.2",
-  "repo_hash": "0f7cfc1wrzz4m5yhd6jnp3dqpdy7vbj8bf826zjsi2ss48430bk0",
-  "yarn_hash": "17wxqvig34namf8kvh8bwci3y0f3k2nl4zs99jcvskdad9p45rlc",
+  "version": "15.0.0",
+  "repo_hash": "sha256-+ZLHo35BhgWlopuwrVGiMvcWl8qUvHUV2kAEIXWazyY=",
+  "yarn_hash": "1a8k3x3b9sirzicqkwmr10m27n593iljfh8awdc9700akbj155lr",
   "owner": "gitlab-org",
   "repo": "gitlab",
-  "rev": "v14.10.2-ee",
+  "rev": "v15.0.0-ee",
   "passthru": {
-    "GITALY_SERVER_VERSION": "14.10.2",
-    "GITLAB_PAGES_VERSION": "1.56.1",
-    "GITLAB_SHELL_VERSION": "13.25.1",
-    "GITLAB_WORKHORSE_VERSION": "14.10.2"
+    "GITALY_SERVER_VERSION": "15.0.0",
+    "GITLAB_PAGES_VERSION": "1.58.0",
+    "GITLAB_SHELL_VERSION": "14.3.0",
+    "GITLAB_WORKHORSE_VERSION": "15.0.0"
   }
 }
diff --git a/pkgs/applications/version-management/gitlab/default.nix b/pkgs/applications/version-management/gitlab/default.nix
index 362cf4702f4..e5765bb7842 100644
--- a/pkgs/applications/version-management/gitlab/default.nix
+++ b/pkgs/applications/version-management/gitlab/default.nix
@@ -74,7 +74,7 @@ let
       rm lib/tasks/yarn.rake
 
       # The rake tasks won't run without a basic configuration in place
-      mv config/database.yml.env config/database.yml
+      mv config/database.yml.postgresql config/database.yml
       mv config/gitlab.yml.example config/gitlab.yml
 
       # Yarn and bundler wants a real home directory to write cache, config, etc to
diff --git a/pkgs/applications/version-management/gitlab/gitaly/Gemfile.lock b/pkgs/applications/version-management/gitlab/gitaly/Gemfile.lock
index cc37adacce6..cc5344f8e87 100644
--- a/pkgs/applications/version-management/gitlab/gitaly/Gemfile.lock
+++ b/pkgs/applications/version-management/gitlab/gitaly/Gemfile.lock
@@ -94,7 +94,7 @@ GEM
     jaeger-client (1.1.0)
       opentracing (~> 0.3)
       thrift
-    json (2.6.1)
+    json (2.5.1)
     licensee (9.14.1)
       dotenv (~> 2.0)
       octokit (~> 4.17)
diff --git a/pkgs/applications/version-management/gitlab/gitaly/default.nix b/pkgs/applications/version-management/gitlab/gitaly/default.nix
index 127a4ec461f..aa53fc5171c 100644
--- a/pkgs/applications/version-management/gitlab/gitaly/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitaly/default.nix
@@ -11,8 +11,9 @@ let
     gemdir = ./.;
   };
 
-  version = "14.10.2";
-  gitaly_package = "gitlab.com/gitlab-org/gitaly/v${lib.versions.major version}";
+  version = "15.0.0";
+  package_version = "v14";
+  gitaly_package = "gitlab.com/gitlab-org/gitaly/${package_version}";
 in
 
 buildGoModule {
@@ -23,10 +24,10 @@ buildGoModule {
     owner = "gitlab-org";
     repo = "gitaly";
     rev = "v${version}";
-    sha256 = "sha256-hLTzkW5GDq1AgTwe1pVj6Tiyd0JpJ76ATFu3Q+m9MVg=";
+    sha256 = "sha256-ib/gGkXo6W6LZ6j92oUMhJWdDYZRnA1p+tsOK6ewemk=";
   };
 
-  vendorSha256 = "sha256-ZL61t+Ii2Ns3TmitiF93exinod54+RCqrbdpU67HeY0=";
+  vendorSha256 = "sha256-/tHKWo09ZV31TSIqlOk36V3y7gNikziUJHf+nS1gHEw=";
 
   passthru = {
     inherit rubyEnv;
@@ -42,7 +43,7 @@ buildGoModule {
   postInstall = ''
     mkdir -p $ruby
     cp -rv $src/ruby/{bin,lib,proto} $ruby
-    mv $out/bin/gitaly-git2go-v${lib.versions.major version} $out/bin/gitaly-git2go-${version}
+    mv $out/bin/gitaly-git2go-${package_version} $out/bin/gitaly-git2go-${version}
   '';
 
   outputs = [ "out" "ruby" ];
diff --git a/pkgs/applications/version-management/gitlab/gitaly/gemset.nix b/pkgs/applications/version-management/gitlab/gitaly/gemset.nix
index 21db54b6ed5..ccf444330af 100644
--- a/pkgs/applications/version-management/gitlab/gitaly/gemset.nix
+++ b/pkgs/applications/version-management/gitlab/gitaly/gemset.nix
@@ -372,10 +372,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1z9grvjyfz16ag55hg522d3q4dh07hf391sf9s96npc0vfi85xkz";
+      sha256 = "0lrirj0gw420kw71bjjlqkqhqbrplla61gbv1jzgsz6bv90qr3ci";
       type = "gem";
     };
-    version = "2.6.1";
+    version = "2.5.1";
   };
   licensee = {
     dependencies = ["dotenv" "octokit" "reverse_markdown" "rugged" "thor"];
diff --git a/pkgs/applications/version-management/gitlab/gitlab-shell/default.nix b/pkgs/applications/version-management/gitlab/gitlab-shell/default.nix
index 915d52f1635..3888b0ba110 100644
--- a/pkgs/applications/version-management/gitlab/gitlab-shell/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-shell/default.nix
@@ -2,19 +2,19 @@
 
 buildGoModule rec {
   pname = "gitlab-shell";
-  version = "13.25.1";
+  version = "14.3.0";
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-shell";
     rev = "v${version}";
-    sha256 = "sha256-JItk6gfpBNxabI0vsIOHIBhK7L6E1ijPgrnzhQiKPYw=";
+    sha256 = "sha256-SFoNtWcY0iJREsA+vZRsVJHmNb2vNvOiBJnochxA/Us=";
   };
 
   buildInputs = [ ruby ];
 
   patches = [ ./remove-hardcoded-locations.patch ];
 
-  vendorSha256 = "sha256-S7bVQxb+p6o0LPAdx7S6dlsHLecPwMS7myjQZwYhHcU=";
+  vendorSha256 = "sha256-eSzJon8o7ktV3rFuTE1A4tzdkBzWBZf1JxnrcMj5s00=";
 
   postInstall = ''
     cp -r "$NIX_BUILD_TOP/source"/bin/* $out/bin
diff --git a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
index 2613fe85f81..d67e8bf4d44 100644
--- a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
@@ -5,7 +5,7 @@ in
 buildGoModule rec {
   pname = "gitlab-workhorse";
 
-  version = "14.10.2";
+  version = "15.0.0";
 
   src = fetchFromGitLab {
     owner = data.owner;
@@ -16,7 +16,7 @@ buildGoModule rec {
 
   sourceRoot = "source/workhorse";
 
-  vendorSha256 = "sha256-TNZtggUBMwIPO6ZZGk/EkRcilh7sztlAT7Hu4vhME0w=";
+  vendorSha256 = "sha256-7hNwBCDMdiiOliZa/lkYLo8gyAksAU0HanCSyaAMYLs=";
   buildInputs = [ git ];
   ldflags = [ "-X main.Version=${version}" ];
   doCheck = false;
diff --git a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
index 732591ae170..cbb4d6f90c0 100644
--- a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
@@ -4,7 +4,7 @@ source 'https://rubygems.org'
 
 gem 'rails', '~> 6.1.4.7'
 
-gem 'bootsnap', '~> 1.9.1', require: false
+gem 'bootsnap', '~> 1.9.4', require: false
 
 # Responders respond_to and respond_with
 gem 'responders', '~> 3.0'
@@ -46,7 +46,6 @@ gem 'omniauth-facebook', '~> 4.0.0'
 gem 'omniauth-github', '~> 1.4'
 gem 'omniauth-gitlab', '~> 1.0.2'
 gem 'omniauth-google-oauth2', '~> 0.6.0'
-gem 'omniauth-kerberos', '~> 0.3.0', group: :kerberos
 gem 'omniauth-oauth2-generic', '~> 0.2.2'
 gem 'omniauth-saml', '~> 1.10'
 gem 'omniauth-shibboleth', '~> 1.3.0'
@@ -61,6 +60,7 @@ gem 'jwt', '~> 2.1.0'
 
 # Kerberos authentication. EE-only
 gem 'gssapi', group: :kerberos
+gem 'timfel-krb5-auth', '~> 0.8', group: :kerberos
 
 # Spam and anti-bot protection
 gem 'recaptcha', '~> 4.11', require: 'recaptcha/rails'
@@ -104,7 +104,7 @@ gem 'graphql', '~> 1.11.10'
 gem 'graphiql-rails', '~> 1.8'
 gem 'apollo_upload_server', '~> 2.1.0'
 gem 'graphql-docs', '~> 1.6.0', group: [:development, :test]
-gem 'graphlient', '~> 0.4.0' # Used by BulkImport feature (group::import)
+gem 'graphlient', '~> 0.5.0' # Used by BulkImport feature (group::import)
 
 gem 'hashie'
 # Disable strong_params so that Mash does not respond to :permitted?
@@ -142,9 +142,9 @@ gem 'unf', '~> 0.1.4'
 gem 'seed-fu', '~> 2.3.7'
 
 # Search
-gem 'elasticsearch-model', '~> 6.1'
-gem 'elasticsearch-rails', '~> 6.1', require: 'elasticsearch/rails/instrumentation'
-gem 'elasticsearch-api',   '~> 6.8.2'
+gem 'elasticsearch-model', '~> 7.2'
+gem 'elasticsearch-rails', '~> 7.2', require: 'elasticsearch/rails/instrumentation'
+gem 'elasticsearch-api',   '7.13.3'
 gem 'aws-sdk-core', '~> 3'
 gem 'aws-sdk-cloudformation', '~> 1'
 gem 'aws-sdk-s3', '~> 1'
@@ -345,6 +345,7 @@ gem 'warning', '~> 1.2.0'
 
 group :development do
   gem 'lefthook', '~> 0.7.0', require: false
+  gem 'rubocop'
   gem 'solargraph', '~> 0.44.3', require: false
 
   gem 'letter_opener_web', '~> 2.0.0'
@@ -543,4 +544,4 @@ gem 'ipaddress', '~> 0.8.3'
 
 gem 'parslet', '~> 1.8'
 
-gem 'ipynbdiff', '0.4.5'
+gem 'ipynbdiff', '0.4.7'
diff --git a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
index eeb2a8d8a73..4f5d0e36ab3 100644
--- a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
@@ -143,7 +143,7 @@ GEM
       rack (>= 0.9.0)
     bindata (2.4.10)
     binding_ninja (0.2.3)
-    bootsnap (1.9.1)
+    bootsnap (1.9.4)
       msgpack (~> 1.0)
     bootstrap_form (4.2.0)
       actionpack (>= 5.0)
@@ -306,17 +306,17 @@ GEM
     e2mmap (0.1.0)
     ecma-re-validator (0.3.0)
       regexp_parser (~> 2.0)
-    elasticsearch (6.8.2)
-      elasticsearch-api (= 6.8.2)
-      elasticsearch-transport (= 6.8.2)
-    elasticsearch-api (6.8.2)
+    elasticsearch (7.13.3)
+      elasticsearch-api (= 7.13.3)
+      elasticsearch-transport (= 7.13.3)
+    elasticsearch-api (7.13.3)
       multi_json
-    elasticsearch-model (6.1.1)
+    elasticsearch-model (7.2.0)
       activesupport (> 3)
-      elasticsearch (~> 6)
+      elasticsearch (~> 7)
       hashie
-    elasticsearch-rails (6.1.1)
-    elasticsearch-transport (6.8.2)
+    elasticsearch-rails (7.2.1)
+    elasticsearch-transport (7.13.3)
       faraday (~> 1)
       multi_json
     email_reply_trimmer (0.1.6)
@@ -342,13 +342,17 @@ GEM
     factory_bot_rails (6.2.0)
       factory_bot (~> 6.2.0)
       railties (>= 5.0.0)
-    faraday (1.4.2)
+    faraday (1.10.0)
       faraday-em_http (~> 1.0)
       faraday-em_synchrony (~> 1.0)
       faraday-excon (~> 1.1)
+      faraday-httpclient (~> 1.0)
+      faraday-multipart (~> 1.0)
       faraday-net_http (~> 1.0)
-      faraday-net_http_persistent (~> 1.1)
-      multipart-post (>= 1.2, < 3)
+      faraday-net_http_persistent (~> 1.0)
+      faraday-patron (~> 1.0)
+      faraday-rack (~> 1.0)
+      faraday-retry (~> 1.0)
       ruby2_keywords (>= 0.0.4)
     faraday-cookie_jar (0.0.7)
       faraday (>= 0.8.0)
@@ -358,9 +362,15 @@ GEM
     faraday-excon (1.1.0)
     faraday-http-cache (2.2.0)
       faraday (>= 0.8)
+    faraday-httpclient (1.0.1)
+    faraday-multipart (1.0.3)
+      multipart-post (>= 1.2, < 3)
     faraday-net_http (1.0.1)
-    faraday-net_http_persistent (1.1.0)
-    faraday_middleware (1.0.0)
+    faraday-net_http_persistent (1.2.0)
+    faraday-patron (1.0.0)
+    faraday-rack (1.0.0)
+    faraday-retry (1.0.3)
+    faraday_middleware (1.2.0)
       faraday (~> 1.0)
     faraday_middleware-aws-sigv4 (0.3.0)
       aws-sigv4 (~> 1.0)
@@ -560,14 +570,14 @@ GEM
     graphiql-rails (1.8.0)
       railties
       sprockets-rails
-    graphlient (0.4.0)
+    graphlient (0.5.0)
       faraday (>= 1.0)
       faraday_middleware
       graphql-client
     graphql (1.11.10)
-    graphql-client (0.16.0)
+    graphql-client (0.17.0)
       activesupport (>= 3.0)
-      graphql (~> 1.8)
+      graphql (~> 1.10)
     graphql-docs (1.6.0)
       commonmarker (~> 0.16)
       escape_utils (~> 1.2)
@@ -648,7 +658,7 @@ GEM
     invisible_captcha (1.1.0)
       rails (>= 4.2)
     ipaddress (0.8.3)
-    ipynbdiff (0.4.5)
+    ipynbdiff (0.4.7)
       diffy (~> 3.3)
       json (~> 2.5, >= 2.5.1)
     jaeger-client (1.1.0)
@@ -767,7 +777,7 @@ GEM
       faraday (>= 0.9, < 2.0.0)
       faraday-cookie_jar (~> 0.0.6)
       ms_rest (~> 0.7.6)
-    msgpack (1.3.3)
+    msgpack (1.5.1)
     multi_json (1.14.1)
     multi_xml (0.6.0)
     multipart-post (2.1.1)
@@ -856,11 +866,6 @@ GEM
       jwt (>= 2.0)
       omniauth (>= 1.1.1)
       omniauth-oauth2 (>= 1.5)
-    omniauth-kerberos (0.3.0)
-      omniauth-multipassword
-      timfel-krb5-auth (~> 0.8)
-    omniauth-multipassword (0.4.2)
-      omniauth (~> 1.0)
     omniauth-oauth (1.1.0)
       oauth
       omniauth (~> 1.0)
@@ -1071,7 +1076,7 @@ GEM
     rspec-expectations (3.10.1)
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.10.0)
-    rspec-mocks (3.10.2)
+    rspec-mocks (3.10.3)
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.10.0)
     rspec-parameterized (0.5.0)
@@ -1133,7 +1138,7 @@ GEM
       nokogiri (>= 1.10.5)
       rexml
     ruby-statistics (3.0.0)
-    ruby2_keywords (0.0.4)
+    ruby2_keywords (0.0.5)
     ruby_parser (3.15.0)
       sexp_processor (~> 4.9)
     rubyntlm (0.6.2)
@@ -1430,7 +1435,7 @@ DEPENDENCIES
   benchmark-ips (~> 2.3.0)
   benchmark-memory (~> 0.1)
   better_errors (~> 2.9.0)
-  bootsnap (~> 1.9.1)
+  bootsnap (~> 1.9.4)
   bootstrap_form (~> 4.2.0)
   browser (~> 4.2)
   bullet (~> 6.1.3)
@@ -1459,9 +1464,9 @@ DEPENDENCIES
   discordrb-webhooks (~> 3.4)
   doorkeeper (~> 5.5.0.rc2)
   doorkeeper-openid_connect (~> 1.7.5)
-  elasticsearch-api (~> 6.8.2)
-  elasticsearch-model (~> 6.1)
-  elasticsearch-rails (~> 6.1)
+  elasticsearch-api (= 7.13.3)
+  elasticsearch-model (~> 7.2)
+  elasticsearch-rails (~> 7.2)
   email_reply_trimmer (~> 0.1)
   email_spec (~> 2.2.0)
   erubi (~> 1.9.0)
@@ -1513,7 +1518,7 @@ DEPENDENCIES
   grape-path-helpers (~> 1.7.0)
   grape_logging (~> 1.7)
   graphiql-rails (~> 1.8)
-  graphlient (~> 0.4.0)
+  graphlient (~> 0.5.0)
   graphql (~> 1.11.10)
   graphql-docs (~> 1.6.0)
   grpc (~> 1.42.0)
@@ -1531,7 +1536,7 @@ DEPENDENCIES
   icalendar
   invisible_captcha (~> 1.1.0)
   ipaddress (~> 0.8.3)
-  ipynbdiff (= 0.4.5)
+  ipynbdiff (= 0.4.7)
   jira-ruby (~> 2.1.4)
   js_regex (~> 3.7)
   json (~> 2.5.1)
@@ -1576,7 +1581,6 @@ DEPENDENCIES
   omniauth-github (~> 1.4)
   omniauth-gitlab (~> 1.0.2)
   omniauth-google-oauth2 (~> 0.6.0)
-  omniauth-kerberos (~> 0.3.0)
   omniauth-oauth2-generic (~> 0.2.2)
   omniauth-salesforce (~> 1.0.5)
   omniauth-saml (~> 1.10)
@@ -1626,6 +1630,7 @@ DEPENDENCIES
   rspec-retry (~> 0.6.1)
   rspec_junit_formatter
   rspec_profiling (~> 0.0.6)
+  rubocop
   ruby-fogbugz (~> 0.2.1)
   ruby-magic (~> 0.5)
   ruby-prof (~> 1.3.0)
@@ -1671,6 +1676,7 @@ DEPENDENCIES
   thin (~> 1.8.0)
   thrift (>= 0.14.0)
   timecop (~> 0.9.1)
+  timfel-krb5-auth (~> 0.8)
   toml-rb (~> 2.0)
   truncato (~> 0.7.11)
   typhoeus (~> 1.4.0)
diff --git a/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix b/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
index e9bd35cea58..87791ff5675 100644
--- a/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
@@ -577,10 +577,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1ndjra3h86dq28njm2swmaw6n3vsywrycrf7i5iy9l8hrhfhv4x2";
+      sha256 = "19i4x2nascd74ahcvmrsnf03cygh1y4c9yf8rcv91fv0mcxpvb9n";
       type = "gem";
     };
-    version = "1.9.1";
+    version = "1.9.4";
   };
   bootstrap_form = {
     dependencies = ["actionpack" "activemodel"];
@@ -1289,10 +1289,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "152z76sp2ymyaqrbm8c6y0p1ydkckwrr6iif66mdsc5s0433va3f";
+      sha256 = "0havyxmvl157a653prspnbhgdchlx44xqxl170v1im5ggxwavcaq";
       type = "gem";
     };
-    version = "6.8.2";
+    version = "7.13.3";
   };
   elasticsearch-api = {
     dependencies = ["multi_json"];
@@ -1300,10 +1300,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "12rjfamnqspvkjs90bvpa5zs7g0nlr9pvlvj228mj71k5pym1x8p";
+      sha256 = "0bmssarkk7lqkjdn8c9j7jvxcnn4hg1zcmhsky8bfvc99k33b3w8";
       type = "gem";
     };
-    version = "6.8.2";
+    version = "7.13.3";
   };
   elasticsearch-model = {
     dependencies = ["activesupport" "elasticsearch" "hashie"];
@@ -1311,20 +1311,20 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1q66mp28696qnr6xgsl1dym2l5wk4j2ifd673r09yi70hn9y5ji8";
+      sha256 = "1ivcz5pcrp0760j26590bm3jvwc8548wcy7z7v2274k18l583h9c";
       type = "gem";
     };
-    version = "6.1.1";
+    version = "7.2.0";
   };
   elasticsearch-rails = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "06k97w4xdkdj982b2mgz4bv0gvkpbscn4wxsrqj6kr1x7dxia394";
+      sha256 = "1r2nh6csdlbfk5hqq5qbvvw1kvv6qa382alil2ixjn33jl7dql07";
       type = "gem";
     };
-    version = "6.1.1";
+    version = "7.2.1";
   };
   elasticsearch-transport = {
     dependencies = ["faraday" "multi_json"];
@@ -1332,10 +1332,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "02z7b26vl0wmvkzy10qp530vx5c7pdv2ynfsd7mc5qmz6m0z5pxp";
+      sha256 = "0blfii8qvj0m6bg9sbfynxc40in7zfmw2wpi4clv7d9gclk053db";
       type = "gem";
     };
-    version = "6.8.2";
+    version = "7.13.3";
   };
   email_reply_trimmer = {
     groups = ["default"];
@@ -1484,15 +1484,15 @@
     version = "6.2.0";
   };
   faraday = {
-    dependencies = ["faraday-em_http" "faraday-em_synchrony" "faraday-excon" "faraday-net_http" "faraday-net_http_persistent" "multipart-post" "ruby2_keywords"];
+    dependencies = ["faraday-em_http" "faraday-em_synchrony" "faraday-excon" "faraday-httpclient" "faraday-multipart" "faraday-net_http" "faraday-net_http_persistent" "faraday-patron" "faraday-rack" "faraday-retry" "ruby2_keywords"];
     groups = ["danger" "default" "development" "test"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "07mhk70gv453pg38md346470hknyhipdqppnplq706ll3k3lzb7v";
+      sha256 = "00palwawk897p5gypw5wjrh93d4p0xz2yl9w93yicb4kq7amh8d4";
       type = "gem";
     };
-    version = "1.4.2";
+    version = "1.10.0";
   };
   faraday-cookie_jar = {
     dependencies = ["faraday" "http-cookie"];
@@ -1546,6 +1546,27 @@
     };
     version = "2.2.0";
   };
+  faraday-httpclient = {
+    groups = ["danger" "default" "development" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0fyk0jd3ks7fdn8nv3spnwjpzx2lmxmg2gh4inz3by1zjzqg33sc";
+      type = "gem";
+    };
+    version = "1.0.1";
+  };
+  faraday-multipart = {
+    dependencies = ["multipart-post"];
+    groups = ["danger" "default" "development" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "03qfi9020ynf7hkdiaq01sd2mllvw7fg4qiin3pk028b4wv23j3j";
+      type = "gem";
+    };
+    version = "1.0.3";
+  };
   faraday-net_http = {
     groups = ["danger" "default" "development" "test"];
     platforms = [];
@@ -1561,10 +1582,40 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0l2c835wl7gv34xp49fhd1bl4czkpw2g3ahqsak2251iqv5589ka";
+      sha256 = "0dc36ih95qw3rlccffcb0vgxjhmipsvxhn6cw71l7ffs0f7vq30b";
       type = "gem";
     };
-    version = "1.1.0";
+    version = "1.2.0";
+  };
+  faraday-patron = {
+    groups = ["danger" "default" "development" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "19wgsgfq0xkski1g7m96snv39la3zxz6x7nbdgiwhg5v82rxfb6w";
+      type = "gem";
+    };
+    version = "1.0.0";
+  };
+  faraday-rack = {
+    groups = ["danger" "default" "development" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1h184g4vqql5jv9s9im6igy00jp6mrah2h14py6mpf9bkabfqq7g";
+      type = "gem";
+    };
+    version = "1.0.0";
+  };
+  faraday-retry = {
+    groups = ["danger" "default" "development" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "153i967yrwnswqgvnnajgwp981k9p50ys1h80yz3q94rygs59ldd";
+      type = "gem";
+    };
+    version = "1.0.3";
   };
   faraday_middleware = {
     dependencies = ["faraday"];
@@ -1572,10 +1623,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0jik2kgfinwnfi6fpp512vlvs0mlggign3gkbpkg5fw1jr9his0r";
+      sha256 = "1bw8mfh4yin2xk7138rg3fhb2p5g2dlmdma88k82psah9mbmvlfy";
       type = "gem";
     };
-    version = "1.0.0";
+    version = "1.2.0";
   };
   faraday_middleware-aws-sigv4 = {
     dependencies = ["aws-sigv4" "faraday"];
@@ -2251,10 +2302,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "04c32rcn3j4d8sh039lkdfzn8xpifsbpsp7f90vlp2s531wbs16a";
+      sha256 = "14pjw0hd9rmfc687yj1cfd8jjy8gh7k6zn6w9syvcl1f2hb98b0g";
       type = "gem";
     };
-    version = "0.4.0";
+    version = "0.5.0";
   };
   graphql = {
     groups = ["default" "development" "test"];
@@ -2272,10 +2323,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0g971rccyrs3rk8812r6az54p28g66m4ngdcbszg31mvddjaqkr4";
+      sha256 = "0pgb1r4vkyrq8hzhkii48hn7cdlkmnrswzjsl0xqxg1diz705bss";
       type = "gem";
     };
-    version = "0.16.0";
+    version = "0.17.0";
   };
   graphql-docs = {
     dependencies = ["commonmarker" "escape_utils" "extended-markdown-filter" "gemoji" "graphql" "html-pipeline" "sass"];
@@ -2623,10 +2674,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1r1pl4imiqi75bksh17r2j3w74x561z4bx1mpgv6cin1fcrzw9zy";
+      sha256 = "0bm7k1lga4jmbi7fx373npbi0smm7jkhhpvnh7jrjawnjmfii1bz";
       type = "gem";
     };
-    version = "0.4.5";
+    version = "0.4.7";
   };
   jaeger-client = {
     dependencies = ["opentracing" "thrift"];
@@ -3175,10 +3226,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1lva6bkvb4mfa0m3bqn4lm4s4gi81c40jvdcsrxr6vng49q9daih";
+      sha256 = "1i0gbypr1yxwfkaxzrk0i1wz4n6v3mw7z24k65jy3q1h5lda5xbw";
       type = "gem";
     };
-    version = "1.3.3";
+    version = "1.5.1";
   };
   multi_json = {
     groups = ["default"];
@@ -3572,28 +3623,6 @@
     };
     version = "0.6.0";
   };
-  omniauth-kerberos = {
-    dependencies = ["omniauth-multipassword" "timfel-krb5-auth"];
-    groups = ["kerberos"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "05xsv76qjxcxzrvabaar2bchv7435y8l2j0wk4zgchh3yv85kiq7";
-      type = "gem";
-    };
-    version = "0.3.0";
-  };
-  omniauth-multipassword = {
-    dependencies = ["omniauth"];
-    groups = ["default" "kerberos"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0qykp76hw80lkgb39hyzrv68hkbivc8cv0vbvrnycjh9fwfp1lv8";
-      type = "gem";
-    };
-    version = "0.4.2";
-  };
   omniauth-oauth = {
     dependencies = ["oauth" "omniauth"];
     groups = ["default"];
@@ -4558,10 +4587,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1d13g6kipqqc9lmwz5b244pdwc97z15vcbnbq6n9rlf32bipdz4k";
+      sha256 = "02i64ihazgm2dp07y89q1m9pyk724g5n9l83cy21x6snnzcg7xnj";
       type = "gem";
     };
-    version = "3.10.2";
+    version = "3.10.3";
   };
   rspec-parameterized = {
     dependencies = ["binding_ninja" "parser" "proc_to_ast" "rspec" "unparser"];
@@ -4773,10 +4802,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "15wfcqxyfgka05v2a7kpg64x57gl1y4xzvnc9lh60bqx5sf1iqrs";
+      sha256 = "1vz322p8n39hz3b4a9gkmz9y7a5jaz41zrm2ywf31dvkqm03glgz";
       type = "gem";
     };
-    version = "0.0.4";
+    version = "0.0.5";
   };
   ruby_parser = {
     dependencies = ["sexp_processor"];
diff --git a/pkgs/applications/virtualization/cloud-hypervisor/default.nix b/pkgs/applications/virtualization/cloud-hypervisor/default.nix
index 9e6de7890a4..10f61bfd233 100644
--- a/pkgs/applications/virtualization/cloud-hypervisor/default.nix
+++ b/pkgs/applications/virtualization/cloud-hypervisor/default.nix
@@ -2,19 +2,19 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cloud-hypervisor";
-  version = "23.0";
+  version = "23.1";
 
   src = fetchFromGitHub {
     owner = "cloud-hypervisor";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0gq23zhpl1rw8i3yv0f058lycsr078yfy8vkb5w382pifgrww1zh";
+    sha256 = "sha256-Pyocmj5cr2vOfeyRG3mBU11I3iXndUh3VifRSlnjoE8=";
   };
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ openssl ] ++ lib.optional stdenv.isAarch64 dtc;
 
-  cargoSha256 = "0r3r6r5scbw23ipz24glcyvaxx9sffy8kp27fpqvwdha915c1zkp";
+  cargoSha256 = "1rx4d38d0ajdq3qs638gmagmj3f9j29i5mhrrzw039mggahjbksw";
 
   OPENSSL_NO_VENDOR = true;
 
diff --git a/pkgs/data/fonts/pretendard/default.nix b/pkgs/data/fonts/pretendard/default.nix
new file mode 100644
index 00000000000..ea2ccfecbc2
--- /dev/null
+++ b/pkgs/data/fonts/pretendard/default.nix
@@ -0,0 +1,46 @@
+{ lib, fetchzip }:
+
+let
+  version = "1.3.0";
+
+  mkPretendard = { pname, typeface, sha256 }:
+    fetchzip {
+      name = "${pname}-${version}";
+
+      url = "https://github.com/orioncactus/pretendard/releases/download/v${version}/${typeface}-${version}.zip";
+      inherit sha256;
+
+      postFetch = ''
+        mkdir -p $out/share/fonts/opentype
+        unzip -j $downloadedFile "*.otf" -d $out/share/fonts/opentype
+      '';
+
+      meta = with lib; {
+        homepage = "https://github.com/orioncactus/pretendard";
+        description = "An alternative font to system-ui for all platforms";
+        license = licenses.ofl;
+        platforms = platforms.all;
+        maintainers = with maintainers; [ sudosubin ];
+      };
+    };
+
+in
+{
+  pretendard = mkPretendard {
+    pname = "pretendard";
+    typeface = "Pretendard";
+    sha256 = "sha256-4DM8PZjxW93sgQChs+qu5Svo+iGlFnpglu6acYMCkSQ=";
+  };
+
+  pretendard-jp = mkPretendard {
+    pname = "pretendard-jp";
+    typeface = "PretendardJP";
+    sha256 = "sha256-3OOUUDiurCpIGNIVjrr2KW0CB3fCXt11P+13teK5kOQ=";
+  };
+
+  pretendard-std = mkPretendard {
+    pname = "pretendard-std";
+    typeface = "PretendardStd";
+    sha256 = "sha256-iVAPdA6qAiE7pseaB0NKPJBPNGdw/nT6PzXIsLajJH4=";
+  };
+}
diff --git a/pkgs/development/interpreters/spidermonkey/91.nix b/pkgs/development/interpreters/spidermonkey/91.nix
index ee8557f49c9..ff60044488e 100644
--- a/pkgs/development/interpreters/spidermonkey/91.nix
+++ b/pkgs/development/interpreters/spidermonkey/91.nix
@@ -1,20 +1,24 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchurl
-, pkg-config
+
+# build time
+, buildPackages
+, cargo
+, m4
 , perl
+, pkg-config
 , python3
-, zip
-, buildPackages
+, rust-cbindgen
+, rustc
 , which
+, zip
+
+# runtime
+, icu
+, nspr
 , readline
 , zlib
-, icu69
-, cargo
-, rustc
-, rust-cbindgen
-, yasm
-, nspr
-, m4
 }:
 
 stdenv.mkDerivation rec {
@@ -31,20 +35,19 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     cargo
-    rustc.llvmPackages.llvm # for llvm-objdump
+    m4
     perl
     pkg-config
     python3
     rust-cbindgen
     rustc
+    rustc.llvmPackages.llvm # for llvm-objdump
     which
-    yasm # to buid icu? seems weird
     zip
-    m4
   ];
 
   buildInputs = [
-    icu69
+    icu
     nspr
     readline
     zlib
diff --git a/pkgs/development/interpreters/wasmtime/default.nix b/pkgs/development/interpreters/wasmtime/default.nix
index a475f53f91f..fd5ff80e7af 100644
--- a/pkgs/development/interpreters/wasmtime/default.nix
+++ b/pkgs/development/interpreters/wasmtime/default.nix
@@ -1,24 +1,24 @@
-{ rustPlatform, fetchFromGitHub, lib, v8 }:
+{ rustPlatform, fetchFromGitHub, lib, stdenv, v8 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "wasmtime";
-  version = "0.36.0";
+  version = "0.37.0";
 
   src = fetchFromGitHub {
     owner = "bytecodealliance";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-nSA78eQRbJ5JTDquaRqRgFU0V8RVCzvWUONgHxGj+Mc=";
+    sha256 = "sha256-ZUr1v94If8ER4lTHLwuP+F3xfXU7IW4ZEztBA2TPvVg=";
     fetchSubmodules = true;
   };
 
-  cargoSha256 = "sha256-/+uioJRXiugsV7SUwsDNHGaPxrxrhscQUGyXOzzwG/g=";
+  cargoSha256 = "sha256-X+KDeWavFTBaxbSPlIiyuiBC7wg1/5C/NXp+VEY8Mk8=";
 
   # This environment variable is required so that when wasmtime tries
   # to run tests by using the rusty_v8 crate, it does not try to
   # download a static v8 build from the Internet, what would break
   # build hermetism.
-  RUSTY_V8_ARCHIVE = "${v8}/lib/libv8.a";
+  RUSTY_V8_ARCHIVE = lib.optionalString stdenv.isLinux "${v8}/lib/libv8.a";
 
   doCheck = true;
   checkFlags = [
@@ -36,6 +36,6 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/bytecodealliance/wasmtime";
     license = licenses.asl20;
     maintainers = [ maintainers.matthewbauer ];
-    platforms = platforms.linux;
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/libraries/menu-cache/default.nix b/pkgs/development/libraries/menu-cache/default.nix
index 66fadee0b31..e05d387846a 100644
--- a/pkgs/development/libraries/menu-cache/default.nix
+++ b/pkgs/development/libraries/menu-cache/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, glib, pkg-config, libfm-extra }:
+{ lib, stdenv, fetchurl, fetchpatch, glib, pkg-config, libfm-extra }:
 
 stdenv.mkDerivation rec {
   pname = "menu-cache";
@@ -9,6 +9,16 @@ stdenv.mkDerivation rec {
     sha256 = "1iry4zlpppww8qai2cw4zid4081hh7fz8nzsp5lqyffbkm2yn0pd";
   };
 
+  patches = [
+    # Pull patch pending upstream inclusion for -fno-common toolchain support:
+    #   https://github.com/lxde/menu-cache/pull/19
+    (fetchpatch {
+      name = "fno-common.patch";
+      url = "https://github.com/lxde/menu-cache/commit/1ce739649b4d66339a03fc0ec9ee7a2f7c141780.patch";
+      sha256 = "08x3h0w2pl8ifj83v9jkf4j3zxcwsyzh251divlhhnwx0rw1pyn7";
+    })
+  ];
+
   nativeBuildInputs = [ pkg-config ];
 
   buildInputs = [ glib libfm-extra ];
diff --git a/pkgs/development/libraries/qt-5/modules/qtspeech.nix b/pkgs/development/libraries/qt-5/modules/qtspeech.nix
index d2748ba8d4c..a1ecb48f0d9 100644
--- a/pkgs/development/libraries/qt-5/modules/qtspeech.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtspeech.nix
@@ -1,7 +1,9 @@
-{ qtModule }:
+{ qtModule, speechd, pkg-config }:
 
 qtModule {
   pname = "qtspeech";
   qtInputs = [ ];
+  buildInputs = [ speechd ];
+  nativeBuildInputs = [ pkg-config ];
   outputs = [ "out" "dev" ];
 }
diff --git a/pkgs/development/ocaml-modules/gd4o/default.nix b/pkgs/development/ocaml-modules/gd4o/default.nix
new file mode 100644
index 00000000000..19a1b42f06b
--- /dev/null
+++ b/pkgs/development/ocaml-modules/gd4o/default.nix
@@ -0,0 +1,36 @@
+{ lib, stdenv, fetchurl, ocaml, gd, freetype, findlib, zlib, libpng, libjpeg }:
+
+stdenv.mkDerivation rec {
+  pname = "ocaml${ocaml.version}-gd4o";
+  version = "1.0a5";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/gd4o/gd4o/1.0%20Alpha%205/gd4o-1.0a5.tar.gz";
+    sha256 = "1vbyakz7byvxmqf3hj68rw15b4kb94ppcnhvmjv38rsyg05bc47s";
+  };
+
+  buildInputs = [ ocaml findlib libjpeg libpng ];
+  propagatedBuildInputs = [ gd zlib freetype ];
+
+
+  preInstall = ''
+    mkdir -p $OCAMLFIND_DESTDIR/stublibs
+  '';
+
+  buildFlags = [ "all" "opt" ];
+
+  checkPhase = ''
+    runHook preCheck
+    make test.opt
+    runHook postCheck
+  '';
+
+  doCheck = true;
+
+  meta = with lib; {
+    homepage = "https://sourceforge.net/projects/gd4o/";
+    description = "OCaml wrapper for the GD graphics library";
+    license = licenses.lgpl21Only;
+    maintainers = with maintainers; [ dandellion ];
+  };
+}
diff --git a/pkgs/development/ocaml-modules/irmin-watcher/default.nix b/pkgs/development/ocaml-modules/irmin-watcher/default.nix
index 82818b39492..7304528b7dc 100644
--- a/pkgs/development/ocaml-modules/irmin-watcher/default.nix
+++ b/pkgs/development/ocaml-modules/irmin-watcher/default.nix
@@ -4,13 +4,13 @@
 
 buildDunePackage rec {
   pname = "irmin-watcher";
-  version = "0.4.1";
+  version = "0.5.0";
 
   useDune2 = true;
 
   src = fetchurl {
     url = "https://github.com/mirage/irmin-watcher/releases/download/${version}/irmin-watcher-${version}.tbz";
-    sha256 = "00d4ph4jbsw6adp3zqdrwi099hfcf7p1xzi0685qr7bgcmandjfv";
+    sha256 = "sha256-vq4kwaz4QUG9x0fGEbQMAuDGjlT3/6lm8xiXTUqJmZM=";
   };
 
   propagatedBuildInputs = [ astring fmt logs ocaml_lwt ];
diff --git a/pkgs/development/ocaml-modules/ppx_cstubs/default.nix b/pkgs/development/ocaml-modules/ppx_cstubs/default.nix
index f2c844ea048..c58004b9adc 100644
--- a/pkgs/development/ocaml-modules/ppx_cstubs/default.nix
+++ b/pkgs/development/ocaml-modules/ppx_cstubs/default.nix
@@ -14,7 +14,7 @@
 
 buildDunePackage rec {
   pname = "ppx_cstubs";
-  version = "0.6.1.2";
+  version = "0.7.0";
 
   minimalOCamlVersion = "4.08";
 
@@ -24,7 +24,7 @@ buildDunePackage rec {
     owner = "fdopen";
     repo = "ppx_cstubs";
     rev = version;
-    sha256 = "15cjb9ygnvp2kv85rrb7ncz7yalifyl7wd2hp2cl8r1qrpgi1d0w";
+    sha256 = "sha256-qMmwRWCIfNyhCQYPKLiufnb57sTR3P+WInOqtPDywFs=";
   };
 
   nativeBuildInputs = [ cppo findlib ];
diff --git a/pkgs/development/python-modules/amaranth/default.nix b/pkgs/development/python-modules/amaranth/default.nix
index 99fe555e3f3..938b44202b9 100644
--- a/pkgs/development/python-modules/amaranth/default.nix
+++ b/pkgs/development/python-modules/amaranth/default.nix
@@ -57,6 +57,10 @@ buildPythonPackage rec {
     substituteInPlace setup.py \
       --replace "Jinja2~=2.11" "Jinja2>=2.11" \
       --replace "pyvcd~=0.2.2" "pyvcd"
+
+    # jinja2.contextfunction was removed in jinja2 v3.1
+    substituteInPlace amaranth/build/plat.py \
+      --replace "@jinja2.contextfunction" "@jinja2.pass_context"
   '';
 
   pythonImportsCheck = [ "amaranth" ];
diff --git a/pkgs/development/python-modules/embrace/default.nix b/pkgs/development/python-modules/embrace/default.nix
index 9b80c5d689b..c342c9be5a0 100644
--- a/pkgs/development/python-modules/embrace/default.nix
+++ b/pkgs/development/python-modules/embrace/default.nix
@@ -1,21 +1,40 @@
-{ stdenv, lib, buildPythonPackage, fetchFromSourcehut,
-  sqlparse, wrapt, pytestCheckHook }:
+{ lib
+, stdenv
+, buildPythonPackage
+, fetchFromSourcehut
+, pytestCheckHook
+, pythonOlder
+, sqlparse
+, wrapt
+}:
 
 buildPythonPackage rec {
   pname = "embrace";
   version = "4.1.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromSourcehut {
     vc = "hg";
     owner = "~olly";
     repo = "embrace-sql";
     rev = "v${version}-release";
-    sha256 = "sha256-R6Ug4f8KFZNzaNWqWZkLvOwtsawCuerzvHlysr7bd6M=";
+    hash = "sha256-R6Ug4f8KFZNzaNWqWZkLvOwtsawCuerzvHlysr7bd6M=";
   };
 
-  propagatedBuildInputs = [ sqlparse wrapt ];
-  checkInputs = [ pytestCheckHook ];
-  pythonImportsCheck = [ "embrace" ];
+  propagatedBuildInputs = [
+    sqlparse
+    wrapt
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "embrace"
+  ];
 
   # Some test for hot-reload fails on Darwin, but the rest of the library
   # should remain usable. (https://todo.sr.ht/~olly/embrace-sql/4)
diff --git a/pkgs/development/python-modules/faraday-plugins/default.nix b/pkgs/development/python-modules/faraday-plugins/default.nix
index 92a9eb9edc0..3d7ad0cdf7d 100644
--- a/pkgs/development/python-modules/faraday-plugins/default.nix
+++ b/pkgs/development/python-modules/faraday-plugins/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "faraday-plugins";
-  version = "1.6.5";
+  version = "1.6.6";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "infobyte";
     repo = "faraday_plugins";
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-mzzUbUBlzOyFpDaoUwwjxC3dqbheLWAt8gXrIH0XXss=";
+    sha256 = "sha256-clhWUKpX4q3aXq7HrrGPda+qjPD/GuPS7PRZ7c4xxxI=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/fontparts/default.nix b/pkgs/development/python-modules/fontparts/default.nix
index 16d594eab04..f394af315a1 100644
--- a/pkgs/development/python-modules/fontparts/default.nix
+++ b/pkgs/development/python-modules/fontparts/default.nix
@@ -6,13 +6,13 @@
 
 buildPythonPackage rec {
   pname = "fontParts";
-  version = "0.10.4";
+  version = "0.10.5";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1ic453q86s5hsw8mxnclk1vr4qp69fd67gywhv23zqwz9a7kb7lh";
+    sha256 = "sha256-VriGYcpd2uVDMXeF3DXGKCMRQ9pTjDkrUOt2YSUgd5M=";
     extension = "zip";
   };
 
diff --git a/pkgs/development/python-modules/greeclimate/default.nix b/pkgs/development/python-modules/greeclimate/default.nix
index a7a2c5594e5..94e384d7d22 100644
--- a/pkgs/development/python-modules/greeclimate/default.nix
+++ b/pkgs/development/python-modules/greeclimate/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "greeclimate";
-  version = "1.1.1";
+  version = "1.2.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "cmroche";
     repo = "greeclimate";
     rev = "refs/tags/v${version}";
-    hash = "sha256-TFsuzw9twhoGrgOnTNSmYWqsUW4oqY+SGvrvPUT4tZY=";
+    hash = "sha256-DRVCBbGj0NfQBn9qNRc0Gu3LNO6KDNF1/ZdSAuhCVsM=";
   };
 
   propagatedBuildInputs = [
@@ -43,6 +43,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Discover, connect and control Gree based minisplit systems";
     homepage = "https://github.com/cmroche/greeclimate";
+    changelog = "https://github.com/cmroche/greeclimate/blob/${src.rev}/CHANGELOG.md";
     license = licenses.gpl3Only;
     maintainers = with maintainers; [ dotlambda ];
   };
diff --git a/pkgs/development/python-modules/jwcrypto/default.nix b/pkgs/development/python-modules/jwcrypto/default.nix
index 2904380775f..ce035c1c64e 100644
--- a/pkgs/development/python-modules/jwcrypto/default.nix
+++ b/pkgs/development/python-modules/jwcrypto/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "jwcrypto";
-  version = "1.3";
+  version = "1.3.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-DWRhuhP3wnHYusUBjuYN28rl/zlAP6+kI3X1fQjjmLs=";
+    hash = "sha256-VLVRsRX/tNErHx7pO4uipxu4VWuj2F1i9wdUlhPah3w=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/nbxmpp/default.nix b/pkgs/development/python-modules/nbxmpp/default.nix
index 749d3e6e30c..c94c7a0b01b 100644
--- a/pkgs/development/python-modules/nbxmpp/default.nix
+++ b/pkgs/development/python-modules/nbxmpp/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "nbxmpp";
-  version = "2.0.6";
+  version = "3.0.2";
 
   disabled = pythonOlder "3.7";
 
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "gajim";
     repo = "python-nbxmpp";
     rev = "nbxmpp-${version}";
-    sha256 = "sha256:03iydz0r9m8559srawwnhaqzqm9liwrnc8v6abj4w3m1lil32bid";
+    sha256 = "sha256:0wvganymqw90y9mz5a5mh531r2s9z0vrkbfspx5akk98syaq6f5p";
   };
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/pybullet/default.nix b/pkgs/development/python-modules/pybullet/default.nix
index 24c0014a118..c93cc59d913 100644
--- a/pkgs/development/python-modules/pybullet/default.nix
+++ b/pkgs/development/python-modules/pybullet/default.nix
@@ -8,11 +8,11 @@
 
 buildPythonPackage rec {
   pname = "pybullet";
-  version = "3.2.4";
+  version = "3.2.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-lZ6FvABRMkucSroj15Nlt33iFvnO68OS+dVR/mOg68Y=";
+    sha256 = "sha256-G8ua+4eghr4bLeGPCE0f2rgZTaG/cfJkdDyia6o5w1E=";
   };
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/ssh-mitm/default.nix b/pkgs/development/python-modules/ssh-mitm/default.nix
index 2787dda2e74..22e30c7e1ac 100644
--- a/pkgs/development/python-modules/ssh-mitm/default.nix
+++ b/pkgs/development/python-modules/ssh-mitm/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "ssh-mitm";
-  version = "2.0.1";
+  version = "2.0.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = pname;
     rev = version;
-    hash = "sha256-90ja1xckGC5W0A6xqeTOlR46QhONxGt4PLlue24DWX0=";
+    hash = "sha256-cFahID4+PMQPG/pDAR0bU5MZAa8LsNiirxrzGi2c/EE=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/watchdog/default.nix b/pkgs/development/python-modules/watchdog/default.nix
index 9afd0f032fc..ee1e866f4a6 100644
--- a/pkgs/development/python-modules/watchdog/default.nix
+++ b/pkgs/development/python-modules/watchdog/default.nix
@@ -12,12 +12,12 @@
 
 buildPythonPackage rec {
   pname = "watchdog";
-  version = "2.1.7";
+  version = "2.1.8";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-P9R4FTU76cRO68lMwo/iaysMW9iJ2vxKWny9+SQUNIA=";
+    sha256 = "sha256-bQMUkSaGSr0ycV1OkmfSdUzt4lppBSkBOZNWrTvF7P8=";
   };
 
   buildInputs = lib.optionals stdenv.isDarwin [ CoreServices ];
diff --git a/pkgs/development/python-modules/yappi/default.nix b/pkgs/development/python-modules/yappi/default.nix
index af650f6db3b..8ebc8767a85 100644
--- a/pkgs/development/python-modules/yappi/default.nix
+++ b/pkgs/development/python-modules/yappi/default.nix
@@ -2,24 +2,28 @@
 , buildPythonPackage
 , fetchFromGitHub
 , gevent
-, isPy27
 , python
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "yappi";
-  version = "1.3.2";
+  version = "1.3.5";
+  format = "setuptools";
 
-  disabled = isPy27; # invalid syntax
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "sumerc";
     repo = pname;
-    rev = "8bf7a650066f104f59c3cae4a189ec15e7d51c8c";
-    sha256 = "1q8lr9n0lny2g3mssy3mksbl9m4k1kqn1a4yv1hfqsahxdvpw2dp";
+    # https://github.com/sumerc/yappi/issues/102
+    rev = "1f41868a2cdfd1e935a5a60808f7bb09c871fa53";
+    hash = "sha256-XxUAYrDQAY7fD9yTSmoRUmWJEs+L6KSQ0/bIVf/o9ag=";
   };
 
-  patches = [ ./tests.patch ];
+  patches = [
+    ./tests.patch
+  ];
 
   checkInputs = [
     gevent
@@ -34,8 +38,8 @@ buildPythonPackage rec {
   ];
 
   meta = with lib; {
-    homepage = "https://github.com/sumerc/yappi";
     description = "Python profiler that supports multithreading and measuring CPU time";
+    homepage = "https://github.com/sumerc/yappi";
     license = licenses.mit;
     maintainers = with maintainers; [ orivej ];
   };
diff --git a/pkgs/development/tools/jtc/default.nix b/pkgs/development/tools/jtc/default.nix
index 947f26664f4..c8a13c07cb6 100644
--- a/pkgs/development/tools/jtc/default.nix
+++ b/pkgs/development/tools/jtc/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch }:
 
 stdenv.mkDerivation rec {
   pname = "jtc";
@@ -11,6 +11,14 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-VATRlOOV4wBInLOm9J0Dp2vhtL5mb0Yxdl/ya0JiqEU=";
   };
 
+  patches = [
+    # Fix building with Clang. Removing with next release.
+    (fetchpatch {
+      url = "https://github.com/ldn-softdev/jtc/commit/92a5116e5524c0b6d2f539db7b5cc9fdd7c5b8ab.patch";
+      sha256 = "sha256-AAvDH0XsT8/CAguG611/odg0m1HR+veC0jbAw6KLHLM=";
+    })
+  ];
+
   buildPhase = ''
     runHook preBuild
 
diff --git a/pkgs/os-specific/linux/util-linux/default.nix b/pkgs/os-specific/linux/util-linux/default.nix
index efd75ce9b3f..51eb20ecacd 100644
--- a/pkgs/os-specific/linux/util-linux/default.nix
+++ b/pkgs/os-specific/linux/util-linux/default.nix
@@ -1,6 +1,10 @@
-{ lib, stdenv, fetchurl, pkg-config, zlib, shadow, libcap_ng
+{ lib, stdenv, fetchurl, pkg-config, zlib, shadow
+, capabilitiesSupport ? true
+, libcap_ng
 , ncursesSupport ? true
-, ncurses, pam
+, ncurses
+, pamSupport ? true
+, pam
 , systemdSupport ? stdenv.isLinux && !stdenv.hostPlatform.isStatic
 , systemd
 , nlsSupport ? true
@@ -59,7 +63,9 @@ stdenv.mkDerivation rec {
   ];
 
   nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ zlib pam libcap_ng ]
+  buildInputs = [ zlib ]
+    ++ lib.optionals pamSupport [ pam ]
+    ++ lib.optionals capabilitiesSupport [ libcap_ng ]
     ++ lib.optionals ncursesSupport [ ncurses ]
     ++ lib.optionals systemdSupport [ systemd ];
 
diff --git a/pkgs/tools/X11/setroot/default.nix b/pkgs/tools/X11/setroot/default.nix
index 014ac4c54be..bc7b468caaf 100644
--- a/pkgs/tools/X11/setroot/default.nix
+++ b/pkgs/tools/X11/setroot/default.nix
@@ -1,9 +1,7 @@
-{ lib, stdenv, fetchFromGitHub, libX11, imlib2
-, enableXinerama ? true, libXinerama ? null
+{ lib, stdenv, fetchFromGitHub, libX11, imlib2, pkg-config, fetchpatch
+, enableXinerama ? true, libXinerama
 }:
 
-assert enableXinerama -> libXinerama != null;
-
 stdenv.mkDerivation rec {
   version = "2.0.2";
   pname = "setroot";
@@ -15,12 +13,21 @@ stdenv.mkDerivation rec {
     sha256 = "0w95828v0splk7bj5kfacp4pq6wxpyamvyjmahyvn5hc3ycq21mq";
   };
 
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/ttzhou/setroot/commit/d8ff8edd7d7594d276d741186bf9ccf0bce30277.patch";
+      sha256 = "sha256-e0iMSpiOmTOpQnp599fjH2UCPU4Oq1VKXcVypVoR9hw=";
+    })
+  ];
+
+  nativeBuildInputs = [ pkg-config ];
+
   buildInputs = [ libX11 imlib2 ]
-    ++ lib.optional enableXinerama libXinerama;
+    ++ lib.optionals enableXinerama [ libXinerama ];
 
-  buildFlags = [ "CC=${stdenv.cc.targetPrefix}cc" (if enableXinerama then "xinerama=1" else "xinerama=0") ] ;
+  buildFlags = [ (if enableXinerama then "xinerama=1" else "xinerama=0") ] ;
 
-  installFlags = [ "DESTDIR=$(out)" "PREFIX=" ];
+  installFlags = [ "PREFIX=$(out)" ];
 
   meta = with lib; {
     description = "Simple X background setter inspired by imlibsetroot and feh";
diff --git a/pkgs/tools/misc/snore/default.nix b/pkgs/tools/misc/snore/default.nix
index 92c3de77c84..e9d7d42d772 100644
--- a/pkgs/tools/misc/snore/default.nix
+++ b/pkgs/tools/misc/snore/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch }:
 
 stdenv.mkDerivation rec {
   version = "0.2";
@@ -11,6 +11,14 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-EOwbRqtQEuGZ+aeCBNVfLUq4m/bFWJTvMDM6a+y74qc=";
   };
 
+  patches = [
+    # Fix POSIX_C_SOURCE macro. Remove with the next release.
+    (fetchpatch {
+      url = "https://github.com/clamiax/snore/commit/284e5aa56e775803d24879954136401a106aa063.patch";
+      sha256 = "sha256-len8E8h9CXC25WB2lmnLLJ0PR903tgllDh9K2RqzQk0=";
+    })
+  ];
+
   makeFlags = [ "PREFIX=${placeholder "out"}" ];
 
   meta = with lib; {
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 7b2634fde4a..c7d91352973 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -24807,6 +24807,11 @@ with pkgs;
 
   poppler_data = callPackage ../data/misc/poppler-data { };
 
+  inherit (callPackages ../data/fonts/pretendard { })
+    pretendard
+    pretendard-jp
+    pretendard-std;
+
   quattrocento = callPackage ../data/fonts/quattrocento {};
 
   quattrocento-sans = callPackage ../data/fonts/quattrocento-sans {};
@@ -30252,6 +30257,7 @@ with pkgs;
   wrapNeovimUnstable = callPackage ../applications/editors/neovim/wrapper.nix { };
   wrapNeovim = neovim-unwrapped: lib.makeOverridable (neovimUtils.legacyWrapper neovim-unwrapped);
   neovim-unwrapped = callPackage ../applications/editors/neovim {
+    CoreServices =  darwin.apple_sdk.frameworks.CoreServices;
     lua = luajit;
   };
 
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 4b31e2484a7..a1effc538b6 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -450,6 +450,8 @@ let
 
     functory = callPackage ../development/ocaml-modules/functory { };
 
+    gd4o = callPackage ../development/ocaml-modules/gd4o { };
+
     gen = callPackage ../development/ocaml-modules/gen { };
 
     genspio = callPackage ../development/ocaml-modules/genspio { };