diff --git a/pkgs/applications/editors/poke/default.nix b/pkgs/applications/editors/poke/default.nix
index a24666741e14..cdfacaf92ede 100644
--- a/pkgs/applications/editors/poke/default.nix
+++ b/pkgs/applications/editors/poke/default.nix
@@ -19,13 +19,15 @@ let
   isCross = stdenv.hostPlatform != stdenv.buildPlatform;
 in stdenv.mkDerivation rec {
   pname = "poke";
-  version = "1.3";
+  version = "1.4";
 
   src = fetchurl {
     url = "mirror://gnu/${pname}/${pname}-${version}.tar.gz";
-    hash = "sha256-unhjA0obCABLDuj4i9qUFgcH6aeB1VVvVVtQdYPPDxs=";
+    sha256 = "sha256-zgVN8pVgySEjATJwPuRJ/hMLbiWrA6psx5a7QBUGqiQ=";
   };
 
+  outputs = [ "out" "dev" "info" "lib" "man" ];
+
   postPatch = ''
     patchShebangs .
   '';
@@ -46,7 +48,9 @@ in stdenv.mkDerivation rec {
   ++ lib.optional textStylingSupport gettext
   ++ lib.optional (!isCross) dejagnu;
 
-  configureFlags = lib.optionals guiSupport [
+  configureFlags = [
+    "--datadir=${placeholder "lib"}/share"
+  ] ++ lib.optionals guiSupport [
     "--with-tcl=${tcl}/lib"
     "--with-tk=${tk}/lib"
     "--with-tkinclude=${tk.dev}/include"
@@ -57,6 +61,10 @@ in stdenv.mkDerivation rec {
   doCheck = !isCross;
   checkInputs = lib.optionals (!isCross) [ dejagnu ];
 
+  postInstall = ''
+    moveToOutput share/emacs "$out"
+  '';
+
   meta = with lib; {
     description = "Interactive, extensible editor for binary data";
     homepage = "http://www.jemarch.net/poke";
diff --git a/pkgs/applications/radio/gnuradio/default.nix b/pkgs/applications/radio/gnuradio/default.nix
index d92af80701b1..61aafb63b5db 100644
--- a/pkgs/applications/radio/gnuradio/default.nix
+++ b/pkgs/applications/radio/gnuradio/default.nix
@@ -46,13 +46,13 @@
 , pname ? "gnuradio"
 , versionAttr ? {
   major = "3.9";
-  minor = "3";
+  minor = "4";
   patch = "0";
 }
 }:
 
 let
-  sourceSha256 = "sha256-jVfExv1CcnlOaaj/XtnfhWAHnQsshZJ1l/zXo0uovdo=";
+  sourceSha256 = "sha256-O+37CyF0IVPdUB1e68HsaXD0T2VsOLPXOpLNlRYEXUk=";
   featuresInfo = {
     # Needed always
     basic = {
@@ -79,6 +79,9 @@ let
       native = [ doxygen ];
       cmakeEnableFlag = "DOXYGEN";
     };
+    man-pages = {
+      cmakeEnableFlag = "MANPAGES";
+    };
     python-support = {
       pythonRuntime = [ python.pkgs.six ];
       native = [
@@ -269,11 +272,6 @@ stdenv.mkDerivation rec {
   patches = [
     # Not accepted upstream, see https://github.com/gnuradio/gnuradio/pull/5227
     ./modtool-newmod-permissions.patch
-    (fetchpatch {
-      # https://github.com/gnuradio/gnuradio/pull/5225
-      url = "https://github.com/gnuradio/gnuradio/commit/4cef46e3ea0faf04e05ca1a5846cd1568fa51bb2.patch";
-      sha256 = "sha256-6AlGbtD1S0c3I9JSoLTMP4YqwDU17i2j+XRkuR+QTuc=";
-    })
   ];
   passthru = shared.passthru // {
     # Deps that are potentially overriden and are used inside GR plugins - the same version must
diff --git a/pkgs/development/coq-modules/equations/default.nix b/pkgs/development/coq-modules/equations/default.nix
index e6d5e11fcc5f..f563d1728744 100644
--- a/pkgs/development/coq-modules/equations/default.nix
+++ b/pkgs/development/coq-modules/equations/default.nix
@@ -7,7 +7,7 @@ with lib; mkCoqDerivation {
   inherit version;
   defaultVersion = switch coq.coq-version [
     { case = "8.14"; out = "1.3-8.14"; }
-    { case = "8.13"; out = "1.2.4+coq8.13"; }
+    { case = "8.13"; out = "1.3-8.13"; }
     { case = "8.12"; out = "1.2.4+coq8.12"; }
     { case = "8.11"; out = "1.2.4+coq8.11"; }
     { case = "8.10"; out = "1.2.1+coq8.10-2"; }
@@ -44,6 +44,8 @@ with lib; mkCoqDerivation {
     release."1.2.4+coq8.12".sha256    = "1n0w8is464qcq8mk2mv7amaf0khbjz5mpc9phf0rhpjm0lb22cb3";
     release."1.2.4+coq8.13".rev       = "v1.2.4-8.13";
     release."1.2.4+coq8.13".sha256    = "0i014lshsdflzw6h0qxra9d2f0q82vffxv2f29awbb9ad0p4rq4q";
+    release."1.3-8.13".rev            = "v1.3-8.13";
+    release."1.3-8.13".sha256         = "1jwjbkkkk4bwf6pz4zzz8fy5bb17aqyf4smkja59rgj9ya6nrdhg";
     release."1.3-8.14".rev            = "v1.3-8.14";
     release."1.3-8.14".sha256         = "19bj9nncd1r9g4273h5qx35gs3i4bw5z9bhjni24b413hyj55hkv";
 
diff --git a/pkgs/development/libraries/lzlib/default.nix b/pkgs/development/libraries/lzlib/default.nix
new file mode 100644
index 000000000000..098336dfbd12
--- /dev/null
+++ b/pkgs/development/libraries/lzlib/default.nix
@@ -0,0 +1,26 @@
+{ lib, stdenv, fetchurl, texinfo }:
+
+stdenv.mkDerivation rec {
+  pname = "lzlib";
+  version = "1.10";
+  outputs = [ "out" "info" ];
+
+  nativeBuildInputs = [ texinfo ];
+
+  src = fetchurl {
+    url = "mirror://savannah/lzip/${pname}/${pname}-${version}.tar.gz";
+    sha256 = "sha256-HWq3gApbQ+Vv0gYH/Sz9qeVQNQ3JX1vrakzhT4W0EEM=";
+  };
+
+  makeFlags = [ "AR:=$(AR)" "CC:=$(CC)" ];
+  doCheck = true;
+
+  meta = with lib; {
+    homepage = "https://www.nongnu.org/lzip/${pname}.html";
+    description =
+      "Data compression library providing in-memory LZMA compression and decompression functions, including integrity checking of the decompressed data";
+    license = licenses.bsd2;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ ehmry ];
+  };
+}
diff --git a/pkgs/development/python-modules/flux-led/default.nix b/pkgs/development/python-modules/flux-led/default.nix
index 1bfc96ff7217..58e271b10dc5 100644
--- a/pkgs/development/python-modules/flux-led/default.nix
+++ b/pkgs/development/python-modules/flux-led/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "flux-led";
-  version = "0.25.1";
+  version = "0.25.10";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "Danielhiversen";
     repo = "flux_led";
     rev = version;
-    sha256 = "sha256-+GgA7ma27dah8G/ITsy84jZHpktJHnGSMjzMfAvvuJg=";
+    sha256 = "sha256-WkLwiQNwueksPpuQ5aMBsenKyzUid1fbeOqEDAhfjkA=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/tools/analysis/checkov/default.nix b/pkgs/development/tools/analysis/checkov/default.nix
index aabbcd07a535..7927a797656b 100644
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@@ -46,13 +46,13 @@ with py.pkgs;
 
 buildPythonApplication rec {
   pname = "checkov";
-  version = "2.0.614";
+  version = "2.0.625";
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = pname;
     rev = version;
-    sha256 = "sha256-z1d1Zcq4x2wU/j4yWpaRwJXsUqy95Ai2uM18EHqxze0=";
+    sha256 = "sha256-Q2GaLHciqgsvnYAFdq6839OHcpxWM2m/H10CPmBj2vg=";
   };
 
   nativeBuildInputs = with py.pkgs; [
diff --git a/pkgs/development/tools/shellcheck/default.nix b/pkgs/development/tools/shellcheck/default.nix
index 13cfc93cfc67..e85b596607b1 100644
--- a/pkgs/development/tools/shellcheck/default.nix
+++ b/pkgs/development/tools/shellcheck/default.nix
@@ -21,9 +21,7 @@ let
     pname = "shellcheck";
     version = bin.version;
 
-    inherit (ShellCheck) src;
-
-    meta = builtins.removeAttrs ShellCheck.meta [ "hydraPlatforms" ];
+    inherit (ShellCheck) meta src;
 
     nativeBuildInputs = [ pandoc ];
 
diff --git a/pkgs/os-specific/linux/kernel/linux-zen.nix b/pkgs/os-specific/linux/kernel/linux-zen.nix
index a822f5d10805..8ff8b30809b7 100644
--- a/pkgs/os-specific/linux/kernel/linux-zen.nix
+++ b/pkgs/os-specific/linux/kernel/linux-zen.nix
@@ -2,7 +2,7 @@
 
 let
   # having the full version string here makes it easier to update
-  modDirVersion = "5.15.3-zen1";
+  modDirVersion = "5.15.5-zen1";
   parts = lib.splitString "-" modDirVersion;
   version = lib.elemAt parts 0;
   suffix = lib.elemAt parts 1;
@@ -19,7 +19,7 @@ buildLinux (args // {
     owner = "zen-kernel";
     repo = "zen-kernel";
     rev = "v${modDirVersion}";
-    sha256 = "sha256-GleOhTKLhnhepAlR+TkiCYcgEe5KfVvDKTPWP7/D8wQ=";
+    sha256 = "sha256-sEt6h29GY18+45jHheRd69eCw+EAzn/CVUK5XRqdZcA=";
   };
 
   structuredExtraConfig = with lib.kernel; {
diff --git a/pkgs/servers/dns/knot-resolver/default.nix b/pkgs/servers/dns/knot-resolver/default.nix
index 420b09234547..26f35145b67c 100644
--- a/pkgs/servers/dns/knot-resolver/default.nix
+++ b/pkgs/servers/dns/knot-resolver/default.nix
@@ -17,11 +17,11 @@ lua = luajitPackages;
 
 unwrapped = stdenv.mkDerivation rec {
   pname = "knot-resolver";
-  version = "5.4.2";
+  version = "5.4.3";
 
   src = fetchurl {
     url = "https://secure.nic.cz/files/knot-resolver/${pname}-${version}.tar.xz";
-    sha256 = "ea6a219571a752056669bae3f2c0c3ed0bec58af5ab832d505a3ec9c4063a58b";
+    sha256 = "488729eb93190336b6bca10de0d78ecb7919f77fcab105debc0a644aa7d0a506";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/tools/archivers/tarlz/default.nix b/pkgs/tools/archivers/tarlz/default.nix
new file mode 100644
index 000000000000..d5b53c5eaaaa
--- /dev/null
+++ b/pkgs/tools/archivers/tarlz/default.nix
@@ -0,0 +1,28 @@
+{ lib, stdenv, fetchurl, lzip, lzlib, texinfo }:
+
+stdenv.mkDerivation rec {
+  pname = "tarlz";
+  version = "0.11";
+  outputs = [ "out" "man" "info" ];
+
+  nativeBuildInputs = [ lzip texinfo ];
+  buildInputs = [ lzlib ];
+
+  src = fetchurl {
+    url = "mirror://savannah/lzip/${pname}/${pname}-${version}.tar.lz";
+    sha256 = "sha256-PalRMerepfYDSaDs4irck+1v5Gy/vlB9CyU6omWUXlk=";
+  };
+
+  enableParallelBuilding = true;
+  makeFlags = [ "CXX:=$(CXX)" ];
+  doCheck = true;
+
+  meta = with lib; {
+    homepage = "https://www.nongnu.org/lzip/${pname}.html";
+    description =
+      "Massively parallel combined implementation of the tar archiver and the lzip compressor";
+    license = licenses.gpl2Plus;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ ehmry ];
+  };
+}
diff --git a/pkgs/tools/inputmethods/m17n-lib/default.nix b/pkgs/tools/inputmethods/m17n-lib/default.nix
index 2ca60bca3e74..cc290ab0eca9 100644
--- a/pkgs/tools/inputmethods/m17n-lib/default.nix
+++ b/pkgs/tools/inputmethods/m17n-lib/default.nix
@@ -11,9 +11,11 @@ stdenv.mkDerivation rec {
   strictDeps = true;
 
   # reconf needed to sucesfully cross-compile
-  nativeBuildInputs = [ autoreconfHook pkg-config ];
-
-  buildInputs = [ m17n_db ];
+  nativeBuildInputs = [
+    autoreconfHook pkg-config
+    # requires m17n-db tool at build time
+    m17n_db
+  ];
 
   # Fails parallel build due to missing intra-package depends:
   #   https://savannah.nongnu.org/bugs/index.php?61377
diff --git a/pkgs/tools/security/kubescape/default.nix b/pkgs/tools/security/kubescape/default.nix
index e68980cc9659..9534480b7dde 100644
--- a/pkgs/tools/security/kubescape/default.nix
+++ b/pkgs/tools/security/kubescape/default.nix
@@ -6,20 +6,20 @@
 
 buildGoModule rec {
   pname = "kubescape";
-  version = "1.0.131";
+  version = "1.0.132";
 
   src = fetchFromGitHub {
     owner = "armosec";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-DcReo4pTdI8ssWH1IqD8gDUm4jQ0jBBJ+ltxSpdkxQE=";
+    sha256 = "sha256-hx11RCLEUW/2MKNIXz51wOyKC7zv0M3Wvblam/E3rdQ=";
   };
 
   nativeBuildInputs = [
     installShellFiles
   ];
 
-  vendorSha256 = "sha256-SxJnYJyKFed1c+zgeeXQQhsKHlaDevJGMwqA5gPef3s=";
+  vendorSha256 = "sha256-GrQmWHdCk8Yl/ryS2zLQU8XCkjfS20qjlEScU8AQT0o=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index e940b1895384..7bb75e401a61 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -9916,6 +9916,8 @@ with pkgs;
 
   target-isns = callPackage ../os-specific/linux/target-isns { };
 
+  tarlz = callPackage ../tools/archivers/tarlz { };
+
   tarsnap = callPackage ../tools/backup/tarsnap { };
 
   tarsnapper = callPackage ../tools/backup/tarsnapper { };
@@ -18547,6 +18549,8 @@ with pkgs;
 
   lyra = callPackage ../development/libraries/lyra { };
 
+  lzlib = callPackage ../development/libraries/lzlib { };
+
   lzo = callPackage ../development/libraries/lzo { };
 
   opencl-clang = callPackage ../development/libraries/opencl-clang { };