Merge staging-next into staging

53 files changed, 1083 insertions, 416 deletions

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index d800d0619079..e25af81c96a8 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -203,6 +203,15 @@
       fingerprint = "D292 365E 3C46 A5AA 75EE  B30B 78DB 7EDE 3540 794B";
     }];
   };
+  _6543 = {
+    email = "6543@obermui.de";
+    github = "6543";
+    githubId = 24977596;
+    name = "6543";
+    keys = [{
+      fingerprint = "8722 B61D 7234 1082 553B  201C B8BE 6D61 0E61 C862";
+    }];
+  };
   _6AA4FD = {
     email = "f6442954@gmail.com";
     github = "6AA4FD";
@@ -7038,6 +7047,15 @@
     github = "ghostbuster91";
     githubId = 5662622;
   };
+  ghthor = {
+    email = "ghthor@gmail.com";
+    github = "ghthor";
+    githubId = 160298;
+    name = "Will Owens";
+    keys = [{
+      fingerprint = "8E98 BB01 BFF8 AEA4 E303  FC4C 8074 09C9 2CE2 3033";
+    }];
+  };
   ghuntley = {
     email = "ghuntley@ghuntley.com";
     github = "ghuntley";
diff --git a/nixos/doc/manual/release-notes/rl-2405.section.md b/nixos/doc/manual/release-notes/rl-2405.section.md
index 8fc7308f32e1..8b89143a199b 100644
--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@@ -93,6 +93,8 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 
 - [Clevis](https://github.com/latchset/clevis), a pluggable framework for automated decryption, used to unlock encrypted devices in initrd. Available as [boot.initrd.clevis.enable](#opt-boot.initrd.clevis.enable).
 
+- [armagetronad](https://wiki.armagetronad.org), a mid-2000s 3D lightcycle game widely played at iD Tech Camps. You can define multiple servers using `services.armagetronad.<server>.enable`.
+
 - [TuxClocker](https://github.com/Lurkki14/tuxclocker), a hardware control and monitoring program. Available as [programs.tuxclocker](#opt-programs.tuxclocker.enable).
 
 - [ALVR](https://github.com/alvr-org/alvr), a VR desktop streamer. Available as [programs.alvr](#opt-programs.alvr.enable)
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 378921c99694..90268d3efb47 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -512,6 +512,7 @@
   ./services/editors/infinoted.nix
   ./services/finance/odoo.nix
   ./services/games/archisteamfarm.nix
+  ./services/games/armagetronad.nix
   ./services/games/crossfire-server.nix
   ./services/games/deliantra-server.nix
   ./services/games/factorio.nix
diff --git a/nixos/modules/services/games/armagetronad.nix b/nixos/modules/services/games/armagetronad.nix
new file mode 100644
index 000000000000..f79818e0e53b
--- /dev/null
+++ b/nixos/modules/services/games/armagetronad.nix
@@ -0,0 +1,268 @@
+{ config, lib, pkgs, ... }:
+let
+  inherit (lib) mkEnableOption mkIf mkOption mkMerge literalExpression;
+  inherit (lib) mapAttrsToList filterAttrs unique recursiveUpdate types;
+
+  mkValueStringArmagetron = with lib; v:
+    if isInt v then toString v
+    else if isFloat v then toString v
+    else if isString v then v
+    else if true == v then "1"
+    else if false == v then "0"
+    else if null == v then ""
+    else throw "unsupported type: ${builtins.typeOf v}: ${(lib.generators.toPretty {} v)}";
+
+  settingsFormat = pkgs.formats.keyValue {
+    mkKeyValue = lib.generators.mkKeyValueDefault
+      {
+        mkValueString = mkValueStringArmagetron;
+      } " ";
+    listsAsDuplicateKeys = true;
+  };
+
+  cfg = config.services.armagetronad;
+  enabledServers = lib.filterAttrs (n: v: v.enable) cfg.servers;
+  nameToId = serverName: "armagetronad-${serverName}";
+  getStateDirectory = serverName: "armagetronad/${serverName}";
+  getServerRoot = serverName: "/var/lib/${getStateDirectory serverName}";
+in
+{
+  options = {
+    services.armagetronad = {
+      servers = mkOption {
+        description = lib.mdDoc "Armagetron server definitions.";
+        default = { };
+        type = types.attrsOf (types.submodule {
+          options = {
+            enable = mkEnableOption (lib.mdDoc "armagetronad");
+
+            package = lib.mkPackageOptionMD pkgs "armagetronad-dedicated" {
+              example = ''
+                pkgs.armagetronad."0.2.9-sty+ct+ap".dedicated
+              '';
+              extraDescription = ''
+                Ensure that you use a derivation which contains the path `bin/armagetronad-dedicated`.
+              '';
+            };
+
+            host = mkOption {
+              type = types.str;
+              default = "0.0.0.0";
+              description = lib.mdDoc "Host to listen on. Used for SERVER_IP.";
+            };
+
+            port = mkOption {
+              type = types.port;
+              default = 4534;
+              description = lib.mdDoc "Port to listen on. Used for SERVER_PORT.";
+            };
+
+            dns = mkOption {
+              type = types.nullOr types.str;
+              default = null;
+              description = lib.mdDoc "DNS address to use for this server. Optional.";
+            };
+
+            openFirewall = mkOption {
+              type = types.bool;
+              default = true;
+              description = lib.mdDoc "Set to true to open the configured UDP port for Armagetron Advanced.";
+            };
+
+            name = mkOption {
+              type = types.str;
+              description = "The name of this server.";
+            };
+
+            settings = mkOption {
+              type = settingsFormat.type;
+              default = { };
+              description = lib.mdDoc ''
+                Armagetron Advanced server rules configuration. Refer to:
+                <https://wiki.armagetronad.org/index.php?title=Console_Commands>
+                or `armagetronad-dedicated --doc` for a list.
+
+                This attrset is used to populate `settings_custom.cfg`; see:
+                <https://wiki.armagetronad.org/index.php/Configuration_Files>
+              '';
+              example = literalExpression ''
+                {
+                  CYCLE_RUBBER = 40;
+                }
+              '';
+            };
+
+            roundSettings = mkOption {
+              type = settingsFormat.type;
+              default = { };
+              description = lib.mdDoc ''
+                Armagetron Advanced server per-round configuration. Refer to:
+                <https://wiki.armagetronad.org/index.php?title=Console_Commands>
+                or `armagetronad-dedicated --doc` for a list.
+
+                This attrset is used to populate `everytime.cfg`; see:
+                <https://wiki.armagetronad.org/index.php/Configuration_Files>
+              '';
+              example = literalExpression ''
+                {
+                  SAY = [
+                    "Hosted on NixOS"
+                    "https://nixos.org"
+                    "iD Tech High Rubber rul3z!! Happy New Year 2008!!1"
+                  ];
+                }
+              '';
+            };
+          };
+        });
+      };
+    };
+  };
+
+  config = mkIf (enabledServers != { }) {
+    systemd.tmpfiles.settings = mkMerge (mapAttrsToList
+      (serverName: serverCfg:
+        let
+          serverId = nameToId serverName;
+          serverRoot = getServerRoot serverName;
+          serverInfo = (
+            {
+              SERVER_IP = serverCfg.host;
+              SERVER_PORT = serverCfg.port;
+              SERVER_NAME = serverCfg.name;
+            } // (lib.optionalAttrs (serverCfg.dns != null) { SERVER_DNS = serverCfg.dns; })
+          );
+          customSettings = serverCfg.settings;
+          everytimeSettings = serverCfg.roundSettings;
+
+          serverInfoCfg = settingsFormat.generate "server_info.${serverName}.cfg" serverInfo;
+          customSettingsCfg = settingsFormat.generate "settings_custom.${serverName}.cfg" customSettings;
+          everytimeSettingsCfg = settingsFormat.generate "everytime.${serverName}.cfg" everytimeSettings;
+        in
+        {
+          "10-armagetronad-${serverId}" = {
+            "${serverRoot}/data" = {
+              d = {
+                group = serverId;
+                user = serverId;
+                mode = "0750";
+              };
+            };
+            "${serverRoot}/settings" = {
+              d = {
+                group = serverId;
+                user = serverId;
+                mode = "0750";
+              };
+            };
+            "${serverRoot}/var" = {
+              d = {
+                group = serverId;
+                user = serverId;
+                mode = "0750";
+              };
+            };
+            "${serverRoot}/resource" = {
+              d = {
+                group = serverId;
+                user = serverId;
+                mode = "0750";
+              };
+            };
+            "${serverRoot}/input" = {
+              "f+" = {
+                group = serverId;
+                user = serverId;
+                mode = "0640";
+              };
+            };
+            "${serverRoot}/settings/server_info.cfg" = {
+              "L+" = {
+                argument = "${serverInfoCfg}";
+              };
+            };
+            "${serverRoot}/settings/settings_custom.cfg" = {
+              "L+" = {
+                argument = "${customSettingsCfg}";
+              };
+            };
+            "${serverRoot}/settings/everytime.cfg" = {
+              "L+" = {
+                argument = "${everytimeSettingsCfg}";
+              };
+            };
+          };
+        }
+      )
+      enabledServers
+    );
+
+    systemd.services = mkMerge (mapAttrsToList
+      (serverName: serverCfg:
+        let
+          serverId = nameToId serverName;
+        in
+        {
+          "armagetronad-${serverName}" = {
+            description = "Armagetron Advanced Dedicated Server for ${serverName}";
+            wants = [ "basic.target" ];
+            after = [ "basic.target" "network.target" "multi-user.target" ];
+            wantedBy = [ "multi-user.target" ];
+            serviceConfig =
+              let
+                serverRoot = getServerRoot serverName;
+              in
+              {
+                Type = "simple";
+                StateDirectory = getStateDirectory serverName;
+                ExecStart = "${lib.getExe serverCfg.package} --daemon --input ${serverRoot}/input --userdatadir ${serverRoot}/data --userconfigdir ${serverRoot}/settings --vardir ${serverRoot}/var --autoresourcedir ${serverRoot}/resource";
+                Restart = "on-failure";
+                CapabilityBoundingSet = "";
+                LockPersonality = true;
+                NoNewPrivileges = true;
+                PrivateDevices = true;
+                PrivateTmp = true;
+                PrivateUsers = true;
+                ProtectClock = true;
+                ProtectControlGroups = true;
+                ProtectHome = true;
+                ProtectHostname = true;
+                ProtectKernelLogs = true;
+                ProtectKernelModules = true;
+                ProtectKernelTunables = true;
+                ProtectProc = "invisible";
+                ProtectSystem = "strict";
+                RestrictNamespaces = true;
+                RestrictSUIDSGID = true;
+                User = serverId;
+                Group = serverId;
+              };
+          };
+        })
+      enabledServers
+    );
+
+    networking.firewall.allowedUDPPorts =
+      unique (mapAttrsToList (serverName: serverCfg: serverCfg.port) (filterAttrs (serverName: serverCfg: serverCfg.openFirewall) enabledServers));
+
+    users.users = mkMerge (mapAttrsToList
+      (serverName: serverCfg:
+        {
+          ${nameToId serverName} = {
+            group = nameToId serverName;
+            description = "Armagetron Advanced dedicated user for server ${serverName}";
+            isSystemUser = true;
+          };
+        })
+      enabledServers
+    );
+
+    users.groups = mkMerge (mapAttrsToList
+      (serverName: serverCfg:
+        {
+          ${nameToId serverName} = { };
+        })
+      enabledServers
+    );
+  };
+}
diff --git a/nixos/modules/services/networking/unbound.nix b/nixos/modules/services/networking/unbound.nix
index 616b32f11797..8438e472e11e 100644
--- a/nixos/modules/services/networking/unbound.nix
+++ b/nixos/modules/services/networking/unbound.nix
@@ -24,12 +24,24 @@ let
   confNoServer = concatStringsSep "\n" ((mapAttrsToList (toConf "") (builtins.removeAttrs cfg.settings [ "server" ])) ++ [""]);
   confServer = concatStringsSep "\n" (mapAttrsToList (toConf "  ") (builtins.removeAttrs cfg.settings.server [ "define-tag" ]));
 
-  confFile = pkgs.writeText "unbound.conf" ''
+  confFileUnchecked = pkgs.writeText "unbound.conf" ''
     server:
     ${optionalString (cfg.settings.server.define-tag != "") (toOption "  " "define-tag" cfg.settings.server.define-tag)}
     ${confServer}
     ${confNoServer}
   '';
+  confFile = if cfg.checkconf then pkgs.runCommandLocal "unbound-checkconf" { } ''
+    cp ${confFileUnchecked} unbound.conf
+
+    # fake stateDir which is not accesible in the sandbox
+    mkdir -p $PWD/state
+    sed -i unbound.conf \
+      -e '/auto-trust-anchor-file/d' \
+      -e "s|${cfg.stateDir}|$PWD/state|"
+    ${cfg.package}/bin/unbound-checkconf unbound.conf
+
+    cp ${confFileUnchecked} $out
+  '' else confFileUnchecked;
 
   rootTrustAnchorFile = "${cfg.stateDir}/root.key";
 
@@ -62,6 +74,17 @@ in {
         description = lib.mdDoc "Directory holding all state for unbound to run.";
       };
 
+      checkconf = mkOption {
+        type = types.bool;
+        default = !cfg.settings ? include;
+        defaultText = "!config.services.unbound.settings ? include";
+        description = lib.mdDoc ''
+          Wether to check the resulting config file with unbound checkconf for syntax errors.
+
+          If settings.include is used, then this options is disabled, as the import can likely not be resolved at build time.
+        '';
+      };
+
       resolveLocalQueries = mkOption {
         type = types.bool;
         default = true;
diff --git a/nixos/modules/virtualisation/podman/default.nix b/nixos/modules/virtualisation/podman/default.nix
index 5a99dc8a1bb9..a97739054216 100644
--- a/nixos/modules/virtualisation/podman/default.nix
+++ b/nixos/modules/virtualisation/podman/default.nix
@@ -216,9 +216,11 @@ in
         requires = [ "podman.service" ];
       };
 
+      systemd.services.podman.environment = config.networking.proxy.envVars;
       systemd.sockets.podman.wantedBy = [ "sockets.target" ];
       systemd.sockets.podman.socketConfig.SocketGroup = "podman";
 
+      systemd.user.services.podman.environment = config.networking.proxy.envVars;
       systemd.user.sockets.podman.wantedBy = [ "sockets.target" ];
 
       systemd.timers.podman-prune.timerConfig = lib.mkIf cfg.autoPrune.enable {
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index e9d3e9935c9a..231767ca2b97 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -128,6 +128,7 @@ in {
   appliance-repart-image = runTest ./appliance-repart-image.nix;
   apparmor = handleTest ./apparmor.nix {};
   archi = handleTest ./archi.nix {};
+  armagetronad = handleTest ./armagetronad.nix {};
   atd = handleTest ./atd.nix {};
   atop = handleTest ./atop.nix {};
   atuin = handleTest ./atuin.nix {};
diff --git a/nixos/tests/armagetronad.nix b/nixos/tests/armagetronad.nix
new file mode 100644
index 000000000000..ff2841dedd21
--- /dev/null
+++ b/nixos/tests/armagetronad.nix
@@ -0,0 +1,272 @@
+import ./make-test-python.nix ({ pkgs, ...} :
+
+let
+  user = "alice";
+
+  client =
+    { pkgs, ... }:
+
+    { imports = [ ./common/user-account.nix ./common/x11.nix ];
+      hardware.opengl.driSupport = true;
+      virtualisation.memorySize = 256;
+      environment = {
+        systemPackages = [ pkgs.armagetronad ];
+        variables.XAUTHORITY = "/home/${user}/.Xauthority";
+      };
+      test-support.displayManager.auto.user = user;
+    };
+
+in {
+  name = "armagetronad";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ numinit ];
+  };
+
+  enableOCR = true;
+
+  nodes =
+    {
+      server = {
+        services.armagetronad.servers = {
+          high-rubber = {
+            enable = true;
+            name = "Smoke Test High Rubber Server";
+            port = 4534;
+            settings = {
+              SERVER_OPTIONS = "High Rubber server made to run smoke tests.";
+              CYCLE_RUBBER = 40;
+              SIZE_FACTOR = 0.5;
+            };
+            roundSettings = {
+              SAY = [
+                "NixOS Smoke Test Server"
+                "https://nixos.org"
+              ];
+            };
+          };
+          sty = {
+            enable = true;
+            name = "Smoke Test sty+ct+ap Server";
+            package = pkgs.armagetronad."0.2.9-sty+ct+ap".dedicated;
+            port = 4535;
+            settings = {
+              SERVER_OPTIONS = "sty+ct+ap server made to run smoke tests.";
+              CYCLE_RUBBER = 20;
+              SIZE_FACTOR = 0.5;
+            };
+            roundSettings = {
+              SAY = [
+                "NixOS Smoke Test sty+ct+ap Server"
+                "https://nixos.org"
+              ];
+            };
+          };
+          trunk = {
+            enable = true;
+            name = "Smoke Test trunk Server";
+            package = pkgs.armagetronad."0.4".dedicated;
+            port = 4536;
+            settings = {
+              SERVER_OPTIONS = "0.4 server made to run smoke tests.";
+              CYCLE_RUBBER = 20;
+              SIZE_FACTOR = 0.5;
+            };
+            roundSettings = {
+              SAY = [
+                "NixOS Smoke Test 0.4 Server"
+                "https://nixos.org"
+              ];
+            };
+          };
+        };
+      };
+
+      client1 = client;
+      client2 = client;
+    };
+
+  testScript = let
+    xdo = name: text: let
+      xdoScript = pkgs.writeText "${name}.xdo" text;
+    in "${pkgs.xdotool}/bin/xdotool ${xdoScript}";
+  in
+    ''
+      import shlex
+      import threading
+      from collections import namedtuple
+
+      class Client(namedtuple('Client', ('node', 'name'))):
+        def send(self, *keys):
+          for key in keys:
+            self.node.send_key(key)
+
+        def send_on(self, text, *keys):
+          self.node.wait_for_text(text)
+          self.send(*keys)
+
+      Server = namedtuple('Server', ('node', 'name', 'address', 'port', 'welcome', 'attacker', 'victim', 'coredump_delay'))
+
+      # Clients and their in-game names
+      clients = (
+        Client(client1, 'Arduino'),
+        Client(client2, 'SmOoThIcE')
+      )
+
+      # Server configs.
+      servers = (
+        Server(server, 'high-rubber', 'server', 4534, 'NixOS Smoke Test Server', 'SmOoThIcE', 'Arduino', 8),
+        Server(server, 'sty', 'server', 4535, 'NixOS Smoke Test sty+ct+ap Server', 'Arduino', 'SmOoThIcE', 8),
+        Server(server, 'trunk', 'server', 4536, 'NixOS Smoke Test 0.4 Server', 'Arduino', 'SmOoThIcE', 8)
+      )
+
+      """
+      Runs a command as the client user.
+      """
+      def run(cmd):
+        return "su - ${user} -c " + shlex.quote(cmd)
+
+      screenshot_idx = 1
+
+      """
+      Takes screenshots on all clients.
+      """
+      def take_screenshots(screenshot_idx):
+        for client in clients:
+          client.node.screenshot(f"screen_{client.name}_{screenshot_idx}")
+        return screenshot_idx + 1
+
+      # Wait for the servers to come up.
+      start_all()
+      for srv in servers:
+        srv.node.wait_for_unit(f"armagetronad-{srv.name}")
+        srv.node.wait_until_succeeds(f"ss --numeric --udp --listening | grep -q {srv.port}")
+
+      # Make sure console commands work through the named pipe we created.
+      for srv in servers:
+        srv.node.succeed(
+          f"echo 'say Testing!' >> /var/lib/armagetronad/{srv.name}/input"
+        )
+        srv.node.succeed(
+          f"echo 'say Testing again!' >> /var/lib/armagetronad/{srv.name}/input"
+        )
+        srv.node.wait_until_succeeds(
+          f"journalctl -u armagetronad-{srv.name} -e | grep -q 'Admin: Testing!'"
+        )
+        srv.node.wait_until_succeeds(
+          f"journalctl -u armagetronad-{srv.name} -e | grep -q 'Admin: Testing again!'"
+        )
+
+      """
+      Sets up a client, waiting for the given barrier on completion.
+      """
+      def client_setup(client, servers, barrier):
+        client.node.wait_for_x()
+
+        # Configure Armagetron.
+        client.node.succeed(
+          run("mkdir -p ~/.armagetronad/var"),
+          run(f"echo 'PLAYER_1 {client.name}' >> ~/.armagetronad/var/autoexec.cfg")
+        )
+        for idx, srv in enumerate(servers):
+          client.node.succeed(
+            run(f"echo 'BOOKMARK_{idx+1}_ADDRESS {srv.address}' >> ~/.armagetronad/var/autoexec.cfg"),
+            run(f"echo 'BOOKMARK_{idx+1}_NAME {srv.name}' >> ~/.armagetronad/var/autoexec.cfg"),
+            run(f"echo 'BOOKMARK_{idx+1}_PORT {srv.port}' >> ~/.armagetronad/var/autoexec.cfg")
+          )
+
+        # Start Armagetron.
+        client.node.succeed(run("ulimit -c unlimited; armagetronad >&2 & disown"))
+        client.node.wait_until_succeeds(
+          run(
+            "${xdo "create_new_win-select_main_window" ''
+              search --onlyvisible --name "Armagetron Advanced"
+              windowfocus --sync
+              windowactivate --sync
+            ''}"
+          )
+        )
+
+        # Get through the tutorial.
+        client.send_on('Language Settings', 'ret')
+        client.send_on('First Setup', 'ret')
+        client.send_on('Welcome to Armagetron Advanced', 'ret')
+        client.send_on('round 1', 'esc')
+        client.send_on('Menu', 'up', 'up', 'ret')
+        client.send_on('We hope you', 'ret')
+        client.send_on('Armagetron Advanced', 'ret')
+        client.send_on('Play Game', 'ret')
+
+        # Online > LAN > Network Setup > Mates > Server Bookmarks
+        client.send_on('Multiplayer', 'down', 'down', 'down', 'down', 'ret')
+
+        barrier.wait()
+
+      # Get to the Server Bookmarks screen on both clients. This takes a while so do it asynchronously.
+      barrier = threading.Barrier(3, timeout=120)
+      for client in clients:
+        threading.Thread(target=client_setup, args=(client, servers, barrier)).start()
+      barrier.wait()
+
+      # Main testing loop. Iterates through each server bookmark and connects to them in sequence.
+      # Assumes that the game is currently on the Server Bookmarks screen.
+      for srv in servers:
+        screenshot_idx = take_screenshots(screenshot_idx)
+
+        # Connect both clients at once, one second apart.
+        for client in clients:
+          client.send('ret')
+          client.node.sleep(1)
+
+        # Wait for clients to connect
+        for client in clients:
+          srv.node.wait_until_succeeds(
+            f"journalctl -u armagetronad-{srv.name} -e | grep -q '{client.name}.*entered the game'"
+          )
+
+        # Wait for the match to start
+        srv.node.wait_until_succeeds(
+          f"journalctl -u armagetronad-{srv.name} -e | grep -q 'Admin: {srv.welcome}'"
+        )
+        srv.node.wait_until_succeeds(
+          f"journalctl -u armagetronad-{srv.name} -e | grep -q 'Admin: https://nixos.org'"
+        )
+        srv.node.wait_until_succeeds(
+          f"journalctl -u armagetronad-{srv.name} -e | grep -q 'Go (round 1 of 10)'"
+        )
+
+        # Wait a bit
+        srv.node.sleep(srv.coredump_delay)
+
+        # Turn the attacker player's lightcycle left
+        attacker = next(client for client in clients if client.name == srv.attacker)
+        victim = next(client for client in clients if client.name == srv.victim)
+        attacker.send('left')
+        screenshot_idx = take_screenshots(screenshot_idx)
+
+        # Wait for coredump.
+        srv.node.wait_until_succeeds(
+          f"journalctl -u armagetronad-{srv.name} -e | grep -q '{attacker.name} core dumped {victim.name}'"
+        )
+        screenshot_idx = take_screenshots(screenshot_idx)
+
+        # Disconnect both clients from the server
+        for client in clients:
+          client.send('esc')
+          client.send_on('Menu', 'up', 'up', 'ret')
+          srv.node.wait_until_succeeds(
+            f"journalctl -u armagetronad-{srv.name} -e | grep -q '{client.name}.*left the game'"
+          )
+
+        # Next server.
+        for client in clients:
+          client.send_on('Server Bookmarks', 'down')
+
+      # Stop the servers
+      for srv in servers:
+        srv.node.succeed(
+          f"systemctl stop armagetronad-{srv.name}"
+        )
+        srv.node.wait_until_fails(f"ss --numeric --udp --listening | grep -q {srv.port}")
+    '';
+
+})
diff --git a/pkgs/applications/audio/pyradio/default.nix b/pkgs/applications/audio/pyradio/default.nix
index 2fc911222da9..e9ef64260f46 100644
--- a/pkgs/applications/audio/pyradio/default.nix
+++ b/pkgs/applications/audio/pyradio/default.nix
@@ -6,13 +6,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "pyradio";
-  version = "0.9.1";
+  version = "0.9.2.25";
 
   src = fetchFromGitHub {
     owner = "coderholic";
-    repo = pname;
+    repo = "pyradio";
     rev = "refs/tags/${version}";
-    hash = "sha256-tu/qlrbTcUCIRF15x9ATKHH+LDy1OsGJpo5x+CerTKg=";
+    hash = "sha256-GkOp0iK84HDvVH8RmtmIKJ5EtQIECgZS5g8pmaIhUcc=";
   };
 
   nativeBuildInputs = [
@@ -20,9 +20,12 @@ python3Packages.buildPythonApplication rec {
   ];
 
   propagatedBuildInputs = with python3Packages; [
-    requests
-    psutil
     dnspython
+    netifaces
+    psutil
+    python-dateutil
+    requests
+    rich
   ];
 
   checkPhase = ''
diff --git a/pkgs/applications/editors/orbiton/default.nix b/pkgs/applications/editors/orbiton/default.nix
index 413af1ab5c54..1e64c5950798 100644
--- a/pkgs/applications/editors/orbiton/default.nix
+++ b/pkgs/applications/editors/orbiton/default.nix
@@ -4,13 +4,13 @@
 
 buildGoModule rec {
   pname = "orbiton";
-  version = "2.65.10";
+  version = "2.65.11";
 
   src = fetchFromGitHub {
     owner = "xyproto";
     repo = "orbiton";
     rev = "v${version}";
-    hash = "sha256-z81Xled6OFs9tKVJgUnws81C86Vle5XR85f3z96N2Gw=";
+    hash = "sha256-eb7Ku1hgvYdmRgemXcEZMl53oNXYcomh4wYHpRzLTUc=";
   };
 
   vendorHash = null;
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index 57abacccd2d9..20a4184580ff 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -16851,5 +16851,16 @@ final: prev:
     meta.homepage = "https://github.com/jhradilek/vim-snippets/";
   };
 
+  vim-tabby = buildVimPlugin {
+    pname = "vim-tabby";
+    version = "2024-02-01";
+    src = fetchFromGitHub {
+      owner = "TabbyML";
+      repo = "vim-tabby";
+      rev = "0b62bc2ed5c7d930c7435c3504d5c18ea6379b28";
+      sha256 = "06crxhvwz04s6sfj0q22kkp3g5zvip13088m95qwznw9bv2gpx3s";
+    };
+    meta.homepage = "https://github.com/TabbyML/vim-tabby/";
+  };
 
 }
diff --git a/pkgs/applications/editors/vim/plugins/overrides.nix b/pkgs/applications/editors/vim/plugins/overrides.nix
index da1b4b6bea20..ab4d9a594867 100644
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@@ -1671,6 +1671,14 @@
     dependencies = with self; [ vim-repeat ];
   };
 
+  vim-tabby = super.vim-tabby.overrideAttrs {
+    postPatch = ''
+      substituteInPlace autoload/tabby/globals.vim --replace-fail \
+        "let g:tabby_node_binary = get(g:, 'tabby_node_binary', 'node')" \
+        "let g:tabby_node_binary = get(g:, 'tabby_node_binary', '${nodejs}/bin/node')"
+    '';
+  };
+
   vim-textobj-entire = super.vim-textobj-entire.overrideAttrs {
     dependencies = with self; [ vim-textobj-user ];
     meta.maintainers = with lib.maintainers; [ farlion ];
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index 7a316fcdfc33..8c0814d5616a 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -1401,3 +1401,4 @@ https://github.com/ziglang/zig.vim/,,
 https://github.com/mickael-menu/zk-nvim/,HEAD,
 https://github.com/troydm/zoomwintab.vim/,,
 https://github.com/nanotee/zoxide.vim/,,
+https://github.com/TabbyML/vim-tabby/,HEAD,
diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.nix b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
index 5a75f0ad2022..0ab5c7ca1ee4 100644
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.nix
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
@@ -28,12 +28,12 @@
         version = "2024-01-22";
       };
       ungoogled-patches = {
-        hash = "sha256-G+agHdsssYhsyi4TgJUJBqMEnEgQ7bYeqpTqmonXI6I=";
-        rev = "122.0.6261.69-1";
+        hash = "sha256-vqiizzSVWV2/iADPac8qgfdZcbunc0QgMqN15NwJ9js=";
+        rev = "122.0.6261.94-1";
       };
     };
-    hash = "sha256-uEN1hN6DOLgw4QDrMBZdiLLPx+yKQc5MimIf/vbCC84=";
-    hash_deb_amd64 = "sha256-k3/Phs72eIMB6LAU4aU0+ze/cRu6KlRhpBshKhmq9N4=";
-    version = "122.0.6261.69";
+    hash = "sha256-7fIs8qQon9L0iNmM/cHuyqtVm09qf7L4j9qb6KSbw2w=";
+    hash_deb_amd64 = "sha256-hOm7YZ9ya/SmwKhj6uIPkdgIDv5bIbss398szBYHuXk=";
+    version = "122.0.6261.94";
   };
 }
diff --git a/pkgs/applications/networking/cluster/bosh-cli/default.nix b/pkgs/applications/networking/cluster/bosh-cli/default.nix
index f54860cd95e1..ab20b2dc72cc 100644
--- a/pkgs/applications/networking/cluster/bosh-cli/default.nix
+++ b/pkgs/applications/networking/cluster/bosh-cli/default.nix
@@ -8,13 +8,13 @@
 buildGoModule rec {
   pname = "bosh-cli";
 
-  version = "7.5.2";
+  version = "7.5.4";
 
   src = fetchFromGitHub {
     owner = "cloudfoundry";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-gT0Oivo5QE+pr5PpD/7JAj8oYF9UmSi5F6Ps8RtACzc=";
+    sha256 = "sha256-aNzKp7QwyhC/ado0NrCyxrRZu+ePGBNSq31/Iw6k6n0=";
   };
   vendorHash = null;
 
diff --git a/pkgs/applications/networking/onionshare/default.nix b/pkgs/applications/networking/onionshare/default.nix
index af0722a6acd3..017dcf3c9156 100644
--- a/pkgs/applications/networking/onionshare/default.nix
+++ b/pkgs/applications/networking/onionshare/default.nix
@@ -1,39 +1,40 @@
 { lib
 , stdenv
 , buildPythonApplication
-, substituteAll
-, fetchFromGitHub
-, isPy3k
+, cepa
 , colorama
+, fetchFromGitHub
 , flask
+, flask-compress
 , flask-httpauth
 , flask-socketio
 , gevent-socketio
 , gevent-websocket
-, cepa
+, obfs4
 , psutil
-, pyqt5
 , pycrypto
 , pynacl
-, pyside2
+, pyqt5
+, pyside6
 , pysocks
 , pytestCheckHook
 , qrcode
 , qt5
 , requests
-, unidecode
-, tor
-, obfs4
 , snowflake
+, substituteAll
+, tor
+, unidecode
+, waitress
 }:
 
 let
-  version = "2.6";
+  version = "2.6.1";
   src = fetchFromGitHub {
     owner = "onionshare";
     repo = "onionshare";
     rev = "v${version}";
-    sha256 = "sha256-LA7XlzoCXUiG/9subTddAd22336wO9sOHCIBlQK4Ga4=";
+    sha256 = "sha256-LR3Ao4Q8kEDwrFV+gYdMSEeYF4hDtEa1rJgvRRrJMwc=";
   };
   meta = with lib; {
     description = "Securely and anonymously send and receive files";
@@ -79,23 +80,27 @@ rec {
       })
     ];
     propagatedBuildInputs = [
+      cepa
       colorama
       flask
+      flask-compress
       flask-httpauth
       flask-socketio
       gevent-socketio
       gevent-websocket
-      cepa
       psutil
       pycrypto
       pynacl
+      pyside6
+      qrcode
       requests
       unidecode
+      waitress
     ];
 
     buildInputs = [
-      tor
       obfs4
+      tor
     ];
 
     nativeCheckInputs = [
@@ -107,9 +112,11 @@ rec {
       export HOME="$(mktemp -d)"
     '';
 
-    disabledTests = [
+    disabledTests = lib.optionals stdenv.isLinux [
       "test_get_tor_paths_linux"  # expects /usr instead of /nix/store
     ] ++ lib.optionals stdenv.isDarwin [
+      # requires meek-client which is not packaged
+      "test_get_tor_paths_darwin"
       # on darwin (and only on darwin) onionshare attempts to discover
       # user's *real* homedir via /etc/passwd, making it more painful
       # to fake
@@ -128,16 +135,15 @@ rec {
         inherit tor meek obfs4 snowflake;
         inherit (tor) geoip;
       })
-      ./fix-qrcode-gui.patch
     ];
 
     propagatedBuildInputs = [
       onionshare
-      pyqt5
-      pyside2
       psutil
-      qrcode
+      pyqt5
+      pyside6
       pysocks
+      qrcode
     ];
 
     nativeBuildInputs = [ qt5.wrapQtAppsHook ];
diff --git a/pkgs/applications/networking/onionshare/fix-qrcode-gui.patch b/pkgs/applications/networking/onionshare/fix-qrcode-gui.patch
deleted file mode 100644
index 97ee3817ab68..000000000000
--- a/pkgs/applications/networking/onionshare/fix-qrcode-gui.patch
+++ /dev/null
@@ -1,14 +0,0 @@
-diff --git desktop/onionshare/widgets.py desktop/onionshare/widgets.py
-index 64a07703..bca974fb 100644
---- desktop/onionshare/widgets.py
-+++ desktop/onionshare/widgets.py
-@@ -101,7 +101,7 @@ class Image(qrcode.image.base.BaseImage):
-     A custom Image class, for use with the QR Code pixmap.
-     """
- 
--    def __init__(self, border, width, box_size):
-+    def __init__(self, border, width, box_size, *args, **kargs):
-         self.border = border
-         self.width = width
-         self.box_size = box_size
-
diff --git a/pkgs/applications/networking/sync/rclone/default.nix b/pkgs/applications/networking/sync/rclone/default.nix
index 735133d641fe..ebb0f17e784b 100644
--- a/pkgs/applications/networking/sync/rclone/default.nix
+++ b/pkgs/applications/networking/sync/rclone/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, buildGoModule, fetchFromGitHub, buildPackages, installShellFiles
 , makeWrapper
-, enableCmount ? true, fuse, macfuse-stubs
+, enableCmount ? true, fuse, fuse3, macfuse-stubs
 , librclone
 }:
 
@@ -46,12 +46,12 @@ buildGoModule rec {
       ln -s $out/bin/rclone $out/bin/rclonefs
       ln -s $out/bin/rclone $out/bin/mount.rclone
     '' + lib.optionalString (enableCmount && !stdenv.isDarwin)
-      # use --suffix here to ensure we don't shadow /run/wrappers/bin/fusermount,
+      # use --suffix here to ensure we don't shadow /run/wrappers/bin/fusermount3,
       # as the setuid wrapper is required as non-root on NixOS.
       ''
       wrapProgram $out/bin/rclone \
-        --suffix PATH : "${lib.makeBinPath [ fuse ] }" \
-        --prefix LD_LIBRARY_PATH : "${fuse}/lib"
+        --suffix PATH : "${lib.makeBinPath [ fuse3 ] }" \
+        --prefix LD_LIBRARY_PATH : "${fuse3}/lib"
     '';
 
   passthru.tests = {
diff --git a/pkgs/applications/science/biology/last/default.nix b/pkgs/applications/science/biology/last/default.nix
index a3faca60c2a6..3bc84e414bb7 100644
--- a/pkgs/applications/science/biology/last/default.nix
+++ b/pkgs/applications/science/biology/last/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "last";
-  version = "1541";
+  version = "1542";
 
   src = fetchFromGitLab {
     owner = "mcfrith";
     repo = "last";
     rev = "refs/tags/${version}";
-    hash = "sha256-gEesPeGY2RozoViZpBWNTXFJriKVb/r0Efw9XEXwXmM=";
+    hash = "sha256-ZzvyyecYiBscogfN9/FnDbHg/lqb8y14n9C2KLIqhFA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/mf/mfcj880dwcupswrapper/package.nix b/pkgs/by-name/mf/mfcj880dwcupswrapper/package.nix
new file mode 100644
index 000000000000..38ff80577071
--- /dev/null
+++ b/pkgs/by-name/mf/mfcj880dwcupswrapper/package.nix
@@ -0,0 +1,46 @@
+{ lib, stdenv, fetchurl, mfcj880dwlpr, makeWrapper, bash }:
+
+stdenv.mkDerivation rec {
+  pname = "mfcj880dw-cupswrapper";
+  version = "1.0.0-0";
+
+  src = fetchurl {
+    url = "https://download.brother.com/welcome/dlf102044/mfcj880dw_cupswrapper_GPL_source_${version}.tar.gz";
+    sha256 = "bf291fe31d64afeaefb5b0e606f4baf80c41d80009e34b32b77d56f759e9cf94";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [
+    bash # shebang
+  ];
+
+  makeFlags = [ "-C" "brcupsconfig" "all" ];
+
+  installPhase = ''
+    runHook preInstall
+
+    TARGETFOLDER=$out/opt/brother/Printers/mfcj880dw/cupswrapper
+    mkdir -p $TARGETFOLDER
+    cp PPD/brother_mfcj880dw_printer_en.ppd $TARGETFOLDER
+    cp brcupsconfig/brcupsconfpt1 $TARGETFOLDER
+    cp cupswrapper/cupswrappermfcj880dw $TARGETFOLDER
+    sed -i -e '26,306d' $TARGETFOLDER/cupswrappermfcj880dw
+    substituteInPlace $TARGETFOLDER/cupswrappermfcj880dw \
+      --replace-fail "\$ppd_file_name" "$TARGETFOLDER/brother_mfcj880dw_printer_en.ppd"
+
+    CPUSFILTERFOLDER=$out/lib/cups/filter
+    mkdir -p $TARGETFOLDER $CPUSFILTERFOLDER
+    ln -s ${mfcj880dwlpr}/lib/cups/filter/brother_lpdwrapper_mfcj880dw $out/lib/cups/filter/brother_lpdwrapper_mfcj880dw
+
+    runHook postInstall
+    '';
+
+  meta = with lib; {
+    homepage = "http://www.brother.com/";
+    description = "Brother MFC-J880DW CUPS wrapper driver";
+    license = with licenses; gpl2;
+    platforms = with platforms; linux;
+    downloadPage = "https://support.brother.com/g/b/downloadlist.aspx?c=us&lang=en&prod=mfcj880dw_us_eu_as&os=128";
+    maintainers = with maintainers; [ _6543 ];
+  };
+}
diff --git a/pkgs/by-name/mf/mfcj880dwlpr/package.nix b/pkgs/by-name/mf/mfcj880dwlpr/package.nix
new file mode 100644
index 000000000000..8b69c85c7240
--- /dev/null
+++ b/pkgs/by-name/mf/mfcj880dwlpr/package.nix
@@ -0,0 +1,94 @@
+{ lib, stdenv, fetchurl, pkgsi686Linux, dpkg, makeWrapper, coreutils, gnused, gawk, file, cups, util-linux, xxd, runtimeShell
+, ghostscript, a2ps, bash }:
+
+# Why:
+# The executable "brprintconf_mfcj880dw" binary is looking for "/opt/brother/Printers/%s/inf/br%sfunc" and "/opt/brother/Printers/%s/inf/br%src".
+# Whereby, %s is printf(3) string substitution for stdin's arg0 (the command's own filename) from the 10th char forwards, as a runtime dependency.
+# e.g. Say the filename is "0123456789ABCDE", the runtime will be looking for /opt/brother/Printers/ABCDE/inf/brABCDEfunc.
+# Presumably, the binary was designed to be deployed under the filename "printconf_mfcj880dw", whereby it will search for "/opt/brother/Printers/mfcj880dw/inf/brmfcj880dwfunc".
+# For NixOS, we want to change the string to the store path of brmfcj880dwfunc and brmfcj880dwrc but we're faced with two complications:
+# 1. Too little room to specify the nix store path. We can't even take advantage of %s by renaming the file to the store path hash since the variable is too short and can't contain the whole hash.
+# 2. The binary needs the directory it's running from to be r/w.
+# What:
+# As such, we strip the path and substitution altogether, leaving only "brmfcj880dwfunc" and "brmfcj880dwrc", while filling the leftovers with nulls.
+# Fully null terminating the cstrings is necessary to keep the array the same size and preventing overflows.
+# We then use a shell script to link and execute the binary, func and rc files in a temporary directory.
+# How:
+# In the package, we dump the raw binary as a string of search-able hex values using hexdump. We execute the substitution with sed. We then convert the hex values back to binary form using xxd.
+# We also write a shell script that invoked "mktemp -d" to produce a r/w temporary directory and link what we need in the temporary directory.
+# Result:
+# The user can run brprintconf_mfcj880dw in the shell.
+
+stdenv.mkDerivation rec {
+  pname = "mfcj880dwlpr";
+  version = "1.0.0-0";
+
+  src = fetchurl {
+    url = "https://download.brother.com/welcome/dlf102038/mfcj880dwlpr-${version}.i386.deb";
+    sha256 = "1680b301f660a407fe0b69f5de59c7473d2d66dc472a1589b0cd9f51736bfea7";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ cups ghostscript dpkg a2ps ];
+
+  dontUnpack = true;
+
+  brprintconf_mfcj880dw_script = ''
+    #!${runtimeShell}
+    cd $(mktemp -d)
+    ln -s @out@/usr/bin/brprintconf_mfcj880dw_patched brprintconf_mfcj880dw_patched
+    ln -s @out@/opt/brother/Printers/mfcj880dw/inf/brmfcj880dwfunc brmfcj880dwfunc
+    ln -s @out@/opt/brother/Printers/mfcj880dw/inf/brmfcj880dwrc brmfcj880dwrc
+    ./brprintconf_mfcj880dw_patched "$@"
+  '';
+
+  installPhase = ''
+    dpkg-deb -x $src $out
+    substituteInPlace $out/opt/brother/Printers/mfcj880dw/lpd/filtermfcj880dw \
+      --replace-fail /opt "$out/opt"
+    substituteInPlace $out/opt/brother/Printers/mfcj880dw/lpd/psconvertij2 \
+      --replace-fail "GHOST_SCRIPT=`which gs`" "GHOST_SCRIPT=${ghostscript}/bin/gs"
+    substituteInPlace $out/opt/brother/Printers/mfcj880dw/inf/setupPrintcapij \
+      --replace-fail "/opt/brother/Printers" "$out/opt/brother/Printers" \
+      --replace-fail "printcap.local" "printcap"
+
+    patchelf --set-interpreter ${pkgsi686Linux.stdenv.cc.libc.out}/lib/ld-linux.so.2 \
+      --set-rpath $out/opt/brother/Printers/mfcj880dw/inf:$out/opt/brother/Printers/mfcj880dw/lpd \
+      $out/opt/brother/Printers/mfcj880dw/lpd/brmfcj880dwfilter
+    patchelf --set-interpreter ${pkgsi686Linux.stdenv.cc.libc.out}/lib/ld-linux.so.2 $out/usr/bin/brprintconf_mfcj880dw
+
+    #stripping the hardcoded path.
+    # /opt/brother/Printers/%s/inf/br%sfunc -> brmfcj880dwfunc
+    # /opt/brother/Printers/%s/inf/br%src -> brmfcj880dwrc
+    ${util-linux}/bin/hexdump -ve '1/1 "%.2X"' $out/usr/bin/brprintconf_mfcj880dw | \
+    sed 's.2F6F70742F62726F746865722F5072696E746572732F25732F696E662F6272257366756E63.62726d66636a383830647766756e6300000000000000000000000000000000000000000000.' | \
+    sed 's.2F6F70742F62726F746865722F5072696E746572732F25732F696E662F627225737263.62726d66636a3838306477726300000000000000000000000000000000000000000000.' | \
+    ${xxd}/bin/xxd -r -p > $out/usr/bin/brprintconf_mfcj880dw_patched
+    chmod +x $out/usr/bin/brprintconf_mfcj880dw_patched
+    #executing from current dir. segfaults if it's not r\w.
+    mkdir -p $out/bin
+    echo -n "$brprintconf_mfcj880dw_script" > $out/bin/brprintconf_mfcj880dw
+    chmod +x $out/bin/brprintconf_mfcj880dw
+    substituteInPlace $out/bin/brprintconf_mfcj880dw --replace-fail @out@ $out
+
+    # NOTE: opt/brother/Printers/mfcj880dw/lpd/brmfcj880dwfilter also has cardcoded paths, but we can not simply replace them
+
+    mkdir -p $out/lib/cups/filter/
+    ln -s $out/opt/brother/Printers/mfcj880dw/lpd/filtermfcj880dw $out/lib/cups/filter/brother_lpdwrapper_mfcj880dw
+
+    wrapProgram $out/opt/brother/Printers/mfcj880dw/lpd/psconvertij2 \
+      --prefix PATH ":" ${ lib.makeBinPath [ coreutils gnused gawk ] }
+    wrapProgram $out/opt/brother/Printers/mfcj880dw/lpd/filtermfcj880dw \
+      --prefix PATH ":" ${ lib.makeBinPath [ coreutils gnused file ghostscript a2ps ] }
+    '';
+
+  meta = with lib; {
+    description  = "Brother MFC-J880DW LPR driver";
+    downloadPage = "https://support.brother.com/g/b/downloadlist.aspx?c=us&lang=en&prod=mfcj880dw_us_eu_as&os=128";
+    homepage     = "http://www.brother.com/";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+    license      = with licenses; unfree;
+    maintainers  = with maintainers; [ _6543 ];
+    platforms    = with platforms; linux;
+  };
+}
diff --git a/pkgs/by-name/ta/tabby/package.nix b/pkgs/by-name/ta/tabby/package.nix
new file mode 100644
index 000000000000..b89434a8fc48
--- /dev/null
+++ b/pkgs/by-name/ta/tabby/package.nix
@@ -0,0 +1,73 @@
+{ lib
+, fetchFromGitHub
+, gcc12
+, cmake
+, git
+, openssl
+, pkg-config
+, protobuf
+, rustPlatform
+, addOpenGLRunpath
+, cudatoolkit
+, nvidia ? true
+}:
+
+rustPlatform.buildRustPackage rec {
+  version = "0.7.0";
+  pname = "tabby";
+
+  src = fetchFromGitHub {
+    owner = "TabbyML";
+    repo = "tabby";
+    rev = "v${version}";
+    hash = "sha256-BTPJWvqO4IuQAiUEER9PYfu4aQsz5RI77WsA/gQu5Jc=";
+    fetchSubmodules = true;
+  };
+
+  cargoHash = "sha256-Du0ya9J+0tz72mSid5If0VFX2lLC7YtwNQ/MALpFv2M=";
+
+  # https://github.com/TabbyML/tabby/blob/v0.7.0/.github/workflows/release.yml#L39
+  cargoBuildFlags = [
+    "--release"
+    "--package" "tabby"
+  ] ++ lib.optional nvidia [
+    "--features" "cuda"
+  ];
+
+  OPENSSL_NO_VENDOR = 1;
+
+  nativeBuildInputs = [
+    pkg-config
+    protobuf
+    git
+    cmake
+    gcc12
+
+  ] ++ lib.optional nvidia [
+    addOpenGLRunpath
+  ];
+
+  buildInputs = [ openssl ]
+    ++ lib.optional nvidia cudatoolkit
+  ;
+
+  postInstall = ''
+    ${if nvidia then ''
+    addOpenGLRunpath "$out/bin/tabby"
+    '' else ''
+    ''}
+  '';
+
+  # Fails with:
+  # file cannot create directory: /var/empty/local/lib64/cmake/Llama
+  doCheck = false;
+
+  meta = with lib; {
+    homepage = "https://github.com/TabbyML/tabby";
+    changelog = "https://github.com/TabbyML/tabby/releases/tag/v${version}";
+    description = "Self-hosted AI coding assistant";
+    mainProgram = "tabby";
+    license = licenses.asl20;
+    maintainers = [ maintainers.ghthor ];
+  };
+}
diff --git a/pkgs/development/libraries/google-cloud-cpp/default.nix b/pkgs/development/libraries/google-cloud-cpp/default.nix
index 0a6be882120b..4d8ef6821240 100644
--- a/pkgs/development/libraries/google-cloud-cpp/default.nix
+++ b/pkgs/development/libraries/google-cloud-cpp/default.nix
@@ -28,7 +28,6 @@ let
     rev = googleapisRev;
     hash = "sha256-4Qiz0pBgW3OZi+Z8Zq6k9E94+8q6/EFMwPh8eQxDjdI=";
   };
-  excludedTests = builtins.fromTOML (builtins.readFile ./skipped_tests.toml);
 in
 stdenv.mkDerivation rec {
   pname = "google-cloud-cpp";
@@ -106,16 +105,17 @@ stdenv.mkDerivation rec {
     lib.optionalString doInstallCheck (
       lib.optionalString (!staticOnly) ''
         export ${ldLibraryPathName}=${lib.concatStringsSep ":" additionalLibraryPaths}
-      '' + ''
-        export GTEST_FILTER="-${lib.concatStringsSep ":" excludedTests.cases}"
       ''
     );
 
   installCheckPhase = lib.optionalString doInstallCheck ''
     runHook preInstallCheck
 
-    # disable tests that contact the internet
-    ctest --exclude-regex '^(${lib.concatStringsSep "|" excludedTests.whole})'
+    # Disable any integration tests, which need to contact the internet.
+    # Also disable the `storage_benchmark_*` tests.
+    # With Protobuf < 23.x they require -DGOOGLE_CLOUD_CPP_ENABLE_CTYPE_WORKAROUND=ON.
+    # With Protobuf >= 23.x they require They require setting -DGOOGLE_CLOUD_CPP_ENABLE_CTYPE_WORKAROUND=OFF
+    ctest --label-exclude integration-test --exclude-regex storage_benchmarks_
 
     runHook postInstallCheck
   '';
diff --git a/pkgs/development/libraries/google-cloud-cpp/skipped_tests.toml b/pkgs/development/libraries/google-cloud-cpp/skipped_tests.toml
deleted file mode 100644
index d4ac469fbcff..000000000000
--- a/pkgs/development/libraries/google-cloud-cpp/skipped_tests.toml
+++ /dev/null
@@ -1,139 +0,0 @@
-whole = [
-  "common_samples_samples",
-  "common_internal_grpc_impersonate_service_account_integration_test",
-  "common_internal_unified_rest_credentials_integration_test",
-  "iam_samples_iam_credentials_samples",
-  "iam_samples_iam_samples",
-  "iam_admin_v1_samples_iam_client_samples",
-  "iam_credentials_v1_samples_iam_credentials_client_samples",
-  "iam_v1_samples_iam_policy_client_samples",
-  "iam_v2_samples_policies_client_samples",
-  "bigtable_admin_admin_iam_policy_integration_test",
-  "bigtable_bigtable_instance_admin_client_samples",
-  "bigtable_bigtable_table_admin_client_samples",
-  "bigtable_apply_read_latency_benchmark",
-  "bigtable_endurance_benchmark",
-  "bigtable_mutation_batcher_throughput_benchmark",
-  "bigtable_read_sync_vs_async_benchmark",
-  "bigtable_scan_throughput_benchmark",
-  "bigtable_admin_iam_policy_integration_test",
-  "bigtable_data_async_future_integration_test",
-  "bigtable_data_integration_test",
-  "bigtable_filters_integration_test",
-  "bigtable_mutations_integration_test",
-  "bigtable_table_sample_rows_integration_test",
-  "bigquery_samples_bigquery_read_samples",
-  "bigquery_analyticshub_v1_samples_analytics_hub_client_samples",
-  "bigquery_biglake_v1_samples_metastore_client_samples",
-  "bigquery_connection_v1_samples_connection_client_samples",
-  "bigquery_datapolicies_v1_samples_data_policy_client_samples",
-  "bigquery_datatransfer_v1_samples_data_transfer_client_samples",
-  "bigquery_migration_v2_samples_migration_client_samples",
-  "bigquery_reservation_v1_samples_reservation_client_samples",
-  "bigquery_storage_v1_samples_bigquery_read_client_samples",
-  "bigquery_storage_v1_samples_bigquery_write_client_samples",
-  "logging_quickstart",
-  "logging_v2_samples_config_service_v2_client_samples",
-  "logging_v2_samples_logging_service_v2_client_samples",
-  "logging_v2_samples_metrics_service_v2_client_samples",
-  "pubsub_endurance",
-  "pubsub_throughput",
-  "pubsub_subscriber_integration_test",
-  "pubsub_subscription_admin_integration_test",
-  "pubsub_topic_admin_integration_test",
-  "spanner_client_integration_test",
-  "spanner_client_stress_test",
-  "spanner_data_types_integration_test",
-  "spanner_database_admin_integration_test",
-  "spanner_instance_admin_integration_test",
-  "spanner_session_pool_integration_test",
-  "spanner_admin_database_admin_integration_test",
-  "spanner_admin_instance_admin_integration_test",
-  "spanner_database_admin_client_samples",
-  "spanner_instance_admin_client_samples",
-  "spanner_multiple_rows_cpu_benchmark",
-  "spanner_single_row_throughput_benchmark",
-  "storage_alternative_endpoint_integration_test",
-  "storage_auto_finalize_integration_test",
-  "storage_bucket_integration_test",
-  "storage_create_client_integration_test",
-  "storage_curl_sign_blob_integration_test",
-  "storage_decompressive_transcoding_integration_test",
-  "storage_grpc_bucket_acl_integration_test",
-  "storage_grpc_bucket_metadata_integration_test",
-  "storage_grpc_default_object_acl_integration_test",
-  "storage_grpc_integration_test",
-  "storage_grpc_object_acl_integration_test",
-  "storage_grpc_object_media_integration_test",
-  "storage_grpc_object_metadata_integration_test",
-  "storage_key_file_integration_test",
-  "storage_minimal_iam_credentials_rest_integration_test",
-  "storage_object_basic_crud_integration_test",
-  "storage_object_checksum_integration_test",
-  "storage_object_compose_many_integration_test",
-  "storage_object_file_integration_test",
-  "storage_object_hash_integration_test",
-  "storage_object_insert_integration_test",
-  "storage_object_insert_preconditions_integration_test",
-  "storage_object_integration_test",
-  "storage_object_list_objects_versions_integration_test",
-  "storage_object_media_integration_test",
-  "storage_object_parallel_upload_integration_test",
-  "storage_object_plenty_clients_serially_integration_test",
-  "storage_object_plenty_clients_simultaneously_integration_test",
-  "storage_object_read_headers_integration_test",
-  "storage_object_read_preconditions_integration_test",
-  "storage_object_read_range_integration_test",
-  "storage_object_read_stream_integration_test",
-  "storage_object_resumable_parallel_upload_integration_test",
-  "storage_object_resumable_write_integration_test",
-  "storage_object_rewrite_integration_test",
-  "storage_object_write_preconditions_integration_test",
-  "storage_object_write_stream_integration_test",
-  "storage_object_write_streambuf_integration_test",
-  "storage_service_account_integration_test",
-  "storage_signed_url_integration_test",
-  "storage_small_reads_integration_test",
-  "storage_thread_integration_test",
-  "storage_tracing_integration_test",
-  "storage_unified_credentials_integration_test",
-  "storage_aggregate_download_throughput_benchmark",
-  "storage_aggregate_upload_throughput_benchmark",
-  "storage_create_dataset",
-  "storage_storage_file_transfer_benchmark",
-  "storage_storage_parallel_uploads_benchmark",
-  "storage_storage_throughput_vs_cpu_benchmark",
-  "storage_throughput_experiment_test"
-]
-cases = [
-  "BackupExtraIntegrationTest.CreateBackupWithExpiredVersionTime",
-  "BackupExtraIntegrationTest.BackupWithExpiredVersionTime",
-  "BackupExtraIntegrationTest.BackupWithFutureVersionTime",
-  "BackupExtraIntegrationTest.CreateBackupWithFutureVersionTime",
-  "BlockingPublisherIntegrationTest.Basic",
-  "DatabaseAdminClientTest.CreateWithEncryptionKey",
-  "DatabaseAdminClientTest.CreateWithNonexistentEncryptionKey",
-  "DatabaseAdminClientTest.DatabaseBasicCRUD",
-  "DatabaseAdminClientTest.VersionRetentionPeriodCreate",
-  "DatabaseAdminClientTest.VersionRetentionPeriodCreateFailure",
-  "DatabaseAdminClientTest.VersionRetentionPeriodUpdate",
-  "DatabaseAdminClientTest.VersionRetentionPeriodUpdateFailure",
-  "ErrorParsingIntegrationTest.FailureContainsErrorInfo",
-  "GrpcServiceAccountIntegrationTest.GetServiceAccount",
-  "GrpcBucketMetadataIntegrationTest.ObjectMetadataCRUD",
-  "InstanceAdminClientTest.InstanceConfig",
-  "InstanceAdminClientTest.InstanceIam",
-  "InstanceAdminClientTest.InstanceReadOperations",
-  "LoggingIntegrationTest.ListMonitoredResourceDescriptors",
-  "LoggingIntegrationTest.WriteLogEntries",
-  "ObjectFileMultiThreadedTest.Download",
-  "ObjectReadLargeIntegrationTest.LimitedMemoryGrowth",
-  "SubscriberIntegrationTest.FireAndForget",
-  "SubscriberIntegrationTest.PublishOrdered",
-  "SubscriberIntegrationTest.PublishPullAck",
-  "SubscriberIntegrationTest.RawStub",
-  "SubscriberIntegrationTest.ReportNotFound",
-  "SubscriberIntegrationTest.StreamingSubscriptionBatchSource",
-  "SubscriptionAdminIntegrationTest.SubscriptionCRUD",
-  "TopicAdminIntegrationTest.TopicCRUD"
-]
diff --git a/pkgs/development/python-modules/aioairzone/default.nix b/pkgs/development/python-modules/aioairzone/default.nix
index fdded411bee7..78d572744aab 100644
--- a/pkgs/development/python-modules/aioairzone/default.nix
+++ b/pkgs/development/python-modules/aioairzone/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "aioairzone";
-  version = "0.7.4";
+  version = "0.7.5";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "Noltari";
     repo = "aioairzone";
     rev = "refs/tags/${version}";
-    hash = "sha256-yIkP0eWyEJAZc2tJbwTvlU5b2pDta4SatmsTMPsSDt8=";
+    hash = "sha256-mliyDKh+7M8GQ0ZJijoYrqKDeAqRHfKGyPJM/5no+fM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/argilla/default.nix b/pkgs/development/python-modules/argilla/default.nix
index 336b6f6db856..0ccca5417a2e 100644
--- a/pkgs/development/python-modules/argilla/default.nix
+++ b/pkgs/development/python-modules/argilla/default.nix
@@ -65,7 +65,7 @@
 }:
 let
   pname = "argilla";
-  version = "1.24.0";
+  version = "1.25.0";
   optional-dependencies = {
     server = [
       fastapi
@@ -126,7 +126,7 @@ buildPythonPackage {
     owner = "argilla-io";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-2baSX6b2BFYHXKg37WMHcGel3OTGsCJrulvyxmbdBek=";
+    hash = "sha256-KU67tu14pX1nCRl9k/Na9EqelO3Uz7It1dpFBU2IjZA=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/cheetah3/default.nix b/pkgs/development/python-modules/cheetah3/default.nix
index b85870572a4c..bb1a3da46cf5 100644
--- a/pkgs/development/python-modules/cheetah3/default.nix
+++ b/pkgs/development/python-modules/cheetah3/default.nix
@@ -6,7 +6,7 @@
 
 buildPythonPackage rec {
   pname = "cheetah3";
-  version = "3.3.3";
+  version = "3.3.3.post1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -15,7 +15,7 @@ buildPythonPackage rec {
     owner = "CheetahTemplate3";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-7L3SBMgNOOLAFvQST8I0gFlrya/6Lwp/umzolfJx3t4=";
+    hash = "sha256-0NVKie/6Fp8T1O1fvrVorycybLrEXMY1yXZBDyxjpbE=";
   };
 
   doCheck = false; # Circular dependency
diff --git a/pkgs/development/python-modules/geoalchemy2/default.nix b/pkgs/development/python-modules/geoalchemy2/default.nix
index bb4eb7ca664e..7920c53b8f57 100644
--- a/pkgs/development/python-modules/geoalchemy2/default.nix
+++ b/pkgs/development/python-modules/geoalchemy2/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "geoalchemy2";
-  version = "0.14.4";
+  version = "0.14.6";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "geoalchemy";
     repo = "geoalchemy2";
     rev = "refs/tags/${version}";
-    hash = "sha256-zMd/hHobFBPre0bZA1e2S9gPWnIkeImZhSySlIDxYsg=";
+    hash = "sha256-s3+w6LtewjR725O8ENl7jRer979fRZDqsnbAYJOWcIY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-bigquery-datatransfer/default.nix b/pkgs/development/python-modules/google-cloud-bigquery-datatransfer/default.nix
index 50346213b253..c256ea54ae49 100644
--- a/pkgs/development/python-modules/google-cloud-bigquery-datatransfer/default.nix
+++ b/pkgs/development/python-modules/google-cloud-bigquery-datatransfer/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-bigquery-datatransfer";
-  version = "3.14.1";
+  version = "3.15.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-v9gBSb9TYvaqF1/g7dJshSkJ2RlCAWXGdf7yPlne0I4=";
+    hash = "sha256-/LBhPJorIQvyiInfNy7PJcVyOvH217FErtwiC2XTZvQ=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-compute/default.nix b/pkgs/development/python-modules/google-cloud-compute/default.nix
index ffe81f753aa7..535aa86cc8a5 100644
--- a/pkgs/development/python-modules/google-cloud-compute/default.nix
+++ b/pkgs/development/python-modules/google-cloud-compute/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-compute";
-  version = "1.16.1";
+  version = "1.17.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-P/A08nd3ZP4GsySd3Q6TM+kuXRabcnnI1aFd+svMz5E=";
+    hash = "sha256-dPs7hSe0YcD3luNqHkF6T8fTHC4/u3HMJwsw6THWL44=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-kms/default.nix b/pkgs/development/python-modules/google-cloud-kms/default.nix
index 32949b14c332..deab86952e76 100644
--- a/pkgs/development/python-modules/google-cloud-kms/default.nix
+++ b/pkgs/development/python-modules/google-cloud-kms/default.nix
@@ -9,20 +9,25 @@
 , pytest-asyncio
 , pytestCheckHook
 , pythonOlder
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "google-cloud-kms";
-  version = "2.19.2";
-  format = "setuptools";
+  version = "2.21.2";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-F6UDRZLoXvADHSW75YlL2y1xlGCFWYC/62iqTo/8Er0=";
+    hash = "sha256-8GrZ38gBVE+6EYN4i5ZPawF0g6Zgkapoa1Gr0HSAbIQ=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     grpc-google-iam-v1
     google-api-core
@@ -36,9 +41,11 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  # Disable tests that need credentials
   disabledTests = [
+    # Disable tests that need credentials
     "test_list_global_key_rings"
+    # Tests require PROJECT_ID
+    "test_list_ekm_connections"
   ];
 
   pythonImportsCheck = [
@@ -48,8 +55,8 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "Cloud Key Management Service (KMS) API API client library";
-    homepage = "https://github.com/googleapis/python-kms";
-    changelog = "https://github.com/googleapis/python-kms/blob/v${version}/CHANGELOG.md";
+    homepage = "https://github.com/googleapis/google-cloud-python/tree/main/packages/google-cloud-kms";
+    changelog = "https://github.com/googleapis/google-cloud-python/blob/google-cloud-kms-v${version}/packages/google-cloud-kms/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ ];
   };
diff --git a/pkgs/development/python-modules/google-cloud-pubsub/default.nix b/pkgs/development/python-modules/google-cloud-pubsub/default.nix
index 8d0d27a77f69..ec901eb34a4f 100644
--- a/pkgs/development/python-modules/google-cloud-pubsub/default.nix
+++ b/pkgs/development/python-modules/google-cloud-pubsub/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-pubsub";
-  version = "2.19.6";
+  version = "2.19.7";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Tq5LyYRj29rq11l/dmb/4U/GKqvtEOPjIslcsFD6fb4=";
+    hash = "sha256-2l8eshfAcnvvp8hbm5XmqJsytCLVSMnPmh4ClBAnC4c=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-secret-manager/default.nix b/pkgs/development/python-modules/google-cloud-secret-manager/default.nix
index 32304fad221f..679d8631aaee 100644
--- a/pkgs/development/python-modules/google-cloud-secret-manager/default.nix
+++ b/pkgs/development/python-modules/google-cloud-secret-manager/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-secret-manager";
-  version = "2.18.1";
+  version = "2.18.2";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-MQVV88jLl39KRtRFTsosg/7WoJ88SzW4T2+h+P71UCQ=";
+    hash = "sha256-oA1iEVpwCD6GsdRMp+vK4EGzakTMYupX3kAFcx+NPIg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/griffe/default.nix b/pkgs/development/python-modules/griffe/default.nix
index d3e9ca2ae7f4..8f2884a5b6c6 100644
--- a/pkgs/development/python-modules/griffe/default.nix
+++ b/pkgs/development/python-modules/griffe/default.nix
@@ -12,16 +12,16 @@
 
 buildPythonPackage rec {
   pname = "griffe";
-  version = "0.40.1";
-  format = "pyproject";
+  version = "0.41.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "mkdocstrings";
-    repo = pname;
+    repo = "griffe";
     rev = "refs/tags/${version}";
-    hash = "sha256-DaLxGEwR2Z9IEkKbLkOy7Q3dvvmwTNBNMzYxNoeZMJE=";
+    hash = "sha256-or0kXc8YJl7+95gM54MaviDdErN0vqBnCtAavZM938k=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/huggingface-hub/default.nix b/pkgs/development/python-modules/huggingface-hub/default.nix
index e9c477cef97b..f57aa1a4cbb9 100644
--- a/pkgs/development/python-modules/huggingface-hub/default.nix
+++ b/pkgs/development/python-modules/huggingface-hub/default.nix
@@ -52,6 +52,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/huggingface/huggingface_hub";
     changelog = "https://github.com/huggingface/huggingface_hub/releases/tag/v${version}";
     license = licenses.asl20;
-    maintainers = with maintainers; [ kira-bruneau ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/development/python-modules/karton-core/default.nix b/pkgs/development/python-modules/karton-core/default.nix
index a934b793c60e..6746fd6eb710 100644
--- a/pkgs/development/python-modules/karton-core/default.nix
+++ b/pkgs/development/python-modules/karton-core/default.nix
@@ -3,15 +3,16 @@
 , buildPythonPackage
 , fetchFromGitHub
 , orjson
-, unittestCheckHook
 , pythonOlder
 , redis
+, setuptools
+, unittestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "karton-core";
-  version = "5.3.2";
-  format = "setuptools";
+  version = "5.3.3";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -19,9 +20,13 @@ buildPythonPackage rec {
     owner = "CERT-Polska";
     repo = "karton";
     rev = "refs/tags/v${version}";
-    hash = "sha256-/MPD83sBo9n/dI1uXbHbjvz6upJSJrssMGmGwfQ+KE8=";
+    hash = "sha256-RVHhMKoQAqsddziK/vWGynSL9mxMuccNEGzoJTx8KAA=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     boto3
     orjson
diff --git a/pkgs/development/python-modules/llama-index-core/default.nix b/pkgs/development/python-modules/llama-index-core/default.nix
index 101429849f7f..708230eed628 100644
--- a/pkgs/development/python-modules/llama-index-core/default.nix
+++ b/pkgs/development/python-modules/llama-index-core/default.nix
@@ -30,7 +30,7 @@
 
 buildPythonPackage rec {
   pname = "llama-index-core";
-  version = "0.10.12";
+  version = "0.10.14";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -39,7 +39,7 @@ buildPythonPackage rec {
     owner = "run-llama";
     repo = "llama_index";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Xn4Gqr5zjZGAEHg5duqkS9GLWWlC83puDHNktNYzvDw=";
+    hash = "sha256-9EbhiW2VPaX6Ffrm5a3pJxw2M73x1JOna+OurSJErSM=";
   };
 
   sourceRoot = "${src.name}/${pname}";
diff --git a/pkgs/development/python-modules/neo4j/default.nix b/pkgs/development/python-modules/neo4j/default.nix
index 4db2398c25b5..ba7a84d02ec5 100644
--- a/pkgs/development/python-modules/neo4j/default.nix
+++ b/pkgs/development/python-modules/neo4j/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "neo4j";
-  version = "5.17.0";
+  version = "5.18.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "neo4j";
     repo = "neo4j-python-driver";
     rev = "refs/tags/${version}";
-    hash = "sha256-BZo4TzFrH1ATl09zRXy+1AFJSBopmByDHe7oITZy7pA=";
+    hash = "sha256-rp0N2k23WZ86hqqz4ByW5gdyU2eYLVppyEJEdY/Yk8w=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pydeconz/default.nix b/pkgs/development/python-modules/pydeconz/default.nix
index 9a322790f865..f64913c32d33 100644
--- a/pkgs/development/python-modules/pydeconz/default.nix
+++ b/pkgs/development/python-modules/pydeconz/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "pydeconz";
-  version = "114";
+  version = "115";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "Kane610";
     repo = "deconz";
     rev = "refs/tags/v${version}";
-    hash = "sha256-XN6di3pxB7lhZ5TQnyHr7nKA0STBi0CVzGnhvRDsbFY=";
+    hash = "sha256-NjzONVSJ4GEaIeC5ytnTi8JpZY1yIq3LN8vbMy3n0vs=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/torch/default.nix b/pkgs/development/python-modules/torch/default.nix
index 388f66f40a49..d6c51904bd9d 100644
--- a/pkgs/development/python-modules/torch/default.nix
+++ b/pkgs/development/python-modules/torch/default.nix
@@ -8,7 +8,7 @@
   magma-hip,
   magma-cuda-static,
   # Use the system NCCL as long as we're targeting CUDA on a supported platform.
-  useSystemNccl ? (cudaSupport && !cudaPackages.nccl.meta.unsupported),
+  useSystemNccl ? (cudaSupport && !cudaPackages.nccl.meta.unsupported || rocmSupport),
   MPISupport ? false, mpi,
   buildDocs ? false,
 
diff --git a/pkgs/development/python-modules/userpath/default.nix b/pkgs/development/python-modules/userpath/default.nix
index 5f4a31d39b19..014de3cfeb1e 100644
--- a/pkgs/development/python-modules/userpath/default.nix
+++ b/pkgs/development/python-modules/userpath/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "userpath";
-  version = "1.9.1";
-  format = "pyproject";
+  version = "1.9.2";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-zoF2co2YyRS2QBeBvzsj/M2WjRZHU5yHiMcBA3XgJ5Y=";
+    hash = "sha256-bFIojasGklfMgxhG0V1IEzUiRV1Gd+5pqXgfEdvv2BU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/vllm/default.nix b/pkgs/development/python-modules/vllm/default.nix
index e8127c4caf8b..4977a829d4c7 100644
--- a/pkgs/development/python-modules/vllm/default.nix
+++ b/pkgs/development/python-modules/vllm/default.nix
@@ -36,14 +36,14 @@
 
 buildPythonPackage rec {
   pname = "vllm";
-  version = "0.3.1";
+  version = "0.3.2";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "vllm-project";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-hfd4ScU0mkZ7z4+w08BUA1K9bPXSiFThfiO+Ll2MTtg=";
+    hash = "sha256-ZFwlR8Xnen7FFblwzPJm0k+3iEo2p27QhfRaDfzwbOM=";
   };
 
   # Otherwise it tries to enumerate host supported ROCM gfx archs, and that is not possible due to sandboxing.
@@ -62,11 +62,11 @@ buildPythonPackage rec {
     substituteInPlace requirements.txt \
       --replace "cupy-cuda12x == 12.1.0" "cupy == 12.3.0"
     substituteInPlace requirements-build.txt \
-      --replace "torch==2.1.2" "torch == 2.2.0"
+      --replace "torch==2.1.2" "torch == 2.2.1"
     substituteInPlace pyproject.toml \
-      --replace "torch == 2.1.2" "torch == 2.2.0"
+      --replace "torch == 2.1.2" "torch == 2.2.1"
     substituteInPlace requirements.txt \
-      --replace "torch == 2.1.2" "torch == 2.2.0"
+      --replace "torch == 2.1.2" "torch == 2.2.1"
   '' + lib.optionalString rocmSupport ''
     substituteInPlace setup.py \
       --replace "'hipcc', '--version'" "'${writeShellScript "hipcc-version-stub" "echo HIP version: 0.0"}'"
diff --git a/pkgs/development/r-modules/default.nix b/pkgs/development/r-modules/default.nix
index e7005357f2bb..fb3e6ffb9d00 100644
--- a/pkgs/development/r-modules/default.nix
+++ b/pkgs/development/r-modules/default.nix
@@ -452,6 +452,7 @@ let
     topicmodels = [ pkgs.gsl ];
     udunits2 = with pkgs; [ udunits expat ];
     units = [ pkgs.udunits ];
+    vdiffr = [ pkgs.libpng.dev ];
     V8 = [ pkgs.v8 ];
     XBRL = with pkgs; [ zlib libxml2.dev ];
     XLConnect = [ pkgs.jdk ];
@@ -500,9 +501,10 @@ let
     RDieHarder = [ pkgs.gsl ];
     QF = [ pkgs.gsl ];
     PICS = [ pkgs.gsl ];
-    RcppCWB = [ pkgs.pkg-config ];
+    RcppCWB = [ pkgs.pkg-config pkgs.pcre2 ];
     redux = [ pkgs.pkg-config ];
     rrd = [ pkgs.pkg-config ];
+    Rbwa = [ pkgs.zlib.dev ];
     trackViewer = [ pkgs.zlib.dev ];
     themetagenomics = [ pkgs.zlib.dev ];
     NanoMethViz = [ pkgs.zlib.dev ];
@@ -593,6 +595,7 @@ let
     Signac = [ pkgs.zlib.dev ];
     TransView = [ pkgs.zlib.dev ];
     bigsnpr = [ pkgs.zlib.dev ];
+    zlib = [ pkgs.zlib.dev ];
     divest = [ pkgs.zlib.dev ];
     hipread = [ pkgs.zlib.dev ];
     jackalope = with pkgs; [ zlib.dev xz.dev ];
diff --git a/pkgs/development/tools/bearer/default.nix b/pkgs/development/tools/bearer/default.nix
index 36d87efb1299..5cd2cfff0d76 100644
--- a/pkgs/development/tools/bearer/default.nix
+++ b/pkgs/development/tools/bearer/default.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "bearer";
-  version = "1.39.0";
+  version = "1.40.1";
 
   src = fetchFromGitHub {
     owner = "bearer";
     repo = "bearer";
     rev = "refs/tags/v${version}";
-    hash = "sha256-GgdEOTrzaTsSTRW2NUzdxzUxGI1UCIk/6mAoyRysRVc=";
+    hash = "sha256-yfgbkF7ANJyyy3qYNLOg85+MJ8SdHCZkXsOhH0vzy8o=";
   };
 
-  vendorHash = "sha256-fCSgRjsioXyt9mxQoZxyA+F63FAwlmwJAjquR+zAgQg=";
+  vendorHash = "sha256-TKdZVNt98jrIzXekfxRXfxEfEhb2doWTTGojOLOcKzU=";
 
   subPackages = [
     "cmd/bearer"
diff --git a/pkgs/servers/mobilizon/common.nix b/pkgs/servers/mobilizon/common.nix
index 4a97ae7bfa1d..0b3e3faa7306 100644
--- a/pkgs/servers/mobilizon/common.nix
+++ b/pkgs/servers/mobilizon/common.nix
@@ -1,13 +1,13 @@
 { fetchFromGitLab }: rec {
 
   pname = "mobilizon";
-  version = "4.0.2";
+  version = "4.1.0";
 
   src = fetchFromGitLab {
     domain = "framagit.org";
     owner = "framasoft";
     repo = pname;
     rev = version;
-    sha256 = "sha256-Ri1qCiQaKlSTSSGWHzFqYBCoTEMtOtwe0Kli466dv4M=";
+    sha256 = "sha256-aS57126Nhz/QvouSyZ9wUu78/eoCYbRwyncUUmO1Dv8=";
   };
 }
diff --git a/pkgs/servers/mobilizon/default.nix b/pkgs/servers/mobilizon/default.nix
index 191952f64681..e4a75a4c91ce 100644
--- a/pkgs/servers/mobilizon/default.nix
+++ b/pkgs/servers/mobilizon/default.nix
@@ -57,8 +57,8 @@ mixRelease rec {
           src = fetchFromGitHub {
             owner = "danhper";
             repo = "elixir-web-push-encryption";
-            rev = "70f00d06cbd88c9ac382e0ad2539e54448e9d8da";
-            sha256 = "sha256-b4ZMrt/8n2sPUFtCDRTwXS1qWm5VlYdbx8qC0R0boOA=";
+            rev = "6e143dcde0a2854c4f0d72816b7ecab696432779";
+            sha256 = "sha256-Da+/28SPZuUQBi8fQj31zmMvhMrYUaQIW4U4E+mRtMg=";
           };
           beamDeps = with final; [ httpoison jose ];
         };
diff --git a/pkgs/servers/mobilizon/frontend.nix b/pkgs/servers/mobilizon/frontend.nix
index 5ea6242c5bdc..397fb138bd44 100644
--- a/pkgs/servers/mobilizon/frontend.nix
+++ b/pkgs/servers/mobilizon/frontend.nix
@@ -6,7 +6,7 @@ in
 buildNpmPackage {
   inherit (common) pname version src;
 
-  npmDepsHash = "sha256-z/xWumL1wri63cGGMHMBq6WVDe81bp8tILsZa53a7FM=";
+  npmDepsHash = "sha256-pF07ul71zg9iLM/ja4Fz/6IXpqdMKb7KwOH02Q9lyCg=";
 
   nativeBuildInputs = [ imagemagick ];
 
diff --git a/pkgs/servers/mobilizon/mix.nix b/pkgs/servers/mobilizon/mix.nix
index 60d212d7fa07..ca33f819723a 100644
--- a/pkgs/servers/mobilizon/mix.nix
+++ b/pkgs/servers/mobilizon/mix.nix
@@ -73,14 +73,27 @@ let
       beamDeps = [ xml_builder ];
     };
 
+    bandit = buildMix rec {
+      name = "bandit";
+      version = "1.2.3";
+
+      src = fetchHex {
+        pkg = "bandit";
+        version = "${version}";
+        sha256 = "3e29150245a9b5f56944434e5240966e75c917dad248f689ab589b32187a81af";
+      };
+
+      beamDeps = [ hpax plug telemetry thousand_island websock ];
+    };
+
     bunt = buildMix rec {
       name = "bunt";
-      version = "0.2.1";
+      version = "1.0.0";
 
       src = fetchHex {
         pkg = "bunt";
         version = "${version}";
-        sha256 = "a330bfb4245239787b15005e66ae6845c9cd524a288f0d141c148b02603777a5";
+        sha256 = "dc5f86aa08a5f6fa6b8096f0735c4e76d54ae5c9fa2c143e5a1fc7c1cd9bb6b5";
       };
 
       beamDeps = [];
@@ -101,12 +114,12 @@ let
 
     castore = buildMix rec {
       name = "castore";
-      version = "1.0.4";
+      version = "1.0.5";
 
       src = fetchHex {
         pkg = "castore";
         version = "${version}";
-        sha256 = "9418c1b8144e11656f0be99943db4caf04612e3eaecefb5dae9a2a87565584f8";
+        sha256 = "8d7c597c3e4a64c395980882d4bca3cebb8d74197c590dc272cfd3b6a6310578";
       };
 
       beamDeps = [];
@@ -177,19 +190,6 @@ let
       beamDeps = [];
     };
 
-    connection = buildMix rec {
-      name = "connection";
-      version = "1.1.0";
-
-      src = fetchHex {
-        pkg = "connection";
-        version = "${version}";
-        sha256 = "722c1eb0a418fbe91ba7bd59a47e28008a189d47e37e0e7bb85585a016b2869c";
-      };
-
-      beamDeps = [];
-    };
-
     cors_plug = buildMix rec {
       name = "cors_plug";
       version = "3.0.3";
@@ -203,53 +203,14 @@ let
       beamDeps = [ plug ];
     };
 
-    cowboy = buildErlangMk rec {
-      name = "cowboy";
-      version = "2.10.0";
-
-      src = fetchHex {
-        pkg = "cowboy";
-        version = "${version}";
-        sha256 = "3afdccb7183cc6f143cb14d3cf51fa00e53db9ec80cdcd525482f5e99bc41d6b";
-      };
-
-      beamDeps = [ cowlib ranch ];
-    };
-
-    cowboy_telemetry = buildRebar3 rec {
-      name = "cowboy_telemetry";
-      version = "0.4.0";
-
-      src = fetchHex {
-        pkg = "cowboy_telemetry";
-        version = "${version}";
-        sha256 = "7d98bac1ee4565d31b62d59f8823dfd8356a169e7fcbb83831b8a5397404c9de";
-      };
-
-      beamDeps = [ cowboy telemetry ];
-    };
-
-    cowlib = buildRebar3 rec {
-      name = "cowlib";
-      version = "2.12.1";
-
-      src = fetchHex {
-        pkg = "cowlib";
-        version = "${version}";
-        sha256 = "163b73f6367a7341b33c794c4e88e7dbfe6498ac42dcd69ef44c5bc5507c8db0";
-      };
-
-      beamDeps = [];
-    };
-
     credo = buildMix rec {
       name = "credo";
-      version = "1.7.1";
+      version = "1.7.5";
 
       src = fetchHex {
         pkg = "credo";
         version = "${version}";
-        sha256 = "e9871c6095a4c0381c89b6aa98bc6260a8ba6addccf7f6a53da8849c748a58a2";
+        sha256 = "f799e9b5cd1891577d8c773d245668aa74a2fcd15eb277f51a0131690ebfb3fd";
       };
 
       beamDeps = [ bunt file_system jason ];
@@ -309,12 +270,12 @@ let
 
     dialyxir = buildMix rec {
       name = "dialyxir";
-      version = "1.4.2";
+      version = "1.4.3";
 
       src = fetchHex {
         pkg = "dialyxir";
         version = "${version}";
-        sha256 = "516603d8067b2fd585319e4b13d3674ad4f314a5902ba8130cd97dc902ce6bbd";
+        sha256 = "bf2cfb75cd5c5006bec30141b131663299c661a864ec7fbbc72dfa557487a986";
       };
 
       beamDeps = [ erlex ];
@@ -348,12 +309,12 @@ let
 
     earmark_parser = buildMix rec {
       name = "earmark_parser";
-      version = "1.4.38";
+      version = "1.4.39";
 
       src = fetchHex {
         pkg = "earmark_parser";
         version = "${version}";
-        sha256 = "2cd0907795aaef0c7e8442e376633c5b3bd6edc8dbbdc539b22f095501c1cdb6";
+        sha256 = "06553a88d1f1846da9ef066b87b57c6f605552cfbe40d20bd8d59cc6bde41944";
       };
 
       beamDeps = [];
@@ -374,12 +335,12 @@ let
 
     ecto = buildMix rec {
       name = "ecto";
-      version = "3.11.0";
+      version = "3.11.1";
 
       src = fetchHex {
         pkg = "ecto";
         version = "${version}";
-        sha256 = "7769dad267ef967310d6e988e92d772659b11b09a0c015f101ce0fff81ce1f81";
+        sha256 = "ebd3d3772cd0dfcd8d772659e41ed527c28b2a8bde4b00fe03e0463da0f1983b";
       };
 
       beamDeps = [ decimal jason telemetry ];
@@ -400,12 +361,12 @@ let
 
     ecto_dev_logger = buildMix rec {
       name = "ecto_dev_logger";
-      version = "0.9.0";
+      version = "0.10.0";
 
       src = fetchHex {
         pkg = "ecto_dev_logger";
         version = "${version}";
-        sha256 = "2e8bc98b4ae4fcc7108896eef7da5a109afad829f4fb2eb46d677fdc9101c2d5";
+        sha256 = "a55e58bad5d5c9b8ef2a3c3347dbdf7efa880a5371cf1457e44b41f489a43927";
       };
 
       beamDeps = [ ecto jason ];
@@ -439,12 +400,12 @@ let
 
     ecto_sql = buildMix rec {
       name = "ecto_sql";
-      version = "3.11.0";
+      version = "3.11.1";
 
       src = fetchHex {
         pkg = "ecto_sql";
         version = "${version}";
-        sha256 = "77aa3677169f55c2714dda7352d563002d180eb33c0dc29cd36d39c0a1a971f5";
+        sha256 = "ce14063ab3514424276e7e360108ad6c2308f6d88164a076aac8a387e1fea634";
       };
 
       beamDeps = [ db_connection ecto postgrex telemetry ];
@@ -465,15 +426,15 @@ let
 
     elixir_make = buildMix rec {
       name = "elixir_make";
-      version = "0.7.7";
+      version = "0.7.8";
 
       src = fetchHex {
         pkg = "elixir_make";
         version = "${version}";
-        sha256 = "5bc19fff950fad52bbe5f211b12db9ec82c6b34a9647da0c2224b8b8464c7e6c";
+        sha256 = "7a71945b913d37ea89b06966e1342c85cfe549b15e6d6d081e8081c493062c07";
       };
 
-      beamDeps = [ castore ];
+      beamDeps = [ castore certifi ];
     };
 
     erlex = buildMix rec {
@@ -530,12 +491,12 @@ let
 
     ex_cldr_calendars = buildMix rec {
       name = "ex_cldr_calendars";
-      version = "1.22.1";
+      version = "1.23.0";
 
       src = fetchHex {
         pkg = "ex_cldr_calendars";
         version = "${version}";
-        sha256 = "e7408cd9e8318b2ef93b76728e84484ddc3ea6d7c894fbc811c54122a7140169";
+        sha256 = "06d2407e699032d5cdc515593b7ce7869f10ce28e98a4ed68d9b21e5001036d4";
       };
 
       beamDeps = [ ex_cldr_numbers ex_doc jason ];
@@ -582,12 +543,12 @@ let
 
     ex_cldr_numbers = buildMix rec {
       name = "ex_cldr_numbers";
-      version = "2.32.3";
+      version = "2.32.4";
 
       src = fetchHex {
         pkg = "ex_cldr_numbers";
         version = "${version}";
-        sha256 = "7b626ff1e59a0ec9c3c5db5ce9ca91a6995e2ab56426b71f3cbf67181ea225f5";
+        sha256 = "6fd5a82f0785418fa8b698c0be2b1845dff92b77f1b3172c763d37868fb503d2";
       };
 
       beamDeps = [ decimal digital_token ex_cldr ex_cldr_currencies jason ];
@@ -608,12 +569,12 @@ let
 
     ex_doc = buildMix rec {
       name = "ex_doc";
-      version = "0.30.9";
+      version = "0.31.1";
 
       src = fetchHex {
         pkg = "ex_doc";
         version = "${version}";
-        sha256 = "d7aaaf21e95dc5cddabf89063327e96867d00013963eadf2c6ad135506a8bc10";
+        sha256 = "3178c3a407c557d8343479e1ff117a96fd31bafe52a039079593fb0524ef61b0";
       };
 
       beamDeps = [ earmark_parser makeup_elixir makeup_erlang ];
@@ -699,12 +660,12 @@ let
 
     expo = buildMix rec {
       name = "expo";
-      version = "0.4.1";
+      version = "0.5.2";
 
       src = fetchHex {
         pkg = "expo";
         version = "${version}";
-        sha256 = "2ff7ba7a798c8c543c12550fa0e2cbc81b95d4974c65855d8d15ba7b37a1ce47";
+        sha256 = "8c9bfa06ca017c9cb4020fabe980bc7fdb1aaec059fd004c2ab3bff03b1c599c";
       };
 
       beamDeps = [];
@@ -725,12 +686,12 @@ let
 
     fast_html = buildMix rec {
       name = "fast_html";
-      version = "2.2.0";
+      version = "2.3.0";
 
       src = fetchHex {
         pkg = "fast_html";
         version = "${version}";
-        sha256 = "064c4f23b4a6168f9187dac8984b056f2c531bb0787f559fd6a8b34b38aefbae";
+        sha256 = "f18e3c7668f82d3ae0b15f48d48feeb257e28aa5ab1b0dbf781c7312e5da029d";
       };
 
       beamDeps = [ elixir_make nimble_pool ];
@@ -777,12 +738,12 @@ let
 
     floki = buildMix rec {
       name = "floki";
-      version = "0.35.2";
+      version = "0.35.4";
 
       src = fetchHex {
         pkg = "floki";
         version = "${version}";
-        sha256 = "6b05289a8e9eac475f644f09c2e4ba7e19201fd002b89c28c1293e7bd16773d9";
+        sha256 = "27fa185d3469bd8fc5947ef0f8d5c4e47f0af02eb6b070b63c868f69e3af0204";
       };
 
       beamDeps = [];
@@ -868,12 +829,12 @@ let
 
     gettext = buildMix rec {
       name = "gettext";
-      version = "0.23.1";
+      version = "0.24.0";
 
       src = fetchHex {
         pkg = "gettext";
         version = "${version}";
-        sha256 = "19d744a36b809d810d610b57c27b934425859d158ebd56561bc41f7eeb8795db";
+        sha256 = "bdf75cdfcbe9e4622dd18e034b227d77dd17f0f133853a1c73b97b3d6c770e8b";
       };
 
       beamDeps = [ expo ];
@@ -933,12 +894,12 @@ let
 
     hammer = buildMix rec {
       name = "hammer";
-      version = "6.1.0";
+      version = "6.2.1";
 
       src = fetchHex {
         pkg = "hammer";
         version = "${version}";
-        sha256 = "b47e415a562a6d072392deabcd58090d8a41182cf9044cdd6b0d0faaaf68ba57";
+        sha256 = "b9476d0c13883d2dc0cc72e786bac6ac28911fba7cc2e04b70ce6a6d9c4b2bdc";
       };
 
       beamDeps = [ poolboy ];
@@ -957,6 +918,19 @@ let
       beamDeps = [];
     };
 
+    hpax = buildMix rec {
+      name = "hpax";
+      version = "0.1.2";
+
+      src = fetchHex {
+        pkg = "hpax";
+        version = "${version}";
+        sha256 = "2c87843d5a23f5f16748ebe77969880e29809580efdaccd615cd3bed628a8c13";
+      };
+
+      beamDeps = [];
+    };
+
     html_entities = buildMix rec {
       name = "html_entities";
       version = "0.5.2";
@@ -972,12 +946,12 @@ let
 
     http_signatures = buildMix rec {
       name = "http_signatures";
-      version = "0.1.1";
+      version = "0.1.2";
 
       src = fetchHex {
         pkg = "http_signatures";
         version = "${version}";
-        sha256 = "cc3b8a007322cc7b624c0c15eec49ee58ac977254ff529a3c482f681465942a3";
+        sha256 = "f08aa9ac121829dae109d608d83c84b940ef2f183ae50f2dd1e9a8bc619d8be7";
       };
 
       beamDeps = [];
@@ -1011,12 +985,12 @@ let
 
     inet_cidr = buildMix rec {
       name = "inet_cidr";
-      version = "1.0.4";
+      version = "1.0.8";
 
       src = fetchHex {
         pkg = "inet_cidr";
         version = "${version}";
-        sha256 = "64a2d30189704ae41ca7dbdd587f5291db5d1dda1414e0774c29ffc81088c1bc";
+        sha256 = "d5b26da66603bb56c933c65214c72152f0de9a6ea53618b56d63302a68f6a90e";
       };
 
       beamDeps = [];
@@ -1128,12 +1102,12 @@ let
 
     makeup_erlang = buildMix rec {
       name = "makeup_erlang";
-      version = "0.1.2";
+      version = "0.1.5";
 
       src = fetchHex {
         pkg = "makeup_erlang";
         version = "${version}";
-        sha256 = "f3f5a1ca93ce6e092d92b6d9c049bcda58a3b617a8d888f8e7231c85630e8108";
+        sha256 = "94d2e986428585a21516d7d7149781480013c56e30c6a233534bedf38867a59a";
       };
 
       beamDeps = [ makeup ];
@@ -1206,12 +1180,12 @@ let
 
     mix_test_watch = buildMix rec {
       name = "mix_test_watch";
-      version = "1.1.1";
+      version = "1.1.2";
 
       src = fetchHex {
         pkg = "mix_test_watch";
         version = "${version}";
-        sha256 = "f82262b54dee533467021723892e15c3267349849f1f737526523ecba4e6baae";
+        sha256 = "8ce79fc69a304eec81ab6c1a05de2eb026a8959f65fb47f933ce8eb56018ba35";
       };
 
       beamDeps = [ file_system ];
@@ -1336,12 +1310,12 @@ let
 
     oban = buildMix rec {
       name = "oban";
-      version = "2.16.3";
+      version = "2.17.5";
 
       src = fetchHex {
         pkg = "oban";
         version = "${version}";
-        sha256 = "4d8a7fb62f63cf2f2080c78954425f5fd8916ef57196b7f79b5bc657abb2ac5f";
+        sha256 = "fd3ccbbfdbb2bc77107c8790946f9821a831ed0720688485ee6adcd7863886cf";
       };
 
       beamDeps = [ ecto_sql jason postgrex telemetry ];
@@ -1375,15 +1349,15 @@ let
 
     phoenix = buildMix rec {
       name = "phoenix";
-      version = "1.7.10";
+      version = "1.7.11";
 
       src = fetchHex {
         pkg = "phoenix";
         version = "${version}";
-        sha256 = "cf784932e010fd736d656d7fead6a584a4498efefe5b8227e9f383bf15bb79d0";
+        sha256 = "b1ec57f2e40316b306708fe59b92a16b9f6f4bf50ccfa41aa8c7feb79e0ec02a";
       };
 
-      beamDeps = [ castore jason phoenix_pubsub phoenix_template phoenix_view plug plug_cowboy plug_crypto telemetry websock_adapter ];
+      beamDeps = [ castore jason phoenix_pubsub phoenix_template phoenix_view plug plug_crypto telemetry websock_adapter ];
     };
 
     phoenix_ecto = buildMix rec {
@@ -1427,12 +1401,12 @@ let
 
     phoenix_live_view = buildMix rec {
       name = "phoenix_live_view";
-      version = "0.20.1";
+      version = "0.20.10";
 
       src = fetchHex {
         pkg = "phoenix_live_view";
         version = "${version}";
-        sha256 = "be494fd1215052729298b0e97d5c2ce8e719c00854b82cd8cf15c1cd7fcf6294";
+        sha256 = "daa17b3fbdfd6347aaade4db01a5dd24d23af0f4344e2e24934e8adfb4a11607";
       };
 
       beamDeps = [ jason phoenix phoenix_html phoenix_template phoenix_view plug telemetry ];
@@ -1453,12 +1427,12 @@ let
 
     phoenix_swoosh = buildMix rec {
       name = "phoenix_swoosh";
-      version = "1.2.0";
+      version = "1.2.1";
 
       src = fetchHex {
         pkg = "phoenix_swoosh";
         version = "${version}";
-        sha256 = "e88d117251e89a16b92222415a6d87b99a96747ddf674fc5c7631de734811dba";
+        sha256 = "4000eeba3f9d7d1a6bf56d2bd56733d5cadf41a7f0d8ffe5bb67e7d667e204a2";
       };
 
       beamDeps = [ hackney phoenix phoenix_html phoenix_view swoosh ];
@@ -1466,12 +1440,12 @@ let
 
     phoenix_template = buildMix rec {
       name = "phoenix_template";
-      version = "1.0.3";
+      version = "1.0.4";
 
       src = fetchHex {
         pkg = "phoenix_template";
         version = "${version}";
-        sha256 = "16f4b6588a4152f3cc057b9d0c0ba7e82ee23afa65543da535313ad8d25d8e2c";
+        sha256 = "2c0c81f0e5c6753faf5cca2f229c9709919aba34fab866d3bc05060c9c444206";
       };
 
       beamDeps = [ phoenix_html ];
@@ -1492,30 +1466,17 @@ let
 
     plug = buildMix rec {
       name = "plug";
-      version = "1.15.2";
+      version = "1.15.3";
 
       src = fetchHex {
         pkg = "plug";
         version = "${version}";
-        sha256 = "02731fa0c2dcb03d8d21a1d941bdbbe99c2946c0db098eee31008e04c6283615";
+        sha256 = "cc4365a3c010a56af402e0809208873d113e9c38c401cabd88027ef4f5c01fd2";
       };
 
       beamDeps = [ mime plug_crypto telemetry ];
     };
 
-    plug_cowboy = buildMix rec {
-      name = "plug_cowboy";
-      version = "2.6.1";
-
-      src = fetchHex {
-        pkg = "plug_cowboy";
-        version = "${version}";
-        sha256 = "de36e1a21f451a18b790f37765db198075c25875c64834bcc82d90b309eb6613";
-      };
-
-      beamDeps = [ cowboy cowboy_telemetry plug ];
-    };
-
     plug_crypto = buildMix rec {
       name = "plug_crypto";
       version = "2.0.0";
@@ -1544,12 +1505,12 @@ let
 
     postgrex = buildMix rec {
       name = "postgrex";
-      version = "0.17.3";
+      version = "0.17.4";
 
       src = fetchHex {
         pkg = "postgrex";
         version = "${version}";
-        sha256 = "946cf46935a4fdca7a81448be76ba3503cff082df42c6ec1ff16a4bdfbfb098d";
+        sha256 = "6458f7d5b70652bc81c3ea759f91736c16a31be000f306d3c64bcdfe9a18b3cc";
       };
 
       beamDeps = [ db_connection decimal jason ];
@@ -1570,12 +1531,12 @@ let
 
     ranch = buildRebar3 rec {
       name = "ranch";
-      version = "1.8.0";
+      version = "2.1.0";
 
       src = fetchHex {
         pkg = "ranch";
         version = "${version}";
-        sha256 = "49fbcfd3682fab1f5d109351b61257676da1a2fdbe295904176d5e521a2ddfe5";
+        sha256 = "244ee3fa2a6175270d8e1fc59024fd9dbc76294a321057de8f803b1479e76916";
       };
 
       beamDeps = [];
@@ -1617,7 +1578,7 @@ let
         sha256 = "f9fc7641ef61e885510f5e5963c2948b9de1de597c63f781e9d3d6c9c8681ab4";
       };
 
-      beamDeps = [ hackney jason plug plug_cowboy ];
+      beamDeps = [ hackney jason plug ];
     };
 
     shortuuid = buildMix rec {
@@ -1635,12 +1596,12 @@ let
 
     sitemapper = buildMix rec {
       name = "sitemapper";
-      version = "0.7.0";
+      version = "0.8.0";
 
       src = fetchHex {
         pkg = "sitemapper";
         version = "${version}";
-        sha256 = "60f7a684e5e9fe7f10ac5b69f48b0be2bcbba995afafcb3c143fc0c8ef1f223f";
+        sha256 = "7cd42b454035da457151c9b6a314b688b5bbe5383add95badc65d013c25989c5";
       };
 
       beamDeps = [ xml_builder ];
@@ -1739,15 +1700,15 @@ let
 
     swoosh = buildMix rec {
       name = "swoosh";
-      version = "1.14.1";
+      version = "1.15.3";
 
       src = fetchHex {
         pkg = "swoosh";
         version = "${version}";
-        sha256 = "87da72260b4351678f96aec61db5c2acc8a88cda2cf2c4f534eb4c9c461350c7";
+        sha256 = "97a667b96ca8cc48a4679f6cd1f40a36d8701cf052587298473614caa70f164a";
       };
 
-      beamDeps = [ cowboy gen_smtp hackney jason mime plug plug_cowboy telemetry ];
+      beamDeps = [ bandit gen_smtp hackney jason mime plug telemetry ];
     };
 
     telemetry = buildRebar3 rec {
@@ -1776,6 +1737,19 @@ let
       beamDeps = [ castore hackney jason mime telemetry ];
     };
 
+    thousand_island = buildMix rec {
+      name = "thousand_island";
+      version = "1.3.5";
+
+      src = fetchHex {
+        pkg = "thousand_island";
+        version = "${version}";
+        sha256 = "2be6954916fdfe4756af3239fb6b6d75d0b8063b5df03ba76fd8a4c87849e180";
+      };
+
+      beamDeps = [ telemetry ];
+    };
+
     timex = buildMix rec {
       name = "timex";
       version = "3.7.11";
@@ -1791,12 +1765,12 @@ let
 
     tls_certificate_check = buildRebar3 rec {
       name = "tls_certificate_check";
-      version = "1.20.0";
+      version = "1.21.0";
 
       src = fetchHex {
         pkg = "tls_certificate_check";
         version = "${version}";
-        sha256 = "ab57b74b1a63dc5775650699a3ec032ec0065005eff1f020818742b7312a8426";
+        sha256 = "6cee6cffc35a390840d48d463541d50746a7b0e421acaadb833cfc7961e490e7";
       };
 
       beamDeps = [ ssl_verify_fun ];
@@ -1804,12 +1778,12 @@ let
 
     tz_world = buildMix rec {
       name = "tz_world";
-      version = "1.3.1";
+      version = "1.3.2";
 
       src = fetchHex {
         pkg = "tz_world";
         version = "${version}";
-        sha256 = "901ed2b4a4430ecab3765244da4a19e6f19141867c2ab3753924919b87ed2224";
+        sha256 = "d1a345e07b3378c4c902ad54fbd5d54c8c3dd55dba883b7407fe57bcec45ff2a";
       };
 
       beamDeps = [ castore certifi geo jason ];
@@ -1830,12 +1804,12 @@ let
 
     ueberauth = buildMix rec {
       name = "ueberauth";
-      version = "0.10.5";
+      version = "0.10.8";
 
       src = fetchHex {
         pkg = "ueberauth";
         version = "${version}";
-        sha256 = "3efd1f31d490a125c7ed453b926f7c31d78b97b8a854c755f5c40064bf3ac9e1";
+        sha256 = "f2d3172e52821375bccb8460e5fa5cb91cfd60b19b636b6e57e9759b6f8c10c1";
       };
 
       beamDeps = [ plug ];
@@ -2020,7 +1994,7 @@ let
         sha256 = "4b977ba4a01918acbf77045ff88de7f6972c2a009213c515a445c48f224ffce9";
       };
 
-      beamDeps = [ plug plug_cowboy websock ];
+      beamDeps = [ bandit plug websock ];
     };
 
     xml_builder = buildMix rec {
diff --git a/pkgs/tools/filesystems/fuse-ext2/default.nix b/pkgs/tools/filesystems/fuse-ext2/default.nix
index aaff185a4a1b..e608bc5a41db 100644
--- a/pkgs/tools/filesystems/fuse-ext2/default.nix
+++ b/pkgs/tools/filesystems/fuse-ext2/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fuse-ext2";
-  version = "unstable-2020-07-12";
+  version = "0.0.11";
 
   src = fetchFromGitHub {
     owner = "alperakcan";
     repo = "fuse-ext2";
-    rev = "899f17c982dadcea13aa447c3a83c53b9431435a";
-    sha256 = "AE7Z+HePAy/h2TCNI9tsz6GVLdnE2AIOM3GnQzerKn8=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-VQMftlnd6q1PdwhSIQwjffjnkhupY8MUc8E+p1tgvUM=";
   };
 
   patches = [
diff --git a/pkgs/tools/inputmethods/fcitx5/fcitx5-qt.nix b/pkgs/tools/inputmethods/fcitx5/fcitx5-qt.nix
index 202886e4e8e1..5311d20ffa32 100644
--- a/pkgs/tools/inputmethods/fcitx5/fcitx5-qt.nix
+++ b/pkgs/tools/inputmethods/fcitx5/fcitx5-qt.nix
@@ -1,19 +1,19 @@
 { lib
-, mkDerivation
+, stdenv
 , fetchFromGitHub
 , cmake
 , extra-cmake-modules
 , fcitx5
-, qtx11extras
-, libxcb
-, libXdmcp
 , qtbase
-, qt6
+, qtwayland
+, wrapQtAppsHook
 , wayland
 }:
-
-mkDerivation rec {
-  pname = "fcitx5-qt";
+let
+  majorVersion = lib.versions.major qtbase.version;
+in
+stdenv.mkDerivation rec {
+  pname = "fcitx5-qt${majorVersion}";
   version = "5.1.4";
 
   src = fetchFromGitHub {
@@ -23,30 +23,28 @@ mkDerivation rec {
     sha256 = "sha256-bVH2US/uEZGERslnAh/fyUbzR9fK1UfG4J+mOmrIE8Y=";
   };
 
-  preConfigure = ''
-    substituteInPlace qt5/platforminputcontext/CMakeLists.txt \
-      --replace \$"{CMAKE_INSTALL_QT5PLUGINDIR}" $out/${qtbase.qtPluginPrefix}
-    substituteInPlace qt6/platforminputcontext/CMakeLists.txt \
-      --replace \$"{CMAKE_INSTALL_QT6PLUGINDIR}" $out/${qt6.qtbase.qtPluginPrefix}
+  postPatch = ''
+    substituteInPlace qt${majorVersion}/platforminputcontext/CMakeLists.txt \
+      --replace \$"{CMAKE_INSTALL_QT${majorVersion}PLUGINDIR}" $out/${qtbase.qtPluginPrefix}
   '';
 
   cmakeFlags = [
-    # adding qt6 to buildInputs would result in error: detected mismatched Qt dependencies
-    "-DCMAKE_PREFIX_PATH=${qt6.qtbase};${qt6.qtwayland}"
-    "-DENABLE_QT4=0"
-    "-DENABLE_QT6=1"
+    "-DENABLE_QT4=OFF"
+    "-DENABLE_QT5=OFF"
+    "-DENABLE_QT6=OFF"
+    "-DENABLE_QT${majorVersion}=ON"
   ];
 
   nativeBuildInputs = [
     cmake
     extra-cmake-modules
+    wrapQtAppsHook
   ];
 
   buildInputs = [
+    qtbase
+    qtwayland
     fcitx5
-    qtx11extras
-    libxcb
-    libXdmcp
     wayland
   ];
 
diff --git a/pkgs/tools/inputmethods/fcitx5/with-addons.nix b/pkgs/tools/inputmethods/fcitx5/with-addons.nix
index 75fac87b6285..614074595f51 100644
--- a/pkgs/tools/inputmethods/fcitx5/with-addons.nix
+++ b/pkgs/tools/inputmethods/fcitx5/with-addons.nix
@@ -4,7 +4,8 @@
 , fcitx5
 , withConfigtool ? true
 , fcitx5-configtool
-, fcitx5-qt
+, libsForQt5
+, qt6Packages
 , fcitx5-gtk
 , addons ? [ ]
 }:
@@ -14,7 +15,8 @@ symlinkJoin {
 
   paths = [
     fcitx5
-    fcitx5-qt
+    libsForQt5.fcitx5-qt
+    qt6Packages.fcitx5-qt
     fcitx5-gtk
   ] ++ lib.optionals withConfigtool [
     fcitx5-configtool
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index df60438b576f..c102372a6675 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -8044,7 +8044,7 @@ with pkgs;
 
   fcitx5 = libsForQt5.callPackage ../tools/inputmethods/fcitx5 { };
 
-  fcitx5-with-addons = libsForQt5.callPackage ../tools/inputmethods/fcitx5/with-addons.nix { };
+  fcitx5-with-addons = callPackage ../tools/inputmethods/fcitx5/with-addons.nix { };
 
   fcitx5-bamboo = callPackage ../tools/inputmethods/fcitx5/fcitx5-bamboo.nix { };
 
diff --git a/pkgs/top-level/qt6-packages.nix b/pkgs/top-level/qt6-packages.nix
index f346dec9f603..68f73dad7634 100644
--- a/pkgs/top-level/qt6-packages.nix
+++ b/pkgs/top-level/qt6-packages.nix
@@ -32,6 +32,8 @@ makeScopeWithSplicing' {
   accounts-qt = callPackage ../development/libraries/accounts-qt { };
   appstream-qt = callPackage ../development/libraries/appstream/qt.nix { };
 
+  fcitx5-qt = callPackage ../tools/inputmethods/fcitx5/fcitx5-qt.nix { };
+
   kdsoap = callPackage ../development/libraries/kdsoap { };
 
   kcolorpicker = callPackage ../development/libraries/kcolorpicker { };