Merge master into staging-next

81 files changed, 986 insertions, 562 deletions

diff --git a/doc/languages-frameworks/python.section.md b/doc/languages-frameworks/python.section.md
index fa7f3eddf72c..4ca177bcdd26 100644
--- a/doc/languages-frameworks/python.section.md
+++ b/doc/languages-frameworks/python.section.md
@@ -2014,6 +2014,10 @@ example of such a situation is when `py.test` is used.
 
 * Tests that attempt to access `$HOME` can be fixed by using the following
   work-around before running tests (e.g. `preCheck`): `export HOME=$(mktemp -d)`
+* Compiling with Cython causes tests to fail with a `ModuleNotLoadedError`.
+  This can be fixed with two changes in the derivation: 1) replacing `pytest` with
+  `pytestCheckHook` and 2) adding a `preCheck` containing `cd $out` to run
+  tests within the built output.
 
 ## Contributing {#contributing}
 
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 4889d6a4b226..443c41dbb98f 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -761,6 +761,11 @@
     githubId = 786394;
     name = "Alexander Krupenkin ";
   };
+  akshayka = {
+    github = "akshayka";
+    githubId = 1994308;
+    name = "Akshay Agrawal";
+  };
   akshgpt7 = {
     email = "akshgpt7@gmail.com";
     github = "akshgpt7";
@@ -5005,6 +5010,12 @@
     githubId = 283316;
     name = "Dane Lipscombe";
   };
+  dmadisetti = {
+    email = "nix@madisetti.me";
+    github = "dmadisetti";
+    githubId = 2689338;
+    name = "Dylan Madisetti";
+  };
   dmalikov = {
     email = "malikov.d.y@gmail.com";
     github = "dmalikov";
@@ -9956,6 +9967,15 @@
     githubId = 1621930;
     name = "Kamil Chmielewski";
   };
+  kamillaova = {
+    name = "Kamilla Ova";
+    email = "me@kamillaova.dev";
+    github = "Kamillaova";
+    githubId = 54859825;
+    keys = [{
+      fingerprint = "B2D0 AA53 8DBE 60B0 0811  3FC0 2D52 5F67 791E 5834";
+    }];
+  };
   kampfschlaefer = {
     email = "arnold@arnoldarts.de";
     github = "kampfschlaefer";
diff --git a/maintainers/scripts/luarocks-packages.csv b/maintainers/scripts/luarocks-packages.csv
index 325b2f30f047..fd6c59c0b46f 100644
--- a/maintainers/scripts/luarocks-packages.csv
+++ b/maintainers/scripts/luarocks-packages.csv
@@ -95,6 +95,7 @@ magick,,,,,5.1,donovanglover
 markdown,,,,,,
 mediator_lua,,,,,,
 middleclass,,,,,,
+mimetypes,,,,,,
 mpack,,,,,,
 moonscript,https://github.com/leafo/moonscript.git,dev-1,,,,arobyn
 nlua,,,,,,teto
diff --git a/nixos/modules/services/networking/dnscache.nix b/nixos/modules/services/networking/dnscache.nix
index eff13f69f470..4f5b77a5b685 100644
--- a/nixos/modules/services/networking/dnscache.nix
+++ b/nixos/modules/services/networking/dnscache.nix
@@ -86,7 +86,11 @@ in {
 
   config = mkIf config.services.dnscache.enable {
     environment.systemPackages = [ pkgs.djbdns ];
-    users.users.dnscache.isSystemUser = true;
+    users.users.dnscache = {
+        isSystemUser = true;
+        group = "dnscache";
+    };
+    users.groups.dnscache = {};
 
     systemd.services.dnscache = {
       description = "djbdns dnscache server";
diff --git a/nixos/modules/services/x11/xserver.nix b/nixos/modules/services/x11/xserver.nix
index 3d7474e18263..4e0235f9ad1d 100644
--- a/nixos/modules/services/x11/xserver.nix
+++ b/nixos/modules/services/x11/xserver.nix
@@ -749,7 +749,7 @@ in
     boot.kernel.sysctl."fs.inotify.max_user_instances" = mkDefault 524288;
     boot.kernel.sysctl."fs.inotify.max_user_watches" = mkDefault 524288;
 
-    programs.gnupg.agent.pinentryPackage = lib.mkDefault pkgs.pinentry-gnome3;
+    programs.gnupg.agent.pinentryPackage = lib.mkOverride 1100 pkgs.pinentry-gnome3;
 
     systemd.defaultUnit = mkIf cfg.autorun "graphical.target";
 
diff --git a/nixos/tests/drawterm.nix b/nixos/tests/drawterm.nix
index 1d444bb55433..3594343853c0 100644
--- a/nixos/tests/drawterm.nix
+++ b/nixos/tests/drawterm.nix
@@ -38,11 +38,24 @@ let
         def drawterm_running():
             machine.succeed("pgrep drawterm")
 
+        # cage is a bit wonky here.
+        # it seems to lag behind drawing
+        # and somehow needs a single input character
+        # in order to get the first prompt to show up.
+        # This is not present in any other compositor
+        # as far as I know, and after spending a couple
+        # hours with the upstream source trying to deduce
+        # how to perhaps fix it, I figured just polling is OK.
+        @polling_condition
+        def cpu_shown_up():
+            machine.send_chars(".")
+            machine.wait_for_text("cpu", 1)
+
         start_all()
 
         machine.wait_for_unit("graphical.target")
         drawterm_running.wait() # type: ignore[union-attr]
-        machine.wait_for_text("cpu")
+        cpu_shown_up.wait() # type: ignore[union-attr]
         machine.send_chars("cpu\n")
         machine.wait_for_text("auth")
         machine.send_chars("cpu\n")
diff --git a/pkgs/applications/editors/rstudio/default.nix b/pkgs/applications/editors/rstudio/default.nix
index 82a572eaf4c5..d3ca7de1d6a1 100644
--- a/pkgs/applications/editors/rstudio/default.nix
+++ b/pkgs/applications/editors/rstudio/default.nix
@@ -7,7 +7,7 @@
 , makeDesktopItem
 , copyDesktopItems
 , cmake
-, boost
+, boost183
 , zlib
 , openssl
 , R
@@ -40,18 +40,19 @@
 
 let
   pname = "RStudio";
-  version =
-  "${RSTUDIO_VERSION_MAJOR}.${RSTUDIO_VERSION_MINOR}.${RSTUDIO_VERSION_PATCH}${RSTUDIO_VERSION_SUFFIX}";
-  RSTUDIO_VERSION_MAJOR  = "2023";
-  RSTUDIO_VERSION_MINOR  = "09";
-  RSTUDIO_VERSION_PATCH  = "0";
-  RSTUDIO_VERSION_SUFFIX = "+463";
+  version = "2023.12.1+402";
+  RSTUDIO_VERSION_MAJOR = lib.versions.major version;
+  RSTUDIO_VERSION_MINOR = lib.versions.minor version;
+  RSTUDIO_VERSION_PATCH = lib.versions.patch version;
+  RSTUDIO_VERSION_SUFFIX = "+" + toString (
+    lib.tail (lib.splitString "+" version)
+  );
 
   src = fetchFromGitHub {
     owner = "rstudio";
     repo = "rstudio";
-    rev = "v${version}";
-    hash = "sha256-FwNuU2rbE3GEhuwphvZISUMhvSZJ6FjjaZ1oQ9F8NWc=";
+    rev = version;
+    hash = "sha256-ecMzkpHazg8jEBz9wh8hqRX2UdziOC8b6F+3xxdugy0=";
   };
 
   mathJaxSrc = fetchurl {
@@ -62,8 +63,8 @@ let
   rsconnectSrc = fetchFromGitHub {
     owner = "rstudio";
     repo = "rsconnect";
-    rev = "5175a927a41acfd9a21d9fdecb705ea3292109f2";
-    hash = "sha256-c1fFcN6KAfxXv8bv4WnIqQKg1wcNP2AywhEmIbyzaBA=";
+    rev = "v1.2.0";
+    hash = "sha256-ghRz4Frd+I9ShRNNOE/kdk9KjRCj0Z1mPnThueriiUY=";
   };
 
   # Ideally, rev should match the rstudio release name.
@@ -93,7 +94,7 @@ in
     ];
 
     buildInputs = [
-      boost
+      boost183
       zlib
       openssl
       R
@@ -133,6 +134,7 @@ in
       ./fix-resources-path.patch
       ./pandoc-nix-path.patch
       ./use-system-quarto.patch
+      ./ignore-etc-os-release.patch
     ];
 
     postPatch = ''
diff --git a/pkgs/applications/editors/rstudio/ignore-etc-os-release.patch b/pkgs/applications/editors/rstudio/ignore-etc-os-release.patch
new file mode 100644
index 000000000000..7c67edd16fcb
--- /dev/null
+++ b/pkgs/applications/editors/rstudio/ignore-etc-os-release.patch
@@ -0,0 +1,77 @@
+diff --git a/CMakeGlobals.txt b/CMakeGlobals.txt
+index 5f96ffb..3f15687 100644
+--- a/CMakeGlobals.txt
++++ b/CMakeGlobals.txt
+@@ -29,11 +29,6 @@ endif()
+ get_filename_component(ROOT_SRC_DIR ${CMAKE_CURRENT_LIST_FILE} PATH)
+ set(CMAKE_MODULE_PATH "${ROOT_SRC_DIR}/cmake/modules/")
+ 
+-# read /etc/os-release
+-if(LINUX)
+-   include(OsRelease)
+-endif()
+-
+ # version info
+ if ("$ENV{RSTUDIO_VERSION_MAJOR}" STREQUAL "")
+   string(TIMESTAMP CPACK_PACKAGE_VERSION_MAJOR "%Y")
+diff --git a/cmake/modules/OsRelease.cmake b/cmake/modules/OsRelease.cmake
+deleted file mode 100644
+index 81a9e1f..0000000
+--- a/cmake/modules/OsRelease.cmake
++++ /dev/null
+@@ -1,24 +0,0 @@
+-#
+-# OsRelease.cmake
+-#
+-# Copyright (C) 2022 by Posit Software, PBC
+-#
+-# This program is licensed to you under the terms of version 3 of the
+-# GNU Affero General Public License. This program is distributed WITHOUT
+-# ANY EXPRESS OR IMPLIED WARRANTY, INCLUDING THOSE OF NON-INFRINGEMENT,
+-# MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Please refer to the
+-# AGPL (http://www.gnu.org/licenses/agpl-3.0.txt) for more details.
+-#
+-#
+-
+-# reads and parses /etc/os-release into CMake variables
+-file(STRINGS "/etc/os-release" OS_RELEASE)
+-foreach(LINE ${OS_RELEASE})
+-	string(FIND "${LINE}" "=" INDEX)
+-	string(SUBSTRING "${LINE}" 0 "${INDEX}" KEY)
+-	math(EXPR INDEX "${INDEX} + 1")
+-	string(SUBSTRING "${LINE}" "${INDEX}" -1 VALUE)
+-	separate_arguments(VALUE UNIX_COMMAND "${VALUE}")
+-	set("OS_RELEASE_${KEY}" "${VALUE}" CACHE INTERNAL "/etc/os-release: ${KEY}")
+-endforeach()
+-
+diff --git a/package/linux/CMakeLists.txt b/package/linux/CMakeLists.txt
+index 5d5c35e..a94f8fc 100644
+--- a/package/linux/CMakeLists.txt
++++ b/package/linux/CMakeLists.txt
+@@ -16,7 +16,7 @@
+ # configure cpack install location
+ set(CPACK_SET_DESTDIR "ON")
+ set(CPACK_INSTALL_PREFIX "${CMAKE_INSTALL_PREFIX}")
+-message(STATUS "Packaging RStudio for ${OS_RELEASE_PRETTY_NAME}")
++message(STATUS "Packaging RStudio for Nix")
+ 
+ # detect architecture (packaging platform specific)
+ find_program(DPKG_EXECUTABLE dpkg)
+@@ -42,17 +42,6 @@ if(EXISTS "/etc/redhat-release")
+    endif()
+ endif()
+ 
+-# set libssl dependency
+-if(OS_RELEASE_ID STREQUAL "ubuntu")
+-  if(OS_RELEASE_VERSION_ID VERSION_GREATER_EQUAL "22.04")
+-    set(RSTUDIO_DEBIAN_DEPENDS_SSL "libssl-dev")
+-  else()
+-    set(RSTUDIO_DEBIAN_DEPENDS_SSL "libssl1.0.0 | libssl1.0.2 | libssl1.1")
+-  endif()
+-else()
+-  set(RSTUDIO_DEBIAN_DEPENDS_SSL "libssl-dev")
+-endif()
+-
+ # configuration specific
+ if(RSTUDIO_SERVER)
+ 
diff --git a/pkgs/applications/editors/rstudio/use-system-node.patch b/pkgs/applications/editors/rstudio/use-system-node.patch
index bb4480b4ae5f..6e0acf46dda0 100644
--- a/pkgs/applications/editors/rstudio/use-system-node.patch
+++ b/pkgs/applications/editors/rstudio/use-system-node.patch
@@ -6,7 +6,7 @@ index d18362b..98cdd4c 100644
  external-pandoc-path=${RSTUDIO_DEPENDENCIES_PANDOC_DIR}
  external-quarto-path=${RSTUDIO_DEPENDENCIES_QUARTO_DIR}
  external-libclang-path=${RSTUDIO_DEPENDENCIES_DIR}/common/libclang
--external-node-path=${RSTUDIO_DEPENDENCIES_DIR}/common/node/16.14.0/bin/node
+-external-node-path=${RSTUDIO_DEPENDENCIES_DIR}/common/node/18.18.2/bin/node
 +external-node-path=@node@/bin/node
  
  # enable copilot
@@ -32,7 +32,7 @@ index 033d605..f1ee63d 100644
 +++ b/src/gwt/build.xml
 @@ -87,29 +87,7 @@
     <!-- ensure version matches RSTUDIO_NODE_VERSION -->
-    <property name="node.version" value="16.14.0"/>
+    <property name="node.version" value="18.18.2"/>
     <property name="node.dir" value="../../dependencies/common/node/${node.version}"/>
 -   <!-- use yarn from system but will prefer yarn from dependencies if available -->
 -   <condition property="yarn.bin" value="yarn">
@@ -58,15 +58,18 @@ index 033d605..f1ee63d 100644
 -      value="c:\rstudio-tools\dependencies\common\node\${node.version}\node_modules\yarn\bin\yarn.cmd"
 -      file="c:\rstudio-tools\dependencies\common\node\${node.version}\node_modules\yarn\bin\yarn.cmd"/>
 +   <property name="node.bin" value="@node@/bin/node"/>
- 
+
     <property name="panmirror.dir" value="./lib/quarto/apps/panmirror"/>
     <property name="panmirror.build.dir" value="./www/js/panmirror"/>
-@@ -126,21 +104,11 @@
-       file="c:\rstudio-tools\src\gwt\lib\quarto\apps\panmirror"/>
- 
-    <target name="panmirror" description="Compile panmirror library">
+@@ -133,28 +111,11 @@
+             <isset property="panmirror.minify" />
+          </not>
+       </condition>
+-
 -      <echo message="yarn location: ${yarn.bin}"/>
 -      <echo message="panmirror location: ${panmirror.dir}"/>
+-      <echo message="panmirror minify: ${panmirror.minify}"/>
+-
        <mkdir dir="${panmirror.build.dir}"/>
 -      <exec executable="${yarn.bin}" dir="${panmirror.dir}" resolveexecutable="true" failonerror="true">
 -         <arg value="install"/>
@@ -75,14 +78,19 @@ index 033d605..f1ee63d 100644
 -      </exec>
 -      <exec executable="${yarn.bin}" dir="${panmirror.dir}" resolveexecutable="true" failonerror="true">
 -         <arg value="build"/>
+-         <arg value="--minify"/>
+-         <arg value="${panmirror.minify}"/>
+-         <arg value="--sourcemap"/>
+-         <arg value="true"/>
 -         <env key="PANMIRROR_OUTDIR" value="dist-rstudio"/>
-+      <exec executable="${node.bin}" dir="${panmirror.dir}" spawn="${panmirror.spawn}">
-+         <arg value="fuse"/>
-+         <arg value="${panmirror.target}"/>
++     <exec executable="${node.bin}" dir="${panmirror.dir}" spawn="${panmirror.spawn}">
++          <arg value="fuse"/>
++          <arg value="${panmirror.target}"/>
        </exec>
 -      <copy todir="${panmirror.build.dir}">
 -         <fileset dir="${panmirror.dir}/dist-rstudio"/>
 -      </copy>
     </target>
- 
+
     <target name="javac" description="Compile java source">
+    
diff --git a/pkgs/applications/graphics/drawio/default.nix b/pkgs/applications/graphics/drawio/default.nix
index 20f061c50e04..b9c56a01e006 100644
--- a/pkgs/applications/graphics/drawio/default.nix
+++ b/pkgs/applications/graphics/drawio/default.nix
@@ -6,6 +6,7 @@
 , copyDesktopItems
 , prefetch-yarn-deps
 , makeWrapper
+, autoSignDarwinBinariesHook
 , nodejs
 , yarn
 , electron
@@ -23,6 +24,11 @@ stdenv.mkDerivation rec {
     hash = "sha256-+TCnVXcmAEpa7MiL0dyeoh2aUfIIO8eze9pEaHgKnME=";
   };
 
+  # `@electron/fuses` tries to run `codesign` and fails. Disable and use autoSignDarwinBinariesHook instead
+  postPatch = ''
+    sed -i -e 's/resetAdHocDarwinSignature:.*/resetAdHocDarwinSignature: false,/' build/fuses.js
+  '';
+
   offlineCache = fetchYarnDeps {
     yarnLock = src + "/yarn.lock";
     hash = "sha256-QS0bkDDQq3sn79TQ+pTZsmbmXgMccyLmlPLTsko7eGg=";
@@ -35,6 +41,8 @@ stdenv.mkDerivation rec {
     yarn
   ] ++ lib.optionals (!stdenv.isDarwin) [
     copyDesktopItems
+  ] ++ lib.optionals stdenv.isDarwin [
+    autoSignDarwinBinariesHook
   ];
 
   ELECTRON_SKIP_BINARY_DOWNLOAD = true;
diff --git a/pkgs/applications/misc/electrum/grs.nix b/pkgs/applications/misc/electrum/grs.nix
index b615a61f5a19..4ca911126c5b 100644
--- a/pkgs/applications/misc/electrum/grs.nix
+++ b/pkgs/applications/misc/electrum/grs.nix
@@ -10,7 +10,7 @@
 }:
 
 let
-  version = "4.4.4";
+  version = "4.5.4";
 
   libsecp256k1_name =
     if stdenv.isLinux then "libsecp256k1.so.{v}"
@@ -32,11 +32,11 @@ python3.pkgs.buildPythonApplication {
     owner = "Groestlcoin";
     repo = "electrum-grs";
     rev = "refs/tags/v${version}";
-    sha256 = "0fl01qdvb1z6l6kwipj1lj0qmjk3mzw25wv7yh5j1hh1f5lng0s8";
+    sha256 = "1k078jg3bw4n3kcxy917m30x1skxm679w8hcw8mlxb94ikrjc66h";
   };
 
   nativeBuildInputs = lib.optionals enableQt [ wrapQtAppsHook ];
-  buildInputs = lib.optional stdenv.isLinux qtwayland;
+  buildInputs = lib.optional (stdenv.isLinux && enableQt) qtwayland;
 
   propagatedBuildInputs = with python3.pkgs; [
     aiohttp
@@ -56,17 +56,25 @@ python3.pkgs.buildPythonApplication {
     requests
     tlslite-ng
     certifi
+    jsonpatch
     # plugins
     btchip-python
     ledger-bitcoin
     ckcc-protocol
     keepkey
     trezor
+    bitbox02
+    cbor
+    pyserial
   ] ++ lib.optionals enableQt [
     pyqt5
     qdarkstyle
   ];
 
+  checkInputs = with python3.pkgs; lib.optionals enableQt [
+    pyqt6
+  ];
+
   postPatch = ''
     # make compatible with protobuf4 by easing dependencies ...
     substituteInPlace ./contrib/requirements/requirements.txt \
@@ -104,7 +112,6 @@ python3.pkgs.buildPythonApplication {
 
   meta = with lib; {
     description = "Lightweight Groestlcoin wallet";
-    mainProgram = "electrum-grs";
     longDescription = ''
       An easy-to-use Groestlcoin client featuring wallets generated from
       mnemonic seeds (in addition to other, more advanced, wallet options)
@@ -116,5 +123,6 @@ python3.pkgs.buildPythonApplication {
     license = licenses.mit;
     platforms = platforms.all;
     maintainers = with maintainers; [ gruve-p ];
+    mainProgram = "electrum-grs";
   };
 }
diff --git a/pkgs/applications/misc/obinskit/default.nix b/pkgs/applications/misc/obinskit/default.nix
deleted file mode 100644
index 043ff2352e90..000000000000
--- a/pkgs/applications/misc/obinskit/default.nix
+++ /dev/null
@@ -1,65 +0,0 @@
-{ stdenv
-, lib
-, fetchurl
-, libxkbcommon
-, systemd
-, xorg
-, electron_13
-, makeWrapper
-, makeDesktopItem
-}:
-let
-  desktopItem = makeDesktopItem rec {
-    name = "Obinskit";
-    exec = "obinskit";
-    icon = "obinskit";
-    desktopName = "Obinskit";
-    genericName = "Obinskit keyboard configurator";
-    categories = [ "Utility" ];
-  };
-  electron = electron_13;
-in
-stdenv.mkDerivation rec {
-  pname = "obinskit";
-  version = "1.2.11";
-
-  src = fetchurl {
-    url = "https://s3.hexcore.xyz/occ/linux/tar/ObinsKit_${version}_x64.tar.gz";
-    curlOptsList = [ "--header" "Referer: https://www.hexcore.xyz/" ];
-    hash = "sha256-KhCu1TZsJmcXRSWSTaYOMjt+IA4qqavBwaYzXnkgls0=";
-  };
-
-  unpackPhase = "tar -xzf $src";
-
-  sourceRoot = "ObinsKit_${version}_x64";
-
-  nativeBuildInputs = [ makeWrapper ];
-
-  dontConfigure = true;
-  dontBuild = true;
-
-  installPhase = ''
-    mkdir -p $out/opt/obinskit
-
-    cp -r resources $out/opt/obinskit/
-    cp -r locales $out/opt/obinskit/
-
-    mkdir -p $out/share/{applications,pixmaps}
-    install resources/icons/tray-darwin@2x.png $out/share/pixmaps/obinskit.png
-    ln -s ${desktopItem}/share/applications/* $out/share/applications
-  '';
-
-  postFixup = ''
-    makeWrapper ${electron}/bin/electron $out/bin/${pname} \
-      --add-flags $out/opt/obinskit/resources/app.asar \
-      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ stdenv.cc.cc.lib libxkbcommon (lib.getLib systemd) xorg.libXt xorg.libXtst ]}"
-  '';
-
-  meta = with lib; {
-    description = "Graphical configurator for Anne Pro and Anne Pro II keyboards";
-    homepage = "https://www.hexcore.xyz/obinskit";
-    license = licenses.unfree;
-    maintainers = with maintainers; [ shou ];
-    platforms = [ "x86_64-linux" ];
-  };
-}
diff --git a/pkgs/applications/misc/sl1-to-photon/default.nix b/pkgs/applications/misc/sl1-to-photon/default.nix
index e76dff0ca570..901265016f8e 100644
--- a/pkgs/applications/misc/sl1-to-photon/default.nix
+++ b/pkgs/applications/misc/sl1-to-photon/default.nix
@@ -8,34 +8,34 @@
 , shiboken2
 }:
 let
-  version = "0.1.3";
+  version = "0.1.3+";
 in
  buildPythonApplication rec {
   pname = "sl1-to-photon";
   inherit version;
 
   src = fetchFromGitHub {
-    owner = "fookatchu";
+    owner = "cab404";
     repo = "SL1toPhoton";
-    rev = "v${version}";
-    sha256 = "1hmb74rcky3nax4lxn7pw6lcd5a66fdbwrm11c84zb31xb51bakw";
+    rev = "7edc6ea99818622f5d49ac7af80ddd4916b8c19f";
+    sha256 = "ssFfjlBMi3FHosDBUA2gs71VUIBkEdPVcV3STNxmOIM=";
   };
 
-  propagatedBuildInputs = [ pyphotonfile pillow numpy pyside2 shiboken2 ];
+  pythonPath = [ pyphotonfile pillow numpy pyside2 shiboken2 ];
 
-  format = "other";
+  format = "setuptools";
+  dontUseSetuptoolsCheck = true;
 
   installPhase = ''
     install -D -m 0755 SL1_to_Photon.py $out/bin/${pname}
-    sed -i '1i#!/usr/bin/env python' $out/bin/${pname}
   '';
 
   meta = with lib; {
     maintainers = [ maintainers.cab404 ];
     license = licenses.gpl3Plus;
     description = "Tool for converting Slic3r PE's SL1 files to Photon files for the Anycubic Photon 3D-Printer";
+    homepage = "https://github.com/cab404/SL1toPhoton";
     mainProgram = "sl1-to-photon";
-    homepage = "https://github.com/fookatchu/SL1toPhoton";
   };
 
 }
diff --git a/pkgs/applications/networking/browsers/firefox/wrapper.nix b/pkgs/applications/networking/browsers/firefox/wrapper.nix
index a2b97577c8d3..0f62075439c5 100644
--- a/pkgs/applications/networking/browsers/firefox/wrapper.nix
+++ b/pkgs/applications/networking/browsers/firefox/wrapper.nix
@@ -18,6 +18,7 @@
 , sndio
 , libjack2
 , speechd
+, removeReferencesTo
 }:
 
 ## configurability of the wrapper itself
@@ -238,7 +239,7 @@ let
               };
             }));
 
-      nativeBuildInputs = [ makeWrapper lndir jq ];
+      nativeBuildInputs = [ makeWrapper lndir jq removeReferencesTo ];
       buildInputs = [ browser.gtk3 ];
 
 
@@ -413,7 +414,9 @@ let
       passthru = { unwrapped = browser; };
 
       disallowedRequisites = [ stdenv.cc ];
-
+      postInstall = ''
+        find "$out" -type f -exec remove-references-to -t ${stdenv.cc} '{}' +
+      '';
       meta = browser.meta // {
         inherit (browser.meta) description;
         mainProgram = launcherName;
diff --git a/pkgs/applications/networking/cluster/argocd/default.nix b/pkgs/applications/networking/cluster/argocd/default.nix
index 3139252e65c7..d40532db8a16 100644
--- a/pkgs/applications/networking/cluster/argocd/default.nix
+++ b/pkgs/applications/networking/cluster/argocd/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "argocd";
-  version = "2.10.3";
+  version = "2.10.4";
 
   src = fetchFromGitHub {
     owner = "argoproj";
     repo = "argo-cd";
     rev = "v${version}";
-    hash = "sha256-DaM3vNmZTz4zJTsmtgWwKPhHeUdqe2ZdlXYTppdhiJs=";
+    hash = "sha256-D7vkVvYLImC9dtqPU3Gxe5sQO92qxnx4533ykBm7u7c=";
   };
 
   proxyVendor = true; # darwin/linux hash mismatch
diff --git a/pkgs/applications/networking/cluster/tftui/default.nix b/pkgs/applications/networking/cluster/tftui/default.nix
index 3a9d657dbdd2..5ef3142ee69d 100644
--- a/pkgs/applications/networking/cluster/tftui/default.nix
+++ b/pkgs/applications/networking/cluster/tftui/default.nix
@@ -1,27 +1,33 @@
 { lib
-, buildPythonApplication
-, fetchPypi
+, fetchFromGitHub
 , makeWrapper
-, poetry-core
-, posthog
-, pyperclip
-, requests
-, rich
-, textual
+, python3
 , enableUsageTracking ? false
 }:
 
-buildPythonApplication rec {
+python3.pkgs.buildPythonApplication rec {
   pname = "tftui";
-  version = "0.12.4";
+  version = "0.12.6";
   pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-E4Y0qA7SooMlHh+oSFUl1hfblpirr/Jdb1C2fqU43t0=";
+  src = fetchFromGitHub {
+    owner = "idoavrah";
+    repo = "terraform-tui";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-vK1qKf8+RxwHUpuEQ97PcwGvObNVpd88kAb3DFRoRG0=";
   };
 
-  propagatedBuildInputs = [
+  pythonRelaxDeps = [
+    "textual"
+  ];
+
+  nativeBuildInputs = with python3.pkgs; [
+    makeWrapper
+    poetry-core
+    pythonRelaxDepsHook
+  ];
+
+  propagatedBuildInputs = with python3.pkgs; [
     posthog
     pyperclip
     requests
@@ -29,11 +35,6 @@ buildPythonApplication rec {
     textual
   ];
 
-  nativeBuildInputs = [
-    makeWrapper
-    poetry-core
-  ];
-
   pythonImportsCheck = [
     "tftui"
   ];
@@ -46,7 +47,7 @@ buildPythonApplication rec {
   meta = with lib; {
     description = "Textual UI to view and interact with Terraform state";
     homepage = "https://github.com/idoavrah/terraform-tui";
-    changelog = "https://github.com/idoavrah/terraform-tui/releases";
+    changelog = "https://github.com/idoavrah/terraform-tui/releases/tag/v${version}";
     license = licenses.asl20;
     maintainers = with maintainers; teams.bitnomial.members;
     mainProgram = "tftui";
diff --git a/pkgs/applications/science/biology/astral/default.nix b/pkgs/applications/science/biology/astral/default.nix
index ffe0326239cc..34077949b97d 100644
--- a/pkgs/applications/science/biology/astral/default.nix
+++ b/pkgs/applications/science/biology/astral/default.nix
@@ -2,49 +2,67 @@
 , stdenvNoCC
 , fetchFromGitHub
 , jdk8
-, makeWrapper
 , jre8
+, strip-nondeterminism
+, makeWrapper
 , zip
 }:
+
 let
   jdk = jdk8;
   jre = jre8;
 in
-stdenvNoCC.mkDerivation rec {
+stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "astral";
   version = "5.7.1";
 
   src = fetchFromGitHub {
     owner = "smirarab";
     repo = "ASTRAL";
-    rev = "v${version}";
-    sha256 = "043w2z6gbrisqirdid022f4b8jps1pp5syi344krv2bis1gjq5sn";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-VhcsX9BxiZ0nISN6Xe4N+kq0iBMCtNhyxDrm9cwXfBA=";
   };
 
-  nativeBuildInputs = [ jdk makeWrapper jre zip ];
+  patches = [
+    # we can't use stripJavaArchivesHook here, because the build process puts a .jar file into a zip file
+    # this patch calls strip-nondeterminism manually
+    ./make-deterministic.patch
+  ];
+
+  nativeBuildInputs = [
+    jdk
+    zip
+    strip-nondeterminism
+    makeWrapper
+  ];
 
   buildPhase = ''
+    runHook preBuild
     patchShebangs ./make.sh
     ./make.sh
+    runHook postBuild
   '';
 
   doCheck = true;
 
   checkPhase = ''
     runHook preCheck
-    java -jar astral.${version}.jar -i main/test_data/song_primates.424.gene.tre
+    java -jar astral.${finalAttrs.version}.jar -i main/test_data/song_primates.424.gene.tre
     runHook postCheck
   '';
 
   installPhase = ''
-    mkdir -p $out/share/lib
-    mkdir -p $out/bin
-    mv astral.${version}.jar $out/share/
-    mv lib/*.jar $out/share/lib
-    mv Astral.${version}.zip $out/share/
-    cp -a  main/test_data $out/share/
+    runHook preInstall
+
+    install -Dm644 astral.${finalAttrs.version}.jar -t $out/share
+    install -Dm644 lib/*.jar -t $out/share/lib
+    install -Dm644 Astral.${finalAttrs.version}.zip -t $out/share
+    cp -a main/test_data $out/share
+
     makeWrapper ${jre}/bin/java $out/bin/astral \
-        --add-flags "-jar $out/share/astral.${version}.jar"
+        --add-flags "-jar $out/share/astral.${finalAttrs.version}.jar"
+
+    runHook postInstall
   '';
 
   meta = with lib; {
@@ -53,9 +71,9 @@ stdenvNoCC.mkDerivation rec {
     mainProgram = "astral";
     sourceProvenance = with sourceTypes; [
       fromSource
-      binaryBytecode  # source bundles dependencies as jars
+      binaryBytecode # source bundles dependencies as jars
     ];
     license = licenses.asl20;
-    maintainers = with maintainers; [ bzizou ];
+    maintainers = with maintainers; [ bzizou tomasajt ];
   };
-}
+})
diff --git a/pkgs/applications/science/biology/astral/make-deterministic.patch b/pkgs/applications/science/biology/astral/make-deterministic.patch
new file mode 100644
index 000000000000..940182e2f49f
--- /dev/null
+++ b/pkgs/applications/science/biology/astral/make-deterministic.patch
@@ -0,0 +1,21 @@
+diff --git a/make.sh b/make.sh
+index 3ff6529..937b1a2 100644
+--- a/make.sh
++++ b/make.sh
+@@ -17,6 +17,8 @@ jar cvfm ../astral.$version.jar ../manifest.text phylonet/util/BitSet.* phylonet
+ 
+ cd ..
+ 
++strip-nondeterminism --type jar astral.$version.jar
++
+ chmod +x astral.$version.jar
+ sed -e "s/__astral.jar__/astral.$version.jar/g" -e "s/__astral.zip__/Astral.$version.zip/g" README.template.md > README.md
+ sed -e "s/__astral.jar__/astral.$version.jar/g" -e "s/__astral.zip__/Astral.$version.zip/g" astral-tutorial-template.md > astral-tutorial.md
+@@ -32,6 +34,7 @@ ln -s ../astral-tutorial.pdf .
+ cd ..
+ rm -f Astral.$version.zip
+ zip -r Astral.$version.zip Astral 
++strip-nondeterminism --type zip Astral.$version.zip
+ 
+ set +x
+ echo "
diff --git a/pkgs/applications/science/math/nauty/default.nix b/pkgs/applications/science/math/nauty/default.nix
index ef8c041039b1..c1feeffdcb6d 100644
--- a/pkgs/applications/science/math/nauty/default.nix
+++ b/pkgs/applications/science/math/nauty/default.nix
@@ -4,11 +4,11 @@
 }:
 stdenv.mkDerivation rec {
   pname = "nauty";
-  version = "2.7r4";
+  version = "2.8.8";
 
   src = fetchurl {
-    url = "https://pallini.di.uniroma1.it/nauty${builtins.replaceStrings ["."] [""] version}.tar.gz";
-    sha256 = "sha256-uBDIWm/imfO0yfJKr5KcrH+VRsLzXCDh3Qrbx0CISKY=";
+    url = "https://pallini.di.uniroma1.it/nauty${builtins.replaceStrings ["."] ["_"] version}.tar.gz";
+    sha256 = "sha256-FZ0hVoEKa7JAQQzWHrZBrdhQiNnxXIiM2qN7hoH5Kc4=";
   };
 
   outputs = [ "out" "dev" ];
@@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
     # I'm not sure if the filename will remain the same for future changelog or
     # if it will track changes to minor releases. Lets see. Better than nothing
     # in any case.
-    changelog = "https://pallini.di.uniroma1.it/changes24-27.txt";
+    changelog = "https://pallini.di.uniroma1.it/changes24-28.txt";
     homepage = "https://pallini.di.uniroma1.it/";
   };
 }
diff --git a/pkgs/applications/science/math/sage/default.nix b/pkgs/applications/science/math/sage/default.nix
index 765c691c9555..6624dcc36528 100644
--- a/pkgs/applications/science/math/sage/default.nix
+++ b/pkgs/applications/science/math/sage/default.nix
@@ -15,7 +15,7 @@ let
     pkgs = pkgs.python3.pkgs.overrideScope (self: super: {
       # `sagelib`, i.e. all of sage except some wrappers and runtime dependencies
       sagelib = self.callPackage ./sagelib.nix {
-        inherit flint arb;
+        inherit flint3;
         inherit sage-src env-locations singular;
         inherit (maxima) lisp-compiler;
         linbox = pkgs.linbox.override { withSage = true; };
@@ -73,7 +73,7 @@ let
     sagelib = python3.pkgs.sagelib;
     sage-docbuild = python3.pkgs.sage-docbuild;
     inherit env-locations;
-    inherit python3 singular palp flint pythonEnv maxima;
+    inherit python3 singular palp flint3 pythonEnv maxima;
     pkg-config = pkgs.pkg-config; # not to confuse with pythonPackages.pkg-config
   };
 
@@ -125,9 +125,7 @@ let
     ignoreCollisions = true;
   } // { extraLibs = pythonRuntimeDeps; }; # make the libs accessible
 
-  arb = pkgs.arb.override { inherit flint; };
-
-  singular = pkgs.singular.override { inherit flint; };
+  singular = pkgs.singular.override { inherit flint3; };
 
   maxima = pkgs.maxima-ecl.override {
     lisp-compiler = pkgs.ecl.override {
@@ -149,7 +147,7 @@ let
   # openblas instead of openblasCompat. Apparently other packages somehow use flints
   # blas when it is available. Alternative would be to override flint to use
   # openblasCompat.
-  flint = pkgs.flint.override { withBlas = false; };
+  flint3 = pkgs.flint3.override { withBlas = false; };
 
   # Multiple palp dimensions need to be available and sage expects them all to be
   # in the same folder.
diff --git a/pkgs/applications/science/math/sage/env-locations.nix b/pkgs/applications/science/math/sage/env-locations.nix
index 39d358a1f9a8..1ca0f471a7ee 100644
--- a/pkgs/applications/science/math/sage/env-locations.nix
+++ b/pkgs/applications/science/math/sage/env-locations.nix
@@ -3,7 +3,6 @@
 , pari
 , singular
 , maxima
-, conway_polynomials
 , graphs
 , elliptic_curves
 , polytopes_db
@@ -27,16 +26,13 @@ writeTextFile rec {
     export GPDOCDIR="${pari}/share/pari/doc"
     export SINGULARPATH='${singular}/share/singular'
     export SINGULAR_SO='${singular}/lib/libSingular.so'
-    export GAP_SO='${gap}/lib/libgap.so'
     export SINGULAR_EXECUTABLE='${singular}/bin/Singular'
     export MAXIMA_FAS='${maxima}/lib/maxima/${maxima.version}/binary-ecl/maxima.fas'
     export MAXIMA_PREFIX="${maxima}"
-    export CONWAY_POLYNOMIALS_DATA_DIR='${conway_polynomials}/share/conway_polynomials'
     export GRAPHS_DATA_DIR='${graphs}/share/graphs'
     export ELLCURVE_DATA_DIR='${elliptic_curves}/share/ellcurves'
     export POLYTOPE_DATA_DIR='${polytopes_db}/share/reflexive_polytopes'
-    export GAP_LIB_DIR='${gap}/lib/gap'
-    export GAP_SHARE_DIR='${gap}/share/gap'
+    export GAP_ROOT_PATHS='${gap}/lib/gap;${gap}/share/gap'
     export ECLDIR='${maxima.lisp-compiler}/lib/${maxima.lisp-compiler.pname}-${maxima.lisp-compiler.version}/'
     export COMBINATORIAL_DESIGN_DATA_DIR="${combinatorial_designs}/share/combinatorial_designs"
     export CREMONA_MINI_DATA_DIR="${elliptic_curves}/share/cremona"
diff --git a/pkgs/applications/science/math/sage/python-modules/sage-docbuild.nix b/pkgs/applications/science/math/sage/python-modules/sage-docbuild.nix
index fb8c3ec8a204..b45998bbcb86 100644
--- a/pkgs/applications/science/math/sage/python-modules/sage-docbuild.nix
+++ b/pkgs/applications/science/math/sage/python-modules/sage-docbuild.nix
@@ -4,6 +4,7 @@
 , jupyter-sphinx
 , sphinx
 , sphinx-copybutton
+, sphinx-inline-tabs
 }:
 
 buildPythonPackage rec {
@@ -15,6 +16,7 @@ buildPythonPackage rec {
     jupyter-sphinx
     sphinx
     sphinx-copybutton
+    sphinx-inline-tabs
   ];
 
   preBuild = ''
diff --git a/pkgs/applications/science/math/sage/sage-env.nix b/pkgs/applications/science/math/sage/sage-env.nix
index 4c22470de910..4f179ea3a42b 100644
--- a/pkgs/applications/science/math/sage/sage-env.nix
+++ b/pkgs/applications/science/math/sage/sage-env.nix
@@ -42,7 +42,7 @@
 , flintqs
 , blas
 , lapack
-, flint
+, flint3
 , gmp
 , mpfr
 , zlib
@@ -155,7 +155,7 @@ writeTextFile rec {
     # cython needs to find these libraries, otherwise will fail with `ld: cannot find -lflint` or similar
     export LDFLAGS='${
       lib.concatStringsSep " " (map (pkg: "-L${pkg}/lib") [
-        flint
+        flint3
         gap
         glpk
         gmp
@@ -174,7 +174,7 @@ writeTextFile rec {
         singular
         gmp.dev
         glpk
-        flint
+        flint3
         gap
         mpfr.dev
       ])
diff --git a/pkgs/applications/science/math/sage/sage-src.nix b/pkgs/applications/science/math/sage/sage-src.nix
index a77565e4072a..11bcc9ee3d5a 100644
--- a/pkgs/applications/science/math/sage/sage-src.nix
+++ b/pkgs/applications/science/math/sage/sage-src.nix
@@ -10,14 +10,14 @@
 # all get the same sources with the same patches applied.
 
 stdenv.mkDerivation rec {
-  version = "10.2";
+  version = "10.3";
   pname = "sage-src";
 
   src = fetchFromGitHub {
     owner = "sagemath";
     repo = "sage";
     rev = version;
-    sha256 = "sha256-VXnPdJhtw5Y/anecrVpevJDCyBVfnjksyuuZslNipm4=";
+    hash = "sha256-OHtMv8t0RrP6R8XIREU+C1vpazeQLWa75wx9Mv6BN1U=";
   };
 
   # contains essential files (e.g., setup.cfg) generated by the bootstrap script.
@@ -25,8 +25,8 @@ stdenv.mkDerivation rec {
   configure-src = fetchurl {
     # the hash below is the tagged commit's _parent_. it can also be found by looking for
     # the "configure" asset at https://github.com/sagemath/sage/releases/tag/${version}
-    url = "mirror://sageupstream/configure/configure-b2813506039143e6f0abe859ab67a343abf72c2e.tar.gz";
-    sha256 = "sha256-a1v0XyoKI+zO6Sjm8DzEwItRHbIgRDbpj4UfwVH+/hw=";
+    url = "mirror://sageupstream/configure/configure-ab1a517b64b02bf15bbcb8d7c2d4d643bd5eff9b.tar.gz";
+    hash = "sha256-pe9AxTM+gFSR4/eVfUzay+4bwjoubbYeDPc+avKjlaw=";
   };
 
   # Patches needed because of particularities of nix or the way this is packaged.
@@ -62,11 +62,11 @@ stdenv.mkDerivation rec {
   # should come from or be proposed to upstream. This list will probably never
   # be empty since dependencies update all the time.
   packageUpgradePatches = [
-    # https://github.com/sagemath/sage/pull/37123, to land in 10.3.beta7
+    # https://github.com/sagemath/sage/pull/37492
     (fetchpatch {
-      name = "scipy-1.12-upgrade.patch";
-      url = "https://github.com/sagemath/sage/commit/54eec464e9fdf18b411d9148aecb918178e95909.diff";
-      sha256 = "sha256-9wyNrcSfF6mYFTIV4ev2OdD7igb0AeyZZYWSc/+JrIU=";
+      name = "singular-4.3.2p14-upgrade.patch";
+      url = "https://github.com/sagemath/sage/commit/a0c56816b051e97da44ac0a4e4d4f6915cf7fa0f.diff";
+      sha256 = "sha256-WGMmPeBoj2LUC+2qxWuaJL89QUuGt6axGvxWkpM9LYg=";
     })
   ];
 
diff --git a/pkgs/applications/science/math/sage/sagelib.nix b/pkgs/applications/science/math/sage/sagelib.nix
index 5a1f4ee473c9..b67b74e3a0f2 100644
--- a/pkgs/applications/science/math/sage/sagelib.nix
+++ b/pkgs/applications/science/math/sage/sagelib.nix
@@ -10,7 +10,6 @@
 , iml
 , libpng
 , readline
-, arb
 , blas
 , boost
 , brial
@@ -18,7 +17,7 @@
 , eclib
 , ecm
 , fflas-ffpack
-, flint
+, flint3
 , gap
 , giac
 , givaro
@@ -45,6 +44,7 @@
 , singular
 , sqlite
 , symmetrica
+, conway-polynomials
 , cvxopt
 , cypari2
 , cysignals
@@ -92,6 +92,7 @@ buildPythonPackage rec {
   version = src.version;
   pname = "sagelib";
   src = sage-src;
+  pyproject = true;
 
   nativeBuildInputs = [
     iml
@@ -112,7 +113,6 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     # native dependencies (TODO: determine which ones need to be propagated)
-    arb
     blas
     boost
     brial
@@ -120,7 +120,7 @@ buildPythonPackage rec {
     eclib
     ecm
     fflas-ffpack
-    flint
+    flint3
     gap
     giac
     givaro
@@ -149,6 +149,7 @@ buildPythonPackage rec {
     symmetrica
 
     # from src/sage/setup.cfg and requirements.txt
+    conway-polynomials
     cvxopt
     cypari2
     cysignals
@@ -202,11 +203,7 @@ buildPythonPackage rec {
     mkdir -p "$SAGE_SHARE/sage/ext/notebook-ipython"
     mkdir -p "var/lib/sage/installed"
 
-    # version lower bounds are useful, but upper bounds are a hassle because
-    # Sage tests already catch any relevant API breakage.
-    # according to the discussion at https://trac.sagemath.org/ticket/33520,
-    # upper bounds will be less noisy starting from Sage 9.6.
-    sed -i 's/, <[^, ]*//' build/pkgs/*/install-requires.txt
+    sed -i "/sage-conf/d" src/{setup.cfg,pyproject.toml,requirements.txt}
 
     cd build/pkgs/sagelib/src
   '';
diff --git a/pkgs/applications/science/math/singular/default.nix b/pkgs/applications/science/math/singular/default.nix
index f77bd5a92243..a6c64066d88e 100644
--- a/pkgs/applications/science/math/singular/default.nix
+++ b/pkgs/applications/science/math/singular/default.nix
@@ -5,7 +5,7 @@
 , sharutils
 , file
 , getconf
-, flint
+, flint3
 , ntl
 , cddlib
 , gfan
@@ -18,13 +18,13 @@
 # want it to match the upstream format because sage depends on it.
 , texinfo4
 , texliveSmall
-, enableDocs ? !stdenv.isDarwin
+, enableDocs ? true
 , enableGfanlib ? true
 }:
 
 stdenv.mkDerivation rec {
   pname = "singular";
-  version = "4.3.2p2";
+  version = "4.3.2p16";
 
   # since the tarball does not contain tests, we fetch from GitHub.
   src = fetchFromGitHub {
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
     # if a release is tagged (which sometimes does not happen), it will
     # be in the format below.
     rev = "Release-${lib.replaceStrings ["."] ["-"] version}";
-    sha256 = "sha256-dtZmN8xUCZ9eSgmtBxqfJeWsM4W5Baq7xWXuNAxNLjA=";
+    sha256 = "sha256-5JZgI5lnfX4JlBSEAL7Wv6uao/57GBaMqwgslJt9Bjk=";
 
     # the repository's .gitattributes file contains the lines "/Tst/
     # export-ignore" and "/doc/ export-ignore" so some directories are
@@ -68,7 +68,7 @@ stdenv.mkDerivation rec {
     ncurses
     readline
     ntl
-    flint
+    flint3
     lrcalc
     gfan
   ] ++ lib.optionals enableGfanlib [
diff --git a/pkgs/applications/version-management/commitizen/default.nix b/pkgs/applications/version-management/commitizen/default.nix
index 6d6774760fe7..537c1bfcd607 100644
--- a/pkgs/applications/version-management/commitizen/default.nix
+++ b/pkgs/applications/version-management/commitizen/default.nix
@@ -11,7 +11,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "commitizen";
-  version = "3.18.4";
+  version = "3.20.0";
   format = "pyproject";
 
   disabled = python3.pythonOlder "3.8";
@@ -20,7 +20,7 @@ python3.pkgs.buildPythonApplication rec {
     owner = "commitizen-tools";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-ODBlNwrvkYnZ+CvKyc5Bic6DK/z8d6/KR3+iarFxduE=";
+    hash = "sha256-lruEkXgbND2Q49J9mnDSqDA4kWiUBIg1mI+s1a+V3ds=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/applications/video/obs-studio/plugins/advanced-scene-switcher/default.nix b/pkgs/applications/video/obs-studio/plugins/advanced-scene-switcher/default.nix
index b776981522d0..ff4ba78ea950 100644
--- a/pkgs/applications/video/obs-studio/plugins/advanced-scene-switcher/default.nix
+++ b/pkgs/applications/video/obs-studio/plugins/advanced-scene-switcher/default.nix
@@ -23,13 +23,13 @@
 
 stdenv.mkDerivation rec {
   pname = "advanced-scene-switcher";
-  version = "1.24.2";
+  version = "1.25.3";
 
   src = fetchFromGitHub {
     owner = "WarmUpTill";
     repo = "SceneSwitcher";
     rev = version;
-    hash = "sha256-J5Qcs2eoKMeO1O/MCsR5wfmfbtndRaZmHrbleEZqqOo=";
+    hash = "sha256-cVMeFAliP0srvnhJQkOhZB2hrald8RHFhBXwdGIu2uo=";
   };
 
   nativeBuildInputs = [
@@ -61,11 +61,7 @@ stdenv.mkDerivation rec {
     chmod -R +w $sourceRoot/deps/libremidi
   '';
 
-  postInstall = ''
-    mkdir $out/lib $out/share
-    mv $out/obs-plugins/64bit $out/lib/obs-plugins
-    mv $out/data $out/share/obs
-  '';
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=stringop-overflow";
 
   meta = with lib; {
     description = "An automated scene switcher for OBS Studio";
diff --git a/pkgs/applications/virtualization/rvvm/default.nix b/pkgs/applications/virtualization/rvvm/default.nix
index b6eaea8d7597..718446d1ce1f 100644
--- a/pkgs/applications/virtualization/rvvm/default.nix
+++ b/pkgs/applications/virtualization/rvvm/default.nix
@@ -1,21 +1,45 @@
-{ lib, stdenv, fetchFromGitHub, SDL_compat, libX11, libXext }:
+{ lib
+, stdenv
+, fetchFromGitHub
+
+, SDL2
+
+, libX11
+, libXext
+
+, guiBackend ? "sdl"
+
+, enableSDL ? guiBackend == "sdl"
+, enableX11 ? guiBackend == "x11"
+}:
+
+assert lib.assertMsg (builtins.elem guiBackend ["sdl" "x11" "none"]) "Unsupported GUI backend";
+assert lib.assertMsg (!(enableSDL && enableX11)) "RVVM can have only one GUI backend at a time";
+assert lib.assertMsg (stdenv.isDarwin -> !enableX11) "macOS supports only SDL GUI backend";
 
 stdenv.mkDerivation rec {
   pname = "rvvm";
-  version = "0.5";
+  version = "0.6";
 
   src = fetchFromGitHub {
     owner = "LekKit";
     repo = "RVVM";
     rev = "v${version}";
-    sha256 = "sha256-1wAKijRYB0FGBe4cSHUynkO4ePVG4QvVIgSoWzNbqtE=";
+    sha256 = "sha256-5nSlKyWDAx0EeKFzzwP5+99XuJz9BHXEF1WNkRMLa9U=";
   };
 
-  buildInputs = if stdenv.isDarwin then [ SDL_compat ] else [ libX11 libXext ];
+  buildInputs = []
+    ++ lib.optionals enableSDL [ SDL2 ]
+    ++ lib.optionals enableX11 [ libX11 libXext ];
+
+  enableParallelBuilding = true;
 
   buildFlags = [ "all" "lib" ];
 
   makeFlags = [ "PREFIX=$(out)" ]
+    ++ lib.optional enableSDL "USE_SDL=2" # Use SDL2 instead of SDL1
+    ++ lib.optional (!enableSDL && !enableX11) "USE_FB=0"
+
     # work around https://github.com/NixOS/nixpkgs/issues/19098
     ++ lib.optional (stdenv.cc.isClang && stdenv.isDarwin) "CFLAGS=-fno-lto";
 
@@ -24,7 +48,7 @@ stdenv.mkDerivation rec {
     description = "The RISC-V Virtual Machine";
     license = with licenses; [ gpl3 /* or */ mpl20 ];
     platforms = platforms.linux ++ platforms.darwin;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ kamillaova ];
     mainProgram = "rvvm";
   };
 }
diff --git a/pkgs/tools/networking/godns/default.nix b/pkgs/by-name/go/godns/package.nix
index a41d1993270b..0e5e155523d6 100644
--- a/pkgs/tools/networking/godns/default.nix
+++ b/pkgs/by-name/go/godns/package.nix
@@ -1,25 +1,50 @@
 { lib
 , buildGoModule
 , fetchFromGitHub
+, nodejs
+, npmHooks
+, fetchNpmDeps
 , nix-update-script
 }:
 
 buildGoModule rec {
   pname = "godns";
-  version = "3.0.7";
+  version = "3.1.5";
 
   src = fetchFromGitHub {
     owner = "TimothyYe";
     repo = "godns";
     rev = "refs/tags/v${version}";
-    hash = "sha256-7zgvrEVt8xg54NijcqnXoZcXetzOu9h3Ucw7w03YagU=";
+    hash = "sha256-kdClyeU0hR0ymVLn9xe/kYVJE/9P/hAz/5UwRAQ2KCU=";
   };
 
-  vendorHash = "sha256-veDrGB6gjUa8G/UyKzEgH2ItGGEPlXDePahq2XP2nAo=";
+  vendorHash = "sha256-kSREFNIGH0MXiyKMp1LmrLkhKBhovvNRz46LTXT2XME=";
+  npmDeps = fetchNpmDeps {
+    src = "${src}/web";
+    hash = "sha256-2yeqLly0guU/kpX+yH/QOoDGzyJTxkTaCt8EleJhybU=";
+  };
+
+  npmRoot = "web";
+  nativeBuildInputs = [
+    nodejs
+    npmHooks.npmConfigHook
+  ];
+
+  overrideModAttrs = oldAttrs: {
+    # Do not add `npmConfigHook` to `goModules`
+    nativeBuildInputs = lib.remove npmHooks.npmConfigHook oldAttrs.nativeBuildInputs;
+    # Do not run `preBuild` when building `goModules`
+    preBuild = null;
+  };
 
   # Some tests require internet access, broken in sandbox
   doCheck = false;
 
+  preBuild = ''
+    npm --prefix="$npmRoot" run build
+    go generate ./...
+  '';
+
   ldflags = [
     "-s"
     "-w"
diff --git a/pkgs/by-name/ma/maloader/package.nix b/pkgs/by-name/ma/maloader/package.nix
new file mode 100644
index 000000000000..bb0f744f37b6
--- /dev/null
+++ b/pkgs/by-name/ma/maloader/package.nix
@@ -0,0 +1,63 @@
+{
+  lib,
+  llvmPackages,
+  fetchFromGitHub,
+  opencflite,
+  libuuid,
+  zlib,
+}:
+
+let
+  stdenv = llvmPackages.libcxxStdenv;
+in
+stdenv.mkDerivation {
+  pname = "maloader";
+  version = "0-unstable-2018-05-02";
+
+  src = fetchFromGitHub {
+    owner = "shinh";
+    repo = "maloader";
+    rev = "464a90fdfd06a54c9da5d1a3725ed6229c0d3d60";
+    hash = "sha256-0N3+tr8XUsn3WhJNsPVknumBrfMgDawTEXVRkIs/IV8=";
+  };
+
+  postPatch = ''
+    substituteInPlace ld-mac.cc \
+      --replace-fail 'loadLibMac(mypath)' 'loadLibMac("${placeholder "out"}/lib/")' \
+      --replace-fail 'libCoreFoundation.so' '${opencflite}/lib/libCoreFoundation.so'
+    substituteInPlace libmac/stack_protector-obsd.c \
+      --replace-fail 'sys/sysctl.h' 'linux/sysctl.h'
+  '';
+
+  buildInputs = [
+    libuuid
+    zlib
+  ];
+
+  buildFlags = [
+    "USE_LIBCXX=1"
+    "release"
+  ];
+
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=unused-command-line-argument";
+
+  installPhase = ''
+    runHook preInstall
+
+    install -vD libmac.so "$out/lib/libmac.so"
+
+    for bin in extract macho2elf ld-mac; do
+      install -vD "$bin" "$out/bin/$bin"
+    done
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Mach-O loader for Linux";
+    homepage = "https://github.com/shinh/maloader";
+    license = lib.licenses.bsd2;
+    maintainers = with lib.maintainers; [ wegank ];
+    inherit (opencflite.meta) platforms;
+  };
+}
diff --git a/pkgs/by-name/op/opencflite/package.nix b/pkgs/by-name/op/opencflite/package.nix
new file mode 100644
index 000000000000..0da9e52e81d6
--- /dev/null
+++ b/pkgs/by-name/op/opencflite/package.nix
@@ -0,0 +1,43 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  pkg-config,
+  icu,
+  libkqueue,
+  libuuid,
+  tzdata,
+  zlib,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "opencflite";
+  version = "635.21.8";
+
+  src = fetchFromGitHub {
+    owner = "gerickson";
+    repo = "opencflite";
+    rev = "opencflite-${version}";
+    hash = "sha256-ijyj4SFYQ0wZAFM2ehNnR9+yu5yDTSVW3VBycBT9l+A=";
+  };
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    icu
+    libkqueue
+    libuuid
+    tzdata
+    zlib
+  ];
+
+  enableParallelBuilding = true;
+
+  meta = {
+    description = "Cross platform port of the macOS CoreFoundation";
+    homepage = "https://github.com/gerickson/opencflite";
+    license = lib.licenses.apsl20;
+    maintainers = with lib.maintainers; [ wegank ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
diff --git a/pkgs/by-name/re/renode-dts2repl/package.nix b/pkgs/by-name/re/renode-dts2repl/package.nix
index 24736a889e51..8f277a02e220 100644
--- a/pkgs/by-name/re/renode-dts2repl/package.nix
+++ b/pkgs/by-name/re/renode-dts2repl/package.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication {
   pname = "renode-dts2repl";
-  version = "unstable-2024-03-12";
+  version = "unstable-2024-03-19";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "antmicro";
     repo = "dts2repl";
-    rev = "eff98d616e3541e54ca783c84f598c9e348a76a8";
-    hash = "sha256-qNHj5WOSca04ceGeRNa60M6cH9/rRHLEF1YX75yYDO8=";
+    rev = "dc4160a3a4c23aee846625ac9115fe2cbb91fe42";
+    hash = "sha256-cy4XLKKiWqEvWWDHmj2bhp38pbtSxp+P92r7NxueAaE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/re/renode/package.nix b/pkgs/by-name/re/renode/package.nix
index 33646daac8c5..7ea55e0fff98 100644
--- a/pkgs/by-name/re/renode/package.nix
+++ b/pkgs/by-name/re/renode/package.nix
@@ -23,11 +23,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "renode";
-  version = "1.14.0";
+  version = "1.15.0";
 
   src = fetchurl {
-    url = "https://builds.renode.io/renode-${finalAttrs.version}.linux-portable.tar.gz";
-    hash = "sha256-1wfVHtCYc99ACz8m2XEg1R0nIDh9xP4ffV/vxeeEHxE=";
+    url = "https://github.com/renode/renode/releases/download/v${finalAttrs.version}/renode-${finalAttrs.version}.linux-portable.tar.gz";
+    hash = "sha256-w3HKYctW1LmiAse/27Y1Gmz9hDprQ1CK7+TXIexCrkg=";
   };
 
   nativeBuildInputs = [
@@ -95,7 +95,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Virtual development framework for complex embedded systems";
-    homepage = "https://renode.org";
+    homepage = "https://renode.io";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ otavio ];
     platforms = [ "x86_64-linux" ];
diff --git a/pkgs/by-name/rs/rs-tftpd/package.nix b/pkgs/by-name/rs/rs-tftpd/package.nix
new file mode 100644
index 000000000000..43b010913ea8
--- /dev/null
+++ b/pkgs/by-name/rs/rs-tftpd/package.nix
@@ -0,0 +1,26 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "rs-tftpd";
+  version = "0.2.12";
+
+  src = fetchFromGitHub {
+    owner = "altugbakan";
+    repo = "rs-tftpd";
+    rev = version;
+    hash = "sha256-H67lXwX+4guHpdq0yTHe6tl1NxC41saNrM9g+yH5otk=";
+  };
+
+  cargoHash = "sha256-B5kduRuX9Lcdd31yj4PsDo8fyy0nabtmsiAXvc8RlYo=";
+
+  meta = with lib; {
+    description = "TFTP Server Daemon implemented in Rust";
+    homepage = "https://github.com/altugbakan/rs-tftpd";
+    license = licenses.mit;
+    maintainers = with maintainers; [ matthewcroughan ];
+    mainProgram = "tftpd";
+  };
+}
diff --git a/pkgs/by-name/sa/satty/package.nix b/pkgs/by-name/sa/satty/package.nix
index 67f69ab79cfb..31e860de8440 100644
--- a/pkgs/by-name/sa/satty/package.nix
+++ b/pkgs/by-name/sa/satty/package.nix
@@ -16,16 +16,16 @@
 rustPlatform.buildRustPackage rec {
 
   pname = "satty";
-  version = "0.11.2";
+  version = "0.11.3";
 
   src = fetchFromGitHub {
     owner = "gabm";
     repo = "Satty";
     rev = "v${version}";
-    hash = "sha256-bUDKRAp3/ByxWRzpoD0qGInxQuEfVIeYJ/pCcAEfH14=";
+    hash = "sha256-TKpotVVjXWm2uue4a4QEqVH/qHKSsegL2MNcsnk0CHw=";
   };
 
-  cargoHash = "sha256-aH08BJK4uOEUrpoMfVGwGnuzncHHW6w6jjxnk4Xz5zo=";
+  cargoHash = "sha256-0AyzjKkTNZwGCT73Xo5AY7rPJwQ9GgAxtMf6lJnrTSA=";
 
   nativeBuildInputs = [
     copyDesktopItems
diff --git a/pkgs/servers/slimserver/default.nix b/pkgs/by-name/sl/slimserver/package.nix
index 1703c03dee26..94b13c99e9dc 100644
--- a/pkgs/servers/slimserver/default.nix
+++ b/pkgs/by-name/sl/slimserver/package.nix
@@ -6,7 +6,7 @@
 , makeWrapper
 , monkeysAudio
 , nixosTests
-, perl538Packages
+, perlPackages
 , sox
 , stdenv
 , wavpack
@@ -15,20 +15,18 @@
 }:
 
 let
-  perlPackages = perl538Packages;
-
   binPath = lib.makeBinPath ([ lame flac faad2 sox wavpack ] ++ (lib.optional stdenv.isLinux monkeysAudio));
   libPath = lib.makeLibraryPath [ zlib stdenv.cc.cc.lib ];
 in
 perlPackages.buildPerlPackage rec {
   pname = "slimserver";
-  version = "8.4.0";
+  version = "8.5.0";
 
   src = fetchFromGitHub {
-    owner = "Logitech";
+    owner = "LMS-Community";
     repo = "slimserver";
     rev = version;
-    hash = "sha256-92mKchgAWRIrNOeK/zXUYRqIAk6THdtz1zQe3fg2kE0=";
+    hash = "sha256-yDJVqZ0+qVm4r/wmQK/hf9uRJaN56WQMO28RE59mNNI=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
@@ -58,7 +56,7 @@ perlPackages.buildPerlPackage rec {
     DataURIEncode
     DBDSQLite
     DBI
-    # DBIxClass # https://github.com/Logitech/slimserver/issues/138
+    # DBIxClass # https://github.com/LMS-Community/slimserver/issues/138
     DigestSHA1
     EncodeDetect
     EV
@@ -144,16 +142,20 @@ perlPackages.buildPerlPackage rec {
 
   outputs = [ "out" ];
 
-  passthru.tests = {
-    inherit (nixosTests) slimserver;
+  passthru = {
+    tests = {
+      inherit (nixosTests) slimserver;
+    };
+
+    updateScript = ./update.nu;
   };
 
   meta = with lib; {
-    homepage = "https://github.com/Logitech/slimserver";
-    changelog = "https://github.com/Logitech/slimserver/blob/${version}/Changelog${lib.versions.major version}.html";
+    homepage = "https://github.com/LMS-Community/slimserver";
+    changelog = "https://github.com/LMS-Community/slimserver/blob/${version}/Changelog${lib.versions.major version}.html";
     description = "Server for Logitech Squeezebox players. This server is also called Logitech Media Server";
     # the firmware is not under a free license, so we do not include firmware in the default package
-    # https://github.com/Logitech/slimserver/blob/public/8.3/License.txt
+    # https://github.com/LMS-Community/slimserver/blob/public/8.3/License.txt
     license = if enableUnfreeFirmware then licenses.unfree else licenses.gpl2Only;
     mainProgram = "slimserver";
     maintainers = with maintainers; [ adamcstephens jecaro ];
diff --git a/pkgs/by-name/sl/slimserver/update.nu b/pkgs/by-name/sl/slimserver/update.nu
new file mode 100755
index 000000000000..556ed236bb68
--- /dev/null
+++ b/pkgs/by-name/sl/slimserver/update.nu
@@ -0,0 +1,14 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i nu -p nushell common-updater-scripts
+
+# get latest tag, but drop versions 10.0 tags since they are 10+ years old
+let latest_tag = list-git-tags --url=https://github.com/LMS-Community/slimserver | lines | find --invert 10.0 | sort --natural | last
+
+let current_version = nix eval --raw -f default.nix slimserver | str trim
+
+if $latest_tag != $current_version {
+  update-source-version slimserver $latest_tag $"--file=(pwd)/pkgs/by-name/sl/slimserver/package.nix"
+  {before: $current_version, after: $latest_tag}
+} else {
+  "No new version"
+}
diff --git a/pkgs/tools/typesetting/soupault/default.nix b/pkgs/by-name/so/soupault/package.nix
index 82ea1e6f5979..639af4136729 100644
--- a/pkgs/tools/typesetting/soupault/default.nix
+++ b/pkgs/by-name/so/soupault/package.nix
@@ -1,5 +1,5 @@
 { lib
-, fetchFromGitea
+, fetchzip
 , ocamlPackages
 , soupault
 , testers
@@ -8,19 +8,19 @@
 let
   pname = "soupault";
 
-  version = "4.8.0";
+  version = "4.9.0";
 in
 ocamlPackages.buildDunePackage {
   inherit pname version;
 
   minimalOCamlVersion = "4.13";
 
-  src = fetchFromGitea {
-    domain = "codeberg.org";
-    owner = "PataphysicalSociety";
-    repo = pname;
-    rev = version;
-    hash = "sha256-/QpT0zgrfMgRKjHyLHugaAlICpPkqaQ7f8fFAL0P02Y=";
+  src = fetchzip {
+    urls = [
+      "https://github.com/PataphysicalSociety/soupault/archive/${version}.tar.gz"
+      "https://codeberg.org/PataphysicalSociety/soupault/archive/${version}.tar.gz"
+    ];
+    hash = "sha256-vGTJUbAeYs/EYFykNSmCc4c9G66/Lz3BsUYnZQ8feFo=";
   };
 
   buildInputs = with ocamlPackages; [
diff --git a/pkgs/by-name/st/strictdoc/package.nix b/pkgs/by-name/st/strictdoc/package.nix
new file mode 100644
index 000000000000..18bc6db8c215
--- /dev/null
+++ b/pkgs/by-name/st/strictdoc/package.nix
@@ -0,0 +1,76 @@
+{ lib
+, python3
+, fetchFromGitHub
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "strictdoc";
+  version = "0.0.49";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "strictdoc-project";
+    repo = "strictdoc";
+    rev = version;
+    hash = "sha256-WtDplupXBtq39oKyo31p5NgXMWtbWgxtpnKn4qCJz3I=";
+  };
+
+  nativeBuildInputs = [
+    python3.pkgs.hatchling
+    python3.pkgs.pythonRelaxDepsHook
+  ];
+
+  propagatedBuildInputs = with python3.pkgs; [
+    beautifulsoup4
+    docutils
+    fastapi
+    graphviz
+    html5lib
+    jinja2
+    lxml
+    pybtex
+    pygments
+    datauri
+    python-multipart
+    selenium
+    requests
+    spdx-tools
+    webdriver-manager
+    reqif
+    setuptools
+    textx
+    toml
+    uvicorn
+    websockets
+    xlrd
+    xlsxwriter
+  ];
+
+  passthru.optional-dependencies = with python3.pkgs; {
+    development = [
+      invoke
+      tox
+    ];
+    nuitka = [
+      nuitka
+      ordered-set
+    ];
+  };
+
+  pythonRelaxDeps = [
+    "python-datauri"
+    "xlsxwriter"
+    "lxml"
+  ];
+
+  pythonImportsCheck = [ "strictdoc" ];
+
+  meta = with lib; {
+    description = "Software for technical documentation and requirements management";
+    homepage = "https://github.com/strictdoc-project/strictdoc";
+    changelog = "https://github.com/strictdoc-project/strictdoc/blob/${src.rev}/CHANGELOG.md";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ yuu ];
+    mainProgram = "strictdoc";
+  };
+}
diff --git a/pkgs/by-name/up/upiano/package.nix b/pkgs/by-name/up/upiano/package.nix
index d13ff18bd425..351e80f0b6d0 100644
--- a/pkgs/by-name/up/upiano/package.nix
+++ b/pkgs/by-name/up/upiano/package.nix
@@ -6,19 +6,24 @@
 python3.pkgs.buildPythonApplication rec {
   pname = "upiano";
   version = "0.1.2";
-  format = "pyproject";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "eliasdorneles";
     repo = "upiano";
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
     hash = "sha256-5WhflvUCjzW4ZJ+PLUTMbKcUnQa3ChkDjl0R5YvjBWk=";
     forceFetchGit = true;
     fetchLFS = true;
   };
 
-  nativeBuildInputs = [
-    python3.pkgs.poetry-core
+  pythonRelaxDeps = [
+    "textual"
+  ];
+
+  nativeBuildInputs = with python3.pkgs; [
+    poetry-core
+    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
@@ -26,7 +31,9 @@ python3.pkgs.buildPythonApplication rec {
     textual
   ];
 
-  pythonImportsCheck = [ "upiano" ];
+  pythonImportsCheck = [
+    "upiano"
+  ];
 
   meta = with lib; {
     description = "A Piano in your terminal";
diff --git a/pkgs/by-name/ux/uxn/package.nix b/pkgs/by-name/ux/uxn/package.nix
index 0569d11fa1f2..2ce14ff19f80 100644
--- a/pkgs/by-name/ux/uxn/package.nix
+++ b/pkgs/by-name/ux/uxn/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "uxn";
-  version = "unstable-2024-03-16";
+  version = "unstable-2024-03-18";
 
   src = fetchFromSourcehut {
     owner = "~rabbits";
     repo = "uxn";
-    rev = "5d3cf8b61457fea833d3e232297b378ba54c8350";
-    hash = "sha256-PXXsMKAPRUs4/Y4s/NBorcJmv7RtNK7UlRgmyowrm3A=";
+    rev = "250aecc920a6f12d2d5479a5230a31630dac2a1e";
+    hash = "sha256-nhKlcuhXkrhecRwVIuSf+jOmFbX0NMhmmc5pj6MCNdQ=";
   };
 
   outputs = [ "out" "projects" ];
diff --git a/pkgs/data/misc/conway_polynomials/default.nix b/pkgs/data/misc/conway_polynomials/default.nix
deleted file mode 100644
index caf470c51152..000000000000
--- a/pkgs/data/misc/conway_polynomials/default.nix
+++ /dev/null
@@ -1,41 +0,0 @@
-{ lib, stdenv
-, fetchurl
-, python3
-}:
-
-stdenv.mkDerivation rec {
-  pname = "conway_polynomials";
-  version = "0.5";
-
-  src = fetchurl {
-    url = "mirror://sageupstream/conway_polynomials/conway_polynomials-${version}.tar.bz2";
-    sha256 = "05zb1ly9x2bbscqv0jgc45g48xx77mfs7qdbqhn4ihmihn57iwnq";
-  };
-
-  # Script that creates the "database" (nested python array) and pickles it
-  spkg-install = fetchurl {
-    url = "https://raw.githubusercontent.com/sagemath/sage/9.2/build/pkgs/conway_polynomials/spkg-install.py";
-    sha256 = "1bwnqasnyv793hxg29viing4dnliz29grkhldsirq19d509yk1fs";
-  };
-
-  installPhase = ''
-    # directory layout as spkg-install.py expects
-    dir="$PWD"
-    cd ..
-    ln -s "$dir" "src"
-
-    # environment spkg-install.py expects
-    mkdir -p "$out/share"
-    export SAGE_SHARE="$out/share"
-    export PYTHONPATH=$PWD
-
-    ${python3.interpreter} ${spkg-install}
-  '';
-
-  meta = with lib; {
-    description = "Contains a small database of Conway polynomials";
-    license = licenses.gpl2;
-    platforms = platforms.all;
-    maintainers = teams.sage.members;
-  };
-}
diff --git a/pkgs/development/interpreters/wasmer/default.nix b/pkgs/development/interpreters/wasmer/default.nix
index e69e04f06df3..a509107ec163 100644
--- a/pkgs/development/interpreters/wasmer/default.nix
+++ b/pkgs/development/interpreters/wasmer/default.nix
@@ -14,16 +14,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "wasmer";
-  version = "4.2.6";
+  version = "4.2.7";
 
   src = fetchFromGitHub {
     owner = "wasmerio";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-FSplJAVdy/b0HXvW1qny052I7Fm9EA83/XqmgEvneeg=";
+    hash = "sha256-jyA1DUouODq9giAWeGOw7VMGwA+FbyqpEU77jtCb5v4=";
   };
 
-  cargoHash = "sha256-OYHPudXGsDLVx6XKTsJTxqG5cbOAD25sd5KJDyU9lvY=";
+  cargoHash = "sha256-EpHM8YaT2Ty9IBX/gXEa9n8006A9Y5/fq/ueODxHlnc=";
 
   nativeBuildInputs = [
     rustPlatform.bindgenHook
diff --git a/pkgs/development/libraries/fflas-ffpack/default.nix b/pkgs/development/libraries/fflas-ffpack/default.nix
index 66ea25a4b11b..25bab6645e07 100644
--- a/pkgs/development/libraries/fflas-ffpack/default.nix
+++ b/pkgs/development/libraries/fflas-ffpack/default.nix
@@ -31,6 +31,7 @@ stdenv.mkDerivation rec {
   configureFlags = [
     "--with-blas-libs=-lcblas"
     "--with-lapack-libs=-llapacke"
+    "--without-archnative"
   ] ++ lib.optionals stdenv.isx86_64 [
     # disable SIMD instructions (which are enabled *when available* by default)
     # for now we need to be careful to disable *all* relevant versions of an instruction set explicitly (https://github.com/linbox-team/fflas-ffpack/issues/284)
diff --git a/pkgs/development/libraries/flint/3.nix b/pkgs/development/libraries/flint/3.nix
index 3be7fdc63904..b8b8c2d8ec7d 100644
--- a/pkgs/development/libraries/flint/3.nix
+++ b/pkgs/development/libraries/flint/3.nix
@@ -24,16 +24,19 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-ezEaAFA6hjiB64F32+uEMi8pOZ89fXLzsaTJuh1XlLQ=";
   };
 
-  propagatedBuildInputs = [
+  nativeBuildInputs = [
     autoconf
     automake
     gettext
     libtool
   ];
 
+  propagatedBuildInputs = [
+    mpfr
+  ];
+
   buildInputs = [
     gmp
-    mpfr
   ] ++ lib.optionals withBlas [
     openblas
   ] ++ lib.optionals withNtl [
diff --git a/pkgs/development/libraries/givaro/default.nix b/pkgs/development/libraries/givaro/default.nix
index 5df1413287d9..a7b1eaa43831 100644
--- a/pkgs/development/libraries/givaro/default.nix
+++ b/pkgs/development/libraries/givaro/default.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
   propagatedBuildInputs = [ gmpxx ];
 
   configureFlags = [
-    "--disable-optimization"
+    "--without-archnative"
   ] ++ lib.optionals stdenv.isx86_64 [
     # disable SIMD instructions (which are enabled *when available* by default)
     "--${if stdenv.hostPlatform.sse3Support   then "enable" else "disable"}-sse3"
diff --git a/pkgs/development/libraries/linbox/default.nix b/pkgs/development/libraries/linbox/default.nix
index f7e6d0f13b1b..0997513f5a51 100644
--- a/pkgs/development/libraries/linbox/default.nix
+++ b/pkgs/development/libraries/linbox/default.nix
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
 
   configureFlags = [
     "--with-blas-libs=-lblas"
-    "--disable-optimization"
+    "--without-archnative"
   ] ++ lib.optionals stdenv.isx86_64 [
     # disable SIMD instructions (which are enabled *when available* by default)
     "--${if stdenv.hostPlatform.sse3Support   then "enable" else "disable"}-sse3"
diff --git a/pkgs/development/lua-modules/generated-packages.nix b/pkgs/development/lua-modules/generated-packages.nix
index 785de9eafe44..f63a2acd23dc 100644
--- a/pkgs/development/lua-modules/generated-packages.nix
+++ b/pkgs/development/lua-modules/generated-packages.nix
@@ -2726,6 +2726,30 @@ buildLuarocksPackage {
   };
 }) {};
 
+mimetypes = callPackage({ buildLuarocksPackage, fetchurl, lua, luaOlder }:
+buildLuarocksPackage {
+  pname = "mimetypes";
+  version = "1.0.0-3";
+  knownRockspec = (fetchurl {
+    url    = "mirror://luarocks/mimetypes-1.0.0-3.rockspec";
+    sha256 = "02f5x5pkz6fba71mp031arrgmddsyivn5fsa0pj3q3a7nxxpmnq9";
+  }).outPath;
+  src = fetchurl {
+    url    = "https://github.com/lunarmodules/lua-mimetypes/archive/v1.0.0/lua-mimetypes-1.0.0.tar.gz";
+    sha256 = "1rc5lnzvw4cg8wxn4w4sar2xgf5vaivdd2hgpxxcqfzzcmblg1zk";
+  };
+
+  disabled = (luaOlder "5.1");
+  propagatedBuildInputs = [ lua ];
+
+  meta = {
+    homepage = "https://github/lunarmodules/lua-mimetypes/";
+    description = "A simple library for looking up the MIME types of files.";
+    license.fullName = "MIT/X11";
+  };
+}) {};
+
+
 moonscript = callPackage({ argparse, buildLuarocksPackage, fetchgit, lpeg, lua, luaOlder, luafilesystem }:
 buildLuarocksPackage {
   pname = "moonscript";
diff --git a/pkgs/development/python-modules/asyncpg/default.nix b/pkgs/development/python-modules/asyncpg/default.nix
index 88591af61bbd..dce3a9ba0642 100644
--- a/pkgs/development/python-modules/asyncpg/default.nix
+++ b/pkgs/development/python-modules/asyncpg/default.nix
@@ -1,6 +1,7 @@
 { lib
 , fetchPypi
 , buildPythonPackage
+, async-timeout
 , uvloop
 , postgresql
 , pythonOlder
@@ -13,7 +14,7 @@ buildPythonPackage rec {
   version = "0.29.0";
   format = "setuptools";
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
@@ -23,6 +24,12 @@ buildPythonPackage rec {
   # sandboxing issues on aarch64-darwin, see https://github.com/NixOS/nixpkgs/issues/198495
   doCheck = postgresql.doCheck;
 
+  # required for compatibility with Python versions older than 3.11
+  # see https://github.com/MagicStack/asyncpg/blob/v0.29.0/asyncpg/_asyncio_compat.py#L13
+  propagatedBuildInputs = lib.optionals (pythonOlder "3.11") [
+    async-timeout
+  ];
+
   nativeCheckInputs = [
     uvloop
     postgresql
diff --git a/pkgs/development/python-modules/conway-polynomials/default.nix b/pkgs/development/python-modules/conway-polynomials/default.nix
new file mode 100644
index 000000000000..d5b57a10aa39
--- /dev/null
+++ b/pkgs/development/python-modules/conway-polynomials/default.nix
@@ -0,0 +1,23 @@
+{ lib
+, fetchPypi
+, buildPythonPackage
+}:
+
+buildPythonPackage rec {
+  pname = "conway-polynomials";
+  version = "0.9";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-btIwBgm8558BddW4VGhY7sAoVPi+MjfbjRRJzMzBxYE=";
+  };
+
+  pythonImportsCheck = [ "conway_polynomials" ];
+
+  meta = with lib; {
+    description = "Python interface to Frank Lübeck's Conway polynomial database";
+    homepage = "https://github.com/sagemath/conway-polynomials";
+    maintainers = teams.sage.members;
+    license = licenses.gpl3Plus;
+  };
+}
diff --git a/pkgs/development/python-modules/marimo/default.nix b/pkgs/development/python-modules/marimo/default.nix
new file mode 100644
index 000000000000..d02f85896200
--- /dev/null
+++ b/pkgs/development/python-modules/marimo/default.nix
@@ -0,0 +1,65 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pythonOlder
+, setuptools
+, click
+, jedi
+, markdown
+, pymdown-extensions
+, pygments
+, tomlkit
+, uvicorn
+, starlette
+, websockets
+, docutils
+, black
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "marimo";
+  version = "0.3.3";
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-l5QehU/LqEWb7ybKxace4sm6C9mcNlaHNOp55ExglpQ=";
+  };
+
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
+    click
+    jedi
+    markdown
+    pymdown-extensions
+    pygments
+    tomlkit
+    uvicorn
+    starlette
+    websockets
+    docutils
+    black
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "marimo"
+  ];
+
+  meta = with lib; {
+    description = "A reactive Python notebook that's reproducible, git-friendly, and deployable as scripts or apps";
+    homepage = "https://github.com/marimo-team/marimo";
+    license = licenses.asl20;
+    mainProgram = "marimo";
+    maintainers = with maintainers; [ akshayka dmadisetti ];
+  };
+}
diff --git a/pkgs/development/python-modules/ollama/default.nix b/pkgs/development/python-modules/ollama/default.nix
new file mode 100644
index 000000000000..5e46474e1129
--- /dev/null
+++ b/pkgs/development/python-modules/ollama/default.nix
@@ -0,0 +1,64 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, httpx
+, pillow
+, poetry-core
+, pytest-asyncio
+, pytest-httpserver
+, pytestCheckHook
+, pythonOlder
+, pythonRelaxDepsHook
+}:
+
+buildPythonPackage rec {
+  pname = "ollama";
+  version = "0.1.7";
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";
+
+  src = fetchFromGitHub {
+    owner = "ollama";
+    repo = "ollama-python";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-xNH9kAjSdVXrCI7zkyR7tYxJ/NG8/08ykkDZQJI8Za4=";
+  };
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail "0.0.0" "${version}"
+  '';
+
+  pythonRelaxDeps = [
+    "httpx"
+  ];
+
+  nativeBuildInputs = [
+    poetry-core
+    pythonRelaxDepsHook
+  ];
+
+  propagatedBuildInputs = [
+    httpx
+  ];
+
+  nativeCheckInputs = [
+    pillow
+    pytest-asyncio
+    pytest-httpserver
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "ollama"
+  ];
+
+  meta = with lib; {
+    description = "Ollama Python library";
+    homepage = "https://github.com/ollama/ollama-python";
+    changelog = "https://github.com/ollama/ollama-python/releases/tag/v${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/py-tree-sitter/default.nix b/pkgs/development/python-modules/py-tree-sitter/default.nix
deleted file mode 100644
index 9358a0fbca88..000000000000
--- a/pkgs/development/python-modules/py-tree-sitter/default.nix
+++ /dev/null
@@ -1,34 +0,0 @@
-{ lib
-, stdenv
-, buildPythonPackage
-, fetchFromGitHub
-, setuptools
-}:
-
-buildPythonPackage rec {
-  pname = "py-tree-sitter";
-  version = "0.20.4";
-  format = "pyproject";
-
-  src = fetchFromGitHub {
-    owner = "tree-sitter";
-    repo = "py-tree-sitter";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-R97WcsHQMcuEOCg/QQ9YbGTRD30G9PRv0xAbxuoFyC4=";
-    fetchSubmodules = true;
-  };
-
-  nativeBuildInputs = [
-    setuptools
-  ];
-
-  pythonImportsCheck = [ "tree_sitter" ];
-
-  meta = with lib; {
-    homepage = "https://github.com/tree-sitter/py-tree-sitter";
-    description = "Python bindings for tree-sitter";
-    license = licenses.mit;
-    maintainers = with maintainers; [ siraben ];
-    platforms = platforms.unix;
-  };
-}
diff --git a/pkgs/development/python-modules/pyphotonfile/default.nix b/pkgs/development/python-modules/pyphotonfile/default.nix
index 9d7a30213869..c18d8c60d478 100644
--- a/pkgs/development/python-modules/pyphotonfile/default.nix
+++ b/pkgs/development/python-modules/pyphotonfile/default.nix
@@ -5,26 +5,28 @@
 , numpy
 }:
 let
-  version = "0.2.1";
-  format = "setuptools";
+  version = "0.2.1+";
 in
 buildPythonPackage {
   pname = "pyphotonfile";
+  format = "setuptools";
   inherit version;
+
+  dontUseSetuptoolsCheck = true;
   propagatedBuildInputs = [ pillow numpy ];
 
   src = fetchFromGitHub {
-    owner = "fookatchu";
+    owner = "cab404";
     repo = "pyphotonfile";
-    rev = "v${version}";
-    sha256 = "1hh1fcn7q3kyk2413pjs18xnxvzrchrisbpj2cd59jrdp0qzgv2s";
+    rev = "b7ee92a0071007bb1d6a5984262651beec26543d";
+    sha256 = "iB5ky4fPX8ZnvXlDpggqS/345k2x/mPC4cIgb9M0f/c=";
   };
 
   meta = with lib; {
     maintainers = [ maintainers.cab404 ];
     license = licenses.gpl3Plus;
     description = "Library for reading and writing files for the Anycubic Photon 3D-Printer";
-    homepage = "https://github.com/fookatchu/pyphotonfile";
+    homepage = "https://github.com/cab404/pyphotonfile";
   };
 
 }
diff --git a/pkgs/development/python-modules/sagemaker/default.nix b/pkgs/development/python-modules/sagemaker/default.nix
index 1d85fb9bed9f..4eaa44f0db38 100644
--- a/pkgs/development/python-modules/sagemaker/default.nix
+++ b/pkgs/development/python-modules/sagemaker/default.nix
@@ -26,7 +26,7 @@
 
 buildPythonPackage rec {
   pname = "sagemaker";
-  version = "2.212.0";
+  version = "2.213.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -35,7 +35,7 @@ buildPythonPackage rec {
     owner = "aws";
     repo = "sagemaker-python-sdk";
     rev = "refs/tags/v${version}";
-    hash = "sha256-JZX/k8AJSQrCrPAsDfEc78mAouBWFQlmRG0ZA1yBGJY=";
+    hash = "sha256-3V4boilVpqvwRBBuZv/AKEks+BH9PFnigfq6Z5kFhqQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/tesla-fleet-api/default.nix b/pkgs/development/python-modules/tesla-fleet-api/default.nix
index a9f70fdf92d9..e82fddf4c424 100644
--- a/pkgs/development/python-modules/tesla-fleet-api/default.nix
+++ b/pkgs/development/python-modules/tesla-fleet-api/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "tesla-fleet-api";
-  version = "0.4.9";
+  version = "0.5.0";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "Teslemetry";
     repo = "python-tesla-fleet-api";
     rev = "refs/tags/v${version}";
-    hash = "sha256-GiDhVN6aBj0yeIg596ox2ES28Dca81pVnsYWvc1SZ+A=";
+    hash = "sha256-IRUH3qWRJoCEvzkkR8/qH5i735B030CLKKRRWO9DVuI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/tree-sitter/default.nix b/pkgs/development/python-modules/tree-sitter/default.nix
index cd572618a2fd..039b9ce21cea 100644
--- a/pkgs/development/python-modules/tree-sitter/default.nix
+++ b/pkgs/development/python-modules/tree-sitter/default.nix
@@ -1,37 +1,52 @@
 { lib
 , buildPythonPackage
-, fetchPypi
+, fetchFromGitHub
+, fetchpatch
 , pytestCheckHook
 , pythonOlder
 , setuptools
-, wheel
 }:
 
 buildPythonPackage rec {
   pname = "tree-sitter";
-  version = "0.20.4";
-  format = "pyproject";
+  version = "0.21.1";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
-  src = fetchPypi {
-    pname = "tree_sitter";
-    inherit version;
-    hash = "sha256-atsSPi8+VjmbvyNZkkYzyILMQO6DRIhSALygki9xO+U=";
+  src = fetchFromGitHub {
+    owner = "tree-sitter";
+    repo = "py-tree-sitter";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-U4ZdU0lxjZO/y0q20bG5CLKipnfpaxzV3AFR6fGS7m4=";
+    fetchSubmodules = true;
   };
 
+  patches = [
+    #  Replace distutils with setuptools, https://github.com/tree-sitter/py-tree-sitter/pull/214
+    (fetchpatch {
+      name = "replace-distutils.patch";
+      url = "https://github.com/tree-sitter/py-tree-sitter/commit/80d3cae493c4a47e49cc1d2ebab0a8eaf7617825.patch";
+      hash = "sha256-00coI8/COpYMiSflAECwh6yJCMJj/ucFEn18Npj2g+Q=";
+    })
+  ];
+
   nativeBuildInputs = [
     setuptools
-    wheel
   ];
 
-  # PyPI tarball doesn't contains tests and source has additional requirements
-  doCheck = false;
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
 
   pythonImportsCheck = [
     "tree_sitter"
   ];
 
+  preCheck = ''
+    rm -r tree_sitter
+  '';
+
   meta = with lib; {
     description = "Python bindings to the Tree-sitter parsing library";
     homepage = "https://github.com/tree-sitter/py-tree-sitter";
diff --git a/pkgs/development/tools/build-managers/moon/default.nix b/pkgs/development/tools/build-managers/moon/default.nix
index 949b405b9923..b45d061fcabf 100644
--- a/pkgs/development/tools/build-managers/moon/default.nix
+++ b/pkgs/development/tools/build-managers/moon/default.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "moon";
-  version = "1.22.7";
+  version = "1.22.8";
 
   src = fetchFromGitHub {
     owner = "moonrepo";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-sMV7pr3uVWpmx1cK+qooxe55E2IAqdbcYs5H76Al56c=";
+    hash = "sha256-hKVC9xnzlucsja57O9p2ZAbE4YVrroKlQ0WMTWOumbE=";
   };
 
-  cargoHash = "sha256-RsT0P7fNsKchQ3N71DNhdR0jViQJe/pyWKtj/A+nDhk=";
+  cargoHash = "sha256-22nov28oq3KhILiwQUXaknTzcf8MlrAEHiyv31ivvBc=";
 
   env = {
     RUSTFLAGS = "-C strip=symbols";
diff --git a/pkgs/development/tools/konstraint/default.nix b/pkgs/development/tools/konstraint/default.nix
index 8d6b4e6ac8de..f015e08453d6 100644
--- a/pkgs/development/tools/konstraint/default.nix
+++ b/pkgs/development/tools/konstraint/default.nix
@@ -2,15 +2,15 @@
 
 buildGoModule rec {
   pname = "konstraint";
-  version = "0.33.0";
+  version = "0.35.0";
 
   src = fetchFromGitHub {
     owner = "plexsystems";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-rZDLnr3FNLNOadmST70p5ZusK+p9SiUmVrnc5TrKuK4=";
+    sha256 = "sha256-6MYpZm5Uc5l06wRo6/15bmyVkdqjFuxHV3B3TriauQg=";
   };
-  vendorHash = "sha256-gaY3U6+Emk6La5wPyT5TvgTwPsh2Ws2t7C8B5T4c46E=";
+  vendorHash = "sha256-NyNQivJM9bFP/EBfjso+13sWMnubG/fjYafCGUnsvdU=";
 
   # Exclude go within .github folder
   excludedPackages = ".github";
diff --git a/pkgs/development/tools/protolint/default.nix b/pkgs/development/tools/protolint/default.nix
index 3ce19782884a..1bf0909c4fe5 100644
--- a/pkgs/development/tools/protolint/default.nix
+++ b/pkgs/development/tools/protolint/default.nix
@@ -1,13 +1,13 @@
 { lib, buildGoModule, fetchFromGitHub }:
 buildGoModule rec {
   pname = "protolint";
-  version = "0.49.2";
+  version = "0.49.3";
 
   src = fetchFromGitHub {
     owner = "yoheimuta";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-JUSHAIyUMsZOWFhomR6s+gxUIwd/oziBZdlgaZX1sOk=";
+    hash = "sha256-V3xsjaqW5PaEmvEAn85c+eMRzb2DHpsPd9rUyzXDe9o=";
   };
 
   vendorHash = "sha256-8yV/YyNSn6O2UjAQlzM90fOoi3TdxO+v4YPtmSQMFC0=";
diff --git a/pkgs/games/runelite/default.nix b/pkgs/games/runelite/default.nix
index f6d205d473bc..d9a5da1a2af1 100644
--- a/pkgs/games/runelite/default.nix
+++ b/pkgs/games/runelite/default.nix
@@ -3,13 +3,19 @@
 , makeDesktopItem
 , makeWrapper
 , maven
+, jdk17
 , jre
 , xorg
 , gitUpdater
 , libGL
 }:
 
-maven.buildMavenPackage rec {
+let
+  mavenJdk17 = maven.override {
+    jdk = jdk17;
+  };
+in
+mavenJdk17.buildMavenPackage rec {
   pname = "runelite";
   version = "2.6.13";
 
diff --git a/pkgs/os-specific/darwin/maloader/default.nix b/pkgs/os-specific/darwin/maloader/default.nix
deleted file mode 100644
index c59f854b8475..000000000000
--- a/pkgs/os-specific/darwin/maloader/default.nix
+++ /dev/null
@@ -1,40 +0,0 @@
-{ lib, stdenv, fetchFromGitHub, opencflite, clang, libcxx }:
-
-stdenv.mkDerivation {
-  pname = "maloader";
-  version = "unstable-2014-02-25";
-
-  src = fetchFromGitHub {
-    owner = "shinh";
-    repo = "maloader";
-    rev = "5f220393e0b7b9ad0cf1aba0e89df2b42a1f0442";
-    sha256 = "0dd1pn07x1y8pyn5wz8qcl1c1xwghyya4d060m3y9vx5dhv9xmzw";
-  };
-
-  postPatch = ''
-    sed -i \
-      -e '/if.*loadLibMac.*mypath/s|mypath|"'"$out/lib/"'"|' \
-      -e 's|libCoreFoundation\.so|${opencflite}/lib/&|' \
-      ld-mac.cc
-  '';
-
-  env.NIX_CFLAGS_COMPILE = "-I${lib.getDev libcxx}/include/c++/v1";
-  buildInputs = [ clang libcxx ];
-  buildFlags = [ "USE_LIBCXX=1" "release" ];
-
-  installPhase = ''
-    install -vD libmac.so "$out/lib/libmac.so"
-
-    for bin in extract macho2elf ld-mac; do
-      install -vD "$bin" "$out/bin/$bin"
-    done
-  '';
-
-  meta = {
-    description = "Mach-O loader for Linux";
-    homepage = "https://github.com/shinh/maloader";
-    license = lib.licenses.bsd2;
-    platforms = lib.platforms.linux;
-    broken = true; # 2018-09-08, no succesful build since 2017-08-21
-  };
-}
diff --git a/pkgs/os-specific/darwin/opencflite/default.nix b/pkgs/os-specific/darwin/opencflite/default.nix
deleted file mode 100644
index 937d0763feff..000000000000
--- a/pkgs/os-specific/darwin/opencflite/default.nix
+++ /dev/null
@@ -1,21 +0,0 @@
-{ lib, stdenv, fetchurl, icu, libuuid, tzdata }:
-
-stdenv.mkDerivation rec {
-  pname = "opencflite";
-  version = "476.19.0";
-
-  src = fetchurl {
-    url = "mirror://sourceforge/opencflite/${pname}-${version}.tar.gz";
-    sha256 = "0jgmzs0ycl930hmzcvx0ykryik56704yw62w394q1q3xw5kkjn9v";
-  };
-
-  configureFlags = [ "--with-uuid=${libuuid.dev}" ];
-  buildInputs = [ icu tzdata.dev ];
-  enableParallelBuilding = true;
-
-  meta = {
-    description = "Cross platform port of the macOS CoreFoundation";
-    homepage = "https://sourceforge.net/projects/opencflite/";
-    license = lib.licenses.apsl20;
-  };
-}
diff --git a/pkgs/servers/klipper/default.nix b/pkgs/servers/klipper/default.nix
index 0c56e1b10c48..b2067020ad9f 100644
--- a/pkgs/servers/klipper/default.nix
+++ b/pkgs/servers/klipper/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "klipper";
-  version = "unstable-2024-03-15";
+  version = "unstable-2024-03-19";
 
   src = fetchFromGitHub {
     owner = "KevinOConnor";
     repo = "klipper";
-    rev = "bfb71bc2dc63f2911a11ebf580f82b1e8b2706c4";
-    sha256 = "sha256-djF1IOcMCBcsmVV0hgn6QMwDVClxSSithgiRvss9KQc=";
+    rev = "235b75be3c287a9fdcde54b347734bf6a8de2ade";
+    sha256 = "sha256-PTdLhoKTlvrTljAvrK8q/JF9w50kKJHkWrzdPPaSfCc=";
   };
 
   sourceRoot = "${src.name}/klippy";
diff --git a/pkgs/servers/monitoring/mackerel-agent/default.nix b/pkgs/servers/monitoring/mackerel-agent/default.nix
index 81fd88c37b29..a240c1aee990 100644
--- a/pkgs/servers/monitoring/mackerel-agent/default.nix
+++ b/pkgs/servers/monitoring/mackerel-agent/default.nix
@@ -2,20 +2,20 @@
 
 buildGoModule rec {
   pname = "mackerel-agent";
-  version = "0.79.0";
+  version = "0.80.0";
 
   src = fetchFromGitHub {
     owner = "mackerelio";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-UKSrNUKS7VYK/hcKdNetaq6HNPqZyK7VtlJZjoyxU6o=";
+    sha256 = "sha256-ETM7OTJEdySej9wrV9sth1JCJAtfBVdsPH8ndOBV118=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
   nativeCheckInputs = lib.optionals (!stdenv.isDarwin) [ nettools ];
   buildInputs = lib.optionals (!stdenv.isDarwin) [ iproute2 ];
 
-  vendorHash = "sha256-AnkjmgcFSI8RadfTdtCk+NCiAw+NecfaU/vc7WOgbuk=";
+  vendorHash = "sha256-pCUHDHKNaSoIPB3fS+Jf953YMI5cXcUOLF+YP62iPMo=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/shells/fish/default.nix b/pkgs/shells/fish/default.nix
index 3703644a73ae..0013c205f31f 100644
--- a/pkgs/shells/fish/default.nix
+++ b/pkgs/shells/fish/default.nix
@@ -135,7 +135,7 @@ let
 
   fish = stdenv.mkDerivation rec {
     pname = "fish";
-    version = "3.7.0";
+    version = "3.7.1";
 
     src = fetchurl {
       # There are differences between the release tarball and the tarball GitHub
@@ -145,7 +145,7 @@ let
       # --version`), as well as the local documentation for all builtins (and
       # maybe other things).
       url = "https://github.com/fish-shell/fish-shell/releases/download/${version}/${pname}-${version}.tar.xz";
-      hash = "sha256-3xtzeLcU8GkLKF7Z5OWK/icKyY28nKWDlYnBr8yjOrE=";
+      hash = "sha256-YUyfVkPNB5nfOROV+mu8NklCe7g5cizjsRTTu8GjslA=";
     };
 
     # Fix FHS paths in tests
@@ -308,7 +308,7 @@ let
     passthru = {
       shellPath = "/bin/fish";
       tests = {
-        nixos = nixosTests.fish;
+        nixos = lib.optionalAttrs stdenv.isLinux nixosTests.fish;
 
         # Test the fish_config tool by checking the generated splash page.
         # Since the webserver requires a port to run, it is not started.
@@ -322,18 +322,17 @@ let
             # if we don't set `delete=False`, the file will get cleaned up
             # automatically (leading the test to fail because there's no
             # tempfile to check)
-            sed -e 's@, mode="w"@, mode="w", delete=False@' -i webconfig.py
+            ${lib.getExe gnused} -e 's@, mode="w"@, mode="w", delete=False@' -i webconfig.py
 
             # we delete everything after the fileurl is assigned
-            sed -e '/fileurl =/q' -i webconfig.py
+            ${lib.getExe gnused} -e '/fileurl =/q' -i webconfig.py
             echo "print(fileurl)" >> webconfig.py
 
             # and check whether the message appears on the page
-            cat (${python3}/bin/python ./webconfig.py \
-              | tail -n1 | sed -ne 's|.*\(/build/.*\)|\1|p' \
-            ) | grep 'a href="http://localhost.*Start the Fish Web config'
-
             # cannot test the http server because it needs a localhost port
+            cat (${python3}/bin/python ./webconfig.py \
+              | tail -n1 | ${lib.getExe gnused} -e 's|file://||' \
+            ) | ${lib.getExe gnugrep} -q 'a href="http://localhost.*Start the Fish Web config'
           '';
           in
           runCommand "test-web-config" { } ''
diff --git a/pkgs/stdenv/adapters.nix b/pkgs/stdenv/adapters.nix
index ed96ef408a3f..300efce9c830 100644
--- a/pkgs/stdenv/adapters.nix
+++ b/pkgs/stdenv/adapters.nix
@@ -225,14 +225,18 @@ rec {
       });
     });
 
+  /* Copy the libstdc++ from the model stdenv to the target stdenv.
+   *
+   * TODO(@connorbaker):
+   * This interface provides behavior which should be revisited prior to the
+   * release of 24.05. For a more detailed explanation and discussion, see
+   * https://github.com/NixOS/nixpkgs/issues/283517. */
   useLibsFrom = modelStdenv: targetStdenv:
     let
       ccForLibs = modelStdenv.cc.cc;
-      cc = pkgs.wrapCCWith {
-        /* NOTE: cc.cc is the unwrapped compiler. Should we respect the old
-         * wrapper instead? */
-        cc = targetStdenv.cc.cc;
-
+      /* NOTE(@connorbaker):
+       * This assumes targetStdenv.cc is a cc-wrapper. */
+      cc = targetStdenv.cc.override {
         /* NOTE(originally by rrbutani):
          * Normally the `useCcForLibs`/`gccForLibs` mechanism is used to get a
          * clang based `cc` to use `libstdc++` (from gcc).
diff --git a/pkgs/tools/admin/drawterm/default.nix b/pkgs/tools/admin/drawterm/default.nix
index 3e4c15faf14b..c83b3dfd6597 100644
--- a/pkgs/tools/admin/drawterm/default.nix
+++ b/pkgs/tools/admin/drawterm/default.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation {
   pname = "drawterm";
-  version = "unstable-2024-02-18";
+  version = "unstable-2024-03-20";
 
   src = fetchFrom9Front {
     owner = "plan9front";
     repo = "drawterm";
-    rev = "bcf1eb425dd4c90a3bfcd004f6aee3854259da78";
-    hash = "sha256-aUQ6ay2ky9NzVUZvWyHc/GqPlCdhGpXTY8GGytJSC6g=";
+    rev = "77b464a5d5648bb646467111b8faf719cd5c46b6";
+    hash = "sha256-3J/Fa3NXxUieEqRcCepGdd0ktxQFKhyY4z8Pvcq94Kw=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/tools/admin/pulumi-bin/data.nix b/pkgs/tools/admin/pulumi-bin/data.nix
index 5acba25c0850..fa059873593f 100644
--- a/pkgs/tools/admin/pulumi-bin/data.nix
+++ b/pkgs/tools/admin/pulumi-bin/data.nix
@@ -1,12 +1,12 @@
 # DO NOT EDIT! This file is generated automatically by update.sh
 { }:
 {
-  version = "3.111.0";
+  version = "3.111.1";
   pulumiPkgs = {
     x86_64-linux = [
       {
-        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.111.0-linux-x64.tar.gz";
-        sha256 = "19nlzw60bsysqldzdg9zlxc9qvwzlfa9bn8wvffndg0xndy6ghwh";
+        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.111.1-linux-x64.tar.gz";
+        sha256 = "1hkj2dkpxp2migg1xh3vk42k1yq7y1bhchvkjd3vxbsd86llkwjz";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aiven-v6.12.0-linux-amd64.tar.gz";
@@ -29,8 +29,8 @@
         sha256 = "0984gpc5ds1bycvl1jwd3ifl6933vkd32w2mbyn3ik13wzxqm3q0";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v6.25.1-linux-amd64.tar.gz";
-        sha256 = "1bwp6fxqaxgyhlakci2crk7qiwgymkmih5cnpcvmgxwvdw56ll4q";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v6.27.0-linux-amd64.tar.gz";
+        sha256 = "0dcyg4d50x5fkzqmnhw7mm8bgcs2zxph6bdjfdq2cxi28nzzg1ac";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuread-v5.47.2-linux-amd64.tar.gz";
@@ -69,8 +69,8 @@
         sha256 = "0hnardid0kbzy65dmn7vz8ddy5hq78nf2871zz6srf2hfyiv7qa4";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-fastly-v8.5.0-linux-amd64.tar.gz";
-        sha256 = "06lzppd2y2qm4gxf54f0s4gps13kk2zv6zmar8lrk31w4sfr06j3";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-fastly-v8.5.1-linux-amd64.tar.gz";
+        sha256 = "0vjd2y8h4m4j7v61wqwzrdgchqpz1nlbrvvrah06k8l9ci2hpml1";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v7.14.0-linux-amd64.tar.gz";
@@ -125,8 +125,8 @@
         sha256 = "1fihr9kilipd3lycl5m0vrf8l8658b1pm8mywsnk5wlksk1bf665";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-spotinst-v3.68.0-linux-amd64.tar.gz";
-        sha256 = "018ynwc7l2xvqq1n64ny3rlv37nzbx1b0c2j1jla7r35a4vjym8f";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-spotinst-v3.69.0-linux-amd64.tar.gz";
+        sha256 = "0qmh81kvqprmp1shml183qc6mdq76p6an7cm0b1qg7zyabg7qbrz";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-sumologic-v0.20.3-linux-amd64.tar.gz";
@@ -148,23 +148,14 @@
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-venafi-v1.7.0-linux-amd64.tar.gz";
         sha256 = "0w7cgafkz1r55bz8n51v2rqhmmxzrf7ma60awzlfd2apyihghxyp";
       }
-      {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vsphere-v4.10.0-linux-amd64.tar.gz";
-        sha256 = "0j3g5d94x5hawlrvr2iya4l0lsqjvszkgrgwppna6cn5mqjpx7v0";
-      }
-      {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-wavefront-v3.1.1-linux-amd64.tar.gz";
-        sha256 = "0ghxcipyz6j3fmawi5bpkz1mdpcdg046nib2w90r26dbidi4l3f3";
-      }
-      {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-yandex-v0.13.0-linux-amd64.tar.gz";
-        sha256 = "14qsnjafhd8ppachxr7j9541p5rbf1cakqlr7mra86fli1r49z9p";
-      }
+      # pulumi-resource-vsphere skipped (does not exist on remote)
+      # pulumi-resource-wavefront skipped (does not exist on remote)
+      # pulumi-resource-yandex skipped (does not exist on remote)
     ];
     x86_64-darwin = [
       {
-        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.111.0-darwin-x64.tar.gz";
-        sha256 = "0z6bcdsm48cw0q6p3jrcbd920kwq56h81hd4qzf1akr5b0fqs8qk";
+        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.111.1-darwin-x64.tar.gz";
+        sha256 = "0vqwgx29z4rpmlxjqjxaixhijha6si0y01ibnr4wiwmm4y6ls578";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aiven-v6.12.0-darwin-amd64.tar.gz";
@@ -187,8 +178,8 @@
         sha256 = "0369vlly2x6sl59b4qha55yhhyjjpx38vlkmsbbqzla3da7zabf0";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v6.25.1-darwin-amd64.tar.gz";
-        sha256 = "1dhykjnvn1qr65nmbdafxl1q3vqfqc152x540syf5v3avcf0kqdb";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v6.27.0-darwin-amd64.tar.gz";
+        sha256 = "0xx4yw5zl4lnswnz4w4qrxgdiy400c8p7bsr1rqz1zmc9bqm43ng";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuread-v5.47.2-darwin-amd64.tar.gz";
@@ -227,8 +218,8 @@
         sha256 = "1m5lh59h7nck1flzxs9m4n0ag0klk3jmnpf7hc509vffxs89xnjq";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-fastly-v8.5.0-darwin-amd64.tar.gz";
-        sha256 = "0ibabyyk92v4cx7h6bckbb6yqp25b68z3s34ri2ci3q595f1mr84";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-fastly-v8.5.1-darwin-amd64.tar.gz";
+        sha256 = "1c5wf2ksp7f02x82swjd7gq1d072j4zsyiyllrrazyvv8310zyig";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v7.14.0-darwin-amd64.tar.gz";
@@ -283,8 +274,8 @@
         sha256 = "0n0yd8hg10qfxvb6y5hci60n3520w5pidjzw43ih35dj84f0y23s";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-spotinst-v3.68.0-darwin-amd64.tar.gz";
-        sha256 = "1jy9ybxsplz7zapw56l0g11sfdzjf6xg1q7cj4js95fvisd2y0a4";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-spotinst-v3.69.0-darwin-amd64.tar.gz";
+        sha256 = "0mjcsgcwb8mqy5si5kj8l96ig6ccjwfplmr8kwrg22bj7g7vidlz";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-sumologic-v0.20.3-darwin-amd64.tar.gz";
@@ -306,23 +297,14 @@
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-venafi-v1.7.0-darwin-amd64.tar.gz";
         sha256 = "1pvbcyw1l2b27hn48klc2fj3is2y3z1dj90ac4kkqi2ag4xj45vx";
       }
-      {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vsphere-v4.10.0-darwin-amd64.tar.gz";
-        sha256 = "0yfk80y2dm0rk06q5m5sc159gryxbxp1gmbi4iwjcrpdra6vbm9v";
-      }
-      {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-wavefront-v3.1.1-darwin-amd64.tar.gz";
-        sha256 = "1lypf3yisnf19ygkjy6fmdbzf4i4mi5jzq7yc16hrg3aq2g75rr5";
-      }
-      {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-yandex-v0.13.0-darwin-amd64.tar.gz";
-        sha256 = "11wm9c125154brisncm9cgb41nbjl9q9h4bq6z0ym8v681qq0fc4";
-      }
+      # pulumi-resource-vsphere skipped (does not exist on remote)
+      # pulumi-resource-wavefront skipped (does not exist on remote)
+      # pulumi-resource-yandex skipped (does not exist on remote)
     ];
     aarch64-linux = [
       {
-        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.111.0-linux-arm64.tar.gz";
-        sha256 = "0vgaqm6ap02640yf6a8ycbb2an3ymamgrzl6x1bj3ykk13x7ri2p";
+        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.111.1-linux-arm64.tar.gz";
+        sha256 = "0nahz89vw9gkgszdcv9v9d658x43jzvk547kq6jpsgnzjligf41q";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aiven-v6.12.0-linux-arm64.tar.gz";
@@ -345,8 +327,8 @@
         sha256 = "10iaa1w7a0xbp15hyfl3slksg7rss04jcchws1z3lqddfn5xdcf2";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v6.25.1-linux-arm64.tar.gz";
-        sha256 = "14ayammjy00d73qgkcdyyryd60yrk6h71vjqakvmbnwndh44hm52";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v6.27.0-linux-arm64.tar.gz";
+        sha256 = "1v3h9j9bxqnjg8fj4k75p96sglnnkw5jziyfvbzhcbd11fcvaffs";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuread-v5.47.2-linux-arm64.tar.gz";
@@ -385,8 +367,8 @@
         sha256 = "111pia2f5xwkwaqs6p90ri29l5b3ivmahsa1bji4fwyyjyp22h4r";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-fastly-v8.5.0-linux-arm64.tar.gz";
-        sha256 = "14c25p6hfyyxq5cfq1z89gb67ywlr4zwj8lllknwqc7wsnvykllg";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-fastly-v8.5.1-linux-arm64.tar.gz";
+        sha256 = "1cx7b7nxmjng8pff84yf0jhdmnmld5g09a80999ah90p54xy4zww";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v7.14.0-linux-arm64.tar.gz";
@@ -441,8 +423,8 @@
         sha256 = "1ssm84izdqzaymw1w3q9b2lkw35brysii73xhw7dgcazhgagfd1w";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-spotinst-v3.68.0-linux-arm64.tar.gz";
-        sha256 = "1nwm69fblmll2d3hgnl5d98x1xhjl49l5cdc8smldr25i5zp5zj2";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-spotinst-v3.69.0-linux-arm64.tar.gz";
+        sha256 = "0ns90ky01kys22dwhkmb4dwax1gzyr8jclczx1fc5d9xvl5cssiy";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-sumologic-v0.20.3-linux-arm64.tar.gz";
@@ -464,23 +446,14 @@
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-venafi-v1.7.0-linux-arm64.tar.gz";
         sha256 = "017ff9x7s4yvsrf4ypsyaz934r9jm954080gn5535w1694k96wbn";
       }
-      {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vsphere-v4.10.0-linux-arm64.tar.gz";
-        sha256 = "0sgrb6h7d5myp1cy4i7fhhx718n4qx83hj561z98y5hvipg16bcx";
-      }
-      {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-wavefront-v3.1.1-linux-arm64.tar.gz";
-        sha256 = "08mxk5rccxsgvjcnfxwzcr8980gkg7mxfrzx3fyvcxmgvf3ykcn8";
-      }
-      {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-yandex-v0.13.0-linux-arm64.tar.gz";
-        sha256 = "0fd3hgvkr3ch2r5hpmi7h70w4hkbjdyc7z534h151pyc5ssxw8bd";
-      }
+      # pulumi-resource-vsphere skipped (does not exist on remote)
+      # pulumi-resource-wavefront skipped (does not exist on remote)
+      # pulumi-resource-yandex skipped (does not exist on remote)
     ];
     aarch64-darwin = [
       {
-        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.111.0-darwin-arm64.tar.gz";
-        sha256 = "13qhv19xr21y6zs6if6gmyvayy0jrcg4kfn1z7zsqhf6j33ibwys";
+        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.111.1-darwin-arm64.tar.gz";
+        sha256 = "0vs7mnp16bc9zj74v2ibn4nsjp43hjqpsdkgx3xhvb021b6lvnh0";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aiven-v6.12.0-darwin-arm64.tar.gz";
@@ -503,8 +476,8 @@
         sha256 = "0ja508z0r4gbg2zdyrjb7gq8kn1brrx5q6am5dvwaikqs6i6vxrm";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v6.25.1-darwin-arm64.tar.gz";
-        sha256 = "0wx39f18qc3yvnzixs7r1lq7lbff3as2xb60ldy3zim2dapy3y37";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v6.27.0-darwin-arm64.tar.gz";
+        sha256 = "0y0qha8d0dsjnqjaipn6i3csda4cl13zq0mqd8jpda127c3jzzxv";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuread-v5.47.2-darwin-arm64.tar.gz";
@@ -543,8 +516,8 @@
         sha256 = "12bzicm43l7yvh02v5fx3z8v46l9i7a9f677735xi5rjbmd2an4c";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-fastly-v8.5.0-darwin-arm64.tar.gz";
-        sha256 = "1ayyr8kywylv6zvwbzs71mvyldkh8qiki8ca90i34rpjxrv92n2d";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-fastly-v8.5.1-darwin-arm64.tar.gz";
+        sha256 = "18985l0djz592235y2brxncpaky850qyr0xa23aflm07wdh7fc3n";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v7.14.0-darwin-arm64.tar.gz";
@@ -599,8 +572,8 @@
         sha256 = "1qr6qh4323d6n7f56lixdrph5cb5qby4q2f3l8l4l6n8s345v9kr";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-spotinst-v3.68.0-darwin-arm64.tar.gz";
-        sha256 = "120acxnm1lid5spszv8i4vgnk732fch8j3i2qhrdd3k2p86z0a1n";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-spotinst-v3.69.0-darwin-arm64.tar.gz";
+        sha256 = "0rjb8pbxrp0djvjmxqvivd3jyy9r1iflp6i5a7mzad825g7gzczb";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-sumologic-v0.20.3-darwin-arm64.tar.gz";
@@ -622,18 +595,9 @@
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-venafi-v1.7.0-darwin-arm64.tar.gz";
         sha256 = "00qq53wirdjm8zqqisad34fzx70m96dwg0dqysz6nqikq620h7dp";
       }
-      {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vsphere-v4.10.0-darwin-arm64.tar.gz";
-        sha256 = "1562pylmy4i109wwpn0lqb11m3ajwlswn5f76ni0cq4sw0iips4l";
-      }
-      {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-wavefront-v3.1.1-darwin-arm64.tar.gz";
-        sha256 = "09k9px0pm55jf3kxq1xc37li34mdv96sgcg89wmmm7spwl8q48m1";
-      }
-      {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-yandex-v0.13.0-darwin-arm64.tar.gz";
-        sha256 = "1qaccfqw24g862ij2p49m78hnymg0j2nghshszqrg45v0d0qnknm";
-      }
+      # pulumi-resource-vsphere skipped (does not exist on remote)
+      # pulumi-resource-wavefront skipped (does not exist on remote)
+      # pulumi-resource-yandex skipped (does not exist on remote)
     ];
   };
 }
diff --git a/pkgs/tools/misc/opentelemetry-collector/contrib.nix b/pkgs/tools/misc/opentelemetry-collector/contrib.nix
index e928544d240a..bad1051fcc64 100644
--- a/pkgs/tools/misc/opentelemetry-collector/contrib.nix
+++ b/pkgs/tools/misc/opentelemetry-collector/contrib.nix
@@ -8,18 +8,18 @@
 
 buildGoModule rec {
   pname = "opentelemetry-collector-contrib";
-  version = "0.87.0";
+  version = "0.96.0";
 
   src = fetchFromGitHub {
     owner = "open-telemetry";
     repo = "opentelemetry-collector-contrib";
     rev = "v${version}";
-    sha256 = "sha256-b1TCj3aKupqUMQ74O58O5WJfQM9tj1G0ny5YeeilFAM=";
+    sha256 = "sha256-eQau6PcslY/Bzghmndv1lq5fb+Q+x9guouKzLw5sJTg=";
   };
 
   # proxy vendor to avoid hash missmatches between linux and macOS
   proxyVendor = true;
-  vendorHash = "sha256-o/51Z2Zmdza3pNZa0u3j4uG46orE9S7pUsZOXjHKrnI=";
+  vendorHash = "sha256-aMxOu6eCskTlphMjM/CBs0lN6UkLDgSidS9qwlSUUiU=";
 
   # there is a nested go.mod
   sourceRoot = "${src.name}/cmd/otelcontribcol";
@@ -39,11 +39,7 @@ buildGoModule rec {
   # it instead of trusting the global $PATH.
   propagatedBuildInputs = lib.optionals withSystemd [ systemdMinimal ];
 
-  preCheck = "export CGO_ENABLED=1";
-
-  # This test fails on darwin for mysterious reasons.
-  checkFlags = lib.optionals stdenv.isDarwin
-    [ "-skip" "TestDefaultExtensions/memory_ballast" ];
+  doCheck = false;
 
   ldflags = [
     "-s"
diff --git a/pkgs/tools/misc/pspg/default.nix b/pkgs/tools/misc/pspg/default.nix
index 2449fd30171d..47fb6fbbd8dd 100644
--- a/pkgs/tools/misc/pspg/default.nix
+++ b/pkgs/tools/misc/pspg/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pspg";
-  version = "5.8.1";
+  version = "5.8.2";
 
   src = fetchFromGitHub {
     owner = "okbob";
     repo = pname;
     rev = version;
-    sha256 = "sha256-nsGBBGw66LCwOuNdBjlz6u9RT+BX6iZmZeDY9yJoc+c=";
+    sha256 = "sha256-1mL/UlN7wD0GBYwg0C2eYCB3MtFO2ILd4+A7br+/ovs=";
   };
 
   nativeBuildInputs = [ pkg-config installShellFiles ];
diff --git a/pkgs/tools/networking/nzbget/default.nix b/pkgs/tools/networking/nzbget/default.nix
index 2c698ae6c831..9a57a2e8a3b5 100644
--- a/pkgs/tools/networking/nzbget/default.nix
+++ b/pkgs/tools/networking/nzbget/default.nix
@@ -2,6 +2,7 @@
 , stdenv
 , fetchFromGitHub
 , autoreconfHook
+, boost
 , pkg-config
 , gnutls
 , libgcrypt
@@ -17,18 +18,19 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "nzbget-ng";
-  version = "21.4-rc2";
+  version = "23.0";
 
   src = fetchFromGitHub {
-    owner = "nzbget-ng";
+    owner = "nzbgetcom";
     repo = "nzbget";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-JJML5mtAog5xC7DkthCtoyn5QeC2Z+fdzSuEa/Te0Ew=";
+    hash = "sha256-JqC82zpsIqRYB7128gTSOQMWJFR/t63NJXlPgGqP0jE=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
 
   buildInputs = [
+    boost
     gnutls
     libgcrypt
     libpar2
@@ -49,11 +51,11 @@ stdenv.mkDerivation (finalAttrs: {
   passthru.tests = { inherit (nixosTests) nzbget; };
 
   meta = with lib; {
-    homepage = "https://nzbget-ng.github.io/";
-    changelog = "https://github.com/nzbget-ng/nzbget/releases/tag/v${finalAttrs.version}";
+    homepage = "https://nzbget.com/";
+    changelog = "https://github.com/nzbgetcom/nzbget/releases/tag/v${finalAttrs.version}";
     license = licenses.gpl2Plus;
     description = "A command line tool for downloading files from news servers";
-    maintainers = with maintainers; [ pSub ];
+    maintainers = with maintainers; [ pSub devusb ];
     platforms = with platforms; unix;
     mainProgram = "nzbget";
   };
diff --git a/pkgs/tools/networking/sockdump/default.nix b/pkgs/tools/networking/sockdump/default.nix
index daedb3a7cbcc..98e88d0d6f83 100644
--- a/pkgs/tools/networking/sockdump/default.nix
+++ b/pkgs/tools/networking/sockdump/default.nix
@@ -2,13 +2,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "sockdump";
-  version = "unstable-2023-09-16";
+  version = "unstable-2023-12-11";
 
   src = fetchFromGitHub {
     owner = "mechpen";
     repo = pname;
-    rev = "713759e383366feae76863881e851a6411c73b68";
-    hash = "sha256-q6jdwFhl2G9o2C0BVU6Xz7xizO00yaSQ2KSR/z4fixY=";
+    rev = "d40ec77e960d021861220bc14a273c5dcad13160";
+    hash = "sha256-FLK1rgWvIoFGv/6+DtDhZGeOZrn7V1jYNS3S8qwL/dc=";
   };
 
   propagatedBuildInputs = [ bcc ];
@@ -21,6 +21,6 @@ python3.pkgs.buildPythonApplication rec {
     description = "Dump unix domain socket traffic with bpf";
     mainProgram = "sockdump";
     license = lib.licenses.unlicense;
-    maintainers = with lib.maintainers; [ ehmry ];
+    maintainers = with lib.maintainers; [ ehmry picnoir ];
   };
 }
diff --git a/pkgs/tools/security/cdxgen/default.nix b/pkgs/tools/security/cdxgen/default.nix
index f624b10952fc..351fee2ff2af 100644
--- a/pkgs/tools/security/cdxgen/default.nix
+++ b/pkgs/tools/security/cdxgen/default.nix
@@ -5,16 +5,16 @@
 
 buildNpmPackage rec {
   pname = "cdxgen";
-  version = "10.2.3";
+  version = "10.2.4";
 
   src = fetchFromGitHub {
     owner = "AppThreat";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-C/XTMOFLW2FPPi1Pgx7g5H8jtJlya5LnKmo3oF21yMI=";
+    sha256 = "sha256-fou0BfQfL66Iv+STY0JcRqu22XTgA9nSOse1LJYl3vs=";
   };
 
-  npmDepsHash = "sha256-64dKqV17WvuHjF+n1vCEfpLx6UBNpGkVE+XYi7YswgI=";
+  npmDepsHash = "sha256-ISmNasK44T21HagHKrX1LyCFVm0GF0CsTwIIi3n8h2o=";
 
   dontNpmBuild = true;
 
diff --git a/pkgs/tools/text/riffdiff/default.nix b/pkgs/tools/text/riffdiff/default.nix
index a15644d59111..1db7967d0f57 100644
--- a/pkgs/tools/text/riffdiff/default.nix
+++ b/pkgs/tools/text/riffdiff/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "riffdiff";
-  version = "3.0.1";
+  version = "3.1.0";
 
   src = fetchFromGitHub {
     owner = "walles";
     repo = "riff";
     rev = version;
-    hash = "sha256-MHsbwtoiaMBWZi/UHbuhG3VuSSvuQtvxPB9EMMti80A=";
+    hash = "sha256-ASIB7+ZyvMsaRdvJcWT/sR0JLyt4v/gytAIi8Yajlzg=";
   };
 
-  cargoHash = "sha256-pEXGUIrWZGJoYdNoufXEJ+eeIEhm5JhIUlHRisD4qWc=";
+  cargoHash = "sha256-NGTWBlg5xvodK02RtFuCe7KsFm4z2aEpbcx3UqH9G/o=";
 
   meta = with lib; {
     description = "A diff filter highlighting which line parts have changed";
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index d132b5c7247f..1f53f0ebfe7c 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -847,6 +847,7 @@ mapAliases ({
   o = orbiton; # Added 2023-04-09
   oathToolkit = oath-toolkit; # Added 2022-04-04
   oauth2_proxy = oauth2-proxy; # Added 2021-04-18
+  obinskit = throw "'obinskit' has been removed from nixpkgs, because the package was unmaintained and depended on an insecure version of electron"; # Added 2024-03-20
   octant = throw "octant has been dropped due to being archived and vulnerable"; # Added 2023-09-29
   octant-desktop = throw "octant-desktop has been dropped due to being archived and vulnerable"; # Added 2023-09-29
   octorpki = throw "octorpki has been removed, upstream says to use rpki-client instead"; # Added 2024-03-19
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 0d1620c569d5..e9d3876a9df9 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1861,8 +1861,6 @@ with pkgs;
 
   gofu = callPackage ../applications/misc/gofu { };
 
-  godns = callPackage ../tools/networking/godns { };
-
   godspeed = callPackage ../tools/networking/godspeed { };
 
   goodhosts = callPackage ../tools/networking/goodhosts { };
@@ -6119,8 +6117,6 @@ with pkgs;
   optar = callPackage ../tools/graphics/optar { };
 
 
-  obinskit = callPackage ../applications/misc/obinskit { };
-
   ockam = callPackage ../tools/networking/ockam {
     inherit (darwin.apple_sdk.frameworks) Security;
   };
@@ -7724,8 +7720,6 @@ with pkgs;
 
   sonobuoy = callPackage ../applications/networking/cluster/sonobuoy { };
 
-  soupault = callPackage ../tools/typesetting/soupault { };
-
   stratisd = callPackage ../tools/filesystems/stratisd { };
 
   stratis-cli = callPackage ../tools/filesystems/stratis-cli { };
@@ -10693,6 +10687,8 @@ with pkgs;
     inherit (python3Packages) mako;
   };
 
+  marimo = with python3Packages; toPythonApplication marimo;
+
   marktext = callPackage ../applications/misc/marktext { };
 
   mars-mips = callPackage ../development/tools/mars-mips { };
@@ -26897,8 +26893,6 @@ with pkgs;
 
   sipwitch = callPackage ../servers/sip/sipwitch { };
 
-  slimserver = callPackage ../servers/slimserver { };
-
   smcroute = callPackage ../servers/smcroute { };
 
   snipe-it = callPackage ../by-name/sn/snipe-it/package.nix {
@@ -28765,8 +28759,6 @@ with pkgs;
 
   commit-mono = callPackage ../data/fonts/commit-mono { };
 
-  conway_polynomials = callPackage ../data/misc/conway_polynomials { };
-
   cooper-hewitt = callPackage ../data/fonts/cooper-hewitt { };
 
   d2coding = callPackage ../data/fonts/d2coding { };
@@ -30695,7 +30687,9 @@ with pkgs;
 
   drawing = callPackage ../applications/graphics/drawing { };
 
-  drawio = callPackage ../applications/graphics/drawio { };
+  drawio = callPackage ../applications/graphics/drawio {
+    inherit (darwin) autoSignDarwinBinariesHook;
+  };
   drawio-headless = callPackage ../applications/graphics/drawio/headless.nix { };
 
   drawpile = libsForQt5.callPackage ../applications/graphics/drawpile { };
@@ -39091,8 +39085,6 @@ with pkgs;
 
   jflap = callPackage ../applications/science/engineering/jflap { };
 
-  strictdoc = python3.pkgs.callPackage ../applications/science/engineering/strictdoc { };
-
   ### SCIENCE / ELECTRONICS
 
   adms = callPackage ../applications/science/electronics/adms { };
diff --git a/pkgs/top-level/darwin-packages.nix b/pkgs/top-level/darwin-packages.nix
index 8fb08c90f70f..a6c98831eee6 100644
--- a/pkgs/top-level/darwin-packages.nix
+++ b/pkgs/top-level/darwin-packages.nix
@@ -153,9 +153,6 @@ impure-cmds // appleSourcePackages // chooseLibs // {
     propagatedBuildInputs = [ self.signingUtils ];
   } ../os-specific/darwin/signing-utils/auto-sign-hook.sh;
 
-  maloader = callPackage ../os-specific/darwin/maloader {
-  };
-
   insert_dylib = callPackage ../os-specific/darwin/insert_dylib { };
 
   iosSdkPkgs = callPackage ../os-specific/darwin/xcode/sdk-pkgs.nix {
@@ -175,8 +172,6 @@ impure-cmds // appleSourcePackages // chooseLibs // {
     inherit (apple_sdk_11_0.libs) simd;
   };
 
-  opencflite = callPackage ../os-specific/darwin/opencflite { };
-
   openwith = pkgs.darwin.apple_sdk_11_0.callPackage ../os-specific/darwin/openwith {
     inherit (apple_sdk_11_0.frameworks) AppKit Foundation UniformTypeIdentifiers;
   };
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 96fccb3f3ecc..fed4bac69f27 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -501,6 +501,7 @@ mapAliases ({
   thumborPexif = throw "thumborPexif has been removed, because it was unused."; # added 2024-01-07
   torrent_parser = torrent-parser; # added 2023-11-04
   transip = throw "transip has been removed because it is no longer maintained. TransIP SOAP V5 API was marked as deprecated"; # added 2023-02-27
+  py-tree-sitter = throw "Was merged with tree-sitter."; # added 2024-03-20
   trezor_agent = trezor-agent; # Added 2024-01-07
   tumpa = throw "tumpa was promoted to a top-level attribute"; # added 2022-11-19
   tvdb_api = tvdb-api; # added 2023-10-20
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index ca49a480a726..f21869e7e17f 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1955,6 +1955,8 @@ self: super: with self; {
 
   connio = callPackage ../development/python-modules/connio { };
 
+  conway-polynomials = callPackage ../development/python-modules/conway-polynomials {};
+
   correctionlib = callPackage ../development/python-modules/correctionlib { };
 
   coqpit = callPackage ../development/python-modules/coqpit { };
@@ -7005,6 +7007,8 @@ self: super: with self; {
 
   mariadb = callPackage ../development/python-modules/mariadb { };
 
+  marimo = callPackage ../development/python-modules/marimo { };
+
   marisa = callPackage ../development/python-modules/marisa {
     inherit (pkgs) marisa;
   };
@@ -8853,6 +8857,8 @@ self: super: with self; {
 
   oletools = callPackage ../development/python-modules/oletools { };
 
+  ollama = callPackage ../development/python-modules/ollama { };
+
   omegaconf = callPackage ../development/python-modules/omegaconf { };
 
   omemo-dr = callPackage ../development/python-modules/omemo-dr { };
@@ -10304,8 +10310,6 @@ self: super: with self; {
 
   py-tes = callPackage ../development/python-modules/py-tes { };
 
-  py-tree-sitter = callPackage ../development/python-modules/py-tree-sitter { };
-
   py-ubjson = callPackage ../development/python-modules/py-ubjson { };
 
   py-zabbix = callPackage ../development/python-modules/py-zabbix { };