about summary refs log tree commit diff
diff options
context:
space:
mode:
authorgithub-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>2023-10-21 00:11:35 +0000
committerGitHub <noreply@github.com>2023-10-21 00:11:35 +0000
commit37282b51d9649376a8a3afa82ec74e148e2608fa (patch)
treedc7f6f9dc2cb646dcb5dc79fc16af3937621ad80
parent041376b9c9e80a24b9b0bfae2d6aa096f7b4cf67 (diff)
parent28eb936285ed02bbd53e3771f1e0153ced640c44 (diff)
downloadnixlib-37282b51d9649376a8a3afa82ec74e148e2608fa.tar
nixlib-37282b51d9649376a8a3afa82ec74e148e2608fa.tar.gz
nixlib-37282b51d9649376a8a3afa82ec74e148e2608fa.tar.bz2
nixlib-37282b51d9649376a8a3afa82ec74e148e2608fa.tar.lz
nixlib-37282b51d9649376a8a3afa82ec74e148e2608fa.tar.xz
nixlib-37282b51d9649376a8a3afa82ec74e148e2608fa.tar.zst
nixlib-37282b51d9649376a8a3afa82ec74e148e2608fa.zip
Merge master into haskell-updates
-rw-r--r--.github/CODEOWNERS8
-rw-r--r--.github/PULL_REQUEST_TEMPLATE.md4
-rw-r--r--maintainers/maintainer-list.nix26
-rw-r--r--maintainers/scripts/pluginupdate.py5
-rw-r--r--nixos/doc/manual/development/what-happens-during-a-system-switch.chapter.md4
-rw-r--r--nixos/doc/manual/release-notes/rl-2311.section.md4
-rw-r--r--nixos/modules/config/iproute2.nix2
-rw-r--r--nixos/modules/config/stevenblack.nix2
-rw-r--r--nixos/modules/hardware/corectrl.nix4
-rw-r--r--nixos/modules/hardware/i2c.nix2
-rw-r--r--nixos/modules/hardware/keyboard/uhk.nix2
-rw-r--r--nixos/modules/hardware/keyboard/zsa.nix2
-rw-r--r--nixos/modules/hardware/openrazer.nix2
-rw-r--r--nixos/modules/hardware/tuxedo-keyboard.nix2
-rw-r--r--nixos/modules/hardware/video/nvidia.nix26
-rw-r--r--nixos/modules/hardware/video/webcam/facetimehd.nix2
-rw-r--r--nixos/modules/misc/ids.nix4
-rw-r--r--nixos/modules/misc/nixops-autoluks.nix2
-rw-r--r--nixos/modules/module-list.nix1
-rw-r--r--nixos/modules/programs/calls.nix2
-rw-r--r--nixos/modules/programs/cnping.nix2
-rw-r--r--nixos/modules/programs/direnv.nix2
-rw-r--r--nixos/modules/programs/feedbackd.nix4
-rw-r--r--nixos/modules/programs/fish.nix4
-rw-r--r--nixos/modules/programs/kdeconnect.nix2
-rw-r--r--nixos/modules/programs/wayland/wayfire.nix2
-rw-r--r--nixos/modules/rename.nix1
-rw-r--r--nixos/modules/services/backup/znapzend.nix20
-rw-r--r--nixos/modules/services/databases/cassandra.nix2
-rw-r--r--nixos/modules/services/databases/ferretdb.nix2
-rw-r--r--nixos/modules/services/databases/redis.nix2
-rw-r--r--nixos/modules/services/databases/surrealdb.nix2
-rw-r--r--nixos/modules/services/desktops/deepin/app-services.nix2
-rw-r--r--nixos/modules/services/desktops/deepin/dde-api.nix4
-rw-r--r--nixos/modules/services/desktops/deepin/dde-daemon.nix2
-rw-r--r--nixos/modules/services/desktops/gnome/gnome-browser-connector.nix4
-rw-r--r--nixos/modules/services/hardware/supergfxd.nix2
-rw-r--r--nixos/modules/services/hardware/tuxedo-rs.nix4
-rw-r--r--nixos/modules/services/mail/dovecot.nix2
-rw-r--r--nixos/modules/services/mail/mailman.nix2
-rw-r--r--nixos/modules/services/matrix/mjolnir.nix4
-rw-r--r--[-rwxr-xr-x]nixos/modules/services/misc/confd.nix0
-rw-r--r--nixos/modules/services/misc/klipper.nix4
-rw-r--r--nixos/modules/services/misc/packagekit.nix4
-rw-r--r--nixos/modules/services/misc/rshim.nix2
-rw-r--r--nixos/modules/services/misc/sourcehut/default.nix2
-rw-r--r--nixos/modules/services/misc/tp-auto-kbbl.nix2
-rw-r--r--nixos/modules/services/misc/zoneminder.nix4
-rw-r--r--nixos/modules/services/monitoring/mackerel-agent.nix6
-rw-r--r--nixos/modules/services/monitoring/prometheus/exporters/wireguard.nix2
-rw-r--r--nixos/modules/services/network-filesystems/openafs/server.nix4
-rw-r--r--nixos/modules/services/networking/create_ap.nix2
-rw-r--r--nixos/modules/services/networking/dae.nix6
-rw-r--r--nixos/modules/services/networking/ddclient.nix234
-rw-r--r--nixos/modules/services/networking/deconz.nix8
-rw-r--r--nixos/modules/services/networking/go-neb.nix2
-rw-r--r--nixos/modules/services/networking/hostapd.nix4
-rw-r--r--nixos/modules/services/networking/hylafax/options.nix8
-rw-r--r--nixos/modules/services/networking/i2pd.nix8
-rw-r--r--nixos/modules/services/networking/iscsi/initiator.nix2
-rw-r--r--nixos/modules/services/networking/nar-serve.nix2
-rw-r--r--nixos/modules/services/networking/nftables.nix2
-rw-r--r--nixos/modules/services/networking/snowflake-proxy.nix2
-rw-r--r--nixos/modules/services/networking/yggdrasil.nix4
-rw-r--r--nixos/modules/services/system/earlyoom.nix2
-rw-r--r--nixos/modules/services/system/systembus-notify.nix2
-rw-r--r--nixos/modules/services/torrent/flexget.nix2
-rw-r--r--nixos/modules/services/video/mediamtx.nix2
-rw-r--r--nixos/modules/services/web-apps/cloudlog.nix2
-rw-r--r--nixos/modules/services/web-apps/dex.nix7
-rw-r--r--nixos/modules/services/web-apps/hedgedoc.nix1226
-rw-r--r--nixos/modules/services/web-apps/hledger-web.nix2
-rw-r--r--nixos/modules/services/web-apps/isso.nix4
-rw-r--r--nixos/modules/services/web-apps/jitsi-meet.nix4
-rw-r--r--nixos/modules/services/web-apps/meme-bingo-web.nix4
-rw-r--r--nixos/modules/services/web-apps/phylactery.nix2
-rw-r--r--nixos/modules/services/web-apps/snipe-it.nix2
-rw-r--r--nixos/modules/services/web-apps/zitadel.nix2
-rw-r--r--nixos/modules/services/web-servers/keter/default.nix2
-rw-r--r--nixos/modules/services/web-servers/rustus.nix2
-rw-r--r--nixos/modules/services/x11/desktop-managers/deepin.nix2
-rw-r--r--nixos/modules/system/activation/bootspec.nix2
-rwxr-xr-xnixos/modules/system/activation/switch-to-configuration.pl4
-rw-r--r--nixos/modules/system/boot/grow-partition.nix56
-rw-r--r--nixos/modules/system/boot/loader/external/external.nix2
-rw-r--r--nixos/modules/system/boot/systemd/homed.nix2
-rw-r--r--nixos/modules/system/boot/systemd/userdbd.nix2
-rw-r--r--nixos/tests/all-tests.nix1
-rw-r--r--nixos/tests/grow-partition.nix83
-rw-r--r--nixos/tests/hedgedoc.nix62
-rw-r--r--[-rwxr-xr-x]pkgs/applications/audio/soundwireserver/default.nix0
-rw-r--r--pkgs/applications/blockchains/bitcoin/default.nix4
-rw-r--r--pkgs/applications/blockchains/lighthouse/default.nix2
-rw-r--r--pkgs/applications/blockchains/polkadot/default.nix5
-rw-r--r--pkgs/applications/blockchains/snarkos/default.nix6
-rw-r--r--pkgs/applications/editors/hexdino/default.nix6
-rw-r--r--[-rwxr-xr-x]pkgs/applications/editors/neovim/neovim-gtk.nix0
-rw-r--r--pkgs/applications/editors/tecoc/default.nix6
-rw-r--r--pkgs/applications/emulators/yuzu/generic.nix4
-rw-r--r--pkgs/applications/emulators/yuzu/sources.nix14
-rw-r--r--[-rwxr-xr-x]pkgs/applications/graphics/structorizer/default.nix0
-rw-r--r--pkgs/applications/misc/blender/default.nix4
-rw-r--r--[-rwxr-xr-x]pkgs/applications/misc/fluxboxlauncher/default.nix0
-rw-r--r--pkgs/applications/misc/get_iplayer/default.nix6
-rw-r--r--pkgs/applications/misc/html5validator/default.nix36
-rw-r--r--pkgs/applications/misc/leetcode-cli/default.nix9
-rw-r--r--pkgs/applications/misc/octoprint/default.nix5
-rw-r--r--pkgs/applications/misc/slweb/default.nix4
-rw-r--r--pkgs/applications/networking/browsers/chromium/common.nix54
-rwxr-xr-xpkgs/applications/networking/browsers/chromium/update.py25
-rw-r--r--pkgs/applications/networking/browsers/chromium/upstream-info.nix16
-rw-r--r--pkgs/applications/networking/cluster/argocd-autopilot/default.nix6
-rw-r--r--pkgs/applications/networking/cluster/kaniko/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/kubernetes/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/starboard/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/tektoncd-cli/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/terraform-backend-git/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/terraform/default.nix6
-rw-r--r--pkgs/applications/networking/ids/zeek/default.nix5
-rw-r--r--pkgs/applications/networking/instant-messengers/discord/default.nix32
-rw-r--r--pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix6
-rw-r--r--pkgs/applications/networking/opsdroid/default.nix2
-rw-r--r--pkgs/applications/networking/sync/storj-uplink/default.nix6
-rw-r--r--pkgs/applications/office/activitywatch/default.nix2
-rw-r--r--pkgs/applications/science/biology/bioawk/default.nix50
-rw-r--r--[-rwxr-xr-x]pkgs/applications/science/biology/poretools/default.nix0
-rw-r--r--[-rwxr-xr-x]pkgs/applications/science/biology/trimal/default.nix0
-rw-r--r--[-rwxr-xr-x]pkgs/applications/science/biology/vcftools/default.nix0
-rw-r--r--pkgs/applications/science/misc/root/default.nix4
-rw-r--r--pkgs/applications/science/molecular-dynamics/gromacs/default.nix4
-rw-r--r--pkgs/applications/version-management/git-mit/default.nix6
-rw-r--r--pkgs/applications/version-management/stgit/default.nix6
-rw-r--r--pkgs/applications/video/kodi/addons/inputstream-adaptive/default.nix4
-rw-r--r--pkgs/applications/video/kodi/addons/netflix/default.nix4
-rw-r--r--[-rwxr-xr-x]pkgs/applications/virtualization/vmware-workstation/default.nix0
-rw-r--r--pkgs/applications/window-managers/cwm/default.nix4
-rw-r--r--pkgs/build-support/fetchdocker/credentials.nix1
-rw-r--r--pkgs/build-support/fetchdocker/generic-fetcher.nix2
-rw-r--r--pkgs/by-name/ez/eza/package.nix6
-rw-r--r--pkgs/by-name/fo/fortune-kind/package.nix6
-rw-r--r--pkgs/by-name/ge/geticons/package.nix27
-rw-r--r--pkgs/by-name/km/kmsvnc/package.nix43
-rw-r--r--pkgs/by-name/ko/kokkos/package.nix44
-rw-r--r--pkgs/by-name/pg/pgmoneta/package.nix61
-rw-r--r--pkgs/by-name/tk/tkdiff/189.patch71
-rw-r--r--pkgs/by-name/tk/tkdiff/package.nix43
-rw-r--r--pkgs/by-name/wi/windowmaker/dockapps/AlsaMixer-app.nix55
-rw-r--r--pkgs/by-name/wi/windowmaker/dockapps/cputnik.nix46
-rw-r--r--pkgs/by-name/wi/windowmaker/dockapps/default.nix29
-rw-r--r--pkgs/by-name/wi/windowmaker/dockapps/libdockapp.nix32
-rw-r--r--pkgs/by-name/wi/windowmaker/dockapps/wmCalClock.nix36
-rw-r--r--pkgs/by-name/wi/windowmaker/dockapps/wmcube.nix48
-rw-r--r--pkgs/by-name/wi/windowmaker/dockapps/wmsm-app.nix39
-rw-r--r--pkgs/by-name/wi/windowmaker/dockapps/wmsystemtray.nix36
-rw-r--r--pkgs/by-name/wi/windowmaker/package.nix5
-rw-r--r--pkgs/data/documentation/scheme-manpages/default.nix6
-rw-r--r--pkgs/data/fonts/sketchybar-app-font/default.nix4
-rw-r--r--[-rwxr-xr-x]pkgs/data/fonts/vazir-fonts/default.nix0
-rw-r--r--pkgs/data/icons/tela-circle-icon-theme/default.nix4
-rw-r--r--pkgs/desktops/gnome/core/zenity/default.nix1
-rw-r--r--pkgs/desktops/xfce/applications/xfce4-notifyd/default.nix11
-rw-r--r--pkgs/development/interpreters/janet/default.nix40
-rw-r--r--pkgs/development/libraries/CGAL/default.nix12
-rw-r--r--pkgs/development/libraries/jemalloc/rust.nix24
-rw-r--r--pkgs/development/libraries/virglrenderer/default.nix12
-rw-r--r--pkgs/development/libraries/zlib-ng/default.nix4
-rw-r--r--pkgs/development/php-packages/opentelemetry/default.nix4
-rw-r--r--pkgs/development/php-packages/xdebug/default.nix4
-rw-r--r--pkgs/development/python-modules/aiohomekit/default.nix4
-rw-r--r--pkgs/development/python-modules/annotated-types/default.nix6
-rw-r--r--pkgs/development/python-modules/argilla/default.nix4
-rw-r--r--pkgs/development/python-modules/asdf-transform-schemas/default.nix9
-rw-r--r--[-rwxr-xr-x]pkgs/development/python-modules/atlassian-python-api/default.nix0
-rw-r--r--pkgs/development/python-modules/bellows/default.nix4
-rw-r--r--pkgs/development/python-modules/bespon/default.nix10
-rw-r--r--pkgs/development/python-modules/certbot-dns-ovh/default.nix39
-rw-r--r--pkgs/development/python-modules/chex/default.nix6
-rw-r--r--pkgs/development/python-modules/desktop-entry-lib/default.nix35
-rw-r--r--pkgs/development/python-modules/dramatiq/default.nix106
-rw-r--r--pkgs/development/python-modules/flask-dramatiq/default.nix85
-rw-r--r--pkgs/development/python-modules/fnv-hash-fast/default.nix4
-rw-r--r--pkgs/development/python-modules/gpaw/default.nix4
-rw-r--r--pkgs/development/python-modules/jax/default.nix6
-rw-r--r--pkgs/development/python-modules/jaxlib/bin.nix10
-rw-r--r--pkgs/development/python-modules/jaxlib/default.nix10
-rw-r--r--pkgs/development/python-modules/logilab/common.nix4
-rw-r--r--pkgs/development/python-modules/lsprotocol/default.nix6
-rw-r--r--pkgs/development/python-modules/num2words/default.nix4
-rw-r--r--pkgs/development/python-modules/opsdroid-get-image-size/default.nix (renamed from pkgs/development/python-modules/opsdroid_get_image_size/default.nix)17
-rw-r--r--pkgs/development/python-modules/optuna/default.nix8
-rw-r--r--[-rwxr-xr-x]pkgs/development/python-modules/osmnx/default.nix0
-rw-r--r--pkgs/development/python-modules/periodiq/default.nix55
-rw-r--r--pkgs/development/python-modules/persim/default.nix4
-rw-r--r--pkgs/development/python-modules/polars/default.nix5
-rw-r--r--pkgs/development/python-modules/publicsuffixlist/default.nix4
-rw-r--r--pkgs/development/python-modules/pydiscovergy/default.nix4
-rw-r--r--pkgs/development/python-modules/pytensor/default.nix4
-rw-r--r--pkgs/development/python-modules/pyyardian/default.nix4
-rw-r--r--pkgs/development/python-modules/recaptcha_client/default.nix23
-rw-r--r--pkgs/development/python-modules/rtree/default.nix4
-rw-r--r--pkgs/development/python-modules/sphinx_pypi_upload/default.nix21
-rw-r--r--pkgs/development/python-modules/staticmap/default.nix31
-rw-r--r--[-rwxr-xr-x]pkgs/development/python-modules/streamlit/default.nix0
-rw-r--r--pkgs/development/python-modules/twilio/default.nix4
-rw-r--r--pkgs/development/python-modules/universal-pathlib/default.nix4
-rw-r--r--pkgs/development/python-modules/vehicle/default.nix6
-rw-r--r--pkgs/development/python-modules/watchdog-gevent/default.nix40
-rw-r--r--pkgs/development/python-modules/zope-lifecycleevent/default.nix44
-rw-r--r--pkgs/development/python-modules/zope_lifecycleevent/default.nix36
-rw-r--r--[-rwxr-xr-x]pkgs/development/python-modules/zstandard/default.nix0
-rw-r--r--pkgs/development/tools/buildkit/default.nix4
-rw-r--r--pkgs/development/tools/continuous-integration/jenkins/default.nix4
-rw-r--r--pkgs/development/tools/electron/binary/generic.nix2
-rw-r--r--pkgs/development/tools/kustomize/default.nix6
-rw-r--r--pkgs/development/tools/misc/runme/default.nix2
-rw-r--r--pkgs/development/tools/misc/slint-lsp/default.nix6
-rw-r--r--pkgs/development/tools/mold/default.nix4
-rw-r--r--pkgs/development/tools/poetry2nix/poetry2nix/overrides/build-systems.json3
-rw-r--r--pkgs/development/tools/railway/default.nix6
-rw-r--r--pkgs/development/tools/ruff/default.nix11
-rw-r--r--pkgs/development/tools/symfony-cli/default.nix6
-rw-r--r--pkgs/development/web/nodejs/v21.nix19
-rw-r--r--[-rwxr-xr-x]pkgs/misc/uq/default.nix0
-rw-r--r--pkgs/os-specific/linux/cpufrequtils/default.nix3
-rw-r--r--pkgs/os-specific/linux/kernel/common-config.nix113
-rw-r--r--pkgs/os-specific/linux/kernel/hardened/patches.json10
-rw-r--r--pkgs/os-specific/linux/kernel/kernels-org.json12
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/bootstrap-sources.nix4
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/make-bootstrap-sources.nix3
-rw-r--r--pkgs/os-specific/linux/oci-seccomp-bpf-hook/default.nix4
-rw-r--r--pkgs/os-specific/linux/ryzenadj/default.nix2
-rw-r--r--pkgs/servers/computing/slurm/default.nix4
-rw-r--r--pkgs/servers/geospatial/fit-trackee/default.nix105
-rw-r--r--pkgs/servers/http/apache-httpd/2.4.nix4
-rw-r--r--pkgs/servers/http/lighttpd/default.nix15
-rw-r--r--pkgs/servers/http/lighttpd/disable-legacy-crypt-tests.patch35
-rw-r--r--pkgs/servers/http/nginx/generic.nix16
-rw-r--r--pkgs/servers/kanidm/default.nix2
-rw-r--r--pkgs/servers/mail/spamassassin/default.nix3
-rw-r--r--pkgs/servers/matrix-conduit/default.nix6
-rw-r--r--pkgs/servers/monitoring/librenms/default.nix1
-rw-r--r--pkgs/servers/monitoring/telegraf/default.nix6
-rw-r--r--pkgs/servers/nosql/redis/default.nix4
-rw-r--r--pkgs/servers/search/qdrant/default.nix6
-rw-r--r--pkgs/servers/search/quickwit/default.nix5
-rw-r--r--pkgs/servers/shairport-sync/default.nix4
-rw-r--r--pkgs/servers/sickbeard/sickgear.nix4
-rw-r--r--pkgs/servers/snac2/default.nix4
-rw-r--r--pkgs/servers/soft-serve/default.nix6
-rw-r--r--pkgs/servers/sql/pgbouncer/default.nix4
-rw-r--r--[-rwxr-xr-x]pkgs/servers/unifi-video/default.nix0
-rw-r--r--pkgs/servers/web-apps/lemmy/package.json2
-rw-r--r--pkgs/servers/web-apps/lemmy/pin.json10
-rw-r--r--pkgs/shells/fish/default.nix2
-rw-r--r--pkgs/shells/fish/plugins/tide.nix4
-rw-r--r--pkgs/shells/fish/wrapper.nix2
-rw-r--r--pkgs/shells/nushell/plugins/default.nix1
-rw-r--r--pkgs/shells/nushell/plugins/regex.nix32
-rw-r--r--pkgs/tools/X11/xssstate/default.nix24
-rw-r--r--pkgs/tools/admin/chamber/default.nix6
-rw-r--r--pkgs/tools/admin/pgadmin/default.nix8
-rw-r--r--pkgs/tools/admin/pgadmin/expose-setup.py.patch28
-rwxr-xr-xpkgs/tools/admin/pgadmin/update.sh2
-rw-r--r--pkgs/tools/admin/pgadmin/yarn.lock288
-rw-r--r--pkgs/tools/admin/stripe-cli/default.nix4
-rw-r--r--[-rwxr-xr-x]pkgs/tools/archivers/payload-dumper-go/default.nix0
-rw-r--r--pkgs/tools/audio/openai-whisper-cpp/default.nix4
-rw-r--r--pkgs/tools/graphics/wdisplays/default.nix16
-rw-r--r--pkgs/tools/misc/dooit/default.nix4
-rw-r--r--pkgs/tools/misc/esphome/default.nix4
-rw-r--r--pkgs/tools/misc/fd/default.nix4
-rw-r--r--pkgs/tools/misc/fzf/default.nix5
-rw-r--r--pkgs/tools/misc/progress/default.nix4
-rw-r--r--pkgs/tools/misc/remind/default.nix4
-rw-r--r--[-rwxr-xr-x]pkgs/tools/misc/starfetch/default.nix0
-rw-r--r--[-rwxr-xr-x]pkgs/tools/misc/szyszka/default.nix0
-rw-r--r--pkgs/tools/misc/tbls/default.nix6
-rw-r--r--pkgs/tools/misc/turbo/default.nix2
-rw-r--r--pkgs/tools/misc/uutils-coreutils/default.nix6
-rw-r--r--pkgs/tools/misc/vector/default.nix3
-rw-r--r--pkgs/tools/networking/ddclient/default.nix53
-rw-r--r--[-rwxr-xr-x]pkgs/tools/networking/ipfetch/default.nix0
-rw-r--r--pkgs/tools/networking/sish/default.nix6
-rw-r--r--pkgs/tools/networking/voms/default.nix15
-rw-r--r--pkgs/tools/networking/xrootd/default.nix23
-rw-r--r--pkgs/tools/networking/xrootd/fetchxrd.nix4
-rw-r--r--pkgs/tools/package-management/nix/default.nix8
-rw-r--r--pkgs/tools/security/aws-iam-authenticator/default.nix23
-rw-r--r--pkgs/tools/security/exploitdb/default.nix4
-rw-r--r--pkgs/tools/security/ldeep/default.nix4
-rw-r--r--pkgs/tools/security/metasploit/Gemfile2
-rw-r--r--pkgs/tools/security/metasploit/Gemfile.lock18
-rw-r--r--pkgs/tools/security/metasploit/default.nix4
-rw-r--r--pkgs/tools/security/metasploit/gemset.nix10
-rw-r--r--pkgs/tools/security/scrypt/default.nix4
-rw-r--r--pkgs/tools/security/sshocker/default.nix6
-rw-r--r--pkgs/tools/text/ov/default.nix6
-rw-r--r--pkgs/tools/text/rsbkb/default.nix6
-rw-r--r--pkgs/tools/typesetting/sile/default.nix4
-rw-r--r--pkgs/tools/wayland/swaykbdd/default.nix4
-rw-r--r--pkgs/top-level/aliases.nix1
-rw-r--r--pkgs/top-level/all-packages.nix42
-rw-r--r--pkgs/top-level/perl-packages.nix43
-rw-r--r--pkgs/top-level/python-aliases.nix4
-rw-r--r--pkgs/top-level/python-packages.nix26
305 files changed, 2935 insertions, 2095 deletions
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 6344ca3902ee..7bca80f5af88 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -24,10 +24,10 @@
 # Libraries
 /lib                        @edolstra @infinisil
 /lib/systems                @alyssais @ericson2314 @amjoseph-nixpkgs
-/lib/generators.nix         @edolstra @Profpatsch
-/lib/cli.nix                @edolstra @Profpatsch
-/lib/debug.nix              @edolstra @Profpatsch
-/lib/asserts.nix            @edolstra @Profpatsch
+/lib/generators.nix         @infinisil @edolstra @Profpatsch
+/lib/cli.nix                @infinisil @edolstra @Profpatsch
+/lib/debug.nix              @infinisil @edolstra @Profpatsch
+/lib/asserts.nix            @infinisil @edolstra @Profpatsch
 /lib/path.*                 @infinisil @fricklerhandwerk
 /lib/fileset                @infinisil
 /doc/functions/fileset.section.md @infinisil
diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
index 4517080bb301..a7d8a1786562 100644
--- a/.github/PULL_REQUEST_TEMPLATE.md
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -14,7 +14,9 @@ For new packages please briefly describe the package or provide a link to its ho
   - [ ] aarch64-linux
   - [ ] x86_64-darwin
   - [ ] aarch64-darwin
-- [ ] For non-Linux: Is `sandbox = true` set in `nix.conf`? (See [Nix manual](https://nixos.org/manual/nix/stable/command-ref/conf-file.html))
+- For non-Linux: Is sandboxing enabled in `nix.conf`? (See [Nix manual](https://nixos.org/manual/nix/stable/command-ref/conf-file.html))
+  - [ ] `sandbox = relaxed`
+  - [ ] `sandbox = true`
 - [ ] Tested, as applicable:
   - [NixOS test(s)](https://nixos.org/manual/nixos/unstable/index.html#sec-nixos-tests) (look inside [nixos/tests](https://github.com/NixOS/nixpkgs/blob/master/nixos/tests))
   - and/or [package tests](https://nixos.org/manual/nixpkgs/unstable/#sec-package-tests)
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 37164565c13c..5294b18995e1 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -2608,12 +2608,6 @@
     githubId = 200617;
     name = "Ben Sima";
   };
-  bstrik = {
-    email = "dutchman55@gmx.com";
-    github = "bstrik";
-    githubId = 7716744;
-    name = "Berno Strik";
-  };
   btlvr = {
     email = "btlvr@protonmail.com";
     github = "btlvr";
@@ -3886,6 +3880,13 @@
     githubId = 107034852;
     name = "Daniyal Suri";
   };
+  dannixon = {
+    email = "dan@dan-nixon.com";
+    github = "DanNixon";
+    githubId = 4037377;
+    name = "Dan Nixon";
+    matrix = "@dannixon:matrix.org";
+  };
   dansbandit = {
     github = "dansbandit";
     githubId = 4530687;
@@ -11666,6 +11667,13 @@
     githubId = 149558;
     name = "Merlin Gaillard";
   };
+  mirkolenz = {
+    name = "Mirko Lenz";
+    email = "mirko@mirkolenz.com";
+    matrix = "@mlenz:matrix.org";
+    github = "mirkolenz";
+    githubId = 5160954;
+  };
   mirrexagon = {
     email = "mirrexagon@mirrexagon.com";
     github = "mirrexagon";
@@ -15042,6 +15050,12 @@
     githubId = 496447;
     name = "Robert Hensing";
   };
+  robert-manchester = {
+    email = "robert.manchester@gmail.com";
+    github = "robert-manchester";
+    githubId = 86313040;
+    name = "Robert Manchester";
+  };
   robertodr = {
     email = "roberto.diremigio@gmail.com";
     github = "robertodr";
diff --git a/maintainers/scripts/pluginupdate.py b/maintainers/scripts/pluginupdate.py
index 5ceaab8db901..52e9af399709 100644
--- a/maintainers/scripts/pluginupdate.py
+++ b/maintainers/scripts/pluginupdate.py
@@ -786,8 +786,11 @@ def update_plugins(editor: Editor, args):
     autocommit = not args.no_commit
 
     if autocommit:
+        from datetime import date
         editor.nixpkgs_repo = git.Repo(editor.root, search_parent_directories=True)
-        commit(editor.nixpkgs_repo, f"{editor.attr_path}: update", [args.outfile])
+        updated = date.today().strftime('%m-%d-%Y')
+
+        commit(editor.nixpkgs_repo, f"{editor.attr_path}: updated the {updated}", [args.outfile])
 
     if redirects:
         update()
diff --git a/nixos/doc/manual/development/what-happens-during-a-system-switch.chapter.md b/nixos/doc/manual/development/what-happens-during-a-system-switch.chapter.md
index 5d6d67f1aa92..82522b33740e 100644
--- a/nixos/doc/manual/development/what-happens-during-a-system-switch.chapter.md
+++ b/nixos/doc/manual/development/what-happens-during-a-system-switch.chapter.md
@@ -44,6 +44,10 @@ of actions is always the same:
 - Inspect what changed during these actions and print units that failed and
   that were newly started
 
+By default, some units are filtered from the outputs to make it less spammy.
+This can be disabled for development or testing by setting the environment variable
+`STC_DISPLAY_ALL_UNITS=1`
+
 Most of these actions are either self-explaining but some of them have to do
 with our units or the activation script. For this reason, these topics are
 explained in the next sections.
diff --git a/nixos/doc/manual/release-notes/rl-2311.section.md b/nixos/doc/manual/release-notes/rl-2311.section.md
index 2368480d045b..38c89668f84a 100644
--- a/nixos/doc/manual/release-notes/rl-2311.section.md
+++ b/nixos/doc/manual/release-notes/rl-2311.section.md
@@ -254,6 +254,8 @@
 
 - Garage has been upgraded to 0.9.x. `services.garage.package` now needs to be explicitly set, so version upgrades can be done in a controlled fashion. For this, we expose `garage_x_y` attributes which can be set here.
 
+- `voms` and `xrootd` now moves the `$out/etc` content to the `$etc` output instead of `$out/etc.orig`, when input argument `externalEtc` is not `null`.
+
 - The `woodpecker-*` CI packages have been updated to 1.0.0. This release is wildly incompatible with the 0.15.X versions that were previously packaged. Please read [upstream's documentation](https://woodpecker-ci.org/docs/next/migrations#100) to learn how to update your CI configurations.
 
 - The Caddy module gained a new option named `services.caddy.enableReload` which is enabled by default. It allows reloading the service instead of restarting it, if only a config file has changed. This option must be disabled if you have turned off the [Caddy admin API](https://caddyserver.com/docs/caddyfile/options#admin). If you keep this option enabled, you should consider setting [`grace_period`](https://caddyserver.com/docs/caddyfile/options#grace-period) to a non-infinite value to prevent Caddy from delaying the reload indefinitely.
@@ -355,6 +357,8 @@
 
 - The application firewall `opensnitch` now uses the process monitor method eBPF as default as recommended by upstream. The method can be changed with the setting [services.opensnitch.settings.ProcMonitorMethod](#opt-services.opensnitch.settings.ProcMonitorMethod).
 
+- `services.hedgedoc` has been heavily refactored, reducing the amount of declared options in the module. Most of the options should still work without any changes. Some options have been deprecated, as they no longer have any effect. See [#244941](https://github.com/NixOS/nixpkgs/pull/244941) for more details.
+
 - The module [services.ankisyncd](#opt-services.ankisyncd.package) has been switched to [anki-sync-server-rs](https://github.com/ankicommunity/anki-sync-server-rs) from the old python version, which was difficult to update, had not been updated in a while, and did not support recent versions of anki.
 Unfortunately all servers supporting new clients (newer version of anki-sync-server, anki's built in sync server and this new rust package) do not support the older sync protocol that was used in the old server, so such old clients will also need updating and in particular the anki package in nixpkgs is also being updated in this release.
 The module update takes care of the new config syntax and the data itself (user login and cards) are compatible, so users of the module will be able to just log in again after updating both client and server without any extra action.
diff --git a/nixos/modules/config/iproute2.nix b/nixos/modules/config/iproute2.nix
index 8f49e7dbf7de..7e4fb4d848e3 100644
--- a/nixos/modules/config/iproute2.nix
+++ b/nixos/modules/config/iproute2.nix
@@ -7,7 +7,7 @@ let
 in
 {
   options.networking.iproute2 = {
-    enable = mkEnableOption (lib.mdDoc "copy IP route configuration files");
+    enable = mkEnableOption (lib.mdDoc "copying IP route configuration files");
     rttablesExtraConfig = mkOption {
       type = types.lines;
       default = "";
diff --git a/nixos/modules/config/stevenblack.nix b/nixos/modules/config/stevenblack.nix
index 07a0aa339a56..30ef7ff259f0 100644
--- a/nixos/modules/config/stevenblack.nix
+++ b/nixos/modules/config/stevenblack.nix
@@ -15,7 +15,7 @@ let
 in
 {
   options.networking.stevenblack = {
-    enable = mkEnableOption (mdDoc "Enable the stevenblack hosts file blocklist");
+    enable = mkEnableOption (mdDoc "the stevenblack hosts file blocklist");
 
     block = mkOption {
       type = types.listOf (types.enum [ "fakenews" "gambling" "porn" "social" ]);
diff --git a/nixos/modules/hardware/corectrl.nix b/nixos/modules/hardware/corectrl.nix
index 965cbe0267e0..8ef61a158d5c 100644
--- a/nixos/modules/hardware/corectrl.nix
+++ b/nixos/modules/hardware/corectrl.nix
@@ -8,13 +8,13 @@ in
 {
   options.programs.corectrl = {
     enable = mkEnableOption (lib.mdDoc ''
-      A tool to overclock amd graphics cards and processors.
+      CoreCtrl, a tool to overclock amd graphics cards and processors.
       Add your user to the corectrl group to run corectrl without needing to enter your password
     '');
 
     gpuOverclock = {
       enable = mkEnableOption (lib.mdDoc ''
-        true
+        GPU overclocking
       '');
       ppfeaturemask = mkOption {
         type = types.str;
diff --git a/nixos/modules/hardware/i2c.nix b/nixos/modules/hardware/i2c.nix
index 9a5a2e44813e..bd4c4ebe21bd 100644
--- a/nixos/modules/hardware/i2c.nix
+++ b/nixos/modules/hardware/i2c.nix
@@ -11,7 +11,7 @@ in
     enable = mkEnableOption (lib.mdDoc ''
       i2c devices support. By default access is granted to users in the "i2c"
       group (will be created if non-existent) and any user with a seat, meaning
-      logged on the computer locally.
+      logged on the computer locally
     '');
 
     group = mkOption {
diff --git a/nixos/modules/hardware/keyboard/uhk.nix b/nixos/modules/hardware/keyboard/uhk.nix
index 17baff83d886..ff984fa5daa6 100644
--- a/nixos/modules/hardware/keyboard/uhk.nix
+++ b/nixos/modules/hardware/keyboard/uhk.nix
@@ -11,7 +11,7 @@ in
       non-root access to the firmware of UHK keyboards.
       You need it when you want to flash a new firmware on the keyboard.
       Access to the keyboard is granted to users in the "input" group.
-      You may want to install the uhk-agent package.
+      You may want to install the uhk-agent package
     '');
 
   };
diff --git a/nixos/modules/hardware/keyboard/zsa.nix b/nixos/modules/hardware/keyboard/zsa.nix
index a04b67b5c8d0..191fb12cca4f 100644
--- a/nixos/modules/hardware/keyboard/zsa.nix
+++ b/nixos/modules/hardware/keyboard/zsa.nix
@@ -11,7 +11,7 @@ in
       udev rules for keyboards from ZSA like the ErgoDox EZ, Planck EZ and Moonlander Mark I.
       You need it when you want to flash a new configuration on the keyboard
       or use their live training in the browser.
-      You may want to install the wally-cli package.
+      You may want to install the wally-cli package
     '');
   };
 
diff --git a/nixos/modules/hardware/openrazer.nix b/nixos/modules/hardware/openrazer.nix
index aaa4000e758f..abbafaee8950 100644
--- a/nixos/modules/hardware/openrazer.nix
+++ b/nixos/modules/hardware/openrazer.nix
@@ -50,7 +50,7 @@ in
   options = {
     hardware.openrazer = {
       enable = mkEnableOption (lib.mdDoc ''
-        OpenRazer drivers and userspace daemon.
+        OpenRazer drivers and userspace daemon
       '');
 
       verboseLogging = mkOption {
diff --git a/nixos/modules/hardware/tuxedo-keyboard.nix b/nixos/modules/hardware/tuxedo-keyboard.nix
index 3ae876bd1f18..fd8b48a5e9ea 100644
--- a/nixos/modules/hardware/tuxedo-keyboard.nix
+++ b/nixos/modules/hardware/tuxedo-keyboard.nix
@@ -9,7 +9,7 @@ in
   {
     options.hardware.tuxedo-keyboard = {
       enable = mkEnableOption (lib.mdDoc ''
-          Enables the tuxedo-keyboard driver.
+          the tuxedo-keyboard driver.
 
           To configure the driver, pass the options to the {option}`boot.kernelParams` configuration.
           There are several parameters you can change. It's best to check at the source code description which options are supported.
diff --git a/nixos/modules/hardware/video/nvidia.nix b/nixos/modules/hardware/video/nvidia.nix
index a40713ac25c7..4320edf60da5 100644
--- a/nixos/modules/hardware/video/nvidia.nix
+++ b/nixos/modules/hardware/video/nvidia.nix
@@ -24,7 +24,7 @@ in {
   options = {
     hardware.nvidia = {
       datacenter.enable = lib.mkEnableOption (lib.mdDoc ''
-        Data Center drivers for NVIDIA cards on a NVLink topology.
+        Data Center drivers for NVIDIA cards on a NVLink topology
       '');
       datacenter.settings = lib.mkOption {
         type = settingsFormat.type;
@@ -79,18 +79,18 @@ in {
 
       powerManagement.enable = lib.mkEnableOption (lib.mdDoc ''
         experimental power management through systemd. For more information, see
-        the NVIDIA docs, on Chapter 21. Configuring Power Management Support.
+        the NVIDIA docs, on Chapter 21. Configuring Power Management Support
       '');
 
       powerManagement.finegrained = lib.mkEnableOption (lib.mdDoc ''
         experimental power management of PRIME offload. For more information, see
-        the NVIDIA docs, on Chapter 22. PCI-Express Runtime D3 (RTD3) Power Management.
+        the NVIDIA docs, on Chapter 22. PCI-Express Runtime D3 (RTD3) Power Management
       '');
 
       dynamicBoost.enable = lib.mkEnableOption (lib.mdDoc ''
         dynamic Boost balances power between the CPU and the GPU for improved
         performance on supported laptops using the nvidia-powerd daemon. For more
-        information, see the NVIDIA docs, on Chapter 23. Dynamic Boost on Linux.
+        information, see the NVIDIA docs, on Chapter 23. Dynamic Boost on Linux
       '');
 
       modesetting.enable = lib.mkEnableOption (lib.mdDoc ''
@@ -99,7 +99,7 @@ in {
         Enabling this fixes screen tearing when using Optimus via PRIME (see
         {option}`hardware.nvidia.prime.sync.enable`. This is not enabled
         by default because it is not officially supported by NVIDIA and would not
-        work with SLI.
+        work with SLI
       '');
 
       prime.nvidiaBusId = lib.mkOption {
@@ -153,11 +153,11 @@ in {
 
         Note that this configuration will only be successful when a display manager
         for which the {option}`services.xserver.displayManager.setupCommands`
-        option is supported is used.
+        option is supported is used
       '');
 
       prime.allowExternalGpu = lib.mkEnableOption (lib.mdDoc ''
-        configuring X to allow external NVIDIA GPUs when using Prime [Reverse] sync optimus.
+        configuring X to allow external NVIDIA GPUs when using Prime [Reverse] sync optimus
       '');
 
       prime.offload.enable = lib.mkEnableOption (lib.mdDoc ''
@@ -166,7 +166,7 @@ in {
         If this is enabled, then the bus IDs of the NVIDIA and Intel/AMD GPUs have to
         be specified ({option}`hardware.nvidia.prime.nvidiaBusId` and
         {option}`hardware.nvidia.prime.intelBusId` or
-        {option}`hardware.nvidia.prime.amdgpuBusId`).
+        {option}`hardware.nvidia.prime.amdgpuBusId`)
       '');
 
       prime.offload.enableOffloadCmd = lib.mkEnableOption (lib.mdDoc ''
@@ -174,7 +174,7 @@ in {
         for offloading programs to an nvidia device. To work, should have also enabled
         {option}`hardware.nvidia.prime.offload.enable` or {option}`hardware.nvidia.prime.reverseSync.enable`.
 
-        Example usage `nvidia-offload sauerbraten_client`.
+        Example usage `nvidia-offload sauerbraten_client`
       '');
 
       prime.reverseSync.enable = lib.mkEnableOption (lib.mdDoc ''
@@ -202,25 +202,25 @@ in {
 
         Note that this configuration will only be successful when a display manager
         for which the {option}`services.xserver.displayManager.setupCommands`
-        option is supported is used.
+        option is supported is used
       '');
 
       nvidiaSettings =
         (lib.mkEnableOption (lib.mdDoc ''
-          nvidia-settings, NVIDIA's GUI configuration tool.
+          nvidia-settings, NVIDIA's GUI configuration tool
         ''))
         // {default = true;};
 
       nvidiaPersistenced = lib.mkEnableOption (lib.mdDoc ''
         nvidia-persistenced a update for NVIDIA GPU headless mode, i.e.
-        It ensures all GPUs stay awake even during headless mode.
+        It ensures all GPUs stay awake even during headless mode
       '');
 
       forceFullCompositionPipeline = lib.mkEnableOption (lib.mdDoc ''
         forcefully the full composition pipeline.
         This sometimes fixes screen tearing issues.
         This has been reported to reduce the performance of some OpenGL applications and may produce issues in WebGL.
-        It also drastically increases the time the driver needs to clock down after load.
+        It also drastically increases the time the driver needs to clock down after load
       '');
 
       package = lib.mkOption {
diff --git a/nixos/modules/hardware/video/webcam/facetimehd.nix b/nixos/modules/hardware/video/webcam/facetimehd.nix
index 480c636aa0d9..a0ec9c98a54c 100644
--- a/nixos/modules/hardware/video/webcam/facetimehd.nix
+++ b/nixos/modules/hardware/video/webcam/facetimehd.nix
@@ -12,7 +12,7 @@ in
 
 {
 
-  options.hardware.facetimehd.enable = mkEnableOption (lib.mdDoc "facetimehd kernel module");
+  options.hardware.facetimehd.enable = mkEnableOption (lib.mdDoc "the facetimehd kernel module");
 
   options.hardware.facetimehd.withCalibration = mkOption {
     default = false;
diff --git a/nixos/modules/misc/ids.nix b/nixos/modules/misc/ids.nix
index dc59ccb357d4..5b278b5e8062 100644
--- a/nixos/modules/misc/ids.nix
+++ b/nixos/modules/misc/ids.nix
@@ -69,7 +69,7 @@ in
       #dialout = 27; # unused
       polkituser = 28;
       #utmp = 29; # unused
-      # ddclient = 30; # software removed
+      # ddclient = 30; # converted to DynamicUser = true
       davfs2 = 31;
       disnix = 33;
       osgi = 34;
@@ -394,7 +394,7 @@ in
       dialout = 27;
       #polkituser = 28; # currently unused, polkitd doesn't need a group
       utmp = 29;
-      # ddclient = 30; # software removed
+      # ddclient = 30; # converted to DynamicUser = true
       davfs2 = 31;
       disnix = 33;
       osgi = 34;
diff --git a/nixos/modules/misc/nixops-autoluks.nix b/nixos/modules/misc/nixops-autoluks.nix
index 221b34f3cc36..e6817633119d 100644
--- a/nixos/modules/misc/nixops-autoluks.nix
+++ b/nixos/modules/misc/nixops-autoluks.nix
@@ -5,7 +5,7 @@ let
 
   inherit (config.nixops) enableDeprecatedAutoLuks;
 in {
-  options.nixops.enableDeprecatedAutoLuks = lib.mkEnableOption (lib.mdDoc "Enable the deprecated NixOps AutoLuks module");
+  options.nixops.enableDeprecatedAutoLuks = lib.mkEnableOption (lib.mdDoc "the deprecated NixOps AutoLuks module");
 
   config = {
     assertions = [
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 2c06f4931725..79918f71f7be 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -884,6 +884,7 @@
   ./services/networking/dae.nix
   ./services/networking/dante.nix
   ./services/networking/deconz.nix
+  ./services/networking/ddclient.nix
   ./services/networking/dhcpcd.nix
   ./services/networking/dnscache.nix
   ./services/networking/dnscrypt-proxy2.nix
diff --git a/nixos/modules/programs/calls.nix b/nixos/modules/programs/calls.nix
index 7a18982915a9..3d757bc1fc32 100644
--- a/nixos/modules/programs/calls.nix
+++ b/nixos/modules/programs/calls.nix
@@ -8,7 +8,7 @@ in {
   options = {
     programs.calls = {
       enable = mkEnableOption (lib.mdDoc ''
-        Whether to enable GNOME calls: a phone dialer and call handler.
+        GNOME calls: a phone dialer and call handler
       '');
     };
   };
diff --git a/nixos/modules/programs/cnping.nix b/nixos/modules/programs/cnping.nix
index d3cf659d4297..143267fc9a42 100644
--- a/nixos/modules/programs/cnping.nix
+++ b/nixos/modules/programs/cnping.nix
@@ -8,7 +8,7 @@ in
 {
   options = {
     programs.cnping = {
-      enable = mkEnableOption (lib.mdDoc "Whether to install a setcap wrapper for cnping");
+      enable = mkEnableOption (lib.mdDoc "a setcap wrapper for cnping");
     };
   };
 
diff --git a/nixos/modules/programs/direnv.nix b/nixos/modules/programs/direnv.nix
index 1a80cb202806..77a6568e73b8 100644
--- a/nixos/modules/programs/direnv.nix
+++ b/nixos/modules/programs/direnv.nix
@@ -11,7 +11,7 @@ in {
     enable = lib.mkEnableOption (lib.mdDoc ''
       direnv integration. Takes care of both installation and
       setting up the sourcing of the shell. Additionally enables nix-direnv
-      integration. Note that you need to logout and login for this change to apply.
+      integration. Note that you need to logout and login for this change to apply
     '');
 
     package = lib.mkPackageOptionMD pkgs "direnv" {};
diff --git a/nixos/modules/programs/feedbackd.nix b/nixos/modules/programs/feedbackd.nix
index cee8daa31462..e3fde947a3df 100644
--- a/nixos/modules/programs/feedbackd.nix
+++ b/nixos/modules/programs/feedbackd.nix
@@ -8,9 +8,9 @@ in {
   options = {
     programs.feedbackd = {
       enable = mkEnableOption (lib.mdDoc ''
-        Whether to enable the feedbackd D-BUS service and udev rules.
+        the feedbackd D-BUS service and udev rules.
 
-        Your user needs to be in the `feedbackd` group to trigger effects.
+        Your user needs to be in the `feedbackd` group to trigger effects
       '');
       package = mkOption {
         description = lib.mdDoc ''
diff --git a/nixos/modules/programs/fish.nix b/nixos/modules/programs/fish.nix
index b500b8f24b2c..e6ac6e9957ba 100644
--- a/nixos/modules/programs/fish.nix
+++ b/nixos/modules/programs/fish.nix
@@ -208,7 +208,7 @@ in
         end
 
         # if we haven't sourced the login config, do it
-        status --is-login; and not set -q __fish_nixos_login_config_sourced
+        status is-login; and not set -q __fish_nixos_login_config_sourced
         and begin
           ${sourceEnv "loginShellInit"}
 
@@ -220,7 +220,7 @@ in
         end
 
         # if we haven't sourced the interactive config, do it
-        status --is-interactive; and not set -q __fish_nixos_interactive_config_sourced
+        status is-interactive; and not set -q __fish_nixos_interactive_config_sourced
         and begin
           ${fishAbbrs}
           ${fishAliases}
diff --git a/nixos/modules/programs/kdeconnect.nix b/nixos/modules/programs/kdeconnect.nix
index 4978c428ce34..4ba156f2db8d 100644
--- a/nixos/modules/programs/kdeconnect.nix
+++ b/nixos/modules/programs/kdeconnect.nix
@@ -9,7 +9,7 @@ with lib;
       1714 to 1764 as they are needed for it to function properly.
       You can use the {option}`package` to use
       `gnomeExtensions.gsconnect` as an alternative
-      implementation if you use Gnome.
+      implementation if you use Gnome
     '');
     package = mkOption {
       default = pkgs.plasma5Packages.kdeconnect-kde;
diff --git a/nixos/modules/programs/wayland/wayfire.nix b/nixos/modules/programs/wayland/wayfire.nix
index d0b280e3940f..9ea2010cf59c 100644
--- a/nixos/modules/programs/wayland/wayfire.nix
+++ b/nixos/modules/programs/wayland/wayfire.nix
@@ -6,7 +6,7 @@ in
   meta.maintainers = with lib.maintainers; [ rewine ];
 
   options.programs.wayfire = {
-    enable = lib.mkEnableOption (lib.mdDoc "Wayfire, a wayland compositor based on wlroots.");
+    enable = lib.mkEnableOption (lib.mdDoc "Wayfire, a wayland compositor based on wlroots");
 
     package = lib.mkPackageOptionMD pkgs "wayfire" { };
 
diff --git a/nixos/modules/rename.nix b/nixos/modules/rename.nix
index 408c515044c8..0fbb2351f986 100644
--- a/nixos/modules/rename.nix
+++ b/nixos/modules/rename.nix
@@ -54,7 +54,6 @@ in
     (mkRemovedOptionModule [ "services" "chronos" ] "The corresponding package was removed from nixpkgs.")
     (mkRemovedOptionModule [ "services" "couchpotato" ] "The corresponding package was removed from nixpkgs.")
     (mkRemovedOptionModule [ "services" "dd-agent" ] "dd-agent was removed from nixpkgs in favor of the newer datadog-agent.")
-    (mkRemovedOptionModule [ "services" "ddclient" ] "ddclient has been removed on the request of the upstream maintainer because it is unmaintained and has bugs. Please switch to a different software like `inadyn` or `knsupdate`.") # Added 2023-07-04
     (mkRemovedOptionModule [ "services" "dnscrypt-proxy" ] "Use services.dnscrypt-proxy2 instead")
     (mkRemovedOptionModule [ "services" "exhibitor" ] "The corresponding package was removed from nixpkgs.")
     (mkRemovedOptionModule [ "services" "firefox" "syncserver" ] "The corresponding package was removed from nixpkgs.")
diff --git a/nixos/modules/services/backup/znapzend.nix b/nixos/modules/services/backup/znapzend.nix
index 76f147c18aff..2ebe8ad2f69a 100644
--- a/nixos/modules/services/backup/znapzend.nix
+++ b/nixos/modules/services/backup/znapzend.nix
@@ -359,14 +359,14 @@ in
       };
 
       features.oracleMode = mkEnableOption (lib.mdDoc ''
-        Destroy snapshots one by one instead of using one long argument list.
+        destroying snapshots one by one instead of using one long argument list.
         If source and destination are out of sync for a long time, you may have
         so many snapshots to destroy that the argument gets is too long and the
-        command fails.
+        command fails
       '');
       features.recvu = mkEnableOption (lib.mdDoc ''
         recvu feature which uses `-u` on the receiving end to keep the destination
-        filesystem unmounted.
+        filesystem unmounted
       '');
       features.compressed = mkEnableOption (lib.mdDoc ''
         compressed feature which adds the options `-Lce` to
@@ -377,7 +377,7 @@ in
         support and -e is for embedded data support. see
         {manpage}`znapzend(1)`
         and {manpage}`zfs(8)`
-        for more info.
+        for more info
       '');
       features.sendRaw = mkEnableOption (lib.mdDoc ''
         sendRaw feature which adds the options `-w` to the
@@ -386,25 +386,25 @@ in
         backup that can't be read without the encryption key/passphrase, useful
         when the remote isn't fully trusted or not physically secure. This
         option must be used consistently, raw incrementals cannot be based on
-        non-raw snapshots and vice versa.
+        non-raw snapshots and vice versa
       '');
       features.skipIntermediates = mkEnableOption (lib.mdDoc ''
-        Enable the skipIntermediates feature to send a single increment
+        the skipIntermediates feature to send a single increment
         between latest common snapshot and the newly made one. It may skip
         several source snaps if the destination was offline for some time, and
         it should skip snapshots not managed by znapzend. Normally for online
         destinations, the new snapshot is sent as soon as it is created on the
-        source, so there are no automatic increments to skip.
+        source, so there are no automatic increments to skip
       '');
       features.lowmemRecurse = mkEnableOption (lib.mdDoc ''
         use lowmemRecurse on systems where you have too many datasets, so a
         recursive listing of attributes to find backup plans exhausts the
         memory available to {command}`znapzend`: instead, go the slower
         way to first list all impacted dataset names, and then query their
-        configs one by one.
+        configs one by one
       '');
       features.zfsGetType = mkEnableOption (lib.mdDoc ''
-        use zfsGetType if your {command}`zfs get` supports a
+        using zfsGetType if your {command}`zfs get` supports a
         `-t` argument for filtering by dataset type at all AND
         lists properties for snapshots by default when recursing, so that there
         is too much data to process while searching for backup plans.
@@ -412,7 +412,7 @@ in
         `--recursive` search for backup plans can literally
         differ by hundreds of times (depending on the amount of snapshots in
         that dataset tree... and a decent backup plan will ensure you have a lot
-        of those), so you would benefit from requesting this feature.
+        of those), so you would benefit from requesting this feature
       '');
     };
   };
diff --git a/nixos/modules/services/databases/cassandra.nix b/nixos/modules/services/databases/cassandra.nix
index e26acb88d8c8..cd816ffaf0dd 100644
--- a/nixos/modules/services/databases/cassandra.nix
+++ b/nixos/modules/services/databases/cassandra.nix
@@ -122,7 +122,7 @@ in
   options.services.cassandra = {
 
     enable = mkEnableOption (lib.mdDoc ''
-      Apache Cassandra – Scalable and highly available database.
+      Apache Cassandra – Scalable and highly available database
     '');
 
     clusterName = mkOption {
diff --git a/nixos/modules/services/databases/ferretdb.nix b/nixos/modules/services/databases/ferretdb.nix
index 5b2cc59d8c06..45f822d64691 100644
--- a/nixos/modules/services/databases/ferretdb.nix
+++ b/nixos/modules/services/databases/ferretdb.nix
@@ -11,7 +11,7 @@ in
 
   options = {
     services.ferretdb = {
-      enable = mkEnableOption "FerretDB, an Open Source MongoDB alternative.";
+      enable = mkEnableOption "FerretDB, an Open Source MongoDB alternative";
 
       package = mkOption {
         type = types.package;
diff --git a/nixos/modules/services/databases/redis.nix b/nixos/modules/services/databases/redis.nix
index 1464f4487e39..86b295dadf49 100644
--- a/nixos/modules/services/databases/redis.nix
+++ b/nixos/modules/services/databases/redis.nix
@@ -75,7 +75,7 @@ in {
               Note that the NixOS module for Redis disables kernel support
               for Transparent Huge Pages (THP),
               because this features causes major performance problems for Redis,
-              e.g. (https://redis.io/topics/latency).
+              e.g. (https://redis.io/topics/latency)
             '');
 
             user = mkOption {
diff --git a/nixos/modules/services/databases/surrealdb.nix b/nixos/modules/services/databases/surrealdb.nix
index 28bd97cd731e..e1a1faed1f8f 100644
--- a/nixos/modules/services/databases/surrealdb.nix
+++ b/nixos/modules/services/databases/surrealdb.nix
@@ -8,7 +8,7 @@ in {
 
   options = {
     services.surrealdb = {
-      enable = mkEnableOption (lib.mdDoc "A scalable, distributed, collaborative, document-graph database, for the realtime web ");
+      enable = mkEnableOption (lib.mdDoc "SurrealDB, a scalable, distributed, collaborative, document-graph database, for the realtime web");
 
       package = mkOption {
         default = pkgs.surrealdb;
diff --git a/nixos/modules/services/desktops/deepin/app-services.nix b/nixos/modules/services/desktops/deepin/app-services.nix
index 6f9932e48733..4592bc7bb340 100644
--- a/nixos/modules/services/desktops/deepin/app-services.nix
+++ b/nixos/modules/services/desktops/deepin/app-services.nix
@@ -14,7 +14,7 @@ with lib;
 
     services.deepin.app-services = {
 
-      enable = mkEnableOption (lib.mdDoc "Service collection of DDE applications, including dconfig-center");
+      enable = mkEnableOption (lib.mdDoc "service collection of DDE applications, including dconfig-center");
 
     };
 
diff --git a/nixos/modules/services/desktops/deepin/dde-api.nix b/nixos/modules/services/desktops/deepin/dde-api.nix
index 472d9860c108..459876febf21 100644
--- a/nixos/modules/services/desktops/deepin/dde-api.nix
+++ b/nixos/modules/services/desktops/deepin/dde-api.nix
@@ -15,8 +15,8 @@ with lib;
     services.deepin.dde-api = {
 
       enable = mkEnableOption (lib.mdDoc ''
-        Provides some dbus interfaces that is used for screen zone detecting,
-        thumbnail generating, and sound playing in Deepin Desktop Environment.
+        some dbus interfaces that is used for screen zone detecting,
+        thumbnail generating, and sound playing in Deepin Desktop Environment
       '');
 
     };
diff --git a/nixos/modules/services/desktops/deepin/dde-daemon.nix b/nixos/modules/services/desktops/deepin/dde-daemon.nix
index 9377f523ebf9..356d323bcbdf 100644
--- a/nixos/modules/services/desktops/deepin/dde-daemon.nix
+++ b/nixos/modules/services/desktops/deepin/dde-daemon.nix
@@ -14,7 +14,7 @@ with lib;
 
     services.deepin.dde-daemon = {
 
-      enable = mkEnableOption (lib.mdDoc "Daemon for handling the deepin session settings");
+      enable = mkEnableOption (lib.mdDoc "daemon for handling the deepin session settings");
 
     };
 
diff --git a/nixos/modules/services/desktops/gnome/gnome-browser-connector.nix b/nixos/modules/services/desktops/gnome/gnome-browser-connector.nix
index 9a45d839629b..d18e303891e4 100644
--- a/nixos/modules/services/desktops/gnome/gnome-browser-connector.nix
+++ b/nixos/modules/services/desktops/gnome/gnome-browser-connector.nix
@@ -24,8 +24,8 @@ in
 
   options = {
     services.gnome.gnome-browser-connector.enable = mkEnableOption (mdDoc ''
-      Native host connector for the GNOME Shell browser extension, a DBus service
-      allowing to install GNOME Shell extensions from a web browser.
+      native host connector for the GNOME Shell browser extension, a DBus service
+      allowing to install GNOME Shell extensions from a web browser
     '');
   };
 
diff --git a/nixos/modules/services/hardware/supergfxd.nix b/nixos/modules/services/hardware/supergfxd.nix
index bd82775e8246..f7af993d7238 100644
--- a/nixos/modules/services/hardware/supergfxd.nix
+++ b/nixos/modules/services/hardware/supergfxd.nix
@@ -7,7 +7,7 @@ in
 {
   options = {
     services.supergfxd = {
-      enable = lib.mkEnableOption (lib.mdDoc "Enable the supergfxd service");
+      enable = lib.mkEnableOption (lib.mdDoc "the supergfxd service");
 
       settings = lib.mkOption {
         type = lib.types.nullOr json.type;
diff --git a/nixos/modules/services/hardware/tuxedo-rs.nix b/nixos/modules/services/hardware/tuxedo-rs.nix
index 343f6845fabb..0daccfef3a53 100644
--- a/nixos/modules/services/hardware/tuxedo-rs.nix
+++ b/nixos/modules/services/hardware/tuxedo-rs.nix
@@ -9,9 +9,9 @@ in
 {
   options = {
     hardware.tuxedo-rs = {
-      enable = mkEnableOption (lib.mdDoc "Rust utilities for interacting with hardware from TUXEDO Computers.");
+      enable = mkEnableOption (lib.mdDoc "Rust utilities for interacting with hardware from TUXEDO Computers");
 
-      tailor-gui.enable = mkEnableOption (lib.mdDoc "Alternative to TUXEDO Control Center, written in Rust.");
+      tailor-gui.enable = mkEnableOption (lib.mdDoc "tailor-gui, an alternative to TUXEDO Control Center, written in Rust");
     };
   };
 
diff --git a/nixos/modules/services/mail/dovecot.nix b/nixos/modules/services/mail/dovecot.nix
index 21bafd859c3c..abbb2f32e6cc 100644
--- a/nixos/modules/services/mail/dovecot.nix
+++ b/nixos/modules/services/mail/dovecot.nix
@@ -302,7 +302,7 @@ in
 
     enablePAM = mkEnableOption (lib.mdDoc "creating a own Dovecot PAM service and configure PAM user logins") // { default = true; };
 
-    enableDHE = mkEnableOption (lib.mdDoc "enable ssl_dh and generation of primes for the key exchange") // { default = true; };
+    enableDHE = mkEnableOption (lib.mdDoc "ssl_dh and generation of primes for the key exchange") // { default = true; };
 
     sieveScripts = mkOption {
       type = types.attrsOf types.path;
diff --git a/nixos/modules/services/mail/mailman.nix b/nixos/modules/services/mail/mailman.nix
index 9f43d5829f09..9cc1ade3f41e 100644
--- a/nixos/modules/services/mail/mailman.nix
+++ b/nixos/modules/services/mail/mailman.nix
@@ -260,7 +260,7 @@ in {
       };
 
       serve = {
-        enable = mkEnableOption (lib.mdDoc "Automatic nginx and uwsgi setup for mailman-web");
+        enable = mkEnableOption (lib.mdDoc "automatic nginx and uwsgi setup for mailman-web");
 
         virtualRoot = mkOption {
           default = "/";
diff --git a/nixos/modules/services/matrix/mjolnir.nix b/nixos/modules/services/matrix/mjolnir.nix
index 0824be663340..4e9a915c23c7 100644
--- a/nixos/modules/services/matrix/mjolnir.nix
+++ b/nixos/modules/services/matrix/mjolnir.nix
@@ -96,8 +96,8 @@ in
       type = types.submodule {
         options = {
           enable = mkEnableOption (lib.mdDoc ''
-            If true, accessToken is ignored and the username/password below will be
-            used instead. The access token of the bot will be stored in the dataPath.
+            ignoring the accessToken. If true, accessToken is ignored and the username/password below will be
+            used instead. The access token of the bot will be stored in the dataPath
           '');
 
           username = mkOption {
diff --git a/nixos/modules/services/misc/confd.nix b/nixos/modules/services/misc/confd.nix
index 17c1be57ccbc..17c1be57ccbc 100755..100644
--- a/nixos/modules/services/misc/confd.nix
+++ b/nixos/modules/services/misc/confd.nix
diff --git a/nixos/modules/services/misc/klipper.nix b/nixos/modules/services/misc/klipper.nix
index 67a217c994e4..9eb2fdb46593 100644
--- a/nixos/modules/services/misc/klipper.nix
+++ b/nixos/modules/services/misc/klipper.nix
@@ -111,11 +111,11 @@ in
           (submodule {
             options = {
               enable = mkEnableOption (lib.mdDoc ''
-                building of firmware for manual flashing.
+                building of firmware for manual flashing
               '');
               enableKlipperFlash = mkEnableOption (lib.mdDoc ''
                 flashings scripts for firmware. This will add `klipper-flash-$mcu` scripts to your environment which can be called to flash the firmware.
-                Please check the configs at [klipper](https://github.com/Klipper3d/klipper/tree/master/config) whether your board supports flashing via `make flash`.
+                Please check the configs at [klipper](https://github.com/Klipper3d/klipper/tree/master/config) whether your board supports flashing via `make flash`
               '');
               serial = mkOption {
                 type = types.nullOr path;
diff --git a/nixos/modules/services/misc/packagekit.nix b/nixos/modules/services/misc/packagekit.nix
index f3e6bf50e9b2..5a0d314d25cd 100644
--- a/nixos/modules/services/misc/packagekit.nix
+++ b/nixos/modules/services/misc/packagekit.nix
@@ -40,9 +40,9 @@ in
 
   options.services.packagekit = {
     enable = mkEnableOption (lib.mdDoc ''
-      PackageKit provides a cross-platform D-Bus abstraction layer for
+      PackageKit, a cross-platform D-Bus abstraction layer for
       installing software. Software utilizing PackageKit can install
-      software regardless of the package manager.
+      software regardless of the package manager
     '');
 
     settings = mkOption {
diff --git a/nixos/modules/services/misc/rshim.nix b/nixos/modules/services/misc/rshim.nix
index 0fef2cc228c9..706cf9136b00 100644
--- a/nixos/modules/services/misc/rshim.nix
+++ b/nixos/modules/services/misc/rshim.nix
@@ -12,7 +12,7 @@ let
 in
 {
   options.services.rshim = {
-    enable = lib.mkEnableOption (lib.mdDoc "User-space rshim driver for the BlueField SoC");
+    enable = lib.mkEnableOption (lib.mdDoc "user-space rshim driver for the BlueField SoC");
 
     package = lib.mkPackageOptionMD pkgs "rshim-user-space" { };
 
diff --git a/nixos/modules/services/misc/sourcehut/default.nix b/nixos/modules/services/misc/sourcehut/default.nix
index 580a009a0ad3..bee971662972 100644
--- a/nixos/modules/services/misc/sourcehut/default.nix
+++ b/nixos/modules/services/misc/sourcehut/default.nix
@@ -438,7 +438,7 @@ in
         };
 
         options."lists.sr.ht" = commonServiceSettings "lists" // {
-          allow-new-lists = mkEnableOption (lib.mdDoc "Allow creation of new lists");
+          allow-new-lists = mkEnableOption (lib.mdDoc "creation of new lists");
           notify-from = mkOption {
             description = lib.mdDoc "Outgoing email for notifications generated by users.";
             type = types.str;
diff --git a/nixos/modules/services/misc/tp-auto-kbbl.nix b/nixos/modules/services/misc/tp-auto-kbbl.nix
index 8d92d3d93677..1076c814e86c 100644
--- a/nixos/modules/services/misc/tp-auto-kbbl.nix
+++ b/nixos/modules/services/misc/tp-auto-kbbl.nix
@@ -9,7 +9,7 @@ in {
 
   options = {
     services.tp-auto-kbbl = {
-      enable = mkEnableOption (lib.mdDoc "Auto toggle keyboard back-lighting on Thinkpads (and maybe other laptops) for Linux");
+      enable = mkEnableOption (lib.mdDoc "auto toggle keyboard back-lighting on Thinkpads (and maybe other laptops) for Linux");
 
       package = mkOption {
         type = types.package;
diff --git a/nixos/modules/services/misc/zoneminder.nix b/nixos/modules/services/misc/zoneminder.nix
index b2e4e760d828..fca03b2ad4e1 100644
--- a/nixos/modules/services/misc/zoneminder.nix
+++ b/nixos/modules/services/misc/zoneminder.nix
@@ -67,14 +67,14 @@ in {
   options = {
     services.zoneminder = with lib; {
       enable = lib.mkEnableOption (lib.mdDoc ''
-        ZoneMinder
+        ZoneMinder.
 
         If you intend to run the database locally, you should set
         `config.services.zoneminder.database.createLocally` to true. Otherwise,
         when set to `false` (the default), you will have to create the database
         and database user as well as populate the database yourself.
         Additionally, you will need to run `zmupdate.pl` yourself when
-        upgrading to a newer version.
+        upgrading to a newer version
       '');
 
       webserver = mkOption {
diff --git a/nixos/modules/services/monitoring/mackerel-agent.nix b/nixos/modules/services/monitoring/mackerel-agent.nix
index 67dc1bc19edd..62a7858500f2 100644
--- a/nixos/modules/services/monitoring/mackerel-agent.nix
+++ b/nixos/modules/services/monitoring/mackerel-agent.nix
@@ -11,10 +11,10 @@ in {
 
     # the upstream package runs as root, but doesn't seem to be strictly
     # necessary for basic functionality
-    runAsRoot = mkEnableOption (lib.mdDoc "Whether to run as root");
+    runAsRoot = mkEnableOption (lib.mdDoc "running as root");
 
     autoRetirement = mkEnableOption (lib.mdDoc ''
-      Whether to automatically retire the host upon OS shutdown.
+      retiring the host upon OS shutdown
     '');
 
     apiKeyFile = mkOption {
@@ -59,7 +59,7 @@ in {
         };
 
         options.diagnostic =
-          mkEnableOption (lib.mdDoc "Collect memory usage for the agent itself");
+          mkEnableOption (lib.mdDoc "collecting memory usage for the agent itself");
       };
     };
   };
diff --git a/nixos/modules/services/monitoring/prometheus/exporters/wireguard.nix b/nixos/modules/services/monitoring/prometheus/exporters/wireguard.nix
index c98dcd9f64bf..9b7590314936 100644
--- a/nixos/modules/services/monitoring/prometheus/exporters/wireguard.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/wireguard.nix
@@ -11,7 +11,7 @@ in {
     ({ options.warnings = options.warnings; options.assertions = options.assertions; })
   ];
   extraOpts = {
-    verbose = mkEnableOption (lib.mdDoc "Verbose logging mode for prometheus-wireguard-exporter");
+    verbose = mkEnableOption (lib.mdDoc "verbose logging mode for prometheus-wireguard-exporter");
 
     wireguardConfig = mkOption {
       type = with types; nullOr (either path str);
diff --git a/nixos/modules/services/network-filesystems/openafs/server.nix b/nixos/modules/services/network-filesystems/openafs/server.nix
index ad0fd7835670..fbaa7cfc1929 100644
--- a/nixos/modules/services/network-filesystems/openafs/server.nix
+++ b/nixos/modules/services/network-filesystems/openafs/server.nix
@@ -177,13 +177,13 @@ in {
 
         backup = {
           enable = mkEnableOption (lib.mdDoc ''
-            Backup server role. When using OpenAFS built-in buserver, use in conjunction with the
+            the backup server role. When using OpenAFS built-in buserver, use in conjunction with the
             `database` role to maintain the Backup
             Database. Normally only used in conjunction with tape storage
             or IBM's Tivoli Storage Manager.
 
             For a modern backup server, enable this role and see
-            {option}`enableFabs`.
+            {option}`enableFabs`
           '');
 
           enableFabs = mkEnableOption (lib.mdDoc ''
diff --git a/nixos/modules/services/networking/create_ap.nix b/nixos/modules/services/networking/create_ap.nix
index e772cf21ec57..994aa6d36d2a 100644
--- a/nixos/modules/services/networking/create_ap.nix
+++ b/nixos/modules/services/networking/create_ap.nix
@@ -8,7 +8,7 @@ let
 in {
   options = {
     services.create_ap = {
-      enable = mkEnableOption (lib.mdDoc "setup wifi hotspots using create_ap");
+      enable = mkEnableOption (lib.mdDoc "setting up wifi hotspots using create_ap");
       settings = mkOption {
         type = with types; attrsOf (oneOf [ int bool str ]);
         default = {};
diff --git a/nixos/modules/services/networking/dae.nix b/nixos/modules/services/networking/dae.nix
index 3c7f386d2d48..cf3fead19be5 100644
--- a/nixos/modules/services/networking/dae.nix
+++ b/nixos/modules/services/networking/dae.nix
@@ -14,7 +14,7 @@ in
   options = {
     services.dae = with lib;{
       enable = mkEnableOption
-        (mdDoc "A Linux high-performance transparent proxy solution based on eBPF");
+        (mdDoc "dae, a Linux high-performance transparent proxy solution based on eBPF");
 
       package = mkPackageOptionMD pkgs "dae" { };
 
@@ -46,7 +46,7 @@ in
       openFirewall = mkOption {
         type = with types; submodule {
           options = {
-            enable = mkEnableOption "enable";
+            enable = mkEnableOption (mdDoc "opening {option}`port` in the firewall");
             port = mkOption {
               type = types.port;
               description = ''
@@ -91,7 +91,7 @@ in
       };
 
       disableTxChecksumIpGeneric =
-        mkEnableOption (mdDoc "See <https://github.com/daeuniverse/dae/issues/43>");
+        mkEnableOption "" // { description = mdDoc "See <https://github.com/daeuniverse/dae/issues/43>"; };
 
     };
   };
diff --git a/nixos/modules/services/networking/ddclient.nix b/nixos/modules/services/networking/ddclient.nix
new file mode 100644
index 000000000000..8f4fb0bc78d4
--- /dev/null
+++ b/nixos/modules/services/networking/ddclient.nix
@@ -0,0 +1,234 @@
+{ config, pkgs, lib, ... }:
+
+let
+  cfg = config.services.ddclient;
+  boolToStr = bool: if bool then "yes" else "no";
+  dataDir = "/var/lib/ddclient";
+  StateDirectory = builtins.baseNameOf dataDir;
+  RuntimeDirectory = StateDirectory;
+
+  configFile' = pkgs.writeText "ddclient.conf" ''
+    # This file can be used as a template for configFile or is automatically generated by Nix options.
+    cache=${dataDir}/ddclient.cache
+    foreground=YES
+    use=${cfg.use}
+    login=${cfg.username}
+    password=${if cfg.protocol == "nsupdate" then "/run/${RuntimeDirectory}/ddclient.key" else "@password_placeholder@"}
+    protocol=${cfg.protocol}
+    ${lib.optionalString (cfg.script != "") "script=${cfg.script}"}
+    ${lib.optionalString (cfg.server != "") "server=${cfg.server}"}
+    ${lib.optionalString (cfg.zone != "")   "zone=${cfg.zone}"}
+    ssl=${boolToStr cfg.ssl}
+    wildcard=YES
+    quiet=${boolToStr cfg.quiet}
+    verbose=${boolToStr cfg.verbose}
+    ${cfg.extraConfig}
+    ${lib.concatStringsSep "," cfg.domains}
+  '';
+  configFile = if (cfg.configFile != null) then cfg.configFile else configFile';
+
+  preStart = ''
+    install --mode=600 --owner=$USER ${configFile} /run/${RuntimeDirectory}/ddclient.conf
+    ${lib.optionalString (cfg.configFile == null) (if (cfg.protocol == "nsupdate") then ''
+      install --mode=600 --owner=$USER ${cfg.passwordFile} /run/${RuntimeDirectory}/ddclient.key
+    '' else if (cfg.passwordFile != null) then ''
+      "${pkgs.replace-secret}/bin/replace-secret" "@password_placeholder@" "${cfg.passwordFile}" "/run/${RuntimeDirectory}/ddclient.conf"
+    '' else ''
+      sed -i '/^password=@password_placeholder@$/d' /run/${RuntimeDirectory}/ddclient.conf
+    '')}
+  '';
+
+in
+
+with lib;
+
+{
+
+  imports = [
+    (mkChangedOptionModule [ "services" "ddclient" "domain" ] [ "services" "ddclient" "domains" ]
+      (config:
+        let value = getAttrFromPath [ "services" "ddclient" "domain" ] config;
+        in optional (value != "") value))
+    (mkRemovedOptionModule [ "services" "ddclient" "homeDir" ] "")
+    (mkRemovedOptionModule [ "services" "ddclient" "password" ] "Use services.ddclient.passwordFile instead.")
+    (mkRemovedOptionModule [ "services" "ddclient" "ipv6" ] "")
+  ];
+
+  ###### interface
+
+  options = {
+
+    services.ddclient = with lib.types; {
+
+      enable = mkOption {
+        default = false;
+        type = bool;
+        description = lib.mdDoc ''
+          Whether to synchronise your machine's IP address with a dynamic DNS provider (e.g. dyndns.org).
+        '';
+      };
+
+      package = mkOption {
+        type = package;
+        default = pkgs.ddclient;
+        defaultText = lib.literalExpression "pkgs.ddclient";
+        description = lib.mdDoc ''
+          The ddclient executable package run by the service.
+        '';
+      };
+
+      domains = mkOption {
+        default = [ "" ];
+        type = listOf str;
+        description = lib.mdDoc ''
+          Domain name(s) to synchronize.
+        '';
+      };
+
+      username = mkOption {
+        # For `nsupdate` username contains the path to the nsupdate executable
+        default = lib.optionalString (config.services.ddclient.protocol == "nsupdate") "${pkgs.bind.dnsutils}/bin/nsupdate";
+        defaultText = "";
+        type = str;
+        description = lib.mdDoc ''
+          User name.
+        '';
+      };
+
+      passwordFile = mkOption {
+        default = null;
+        type = nullOr str;
+        description = lib.mdDoc ''
+          A file containing the password or a TSIG key in named format when using the nsupdate protocol.
+        '';
+      };
+
+      interval = mkOption {
+        default = "10min";
+        type = str;
+        description = lib.mdDoc ''
+          The interval at which to run the check and update.
+          See {command}`man 7 systemd.time` for the format.
+        '';
+      };
+
+      configFile = mkOption {
+        default = null;
+        type = nullOr path;
+        description = lib.mdDoc ''
+          Path to configuration file.
+          When set this overrides the generated configuration from module options.
+        '';
+        example = "/root/nixos/secrets/ddclient.conf";
+      };
+
+      protocol = mkOption {
+        default = "dyndns2";
+        type = str;
+        description = lib.mdDoc ''
+          Protocol to use with dynamic DNS provider (see https://sourceforge.net/p/ddclient/wiki/protocols).
+        '';
+      };
+
+      server = mkOption {
+        default = "";
+        type = str;
+        description = lib.mdDoc ''
+          Server address.
+        '';
+      };
+
+      ssl = mkOption {
+        default = true;
+        type = bool;
+        description = lib.mdDoc ''
+          Whether to use SSL/TLS to connect to dynamic DNS provider.
+        '';
+      };
+
+      quiet = mkOption {
+        default = false;
+        type = bool;
+        description = lib.mdDoc ''
+          Print no messages for unnecessary updates.
+        '';
+      };
+
+      script = mkOption {
+        default = "";
+        type = str;
+        description = lib.mdDoc ''
+          script as required by some providers.
+        '';
+      };
+
+      use = mkOption {
+        default = "web, web=checkip.dyndns.com/, web-skip='Current IP Address: '";
+        type = str;
+        description = lib.mdDoc ''
+          Method to determine the IP address to send to the dynamic DNS provider.
+        '';
+      };
+
+      verbose = mkOption {
+        default = false;
+        type = bool;
+        description = lib.mdDoc ''
+          Print verbose information.
+        '';
+      };
+
+      zone = mkOption {
+        default = "";
+        type = str;
+        description = lib.mdDoc ''
+          zone as required by some providers.
+        '';
+      };
+
+      extraConfig = mkOption {
+        default = "";
+        type = lines;
+        description = lib.mdDoc ''
+          Extra configuration. Contents will be added verbatim to the configuration file.
+
+          ::: {.note}
+          `daemon` should not be added here because it does not work great with the systemd-timer approach the service uses.
+          :::
+        '';
+      };
+    };
+  };
+
+
+  ###### implementation
+
+  config = mkIf config.services.ddclient.enable {
+    systemd.services.ddclient = {
+      description = "Dynamic DNS Client";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+      restartTriggers = optional (cfg.configFile != null) cfg.configFile;
+      path = lib.optional (lib.hasPrefix "if," cfg.use) pkgs.iproute2;
+
+      serviceConfig = {
+        DynamicUser = true;
+        RuntimeDirectoryMode = "0700";
+        inherit RuntimeDirectory;
+        inherit StateDirectory;
+        Type = "oneshot";
+        ExecStartPre = "!${pkgs.writeShellScript "ddclient-prestart" preStart}";
+        ExecStart = "${lib.getExe cfg.package} -file /run/${RuntimeDirectory}/ddclient.conf";
+      };
+    };
+
+    systemd.timers.ddclient = {
+      description = "Run ddclient";
+      wantedBy = [ "timers.target" ];
+      timerConfig = {
+        OnBootSec = cfg.interval;
+        OnUnitInactiveSec = cfg.interval;
+      };
+    };
+  };
+}
diff --git a/nixos/modules/services/networking/deconz.nix b/nixos/modules/services/networking/deconz.nix
index 1fe103733212..05b724708777 100644
--- a/nixos/modules/services/networking/deconz.nix
+++ b/nixos/modules/services/networking/deconz.nix
@@ -54,13 +54,13 @@ in
       description = "TCP port for the WebSocket.";
     };
 
-    openFirewall = lib.mkEnableOption "open up the service ports in the firewall";
+    openFirewall = lib.mkEnableOption "opening up the service ports in the firewall";
 
-    allowRebootSystem = lib.mkEnableOption "allow rebooting the system";
+    allowRebootSystem = lib.mkEnableOption "rebooting the system";
 
-    allowRestartService = lib.mkEnableOption "allow killing/restarting processes";
+    allowRestartService = lib.mkEnableOption "killing/restarting processes";
 
-    allowSetSystemTime = lib.mkEnableOption "allow setting the system time";
+    allowSetSystemTime = lib.mkEnableOption "setting the system time";
 
     extraArgs = lib.mkOption {
       type = lib.types.listOf lib.types.str;
diff --git a/nixos/modules/services/networking/go-neb.nix b/nixos/modules/services/networking/go-neb.nix
index b65bb5f548ee..78d24ecf17d9 100644
--- a/nixos/modules/services/networking/go-neb.nix
+++ b/nixos/modules/services/networking/go-neb.nix
@@ -9,7 +9,7 @@ let
   configFile = settingsFormat.generate "config.yaml" cfg.config;
 in {
   options.services.go-neb = {
-    enable = mkEnableOption (lib.mdDoc "Extensible matrix bot written in Go");
+    enable = mkEnableOption (lib.mdDoc "an extensible matrix bot written in Go");
 
     bindAddress = mkOption {
       type = types.str;
diff --git a/nixos/modules/services/networking/hostapd.nix b/nixos/modules/services/networking/hostapd.nix
index 4ec066c2ec97..ffb154463053 100644
--- a/nixos/modules/services/networking/hostapd.nix
+++ b/nixos/modules/services/networking/hostapd.nix
@@ -116,10 +116,10 @@ in {
   options = {
     services.hostapd = {
       enable = mkEnableOption (mdDoc ''
-        Whether to enable hostapd. hostapd is a user space daemon for access point and
+        hostapd, a user space daemon for access point and
         authentication servers. It implements IEEE 802.11 access point management,
         IEEE 802.1X/WPA/WPA2/EAP Authenticators, RADIUS client, EAP server, and RADIUS
-        authentication server.
+        authentication server
       '');
 
       package = mkPackageOption pkgs "hostapd" {};
diff --git a/nixos/modules/services/networking/hylafax/options.nix b/nixos/modules/services/networking/hylafax/options.nix
index 82c144236f3b..49b2bef90a5f 100644
--- a/nixos/modules/services/networking/hylafax/options.nix
+++ b/nixos/modules/services/networking/hylafax/options.nix
@@ -272,18 +272,18 @@ in
     };
 
     faxcron.enable.spoolInit = mkEnableOption (lib.mdDoc ''
-      Purge old files from the spooling area with
+      purging old files from the spooling area with
       {file}`faxcron`
-      each time the spooling area is initialized.
+      each time the spooling area is initialized
     '');
     faxcron.enable.frequency = mkOption {
       type = nullOr nonEmptyStr;
       default = null;
       example = "daily";
       description = lib.mdDoc ''
-        Purge old files from the spooling area with
+        purging old files from the spooling area with
         {file}`faxcron` with the given frequency
-        (see systemd.time(7)).
+        (see systemd.time(7))
       '';
     };
     faxcron.infoDays = mkOption {
diff --git a/nixos/modules/services/networking/i2pd.nix b/nixos/modules/services/networking/i2pd.nix
index c940324ad096..f872daf05b8f 100644
--- a/nixos/modules/services/networking/i2pd.nix
+++ b/nixos/modules/services/networking/i2pd.nix
@@ -265,7 +265,7 @@ in
         '';
       };
 
-      logCLFTime = mkEnableOption (lib.mdDoc "Full CLF-formatted date and time to log");
+      logCLFTime = mkEnableOption (lib.mdDoc "full CLF-formatted date and time to log");
 
       address = mkOption {
         type = with types; nullOr str;
@@ -456,7 +456,7 @@ in
         '';
       };
 
-      trust.enable = mkEnableOption (lib.mdDoc "Explicit trust options");
+      trust.enable = mkEnableOption (lib.mdDoc "explicit trust options");
 
       trust.family = mkOption {
         type = with types; nullOr str;
@@ -474,7 +474,7 @@ in
         '';
       };
 
-      trust.hidden = mkEnableOption (lib.mdDoc "Router concealment");
+      trust.hidden = mkEnableOption (lib.mdDoc "router concealment");
 
       websocket = mkEndpointOpt "websockets" "127.0.0.1" 7666;
 
@@ -552,7 +552,7 @@ in
 
       proto.http = (mkEndpointOpt "http" "127.0.0.1" 7070) // {
 
-        auth = mkEnableOption (lib.mdDoc "Webconsole authentication");
+        auth = mkEnableOption (lib.mdDoc "webconsole authentication");
 
         user = mkOption {
           type = types.str;
diff --git a/nixos/modules/services/networking/iscsi/initiator.nix b/nixos/modules/services/networking/iscsi/initiator.nix
index d2865a660ead..9c71a988f29c 100644
--- a/nixos/modules/services/networking/iscsi/initiator.nix
+++ b/nixos/modules/services/networking/iscsi/initiator.nix
@@ -7,7 +7,7 @@ in
     enable = mkEnableOption (lib.mdDoc "the openiscsi iscsi daemon");
     enableAutoLoginOut = mkEnableOption (lib.mdDoc ''
       automatic login and logout of all automatic targets.
-      You probably do not want this.
+      You probably do not want this
     '');
     discoverPortal = mkOption {
       type = nullOr str;
diff --git a/nixos/modules/services/networking/nar-serve.nix b/nixos/modules/services/networking/nar-serve.nix
index beee53c8a242..b8b76120e44f 100644
--- a/nixos/modules/services/networking/nar-serve.nix
+++ b/nixos/modules/services/networking/nar-serve.nix
@@ -10,7 +10,7 @@ in
   };
   options = {
     services.nar-serve = {
-      enable = mkEnableOption (lib.mdDoc "Serve NAR file contents via HTTP");
+      enable = mkEnableOption (lib.mdDoc "serving NAR file contents via HTTP");
 
       port = mkOption {
         type = types.port;
diff --git a/nixos/modules/services/networking/nftables.nix b/nixos/modules/services/networking/nftables.nix
index a0afdb452752..424d005dc0b5 100644
--- a/nixos/modules/services/networking/nftables.nix
+++ b/nixos/modules/services/networking/nftables.nix
@@ -103,7 +103,7 @@ in
       '';
     };
 
-    networking.nftables.flushRuleset = mkEnableOption (lib.mdDoc "Flush the entire ruleset on each reload.");
+    networking.nftables.flushRuleset = mkEnableOption (lib.mdDoc "flushing the entire ruleset on each reload");
 
     networking.nftables.extraDeletions = mkOption {
       type = types.lines;
diff --git a/nixos/modules/services/networking/snowflake-proxy.nix b/nixos/modules/services/networking/snowflake-proxy.nix
index ca015ed9d44b..19b68f1e20ba 100644
--- a/nixos/modules/services/networking/snowflake-proxy.nix
+++ b/nixos/modules/services/networking/snowflake-proxy.nix
@@ -8,7 +8,7 @@ in
 {
   options = {
     services.snowflake-proxy = {
-      enable = mkEnableOption (lib.mdDoc "System to defeat internet censorship");
+      enable = mkEnableOption (lib.mdDoc "snowflake-proxy, a system to defeat internet censorship");
 
       broker = mkOption {
         description = lib.mdDoc "Broker URL (default \"https://snowflake-broker.torproject.net/\")";
diff --git a/nixos/modules/services/networking/yggdrasil.nix b/nixos/modules/services/networking/yggdrasil.nix
index 8335583d2dad..56d81fb04013 100644
--- a/nixos/modules/services/networking/yggdrasil.nix
+++ b/nixos/modules/services/networking/yggdrasil.nix
@@ -116,9 +116,9 @@ in
       };
 
       persistentKeys = mkEnableOption (lib.mdDoc ''
-        If enabled then keys will be generated once and Yggdrasil
+        persistent keys. If enabled then keys will be generated once and Yggdrasil
         will retain the same IPv6 address when the service is
-        restarted. Keys are stored at ${keysPath}.
+        restarted. Keys are stored at ${keysPath}
       '');
 
       extraArgs = mkOption {
diff --git a/nixos/modules/services/system/earlyoom.nix b/nixos/modules/services/system/earlyoom.nix
index 3f501d453460..38805eba2ca1 100644
--- a/nixos/modules/services/system/earlyoom.nix
+++ b/nixos/modules/services/system/earlyoom.nix
@@ -11,7 +11,7 @@ let
 in
 {
   options.services.earlyoom = {
-    enable = mkEnableOption (lib.mdDoc "Early out of memory killing");
+    enable = mkEnableOption (lib.mdDoc "early out of memory killing");
 
     freeMemThreshold = mkOption {
       type = types.ints.between 1 100;
diff --git a/nixos/modules/services/system/systembus-notify.nix b/nixos/modules/services/system/systembus-notify.nix
index 269197b3997e..f79879fa1360 100644
--- a/nixos/modules/services/system/systembus-notify.nix
+++ b/nixos/modules/services/system/systembus-notify.nix
@@ -13,7 +13,7 @@ in
 
       WARNING: enabling this option (while convenient) should *not* be done on a
       machine where you do not trust the other users as it allows any other
-      local user to DoS your session by spamming notifications.
+      local user to DoS your session by spamming notifications
     '');
   };
 
diff --git a/nixos/modules/services/torrent/flexget.nix b/nixos/modules/services/torrent/flexget.nix
index 1b971838b32e..5cd7ae6ad7db 100644
--- a/nixos/modules/services/torrent/flexget.nix
+++ b/nixos/modules/services/torrent/flexget.nix
@@ -14,7 +14,7 @@ let
 in {
   options = {
     services.flexget = {
-      enable = mkEnableOption (lib.mdDoc "Run FlexGet Daemon");
+      enable = mkEnableOption (lib.mdDoc "FlexGet daemon");
 
       package = mkPackageOptionMD pkgs "flexget" {};
 
diff --git a/nixos/modules/services/video/mediamtx.nix b/nixos/modules/services/video/mediamtx.nix
index c3abd9cdcc5c..50f8e8810278 100644
--- a/nixos/modules/services/video/mediamtx.nix
+++ b/nixos/modules/services/video/mediamtx.nix
@@ -40,7 +40,7 @@ in
       };
 
       allowVideoAccess = lib.mkEnableOption (lib.mdDoc ''
-        Enable access to video devices like cameras on the system.
+        access to video devices like cameras on the system
       '');
     };
   };
diff --git a/nixos/modules/services/web-apps/cloudlog.nix b/nixos/modules/services/web-apps/cloudlog.nix
index da2cf93d7f1c..5519d6967a12 100644
--- a/nixos/modules/services/web-apps/cloudlog.nix
+++ b/nixos/modules/services/web-apps/cloudlog.nix
@@ -69,7 +69,7 @@ let
 in
 {
   options.services.cloudlog = with types; {
-    enable = mkEnableOption (mdDoc "Whether to enable Cloudlog");
+    enable = mkEnableOption (mdDoc "Cloudlog");
     dataDir = mkOption {
       type = str;
       default = "/var/lib/cloudlog";
diff --git a/nixos/modules/services/web-apps/dex.nix b/nixos/modules/services/web-apps/dex.nix
index bd041db007a1..0c4a71c6dfe4 100644
--- a/nixos/modules/services/web-apps/dex.nix
+++ b/nixos/modules/services/web-apps/dex.nix
@@ -108,8 +108,7 @@ in
         ProtectClock = true;
         ProtectHome = true;
         ProtectHostname = true;
-        # Would re-mount paths ignored by temporary root
-        #ProtectSystem = "strict";
+        ProtectSystem = "strict";
         ProtectControlGroups = true;
         ProtectKernelLogs = true;
         ProtectKernelModules = true;
@@ -121,9 +120,7 @@ in
         RestrictSUIDSGID = true;
         SystemCallArchitectures = "native";
         SystemCallFilter = [ "@system-service" "~@privileged @setuid @keyring" ];
-        TemporaryFileSystem = "/:ro";
-        # Does not work well with the temporary root
-        #UMask = "0066";
+        UMask = "0066";
       } // optionalAttrs (cfg.environmentFile != null) {
         EnvironmentFile = cfg.environmentFile;
       };
diff --git a/nixos/modules/services/web-apps/hedgedoc.nix b/nixos/modules/services/web-apps/hedgedoc.nix
index bfa5fd5aff25..1a66f077b09d 100644
--- a/nixos/modules/services/web-apps/hedgedoc.nix
+++ b/nixos/modules/services/web-apps/hedgedoc.nix
@@ -1,7 +1,7 @@
 { config, lib, pkgs, ... }:
 
 let
-  inherit (lib) literalExpression mdDoc mkEnableOption mkIf mkOption mkPackageOptionMD mkRenamedOptionModule types versionAtLeast;
+  inherit (lib) mkOption types mdDoc literalExpression;
 
   cfg = config.services.hedgedoc;
 
@@ -9,990 +9,189 @@ let
   # versionAtLeast statement remains set to 21.03 for backwards compatibility.
   # See https://github.com/NixOS/nixpkgs/pull/108899 and
   # https://github.com/NixOS/rfcs/blob/master/rfcs/0080-nixos-release-schedule.md.
-  name = if versionAtLeast config.system.stateVersion "21.03"
-    then "hedgedoc"
-    else "codimd";
+  name = if lib.versionAtLeast config.system.stateVersion "21.03" then
+    "hedgedoc"
+  else
+    "codimd";
 
-  settingsFormat = pkgs.formats.json {};
-
-  prettyJSON = conf:
-    pkgs.runCommandLocal "hedgedoc-config.json" {
-      nativeBuildInputs = [ pkgs.jq ];
-    } ''
-      jq '{production:del(.[]|nulls)|del(.[][]?|nulls)}' \
-        < ${settingsFormat.generate "hedgedoc-ugly.json" cfg.settings} \
-        > $out
-    '';
+  settingsFormat = pkgs.formats.json { };
 in
 {
+  meta.maintainers = with lib.maintainers; [ SuperSandro2000 h7x4 ];
+
   imports = [
-    (mkRenamedOptionModule [ "services" "codimd" ] [ "services" "hedgedoc" ])
-    (mkRenamedOptionModule
-      [ "services" "hedgedoc" "configuration" ] [ "services" "hedgedoc" "settings" ])
+    (lib.mkRenamedOptionModule [ "services" "codimd" ] [ "services" "hedgedoc" ])
+    (lib.mkRenamedOptionModule [ "services" "hedgedoc" "configuration" ] [ "services" "hedgedoc" "settings" ])
+    (lib.mkRenamedOptionModule [ "services" "hedgedoc" "groups" ] [ "users" "users" "hedgedoc" "extraGroups" ])
+    (lib.mkRemovedOptionModule [ "services" "hedgedoc" "workDir" ] ''
+      This option has been removed in favor of systemd managing the state directory.
+
+      If you have set this option without specifying `services.settings.uploadsDir`,
+      please move these files to `/var/lib/hedgedoc/uploads`, or set the option to point
+      at the correct location.
+    '')
   ];
 
   options.services.hedgedoc = {
-    package = mkPackageOptionMD pkgs "hedgedoc" { };
-    enable = mkEnableOption (lib.mdDoc "the HedgeDoc Markdown Editor");
+    package = lib.mkPackageOptionMD pkgs "hedgedoc" { };
+    enable = lib.mkEnableOption (mdDoc "the HedgeDoc Markdown Editor");
 
-    groups = mkOption {
-      type = types.listOf types.str;
-      default = [];
-      description = lib.mdDoc ''
-        Groups to which the service user should be added.
-      '';
-    };
-
-    workDir = mkOption {
-      type = types.path;
-      default = "/var/lib/${name}";
-      description = lib.mdDoc ''
-        Working directory for the HedgeDoc service.
-      '';
-    };
+    settings = mkOption {
+      type = types.submodule {
+        freeformType = settingsFormat.type;
+        options = {
+          domain = mkOption {
+            type = with types; nullOr str;
+            default = null;
+            example = "hedgedoc.org";
+            description = mdDoc ''
+              Domain to use for website.
 
-    settings = let options = {
-      debug = mkEnableOption (lib.mdDoc "debug mode");
-      domain = mkOption {
-        type = types.nullOr types.str;
-        default = null;
-        example = "hedgedoc.org";
-        description = lib.mdDoc ''
-          Domain name for the HedgeDoc instance.
-        '';
-      };
-      urlPath = mkOption {
-        type = types.nullOr types.str;
-        default = null;
-        example = "/url/path/to/hedgedoc";
-        description = lib.mdDoc ''
-          Path under which HedgeDoc is accessible.
-        '';
-      };
-      host = mkOption {
-        type = types.str;
-        default = "localhost";
-        description = lib.mdDoc ''
-          Address to listen on.
-        '';
-      };
-      port = mkOption {
-        type = types.port;
-        default = 3000;
-        example = 80;
-        description = lib.mdDoc ''
-          Port to listen on.
-        '';
-      };
-      path = mkOption {
-        type = types.nullOr types.str;
-        default = null;
-        example = "/run/hedgedoc.sock";
-        description = lib.mdDoc ''
-          Specify where a UNIX domain socket should be placed.
-        '';
-      };
-      allowOrigin = mkOption {
-        type = types.listOf types.str;
-        default = [];
-        example = [ "localhost" "hedgedoc.org" ];
-        description = lib.mdDoc ''
-          List of domains to whitelist.
-        '';
-      };
-      useSSL = mkOption {
-        type = types.bool;
-        default = false;
-        description = lib.mdDoc ''
-          Enable to use SSL server. This will also enable
-          {option}`protocolUseSSL`.
-        '';
-      };
-      enableStatsApi = mkOption {
-        type = types.bool;
-        default = false;
-        description = lib.mdDoc ''
-          Enables or disables the /status and /metrics endpoint.
-        '';
-      };
-      hsts = {
-        enable = mkOption {
-          type = types.bool;
-          default = true;
-          description = lib.mdDoc ''
-            Whether to enable HSTS if HTTPS is also enabled.
-          '';
-        };
-        maxAgeSeconds = mkOption {
-          type = types.int;
-          default = 31536000;
-          description = lib.mdDoc ''
-            Max duration for clients to keep the HSTS status.
-          '';
-        };
-        includeSubdomains = mkOption {
-          type = types.bool;
-          default = true;
-          description = lib.mdDoc ''
-            Whether to include subdomains in HSTS.
-          '';
-        };
-        preload = mkOption {
-          type = types.bool;
-          default = true;
-          description = lib.mdDoc ''
-            Whether to allow preloading of the site's HSTS status.
-          '';
-        };
-      };
-      csp = mkOption {
-        type = types.nullOr types.attrs;
-        default = null;
-        example = literalExpression ''
-          {
-            enable = true;
-            directives = {
-              scriptSrc = "trustworthy.scripts.example.com";
-            };
-            upgradeInsecureRequest = "auto";
-            addDefaults = true;
-          }
-        '';
-        description = lib.mdDoc ''
-          Specify the Content Security Policy which is passed to Helmet.
-          For configuration details see <https://helmetjs.github.io/docs/csp/>.
-        '';
-      };
-      protocolUseSSL = mkOption {
-        type = types.bool;
-        default = false;
-        description = lib.mdDoc ''
-          Enable to use TLS for resource paths.
-          This only applies when {option}`domain` is set.
-        '';
-      };
-      urlAddPort = mkOption {
-        type = types.bool;
-        default = false;
-        description = lib.mdDoc ''
-          Enable to add the port to callback URLs.
-          This only applies when {option}`domain` is set
-          and only for ports other than 80 and 443.
-        '';
-      };
-      useCDN = mkOption {
-        type = types.bool;
-        default = false;
-        description = lib.mdDoc ''
-          Whether to use CDN resources or not.
-        '';
-      };
-      allowAnonymous = mkOption {
-        type = types.bool;
-        default = true;
-        description = lib.mdDoc ''
-          Whether to allow anonymous usage.
-        '';
-      };
-      allowAnonymousEdits = mkOption {
-        type = types.bool;
-        default = false;
-        description = lib.mdDoc ''
-          Whether to allow guests to edit existing notes with the `freely` permission,
-          when {option}`allowAnonymous` is enabled.
-        '';
-      };
-      allowFreeURL = mkOption {
-        type = types.bool;
-        default = false;
-        description = lib.mdDoc ''
-          Whether to allow note creation by accessing a nonexistent note URL.
-        '';
-      };
-      requireFreeURLAuthentication = mkOption {
-        type = types.bool;
-        default = false;
-        description = lib.mdDoc ''
-          Whether to require authentication for FreeURL mode style note creation.
-        '';
-      };
-      defaultPermission = mkOption {
-        type = types.enum [ "freely" "editable" "limited" "locked" "private" ];
-        default = "editable";
-        description = lib.mdDoc ''
-          Default permissions for notes.
-          This only applies for signed-in users.
-        '';
-      };
-      dbURL = mkOption {
-        type = types.nullOr types.str;
-        default = null;
-        example = ''
-          postgres://user:pass@host:5432/dbname
-        '';
-        description = lib.mdDoc ''
-          Specify which database to use.
-          HedgeDoc supports mysql, postgres, sqlite and mssql.
-          See [
-          https://sequelize.readthedocs.io/en/v3/](https://sequelize.readthedocs.io/en/v3/) for more information.
-          Note: This option overrides {option}`db`.
-        '';
-      };
-      db = mkOption {
-        type = types.attrs;
-        default = {};
-        example = literalExpression ''
-          {
-            dialect = "sqlite";
-            storage = "/var/lib/${name}/db.${name}.sqlite";
-          }
-        '';
-        description = lib.mdDoc ''
-          Specify the configuration for sequelize.
-          HedgeDoc supports mysql, postgres, sqlite and mssql.
-          See [
-          https://sequelize.readthedocs.io/en/v3/](https://sequelize.readthedocs.io/en/v3/) for more information.
-          Note: This option overrides {option}`db`.
-        '';
-      };
-      sslKeyPath= mkOption {
-        type = types.nullOr types.str;
-        default = null;
-        example = "/var/lib/hedgedoc/hedgedoc.key";
-        description = lib.mdDoc ''
-          Path to the SSL key. Needed when {option}`useSSL` is enabled.
-        '';
-      };
-      sslCertPath = mkOption {
-        type = types.nullOr types.str;
-        default = null;
-        example = "/var/lib/hedgedoc/hedgedoc.crt";
-        description = lib.mdDoc ''
-          Path to the SSL cert. Needed when {option}`useSSL` is enabled.
-        '';
-      };
-      sslCAPath = mkOption {
-        type = types.listOf types.str;
-        default = [];
-        example = [ "/var/lib/hedgedoc/ca.crt" ];
-        description = lib.mdDoc ''
-          SSL ca chain. Needed when {option}`useSSL` is enabled.
-        '';
-      };
-      dhParamPath = mkOption {
-        type = types.nullOr types.str;
-        default = null;
-        example = "/var/lib/hedgedoc/dhparam.pem";
-        description = lib.mdDoc ''
-          Path to the SSL dh params. Needed when {option}`useSSL` is enabled.
-        '';
-      };
-      tmpPath = mkOption {
-        type = types.str;
-        default = "/tmp";
-        description = lib.mdDoc ''
-          Path to the temp directory HedgeDoc should use.
-          Note that {option}`serviceConfig.PrivateTmp` is enabled for
-          the HedgeDoc systemd service by default.
-          (Non-canonical paths are relative to HedgeDoc's base directory)
-        '';
-      };
-      defaultNotePath = mkOption {
-        type = types.nullOr types.str;
-        default = "${cfg.package}/public/default.md";
-        defaultText = literalExpression "\"\${cfg.package}/public/default.md\"";
-        description = lib.mdDoc ''
-          Path to the default Note file.
-          (Non-canonical paths are relative to HedgeDoc's base directory)
-        '';
-      };
-      docsPath = mkOption {
-        type = types.nullOr types.str;
-        default = "${cfg.package}/public/docs";
-        defaultText = literalExpression "\"\${cfg.package}/public/docs\"";
-        description = lib.mdDoc ''
-          Path to the docs directory.
-          (Non-canonical paths are relative to HedgeDoc's base directory)
-        '';
-      };
-      indexPath = mkOption {
-        type = types.nullOr types.str;
-        default = "${cfg.package}/public/views/index.ejs";
-        defaultText = literalExpression "\"\${cfg.package}/public/views/index.ejs\"";
-        description = lib.mdDoc ''
-          Path to the index template file.
-          (Non-canonical paths are relative to HedgeDoc's base directory)
-        '';
-      };
-      hackmdPath = mkOption {
-        type = types.nullOr types.str;
-        default = "${cfg.package}/public/views/hackmd.ejs";
-        defaultText = literalExpression "\"\${cfg.package}/public/views/hackmd.ejs\"";
-        description = lib.mdDoc ''
-          Path to the hackmd template file.
-          (Non-canonical paths are relative to HedgeDoc's base directory)
-        '';
-      };
-      errorPath = mkOption {
-        type = types.nullOr types.str;
-        default = "${cfg.package}/public/views/error.ejs";
-        defaultText = literalExpression "\"\${cfg.package}/public/views/error.ejs\"";
-        description = lib.mdDoc ''
-          Path to the error template file.
-          (Non-canonical paths are relative to HedgeDoc's base directory)
-        '';
-      };
-      prettyPath = mkOption {
-        type = types.nullOr types.str;
-        default = "${cfg.package}/public/views/pretty.ejs";
-        defaultText = literalExpression "\"\${cfg.package}/public/views/pretty.ejs\"";
-        description = lib.mdDoc ''
-          Path to the pretty template file.
-          (Non-canonical paths are relative to HedgeDoc's base directory)
-        '';
-      };
-      slidePath = mkOption {
-        type = types.nullOr types.str;
-        default = "${cfg.package}/public/views/slide.hbs";
-        defaultText = literalExpression "\"\${cfg.package}/public/views/slide.hbs\"";
-        description = lib.mdDoc ''
-          Path to the slide template file.
-          (Non-canonical paths are relative to HedgeDoc's base directory)
-        '';
-      };
-      uploadsPath = mkOption {
-        type = types.str;
-        default = "${cfg.workDir}/uploads";
-        defaultText = literalExpression "\"\${cfg.workDir}/uploads\"";
-        description = lib.mdDoc ''
-          Path under which uploaded files are saved.
-        '';
-      };
-      sessionName = mkOption {
-        type = types.str;
-        default = "connect.sid";
-        description = lib.mdDoc ''
-          Specify the name of the session cookie.
-        '';
-      };
-      sessionSecret = mkOption {
-        type = types.nullOr types.str;
-        default = null;
-        description = lib.mdDoc ''
-          Specify the secret used to sign the session cookie.
-          If unset, one will be generated on startup.
-        '';
-      };
-      sessionLife = mkOption {
-        type = types.int;
-        default = 1209600000;
-        description = lib.mdDoc ''
-          Session life time in milliseconds.
-        '';
-      };
-      heartbeatInterval = mkOption {
-        type = types.int;
-        default = 5000;
-        description = lib.mdDoc ''
-          Specify the socket.io heartbeat interval.
-        '';
-      };
-      heartbeatTimeout = mkOption {
-        type = types.int;
-        default = 10000;
-        description = lib.mdDoc ''
-          Specify the socket.io heartbeat timeout.
-        '';
-      };
-      documentMaxLength = mkOption {
-        type = types.int;
-        default = 100000;
-        description = lib.mdDoc ''
-          Specify the maximum document length.
-        '';
-      };
-      email = mkOption {
-        type = types.bool;
-        default = true;
-        description = lib.mdDoc ''
-          Whether to enable email sign-in.
-        '';
-      };
-      allowEmailRegister = mkOption {
-        type = types.bool;
-        default = true;
-        description = lib.mdDoc ''
-          Whether to enable email registration.
-        '';
-      };
-      allowGravatar = mkOption {
-        type = types.bool;
-        default = true;
-        description = lib.mdDoc ''
-          Whether to use gravatar as profile picture source.
-        '';
-      };
-      imageUploadType = mkOption {
-        type = types.enum [ "imgur" "s3" "minio" "filesystem" ];
-        default = "filesystem";
-        description = lib.mdDoc ''
-          Specify where to upload images.
-        '';
-      };
-      minio = mkOption {
-        type = types.nullOr (types.submodule {
-          options = {
-            accessKey = mkOption {
-              type = types.str;
-              description = lib.mdDoc ''
-                Minio access key.
-              '';
-            };
-            secretKey = mkOption {
-              type = types.str;
-              description = lib.mdDoc ''
-                Minio secret key.
-              '';
-            };
-            endPoint = mkOption {
-              type = types.str;
-              description = lib.mdDoc ''
-                Minio endpoint.
-              '';
-            };
-            port = mkOption {
-              type = types.port;
-              default = 9000;
-              description = lib.mdDoc ''
-                Minio listen port.
-              '';
-            };
-            secure = mkOption {
-              type = types.bool;
-              default = true;
-              description = lib.mdDoc ''
-                Whether to use HTTPS for Minio.
-              '';
-            };
+              This is useful if you are trying to run hedgedoc behind
+              a reverse proxy.
+            '';
           };
-        });
-        default = null;
-        description = lib.mdDoc "Configure the minio third-party integration.";
-      };
-      s3 = mkOption {
-        type = types.nullOr (types.submodule {
-          options = {
-            accessKeyId = mkOption {
-              type = types.str;
-              description = lib.mdDoc ''
-                AWS access key id.
-              '';
-            };
-            secretAccessKey = mkOption {
-              type = types.str;
-              description = lib.mdDoc ''
-                AWS access key.
-              '';
-            };
-            region = mkOption {
-              type = types.str;
-              description = lib.mdDoc ''
-                AWS S3 region.
-              '';
-            };
-          };
-        });
-        default = null;
-        description = lib.mdDoc "Configure the s3 third-party integration.";
-      };
-      s3bucket = mkOption {
-        type = types.nullOr types.str;
-        default = null;
-        description = lib.mdDoc ''
-          Specify the bucket name for upload types `s3` and `minio`.
-        '';
-      };
-      allowPDFExport = mkOption {
-        type = types.bool;
-        default = true;
-        description = lib.mdDoc ''
-          Whether to enable PDF exports.
-        '';
-      };
-      imgur.clientId = mkOption {
-        type = types.nullOr types.str;
-        default = null;
-        description = lib.mdDoc ''
-          Imgur API client ID.
-        '';
-      };
-      azure = mkOption {
-        type = types.nullOr (types.submodule {
-          options = {
-            connectionString = mkOption {
-              type = types.str;
-              description = lib.mdDoc ''
-                Azure Blob Storage connection string.
-              '';
-            };
-            container = mkOption {
-              type = types.str;
-              description = lib.mdDoc ''
-                Azure Blob Storage container name.
-                It will be created if non-existent.
-              '';
-            };
-          };
-        });
-        default = null;
-        description = lib.mdDoc "Configure the azure third-party integration.";
-      };
-      oauth2 = mkOption {
-        type = types.nullOr (types.submodule {
-          options = {
-            authorizationURL = mkOption {
-              type = types.str;
-              description = lib.mdDoc ''
-                Specify the OAuth authorization URL.
-              '';
-            };
-            tokenURL = mkOption {
-              type = types.str;
-              description = lib.mdDoc ''
-                Specify the OAuth token URL.
-              '';
-            };
-            baseURL = mkOption {
-              type = with types; nullOr str;
-              default = null;
-              description = lib.mdDoc ''
-                Specify the OAuth base URL.
-              '';
-            };
-            userProfileURL = mkOption {
-              type = with types; nullOr str;
-              default = null;
-              description = lib.mdDoc ''
-                Specify the OAuth userprofile URL.
-              '';
-            };
-            userProfileUsernameAttr = mkOption {
-              type = with types; nullOr str;
-              default = null;
-              description = lib.mdDoc ''
-                Specify the name of the attribute for the username from the claim.
-              '';
-            };
-            userProfileDisplayNameAttr = mkOption {
-              type = with types; nullOr str;
-              default = null;
-              description = lib.mdDoc ''
-                Specify the name of the attribute for the display name from the claim.
-              '';
-            };
-            userProfileEmailAttr = mkOption {
-              type = with types; nullOr str;
-              default = null;
-              description = lib.mdDoc ''
-                Specify the name of the attribute for the email from the claim.
-              '';
-            };
-            scope = mkOption {
-              type = with types; nullOr str;
-              default = null;
-              description = lib.mdDoc ''
-                Specify the OAuth scope.
-              '';
-            };
-            providerName = mkOption {
-              type = with types; nullOr str;
-              default = null;
-              description = lib.mdDoc ''
-                Specify the name to be displayed for this strategy.
-              '';
-            };
-            rolesClaim = mkOption {
-              type = with types; nullOr str;
-              default = null;
-              description = lib.mdDoc ''
-                Specify the role claim name.
-              '';
-            };
-            accessRole = mkOption {
-              type = with types; nullOr str;
-              default = null;
-              description = lib.mdDoc ''
-                Specify role which should be included in the ID token roles claim to grant access
-              '';
-            };
-            clientID = mkOption {
-              type = types.str;
-              description = lib.mdDoc ''
-                Specify the OAuth client ID.
-              '';
-            };
-            clientSecret = mkOption {
-              type = with types; nullOr str;
-              default = null;
-              description = lib.mdDoc ''
-                Specify the OAuth client secret.
-              '';
-            };
+          urlPath = mkOption {
+            type = with types; nullOr str;
+            default = null;
+            example = "hedgedoc";
+            description = mdDoc ''
+              URL path for the website.
+
+              This is useful if you are hosting hedgedoc on a path like
+              `www.example.com/hedgedoc`
+            '';
           };
-        });
-        default = null;
-        description = lib.mdDoc "Configure the OAuth integration.";
-      };
-      facebook = mkOption {
-        type = types.nullOr (types.submodule {
-          options = {
-            clientID = mkOption {
-              type = types.str;
-              description = lib.mdDoc ''
-                Facebook API client ID.
-              '';
-            };
-            clientSecret = mkOption {
-              type = types.str;
-              description = lib.mdDoc ''
-                Facebook API client secret.
-              '';
-            };
+          host = mkOption {
+            type = with types; nullOr str;
+            default = "localhost";
+            description = mdDoc ''
+              Address to listen on.
+            '';
           };
-        });
-        default = null;
-        description = lib.mdDoc "Configure the facebook third-party integration";
-      };
-      twitter = mkOption {
-        type = types.nullOr (types.submodule {
-          options = {
-            consumerKey = mkOption {
-              type = types.str;
-              description = lib.mdDoc ''
-                Twitter API consumer key.
-              '';
-            };
-            consumerSecret = mkOption {
-              type = types.str;
-              description = lib.mdDoc ''
-                Twitter API consumer secret.
-              '';
-            };
+          port = mkOption {
+            type = types.port;
+            default = 3000;
+            example = 80;
+            description = mdDoc ''
+              Port to listen on.
+            '';
           };
-        });
-        default = null;
-        description = lib.mdDoc "Configure the Twitter third-party integration.";
-      };
-      github = mkOption {
-        type = types.nullOr (types.submodule {
-          options = {
-            clientID = mkOption {
-              type = types.str;
-              description = lib.mdDoc ''
-                GitHub API client ID.
-              '';
-            };
-            clientSecret = mkOption {
-              type = types.str;
-              description = lib.mdDoc ''
-                Github API client secret.
-              '';
-            };
+          path = mkOption {
+            type = with types; nullOr path;
+            default = null;
+            example = "/run/hedgedoc/hedgedoc.sock";
+            description = mdDoc ''
+              Path to UNIX domain socket to listen on
+
+              ::: {.note}
+                If specified, {option}`host` and {option}`port` will be ignored.
+              :::
+            '';
           };
-        });
-        default = null;
-        description = lib.mdDoc "Configure the GitHub third-party integration.";
-      };
-      gitlab = mkOption {
-        type = types.nullOr (types.submodule {
-          options = {
-            baseURL = mkOption {
-              type = types.str;
-              default = "";
-              description = lib.mdDoc ''
-                GitLab API authentication endpoint.
-                Only needed for other endpoints than gitlab.com.
-              '';
-            };
-            clientID = mkOption {
-              type = types.str;
-              description = lib.mdDoc ''
-                GitLab API client ID.
-              '';
-            };
-            clientSecret = mkOption {
-              type = types.str;
-              description = lib.mdDoc ''
-                GitLab API client secret.
-              '';
-            };
-            scope = mkOption {
-              type = types.enum [ "api" "read_user" ];
-              default = "api";
-              description = lib.mdDoc ''
-                GitLab API requested scope.
-                GitLab snippet import/export requires api scope.
-              '';
-            };
+          protocolUseSSL = mkOption {
+            type = types.bool;
+            default = false;
+            example = true;
+            description = mdDoc ''
+              Use `https://` for all links.
+
+              This is useful if you are trying to run hedgedoc behind
+              a reverse proxy.
+
+              ::: {.note}
+                Only applied if {option}`domain` is set.
+              :::
+            '';
           };
-        });
-        default = null;
-        description = lib.mdDoc "Configure the GitLab third-party integration.";
-      };
-      mattermost = mkOption {
-        type = types.nullOr (types.submodule {
-          options = {
-            baseURL = mkOption {
-              type = types.str;
-              description = lib.mdDoc ''
-                Mattermost authentication endpoint.
-              '';
-            };
-            clientID = mkOption {
-              type = types.str;
-              description = lib.mdDoc ''
-                Mattermost API client ID.
-              '';
-            };
-            clientSecret = mkOption {
-              type = types.str;
-              description = lib.mdDoc ''
-                Mattermost API client secret.
-              '';
-            };
+          allowOrigin = mkOption {
+            type = with types; listOf str;
+            default = with cfg.settings; [ host ] ++ lib.optionals (domain != null) [ domain ];
+            defaultText = literalExpression ''
+              with config.services.hedgedoc.settings; [ host ] ++ lib.optionals (domain != null) [ domain ]
+            '';
+            example = [ "localhost" "hedgedoc.org" ];
+            description = mdDoc ''
+              List of domains to whitelist.
+            '';
           };
-        });
-        default = null;
-        description = lib.mdDoc "Configure the Mattermost third-party integration.";
-      };
-      dropbox = mkOption {
-        type = types.nullOr (types.submodule {
-          options = {
-            clientID = mkOption {
-              type = types.str;
-              description = lib.mdDoc ''
-                Dropbox API client ID.
-              '';
-            };
-            clientSecret = mkOption {
-              type = types.str;
-              description = lib.mdDoc ''
-                Dropbox API client secret.
-              '';
-            };
-            appKey = mkOption {
-              type = types.str;
-              description = lib.mdDoc ''
-                Dropbox app key.
-              '';
-            };
+          db = mkOption {
+            type = types.attrs;
+            default = {
+              dialect = "sqlite";
+              storage = "/var/lib/${name}/db.sqlite";
+            };
+            defaultText = literalExpression ''
+              {
+                dialect = "sqlite";
+                storage = "/var/lib/hedgedoc/db.sqlite";
+              }
+            '';
+            example = literalExpression ''
+              db = {
+                username = "hedgedoc";
+                database = "hedgedoc";
+                host = "localhost:5432";
+                # or via socket
+                # host = "/run/postgresql";
+                dialect = "postgresql";
+              };
+            '';
+            description = mdDoc ''
+              Specify the configuration for sequelize.
+              HedgeDoc supports `mysql`, `postgres`, `sqlite` and `mssql`.
+              See <https://sequelize.readthedocs.io/en/v3/>
+              for more information.
+
+              ::: {.note}
+                The relevant parts will be overriden if you set {option}`dbURL`.
+              :::
+            '';
           };
-        });
-        default = null;
-        description = lib.mdDoc "Configure the Dropbox third-party integration.";
-      };
-      google = mkOption {
-        type = types.nullOr (types.submodule {
-          options = {
-            clientID = mkOption {
-              type = types.str;
-              description = lib.mdDoc ''
-                Google API client ID.
-              '';
-            };
-            clientSecret = mkOption {
-              type = types.str;
-              description = lib.mdDoc ''
-                Google API client secret.
-              '';
-            };
+          useSSL = mkOption {
+            type = types.bool;
+            default = false;
+            description = mdDoc ''
+              Enable to use SSL server.
+
+              ::: {.note}
+                This will also enable {option}`protocolUseSSL`.
+
+                It will also require you to set the following:
+
+                - {option}`sslKeyPath`
+                - {option}`sslCertPath`
+                - {option}`sslCAPath`
+                - {option}`dhParamPath`
+              :::
+            '';
           };
-        });
-        default = null;
-        description = lib.mdDoc "Configure the Google third-party integration.";
-      };
-      ldap = mkOption {
-        type = types.nullOr (types.submodule {
-          options = {
-            providerName = mkOption {
-              type = types.str;
-              default = "";
-              description = lib.mdDoc ''
-                Optional name to be displayed at login form, indicating the LDAP provider.
-              '';
-            };
-            url = mkOption {
-              type = types.str;
-              example = "ldap://localhost";
-              description = lib.mdDoc ''
-                URL of LDAP server.
-              '';
-            };
-            bindDn = mkOption {
-              type = types.str;
-              description = lib.mdDoc ''
-                Bind DN for LDAP access.
-              '';
-            };
-            bindCredentials = mkOption {
-              type = types.str;
-              description = lib.mdDoc ''
-                Bind credentials for LDAP access.
-              '';
-            };
-            searchBase = mkOption {
-              type = types.str;
-              example = "o=users,dc=example,dc=com";
-              description = lib.mdDoc ''
-                LDAP directory to begin search from.
-              '';
-            };
-            searchFilter = mkOption {
-              type = types.str;
-              example = "(uid={{username}})";
-              description = lib.mdDoc ''
-                LDAP filter to search with.
-              '';
-            };
-            searchAttributes = mkOption {
-              type = types.nullOr (types.listOf types.str);
-              default = null;
-              example = [ "displayName" "mail" ];
-              description = lib.mdDoc ''
-                LDAP attributes to search with.
-              '';
-            };
-            userNameField = mkOption {
-              type = types.str;
-              default = "";
-              description = lib.mdDoc ''
-                LDAP field which is used as the username on HedgeDoc.
-                By default {option}`useridField` is used.
-              '';
-            };
-            useridField = mkOption {
-              type = types.str;
-              example = "uid";
-              description = lib.mdDoc ''
-                LDAP field which is a unique identifier for users on HedgeDoc.
-              '';
-            };
-            tlsca = mkOption {
-              type = types.str;
-              default = "/etc/ssl/certs/ca-certificates.crt";
-              example = "server-cert.pem,root.pem";
-              description = lib.mdDoc ''
-                Root CA for LDAP TLS in PEM format.
-              '';
-            };
+          uploadsPath = mkOption {
+            type = types.path;
+            default = "/var/lib/${name}/uploads";
+            defaultText = "/var/lib/hedgedoc/uploads";
+            description = mdDoc ''
+              Directory for storing uploaded images.
+            '';
           };
-        });
-        default = null;
-        description = lib.mdDoc "Configure the LDAP integration.";
-      };
-      saml = mkOption {
-        type = types.nullOr (types.submodule {
-          options = {
-            idpSsoUrl = mkOption {
-              type = types.str;
-              example = "https://idp.example.com/sso";
-              description = lib.mdDoc ''
-                IdP authentication endpoint.
-              '';
-            };
-            idpCert = mkOption {
-              type = types.path;
-              example = "/path/to/cert.pem";
-              description = lib.mdDoc ''
-                Path to IdP certificate file in PEM format.
-              '';
-            };
-            issuer = mkOption {
-              type = types.str;
-              default = "";
-              description = lib.mdDoc ''
-                Optional identity of the service provider.
-                This defaults to the server URL.
-              '';
-            };
-            identifierFormat = mkOption {
-              type = types.str;
-              default = "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress";
-              description = lib.mdDoc ''
-                Optional name identifier format.
-              '';
-            };
-            groupAttribute = mkOption {
-              type = types.str;
-              default = "";
-              example = "memberOf";
-              description = lib.mdDoc ''
-                Optional attribute name for group list.
-              '';
-            };
-            externalGroups = mkOption {
-              type = types.listOf types.str;
-              default = [];
-              example = [ "Temporary-staff" "External-users" ];
-              description = lib.mdDoc ''
-                Excluded group names.
-              '';
-            };
-            requiredGroups = mkOption {
-              type = types.listOf types.str;
-              default = [];
-              example = [ "Hedgedoc-Users" ];
-              description = lib.mdDoc ''
-                Required group names.
-              '';
-            };
-            providerName = mkOption {
-              type = types.str;
-              default = "";
-              example = "My institution";
-              description = lib.mdDoc ''
-                Optional name to be displayed at login form indicating the SAML provider.
-              '';
-            };
-            attribute = {
-              id = mkOption {
-                type = types.str;
-                default = "";
-                description = lib.mdDoc ''
-                  Attribute map for `id`.
-                  Defaults to `NameID` of SAML response.
-                '';
-              };
-              username = mkOption {
-                type = types.str;
-                default = "";
-                description = lib.mdDoc ''
-                  Attribute map for `username`.
-                  Defaults to `NameID` of SAML response.
-                '';
-              };
-              email = mkOption {
-                type = types.str;
-                default = "";
-                description = lib.mdDoc ''
-                  Attribute map for `email`.
-                  Defaults to `NameID` of SAML response if
-                  {option}`identifierFormat` has
-                  the default value.
-                '';
-              };
-            };
+
+          # Declared because we change the default to false.
+          allowGravatar = mkOption {
+            type = types.bool;
+            default = false;
+            example = true;
+            description = mdDoc ''
+              Whether to enable [Libravatar](https://wiki.libravatar.org/) as
+              profile picture source on your instance.
+
+              Despite the naming of the setting, Hedgedoc replaced Gravatar
+              with Libravatar in [CodiMD 1.4.0](https://hedgedoc.org/releases/1.4.0/)
+            '';
           };
-        });
-        default = null;
-        description = lib.mdDoc "Configure the SAML integration.";
-      };
-    }; in lib.mkOption {
-      type = lib.types.submodule {
-        freeformType = settingsFormat.type;
-        inherit options;
+        };
       };
-      description = lib.mdDoc ''
+
+      description = mdDoc ''
         HedgeDoc configuration, see
         <https://docs.hedgedoc.org/configuration/>
         for documentation.
@@ -1003,7 +202,7 @@ in
       type = with types; nullOr path;
       default = null;
       example = "/var/lib/hedgedoc/hedgedoc.env";
-      description = lib.mdDoc ''
+      description = mdDoc ''
         Environment file as defined in {manpage}`systemd.exec(5)`.
 
         Secrets may be passed to the service without adding them to the world-readable
@@ -1028,45 +227,94 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
-    assertions = [
-      { assertion = cfg.settings.db == {} -> (
-          cfg.settings.dbURL != "" && cfg.settings.dbURL != null
-        );
-        message = "Database configuration for HedgeDoc missing."; }
-    ];
-    users.groups.${name} = {};
+  config = lib.mkIf cfg.enable {
+    users.groups.${name} = { };
     users.users.${name} = {
       description = "HedgeDoc service user";
       group = name;
-      extraGroups = cfg.groups;
-      home = cfg.workDir;
-      createHome = true;
       isSystemUser = true;
     };
 
+    services.hedgedoc.settings = {
+      defaultNotePath = lib.mkDefault "${cfg.package}/public/default.md";
+      docsPath = lib.mkDefault "${cfg.package}/public/docs";
+      viewPath = lib.mkDefault "${cfg.package}/public/views";
+    };
+
     systemd.services.hedgedoc = {
       description = "HedgeDoc Service";
+      documentation = [ "https://docs.hedgedoc.org/" ];
       wantedBy = [ "multi-user.target" ];
       after = [ "networking.target" ];
-      preStart = ''
-        ${pkgs.envsubst}/bin/envsubst \
-          -o ${cfg.workDir}/config.json \
-          -i ${prettyJSON cfg.settings}
-        mkdir -p ${cfg.settings.uploadsPath}
-      '';
+      preStart =
+        let
+          configFile = settingsFormat.generate "hedgedoc-config.json" {
+            production = cfg.settings;
+          };
+        in
+        ''
+          ${pkgs.envsubst}/bin/envsubst \
+            -o /run/${name}/config.json \
+            -i ${configFile}
+          ${pkgs.coreutils}/bin/mkdir -p ${cfg.settings.uploadsPath}
+        '';
       serviceConfig = {
-        WorkingDirectory = cfg.workDir;
-        StateDirectory = [ cfg.workDir cfg.settings.uploadsPath ];
-        ExecStart = "${lib.getExe cfg.package}";
-        EnvironmentFile = mkIf (cfg.environmentFile != null) [ cfg.environmentFile ];
+        User = name;
+        Group = name;
+
+        Restart = "always";
+        ExecStart = "${cfg.package}/bin/hedgedoc";
+        RuntimeDirectory = [ name ];
+        StateDirectory = [ name ];
+        WorkingDirectory = "/run/${name}";
+        ReadWritePaths = [
+          "-${cfg.settings.uploadsPath}"
+        ] ++ lib.optionals (cfg.settings.db ? "storage") [ "-${cfg.settings.db.storage}" ];
+        EnvironmentFile = lib.mkIf (cfg.environmentFile != null) [ cfg.environmentFile ];
         Environment = [
-          "CMD_CONFIG_FILE=${cfg.workDir}/config.json"
+          "CMD_CONFIG_FILE=/run/${name}/config.json"
           "NODE_ENV=production"
         ];
-        Restart = "always";
-        User = name;
+
+        # Hardening
+        AmbientCapabilities = "";
+        CapabilityBoundingSet = "";
+        LockPersonality = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateMounts = true;
         PrivateTmp = true;
+        PrivateUsers = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        RemoveIPC = true;
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          # Required for connecting to database sockets,
+          # and listening to unix socket at `cfg.settings.path`
+          "AF_UNIX"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SocketBindAllow = lib.mkIf (cfg.settings.path == null) cfg.settings.port;
+        SocketBindDeny = "any";
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged @obsolete"
+          "@pkey"
+        ];
+        UMask = "0007";
       };
     };
   };
diff --git a/nixos/modules/services/web-apps/hledger-web.nix b/nixos/modules/services/web-apps/hledger-web.nix
index 0fc283ff5219..be8ecc645e59 100644
--- a/nixos/modules/services/web-apps/hledger-web.nix
+++ b/nixos/modules/services/web-apps/hledger-web.nix
@@ -7,7 +7,7 @@ in {
 
     enable = mkEnableOption (lib.mdDoc "hledger-web service");
 
-    serveApi = mkEnableOption (lib.mdDoc "Serve only the JSON web API, without the web UI");
+    serveApi = mkEnableOption (lib.mdDoc "serving only the JSON web API, without the web UI");
 
     host = mkOption {
       type = types.str;
diff --git a/nixos/modules/services/web-apps/isso.nix b/nixos/modules/services/web-apps/isso.nix
index 1a852ec352f2..6cb2d9ec785e 100644
--- a/nixos/modules/services/web-apps/isso.nix
+++ b/nixos/modules/services/web-apps/isso.nix
@@ -12,11 +12,11 @@ in {
   options = {
     services.isso = {
       enable = mkEnableOption (lib.mdDoc ''
-        A commenting server similar to Disqus.
+        isso, a commenting server similar to Disqus.
 
         Note: The application's author suppose to run isso behind a reverse proxy.
         The embedded solution offered by NixOS is also only suitable for small installations
-        below 20 requests per second.
+        below 20 requests per second
       '');
 
       settings = mkOption {
diff --git a/nixos/modules/services/web-apps/jitsi-meet.nix b/nixos/modules/services/web-apps/jitsi-meet.nix
index 3825b03c2449..21416be35877 100644
--- a/nixos/modules/services/web-apps/jitsi-meet.nix
+++ b/nixos/modules/services/web-apps/jitsi-meet.nix
@@ -105,9 +105,9 @@ in
         type = bool;
         default = true;
         description = lib.mdDoc ''
-          Whether to enable Jitsi Videobridge instance and configure it to connect to Prosody.
+          Jitsi Videobridge instance and configure it to connect to Prosody.
 
-          Additional configuration is possible with {option}`services.jitsi-videobridge`.
+          Additional configuration is possible with {option}`services.jitsi-videobridge`
         '';
       };
 
diff --git a/nixos/modules/services/web-apps/meme-bingo-web.nix b/nixos/modules/services/web-apps/meme-bingo-web.nix
index cb864321ef27..652dc8840252 100644
--- a/nixos/modules/services/web-apps/meme-bingo-web.nix
+++ b/nixos/modules/services/web-apps/meme-bingo-web.nix
@@ -8,9 +8,9 @@ in {
   options = {
     services.meme-bingo-web = {
       enable = mkEnableOption (mdDoc ''
-        A web app for the meme bingo, rendered entirely on the web server and made interactive with forms.
+        a web app for the meme bingo, rendered entirely on the web server and made interactive with forms.
 
-        Note: The application's author suppose to run meme-bingo-web behind a reverse proxy for SSL and HTTP/3.
+        Note: The application's author suppose to run meme-bingo-web behind a reverse proxy for SSL and HTTP/3
       '');
 
       package = mkOption {
diff --git a/nixos/modules/services/web-apps/phylactery.nix b/nixos/modules/services/web-apps/phylactery.nix
index 4801bd203b48..723b38ee75d9 100644
--- a/nixos/modules/services/web-apps/phylactery.nix
+++ b/nixos/modules/services/web-apps/phylactery.nix
@@ -4,7 +4,7 @@ with lib;
 let cfg = config.services.phylactery;
 in {
   options.services.phylactery = {
-    enable = mkEnableOption (lib.mdDoc "Whether to enable Phylactery server");
+    enable = mkEnableOption (lib.mdDoc "Phylactery server");
 
     host = mkOption {
       type = types.str;
diff --git a/nixos/modules/services/web-apps/snipe-it.nix b/nixos/modules/services/web-apps/snipe-it.nix
index e861a4185194..9cba5cb4fa9e 100644
--- a/nixos/modules/services/web-apps/snipe-it.nix
+++ b/nixos/modules/services/web-apps/snipe-it.nix
@@ -30,7 +30,7 @@ let
 in {
   options.services.snipe-it = {
 
-    enable = mkEnableOption (lib.mdDoc "A free open source IT asset/license management system");
+    enable = mkEnableOption (lib.mdDoc "snipe-it, a free open source IT asset/license management system");
 
     user = mkOption {
       default = "snipeit";
diff --git a/nixos/modules/services/web-apps/zitadel.nix b/nixos/modules/services/web-apps/zitadel.nix
index f225d138cc43..99b0a0bc56f6 100644
--- a/nixos/modules/services/web-apps/zitadel.nix
+++ b/nixos/modules/services/web-apps/zitadel.nix
@@ -9,7 +9,7 @@ in
   options.services.zitadel =
     let inherit (lib) mkEnableOption mkOption mkPackageOption types;
     in {
-      enable = mkEnableOption "ZITADEL, a user and identity access management platform.";
+      enable = mkEnableOption "ZITADEL, a user and identity access management platform";
 
       package = mkPackageOption pkgs "ZITADEL" { default = [ "zitadel" ]; };
 
diff --git a/nixos/modules/services/web-servers/keter/default.nix b/nixos/modules/services/web-servers/keter/default.nix
index 3916c486475d..0cd9c30cea14 100644
--- a/nixos/modules/services/web-servers/keter/default.nix
+++ b/nixos/modules/services/web-servers/keter/default.nix
@@ -16,7 +16,7 @@ in
   options.services.keter = {
     enable = lib.mkEnableOption (lib.mdDoc ''keter, a web app deployment manager.
 Note that this module only support loading of webapps:
-Keep an old app running and swap the ports when the new one is booted.
+Keep an old app running and swap the ports when the new one is booted
 '');
 
     root = lib.mkOption {
diff --git a/nixos/modules/services/web-servers/rustus.nix b/nixos/modules/services/web-servers/rustus.nix
index 878d790e3666..6d3b2e6a65d9 100644
--- a/nixos/modules/services/web-servers/rustus.nix
+++ b/nixos/modules/services/web-servers/rustus.nix
@@ -8,7 +8,7 @@ in
 
   options.services.rustus = {
 
-    enable = mkEnableOption (lib.mdDoc "TUS protocol implementation in Rust.");
+    enable = mkEnableOption (lib.mdDoc "TUS protocol implementation in Rust");
 
     host = mkOption {
       type = types.str;
diff --git a/nixos/modules/services/x11/desktop-managers/deepin.nix b/nixos/modules/services/x11/desktop-managers/deepin.nix
index b2369e2426f8..28d751305892 100644
--- a/nixos/modules/services/x11/desktop-managers/deepin.nix
+++ b/nixos/modules/services/x11/desktop-managers/deepin.nix
@@ -15,7 +15,7 @@ in
   options = {
 
     services.xserver.desktopManager.deepin = {
-      enable = mkEnableOption (lib.mdDoc "Enable Deepin desktop manager");
+      enable = mkEnableOption (lib.mdDoc "Deepin desktop manager");
       extraGSettingsOverrides = mkOption {
         default = "";
         type = types.lines;
diff --git a/nixos/modules/system/activation/bootspec.nix b/nixos/modules/system/activation/bootspec.nix
index 9e1fa309d5db..98c234bc340d 100644
--- a/nixos/modules/system/activation/bootspec.nix
+++ b/nixos/modules/system/activation/bootspec.nix
@@ -79,7 +79,7 @@ in
       // { default = true; internal = true; };
     enableValidation = lib.mkEnableOption (lib.mdDoc ''the validation of bootspec documents for each build.
       This will introduce Go in the build-time closure as we are relying on [Cuelang](https://cuelang.org/) for schema validation.
-      Enable this option if you want to ascertain that your documents are correct.
+      Enable this option if you want to ascertain that your documents are correct
       ''
     );
 
diff --git a/nixos/modules/system/activation/switch-to-configuration.pl b/nixos/modules/system/activation/switch-to-configuration.pl
index e05f89bb0fb4..b3ff3ac0abf3 100755
--- a/nixos/modules/system/activation/switch-to-configuration.pl
+++ b/nixos/modules/system/activation/switch-to-configuration.pl
@@ -599,7 +599,9 @@ while (my ($unit, $state) = each(%{$active_cur})) {
                     $units_to_start{$unit} = 1;
                     record_unit($start_list_file, $unit);
                     # Don't spam the user with target units that always get started.
-                    $units_to_filter{$unit} = 1;
+                    if (($ENV{"STC_DISPLAY_ALL_UNITS"} // "") ne "1") {
+                        $units_to_filter{$unit} = 1;
+                    }
                 }
             }
 
diff --git a/nixos/modules/system/boot/grow-partition.nix b/nixos/modules/system/boot/grow-partition.nix
index a2764187a533..897602f9826a 100644
--- a/nixos/modules/system/boot/grow-partition.nix
+++ b/nixos/modules/system/boot/grow-partition.nix
@@ -12,33 +12,32 @@ with lib;
   ];
 
   options = {
-    boot.growPartition = mkEnableOption (lib.mdDoc "grow the root partition on boot");
+    boot.growPartition = mkEnableOption (lib.mdDoc "growing the root partition on boot");
   };
 
   config = mkIf config.boot.growPartition {
-
-    assertions = [{
-      assertion = !config.boot.initrd.systemd.enable;
-      message = "systemd stage 1 does not support 'boot.growPartition' yet.";
-    }];
-
-    boot.initrd.extraUtilsCommands = ''
-      copy_bin_and_libs ${pkgs.gawk}/bin/gawk
-      copy_bin_and_libs ${pkgs.gnused}/bin/sed
-      copy_bin_and_libs ${pkgs.util-linux}/sbin/sfdisk
-      copy_bin_and_libs ${pkgs.util-linux}/sbin/lsblk
-
-      substitute "${pkgs.cloud-utils.guest}/bin/.growpart-wrapped" "$out/bin/growpart" \
-        --replace "${pkgs.bash}/bin/sh" "/bin/sh" \
-        --replace "awk" "gawk" \
-        --replace "sed" "gnused"
-
-      ln -s sed $out/bin/gnused
-    '';
-
-    boot.initrd.postDeviceCommands = ''
-      rootDevice="${config.fileSystems."/".device}"
-      if waitDevice "$rootDevice"; then
+    assertions = [
+      {
+        assertion = !config.boot.initrd.systemd.repart.enable && !config.systemd.repart.enable;
+        message = "systemd-repart already grows the root partition and thus you should not use boot.growPartition";
+      }
+    ];
+    systemd.services.growpart = {
+      wantedBy = [ "-.mount" ];
+      after = [ "-.mount" ];
+      before = [ "systemd-growfs-root.service" ];
+      conflicts = [ "shutdown.target" ];
+      unitConfig.DefaultDependencies = false;
+      serviceConfig = {
+        Type = "oneshot";
+        RemainAfterExit = true;
+        TimeoutSec = "infinity";
+        # growpart returns 1 if the partition is already grown
+        SuccessExitStatus = "0 1";
+      };
+
+      script = ''
+        rootDevice="${config.fileSystems."/".device}"
         rootDevice="$(readlink -f "$rootDevice")"
         parentDevice="$rootDevice"
         while [ "''${parentDevice%[0-9]}" != "''${parentDevice}" ]; do
@@ -48,11 +47,8 @@ with lib;
         if [ "''${parentDevice%[0-9]p}" != "''${parentDevice}" ] && [ -b "''${parentDevice%p}" ]; then
           parentDevice="''${parentDevice%p}"
         fi
-        TMPDIR=/run sh $(type -P growpart) "$parentDevice" "$partNum"
-        udevadm settle
-      fi
-    '';
-
+        "${pkgs.cloud-utils.guest}/bin/growpart" "$parentDevice" "$partNum"
+      '';
+    };
   };
-
 }
diff --git a/nixos/modules/system/boot/loader/external/external.nix b/nixos/modules/system/boot/loader/external/external.nix
index 926cbd2b4b3f..78982356a9ea 100644
--- a/nixos/modules/system/boot/loader/external/external.nix
+++ b/nixos/modules/system/boot/loader/external/external.nix
@@ -12,7 +12,7 @@ in
   };
 
   options.boot.loader.external = {
-    enable = mkEnableOption (lib.mdDoc "use an external tool to install your bootloader");
+    enable = mkEnableOption (lib.mdDoc "using an external tool to install your bootloader");
 
     installHook = mkOption {
       type = with types; path;
diff --git a/nixos/modules/system/boot/systemd/homed.nix b/nixos/modules/system/boot/systemd/homed.nix
index 403d1690124d..b216820c0c0c 100644
--- a/nixos/modules/system/boot/systemd/homed.nix
+++ b/nixos/modules/system/boot/systemd/homed.nix
@@ -5,7 +5,7 @@ let
 in
 {
   options.services.homed.enable = lib.mkEnableOption (lib.mdDoc ''
-    Enable systemd home area/user account manager
+    systemd home area/user account manager
   '');
 
   config = lib.mkIf cfg.enable {
diff --git a/nixos/modules/system/boot/systemd/userdbd.nix b/nixos/modules/system/boot/systemd/userdbd.nix
index 994aa3ca3b8c..e7f6d42341c4 100644
--- a/nixos/modules/system/boot/systemd/userdbd.nix
+++ b/nixos/modules/system/boot/systemd/userdbd.nix
@@ -5,7 +5,7 @@ let
 in
 {
   options.services.userdbd.enable = lib.mkEnableOption (lib.mdDoc ''
-    Enables the systemd JSON user/group record lookup service
+    the systemd JSON user/group record lookup service
   '');
   config = lib.mkIf cfg.enable {
     systemd.additionalUpstreamSystemUnits = [
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 22371c9fec37..33f8abf6ccd4 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -332,6 +332,7 @@ in {
   graphite = handleTest ./graphite.nix {};
   graylog = handleTest ./graylog.nix {};
   grocy = handleTest ./grocy.nix {};
+  grow-partition = runTest ./grow-partition.nix;
   grub = handleTest ./grub.nix {};
   guacamole-server = handleTest ./guacamole-server.nix {};
   gvisor = handleTest ./gvisor.nix {};
diff --git a/nixos/tests/grow-partition.nix b/nixos/tests/grow-partition.nix
new file mode 100644
index 000000000000..344910848dca
--- /dev/null
+++ b/nixos/tests/grow-partition.nix
@@ -0,0 +1,83 @@
+{ lib, ... }:
+
+let
+  rootFslabel = "external";
+  rootFsDevice = "/dev/disk/by-label/${rootFslabel}";
+
+  externalModule = partitionTableType: { config, lib, pkgs, ... }: {
+    virtualisation.directBoot.enable = false;
+    virtualisation.mountHostNixStore = false;
+    virtualisation.useEFIBoot = partitionTableType == "efi";
+
+    # This stops the qemu-vm module from overriding the fileSystems option
+    # with virtualisation.fileSystems.
+    virtualisation.fileSystems = lib.mkForce { };
+
+
+    boot.loader.grub.enable = true;
+    boot.loader.grub.efiSupport = partitionTableType == "efi";
+    boot.loader.grub.efiInstallAsRemovable = partitionTableType == "efi";
+    boot.loader.grub.device = if partitionTableType == "efi" then "nodev" else "/dev/vda";
+
+    boot.growPartition = true;
+
+    fileSystems = {
+      "/".device = rootFsDevice;
+    };
+
+    system.build.diskImage = import ../lib/make-disk-image.nix {
+      inherit config lib pkgs;
+      label = rootFslabel;
+      inherit partitionTableType;
+      format = "raw";
+      bootSize = "128M";
+      additionalSpace = "0M";
+      copyChannel = false;
+    };
+  };
+in
+{
+  name = "grow-partition";
+
+  meta.maintainers = with lib.maintainers; [ arianvp ];
+
+  nodes = {
+    efi = externalModule "efi";
+    legacy = externalModule "legacy";
+    legacyGPT = externalModule "legacy+gpt";
+    hybrid = externalModule "hybrid";
+  };
+
+
+  testScript = { nodes, ... }:
+    lib.concatLines (lib.mapAttrsToList (name: node: ''
+    import os
+    import subprocess
+    import tempfile
+    import shutil
+
+    tmp_disk_image = tempfile.NamedTemporaryFile()
+
+    shutil.copyfile("${node.system.build.diskImage}/nixos.img", tmp_disk_image.name)
+
+    subprocess.run([
+      "${node.virtualisation.qemu.package}/bin/qemu-img",
+      "resize",
+      "-f",
+      "raw",
+      tmp_disk_image.name,
+      "+32M",
+    ])
+
+    # Set NIX_DISK_IMAGE so that the qemu script finds the right disk image.
+    os.environ['NIX_DISK_IMAGE'] = tmp_disk_image.name
+
+    ${name}.wait_for_unit("growpart.service")
+    systemd_growpart_logs = ${name}.succeed("journalctl --boot --unit growpart.service")
+    assert "CHANGED" in systemd_growpart_logs
+    ${name}.succeed("systemctl restart growpart.service")
+    systemd_growpart_logs = ${name}.succeed("journalctl --boot --unit growpart.service")
+    assert "NOCHANGE" in systemd_growpart_logs
+
+    '') nodes);
+}
diff --git a/nixos/tests/hedgedoc.nix b/nixos/tests/hedgedoc.nix
index 410350d83627..16e0dc14e947 100644
--- a/nixos/tests/hedgedoc.nix
+++ b/nixos/tests/hedgedoc.nix
@@ -8,25 +8,54 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
 
   nodes = {
     hedgedocSqlite = { ... }: {
+      services.hedgedoc.enable = true;
+    };
+
+    hedgedocPostgresWithTCPSocket = { ... }: {
+      systemd.services.hedgedoc.after = [ "postgresql.service" ];
       services = {
         hedgedoc = {
           enable = true;
-          settings.dbURL = "sqlite:///var/lib/hedgedoc/hedgedoc.db";
+          settings.db = {
+            dialect = "postgres";
+            user = "hedgedoc";
+            password = "$DB_PASSWORD";
+            host = "localhost";
+            port = 5432;
+            database = "hedgedocdb";
+          };
+
+          /*
+           * Do not use pkgs.writeText for secrets as
+           * they will end up in the world-readable Nix store.
+           */
+          environmentFile = pkgs.writeText "hedgedoc-env" ''
+            DB_PASSWORD=snakeoilpassword
+          '';
+        };
+        postgresql = {
+          enable = true;
+          initialScript = pkgs.writeText "pg-init-script.sql" ''
+            CREATE ROLE hedgedoc LOGIN PASSWORD 'snakeoilpassword';
+            CREATE DATABASE hedgedocdb OWNER hedgedoc;
+          '';
         };
       };
     };
 
-    hedgedocPostgres = { ... }: {
+    hedgedocPostgresWithUNIXSocket = { ... }: {
       systemd.services.hedgedoc.after = [ "postgresql.service" ];
       services = {
         hedgedoc = {
           enable = true;
-          settings.dbURL = "postgres://hedgedoc:\${DB_PASSWORD}@localhost:5432/hedgedocdb";
+          settings.db = {
+            dialect = "postgres";
+            user = "hedgedoc";
+            password = "$DB_PASSWORD";
+            host = "/run/postgresql";
+            database = "hedgedocdb";
+          };
 
-          /*
-           * Do not use pkgs.writeText for secrets as
-           * they will end up in the world-readable Nix store.
-           */
           environmentFile = pkgs.writeText "hedgedoc-env" ''
             DB_PASSWORD=snakeoilpassword
           '';
@@ -50,11 +79,18 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
         hedgedocSqlite.wait_for_open_port(3000)
         hedgedocSqlite.wait_until_succeeds("curl -sSf http://localhost:3000/new")
 
-    with subtest("HedgeDoc postgres"):
-        hedgedocPostgres.wait_for_unit("postgresql.service")
-        hedgedocPostgres.wait_for_unit("hedgedoc.service")
-        hedgedocPostgres.wait_for_open_port(5432)
-        hedgedocPostgres.wait_for_open_port(3000)
-        hedgedocPostgres.wait_until_succeeds("curl -sSf http://localhost:3000/new")
+    with subtest("HedgeDoc postgres with TCP socket"):
+        hedgedocPostgresWithTCPSocket.wait_for_unit("postgresql.service")
+        hedgedocPostgresWithTCPSocket.wait_for_unit("hedgedoc.service")
+        hedgedocPostgresWithTCPSocket.wait_for_open_port(5432)
+        hedgedocPostgresWithTCPSocket.wait_for_open_port(3000)
+        hedgedocPostgresWithTCPSocket.wait_until_succeeds("curl -sSf http://localhost:3000/new")
+
+    with subtest("HedgeDoc postgres with UNIX socket"):
+        hedgedocPostgresWithUNIXSocket.wait_for_unit("postgresql.service")
+        hedgedocPostgresWithUNIXSocket.wait_for_unit("hedgedoc.service")
+        hedgedocPostgresWithUNIXSocket.wait_for_open_port(5432)
+        hedgedocPostgresWithUNIXSocket.wait_for_open_port(3000)
+        hedgedocPostgresWithUNIXSocket.wait_until_succeeds("curl -sSf http://localhost:3000/new")
   '';
 })
diff --git a/pkgs/applications/audio/soundwireserver/default.nix b/pkgs/applications/audio/soundwireserver/default.nix
index b296ebdad602..b296ebdad602 100755..100644
--- a/pkgs/applications/audio/soundwireserver/default.nix
+++ b/pkgs/applications/audio/soundwireserver/default.nix
diff --git a/pkgs/applications/blockchains/bitcoin/default.nix b/pkgs/applications/blockchains/bitcoin/default.nix
index 24f7d78e4f56..1d0736244b68 100644
--- a/pkgs/applications/blockchains/bitcoin/default.nix
+++ b/pkgs/applications/blockchains/bitcoin/default.nix
@@ -33,14 +33,14 @@ let
 in
 stdenv.mkDerivation rec {
   pname = if withGui then "bitcoin" else "bitcoind";
-  version = "25.0";
+  version = "25.1";
 
   src = fetchurl {
     urls = [
       "https://bitcoincore.org/bin/bitcoin-core-${version}/bitcoin-${version}.tar.gz"
     ];
     # hash retrieved from signed SHA256SUMS
-    sha256 = "5df67cf42ca3b9a0c38cdafec5bbb517da5b58d251f32c8d2a47511f9be1ebc2";
+    sha256 = "bec2a598d8dfa8c2365b77f13012a733ec84b8c30386343b7ac1996e901198c9";
   };
 
   nativeBuildInputs =
diff --git a/pkgs/applications/blockchains/lighthouse/default.nix b/pkgs/applications/blockchains/lighthouse/default.nix
index 20792dd8fd95..44cbb147bd20 100644
--- a/pkgs/applications/blockchains/lighthouse/default.nix
+++ b/pkgs/applications/blockchains/lighthouse/default.nix
@@ -14,6 +14,7 @@
 , rustPlatform
 , Security
 , sqlite
+, rust-jemalloc-sys
 , stdenv
 , SystemConfiguration
 , testers
@@ -70,6 +71,7 @@ rustPlatform.buildRustPackage rec {
 
   buildInputs = [
     sqlite
+    rust-jemalloc-sys
   ] ++ lib.optionals stdenv.isDarwin [
     CoreFoundation
     Security
diff --git a/pkgs/applications/blockchains/polkadot/default.nix b/pkgs/applications/blockchains/polkadot/default.nix
index 1ed5d9819110..4be874ef5ce1 100644
--- a/pkgs/applications/blockchains/polkadot/default.nix
+++ b/pkgs/applications/blockchains/polkadot/default.nix
@@ -2,6 +2,7 @@
 , lib
 , protobuf
 , rocksdb
+, rust-jemalloc-sys-unprefixed
 , rustPlatform
 , rustc-wasm32
 , stdenv
@@ -60,7 +61,9 @@ rustPlatform.buildRustPackage rec {
     rustc-wasm32.llvmPackages.lld
   ];
 
-  buildInputs = lib.optionals stdenv.isDarwin [ Security SystemConfiguration ];
+  buildInputs = [
+    rust-jemalloc-sys-unprefixed
+  ] ++ lib.optionals stdenv.isDarwin [ Security SystemConfiguration ];
 
   # NOTE: we need to force lld otherwise rust-lld is not found for wasm32 target
   CARGO_TARGET_WASM32_UNKNOWN_UNKNOWN_LINKER = "lld";
diff --git a/pkgs/applications/blockchains/snarkos/default.nix b/pkgs/applications/blockchains/snarkos/default.nix
index 080cc4b5c108..000c1ace4a4c 100644
--- a/pkgs/applications/blockchains/snarkos/default.nix
+++ b/pkgs/applications/blockchains/snarkos/default.nix
@@ -10,16 +10,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "snarkos";
-  version = "2.1.7";
+  version = "2.2.1";
 
   src = fetchFromGitHub {
     owner = "AleoHQ";
     repo = "snarkOS";
     rev = "v${version}";
-    sha256 = "sha256-kW41SNbl2vckgUth+BZ6/aM03aT6MFeY4Hwi9OVWtTI=";
+    sha256 = "sha256-vEoEnjVjxVnjZ3Lya1qO2kOypNu07aYSlrSya5NJZzs=";
   };
 
-  cargoHash = "sha256-znEAb4q9H0Doc+XYCf27hV/z2t74kjQUffl/aJzW6tI=";
+  cargoHash = "sha256-CVHvBqfcTqWBtLFcEcs9y/LmQ4gXjX+dfqqZSxN+33A=";
 
   # buildAndTestSubdir = "cli";
 
diff --git a/pkgs/applications/editors/hexdino/default.nix b/pkgs/applications/editors/hexdino/default.nix
index cc3b39ed4bf7..5eb023f8b9ed 100644
--- a/pkgs/applications/editors/hexdino/default.nix
+++ b/pkgs/applications/editors/hexdino/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "hexdino";
-  version = "0.1.2";
+  version = "0.1.3";
 
   src = fetchFromGitHub {
     owner = "Luz";
     repo = pname;
     rev = version;
-    sha256 = "sha256-OFtOa6StpOuLgkULnY5MlqDcSTEiMxogowHIBEiGr4E=";
+    hash = "sha256-glbyftCJiP0/5trW7DOcVCU2q4ZH3zFK96eyGuYR8eY=";
   };
 
-  cargoSha256 = "sha256-lvLiRQNH3rpu+JTXWhQtXczmGRWGtnnLDknZaMp3d0s=";
+  cargoHash = "sha256-nldA8gDMj0iO+HgatiuMqzR6ZCjbxFsTp5pDGbFKA1k=";
 
   meta = with lib; {
     description = "A hex editor with vim like keybindings written in Rust";
diff --git a/pkgs/applications/editors/neovim/neovim-gtk.nix b/pkgs/applications/editors/neovim/neovim-gtk.nix
index eebb980f85cb..eebb980f85cb 100755..100644
--- a/pkgs/applications/editors/neovim/neovim-gtk.nix
+++ b/pkgs/applications/editors/neovim/neovim-gtk.nix
diff --git a/pkgs/applications/editors/tecoc/default.nix b/pkgs/applications/editors/tecoc/default.nix
index 94889a13ef6d..778115dfbfa7 100644
--- a/pkgs/applications/editors/tecoc/default.nix
+++ b/pkgs/applications/editors/tecoc/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tecoc";
-  version = "unstable-2023-04-21";
+  version = "unstable-2023-06-21";
 
   src = fetchFromGitHub {
     owner = "blakemcbride";
     repo = "TECOC";
-    rev = "021d1d15242b9d6c84d70c9ffcf1871793898f0a";
-    hash = "sha256-VGIO+uiAZkdzLYmJztmnKTS4HDIVow4AimaneHj7E1M=";
+    rev = "b4a96395a18c7e64ccaef0e25fdde3b7ef33ac4b";
+    hash = "sha256-KTOGsTtxJh2sneU2VoDNUHcL3m8zt+3rBZTDvK1n02A=";
   };
 
   buildInputs = [ ncurses ];
diff --git a/pkgs/applications/emulators/yuzu/generic.nix b/pkgs/applications/emulators/yuzu/generic.nix
index 3fdd6db84661..a24ded852531 100644
--- a/pkgs/applications/emulators/yuzu/generic.nix
+++ b/pkgs/applications/emulators/yuzu/generic.nix
@@ -49,10 +49,10 @@
 }:
 
 let
-  tzinfoVersion = "220816";
+  tzinfoVersion = "221202";
   tzinfo = fetchurl {
     url = "https://github.com/lat9nq/tzdb_to_nx/releases/download/${tzinfoVersion}/${tzinfoVersion}.zip";
-    hash = "sha256-yv8ykEYPu9upeXovei0u16iqQ7NasH6873KnQy4+KwI=";
+    hash = "sha256-mRzW+iIwrU1zsxHmf+0RArU8BShAoEMvCz+McXFFK3c=";
   };
 in stdenv.mkDerivation {
   pname = "yuzu-${branch}";
diff --git a/pkgs/applications/emulators/yuzu/sources.nix b/pkgs/applications/emulators/yuzu/sources.nix
index fc6d1813afb5..3371bf15c5c9 100644
--- a/pkgs/applications/emulators/yuzu/sources.nix
+++ b/pkgs/applications/emulators/yuzu/sources.nix
@@ -1,19 +1,19 @@
 # Generated by ./update.sh - do not update manually!
-# Last updated: 2023-10-07
+# Last updated: 2023-10-20
 {
   compatList = {
-    rev = "156a0a80efc47069ba3360f8a1b268a1c6f2f505";
+    rev = "9d17cbd71408476c6a28cbf0fa8177155c511681";
     hash = "sha256:1hdsza3wf9a0yvj6h55gsl7xqvhafvbz1i8paz9kg7l49b0gnlh1";
   };
 
   mainline = {
-    version = "1579";
-    hash = "sha256:0689w42as1di8xbh8kq2p0cws8gdwq64zdj3i8wq612nkw0q5s60";
+    version = "1595";
+    hash = "sha256:09b0w6z4w9z4ms2pvik2vrmklfcx25jxcgs61bff3nflilnw9m97";
   };
 
   ea = {
-    version = "3911";
-    distHash = "sha256:0xj642kjhj0gp9l15b3ysj3gmyy47rcvzw9amghsfl13bg5ffnwh";
-    fullHash = "sha256:13rd6kwnhpvjzp67k6pqgl9fsqzwy5d8043hv6kd93gg8jbxkp38";
+    version = "3940";
+    distHash = "sha256:0g0vv274sh3iy56n7s324km87g302005ahi9zh2qhwkiirbnc811";
+    fullHash = "sha256:0ywppc4z5d4b1zl1cr8yfnba58hgi0z2szficwpinapai7q0pyid";
   };
 }
diff --git a/pkgs/applications/graphics/structorizer/default.nix b/pkgs/applications/graphics/structorizer/default.nix
index d1f796e42fee..d1f796e42fee 100755..100644
--- a/pkgs/applications/graphics/structorizer/default.nix
+++ b/pkgs/applications/graphics/structorizer/default.nix
diff --git a/pkgs/applications/misc/blender/default.nix b/pkgs/applications/misc/blender/default.nix
index 00bbcdafff13..8e7fde6d9c29 100644
--- a/pkgs/applications/misc/blender/default.nix
+++ b/pkgs/applications/misc/blender/default.nix
@@ -31,11 +31,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: rec {
   pname = "blender";
-  version = "3.6.4";
+  version = "3.6.5";
 
   src = fetchurl {
     url = "https://download.blender.org/source/${pname}-${version}.tar.xz";
-    hash = "sha256-zFL0GRWAtNC3C+SAspWZmGa8US92EiYQgVfiOsCJRx4=";
+    hash = "sha256-QAHA/pn22HLsfH6VX4Sp7r25raFxAPS1Gergjez38kM=";
   };
 
   patches = [
diff --git a/pkgs/applications/misc/fluxboxlauncher/default.nix b/pkgs/applications/misc/fluxboxlauncher/default.nix
index 4794e14b4698..4794e14b4698 100755..100644
--- a/pkgs/applications/misc/fluxboxlauncher/default.nix
+++ b/pkgs/applications/misc/fluxboxlauncher/default.nix
diff --git a/pkgs/applications/misc/get_iplayer/default.nix b/pkgs/applications/misc/get_iplayer/default.nix
index 2483cc000f01..fe33a7df7569 100644
--- a/pkgs/applications/misc/get_iplayer/default.nix
+++ b/pkgs/applications/misc/get_iplayer/default.nix
@@ -11,13 +11,13 @@
 
 perlPackages.buildPerlPackage rec {
   pname = "get_iplayer";
-  version = "3.31";
+  version = "3.33";
 
   src = fetchFromGitHub {
     owner = "get-iplayer";
     repo = "get_iplayer";
     rev = "v${version}";
-    sha256 = "+ChCF27nmPKbqaZVxsZ6TlbzSdEz6RfMs87NE8xaSRw=";
+    hash = "sha256-cX+ydMvpQNFfQICRVKyhnB5gZkVnOMLPbGgdFymzmeA=";
   };
 
   nativeBuildInputs = [ makeWrapper ] ++ lib.optional stdenv.isDarwin shortenPerlShebang;
@@ -32,10 +32,12 @@ perlPackages.buildPerlPackage rec {
 
   installPhase = ''
     runHook preInstall
+
     mkdir -p $out/bin $out/share/man/man1
     cp get_iplayer $out/bin
     wrapProgram $out/bin/get_iplayer --suffix PATH : ${lib.makeBinPath [ atomicparsley ffmpeg ]} --prefix PERL5LIB : $PERL5LIB
     cp get_iplayer.1 $out/share/man/man1
+
     runHook postInstall
   '';
 
diff --git a/pkgs/applications/misc/html5validator/default.nix b/pkgs/applications/misc/html5validator/default.nix
index 71ba3dcf100a..6c9c65cf4270 100644
--- a/pkgs/applications/misc/html5validator/default.nix
+++ b/pkgs/applications/misc/html5validator/default.nix
@@ -1,25 +1,41 @@
-{ buildPythonApplication, fetchFromGitHub, nose, openjdk, lib }:
+{ lib
+, fetchFromGitHub
+, openjdk
+, python3
+}:
 
-buildPythonApplication rec {
+python3.pkgs.buildPythonApplication rec {
   pname = "html5validator";
-  version = "0.3.3";
+  version = "0.4.2";
+  format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "svenkreiss";
     repo = "html5validator";
-    rev = "v${version}";
-    sha256 = "130acqi0dsy3midg7hwslykzry6crr4ln6ia0f0avyywkz4bplsv";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-yvclqE4+2R9q/UJU9W95U1/xVJeNj+5eKvT6VQel9k8=";
   };
 
-  propagatedBuildInputs = [ openjdk ];
+  propagatedBuildInputs = [
+    openjdk
+  ] ++ (with python3.pkgs; [
+    pyyaml
+  ]);
 
-  nativeCheckInputs = [ nose ];
-  checkPhase = "PATH=$PATH:$out/bin nosetests";
+  nativeCheckInputs = with python3.pkgs; [
+    hacking
+    pytestCheckHook
+  ];
+
+  preCheck = ''
+    export PATH="$PATH:$out/bin";
+  '';
 
   meta = with lib; {
-    homepage = "https://github.com/svenkreiss/html5validator";
     description = "Command line tool that tests files for HTML5 validity";
+    homepage = "https://github.com/svenkreiss/html5validator";
+    changelog = "https://github.com/svenkreiss/html5validator/releases/tag/v${version}";
     license = licenses.mit;
-    maintainers = [ maintainers.phunehehe ];
+    maintainers = with maintainers; [ phunehehe ];
   };
 }
diff --git a/pkgs/applications/misc/leetcode-cli/default.nix b/pkgs/applications/misc/leetcode-cli/default.nix
index be9102b6120b..4ea55b39c531 100644
--- a/pkgs/applications/misc/leetcode-cli/default.nix
+++ b/pkgs/applications/misc/leetcode-cli/default.nix
@@ -2,6 +2,7 @@
 , fetchCrate
 , rustPlatform
 , pkg-config
+, installShellFiles
 , openssl
 , dbus
 , sqlite
@@ -24,6 +25,7 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [
     pkg-config
+    installShellFiles
   ];
 
   buildInputs = [
@@ -32,6 +34,13 @@ rustPlatform.buildRustPackage rec {
     sqlite
   ] ++ lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.Security ];
 
+  postInstall = ''
+    installShellCompletion --cmd leetcode \
+      --bash <($out/bin/leetcode completions bash) \
+      --fish <($out/bin/leetcode completions fish) \
+      --zsh <($out/bin/leetcode completions zsh)
+  '';
+
   passthru.tests = testers.testVersion {
     package = leetcode-cli;
     command = "leetcode -V";
diff --git a/pkgs/applications/misc/octoprint/default.nix b/pkgs/applications/misc/octoprint/default.nix
index aa918ddce9e2..810b13afbf2a 100644
--- a/pkgs/applications/misc/octoprint/default.nix
+++ b/pkgs/applications/misc/octoprint/default.nix
@@ -86,7 +86,7 @@ let
                 owner = "OctoPrint";
                 repo = "OctoPrint";
                 rev = version;
-                hash = "sha256-SYN/BrcukHMDwk70XGu/pO45fSPr/KOEyd4wxtz2Fo0=";
+                hash = "sha256-71uE8JvcS++xH8WSVWj5x0+9s3XIwf3A64c6YtxpSRc=";
               };
 
               propagatedBuildInputs = with self; [
@@ -114,7 +114,6 @@ let
                 netifaces
                 octoprint-filecheck
                 octoprint-firmwarecheck
-                octoprint-pisupport
                 passlib
                 pathvalidate
                 pkginfo
@@ -142,6 +141,8 @@ let
                 pydantic
               ] ++ lib.optionals stdenv.isDarwin [
                 py.pkgs.appdirs
+              ] ++ lib.optionals (!stdenv.isDarwin) [
+                octoprint-pisupport
               ];
 
               nativeCheckInputs = with self; [
diff --git a/pkgs/applications/misc/slweb/default.nix b/pkgs/applications/misc/slweb/default.nix
index 1c6931fadcd4..ee5e01b79956 100644
--- a/pkgs/applications/misc/slweb/default.nix
+++ b/pkgs/applications/misc/slweb/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "slweb";
-  version = "0.6.11";
+  version = "0.9.0";
 
   src = fetchFromSourcehut {
     owner = "~strahinja";
     repo = "slweb";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-+bKapK/s1pmo1NRRslf7V4ogWTtchFNWpzi+S8YG6+4=";
+    hash = "sha256-QDHcp5pCmapgOlJpDDyyC12JOfh/biDyF6O+iKGbOGg=";
   };
 
   nativeBuildInputs = [ redo-apenwarr ];
diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix
index e3bb552d57c0..22d71e8975f8 100644
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@@ -148,36 +148,39 @@ let
       else throw "no chromium Rosetta Stone entry for os: ${platform.config}";
   };
 
+  recompressTarball = { version, sha256 ? "" }: fetchzip {
+    name = "chromium-${version}.tar.zstd";
+    url = "https://commondatastorage.googleapis.com/chromium-browser-official/chromium-${version}.tar.xz";
+    inherit sha256;
+
+    nativeBuildInputs = [ zstd ];
+
+    postFetch = ''
+      echo removing unused code from tarball to stay under hydra limit
+      rm -r $out/third_party/{rust-src,llvm}
+
+      echo moving remains out of \$out
+      mv $out source
+
+      echo recompressing final contents into new tarball
+      # try to make a deterministic tarball
+      tar \
+        --use-compress-program "zstd -T$NIX_BUILD_CORES" \
+        --sort name \
+        --mtime 1970-01-01 \
+        --owner=root --group=root \
+        --numeric-owner --mode=go=rX,u+rw,a-s \
+        -cf $out source
+    '';
+  };
+
+
   base = rec {
     pname = "${packageName}-unwrapped";
     inherit (upstream-info) version;
     inherit packageName buildType buildPath;
 
-    src = fetchzip {
-      name = "chromium-${version}.tar.zstd";
-      url = "https://commondatastorage.googleapis.com/chromium-browser-official/chromium-${version}.tar.xz";
-      inherit (upstream-info) sha256;
-
-      nativeBuildInputs = [ zstd ];
-
-      postFetch = ''
-        echo removing unused code from tarball to stay under hydra limit
-        rm -r $out/third_party/{rust-src,llvm}
-
-        echo moving remains out of \$out
-        mv $out source
-
-        echo recompressing final contents into new tarball
-        # try to make a deterministic tarball
-        tar \
-          --use-compress-program "zstd -T$NIX_BUILD_CORES" \
-          --sort name \
-          --mtime 1970-01-01 \
-          --owner=root --group=root \
-          --numeric-owner --mode=go=rX,u+rw,a-s \
-          -cf $out source
-      '';
-    };
+    src = recompressTarball { inherit version; inherit (upstream-info) sha256; };
 
     nativeBuildInputs = [
       ninja pkg-config
@@ -486,6 +489,7 @@ let
       chromiumDeps = {
         gn = gnChromium;
       };
+      inherit recompressTarball;
     };
   }
   # overwrite `version` with the exact same `version` from the same source,
diff --git a/pkgs/applications/networking/browsers/chromium/update.py b/pkgs/applications/networking/browsers/chromium/update.py
index f8dae9593601..fd8f36778405 100755
--- a/pkgs/applications/networking/browsers/chromium/update.py
+++ b/pkgs/applications/networking/browsers/chromium/update.py
@@ -21,12 +21,11 @@ from urllib.request import urlopen
 
 RELEASES_URL = 'https://versionhistory.googleapis.com/v1/chrome/platforms/linux/channels/all/versions/all/releases'
 DEB_URL = 'https://dl.google.com/linux/chrome/deb/pool/main/g'
-BUCKET_URL = 'https://commondatastorage.googleapis.com/chromium-browser-official'
 
 PIN_PATH = dirname(abspath(__file__)) + '/upstream-info.nix'
 UNGOOGLED_FLAGS_PATH = dirname(abspath(__file__)) + '/ungoogled-flags.toml'
 COMMIT_MESSAGE_SCRIPT = dirname(abspath(__file__)) + '/get-commit-message.py'
-
+NIXPKGS_PATH = subprocess.check_output(["git", "rev-parse", "--show-toplevel"], cwd=dirname(PIN_PATH)).strip()
 
 def load_as_json(path):
     """Loads the given nix file as JSON."""
@@ -41,6 +40,23 @@ def save_dict_as_nix(path, input):
     with open(path, 'w') as out:
         out.write(formatted.decode())
 
+def prefetch_src_sri_hash(attr_path, version):
+    """Prefetches the fixed-output-derivation source tarball and returns its SRI-Hash."""
+    print(f'nix-build (FOD prefetch) {attr_path} {version}')
+    out = subprocess.run(
+        ["nix-build", "--expr", f'(import ./. {{}}).{attr_path}.browser.passthru.recompressTarball {{ version = "{version}"; }}'],
+        cwd=NIXPKGS_PATH,
+        stderr=subprocess.PIPE
+    ).stderr.decode()
+
+    for line in iter(out.split("\n")):
+        match = re.match(r"\s+got:\s+(.+)$", line)
+        if match:
+            print(f'Hash: {match.group(1)}')
+            return match.group(1)
+    print(f'{out}\n\nError: Expected hash in nix-build stderr output.', file=sys.stderr)
+    sys.exit(1)
+
 def nix_prefetch_url(url, algo='sha256'):
     """Prefetches the content of the given URL."""
     print(f'nix-prefetch-url {url}')
@@ -206,7 +222,10 @@ with urlopen(RELEASES_URL) as resp:
             google_chrome_suffix = channel_name
 
         try:
-            channel['sha256'] = nix_prefetch_url(f'{BUCKET_URL}/chromium-{release["version"]}.tar.xz')
+            channel['sha256'] = prefetch_src_sri_hash(
+                channel_name_to_attr_name(channel_name),
+                release["version"]
+            )
             channel['sha256bin64'] = nix_prefetch_url(
                 f'{DEB_URL}/google-chrome-{google_chrome_suffix}/' +
                 f'google-chrome-{google_chrome_suffix}_{release["version"]}-1_amd64.deb')
diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.nix b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
index 3086f82c9c48..b8004a7d4b39 100644
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.nix
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
@@ -41,9 +41,9 @@
         version = "2023-08-10";
       };
     };
-    sha256 = "1g8rllmnmhmmpjzrmi3cww0nszxicq0kim2wd0l0ip2mzk2p8qlp";
-    sha256bin64 = "1bq170l0g9yq17x6xlg6fjar6gv3hdi0zijwmx4s02pmw6727484";
-    version = "118.0.5993.70";
+    sha256 = "sha256-CTkw92TiRD2tkYu5a5dy8fjpR2MMOMCvcbxXhJ36Bp8=";
+    sha256bin64 = "06rbsjh4khhl408181ns5nsdwasklb277fdjfajdv5h1j9a190k3";
+    version = "118.0.5993.88";
   };
   ungoogled-chromium = {
     deps = {
@@ -54,12 +54,12 @@
         version = "2023-08-10";
       };
       ungoogled-patches = {
-        rev = "118.0.5993.70-1";
-        sha256 = "0k6684cy1ks6yba2bdz17g244f05qy9769cvis4h2jzhgbf5rysh";
+        rev = "118.0.5993.88-1";
+        sha256 = "17j47d64l97ascp85h8cnfnr5wr4va3bdk95wmagqss7ym5c7zsf";
       };
     };
-    sha256 = "1g8rllmnmhmmpjzrmi3cww0nszxicq0kim2wd0l0ip2mzk2p8qlp";
-    sha256bin64 = "1bq170l0g9yq17x6xlg6fjar6gv3hdi0zijwmx4s02pmw6727484";
-    version = "118.0.5993.70";
+    sha256 = "sha256-CTkw92TiRD2tkYu5a5dy8fjpR2MMOMCvcbxXhJ36Bp8=";
+    sha256bin64 = "06rbsjh4khhl408181ns5nsdwasklb277fdjfajdv5h1j9a190k3";
+    version = "118.0.5993.88";
   };
 }
diff --git a/pkgs/applications/networking/cluster/argocd-autopilot/default.nix b/pkgs/applications/networking/cluster/argocd-autopilot/default.nix
index e42a4e0c4b49..3b0250c5f9a9 100644
--- a/pkgs/applications/networking/cluster/argocd-autopilot/default.nix
+++ b/pkgs/applications/networking/cluster/argocd-autopilot/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "argocd-autopilot";
-  version = "0.4.16";
+  version = "0.4.17";
 
   src = fetchFromGitHub {
     owner = "argoproj-labs";
     repo = "argocd-autopilot";
     rev = "v${version}";
-    sha256 = "sha256-KxEH6FpCaOVOjdNKn7dYbFlT/W4gA8276Zt3sIs3Tg8=";
+    sha256 = "sha256-txbs1SzAaV1nCl104m0Ht5DwzCmK+sBDn4rZ1newdLc=";
   };
 
-  vendorHash = "sha256-3f5eEge5tGko/B7MtPcifoQOkkVr0jjFX5nF6g1kow4=";
+  vendorHash = "sha256-1nolJLWkArzSKf11fzlvvgiCnvMYSu5MHRNAn1lryms=";
 
   proxyVendor = true;
 
diff --git a/pkgs/applications/networking/cluster/kaniko/default.nix b/pkgs/applications/networking/cluster/kaniko/default.nix
index 7639c95a971f..13ccf5599ce7 100644
--- a/pkgs/applications/networking/cluster/kaniko/default.nix
+++ b/pkgs/applications/networking/cluster/kaniko/default.nix
@@ -9,13 +9,13 @@
 
 buildGoModule rec {
   pname = "kaniko";
-  version = "1.16.0";
+  version = "1.17.0";
 
   src = fetchFromGitHub {
     owner = "GoogleContainerTools";
     repo = "kaniko";
     rev = "v${version}";
-    hash = "sha256-PTcPlYJ0IHWNQKBJcMiotGp6GPH3qY3f6sJKgUVSTZU=";
+    hash = "sha256-O4FPz62QnvG+Q2l4Gr/O0XFpkXE2G4RO/G6KNDdanzk=";
   };
 
   vendorHash = null;
diff --git a/pkgs/applications/networking/cluster/kubernetes/default.nix b/pkgs/applications/networking/cluster/kubernetes/default.nix
index 97d3a3140209..ac142ca3597e 100644
--- a/pkgs/applications/networking/cluster/kubernetes/default.nix
+++ b/pkgs/applications/networking/cluster/kubernetes/default.nix
@@ -20,13 +20,13 @@
 
 buildGoModule rec {
   pname = "kubernetes";
-  version = "1.28.2";
+  version = "1.28.3";
 
   src = fetchFromGitHub {
     owner = "kubernetes";
     repo = "kubernetes";
     rev = "v${version}";
-    hash = "sha256-7juoX4nFvQbIIbhTlnIYVUEYUJGwu+aKrpw4ltujjXI=";
+    hash = "sha256-lb9FAk3b6J92viyHzLCzbYRxhQS94/FQvDr1m1kdTq8=";
   };
 
   vendorHash = null;
diff --git a/pkgs/applications/networking/cluster/starboard/default.nix b/pkgs/applications/networking/cluster/starboard/default.nix
index ddfa4443d826..8f456f3fb4de 100644
--- a/pkgs/applications/networking/cluster/starboard/default.nix
+++ b/pkgs/applications/networking/cluster/starboard/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "starboard";
-  version = "0.15.15";
+  version = "0.15.16";
 
   src = fetchFromGitHub {
     owner = "aquasecurity";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-aKxRjPXvj9rGUheUjpjGWlzg9I6LaCxfc6FJV8Kzj3I=";
+    sha256 = "sha256-n4gChQQMVdtEKW2WqQAEVtlU2fFxLxBem2yAJzDjx2Q=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
diff --git a/pkgs/applications/networking/cluster/tektoncd-cli/default.nix b/pkgs/applications/networking/cluster/tektoncd-cli/default.nix
index 3b9962b84a0f..a729e62783b1 100644
--- a/pkgs/applications/networking/cluster/tektoncd-cli/default.nix
+++ b/pkgs/applications/networking/cluster/tektoncd-cli/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "tektoncd-cli";
-  version = "0.32.0";
+  version = "0.32.1";
 
   src = fetchFromGitHub {
     owner = "tektoncd";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "sha256-Ilue0stXko8bkMMzXEHrdgJYIV5ZcI39hwFUya8X4ac=";
+    sha256 = "sha256-qxKWyNQRWc0krdIfG6Mkn8ZZSkCkb0V41nIUsN5azGo=";
   };
 
   vendorHash = null;
diff --git a/pkgs/applications/networking/cluster/terraform-backend-git/default.nix b/pkgs/applications/networking/cluster/terraform-backend-git/default.nix
index 09cc62352d7b..2e7f70eaf57d 100644
--- a/pkgs/applications/networking/cluster/terraform-backend-git/default.nix
+++ b/pkgs/applications/networking/cluster/terraform-backend-git/default.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "terraform-backend-git";
-  version = "0.1.5";
+  version = "0.1.6";
 
   src = fetchFromGitHub {
     owner = "plumber-cd";
     repo = "terraform-backend-git";
     rev = "v${version}";
-    hash = "sha256-ryHFuHIEJ4i1R3oBW3w3aAvtv+vIrO745qwx0+SqBF4=";
+    hash = "sha256-ZbQfL7uKCFD98HcoeqscZaIsWFvWH0Ytzlqr6fMmXUs=";
   };
 
   vendorHash = "sha256-Y/4UgG/2Vp+gxBnGrNpAgRNfPZWJXhVo8TVa/VfOYt0=";
diff --git a/pkgs/applications/networking/cluster/terraform/default.nix b/pkgs/applications/networking/cluster/terraform/default.nix
index 38051dff543c..5974560092c8 100644
--- a/pkgs/applications/networking/cluster/terraform/default.nix
+++ b/pkgs/applications/networking/cluster/terraform/default.nix
@@ -167,9 +167,9 @@ rec {
   mkTerraform = attrs: pluggable (generic attrs);
 
   terraform_1 = mkTerraform {
-    version = "1.6.1";
-    hash = "sha256-qUJruwpec4uZ/gPWzpbQOMfSxkwRkRDlWDmVIgqe5A8=";
-    vendorHash = "sha256-1ZQDgNeMC59KrmZpA8T+Etbuk2MQKQsDYzqPGl6Y4Hg=";
+    version = "1.6.2";
+    hash = "sha256-24B8YlorL00OqmYYVM1xg5dM9hZ4enDWJ1XIGmeEAiM=";
+    vendorHash = "sha256-fIirGWt4Os2uZHo4ui7wmZEp+DRUHu/0p+cQCbUbzjc=";
     patches = [ ./provider-path-0_15.patch ];
     passthru = {
       inherit plugins;
diff --git a/pkgs/applications/networking/ids/zeek/default.nix b/pkgs/applications/networking/ids/zeek/default.nix
index 8ab64a6e57dd..e4440b483595 100644
--- a/pkgs/applications/networking/ids/zeek/default.nix
+++ b/pkgs/applications/networking/ids/zeek/default.nix
@@ -22,6 +22,7 @@
 
 let
   broker = callPackage ./broker { };
+  python = python3.withPackages (p: [ p.gitpython p.semantic-version ]);
 in
 stdenv.mkDerivation rec {
   pname = "zeek";
@@ -43,7 +44,7 @@ stdenv.mkDerivation rec {
     cmake
     file
     flex
-    python3
+    python
   ];
 
   buildInputs = [
@@ -56,11 +57,11 @@ stdenv.mkDerivation rec {
     openssl
     swig
     zlib
+    python
   ] ++ lib.optionals stdenv.isLinux [
     libkqueue
   ] ++ lib.optionals stdenv.isDarwin [
     gettext
-    python3
   ];
 
   postPatch = ''
diff --git a/pkgs/applications/networking/instant-messengers/discord/default.nix b/pkgs/applications/networking/instant-messengers/discord/default.nix
index 2cd7ee2d2c5b..0420ae8ca946 100644
--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@@ -1,52 +1,52 @@
 { branch ? "stable", callPackage, fetchurl, lib, stdenv }:
 let
   versions = if stdenv.isLinux then {
-    stable = "0.0.31";
-    ptb = "0.0.49";
-    canary = "0.0.170";
-    development = "0.0.234";
+    stable = "0.0.32";
+    ptb = "0.0.51";
+    canary = "0.0.171";
+    development = "0.0.1";
   } else {
-    stable = "0.0.280";
-    ptb = "0.0.80";
-    canary = "0.0.315";
-    development = "0.0.8797";
+    stable = "0.0.281";
+    ptb = "0.0.82";
+    canary = "0.0.320";
+    development = "0.0.2";
   };
   version = versions.${branch};
   srcs = rec {
     x86_64-linux = {
       stable = fetchurl {
         url = "https://dl.discordapp.net/apps/linux/${version}/discord-${version}.tar.gz";
-        hash = "sha256-toWwiMsEFsGaOYaPZziSmZtpzxGd9m+2MtxTrJwqFbw=";
+        hash = "sha256-XeGDKRKnvDyl0AWm9Vs/PDeIfAq/FL9AsjLt+dNg1HQ=";
       };
       ptb = fetchurl {
         url = "https://dl-ptb.discordapp.net/apps/linux/${version}/discord-ptb-${version}.tar.gz";
-        hash = "sha256-o8cDoBe6A0wBjVLjp4JXrv3QsG7TZ/Kj4+T5lj6WHdY=";
+        hash = "sha256-VlvGZ5qy61zse0mhvrROYwr0C94Zy1Kh4D4dp+sJTN0=";
       };
       canary = fetchurl {
         url = "https://dl-canary.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
-        hash = "sha256-Lw+qLAAwyoDBKDPOBA9HR79gcnqwTshFq6GMpFS0tXA=";
+        hash = "sha256-NcmV+DPI5hfNdBUgoaOLsjG32QfjF+x7f01B6PR10Vc=";
       };
       development = fetchurl {
         url = "https://dl-development.discordapp.net/apps/linux/${version}/discord-development-${version}.tar.gz";
-        hash = "sha256-R5UwgpXgb32mEohTzyRVXmumcgPl8UPan3UjmLFLxLo=";
+        hash = "sha256-ogLOZZ9pTXB01TqdnmdORIzZ8GbGzskUzbG4E68gZwY=";
       };
     };
     x86_64-darwin = {
       stable = fetchurl {
         url = "https://dl.discordapp.net/apps/osx/${version}/Discord.dmg";
-        hash = "sha256-SUbpzd8RIf+e+so/dXZh5OkjCvWRC+EyqgeIg4u32Hg=";
+        hash = "sha256-Qxh9K0u99xfsVPJyAD3bFeZPxBXg2EeDyM+rbF80EC8=";
       };
       ptb = fetchurl {
         url = "https://dl-ptb.discordapp.net/apps/osx/${version}/DiscordPTB.dmg";
-        hash = "sha256-IvrCjiZ5Oa616+U8C2ihg8THj7ePV2A8+82wUWqWoPY=";
+        hash = "sha256-U99FiR3IUL8saGtVrWblWqsCIJc0rK5ZMII9/BL5H7w=";
       };
       canary = fetchurl {
         url = "https://dl-canary.discordapp.net/apps/osx/${version}/DiscordCanary.dmg";
-        hash = "sha256-m43SijSBxcAvYAlSFpQKIFILUm4AgSQ5F4XyQJyftts=";
+        hash = "sha256-7fPlb4x116HIXEJr1G7wVHriOQu6/2u69SpbU9qxHNw=";
       };
       development = fetchurl {
         url = "https://dl-development.discordapp.net/apps/osx/${version}/DiscordDevelopment.dmg";
-        hash = "sha256-ra0El4Y7SqanY6ZBbHE1Y+pqel4OD7nXKKfg/vndULo=";
+        hash = "sha256-iMw61dXtThXvz2GnZiM4+tURMRfXhrN/ze1RTBL6zy8=";
       };
     };
     aarch64-darwin = x86_64-darwin;
diff --git a/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix b/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix
index 157df8ca9a65..2307c4db01e3 100644
--- a/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix
+++ b/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix
@@ -19,18 +19,18 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "teams-for-linux";
-  version = "1.3.13";
+  version = "1.3.14";
 
   src = fetchFromGitHub {
     owner = "IsmaelMartinez";
     repo = "teams-for-linux";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-WF2jWP6utopAMZPP/ZWOhqVGZJmACwHyLLE+HQaHJjg=";
+    hash = "sha256-2H7j8e2wPMd4cHXDKxSmyC2Ng/B3jb3/tGVTpUOU3XM=";
   };
 
   offlineCache = fetchYarnDeps {
     yarnLock = "${finalAttrs.src}/yarn.lock";
-    hash = "sha256-vgjPGO5qa4IYfW1svClJ+wP/KtIFFd3P02T2sht69C8=";
+    hash = "sha256-zB6H14VAf13pAHQmsWC51d/qqyfRmAEbltyLD5ucG4Y=";
   };
 
   nativeBuildInputs = [ yarn fixup_yarn_lock nodejs copyDesktopItems makeWrapper ];
diff --git a/pkgs/applications/networking/opsdroid/default.nix b/pkgs/applications/networking/opsdroid/default.nix
index 4398c771e535..d4f2a9b26a18 100644
--- a/pkgs/applications/networking/opsdroid/default.nix
+++ b/pkgs/applications/networking/opsdroid/default.nix
@@ -17,7 +17,7 @@ python3Packages.buildPythonPackage rec {
   doCheck = false;
 
   propagatedBuildInputs = with python3Packages; [
-    click babel opsdroid_get_image_size slackclient webexteamssdk bleach
+    click babel opsdroid-get-image-size slackclient webexteamssdk bleach
     parse emoji puremagic yamale nbformat websockets pycron nbconvert
     aiohttp matrix-api-async aioredis aiosqlite arrow pyyaml motor regex
     mattermostdriver setuptools voluptuous ibm-watson tailer multidict
diff --git a/pkgs/applications/networking/sync/storj-uplink/default.nix b/pkgs/applications/networking/sync/storj-uplink/default.nix
index f8b381b4384e..f1cf8489c808 100644
--- a/pkgs/applications/networking/sync/storj-uplink/default.nix
+++ b/pkgs/applications/networking/sync/storj-uplink/default.nix
@@ -5,18 +5,18 @@
 
 buildGoModule rec {
   pname = "storj-uplink";
-  version = "1.89.2";
+  version = "1.90.1";
 
   src = fetchFromGitHub {
     owner = "storj";
     repo = "storj";
     rev = "v${version}";
-    hash = "sha256-tbzdfKA3ojwTvJ+t7jLLy3iKQ/x/0lXDcb2w1XcyEhs=";
+    hash = "sha256-LJtNsemNbN+TLyUxSgB/wftKxOfI/y/t+qv1TjcsXzQ=";
   };
 
   subPackages = [ "cmd/uplink" ];
 
-  vendorHash = "sha256-AME5EM2j7PQ/DodK+3BiVepTRbwMqqItQbmCJ2lrGM8=";
+  vendorHash = "sha256-R713WhFrWT7Cgstk3SLuvvyk3/ZtT1LOH0qqmFcWzKw=";
 
   ldflags = [ "-s" "-w" ];
 
diff --git a/pkgs/applications/office/activitywatch/default.nix b/pkgs/applications/office/activitywatch/default.nix
index 04d58e74dadd..4187da1bfabb 100644
--- a/pkgs/applications/office/activitywatch/default.nix
+++ b/pkgs/applications/office/activitywatch/default.nix
@@ -5,6 +5,7 @@
 , pkg-config
 , perl
 , openssl
+, rust-jemalloc-sys
 , python3
 , wrapQtAppsHook
 , qtbase
@@ -173,6 +174,7 @@ rec {
 
     buildInputs = [
       openssl
+      rust-jemalloc-sys
     ];
 
     postFixup = ''
diff --git a/pkgs/applications/science/biology/bioawk/default.nix b/pkgs/applications/science/biology/bioawk/default.nix
new file mode 100644
index 000000000000..cfbb1a551fac
--- /dev/null
+++ b/pkgs/applications/science/biology/bioawk/default.nix
@@ -0,0 +1,50 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, installShellFiles
+, bison
+, zlib
+}:
+
+stdenv.mkDerivation {
+  pname = "bioawk";
+  version = "unstable-2017-09-11";
+
+  src = fetchFromGitHub {
+    owner = "lh3";
+    repo = "bioawk";
+    rev = "fd40150b7c557da45e781a999d372abbc634cc21";
+    hash = "sha256-WWgz96DPP83J45isWkMbgEvOlibq6WefK//ImV6+AU0=";
+  };
+
+  nativeBuildInputs = [
+    bison
+    installShellFiles
+  ];
+
+  buildInputs = [
+    zlib
+  ];
+
+  buildFlags = [
+    "CC=${stdenv.cc.targetPrefix}cc"
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm755 bioawk -t $out/bin
+    mv awk.1 bioawk.1
+    installManPage bioawk.1
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "BWK awk modified for biological data";
+    homepage = "https://github.com/lh3/bioawk";
+    license = licenses.hpnd;
+    maintainers = with maintainers; [ natsukium ];
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/applications/science/biology/poretools/default.nix b/pkgs/applications/science/biology/poretools/default.nix
index efbedf9a121a..efbedf9a121a 100755..100644
--- a/pkgs/applications/science/biology/poretools/default.nix
+++ b/pkgs/applications/science/biology/poretools/default.nix
diff --git a/pkgs/applications/science/biology/trimal/default.nix b/pkgs/applications/science/biology/trimal/default.nix
index b27a63a2135a..b27a63a2135a 100755..100644
--- a/pkgs/applications/science/biology/trimal/default.nix
+++ b/pkgs/applications/science/biology/trimal/default.nix
diff --git a/pkgs/applications/science/biology/vcftools/default.nix b/pkgs/applications/science/biology/vcftools/default.nix
index a4ec84d4d506..a4ec84d4d506 100755..100644
--- a/pkgs/applications/science/biology/vcftools/default.nix
+++ b/pkgs/applications/science/biology/vcftools/default.nix
diff --git a/pkgs/applications/science/misc/root/default.nix b/pkgs/applications/science/misc/root/default.nix
index 6dc630181be2..6b2598efc3dc 100644
--- a/pkgs/applications/science/misc/root/default.nix
+++ b/pkgs/applications/science/misc/root/default.nix
@@ -57,7 +57,7 @@
 
 stdenv.mkDerivation rec {
   pname = "root";
-  version = "6.28.06";
+  version = "6.28.08";
 
   passthru = {
     tests = import ./tests { inherit callPackage; };
@@ -65,7 +65,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://root.cern.ch/download/root_v${version}.source.tar.gz";
-    hash = "sha256-rztnO5rKOTpcmuG/huqyZyqvGEG2WMXG56MKuTxYZTM=";
+    hash = "sha256-o+ZLTAH4fNm75X5h75a0FibkmwRGCVBw1B2b+6NSaGI=";
   };
 
   nativeBuildInputs = [ makeWrapper cmake pkg-config git ];
diff --git a/pkgs/applications/science/molecular-dynamics/gromacs/default.nix b/pkgs/applications/science/molecular-dynamics/gromacs/default.nix
index cb1dbc15b336..2ca47d812bbf 100644
--- a/pkgs/applications/science/molecular-dynamics/gromacs/default.nix
+++ b/pkgs/applications/science/molecular-dynamics/gromacs/default.nix
@@ -20,11 +20,11 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "gromacs";
-  version = "2023.2";
+  version = "2023.3";
 
   src = fetchurl {
     url = "ftp://ftp.gromacs.org/pub/gromacs/gromacs-${version}.tar.gz";
-    sha256 = "sha256-vOFIByfksruQBBO3XZmjJm81B4d9pPWy1JHfeY+fza4=";
+    sha256 = "sha256-Tsj40MevdrE/j9FtuOLBIOdJ3kOa6VVNn2U/gS140cs=";
   };
 
   patches = [ ./pkgconfig.patch ];
diff --git a/pkgs/applications/version-management/git-mit/default.nix b/pkgs/applications/version-management/git-mit/default.nix
index ebfae6fa356e..f53f021a80c0 100644
--- a/pkgs/applications/version-management/git-mit/default.nix
+++ b/pkgs/applications/version-management/git-mit/default.nix
@@ -10,7 +10,7 @@
 }:
 
 let
-  version = "5.12.161";
+  version = "5.12.162";
 in
 rustPlatform.buildRustPackage {
   pname = "git-mit";
@@ -20,10 +20,10 @@ rustPlatform.buildRustPackage {
     owner = "PurpleBooth";
     repo = "git-mit";
     rev = "v${version}";
-    hash = "sha256-r0gRBOf/CC4HDh/N4Qi1/3DkPuuNlqfbvl4o5JqobKE=";
+    hash = "sha256-qwnzq1CKo7kJXITpPjKAhk1dbGSj6TXat7ioP7o3ifg=";
   };
 
-  cargoHash = "sha256-LgiO/wPoPjmxymcXl9zQ8n/xOnFfpravwpqEsUctxxw=";
+  cargoHash = "sha256-AGE+zA5DHabqgzCC/T1DDG9bGPciSdl1euZbbCeKPzQ=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/applications/version-management/stgit/default.nix b/pkgs/applications/version-management/stgit/default.nix
index 12450fc440d8..196cdea93dba 100644
--- a/pkgs/applications/version-management/stgit/default.nix
+++ b/pkgs/applications/version-management/stgit/default.nix
@@ -18,15 +18,15 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "stgit";
-  version = "2.3.2";
+  version = "2.4.0";
 
   src = fetchFromGitHub {
     owner = "stacked-git";
     repo = "stgit";
     rev = "v${version}";
-    hash = "sha256-rQNX54zmVHZKplEUNaKyVtCrC8Q4DdxLzNSStiYvDGA=";
+    hash = "sha256-+ipNSdEaz3nVBTYS+A4Fauan0DaKZR69No95FTS2/4o=";
   };
-  cargoHash = "sha256-ju8JQnohidBsydwwm6gNx1L24brmDWYXwNgfCl7G/aA=";
+  cargoHash = "sha256-G0g+53HWxhJfozMGByhmgnxws6P10FY9fAOleqhn+Mk=";
 
   nativeBuildInputs = [
     pkg-config installShellFiles makeWrapper asciidoc xmlto docbook_xsl
diff --git a/pkgs/applications/video/kodi/addons/inputstream-adaptive/default.nix b/pkgs/applications/video/kodi/addons/inputstream-adaptive/default.nix
index 1e8e2ae2f4d4..61e5147be360 100644
--- a/pkgs/applications/video/kodi/addons/inputstream-adaptive/default.nix
+++ b/pkgs/applications/video/kodi/addons/inputstream-adaptive/default.nix
@@ -10,13 +10,13 @@ in
 buildKodiBinaryAddon rec {
   pname = "inputstream-adaptive";
   namespace = "inputstream.adaptive";
-  version = "20.3.9";
+  version = "20.3.13";
 
   src = fetchFromGitHub {
     owner = "xbmc";
     repo = "inputstream.adaptive";
     rev = "${version}-${rel}";
-    sha256 = "sha256-Z5p/lw7qg6aacJ0eSqswaiwTOsUmuDbNlRRs51LdjRw=";
+    sha256 = "sha256-xvU+DcVEaQ/1sm6o21/6N1znCtzrct0qDhMxXGFZjL4=";
   };
 
   extraCMakeFlags = [
diff --git a/pkgs/applications/video/kodi/addons/netflix/default.nix b/pkgs/applications/video/kodi/addons/netflix/default.nix
index ab034c13755e..5a3089d1936d 100644
--- a/pkgs/applications/video/kodi/addons/netflix/default.nix
+++ b/pkgs/applications/video/kodi/addons/netflix/default.nix
@@ -3,13 +3,13 @@
 buildKodiAddon rec {
   pname = "netflix";
   namespace = "plugin.video.netflix";
-  version = "1.20.2";
+  version = "1.22.3";
 
   src = fetchFromGitHub {
     owner = "CastagnaIT";
     repo = namespace;
     rev = "v${version}";
-    sha256 = "sha256-k2O8a0P+TzQVoFQJkzmdqmkKh3Aj7OlsnuhJfUwxOmI=";
+    sha256 = "sha256-8NGj8n1p8euqYYdPDSeFh2ZE9lly5ThSmg69yXY3Te8=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/applications/virtualization/vmware-workstation/default.nix b/pkgs/applications/virtualization/vmware-workstation/default.nix
index 8fe79b6e237c..8fe79b6e237c 100755..100644
--- a/pkgs/applications/virtualization/vmware-workstation/default.nix
+++ b/pkgs/applications/virtualization/vmware-workstation/default.nix
diff --git a/pkgs/applications/window-managers/cwm/default.nix b/pkgs/applications/window-managers/cwm/default.nix
index d46811290a2c..94b75af3ea5c 100644
--- a/pkgs/applications/window-managers/cwm/default.nix
+++ b/pkgs/applications/window-managers/cwm/default.nix
@@ -3,13 +3,13 @@
 stdenv.mkDerivation rec {
 
   pname = "cwm";
-  version = "7.1";
+  version = "7.4";
 
   src = fetchFromGitHub {
     owner = "leahneukirchen";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-lkjsxGMXOrnu4cUiV/TO7yzd9FzM297MhaFKauqmiHo=";
+    sha256 = "sha256-L3u4mH2UH2pTHhSPVr5dUi94b9DheslkIWL6EgQ05yA=";
   };
 
   strictDeps = true;
diff --git a/pkgs/build-support/fetchdocker/credentials.nix b/pkgs/build-support/fetchdocker/credentials.nix
index da1984832684..f8a229ccb6bb 100644
--- a/pkgs/build-support/fetchdocker/credentials.nix
+++ b/pkgs/build-support/fetchdocker/credentials.nix
@@ -1,3 +1,4 @@
+{ lib }:
 # We provide three paths to get the credentials into the builder's
 # environment:
 #
diff --git a/pkgs/build-support/fetchdocker/generic-fetcher.nix b/pkgs/build-support/fetchdocker/generic-fetcher.nix
index 6a7b977db29f..95b193490a82 100644
--- a/pkgs/build-support/fetchdocker/generic-fetcher.nix
+++ b/pkgs/build-support/fetchdocker/generic-fetcher.nix
@@ -1,7 +1,7 @@
 { stdenv, lib, haskellPackages, writeText, gawk }:
 let
   awk                   = "${gawk}/bin/awk";
-  dockerCredentialsFile = import ./credentials.nix;
+  dockerCredentialsFile = import ./credentials.nix { inherit lib; };
 in
 { fetcher
 , name
diff --git a/pkgs/by-name/ez/eza/package.nix b/pkgs/by-name/ez/eza/package.nix
index e7181d59afaf..804446d6fe7a 100644
--- a/pkgs/by-name/ez/eza/package.nix
+++ b/pkgs/by-name/ez/eza/package.nix
@@ -17,16 +17,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "eza";
-  version = "0.14.2";
+  version = "0.15.0";
 
   src = fetchFromGitHub {
     owner = "eza-community";
     repo = "eza";
     rev = "v${version}";
-    hash = "sha256-eST70KMdGgbTo4FNL3K5YGn9lwIGroG4y4ExKDb30hU=";
+    hash = "sha256-52vBN/EdO0R2Lt/Iv33Odl437I8kgUhxXwtUuiaAcAU=";
   };
 
-  cargoHash = "sha256-h5ooNR0IeXWyY6PuZM/bQLkX4F0eZsEY2eoIgo0nRFA=";
+  cargoHash = "sha256-j6FsI6FpBXtaNcVDY84UBcqifXuJxBRW5Gdln8pq7Iw=";
 
   nativeBuildInputs = [ cmake pkg-config installShellFiles pandoc ];
   buildInputs = [ zlib ]
diff --git a/pkgs/by-name/fo/fortune-kind/package.nix b/pkgs/by-name/fo/fortune-kind/package.nix
index 54d1ecc33fae..c3e76a5f0c61 100644
--- a/pkgs/by-name/fo/fortune-kind/package.nix
+++ b/pkgs/by-name/fo/fortune-kind/package.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "fortune-kind";
-  version = "0.1.4";
+  version = "0.1.5";
 
   src = fetchFromGitHub {
     owner = "cafkafk";
     repo = "fortune-kind";
     rev = "v${version}";
-    hash = "sha256-xIibKXca3RXQpRJyQ62GL7l24ovX4KXhdk2zK1gB98M=";
+    hash = "sha256-bpQ1cPsgKgOU3stnUwGrMnY9RZGZnuoR6B05LyARtVY=";
   };
 
-  cargoHash = "sha256-7JBT3EhwrcNITR5ocQkLoQw4/R7xAoplZ9I1cTs9DW8=";
+  cargoHash = "sha256-2hL4vbbfvzJk73cvMU+eau+UHDFtokt4v8GBXyNkjbw=";
 
   nativeBuildInputs = [ makeBinaryWrapper installShellFiles ];
   buildInputs = lib.optionals stdenv.isDarwin [ libiconv darwin.apple_sdk.frameworks.Security ];
diff --git a/pkgs/by-name/ge/geticons/package.nix b/pkgs/by-name/ge/geticons/package.nix
new file mode 100644
index 000000000000..f3afda0f136d
--- /dev/null
+++ b/pkgs/by-name/ge/geticons/package.nix
@@ -0,0 +1,27 @@
+{ lib
+, rustPlatform
+, fetchFromSourcehut
+, gitUpdater
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "geticons";
+  version = "1.2.2";
+
+  src = fetchFromSourcehut {
+    owner = "~zethra";
+    repo = pname;
+    rev = version;
+    hash = "sha256-HEnUfOLeRTi2dRRqjDPVwVVHo/GN9wE28x5qv3qOpCY=";
+  };
+
+  cargoHash = "sha256-Znwni7uMnG9cpZbztUMY1j73K+XrDLv5zyNEZDoxWg4=";
+  passthru.updateScript = gitUpdater { };
+
+  meta = with lib; {
+    description = "CLI utility to get icons for apps on your system or other generic icons by name";
+    homepage = "https://git.sr.ht/~zethra/geticons";
+    license = with licenses; [ gpl3Plus ];
+    maintainers = with maintainers; [ Madouura ];
+  };
+}
diff --git a/pkgs/by-name/km/kmsvnc/package.nix b/pkgs/by-name/km/kmsvnc/package.nix
new file mode 100644
index 000000000000..000dc8115b2b
--- /dev/null
+++ b/pkgs/by-name/km/kmsvnc/package.nix
@@ -0,0 +1,43 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, pkg-config
+, libdrm
+, libvncserver
+, libxkbcommon
+, libva
+}:
+
+stdenv.mkDerivation rec {
+  pname = "kmsvnc";
+  version = "0.0.5";
+
+  src = fetchFromGitHub {
+    owner = "isjerryxiao";
+    repo = "kmsvnc";
+    rev = "v${version}";
+    hash = "sha256-Dz1y4t8u9/rnmOiYMWMq6aEq3kV47uiIK7K4DSvjZNc=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
+
+  buildInputs = [
+    libdrm
+    libvncserver
+    libxkbcommon
+    libva
+  ];
+
+  meta = with lib; {
+    description = "A VNC server for DRM/KMS capable GNU/Linux devices";
+    homepage = "https://github.com/isjerryxiao/kmsvnc";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ nickcao ];
+    mainProgram = "kmsvnc";
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/by-name/ko/kokkos/package.nix b/pkgs/by-name/ko/kokkos/package.nix
new file mode 100644
index 000000000000..b6578f4a020f
--- /dev/null
+++ b/pkgs/by-name/ko/kokkos/package.nix
@@ -0,0 +1,44 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, gitUpdater
+, cmake
+, python3
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "kokkos";
+  version = "4.1.00";
+
+  src = fetchFromGitHub {
+    owner = "kokkos";
+    repo = "kokkos";
+    rev = finalAttrs.version;
+    hash = "sha256-bPgXn1Lv+EiiKEHgTVhRFhcELUnZCphaXDlrTYq6cpY=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    python3
+  ];
+
+  cmakeFlags = [
+    (lib.cmakeBool "Kokkos_ENABLE_TESTS" true)
+  ];
+
+  postPatch = ''
+    patchShebangs .
+  '';
+
+  doCheck = true;
+  passthru.updateScript = gitUpdater { };
+
+  meta = with lib; {
+    description = "C++ Performance Portability Programming EcoSystem";
+    homepage = "https://github.com/kokkos/kokkos";
+    license = with licenses; [ asl20-llvm ];
+    maintainers = with maintainers; [ Madouura ];
+    platforms = platforms.unix;
+    broken = stdenv.isDarwin;
+  };
+})
diff --git a/pkgs/by-name/pg/pgmoneta/package.nix b/pkgs/by-name/pg/pgmoneta/package.nix
new file mode 100644
index 000000000000..bbfbb1a64476
--- /dev/null
+++ b/pkgs/by-name/pg/pgmoneta/package.nix
@@ -0,0 +1,61 @@
+{ lib
+, stdenv
+, bzip2
+, cjson
+, cmake
+, curl
+, docutils
+, fetchFromGitHub
+, libarchive
+, libev
+, libgccjit
+, libssh
+, lz4
+, openssl
+, systemd
+, zlib
+, zstd
+}:
+
+stdenv.mkDerivation rec {
+  pname = "pgmoneta";
+  version = "0.7.0";
+
+  src = fetchFromGitHub {
+    owner = "pgmoneta";
+    repo = "pgmoneta";
+    rev = version;
+    hash = "sha256-Acg60QFMmRTubYWkPxbHTciVOYoIWc3GZGQVauewZik=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    docutils # for rst2man
+  ];
+
+  buildInputs = [
+    bzip2
+    cjson
+    curl
+    libarchive
+    libev
+    libgccjit
+    libssh
+    lz4
+    openssl
+    systemd
+    zlib
+    zstd
+  ];
+
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
+
+  meta = with lib; {
+    description = "Backup / restore solution for PostgreSQL";
+    homepage = "https://pgmoneta.github.io/";
+    changelog = "https://github.com/pgmoneta/pgmoneta/releases/tag/${version}";
+    license = licenses.bsd3;
+    maintainers = [ maintainers.marsam ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/by-name/tk/tkdiff/189.patch b/pkgs/by-name/tk/tkdiff/189.patch
new file mode 100644
index 000000000000..c638727d3bd4
--- /dev/null
+++ b/pkgs/by-name/tk/tkdiff/189.patch
@@ -0,0 +1,71 @@
+Index: tkdiff
+===================================================================
+diff --git a/tkdiff b/tkdiff
+--- a/tkdiff	(revision 188)
++++ b/tkdiff	(revision 189)
+@@ -111,7 +111,7 @@
+ }
+ 
+ # Determine the name of the temporary directory, the rc file name,
+-# and possible VPATH EnvVar, all of which are platform dependent.
++# NULLdev, and possible VPATH EnvVar, all of which are platform dependent.
+ #
+ # Much MAY likely be overridden by a preference in .tkdiffrc,
+ # EXCEPT (obviously) when no such file actually exists yet
+@@ -126,6 +126,9 @@
+             set opts(tmpdir) C:/temp
+         }
+ 
++        # Reserved filename which is actually a NULL device
++        set opts(NULLdev) "nul"
++
+         # Split up and store a VPATH if it exists
+         if {[info exists ::env(VPATH)]} {
+             set finfo(Vpath) [split $::env(VPATH) ";"]
+@@ -145,6 +148,9 @@
+             set opts(tmpdir) $::env(TMPDIR)
+         }  {set opts(tmpdir) /tmp }
+ 
++        # Reserved filename which is actually a NULL device (Unix-like platforms)
++        set opts(NULLdev) "/dev/null"
++
+         # Split up and store a VPATH if it exists
+         if {[info exists ::env(VPATH)]} {
+             set finfo(Vpath) [split $::env(VPATH) ":"]
+@@ -2106,7 +2112,7 @@
+ #           1  Failed   (PLUS a 'pushed' HARD-error message to the caller)
+ ###############################################################################
+ proc get-file {fn ndx {probe 0}} {
+-    global g finfo
++    global g opts finfo
+ 
+     # Ancestor files are stored into a slightly adjusted array element name 
+     #   N.B> 'ndx' AS PASSED *can* be an EXPRESSION (not just a number): resolve!
+@@ -2121,7 +2127,7 @@
+     } elseif {!$tildechk} {
+         # DO NOT REPORT non-existence if this attempt was ONLY a probe
+         if {$probe} { return 1 } { set MSG "File '$fn' does not exist" }
+-    } elseif {[file isfile $fn]} {
++    } elseif {[file isfile $fn] || $fn == $opts(NULLdev)} {
+         set finfo(${A}lbl,$ndx) [shortNm [set finfo(${A}pth,$ndx) "$fn"]]
+     } else { set MSG "'$fn' exists, but is not a file" }
+ 
+@@ -2857,7 +2863,7 @@
+ # Align various label decorations to the CURRENT input file pairing
+ ###############################################################################
+ proc alignDecor {pairnum} {
+-    global g w finfo
++    global g w opts finfo
+ 
+     # Establish if 3way mode is NOW active and what file indices are in use
+     set g(is3way) [info exists finfo(albl,$pairnum)]
+@@ -2874,7 +2880,8 @@
+             set finfo(lbl,$LR) $finfo(ulbl,$ndx($n))    ;# Override lbl display
+         } else {set finfo(lbl,$LR) $finfo(lbl,$ndx($n))}
+ 
+-        if {![info exists finfo(tmp,$ndx($n))]} {
++        if {![info exists finfo(tmp,$ndx($n))] \
++            && $finfo(pth,$ndx($n)) != $opts(NULLdev)} {
+             #   (N.B> Tip data will ALSO be used by report generation heading)
+             set    g(tooltip,${LR}Label) "{$finfo(pth,$ndx($n))\n"
+             append g(tooltip,${LR}Label) \
diff --git a/pkgs/by-name/tk/tkdiff/package.nix b/pkgs/by-name/tk/tkdiff/package.nix
new file mode 100644
index 000000000000..478ee4e29ff9
--- /dev/null
+++ b/pkgs/by-name/tk/tkdiff/package.nix
@@ -0,0 +1,43 @@
+{ diffutils, fetchzip, lib, makeBinaryWrapper, stdenv, tk }:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "tkdiff";
+  version = "5.6";
+
+  src = fetchzip {
+    url = "mirror://sourceforge/tkdiff/tkdiff-${builtins.replaceStrings ["."] ["-"] finalAttrs.version}.zip";
+    hash = "sha256-EpbIdjsejkkTaSpoZRM5AHz0r1Cio+YzRryK0BoghBk=";
+  };
+
+  # fix regression: allow /dev/null again. eg: "tkdiff /dev/null file"
+  # svn diff --git -r188:189 https://svn.code.sf.net/p/tkdiff/code/trunk
+  patches = [ ./189.patch ];
+
+  nativeBuildInputs = [ makeBinaryWrapper ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm755 -t $out/bin tkdiff
+    wrapProgram $out/bin/tkdiff \
+      --prefix PATH : ${lib.makeBinPath [ diffutils tk ]}
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "A graphical front end to the diff program";
+    homepage = "https://tkdiff.sourceforge.io/";
+    license = lib.licenses.gpl2Plus;
+    longDescription = ''
+      TkDiff is a graphical front end to the diff program. It provides a
+      side-by-side view of the differences between two text files, along
+      with several innovative features such as diff bookmarks, a graphical
+      map of differences for quick navigation, and a facility for slicing
+      diff regions to achieve exactly the merge output desired.
+    '';
+    mainProgram = "tkdiff";
+    maintainers = with lib.maintainers; [ robert-manchester ];
+    platforms = tk.meta.platforms;
+  };
+})
diff --git a/pkgs/by-name/wi/windowmaker/dockapps/AlsaMixer-app.nix b/pkgs/by-name/wi/windowmaker/dockapps/AlsaMixer-app.nix
index e22b02825b75..a6b78b70b244 100644
--- a/pkgs/by-name/wi/windowmaker/dockapps/AlsaMixer-app.nix
+++ b/pkgs/by-name/wi/windowmaker/dockapps/AlsaMixer-app.nix
@@ -1,38 +1,47 @@
-{ lib, stdenv, dockapps-sources, pkg-config, libX11, libXpm, libXext, alsa-lib }:
-
-stdenv.mkDerivation rec {
+{ lib
+, stdenv
+, alsa-lib
+, dockapps-sources
+, libX11
+, libXext
+, libXpm
+, pkg-config
+}:
+
+stdenv.mkDerivation (finalAttrs: {
   pname = "AlsaMixer.app";
-  version = "0.2.1";
 
-  src = dockapps-sources;
+  inherit (dockapps-sources) version src;
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ libX11 libXpm libXext alsa-lib ];
+  sourceRoot = "${finalAttrs.src.name}/AlsaMixer.app";
 
-  setSourceRoot = ''
-    export sourceRoot=$(echo */${pname})
-  '';
+  nativeBuildInputs = [
+    pkg-config
+  ];
 
-  dontConfigure = true;
+  buildInputs = [
+    alsa-lib
+    libX11
+    libXpm
+    libXext
+  ];
 
-  preInstall = ''
-    install -d ${placeholder "out"}/bin
-  '';
+  hardeningDisable = [ "fortify" ];
+
+  dontConfigure = true;
 
   installPhase = ''
     runHook preInstall
-    install -t ${placeholder "out"}/bin AlsaMixer.app
+    install -D -t ${placeholder "out"}/bin/ AlsaMixer.app
+    pushd ${placeholder "out"}/bin
+    ln -vs AlsaMixer.app AlsaMixer
     runHook postInstall
   '';
 
-  postInstall = ''
-    ln -s ${placeholder "out"}/bin/AlsaMixer.app ${placeholder "out"}/bin/AlsaMixer
-  '';
-
-  meta = with lib; {
+  meta = {
     description = "Alsa mixer application for Windowmaker";
     homepage = "https://www.dockapps.net/alsamixerapp";
-    license = licenses.gpl2Plus;
-    maintainers = [ maintainers.bstrik ];
+    license = lib.licenses.gpl2Plus;
+    maintainers = [ ];
   };
-}
+})
diff --git a/pkgs/by-name/wi/windowmaker/dockapps/cputnik.nix b/pkgs/by-name/wi/windowmaker/dockapps/cputnik.nix
new file mode 100644
index 000000000000..6ac10e374e0f
--- /dev/null
+++ b/pkgs/by-name/wi/windowmaker/dockapps/cputnik.nix
@@ -0,0 +1,46 @@
+{ lib
+, stdenv
+, dockapps-sources
+, libX11
+, libXext
+, libXpm
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "cputnik";
+
+  inherit (dockapps-sources) version src;
+
+  sourceRoot = "${finalAttrs.src.name}/cputnik/src";
+
+  buildInputs = [
+    libX11
+    libXpm
+    libXext
+  ];
+
+  preBuild = ''
+    makeFlagsArray+=(
+      INCS="-I${libX11.dev}/include -I${libXext.dev}/include -I${libXpm.dev}/include"
+      LIBS="-L${libX11}/lib -L${libXext}/lib -L${libXpm}/lib -lX11 -lXpm -lXext"
+    )
+  '';
+
+  hardeningDisable = [ "format" ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm755 -t $out/bin/ cputnik
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "A Calendar clock with antialiased text";
+    homepage = "https://www.dockapps.net/wmcalclock";
+    license = lib.licenses.gpl2Plus;
+    maintainers = [ ];
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/wi/windowmaker/dockapps/default.nix b/pkgs/by-name/wi/windowmaker/dockapps/default.nix
index 8a66fdbd67f2..84cfe01bddf3 100644
--- a/pkgs/by-name/wi/windowmaker/dockapps/default.nix
+++ b/pkgs/by-name/wi/windowmaker/dockapps/default.nix
@@ -1,20 +1,29 @@
 { config, lib, pkgs }:
 
-lib.makeScope pkgs.newScope (self: with self; {
+lib.makeScope pkgs.newScope (self: {
 
-  dockapps-sources = pkgs.fetchgit {
-    url = "https://repo.or.cz/dockapps.git";
-    rev = "b2b9d872ee61c9b329e4597c301e4417cbd9c3ea";
-    sha256 = "sha256-BuSnwPIj3gUWMjj++SK+117xm/77u4gXLQzRFttei0w=";
+  dockapps-sources = {
+    pname = "dockapps-sources";
+    version = "2023-10-11"; # Shall correspond to src.rev
+
+    src = pkgs.fetchFromRepoOrCz {
+      repo = "dockapps";
+      rev = "1bbb32008ecb58acaec9ea70e00b4ea1735408fc";
+      hash = "sha256-BLUDe/cIIuh9mCtafbcBSDatUXSRD83FeyYhcbem5FU=";
+    };
   };
 
-  libdockapp = callPackage ./libdockapp.nix { };
+  AlsaMixer-app = self.callPackage ./AlsaMixer-app.nix { };
+
+  cputnik = self.callPackage ./cputnik.nix { };
+
+  libdockapp = self.callPackage ./libdockapp.nix { };
 
-  AlsaMixer-app = callPackage ./AlsaMixer-app.nix { };
+  wmCalClock = self.callPackage ./wmCalClock.nix { };
 
-  wmCalClock = callPackage ./wmCalClock.nix { };
+  wmcube = self.callPackage ./wmcube.nix { };
 
-  wmsm-app = callPackage ./wmsm-app.nix { };
+  wmsm-app = self.callPackage ./wmsm-app.nix { };
 
-  wmsystemtray = callPackage ./wmsystemtray.nix { };
+  wmsystemtray = self.callPackage ./wmsystemtray.nix { };
 })
diff --git a/pkgs/by-name/wi/windowmaker/dockapps/libdockapp.nix b/pkgs/by-name/wi/windowmaker/dockapps/libdockapp.nix
index aaf99ec932e6..12446bfc7262 100644
--- a/pkgs/by-name/wi/windowmaker/dockapps/libdockapp.nix
+++ b/pkgs/by-name/wi/windowmaker/dockapps/libdockapp.nix
@@ -1,30 +1,36 @@
-{ lib, stdenv, dockapps-sources, autoreconfHook, pkg-config
-, libX11, libXext, libXpm, mkfontdir, fontutil }:
+{ lib
+, stdenv
+, autoreconfHook
+, dockapps-sources
+, fontutil
+, libX11
+, libXext
+, libXpm
+, mkfontdir
+, pkg-config
+}:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "libdockapp";
-  version = "0.7.3";
 
-  src = dockapps-sources;
+  inherit (dockapps-sources) version src;
+
+  sourceRoot = "${finalAttrs.src.name}/libdockapp";
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
 
   buildInputs = [ libX11 libXext libXpm fontutil mkfontdir ];
 
-  setSourceRoot = ''
-    export sourceRoot=$(echo */${pname})
-  '';
-
   # There is a bug on --with-font
   configureFlags = [
     "--with-examples=no"
     "--with-font=no"
   ];
 
-  meta = with lib; {
+  meta = {
     description = "A library providing a framework for dockapps";
     homepage = "https://www.dockapps.net/libdockapp";
-    license = licenses.gpl2Plus;
-    maintainers = [ maintainers.bstrik ];
+    license = lib.licenses.gpl2Plus;
+    maintainers = [ ];
   };
-}
+})
diff --git a/pkgs/by-name/wi/windowmaker/dockapps/wmCalClock.nix b/pkgs/by-name/wi/windowmaker/dockapps/wmCalClock.nix
index 9f49b4508c1c..1dc130971ded 100644
--- a/pkgs/by-name/wi/windowmaker/dockapps/wmCalClock.nix
+++ b/pkgs/by-name/wi/windowmaker/dockapps/wmCalClock.nix
@@ -1,17 +1,23 @@
-{ lib, stdenv, dockapps-sources
-, libX11, libXpm, libXext }:
-
-stdenv.mkDerivation rec {
+{ lib
+, stdenv
+, dockapps-sources
+, libX11
+, libXext
+, libXpm
+}:
+
+stdenv.mkDerivation (finalAttrs: {
   pname = "wmCalClock";
-  version = "1.25";
 
-  src = dockapps-sources;
+  inherit (dockapps-sources) version src;
 
-  buildInputs = [ libX11 libXpm libXext ];
+  sourceRoot = "${finalAttrs.src.name}/wmCalClock";
 
-  setSourceRoot = ''
-    export sourceRoot=$(echo */${pname}/Src)
-  '';
+  buildInputs = [
+    libX11
+    libXpm
+    libXext
+  ];
 
   preBuild = ''
     makeFlagsArray+=(
@@ -28,11 +34,11 @@ stdenv.mkDerivation rec {
 
   installFlags = [ "DESTDIR=${placeholder "out"}" ];
 
-  meta = with lib; {
+  meta = {
     description = "A Calendar clock with antialiased text";
     homepage = "https://www.dockapps.net/wmcalclock";
-    license = licenses.gpl2Plus;
-    maintainers = [ maintainers.bstrik ];
-    platforms = platforms.linux;
+    license = lib.licenses.gpl2Plus;
+    maintainers = [ ];
+    platforms = lib.platforms.linux;
   };
-}
+})
diff --git a/pkgs/by-name/wi/windowmaker/dockapps/wmcube.nix b/pkgs/by-name/wi/windowmaker/dockapps/wmcube.nix
new file mode 100644
index 000000000000..5aaa00e23e34
--- /dev/null
+++ b/pkgs/by-name/wi/windowmaker/dockapps/wmcube.nix
@@ -0,0 +1,48 @@
+{ lib
+, stdenv
+, dockapps-sources
+, libX11
+, libXpm
+, libXext
+, libdockapp
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "wmcube";
+
+  inherit (dockapps-sources) version src;
+
+  sourceRoot = "${finalAttrs.src.name}/wmcube/wmcube";
+
+  buildInputs = [
+    libX11
+    libXext
+    libXpm
+    libdockapp
+  ];
+
+  env.NIX_CFLAGS_COMPILE = "-std=gnu89";
+
+  preBuild = ''
+    makeFlagsArray=(
+      CC="${stdenv.cc.targetPrefix}cc"
+      PREFIX="${placeholder "out"}"
+      VERSION="${finalAttrs.version}"
+      LIBDIR="-L${lib.getLib libX11}/lib -L${lib.getLib libXext}/lib \
+-L${lib.getLib libXpm}/lib -L${lib.getLib libdockapp}/lib"
+      INCDIR="-I${lib.getDev libX11}/lib -I${lib.getDev libXext}/lib \
+-I${lib.getDev libXpm}/lib -I${lib.getDev libdockapp}/lib"
+      LIBS="-lm -lXpm -lXext -lX11 -ldockapp"
+    )
+  '';
+
+  preInstall = ''
+    mkdir -pv $out/{bin,doc/wmcube-${finalAttrs.version},share/wmcube,man/man1}
+  '';
+
+  meta = {
+    description = "System monitor for Windowmaker";
+    license = lib.licenses.gpl2Plus;
+    maintainers = [ ];
+  };
+})
diff --git a/pkgs/by-name/wi/windowmaker/dockapps/wmsm-app.nix b/pkgs/by-name/wi/windowmaker/dockapps/wmsm-app.nix
index 5c68a39a1ead..6becfce9578b 100644
--- a/pkgs/by-name/wi/windowmaker/dockapps/wmsm-app.nix
+++ b/pkgs/by-name/wi/windowmaker/dockapps/wmsm-app.nix
@@ -1,20 +1,25 @@
-{ lib, stdenv, dockapps-sources
+{ lib
+, stdenv
+, dockapps-sources
 , libX11
 , libXpm
 , libXext
-, libdockapp }:
+, libdockapp
+}:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation  (finalAttrs: {
   pname = "wmsm.app";
-  version = "0.2.1";
 
-  src = dockapps-sources;
+  inherit (dockapps-sources) version src;
 
-  buildInputs = [ libX11 libXpm libXext libdockapp ];
+  sourceRoot = "${src.name}/wmsm.app/wmsm";
 
-  setSourceRoot = ''
-    export sourceRoot=$(echo */${pname}/wmsm)
-  '';
+  buildInputs = [
+    libX11
+    libXext
+    libXpm
+    libdockapp
+  ];
 
   env.NIX_CFLAGS_COMPILE = "-std=gnu89";
 
@@ -24,7 +29,9 @@ stdenv.mkDerivation rec {
       --replace "/usr/bin/install" "install"
   '';
 
-  makeFlags = [ "CC=${stdenv.cc.targetPrefix}cc" ];
+  makeFlags = [
+    "CC=${stdenv.cc.targetPrefix}cc"
+  ];
 
   installPhase = ''
     runHook preInstall
@@ -32,12 +39,14 @@ stdenv.mkDerivation rec {
     runHook postInstall
   '';
 
-  installFlags = [ "PREFIX=${placeholder "out"}/bin" ];
+  installFlags = [
+    "PREFIX=${placeholder "out"}/bin"
+  ];
 
-  meta = with lib; {
+  meta = {
     description = "System monitor for Windowmaker";
     homepage = "https://www.dockapps.net/wmsmapp";
-    license = licenses.gpl2;
-    maintainers = [ maintainers.bstrik ];
+    license = lib.licenses.gpl2Plus;
+    maintainers = [ ];
   };
-}
+})
diff --git a/pkgs/by-name/wi/windowmaker/dockapps/wmsystemtray.nix b/pkgs/by-name/wi/windowmaker/dockapps/wmsystemtray.nix
index ced4cad80556..7f17475d318f 100644
--- a/pkgs/by-name/wi/windowmaker/dockapps/wmsystemtray.nix
+++ b/pkgs/by-name/wi/windowmaker/dockapps/wmsystemtray.nix
@@ -1,22 +1,40 @@
-{ lib, stdenv, fetchurl, pkg-config, libX11, libXpm, libXext, libXfixes, libXmu }:
+{ lib
+, stdenv
+, fetchurl
+, libX11
+, libXext
+, libXfixes
+, libXmu
+, libXpm
+, pkg-config
+}:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "wmsystemtray";
   version = "1.4";
 
   src = fetchurl {
-    url = "mirror://sourceforge/project/${pname}/${pname}/${pname}-${version}.tar.gz";
-     sha256 = "sha256-jt70NpHp//BxAA4pFmx8GtQgwJVukGgVEGHogcisl+k=";
+    url = "mirror://sourceforge/project/wmsystemtray/wmsystemtray/wmsystemtray-${finalAttrs.version}.tar.gz";
+    hash = "sha256-jt70NpHp//BxAA4pFmx8GtQgwJVukGgVEGHogcisl+k=";
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ libX11 libXpm libXext libXfixes libXmu ];
+  nativeBuildInputs = [
+    pkg-config
+  ];
 
-  meta = with lib; {
+  buildInputs = [
+    libX11
+    libXext
+    libXfixes
+    libXmu
+    libXpm
+  ];
+
+  meta = {
     description = "A system tray for Windowmaker";
     homepage = "http://wmsystemtray.sourceforge.net";
     license = licenses.gpl2Only;
-    maintainers = [ maintainers.bstrik ];
+    maintainers = [ ];
     platforms = platforms.linux;
   };
-}
+})
diff --git a/pkgs/by-name/wi/windowmaker/package.nix b/pkgs/by-name/wi/windowmaker/package.nix
index 2381c16f41ae..6c39eadeb05b 100644
--- a/pkgs/by-name/wi/windowmaker/package.nix
+++ b/pkgs/by-name/wi/windowmaker/package.nix
@@ -2,6 +2,7 @@
 , stdenv
 , fetchFromRepoOrCz
 , autoreconfHook
+, callPackage
 , pkg-config
 , imagemagick
 , libX11
@@ -62,6 +63,10 @@ stdenv.mkDerivation (finalAttrs: {
     "--with-x"
   ];
 
+  passthru = {
+    dockapps = callPackage ./dockapps { };
+  };
+
   meta = {
     homepage = "http://windowmaker.org/";
     description = "NeXTSTEP-like window manager";
diff --git a/pkgs/data/documentation/scheme-manpages/default.nix b/pkgs/data/documentation/scheme-manpages/default.nix
index 08916f3e561f..6eb1e3e74170 100644
--- a/pkgs/data/documentation/scheme-manpages/default.nix
+++ b/pkgs/data/documentation/scheme-manpages/default.nix
@@ -2,13 +2,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "scheme-manpages";
-  version = "unstable-2023-08-13";
+  version = "unstable-2023-08-27";
 
   src = fetchFromGitHub {
     owner = "schemedoc";
     repo = "manpages";
-    rev = "c17abb7dfb733fede4cf776a932e9696ccc7a4f2";
-    hash = "sha256-9s/1sJEA4nowzQRpySOFzY+PxiUdz1Z3D931rMet4CA=";
+    rev = "44317b20616699b13b2b6276c86d796f4ae0c8dd";
+    hash = "sha256-qxj9sEQYOZ+me2IhDS5S2GRSho4KWWrEm+5MNxfw1VI=";
   };
 
   dontBuild = true;
diff --git a/pkgs/data/fonts/sketchybar-app-font/default.nix b/pkgs/data/fonts/sketchybar-app-font/default.nix
index c66d649de187..df68dbb844c5 100644
--- a/pkgs/data/fonts/sketchybar-app-font/default.nix
+++ b/pkgs/data/fonts/sketchybar-app-font/default.nix
@@ -5,11 +5,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "sketchybar-app-font";
-  version = "1.0.16";
+  version = "1.0.17";
 
   src = fetchurl {
     url = "https://github.com/kvndrsslr/sketchybar-app-font/releases/download/v${finalAttrs.version}/sketchybar-app-font.ttf";
-    hash = "sha256-58gRCEJix9pnZEcoo6bm2zWduP0xXl3WWC6mt36SGuo=";
+    hash = "sha256-sDMasHVcITTSUP9B87w4I7IZ44tYmabNNWl+kE3dUoE=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/data/fonts/vazir-fonts/default.nix b/pkgs/data/fonts/vazir-fonts/default.nix
index d65b270c881f..d65b270c881f 100755..100644
--- a/pkgs/data/fonts/vazir-fonts/default.nix
+++ b/pkgs/data/fonts/vazir-fonts/default.nix
diff --git a/pkgs/data/icons/tela-circle-icon-theme/default.nix b/pkgs/data/icons/tela-circle-icon-theme/default.nix
index 6e32d09dac68..518f0d11efd7 100644
--- a/pkgs/data/icons/tela-circle-icon-theme/default.nix
+++ b/pkgs/data/icons/tela-circle-icon-theme/default.nix
@@ -19,13 +19,13 @@ lib.checkListOfEnum "${pname}: color variants" [ "standard" "black" "blue" "brow
 
 stdenvNoCC.mkDerivation rec {
   inherit pname;
-  version = "2023-06-25";
+  version = "2023-10-07";
 
   src = fetchFromGitHub {
     owner = "vinceliuice";
     repo = pname;
     rev = version;
-    sha256 = "nob0Isx785YRP4QIj2CK+v99CUiRwtkge1dNXCCwaDs=";
+    sha256 = "il+bYIcwm0BQF6U0J6h6rlzHSGSHYN/O8BezehYIpQ4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/gnome/core/zenity/default.nix b/pkgs/desktops/gnome/core/zenity/default.nix
index b171ef202252..6ff36b1c1960 100644
--- a/pkgs/desktops/gnome/core/zenity/default.nix
+++ b/pkgs/desktops/gnome/core/zenity/default.nix
@@ -45,6 +45,7 @@ stdenv.mkDerivation rec {
   };
 
   meta = with lib; {
+    mainProgram = "zenity";
     description = "Tool to display dialogs from the commandline and shell scripts";
     homepage = "https://wiki.gnome.org/Projects/Zenity";
     license = licenses.lgpl21Plus;
diff --git a/pkgs/desktops/xfce/applications/xfce4-notifyd/default.nix b/pkgs/desktops/xfce/applications/xfce4-notifyd/default.nix
index 8d75389b079d..54f51ee2518c 100644
--- a/pkgs/desktops/xfce/applications/xfce4-notifyd/default.nix
+++ b/pkgs/desktops/xfce/applications/xfce4-notifyd/default.nix
@@ -1,9 +1,12 @@
 { lib
 , mkXfceDerivation
+, dbus
 , glib
 , gtk3
+, gtk-layer-shell
 , libcanberra-gtk3
 , libnotify
+, libX11
 , libxfce4ui
 , libxfce4util
 , sqlite
@@ -14,15 +17,19 @@
 mkXfceDerivation {
   category = "apps";
   pname = "xfce4-notifyd";
-  version = "0.8.2";
+  version = "0.9.2";
+  odd-unstable = false;
 
-  sha256 = "sha256-M8L2HWTuQDl/prD7s6uptkW4XDscpk6fc+epoxjFNS8=";
+  sha256 = "sha256-BHhz5LURXLeILxQ+iNQ+50yHd/oIF7twHAqxiBQ2hFE=";
 
   buildInputs = [
+    dbus
     gtk3
+    gtk-layer-shell
     glib
     libcanberra-gtk3
     libnotify
+    libX11
     libxfce4ui
     libxfce4util
     sqlite
diff --git a/pkgs/development/interpreters/janet/default.nix b/pkgs/development/interpreters/janet/default.nix
index 3c44239dc2fa..f186021eb3d6 100644
--- a/pkgs/development/interpreters/janet/default.nix
+++ b/pkgs/development/interpreters/janet/default.nix
@@ -1,19 +1,30 @@
-{ lib, stdenv, fetchFromGitHub, meson, ninja }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, meson
+, ninja
+, nix-update-script
+, runCommand
+}:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "janet";
-  version = "1.31.0";
+  version = "1.32.1";
 
   src = fetchFromGitHub {
     owner = "janet-lang";
-    repo = pname;
-    rev = "v${version}";
-    hash = "sha256-Dj2fj1dsdAMl/H0vNKTf9qjPB4GVRpgWPVR+PuZWZMc=";
+    repo = "janet";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-24d9N59pTfQATWmAZN4dAFT8RTTlUlBPKokcQ/Fd2No=";
   };
 
   postPatch = ''
     substituteInPlace janet.1 \
       --replace /usr/local/ $out/
+  '' + lib.optionalString stdenv.isDarwin ''
+    # error: Socket is not connected
+    substituteInPlace meson.build \
+      --replace "'test/suite-ev.janet'," ""
   '';
 
   nativeBuildInputs = [ meson ninja ];
@@ -29,6 +40,21 @@ stdenv.mkDerivation rec {
     $out/bin/janet -e '(+ 1 2 3)'
   '';
 
+  passthru = {
+    tests.run = runCommand "janet-test-run" {
+      nativeBuildInputs = [finalAttrs.finalPackage];
+    } ''
+      echo "(+ 1 2 3)" | janet | tail -n 1 > arithmeticTest.txt;
+      diff -U3 --color=auto <(cat arithmeticTest.txt) <(echo "6");
+
+      echo "(print \"Hello, World!\")" | janet | tail -n 2 > ioTest.txt;
+      diff -U3 --color=auto <(cat ioTest.txt) <(echo -e "Hello, World!\nnil");
+
+      touch $out;
+    '';
+    updateScript = nix-update-script {};
+  };
+
   meta = with lib; {
     description = "Janet programming language";
     homepage = "https://janet-lang.org/";
@@ -36,4 +62,4 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ andrewchambers peterhoeg ];
     platforms = platforms.all;
   };
-}
+})
diff --git a/pkgs/development/libraries/CGAL/default.nix b/pkgs/development/libraries/CGAL/default.nix
index 9d9233aad20e..672facdc230c 100644
--- a/pkgs/development/libraries/CGAL/default.nix
+++ b/pkgs/development/libraries/CGAL/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv
-, fetchFromGitHub
+, fetchurl
 , cmake
 , boost
 , gmp
@@ -8,13 +8,11 @@
 
 stdenv.mkDerivation rec {
   pname = "cgal";
-  version = "5.5.2";
+  version = "5.5.3";
 
-  src = fetchFromGitHub {
-    owner = "CGAL";
-    repo = "releases";
-    rev = "CGAL-${version}";
-    sha256 = "sha256-olMPT/8Q0bf+rooJoNc0k8NrO//O7z0yqBoP8KX39yQ=";
+  src = fetchurl {
+    url = "https://github.com/CGAL/cgal/releases/download/v${version}/CGAL-${version}.tar.xz";
+    hash = "sha256-CgT2YmkyVjKLBbq/q7XjpbfbL1pY1S48Ug350IKN3XM=";
   };
 
   # note: optional component libCGAL_ImageIO would need zlib and opengl;
diff --git a/pkgs/development/libraries/jemalloc/rust.nix b/pkgs/development/libraries/jemalloc/rust.nix
new file mode 100644
index 000000000000..1a9968933b1e
--- /dev/null
+++ b/pkgs/development/libraries/jemalloc/rust.nix
@@ -0,0 +1,24 @@
+{ lib
+, stdenv
+, jemalloc
+, writeText
+
+, unprefixed ? false
+}:
+
+let
+  # On some platforms the unprefixed feature will be ignored:
+  # https://github.com/tikv/jemallocator/blob/ab0676d77e81268cd09b059260c75b38dbef2d51/jemalloc-sys/src/env.rs
+  unprefixed' = unprefixed && !stdenv.hostPlatform.isMusl && !stdenv.hostPlatform.isDarwin && !stdenv.hostPlatform.isAndroid;
+
+in jemalloc.overrideAttrs (oldAttrs: {
+  configureFlags = oldAttrs.configureFlags ++ [
+    "--with-private-namespace=_rjem_"
+  ] ++ lib.optionals (!unprefixed') [
+    "--with-jemalloc-prefix=_rjem_"
+  ];
+
+  setupHook = writeText "setup-hook.sh" ''
+    export JEMALLOC_OVERRIDE="@out@/lib/libjemalloc${stdenv.hostPlatform.extensions.library}"
+  '';
+})
diff --git a/pkgs/development/libraries/virglrenderer/default.nix b/pkgs/development/libraries/virglrenderer/default.nix
index 42ce297d4563..f64de57fcb89 100644
--- a/pkgs/development/libraries/virglrenderer/default.nix
+++ b/pkgs/development/libraries/virglrenderer/default.nix
@@ -1,23 +1,21 @@
-{ lib, stdenv, fetchurl, cmake, meson, ninja, pkg-config, python3
+{ lib, stdenv, fetchurl, meson, ninja, pkg-config, python3
 , libGLU, libepoxy, libX11, libdrm, mesa
 }:
 
 stdenv.mkDerivation rec {
   pname = "virglrenderer";
-  version = "0.10.4";
+  version = "1.0.0";
 
   src = fetchurl {
-    url = "https://gitlab.freedesktop.org/virgl/virglrenderer/-/archive/virglrenderer-${version}/virglrenderer-virglrenderer-${version}.tar.bz2";
-    sha256 = "sha256-qqvnko2sN4bdm9+F0PVjDW5FsiL5k3UAfjPSTqG+73c=";
+    url = "https://gitlab.freedesktop.org/virgl/virglrenderer/-/archive/${version}/virglrenderer-${version}.tar.bz2";
+    hash = "sha256-KMGPP2MeuATHFXKr5oW9HuFOMmmYpmkVLvMvQi0cEdg=";
   };
 
   separateDebugInfo = true;
 
   buildInputs = [ libGLU libepoxy libX11 libdrm mesa ];
 
-  nativeBuildInputs = [ cmake meson ninja pkg-config python3 ];
-
-  dontUseCmakeConfigure = true;
+  nativeBuildInputs = [ meson ninja pkg-config python3 ];
 
   meta = with lib; {
     description = "A virtual 3D GPU library that allows a qemu guest to use the host GPU for accelerated 3D rendering";
diff --git a/pkgs/development/libraries/zlib-ng/default.nix b/pkgs/development/libraries/zlib-ng/default.nix
index 3f2ba22ea430..2d3ba583cfd5 100644
--- a/pkgs/development/libraries/zlib-ng/default.nix
+++ b/pkgs/development/libraries/zlib-ng/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "zlib-ng";
-  version = "2.1.3";
+  version = "2.1.4";
 
   src = fetchFromGitHub {
     owner = "zlib-ng";
     repo = "zlib-ng";
     rev = version;
-    hash = "sha256-DC4KPPaMuqML0HEhWJmWjyox4WEbExPDfNnpnWzoaHc=";
+    hash = "sha256-okNmobCVAC9y7tjZqFd0DBhOjs3WWRPK8jvK1j9G29k=";
   };
 
   outputs = [ "out" "dev" "bin" ];
diff --git a/pkgs/development/php-packages/opentelemetry/default.nix b/pkgs/development/php-packages/opentelemetry/default.nix
index 2bef82d8d8e9..346a3cb36951 100644
--- a/pkgs/development/php-packages/opentelemetry/default.nix
+++ b/pkgs/development/php-packages/opentelemetry/default.nix
@@ -1,7 +1,7 @@
 { lib, buildPecl, fetchFromGitHub }:
 
 let
-  version = "1.0.0RC2";
+  version = "1.0.0RC3";
 in buildPecl {
   inherit version;
   pname = "opentelemetry";
@@ -10,7 +10,7 @@ in buildPecl {
     owner = "open-telemetry";
     repo = "opentelemetry-php-instrumentation";
     rev = version;
-    hash = "sha256-sCsJ4ZmQXTTG+ZxDzw3b6Su/8QUAVZv7vV6SuLBET+0=";
+    hash = "sha256-0jHXl+Amjv0vLSuSWhkGAU25pkRXbJgdx02N6o2dUyw=";
   };
 
   sourceRoot = "source/ext";
diff --git a/pkgs/development/php-packages/xdebug/default.nix b/pkgs/development/php-packages/xdebug/default.nix
index 61e83d918765..3aa24ce15e43 100644
--- a/pkgs/development/php-packages/xdebug/default.nix
+++ b/pkgs/development/php-packages/xdebug/default.nix
@@ -1,7 +1,7 @@
 { buildPecl, lib, fetchFromGitHub }:
 
 let
-  version = "3.2.2";
+  version = "3.3.0alpha3";
 in buildPecl {
   inherit version;
 
@@ -11,7 +11,7 @@ in buildPecl {
     owner = "xdebug";
     repo = "xdebug";
     rev = version;
-    hash = "sha256-zbgJw2oPzyUTK0UwLAqpShBi+toVsEQcjoG4tIBder0=";
+    hash = "sha256-LBrKQCR4qpV3yJpTknUNKX6mq+qSdBSveIoYmk5Vmoc=";
   };
 
   doCheck = true;
diff --git a/pkgs/development/python-modules/aiohomekit/default.nix b/pkgs/development/python-modules/aiohomekit/default.nix
index 7eb2a64d38e6..644c3cda0801 100644
--- a/pkgs/development/python-modules/aiohomekit/default.nix
+++ b/pkgs/development/python-modules/aiohomekit/default.nix
@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "aiohomekit";
-  version = "3.0.5";
+  version = "3.0.6";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "Jc2k";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-Rux3fRP1lM42i42K24t27DwAadi+NRJJHDhPAjZXb7s=";
+    hash = "sha256-e7KSgUOEA3iAR4QdUhjYcHsPdtCJRxu6u+uxuDMaghQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/annotated-types/default.nix b/pkgs/development/python-modules/annotated-types/default.nix
index 645e3c40c48c..85e2379507c6 100644
--- a/pkgs/development/python-modules/annotated-types/default.nix
+++ b/pkgs/development/python-modules/annotated-types/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "annotated-types";
-  version = "0.5.0";
+  version = "0.6.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "annotated-types";
     repo = "annotated-types";
-    rev = "v${version}";
-    hash = "sha256-zCsWfJ8BQuov8FN+hlm9XBKWAAQ/KHPK/x024A8k2kE=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-SZ9/rXYcns4DFM6vk6SRKvuv3MY3T7xO9aW7WAQqtVE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/argilla/default.nix b/pkgs/development/python-modules/argilla/default.nix
index 8ac1ccdc65f8..8179d054a97f 100644
--- a/pkgs/development/python-modules/argilla/default.nix
+++ b/pkgs/development/python-modules/argilla/default.nix
@@ -65,7 +65,7 @@
 }:
 let
   pname = "argilla";
-  version = "1.16.0";
+  version = "1.17.0";
   optional-dependencies = {
     server = [
       fastapi
@@ -126,7 +126,7 @@ buildPythonPackage {
     owner = "argilla-io";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-SKxIc7T9wmMMGQeebcRVOrB4Y5ETz9LSeKzzqI+wf80=";
+    hash = "sha256-ggw6ABPn3d+aOj+0ETKYWWTha/2Recdnp/LGBXG1HY4=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/asdf-transform-schemas/default.nix b/pkgs/development/python-modules/asdf-transform-schemas/default.nix
index 545062e0dd5a..d00e43e756a3 100644
--- a/pkgs/development/python-modules/asdf-transform-schemas/default.nix
+++ b/pkgs/development/python-modules/asdf-transform-schemas/default.nix
@@ -9,15 +9,15 @@
 
 buildPythonPackage rec {
   pname = "asdf-transform-schemas";
-  version = "0.3.0";
-  format = "pyproject";
+  version = "0.4.0";
+  pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     pname = "asdf_transform_schemas";
     inherit version;
-    hash = "sha256-DPL/eyLMtAj+WN3ZskQaWbpz/jI+QW1ZueCkcop9LdY=";
+    hash = "sha256-3n/cP+41+5V/wylXh3oOnX3U0uhRvWMaclnxHCvSlMo=";
   };
 
   nativeBuildInputs = [
@@ -40,6 +40,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "ASDF schemas for validating transform tags";
     homepage = "https://github.com/asdf-format/asdf-transform-schemas";
+    changelog = "https://github.com/asdf-format/asdf-transform-schemas/releases/tag/${version}";
     license = licenses.bsd3;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/atlassian-python-api/default.nix b/pkgs/development/python-modules/atlassian-python-api/default.nix
index fd389308c931..fd389308c931 100755..100644
--- a/pkgs/development/python-modules/atlassian-python-api/default.nix
+++ b/pkgs/development/python-modules/atlassian-python-api/default.nix
diff --git a/pkgs/development/python-modules/bellows/default.nix b/pkgs/development/python-modules/bellows/default.nix
index 2566e8e02e61..13cc8d991774 100644
--- a/pkgs/development/python-modules/bellows/default.nix
+++ b/pkgs/development/python-modules/bellows/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "bellows";
-  version = "0.36.6";
+  version = "0.36.7";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "zigpy";
     repo = "bellows";
     rev = "refs/tags/${version}";
-    hash = "sha256-ThLUWcGMTHg/ASKiL19iLe+9hq7KybWm+38PdoDhWvk=";
+    hash = "sha256-j7Awqt14/J0BbYcKwIR10UtVeqt9BpQkzT8dqGRVEOU=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/bespon/default.nix b/pkgs/development/python-modules/bespon/default.nix
index da6820ef6ecc..a942651dcb73 100644
--- a/pkgs/development/python-modules/bespon/default.nix
+++ b/pkgs/development/python-modules/bespon/default.nix
@@ -1,18 +1,20 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, setuptools
 }:
 
 buildPythonPackage rec {
-  version = "0.6.0";
-  pname = "BespON";
+  version = "0.7.0";
+  pname = "bespon";
+  format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "2f2bda67fea8ee95c8aa7e885835ab88bdbfa392a94077ce1c9d29017420ce7a";
+    hash = "sha256-dGtXw4uq6pdyXBVfSi9s7kCFUqA1PO7qWEGY0JNAz8Q=";
   };
 
-  propagatedBuildInputs = [ ];
+  nativeBuildInputs = [ setuptools ];
   # upstream doesn't contain tests
   doCheck = false;
 
diff --git a/pkgs/development/python-modules/certbot-dns-ovh/default.nix b/pkgs/development/python-modules/certbot-dns-ovh/default.nix
new file mode 100644
index 000000000000..da0dd57cff87
--- /dev/null
+++ b/pkgs/development/python-modules/certbot-dns-ovh/default.nix
@@ -0,0 +1,39 @@
+{ buildPythonPackage
+, acme
+, certbot
+, dns-lexicon
+, pytestCheckHook
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "certbot-dns-ovh";
+
+  inherit (certbot) src version;
+  disabled = pythonOlder "3.6";
+
+  sourceRoot = "${src.name}/certbot-dns-ovh";
+
+  propagatedBuildInputs = [
+    acme
+    certbot
+    dns-lexicon
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pytestFlagsArray = [
+    "-o cache_dir=$(mktemp -d)"
+
+    # Monitor https://github.com/certbot/certbot/issues/9606 for a solution
+    "-W 'ignore:pkg_resources is deprecated as an API:DeprecationWarning'"
+    "-W 'ignore:Package lexicon.providers is deprecated and will be removed in Lexicon 4>=.:DeprecationWarning'"
+    "-W 'ignore:Legacy configuration object has been used to load the ConfigResolver.:DeprecationWarning'"
+  ];
+
+  meta = certbot.meta // {
+    description = "OVH DNS Authenticator plugin for Certbot";
+  };
+}
diff --git a/pkgs/development/python-modules/chex/default.nix b/pkgs/development/python-modules/chex/default.nix
index 047073587b26..6bee1641242c 100644
--- a/pkgs/development/python-modules/chex/default.nix
+++ b/pkgs/development/python-modules/chex/default.nix
@@ -15,16 +15,16 @@
 
 buildPythonPackage rec {
   pname = "chex";
-  version = "0.1.83";
+  version = "0.1.84";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
 
   src = fetchFromGitHub {
     owner = "deepmind";
-    repo = pname;
+    repo = "chex";
     rev = "refs/tags/v${version}";
-    hash = "sha256-iEachJf5NjOnkMWdP0aVQHWNPgUUBkMnzHKq3GP7t4w=";
+    hash = "sha256-LsUMvSMVGjqZuFDcb+/61RtFxweeG6bSFzmJUUMv6rA=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/desktop-entry-lib/default.nix b/pkgs/development/python-modules/desktop-entry-lib/default.nix
new file mode 100644
index 000000000000..5a6d3c00e7f0
--- /dev/null
+++ b/pkgs/development/python-modules/desktop-entry-lib/default.nix
@@ -0,0 +1,35 @@
+{ lib
+, buildPythonPackage
+, pythonOlder
+, pytestCheckHook
+, fetchFromGitea
+, setuptools
+}:
+
+buildPythonPackage rec {
+  pname = "desktop-entry-lib";
+  version = "3.1";
+  pyproject = true;
+  disabled = pythonOlder "3.9";
+
+  # We could use fetchPypi, but then the tests won't run
+  src = fetchFromGitea {
+    domain = "codeberg.org";
+    owner = "JakobDev";
+    repo = pname;
+    rev = version;
+    hash = "sha256-+c+FuLv88wc4yVw3iyFFtfbocnWzTCIe2DS0SWoj+VI=";
+  };
+
+  nativeBuildInputs = [ setuptools ];
+  nativeCheckInputs = [ pytestCheckHook ];
+  pythonImportsCheck = [ "desktop_entry_lib" ];
+
+  meta = with lib; {
+    description = "Allows reading and writing .desktop files according to the Desktop Entry Specification";
+    homepage = "https://codeberg.org/JakobDev/desktop-entry-lib";
+    changelog = "https://codeberg.org/JakobDev/desktop-entry-lib/releases/tag/${version}";
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ Madouura ];
+  };
+}
diff --git a/pkgs/development/python-modules/dramatiq/default.nix b/pkgs/development/python-modules/dramatiq/default.nix
new file mode 100644
index 000000000000..8b7300d786f5
--- /dev/null
+++ b/pkgs/development/python-modules/dramatiq/default.nix
@@ -0,0 +1,106 @@
+{ lib
+, stdenv
+, buildPythonPackage
+, pythonOlder
+, fetchFromGitHub
+, gevent
+, pika
+, prometheus-client
+, pylibmc
+, pytestCheckHook
+, redis
+, watchdog
+, watchdog-gevent
+}:
+
+buildPythonPackage rec {
+  pname = "dramatiq";
+  version = "1.14.2";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "Bogdanp";
+    repo = "dramatiq";
+    rev = "v${version}";
+    hash = "sha256-yv6HUJI7wsAQdBJ5QNv7qXhtzPvCsrF1389kyemAV7Y=";
+  };
+
+  propagatedBuildInputs = [
+    prometheus-client
+  ];
+
+  passthru.optional-dependencies = {
+    all = [
+      gevent
+      pika
+      pylibmc
+      redis
+      watchdog
+      watchdog-gevent
+    ];
+    gevent = [
+      gevent
+    ];
+    memcached = [
+      pylibmc
+    ];
+    rabbitmq = [
+      pika
+    ];
+    redis = [
+      redis
+    ];
+    watch = [
+      watchdog
+      watchdog-gevent
+    ];
+  };
+
+  nativeCheckInputs = [ pytestCheckHook pika redis pylibmc ];
+
+  postPatch = ''
+    sed -i ./setup.cfg \
+      -e 's:--cov dramatiq::' \
+      -e 's:--cov-report html::' \
+      -e 's:--benchmark-autosave::' \
+      -e 's:--benchmark-compare::' \
+  '';
+
+  disabledTests = [
+    # Requires a running redis
+    "test_after_process_boot_call_has_no_blocked_signals"
+    "test_cli_can_be_reloaded_on_sighup"
+    "test_cli_can_watch_for_source_code_changes"
+    "test_cli_fork_functions_have_no_blocked_signals"
+    "test_consumer_threads_have_no_blocked_signals"
+    "test_middleware_fork_functions_have_no_blocked_signals"
+    "test_redis_broker_can_connect_via_client"
+    "test_redis_broker_can_connect_via_url"
+    "test_redis_process_100k_messages_with_cli"
+    "test_redis_process_10k_fib_with_cli"
+    "test_redis_process_1k_latency_with_cli"
+    "test_worker_threads_have_no_blocked_signals"
+    # Requires a running rabbitmq
+    "test_rabbitmq_broker_can_be_passed_a_list_of_parameters_for_failover"
+    "test_rabbitmq_broker_can_be_passed_a_list_of_uri_for_failover"
+    "test_rabbitmq_broker_can_be_passed_a_semicolon_separated_list_of_uris"
+    "test_rabbitmq_broker_connections_are_lazy"
+    "test_rabbitmq_process_100k_messages_with_cli"
+    "test_rabbitmq_process_10k_fib_with_cli"
+    "test_rabbitmq_process_1k_latency_with_cli"
+  ] ++ lib.optionals stdenv.isDarwin [
+    # Takes too long for darwin ofborg
+    "test_retry_exceptions_can_specify_a_delay"
+  ];
+
+  pythonImportsCheck = [ "dramatiq" ];
+
+  meta = with lib; {
+    description = "Background Processing for Python 3";
+    homepage = "https://github.com/Bogdanp/dramatiq";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ traxys ];
+  };
+}
diff --git a/pkgs/development/python-modules/flask-dramatiq/default.nix b/pkgs/development/python-modules/flask-dramatiq/default.nix
new file mode 100644
index 000000000000..6f8884516f49
--- /dev/null
+++ b/pkgs/development/python-modules/flask-dramatiq/default.nix
@@ -0,0 +1,85 @@
+{ lib
+, buildPythonPackage
+, pythonOlder
+, fetchFromGitLab
+, poetry-core
+, dramatiq
+, flask
+, requests
+, pytestCheckHook
+, flask-migrate
+, periodiq
+, postgresql
+, postgresqlTestHook
+, psycopg2
+}:
+
+buildPythonPackage {
+  pname = "flask-dramatiq";
+  version = "0.6.0";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.6";
+
+  src = fetchFromGitLab {
+    owner = "bersace";
+    repo = "flask-dramatiq";
+    rev = "840209e9bf582b4dda468e8bba515f248f3f8534";
+    hash = "sha256-qjV1zyVzHPXMt+oUeGBdP9XVlbcSz2MF9Zygj543T4w=";
+  };
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace 'poetry>=0.12' 'poetry-core' \
+      --replace 'poetry.masonry.api' 'poetry.core.masonry.api'
+
+    patchShebangs --build ./example.py
+
+    sed -i ./tests/unit/pytest.ini \
+      -e 's:--cov=flask_dramatiq::' \
+      -e 's:--cov-report=term-missing::'
+  '';
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    dramatiq
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    flask
+    requests
+    flask-migrate
+    periodiq
+    postgresql
+    postgresqlTestHook
+    psycopg2
+  ] ++ dramatiq.optional-dependencies.rabbitmq;
+
+  postgresqlTestSetupPost = ''
+    substituteInPlace config.py \
+      --replace 'SQLALCHEMY_DATABASE_URI = f"postgresql://{PGUSER}:{PGPASSWORD}@{PGHOST}/{PGDATABASE}"' \
+        "SQLALCHEMY_DATABASE_URI = \"postgresql://$PGUSER/$PGDATABASE?host=$PGHOST\""
+    python3 ./example.py db upgrade
+  '';
+
+  pytestFlagsArray = [ "-x" "tests/func/" "tests/unit"];
+
+  pythonImportsCheck = [ "flask_dramatiq" ];
+
+  # Does HTTP requests to localhost
+  disabledTests = [
+    "test_fast"
+    "test_other"
+  ];
+
+  meta = with lib; {
+    description = "Adds Dramatiq support to your Flask application";
+    homepage = "https://gitlab.com/bersace/flask-dramatiq";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ traxys ];
+  };
+}
diff --git a/pkgs/development/python-modules/fnv-hash-fast/default.nix b/pkgs/development/python-modules/fnv-hash-fast/default.nix
index 7fe9ba92b638..01e57845d3bb 100644
--- a/pkgs/development/python-modules/fnv-hash-fast/default.nix
+++ b/pkgs/development/python-modules/fnv-hash-fast/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "fnv-hash-fast";
-  version = "0.4.1";
+  version = "0.5.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "bdraco";
     repo = "fnv-hash-fast";
     rev = "v${version}";
-    hash = "sha256-vKv3Hfla+U1teYVB+w8ONj0Ur996noanbg6aaJ6S6+I=";
+    hash = "sha256-gAHCssJC6sTR6ftkQHrtF/5Nf9dXE4ykRhVusb0Gu3I=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/gpaw/default.nix b/pkgs/development/python-modules/gpaw/default.nix
index 913f1616a07d..e359c78c66f8 100644
--- a/pkgs/development/python-modules/gpaw/default.nix
+++ b/pkgs/development/python-modules/gpaw/default.nix
@@ -74,13 +74,13 @@ let
 
 in buildPythonPackage rec {
   pname = "gpaw";
-  version = "22.8.0";
+  version = "23.9.1";
 
   src = fetchFromGitLab {
     owner = "gpaw";
     repo = pname;
     rev = version;
-    hash = "sha256-Kgf8yuGua7mcGP+jVVmbE8JCsbrfzewRTRt3ihq9YX4=";
+    hash = "sha256-9nnK4ksTFATO6HexnxfMiih/yoY/noyJZXZOaDG/2kc=";
   };
 
   # `inetutils` is required because importing `gpaw`, as part of
diff --git a/pkgs/development/python-modules/jax/default.nix b/pkgs/development/python-modules/jax/default.nix
index 9453ba1c0c6c..d9293e073480 100644
--- a/pkgs/development/python-modules/jax/default.nix
+++ b/pkgs/development/python-modules/jax/default.nix
@@ -27,17 +27,17 @@ let
 in
 buildPythonPackage rec {
   pname = "jax";
-  version = "0.4.18";
+  version = "0.4.19";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
 
   src = fetchFromGitHub {
     owner = "google";
-    repo = pname;
+    repo = "jax";
     # google/jax contains tags for jax and jaxlib. Only use jax tags!
     rev = "refs/tags/${pname}-v${version}";
-    hash = "sha256-rDvWHa8jYCAA9iKbWaFUXdE/9L7AepFiNzmqOcc/090=";
+    hash = "sha256-l5uLPqhg/hqtO9oJSaioow5cH/0jKHDVziGezkfnVcc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/jaxlib/bin.nix b/pkgs/development/python-modules/jaxlib/bin.nix
index 68a1275246aa..8b673d6040d5 100644
--- a/pkgs/development/python-modules/jaxlib/bin.nix
+++ b/pkgs/development/python-modules/jaxlib/bin.nix
@@ -39,7 +39,7 @@ in
 assert cudaSupport -> lib.versionAtLeast cudatoolkit.version "11.1" && lib.versionAtLeast cudnn.version "8.2" && stdenv.isLinux;
 
 let
-  version = "0.4.18";
+  version = "0.4.19";
 
   inherit (python) pythonVersion;
 
@@ -60,15 +60,15 @@ let
     {
       "x86_64-linux" = getSrcFromPypi {
         platform = "manylinux2014_x86_64";
-        hash = "sha256-MpNomovvSVx4N6gsowOLksTyEgTK261vSXMGxYqlVOE=";
+        hash = "sha256-ksnY+CPEstact5lKjbSg+ZSPJtSt0Y0NFWEFufBCByk=";
       };
       "aarch64-darwin" = getSrcFromPypi {
         platform = "macosx_11_0_arm64";
-        hash = "sha256-if/5O5DQVHFdsLw9O1creZBx5j8ftE7fsWMMX1NjHP0=";
+        hash = "sha256-O7dHvdKLKfNELGfF4TKy7N5EX6Ca7Zu8OtLXWvFykR8=";
       };
       "x86_64-darwin" = getSrcFromPypi {
         platform = "macosx_10_14_x86_64";
-        hash = "sha256-4NeHA/0SGdmHXyDGxpK7oJc7dE1meR4LPjzbIwxloqU=";
+        hash = "sha256-gqKMUZSXrt8sQtTAoQbzAfCzO8gM9Y1/tZpuJVWyN0Y=";
       };
     };
 
@@ -78,7 +78,7 @@ let
   # https://github.com/google/jax/issues/12879 as to why this specific URL is the correct index.
   gpuSrc = fetchurl {
     url = "https://storage.googleapis.com/jax-releases/cuda12/jaxlib-${version}+cuda12.cudnn89-cp310-cp310-manylinux2014_x86_64.whl";
-    hash = "sha256-p6BNvhhRzVDQdpEoIRau5JovC+eDjlW3bXrahtsGvmI=";
+    hash = "sha256-zfN0n31+5GohwBkeQrqHus4qOyhM/GEdqG6KUupCZ4o=";
   };
 
 in
diff --git a/pkgs/development/python-modules/jaxlib/default.nix b/pkgs/development/python-modules/jaxlib/default.nix
index 35d56ff1a1eb..d02cb0aa5dee 100644
--- a/pkgs/development/python-modules/jaxlib/default.nix
+++ b/pkgs/development/python-modules/jaxlib/default.nix
@@ -54,7 +54,7 @@ let
   inherit (cudaPackages) backendStdenv cudatoolkit cudaFlags cudnn nccl;
 
   pname = "jaxlib";
-  version = "0.4.18";
+  version = "0.4.19";
 
   meta = with lib; {
     description = "JAX is Autograd and XLA, brought together for high-performance machine learning research.";
@@ -151,7 +151,7 @@ let
       repo = "jax";
       # google/jax contains tags for jax and jaxlib. Only use jaxlib tags!
       rev = "refs/tags/${pname}-v${version}";
-      hash = "sha256-rDvWHa8jYCAA9iKbWaFUXdE/9L7AepFiNzmqOcc/090=";
+      hash = "sha256-l5uLPqhg/hqtO9oJSaioow5cH/0jKHDVziGezkfnVcc=";
     };
 
     nativeBuildInputs = [
@@ -264,10 +264,10 @@ let
       ];
 
       sha256 = (if cudaSupport then {
-        x86_64-linux = "sha256-0CfGWlwKsUFP1DHUN6+6wX3cHr5x3TE6NbqYlV5me1E=";
+        x86_64-linux = "sha256-Z5cSgdRxdKxidaz4b1RlUF4rVcQiUTmQ1OorlBWlpt0=";
       } else {
-        x86_64-linux = "sha256-sljmyIligXC7d9fdlpqR32xyMR0UslWs04gXJBD8FTA=";
-        aarch64-linux = "sha256-eJ4KIkHdcA2EVvyBoNum2cOPcHPFoBOtUTAGufO8FJA=";
+        x86_64-linux = "sha256-sn7p8FFHWIVdBWnsLsVj5jLiSaTlRm7s/qj2RqvQ3jU=";
+        aarch64-linux = "sha256-oAYF5AeuPHTlwtpDMs2+tAhRAJH0yeSVnB7Ni7wmzS8=";
       }).${stdenv.system} or (throw "jaxlib: unsupported system: ${stdenv.system}");
     };
 
diff --git a/pkgs/development/python-modules/logilab/common.nix b/pkgs/development/python-modules/logilab/common.nix
index 9467f003c703..b03fd98eefe8 100644
--- a/pkgs/development/python-modules/logilab/common.nix
+++ b/pkgs/development/python-modules/logilab/common.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "logilab-common";
-  version = "1.10.0";
+  version = "1.11.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-MoXt3tta5OimJUjOkWSMDCmXV0aS8N0W5bcANwAelYY=";
+    hash = "sha256-lWl6654nbOBCec24iJ7GGKEcYy/gYDn9wMil3PPqWkk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/lsprotocol/default.nix b/pkgs/development/python-modules/lsprotocol/default.nix
index a2e17eb40042..5ee4d3ed1126 100644
--- a/pkgs/development/python-modules/lsprotocol/default.nix
+++ b/pkgs/development/python-modules/lsprotocol/default.nix
@@ -4,6 +4,7 @@
 , cattrs
 , fetchFromGitHub
 , flit-core
+, importlib-resources
 , jsonschema
 , nox
 , pyhamcrest
@@ -13,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "lsprotocol";
-  version = "2023.0.0a2";
+  version = "2023.0.0b1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -22,7 +23,7 @@ buildPythonPackage rec {
     owner = "microsoft";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-AEvs2fb8nhWEFMyLvwNv9HoxxxE50/KW3TGZ5pDf4dc=";
+    hash = "sha256-Y/Mp/8MskRB6irNU3CBOKmo2Zt5S69h+GyMg71sQ9Uw=";
   };
 
   nativeBuildInputs = [
@@ -40,6 +41,7 @@ buildPythonPackage rec {
   ];
 
   checkInputs = [
+    importlib-resources
     jsonschema
     pyhamcrest
   ];
diff --git a/pkgs/development/python-modules/num2words/default.nix b/pkgs/development/python-modules/num2words/default.nix
index 82ba5a8cec10..c43cb81eb2fc 100644
--- a/pkgs/development/python-modules/num2words/default.nix
+++ b/pkgs/development/python-modules/num2words/default.nix
@@ -7,12 +7,12 @@
 }:
 
 buildPythonPackage rec {
-  version = "0.5.12";
+  version = "0.5.13";
   pname = "num2words";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-fnwLDwgEBao6HdnTKxypCzvwO6sXuOVNsF4beDAaCYg=";
+    hash = "sha256-owZHFvu/kNdcRJRQzr+8c6ahPmOyUx0JvezDqxoiCc8=";
   };
 
   propagatedBuildInputs = [ docopt ];
diff --git a/pkgs/development/python-modules/opsdroid_get_image_size/default.nix b/pkgs/development/python-modules/opsdroid-get-image-size/default.nix
index 0f33da44145f..edd09d2750e2 100644
--- a/pkgs/development/python-modules/opsdroid_get_image_size/default.nix
+++ b/pkgs/development/python-modules/opsdroid-get-image-size/default.nix
@@ -1,15 +1,24 @@
-{ lib, buildPythonPackage, fetchPypi
+{ lib
+, buildPythonPackage
+, fetchPypi
+, setuptools
 }:
 
 buildPythonPackage rec {
-  pname = "opsdroid_get_image_size";
+  pname = "opsdroid-get-image-size";
   version = "0.2.2";
+  pyproject = true;
 
   src = fetchPypi {
-    inherit pname version;
-    sha256 = "124j2xvfxv09q42qfb8nqlcn55y7f09iayrix3yfyrs2qyzav78a";
+    pname = "opsdroid_get_image_size";
+    inherit version;
+    hash = "sha256-Cp2tvsdCZ+/86DF7FRNwx5diGcUWLYcFwQns7nYXkog=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   # test data not included on pypi
   doCheck = false;
 
diff --git a/pkgs/development/python-modules/optuna/default.nix b/pkgs/development/python-modules/optuna/default.nix
index f3b41af02096..7a3b3cca06b0 100644
--- a/pkgs/development/python-modules/optuna/default.nix
+++ b/pkgs/development/python-modules/optuna/default.nix
@@ -13,6 +13,7 @@
 , distributed
 , fakeredis
 , fastai
+, google-cloud-storage
 , lightgbm
 , matplotlib
 , mlflow
@@ -43,7 +44,7 @@
 
 buildPythonPackage rec {
   pname = "optuna";
-  version = "3.3.0";
+  version = "3.4.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -52,7 +53,7 @@ buildPythonPackage rec {
     owner = "optuna";
     repo = "optuna";
     rev = "refs/tags/v${version}";
-    hash = "sha256-uHv8uEJOQO1+AeNSxBtnCt6gDQHLT1RToF4hfolVVX0=";
+    hash = "sha256-WUjO13NxX0FneOPS4nn6aHq48X95r+GJR/Oxir6n8Pk=";
   };
 
   nativeBuildInputs = [
@@ -62,7 +63,6 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     alembic
-    cmaes
     colorlog
     numpy
     packaging
@@ -96,6 +96,8 @@ buildPythonPackage rec {
     optional = [
       boto3
       botorch
+      cmaes
+      google-cloud-storage
       matplotlib
       pandas
       plotly
diff --git a/pkgs/development/python-modules/osmnx/default.nix b/pkgs/development/python-modules/osmnx/default.nix
index fec12037e20b..fec12037e20b 100755..100644
--- a/pkgs/development/python-modules/osmnx/default.nix
+++ b/pkgs/development/python-modules/osmnx/default.nix
diff --git a/pkgs/development/python-modules/periodiq/default.nix b/pkgs/development/python-modules/periodiq/default.nix
new file mode 100644
index 000000000000..5ed6a028aa38
--- /dev/null
+++ b/pkgs/development/python-modules/periodiq/default.nix
@@ -0,0 +1,55 @@
+{ lib
+, buildPythonPackage
+, pythonOlder
+, fetchFromGitLab
+, poetry-core
+, dramatiq
+, pendulum
+, setuptools
+, pytest-mock
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "periodiq";
+  version = "0.12.1";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.5";
+
+  src = fetchFromGitLab {
+    owner = "bersace";
+    repo = "periodiq";
+    rev = "v${version}";
+    hash = "sha256-Ar0n+Wi1OUtRdhVxrU7Nz4je8ylaHgPZbXE0a30hzU0=";
+  };
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace 'poetry>=0.12' 'poetry-core' \
+      --replace 'poetry.masonry.api' 'poetry.core.masonry.api'
+  '';
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    dramatiq
+    pendulum
+    setuptools
+  ];
+
+  nativeCheckInputs = [ pytestCheckHook pytest-mock ];
+
+  pytestFlagsArray = [ "tests/unit" ];
+
+  pythonImportsCheck = [ "periodiq" ];
+
+  meta = with lib; {
+    description = "Simple Scheduler for Dramatiq Task Queue";
+    homepage = "https://pypi.org/project/periodiq/";
+    license = licenses.lgpl3Only;
+    maintainers = with maintainers; [ traxys ];
+  };
+}
diff --git a/pkgs/development/python-modules/persim/default.nix b/pkgs/development/python-modules/persim/default.nix
index 09feb66549a4..869fb6146f2e 100644
--- a/pkgs/development/python-modules/persim/default.nix
+++ b/pkgs/development/python-modules/persim/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "persim";
-  version = "0.3.1";
+  version = "0.3.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-7w8KJHrc9hBOysFBF9sLJFgXEOqKjZZIFoBTlXALSXU=";
+    hash = "sha256-p6Vumfr+vRDr0D9PnEZItp9vNlCLIb59HpBg1KdyHGE=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/polars/default.nix b/pkgs/development/python-modules/polars/default.nix
index b070ae37978f..ccd6f2b79ba9 100644
--- a/pkgs/development/python-modules/polars/default.nix
+++ b/pkgs/development/python-modules/polars/default.nix
@@ -6,6 +6,7 @@
 , libiconv
 , fetchFromGitHub
 , typing-extensions
+, rust-jemalloc-sys
 , darwin
 }:
 let
@@ -49,7 +50,9 @@ buildPythonPackage {
 
   nativeBuildInputs = with rustPlatform; [ cargoSetupHook maturinBuildHook ];
 
-  buildInputs = lib.optionals stdenv.isDarwin [
+  buildInputs = [
+    rust-jemalloc-sys
+  ] ++ lib.optionals stdenv.isDarwin [
     libiconv
     darwin.apple_sdk.frameworks.Security
   ];
diff --git a/pkgs/development/python-modules/publicsuffixlist/default.nix b/pkgs/development/python-modules/publicsuffixlist/default.nix
index 47bca9e9311e..1b0745990ec5 100644
--- a/pkgs/development/python-modules/publicsuffixlist/default.nix
+++ b/pkgs/development/python-modules/publicsuffixlist/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "publicsuffixlist";
-  version = "0.10.0.20231002";
+  version = "0.10.0.20231020";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-qO8/V0UZb9lWvPb0JbUABFCJbGFu5ulRMOFH4vrhDMw=";
+    hash = "sha256-5Woh5xWIVvVvgmp4xtpU51rXSCZDH0ljPpLpkvFmO+8=";
   };
 
   passthru.optional-dependencies = {
diff --git a/pkgs/development/python-modules/pydiscovergy/default.nix b/pkgs/development/python-modules/pydiscovergy/default.nix
index d5cdb74b7671..3c87b6b6f3a1 100644
--- a/pkgs/development/python-modules/pydiscovergy/default.nix
+++ b/pkgs/development/python-modules/pydiscovergy/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "pydiscovergy";
-  version = "2.0.4";
+  version = "2.0.5";
   format = "pyproject";
 
   disabled = pythonOlder "3.10";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "jpbede";
     repo = "pydiscovergy";
     rev = "refs/tags/${version}";
-    hash = "sha256-yHACEo5481BZVqqEj8WeuIpSWAfBqnmRdOWRPH5RuHQ=";
+    hash = "sha256-u2G+o/vhPri7CPSnekC8rUo/AvuvePpG51MR+FdH2XA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pytensor/default.nix b/pkgs/development/python-modules/pytensor/default.nix
index dcb41604102f..06d0dffb2468 100644
--- a/pkgs/development/python-modules/pytensor/default.nix
+++ b/pkgs/development/python-modules/pytensor/default.nix
@@ -26,7 +26,7 @@
 
 buildPythonPackage rec {
   pname = "pytensor";
-  version = "2.17.2";
+  version = "2.17.3";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -35,7 +35,7 @@ buildPythonPackage rec {
     owner = "pymc-devs";
     repo = "pytensor";
     rev = "refs/tags/rel-${version}";
-    hash = "sha256-u1CbOjU3rQ6G3SSwYR3UlebymkupGMJWID4RH4v9PIk=";
+    hash = "sha256-FufPCFzSjG8BrHes7t3XsdovX9gqUBG0gMDGKvkRkSA=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pyyardian/default.nix b/pkgs/development/python-modules/pyyardian/default.nix
index 63318cbfcaef..0216d562faea 100644
--- a/pkgs/development/python-modules/pyyardian/default.nix
+++ b/pkgs/development/python-modules/pyyardian/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "pyyardian";
-  version = "1.1.1";
+  version = "1.2.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "h3l1o5";
     repo = "pyyardian";
     rev = "refs/tags/${version}";
-    hash = "sha256-dnHHRGt3TsWJb6tzx+i1gb9hkLJYPVdCt92UGKuO6Mg=";
+    hash = "sha256-JBb62pFDuVcXIGRc6UOp5/ciUtbGm4XnKZjt1icF/jQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/recaptcha_client/default.nix b/pkgs/development/python-modules/recaptcha_client/default.nix
deleted file mode 100644
index dce24cfa7a8f..000000000000
--- a/pkgs/development/python-modules/recaptcha_client/default.nix
+++ /dev/null
@@ -1,23 +0,0 @@
-{ lib
-, buildPythonPackage
-, fetchPypi
-, pythonAtLeast
-}:
-
-buildPythonPackage rec {
-  pname = "recaptcha-client";
-  version = "1.0.6";
-  disabled = pythonAtLeast "3.5";
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "28c6853c1d13d365b7dc71a6b05e5ffb56471f70a850de318af50d3d7c0dea2f";
-  };
-
-  meta = with lib; {
-    description = "A CAPTCHA for Python using the reCAPTCHA service";
-    homepage = "http://recaptcha.net/";
-    license = licenses.mit;
-  };
-
-}
diff --git a/pkgs/development/python-modules/rtree/default.nix b/pkgs/development/python-modules/rtree/default.nix
index 7d4e14196314..0de516ec85f0 100644
--- a/pkgs/development/python-modules/rtree/default.nix
+++ b/pkgs/development/python-modules/rtree/default.nix
@@ -10,13 +10,13 @@
 
 buildPythonPackage rec {
   pname = "rtree";
-  version = "1.0.1";
+  version = "1.1.0";
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     pname = "Rtree";
     inherit version;
-    hash = "sha256-IiEhaZwwOmQGXYSb9wOLHsq8N7Zcf6NAvts47w6AVCk=";
+    hash = "sha256-b47lBN3l0AWyWwiq9b4LNASvOtX+zm4d3N41kIp5ipU=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/sphinx_pypi_upload/default.nix b/pkgs/development/python-modules/sphinx_pypi_upload/default.nix
deleted file mode 100644
index d2c20e980e7a..000000000000
--- a/pkgs/development/python-modules/sphinx_pypi_upload/default.nix
+++ /dev/null
@@ -1,21 +0,0 @@
-{ lib
-, buildPythonPackage
-, fetchPypi
-}:
-
-buildPythonPackage rec {
-  pname = "Sphinx-PyPI-upload";
-  version = "0.2.1";
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "5f919a47ce7a7e6028dba809de81ae1297ac192347cf6fc54efca919d4865159";
-  };
-
-  meta = with lib; {
-    description = "Setuptools command for uploading Sphinx documentation to PyPI";
-    homepage = "https://bitbucket.org/jezdez/sphinx-pypi-upload/";
-    license = licenses.bsd0;
-  };
-
-}
diff --git a/pkgs/development/python-modules/staticmap/default.nix b/pkgs/development/python-modules/staticmap/default.nix
new file mode 100644
index 000000000000..bb3eac8655bd
--- /dev/null
+++ b/pkgs/development/python-modules/staticmap/default.nix
@@ -0,0 +1,31 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pillow
+, requests
+}:
+
+buildPythonPackage rec {
+  pname = "staticmap";
+  version = "0.5.7";
+  format = "setuptools";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-x6lrkCumEpLoGMILCBBhnWuBps21C8wauS1QrE2yCn8=";
+  };
+
+  propagatedBuildInputs = [ requests pillow ];
+
+  pythonImportsCheck = [ "staticmap" ];
+
+  # Tests seem to be broken
+  doCheck = false;
+
+  meta = with lib; {
+    description = "A small, python-based library for creating map images with lines and markers";
+    homepage = "https://pypi.org/project/staticmap/";
+    license = with licenses; [ asl20 ];
+    maintainers = with maintainers; [ traxys ];
+  };
+}
diff --git a/pkgs/development/python-modules/streamlit/default.nix b/pkgs/development/python-modules/streamlit/default.nix
index b764d9573451..b764d9573451 100755..100644
--- a/pkgs/development/python-modules/streamlit/default.nix
+++ b/pkgs/development/python-modules/streamlit/default.nix
diff --git a/pkgs/development/python-modules/twilio/default.nix b/pkgs/development/python-modules/twilio/default.nix
index d342c3d330c6..e12271c48645 100644
--- a/pkgs/development/python-modules/twilio/default.nix
+++ b/pkgs/development/python-modules/twilio/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "twilio";
-  version = "8.9.1";
+  version = "8.10.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "twilio";
     repo = "twilio-python";
     rev = "refs/tags/${version}";
-    hash = "sha256-F+0nYZIvZVH0QuEkuiV2lwA62r6T/amWFWg7rfBqddU=";
+    hash = "sha256-1y9kETu2E7dN7fmE0qP6yAVwMcVGCYnyPQYzIIApKjU=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/universal-pathlib/default.nix b/pkgs/development/python-modules/universal-pathlib/default.nix
index 966e9c459d86..23667d02c283 100644
--- a/pkgs/development/python-modules/universal-pathlib/default.nix
+++ b/pkgs/development/python-modules/universal-pathlib/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "universal-pathlib";
-  version = "0.1.3";
+  version = "0.1.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "universal_pathlib";
     inherit version;
-    hash = "sha256-GgUqteBRcwHfZr5lF+n+Y82fwAgT5c5xpzcBRBrCtcg=";
+    hash = "sha256-guXYbRaifg6hrcfYisvLqdAtWkVIgWMXT5bZrCidsuQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/vehicle/default.nix b/pkgs/development/python-modules/vehicle/default.nix
index e1d4531719b4..a233b51773ac 100644
--- a/pkgs/development/python-modules/vehicle/default.nix
+++ b/pkgs/development/python-modules/vehicle/default.nix
@@ -13,16 +13,16 @@
 
 buildPythonPackage rec {
   pname = "vehicle";
-  version = "1.0.1";
+  version = "2.0.0";
   format = "pyproject";
 
-  disabled = pythonOlder "3.10";
+  disabled = pythonOlder "3.11";
 
   src = fetchFromGitHub {
     owner = "frenck";
     repo = "python-vehicle";
     rev = "refs/tags/v${version}";
-    hash = "sha256-nN7efkN59FCCjCk3svYCTGGdvr2RSM5VektuUkHy3Vo=";
+    hash = "sha256-EbjrAfbqVY336RHBWq81KM+oHixen+38aUTnWZQ+nCs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/watchdog-gevent/default.nix b/pkgs/development/python-modules/watchdog-gevent/default.nix
new file mode 100644
index 000000000000..e1b812b9612f
--- /dev/null
+++ b/pkgs/development/python-modules/watchdog-gevent/default.nix
@@ -0,0 +1,40 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, gevent
+, pytestCheckHook
+, watchdog
+}:
+
+buildPythonPackage rec {
+  pname = "watchdog-gevent";
+  version = "0.1.1";
+  format = "setuptools";
+
+  # Need to fetch from github because tests are not present in pypi
+  src = fetchFromGitHub {
+    owner = "Bogdanp";
+    repo = "watchdog_gevent";
+    rev = "v${version}";
+    hash = "sha256-FESm3fNuLmOg2ilI/x8U9LuAimHLnahcTHYzW/nzOVY=";
+  };
+
+  propagatedBuildInputs = [ watchdog gevent ];
+
+  postPatch = ''
+    sed -i setup.cfg \
+      -e 's:--cov watchdog_gevent::' \
+      -e 's:--cov-report html::'
+  '';
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "watchdog_gevent" ];
+
+  meta = with lib; {
+    description = "A gevent-based observer for watchdog";
+    homepage = "https://github.com/Bogdanp/watchdog_gevent";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ traxys ];
+  };
+}
diff --git a/pkgs/development/python-modules/zope-lifecycleevent/default.nix b/pkgs/development/python-modules/zope-lifecycleevent/default.nix
new file mode 100644
index 000000000000..fc6b0005ffac
--- /dev/null
+++ b/pkgs/development/python-modules/zope-lifecycleevent/default.nix
@@ -0,0 +1,44 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pythonOlder
+, setuptools
+, zope_event
+, zope_interface
+}:
+
+buildPythonPackage rec {
+  pname = "zope-lifecycleevent";
+  version = "5.0";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchPypi {
+    pname = "zope.lifecycleevent";
+    inherit version;
+    hash = "sha256-6tP7SW52FPm1adFtrUt4BSsKwhh1utjWbKNQNS2bb50=";
+  };
+
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  propagatedBuildInputs = [ zope_event zope_interface ];
+
+  # namespace colides with local directory
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "zope.lifecycleevent"
+    "zope.interface"
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/zopefoundation/zope.lifecycleevent";
+    description = "Object life-cycle events";
+    changelog = "https://github.com/zopefoundation/zope.lifecycleevent/blob/${version}/CHANGES.rst";
+    license = licenses.zpl21;
+    maintainers = with maintainers; [ goibhniu ];
+  };
+}
diff --git a/pkgs/development/python-modules/zope_lifecycleevent/default.nix b/pkgs/development/python-modules/zope_lifecycleevent/default.nix
deleted file mode 100644
index 807deb097feb..000000000000
--- a/pkgs/development/python-modules/zope_lifecycleevent/default.nix
+++ /dev/null
@@ -1,36 +0,0 @@
-{ lib
-, buildPythonPackage
-, fetchPypi
-, isPy3k
-, zope_event
-, zope-component
-}:
-
-buildPythonPackage rec {
-  pname = "zope.lifecycleevent";
-  version = "4.4";
-
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-9ahU6J/5fe6ke/vqN4u77yeJ0uDMkKHB2lfZChzmfLU=";
-  };
-
-  propagatedBuildInputs = [ zope_event zope-component ];
-
-  # namespace colides with local directory
-  doCheck = false;
-
-  # zope uses pep 420 namespaces for python3, doesn't work with nix + python2
-  pythonImportsCheck = lib.optionals isPy3k [
-    "zope.lifecycleevent"
-    "zope.interface"
-  ];
-
-  meta = with lib; {
-    homepage = "https://github.com/zopefoundation/zope.lifecycleevent";
-    description = "Object life-cycle events";
-    license = licenses.zpl20;
-    maintainers = with maintainers; [ goibhniu ];
-  };
-
-}
diff --git a/pkgs/development/python-modules/zstandard/default.nix b/pkgs/development/python-modules/zstandard/default.nix
index 2da5ae524bb3..2da5ae524bb3 100755..100644
--- a/pkgs/development/python-modules/zstandard/default.nix
+++ b/pkgs/development/python-modules/zstandard/default.nix
diff --git a/pkgs/development/tools/buildkit/default.nix b/pkgs/development/tools/buildkit/default.nix
index 6787ca6b07dd..41843024a515 100644
--- a/pkgs/development/tools/buildkit/default.nix
+++ b/pkgs/development/tools/buildkit/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "buildkit";
-  version = "0.12.2";
+  version = "0.12.3";
 
   src = fetchFromGitHub {
     owner = "moby";
     repo = "buildkit";
     rev = "v${version}";
-    hash = "sha256-u85Yrg3aMG6Tx8onivSy1p7yB4lZxsBWF4bxnwO68EE=";
+    hash = "sha256-ph44J90g5zOTi/+FVbdnDDJp1gXcxPt7coA1rvhsQSQ=";
   };
 
   vendorHash = null;
diff --git a/pkgs/development/tools/continuous-integration/jenkins/default.nix b/pkgs/development/tools/continuous-integration/jenkins/default.nix
index c90845ddcd73..aa4de161d9ce 100644
--- a/pkgs/development/tools/continuous-integration/jenkins/default.nix
+++ b/pkgs/development/tools/continuous-integration/jenkins/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "jenkins";
-  version = "2.414.2";
+  version = "2.414.3";
 
   src = fetchurl {
     url = "https://get.jenkins.io/war-stable/${version}/jenkins.war";
-    hash = "sha256-kiu/Ymn92tYUu2VAJB7QzlUjpKUyginhX157t//VZbg=";
+    hash = "sha256-LZMlS8GG3zSbxK0GtrHddXxJMZDwVY0RHb2pUXqEe1k=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/development/tools/electron/binary/generic.nix b/pkgs/development/tools/electron/binary/generic.nix
index f7e8f6461a4c..cbd908098965 100644
--- a/pkgs/development/tools/electron/binary/generic.nix
+++ b/pkgs/development/tools/electron/binary/generic.nix
@@ -24,6 +24,7 @@
 , xorg
 , pango
 , systemd
+, pciutils
 }:
 
 version: hashes:
@@ -92,6 +93,7 @@ let
     xorg.libXrandr
     xorg.libxkbfile
     pango
+    pciutils
     stdenv.cc.cc.lib
     systemd
   ]
diff --git a/pkgs/development/tools/kustomize/default.nix b/pkgs/development/tools/kustomize/default.nix
index 6f62f7d86c92..a8e90fc7b036 100644
--- a/pkgs/development/tools/kustomize/default.nix
+++ b/pkgs/development/tools/kustomize/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "kustomize";
-  version = "5.1.1";
+  version = "5.2.1";
 
   ldflags = let t = "sigs.k8s.io/kustomize/api/provenance"; in
     [
@@ -15,13 +15,13 @@ buildGoModule rec {
     owner = "kubernetes-sigs";
     repo = pname;
     rev = "kustomize/v${version}";
-    hash = "sha256-XtpMws2o3h19PsRJXKg+y5/Zk3bc6mJ4O1LLZ40ioTM=";
+    hash = "sha256-NuDg9Vtfxddosi8J7p6+WI2jDM2k16gbWsQcZF27vJo=";
   };
 
   # avoid finding test and development commands
   modRoot = "kustomize";
   proxyVendor = true;
-  vendorHash = "sha256-/XyxZHhlxD0CpaDAuJbLkOHysLXo1+ThTcexqtNdVIs=";
+  vendorHash = "sha256-pA0B4CA5RXyo2GTyk9Xa/unpU46gnLI6ulCY5vTLTvA=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/development/tools/misc/runme/default.nix b/pkgs/development/tools/misc/runme/default.nix
index 67a69db81426..3795476c3e16 100644
--- a/pkgs/development/tools/misc/runme/default.nix
+++ b/pkgs/development/tools/misc/runme/default.nix
@@ -12,7 +12,7 @@
 
 buildGo121Module rec {
   pname = "runme";
-  version = "1.7.7";
+  version = "1.7.8";
 
   src = fetchFromGitHub {
     owner = "stateful";
diff --git a/pkgs/development/tools/misc/slint-lsp/default.nix b/pkgs/development/tools/misc/slint-lsp/default.nix
index 028f2f8d5029..0eb55d14c005 100644
--- a/pkgs/development/tools/misc/slint-lsp/default.nix
+++ b/pkgs/development/tools/misc/slint-lsp/default.nix
@@ -25,14 +25,14 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "slint-lsp";
-  version = "1.1.1";
+  version = "1.2.2";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-ENv17Az6yzUwD39HDfoD7Bmvs6LHjVp85PaYkTw6jW0=";
+    sha256 = "sha256-+1nuezax7aV9b+L11zzIouA8QEWduqBzPiT6jvCGMac=";
   };
 
-  cargoHash = "sha256-wL46QhY3Cq2KFLETPRhUWb77o1vNrRA2w1NBAtBc0yo=";
+  cargoHash = "sha256-o7HDhNtjA0/JybJCiEejR8PcRIdJim+/wq4q8xj9A5Q=";
 
   nativeBuildInputs = [ cmake pkg-config fontconfig ];
   buildInputs = rpathLibs ++ [ xorg.libxcb.dev ]
diff --git a/pkgs/development/tools/mold/default.nix b/pkgs/development/tools/mold/default.nix
index 530fbb1666c7..fadbe57a5690 100644
--- a/pkgs/development/tools/mold/default.nix
+++ b/pkgs/development/tools/mold/default.nix
@@ -23,13 +23,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mold";
-  version = "2.3.0";
+  version = "2.3.1";
 
   src = fetchFromGitHub {
     owner = "rui314";
     repo = "mold";
     rev = "v${version}";
-    hash = "sha256-TgDGAYdJjqGQradB7UJlV2emvG7q4F9ctzPaGRUgvxU=";
+    hash = "sha256-SahpgmkeGVXqQebtw36IjFwHcbvi0JeiEWkNV3hk3lM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/poetry2nix/poetry2nix/overrides/build-systems.json b/pkgs/development/tools/poetry2nix/poetry2nix/overrides/build-systems.json
index 04174d1c4354..2e859c6ddbf5 100644
--- a/pkgs/development/tools/poetry2nix/poetry2nix/overrides/build-systems.json
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/overrides/build-systems.json
@@ -2732,6 +2732,9 @@
   "certbot-dns-inwx": [
     "setuptools"
   ],
+  "certbot-dns-ovh": [
+    "setuptools"
+  ],
   "certbot-dns-rfc2136": [
     "setuptools"
   ],
diff --git a/pkgs/development/tools/railway/default.nix b/pkgs/development/tools/railway/default.nix
index 1d075250a415..688a475a1403 100644
--- a/pkgs/development/tools/railway/default.nix
+++ b/pkgs/development/tools/railway/default.nix
@@ -3,16 +3,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "railway";
-  version = "3.4.0";
+  version = "3.5.0";
 
   src = fetchFromGitHub {
     owner = "railwayapp";
     repo = "cli";
     rev = "v${version}";
-    hash = "sha256-pydnIUqUBMLHonEGcvB+K+48QQYQuFfZxbAETJjU+3o=";
+    hash = "sha256-I32DC0hzVM/LCSqS878sZd+UYZ0NfBuzBgd9Aed/Sq0=";
   };
 
-  cargoHash = "sha256-VgLQfUk1xeAwr9KUo1Vz4Ndw0FAnYGw3af0v3ueNPuA=";
+  cargoHash = "sha256-CYy0YEWK9sHAr0yFIH9yzxPnzG6x/EcE8ZLkueYgSiE=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/development/tools/ruff/default.nix b/pkgs/development/tools/ruff/default.nix
index b7c5ab87a644..8b42bfbe85c5 100644
--- a/pkgs/development/tools/ruff/default.nix
+++ b/pkgs/development/tools/ruff/default.nix
@@ -4,6 +4,7 @@
 , installShellFiles
 , stdenv
 , darwin
+, rust-jemalloc-sys
   # tests
 , ruff-lsp
 }:
@@ -31,19 +32,15 @@ rustPlatform.buildRustPackage rec {
     installShellFiles
   ];
 
-  buildInputs = lib.optionals stdenv.isDarwin [
+  buildInputs = [
+    rust-jemalloc-sys
+  ] ++ lib.optionals stdenv.isDarwin [
     darwin.apple_sdk.frameworks.CoreServices
   ];
 
   cargoBuildFlags = [ "--package=ruff_cli" ];
   cargoTestFlags = cargoBuildFlags;
 
-  preBuild = lib.optionalString (stdenv.isDarwin && stdenv.isx86_64) ''
-    # See https://github.com/jemalloc/jemalloc/issues/1997
-    # Using a value of 48 should work on both emulated and native x86_64-darwin.
-    export JEMALLOC_SYS_WITH_LG_VADDR=48
-  '';
-
   # tests expect no colors
   preCheck = ''
     export NO_COLOR=1
diff --git a/pkgs/development/tools/symfony-cli/default.nix b/pkgs/development/tools/symfony-cli/default.nix
index d626027ee186..4f7dd010b844 100644
--- a/pkgs/development/tools/symfony-cli/default.nix
+++ b/pkgs/development/tools/symfony-cli/default.nix
@@ -2,14 +2,14 @@
 
 buildGoModule rec {
   pname = "symfony-cli";
-  version = "5.5.10";
-  vendorHash = "sha256-eeVi/O4p7bF4CPqJBCpLfx1Yc5vZZ3b8RV5ERcIL8H4=";
+  version = "5.6.0";
+  vendorHash = "sha256-1BqgnWFMk8hWwra75a5o6Rwbj5wiCUIdSnsAcB+7Mno=";
 
   src = fetchFromGitHub {
     owner = "symfony-cli";
     repo = "symfony-cli";
     rev = "v${version}";
-    hash = "sha256-n0R+J41lJYxswMnknYAAEKwwIqOremZF73cRBYfD3CE=";
+    hash = "sha256-AtHRuzpKXp+WlFser0J5MR63rbO0xO4N/L3U0Q3iax8=";
   };
 
   ldflags = [
diff --git a/pkgs/development/web/nodejs/v21.nix b/pkgs/development/web/nodejs/v21.nix
new file mode 100644
index 000000000000..6d59e20dfa5f
--- /dev/null
+++ b/pkgs/development/web/nodejs/v21.nix
@@ -0,0 +1,19 @@
+{ callPackage, openssl, python3, enableNpm ? true }:
+
+let
+  buildNodejs = callPackage ./nodejs.nix {
+    inherit openssl;
+    python = python3;
+  };
+in
+buildNodejs {
+  inherit enableNpm;
+  version = "21.0.0";
+  sha256 = "sha256-vFYZK5Ua0YNQbcqaz3pNDAJZEUC3/I8lZhN1GZJm8/I=";
+  patches = [
+    ./revert-arm64-pointer-auth.patch
+    ./disable-darwin-v8-system-instrumentation-node19.patch
+    ./bypass-darwin-xcrun-node16.patch
+    ./node-npm-build-npm-package-logic.patch
+  ];
+}
diff --git a/pkgs/misc/uq/default.nix b/pkgs/misc/uq/default.nix
index 81c09685be8b..81c09685be8b 100755..100644
--- a/pkgs/misc/uq/default.nix
+++ b/pkgs/misc/uq/default.nix
diff --git a/pkgs/os-specific/linux/cpufrequtils/default.nix b/pkgs/os-specific/linux/cpufrequtils/default.nix
index d64996c4961e..f62d8463714e 100644
--- a/pkgs/os-specific/linux/cpufrequtils/default.nix
+++ b/pkgs/os-specific/linux/cpufrequtils/default.nix
@@ -6,7 +6,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "http://ftp.be.debian.org/pub/linux/utils/kernel/cpufreq/cpufrequtils-${version}.tar.gz";
-    sha256 = "127i38d4w1hv2dzdy756gmbhq25q3k34nqb2s0xlhsfhhdqs0lq0";
+    hash = "sha256-AFOgcYPQaUg70GJhS8YcuAgMV32mHN9+ExsGThoa8Yg=";
   };
 
   patches = [
@@ -27,5 +27,6 @@ stdenv.mkDerivation rec {
     homepage = "http://ftp.be.debian.org/pub/linux/utils/kernel/cpufreq/cpufrequtils.html";
     license = licenses.gpl2Only;
     platforms = [ "x86_64-linux" ];
+    mainProgram = "cpufreq-set";
   };
 }
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index 038a3105a182..ceb34fe0c76f 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -146,7 +146,7 @@ let
     scheduler = {
       IOSCHED_CFQ = whenOlder "5.0" yes; # Removed in 5.0-RC1
       BLK_CGROUP  = yes; # required by CFQ"
-      BLK_CGROUP_IOLATENCY = whenAtLeast "4.19" yes;
+      BLK_CGROUP_IOLATENCY = yes;
       BLK_CGROUP_IOCOST = whenAtLeast "5.4" yes;
       IOSCHED_DEADLINE = whenOlder "5.0" yes; # Removed in 5.0-RC1
       MQ_IOSCHED_DEADLINE = yes;
@@ -183,8 +183,8 @@ let
       BPF_JIT            = whenPlatformHasEBPFJit yes;
       BPF_JIT_ALWAYS_ON  = whenPlatformHasEBPFJit no; # whenPlatformHasEBPFJit yes; # see https://github.com/NixOS/nixpkgs/issues/79304
       HAVE_EBPF_JIT      = whenPlatformHasEBPFJit yes;
-      BPF_STREAM_PARSER  = whenAtLeast "4.19" yes;
-      XDP_SOCKETS        = whenAtLeast "4.19" yes;
+      BPF_STREAM_PARSER  = yes;
+      XDP_SOCKETS        = yes;
       XDP_SOCKETS_DIAG   = whenAtLeast "5.1" yes;
       WAN                = yes;
       TCP_CONG_ADVANCED  = yes;
@@ -208,7 +208,7 @@ let
       IPV6_FOU_TUNNEL             = module;
       IPV6_SEG6_LWTUNNEL          = yes;
       IPV6_SEG6_HMAC              = yes;
-      IPV6_SEG6_BPF               = whenAtLeast "4.18" yes;
+      IPV6_SEG6_BPF               = yes;
       NET_CLS_BPF                 = module;
       NET_ACT_BPF                 = module;
       NET_SCHED                   = yes;
@@ -237,22 +237,17 @@ let
       NF_CONNTRACK_TIMEOUT        = yes;
       NF_CONNTRACK_TIMESTAMP      = yes;
       NETFILTER_NETLINK_GLUE_CT   = yes;
-      NF_TABLES_INET              = mkMerge [ (whenOlder "4.17" module)
-                                              (whenAtLeast "4.17" yes) ];
-      NF_TABLES_NETDEV            = mkMerge [ (whenOlder "4.17" module)
-                                              (whenAtLeast "4.17" yes) ];
+      NF_TABLES_INET              = yes;
+      NF_TABLES_NETDEV            = yes;
       NFT_REJECT_NETDEV           = whenAtLeast "5.11" module;
 
       # IP: Netfilter Configuration
-      NF_TABLES_IPV4              = mkMerge [ (whenOlder "4.17" module)
-                                              (whenAtLeast "4.17" yes) ];
-      NF_TABLES_ARP               = mkMerge [ (whenOlder "4.17" module)
-                                              (whenAtLeast "4.17" yes) ];
+      NF_TABLES_IPV4              = yes;
+      NF_TABLES_ARP               = yes;
       # IPv6: Netfilter Configuration
-      NF_TABLES_IPV6              = mkMerge [ (whenOlder "4.17" module)
-                                              (whenAtLeast "4.17" yes) ];
+      NF_TABLES_IPV6              = yes;
       # Bridge Netfilter Configuration
-      NF_TABLES_BRIDGE            = mkMerge [ (whenBetween "4.19" "5.3" yes)
+      NF_TABLES_BRIDGE            = mkMerge [ (whenOlder "5.3" yes)
                                               (whenAtLeast "5.3" module) ];
 
       # needed for `dropwatch`
@@ -274,7 +269,7 @@ let
 
       # Kernel TLS
       TLS         = module;
-      TLS_DEVICE  = whenAtLeast "4.18" yes;
+      TLS_DEVICE  = yes;
 
       # infiniband
       INFINIBAND = module;
@@ -323,7 +318,7 @@ let
       FB_3DFX_ACCEL       = yes;
       FB_VESA             = yes;
       FRAMEBUFFER_CONSOLE = yes;
-      FRAMEBUFFER_CONSOLE_DEFERRED_TAKEOVER = whenAtLeast "4.19" yes;
+      FRAMEBUFFER_CONSOLE_DEFERRED_TAKEOVER = yes;
       FRAMEBUFFER_CONSOLE_ROTATION = yes;
       FB_GEODE            = mkIf (stdenv.hostPlatform.system == "i686-linux") yes;
       # On 5.14 this conflicts with FB_SIMPLE.
@@ -357,8 +352,7 @@ let
       # Allow device firmware updates
       DRM_DP_AUX_CHARDEV = yes;
       # amdgpu display core (DC) support
-      DRM_AMD_DC_DCN1_0 = whenBetween "4.15" "5.6" yes;
-      DRM_AMD_DC_PRE_VEGA = whenBetween "4.15" "4.18" yes;
+      DRM_AMD_DC_DCN1_0 = whenOlder "5.6" yes;
       DRM_AMD_DC_DCN2_0 = whenBetween "5.3" "5.6" yes;
       DRM_AMD_DC_DCN2_1 = whenBetween "5.4" "5.6" yes;
       DRM_AMD_DC_DCN3_0 = whenBetween "5.9" "5.11" yes;
@@ -368,8 +362,8 @@ let
       DRM_AMD_DC_SI = whenAtLeast "5.10" yes;
     } // optionalAttrs (stdenv.hostPlatform.system == "x86_64-linux") {
       # Intel GVT-g graphics virtualization supports 64-bit only
-      DRM_I915_GVT = whenAtLeast "4.16" yes;
-      DRM_I915_GVT_KVMGT = whenAtLeast "4.16" module;
+      DRM_I915_GVT = yes;
+      DRM_I915_GVT_KVMGT = module;
       # Enable Hyper-V Synthetic DRM Driver
       DRM_HYPERV = whenAtLeast "5.14" module;
     } // optionalAttrs (stdenv.hostPlatform.system == "aarch64-linux") {
@@ -425,25 +419,9 @@ let
 
     usb-serial = {
       USB_SERIAL_GENERIC          = yes; # USB Generic Serial Driver
-    } // optionalAttrs (versionOlder version "4.16") {
-      # Include firmware for various USB serial devices.
-      # Only applicable for kernels below 4.16, after that no firmware is shipped in the kernel tree.
-      USB_SERIAL_KEYSPAN_MPR      = yes;
-      USB_SERIAL_KEYSPAN_USA28    = yes;
-      USB_SERIAL_KEYSPAN_USA28X   = yes;
-      USB_SERIAL_KEYSPAN_USA28XA  = yes;
-      USB_SERIAL_KEYSPAN_USA28XB  = yes;
-      USB_SERIAL_KEYSPAN_USA19    = yes;
-      USB_SERIAL_KEYSPAN_USA18X   = yes;
-      USB_SERIAL_KEYSPAN_USA19W   = yes;
-      USB_SERIAL_KEYSPAN_USA19QW  = yes;
-      USB_SERIAL_KEYSPAN_USA19QI  = yes;
-      USB_SERIAL_KEYSPAN_USA49W   = yes;
-      USB_SERIAL_KEYSPAN_USA49WLC = yes;
     };
 
     usb = {
-      USB_DEBUG = { optional = true; tristate = whenOlder "4.18" "n";};
       USB_EHCI_ROOT_HUB_TT = yes; # Root Hub Transaction Translators
       USB_EHCI_TT_NEWSCHED = yes; # Improved transaction translator scheduling
       USB_HIDDEV = yes; # USB Raw HID Devices (like monitor controls and Uninterruptable Power Supplies)
@@ -514,7 +492,6 @@ let
       CIFS_XATTR        = yes;
       CIFS_POSIX        = option yes;
       CIFS_FSCACHE      = yes;
-      CIFS_STATS        = whenOlder "4.19" yes;
       CIFS_WEAK_PW_HASH = whenOlder "5.15" yes;
       CIFS_UPCALL       = yes;
       CIFS_ACL          = whenOlder "5.3" yes;
@@ -569,7 +546,7 @@ let
       SECURITY_APPARMOR                = yes;
       DEFAULT_SECURITY_APPARMOR        = yes;
 
-      RANDOM_TRUST_CPU                 = whenOlder "6.2" (whenAtLeast "4.19" yes); # allow RDRAND to seed the RNG
+      RANDOM_TRUST_CPU                 = whenOlder "6.2" yes; # allow RDRAND to seed the RNG
       RANDOM_TRUST_BOOTLOADER          = whenOlder "6.2" (whenAtLeast "5.4" yes); # allow the bootloader to seed the RNG
 
       MODULE_SIG            = no; # r13y, generates a random key during build and bakes it in
@@ -581,10 +558,6 @@ let
       PERSISTENT_KEYRINGS              = yes;
       # enable temporary caching of the last request_key() result
       KEYS_REQUEST_CACHE               = whenAtLeast "5.3" yes;
-    } // optionalAttrs (!stdenv.hostPlatform.isAarch32) {
-
-      # Detect buffer overflows on the stack
-      CC_STACKPROTECTOR_REGULAR = {optional = true; tristate = whenOlder "4.18" "y";};
     } // optionalAttrs stdenv.hostPlatform.isx86_64 {
       # Enable Intel SGX
       X86_SGX     = whenAtLeast "5.11" yes;
@@ -596,7 +569,7 @@ let
       # AMD SME
       AMD_MEM_ENCRYPT = yes;
       # AMD SEV and AMD SEV-SE
-      KVM_AMD_SEV     = whenAtLeast "4.16" yes;
+      KVM_AMD_SEV     = yes;
       # AMD SEV-SNP
       SEV_GUEST       = whenAtLeast "5.19" module;
     };
@@ -702,7 +675,6 @@ let
       XEN_PVH                     = option yes;
       XEN_PVHVM                   = option yes;
       XEN_SAVE_RESTORE            = option yes;
-      XEN_SCRUB_PAGES             = whenOlder "4.19" yes;
       XEN_SELFBALLOONING          = whenOlder "5.3" yes;
 
       # Enable device detection on virtio-mmio hypervisors
@@ -756,40 +728,11 @@ let
     tests = {
       # This menu disables all/most of them on >= 4.16
       RUNTIME_TESTING_MENU = option no;
-    } // optionalAttrs (versionOlder version "4.16") {
-      # For older kernels, painstakingly disable each symbol.
-      ARM_KPROBES_TEST    = option no;
-      ASYNC_RAID6_TEST    = option no;
-      ATOMIC64_SELFTEST   = option no;
-      BACKTRACE_SELF_TEST = option no;
-      INTERVAL_TREE_TEST  = option no;
-      PERCPU_TEST         = option no;
-      RBTREE_TEST         = option no;
-      TEST_BITMAP         = option no;
-      TEST_BPF            = option no;
-      TEST_FIRMWARE       = option no;
-      TEST_HASH           = option no;
-      TEST_HEXDUMP        = option no;
-      TEST_KMOD           = option no;
-      TEST_KSTRTOX        = option no;
-      TEST_LIST_SORT      = option no;
-      TEST_LKM            = option no;
-      TEST_PARMAN         = option no;
-      TEST_PRINTF         = option no;
-      TEST_RHASHTABLE     = option no;
-      TEST_SORT           = option no;
-      TEST_STATIC_KEYS    = option no;
-      TEST_STRING_HELPERS = option no;
-      TEST_UDELAY         = option no;
-      TEST_USER_COPY      = option no;
-      TEST_UUID           = option no;
     } // {
       CRC32_SELFTEST           = option no;
       CRYPTO_TEST              = option no;
       EFI_TEST                 = option no;
       GLOB_SELFTEST            = option no;
-      DRM_DEBUG_MM_SELFTEST    = { optional = true; tristate = whenOlder "4.18" "n";};
-      LNET_SELFTEST            = { optional = true; tristate = whenOlder "4.18" "n";};
       LOCK_TORTURE_TEST        = option no;
       MTD_TESTS                = option no;
       NOTIFIER_ERROR_INJECTION = option no;
@@ -801,23 +744,11 @@ let
       XZ_DEC_TEST              = option no;
     };
 
-    criu = if (versionAtLeast version "4.19") then {
+    criu = {
       # Unconditionally enabled, because it is required for CRIU and
       # it provides the kcmp() system call that Mesa depends on.
       CHECKPOINT_RESTORE  = yes;
-    } else optionalAttrs (features.criu or false) ({
-      # For older kernels, CHECKPOINT_RESTORE is hidden behind EXPERT.
-      EXPERT              = yes;
-      CHECKPOINT_RESTORE  = yes;
-    } // optionalAttrs (features.criu_revert_expert or true) {
-      RFKILL_INPUT          = option yes;
-      HID_PICOLCD_FB        = option yes;
-      HID_PICOLCD_BACKLIGHT = option yes;
-      HID_PICOLCD_LCD       = option yes;
-      HID_PICOLCD_LEDS      = option yes;
-      HID_PICOLCD_CIR       = option yes;
-      DEBUG_MEMORY_INIT     = option yes;
-    });
+    };
 
     misc = let
       # Use zstd for kernel compression if 64-bit and newer than 5.9, otherwise xz.
@@ -861,7 +792,6 @@ let
       PM_TRACE_RTC         = no; # Disable some expensive (?) features.
       ACCESSIBILITY        = yes; # Accessibility support
       AUXDISPLAY           = yes; # Auxiliary Display support
-      DONGLE               = whenOlder "4.17" yes; # Serial dongle support
       HIPPI                = yes;
       MTD_COMPLEX_MAPPINGS = yes; # needed for many devices
 
@@ -917,7 +847,6 @@ let
       FUSION              = yes; # Fusion MPT device support
       IDE                 = whenOlder "5.14" no; # deprecated IDE support, removed in 5.14
       IDLE_PAGE_TRACKING  = yes;
-      IRDA_ULTRA          = whenOlder "4.17" yes; # Ultra (connectionless) protocol
 
       JOYSTICK_IFORCE_232 = { optional = true; tristate = whenOlder "5.3" "y"; }; # I-Force Serial joysticks and wheels
       JOYSTICK_IFORCE_USB = { optional = true; tristate = whenOlder "5.3" "y"; }; # I-Force USB joysticks and wheels
@@ -939,7 +868,7 @@ let
 
       MLX5_CORE_EN       = option yes;
 
-      NVME_MULTIPATH = whenAtLeast "4.15" yes;
+      NVME_MULTIPATH = yes;
 
       PSI = whenAtLeast "4.20" yes;
 
@@ -1014,7 +943,7 @@ let
       X86_PLATFORM_DRIVERS_DELL = whenAtLeast "5.12" yes;
       X86_PLATFORM_DRIVERS_HP = whenAtLeast "6.1" yes;
 
-      LIRC = mkMerge [ (whenOlder "4.16" module) (whenAtLeast "4.17" yes) ];
+      LIRC = yes;
 
       SCHED_CORE = whenAtLeast "5.14" yes;
 
diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json
index 1981ad96b551..cadef31334df 100644
--- a/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened/patches.json
@@ -52,12 +52,12 @@
     "6.1": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-6.1.57-hardened1.patch",
-            "sha256": "0cjcjphl2val9kl9vn37yvgd1k02pn2qm6g7dnfpzph4mxg17ap4",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.1.57-hardened1/linux-hardened-6.1.57-hardened1.patch"
+            "name": "linux-hardened-6.1.58-hardened1.patch",
+            "sha256": "0xca1pf6hkipci7blly111cchfw58cj22b73nr38dks0xvyb4rx6",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.1.58-hardened1/linux-hardened-6.1.58-hardened1.patch"
         },
-        "sha256": "1ccidrxswblxw9yaa45y6ds16pc7647f6fz36xxxhljivhyzxszr",
-        "version": "6.1.57"
+        "sha256": "1b913ina3rcw4dx2s7n37kynv8rqsmrqa2ialsib6h7nsb9px66f",
+        "version": "6.1.58"
     },
     "6.5": {
         "patch": {
diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index b4772aa24271..94c383ff8dbd 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -4,20 +4,20 @@
         "hash": "sha256:1yzzf0bswqqarmbkw17vqcrkghivin7ca84x919aa2i8z7fyg2hw"
     },
     "6.5": {
-        "version": "6.5.7",
-        "hash": "sha256:135v3y2vgc83dca4xi7q52wqi4dkfal74k1y73jwzj85h12fl28d"
+        "version": "6.5.8",
+        "hash": "sha256:05zpdh4dxaadq52hlczdmwb7bsqfm3q45v7bdqbsmplhgn4wm719"
     },
     "6.4": {
         "version": "6.4.16",
         "hash": "sha256:0zgj1z97jyx7wf12zrnlcp0mj4cl43ais9qsy6dh1jwylf2fq9ln"
     },
     "6.1": {
-        "version": "6.1.58",
-        "hash": "sha256:1b913ina3rcw4dx2s7n37kynv8rqsmrqa2ialsib6h7nsb9px66f"
+        "version": "6.1.59",
+        "hash": "sha256:1860r1aan258yi2jq68bp1kdbcyy7ygc7d8g54wnc0vmqqj7fzv2"
     },
     "5.15": {
-        "version": "5.15.135",
-        "hash": "sha256:0w3i8jvzqvfnlarcvg89k1144ln96fszv16lzrn16zr3kri5x0ql"
+        "version": "5.15.136",
+        "hash": "sha256:1f5cxrair8qycjcc931kcdsarbrph32ypdyhrws8sw74gvzbj966"
     },
     "5.10": {
         "version": "5.10.198",
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/bootstrap-sources.nix b/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/bootstrap-sources.nix
index a0663c9dbe4f..715d261eea4f 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/bootstrap-sources.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/bootstrap-sources.nix
@@ -1,4 +1,4 @@
-{
+{ hostPlatform
 }:
 
 rec {
@@ -65,7 +65,7 @@ rec {
   */
   minimal-bootstrap-sources = derivation {
     inherit name;
-    system = builtins.currentSystem;
+    system = hostPlatform.system;
     outputHashMode = "recursive";
     inherit outputHashAlgo outputHash;
 
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/make-bootstrap-sources.nix b/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/make-bootstrap-sources.nix
index 381902cd2c12..6cc7cddb82af 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/make-bootstrap-sources.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/make-bootstrap-sources.nix
@@ -12,12 +12,13 @@
 #
 
 { lib
+, hostPlatform
 , fetchFromGitHub
 , fetchpatch
 }:
 
 let
-  expected = import ./bootstrap-sources.nix { };
+  expected = import ./bootstrap-sources.nix { inherit hostPlatform; };
 in
 
 fetchFromGitHub {
diff --git a/pkgs/os-specific/linux/oci-seccomp-bpf-hook/default.nix b/pkgs/os-specific/linux/oci-seccomp-bpf-hook/default.nix
index 40ef0796dfa1..61a27bd51f02 100644
--- a/pkgs/os-specific/linux/oci-seccomp-bpf-hook/default.nix
+++ b/pkgs/os-specific/linux/oci-seccomp-bpf-hook/default.nix
@@ -10,12 +10,12 @@
 
 buildGoModule rec {
   pname = "oci-seccomp-bpf-hook";
-  version = "1.2.9";
+  version = "1.2.10";
   src = fetchFromGitHub {
     owner = "containers";
     repo = "oci-seccomp-bpf-hook";
     rev = "v${version}";
-    sha256 = "sha256-KPO9xqLgPML6smoO7P50yP81b4iCvRFIR74ciUiva7o=";
+    sha256 = "sha256-bWlm+JYNf7+faKSQfW5fhxoH/D2I8ujjakswH+1r49o=";
   };
   vendorHash = null;
 
diff --git a/pkgs/os-specific/linux/ryzenadj/default.nix b/pkgs/os-specific/linux/ryzenadj/default.nix
index efdb9f3ed39b..0744ed2896ff 100644
--- a/pkgs/os-specific/linux/ryzenadj/default.nix
+++ b/pkgs/os-specific/linux/ryzenadj/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     description = "Adjust power management settings for Ryzen Mobile Processors.";
     homepage = "https://github.com/FlyGoat/RyzenAdj";
     license = licenses.lgpl3Only;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ rhendric ];
     platforms = [ "x86_64-linux" ];
   };
 }
diff --git a/pkgs/servers/computing/slurm/default.nix b/pkgs/servers/computing/slurm/default.nix
index 321e988af7f5..226755b14c9e 100644
--- a/pkgs/servers/computing/slurm/default.nix
+++ b/pkgs/servers/computing/slurm/default.nix
@@ -14,7 +14,7 @@
 
 stdenv.mkDerivation rec {
   pname = "slurm";
-  version = "23.02.5.1";
+  version = "23.02.6.1";
 
   # N.B. We use github release tags instead of https://www.schedmd.com/downloads.php
   # because the latter does not keep older releases.
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
     repo = "slurm";
     # The release tags use - instead of .
     rev = "${pname}-${builtins.replaceStrings ["."] ["-"] version}";
-    sha256 = "sha256-9VvZ8xySYFyBa5tZzf5WCShbEDpqE1/5t76jXX6t+bc=";
+    sha256 = "sha256-azgGM4qfS0xtUaiGfXtu8MNYdgpZRUfx+zBgAAlmt6g=";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/servers/geospatial/fit-trackee/default.nix b/pkgs/servers/geospatial/fit-trackee/default.nix
new file mode 100644
index 000000000000..c7bc7fbc2e5b
--- /dev/null
+++ b/pkgs/servers/geospatial/fit-trackee/default.nix
@@ -0,0 +1,105 @@
+{ lib
+, python3
+, fetchFromGitHub
+, fetchPypi
+, postgresql
+, postgresqlTestHook
+}:
+let
+  python = python3.override {
+    packageOverrides = self: super: {
+      sqlalchemy = super.sqlalchemy.overridePythonAttrs (oldAttrs: rec {
+        version = "1.4.49";
+        src = fetchPypi {
+          pname = "SQLAlchemy";
+          inherit version;
+          hash = "sha256-Bv8ly64ww5bEt3N0ZPKn/Deme32kCZk7GCsCTOyArtk=";
+        };
+        # Remove "test/typing" that does not exist
+        disabledTestPaths = [
+          "test/aaa_profiling"
+          "test/ext/mypy"
+        ];
+      });
+    };
+  };
+
+in
+python.pkgs.buildPythonApplication rec {
+  pname = "fit-trackee";
+  version = "0.7.22";
+  format = "pyproject";
+
+  src = fetchFromGitHub {
+    owner = "SamR1";
+    repo = "FitTrackee";
+    rev = "v${version}";
+    hash = "sha256-aPQ8jLssN9nx0Bpd/44E3sQi2w0cR8ecG76DJjreeHA=";
+  };
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace psycopg2-binary psycopg2 \
+      --replace 'poetry>=0.12' 'poetry-core' \
+      --replace 'poetry.masonry.api' 'poetry.core.masonry.api'
+  '';
+
+  nativeBuildInputs = [
+    python3.pkgs.poetry-core
+  ];
+
+  propagatedBuildInputs = with python.pkgs; [
+    authlib
+    babel
+    dramatiq
+    flask
+    flask-bcrypt
+    flask-dramatiq
+    flask-limiter
+    flask-migrate
+    gpxpy
+    gunicorn
+    humanize
+    psycopg2
+    pyjwt
+    pyopenssl
+    pytz
+    shortuuid
+    sqlalchemy
+    staticmap
+    ua-parser
+  ] ++ dramatiq.optional-dependencies.redis;
+
+  pythonImportsCheck = [ "fittrackee" ];
+
+  nativeCheckInputs = with python.pkgs; [
+    pytestCheckHook
+    freezegun
+    postgresqlTestHook
+    postgresql
+  ];
+
+  pytestFlagsArray = [
+    "fittrackee"
+  ];
+
+  postgresqlTestSetupPost = ''
+    export DATABASE_TEST_URL=postgresql://$PGUSER/$PGDATABAS?host=$PGHOST
+  '';
+
+  postInstall = ''
+    mkdir -p $out/var/share/fittrackee-instance
+  '';
+
+  preCheck = ''
+    export TMP=$(mktemp -d)
+  '';
+
+  meta = with lib; {
+    description = "Self-hosted outdoor activity tracker :bicyclist";
+    homepage = "https://github.com/SamR1/FitTrackee";
+    changelog = "https://github.com/SamR1/FitTrackee/blob/${src.rev}/CHANGELOG.md";
+    license = licenses.agpl3Only;
+    maintainers = with maintainers; [ traxys ];
+  };
+}
diff --git a/pkgs/servers/http/apache-httpd/2.4.nix b/pkgs/servers/http/apache-httpd/2.4.nix
index 98a00afc519d..c6e7ad1f5661 100644
--- a/pkgs/servers/http/apache-httpd/2.4.nix
+++ b/pkgs/servers/http/apache-httpd/2.4.nix
@@ -13,11 +13,11 @@
 
 stdenv.mkDerivation rec {
   pname = "apache-httpd";
-  version = "2.4.57";
+  version = "2.4.58";
 
   src = fetchurl {
     url = "mirror://apache/httpd/httpd-${version}.tar.bz2";
-    sha256 = "sha256-28y4Su6V4JXt+7geXrkmzNJOatpV3Ng8rssmLlz5TSo=";
+    sha256 = "sha256-+hbXKgeCEKVMR91b7y+Lm4oB2UkJpRRTlWs+xkQupMU=";
   };
 
   # FIXME: -dev depends on -doc
diff --git a/pkgs/servers/http/lighttpd/default.nix b/pkgs/servers/http/lighttpd/default.nix
index b0bb720c21cd..0c83c2e750a0 100644
--- a/pkgs/servers/http/lighttpd/default.nix
+++ b/pkgs/servers/http/lighttpd/default.nix
@@ -15,26 +15,15 @@
 
 stdenv.mkDerivation rec {
   pname = "lighttpd";
-  version = "1.4.71";
+  version = "1.4.72";
 
   src = fetchurl {
     url = "https://download.lighttpd.net/lighttpd/releases-${lib.versions.majorMinor version}.x/${pname}-${version}.tar.xz";
-    sha256 = "sha256-uLaRXaIDlv3DVN8zJNXkQBabLl6nhZ46d1IThBMlr6w=";
+    sha256 = "sha256-98reTWm3VKB0jAFGPDPNi0VsqcwDuwnoWnG8vNVOVew=";
   };
 
-  patches = [
-    # disable tests for des/md5, which we don't support any more
-    ./disable-legacy-crypt-tests.patch
-  ];
-
   postPatch = ''
     patchShebangs tests
-    # Linux sandbox has an empty hostname and not /etc/hosts, which fails some tests
-    sed -ire '/[$]self->{HOSTNAME} *=/i     if(length($name)==0) { $name = "127.0.0.1" }' tests/LightyTest.pm
-    # it's difficult to prevent this test from trying to use /var/tmp (which
-    # the sandbox doesn't have) so until libredirect has support for mkstemp
-    # calls it's easiest to disable it
-    sed -i '/test_mod_ssi/d' src/t/test_mod.c
   '';
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
diff --git a/pkgs/servers/http/lighttpd/disable-legacy-crypt-tests.patch b/pkgs/servers/http/lighttpd/disable-legacy-crypt-tests.patch
deleted file mode 100644
index 4a411c0b98ae..000000000000
--- a/pkgs/servers/http/lighttpd/disable-legacy-crypt-tests.patch
+++ /dev/null
@@ -1,35 +0,0 @@
-diff -uNr lighttpd-1.4.71.orig/tests/mod-fastcgi.t lighttpd-1.4.71.new/tests/mod-fastcgi.t
---- lighttpd-1.4.71.orig/tests/mod-fastcgi.t	2023-05-27 21:56:16.000000000 +0200
-+++ lighttpd-1.4.71.new/tests/mod-fastcgi.t	2023-06-01 07:01:59.789873512 +0200
-@@ -79,7 +79,7 @@
- 	ok($tf->handle_http($t) == 0, 'FastCGI + bin-copy-environment');
- 
- SKIP: {
--	skip "no crypt-des under openbsd or MS Visual Studio", 2 if $^O eq 'openbsd' || $tf->{'win32native'};
-+	skip "no crypt-des", 2;
- 
- 	$t->{REQUEST}  = ( <<EOF
- GET /get-server-env.php?env=REMOTE_USER HTTP/1.0
-diff -uNr lighttpd-1.4.71.orig/tests/request.t lighttpd-1.4.71.new/tests/request.t
---- lighttpd-1.4.71.orig/tests/request.t	2023-05-27 21:56:16.000000000 +0200
-+++ lighttpd-1.4.71.new/tests/request.t	2023-06-01 07:02:39.855940048 +0200
-@@ -1106,7 +1106,7 @@
- ok($tf->handle_http($t) == 0, 'Basic-Auth: Valid Auth-token - plain');
- 
- SKIP: {
--	skip "no crypt-des under openbsd or MS Visual Studio", 2 if $^O eq 'openbsd' || $tf->{'win32native'};
-+	skip "no crypt-des", 2;
- $t->{REQUEST}  = ( <<EOF
- GET /server-config HTTP/1.0
- Host: auth-htpasswd.example.org
-@@ -1163,9 +1163,7 @@
- ok($tf->handle_http($t) == 0, 'Basic-Auth: Valid Auth-token - htpasswd (apr-md5, wrong password)');
- 
- SKIP: {
--	skip "no crypt-md5 under cygwin", 1 if $^O eq 'cygwin';
--	skip "no crypt-md5 under darwin", 1 if $^O eq 'darwin';
--	skip "no crypt-md5 under openbsd",1 if $^O eq 'openbsd';
-+	skip "no crypt-md5", 1;
- $t->{REQUEST}  = ( <<EOF
- GET /server-config HTTP/1.0
- Host: auth-htpasswd.example.org
diff --git a/pkgs/servers/http/nginx/generic.nix b/pkgs/servers/http/nginx/generic.nix
index 3db19396bee9..1f175c03d8a8 100644
--- a/pkgs/servers/http/nginx/generic.nix
+++ b/pkgs/servers/http/nginx/generic.nix
@@ -2,7 +2,7 @@ outer@{ lib, stdenv, fetchurl, fetchpatch, openssl, zlib, pcre, libxml2, libxslt
 , nginx-doc
 
 , nixosTests
-, substituteAll, removeReferencesTo, gd, geoip, perl
+, installShellFiles, substituteAll, removeReferencesTo, gd, geoip, perl
 , withDebug ? false
 , withKTLS ? false
 , withStream ? true
@@ -51,15 +51,17 @@ assert lib.assertMsg (lib.unique moduleNames == moduleNames)
 stdenv.mkDerivation {
   inherit pname version nginxVersion;
 
-  outputs = ["out" "doc"];
+  outputs = [ "out" "doc" ];
 
   src = if src != null then src else fetchurl {
     url = "https://nginx.org/download/nginx-${version}.tar.gz";
     inherit hash;
   };
 
-  nativeBuildInputs = [ removeReferencesTo ]
-    ++ nativeBuildInputs;
+  nativeBuildInputs = [
+    installShellFiles
+    removeReferencesTo
+  ] ++ nativeBuildInputs;
 
   buildInputs = [ openssl zlib pcre libxml2 libxslt gd geoip perl ]
     ++ buildInputs
@@ -166,6 +168,12 @@ stdenv.mkDerivation {
   preInstall = ''
     mkdir -p $doc
     cp -r ${nginx-doc}/* $doc
+
+    # TODO: make it unconditional when `openresty` and `nginx` are not
+    # sharing this code.
+    if [[ -e man/nginx.8 ]]; then
+      installManPage man/nginx.8
+    fi
   '';
 
   disallowedReferences = map (m: m.src) modules;
diff --git a/pkgs/servers/kanidm/default.nix b/pkgs/servers/kanidm/default.nix
index e6c49b846f4b..65450e0e3eb9 100644
--- a/pkgs/servers/kanidm/default.nix
+++ b/pkgs/servers/kanidm/default.nix
@@ -11,6 +11,7 @@
 , sqlite
 , pam
 , bashInteractive
+, rust-jemalloc-sys
 }:
 
 let
@@ -59,6 +60,7 @@ rustPlatform.buildRustPackage rec {
     openssl
     sqlite
     pam
+    rust-jemalloc-sys
   ];
 
   # The UI needs to be in place before the tests are run.
diff --git a/pkgs/servers/mail/spamassassin/default.nix b/pkgs/servers/mail/spamassassin/default.nix
index 8e9aee8ad986..8b6623200eba 100644
--- a/pkgs/servers/mail/spamassassin/default.nix
+++ b/pkgs/servers/mail/spamassassin/default.nix
@@ -52,6 +52,9 @@ perlPackages.buildPerlPackage rec {
     export HOME=$NIX_BUILD_TOP/home
     mkdir -p $HOME
     mkdir t/log  # pre-create to avoid race conditions
+
+    # https://bz.apache.org/SpamAssassin/show_bug.cgi?id=8068
+    checkFlagsArray+=(TEST_FILES='$(shell find t -name *.t -not -name spamd_ssl_accept_fail.t)')
   '';
 
   postInstall = ''
diff --git a/pkgs/servers/matrix-conduit/default.nix b/pkgs/servers/matrix-conduit/default.nix
index 6cb8f16d203c..cc162e6373d6 100644
--- a/pkgs/servers/matrix-conduit/default.nix
+++ b/pkgs/servers/matrix-conduit/default.nix
@@ -7,6 +7,7 @@
 , darwin
 , nixosTests
 , rocksdb
+, rust-jemalloc-sys
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -42,7 +43,10 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs = [ sqlite ] ++ lib.optionals stdenv.isDarwin [
+  buildInputs = [
+    sqlite
+    rust-jemalloc-sys
+  ] ++ lib.optionals stdenv.isDarwin [
     darwin.apple_sdk.frameworks.Security
   ];
 
diff --git a/pkgs/servers/monitoring/librenms/default.nix b/pkgs/servers/monitoring/librenms/default.nix
index 79b550e28146..0fab1b334890 100644
--- a/pkgs/servers/monitoring/librenms/default.nix
+++ b/pkgs/servers/monitoring/librenms/default.nix
@@ -23,7 +23,6 @@
 let
   phpPackage = php82.withExtensions ({ enabled, all }: enabled ++ [ all.memcached ]);
 in phpPackage.buildComposerProject rec {
-  name = pname + "-" + version;
   pname = "librenms";
   version = "23.9.1";
 
diff --git a/pkgs/servers/monitoring/telegraf/default.nix b/pkgs/servers/monitoring/telegraf/default.nix
index 52605250cff6..ac13d678ff1f 100644
--- a/pkgs/servers/monitoring/telegraf/default.nix
+++ b/pkgs/servers/monitoring/telegraf/default.nix
@@ -8,7 +8,7 @@
 
 buildGoModule rec {
   pname = "telegraf";
-  version = "1.28.1";
+  version = "1.28.2";
 
   subPackages = [ "cmd/telegraf" ];
 
@@ -16,10 +16,10 @@ buildGoModule rec {
     owner = "influxdata";
     repo = "telegraf";
     rev = "v${version}";
-    hash = "sha256-ag5Hk/LAHS2XDZ0MUAycLfDLr9awMl3T+5NoQGUIl/w=";
+    hash = "sha256-gD4xdKjIx0zLKJySx8UdSKvMIZJaIXtubWQX/mLu+TI=";
   };
 
-  vendorHash = "sha256-3hmYyUDlBPEcoM/1MhH6yoH/Kb21rITrAzy7APQpLqI=";
+  vendorHash = "sha256-OzAAchUHNno58Em2oDnMt9P1B03HtQylFBFEkv4bAkU=";
   proxyVendor = true;
 
   ldflags = [
diff --git a/pkgs/servers/nosql/redis/default.nix b/pkgs/servers/nosql/redis/default.nix
index 25d889694504..b1f3bb7adcc3 100644
--- a/pkgs/servers/nosql/redis/default.nix
+++ b/pkgs/servers/nosql/redis/default.nix
@@ -12,11 +12,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "redis";
-  version = "7.2.1";
+  version = "7.2.2";
 
   src = fetchurl {
     url = "https://download.redis.io/releases/redis-${finalAttrs.version}.tar.gz";
-    hash = "sha256-XHbZkKGxxflJvNHu2Q0Mik9wNpvb3LQCiMVh3fiJZ6Q=";
+    hash = "sha256-ypmb4IgA7cbSZTecTHqvrZLw7kAGkuTi1pgpq0tMPQg=";
   };
 
   patches = lib.optionals useSystemJemalloc [
diff --git a/pkgs/servers/search/qdrant/default.nix b/pkgs/servers/search/qdrant/default.nix
index 005514819820..6d70b5e4b3da 100644
--- a/pkgs/servers/search/qdrant/default.nix
+++ b/pkgs/servers/search/qdrant/default.nix
@@ -5,6 +5,7 @@
 , stdenv
 , pkg-config
 , openssl
+, rust-jemalloc-sys
 , nix-update-script
 , Security
 }:
@@ -32,7 +33,10 @@ rustPlatform.buildRustPackage rec {
   # Needed to get openssl-sys to use pkg-config.
   OPENSSL_NO_VENDOR = 1;
 
-  buildInputs = [ openssl ] ++ lib.optionals stdenv.isDarwin [ Security ];
+  buildInputs = [
+    openssl
+    rust-jemalloc-sys
+  ] ++ lib.optionals stdenv.isDarwin [ Security ];
 
   nativeBuildInputs = [ protobuf rustPlatform.bindgenHook pkg-config ];
 
diff --git a/pkgs/servers/search/quickwit/default.nix b/pkgs/servers/search/quickwit/default.nix
index 9fdcbef3e712..f4d75be434ec 100644
--- a/pkgs/servers/search/quickwit/default.nix
+++ b/pkgs/servers/search/quickwit/default.nix
@@ -4,6 +4,7 @@
 , rustPlatform
 , nix-update-script
 , protobuf
+, rust-jemalloc-sys
 , Security
 }:
 
@@ -32,7 +33,9 @@ rustPlatform.buildRustPackage rec {
 
   sourceRoot = "${src.name}/quickwit";
 
-  buildInputs = lib.optionals stdenv.isDarwin [ Security ];
+  buildInputs = [
+    rust-jemalloc-sys
+  ] ++ lib.optionals stdenv.isDarwin [ Security ];
 
   cargoLock = {
     lockFile = ./Cargo.lock;
diff --git a/pkgs/servers/shairport-sync/default.nix b/pkgs/servers/shairport-sync/default.nix
index 7cd768bd332a..b1bac49ba919 100644
--- a/pkgs/servers/shairport-sync/default.nix
+++ b/pkgs/servers/shairport-sync/default.nix
@@ -40,13 +40,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "shairport-sync";
-  version = "4.3.1";
+  version = "4.3.2";
 
   src = fetchFromGitHub {
     repo = "shairport-sync";
     owner = "mikebrady";
     rev = "refs/tags/${version}";
-    hash = "sha256-Yj0SKMKACj2B/ADPkUzO4EvaYZX39erKmjaTsr5UN0s=";
+    hash = "sha256-M7bJO8KVxP2H27aB0qJcsaN9uHADWeOYPdNo8Xfg9gc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/servers/sickbeard/sickgear.nix b/pkgs/servers/sickbeard/sickgear.nix
index 2e723c9b3ea3..e75dc72a1354 100644
--- a/pkgs/servers/sickbeard/sickgear.nix
+++ b/pkgs/servers/sickbeard/sickgear.nix
@@ -4,13 +4,13 @@ let
   pythonEnv = python3.withPackages(ps: with ps; [ cheetah3 lxml ]);
 in stdenv.mkDerivation rec {
   pname = "sickgear";
-  version = "3.30.0";
+  version = "3.30.4";
 
   src = fetchFromGitHub {
     owner = "SickGear";
     repo = "SickGear";
     rev = "release_${version}";
-    hash = "sha256-Y9FXaDODeuMaXeqmfBCd96JgwrqDe5k6RCtGKvTOMKw=";
+    hash = "sha256-me52Ji+IWPN6IEDWsAlIoGPS45uA22+dxHJjqnYPniE=";
   };
 
   patches = [
diff --git a/pkgs/servers/snac2/default.nix b/pkgs/servers/snac2/default.nix
index b13b6c2b9fcf..49c2c27890ff 100644
--- a/pkgs/servers/snac2/default.nix
+++ b/pkgs/servers/snac2/default.nix
@@ -10,14 +10,14 @@
 
 stdenv.mkDerivation rec {
   pname = "snac2";
-  version = "2.41";
+  version = "2.42";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "grunfink";
     repo = pname;
     rev = version;
-    hash = "sha256-WVbGORth3paDo1eK/J7MPUstVQifcU7ksVEb87vknN0=";
+    hash = "sha256-cLSbmEZj5lyMtZMM2vaWqdrXFk1/VPws9yBPhSUka2E=";
   };
 
   buildInputs = [ curl openssl ];
diff --git a/pkgs/servers/soft-serve/default.nix b/pkgs/servers/soft-serve/default.nix
index a3f35d32885a..5072869c39b6 100644
--- a/pkgs/servers/soft-serve/default.nix
+++ b/pkgs/servers/soft-serve/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "soft-serve";
-  version = "0.6.1";
+  version = "0.6.2";
 
   src = fetchFromGitHub {
     owner = "charmbracelet";
     repo = "soft-serve";
     rev = "v${version}";
-    hash = "sha256-Xst/eNam3HuHixEmPUl2J7B7cLYaeGVaUnzXIVugBbw=";
+    hash = "sha256-gmgIuQk+8MRkuFZaJq82hHNdUMSqrylwgk6vi/Q0OQ0=";
   };
 
-  vendorHash = "sha256-tzJu2DmbvPU1tPIWP88q66PBtC1XEduQac8cIxwb/sM=";
+  vendorHash = "sha256-7lzdngj6xBpEe2nZdPW1GLbarPBdCHMnf+Dyxuq2Ikw=";
 
   doCheck = false;
 
diff --git a/pkgs/servers/sql/pgbouncer/default.nix b/pkgs/servers/sql/pgbouncer/default.nix
index b0f2bcb61626..7f6cfa0f898a 100644
--- a/pkgs/servers/sql/pgbouncer/default.nix
+++ b/pkgs/servers/sql/pgbouncer/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "pgbouncer";
-  version = "1.20.1";
+  version = "1.21.0";
 
   src = fetchurl {
     url = "https://www.pgbouncer.org/downloads/files/${version}/${pname}-${version}.tar.gz";
-    hash = "sha256-JJks9VfXNCbXBIaY3/x7AZ5jZNTYdXriz14kcShqIIg=";
+    hash = "sha256-fh3WIMjYWoSQr/JQYdUFXXrvnPPov+LZ53GbjuWRFOI=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/servers/unifi-video/default.nix b/pkgs/servers/unifi-video/default.nix
index 45a9b5c6fb61..45a9b5c6fb61 100755..100644
--- a/pkgs/servers/unifi-video/default.nix
+++ b/pkgs/servers/unifi-video/default.nix
diff --git a/pkgs/servers/web-apps/lemmy/package.json b/pkgs/servers/web-apps/lemmy/package.json
index f9b990ec203b..5b7f477f7c29 100644
--- a/pkgs/servers/web-apps/lemmy/package.json
+++ b/pkgs/servers/web-apps/lemmy/package.json
@@ -1,6 +1,6 @@
 {
   "name": "lemmy-ui",
-  "version": "0.18.4",
+  "version": "0.18.5",
   "description": "An isomorphic UI for lemmy",
   "repository": "https://github.com/LemmyNet/lemmy-ui",
   "license": "AGPL-3.0",
diff --git a/pkgs/servers/web-apps/lemmy/pin.json b/pkgs/servers/web-apps/lemmy/pin.json
index a2cd10515833..f7a4d855f406 100644
--- a/pkgs/servers/web-apps/lemmy/pin.json
+++ b/pkgs/servers/web-apps/lemmy/pin.json
@@ -1,8 +1,8 @@
 {
-  "serverVersion": "0.18.4",
-  "uiVersion": "0.18.4",
-  "serverHash": "sha256-J+kjsirEcLz0th3IGVheSShVLbQma1Eip329/q5/3S8=",
-  "serverCargoHash": "sha256-0UDhHa2QvHoNYJIArpc/o+lkq87tBX/XVgXsr7y/+Rk=",
-  "uiHash": "sha256-E/rSNWVjiZE5Hl0iIocQfkIdOFSeB0zYXQDq9A3h3lI=",
+  "serverVersion": "0.18.5",
+  "uiVersion": "0.18.5",
+  "serverHash": "sha256-tj8zryCzW3r6VGiNGlI5eo0I+rJfhTUOGtb3YieodpQ=",
+  "serverCargoHash": "sha256-80jk1GhnXos+lil3joEtPwJjsE8qSEm/WinCfZ3CF/c=",
+  "uiHash": "sha256-fyXKhVTFc1+gG2TXb9l/YkcwRt/p7DWtB1FO5mpQ3i4=",
   "uiYarnDepsHash": "sha256-rLP1CQd75nVfI6C0sC21TUskzVfbGHm2fblcYr6JcGc="
 }
diff --git a/pkgs/shells/fish/default.nix b/pkgs/shells/fish/default.nix
index 4df95a9ca6fe..bd816f9a8991 100644
--- a/pkgs/shells/fish/default.nix
+++ b/pkgs/shells/fish/default.nix
@@ -79,7 +79,7 @@ let
     # note that this is required:
     #   1. For all shells, not just login shells (mosh needs this as do some other command-line utilities)
     #   2. Before the shell is initialized, so that config snippets can find the commands they use on the PATH
-    builtin status --is-login
+    builtin status is-login
     or test -z "$__fish_nixos_env_preinit_sourced" -a -z "$ETC_PROFILE_SOURCED" -a -z "$ETC_ZSHENV_SOURCED"
     ${if fishEnvPreInit != null then ''
     and begin
diff --git a/pkgs/shells/fish/plugins/tide.nix b/pkgs/shells/fish/plugins/tide.nix
index 94cbfaa6b8f9..39afd487afdb 100644
--- a/pkgs/shells/fish/plugins/tide.nix
+++ b/pkgs/shells/fish/plugins/tide.nix
@@ -4,13 +4,13 @@
 # Refer to the following comment to get you setup: https://github.com/NixOS/nixpkgs/pull/201646#issuecomment-1320893716
 buildFishPlugin rec {
   pname = "tide";
-  version = "5.6.0";
+  version = "6.0.1";
 
   src = fetchFromGitHub {
     owner = "IlanCosman";
     repo = "tide";
     rev = "v${version}";
-    hash = "sha256-cCI1FDpvajt1vVPUd/WvsjX/6BJm6X1yFPjqohmo1rI=";
+    hash = "sha256-oLD7gYFCIeIzBeAW1j62z5FnzWAp3xSfxxe7kBtTLgA=";
   };
 
   #buildFishplugin will only move the .fish files, but tide has a tide configure function
diff --git a/pkgs/shells/fish/wrapper.nix b/pkgs/shells/fish/wrapper.nix
index 75213809821f..62ae03ec9ef9 100644
--- a/pkgs/shells/fish/wrapper.nix
+++ b/pkgs/shells/fish/wrapper.nix
@@ -18,7 +18,7 @@ let
     name = "wrapfish.aliases.fish";
     destination = "/share/fish/vendor_conf.d/aliases.fish";
     text = ''
-      status --is-interactive; and begin
+      status is-interactive; and begin
         # Aliases
         ${aliasesStr}
       end
diff --git a/pkgs/shells/nushell/plugins/default.nix b/pkgs/shells/nushell/plugins/default.nix
index 44b5b05a739f..dfe2a4062c89 100644
--- a/pkgs/shells/nushell/plugins/default.nix
+++ b/pkgs/shells/nushell/plugins/default.nix
@@ -4,4 +4,5 @@ lib.makeScope newScope (self: with self; {
   gstat = callPackage ./gstat.nix { inherit Security; };
   formats = callPackage ./formats.nix { inherit IOKit Foundation; };
   query = callPackage ./query.nix { inherit IOKit CoreFoundation; };
+  regex = callPackage ./regex.nix { };
 })
diff --git a/pkgs/shells/nushell/plugins/regex.nix b/pkgs/shells/nushell/plugins/regex.nix
new file mode 100644
index 000000000000..457c7170a5b3
--- /dev/null
+++ b/pkgs/shells/nushell/plugins/regex.nix
@@ -0,0 +1,32 @@
+{ stdenv
+, lib
+, rustPlatform
+, fetchFromGitHub
+, nix-update-script
+}:
+
+rustPlatform.buildRustPackage {
+  pname = "nushell_plugin_regex";
+  version = "unstable-2023-10-08";
+
+  src = fetchFromGitHub {
+    owner = "fdncred";
+    repo = "nu_plugin_regex";
+    rev = "e1aa88e703f1f632ede685dd733472d34dd0c8e7";
+    hash = "sha256-GJgnsaeNDJoJjw8RPw6wpEq1mIult18Eh4frl8Plgxc=";
+  };
+
+  cargoHash = "sha256-AACpzSavY6MlYnl1lDYxVlfsEvEpNK0u8SzsoSZbqFc=";
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = with lib; {
+    description = "A Nushell plugin to parse regular expressions";
+    homepage = "https://github.com/fdncred/nu_plugin_regex";
+    license = licenses.mit;
+    maintainers = with maintainers; [ aidalgol ];
+    platforms = with platforms; all;
+  };
+}
diff --git a/pkgs/tools/X11/xssstate/default.nix b/pkgs/tools/X11/xssstate/default.nix
index a1ce545a5f13..53fd1138c29d 100644
--- a/pkgs/tools/X11/xssstate/default.nix
+++ b/pkgs/tools/X11/xssstate/default.nix
@@ -4,29 +4,31 @@
 , libX11
 , libXScrnSaver
 }:
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "xssstate";
-  #
-  # Use the date of the last commit, since there were bug fixes after the 1.1
-  # release.
-  #
-  version = "unstable-2022-09-24";
+  version = "1.1-unstable-2022-09-24";
+
   src = fetchgit {
     url = "https://git.suckless.org/xssstate/";
     rev = "5d8e9b49ce2970f786f1e5aa12bbaae83900453f";
     hash = "sha256-Aor12tU1I/qNZCdBhZcvNK1FWFh0HYK8CEI29X5yoeA=";
   };
 
-  makeFlags = [ "VERSION=${version}" ];
-
-  installFlags = [ "PREFIX=$(out)" ];
+  buildInputs = [
+    libX11
+    libXScrnSaver
+  ];
 
-  buildInputs = [ libX11 libXScrnSaver ];
+  makeFlags = [
+    "PREFIX=${placeholder "out"}"
+    "VERSION=${finalAttrs.version}"
+  ];
 
   meta = with lib; {
     description = "A simple tool to retrieve the X screensaver state";
     license = licenses.mit;
     maintainers = with maintainers; [ onemoresuza ];
     platforms = platforms.linux;
+    mainProgram = "xssstate";
   };
-}
+})
diff --git a/pkgs/tools/admin/chamber/default.nix b/pkgs/tools/admin/chamber/default.nix
index 7f716e3b1fbe..0dca98037997 100644
--- a/pkgs/tools/admin/chamber/default.nix
+++ b/pkgs/tools/admin/chamber/default.nix
@@ -2,18 +2,18 @@
 
 buildGoModule rec {
   pname = "chamber";
-  version = "2.13.3";
+  version = "2.13.4";
 
   src = fetchFromGitHub {
     owner = "segmentio";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Pte2fOIuezFJ1Hz5MgjRDTIAMJ5r+LO1hKHc3sLu0W4=";
+    sha256 = "sha256-J6sLDalvUl4SgSyr5DK/tW7DyRa/qdKw6zornz1R2ck=";
   };
 
   CGO_ENABLED = 0;
 
-  vendorHash = "sha256-McicBVC2niLvP902monJwPMOrQKSum10zeHNcO32/M8=";
+  vendorHash = "sha256-BkTC6sqitc1OHdQFlA2BtqxHI31ubBj2GRszs3YlWsA=";
 
   ldflags = [ "-s" "-w" "-X main.Version=v${version}" ];
 
diff --git a/pkgs/tools/admin/pgadmin/default.nix b/pkgs/tools/admin/pgadmin/default.nix
index 3040258c0ca7..beecd6412bcf 100644
--- a/pkgs/tools/admin/pgadmin/default.nix
+++ b/pkgs/tools/admin/pgadmin/default.nix
@@ -14,14 +14,14 @@
 
 let
   pname = "pgadmin";
-  version = "7.5";
-  yarnSha256 = "sha256-rEKMUZksmR2jPwtXy6drNwAJktK/3Dee6EZVFHPngWs=";
+  version = "7.7";
+  yarnHash = "sha256-8EbbyZHodrYz4a2IYuIWYGutqvrjauSv34o9KFvR/6c=";
 
   src = fetchFromGitHub {
     owner = "pgadmin-org";
     repo = "pgadmin4";
     rev = "REL-${lib.versions.major version}_${lib.versions.minor version}";
-    hash = "sha256-o8jPqp4jLF/lZ0frCzPDCSxCy51Nt0mbdeNB44ZwNHI=";
+    hash = "sha256-+KD05hzghNFpuw2xW3NUVyKwspCUO9fyJgMPzYk1Xt8=";
   };
 
   # keep the scope, as it is used throughout the derivation and tests
@@ -30,7 +30,7 @@ let
 
   offlineCache = fetchYarnDeps {
     yarnLock = ./yarn.lock;
-    hash = yarnSha256;
+    hash = yarnHash;
   };
 
 in
diff --git a/pkgs/tools/admin/pgadmin/expose-setup.py.patch b/pkgs/tools/admin/pgadmin/expose-setup.py.patch
index 13f7d5069c69..ac68eabd411d 100644
--- a/pkgs/tools/admin/pgadmin/expose-setup.py.patch
+++ b/pkgs/tools/admin/pgadmin/expose-setup.py.patch
@@ -58,3 +58,31 @@ index 2204ffb..d5fda9f 100644
 +
 +if __name__ == '__main__':
 +    main()
+
+diff --git a/web/pgadmin/model/__init__.py b/web/pgadmin/model/__init__.py
+index 4c36dd1..a492365 100644
+--- a/web/pgadmin/model/__init__.py
++++ b/web/pgadmin/model/__init__.py
+@@ -23,7 +23,6 @@ from flask_sqlalchemy import SQLAlchemy
+ from sqlalchemy.ext.mutable import MutableDict
+ import sqlalchemy.types as types
+ import uuid
+-import config
+
+ ##########################################################################
+ #
+@@ -41,10 +40,12 @@ SCHEMA_VERSION = 35
+ #
+ ##########################################################################
+
++# hardcode poolsize and max_overflow due to a circular import (config imports model,
++# model now tries to import config)
+ db = SQLAlchemy(
+     engine_options={
+-        'pool_size': config.CONFIG_DATABASE_CONNECTION_POOL_SIZE,
+-        'max_overflow': config.CONFIG_DATABASE_CONNECTION_MAX_OVERFLOW})
++        'pool_size': 5,
++        'max_overflow': 100})
+
+
+ USER_ID = 'user.id'
diff --git a/pkgs/tools/admin/pgadmin/update.sh b/pkgs/tools/admin/pgadmin/update.sh
index a819c94ebc98..90b52f18ad51 100755
--- a/pkgs/tools/admin/pgadmin/update.sh
+++ b/pkgs/tools/admin/pgadmin/update.sh
@@ -104,7 +104,7 @@ cp yarn.lock "$nixpkgs/pkgs/tools/admin/pgadmin/"
 printf "Done\n"
 popd
 
-sed -i -E -e "s#yarnSha256 = \".*\"#yarnSha256 = \"$YARN_HASH\"#" ${scriptDir}/default.nix
+sed -i -E -e "s#yarnHash = \".*\"#yarnHash = \"$YARN_HASH\"#" ${scriptDir}/default.nix
 
 update-source-version pgadmin4 "$newest_version" --print-changes
 touch $TMPDIR/.done
diff --git a/pkgs/tools/admin/pgadmin/yarn.lock b/pkgs/tools/admin/pgadmin/yarn.lock
index 04815260d496..8ced96dcb781 100644
--- a/pkgs/tools/admin/pgadmin/yarn.lock
+++ b/pkgs/tools/admin/pgadmin/yarn.lock
@@ -1640,16 +1640,31 @@
     rc-resize-observer "^1.3.1"
     rc-util "^5.33.0"
 
+"@react-dnd/asap@^4.0.0":
+  version "4.0.1"
+  resolved "https://registry.npmjs.org/@react-dnd/asap/-/asap-4.0.1.tgz#5291850a6b58ce6f2da25352a64f1b0674871aab"
+  integrity sha512-kLy0PJDDwvwwTXxqTFNAAllPHD73AycE9ypWeln/IguoGBEbvFcPDbCV03G52bEcC5E+YgupBE0VzHGdC8SIXg==
+
 "@react-dnd/asap@^5.0.1":
   version "5.0.2"
   resolved "https://registry.npmjs.org/@react-dnd/asap/-/asap-5.0.2.tgz#1f81f124c1cd6f39511c11a881cfb0f715343488"
   integrity sha512-WLyfoHvxhs0V9U+GTsGilGgf2QsPl6ZZ44fnv0/b8T3nQyvzxidxsg/ZltbWssbsRDlYW8UKSQMTGotuTotZ6A==
 
+"@react-dnd/invariant@^2.0.0":
+  version "2.0.0"
+  resolved "https://registry.npmjs.org/@react-dnd/invariant/-/invariant-2.0.0.tgz#09d2e81cd39e0e767d7da62df9325860f24e517e"
+  integrity sha512-xL4RCQBCBDJ+GRwKTFhGUW8GXa4yoDfJrPbLblc3U09ciS+9ZJXJ3Qrcs/x2IODOdIE5kQxvMmE2UKyqUictUw==
+
 "@react-dnd/invariant@^4.0.1":
   version "4.0.2"
   resolved "https://registry.npmjs.org/@react-dnd/invariant/-/invariant-4.0.2.tgz#b92edffca10a26466643349fac7cdfb8799769df"
   integrity sha512-xKCTqAK/FFauOM9Ta2pswIyT3D8AQlfrYdOi/toTPEhqCuAs1v5tcJ3Y08Izh1cJ5Jchwy9SeAXmMg6zrKs2iw==
 
+"@react-dnd/shallowequal@^2.0.0":
+  version "2.0.0"
+  resolved "https://registry.npmjs.org/@react-dnd/shallowequal/-/shallowequal-2.0.0.tgz#a3031eb54129f2c66b2753f8404266ec7bf67f0a"
+  integrity sha512-Pc/AFTdwZwEKJxFJvlxrSmGe/di+aAOBn60sremrpLo6VI/6cmiUYNNwlI5KNYttg7uypzA3ILPMPgxB2GYZEg==
+
 "@react-dnd/shallowequal@^4.0.1":
   version "4.0.2"
   resolved "https://registry.npmjs.org/@react-dnd/shallowequal/-/shallowequal-4.0.2.tgz#d1b4befa423f692fa4abf1c79209702e7d8ae4b4"
@@ -2635,6 +2650,11 @@ async@^3.2.3:
   resolved "https://registry.npmjs.org/async/-/async-3.2.4.tgz#2d22e00f8cddeb5fde5dd33522b56d1cf569a81c"
   integrity sha512-iAB+JbDEGXhyIUavoDl9WP/Jj106Kz9DEn1DPgYw5ruDn0e3Wgi3sKFm55sASdGBNOQB8F59d9qQ7deqrHA8wQ==
 
+asynckit@^0.4.0:
+  version "0.4.0"
+  resolved "https://registry.npmjs.org/asynckit/-/asynckit-0.4.0.tgz#c79ed97f7f34cb8f2ba1bc9790bcc366474b4b79"
+  integrity sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q==
+
 attr-accept@^2.2.2:
   version "2.2.2"
   resolved "https://registry.npmjs.org/attr-accept/-/attr-accept-2.2.2.tgz#646613809660110749e92f2c10833b70968d929b"
@@ -2665,12 +2685,14 @@ axios-mock-adapter@^1.17.0:
     fast-deep-equal "^3.1.3"
     is-buffer "^2.0.5"
 
-axios@^0.21.1:
-  version "0.21.4"
-  resolved "https://registry.npmjs.org/axios/-/axios-0.21.4.tgz#c67b90dc0568e5c1cf2b0b858c43ba28e2eda575"
-  integrity sha512-ut5vewkiu8jjGBdqpM44XxjuCjq9LAKeHVmoVfHVzy8eHgxxq8SbAVQNovDA8mVi05kP0Ea/n/UzcSHcTJQfNg==
+axios@^1.4.0:
+  version "1.4.0"
+  resolved "https://registry.npmjs.org/axios/-/axios-1.4.0.tgz#38a7bf1224cd308de271146038b551d725f0be1f"
+  integrity sha512-S4XCWMEmzvo64T9GfvQDOXgYRDJ/wsSZc7Jvdgx5u1sd0JwsuPLqb3SYmusag+edF6ziyMensPVqLTSc1PiSEA==
   dependencies:
-    follow-redirects "^1.14.0"
+    follow-redirects "^1.15.0"
+    form-data "^4.0.0"
+    proxy-from-env "^1.1.0"
 
 babel-code-frame@^6.26.0:
   version "6.26.0"
@@ -2906,7 +2928,7 @@ bin-version@^3.0.0:
     execa "^1.0.0"
     find-versions "^3.0.0"
 
-"bin-wrapper@^4.0.0", "bin-wrapper@^4.0.1":
+bin-wrapper@^4.0.0:
   version "4.1.0"
   resolved "https://registry.npmjs.org/bin-wrapper/-/bin-wrapper-4.1.0.tgz#99348f2cf85031e3ef7efce7e5300aeaae960605"
   integrity sha512-hfRmo7hWIXPkbpi0ZltboCMVrU+0ClXR/JgbCKKjlDjQf6igXa7OwdqNcFWQZPZTgiY7ZpzE3+LjjkLiTN2T7Q==
@@ -3546,6 +3568,13 @@ colorette@^2.0.14:
     lodash.memoize "~3.0.3"
     source-map "~0.5.3"
 
+combined-stream@^1.0.8:
+  version "1.0.8"
+  resolved "https://registry.npmjs.org/combined-stream/-/combined-stream-1.0.8.tgz#c3d45a8b34fd730631a110a8a2520682b31d5a7f"
+  integrity sha512-FQN4MRfuJeHf7cBbBMJFXhKSDq+2kAArBlmRBvcvFE5BB1HZKXtSFASDhdlz9zOYwxh8lDdnvmMOe/+5cdoEdg==
+  dependencies:
+    delayed-stream "~1.0.0"
+
 "commander@^2.19.0", "commander@^2.20.0", "commander@^2.8.1":
   version "2.20.3"
   resolved "https://registry.npmjs.org/commander/-/commander-2.20.3.tgz#fd485e84c03eb4881c20722ba48035e8531aeb33"
@@ -4211,6 +4240,11 @@ defined@^1.0.0:
   resolved "https://registry.npmjs.org/defined/-/defined-1.0.1.tgz#c0b9db27bfaffd95d6f61399419b893df0f91ebf"
   integrity sha512-hsBd2qSVCRE+5PmNdHt1uzyrFu5d3RwmFDKzyNZMFq/EwDNJF7Ee5+D5oEKF0hU6LhtoUF1macFvOe4AskQC1Q==
 
+delayed-stream@~1.0.0:
+  version "1.0.0"
+  resolved "https://registry.npmjs.org/delayed-stream/-/delayed-stream-1.0.0.tgz#df3ae199acadfb7d440aaae0b29e2272b24ec619"
+  integrity sha512-ZySD7Nf91aLB0RxL4KGrKHBXl7Eds1DAmEdcoVawXnLD7SDhpNgtuII2aAkg7a7QS41jxPSZ17p4VdGnMHk3MQ==
+
 delegates@^1.0.0:
   version "1.0.0"
   resolved "https://registry.npmjs.org/delegates/-/delegates-1.0.0.tgz#84c6e159b81904fdca59a0ef44cd870d31250f9a"
@@ -4294,6 +4328,15 @@ discontinuous-range@1.0.0:
   resolved "https://registry.npmjs.org/discontinuous-range/-/discontinuous-range-1.0.0.tgz#e38331f0844bba49b9a9cb71c771585aab1bc65a"
   integrity sha512-c68LpLbO+7kP/b1Hr1qs8/BJ09F5khZGTxqxZuhzxpmwJKOgRFHJWIb9/KmqnqHhLdO55aOxFH/EGBvUQbL/RQ==
 
+dnd-core@14.0.1:
+  version "14.0.1"
+  resolved "https://registry.npmjs.org/dnd-core/-/dnd-core-14.0.1.tgz#76d000e41c494983210fb20a48b835f81a203c2e"
+  integrity sha512-+PVS2VPTgKFPYWo3vAFEA8WPbTf7/xo43TifH9G8S1KqnrQu0o77A3unrF5yOugy4mIz7K5wAVFHUcha7wsz6A==
+  dependencies:
+    "@react-dnd/asap" "^4.0.0"
+    "@react-dnd/invariant" "^2.0.0"
+    redux "^4.1.1"
+
 dnd-core@^16.0.1:
   version "16.0.1"
   resolved "https://registry.npmjs.org/dnd-core/-/dnd-core-16.0.1.tgz#a1c213ed08961f6bd1959a28bb76f1a868360d19"
@@ -4368,20 +4411,20 @@ domain-browser@^1.2.0:
   resolved "https://registry.npmjs.org/domelementtype/-/domelementtype-2.3.0.tgz#5c45e8e869952626331d7aab326d01daf65d589d"
   integrity sha512-OLETBj6w0OsagBwdXnPdN0cnMfF9opN69co+7ZrbfPGrdpPVNBUj02spi6B1N7wChLQiPn4CSH/zJvXw56gmHw==
 
-"domhandler@4.3.1", "domhandler@^4.2.0", "domhandler@^4.2.2", "domhandler@^4.3.1":
-  version "4.3.1"
-  resolved "https://registry.npmjs.org/domhandler/-/domhandler-4.3.1.tgz#8d792033416f59d68bc03a5aa7b018c1ca89279c"
-  integrity sha512-GrwoxYN+uWlzO8uhUXRl0P+kHE4GtVPfYzVLcUxPL7KNdHKj66vvlhiweIHqYYXWlw+T8iLMp42Lm67ghw4WMQ==
-  dependencies:
-    domelementtype "^2.2.0"
-
-"domhandler@^5.0.2", "domhandler@^5.0.3":
+"domhandler@5.0.3", "domhandler@^5.0.2", "domhandler@^5.0.3":
   version "5.0.3"
   resolved "https://registry.npmjs.org/domhandler/-/domhandler-5.0.3.tgz#cc385f7f751f1d1fc650c21374804254538c7d31"
   integrity sha512-cgwlv/1iFQiFnU96XXgROh8xTeetsnJiDsTc7TYCLFd9+/WNkIqPTxiM/8pSd8VIrhXGTf1Ny1q1hquVqDJB5w==
   dependencies:
     domelementtype "^2.3.0"
 
+"domhandler@^4.2.0", "domhandler@^4.3.1":
+  version "4.3.1"
+  resolved "https://registry.npmjs.org/domhandler/-/domhandler-4.3.1.tgz#8d792033416f59d68bc03a5aa7b018c1ca89279c"
+  integrity sha512-GrwoxYN+uWlzO8uhUXRl0P+kHE4GtVPfYzVLcUxPL7KNdHKj66vvlhiweIHqYYXWlw+T8iLMp42Lm67ghw4WMQ==
+  dependencies:
+    domelementtype "^2.2.0"
+
 domutils@^2.8.0:
   version "2.8.0"
   resolved "https://registry.npmjs.org/domutils/-/domutils-2.8.0.tgz#4437def5db6e2d1f5d6ee859bd95ca7d02048135"
@@ -4391,7 +4434,7 @@ domutils@^2.8.0:
     domelementtype "^2.2.0"
     domhandler "^4.2.0"
 
-domutils@^3.0.1:
+"domutils@^3.0.1", "domutils@^3.1.0":
   version "3.1.0"
   resolved "https://registry.npmjs.org/domutils/-/domutils-3.1.0.tgz#c47f551278d3dc4b0b1ab8cbb42d751a6f0d824e"
   integrity sha512-H78uMmQtI2AhgDJjWeQmHwJJ2bLPD3GMmO7Zja/ZZh84wkm+4ut+IUnUdRa8uCGX88DiVx1j6FRe1XfxEgjEZA==
@@ -4571,12 +4614,7 @@ entities@^2.0.0:
   resolved "https://registry.npmjs.org/entities/-/entities-2.2.0.tgz#098dc90ebb83d8dffa089d55256b351d34c4da55"
   integrity sha512-p92if5Nz619I0w+akJrLZH0MX0Pb5DX39XOwQTtXSdQQOaYH03S1uIQp4mhOZtAXrxq4ViO67YTiLBo2638o9A==
 
-entities@^3.0.1:
-  version "3.0.1"
-  resolved "https://registry.npmjs.org/entities/-/entities-3.0.1.tgz#2b887ca62585e96db3903482d336c1006c3001d4"
-  integrity sha512-WiyBqoomrwMdFG1e0kqvASYfnlb0lp8M5o5Fw2OFq1hNZxxcNk8Ik0Xm7LxzBhuidnZB/UtBqVCgUz3kBOP51Q==
-
-"entities@^4.2.0", "entities@^4.4.0":
+"entities@^4.2.0", "entities@^4.4.0", "entities@^4.5.0":
   version "4.5.0"
   resolved "https://registry.npmjs.org/entities/-/entities-4.5.0.tgz#5d268ea5e7113ec74c4d033b79ea5a35a488fb48"
   integrity sha512-V0hjH4dGPh9Ao5p0MoRY6BVqtwCjhz6vI5LT8AJ55H+4g9/4vbHx1I54fS0XuclLhDHArPQCiMjDxjaL8fPxhw==
@@ -4948,21 +4986,6 @@ execa@^1.0.0:
     signal-exit "^3.0.0"
     strip-eof "^1.0.0"
 
-execa@^4.0.0:
-  version "4.1.0"
-  resolved "https://registry.npmjs.org/execa/-/execa-4.1.0.tgz#4e5491ad1572f2f17a77d388c6c857135b22847a"
-  integrity sha512-j5W0//W7f8UxAn8hXVnwG8tLwdiUy4FJLcSupCg6maBYZDpyBvTApK7KyuI4bKj8KOh1r2YH+6ucuYtJv1bTZA==
-  dependencies:
-    cross-spawn "^7.0.0"
-    get-stream "^5.0.0"
-    human-signals "^1.1.1"
-    is-stream "^2.0.0"
-    merge-stream "^2.0.0"
-    npm-run-path "^4.0.0"
-    onetime "^5.1.0"
-    signal-exit "^3.0.2"
-    strip-final-newline "^2.0.0"
-
 execa@^6.0.0:
   version "6.1.0"
   resolved "https://registry.npmjs.org/execa/-/execa-6.1.0.tgz#cea16dee211ff011246556388effa0818394fb20"
@@ -5221,7 +5244,7 @@ flat-cache@^3.0.4:
   resolved "https://registry.npmjs.org/flatted/-/flatted-3.2.7.tgz#609f39207cb614b89d0765b477cb2d437fbf9787"
   integrity sha512-5nqDSxl8nn5BSNxyR3n4I6eDmbolI6WT+QqR547RwxQapgjQBmtktdP+HTBb/a/zLsbzERTONyUB5pefh5TtjQ==
 
-"follow-redirects@^1.0.0", "follow-redirects@^1.14.0":
+"follow-redirects@^1.0.0", "follow-redirects@^1.15.0":
   version "1.15.2"
   resolved "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.2.tgz#b460864144ba63f2681096f274c4e57026da2c13"
   integrity sha512-VQLG33o04KaQ8uYi2tVNbdrWp1QWxNNea+nmIB4EVM28v0hmP17z7aG1+wAkNzVq4KeXTq3221ye5qTJP91JwA==
@@ -5241,6 +5264,15 @@ foreground-child@^3.1.0:
     cross-spawn "^7.0.0"
     signal-exit "^4.0.1"
 
+form-data@^4.0.0:
+  version "4.0.0"
+  resolved "https://registry.npmjs.org/form-data/-/form-data-4.0.0.tgz#93919daeaf361ee529584b9b31664dc12c9fa452"
+  integrity sha512-ETEklSGi5t0QMZuiXoA/Q6vcnxcLQP5vdugSpuAyi6SVGi2clPPp+xgEhuMaHC+zGgn31Kd235W35f7Hykkaww==
+  dependencies:
+    asynckit "^0.4.0"
+    combined-stream "^1.0.8"
+    mime-types "^2.1.12"
+
 fraction.js@^4.2.0:
   version "4.2.0"
   resolved "https://registry.npmjs.org/fraction.js/-/fraction.js-4.2.0.tgz#448e5109a313a3527f5a3ab2119ec4cf0e0e2950"
@@ -5385,13 +5417,6 @@ get-stream@^4.0.0:
   dependencies:
     pump "^3.0.0"
 
-get-stream@^5.0.0:
-  version "5.2.0"
-  resolved "https://registry.npmjs.org/get-stream/-/get-stream-5.2.0.tgz#4966a1795ee5ace65e706c4b7beb71257d6e22d3"
-  integrity sha512-nBF+F1rAZVCu/p7rjzgA+Yb4lfYXrpl7a6VmJrU8wF9I1CKvP/QwPNZHnOlwbTkY6dvtFIzFMSyQXbLoTQPRpA==
-  dependencies:
-    pump "^3.0.0"
-
 get-stream@^6.0.1:
   version "6.0.1"
   resolved "https://registry.npmjs.org/get-stream/-/get-stream-6.0.1.tgz#a262d8eef67aced57c2852ad6167526a43cbf7b7"
@@ -5726,13 +5751,13 @@ hosted-git-info@^4.0.1:
   dependencies:
     lru-cache "^6.0.0"
 
-html-dom-parser@1.2.0:
-  version "1.2.0"
-  resolved "https://registry.npmjs.org/html-dom-parser/-/html-dom-parser-1.2.0.tgz#8f689b835982ffbf245eda99730e92b8462c111e"
-  integrity sha512-2HIpFMvvffsXHFUFjso0M9LqM+1Lm22BF+Df2ba+7QHJXjk63pWChEnI6YG27eaWqUdfnh5/Vy+OXrNTtepRsg==
+html-dom-parser@4.0.0:
+  version "4.0.0"
+  resolved "https://registry.npmjs.org/html-dom-parser/-/html-dom-parser-4.0.0.tgz#dc382fbbc9306f8c9b5aae4e3f2822e113a48709"
+  integrity sha512-TUa3wIwi80f5NF8CVWzkopBVqVAtlawUzJoLwVLHns0XSJGynss4jiY0mTWpiDOsuyw+afP+ujjMgRh9CoZcXw==
   dependencies:
-    domhandler "4.3.1"
-    htmlparser2 "7.2.0"
+    domhandler "5.0.3"
+    htmlparser2 "9.0.0"
 
 html-element-map@^1.2.0:
   version "1.3.1"
@@ -5747,15 +5772,15 @@ html-escaper@^2.0.0:
   resolved "https://registry.npmjs.org/html-escaper/-/html-escaper-2.0.2.tgz#dfd60027da36a36dfcbe236262c00a5822681453"
   integrity sha512-H2iMtd0I4Mt5eYiapRdIDjp+XzelXQ0tFE4JS7YFwFevXXMmOp9myNrUvCg0D6ws8iqkRPBfKHgbwig1SmlLfg==
 
-html-react-parser@^1.2.7:
-  version "1.4.14"
-  resolved "https://registry.npmjs.org/html-react-parser/-/html-react-parser-1.4.14.tgz#577b7a90be0c61eebbbc488d914ad08398c79ef5"
-  integrity sha512-pxhNWGie8Y+DGDpSh8cTa0k3g8PsDcwlfolA+XxYo1AGDeB6e2rdlyv4ptU9bOTiZ2i3fID+6kyqs86MN0FYZQ==
+html-react-parser@^4.2.0:
+  version "4.2.0"
+  resolved "https://registry.npmjs.org/html-react-parser/-/html-react-parser-4.2.0.tgz#9168eda80dbfe0335a87fde3fb3ed6c2e91b1188"
+  integrity sha512-gzU55AS+FI6qD7XaKe5BLuLFM2Xw0/LodfMWZlxV9uOHe7LCD5Lukx/EgYuBI3c0kLu0XlgFXnSzO0qUUn3Vrg==
   dependencies:
-    domhandler "4.3.1"
-    html-dom-parser "1.2.0"
+    domhandler "5.0.3"
+    html-dom-parser "4.0.0"
     react-property "2.0.0"
-    style-to-js "1.1.1"
+    style-to-js "1.1.3"
 
 html2canvas@^1.0.0-rc.7:
   version "1.4.1"
@@ -5770,15 +5795,15 @@ htmlescape@^1.1.0:
   resolved "https://registry.npmjs.org/htmlescape/-/htmlescape-1.1.1.tgz#3a03edc2214bca3b66424a3e7959349509cb0351"
   integrity sha512-eVcrzgbR4tim7c7soKQKtxa/kQM4TzjnlU83rcZ9bHU6t31ehfV7SktN6McWgwPWg+JYMA/O3qpGxBvFq1z2Jg==
 
-htmlparser2@7.2.0:
-  version "7.2.0"
-  resolved "https://registry.npmjs.org/htmlparser2/-/htmlparser2-7.2.0.tgz#8817cdea38bbc324392a90b1990908e81a65f5a5"
-  integrity sha512-H7MImA4MS6cw7nbyURtLPO1Tms7C5H602LRETv95z1MxO/7CP7rDVROehUYeYBUYEON94NXXDEPmZuq+hX4sog==
+htmlparser2@9.0.0:
+  version "9.0.0"
+  resolved "https://registry.npmjs.org/htmlparser2/-/htmlparser2-9.0.0.tgz#e431142b7eeb1d91672742dea48af8ac7140cddb"
+  integrity sha512-uxbSI98wmFT/G4P2zXx4OVx04qWUmyFPrD2/CNepa2Zo3GPNaCaaxElDgwUrwYWkK1nr9fft0Ya8dws8coDLLQ==
   dependencies:
-    domelementtype "^2.0.1"
-    domhandler "^4.2.2"
-    domutils "^2.8.0"
-    entities "^3.0.1"
+    domelementtype "^2.3.0"
+    domhandler "^5.0.3"
+    domutils "^3.1.0"
+    entities "^4.5.0"
 
 htmlparser2@^8.0.1:
   version "8.0.2"
@@ -5842,11 +5867,6 @@ https-proxy-agent@^5.0.0:
     agent-base 6
     debug 4
 
-human-signals@^1.1.1:
-  version "1.1.1"
-  resolved "https://registry.npmjs.org/human-signals/-/human-signals-1.1.1.tgz#c5b1cd14f50aeae09ab6c59fe63ba3395fe4dfa3"
-  integrity sha512-SEQu7vl8KjNL2eoGBLF3+wAjpsNfA9XMlXAYj/3EdaNfAlxKthD1xjEQfGOUhllCGGJVNY34bRr6lPINhNjyZw==
-
 human-signals@^3.0.1:
   version "3.0.1"
   resolved "https://registry.npmjs.org/human-signals/-/human-signals-3.0.1.tgz#c740920859dafa50e5a3222da9d3bf4bb0e5eef5"
@@ -5919,17 +5939,6 @@ imagemin-optipng@^8.0.0:
     is-png "^2.0.0"
     optipng-bin "^7.0.0"
 
-imagemin-pngquant@^9.0.2:
-  version "9.0.2"
-  resolved "https://registry.npmjs.org/imagemin-pngquant/-/imagemin-pngquant-9.0.2.tgz#38155702b0cc4f60f671ba7c2b086ea3805d9567"
-  integrity sha512-cj//bKo8+Frd/DM8l6Pg9pws1pnDUjgb7ae++sUX1kUVdv2nrngPykhiUOgFeE0LGY/LmUbCf4egCHC4YUcZSg==
-  dependencies:
-    execa "^4.0.0"
-    is-png "^2.0.0"
-    is-stream "^2.0.0"
-    ow "^0.17.0"
-    pngquant-bin "^6.0.0"
-
 imagemin@^8.0.1:
   version "8.0.1"
   resolved "https://registry.npmjs.org/imagemin/-/imagemin-8.0.1.tgz#8b29ecb78197d8f0eac6a782f2e6b38fb3780d9e"
@@ -6303,11 +6312,6 @@ is-shared-array-buffer@^1.0.2:
   resolved "https://registry.npmjs.org/is-stream/-/is-stream-1.1.0.tgz#12d4a3dd4e68e0b79ceb8dbc84173ae80d91ca44"
   integrity sha512-uQPm8kcs47jx38atAcWTVxyltQYoPT68y9aWYdV6yWXSyW8mzSat0TL6CiWdZeCdF3KrAvpVtnHbTv4RN+rqdQ==
 
-is-stream@^2.0.0:
-  version "2.0.1"
-  resolved "https://registry.npmjs.org/is-stream/-/is-stream-2.0.1.tgz#fac1e3d53b97ad5a9d0ae9cef2389f5810a5c077"
-  integrity sha512-hFoiJiTl63nn+kstHGBtewWSKnQLpyb155KHheA1l39uvtO9nWIop1p3udqPcUd/xbF1VLMO4n7OI6p7RbngDg==
-
 is-stream@^3.0.0:
   version "3.0.0"
   resolved "https://registry.npmjs.org/is-stream/-/is-stream-3.0.0.tgz#e6bfd7aa6bef69f4f472ce9bb681e3e57b4319ac"
@@ -7408,7 +7412,7 @@ miller-rabin@^4.0.0:
   resolved "https://registry.npmjs.org/mime-db/-/mime-db-1.52.0.tgz#bbabcdc02859f4987301c856e3387ce5ec43bf70"
   integrity sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==
 
-"mime-types@^2.1.27", "mime-types@~2.1.24", "mime-types@~2.1.34":
+"mime-types@^2.1.12", "mime-types@^2.1.27", "mime-types@~2.1.24", "mime-types@~2.1.34":
   version "2.1.35"
   resolved "https://registry.npmjs.org/mime-types/-/mime-types-2.1.35.tgz#381a871b62a734450660ae3deee44813f70d959a"
   integrity sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==
@@ -7420,11 +7424,6 @@ mime@^2.5.2:
   resolved "https://registry.npmjs.org/mime/-/mime-2.6.0.tgz#a2a682a95cd4d0cb1d6257e28f83da7e35800367"
   integrity sha512-USPkMeET31rOMiarsBNIHZKLGgvKc/LrjofAnBlOttf5ajRvqiRA8QsenbcooctK6d6Ts6aqZXBA+XbkKthiQg==
 
-mimic-fn@^2.1.0:
-  version "2.1.0"
-  resolved "https://registry.npmjs.org/mimic-fn/-/mimic-fn-2.1.0.tgz#7ed2c2ccccaf84d3ffcb7a69b57711fc2083401b"
-  integrity sha512-OqbOk5oEQeAZ8WXWydlu9HJjz9WVdEIvamMCcXmuqUYjTknH/sqsWvhQ3vgwKFRR1HpjvNBKQ37nbJgYzGqGcg==
-
 mimic-fn@^4.0.0:
   version "4.0.0"
   resolved "https://registry.npmjs.org/mimic-fn/-/mimic-fn-4.0.0.tgz#60a90550d5cb0b239cca65d893b1a53b29871ecc"
@@ -7829,13 +7828,6 @@ npm-run-path@^2.0.0:
   dependencies:
     path-key "^2.0.0"
 
-npm-run-path@^4.0.0:
-  version "4.0.1"
-  resolved "https://registry.npmjs.org/npm-run-path/-/npm-run-path-4.0.1.tgz#b7ecd1e5ed53da8e37a55e1c2269e0b97ed748ea"
-  integrity sha512-S48WzZW777zhNIrn7gxOlISNAqi9ZC/uQFnRdbeIHhZhCA6UqpkOT8T1G7BvfdgP4Er8gF4sUbaS0i7QvIfCWw==
-  dependencies:
-    path-key "^3.0.0"
-
 npm-run-path@^5.1.0:
   version "5.1.0"
   resolved "https://registry.npmjs.org/npm-run-path/-/npm-run-path-5.1.0.tgz#bc62f7f3f6952d9894bd08944ba011a6ee7b7e00"
@@ -7949,13 +7941,6 @@ on-finished@~2.3.0:
   dependencies:
     wrappy 1
 
-onetime@^5.1.0:
-  version "5.1.2"
-  resolved "https://registry.npmjs.org/onetime/-/onetime-5.1.2.tgz#d0e96ebb56b07476df1dd9c4806e5237985ca45e"
-  integrity sha512-kbpaSSGJTWdAY5KPVeMOKXSrPtr8C8C7wodJbcsd51jRnmD+GZu8Y0VoU6Dm5Z4vWr0Ig/1NKuWRKf7j5aaYSg==
-  dependencies:
-    mimic-fn "^2.1.0"
-
 onetime@^6.0.0:
   version "6.0.0"
   resolved "https://registry.npmjs.org/onetime/-/onetime-6.0.0.tgz#7c24c18ed1fd2e9bca4bd26806a33613c77d34b4"
@@ -8005,13 +7990,6 @@ os-shim@^0.1.3:
   resolved "https://registry.npmjs.org/os-shim/-/os-shim-0.1.3.tgz#6b62c3791cf7909ea35ed46e17658bb417cb3917"
   integrity sha512-jd0cvB8qQ5uVt0lvCIexBaROw1KyKm5sbulg2fWOHjETisuCzWyt+eTZKEMs8v6HwzoGs8xik26jg7eCM6pS+A==
 
-ow@^0.17.0:
-  version "0.17.0"
-  resolved "https://registry.npmjs.org/ow/-/ow-0.17.0.tgz#4f938999fed6264c9048cd6254356e0f1e7f688c"
-  integrity sha512-i3keDzDQP5lWIe4oODyDFey1qVrq2hXKTuTH2VpqwpYtzPiKZt2ziRI4NBQmgW40AnV5Euz17OyWweCb+bNEQA==
-  dependencies:
-    type-fest "^0.11.0"
-
 p-cancelable@^0.3.0:
   version "0.3.0"
   resolved "https://registry.npmjs.org/p-cancelable/-/p-cancelable-0.3.0.tgz#b9e123800bcebb7ac13a479be195b507b98d30fa"
@@ -8212,7 +8190,7 @@ path-exists@^4.0.0:
   resolved "https://registry.npmjs.org/path-key/-/path-key-2.0.1.tgz#411cadb574c5a140d3a4b1910d40d80cc9f40b40"
   integrity sha512-fEHGKCSmUSDPv4uoj8AlD+joPlq3peND+HRYyxFz4KPw4z926S/b8rIuFs2FYJg3BwsxJf6A9/3eIdLaYC+9Dw==
 
-"path-key@^3.0.0", "path-key@^3.1.0":
+path-key@^3.1.0:
   version "3.1.1"
   resolved "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz#581f6ade658cbba65a0d3380de7753295054f375"
   integrity sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==
@@ -8332,15 +8310,6 @@ pinkie@^2.0.0:
   dependencies:
     find-up "^4.0.0"
 
-pngquant-bin@^6.0.0:
-  version "6.0.1"
-  resolved "https://registry.npmjs.org/pngquant-bin/-/pngquant-bin-6.0.1.tgz#2b5789ca219eeb4d8509ab1ae082092801b7f07e"
-  integrity sha512-Q3PUyolfktf+hYio6wsg3SanQzEU/v8aICg/WpzxXcuCMRb7H2Q81okfpcEztbMvw25ILjd3a87doj2N9kvbpQ==
-  dependencies:
-    bin-build "^3.0.0"
-    bin-wrapper "^4.0.1"
-    execa "^4.0.0"
-
 popper.js@1.16.1-lts:
   version "1.16.1-lts"
   resolved "https://registry.npmjs.org/popper.js/-/popper.js-1.16.1-lts.tgz#cf6847b807da3799d80ee3d6d2f90df8a3f50b05"
@@ -8855,6 +8824,11 @@ proto-list@~1.2.1:
   resolved "https://registry.npmjs.org/proto-list/-/proto-list-1.2.4.tgz#212d5bfe1318306a420f6402b8e26ff39647a849"
   integrity sha512-vtK/94akxsTMhe0/cbfpR+syPuszcuwhqVjJq26CuNDgFGj682oRBXOP5MJpv2r7JtE8MsiepGIqvvOTBwn2vA==
 
+proxy-from-env@^1.1.0:
+  version "1.1.0"
+  resolved "https://registry.npmjs.org/proxy-from-env/-/proxy-from-env-1.1.0.tgz#e102f16ca355424865755d2c9e8ea4f24d58c3e2"
+  integrity sha512-D+zkORCbA9f1tdWRK0RaCR3GPv50cMxcrz4X8k5LTSUD1Dkw47mKJEZQNunItRTkWwgtaUSo1RVFRIG9ZXiFYg==
+
 pseudomap@^1.0.2:
   version "1.0.2"
   resolved "https://registry.npmjs.org/pseudomap/-/pseudomap-1.0.2.tgz#f052a28da70e618917ef0a8ac34c1ae5a68286b3"
@@ -9133,6 +9107,17 @@ re-resizable@6.9.6:
   dependencies:
     fast-memoize "^2.5.1"
 
+react-arborist@^3.2.0:
+  version "3.2.0"
+  resolved "https://registry.npmjs.org/react-arborist/-/react-arborist-3.2.0.tgz#f17d726e7d18fcb1494b83ffadfecc8c9bda5dff"
+  integrity sha512-sjGL1KIRogwkM5uVifpp01yrfTcIHsm62Kbs78kBbPuksrnJPZ13SAqAqZeXVuyvO0Tbd7odExF/KoHtXHIZaQ==
+  dependencies:
+    react-dnd "^14.0.3"
+    react-dnd-html5-backend "^14.0.1"
+    react-window "^1.8.6"
+    redux "^4.1.1"
+    use-sync-external-store "^1.2.0"
+
 react-aspen@^1.1.0:
   version "1.2.0"
   resolved "https://registry.npmjs.org/react-aspen/-/react-aspen-1.2.0.tgz#375fa82a8db627542fc8b9e6e421baa49a65ab95"
@@ -9154,6 +9139,13 @@ react-checkbox-tree@^1.7.2:
     nanoid "^3.0.0"
     prop-types "^15.5.8"
 
+react-dnd-html5-backend@^14.0.1:
+  version "14.1.0"
+  resolved "https://registry.npmjs.org/react-dnd-html5-backend/-/react-dnd-html5-backend-14.1.0.tgz#b35a3a0c16dd3a2bfb5eb7ec62cf0c2cace8b62f"
+  integrity sha512-6ONeqEC3XKVf4eVmMTe0oPds+c5B9Foyj8p/ZKLb7kL2qh9COYxiBHv3szd6gztqi/efkmriywLUVlPotqoJyw==
+  dependencies:
+    dnd-core "14.0.1"
+
 react-dnd-html5-backend@^16.0.1:
   version "16.0.1"
   resolved "https://registry.npmjs.org/react-dnd-html5-backend/-/react-dnd-html5-backend-16.0.1.tgz#87faef15845d512a23b3c08d29ecfd34871688b6"
@@ -9161,6 +9153,17 @@ react-dnd-html5-backend@^16.0.1:
   dependencies:
     dnd-core "^16.0.1"
 
+react-dnd@^14.0.3:
+  version "14.0.5"
+  resolved "https://registry.npmjs.org/react-dnd/-/react-dnd-14.0.5.tgz#ecf264e220ae62e35634d9b941502f3fca0185ed"
+  integrity sha512-9i1jSgbyVw0ELlEVt/NkCUkxy1hmhJOkePoCH713u75vzHGyXhPDm28oLfc2NMSBjZRM1Y+wRjHXJT3sPrTy+A==
+  dependencies:
+    "@react-dnd/invariant" "^2.0.0"
+    "@react-dnd/shallowequal" "^2.0.0"
+    dnd-core "14.0.1"
+    fast-deep-equal "^3.1.3"
+    hoist-non-react-statics "^3.3.2"
+
 react-dnd@^16.0.1:
   version "16.0.1"
   resolved "https://registry.npmjs.org/react-dnd/-/react-dnd-16.0.1.tgz#2442a3ec67892c60d40a1559eef45498ba26fa37"
@@ -9319,7 +9322,7 @@ react-virtualized-auto-sizer@^1.0.6:
   resolved "https://registry.npmjs.org/react-virtualized-auto-sizer/-/react-virtualized-auto-sizer-1.0.20.tgz#d9a907253a7c221c52fa57dc775a6ef40c182645"
   integrity sha512-OdIyHwj4S4wyhbKHOKM1wLSj/UDXm839Z3Cvfg2a9j+He6yDa6i5p0qQvEiCnyQlGO/HyfSnigQwuxvYalaAXA==
 
-"react-window@^1.3.1", "react-window@^1.8.5":
+"react-window@^1.3.1", "react-window@^1.8.5", "react-window@^1.8.6":
   version "1.8.9"
   resolved "https://registry.npmjs.org/react-window/-/react-window-1.8.9.tgz#24bc346be73d0468cdf91998aac94e32bc7fa6a8"
   integrity sha512-+Eqx/fj1Aa5WnhRfj9dJg4VYATGwIUP2ItwItiJ6zboKWA6EX3lYDAXfGF2hyNqplEprhbtjbipiADEcwQ823Q==
@@ -9422,7 +9425,7 @@ redent@^4.0.0:
     indent-string "^5.0.0"
     strip-indent "^4.0.0"
 
-redux@^4.2.0:
+"redux@^4.1.1", "redux@^4.2.0":
   version "4.2.1"
   resolved "https://registry.npmjs.org/redux/-/redux-4.2.1.tgz#c08f4306826c49b5e9dc901dee0452ea8fce6197"
   integrity sha512-LAUYz4lc+Do8/g7aeRa8JkyDErK6ekstQaqWQrNRW//MY1TvCEpMtpTWvlQ+FPbWCx+Xixu/6SHt5N0HR+SB4w==
@@ -9851,7 +9854,7 @@ side-channel@^1.0.4:
     get-intrinsic "^1.0.2"
     object-inspect "^1.9.0"
 
-"signal-exit@^3.0.0", "signal-exit@^3.0.2", "signal-exit@^3.0.7":
+"signal-exit@^3.0.0", "signal-exit@^3.0.7":
   version "3.0.7"
   resolved "https://registry.npmjs.org/signal-exit/-/signal-exit-3.0.7.tgz#a9a1767f8af84155114eaabd73f99273c8f59ad9"
   integrity sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ==
@@ -10235,11 +10238,6 @@ strip-eof@^1.0.0:
   resolved "https://registry.npmjs.org/strip-eof/-/strip-eof-1.0.0.tgz#bb43ff5598a6eb05d89b59fcd129c983313606bf"
   integrity sha512-7FCwGGmx8mD5xQd3RPUvnSpUXHM3BWuzjtpD4TXsfcZ9EL4azvVVUscFYwD9nx8Kh+uCBC00XBtAykoMHwTh8Q==
 
-strip-final-newline@^2.0.0:
-  version "2.0.0"
-  resolved "https://registry.npmjs.org/strip-final-newline/-/strip-final-newline-2.0.0.tgz#89b852fb2fcbe936f6f4b3187afb0a12c1ab58ad"
-  integrity sha512-BrpvfNAE3dcvq7ll3xVumzjKjZQ5tI1sEUIKr3Uoks0XUl45St3FlatVqef9prk4jRDzhW6WZg+3bk93y6pLjA==
-
 strip-final-newline@^3.0.0:
   version "3.0.0"
   resolved "https://registry.npmjs.org/strip-final-newline/-/strip-final-newline-3.0.0.tgz#52894c313fbff318835280aed60ff71ebf12b8fd"
@@ -10277,17 +10275,17 @@ style-loader@^3.3.2:
   resolved "https://registry.npmjs.org/style-loader/-/style-loader-3.3.3.tgz#bba8daac19930169c0c9c96706749a597ae3acff"
   integrity sha512-53BiGLXAcll9maCYtZi2RCQZKa8NQQai5C4horqKyRmHj9H7QmcUyucrH+4KW/gBQbXM2AsB0axoEcFZPlfPcw==
 
-style-to-js@1.1.1:
-  version "1.1.1"
-  resolved "https://registry.npmjs.org/style-to-js/-/style-to-js-1.1.1.tgz#417786986cda61d4525c80aed9d1123a6a7af9b8"
-  integrity sha512-RJ18Z9t2B02sYhZtfWKQq5uplVctgvjTfLWT7+Eb1zjUjIrWzX5SdlkwLGQozrqarTmEzJJ/YmdNJCUNI47elg==
+style-to-js@1.1.3:
+  version "1.1.3"
+  resolved "https://registry.npmjs.org/style-to-js/-/style-to-js-1.1.3.tgz#2012d75dc89bf400edc29c545ed61c8626b00184"
+  integrity sha512-zKI5gN/zb7LS/Vm0eUwjmjrXWw8IMtyA8aPBJZdYiQTXj4+wQ3IucOLIOnF7zCHxvW8UhIGh/uZh/t9zEHXNTQ==
   dependencies:
-    style-to-object "0.3.0"
+    style-to-object "0.4.1"
 
-style-to-object@0.3.0:
-  version "0.3.0"
-  resolved "https://registry.npmjs.org/style-to-object/-/style-to-object-0.3.0.tgz#b1b790d205991cc783801967214979ee19a76e46"
-  integrity sha512-CzFnRRXhzWIdItT3OmF8SQfWyahHhjq3HwcMNCNLn+N7klOOqPjMeG/4JSu77D7ypZdGvSzvkrbyeTMizz2VrA==
+style-to-object@0.4.1:
+  version "0.4.1"
+  resolved "https://registry.npmjs.org/style-to-object/-/style-to-object-0.4.1.tgz#53cf856f7cf7f172d72939d9679556469ba5de37"
+  integrity sha512-HFpbb5gr2ypci7Qw+IOhnP2zOU7e77b+rzM+wTzXzfi1PrtBCX0E7Pk4wL4iTLnhzZ+JgEGAhX81ebTg/aYjQw==
   dependencies:
     inline-style-parser "0.1.1"
 
@@ -10691,11 +10689,6 @@ tunnel-agent@^0.6.0:
   dependencies:
     prelude-ls "^1.2.1"
 
-type-fest@^0.11.0:
-  version "0.11.0"
-  resolved "https://registry.npmjs.org/type-fest/-/type-fest-0.11.0.tgz#97abf0872310fed88a5c466b25681576145e33f1"
-  integrity sha512-OdjXJxnCN1AvyLSzeKIgXTXxV+99ZuXl3Hpo9XpJAv9MBcHrrJOQ5kV7ypXOuQie+AmWG25hLbiKdwYTifzcfQ==
-
 type-fest@^0.20.2:
   version "0.20.2"
   resolved "https://registry.npmjs.org/type-fest/-/type-fest-0.20.2.tgz#1bf207f4b28f91583666cb5fbd327887301cd5f4"
@@ -10905,6 +10898,11 @@ use-isomorphic-layout-effect@^1.1.2:
   resolved "https://registry.npmjs.org/use-isomorphic-layout-effect/-/use-isomorphic-layout-effect-1.1.2.tgz#497cefb13d863d687b08477d9e5a164ad8c1a6fb"
   integrity sha512-49L8yCO3iGT/ZF9QttjwLF/ZD9Iwto5LnH5LmEdk/6cFmXddqi2ulF0edxTwjj+7mqvpVVGQWvbXZdn32wRSHA==
 
+use-sync-external-store@^1.2.0:
+  version "1.2.0"
+  resolved "https://registry.npmjs.org/use-sync-external-store/-/use-sync-external-store-1.2.0.tgz#7dbefd6ef3fe4e767a0cf5d7287aacfb5846928a"
+  integrity sha512-eEgnFxGQ1Ife9bzYs6VLi8/4X6CObHMw9Qr9tPY43iKwsPw8xE8+EFsf/2cFZ5S3esXgpWgtSCtLNS41F+sKPA==
+
 "util-deprecate@^1.0.1", "util-deprecate@^1.0.2", "util-deprecate@~1.0.1":
   version "1.0.2"
   resolved "https://registry.npmjs.org/util-deprecate/-/util-deprecate-1.0.2.tgz#450d4dc9fa70de732762fbd2d4a28981419a0ccf"
diff --git a/pkgs/tools/admin/stripe-cli/default.nix b/pkgs/tools/admin/stripe-cli/default.nix
index 45fdbff60321..3fc6a6dba776 100644
--- a/pkgs/tools/admin/stripe-cli/default.nix
+++ b/pkgs/tools/admin/stripe-cli/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "stripe-cli";
-  version = "1.17.2";
+  version = "1.18.0";
 
   src = fetchFromGitHub {
     owner = "stripe";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-MzzjrGtqbtZMvfL7dPAsKHF2ZTneSdtDuwHQQcyrQDw=";
+    hash = "sha256-1AdR0PHAhrMbeCD5zNsU9JoXInQD+qUIYfveBD60wR0=";
   };
   vendorHash = "sha256-DYA6cu2KzEBZ4wsT7wjcdY1endQQOZlj2aOwu6iGLew=";
 
diff --git a/pkgs/tools/archivers/payload-dumper-go/default.nix b/pkgs/tools/archivers/payload-dumper-go/default.nix
index bb1572e1ceb6..bb1572e1ceb6 100755..100644
--- a/pkgs/tools/archivers/payload-dumper-go/default.nix
+++ b/pkgs/tools/archivers/payload-dumper-go/default.nix
diff --git a/pkgs/tools/audio/openai-whisper-cpp/default.nix b/pkgs/tools/audio/openai-whisper-cpp/default.nix
index f6d83690824f..f19425201cde 100644
--- a/pkgs/tools/audio/openai-whisper-cpp/default.nix
+++ b/pkgs/tools/audio/openai-whisper-cpp/default.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "whisper-cpp";
-  version = "1.4.0";
+  version = "1.4.2";
 
   src = fetchFromGitHub {
     owner = "ggerganov";
     repo = "whisper.cpp";
     rev = "refs/tags/v${version}" ;
-    hash = "sha256-176MpooVQrq1dXC62h8Yyyhw6IjCA50tp1J4DQPSePQ=";
+    hash = "sha256-Qea9zGLJ41D+l8h1Sg/KJI6Ou02jtbRIxYPGoabM8nY=";
   };
 
   # The upstream download script tries to download the models to the
diff --git a/pkgs/tools/graphics/wdisplays/default.nix b/pkgs/tools/graphics/wdisplays/default.nix
index b05aa13ea601..9c7093b58f85 100644
--- a/pkgs/tools/graphics/wdisplays/default.nix
+++ b/pkgs/tools/graphics/wdisplays/default.nix
@@ -1,24 +1,20 @@
 { lib, stdenv, fetchFromGitHub, meson, ninja, pkg-config, gtk3, libepoxy, wayland, wrapGAppsHook }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "wdisplays";
-  version = "unstable-2021-04-03";
+  version = "1.1.1";
 
   nativeBuildInputs = [ meson ninja pkg-config wrapGAppsHook ];
 
   buildInputs = [ gtk3 libepoxy wayland ];
 
   src = fetchFromGitHub {
-    owner = "luispabon";
+    owner = "artizirk";
     repo = "wdisplays";
-    rev = "7f2eac0d2aa81b5f495da7950fd5a94683f7868e";
-    sha256 = "sha256-cOF3+T34zPro58maWUouGG+vlLm2C5NfcH7PZhSvApE=";
+    rev = finalAttrs.version;
+    sha256 = "sha256-dtvP930ChiDRT60xq6xBDU6k+zHnkrAkxkKz2FxlzRs=";
   };
 
-  patchPhase = ''
-    substituteInPlace ./resources/wdisplays.desktop.in --replace "@app_id@" "wdisplays"
-  '';
-
   meta = with lib; {
     description = "A graphical application for configuring displays in Wayland compositors";
     homepage = "https://github.com/luispabon/wdisplays";
@@ -27,4 +23,4 @@ stdenv.mkDerivation rec {
     platforms = platforms.linux;
     mainProgram = "wdisplays";
   };
-}
+})
diff --git a/pkgs/tools/misc/dooit/default.nix b/pkgs/tools/misc/dooit/default.nix
index ab7db4a2cb7c..b8aa6c8809ff 100644
--- a/pkgs/tools/misc/dooit/default.nix
+++ b/pkgs/tools/misc/dooit/default.nix
@@ -7,14 +7,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "dooit";
-  version = "2.0.1";
+  version = "2.1.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "kraanzu";
     repo = "dooit";
     rev = "v${version}";
-    hash = "sha256-iQAGD6zrBBd4fJONaB7to1OJpAJUO0zeA1xhVQZBkMc=";
+    hash = "sha256-ZCEBpaQHaFb09MUlN6acYB3LrfX456uRbhVh9YPz7NU=";
   };
 
   nativeBuildInputs = with python3.pkgs; [
diff --git a/pkgs/tools/misc/esphome/default.nix b/pkgs/tools/misc/esphome/default.nix
index b791cac21bd4..de7b7d5d03ef 100644
--- a/pkgs/tools/misc/esphome/default.nix
+++ b/pkgs/tools/misc/esphome/default.nix
@@ -16,14 +16,14 @@ let
 in
 python.pkgs.buildPythonApplication rec {
   pname = "esphome";
-  version = "2023.9.3";
+  version = "2023.10.1";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-SyXEiGh1/s9EJ0UPYC8R04JUYkCPhCtNUcGvVCycKGM=";
+    hash = "sha256-XKZYnZYXETv0UXrKtjQvDXyv8lwqfO19jc5Fs3KMhEY=";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/misc/fd/default.nix b/pkgs/tools/misc/fd/default.nix
index 0f78b752de00..23e00e00363c 100644
--- a/pkgs/tools/misc/fd/default.nix
+++ b/pkgs/tools/misc/fd/default.nix
@@ -1,4 +1,4 @@
-{ lib, rustPlatform, fetchFromGitHub, installShellFiles, testers, fd }:
+{ lib, rustPlatform, fetchFromGitHub, installShellFiles, rust-jemalloc-sys, testers, fd }:
 
 rustPlatform.buildRustPackage rec {
   pname = "fd";
@@ -15,6 +15,8 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ installShellFiles ];
 
+  buildInputs = [ rust-jemalloc-sys ];
+
   # skip flaky test
   checkFlags = [
     "--skip=test_owner_current_group"
diff --git a/pkgs/tools/misc/fzf/default.nix b/pkgs/tools/misc/fzf/default.nix
index 29f87b4ffdd0..be7992f94af5 100644
--- a/pkgs/tools/misc/fzf/default.nix
+++ b/pkgs/tools/misc/fzf/default.nix
@@ -79,7 +79,10 @@ buildGoModule rec {
     install -D shell/* -t $out/share/fzf/
     install -D shell/key-bindings.fish $out/share/fish/vendor_functions.d/fzf_key_bindings.fish
     mkdir -p $out/share/fish/vendor_conf.d
-    echo fzf_key_bindings > $out/share/fish/vendor_conf.d/load-fzf-key-bindings.fish
+    cat << EOF > $out/share/fish/vendor_conf.d/load-fzf-key-bindings.fish
+      status is-interactive; or exit 0
+      fzf_key_bindings
+    EOF
 
     cat <<SCRIPT > $out/bin/fzf-share
     #!${runtimeShell}
diff --git a/pkgs/tools/misc/progress/default.nix b/pkgs/tools/misc/progress/default.nix
index 94eeace1dc2e..2a8dc9926017 100644
--- a/pkgs/tools/misc/progress/default.nix
+++ b/pkgs/tools/misc/progress/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "progress";
-  version = "0.16";
+  version = "0.17";
 
   src = fetchFromGitHub {
     owner = "Xfennec";
     repo = "progress";
     rev = "v${version}";
-    sha256 = "sha256-kkEyflyBaQ5hUVo646NUuC1u54uzLJJsVFej9pMEwT0=";
+    sha256 = "sha256-riewkageSZIlwDNMjYep9Pb2q1GJ+WMXazokJGbb4bE=";
   };
 
   nativeBuildInputs = [ pkg-config which ];
diff --git a/pkgs/tools/misc/remind/default.nix b/pkgs/tools/misc/remind/default.nix
index 945e592e848a..97aefe1f8e5c 100644
--- a/pkgs/tools/misc/remind/default.nix
+++ b/pkgs/tools/misc/remind/default.nix
@@ -15,11 +15,11 @@ let
 in
 tcl.mkTclDerivation rec {
   pname = "remind";
-  version = "04.02.05";
+  version = "04.02.07";
 
   src = fetchurl {
     url = "https://dianne.skoll.ca/projects/remind/download/remind-${version}.tar.gz";
-    sha256 = "sha256-nOEFhVwZvgUod+j/5ifllFgTS7I8+hOAeMSDlRH4+Ag=";
+    sha256 = "sha256-A+EtkNmQOcz3Mb4q7qQGNL6pyCnRus4nqNor485tsZA=";
   };
 
   propagatedBuildInputs = tclLibraries;
diff --git a/pkgs/tools/misc/starfetch/default.nix b/pkgs/tools/misc/starfetch/default.nix
index ba6309c97ecb..ba6309c97ecb 100755..100644
--- a/pkgs/tools/misc/starfetch/default.nix
+++ b/pkgs/tools/misc/starfetch/default.nix
diff --git a/pkgs/tools/misc/szyszka/default.nix b/pkgs/tools/misc/szyszka/default.nix
index 58d839acf078..58d839acf078 100755..100644
--- a/pkgs/tools/misc/szyszka/default.nix
+++ b/pkgs/tools/misc/szyszka/default.nix
diff --git a/pkgs/tools/misc/tbls/default.nix b/pkgs/tools/misc/tbls/default.nix
index 5b2d16097164..de880c201446 100644
--- a/pkgs/tools/misc/tbls/default.nix
+++ b/pkgs/tools/misc/tbls/default.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "tbls";
-  version = "1.68.2";
+  version = "1.70.2";
 
   src = fetchFromGitHub {
     owner = "k1LoW";
     repo = "tbls";
     rev = "v${version}";
-    hash = "sha256-yDWAKkzRb487iZ+5tmIH1qfuHj0TldOT+tTQwtVyX7s=";
+    hash = "sha256-LSICkg99veFHLmdcQZmnyfTbdqx7k2XI13W7Cjuj3qA=";
   };
 
-  vendorHash = "sha256-V6TF7Q+9XxBeSVXlotu8tUrNCWDr80BZsQcVSBGikl8=";
+  vendorHash = "sha256-84h+LQzk/xy/Gapy7IxB8IPvsVGRsJP7udd9HhLskew=";
 
   CGO_CFLAGS = [ "-Wno-format-security" ];
 
diff --git a/pkgs/tools/misc/turbo/default.nix b/pkgs/tools/misc/turbo/default.nix
index f3fcd8cd0f30..c887fdc131c2 100644
--- a/pkgs/tools/misc/turbo/default.nix
+++ b/pkgs/tools/misc/turbo/default.nix
@@ -12,6 +12,7 @@
 , openssl
 , extra-cmake-modules
 , fontconfig
+, rust-jemalloc-sys
 , testers
 , turbo
 , nix-update-script
@@ -149,6 +150,7 @@ rustPlatform.buildRustPackage {
   buildInputs = [
     openssl
     fontconfig
+    rust-jemalloc-sys
   ] ++ lib.optionals stdenv.isDarwin [
       IOKit
       CoreServices
diff --git a/pkgs/tools/misc/uutils-coreutils/default.nix b/pkgs/tools/misc/uutils-coreutils/default.nix
index 697396f0817a..45a1c3f8a28f 100644
--- a/pkgs/tools/misc/uutils-coreutils/default.nix
+++ b/pkgs/tools/misc/uutils-coreutils/default.nix
@@ -12,19 +12,19 @@
 
 stdenv.mkDerivation rec {
   pname = "uutils-coreutils";
-  version = "0.0.20";
+  version = "0.0.22";
 
   src = fetchFromGitHub {
     owner = "uutils";
     repo = "coreutils";
     rev = version;
-    sha256 = "sha256-Xr+RcWvAHyMMaHhcd3ArGeRZzpL76v7fXiHUSSxgj10=";
+    hash = "sha256-aEhU4O4xoj7hrnmNXA9GQYn8nc6XEJCGQIcx/xRtLMc=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-3hUEDE+Yup/+u/ACyAWXYTLerOqB/jtOzECdI540Ag0=";
+    hash = "sha256-zQN6EVRyd4FWeNNDXI3NY6XWmJTD+n8c+w7BHtXvs1k=";
   };
 
   nativeBuildInputs = [ rustPlatform.cargoSetupHook sphinx ];
diff --git a/pkgs/tools/misc/vector/default.nix b/pkgs/tools/misc/vector/default.nix
index b1fd29e74673..c50d136d051e 100644
--- a/pkgs/tools/misc/vector/default.nix
+++ b/pkgs/tools/misc/vector/default.nix
@@ -8,6 +8,7 @@
 , rdkafka
 , oniguruma
 , zstd
+, rust-jemalloc-sys
 , Security
 , libiconv
 , coreutils
@@ -59,7 +60,7 @@ rustPlatform.buildRustPackage {
     };
   };
   nativeBuildInputs = [ pkg-config cmake perl git rustPlatform.bindgenHook ];
-  buildInputs = [ oniguruma openssl protobuf rdkafka zstd ]
+  buildInputs = [ oniguruma openssl protobuf rdkafka zstd rust-jemalloc-sys ]
     ++ lib.optionals stdenv.isDarwin [ Security libiconv coreutils CoreServices ];
 
   # needed for internal protobuf c wrapper library
diff --git a/pkgs/tools/networking/ddclient/default.nix b/pkgs/tools/networking/ddclient/default.nix
new file mode 100644
index 000000000000..6477c5b185c0
--- /dev/null
+++ b/pkgs/tools/networking/ddclient/default.nix
@@ -0,0 +1,53 @@
+{ lib, fetchFromGitHub, perlPackages, autoreconfHook, iproute2, perl, curl }:
+
+let
+  myPerl = perl.withPackages (ps: [ ps.JSONPP ]);
+in
+perlPackages.buildPerlPackage rec {
+  pname = "ddclient";
+  version = "3.11.0_1";
+
+  outputs = [ "out" ];
+
+  src = fetchFromGitHub {
+    owner = "ddclient";
+    repo = "ddclient";
+    rev = "v${version}";
+    sha256 = "sha256-pl1kbzY5nUIvx1QiDdL9TP4vKtQnnv3RWklE4gbxXCw=";
+  };
+
+  postPatch = ''
+    touch Makefile.PL
+  '';
+
+  nativeBuildInputs = [ autoreconfHook ];
+
+  buildInputs = [ curl myPerl ];
+
+  # Prevent ddclient from picking up build time perl which is implicitly added
+  # by buildPerlPackage.
+  configureFlags = [
+    "--with-perl=${lib.getExe myPerl}"
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm755 ddclient $out/bin/ddclient
+    install -Dm644 -t $out/share/doc/ddclient COP* README.* ChangeLog.md
+
+    runHook postInstall
+  '';
+
+  # TODO: run upstream tests
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Client for updating dynamic DNS service entries";
+    homepage = "https://ddclient.net/";
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ bjornfor ];
+    mainProgram = "ddclient";
+  };
+}
diff --git a/pkgs/tools/networking/ipfetch/default.nix b/pkgs/tools/networking/ipfetch/default.nix
index b9b675366e56..b9b675366e56 100755..100644
--- a/pkgs/tools/networking/ipfetch/default.nix
+++ b/pkgs/tools/networking/ipfetch/default.nix
diff --git a/pkgs/tools/networking/sish/default.nix b/pkgs/tools/networking/sish/default.nix
index 0bcf6bff9431..aa64767cc3fe 100644
--- a/pkgs/tools/networking/sish/default.nix
+++ b/pkgs/tools/networking/sish/default.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "sish";
-  version = "2.9.2";
+  version = "2.11.0";
 
   src = fetchFromGitHub {
     owner = "antoniomika";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-6PCZtiXsDQfPZFw3r1n3rwgxigSnWgggHXzZdBT/fxA=";
+    hash = "sha256-dNwSMDEt142A0rP212bWBZSX2zhYgL94EJymOvegTa8=";
   };
 
-  vendorHash = "sha256-RnvkEUvL/bQTTTlg0RF0xjjvVniltequNKRD3z0H3O8=";
+  vendorHash = "sha256-XtN2RgegmKR/RDFBbHn9kpI1BxmF7jfu7LAwPVaAvEk=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/tools/networking/voms/default.nix b/pkgs/tools/networking/voms/default.nix
index a16648b9a833..cafc812032b7 100644
--- a/pkgs/tools/networking/voms/default.nix
+++ b/pkgs/tools/networking/voms/default.nix
@@ -13,7 +13,8 @@
 , zlib
   # Configuration overridable with .override
   # If not null, the builder will
-  # move "$out/etc" to "$out/etc.orig" and symlink "$out/etc" to externalEtc.
+  # create a new output "etc", move "$out/etc" to "$etc/etc"
+  # and symlink "$out/etc" to externalEtc.
 , externalEtc ? "/etc"
 }:
 
@@ -46,7 +47,8 @@ stdenv.mkDerivation rec{
     zlib
   ];
 
-  outputs = [ "bin" "out" "dev" "man" ];
+  outputs = [ "bin" "out" "dev" "man" ]
+    ++ lib.optional (externalEtc != null) "etc";
 
   preAutoreconf = ''
     mkdir -p aux src/autogen
@@ -65,13 +67,12 @@ stdenv.mkDerivation rec{
 
   configureFlags = [
     "--with-gsoap-wsdl2h=${gsoap}/bin/wsdl2h"
+    "--sysconfdir=${placeholder "out"}/etc"
   ];
 
-  postFixup = ''
-    ${lib.optionalString (externalEtc != null) ''
-      mv "$out"/etc{,.orig}
-      ln -s ${lib.escapeShellArg externalEtc} "$out/etc"
-    ''}
+  postFixup = lib.optionalString (externalEtc != null) ''
+    moveToOutput etc "$etc"
+    ln -s ${lib.escapeShellArg externalEtc} "$out/etc"
   '';
 
   meta = with lib; {
diff --git a/pkgs/tools/networking/xrootd/default.nix b/pkgs/tools/networking/xrootd/default.nix
index e5aad1b4ee9b..e32139fdfceb 100644
--- a/pkgs/tools/networking/xrootd/default.nix
+++ b/pkgs/tools/networking/xrootd/default.nix
@@ -4,6 +4,7 @@
 , fetchFromGitHub
 , cmake
 , cppunit
+, makeWrapper
 , pkg-config
 , curl
 , fuse
@@ -24,6 +25,9 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
+
+  __structuredAttrs = true;
+
   pname = "xrootd";
   version = "5.5.5";
 
@@ -35,7 +39,8 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-SLmxv8opN7z4V07S9kLGo8HG7Ql62iZQLtf3zGemwA8=";
   };
 
-  outputs = [ "bin" "out" "dev" "man" ];
+  outputs = [ "bin" "out" "dev" "man" ]
+  ++ lib.optional (externalEtc != null) "etc";
 
   passthru.fetchxrd = callPackage ./fetchxrd.nix { xrootd = finalAttrs.finalPackage; };
   passthru.tests =
@@ -55,6 +60,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     cmake
+    makeWrapper
     pkg-config
   ];
 
@@ -101,8 +107,19 @@ stdenv.mkDerivation (finalAttrs: {
     "-DENABLE_TESTS=TRUE"
   ];
 
-  postFixup = lib.optionalString (externalEtc != null) ''
-    mv "$out"/etc{,.orig}
+  makeWrapperArgs = [
+    # Workaround the library-not-found issue
+    # happening to binaries compiled with xrootd libraries.
+    # See #169677
+    "--prefix" "${lib.optionalString stdenv.hostPlatform.isDarwin "DY"}LD_LIBRARY_PATH" ":" "${placeholder "out"}/lib"
+  ];
+
+  postFixup = ''
+    while IFS= read -r FILE; do
+      wrapProgram "$FILE" "''${makeWrapperArgs[@]}"
+    done < <(find "$bin/bin" -mindepth 1 -maxdepth 1 -type f,l -perm -a+x)
+  '' + lib.optionalString (externalEtc != null) ''
+    moveToOutput etc "$etc"
     ln -s ${lib.escapeShellArg externalEtc} "$out/etc"
   '';
 
diff --git a/pkgs/tools/networking/xrootd/fetchxrd.nix b/pkgs/tools/networking/xrootd/fetchxrd.nix
index 2d197f8504fe..21d7a2a0386d 100644
--- a/pkgs/tools/networking/xrootd/fetchxrd.nix
+++ b/pkgs/tools/networking/xrootd/fetchxrd.nix
@@ -21,11 +21,9 @@
     inherit url;
     urls = if urls == [ ] then lib.singleton url else urls;
   }
-  # Set [DY]LD_LIBRARY_PATH to workaround #169677
-  # TODO: Remove the library path after #200830 get merged
   ''
     for u in $urls; do
-      ${lib.optionalString buildPlatform.isDarwin "DY"}LD_LIBRARY_PATH=${lib.makeLibraryPath [ xrootd ]} xrdcp --force "$u" "$out"
+      xrdcp --verbose --force "$u" "$out"
       ret=$?
       (( ret != 0 )) || break
     done
diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix
index 9d03c35c1eb5..1aab6b3353ea 100644
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@@ -167,13 +167,13 @@ in lib.makeExtensible (self: ({
   };
 
   nix_2_15 = common {
-    version = "2.15.2";
-    hash = "sha256-0BxVsvp4JfliYu4EdpZ/zPYOt9Qn5w9Ix5r0sagZZ7o=";
+    version = "2.15.3";
+    hash = "sha256-sfFXbjC5iIdSAbctZIuFozxX0uux/KFBNr9oh33xINs=";
   };
 
   nix_2_16 = common {
-    version = "2.16.1";
-    hash = "sha256-/XCWa2osNFIpPC5MkxlX6qTZf/DaTLwS3LWN0SRFiuU=";
+    version = "2.16.2";
+    hash = "sha256-VXIYCDkvAWeMoU0W2ZI0TeOszCZA1o8trz6YCPFD5ac=";
   };
 
   nix_2_17 = common {
diff --git a/pkgs/tools/security/aws-iam-authenticator/default.nix b/pkgs/tools/security/aws-iam-authenticator/default.nix
index 4f1dcf318282..f186c43721f4 100644
--- a/pkgs/tools/security/aws-iam-authenticator/default.nix
+++ b/pkgs/tools/security/aws-iam-authenticator/default.nix
@@ -1,23 +1,27 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
 
 buildGoModule rec {
   pname = "aws-iam-authenticator";
-  version = "0.6.11";
+  version = "0.6.12";
 
   src = fetchFromGitHub {
     owner = "kubernetes-sigs";
     repo = pname;
-    rev = "v${version}";
-    hash = "sha256-4bZnGgf/H2/uLhh8ip8rrA+U0vA+1SO5uhjLK40j3wE=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-IIlAsxxEYjR7+wdWExdsQAH0x4yOXZ+bVQWwn7mrhRw=";
   };
 
   vendorHash = "sha256-RcZqnyZtonE4qeu+llL1OPGPG93/Rx8ESWM5wapZ1BM=";
 
   ldflags = let PKG = "sigs.k8s.io/aws-iam-authenticator"; in [
-    "-s" "-w"
-    "-X ${PKG}/pkg.Version=${version}"
-    "-X ${PKG}/pkg.BuildDate=1970-01-01T01:01:01Z"
-    "-X ${PKG}/pkg.CommitID=${version}"
+    "-s"
+    "-w"
+    "-X=${PKG}/pkg.Version=${version}"
+    "-X=${PKG}/pkg.BuildDate=1970-01-01T01:01:01Z"
+    "-X ?${PKG}/pkg.CommitID=${version}"
   ];
 
   subPackages = [ "cmd/aws-iam-authenticator" ];
@@ -25,7 +29,8 @@ buildGoModule rec {
   meta = with lib; {
     homepage = "https://github.com/kubernetes-sigs/aws-iam-authenticator";
     description = "AWS IAM credentials for Kubernetes authentication";
+    changelog = "https://github.com/kubernetes-sigs/aws-iam-authenticator/releases/tag/v${version}";
     license = licenses.asl20;
-    maintainers = [ maintainers.srhb ];
+    maintainers = with maintainers; [ srhb ];
   };
 }
diff --git a/pkgs/tools/security/exploitdb/default.nix b/pkgs/tools/security/exploitdb/default.nix
index 7f0b22d44581..0762a437dfbe 100644
--- a/pkgs/tools/security/exploitdb/default.nix
+++ b/pkgs/tools/security/exploitdb/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "exploitdb";
-  version = "2023-10-14";
+  version = "2023-10-20";
 
   src = fetchFromGitLab {
     owner = "exploit-database";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-Hhk7P6mUDxTGeAq1qbtCPV0Npm7ab/F++Q0cL5rJifc=";
+    hash = "sha256-v9myewSoa0U/1EjmBejHj7M2iL8k8xNpFzi74IN4dS0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/security/ldeep/default.nix b/pkgs/tools/security/ldeep/default.nix
index 3ed3d189ec49..ebc1ca5922e5 100644
--- a/pkgs/tools/security/ldeep/default.nix
+++ b/pkgs/tools/security/ldeep/default.nix
@@ -5,14 +5,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "ldeep";
-  version = "1.0.41";
+  version = "1.0.42";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "franc-pentest";
     repo = "ldeep";
     rev = "refs/tags/${version}";
-    hash = "sha256-jiOZAoZx5KK/jpW/Cui1WgPhjyf5gglcgWZbzMw65Lw=";
+    hash = "sha256-kXXZU4/nWUKAFJbcp9PFyPUxd+fRXJb6JbS/fybHh3g=";
   };
 
   nativeBuildInputs = with python3.pkgs; [
diff --git a/pkgs/tools/security/metasploit/Gemfile b/pkgs/tools/security/metasploit/Gemfile
index 310fa1b71912..719091e6d9a6 100644
--- a/pkgs/tools/security/metasploit/Gemfile
+++ b/pkgs/tools/security/metasploit/Gemfile
@@ -1,4 +1,4 @@
 # frozen_string_literal: true
 source "https://rubygems.org"
 
-gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.3.37"
+gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.3.39"
diff --git a/pkgs/tools/security/metasploit/Gemfile.lock b/pkgs/tools/security/metasploit/Gemfile.lock
index c44c869c7cd3..d9488beb1780 100644
--- a/pkgs/tools/security/metasploit/Gemfile.lock
+++ b/pkgs/tools/security/metasploit/Gemfile.lock
@@ -1,12 +1,12 @@
 GIT
   remote: https://github.com/rapid7/metasploit-framework
-  revision: 40ba61c644b1529ec4493ecb59dd5a8e4b3f16c1
-  ref: refs/tags/6.3.37
+  revision: 77fb7ae14f17fd7f4851bca87e0c28c704797591
+  ref: refs/tags/6.3.39
   specs:
-    metasploit-framework (6.3.37)
-      actionpack (~> 7.0)
-      activerecord (~> 7.0)
-      activesupport (~> 7.0)
+    metasploit-framework (6.3.39)
+      actionpack (~> 7.0.0)
+      activerecord (~> 7.0.0)
+      activesupport (~> 7.0.0)
       aws-sdk-ec2
       aws-sdk-ec2instanceconnect
       aws-sdk-iam
@@ -28,14 +28,14 @@ GIT
       filesize
       hrr_rb_ssh-ed25519
       http-cookie
-      irb
+      irb (~> 1.7.4)
       jsobfu
       json
       metasm
       metasploit-concern
       metasploit-credential
       metasploit-model
-      metasploit-payloads (= 2.0.154)
+      metasploit-payloads (= 2.0.156)
       metasploit_data_models
       metasploit_payloads-mettle (= 1.0.26)
       mqtt
@@ -252,7 +252,7 @@ GEM
       activemodel (~> 7.0)
       activesupport (~> 7.0)
       railties (~> 7.0)
-    metasploit-payloads (2.0.154)
+    metasploit-payloads (2.0.156)
     metasploit_data_models (6.0.2)
       activerecord (~> 7.0)
       activesupport (~> 7.0)
diff --git a/pkgs/tools/security/metasploit/default.nix b/pkgs/tools/security/metasploit/default.nix
index fdc61c0c8774..d50d8760e21d 100644
--- a/pkgs/tools/security/metasploit/default.nix
+++ b/pkgs/tools/security/metasploit/default.nix
@@ -15,13 +15,13 @@ let
   };
 in stdenv.mkDerivation rec {
   pname = "metasploit-framework";
-  version = "6.3.37";
+  version = "6.3.39";
 
   src = fetchFromGitHub {
     owner = "rapid7";
     repo = "metasploit-framework";
     rev = version;
-    sha256 = "sha256-veyBJpRycTBuNQocUss6xBOaiImj4EyLv0261UmI7mM=";
+    sha256 = "sha256-EKLzIhrNiTUM3OtezPJL8g70BmR+vEyNcllyme5hH8o=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/security/metasploit/gemset.nix b/pkgs/tools/security/metasploit/gemset.nix
index 71dc2b4c8d81..631d9f8c4dd8 100644
--- a/pkgs/tools/security/metasploit/gemset.nix
+++ b/pkgs/tools/security/metasploit/gemset.nix
@@ -654,12 +654,12 @@
     platforms = [];
     source = {
       fetchSubmodules = false;
-      rev = "40ba61c644b1529ec4493ecb59dd5a8e4b3f16c1";
-      sha256 = "0qzfi14xbfjdpy5lrq53i649l4y47b5m470a6mp30wbjjhk83v5x";
+      rev = "77fb7ae14f17fd7f4851bca87e0c28c704797591";
+      sha256 = "1jhzc7p9jwjrfa6lrg3ych3g83pj9grcqppbvh63b2fd38ig78hh";
       type = "git";
       url = "https://github.com/rapid7/metasploit-framework";
     };
-    version = "6.3.37";
+    version = "6.3.39";
   };
   metasploit-model = {
     groups = ["default"];
@@ -676,10 +676,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0s3iii3y6jhmiymylhpxqcksgm8gwmmm3rhqspmd4n9ab4p4l36s";
+      sha256 = "1x2lyyz9n89ii16v1pkw69yrywyjx1mv46rg5z4wa95gbp236mmy";
       type = "gem";
     };
-    version = "2.0.154";
+    version = "2.0.156";
   };
   metasploit_data_models = {
     groups = ["default"];
diff --git a/pkgs/tools/security/scrypt/default.nix b/pkgs/tools/security/scrypt/default.nix
index aad2873d4aca..d2b8228f6511 100644
--- a/pkgs/tools/security/scrypt/default.nix
+++ b/pkgs/tools/security/scrypt/default.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation rec {
   pname = "scrypt";
-  version = "1.3.1";
+  version = "1.3.2";
 
   src = fetchurl {
     url = "https://www.tarsnap.com/scrypt/${pname}-${version}.tgz";
-    sha256 = "1hnl0r6pmyxiy4dmafmqk1db7wpc0x9rqpzqcwr9d2cmghcj6byz";
+    sha256 = "sha256-1jLBGTQgrG+uv5SC5l4z06VmTszWQ7CaUJ0h0cHym+I=";
   };
 
   outputs = [ "out" "lib" "dev" ];
diff --git a/pkgs/tools/security/sshocker/default.nix b/pkgs/tools/security/sshocker/default.nix
index b42c0a7580c3..bb8177ea3878 100644
--- a/pkgs/tools/security/sshocker/default.nix
+++ b/pkgs/tools/security/sshocker/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "sshocker";
-  version = "0.3.3";
+  version = "0.3.4";
 
   src = fetchFromGitHub {
     owner = "lima-vm";
     repo = "sshocker";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Z1Dg+AeyfFmUDc3jV8/tOcUrxuyInfwubzo0cLpfFl8=";
+    hash = "sha256-IDbGRQSLQlT4lt2bextGYB4fJfbpLhPx3JF1eYDJ6gw=";
   };
 
-  vendorHash = "sha256-ceQzYByJNXr02IDBKhYuqnKfaTbnX5T03p2US4HRu6I=";
+  vendorHash = "sha256-kee5D80RjCVosts/Jd6WuvtiK/J5+79HsM5ITHs15xc=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/tools/text/ov/default.nix b/pkgs/tools/text/ov/default.nix
index e988f1c2f204..2a70d7cdaa54 100644
--- a/pkgs/tools/text/ov/default.nix
+++ b/pkgs/tools/text/ov/default.nix
@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "ov";
-  version = "0.32.0";
+  version = "0.32.1";
 
   src = fetchFromGitHub {
     owner = "noborus";
     repo = "ov";
     rev = "refs/tags/v${version}";
-    hash = "sha256-mQ1KwElD8RizOT2trHWo4T1QiZ974xwhQCCa5snpnZM=";
+    hash = "sha256-S84CMC02KJ5eevLxVkapCdjZh4PH95u/0AK4tpkOx2k=";
   };
 
-  vendorHash = "sha256-XACdtJdACMKQ5gSJcjGAPNGPFL1Tbt6QOovl15mvFGI=";
+  vendorHash = "sha256-1NdvUdPPr0Twx0hyve4/vvDR2cU+mGyws3UIf8jHfbw=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/tools/text/rsbkb/default.nix b/pkgs/tools/text/rsbkb/default.nix
index fd02babac0b0..1510a63b050f 100644
--- a/pkgs/tools/text/rsbkb/default.nix
+++ b/pkgs/tools/text/rsbkb/default.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rsbkb";
-  version = "1.2";
+  version = "1.2.1";
 
   src = fetchFromGitHub {
     owner = "trou";
     repo = "rsbkb";
     rev = "release-${version}";
-    hash = "sha256-Y6YTjEbefNUPcl6rNYWVZLGZYTUPr5pvfLabS+zDWqA=";
+    hash = "sha256-+plf7BoYpEFPRsGKNrvLF8TAU3Z7nyx6Td6uRBoNGiE=";
   };
 
-  cargoHash = "sha256-RMX+ZdPaqtqRJvhHFJJrPZnBGwQwZSCXNg1oNo+v2+8=";
+  cargoHash = "sha256-HyosR/5tZCRU2CNnnGITEuESW30Zq3s33UFNcLmEWIA=";
 
   # Setup symlinks for all the utilities,
   # busybox style
diff --git a/pkgs/tools/typesetting/sile/default.nix b/pkgs/tools/typesetting/sile/default.nix
index 7c436ac419b2..6b5498656b0e 100644
--- a/pkgs/tools/typesetting/sile/default.nix
+++ b/pkgs/tools/typesetting/sile/default.nix
@@ -46,11 +46,11 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "sile";
-  version = "0.14.11";
+  version = "0.14.12";
 
   src = fetchurl {
     url = "https://github.com/sile-typesetter/sile/releases/download/v${finalAttrs.version}/sile-${finalAttrs.version}.tar.xz";
-    sha256 = "sha256-JXlgiK1XyZZSe5QXz06zwEAnVYhiIZhhIaBmfxAgRS4=";
+    sha256 = "sha256-iyxNi4Y2zaeR6HUf/IVW1M7mB0WhM2yxOqDkb1oAkHg=";
   };
 
   configureFlags = [
diff --git a/pkgs/tools/wayland/swaykbdd/default.nix b/pkgs/tools/wayland/swaykbdd/default.nix
index cb46519ac345..c6e59cec2a81 100644
--- a/pkgs/tools/wayland/swaykbdd/default.nix
+++ b/pkgs/tools/wayland/swaykbdd/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "swaykbdd";
-  version = "1.1";
+  version = "1.2";
 
   src = fetchFromGitHub {
     owner = "artemsen";
     repo = "swaykbdd";
     rev = "v${version}";
-    sha256 = "sha256-umYPVkkYeu6TyVkjDsVBsRZLYh8WyseCPdih85kTz6A=";
+    sha256 = "sha256-QHNUIFJb5XYjUC07NQo96oD57nU8jd8sUW32iJSW+SU=";
   };
 
   strictDeps = true;
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 9d2e755ca144..4e52ec42d82e 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -92,7 +92,6 @@ mapAliases ({
   bird2 = bird; # Added 2022-02-21
   bitwig-studio1 = throw "bitwig-studio1 has been removed, you can upgrade to 'bitwig-studio'"; # Added 2023-01-03
   bitwig-studio2 = throw "bitwig-studio2 has been removed, you can upgrade to 'bitwig-studio'"; # Added 2023-01-03
-  ddclient = throw "ddclient has been removed on the request of the upstream maintainer because it is unmaintained and has bugs. Please switch to a different software like `inadyn` or `knsupdate`."; # Added 2023-07-04
   bluezFull = throw "'bluezFull' has been renamed to/replaced by 'bluez'"; # Converted to throw 2023-09-10
   boost168 = throw "boost168 has been deprecated in favor of the latest version"; # Added 2023-06-08
   boost169 = throw "boost169 has been deprecated in favor of the latest version"; # Added 2023-06-08
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 34d9d153a437..d960113b2458 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2112,7 +2112,10 @@ with pkgs;
 
   xpaste = callPackage ../tools/text/xpaste { };
 
-  xrootd = callPackage ../tools/networking/xrootd { };
+  xrootd = callPackage ../tools/networking/xrootd {
+    # Workaround systemd static build breakage
+    systemd = if systemd.meta.broken then null else systemd;
+  };
 
   yabridge = callPackage ../tools/audio/yabridge {
     wine = wineWowPackages.staging;
@@ -7241,7 +7244,11 @@ with pkgs;
   cpcfs = callPackage ../tools/filesystems/cpcfs { };
 
   coreutils =  callPackage ../tools/misc/coreutils { };
-  coreutils-full = coreutils.override { minimal = false; };
+
+  # The coreutils above are built with dependencies from
+  # bootstrapping. We cannot override it here, because that pulls in
+  # openssl from the previous stage as well.
+  coreutils-full = callPackage ../tools/misc/coreutils { minimal = false; };
   coreutils-prefixed = coreutils.override { withPrefix = true; singleBinary = false; };
 
   corkscrew = callPackage ../tools/networking/corkscrew { };
@@ -7418,6 +7425,8 @@ with pkgs;
 
   ddcutil = callPackage ../tools/misc/ddcutil { };
 
+  ddclient = callPackage ../tools/networking/ddclient { };
+
   dd_rescue = callPackage ../tools/system/dd_rescue { };
 
   ddh = callPackage ../tools/system/ddh { };
@@ -10301,10 +10310,14 @@ with pkgs;
   nodejs-slim_20 = callPackage ../development/web/nodejs/v20.nix { enableNpm = false; };
   corepack_20 = hiPrio (callPackage ../development/web/nodejs/corepack.nix { nodejs = nodejs_20; });
 
+  nodejs_21 = callPackage ../development/web/nodejs/v21.nix { };
+  nodejs-slim_21 = callPackage ../development/web/nodejs/v21.nix { enableNpm = false; };
+  corepack_21 = hiPrio (callPackage ../development/web/nodejs/corepack.nix { nodejs = nodejs_21; });
+
   # Update this when adding the newest nodejs major version!
-  nodejs_latest = nodejs_20;
-  nodejs-slim_latest = nodejs-slim_20;
-  corepack_latest = hiPrio corepack_20;
+  nodejs_latest = nodejs_21;
+  nodejs-slim_latest = nodejs-slim_21;
+  corepack_latest = hiPrio corepack_21;
 
   buildNpmPackage = callPackage ../build-support/node/build-npm-package { };
 
@@ -20829,6 +20842,8 @@ with pkgs;
 
   certbot-full = certbot.withPlugins (cp: with cp; [
     certbot-dns-cloudflare
+    certbot-dns-google
+    certbot-dns-ovh
     certbot-dns-rfc2136
     certbot-dns-route53
   ]);
@@ -22272,6 +22287,9 @@ with pkgs;
 
   jemalloc = callPackage ../development/libraries/jemalloc { };
 
+  rust-jemalloc-sys = callPackage ../development/libraries/jemalloc/rust.nix { };
+  rust-jemalloc-sys-unprefixed = rust-jemalloc-sys.override { unprefixed = true; };
+
   jose = callPackage ../development/libraries/jose { };
 
   jpcre2 = callPackage ../development/libraries/jpcre2 { };
@@ -27557,6 +27575,8 @@ with pkgs;
 
   ### SERVERS / GEOSPATIAL
 
+  fit-trackee = callPackage ../servers/geospatial/fit-trackee { };
+
   geoserver = callPackage ../servers/geospatial/geoserver { };
 
   mapcache = callPackage ../servers/geospatial/mapcache { };
@@ -28302,7 +28322,9 @@ with pkgs;
     checkMeta = callPackage ../stdenv/generic/check-meta.nix { };
   });
   minimal-bootstrap-sources = callPackage ../os-specific/linux/minimal-bootstrap/stage0-posix/bootstrap-sources.nix { };
-  make-minimal-bootstrap-sources = callPackage ../os-specific/linux/minimal-bootstrap/stage0-posix/make-bootstrap-sources.nix { };
+  make-minimal-bootstrap-sources = callPackage ../os-specific/linux/minimal-bootstrap/stage0-posix/make-bootstrap-sources.nix {
+    inherit (stdenv) hostPlatform;
+  };
 
   mingetty = callPackage ../os-specific/linux/mingetty { };
 
@@ -28427,7 +28449,9 @@ with pkgs;
 
   golint = callPackage ../development/tools/golint { };
 
-  golangci-lint = callPackage ../development/tools/golangci-lint { };
+  golangci-lint = callPackage ../development/tools/golangci-lint {
+    buildGoModule = buildGo121Module;
+  };
 
   golangci-lint-langserver = callPackage ../development/tools/golangci-lint-langserver { };
 
@@ -36483,7 +36507,7 @@ with pkgs;
 
   windowlab = callPackage ../applications/window-managers/windowlab { };
 
-  dockapps = callPackage ../by-name/wi/windowmaker/dockapps { };
+  inherit (windowmaker) dockapps;
 
   wily = callPackage ../applications/editors/wily { };
 
@@ -38872,6 +38896,8 @@ with pkgs;
 
   bftools = callPackage ../applications/science/biology/bftools { };
 
+  bioawk = callPackage ../applications/science/biology/bioawk { };
+
   blast = callPackage ../applications/science/biology/blast {
     inherit (darwin.apple_sdk.frameworks) ApplicationServices;
   };
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 4936635db735..425ece6b7bee 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -4947,6 +4947,26 @@ with self; {
     };
   };
 
+  CryptHSXKPasswd = buildPerlPackage {
+    pname = "Crypt-HSXKPasswd";
+    version = "3.6";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/B/BA/BARTB/Crypt-HSXKPasswd-v3.6.tar.gz";
+      hash = "sha256-lZ3MX58BG/ALha0i31ZrerK/XqHTYrDeD7WuKfvEWLM=";
+    };
+    buildInputs = [ Clone DateTime FileHomeDir FileShare FileShareDir GetoptLong JSON ListMoreUtils MathRound Readonly TextUnidecode TypeTiny ];
+    meta = {
+      description = "A secure memorable password generator";
+      homepage = "http://www.bartb.ie/hsxkpasswd";
+      license = with lib.licenses; [ bsd2 ];
+      maintainers = [ maintainers.dannixon ];
+      mainProgram = "hsxkpasswd";
+    };
+    # Two tests fail as a result of https://github.com/bbusschots/hsxkpasswd/issues/42
+    # (also see https://github.com/bbusschots/hsxkpasswd/issues/43)
+    doCheck = false;
+  };
+
   CryptIDEA = buildPerlPackage {
     pname = "Crypt-IDEA";
     version = "1.10";
@@ -4976,11 +4996,12 @@ with self; {
 
   CryptPassphrase = buildPerlPackage {
     pname = "Crypt-Passphrase";
-    version = "0.003";
+    version = "0.016";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/L/LE/LEONT/Crypt-Passphrase-0.003.tar.gz";
-      hash = "sha256-aFqgkPgXmobWiWISzPjM/eennM6FcZm7FOInehDSQK0=";
+      url = "mirror://cpan/authors/id/L/LE/LEONT/Crypt-Passphrase-0.016.tar.gz";
+      hash = "sha256-TOtPi1SsM/PYHJq0euTPoejDbzhJ76ghcDycMH46T8c=";
     };
+    propagatedBuildInputs = [ CryptURandom ];
     meta = {
       description = "A module for managing passwords in a cryptographically agile manner";
       license = with lib.licenses; [ artistic1 gpl1Plus ];
@@ -5003,12 +5024,12 @@ with self; {
 
   CryptPassphraseBcrypt = buildPerlPackage {
     pname = "Crypt-Passphrase-Bcrypt";
-    version = "0.001";
+    version = "0.007";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/L/LE/LEONT/Crypt-Passphrase-Bcrypt-0.001.tar.gz";
-      hash = "sha256-M44nA4RH/eAjznyaC1dPR+4zeQRKDAgxrJRx8UMNxMU=";
+      url = "mirror://cpan/authors/id/L/LE/LEONT/Crypt-Passphrase-Bcrypt-0.007.tar.gz";
+      hash = "sha256-/k1NHTm9TxODQaJZUFzhE3EnCnZ8nndH90H7dGH9sA8=";
     };
-    propagatedBuildInputs = [ CryptEksblowfish CryptPassphrase ];
+    propagatedBuildInputs = [ CryptBcrypt CryptPassphrase ];
     meta = {
       description = "A bcrypt encoder for Crypt::Passphrase";
       homepage = "https://github.com/Leont/crypt-passphrase-bcrypt";
@@ -16181,12 +16202,12 @@ with self; {
 
   MojoliciousPluginOpenAPI = buildPerlPackage {
     pname = "Mojolicious-Plugin-OpenAPI";
-    version = "5.05";
+    version = "5.09";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/J/JH/JHTHORSEN/Mojolicious-Plugin-OpenAPI-5.05.tar.gz";
-      hash = "sha256-xH+I0c434/YT9uizV9grenEEX/wKSXOVUS67zahlYV0=";
+      url = "mirror://cpan/authors/id/J/JH/JHTHORSEN/Mojolicious-Plugin-OpenAPI-5.09.tar.gz";
+      hash = "sha256-BIJdfOIe20G80Ujrz6Gu+Ek258QOhKOdvyeGcdSaMQY=";
     };
-    propagatedBuildInputs = [ JSONValidator ];
+    propagatedBuildInputs = [ JSONValidator Mojolicious ];
     meta = {
       description = "OpenAPI / Swagger plugin for Mojolicious";
       homepage = "https://github.com/jhthorsen/mojolicious-plugin-openapi";
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 6d28fd6dc2f1..66be4900a11b 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -244,6 +244,7 @@ mapAliases ({
   notifymuch = throw "notifymuch has been promoted to a top-level attribute"; # added 2022-10-02
   Nuitka = nuitka; # added 2023-02-19
   ntlm-auth = throw "ntlm-auth has been removed, because it relies on the md4 implementation provided by openssl. Use pyspnego instead.";
+  opsdroid_get_image_size = opsdroid-get-image-size; # added 2023-10-16
   ordereddict = throw "ordereddict has been removed because it is only useful on unsupported python versions."; # added 2022-05-28
   pafy = throw "pafy has been removed because it is unmaintained and only a dependency of mps-youtube, itself superseded by yewtube"; # Added 2023-01-19
   pam = python-pam; # added 2020-09-07.
@@ -353,6 +354,7 @@ mapAliases ({
   qiskit-aqua = throw "qiskit-aqua has been removed due to deprecation, with its functionality moved to different qiskit packages";
   rabbitpy = throw "rabbitpy has been removed, since it is unmaintained and broken"; # added 2023-07-01
   rdflib-jsonld = throw "rdflib-jsonld is not compatible with rdflib 6"; # added 2021-11-05
+  recaptcha_client = throw "recaptcha_client has been removed since it is no longer maintained"; # added 2023-10-20
   rednose = throw "rednose is no longer maintained (since February 2018)"; # added 2023-08-06
   retworkx = rustworkx; # added 2023-05-14
   repeated_test = repeated-test; # added 2022-11-15
@@ -381,6 +383,7 @@ mapAliases ({
   somecomfort = throw "somecomfort was removed because Home Assistant switched to aiosomecomfort"; # added 2023-02-01
   SPARQLWrapper = sparqlwrapper;
   sphinx-jquery = sphinxcontrib-jquery; # added 2023-02-24
+  sphinx_pypi_upload = throw "sphinx_pypi_upload has been removed since it is abandoned."; # added 2023-10-11
   sphinx_rtd_theme = sphinx-rtd-theme; # added 2022-08-03
   sphinxcontrib-autoapi = sphinx-autoapi; # added 2023-02=28
   sphinxcontrib_plantuml = sphinxcontrib-plantuml; # added 2021-08-02
@@ -432,5 +435,6 @@ mapAliases ({
   zope_contenttype = zope-contenttype; # added 2023-10-11
   zope_deprecation = zope-deprecation; # added 2023-10-07
   zope_i18nmessageid = zope-i18nmessageid; # added 2023-07-29
+  zope_lifecycleevent = zope-lifecycleevent; # added 2023-10-11
   zope_proxy = zope-proxy; # added 2023-10-07
 })
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 0dd42931c495..2ae3133dc39c 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1876,11 +1876,13 @@ self: super: with self; {
 
   certbot-dns-cloudflare = callPackage ../development/python-modules/certbot-dns-cloudflare { };
 
+  certbot-dns-google = callPackage ../development/python-modules/certbot-dns-google { };
+
   certbot-dns-inwx = callPackage ../development/python-modules/certbot-dns-inwx { };
 
-  certbot-dns-rfc2136 = callPackage ../development/python-modules/certbot-dns-rfc2136 { };
+  certbot-dns-ovh = callPackage ../development/python-modules/certbot-dns-ovh { };
 
-  certbot-dns-google = callPackage ../development/python-modules/certbot-dns-google { };
+  certbot-dns-rfc2136 = callPackage ../development/python-modules/certbot-dns-rfc2136 { };
 
   certbot-dns-route53 = callPackage ../development/python-modules/certbot-dns-route53 { };
 
@@ -2730,6 +2732,8 @@ self: super: with self; {
 
   derpconf = callPackage ../development/python-modules/derpconf { };
 
+  desktop-entry-lib = callPackage ../development/python-modules/desktop-entry-lib { };
+
   desktop-notifier = callPackage ../development/python-modules/desktop-notifier { };
 
   detect-secrets = callPackage ../development/python-modules/detect-secrets { };
@@ -3267,6 +3271,8 @@ self: super: with self; {
 
   dragonfly = callPackage ../development/python-modules/dragonfly { };
 
+  dramatiq = callPackage ../development/python-modules/dramatiq { };
+
   drawille = callPackage ../development/python-modules/drawille { };
 
   drawilleplot = callPackage ../development/python-modules/drawilleplot { };
@@ -3964,6 +3970,8 @@ self: super: with self; {
 
   flask-cors = callPackage ../development/python-modules/flask-cors { };
 
+  flask-dramatiq = callPackage ../development/python-modules/flask-dramatiq { };
+
   flask-elastic = callPackage ../development/python-modules/flask-elastic { };
 
   flask-expects-json = callPackage ../development/python-modules/flask-expects-json { };
@@ -8510,7 +8518,7 @@ self: super: with self; {
 
   opower = callPackage ../development/python-modules/opower { };
 
-  opsdroid_get_image_size = callPackage ../development/python-modules/opsdroid_get_image_size { };
+  opsdroid-get-image-size = callPackage ../development/python-modules/opsdroid-get-image-size { };
 
   opt-einsum = callPackage ../development/python-modules/opt-einsum { };
 
@@ -8846,6 +8854,8 @@ self: super: with self; {
 
   periodictable = callPackage ../development/python-modules/periodictable { };
 
+  periodiq = callPackage ../development/python-modules/periodiq { };
+
   permissionedforms = callPackage ../development/python-modules/permissionedforms { };
 
   persim = callPackage ../development/python-modules/persim { };
@@ -12026,8 +12036,6 @@ self: super: with self; {
 
   rebulk = callPackage ../development/python-modules/rebulk { };
 
-  recaptcha_client = callPackage ../development/python-modules/recaptcha_client { };
-
   recipe-scrapers = callPackage ../development/python-modules/recipe-scrapers { };
 
   recline = callPackage ../development/python-modules/recline { };
@@ -13222,8 +13230,6 @@ self: super: with self; {
 
   sphinx-mdinclude = callPackage ../development/python-modules/sphinx-mdinclude { };
 
-  sphinx_pypi_upload = callPackage ../development/python-modules/sphinx_pypi_upload { };
-
   sphinx-rtd-theme = callPackage ../development/python-modules/sphinx-rtd-theme { };
 
   sphinx-serve = callPackage ../development/python-modules/sphinx-serve { };
@@ -13342,6 +13348,8 @@ self: super: with self; {
 
   static3 = callPackage ../development/python-modules/static3 { };
 
+  staticmap = callPackage ../development/python-modules/staticmap { };
+
   staticjinja = callPackage ../development/python-modules/staticjinja { };
 
   statistics = callPackage ../development/python-modules/statistics { };
@@ -15421,6 +15429,8 @@ self: super: with self; {
     inherit (pkgs.darwin.apple_sdk.frameworks) CoreServices;
   };
 
+  watchdog-gevent = callPackage ../development/python-modules/watchdog-gevent { };
+
   watchfiles = callPackage ../development/python-modules/watchfiles {
     inherit (pkgs.darwin.apple_sdk.frameworks) CoreServices;
   };
@@ -15959,7 +15969,7 @@ self: super: with self; {
 
   zope_interface = callPackage ../development/python-modules/zope_interface { };
 
-  zope_lifecycleevent = callPackage ../development/python-modules/zope_lifecycleevent { };
+  zope-lifecycleevent = callPackage ../development/python-modules/zope-lifecycleevent { };
 
   zope_location = callPackage ../development/python-modules/zope_location { };