Merge master into staging-next

100 files changed, 2015 insertions, 1182 deletions

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 8c965ac79acd..5c78bb25caef 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -7664,6 +7664,12 @@
     githubId = 88038050;
     name = "Souvik Sen";
   };
+  iogamaster = {
+    email = "iogamastercode+nixpkgs@gmail.com";
+    name = "IogaMaster";
+    github = "iogamaster";
+    githubId = 67164465;
+  };
   ionutnechita = {
     email = "ionut_n2001@yahoo.com";
     github = "ionutnechita";
@@ -14088,6 +14094,12 @@
     githubId = 7839004;
     name = "Dmitriy Pleshevskiy";
   };
+  pluiedev = {
+    email = "hi@pluie.me";
+    github = "pluiedev";
+    githubId = 22406910;
+    name = "Leah Amelia Chen";
+  };
   plumps = {
     email = "maks.bronsky@web.de";
     github = "plumps";
@@ -16561,6 +16573,16 @@
     github = "SnO2WMaN";
     githubId = 15155608;
   };
+  snowflake = {
+    email = "snowflake@pissmail.com";
+    name = "Snowflake";
+    github = "snf1k";
+    githubId = 149651684;
+    matrix = "@snowflake:mozilla.org";
+    keys = [{
+      fingerprint = "8223 7B6F 2FF4 8F16 B652  6CA3 934F 9E5F 9701 2C0B";
+    }];
+  };
   snpschaaf = {
     email = "philipe.schaaf@secunet.com";
     name = "Philippe Schaaf";
diff --git a/nixos/doc/manual/configuration/x-windows.chapter.md b/nixos/doc/manual/configuration/x-windows.chapter.md
index 5a870a46cbb8..0451e4d25265 100644
--- a/nixos/doc/manual/configuration/x-windows.chapter.md
+++ b/nixos/doc/manual/configuration/x-windows.chapter.md
@@ -208,7 +208,7 @@ qt.style = "gtk2";
 
 It is possible to install custom [ XKB
 ](https://en.wikipedia.org/wiki/X_keyboard_extension) keyboard layouts
-using the option `services.xserver.extraLayouts`.
+using the option `services.xserver.xkb.extraLayouts`.
 
 As a first example, we are going to create a layout based on the basic
 US layout, with an additional layer to type some greek symbols by
@@ -235,7 +235,7 @@ xkb_symbols "us-greek"
 A minimal layout specification must include the following:
 
 ```nix
-services.xserver.extraLayouts.us-greek = {
+services.xserver.xkb.extraLayouts.us-greek = {
   description = "US layout with alt-gr greek";
   languages   = [ "eng" ];
   symbolsFile = /yourpath/symbols/us-greek;
@@ -298,7 +298,7 @@ xkb_symbols "media"
 As before, to install the layout do
 
 ```nix
-services.xserver.extraLayouts.media = {
+services.xserver.xkb.extraLayouts.media = {
   description  = "Multimedia keys remapping";
   languages    = [ "eng" ];
   symbolsFile  = /path/to/media-key;
diff --git a/nixos/doc/manual/release-notes/rl-2311.section.md b/nixos/doc/manual/release-notes/rl-2311.section.md
index 05e648a74fe6..aaeee4493aa2 100644
--- a/nixos/doc/manual/release-notes/rl-2311.section.md
+++ b/nixos/doc/manual/release-notes/rl-2311.section.md
@@ -334,7 +334,7 @@
   order, or relying on `mkBefore` and `mkAfter`, but may impact users calling
   `mkOrder n` with n ≤ 400.
 
-- X keyboard extension (XKB) options have been reorganized into a single attribute set, `services.xserver.xkb`. Specifically, `services.xserver.layout` is now `services.xserver.xkb.layout`, `services.xserver.xkbModel` is now `services.xserver.xkb.model`, `services.xserver.xkbOptions` is now `services.xserver.xkb.options`, `services.xserver.xkbVariant` is now `services.xserver.xkb.variant`, and `services.xserver.xkbDir` is now `services.xserver.xkb.dir`.
+- X keyboard extension (XKB) options have been reorganized into a single attribute set, `services.xserver.xkb`. Specifically, `services.xserver.layout` is now `services.xserver.xkb.layout`, `services.xserver.extraLayouts` is now `services.xserver.xkb.extraLayouts`, `services.xserver.xkbModel` is now `services.xserver.xkb.model`, `services.xserver.xkbOptions` is now `services.xserver.xkb.options`, `services.xserver.xkbVariant` is now `services.xserver.xkb.variant`, and `services.xserver.xkbDir` is now `services.xserver.xkb.dir`.
 
 - `networking.networkmanager.firewallBackend` was removed as NixOS is now using iptables-nftables-compat even when using iptables, therefore Networkmanager now uses the nftables backend unconditionally.
 
@@ -349,6 +349,8 @@
 
 - The `services.mtr-exporter.target` has been removed in favor of `services.mtr-exporter.jobs` which allows specifying multiple targets.
 
+- `blender-with-packages` has been deprecated in favor of `blender.withPackages`, for example `blender.withPackages (ps: [ps.bpycv])`. It behaves similarly to `python3.withPackages`.
+
 - Setting `nixpkgs.config` options while providing an external `pkgs` instance will now raise an error instead of silently ignoring the options. NixOS modules no longer set `nixpkgs.config` to accomodate this. This specifically affects `services.locate`, `services.xserver.displayManager.lightdm.greeters.tiny` and `programs.firefox` NixOS modules. No manual intervention should be required in most cases, however, configurations relying on those modules affecting packages outside the system environment should switch to explicit overlays.
 
 - `service.borgmatic.settings.location` and `services.borgmatic.configurations.<name>.location` are deprecated, please move your options out of sections to the global scope.
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 2a6ca202024b..9a1bc0450d26 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1506,6 +1506,7 @@
   ./virtualisation/docker.nix
   ./virtualisation/ecs-agent.nix
   ./virtualisation/hyperv-guest.nix
+  ./virtualisation/incus.nix
   ./virtualisation/kvmgt.nix
   ./virtualisation/libvirtd.nix
   ./virtualisation/lxc.nix
diff --git a/nixos/modules/services/x11/extra-layouts.nix b/nixos/modules/services/x11/extra-layouts.nix
index 3941f50b7550..ab7e39739eeb 100644
--- a/nixos/modules/services/x11/extra-layouts.nix
+++ b/nixos/modules/services/x11/extra-layouts.nix
@@ -3,7 +3,7 @@
 with lib;
 
 let
-  layouts = config.services.xserver.extraLayouts;
+  layouts = config.services.xserver.xkb.extraLayouts;
 
   layoutOpts = {
     options = {
@@ -15,10 +15,10 @@ let
       languages = mkOption {
         type = types.listOf types.str;
         description =
-        lib.mdDoc ''
-          A list of languages provided by the layout.
-          (Use ISO 639-2 codes, for example: "eng" for english)
-        '';
+          lib.mdDoc ''
+            A list of languages provided by the layout.
+            (Use ISO 639-2 codes, for example: "eng" for english)
+          '';
       };
 
       compatFile = mkOption {
@@ -80,29 +80,37 @@ let
   };
 
   xkb_patched = pkgs.xorg.xkeyboardconfig_custom {
-    layouts = config.services.xserver.extraLayouts;
+    layouts = config.services.xserver.xkb.extraLayouts;
   };
 
 in
 
 {
 
+  imports = [
+    (lib.mkRenamedOptionModuleWith {
+      sinceRelease = 2311;
+      from = [ "services" "xserver" "extraLayouts" ];
+      to = [ "services" "xserver" "xkb" "extraLayouts" ];
+    })
+  ];
+
   ###### interface
 
-  options.services.xserver = {
+  options.services.xserver.xkb = {
     extraLayouts = mkOption {
       type = types.attrsOf (types.submodule layoutOpts);
-      default = {};
+      default = { };
       example = literalExpression
-      ''
-        {
-          mine = {
-            description = "My custom xkb layout.";
-            languages = [ "eng" ];
-            symbolsFile = /path/to/my/layout;
-          };
-        }
-      '';
+        ''
+          {
+            mine = {
+              description = "My custom xkb layout.";
+              languages = [ "eng" ];
+              symbolsFile = /path/to/my/layout;
+            };
+          }
+        '';
       description = lib.mdDoc ''
         Extra custom layouts that will be included in the xkb configuration.
         Information on how to create a new layout can be found here:
diff --git a/nixos/modules/virtualisation/incus.nix b/nixos/modules/virtualisation/incus.nix
new file mode 100644
index 000000000000..3a4f0d7157a0
--- /dev/null
+++ b/nixos/modules/virtualisation/incus.nix
@@ -0,0 +1,236 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.virtualisation.incus;
+  preseedFormat = pkgs.formats.yaml { };
+in
+{
+  meta.maintainers = [ lib.maintainers.adamcstephens ];
+
+  options = {
+    virtualisation.incus = {
+      enable = lib.mkEnableOption (lib.mdDoc ''
+        incusd, a daemon that manages containers and virtual machines.
+
+        Users in the "incus-admin" group can interact with
+        the daemon (e.g. to start or stop containers) using the
+        {command}`incus` command line tool, among others.
+      '');
+
+      package = lib.mkPackageOptionMD pkgs "incus" { };
+
+      lxcPackage = lib.mkPackageOptionMD pkgs "lxc" { };
+
+      preseed = lib.mkOption {
+        type = lib.types.nullOr (
+          lib.types.submodule { freeformType = preseedFormat.type; }
+        );
+
+        default = null;
+
+        description = lib.mdDoc ''
+          Configuration for Incus preseed, see
+          <https://linuxcontainers.org/incus/docs/main/howto/initialize/#non-interactive-configuration>
+          for supported values.
+
+          Changes to this will be re-applied to Incus which will overwrite existing entities or create missing ones,
+          but entities will *not* be removed by preseed.
+        '';
+
+        example = {
+          networks = [
+            {
+              name = "incusbr0";
+              type = "bridge";
+              config = {
+                "ipv4.address" = "10.0.100.1/24";
+                "ipv4.nat" = "true";
+              };
+            }
+          ];
+          profiles = [
+            {
+              name = "default";
+              devices = {
+                eth0 = {
+                  name = "eth0";
+                  network = "incusbr0";
+                  type = "nic";
+                };
+                root = {
+                  path = "/";
+                  pool = "default";
+                  size = "35GiB";
+                  type = "disk";
+                };
+              };
+            }
+          ];
+          storage_pools = [
+            {
+              name = "default";
+              driver = "dir";
+              config = {
+                source = "/var/lib/incus/storage-pools/default";
+              };
+            }
+          ];
+        };
+      };
+
+      socketActivation = lib.mkEnableOption (
+        lib.mdDoc ''
+          socket-activation for starting incus.service. Enabling this option
+          will stop incus.service from starting automatically on boot.
+        ''
+      );
+
+      startTimeout = lib.mkOption {
+        type = lib.types.ints.unsigned;
+        default = 600;
+        apply = toString;
+        description = lib.mdDoc ''
+          Time to wait (in seconds) for incusd to become ready to process requests.
+          If incusd does not reply within the configured time, `incus.service` will be
+          considered failed and systemd will attempt to restart it.
+        '';
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    # https://github.com/lxc/incus/blob/f145309929f849b9951658ad2ba3b8f10cbe69d1/doc/reference/server_settings.md
+    boot.kernel.sysctl = {
+      "fs.aio-max-nr" = lib.mkDefault 524288;
+      "fs.inotify.max_queued_events" = lib.mkDefault 1048576;
+      "fs.inotify.max_user_instances" = lib.mkOverride 1050 1048576; # override in case conflict nixos/modules/services/x11/xserver.nix
+      "fs.inotify.max_user_watches" = lib.mkOverride 1050 1048576; # override in case conflict nixos/modules/services/x11/xserver.nix
+      "kernel.dmesg_restrict" = lib.mkDefault 1;
+      "kernel.keys.maxbytes" = lib.mkDefault 2000000;
+      "kernel.keys.maxkeys" = lib.mkDefault 2000;
+      "net.core.bpf_jit_limit" = lib.mkDefault 1000000000;
+      "net.ipv4.neigh.default.gc_thresh3" = lib.mkDefault 8192;
+      "net.ipv6.neigh.default.gc_thresh3" = lib.mkDefault 8192;
+      # vm.max_map_count is set higher in nixos/modules/config/sysctl.nix
+    };
+
+    boot.kernelModules = [
+      "veth"
+      "xt_comment"
+      "xt_CHECKSUM"
+      "xt_MASQUERADE"
+      "vhost_vsock"
+    ] ++ lib.optionals (!config.networking.nftables.enable) [ "iptable_mangle" ];
+
+    environment.systemPackages = [ cfg.package ];
+
+    # Note: the following options are also declared in virtualisation.lxc, but
+    # the latter can't be simply enabled to reuse the formers, because it
+    # does a bunch of unrelated things.
+    systemd.tmpfiles.rules = [ "d /var/lib/lxc/rootfs 0755 root root -" ];
+
+    security.apparmor = {
+      packages = [ cfg.lxcPackage ];
+      policies = {
+        "bin.lxc-start".profile = ''
+          include ${cfg.lxcPackage}/etc/apparmor.d/usr.bin.lxc-start
+        '';
+        "lxc-containers".profile = ''
+          include ${cfg.lxcPackage}/etc/apparmor.d/lxc-containers
+        '';
+      };
+    };
+
+    systemd.services.incus = {
+      description = "Incus Container and Virtual Machine Management Daemon";
+
+      wantedBy = lib.mkIf (!cfg.socketActivation) [ "multi-user.target" ];
+      after = [
+        "network-online.target"
+        "lxcfs.service"
+      ] ++ (lib.optional cfg.socketActivation "incus.socket");
+      requires = [
+        "lxcfs.service"
+      ] ++ (lib.optional cfg.socketActivation "incus.socket");
+      wants = [
+        "network-online.target"
+      ];
+
+      path = lib.mkIf config.boot.zfs.enabled [ config.boot.zfs.package ];
+
+      environment = {
+        # Override Path to the LXC template configuration directory
+        INCUS_LXC_TEMPLATE_CONFIG = "${pkgs.lxcfs}/share/lxc/config";
+      };
+
+      serviceConfig = {
+        ExecStart = "${cfg.package}/bin/incusd --group incus-admin";
+        ExecStartPost = "${cfg.package}/bin/incusd waitready --timeout=${cfg.startTimeout}";
+        ExecStop = "${cfg.package}/bin/incus admin shutdown";
+
+        KillMode = "process"; # when stopping, leave the containers alone
+        Delegate = "yes";
+        LimitMEMLOCK = "infinity";
+        LimitNOFILE = "1048576";
+        LimitNPROC = "infinity";
+        TasksMax = "infinity";
+
+        Restart = "on-failure";
+        TimeoutStartSec = "${cfg.startTimeout}s";
+        TimeoutStopSec = "30s";
+      };
+    };
+
+    systemd.sockets.incus = lib.mkIf cfg.socketActivation {
+      description = "Incus UNIX socket";
+      wantedBy = [ "sockets.target" ];
+
+      socketConfig = {
+        ListenStream = "/var/lib/incus/unix.socket";
+        SocketMode = "0660";
+        SocketGroup = "incus-admin";
+        Service = "incus.service";
+      };
+    };
+
+    systemd.services.incus-preseed = lib.mkIf (cfg.preseed != null) {
+      description = "Incus initialization with preseed file";
+
+      wantedBy = ["incus.service"];
+      after = ["incus.service"];
+      bindsTo = ["incus.service"];
+      partOf = ["incus.service"];
+
+      script = ''
+        ${cfg.package}/bin/incus admin init --preseed <${
+          preseedFormat.generate "incus-preseed.yaml" cfg.preseed
+        }
+      '';
+
+      serviceConfig = {
+        Type = "oneshot";
+        RemainAfterExit = true;
+      };
+    };
+
+    users.groups.incus-admin = { };
+
+    users.users.root = {
+      # match documented default ranges https://linuxcontainers.org/incus/docs/main/userns-idmap/#allowed-ranges
+      subUidRanges = [
+        {
+          startUid = 1000000;
+          count = 1000000000;
+        }
+      ];
+      subGidRanges = [
+        {
+          startGid = 1000000;
+          count = 1000000000;
+        }
+      ];
+    };
+
+    virtualisation.lxc.lxcfs.enable = true;
+  };
+}
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 979eb3e1aa77..6201045b54cc 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -394,6 +394,7 @@ in {
   icingaweb2 = handleTest ./icingaweb2.nix {};
   iftop = handleTest ./iftop.nix {};
   incron = handleTest ./incron.nix {};
+  incus = pkgs.recurseIntoAttrs (handleTest ./incus { inherit handleTestOn; });
   influxdb = handleTest ./influxdb.nix {};
   influxdb2 = handleTest ./influxdb2.nix {};
   initrd-network-openvpn = handleTest ./initrd-network-openvpn {};
diff --git a/nixos/tests/incus/container.nix b/nixos/tests/incus/container.nix
new file mode 100644
index 000000000000..79b9e2fbabdc
--- /dev/null
+++ b/nixos/tests/incus/container.nix
@@ -0,0 +1,77 @@
+import ../make-test-python.nix ({ pkgs, lib, ... } :
+
+let
+  releases = import ../../release.nix {
+    configuration = {
+      # Building documentation makes the test unnecessarily take a longer time:
+      documentation.enable = lib.mkForce false;
+    };
+  };
+
+  container-image-metadata = releases.lxdContainerMeta.${pkgs.stdenv.hostPlatform.system};
+  container-image-rootfs = releases.lxdContainerImage.${pkgs.stdenv.hostPlatform.system};
+in
+{
+  name = "incus-container";
+
+  meta.maintainers = with lib.maintainers; [ adamcstephens ];
+
+  nodes.machine = { ... }: {
+    virtualisation = {
+      # Ensure test VM has enough resources for creating and managing guests
+      cores = 2;
+      memorySize = 1024;
+      diskSize = 4096;
+
+      incus.enable = true;
+    };
+  };
+
+  testScript = ''
+    def instance_is_up(_) -> bool:
+        status, _ = machine.execute("incus exec container --disable-stdin --force-interactive /run/current-system/sw/bin/true")
+        return status == 0
+
+    def set_container(config):
+        machine.succeed(f"incus config set container {config}")
+        machine.succeed("incus restart container")
+        with machine.nested("Waiting for instance to start and be usable"):
+          retry(instance_is_up)
+
+    machine.wait_for_unit("incus.service")
+
+    # no preseed should mean no service
+    machine.fail("systemctl status incus-preseed.service")
+
+    machine.succeed("incus admin init --minimal")
+
+    with subtest("Container image can be imported"):
+        machine.succeed("incus image import ${container-image-metadata}/*/*.tar.xz ${container-image-rootfs}/*/*.tar.xz --alias nixos")
+
+    with subtest("Container can be launched and managed"):
+        machine.succeed("incus launch nixos container")
+        with machine.nested("Waiting for instance to start and be usable"):
+          retry(instance_is_up)
+        machine.succeed("echo true | incus exec container /run/current-system/sw/bin/bash -")
+
+    with subtest("Container CPU limits can be managed"):
+        set_container("limits.cpu 1")
+        cpuinfo = machine.succeed("incus exec container grep -- -c ^processor /proc/cpuinfo").strip()
+        assert cpuinfo == "1", f"Wrong number of CPUs reported from /proc/cpuinfo, want: 1, got: {cpuinfo}"
+
+        set_container("limits.cpu 2")
+        cpuinfo = machine.succeed("incus exec container grep -- -c ^processor /proc/cpuinfo").strip()
+        assert cpuinfo == "2", f"Wrong number of CPUs reported from /proc/cpuinfo, want: 2, got: {cpuinfo}"
+
+    with subtest("Container memory limits can be managed"):
+        set_container("limits.memory 64MB")
+        meminfo = machine.succeed("incus exec container grep -- MemTotal /proc/meminfo").strip()
+        meminfo_bytes = " ".join(meminfo.split(' ')[-2:])
+        assert meminfo_bytes == "62500 kB", f"Wrong amount of memory reported from /proc/meminfo, want: '62500 kB', got: '{meminfo_bytes}'"
+
+        set_container("limits.memory 128MB")
+        meminfo = machine.succeed("incus exec container grep -- MemTotal /proc/meminfo").strip()
+        meminfo_bytes = " ".join(meminfo.split(' ')[-2:])
+        assert meminfo_bytes == "125000 kB", f"Wrong amount of memory reported from /proc/meminfo, want: '125000 kB', got: '{meminfo_bytes}'"
+  '';
+})
diff --git a/nixos/tests/incus/default.nix b/nixos/tests/incus/default.nix
new file mode 100644
index 000000000000..c88974605e30
--- /dev/null
+++ b/nixos/tests/incus/default.nix
@@ -0,0 +1,14 @@
+{
+  system ? builtins.currentSystem,
+  config ? { },
+  pkgs ? import ../../.. { inherit system config; },
+  handleTestOn,
+}:
+{
+  container = import ./container.nix { inherit system pkgs; };
+  preseed = import ./preseed.nix { inherit system pkgs; };
+  socket-activated = import ./socket-activated.nix { inherit system pkgs; };
+  virtual-machine = handleTestOn [ "x86_64-linux" ] ./virtual-machine.nix {
+    inherit system pkgs;
+  };
+}
diff --git a/nixos/tests/incus/preseed.nix b/nixos/tests/incus/preseed.nix
new file mode 100644
index 000000000000..47b2d0cd6228
--- /dev/null
+++ b/nixos/tests/incus/preseed.nix
@@ -0,0 +1,60 @@
+import ../make-test-python.nix ({ pkgs, lib, ... } :
+
+{
+  name = "incus-preseed";
+
+  meta.maintainers = with lib.maintainers; [ adamcstephens ];
+
+  nodes.machine = { lib, ... }: {
+    virtualisation = {
+      incus.enable = true;
+
+      incus.preseed = {
+        networks = [
+          {
+            name = "nixostestbr0";
+            type = "bridge";
+            config = {
+              "ipv4.address" = "10.0.100.1/24";
+              "ipv4.nat" = "true";
+            };
+          }
+        ];
+        profiles = [
+          {
+            name = "nixostest_default";
+            devices = {
+              eth0 = {
+                name = "eth0";
+                network = "nixostestbr0";
+                type = "nic";
+              };
+              root = {
+                path = "/";
+                pool = "default";
+                size = "35GiB";
+                type = "disk";
+              };
+            };
+          }
+        ];
+        storage_pools = [
+          {
+            name = "nixostest_pool";
+            driver = "dir";
+          }
+        ];
+      };
+    };
+  };
+
+  testScript = ''
+    machine.wait_for_unit("incus.service")
+    machine.wait_for_unit("incus-preseed.service")
+
+    with subtest("Verify preseed resources created"):
+      machine.succeed("incus profile show nixostest_default")
+      machine.succeed("incus network info nixostestbr0")
+      machine.succeed("incus storage show nixostest_pool")
+  '';
+})
diff --git a/nixos/tests/incus/socket-activated.nix b/nixos/tests/incus/socket-activated.nix
new file mode 100644
index 000000000000..4d25b26a15f5
--- /dev/null
+++ b/nixos/tests/incus/socket-activated.nix
@@ -0,0 +1,26 @@
+import ../make-test-python.nix ({ pkgs, lib, ... } :
+
+{
+  name = "incus-socket-activated";
+
+  meta.maintainers = with lib.maintainers; [ adamcstephens ];
+
+  nodes.machine = { lib, ... }: {
+    virtualisation = {
+      incus.enable = true;
+      incus.socketActivation = true;
+    };
+  };
+
+  testScript = ''
+    machine.wait_for_unit("incus.socket")
+
+    # ensure service is not running by default
+    machine.fail("systemctl is-active incus.service")
+    machine.fail("systemctl is-active incus-preseed.service")
+
+    # access the socket and ensure the service starts
+    machine.succeed("incus list")
+    machine.wait_for_unit("incus.service")
+  '';
+})
diff --git a/nixos/tests/incus/virtual-machine.nix b/nixos/tests/incus/virtual-machine.nix
new file mode 100644
index 000000000000..bfa116679d43
--- /dev/null
+++ b/nixos/tests/incus/virtual-machine.nix
@@ -0,0 +1,55 @@
+import ../make-test-python.nix ({ pkgs, lib, ... }:
+
+let
+  releases = import ../../release.nix {
+    configuration = {
+      # Building documentation makes the test unnecessarily take a longer time:
+      documentation.enable = lib.mkForce false;
+
+      # Our tests require `grep` & friends:
+      environment.systemPackages = with pkgs; [busybox];
+    };
+  };
+
+  vm-image-metadata = releases.lxdVirtualMachineImageMeta.${pkgs.stdenv.hostPlatform.system};
+  vm-image-disk = releases.lxdVirtualMachineImage.${pkgs.stdenv.hostPlatform.system};
+
+  instance-name = "instance1";
+in
+{
+  name = "incus-virtual-machine";
+
+  meta.maintainers = with lib.maintainers; [ adamcstephens ];
+
+  nodes.machine = {...}: {
+    virtualisation = {
+      # Ensure test VM has enough resources for creating and managing guests
+      cores = 2;
+      memorySize = 1024;
+      diskSize = 4096;
+
+      incus.enable = true;
+    };
+  };
+
+  testScript = ''
+    def instance_is_up(_) -> bool:
+      status, _ = machine.execute("incus exec ${instance-name} --disable-stdin --force-interactive /run/current-system/sw/bin/true")
+      return status == 0
+
+    machine.wait_for_unit("incus.service")
+
+    machine.succeed("incus admin init --minimal")
+
+    with subtest("virtual-machine image can be imported"):
+        machine.succeed("incus image import ${vm-image-metadata}/*/*.tar.xz ${vm-image-disk}/nixos.qcow2 --alias nixos")
+
+    with subtest("virtual-machine can be launched and become available"):
+        machine.succeed("incus launch nixos ${instance-name} --vm --config limits.memory=512MB --config security.secureboot=false")
+        with machine.nested("Waiting for instance to start and be usable"):
+          retry(instance_is_up)
+
+    with subtest("lxd-agent is started"):
+        machine.succeed("incus exec ${instance-name} systemctl is-active lxd-agent")
+  '';
+})
diff --git a/nixos/tests/keymap.nix b/nixos/tests/keymap.nix
index 0e160269304b..e8973a50f852 100644
--- a/nixos/tests/keymap.nix
+++ b/nixos/tests/keymap.nix
@@ -213,7 +213,7 @@ in pkgs.lib.mapAttrs mkKeyboardTest {
 
     extraConfig.console.useXkbConfig = true;
     extraConfig.services.xserver.xkb.layout = "us-greek";
-    extraConfig.services.xserver.extraLayouts.us-greek =
+    extraConfig.services.xserver.xkb.extraLayouts.us-greek =
       { description = "US layout with alt-gr greek";
         languages   = [ "eng" ];
         symbolsFile = pkgs.writeText "us-greek" ''
diff --git a/pkgs/README.md b/pkgs/README.md
index 4845cfa31755..642833d968f3 100644
--- a/pkgs/README.md
+++ b/pkgs/README.md
@@ -568,7 +568,7 @@ This is how the pull request looks like in this case: [https://github.com/NixOS/
 To run the main types of tests locally:
 
 - Run package-internal tests with `nix-build --attr pkgs.PACKAGE.passthru.tests`
-- Run [NixOS tests](https://nixos.org/manual/nixos/unstable/#sec-nixos-tests) with `nix-build --attr nixosTest.NAME`, where `NAME` is the name of the test listed in `nixos/tests/all-tests.nix`
+- Run [NixOS tests](https://nixos.org/manual/nixos/unstable/#sec-nixos-tests) with `nix-build --attr nixosTests.NAME`, where `NAME` is the name of the test listed in `nixos/tests/all-tests.nix`
 - Run [global package tests](https://nixos.org/manual/nixpkgs/unstable/#sec-package-tests) with `nix-build --attr tests.PACKAGE`, where `PACKAGE` is the name of the test listed in `pkgs/test/default.nix`
 - See `lib/tests/NAME.nix` for instructions on running specific library tests
 
diff --git a/pkgs/applications/editors/kakoune/plugins/aliases.nix b/pkgs/applications/editors/kakoune/plugins/aliases.nix
index 2f097dee5275..1d516f9b436f 100644
--- a/pkgs/applications/editors/kakoune/plugins/aliases.nix
+++ b/pkgs/applications/editors/kakoune/plugins/aliases.nix
@@ -39,6 +39,7 @@ in
 mapAliases ({
   kak-auto-pairs         = auto-pairs-kak; # backwards compat, added 2021-01-04
   kak-buffers            = kakoune-buffers; # backwards compat, added 2021-01-04
+  kak-byline             = byline-kak; # backwards compat, added 2023-10-22
   kak-fzf                = fzf-kak; # backwards compat, added 2021-01-04
   kak-powerline          = powerline-kak; # backwards compat, added 2021-01-04
   kak-prelude            = prelude-kak; # backwards compat, added 2021-01-04
diff --git a/pkgs/applications/editors/kakoune/plugins/generated.nix b/pkgs/applications/editors/kakoune/plugins/generated.nix
index a37c90fb99d3..84fc2cec0a95 100644
--- a/pkgs/applications/editors/kakoune/plugins/generated.nix
+++ b/pkgs/applications/editors/kakoune/plugins/generated.nix
@@ -17,16 +17,28 @@ packages = ( self:
 
   auto-pairs-kak = buildKakounePluginFrom2Nix {
     pname = "auto-pairs-kak";
-    version = "2022-03-13";
+    version = "2023-07-30";
     src = fetchFromGitHub {
       owner = "alexherbo2";
       repo = "auto-pairs.kak";
-      rev = "bfdcb8566076f653ec707f86207f83ea75173ce9";
-      sha256 = "0vx9msk8wlj8p9qf6yiv9gzrbanb5w245cidnx5cppgld2w842ij";
+      rev = "d4b33b783ea42a536c848296b5b6d434b4d1470f";
+      sha256 = "017x9g89q0w60y561xhigc0f14ryp4phh1hdna847ca5lvmbxksp";
     };
     meta.homepage = "https://github.com/alexherbo2/auto-pairs.kak/";
   };
 
+  byline-kak = buildKakounePluginFrom2Nix {
+    pname = "byline-kak";
+    version = "2023-02-27";
+    src = fetchFromGitHub {
+      owner = "evanrelf";
+      repo = "byline.kak";
+      rev = "a27d109b776c60e11752eeb3207c989a5e157fc0";
+      sha256 = "121dxd65ml65ablkvdxj0rib3kvfwss0pv943bgl3nq35ag19b81";
+    };
+    meta.homepage = "https://github.com/evanrelf/byline.kak/";
+  };
+
   connect-kak = buildKakounePluginFrom2Nix {
     pname = "connect-kak";
     version = "2021-02-24";
@@ -137,12 +149,12 @@ packages = ( self:
 
   kakoune-vertical-selection = buildKakounePluginFrom2Nix {
     pname = "kakoune-vertical-selection";
-    version = "2022-11-29";
+    version = "2023-04-20";
     src = fetchFromGitHub {
       owner = "occivink";
       repo = "kakoune-vertical-selection";
-      rev = "227b3fd9643e6e3b9d36fab324081a988c038e21";
-      sha256 = "0ygqhlk31ilczpwws28iqya8i1qhnwkb5rw6bn2zqgxj428a1kqj";
+      rev = "dbb39712e3824ca6142b510f26f35a769934a1e1";
+      sha256 = "1wncx16a8mi2b81cvkiji3ccv8is5g3sa4hwf1669va5a432vdwn";
     };
     meta.homepage = "https://github.com/occivink/kakoune-vertical-selection/";
   };
@@ -209,12 +221,12 @@ packages = ( self:
 
   tabs-kak = buildKakounePluginFrom2Nix {
     pname = "tabs-kak";
-    version = "2021-07-05";
+    version = "2023-05-15";
     src = fetchFromGitHub {
       owner = "enricozb";
       repo = "tabs.kak";
-      rev = "1cb19e410a3ef299f7a701fa5bec98c2d9284dac";
-      sha256 = "0hxa4mvw1k74vscxkm520c6g7iwcaqh8kj9g4mwy6n5kkvr1drf0";
+      rev = "f0b3a399db1dfa12b89fbff3eed09aec74725bab";
+      sha256 = "1sg26bv4vr08pqyxp68wsmzj8vhi2qg1bmkqb2jnngi5sjp4r7xy";
     };
     meta.homepage = "https://github.com/enricozb/tabs.kak/";
   };
diff --git a/pkgs/applications/editors/kakoune/plugins/kakoune-plugin-names b/pkgs/applications/editors/kakoune/plugins/kakoune-plugin-names
index b856308c7831..3f4a640e2f35 100644
--- a/pkgs/applications/editors/kakoune/plugins/kakoune-plugin-names
+++ b/pkgs/applications/editors/kakoune/plugins/kakoune-plugin-names
@@ -1,6 +1,7 @@
 repo,branch,alias
 https://github.com/greenfork/active-window.kak/,,
 https://github.com/alexherbo2/auto-pairs.kak/,,
+https://github.com/evanrelf/byline.kak/,,
 https://github.com/kakounedotcom/connect.kak/,,
 https://github.com/andreyorst/fzf.kak/,,
 https://github.com/lePerdu/kakboard/,,
diff --git a/pkgs/applications/editors/kakoune/plugins/update.py b/pkgs/applications/editors/kakoune/plugins/update.py
index 5ce54c834f08..5e0ca51727c1 100755
--- a/pkgs/applications/editors/kakoune/plugins/update.py
+++ b/pkgs/applications/editors/kakoune/plugins/update.py
@@ -73,6 +73,9 @@ in lib.fix' (lib.extends overrides packages)
             )
         print(f"updated {outfile}")
 
+    def update(self, args):
+        pluginupdate.update_plugins(self, args)
+
 
 def main():
     editor = KakouneEditor("kakoune", ROOT, GET_PLUGINS)
diff --git a/pkgs/applications/editors/openvi/default.nix b/pkgs/applications/editors/openvi/default.nix
index 83abef98152b..54a57d949eff 100644
--- a/pkgs/applications/editors/openvi/default.nix
+++ b/pkgs/applications/editors/openvi/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "openvi";
-  version = "7.4.24";
+  version = "7.4.26";
 
   src = fetchFromGitHub {
     owner = "johnsonjh";
     repo = "OpenVi";
     rev = version;
-    hash = "sha256-jfh82Ti8iVqsh7G9BnHbc3cQP8D9dGV71YJ28SBjjgA=";
+    hash = "sha256-Fgsw4ovq7PXqPF5ECVFJulrcHdsbRQsvy62DAr4RRr4=";
   };
 
   buildInputs = [ ncurses perl ];
diff --git a/pkgs/applications/editors/pixelorama/default.nix b/pkgs/applications/editors/pixelorama/default.nix
index 0ca79907f8e8..65e724df3db9 100644
--- a/pkgs/applications/editors/pixelorama/default.nix
+++ b/pkgs/applications/editors/pixelorama/default.nix
@@ -26,13 +26,13 @@ let
     else throw "unsupported platform";
 in stdenv.mkDerivation (finalAttrs: {
   pname = "pixelorama";
-  version = "0.11.2";
+  version = "0.11.3";
 
   src = fetchFromGitHub {
     owner = "Orama-Interactive";
     repo = "Pixelorama";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-jSgSKxW7cxSoSwBytoaQtLwbkYm2udjmaZTHbN1jJwQ=";
+    sha256 = "sha256-+bQRUTEJluhcs5P87It9/oJOzrCcNFzDJVpixoQKXQc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/finance/odoo/default.nix b/pkgs/applications/finance/odoo/default.nix
index f00118fdf75a..c10e0d43686f 100644
--- a/pkgs/applications/finance/odoo/default.nix
+++ b/pkgs/applications/finance/odoo/default.nix
@@ -11,41 +11,25 @@
 let
   python = python310.override {
     packageOverrides = self: super: {
-      pypdf2 = super.pypdf2.overridePythonAttrs (old: rec {
-        version = "1.28.6";
-        format = "setuptools";
-
-        src = fetchFromGitHub {
-          owner = "py-pdf";
-          repo = "pypdf";
-          rev = version;
-          fetchSubmodules = true;
-          hash = "sha256-WnRbsy/PJcotZqY9mJPLadrYqkXykOVifLIbDyNf4s4=";
-        };
-
-        nativeBuildInputs = [];
-
-        nativeCheckInputs = with self; [ pytestCheckHook pillow ];
-      });
       flask = super.flask.overridePythonAttrs (old: rec {
-        version = "2.1.3";
+        version = "2.3.3";
         src = old.src.override {
           inherit version;
-          hash = "sha256-FZcuUBffBXXD1sCQuhaLbbkCWeYgrI1+qBOjlrrVtss=";
+          hash = "sha256-CcNHqSqn/0qOfzIGeV8w2CZlS684uHPQdEzVccpgnvw=";
         };
       });
       werkzeug = super.werkzeug.overridePythonAttrs (old: rec {
-        version = "2.1.2";
+        version = "2.3.7";
         src = old.src.override {
           inherit version;
-          hash = "sha256-HOCOgJPtZ9Y41jh5/Rujc1gX96gN42dNKT9ZhPJftuY=";
+          hash = "sha256-K4wORHtLnbzIXdl7butNy69si2w74L1lTiVVPgohV9g=";
         };
       });
     };
   };
 
   odoo_version = "16.0";
-  odoo_release = "20230722";
+  odoo_release = "20231024";
 in python.pkgs.buildPythonApplication rec {
   pname = "odoo";
   version = "${odoo_version}.${odoo_release}";
@@ -56,7 +40,7 @@ in python.pkgs.buildPythonApplication rec {
   src = fetchzip {
     url = "https://nightly.odoo.com/${odoo_version}/nightly/src/odoo_${version}.zip";
     name = "${pname}-${version}";
-    hash = "sha256-pSycpYSiqJ6DKENvCWwLz+JaPUXT5dmaq8x4Aency60="; # odoo
+    hash = "sha256-Ux8RfA7kWLKissBBY5wrfL+aKKw++5BxjP3Vw0JAOsk="; # odoo
   };
 
   # needs some investigation
@@ -69,6 +53,7 @@ in python.pkgs.buildPythonApplication rec {
   propagatedBuildInputs = with python.pkgs; [
     babel
     chardet
+    cryptography
     decorator
     docutils
     ebaysdk
@@ -80,7 +65,6 @@ in python.pkgs.buildPythonApplication rec {
     libsass
     lxml
     markupsafe
-    mock
     num2words
     ofxparse
     passlib
@@ -100,13 +84,16 @@ in python.pkgs.buildPythonApplication rec {
     qrcode
     reportlab
     requests
-    setuptools
+    urllib3
     vobject
     werkzeug
     xlrd
     xlsxwriter
     xlwt
     zeep
+
+    setuptools
+    mock
   ];
 
   # takes 5+ minutes and there are not files to strip
diff --git a/pkgs/applications/misc/blender/default.nix b/pkgs/applications/misc/blender/default.nix
index 8e7fde6d9c29..7a6db59bf66d 100644
--- a/pkgs/applications/misc/blender/default.nix
+++ b/pkgs/applications/misc/blender/default.nix
@@ -18,10 +18,13 @@
 , openpgl
 , mesa
 , runCommand
+, callPackage
 }:
 
 let
-  python = python310Packages.python;
+  pythonPackages = python310Packages;
+  inherit (pythonPackages) python;
+  buildEnv = callPackage ./wrapper.nix {};
   optix = fetchzip {
     # url taken from the archlinux blender PKGBUILD
     url = "https://developer.download.nvidia.com/redist/optix/v7.3/OptiX-7.3.0-Include.zip";
@@ -189,7 +192,9 @@ stdenv.mkDerivation (finalAttrs: rec {
   '';
 
   passthru = {
-    inherit python;
+    inherit python pythonPackages;
+
+    withPackages = f: let packages = f pythonPackages; in buildEnv.override { blender = finalAttrs.finalPackage; extraModules = packages; };
 
     tests = {
       render = runCommand "${pname}-test" { } ''
diff --git a/pkgs/applications/misc/blender/wrapper.nix b/pkgs/applications/misc/blender/wrapper.nix
index 3828d61a8645..7450827a8fa9 100644
--- a/pkgs/applications/misc/blender/wrapper.nix
+++ b/pkgs/applications/misc/blender/wrapper.nix
@@ -2,32 +2,28 @@
 , lib
 , blender
 , makeWrapper
-, python3Packages
+, extraModules ? []
 }:
-{ name ? "wrapped"
-, packages ? []
-}:
-stdenv.mkDerivation {
-  pname = "blender-${name}";
-  inherit (blender) version;
+stdenv.mkDerivation (finalAttrs: {
+  pname = blender.pname + "-wrapped";
   src = blender;
 
-  nativeBuildInputs = [ python3Packages.wrapPython makeWrapper ];
+  inherit (blender) version meta;
+
+  nativeBuildInputs = [ blender.pythonPackages.wrapPython makeWrapper ];
   installPhase = ''
     mkdir $out/{share/applications,bin} -p
-    sed 's/Exec=blender/Exec=blender-${name}/g' $src/share/applications/blender.desktop > $out/share/applications/blender-${name}.desktop
+    sed 's/Exec=blender/Exec=${finalAttrs.finalPackage.pname}/g' $src/share/applications/blender.desktop > $out/share/applications/${finalAttrs.finalPackage.pname}.desktop
     cp -r $src/share/blender $out/share
     cp -r $src/share/doc $out/share
     cp -r $src/share/icons $out/share
 
     buildPythonPath "$pythonPath"
 
-    makeWrapper ${blender}/bin/blender $out/bin/blender-${name} \
+    makeWrapper ${blender}/bin/blender $out/bin/${finalAttrs.finalPackage.pname} \
       --prefix PATH : $program_PATH \
       --prefix PYTHONPATH : $program_PYTHONPATH
   '';
 
-  pythonPath = packages;
-
-  meta = blender.meta;
-}
+  pythonPath = extraModules;
+})
diff --git a/pkgs/applications/networking/avalanchego/default.nix b/pkgs/applications/networking/avalanchego/default.nix
index 7e79064833a4..e2673068dcb3 100644
--- a/pkgs/applications/networking/avalanchego/default.nix
+++ b/pkgs/applications/networking/avalanchego/default.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "avalanchego";
-  version = "1.10.11";
+  version = "1.10.15";
 
   src = fetchFromGitHub {
     owner = "ava-labs";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-6eebc8+SsonTngOIM5C+cxqzhFSLK5wLB/sBhVQuTQ4=";
+    hash = "sha256-vx9Vfbdxd3Y0fdjpKC6LFAUEej1RHszyM5GUUGKy0zU=";
   };
 
-  vendorHash = "sha256-sBoH/0SQtHO/fgyfve4bpy74GIS8qWr6KcIQyOnkgkI=";
+  vendorHash = "sha256-br/z6k1D1r9JEECKNy7BOZzfHaaveCMUA1bKos0+p0Q=";
   # go mod vendor has a bug, see: https://github.com/golang/go/issues/57529
   proxyVendor = true;
 
diff --git a/pkgs/applications/networking/browsers/qutebrowser/default.nix b/pkgs/applications/networking/browsers/qutebrowser/default.nix
index 054726f65948..03b03724aeef 100644
--- a/pkgs/applications/networking/browsers/qutebrowser/default.nix
+++ b/pkgs/applications/networking/browsers/qutebrowser/default.nix
@@ -57,6 +57,8 @@ python3.pkgs.buildPythonApplication {
     pynacl
     # extensive ad blocking
     adblock
+    # for the qute-bitwarden user script to be able to copy the TOTP token to clipboard
+    pyperclip
   ] ++ lib.optional stdenv.isLinux qtwayland
   );
 
diff --git a/pkgs/applications/networking/p2p/gnunet/gtk.nix b/pkgs/applications/networking/p2p/gnunet/gtk.nix
index a915e3fed8e0..94504f2b9956 100644
--- a/pkgs/applications/networking/p2p/gnunet/gtk.nix
+++ b/pkgs/applications/networking/p2p/gnunet/gtk.nix
@@ -38,7 +38,11 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "--with-gnunet=${gnunet}" ];
 
-  patchPhase = "patchShebangs pixmaps/icon-theme-installer";
+  postPatch = "patchShebangs pixmaps/icon-theme-installer";
+
+  postInstall = ''
+    ln -s $out/share/gnunet-gtk/gnunet_logo.png $out/share/gnunet/gnunet-logo-color.png
+  '';
 
   meta = gnunet.meta // {
     description = "GNUnet GTK User Interface";
diff --git a/pkgs/applications/version-management/gitlab/data.json b/pkgs/applications/version-management/gitlab/data.json
index 3566e85a2707..01773299cf1b 100644
--- a/pkgs/applications/version-management/gitlab/data.json
+++ b/pkgs/applications/version-management/gitlab/data.json
@@ -1,15 +1,15 @@
 {
-  "version": "16.4.1",
-  "repo_hash": "sha256-gIoHv+Zt0WgxxL1GLz1iaK1g3uJNMbp+Umo6FbWEggY=",
-  "yarn_hash": "0106yyiy00cag36mgckiwfdvhz23fsnskigpd533kjrl32qr9d6l",
+  "version": "16.5.1",
+  "repo_hash": "sha256-7vKdCFDgtXSTlYV9nfLuQ+LZCaGDLU9zp97rob4dj2A=",
+  "yarn_hash": "1df7lf2grxpfjy1vgwsxw9n310jgjb64vqcxn2a7wzgh0svr1yyf",
   "owner": "gitlab-org",
   "repo": "gitlab",
-  "rev": "v16.4.1-ee",
+  "rev": "v16.5.1-ee",
   "passthru": {
-    "GITALY_SERVER_VERSION": "16.4.1",
-    "GITLAB_PAGES_VERSION": "16.4.1",
-    "GITLAB_SHELL_VERSION": "14.28.0",
-    "GITLAB_ELASTICSEARCH_INDEXER_VERSION": "4.3.9",
-    "GITLAB_WORKHORSE_VERSION": "16.4.1"
+    "GITALY_SERVER_VERSION": "16.5.1",
+    "GITLAB_PAGES_VERSION": "16.5.1",
+    "GITLAB_SHELL_VERSION": "14.29.0",
+    "GITLAB_ELASTICSEARCH_INDEXER_VERSION": "4.4.0",
+    "GITLAB_WORKHORSE_VERSION": "16.5.1"
   }
 }
diff --git a/pkgs/applications/version-management/gitlab/default.nix b/pkgs/applications/version-management/gitlab/default.nix
index 559058824340..bc5d3aa8b33d 100644
--- a/pkgs/applications/version-management/gitlab/default.nix
+++ b/pkgs/applications/version-management/gitlab/default.nix
@@ -160,6 +160,7 @@ stdenv.mkDerivation {
     ${replace}/bin/replace-literal -f -r -e '../../lib' "$out/share/gitlab/lib" config
     ${replace}/bin/replace-literal -f -r -e '../lib' "$out/share/gitlab/lib" config
     ${replace}/bin/replace-literal -f -r -e "require_relative 'application'" "require_relative '$out/share/gitlab/config/application'" config
+    ${replace}/bin/replace-literal -f -r -e 'require_relative "/home/git/gitlab/lib/gitlab/puma/error_handler"' "require_relative '$out/share/gitlab/lib/gitlab/puma/error_handler'" config
   '';
 
   buildPhase = ''
diff --git a/pkgs/applications/version-management/gitlab/gitaly/default.nix b/pkgs/applications/version-management/gitlab/gitaly/default.nix
index f89f920c4c0b..eddab0b53c9d 100644
--- a/pkgs/applications/version-management/gitlab/gitaly/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitaly/default.nix
@@ -6,21 +6,22 @@
 }:
 
 let
-  version = "16.4.1";
+  version = "16.5.1";
   package_version = "v${lib.versions.major version}";
   gitaly_package = "gitlab.com/gitlab-org/gitaly/${package_version}";
 
   commonOpts = {
     inherit version;
 
+    # nixpkgs-update: no auto update
     src = fetchFromGitLab {
       owner = "gitlab-org";
       repo = "gitaly";
       rev = "v${version}";
-      hash = "sha256-t3d72l/Na0qv+jezT/YhAUbG9DSSe9pyixQjTALTxvk=";
+      hash = "sha256-LrkFSsWIPqiEXUV5OyYkB2XUbCMXjbpcCmTacR33vOQ=";
     };
 
-    vendorHash = "sha256-Nlq1l1f389DC854rFznEu2Viv0T7Y1cD1Ht0o2N304o=";
+    vendorHash = "sha256-QLt/12P6OLpLqCINROLmzhoRpLGrB9WzME7FzhIcb0Q=";
 
     ldflags = [ "-X ${gitaly_package}/internal/version.version=${version}" "-X ${gitaly_package}/internal/version.moduleVersion=${version}" ];
 
diff --git a/pkgs/applications/version-management/gitlab/gitlab-container-registry/default.nix b/pkgs/applications/version-management/gitlab/gitlab-container-registry/default.nix
index 0cac9f890e78..44fc1630c196 100644
--- a/pkgs/applications/version-management/gitlab/gitlab-container-registry/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-container-registry/default.nix
@@ -2,17 +2,18 @@
 
 buildGoModule rec {
   pname = "gitlab-container-registry";
-  version = "3.84.0";
+  version = "3.85.0";
   rev = "v${version}-gitlab";
 
+  # nixpkgs-update: no auto update
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "container-registry";
     inherit rev;
-    sha256 = "sha256-VdLovX3/y0fME74YlpPxjNPAwFpr1urAHJYO24VJ4AE=";
+    sha256 = "sha256-F20f1qDsI+moBAL+Tpx5AALgOi0vTH7hZ5RIvRMwY1s=";
   };
 
-  vendorHash = "sha256-ZFQixOgcB8GqgZPIbjMJEYOlg9cD+wAMZF7mwWaNSXI=";
+  vendorHash = "sha256-JWuSJD2Mi0om9vA6+mYbArfr2lmGlRua6IM0DhDzSBk=";
 
   patches = [
     ./Disable-inmemory-storage-driver-test.patch
diff --git a/pkgs/applications/version-management/gitlab/gitlab-elasticsearch-indexer/default.nix b/pkgs/applications/version-management/gitlab/gitlab-elasticsearch-indexer/default.nix
index 11e272e1bcc4..9a513a1590fd 100644
--- a/pkgs/applications/version-management/gitlab/gitlab-elasticsearch-indexer/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-elasticsearch-indexer/default.nix
@@ -2,17 +2,17 @@
 
 buildGoModule rec {
   pname = "gitlab-elasticsearch-indexer";
-  version = "4.3.9";
+  version = "4.4.0";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-elasticsearch-indexer";
     rev = "v${version}";
-    sha256 = "sha256-/jo44MlLWZCSUWFW2rJSqugNYZCXEs5pfj0f6fZs4zg=";
+    sha256 = "sha256-Qywf5ACxXqY1iUZCsROTLmWeM8gFcqZvnClRo5DlnjY=";
   };
 
-  vendorHash = "sha256-TQ6E5eckZNVL6zzaS9m0izWnQitqfpc4MAEoQOVasnA=";
+  vendorHash = "sha256-2dUlztXnr7OH/gQ0Q4jQpuO1MdkOy1O4BNGiY223DAA=";
 
   buildInputs = [ icu ];
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/applications/version-management/gitlab/gitlab-pages/default.nix b/pkgs/applications/version-management/gitlab/gitlab-pages/default.nix
index 7810639eca74..72a12a81f3c2 100644
--- a/pkgs/applications/version-management/gitlab/gitlab-pages/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-pages/default.nix
@@ -2,16 +2,17 @@
 
 buildGoModule rec {
   pname = "gitlab-pages";
-  version = "16.4.1";
+  version = "16.5.1";
 
+  # nixpkgs-update: no auto update
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-pages";
     rev = "v${version}";
-    hash = "sha256-aUpuzgFbxMJwKjTn+QAudOeMBSLtLTjaTmwe25f6qxg=";
+    hash = "sha256-1fcsliorkl118MyUnZ3yrQjwLBQGsNBBA4dIEFHBJAI=";
   };
 
-  vendorHash = "sha256-ko0ycT8HlqVfXf7tck0xcs6rDJMpHxjSoI59gTLgqDQ=";
+  vendorHash = "sha256-YG+ERETxp0BPh/V4820pMXTXu9YcodRhzme6qZJBC9Q=";
   subPackages = [ "." ];
 
   meta = with lib; {
diff --git a/pkgs/applications/version-management/gitlab/gitlab-shell/default.nix b/pkgs/applications/version-management/gitlab/gitlab-shell/default.nix
index 01b119326396..882cb5f53844 100644
--- a/pkgs/applications/version-management/gitlab/gitlab-shell/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-shell/default.nix
@@ -2,19 +2,21 @@
 
 buildGoModule rec {
   pname = "gitlab-shell";
-  version = "14.28.0";
+  version = "14.29.0";
+
+  # nixpkgs-update: no auto update
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-shell";
     rev = "v${version}";
-    sha256 = "sha256-w/Td4J4t/xrkR5LmFTcAD5U9ZR3HDGqLNxpjkDC0pi4=";
+    sha256 = "sha256-MhvFLBH0CLiGNTEjHy7vDhLE3YsvbBL8XRNytPEa6uU=";
   };
 
   buildInputs = [ ruby libkrb5 ];
 
   patches = [ ./remove-hardcoded-locations.patch ];
 
-  vendorHash = "sha256-EIJSBUUsWvA93OAyBNey2WA2sV+7YSWbsC1RnWf6nrI=";
+  vendorHash = "sha256-g1ZaRY0A7oREByNicPvnuxakYrNQNXg4Vy94iyNVdDY=";
 
   postInstall = ''
     cp -r "$NIX_BUILD_TOP/source"/bin/* $out/bin
diff --git a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
index 690af3a806d4..961d2d6dbd6c 100644
--- a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
@@ -5,8 +5,9 @@ in
 buildGoModule rec {
   pname = "gitlab-workhorse";
 
-  version = "16.4.1";
+  version = "16.5.1";
 
+  # nixpkgs-update: no auto update
   src = fetchFromGitLab {
     owner = data.owner;
     repo = data.repo;
@@ -16,7 +17,7 @@ buildGoModule rec {
 
   sourceRoot = "${src.name}/workhorse";
 
-  vendorHash = "sha256-C6FVTOY3CdO2y6mKuvgEWDZnWevRTxeOefRF2EbXDv8=";
+  vendorHash = "sha256-m8cDhI6DzFnSEZscZQfFm8l9MTJqTqxhBFJeTX1HWiE=";
   buildInputs = [ git ];
   ldflags = [ "-X main.Version=${version}" ];
   doCheck = false;
diff --git a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
index d9ee8a8ae714..2107186fe159 100644
--- a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
@@ -8,555 +8,561 @@ if ENV.fetch('BUNDLER_CHECKSUM_VERIFICATION_OPT_IN', 'false') != 'false' # this
   BundlerChecksum.patch!
 end
 
-gem 'bundler-checksum', '~> 0.1.0', path: 'vendor/gems/bundler-checksum', require: false
+# Please see https://docs.gitlab.com/ee/development/feature_categorization/#gemfile
+ignore_feature_category = Module.new do
+  def gem(*arguments, feature_category: nil, **keyword_arguments) # rubocop:disable Lint/UnusedMethodArgument
+    super(*arguments, **keyword_arguments)
+  end
+end
+
+extend ignore_feature_category
+
+gem 'bundler-checksum', '~> 0.1.0', path: 'vendor/gems/bundler-checksum', require: false # rubocop:todo Gemfile/MissingFeatureCategory
 
 # NOTE: When incrementing the major or minor version here, also increment activerecord_version
 # in vendor/gems/attr_encrypted/attr_encrypted.gemspec until we resolve
 # https://gitlab.com/gitlab-org/gitlab/-/issues/375713
 #
 # See https://docs.gitlab.com/ee/development/gemfile.html#upgrade-rails for guidelines when upgrading Rails
-gem 'rails', '~> 7.0.6'
+gem 'rails', '~> 7.0.8' # rubocop:todo Gemfile/MissingFeatureCategory
 
-gem 'activerecord-gitlab', path: 'gems/activerecord-gitlab'
+gem 'activerecord-gitlab', path: 'gems/activerecord-gitlab' # rubocop:todo Gemfile/MissingFeatureCategory
 
-gem 'vite_rails'
+gem 'vite_rails' # rubocop:todo Gemfile/MissingFeatureCategory
 
-gem 'bootsnap', '~> 1.16.0', require: false
+gem 'bootsnap', '~> 1.16.0', require: false # rubocop:todo Gemfile/MissingFeatureCategory
 
-gem 'openssl', '~> 3.0'
-gem 'ipaddr', '~> 1.2.5'
+gem 'openssl', '~> 3.0' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'ipaddr', '~> 1.2.5' # rubocop:todo Gemfile/MissingFeatureCategory
 
-gem 'gitlab-safe_request_store', path: 'gems/gitlab-safe_request_store'
+gem 'gitlab-safe_request_store', path: 'gems/gitlab-safe_request_store' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # GitLab Monorepo Gems
 group :monorepo do
-  gem 'gitlab-utils', path: 'gems/gitlab-utils'
+  gem 'gitlab-utils', path: 'gems/gitlab-utils' # rubocop:todo Gemfile/MissingFeatureCategory
 end
 
 # Responders respond_to and respond_with
-gem 'responders', '~> 3.0'
+gem 'responders', '~> 3.0' # rubocop:todo Gemfile/MissingFeatureCategory
 
-gem 'sprockets', '~> 3.7.0'
+gem 'sprockets', '~> 3.7.0' # rubocop:todo Gemfile/MissingFeatureCategory
 
-gem 'view_component', '~> 3.5.0'
+gem 'view_component', '~> 3.6.0' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Supported DBs
-gem 'pg', '~> 1.5.4'
+gem 'pg', '~> 1.5.4' # rubocop:todo Gemfile/MissingFeatureCategory
 
-gem 'neighbor', '~> 0.2.3'
+gem 'neighbor', '~> 0.2.3' # rubocop:todo Gemfile/MissingFeatureCategory
 
-gem 'rugged', '~> 1.6'
-gem 'grape-path-helpers', '~> 1.7.1'
+gem 'rugged', '~> 1.6' # rubocop:todo Gemfile/MissingFeatureCategory
 
-gem 'faraday', '~> 1.0'
-gem 'marginalia', '~> 1.11.1'
+gem 'faraday', '~> 1.0' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'marginalia', '~> 1.11.1' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Authorization
-gem 'declarative_policy', '~> 1.1.0'
+gem 'declarative_policy', '~> 1.1.0' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Authentication libraries
-gem 'devise', '~> 4.8.1'
-gem 'devise-pbkdf2-encryptable', '~> 0.0.0', path: 'vendor/gems/devise-pbkdf2-encryptable'
-gem 'bcrypt', '~> 3.1', '>= 3.1.14'
-gem 'doorkeeper', '~> 5.6', '>= 5.6.6'
-gem 'doorkeeper-openid_connect', '~> 1.8', '>= 1.8.7'
-gem 'rexml', '~> 3.2.6'
-gem 'ruby-saml', '~> 1.15.0'
-gem 'omniauth', '~> 2.1.0'
-gem 'omniauth-auth0', '~> 3.1'
-gem 'omniauth-azure-activedirectory-v2', '~> 2.0'
-gem 'omniauth-azure-oauth2', '~> 0.0.9', path: 'vendor/gems/omniauth-azure-oauth2' # See gem README.md
-gem 'omniauth-dingtalk-oauth2', '~> 1.0'
-gem 'omniauth-alicloud', '~> 2.0.1'
-gem 'omniauth-facebook', '~> 4.0.0'
-gem 'omniauth-github', '2.0.1'
-gem 'omniauth-gitlab', '~> 4.0.0', path: 'vendor/gems/omniauth-gitlab' # See vendor/gems/omniauth-gitlab/README.md
-gem 'omniauth-google-oauth2', '~> 1.1'
-gem 'omniauth-oauth2-generic', '~> 0.2.2'
-gem 'omniauth-saml', '~> 2.1.0'
-gem 'omniauth-shibboleth-redux', '~> 2.0', require: 'omniauth-shibboleth'
-gem 'omniauth-twitter', '~> 1.4'
-gem 'omniauth_crowd', '~> 2.4.0', path: 'vendor/gems/omniauth_crowd' # See vendor/gems/omniauth_crowd/README.md
-gem 'omniauth_openid_connect', '~> 0.6.1'
+gem 'devise', '~> 4.8.1' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'devise-pbkdf2-encryptable', '~> 0.0.0', path: 'vendor/gems/devise-pbkdf2-encryptable' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'bcrypt', '~> 3.1', '>= 3.1.14' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'doorkeeper', '~> 5.6', '>= 5.6.6' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'doorkeeper-openid_connect', '~> 1.8', '>= 1.8.7' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'rexml', '~> 3.2.6' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'ruby-saml', '~> 1.15.0' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'omniauth', '~> 2.1.0' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'omniauth-auth0', '~> 3.1' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'omniauth-azure-activedirectory-v2', '~> 2.0' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'omniauth-azure-oauth2', '~> 0.0.9', path: 'vendor/gems/omniauth-azure-oauth2' # See gem README.md # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'omniauth-dingtalk-oauth2', '~> 1.0' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'omniauth-alicloud', '~> 3.0.0' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'omniauth-facebook', '~> 4.0.0' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'omniauth-github', '2.0.1' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'omniauth-gitlab', '~> 4.0.0', path: 'vendor/gems/omniauth-gitlab' # See vendor/gems/omniauth-gitlab/README.md # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'omniauth-google-oauth2', '~> 1.1' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'omniauth-oauth2-generic', '~> 0.2.2' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'omniauth-saml', '~> 2.1.0' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'omniauth-shibboleth-redux', '~> 2.0', require: 'omniauth-shibboleth' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'omniauth-twitter', '~> 1.4' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'omniauth_crowd', '~> 2.4.0', path: 'vendor/gems/omniauth_crowd' # See vendor/gems/omniauth_crowd/README.md # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'omniauth_openid_connect', '~> 0.6.1' # rubocop:todo Gemfile/MissingFeatureCategory
 # Locked until Ruby 3.0 upgrade since upgrading will pull in an updated net-smtp gem.
 # See https://docs.gitlab.com/ee/development/emails.html#rationale.
-gem 'openid_connect', '= 1.3.0'
-gem 'omniauth-salesforce', '~> 1.0.5', path: 'vendor/gems/omniauth-salesforce' # See gem README.md
-gem 'omniauth-atlassian-oauth2', '~> 0.2.0'
-gem 'rack-oauth2', '~> 1.21.3'
-gem 'jwt', '~> 2.5'
+gem 'openid_connect', '= 1.3.0' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'omniauth-salesforce', '~> 1.0.5', path: 'vendor/gems/omniauth-salesforce' # See gem README.md # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'omniauth-atlassian-oauth2', '~> 0.2.0' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'rack-oauth2', '~> 1.21.3' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'jwt', '~> 2.5' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Kerberos authentication. EE-only
-gem 'gssapi', '~> 1.3.1', group: :kerberos
-gem 'timfel-krb5-auth', '~> 0.8', group: :kerberos
+gem 'gssapi', '~> 1.3.1', group: :kerberos # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'timfel-krb5-auth', '~> 0.8', group: :kerberos # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Spam and anti-bot protection
-gem 'recaptcha', '~> 5.12', require: 'recaptcha/rails'
-gem 'akismet', '~> 3.0'
-gem 'invisible_captcha', '~> 2.1.0'
+gem 'recaptcha', '~> 5.12', require: 'recaptcha/rails' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'akismet', '~> 3.0' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'invisible_captcha', '~> 2.1.0' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Two-factor authentication
-gem 'devise-two-factor', '~> 4.0.2'
-gem 'rqrcode-rails3', '~> 0.1.7'
-gem 'attr_encrypted', '~> 3.2.4', path: 'vendor/gems/attr_encrypted'
+gem 'devise-two-factor', '~> 4.1.1' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'rqrcode', '~> 2.0', feature_category: :system_access
+
+gem 'attr_encrypted', '~> 3.2.4', path: 'vendor/gems/attr_encrypted' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # GitLab Pages
-gem 'validates_hostname', '~> 1.0.13'
-gem 'rubyzip', '~> 2.3.2', require: 'zip'
+gem 'validates_hostname', '~> 1.0.13' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'rubyzip', '~> 2.3.2', require: 'zip' # rubocop:todo Gemfile/MissingFeatureCategory
 # GitLab Pages letsencrypt support
-gem 'acme-client', '~> 2.0'
+gem 'acme-client', '~> 2.0' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Browser detection
-gem 'browser', '~> 5.3.1'
+gem 'browser', '~> 5.3.1' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # OS detection for usage ping
-gem 'ohai', '~> 17.9'
+gem 'ohai', '~> 17.9' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # GPG
-gem 'gpgme', '~> 2.0.23'
+gem 'gpgme', '~> 2.0.23' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # LDAP Auth
 # GitLab fork with several improvements to original library. For full list of changes
 # see https://github.com/intridea/omniauth-ldap/compare/master...gitlabhq:master
-gem 'gitlab_omniauth-ldap', '~> 2.2.0', require: 'omniauth-ldap'
-gem 'net-ldap', '~> 0.17.1'
+gem 'gitlab_omniauth-ldap', '~> 2.2.0', require: 'omniauth-ldap' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'net-ldap', '~> 0.17.1' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # API
-gem 'grape', '~> 1.7.1'
-gem 'grape-entity', '~> 0.10.0'
-gem 'rack-cors', '~> 2.0.1', require: 'rack/cors'
-gem 'grape-swagger', '~> 1.6.1', group: [:development, :test]
-gem 'grape-swagger-entity', '~> 0.5.1', group: [:development, :test]
+gem 'grape', '~> 1.7.1', feature_category: :api
+gem 'grape-entity', '~> 0.10.0', feature_category: :api
+gem 'grape-swagger', '~> 1.6.1', group: [:development, :test], feature_category: :api
+gem 'grape-swagger-entity', '~> 0.5.1', group: [:development, :test], feature_category: :api
+gem 'grape-path-helpers', '~> 1.7.1', feature_category: :api
+gem 'rack-cors', '~> 2.0.1', require: 'rack/cors' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # GraphQL API
-gem 'graphql', '~> 1.13.19'
-gem 'graphiql-rails', '~> 1.8.0'
-gem 'apollo_upload_server', '~> 2.1.0'
-gem 'graphql-docs', '~> 2.1.0', group: [:development, :test]
-gem 'graphlient', '~> 0.5.0' # Used by BulkImport feature (group::import)
+gem 'graphql', '~> 2.0.27', feature_category: :api
+gem 'graphql-docs', '~> 4.0.0', group: [:development, :test], feature_category: :api
+gem 'graphiql-rails', '~> 1.8.0', feature_category: :api
+gem 'apollo_upload_server', '~> 2.1.0', feature_category: :api
+gem 'graphlient', '~> 0.5.0', feature_category: :importers # Used by BulkImport feature (group::import)
 
 # Generate Fake data
-gem 'ffaker', '~> 2.10'
+gem 'ffaker', '~> 2.10' # rubocop:todo Gemfile/MissingFeatureCategory
 
-gem 'hashie', '~> 5.0.0'
+gem 'hashie', '~> 5.0.0' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Pagination
-gem 'kaminari', '~> 1.2.2'
+gem 'kaminari', '~> 1.2.2' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # HAML
-gem 'hamlit', '~> 2.15.0'
+gem 'hamlit', '~> 2.15.0' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Files attachments
-gem 'carrierwave', '~> 1.3'
-gem 'mini_magick', '~> 4.10.1'
+gem 'carrierwave', '~> 1.3' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'mini_magick', '~> 4.10.1' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # for backups
-gem 'fog-aws', '~> 3.18'
+gem 'fog-aws', '~> 3.18' # rubocop:todo Gemfile/MissingFeatureCategory
 # Locked until fog-google resolves https://github.com/fog/fog-google/issues/421.
 # Also see config/initializers/fog_core_patch.rb.
-gem 'fog-core', '= 2.1.0'
-gem 'fog-google', '~> 1.19', require: 'fog/google'
-gem 'fog-local', '~> 0.8'
+gem 'fog-core', '= 2.1.0' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'fog-google', '~> 1.19', require: 'fog/google' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'fog-local', '~> 0.8' # rubocop:todo Gemfile/MissingFeatureCategory
 # NOTE:
 # the fog-aliyun gem since v0.4 pulls in aliyun-sdk transitively, which monkey-patches
 # the rest-client gem to drop the Content-Length header field for chunked transfers,
 # which may have knock-on effects on other features using `RestClient`.
 # We may want to update this dependency if this is ever addressed upstream, e.g. via
 # https://github.com/aliyun/aliyun-oss-ruby-sdk/pull/93
-gem 'fog-aliyun', '~> 0.4'
-gem 'gitlab-fog-azure-rm', '~> 1.8.0', require: 'fog/azurerm'
+gem 'fog-aliyun', '~> 0.4' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'gitlab-fog-azure-rm', '~> 1.8.0', require: 'fog/azurerm' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # for Google storage
-gem 'google-cloud-storage', '~> 1.44.0'
-gem 'google-apis-core', '~> 0.10.0'
-gem 'google-apis-compute_v1', '~> 0.57.0'
-gem 'google-apis-container_v1', '~> 0.43.0'
-gem 'google-apis-container_v1beta1', '~> 0.43.0'
-gem 'google-apis-cloudbilling_v1', '~> 0.21.0'
-gem 'google-apis-cloudresourcemanager_v1', '~> 0.31.0'
-gem 'google-apis-iam_v1', '~> 0.36.0'
-gem 'google-apis-serviceusage_v1', '~> 0.28.0'
-gem 'google-apis-sqladmin_v1beta4', '~> 0.41.0'
-gem 'google-apis-androidpublisher_v3', '~> 0.34.0'
+gem 'google-cloud-storage', '~> 1.44.0' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'google-apis-core', '~> 0.10.0' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'google-apis-compute_v1', '~> 0.57.0' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'google-apis-container_v1', '~> 0.43.0' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'google-apis-container_v1beta1', '~> 0.43.0' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'google-apis-cloudbilling_v1', '~> 0.21.0' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'google-apis-cloudresourcemanager_v1', '~> 0.31.0' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'google-apis-iam_v1', '~> 0.36.0' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'google-apis-serviceusage_v1', '~> 0.28.0' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'google-apis-sqladmin_v1beta4', '~> 0.41.0' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'google-apis-androidpublisher_v3', '~> 0.34.0' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Seed data
-gem 'seed-fu', '~> 2.3.7'
+gem 'seed-fu', '~> 2.3.7' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Search
-gem 'elasticsearch-model', '~> 7.2'
-gem 'elasticsearch-rails', '~> 7.2', require: 'elasticsearch/rails/instrumentation'
-gem 'elasticsearch-api',   '7.13.3'
-gem 'aws-sdk-core', '~> 3.181.1'
-gem 'aws-sdk-cloudformation', '~> 1'
-gem 'aws-sdk-s3', '~> 1.134.0'
-gem 'faraday_middleware-aws-sigv4', '~>0.3.0'
-gem 'typhoeus', '~> 1.4.0' # Used with Elasticsearch to support http keep-alive connections
+gem 'elasticsearch-model', '~> 7.2' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'elasticsearch-rails', '~> 7.2', require: 'elasticsearch/rails/instrumentation' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'elasticsearch-api',   '7.13.3' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'aws-sdk-core', '~> 3.185.1' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'aws-sdk-cloudformation', '~> 1' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'aws-sdk-s3', '~> 1.136.0' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'faraday_middleware-aws-sigv4', '~>0.3.0' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'typhoeus', '~> 1.4.0' # Used with Elasticsearch to support http keep-alive connections # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Markdown and HTML processing
-gem 'html-pipeline', '~> 2.14.3'
-gem 'deckar01-task_list', '2.3.3'
-gem 'gitlab-markup', '~> 1.9.0', require: 'github/markup'
-gem 'commonmarker', '~> 0.23.10'
-gem 'kramdown', '~> 2.3.1'
-gem 'RedCloth', '~> 4.3.2'
-gem 'rdoc', '~> 6.3.2'
-gem 'org-ruby', '~> 0.9.12'
-gem 'creole', '~> 0.5.0'
-gem 'wikicloth', '0.8.1'
-gem 'asciidoctor', '~> 2.0.18'
-gem 'asciidoctor-include-ext', '~> 0.4.0', require: false
-gem 'asciidoctor-plantuml', '~> 0.0.16'
-gem 'asciidoctor-kroki', '~> 0.8.0', require: false
-gem 'rouge', '~> 4.1.3'
-gem 'truncato', '~> 0.7.12'
-gem 'nokogiri', '~> 1.15', '>= 1.15.4'
+gem 'html-pipeline', '~> 2.14.3' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'deckar01-task_list', '2.3.3' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'gitlab-markup', '~> 1.9.0', require: 'github/markup' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'commonmarker', '~> 0.23.10' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'kramdown', '~> 2.3.1' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'RedCloth', '~> 4.3.2' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'org-ruby', '~> 0.9.12' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'creole', '~> 0.5.0' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'wikicloth', '0.8.1' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'asciidoctor', '~> 2.0.18' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'asciidoctor-include-ext', '~> 0.4.0', require: false # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'asciidoctor-plantuml', '~> 0.0.16' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'asciidoctor-kroki', '~> 0.8.0', require: false # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'rouge', '~> 4.1.3' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'truncato', '~> 0.7.12' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'nokogiri', '~> 1.15', '>= 1.15.4' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Calendar rendering
-gem 'icalendar'
+gem 'icalendar' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Diffs
-gem 'diffy', '~> 3.4'
-gem 'diff_match_patch', '~> 0.1.0'
+gem 'diffy', '~> 3.4' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'diff_match_patch', '~> 0.1.0' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Application server
-gem 'rack', '~> 2.2.8'
+gem 'rack', '~> 2.2.8' # rubocop:todo Gemfile/MissingFeatureCategory
 # https://github.com/zombocom/rack-timeout/blob/master/README.md#rails-apps-manually
-gem 'rack-timeout', '~> 0.6.3', require: 'rack/timeout/base'
+gem 'rack-timeout', '~> 0.6.3', require: 'rack/timeout/base' # rubocop:todo Gemfile/MissingFeatureCategory
 
 group :puma do
-  gem 'puma', '~> 6.3', '>= 6.3.1', require: false
-  gem 'sd_notify', '~> 0.1.0', require: false
+  gem 'puma', '~> 6.4', require: false # rubocop:todo Gemfile/MissingFeatureCategory
+  gem 'sd_notify', '~> 0.1.0', require: false # rubocop:todo Gemfile/MissingFeatureCategory
 end
 
 # State machine
-gem 'state_machines-activerecord', '~> 0.8.0'
+gem 'state_machines-activerecord', '~> 0.8.0' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # CI domain tags
-gem 'acts-as-taggable-on', '~> 9.0'
+gem 'acts-as-taggable-on', '~> 9.0' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Background jobs
-gem 'sidekiq', '~> 6.5.7'
-gem 'sidekiq-cron', '~> 1.8.0'
-gem 'redis-namespace', '~> 1.9.0'
-gem 'gitlab-sidekiq-fetcher', path: 'vendor/gems/sidekiq-reliable-fetch', require: 'sidekiq-reliable-fetch'
+gem 'sidekiq', '~> 6.5.7' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'sidekiq-cron', '~> 1.8.0' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'redis-namespace', '~> 1.9.0' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'gitlab-sidekiq-fetcher', path: 'vendor/gems/sidekiq-reliable-fetch', require: 'sidekiq-reliable-fetch' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Cron Parser
-gem 'fugit', '~> 1.8.1'
+gem 'fugit', '~> 1.8.1' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # HTTP requests
-gem 'httparty', '~> 0.21.0'
+gem 'httparty', '~> 0.21.0' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Colored output to console
-gem 'rainbow', '~> 3.0'
+gem 'rainbow', '~> 3.0' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Progress bar
-gem 'ruby-progressbar', '~> 1.10'
+gem 'ruby-progressbar', '~> 1.10' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Linear-time regex library for untrusted regular expressions
-gem 're2', '2.0.0'
+gem 're2', '2.1.3' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Misc
 
-gem 'semver_dialects', '~> 1.2.1'
-gem 'version_sorter', '~> 2.3'
-gem 'csv_builder', path: 'gems/csv_builder'
+gem 'semver_dialects', '~> 1.2.1' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'version_sorter', '~> 2.3' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'csv_builder', path: 'gems/csv_builder' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Export Ruby Regex to Javascript
-gem 'js_regex', '~> 3.8'
+gem 'js_regex', '~> 3.8' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # User agent parsing
-gem 'device_detector'
+gem 'device_detector' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Redis
-gem 'redis', '~> 4.8.0'
-gem 'connection_pool', '~> 2.0'
+gem 'redis', '~> 4.8.0' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'connection_pool', '~> 2.4' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Redis session store
-gem 'redis-actionpack', '~> 5.3.0'
+gem 'redis-actionpack', '~> 5.3.0' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Discord integration
-gem 'discordrb-webhooks', '~> 3.4', require: false
+gem 'discordrb-webhooks', '~> 3.4', require: false # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Jira integration
-gem 'jira-ruby', '~> 2.1.4'
-gem 'atlassian-jwt', '~> 0.2.0'
+gem 'jira-ruby', '~> 2.1.4' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'atlassian-jwt', '~> 0.2.0' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Slack integration
-gem 'slack-messenger', '~> 2.3.4'
-
-# Hangouts Chat integration
-gem 'hangouts-chat', '~> 0.0.5', require: 'hangouts_chat'
-
-# Asana integration
-gem 'asana', '~> 0.10.13'
+gem 'slack-messenger', '~> 2.3.4' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # FogBugz integration
-gem 'ruby-fogbugz', '~> 0.3.0'
+gem 'ruby-fogbugz', '~> 0.3.0' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Kubernetes integration
-gem 'kubeclient', '~> 4.11.0'
+gem 'kubeclient', '~> 4.11.0' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # AI
-gem 'ruby-openai', '~> 3.7'
-gem 'circuitbox', '2.0.0'
+gem 'ruby-openai', '~> 3.7' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'circuitbox', '2.0.0' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Sanitize user input
-gem 'sanitize', '~> 6.0.2'
-gem 'babosa', '~> 2.0'
+gem 'sanitize', '~> 6.0.2' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'babosa', '~> 2.0' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Sanitizes SVG input
-gem 'loofah', '~> 2.21.3'
+gem 'loofah', '~> 2.21.4' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Used to provide license templates
-gem 'licensee', '~> 9.16'
+gem 'licensee', '~> 9.16' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Detect and convert string character encoding
-gem 'charlock_holmes', '~> 0.7.7'
+gem 'charlock_holmes', '~> 0.7.7' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Detect mime content type from content
-gem 'ruby-magic', '~> 0.6'
+gem 'ruby-magic', '~> 0.6' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Faster blank
-gem 'fast_blank', '~> 1.0.1'
+gem 'fast_blank', '~> 1.0.1' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Parse time & duration
-gem 'gitlab-chronic', '~> 0.10.5'
-gem 'gitlab_chronic_duration', '~> 0.11'
+gem 'gitlab-chronic', '~> 0.10.5' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'gitlab_chronic_duration', '~> 0.12' # rubocop:todo Gemfile/MissingFeatureCategory
 
-gem 'rack-proxy', '~> 0.7.7'
+gem 'rack-proxy', '~> 0.7.7' # rubocop:todo Gemfile/MissingFeatureCategory
 
-gem 'sassc-rails', '~> 2.1.0'
-gem 'autoprefixer-rails', '10.2.5.1'
-gem 'terser', '1.0.2'
+gem 'sassc-rails', '~> 2.1.0' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'autoprefixer-rails', '10.2.5.1' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'terser', '1.0.2' # rubocop:todo Gemfile/MissingFeatureCategory
 
-gem 'click_house-client', path: 'gems/click_house-client', require: 'click_house/client'
-gem 'addressable', '~> 2.8'
-gem 'tanuki_emoji', '~> 0.7'
-gem 'gon', '~> 6.4.0'
-gem 'request_store', '~> 1.5.1'
-gem 'base32', '~> 0.3.0'
+gem 'click_house-client', path: 'gems/click_house-client', require: 'click_house/client' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'addressable', '~> 2.8' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'tanuki_emoji', '~> 0.7' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'gon', '~> 6.4.0' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'request_store', '~> 1.5.1' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'base32', '~> 0.3.0' # rubocop:todo Gemfile/MissingFeatureCategory
 
-gem 'gitlab-license', '~> 2.3'
+gem 'gitlab-license', '~> 2.3' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Protect against bruteforcing
-gem 'rack-attack', '~> 6.7.0'
+gem 'rack-attack', '~> 6.7.0' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Sentry integration
-gem 'sentry-raven', '~> 3.1'
-gem 'sentry-ruby', '~> 5.8.0'
-gem 'sentry-rails', '~> 5.8.0'
-gem 'sentry-sidekiq', '~> 5.8.0'
+gem 'sentry-raven', '~> 3.1' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'sentry-ruby', '~> 5.8.0' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'sentry-rails', '~> 5.8.0' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'sentry-sidekiq', '~> 5.8.0' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # PostgreSQL query parsing
 #
-gem 'pg_query', '~> 4.2.3'
+gem 'pg_query', '~> 4.2.3' # rubocop:todo Gemfile/MissingFeatureCategory
 
-gem 'gitlab-schema-validation', path: 'gems/gitlab-schema-validation'
+gem 'gitlab-schema-validation', path: 'gems/gitlab-schema-validation' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'gitlab-http', path: 'gems/gitlab-http' # rubocop:todo Gemfile/MissingFeatureCategory
 
-gem 'premailer-rails', '~> 1.10.3'
+gem 'premailer-rails', '~> 1.10.3' # rubocop:todo Gemfile/MissingFeatureCategory
 
-gem 'gitlab-labkit', '~> 0.34.0'
-gem 'thrift', '>= 0.16.0'
+gem 'gitlab-labkit', '~> 0.34.0' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'thrift', '>= 0.16.0' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # I18n
-gem 'rails-i18n', '~> 7.0'
-gem 'gettext_i18n_rails', '~> 1.11.0'
-gem 'gettext_i18n_rails_js', '~> 1.3'
-gem 'gettext', '~> 3.3', require: false, group: :development
+gem 'rails-i18n', '~> 7.0' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'gettext_i18n_rails', '~> 1.11.0' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'gettext_i18n_rails_js', '~> 1.3' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'gettext', '~> 3.3', require: false, group: :development # rubocop:todo Gemfile/MissingFeatureCategory
 
-gem 'batch-loader', '~> 2.0.1'
+gem 'batch-loader', '~> 2.0.1' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Perf bar
-gem 'peek', '~> 1.1'
+gem 'peek', '~> 1.1' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Google Cloud Profiler support
-gem 'cloud_profiler_agent', '~> 0.0.0', path: 'vendor/gems/cloud_profiler_agent', require: false
+gem 'cloud_profiler_agent', '~> 0.0.0', path: 'vendor/gems/cloud_profiler_agent', require: false # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Snowplow events tracking
-gem 'snowplow-tracker', '~> 0.8.0'
+gem 'snowplow-tracker', '~> 0.8.0' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Metrics
-gem 'webrick', '~> 1.8.1', require: false
-gem 'prometheus-client-mmap', '~> 0.28', require: 'prometheus/client'
+gem 'webrick', '~> 1.8.1', require: false # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'prometheus-client-mmap', '~> 0.28', '>= 0.28.1', require: 'prometheus/client' # rubocop:todo Gemfile/MissingFeatureCategory
 
-gem 'warning', '~> 1.3.0'
+gem 'warning', '~> 1.3.0' # rubocop:todo Gemfile/MissingFeatureCategory
 
 group :development do
-  gem 'lefthook', '~> 1.4.7', require: false
-  gem 'rubocop'
-  gem 'solargraph', '~> 0.47.2', require: false
+  gem 'lefthook', '~> 1.5.2', require: false, feature_category: :tooling
+  gem 'rubocop', feature_category: :tooling
+  gem 'solargraph', '~> 0.47.2', require: false # rubocop:todo Gemfile/MissingFeatureCategory
 
-  gem 'letter_opener_web', '~> 2.0.0'
-  gem 'lookbook', '~> 2.0', '>= 2.0.1'
+  gem 'letter_opener_web', '~> 2.0.0' # rubocop:todo Gemfile/MissingFeatureCategory
+  gem 'lookbook', '~> 2.0', '>= 2.0.1' # rubocop:todo Gemfile/MissingFeatureCategory
 
   # Better errors handler
-  gem 'better_errors', '~> 2.10.1'
+  gem 'better_errors', '~> 2.10.1' # rubocop:todo Gemfile/MissingFeatureCategory
 
-  gem 'sprite-factory', '~> 1.7'
+  gem 'sprite-factory', '~> 1.7' # rubocop:todo Gemfile/MissingFeatureCategory
 
-  gem "listen", "~> 3.7"
+  gem 'listen', '~> 3.7' # rubocop:todo Gemfile/MissingFeatureCategory
 end
 
 group :development, :test do
-  gem 'deprecation_toolkit', '~> 1.5.1', require: false
-  gem 'bullet', '~> 7.0.2'
-  gem 'parser', '~> 3.2', '>= 3.2.2.3'
-  gem 'pry-byebug'
-  gem 'pry-rails', '~> 0.3.9'
-  gem 'pry-shell', '~> 0.6.4'
+  gem 'deprecation_toolkit', '~> 1.5.1', require: false # rubocop:todo Gemfile/MissingFeatureCategory
+  gem 'bullet', '~> 7.1.1' # rubocop:todo Gemfile/MissingFeatureCategory
+  gem 'parser', '~> 3.2', '>= 3.2.2.4' # rubocop:todo Gemfile/MissingFeatureCategory
+  gem 'pry-byebug' # rubocop:todo Gemfile/MissingFeatureCategory
+  gem 'pry-rails', '~> 0.3.9' # rubocop:todo Gemfile/MissingFeatureCategory
+  gem 'pry-shell', '~> 0.6.4' # rubocop:todo Gemfile/MissingFeatureCategory
 
-  gem 'awesome_print', require: false
+  gem 'awesome_print', require: false # rubocop:todo Gemfile/MissingFeatureCategory
 
-  gem 'database_cleaner', '~> 1.7.0'
-  gem 'factory_bot_rails', '~> 6.2.0'
-  gem 'rspec-rails', '~> 6.0.3'
+  gem 'database_cleaner', '~> 1.7.0' # rubocop:todo Gemfile/MissingFeatureCategory
+  gem 'factory_bot_rails', '~> 6.2.0' # rubocop:todo Gemfile/MissingFeatureCategory
+  gem 'rspec-rails', '~> 6.0.3' # rubocop:todo Gemfile/MissingFeatureCategory
 
   # Prevent occasions where minitest is not bundled in packaged versions of ruby (see #3826)
-  gem 'minitest', '~> 5.11.0'
+  gem 'minitest', '~> 5.11.0' # rubocop:todo Gemfile/MissingFeatureCategory
 
-  gem 'spring', '~> 4.1.0'
-  gem 'spring-commands-rspec', '~> 1.0.4'
+  gem 'spring', '~> 4.1.0' # rubocop:todo Gemfile/MissingFeatureCategory
+  gem 'spring-commands-rspec', '~> 1.0.4' # rubocop:todo Gemfile/MissingFeatureCategory
 
-  gem 'gitlab-styles', '~> 10.1.0', require: false
+  gem 'gitlab-styles', '~> 10.1.0', require: false # rubocop:todo Gemfile/MissingFeatureCategory
 
-  gem 'haml_lint', '~> 0.40.0', require: false
-  gem 'bundler-audit', '~> 0.7.0.1', require: false
+  gem 'haml_lint', '~> 0.40.0', require: false # rubocop:todo Gemfile/MissingFeatureCategory
+  gem 'bundler-audit', '~> 0.9.1', require: false # rubocop:todo Gemfile/MissingFeatureCategory
 
   # Benchmarking & profiling
-  gem 'benchmark-ips', '~> 2.11.0', require: false
-  gem 'benchmark-memory', '~> 0.1', require: false
+  gem 'benchmark-ips', '~> 2.11.0', require: false # rubocop:todo Gemfile/MissingFeatureCategory
+  gem 'benchmark-memory', '~> 0.1', require: false # rubocop:todo Gemfile/MissingFeatureCategory
 
-  gem 'knapsack', '~> 1.21.1'
-  gem 'crystalball', '~> 0.7.0', require: false
+  # Profiling data from CI/CD pipelines
+  gem 'influxdb-client', '~> 2.9', require: false # rubocop:todo Gemfile/MissingFeatureCategory
 
-  gem 'simple_po_parser', '~> 1.1.6', require: false
+  gem 'knapsack', '~> 1.21.1', feature_category: :tooling
+  gem 'crystalball', '~> 0.7.0', require: false, feature_category: :tooling
+  gem 'test_file_finder', '~> 0.1.3', feature_category: :tooling
 
-  gem 'png_quantizator', '~> 0.2.1', require: false
+  gem 'simple_po_parser', '~> 1.1.6', require: false # rubocop:todo Gemfile/MissingFeatureCategory
 
-  gem 'parallel', '~> 1.19', require: false
+  gem 'png_quantizator', '~> 0.2.1', require: false # rubocop:todo Gemfile/MissingFeatureCategory
 
-  gem 'test_file_finder', '~> 0.1.3'
+  gem 'parallel', '~> 1.19', require: false # rubocop:todo Gemfile/MissingFeatureCategory
 
-  gem 'sigdump', '~> 0.2.4', require: 'sigdump/setup'
+  gem 'sigdump', '~> 0.2.4', require: 'sigdump/setup' # rubocop:todo Gemfile/MissingFeatureCategory
 
-  gem 'pact', '~> 1.63'
+  gem 'pact', '~> 1.63' # rubocop:todo Gemfile/MissingFeatureCategory
 end
 
 group :development, :test, :danger do
-  gem 'gitlab-dangerfiles', '~> 4.0.0', require: false
+  gem 'gitlab-dangerfiles', '~> 4.3.2', require: false, feature_category: :tooling
 end
 
 group :development, :test, :coverage do
-  gem 'simplecov', '~> 0.21', require: false
-  gem 'simplecov-lcov', '~> 0.8.0', require: false
-  gem 'simplecov-cobertura', '~> 2.1.0', require: false
-  gem 'undercover', '~> 0.4.4', require: false
+  gem 'simplecov', '~> 0.21', require: false, feature_category: :tooling
+  gem 'simplecov-lcov', '~> 0.8.0', require: false, feature_category: :tooling
+  gem 'simplecov-cobertura', '~> 2.1.0', require: false, feature_category: :tooling
+  gem 'undercover', '~> 0.4.4', require: false, feature_category: :tooling
 end
 
 # Gems required in omnibus-gitlab pipeline
 group :development, :test, :omnibus do
-  gem 'license_finder', '~> 7.0', require: false
+  gem 'license_finder', '~> 7.0', require: false # rubocop:todo Gemfile/MissingFeatureCategory
 end
 
 # Gems required in various pipelines
 group :development, :test, :monorepo do
-  gem 'gitlab-rspec', path: 'gems/gitlab-rspec'
-  gem 'rspec_flaky', path: 'gems/rspec_flaky'
+  gem 'gitlab-rspec', path: 'gems/gitlab-rspec' # rubocop:todo Gemfile/MissingFeatureCategory
+  gem 'rspec_flaky', path: 'gems/rspec_flaky' # rubocop:todo Gemfile/MissingFeatureCategory
 end
 
 group :test do
-  gem 'fuubar', '~> 2.2.0'
-  gem 'rspec-retry', '~> 0.6.2'
-  gem 'rspec_profiling', '~> 0.0.6'
-  gem 'rspec-benchmark', '~> 0.6.0'
-  gem 'rspec-parameterized', '~> 1.0', require: false
-
-  gem 'capybara', '~> 3.39', '>= 3.39.2'
-  gem 'capybara-screenshot', '~> 1.0.26'
-  gem 'selenium-webdriver', '= 4.12.0'
-
-  gem 'graphlyte', '~> 1.0.0'
-
-  gem 'shoulda-matchers', '~> 5.1.0', require: false
-  gem 'email_spec', '~> 2.2.0'
-  gem 'webmock', '~> 3.19.1'
-  gem 'rails-controller-testing'
-  gem 'concurrent-ruby', '~> 1.1'
-  gem 'test-prof', '~> 1.2.2'
-  gem 'rspec_junit_formatter'
-  gem 'guard-rspec'
-  gem 'axe-core-rspec'
+  gem 'fuubar', '~> 2.2.0' # rubocop:todo Gemfile/MissingFeatureCategory
+  gem 'rspec-retry', '~> 0.6.2', feature_category: :tooling
+  gem 'rspec_profiling', '~> 0.0.6', feature_category: :tooling
+  gem 'rspec-benchmark', '~> 0.6.0', feature_category: :tooling
+  gem 'rspec-parameterized', '~> 1.0', require: false, feature_category: :tooling
+
+  gem 'capybara', '~> 3.39', '>= 3.39.2' # rubocop:todo Gemfile/MissingFeatureCategory
+  gem 'capybara-screenshot', '~> 1.0.26' # rubocop:todo Gemfile/MissingFeatureCategory
+  gem 'selenium-webdriver', '~> 4.14' # rubocop:todo Gemfile/MissingFeatureCategory
+
+  gem 'graphlyte', '~> 1.0.0' # rubocop:todo Gemfile/MissingFeatureCategory
+
+  gem 'shoulda-matchers', '~> 5.1.0', require: false # rubocop:todo Gemfile/MissingFeatureCategory
+  gem 'email_spec', '~> 2.2.0' # rubocop:todo Gemfile/MissingFeatureCategory
+  gem 'webmock', '~> 3.19.1' # rubocop:todo Gemfile/MissingFeatureCategory
+  gem 'rails-controller-testing' # rubocop:todo Gemfile/MissingFeatureCategory
+  gem 'concurrent-ruby', '~> 1.1' # rubocop:todo Gemfile/MissingFeatureCategory
+  gem 'test-prof', '~> 1.2.3' # rubocop:todo Gemfile/MissingFeatureCategory
+  gem 'rspec_junit_formatter' # rubocop:todo Gemfile/MissingFeatureCategory
+  gem 'guard-rspec' # rubocop:todo Gemfile/MissingFeatureCategory
+  gem 'axe-core-rspec' # rubocop:todo Gemfile/MissingFeatureCategory
 
   # Moved in `test` because https://gitlab.com/gitlab-org/gitlab/-/issues/217527
-  gem 'derailed_benchmarks', require: false
+  gem 'derailed_benchmarks', require: false # rubocop:todo Gemfile/MissingFeatureCategory
 
-  gem 'gitlab_quality-test_tooling', '~> 1.0.0', require: false
+  gem 'gitlab_quality-test_tooling', '~> 1.3.0', require: false # rubocop:todo Gemfile/MissingFeatureCategory
 end
 
-gem 'octokit', '~> 6.0'
+gem 'octokit', '~> 6.0' # rubocop:todo Gemfile/MissingFeatureCategory
 
-gem 'gitlab-mail_room', '~> 0.0.23', require: 'mail_room'
+gem 'gitlab-mail_room', '~> 0.0.23', require: 'mail_room' # rubocop:todo Gemfile/MissingFeatureCategory
 
-gem 'email_reply_trimmer', '~> 0.1'
-gem 'html2text'
+gem 'email_reply_trimmer', '~> 0.1' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'html2text' # rubocop:todo Gemfile/MissingFeatureCategory
 
-gem 'stackprof', '~> 0.2.25', require: false
-gem 'rbtrace', '~> 0.4', require: false
-gem 'memory_profiler', '~> 1.0', require: false
-gem 'activerecord-explain-analyze', '~> 0.1', require: false
+gem 'stackprof', '~> 0.2.25', require: false # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'rbtrace', '~> 0.4', require: false # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'memory_profiler', '~> 1.0', require: false # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'activerecord-explain-analyze', '~> 0.1', require: false # rubocop:todo Gemfile/MissingFeatureCategory
 
 # OAuth
-gem 'oauth2', '~> 2.0'
+gem 'oauth2', '~> 2.0' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Health check
-gem 'health_check', '~> 3.0'
+gem 'health_check', '~> 3.0' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # System information
-gem 'vmstat', '~> 2.3.0'
-gem 'sys-filesystem', '~> 1.4.3'
+gem 'vmstat', '~> 2.3.0' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'sys-filesystem', '~> 1.4.3' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # NTP client
-gem 'net-ntp'
+gem 'net-ntp' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # SSH keys support
-gem 'ssh_data', '~> 1.3'
+gem 'ssh_data', '~> 1.3' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Spamcheck GRPC protocol definitions
-gem 'spamcheck', '~> 1.3.0'
+gem 'spamcheck', '~> 1.3.0' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Gitaly GRPC protocol definitions
-gem 'gitaly', '~> 16.3.0-rc1'
+gem 'gitaly', '~> 16.5.0.pre.rc1' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # KAS GRPC protocol definitions
-gem 'kas-grpc', '~> 0.2.0'
+gem 'kas-grpc', '~> 0.2.0' # rubocop:todo Gemfile/MissingFeatureCategory
 
-gem 'grpc', '~> 1.55.0'
+gem 'grpc', '~> 1.58.0' # rubocop:todo Gemfile/MissingFeatureCategory
 
-gem 'google-protobuf', '~> 3.24', '>= 3.24.3'
+gem 'google-protobuf', '~> 3.24', '>= 3.24.4' # rubocop:todo Gemfile/MissingFeatureCategory
 
-gem 'toml-rb', '~> 2.2.0'
+gem 'toml-rb', '~> 2.2.0' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Feature toggles
-gem 'flipper', '~> 0.26.2'
-gem 'flipper-active_record', '~> 0.26.2'
-gem 'flipper-active_support_cache_store', '~> 0.26.2'
-gem 'unleash', '~> 3.2.2'
-gem 'gitlab-experiment', '~> 0.8.0'
+gem 'flipper', '~> 0.26.2' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'flipper-active_record', '~> 0.26.2' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'flipper-active_support_cache_store', '~> 0.26.2' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'unleash', '~> 3.2.2' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'gitlab-experiment', '~> 0.8.0' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Structured logging
-gem 'lograge', '~> 0.5'
-gem 'grape_logging', '~> 1.8'
+gem 'lograge', '~> 0.5' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'grape_logging', '~> 1.8', feature_category: :api
 
 # DNS Lookup
-gem 'gitlab-net-dns', '~> 0.9.2'
+gem 'gitlab-net-dns', '~> 0.9.2' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Countries list
-gem 'countries', '~> 4.0.0'
+gem 'countries', '~> 4.0.0' # rubocop:todo Gemfile/MissingFeatureCategory
 
-gem 'retriable', '~> 3.1.2'
+gem 'retriable', '~> 3.1.2' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # LRU cache
-gem 'lru_redux'
+gem 'lru_redux' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Locked as long as quoted-printable encoding issues are not resolved
 # Monkey-patched in `config/initializers/mail_encoding_patch.rb`
@@ -565,62 +571,62 @@ gem 'lru_redux'
 # `config/initializers/mail_starttls_patch.rb` has also been patched to
 # fix STARTTLS handling until https://github.com/mikel/mail/pull/1536 is
 # released.
-gem 'mail', '= 2.8.1'
-gem 'mail-smtp_pool', '~> 0.1.0', path: 'vendor/gems/mail-smtp_pool', require: false
+gem 'mail', '= 2.8.1' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'mail-smtp_pool', '~> 0.1.0', path: 'vendor/gems/mail-smtp_pool', require: false # rubocop:todo Gemfile/MissingFeatureCategory
 
-gem 'microsoft_graph_mailer', '~> 0.1.0', path: 'vendor/gems/microsoft_graph_mailer'
+gem 'microsoft_graph_mailer', '~> 0.1.0', path: 'vendor/gems/microsoft_graph_mailer' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # File encryption
-gem 'lockbox', '~> 1.3.0'
+gem 'lockbox', '~> 1.3.0' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Email validation
-gem 'valid_email', '~> 0.1'
+gem 'valid_email', '~> 0.1' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # JSON
-gem 'jsonb_accessor', '~> 1.3.10'
-gem 'json', '~> 2.6.3'
-gem 'json_schemer', '~> 0.2.18'
-gem 'oj', '~> 3.13.21'
-gem 'oj-introspect', '~> 0.7'
-gem 'multi_json', '~> 1.14.1'
-gem 'yajl-ruby', '~> 1.4.3', require: 'yajl'
+gem 'jsonb_accessor', '~> 1.3.10' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'json', '~> 2.6.3' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'json_schemer', '~> 0.2.18' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'oj', '~> 3.13.21' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'oj-introspect', '~> 0.7' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'multi_json', '~> 1.14.1' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'yajl-ruby', '~> 1.4.3', require: 'yajl' # rubocop:todo Gemfile/MissingFeatureCategory
 
-gem 'webauthn', '~> 3.0'
+gem 'webauthn', '~> 3.0' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # IPAddress utilities
-gem 'ipaddress', '~> 0.8.3'
+gem 'ipaddress', '~> 0.8.3' # rubocop:todo Gemfile/MissingFeatureCategory
 
-gem 'parslet', '~> 1.8'
+gem 'parslet', '~> 1.8' # rubocop:todo Gemfile/MissingFeatureCategory
 
-gem 'ipynbdiff', path: 'gems/ipynbdiff', require: 'ipynb_diff'
+gem 'ipynbdiff', path: 'gems/ipynbdiff', require: 'ipynb_diff' # rubocop:todo Gemfile/MissingFeatureCategory
 
-gem 'ed25519', '~> 1.3.0'
+gem 'ed25519', '~> 1.3.0' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Error Tracking OpenAPI client
 # See https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/development/rake_tasks.md#update-openapi-client-for-error-tracking-feature
-gem 'error_tracking_open_api', path: 'gems/error_tracking_open_api'
+gem 'error_tracking_open_api', path: 'gems/error_tracking_open_api' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Vulnerability advisories
-gem 'cvss-suite', '~> 3.0.1', require: 'cvss_suite'
+gem 'cvss-suite', '~> 3.0.1', require: 'cvss_suite' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Work with RPM packages
-gem 'arr-pm', '~> 0.0.12'
+gem 'arr-pm', '~> 0.0.12' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Remote Development
-gem 'devfile', '~> 0.0.22.pre.alpha1'
+gem 'devfile', '~> 0.0.23.pre.alpha1' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Apple plist parsing
-gem 'CFPropertyList', '~> 3.0.0'
-gem 'app_store_connect'
+gem 'CFPropertyList', '~> 3.0.0' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'app_store_connect' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # For phone verification
-gem 'telesignenterprise', '~> 2.2'
+gem 'telesignenterprise', '~> 2.2' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # BufferedIO patch
 # Updating this version will require updating scripts/allowed_warnings.txt
-gem 'net-protocol', '~> 0.1.3'
+gem 'net-protocol', '~> 0.1.3' # rubocop:todo Gemfile/MissingFeatureCategory
 # Lock this until we make DNS rebinding work with the updated net-http:
 # https://gitlab.com/gitlab-org/gitlab/-/issues/413528
-gem 'net-http', '= 0.1.1'
+gem 'net-http', '= 0.1.1' # rubocop:todo Gemfile/MissingFeatureCategory
 
-gem 'duo_api', '~> 1.3'
+gem 'duo_api', '~> 1.3' # rubocop:todo Gemfile/MissingFeatureCategory
diff --git a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
index 2a8f80bf3939..052a59d6b7f7 100644
--- a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
@@ -24,6 +24,16 @@ PATH
       typhoeus (~> 1.0, >= 1.0.1)
 
 PATH
+  remote: gems/gitlab-http
+  specs:
+    gitlab-http (0.1.0)
+      activesupport (~> 7)
+      httparty (~> 0.21.0)
+      ipaddress (~> 0.8.3)
+      nokogiri (~> 1.15.4)
+      railties (~> 7)
+
+PATH
   remote: gems/gitlab-rspec
   specs:
     gitlab-rspec (0.1.0)
@@ -64,7 +74,7 @@ PATH
   remote: gems/rspec_flaky
   specs:
     rspec_flaky (0.1.0)
-      activesupport (>= 6.1, < 7.1)
+      activesupport (>= 6.1, < 8)
       rspec (~> 3.0)
 
 PATH
@@ -155,70 +165,70 @@ GEM
     acme-client (2.0.11)
       faraday (>= 1.0, < 3.0.0)
       faraday-retry (~> 1.0)
-    actioncable (7.0.6)
-      actionpack (= 7.0.6)
-      activesupport (= 7.0.6)
+    actioncable (7.0.8)
+      actionpack (= 7.0.8)
+      activesupport (= 7.0.8)
       nio4r (~> 2.0)
       websocket-driver (>= 0.6.1)
-    actionmailbox (7.0.6)
-      actionpack (= 7.0.6)
-      activejob (= 7.0.6)
-      activerecord (= 7.0.6)
-      activestorage (= 7.0.6)
-      activesupport (= 7.0.6)
+    actionmailbox (7.0.8)
+      actionpack (= 7.0.8)
+      activejob (= 7.0.8)
+      activerecord (= 7.0.8)
+      activestorage (= 7.0.8)
+      activesupport (= 7.0.8)
       mail (>= 2.7.1)
       net-imap
       net-pop
       net-smtp
-    actionmailer (7.0.6)
-      actionpack (= 7.0.6)
-      actionview (= 7.0.6)
-      activejob (= 7.0.6)
-      activesupport (= 7.0.6)
+    actionmailer (7.0.8)
+      actionpack (= 7.0.8)
+      actionview (= 7.0.8)
+      activejob (= 7.0.8)
+      activesupport (= 7.0.8)
       mail (~> 2.5, >= 2.5.4)
       net-imap
       net-pop
       net-smtp
       rails-dom-testing (~> 2.0)
-    actionpack (7.0.6)
-      actionview (= 7.0.6)
-      activesupport (= 7.0.6)
+    actionpack (7.0.8)
+      actionview (= 7.0.8)
+      activesupport (= 7.0.8)
       rack (~> 2.0, >= 2.2.4)
       rack-test (>= 0.6.3)
       rails-dom-testing (~> 2.0)
       rails-html-sanitizer (~> 1.0, >= 1.2.0)
-    actiontext (7.0.6)
-      actionpack (= 7.0.6)
-      activerecord (= 7.0.6)
-      activestorage (= 7.0.6)
-      activesupport (= 7.0.6)
+    actiontext (7.0.8)
+      actionpack (= 7.0.8)
+      activerecord (= 7.0.8)
+      activestorage (= 7.0.8)
+      activesupport (= 7.0.8)
       globalid (>= 0.6.0)
       nokogiri (>= 1.8.5)
-    actionview (7.0.6)
-      activesupport (= 7.0.6)
+    actionview (7.0.8)
+      activesupport (= 7.0.8)
       builder (~> 3.1)
       erubi (~> 1.4)
       rails-dom-testing (~> 2.0)
       rails-html-sanitizer (~> 1.1, >= 1.2.0)
-    activejob (7.0.6)
-      activesupport (= 7.0.6)
+    activejob (7.0.8)
+      activesupport (= 7.0.8)
       globalid (>= 0.3.6)
-    activemodel (7.0.6)
-      activesupport (= 7.0.6)
-    activerecord (7.0.6)
-      activemodel (= 7.0.6)
-      activesupport (= 7.0.6)
+    activemodel (7.0.8)
+      activesupport (= 7.0.8)
+    activerecord (7.0.8)
+      activemodel (= 7.0.8)
+      activesupport (= 7.0.8)
     activerecord-explain-analyze (0.1.0)
       activerecord (>= 4)
       pg
-    activestorage (7.0.6)
-      actionpack (= 7.0.6)
-      activejob (= 7.0.6)
-      activerecord (= 7.0.6)
-      activesupport (= 7.0.6)
+    activestorage (7.0.8)
+      actionpack (= 7.0.8)
+      activejob (= 7.0.8)
+      activerecord (= 7.0.8)
+      activesupport (= 7.0.8)
       marcel (~> 1.0)
       mini_mime (>= 1.1.0)
-    activesupport (7.0.6)
+    activesupport (7.0.8)
       concurrent-ruby (~> 1.0, >= 1.0.2)
       i18n (>= 1.6, < 2)
       minitest (>= 5.1)
@@ -240,11 +250,6 @@ GEM
       activesupport (>= 6.0.0)
       jwt (>= 1.4, <= 2.5.0)
     arr-pm (0.0.12)
-    asana (0.10.13)
-      faraday (~> 1.0)
-      faraday_middleware (~> 1.0)
-      faraday_middleware-multi_json (~> 0.0)
-      oauth2 (>= 1.4, < 3)
     asciidoctor (2.0.18)
     asciidoctor-include-ext (0.4.0)
       asciidoctor (>= 1.5.6, < 3.0.0)
@@ -265,7 +270,7 @@ GEM
     aws-sdk-cloudformation (1.41.0)
       aws-sdk-core (~> 3, >= 3.99.0)
       aws-sigv4 (~> 1.1)
-    aws-sdk-core (3.181.1)
+    aws-sdk-core (3.185.1)
       aws-eventstream (~> 1, >= 1.0.2)
       aws-partitions (~> 1, >= 1.651.0)
       aws-sigv4 (~> 1.5)
@@ -273,7 +278,7 @@ GEM
     aws-sdk-kms (1.64.0)
       aws-sdk-core (~> 3, >= 3.165.0)
       aws-sigv4 (~> 1.1)
-    aws-sdk-s3 (1.134.0)
+    aws-sdk-s3 (1.136.0)
       aws-sdk-core (~> 3, >= 3.181.0)
       aws-sdk-kms (~> 1)
       aws-sigv4 (~> 1.6)
@@ -321,12 +326,12 @@ GEM
       msgpack (~> 1.2)
     browser (5.3.1)
     builder (3.2.4)
-    bullet (7.0.2)
+    bullet (7.1.1)
       activesupport (>= 3.0.0)
       uniform_notifier (~> 1.11)
-    bundler-audit (0.7.0.1)
+    bundler-audit (0.9.1)
       bundler (>= 1.2.0, < 3)
-      thor (>= 0.18, < 2)
+      thor (~> 1.0)
     byebug (11.1.3)
     capybara (3.39.2)
       addressable
@@ -340,7 +345,7 @@ GEM
     capybara-screenshot (1.0.26)
       capybara (>= 1.0, < 4)
       launchy
-    carrierwave (1.3.3)
+    carrierwave (1.3.4)
       activemodel (>= 4.0.0)
       activesupport (>= 4.0.0)
       mime-types (>= 1.16)
@@ -357,7 +362,7 @@ GEM
       mixlib-shellout (>= 2.0, < 4.0)
       tomlrb (~> 1.2)
     chef-utils (16.10.17)
-    chunky_png (1.3.5)
+    chunky_png (1.4.0)
     circuitbox (2.0.0)
     citrus (3.0.2)
     claide (1.1.0)
@@ -371,7 +376,7 @@ GEM
     colored2 (3.1.2)
     commonmarker (0.23.10)
     concurrent-ruby (1.2.2)
-    connection_pool (2.3.0)
+    connection_pool (2.4.1)
     cork (0.3.0)
       colored2 (~> 3.1)
     cose (1.3.0)
@@ -405,6 +410,7 @@ GEM
     danger-gitlab (8.0.0)
       danger
       gitlab (~> 4.2, >= 4.2.0)
+    dartsass (1.49.8)
     database_cleaner (1.7.0)
     date (3.3.3)
     dead_end (3.1.1)
@@ -429,7 +435,7 @@ GEM
       thor (>= 0.19, < 2)
     descendants_tracker (0.0.4)
       thread_safe (~> 0.3, >= 0.3.1)
-    devfile (0.0.22.pre.alpha1)
+    devfile (0.0.23.pre.alpha1)
     device_detector (1.0.0)
     devise (4.8.1)
       bcrypt (~> 3.0)
@@ -437,11 +443,11 @@ GEM
       railties (>= 4.1.0)
       responders
       warden (~> 1.2.3)
-    devise-two-factor (4.0.2)
-      activesupport (< 7.1)
-      attr_encrypted (>= 1.3, < 4, != 2)
+    devise-two-factor (4.1.1)
+      activesupport (~> 7.0)
+      attr_encrypted (>= 1.3, < 5, != 2)
       devise (~> 4.0)
-      railties (< 7.1)
+      railties (~> 7.0)
       rotp (~> 6.0)
     diff-lcs (1.5.0)
     diff_match_patch (0.1.0)
@@ -500,7 +506,7 @@ GEM
       mail (~> 2.7)
     encryptor (3.0.0)
     erubi (1.12.0)
-    escape_utils (1.2.1)
+    escape_utils (1.3.0)
     et-orbi (1.2.7)
       tzinfo
     ethon (0.16.0)
@@ -510,8 +516,8 @@ GEM
     expgen (0.1.1)
       parslet
     expression_parser (0.9.0)
-    extended-markdown-filter (0.6.0)
-      html-pipeline (~> 2.0)
+    extended-markdown-filter (0.7.0)
+      html-pipeline (~> 2.9)
     factory_bot (6.2.0)
       activesupport (>= 5.0.0)
     factory_bot_rails (6.2.0)
@@ -547,9 +553,6 @@ GEM
     faraday_middleware-aws-sigv4 (0.3.0)
       aws-sigv4 (~> 1.0)
       faraday (>= 0.15)
-    faraday_middleware-multi_json (0.0.6)
-      faraday_middleware
-      multi_json
     fast_blank (1.0.1)
     fast_gettext (2.3.0)
     ffaker (2.10.0)
@@ -637,17 +640,17 @@ GEM
     git (1.18.0)
       addressable (~> 2.8)
       rchardet (~> 1.8)
-    gitaly (16.3.0.pre.rc1)
+    gitaly (16.5.0.pre.rc1)
       grpc (~> 1.0)
     gitlab (4.19.0)
       httparty (~> 0.20)
       terminal-table (>= 1.5.1)
     gitlab-chronic (0.10.5)
       numerizer (~> 0.2)
-    gitlab-dangerfiles (4.0.0)
+    gitlab-dangerfiles (4.3.2)
       danger (>= 9.3.0)
       danger-gitlab (>= 8.0.0)
-      rake
+      rake (~> 13.0)
     gitlab-experiment (0.8.0)
       activesupport (>= 3.0)
       request_store (>= 1.0)
@@ -678,15 +681,15 @@ GEM
       rubocop-performance (~> 1.15)
       rubocop-rails (~> 2.17)
       rubocop-rspec (~> 2.22)
-    gitlab_chronic_duration (0.11.0)
+    gitlab_chronic_duration (0.12.0)
       numerizer (~> 0.2)
     gitlab_omniauth-ldap (2.2.0)
       net-ldap (~> 0.16)
       omniauth (>= 1.3, < 3)
       pyu-ruby-sasl (>= 0.0.3.3, < 0.1)
       rubyntlm (~> 0.5)
-    gitlab_quality-test_tooling (1.0.0)
-      activesupport (>= 6.1, < 7.1)
+    gitlab_quality-test_tooling (1.3.0)
+      activesupport (>= 6.1, < 7.2)
       gitlab (~> 4.19)
       http (~> 5.0)
       nokogiri (~> 1.10)
@@ -755,7 +758,7 @@ GEM
       google-cloud-core (~> 1.6)
       googleauth (>= 0.16.2, < 2.a)
       mini_mime (~> 1.0)
-    google-protobuf (3.24.3)
+    google-protobuf (3.24.4)
     googleapis-common-protos (1.4.0)
       google-protobuf (~> 3.14)
       googleapis-common-protos-types (~> 1.2)
@@ -802,19 +805,19 @@ GEM
       faraday_middleware
       graphql-client
     graphlyte (1.0.0)
-    graphql (1.13.19)
-    graphql-client (0.17.0)
+    graphql (2.0.27)
+    graphql-client (0.18.0)
       activesupport (>= 3.0)
-      graphql (~> 1.10)
-    graphql-docs (2.1.0)
-      commonmarker (~> 0.16)
+      graphql
+    graphql-docs (4.0.0)
+      commonmarker (~> 0.23, >= 0.23.6)
+      dartsass (~> 1.49)
       escape_utils (~> 1.2)
       extended-markdown-filter (~> 0.4)
       gemoji (~> 3.0)
-      graphql (~> 1.12)
-      html-pipeline (~> 2.9)
-      sass (~> 3.4)
-    grpc (1.55.0)
+      graphql (~> 2.0)
+      html-pipeline (~> 2.14, >= 2.14.3)
+    grpc (1.58.0)
       google-protobuf (~> 3.23)
       googleapis-common-protos-types (~> 1.0)
     gssapi (1.3.1)
@@ -847,7 +850,6 @@ GEM
       thor
       tilt
     hana (1.3.7)
-    hangouts-chat (0.0.5)
     hashdiff (1.0.1)
     hashie (5.0.0)
     health_check (3.1.0)
@@ -883,6 +885,7 @@ GEM
     ice_nine (0.11.2)
     imagen (0.1.8)
       parser (>= 2.5, != 2.5.1.1)
+    influxdb-client (2.9.0)
     invisible_captcha (2.1.0)
       rails (>= 5.2)
     ipaddr (1.2.5)
@@ -946,7 +949,7 @@ GEM
       rest-client (~> 2.0)
     launchy (2.5.0)
       addressable (~> 2.7)
-    lefthook (1.4.7)
+    lefthook (1.5.2)
     letter_opener (1.7.0)
       launchy (~> 2.2)
     letter_opener_web (2.0.0)
@@ -981,7 +984,7 @@ GEM
       activesupport (>= 4)
       railties (>= 4)
       request_store (~> 1.0)
-    loofah (2.21.3)
+    loofah (2.21.4)
       crass (~> 1.0.2)
       nokogiri (>= 1.12.0)
     lookbook (2.0.1)
@@ -1011,9 +1014,9 @@ GEM
     memoist (0.16.2)
     memory_profiler (1.0.1)
     method_source (1.0.0)
-    mime-types (3.4.1)
+    mime-types (3.5.1)
       mime-types-data (~> 3.2015)
-    mime-types-data (3.2022.0105)
+    mime-types-data (3.2023.1003)
     mini_histogram (0.3.1)
     mini_magick (4.10.1)
     mini_mime (1.1.2)
@@ -1098,7 +1101,7 @@ GEM
       hashie (>= 3.4.6)
       rack (>= 2.2.3)
       rack-protection
-    omniauth-alicloud (2.0.1)
+    omniauth-alicloud (3.0.0)
       omniauth-oauth2 (~> 1.8)
     omniauth-atlassian-oauth2 (0.2.0)
       omniauth (>= 1.1.1)
@@ -1184,7 +1187,7 @@ GEM
       expgen (~> 0.1)
       rainbow (~> 3.1.1)
     parallel (1.22.1)
-    parser (3.2.2.3)
+    parser (3.2.2.4)
       ast (~> 2.4.1)
       racc
     parslet (1.8.2)
@@ -1210,7 +1213,7 @@ GEM
       coderay
       parser
       unparser
-    prometheus-client-mmap (0.28.0)
+    prometheus-client-mmap (0.28.1)
       rb_sys (~> 0.9)
     pry (0.14.2)
       coderay (~> 1.1)
@@ -1225,7 +1228,7 @@ GEM
       tty-markdown
       tty-prompt
     public_suffix (5.0.0)
-    puma (6.3.1)
+    puma (6.4.0)
       nio4r (~> 2.0)
     pyu-ruby-sasl (0.0.3.3)
     raabro (1.4.0)
@@ -1250,20 +1253,20 @@ GEM
     rack-test (2.1.0)
       rack (>= 1.3)
     rack-timeout (0.6.3)
-    rails (7.0.6)
-      actioncable (= 7.0.6)
-      actionmailbox (= 7.0.6)
-      actionmailer (= 7.0.6)
-      actionpack (= 7.0.6)
-      actiontext (= 7.0.6)
-      actionview (= 7.0.6)
-      activejob (= 7.0.6)
-      activemodel (= 7.0.6)
-      activerecord (= 7.0.6)
-      activestorage (= 7.0.6)
-      activesupport (= 7.0.6)
+    rails (7.0.8)
+      actioncable (= 7.0.8)
+      actionmailbox (= 7.0.8)
+      actionmailer (= 7.0.8)
+      actionpack (= 7.0.8)
+      actiontext (= 7.0.8)
+      actionview (= 7.0.8)
+      activejob (= 7.0.8)
+      activemodel (= 7.0.8)
+      activerecord (= 7.0.8)
+      activestorage (= 7.0.8)
+      activesupport (= 7.0.8)
       bundler (>= 1.15.0)
-      railties (= 7.0.6)
+      railties (= 7.0.8)
     rails-controller-testing (1.0.5)
       actionpack (>= 5.0.1.rc1)
       actionview (>= 5.0.1.rc1)
@@ -1276,9 +1279,9 @@ GEM
     rails-i18n (7.0.3)
       i18n (>= 0.7, < 2)
       railties (>= 6.0.0, < 8)
-    railties (7.0.6)
-      actionpack (= 7.0.6)
-      activesupport (= 7.0.6)
+    railties (7.0.8)
+      actionpack (= 7.0.8)
+      activesupport (= 7.0.8)
       method_source
       rake (>= 12.2)
       thor (~> 1.0)
@@ -1295,8 +1298,7 @@ GEM
       optimist (>= 3.0.0)
     rbtree (0.4.6)
     rchardet (1.8.0)
-    rdoc (6.3.2)
-    re2 (2.0.0)
+    re2 (2.1.3)
       mini_portile2 (~> 2.8.4)
     recaptcha (5.12.3)
       json
@@ -1335,12 +1337,12 @@ GEM
       nokogiri
     rexml (3.2.6)
     rinku (2.0.0)
-    rotp (6.2.0)
+    rotp (6.3.0)
     rouge (4.1.3)
-    rqrcode (0.7.0)
-      chunky_png
-    rqrcode-rails3 (0.1.7)
-      rqrcode (>= 0.4.2)
+    rqrcode (2.2.0)
+      chunky_png (~> 1.0)
+      rqrcode_core (~> 1.0)
+    rqrcode_core (1.2.0)
     rspec (3.12.0)
       rspec-core (~> 3.12.0)
       rspec-expectations (~> 3.12.0)
@@ -1439,11 +1441,6 @@ GEM
     sanitize (6.0.2)
       crass (~> 1.0.2)
       nokogiri (>= 1.12.0)
-    sass (3.5.5)
-      sass-listen (~> 4.0.0)
-    sass-listen (4.0.0)
-      rb-fsevent (~> 0.9, >= 0.9.4)
-      rb-inotify (~> 0.9, >= 0.9.7)
     sassc (2.4.0)
       ffi (~> 1.9)
     sassc-rails (2.1.0)
@@ -1459,7 +1456,7 @@ GEM
     seed-fu (2.3.7)
       activerecord (>= 3.1)
       activesupport (>= 3.1)
-    selenium-webdriver (4.12.0)
+    selenium-webdriver (4.14.0)
       rexml (~> 3.2, >= 3.2.5)
       rubyzip (>= 1.2.2, < 3.0)
       websocket (~> 1.0)
@@ -1580,11 +1577,11 @@ GEM
       unicode-display_width (>= 1.1.1, < 3)
     terser (1.0.2)
       execjs (>= 0.3.0, < 3)
-    test-prof (1.2.2)
+    test-prof (1.2.3)
     test_file_finder (0.1.4)
       faraday (~> 1.0)
     text (1.3.1)
-    thor (1.2.1)
+    thor (1.2.2)
     thread_safe (0.3.6)
     thrift (0.16.0)
     tilt (2.0.11)
@@ -1649,7 +1646,7 @@ GEM
     unparser (0.6.7)
       diff-lcs (~> 1.3)
       parser (>= 3.2.0)
-    uri (0.12.1)
+    uri (0.12.2)
     uri_template (0.7.0)
     valid_email (0.1.3)
       activemodel
@@ -1665,7 +1662,7 @@ GEM
       activesupport (>= 3.0)
     version_gem (1.1.0)
     version_sorter (2.3.0)
-    view_component (3.5.0)
+    view_component (3.6.0)
       activesupport (>= 5.2.0, < 8.0)
       concurrent-ruby (~> 1.0)
       method_source (~> 1.0)
@@ -1701,8 +1698,8 @@ GEM
       crack (>= 0.3.2)
       hashdiff (>= 0.4.0, < 2.0.0)
     webrick (1.8.1)
-    websocket (1.2.9)
-    websocket-driver (0.7.5)
+    websocket (1.2.10)
+    websocket-driver (0.7.6)
       websocket-extensions (>= 0.1.0)
     websocket-extensions (0.1.5)
     wikicloth (0.8.1)
@@ -1735,7 +1732,6 @@ DEPENDENCIES
   apollo_upload_server (~> 2.1.0)
   app_store_connect
   arr-pm (~> 0.0.12)
-  asana (~> 0.10.13)
   asciidoctor (~> 2.0.18)
   asciidoctor-include-ext (~> 0.4.0)
   asciidoctor-kroki (~> 0.8.0)
@@ -1745,8 +1741,8 @@ DEPENDENCIES
   autoprefixer-rails (= 10.2.5.1)
   awesome_print
   aws-sdk-cloudformation (~> 1)
-  aws-sdk-core (~> 3.181.1)
-  aws-sdk-s3 (~> 1.134.0)
+  aws-sdk-core (~> 3.185.1)
+  aws-sdk-s3 (~> 1.136.0)
   axe-core-rspec
   babosa (~> 2.0)
   base32 (~> 0.3.0)
@@ -1757,8 +1753,8 @@ DEPENDENCIES
   better_errors (~> 2.10.1)
   bootsnap (~> 1.16.0)
   browser (~> 5.3.1)
-  bullet (~> 7.0.2)
-  bundler-audit (~> 0.7.0.1)
+  bullet (~> 7.1.1)
+  bundler-audit (~> 0.9.1)
   bundler-checksum (~> 0.1.0)!
   capybara (~> 3.39, >= 3.39.2)
   capybara-screenshot (~> 1.0.26)
@@ -1769,7 +1765,7 @@ DEPENDENCIES
   cloud_profiler_agent (~> 0.0.0)!
   commonmarker (~> 0.23.10)
   concurrent-ruby (~> 1.1)
-  connection_pool (~> 2.0)
+  connection_pool (~> 2.4)
   countries (~> 4.0.0)
   creole (~> 0.5.0)
   crystalball (~> 0.7.0)
@@ -1780,11 +1776,11 @@ DEPENDENCIES
   declarative_policy (~> 1.1.0)
   deprecation_toolkit (~> 1.5.1)
   derailed_benchmarks
-  devfile (~> 0.0.22.pre.alpha1)
+  devfile (~> 0.0.23.pre.alpha1)
   device_detector
   devise (~> 4.8.1)
   devise-pbkdf2-encryptable (~> 0.0.0)!
-  devise-two-factor (~> 4.0.2)
+  devise-two-factor (~> 4.1.1)
   diff_match_patch (~> 0.1.0)
   diffy (~> 3.4)
   discordrb-webhooks (~> 3.4)
@@ -1816,11 +1812,12 @@ DEPENDENCIES
   gettext (~> 3.3)
   gettext_i18n_rails (~> 1.11.0)
   gettext_i18n_rails_js (~> 1.3)
-  gitaly (~> 16.3.0.pre.rc1)
+  gitaly (~> 16.5.0.pre.rc1)
   gitlab-chronic (~> 0.10.5)
-  gitlab-dangerfiles (~> 4.0.0)
+  gitlab-dangerfiles (~> 4.3.2)
   gitlab-experiment (~> 0.8.0)
   gitlab-fog-azure-rm (~> 1.8.0)
+  gitlab-http!
   gitlab-labkit (~> 0.34.0)
   gitlab-license (~> 2.3)
   gitlab-mail_room (~> 0.0.23)
@@ -1832,9 +1829,9 @@ DEPENDENCIES
   gitlab-sidekiq-fetcher!
   gitlab-styles (~> 10.1.0)
   gitlab-utils!
-  gitlab_chronic_duration (~> 0.11)
+  gitlab_chronic_duration (~> 0.12)
   gitlab_omniauth-ldap (~> 2.2.0)
-  gitlab_quality-test_tooling (~> 1.0.0)
+  gitlab_quality-test_tooling (~> 1.3.0)
   gon (~> 6.4.0)
   google-apis-androidpublisher_v3 (~> 0.34.0)
   google-apis-cloudbilling_v1 (~> 0.21.0)
@@ -1847,7 +1844,7 @@ DEPENDENCIES
   google-apis-serviceusage_v1 (~> 0.28.0)
   google-apis-sqladmin_v1beta4 (~> 0.41.0)
   google-cloud-storage (~> 1.44.0)
-  google-protobuf (~> 3.24, >= 3.24.3)
+  google-protobuf (~> 3.24, >= 3.24.4)
   gpgme (~> 2.0.23)
   grape (~> 1.7.1)
   grape-entity (~> 0.10.0)
@@ -1858,20 +1855,20 @@ DEPENDENCIES
   graphiql-rails (~> 1.8.0)
   graphlient (~> 0.5.0)
   graphlyte (~> 1.0.0)
-  graphql (~> 1.13.19)
-  graphql-docs (~> 2.1.0)
-  grpc (~> 1.55.0)
+  graphql (~> 2.0.27)
+  graphql-docs (~> 4.0.0)
+  grpc (~> 1.58.0)
   gssapi (~> 1.3.1)
   guard-rspec
   haml_lint (~> 0.40.0)
   hamlit (~> 2.15.0)
-  hangouts-chat (~> 0.0.5)
   hashie (~> 5.0.0)
   health_check (~> 3.0)
   html-pipeline (~> 2.14.3)
   html2text
   httparty (~> 0.21.0)
   icalendar
+  influxdb-client (~> 2.9)
   invisible_captcha (~> 2.1.0)
   ipaddr (~> 1.2.5)
   ipaddress (~> 0.8.3)
@@ -1887,14 +1884,14 @@ DEPENDENCIES
   knapsack (~> 1.21.1)
   kramdown (~> 2.3.1)
   kubeclient (~> 4.11.0)
-  lefthook (~> 1.4.7)
+  lefthook (~> 1.5.2)
   letter_opener_web (~> 2.0.0)
   license_finder (~> 7.0)
   licensee (~> 9.16)
   listen (~> 3.7)
   lockbox (~> 1.3.0)
   lograge (~> 0.5)
-  loofah (~> 2.21.3)
+  loofah (~> 2.21.4)
   lookbook (~> 2.0, >= 2.0.1)
   lru_redux
   mail (= 2.8.1)
@@ -1917,7 +1914,7 @@ DEPENDENCIES
   oj (~> 3.13.21)
   oj-introspect (~> 0.7)
   omniauth (~> 2.1.0)
-  omniauth-alicloud (~> 2.0.1)
+  omniauth-alicloud (~> 3.0.0)
   omniauth-atlassian-oauth2 (~> 0.2.0)
   omniauth-auth0 (~> 3.1)
   omniauth-azure-activedirectory-v2 (~> 2.0)
@@ -1939,31 +1936,30 @@ DEPENDENCIES
   org-ruby (~> 0.9.12)
   pact (~> 1.63)
   parallel (~> 1.19)
-  parser (~> 3.2, >= 3.2.2.3)
+  parser (~> 3.2, >= 3.2.2.4)
   parslet (~> 1.8)
   peek (~> 1.1)
   pg (~> 1.5.4)
   pg_query (~> 4.2.3)
   png_quantizator (~> 0.2.1)
   premailer-rails (~> 1.10.3)
-  prometheus-client-mmap (~> 0.28)
+  prometheus-client-mmap (~> 0.28, >= 0.28.1)
   pry-byebug
   pry-rails (~> 0.3.9)
   pry-shell (~> 0.6.4)
-  puma (~> 6.3, >= 6.3.1)
+  puma (~> 6.4)
   rack (~> 2.2.8)
   rack-attack (~> 6.7.0)
   rack-cors (~> 2.0.1)
   rack-oauth2 (~> 1.21.3)
   rack-proxy (~> 0.7.7)
   rack-timeout (~> 0.6.3)
-  rails (~> 7.0.6)
+  rails (~> 7.0.8)
   rails-controller-testing
   rails-i18n (~> 7.0)
   rainbow (~> 3.0)
   rbtrace (~> 0.4)
-  rdoc (~> 6.3.2)
-  re2 (= 2.0.0)
+  re2 (= 2.1.3)
   recaptcha (~> 5.12)
   redis (~> 4.8.0)
   redis-actionpack (~> 5.3.0)
@@ -1973,7 +1969,7 @@ DEPENDENCIES
   retriable (~> 3.1.2)
   rexml (~> 3.2.6)
   rouge (~> 4.1.3)
-  rqrcode-rails3 (~> 0.1.7)
+  rqrcode (~> 2.0)
   rspec-benchmark (~> 0.6.0)
   rspec-parameterized (~> 1.0)
   rspec-rails (~> 6.0.3)
@@ -1993,7 +1989,7 @@ DEPENDENCIES
   sassc-rails (~> 2.1.0)
   sd_notify (~> 0.1.0)
   seed-fu (~> 2.3.7)
-  selenium-webdriver (= 4.12.0)
+  selenium-webdriver (~> 4.14)
   semver_dialects (~> 1.2.1)
   sentry-rails (~> 5.8.0)
   sentry-raven (~> 3.1)
@@ -2022,7 +2018,7 @@ DEPENDENCIES
   tanuki_emoji (~> 0.7)
   telesignenterprise (~> 2.2)
   terser (= 1.0.2)
-  test-prof (~> 1.2.2)
+  test-prof (~> 1.2.3)
   test_file_finder (~> 0.1.3)
   thrift (>= 0.16.0)
   timfel-krb5-auth (~> 0.8)
@@ -2034,7 +2030,7 @@ DEPENDENCIES
   valid_email (~> 0.1)
   validates_hostname (~> 1.0.13)
   version_sorter (~> 2.3)
-  view_component (~> 3.5.0)
+  view_component (~> 3.6.0)
   vite_rails
   vmstat (~> 2.3.0)
   warning (~> 1.3.0)
@@ -2045,4 +2041,4 @@ DEPENDENCIES
   yajl-ruby (~> 1.4.3)
 
 BUNDLED WITH
-   2.4.19
+   2.4.20
diff --git a/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix b/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
index 6dcac890ea76..e239df5e9e94 100644
--- a/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
@@ -17,10 +17,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1d72cqx1h9c0yl1vc8xakvji00krg118ih6lwqlg5nbw50gbx25c";
+      sha256 = "117vxic67jnw6q637kmsb3ryj0x485295pz9a9y4z8xn9bdlsl0z";
       type = "gem";
     };
-    version = "7.0.6";
+    version = "7.0.8";
   };
   actionmailbox = {
     dependencies = ["actionpack" "activejob" "activerecord" "activestorage" "activesupport" "mail" "net-imap" "net-pop" "net-smtp"];
@@ -28,10 +28,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "12xkyfdpr7ljnd31yhc2kzl0rqrlwxzpg4qcn4yb2h364hwc6fh8";
+      sha256 = "1r8ldj2giaz8cn49qkdqn5zc29gbsr5ky4fg6r7ali0yh1xh684l";
       type = "gem";
     };
-    version = "7.0.6";
+    version = "7.0.8";
   };
   actionmailer = {
     dependencies = ["actionpack" "actionview" "activejob" "activesupport" "mail" "net-imap" "net-pop" "net-smtp" "rails-dom-testing"];
@@ -39,10 +39,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "01x11ijfg56585vj7a7az0235idnxcnyjp1nb1jvkm08jjll5d1k";
+      sha256 = "0w6gvj7ybniq89834hqww9rj2xypz9l91f8niwaws2yq1qklymr2";
       type = "gem";
     };
-    version = "7.0.6";
+    version = "7.0.8";
   };
   actionpack = {
     dependencies = ["actionview" "activesupport" "rack" "rack-test" "rails-dom-testing" "rails-html-sanitizer"];
@@ -50,10 +50,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0d66w1d9rhvafd0dilqyr1ymsvr060l8hi0xvwij7cyvzzxrlrbc";
+      sha256 = "1l319p0gipfgq8bp8dvbv97qqb72rad9zcqn5snhgv20cmpqr69b";
       type = "gem";
     };
-    version = "7.0.6";
+    version = "7.0.8";
   };
   actiontext = {
     dependencies = ["actionpack" "activerecord" "activestorage" "activesupport" "globalid" "nokogiri"];
@@ -61,10 +61,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0bpyfh8g0mzgkb8bxvf245mwnx1awbr1y6dxcdckyhsjjgrfynfl";
+      sha256 = "0i47r3n2m8qm002gx7c0lx1pv15pr2zy57dm8j38x960rsb655pp";
       type = "gem";
     };
-    version = "7.0.6";
+    version = "7.0.8";
   };
   actionview = {
     dependencies = ["activesupport" "builder" "erubi" "rails-dom-testing" "rails-html-sanitizer"];
@@ -72,10 +72,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1icfh9pgjpd29apzn07cnqa9nlpvjv7i4vrygack5gp7hp54l8m7";
+      sha256 = "0xnpdwj1d8m6c2d90jp9cs50ggiz0jj02ls2h9lg68k4k8mnjbd2";
       type = "gem";
     };
-    version = "7.0.6";
+    version = "7.0.8";
   };
   activejob = {
     dependencies = ["activesupport" "globalid"];
@@ -83,10 +83,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1gawwb6550ra1xgbrki03aq4q5wafa3xfrpdr3cva4ghy3qqn53q";
+      sha256 = "1cn1ic7ml75jm0c10s7cm5mvcgfnafj0kjvvjavpjcxgz6lxcqyb";
       type = "gem";
     };
-    version = "7.0.6";
+    version = "7.0.8";
   };
   activemodel = {
     dependencies = ["activesupport"];
@@ -94,10 +94,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "072iv0d3vpbp0xijg4jj99sjil1rykmqfj9addxj76bm5mbzwcaj";
+      sha256 = "004w8zaz2g3y6lnrsvlcmljll0m3ndqpgwf0wfscgq6iysibiglm";
       type = "gem";
     };
-    version = "7.0.6";
+    version = "7.0.8";
   };
   activerecord = {
     dependencies = ["activemodel" "activesupport"];
@@ -105,10 +105,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1l0rn43bhyzlfa4wwcfz016vb4lkzvl0jf5zibkjy4sppxxixzrq";
+      sha256 = "04wavps80q3pvhvfbmi4gs102y1p6mxbg8xylzvib35b6m92adpj";
       type = "gem";
     };
-    version = "7.0.6";
+    version = "7.0.8";
   };
   activerecord-explain-analyze = {
     dependencies = ["activerecord" "pg"];
@@ -137,10 +137,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "036mv935r5mmh7fljz10lyr43c5y5bn8b6h7gdkv8spfgwzihw4j";
+      sha256 = "0d6vm6alsp0g6f3548b615zxbz8l2wrmaikwgsf8kv11wf6swb4c";
       type = "gem";
     };
-    version = "7.0.6";
+    version = "7.0.8";
   };
   activesupport = {
     dependencies = ["concurrent-ruby" "i18n" "minitest" "tzinfo"];
@@ -148,10 +148,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1cjsf26656996hv48wgv2mkwxf0fy1qc68ikgzq7mzfq2mmvmayk";
+      sha256 = "188kbwkn1lbhz40ala8ykp20jzqphgc68g3d8flin8cqa2xid0s5";
       type = "gem";
     };
-    version = "7.0.6";
+    version = "7.0.8";
   };
   acts-as-taggable-on = {
     dependencies = ["activerecord"];
@@ -248,17 +248,6 @@ src:
     };
     version = "0.0.12";
   };
-  asana = {
-    dependencies = ["faraday" "faraday_middleware" "faraday_middleware-multi_json" "oauth2"];
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1b6pqazhi9922y79763m0alvdmvm90i806qgb1a8l4fnimzx7l1n";
-      type = "gem";
-    };
-    version = "0.10.13";
-  };
   asciidoctor = {
     groups = ["default"];
     platforms = [];
@@ -411,10 +400,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1qnwh40d45pqm77dayvh1zdlb5xjbbj7hv29s8nhxj7c3qkl4bpb";
+      sha256 = "0wvrz7d2rw17ihj2fmvaq91cg35pvk1asl4skncsk4w3mx7dlajp";
       type = "gem";
     };
-    version = "3.181.1";
+    version = "3.185.1";
   };
   aws-sdk-kms = {
     dependencies = ["aws-sdk-core" "aws-sigv4"];
@@ -433,10 +422,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1fbz259as60xnf563z9byp8blq5fsc81h92h3wicai4bmz45w4r5";
+      sha256 = "0qwdkbwp3f5illkkmivzdr9gcrcg69yv73xlfp6fc7fmhlm30irm";
       type = "gem";
     };
-    version = "1.134.0";
+    version = "1.136.0";
   };
   aws-sigv4 = {
     dependencies = ["aws-eventstream"];
@@ -684,10 +673,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "10cwf4pi2i1r1hpz06sishj95aa9m65ymd61sl2vp57ncsrqcyab";
+      sha256 = "172v1vjqqlfk8dw3xh7j4m2wfmp74zwsh2v2jqppgzibmpcqjxxd";
       type = "gem";
     };
-    version = "7.0.2";
+    version = "7.1.1";
   };
   bundler-audit = {
     dependencies = ["thor"];
@@ -695,10 +684,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "04l9rs56rlvihbr2ybkrigjajgd3swa98lxvmdl8iylj1g5m7n0j";
+      sha256 = "0gdx0019vj04n1512shhdx7hwphzqmdpw4vva2k551nd47y1dixx";
       type = "gem";
     };
-    version = "0.7.0.1";
+    version = "0.9.1";
   };
   bundler-checksum = {
     dependencies = [];
@@ -752,10 +741,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1w8k7bbwknqmq64mygl2a137vx3cs8xrjmdp8l3whm6f5vg480hg";
+      sha256 = "089s8rbwddzcyw1ky34h90flz5wzqzi2lvajykbxn3l3s6mjsxw1";
       type = "gem";
     };
-    version = "1.3.3";
+    version = "1.3.4";
   };
   cbor = {
     groups = ["default"];
@@ -825,10 +814,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0vf0axgrm95bs3y0x5gdb76xawfh210yxplj7jbwr6z7n88i1axn";
+      sha256 = "1znw5x86hmm9vfhidwdsijz8m38pqgmv98l9ryilvky0aldv7mc9";
       type = "gem";
     };
-    version = "1.3.5";
+    version = "1.4.0";
   };
   circuitbox = {
     groups = ["default"];
@@ -951,10 +940,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1nj4r58m5cpfdsijj6gjfs3yzcnxq2halagjk07wjcrgj6z8ayb7";
+      sha256 = "1x32mcpm2cl5492kd6lbjbaf17qsssmpx9kdyr7z1wcif2cwyh0g";
       type = "gem";
     };
-    version = "2.3.0";
+    version = "2.4.1";
   };
   cork = {
     dependencies = ["colored2"];
@@ -1083,6 +1072,16 @@ src:
     };
     version = "8.0.0";
   };
+  dartsass = {
+    groups = ["default" "development" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0i8kivfa4i1m2msw2h5zigxdnar5fvln7xhym85qyp35lmi74zi6";
+      type = "gem";
+    };
+    version = "1.49.8";
+  };
   database_cleaner = {
     groups = ["development" "test"];
     platforms = [];
@@ -1192,10 +1191,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0hglq61xxs8hgj2aq6g94w9ry90jq9aivb3c6fycxz1srdq26lsl";
+      sha256 = "02p4cxz9w9nsghgmwmw32f9g80df8simagzpafhkvc5grdwwd8pv";
       type = "gem";
     };
-    version = "0.0.22.pre.alpha1";
+    version = "0.0.23.pre.alpha1";
   };
   device_detector = {
     groups = ["default"];
@@ -1234,10 +1233,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "04f5rb8fg4cvzm32v413z3h53wc0fgxg927q8rqd546hdrlx4j35";
+      sha256 = "15cbgb0hyq78myc6aaszzdrd9qll9n3qdhykmrx22qiyac3mnpy9";
       type = "gem";
     };
-    version = "4.0.2";
+    version = "4.1.1";
   };
   diff-lcs = {
     groups = ["default" "development" "test"];
@@ -1558,10 +1557,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0qminivnyzwmqjhrh3b92halwbk0zcl9xn828p5rnap1szl2yag5";
+      sha256 = "029c7kynhkxw8fgq9q171xi68ajfqrb22r7drvkar018j8871yyz";
       type = "gem";
     };
-    version = "1.2.1";
+    version = "1.3.0";
   };
   et-orbi = {
     dependencies = ["tzinfo"];
@@ -1632,10 +1631,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "17mi5qayplfaa6p3mfwa36il84ixr0bimqvl0q73lw5i81blp126";
+      sha256 = "0f7isjr3vpvmyc3arqcgn1fc69axxd73xk87nk31ibpv15sfzvn8";
       type = "gem";
     };
-    version = "0.6.0";
+    version = "0.7.0";
   };
   factory_bot = {
     dependencies = ["activesupport"];
@@ -1804,17 +1803,6 @@ src:
     };
     version = "0.3.0";
   };
-  faraday_middleware-multi_json = {
-    dependencies = ["faraday_middleware" "multi_json"];
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0651sxhzbq9xfq3hbpmrp0nbybxnm9ja3m97k386m4bqgamlvz1q";
-      type = "gem";
-    };
-    version = "0.0.6";
-  };
   fast_blank = {
     groups = ["default"];
     platforms = [];
@@ -2131,10 +2119,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0hsccw9njvvsic0qn5x1aia0yz66sy4bsw1pixc5jf2g990wrnam";
+      sha256 = "0lw3lfq0wii1jg6112ry2c3g01dphwl8yp61xyh66ijds1d525zd";
       type = "gem";
     };
-    version = "16.3.0.pre.rc1";
+    version = "16.5.0.pre.rc1";
   };
   gitlab = {
     dependencies = ["httparty" "terminal-table"];
@@ -2164,10 +2152,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "04j81xsasbfzc9xs0sgizc76qj26ka629yrcd9l6m3iqj0byiaz3";
+      sha256 = "15hax19xpav0i8mhg3y1zf4528hx18r6zg6dy8lwdk7s60gdi2wp";
       type = "gem";
     };
-    version = "4.0.0";
+    version = "4.3.2";
   };
   gitlab-experiment = {
     dependencies = ["activesupport" "request_store"];
@@ -2191,6 +2179,16 @@ src:
     };
     version = "1.8.0";
   };
+  gitlab-http = {
+    dependencies = ["activesupport" "httparty" "ipaddress" "nokogiri" "railties"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      path = "${src}/gems/gitlab-http";
+      type = "path";
+    };
+    version = "0.1.0";
+  };
   gitlab-labkit = {
     dependencies = ["actionpack" "activesupport" "grpc" "jaeger-client" "opentracing" "pg_query" "redis"];
     groups = ["default"];
@@ -2310,10 +2308,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "19jba5gxlb25mvd85rn3hfzyzsqw4cq7ml13mzq1y0x94hbj1zf2";
+      sha256 = "0vf1zw3z45m6ldwjvvzvbc6gr0spcbl1x1vny4qwid8msi26jxhd";
       type = "gem";
     };
-    version = "0.11.0";
+    version = "0.12.0";
   };
   gitlab_omniauth-ldap = {
     dependencies = ["net-ldap" "omniauth" "pyu-ruby-sasl" "rubyntlm"];
@@ -2332,10 +2330,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1nriqgy9rlnachzrq63xakskdgjg9b3bdgh2fb2b63kai8bbwc5h";
+      sha256 = "0bk5lhaqfww0swi6xl1wqj6g97xmxlva6b8yyag23743k052x4qc";
       type = "gem";
     };
-    version = "1.0.0";
+    version = "1.3.0";
   };
   globalid = {
     dependencies = ["activesupport"];
@@ -2583,10 +2581,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0pcl4x4cw3snl5xzs99lm82m9xkfs8vm1a8dfrc34pwb77mwrwv3";
+      sha256 = "1jpjf9p3yf11f1fx74whp4zbxwcaf7jd5y10gknx61fr5z50791q";
       type = "gem";
     };
-    version = "3.24.3";
+    version = "3.24.4";
   };
   googleapis-common-protos = {
     dependencies = ["google-protobuf" "googleapis-common-protos-types" "grpc"];
@@ -2735,10 +2733,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0njsbxx82vqi8hdn4nad62abmh0x0w3mis3mq79q3xr11srisn23";
+      sha256 = "0dlb8hbgs7yas59pwf4k7qrczbgkvrpcjqd2f5cmjj02fxdbwn8z";
       type = "gem";
     };
-    version = "1.13.19";
+    version = "2.0.27";
   };
   graphql-client = {
     dependencies = ["activesupport" "graphql"];
@@ -2746,21 +2744,21 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0pgb1r4vkyrq8hzhkii48hn7cdlkmnrswzjsl0xqxg1diz705bss";
+      sha256 = "02r5qvfr176n051mp1c79xbpjhjqm92kk4118r0fbp131y0xralq";
       type = "gem";
     };
-    version = "0.17.0";
+    version = "0.18.0";
   };
   graphql-docs = {
-    dependencies = ["commonmarker" "escape_utils" "extended-markdown-filter" "gemoji" "graphql" "html-pipeline" "sass"];
+    dependencies = ["commonmarker" "dartsass" "escape_utils" "extended-markdown-filter" "gemoji" "graphql" "html-pipeline"];
     groups = ["development" "test"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0xmmifirvm4hay8qy6hjsdwms56sk973cq1b9c85b97xz0129f3y";
+      sha256 = "1mq2zafz0n5yd0i251w1a37l3dk7dn2mhw5snzhjdnv3jaard0pn";
       type = "gem";
     };
-    version = "2.1.0";
+    version = "4.0.0";
   };
   grpc = {
     dependencies = ["google-protobuf" "googleapis-common-protos-types"];
@@ -2768,10 +2766,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1bk1l7mi98givcd4rj0h9izj97nwgff4lp7xi89mp3z9wpw354sj";
+      sha256 = "00lx7sql179ak7rx5vg76z45y558d5wj0gldql4qjcaxjnzcryqc";
       type = "gem";
     };
-    version = "1.55.0";
+    version = "1.58.0";
   };
   gssapi = {
     dependencies = ["ffi"];
@@ -2859,16 +2857,6 @@ src:
     };
     version = "1.3.7";
   };
-  hangouts-chat = {
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1dmnv3723c22683bzys8walkl6wi74xzawxjbhwqzjdbwk3bdgmx";
-      type = "gem";
-    };
-    version = "0.0.5";
-  };
   hashdiff = {
     groups = ["default" "test"];
     platforms = [];
@@ -3079,6 +3067,16 @@ src:
     };
     version = "0.1.8";
   };
+  influxdb-client = {
+    groups = ["development" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "00lzkgzr6zmnlbqcfsb38b4d3762wslx0v32nsy6052jksvas7xm";
+      type = "gem";
+    };
+    version = "2.9.0";
+  };
   invisible_captcha = {
     dependencies = ["rails"];
     groups = ["default"];
@@ -3351,10 +3349,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "112m3ypr3z3n23l0axy057wkbzwhf52p20pya2nylwd8jmck1gi2";
+      sha256 = "02k7gr457gdi4zjgxr9ga44f8lb8q0yyiqmwhaylr70n76zqrmrp";
       type = "gem";
     };
-    version = "1.4.7";
+    version = "1.5.2";
   };
   letter_opener = {
     dependencies = ["launchy"];
@@ -3465,14 +3463,14 @@ src:
   };
   loofah = {
     dependencies = ["crass" "nokogiri"];
-    groups = ["default" "development" "test"];
+    groups = ["default" "development" "monorepo" "test"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1p744kjpb5zk2ihklbykzii77alycjc04vpnm2ch2f3cp65imlj3";
+      sha256 = "0d5p9vg2qkqfy60i93mpd3b25kw4bdxfai034y5a94pxp5fws61c";
       type = "gem";
     };
-    version = "2.21.3";
+    version = "2.21.4";
   };
   lookbook = {
     dependencies = ["activemodel" "css_parser" "htmlbeautifier" "htmlentities" "marcel" "railties" "redcarpet" "rouge" "view_component" "yard" "zeitwerk"];
@@ -3603,24 +3601,24 @@ src:
   };
   mime-types = {
     dependencies = ["mime-types-data"];
-    groups = ["danger" "default" "development" "test"];
+    groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0ipw892jbksbxxcrlx9g5ljq60qx47pm24ywgfbyjskbcl78pkvb";
+      sha256 = "0q8d881k1b3rbsfcdi3fx0b5vpdr5wcrhn88r2d9j7zjdkxp5mw5";
       type = "gem";
     };
-    version = "3.4.1";
+    version = "3.5.1";
   };
   mime-types-data = {
-    groups = ["danger" "default" "development" "test"];
+    groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "003gd7mcay800k2q4pb2zn8lwwgci4bhi42v2jvlidm8ksx03i6q";
+      sha256 = "0yjv0apysnrhbc70ralinfpcqn9382lxr643swp7a5sdwpa9cyqg";
       type = "gem";
     };
-    version = "3.2022.0105";
+    version = "3.2023.1003";
   };
   mini_histogram = {
     groups = ["default" "test"];
@@ -4067,10 +4065,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1ls87xxzhh1bbm4iqz221hz57y7iq1ifn33i7vvx1d02r9dl4k5i";
+      sha256 = "0gh1d69w6p62hj18bh2p5fdykg9za1yifpq18swp9ms0pcx4yp4w";
       type = "gem";
     };
-    version = "2.0.1";
+    version = "3.0.0";
   };
   omniauth-atlassian-oauth2 = {
     dependencies = ["omniauth" "omniauth-oauth2"];
@@ -4408,10 +4406,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1swigds85jddb5gshll1g8lkmbcgbcp9bi1d4nigwvxki8smys0h";
+      sha256 = "0r69dbh6h6j4d54isany2ir4ni4gf2ysvk3k44awi6amz18nggpd";
       type = "gem";
     };
-    version = "3.2.2.3";
+    version = "3.2.2.4";
   };
   parslet = {
     groups = ["default" "development" "test"];
@@ -4536,10 +4534,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0yyd1mvzbv64jc700d2vvdcr4cmb2gwf68368g0bwp1ybn64xqgk";
+      sha256 = "0ap52y7lng1cnqmg5bp4hazllppar33fpczwmh6gn9v9l64kkywj";
       type = "gem";
     };
-    version = "0.28.0";
+    version = "0.28.1";
   };
   pry = {
     dependencies = ["coderay" "method_source"];
@@ -4601,10 +4599,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1x4dwx2shx0p7lsms97r85r7ji7zv57bjy3i1kmcpxc8bxvrr67c";
+      sha256 = "1y8jcw80zcxvdq0id329lzmp5pzx7hpac227d7sgjkblc89s3pfm";
       type = "gem";
     };
-    version = "6.3.1";
+    version = "6.4.0";
   };
   pyu-ruby-sasl = {
     groups = ["default"];
@@ -4739,10 +4737,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "08glp6jhq5yh8i5jjxzqa3aqx819l6ci6m68bx1asmimla0x9ysx";
+      sha256 = "0rsqin156dawz7gzpy1ijs02afqcr4704vqj56s6yxng3a9ayhwf";
       type = "gem";
     };
-    version = "7.0.6";
+    version = "7.0.8";
   };
   rails-controller-testing = {
     dependencies = ["actionpack" "actionview" "activesupport"];
@@ -4794,10 +4792,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0dcabk5bl5flmspnb9d2qcvclcaw0nd5yr9w6m5pzsmylg3y63pv";
+      sha256 = "0sfc16zrcn4jgf5xczb08n6prhmqqgg9f0b4mn73zlzg6cwmqchj";
       type = "gem";
     };
-    version = "7.0.6";
+    version = "7.0.8";
   };
   rainbow = {
     groups = ["coverage" "default" "development" "test"];
@@ -4881,26 +4879,16 @@ src:
     };
     version = "1.8.0";
   };
-  rdoc = {
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "19h5g3g7k7wggy9amfx8b3m09ss7wrakbrva2xnda9sw4chagx6y";
-      type = "gem";
-    };
-    version = "6.3.2";
-  };
   re2 = {
     dependencies = ["mini_portile2"];
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "09c9f692ixym8sqk26f175jw53a00h2s4xad6z141axpi2mmy1q9";
+      sha256 = "13xfrx1wwq7n2qsw449fq8h611n05v400i9dz9k6pdia019hp8q3";
       type = "gem";
     };
-    version = "2.0.0";
+    version = "2.1.3";
   };
   recaptcha = {
     dependencies = ["json"];
@@ -5107,10 +5095,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "11q7rkjx40yi6lpylgl2jkpy162mjw7mswrcgcax86vgpbpjx6i3";
+      sha256 = "0m48hv6wpmmm6cjr6q92q78h1i610riml19k5h1dil2yws3h1m3m";
       type = "gem";
     };
-    version = "6.2.0";
+    version = "6.3.0";
   };
   rouge = {
     groups = ["default" "development" "test"];
@@ -5123,26 +5111,25 @@ src:
     version = "4.1.3";
   };
   rqrcode = {
-    dependencies = ["chunky_png"];
+    dependencies = ["chunky_png" "rqrcode_core"];
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "188n1mvc7klrlw30bai16sdg4yannmy7cz0sg0nvm6f1kjx5qflb";
+      sha256 = "1hggzz8i1l62pkkiybhiqv6ypxw7q844sddrrbbfczjcnj5sivi3";
       type = "gem";
     };
-    version = "0.7.0";
+    version = "2.2.0";
   };
-  rqrcode-rails3 = {
-    dependencies = ["rqrcode"];
+  rqrcode_core = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1i28rwmj24ssk91chn0g7qsnvn003y3s5a7jsrg3w4l5ckr841bg";
+      sha256 = "06ld6386hbdhy5h0k09axmgn424kavpc8f27k1vjhknjhbf8jjfg";
       type = "gem";
     };
-    version = "0.1.7";
+    version = "1.2.0";
   };
   rspec = {
     dependencies = ["rspec-core" "rspec-expectations" "rspec-mocks"];
@@ -5530,28 +5517,6 @@ src:
     };
     version = "6.0.2";
   };
-  sass = {
-    dependencies = ["sass-listen"];
-    groups = ["default" "development" "test"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "10401m2xlv6vaxfwzy4xxmk51ddcnkvwi918cw3jkki0qqdl7d8v";
-      type = "gem";
-    };
-    version = "3.5.5";
-  };
-  sass-listen = {
-    dependencies = ["rb-fsevent" "rb-inotify"];
-    groups = ["default" "development" "test"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0xw3q46cmahkgyldid5hwyiwacp590zj2vmswlll68ryvmvcp7df";
-      type = "gem";
-    };
-    version = "4.0.0";
-  };
   sassc = {
     dependencies = ["ffi"];
     groups = ["default"];
@@ -5612,10 +5577,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0jwll13m7bqph4lgl75m7vwd175k657znwa7qn9qkf5dcxdjkcjs";
+      sha256 = "094x2gzfxpp4wzyy3fcbb5ah3abvdd41ilzwv5g0hgqx0a0nywjm";
       type = "gem";
     };
-    version = "4.12.0";
+    version = "4.14.0";
   };
   semver_dialects = {
     dependencies = ["pastel" "thor" "tty-command"];
@@ -6161,10 +6126,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "08j5456rdpgxvv8bs44x81jrxzpxb79wxfxdq4fqwxyircxzi2jj";
+      sha256 = "1mhzw33lv7h8d7pyh65lis5svnmm8m6fnszbsfg3j3xk9hcl0an5";
       type = "gem";
     };
-    version = "1.2.2";
+    version = "1.2.3";
   };
   test_file_finder = {
     dependencies = ["faraday"];
@@ -6192,10 +6157,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0inl77jh4ia03jw3iqm5ipr76ghal3hyjrd6r8zqsswwvi9j2xdi";
+      sha256 = "0k7j2wn14h1pl4smibasw0bp66kg626drxb59z7rzflch99cd4rg";
       type = "gem";
     };
-    version = "1.2.1";
+    version = "1.2.2";
   };
   thread_safe = {
     groups = ["default" "test"];
@@ -6517,10 +6482,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1vigw7nfszfqgikr6n574k9bfh0rvs74z8xq46rz2zsm8249l8cc";
+      sha256 = "0fa49cdssxllj1j37a56kq27wsibx5lmqxkqdk1rz3452y0bsydy";
       type = "gem";
     };
-    version = "0.12.1";
+    version = "0.12.2";
   };
   uri_template = {
     groups = ["default"];
@@ -6602,10 +6567,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1bz86m3bbnhy8j1gmpm76jcgqfyjafqwyxjdd1bk2f5jmgswvqy3";
+      sha256 = "18s2b8g23agnykjjdw74ha0hhzx8n73gn41vsqxmhlgxnh8mr93s";
       type = "gem";
     };
-    version = "3.5.0";
+    version = "3.6.0";
   };
   virtus = {
     dependencies = ["axiom-types" "coercible" "descendants_tracker"];
@@ -6719,10 +6684,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0dib6p55sl606qb4vpwrvj5wh881kk4aqn2zpfapf8ckx7g14jw8";
+      sha256 = "1a4zc8d0d91c3xqwapda3j3zgpfwdbj76hkb69xn6qvfkfks9h9c";
       type = "gem";
     };
-    version = "1.2.9";
+    version = "1.2.10";
   };
   websocket-driver = {
     dependencies = ["websocket-extensions"];
@@ -6730,10 +6695,10 @@ src:
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0a3bwxd9v3ghrxzjc4vxmf4xa18c6m4xqy5wb0yk5c6b9psc7052";
+      sha256 = "1nyh873w4lvahcl8kzbjfca26656d5c6z3md4sbqg5y1gfz0157n";
       type = "gem";
     };
-    version = "0.7.5";
+    version = "0.7.6";
   };
   websocket-extensions = {
     groups = ["default" "test"];
diff --git a/pkgs/applications/virtualization/cri-o/default.nix b/pkgs/applications/virtualization/cri-o/default.nix
index c6ee442d02fe..05de3c1626df 100644
--- a/pkgs/applications/virtualization/cri-o/default.nix
+++ b/pkgs/applications/virtualization/cri-o/default.nix
@@ -15,13 +15,13 @@
 
 buildGoModule rec {
   pname = "cri-o";
-  version = "1.28.1";
+  version = "1.28.2";
 
   src = fetchFromGitHub {
     owner = "cri-o";
     repo = "cri-o";
     rev = "v${version}";
-    sha256 = "sha256-4RwR4aM+h0cqogJ9sxoODlPGaXH2PALFoBU3jv/6Agg=";
+    sha256 = "sha256-g9J66CZOAoco7UmK+xPEE6T5Aes3LWEG3J40LuDcvYo=";
   };
   vendorHash = null;
 
diff --git a/pkgs/applications/window-managers/picom/picom-allusive.nix b/pkgs/applications/window-managers/picom/picom-allusive.nix
index eb31dd9ccdff..0efb67f641bb 100644
--- a/pkgs/applications/window-managers/picom/picom-allusive.nix
+++ b/pkgs/applications/window-managers/picom/picom-allusive.nix
@@ -2,19 +2,18 @@
 
 picom.overrideAttrs (oldAttrs: rec {
   pname = "picom-allusive";
-  version = "0.3.2";
+  version = "1.2.5";
 
   src = fetchFromGitHub {
     owner = "allusive-dev";
     repo = "picom-allusive";
     rev = version;
-    hash = "sha256-1zWntz2QKp/O9ZuOUZy9NkCNXFsBqRRvcd0SAr+7G/o=";
+    hash = "sha256-yM4TJjoVs+i33m/u/oWlx1TDKJrgwlfiGu72DOL/tl8=";
   };
 
   nativeBuildInputs = [ installShellFiles ] ++ oldAttrs.nativeBuildInputs;
 
   postInstall = ''
-    chmod +x $out/bin/picom-trans
     installManPage $src/man/picom.1.gz
   '' + (lib.optionalString (oldAttrs ? postInstall) oldAttrs.postInstall);
 
@@ -22,6 +21,6 @@ picom.overrideAttrs (oldAttrs: rec {
     description = "A fork of picom featuring improved animations and other features";
     homepage = "https://github.com/allusive-dev/picom-allusive";
     license = with lib.licenses; [ mit mpl20 ];
-    maintainers = with lib.maintainers; [ allusive ];
+    maintainers = with lib.maintainers; [ allusive iogamaster ];
   };
 })
diff --git a/pkgs/by-name/co/cowsql/package.nix b/pkgs/by-name/co/cowsql/package.nix
index c7b7b97e9792..e0ce26609124 100644
--- a/pkgs/by-name/co/cowsql/package.nix
+++ b/pkgs/by-name/co/cowsql/package.nix
@@ -39,9 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
   outputs = [ "dev" "out" ];
 
   passthru = {
-    tests = {
-      inherit incus;
-    };
+    inherit (incus) tests;
 
     updateScript = gitUpdater {
       rev-prefix = "v";
diff --git a/pkgs/by-name/ec/ecc/package.nix b/pkgs/by-name/ec/ecc/package.nix
index 733e7a1f3cc4..b79fa4bd18c8 100644
--- a/pkgs/by-name/ec/ecc/package.nix
+++ b/pkgs/by-name/ec/ecc/package.nix
@@ -53,18 +53,18 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "ecc";
-  version = "1.0.11";
+  version = "1.0.12";
 
   src = fetchFromGitHub {
     owner = "eunomia-bpf";
     repo = "eunomia-bpf";
     rev = "v${version}";
-    hash = "sha256-UiwS+osyC3gtbQH0bWNsx1p3xYr993/FAZ5d5NKnaBM=";
+    hash = "sha256-EK/SZ9LNAk88JpHJEoxw12NHje6QdCqO/vT2TfkWlb0=";
   };
 
   sourceRoot = "${src.name}/compiler/cmd";
 
-  cargoHash = "sha256-j2HPSmU/JARfw2mE1IiXFT/dcdxxnp+agC2DN0Kc5nw=";
+  cargoHash = "sha256-ymBEzFsMTxKSdJRYoDY3AC0QpgtcMlU0fQV03emCxQc=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/gu/guile-aspell/package.nix b/pkgs/by-name/gu/guile-aspell/package.nix
new file mode 100644
index 000000000000..cf5e51e2540b
--- /dev/null
+++ b/pkgs/by-name/gu/guile-aspell/package.nix
@@ -0,0 +1,46 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, guile
+, autoreconfHook
+, pkg-config
+, aspell
+, texinfo
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "guile-aspell";
+  version = "0.5.0";
+
+  src = fetchFromGitHub {
+    owner = "spk121";
+    repo = "guile-aspell";
+    rev = finalAttrs.version;
+    hash = "sha256-CvLECZLwf4MujAQCL3I81O5xFvq6ezVhV0BjbqI3mR0=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    guile
+    autoreconfHook
+    pkg-config
+    texinfo
+  ];
+
+  buildInputs = [
+    guile
+  ];
+
+  propagatedBuildInputs = [
+    aspell
+  ];
+
+  meta = with lib; {
+    description = "Guile bindings for the aspell library";
+    homepage = "https://github.com/spk121/guile-aspell";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ snowflake ];
+    platforms = guile.meta.platforms;
+  };
+})
diff --git a/pkgs/by-name/ic/icewm/package.nix b/pkgs/by-name/ic/icewm/package.nix
index 4df2536516f3..186810876b32 100644
--- a/pkgs/by-name/ic/icewm/package.nix
+++ b/pkgs/by-name/ic/icewm/package.nix
@@ -41,13 +41,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "icewm";
-  version = "3.4.3";
+  version = "3.4.4";
 
   src = fetchFromGitHub {
     owner = "ice-wm";
     repo = "icewm";
     rev = finalAttrs.version;
-    hash = "sha256-SgSbcWNib2BXyTOBDI1J2TzXhnXoRH0GK3rJvyLID7w=";
+    hash = "sha256-bnoNkBsNJ/6CVmm5I/nwy6LGxYhxPXssjZ3TT7FdEz8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/in/incus-unwrapped/package.nix b/pkgs/by-name/in/incus-unwrapped/package.nix
index 051527357ca6..4c256481bfc3 100644
--- a/pkgs/by-name/in/incus-unwrapped/package.nix
+++ b/pkgs/by-name/in/incus-unwrapped/package.nix
@@ -11,6 +11,7 @@
 , udev
 , installShellFiles
 , nix-update-script
+, nixosTests
 }:
 
 buildGoModule rec {
@@ -79,6 +80,8 @@ buildGoModule rec {
   '';
 
   passthru = {
+    tests.incus = nixosTests.incus;
+
     updateScript = nix-update-script {
        extraArgs = [
         "-vr" "incus-\(.*\)"
diff --git a/pkgs/by-name/in/incus/package.nix b/pkgs/by-name/in/incus/package.nix
index 1eda9cf3ea72..e02876407a7b 100644
--- a/pkgs/by-name/in/incus/package.nix
+++ b/pkgs/by-name/in/incus/package.nix
@@ -24,6 +24,7 @@
 , rsync
 , spice-gtk
 , squashfsTools
+, util-linux
 , virtiofsd
 , xz
 }:
@@ -44,6 +45,7 @@ let
     qemu-utils
     rsync
     squashfsTools
+    util-linux
     virtiofsd
     xz
 
diff --git a/pkgs/by-name/ll/llama-cpp/package.nix b/pkgs/by-name/ll/llama-cpp/package.nix
new file mode 100644
index 000000000000..1c96f5d83a60
--- /dev/null
+++ b/pkgs/by-name/ll/llama-cpp/package.nix
@@ -0,0 +1,130 @@
+{ lib
+, cmake
+, darwin
+, fetchFromGitHub
+, nix-update-script
+, stdenv
+, symlinkJoin
+
+, config
+, cudaSupport ? config.cudaSupport
+, cudaPackages ? { }
+
+, rocmSupport ? false
+, rocmPackages ? { }
+
+, openclSupport ? false
+, clblast
+
+, openblasSupport ? true
+, openblas
+, pkg-config
+}:
+
+let
+  cudatoolkit_joined = symlinkJoin {
+    name = "${cudaPackages.cudatoolkit.name}-merged";
+    paths = [
+      cudaPackages.cudatoolkit.lib
+      cudaPackages.cudatoolkit.out
+    ] ++ lib.optionals (lib.versionOlder cudaPackages.cudatoolkit.version "11") [
+      # for some reason some of the required libs are in the targets/x86_64-linux
+      # directory; not sure why but this works around it
+      "${cudaPackages.cudatoolkit}/targets/${stdenv.system}"
+    ];
+  };
+  metalSupport = stdenv.isDarwin && stdenv.isAarch64;
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "llama-cpp";
+  version = "1469";
+
+  src = fetchFromGitHub {
+    owner = "ggerganov";
+    repo = "llama.cpp";
+    rev = "refs/tags/b${finalAttrs.version}";
+    hash = "sha256-budBvpX2SnKekGTWHomvhW+4grB8EPd9OJbufNynHsc=";
+  };
+
+  postPatch = ''
+    substituteInPlace ./ggml-metal.m \
+      --replace '[bundle pathForResource:@"ggml-metal" ofType:@"metal"];' "@\"$out/bin/ggml-metal.metal\";"
+  '';
+
+  nativeBuildInputs = [ cmake ] ++ lib.optionals openblasSupport [ pkg-config ];
+
+  buildInputs = lib.optionals metalSupport
+    (with darwin.apple_sdk.frameworks; [
+      Accelerate
+      CoreGraphics
+      CoreVideo
+      Foundation
+      MetalKit
+    ])
+  ++ lib.optionals cudaSupport [
+    cudatoolkit_joined
+  ] ++ lib.optionals rocmSupport [
+    rocmPackages.clr
+    rocmPackages.hipblas
+    rocmPackages.rocblas
+  ] ++ lib.optionals openclSupport [
+    clblast
+  ] ++ lib.optionals openblasSupport [
+    openblas
+  ];
+
+  cmakeFlags = [
+    "-DLLAMA_NATIVE=OFF"
+    "-DLLAMA_BUILD_SERVER=ON"
+  ]
+  ++ lib.optionals metalSupport [
+    "-DCMAKE_C_FLAGS=-D__ARM_FEATURE_DOTPROD=1"
+    "-DLLAMA_METAL=ON"
+  ]
+  ++ lib.optionals cudaSupport [
+    "-DLLAMA_CUBLAS=ON"
+  ]
+  ++ lib.optionals rocmSupport [
+    "-DLLAMA_HIPBLAS=1"
+    "-DCMAKE_C_COMPILER=hipcc"
+    "-DCMAKE_CXX_COMPILER=hipcc"
+    "-DCMAKE_POSITION_INDEPENDENT_CODE=ON"
+  ]
+  ++ lib.optionals openclSupport [
+    "-DLLAMA_CLBLAST=ON"
+  ]
+  ++ lib.optionals openblasSupport [
+    "-DLLAMA_BLAS=ON"
+    "-DLLAMA_BLAS_VENDOR=OpenBLAS"
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+
+    for f in bin/*; do
+      test -x "$f" || continue
+      cp "$f" $out/bin/llama-cpp-"$(basename "$f")"
+    done
+
+    ${lib.optionalString metalSupport "cp ./bin/ggml-metal.metal $out/bin/ggml-metal.metal"}
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = nix-update-script {
+    attrPath = "llama-cpp";
+    extraArgs = [ "--version-regex" "b(.*)" ];
+  };
+
+  meta = with lib; {
+    description = "Port of Facebook's LLaMA model in C/C++";
+    homepage = "https://github.com/ggerganov/llama.cpp/";
+    license = licenses.mit;
+    mainProgram = "llama-cpp-main";
+    maintainers = with maintainers; [ dit7ya elohmeier ];
+    broken = stdenv.isDarwin && stdenv.isx86_64;
+    platforms = platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/or/orchard/package.nix b/pkgs/by-name/or/orchard/package.nix
index a0aa38665352..04443e2f1698 100644
--- a/pkgs/by-name/or/orchard/package.nix
+++ b/pkgs/by-name/or/orchard/package.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "orchard";
-  version = "0.14.1";
+  version = "0.14.3";
 
   src = fetchFromGitHub {
     owner = "cirruslabs";
     repo = pname;
     rev = version;
-    hash = "sha256-u4aGjEkQ9H7caW2Y5ZbiGhCV47I0Afi5NC/apJB5qvU=";
+    hash = "sha256-hQP48druIwkVVKeC1TKq+DEGOJOmkendc3Ij9ft+uDQ=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -19,7 +19,7 @@ buildGoModule rec {
     '';
   };
 
-  vendorHash = "sha256-BrzS+QtpGUHcYNNmSI6FlBtcYwNFri7R6nlVvFihdb4=";
+  vendorHash = "sha256-opPxsCukXcLcrf/sD9AW1iIYOK5BmTLnc/QGUvzVLwg=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/ra/raft-cowsql/package.nix b/pkgs/by-name/ra/raft-cowsql/package.nix
index 821abd91727c..a377f966241d 100644
--- a/pkgs/by-name/ra/raft-cowsql/package.nix
+++ b/pkgs/by-name/ra/raft-cowsql/package.nix
@@ -41,9 +41,12 @@ stdenv.mkDerivation rec {
 
   outputs = [ "dev" "out" ];
 
-  passthru.tests = {
-    inherit incus;
-    updateScript = gitUpdater { };
+  passthru = {
+    inherit (incus) tests;
+
+    updateScript = gitUpdater {
+      rev-prefix = "v";
+    };
   };
 
   meta = with lib; {
diff --git a/pkgs/by-name/tk/tkdiff/194.patch b/pkgs/by-name/tk/tkdiff/194.patch
new file mode 100644
index 000000000000..0fc50db3028b
--- /dev/null
+++ b/pkgs/by-name/tk/tkdiff/194.patch
@@ -0,0 +1,15 @@
+Index: tkdiff
+===================================================================
+diff --git a/tkdiff b/tkdiff
+--- a/tkdiff	(revision 193)
++++ b/tkdiff	(revision 194)
+@@ -4557,7 +4557,8 @@
+                 }
+             }
+         }
+-    }
++        # But KICK scroll to *LOOK* for Ratcliff (when ON); otherwise is a NOOP
++    } { $w(acTxWdg) SEE @1,1 }
+ }
+ 
+ ###############################################################################
diff --git a/pkgs/by-name/tk/tkdiff/package.nix b/pkgs/by-name/tk/tkdiff/package.nix
index 478ee4e29ff9..329b7144202e 100644
--- a/pkgs/by-name/tk/tkdiff/package.nix
+++ b/pkgs/by-name/tk/tkdiff/package.nix
@@ -9,9 +9,16 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-EpbIdjsejkkTaSpoZRM5AHz0r1Cio+YzRryK0BoghBk=";
   };
 
-  # fix regression: allow /dev/null again. eg: "tkdiff /dev/null file"
-  # svn diff --git -r188:189 https://svn.code.sf.net/p/tkdiff/code/trunk
-  patches = [ ./189.patch ];
+  patches = [
+    # fix regression: allow /dev/null again. eg: "tkdiff /dev/null file"
+    # svn diff --git -r188:189 https://svn.code.sf.net/p/tkdiff/code/trunk
+    ./189.patch
+
+    # fix regression: trigger redraw when inline recursive diff requested
+    # svn diff --git -r193:194 https://svn.code.sf.net/p/tkdiff/code/trunk | \
+    #   sed -e '/^@@ -4545,7/,14d' -e '/^@@ -18063,7/,$d'
+    ./194.patch
+  ];
 
   nativeBuildInputs = [ makeBinaryWrapper ];
 
diff --git a/pkgs/by-name/tu/tusc-sh/package.nix b/pkgs/by-name/tu/tusc-sh/package.nix
index 387b68f85222..f5b1ce36e152 100644
--- a/pkgs/by-name/tu/tusc-sh/package.nix
+++ b/pkgs/by-name/tu/tusc-sh/package.nix
@@ -10,13 +10,13 @@
 let
   tusc = stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "tusc-sh";
-  version = "1.1.0";
+  version = "1.1.1";
 
   src = fetchFromGitHub {
     owner = "adhocore";
     repo = "tusc.sh";
     rev = finalAttrs.version;
-    hash = "sha256-9bTv6ih9N3nPtY5fioZvUCSvCHHB0+yVpxA++z8uGWY=";
+    hash = "sha256-EKlcE+rsVh5lUd8dQzAwXDjiUvrrud5yWfF6JWSZQFE=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/by-name/un/unsilence/package.nix b/pkgs/by-name/un/unsilence/package.nix
new file mode 100644
index 000000000000..a8c9ef1d9c95
--- /dev/null
+++ b/pkgs/by-name/un/unsilence/package.nix
@@ -0,0 +1,43 @@
+{ lib
+, fetchFromGitHub
+, python3Packages
+, ffmpeg
+,
+}:
+python3Packages.buildPythonPackage rec {
+  pname = "unsilence";
+  version = "1.0.9";
+
+  src = fetchFromGitHub {
+    owner = "lagmoellertim";
+    repo = "unsilence";
+    rev = version;
+    sha256 = "sha256-M4Ek1JZwtr7vIg14aTa8h4otIZnPQfKNH4pZE4GpiBQ=";
+  };
+
+  nativeBuildInputs = with python3Packages; [
+    rich
+    pythonRelaxDepsHook
+  ];
+
+  propagatedBuildInputs = [
+    python3Packages.rich
+    python3Packages.setuptools # imports pkg_resources.parse_version
+  ];
+
+  makeWrapperArgs = [
+    "--suffix PATH : ${lib.makeBinPath [ ffmpeg ]}"
+  ];
+
+  doCheck = false;
+  pythonImportsCheck = [ "unsilence" ];
+
+  pythonRelaxDeps = [ "rich" ];
+
+  meta = with lib; {
+    homepage = "https://github.com/lagmoellertim/unsilence";
+    description = "Console Interface and Library to remove silent parts of a media file";
+    license = licenses.mit;
+    maintainers = with maintainers; [ esau79p ];
+  };
+}
diff --git a/pkgs/by-name/ve/vesktop/package.nix b/pkgs/by-name/ve/vesktop/package.nix
index 67f022e0e10b..0992f6612e98 100644
--- a/pkgs/by-name/ve/vesktop/package.nix
+++ b/pkgs/by-name/ve/vesktop/package.nix
@@ -18,13 +18,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "vesktop";
-  version = "0.4.2";
+  version = "0.4.3";
 
   src = fetchFromGitHub {
     owner = "Vencord";
     repo = "Vesktop";
     rev = "v${version}";
-    hash = "sha256-elgoX8z8q0+7uUia9gbcCmpDg+qYRWWUxdRuNV53Puw=";
+    hash = "sha256-wGOyDGY0FpAVS5+MTiKrOpDyd13ng0RLGAENW5tXuR4=";
   };
 
   pnpm-deps = stdenvNoCC.mkDerivation {
@@ -54,8 +54,8 @@ stdenv.mkDerivation rec {
     dontFixup = true;
     outputHashMode = "recursive";
     outputHash = {
-      "aarch64-linux" = "sha256-Fkfq8vBfNXdndVb17aZOTvIOAyiccDzyuFvg6kDy7QI=";
-      "x86_64-linux" = "sha256-KDJ8QmpwGb2lOdwWEl5y62pJiqEvpI59StfQZrN1PPE=";
+      "aarch64-linux" = "sha256-OcAQbUi+wpBAumncYxP3qtTzjyxiHL69kbQefwaeBfg=";
+      "x86_64-linux" = "sha256-R5/2MSH/jXHrj2x1Ap2OoOFLBLQp3Sq91o01uW8hWOw=";
     }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
   };
 
@@ -141,7 +141,7 @@ stdenv.mkDerivation rec {
     description = "An alternate client for Discord with Vencord built-in";
     homepage = "https://github.com/Vencord/Vesktop";
     license = licenses.gpl3Only;
-    maintainers = with maintainers; [ getchoo Scrumplex vgskye ];
+    maintainers = with maintainers; [ getchoo Scrumplex vgskye pluiedev ];
     platforms = [ "x86_64-linux" "aarch64-linux" ];
     mainProgram = "vencorddesktop";
   };
diff --git a/pkgs/data/fonts/noto-fonts/default.nix b/pkgs/data/fonts/noto-fonts/default.nix
index f0a22fde9264..86565615534c 100644
--- a/pkgs/data/fonts/noto-fonts/default.nix
+++ b/pkgs/data/fonts/noto-fonts/default.nix
@@ -35,13 +35,13 @@ rec {
     }:
     stdenvNoCC.mkDerivation rec {
       inherit pname;
-      version = "23.8.1";
+      version = "23.11.1";
 
       src = fetchFromGitHub {
         owner = "notofonts";
         repo = "notofonts.github.io";
         rev = "noto-monthly-release-${version}";
-        hash = "sha256-TYCJzioZcNFV8N5wLr7Fo69g/p5GQF/tbGgYoLUV7Us=";
+        hash = "sha256-qBHLCOfVBOn9CV194S4cYw9nhHyAe2AUBJHQMvyEfW8=";
       };
 
       _variants = map (variant: builtins.replaceStrings [ " " ] [ "" ] variant) variants;
diff --git a/pkgs/data/themes/marwaita-peppermint/default.nix b/pkgs/data/themes/marwaita-peppermint/default.nix
index 6873cd31f8dd..16a60de9287e 100644
--- a/pkgs/data/themes/marwaita-peppermint/default.nix
+++ b/pkgs/data/themes/marwaita-peppermint/default.nix
@@ -5,17 +5,18 @@
 , gtk-engine-murrine
 , gtk_engines
 , librsvg
+, gitUpdater
 }:
 
 stdenv.mkDerivation rec {
   pname = "marwaita-peppermint";
-  version = "10.3";
+  version = "17.0";
 
   src = fetchFromGitHub {
     owner = "darkomarko42";
     repo = pname;
-    rev = version;
-    sha256 = "09lqp82aymj3silpwmjkkf4mgv3b1xw7181ck89lz2nxb98sr9im";
+    rev = "247f9c539d6eef8ae3a5f59beed42a40b1f10434";
+    hash = "sha256-uT7KnpIdxypUqKhXOao3Bz3vJecJKK+GjcAp9biNyHc=";
   };
 
   buildInputs = [
@@ -37,6 +38,8 @@ stdenv.mkDerivation rec {
     runHook postInstall
   '';
 
+  passthru.updateScript = gitUpdater { };
+
   meta = with lib; {
     description = "Marwaita GTK theme with Peppermint Os Linux style";
     homepage = "https://www.pling.com/p/1399569/";
diff --git a/pkgs/development/compilers/chicken/5/overrides.nix b/pkgs/development/compilers/chicken/5/overrides.nix
index 89737e94f489..a5fd3f94830b 100644
--- a/pkgs/development/compilers/chicken/5/overrides.nix
+++ b/pkgs/development/compilers/chicken/5/overrides.nix
@@ -68,7 +68,10 @@ in
   scheme2c-compatibility = old:
     addToNativeBuildInputs (lib.optionals (stdenv.system == "x86_64-darwin") [ pkgs.memorymappingHook ])
       (addPkgConfig old);
-  sdl-base = addToBuildInputs pkgs.SDL;
+  sdl-base = old:
+    ((addToPropagatedBuildInputsWithPkgConfig pkgs.SDL old) //
+      # needed for sdl-config to be in PATH
+      (addToNativeBuildInputs pkgs.SDL old));
   sdl2 = old:
     ((addToPropagatedBuildInputsWithPkgConfig pkgs.SDL2 old) //
       # needed for sdl2-config to be in PATH
@@ -89,7 +92,10 @@ in
   stfl = old:
     (addToBuildInputs [ pkgs.ncurses pkgs.stfl ] old)
     // (addToCscOptions "-L -lncurses" old);
-  taglib = addToBuildInputs [ pkgs.zlib pkgs.taglib ];
+  taglib = old:
+    (addToBuildInputs [ pkgs.zlib pkgs.taglib ] old) // (
+      # needed for tablib-config to be in PATH
+      addToNativeBuildInputs pkgs.taglib old);
   uuid-lib = addToBuildInputs pkgs.libuuid;
   ws-client = addToBuildInputs pkgs.zlib;
   xlib = addToPropagatedBuildInputs pkgs.xorg.libX11;
diff --git a/pkgs/development/libraries/simpleitk/default.nix b/pkgs/development/libraries/simpleitk/default.nix
index 8ef0e5e39a55..10e055d5acde 100644
--- a/pkgs/development/libraries/simpleitk/default.nix
+++ b/pkgs/development/libraries/simpleitk/default.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "simpleitk";
-  version = "2.3.0";
+  version = "2.3.1";
 
   src = fetchFromGitHub {
     owner = "SimpleITK";
     repo = "SimpleITK";
     rev = "refs/tags/v${finalAttrs.version}";
-    hash = "sha256-SJSFJEFu1qKowX5/98MslN7GFDS8aF5+EKkQ2983Azg=";
+    hash = "sha256-JmZUlIdcCQ9yEqxoUwRaxvr/Q7xZm41QA3mtDtoSdyI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/php-packages/datadog_trace/Cargo.lock b/pkgs/development/php-packages/datadog_trace/Cargo.lock
index 7eb8515e4049..b2633f3a06c1 100644
--- a/pkgs/development/php-packages/datadog_trace/Cargo.lock
+++ b/pkgs/development/php-packages/datadog_trace/Cargo.lock
@@ -42,9 +42,9 @@ dependencies = [
 
 [[package]]
 name = "aho-corasick"
-version = "1.0.5"
+version = "1.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c378d78423fdad8089616f827526ee33c19f2fddbd5de1629152c9593ba4783"
+checksum = "b2969dcb958b36655471fc61f7e416fa76033bdd4bfed0678d8fee1e2d07a1f0"
 dependencies = [
  "memchr",
 ]
@@ -67,7 +67,7 @@ version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "819e7219dbd41043ac279b19830f2efc897156490d7fd6ea916720117ee66311"
 dependencies = [
- "libc 0.2.147",
+ "libc 0.2.149",
 ]
 
 [[package]]
@@ -78,9 +78,9 @@ checksum = "4b46cbb362ab8752921c97e041f5e366ee6297bd428a31275b9fcf1e380f7299"
 
 [[package]]
 name = "anstyle"
-version = "1.0.2"
+version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "15c4c2c83f81532e5845a733998b6971faca23490340a418e9b72a3ec9de12ea"
+checksum = "7079075b41f533b8c61d2a4d073c4676e1f8b249ff94a393b0595db304e0dd87"
 
 [[package]]
 name = "anyhow"
@@ -108,7 +108,7 @@ checksum = "bc00ceb34980c03614e35a3a4e218276a0a824e911d07651cd0d858a51e8c0f0"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.31",
+ "syn 2.0.38",
 ]
 
 [[package]]
@@ -118,7 +118,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d9b39be18770d11421cdb1b9947a45dd3f37e93092cbf377614828a319d5fee8"
 dependencies = [
  "hermit-abi 0.1.19",
- "libc 0.2.147",
+ "libc 0.2.149",
  "winapi",
 ]
 
@@ -182,7 +182,7 @@ dependencies = [
  "addr2line",
  "cc",
  "cfg-if",
- "libc 0.2.147",
+ "libc 0.2.149",
  "miniz_oxide",
  "object 0.32.1",
  "rustc-demangle",
@@ -196,9 +196,9 @@ checksum = "9e1b586273c5702936fe7b7d6896644d8be71e6314cfe09d3167c95f712589e8"
 
 [[package]]
 name = "base64"
-version = "0.21.3"
+version = "0.21.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "414dcefbc63d77c526a76b3afcf6fbb9b5e2791c19c3aa2297733208750c6e53"
+checksum = "9ba43ea6f343b788c8764558649e08df62f86c6ef251fdaeb1ffd010a9ae50a2"
 
 [[package]]
 name = "basic-toml"
@@ -231,13 +231,13 @@ dependencies = [
  "lazycell",
  "log",
  "peeking_take_while",
- "prettyplease 0.2.14",
+ "prettyplease 0.2.15",
  "proc-macro2",
  "quote",
  "regex",
  "rustc-hash",
  "shlex",
- "syn 2.0.31",
+ "syn 2.0.38",
  "which",
 ]
 
@@ -267,21 +267,21 @@ checksum = "703642b98a00b3b90513279a8ede3fcfa479c126c5fb46e78f3051522f021403"
 
 [[package]]
 name = "bumpalo"
-version = "3.13.0"
+version = "3.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a3e2c3daef883ecc1b5d58c15adae93470a91d425f3532ba1695849656af3fc1"
+checksum = "7f30e7476521f6f8af1a1c4c0b8cc94f0bee37d91763d0ca2665f299b6cd8aec"
 
 [[package]]
 name = "byteorder"
-version = "1.4.3"
+version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "14c189c53d098945499cdfa7ecc63567cf3886b3332b312a5b4585d8d3a6a610"
+checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
 
 [[package]]
 name = "bytes"
-version = "1.4.0"
+version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "89b2fd2a0dcf38d7971e2194b6b6eebab45ae01067456a7fd93d5547a61b70be"
+checksum = "a2bd12c1caf447e69cd4528f47f94d203fd2582878ecb9e9465484c4148a8223"
 dependencies = [
  "serde",
 ]
@@ -317,7 +317,7 @@ version = "1.0.83"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f1174fb0b6ec23863f8b971027804a42614e347eafb0a95bf0b12cdae21fc4d0"
 dependencies = [
- "libc 0.2.147",
+ "libc 0.2.149",
 ]
 
 [[package]]
@@ -345,9 +345,9 @@ checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
 
 [[package]]
 name = "chrono"
-version = "0.4.29"
+version = "0.4.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d87d9d13be47a5b7c3907137f1290b0459a7f80efb26be8c52afb11963bccb02"
+checksum = "7f2c685bad3eb3d45a01354cedb7d5faa66194d1d58ba6e267a8de788f79db38"
 dependencies = [
  "android-tzdata",
  "iana-time-zone",
@@ -389,7 +389,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c688fc74432808e3eb684cae8830a86be1d66a2bd58e1f248ed0960a590baf6f"
 dependencies = [
  "glob",
- "libc 0.2.147",
+ "libc 0.2.149",
  "libloading",
 ]
 
@@ -410,18 +410,18 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "4.4.2"
+version = "4.4.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6a13b88d2c62ff462f88e4a121f17a82c1af05693a2f192b5c38d14de73c19f6"
+checksum = "d04704f56c2cde07f43e8e2c154b43f216dc5c92fc98ada720177362f953b956"
 dependencies = [
  "clap_builder",
 ]
 
 [[package]]
 name = "clap_builder"
-version = "4.4.2"
+version = "4.4.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2bb9faaa7c2ef94b2743a21f5a29e6f0010dff4caa69ac8e9d6cf8b6fa74da08"
+checksum = "0e231faeaca65ebd1ea3c737966bf858971cd38c3849107aa3ea7de90a804e45"
 dependencies = [
  "anstyle",
  "clap_lex 0.5.1",
@@ -501,7 +501,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "194a7a9e6de53fa55116934067c844d9d749312f75c6f6d0980e8c252f8c2146"
 dependencies = [
  "core-foundation-sys",
- "libc 0.2.147",
+ "libc 0.2.149",
 ]
 
 [[package]]
@@ -516,7 +516,7 @@ version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e9e393a7668fe1fad3075085b86c781883000b4ede868f43627b34a87c8b7ded"
 dependencies = [
- "libc 0.2.147",
+ "libc 0.2.149",
  "winapi",
 ]
 
@@ -538,7 +538,7 @@ dependencies = [
  "anes",
  "cast",
  "ciborium",
- "clap 4.4.2",
+ "clap 4.4.6",
  "criterion-plot",
  "is-terminal",
  "itertools",
@@ -620,9 +620,9 @@ dependencies = [
 
 [[package]]
 name = "csv"
-version = "1.2.2"
+version = "1.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "626ae34994d3d8d668f4269922248239db4ae42d538b14c398b74a52208e8086"
+checksum = "ac574ff4d437a7b5ad237ef331c17ccca63c46479e5b5453eb8e10bb99a759fe"
 dependencies = [
  "csv-core",
  "itoa",
@@ -632,9 +632,9 @@ dependencies = [
 
 [[package]]
 name = "csv-core"
-version = "0.1.10"
+version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b2466559f260f48ad25fe6317b3c8dac77b5bdb5763ac7d9d6103530663bc90"
+checksum = "5efa2b3d7902f4b634a20cae3c9c4e6209dc4779feb6863329607560143efa70"
 dependencies = [
  "memchr",
 ]
@@ -650,7 +650,7 @@ dependencies = [
  "futures",
  "glibc_version",
  "io-lifetimes",
- "libc 0.2.147",
+ "libc 0.2.149",
  "memfd",
  "nix 0.26.4",
  "page_size",
@@ -673,12 +673,12 @@ name = "datadog-ipc-macros"
 version = "0.0.1"
 dependencies = [
  "quote",
- "syn 2.0.31",
+ "syn 2.0.38",
 ]
 
 [[package]]
 name = "datadog-php-profiling"
-version = "0.92.2"
+version = "0.93.1"
 dependencies = [
  "ahash 0.8.3",
  "anyhow",
@@ -691,11 +691,11 @@ dependencies = [
  "criterion-perf-events",
  "crossbeam-channel",
  "datadog-profiling",
- "ddcommon 4.0.0",
+ "ddcommon 5.0.0",
  "env_logger",
- "indexmap 2.0.0",
+ "indexmap 2.0.2",
  "lazy_static",
- "libc 0.2.147",
+ "libc 0.2.149",
  "log",
  "once_cell",
  "ouroboros",
@@ -707,14 +707,14 @@ dependencies = [
 
 [[package]]
 name = "datadog-profiling"
-version = "4.0.0"
-source = "git+https://github.com/DataDog/libdatadog?tag=v4.0.0#a07180585a39b0e0baeb858d20efb8d7b57f17c4"
+version = "5.0.0"
+source = "git+https://github.com/DataDog/libdatadog?tag=v5.0.0#7b8a01ecfaf03e063feb16896356e71b9a2fc6f3"
 dependencies = [
  "anyhow",
  "bitmaps",
  "bytes",
  "chrono",
- "ddcommon 4.0.0",
+ "ddcommon 5.0.0",
  "derivative",
  "futures",
  "futures-core",
@@ -724,7 +724,7 @@ dependencies = [
  "hyper",
  "hyper-multipart-rfc7578",
  "indexmap 1.9.3",
- "libc 0.2.147",
+ "libc 0.2.149",
  "lz4_flex",
  "mime",
  "mime_guess",
@@ -734,7 +734,7 @@ dependencies = [
  "serde",
  "serde_json",
  "tokio",
- "tokio-util 0.7.8",
+ "tokio-util 0.7.9",
 ]
 
 [[package]]
@@ -758,7 +758,7 @@ dependencies = [
  "hyper",
  "io-lifetimes",
  "lazy_static",
- "libc 0.2.147",
+ "libc 0.2.149",
  "manual_future",
  "nix 0.26.4",
  "pin-project",
@@ -773,7 +773,7 @@ dependencies = [
  "sys-info",
  "tempfile",
  "tokio",
- "tokio-util 0.7.8",
+ "tokio-util 0.7.9",
  "tracing",
  "tracing-subscriber",
  "uuid",
@@ -792,7 +792,7 @@ dependencies = [
  "ddtelemetry",
  "ddtelemetry-ffi",
  "hyper",
- "libc 0.2.147",
+ "libc 0.2.149",
  "paste",
  "tempfile",
 ]
@@ -802,7 +802,7 @@ name = "datadog-sidecar-macros"
 version = "0.0.1"
 dependencies = [
  "quote",
- "syn 2.0.31",
+ "syn 2.0.38",
 ]
 
 [[package]]
@@ -873,8 +873,8 @@ dependencies = [
 
 [[package]]
 name = "ddcommon"
-version = "4.0.0"
-source = "git+https://github.com/DataDog/libdatadog?tag=v4.0.0#a07180585a39b0e0baeb858d20efb8d7b57f17c4"
+version = "5.0.0"
+source = "git+https://github.com/DataDog/libdatadog?tag=v5.0.0#7b8a01ecfaf03e063feb16896356e71b9a2fc6f3"
 dependencies = [
  "anyhow",
  "futures",
@@ -922,7 +922,7 @@ dependencies = [
  "serde_json",
  "sys-info",
  "tokio",
- "tokio-util 0.7.8",
+ "tokio-util 0.7.9",
  "tracing",
  "tracing-subscriber",
  "uuid",
@@ -935,7 +935,7 @@ dependencies = [
  "ddcommon 0.0.1",
  "ddcommon-ffi",
  "ddtelemetry",
- "libc 0.2.147",
+ "libc 0.2.149",
  "paste",
  "tempfile",
 ]
@@ -991,9 +991,9 @@ dependencies = [
 
 [[package]]
 name = "educe"
-version = "0.4.22"
+version = "0.4.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "079044df30bb07de7d846d41a184c4b00e66ebdac93ee459253474f3a47e50ae"
+checksum = "0f0042ff8246a363dbe77d2ceedb073339e85a804b9a47636c6e016a9a32c05f"
 dependencies = [
  "enum-ordinalize",
  "proc-macro2",
@@ -1009,15 +1009,15 @@ checksum = "a26ae43d7bcc3b814de94796a5e736d4029efb0ee900c12e2d54c993ad1a1e07"
 
 [[package]]
 name = "enum-ordinalize"
-version = "3.1.13"
+version = "3.1.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e4f76552f53cefc9a7f64987c3701b99d982f7690606fd67de1d09712fbf52f1"
+checksum = "1bf1fa3f06bbff1ea5b1a9c7b14aa992a39657db60a2759457328d7e058f49ee"
 dependencies = [
  "num-bigint",
  "num-traits",
  "proc-macro2",
  "quote",
- "syn 2.0.31",
+ "syn 2.0.38",
 ]
 
 [[package]]
@@ -1041,30 +1041,19 @@ checksum = "5443807d6dff69373d433ab9ef5378ad8df50ca6298caf15de6e52e24aaf54d5"
 
 [[package]]
 name = "errno"
-version = "0.3.3"
+version = "0.3.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "136526188508e25c6fef639d7927dfb3e0e3084488bf202267829cf7fc23dbdd"
+checksum = "ac3e13f66a2f95e32a39eaa81f6b95d42878ca0e1db0c7543723dfe12557e860"
 dependencies = [
- "errno-dragonfly",
- "libc 0.2.147",
+ "libc 0.2.149",
  "windows-sys",
 ]
 
 [[package]]
-name = "errno-dragonfly"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aa68f1b12764fab894d2755d2518754e71b4fd80ecfb822714a1206c2aab39bf"
-dependencies = [
- "cc",
- "libc 0.2.147",
-]
-
-[[package]]
 name = "fastrand"
-version = "2.0.0"
+version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6999dc1837253364c2ebb0704ba97994bd874e8f195d665c50b7548f6ea92764"
+checksum = "25cbce373ec4653f1a01a31e8a5e5ec0c622dc27ff9c4e6606eefef5cbbed4a5"
 
 [[package]]
 name = "fixedbitset"
@@ -1150,7 +1139,7 @@ checksum = "89ca545a94061b6365f2c7355b4b32bd20df3ff95f02da9329b34ccc3bd6ee72"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.31",
+ "syn 2.0.38",
 ]
 
 [[package]]
@@ -1207,7 +1196,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "be4136b2a15dd319360be1c07d9933517ccf0be8f16bf62a3bee4f0d618df427"
 dependencies = [
  "cfg-if",
- "libc 0.2.147",
+ "libc 0.2.149",
  "wasi",
 ]
 
@@ -1247,7 +1236,7 @@ dependencies = [
  "indexmap 1.9.3",
  "slab",
  "tokio",
- "tokio-util 0.7.8",
+ "tokio-util 0.7.9",
  "tracing",
 ]
 
@@ -1268,9 +1257,9 @@ dependencies = [
 
 [[package]]
 name = "hashbrown"
-version = "0.14.0"
+version = "0.14.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c6201b9ff9fd90a5a3bac2e56a830d0caa509576f0e503818ee82c181b3437a"
+checksum = "7dfda62a12f55daeae5015f81b0baea145391cb4520f86c248fc615d72640d12"
 
 [[package]]
 name = "hdrhistogram"
@@ -1297,14 +1286,14 @@ version = "0.1.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "62b467343b94ba476dcb2500d242dadbb39557df889310ac77c5d99100aaac33"
 dependencies = [
- "libc 0.2.147",
+ "libc 0.2.149",
 ]
 
 [[package]]
 name = "hermit-abi"
-version = "0.3.2"
+version = "0.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "443144c8cdadd93ebf52ddb4056d257f5b52c04d3c804e657d19eb73fc33668b"
+checksum = "d77f7ec81a6d05a3abb01ab6eb7590f6083d08449fe5a1c8b1e620283546ccb7"
 
 [[package]]
 name = "hex"
@@ -1459,12 +1448,12 @@ dependencies = [
 
 [[package]]
 name = "indexmap"
-version = "2.0.0"
+version = "2.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d5477fe2230a79769d8dc68e0eabf5437907c0457a5614a9e8dddb67f65eb65d"
+checksum = "8adf3ddd720272c6ea8bf59463c04e0f93d0bbf7c5439b691bca2987e0270897"
 dependencies = [
  "equivalent",
- "hashbrown 0.14.0",
+ "hashbrown 0.14.1",
 ]
 
 [[package]]
@@ -1479,8 +1468,8 @@ version = "1.0.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "eae7b9aee968036d54dce06cebaefd919e4472e753296daccd6d344e3e2df0c2"
 dependencies = [
- "hermit-abi 0.3.2",
- "libc 0.2.147",
+ "hermit-abi 0.3.3",
+ "libc 0.2.149",
  "windows-sys",
 ]
 
@@ -1490,8 +1479,8 @@ version = "0.4.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cb0889898416213fab133e1d33a0e5858a48177452750691bde3666d0fdbaf8b"
 dependencies = [
- "hermit-abi 0.3.2",
- "rustix 0.38.11",
+ "hermit-abi 0.3.3",
+ "rustix",
  "windows-sys",
 ]
 
@@ -1545,9 +1534,9 @@ checksum = "e32a70cf75e5846d53a673923498228bbec6a8624708a9ea5645f075d6276122"
 
 [[package]]
 name = "libc"
-version = "0.2.147"
+version = "0.2.149"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4668fb0ea861c1df094127ac5f1da3409a82116a4ba74fca2e58ef927159bb3"
+checksum = "a08173bc88b7955d1b3145aa561539096c421ac8debde8cbc3612ec635fee29b"
 
 [[package]]
 name = "libloading"
@@ -1561,21 +1550,15 @@ dependencies = [
 
 [[package]]
 name = "libm"
-version = "0.2.7"
+version = "0.2.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f7012b1bbb0719e1097c47611d3898568c546d597c2e74d66f6087edd5233ff4"
+checksum = "4ec2a862134d2a7d32d7983ddcdd1c4923530833c9f2ea1a44fc5fa473989058"
 
 [[package]]
 name = "linux-raw-sys"
-version = "0.3.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ef53942eb7bf7ff43a617b3e2c1c4a5ecf5944a7c1bc12d7ee39bbb15e5c1519"
-
-[[package]]
-name = "linux-raw-sys"
-version = "0.4.5"
+version = "0.4.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "57bcfdad1b858c2db7c38303a6d2ad4dfaf5eb53dfeb0910128b2c26d6158503"
+checksum = "da2479e8c062e40bf0066ffa0bc823de0a9368974af99c9f6df941d2c231e03f"
 
 [[package]]
 name = "lock_api"
@@ -1628,23 +1611,23 @@ dependencies = [
 
 [[package]]
 name = "matchit"
-version = "0.7.2"
+version = "0.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed1202b2a6f884ae56f04cff409ab315c5ce26b5e58d7412e484f01fd52f52ef"
+checksum = "0e7465ac9959cc2b1404e8e2367b43684a6d13790fe23056cc8c6c5a6b7bcb94"
 
 [[package]]
 name = "memchr"
-version = "2.6.3"
+version = "2.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f232d6ef707e1956a43342693d2a31e72989554d58299d7a88738cc95b0d35c"
+checksum = "f665ee40bc4a3c5590afb1e9677db74a508659dfd71e126420da8274909a0167"
 
 [[package]]
 name = "memfd"
-version = "0.6.3"
+version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ffc89ccdc6e10d6907450f753537ebc5c5d3460d2e4e62ea74bd571db62c0f9e"
+checksum = "b2cffa4ad52c6f791f4f8b15f0c05f9824b2ced1160e88cc393d64fff9a8ac64"
 dependencies = [
- "rustix 0.37.23",
+ "rustix",
 ]
 
 [[package]]
@@ -1711,7 +1694,7 @@ version = "0.8.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "927a765cd3fc26206e66b296465fa9d3e5ab003e651c1b3c060e7956d96b19d2"
 dependencies = [
- "libc 0.2.147",
+ "libc 0.2.149",
  "wasi",
  "windows-sys",
 ]
@@ -1740,7 +1723,7 @@ checksum = "fa52e972a9a719cecb6864fb88568781eb706bac2cd1d4f04a648542dbf78069"
 dependencies = [
  "bitflags 1.3.2",
  "cfg-if",
- "libc 0.2.147",
+ "libc 0.2.149",
  "memoffset 0.6.5",
 ]
 
@@ -1752,7 +1735,7 @@ checksum = "598beaf3cc6fdd9a5dfb1630c2800c7acd31df7aaf0f565796fba2b53ca1af1b"
 dependencies = [
  "bitflags 1.3.2",
  "cfg-if",
- "libc 0.2.147",
+ "libc 0.2.149",
  "memoffset 0.7.1",
  "pin-utils",
 ]
@@ -1765,7 +1748,7 @@ checksum = "2eb04e9c688eff1c89d72b407f168cf79bb9e867a9d3323ed6c01519eb9cc053"
 dependencies = [
  "bitflags 2.4.0",
  "cfg-if",
- "libc 0.2.147",
+ "libc 0.2.149",
 ]
 
 [[package]]
@@ -1821,9 +1804,9 @@ dependencies = [
 
 [[package]]
 name = "num-traits"
-version = "0.2.16"
+version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f30b0abd723be7e2ffca1272140fac1a2f084c77ec3e123c192b66af1ee9e6c2"
+checksum = "39e3200413f237f41ab11ad6d161bc7239c84dcb631773ccd7de3dfe4b5c267c"
 dependencies = [
  "autocfg",
  "libm",
@@ -1835,8 +1818,8 @@ version = "1.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4161fcb6d602d4d2081af7c3a45852d875a03dd337a6bfdd6e06407b61342a43"
 dependencies = [
- "hermit-abi 0.3.2",
- "libc 0.2.147",
+ "hermit-abi 0.3.3",
+ "libc 0.2.149",
 ]
 
 [[package]]
@@ -1958,7 +1941,7 @@ dependencies = [
  "proc-macro-error",
  "proc-macro2",
  "quote",
- "syn 2.0.31",
+ "syn 2.0.38",
 ]
 
 [[package]]
@@ -1973,7 +1956,7 @@ version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1b7663cbd190cfd818d08efa8497f6cd383076688c49a391ef7c0d03cd12b561"
 dependencies = [
- "libc 0.2.147",
+ "libc 0.2.149",
  "winapi",
 ]
 
@@ -1994,7 +1977,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "93f00c865fe7cabf650081affecd3871070f26767e7b2070a3ffae14c654b447"
 dependencies = [
  "cfg-if",
- "libc 0.2.147",
+ "libc 0.2.149",
  "redox_syscall",
  "smallvec",
  "windows-targets",
@@ -2025,7 +2008,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4ba1fd955270ca6f8bd8624ec0c4ee1a251dd3cc0cc18e1e2665ca8f5acb1501"
 dependencies = [
  "bitflags 1.3.2",
- "libc 0.2.147",
+ "libc 0.2.149",
  "mmap",
  "nom 4.2.3",
  "x86",
@@ -2038,7 +2021,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e1d3afd2628e69da2be385eb6f2fd57c8ac7977ceeff6dc166ff1657b0e386a9"
 dependencies = [
  "fixedbitset",
- "indexmap 2.0.0",
+ "indexmap 2.0.2",
 ]
 
 [[package]]
@@ -2096,7 +2079,7 @@ checksum = "4359fd9c9171ec6e8c62926d6faaf553a8dc3f64e1507e76da7911b4f6a04405"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.31",
+ "syn 2.0.38",
 ]
 
 [[package]]
@@ -2151,7 +2134,7 @@ version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "059a34f111a9dee2ce1ac2826a68b24601c4298cfeb1a587c3cb493d5ab46f52"
 dependencies = [
- "libc 0.2.147",
+ "libc 0.2.149",
  "nix 0.27.1",
 ]
 
@@ -2177,12 +2160,12 @@ dependencies = [
 
 [[package]]
 name = "prettyplease"
-version = "0.2.14"
+version = "0.2.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8832c0f9be7e3cae60727e6256cfd2cd3c3e2b6cd5dad4190ecb2fd658c9030b"
+checksum = "ae005bd773ab59b4725093fd7df83fd7892f7d8eafb48dbd7de6e024e4215f9d"
 dependencies = [
  "proc-macro2",
- "syn 2.0.31",
+ "syn 2.0.38",
 ]
 
 [[package]]
@@ -2211,9 +2194,9 @@ dependencies = [
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.66"
+version = "1.0.69"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "18fb31db3f9bddb2ea821cde30a9f70117e3f119938b5ee630b7403aa6e2ead9"
+checksum = "134c189feb4956b20f6f547d2cf727d4c0fe06722b20a0eec87ed445a97f92da"
 dependencies = [
  "unicode-ident",
 ]
@@ -2338,7 +2321,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "552840b97013b1a26992c11eac34bdd778e464601a4c2054b5f0bff7c6761293"
 dependencies = [
  "fuchsia-cprng",
- "libc 0.2.147",
+ "libc 0.2.149",
  "rand_core 0.3.1",
  "rdrand",
  "winapi",
@@ -2350,7 +2333,7 @@ version = "0.8.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
 dependencies = [
- "libc 0.2.147",
+ "libc 0.2.149",
  "rand_chacha",
  "rand_core 0.6.4",
 ]
@@ -2410,9 +2393,9 @@ dependencies = [
 
 [[package]]
 name = "rayon"
-version = "1.7.0"
+version = "1.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d2df5196e37bcc87abebc0053e20787d73847bb33134a69841207dd0a47f03b"
+checksum = "9c27db03db7734835b3f53954b534c91069375ce6ccaa2e065441e07d9b6cdb1"
 dependencies = [
  "either",
  "rayon-core",
@@ -2420,14 +2403,12 @@ dependencies = [
 
 [[package]]
 name = "rayon-core"
-version = "1.11.0"
+version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4b8f95bd6966f5c87776639160a66bd8ab9895d9d4ab01ddba9fc60661aebe8d"
+checksum = "5ce3fb6ad83f861aac485e76e1985cd109d9a3713802152be56c3b1f0e0658ed"
 dependencies = [
- "crossbeam-channel",
  "crossbeam-deque",
  "crossbeam-utils",
- "num_cpus",
 ]
 
 [[package]]
@@ -2450,14 +2431,14 @@ dependencies = [
 
 [[package]]
 name = "regex"
-version = "1.9.5"
+version = "1.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "697061221ea1b4a94a624f67d0ae2bfe4e22b8a17b6a192afb11046542cc8c47"
+checksum = "d119d7c7ca818f8a53c300863d4f87566aac09943aef5b355bb83969dae75d87"
 dependencies = [
  "aho-corasick",
  "memchr",
- "regex-automata 0.3.8",
- "regex-syntax 0.7.5",
+ "regex-automata 0.4.1",
+ "regex-syntax 0.8.1",
 ]
 
 [[package]]
@@ -2471,13 +2452,13 @@ dependencies = [
 
 [[package]]
 name = "regex-automata"
-version = "0.3.8"
+version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c2f401f4955220693b56f8ec66ee9c78abffd8d1c4f23dc41a23839eb88f0795"
+checksum = "465c6fc0621e4abc4187a2bda0937bfd4f722c2730b29562e19689ea796c9a4b"
 dependencies = [
  "aho-corasick",
  "memchr",
- "regex-syntax 0.7.5",
+ "regex-syntax 0.8.1",
 ]
 
 [[package]]
@@ -2488,9 +2469,9 @@ checksum = "f162c6dd7b008981e4d40210aca20b4bd0f9b60ca9271061b07f78537722f2e1"
 
 [[package]]
 name = "regex-syntax"
-version = "0.7.5"
+version = "0.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dbb5fb1acd8a1a18b3dd5be62d25485eb770e05afb408a9627d14d451bae12da"
+checksum = "56d84fdd47036b038fc80dd333d10b6aab10d5d31f4a366e20014def75328d33"
 
 [[package]]
 name = "remove_dir_all"
@@ -2508,21 +2489,35 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3053cf52e236a3ed746dfc745aa9cacf1b791d846bdaf412f60a8d7d6e17c8fc"
 dependencies = [
  "cc",
- "libc 0.2.147",
+ "libc 0.2.149",
  "once_cell",
- "spin",
- "untrusted",
+ "spin 0.5.2",
+ "untrusted 0.7.1",
  "web-sys",
  "winapi",
 ]
 
 [[package]]
+name = "ring"
+version = "0.17.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9babe80d5c16becf6594aa32ad2be8fe08498e7ae60b77de8df700e67f191d7e"
+dependencies = [
+ "cc",
+ "getrandom",
+ "libc 0.2.149",
+ "spin 0.9.8",
+ "untrusted 0.9.0",
+ "windows-sys",
+]
+
+[[package]]
 name = "rlimit"
 version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f7278a1ec8bfd4a4e07515c589f5ff7b309a373f987393aef44813d9dcf87aa3"
 dependencies = [
- "libc 0.2.147",
+ "libc 0.2.149",
 ]
 
 [[package]]
@@ -2561,28 +2556,14 @@ checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
 
 [[package]]
 name = "rustix"
-version = "0.37.23"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4d69718bf81c6127a49dc64e44a742e8bb9213c0ff8869a22c308f84c1d4ab06"
-dependencies = [
- "bitflags 1.3.2",
- "errno",
- "io-lifetimes",
- "libc 0.2.147",
- "linux-raw-sys 0.3.8",
- "windows-sys",
-]
-
-[[package]]
-name = "rustix"
-version = "0.38.11"
+version = "0.38.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0c3dde1fc030af041adc40e79c0e7fbcf431dd24870053d187d7c66e4b87453"
+checksum = "5a74ee2d7c2581cd139b42447d7d9389b889bdaad3a73f1ebb16f2a3237bb19c"
 dependencies = [
  "bitflags 2.4.0",
  "errno",
- "libc 0.2.147",
- "linux-raw-sys 0.4.5",
+ "libc 0.2.149",
+ "linux-raw-sys",
  "windows-sys",
 ]
 
@@ -2593,7 +2574,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1b80e3dec595989ea8510028f30c408a4630db12c9cbb8de34203b89d6577e99"
 dependencies = [
  "log",
- "ring",
+ "ring 0.16.20",
  "sct",
  "webpki",
 ]
@@ -2616,7 +2597,7 @@ version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2d3987094b1d07b653b7dfdc3f70ce9a1da9c51ac18c1b06b662e4f9a0e9f4b2"
 dependencies = [
- "base64 0.21.3",
+ "base64 0.21.4",
 ]
 
 [[package]]
@@ -2672,8 +2653,8 @@ version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d53dcdb7c9f8158937a7981b48accfd39a43af418591a5d008c7b22b5e1b7ca4"
 dependencies = [
- "ring",
- "untrusted",
+ "ring 0.16.20",
+ "untrusted 0.7.1",
 ]
 
 [[package]]
@@ -2685,7 +2666,7 @@ dependencies = [
  "bitflags 1.3.2",
  "core-foundation",
  "core-foundation-sys",
- "libc 0.2.147",
+ "libc 0.2.149",
  "security-framework-sys",
 ]
 
@@ -2696,7 +2677,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e932934257d3b408ed8f30db49d85ea163bfe74961f017f405b025af298f0c7a"
 dependencies = [
  "core-foundation-sys",
- "libc 0.2.147",
+ "libc 0.2.149",
 ]
 
 [[package]]
@@ -2705,7 +2686,7 @@ version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "604b71b8fc267e13bb3023a2c901126c8f349393666a6d98ac1ae5729b701798"
 dependencies = [
- "libc 0.2.147",
+ "libc 0.2.149",
  "tokio",
 ]
 
@@ -2735,14 +2716,14 @@ checksum = "4eca7ac642d82aa35b60049a6eccb4be6be75e599bd2e9adb5f875a737654af2"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.31",
+ "syn 2.0.38",
 ]
 
 [[package]]
 name = "serde_json"
-version = "1.0.105"
+version = "1.0.107"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "693151e1ac27563d6dbcec9dee9fbd5da8539b20fa14ad3752b2e6d363ace360"
+checksum = "6b420ce6e3d8bd882e9b243c6eed35dbc9a6110c9769e74b584e0d68d1f20c65"
 dependencies = [
  "itoa",
  "ryu",
@@ -2751,9 +2732,9 @@ dependencies = [
 
 [[package]]
 name = "sharded-slab"
-version = "0.1.4"
+version = "0.1.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "900fba806f70c630b0a382d0d825e17a0f19fcd059a2ade1ff237bcddf446b31"
+checksum = "f40ca3c46823713e0d4209592e8d6e826aa57e928f09752619fc696c499637f6"
 dependencies = [
  "lazy_static",
 ]
@@ -2777,7 +2758,7 @@ version = "1.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d8229b473baa5980ac72ef434c4415e70c4b5e71b423043adb4ba059f89c99a1"
 dependencies = [
- "libc 0.2.147",
+ "libc 0.2.149",
 ]
 
 [[package]]
@@ -2797,9 +2778,9 @@ dependencies = [
 
 [[package]]
 name = "smallvec"
-version = "1.11.0"
+version = "1.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "62bb4feee49fdd9f707ef802e22365a35de4b7b299de4763d44bfea899442ff9"
+checksum = "942b4a808e05215192e39f4ab80813e599068285906cc91aa64f923db842bd5a"
 
 [[package]]
 name = "socket2"
@@ -2807,17 +2788,17 @@ version = "0.4.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "64a4a911eed85daf18834cfaa86a79b7d266ff93ff5ba14005426219480ed662"
 dependencies = [
- "libc 0.2.147",
+ "libc 0.2.149",
  "winapi",
 ]
 
 [[package]]
 name = "socket2"
-version = "0.5.3"
+version = "0.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2538b18701741680e0322a2302176d3253a35388e2e62f172f64f4f16605f877"
+checksum = "4031e820eb552adee9295814c0ced9e5cf38ddf1e8b7d566d6de8e2538ea989e"
 dependencies = [
- "libc 0.2.147",
+ "libc 0.2.149",
  "windows-sys",
 ]
 
@@ -2841,6 +2822,12 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6e63cff320ae2c57904679ba7cb63280a3dc4613885beafb148ee7bf9aa9042d"
 
 [[package]]
+name = "spin"
+version = "0.9.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67"
+
+[[package]]
 name = "static_assertions"
 version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2865,9 +2852,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "2.0.31"
+version = "2.0.38"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "718fa2415bcb8d8bd775917a1bf12a7931b6dfa890753378538118181e0cb398"
+checksum = "e96b79aaa137db8f61e26363a0c9b47d8b4ec75da28b7d1d614c2303e232408b"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2887,7 +2874,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0b3a0d0aba8bf96a0e1ddfdc352fc53b3df7f39318c71854910c3c4b024ae52c"
 dependencies = [
  "cc",
- "libc 0.2.147",
+ "libc 0.2.149",
 ]
 
 [[package]]
@@ -2915,7 +2902,7 @@ dependencies = [
  "thiserror",
  "tokio",
  "tokio-serde",
- "tokio-util 0.7.8",
+ "tokio-util 0.7.9",
  "tracing",
  "tracing-opentelemetry",
  "tracing-subscriber",
@@ -2954,15 +2941,15 @@ dependencies = [
  "cfg-if",
  "fastrand",
  "redox_syscall",
- "rustix 0.38.11",
+ "rustix",
  "windows-sys",
 ]
 
 [[package]]
 name = "termcolor"
-version = "1.2.0"
+version = "1.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "be55cf8942feac5c765c2c993422806843c9a9a45d4d5c407ad6dd2ea95eb9b6"
+checksum = "6093bad37da69aab9d123a8091e4be0aa4a03e4d601ec641c327398315f62b64"
 dependencies = [
  "winapi-util",
 ]
@@ -2975,22 +2962,22 @@ checksum = "222a222a5bfe1bba4a77b45ec488a741b3cb8872e5e499451fd7d0129c9c7c3d"
 
 [[package]]
 name = "thiserror"
-version = "1.0.48"
+version = "1.0.49"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9d6d7a740b8a666a7e828dd00da9c0dc290dff53154ea77ac109281de90589b7"
+checksum = "1177e8c6d7ede7afde3585fd2513e611227efd6481bd78d2e82ba1ce16557ed4"
 dependencies = [
  "thiserror-impl",
 ]
 
 [[package]]
 name = "thiserror-impl"
-version = "1.0.48"
+version = "1.0.49"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "49922ecae66cc8a249b77e68d1d0623c1b2c514f0060c27cdc68bd62a1219d35"
+checksum = "10712f02019e9288794769fba95cd6847df9874d49d871d062172f9dd41bc4cc"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.31",
+ "syn 2.0.38",
 ]
 
 [[package]]
@@ -3037,19 +3024,19 @@ dependencies = [
 
 [[package]]
 name = "tokio"
-version = "1.32.0"
+version = "1.33.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "17ed6077ed6cd6c74735e21f37eb16dc3935f96878b1fe961074089cc80893f9"
+checksum = "4f38200e3ef7995e5ef13baec2f432a6da0aa9ac495b2c0e8f3b7eec2c92d653"
 dependencies = [
  "backtrace",
  "bytes",
- "libc 0.2.147",
+ "libc 0.2.149",
  "mio",
  "num_cpus",
  "parking_lot",
  "pin-project-lite",
  "signal-hook-registry",
- "socket2 0.5.3",
+ "socket2 0.5.4",
  "tokio-macros",
  "tracing",
  "windows-sys",
@@ -3073,7 +3060,7 @@ checksum = "630bdcf245f78637c13ec01ffae6187cca34625e8c63150d424b59e55af2675e"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.31",
+ "syn 2.0.38",
 ]
 
 [[package]]
@@ -3130,9 +3117,9 @@ dependencies = [
 
 [[package]]
 name = "tokio-util"
-version = "0.7.8"
+version = "0.7.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "806fe8c2c87eccc8b3267cbae29ed3ab2d0bd37fca70ab622e46aaa9375ddb7d"
+checksum = "1d68074620f57a0b21594d9735eb2e98ab38b17f80d3fcb189fca266771ca60d"
 dependencies = [
  "bytes",
  "futures-core",
@@ -3160,7 +3147,7 @@ checksum = "3082666a3a6433f7f511c7192923fa1fe07c69332d3c6a2e6bb040b569199d5a"
 dependencies = [
  "async-trait",
  "axum",
- "base64 0.21.3",
+ "base64 0.21.4",
  "bytes",
  "futures-core",
  "futures-util",
@@ -3194,7 +3181,7 @@ dependencies = [
  "rand 0.8.5",
  "slab",
  "tokio",
- "tokio-util 0.7.8",
+ "tokio-util 0.7.9",
  "tower-layer",
  "tower-service",
  "tracing",
@@ -3233,7 +3220,7 @@ checksum = "5f4f31f56159e98206da9efd823404b79b6ef3143b4a7ab76e67b1751b25a4ab"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.31",
+ "syn 2.0.38",
 ]
 
 [[package]]
@@ -3296,9 +3283,9 @@ checksum = "3528ecfd12c466c6f163363caf2d02a71161dd5e1cc6ae7b34207ea2d42d81ed"
 
 [[package]]
 name = "trybuild"
-version = "1.0.83"
+version = "1.0.85"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6df60d81823ed9c520ee897489573da4b1d79ffbe006b8134f46de1a1aa03555"
+checksum = "196a58260a906cedb9bf6d8034b6379d0c11f552416960452f267402ceeddff1"
 dependencies = [
  "basic-toml",
  "glob",
@@ -3330,9 +3317,9 @@ dependencies = [
 
 [[package]]
 name = "unicode-ident"
-version = "1.0.11"
+version = "1.0.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "301abaae475aa91687eb82514b328ab47a211a533026cb25fc3e519b86adfc3c"
+checksum = "3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b"
 
 [[package]]
 name = "untrusted"
@@ -3341,6 +3328,12 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a156c684c91ea7d62626509bce3cb4e1d9ed5c4d978f7b4352658f96a4c26b4a"
 
 [[package]]
+name = "untrusted"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
+
+[[package]]
 name = "uuid"
 version = "1.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -3413,7 +3406,7 @@ dependencies = [
  "once_cell",
  "proc-macro2",
  "quote",
- "syn 2.0.31",
+ "syn 2.0.38",
  "wasm-bindgen-shared",
 ]
 
@@ -3435,7 +3428,7 @@ checksum = "54681b18a46765f095758388f2d0cf16eb8d4169b639ab575a8f5693af210c7b"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.31",
+ "syn 2.0.38",
  "wasm-bindgen-backend",
  "wasm-bindgen-shared",
 ]
@@ -3458,12 +3451,12 @@ dependencies = [
 
 [[package]]
 name = "webpki"
-version = "0.22.1"
+version = "0.22.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0e74f82d49d545ad128049b7e88f6576df2da6b02e9ce565c6f533be576957e"
+checksum = "ed63aea5ce73d0ff405984102c42de94fc55a6b75765d621c65262469b3c9b53"
 dependencies = [
- "ring",
- "untrusted",
+ "ring 0.17.3",
+ "untrusted 0.9.0",
 ]
 
 [[package]]
@@ -3475,7 +3468,7 @@ dependencies = [
  "either",
  "home",
  "once_cell",
- "rustix 0.38.11",
+ "rustix",
 ]
 
 [[package]]
@@ -3496,9 +3489,9 @@ checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
 
 [[package]]
 name = "winapi-util"
-version = "0.1.5"
+version = "0.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "70ec6ce85bb158151cae5e5c87f95a8e97d2c0c4b001223f33a334e3ce5de178"
+checksum = "f29e6f9198ba0d26b4c9f07dbe6f9ed633e1f3d5b8b414090084349e46a52596"
 dependencies = [
  "winapi",
 ]
diff --git a/pkgs/development/php-packages/datadog_trace/default.nix b/pkgs/development/php-packages/datadog_trace/default.nix
index 87e3e06b9428..7e9d3164ccfe 100644
--- a/pkgs/development/php-packages/datadog_trace/default.nix
+++ b/pkgs/development/php-packages/datadog_trace/default.nix
@@ -13,20 +13,20 @@
 
 buildPecl rec {
   pname = "ddtrace";
-  version = "0.92.2";
+  version = "0.93.1";
 
   src = fetchFromGitHub {
     owner = "DataDog";
     repo = "dd-trace-php";
     rev = version;
     fetchSubmodules = true;
-    hash = "sha256-8h05ar16s1r1movP7zJgOsVAXJbU+Wi+wzmgVZ3nPbw=";
+    hash = "sha256-eiqwcSDwxkuYEsseHdjBE3KFnTnD/7BMyz/DNVAKUIA=";
   };
 
   cargoDeps = rustPlatform.importCargoLock {
     lockFile = ./Cargo.lock;
     outputHashes = {
-      "datadog-profiling-4.0.0" = "sha256-HoRELMxNkxkISscBksH4wMj/cuK/XQANr2WQUKwrevg=";
+      "datadog-profiling-5.0.0" = "sha256-/Z1vGpAHpU5EO80NXnzyAHN4s3iyA1jOquBS8MH1nOo=";
     };
   };
 
diff --git a/pkgs/development/python-modules/aioairzone-cloud/default.nix b/pkgs/development/python-modules/aioairzone-cloud/default.nix
index 2325bf4ff0fc..586f74c89c7a 100644
--- a/pkgs/development/python-modules/aioairzone-cloud/default.nix
+++ b/pkgs/development/python-modules/aioairzone-cloud/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "aioairzone-cloud";
-  version = "0.3.1";
+  version = "0.3.2";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "Noltari";
     repo = "aioairzone-cloud";
     rev = "refs/tags/${version}";
-    hash = "sha256-PWdyyzdPXDOfZgyLasT9TW+g+So2wOkcf9Fy77Oydl4=";
+    hash = "sha256-aaa2/E6QCeWtTc1c7n0z05Kn3gCCjuQVbdwCgMAYX1A=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/bpycv/default.nix b/pkgs/development/python-modules/bpycv/default.nix
index a6d385e97781..4a3eb5b88f78 100644
--- a/pkgs/development/python-modules/bpycv/default.nix
+++ b/pkgs/development/python-modules/bpycv/default.nix
@@ -2,7 +2,6 @@
 , lib
 , beautifulsoup4
 , blender
-, blender-with-packages
 , boxx
 , bpycv
 , buildPythonPackage
@@ -52,13 +51,8 @@ buildPythonPackage rec {
         hash = "sha256-dGb6KvbXTGTu5f4AqhA+i4AwTqBoR5SdXk0vsMEcD3Q=";
         rev = "6ce0e65c107d572011394da16ffdf851e988dbb4";
       };
-      nativeBuildInputs = [
-        ((blender-with-packages.override {inherit blender python3Packages;}) {
-          packages = [ bpycv ];
-        })
-      ];
     } ''
-      blender-wrapped -b -P ${./bpycv-test.py}
+      ${blender.withPackages (ps: [ps.bpycv])}/bin/blender-wrapped -b -P ${./bpycv-test.py}
     '';
   };
 
diff --git a/pkgs/development/python-modules/holidays/default.nix b/pkgs/development/python-modules/holidays/default.nix
index 976766f0a4df..9fd25d7e138c 100644
--- a/pkgs/development/python-modules/holidays/default.nix
+++ b/pkgs/development/python-modules/holidays/default.nix
@@ -3,27 +3,33 @@
 , convertdate
 , fetchFromGitHub
 , hijri-converter
+, importlib-metadata
 , korean-lunar-calendar
 , polib
 , pytestCheckHook
 , python-dateutil
 , pythonOlder
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "holidays";
-  version = "0.32";
-  format = "setuptools";
+  version = "0.35";
+  pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "dr-prodigy";
     repo = "python-holidays";
-    rev = "refs/tags/v.${version}";
-    hash = "sha256-YAh5gR4KcUgXzeXy3xyGeokDFsyd9FqRQ5j1TC6wCQY=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-FrAqVLyEtjhpiu1XdFY5yOstKKjXhRTv9PeaFlJaf8k=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     convertdate
     python-dateutil
@@ -32,6 +38,7 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
+    importlib-metadata
     polib
     pytestCheckHook
   ];
@@ -48,9 +55,9 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Generate and work with holidays in Python";
     homepage = "https://github.com/dr-prodigy/python-holidays";
-    changelog = "https://github.com/dr-prodigy/python-holidays/releases/tag/v.${version}";
+    changelog = "https://github.com/dr-prodigy/python-holidays/releases/tag/v${version}";
     license = licenses.mit;
-    maintainers = with maintainers; [ jluttine ];
+    maintainers = with maintainers; [ fab jluttine ];
   };
 }
 
diff --git a/pkgs/development/python-modules/opower/default.nix b/pkgs/development/python-modules/opower/default.nix
index 3a9b516c2daf..72e83c216699 100644
--- a/pkgs/development/python-modules/opower/default.nix
+++ b/pkgs/development/python-modules/opower/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "opower";
-  version = "0.0.38";
+  version = "0.0.39";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "tronikos";
     repo = "opower";
     rev = "refs/tags/v${version}";
-    hash = "sha256-NX4w5id/XJfleHJd1fa1XcvekwhtWMaEyhbY253SMOo=";
+    hash = "sha256-5JcediHl2TeMhYa6OJqoW5K0SlAjdIrMwj2IHh3qW7I=";
   };
 
   pythonRemoveDeps = [
diff --git a/pkgs/development/python-modules/pyacaia-async/default.nix b/pkgs/development/python-modules/pyacaia-async/default.nix
index 3001e33937f8..7d69f39ceb1e 100644
--- a/pkgs/development/python-modules/pyacaia-async/default.nix
+++ b/pkgs/development/python-modules/pyacaia-async/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "pyacaia-async";
-  version = "0.0.8";
+  version = "0.0.10";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "pyacaia_async";
     inherit version;
-    hash = "sha256-9aZmlw+u4fUa+TRh1COmViWAUQQ0MN2nFKY0t1hS+ko=";
+    hash = "sha256-hmzsZIIZsswUvy9AMgfXNC2v6H8Wvgdk9Qa4PoYmhCU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/yalexs-ble/default.nix b/pkgs/development/python-modules/yalexs-ble/default.nix
index 6c8624608764..29ac9d1c68d7 100644
--- a/pkgs/development/python-modules/yalexs-ble/default.nix
+++ b/pkgs/development/python-modules/yalexs-ble/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "yalexs-ble";
-  version = "2.3.1";
+  version = "2.3.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "bdraco";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-rWJojH2vitkoCRthaczWW/wGLdxsMlmJ4b/2vdaZhdA=";
+    hash = "sha256-uHkJEtaohuTRs1RXDPbe4dohbjBnYi9MFguP9CTwM5w=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/air/default.nix b/pkgs/development/tools/air/default.nix
index 5c35251a9025..ce51efafdbad 100644
--- a/pkgs/development/tools/air/default.nix
+++ b/pkgs/development/tools/air/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "air";
-  version = "1.46.0";
+  version = "1.49.0";
 
   src = fetchFromGitHub {
     owner = "cosmtrek";
     repo = "air";
     rev = "v${version}";
-    hash = "sha256-Y5tvCKpcqCkjUOs6awSE5giRKmtofhGypWN1pT7BEXU=";
+    hash = "sha256-6XQakQXGFMepX29KeiLlGM6EI8tiIfmKQuqZQXYNoto=";
   };
 
   vendorHash = "sha256-vyuXmQEjy5kPk9cKosHx0JZSZxstYtCNyfLIlRt2bnk=";
diff --git a/pkgs/development/tools/eslint_d/default.nix b/pkgs/development/tools/eslint_d/default.nix
index a49dbfdefc7a..e7e01bf8b5ae 100644
--- a/pkgs/development/tools/eslint_d/default.nix
+++ b/pkgs/development/tools/eslint_d/default.nix
@@ -17,7 +17,7 @@ buildNpmPackage rec {
 
   meta = with lib; {
     description = "Makes eslint the fastest linter on the planet";
-    homepage = "github.com/mantoni/eslint_d.js";
+    homepage = "https://github.com/mantoni/eslint_d.js";
     license = licenses.mit;
     maintainers = [ maintainers.ehllie ];
     mainProgram = "eslint_d";
diff --git a/pkgs/development/tools/kube-linter/default.nix b/pkgs/development/tools/kube-linter/default.nix
index 5821a1753b88..bcacc28214bf 100644
--- a/pkgs/development/tools/kube-linter/default.nix
+++ b/pkgs/development/tools/kube-linter/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "kube-linter";
-  version = "0.6.4";
+  version = "0.6.5";
 
   src = fetchFromGitHub {
     owner = "stackrox";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-L0JjbjV5KwI4qas8iLp5OLkleQlD29jsYLpe3ER1l2Y=";
+    sha256 = "sha256-gygzibpTpdVg1ZenAXIDHXYwAemlr6qkioE+GV52NkE=";
   };
 
-  vendorHash = "sha256-1erG3TFv3DR6SLDIrmRefAPjXhgXEVYFiAsUPiI7kX4=";
+  vendorHash = "sha256-ZeAAvL5pOvHMAsDBe/0CBeayTsUrPDK5a5rAxHAu64o=";
 
   ldflags = [
     "-s" "-w" "-X golang.stackrox.io/kube-linter/internal/version.version=${version}"
diff --git a/pkgs/development/tools/rust/cargo-temp/default.nix b/pkgs/development/tools/rust/cargo-temp/default.nix
index 706e33235c6d..9df84462efa7 100644
--- a/pkgs/development/tools/rust/cargo-temp/default.nix
+++ b/pkgs/development/tools/rust/cargo-temp/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-temp";
-  version = "0.2.18";
+  version = "0.2.19";
 
   src = fetchFromGitHub {
     owner = "yozhgoor";
     repo = "cargo-temp";
     rev = "v${version}";
-    hash = "sha256-JUpXLdFaG653u9a4Nq7TC1ZNEcZ0QzgYMjGS8Kam0ec=";
+    hash = "sha256-vLD7M+Pg0BHJq9zDPeJLY+v/Vri/XtV3pQu0+ZE84Ew=";
   };
 
-  cargoHash = "sha256-7yPvHCmdokb/oJqR3h+RJOQbE/pcrIDBltnG5zfoqMk=";
+  cargoHash = "sha256-NKT5AijwNm/BVhHGVAXq6sWBJYjSpq90TXHjlrihldo=";
 
   meta = with lib; {
     description = "A CLI tool that allow you to create a temporary new Rust project using cargo with already installed dependencies";
diff --git a/pkgs/development/tools/wasm-bindgen-cli/default.nix b/pkgs/development/tools/wasm-bindgen-cli/default.nix
index d7b6aba2a2a3..c87f49aa7cb4 100644
--- a/pkgs/development/tools/wasm-bindgen-cli/default.nix
+++ b/pkgs/development/tools/wasm-bindgen-cli/default.nix
@@ -7,9 +7,9 @@
 , stdenv
 , curl
 , Security
-, version ? "0.2.87"
-, hash ? "sha256-0u9bl+FkXEK2b54n7/l9JOCtKo+pb42GF9E1EnAUQa0="
-, cargoHash ? "sha256-AsZBtE2qHJqQtuCt/wCAgOoxYMfvDh8IzBPAOkYSYko="
+, version ? "0.2.88"
+, hash ? "sha256-CpyB2poKIqP4Zfn3Gk1hA9m6EQ/ZiyO91wZViMH7Wsk="
+, cargoHash ? "sha256-0D5ABJ3jwsrFIvXSOYgOqJtV5B9JUsHZfJEKl6PO47I="
 }:
 
 rustPlatform.buildRustPackage rec {
diff --git a/pkgs/os-specific/darwin/apple-sdk-11.0/private-frameworks.nix b/pkgs/os-specific/darwin/apple-sdk-11.0/private-frameworks.nix
index f95932516d20..4566c8af84f5 100644
--- a/pkgs/os-specific/darwin/apple-sdk-11.0/private-frameworks.nix
+++ b/pkgs/os-specific/darwin/apple-sdk-11.0/private-frameworks.nix
@@ -2,6 +2,7 @@
 # generated by hand to avoid exposing all private frameworks
 # frameworks here are only the necessary ones used by public frameworks.
 {
+  Apple80211 = {};
   AVFCapture = {};
   AVFCore = {};
   AddressBookCore = { inherit ContactsPersistence; };
diff --git a/pkgs/servers/dante/clang-osint-m4.patch b/pkgs/servers/dante/clang-osint-m4.patch
new file mode 100644
index 000000000000..65281e22ea0e
--- /dev/null
+++ b/pkgs/servers/dante/clang-osint-m4.patch
@@ -0,0 +1,34 @@
+diff -ur a/osdep.m4 b/osdep.m4
+--- a/osdep.m4	2017-01-18 09:11:20.000000000 -0500
++++ b/osdep.m4	2023-10-21 12:43:59.464797030 -0400
+@@ -381,6 +381,7 @@
+ unset have_sa_len
+ AC_MSG_CHECKING([for sa_len in sockaddr])
+ AC_TRY_COMPILE([
++#include <stdint.h>
+ #include <sys/types.h>
+ #include <sys/socket.h>
+ ], [struct sockaddr sa;
+@@ -397,12 +398,13 @@
+    unset sa_len_type_found
+    for type in uint8_t "unsigned char"; do
+        AC_TRY_COMPILE([
++#include <stdint.h>
+ #include <sys/types.h>
+ #include <sys/socket.h>], [
+ struct sockaddr sa;
+ $type *sa_len_ptr;
+ sa_len_ptr = &sa.sa_len;
+-sa_len_ptr++; /* use to avoid warning/error */],
++(*sa_len_ptr)++; /* use to avoid warning/error */],
+        [AC_DEFINE_UNQUOTED(sa_len_type, [$type], [sa_len type])
+         sa_len_type_found=t
+         break])
+@@ -636,6 +638,7 @@
+ 		in_port_t, in_addr_t],
+ 		, ,
+ [
++#include <stdint.h>
+ #include <sys/types.h>
+ #include <netinet/in.h>
+ ])
diff --git a/pkgs/servers/dante/default.nix b/pkgs/servers/dante/default.nix
index 49e6a26f455f..a5806a20d411 100644
--- a/pkgs/servers/dante/default.nix
+++ b/pkgs/servers/dante/default.nix
@@ -22,12 +22,17 @@ stdenv.mkDerivation rec {
 
   dontAddDisableDepTrack = stdenv.isDarwin;
 
-  patches = lib.optionals remove_getaddrinfo_checks [
+  patches = [
+    # Fixes several issues with `osint.m4` that causes incorrect check failures when using newer
+    # versions of clang: missing `stdint.h` for `uint8_t` and unused `sa_len_ptr`.
+    ./clang-osint-m4.patch
+  ] ++ lib.optionals remove_getaddrinfo_checks [
     (fetchpatch {
       name = "0002-osdep-m4-Remove-getaddrinfo-too-low-checks.patch";
       url = "https://raw.githubusercontent.com/buildroot/buildroot/master/package/dante/0002-osdep-m4-Remove-getaddrinfo-too-low-checks.patch";
       sha256 = "sha256-e+qF8lB5tkiA7RlJ+tX5O6KxQrQp33RSPdP1TxU961Y=";
-    }) ];
+    })
+  ];
 
   postPatch = ''
     substituteInPlace include/redefgen.sh --replace 'PATH=/bin:/usr/bin:/sbin:/usr/sbin' ""
diff --git a/pkgs/servers/mail/postfix/default.nix b/pkgs/servers/mail/postfix/default.nix
index 002ea06ef905..ca8d54d6006d 100644
--- a/pkgs/servers/mail/postfix/default.nix
+++ b/pkgs/servers/mail/postfix/default.nix
@@ -84,6 +84,8 @@ in stdenv.mkDerivation rec {
     make makefiles CCARGS='${ccargs}' AUXLIBS='${auxlibs}'
   '';
 
+  enableParallelBuilding = true;
+
   NIX_LDFLAGS = lib.optionalString withLDAP "-llber";
 
   installTargets = [ "non-interactive-package" ];
diff --git a/pkgs/servers/mail/stalwart/Cargo.lock b/pkgs/servers/mail/stalwart/Cargo.lock
index c2d471f00054..80e61090a905 100644
--- a/pkgs/servers/mail/stalwart/Cargo.lock
+++ b/pkgs/servers/mail/stalwart/Cargo.lock
@@ -2276,7 +2276,7 @@ checksum = "029d73f573d8e8d63e6d5020011d3255b28c3ba85d6cf870a07184ed23de9284"
 
 [[package]]
 name = "imap"
-version = "0.4.0"
+version = "0.4.2"
 dependencies = [
  "ahash 0.8.3",
  "dashmap",
@@ -2460,7 +2460,7 @@ dependencies = [
 
 [[package]]
 name = "jmap"
-version = "0.4.0"
+version = "0.4.2"
 dependencies = [
  "aes",
  "aes-gcm",
@@ -2497,6 +2497,7 @@ dependencies = [
  "sequoia-openpgp",
  "serde",
  "serde_json",
+ "sha1",
  "sha2 0.10.8",
  "sieve-rs",
  "smtp",
@@ -2824,7 +2825,7 @@ dependencies = [
 
 [[package]]
 name = "mail-server"
-version = "0.4.0"
+version = "0.4.2"
 dependencies = [
  "directory",
  "imap",
@@ -2841,7 +2842,7 @@ dependencies = [
 
 [[package]]
 name = "managesieve"
-version = "0.1.0"
+version = "0.4.2"
 dependencies = [
  "ahash 0.8.3",
  "bincode",
@@ -3031,7 +3032,7 @@ dependencies = [
 
 [[package]]
 name = "nlp"
-version = "0.4.0"
+version = "0.4.2"
 dependencies = [
  "ahash 0.8.3",
  "bincode",
@@ -4739,7 +4740,7 @@ checksum = "942b4a808e05215192e39f4ab80813e599068285906cc91aa64f923db842bd5a"
 
 [[package]]
 name = "smtp"
-version = "0.4.0"
+version = "0.4.2"
 dependencies = [
  "ahash 0.8.3",
  "blake3",
@@ -5070,7 +5071,7 @@ dependencies = [
 
 [[package]]
 name = "stalwart-cli"
-version = "0.4.0"
+version = "0.4.2"
 dependencies = [
  "clap",
  "console",
@@ -5092,7 +5093,7 @@ dependencies = [
 
 [[package]]
 name = "stalwart-install"
-version = "0.4.0"
+version = "0.4.2"
 dependencies = [
  "base64 0.21.4",
  "clap",
@@ -5900,7 +5901,7 @@ checksum = "711b9620af191e0cdc7468a8d14e709c3dcdb115b36f838e601583af800a370a"
 
 [[package]]
 name = "utils"
-version = "0.4.0"
+version = "0.4.2"
 dependencies = [
  "ahash 0.8.3",
  "chrono",
diff --git a/pkgs/servers/mail/stalwart/default.nix b/pkgs/servers/mail/stalwart/default.nix
index f76d34cf29ee..2be1e000f88a 100644
--- a/pkgs/servers/mail/stalwart/default.nix
+++ b/pkgs/servers/mail/stalwart/default.nix
@@ -13,7 +13,7 @@
 }:
 
 let
-  version = "0.4.0";
+  version = "0.4.2";
 in
 rustPlatform.buildRustPackage {
   pname = "stalwart-mail";
@@ -23,7 +23,7 @@ rustPlatform.buildRustPackage {
     owner = "stalwartlabs";
     repo = "mail-server";
     rev = "v${version}";
-    hash = "sha256-T61GlSzKdJZiSyRyxyk7PKhm0jmEtrMxoaTyM3FeDCU=";
+    hash = "sha256-Ah53htK38Bm2yGN44IiC6iRWgxkMVRtrNvXXvPh+SJc=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/servers/rustypaste/default.nix b/pkgs/servers/rustypaste/default.nix
index 76295880d494..0dc72f74bb2d 100644
--- a/pkgs/servers/rustypaste/default.nix
+++ b/pkgs/servers/rustypaste/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rustypaste";
-  version = "0.14.0";
+  version = "0.14.1";
 
   src = fetchFromGitHub {
     owner = "orhun";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-bVy3/Ot4cb2Tr+wEDtWD3W2FYlXQVQ6tYC8DDyCiivY=";
+    sha256 = "sha256-9qP0/PGXRbQzSIsxUoGzbtc2KNg6SKrqGYcg/K6SuKo=";
   };
 
-  cargoHash = "sha256-lCpp1VM6G36mFCm3u+4trsdFszd8SbUEgK1iIm/LwQ4=";
+  cargoHash = "sha256-76s3cWAKS6aeIG1ctHU6uCMWHDKsMcf5HWhUWzEuAkI=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
     darwin.apple_sdk.frameworks.CoreServices
diff --git a/pkgs/tools/admin/granted/default.nix b/pkgs/tools/admin/granted/default.nix
index 6e48f468c4d8..65084dcedeb4 100644
--- a/pkgs/tools/admin/granted/default.nix
+++ b/pkgs/tools/admin/granted/default.nix
@@ -12,16 +12,16 @@
 
 buildGoModule rec {
   pname = "granted";
-  version = "0.18.0";
+  version = "0.19.2";
 
   src = fetchFromGitHub {
     owner = "common-fate";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-BvrMfQ/fiAMJCROwOqzt17ae/qqDC2KFdBK2epVImus=";
+    sha256 = "sha256-z8j44WFLzPDpnmQ/vG8DfpjpxnNd942mPUxoXSEJDeI=";
   };
 
-  vendorHash = "sha256-vHOGnflLC85hrONPPAAuuaPxNkv3t5T616nAnDEZbAY=";
+  vendorHash = "sha256-cn1rGmjrmPSo6v4TD72I01VbQjwt6dT7ZEijPOjp+kc=";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/tools/filesystems/erofs-utils/default.nix b/pkgs/tools/filesystems/erofs-utils/default.nix
index dbf8de967d73..b57dcc4b3629 100644
--- a/pkgs/tools/filesystems/erofs-utils/default.nix
+++ b/pkgs/tools/filesystems/erofs-utils/default.nix
@@ -1,5 +1,6 @@
-{ lib, stdenv, fetchurl, autoreconfHook, pkg-config, fuse, util-linux, lz4, zlib
+{ lib, stdenv, fetchurl, autoreconfHook, pkg-config, fuse, util-linux, lz4, zlib, libselinux
 , fuseSupport ? stdenv.isLinux
+, selinuxSupport ? false
 }:
 
 stdenv.mkDerivation rec {
@@ -15,11 +16,13 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
   buildInputs = [ util-linux lz4 zlib ]
-    ++ lib.optionals fuseSupport [ fuse ];
+    ++ lib.optionals fuseSupport [ fuse ]
+    ++ lib.optionals selinuxSupport [ libselinux ];
 
   configureFlags = [
     "MAX_BLOCK_SIZE=4096"
-  ] ++ lib.optional fuseSupport "--enable-fuse";
+  ] ++ lib.optional fuseSupport "--enable-fuse"
+    ++ lib.optional selinuxSupport "--with-selinux";
 
   meta = with lib; {
     homepage = "https://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs-utils.git/about/";
diff --git a/pkgs/tools/graphics/gromit-mpx/default.nix b/pkgs/tools/graphics/gromit-mpx/default.nix
index b131b4d0fb1e..d98ee8733a04 100644
--- a/pkgs/tools/graphics/gromit-mpx/default.nix
+++ b/pkgs/tools/graphics/gromit-mpx/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gromit-mpx";
-  version = "1.5.0";
+  version = "1.5.1";
 
   src = fetchFromGitHub {
     owner = "bk138";
     repo = "gromit-mpx";
     rev = version;
-    sha256 = "sha256-I2/9zRKpMkiB0IhnYuOrJHp4nNyG6pfful5D7OqCILQ=";
+    sha256 = "sha256-6sjps0wbB0sTaQtehRmz2KBWxqk3pqJmQs9htqxmJwo=";
   };
 
   nativeBuildInputs = [ cmake pkg-config wrapGAppsHook ];
diff --git a/pkgs/tools/inputmethods/evsieve/default.nix b/pkgs/tools/inputmethods/evsieve/default.nix
index 4497448cad12..de18668e7475 100644
--- a/pkgs/tools/inputmethods/evsieve/default.nix
+++ b/pkgs/tools/inputmethods/evsieve/default.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "evsieve";
-  version = "1.3.1";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "KarsMulder";
     repo = "evsieve";
     rev = "v${version}";
-    hash = "sha256-R/y3iyKGE4dzAyNnDwrMCr8JFshYJwNcgHQ8UbtuRj8=";
+    hash = "sha256-UV5m8DmFtkCU/DoBJNBCdvhU/jYtU5+WnnhKwxZNl9g=";
   };
 
-  cargoHash = "sha256-jkm+mAHejCBZFalUbJNaIxtIl2kwnlPR2wsaYlcfSz8=";
+  cargoHash = "sha256-Bug25xK3YYQ3YjrUXlgWaVUPn87V3N/8XikqwYL/sUg=";
 
   buildInputs = [ libevdev ];
 
diff --git a/pkgs/tools/misc/asciinema/default.nix b/pkgs/tools/misc/asciinema/default.nix
index 667e13405607..2643cdd474b3 100644
--- a/pkgs/tools/misc/asciinema/default.nix
+++ b/pkgs/tools/misc/asciinema/default.nix
@@ -6,14 +6,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "asciinema";
-  version = "2.3.0";
+  version = "2.4.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "asciinema";
     repo = "asciinema";
     rev = "v${version}";
-    hash = "sha256-1B2A2lfLeDHgD4tg3M5IIyHxBQ0cHuWDrQ3bUKAIFlc=";
+    hash = "sha256-UegLwpJ+uc9cW3ozLQJsQBjIGD7+vzzwzQFRV5gmDmI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/misc/esphome/default.nix b/pkgs/tools/misc/esphome/default.nix
index ef6e0f1de6ed..8413dde76961 100644
--- a/pkgs/tools/misc/esphome/default.nix
+++ b/pkgs/tools/misc/esphome/default.nix
@@ -16,14 +16,14 @@ let
 in
 python.pkgs.buildPythonApplication rec {
   pname = "esphome";
-  version = "2023.10.5";
+  version = "2023.10.6";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-I/VA1/vw0WrTsLC1F3IrKYf8lmTJHLG/RYj3VcJx+Zc=";
+    hash = "sha256-GqZSQVQnxLj0JrUrCMB5+RmxcJRU6ErIDGP8WaMolXk=";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/misc/fastfetch/default.nix b/pkgs/tools/misc/fastfetch/default.nix
index 77eeaeaf6702..ced223496bf4 100644
--- a/pkgs/tools/misc/fastfetch/default.nix
+++ b/pkgs/tools/misc/fastfetch/default.nix
@@ -27,6 +27,7 @@
 , xfce
 , yyjson
 , zlib
+, Apple80211
 , AppKit
 , Cocoa
 , CoreDisplay
@@ -42,13 +43,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fastfetch";
-  version = "2.2.0";
+  version = "2.2.1";
 
   src = fetchFromGitHub {
     owner = "fastfetch-cli";
     repo = "fastfetch";
     rev = finalAttrs.version;
-    hash = "sha256-H2iIL41h3o8184S/XMYAuIDPVJPm+zSI/YX8FT8vLio=";
+    hash = "sha256-7g2p33j97hu26xwBLrakc7/bIpYHNTC5jqCj/Fs4fKo=";
   };
 
   nativeBuildInputs = [
@@ -83,6 +84,7 @@ stdenv.mkDerivation (finalAttrs: {
     zlib
   ]
   ++ lib.optionals stdenv.isDarwin [
+    Apple80211
     AppKit
     Cocoa
     CoreDisplay
@@ -101,6 +103,11 @@ stdenv.mkDerivation (finalAttrs: {
     "-DENABLE_SYSTEM_YYJSON=YES"
   ];
 
+  env.NIX_CFLAGS_COMPILE = toString [
+    # Needed with GCC 12
+    "-Wno-error=uninitialized"
+  ];
+
   postInstall = ''
     wrapProgram $out/bin/fastfetch \
       --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath finalAttrs.buildInputs}"
diff --git a/pkgs/tools/misc/gosu/default.nix b/pkgs/tools/misc/gosu/default.nix
index 6f08e027d8f8..bd3ba4c930d7 100644
--- a/pkgs/tools/misc/gosu/default.nix
+++ b/pkgs/tools/misc/gosu/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "gosu";
-  version = "1.16";
+  version = "1.17";
 
   src = fetchFromGitHub {
     owner = "tianon";
     repo = "gosu";
     rev = version;
-    hash = "sha256-UfrhrwsnDT7pfizQtQzqv/1FTMBTrk3qmtiR7ffwwhc=";
+    hash = "sha256-ziviUXqCpCGECewyZNLDKSjnpmz/3i5DKrIKZlLwl4o=";
   };
 
-  vendorHash = "sha256-3HIAPI1bbfwE2/cUsQnp2Vz2uvlvSFDUrp2xuGNr8Gk=";
+  vendorHash = "sha256-fygLYSO0kpMFJd6WQp/uLYkELkyaOPZ9V8BrJcIcMuU=";
 
   ldflags = [ "-d" "-s" "-w" ];
 
diff --git a/pkgs/tools/misc/ollama/default.nix b/pkgs/tools/misc/ollama/default.nix
index be1864024888..30be00d72a15 100644
--- a/pkgs/tools/misc/ollama/default.nix
+++ b/pkgs/tools/misc/ollama/default.nix
@@ -1,35 +1,50 @@
 { lib
 , buildGoModule
 , fetchFromGitHub
+, llama-cpp
 , stdenv
-, darwin
 }:
 
 buildGoModule rec {
   pname = "ollama";
-  version = "0.0.17";
+  version = "0.1.7";
 
   src = fetchFromGitHub {
     owner = "jmorganca";
     repo = "ollama";
     rev = "v${version}";
-    hash = "sha256-idsFcjsRD1zPmG742gnYQJcgSWDA2DLMHksCFNe2GiY=";
+    hash = "sha256-rzcuRU2qcYTMo/GxiSHwJYnvA9samfWlztMEhOGzbRg=";
   };
 
-  buildInputs = lib.optionals stdenv.isDarwin (with darwin.apple_sdk_11_0.frameworks; [
-    Accelerate
-    MetalPerformanceShaders
-    MetalKit
-  ]);
+  patches = [
+    # disable passing the deprecated gqa flag to llama-cpp-server
+    # see https://github.com/ggerganov/llama.cpp/issues/2975
+    ./disable-gqa.patch
 
-  vendorHash = "sha256-IgEf/WOc1eNGCif1fViIFxbgZAd6mHBqfxcaqH/WvGg=";
+    # replace the call to the bundled llama-cpp-server with the one in the llama-cpp package
+    ./set-llamacpp-path.patch
+  ];
 
-  ldflags = [ "-s" "-w" ];
+  postPatch = ''
+    substituteInPlace llm/llama.go \
+      --subst-var-by llamaCppServer "${llama-cpp}/bin/llama-cpp-server"
+  '';
+
+  vendorHash = "sha256-Qt5QVqRkwK61BJPVhFWtox6b9E8BpAIseNB0yhh+/90=";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X=github.com/jmorganca/ollama/version.Version=${version}"
+    "-X=github.com/jmorganca/ollama/server.mode=release"
+  ];
 
   meta = with lib; {
     description = "Get up and running with large language models locally";
     homepage = "https://github.com/jmorganca/ollama";
     license = licenses.mit;
-    maintainers = with maintainers; [ dit7ya ];
+    mainProgram = "ollama";
+    maintainers = with maintainers; [ dit7ya elohmeier ];
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/tools/misc/ollama/disable-gqa.patch b/pkgs/tools/misc/ollama/disable-gqa.patch
new file mode 100644
index 000000000000..b54440cd3d53
--- /dev/null
+++ b/pkgs/tools/misc/ollama/disable-gqa.patch
@@ -0,0 +1,15 @@
+diff --git a/llm/llama.go b/llm/llama.go
+index 0b460e9..b79e04a 100644
+--- a/llm/llama.go
++++ b/llm/llama.go
+@@ -299,10 +299,6 @@ func newLlama(model string, adapters []string, runners []ModelRunner, numLayers
+ 		params = append(params, "--n-gpu-layers", fmt.Sprintf("%d", numGPU))
+ 	}
+ 
+-	if opts.NumGQA > 0 {
+-		params = append(params, "--gqa", fmt.Sprintf("%d", opts.NumGQA))
+-	}
+-
+ 	if len(adapters) > 0 {
+ 		// TODO: applying multiple adapters is not supported by the llama.cpp server yet
+ 		params = append(params, "--lora", adapters[0])
diff --git a/pkgs/tools/misc/ollama/set-llamacpp-path.patch b/pkgs/tools/misc/ollama/set-llamacpp-path.patch
new file mode 100644
index 000000000000..e90e552bab45
--- /dev/null
+++ b/pkgs/tools/misc/ollama/set-llamacpp-path.patch
@@ -0,0 +1,23 @@
+diff --git a/llm/llama.go b/llm/llama.go
+index f23d5d8..6563550 100644
+--- a/llm/llama.go
++++ b/llm/llama.go
+@@ -25,7 +25,6 @@ import (
+ 	"github.com/jmorganca/ollama/api"
+ )
+ 
+-//go:embed llama.cpp/*/build/*/bin/*
+ var llamaCppEmbed embed.FS
+ 
+ type ModelRunner struct {
+@@ -33,6 +32,10 @@ type ModelRunner struct {
+ }
+ 
+ func chooseRunners(workDir, runnerType string) []ModelRunner {
++	return []ModelRunner{
++		{Path: "@llamaCppServer@"},
++	}
++
+ 	buildPath := path.Join("llama.cpp", runnerType, "build")
+ 	var runners []string
+ 
diff --git a/pkgs/tools/misc/otel-cli/default.nix b/pkgs/tools/misc/otel-cli/default.nix
index 9a2aca663972..635e8ee10185 100644
--- a/pkgs/tools/misc/otel-cli/default.nix
+++ b/pkgs/tools/misc/otel-cli/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "otel-cli";
-  version = "0.4.0";
+  version = "0.4.1";
 
   src = fetchFromGitHub {
     owner = "equinix-labs";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-xIvxjmrZd/2eT2JAagH+mMyYkDjc7La5dUqsmNnOtrc=";
+    hash = "sha256-kOTReHG7byOqKsaVrXXNq9DAyawTz4hUeR4Q5lJKmiM=";
   };
 
-  vendorHash = "sha256-mnMtvR2r5HbKC0P5iGFkwLcpx3IvmhgCI8/CCVJunXw=";
+  vendorHash = "sha256-HwbEqWtOqiTe5Z/MtMAs63Lzvll/vgmbCpMTREXgtXA=";
 
   preCheck = ''
     ln -s $GOPATH/bin/otel-cli .
diff --git a/pkgs/tools/misc/pfetch-rs/default.nix b/pkgs/tools/misc/pfetch-rs/default.nix
index 4ceed388cd4b..6291d24e2336 100644
--- a/pkgs/tools/misc/pfetch-rs/default.nix
+++ b/pkgs/tools/misc/pfetch-rs/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "pfetch-rs";
-  version = "2.7.0";
+  version = "2.8.1";
 
   src = fetchFromGitHub {
     owner = "Gobidev";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-KNd6EKYxuSNvWXNERZ+ZGq3HzRbE75LZPcAlfB4Aoyw=";
+    hash = "sha256-/eVtI+Uvb0r1af20MlQU8sDSNf6YyIBvFKSVp47JMfQ=";
   };
 
-  cargoHash = "sha256-Zxtf1OPsafm/BexDsHKb4Ei/ca3Nxz7c/U/A0AnAAI4=";
+  cargoHash = "sha256-eEBtrMF6dl5TzOZHnqjX4Yz2SfknGM2bzJcQWQIctPc=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
     darwin.apple_sdk.frameworks.AppKit
diff --git a/pkgs/tools/misc/vector/Cargo.lock b/pkgs/tools/misc/vector/Cargo.lock
index e74b6b2c2107..c3e659723df5 100644
--- a/pkgs/tools/misc/vector/Cargo.lock
+++ b/pkgs/tools/misc/vector/Cargo.lock
@@ -655,7 +655,7 @@ dependencies = [
  "once_cell",
  "rand 0.8.5",
  "regex",
- "ring",
+ "ring 0.16.20",
  "rustls 0.21.7",
  "rustls-native-certs",
  "rustls-pemfile",
@@ -808,7 +808,7 @@ dependencies = [
  "hex",
  "http",
  "hyper",
- "ring",
+ "ring 0.16.20",
  "time",
  "tokio",
  "tower",
@@ -5863,7 +5863,7 @@ dependencies = [
  "num-bigint",
  "oauth2",
  "rand 0.8.5",
- "ring",
+ "ring 0.16.20",
  "serde",
  "serde-value",
  "serde_derive",
@@ -7280,12 +7280,26 @@ dependencies = [
  "libc",
  "once_cell",
  "spin 0.5.2",
- "untrusted",
+ "untrusted 0.7.1",
  "web-sys",
  "winapi",
 ]
 
 [[package]]
+name = "ring"
+version = "0.17.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9babe80d5c16becf6594aa32ad2be8fe08498e7ae60b77de8df700e67f191d7e"
+dependencies = [
+ "cc",
+ "getrandom 0.2.10",
+ "libc",
+ "spin 0.9.4",
+ "untrusted 0.9.0",
+ "windows-sys 0.48.0",
+]
+
+[[package]]
 name = "rkyv"
 version = "0.7.40"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -7500,7 +7514,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "539a2bfe908f471bfa933876bd1eb6a19cf2176d375f82ef7f99530a40e48c2c"
 dependencies = [
  "log",
- "ring",
+ "ring 0.16.20",
  "sct",
  "webpki",
 ]
@@ -7512,7 +7526,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cd8d6c9f025a446bc4d18ad9632e69aec8f287aa84499ee335599fabd20c3fd8"
 dependencies = [
  "log",
- "ring",
+ "ring 0.16.20",
  "rustls-webpki",
  "sct",
 ]
@@ -7544,8 +7558,8 @@ version = "0.101.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7d93931baf2d282fff8d3a532bbfd7653f734643161b87e3e01e59a04439bf0d"
 dependencies = [
- "ring",
- "untrusted",
+ "ring 0.16.20",
+ "untrusted 0.7.1",
 ]
 
 [[package]]
@@ -7665,8 +7679,8 @@ version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d53dcdb7c9f8158937a7981b48accfd39a43af418591a5d008c7b22b5e1b7ca4"
 dependencies = [
- "ring",
- "untrusted",
+ "ring 0.16.20",
+ "untrusted 0.7.1",
 ]
 
 [[package]]
@@ -8812,27 +8826,15 @@ dependencies = [
 
 [[package]]
 name = "tokio-tungstenite"
-version = "0.18.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "54319c93411147bced34cb5609a80e0a8e44c5999c93903a81cd866630ec0bfd"
-dependencies = [
- "futures-util",
- "log",
- "tokio",
- "tungstenite 0.18.0",
-]
-
-[[package]]
-name = "tokio-tungstenite"
-version = "0.20.0"
+version = "0.20.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b2dbec703c26b00d74844519606ef15d09a7d6857860f84ad223dec002ddea2"
+checksum = "212d5dcb2a1ce06d81107c3d0ffa3121fe974b73f068c8282cb1c32328113b6c"
 dependencies = [
  "futures-util",
  "log",
  "rustls 0.21.7",
  "tokio",
- "tungstenite 0.20.0",
+ "tungstenite",
 ]
 
 [[package]]
@@ -9287,28 +9289,9 @@ checksum = "59547bce71d9c38b83d9c0e92b6066c4253371f15005def0c30d9657f50c7642"
 
 [[package]]
 name = "tungstenite"
-version = "0.18.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "30ee6ab729cd4cf0fd55218530c4522ed30b7b6081752839b68fcec8d0960788"
-dependencies = [
- "base64 0.13.1",
- "byteorder",
- "bytes 1.5.0",
- "http",
- "httparse",
- "log",
- "rand 0.8.5",
- "sha1",
- "thiserror",
- "url",
- "utf-8",
-]
-
-[[package]]
-name = "tungstenite"
-version = "0.20.0"
+version = "0.20.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e862a1c4128df0112ab625f55cd5c934bcb4312ba80b39ae4b4835a3fd58e649"
+checksum = "9e3dac10fd62eaf6617d3a904ae222845979aec67c615d1c842b4002c7666fb9"
 dependencies = [
  "byteorder",
  "bytes 1.5.0",
@@ -9497,6 +9480,12 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a156c684c91ea7d62626509bce3cb4e1d9ed5c4d978f7b4352658f96a4c26b4a"
 
 [[package]]
+name = "untrusted"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
+
+[[package]]
 name = "uom"
 version = "0.31.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -9609,7 +9598,7 @@ checksum = "f1bddf1187be692e79c5ffeab891132dfb0f236ed36a43c7ed39f1165ee20191"
 
 [[package]]
 name = "vector"
-version = "0.33.0"
+version = "0.33.1"
 dependencies = [
  "apache-avro",
  "approx",
@@ -9772,7 +9761,7 @@ dependencies = [
  "tokio-postgres",
  "tokio-stream",
  "tokio-test",
- "tokio-tungstenite 0.20.0",
+ "tokio-tungstenite",
  "tokio-util",
  "toml 0.8.0",
  "tonic 0.10.1",
@@ -9822,7 +9811,7 @@ dependencies = [
  "serde_json",
  "tokio",
  "tokio-stream",
- "tokio-tungstenite 0.20.0",
+ "tokio-tungstenite",
  "url",
  "uuid",
 ]
@@ -10256,9 +10245,9 @@ dependencies = [
 
 [[package]]
 name = "warp"
-version = "0.3.5"
+version = "0.3.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba431ef570df1287f7f8b07e376491ad54f84d26ac473489427231e1718e1f69"
+checksum = "c1e92e22e03ff1230c03a1a8ee37d2f89cd489e2e541b7550d6afad96faed169"
 dependencies = [
  "bytes 1.5.0",
  "futures-channel",
@@ -10278,7 +10267,7 @@ dependencies = [
  "serde_urlencoded",
  "tokio",
  "tokio-stream",
- "tokio-tungstenite 0.18.0",
+ "tokio-tungstenite",
  "tokio-util",
  "tower-service",
  "tracing 0.1.37",
@@ -10404,12 +10393,12 @@ dependencies = [
 
 [[package]]
 name = "webpki"
-version = "0.22.1"
+version = "0.22.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0e74f82d49d545ad128049b7e88f6576df2da6b02e9ce565c6f533be576957e"
+checksum = "ed63aea5ce73d0ff405984102c42de94fc55a6b75765d621c65262469b3c9b53"
 dependencies = [
- "ring",
- "untrusted",
+ "ring 0.17.3",
+ "untrusted 0.9.0",
 ]
 
 [[package]]
diff --git a/pkgs/tools/misc/vector/default.nix b/pkgs/tools/misc/vector/default.nix
index c50d136d051e..911d7671ee59 100644
--- a/pkgs/tools/misc/vector/default.nix
+++ b/pkgs/tools/misc/vector/default.nix
@@ -34,7 +34,7 @@
 
 let
   pname = "vector";
-  version = "0.33.0";
+  version = "0.33.1";
 in
 rustPlatform.buildRustPackage {
   inherit pname version;
@@ -43,7 +43,7 @@ rustPlatform.buildRustPackage {
     owner = "vectordotdev";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-ZhRvQQ0MxEd0Ry6sfEWUzYpEN80GhBOzpbEG5ZhCA2E=";
+    hash = "sha256-SjTXzLDxQ8tPSFirGCiUkgJbCHRRRK5Fr0CKgJ189Yc=";
   };
 
   cargoLock = {
diff --git a/pkgs/tools/security/cnspec/default.nix b/pkgs/tools/security/cnspec/default.nix
index 2b51ba0f7f94..0f4c544f8f48 100644
--- a/pkgs/tools/security/cnspec/default.nix
+++ b/pkgs/tools/security/cnspec/default.nix
@@ -5,17 +5,17 @@
 
 buildGoModule rec {
   pname = "cnspec";
-  version = "9.4.0";
+  version = "9.5.0";
 
   src = fetchFromGitHub {
     owner = "mondoohq";
     repo = "cnspec";
     rev = "refs/tags/v${version}";
-    hash = "sha256-rAvSC+MqgS47n/DFbGoeyvN1GyidvQ37TS+buSYwxME=";
+    hash = "sha256-XDsZyDTULetUnV0zFn6ZhP/2MJN0gs/HlvWmdeTa0NU=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-xghScwfR82Q9lhx2cNc1JZShppCKQR+tZynk+ee/81c=";
+  vendorHash = "sha256-XX+prBSq9mwwnGFBDe2g0un/ZaF+DTXxymq8lfr2xiM=";
 
   subPackages = [
     "apps/cnspec"
diff --git a/pkgs/tools/security/exploitdb/default.nix b/pkgs/tools/security/exploitdb/default.nix
index a227705ec8df..e0c46ca61f06 100644
--- a/pkgs/tools/security/exploitdb/default.nix
+++ b/pkgs/tools/security/exploitdb/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "exploitdb";
-  version = "2023-11-02";
+  version = "2023-11-03";
 
   src = fetchFromGitLab {
     owner = "exploit-database";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-7j2HIYEYs1OcB919S3lLGYNsJzbkE3jIqq2MNCHG3lY=";
+    hash = "sha256-Ent0FQI2ZCmgQA98bZxGjKW12fj/0yicZ/UFUgfT0yw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/security/gau/default.nix b/pkgs/tools/security/gau/default.nix
index 1a67b89855f9..eea5df85162c 100644
--- a/pkgs/tools/security/gau/default.nix
+++ b/pkgs/tools/security/gau/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "gau";
-  version = "2.2.0";
+  version = "2.2.1";
 
   src = fetchFromGitHub {
     owner = "lc";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-09Mf6KmTO3gper7txhvPZ/lb/cFOTDWicpu7+JrNrbo=";
+    sha256 = "sha256-AtKakeQnxRbFAbK/aQ4OQoEowN753jm4P4M57Oo3x1Y=";
   };
 
   vendorHash = "sha256-nhsGhuX5AJMHg+zQUt1G1TwVgMCxnuJ2T3uBrx7bJNs=";
diff --git a/pkgs/tools/security/oauth2c/default.nix b/pkgs/tools/security/oauth2c/default.nix
index b576bad13727..c4e187ea53ed 100644
--- a/pkgs/tools/security/oauth2c/default.nix
+++ b/pkgs/tools/security/oauth2c/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "oauth2c";
-  version = "1.12.0";
+  version = "1.12.1";
 
   src = fetchFromGitHub {
     owner = "cloudentity";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-7WZJdB4D1UnveAgf8+aZlE/4+d0rUIPIYqG5k993nk4=";
+    hash = "sha256-Qb4eES7xT/bQTMtcpFy6aQ7n5U/0yA1GXdTR9ga3aYU=";
   };
 
-  vendorHash = "sha256-euEmslrSbXPVDNZkIguq+ukt74Um4H0+lIXEyCBorjE=";
+  vendorHash = "sha256-+rkRo9zY3dRqElKApkbaBrDW8SqilqlGAhOM9vDeQps=";
 
   doCheck = false; # tests want to talk to oauth2c.us.authz.cloudentity.io
 
diff --git a/pkgs/tools/system/nkeys/default.nix b/pkgs/tools/system/nkeys/default.nix
index 9914e6f14243..a9328067463a 100644
--- a/pkgs/tools/system/nkeys/default.nix
+++ b/pkgs/tools/system/nkeys/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "nkeys";
-  version = "0.4.5";
+  version = "0.4.6";
 
   src = fetchFromGitHub {
     owner = "nats-io";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-txPd4Q/ApaNutt2Ik5E2478tHAQmpTJQKYnHA9niz3E=";
+    hash = "sha256-Sgj4+akOs/3fnpP0YDoRY9WwSk4uwtIPyPilutDXOlE=";
   };
 
-  vendorHash = "sha256-ozK0vimYs7wGplw1QhSu+q8R+YsIYHU4m08a7K6i78I=";
+  vendorHash = "sha256-8EfOtCiYCGmhGtZdPiFyNzBj+QsPx67vwFDMZ6ATidc=";
 
   meta = with lib; {
     description = "Public-key signature system for NATS";
diff --git a/pkgs/tools/virtualization/awsebcli/default.nix b/pkgs/tools/virtualization/awsebcli/default.nix
index 581b7ee70ec2..594b7a30b2ed 100644
--- a/pkgs/tools/virtualization/awsebcli/default.nix
+++ b/pkgs/tools/virtualization/awsebcli/default.nix
@@ -93,5 +93,6 @@ with localPython.pkgs; buildPythonApplication rec {
     changelog = "https://github.com/aws/aws-elastic-beanstalk-cli/blob/${version}/CHANGES.rst";
     maintainers = with maintainers; [ eqyiel kirillrdy ];
     license = licenses.asl20;
+    mainProgram = "eb";
   };
 }
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 2b5fa88e0f0d..90ffb7cbc7dc 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -92,6 +92,9 @@ mapAliases ({
   bird2 = bird; # Added 2022-02-21
   bitwig-studio1 = throw "bitwig-studio1 has been removed, you can upgrade to 'bitwig-studio'"; # Added 2023-01-03
   bitwig-studio2 = throw "bitwig-studio2 has been removed, you can upgrade to 'bitwig-studio'"; # Added 2023-01-03
+  blender-with-packages = args:
+    lib.warn "blender-with-packages is deprecated in favor of blender.withPackages, e.g. `blender.withPackages(ps: [ ps.foobar ])`"
+    (blender.withPackages (_: args.packages)).overrideAttrs (lib.optionalAttrs (args ? name) { pname = "blender-" + args.name; }); # Added 2023-10-30
   bluezFull = throw "'bluezFull' has been renamed to/replaced by 'bluez'"; # Converted to throw 2023-09-10
   boost168 = throw "boost168 has been deprecated in favor of the latest version"; # Added 2023-06-08
   boost169 = throw "boost169 has been deprecated in favor of the latest version"; # Added 2023-06-08
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 41bc1085d66f..2d8aff9d1570 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1770,7 +1770,7 @@ with pkgs;
 
   fastfetch = darwin.apple_sdk_11_0.callPackage ../tools/misc/fastfetch {
     inherit (darwin.apple_sdk_11_0.frameworks)
-    AppKit Cocoa CoreDisplay CoreVideo CoreWLAN DisplayServices
+    AppKit Apple80211 Cocoa CoreDisplay CoreVideo CoreWLAN DisplayServices
     Foundation IOBluetooth MediaRemote OpenCL;
 
     inherit (darwin) moltenvk;
@@ -30693,8 +30693,6 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) Cocoa CoreGraphics ForceFeedback OpenAL OpenGL;
   };
 
-  blender-with-packages = callPackage ../applications/misc/blender/wrapper.nix { };
-
   blender-hip = blender.override { hipSupport = true; };
 
   blflash = callPackage ../tools/misc/blflash { };