Merge master into staging-next

44 files changed, 433 insertions, 190 deletions

diff --git a/COPYING b/COPYING
index 93cbc590f450..40eae096b709 100644
--- a/COPYING
+++ b/COPYING
@@ -1,4 +1,4 @@
-Copyright (c) 2003-2023 Eelco Dolstra and the Nixpkgs/NixOS contributors
+Copyright (c) 2003-2024 Eelco Dolstra and the Nixpkgs/NixOS contributors
 
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the
diff --git a/lib/systems/inspect.nix b/lib/systems/inspect.nix
index 38ca9967cdde..c6a33781ae28 100644
--- a/lib/systems/inspect.nix
+++ b/lib/systems/inspect.nix
@@ -48,6 +48,7 @@ rec {
     isRiscV64      = { cpu = { family = "riscv"; bits = 64; }; };
     isRx           = { cpu = { family = "rx"; }; };
     isSparc        = { cpu = { family = "sparc"; }; };
+    isSparc64      = { cpu = { family = "sparc"; bits = 64; }; };
     isWasm         = { cpu = { family = "wasm"; }; };
     isMsp430       = { cpu = { family = "msp430"; }; };
     isVc4          = { cpu = { family = "vc4"; }; };
diff --git a/nixos/doc/manual/release-notes/rl-2405.section.md b/nixos/doc/manual/release-notes/rl-2405.section.md
index ebb401cc42f0..05c06ebcac1b 100644
--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@@ -250,6 +250,9 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 - `services.postgresql.extraPlugins` changed its type from just a list of packages to also a function that returns such a list.
   For example a config line like ``services.postgresql.extraPlugins = with pkgs.postgresql_11.pkgs; [ postgis ];`` is recommended to be changed to ``services.postgresql.extraPlugins = ps: with ps; [ postgis ];``;
 
+- The Matrix homeserver [Synapse](https://element-hq.github.io/synapse/) module now supports configuring UNIX domain socket [listeners](#opt-services.matrix-synapse.settings.listeners) through the `path` option.
+  The default replication worker on the main instance has been migrated away from TCP sockets to UNIX domain sockets.
+
 - Programs written in [Nim](https://nim-lang.org/) are built with libraries selected by lockfiles.
   The `nimPackages` and `nim2Packages` sets have been removed.
   See https://nixos.org/manual/nixpkgs/unstable#nim for more information.
diff --git a/nixos/maintainers/scripts/ec2/README.md b/nixos/maintainers/scripts/ec2/README.md
new file mode 100644
index 000000000000..1328109d464a
--- /dev/null
+++ b/nixos/maintainers/scripts/ec2/README.md
@@ -0,0 +1,7 @@
+# Amazon images
+
+* The `create-amis.sh` script will be replaced by https://github.com/NixOS/amis which will regularly upload AMIs per NixOS channel bump.
+
+* @arianvp is planning to drop zfs support
+* @arianvp is planning to rewrite the image builder to use the repart-based image builder.
+
diff --git a/nixos/maintainers/scripts/ec2/amazon-image.nix b/nixos/maintainers/scripts/ec2/amazon-image.nix
index d12339bca1f8..055d44ba6576 100644
--- a/nixos/maintainers/scripts/ec2/amazon-image.nix
+++ b/nixos/maintainers/scripts/ec2/amazon-image.nix
@@ -157,4 +157,6 @@ in {
       '';
     };
   in if config.ec2.zfs.enable then zfsBuilder else extBuilder;
+
+  meta.maintainers = with maintainers; [ arianvp ];
 }
diff --git a/nixos/modules/services/matrix/synapse.md b/nixos/modules/services/matrix/synapse.md
index f270be8c8d78..9c9c025fc5f5 100644
--- a/nixos/modules/services/matrix/synapse.md
+++ b/nixos/modules/services/matrix/synapse.md
@@ -126,8 +126,9 @@ then enable `services.matrix-synapse.settings.enable_registration = true;`.
 Otherwise, or you can generate a registration secret with
 {command}`pwgen -s 64 1` and set it with
 [](#opt-services.matrix-synapse.settings.registration_shared_secret).
-To create a new user or admin, run the following after you have set the secret
-and have rebuilt NixOS:
+To create a new user or admin from the terminal your client listener
+must be configured to use TCP sockets. Then you can run the following
+after you have set the secret and have rebuilt NixOS:
 ```ShellSession
 $ nix-shell -p matrix-synapse
 $ register_new_matrix_user -k your-registration-shared-secret http://localhost:8008
diff --git a/nixos/modules/services/matrix/synapse.nix b/nixos/modules/services/matrix/synapse.nix
index 4c1c396eac05..e3f9c7742cc7 100644
--- a/nixos/modules/services/matrix/synapse.nix
+++ b/nixos/modules/services/matrix/synapse.nix
@@ -6,8 +6,16 @@ let
   cfg = config.services.matrix-synapse;
   format = pkgs.formats.yaml { };
 
+  filterRecursiveNull = o:
+    if isAttrs o then
+      mapAttrs (_: v: filterRecursiveNull v) (filterAttrs (_: v: v != null) o)
+    else if isList o then
+      map filterRecursiveNull (filter (v: v != null) o)
+    else
+      o;
+
   # remove null values from the final configuration
-  finalSettings = lib.filterAttrsRecursive (_: v: v != null) cfg.settings;
+  finalSettings = filterRecursiveNull cfg.settings;
   configFile = format.generate "homeserver.yaml" finalSettings;
 
   usePostgresql = cfg.settings.database.name == "psycopg2";
@@ -105,6 +113,19 @@ let
         SYSLOG_IDENTIFIER = logName;
       };
     });
+
+  toIntBase8 = str:
+    lib.pipe str [
+      lib.stringToCharacters
+      (map lib.toInt)
+      (lib.foldl (acc: digit: acc * 8 + digit) 0)
+    ];
+
+  toDecimalFilePermission = value:
+    if value == null then
+      null
+    else
+      toIntBase8 value;
 in {
 
   imports = [
@@ -192,10 +213,11 @@ in {
   ];
 
   options = let
-    listenerType = workerContext: types.submodule {
+    listenerType = workerContext: types.submodule ({ config, ... }: {
       options = {
         port = mkOption {
-          type = types.port;
+          type = types.nullOr types.port;
+          default = null;
           example = 8448;
           description = lib.mdDoc ''
             The port to listen for HTTP(S) requests on.
@@ -203,11 +225,20 @@ in {
         };
 
         bind_addresses = mkOption {
-          type = types.listOf types.str;
-          default = [
+          type = types.nullOr (types.listOf types.str);
+          default = if config.path != null then null else [
             "::1"
             "127.0.0.1"
           ];
+          defaultText = literalExpression ''
+            if path != null then
+              null
+            else
+              [
+                "::1"
+                "127.0.0.1"
+              ]
+          '';
           example = literalExpression ''
             [
               "::"
@@ -219,6 +250,35 @@ in {
           '';
         };
 
+        path = mkOption {
+          type = types.nullOr types.path;
+          default = null;
+          description = ''
+            Unix domain socket path to bind this listener to.
+
+            ::: {.note}
+              This option is incompatible with {option}`bind_addresses`, {option}`port`, {option}`tls`
+              and also does not support the `metrics` and `manhole` listener {option}`type`.
+            :::
+          '';
+        };
+
+        mode = mkOption {
+          type = types.nullOr (types.strMatching "^[0,2-7]{3,4}$");
+          default = if config.path != null then "660" else null;
+          defaultText = literalExpression ''
+            if path != null then
+              "660"
+            else
+              null
+          '';
+          example = "660";
+          description = ''
+            File permissions on the UNIX domain socket.
+          '';
+          apply = toDecimalFilePermission;
+        };
+
         type = mkOption {
           type = types.enum [
             "http"
@@ -234,17 +294,30 @@ in {
         };
 
         tls = mkOption {
-          type = types.bool;
-          default = !workerContext;
+          type = types.nullOr types.bool;
+          default = if config.path != null then
+            null
+          else
+            !workerContext;
+          defaultText = ''
+            Enabled for the main instance listener, unless it is configured with a UNIX domain socket path.
+          '';
           example = false;
           description = lib.mdDoc ''
             Whether to enable TLS on the listener socket.
+
+            ::: {.note}
+              This option will be ignored for UNIX domain sockets.
+            :::
           '';
         };
 
         x_forwarded = mkOption {
           type = types.bool;
-          default = false;
+          default = config.path != null;
+          defaultText = ''
+            Enabled if the listener is configured with a UNIX domain socket path
+          '';
           example = true;
           description = lib.mdDoc ''
             Use the X-Forwarded-For (XFF) header as the client IP and not the
@@ -291,11 +364,28 @@ in {
           '';
         };
       };
-    };
+    });
   in {
     services.matrix-synapse = {
       enable = mkEnableOption (lib.mdDoc "matrix.org synapse");
 
+      enableRegistrationScript = mkOption {
+        type = types.bool;
+        default = clientListener.bind_addresses != [];
+        example = false;
+        defaultText = ''
+          Enabled if the client listener uses TCP sockets
+        '';
+        description = ''
+          Whether to install the `register_new_matrix_user` script, that
+          allows account creation on the terminal.
+
+          ::: {.note}
+            This script does not work when the client listener uses UNIX domain sockets
+          :::
+        '';
+      };
+
       serviceUnit = lib.mkOption {
         type = lib.types.str;
         readOnly = true;
@@ -616,11 +706,8 @@ in {
                   compress = false;
                 }];
               }] ++ lib.optional hasWorkers {
-                port = 9093;
-                bind_addresses = [ "127.0.0.1" ];
+                path = "/run/matrix-synapse/main_replication.sock";
                 type = "http";
-                tls = false;
-                x_forwarded = false;
                 resources = [{
                   names = [ "replication" ];
                   compress = false;
@@ -630,7 +717,7 @@ in {
                 List of ports that Synapse should listen on, their purpose and their configuration.
 
                 By default, synapse will be configured for client and federation traffic on port 8008, and
-                for worker replication traffic on port 9093. See [`services.matrix-synapse.workers`](#opt-services.matrix-synapse.workers)
+                use a UNIX domain socket for worker replication. See [`services.matrix-synapse.workers`](#opt-services.matrix-synapse.workers)
                 for more details.
               '';
             };
@@ -1006,9 +1093,15 @@ in {
             listener = lib.findFirst
               (
                 listener:
-                  listener.port == main.port
+                  (
+                    lib.hasAttr "port" main && listener.port or null == main.port
+                    || lib.hasAttr "path" main && listener.path or null == main.path
+                  )
                   && listenerSupportsResource "replication" listener
-                  && (lib.any (bind: bind == main.host || bind == "0.0.0.0" || bind == "::") listener.bind_addresses)
+                  && (
+                    lib.hasAttr "host" main &&  lib.any (bind: bind == main.host || bind == "0.0.0.0" || bind == "::") listener.bind_addresses
+                    || lib.hasAttr "path" main
+                  )
               )
               null
               cfg.settings.listeners;
@@ -1022,15 +1115,44 @@ in {
           This is done by default unless you manually configure either of those settings.
         '';
       }
-    ];
+      {
+        assertion = cfg.enableRegistrationScript -> clientListener.path == null;
+        message = ''
+          The client listener on matrix-synapse is configured to use UNIX domain sockets.
+          This configuration is incompatible with the `register_new_matrix_user` script.
+
+          Disable  `services.mastrix-synapse.enableRegistrationScript` to continue.
+        '';
+      }
+    ]
+    ++ (map (listener: {
+      assertion = (listener.path == null) != (listener.bind_addresses == null);
+      message = ''
+        Listeners require either a UNIX domain socket `path` or `bind_addresses` for a TCP socket.
+      '';
+    }) cfg.settings.listeners)
+    ++ (map (listener: {
+      assertion = listener.path != null -> (listener.bind_addresses == null && listener.port == null && listener.tls == null);
+      message = let
+        formatKeyValue = key: value: lib.optionalString (value != null) "  - ${key}=${toString value}\n";
+      in ''
+        Listener configured with UNIX domain socket (${toString listener.path}) ignores the following options:
+        ${formatKeyValue "bind_addresses" listener.bind_addresses}${formatKeyValue "port" listener.port}${formatKeyValue "tls" listener.tls}
+      '';
+    }) cfg.settings.listeners)
+    ++ (map (listener: {
+      assertion = listener.path == null || listener.type == "http";
+      message = ''
+        Listener configured with UNIX domain socket (${toString listener.path}) only supports the "http" listener type.
+      '';
+    }) cfg.settings.listeners);
 
     services.matrix-synapse.settings.redis = lib.mkIf cfg.configureRedisLocally {
       enabled = true;
       path = config.services.redis.servers.matrix-synapse.unixSocket;
     };
     services.matrix-synapse.settings.instance_map.main = lib.mkIf hasWorkers (lib.mkDefault {
-      host = "127.0.0.1";
-      port = 9093;
+      path = "/run/matrix-synapse/main_replication.sock";
     });
 
     services.matrix-synapse.serviceUnit = if hasWorkers then "matrix-synapse.target" else "matrix-synapse.service";
@@ -1086,6 +1208,8 @@ in {
             User = "matrix-synapse";
             Group = "matrix-synapse";
             WorkingDirectory = cfg.dataDir;
+            RuntimeDirectory = "matrix-synapse";
+            RuntimeDirectoryPreserve = true;
             ExecReload = "${pkgs.util-linux}/bin/kill -HUP $MAINPID";
             Restart = "on-failure";
             UMask = "0077";
@@ -1178,7 +1302,9 @@ in {
       user = "matrix-synapse";
     };
 
-    environment.systemPackages = [ registerNewMatrixUser ];
+    environment.systemPackages = lib.optionals cfg.enableRegistrationScript [
+      registerNewMatrixUser
+    ];
   };
 
   meta = {
diff --git a/nixos/modules/services/networking/nftables.nix b/nixos/modules/services/networking/nftables.nix
index 424d005dc0b5..46fa9d2de046 100644
--- a/nixos/modules/services/networking/nftables.nix
+++ b/nixos/modules/services/networking/nftables.nix
@@ -252,8 +252,10 @@ in
     networking.nftables.flushRuleset = mkDefault (versionOlder config.system.stateVersion "23.11" || (cfg.rulesetFile != null || cfg.ruleset != ""));
     systemd.services.nftables = {
       description = "nftables firewall";
-      before = [ "network-pre.target" ];
-      wants = [ "network-pre.target" ];
+      after = [ "sysinit.target" ];
+      before = [ "network-pre.target" "shutdown.target" ];
+      conflicts = [ "shutdown.target" ];
+      wants = [ "network-pre.target" "sysinit.target" ];
       wantedBy = [ "multi-user.target" ];
       reloadIfChanged = true;
       serviceConfig = let
@@ -315,6 +317,7 @@ in
         ExecStop = [ deletionsScriptVar cleanupDeletionsScript ];
         StateDirectory = "nftables";
       };
+      unitConfig.DefaultDependencies = false;
     };
   };
 }
diff --git a/nixos/modules/virtualisation/amazon-image.nix b/nixos/modules/virtualisation/amazon-image.nix
index f0d9b95f81f6..c7fe1bed5159 100644
--- a/nixos/modules/virtualisation/amazon-image.nix
+++ b/nixos/modules/virtualisation/amazon-image.nix
@@ -103,4 +103,5 @@ in
     # (e.g. it depends on GTK).
     services.udisks2.enable = false;
   };
+  meta.maintainers = with maintainers; [ arianvp ];
 }
diff --git a/nixos/modules/virtualisation/amazon-init.nix b/nixos/modules/virtualisation/amazon-init.nix
index 8b98f2e32dd5..8475097df07c 100644
--- a/nixos/modules/virtualisation/amazon-init.nix
+++ b/nixos/modules/virtualisation/amazon-init.nix
@@ -84,4 +84,5 @@ in {
       };
     };
   };
+  meta.maintainers = with maintainers; [ arianvp ];
 }
diff --git a/nixos/modules/virtualisation/qemu-vm.nix b/nixos/modules/virtualisation/qemu-vm.nix
index 523cfa023b35..57e2c38301a0 100644
--- a/nixos/modules/virtualisation/qemu-vm.nix
+++ b/nixos/modules/virtualisation/qemu-vm.nix
@@ -701,7 +701,10 @@ in
           type = types.listOf types.str;
           default = [];
           example = [ "-vga std" ];
-          description = lib.mdDoc "Options passed to QEMU.";
+          description = lib.mdDoc ''
+            Options passed to QEMU.
+            See [QEMU User Documentation](https://www.qemu.org/docs/master/system/qemu-manpage) for a complete list.
+          '';
         };
 
       consoles = mkOption {
@@ -732,6 +735,7 @@ in
           description = lib.mdDoc ''
             Networking-related command-line options that should be passed to qemu.
             The default is to use userspace networking (SLiRP).
+            See the [QEMU Wiki on Networking](https://wiki.qemu.org/Documentation/Networking) for details.
 
             If you override this option, be advised to keep
             ''${QEMU_NET_OPTS:+,$QEMU_NET_OPTS} (as seen in the example)
diff --git a/pkgs/applications/audio/ledfx/default.nix b/pkgs/applications/audio/ledfx/default.nix
index fb1557b0d2f8..3c6d807714bf 100644
--- a/pkgs/applications/audio/ledfx/default.nix
+++ b/pkgs/applications/audio/ledfx/default.nix
@@ -5,12 +5,12 @@
 
 python3.pkgs.buildPythonPackage rec {
   pname = "ledfx";
-  version = "2.0.90";
+  version = "2.0.92";
   pyproject= true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ZlZtC0bi9ZUf/1D9hUxxhdix6F8l7Lg5IUOOg+JHGYU=";
+    hash = "sha256-tt2D8pjU/SClweAn9vHYl+H1POdB1u2SQfrnZZvBQ7I=";
   };
 
   pythonRelaxDeps = true;
diff --git a/pkgs/applications/blockchains/taproot-assets/default.nix b/pkgs/applications/blockchains/taproot-assets/default.nix
index a49b25c7be11..1012db5337ea 100644
--- a/pkgs/applications/blockchains/taproot-assets/default.nix
+++ b/pkgs/applications/blockchains/taproot-assets/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "taproot-assets";
-  version = "0.3.2";
+  version = "0.3.3";
 
   src = fetchFromGitHub {
     owner = "lightninglabs";
     repo = "taproot-assets";
     rev = "v${version}";
-    hash = "sha256-zYS/qLWYzfmLksYLCUWosT287K8La2fuu9TcT4Wytto=";
+    hash = "sha256-KEEecyZA+sVAkg2/i9AcfvPTB26Dk02r77Py87LP758=";
   };
 
   vendorHash = "sha256-jz6q3l2FtkJM3qyaTTqqu3ZG2FeKW9s7WdlW1pHij5k=";
diff --git a/pkgs/applications/misc/lutris/default.nix b/pkgs/applications/misc/lutris/default.nix
index 044553bbaba8..3ee6148ef16b 100644
--- a/pkgs/applications/misc/lutris/default.nix
+++ b/pkgs/applications/misc/lutris/default.nix
@@ -76,24 +76,15 @@ let
 in
 buildPythonApplication rec {
   pname = "lutris-unwrapped";
-  version = "0.5.14";
+  version = "0.5.16";
 
   src = fetchFromGitHub {
     owner = "lutris";
     repo = "lutris";
     rev = "v${version}";
-    hash = "sha256-h7oHFVqMJU1HuuUgh5oKXxr9uaIPHz7Q4gf8ONLzric=";
+    hash = "sha256-Ed1bhugBe97XmY050A5jCPcnLj0Fd7qPX2p/Ab+YbOE=";
   };
 
-  # Backport patch to fix a failing test
-  # FIXME: remove in next release
-  patches = [
-    (fetchpatch {
-      url = "https://github.com/lutris/lutris/commit/1f1d554df3b38da64fc65557ad619e55e050641e.patch";
-      hash = "sha256-kVK1RX6T1ijffWVU7VEt2fR62QpvI6VZebiKPgEE/N8=";
-    })
-  ];
-
   nativeBuildInputs = [ wrapGAppsHook gobject-introspection ];
   buildInputs = [
     atk
diff --git a/pkgs/applications/misc/wofi/default.nix b/pkgs/applications/misc/wofi/default.nix
index e64426365ecc..97aba94d1770 100644
--- a/pkgs/applications/misc/wofi/default.nix
+++ b/pkgs/applications/misc/wofi/default.nix
@@ -11,13 +11,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "wofi";
-  version = "1.3";
+  version = "1.4";
 
   src = fetchFromSourcehut {
     repo = pname;
     owner = "~scoopta";
     rev = "v${version}";
-    sha256 = "sha256-GxMjEXBPQniD+Yc9QZjd8TH4ILJAX5dNzrjxDawhy8w=";
+    sha256 = "sha256-zzBD1OPPlOjAUaJOlMf6k1tSai1w1ZvOwy2sSOWI7AM=";
     vc = "hg";
   };
 
diff --git a/pkgs/applications/networking/irc/hexchat/default.nix b/pkgs/applications/networking/irc/hexchat/default.nix
index 3ab70167f7ac..d6f9976ad67b 100644
--- a/pkgs/applications/networking/irc/hexchat/default.nix
+++ b/pkgs/applications/networking/irc/hexchat/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "hexchat";
-  version = "2.16.1";
+  version = "2.16.2";
 
   src = fetchFromGitHub {
     owner = "hexchat";
     repo = "hexchat";
     rev = "v${version}";
-    sha256 = "sha256-2IUlNUTL3TOJnDNMds2EWwkfn5NUOQ1ids96Ddo196E=";
+    sha256 = "sha256-rgaXqXbBWlfSyz+CT0jRLyfGOR1cYYnRhEAu7AsaWus=";
   };
 
   nativeBuildInputs = [ meson ninja pkg-config makeWrapper ];
diff --git a/pkgs/applications/search/recoll/default.nix b/pkgs/applications/search/recoll/default.nix
index 902571dd33f1..67f22a33abce 100644
--- a/pkgs/applications/search/recoll/default.nix
+++ b/pkgs/applications/search/recoll/default.nix
@@ -70,11 +70,11 @@ in
 
 mkDerivation rec {
   pname = "recoll";
-  version = "1.36.2";
+  version = "1.37.2";
 
   src = fetchurl {
     url = "https://www.lesbonscomptes.com/${pname}/${pname}-${version}.tar.gz";
-    hash = "sha256-GyQqI3ciRO0TRaAeM4rGu+j/eB4bJlQ7VBTTxUGMNt4=";
+    hash = "sha256-xLdk3pJSV1YaloSV3TuTdJhujXsxUGrDru+mu86YBTU=";
   };
 
   configureFlags = [
diff --git a/pkgs/by-name/ca/cardboard/package.nix b/pkgs/by-name/ca/cardboard/package.nix
index 4bed07f0bc57..f3fca1632ce4 100644
--- a/pkgs/by-name/ca/cardboard/package.nix
+++ b/pkgs/by-name/ca/cardboard/package.nix
@@ -127,6 +127,7 @@ stdenv.mkDerivation {
   };
 
   meta = {
+    broken = true; # Upstream is archived, fails to build on gcc-13.
     homepage = "https://gitlab.com/cardboardwm/cardboard";
     description = "A scrollable, tiling Wayland compositor inspired on PaperWM";
     license = lib.licenses.gpl3Only;
diff --git a/pkgs/by-name/cm/cmd-wrapped/package.nix b/pkgs/by-name/cm/cmd-wrapped/package.nix
new file mode 100644
index 000000000000..446188b34290
--- /dev/null
+++ b/pkgs/by-name/cm/cmd-wrapped/package.nix
@@ -0,0 +1,26 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "cmd-wrapped";
+  version = "0.1.1";
+
+  src = fetchFromGitHub {
+    owner = "YiNNx";
+    repo = "cmd-wrapped";
+    rev = version;
+    hash = "sha256-9GyeJFU8wLl2kCnrwZ+j+PwCRS17NvzgSCpulhXHYqQ=";
+  };
+
+  cargoHash = "sha256-i6LgLvLMDF696Tpn4yVA1XNuaTrABLVg3SgclHBq6Go=";
+
+  meta = with lib; {
+    description = "Find out what the past year looks like in commandline";
+    homepage = "https://github.com/YiNNx/cmd-wrapped";
+    license = licenses.mit;
+    maintainers = with maintainers; [ Cryolitia ];
+    mainProgram = "cmd-wrapped";
+  };
+}
diff --git a/pkgs/development/tools/rust/cargo-espflash/default.nix b/pkgs/by-name/es/espflash/package.nix
index b8c6243e97bd..c56f347b4709 100644
--- a/pkgs/development/tools/rust/cargo-espflash/default.nix
+++ b/pkgs/by-name/es/espflash/package.nix
@@ -12,7 +12,7 @@
 }:
 
 rustPlatform.buildRustPackage rec {
-  pname = "cargo-espflash";
+  pname = "espflash";
   version = "2.1.0";
 
   src = fetchFromGitHub {
@@ -36,13 +36,15 @@ rustPlatform.buildRustPackage rec {
     SystemConfiguration
   ];
 
-  cargoHash = "sha256-FpBc92a2JQHRLe5S6yh3l0FpRI8LpkGGEma/4v5X4xs=";
+  cargoHash = "sha256-Xj5FVTssC3e+mMhDHmKqV6lUQgaIv3aVc1yewbQSy9E=";
 
   passthru.updateScript = nix-update-script { };
 
   meta = with lib; {
     description = "Serial flasher utility for Espressif SoCs and modules based on esptool.py";
-    homepage = "https://github.com/esp-rs/cargo-espflash";
+    homepage = "https://github.com/esp-rs/espflash";
+    changelog = "https://github.com/esp-rs/espflash/blob/v${version}/CHANGELOG.md";
+    mainProgram = "espflash";
     license = with licenses; [ mit /* or */ asl20 ];
     maintainers = with maintainers; [ matthiasbeyer ];
   };
diff --git a/pkgs/by-name/oc/ocenaudio/package.nix b/pkgs/by-name/oc/ocenaudio/package.nix
index 711ff62fa6ab..98852f37c325 100644
--- a/pkgs/by-name/oc/ocenaudio/package.nix
+++ b/pkgs/by-name/oc/ocenaudio/package.nix
@@ -13,11 +13,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ocenaudio";
-  version = "3.13.3";
+  version = "3.13.4";
 
   src = fetchurl {
-    url = "https://www.ocenaudio.com/downloads/index.php/ocenaudio_debian9_64.deb?version=${version}";
-    hash = "sha256-B0+NyFZ9c0ljzYMJm3741TpoxFS0Zo6hxzhadYFofSA=";
+    url = "https://www.ocenaudio.com/downloads/index.php/ocenaudio_debian9_64.deb?version=v${version}";
+    hash = "sha256-vE+xwwkBXIksy+6oygLDsrT8mFfHYIGcb6+8KMZe0no=";
   };
 
   nativeBuildInputs = [
@@ -45,7 +45,7 @@ stdenv.mkDerivation rec {
     mv $out/usr/share $out/share
     rm -rf $out/usr
     substituteInPlace $out/share/applications/ocenaudio.desktop \
-      --replace "/opt/ocenaudio/bin/ocenaudio" "ocenaudio"
+      --replace-fail "/opt/ocenaudio/bin/ocenaudio" "ocenaudio"
     mkdir -p $out/share/licenses/ocenaudio
     mv $out/bin/ocenaudio_license.txt $out/share/licenses/ocenaudio/LICENSE
 
diff --git a/pkgs/data/themes/base16-schemes/default.nix b/pkgs/data/themes/base16-schemes/default.nix
index 674eeabc6256..b910ba8c6cf6 100644
--- a/pkgs/data/themes/base16-schemes/default.nix
+++ b/pkgs/data/themes/base16-schemes/default.nix
@@ -2,20 +2,20 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "base16-schemes";
-  version = "unstable-2023-05-02";
+  version = "unstable-2024-01-14";
 
   src = fetchFromGitHub {
     owner = "tinted-theming";
-    repo = "base16-schemes";
-    rev = "9a4002f78dd1094c123169da243680b2fda3fe69";
-    sha256 = "sha256-AngNF++RZQB0l4M8pRgcv66pAcIPY+cCwmUOd+RBJKA=";
+    repo = "schemes";
+    rev = "395074124283df993571f2abb9c713f413b76e6e";
+    sha256 = "sha256-9LmwYbtTxNFiP+osqRUbOXghJXpYvyvAwBwW80JMO7s=";
   };
 
   installPhase = ''
     runHook preInstall
 
     mkdir -p $out/share/themes/
-    install *.yaml $out/share/themes/
+    install base16/*.yaml $out/share/themes/
 
     runHook postInstall
   '';
diff --git a/pkgs/desktops/cinnamon/cinnamon-session/default.nix b/pkgs/desktops/cinnamon/cinnamon-session/default.nix
index 7352c5549b23..66044ccefc4f 100644
--- a/pkgs/desktops/cinnamon/cinnamon-session/default.nix
+++ b/pkgs/desktops/cinnamon/cinnamon-session/default.nix
@@ -32,13 +32,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "cinnamon-session";
-  version = "6.0.3";
+  version = "6.0.4";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = pname;
     rev = version;
-    hash = "sha256-dNg1e339NWRzyEsRp7I91SwK2H+lU28Ra+7MSgUDk8w=";
+    hash = "sha256-GtaoqzcnpKbiP4OqhnLkNWzZTUqX/KgVE6JImNMkdGo=";
   };
 
   patches = [
diff --git a/pkgs/development/compilers/zulu/11.nix b/pkgs/development/compilers/zulu/11.nix
index 9272dc75c3e8..afe33634820c 100644
--- a/pkgs/development/compilers/zulu/11.nix
+++ b/pkgs/development/compilers/zulu/11.nix
@@ -8,35 +8,35 @@ callPackage ./common.nix ({
   # Note that the latest build may differ by platform
   dists = {
     x86_64-linux = {
-      zuluVersion = "11.66.15";
-      jdkVersion = "11.0.20";
+      zuluVersion = "11.70.15";
+      jdkVersion = "11.0.22";
       hash =
-        if enableJavaFX then "sha256-CjWtqnirEDrpF61WXm/Yi372IzhpTpi+/AfEqirlZnc="
-        else "sha256-o0tAT4egimEUizjhQW2DcYnh33oEDZSedDYz2vRpWjw=";
+        if enableJavaFX then "sha256-FxTHgng7/oDY3n3qy8j1ztbpBQeoGcEBJbEXqaE4Zr4="
+        else "sha256-V41ZRrJtkle3joKhwoID5bvWkN5I4gFjmbEnTD7no8U=";
     };
 
     aarch64-linux = {
-      zuluVersion = "11.66.15";
-      jdkVersion = "11.0.20";
+      zuluVersion = "11.70.15";
+      jdkVersion = "11.0.22";
       hash =
         if enableJavaFX then throw "JavaFX is not available for aarch64-linux"
-        else "sha256-VBdEOfKz/d0R8QSMOX/nu0XUydZtRS1oibAT0E0hxN4=";
+        else "sha256-u6XWMXAArUhMMb6j3KFOhkIxpVYR1oYLF0Wde7/tI0k=";
     };
 
     x86_64-darwin = {
-      zuluVersion = "11.66.15";
-      jdkVersion = "11.0.20";
+      zuluVersion = "11.70.15";
+      jdkVersion = "11.0.22";
       hash =
-        if enableJavaFX then "sha256-pVgCJkgYTlFeL7nkkMWLeJ/J8ELhgvWb7gzf3erZP7Y="
-        else "sha256-vKqxHP5Yb651g8bZ0xHGQ4Q1T7JjjrmgEuykw/Gh2f0=";
+        if enableJavaFX then "sha256-JkJZwk+D28wHWqwUoLo7WW5ypwTrT5biSoP+70YI3eQ="
+        else "sha256-ca/ttkPe2tbcm1ruguDgPsxKWbEdKcICsKCDXaup9N4=";
     };
 
     aarch64-darwin = {
-      zuluVersion = "11.66.15";
-      jdkVersion = "11.0.20";
+      zuluVersion = "11.70.15";
+      jdkVersion = "11.0.22";
       hash =
-        if enableJavaFX then "sha256-VoZo34SCUU+HHnTl6iLe0QBC+4VDkPP14N98oqSg9EQ="
-        else "sha256-djK8Kfikt9SSuT87x1p7YWMIlNuF0TZFYDWrKiTTiIU=";
+        if enableJavaFX then "sha256-bAgH4lCxPvvFOeif5gI2aoLt1aC4EXPzb2YmiS9bQsU="
+        else "sha256-PWQOF+P9djZarjAJaE3I0tuI1E4H/9584VN04BMzmvM=";
     };
   };
 } // builtins.removeAttrs args [ "callPackage" ])
diff --git a/pkgs/development/compilers/zulu/8.nix b/pkgs/development/compilers/zulu/8.nix
index 91aaaf06cd13..05411149da68 100644
--- a/pkgs/development/compilers/zulu/8.nix
+++ b/pkgs/development/compilers/zulu/8.nix
@@ -8,27 +8,35 @@ callPackage ./common.nix ({
   # Note that the latest build may differ by platform
   dists = {
     x86_64-linux = {
-      zuluVersion = "8.72.0.17";
-      jdkVersion = "8.0.382";
+      zuluVersion = "8.76.0.17";
+      jdkVersion = "8.0.402";
       hash =
-        if enableJavaFX then "sha256-mIPCFESU7hy2naYur2jvFBtVn/LZQRcFiyiG61buCYs="
-        else "sha256-exWlbyrgBb7aD4daJps9qtFP+hKWkwbMdFR4OFslupY=";
+        if enableJavaFX then "sha256-29aDAu8WVYQFSpMUFq4gG64BBz/ei/VDMg72xrpB9w4="
+        else "sha256-34DI6O7T8iqDHsX63S3xk+BKDu8IHRRWNvtxpsnUJEk=";
+    };
+
+    aarch64-linux = {
+      zuluVersion = "8.74.0.17";
+      jdkVersion = "8.0.392";
+      hash =
+        if enableJavaFX then throw "JavaFX is not available for aarch64-linux"
+        else "sha256-xESdKEmfkiE657X/xclwsJR5M+P72BpWErtAcYMcK0Y=";
     };
 
     x86_64-darwin = {
-      zuluVersion = "8.72.0.17";
-      jdkVersion = "8.0.382";
+      zuluVersion = "8.76.0.17";
+      jdkVersion = "8.0.402";
       hash =
-        if enableJavaFX then "sha256-/x8FqygivzddXsOwIV8aj/u+LPXMmokgu97vLAVEv80="
-        else "sha256-3dTPIPGUeT6nb3gncNvEa4VTRyQIBJpp8oZadrT2ToE=";
+        if enableJavaFX then "sha256-oqFpKeWwfiXr3oX78LGvAyDGAAS2GON2gAm6fHGH7Ow="
+        else "sha256-edZqDEsydQCDEwC1ZCDF/MjWVTnuQNWcKR2k/RjaIEI=";
     };
 
     aarch64-darwin = {
-      zuluVersion = "8.72.0.17";
-      jdkVersion = "8.0.382";
+      zuluVersion = "8.76.0.17";
+      jdkVersion = "8.0.402";
       hash =
-        if enableJavaFX then "sha256-FkQ+0MzSZWUzc/HmiDVZEHGOrdKAVCdK5pm9wXXzzaU="
-        else "sha256-rN5AI4xAWppE4kJlzMod0JmGyHdHjTXYtx8/wOW6CFk=";
+        if enableJavaFX then "sha256-UCWRXCz4v381IWzWPDYzwJwbhsmZOYxKPLGJBQGjPmc="
+        else "sha256-0VPlOuNB39gDnU+pK0DGTSUjTHTtYoxaRg3YD2LyLXg=";
     };
   };
 } // builtins.removeAttrs args [ "callPackage" ])
diff --git a/pkgs/development/coq-modules/mathcomp-analysis/default.nix b/pkgs/development/coq-modules/mathcomp-analysis/default.nix
index 5cbfbdf0c6f4..3703eee0e588 100644
--- a/pkgs/development/coq-modules/mathcomp-analysis/default.nix
+++ b/pkgs/development/coq-modules/mathcomp-analysis/default.nix
@@ -9,6 +9,9 @@ let
   repo  = "analysis";
   owner = "math-comp";
 
+  release."1.0.0".sha256 = "sha256-KiXyaWB4zQ3NuXadq4BSWfoN1cIo1xiLVSN6nW03tC4=";
+  release."0.7.0".sha256 = "sha256-JwkyetXrFsFHqz8KY3QBpHsrkhmEFnrCGuKztcoen60=";
+  release."0.6.7".sha256 = "sha256-3i2PBMEwihwgwUmnS0cmrZ8s+aLPFVq/vo0aXMUaUyA=";
   release."0.6.6".sha256 = "sha256-tWtv6yeB5/vzwpKZINK9OQ0yQsvD8qu9zVSNHvLMX5Y=";
   release."0.6.5".sha256 = "sha256-oJk9/Jl1SWra2aFAXRAVfX7ZUaDfajqdDksYaW8dv8E=";
   release."0.6.1".sha256 = "sha256-1VyNXu11/pDMuH4DmFYSUF/qZ4Bo+/Zl3Y0JkyrH/r0=";
@@ -26,10 +29,13 @@ let
   release."0.2.3".sha256 = "0p9mr8g1qma6h10qf7014dv98ln90dfkwn76ynagpww7qap8s966";
 
   defaultVersion = with versions; lib.switch [ coq.version mathcomp.version ]  [
-      { cases = [ (isGe "8.17") (range "1.15.0" "1.18.0") ];     out = "0.6.6"; }
-      { cases = [ (isGe "8.14") (range "1.15.0" "1.17.0") ];     out = "0.6.5"; }
-      { cases = [ (isGe "8.14") (range "1.13.0" "1.16.0") ];     out = "0.6.1"; }
-      { cases = [ (isGe "8.14") (range "1.13" "1.15") ];         out = "0.5.2"; }
+      { cases = [ (range "8.17" "8.19") (range "2.0.0" "2.2.0") ]; out = "1.0.0"; }
+      { cases = [ (range "8.17" "8.19") (range "1.17.0" "1.19.0") ]; out = "0.7.0"; }
+      { cases = [ (range "8.17" "8.18") (range "1.15.0" "1.18.0") ]; out = "0.6.7"; }
+      { cases = [ (range "8.17" "8.18") (range "1.15.0" "1.18.0") ]; out = "0.6.6"; }
+      { cases = [ (range "8.14" "8.18") (range "1.15.0" "1.17.0") ]; out = "0.6.5"; }
+      { cases = [ (range "8.14" "8.18") (range "1.13.0" "1.16.0") ]; out = "0.6.1"; }
+      { cases = [ (range "8.14" "8.18") (range "1.13" "1.15") ]; out = "0.5.2"; }
       { cases = [ (range "8.13" "8.15") (range "1.13" "1.14") ]; out = "0.5.1"; }
       { cases = [ (range "8.13" "8.15") (range "1.12" "1.14") ]; out = "0.3.13"; }
       { cases = [ (range "8.11" "8.14") (range "1.12" "1.13") ]; out = "0.3.10"; }
diff --git a/pkgs/development/coq-modules/mathcomp-infotheo/default.nix b/pkgs/development/coq-modules/mathcomp-infotheo/default.nix
index a649916892a8..6a14e67844c8 100644
--- a/pkgs/development/coq-modules/mathcomp-infotheo/default.nix
+++ b/pkgs/development/coq-modules/mathcomp-infotheo/default.nix
@@ -1,14 +1,17 @@
-{ coq, mkCoqDerivation, mathcomp-analysis, lib, version ? null }:
+{ coq, mkCoqDerivation, mathcomp-analysis, mathcomp-algebra-tactics, lib, version ? null }:
 
-mkCoqDerivation {
+(mkCoqDerivation {
   namePrefix = [ "coq" "mathcomp" ];
   pname = "infotheo";
   owner = "affeldt-aist";
   inherit version;
+
   defaultVersion = with lib.versions; lib.switch [ coq.version mathcomp-analysis.version] [
-    { cases = [ (isGe "8.17") (isGe "0.6.0") ];                  out = "0.5.2"; }
+    { cases = [ (isGe "8.17") (range "0.6.6" "0.7.0") ];         out = "0.6.1"; }
+    { cases = [ (range "8.17" "8.18") (range "0.6.0" "0.6.7") ]; out = "0.5.2"; }
     { cases = [ (range "8.15" "8.16") (range "0.5.4" "0.6.5") ]; out = "0.5.1"; }
   ] null;
+  release."0.6.1".sha256 = "sha256-tFB5lrwRPIlHkP+ebgcJwu03Cc9yVaOINOAo8Bf2LT4=";
   release."0.5.1".sha256 = "sha256-yBBl5l+V+dggsg5KM59Yo9CULKog/xxE8vrW+ZRnX7Y=";
   release."0.5.2".sha256 = "sha256-8WAnAV53c0pMTdwj8XcUDUkLZbpUgIQbEOgOb63uHQA=";
 
@@ -18,4 +21,7 @@ mkCoqDerivation {
     description = "A Coq formalization of information theory and linear error-correcting codes";
     license = licenses.lgpl21Plus;
   };
-}
+}).overrideAttrs (o: {
+  propagatedBuildInputs = o.propagatedBuildInputs
+  ++ lib.optional (lib.versions.isGe "0.6.1" o.version || o.version == "dev") mathcomp-algebra-tactics;
+})
diff --git a/pkgs/development/embedded/espflash/default.nix b/pkgs/development/embedded/espflash/default.nix
deleted file mode 100644
index 8b3540111a71..000000000000
--- a/pkgs/development/embedded/espflash/default.nix
+++ /dev/null
@@ -1,39 +0,0 @@
-{ lib
-, rustPlatform
-, fetchCrate
-, pkg-config
-, stdenv
-, udev
-, Security
-, SystemConfiguration
-}:
-
-rustPlatform.buildRustPackage rec {
-  pname = "espflash";
-  version = "2.1.0";
-
-  src = fetchCrate {
-    inherit pname version;
-    hash = "sha256-Gd+8pA36mO+BCA0EFshboBi0etNjsiQFQU1wBYf/o6I=";
-  };
-
-  nativeBuildInputs = [ pkg-config ];
-
-  buildInputs = lib.optionals stdenv.isLinux [
-    udev
-  ] ++ lib.optionals stdenv.isDarwin [
-    Security
-    SystemConfiguration
-  ];
-
-  cargoHash = "sha256-IObAbsyrVBXt5zldirRezU7vS3R3aUihMFy2yIRWIlk=";
-
-  meta = with lib; {
-    description = "Serial flasher utility for Espressif SoCs and modules";
-    homepage = "https://github.com/esp-rs/espflash";
-    changelog = "https://github.com/esp-rs/espflash/blob/v${version}/CHANGELOG.md";
-    mainProgram = "espflash";
-    license = with licenses; [ asl20 /* or */ mit ];
-    maintainers = with maintainers; [ newam ];
-  };
-}
diff --git a/pkgs/development/libraries/httplib/default.nix b/pkgs/development/libraries/httplib/default.nix
index ad27a98fa60b..4736326b4a30 100644
--- a/pkgs/development/libraries/httplib/default.nix
+++ b/pkgs/development/libraries/httplib/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "httplib";
-  version = "0.15.2";
+  version = "0.15.3";
 
   src = fetchFromGitHub {
     owner = "yhirose";
     repo = "cpp-httplib";
     rev = "v${version}";
-    hash = "sha256-DNktnRckqiZf0EQ96LfweDvBNgcX8u3Gry1LCs/Qj74=";
+    hash = "sha256-+YAjmsZvBkOk5bsjE07weTNUmevHd1ZXP0bv5QbkZMs=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/libvirt/default.nix b/pkgs/development/libraries/libvirt/default.nix
index 17875c415b14..783a20d3e6ea 100644
--- a/pkgs/development/libraries/libvirt/default.nix
+++ b/pkgs/development/libraries/libvirt/default.nix
@@ -250,6 +250,9 @@ stdenv.mkDerivation rec {
       substituteInPlace src/util/virpolkit.h \
         --replace '"/usr/bin/pkttyagent"' '"${if isLinux then polkit.bin else "/usr"}/bin/pkttyagent"'
 
+      substituteInPlace src/util/virpci.c \
+         --replace '/lib/modules' '${if isLinux then "/run/current-system/kernel-modules" else ""}/lib/modules'
+
       patchShebangs .
     ''
     + (lib.concatStringsSep "\n" (lib.mapAttrsToList patchBuilder overrides));
diff --git a/pkgs/development/libraries/vaapi-vdpau/default.nix b/pkgs/development/libraries/vaapi-vdpau/default.nix
index fd38eba73974..2e3976e3a4d2 100644
--- a/pkgs/development/libraries/vaapi-vdpau/default.nix
+++ b/pkgs/development/libraries/vaapi-vdpau/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
                   sha256 = "15snqf60ib0xb3cnav5b2r55qv8lv2fa4p6jwxajh8wbvqpw0ibz"; })
     (fetchpatch { url = "https://src.fedoraproject.org/rpms/libva-vdpau-driver/raw/0ad71107e28a60ea453ac70e895cf64342bd58d0/f/implement-vaquerysurfaceattributes.patch";
                   sha256 = "1dapx3bqqblw6l2iqqw1yff6qifam8q4m2rq343kwb3dqhy2ymy5"; })
-    (fetchpatch { url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/x11-libs/libva-vdpau-driver/files/libva-vdpau-driver-0.7.4-include-linux-videodev2.h.patch";
+    (fetchpatch { url = "https://github.com/gentoo/gentoo/raw/34d5cc6fcf1d76c1c2833cb534717246c221214c/x11-libs/libva-vdpau-driver/files/libva-vdpau-driver-0.7.4-include-linux-videodev2.h.patch";
                   sha256 = "1m4is6lk580mppsx2mvdv1xifj6gvx724si4qynsm9qrdfdc9fby"; })
   ];
 
diff --git a/pkgs/development/python-modules/hdf5plugin/default.nix b/pkgs/development/python-modules/hdf5plugin/default.nix
index c5a1ad4141dd..c2cfe5843c42 100644
--- a/pkgs/development/python-modules/hdf5plugin/default.nix
+++ b/pkgs/development/python-modules/hdf5plugin/default.nix
@@ -6,14 +6,14 @@
 
 buildPythonPackage rec {
   pname = "hdf5plugin";
-  version = "4.3.0";
+  version = "4.4.0";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "silx-kit";
     repo = "hdf5plugin";
     rev = "refs/tags/v${version}";
-    hash = "sha256-xOSGykG6D2Am/gnAPoqLOvIQz6FfxRQe9lPyRHxUoew=";
+    hash = "sha256-MnqY1PyGzo31H696J9CekiA2rJrUYzUMDC3UJMZaFLA=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/iminuit/default.nix b/pkgs/development/python-modules/iminuit/default.nix
index 675a751f0096..1028512694b7 100644
--- a/pkgs/development/python-modules/iminuit/default.nix
+++ b/pkgs/development/python-modules/iminuit/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage rec {
   pname = "iminuit";
-  version = "2.25.0";
+  version = "2.25.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-e99ZRg05Dy0DznVcAVGy7D0gMwC8UVQb+Ch7Q8EgTGY=";
+    hash = "sha256-uCn/wdte1nHc0aSeBFk3duZXXPOmbMfOdHf8ZkI/hj4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/jaxlib/bin.nix b/pkgs/development/python-modules/jaxlib/bin.nix
index f6f8f5e2b1b6..b7e20d6f55e7 100644
--- a/pkgs/development/python-modules/jaxlib/bin.nix
+++ b/pkgs/development/python-modules/jaxlib/bin.nix
@@ -33,7 +33,7 @@
 }:
 
 let
-  inherit (cudaPackagesGoogle) cudatoolkit cudnn;
+  inherit (cudaPackagesGoogle) cudatoolkit cudnn cudaVersion;
 
   version = "0.4.23";
 
@@ -118,26 +118,44 @@ let
       };
     };
 
-  # Find new releases at https://storage.googleapis.com/jax-releases/jax_releases.html.
+  # Note that the prebuilt jaxlib binary requires specific version of CUDA to
+  # work. The cuda12 jaxlib binaries only works with CUDA 12.2, and cuda11
+  # jaxlib binaries only works with CUDA 11.8. This is why we need to find a
+  # binary that matches the provided cudaVersion.
+  gpuSrcVersionString = "cuda${cudaVersion}-${pythonVersion}";
+
+  # Find new releases at https://storage.googleapis.com/jax-releases
   # When upgrading, you can get these hashes from prefetch.sh. See
   # https://github.com/google/jax/issues/12879 as to why this specific URL is the correct index.
   gpuSrcs = {
-    "3.9" = fetchurl {
+    "cuda12.2-3.9" = fetchurl {
       url = "https://storage.googleapis.com/jax-releases/cuda12/jaxlib-${version}+cuda12.cudnn89-cp39-cp39-manylinux2014_x86_64.whl";
       hash = "sha256-our2mSwHPdjVoDAZP+9aNUkJ+vxv1Tq7G5UqA9HvhNI=";
     };
-    "3.10" = fetchurl {
+    "cuda12.2-3.10" = fetchurl {
       url = "https://storage.googleapis.com/jax-releases/cuda12/jaxlib-${version}+cuda12.cudnn89-cp310-cp310-manylinux2014_x86_64.whl";
       hash = "sha256-jkIABnJZnn7A6n9VGs/MldzdDiKwWh0fEvl7Vqn85Kg=";
     };
-    "3.11" = fetchurl {
+    "cuda12.2-3.11" = fetchurl {
       url = "https://storage.googleapis.com/jax-releases/cuda12/jaxlib-${version}+cuda12.cudnn89-cp311-cp311-manylinux2014_x86_64.whl";
       hash = "sha256-dMUcRnHjl8NyUeO3P1x7CNgF0iAHFKIzUtHh+/CNkow=";
     };
-    "3.12" = fetchurl {
+    "cuda12.2-3.12" = fetchurl {
       url = "https://storage.googleapis.com/jax-releases/cuda12/jaxlib-${version}+cuda12.cudnn89-cp312-cp312-manylinux2014_x86_64.whl";
       hash = "sha256-kXJ6bUwX+QybqYPV9Kpwv+lhdoGEFRr4+1T0vfXoWRo=";
     };
+    "cuda11.8-3.9" = fetchurl {
+      url = "https://storage.googleapis.com/jax-releases/cuda11/jaxlib-${version}+cuda11.cudnn86-cp39-cp39-manylinux2014_x86_64.whl";
+      hash = "sha256-m2Y5p12gF3OaADu+aGw5RjcKFrj9RB8xzNWnKNpSz60=";
+    };
+    "cuda11.8-3.10" = fetchurl {
+      url = "https://storage.googleapis.com/jax-releases/cuda11/jaxlib-${version}+cuda11.cudnn86-cp310-cp310-manylinux2014_x86_64.whl";
+      hash = "osha256-aQ7iX3o0kQ4liPexv7dkBVWVTUpaty83L083MybGkf0=";
+    };
+    "cuda11.8-3.11" = fetchurl {
+      url = "https://storage.googleapis.com/jax-releases/cuda11/jaxlib-${version}+cuda11.cudnn86-cp311-cp311-manylinux2014_x86_64.whl";
+      hash = "sha256-uIEyjEmv0HBaiYVl5PuICTI9XnH4zAfQ1l9tjALRcP4=";
+    };
   };
 
 in
@@ -154,7 +172,7 @@ buildPythonPackage {
       (
         cpuSrcs."${pythonVersion}-${stdenv.hostPlatform.system}"
           or (throw "jaxlib-bin is not supported on ${stdenv.hostPlatform.system}")
-      ) else gpuSrcs."${pythonVersion}";
+      ) else gpuSrcs."${gpuSrcVersionString}";
 
   # Prebuilt wheels are dynamically linked against things that nix can't find.
   # Run `autoPatchelfHook` to automagically fix them.
@@ -212,6 +230,7 @@ buildPythonPackage {
     broken =
       !(cudaSupport -> (cudaPackagesGoogle ? cudatoolkit) && lib.versionAtLeast cudatoolkit.version "11.1")
       || !(cudaSupport -> (cudaPackagesGoogle ? cudnn) && lib.versionAtLeast cudnn.version "8.2")
-      || !(cudaSupport -> stdenv.isLinux);
+      || !(cudaSupport -> stdenv.isLinux)
+      || !(cudaSupport -> (gpuSrcs ? "cuda${cudaVersion}-${pythonVersion}"));
   };
 }
diff --git a/pkgs/development/python-modules/py-aosmith/default.nix b/pkgs/development/python-modules/py-aosmith/default.nix
index b21cdda8f662..bce96a1d320b 100644
--- a/pkgs/development/python-modules/py-aosmith/default.nix
+++ b/pkgs/development/python-modules/py-aosmith/default.nix
@@ -1,9 +1,9 @@
 { lib
-, aiohttp
 , buildPythonPackage
+, pythonOlder
 , fetchFromGitHub
 , poetry-core
-, pythonOlder
+, aiohttp
 , tenacity
 }:
 
@@ -38,7 +38,6 @@ buildPythonPackage rec {
   meta = {
     description = "Python client library for A. O. Smith water heaters";
     homepage = "https://github.com/bdr99/py-aosmith";
-    changelog = "https://github.com/bdr99/py-aosmith/releases/tag/${version}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ dotlambda ];
   };
diff --git a/pkgs/development/python-modules/pycaption/default.nix b/pkgs/development/python-modules/pycaption/default.nix
index ea873940e416..c6d65db362ae 100644
--- a/pkgs/development/python-modules/pycaption/default.nix
+++ b/pkgs/development/python-modules/pycaption/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "pycaption";
-  version = "2.2.3";
+  version = "2.2.4";
 
   disabled = pythonOlder "3.8";
 
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "pbs";
     repo = "pycaption";
     rev = "refs/tags/${version}";
-    hash = "sha256-uPzeMuYoNgluXnwSMQE5lSkduBzwi8mP8K5cAKdTZUw=";
+    hash = "sha256-aUhNvqeSNtbnRVp4yxsk4q3szNfR0m1zo0MpkBOCokY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/qpsolvers/default.nix b/pkgs/development/python-modules/qpsolvers/default.nix
index 085c40a4ad18..7a1844616a36 100644
--- a/pkgs/development/python-modules/qpsolvers/default.nix
+++ b/pkgs/development/python-modules/qpsolvers/default.nix
@@ -4,13 +4,18 @@
 , buildPythonPackage
 , unittestCheckHook
 , flit-core
+, numpy
+, scipy
+
+# optional dependencies
+, clarabel
+, cvxopt
 , daqp
 , ecos
-, numpy
+, gurobipy
 , osqp
-, scipy
-, scs
 , quadprog
+, scs
 }:
 buildPythonPackage rec {
   pname = "qpsolvers";
@@ -24,22 +29,40 @@ buildPythonPackage rec {
     hash = "sha256-/HLc9dFf9F/6W7ux2Fj2yJuV/xCVeGyO6MblddwIGdM=";
   };
 
+  nativeBuildInputs = [
+    flit-core
+  ];
+
   pythonImportsCheck = [ "qpsolvers" ];
 
   propagatedBuildInputs = [
-    daqp
-    ecos
     numpy
-    osqp
     scipy
-    scs
   ];
 
+  passthru.optional-dependencies = {
+    # FIXME commented out solvers have not been packaged yet
+    clarabel = [ clarabel ];
+    cvxopt = [ cvxopt ];
+    daqp = [ daqp ];
+    ecos = [ ecos ];
+    gurobi = [ gurobipy ];
+    # highs = [ highspy ];
+    # mosek = [ cvxopt mosek ];
+    osqp = [ osqp ];
+    # piqp = [ piqp ];
+    # proxqp = [ proxsuite ];
+    # qpalm = [ qpalm ];
+    quadprog = [ quadprog ];
+    scs = [ scs ];
+    open_source_solvers = with passthru.optional-dependencies; lib.flatten [
+      clarabel cvxopt daqp ecos /* highs */ osqp /* piqp proxqp qpalm */ quadprog scs
+    ];
+  };
+
   nativeCheckInputs = [
-    flit-core
-    quadprog
     unittestCheckHook
-  ];
+  ] ++ passthru.optional-dependencies.open_source_solvers;
 
   meta = with lib; {
     changelog = "https://github.com/qpsolvers/qpsolvers/blob/${src.rev}/CHANGELOG.md";
diff --git a/pkgs/tools/misc/plantuml/default.nix b/pkgs/tools/misc/plantuml/default.nix
index 24f8187aadd9..79e742989cac 100644
--- a/pkgs/tools/misc/plantuml/default.nix
+++ b/pkgs/tools/misc/plantuml/default.nix
@@ -1,12 +1,12 @@
 { lib, stdenv, fetchurl, makeWrapper, jre, graphviz }:
 
 stdenv.mkDerivation rec {
-  version = "1.2024.0";
+  version = "1.2024.1";
   pname = "plantuml";
 
   src = fetchurl {
     url = "https://github.com/plantuml/plantuml/releases/download/v${version}/plantuml-pdf-${version}.jar";
-    sha256 = "sha256-jpO4BhOyTS9y2e9d3AK911HDQa04zhPeFGyhz1FJN+Q=";
+    sha256 = "sha256-lXo8eU6IX4JQFfhNUM2h6fi0HkShiwLsjMRTNbwLYwk=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/security/tor/torsocks-gethostbyaddr-darwin.patch b/pkgs/tools/security/tor/torsocks-gethostbyaddr-darwin.patch
new file mode 100644
index 000000000000..d7d834271a94
--- /dev/null
+++ b/pkgs/tools/security/tor/torsocks-gethostbyaddr-darwin.patch
@@ -0,0 +1,33 @@
+diff --git a/tests/test_dns.c b/tests/test_dns.c
+index 7e07663..acf095c 100644
+--- a/tests/test_dns.c
++++ b/tests/test_dns.c
+@@ -76,6 +76,8 @@ static void test_gethostbyname(const struct test_host *host)
+ 	return;
+ }
+ 
++#ifdef __linux__
++
+ static void test_gethostbyaddr_r_failed(void)
+ {
+ 	int result;
+@@ -129,6 +131,8 @@ static void test_gethostbyaddr_r(const struct test_host *host)
+   ok(1, "Resolved address");
+ }
+ 
++#endif
++
+ static void test_gethostbyaddr(const struct test_host *host)
+ {
+ 	struct hostent *he;
+@@ -199,8 +203,10 @@ int main(int argc, char **argv)
+ 	test_getaddrinfo(&tor_check);
+ 	test_gethostbyname(&tor_dir_auth1);
+ 	test_gethostbyaddr(&tor_dir_auth2);
++#ifdef __linux__
+ 	test_gethostbyaddr_r(&tor_dir_auth2);
+ 	test_gethostbyaddr_r_failed();
++#endif
+ 	test_getaddrinfo(&tor_localhost);
+ 
+ end:
diff --git a/pkgs/tools/security/tor/torsocks.nix b/pkgs/tools/security/tor/torsocks.nix
index 16eeca0ffad7..6c5be8fcc7bd 100644
--- a/pkgs/tools/security/tor/torsocks.nix
+++ b/pkgs/tools/security/tor/torsocks.nix
@@ -1,22 +1,39 @@
-{ lib, stdenv, fetchgit, fetchurl, autoreconfHook, libcap }:
+{ lib
+, stdenv
+, fetchFromGitLab
+, fetchpatch
+, autoreconfHook
+, libcap
+}:
 
 stdenv.mkDerivation rec {
   pname = "torsocks";
-  version = "2.3.0";
+  version = "2.4.0";
 
-  src = fetchgit {
-    url    = "https://git.torproject.org/torsocks.git";
-    rev    = "refs/tags/v${version}";
-    sha256 = "0x0wpcigf22sjxg7bm0xzqihmsrz51hl4v8xf91qi4qnmr4ny1hb";
+  src = fetchFromGitLab {
+    domain = "gitlab.torproject.org";
+    group = "tpo";
+    owner = "core";
+    repo = "torsocks";
+    rev = "v${version}";
+    sha256 = "sha256-ocJkoF9LMLC84ukFrm5pzjp/1gaXqDz8lzr9TdG+f88=";
   };
 
-  nativeBuildInputs = [ autoreconfHook ];
-
-  patches = lib.optional stdenv.isDarwin
-    (fetchurl {
-       url = "https://trac.torproject.org/projects/tor/raw-attachment/ticket/28538/0001-Fix-macros-for-accept4-2.patch";
-       sha256 = "97881f0b59b3512acc4acb58a0d6dfc840d7633ead2f400fad70dda9b2ba30b0";
-     });
+  patches = [
+    # fix compatibility with C99
+    # https://gitlab.torproject.org/tpo/core/torsocks/-/merge_requests/9
+    (fetchpatch {
+      url = "https://gitlab.torproject.org/tpo/core/torsocks/-/commit/1171bf2fd4e7a0cab02cf5fca59090b65af9cd29.patch";
+      hash = "sha256-qu5/0fy72+02QI0cVE/6YrR1kPuJxsZfG8XeODqVOPY=";
+    })
+    # tsocks_libc_accept4 only exists on Linux, use tsocks_libc_accept on other platforms
+    (fetchpatch {
+      url = "https://gitlab.torproject.org/tpo/core/torsocks/uploads/eeec9833512850306a42a0890d283d77/0001-Fix-macros-for-accept4-2.patch";
+      hash = "sha256-XWi8+UFB8XgBFSl5QDJ+hLu/dH4CvAwYbeZz7KB10Bs=";
+    })
+    # no gethostbyaddr_r on darwin
+    ./torsocks-gethostbyaddr-darwin.patch
+  ];
 
   postPatch = ''
     # Patch torify_app()
@@ -29,12 +46,14 @@ stdenv.mkDerivation rec {
       src/bin/torsocks.in
   '';
 
+  nativeBuildInputs = [ autoreconfHook ];
+
   doInstallCheck = true;
   installCheckTarget = "check-recursive";
 
   meta = {
     description      = "Wrapper to safely torify applications";
-    homepage         = "https://github.com/dgoulet/torsocks";
+    homepage         = "https://gitlab.torproject.org/tpo/core/torsocks";
     license          = lib.licenses.gpl2;
     platforms        = lib.platforms.unix;
     maintainers      = with lib.maintainers; [ thoughtpolice ];
diff --git a/pkgs/tools/system/netdata/go.d.plugin.nix b/pkgs/tools/system/netdata/go.d.plugin.nix
index c741d1d62beb..ce53b278a9bd 100644
--- a/pkgs/tools/system/netdata/go.d.plugin.nix
+++ b/pkgs/tools/system/netdata/go.d.plugin.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "netdata-go-plugins";
-  version = "0.58.0";
+  version = "0.58.1";
 
   src = fetchFromGitHub {
     owner = "netdata";
     repo = "go.d.plugin";
     rev = "v${version}";
-    hash = "sha256-XZBF0uNXTo5UcBuhMVznij+QGhHM06j5J2xflZf40kI=";
+    hash = "sha256-zzHm98jec7MXnzVsrLlYIk+ILA3Ei43853dM1LdFz5c=";
   };
 
-  vendorHash = "sha256-bdW6ZDMYVFGWD7KEDU2kaoccgwbOPl7ADnZ1npGBLAc=";
+  vendorHash = "sha256-eb+GRFhfWxDkfH4x2VF3ogyT5z4OcIoqHtEVJ1tGsdA=";
 
   doCheck = false;
 
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 01ae1c147908..dc05363a7058 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -141,6 +141,7 @@ mapAliases ({
   cadence = throw "cadence has been removed from nixpkgs, as it was archived upstream"; # Added 2023-10-28
   cask = emacs.pkgs.cask; # Added 2022-11-12
   cargo-embed = throw "cargo-embed is now part of the probe-rs package"; # Added 2023-07-03
+  cargo-espflash = espflash;
   cargo-flash = throw "cargo-flash is now part of the probe-rs package"; # Added 2023-07-03
   catfish = throw "'catfish' has been renamed to/replaced by 'xfce.catfish'"; # Converted to throw 2023-09-10
   cawbird = throw "cawbird has been abandoned upstream and is broken anyways due to Twitter closing its API";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 52fcd92108bb..1077d4c87449 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -16860,10 +16860,6 @@ with pkgs;
 
   cargo2junit = callPackage ../development/tools/rust/cargo2junit { };
 
-  cargo-espflash = callPackage ../development/tools/rust/cargo-espflash {
-    inherit (darwin.apple_sdk.frameworks) Security SystemConfiguration;
-  };
-
   cargo-web = callPackage ../development/tools/rust/cargo-web {
     inherit (darwin.apple_sdk.frameworks) CoreServices Security;
   };
@@ -31237,7 +31233,7 @@ with pkgs;
 
   espeakup = callPackage ../applications/accessibility/espeakup { };
 
-  espflash = callPackage ../development/embedded/espflash {
+  espflash = callPackage ../by-name/es/espflash/package.nix {
     inherit (darwin.apple_sdk.frameworks) Security SystemConfiguration;
   };
 
diff --git a/pkgs/top-level/java-packages.nix b/pkgs/top-level/java-packages.nix
index e63c23f34bf3..4c2fd0d4251e 100644
--- a/pkgs/top-level/java-packages.nix
+++ b/pkgs/top-level/java-packages.nix
@@ -62,7 +62,7 @@ in {
 
     mkOpenjdkLinuxOnly = path-linux: args: let
       openjdk = callPackage path-linux  (gnomeArgs // args);
-    in openjdk // {
+    in assert stdenv.isLinux; openjdk // {
       headless = openjdk.override { headless = true; };
     };