Merge master into haskell-updates

375 files changed, 2035 insertions, 1095 deletions

diff --git a/doc/packages/linux.section.md b/doc/packages/linux.section.md
index b64da85791a0..0edf40043361 100644
--- a/doc/packages/linux.section.md
+++ b/doc/packages/linux.section.md
@@ -2,9 +2,21 @@
 
 The Nix expressions to build the Linux kernel are in [`pkgs/os-specific/linux/kernel`](https://github.com/NixOS/nixpkgs/blob/master/pkgs/os-specific/linux/kernel).
 
-The function that builds the kernel has an argument `kernelPatches` which should be a list of `{name, patch, extraConfig}` attribute sets, where `name` is the name of the patch (which is included in the kernel’s `meta.description` attribute), `patch` is the patch itself (possibly compressed), and `extraConfig` (optional) is a string specifying extra options to be concatenated to the kernel configuration file (`.config`).
+The function [`pkgs.buildLinux`](https://github.com/NixOS/nixpkgs/blob/d77bda728d5041c1294a68fb25c79e2d161f62b9/pkgs/os-specific/linux/kernel/generic.nix) builds a kernel with [common configuration values](https://github.com/NixOS/nixpkgs/blob/d77bda728d5041c1294a68fb25c79e2d161f62b9/pkgs/os-specific/linux/kernel/common-config.nix).
+This is the preferred option unless you have a very specific use case.
+Most kernels packaged in Nixpkgs are built that way, and it will also generate kernels suitable for NixOS.
+[`pkgs.linuxManualConfig`](https://github.com/NixOS/nixpkgs/blob/d77bda728d5041c1294a68fb25c79e2d161f62b9/pkgs/os-specific/linux/kernel/manual-config.nix) requires a complete configuration to be passed.
+It has fewer additional features than `pkgs.buildLinux`, which provides common configuration values and exposes the `features` attribute, as explained below.
 
-The kernel derivation exports an attribute `features` specifying whether optional functionality is or isn’t enabled. This is used in NixOS to implement kernel-specific behaviour. For instance, if the kernel has the `iwlwifi` feature (i.e., has built-in support for Intel wireless chipsets), then NixOS doesn’t have to build the external `iwlwifi` package:
+Both functions have an argument `kernelPatches` which should be a list of `{name, patch, extraConfig}` attribute sets, where `name` is the name of the patch (which is included in the kernel’s `meta.description` attribute), `patch` is the patch itself (possibly compressed), and `extraConfig` (optional) is a string specifying extra options to be concatenated to the kernel configuration file (`.config`).
+
+The kernel derivation created with `pkgs.buildLinux` exports an attribute `features` specifying whether optional functionality is or isn’t enabled. This is used in NixOS to implement kernel-specific behaviour.
+
+:::{.example #ex-skip-package-from-kernel-feature}
+
+# Skipping an external package because of a kernel feature
+
+For instance, if the kernel has the `iwlwifi` feature (i.e., has built-in support for Intel wireless chipsets), then NixOS doesn’t have to build the external `iwlwifi` package:
 
 ```nix
 modulesTree = [kernel]
@@ -12,30 +24,104 @@ modulesTree = [kernel]
   ++ ...;
 ```
 
-How to add a new (major) version of the Linux kernel to Nixpkgs:
+:::
+
+If you are using a kernel packaged in Nixpkgs, you can customize it by overriding its arguments. For details on how each argument affects the generated kernel, refer to [the `pkgs.buildLinux` source code](https://github.com/NixOS/nixpkgs/blob/d77bda728d5041c1294a68fb25c79e2d161f62b9/pkgs/os-specific/linux/kernel/generic.nix).
+
+:::{.example #ex-overriding-kernel-derivation}
+
+# Overriding the kernel derivation
+
+Assuming you are using the kernel from `pkgs.linux_latest`:
+
+```nix
+pkgs.linux_latest.override {
+  ignoreConfigErrors = true;
+  autoModules = false;
+  kernelPreferBuiltin = true;
+  extraStructuredConfig = with lib.kernel; {
+    DEBUG_KERNEL = yes;
+    FRAME_POINTER = yes;
+    KGDB = yes;
+    KGDB_SERIAL_CONSOLE = yes;
+    DEBUG_INFO = yes;
+  };
+}
+```
+
+:::
 
-1.  Copy the old Nix expression (e.g., `linux-2.6.21.nix`) to the new one (e.g., `linux-2.6.22.nix`) and update it.
+## Manual kernel configuration {#sec-manual-kernel-configuration}
 
-2.  Add the new kernel to the `kernels` attribute set in `linux-kernels.nix` (e.g., create an attribute `kernel_2_6_22`).
+Sometimes it may not be desirable to use kernels built with `pkgs.buildLinux`, especially if most of the common configuration has to be altered or disabled to achieve a kernel as expected by the target use case.
+An example of this is building a kernel for use in a VM or micro VM. You can use `pkgs.linuxManualConfig` in these cases. It requires the `src`, `version`, and `configfile` attributes to be specified.
 
-3.  Now we’re going to update the kernel configuration. First unpack the kernel. Then for each supported platform (`i686`, `x86_64`, `uml`) do the following:
+:::{.example #ex-using-linux-manual-config}
 
-    1.  Make a copy from the old config (e.g., `config-2.6.21-i686-smp`) to the new one (e.g., `config-2.6.22-i686-smp`).
+# Using `pkgs.linuxManualConfig` with a specific source, version, and config file
 
-    2.  Copy the config file for this platform (e.g., `config-2.6.22-i686-smp`) to `.config` in the kernel source tree.
+```nix
+{ pkgs, ... }: {
+  version = "6.1.55";
+  src = pkgs.fetchurl {
+    url = "https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-${version}.tar.xz";
+    hash = "sha256:1h0mzx52q9pvdv7rhnvb8g68i7bnlc9rf8gy9qn4alsxq4g28zm8";
+  };
+  configfile = ./path_to_config_file;
+  linux = pkgs.linuxManualConfig {
+    inherit version src configfile;
+    allowImportFromDerivation = true;
+  };
+}
+```
+
+If necessary, the version string can be slightly modified to explicitly mark it as a custom version. If you do so, ensure the `modDirVersion` attribute matches the source's version, otherwise the build will fail.
+
+```nix
+{ pkgs, ... }: {
+  version = "6.1.55-custom";
+  modDirVersion = "6.1.55";
+  src = pkgs.fetchurl {
+    url = "https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-${modDirVersion}.tar.xz";
+    hash = "sha256:1h0mzx52q9pvdv7rhnvb8g68i7bnlc9rf8gy9qn4alsxq4g28zm8";
+  };
+  configfile = ./path_to_config_file;
+  linux = pkgs.linuxManualConfig {
+    inherit version modDirVersion src configfile;
+    allowImportFromDerivation = true;
+  };
+}
+```
 
-    3.  Run `make oldconfig ARCH={i386,x86_64,um}` and answer all questions. (For the uml configuration, also add `SHELL=bash`.) Make sure to keep the configuration consistent between platforms (i.e., don’t enable some feature on `i686` and disable it on `x86_64`).
+:::
 
-    4.  If needed, you can also run `make menuconfig`:
+Additional attributes can be used with `linuxManualConfig` for further customisation. You're encouraged to read [the `pkgs.linuxManualConfig` source code](https://github.com/NixOS/nixpkgs/blob/d77bda728d5041c1294a68fb25c79e2d161f62b9/pkgs/os-specific/linux/kernel/manual-config.nix) to understand how to use them.
 
-        ```ShellSession
-        $ nix-env -f "<nixpkgs>" -iA ncurses
-        $ export NIX_CFLAGS_LINK=-lncurses
-        $ make menuconfig ARCH=arch
-        ```
+To edit the `.config` file for Linux X.Y from within Nix, proceed as follows:
 
-    5.  Copy `.config` over the new config file (e.g., `config-2.6.22-i686-smp`).
+```ShellSession
+$ nix-shell '<nixpkgs>' -A linuxKernel.kernels.linux_X_Y.configEnv
+$ unpackPhase
+$ cd linux-*
+$ make nconfig
+```
+
+## Developing kernel modules {#sec-linux-kernel-developing-modules}
+
+When developing kernel modules it's often convenient to run the edit-compile-run loop as quickly as possible.
+See the snippet below as an example.
 
-4.  Test building the kernel: `nix-build -A linuxKernel.kernels.kernel_2_6_22`. If it compiles, ship it! For extra credit, try booting NixOS with it.
+:::{.example #ex-edit-compile-run-kernel-modules}
+
+# Edit-compile-run loop when developing `mellanox` drivers
+
+```ShellSession
+$ nix-build '<nixpkgs>' -A linuxPackages.kernel.dev
+$ nix-shell '<nixpkgs>' -A linuxPackages.kernel
+$ unpackPhase
+$ cd linux-*
+$ make -C $dev/lib/modules/*/build M=$(pwd)/drivers/net/ethernet/mellanox modules
+# insmod ./drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.ko
+```
 
-5.  It may be that the new kernel requires updating the external kernel modules and kernel-dependent packages listed in the `linuxPackagesFor` function in `linux-kernels.nix` (such as the NVIDIA drivers, AUFS, etc.). If the updated packages aren’t backwards compatible with older kernels, you may need to keep the older versions around.
+:::
diff --git a/lib/fileset/default.nix b/lib/fileset/default.nix
index 9ccbf0ed7ce7..75e609a072e7 100644
--- a/lib/fileset/default.nix
+++ b/lib/fileset/default.nix
@@ -604,6 +604,7 @@ in {
         ({
           name :: String,
           type :: String,
+          hasExt :: String -> Bool,
           ...
         } -> Bool)
         -> Path
@@ -614,7 +615,7 @@ in {
       fileFilter (file: file.name == "default.nix") ./.
 
       # Include all non-Nix files from the current directory
-      fileFilter (file: ! hasSuffix ".nix" file.name) ./.
+      fileFilter (file: ! file.hasExt "nix") ./.
 
       # Include all files that start with a "." in the current directory
       fileFilter (file: hasPrefix "." file.name) ./.
@@ -634,6 +635,12 @@ in {
       - `type` (String, one of `"regular"`, `"symlink"` or `"unknown"`): The type of the file.
         This matches result of calling [`builtins.readFileType`](https://nixos.org/manual/nix/stable/language/builtins.html#builtins-readFileType) on the file's path.
 
+      - `hasExt` (String -> Bool): Whether the file has a certain file extension.
+        `hasExt ext` is true only if `hasSuffix ".${ext}" name`.
+
+        This also means that e.g. for a file with name `.gitignore`,
+        `hasExt "gitignore"` is true.
+
       Other attributes may be added in the future.
     */
     predicate:
diff --git a/lib/fileset/internal.nix b/lib/fileset/internal.nix
index 2fddf0d02285..35d556e78391 100644
--- a/lib/fileset/internal.nix
+++ b/lib/fileset/internal.nix
@@ -52,6 +52,7 @@ let
     concatStringsSep
     substring
     stringLength
+    hasSuffix
     ;
 
 in
@@ -797,9 +798,11 @@ rec {
         if
           predicate {
             inherit name type;
+            hasExt = ext: hasSuffix ".${ext}" name;
+
             # To ensure forwards compatibility with more arguments being added in the future,
             # adding an attribute which can't be deconstructed :)
-            "lib.fileset.fileFilter: The predicate function passed as the first argument must be able to handle extra attributes for future compatibility. If you're using `{ name, file }:`, use `{ name, file, ... }:` instead." = null;
+            "lib.fileset.fileFilter: The predicate function passed as the first argument must be able to handle extra attributes for future compatibility. If you're using `{ name, file, hasExt }:`, use `{ name, file, hasExt, ... }:` instead." = null;
           }
         then
           type
diff --git a/lib/fileset/tests.sh b/lib/fileset/tests.sh
index 81376bc451b1..077aefe371c3 100755
--- a/lib/fileset/tests.sh
+++ b/lib/fileset/tests.sh
@@ -847,7 +847,7 @@ checkFileset 'fileFilter (file: abort "this is not needed") ./.'
 
 # The predicate must be able to handle extra attributes
 touch a
-expectFailure 'toSource { root = ./.; fileset = fileFilter ({ name, type }: true) ./.; }' 'called with unexpected argument '\''"lib.fileset.fileFilter: The predicate function passed as the first argument must be able to handle extra attributes for future compatibility. If you'\''re using `\{ name, file \}:`, use `\{ name, file, ... \}:` instead."'\'
+expectFailure 'toSource { root = ./.; fileset = fileFilter ({ name, type, hasExt }: true) ./.; }' 'called with unexpected argument '\''"lib.fileset.fileFilter: The predicate function passed as the first argument must be able to handle extra attributes for future compatibility. If you'\''re using `\{ name, file, hasExt \}:`, use `\{ name, file, hasExt, ... \}:` instead."'\'
 rm -rf -- *
 
 # .name is the name, and it works correctly, even recursively
@@ -895,6 +895,39 @@ expectEqual \
     'toSource { root = ./.; fileset = union ./d/a ./d/b; }'
 rm -rf -- *
 
+# Check that .hasExt checks for the file extension
+# The empty extension is the same as a file ending with a .
+tree=(
+    [a]=0
+    [a.]=1
+    [a.b]=0
+    [a.b.]=1
+    [a.b.c]=0
+)
+checkFileset 'fileFilter (file: file.hasExt "") ./.'
+
+# It can check for the last extension
+tree=(
+    [a]=0
+    [.a]=1
+    [.a.]=0
+    [.b.a]=1
+    [.b.a.]=0
+)
+checkFileset 'fileFilter (file: file.hasExt "a") ./.'
+
+# It can check for any extension
+tree=(
+    [a.b.c.d]=1
+)
+checkFileset 'fileFilter (file:
+  all file.hasExt [
+    "b.c.d"
+    "c.d"
+    "d"
+  ]
+) ./.'
+
 # It's lazy
 tree=(
     [b]=1
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 04c939fd6a48..6848ff87e8e1 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -16592,6 +16592,13 @@
     githubId = 2770647;
     name = "Simon Vandel Sillesen";
   };
+  sinanmohd = {
+    name = "Sinan Mohd";
+    email = "sinan@firemail.cc";
+    matrix = "@sinan:sinanmohd.com";
+    github = "sinanmohd";
+    githubId = 69694713;
+  };
   sioodmy = {
     name = "Antoni Sokołowski";
     github = "sioodmy";
diff --git a/nixos/doc/manual/configuration/linux-kernel.chapter.md b/nixos/doc/manual/configuration/linux-kernel.chapter.md
index f5bce99dd1bb..9d1b2bc2f9b8 100644
--- a/nixos/doc/manual/configuration/linux-kernel.chapter.md
+++ b/nixos/doc/manual/configuration/linux-kernel.chapter.md
@@ -84,26 +84,7 @@ available parameters, run `sysctl -a`.
 
 ## Building a custom kernel {#sec-linux-config-customizing}
 
-You can customize the default kernel configuration by overriding the arguments for your kernel package:
-
-```nix
-pkgs.linux_latest.override {
-  ignoreConfigErrors = true;
-  autoModules = false;
-  kernelPreferBuiltin = true;
-  extraStructuredConfig = with lib.kernel; {
-    DEBUG_KERNEL = yes;
-    FRAME_POINTER = yes;
-    KGDB = yes;
-    KGDB_SERIAL_CONSOLE = yes;
-    DEBUG_INFO = yes;
-  };
-}
-```
-
-See `pkgs/os-specific/linux/kernel/generic.nix` for details on how these arguments
-affect the generated configuration. You can also build a custom version of Linux by calling
-`pkgs.buildLinux` directly, which requires the `src` and `version` arguments to be specified.
+Please refer to the Nixpkgs manual for the various ways of [building a custom kernel](https://nixos.org/nixpkgs/manual#sec-linux-kernel).
 
 To use your custom kernel package in your NixOS configuration, set
 
@@ -111,50 +92,9 @@ To use your custom kernel package in your NixOS configuration, set
 boot.kernelPackages = pkgs.linuxPackagesFor yourCustomKernel;
 ```
 
-Note that this method will use the common configuration defined in `pkgs/os-specific/linux/kernel/common-config.nix`,
-which is suitable for a NixOS system.
-
-If you already have a generated configuration file, you can build a kernel that uses it with `pkgs.linuxManualConfig`:
-
-```nix
-let
-  baseKernel = pkgs.linux_latest;
-in pkgs.linuxManualConfig {
-  inherit (baseKernel) src modDirVersion;
-  version = "${baseKernel.version}-custom";
-  configfile = ./my_kernel_config;
-  allowImportFromDerivation = true;
-}
-```
-
-::: {.note}
-The build will fail if `modDirVersion` does not match the source's `kernel.release` file,
-so `modDirVersion` should remain tied to `src`.
-:::
-
-To edit the `.config` file for Linux X.Y, proceed as follows:
-
-```ShellSession
-$ nix-shell '<nixpkgs>' -A linuxKernel.kernels.linux_X_Y.configEnv
-$ unpackPhase
-$ cd linux-*
-$ make nconfig
-```
-
 ## Developing kernel modules {#sec-linux-config-developing-modules}
 
-When developing kernel modules it's often convenient to run
-edit-compile-run loop as quickly as possible. See below snippet as an
-example of developing `mellanox` drivers.
-
-```ShellSession
-$ nix-build '<nixpkgs>' -A linuxPackages.kernel.dev
-$ nix-shell '<nixpkgs>' -A linuxPackages.kernel
-$ unpackPhase
-$ cd linux-*
-$ make -C $dev/lib/modules/*/build M=$(pwd)/drivers/net/ethernet/mellanox modules
-# insmod ./drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.ko
-```
+This section was moved to the [Nixpkgs manual](https://nixos.org/nixpkgs/manual#sec-linux-kernel-developing-modules).
 
 ## ZFS {#sec-linux-zfs}
 
@@ -163,7 +103,7 @@ available Linux kernel. It is recommended to use the latest available LTS that's
 with ZFS. Usually this is the default kernel provided by nixpkgs (i.e. `pkgs.linuxPackages`).
 
 Alternatively, it's possible to pin the system to the latest available kernel
-version *that is supported by ZFS* like this:
+version _that is supported by ZFS_ like this:
 
 ```nix
 {
diff --git a/nixos/doc/manual/release-notes/rl-2311.section.md b/nixos/doc/manual/release-notes/rl-2311.section.md
index fbfac3fada64..f41a9a813ca6 100644
--- a/nixos/doc/manual/release-notes/rl-2311.section.md
+++ b/nixos/doc/manual/release-notes/rl-2311.section.md
@@ -65,6 +65,8 @@
 
 - [hddfancontrol](https://github.com/desbma/hddfancontrol), a service to regulate fan speeds based on hard drive temperature. Available as [services.hddfancontrol](#opt-services.hddfancontrol.enable).
 
+- [seatd](https://sr.ht/~kennylevinsen/seatd/), A minimal seat management daemon. Available as [services.seatd](#opt-services.seatd.enable).
+
 - [GoToSocial](https://gotosocial.org/), an ActivityPub social network server, written in Golang. Available as [services.gotosocial](#opt-services.gotosocial.enable).
 
 - [Castopod](https://castopod.org/), an open-source hosting platform made for podcasters who want to engage and interact with their audience. Available as [services.castopod](#opt-services.castopod.enable).
@@ -316,6 +318,13 @@
 
 - The binary of the package `cloud-sql-proxy` has changed from `cloud_sql_proxy` to `cloud-sql-proxy`.
 
+- The module `services.apache-kafka` was largely rewritten and has certain breaking changes. To be precise, this means that the following things have changed:
+
+  - Most settings have been migrated to [services.apache-kafka.settings](#opt-services.apache-kafka.settings).
+    - Care must be taken when adapting an existing cluster to these changes, see [](#module-services-apache-kafka-migrating-to-settings).
+  - By virtue of being less opinionated, it is now possible to use the module to run Apache Kafka in KRaft mode instead of Zookeeper mode.
+    - [A few options](#module-services-apache-kafka-kraft) have been added to assist in this mode.
+
 - Garage has been upgraded to 0.9.x. `services.garage.package` now needs to be explicitly set, so version upgrades can be done in a controlled fashion. For this, we expose `garage_x_y` attributes which can be set here.
 
 - `voms` and `xrootd` now moves the `$out/etc` content to the `$etc` output instead of `$out/etc.orig`, when input argument `externalEtc` is not `null`.
@@ -364,11 +373,6 @@
 
 - `networking.networkmanager.firewallBackend` was removed as NixOS is now using iptables-nftables-compat even when using iptables, therefore Networkmanager now uses the nftables backend unconditionally.
 
-- [`lib.lists.foldl'`](https://nixos.org/manual/nixpkgs/stable#function-library-lib.lists.foldl-prime) now always evaluates the initial accumulator argument first.
-  If you depend on the lazier behavior, consider using [`lib.lists.foldl`](https://nixos.org/manual/nixpkgs/stable#function-library-lib.lists.foldl) or [`builtins.foldl'`](https://nixos.org/manual/nix/stable/language/builtins.html#builtins-foldl') instead.
-
-- [`lib.attrsets.foldlAttrs`](https://nixos.org/manual/nixpkgs/stable#function-library-lib.attrsets.foldlAttrs) now always evaluates the initial accumulator argument first.
-
 - `rome` was removed because it is no longer maintained and is succeeded by `biome`.
 
 - The `prometheus-knot-exporter` was migrated to a version maintained by CZ.NIC. Various metric names have changed, so checking existing rules is recommended.
@@ -443,6 +447,10 @@
 
 - A new option was added to the virtualisation module that enables specifying explicitly named network interfaces in QEMU VMs. The existing `virtualisation.vlans` is still supported for cases where the name of the network interface is irrelevant.
 
+- Apptainer/Singularity now defaults to using `"$out/var/lib"` for the `LOCALSTATEDIR` configuration option instead of the top-level `"/var/lib"`. This change impacts the `SESSIONDIR` (container-run-time mount point) configuration, which is set to `$LOCALSTATEDIR/<apptainer or singularity>/mnt/session`. This detaches the packages from the top-level directory, rendering the NixOS module optional.
+
+  The default behavior of the NixOS module `programs.singularity` stays unchanged. We add a new option `programs.singularity.enableExternalSysConfDir` (default to `true`) to specify whether to set the top-level `"/var/lib"` as `LOCALSTATEDIR` or not.
+
 - DocBook option documentation is no longer supported, all module documentation now uses markdown.
 
 - `services.outline` can now be configured to use local filesystem storage instead of S3 storage using [services.outline.storage.storageType](#opt-services.outline.storage.storageType).
@@ -616,3 +624,101 @@ The module update takes care of the new config syntax and the data itself (user
 - Docker now defaults to 24, as 20.10 is stopping to receive security updates and bug fixes after [December 10, 2023](https://github.com/moby/moby/discussions/45104).
 
 - There is a new NixOS option when writing NixOS tests `testing.initrdBackdoor`, that enables `backdoor.service` in initrd. Requires `boot.initrd.systemd.enable` to be enabled. Boot will pause in stage 1 at `initrd.target`, and will listen for commands from the `Machine` python interface, just like stage 2 normally does. This enables commands to be sent to test and debug stage 1. Use `machine.switch_root()` to leave stage 1 and proceed to stage 2.
+
+## Nixpkgs library changes {#sec-release-23.11-lib}
+
+### Breaking changes {#sec-release-23.11-lib-breaking}
+
+- [`lib.lists.foldl'`](https://nixos.org/manual/nixpkgs/unstable#function-library-lib.lists.foldl-prime)
+  now always evaluates the initial accumulator argument first.
+  If you depend on the lazier behavior, consider using [`lib.lists.foldl`](https://nixos.org/manual/nixpkgs/unstable#function-library-lib.lists.foldl)
+  or [`builtins.foldl'`](https://nixos.org/manual/nix/stable/language/builtins.html#builtins-foldl') instead.
+- [`lib.attrsets.foldlAttrs`](https://nixos.org/manual/nixpkgs/unstable#function-library-lib.attrsets.foldlAttrs)
+  now always evaluates the initial accumulator argument first.
+- Now that the internal NixOS transition to Markdown documentation is complete,
+  `lib.options.literalDocBook` has been removed after deprecation in 22.11.
+- `lib.types.string` is now fully deprecated and gives a warning when used.
+
+### Additions and improvements {#sec-release-23.11-lib-additions-improvements}
+
+- [`lib.fileset`](https://nixos.org/manual/nixpkgs/unstable#sec-functions-library-fileset):
+  A new sub-library to select local files to use for sources,
+  designed to be easy and safe to use.
+
+  This aims to be a replacement for `lib.sources`-based filtering.
+  To learn more about it, see [the tutorial](https://nix.dev/tutorials/file-sets).
+
+- [`lib.gvariant`](https://nixos.org/manual/nixpkgs/unstable#sec-functions-library-gvariant):
+  A partial and basic implementation of GVariant formatted strings.
+  See [GVariant Format Strings](https://docs.gtk.org/glib/gvariant-format-strings.html) for details.
+
+  :::{.warning}
+  This API is not considered fully stable and it might therefore
+  change in backwards incompatible ways without prior notice.
+  :::
+
+- [`lib.asserts`](https://nixos.org/manual/nixpkgs/unstable#sec-functions-library-asserts): New function:
+  [`assertEachOneOf`](https://nixos.org/manual/nixpkgs/unstable#function-library-lib.asserts.assertEachOneOf).
+- [`lib.attrsets`](https://nixos.org/manual/nixpkgs/unstable#sec-functions-library-attrsets): New function:
+  [`attrsToList`](https://nixos.org/manual/nixpkgs/unstable#function-library-lib.attrsets.attrsToList).
+- [`lib.customisation`](https://nixos.org/manual/nixpkgs/unstable#sec-functions-library-customisation): New function:
+  [`makeScopeWithSplicing'`](https://nixos.org/manual/nixpkgs/unstable#function-library-lib.customisation.makeScopeWithSplicing-prime).
+- [`lib.fixedPoints`](https://nixos.org/manual/nixpkgs/unstable#sec-functions-library-fixedPoints): Documentation improvements for
+  [`lib.fixedPoints.fix`](https://nixos.org/manual/nixpkgs/unstable#function-library-lib.fixedPoints.fix).
+- `lib.generators`: New functions:
+  [`mkDconfKeyValue`](https://nixos.org/manual/nixpkgs/unstable#function-library-lib.generators.mkDconfKeyValue),
+  [`toDconfINI`](https://nixos.org/manual/nixpkgs/unstable#function-library-lib.generators.toDconfINI).
+
+  `lib.generators.toKeyValue` now supports the `indent` attribute in its first argument.
+- [`lib.lists`](https://nixos.org/manual/nixpkgs/unstable#sec-functions-library-lists): New functions:
+  [`findFirstIndex`](https://nixos.org/manual/nixpkgs/unstable#function-library-lib.lists.findFirstIndex),
+  [`hasPrefix`](https://nixos.org/manual/nixpkgs/unstable#function-library-lib.lists.hasPrefix),
+  [`removePrefix`](https://nixos.org/manual/nixpkgs/unstable#function-library-lib.lists.removePrefix),
+  [`commonPrefix`](https://nixos.org/manual/nixpkgs/unstable#function-library-lib.lists.commonPrefix),
+  [`allUnique`](https://nixos.org/manual/nixpkgs/unstable#function-library-lib.lists.allUnique).
+
+  Documentation improvements for
+  [`lib.lists.foldl'`](https://nixos.org/manual/nixpkgs/unstable#function-library-lib.lists.foldl-prime).
+- [`lib.meta`](https://nixos.org/manual/nixpkgs/unstable#sec-functions-library-meta): Documentation of functions now gets rendered
+- [`lib.path`](https://nixos.org/manual/nixpkgs/unstable#sec-functions-library-path): New functions:
+  [`hasPrefix`](https://nixos.org/manual/nixpkgs/unstable#function-library-lib.path.hasPrefix),
+  [`removePrefix`](https://nixos.org/manual/nixpkgs/unstable#function-library-lib.path.removePrefix),
+  [`splitRoot`](https://nixos.org/manual/nixpkgs/unstable#function-library-lib.path.splitRoot),
+  [`subpath.components`](https://nixos.org/manual/nixpkgs/unstable#function-library-lib.path.subpath.components).
+- [`lib.strings`](https://nixos.org/manual/nixpkgs/unstable#sec-functions-library-strings): New functions:
+  [`replicate`](https://nixos.org/manual/nixpkgs/unstable#function-library-lib.strings.replicate),
+  [`cmakeOptionType`](https://nixos.org/manual/nixpkgs/unstable#function-library-lib.strings.cmakeOptionType),
+  [`cmakeBool`](https://nixos.org/manual/nixpkgs/unstable#function-library-lib.strings.cmakeBool),
+  [`cmakeFeature`](https://nixos.org/manual/nixpkgs/unstable#function-library-lib.strings.cmakeFeature).
+- [`lib.trivial`](https://nixos.org/manual/nixpkgs/unstable#sec-functions-library-trivial): New function:
+  [`mirrorFunctionArgs`](https://nixos.org/manual/nixpkgs/unstable#function-library-lib.trivial.mirrorFunctionArgs).
+- `lib.systems`: New function:
+  [`equals`](https://nixos.org/manual/nixpkgs/unstable#function-library-lib.systems.equals).
+- [`lib.options`](https://nixos.org/manual/nixpkgs/unstable#sec-functions-library-options): Improved documentation for
+  [`mkPackageOption`](https://nixos.org/manual/nixpkgs/unstable#function-library-lib.options.mkPackageOption).
+
+  [`mkPackageOption`](https://nixos.org/manual/nixpkgs/unstable#function-library-lib.options.mkPackageOption).
+  now also supports the `pkgsText` attribute.
+
+Module system:
+- Options in the `options` module argument now have the `declarationPositions` attribute
+  containing the position where the option was declared:
+  ```
+  $ nix repl -f '<nixpkgs/nixos>'
+  [...]
+  nix-repl> :p options.environment.systemPackages.declarationPositions
+  [ {
+    column = 7;
+    file = "/nix/store/vm9zf9wvfd628cchj0hdij1g4hzjrcz9-source/nixos/modules/config/system-path.nix";
+    line = 62;
+  } ]
+  ```
+  Not to be confused with `definitionsWithLocations`, which is the same but for option _definitions_.
+- Improved error message for option declarations missing `mkOption`
+
+### Deprecations {#sec-release-23.11-lib-deprecations}
+
+- `lib.meta.getExe pkg` (also available as `lib.getExe`) now gives a warning if `pkg.meta.mainProgram` is not set,
+  but it continues to default to the derivation name.
+  Nixpkgs accepts PRs that set `meta.mainProgram` on packages where it makes sense.
+  Use `lib.getExe' pkg "some-command"` to avoid the warning and/or select a different executable.
diff --git a/nixos/modules/hardware/video/nvidia.nix b/nixos/modules/hardware/video/nvidia.nix
index c36775dd24bb..c76883b656d4 100644
--- a/nixos/modules/hardware/video/nvidia.nix
+++ b/nixos/modules/hardware/video/nvidia.nix
@@ -261,7 +261,16 @@ in {
         ];
         boot = {
           blacklistedKernelModules = ["nouveau" "nvidiafb"];
-          kernelModules = [ "nvidia-uvm" ];
+
+          # Don't add `nvidia-uvm` to `kernelModules`, because we want
+          # `nvidia-uvm` be loaded only after `udev` rules for `nvidia` kernel
+          # module are applied.
+          #
+          # Instead, we use `softdep` to lazily load `nvidia-uvm` kernel module
+          # after `nvidia` kernel module is loaded and `udev` rules are applied.
+          extraModprobeConfig = ''
+            softdep nvidia post: nvidia-uvm
+          '';
         };
         systemd.tmpfiles.rules =
           lib.optional config.virtualisation.docker.enableNvidia
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index f4ca96d2ca16..cafde7f9efdf 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -474,6 +474,7 @@
   ./services/desktops/pipewire/pipewire.nix
   ./services/desktops/pipewire/wireplumber.nix
   ./services/desktops/profile-sync-daemon.nix
+  ./services/desktops/seatd.nix
   ./services/desktops/system-config-printer.nix
   ./services/desktops/system76-scheduler.nix
   ./services/desktops/telepathy.nix
diff --git a/nixos/modules/programs/singularity.nix b/nixos/modules/programs/singularity.nix
index 05fdb4842c54..79695b29beca 100644
--- a/nixos/modules/programs/singularity.nix
+++ b/nixos/modules/programs/singularity.nix
@@ -45,6 +45,18 @@ in
         Use `lib.mkForce` to forcefully specify the overridden package.
       '';
     };
+    enableExternalLocalStateDir = mkOption {
+      type = types.bool;
+      default = true;
+      example = false;
+      description = mdDoc ''
+        Whether to use top-level directories as LOCALSTATEDIR
+        instead of the store path ones.
+        This affects the SESSIONDIR of Apptainer/Singularity.
+        If set to true, the SESSIONDIR will become
+        `/var/lib/''${projectName}/mnt/session`.
+      '';
+    };
     enableFakeroot = mkOption {
       type = types.bool;
       default = true;
@@ -65,7 +77,9 @@ in
 
   config = mkIf cfg.enable {
     programs.singularity.packageOverriden = (cfg.package.override (
-      optionalAttrs cfg.enableFakeroot {
+      optionalAttrs cfg.enableExternalLocalStateDir {
+        externalLocalStateDir = "/var/lib";
+      } // optionalAttrs cfg.enableFakeroot {
         newuidmapPath = "/run/wrappers/bin/newuidmap";
         newgidmapPath = "/run/wrappers/bin/newgidmap";
       } // optionalAttrs cfg.enableSuid {
@@ -80,12 +94,8 @@ in
       group = "root";
       source = "${cfg.packageOverriden}/libexec/${cfg.packageOverriden.projectName}/bin/starter-suid.orig";
     };
-    systemd.tmpfiles.rules = [
+    systemd.tmpfiles.rules = mkIf cfg.enableExternalLocalStateDir [
       "d /var/lib/${cfg.packageOverriden.projectName}/mnt/session 0770 root root -"
-      "d /var/lib/${cfg.packageOverriden.projectName}/mnt/final 0770 root root -"
-      "d /var/lib/${cfg.packageOverriden.projectName}/mnt/overlay 0770 root root -"
-      "d /var/lib/${cfg.packageOverriden.projectName}/mnt/container 0770 root root -"
-      "d /var/lib/${cfg.packageOverriden.projectName}/mnt/source 0770 root root -"
     ];
   };
 
diff --git a/nixos/modules/services/desktops/seatd.nix b/nixos/modules/services/desktops/seatd.nix
new file mode 100644
index 000000000000..51977dfd2153
--- /dev/null
+++ b/nixos/modules/services/desktops/seatd.nix
@@ -0,0 +1,51 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.services.seatd;
+  inherit (lib) mkEnableOption mkOption mdDoc types;
+in
+{
+  meta.maintainers = with lib.maintainers; [ sinanmohd ];
+
+  options.services.seatd = {
+    enable = mkEnableOption (mdDoc "seatd");
+
+    user = mkOption {
+      type = types.str;
+      default = "root";
+      description = mdDoc "User to own the seatd socket";
+    };
+    group = mkOption {
+      type = types.str;
+      default = "seat";
+      description = mdDoc "Group to own the seatd socket";
+    };
+    logLevel = mkOption {
+      type = types.enum [ "debug" "info" "error" "silent" ];
+      default = "info";
+      description = mdDoc "Logging verbosity";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = with pkgs; [ seatd sdnotify-wrapper ];
+    users.groups.seat = lib.mkIf (cfg.group == "seat") {};
+
+    systemd.services.seatd = {
+      description = "Seat management daemon";
+      documentation = [ "man:seatd(1)" ];
+
+      wantedBy = [ "multi-user.target" ];
+      restartIfChanged = false;
+
+      serviceConfig = {
+        Type = "notify";
+        NotifyAccess = "all";
+        SyslogIdentifier = "seatd";
+        ExecStart = "${pkgs.sdnotify-wrapper}/bin/sdnotify-wrapper ${pkgs.seatd.bin}/bin/seatd -n 1 -u ${cfg.user} -g ${cfg.group} -l ${cfg.logLevel}";
+        RestartSec = 1;
+        Restart = "always";
+      };
+    };
+  };
+}
diff --git a/nixos/modules/services/misc/apache-kafka.nix b/nixos/modules/services/misc/apache-kafka.nix
index 598907aaf1c6..44db77ac754c 100644
--- a/nixos/modules/services/misc/apache-kafka.nix
+++ b/nixos/modules/services/misc/apache-kafka.nix
@@ -5,75 +5,117 @@ with lib;
 let
   cfg = config.services.apache-kafka;
 
-  serverProperties =
-    if cfg.serverProperties != null then
-      cfg.serverProperties
-    else
-      ''
-        # Generated by nixos
-        broker.id=${toString cfg.brokerId}
-        port=${toString cfg.port}
-        host.name=${cfg.hostname}
-        log.dirs=${concatStringsSep "," cfg.logDirs}
-        zookeeper.connect=${cfg.zookeeper}
-        ${toString cfg.extraProperties}
-      '';
+  # The `javaProperties` generator takes care of various escaping rules and
+  # generation of the properties file, but we'll handle stringly conversion
+  # ourselves in mkPropertySettings and stringlySettings, since we know more
+  # about the specifically allowed format eg. for lists of this type, and we
+  # don't want to coerce-downsample values to str too early by having the
+  # coercedTypes from javaProperties directly in our NixOS option types.
+  #
+  # Make sure every `freeformType` and any specific option type in `settings` is
+  # supported here.
+
+  mkPropertyString = let
+    render = {
+      bool = boolToString;
+      int = toString;
+      list = concatMapStringsSep "," mkPropertyString;
+      string = id;
+    };
+  in
+    v: render.${builtins.typeOf v} v;
 
-  serverConfig = pkgs.writeText "server.properties" serverProperties;
-  logConfig = pkgs.writeText "log4j.properties" cfg.log4jProperties;
+  stringlySettings = mapAttrs (_: mkPropertyString)
+    (filterAttrs (_: v:  v != null) cfg.settings);
 
+  generator = (pkgs.formats.javaProperties {}).generate;
 in {
 
   options.services.apache-kafka = {
-    enable = mkOption {
-      description = lib.mdDoc "Whether to enable Apache Kafka.";
-      default = false;
-      type = types.bool;
-    };
-
-    brokerId = mkOption {
-      description = lib.mdDoc "Broker ID.";
-      default = -1;
-      type = types.int;
-    };
+    enable = mkEnableOption (lib.mdDoc "Apache Kafka event streaming broker");
 
-    port = mkOption {
-      description = lib.mdDoc "Port number the broker should listen on.";
-      default = 9092;
-      type = types.port;
+    settings = mkOption {
+      description = lib.mdDoc ''
+        [Kafka broker configuration](https://kafka.apache.org/documentation.html#brokerconfigs)
+        {file}`server.properties`.
+
+        Note that .properties files contain mappings from string to string.
+        Keys with dots are NOT represented by nested attrs in these settings,
+        but instead as quoted strings (ie. `settings."broker.id"`, NOT
+        `settings.broker.id`).
+     '';
+      type = types.submodule {
+        freeformType = with types; let
+          primitive = oneOf [bool int str];
+        in lazyAttrsOf (nullOr (either primitive (listOf primitive)));
+
+        options = {
+          "broker.id" = mkOption {
+            description = lib.mdDoc "Broker ID. -1 or null to auto-allocate in zookeeper mode.";
+            default = null;
+            type = with types; nullOr int;
+          };
+
+          "log.dirs" = mkOption {
+            description = lib.mdDoc "Log file directories.";
+            # Deliberaly leave out old default and use the rewrite opportunity
+            # to have users choose a safer value -- /tmp might be volatile and is a
+            # slightly scary default choice.
+            # default = [ "/tmp/apache-kafka" ];
+            type = with types; listOf path;
+          };
+
+          "listeners" = mkOption {
+            description = lib.mdDoc ''
+              Kafka Listener List.
+              See [listeners](https://kafka.apache.org/documentation/#brokerconfigs_listeners).
+            '';
+            type = types.listOf types.str;
+            default = [ "PLAINTEXT://localhost:9092" ];
+          };
+        };
+      };
     };
 
-    hostname = mkOption {
-      description = lib.mdDoc "Hostname the broker should bind to.";
-      default = "localhost";
-      type = types.str;
+    clusterId = mkOption {
+      description = lib.mdDoc ''
+        KRaft mode ClusterId used for formatting log directories. Can be generated with `kafka-storage.sh random-uuid`
+      '';
+      type = with types; nullOr str;
+      default = null;
     };
 
-    logDirs = mkOption {
-      description = lib.mdDoc "Log file directories";
-      default = [ "/tmp/kafka-logs" ];
-      type = types.listOf types.path;
+    configFiles.serverProperties = mkOption {
+      description = lib.mdDoc ''
+        Kafka server.properties configuration file path.
+        Defaults to the rendered `settings`.
+      '';
+      type = types.path;
     };
 
-    zookeeper = mkOption {
-      description = lib.mdDoc "Zookeeper connection string";
-      default = "localhost:2181";
-      type = types.str;
+    configFiles.log4jProperties = mkOption {
+      description = lib.mdDoc "Kafka log4j property configuration file path";
+      type = types.path;
+      default = pkgs.writeText "log4j.properties" cfg.log4jProperties;
+      defaultText = ''pkgs.writeText "log4j.properties" cfg.log4jProperties'';
     };
 
-    extraProperties = mkOption {
-      description = lib.mdDoc "Extra properties for server.properties.";
-      type = types.nullOr types.lines;
-      default = null;
+    formatLogDirs = mkOption {
+      description = lib.mdDoc ''
+        Whether to format log dirs in KRaft mode if all log dirs are
+        unformatted, ie. they contain no meta.properties.
+      '';
+      type = types.bool;
+      default = false;
     };
 
-    serverProperties = mkOption {
+    formatLogDirsIgnoreFormatted = mkOption {
       description = lib.mdDoc ''
-        Complete server.properties content. Other server.properties config
-        options will be ignored if this option is used.
+        Whether to ignore already formatted log dirs when formatting log dirs,
+        instead of failing. Useful when replacing or adding disks.
       '';
-      type = types.nullOr types.lines;
-      default = null;
+      type = types.bool;
+      default = false;
     };
 
     log4jProperties = mkOption {
@@ -112,40 +154,70 @@ in {
       defaultText = literalExpression "pkgs.apacheKafka.passthru.jre";
       type = types.package;
     };
-
   };
 
-  config = mkIf cfg.enable {
+  imports = [
+    (mkRenamedOptionModule
+      [ "services" "apache-kafka" "brokerId" ]
+      [ "services" "apache-kafka" "settings" ''broker.id'' ])
+    (mkRenamedOptionModule
+      [ "services" "apache-kafka" "logDirs" ]
+      [ "services" "apache-kafka" "settings" ''log.dirs'' ])
+    (mkRenamedOptionModule
+      [ "services" "apache-kafka" "zookeeper" ]
+      [ "services" "apache-kafka" "settings" ''zookeeper.connect'' ])
+
+    (mkRemovedOptionModule [ "services" "apache-kafka" "port" ]
+      "Please see services.apache-kafka.settings.listeners and its documentation instead")
+    (mkRemovedOptionModule [ "services" "apache-kafka" "hostname" ]
+      "Please see services.apache-kafka.settings.listeners and its documentation instead")
+    (mkRemovedOptionModule [ "services" "apache-kafka" "extraProperties" ]
+      "Please see services.apache-kafka.settings and its documentation instead")
+    (mkRemovedOptionModule [ "services" "apache-kafka" "serverProperties" ]
+      "Please see services.apache-kafka.settings and its documentation instead")
+  ];
 
-    environment.systemPackages = [cfg.package];
+  config = mkIf cfg.enable {
+    services.apache-kafka.configFiles.serverProperties = generator "server.properties" stringlySettings;
 
     users.users.apache-kafka = {
       isSystemUser = true;
       group = "apache-kafka";
       description = "Apache Kafka daemon user";
-      home = head cfg.logDirs;
     };
     users.groups.apache-kafka = {};
 
-    systemd.tmpfiles.rules = map (logDir: "d '${logDir}' 0700 apache-kafka - - -") cfg.logDirs;
+    systemd.tmpfiles.rules = map (logDir: "d '${logDir}' 0700 apache-kafka - - -") cfg.settings."log.dirs";
 
     systemd.services.apache-kafka = {
       description = "Apache Kafka Daemon";
       wantedBy = [ "multi-user.target" ];
       after = [ "network.target" ];
+      preStart = mkIf cfg.formatLogDirs
+        (if cfg.formatLogDirsIgnoreFormatted then ''
+          ${cfg.package}/bin/kafka-storage.sh format -t "${cfg.clusterId}" -c ${cfg.configFiles.serverProperties} --ignore-formatted
+        '' else ''
+          if ${concatMapStringsSep " && " (l: ''[ ! -f "${l}/meta.properties" ]'') cfg.settings."log.dirs"}; then
+            ${cfg.package}/bin/kafka-storage.sh format -t "${cfg.clusterId}" -c ${cfg.configFiles.serverProperties}
+          fi
+        '');
       serviceConfig = {
         ExecStart = ''
           ${cfg.jre}/bin/java \
             -cp "${cfg.package}/libs/*" \
-            -Dlog4j.configuration=file:${logConfig} \
+            -Dlog4j.configuration=file:${cfg.configFiles.log4jProperties} \
             ${toString cfg.jvmOptions} \
             kafka.Kafka \
-            ${serverConfig}
+            ${cfg.configFiles.serverProperties}
         '';
         User = "apache-kafka";
         SuccessExitStatus = "0 143";
       };
     };
-
   };
+
+  meta.doc = ./kafka.md;
+  meta.maintainers = with lib.maintainers; [
+    srhb
+  ];
 }
diff --git a/nixos/modules/services/misc/kafka.md b/nixos/modules/services/misc/kafka.md
new file mode 100644
index 000000000000..370bb3b482d2
--- /dev/null
+++ b/nixos/modules/services/misc/kafka.md
@@ -0,0 +1,63 @@
+# Apache Kafka {#module-services-apache-kafka}
+
+[Apache Kafka](https://kafka.apache.org/) is an open-source distributed event
+streaming platform
+
+## Basic Usage {#module-services-apache-kafka-basic-usage}
+
+The Apache Kafka service is configured almost exclusively through its
+[settings](#opt-services.apache-kafka.settings) option, with each attribute
+corresponding to the [upstream configuration
+manual](https://kafka.apache.org/documentation/#configuration) broker settings.
+
+## KRaft {#module-services-apache-kafka-kraft}
+
+Unlike in Zookeeper mode, Kafka in
+[KRaft](https://kafka.apache.org/documentation/#kraft) mode requires each log
+dir to be "formatted" (which means a cluster-specific a metadata file must
+exist in each log dir)
+
+The upstream intention is for users to execute the [storage
+tool](https://kafka.apache.org/documentation/#kraft_storage) to achieve this,
+but this module contains a few extra options to automate this:
+
+- [](#opt-services.apache-kafka.clusterId)
+- [](#opt-services.apache-kafka.formatLogDirs)
+- [](#opt-services.apache-kafka.formatLogDirsIgnoreFormatted)
+
+## Migrating to settings {#module-services-apache-kafka-migrating-to-settings}
+
+Migrating a cluster to the new `settings`-based changes requires adapting removed options to the corresponding upstream settings.
+
+This means that the upstream [Broker Configs documentation](https://kafka.apache.org/documentation/#brokerconfigs) should be followed closely.
+
+Note that dotted options in the upstream docs do _not_ correspond to nested Nix attrsets, but instead as quoted top level `settings` attributes, as in `services.apache-kafka.settings."broker.id"`, *NOT* `services.apache-kafka.settings.broker.id`.
+
+Care should be taken, especially when migrating clusters from the old module, to ensure that the same intended configuration is reproduced faithfully via `settings`.
+
+To assist in the comparison, the final config can be inspected by building the config file itself, ie. with: `nix-build <nixpkgs/nixos> -A config.services.apache-kafka.configFiles.serverProperties`.
+
+Notable changes to be aware of include:
+
+- Removal of `services.apache-kafka.extraProperties` and `services.apache-kafka.serverProperties`
+  - Translate using arbitrary properties using [](#opt-services.apache-kafka.settings)
+  - [Upstream docs](https://kafka.apache.org/documentation.html#brokerconfigs)
+  - The intention is for all broker properties to be fully representable via [](#opt-services.apache-kafka.settings).
+  - If this is not the case, please do consider raising an issue.
+  - Until it can be remedied, you *can* bail out by using [](#opt-services.apache-kafka.configFiles.serverProperties) to the path of a fully rendered properties file.
+
+- Removal of `services.apache-kafka.hostname` and `services.apache-kafka.port`
+  - Translate using: `services.apache-kafka.settings.listeners`
+  - [Upstream docs](https://kafka.apache.org/documentation.html#brokerconfigs_listeners)
+
+- Removal of `services.apache-kafka.logDirs`
+  - Translate using: `services.apache-kafka.settings."log.dirs"`
+  - [Upstream docs](https://kafka.apache.org/documentation.html#brokerconfigs_log.dirs)
+
+- Removal of `services.apache-kafka.brokerId`
+  - Translate using: `services.apache-kafka.settings."broker.id"`
+  - [Upstream docs](https://kafka.apache.org/documentation.html#brokerconfigs_broker.id)
+
+- Removal of `services.apache-kafka.zookeeper`
+  - Translate using: `services.apache-kafka.settings."zookeeper.connect"`
+  - [Upstream docs](https://kafka.apache.org/documentation.html#brokerconfigs_zookeeper.connect)
diff --git a/nixos/modules/tasks/filesystems/bcachefs.nix b/nixos/modules/tasks/filesystems/bcachefs.nix
index d144ce62dc27..f28fd5cde9c1 100644
--- a/nixos/modules/tasks/filesystems/bcachefs.nix
+++ b/nixos/modules/tasks/filesystems/bcachefs.nix
@@ -20,6 +20,7 @@ let
         printf "waiting for device to appear $path"
         for try in $(seq 10); do
           if [ -e $path ]; then
+              target=$(readlink -f $path)
               success=true
               break
           else
@@ -97,7 +98,7 @@ let
           lib.elem (kernel.structuredExtraConfig.BCACHEFS_FS or null) [
             lib.kernel.module
             lib.kernel.yes
-            lib.kernel.option.yes
+            (lib.kernel.option lib.kernel.yes)
           ]
         )
       );
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 44e99203856d..3b0871e36a77 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -742,6 +742,7 @@ in {
   sddm = handleTest ./sddm.nix {};
   seafile = handleTest ./seafile.nix {};
   searx = handleTest ./searx.nix {};
+  seatd = handleTest ./seatd.nix {};
   service-runner = handleTest ./service-runner.nix {};
   sftpgo = runTest ./sftpgo.nix;
   sfxr-qt = handleTest ./sfxr-qt.nix {};
diff --git a/nixos/tests/containers-ip.nix b/nixos/tests/containers-ip.nix
index ecead5c22f75..ecff99a3f0c2 100644
--- a/nixos/tests/containers-ip.nix
+++ b/nixos/tests/containers-ip.nix
@@ -19,10 +19,7 @@ in import ./make-test-python.nix ({ pkgs, lib, ... }: {
 
   nodes.machine =
     { pkgs, ... }: {
-      imports = [ ../modules/installer/cd-dvd/channel.nix ];
-      virtualisation = {
-        writableStore = true;
-      };
+      virtualisation.writableStore = true;
 
       containers.webserver4 = webserverFor "10.231.136.1" "10.231.136.2";
       containers.webserver6 = webserverFor "fc00::2" "fc00::1";
diff --git a/nixos/tests/kafka.nix b/nixos/tests/kafka.nix
index 864253fd8c73..f4f9827ab7b5 100644
--- a/nixos/tests/kafka.nix
+++ b/nixos/tests/kafka.nix
@@ -6,13 +6,62 @@
 with pkgs.lib;
 
 let
-  makeKafkaTest = name: kafkaPackage: (import ./make-test-python.nix ({
+  makeKafkaTest = name: { kafkaPackage, mode ? "zookeeper" }: (import ./make-test-python.nix ({
     inherit name;
     meta = with pkgs.lib.maintainers; {
       maintainers = [ nequissimus ];
     };
 
     nodes = {
+      kafka = { ... }: {
+        services.apache-kafka = mkMerge [
+          ({
+            enable = true;
+            package = kafkaPackage;
+            settings = {
+              "offsets.topic.replication.factor" = 1;
+              "log.dirs" = [
+                "/var/lib/kafka/logdir1"
+                "/var/lib/kafka/logdir2"
+              ];
+            };
+          })
+          (mkIf (mode == "zookeeper") {
+            settings = {
+              "zookeeper.session.timeout.ms" = 600000;
+              "zookeeper.connect" = [ "zookeeper1:2181" ];
+            };
+          })
+          (mkIf (mode == "kraft") {
+            clusterId = "ak2fIHr4S8WWarOF_ODD0g";
+            formatLogDirs = true;
+            settings = {
+              "node.id" = 1;
+              "process.roles" = [
+                "broker"
+                "controller"
+              ];
+              "listeners" = [
+                "PLAINTEXT://:9092"
+                "CONTROLLER://:9093"
+              ];
+              "listener.security.protocol.map" = [
+                "PLAINTEXT:PLAINTEXT"
+                "CONTROLLER:PLAINTEXT"
+              ];
+              "controller.quorum.voters" = [
+                "1@kafka:9093"
+              ];
+              "controller.listener.names" = [ "CONTROLLER" ];
+            };
+          })
+        ];
+
+        networking.firewall.allowedTCPPorts = [ 9092 9093 ];
+        # i686 tests: qemu-system-i386 can simulate max 2047MB RAM (not 2048)
+        virtualisation.memorySize = 2047;
+      };
+    } // optionalAttrs (mode == "zookeeper") {
       zookeeper1 = { ... }: {
         services.zookeeper = {
           enable = true;
@@ -20,29 +69,16 @@ let
 
         networking.firewall.allowedTCPPorts = [ 2181 ];
       };
-      kafka = { ... }: {
-        services.apache-kafka = {
-          enable = true;
-          extraProperties = ''
-            offsets.topic.replication.factor = 1
-            zookeeper.session.timeout.ms = 600000
-          '';
-          package = kafkaPackage;
-          zookeeper = "zookeeper1:2181";
-        };
-
-        networking.firewall.allowedTCPPorts = [ 9092 ];
-        # i686 tests: qemu-system-i386 can simulate max 2047MB RAM (not 2048)
-        virtualisation.memorySize = 2047;
-      };
     };
 
     testScript = ''
       start_all()
 
+      ${optionalString (mode == "zookeeper") ''
       zookeeper1.wait_for_unit("default.target")
       zookeeper1.wait_for_unit("zookeeper.service")
       zookeeper1.wait_for_open_port(2181)
+      ''}
 
       kafka.wait_for_unit("default.target")
       kafka.wait_for_unit("apache-kafka.service")
@@ -67,12 +103,13 @@ let
   }) { inherit system; });
 
 in with pkgs; {
-  kafka_2_8  = makeKafkaTest "kafka_2_8"  apacheKafka_2_8;
-  kafka_3_0  = makeKafkaTest "kafka_3_0"  apacheKafka_3_0;
-  kafka_3_1  = makeKafkaTest "kafka_3_1"  apacheKafka_3_1;
-  kafka_3_2  = makeKafkaTest "kafka_3_2"  apacheKafka_3_2;
-  kafka_3_3  = makeKafkaTest "kafka_3_3"  apacheKafka_3_3;
-  kafka_3_4  = makeKafkaTest "kafka_3_4"  apacheKafka_3_4;
-  kafka_3_5  = makeKafkaTest "kafka_3_5"  apacheKafka_3_5;
-  kafka  = makeKafkaTest "kafka"  apacheKafka;
+  kafka_2_8 = makeKafkaTest "kafka_2_8" { kafkaPackage = apacheKafka_2_8; };
+  kafka_3_0 = makeKafkaTest "kafka_3_0" { kafkaPackage = apacheKafka_3_0; };
+  kafka_3_1 = makeKafkaTest "kafka_3_1" { kafkaPackage = apacheKafka_3_1; };
+  kafka_3_2 = makeKafkaTest "kafka_3_2" { kafkaPackage = apacheKafka_3_2; };
+  kafka_3_3 = makeKafkaTest "kafka_3_3" { kafkaPackage = apacheKafka_3_3; };
+  kafka_3_4 = makeKafkaTest "kafka_3_4" { kafkaPackage = apacheKafka_3_4; };
+  kafka_3_5 = makeKafkaTest "kafka_3_5" { kafkaPackage = apacheKafka_3_5; };
+  kafka = makeKafkaTest "kafka" { kafkaPackage = apacheKafka; };
+  kafka_kraft = makeKafkaTest "kafka_kraft" { kafkaPackage = apacheKafka; mode = "kraft"; };
 }
diff --git a/nixos/tests/seatd.nix b/nixos/tests/seatd.nix
new file mode 100644
index 000000000000..138a6cb1cf44
--- /dev/null
+++ b/nixos/tests/seatd.nix
@@ -0,0 +1,51 @@
+import ./make-test-python.nix ({ pkgs, lib, ... }:
+
+let
+  seatd-test = pkgs.writeShellApplication {
+    name = "seatd-client-pid";
+    text = ''
+      journalctl -u seatd --no-pager -b | while read -r line; do
+          case "$line" in
+          *"New client connected"*)
+              line="''${line##*pid: }"
+              pid="''${line%%,*}"
+              ;;
+          *"Opened client"*)
+              echo "$pid"
+              exit
+          esac
+      done;
+    '';
+  };
+in
+{
+  name = "seatd";
+  meta.maintainers = with lib.maintainers; [ sinanmohd ];
+
+  nodes.machine = { ... }: {
+    imports = [ ./common/user-account.nix ];
+    services.getty.autologinUser = "alice";
+    users.users.alice.extraGroups = [ "seat" "wheel" ];
+
+    fonts.enableDefaultPackages = true;
+    environment.systemPackages = with pkgs; [
+      dwl
+      foot
+      seatd-test
+    ];
+
+    programs.bash.loginShellInit = ''
+      [ "$(tty)" = "/dev/tty1" ] &&
+          dwl -s 'foot touch /tmp/foot_started'
+    '';
+
+    hardware.opengl.enable = true;
+    virtualisation.qemu.options = [ "-vga none -device virtio-gpu-pci" ];
+    services.seatd.enable = true;
+  };
+
+  testScript = ''
+    machine.wait_for_file("/tmp/foot_started")
+    machine.succeed("test $(seatd-client-pid) = $(pgrep dwl)")
+  '';
+})
diff --git a/pkgs/applications/audio/mousai/default.nix b/pkgs/applications/audio/mousai/default.nix
index fae165495e19..c2bcc0200fbc 100644
--- a/pkgs/applications/audio/mousai/default.nix
+++ b/pkgs/applications/audio/mousai/default.nix
@@ -23,19 +23,19 @@
 
 stdenv.mkDerivation rec {
   pname = "mousai";
-  version = "0.7.5";
+  version = "0.7.6";
 
   src = fetchFromGitHub {
     owner = "SeaDve";
     repo = "Mousai";
     rev = "v${version}";
-    hash = "sha256-4olJGpS5QfPyt6/ZmigoojP7kGjx6LExW3LKrL4nxTE=";
+    hash = "sha256-QInnKjGYaWlIj+F3upQ8CJ6RqCM72Y+BGrrezndqfOg=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-SeKcguCB+f2ocKKf7Moc74O2sGK2EXgEEkTiN82dSps=";
+    hash = "sha256-/AwTNuDdhAhj/kbc6EdC3FKGO1LfZIY68utPjcrw0S0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/audio/muzika/default.nix b/pkgs/applications/audio/muzika/default.nix
index 01f09a5bef92..6605ebc9dcca 100644
--- a/pkgs/applications/audio/muzika/default.nix
+++ b/pkgs/applications/audio/muzika/default.nix
@@ -2,7 +2,7 @@
 , desktop-file-utils
 , fetchFromGitHub
 , fetchYarnDeps
-, fixup_yarn_lock
+, prefetch-yarn-deps
 , gjs
 , glib-networking
 , gobject-introspection
@@ -40,6 +40,7 @@ stdenv.mkDerivation rec {
     pkg-config
     wrapGAppsHook4
     yarn
+    prefetch-yarn-deps
   ];
 
   buildInputs = [
@@ -61,7 +62,7 @@ stdenv.mkDerivation rec {
   preConfigure = ''
     export HOME="$PWD"
     yarn config --offline set yarn-offline-mirror $yarnOfflineCache
-    ${fixup_yarn_lock}/bin/fixup_yarn_lock yarn.lock
+    fixup-yarn-lock yarn.lock
   '';
 
   mesonFlags = [
diff --git a/pkgs/applications/blockchains/besu/default.nix b/pkgs/applications/blockchains/besu/default.nix
index 549437313bb4..bf1e4ced669a 100644
--- a/pkgs/applications/blockchains/besu/default.nix
+++ b/pkgs/applications/blockchains/besu/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "besu";
-  version = "23.10.0";
+  version = "23.10.2";
 
   src = fetchurl {
     url = "https://hyperledger.jfrog.io/artifactory/${pname}-binaries/${pname}/${version}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-PHXzeSv9sIknBbN48Li/wU72zs8div5xHY2Gh+1mh88=";
+    sha256 = "sha256-JVgYpcYGejiqi1ZdjzKkmhcqdTah03BnO7t19UgmPCw=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/applications/graphics/drawio/default.nix b/pkgs/applications/graphics/drawio/default.nix
index fdf571b026a3..688b61a86d0c 100644
--- a/pkgs/applications/graphics/drawio/default.nix
+++ b/pkgs/applications/graphics/drawio/default.nix
@@ -4,7 +4,7 @@
 , fetchYarnDeps
 , makeDesktopItem
 , copyDesktopItems
-, fixup_yarn_lock
+, prefetch-yarn-deps
 , makeWrapper
 , nodejs
 , yarn
@@ -13,23 +13,23 @@
 
 stdenv.mkDerivation rec {
   pname = "drawio";
-  version = "22.0.3";
+  version = "22.1.2";
 
   src = fetchFromGitHub {
     owner = "jgraph";
     repo = "drawio-desktop";
     rev = "v${version}";
     fetchSubmodules = true;
-    hash = "sha256-Im0T+1jm1IZT3UILsOJ4Rp5P5IiBUKcJJ+cqv3WsqXw=";
+    hash = "sha256-4S4N7vfDwzlNutPfHozy/z0LOAr8q8EepXV4tsy+yAU=";
   };
 
   offlineCache = fetchYarnDeps {
     yarnLock = src + "/yarn.lock";
-    hash = "sha256-Abyu/WoNOPAIfRIThG7vKFECW9NQMgcBAkLgEPwdJDQ=";
+    hash = "sha256-QM7qazr8Iv4gjO7vF5Wj564D/yB+ZWmMGQDtTFytK00=";
   };
 
   nativeBuildInputs = [
-    fixup_yarn_lock
+    prefetch-yarn-deps
     makeWrapper
     nodejs
     yarn
@@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
 
     export HOME="$TMPDIR"
     yarn config --offline set yarn-offline-mirror "$offlineCache"
-    fixup_yarn_lock yarn.lock
+    fixup-yarn-lock yarn.lock
     yarn install --offline --frozen-lockfile --ignore-platform --ignore-scripts --no-progress --non-interactive
     patchShebangs node_modules/
 
diff --git a/pkgs/applications/misc/mako/default.nix b/pkgs/applications/misc/mako/default.nix
index ffad5a5684fa..b4eeb51049be 100644
--- a/pkgs/applications/misc/mako/default.nix
+++ b/pkgs/applications/misc/mako/default.nix
@@ -35,5 +35,6 @@ stdenv.mkDerivation rec {
     license = licenses.mit;
     maintainers = with maintainers; [ dywedir synthetica ];
     platforms = platforms.linux;
+    mainProgram = "mako";
   };
 }
diff --git a/pkgs/applications/misc/oxker/default.nix b/pkgs/applications/misc/oxker/default.nix
index 2e22cdbd1b3a..5d10c7156364 100644
--- a/pkgs/applications/misc/oxker/default.nix
+++ b/pkgs/applications/misc/oxker/default.nix
@@ -2,14 +2,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "oxker";
-  version = "0.3.3";
+  version = "0.4.0";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-2zdsVItGZYQydpC9E/uCbzOE9Xoh7zTqa9DpxA5qNCc=";
+    sha256 = "sha256-zre4ccMmv1NWcokLvEFRIf+kornAnge/a3c3b6IO03o=";
   };
 
-  cargoHash = "sha256-FXYFQpiK2BGUz9GjsUPS9LWPeezbBQ3A33juoVCl71g=";
+  cargoHash = "sha256-xdfaTVRt5h4q0kfAE1l6pOXCfk0Cb8TnKNMZeeGvciY=";
 
   meta = with lib; {
     description = "A simple tui to view & control docker containers";
diff --git a/pkgs/applications/misc/seatd/default.nix b/pkgs/applications/misc/seatd/default.nix
index 7cc2c967fe01..da3dda9fc8d7 100644
--- a/pkgs/applications/misc/seatd/default.nix
+++ b/pkgs/applications/misc/seatd/default.nix
@@ -6,6 +6,7 @@
 , scdoc
 , stdenv
 , systemdSupport ? lib.meta.availableOn stdenv.hostPlatform systemd, systemd
+, nixosTests
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -40,8 +41,10 @@ stdenv.mkDerivation (finalAttrs: {
     "-Dserver=enabled"
   ];
 
+  passthru.tests.basic = nixosTests.seatd;
+
   meta = {
-    description = "A universal seat management library";
+    description = "A minimal seat management daemon, and a universal seat management library";
     changelog = "https://git.sr.ht/~kennylevinsen/seatd/refs/${finalAttrs.version}";
     homepage = "https://sr.ht/~kennylevinsen/seatd/";
     license = lib.licenses.mit;
diff --git a/pkgs/applications/misc/tandoor-recipes/frontend.nix b/pkgs/applications/misc/tandoor-recipes/frontend.nix
index dd6380449d95..d63c0874171e 100644
--- a/pkgs/applications/misc/tandoor-recipes/frontend.nix
+++ b/pkgs/applications/misc/tandoor-recipes/frontend.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchYarnDeps, fixup_yarn_lock, callPackage, nodejs }:
+{ stdenv, fetchYarnDeps, prefetch-yarn-deps, callPackage, nodejs }:
 let
   common = callPackage ./common.nix { };
 in
@@ -14,7 +14,7 @@ stdenv.mkDerivation {
   };
 
   nativeBuildInputs = [
-    fixup_yarn_lock
+    prefetch-yarn-deps
     nodejs
     nodejs.pkgs.yarn
   ];
@@ -24,7 +24,7 @@ stdenv.mkDerivation {
 
     export HOME=$(mktemp -d)
     yarn config --offline set yarn-offline-mirror "$yarnOfflineCache"
-    fixup_yarn_lock yarn.lock
+    fixup-yarn-lock yarn.lock
     command -v yarn
     yarn install --frozen-lockfile --offline --no-progress --non-interactive
     patchShebangs node_modules/
diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix
index 020d902a9812..249c8b45f3f5 100644
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@@ -47,7 +47,6 @@
 , glibc # gconv + locale
 # postFixup:
 , vulkan-loader
-, libglvnd
 
 # Package customization:
 , cupsSupport ? true, cups ? null
@@ -490,11 +489,11 @@ let
     '';
 
     postFixup = ''
-      # Make sure that libGLESv2 and libvulkan are found by dlopen.
+      # Make sure that libGLESv2 and libvulkan are found by dlopen in both chromium binary and ANGLE libGLESv2.so.
       # libpci (from pciutils) is needed by dlopen in angle/src/gpu_info_util/SystemInfo_libpci.cpp
-      chromiumBinary="$libExecPath/$packageName"
-      origRpath="$(patchelf --print-rpath "$chromiumBinary")"
-      patchelf --set-rpath "${lib.makeLibraryPath [ libGL libglvnd vulkan-loader pciutils ]}:$origRpath" "$chromiumBinary"
+      for chromiumBinary in "$libExecPath/$packageName" "$libExecPath/libGLESv2.so"; do
+        patchelf --set-rpath "${lib.makeLibraryPath [ libGL vulkan-loader pciutils ]}:$(patchelf --print-rpath "$chromiumBinary")" "$chromiumBinary"
+      done
     '';
 
     passthru = {
diff --git a/pkgs/applications/networking/cluster/kubergrunt/default.nix b/pkgs/applications/networking/cluster/kubergrunt/default.nix
index c38e4e247334..c69ec96df6a2 100644
--- a/pkgs/applications/networking/cluster/kubergrunt/default.nix
+++ b/pkgs/applications/networking/cluster/kubergrunt/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "kubergrunt";
-  version = "0.12.1";
+  version = "0.13.0";
 
   src = fetchFromGitHub {
     owner = "gruntwork-io";
     repo = "kubergrunt";
     rev = "v${version}";
-    sha256 = "sha256-qd+7tYvRpRMg8Y83L/K8g8fWrfO4rAQj72EpunqfSsc=";
+    sha256 = "sha256-ZUuMQ0y6qXM9g/snJchqGPf7z+5skE/OPqC3rvRenXo=";
   };
 
   vendorHash = "sha256-AUw1wJNWjpNVsjw/Hr1ZCePYWQkf1SqRVnQgi8tOFG0=";
diff --git a/pkgs/applications/networking/cluster/terraform-providers/default.nix b/pkgs/applications/networking/cluster/terraform-providers/default.nix
index 6769c46868d6..2454092e0051 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/default.nix
+++ b/pkgs/applications/networking/cluster/terraform-providers/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , buildGoModule
-, buildGo121Module
 , fetchFromGitHub
 , fetchFromGitLab
 , callPackage
@@ -87,7 +86,6 @@ let
       heroku = automated-providers.heroku.override { spdx = "MPL-2.0"; };
       # mkisofs needed to create ISOs holding cloud-init data and wrapped to terraform via deecb4c1aab780047d79978c636eeb879dd68630
       libvirt = automated-providers.libvirt.overrideAttrs (_: { propagatedBuildInputs = [ cdrtools ]; });
-      tailscale = automated-providers.tailscale.override { mkProviderGoModule = buildGo121Module; };
     };
 
   # Put all the providers we not longer support in this list.
@@ -98,7 +96,6 @@ let
     in
     lib.optionalAttrs config.allowAliases {
       fly = archived "fly" "2023/10";
-      ksyun = removed "ksyun" "2023/04";
     };
 
   # excluding aliases, used by terraform-full
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 3ba13e12bc57..62ca803c8b63 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -103,11 +103,10 @@
     "hash": "sha256-EGpHajrTTOx7LrFHzsrrkGMqsuUEJLJAN6AJ48QdJis=",
     "homepage": "https://registry.terraform.io/providers/vmware/avi",
     "owner": "vmware",
-    "proxyVendor": true,
     "repo": "terraform-provider-avi",
     "rev": "v22.1.5",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-1+VDh9hR/2Knl5oV9ZQiPCt+F7VmaTU4MI1+o8Msu8M="
+    "vendorHash": "sha256-r42KHzvRBXuWgLgtg+WUVt0ThjSMXtUKjEE9y/s/1uQ="
   },
   "aviatrix": {
     "hash": "sha256-PRYtkq4CLEbUJ7YOSlvDyz+z4icLi0DBkDCTs/tNoIQ=",
@@ -1227,11 +1226,10 @@
     "hash": "sha256-9SOHw46KChe7bGInsIIyy0pyNG3K7CXNEomHkmpt8d4=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/vault",
     "owner": "hashicorp",
-    "proxyVendor": true,
     "repo": "terraform-provider-vault",
     "rev": "v3.22.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-HvjbXSAkbTmADyWQaw0lZV3nZUEIYiAB3VahYvIQeb4="
+    "vendorHash": "sha256-5rRWlInDRj7hw4GZqTxfH7Y8tyTvzJgBWA1I5j0EyaI="
   },
   "vcd": {
     "hash": "sha256-ltdkB9PqmuCs5daRjcThVhy1wIoDW21yBiwtRo/pMss=",
diff --git a/pkgs/applications/networking/instant-messengers/element/element-desktop.nix b/pkgs/applications/networking/instant-messengers/element/element-desktop.nix
index 7611f4dfa03f..4eb5707fe256 100644
--- a/pkgs/applications/networking/instant-messengers/element/element-desktop.nix
+++ b/pkgs/applications/networking/instant-messengers/element/element-desktop.nix
@@ -3,7 +3,7 @@
 , fetchFromGitHub
 , makeWrapper
 , makeDesktopItem
-, fixup_yarn_lock
+, prefetch-yarn-deps
 , yarn
 , nodejs
 , fetchYarnDeps
@@ -41,7 +41,7 @@ stdenv.mkDerivation (finalAttrs: builtins.removeAttrs pinData [ "hashes" ] // {
     sha256 = desktopYarnHash;
   };
 
-  nativeBuildInputs = [ yarn fixup_yarn_lock nodejs makeWrapper jq ]
+  nativeBuildInputs = [ yarn prefetch-yarn-deps nodejs makeWrapper jq ]
     ++ lib.optionals stdenv.isDarwin [ desktopToDarwinBundle ];
 
   inherit seshat;
@@ -51,7 +51,7 @@ stdenv.mkDerivation (finalAttrs: builtins.removeAttrs pinData [ "hashes" ] // {
 
     export HOME=$(mktemp -d)
     yarn config --offline set yarn-offline-mirror $offlineCache
-    fixup_yarn_lock yarn.lock
+    fixup-yarn-lock yarn.lock
     yarn install --offline --frozen-lockfile --ignore-platform --ignore-scripts --no-progress --non-interactive
     patchShebangs node_modules/
 
diff --git a/pkgs/applications/networking/instant-messengers/element/element-web.nix b/pkgs/applications/networking/instant-messengers/element/element-web.nix
index 4e80744a4c0f..343c21d64730 100644
--- a/pkgs/applications/networking/instant-messengers/element/element-web.nix
+++ b/pkgs/applications/networking/instant-messengers/element/element-web.nix
@@ -6,7 +6,7 @@
 , writeText
 , jq
 , yarn
-, fixup_yarn_lock
+, prefetch-yarn-deps
 , nodejs
 , jitsi-meet
 }:
@@ -33,7 +33,18 @@ stdenv.mkDerivation (finalAttrs: builtins.removeAttrs pinData [ "hashes" ] // {
     sha256 = webYarnHash;
   };
 
-  nativeBuildInputs = [ yarn fixup_yarn_lock jq nodejs ];
+  nativeBuildInputs = [ yarn prefetch-yarn-deps jq nodejs ];
+
+  buildPhase = ''
+    runHook preBuild
+
+    export VERSION=${finalAttrs.version}
+    yarn --offline build:res
+    yarn --offline build:module_system
+    yarn --offline build:bundle
+
+    runHook postBuild
+  '';
 
   configurePhase = ''
     runHook preConfigure
@@ -46,7 +57,7 @@ stdenv.mkDerivation (finalAttrs: builtins.removeAttrs pinData [ "hashes" ] // {
     export NODE_OPTIONS=--openssl-legacy-provider
     mkdir -p $HOME
 
-    fixup_yarn_lock yarn.lock
+    fixup-yarn-lock yarn.lock
     yarn config --offline set yarn-offline-mirror $offlineCache
     yarn install --offline --frozen-lockfile --ignore-platform --ignore-scripts --no-progress --non-interactive
     patchShebangs node_modules
@@ -54,17 +65,6 @@ stdenv.mkDerivation (finalAttrs: builtins.removeAttrs pinData [ "hashes" ] // {
     runHook postConfigure
   '';
 
-  buildPhase = ''
-    runHook preBuild
-
-    export VERSION=${finalAttrs.version}
-    yarn build:res --offline
-    yarn build:module_system --offline
-    yarn build:bundle --offline
-
-    runHook postBuild
-  '';
-
   installPhase = ''
     runHook preInstall
 
diff --git a/pkgs/applications/networking/instant-messengers/element/pin.nix b/pkgs/applications/networking/instant-messengers/element/pin.nix
index a49a2f271583..a730d8611b78 100644
--- a/pkgs/applications/networking/instant-messengers/element/pin.nix
+++ b/pkgs/applications/networking/instant-messengers/element/pin.nix
@@ -1,9 +1,9 @@
 {
-  "version" = "1.11.47";
+  "version" = "1.11.50";
   "hashes" = {
-    "desktopSrcHash" = "sha256-Ea3LJt+3HAOX2PTREMojtuPVTeA6u7VJtysd8bbTbwU=";
-    "desktopYarnHash" = "1nssv92yk1a53v7mvijkrb3gzif5xrz2j6lxvg7p340z42rm7f9v";
-    "webSrcHash" = "sha256-DPBMZMjDnwjdNsePcUBBU0KRGOpOmNHgQZn9/ad/Qss=";
-    "webYarnHash" = "0rzipmaq0jarzdawl7lmxnapwzl52kklxadm859hgx9b1hd5vwj7";
+    "desktopSrcHash" = "sha256-ZSzH0QWUSmoSk57TF7EH3DbUFO4VX8jCrH55oruMP+s=";
+    "desktopYarnHash" = "044sjxpd86zhmd0wcqmsnjvrh1krspp2qd9xzlxii4zwm9jz1hxn";
+    "webSrcHash" = "sha256-6BzqETzQL4Xi4YqSyjFmIgajPPpagTS4tYhOZrEfEpo=";
+    "webYarnHash" = "1aw40r44dvl43bfgl2cr52hdj833maq2xyg3xa49837m7lf6pr8c";
   };
 }
diff --git a/pkgs/applications/networking/instant-messengers/element/seshat/default.nix b/pkgs/applications/networking/instant-messengers/element/seshat/default.nix
index b24b0d7b71ba..980e22c0c3e3 100644
--- a/pkgs/applications/networking/instant-messengers/element/seshat/default.nix
+++ b/pkgs/applications/networking/instant-messengers/element/seshat/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, rustPlatform, fetchFromGitHub, callPackage, sqlcipher, nodejs, python3, yarn, fixup_yarn_lock, CoreServices, fetchYarnDeps, removeReferencesTo }:
+{ lib, stdenv, rustPlatform, fetchFromGitHub, callPackage, sqlcipher, nodejs, python3, yarn, prefetch-yarn-deps, CoreServices, fetchYarnDeps, removeReferencesTo }:
 
 let
   pinData = lib.importJSON ./pin.json;
@@ -16,7 +16,7 @@ in rustPlatform.buildRustPackage rec {
 
   sourceRoot = "${src.name}/seshat-node/native";
 
-  nativeBuildInputs = [ nodejs python3 yarn ];
+  nativeBuildInputs = [ nodejs python3 yarn prefetch-yarn-deps ];
   buildInputs = [ sqlcipher ] ++ lib.optional stdenv.isDarwin CoreServices;
 
   npm_config_nodedir = nodejs;
@@ -33,7 +33,7 @@ in rustPlatform.buildRustPackage rec {
     export HOME=$PWD/tmp
     mkdir -p $HOME
     yarn config --offline set yarn-offline-mirror $yarnOfflineCache
-    ${fixup_yarn_lock}/bin/fixup_yarn_lock yarn.lock
+    fixup-yarn-lock yarn.lock
     yarn install --offline --frozen-lockfile --ignore-platform --ignore-scripts --no-progress --non-interactive
     patchShebangs node_modules/
     node_modules/.bin/neon build --release
diff --git a/pkgs/applications/networking/instant-messengers/schildichat/schildichat-desktop.nix b/pkgs/applications/networking/instant-messengers/schildichat/schildichat-desktop.nix
index cf2c44f5f2f2..86bc2d671eb0 100644
--- a/pkgs/applications/networking/instant-messengers/schildichat/schildichat-desktop.nix
+++ b/pkgs/applications/networking/instant-messengers/schildichat/schildichat-desktop.nix
@@ -9,7 +9,7 @@
 , fetchYarnDeps
 , yarn
 , nodejs
-, fixup_yarn_lock
+, prefetch-yarn-deps
 , electron
 , Security
 , AppKit
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
     sha256 = pinData.desktopYarnHash;
   };
 
-  nativeBuildInputs = [ yarn fixup_yarn_lock nodejs makeWrapper copyDesktopItems ];
+  nativeBuildInputs = [ yarn prefetch-yarn-deps nodejs makeWrapper copyDesktopItems ];
   inherit (element-desktop) seshat keytar;
 
   configurePhase = ''
@@ -47,7 +47,7 @@ stdenv.mkDerivation rec {
     export HOME=$(mktemp -d)
     pushd element-desktop
     yarn config --offline set yarn-offline-mirror $offlineCache
-    fixup_yarn_lock yarn.lock
+    fixup-yarn-lock yarn.lock
     yarn install --offline --frozen-lockfile --ignore-platform --ignore-scripts --no-progress --non-interactive
     rm -rf node_modules/matrix-seshat node_modules/keytar
     ln -s $keytar node_modules/keytar
diff --git a/pkgs/applications/networking/instant-messengers/schildichat/schildichat-web.nix b/pkgs/applications/networking/instant-messengers/schildichat/schildichat-web.nix
index 1cba6c62a765..0803bcc37791 100644
--- a/pkgs/applications/networking/instant-messengers/schildichat/schildichat-web.nix
+++ b/pkgs/applications/networking/instant-messengers/schildichat/schildichat-web.nix
@@ -3,7 +3,7 @@
 , fetchYarnDeps
 , nodejs
 , yarn
-, fixup_yarn_lock
+, prefetch-yarn-deps
 , writeText, jq, conf ? {}
 }:
 
@@ -39,7 +39,7 @@ in stdenv.mkDerivation rec {
     sha256 = pinData.reactSdkYarnHash;
   };
 
-  nativeBuildInputs = [ yarn fixup_yarn_lock jq nodejs ];
+  nativeBuildInputs = [ yarn prefetch-yarn-deps jq nodejs ];
 
   configurePhase = ''
     runHook preConfigure
@@ -53,7 +53,7 @@ in stdenv.mkDerivation rec {
     mkdir -p $HOME
 
     pushd element-web
-    fixup_yarn_lock yarn.lock
+    fixup-yarn-lock yarn.lock
     yarn config --offline set yarn-offline-mirror $webOfflineCache
     yarn install --offline --frozen-lockfile --ignore-platform --ignore-scripts --no-progress --non-interactive
     patchShebangs node_modules
@@ -64,14 +64,14 @@ in stdenv.mkDerivation rec {
     popd
 
     pushd matrix-js-sdk
-    fixup_yarn_lock yarn.lock
+    fixup-yarn-lock yarn.lock
     yarn config --offline set yarn-offline-mirror $jsSdkOfflineCache
     yarn install --offline --frozen-lockfile --ignore-platform --ignore-scripts --no-progress --non-interactive
     patchShebangs node_modules
     popd
 
     pushd matrix-react-sdk
-    fixup_yarn_lock yarn.lock
+    fixup-yarn-lock yarn.lock
     yarn config --offline set yarn-offline-mirror $reactSdkOfflineCache
     yarn install --offline --frozen-lockfile --ignore-platform --ignore-scripts --no-progress --non-interactive
     patchShebangs node_modules scripts
diff --git a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
index 0e66707349db..683b1d7550cb 100644
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
@@ -1,12 +1,12 @@
 { callPackage }: builtins.mapAttrs (pname: attrs: callPackage ./generic.nix (attrs // { inherit pname; })) {
   signal-desktop = {
     dir = "Signal";
-    version = "6.39.0";
-    hash = "sha256-cG8ZFWpx92haTgMkpMMcFDV0OB7lmU540g9fNj4ofy8=";
+    version = "6.39.1";
+    hash = "sha256-dDbUpxXpQg1SoVyYO33Nczqf+WmWDPNE6cmw792wjGY=";
   };
   signal-desktop-beta = {
     dir = "Signal Beta";
-    version = "6.40.0-beta.1";
-    hash = "sha256-daXh1Uh2lHw0NA/j7qhQK7nrVljbr/fP2iLjcqnuvns=";
+    version = "6.40.0-beta.2";
+    hash = "sha256-pfedkxbZ25DFgz+/N7ZEb9LwKrHuoMM+Zi+Tc21QPsg=";
   };
 }
diff --git a/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix b/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix
index a30f5be4ce9f..ed8ed3032781 100644
--- a/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix
+++ b/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix
@@ -7,7 +7,7 @@
 , yarn
 , nodejs
 , fetchYarnDeps
-, fixup_yarn_lock
+, prefetch-yarn-deps
 , electron
 , libpulseaudio
 , pipewire
@@ -19,28 +19,28 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "teams-for-linux";
-  version = "1.3.19";
+  version = "1.3.22";
 
   src = fetchFromGitHub {
     owner = "IsmaelMartinez";
     repo = "teams-for-linux";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-+n26VTNRymPdzMbSz8AZsQ73xOHizOFAstw6toKfZQM=";
+    hash = "sha256-nyhAq06k0nNrGSbD0N1RNwcplYf5vO1BvnvEfNYGG0A=";
   };
 
   offlineCache = fetchYarnDeps {
     yarnLock = "${finalAttrs.src}/yarn.lock";
-    hash = "sha256-SxUdTzk8WngkKwT05U8HJsK8+8ezcJWdiT/ettxpeEE=";
+    hash = "sha256-ydhJXAvz3k6GwpnSL6brl9xFpb+ooi8Am89TkcE00hc=";
   };
 
-  nativeBuildInputs = [ yarn fixup_yarn_lock nodejs copyDesktopItems makeWrapper ];
+  nativeBuildInputs = [ yarn prefetch-yarn-deps nodejs copyDesktopItems makeWrapper ];
 
   configurePhase = ''
     runHook preConfigure
 
     export HOME=$(mktemp -d)
     yarn config --offline set yarn-offline-mirror $offlineCache
-    fixup_yarn_lock yarn.lock
+    fixup-yarn-lock yarn.lock
     yarn install --offline --frozen-lockfile --ignore-platform --ignore-scripts --no-progress --non-interactive
     patchShebangs node_modules/
 
diff --git a/pkgs/applications/networking/maestral-qt/default.nix b/pkgs/applications/networking/maestral-qt/default.nix
index 6ce0abb6c0e6..51fde794a1c8 100644
--- a/pkgs/applications/networking/maestral-qt/default.nix
+++ b/pkgs/applications/networking/maestral-qt/default.nix
@@ -1,8 +1,11 @@
 { lib
 , fetchFromGitHub
 , python3
-, qt6
+, qtbase
+, qtsvg
+, qtwayland
 , nixosTests
+, wrapQtAppsHook
 }:
 
 python3.pkgs.buildPythonApplication rec {
@@ -28,12 +31,13 @@ python3.pkgs.buildPythonApplication rec {
   ];
 
   buildInputs = [
-    qt6.qtbase
-    qt6.qtsvg  # Needed for the systray icon
+    qtwayland
+    qtbase
+    qtsvg  # Needed for the systray icon
   ];
 
   nativeBuildInputs = [
-    qt6.wrapQtAppsHook
+    wrapQtAppsHook
   ];
 
   dontWrapQtApps = true;
diff --git a/pkgs/applications/science/logic/lean4/default.nix b/pkgs/applications/science/logic/lean4/default.nix
index ecc929cb5f0e..7cbedeef29a7 100644
--- a/pkgs/applications/science/logic/lean4/default.nix
+++ b/pkgs/applications/science/logic/lean4/default.nix
@@ -48,6 +48,11 @@ stdenv.mkDerivation rec {
     "-DUSE_GITHASH=OFF"
   ];
 
+  # Work around https://github.com/NixOS/nixpkgs/issues/166205.
+  env = lib.optionalAttrs stdenv.cc.isClang {
+    NIX_LDFLAGS = "-l${stdenv.cc.libcxx.cxxabi.libName}";
+  };
+
   meta = with lib; {
     description = "Automatic and interactive theorem prover";
     homepage = "https://leanprover.github.io/";
diff --git a/pkgs/applications/version-management/git-machete/default.nix b/pkgs/applications/version-management/git-machete/default.nix
index a4d1ffb090f0..26cce4b25c9d 100644
--- a/pkgs/applications/version-management/git-machete/default.nix
+++ b/pkgs/applications/version-management/git-machete/default.nix
@@ -12,13 +12,13 @@
 
 buildPythonApplication rec {
   pname = "git-machete";
-  version = "3.17.9";
+  version = "3.20.0";
 
   src = fetchFromGitHub {
     owner = "virtuslab";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-oU4c57XU/DLGjOl/CyCt6oG3QaB2xnrOEg+sUAd7sww=";
+    hash = "sha256-6TntyAkDIcCVcAsNdAlgvKYO7Db0oMDWKW92rMRIDI4=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
@@ -29,6 +29,12 @@ buildPythonApplication rec {
     pytestCheckHook
   ];
 
+  disabledTests = [
+    # Requires fully functioning shells including zsh modules and bash
+    # completion.
+    "completion_e2e"
+  ];
+
   postInstall = ''
     installShellCompletion --bash --name git-machete completion/git-machete.completion.bash
     installShellCompletion --zsh --name _git-machete completion/git-machete.completion.zsh
diff --git a/pkgs/applications/version-management/gitlab/default.nix b/pkgs/applications/version-management/gitlab/default.nix
index e73512ddce42..4330a8f56971 100644
--- a/pkgs/applications/version-management/gitlab/default.nix
+++ b/pkgs/applications/version-management/gitlab/default.nix
@@ -1,7 +1,7 @@
 { stdenv, lib, fetchurl, fetchpatch, fetchFromGitLab, bundlerEnv
 , ruby_3_1, tzdata, git, nettools, nixosTests, nodejs, openssl
 , gitlabEnterprise ? false, callPackage, yarn
-, fixup_yarn_lock, replace, file, cacert, fetchYarnDeps, makeWrapper, pkg-config
+, prefetch-yarn-deps, replace, file, cacert, fetchYarnDeps, makeWrapper, pkg-config
 }:
 
 let
@@ -53,7 +53,7 @@ let
       sha256 = data.yarn_hash;
     };
 
-    nativeBuildInputs = [ rubyEnv.wrappedRuby rubyEnv.bundler nodejs yarn git cacert ];
+    nativeBuildInputs = [ rubyEnv.wrappedRuby rubyEnv.bundler nodejs yarn git cacert prefetch-yarn-deps ];
 
     patches = [
       # Since version 12.6.0, the rake tasks need the location of git,
@@ -88,7 +88,7 @@ let
       yarn config --offline set yarn-offline-mirror $yarnOfflineCache
 
       # Fixup "resolved"-entries in yarn.lock to match our offline cache
-      ${fixup_yarn_lock}/bin/fixup_yarn_lock yarn.lock
+      fixup-yarn-lock yarn.lock
 
       yarn install --offline --frozen-lockfile --ignore-scripts --no-progress --non-interactive
 
diff --git a/pkgs/applications/video/kodi/addons/radioparadise/default.nix b/pkgs/applications/video/kodi/addons/radioparadise/default.nix
index 3100325ddd20..bb556e9ec822 100644
--- a/pkgs/applications/video/kodi/addons/radioparadise/default.nix
+++ b/pkgs/applications/video/kodi/addons/radioparadise/default.nix
@@ -3,11 +3,11 @@
 buildKodiAddon rec {
   pname = "radioparadise";
   namespace = "script.radioparadise";
-  version = "1.0.5";
+  version = "2.0.0";
 
   src = fetchzip {
     url = "https://mirrors.kodi.tv/addons/nexus/script.radioparadise/script.radioparadise-${version}.zip";
-    sha256 = "sha256-/X/8Q741piNHue5i/kgV+UYpBECyGzkFuN+PUzdeQnA=";
+    sha256 = "sha256-eRCP0XMQHmyDrZ8Y6RGFfxQ1r26/bWbE/PJz4PET7D8=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/applications/video/mpv/scripts/buildLua.nix b/pkgs/applications/video/mpv/scripts/buildLua.nix
index 769e11798a6a..046b0fa2ea96 100644
--- a/pkgs/applications/video/mpv/scripts/buildLua.nix
+++ b/pkgs/applications/video/mpv/scripts/buildLua.nix
@@ -2,8 +2,18 @@
 , stdenvNoCC }:
 
 let
+  inherit (lib) hasPrefix hasSuffix removeSuffix;
   escapedList = with lib; concatMapStringsSep " " (s: "'${escape [ "'" ] s}'");
   fileName = pathStr: lib.last (lib.splitString "/" pathStr);
+  nameFromPath = pathStr:
+    let fN = fileName pathStr; in
+    if hasSuffix ".lua" fN then
+      fN
+    else if !(hasPrefix "." fN) then
+      "${fN}.lua"
+    else
+      null
+  ;
   scriptsDir = "$out/share/mpv/scripts";
 in
 lib.makeOverridable (
@@ -13,8 +23,8 @@ lib.makeOverridable (
   let
     # either passthru.scriptName, inferred from scriptPath, or from pname
     scriptName = (args.passthru or {}).scriptName or (
-      if args ? scriptPath
-      then fileName args.scriptPath
+      if args ? scriptPath && nameFromPath args.scriptPath != null
+      then nameFromPath args.scriptPath
       else "${pname}.lua"
     );
     scriptPath = args.scriptPath or "./${scriptName}";
@@ -26,8 +36,24 @@ lib.makeOverridable (
     outputHashMode = "recursive";
     installPhase = ''
       runHook preInstall
-      install -m644 -Dt "${scriptsDir}" \
-        ${escapedList ([ scriptPath ] ++ extraScripts)}
+
+      if [ -d "${scriptPath}" ]; then
+        [ -f "${scriptPath}/main.lua" ] || {
+          echo "Script directory '${scriptPath}' does not contain 'main.lua'" >&2
+          exit 1
+        }
+        [ ${with builtins; toString (length extraScripts)} -eq 0 ] || {
+          echo "mpvScripts.buildLua does not support 'extraScripts'" \
+               "when 'scriptPath' is a directory"
+          exit 1
+        }
+        mkdir -p "${scriptsDir}"
+        cp -a "${scriptPath}" "${scriptsDir}/${lib.removeSuffix ".lua" scriptName}"
+      else
+        install -m644 -Dt "${scriptsDir}" \
+          ${escapedList ([ scriptPath ] ++ extraScripts)}
+      fi
+
       runHook postInstall
     '';
 
diff --git a/pkgs/applications/video/mpv/scripts/default.nix b/pkgs/applications/video/mpv/scripts/default.nix
index 63f986c2c41a..9d16deb1c529 100644
--- a/pkgs/applications/video/mpv/scripts/default.nix
+++ b/pkgs/applications/video/mpv/scripts/default.nix
@@ -18,7 +18,7 @@ in lib.recurseIntoAttrs
     mpv-webm = callPackage ./mpv-webm.nix { };
     mpvacious = callPackage ./mpvacious.nix { inherit buildLua; };
     quality-menu = callPackage ./quality-menu.nix { inherit buildLua; };
-    simple-mpv-webui = callPackage ./simple-mpv-webui.nix { };
+    simple-mpv-webui = callPackage ./simple-mpv-webui.nix { inherit buildLua; };
     sponsorblock = callPackage ./sponsorblock.nix { };
     thumbfast = callPackage ./thumbfast.nix { inherit buildLua; };
     thumbnail = callPackage ./thumbnail.nix { inherit buildLua; };
diff --git a/pkgs/applications/video/mpv/scripts/simple-mpv-webui.nix b/pkgs/applications/video/mpv/scripts/simple-mpv-webui.nix
index 01f2c3a099fa..c3b53c618396 100644
--- a/pkgs/applications/video/mpv/scripts/simple-mpv-webui.nix
+++ b/pkgs/applications/video/mpv/scripts/simple-mpv-webui.nix
@@ -1,21 +1,18 @@
-{ lib, stdenvNoCC
+{ lib, buildLua
 , fetchFromGitHub }:
-stdenvNoCC.mkDerivation rec {
+buildLua rec {
   pname = "simple-mpv-ui";
-  version = "2.1.0";
+  version = "3.0.0";
 
   src = fetchFromGitHub {
     owner = "open-dynaMIX";
     repo = "simple-mpv-webui";
     rev = "v${version}";
-    sha256 = "1z0y8sdv5mbxznxqh43w5592ym688vkvqg7w26p8cinrhf09pbw8";
+    hash = "sha256-I8lwpo3Hfpy3UnPMmHEJCdArVQnNL245NkxsYVmnMF0=";
+    sparseCheckout = [ "main.lua" "webui-page" ];
   };
 
-  dontBuild = true;
-  installPhase = ''
-    mkdir -p $out/share/mpv/scripts
-    cp -r webui.lua webui-page $out/share/mpv/scripts/
-  '';
+  scriptPath = ".";
   passthru.scriptName = "webui.lua";
 
   meta = with lib; {
@@ -30,4 +27,3 @@ stdenvNoCC.mkDerivation rec {
     license = licenses.mit;
   };
 }
-
diff --git a/pkgs/applications/virtualization/singularity/generic.nix b/pkgs/applications/virtualization/singularity/generic.nix
index 3b110d9bc991..9f17dc8eb03d 100644
--- a/pkgs/applications/virtualization/singularity/generic.nix
+++ b/pkgs/applications/virtualization/singularity/generic.nix
@@ -71,6 +71,8 @@ in
 , newuidmapPath ? null
   # Path to SUID-ed newgidmap executable
 , newgidmapPath ? null
+  # External LOCALSTATEDIR
+, externalLocalStateDir ? null
   # Remove the symlinks to `singularity*` when projectName != "singularity"
 , removeCompat ? false
   # Workaround #86349
@@ -106,6 +108,7 @@ in
     inherit
       enableSeccomp
       enableSuid
+      externalLocalStateDir
       projectName
       removeCompat
       starterSuidPath
@@ -141,7 +144,7 @@ in
   configureScript = "./mconfig";
 
   configureFlags = [
-    "--localstatedir=/var/lib"
+    "--localstatedir=${if externalLocalStateDir != null then externalLocalStateDir else "${placeholder "out"}/var/lib"}"
     "--runstatedir=/var/run"
   ]
   ++ lib.optional (!enableSeccomp) "--without-seccomp"
diff --git a/pkgs/applications/window-managers/hyprwm/xdg-desktop-portal-hyprland/default.nix b/pkgs/applications/window-managers/hyprwm/xdg-desktop-portal-hyprland/default.nix
index 4657ab2464c7..6a067878f22f 100644
--- a/pkgs/applications/window-managers/hyprwm/xdg-desktop-portal-hyprland/default.nix
+++ b/pkgs/applications/window-managers/hyprwm/xdg-desktop-portal-hyprland/default.nix
@@ -23,13 +23,13 @@
 }:
 stdenv.mkDerivation (self: {
   pname = "xdg-desktop-portal-hyprland";
-  version = "1.2.4";
+  version = "1.2.5";
 
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = "xdg-desktop-portal-hyprland";
     rev = "v${self.version}";
-    hash = "sha256-IKcRTKzlcDsbD5xydRNc9s4c4KjcQHaZgOc5kWPOAtU=";
+    hash = "sha256-X4o/mifI7Nhu0UKYlxx53wIC+gYDo3pVM9L2u3PE2bE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/build-support/node/build-npm-package/default.nix b/pkgs/build-support/node/build-npm-package/default.nix
index eecea8b76758..42c6a9c065b2 100644
--- a/pkgs/build-support/node/build-npm-package/default.nix
+++ b/pkgs/build-support/node/build-npm-package/default.nix
@@ -21,6 +21,9 @@
   # Whether to force the usage of Git dependencies that have install scripts, but not a lockfile.
   # Use with care.
 , forceGitDeps ? false
+  # Whether to force allow an empty dependency cache.
+  # This can be enabled if there are truly no remote dependencies, but generally an empty cache indicates something is wrong.
+, forceEmptyCache ? false
   # Whether to make the cache writable prior to installing dependencies.
   # Don't set this unless npm tries to write to the cache directory, as it can slow down the build.
 , makeCacheWritable ? false
@@ -42,7 +45,7 @@
 , npmWorkspace ? null
 , nodejs ? topLevelArgs.nodejs
 , npmDeps ?  fetchNpmDeps {
-  inherit forceGitDeps src srcs sourceRoot prePatch patches postPatch;
+  inherit forceGitDeps forceEmptyCache src srcs sourceRoot prePatch patches postPatch;
   name = "${name}-npm-deps";
   hash = npmDepsHash;
 }
diff --git a/pkgs/build-support/node/fetch-npm-deps/default.nix b/pkgs/build-support/node/fetch-npm-deps/default.nix
index 67a4c337c0d2..cfa3366491f2 100644
--- a/pkgs/build-support/node/fetch-npm-deps/default.nix
+++ b/pkgs/build-support/node/fetch-npm-deps/default.nix
@@ -36,8 +36,8 @@
           '';
         };
 
-        makeTest = { name, src, hash, forceGitDeps ? false }: testers.invalidateFetcherByDrvHash fetchNpmDeps {
-          inherit name hash forceGitDeps;
+        makeTest = { name, src, hash, forceGitDeps ? false, forceEmptyCache ? false }: testers.invalidateFetcherByDrvHash fetchNpmDeps {
+          inherit name hash forceGitDeps forceEmptyCache;
 
           src = makeTestSrc { inherit name src; };
         };
@@ -98,6 +98,20 @@
           hash = "sha256-VzQhArHoznYSXUT7l9HkJV4yoSOmoP8eYTLel1QwmB4=";
         };
 
+        # This package has no resolved deps whatsoever, which will not actually work but does test the forceEmptyCache option.
+        emptyCache = makeTest {
+          name = "empty-cache";
+
+          src = fetchurl {
+            url = "https://raw.githubusercontent.com/bufbuild/protobuf-es/v1.2.1/package-lock.json";
+            hash = "sha256-UdBUEb4YRHsbvyjymIyjemJEiaI9KQRirqt+SFSK0wA=";
+          };
+
+          hash = "sha256-Cdv40lQjRszzJtJydZt25uYfcJVeJGwH54A+agdH9wI=";
+
+          forceEmptyCache = true;
+        };
+
         # This package contains both hosted Git shorthand, and a bundled dependency that happens to override an existing one.
         etherpadLite1818 = makeTest {
           name = "etherpad-lite-1.8.18";
@@ -124,6 +138,7 @@
     { name ? "npm-deps"
     , hash ? ""
     , forceGitDeps ? false
+    , forceEmptyCache ? false
     , ...
     } @ args:
     let
@@ -136,6 +151,7 @@
         };
 
       forceGitDeps_ = lib.optionalAttrs forceGitDeps { FORCE_GIT_DEPS = true; };
+      forceEmptyCache_ = lib.optionalAttrs forceEmptyCache { FORCE_EMPTY_CACHE = true; };
     in
     stdenvNoCC.mkDerivation (args // {
       inherit name;
@@ -174,5 +190,5 @@
         else "/no-cert-file.crt";
 
       outputHashMode = "recursive";
-    } // hash_ // forceGitDeps_);
+    } // hash_ // forceGitDeps_ // forceEmptyCache_);
 }
diff --git a/pkgs/build-support/node/fetch-npm-deps/src/cacache.rs b/pkgs/build-support/node/fetch-npm-deps/src/cacache.rs
index b7efedac59bd..75133b1b03ea 100644
--- a/pkgs/build-support/node/fetch-npm-deps/src/cacache.rs
+++ b/pkgs/build-support/node/fetch-npm-deps/src/cacache.rs
@@ -43,6 +43,13 @@ impl Cache {
         Cache(path)
     }
 
+    pub fn init(&self) -> anyhow::Result<()> {
+        fs::create_dir_all(self.0.join("content-v2"))?;
+        fs::create_dir_all(self.0.join("index-v5"))?;
+
+        Ok(())
+    }
+
     pub fn put(
         &self,
         key: String,
diff --git a/pkgs/build-support/node/fetch-npm-deps/src/main.rs b/pkgs/build-support/node/fetch-npm-deps/src/main.rs
index 9d86bd8091a7..2b28e290ad51 100644
--- a/pkgs/build-support/node/fetch-npm-deps/src/main.rs
+++ b/pkgs/build-support/node/fetch-npm-deps/src/main.rs
@@ -234,9 +234,14 @@ fn main() -> anyhow::Result<()> {
         (out_tempdir.path(), true)
     };
 
-    let packages = parse::lockfile(&lock_content, env::var("FORCE_GIT_DEPS").is_ok())?;
+    let packages = parse::lockfile(
+        &lock_content,
+        env::var("FORCE_GIT_DEPS").is_ok(),
+        env::var("FORCE_EMPTY_CACHE").is_ok(),
+    )?;
 
     let cache = Cache::new(out.join("_cacache"));
+    cache.init()?;
 
     packages.into_par_iter().try_for_each(|package| {
         eprintln!("{}", package.name);
diff --git a/pkgs/build-support/node/fetch-npm-deps/src/parse/mod.rs b/pkgs/build-support/node/fetch-npm-deps/src/parse/mod.rs
index 86e9120de02f..880a972e80e9 100644
--- a/pkgs/build-support/node/fetch-npm-deps/src/parse/mod.rs
+++ b/pkgs/build-support/node/fetch-npm-deps/src/parse/mod.rs
@@ -14,7 +14,11 @@ use crate::util;
 
 pub mod lock;
 
-pub fn lockfile(content: &str, force_git_deps: bool) -> anyhow::Result<Vec<Package>> {
+pub fn lockfile(
+    content: &str,
+    force_git_deps: bool,
+    force_empty_cache: bool,
+) -> anyhow::Result<Vec<Package>> {
     let mut packages = lock::packages(content)
         .context("failed to extract packages from lockfile")?
         .into_par_iter()
@@ -25,6 +29,10 @@ pub fn lockfile(content: &str, force_git_deps: bool) -> anyhow::Result<Vec<Packa
         })
         .collect::<anyhow::Result<Vec<_>>>()?;
 
+    if packages.is_empty() && !force_empty_cache {
+        bail!("No cacheable dependencies were found. Please inspect the upstream `package-lock.json` file and ensure that remote dependencies have `resolved` URLs and `integrity` hashes. If the lockfile is missing this data, attempt to get upstream to fix it via a tool like <https://github.com/jeslie0/npm-lockfile-fix>. If generating an empty cache is intentional and you would like to do it anyways, set `forceEmptyCache = true`.");
+    }
+
     let mut new = Vec::new();
 
     for pkg in packages
@@ -64,7 +72,13 @@ pub fn lockfile(content: &str, force_git_deps: bool) -> anyhow::Result<Vec<Packa
         }
 
         if let Ok(lockfile_contents) = lockfile_contents {
-            new.append(&mut lockfile(&lockfile_contents, force_git_deps)?);
+            new.append(&mut lockfile(
+                &lockfile_contents,
+                force_git_deps,
+                // force_empty_cache is turned on here since recursively parsed lockfiles should be
+                // allowed to have an empty cache without erroring by default
+                true,
+            )?);
         }
     }
 
diff --git a/pkgs/build-support/node/fetch-yarn-deps/default.nix b/pkgs/build-support/node/fetch-yarn-deps/default.nix
index 06c82c8d8e2b..e837f7457d17 100644
--- a/pkgs/build-support/node/fetch-yarn-deps/default.nix
+++ b/pkgs/build-support/node/fetch-yarn-deps/default.nix
@@ -64,6 +64,7 @@ in {
 
       nativeBuildInputs = [ prefetch-yarn-deps cacert ];
       GIT_SSL_CAINFO = "${cacert}/etc/ssl/certs/ca-bundle.crt";
+      NODE_EXTRA_CA_CERTS = "${cacert}/etc/ssl/certs/ca-bundle.crt";
 
       buildPhase = ''
         runHook preBuild
diff --git a/pkgs/build-support/singularity-tools/default.nix b/pkgs/build-support/singularity-tools/default.nix
index 9689e4124590..8d7ad9e742a1 100644
--- a/pkgs/build-support/singularity-tools/default.nix
+++ b/pkgs/build-support/singularity-tools/default.nix
@@ -111,7 +111,7 @@ rec {
             touch .${projectName}.d/env/94-appsbase.sh
 
             cd ..
-            mkdir -p /var/lib/${projectName}/mnt/{container,final,overlay,session,source}
+            mkdir -p /var/lib/${projectName}/mnt/session
             echo "root:x:0:0:System administrator:/root:/bin/sh" > /etc/passwd
             echo > /etc/resolv.conf
             TMPDIR=$(pwd -P) ${projectName} build $out ./img
diff --git a/pkgs/by-name/in/inshellisense/package.nix b/pkgs/by-name/in/inshellisense/package.nix
new file mode 100644
index 000000000000..2361c0e69ad2
--- /dev/null
+++ b/pkgs/by-name/in/inshellisense/package.nix
@@ -0,0 +1,23 @@
+{ lib, buildNpmPackage, fetchFromGitHub }:
+
+buildNpmPackage rec {
+  pname = "inshellisense";
+  version = "0.0.1-rc.4";
+
+  src = fetchFromGitHub {
+    owner = "microsoft";
+    repo = pname;
+    rev = "refs/tags/${version}";
+    hash = "sha256-PYSonVyclGSH3ArbqJuKrBNGbJaQEp6XemwnHboVwPk=";
+  };
+
+  npmDepsHash = "sha256-sjr4Hy1/zWPAlVGsMkyQIQcBT86KLaN2/UAaAd7Mn6Q=";
+
+  meta = with lib; {
+    description = "IDE style command line auto complete";
+    homepage = "https://github.com/microsoft/inshellisense";
+    license = licenses.mit;
+    maintainers = [ maintainers.malo ];
+  };
+}
+
diff --git a/pkgs/by-name/rq/rqbit/package.nix b/pkgs/by-name/rq/rqbit/package.nix
index 0505cbb1b69e..078fd7a9b35d 100644
--- a/pkgs/by-name/rq/rqbit/package.nix
+++ b/pkgs/by-name/rq/rqbit/package.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rqbit";
-  version = "2.2.2";
+  version = "3.2.0";
 
   src = fetchFromGitHub {
     owner = "ikatson";
     repo = "rqbit";
     rev = "v${version}";
-    hash = "sha256-9yYHxlvRlO8iJ3SPi0+4lEgBgAaqaDffKChqAe4OsYU=";
+    hash = "sha256-c0JYFr2yy1lcaJ+xOZnFsGzPVGPoFgCiFTGDlDaHdZk=";
   };
 
-  cargoHash = "sha256-dUQiW6J3Wycp5D3mAwGwruU6CkQ534OyP1GdsY7jzEw=";
+  cargoHash = "sha256-VnkAokOC5xSqO7MVASssKs0EqQ+re5EsEar4eLspTSA=";
 
   nativeBuildInputs = lib.optionals stdenv.isLinux [ pkg-config ];
 
diff --git a/pkgs/by-name/wi/wio/package.nix b/pkgs/by-name/wi/wio/package.nix
new file mode 100644
index 000000000000..73255a38208b
--- /dev/null
+++ b/pkgs/by-name/wi/wio/package.nix
@@ -0,0 +1,76 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, alacritty
+, cage
+, cairo
+, libxkbcommon
+, makeWrapper
+, mesa
+, meson
+, ninja
+, pkg-config
+, udev
+, unstableGitUpdater
+, wayland
+, wayland-protocols
+, wlroots
+, xwayland
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "wio";
+  version = "unstable-2023-05-28";
+
+  src = fetchFromGitHub {
+    owner = "Rubo3";
+    repo = "wio";
+    rev = "9d33d60839d3005ee16b5b04ae7f42c049939058";
+    hash = "sha256-ylJ8VHQU4TWLrhxGRo6HHOB7RWTVAThMQRw0uAFboNE=";
+  };
+
+  nativeBuildInputs = [
+    makeWrapper
+    meson
+    ninja
+    pkg-config
+  ];
+
+  buildInputs = [
+    cairo
+    libxkbcommon
+    mesa
+    udev
+    wayland
+    wayland-protocols
+    wlroots
+    xwayland
+  ];
+
+  strictDeps = false; # why is it so hard?
+
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=maybe-uninitialized";
+
+  postInstall = ''
+    wrapProgram $out/bin/wio \
+      --prefix PATH ":" "${lib.makeBinPath [ alacritty cage ]}"
+  '';
+
+  passthru = {
+    providedSessions = [ "wio" ];
+    updateScript = unstableGitUpdater { };
+  };
+
+  meta = {
+    homepage = "https://github.com/Rubo3/wio";
+    description = "Wayland compositor similar to Plan 9's rio";
+    longDescription = ''
+      Wio is a Wayland compositor for Linux and FreeBSD which has a similar look
+      and feel to plan9's rio.
+    '';
+    license = with lib.licenses; [ bsd3 ];
+    mainProgram = "wio";
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    inherit (wayland.meta) platforms;
+  };
+})
diff --git a/pkgs/data/themes/catppuccin-gtk/default.nix b/pkgs/data/themes/catppuccin-gtk/default.nix
index 6459f50fe786..dd3ee6bb303a 100644
--- a/pkgs/data/themes/catppuccin-gtk/default.nix
+++ b/pkgs/data/themes/catppuccin-gtk/default.nix
@@ -7,6 +7,7 @@
 , gtk-engine-murrine
 , python3
 , sassc
+, nix-update-script
 , accents ? [ "blue" ]
 , size ? "standard"
 , tweaks ? [ ]
@@ -28,13 +29,13 @@ lib.checkListOfEnum "${pname}: tweaks" validTweaks tweaks
 
 stdenvNoCC.mkDerivation rec {
   inherit pname;
-  version = "0.7.0";
+  version = "0.7.1";
 
   src = fetchFromGitHub {
     owner = "catppuccin";
     repo = "gtk";
     rev = "v${version}";
-    hash = "sha256-J1iLN2FF3Ml/3zmntXYlfkv6dZcwl62A9X4ruAH1ll4=";
+    hash = "sha256-V3JasiHaATbVDQJeJPeFq5sjbkQnSMbDRWsaRzGccXU=";
   };
 
   nativeBuildInputs = [ gtk3 sassc ];
@@ -74,6 +75,8 @@ stdenvNoCC.mkDerivation rec {
     runHook postInstall
   '';
 
+  passthru.updateScript = nix-update-script { };
+
   meta = with lib; {
     description = "Soothing pastel theme for GTK";
     homepage = "https://github.com/catppuccin/gtk";
diff --git a/pkgs/desktops/cinnamon/cinnamon-screensaver/default.nix b/pkgs/desktops/cinnamon/cinnamon-screensaver/default.nix
index 956a87773d6d..91c495563058 100644
--- a/pkgs/desktops/cinnamon/cinnamon-screensaver/default.nix
+++ b/pkgs/desktops/cinnamon/cinnamon-screensaver/default.nix
@@ -38,6 +38,11 @@ stdenv.mkDerivation rec {
     hash = "sha256-d7h9OJ39HVQNCHNr13M1ybDFoU3Xnd1PEczGLHZU/lU=";
   };
 
+  patches = [
+    # See https://github.com/linuxmint/cinnamon-screensaver/issues/446#issuecomment-1819580053
+    ./fix-broken-theming-with-pygobject-3-46.patch
+  ];
+
   nativeBuildInputs = [
     pkg-config
     wrapGAppsHook
diff --git a/pkgs/desktops/cinnamon/cinnamon-screensaver/fix-broken-theming-with-pygobject-3-46.patch b/pkgs/desktops/cinnamon/cinnamon-screensaver/fix-broken-theming-with-pygobject-3-46.patch
new file mode 100644
index 000000000000..c594826d5261
--- /dev/null
+++ b/pkgs/desktops/cinnamon/cinnamon-screensaver/fix-broken-theming-with-pygobject-3-46.patch
@@ -0,0 +1,17 @@
+diff --git a/src/cinnamon-screensaver-main.py b/src/cinnamon-screensaver-main.py
+index 05b727c..a185159 100755
+--- a/src/cinnamon-screensaver-main.py
++++ b/src/cinnamon-screensaver-main.py
+@@ -139,9 +139,9 @@ class Main(Gtk.Application):
+ 
+             fallback_prov = Gtk.CssProvider()
+ 
+-            if fallback_prov.load_from_data(fallback_css.encode()):
+-                Gtk.StyleContext.add_provider_for_screen (Gdk.Screen.get_default(), fallback_prov, 600)
+-                Gtk.StyleContext.reset_widgets(Gdk.Screen.get_default())
++            fallback_prov.load_from_data(fallback_css.encode())
++            Gtk.StyleContext.add_provider_for_screen (Gdk.Screen.get_default(), fallback_prov, 600)
++            Gtk.StyleContext.reset_widgets(Gdk.Screen.get_default())
+ 
+ if __name__ == "__main__":
+     setproctitle.setproctitle('cinnamon-screensaver')
diff --git a/pkgs/desktops/gnome/extensions/extensionOverridesPatches/freon_at_UshakovVasilii_Github.yahoo.com.patch b/pkgs/desktops/gnome/extensions/extensionOverridesPatches/freon_at_UshakovVasilii_Github.yahoo.com.patch
index f9c326e58396..98f58d0c458f 100644
--- a/pkgs/desktops/gnome/extensions/extensionOverridesPatches/freon_at_UshakovVasilii_Github.yahoo.com.patch
+++ b/pkgs/desktops/gnome/extensions/extensionOverridesPatches/freon_at_UshakovVasilii_Github.yahoo.com.patch
@@ -1,8 +1,8 @@
 diff --git a/hddtempUtil.js b/hddtempUtil.js
-index e5d1d6d..23f6289 100644
+index e52fbc2..f5138bb 100644
 --- a/hddtempUtil.js
 +++ b/hddtempUtil.js
-@@ -7,7 +7,7 @@ var HddtempUtil = class extends CommandLineUtil.CommandLineUtil {
+@@ -10,7 +10,7 @@ export default class HddtempUtil extends CommandLineUtil {
  
      constructor() {
          super();
@@ -11,7 +11,7 @@ index e5d1d6d..23f6289 100644
          if(hddtempArgv) {
              // check if this user can run hddtemp directly.
              if(!GLib.spawn_command_line_sync(hddtempArgv)[3]){
-@@ -19,8 +19,8 @@ var HddtempUtil = class extends CommandLineUtil.CommandLineUtil {
+@@ -22,8 +22,8 @@ export default class HddtempUtil extends CommandLineUtil {
          // doesn't seem to be the case… is it running as a daemon?
          // Check first for systemd
          let systemctl = GLib.find_program_in_path('systemctl');
@@ -22,21 +22,21 @@ index e5d1d6d..23f6289 100644
          let pid = undefined;
  
          if(systemctl) {
-@@ -35,7 +35,7 @@ var HddtempUtil = class extends CommandLineUtil.CommandLineUtil {
+@@ -38,7 +38,7 @@ export default class HddtempUtil extends CommandLineUtil {
  
          // systemd isn't used on this system, try sysvinit instead
          if(!pid && pidof) {
--            let output = GLib.spawn_command_line_sync("pidof hddtemp")[1].toString().trim();
-+            let output = GLib.spawn_command_line_sync("@procps@/bin/pidof hddtemp")[1].toString().trim();
+-            let output = run_command("pidof hddtemp");
++            let output = run_command("@procps@/bin/pidof hddtemp");
              if(output.length)
                  pid = Number(output.trim());
          }
 diff --git a/liquidctlUtil.js b/liquidctlUtil.js
-index 766bf62..2a6faf8 100644
+index a2f3015..215707a 100644
 --- a/liquidctlUtil.js
 +++ b/liquidctlUtil.js
-@@ -8,7 +8,7 @@ const commandLineUtil = Me.imports.commandLineUtil;
- var LiquidctlUtil = class extends commandLineUtil.CommandLineUtil {
+@@ -7,7 +7,7 @@ export default class LiquidctlUtil extends CommandLineUtil {
+ 
      constructor() {
          super();
 -        const path = GLib.find_program_in_path('liquidctl');
@@ -45,23 +45,23 @@ index 766bf62..2a6faf8 100644
      }
  
 diff --git a/nvmecliUtil.js b/nvmecliUtil.js
-index 98a61df..8a40624 100644
+index 2b12d2d..70609f7 100644
 --- a/nvmecliUtil.js
 +++ b/nvmecliUtil.js
-@@ -3,7 +3,7 @@ const GLib = imports.gi.GLib;
- const Me = imports.misc.extensionUtils.getCurrentExtension();
+@@ -1,7 +1,7 @@
+ import GLib from 'gi://GLib';
  
  function getNvmeData (argv){
 -    const nvme = GLib.find_program_in_path('nvme')
 +    const nvme = '@nvmecli@/bin/nvme'
-     return JSON.parse(GLib.spawn_command_line_sync(`${nvme} ${argv} -o json`)[1].toString())
+     return JSON.parse(new TextDecoder().decode(GLib.spawn_command_line_sync(`${nvme} ${argv} -o json`)[1]))
  }
  
 diff --git a/sensorsUtil.js b/sensorsUtil.js
-index bd6de61..5951b17 100644
+index 90c6ca9..5788635 100644
 --- a/sensorsUtil.js
 +++ b/sensorsUtil.js
-@@ -7,7 +7,7 @@ var SensorsUtil = class extends CommandLineUtil.CommandLineUtil {
+@@ -6,7 +6,7 @@ export default class SensorsUtil extends CommandLineUtil {
  
      constructor() {
          super();
@@ -71,15 +71,15 @@ index bd6de61..5951b17 100644
          this._argv = path ? [path, '-A', '-j'] : null;
      }
 diff --git a/smartctlUtil.js b/smartctlUtil.js
-index 4888323..66b6c61 100644
+index f58d194..b9cb9ca 100644
 --- a/smartctlUtil.js
 +++ b/smartctlUtil.js
-@@ -3,7 +3,7 @@ const GLib = imports.gi.GLib;
- const Me = imports.misc.extensionUtils.getCurrentExtension();
- const ByteArray = imports.byteArray;
+@@ -1,7 +1,7 @@
+ import GLib from 'gi://GLib';
+ 
  function getSmartData (argv){
 -    const smartctl = GLib.find_program_in_path('smartctl')
 +    const smartctl = '@smartmontools@/bin/smartctl'
-     return JSON.parse(ByteArray.toString( GLib.spawn_command_line_sync(`'${smartctl}' ${argv} -j`)[1] ))
+     return JSON.parse(new TextDecoder().decode( GLib.spawn_command_line_sync(`'${smartctl}' ${argv} -j`)[1] ))
  }
  
diff --git a/pkgs/development/compilers/llvm/10/default.nix b/pkgs/development/compilers/llvm/10/default.nix
index 37c32e425c63..bc72be0ce7a1 100644
--- a/pkgs/development/compilers/llvm/10/default.nix
+++ b/pkgs/development/compilers/llvm/10/default.nix
@@ -1,5 +1,5 @@
 { lowPrio, newScope, pkgs, lib, stdenv, cmake
-, gccForLibs, preLibcCrossHeaders
+, preLibcCrossHeaders
 , libxml2, python3, isl, fetchurl, overrideCC, wrapCCWith, wrapBintoolsWith
 , buildLlvmTools # tools, but from the previous stage, for cross
 , targetLlvmLibraries # libraries, but from the next stage, for cross
@@ -20,7 +20,6 @@
 let
   release_version = "10.0.1";
   version = release_version; # differentiating these (variables) is important for RCs
-  targetConfig = stdenv.targetPlatform.config;
 
   fetch = name: sha256: fetchurl {
     url = "https://github.com/llvm/llvm-project/releases/download/llvmorg-${release_version}/${name}-${version}.src.tar.xz";
@@ -29,21 +28,7 @@ let
 
   clang-tools-extra_src = fetch "clang-tools-extra" "06n1yp638rh24xdxv9v2df0qajxbjz4w59b7dd4ky36drwmpi4yh";
 
-  llvm_meta = {
-    license     = lib.licenses.ncsa;
-    maintainers = lib.teams.llvm.members;
-
-    # See llvm/cmake/config-ix.cmake.
-    platforms   =
-      lib.platforms.aarch64 ++
-      lib.platforms.arm ++
-      lib.platforms.mips ++
-      lib.platforms.power ++
-      lib.platforms.riscv ++
-      lib.platforms.s390x ++
-      lib.platforms.wasi ++
-      lib.platforms.x86;
-  };
+  inherit (import ../common/common-let.nix { inherit lib release_version; }) llvm_meta;
 
   tools = lib.makeExtensible (tools: let
     callPackage = newScope (tools // { inherit stdenv cmake libxml2 python3 isl release_version version fetch buildLlvmTools; });
diff --git a/pkgs/development/compilers/llvm/10/libunwind/default.nix b/pkgs/development/compilers/llvm/10/libunwind/default.nix
index 8124cf0821e0..2941dca35bf6 100644
--- a/pkgs/development/compilers/llvm/10/libunwind/default.nix
+++ b/pkgs/development/compilers/llvm/10/libunwind/default.nix
@@ -1,5 +1,4 @@
-{ lib, stdenv, llvm_meta, version, fetch, cmake, fetchpatch
-, enableShared ? !stdenv.hostPlatform.isStatic
+{ lib, stdenv, llvm_meta, version, fetch, cmake, enableShared ? !stdenv.hostPlatform.isStatic
 }:
 
 stdenv.mkDerivation rec {
diff --git a/pkgs/development/compilers/llvm/11/clang/default.nix b/pkgs/development/compilers/llvm/11/clang/default.nix
index f0d41a3ab734..a4fe7199e080 100644
--- a/pkgs/development/compilers/llvm/11/clang/default.nix
+++ b/pkgs/development/compilers/llvm/11/clang/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, llvm_meta, fetch, fetchpatch, substituteAll, cmake, libxml2, libllvm, version, clang-tools-extra_src, python3
+{ lib, stdenv, llvm_meta, fetch, substituteAll, cmake, libxml2, libllvm, version, clang-tools-extra_src, python3
 , buildLlvmTools
 , fixDarwinDylibNames
 , enableManpages ? false
diff --git a/pkgs/development/compilers/llvm/11/default.nix b/pkgs/development/compilers/llvm/11/default.nix
index 6ce7d86c835e..2d9790fe61ac 100644
--- a/pkgs/development/compilers/llvm/11/default.nix
+++ b/pkgs/development/compilers/llvm/11/default.nix
@@ -1,5 +1,5 @@
 { lowPrio, newScope, pkgs, lib, stdenv, cmake
-, gccForLibs, preLibcCrossHeaders
+, preLibcCrossHeaders
 , libxml2, python3, isl, fetchurl, overrideCC, wrapCCWith, wrapBintoolsWith
 , buildLlvmTools # tools, but from the previous stage, for cross
 , targetLlvmLibraries # libraries, but from the next stage, for cross
@@ -22,7 +22,6 @@ let
   candidate = ""; # empty or "rcN"
   dash-candidate = lib.optionalString (candidate != "") "-${candidate}";
   version = "${release_version}${dash-candidate}"; # differentiating these (variables) is important for RCs
-  targetConfig = stdenv.targetPlatform.config;
 
   fetch = name: sha256: fetchurl {
     url = "https://github.com/llvm/llvm-project/releases/download/llvmorg-${version}/${name}-${release_version}${candidate}.src.tar.xz";
@@ -31,21 +30,7 @@ let
 
   clang-tools-extra_src = fetch "clang-tools-extra" "18n1w1hkv931xzq02b34wglbv6zd6sd0r5kb8piwvag7klj7qw3n";
 
-  llvm_meta = {
-    license     = lib.licenses.ncsa;
-    maintainers = lib.teams.llvm.members;
-
-    # See llvm/cmake/config-ix.cmake.
-    platforms   =
-      lib.platforms.aarch64 ++
-      lib.platforms.arm ++
-      lib.platforms.mips ++
-      lib.platforms.power ++
-      lib.platforms.riscv ++
-      lib.platforms.s390x ++
-      lib.platforms.wasi ++
-      lib.platforms.x86;
-  };
+  inherit (import ../common/common-let.nix { inherit lib release_version; }) llvm_meta;
 
   tools = lib.makeExtensible (tools: let
     callPackage = newScope (tools // { inherit stdenv cmake libxml2 python3 isl release_version version fetch buildLlvmTools; });
diff --git a/pkgs/development/compilers/llvm/11/libunwind/default.nix b/pkgs/development/compilers/llvm/11/libunwind/default.nix
index 462d63283baf..4cd39e379601 100644
--- a/pkgs/development/compilers/llvm/11/libunwind/default.nix
+++ b/pkgs/development/compilers/llvm/11/libunwind/default.nix
@@ -1,5 +1,4 @@
-{ lib, stdenv, llvm_meta, version, fetch, cmake, fetchpatch
-, enableShared ? !stdenv.hostPlatform.isStatic
+{ lib, stdenv, llvm_meta, version, fetch, cmake, enableShared ? !stdenv.hostPlatform.isStatic
 }:
 
 stdenv.mkDerivation rec {
diff --git a/pkgs/development/compilers/llvm/12/default.nix b/pkgs/development/compilers/llvm/12/default.nix
index b976dd2ee67a..4de048827071 100644
--- a/pkgs/development/compilers/llvm/12/default.nix
+++ b/pkgs/development/compilers/llvm/12/default.nix
@@ -1,5 +1,5 @@
 { lowPrio, newScope, pkgs, lib, stdenv, cmake
-, gccForLibs, preLibcCrossHeaders
+, preLibcCrossHeaders
 , libxml2, python3, isl, fetchurl, overrideCC, wrapCCWith, wrapBintoolsWith
 , buildLlvmTools # tools, but from the previous stage, for cross
 , targetLlvmLibraries # libraries, but from the next stage, for cross
@@ -23,7 +23,6 @@ let
   candidate = ""; # empty or "rcN"
   dash-candidate = lib.optionalString (candidate != "") "-${candidate}";
   version = "${release_version}${dash-candidate}"; # differentiating these (variables) is important for RCs
-  targetConfig = stdenv.targetPlatform.config;
 
   fetch = name: sha256: fetchurl {
     url = "https://github.com/llvm/llvm-project/releases/download/llvmorg-${version}/${name}-${release_version}${candidate}.src.tar.xz";
@@ -32,21 +31,7 @@ let
 
   clang-tools-extra_src = fetch "clang-tools-extra" "1r9a4fdz9ci58b5z2inwvm4z4cdp6scrivnaw05dggkxz7yrwrb5";
 
-  llvm_meta = {
-    license     = lib.licenses.ncsa;
-    maintainers = lib.teams.llvm.members;
-
-    # See llvm/cmake/config-ix.cmake.
-    platforms   =
-      lib.platforms.aarch64 ++
-      lib.platforms.arm ++
-      lib.platforms.mips ++
-      lib.platforms.power ++
-      lib.platforms.riscv ++
-      lib.platforms.s390x ++
-      lib.platforms.wasi ++
-      lib.platforms.x86;
-  };
+  inherit (import ../common/common-let.nix { inherit lib release_version; }) llvm_meta;
 
   tools = lib.makeExtensible (tools: let
     callPackage = newScope (tools // { inherit stdenv cmake libxml2 python3 isl release_version version fetch buildLlvmTools; });
diff --git a/pkgs/development/compilers/llvm/13/default.nix b/pkgs/development/compilers/llvm/13/default.nix
index 3cf7cd711ebe..c46ebee1d0db 100644
--- a/pkgs/development/compilers/llvm/13/default.nix
+++ b/pkgs/development/compilers/llvm/13/default.nix
@@ -1,5 +1,5 @@
 { lowPrio, newScope, pkgs, lib, stdenv, cmake
-, gccForLibs, preLibcCrossHeaders
+, preLibcCrossHeaders
 , libxml2, python3, isl, fetchFromGitHub, overrideCC, wrapCCWith, wrapBintoolsWith
 , buildLlvmTools # tools, but from the previous stage, for cross
 , targetLlvmLibraries # libraries, but from the next stage, for cross
@@ -16,39 +16,51 @@
     then null
     else pkgs.bintools
 , darwin
+# LLVM release information; specify one of these but not both:
+, gitRelease ? null
+  # i.e.:
+  # {
+  #   version = /* i.e. "15.0.0" */;
+  #   rev = /* commit SHA */;
+  #   rev-version = /* human readable version; i.e. "unstable-2022-26-07" */;
+  #   sha256 = /* checksum for this release, can omit if specifying your own `monorepoSrc` */;
+  # }
+, officialRelease ? { version = "13.0.1"; sha256 = "06dv6h5dmvzdxbif2s8njki6h32796v368dyb5945x8gjj72xh7k"; }
+  # i.e.:
+  # {
+  #   version = /* i.e. "15.0.0" */;
+  #   candidate = /* optional; if specified, should be: "rcN" */
+  #   sha256 = /* checksum for this release, can omit if specifying your own `monorepoSrc` */;
+  # }
+# By default, we'll try to fetch a release from `github:llvm/llvm-project`
+# corresponding to the `gitRelease` or `officialRelease` specified.
+#
+# You can provide your own LLVM source by specifying this arg but then it's up
+# to you to make sure that the LLVM repo given matches the release configuration
+# specified.
+, monorepoSrc ? null
+
 }:
 
+assert let
+  int = a: if a then 1 else 0;
+  xor = a: b: ((builtins.bitXor (int a) (int b)) == 1);
+in
+  lib.assertMsg
+    (xor
+      (gitRelease != null)
+      (officialRelease != null))
+    ("must specify `gitRelease` or `officialRelease`" +
+      (lib.optionalString (gitRelease != null) " — not both"));
 let
-  release_version = "13.0.1";
-  candidate = ""; # empty or "rcN"
-  dash-candidate = lib.optionalString (candidate != "") "-${candidate}";
-  rev = ""; # When using a Git commit
-  rev-version = ""; # When using a Git commit
-  version = if rev != "" then rev-version else "${release_version}${dash-candidate}";
-  targetConfig = stdenv.targetPlatform.config;
-
-  src = fetchFromGitHub {
-    owner = "llvm";
-    repo = "llvm-project";
-    rev = if rev != "" then rev else "llvmorg-${version}";
-    sha256 = "06dv6h5dmvzdxbif2s8njki6h32796v368dyb5945x8gjj72xh7k";
-  };
-
-  llvm_meta = {
-    license     = lib.licenses.ncsa;
-    maintainers = lib.teams.llvm.members;
-
-    # See llvm/cmake/config-ix.cmake.
-    platforms   =
-      lib.platforms.aarch64 ++
-      lib.platforms.arm ++
-      lib.platforms.mips ++
-      lib.platforms.power ++
-      lib.platforms.riscv ++
-      lib.platforms.s390x ++
-      lib.platforms.wasi ++
-      lib.platforms.x86;
-  };
+  monorepoSrc' = monorepoSrc;
+in let
+  # Import releaseInfo separately to avoid infinite recursion
+  inherit (import ../common/common-let.nix { inherit lib gitRelease officialRelease; }) releaseInfo;
+  inherit (releaseInfo) release_version version;
+  inherit (import ../common/common-let.nix { inherit lib fetchFromGitHub release_version gitRelease officialRelease monorepoSrc'; }) llvm_meta monorepoSrc;
+
+  src = monorepoSrc;
 
   tools = lib.makeExtensible (tools: let
     callPackage = newScope (tools // { inherit stdenv cmake libxml2 python3 isl release_version version src buildLlvmTools; });
diff --git a/pkgs/development/compilers/llvm/14/default.nix b/pkgs/development/compilers/llvm/14/default.nix
index b9a74e0f070a..d6d3c2d088b0 100644
--- a/pkgs/development/compilers/llvm/14/default.nix
+++ b/pkgs/development/compilers/llvm/14/default.nix
@@ -1,5 +1,5 @@
 { lowPrio, newScope, pkgs, lib, stdenv, cmake
-, gccForLibs, preLibcCrossHeaders
+, preLibcCrossHeaders
 , libxml2, python3, fetchFromGitHub, overrideCC, wrapCCWith, wrapBintoolsWith
 , buildLlvmTools # tools, but from the previous stage, for cross
 , targetLlvmLibraries # libraries, but from the next stage, for cross
@@ -16,40 +16,48 @@
     then null
     else pkgs.bintools
 , darwin
+# LLVM release information; specify one of these but not both:
+, gitRelease ? null
+  # i.e.:
+  # {
+  #   version = /* i.e. "15.0.0" */;
+  #   rev = /* commit SHA */;
+  #   rev-version = /* human readable version; i.e. "unstable-2022-26-07" */;
+  #   sha256 = /* checksum for this release, can omit if specifying your own `monorepoSrc` */;
+  # }
+, officialRelease ? { version = "14.0.6"; sha256 = "sha256-vffu4HilvYwtzwgq+NlS26m65DGbp6OSSne2aje1yJE="; }
+  # i.e.:
+  # {
+  #   version = /* i.e. "15.0.0" */;
+  #   candidate = /* optional; if specified, should be: "rcN" */
+  #   sha256 = /* checksum for this release, can omit if specifying your own `monorepoSrc` */;
+  # }
+# By default, we'll try to fetch a release from `github:llvm/llvm-project`
+# corresponding to the `gitRelease` or `officialRelease` specified.
+#
+# You can provide your own LLVM source by specifying this arg but then it's up
+# to you to make sure that the LLVM repo given matches the release configuration
+# specified.
+, monorepoSrc ? null
 }:
 
+assert let
+  int = a: if a then 1 else 0;
+  xor = a: b: ((builtins.bitXor (int a) (int b)) == 1);
+in
+  lib.assertMsg
+    (xor
+      (gitRelease != null)
+      (officialRelease != null))
+    ("must specify `gitRelease` or `officialRelease`" +
+      (lib.optionalString (gitRelease != null) " — not both"));
 let
-  release_version = "14.0.6";
-  candidate = ""; # empty or "rcN"
-  dash-candidate = lib.optionalString (candidate != "") "-${candidate}";
-  rev = ""; # When using a Git commit
-  rev-version = ""; # When using a Git commit
-  version = if rev != "" then rev-version else "${release_version}${dash-candidate}";
-  targetConfig = stdenv.targetPlatform.config;
-
-  monorepoSrc = fetchFromGitHub {
-    owner = "llvm";
-    repo = "llvm-project";
-    rev = if rev != "" then rev else "llvmorg-${version}";
-    sha256 = "sha256-vffu4HilvYwtzwgq+NlS26m65DGbp6OSSne2aje1yJE=";
-  };
-
-  llvm_meta = {
-    license     = lib.licenses.ncsa;
-    maintainers = lib.teams.llvm.members;
-
-    # See llvm/cmake/config-ix.cmake.
-    platforms   =
-      lib.platforms.aarch64 ++
-      lib.platforms.arm ++
-      lib.platforms.m68k ++
-      lib.platforms.mips ++
-      lib.platforms.power ++
-      lib.platforms.riscv ++
-      lib.platforms.s390x ++
-      lib.platforms.wasi ++
-      lib.platforms.x86;
-  };
+  monorepoSrc' = monorepoSrc;
+in let
+  # Import releaseInfo separately to avoid infinite recursion
+  inherit (import ../common/common-let.nix { inherit lib gitRelease officialRelease; }) releaseInfo;
+  inherit (releaseInfo) release_version version;
+  inherit (import ../common/common-let.nix { inherit lib fetchFromGitHub release_version gitRelease officialRelease monorepoSrc'; }) llvm_meta monorepoSrc;
 
   tools = lib.makeExtensible (tools: let
     callPackage = newScope (tools // { inherit stdenv cmake libxml2 python3 release_version version monorepoSrc buildLlvmTools; });
diff --git a/pkgs/development/compilers/llvm/14/llvm/default.nix b/pkgs/development/compilers/llvm/14/llvm/default.nix
index 081c84c04e06..6eec4c563f9c 100644
--- a/pkgs/development/compilers/llvm/14/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/14/llvm/default.nix
@@ -25,7 +25,7 @@
 # broken for the armv7l builder
 , enablePFM ? stdenv.isLinux && !stdenv.hostPlatform.isAarch
 , enablePolly ? true
-} @args:
+}:
 
 let
   inherit (lib) optional optionals optionalString;
diff --git a/pkgs/development/compilers/llvm/15/compiler-rt/default.nix b/pkgs/development/compilers/llvm/15/compiler-rt/default.nix
index 4ac51c1dd31e..bfdeeff6db5b 100644
--- a/pkgs/development/compilers/llvm/15/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/15/compiler-rt/default.nix
@@ -9,7 +9,7 @@ let
   useLLVM = stdenv.hostPlatform.useLLVM or false;
   bareMetal = stdenv.hostPlatform.parsed.kernel.name == "none";
   haveLibc = stdenv.cc.libc != null;
-  inherit (stdenv.hostPlatform) isMusl isGnu;
+  inherit (stdenv.hostPlatform) isMusl;
 
   baseName = "compiler-rt";
 
diff --git a/pkgs/development/compilers/llvm/15/default.nix b/pkgs/development/compilers/llvm/15/default.nix
index 6a3b8cbabab7..095da445a990 100644
--- a/pkgs/development/compilers/llvm/15/default.nix
+++ b/pkgs/development/compilers/llvm/15/default.nix
@@ -1,5 +1,5 @@
-{ lowPrio, newScope, pkgs, lib, stdenv, stdenvNoCC, cmake, ninja
-, gccForLibs, preLibcCrossHeaders
+{ lowPrio, newScope, pkgs, lib, stdenv, cmake, ninja
+, preLibcCrossHeaders
 , libxml2, python3, fetchFromGitHub, overrideCC, wrapCCWith, wrapBintoolsWith
 , buildLlvmTools # tools, but from the previous stage, for cross
 , targetLlvmLibraries # libraries, but from the next stage, for cross
@@ -54,51 +54,10 @@ in
 let
   monorepoSrc' = monorepoSrc;
 in let
-  releaseInfo = if gitRelease != null then rec {
-    original = gitRelease;
-    release_version = original.version;
-    version = gitRelease.rev-version;
-  } else rec {
-    original = officialRelease;
-    release_version = original.version;
-    version = if original ? candidate then
-      "${release_version}-${original.candidate}"
-    else
-      release_version;
-  };
-
-  monorepoSrc = if monorepoSrc' != null then
-    monorepoSrc'
-  else let
-    sha256 = releaseInfo.original.sha256;
-    rev = if gitRelease != null then
-      gitRelease.rev
-    else
-      "llvmorg-${releaseInfo.version}";
-  in fetchFromGitHub {
-    owner = "llvm";
-    repo = "llvm-project";
-    inherit rev sha256;
-  };
-
+  # Import releaseInfo separately to avoid infinite recursion
+  inherit (import ../common/common-let.nix { inherit lib gitRelease officialRelease; }) releaseInfo;
   inherit (releaseInfo) release_version version;
-
-  llvm_meta = {
-    license     = lib.licenses.ncsa;
-    maintainers = lib.teams.llvm.members;
-
-    # See llvm/cmake/config-ix.cmake.
-    platforms   =
-      lib.platforms.aarch64 ++
-      lib.platforms.arm ++
-      lib.platforms.m68k ++
-      lib.platforms.mips ++
-      lib.platforms.power ++
-      lib.platforms.riscv ++
-      lib.platforms.s390x ++
-      lib.platforms.wasi ++
-      lib.platforms.x86;
-  };
+  inherit (import ../common/common-let.nix { inherit lib fetchFromGitHub release_version gitRelease officialRelease monorepoSrc'; }) llvm_meta monorepoSrc;
 
   tools = lib.makeExtensible (tools: let
     callPackage = newScope (tools // { inherit stdenv cmake ninja libxml2 python3 release_version version monorepoSrc buildLlvmTools; });
diff --git a/pkgs/development/compilers/llvm/15/llvm/default.nix b/pkgs/development/compilers/llvm/15/llvm/default.nix
index 8a1c0547890b..0b9e83259b2c 100644
--- a/pkgs/development/compilers/llvm/15/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/15/llvm/default.nix
@@ -30,7 +30,7 @@
   # broken for the armv7l builder
   && !stdenv.hostPlatform.isAarch
 , enablePolly ? true
-} @args:
+}:
 
 let
   inherit (lib) optional optionals optionalString;
diff --git a/pkgs/development/compilers/llvm/16/clang/default.nix b/pkgs/development/compilers/llvm/16/clang/default.nix
index 2a2656df5fe1..b801bdda5292 100644
--- a/pkgs/development/compilers/llvm/16/clang/default.nix
+++ b/pkgs/development/compilers/llvm/16/clang/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, llvm_meta
 , monorepoSrc, runCommand
-, substituteAll, cmake, ninja, libxml2, libllvm, version, python3
+, cmake, ninja, libxml2, libllvm, version, python3
 , buildLlvmTools
 , fixDarwinDylibNames
 , enableManpages ? false
diff --git a/pkgs/development/compilers/llvm/16/compiler-rt/default.nix b/pkgs/development/compilers/llvm/16/compiler-rt/default.nix
index 9b6ab0a77c2a..7add8fab0f91 100644
--- a/pkgs/development/compilers/llvm/16/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/16/compiler-rt/default.nix
@@ -10,7 +10,7 @@ let
   bareMetal = stdenv.hostPlatform.parsed.kernel.name == "none";
   haveLibc = stdenv.cc.libc != null;
   isDarwinStatic = stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isStatic;
-  inherit (stdenv.hostPlatform) isMusl isGnu;
+  inherit (stdenv.hostPlatform) isMusl;
 
   baseName = "compiler-rt";
 
diff --git a/pkgs/development/compilers/llvm/16/default.nix b/pkgs/development/compilers/llvm/16/default.nix
index 541db8c400de..5ecb89a3a264 100644
--- a/pkgs/development/compilers/llvm/16/default.nix
+++ b/pkgs/development/compilers/llvm/16/default.nix
@@ -1,5 +1,5 @@
-{ lowPrio, newScope, pkgs, lib, stdenv, stdenvNoCC, cmake, ninja
-, gccForLibs, preLibcCrossHeaders
+{ lowPrio, newScope, pkgs, lib, stdenv, cmake, ninja
+, preLibcCrossHeaders
 , libxml2, python3, fetchFromGitHub, overrideCC, wrapCCWith, wrapBintoolsWith
 , buildLlvmTools # tools, but from the previous stage, for cross
 , targetLlvmLibraries # libraries, but from the next stage, for cross
@@ -54,51 +54,10 @@ in
 let
   monorepoSrc' = monorepoSrc;
 in let
-  releaseInfo = if gitRelease != null then rec {
-    original = gitRelease;
-    release_version = original.version;
-    version = gitRelease.rev-version;
-  } else rec {
-    original = officialRelease;
-    release_version = original.version;
-    version = if original ? candidate then
-      "${release_version}-${original.candidate}"
-    else
-      release_version;
-  };
-
-  monorepoSrc = if monorepoSrc' != null then
-    monorepoSrc'
-  else let
-    sha256 = releaseInfo.original.sha256;
-    rev = if gitRelease != null then
-      gitRelease.rev
-    else
-      "llvmorg-${releaseInfo.version}";
-  in fetchFromGitHub {
-    owner = "llvm";
-    repo = "llvm-project";
-    inherit rev sha256;
-  };
-
+  # Import releaseInfo separately to avoid infinite recursion
+  inherit (import ../common/common-let.nix { inherit lib gitRelease officialRelease; }) releaseInfo;
   inherit (releaseInfo) release_version version;
-
-  llvm_meta = {
-    license     = lib.licenses.ncsa;
-    maintainers = lib.teams.llvm.members;
-
-    # See llvm/cmake/config-ix.cmake.
-    platforms   =
-      lib.platforms.aarch64 ++
-      lib.platforms.arm ++
-      lib.platforms.m68k ++
-      lib.platforms.mips ++
-      lib.platforms.power ++
-      lib.platforms.riscv ++
-      lib.platforms.s390x ++
-      lib.platforms.wasi ++
-      lib.platforms.x86;
-  };
+  inherit (import ../common/common-let.nix { inherit lib fetchFromGitHub release_version gitRelease officialRelease monorepoSrc'; }) llvm_meta monorepoSrc;
 
   tools = lib.makeExtensible (tools: let
     callPackage = newScope (tools // { inherit stdenv cmake ninja libxml2 python3 release_version version monorepoSrc buildLlvmTools; });
diff --git a/pkgs/development/compilers/llvm/16/libclc/default.nix b/pkgs/development/compilers/llvm/16/libclc/default.nix
index 6fa0751f906b..2ceca9aaf7fd 100644
--- a/pkgs/development/compilers/llvm/16/libclc/default.nix
+++ b/pkgs/development/compilers/llvm/16/libclc/default.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
                 'find_program( LLVM_SPIRV llvm-spirv PATHS "${buildPackages.spirv-llvm-translator}/bin" NO_DEFAULT_PATH )'
   '' + lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
     substituteInPlace CMakeLists.txt \
-      --replace 'COMMAND prepare_builtins' 'COMMAND ${buildPackages.libclc.dev}/bin/prepare_builtins'
+      --replace 'COMMAND prepare_builtins' 'COMMAND ${buildLlvmTools.libclc.dev}/bin/prepare_builtins'
   '';
 
   nativeBuildInputs = [ cmake ninja python3 ];
diff --git a/pkgs/development/compilers/llvm/16/llvm/default.nix b/pkgs/development/compilers/llvm/16/llvm/default.nix
index 9475b5c99485..9994076bbdab 100644
--- a/pkgs/development/compilers/llvm/16/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/16/llvm/default.nix
@@ -2,7 +2,6 @@
 , pkgsBuildBuild
 , monorepoSrc
 , runCommand
-, fetchpatch
 , cmake
 , darwin
 , ninja
@@ -31,7 +30,7 @@
   # broken for the armv7l builder
   && !stdenv.hostPlatform.isAarch
 , enablePolly ? true
-} @args:
+}:
 
 let
   inherit (lib) optional optionals optionalString;
diff --git a/pkgs/development/compilers/llvm/6/default.nix b/pkgs/development/compilers/llvm/6/default.nix
index 3dcc75023f4f..3e78f5461e3f 100644
--- a/pkgs/development/compilers/llvm/6/default.nix
+++ b/pkgs/development/compilers/llvm/6/default.nix
@@ -1,5 +1,4 @@
-{ lowPrio, newScope, pkgs, lib, stdenv, cmake, gccForLibs
-, libxml2, python3, isl, fetchurl, overrideCC, wrapCCWith
+{ lowPrio, newScope, pkgs, lib, stdenv, cmake, libxml2, python3, isl, fetchurl, overrideCC, wrapCCWith
 , buildLlvmTools # tools, but from the previous stage, for cross
 , targetLlvmLibraries # libraries, but from the next stage, for cross
 , targetLlvm
@@ -8,7 +7,6 @@
 let
   release_version = "6.0.1";
   version = release_version; # differentiating these is important for rc's
-  targetConfig = stdenv.targetPlatform.config;
 
   fetch = name: sha256: fetchurl {
     url = "https://releases.llvm.org/${release_version}/${name}-${version}.src.tar.xz";
@@ -17,20 +15,7 @@ let
 
   clang-tools-extra_src = fetch "clang-tools-extra" "1w8ml7fyn4vyxmy59n2qm4r1k1kgwgwkaldp6m45fdv4g0kkfbhd";
 
-  llvm_meta = {
-    license     = lib.licenses.ncsa;
-    maintainers = lib.teams.llvm.members;
-
-    # See llvm/cmake/config-ix.cmake.
-    platforms   =
-      lib.platforms.aarch64 ++
-      lib.platforms.arm ++
-      lib.platforms.mips ++
-      lib.platforms.power ++
-      lib.platforms.s390x ++
-      lib.platforms.wasi ++
-      lib.platforms.x86;
-  };
+  inherit (import ../common/common-let.nix { inherit lib release_version; }) llvm_meta;
 
   tools = lib.makeExtensible (tools: let
     callPackage = newScope (tools // { inherit stdenv cmake libxml2 python3 isl release_version version fetch buildLlvmTools; });
diff --git a/pkgs/development/compilers/llvm/7/default.nix b/pkgs/development/compilers/llvm/7/default.nix
index 0607b5ebf42c..972d52ac6e1a 100644
--- a/pkgs/development/compilers/llvm/7/default.nix
+++ b/pkgs/development/compilers/llvm/7/default.nix
@@ -1,5 +1,5 @@
 { lowPrio, newScope, pkgs, lib, stdenv, cmake
-, gccForLibs, preLibcCrossHeaders
+, preLibcCrossHeaders
 , libxml2, python3, isl, fetchurl, overrideCC, wrapCCWith, wrapBintoolsWith
 , buildLlvmTools # tools, but from the previous stage, for cross
 , targetLlvmLibraries # libraries, but from the next stage, for cross
@@ -20,7 +20,6 @@
 let
   release_version = "7.1.0";
   version = release_version; # differentiating these is important for rc's
-  targetConfig = stdenv.targetPlatform.config;
 
   fetch = name: sha256: fetchurl {
     url = "https://releases.llvm.org/${release_version}/${name}-${version}.src.tar.xz";
@@ -29,21 +28,7 @@ let
 
   clang-tools-extra_src = fetch "clang-tools-extra" "0lb4kdh7j2fhfz8kd6iv5df7m3pikiryk1vvwsf87spc90n09q0w";
 
-  llvm_meta = {
-    license     = lib.licenses.ncsa;
-    maintainers = lib.teams.llvm.members;
-
-    # See llvm/cmake/config-ix.cmake.
-    platforms   =
-      lib.platforms.aarch64 ++
-      lib.platforms.arm ++
-      lib.platforms.mips ++
-      lib.platforms.power ++
-      lib.platforms.riscv ++
-      lib.platforms.s390x ++
-      lib.platforms.wasi ++
-      lib.platforms.x86;
-  };
+  inherit (import ../common/common-let.nix { inherit lib release_version; }) llvm_meta;
 
   tools = lib.makeExtensible (tools: let
     callPackage = newScope (tools // { inherit stdenv cmake libxml2 python3 isl release_version version fetch buildLlvmTools; });
diff --git a/pkgs/development/compilers/llvm/8/default.nix b/pkgs/development/compilers/llvm/8/default.nix
index 5beb8afb2ee9..0483916a620b 100644
--- a/pkgs/development/compilers/llvm/8/default.nix
+++ b/pkgs/development/compilers/llvm/8/default.nix
@@ -1,5 +1,5 @@
 { lowPrio, newScope, pkgs, lib, stdenv, cmake
-, gccForLibs, preLibcCrossHeaders
+, preLibcCrossHeaders
 , libxml2, python3, isl, fetchurl, overrideCC, wrapCCWith, wrapBintoolsWith
 , buildLlvmTools # tools, but from the previous stage, for cross
 , targetLlvmLibraries # libraries, but from the next stage, for cross
@@ -20,7 +20,6 @@
 let
   release_version = "8.0.1";
   version = release_version; # differentiating these is important for rc's
-  targetConfig = stdenv.targetPlatform.config;
 
   fetch = name: sha256: fetchurl {
     url = "https://github.com/llvm/llvm-project/releases/download/llvmorg-${release_version}/${name}-${version}.src.tar.xz";
@@ -29,21 +28,7 @@ let
 
   clang-tools-extra_src = fetch "clang-tools-extra" "1qf3097bc5ia8p6cpmbx985rjr3yaah5s8fc0nv7pw742yv7jw8q";
 
-  llvm_meta = {
-    license     = lib.licenses.ncsa;
-    maintainers = lib.teams.llvm.members;
-
-    # See llvm/cmake/config-ix.cmake.
-    platforms   =
-      lib.platforms.aarch64 ++
-      lib.platforms.arm ++
-      lib.platforms.mips ++
-      lib.platforms.power ++
-      lib.platforms.riscv ++
-      lib.platforms.s390x ++
-      lib.platforms.wasi ++
-      lib.platforms.x86;
-  };
+  inherit (import ../common/common-let.nix { inherit lib release_version; }) llvm_meta;
 
   tools = lib.makeExtensible (tools: let
     callPackage = newScope (tools // { inherit stdenv cmake libxml2 python3 isl release_version version fetch buildLlvmTools; });
diff --git a/pkgs/development/compilers/llvm/9/default.nix b/pkgs/development/compilers/llvm/9/default.nix
index 9f79dc5cce7f..fbd2e57805be 100644
--- a/pkgs/development/compilers/llvm/9/default.nix
+++ b/pkgs/development/compilers/llvm/9/default.nix
@@ -1,5 +1,5 @@
 { lowPrio, newScope, pkgs, lib, stdenv, cmake
-, gccForLibs, preLibcCrossHeaders
+, preLibcCrossHeaders
 , libxml2, python3, isl, fetchurl, overrideCC, wrapCCWith, wrapBintoolsWith
 , buildLlvmTools # tools, but from the previous stage, for cross
 , targetLlvmLibraries # libraries, but from the next stage, for cross
@@ -20,7 +20,6 @@
 let
   release_version = "9.0.1";
   version = release_version; # differentiating these is important for rc's
-  targetConfig = stdenv.targetPlatform.config;
 
   fetch = name: sha256: fetchurl {
     url = "https://github.com/llvm/llvm-project/releases/download/llvmorg-${release_version}/${name}-${version}.src.tar.xz";
@@ -29,21 +28,7 @@ let
 
   clang-tools-extra_src = fetch "clang-tools-extra" "01vgzd4k1q93nfs8gyl83mjlc4x0qsgfqw32lacbjzdxg0mdfvxj";
 
-  llvm_meta = {
-    license     = lib.licenses.ncsa;
-    maintainers = lib.teams.llvm.members;
-
-    # See llvm/cmake/config-ix.cmake.
-    platforms   =
-      lib.platforms.aarch64 ++
-      lib.platforms.arm ++
-      lib.platforms.mips ++
-      lib.platforms.power ++
-      lib.platforms.riscv ++
-      lib.platforms.s390x ++
-      lib.platforms.wasi ++
-      lib.platforms.x86;
-  };
+  inherit (import ../common/common-let.nix { inherit lib release_version; }) llvm_meta;
 
   tools = lib.makeExtensible (tools: let
     callPackage = newScope (tools // { inherit stdenv cmake libxml2 python3 isl release_version version fetch buildLlvmTools; });
diff --git a/pkgs/development/compilers/llvm/9/libunwind/default.nix b/pkgs/development/compilers/llvm/9/libunwind/default.nix
index 65b89c6bb18f..9a78025d71d4 100644
--- a/pkgs/development/compilers/llvm/9/libunwind/default.nix
+++ b/pkgs/development/compilers/llvm/9/libunwind/default.nix
@@ -1,5 +1,4 @@
-{ lib, stdenv, llvm_meta, version, fetch, cmake, fetchpatch
-, enableShared ? !stdenv.hostPlatform.isStatic
+{ lib, stdenv, llvm_meta, version, fetch, cmake, enableShared ? !stdenv.hostPlatform.isStatic
 }:
 
 stdenv.mkDerivation rec {
diff --git a/pkgs/development/compilers/llvm/common/common-let.nix b/pkgs/development/compilers/llvm/common/common-let.nix
new file mode 100644
index 000000000000..31360f5b98b9
--- /dev/null
+++ b/pkgs/development/compilers/llvm/common/common-let.nix
@@ -0,0 +1,60 @@
+{ lib
+, fetchFromGitHub ? null
+, release_version ? null
+, gitRelease ? null
+, officialRelease ? null
+, monorepoSrc' ? null
+}:
+
+rec {
+  llvm_meta = {
+    license = lib.licenses.ncsa;
+    maintainers = lib.teams.llvm.members;
+
+    # See llvm/cmake/config-ix.cmake.
+    platforms =
+      lib.platforms.aarch64 ++
+      lib.platforms.arm ++
+      lib.platforms.mips ++
+      lib.platforms.power ++
+      lib.platforms.s390x ++
+      lib.platforms.wasi ++
+      lib.platforms.x86 ++
+      lib.optionals (lib.versionAtLeast release_version "7") lib.platforms.riscv ++
+      lib.optionals (lib.versionAtLeast release_version "14") lib.platforms.m68k;
+  };
+
+  releaseInfo =
+    if gitRelease != null then rec {
+      original = gitRelease;
+      release_version = original.version;
+      version = gitRelease.rev-version;
+    } else rec {
+      original = officialRelease;
+      release_version = original.version;
+      version =
+        if original ? candidate then
+          "${release_version}-${original.candidate}"
+        else
+          release_version;
+    };
+
+  monorepoSrc =
+    if monorepoSrc' != null then
+      monorepoSrc'
+    else
+      let
+        sha256 = releaseInfo.original.sha256;
+        rev =
+          if gitRelease != null then
+            gitRelease.rev
+          else
+            "llvmorg-${releaseInfo.version}";
+      in
+      fetchFromGitHub {
+        owner = "llvm";
+        repo = "llvm-project";
+        inherit rev sha256;
+      };
+
+}
diff --git a/pkgs/development/compilers/llvm/git/default.nix b/pkgs/development/compilers/llvm/git/default.nix
index 930b716881e8..0748b97dd598 100644
--- a/pkgs/development/compilers/llvm/git/default.nix
+++ b/pkgs/development/compilers/llvm/git/default.nix
@@ -1,5 +1,5 @@
 { lowPrio, newScope, pkgs, lib, stdenv, cmake, ninja
-, gccForLibs, preLibcCrossHeaders
+, preLibcCrossHeaders
 , libxml2, python3, fetchFromGitHub, overrideCC, wrapCCWith, wrapBintoolsWith
 , buildLlvmTools # tools, but from the previous stage, for cross
 , targetLlvmLibraries # libraries, but from the next stage, for cross
@@ -53,51 +53,10 @@ in
 let
   monorepoSrc' = monorepoSrc;
 in let
-  releaseInfo = if gitRelease != null then rec {
-    original = gitRelease;
-    release_version = original.version;
-    version = gitRelease.rev-version;
-  } else rec {
-    original = officialRelease;
-    release_version = original.version;
-    version = if original ? candidate then
-      "${release_version}-${original.candidate}"
-    else
-      release_version;
-  };
-
-  monorepoSrc = if monorepoSrc' != null then
-    monorepoSrc'
-  else let
-    sha256 = releaseInfo.original.sha256;
-    rev = if gitRelease != null then
-      gitRelease.rev
-    else
-      "llvmorg-${releaseInfo.version}";
-  in fetchFromGitHub {
-    owner = "llvm";
-    repo = "llvm-project";
-    inherit rev sha256;
-  };
-
+  # Import releaseInfo separately to avoid infinite recursion
+  inherit (import ../common/common-let.nix { inherit lib gitRelease officialRelease; }) releaseInfo;
   inherit (releaseInfo) release_version version;
-
-  llvm_meta = {
-    license     = lib.licenses.ncsa;
-    maintainers = lib.teams.llvm.members;
-
-    # See llvm/cmake/config-ix.cmake.
-    platforms   =
-      lib.platforms.aarch64 ++
-      lib.platforms.arm ++
-      lib.platforms.m68k ++
-      lib.platforms.mips ++
-      lib.platforms.power ++
-      lib.platforms.riscv ++
-      lib.platforms.s390x ++
-      lib.platforms.wasi ++
-      lib.platforms.x86;
-  };
+  inherit (import ../common/common-let.nix { inherit lib fetchFromGitHub release_version gitRelease officialRelease monorepoSrc'; }) llvm_meta monorepoSrc;
 
   tools = lib.makeExtensible (tools: let
     callPackage = newScope (tools // { inherit stdenv cmake ninja libxml2 python3 release_version version monorepoSrc buildLlvmTools; });
diff --git a/pkgs/development/compilers/llvm/git/llvm/default.nix b/pkgs/development/compilers/llvm/git/llvm/default.nix
index 66b0a7438cef..119b2272beda 100644
--- a/pkgs/development/compilers/llvm/git/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/git/llvm/default.nix
@@ -29,7 +29,7 @@
   # broken for the armv7l builder
   && !stdenv.hostPlatform.isAarch
 , enablePolly ? true
-} @args:
+}:
 
 let
   inherit (lib) optional optionals optionalString;
diff --git a/pkgs/development/interpreters/lua-5/build-luarocks-package.nix b/pkgs/development/interpreters/lua-5/build-luarocks-package.nix
index 3b49b60ca5d3..c388d0eef8c1 100644
--- a/pkgs/development/interpreters/lua-5/build-luarocks-package.nix
+++ b/pkgs/development/interpreters/lua-5/build-luarocks-package.nix
@@ -3,6 +3,7 @@
 , lua
 , wrapLua
 , luarocks
+, writeTextFile
 
 # Whether the derivation provides a lua module or not.
 , luarocksCheckHook
@@ -83,7 +84,7 @@ let
 
   __structuredAttrs = true;
   env = {
-    LUAROCKS_CONFIG="$PWD/${luarocks_config}";
+    LUAROCKS_CONFIG = self.configFile;
   } // attrs.env or {};
 
   generatedRockspecFilename = "${rockspecDir}/${pname}-${rockspecVersion}.rockspec";
@@ -111,6 +112,12 @@ let
   # explicitly inherit this for it to be available as a shell variable in the
   # builder
   rocksSubdir = "${self.pname}-${self.version}-rocks";
+
+  configFile = writeTextFile {
+    name = pname + "-luarocks-config.lua";
+    text = self.luarocks_content;
+  };
+
   luarocks_content = let
       externalDepsGenerated = lib.filter (drv: !drv ? luaModule)
         (self.nativeBuildInputs ++ self.propagatedBuildInputs ++ self.buildInputs);
@@ -131,12 +138,6 @@ let
 
   configurePhase = ''
     runHook preConfigure
-
-    cat > ${luarocks_config} <<EOF
-    ${self.luarocks_content}
-    EOF
-    export LUAROCKS_CONFIG="$PWD/${luarocks_config}";
-    cat "$LUAROCKS_CONFIG"
   ''
   + lib.optionalString (self.rockspecFilename == null) ''
     rockspecFilename="${self.generatedRockspecFilename}"
diff --git a/pkgs/development/interpreters/lua-5/interpreter.nix b/pkgs/development/interpreters/lua-5/interpreter.nix
index 57245bd61e76..c26275299142 100644
--- a/pkgs/development/interpreters/lua-5/interpreter.nix
+++ b/pkgs/development/interpreters/lua-5/interpreter.nix
@@ -1,6 +1,5 @@
 { lib, stdenv, fetchurl, readline
 , compat ? false
-, callPackage
 , makeWrapper
 , self
 , packageOverrides ? (final: prev: {})
@@ -18,38 +17,42 @@
 , staticOnly ? stdenv.hostPlatform.isStatic
 , luaAttr ? "lua${lib.versions.major version}_${lib.versions.minor version}"
 } @ inputs:
-let
-  luaPackages = self.pkgs;
-
-  luaversion = lib.versions.majorMinor version;
-
-plat = if (stdenv.isLinux && lib.versionOlder self.luaversion "5.4") then "linux"
-       else if (stdenv.isLinux && lib.versionAtLeast self.luaversion "5.4") then "linux-readline"
-       else if stdenv.isDarwin then "macosx"
-       else if stdenv.hostPlatform.isMinGW then "mingw"
-       else if stdenv.isFreeBSD then "freebsd"
-       else if stdenv.isSunOS then "solaris"
-       else if stdenv.hostPlatform.isBSD then "bsd"
-       else if stdenv.hostPlatform.isUnix then "posix"
-       else "generic";
-
-compatFlags = if (lib.versionOlder self.luaversion "5.3") then " -DLUA_COMPAT_ALL"
-              else if (lib.versionOlder self.luaversion "5.4") then " -DLUA_COMPAT_5_1 -DLUA_COMPAT_5_2"
-              else " -DLUA_COMPAT_5_3";
-in
-
-stdenv.mkDerivation rec {
+
+stdenv.mkDerivation (finalAttrs:
+  let
+    luaPackages = self.pkgs;
+
+    luaversion = lib.versions.majorMinor version;
+
+    plat = if (stdenv.isLinux && lib.versionOlder self.luaversion "5.4") then "linux"
+          else if (stdenv.isLinux && lib.versionAtLeast self.luaversion "5.4") then "linux-readline"
+          else if stdenv.isDarwin then "macosx"
+          else if stdenv.hostPlatform.isMinGW then "mingw"
+          else if stdenv.isFreeBSD then "freebsd"
+          else if stdenv.isSunOS then "solaris"
+          else if stdenv.hostPlatform.isBSD then "bsd"
+          else if stdenv.hostPlatform.isUnix then "posix"
+          else "generic";
+
+    compatFlags = if (lib.versionOlder self.luaversion "5.3") then " -DLUA_COMPAT_ALL"
+                  else if (lib.versionOlder self.luaversion "5.4") then " -DLUA_COMPAT_5_1 -DLUA_COMPAT_5_2"
+                  else " -DLUA_COMPAT_5_3";
+  in
+
+  {
   pname = "lua";
   inherit version;
 
   src = fetchurl {
-    url = "https://www.lua.org/ftp/${pname}-${version}.tar.gz";
+    url = "https://www.lua.org/ftp/${finalAttrs.pname}-${finalAttrs.version}.tar.gz";
     sha256 = hash;
   };
 
-  LuaPathSearchPaths    = luaPackages.luaLib.luaPathList;
-  LuaCPathSearchPaths   = luaPackages.luaLib.luaCPathList;
-  setupHook = luaPackages.lua-setup-hook LuaPathSearchPaths LuaCPathSearchPaths;
+  LuaPathSearchPaths  = luaPackages.luaLib.luaPathList;
+  LuaCPathSearchPaths = luaPackages.luaLib.luaCPathList;
+  setupHook = luaPackages.lua-setup-hook
+    finalAttrs.LuaPathSearchPaths
+    finalAttrs.LuaCPathSearchPaths;
 
   nativeBuildInputs = [ makeWrapper ];
   buildInputs = [ readline ];
@@ -163,4 +166,4 @@ stdenv.mkDerivation rec {
     license = lib.licenses.mit;
     platforms = lib.platforms.unix;
   };
-}
+})
diff --git a/pkgs/development/interpreters/luajit/default.nix b/pkgs/development/interpreters/luajit/default.nix
index 28493cc48aec..211fa56e9119 100644
--- a/pkgs/development/interpreters/luajit/default.nix
+++ b/pkgs/development/interpreters/luajit/default.nix
@@ -1,11 +1,9 @@
 { lib
 , stdenv
-, fetchFromGitHub
 , buildPackages
 , version
 , src
 , extraMeta ? { }
-, callPackage
 , self
 , packageOverrides ? (final: prev: {})
 , pkgsBuildBuild
diff --git a/pkgs/development/interpreters/php/8.1.nix b/pkgs/development/interpreters/php/8.1.nix
index 51651c5d405b..5f5be6b3d1d8 100644
--- a/pkgs/development/interpreters/php/8.1.nix
+++ b/pkgs/development/interpreters/php/8.1.nix
@@ -2,8 +2,8 @@
 
 let
   base = callPackage ./generic.nix (_args // {
-    version = "8.1.25";
-    hash = "sha256-qGqIwYQMG8gyvP0vvsO4oZQsgxTaXf9T8J+cmNDBLoo=";
+    version = "8.1.26";
+    hash = "sha256-g73iSchKoaBDqMjQ7qCTRcLK5puXhM3wIin8kW+7nqA=";
   });
 
 in
diff --git a/pkgs/development/interpreters/php/8.2.nix b/pkgs/development/interpreters/php/8.2.nix
index 072012657588..20aa6aaa0bc0 100644
--- a/pkgs/development/interpreters/php/8.2.nix
+++ b/pkgs/development/interpreters/php/8.2.nix
@@ -2,8 +2,8 @@
 
 let
   base = callPackage ./generic.nix (_args // {
-    version = "8.2.12";
-    hash = "sha256-cEMl9WsbTBf5+VHh/+9cZOFIiWBT804mJhUsuqLwWJM=";
+    version = "8.2.13";
+    hash = "sha256-ZlKfQ7ITEx5rJTxWAr7wXwSUWNISknMPzNY7SKBtZ7o=";
   });
 
 in
diff --git a/pkgs/development/interpreters/php/8.3.nix b/pkgs/development/interpreters/php/8.3.nix
index 23b9c2ee8e82..6327e23504a8 100644
--- a/pkgs/development/interpreters/php/8.3.nix
+++ b/pkgs/development/interpreters/php/8.3.nix
@@ -1,13 +1,10 @@
 { callPackage, fetchurl, ... }@_args:
 
 let
-  base = (callPackage ./generic.nix (_args // {
-    version = "8.3.0RC6";
-    phpSrc = fetchurl {
-      url = "https://downloads.php.net/~eric/php-8.3.0RC6.tar.xz";
-      hash = "sha256-Hntdz+vEkh7EQgnB4IrnG2sQ5bG2uJW7T3a0RIbHBe0=";
-    };
-  }));
+  base = callPackage ./generic.nix (_args // {
+    version = "8.3.0";
+    hash = "sha256-3mfQgz1CsZblpm+hozL0Xilsvo6UcuklayoHHDTcXtY=";
+  });
 in
 base.withExtensions ({ all, ... }: with all; ([
   bcmath
diff --git a/pkgs/development/libraries/gvm-libs/default.nix b/pkgs/development/libraries/gvm-libs/default.nix
index 6c6818b455d9..96a6f99925de 100644
--- a/pkgs/development/libraries/gvm-libs/default.nix
+++ b/pkgs/development/libraries/gvm-libs/default.nix
@@ -23,13 +23,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gvm-libs";
-  version = "22.7.2";
+  version = "22.7.3";
 
   src = fetchFromGitHub {
     owner = "greenbone";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-vcCugIohuZg+GhUA7ZgkyhMxN0KSvCFVO/HLOnrNxxA=";
+    hash = "sha256-Vo+lFUGLeGPKq3aUCiiBcBYu6BZ4KQI5vCtnQyRUUiU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/paho-mqtt-cpp/default.nix b/pkgs/development/libraries/paho-mqtt-cpp/default.nix
index b62e774ba513..2e390da0bef4 100644
--- a/pkgs/development/libraries/paho-mqtt-cpp/default.nix
+++ b/pkgs/development/libraries/paho-mqtt-cpp/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "paho.mqtt.cpp";
-  version = "1.2.0";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "eclipse";
     repo = "paho.mqtt.cpp";
     rev = "v${version}";
-    hash = "sha256-tcq0a4X5dKE4rnczRMAVe3Wt43YzUKbxsv9Sk+q+IB8=";
+    hash = "sha256-QV6r4GzSVghgVQtF8OQ1a23PtCdjg7PeuGRBdA+WbE0=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/pipewire/wireplumber.nix b/pkgs/development/libraries/pipewire/wireplumber.nix
index 37dea2ece86a..c58ff8399aec 100644
--- a/pkgs/development/libraries/pipewire/wireplumber.nix
+++ b/pkgs/development/libraries/pipewire/wireplumber.nix
@@ -24,7 +24,7 @@
 
 stdenv.mkDerivation rec {
   pname = "wireplumber";
-  version = "0.4.15";
+  version = "0.4.16";
 
   outputs = [ "out" "dev" ] ++ lib.optional enableDocs "doc";
 
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
     owner = "pipewire";
     repo = "wireplumber";
     rev = version;
-    hash = "sha256-VwzpPAVfoaV47O7OjXtPQj5s8zfH5rkB22Pdlg7u5Fg=";
+    hash = "sha256-BJ4Q34wLGQNxoihH+M8NBY5ZDw/D9RMda9GvFw7BemY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/ocaml-modules/syslog/default.nix b/pkgs/development/ocaml-modules/syslog/default.nix
index ccec03296384..ad9204847e10 100644
--- a/pkgs/development/ocaml-modules/syslog/default.nix
+++ b/pkgs/development/ocaml-modules/syslog/default.nix
@@ -1,30 +1,22 @@
-{ lib, stdenv, fetchFromGitHub, ocaml, findlib }:
+{ lib, fetchFromGitHub, buildDunePackage }:
 
-assert lib.versionAtLeast (lib.getVersion ocaml) "4.03.0";
+buildDunePackage rec {
+  pname = "syslog";
+  version = "2.0.2";
 
-stdenv.mkDerivation rec {
-  pname = "ocaml${ocaml.version}-syslog";
-  version = "1.5";
+  minimalOCamlVersion = "4.03";
 
   src = fetchFromGitHub {
-    owner = "rixed";
+    owner = "geneanet";
     repo = "ocaml-syslog";
     rev = "v${version}";
-    sha256 = "1kqpc55ppzv9n555qgqpda49n7nvkqimzisyjx2a7338r7q4r5bw";
+    hash = "sha256-WybNZBPhv4fhjzzb95E+6ZHcZUnfROLlNF3PMBGO9ys=";
   };
 
-  nativeBuildInputs = [ ocaml findlib ];
-  strictDeps = true;
-
-  buildFlags = [ "all" "opt" ];
-
-  createFindlibDestdir = true;
-
   meta = with lib; {
-    homepage = "https://github.com/rixed/ocaml-syslog";
+    homepage = "https://github.com/geneanet/ocaml-syslog";
     description = "Simple wrapper to access the system logger from OCaml";
     license = licenses.lgpl21Plus;
-    inherit (ocaml.meta) platforms;
     maintainers = [ maintainers.rixed ];
   };
 }
diff --git a/pkgs/development/python-modules/adguardhome/default.nix b/pkgs/development/python-modules/adguardhome/default.nix
index 78b2cba4d482..a92e6e8ae33d 100644
--- a/pkgs/development/python-modules/adguardhome/default.nix
+++ b/pkgs/development/python-modules/adguardhome/default.nix
@@ -12,16 +12,16 @@
 
 buildPythonPackage rec {
   pname = "adguardhome";
-  version = "0.6.2";
+  version = "0.6.3";
   format = "pyproject";
 
-  disabled = pythonOlder "3.8";
+  disabled = pythonOlder "3.11";
 
   src = fetchFromGitHub {
     owner = "frenck";
     repo = "python-${pname}";
     rev = "refs/tags/v${version}";
-    hash = "sha256-hCiyylnc1WsKz8zQxJhXe4v+SJxKFkwzpmPYnltnc8g=";
+    hash = "sha256-V8SsWsGYmUhR9/yV6BZBK1UjYGHlDrXrF8nt0eZbTnI=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/bqscales/default.nix b/pkgs/development/python-modules/bqscales/default.nix
index c8fa7879bd75..a5fae24a13eb 100644
--- a/pkgs/development/python-modules/bqscales/default.nix
+++ b/pkgs/development/python-modules/bqscales/default.nix
@@ -5,7 +5,6 @@
 , hatchling
 , hatch-jupyter-builder
 , jupyterlab
-, jupyter-packaging
 , ipywidgets
 , numpy
 , traitlets
@@ -15,7 +14,7 @@
 buildPythonPackage rec {
   pname = "bqscales";
   version = "0.3.3";
-  format = "pyproject";
+  pyproject = true;
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
@@ -23,24 +22,10 @@ buildPythonPackage rec {
     hash = "sha256-SlnNw4dWOzRedwIN3kCyl95qVqkY92QGOMS3Eyoqk0I=";
   };
 
-  # We relax dependencies here instead of pulling in a patch because upstream
-  # has released a new version using hatch-jupyter-builder, but it is not yet
-  # trivial to upgrade to that.
-  #
-  # Per https://github.com/bqplot/bqscales/issues/76, jupyterlab is not needed
-  # as a build dependency right now.
-  #
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace '"jupyterlab==3.*",' "" \
-      --replace 'jupyter_packaging~=' 'jupyter_packaging>='
-  '';
-
   nativeBuildInputs = [
     hatch-jupyter-builder
     hatchling
     jupyterlab
-    jupyter-packaging
   ];
 
   propagatedBuildInputs = [
@@ -50,6 +35,8 @@ buildPythonPackage rec {
     traittypes
   ];
 
+  env.SKIP_JUPYTER_BUILDER = 1;
+
   # no tests in PyPI dist
   doCheck = false;
 
diff --git a/pkgs/development/python-modules/can/default.nix b/pkgs/development/python-modules/can/default.nix
index 2ed28098a63e..4688c6507495 100644
--- a/pkgs/development/python-modules/can/default.nix
+++ b/pkgs/development/python-modules/can/default.nix
@@ -1,4 +1,5 @@
 { lib
+, stdenv
 , buildPythonPackage
 , fetchFromGitHub
 , future
@@ -11,7 +12,6 @@
 , pytestCheckHook
 , pythonOlder
 , setuptools
-, stdenv
 , typing-extensions
 , wrapt
 , uptime
@@ -19,8 +19,8 @@
 
 buildPythonPackage rec {
   pname = "can";
-  version = "4.2.2";
-  format = "setuptools";
+  version = "4.3.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "hardbyte";
     repo = "python-can";
     rev = "refs/tags/v${version}";
-    hash = "sha256-MyVGjAy13Ne0PkVufB0JDNEZHhVBzeUYWWlH72ib/pI=";
+    hash = "sha256-JsYAh5Z6RIX6aWpSuW+VIzJRPf5MfNbBGg36v3CQiLU=";
   };
 
   postPatch = ''
@@ -36,10 +36,13 @@ buildPythonPackage rec {
       --replace " --cov=can --cov-config=tox.ini --cov-report=lcov --cov-report=term" ""
   '';
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     msgpack
     packaging
-    setuptools
     typing-extensions
     wrapt
   ];
diff --git a/pkgs/development/python-modules/chex/default.nix b/pkgs/development/python-modules/chex/default.nix
index 6bee1641242c..559d047032c6 100644
--- a/pkgs/development/python-modules/chex/default.nix
+++ b/pkgs/development/python-modules/chex/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "chex";
-  version = "0.1.84";
+  version = "0.1.85";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "deepmind";
     repo = "chex";
     rev = "refs/tags/v${version}";
-    hash = "sha256-LsUMvSMVGjqZuFDcb+/61RtFxweeG6bSFzmJUUMv6rA=";
+    hash = "sha256-7k/+2dNNbPBXtbabuOEVpAI7T1SuM4JDf074dmTg/vs=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/elastic-transport/default.nix b/pkgs/development/python-modules/elastic-transport/default.nix
index c4d41f7d2fac..f8645e795629 100644
--- a/pkgs/development/python-modules/elastic-transport/default.nix
+++ b/pkgs/development/python-modules/elastic-transport/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "elastic-transport";
-  version = "8.4.1";
+  version = "8.10.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "elastic";
     repo = "elastic-transport-python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-hrI8GJaI3K/3B0Vng0WvoabDP2Y8/60/tHNKo/Xq6JM=";
+    hash = "sha256-4W9p9niHf2EMY+sS1RCdqWndzvpz8pKrIlLo3NxJ8mk=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/elasticsearch8/default.nix b/pkgs/development/python-modules/elasticsearch8/default.nix
index 3ab17cb180d0..b3c06adb539e 100644
--- a/pkgs/development/python-modules/elasticsearch8/default.nix
+++ b/pkgs/development/python-modules/elasticsearch8/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "elasticsearch8";
-  version = "8.10.1";
+  version = "8.11.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-naLy7xSqHlz8QNbQhM+iydJi8m6DQqBWlDLijOOT7ak=";
+    hash = "sha256-+y9U5fscYLAfP6IhLxzUUOENaNC4i8NAPEFtVP5+HG4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/hahomematic/default.nix b/pkgs/development/python-modules/hahomematic/default.nix
index 620883eb6cd1..e69d51887050 100644
--- a/pkgs/development/python-modules/hahomematic/default.nix
+++ b/pkgs/development/python-modules/hahomematic/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "hahomematic";
-  version = "2023.11.1";
+  version = "2023.11.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.11";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "danielperna84";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-C8KznmR3+G38MLQj6Sek7qW9R9yJr8gfcjgNjDyXG7I=";
+    hash = "sha256-LB0BGj/DWjHGAFkyACkkzGY1oYNc7hJ2BeT1lHlNjqU=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/jupyter-server/default.nix b/pkgs/development/python-modules/jupyter-server/default.nix
index fbb9f0cacd83..5a61b06c5026 100644
--- a/pkgs/development/python-modules/jupyter-server/default.nix
+++ b/pkgs/development/python-modules/jupyter-server/default.nix
@@ -34,14 +34,14 @@
 
 buildPythonPackage rec {
   pname = "jupyter-server";
-  version = "2.7.3";
+  version = "2.10.1";
   format = "pyproject";
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     pname = "jupyter_server";
     inherit version;
-    hash = "sha256-1JFshYHE67xTTOvaqOyiR42fO/3Yjq4p/KsBIOrFdkk=";
+    hash = "sha256-5tomV6lUp4ee7SjMCOCBewH/2B1+q4Y0ZgOXtV+SZHI=";
   };
 
   nativeBuildInputs = [
@@ -90,9 +90,9 @@ buildPythonPackage rec {
   '';
 
   disabledTests = [
-    "test_server_extension_list"
     "test_cull_idle"
     "test_server_extension_list"
+    "test_subscribe_websocket"
   ] ++ lib.optionals stdenv.isDarwin [
     # attempts to use trashcan, build env doesn't allow this
     "test_delete"
diff --git a/pkgs/development/python-modules/lpc-checksum/default.nix b/pkgs/development/python-modules/lpc-checksum/default.nix
new file mode 100644
index 000000000000..2ebdba9fe095
--- /dev/null
+++ b/pkgs/development/python-modules/lpc-checksum/default.nix
@@ -0,0 +1,38 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, poetry-core
+, pytestCheckHook
+, intelhex
+}:
+
+buildPythonPackage rec {
+  pname = "lpc-checksum";
+  version = "3.0.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "basilfx";
+    repo = "lpc_checksum";
+    rev = "v${version}";
+    hash = "sha256-POgV0BdkMLmdjBh/FToPPmJTAxsPASB7ZE32SqGGKHk=";
+  };
+
+  nativeBuildInputs = [
+    poetry-core
+    pytestCheckHook
+  ];
+
+  propagatedBuildInputs = [
+    intelhex
+  ];
+
+  pythonImportsCheck = [ "lpc_checksum" ];
+
+  meta = with lib; {
+    description = "Python script to calculate LPC firmware checksums";
+    homepage = "https://pypi.org/project/lpc-checksum/";
+    license = licenses.mit;
+    maintainers = with maintainers; [ otavio ];
+  };
+}
diff --git a/pkgs/development/python-modules/mdformat-mkdocs/default.nix b/pkgs/development/python-modules/mdformat-mkdocs/default.nix
index 8b5db005eddf..9052c67be207 100644
--- a/pkgs/development/python-modules/mdformat-mkdocs/default.nix
+++ b/pkgs/development/python-modules/mdformat-mkdocs/default.nix
@@ -6,20 +6,21 @@
 , mdformat-gfm
 , mdit-py-plugins
 , pythonOlder
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "mdformat-mkdocs";
-  version = "1.0.6";
-  format = "pyproject";
+  version = "1.1.0";
+  pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "KyleKing";
-    repo = pname;
+    repo = "mdformat-mkdocs";
     rev = "refs/tags/v${version}";
-    hash = "sha256-l4B/DR0pKZG62+sBG+fiux/XeF3ewxb2TYa+Zs1O3kU=";
+    hash = "sha256-5MCsXCkYnoLEZZoj9WrO/Z3VzTKagoOrMCuTpA4dGAQ=";
   };
 
   nativeBuildInputs = [
@@ -32,6 +33,10 @@ buildPythonPackage rec {
     mdit-py-plugins
   ];
 
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
   pythonImportsCheck = [
     "mdformat_mkdocs"
   ];
@@ -39,7 +44,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "mdformat plugin for MkDocs";
     homepage = "https://github.com/KyleKing/mdformat-mkdocs";
-changelog = "https://github.com/KyleKing/mdformat-mkdocs/releases/tag/v${version}";
+    changelog = "https://github.com/KyleKing/mdformat-mkdocs/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ aldoborrero ];
   };
diff --git a/pkgs/development/python-modules/pebble/default.nix b/pkgs/development/python-modules/pebble/default.nix
index deeec443b85c..5cdc198bc792 100644
--- a/pkgs/development/python-modules/pebble/default.nix
+++ b/pkgs/development/python-modules/pebble/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "pebble";
-  version = "5.0.3";
+  version = "5.0.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "Pebble";
     inherit version;
-    hash = "sha256-vc/Z6n4K7biVsgQXfBnm1lQ9mWL040AuurIXUASGPag=";
+    hash = "sha256-b3rfK97UQUvdNWLV9NVnvZT/EB5yav+HimZXW8mcEis=";
   };
 
   nativeCheckInputs = [
@@ -32,6 +32,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "API to manage threads and processes within an application";
     homepage = "https://github.com/noxdafox/pebble";
+    changelog = "https://github.com/noxdafox/pebble/releases/tag/${version}";
     license = licenses.lgpl3Plus;
     maintainers = with maintainers; [ orivej ];
   };
diff --git a/pkgs/development/python-modules/plum-py/default.nix b/pkgs/development/python-modules/plum-py/default.nix
index b0cd4c4aea5b..721786e608d9 100644
--- a/pkgs/development/python-modules/plum-py/default.nix
+++ b/pkgs/development/python-modules/plum-py/default.nix
@@ -38,6 +38,12 @@ buildPythonPackage rec {
     "tests"
   ];
 
+  disabledTestPaths = [
+    # tests enum.IntFlag behaviour which has been disallowed in python 3.11.6
+    # https://gitlab.com/dangass/plum/-/issues/150
+    "tests/flag/test_flag_invalid.py"
+  ];
+
   meta = with lib; {
     description = "Classes and utilities for packing/unpacking bytes";
     homepage = "https://plum-py.readthedocs.io/";
diff --git a/pkgs/development/python-modules/polars/all_horizontal.patch b/pkgs/development/python-modules/polars/all_horizontal.patch
deleted file mode 100644
index 3caf548d4ac0..000000000000
--- a/pkgs/development/python-modules/polars/all_horizontal.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/crates/polars-lazy/src/frame/mod.rs b/crates/polars-lazy/src/frame/mod.rs
-index 2d2ede651..be24b8809 100644
---- a/crates/polars-lazy/src/frame/mod.rs
-+++ b/crates/polars-lazy/src/frame/mod.rs
-@@ -25,7 +25,7 @@ pub use parquet::*;
- use polars_core::frame::explode::MeltArgs;
- use polars_core::prelude::*;
- use polars_io::RowCount;
--use polars_plan::dsl::all_horizontal;
-+use polars_plan::dsl::functions::all_horizontal;
- pub use polars_plan::frame::{AllowedOptimizations, OptState};
- use polars_plan::global::FETCH_ROWS;
- #[cfg(any(feature = "ipc", feature = "parquet", feature = "csv"))]
diff --git a/pkgs/development/python-modules/polars/default.nix b/pkgs/development/python-modules/polars/default.nix
index fc82d8638569..991a3a3684cd 100644
--- a/pkgs/development/python-modules/polars/default.nix
+++ b/pkgs/development/python-modules/polars/default.nix
@@ -32,13 +32,6 @@ buildPythonPackage {
   disabled = pythonOlder "3.6";
   src = rootSource;
 
-  patches = [
-    # workaround for apparent rustc bug
-    # remove when we're at Rust 1.73
-    # https://github.com/pola-rs/polars/issues/12050
-    ./all_horizontal.patch
-  ];
-
   # Cargo.lock file is sometimes behind actual release which throws an error,
   # thus the `sed` command
   # Make sure to check that the right substitutions are made when updating the package
diff --git a/pkgs/development/python-modules/publicsuffixlist/default.nix b/pkgs/development/python-modules/publicsuffixlist/default.nix
index 46fb43943cac..ad60d8e79f85 100644
--- a/pkgs/development/python-modules/publicsuffixlist/default.nix
+++ b/pkgs/development/python-modules/publicsuffixlist/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "publicsuffixlist";
-  version = "0.10.0.20231121";
+  version = "0.10.0.20231122";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-6Jc12xQchyjXfI0kvvCCBGPNpivsz51izgS/41JrVnQ=";
+    hash = "sha256-0CrHVPoQTS3I9ZPvf/4wWQX4vYn5vAeWUxNanjnbF60=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pyngo/default.nix b/pkgs/development/python-modules/pyngo/default.nix
new file mode 100644
index 000000000000..91d39a4ab0a2
--- /dev/null
+++ b/pkgs/development/python-modules/pyngo/default.nix
@@ -0,0 +1,56 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+
+# build-system
+, hatchling
+
+# dependencies
+, django
+, pydantic
+, typing-extensions
+
+# tests
+, django-stubs
+, pytestCheckHook
+, pytest-asyncio
+}:
+
+buildPythonPackage rec {
+  pname = "pyngo";
+  version = "1.6.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "yezz123";
+    repo = "pyngo";
+    rev = version;
+    hash = "sha256-qOY1ILMDqSguLnbhuu5JJVMvG3uA08Lv2fB70TgrKqI=";
+  };
+
+  nativeBuildInputs = [
+    hatchling
+  ];
+
+  propagatedBuildInputs = [
+    django
+    pydantic
+    typing-extensions
+  ];
+
+  pythonImportsCheck = [ "pyngo" ];
+
+  nativeCheckInputs = [
+    django-stubs
+    pytestCheckHook
+    pytest-asyncio
+  ];
+
+  meta = with lib; {
+    changelog = "https://github.com/yezz123/pyngo/releases/tag/${version}";
+    description = "Pydantic model support for Django & Django-Rest-Framework";
+    homepage = "https://github.com/yezz123/pyngo";
+    license = licenses.mit;
+    maintainers = with maintainers; [ hexa ];
+  };
+}
diff --git a/pkgs/development/python-modules/pytorch-lightning/default.nix b/pkgs/development/python-modules/pytorch-lightning/default.nix
index 1ed718a70032..c2244a1c1447 100644
--- a/pkgs/development/python-modules/pytorch-lightning/default.nix
+++ b/pkgs/development/python-modules/pytorch-lightning/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage rec {
   pname = "pytorch-lightning";
-  version = "2.1.1";
+  version = "2.1.2";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "Lightning-AI";
     repo = "pytorch-lightning";
     rev = "refs/tags/${version}";
-    hash = "sha256-1psTa++qF5WPDVXeDGWfcQ4hGz98uW297QDUKrQyoRE=";
+    hash = "sha256-d5DKAx67uuIPxtSgazIQnxLiHTBD0lwHaB6LD3R6vKA=";
   };
 
   preConfigure = ''
diff --git a/pkgs/development/python-modules/rollbar/default.nix b/pkgs/development/python-modules/rollbar/default.nix
index 51b4af38b2e2..d5caebf899b0 100644
--- a/pkgs/development/python-modules/rollbar/default.nix
+++ b/pkgs/development/python-modules/rollbar/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "rollbar";
-  version = "0.16.3";
+  version = "1.0.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-AjE9/GBxDsc2qwM9D4yWnYV6i5kc1n4MGpFiDooE7eI=";
+    hash = "sha256-Y0e35J8i8ClvwoemrqddZCz2RJTS7hJwQqelk8l9868=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/sentry-sdk/default.nix b/pkgs/development/python-modules/sentry-sdk/default.nix
index b389da6f1c99..1de6ee56adea 100644
--- a/pkgs/development/python-modules/sentry-sdk/default.nix
+++ b/pkgs/development/python-modules/sentry-sdk/default.nix
@@ -41,7 +41,7 @@
 
 buildPythonPackage rec {
   pname = "sentry-sdk";
-  version = "1.35.0";
+  version = "1.36.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -50,7 +50,7 @@ buildPythonPackage rec {
     owner = "getsentry";
     repo = "sentry-python";
     rev = "refs/tags/${version}";
-    hash = "sha256-wV38DW5YfY+f5Qg/I7JPQ5R8TyqqdjwHKfr5XjT2vFA=";
+    hash = "sha256-4NncvZtBwAyMkfZBm44IubFA+f2bXrGy5HOYr70SoSg=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/trimesh/default.nix b/pkgs/development/python-modules/trimesh/default.nix
index 3943d185255d..6a38fed9c492 100644
--- a/pkgs/development/python-modules/trimesh/default.nix
+++ b/pkgs/development/python-modules/trimesh/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "trimesh";
-  version = "4.0.1";
+  version = "4.0.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-jBVQqYNB8P7E0xkcTH6uYmbBZ/l5P9VLtyyRQxq/fOY=";
+    hash = "sha256-3XpncG6ISKQU+hqJpvck82s0BYgvYpNGn3zcdWkB5Ps=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/types-appdirs/default.nix b/pkgs/development/python-modules/types-appdirs/default.nix
index 7d316400a041..f6fe4cf6e1b3 100644
--- a/pkgs/development/python-modules/types-appdirs/default.nix
+++ b/pkgs/development/python-modules/types-appdirs/default.nix
@@ -14,7 +14,7 @@ buildPythonPackage rec {
 
   meta = {
     description = "This is a PEP 561 type stub package for the appdirs package. It can be used by type-checking tools like mypy, pyright, pytype, PyCharm, etc. to check code that uses appdirs. ";
-    homepage = "https://pypi.org/project/types-appdirss";
+    homepage = "https://pypi.org/project/types-appdirs";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ ];
   };
diff --git a/pkgs/development/tools/build-managers/bazel/bazel_6/default.nix b/pkgs/development/tools/build-managers/bazel/bazel_6/default.nix
index fb1f4a8f319c..a32c2fc536b6 100644
--- a/pkgs/development/tools/build-managers/bazel/bazel_6/default.nix
+++ b/pkgs/development/tools/build-managers/bazel/bazel_6/default.nix
@@ -199,6 +199,10 @@ stdenv.mkDerivation rec {
   inherit src;
   inherit sourceRoot;
   patches = [
+    # upb definition inside bazel sets its own copts that take precedence
+    # over flags we set externally, so need to patch them at the source
+    ./upb-clang16.patch
+
     # Force usage of the _non_ prebuilt java toolchain.
     # the prebuilt one does not work in nix world.
     ./java_toolchain.patch
@@ -403,6 +407,8 @@ stdenv.mkDerivation rec {
       # libcxx includes aren't added by libcxx hook
       # https://github.com/NixOS/nixpkgs/pull/41589
       export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -isystem ${lib.getDev libcxx}/include/c++/v1"
+      # for CLang 16 compatibility in external/{absl,upb} dependencies
+      export NIX_CFLAGS_COMPILE+=" -Wno-deprecated-builtins -Wno-gnu-offsetof-extensions"
 
       # don't use system installed Xcode to run clang, use Nix clang instead
       sed -i -E "s;/usr/bin/xcrun (--sdk macosx )?clang;${stdenv.cc}/bin/clang $NIX_CFLAGS_COMPILE $(bazelLinkFlags) -framework CoreFoundation;g" \
diff --git a/pkgs/development/tools/build-managers/bazel/bazel_6/upb-clang16.patch b/pkgs/development/tools/build-managers/bazel/bazel_6/upb-clang16.patch
new file mode 100644
index 000000000000..915585778384
--- /dev/null
+++ b/pkgs/development/tools/build-managers/bazel/bazel_6/upb-clang16.patch
@@ -0,0 +1,30 @@
+diff --git a/distdir_deps.bzl b/distdir_deps.bzl
+index c7fc4588e4..01e6966fca 100644
+--- a/distdir_deps.bzl
++++ b/distdir_deps.bzl
+@@ -192,6 +192,8@@ DIST_DEPS = {
+         "archive": "a5477045acaa34586420942098f5fecd3570f577.tar.gz",
+         "sha256": "cf7f71eaff90b24c1a28b49645a9ff03a9a6c1e7134291ce70901cb63e7364b5",
+         "strip_prefix": "upb-a5477045acaa34586420942098f5fecd3570f577",
++        "patches": ["//:upb-clang16.patch"],
++        "patch_args": ["-p1"],
+         "urls": [
+             "https://mirror.bazel.build/github.com/protocolbuffers/upb/archive/a5477045acaa34586420942098f5fecd3570f577.tar.gz",
+             "https://github.com/protocolbuffers/upb/archive/a5477045acaa34586420942098f5fecd3570f577.tar.gz",
+diff --git a/upb-clang16.patch b/upb-clang16.patch
+new file mode 100644
+index 0000000000..f81855181f
+--- /dev/null
++++ upb-clang16.patch
+@@ -0,0 +1,10 @@
++--- a/bazel/build_defs.bzl
+++++ b/bazel/build_defs.bzl
++@@ -43,6 +43,7 @@
++     "-Werror=pedantic",
++     "-Wall",
++     "-Wstrict-prototypes",
+++    "-Wno-gnu-offsetof-extensions",
++     # GCC (at least) emits spurious warnings for this that cannot be fixed
++     # without introducing redundant initialization (with runtime cost):
++     #   https://gcc.gnu.org/bugzilla/show_bug.cgi?id=80635
+
diff --git a/pkgs/development/tools/clj-kondo/default.nix b/pkgs/development/tools/clj-kondo/default.nix
index dc78761cc256..a60de4d83ea8 100644
--- a/pkgs/development/tools/clj-kondo/default.nix
+++ b/pkgs/development/tools/clj-kondo/default.nix
@@ -1,25 +1,34 @@
-{ lib, buildGraalvmNativeImage, fetchurl }:
+{ lib, buildGraalvmNativeImage, graalvmCEPackages, removeReferencesTo, fetchurl
+}:
 
 buildGraalvmNativeImage rec {
   pname = "clj-kondo";
   version = "2023.10.20";
 
   src = fetchurl {
-    url = "https://github.com/clj-kondo/${pname}/releases/download/v${version}/${pname}-${version}-standalone.jar";
+    url =
+      "https://github.com/clj-kondo/${pname}/releases/download/v${version}/${pname}-${version}-standalone.jar";
     sha256 = "sha256-f9u/pk3CEEmiLgnS2biaUHpsMHjVEwZL2jyB/1PiZUY=";
   };
 
-  extraNativeImageBuildArgs = [
-    "-H:+ReportExceptionStackTraces"
-    "--no-fallback"
-  ];
+  graalvmDrv = graalvmCEPackages.graalvm-ce;
+
+  nativeBuildInputs = [ removeReferencesTo ];
+
+  extraNativeImageBuildArgs =
+    [ "-H:+ReportExceptionStackTraces" "--no-fallback" ];
+
+  postInstall = ''
+    remove-references-to -t ${graalvmDrv} $out/bin/${pname}
+  '';
 
   meta = with lib; {
     description = "A linter for Clojure code that sparks joy";
     homepage = "https://github.com/clj-kondo/clj-kondo";
     sourceProvenance = with sourceTypes; [ binaryBytecode ];
     license = licenses.epl10;
-    changelog = "https://github.com/clj-kondo/clj-kondo/blob/v${version}/CHANGELOG.md";
+    changelog =
+      "https://github.com/clj-kondo/clj-kondo/blob/v${version}/CHANGELOG.md";
     maintainers = with maintainers; [ jlesquembre bandresen thiagokokada ];
   };
 }
diff --git a/pkgs/development/tools/misc/global/default.nix b/pkgs/development/tools/misc/global/default.nix
index ed0596fef8a0..e0e1ea0e606c 100644
--- a/pkgs/development/tools/misc/global/default.nix
+++ b/pkgs/development/tools/misc/global/default.nix
@@ -6,11 +6,11 @@ let
   pygments = python3Packages.pygments;
 in stdenv.mkDerivation rec {
   pname = "global";
-  version = "6.6.10";
+  version = "6.6.11";
 
   src = fetchurl {
     url = "mirror://gnu/global/${pname}-${version}.tar.gz";
-    hash = "sha256-LdHmqUXpPAE5D7lBpOaU9McbvXVp1kFJwE6Se79NzOg=";
+    hash = "sha256-BTMxn3jThguBZo366qUHkBVB5d2oz8MNUt/GzpSJ9eM=";
   };
 
   nativeBuildInputs = [ libtool makeWrapper ];
diff --git a/pkgs/development/tools/parsing/javacc/default.nix b/pkgs/development/tools/parsing/javacc/default.nix
index 0279ef8f89df..9af0b7374598 100644
--- a/pkgs/development/tools/parsing/javacc/default.nix
+++ b/pkgs/development/tools/parsing/javacc/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "javacc";
-  version = "7.0.12";
+  version = "7.0.13";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "${pname}-${version}";
-    sha256 = "sha256-tDtstF3ivKjG01vOZ8Ga1zTjIZFSTWt5QPY1VQvyFMU=";
+    sha256 = "sha256-nDJvKIbJc23Tvfn7Zqvt5tDDffNf4KQ0juGQQCZ+i1c=";
   };
 
   nativeBuildInputs = [ ant jdk makeWrapper ];
diff --git a/pkgs/development/web/protege-distribution/default.nix b/pkgs/development/web/protege-distribution/default.nix
index a6ef66d06950..3051c80f473b 100644
--- a/pkgs/development/web/protege-distribution/default.nix
+++ b/pkgs/development/web/protege-distribution/default.nix
@@ -1,19 +1,30 @@
-{ lib, stdenv, fetchurl, unzip, jre8
+{ lib
+, stdenv
+, fetchurl
+, unzip
+, jdk11
 , copyDesktopItems
-, makeDesktopItem
 , iconConvTools
+, makeDesktopItem
+, makeWrapper
 }:
 
 stdenv.mkDerivation rec {
   pname = "protege-distribution";
-  version = "5.5.0";
+  version = "5.6.3";
 
   src = fetchurl {
-    url = "https://github.com/protegeproject/protege-distribution/releases/download/v${version}/Protege-${version}-platform-independent.zip";
-    sha256 = "092x22wyisdnhccx817mqq15sxqdfc7iz4whr4mbvzrd9di6ipjq";
+    url = "https://github.com/protegeproject/protege-distribution/releases/download/protege-${version}/Protege-${version}-platform-independent.zip";
+    sha256 = "08pr0rn76wcc9bczdf93nlshxbid4z4nyvmaz198hhlq96aqpc3i";
   };
 
-  nativeBuildInputs = [ unzip copyDesktopItems iconConvTools ];
+  nativeBuildInputs = [
+    copyDesktopItems
+    iconConvTools
+    jdk11
+    makeWrapper
+    unzip
+  ];
 
   patches = [
     # Replace logic for searching the install directory with a static cd into $out
@@ -23,11 +34,8 @@ stdenv.mkDerivation rec {
   ];
 
   postPatch = ''
-    # Resolve @out@ (introduced by "static-path.patch") to $out, and set the
-    # correct Java executable (Protege is a JRE 8 application)
-    substituteInPlace run.sh \
-      --subst-var-by out $out \
-      --replace "java -X" "exec ${jre8.outPath}/bin/java -X"
+    # Resolve @out@ (introduced by "static-path.patch") to $out
+    substituteInPlace run.sh --subst-var-by out $out
   '';
 
   dontConfigure = true;
@@ -36,20 +44,18 @@ stdenv.mkDerivation rec {
   installPhase = ''
     runHook preInstall
 
-    mkdir $out
-
-    # Delete non-Linux launch scripts
-    rm run.{bat,command}
+    mkdir -p $out/bin
 
-    # Move launch script into /bin, giving it a recognizable name
-    install -D run.sh $out/bin/run-protege
+    # Wrap launch script to set $JAVA_HOME correctly
+    mv run.sh $out/bin/run-protege
+    wrapProgram  $out/bin/run-protege --set JAVA_HOME ${jdk11.home}
 
     # Generate and copy icons to where they can be found
     icoFileToHiColorTheme app/Protege.ico protege $out
 
     # Move everything else under protege/
     mkdir $out/protege
-    mv {bin,bundles,conf,plugins} $out/protege
+    mv {bundles,conf,plugins} $out/protege
 
     runHook postInstall
   '';
diff --git a/pkgs/os-specific/linux/kernel/README.md b/pkgs/os-specific/linux/kernel/README.md
new file mode 100644
index 000000000000..92d5308e1c05
--- /dev/null
+++ b/pkgs/os-specific/linux/kernel/README.md
@@ -0,0 +1,33 @@
+# How to add a new (major) version of the Linux kernel to Nixpkgs:
+
+1.  Copy the old Nix expression (e.g., `linux-2.6.21.nix`) to the new one (e.g., `linux-2.6.22.nix`) and update it.
+
+2.  Add the new kernel to the `kernels` attribute set in [`linux-kernels.nix`](./linux-kernels.nix) (e.g., create an attribute `kernel_2_6_22`).
+
+3.  Update the kernel configuration. First unpack the kernel. Then for each supported platform (`i686`, `x86_64`, `uml`) do the following:
+
+    1.  Make a copy from the old config (e.g., `config-2.6.21-i686-smp`) to the new one (e.g., `config-2.6.22-i686-smp`).
+
+    2.  Copy the config file for this platform (e.g., `config-2.6.22-i686-smp`) to `.config` in the kernel source tree.
+
+    3.  Run `make oldconfig ARCH={i386,x86_64,um}` and answer all questions. (For the uml configuration, also add `SHELL=bash`.) Make sure to keep the configuration consistent between platforms (i.e., don’t enable some feature on `i686` and disable it on `x86_64`).
+
+    4.  If needed, you can also run `make menuconfig`:
+
+        ```ShellSession
+        $ nix-env -f "<nixpkgs>" -iA ncurses
+        $ export NIX_CFLAGS_LINK=-lncurses
+        $ make menuconfig ARCH=arch
+        ```
+
+    5.  Copy `.config` over the new config file (e.g., `config-2.6.22-i686-smp`).
+
+4.  Test building the kernel:
+
+```ShellSession
+nix-build -A linuxKernel.kernels.kernel_2_6_22
+```
+
+If it compiles, ship it! For extra credit, try booting NixOS with it.
+
+5.  It may be that the new kernel requires updating the external kernel modules and kernel-dependent packages listed in the `linuxPackagesFor` function in `linux-kernels.nix` (such as the NVIDIA drivers, AUFS, etc.). If the updated packages aren’t backwards compatible with older kernels, you may need to keep the older versions around.
diff --git a/pkgs/servers/alice-lg/default.nix b/pkgs/servers/alice-lg/default.nix
index 5619928e4592..c81ca8f5c121 100644
--- a/pkgs/servers/alice-lg/default.nix
+++ b/pkgs/servers/alice-lg/default.nix
@@ -5,8 +5,9 @@
 , stdenv
 , yarn
 , nodejs
+, nixosTests
 , git
-, fixup_yarn_lock
+, prefetch-yarn-deps
 }:
 
 buildGoModule rec {
@@ -32,7 +33,7 @@ buildGoModule rec {
       hash = "sha256-NeK9IM8E2IH09SVH9lMlV3taCmqwlroo4xzmv4Q01jI=";
     };
 
-    nativeBuildInputs = [ nodejs yarn git ];
+    nativeBuildInputs = [ nodejs yarn git prefetch-yarn-deps ];
     configurePhase = ''
       runHook preConfigure
 
@@ -43,7 +44,7 @@ buildGoModule rec {
       yarn config --offline set yarn-offline-mirror $yarnOfflineCache
 
       # Fixup "resolved"-entries in yarn.lock to match our offline cache
-      ${fixup_yarn_lock}/bin/fixup_yarn_lock yarn.lock
+      fixup-yarn-lock yarn.lock
 
       yarn install --offline --frozen-lockfile --ignore-scripts --no-progress --non-interactive
       patchShebangs node_modules/
@@ -74,6 +75,8 @@ buildGoModule rec {
   subPackages = [ "cmd/alice-lg" ];
   doCheck = false;
 
+  passthru.tests = nixosTests.alice-lg;
+
   meta = with lib; {
     homepage = "https://github.com/alice-lg/alice-lg";
     description = "A looking-glass for BGP sessions";
diff --git a/pkgs/servers/geospatial/fit-trackee/default.nix b/pkgs/servers/geospatial/fit-trackee/default.nix
index c7bc7fbc2e5b..266747622db9 100644
--- a/pkgs/servers/geospatial/fit-trackee/default.nix
+++ b/pkgs/servers/geospatial/fit-trackee/default.nix
@@ -21,6 +21,15 @@ let
           "test/ext/mypy"
         ];
       });
+      flask-sqlalchemy = super.flask-sqlalchemy.overridePythonAttrs (oldAttrs: rec {
+        version = "3.0.5";
+
+        src = fetchPypi {
+          pname = "flask_sqlalchemy";
+          inherit version;
+          hash = "sha256-xXZeWMoUVAG1IQbA9GF4VpJDxdolVWviwjHsxghnxbE=";
+        };
+      });
     };
   };
 
diff --git a/pkgs/servers/home-assistant/stubs.nix b/pkgs/servers/home-assistant/stubs.nix
index b3652e734f19..b6d6d1517af8 100644
--- a/pkgs/servers/home-assistant/stubs.nix
+++ b/pkgs/servers/home-assistant/stubs.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "homeassistant-stubs";
-  version = "2023.11.2";
+  version = "2023.11.3";
   format = "pyproject";
 
   disabled = python.version != home-assistant.python.version;
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "KapJI";
     repo = "homeassistant-stubs";
     rev = "refs/tags/${version}";
-    hash = "sha256-stVfFXb5QfC+wZUSk53+jt/hb8kO1gCcgeOnHHpNlWE=";
+    hash = "sha256-x3FcUmbUYAUKGAPb85SqJk1kTWFKxpJSX2J+rTRj1KY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/servers/mastodon/default.nix b/pkgs/servers/mastodon/default.nix
index 0fa099881d96..ac4083fd9be7 100644
--- a/pkgs/servers/mastodon/default.nix
+++ b/pkgs/servers/mastodon/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, nodejs-slim, bundlerEnv, nixosTests
 , yarn, callPackage, imagemagick, ffmpeg, file, ruby, writeShellScript
-, fetchYarnDeps, fixup_yarn_lock
+, fetchYarnDeps, prefetch-yarn-deps
 , brotli
 
   # Allow building a fork or custom version of Mastodon:
@@ -45,7 +45,7 @@ stdenv.mkDerivation rec {
       hash = yarnHash;
     };
 
-    nativeBuildInputs = [ fixup_yarn_lock nodejs-slim yarn mastodonGems mastodonGems.wrappedRuby brotli ];
+    nativeBuildInputs = [ prefetch-yarn-deps nodejs-slim yarn mastodonGems mastodonGems.wrappedRuby brotli ];
 
     RAILS_ENV = "production";
     NODE_ENV = "production";
@@ -57,7 +57,7 @@ stdenv.mkDerivation rec {
       # This option is needed for openssl-3 compatibility
       # Otherwise we encounter this upstream issue: https://github.com/mastodon/mastodon/issues/17924
       export NODE_OPTIONS=--openssl-legacy-provider
-      fixup_yarn_lock ~/yarn.lock
+      fixup-yarn-lock ~/yarn.lock
       yarn config --offline set yarn-offline-mirror $yarnOfflineCache
       yarn install --offline --frozen-lockfile --ignore-engines --ignore-scripts --no-progress
 
diff --git a/pkgs/servers/monitoring/grafana-agent/default.nix b/pkgs/servers/monitoring/grafana-agent/default.nix
index a970b998065a..773039962aa3 100644
--- a/pkgs/servers/monitoring/grafana-agent/default.nix
+++ b/pkgs/servers/monitoring/grafana-agent/default.nix
@@ -14,21 +14,21 @@
 
 buildGoModule rec {
   pname = "grafana-agent";
-  version = "0.37.4";
+  version = "0.38.0";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = "agent";
     rev = "v${version}";
-    hash = "sha256-wR5Xexebe6LB15hKQwFtVjyTZPFmvuyozji9BmxuZ/g=";
+    hash = "sha256-lXjtKZJNkYffizNiX+rrRVu94mr+WXnsKKpEaLdd2Rs=";
   };
 
-  vendorHash = "sha256-emtSRn/xT9RSEdGrkfaa+IuP5yF+tVLP1j+bzOoNHXg=";
+  vendorHash = "sha256-+6ReDdjCHED8kYVt7WSUFT+Gsmg+AIyS3oIfj2kTCGo=";
   proxyVendor = true; # darwin/linux hash mismatch
 
   frontendYarnOfflineCache = fetchYarnDeps {
     yarnLock = src + "/web/ui/yarn.lock";
-    hash = "sha256-sUFxuliLupGEJY1xFA2V4W2gwHxtUgst3Vrywh1owAo=";
+    hash = "sha256-rT0UCInISo/p60xzQC7wAJFuKFByIzhNf0RxFFJx+3k=";
   };
 
   ldflags = let
diff --git a/pkgs/servers/monitoring/mimir/default.nix b/pkgs/servers/monitoring/mimir/default.nix
index b54888cad96b..b52ca5a2f1c2 100644
--- a/pkgs/servers/monitoring/mimir/default.nix
+++ b/pkgs/servers/monitoring/mimir/default.nix
@@ -1,13 +1,13 @@
 { lib, buildGoModule, fetchFromGitHub, nixosTests, nix-update-script }:
 buildGoModule rec {
   pname = "mimir";
-  version = "2.10.3";
+  version = "2.10.4";
 
   src = fetchFromGitHub {
     rev = "${pname}-${version}";
     owner = "grafana";
     repo = pname;
-    hash = "sha256-tVJcvxKcxhSeYyqBsBeG+OrWoD+hTDAoPuIXB72MMkY=";
+    hash = "sha256-0OFuMWoYgo8qCxWk93wOy45diLb2JIBsoxptLKTeOC4=";
   };
 
   vendorHash = null;
diff --git a/pkgs/servers/monitoring/riemann/default.nix b/pkgs/servers/monitoring/riemann/default.nix
index 1b3a206dd6dc..0736228645dd 100644
--- a/pkgs/servers/monitoring/riemann/default.nix
+++ b/pkgs/servers/monitoring/riemann/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "riemann";
-  version = "0.3.9";
+  version = "0.3.10";
 
   src = fetchurl {
     url = "https://github.com/riemann/riemann/releases/download/${version}/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-w3Uv+RMHhw1/G0wkygfLbazeinZqrbxVL4NFmy1/RgQ=";
+    sha256 = "sha256-dkIdx+9Rq3paDGHKuwO6RsrQ1u2mvRnncEyOIHqOBRM=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/servers/sql/postgresql/ext/postgis.nix b/pkgs/servers/sql/postgresql/ext/postgis.nix
index 583bde82f481..67f7b520b898 100644
--- a/pkgs/servers/sql/postgresql/ext/postgis.nix
+++ b/pkgs/servers/sql/postgresql/ext/postgis.nix
@@ -16,13 +16,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "postgis";
-  version = "3.4.0";
+  version = "3.4.1";
 
   outputs = [ "out" "doc" ];
 
   src = fetchurl {
     url = "https://download.osgeo.org/postgis/source/postgis-${version}.tar.gz";
-    sha256 = "sha256-rum2CmyITTVBZLMJbEZX8yRFQYZgf4WdHOBdiZeYr50=";
+    sha256 = "sha256-/vahQSE9D/J79FszuEnMOWwi3bH/xv7UNUacnokfyB0=";
   };
 
   buildInputs = [ libxml2 postgresql geos proj gdal json_c protobufc pcre2.dev ]
diff --git a/pkgs/servers/teleport/generic.nix b/pkgs/servers/teleport/generic.nix
index f98e01de5152..d8b630d1a5f3 100644
--- a/pkgs/servers/teleport/generic.nix
+++ b/pkgs/servers/teleport/generic.nix
@@ -14,7 +14,7 @@
 , stdenv
 , xdg-utils
 , yarn
-, yarn2nix-moretea
+, prefetch-yarn-deps
 , nixosTests
 
 , withRdpClient ? true
@@ -72,7 +72,7 @@ let
     nativeBuildInputs = [
       nodejs
       yarn
-      yarn2nix-moretea.fixup_yarn_lock
+      prefetch-yarn-deps
     ];
 
     configurePhase = ''
@@ -81,7 +81,7 @@ let
 
     buildPhase = ''
       yarn config --offline set yarn-offline-mirror ${yarnOfflineCache}
-      fixup_yarn_lock yarn.lock
+      fixup-yarn-lock yarn.lock
 
       yarn install --offline \
         --frozen-lockfile \
diff --git a/pkgs/shells/nix-your-shell/default.nix b/pkgs/shells/nix-your-shell/default.nix
index 8b2c36daf127..8a3e22544034 100644
--- a/pkgs/shells/nix-your-shell/default.nix
+++ b/pkgs/shells/nix-your-shell/default.nix
@@ -5,16 +5,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "nix-your-shell";
-  version = "1.3.0";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "MercuryTechnologies";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-5zHjz0NOKcZCuR6QaLrwOXih3Xoqf2uBrJnxTX/TQok=";
+    hash = "sha256-2fS91/qeZt4JwQQeA+26RTN6zdm8/HUxG8sJDobX0+0=";
   };
 
-  cargoSha256 = "sha256-4Z/z4VgnJQd8Uc0tMDnx7sChzXtG5ZDL88jTlhPSonM=";
+  cargoHash = "sha256-e7gxNaKP0n+Zx0KaQEfNA3QsS5HZ2KIB6HJ22Ve8+EA=";
 
   meta = with lib; {
     mainProgram = "nix-your-shell";
diff --git a/pkgs/tools/X11/xidlehook/default.nix b/pkgs/tools/X11/xidlehook/default.nix
index bb86014257b8..c23acbedafdf 100644
--- a/pkgs/tools/X11/xidlehook/default.nix
+++ b/pkgs/tools/X11/xidlehook/default.nix
@@ -44,5 +44,6 @@ rustPlatform.buildRustPackage rec {
     maintainers = with maintainers; [ ];
     platforms = platforms.unix;
     badPlatforms = platforms.darwin;
+    mainProgram = "xidlehook";
   };
 }
diff --git a/pkgs/tools/admin/awscli2/default.nix b/pkgs/tools/admin/awscli2/default.nix
index b59f702701f7..5582f63ffc0c 100644
--- a/pkgs/tools/admin/awscli2/default.nix
+++ b/pkgs/tools/admin/awscli2/default.nix
@@ -19,10 +19,14 @@ let
           hash = "sha256-i3zml6LyEnUqNcGsQURx3BbEJMlXO+SSa1b/P10jt68=";
         };
       });
-      urllib3 = prev.urllib3.overridePythonAttrs (prev: {
-        format = "setuptools";
+      urllib3 = prev.urllib3.overridePythonAttrs (prev: rec {
+        pyproject = true;
+        version = "1.26.18";
+        nativeBuildInputs = with final; [
+          setuptools
+        ];
         src = prev.src.override {
-          version = "1.26.18";
+          inherit version;
           hash = "sha256-+OzBu6VmdBNFfFKauVW/jGe0XbeZ0VkGYmFxnjKFgKA=";
         };
       });
diff --git a/pkgs/tools/audio/asap/default.nix b/pkgs/tools/audio/asap/default.nix
index c4a9b03039c5..ccdb5ed93039 100644
--- a/pkgs/tools/audio/asap/default.nix
+++ b/pkgs/tools/audio/asap/default.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "asap";
-  version = "6.0.0";
+  version = "6.0.1";
 
   src = fetchzip {
     url = "mirror://sourceforge/project/asap/asap/${version}/asap-${version}.tar.gz";
-    sha256 = "sha256-j7vznFI/Yg1yuRvYDmRSyHDfDN7iFV+b6MK2jdnaz6Q=";
+    sha256 = "sha256-nTnnRDYOkTmXfXPS1XIHaC2LHFfZz+gVInQ3satuyDM=";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/tools/backup/awsbck/default.nix b/pkgs/tools/backup/awsbck/default.nix
index d8d54dad392d..3b2bf517a404 100644
--- a/pkgs/tools/backup/awsbck/default.nix
+++ b/pkgs/tools/backup/awsbck/default.nix
@@ -30,5 +30,6 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/beeb/awsbck";
     license = with licenses; [ mit asl20 ];
     maintainers = with maintainers; [ beeb ];
+    mainProgram = "awsbck";
   };
 }
diff --git a/pkgs/tools/backup/bdsync/default.nix b/pkgs/tools/backup/bdsync/default.nix
index bf3afacb9496..8018a1b7cfdf 100644
--- a/pkgs/tools/backup/bdsync/default.nix
+++ b/pkgs/tools/backup/bdsync/default.nix
@@ -36,5 +36,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2;
     platforms = platforms.linux;
     maintainers = with maintainers; [ jluttine ];
+    mainProgram = "bdsync";
   };
 }
diff --git a/pkgs/tools/backup/conserve/default.nix b/pkgs/tools/backup/conserve/default.nix
index 345bd06e23c0..8b6e7e072226 100644
--- a/pkgs/tools/backup/conserve/default.nix
+++ b/pkgs/tools/backup/conserve/default.nix
@@ -21,5 +21,6 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/sourcefrog/conserve";
     license = licenses.gpl2Only;
     maintainers = with maintainers; [ happysalada ];
+    mainProgram = "conserve";
   };
 }
diff --git a/pkgs/tools/cd-dvd/bchunk/default.nix b/pkgs/tools/cd-dvd/bchunk/default.nix
index df8ca279107e..a3677b984818 100644
--- a/pkgs/tools/cd-dvd/bchunk/default.nix
+++ b/pkgs/tools/cd-dvd/bchunk/default.nix
@@ -21,5 +21,6 @@ stdenv.mkDerivation rec {
     description = "A program that converts CD images in BIN/CUE format into a set of ISO and CDR tracks";
     platforms = platforms.unix;
     license = licenses.gpl2;
+    mainProgram = "bchunk";
   };
 }
diff --git a/pkgs/tools/cd-dvd/bootiso/default.nix b/pkgs/tools/cd-dvd/bootiso/default.nix
index ee5d4fd8456f..243989d04948 100644
--- a/pkgs/tools/cd-dvd/bootiso/default.nix
+++ b/pkgs/tools/cd-dvd/bootiso/default.nix
@@ -56,5 +56,6 @@ stdenvNoCC.mkDerivation rec {
     license = licenses.gpl3;
     maintainers = with maintainers; [ muscaln ];
     platforms = platforms.all;
+    mainProgram = "bootiso";
   };
 }
diff --git a/pkgs/tools/cd-dvd/brasero/default.nix b/pkgs/tools/cd-dvd/brasero/default.nix
index decd4352ad45..fb57e2d7decb 100644
--- a/pkgs/tools/cd-dvd/brasero/default.nix
+++ b/pkgs/tools/cd-dvd/brasero/default.nix
@@ -45,5 +45,6 @@ in stdenv.mkDerivation rec {
     maintainers = [ maintainers.bdimcheff ];
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
+    mainProgram = "brasero";
   };
 }
diff --git a/pkgs/tools/cd-dvd/ccd2iso/default.nix b/pkgs/tools/cd-dvd/ccd2iso/default.nix
index 1fe606e6acc2..4885b16aa065 100644
--- a/pkgs/tools/cd-dvd/ccd2iso/default.nix
+++ b/pkgs/tools/cd-dvd/ccd2iso/default.nix
@@ -15,5 +15,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2;
     maintainers = with maintainers; [ yana ];
     platforms = platforms.unix;
+    mainProgram = "ccd2iso";
   };
 }
diff --git a/pkgs/tools/cd-dvd/cdi2iso/default.nix b/pkgs/tools/cd-dvd/cdi2iso/default.nix
index 26768747a46c..f6d0b4e1175f 100644
--- a/pkgs/tools/cd-dvd/cdi2iso/default.nix
+++ b/pkgs/tools/cd-dvd/cdi2iso/default.nix
@@ -24,5 +24,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2;
     maintainers = with maintainers; [ hrdinka ];
     platforms = platforms.all;
+    mainProgram = "cdi2iso";
   };
 }
diff --git a/pkgs/tools/cd-dvd/cue2pops/default.nix b/pkgs/tools/cd-dvd/cue2pops/default.nix
index 795589a64ec2..6cb93b3e04be 100644
--- a/pkgs/tools/cd-dvd/cue2pops/default.nix
+++ b/pkgs/tools/cd-dvd/cue2pops/default.nix
@@ -28,5 +28,6 @@ stdenv.mkDerivation {
     homepage = "https://github.com/makefu/cue2pops-linux";
     maintainers = with maintainers; [ AndersonTorres ];
     platforms = platforms.all;
+    mainProgram = "cue2pops";
   };
 }
diff --git a/pkgs/tools/cd-dvd/dvd-vr/default.nix b/pkgs/tools/cd-dvd/dvd-vr/default.nix
index 4375aebe2990..88703b28b582 100644
--- a/pkgs/tools/cd-dvd/dvd-vr/default.nix
+++ b/pkgs/tools/cd-dvd/dvd-vr/default.nix
@@ -15,6 +15,7 @@ stdenv.mkDerivation rec {
     description = "A utility to identify and optionally copy recordings from a DVD-VR format disc";
     license = licenses.gpl2;
     maintainers = with maintainers; [ fgaz ];
+    mainProgram = "dvd-vr";
   };
 }
 
diff --git a/pkgs/tools/cd-dvd/dvdisaster/default.nix b/pkgs/tools/cd-dvd/dvdisaster/default.nix
index 55e0e51e5f44..abbda3512e5f 100644
--- a/pkgs/tools/cd-dvd/dvdisaster/default.nix
+++ b/pkgs/tools/cd-dvd/dvdisaster/default.nix
@@ -93,5 +93,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl3Plus;
     platforms = platforms.linux;
     maintainers = with maintainers; [ ];
+    mainProgram = "dvdisaster";
   };
 }
diff --git a/pkgs/tools/cd-dvd/iat/default.nix b/pkgs/tools/cd-dvd/iat/default.nix
index 083ff35acd78..0f7a1ad442a7 100644
--- a/pkgs/tools/cd-dvd/iat/default.nix
+++ b/pkgs/tools/cd-dvd/iat/default.nix
@@ -18,5 +18,6 @@ stdenv.mkDerivation (finalAttr: {
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ hughobrien ];
     platforms = platforms.linux;
+    mainProgram = "iat";
   };
 })
diff --git a/pkgs/tools/cd-dvd/isolyzer/default.nix b/pkgs/tools/cd-dvd/isolyzer/default.nix
index f13a17e01f79..6f231430fa86 100644
--- a/pkgs/tools/cd-dvd/isolyzer/default.nix
+++ b/pkgs/tools/cd-dvd/isolyzer/default.nix
@@ -21,5 +21,6 @@ python3.pkgs.buildPythonApplication rec {
     description = "Verify size of ISO 9660 image against Volume Descriptor fields";
     license = licenses.asl20;
     maintainers = with maintainers; [ mkg20001 ];
+    mainProgram = "isolyzer";
   };
 }
diff --git a/pkgs/tools/cd-dvd/lsdvd/default.nix b/pkgs/tools/cd-dvd/lsdvd/default.nix
index 59e8bf8843a4..3fd116faea5b 100644
--- a/pkgs/tools/cd-dvd/lsdvd/default.nix
+++ b/pkgs/tools/cd-dvd/lsdvd/default.nix
@@ -16,5 +16,6 @@ stdenv.mkDerivation rec {
     description = "Display information about audio, video, and subtitle tracks on a DVD";
     license = licenses.gpl2;
     platforms = platforms.linux;
+    mainProgram = "lsdvd";
   };
 }
diff --git a/pkgs/tools/cd-dvd/mdf2iso/default.nix b/pkgs/tools/cd-dvd/mdf2iso/default.nix
index e737e38d1bd6..b5fcc557b4e1 100644
--- a/pkgs/tools/cd-dvd/mdf2iso/default.nix
+++ b/pkgs/tools/cd-dvd/mdf2iso/default.nix
@@ -16,5 +16,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2;
     platforms = platforms.unix;
     maintainers = [ maintainers.oxij ];
+    mainProgram = "mdf2iso";
   };
 }
diff --git a/pkgs/tools/cd-dvd/mkcue/default.nix b/pkgs/tools/cd-dvd/mkcue/default.nix
index 596164f13ffa..575adecbd521 100644
--- a/pkgs/tools/cd-dvd/mkcue/default.nix
+++ b/pkgs/tools/cd-dvd/mkcue/default.nix
@@ -17,5 +17,6 @@ stdenv.mkDerivation rec {
     license = licenses.lgpl2Plus;
     platforms = platforms.linux;
     maintainers = with maintainers; [ pSub ];
+    mainProgram = "mkcue";
   };
 }
diff --git a/pkgs/tools/cd-dvd/nrg2iso/default.nix b/pkgs/tools/cd-dvd/nrg2iso/default.nix
index fdde54b596f1..8807466d05a6 100644
--- a/pkgs/tools/cd-dvd/nrg2iso/default.nix
+++ b/pkgs/tools/cd-dvd/nrg2iso/default.nix
@@ -21,5 +21,6 @@ stdenv.mkDerivation rec {
     homepage = "http://gregory.kokanosky.free.fr/v4/linux/nrg2iso.en.html";
     license = licenses.gpl2;
     platforms = platforms.all;
+    mainProgram = "nrg2iso";
   };
 }
diff --git a/pkgs/tools/cd-dvd/sacd/default.nix b/pkgs/tools/cd-dvd/sacd/default.nix
index 948c51428402..c24a5e7c15c7 100644
--- a/pkgs/tools/cd-dvd/sacd/default.nix
+++ b/pkgs/tools/cd-dvd/sacd/default.nix
@@ -39,5 +39,6 @@ stdenv.mkDerivation (finalAttrs: {
     license = licenses.gpl3;
     maintainers = [ maintainers.doronbehar ];
     platforms = [ "x86_64-linux" ];
+    mainProgram = "sacd";
   };
 })
diff --git a/pkgs/tools/cd-dvd/srt-to-vtt-cl/default.nix b/pkgs/tools/cd-dvd/srt-to-vtt-cl/default.nix
index 80e456d072ce..b0868c885edd 100644
--- a/pkgs/tools/cd-dvd/srt-to-vtt-cl/default.nix
+++ b/pkgs/tools/cd-dvd/srt-to-vtt-cl/default.nix
@@ -27,5 +27,6 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ ericdallo ];
     homepage = "https://github.com/nwoltman/srt-to-vtt-cl";
     platforms = platforms.unix;
+    mainProgram = "srt-vtt";
   };
 }
diff --git a/pkgs/tools/cd-dvd/uif2iso/default.nix b/pkgs/tools/cd-dvd/uif2iso/default.nix
index 7a8a6569e533..ae1eff26568f 100644
--- a/pkgs/tools/cd-dvd/uif2iso/default.nix
+++ b/pkgs/tools/cd-dvd/uif2iso/default.nix
@@ -21,5 +21,6 @@ stdenv.mkDerivation rec {
     homepage = "http://aluigi.org/mytoolz.htm#uif2iso";
     license = lib.licenses.gpl1Plus;
     platforms = lib.platforms.linux;
+    mainProgram = "uif2iso";
   };
 }
diff --git a/pkgs/tools/cd-dvd/unetbootin/default.nix b/pkgs/tools/cd-dvd/unetbootin/default.nix
index 88fab512b0b8..fb12968aa728 100644
--- a/pkgs/tools/cd-dvd/unetbootin/default.nix
+++ b/pkgs/tools/cd-dvd/unetbootin/default.nix
@@ -80,5 +80,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ ebzzry ];
     platforms = platforms.linux;
+    mainProgram = "unetbootin";
   };
 }
diff --git a/pkgs/tools/cd-dvd/vobcopy/default.nix b/pkgs/tools/cd-dvd/vobcopy/default.nix
index 2ebe9e5e0a35..dbe192e039bd 100644
--- a/pkgs/tools/cd-dvd/vobcopy/default.nix
+++ b/pkgs/tools/cd-dvd/vobcopy/default.nix
@@ -19,5 +19,6 @@ stdenv.mkDerivation rec {
 
     maintainers = [ lib.maintainers.bluescreen303 ];
     platforms = lib.platforms.all;
+    mainProgram = "vobcopy";
   };
 }
diff --git a/pkgs/tools/cd-dvd/vobsub2srt/default.nix b/pkgs/tools/cd-dvd/vobsub2srt/default.nix
index d56cfdf86c8e..2847c68899fe 100644
--- a/pkgs/tools/cd-dvd/vobsub2srt/default.nix
+++ b/pkgs/tools/cd-dvd/vobsub2srt/default.nix
@@ -23,5 +23,6 @@ stdenv.mkDerivation rec {
     license = lib.licenses.gpl3Plus;
     platforms = lib.platforms.unix;
     maintainers = [ lib.maintainers.ttuegel ];
+    mainProgram = "vobsub2srt";
   };
 }
diff --git a/pkgs/tools/compression/brotli/default.nix b/pkgs/tools/compression/brotli/default.nix
index 263478e4ba3c..60429f435ec6 100644
--- a/pkgs/tools/compression/brotli/default.nix
+++ b/pkgs/tools/compression/brotli/default.nix
@@ -73,5 +73,6 @@ stdenv.mkDerivation (finalAttrs: {
       "libbrotlienc"
     ];
     platforms = platforms.all;
+    mainProgram = "brotli";
   };
 })
diff --git a/pkgs/tools/compression/bsc/default.nix b/pkgs/tools/compression/bsc/default.nix
index 93b715f853cf..7d2af1c4898f 100644
--- a/pkgs/tools/compression/bsc/default.nix
+++ b/pkgs/tools/compression/bsc/default.nix
@@ -29,5 +29,6 @@ stdenv.mkDerivation rec {
     # Later commits changed the licence to Apache2 (no release yet, though)
     license = with licenses; [ lgpl3Plus ];
     platforms = platforms.unix;
+    mainProgram = "bsc";
   };
 }
diff --git a/pkgs/tools/compression/crabz/default.nix b/pkgs/tools/compression/crabz/default.nix
index b68d3af1a844..f8cb155f272e 100644
--- a/pkgs/tools/compression/crabz/default.nix
+++ b/pkgs/tools/compression/crabz/default.nix
@@ -25,5 +25,6 @@ rustPlatform.buildRustPackage rec {
     changelog = "https://github.com/sstadick/crabz/blob/v${version}/CHANGELOG.md";
     license = with licenses; [ unlicense /* or */ mit ];
     maintainers = with maintainers; [ figsoda ];
+    mainProgram = "crabz";
   };
 }
diff --git a/pkgs/tools/compression/dejsonlz4/default.nix b/pkgs/tools/compression/dejsonlz4/default.nix
index 0dd703035fa9..51c5d485cfa9 100644
--- a/pkgs/tools/compression/dejsonlz4/default.nix
+++ b/pkgs/tools/compression/dejsonlz4/default.nix
@@ -26,5 +26,6 @@ stdenv.mkDerivation rec {
     license = licenses.bsd2;
     maintainers = with maintainers; [ mt-caret ];
     platforms = platforms.all;
+    mainProgram = "dejsonlz4";
   };
 }
diff --git a/pkgs/tools/compression/dtrx/default.nix b/pkgs/tools/compression/dtrx/default.nix
index 2bfe975d033c..9890112171d8 100644
--- a/pkgs/tools/compression/dtrx/default.nix
+++ b/pkgs/tools/compression/dtrx/default.nix
@@ -51,5 +51,6 @@ python3Packages.buildPythonApplication rec {
     homepage = "https://github.com/dtrx-py/dtrx";
     license = licenses.gpl3Plus;
     maintainers = [ ];
+    mainProgram = "dtrx";
   };
 }
diff --git a/pkgs/tools/compression/efficient-compression-tool/default.nix b/pkgs/tools/compression/efficient-compression-tool/default.nix
index 6a9615601276..17c1bfcbcf2b 100644
--- a/pkgs/tools/compression/efficient-compression-tool/default.nix
+++ b/pkgs/tools/compression/efficient-compression-tool/default.nix
@@ -35,5 +35,6 @@ stdenv.mkDerivation rec {
     license = licenses.asl20;
     maintainers = [ maintainers.lunik1 ];
     platforms = platforms.linux;
+    mainProgram = "ect";
   };
 }
diff --git a/pkgs/tools/compression/flips/default.nix b/pkgs/tools/compression/flips/default.nix
index 4ba618556a70..6ee1c03cabce 100644
--- a/pkgs/tools/compression/flips/default.nix
+++ b/pkgs/tools/compression/flips/default.nix
@@ -27,5 +27,6 @@ stdenv.mkDerivation {
     license = licenses.gpl3Plus;
     maintainers = [ maintainers.xfix ];
     platforms = platforms.linux;
+    mainProgram = "flips";
   };
 }
diff --git a/pkgs/tools/compression/hacpack/default.nix b/pkgs/tools/compression/hacpack/default.nix
index 34722d52ccfd..8d44660898cf 100644
--- a/pkgs/tools/compression/hacpack/default.nix
+++ b/pkgs/tools/compression/hacpack/default.nix
@@ -29,5 +29,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2Only;
     maintainers = [ maintainers.ivar ];
     platforms = platforms.linux;
+    mainProgram = "hacpack";
   };
 }
diff --git a/pkgs/tools/compression/hactool/default.nix b/pkgs/tools/compression/hactool/default.nix
index 2e6e7437fff2..11adbe3ced1b 100644
--- a/pkgs/tools/compression/hactool/default.nix
+++ b/pkgs/tools/compression/hactool/default.nix
@@ -31,5 +31,6 @@ stdenv.mkDerivation rec {
     license = licenses.isc;
     maintainers = with maintainers; [ ivar ];
     platforms = platforms.unix;
+    mainProgram = "hactool";
   };
 }
diff --git a/pkgs/tools/compression/heatshrink/default.nix b/pkgs/tools/compression/heatshrink/default.nix
index 290e2dc9d8ca..49ef7354cbc9 100644
--- a/pkgs/tools/compression/heatshrink/default.nix
+++ b/pkgs/tools/compression/heatshrink/default.nix
@@ -39,5 +39,6 @@ stdenv.mkDerivation rec {
     license = licenses.isc;
     maintainers = with maintainers; [ fgaz ];
     platforms = platforms.all;
+    mainProgram = "heatshrink";
   };
 }
diff --git a/pkgs/tools/compression/imagelol/default.nix b/pkgs/tools/compression/imagelol/default.nix
index 857de32ad886..950b12826b33 100644
--- a/pkgs/tools/compression/imagelol/default.nix
+++ b/pkgs/tools/compression/imagelol/default.nix
@@ -54,5 +54,6 @@ stdenv.mkDerivation rec {
     license = licenses.mit;
     maintainers = [ maintainers.ivar ];
     platforms = platforms.unix;
+    mainProgram = "ImageLOL";
   };
 }
diff --git a/pkgs/tools/compression/lzbench/default.nix b/pkgs/tools/compression/lzbench/default.nix
index 93ccc67f7d14..c35f738b2bde 100644
--- a/pkgs/tools/compression/lzbench/default.nix
+++ b/pkgs/tools/compression/lzbench/default.nix
@@ -23,5 +23,6 @@ stdenv.mkDerivation rec {
     description = "In-memory benchmark of open-source LZ77/LZSS/LZMA compressors";
     license = licenses.free;
     platforms = platforms.all;
+    mainProgram = "lzbench";
   };
 }
diff --git a/pkgs/tools/compression/lzfse/default.nix b/pkgs/tools/compression/lzfse/default.nix
index 13764971bb51..e5f104a9aef2 100644
--- a/pkgs/tools/compression/lzfse/default.nix
+++ b/pkgs/tools/compression/lzfse/default.nix
@@ -24,5 +24,6 @@ stdenv.mkDerivation rec {
     platforms = platforms.unix;
     license = licenses.bsd3;
     maintainers = with maintainers; [ ];
+    mainProgram = "lzfse";
   };
 }
diff --git a/pkgs/tools/compression/lzip/default.nix b/pkgs/tools/compression/lzip/default.nix
index b41b3c843da6..526e3f8c12fc 100644
--- a/pkgs/tools/compression/lzip/default.nix
+++ b/pkgs/tools/compression/lzip/default.nix
@@ -33,5 +33,6 @@ stdenv.mkDerivation rec {
     license = lib.licenses.gpl2Plus;
     maintainers = with maintainers; [ vlaci ];
     platforms = lib.platforms.all;
+    mainProgram = "lzip";
   };
 }
diff --git a/pkgs/tools/compression/lziprecover/default.nix b/pkgs/tools/compression/lziprecover/default.nix
index 38840a07092d..38051d8efbad 100644
--- a/pkgs/tools/compression/lziprecover/default.nix
+++ b/pkgs/tools/compression/lziprecover/default.nix
@@ -27,5 +27,6 @@ stdenv.mkDerivation rec {
     license = lib.licenses.gpl2Plus;
     maintainers = with maintainers; [ vlaci ];
     platforms = lib.platforms.all;
+    mainProgram = "lziprecover";
   };
 }
diff --git a/pkgs/tools/compression/lzop/default.nix b/pkgs/tools/compression/lzop/default.nix
index 8bf58d9cc356..64061647667a 100644
--- a/pkgs/tools/compression/lzop/default.nix
+++ b/pkgs/tools/compression/lzop/default.nix
@@ -17,5 +17,6 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ ];
     license = licenses.gpl2;
     platforms = platforms.unix;
+    mainProgram = "lzop";
   };
 }
diff --git a/pkgs/tools/compression/mozlz4a/default.nix b/pkgs/tools/compression/mozlz4a/default.nix
index 834b7698cf85..a9ab74bc7a59 100644
--- a/pkgs/tools/compression/mozlz4a/default.nix
+++ b/pkgs/tools/compression/mozlz4a/default.nix
@@ -34,5 +34,6 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ kira-bruneau pshirshov raskin ];
     platforms = python3.meta.platforms;
     homepage = "https://gist.github.com/Tblue/62ff47bef7f894e92ed5";
+    mainProgram = "mozlz4a";
   };
 }
diff --git a/pkgs/tools/compression/nx2elf/default.nix b/pkgs/tools/compression/nx2elf/default.nix
index d4963487ada1..a068788dc1d8 100644
--- a/pkgs/tools/compression/nx2elf/default.nix
+++ b/pkgs/tools/compression/nx2elf/default.nix
@@ -29,5 +29,6 @@ stdenv.mkDerivation rec {
     license = licenses.unfree; # No license specified upstream
     platforms = [ "x86_64-linux" ]; # Should work on Darwin as well, but this is untested. aarch64-linux fails.
     maintainers = [ maintainers.ivar ];
+    mainProgram = "nx2elf";
   };
 }
diff --git a/pkgs/tools/compression/offzip/default.nix b/pkgs/tools/compression/offzip/default.nix
index cc79d29a91d9..e756d4257264 100644
--- a/pkgs/tools/compression/offzip/default.nix
+++ b/pkgs/tools/compression/offzip/default.nix
@@ -28,5 +28,6 @@ stdenv.mkDerivation rec {
     license = lib.licenses.gpl2Plus;
     maintainers = with maintainers; [ r-burns ];
     platforms = platforms.unix;
+    mainProgram = "offzip";
   };
 }
diff --git a/pkgs/tools/compression/orz/default.nix b/pkgs/tools/compression/orz/default.nix
index a0c9a4653ca5..b760b0132ef7 100644
--- a/pkgs/tools/compression/orz/default.nix
+++ b/pkgs/tools/compression/orz/default.nix
@@ -35,5 +35,6 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/richox/orz";
     license = licenses.mit;
     maintainers = with maintainers; [ figsoda ];
+    mainProgram = "orz";
   };
 }
diff --git a/pkgs/tools/compression/ouch/default.nix b/pkgs/tools/compression/ouch/default.nix
index 2c645bf56ebf..b2e4bafc3af1 100644
--- a/pkgs/tools/compression/ouch/default.nix
+++ b/pkgs/tools/compression/ouch/default.nix
@@ -41,5 +41,6 @@ rustPlatform.buildRustPackage rec {
     changelog = "https://github.com/ouch-org/ouch/blob/${version}/CHANGELOG.md";
     license = licenses.mit;
     maintainers = with maintainers; [ figsoda psibi ];
+    mainProgram = "ouch";
   };
 }
diff --git a/pkgs/tools/compression/pbzx/default.nix b/pkgs/tools/compression/pbzx/default.nix
index 03b984bb6435..44555cd6ddbc 100644
--- a/pkgs/tools/compression/pbzx/default.nix
+++ b/pkgs/tools/compression/pbzx/default.nix
@@ -22,5 +22,6 @@ stdenv.mkDerivation rec {
     platforms = platforms.unix;
     license = licenses.gpl3;
     maintainers = [ maintainers.matthewbauer ];
+    mainProgram = "pbzx";
   };
 }
diff --git a/pkgs/tools/compression/pixz/default.nix b/pkgs/tools/compression/pixz/default.nix
index a8463f8abc4e..9eb1d6539cdf 100644
--- a/pkgs/tools/compression/pixz/default.nix
+++ b/pkgs/tools/compression/pixz/default.nix
@@ -47,5 +47,6 @@ stdenv.mkDerivation rec {
     license = licenses.bsd2;
     maintainers = [ maintainers.raskin ];
     platforms = platforms.unix;
+    mainProgram = "pixz";
   };
 }
diff --git a/pkgs/tools/compression/plzip/default.nix b/pkgs/tools/compression/plzip/default.nix
index f8af3a26c8e1..310ae2074973 100644
--- a/pkgs/tools/compression/plzip/default.nix
+++ b/pkgs/tools/compression/plzip/default.nix
@@ -21,5 +21,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2Plus;
     platforms = platforms.all;
     maintainers = with maintainers; [ _360ied ];
+    mainProgram = "plzip";
   };
 }
diff --git a/pkgs/tools/compression/rzip/default.nix b/pkgs/tools/compression/rzip/default.nix
index 5f878f8c494f..24f59d25a91f 100644
--- a/pkgs/tools/compression/rzip/default.nix
+++ b/pkgs/tools/compression/rzip/default.nix
@@ -24,5 +24,6 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ ];
     license = licenses.gpl2Plus;
     platforms = platforms.unix;
+    mainProgram = "rzip";
   };
 }
diff --git a/pkgs/tools/compression/unzrip/default.nix b/pkgs/tools/compression/unzrip/default.nix
index 78b1278d8411..2e92fadd39a9 100644
--- a/pkgs/tools/compression/unzrip/default.nix
+++ b/pkgs/tools/compression/unzrip/default.nix
@@ -31,5 +31,6 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/quininer/unzrip";
     license = licenses.mit;
     maintainers = with maintainers; [ figsoda ];
+    mainProgram = "unzrip";
   };
 }
diff --git a/pkgs/tools/compression/upx/default.nix b/pkgs/tools/compression/upx/default.nix
index 09aab8258a81..9af509100e00 100644
--- a/pkgs/tools/compression/upx/default.nix
+++ b/pkgs/tools/compression/upx/default.nix
@@ -18,5 +18,6 @@ stdenv.mkDerivation rec {
     description = "The Ultimate Packer for eXecutables";
     license = licenses.gpl2Plus;
     platforms = platforms.unix;
+    mainProgram = "upx";
   };
 }
diff --git a/pkgs/tools/compression/xar/default.nix b/pkgs/tools/compression/xar/default.nix
index d4baab17b91f..fa680ebcf51c 100644
--- a/pkgs/tools/compression/xar/default.nix
+++ b/pkgs/tools/compression/xar/default.nix
@@ -42,5 +42,6 @@ stdenv.mkDerivation rec {
     license     = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ copumpkin ];
     platforms   = lib.platforms.all;
+    mainProgram = "xar";
   };
 }
diff --git a/pkgs/tools/compression/zfp/default.nix b/pkgs/tools/compression/zfp/default.nix
index fdb005007f1e..145f33a1cf8e 100644
--- a/pkgs/tools/compression/zfp/default.nix
+++ b/pkgs/tools/compression/zfp/default.nix
@@ -52,5 +52,6 @@ stdenv.mkDerivation rec {
     maintainers = [ maintainers.spease ];
     # 64-bit only
     platforms = platforms.aarch64 ++ platforms.x86_64;
+    mainProgram = "zfp";
   };
 }
diff --git a/pkgs/tools/graphics/aaphoto/default.nix b/pkgs/tools/graphics/aaphoto/default.nix
index 6df3ed916613..57744eb6b8ec 100644
--- a/pkgs/tools/graphics/aaphoto/default.nix
+++ b/pkgs/tools/graphics/aaphoto/default.nix
@@ -48,5 +48,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ AndersonTorres ];
     platforms = platforms.unix;
+    mainProgram = "aaphoto";
   };
 }
diff --git a/pkgs/tools/graphics/adriconf/default.nix b/pkgs/tools/graphics/adriconf/default.nix
index 35de292a36c8..3d516f8ee113 100644
--- a/pkgs/tools/graphics/adriconf/default.nix
+++ b/pkgs/tools/graphics/adriconf/default.nix
@@ -45,5 +45,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ muscaln ];
     platforms = platforms.linux;
+    mainProgram = "adriconf";
   };
 }
diff --git a/pkgs/tools/graphics/blockhash/default.nix b/pkgs/tools/graphics/blockhash/default.nix
index 0a08e0cd31ff..a58fcc4e8ec6 100644
--- a/pkgs/tools/graphics/blockhash/default.nix
+++ b/pkgs/tools/graphics/blockhash/default.nix
@@ -26,5 +26,6 @@ stdenv.mkDerivation rec {
     license = licenses.mit;
     maintainers = [ maintainers.infinisil ];
     platforms = platforms.unix;
+    mainProgram = "blockhash";
   };
 }
diff --git a/pkgs/tools/graphics/blur-effect/default.nix b/pkgs/tools/graphics/blur-effect/default.nix
index e393da508323..cc88bb088949 100644
--- a/pkgs/tools/graphics/blur-effect/default.nix
+++ b/pkgs/tools/graphics/blur-effect/default.nix
@@ -29,5 +29,6 @@ stdenv.mkDerivation rec {
     platforms = platforms.unix;
     broken = stdenv.hostPlatform.isDarwin; # packages 'libdrm' and 'gbm' not found
     maintainers = with maintainers; [ romildo ];
+    mainProgram = "blur_image";
   };
 }
diff --git a/pkgs/tools/graphics/briss/default.nix b/pkgs/tools/graphics/briss/default.nix
index f95c9b527c14..801b8f5a4862 100644
--- a/pkgs/tools/graphics/briss/default.nix
+++ b/pkgs/tools/graphics/briss/default.nix
@@ -25,5 +25,6 @@ stdenv.mkDerivation rec {
     sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
     license = lib.licenses.gpl3;
     platforms = lib.platforms.unix;
+    mainProgram = "briss";
   };
 }
diff --git a/pkgs/tools/graphics/cfdg/default.nix b/pkgs/tools/graphics/cfdg/default.nix
index 2f8b506c65bd..496255c57953 100644
--- a/pkgs/tools/graphics/cfdg/default.nix
+++ b/pkgs/tools/graphics/cfdg/default.nix
@@ -36,5 +36,6 @@ stdenv.mkDerivation rec {
     platforms = platforms.linux;
     homepage = "https://contextfreeart.org/";
     license = licenses.gpl2Only;
+    mainProgram = "cfdg";
   };
 }
diff --git a/pkgs/tools/graphics/cuneiform/default.nix b/pkgs/tools/graphics/cuneiform/default.nix
index 1a1b52502f7d..fa4cb75d174b 100644
--- a/pkgs/tools/graphics/cuneiform/default.nix
+++ b/pkgs/tools/graphics/cuneiform/default.nix
@@ -40,5 +40,6 @@ stdenv.mkDerivation {
     license = licenses.bsd3;
     platforms = platforms.linux;
     maintainers = [ maintainers.raskin ];
+    mainProgram = "cuneiform";
   };
 }
diff --git a/pkgs/tools/graphics/didder/default.nix b/pkgs/tools/graphics/didder/default.nix
index e42a89c72d62..10e97e356daf 100644
--- a/pkgs/tools/graphics/didder/default.nix
+++ b/pkgs/tools/graphics/didder/default.nix
@@ -29,5 +29,6 @@ buildGoModule rec {
       "An extensive, fast, and accurate command-line image dithering tool";
     license = lib.licenses.gpl3;
     maintainers = with lib.maintainers; [ ehmry ];
+    mainProgram = "didder";
   };
 }
diff --git a/pkgs/tools/graphics/ditaa/default.nix b/pkgs/tools/graphics/ditaa/default.nix
index ab1c6ff74ec3..c6823fbed369 100644
--- a/pkgs/tools/graphics/ditaa/default.nix
+++ b/pkgs/tools/graphics/ditaa/default.nix
@@ -31,5 +31,6 @@ stdenv.mkDerivation rec {
     license = licenses.lgpl3;
     platforms = platforms.unix;
     maintainers = [ maintainers.bjornfor ];
+    mainProgram = "ditaa";
   };
 }
diff --git a/pkgs/tools/graphics/dnglab/default.nix b/pkgs/tools/graphics/dnglab/default.nix
index cb865e51a9c5..9088a1110b7b 100644
--- a/pkgs/tools/graphics/dnglab/default.nix
+++ b/pkgs/tools/graphics/dnglab/default.nix
@@ -24,5 +24,6 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/dnglab/dnglab";
     license = licenses.lgpl21Only;
     maintainers = with maintainers; [ dit7ya ];
+    mainProgram = "dnglab";
   };
 }
diff --git a/pkgs/tools/graphics/dpic/default.nix b/pkgs/tools/graphics/dpic/default.nix
index 1a4161dd6206..fb3e0c19bf82 100644
--- a/pkgs/tools/graphics/dpic/default.nix
+++ b/pkgs/tools/graphics/dpic/default.nix
@@ -18,6 +18,7 @@ stdenv.mkDerivation rec {
     license = licenses.bsd2;
     maintainers = with maintainers; [ aespinosa ];
     platforms = platforms.all;
+    mainProgram = "dpic";
   };
 }
 
diff --git a/pkgs/tools/graphics/editres/default.nix b/pkgs/tools/graphics/editres/default.nix
index ca9be631942a..ce8b2e0a4ff6 100644
--- a/pkgs/tools/graphics/editres/default.nix
+++ b/pkgs/tools/graphics/editres/default.nix
@@ -21,5 +21,6 @@ stdenv.mkDerivation rec {
     description = "A dynamic resource editor for X Toolkit applications";
     license = licenses.mit;
     platforms = platforms.linux;
+    mainProgram = "editres";
   };
 }
diff --git a/pkgs/tools/graphics/epstool/default.nix b/pkgs/tools/graphics/epstool/default.nix
index cdb1f75cb2c3..5952734e4582 100644
--- a/pkgs/tools/graphics/epstool/default.nix
+++ b/pkgs/tools/graphics/epstool/default.nix
@@ -25,5 +25,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2;
     maintainers = [ maintainers.asppsa ];
     platforms = platforms.all;
+    mainProgram = "epstool";
   };
 }
diff --git a/pkgs/tools/graphics/escrotum/default.nix b/pkgs/tools/graphics/escrotum/default.nix
index 04c245dbd9a6..c2e5a7ec9a71 100644
--- a/pkgs/tools/graphics/escrotum/default.nix
+++ b/pkgs/tools/graphics/escrotum/default.nix
@@ -47,5 +47,6 @@ with python3Packages; buildPythonApplication {
     platforms = platforms.linux;
     maintainers = with maintainers; [ rasendubi ];
     license = licenses.gpl3;
+    mainProgram = "escrotum";
   };
 }
diff --git a/pkgs/tools/graphics/esshader/default.nix b/pkgs/tools/graphics/esshader/default.nix
index 2e2e9ddbd65e..38bd4d1b7f0a 100644
--- a/pkgs/tools/graphics/esshader/default.nix
+++ b/pkgs/tools/graphics/esshader/default.nix
@@ -36,5 +36,6 @@ stdenv.mkDerivation {
     platforms = lib.platforms.unix;
     # never built on aarch64-darwin, x86_64-darwin since first introduction in nixpkgs
     broken = stdenv.isDarwin;
+    mainProgram = "esshader";
   };
 }
diff --git a/pkgs/tools/graphics/exif/default.nix b/pkgs/tools/graphics/exif/default.nix
index f07f3d05541e..437ae29a2f50 100644
--- a/pkgs/tools/graphics/exif/default.nix
+++ b/pkgs/tools/graphics/exif/default.nix
@@ -41,5 +41,6 @@ stdenv.mkDerivation rec {
     description = "A utility to read and manipulate EXIF data in digital photographs";
     platforms = platforms.unix;
     license = licenses.lgpl21Plus;
+    mainProgram = "exif";
   };
 }
diff --git a/pkgs/tools/graphics/facedetect/default.nix b/pkgs/tools/graphics/facedetect/default.nix
index d62f077e06d7..d83501d26da6 100644
--- a/pkgs/tools/graphics/facedetect/default.nix
+++ b/pkgs/tools/graphics/facedetect/default.nix
@@ -41,5 +41,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2Plus;
     platforms = platforms.all;
     maintainers = [ maintainers.rycee ];
+    mainProgram = "facedetect";
   };
 }
diff --git a/pkgs/tools/graphics/fbv/default.nix b/pkgs/tools/graphics/fbv/default.nix
index 5b46d5d2268d..659a661fded8 100644
--- a/pkgs/tools/graphics/fbv/default.nix
+++ b/pkgs/tools/graphics/fbv/default.nix
@@ -32,5 +32,6 @@ stdenv.mkDerivation rec {
     homepage = "http://s-tech.elsat.net.pl/fbv/";
     license = licenses.gpl2Only;
     maintainers = with maintainers; [ peterhoeg ];
+    mainProgram = "fbv";
   };
 }
diff --git a/pkgs/tools/graphics/feedgnuplot/default.nix b/pkgs/tools/graphics/feedgnuplot/default.nix
index 827481af497c..6503a2887ab2 100644
--- a/pkgs/tools/graphics/feedgnuplot/default.nix
+++ b/pkgs/tools/graphics/feedgnuplot/default.nix
@@ -62,5 +62,6 @@ perlPackages.buildPerlPackage rec {
     license = with licenses; [ artistic1 gpl1Plus ];
     platforms = platforms.unix;
     maintainers = with maintainers; [ mnacamura ];
+    mainProgram = "feedgnuplot";
   };
 }
diff --git a/pkgs/tools/graphics/fgallery/default.nix b/pkgs/tools/graphics/fgallery/default.nix
index 7af5c6129f25..be8bc4eb6eab 100644
--- a/pkgs/tools/graphics/fgallery/default.nix
+++ b/pkgs/tools/graphics/fgallery/default.nix
@@ -49,5 +49,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2;
     platforms = platforms.all;
     maintainers = [ maintainers.bjornfor ];
+    mainProgram = "fgallery";
   };
 }
diff --git a/pkgs/tools/graphics/ggobi/default.nix b/pkgs/tools/graphics/ggobi/default.nix
index 4e1b851735f0..2bd5abf00666 100644
--- a/pkgs/tools/graphics/ggobi/default.nix
+++ b/pkgs/tools/graphics/ggobi/default.nix
@@ -22,5 +22,6 @@ stdenv.mkDerivation rec {
     license = licenses.cpl10;
     platforms = platforms.linux;
     maintainers = [ maintainers.michelk ];
+    mainProgram = "ggobi";
   };
 }
diff --git a/pkgs/tools/graphics/gnuplot/default.nix b/pkgs/tools/graphics/gnuplot/default.nix
index f0fa45e59e4d..1d07707b57e4 100644
--- a/pkgs/tools/graphics/gnuplot/default.nix
+++ b/pkgs/tools/graphics/gnuplot/default.nix
@@ -88,5 +88,6 @@ in
       url = "https://sourceforge.net/p/gnuplot/gnuplot-main/ci/master/tree/Copyright";
     };
     maintainers = with maintainers; [ lovek323 ];
+    mainProgram = "gnuplot";
   };
 }
diff --git a/pkgs/tools/graphics/goverlay/default.nix b/pkgs/tools/graphics/goverlay/default.nix
index d4f88a770a01..b73216a7875c 100644
--- a/pkgs/tools/graphics/goverlay/default.nix
+++ b/pkgs/tools/graphics/goverlay/default.nix
@@ -113,5 +113,6 @@ in stdenv.mkDerivation rec {
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ kira-bruneau ];
     platforms = platforms.linux;
+    mainProgram = "goverlay";
   };
 }
diff --git a/pkgs/tools/graphics/graph-cli/default.nix b/pkgs/tools/graphics/graph-cli/default.nix
index c504d6b27156..be6769d85e9a 100644
--- a/pkgs/tools/graphics/graph-cli/default.nix
+++ b/pkgs/tools/graphics/graph-cli/default.nix
@@ -28,5 +28,6 @@ python3Packages.buildPythonApplication rec {
     homepage = "https://github.com/mcastorina/graph-cli/";
     license = with licenses; [ gpl3Only ];
     maintainers = with maintainers; [ leungbk ];
+    mainProgram = "graph";
   };
 }
diff --git a/pkgs/tools/graphics/graph-easy/default.nix b/pkgs/tools/graphics/graph-easy/default.nix
index 4f3b89eea917..668c7527e9e4 100644
--- a/pkgs/tools/graphics/graph-easy/default.nix
+++ b/pkgs/tools/graphics/graph-easy/default.nix
@@ -13,5 +13,6 @@ perlPackages.buildPerlPackage {
     license = licenses.gpl1Only;
     platforms = platforms.unix;
     maintainers = [ maintainers.jensbin ];
+    mainProgram = "graph-easy";
   };
 }
diff --git a/pkgs/tools/graphics/gromit-mpx/default.nix b/pkgs/tools/graphics/gromit-mpx/default.nix
index d98ee8733a04..0a54626419b5 100644
--- a/pkgs/tools/graphics/gromit-mpx/default.nix
+++ b/pkgs/tools/graphics/gromit-mpx/default.nix
@@ -34,5 +34,6 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ pjones ];
     platforms = platforms.linux;
     license = licenses.gpl2Plus;
+    mainProgram = "gromit-mpx";
   };
 }
diff --git a/pkgs/tools/graphics/guff/default.nix b/pkgs/tools/graphics/guff/default.nix
index daca6f4344eb..2ca68376baa2 100644
--- a/pkgs/tools/graphics/guff/default.nix
+++ b/pkgs/tools/graphics/guff/default.nix
@@ -21,5 +21,6 @@ stdenv.mkDerivation rec {
     license = licenses.isc;
     maintainers = [ maintainers.marsam ];
     platforms = platforms.all;
+    mainProgram = "guff";
   };
 }
diff --git a/pkgs/tools/graphics/ibniz/default.nix b/pkgs/tools/graphics/ibniz/default.nix
index a74267846c1d..04aadf911e1e 100644
--- a/pkgs/tools/graphics/ibniz/default.nix
+++ b/pkgs/tools/graphics/ibniz/default.nix
@@ -22,5 +22,6 @@ stdenv.mkDerivation rec {
     license = licenses.zlib;
     platforms = platforms.linux;
     maintainers = [ maintainers.dezgeg ];
+    mainProgram = "ibniz";
   };
 }
diff --git a/pkgs/tools/graphics/imgur-screenshot/default.nix b/pkgs/tools/graphics/imgur-screenshot/default.nix
index 885638c28b8c..fe23866bda0b 100644
--- a/pkgs/tools/graphics/imgur-screenshot/default.nix
+++ b/pkgs/tools/graphics/imgur-screenshot/default.nix
@@ -25,5 +25,6 @@ in stdenv.mkDerivation rec {
     platforms = platforms.linux;
     license = licenses.mit;
     maintainers = with maintainers; [ lw ];
+    mainProgram = "imgur-screenshot";
   };
 }
diff --git a/pkgs/tools/graphics/imgurbash2/default.nix b/pkgs/tools/graphics/imgurbash2/default.nix
index 6c0e827a8488..e577c8be5a3d 100644
--- a/pkgs/tools/graphics/imgurbash2/default.nix
+++ b/pkgs/tools/graphics/imgurbash2/default.nix
@@ -27,5 +27,6 @@ stdenv.mkDerivation rec {
     platforms = platforms.all;
     maintainers = with maintainers; [ abbradar ];
     homepage = "https://github.com/ram-on/imgurbash2";
+    mainProgram = "imgurbash2";
   };
 }
diff --git a/pkgs/tools/graphics/jhead/default.nix b/pkgs/tools/graphics/jhead/default.nix
index 35000088fea9..391780a4df35 100644
--- a/pkgs/tools/graphics/jhead/default.nix
+++ b/pkgs/tools/graphics/jhead/default.nix
@@ -45,5 +45,6 @@ stdenv.mkDerivation rec {
     license = licenses.publicDomain;
     maintainers = with maintainers; [ rycee ];
     platforms = platforms.all;
+    mainProgram = "jhead";
   };
 }
diff --git a/pkgs/tools/graphics/jpegexiforient/default.nix b/pkgs/tools/graphics/jpegexiforient/default.nix
index 09d096e7b687..bdf2ce12e837 100644
--- a/pkgs/tools/graphics/jpegexiforient/default.nix
+++ b/pkgs/tools/graphics/jpegexiforient/default.nix
@@ -23,5 +23,6 @@ stdenv.mkDerivation {
     license = licenses.free;
     platforms = platforms.all;
     maintainers = with maintainers; [ infinisil ];
+    mainProgram = "jpegexiforient";
   };
 }
diff --git a/pkgs/tools/graphics/leela/default.nix b/pkgs/tools/graphics/leela/default.nix
index 6676e47ad492..7ddf02d16369 100644
--- a/pkgs/tools/graphics/leela/default.nix
+++ b/pkgs/tools/graphics/leela/default.nix
@@ -22,5 +22,6 @@ stdenv.mkDerivation {
     license = lib.licenses.gpl3;
     maintainers = [ lib.maintainers.puffnfresh ];
     platforms = lib.platforms.linux;
+    mainProgram = "leela";
   };
 }
diff --git a/pkgs/tools/graphics/logstalgia/default.nix b/pkgs/tools/graphics/logstalgia/default.nix
index 8edde6e3f428..69084a8b5370 100644
--- a/pkgs/tools/graphics/logstalgia/default.nix
+++ b/pkgs/tools/graphics/logstalgia/default.nix
@@ -40,5 +40,6 @@ stdenv.mkDerivation rec {
 
     platforms = platforms.gnu ++ platforms.linux;
     maintainers = with maintainers; [ pSub ];
+    mainProgram = "logstalgia";
   };
 }
diff --git a/pkgs/tools/graphics/lsix/default.nix b/pkgs/tools/graphics/lsix/default.nix
index dcf078654b82..7cbe2ee8626c 100644
--- a/pkgs/tools/graphics/lsix/default.nix
+++ b/pkgs/tools/graphics/lsix/default.nix
@@ -32,5 +32,6 @@ stdenvNoCC.mkDerivation rec {
     license = licenses.gpl3Only;
     platforms = platforms.all;
     maintainers = with maintainers; [ kidonng ];
+    mainProgram = "lsix";
   };
 }
diff --git a/pkgs/tools/graphics/mscgen/default.nix b/pkgs/tools/graphics/mscgen/default.nix
index 7eb1d6cce818..a391a62ccb68 100644
--- a/pkgs/tools/graphics/mscgen/default.nix
+++ b/pkgs/tools/graphics/mscgen/default.nix
@@ -49,5 +49,6 @@ stdenv.mkDerivation rec {
     '';
 
     platforms = lib.platforms.unix;
+    mainProgram = "mscgen";
   };
 }
diff --git a/pkgs/tools/graphics/nifskope/default.nix b/pkgs/tools/graphics/nifskope/default.nix
index f74b720ea9ea..056b3ad8d065 100644
--- a/pkgs/tools/graphics/nifskope/default.nix
+++ b/pkgs/tools/graphics/nifskope/default.nix
@@ -63,5 +63,6 @@ stdenv.mkDerivation {
     maintainers = with maintainers; [ eelco ];
     platforms = platforms.linux;
     license = licenses.bsd3;
+    mainProgram = "NifSkope";
   };
 }
diff --git a/pkgs/tools/graphics/nip2/default.nix b/pkgs/tools/graphics/nip2/default.nix
index 08ec885aed14..651baf547a9e 100644
--- a/pkgs/tools/graphics/nip2/default.nix
+++ b/pkgs/tools/graphics/nip2/default.nix
@@ -52,5 +52,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ kovirobi ];
     platforms = platforms.unix;
+    mainProgram = "nip2";
   };
 }
diff --git a/pkgs/tools/graphics/optipng/default.nix b/pkgs/tools/graphics/optipng/default.nix
index 2f70dec897c0..bbabcaf6b800 100644
--- a/pkgs/tools/graphics/optipng/default.nix
+++ b/pkgs/tools/graphics/optipng/default.nix
@@ -42,5 +42,6 @@ stdenv.mkDerivation rec {
     description = "A PNG optimizer";
     license = licenses.zlib;
     platforms = platforms.unix;
+    mainProgram = "optipng";
   };
 }
diff --git a/pkgs/tools/graphics/oxipng/default.nix b/pkgs/tools/graphics/oxipng/default.nix
index 8f4793edb45d..23f9692597a3 100644
--- a/pkgs/tools/graphics/oxipng/default.nix
+++ b/pkgs/tools/graphics/oxipng/default.nix
@@ -18,5 +18,6 @@ rustPlatform.buildRustPackage rec {
     description = "A multithreaded lossless PNG compression optimizer";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ dywedir ];
+    mainProgram = "oxipng";
   };
 }
diff --git a/pkgs/tools/graphics/pdf2svg/default.nix b/pkgs/tools/graphics/pdf2svg/default.nix
index c6d2eab45376..b68ba12ebfe9 100644
--- a/pkgs/tools/graphics/pdf2svg/default.nix
+++ b/pkgs/tools/graphics/pdf2svg/default.nix
@@ -21,5 +21,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2;
     maintainers = [ maintainers.ianwookim ];
     platforms = platforms.unix;
+    mainProgram = "pdf2svg";
   };
 }
diff --git a/pkgs/tools/graphics/pdftag/default.nix b/pkgs/tools/graphics/pdftag/default.nix
index c10412c976ce..90b8dde05f37 100644
--- a/pkgs/tools/graphics/pdftag/default.nix
+++ b/pkgs/tools/graphics/pdftag/default.nix
@@ -20,5 +20,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl3;
     maintainers = with maintainers; [ leenaars ];
     platforms = platforms.unix;
+    mainProgram = "pdftag";
   };
 }
diff --git a/pkgs/tools/graphics/pdftoipe/default.nix b/pkgs/tools/graphics/pdftoipe/default.nix
index d7e757e679bf..e969d90f9e05 100644
--- a/pkgs/tools/graphics/pdftoipe/default.nix
+++ b/pkgs/tools/graphics/pdftoipe/default.nix
@@ -50,5 +50,6 @@ stdenv.mkDerivation rec {
     changelog = "https://github.com/otfried/ipe-tools/releases";
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ yrd ];
+    mainProgram = "pdftoipe";
   };
 }
diff --git a/pkgs/tools/graphics/perceptualdiff/default.nix b/pkgs/tools/graphics/perceptualdiff/default.nix
index 919b99327110..aa88b33aa381 100644
--- a/pkgs/tools/graphics/perceptualdiff/default.nix
+++ b/pkgs/tools/graphics/perceptualdiff/default.nix
@@ -20,5 +20,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ uri-canva ];
     platforms = platforms.unix;
+    mainProgram = "perceptualdiff";
   };
 }
diff --git a/pkgs/tools/graphics/piglit/default.nix b/pkgs/tools/graphics/piglit/default.nix
index 561268b3f4b3..aa076d1b84e0 100644
--- a/pkgs/tools/graphics/piglit/default.nix
+++ b/pkgs/tools/graphics/piglit/default.nix
@@ -73,5 +73,6 @@ stdenv.mkDerivation rec {
     license = licenses.free; # custom license. See COPYING in the source repo.
     platforms = platforms.mesaPlatforms;
     maintainers = with maintainers; [ Flakebi ];
+    mainProgram = "piglit";
   };
 }
diff --git a/pkgs/tools/graphics/pixel2svg/default.nix b/pkgs/tools/graphics/pixel2svg/default.nix
index 8e5e86624900..1094cad56a33 100644
--- a/pkgs/tools/graphics/pixel2svg/default.nix
+++ b/pkgs/tools/graphics/pixel2svg/default.nix
@@ -16,5 +16,6 @@ python310Packages.buildPythonPackage rec {
     description = "Converts pixel art to SVG - pixel by pixel";
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ annaaurora ];
+    mainProgram = "pixel2svg.py";
   };
 }
diff --git a/pkgs/tools/graphics/pngcheck/default.nix b/pkgs/tools/graphics/pngcheck/default.nix
index a90881dad224..d6ed7a6960fc 100644
--- a/pkgs/tools/graphics/pngcheck/default.nix
+++ b/pkgs/tools/graphics/pngcheck/default.nix
@@ -36,5 +36,6 @@ stdenv.mkDerivation rec {
     license = licenses.free;
     platforms = platforms.unix;
     maintainers = with maintainers; [ starcraft66 ];
+    mainProgram = "pngcheck";
   };
 }
diff --git a/pkgs/tools/graphics/pngcrush/default.nix b/pkgs/tools/graphics/pngcrush/default.nix
index 16c710ceb79f..8ce9965eae25 100644
--- a/pkgs/tools/graphics/pngcrush/default.nix
+++ b/pkgs/tools/graphics/pngcrush/default.nix
@@ -22,5 +22,6 @@ stdenv.mkDerivation rec {
     description = "A PNG optimizer";
     license = lib.licenses.free;
     platforms = with lib.platforms; linux ++ darwin;
+    mainProgram = "pngcrush";
   };
 }
diff --git a/pkgs/tools/graphics/pngloss/default.nix b/pkgs/tools/graphics/pngloss/default.nix
index eafd77054e40..7eca91f42d7d 100644
--- a/pkgs/tools/graphics/pngloss/default.nix
+++ b/pkgs/tools/graphics/pngloss/default.nix
@@ -31,5 +31,6 @@ stdenv.mkDerivation rec {
     license = licenses.mit;
     platforms = platforms.all;
     maintainers = with maintainers; [ _2gn ];
+    mainProgram = "pngloss";
   };
 }
diff --git a/pkgs/tools/graphics/pngout/default.nix b/pkgs/tools/graphics/pngout/default.nix
index 2b86f5e5e136..c80d4a65adc9 100644
--- a/pkgs/tools/graphics/pngout/default.nix
+++ b/pkgs/tools/graphics/pngout/default.nix
@@ -46,5 +46,6 @@ stdenv.mkDerivation rec {
     homepage = "http://advsys.net/ken/utils.htm";
     platforms = lib.attrNames platforms;
     maintainers = [ lib.maintainers.sander ];
+    mainProgram = "pngout";
   };
 }
diff --git a/pkgs/tools/graphics/pngtoico/default.nix b/pkgs/tools/graphics/pngtoico/default.nix
index 7abf94f0a3e1..c480f99651dc 100644
--- a/pkgs/tools/graphics/pngtoico/default.nix
+++ b/pkgs/tools/graphics/pngtoico/default.nix
@@ -20,5 +20,6 @@ stdenv.mkDerivation rec {
     description = "Small utility to convert a set of PNG images to Microsoft ICO format";
     license = lib.licenses.gpl2Plus;
     platforms = with lib.platforms; linux;
+    mainProgram = "pngtoico";
   };
 }
diff --git a/pkgs/tools/graphics/povray/default.nix b/pkgs/tools/graphics/povray/default.nix
index f9a08543fb95..5e432a0d13c4 100644
--- a/pkgs/tools/graphics/povray/default.nix
+++ b/pkgs/tools/graphics/povray/default.nix
@@ -57,5 +57,6 @@ stdenv.mkDerivation rec {
     description = "Persistence of Vision Raytracer";
     license = licenses.free;
     platforms = platforms.linux;
+    mainProgram = "povray";
   };
 }
diff --git a/pkgs/tools/graphics/pstoedit/default.nix b/pkgs/tools/graphics/pstoedit/default.nix
index df3d1c6a6938..3bd4c1a86fbc 100644
--- a/pkgs/tools/graphics/pstoedit/default.nix
+++ b/pkgs/tools/graphics/pstoedit/default.nix
@@ -36,5 +36,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2;
     maintainers = [ maintainers.marcweber ];
     platforms = platforms.unix;
+    mainProgram = "pstoedit";
   };
 }
diff --git a/pkgs/tools/graphics/qrcode/default.nix b/pkgs/tools/graphics/qrcode/default.nix
index 3f1404404005..ce623e25db0e 100644
--- a/pkgs/tools/graphics/qrcode/default.nix
+++ b/pkgs/tools/graphics/qrcode/default.nix
@@ -27,5 +27,6 @@ stdenv.mkDerivation {
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ raskin ];
     platforms = with platforms; unix;
+    mainProgram = "qrcode";
   };
 }
diff --git a/pkgs/tools/graphics/realesrgan-ncnn-vulkan/default.nix b/pkgs/tools/graphics/realesrgan-ncnn-vulkan/default.nix
index 05cb130467a7..107a09a0ff92 100644
--- a/pkgs/tools/graphics/realesrgan-ncnn-vulkan/default.nix
+++ b/pkgs/tools/graphics/realesrgan-ncnn-vulkan/default.nix
@@ -60,5 +60,6 @@ stdenv.mkDerivation rec {
     license = licenses.mit;
     maintainers = with maintainers; [ tilcreator ];
     platforms = platforms.all;
+    mainProgram = "realesrgan-ncnn-vulkan";
   };
 }
diff --git a/pkgs/tools/graphics/s2png/default.nix b/pkgs/tools/graphics/s2png/default.nix
index d3f8b74512a8..940e9db05419 100644
--- a/pkgs/tools/graphics/s2png/default.nix
+++ b/pkgs/tools/graphics/s2png/default.nix
@@ -21,5 +21,6 @@ stdenv.mkDerivation rec {
     license = lib.licenses.gpl2;
     maintainers = [ lib.maintainers.dbohdan ];
     platforms = lib.platforms.unix;
+    mainProgram = "s2png";
   };
 }
diff --git a/pkgs/tools/graphics/sanjuuni/default.nix b/pkgs/tools/graphics/sanjuuni/default.nix
index 71807b0db019..6b96e6ad5a92 100644
--- a/pkgs/tools/graphics/sanjuuni/default.nix
+++ b/pkgs/tools/graphics/sanjuuni/default.nix
@@ -45,5 +45,6 @@ stdenv.mkDerivation rec {
     maintainers = [ maintainers.tomodachi94 ];
     license = licenses.gpl2Plus;
     broken = stdenv.isDarwin;
+    mainProgram = "sanjuuni";
   };
 }
diff --git a/pkgs/tools/graphics/shot-scraper/default.nix b/pkgs/tools/graphics/shot-scraper/default.nix
index e083014f8a98..60aee277b60f 100644
--- a/pkgs/tools/graphics/shot-scraper/default.nix
+++ b/pkgs/tools/graphics/shot-scraper/default.nix
@@ -35,5 +35,6 @@ python3.pkgs.buildPythonApplication rec {
     changelog = "https://github.com/simonw/shot-scraper/releases/tag/${version}";
     license = licenses.asl20;
     maintainers = with maintainers; [ techknowlogick ];
+    mainProgram = "shot-scraper";
   };
 }
diff --git a/pkgs/tools/graphics/shotgun/default.nix b/pkgs/tools/graphics/shotgun/default.nix
index 30d676d4b2ef..d2d3c92982f6 100644
--- a/pkgs/tools/graphics/shotgun/default.nix
+++ b/pkgs/tools/graphics/shotgun/default.nix
@@ -19,5 +19,6 @@ rustPlatform.buildRustPackage rec {
     license = with licenses; [ mpl20 ];
     maintainers = with maintainers; [ figsoda lumi novenary ];
     platforms = platforms.linux;
+    mainProgram = "shotgun";
   };
 }
diff --git a/pkgs/tools/graphics/smartcrop/default.nix b/pkgs/tools/graphics/smartcrop/default.nix
index d08c11fd3ebf..7660607a9a47 100644
--- a/pkgs/tools/graphics/smartcrop/default.nix
+++ b/pkgs/tools/graphics/smartcrop/default.nix
@@ -23,5 +23,6 @@ buildGoModule {
     homepage = "https://github.com/muesli/smartcrop";
     license = licenses.mit;
     maintainers = with maintainers; [ figsoda ];
+    mainProgram = "smartcrop";
   };
 }
diff --git a/pkgs/tools/graphics/sng/default.nix b/pkgs/tools/graphics/sng/default.nix
index 8ebfd967828b..a8db32128a5e 100644
--- a/pkgs/tools/graphics/sng/default.nix
+++ b/pkgs/tools/graphics/sng/default.nix
@@ -21,5 +21,6 @@ stdenv.mkDerivation rec {
     license = licenses.zlib;
     maintainers = [ maintainers.dezgeg ];
     platforms = platforms.unix;
+    mainProgram = "sng";
   };
 }
diff --git a/pkgs/tools/graphics/spirv-cross/default.nix b/pkgs/tools/graphics/spirv-cross/default.nix
index 642a49c39b84..cd7489be9aec 100644
--- a/pkgs/tools/graphics/spirv-cross/default.nix
+++ b/pkgs/tools/graphics/spirv-cross/default.nix
@@ -25,5 +25,6 @@ stdenv.mkDerivation (finalAttrs: {
     platforms = platforms.all;
     license = licenses.asl20;
     maintainers = with maintainers; [ Flakebi ];
+    mainProgram = "spirv-cross";
   };
 })
diff --git a/pkgs/tools/graphics/steghide/default.nix b/pkgs/tools/graphics/steghide/default.nix
index 74011917d5fb..c62761bb2a21 100644
--- a/pkgs/tools/graphics/steghide/default.nix
+++ b/pkgs/tools/graphics/steghide/default.nix
@@ -40,5 +40,6 @@ stdenv.mkDerivation (finalAttrs: {
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ AndersonTorres ];
     platforms = with platforms; unix;
+    mainProgram = "steghide";
   };
 })
diff --git a/pkgs/tools/graphics/stegsolve/default.nix b/pkgs/tools/graphics/stegsolve/default.nix
index 3f147ab0deca..a42b3c304b28 100644
--- a/pkgs/tools/graphics/stegsolve/default.nix
+++ b/pkgs/tools/graphics/stegsolve/default.nix
@@ -55,5 +55,6 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     };
     maintainers = with maintainers; [ emilytrau ];
     platforms = platforms.all;
+    mainProgram = "stegsolve";
   };
 })
diff --git a/pkgs/tools/graphics/svg2pdf/default.nix b/pkgs/tools/graphics/svg2pdf/default.nix
index 27ef2edd0fa8..d92fa5802d87 100644
--- a/pkgs/tools/graphics/svg2pdf/default.nix
+++ b/pkgs/tools/graphics/svg2pdf/default.nix
@@ -22,5 +22,6 @@ rustPlatform.buildRustPackage rec {
     changelog = "https://github.com/typst/svg2pdf/releases/tag/${src.rev}";
     license = with licenses; [ asl20 mit ];
     maintainers = with maintainers; [ doronbehar figsoda ];
+    mainProgram = "svg2pdf";
   };
 }
diff --git a/pkgs/tools/graphics/svgbob/default.nix b/pkgs/tools/graphics/svgbob/default.nix
index e5974d04e1ae..b09d8dee1ab0 100644
--- a/pkgs/tools/graphics/svgbob/default.nix
+++ b/pkgs/tools/graphics/svgbob/default.nix
@@ -22,5 +22,6 @@ rustPlatform.buildRustPackage rec {
     changelog = "https://github.com/ivanceras/svgbob/raw/${version}/Changelog.md";
     license = licenses.asl20;
     maintainers = [ maintainers.marsam ];
+    mainProgram = "svgbob";
   };
 }
diff --git a/pkgs/tools/graphics/svgcleaner/default.nix b/pkgs/tools/graphics/svgcleaner/default.nix
index c2938a69b57a..1ec42817456a 100644
--- a/pkgs/tools/graphics/svgcleaner/default.nix
+++ b/pkgs/tools/graphics/svgcleaner/default.nix
@@ -22,5 +22,6 @@ rustPlatform.buildRustPackage rec {
     changelog = "https://github.com/RazrFalcon/svgcleaner/releases";
     license = licenses.gpl2;
     maintainers = with maintainers; [ yuu ];
+    mainProgram = "svgcleaner";
   };
 }
diff --git a/pkgs/tools/graphics/textplots/default.nix b/pkgs/tools/graphics/textplots/default.nix
index a423ca9f30e2..81d9b5de3e36 100644
--- a/pkgs/tools/graphics/textplots/default.nix
+++ b/pkgs/tools/graphics/textplots/default.nix
@@ -18,5 +18,6 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/loony-bean/textplots-rs";
     license = licenses.mit;
     maintainers = with maintainers; [ figsoda ];
+    mainProgram = "textplots";
   };
 }
diff --git a/pkgs/tools/graphics/texture-synthesis/default.nix b/pkgs/tools/graphics/texture-synthesis/default.nix
index d4f66357fadc..7122450587a7 100644
--- a/pkgs/tools/graphics/texture-synthesis/default.nix
+++ b/pkgs/tools/graphics/texture-synthesis/default.nix
@@ -26,5 +26,6 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/embarkstudios/texture-synthesis";
     license = with licenses; [ mit /* or */ asl20 ];
     maintainers = with maintainers; [ figsoda ];
+    mainProgram = "texture-synthesis";
   };
 }
diff --git a/pkgs/tools/graphics/twilight/default.nix b/pkgs/tools/graphics/twilight/default.nix
index 58d4d0df9133..52941f7b96d7 100644
--- a/pkgs/tools/graphics/twilight/default.nix
+++ b/pkgs/tools/graphics/twilight/default.nix
@@ -24,5 +24,6 @@ stdenv.mkDerivation rec {
     license = licenses.mit;
     platforms = platforms.linux;
     maintainers = with maintainers; [ ];
+    mainProgram = "twilight";
   };
 }
diff --git a/pkgs/tools/graphics/viu/default.nix b/pkgs/tools/graphics/viu/default.nix
index ade2dd7331bf..83c97376676a 100644
--- a/pkgs/tools/graphics/viu/default.nix
+++ b/pkgs/tools/graphics/viu/default.nix
@@ -29,5 +29,6 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/atanunq/viu";
     license = licenses.mit;
     maintainers = with maintainers; [ chuangzhu ];
+    mainProgram = "viu";
   };
 }
diff --git a/pkgs/tools/graphics/vkbasalt-cli/default.nix b/pkgs/tools/graphics/vkbasalt-cli/default.nix
index 0d54f695e9af..efe704ace293 100644
--- a/pkgs/tools/graphics/vkbasalt-cli/default.nix
+++ b/pkgs/tools/graphics/vkbasalt-cli/default.nix
@@ -27,5 +27,6 @@ python3Packages.buildPythonApplication rec {
     homepage = "https://gitlab.com/TheEvilSkeleton/vkbasalt-cli";
     license = with licenses; [ lgpl3Only gpl3Only ];
     maintainers = with maintainers; [ martfont ];
+    mainProgram = "vkbasalt";
   };
 }
diff --git a/pkgs/tools/graphics/vkdisplayinfo/default.nix b/pkgs/tools/graphics/vkdisplayinfo/default.nix
index a48c4d1154fe..3a88b2e21147 100644
--- a/pkgs/tools/graphics/vkdisplayinfo/default.nix
+++ b/pkgs/tools/graphics/vkdisplayinfo/default.nix
@@ -44,5 +44,6 @@ stdenv.mkDerivation rec {
     platforms = platforms.linux;
     license = licenses.boost;
     maintainers = [ maintainers.LunNova ];
+    mainProgram = "vkdisplayinfo";
   };
 }
diff --git a/pkgs/tools/graphics/vkmark/default.nix b/pkgs/tools/graphics/vkmark/default.nix
index 2923c786507e..d9c4f8a2024f 100644
--- a/pkgs/tools/graphics/vkmark/default.nix
+++ b/pkgs/tools/graphics/vkmark/default.nix
@@ -45,5 +45,6 @@ stdenv.mkDerivation rec {
     license = with licenses; [ lgpl21Plus ];
     platforms = platforms.linux;
     maintainers = with maintainers; [ muscaln ];
+    mainProgram = "vkmark";
   };
 }
diff --git a/pkgs/tools/graphics/vulkan-helper/default.nix b/pkgs/tools/graphics/vulkan-helper/default.nix
index 8db735c662e8..404ce734b5b3 100644
--- a/pkgs/tools/graphics/vulkan-helper/default.nix
+++ b/pkgs/tools/graphics/vulkan-helper/default.nix
@@ -33,5 +33,6 @@ rustPlatform.buildRustPackage rec {
     license = licenses.mit;
     maintainers = with maintainers; [ aidalgol ];
     platforms = platforms.linux;
+    mainProgram = "vulkan-helper";
   };
 }
diff --git a/pkgs/tools/graphics/waifu2x-converter-cpp/default.nix b/pkgs/tools/graphics/waifu2x-converter-cpp/default.nix
index f936ab83fb56..dd2c15c8fda4 100644
--- a/pkgs/tools/graphics/waifu2x-converter-cpp/default.nix
+++ b/pkgs/tools/graphics/waifu2x-converter-cpp/default.nix
@@ -42,5 +42,6 @@ stdenv.mkDerivation rec {
     license = lib.licenses.mit;
     maintainers = [ lib.maintainers.xzfc ];
     platforms = lib.platforms.linux ++ lib.platforms.darwin;
+    mainProgram = "waifu2x-converter-cpp";
   };
 }
diff --git a/pkgs/tools/graphics/xcolor/default.nix b/pkgs/tools/graphics/xcolor/default.nix
index dabe14d895fa..50aa912522d9 100644
--- a/pkgs/tools/graphics/xcolor/default.nix
+++ b/pkgs/tools/graphics/xcolor/default.nix
@@ -43,5 +43,6 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/Soft/xcolor";
     maintainers = with lib.maintainers; [ moni ];
     license = licenses.mit;
+    mainProgram = "xcolor";
   };
 }
diff --git a/pkgs/tools/graphics/xcur2png/default.nix b/pkgs/tools/graphics/xcur2png/default.nix
index e8d761c6d842..5d5396aea273 100644
--- a/pkgs/tools/graphics/xcur2png/default.nix
+++ b/pkgs/tools/graphics/xcur2png/default.nix
@@ -28,5 +28,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl3;
     platforms = platforms.unix;
     maintainers = with maintainers; [ romildo ];
+    mainProgram = "xcur2png";
   };
 }
diff --git a/pkgs/tools/graphics/yaxg/default.nix b/pkgs/tools/graphics/yaxg/default.nix
index 9d83ae71d333..dd428ae0c427 100644
--- a/pkgs/tools/graphics/yaxg/default.nix
+++ b/pkgs/tools/graphics/yaxg/default.nix
@@ -34,5 +34,6 @@ stdenv.mkDerivation rec {
     platforms = platforms.all;
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ neonfuz ];
+    mainProgram = "yaxg";
   };
 }
diff --git a/pkgs/tools/llm/gorilla-cli/default.nix b/pkgs/tools/llm/gorilla-cli/default.nix
index ff5e3468ef91..276793c2c8bc 100644
--- a/pkgs/tools/llm/gorilla-cli/default.nix
+++ b/pkgs/tools/llm/gorilla-cli/default.nix
@@ -34,5 +34,6 @@ python3.pkgs.buildPythonApplication rec {
     homepage = "https://github.com/gorilla-llm/gorilla-cli";
     license = licenses.asl20;
     maintainers = with maintainers; [ happysalada ];
+    mainProgram = "gorilla";
   };
 }
diff --git a/pkgs/tools/misc/broot/default.nix b/pkgs/tools/misc/broot/default.nix
index de0fd1a11559..4541d41299d1 100644
--- a/pkgs/tools/misc/broot/default.nix
+++ b/pkgs/tools/misc/broot/default.nix
@@ -16,16 +16,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "broot";
-  version = "1.27.0";
+  version = "1.28.1";
 
   src = fetchFromGitHub {
     owner = "Canop";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-yZsb/G+8XoJS4Fg6WFuEk1v3Ht5i3G3p+sKi+Z3jeGU=";
+    hash = "sha256-zq63PfKVcCLudsIBugGQIozG4Ve4vgBwYz0ID5k1J5o=";
   };
 
-  cargoHash = "sha256-xHmrFIXXkuhYGApgNoJxcL1Kpf8ellwQgiH8AEZvDRU=";
+  cargoHash = "sha256-jjov7kW6iH+Tfi5XBjMFbRk0a4HRYZ7pWm+Aa0hUndM=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/tools/misc/chezmoi/default.nix b/pkgs/tools/misc/chezmoi/default.nix
index 88812357a9c0..5e2bd00dd30a 100644
--- a/pkgs/tools/misc/chezmoi/default.nix
+++ b/pkgs/tools/misc/chezmoi/default.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "chezmoi";
-  version = "2.40.4";
+  version = "2.41.0";
 
   src = fetchFromGitHub {
     owner = "twpayne";
     repo = "chezmoi";
     rev = "v${version}";
-    hash = "sha256-PtIT2PS88jkX/ERHYKRwhvCnCnlAP0lM0FDv74zi32M=";
+    hash = "sha256-N1KzSpNKwh8OyxtgPdRvhEwO/q9/o9yS6mr3sV7fF6k=";
   };
 
-  vendorHash = "sha256-O9Ywq8LunS/0yBX9p9M2mzm+auvX1ynYaAY4EoBaE94=";
+  vendorHash = "sha256-SoSRSKG7tb09hFu2KZBKtA3/6YY9xbI0dKlCHMwytdI=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/misc/edid-generator/default.nix b/pkgs/tools/misc/edid-generator/default.nix
index 09402111fb66..fc7f01226972 100644
--- a/pkgs/tools/misc/edid-generator/default.nix
+++ b/pkgs/tools/misc/edid-generator/default.nix
@@ -5,43 +5,63 @@
 , edid-decode
 , hexdump
 , zsh
-, modelines ? [ ] # Modeline "1280x800"   83.50  1280 1352 1480 1680  800 803 809 831 -hsync +vsync
-, clean ? false # should it skip all, but explicitly listed modelines?
 }:
 
 # Usage:
-#   (edid-generator.override {
+#   hardware.firmware = [(edid-generator.overrideAttrs {
 #     clean = true;
-#     modelines = [
-#       ''Modeline "PG278Q_2560x1440"       241.50   2560 2608 2640 2720   1440 1443 1448 1481   -hsync +vsync''
-#       ''Modeline "PG278Q_2560x1440@120"   497.75   2560 2608 2640 2720   1440 1443 1448 1525   +hsync -vsync''
-#       ''Modeline "U2711_2560x1440"        241.50   2560 2600 2632 2720   1440 1443 1448 1481   -hsync +vsync''
-#     ];
-#   })
-
-stdenv.mkDerivation rec {
+#     modelines = ''
+#       Modeline "PG278Q_60"      241.50   2560 2608 2640 2720   1440 1443 1448 1481   -hsync +vsync
+#       Modeline "PG278Q_120"     497.75   2560 2608 2640 2720   1440 1443 1448 1525   +hsync -vsync
+#       Modeline "U2711_60"       241.50   2560 2600 2632 2720   1440 1443 1448 1481   -hsync +vsync
+#     '';
+#   })];
+
+stdenv.mkDerivation {
   pname = "edid-generator";
-  version = "unstable-2018-03-15";
+  version = "master-2023-11-20";
+
+  # so `hardware.firmware` doesn't compress it
+  compressFirmware = false;
 
   src = fetchFromGitHub {
     owner = "akatrevorjay";
     repo = "edid-generator";
-    rev = "31a6f80784d289d2faa8c4ca4788409c83b3ea14";
-    sha256 = "0j6wqzx5frca8b5i6812vvr5iwk7440fka70bmqn00k0vfhsc2x3";
+    rev = "476a016d8b488df749bf6d6efbf7b9fbfb2e3cb8";
+    sha256 = "sha256-UGxze273VB5cQDWrv9X/Lam6WbOu9U3bro8GcVbEvws=";
   };
 
   nativeBuildInputs = [ dos2unix edid-decode hexdump zsh ];
 
   postPatch = ''
     patchShebangs modeline2edid
-    # allows makefile to discover prefixes and suffixes in addition to just `[0-9]*x[0-9]*.S`
-    awk -i inplace '/^SOURCES\t/ { print "SOURCES\t:= $(wildcard *[0-9]*x[0-9]**.S)"; next; }; { print; }' Makefile
   '';
 
+  passAsFile = [ "modelines" ];
+  clean = false;
+  modelines = "";
+
   configurePhase = ''
-    test '${toString clean}' != 1 || rm *x*.S
-    ${lib.concatMapStringsSep "\n" (m: "./modeline2edid - <<<'${m}'") modelines}
-    make clean all
+    test "$clean" != 1 || rm *x*.S
+    ./modeline2edid - <"$modelinesPath"
+
+    for file in *.S ; do
+      echo "--- generated file: $file"
+      cat "$file"
+    done
+    make clean
+  '';
+
+  buildPhase = ''
+    make all
+  '';
+
+  doCheck = true;
+  checkPhase = ''
+    for file in *.bin ; do
+      echo "validating $file"
+      edid-decode <"$file"
+    done
   '';
 
   installPhase = ''
@@ -51,7 +71,7 @@ stdenv.mkDerivation rec {
   meta = {
     description = "Hackerswork to generate an EDID blob from given Xorg Modelines";
     homepage = "https://github.com/akatrevorjay/edid-generator";
-    license = lib.licenses.mit;
+    license = lib.licenses.gpl3;
     maintainers = with lib.maintainers; [ flokli nazarewk ];
     platforms = lib.platforms.all;
     broken = stdenv.isDarwin; # never built on Hydra https://hydra.nixos.org/job/nixpkgs/trunk/edid-generator.x86_64-darwin
diff --git a/pkgs/tools/misc/figlet/default.nix b/pkgs/tools/misc/figlet/default.nix
index b297b03d86ba..f959440fc2ea 100644
--- a/pkgs/tools/misc/figlet/default.nix
+++ b/pkgs/tools/misc/figlet/default.nix
@@ -23,6 +23,10 @@ stdenv.mkDerivation rec {
     })
   ];
 
+  env = lib.optionalAttrs stdenv.cc.isClang {
+    NIX_CFLAGS_COMPILE = "-Wno-error=implicit-function-declaration";
+  };
+
   makeFlags = [ "prefix=$(out)" "CC:=$(CC)" "LD:=$(CC)" ];
 
   postInstall = "cp -ar ${contributed}/* $out/share/figlet/";
diff --git a/pkgs/tools/misc/parallel/default.nix b/pkgs/tools/misc/parallel/default.nix
index 9b223c12f8f4..a2aee41eff75 100644
--- a/pkgs/tools/misc/parallel/default.nix
+++ b/pkgs/tools/misc/parallel/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "parallel";
-  version = "20230922";
+  version = "20231022";
 
   src = fetchurl {
     url = "mirror://gnu/parallel/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-EUR0Ft1eXfZQE897RULhQJOKO/1fPzCVye2xaPy/4GM=";
+    sha256 = "sha256-k/K5TxhQeYpLXdoiva6G2ramVl41JYYOCORvJWPzJow=";
   };
 
   outputs = [ "out" "man" "doc" ];
diff --git a/pkgs/tools/security/agebox/default.nix b/pkgs/tools/security/agebox/default.nix
index ea50c8779b3d..b87cb2b8ca2a 100644
--- a/pkgs/tools/security/agebox/default.nix
+++ b/pkgs/tools/security/agebox/default.nix
@@ -25,5 +25,6 @@ buildGoModule rec {
     description = "Age based repository file encryption gitops tool";
     license = licenses.asl20;
     maintainers = with maintainers; [ lesuisse ];
+    mainProgram = "agebox";
   };
 }
diff --git a/pkgs/tools/security/apkleaks/default.nix b/pkgs/tools/security/apkleaks/default.nix
index 133601e4025f..29a0b17ccb32 100644
--- a/pkgs/tools/security/apkleaks/default.nix
+++ b/pkgs/tools/security/apkleaks/default.nix
@@ -33,5 +33,6 @@ python3.pkgs.buildPythonApplication rec {
     homepage = "https://github.com/dwisiswant0/apkleaks";
     license = with licenses; [ asl20 ];
     maintainers = with maintainers; [ fab ];
+    mainProgram = "apkleaks";
   };
 }
diff --git a/pkgs/tools/security/bao/default.nix b/pkgs/tools/security/bao/default.nix
index f948bccc5f43..503896885c13 100644
--- a/pkgs/tools/security/bao/default.nix
+++ b/pkgs/tools/security/bao/default.nix
@@ -20,5 +20,6 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/oconnor663/bao";
     maintainers = with lib.maintainers; [ amarshall ];
     license = with lib.licenses; [ cc0 asl20 ];
+    mainProgram = "bao";
   };
 }
diff --git a/pkgs/tools/security/bettercap/default.nix b/pkgs/tools/security/bettercap/default.nix
index 69736b4cc308..2ece9ee6e4c4 100644
--- a/pkgs/tools/security/bettercap/default.nix
+++ b/pkgs/tools/security/bettercap/default.nix
@@ -37,5 +37,6 @@ buildGoModule rec {
     homepage = "https://www.bettercap.org/";
     license = with licenses; [ gpl3Only ];
     maintainers = with maintainers; [ y0no ];
+    mainProgram = "bettercap";
   };
 }
diff --git a/pkgs/tools/security/chainsaw/Cargo.lock b/pkgs/tools/security/chainsaw/Cargo.lock
index d088da4d305c..28e3406db066 100644
--- a/pkgs/tools/security/chainsaw/Cargo.lock
+++ b/pkgs/tools/security/chainsaw/Cargo.lock
@@ -4,20 +4,21 @@ version = 3
 
 [[package]]
 name = "ahash"
-version = "0.8.3"
+version = "0.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c99f64d1e06488f620f932677e24bc6e2897582980441ae90a671415bd7ec2f"
+checksum = "91429305e9f0a25f6205c5b8e0d2db09e0708a7a6df0f42212bb56c32c8ac97a"
 dependencies = [
  "cfg-if",
  "once_cell",
  "version_check",
+ "zerocopy",
 ]
 
 [[package]]
 name = "aho-corasick"
-version = "1.1.1"
+version = "1.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ea5d730647d4fadd988536d06fecce94b7b4f2a7efdae548f1cf4b63205518ab"
+checksum = "b2969dcb958b36655471fc61f7e416fa76033bdd4bfed0678d8fee1e2d07a1f0"
 dependencies = [
  "memchr",
 ]
@@ -137,9 +138,9 @@ checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
 
 [[package]]
 name = "base64"
-version = "0.21.4"
+version = "0.21.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ba43ea6f343b788c8764558649e08df62f86c6ef251fdaeb1ffd010a9ae50a2"
+checksum = "35636a1494ede3b646cc98f74f8e62c773a38a659ebc777a2cf26b9b74171df9"
 
 [[package]]
 name = "bincode"
@@ -158,9 +159,9 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
 
 [[package]]
 name = "bitflags"
-version = "2.4.0"
+version = "2.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4682ae6287fcf752ecaabbfcc7b6f9b72aa33933dc23a554d853aea8eea8635"
+checksum = "327762f6e5a765692301e5bb513e0d9fef63be86bbc14528052b1cd3e6f03e07"
 
 [[package]]
 name = "blake3"
@@ -177,9 +178,9 @@ dependencies = [
 
 [[package]]
 name = "bstr"
-version = "1.6.2"
+version = "1.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c2f7349907b712260e64b0afe2f84692af14a454be26187d9df565c7f69266a"
+checksum = "542f33a8835a0884b006a0c3df3dadd99c0c3f296ed26c2fdc8028e01ad6230c"
 dependencies = [
  "memchr",
  "regex-automata",
@@ -194,9 +195,9 @@ checksum = "7f30e7476521f6f8af1a1c4c0b8cc94f0bee37d91763d0ca2665f299b6cd8aec"
 
 [[package]]
 name = "bytecount"
-version = "0.6.4"
+version = "0.6.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ad152d03a2c813c80bb94fedbf3a3f02b28f793e39e7c214c8a0bcc196343de7"
+checksum = "e1e5f035d16fc623ae5f74981db80a439803888314e3a555fd6f04acd51a3205"
 
 [[package]]
 name = "byteorder"
@@ -221,9 +222,9 @@ dependencies = [
 
 [[package]]
 name = "cargo-platform"
-version = "0.1.3"
+version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2cfa25e60aea747ec7e1124f238816749faa93759c6ff5b31f1ccdda137f4479"
+checksum = "e34637b3140142bdf929fb439e8aa4ebad7651ebf7b1080b3930aa16ac1459ff"
 dependencies = [
  "serde",
 ]
@@ -259,7 +260,7 @@ checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
 
 [[package]]
 name = "chainsaw"
-version = "2.8.0"
+version = "2.8.1"
 dependencies = [
  "aho-corasick",
  "anyhow",
@@ -269,7 +270,7 @@ dependencies = [
  "bytesize",
  "chrono",
  "chrono-tz",
- "clap 4.4.6",
+ "clap 4.4.8",
  "crossterm",
  "evtx",
  "hex",
@@ -282,7 +283,7 @@ dependencies = [
  "paste",
  "predicates",
  "prettytable-rs",
- "quick-xml 0.30.0",
+ "quick-xml 0.31.0",
  "rayon",
  "regex",
  "rustc-hash",
@@ -313,9 +314,9 @@ dependencies = [
 
 [[package]]
 name = "chrono-tz"
-version = "0.8.3"
+version = "0.8.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1369bc6b9e9a7dfdae2055f6ec151fe9c554a9d23d357c0237cee2e25eaabb7"
+checksum = "e23185c0e21df6ed832a12e2bda87c7d1def6842881fb634a8511ced741b0d76"
 dependencies = [
  "chrono",
  "chrono-tz-build",
@@ -325,9 +326,9 @@ dependencies = [
 
 [[package]]
 name = "chrono-tz-build"
-version = "0.2.0"
+version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2f5ebdc942f57ed96d560a6d1a459bae5851102a25d5bf89dc04ae453e31ecf"
+checksum = "433e39f13c9a060046954e0592a8d0a4bcb1040125cbf91cb8ee58964cfb350f"
 dependencies = [
  "parse-zoneinfo",
  "phf",
@@ -351,9 +352,9 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "4.4.6"
+version = "4.4.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d04704f56c2cde07f43e8e2c154b43f216dc5c92fc98ada720177362f953b956"
+checksum = "2275f18819641850fa26c89acc84d465c1bf91ce57bc2748b28c420473352f64"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -361,26 +362,26 @@ dependencies = [
 
 [[package]]
 name = "clap_builder"
-version = "4.4.6"
+version = "4.4.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0e231faeaca65ebd1ea3c737966bf858971cd38c3849107aa3ea7de90a804e45"
+checksum = "07cdf1b148b25c1e1f7a42225e30a0d99a615cd4637eae7365548dd4529b95bc"
 dependencies = [
  "anstream",
  "anstyle",
- "clap_lex 0.5.1",
+ "clap_lex 0.6.0",
  "strsim",
 ]
 
 [[package]]
 name = "clap_derive"
-version = "4.4.2"
+version = "4.4.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0862016ff20d69b84ef8247369fabf5c008a7417002411897d40ee1f4532b873"
+checksum = "cf9804afaaf59a91e75b022a30fb7229a7901f60c755489cc61c9b423b836442"
 dependencies = [
  "heck",
  "proc-macro2",
  "quote",
- "syn 2.0.38",
+ "syn 2.0.39",
 ]
 
 [[package]]
@@ -394,9 +395,9 @@ dependencies = [
 
 [[package]]
 name = "clap_lex"
-version = "0.5.1"
+version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cd7cc57abe963c6d3b9d8be5b06ba7c8957a930305ca90304f24ef040aa6f961"
+checksum = "702fc72eb24e5a1e48ce58027a675bc24edd52096d5397d4aea7c6dd9eca0bd1"
 
 [[package]]
 name = "colorchoice"
@@ -477,7 +478,7 @@ version = "0.27.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f476fe445d41c9e991fd07515a6f463074b782242ccf4a5b7b1d1012e70824df"
 dependencies = [
- "bitflags 2.4.0",
+ "bitflags 2.4.1",
  "crossterm_winapi",
  "libc",
  "mio",
@@ -519,9 +520,12 @@ dependencies = [
 
 [[package]]
 name = "deranged"
-version = "0.3.8"
+version = "0.3.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2696e8a945f658fd14dc3b87242e6b80cd0f36ff04ea560fa39082368847946"
+checksum = "0f32d04922c60427da6f9fef14d042d9edddef64cb9d4ce0d64d0685fbeb1fd3"
+dependencies = [
+ "powerfmt",
+]
 
 [[package]]
 name = "dialoguer"
@@ -669,26 +673,15 @@ checksum = "5443807d6dff69373d433ab9ef5378ad8df50ca6298caf15de6e52e24aaf54d5"
 
 [[package]]
 name = "errno"
-version = "0.3.4"
+version = "0.3.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "add4f07d43996f76ef320709726a556a9d4f965d9410d8d0271132d2f8293480"
+checksum = "f258a7194e7f7c2a7837a8913aeab7fd8c383457034fa20ce4dd3dcb813e8eb8"
 dependencies = [
- "errno-dragonfly",
  "libc",
  "windows-sys 0.48.0",
 ]
 
 [[package]]
-name = "errno-dragonfly"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aa68f1b12764fab894d2755d2518754e71b4fd80ecfb822714a1206c2aab39bf"
-dependencies = [
- "cc",
- "libc",
-]
-
-[[package]]
 name = "error-chain"
 version = "0.12.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -740,9 +733,9 @@ dependencies = [
 
 [[package]]
 name = "getrandom"
-version = "0.2.10"
+version = "0.2.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "be4136b2a15dd319360be1c07d9933517ccf0be8f16bf62a3bee4f0d618df427"
+checksum = "fe9006bed769170c11f845cf00c7c1e9092aeb3f268e007c3e760ac68008070f"
 dependencies = [
  "cfg-if",
  "libc",
@@ -772,9 +765,9 @@ dependencies = [
 
 [[package]]
 name = "hashbrown"
-version = "0.14.1"
+version = "0.14.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7dfda62a12f55daeae5015f81b0baea145391cb4520f86c248fc615d72640d12"
+checksum = "f93e7192158dbcda357bdec5fb5788eebf8bbac027f3f33e719d29135ae84156"
 
 [[package]]
 name = "heck"
@@ -805,16 +798,16 @@ checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
 
 [[package]]
 name = "iana-time-zone"
-version = "0.1.57"
+version = "0.1.58"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2fad5b825842d2b38bd206f3e81d6957625fd7f0a361e345c30e01a0ae2dd613"
+checksum = "8326b86b6cff230b97d0d312a6c40a60726df3332e721f72a1b035f451663b20"
 dependencies = [
  "android_system_properties",
  "core-foundation-sys",
  "iana-time-zone-haiku",
  "js-sys",
  "wasm-bindgen",
- "windows",
+ "windows-core",
 ]
 
 [[package]]
@@ -838,12 +831,12 @@ dependencies = [
 
 [[package]]
 name = "indexmap"
-version = "2.0.2"
+version = "2.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8adf3ddd720272c6ea8bf59463c04e0f93d0bbf7c5439b691bca2987e0270897"
+checksum = "d530e1a18b1cb4c484e6e34556a0d948706958449fca0cab753d649f2bce3d1f"
 dependencies = [
  "equivalent",
- "hashbrown 0.14.1",
+ "hashbrown 0.14.2",
 ]
 
 [[package]]
@@ -881,24 +874,13 @@ dependencies = [
 ]
 
 [[package]]
-name = "io-lifetimes"
-version = "1.0.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eae7b9aee968036d54dce06cebaefd919e4472e753296daccd6d344e3e2df0c2"
-dependencies = [
- "hermit-abi 0.3.3",
- "libc",
- "windows-sys 0.48.0",
-]
-
-[[package]]
 name = "is-terminal"
 version = "0.4.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cb0889898416213fab133e1d33a0e5858a48177452750691bde3666d0fdbaf8b"
 dependencies = [
  "hermit-abi 0.3.3",
- "rustix 0.38.17",
+ "rustix",
  "windows-sys 0.48.0",
 ]
 
@@ -928,18 +910,18 @@ checksum = "af150ab688ff2122fcef229be89cb50dd66af9e01a4ff320cc137eecc9bacc38"
 
 [[package]]
 name = "jobserver"
-version = "0.1.26"
+version = "0.1.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "936cfd212a0155903bcbc060e316fb6cc7cbf2e1907329391ebadc1fe0ce77c2"
+checksum = "8c37f63953c4c63420ed5fd3d6d398c719489b9f872b9fa683262f8edd363c7d"
 dependencies = [
  "libc",
 ]
 
 [[package]]
 name = "js-sys"
-version = "0.3.64"
+version = "0.3.65"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c5f195fe497f702db0f318b07fdd68edb16955aed830df8363d837542f8f935a"
+checksum = "54c0c35952f67de54bb584e9fd912b3023117cbafc0a77d8f3dee1fb5f572fe8"
 dependencies = [
  "wasm-bindgen",
 ]
@@ -952,9 +934,9 @@ checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
 
 [[package]]
 name = "libc"
-version = "0.2.149"
+version = "0.2.150"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a08173bc88b7955d1b3145aa561539096c421ac8debde8cbc3612ec635fee29b"
+checksum = "89d92a4743f9a61002fae18374ed11e7973f530cb3a3255fb354818118b2203c"
 
 [[package]]
 name = "libesedb"
@@ -977,22 +959,27 @@ dependencies = [
 ]
 
 [[package]]
-name = "linux-raw-sys"
-version = "0.3.8"
+name = "libredox"
+version = "0.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ef53942eb7bf7ff43a617b3e2c1c4a5ecf5944a7c1bc12d7ee39bbb15e5c1519"
+checksum = "85c833ca1e66078851dba29046874e38f08b2c883700aa29a03ddd3b23814ee8"
+dependencies = [
+ "bitflags 2.4.1",
+ "libc",
+ "redox_syscall",
+]
 
 [[package]]
 name = "linux-raw-sys"
-version = "0.4.8"
+version = "0.4.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3852614a3bd9ca9804678ba6be5e3b8ce76dfc902cae004e3e0c44051b6e88db"
+checksum = "969488b55f8ac402214f3f5fd243ebb7206cf82de60d3172994707a4bcc2b829"
 
 [[package]]
 name = "lock_api"
-version = "0.4.10"
+version = "0.4.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c1cc9717a20b1bb222f333e6a92fd32f7d8a18ddc5a3191a11af45dcbf4dcd16"
+checksum = "3c168f8615b12bc01f9c17e2eb0cc07dcae1940121185446edc3744920e8ef45"
 dependencies = [
  "autocfg",
  "scopeguard",
@@ -1044,7 +1031,7 @@ dependencies = [
  "bitflags 1.3.2",
  "byteorder",
  "chrono",
- "clap 4.4.6",
+ "clap 4.4.8",
  "csv",
  "dialoguer",
  "encoding",
@@ -1071,9 +1058,9 @@ checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
 
 [[package]]
 name = "mio"
-version = "0.8.8"
+version = "0.8.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "927a765cd3fc26206e66b296465fa9d3e5ab003e651c1b3c060e7956d96b19d2"
+checksum = "3dce281c5e46beae905d4de1870d8b1509a9142b62eedf18b443b011ca8343d0"
 dependencies = [
  "libc",
  "log",
@@ -1103,7 +1090,7 @@ version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "394a6bb8a521ac6140cf95b0a3b1c9a35c3ebccde7a0b13b7a3deb7039220024"
 dependencies = [
- "bitflags 2.4.0",
+ "bitflags 2.4.1",
  "blake3",
  "chrono",
  "crossterm",
@@ -1201,9 +1188,9 @@ dependencies = [
 
 [[package]]
 name = "num-traits"
-version = "0.2.16"
+version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f30b0abd723be7e2ffca1272140fac1a2f084c77ec3e123c192b66af1ee9e6c2"
+checksum = "39e3200413f237f41ab11ad6d161bc7239c84dcb631773ccd7de3dfe4b5c267c"
 dependencies = [
  "autocfg",
 ]
@@ -1231,9 +1218,9 @@ checksum = "dd8b5dd2ae5ed71462c540258bedcb51965123ad7e7ccf4b9a8cafaa4a63576d"
 
 [[package]]
 name = "os_str_bytes"
-version = "6.5.1"
+version = "6.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4d5d9eb14b174ee9aa2ef96dc2b94637a2d4b6e7cb873c7e171f0c20c6cf3eac"
+checksum = "e2355d85b9a3786f481747ced0e0ff2ba35213a1f9bd406ed906554d7af805a1"
 
 [[package]]
 name = "parking_lot"
@@ -1247,13 +1234,13 @@ dependencies = [
 
 [[package]]
 name = "parking_lot_core"
-version = "0.9.8"
+version = "0.9.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "93f00c865fe7cabf650081affecd3871070f26767e7b2070a3ffae14c654b447"
+checksum = "4c42a9226546d68acdd9c0a280d17ce19bfe27a46bf68784e4066115788d008e"
 dependencies = [
  "cfg-if",
  "libc",
- "redox_syscall 0.3.5",
+ "redox_syscall",
  "smallvec",
  "windows-targets 0.48.5",
 ]
@@ -1319,9 +1306,15 @@ checksum = "8afb450f006bf6385ca15ef45d71d2288452bc3683ce2e2cacc0d18e4be60b58"
 
 [[package]]
 name = "portable-atomic"
-version = "1.4.3"
+version = "1.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3bccab0e7fd7cc19f820a1c8c91720af652d0c88dc9664dd72aef2614f04af3b"
+
+[[package]]
+name = "powerfmt"
+version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "31114a898e107c51bb1609ffaf55a0e011cf6a4d7f1170d0015a165082c0338b"
+checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
 
 [[package]]
 name = "ppv-lite86"
@@ -1376,9 +1369,9 @@ dependencies = [
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.68"
+version = "1.0.69"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b1106fec09662ec6dd98ccac0f81cef56984d0b49f75c92d8cbad76e20c005c"
+checksum = "134c189feb4956b20f6f547d2cf727d4c0fe06722b20a0eec87ed445a97f92da"
 dependencies = [
  "unicode-ident",
 ]
@@ -1405,9 +1398,9 @@ dependencies = [
 
 [[package]]
 name = "quick-xml"
-version = "0.30.0"
+version = "0.31.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eff6510e86862b57b210fd8cbe8ed3f0d7d600b9c2863cd4549a2e033c66e956"
+checksum = "1004a344b30a54e2ee58d66a71b32d2db2feb0a31f9a2d302bf0536f15de2a33"
 dependencies = [
  "memchr",
  "serde",
@@ -1474,38 +1467,29 @@ dependencies = [
 
 [[package]]
 name = "redox_syscall"
-version = "0.2.16"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fb5a58c1855b4b6819d59012155603f0b22ad30cad752600aadfcb695265519a"
-dependencies = [
- "bitflags 1.3.2",
-]
-
-[[package]]
-name = "redox_syscall"
-version = "0.3.5"
+version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "567664f262709473930a4bf9e51bf2ebf3348f2e748ccc50dea20646858f8f29"
+checksum = "4722d768eff46b75989dd134e5c353f0d6296e5aaa3132e776cbdb56be7731aa"
 dependencies = [
  "bitflags 1.3.2",
 ]
 
 [[package]]
 name = "redox_users"
-version = "0.4.3"
+version = "0.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b033d837a7cf162d7993aded9304e30a83213c648b6e389db233191f891e5c2b"
+checksum = "a18479200779601e498ada4e8c1e1f50e3ee19deb0259c25825a98b5603b2cb4"
 dependencies = [
  "getrandom",
- "redox_syscall 0.2.16",
+ "libredox",
  "thiserror",
 ]
 
 [[package]]
 name = "regex"
-version = "1.9.6"
+version = "1.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ebee201405406dbf528b8b672104ae6d6d63e6d118cb10e4d51abbc7b58044ff"
+checksum = "380b951a9c5e80ddfd6136919eef32310721aa4aacd4889a8d39124b026ab343"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -1515,9 +1499,9 @@ dependencies = [
 
 [[package]]
 name = "regex-automata"
-version = "0.3.9"
+version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "59b23e92ee4318893fa3fe3e6fb365258efbfe6ac6ab30f090cdcbb7aa37efa9"
+checksum = "5f804c7828047e88b2d32e2d7fe5a105da8ee3264f01902f796c8e067dc2483f"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -1526,9 +1510,9 @@ dependencies = [
 
 [[package]]
 name = "regex-syntax"
-version = "0.7.5"
+version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dbb5fb1acd8a1a18b3dd5be62d25485eb770e05afb408a9627d14d451bae12da"
+checksum = "c08c74e62047bb2de4ff487b251e4a92e24f48745648451635cec7d591162d9f"
 
 [[package]]
 name = "rustc-hash"
@@ -1538,28 +1522,14 @@ checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
 
 [[package]]
 name = "rustix"
-version = "0.37.24"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4279d76516df406a8bd37e7dff53fd37d1a093f997a3c34a5c21658c126db06d"
-dependencies = [
- "bitflags 1.3.2",
- "errno",
- "io-lifetimes",
- "libc",
- "linux-raw-sys 0.3.8",
- "windows-sys 0.48.0",
-]
-
-[[package]]
-name = "rustix"
-version = "0.38.17"
+version = "0.38.25"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f25469e9ae0f3d0047ca8b93fc56843f38e6774f0914a107ff8b41be8be8e0b7"
+checksum = "dc99bc2d4f1fed22595588a013687477aedf3cdcfb26558c559edb67b4d9b22e"
 dependencies = [
- "bitflags 2.4.0",
+ "bitflags 2.4.1",
  "errno",
  "libc",
- "linux-raw-sys 0.4.8",
+ "linux-raw-sys",
  "windows-sys 0.48.0",
 ]
 
@@ -1592,38 +1562,38 @@ checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
 [[package]]
 name = "semver"
-version = "1.0.19"
+version = "1.0.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ad977052201c6de01a8ef2aa3378c4bd23217a056337d1d6da40468d267a4fb0"
+checksum = "836fa6a3e1e547f9a2c4040802ec865b5d85f4014efe00555d7090a3dcaa1090"
 dependencies = [
  "serde",
 ]
 
 [[package]]
 name = "serde"
-version = "1.0.188"
+version = "1.0.193"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf9e0fcba69a370eed61bcf2b728575f726b50b55cba78064753d708ddc7549e"
+checksum = "25dd9975e68d0cb5aa1120c288333fc98731bd1dd12f561e468ea4728c042b89"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.188"
+version = "1.0.193"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4eca7ac642d82aa35b60049a6eccb4be6be75e599bd2e9adb5f875a737654af2"
+checksum = "43576ca501357b9b071ac53cdc7da8ef0cbd9493d8df094cd821777ea6e894d3"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.38",
+ "syn 2.0.39",
 ]
 
 [[package]]
 name = "serde_json"
-version = "1.0.107"
+version = "1.0.108"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6b420ce6e3d8bd882e9b243c6eed35dbc9a6110c9769e74b584e0d68d1f20c65"
+checksum = "3d1c7e3eac408d115102c4c24ad393e0821bb3a5df4d506a80f85f7a742a526b"
 dependencies = [
  "itoa",
  "ryu",
@@ -1632,11 +1602,11 @@ dependencies = [
 
 [[package]]
 name = "serde_yaml"
-version = "0.9.25"
+version = "0.9.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a49e178e4452f45cb61d0cd8cebc1b0fafd3e41929e996cef79aa3aca91f574"
+checksum = "3cc7a1570e38322cfe4154732e5110f887ea57e22b76f4bfd32b5bdd3368666c"
 dependencies = [
- "indexmap 2.0.2",
+ "indexmap 2.1.0",
  "itoa",
  "ryu",
  "serde",
@@ -1713,9 +1683,9 @@ dependencies = [
 
 [[package]]
 name = "smallvec"
-version = "1.11.1"
+version = "1.11.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "942b4a808e05215192e39f4ab80813e599068285906cc91aa64f923db842bd5a"
+checksum = "4dccd0940a2dcdf68d092b8cbab7dc0ad8fa938bf95787e1b916b0e3d0e8e970"
 
 [[package]]
 name = "strsim"
@@ -1725,15 +1695,15 @@ checksum = "73473c0e59e6d5812c5dfe2a064a6444949f089e20eec9a2e5506596494e4623"
 
 [[package]]
 name = "strum_macros"
-version = "0.25.2"
+version = "0.25.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ad8d03b598d3d0fff69bf533ee3ef19b8eeb342729596df84bcc7e1f96ec4059"
+checksum = "23dc1fa9ac9c169a78ba62f0b841814b7abae11bdd047b9c58f893439e309ea0"
 dependencies = [
  "heck",
  "proc-macro2",
  "quote",
  "rustversion",
- "syn 2.0.38",
+ "syn 2.0.39",
 ]
 
 [[package]]
@@ -1749,9 +1719,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "2.0.38"
+version = "2.0.39"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e96b79aaa137db8f61e26363a0c9b47d8b4ec75da28b7d1d614c2303e232408b"
+checksum = "23e78b90f2fcf45d3e842032ce32e3f2d1545ba6636271dcbf24fa306d87be7a"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1775,14 +1745,14 @@ dependencies = [
 
 [[package]]
 name = "tempfile"
-version = "3.8.0"
+version = "3.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cb94d2f3cc536af71caac6b6fcebf65860b347e7ce0cc9ebe8f70d3e521054ef"
+checksum = "7ef1adac450ad7f4b3c28589471ade84f25f731a7a0fe30d71dfa9f60fd808e5"
 dependencies = [
  "cfg-if",
  "fastrand",
- "redox_syscall 0.3.5",
- "rustix 0.38.17",
+ "redox_syscall",
+ "rustix",
  "windows-sys 0.48.0",
 ]
 
@@ -1808,11 +1778,11 @@ dependencies = [
 
 [[package]]
 name = "terminal_size"
-version = "0.2.6"
+version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e6bf6f19e9f8ed8d4048dc22981458ebcf406d67e94cd422e5ecd73d63b3237"
+checksum = "21bebf2b7c9e0a515f6e0f8c51dc0f8e4696391e6f1ff30379559f8365fb0df7"
 dependencies = [
- "rustix 0.37.24",
+ "rustix",
  "windows-sys 0.48.0",
 ]
 
@@ -1830,34 +1800,35 @@ checksum = "222a222a5bfe1bba4a77b45ec488a741b3cb8872e5e499451fd7d0129c9c7c3d"
 
 [[package]]
 name = "thiserror"
-version = "1.0.49"
+version = "1.0.50"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1177e8c6d7ede7afde3585fd2513e611227efd6481bd78d2e82ba1ce16557ed4"
+checksum = "f9a7210f5c9a7156bb50aa36aed4c95afb51df0df00713949448cf9e97d382d2"
 dependencies = [
  "thiserror-impl",
 ]
 
 [[package]]
 name = "thiserror-impl"
-version = "1.0.49"
+version = "1.0.50"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "10712f02019e9288794769fba95cd6847df9874d49d871d062172f9dd41bc4cc"
+checksum = "266b2e40bc00e5a6c09c3584011e08b06f123c00362c92b975ba9843aaaa14b8"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.38",
+ "syn 2.0.39",
 ]
 
 [[package]]
 name = "time"
-version = "0.3.29"
+version = "0.3.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "426f806f4089c493dcac0d24c29c01e2c38baf8e30f1b716ee37e83d200b18fe"
+checksum = "c4a34ab300f2dee6e562c10a046fc05e358b29f9bf92277f30c3c8d82275f6f5"
 dependencies = [
  "deranged",
  "itoa",
  "libc",
  "num_threads",
+ "powerfmt",
  "serde",
  "time-core",
  "time-macros",
@@ -1880,11 +1851,10 @@ dependencies = [
 
 [[package]]
 name = "tracing"
-version = "0.1.37"
+version = "0.1.40"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ce8c33a8d48bd45d624a6e523445fd21ec13d3653cd51f681abf67418f54eb8"
+checksum = "c3523ab5a71916ccf420eebdf5521fcef02141234bbc0b8a49f2fdc4544364ef"
 dependencies = [
- "cfg-if",
  "pin-project-lite",
  "tracing-attributes",
  "tracing-core",
@@ -1892,20 +1862,20 @@ dependencies = [
 
 [[package]]
 name = "tracing-attributes"
-version = "0.1.26"
+version = "0.1.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f4f31f56159e98206da9efd823404b79b6ef3143b4a7ab76e67b1751b25a4ab"
+checksum = "34704c8d6ebcbc939824180af020566b01a7c01f80641264eba0999f6c2b6be7"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.38",
+ "syn 2.0.39",
 ]
 
 [[package]]
 name = "tracing-core"
-version = "0.1.31"
+version = "0.1.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0955b8137a1df6f1a2e9a37d8a6656291ff0297c1a97c24e0d8425fe2312f79a"
+checksum = "c06d3da6113f116aaee68e4d601191614c9053067f9ab7f6edbcb161237daa54"
 dependencies = [
  "once_cell",
 ]
@@ -1945,9 +1915,9 @@ checksum = "711b9620af191e0cdc7468a8d14e709c3dcdb115b36f838e601583af800a370a"
 
 [[package]]
 name = "uuid"
-version = "1.4.1"
+version = "1.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "79daa5ed5740825c40b389c5e50312b9c86df53fccd33f281df655642b43869d"
+checksum = "5e395fcf16a7a3d8127ec99782007af141946b4795001f876d54fb0d55978560"
 dependencies = [
  "getrandom",
  "serde",
@@ -1986,9 +1956,9 @@ checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.87"
+version = "0.2.88"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7706a72ab36d8cb1f80ffbf0e071533974a60d0a308d01a5d0375bf60499a342"
+checksum = "7daec296f25a1bae309c0cd5c29c4b260e510e6d813c286b19eaadf409d40fce"
 dependencies = [
  "cfg-if",
  "wasm-bindgen-macro",
@@ -1996,24 +1966,24 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-backend"
-version = "0.2.87"
+version = "0.2.88"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ef2b6d3c510e9625e5fe6f509ab07d66a760f0885d858736483c32ed7809abd"
+checksum = "e397f4664c0e4e428e8313a469aaa58310d302159845980fd23b0f22a847f217"
 dependencies = [
  "bumpalo",
  "log",
  "once_cell",
  "proc-macro2",
  "quote",
- "syn 2.0.38",
+ "syn 2.0.39",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.87"
+version = "0.2.88"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dee495e55982a3bd48105a7b947fd2a9b4a8ae3010041b9e0faab3f9cd028f1d"
+checksum = "5961017b3b08ad5f3fe39f1e79877f8ee7c23c5e5fd5eb80de95abc41f1f16b2"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -2021,22 +1991,22 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.87"
+version = "0.2.88"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "54681b18a46765f095758388f2d0cf16eb8d4169b639ab575a8f5693af210c7b"
+checksum = "c5353b8dab669f5e10f5bd76df26a9360c748f054f862ff5f3f8aae0c7fb3907"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.38",
+ "syn 2.0.39",
  "wasm-bindgen-backend",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.87"
+version = "0.2.88"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca6ad05a4870b2bf5fe995117d3728437bd27d7cd5f06f13c17443ef369775a1"
+checksum = "0d046c5d029ba91a1ed14da14dca44b68bf2f124cfbaf741c54151fdb3e0750b"
 
 [[package]]
 name = "winapi"
@@ -2070,10 +2040,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
-name = "windows"
-version = "0.48.0"
+name = "windows-core"
+version = "0.51.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e686886bc078bc1b0b600cac0147aadb815089b6e4da64016cbd754b6342700f"
+checksum = "f1f8cf84f35d2db49a46868f947758c7a1138116f7fac3bc844f43ade1292e64"
 dependencies = [
  "windows-targets 0.48.5",
 ]
@@ -2228,7 +2198,27 @@ dependencies = [
 ]
 
 [[package]]
+name = "zerocopy"
+version = "0.7.26"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e97e415490559a91254a2979b4829267a57d2fcd741a98eee8b722fb57289aa0"
+dependencies = [
+ "zerocopy-derive",
+]
+
+[[package]]
+name = "zerocopy-derive"
+version = "0.7.26"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dd7e48ccf166952882ca8bd778a43502c64f33bf94c12ebe2a7f08e5a0f6689f"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.39",
+]
+
+[[package]]
 name = "zeroize"
-version = "1.6.0"
+version = "1.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2a0956f1ba7c7909bfb66c2e9e4124ab6f6482560f6628b5aaeba39207c9aad9"
+checksum = "525b4ec142c6b68a2d10f01f7bbf6755599ca3f81ea53b8431b7dd348f5fdb2d"
diff --git a/pkgs/tools/security/chainsaw/default.nix b/pkgs/tools/security/chainsaw/default.nix
index 17208b71bde6..8375cccd0bdd 100644
--- a/pkgs/tools/security/chainsaw/default.nix
+++ b/pkgs/tools/security/chainsaw/default.nix
@@ -7,13 +7,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "chainsaw";
-  version = "2.8.0";
+  version = "2.8.1";
 
   src = fetchFromGitHub {
     owner = "WithSecureLabs";
     repo = "chainsaw";
     rev = "refs/tags/v${version}";
-    hash = "sha256-IBMMZ4NKD7BR3l06C7Y7pRL+pB8p6Ssx6RoXlH2XKyg=";
+    hash = "sha256-YEw/rN7X+npc9M8XdPGAZyYXSQOGiR0w9Wb3W63g8VU=";
   };
 
   cargoLock = {
diff --git a/pkgs/tools/security/chkrootkit/default.nix b/pkgs/tools/security/chkrootkit/default.nix
index 7c3af075a552..ad14c1cd3997 100644
--- a/pkgs/tools/security/chkrootkit/default.nix
+++ b/pkgs/tools/security/chkrootkit/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "chkrootkit";
-  version = "0.55";
+  version = "0.58b";
 
   src = fetchurl {
     url = "ftp://ftp.chkrootkit.org/pub/seg/pac/${pname}-${version}.tar.gz";
-    sha256 = "sha256-qBwChuxEkxP5U3ASAqAOgbIE/Cz0PieFhaEcEqXgJYs=";
+    sha256 = "sha256-de0qzoHw+j6cP7ZNqw6IV+1ZJH6nVfWJhBb+ssZoB7k=";
   };
 
   # TODO: a lazy work-around for linux build failure ...
diff --git a/pkgs/tools/security/cmospwd/default.nix b/pkgs/tools/security/cmospwd/default.nix
index 969298918055..e80b7256e50c 100644
--- a/pkgs/tools/security/cmospwd/default.nix
+++ b/pkgs/tools/security/cmospwd/default.nix
@@ -34,6 +34,6 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://www.cgsecurity.org/wiki/CmosPwd";
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ t4ccer ];
-    platforms = platforms.x86_64;
+    platforms = [ "x86_64-linux" ];
   };
 })
diff --git a/pkgs/tools/security/ctmg/default.nix b/pkgs/tools/security/ctmg/default.nix
index b08af06825e3..81d57513aac3 100644
--- a/pkgs/tools/security/ctmg/default.nix
+++ b/pkgs/tools/security/ctmg/default.nix
@@ -17,5 +17,6 @@ stdenv.mkDerivation rec {
     license = licenses.isc;
     maintainers = with maintainers; [ mrVanDalo ];
     platforms = platforms.linux;
+    mainProgram = "ctmg";
   };
 }
diff --git a/pkgs/tools/security/cyclonedx-gomod/default.nix b/pkgs/tools/security/cyclonedx-gomod/default.nix
index 1c404aa3f836..d9e740fcf644 100644
--- a/pkgs/tools/security/cyclonedx-gomod/default.nix
+++ b/pkgs/tools/security/cyclonedx-gomod/default.nix
@@ -25,5 +25,6 @@ buildGoModule rec {
     changelog = "https://github.com/CycloneDX/cyclonedx-gomod/releases/tag/v${version}";
     license = licenses.asl20;
     maintainers = with maintainers; [ fab ];
+    mainProgram = "cyclonedx-gomod";
   };
 }
diff --git a/pkgs/tools/security/dalfox/default.nix b/pkgs/tools/security/dalfox/default.nix
index 85fc3c55a3b0..b6d21b801efc 100644
--- a/pkgs/tools/security/dalfox/default.nix
+++ b/pkgs/tools/security/dalfox/default.nix
@@ -25,5 +25,6 @@ buildGoModule rec {
     changelog = "https://github.com/hahwul/dalfox/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
+    mainProgram = "dalfox";
   };
 }
diff --git a/pkgs/tools/security/dismember/default.nix b/pkgs/tools/security/dismember/default.nix
index 2dffd8116b9c..cb2dd99b45c5 100644
--- a/pkgs/tools/security/dismember/default.nix
+++ b/pkgs/tools/security/dismember/default.nix
@@ -21,5 +21,6 @@ buildGoModule rec {
     homepage = "https://github.com/liamg/dismember";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
+    mainProgram = "dismember";
   };
 }
diff --git a/pkgs/tools/security/erosmb/default.nix b/pkgs/tools/security/erosmb/default.nix
index b7984feac513..f03e9a958de2 100644
--- a/pkgs/tools/security/erosmb/default.nix
+++ b/pkgs/tools/security/erosmb/default.nix
@@ -44,5 +44,6 @@ python3.pkgs.buildPythonApplication rec {
     changelog = "https://github.com/viktor02/EroSmb/releases/tag/v${version}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
+    mainProgram = "erosmb";
   };
 }
diff --git a/pkgs/tools/security/feroxbuster/default.nix b/pkgs/tools/security/feroxbuster/default.nix
index 7ff4c2e12458..18af1a0f1c48 100644
--- a/pkgs/tools/security/feroxbuster/default.nix
+++ b/pkgs/tools/security/feroxbuster/default.nix
@@ -47,6 +47,7 @@ rustPlatform.buildRustPackage rec {
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
     platforms = platforms.unix;
+    mainProgram = "feroxbuster";
   };
 }
 
diff --git a/pkgs/tools/security/fscan/default.nix b/pkgs/tools/security/fscan/default.nix
index f334555ad1ec..cda7fb968d3d 100644
--- a/pkgs/tools/security/fscan/default.nix
+++ b/pkgs/tools/security/fscan/default.nix
@@ -19,5 +19,6 @@ buildGoModule rec {
     license = licenses.mit;
     maintainers = with maintainers; [ Misaka13514 ];
     platforms = with platforms; unix ++ windows;
+    mainProgram = "fscan";
   };
 }
diff --git a/pkgs/tools/security/gen-oath-safe/default.nix b/pkgs/tools/security/gen-oath-safe/default.nix
index bb607c1fbd32..9ce87ac3bdd1 100644
--- a/pkgs/tools/security/gen-oath-safe/default.nix
+++ b/pkgs/tools/security/gen-oath-safe/default.nix
@@ -38,6 +38,7 @@ stdenv.mkDerivation rec {
     platforms =  platforms.unix;
     license = licenses.mit;
     maintainers = [ maintainers.makefu ];
+    mainProgram = "gen-oath-safe";
   };
 
 }
diff --git a/pkgs/tools/security/go-dork/default.nix b/pkgs/tools/security/go-dork/default.nix
index 5e6c21d2397b..d5b999d96990 100644
--- a/pkgs/tools/security/go-dork/default.nix
+++ b/pkgs/tools/security/go-dork/default.nix
@@ -22,5 +22,6 @@ buildGoModule rec {
     changelog = "https://github.com/dwisiswant0/go-dork/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
+    mainProgram = "go-dork";
   };
 }
diff --git a/pkgs/tools/security/hash-identifier/default.nix b/pkgs/tools/security/hash-identifier/default.nix
index 5e9b49dd73db..2f54d5e6904f 100644
--- a/pkgs/tools/security/hash-identifier/default.nix
+++ b/pkgs/tools/security/hash-identifier/default.nix
@@ -23,5 +23,6 @@ python3Packages.buildPythonApplication rec {
     license = licenses.gpl3Plus;
     platforms = platforms.unix;
     maintainers = with maintainers; [ ethancedwards8 ];
+    mainProgram = "hash-identifier";
   };
 }
diff --git a/pkgs/tools/security/hcxdumptool/default.nix b/pkgs/tools/security/hcxdumptool/default.nix
index 3e51d300e9a3..c718ec0b5a0f 100644
--- a/pkgs/tools/security/hcxdumptool/default.nix
+++ b/pkgs/tools/security/hcxdumptool/default.nix
@@ -21,5 +21,6 @@ stdenv.mkDerivation rec {
     license = licenses.mit;
     platforms = platforms.linux;
     maintainers = with maintainers; [ danielfullmer ];
+    mainProgram = "hcxdumptool";
   };
 }
diff --git a/pkgs/tools/security/ic-keysmith/default.nix b/pkgs/tools/security/ic-keysmith/default.nix
index c3fd58933a3b..30ca2a467576 100644
--- a/pkgs/tools/security/ic-keysmith/default.nix
+++ b/pkgs/tools/security/ic-keysmith/default.nix
@@ -18,5 +18,6 @@ buildGoModule rec {
     homepage = "https://github.com/dfinity/keysmith";
     license = licenses.mit;
     maintainers = with maintainers; [ imalison ];
+    mainProgram = "keysmith";
   };
 }
diff --git a/pkgs/tools/security/jwt-hack/default.nix b/pkgs/tools/security/jwt-hack/default.nix
index 351414b25eee..4922f67fe576 100644
--- a/pkgs/tools/security/jwt-hack/default.nix
+++ b/pkgs/tools/security/jwt-hack/default.nix
@@ -21,5 +21,6 @@ buildGoModule rec {
     homepage = "https://github.com/hahwul/jwt-hack";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
+    mainProgram = "jwt-hack";
   };
 }
diff --git a/pkgs/tools/security/kepler/default.nix b/pkgs/tools/security/kepler/default.nix
index f4a229030f1d..e4d2fc914cf9 100644
--- a/pkgs/tools/security/kepler/default.nix
+++ b/pkgs/tools/security/kepler/default.nix
@@ -43,5 +43,6 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/Exein-io/kepler";
     license = licenses.asl20;
     maintainers = with maintainers; [ fab ];
+    mainProgram = "kepler";
   };
 }
diff --git a/pkgs/tools/security/kube-hunter/default.nix b/pkgs/tools/security/kube-hunter/default.nix
index 05ee083f4d77..f80f5c70c98c 100644
--- a/pkgs/tools/security/kube-hunter/default.nix
+++ b/pkgs/tools/security/kube-hunter/default.nix
@@ -59,5 +59,6 @@ python3.pkgs.buildPythonApplication rec {
     homepage = "https://github.com/aquasecurity/kube-hunter";
     license = with licenses; [ asl20 ];
     maintainers = with maintainers; [ fab ];
+    mainProgram = "kube-hunter";
   };
 }
diff --git a/pkgs/tools/security/kubestroyer/default.nix b/pkgs/tools/security/kubestroyer/default.nix
index bbe0d9cad7a3..8e0922e4dfb0 100644
--- a/pkgs/tools/security/kubestroyer/default.nix
+++ b/pkgs/tools/security/kubestroyer/default.nix
@@ -27,5 +27,6 @@ buildGoModule rec {
     changelog = "https://github.com/Rolix44/Kubestroyer/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
+    mainProgram = "kubestroyer";
   };
 }
diff --git a/pkgs/tools/security/ldapnomnom/default.nix b/pkgs/tools/security/ldapnomnom/default.nix
index 132ecf70591a..65e874d06691 100644
--- a/pkgs/tools/security/ldapnomnom/default.nix
+++ b/pkgs/tools/security/ldapnomnom/default.nix
@@ -22,5 +22,6 @@ buildGoModule rec {
     changelog = "https://github.com/lkarlslund/ldapnomnom/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
+    mainProgram = "ldapnomnom";
   };
 }
diff --git a/pkgs/tools/security/lethe/default.nix b/pkgs/tools/security/lethe/default.nix
index 0e63b0db2a53..eb3474293814 100644
--- a/pkgs/tools/security/lethe/default.nix
+++ b/pkgs/tools/security/lethe/default.nix
@@ -25,5 +25,6 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/kostassoid/lethe";
     license = licenses.asl20;
     maintainers = with maintainers; [ fab ];
+    mainProgram = "lethe";
   };
 }
diff --git a/pkgs/tools/security/libmodsecurity/default.nix b/pkgs/tools/security/libmodsecurity/default.nix
index e1d78b79753e..c44733034b5a 100644
--- a/pkgs/tools/security/libmodsecurity/default.nix
+++ b/pkgs/tools/security/libmodsecurity/default.nix
@@ -76,5 +76,6 @@ stdenv.mkDerivation rec {
     license = licenses.asl20;
     platforms = platforms.all;
     maintainers = with maintainers; [ izorkin ];
+    mainProgram = "modsec-rules-check";
   };
 }
diff --git a/pkgs/tools/security/lmp/default.nix b/pkgs/tools/security/lmp/default.nix
index 2b945478f3da..021b9d33d35a 100644
--- a/pkgs/tools/security/lmp/default.nix
+++ b/pkgs/tools/security/lmp/default.nix
@@ -21,5 +21,6 @@ buildGoModule rec {
     homepage = "https://github.com/0xInfection/LogMePwn";
     license = with licenses; [ gpl3Only ];
     maintainers = with maintainers; [ fab ];
+    mainProgram = "lmp";
   };
 }
diff --git a/pkgs/tools/security/log4jcheck/default.nix b/pkgs/tools/security/log4jcheck/default.nix
index 291bf1ff96b4..1a7608fa73de 100644
--- a/pkgs/tools/security/log4jcheck/default.nix
+++ b/pkgs/tools/security/log4jcheck/default.nix
@@ -30,5 +30,6 @@ python3.pkgs.buildPythonApplication rec {
     homepage = "https://github.com/NorthwaveSecurity/log4jcheck";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
+    mainProgram = "log4jcheck";
   };
 }
diff --git a/pkgs/tools/security/log4shell-detector/default.nix b/pkgs/tools/security/log4shell-detector/default.nix
index 76fc65728438..c29a32bea396 100644
--- a/pkgs/tools/security/log4shell-detector/default.nix
+++ b/pkgs/tools/security/log4shell-detector/default.nix
@@ -36,5 +36,6 @@ python3.pkgs.buildPythonApplication rec {
     homepage = "https://github.com/Neo23x0/log4shell-detector";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
+    mainProgram = "log4shell-detector";
   };
 }
diff --git a/pkgs/tools/security/logmap/default.nix b/pkgs/tools/security/logmap/default.nix
index d6d4cb0f1a54..50f14bc33aff 100644
--- a/pkgs/tools/security/logmap/default.nix
+++ b/pkgs/tools/security/logmap/default.nix
@@ -30,5 +30,6 @@ python3.pkgs.buildPythonApplication rec {
     homepage = "https://github.com/zhzyker/logmap";
     license = licenses.gpl3Only;
     maintainers = with maintainers; [ fab ];
+    mainProgram = "logmap";
   };
 }
diff --git a/pkgs/tools/security/mantra/default.nix b/pkgs/tools/security/mantra/default.nix
index 7453926a8bd3..348c0afc3251 100644
--- a/pkgs/tools/security/mantra/default.nix
+++ b/pkgs/tools/security/mantra/default.nix
@@ -27,5 +27,6 @@ buildGoModule rec {
     changelog = "https://github.com/MrEmpy/Mantra/releases/tag/v.${version}";
     license = licenses.gpl3Only;
     maintainers = with maintainers; [ fab ];
+    mainProgram = "mantra";
   };
 }
diff --git a/pkgs/tools/security/minisign/default.nix b/pkgs/tools/security/minisign/default.nix
index 2ab1babcafc7..aaa280f40e90 100644
--- a/pkgs/tools/security/minisign/default.nix
+++ b/pkgs/tools/security/minisign/default.nix
@@ -25,5 +25,6 @@ stdenv.mkDerivation rec {
     license = licenses.isc;
     maintainers = with maintainers; [ joachifm ];
     platforms = platforms.unix;
+    mainProgram = "minisign";
   };
 }
diff --git a/pkgs/tools/security/mongoaudit/default.nix b/pkgs/tools/security/mongoaudit/default.nix
index 3ba19256ec34..2f980be5163b 100644
--- a/pkgs/tools/security/mongoaudit/default.nix
+++ b/pkgs/tools/security/mongoaudit/default.nix
@@ -35,5 +35,6 @@ python3.pkgs.buildPythonApplication rec {
     homepage = "https://github.com/stampery/mongoaudit";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
+    mainProgram = "mongoaudit";
   };
 }
diff --git a/pkgs/tools/security/nsjail/default.nix b/pkgs/tools/security/nsjail/default.nix
index 187674596e1f..a92aa5f21041 100644
--- a/pkgs/tools/security/nsjail/default.nix
+++ b/pkgs/tools/security/nsjail/default.nix
@@ -36,5 +36,6 @@ stdenv.mkDerivation rec {
     license     = licenses.asl20;
     maintainers = with maintainers; [ arturcygan bosu c0bw3b ];
     platforms   = platforms.linux;
+    mainProgram = "nsjail";
   };
 }
diff --git a/pkgs/tools/security/oath-toolkit/default.nix b/pkgs/tools/security/oath-toolkit/default.nix
index fe8367ea57e4..eda2affaa262 100644
--- a/pkgs/tools/security/oath-toolkit/default.nix
+++ b/pkgs/tools/security/oath-toolkit/default.nix
@@ -26,5 +26,6 @@ in stdenv.mkDerivation rec {
     homepage = "https://www.nongnu.org/oath-toolkit/";
     maintainers = with maintainers; [ schnusch ];
     platforms = with platforms; linux ++ darwin;
+    mainProgram = "oathtool";
   };
 }
diff --git a/pkgs/tools/security/onesixtyone/default.nix b/pkgs/tools/security/onesixtyone/default.nix
index 374d1322246b..1ff1b0266eaf 100644
--- a/pkgs/tools/security/onesixtyone/default.nix
+++ b/pkgs/tools/security/onesixtyone/default.nix
@@ -25,6 +25,7 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2Plus;
     platforms = platforms.unix;
     maintainers = [ maintainers.fishi0x01 ];
+    mainProgram = "onesixtyone";
   };
 }
 
diff --git a/pkgs/tools/security/ospd-openvas/default.nix b/pkgs/tools/security/ospd-openvas/default.nix
index 68c6a7dba953..0e4b4b16e752 100644
--- a/pkgs/tools/security/ospd-openvas/default.nix
+++ b/pkgs/tools/security/ospd-openvas/default.nix
@@ -5,14 +5,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "ospd-openvas";
-  version = "22.6.1";
+  version = "22.6.2";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "greenbone";
     repo = "ospd-openvas";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Qm6TTS9yLqQHXsz19yJR3Ccyc+syxkrTJ7upSTXdXSE=";
+    hash = "sha256-SO2+PpxjyP+Yba0X81EgNCOAu7ntlG7zOeWA+7XdRIA=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/tools/security/parsero/default.nix b/pkgs/tools/security/parsero/default.nix
index a8cd9c39eb13..2c3323f25e52 100644
--- a/pkgs/tools/security/parsero/default.nix
+++ b/pkgs/tools/security/parsero/default.nix
@@ -24,5 +24,6 @@ python3Packages.buildPythonApplication rec {
     homepage = "https://github.com/behindthefirewalls/Parsero";
     license = licenses.gpl2Only;
     maintainers = with maintainers; [ emilytrau fab ];
+    mainProgram = "parsero";
   };
 }
diff --git a/pkgs/tools/security/prs/default.nix b/pkgs/tools/security/prs/default.nix
index 33df7e7948ce..cfab2229efee 100644
--- a/pkgs/tools/security/prs/default.nix
+++ b/pkgs/tools/security/prs/default.nix
@@ -59,5 +59,6 @@ rustPlatform.buildRustPackage rec {
       gpl3Only  # everything else
     ];
     maintainers = with maintainers; [ dotlambda ];
+    mainProgram = "prs";
   };
 }
diff --git a/pkgs/tools/security/routersploit/default.nix b/pkgs/tools/security/routersploit/default.nix
index e147e8feac0b..3f656e8e4578 100644
--- a/pkgs/tools/security/routersploit/default.nix
+++ b/pkgs/tools/security/routersploit/default.nix
@@ -52,5 +52,6 @@ python3.pkgs.buildPythonApplication rec {
     homepage = "https://github.com/threat9/routersploit";
     license = with licenses; [ bsd3 ];
     maintainers = with maintainers; [ fab ];
+    mainProgram = "rsf";
   };
 }
diff --git a/pkgs/tools/security/rucredstash/default.nix b/pkgs/tools/security/rucredstash/default.nix
index 3a6fcfbf5325..972695ad565e 100644
--- a/pkgs/tools/security/rucredstash/default.nix
+++ b/pkgs/tools/security/rucredstash/default.nix
@@ -24,5 +24,6 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/psibi/rucredstash";
     license = licenses.mit;
     maintainers = with maintainers; [ psibi ];
+    mainProgram = "rucredstash";
   };
 }
diff --git a/pkgs/tools/security/shellz/default.nix b/pkgs/tools/security/shellz/default.nix
index f1b226c32137..e7d44bd21926 100644
--- a/pkgs/tools/security/shellz/default.nix
+++ b/pkgs/tools/security/shellz/default.nix
@@ -26,5 +26,6 @@ buildGoModule rec {
     homepage = "https://github.com/evilsocket/shellz";
     license = licenses.gpl3Only;
     maintainers = with maintainers; [ fab ];
+    mainProgram = "shellz";
   };
 }
diff --git a/pkgs/tools/security/silenthound/default.nix b/pkgs/tools/security/silenthound/default.nix
index 92b651bc9a83..f2915c447675 100644
--- a/pkgs/tools/security/silenthound/default.nix
+++ b/pkgs/tools/security/silenthound/default.nix
@@ -39,5 +39,6 @@ python3.pkgs.buildPythonApplication rec {
     # Unknown license, https://github.com/layer8secure/SilentHound/issues/1
     license = licenses.unfree;
     maintainers = with maintainers; [ fab ];
+    mainProgram = "silenthound";
   };
 }
diff --git a/pkgs/tools/security/slowhttptest/default.nix b/pkgs/tools/security/slowhttptest/default.nix
index b4c2b0efeec3..94e60a6a0084 100644
--- a/pkgs/tools/security/slowhttptest/default.nix
+++ b/pkgs/tools/security/slowhttptest/default.nix
@@ -22,5 +22,6 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/shekyan/slowhttptest";
     license = with licenses; [ asl20 ];
     maintainers = with maintainers; [ fab ];
+    mainProgram = "slowhttptest";
   };
 }
diff --git a/pkgs/tools/security/smbscan/default.nix b/pkgs/tools/security/smbscan/default.nix
index f807704005e1..ea2a99b64bb0 100644
--- a/pkgs/tools/security/smbscan/default.nix
+++ b/pkgs/tools/security/smbscan/default.nix
@@ -37,5 +37,6 @@ python3.pkgs.buildPythonApplication rec {
     homepage = "https://github.com/jeffhacks/smbscan";
     license = with licenses; [ gpl3Only ];
     maintainers = with maintainers; [ fab ];
+    mainProgram = "smbscan";
   };
 }
diff --git a/pkgs/tools/security/stegseek/default.nix b/pkgs/tools/security/stegseek/default.nix
index f898b5eab0e6..dd2c10045754 100644
--- a/pkgs/tools/security/stegseek/default.nix
+++ b/pkgs/tools/security/stegseek/default.nix
@@ -40,5 +40,6 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/RickdeJager/stegseek";
     license = with licenses; [ gpl2Only ];
     maintainers = with maintainers; [ fab ];
+    mainProgram = "stegseek";
   };
 }
diff --git a/pkgs/tools/security/stricat/default.nix b/pkgs/tools/security/stricat/default.nix
index bdd7d18923f1..b21498e009f1 100644
--- a/pkgs/tools/security/stricat/default.nix
+++ b/pkgs/tools/security/stricat/default.nix
@@ -22,5 +22,6 @@ stdenv.mkDerivation rec {
     license     = lib.licenses.bsd3;
     platforms   = lib.platforms.unix;
     maintainers = [ lib.maintainers.thoughtpolice ];
+    mainProgram = "stricat";
   };
 }
diff --git a/pkgs/tools/security/sx-go/default.nix b/pkgs/tools/security/sx-go/default.nix
index 11a9b497fdf0..8c8ceee0fe74 100644
--- a/pkgs/tools/security/sx-go/default.nix
+++ b/pkgs/tools/security/sx-go/default.nix
@@ -41,5 +41,6 @@ buildGoModule rec {
     homepage = "https://github.com/v-byte-cpu/sx";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
+    mainProgram = "sx-go";
   };
 }
diff --git a/pkgs/tools/security/tessen/default.nix b/pkgs/tools/security/tessen/default.nix
index 1113134a1451..e8517dda9b4e 100644
--- a/pkgs/tools/security/tessen/default.nix
+++ b/pkgs/tools/security/tessen/default.nix
@@ -48,5 +48,6 @@ stdenvNoCC.mkDerivation rec {
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
     maintainers = with maintainers; [ monaaraj ];
+    mainProgram = "tessen";
   };
 }
diff --git a/pkgs/tools/security/vaultwarden/default.nix b/pkgs/tools/security/vaultwarden/default.nix
index cb1148fdc1af..762c8312c1e6 100644
--- a/pkgs/tools/security/vaultwarden/default.nix
+++ b/pkgs/tools/security/vaultwarden/default.nix
@@ -39,5 +39,6 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/dani-garcia/vaultwarden";
     license = licenses.agpl3Only;
     maintainers = with maintainers; [ msteen ivan ];
+    mainProgram = "vaultwarden";
   };
 }
diff --git a/pkgs/tools/security/webanalyze/default.nix b/pkgs/tools/security/webanalyze/default.nix
index 3b49b496f62e..7c043c0d0a18 100644
--- a/pkgs/tools/security/webanalyze/default.nix
+++ b/pkgs/tools/security/webanalyze/default.nix
@@ -22,5 +22,6 @@ buildGoModule rec {
     changelog = "https://github.com/rverton/webanalyze/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
+    mainProgram = "webanalyze";
   };
 }
diff --git a/pkgs/tools/security/xcrawl3r/default.nix b/pkgs/tools/security/xcrawl3r/default.nix
index c7b63c238be1..b714d555bafb 100644
--- a/pkgs/tools/security/xcrawl3r/default.nix
+++ b/pkgs/tools/security/xcrawl3r/default.nix
@@ -27,5 +27,6 @@ buildGoModule rec {
     changelog = "https://github.com/hueristiq/xcrawl3r/releases/tag/${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
+    mainProgram = "xcrawl3r";
   };
 }
diff --git a/pkgs/tools/security/yatas/default.nix b/pkgs/tools/security/yatas/default.nix
index 057f0c7b18b4..e351ea244f5d 100644
--- a/pkgs/tools/security/yatas/default.nix
+++ b/pkgs/tools/security/yatas/default.nix
@@ -22,5 +22,6 @@ buildGoModule rec {
     changelog = "https://github.com/padok-team/YATAS/releases/tag/v${version}";
     license = licenses.asl20;
     maintainers = with maintainers; [ fab ];
+    mainProgram = "yatas";
   };
 }
diff --git a/pkgs/tools/security/yubihsm-connector/default.nix b/pkgs/tools/security/yubihsm-connector/default.nix
index 8e56cc6a227e..ab2a29808380 100644
--- a/pkgs/tools/security/yubihsm-connector/default.nix
+++ b/pkgs/tools/security/yubihsm-connector/default.nix
@@ -32,5 +32,6 @@ buildGoModule rec {
     homepage = "https://developers.yubico.com/yubihsm-connector/";
     maintainers = with maintainers; [ matthewcroughan ];
     license = licenses.asl20;
+    mainProgram = "yubihsm-connector";
   };
 }
diff --git a/pkgs/tools/typesetting/asciidoctorj/default.nix b/pkgs/tools/typesetting/asciidoctorj/default.nix
index ac8683a36db3..91ce383f9a4d 100644
--- a/pkgs/tools/typesetting/asciidoctorj/default.nix
+++ b/pkgs/tools/typesetting/asciidoctorj/default.nix
@@ -30,5 +30,6 @@ stdenv.mkDerivation rec {
     license = licenses.asl20;
     platforms = platforms.all;
     maintainers = with maintainers; [ moaxcp ];
+    mainProgram = "asciidoctorj";
   };
 }
diff --git a/pkgs/tools/typesetting/biber-ms/default.nix b/pkgs/tools/typesetting/biber-ms/default.nix
index f5c161fe2cbc..9cf2bbe014f1 100644
--- a/pkgs/tools/typesetting/biber-ms/default.nix
+++ b/pkgs/tools/typesetting/biber-ms/default.nix
@@ -50,5 +50,6 @@ perlPackages.buildPerlModule {
     license = biberSource.meta.license;
     platforms = platforms.unix;
     maintainers = [ maintainers.xworld21 ];
+    mainProgram = "biber-ms";
   };
 }
diff --git a/pkgs/tools/typesetting/biber/default.nix b/pkgs/tools/typesetting/biber/default.nix
index b09a4b092f9b..08038c41377f 100644
--- a/pkgs/tools/typesetting/biber/default.nix
+++ b/pkgs/tools/typesetting/biber/default.nix
@@ -31,5 +31,6 @@ perlPackages.buildPerlModule {
     license = biberSource.meta.license;
     platforms = platforms.unix;
     maintainers = [ maintainers.ttuegel ];
+    mainProgram = "biber";
   };
 }
diff --git a/pkgs/tools/typesetting/biblatex-check/default.nix b/pkgs/tools/typesetting/biblatex-check/default.nix
index d3d3be0f430f..beff04156190 100644
--- a/pkgs/tools/typesetting/biblatex-check/default.nix
+++ b/pkgs/tools/typesetting/biblatex-check/default.nix
@@ -24,5 +24,6 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/Pezmc/BibLatex-Check";
     license = licenses.mit;
     maintainers = with maintainers; [ dtzWill ];
+    mainProgram = "biblatex-check";
   };
 }
diff --git a/pkgs/tools/typesetting/coq2html/default.nix b/pkgs/tools/typesetting/coq2html/default.nix
index 267309e2e35b..69b3bc0ff239 100644
--- a/pkgs/tools/typesetting/coq2html/default.nix
+++ b/pkgs/tools/typesetting/coq2html/default.nix
@@ -32,5 +32,6 @@ stdenv.mkDerivation  rec {
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ jwiegley siraben ];
     platforms = platforms.unix;
+    mainProgram = "coq2html";
   };
 }
diff --git a/pkgs/tools/typesetting/djvu2pdf/default.nix b/pkgs/tools/typesetting/djvu2pdf/default.nix
index e6c8f80f9d25..9396d43b3962 100644
--- a/pkgs/tools/typesetting/djvu2pdf/default.nix
+++ b/pkgs/tools/typesetting/djvu2pdf/default.nix
@@ -25,5 +25,6 @@ stdenv.mkDerivation rec {
     homepage = "https://0x2a.at/site/projects/djvu2pdf/";
     license = lib.licenses.gpl1Only;
     platforms = lib.platforms.all;
+    mainProgram = "djvu2pdf";
   };
 }
diff --git a/pkgs/tools/typesetting/docbook2odf/default.nix b/pkgs/tools/typesetting/docbook2odf/default.nix
index e17acac3dd96..7608fb1228ed 100644
--- a/pkgs/tools/typesetting/docbook2odf/default.nix
+++ b/pkgs/tools/typesetting/docbook2odf/default.nix
@@ -45,5 +45,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
     maintainers = [ maintainers.bjornfor ];
+    mainProgram = "docbook2odf";
   };
 }
diff --git a/pkgs/tools/typesetting/fop/default.nix b/pkgs/tools/typesetting/fop/default.nix
index 0855c442deb9..254f29d27a78 100644
--- a/pkgs/tools/typesetting/fop/default.nix
+++ b/pkgs/tools/typesetting/fop/default.nix
@@ -54,5 +54,6 @@ stdenv.mkDerivation rec {
     ];
     platforms = platforms.all;
     maintainers = with maintainers; [ bjornfor ];
+    mainProgram = "fop";
   };
 }
diff --git a/pkgs/tools/typesetting/git-latexdiff/default.nix b/pkgs/tools/typesetting/git-latexdiff/default.nix
index 154781d1ef18..e7e4351a2088 100644
--- a/pkgs/tools/typesetting/git-latexdiff/default.nix
+++ b/pkgs/tools/typesetting/git-latexdiff/default.nix
@@ -35,5 +35,6 @@ stdenv.mkDerivation rec {
     maintainers = [ ];
     license = licenses.bsd3; # https://gitlab.com/git-latexdiff/git-latexdiff/issues/9
     platforms = platforms.unix;
+    mainProgram = "git-latexdiff";
   };
 }
diff --git a/pkgs/tools/typesetting/halibut/default.nix b/pkgs/tools/typesetting/halibut/default.nix
index de76c4956d7a..3429df706d2f 100644
--- a/pkgs/tools/typesetting/halibut/default.nix
+++ b/pkgs/tools/typesetting/halibut/default.nix
@@ -17,5 +17,6 @@ stdenv.mkDerivation rec {
     license = licenses.mit;
     maintainers = with maintainers; [ pSub ];
     platforms = with platforms; unix;
+    mainProgram = "halibut";
   };
 }
diff --git a/pkgs/tools/typesetting/hayagriva/default.nix b/pkgs/tools/typesetting/hayagriva/default.nix
index 6723e1acecdb..0db1bf73c9cd 100644
--- a/pkgs/tools/typesetting/hayagriva/default.nix
+++ b/pkgs/tools/typesetting/hayagriva/default.nix
@@ -30,5 +30,6 @@ rustPlatform.buildRustPackage rec {
     changelog = "https://github.com/typst/hayagriva/releases/tag/v${version}";
     license = with licenses; [ asl20 mit ];
     maintainers = with maintainers; [ figsoda ];
+    mainProgram = "hayagriva";
   };
 }
diff --git a/pkgs/tools/typesetting/htmldoc/default.nix b/pkgs/tools/typesetting/htmldoc/default.nix
index 02a1a97010c5..da54f7c62970 100644
--- a/pkgs/tools/typesetting/htmldoc/default.nix
+++ b/pkgs/tools/typesetting/htmldoc/default.nix
@@ -38,5 +38,6 @@ stdenv.mkDerivation rec {
       generates corresponding HTML, PostScript, or PDF files with an optional
       table of contents.
     '';
+    mainProgram = "htmldoc";
   };
 }
diff --git a/pkgs/tools/typesetting/kramdown-asciidoc/default.nix b/pkgs/tools/typesetting/kramdown-asciidoc/default.nix
index ebe57e3695f5..f3058156848e 100644
--- a/pkgs/tools/typesetting/kramdown-asciidoc/default.nix
+++ b/pkgs/tools/typesetting/kramdown-asciidoc/default.nix
@@ -30,6 +30,7 @@ let
       license = licenses.mit;
       maintainers = with maintainers; [ ];
       platforms = platforms.unix;
+      mainProgram = "kramdoc";
     };
   };
 in
diff --git a/pkgs/tools/typesetting/mmark/default.nix b/pkgs/tools/typesetting/mmark/default.nix
index 0cb100dde5e3..3e1c95ca0241 100644
--- a/pkgs/tools/typesetting/mmark/default.nix
+++ b/pkgs/tools/typesetting/mmark/default.nix
@@ -27,5 +27,6 @@ buildGoModule rec {
     homepage = "https://github.com/mmarkdown/mmark";
     license = with lib.licenses; bsd2;
     maintainers = with lib.maintainers; [ yrashk ];
+    mainProgram = "mmark";
   };
 }
diff --git a/pkgs/tools/typesetting/pdf2djvu/default.nix b/pkgs/tools/typesetting/pdf2djvu/default.nix
index 9cbf61304b9a..09285cf2843b 100644
--- a/pkgs/tools/typesetting/pdf2djvu/default.nix
+++ b/pkgs/tools/typesetting/pdf2djvu/default.nix
@@ -62,5 +62,6 @@ stdenv.mkDerivation rec {
     homepage = "https://jwilk.net/software/pdf2djvu";
     license = licenses.gpl2;
     maintainers = with maintainers; [ pSub ];
+    mainProgram = "pdf2djvu";
   };
 }
diff --git a/pkgs/tools/typesetting/pdfchain/default.nix b/pkgs/tools/typesetting/pdfchain/default.nix
index 256a8ebd6c53..6d772a6fea20 100644
--- a/pkgs/tools/typesetting/pdfchain/default.nix
+++ b/pkgs/tools/typesetting/pdfchain/default.nix
@@ -53,5 +53,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ hqurve ];
     platforms = platforms.unix;
+    mainProgram = "pdfchain";
   };
 }
diff --git a/pkgs/tools/typesetting/pdfgrep/default.nix b/pkgs/tools/typesetting/pdfgrep/default.nix
index 3b926a3a4fdc..44854592348b 100644
--- a/pkgs/tools/typesetting/pdfgrep/default.nix
+++ b/pkgs/tools/typesetting/pdfgrep/default.nix
@@ -28,5 +28,6 @@ stdenv.mkDerivation rec {
     license = lib.licenses.gpl2Plus;
     maintainers = with lib.maintainers; [ qknight fpletz ];
     platforms = with lib.platforms; unix;
+    mainProgram = "pdfgrep";
   };
 }
diff --git a/pkgs/tools/typesetting/pdfsandwich/default.nix b/pkgs/tools/typesetting/pdfsandwich/default.nix
index 26037b05664d..377a7f7bf432 100644
--- a/pkgs/tools/typesetting/pdfsandwich/default.nix
+++ b/pkgs/tools/typesetting/pdfsandwich/default.nix
@@ -28,5 +28,6 @@ meta = with lib; {
     license = licenses.gpl2;
     maintainers = [ maintainers.rps ];
     platforms = platforms.linux;
+    mainProgram = "pdfsandwich";
   };
 }
diff --git a/pkgs/tools/typesetting/pdftk/default.nix b/pkgs/tools/typesetting/pdftk/default.nix
index b11975d83c7f..27d95c00c01b 100644
--- a/pkgs/tools/typesetting/pdftk/default.nix
+++ b/pkgs/tools/typesetting/pdftk/default.nix
@@ -95,5 +95,6 @@ in stdenv.mkDerivation rec {
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ raskin averelld ];
     platforms = platforms.unix;
+    mainProgram = "pdftk";
   };
 }
diff --git a/pkgs/tools/typesetting/pulldown-cmark/default.nix b/pkgs/tools/typesetting/pulldown-cmark/default.nix
index ee2b124b04ab..9a946eae732d 100644
--- a/pkgs/tools/typesetting/pulldown-cmark/default.nix
+++ b/pkgs/tools/typesetting/pulldown-cmark/default.nix
@@ -21,5 +21,6 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/raphlinus/pulldown-cmark";
     license = with lib.licenses; [ mit ];
     maintainers = with lib.maintainers; [ CobaltCause ];
+    mainProgram = "pulldown-cmark";
   };
 }
diff --git a/pkgs/tools/typesetting/rfc-bibtex/default.nix b/pkgs/tools/typesetting/rfc-bibtex/default.nix
index a748983222ef..d9bed6946697 100644
--- a/pkgs/tools/typesetting/rfc-bibtex/default.nix
+++ b/pkgs/tools/typesetting/rfc-bibtex/default.nix
@@ -29,5 +29,6 @@ with python3.pkgs; buildPythonApplication rec {
     description = "Generate Bibtex entries for IETF RFCs and Internet-Drafts";
     license = licenses.mit;
     maintainers = with maintainers; [ teto ];
+    mainProgram = "rfcbibtex";
   };
 }
diff --git a/pkgs/tools/typesetting/satysfi/default.nix b/pkgs/tools/typesetting/satysfi/default.nix
index 6d77faac76a9..7284e2cc2fdc 100644
--- a/pkgs/tools/typesetting/satysfi/default.nix
+++ b/pkgs/tools/typesetting/satysfi/default.nix
@@ -80,5 +80,6 @@ in
       license = licenses.lgpl3Only;
       maintainers = [ maintainers.mt-caret maintainers.marsam ];
       platforms = platforms.all;
+      mainProgram = "satysfi";
     };
   }
diff --git a/pkgs/tools/typesetting/sile/default.nix b/pkgs/tools/typesetting/sile/default.nix
index 3c64e8872019..f2005f491a17 100644
--- a/pkgs/tools/typesetting/sile/default.nix
+++ b/pkgs/tools/typesetting/sile/default.nix
@@ -137,5 +137,6 @@ stdenv.mkDerivation (finalAttrs: {
     platforms = platforms.unix;
     maintainers = with maintainers; [ doronbehar alerque ];
     license = licenses.mit;
+    mainProgram = "sile";
   };
 })
diff --git a/pkgs/tools/typesetting/sshlatex/default.nix b/pkgs/tools/typesetting/sshlatex/default.nix
index 8a5b4811d770..ed1252928bb3 100644
--- a/pkgs/tools/typesetting/sshlatex/default.nix
+++ b/pkgs/tools/typesetting/sshlatex/default.nix
@@ -34,5 +34,6 @@ stdenv.mkDerivation rec {
     license = lib.licenses.gpl3Plus;  # actually dual-licensed gpl3Plus | lppl13cplus
     platforms = lib.platforms.all;
     maintainers = [ maintainers.iblech ];
+    mainProgram = "sshlatex";
   };
 }
diff --git a/pkgs/tools/typesetting/tikzit/default.nix b/pkgs/tools/typesetting/tikzit/default.nix
index 2f6d169d0cb5..44c2fed0508a 100644
--- a/pkgs/tools/typesetting/tikzit/default.nix
+++ b/pkgs/tools/typesetting/tikzit/default.nix
@@ -29,5 +29,6 @@ mkDerivation {
     license = licenses.gpl3Plus;
     platforms = platforms.all;
     maintainers = [ maintainers.iblech maintainers.mgttlinger ];
+    mainProgram = "tikzit";
   };
 }
diff --git a/pkgs/tools/typesetting/typstfmt/default.nix b/pkgs/tools/typesetting/typstfmt/default.nix
index c6c054888f82..cec70394e4f9 100644
--- a/pkgs/tools/typesetting/typstfmt/default.nix
+++ b/pkgs/tools/typesetting/typstfmt/default.nix
@@ -24,5 +24,6 @@ rustPlatform.buildRustPackage rec {
     changelog = "https://github.com/astrale-sharp/typstfmt/blob/${src.rev}/CHANGELOG.md";
     license = licenses.mit;
     maintainers = with maintainers; [ figsoda geri1701 ];
+    mainProgram = "typstfmt";
   };
 }
diff --git a/pkgs/tools/typesetting/xmlroff/default.nix b/pkgs/tools/typesetting/xmlroff/default.nix
index dd8adab9ee8a..f1e7e2c3243f 100644
--- a/pkgs/tools/typesetting/xmlroff/default.nix
+++ b/pkgs/tools/typesetting/xmlroff/default.nix
@@ -49,5 +49,6 @@ stdenv.mkDerivation rec {
     homepage = "http://xmlroff.org/";
     platforms = platforms.unix;
     license = licenses.bsd3;
+    mainProgram = "xmlroff";
   };
 }
diff --git a/pkgs/tools/video/dvgrab/default.nix b/pkgs/tools/video/dvgrab/default.nix
index c5bb05853bf9..de5c5e906bf5 100644
--- a/pkgs/tools/video/dvgrab/default.nix
+++ b/pkgs/tools/video/dvgrab/default.nix
@@ -36,5 +36,6 @@ stdenv.mkDerivation {
 
     license = licenses.gpl2Plus;
     platforms = platforms.gnu ++ platforms.linux;
+    mainProgram = "dvgrab";
   };
 }
diff --git a/pkgs/tools/video/go2rtc/default.nix b/pkgs/tools/video/go2rtc/default.nix
index 9b0f9bbe3f70..c6f8b66d1bcd 100644
--- a/pkgs/tools/video/go2rtc/default.nix
+++ b/pkgs/tools/video/go2rtc/default.nix
@@ -35,5 +35,6 @@ buildGoModule rec {
     changelog = "https://github.com/AlexxIT/go2rtc/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ hexa ];
+    mainProgram = "go2rtc";
   };
 }
diff --git a/pkgs/tools/video/gopro/default.nix b/pkgs/tools/video/gopro/default.nix
index a1991772bf10..7f234ae5247a 100644
--- a/pkgs/tools/video/gopro/default.nix
+++ b/pkgs/tools/video/gopro/default.nix
@@ -34,5 +34,6 @@ stdenv.mkDerivation rec {
     platforms = platforms.unix;
     license = licenses.gpl3;
     maintainers = with maintainers; [ jonringer ];
+    mainProgram = "gopro";
   };
 }
diff --git a/pkgs/tools/video/harvid/default.nix b/pkgs/tools/video/harvid/default.nix
index 655d1ba3874f..2860e5f22280 100644
--- a/pkgs/tools/video/harvid/default.nix
+++ b/pkgs/tools/video/harvid/default.nix
@@ -48,5 +48,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
     maintainers = with maintainers; [ mitchmindtree ];
+    mainProgram = "harvid";
   };
 }
diff --git a/pkgs/tools/video/lux/default.nix b/pkgs/tools/video/lux/default.nix
index f6a4ea61f2dc..6d1e92af4aca 100644
--- a/pkgs/tools/video/lux/default.nix
+++ b/pkgs/tools/video/lux/default.nix
@@ -39,5 +39,6 @@ buildGoModule rec {
     changelog = "https://github.com/iawia002/lux/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ galaxy ];
+    mainProgram = "lux";
   };
 }
diff --git a/pkgs/tools/video/play-with-mpv/default.nix b/pkgs/tools/video/play-with-mpv/default.nix
index 9047f9062462..16e645eb4455 100644
--- a/pkgs/tools/video/play-with-mpv/default.nix
+++ b/pkgs/tools/video/play-with-mpv/default.nix
@@ -57,5 +57,6 @@ python3Packages.buildPythonApplication rec {
     homepage = "https://github.com/Thann/play-with-mpv";
     license = licenses.mit;
     maintainers = with maintainers; [ dawidsowa ];
+    mainProgram = "play-with-mpv";
   };
 }
diff --git a/pkgs/tools/video/rav1e/default.nix b/pkgs/tools/video/rav1e/default.nix
index 146ff6072544..859e523dfa65 100644
--- a/pkgs/tools/video/rav1e/default.nix
+++ b/pkgs/tools/video/rav1e/default.nix
@@ -63,5 +63,6 @@ rustPlatform.buildRustPackage rec {
     changelog = "https://github.com/xiph/rav1e/releases/tag/v${version}";
     license = licenses.bsd2;
     maintainers = [ ];
+    mainProgram = "rav1e";
   };
 }
diff --git a/pkgs/tools/video/replay-sorcery/default.nix b/pkgs/tools/video/replay-sorcery/default.nix
index 8f362c3beb96..7323644cdefb 100644
--- a/pkgs/tools/video/replay-sorcery/default.nix
+++ b/pkgs/tools/video/replay-sorcery/default.nix
@@ -58,5 +58,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ kira-bruneau ];
     platforms = platforms.linux;
+    mainProgram = "replay-sorcery";
   };
 }
diff --git a/pkgs/tools/video/swfmill/default.nix b/pkgs/tools/video/swfmill/default.nix
index 28d7e0039edd..c93534bf1a20 100644
--- a/pkgs/tools/video/swfmill/default.nix
+++ b/pkgs/tools/video/swfmill/default.nix
@@ -19,5 +19,6 @@ stdenv.mkDerivation rec {
     homepage = "http://swfmill.org";
     license = lib.licenses.gpl2;
     platforms = lib.platforms.linux;
+    mainProgram = "swfmill";
   };
 }
diff --git a/pkgs/tools/video/vcsi/default.nix b/pkgs/tools/video/vcsi/default.nix
index bb3bc4c9856c..7db0fdd6962e 100644
--- a/pkgs/tools/video/vcsi/default.nix
+++ b/pkgs/tools/video/vcsi/default.nix
@@ -33,5 +33,6 @@ python3Packages.buildPythonApplication rec {
     homepage = "https://github.com/amietn/vcsi";
     license = licenses.mit;
     maintainers = with maintainers; [ dandellion zopieux ];
+    mainProgram = "vcsi";
   };
 }
diff --git a/pkgs/tools/video/vncrec/default.nix b/pkgs/tools/video/vncrec/default.nix
index 02608ac16b20..3b3391284f07 100644
--- a/pkgs/tools/video/vncrec/default.nix
+++ b/pkgs/tools/video/vncrec/default.nix
@@ -30,5 +30,6 @@ stdenv.mkDerivation {
     homepage = "http://ronja.twibright.com/utils/vncrec/";
     platforms = lib.platforms.linux;
     license = lib.licenses.gpl2;
+    mainProgram = "vncrec";
   };
 }
diff --git a/pkgs/tools/video/wtwitch/default.nix b/pkgs/tools/video/wtwitch/default.nix
index 9b2a9a7be031..0035e184540c 100644
--- a/pkgs/tools/video/wtwitch/default.nix
+++ b/pkgs/tools/video/wtwitch/default.nix
@@ -67,5 +67,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl3Only;
     maintainers = with maintainers; [ urandom ];
     platforms = platforms.all;
+    mainProgram = "wtwitch";
   };
 }
diff --git a/pkgs/tools/video/yamdi/default.nix b/pkgs/tools/video/yamdi/default.nix
index 6665637e6371..1bcfffb92903 100644
--- a/pkgs/tools/video/yamdi/default.nix
+++ b/pkgs/tools/video/yamdi/default.nix
@@ -27,5 +27,6 @@ stdenv.mkDerivation rec {
     license = licenses.bsd3;
     platforms = platforms.all;
     maintainers = [ maintainers.ryanartecona ];
+    mainProgram = "yamdi";
   };
 }
diff --git a/pkgs/tools/video/yaydl/default.nix b/pkgs/tools/video/yaydl/default.nix
index ce7e4ef8eebf..7dea97bf649e 100644
--- a/pkgs/tools/video/yaydl/default.nix
+++ b/pkgs/tools/video/yaydl/default.nix
@@ -40,5 +40,6 @@ rustPlatform.buildRustPackage rec {
     description = "Yet another youtube down loader";
     license = licenses.cddl;
     maintainers = with maintainers; [];
+    mainProgram = "yaydl";
   };
 }
diff --git a/pkgs/tools/virtualization/kubevirt/default.nix b/pkgs/tools/virtualization/kubevirt/default.nix
index 733c2ef62323..a9e49cc75c34 100644
--- a/pkgs/tools/virtualization/kubevirt/default.nix
+++ b/pkgs/tools/virtualization/kubevirt/default.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "kubevirt";
-  version = "1.0.1";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "kubevirt";
     repo = "kubevirt";
     rev = "v${version}";
-    sha256 = "sha256-L+spWtYuXq0bPYmE1eGnzTfCAh8Q3j5DUS+k6dNGdOU=";
+    sha256 = "sha256-dW2rHW/37Jpk3vuu3O87nynK8Mp0IAqpkRvBDxT/++I=";
   };
 
   vendorHash = null;
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index df1ee47a4f2f..e67c8ece527c 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -976,7 +976,6 @@ mapAliases ({
   ''; # Add 2023-07-29
   wcm = throw "'wcm' has been renamed to/replaced by 'wayfirePlugins.wcm'"; # Add 2023-07-29
   webkitgtk_5_0 = throw "'webkitgtk_5_0' has been superseded by 'webkitgtk_6_0'"; # Added 2023-02-25
-  wio = throw "wio has been removed from nixpkgs, it was unmaintained and required wlroots_0_14 at the time of removal"; # Added 2023-04-28
   wineWayland = wine-wayland;
   win-qemu = throw "'win-qemu' has been replaced by 'virtio-win'"; # Added 2023-08-16
   win-virtio = virtio-win; # Added 2023-10-17
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 4d493eba645f..11769b120333 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -35409,7 +35409,7 @@ with pkgs;
 
   maestral = with python3Packages; toPythonApplication maestral;
 
-  maestral-gui = libsForQt5.callPackage ../applications/networking/maestral-qt { };
+  maestral-gui = qt6.callPackage ../applications/networking/maestral-qt { };
 
   maestro = callPackage ../development/mobile/maestro { };
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 4ce388234b5e..35554ba70d38 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -6479,6 +6479,8 @@ self: super: with self; {
 
   losant-rest = callPackage ../development/python-modules/losant-rest { };
 
+  lpc-checksum = callPackage ../development/python-modules/lpc-checksum { };
+
   lrcalc-python = callPackage ../development/python-modules/lrcalc-python { };
 
   lru-dict = callPackage ../development/python-modules/lru-dict { };
@@ -9232,6 +9234,8 @@ self: super: with self; {
 
   pylddwrap = callPackage ../development/python-modules/pylddwrap { };
 
+  pyngo = callPackage ../development/python-modules/pyngo { };
+
   pyngrok = callPackage ../development/python-modules/pyngrok { };
 
   pynndescent = callPackage ../development/python-modules/pynndescent { };