about summary refs log tree commit diff
path: root/nixpkgs/pkgs/os-specific
diff options
context:
space:
mode:
authorAlyssa Ross <hi@alyssa.is>2023-08-08 16:04:42 +0000
committerAlyssa Ross <hi@alyssa.is>2023-08-13 06:35:37 +0000
commit12aaa58dac35800b5b7d77f81cf2a87c21ee55da (patch)
treebe0add9e5c22a85d20b5d78206aa74f956eb2a1b /nixpkgs/pkgs/os-specific
parent45892a5591202f75a1c2f1ca7c62a92c7566e3c5 (diff)
parent5a8e9243812ba528000995b294292d3b5e120947 (diff)
downloadnixlib-12aaa58dac35800b5b7d77f81cf2a87c21ee55da.tar
nixlib-12aaa58dac35800b5b7d77f81cf2a87c21ee55da.tar.gz
nixlib-12aaa58dac35800b5b7d77f81cf2a87c21ee55da.tar.bz2
nixlib-12aaa58dac35800b5b7d77f81cf2a87c21ee55da.tar.lz
nixlib-12aaa58dac35800b5b7d77f81cf2a87c21ee55da.tar.xz
nixlib-12aaa58dac35800b5b7d77f81cf2a87c21ee55da.tar.zst
nixlib-12aaa58dac35800b5b7d77f81cf2a87c21ee55da.zip
Merge branch 'nixos-unstable' of https://github.com/NixOS/nixpkgs
Conflicts:
	nixpkgs/pkgs/applications/window-managers/sway/default.nix
	nixpkgs/pkgs/build-support/go/module.nix
	nixpkgs/pkgs/build-support/rust/build-rust-package/default.nix
	nixpkgs/pkgs/development/libraries/mesa/default.nix
	nixpkgs/pkgs/servers/dict/dictd-db.nix

Link: https://gitlab.freedesktop.org/xkeyboard-config/xkeyboard-config/-/issues/391
Diffstat (limited to 'nixpkgs/pkgs/os-specific')
-rw-r--r--nixpkgs/pkgs/os-specific/bsd/freebsd/evdev-proto/default.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/bsd/netbsd/default.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/airbuddy/default.nix60
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/aldente/default.nix59
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/apple-sdk-11.0/private-frameworks.nix7
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/apple-sdk/default.nix7
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/apple-source-releases/Libc/825_40_1.nix13
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/apple-source-releases/Libc/default.nix17
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/apple-source-releases/Libc/headers.txt13
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix22
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/apple-source-releases/Libsystem/headers.txt5
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/apple-source-releases/configd/default.nix66
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/apple-source-releases/default.nix7
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/apple-source-releases/libmalloc/default.nix10
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/apple-source-releases/macos-11.0.1.nix1
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/apple-source-releases/system_cmds/default.nix7
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/apple-source-releases/system_cmds/fix-implicit-declarations.patch48
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix3
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/apple-source-releases/xnu/headers-arm64.txt2
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/apple-source-releases/xnu/headers-x86_64.txt2
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/bartender/default.nix48
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/cctools/darwin-memstream.patch (renamed from nixpkgs/pkgs/os-specific/darwin/cctools/darwin-no-memstream.patch)6
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/cctools/llvm.nix19
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/cctools/port.nix10
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/coconutbattery/default.nix41
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/grandperspective/default.nix19
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/hexfiend/default.nix28
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/libtapi/default.nix8
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/moltenvk/default.nix10
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/plistwatch/default.nix8
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/raycast/default.nix22
-rwxr-xr-xnixpkgs/pkgs/os-specific/darwin/raycast/update.sh12
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/rewrite-tbd/default.nix8
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/sketchybar/default.nix43
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/skhd/default.nix36
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/swift-corelibs/0002-Add-missing-launchd-header.patch11
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/swift-corelibs/0003-Fix-incompatible-pointer-conversion.patch25
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/swift-corelibs/0004-Fix-Darwin-cmake-build.patch66
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/swift-corelibs/0005-Fix-framework-installation-path.patch23
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/swift-corelibs/0006-System-CF-framework-compatibility.patch84
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/swift-corelibs/0007-Use-nixpkgs-icu.patch31
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/swift-corelibs/0008-Dont-link-libcurl.patch46
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/swift-corelibs/corefoundation.nix102
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/swift-corelibs/pure-corefoundation-hook.sh7
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/utm/default.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/yabai/default.nix6
-rw-r--r--nixpkgs/pkgs/os-specific/linux/9ptls/default.nix28
-rw-r--r--nixpkgs/pkgs/os-specific/linux/afuse/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/akvcam/default.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/linux/android-udev-rules/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/apfs/default.nix3
-rw-r--r--nixpkgs/pkgs/os-specific/linux/apparmor/default.nix39
-rw-r--r--nixpkgs/pkgs/os-specific/linux/aseq2json/default.nix6
-rw-r--r--nixpkgs/pkgs/os-specific/linux/ax99100/default.nix1
-rw-r--r--nixpkgs/pkgs/os-specific/linux/ax99100/kernel-6.4-fix-define-semaphore.patch14
-rw-r--r--nixpkgs/pkgs/os-specific/linux/batman-adv/alfred.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/linux/batman-adv/batctl.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/linux/batman-adv/version.nix8
-rw-r--r--nixpkgs/pkgs/os-specific/linux/bcc/default.nix45
-rw-r--r--nixpkgs/pkgs/os-specific/linux/below/default.nix7
-rw-r--r--nixpkgs/pkgs/os-specific/linux/blktrace/default.nix11
-rw-r--r--nixpkgs/pkgs/os-specific/linux/bluez/default.nix1
-rw-r--r--nixpkgs/pkgs/os-specific/linux/bpftune/default.nix73
-rw-r--r--nixpkgs/pkgs/os-specific/linux/cannelloni/default.nix11
-rw-r--r--nixpkgs/pkgs/os-specific/linux/cfs-zen-tweaks/default.nix15
-rw-r--r--nixpkgs/pkgs/os-specific/linux/conky/default.nix18
-rw-r--r--nixpkgs/pkgs/os-specific/linux/conntrack-tools/default.nix12
-rw-r--r--nixpkgs/pkgs/os-specific/linux/cpuid/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/cpupower/default.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/linux/cryptsetup/default.nix8
-rw-r--r--nixpkgs/pkgs/os-specific/linux/dbus-broker/default.nix17
-rw-r--r--nixpkgs/pkgs/os-specific/linux/dcgm/default.nix147
-rw-r--r--nixpkgs/pkgs/os-specific/linux/digimend/default.nix6
-rw-r--r--nixpkgs/pkgs/os-specific/linux/displaylink/default.nix12
-rw-r--r--nixpkgs/pkgs/os-specific/linux/erofs-utils/default.nix25
-rw-r--r--nixpkgs/pkgs/os-specific/linux/esdm/default.nix87
-rw-r--r--nixpkgs/pkgs/os-specific/linux/evdi/0000-fix-drm-path.patch31
-rw-r--r--nixpkgs/pkgs/os-specific/linux/evdi/default.nix22
-rw-r--r--nixpkgs/pkgs/os-specific/linux/fanout/default.nix37
-rw-r--r--nixpkgs/pkgs/os-specific/linux/fanout/remove_auto_mknod.patch13
-rw-r--r--nixpkgs/pkgs/os-specific/linux/fbterm/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/firmware/ath9k/default.nix11
-rw-r--r--nixpkgs/pkgs/os-specific/linux/firmware/firmware-updater/default.nix12
-rw-r--r--nixpkgs/pkgs/os-specific/linux/firmware/firmware-updater/deps.json187
-rw-r--r--nixpkgs/pkgs/os-specific/linux/firmware/firmware-updater/pubspec.lock259
-rw-r--r--nixpkgs/pkgs/os-specific/linux/firmware/fwupd/add-option-for-installation-sysconfdir.patch85
-rw-r--r--nixpkgs/pkgs/os-specific/linux/firmware/fwupd/default.nix17
-rw-r--r--nixpkgs/pkgs/os-specific/linux/firmware/fwupd/efi-app-path.patch12
-rw-r--r--nixpkgs/pkgs/os-specific/linux/firmware/ipu6-camera-bins/default.nix6
-rw-r--r--nixpkgs/pkgs/os-specific/linux/firmware/linux-firmware/default.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/linux/firmware/linux-firmware/source.nix7
-rwxr-xr-xnixpkgs/pkgs/os-specific/linux/firmware/linux-firmware/update.sh16
-rw-r--r--nixpkgs/pkgs/os-specific/linux/firmware/raspberrypi-wireless/default.nix7
-rw-r--r--nixpkgs/pkgs/os-specific/linux/firmware/rtl8723bs-firmware/default.nix23
-rw-r--r--nixpkgs/pkgs/os-specific/linux/firmware/sof-firmware/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/freeipa/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/fwts/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/fwts/module.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/linux/game-devices-udev-rules/default.nix38
-rw-r--r--nixpkgs/pkgs/os-specific/linux/gasket/default.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/linux/gt/default.nix6
-rw-r--r--nixpkgs/pkgs/os-specific/linux/hid-nintendo/default.nix42
-rw-r--r--nixpkgs/pkgs/os-specific/linux/hostapd/default.nix50
-rw-r--r--nixpkgs/pkgs/os-specific/linux/hwdata/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/iio-sensor-proxy/default.nix59
-rw-r--r--nixpkgs/pkgs/os-specific/linux/intel-compute-runtime/default.nix7
-rw-r--r--nixpkgs/pkgs/os-specific/linux/iproute/default.nix8
-rw-r--r--nixpkgs/pkgs/os-specific/linux/ipu6-drivers/default.nix6
-rw-r--r--nixpkgs/pkgs/os-specific/linux/iwd/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/jfbview/default.nix73
-rw-r--r--nixpkgs/pkgs/os-specific/linux/jool/cli.nix5
-rw-r--r--nixpkgs/pkgs/os-specific/linux/jool/default.nix7
-rw-r--r--nixpkgs/pkgs/os-specific/linux/jool/source.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kbd/default.nix10
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel-headers/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/common-config.nix71
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/generic.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/hardened/config.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/hardened/patches.json70
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/htmldocs.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/linux-4.14.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/linux-4.19.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/linux-5.10.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/linux-5.15.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/linux-5.4.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/linux-6.1.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/linux-6.4.nix (renamed from nixpkgs/pkgs/os-specific/linux/kernel/linux-6.3.nix)4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/linux-libre.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix6
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/linux-rt-5.15.nix6
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/linux-rt-5.4.nix6
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix6
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix20
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/linux-testing.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/manual-config.nix22
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/patches.nix9
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/xanmod-kernels.nix8
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/zen-kernels.nix85
-rw-r--r--nixpkgs/pkgs/os-specific/linux/ksmbd-tools/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kvmfr/default.nix9
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kvmfr/linux-6-4-compat.patch16
-rw-r--r--nixpkgs/pkgs/os-specific/linux/lenovo-legion/app.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/linux/lenovo-legion/default.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/linux/libbpf/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/libevdevc/default.nix3
-rw-r--r--nixpkgs/pkgs/os-specific/linux/libtraceevent/default.nix29
-rw-r--r--nixpkgs/pkgs/os-specific/linux/libtracefs/default.nix42
-rw-r--r--nixpkgs/pkgs/os-specific/linux/lttng-modules/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/mba6x_bl/default.nix6
-rw-r--r--nixpkgs/pkgs/os-specific/linux/microcode/intel.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/bash/default.nix98
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/binutils/default.nix118
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/binutils/deterministic.patch12
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/default.nix77
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/diffutils/default.nix72
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/findutils/default.nix72
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gcc/2.nix140
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/glibc/default.nix121
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gnused/default.nix42
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/linux-headers/default.nix49
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/bootstrap-sources.nix105
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/default.nix5
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/hex0.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/kaem/minimal.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/make-bootstrap-sources.nix65
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/utils.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/xz/default.nix78
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/xz/stubs.h25
-rw-r--r--nixpkgs/pkgs/os-specific/linux/mmc-utils/default.nix9
-rw-r--r--nixpkgs/pkgs/os-specific/linux/musl/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/new-lg4ff/default.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/linux/nftables/default.nix19
-rw-r--r--nixpkgs/pkgs/os-specific/linux/nix-ld/default.nix4
-rwxr-xr-xnixpkgs/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh18
-rw-r--r--nixpkgs/pkgs/os-specific/linux/nvidia-x11/default.nix43
-rw-r--r--nixpkgs/pkgs/os-specific/linux/oddjob/default.nix60
-rw-r--r--nixpkgs/pkgs/os-specific/linux/open-iscsi/default.nix6
-rw-r--r--nixpkgs/pkgs/os-specific/linux/pam_dp9ik/default.nix29
-rw-r--r--nixpkgs/pkgs/os-specific/linux/pam_rssh/default.nix71
-rw-r--r--nixpkgs/pkgs/os-specific/linux/pcm/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/plymouth/add-runtime-plugin-path.patch67
-rw-r--r--nixpkgs/pkgs/os-specific/linux/plymouth/default.nix130
-rw-r--r--nixpkgs/pkgs/os-specific/linux/plymouth/dont-create-broken-symlink.patch13
-rw-r--r--nixpkgs/pkgs/os-specific/linux/prl-tools/default.nix10
-rw-r--r--nixpkgs/pkgs/os-specific/linux/rdma-core/default.nix52
-rw-r--r--nixpkgs/pkgs/os-specific/linux/reptyr/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/rtl8192eu/default.nix8
-rw-r--r--nixpkgs/pkgs/os-specific/linux/rtl8723bs/default.nix41
-rw-r--r--nixpkgs/pkgs/os-specific/linux/rtl8812au/default.nix8
-rw-r--r--nixpkgs/pkgs/os-specific/linux/rtl8821au/default.nix8
-rw-r--r--nixpkgs/pkgs/os-specific/linux/rtl88x2bu/default.nix10
-rw-r--r--nixpkgs/pkgs/os-specific/linux/sch_cake/default.nix34
-rw-r--r--nixpkgs/pkgs/os-specific/linux/sd-switch/default.nix17
-rw-r--r--nixpkgs/pkgs/os-specific/linux/sgx/psw/default.nix5
-rw-r--r--nixpkgs/pkgs/os-specific/linux/smemstat/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/sssd/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/sysdig/default.nix16
-rw-r--r--nixpkgs/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch6
-rw-r--r--nixpkgs/pkgs/os-specific/linux/systemd/0004-Add-some-NixOS-specific-unit-directories.patch (renamed from nixpkgs/pkgs/os-specific/linux/systemd/0005-Add-some-NixOS-specific-unit-directories.patch)0
-rw-r--r--nixpkgs/pkgs/os-specific/linux/systemd/0004-fsck-look-for-fsck-binary-not-just-in-sbin.patch152
-rw-r--r--nixpkgs/pkgs/os-specific/linux/systemd/0005-Get-rid-of-a-useless-message-in-user-sessions.patch (renamed from nixpkgs/pkgs/os-specific/linux/systemd/0006-Get-rid-of-a-useless-message-in-user-sessions.patch)4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/systemd/0006-hostnamed-localed-timedated-disable-methods-that-cha.patch (renamed from nixpkgs/pkgs/os-specific/linux/systemd/0007-hostnamed-localed-timedated-disable-methods-that-cha.patch)0
-rw-r--r--nixpkgs/pkgs/os-specific/linux/systemd/0007-Fix-hwdb-paths.patch (renamed from nixpkgs/pkgs/os-specific/linux/systemd/0008-Fix-hwdb-paths.patch)0
-rw-r--r--nixpkgs/pkgs/os-specific/linux/systemd/0008-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch (renamed from nixpkgs/pkgs/os-specific/linux/systemd/0009-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch)4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/systemd/0009-localectl-use-etc-X11-xkb-for-list-x11.patch (renamed from nixpkgs/pkgs/os-specific/linux/systemd/0010-localectl-use-etc-X11-xkb-for-list-x11.patch)0
-rw-r--r--nixpkgs/pkgs/os-specific/linux/systemd/0010-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch (renamed from nixpkgs/pkgs/os-specific/linux/systemd/0011-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch)0
-rw-r--r--nixpkgs/pkgs/os-specific/linux/systemd/0011-add-rootprefix-to-lookup-dir-paths.patch (renamed from nixpkgs/pkgs/os-specific/linux/systemd/0012-add-rootprefix-to-lookup-dir-paths.patch)0
-rw-r--r--nixpkgs/pkgs/os-specific/linux/systemd/0012-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch (renamed from nixpkgs/pkgs/os-specific/linux/systemd/0013-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch)4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/systemd/0013-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch (renamed from nixpkgs/pkgs/os-specific/linux/systemd/0014-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch)0
-rw-r--r--nixpkgs/pkgs/os-specific/linux/systemd/0014-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch (renamed from nixpkgs/pkgs/os-specific/linux/systemd/0015-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch)0
-rw-r--r--nixpkgs/pkgs/os-specific/linux/systemd/0015-pkg-config-derive-prefix-from-prefix.patch (renamed from nixpkgs/pkgs/os-specific/linux/systemd/0016-pkg-config-derive-prefix-from-prefix.patch)0
-rw-r--r--nixpkgs/pkgs/os-specific/linux/systemd/0016-inherit-systemd-environment-when-calling-generators.patch (renamed from nixpkgs/pkgs/os-specific/linux/systemd/0017-inherit-systemd-environment-when-calling-generators.patch)4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/systemd/0017-core-don-t-taint-on-unmerged-usr.patch (renamed from nixpkgs/pkgs/os-specific/linux/systemd/0018-core-don-t-taint-on-unmerged-usr.patch)4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/systemd/0018-tpm2_context_init-fix-driver-name-checking.patch (renamed from nixpkgs/pkgs/os-specific/linux/systemd/0019-tpm2_context_init-fix-driver-name-checking.patch)0
-rw-r--r--nixpkgs/pkgs/os-specific/linux/systemd/0019-bootctl-also-print-efi-files-not-owned-by-systemd-in.patch46
-rw-r--r--nixpkgs/pkgs/os-specific/linux/systemd/default.nix76
-rw-r--r--nixpkgs/pkgs/os-specific/linux/tp_smapi/default.nix27
-rw-r--r--nixpkgs/pkgs/os-specific/linux/trace-cmd/default.nix8
-rw-r--r--nixpkgs/pkgs/os-specific/linux/trace-cmd/kernelshark.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/trelay/Makefile14
-rw-r--r--nixpkgs/pkgs/os-specific/linux/trelay/default.nix46
-rw-r--r--nixpkgs/pkgs/os-specific/linux/tuxedo-keyboard/default.nix26
-rw-r--r--nixpkgs/pkgs/os-specific/linux/udisks/2-default.nix17
-rw-r--r--nixpkgs/pkgs/os-specific/linux/udisks/fix-paths.patch107
-rw-r--r--nixpkgs/pkgs/os-specific/linux/uhk-agent/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/ulogd/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/ultrablue-server/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/unstick/default.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/linux/upower/default.nix93
-rw-r--r--nixpkgs/pkgs/os-specific/linux/upower/installed-tests-path.patch56
-rw-r--r--nixpkgs/pkgs/os-specific/linux/util-linux/default.nix36
-rw-r--r--nixpkgs/pkgs/os-specific/linux/vdo/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/virtio_vmmci/default.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/linux/vmm_clock/default.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/linux/wiringpi/default.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/linux/wooting-udev-rules/default.nix6
-rw-r--r--nixpkgs/pkgs/os-specific/linux/wooting-udev-rules/wooting.rules14
-rw-r--r--nixpkgs/pkgs/os-specific/linux/wpa_supplicant/default.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/linux/x86info/default.nix3
-rw-r--r--nixpkgs/pkgs/os-specific/linux/zfs/stable.nix5
-rw-r--r--nixpkgs/pkgs/os-specific/linux/zfs/unstable.nix14
-rw-r--r--nixpkgs/pkgs/os-specific/windows/default.nix6
-rw-r--r--nixpkgs/pkgs/os-specific/windows/mcfgthreads/default.nix11
-rw-r--r--nixpkgs/pkgs/os-specific/windows/mcfgthreads/pre_gcc_13.nix24
245 files changed, 4109 insertions, 1783 deletions
diff --git a/nixpkgs/pkgs/os-specific/bsd/freebsd/evdev-proto/default.nix b/nixpkgs/pkgs/os-specific/bsd/freebsd/evdev-proto/default.nix
index 3c3dcb6d5d67..b6dab0d8bdfc 100644
--- a/nixpkgs/pkgs/os-specific/bsd/freebsd/evdev-proto/default.nix
+++ b/nixpkgs/pkgs/os-specific/bsd/freebsd/evdev-proto/default.nix
@@ -6,7 +6,7 @@ stdenv.mkDerivation {
 
   src = freebsd.ports;
 
-  sourceRoot = "source/devel/evdev-proto";
+  sourceRoot = "${freebsd.ports.name}/devel/evdev-proto";
 
   useTempPrefix = true;
 
diff --git a/nixpkgs/pkgs/os-specific/bsd/netbsd/default.nix b/nixpkgs/pkgs/os-specific/bsd/netbsd/default.nix
index 6bf884d38284..11d8aa2ec3b0 100644
--- a/nixpkgs/pkgs/os-specific/bsd/netbsd/default.nix
+++ b/nixpkgs/pkgs/os-specific/bsd/netbsd/default.nix
@@ -212,7 +212,7 @@ in makeScopeWithSplicing
     ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
       # GNU objcopy produces broken .a libs which won't link into dependers.
       # Makefiles only invoke `$OBJCOPY -x/-X`, so cctools strip works here.
-      "OBJCOPY=${buildPackages.darwin.cctools}/bin/strip"
+      "OBJCOPY=${buildPackages.darwin.cctools-port}/bin/strip"
     ];
     RENAME = "-D";
 
diff --git a/nixpkgs/pkgs/os-specific/darwin/airbuddy/default.nix b/nixpkgs/pkgs/os-specific/darwin/airbuddy/default.nix
new file mode 100644
index 000000000000..303311ccb105
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/darwin/airbuddy/default.nix
@@ -0,0 +1,60 @@
+{ lib
+, stdenvNoCC
+, fetchurl
+, undmg
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "airbuddy";
+  version = "2.7.1";
+
+  src = fetchurl {
+    name = "AirBuddy.dmg";
+    url = "https://download.airbuddy.app/WebDownload/AirBuddy_v${finalAttrs.version}.dmg";
+    hash = "sha256-z8iy3kIBO+1HDgmWxXmFHArLdw85CLNSMvMFZfEJAp0=";
+  };
+
+  dontPatch = true;
+  dontConfigure = true;
+  dontBuild = true;
+  dontFixup = true;
+
+  nativeBuildInputs = [ undmg ];
+
+  # AirBuddy.dmg is not HFS formatted, default unpackPhase fails
+  # https://discourse.nixos.org/t/help-with-error-only-hfs-file-systems-are-supported-on-ventura
+  unpackCmd = ''
+    mnt=$(mktemp -d)
+
+    /usr/bin/hdiutil attach -nobrowse -readonly $src -mountpoint $mnt
+
+    shopt -s extglob
+    DEST="$PWD"
+    (cd "$mnt"; cp -a !(Applications) "$DEST/")
+  '';
+
+  sourceRoot = "AirBuddy.app";
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/Applications/AirBuddy.app
+    cp -R . $out/Applications/AirBuddy.app
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Take Control of Your Wireless Devices on macOS";
+    longDescription = ''
+      Open your AirPods case next to your Mac to see the status right away, just like it works on your iPhone or iPad.
+      AirBuddy lives in your Menu Bar and can also show battery information for your iPhone, iPad, Apple Watch, Mouse, Keyboard, and more.
+    '';
+    homepage = "https://v2.airbuddy.app";
+    changelog = "https://support.airbuddy.app/articles/airbuddy-2-changelog";
+    license = with licenses; [ unfree ];
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+    maintainers = with maintainers; [ stepbrobd ];
+    platforms = [ "aarch64-darwin" "x86_64-darwin" ];
+  };
+})
diff --git a/nixpkgs/pkgs/os-specific/darwin/aldente/default.nix b/nixpkgs/pkgs/os-specific/darwin/aldente/default.nix
new file mode 100644
index 000000000000..6dd464a405f0
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/darwin/aldente/default.nix
@@ -0,0 +1,59 @@
+{ lib
+, stdenvNoCC
+, fetchurl
+, undmg
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "aldente";
+  version = "1.22.2";
+
+  src = fetchurl {
+    url = "https://github.com/davidwernhart/aldente-charge-limiter/releases/download/${finalAttrs.version}/AlDente.dmg";
+    hash = "sha256-bREI0RS4xvEccyw3yed5aD8oG5wmD5hyG82qW2tqlEA=";
+  };
+
+  dontBuild = true;
+  dontFixup = true;
+
+  nativeBuildInputs = [ undmg ];
+
+  # AlDente.dmg is not HFS formatted, default unpackPhase fails
+  # https://discourse.nixos.org/t/help-with-error-only-hfs-file-systems-are-supported-on-ventura
+  unpackCmd = ''
+    if ! [[ "$curSrc" =~ \.dmg$ ]]; then return 1; fi
+    mnt=$(mktemp -d -t ci-XXXXXXXXXX)
+
+    function finish {
+      /usr/bin/hdiutil detach $mnt -force
+    }
+    trap finish EXIT
+
+    /usr/bin/hdiutil attach -nobrowse -readonly $src -mountpoint $mnt
+
+    shopt -s extglob
+    DEST="$PWD"
+    (cd "$mnt"; cp -a !(Applications) "$DEST/")
+  '';
+
+  sourceRoot = "AlDente.app";
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/Applications/AlDente.app
+    cp -R . $out/Applications/AlDente.app
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "macOS tool to limit maximum charging percentage";
+    homepage = "https://apphousekitchen.com";
+    changelog = "https://github.com/davidwernhart/aldente-charge-limiter/releases/tag/${finalAttrs.version}";
+    license = with licenses; [ unfree ];
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+    maintainers = with maintainers; [ stepbrobd ];
+    platforms = [ "aarch64-darwin" "x86_64-darwin" ];
+  };
+})
diff --git a/nixpkgs/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix b/nixpkgs/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix
index 741c1a82f347..fe0d0ca63ea9 100644
--- a/nixpkgs/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix
@@ -62,6 +62,7 @@ let
     if stdenv.isAarch64 then stdenv
     else
       (overrideCC stdenv (mkCc stdenv.cc)).override {
+        extraBuildInputs = [ pkgs.darwin.apple_sdk_11_0.frameworks.CoreFoundation ];
         targetPlatform = stdenv.targetPlatform // {
           darwinMinVersion = "10.12";
           darwinSdkVersion = "11.0";
@@ -75,6 +76,7 @@ let
       name = "llvmPackages_${v}";
       value = pkgs."llvmPackages_${v}" // {
         stdenv = mkStdenv pkgs."llvmPackages_${v}".stdenv;
+        clang = mkCc pkgs."llvmPackages_${v}".clang;
       };
     })
     [ "12" "13" "14" "15" "16" ]
diff --git a/nixpkgs/pkgs/os-specific/darwin/apple-sdk-11.0/private-frameworks.nix b/nixpkgs/pkgs/os-specific/darwin/apple-sdk-11.0/private-frameworks.nix
index 27749dde100a..f95932516d20 100644
--- a/nixpkgs/pkgs/os-specific/darwin/apple-sdk-11.0/private-frameworks.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/apple-sdk-11.0/private-frameworks.nix
@@ -7,14 +7,15 @@
   AddressBookCore = { inherit ContactsPersistence; };
   AudioToolboxCore = {};
   ContactsPersistence = {};
-  UIFoundation = {};
   GameCenterFoundation = {};
   GameCenterUI = {};
   GameCenterUICore = {};
-  URLFormatting = {};
-  SignpostMetrics = {};
+  MediaRemote = {};
   PassKitCore = {};
+  SignpostMetrics = {};
   SkyLight = {};
+  UIFoundation = {};
+  URLFormatting = {};
 
   # Also expose CoreSymbolication; used by `root` package.
   CoreSymbolication = {};
diff --git a/nixpkgs/pkgs/os-specific/darwin/apple-sdk/default.nix b/nixpkgs/pkgs/os-specific/darwin/apple-sdk/default.nix
index 48c423c98929..0c959695d779 100644
--- a/nixpkgs/pkgs/os-specific/darwin/apple-sdk/default.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/apple-sdk/default.nix
@@ -1,6 +1,9 @@
-{ stdenv, fetchurl, xar, cpio, pkgs, python3, pbzx, lib, darwin-stubs, print-reexports }:
+{ stdenv, fetchurl, libxml2, xar, cpio, pkgs, python3Minimal, pbzx, lib, darwin-stubs, print-reexports }:
 
 let
+  xarMinimal = xar.override {
+    libxml2 = libxml2.override { pythonSupport = false; };
+  };
   # sadly needs to be exported because security_tool needs it
   sdk = stdenv.mkDerivation rec {
     pname = "MacOS_SDK";
@@ -16,7 +19,7 @@ let
       sha256 = "13xq34sb7383b37hwy076gnhf96prpk1b4087p87xnwswxbrisih";
     };
 
-    nativeBuildInputs = [ xar cpio python3 pbzx ];
+    nativeBuildInputs = [ xarMinimal cpio python3Minimal pbzx ];
 
     outputs = [ "out" "dev" "man" ];
 
diff --git a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/Libc/825_40_1.nix b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/Libc/825_40_1.nix
deleted file mode 100644
index c9202b536583..000000000000
--- a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/Libc/825_40_1.nix
+++ /dev/null
@@ -1,13 +0,0 @@
-{ appleDerivation', stdenvNoCC, ed, unifdef }:
-
-appleDerivation' stdenvNoCC {
-  nativeBuildInputs = [ ed unifdef ];
-
-  installPhase = ''
-    export SRCROOT=$PWD
-    export DSTROOT=$out
-    export PUBLIC_HEADERS_FOLDER_PATH=include
-    export PRIVATE_HEADERS_FOLDER_PATH=include
-    bash xcodescripts/headers.sh
-  '';
-}
diff --git a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/Libc/default.nix b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/Libc/default.nix
index 915d3a61f816..6ff3cec2f1eb 100644
--- a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/Libc/default.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/Libc/default.nix
@@ -1,4 +1,4 @@
-{ appleDerivation', stdenvNoCC, ed, unifdef, Libc_old, Libc_10-9 }:
+{ appleDerivation', stdenvNoCC, ed, unifdef, Libc_10-9 }:
 
 appleDerivation' stdenvNoCC {
   nativeBuildInputs = [ ed unifdef ];
@@ -7,7 +7,6 @@ appleDerivation' stdenvNoCC {
     ./0001-Define-TARGET_OS_EMBEDDED-in-std-lib-io-if-not-defin.patch
   ];
 
-  # TODO: asl.h actually comes from syslog project now
   installPhase = ''
     export SRCROOT=$PWD
     export DSTROOT=$out
@@ -18,20 +17,6 @@ appleDerivation' stdenvNoCC {
     cp ${./CrashReporterClient.h} $out/include/CrashReporterClient.h
 
     cp ${Libc_10-9}/include/NSSystemDirectories.h $out/include
-
-    # Ugh Apple stopped releasing this stuff so we need an older one...
-    cp    ${Libc_old}/include/spawn.h    $out/include
-    cp    ${Libc_old}/include/setjmp.h   $out/include
-    cp    ${Libc_old}/include/ucontext.h $out/include
-    cp    ${Libc_old}/include/pthread*.h $out/include
-    cp    ${Libc_old}/include/sched.h    $out/include
-    cp -R ${Libc_old}/include/malloc     $out/include
-
-    mkdir -p $out/include/libkern
-    cp ${Libc_old}/include/asl.h                    $out/include
-    cp ${Libc_old}/include/libproc.h                $out/include
-    cp ${Libc_old}/include/libkern/OSAtomic.h       $out/include/libkern
-    cp ${Libc_old}/include/libkern/OSCacheControl.h $out/include/libkern
   '';
 
   appleHeaders = builtins.readFile ./headers.txt;
diff --git a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/Libc/headers.txt b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/Libc/headers.txt
index ea62e31dc781..c7cad6343d8a 100644
--- a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/Libc/headers.txt
+++ b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/Libc/headers.txt
@@ -21,7 +21,6 @@ arpa/inet.h
 arpa/nameser_compat.h
 arpa/telnet.h
 arpa/tftp.h
-asl.h
 assert.h
 bitstring.h
 cpio.h
@@ -49,12 +48,8 @@ langinfo.h
 libc.h
 libc_private.h
 libgen.h
-libkern/OSAtomic.h
-libkern/OSCacheControl.h
-libproc.h
 limits.h
 locale.h
-malloc/malloc.h
 memory.h
 monetary.h
 monitor.h
@@ -72,24 +67,17 @@ protocols/routed.h
 protocols/rwhod.h
 protocols/talkd.h
 protocols/timed.h
-pthread.h
-pthread_impl.h
-pthread_spis.h
-pthread_workqueue.h
 ranlib.h
 readpassphrase.h
 regex.h
 runetype.h
-sched.h
 search.h
 secure/_common.h
 secure/_stdio.h
 secure/_string.h
 semaphore.h
-setjmp.h
 sgtty.h
 signal.h
-spawn.h
 stab.h
 standards.h
 stddef.h
@@ -112,7 +100,6 @@ time.h
 timeconv.h
 ttyent.h
 tzfile.h
-ucontext.h
 ulimit.h
 unistd.h
 util.h
diff --git a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix
index aa93a32c5621..c9cc99a6550e 100644
--- a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix
@@ -1,7 +1,7 @@
-{ lib, stdenv, buildPackages, fetchzip
+{ lib, stdenv, buildPackages, fetchzip, fetchFromGitHub
 , appleDerivation', xnu, Libc, Libm, libdispatch, Libinfo
 , dyld, Csu, architecture, libclosure, CarbonHeaders, ncurses, CommonCrypto
-, copyfile, removefile, libresolvHeaders, libresolv, Libnotify, libplatform, libpthread
+, copyfile, removefile, libresolvHeaders, libresolv, Libnotify, libmalloc, libplatform, libpthread
 , mDNSResponder, launchd, libutilHeaders, hfsHeaders, darwin-stubs
 , headersOnly ? false
 , withLibresolv ? !headersOnly
@@ -30,6 +30,15 @@ let
       fi
     '';
   };
+
+  # Libsystem needs `asl.h` from syslog. This is the version corresponding to the 10.12 SDK
+  # source release, but it hasn’t changed in newer versions.
+  syslog.src = fetchFromGitHub {
+    owner = "apple-oss-distributions";
+    repo = "syslog";
+    rev = "syslog-349.50.5";
+    hash = "sha256-tXLW/TNsluhO1X9Rv3FANyzyOe5TE/hZz0gVo7JGvHA=";
+  };
 in
 appleDerivation' stdenv {
   dontBuild = true;
@@ -57,12 +66,19 @@ appleDerivation' stdenv {
                ${libclosure} ${CarbonHeaders} ${libdispatch} ${ncurses.dev} \
                ${CommonCrypto} ${copyfile} ${removefile} ${libresolvHeaders} \
                ${Libnotify} ${libplatform} ${mDNSResponder} ${launchd} \
-               ${libutilHeaders} ${libpthread} ${hfsHeaders}; do
+               ${libutilHeaders} ${libmalloc} ${libpthread} ${hfsHeaders}; do
       (cd $dep/include && find . -name '*.h' | copyHierarchy $out/include)
     done
 
     (cd ${buildPackages.darwin.cctools.dev}/include/mach-o && find . -name '*.h' | copyHierarchy $out/include/mach-o)
 
+    for header in pthread.h pthread_impl.h pthread_spis.h sched.h; do
+      ln -s "$out/include/pthread/$header" "$out/include/$header"
+    done
+
+    # Copy `asl.h` from the syslog sources since it is no longer provided as part of Libc.
+    cp ${syslog.src}/libsystem_asl.tproj/include/asl.h $out/include
+
     mkdir -p $out/include/os
 
     cp ${darling.src}/src/libc/os/activity.h $out/include/os
diff --git a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/Libsystem/headers.txt b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/Libsystem/headers.txt
index cdca44c7292c..b6e608f81ebf 100644
--- a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/Libsystem/headers.txt
+++ b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/Libsystem/headers.txt
@@ -1381,7 +1381,6 @@ protocols/routed.h
 protocols/rwhod.h
 protocols/talkd.h
 protocols/timed.h
-pthread.h
 pthread/introspection.h
 pthread/pthread.h
 pthread/pthread_impl.h
@@ -1389,9 +1388,6 @@ pthread/pthread_spis.h
 pthread/qos.h
 pthread/sched.h
 pthread/spawn.h
-pthread_impl.h
-pthread_spis.h
-pthread_workqueue.h
 pwd.h
 ranlib.h
 readpassphrase.h
@@ -1414,7 +1410,6 @@ rpc/xdr.h
 rpcsvc/yp_prot.h
 rpcsvc/ypclnt.h
 runetype.h
-sched.h
 search.h
 secure/_common.h
 secure/_stdio.h
diff --git a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/configd/default.nix b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/configd/default.nix
index 37830c0665e1..38b13f784a32 100644
--- a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/configd/default.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/configd/default.nix
@@ -1,67 +1,33 @@
-{ lib, stdenv, appleDerivation', launchd, bootstrap_cmds, xnu, ppp, IOKit, eap8021x, Security
+{ lib, stdenv, appleDerivation', launchd, bootstrap_cmds, xnu, xpc, ppp, IOKit, eap8021x, Security
 , headersOnly ? false }:
 
 appleDerivation' stdenv {
   meta.broken = stdenv.cc.nativeLibc;
 
   nativeBuildInputs = lib.optionals (!headersOnly) [ bootstrap_cmds ];
-  buildInputs = lib.optionals (!headersOnly) [ launchd ppp IOKit eap8021x ];
+  buildInputs = lib.optionals (!headersOnly) [ launchd ppp xpc IOKit eap8021x ];
 
   propagatedBuildInputs = lib.optionals (!headersOnly) [ Security ];
 
-  patchPhase = lib.optionalString (!headersOnly) ''
-    HACK=$PWD/hack
-    mkdir $HACK
-    cp -r ${xnu}/Library/Frameworks/System.framework/Versions/B/PrivateHeaders/net $HACK
-
+  env = lib.optionalAttrs (!headersOnly) {
+    NIX_CFLAGS_COMPILE = toString [
+      "-ISystemConfiguration.framework/Headers"
+      "-I${xnu}/Library/Frameworks/System.framework/Versions/B/PrivateHeaders"
+      "-D_DNS_SD_LIBDISPATCH" # Needed for DNSServiceSetDispatchQueue to be available
+    ];
+  };
 
-    substituteInPlace SystemConfiguration.fproj/SCNetworkReachabilityInternal.h \
-      --replace '#include <xpc/xpc.h>' ""
+  patchPhase = lib.optionalString (!headersOnly) ''
+    substituteInPlace SystemConfiguration.fproj/reachability/SCNetworkReachabilityServer_client.c \
+      --replace '#include <xpc/private.h>' ""
 
     substituteInPlace SystemConfiguration.fproj/SCNetworkReachability.c \
       --replace ''$'#define\tHAVE_VPN_STATUS' ""
 
-    substituteInPlace SystemConfiguration.fproj/reachability/SCNetworkReachabilityServer_client.c \
-      --replace '#include <xpc/xpc.h>' '#include "fake_xpc.h"' \
-      --replace '#include <xpc/private.h>' "" \
-
     # Our neutered CoreFoundation doesn't have this function, but I think we'll live...
     substituteInPlace SystemConfiguration.fproj/SCNetworkConnectionPrivate.c \
       --replace 'CFPreferencesAppValueIsForced(serviceID, USER_PREFERENCES_APPLICATION_ID)' 'FALSE' \
       --replace 'CFPreferencesAppValueIsForced(userPrivate->serviceID, USER_PREFERENCES_APPLICATION_ID)' 'FALSE'
-
-    cat >SystemConfiguration.fproj/fake_xpc.h <<EOF
-    typedef void *xpc_type_t;
-    typedef void *xpc_object_t;
-    typedef void *xpc_connection_t;
-
-    xpc_type_t xpc_get_type(xpc_object_t object);
-    xpc_object_t xpc_dictionary_create(const char * const *keys, const xpc_object_t *values, size_t count);
-    char *xpc_copy_description(xpc_object_t object);
-    int64_t  xpc_dictionary_get_int64(xpc_object_t xdict, const char *key);
-    uint64_t xpc_dictionary_get_uint64(xpc_object_t xdict, const char *key);
-    void xpc_connection_set_event_handler(xpc_connection_t connection, void *handler);
-
-    extern const struct _xpc_type_s _xpc_type_error;
-    #define XPC_TYPE_ERROR (&_xpc_type_error)
-
-    extern const struct _xpc_type_s _xpc_type_dictionary;
-    #define XPC_TYPE_DICTIONARY (&_xpc_type_dictionary)
-
-    extern const struct _xpc_type_s _xpc_type_array;
-    #define XPC_TYPE_ARRAY (&_xpc_type_array)
-
-    extern const struct _xpc_dictionary_s _xpc_error_connection_interrupted;
-    #define XPC_ERROR_CONNECTION_INTERRUPTED (&_xpc_error_connection_interrupted)
-
-    extern const struct _xpc_dictionary_s _xpc_error_connection_invalid;
-    #define XPC_ERROR_CONNECTION_INVALID (&_xpc_error_connection_invalid)
-
-    extern const char *const _xpc_error_key_description;
-    #define XPC_ERROR_KEY_DESCRIPTION _xpc_error_key_description
-
-    #define XPC_CONNECTION_MACH_SERVICE_PRIVILEGED (1 << 1)
-    EOF
   '';
 
   dontBuild = headersOnly;
@@ -177,9 +143,9 @@ appleDerivation' stdenv {
     $CC -I. -Ihelper -Iderived -F. -c DHCP.c -o DHCP.o
     $CC -I. -Ihelper -Iderived -F. -c moh.c -o moh.o
     $CC -I. -Ihelper -Iderived -F. -c DeviceOnHold.c -o DeviceOnHold.o
-    $CC -I. -Ihelper -Iderived -I $HACK -F. -c LinkConfiguration.c -o LinkConfiguration.o
+    $CC -I. -Ihelper -Iderived -F. -c LinkConfiguration.c -o LinkConfiguration.o
     $CC -I. -Ihelper -Iderived -F. -c dy_framework.c -o dy_framework.o
-    $CC -I. -Ihelper -Iderived -I $HACK -F. -c VLANConfiguration.c -o VLANConfiguration.o
+    $CC -I. -Ihelper -Iderived -F. -c VLANConfiguration.c -o VLANConfiguration.o
     $CC -I. -Ihelper -Iderived -F. -c derived/configUser.c -o configUser.o
     $CC -I. -Ihelper -Iderived -F. -c SCPreferencesPathKey.c -o SCPreferencesPathKey.o
     $CC -I. -Ihelper -Iderived -I../dnsinfo -F. -c derived/shared_dns_infoUser.c -o shared_dns_infoUser.o
@@ -188,8 +154,8 @@ appleDerivation' stdenv {
     $CC -I. -Ihelper -Iderived -F. -c SCNetworkProtocol.c -o SCNetworkProtocol.o
     $CC -I. -Ihelper -Iderived -F. -c SCNetworkService.c -o SCNetworkService.o
     $CC -I. -Ihelper -Iderived -F. -c SCNetworkSet.c -o SCNetworkSet.o
-    $CC -I. -Ihelper -Iderived -I $HACK -F. -c BondConfiguration.c -o BondConfiguration.o
-    $CC -I. -Ihelper -Iderived -I $HACK -F. -c BridgeConfiguration.c -o BridgeConfiguration.o
+    $CC -I. -Ihelper -Iderived -F. -c BondConfiguration.c -o BondConfiguration.o
+    $CC -I. -Ihelper -Iderived -F. -c BridgeConfiguration.c -o BridgeConfiguration.o
     $CC -I. -Ihelper -Iderived -F. -c helper/SCHelper_client.c -o SCHelper_client.o
     $CC -I. -Ihelper -Iderived -F. -c SCPreferencesKeychainPrivate.c -o SCPreferencesKeychainPrivate.o
     $CC -I. -Ihelper -Iderived -F. -c SCNetworkSignature.c -o SCNetworkSignature.o
diff --git a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/default.nix b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/default.nix
index ba0e5b3b78b9..ab13e91e3735 100644
--- a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/default.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/default.nix
@@ -19,6 +19,7 @@ let
       Libinfo       = "503.50.4";
       Libsystem     = "1238.60.2";
       removefile    = "45";
+      libmalloc     = "116.50.8";
       libresolv     = "64";
       libplatform   = "126.50.8";
       mDNSResponder = "765.50.9";
@@ -248,6 +249,7 @@ developerToolsPackages_11_3_1 // macosPackages_11_0_1 // {
     CommonCrypto    = applePackage "CommonCrypto"      "osx-10.12.6"     "sha256-FLgODBrfv+XsGaAjddncYAm/BIJJYw6LcwX/z7ncKFM=" {};
     configd         = applePackage "configd"           "osx-10.8.5"      "sha256-6I3FWNjTgds5abEcZrD++s9b+P9a2+qUf8KFAb72DwI=" {
       Security      = applePackage "Security/boot.nix" "osx-10.9.5"      "sha256-7qr0IamjCXCobIJ6V9KtvbMBkJDfRCy4C5eqpHJlQLI=" {};
+      inherit (pkgs.darwin.apple_sdk.libs) xpc;
     };
     copyfile        = applePackage "copyfile"          "osx-10.12.6"     "sha256-uHqLFOIpXK+n0RHyOZzVsP2DDZcFDivKCnqHBaXvHns=" {};
     Csu             = applePackage "Csu"               "osx-10.11.6"     "sha256-h6a/sQMEVeFxKNWAPgKBXjWhyL2L2nvX9BQUMaTQ6sY=" {};
@@ -264,7 +266,6 @@ developerToolsPackages_11_3_1 // macosPackages_11_0_1 // {
         rev    = "Libc-997.90.3";
         hash   = "sha256-B18RNO+Rai5XE52TKdJV7eknosTZ+bRERkiU12d/kPU=";
       };
-      Libc_old        = applePackage "Libc/825_40_1.nix" "osx-10.8.5"      "sha256-JvPSY7FzraGpqF/jYLfhU2o/2195NuKrXsryYfVtx3s=" {};
     };
     libclosure      = applePackage "libclosure"        "osx-10.11.6"     "sha256-L5rQ+UBpf3B+W1U+gZKk7fXulslHsc8lxnCsplV+nr0=" {};
     libdispatch     = applePackage "libdispatch"       "osx-10.10.5"     "sha256-jfAEk0OLrJa9AIZVikIoHomd+l+4rCfc320Xh50qK5M=" {};
@@ -272,6 +273,9 @@ developerToolsPackages_11_3_1 // macosPackages_11_0_1 // {
     Libinfo         = applePackage "Libinfo"           "osx-10.11.6"     "sha256-6F7wiwerv4nz/xXHtp1qCHSaFzZgzcRN+jbmXA5oWOQ=" {};
     Libm            = applePackage "Libm"              "osx-10.7.4"      "sha256-KjMETfT4qJm0m0Ux/F6Rq8bI4Q4UVnFx6IKbKxXd+Es=" {};
     Libnotify       = applePackage "Libnotify"         "osx-10.12.6"     "sha256-6wvMBxAUfiYcQtmlfYCj1d3kFmFM/jdboTd7hRvi3e4=" {};
+    libmalloc       = if stdenv.isx86_64 then
+      applePackage "libmalloc" "osx-10.12.6" "sha256-brfG4GEF2yZipKdhlPq6DhT2z5hKYSb2MAmffaikdO4=" {}
+    else macosPackages_11_0_1.libmalloc;
     libplatform     = applePackage "libplatform"       "osx-10.12.6"     "sha256-6McMTjw55xtnCsFI3AB1osRagnuB5pSTqeMKD3gpGtM=" {};
     libpthread      = applePackage "libpthread"        "osx-10.12.6"     "sha256-QvJ9PERmrCWBiDmOWrLvQUKZ4JxHuh8gS5nlZKDLqE8=" {};
     libresolv       = applePackage "libresolv"         "osx-10.12.6"     "sha256-FtvwjJKSFX6j9APYPC8WLXVOjbHLZa1Gcoc8yxLy8qE=" {};
@@ -310,6 +314,7 @@ developerToolsPackages_11_3_1 // macosPackages_11_0_1 // {
     configdHeaders  = applePackage "configd"           "osx-10.8.5"      "sha256-6I3FWNjTgds5abEcZrD++s9b+P9a2+qUf8KFAb72DwI=" {
       headersOnly = true;
       Security    = null;
+      xpc         = null;
     };
     libutilHeaders  = pkgs.darwin.libutil.override { headersOnly = true; };
     hfsHeaders      = pkgs.darwin.hfs.override { headersOnly = true; };
diff --git a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/libmalloc/default.nix b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/libmalloc/default.nix
new file mode 100644
index 000000000000..8b362a2edd54
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/libmalloc/default.nix
@@ -0,0 +1,10 @@
+{ appleDerivation', stdenvNoCC }:
+
+# Unfortunately, buiding libmalloc is not feasible due to its use of non-public headers, but its
+# headers are needed by Libsystem.
+appleDerivation' stdenvNoCC {
+  installPhase = ''
+    mkdir -p $out/include
+    cp -R include/malloc $out/include/
+  '';
+}
diff --git a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/macos-11.0.1.nix b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/macos-11.0.1.nix
index 1637ed783895..0a70e648695d 100644
--- a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/macos-11.0.1.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/macos-11.0.1.nix
@@ -28,6 +28,7 @@ hfs = applePackage' "hfs" "556.41.1" "macos-11.0.1" "0a0s6b12b0q07wslfifna0bj51d
 libclosure = applePackage' "libclosure" "78" "macos-11.0.1" "0vf9n0k3m8dbprv1bf45zqg0g43bidy2i5z1v9a826bsf8lv7am7" {};
 libdispatch = applePackage' "libdispatch" "1271.40.12" "macos-11.0.1" "1ck5srcjapg18vqb8wl08gacs7ndc6xr067qjn3ngx39q1jdcywz" {};
 libiconv = applePackage' "libiconv" "59" "macos-11.0.1" "0lwa4brdwm4lvrdnxylzsn1yph4m7csgri2zkc4xb4xiisz32pwp" {};
+libmalloc = applePackage' "libmalloc" "317.40.8" "macos-11.0.1" "sha256-Tdhb0mq3w4Hwvp3xHB79Vr22hCOQK6h28HCsd7jvITI=" {};
 libplatform = applePackage' "libplatform" "254.40.4" "macos-11.0.1" "1qf3ri0yd8b1xjln1j1gyx7ks6k3a2jhd63blyvfby75y9s7flky" {};
 libpthread = applePackage' "libpthread" "454.40.3" "macos-11.0.1" "0zljbw8mpb80n1if65hhi9lkgwbgjr8vc9wvf7q1nl3mzyl35f8p" {};
 libresolv = applePackage' "libresolv" "68" "macos-11.0.1" "045ahh8nvaam9whryc2f5g5xagwp7d187r80kcff82snp5p66aq1" {};
diff --git a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/system_cmds/default.nix b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/system_cmds/default.nix
index 0c40bc3b1868..f708d7740900 100644
--- a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/system_cmds/default.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/system_cmds/default.nix
@@ -30,7 +30,12 @@ appleDerivation {
                          "-DAU_SESSION_FLAG_HAS_AUTHENTICATED=0x4000"
                        ] ++ lib.optional (!stdenv.isLinux) " -D__FreeBSD__ ");
 
-  patchPhase = ''
+  patches = [
+    # Fix implicit declarations that cause builds to fail when built with clang 16.
+    ./fix-implicit-declarations.patch
+  ];
+
+  postPatch = ''
     substituteInPlace login.tproj/login.c \
       --replace bsm/audit_session.h bsm/audit.h
     substituteInPlace login.tproj/login_audit.c \
diff --git a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/system_cmds/fix-implicit-declarations.patch b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/system_cmds/fix-implicit-declarations.patch
new file mode 100644
index 000000000000..b08f54045724
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/system_cmds/fix-implicit-declarations.patch
@@ -0,0 +1,48 @@
+diff -ur a/getty.tproj/main.c b/getty.tproj/main.c
+--- a/getty.tproj/main.c	2008-06-10 14:50:19.000000000 -0400
++++ b/getty.tproj/main.c	2023-05-31 18:06:40.121028558 -0400
+@@ -67,6 +67,7 @@
+ #include <syslog.h>
+ #include <termios.h>
+ #include <time.h>
++#include <util.h>
+ #include <unistd.h>
+ 
+ #ifdef __APPLE__
+@@ -152,7 +153,7 @@
+ static void	putpad(const char *);
+ static void	puts(const char *);
+ static void	timeoverrun(int);
+-static char	*getline(int);
++static char	*get_line(int);
+ static void	setttymode(int);
+ static int	opentty(const char *, int);
+ 
+@@ -352,7 +353,7 @@
+ 			if ((fd = open(IF, O_RDONLY)) != -1) {
+ 				char * cp;
+ 
+-				while ((cp = getline(fd)) != NULL) {
++				while ((cp = get_line(fd)) != NULL) {
+ 					  putf(cp);
+ 				}
+ 				close(fd);
+@@ -744,7 +745,7 @@
+ 
+ 
+ static char *
+-getline(int fd)
++get_line(int fd)
+ {
+ 	int i = 0;
+ 	static char linebuf[512];
+--- a/newgrp.tproj/newgrp.c	2021-10-06 01:38:52.000000000 -0400
++++ b/newgrp.tproj/newgrp.c	2023-05-31 22:26:50.656157841 -0400
+@@ -47,6 +47,7 @@
+ #include <string.h>
+ #include <unistd.h>
+ #ifdef __APPLE__
++#include <membership.h>
+ #include <paths.h>
+ #endif /* __APPLE__ */
+ static void	 addgroup(const char *grpname);
diff --git a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix
index 62003a6e4a6c..b05d973bb3d3 100644
--- a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix
@@ -116,6 +116,9 @@ appleDerivation' (if headersOnly then stdenvNoCC else stdenv) (
     cp EXTERNAL_HEADERS/Availability*.h $out/System/Library/Frameworks/Kernel.framework/Versions/A/Headers/
     cp -r EXTERNAL_HEADERS/corecrypto $out/include
 
+    # These headers are needed by Libsystem.
+    cp libsyscall/wrappers/{spawn/spawn.h,libproc/libproc.h} $out/include
+
     # Build the mach headers we crave
     export SRCROOT=$PWD/libsyscall
     export DERIVED_SOURCES_DIR=$out/include
diff --git a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/xnu/headers-arm64.txt b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/xnu/headers-arm64.txt
index fe17d8784e41..23ae12a9b057 100644
--- a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/xnu/headers-arm64.txt
+++ b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/xnu/headers-arm64.txt
@@ -637,6 +637,7 @@ libkern/os/reason_private.h
 libkern/os/refcnt.h
 libkern/os/refcnt_internal.h
 libkern/os/trace.h
+libproc.h
 mach/arm/_structs.h
 mach/arm/asm.h
 mach/arm/boolean.h
@@ -1270,6 +1271,7 @@ servers/ls_defs.h
 servers/netname.h
 servers/netname_defs.h
 servers/nm_defs.h
+spawn.h
 sys/_endian.h
 sys/_posix_availability.h
 sys/_select.h
diff --git a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/xnu/headers-x86_64.txt b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/xnu/headers-x86_64.txt
index 93c0dbb18bf7..8d7d9be7f218 100644
--- a/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/xnu/headers-x86_64.txt
+++ b/nixpkgs/pkgs/os-specific/darwin/apple-source-releases/xnu/headers-x86_64.txt
@@ -554,6 +554,7 @@ libkern/os/object.h
 libkern/os/object_private.h
 libkern/os/overflow.h
 libkern/os/trace.h
+libproc.h
 mach/audit_triggers.defs
 mach/boolean.h
 mach/bootstrap.h
@@ -1116,6 +1117,7 @@ servers/ls_defs.h
 servers/netname.h
 servers/netname_defs.h
 servers/nm_defs.h
+spawn.h
 sys/_endian.h
 sys/_posix_availability.h
 sys/_select.h
diff --git a/nixpkgs/pkgs/os-specific/darwin/bartender/default.nix b/nixpkgs/pkgs/os-specific/darwin/bartender/default.nix
new file mode 100644
index 000000000000..4aca240cba16
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/darwin/bartender/default.nix
@@ -0,0 +1,48 @@
+{ lib
+, stdenvNoCC
+, fetchurl
+, undmg
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "bartender";
+  version = "4.2.21";
+
+  src = fetchurl {
+    name = "Bartender 4.dmg";
+    url = "https://www.macbartender.com/B2/updates/${builtins.replaceStrings [ "." ] [ "-" ] finalAttrs.version}/Bartender%204.dmg";
+    hash = "sha256-KL4Wy8adGiYmxaDkhGJjwobU5szpW2j7ObgHyp02Dow=";
+  };
+
+  dontPatch = true;
+  dontConfigure = true;
+  dontBuild = true;
+  dontFixup = true;
+
+  nativeBuildInputs = [ undmg ];
+
+  sourceRoot = "Bartender 4.app";
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/Applications/Bartender\ 4.app
+    cp -R . $out/Applications/Bartender\ 4.app
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Take control of your menu bar";
+    longDescription = ''
+      Bartender is an award-winning app for macOS that superpowers your menu bar, giving you total control over your menu bar items, what's displayed, and when, with menu bar items only showing when you need them.
+      Bartender improves your workflow with quick reveal, search, custom hotkeys and triggers, and lots more.
+    '';
+    homepage = "https://www.macbartender.com";
+    changelog = "https://www.macbartender.com/Bartender4/release_notes";
+    license = with licenses; [ unfree ];
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+    maintainers = with maintainers; [ stepbrobd ];
+    platforms = [ "aarch64-darwin" "x86_64-darwin" ];
+  };
+})
diff --git a/nixpkgs/pkgs/os-specific/darwin/cctools/darwin-no-memstream.patch b/nixpkgs/pkgs/os-specific/darwin/cctools/darwin-memstream.patch
index bb8a4ad68f3b..3e0d0a43ba8d 100644
--- a/nixpkgs/pkgs/os-specific/darwin/cctools/darwin-no-memstream.patch
+++ b/nixpkgs/pkgs/os-specific/darwin/cctools/darwin-memstream.patch
@@ -1,7 +1,3 @@
-MacOS SDKs before 10.13 don't support open_memstream. This is already replaced
-by a runtime check in cctools-port, but because we build with SDK 10.12 by
-default, linking still fails for us. Disable it entirely here.
-
 --- a/cctools/include/stuff/diagnostics.h
 +++ b/cctools/include/stuff/diagnostics.h
 @@ -60,13 +60,6 @@ void diagnostics_log_msg(enum diagnostic_level level, const char* message);
@@ -16,6 +12,6 @@ default, linking still fails for us. Disable it entirely here.
 -#ifndef HAVE_OPENMEMSTREAM_RUNTIME
 -#  define HAVE_OPENMEMSTREAM_RUNTIME 1
 -#endif
-+#define HAVE_OPENMEMSTREAM_RUNTIME 0
++#define HAVE_OPENMEMSTREAM_RUNTIME 1
  
  #endif /* diagnostics_h */
diff --git a/nixpkgs/pkgs/os-specific/darwin/cctools/llvm.nix b/nixpkgs/pkgs/os-specific/darwin/cctools/llvm.nix
index 11ec2b4d04fa..f2986bf872f7 100644
--- a/nixpkgs/pkgs/os-specific/darwin/cctools/llvm.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/cctools/llvm.nix
@@ -1,9 +1,11 @@
 # Create a cctools-compatible bintools that uses equivalent tools from LLVM in place of the ones
 # from cctools when possible.
 
-{ lib, stdenv, makeWrapper, cctools-port, llvmPackages, enableManpages ? true }:
+{ lib, stdenv, makeWrapper, cctools-port, llvmPackages, enableManpages ? stdenv.targetPlatform == stdenv.hostPlatform }:
 
 let
+  inherit (stdenv) targetPlatform hostPlatform;
+
   cctoolsVersion = lib.getVersion cctools-port;
   llvmVersion = llvmPackages.release_version;
 
@@ -18,6 +20,10 @@ let
   # not appear to have issues, but the source is not available yet (as of June 2023).
   useLLVMStrip = lib.versionAtLeast llvmVersion "15" || lib.versionAtLeast cctoolsVersion "1005.2";
 
+  # Clang 11 performs an optimization on x86_64 that is sensitive to the presence of debug info.
+  # This causes GCC to fail to bootstrap due to object file differences between stages 2 and 3.
+  useClangAssembler = lib.versionAtLeast llvmVersion "12" || !stdenv.isx86_64;
+
   llvm_bins = [
     "dwarfdump"
     "nm"
@@ -50,9 +56,10 @@ let
   ]
   ++ lib.optional (!useLLVMBitcodeStrip) "bitcode_strip"
   ++ lib.optional (!useLLVMOtool) "otool"
-  ++ lib.optional (!useLLVMStrip) "strip";
+  ++ lib.optional (!useLLVMStrip) "strip"
+  ++ lib.optional (!useClangAssembler) "as";
 
-  inherit (stdenv.cc) targetPrefix;
+  targetPrefix = lib.optionalString (targetPlatform != hostPlatform) "${targetPlatform.config}-";
 
   linkManPages = pkg: source: target: lib.optionalString enableManpages ''
     sourcePath=${pkg}/share/man/man1/${source}.1.gz
@@ -77,11 +84,13 @@ stdenv.mkDerivation {
     mkdir -p "$out/bin" "$man"
     ln -s ${lib.getDev cctools-port} "$dev"
 
+  '' + lib.optionalString useClangAssembler ''
     # Use the clang-integrated assembler instead of using `as` from cctools.
     makeWrapper "${lib.getBin llvmPackages.clang-unwrapped}/bin/clang" "$out/bin/${targetPrefix}as" \
       --add-flags "-x assembler -integrated-as -c"
 
-    ln -s "${lib.getBin llvmPackages.bintools-unwrapped}/bin/llvm-ar" "$out/bin/${targetPrefix}ar"
+  '' + ''
+    ln -s "${lib.getBin llvmPackages.bintools-unwrapped}/bin/${targetPrefix}llvm-ar" "$out/bin/${targetPrefix}ar"
     ${linkManPages llvmPackages.llvm-manpages "llvm-ar" "ar"}
 
     for tool in ${toString llvm_bins}; do
@@ -97,7 +106,7 @@ stdenv.mkDerivation {
 
     ${linkManPages (lib.getMan cctools-port) "ld64" "ld64"}
     ${lib.optionalString (!useLLVMOtool)  # The actual man page for otool in cctools is llvm-otool
-      linkManPages (lib.getMan cctools-port) "llvm-otool" "llvm-otool"}
+      (linkManPages (lib.getMan cctools-port) "llvm-otool" "llvm-otool")}
   '';
 
   passthru = { inherit targetPrefix; };
diff --git a/nixpkgs/pkgs/os-specific/darwin/cctools/port.nix b/nixpkgs/pkgs/os-specific/darwin/cctools/port.nix
index 4d8079977513..c9b11ee20155 100644
--- a/nixpkgs/pkgs/os-specific/darwin/cctools/port.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/cctools/port.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, autoconf, automake, libtool, autoreconfHook
+{ lib, stdenv, fetchFromGitHub, autoconf, automake, libtool, autoreconfHook, memstreamHook
 , installShellFiles
 , libuuid
 , libobjc ? null, maloader ? null
@@ -35,7 +35,8 @@ stdenv.mkDerivation {
 
   outputs = [ "out" "dev" "man" ];
 
-  nativeBuildInputs = [ autoconf automake libtool autoreconfHook installShellFiles ];
+  nativeBuildInputs = [ autoconf automake libtool autoreconfHook installShellFiles ]
+    ++ lib.optionals (stdenv.isDarwin && stdenv.isx86_64) [ memstreamHook ];
   buildInputs = [ libuuid ]
     ++ lib.optionals stdenv.isDarwin [ libobjc ]
     ++ lib.optional enableTapiSupport libtapi;
@@ -51,8 +52,9 @@ stdenv.mkDerivation {
       url = "https://github.com/MercuryTechnologies/cctools-port/commit/025899b7b3593dedb0c681e689e57c0e7bbd9b80.patch";
       hash = "sha256-SWVUzFaJHH2fu9y8RcU3Nx/QKx60hPE5zFx0odYDeQs=";
     })
-  ]
-    ++ lib.optional stdenv.isDarwin ./darwin-no-memstream.patch;
+    # Always use `open_memstream`. This is provided by memstream via hook on x86_64-darwin.
+    ./darwin-memstream.patch
+  ];
 
   __propagatedImpureHostDeps = [
     # As far as I can tell, otool from cctools is the only thing that depends on these two, and we should fix them
diff --git a/nixpkgs/pkgs/os-specific/darwin/coconutbattery/default.nix b/nixpkgs/pkgs/os-specific/darwin/coconutbattery/default.nix
new file mode 100644
index 000000000000..69302baa92eb
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/darwin/coconutbattery/default.nix
@@ -0,0 +1,41 @@
+{ lib
+, stdenvNoCC
+, fetchzip
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "coconutbattery";
+  version = "3.9.12";
+
+  src = fetchzip {
+    url = "https://coconut-flavour.com/downloads/coconutBattery_${builtins.replaceStrings [ "." ] [ "" ] finalAttrs.version}.zip";
+    hash = "sha256-8WxGjZbxUqchSIfvpK2RLifn7/TD5nau5hgMzLUiV2o=";
+  };
+
+  dontPatch = true;
+  dontConfigure = true;
+  dontBuild = true;
+  dontFixup = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/Applications/coconutBattery.app
+    cp -R . $out/Applications/coconutBattery.app
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "The standard for battery reading since 2005";
+    longDescription = ''
+      With coconutBattery you are always aware of your current battery health.
+      It shows you live information about the battery quality in your Mac, iPhone and iPad.
+    '';
+    homepage = "https://www.coconut-flavour.com/coconutbattery";
+    license = with licenses; [ unfree ];
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+    maintainers = with maintainers; [ stepbrobd ];
+    platforms = [ "aarch64-darwin" "x86_64-darwin" ];
+  };
+})
diff --git a/nixpkgs/pkgs/os-specific/darwin/grandperspective/default.nix b/nixpkgs/pkgs/os-specific/darwin/grandperspective/default.nix
index a1156c7cb873..0d57d4f27714 100644
--- a/nixpkgs/pkgs/os-specific/darwin/grandperspective/default.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/grandperspective/default.nix
@@ -1,13 +1,13 @@
-{ stdenv, lib, fetchurl, undmg, ... }:
+{ stdenv, lib, fetchurl, undmg }:
 
-stdenv.mkDerivation rec {
-  version = "3.0.1";
+stdenv.mkDerivation (finalAttrs: {
+  version = "3.4.1";
   pname = "grandperspective";
 
   src = fetchurl {
-    inherit version;
-    url = "mirror://sourceforge/grandperspectiv/GrandPerspective-${builtins.replaceStrings [ "." ] [ "_" ] version}.dmg";
-    sha256 = "sha256-ZPqrlN9aw5q7656GmmxCnTRBw3lu9n952rIyun8MsiI=";
+    inherit (finalAttrs) version;
+    url = "mirror://sourceforge/grandperspectiv/GrandPerspective-${lib.replaceStrings [ "." ] [ "_" ] finalAttrs.version}.dmg";
+    hash = "sha256-iTtvP6iONcfDWJ3qMh+TUJMN+3spwCQ/5S+A307BJCM=";
   };
 
   sourceRoot = "GrandPerspective.app";
@@ -26,9 +26,10 @@ stdenv.mkDerivation rec {
       the file's size. Files in the same folder appear together, but their placement is otherwise arbitrary.
     '';
     homepage = "https://grandperspectiv.sourceforge.net";
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     maintainers = with maintainers; [ eliandoran ];
-    platforms = [ "x86_64-darwin" ];
+    platforms = platforms.darwin;
   };
 
-}
+})
diff --git a/nixpkgs/pkgs/os-specific/darwin/hexfiend/default.nix b/nixpkgs/pkgs/os-specific/darwin/hexfiend/default.nix
new file mode 100644
index 000000000000..29767a1154d5
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/darwin/hexfiend/default.nix
@@ -0,0 +1,28 @@
+{ stdenv, lib, fetchurl, undmg }:
+
+stdenv.mkDerivation rec {
+  pname = "hexfiend";
+  version = "2.16.0";
+
+  src = fetchurl {
+    url = "https://github.com/HexFiend/HexFiend/releases/download/v${version}/Hex_Fiend_${lib.versions.majorMinor version}.dmg";
+    sha256 = "sha256-jO57bW5TyuQ0mjKKsSwDoGLp2TZ1d+m159flVGaVrLc=";
+  };
+
+  sourceRoot = "Hex Fiend.app";
+  nativeBuildInputs = [ undmg ];
+  installPhase = ''
+    mkdir -p "$out/Applications/Hex Fiend.app"
+    cp -R . "$out/Applications/Hex Fiend.app"
+  '';
+
+  meta = with lib; {
+    description = "Open-source macOS hex editor";
+    homepage = "http://hexfiend.com/";
+    changelog = "https://hexfiend.github.io/HexFiend/ReleaseNotes.html";
+    license = licenses.bsd2;
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+    maintainers = with maintainers; [ eliandoran ];
+    platforms = platforms.darwin;
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/darwin/libtapi/default.nix b/nixpkgs/pkgs/os-specific/darwin/libtapi/default.nix
index d109e0edcbd8..5a72225eec30 100644
--- a/nixpkgs/pkgs/os-specific/darwin/libtapi/default.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/libtapi/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchFromGitHub, pkgsBuildBuild, cmake, python3, ncurses }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
   pname = "libtapi";
   version = "1100.0.11"; # determined by looking at VERSION.txt
 
@@ -11,7 +11,7 @@ stdenv.mkDerivation {
     sha256 = "1y1yl46msabfy14z0rln333a06087bk14f5h7q1cdawn8nmvbdbr";
   };
 
-  sourceRoot = "source/src/llvm";
+  sourceRoot = "${finalAttrs.src.name}/src/llvm";
 
   # Backported from newer llvm, fixes configure error when cross compiling.
   # Also means we don't have to manually fix the result with install_name_tool.
@@ -71,7 +71,7 @@ stdenv.mkDerivation {
   meta = with lib; {
     description = "Replaces the Mach-O Dynamic Library Stub files in Apple's SDKs to reduce the size";
     homepage = "https://github.com/tpoechtrager/apple-libtapi";
-    license = licenses.apsl20;
+    license = licenses.ncsa;
     maintainers = with maintainers; [ matthewbauer ];
   };
-}
+})
diff --git a/nixpkgs/pkgs/os-specific/darwin/moltenvk/default.nix b/nixpkgs/pkgs/os-specific/darwin/moltenvk/default.nix
index 4d247fa58363..41f929fe90ff 100644
--- a/nixpkgs/pkgs/os-specific/darwin/moltenvk/default.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/moltenvk/default.nix
@@ -3,6 +3,7 @@
 , stdenv
 , fetchurl
 , fetchFromGitHub
+, gitUpdater
 , cctools
 , sigtool
 , cereal
@@ -23,7 +24,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "MoltenVK";
-  version = "1.2.3";
+  version = "1.2.4";
 
   buildInputs = [
     AppKit
@@ -46,7 +47,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "KhronosGroup";
     repo = "MoltenVK";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-GPOF2lyo1eDf1GrPjcj0y1OuUHI/c80L9gSQM+4wEp0=";
+    hash = "sha256-BL46BgZHUpk0dpzmeZ/2W0msHxFwieeGDjmVB8Nb1J4=";
   };
 
   patches = [
@@ -144,8 +145,13 @@ stdenv.mkDerivation (finalAttrs: {
   postFixup = ''
     install_name_tool -id "$out/lib/libMoltenVK.dylib" "$out/lib/libMoltenVK.dylib"
     codesign -s - -f "$out/lib/libMoltenVK.dylib"
+    codesign -s - -f "$bin/bin/MoltenVKShaderConverter"
   '';
 
+  passthru.updateScript = gitUpdater {
+    rev-prefix = "v";
+  };
+
   meta = {
     description = "A Vulkan Portability implementation built on top of Apple’s Metal API";
     homepage = "https://github.com/KhronosGroup/MoltenVK";
diff --git a/nixpkgs/pkgs/os-specific/darwin/plistwatch/default.nix b/nixpkgs/pkgs/os-specific/darwin/plistwatch/default.nix
index 852c9c23aa9b..0c99363510c8 100644
--- a/nixpkgs/pkgs/os-specific/darwin/plistwatch/default.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/plistwatch/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "plistwatch";
-  version = "unstable-2020-12-22";
+  version = "unstable-2023-06-22";
 
   src = fetchFromGitHub {
     owner = "catilac";
     repo = "plistwatch";
-    rev = "c3a9afd8d3e5ffa8dcc379770bc4216bae88a671";
-    sha256 = "0a5rfmpy6h06p02z9gdilh7vr3h9cc6n6zzygpjk6zvnqs3mm3vx";
+    rev = "34d808c1509eea22fe88a2dbb6f0a1669a2a5b23";
+    hash = "sha256-kMHi5xKbiwO+/6Eb8oJz7ECoUybFE+IUDz7VfJueB3g=";
   };
 
-  vendorSha256 = "sha256-Layg1axFN86OFgxEyNFtIlm6Jtx317jZb/KH6IjJ8e4=";
+  vendorHash = "sha256-Layg1axFN86OFgxEyNFtIlm6Jtx317jZb/KH6IjJ8e4=";
 
   #add missing dependencies and hashes
   patches = [ ./go-modules.patch ];
diff --git a/nixpkgs/pkgs/os-specific/darwin/raycast/default.nix b/nixpkgs/pkgs/os-specific/darwin/raycast/default.nix
index 796d3912f977..2116237ad666 100644
--- a/nixpkgs/pkgs/os-specific/darwin/raycast/default.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/raycast/default.nix
@@ -4,20 +4,14 @@
 , undmg
 }:
 
-stdenvNoCC.mkDerivation rec {
+stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "raycast";
-  version = "1.53.0";
+  version = "1.55.2";
 
   src = fetchurl {
-    # https://github.com/NixOS/nixpkgs/pull/223495
-    # official download API: https://api.raycast.app/v2/download
-    # this returns an AWS CloudFront signed URL with expiration timestamp and signature
-    # the returned URL will always be the latest Raycast which might result in an impure derivation
-    # the package maintainer created a repo (https://github.com/stepbrobd/raycast-overlay)
-    # to host GitHub Actions to periodically check for updates
-    # and re-release the `.dmg` file to Internet Archive (https://archive.org/details/raycast)
-    url = "https://archive.org/download/raycast/raycast-${version}.dmg";
-    sha256 = "sha256-IkLbfuzkgO/E8U8PjZ6NQ28WEVeBumKYbbKpK/LPwNY=";
+    name = "Raycast.dmg";
+    url = "https://releases.raycast.com/releases/${finalAttrs.version}/download?build=universal";
+    hash = "sha256-O+9dSXmkNxeY0Rvjn7dcStk/cqmM4y+lrXa5MymYUcY=";
   };
 
   dontPatch = true;
@@ -41,9 +35,9 @@ stdenvNoCC.mkDerivation rec {
   meta = with lib; {
     description = "Control your tools with a few keystrokes";
     homepage = "https://raycast.app/";
-    license = licenses.unfree;
+    license = with licenses; [ unfree ];
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     maintainers = with maintainers; [ lovesegfault stepbrobd ];
-    platforms = platforms.darwin;
+    platforms = [ "aarch64-darwin" "x86_64-darwin" ];
   };
-}
+})
diff --git a/nixpkgs/pkgs/os-specific/darwin/raycast/update.sh b/nixpkgs/pkgs/os-specific/darwin/raycast/update.sh
index d8f4e109da21..e33f8421597d 100755
--- a/nixpkgs/pkgs/os-specific/darwin/raycast/update.sh
+++ b/nixpkgs/pkgs/os-specific/darwin/raycast/update.sh
@@ -1,12 +1,12 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -I nixpkgs=../../../../. -i bash -p common-updater-scripts internetarchive
+#!nix-shell -I nixpkgs=../../../../. -i bash -p common-updater-scripts jq
 
 set -eo pipefail
 
-new_version="$(ia list raycast | grep -Eo '^raycast-.*\.dmg$' | sort -r | head -n1 | sed -E 's/^raycast-([0-9]+\.[0-9]+\.[0-9]+)\.dmg$/\1/')"
-old_version="$(sed -nE 's/\s*version = "(.*)".*/\1/p' ./default.nix)"
+new_version=$(curl --silent https://releases.raycast.com/releases/latest?build=universal | jq -r '.version')
+old_version=$(sed -nE 's/\s*version = "(.*)".*/\1/p' ./default.nix)
 
-if [[ "$new_version" == "$old_version" ]]; then
+if [[ $new_version == $old_version ]]; then
     echo "Already up to date."
     exit 0
 else
@@ -15,6 +15,6 @@ else
     rm ./default.nix.bak
 fi
 
-hash="$(nix --extra-experimental-features nix-command store prefetch-file --json --hash-type sha256 "https://archive.org/download/raycast/raycast-$new_version.dmg" | jq -r '.hash')"
-sed -Ei.bak '/ *sha256 = /{N;N; s@("sha256-)[^;"]+@"'"$hash"'@}' ./default.nix
+hash=$(nix --extra-experimental-features nix-command store prefetch-file --json --hash-type sha256 "https://releases.raycast.com/releases/$new_version/download?build=universal" | jq -r '.hash')
+sed -Ei.bak '/ *hash = /{N;N; s@("sha256-)[^;"]+@"'"$hash"'@}' ./default.nix
 rm ./default.nix.bak
diff --git a/nixpkgs/pkgs/os-specific/darwin/rewrite-tbd/default.nix b/nixpkgs/pkgs/os-specific/darwin/rewrite-tbd/default.nix
index 5cf63754dfbb..7a5467dc92a4 100644
--- a/nixpkgs/pkgs/os-specific/darwin/rewrite-tbd/default.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/rewrite-tbd/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation {
   pname = "rewrite-tbd";
-  version = "20201114";
+  version = "unstable-2023-03-27";
 
   src = fetchFromGitHub {
     owner = "thefloweringash";
     repo = "rewrite-tbd";
-    rev = "988f29c6ccbca9b883966225263d8d78676da6a3";
-    sha256 = "08sk91zwj6n9x2ymwid2k7y0rwv5b7p6h1b25ipx1dv0i43p6v1a";
+    rev = "d7852691762635028d237b7d00c3dc6a6613de79";
+    hash = "sha256-syxioFiGvEv4Ypk5hlIjLQth5YmdFdr+NC+aXSXzG4k=";
   };
 
   # Nix takes care of these paths. Avoiding the use of `pkg-config` prevents an infinite recursion.
@@ -25,7 +25,7 @@ stdenv.mkDerivation {
   meta = with lib; {
     homepage = "https://github.com/thefloweringash/rewrite-tbd/";
     description = "Rewrite filepath in .tbd to Nix applicable format";
-    platforms = platforms.darwin;
+    platforms = platforms.unix;
     license = licenses.mit;
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/darwin/sketchybar/default.nix b/nixpkgs/pkgs/os-specific/darwin/sketchybar/default.nix
index 6d478d8ab334..b27390608a28 100644
--- a/nixpkgs/pkgs/os-specific/darwin/sketchybar/default.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/sketchybar/default.nix
@@ -1,4 +1,13 @@
-{ lib, stdenv, fetchFromGitHub, Carbon, Cocoa, CoreWLAN, DisplayServices, SkyLight }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, Carbon
+, Cocoa
+, CoreWLAN
+, DisplayServices
+, MediaRemote
+, SkyLight
+}:
 
 let
   inherit (stdenv.hostPlatform) system;
@@ -7,34 +16,44 @@ let
     "x86_64-darwin" = "x86";
   }.${system} or (throw "Unsupported system: ${system}");
 in
-
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "sketchybar";
-  version = "2.15.1";
+  version = "2.15.2";
 
   src = fetchFromGitHub {
     owner = "FelixKratz";
     repo = "SketchyBar";
-    rev = "v${version}";
-    hash = "sha256-0jCVDaFc7ZvA8apeHRoQvPhAlaGlBHzqUkS9or88PcM=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-13wc+1IgplB+L0j1AbBr/MUjEo4W38ZgJwrAhbdOroE=";
   };
 
-  buildInputs = [ Carbon Cocoa CoreWLAN DisplayServices SkyLight ];
+  buildInputs = [
+    Carbon
+    Cocoa
+    CoreWLAN
+    DisplayServices
+    MediaRemote
+    SkyLight
+  ];
 
   makeFlags = [
     target
   ];
 
   installPhase = ''
+    runHook preInstall
+
     mkdir -p $out/bin
     cp ./bin/sketchybar $out/bin/sketchybar
+
+    runHook postInstall
   '';
 
-  meta = with lib; {
+  meta = {
     description = "A highly customizable macOS status bar replacement";
     homepage = "https://github.com/FelixKratz/SketchyBar";
-    platforms = platforms.darwin;
-    maintainers = [ maintainers.azuwis ];
-    license = licenses.gpl3;
+    license = lib.licenses.gpl3;
+    maintainers = with lib.maintainers; [ azuwis khaneliman ];
+    platforms = lib.platforms.darwin;
   };
-}
+})
diff --git a/nixpkgs/pkgs/os-specific/darwin/skhd/default.nix b/nixpkgs/pkgs/os-specific/darwin/skhd/default.nix
index ad33cf713d0c..2de0a8d4d510 100644
--- a/nixpkgs/pkgs/os-specific/darwin/skhd/default.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/skhd/default.nix
@@ -1,19 +1,29 @@
-{ lib, stdenv, fetchFromGitHub, Carbon }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, Carbon
+, Cocoa
+}:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "skhd";
-  version = "0.3.5";
+  version = "0.3.9";
 
   src = fetchFromGitHub {
     owner = "koekeishiya";
-    repo = pname;
-    rev = "v${version}";
-    sha256 = "0x099979kgpim18r0vi9vd821qnv0rl3rkj0nd1nx3wljxgf7mrg";
+    repo = "skhd";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-fnkWws/g4BdHKDRhqoCpdPFUavOHdk8R7h7H1dAdAYI=";
   };
 
-  buildInputs = [ Carbon ];
+  buildInputs = [
+    Carbon
+    Cocoa
+  ];
 
-  makeFlags = [ "BUILD_PATH=$(out)/bin" ];
+  makeFlags = [
+    "BUILD_PATH=$(out)/bin"
+  ];
 
   postInstall = ''
     mkdir -p $out/Library/LaunchDaemons
@@ -21,11 +31,11 @@ stdenv.mkDerivation rec {
     substituteInPlace $out/Library/LaunchDaemons/org.nixos.skhd.plist --subst-var out
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Simple hotkey daemon for macOS";
     homepage = "https://github.com/koekeishiya/skhd";
-    platforms = platforms.darwin;
-    maintainers = with maintainers; [ cmacrae lnl7 periklis ];
-    license = licenses.mit;
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ cmacrae lnl7 periklis khaneliman];
+    platforms = lib.platforms.darwin;
   };
-}
+})
diff --git a/nixpkgs/pkgs/os-specific/darwin/swift-corelibs/0002-Add-missing-launchd-header.patch b/nixpkgs/pkgs/os-specific/darwin/swift-corelibs/0002-Add-missing-launchd-header.patch
new file mode 100644
index 000000000000..b1187c56587e
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/darwin/swift-corelibs/0002-Add-missing-launchd-header.patch
@@ -0,0 +1,11 @@
+--- a/CoreFoundation/RunLoop.subproj/CFMessagePort.c	1969-12-31 19:00:01.000000000 -0500
++++ b/CoreFoundation/RunLoop.subproj/CFMessagePort.c	2023-06-09 20:25:28.599209755 -0400
+@@ -28,6 +28,8 @@
+ #endif
+ #endif
+ 
++#include <bootstrap.h>
++
+ extern pid_t getpid(void);
+ 
+ #define __kCFMessagePortMaxNameLengthMax 255
diff --git a/nixpkgs/pkgs/os-specific/darwin/swift-corelibs/0003-Fix-incompatible-pointer-conversion.patch b/nixpkgs/pkgs/os-specific/darwin/swift-corelibs/0003-Fix-incompatible-pointer-conversion.patch
new file mode 100644
index 000000000000..910b622ed3ce
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/darwin/swift-corelibs/0003-Fix-incompatible-pointer-conversion.patch
@@ -0,0 +1,25 @@
+diff -u a/CoreFoundation/URL.subproj/CFURLComponents.c b/CoreFoundation/URL.subproj/CFURLComponents.c
+--- a/CoreFoundation/URL.subproj/CFURLComponents.c	1969-12-31 19:00:01.000000000 -0500
++++ b/CoreFoundation/URL.subproj/CFURLComponents.c	2023-06-09 20:36:52.995514573 -0400
+@@ -66,7 +66,8 @@
+     return CFRetain(CFSTR("A really nice CFURLComponents object"));
+ }
+ 
+-CF_CROSS_PLATFORM_EXPORT void __CFURLComponentsDeallocate(CFURLComponentsRef instance) {
++CF_CROSS_PLATFORM_EXPORT void __CFURLComponentsDeallocate(CFTypeRef cf) {
++    CFURLComponentsRef instance = (CFURLComponentsRef)cf;
+     __CFGenericValidateType(instance, _CFURLComponentsGetTypeID());
+     
+     if (instance->_urlString) CFRelease(instance->_urlString);
+diff -u a/CoreFoundation/URL.subproj/CFURLComponents.h b/CoreFoundation/URL.subproj/CFURLComponents.h
+--- a/CoreFoundation/URL.subproj/CFURLComponents.h	1969-12-31 19:00:01.000000000 -0500
++++ b/CoreFoundation/URL.subproj/CFURLComponents.h	2023-06-09 20:39:36.967857713 -0400
+@@ -38,7 +38,7 @@
+ 
+ CF_EXPORT CFTypeID _CFURLComponentsGetTypeID(void);
+ 
+-CF_CROSS_PLATFORM_EXPORT void __CFURLComponentsDeallocate(CFURLComponentsRef);
++CF_CROSS_PLATFORM_EXPORT void __CFURLComponentsDeallocate(CFTypeRef);
+ 
+ // URLComponents are always mutable.
+ CF_EXPORT _Nullable CFURLComponentsRef _CFURLComponentsCreate(CFAllocatorRef alloc);
diff --git a/nixpkgs/pkgs/os-specific/darwin/swift-corelibs/0004-Fix-Darwin-cmake-build.patch b/nixpkgs/pkgs/os-specific/darwin/swift-corelibs/0004-Fix-Darwin-cmake-build.patch
new file mode 100644
index 000000000000..afffa1abc8e0
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/darwin/swift-corelibs/0004-Fix-Darwin-cmake-build.patch
@@ -0,0 +1,66 @@
+--- a/CoreFoundation/CMakeLists.txt	1969-12-31 19:00:01.000000000 -0500
++++ b/CoreFoundation/CMakeLists.txt	2023-06-29 18:52:49.096019700 -0400
+@@ -129,7 +129,7 @@
+                 Base.subproj/CFByteOrder.h
+                 Base.subproj/CFUUID.h
+                 Base.subproj/CFUtilities.h
+-                Base.subproj/SwiftRuntime/CoreFoundation.h
++                Base.subproj/CoreFoundation.h  # The SwiftRuntime version of this file causes linker errors and is not correct for standalone CF.
+                 Base.subproj/SwiftRuntime/TargetConditionals.h
+                 # Collections
+                 Collections.subproj/CFArray.h
+@@ -245,6 +245,8 @@
+                 # RunLoop
+                 RunLoop.subproj/CFRunLoop.c
+                 RunLoop.subproj/CFSocket.c
++                RunLoop.subproj/CFMachPort.c   # These files are missing from the upstream `CMakeLists.txt` but required to build on Darwin.
++                RunLoop.subproj/CFMessagePort.c
+                 # Stream
+                 Stream.subproj/CFConcreteStreams.c
+                 Stream.subproj/CFSocketStream.c
+@@ -336,6 +338,11 @@
+   target_include_directories(CoreFoundation
+                              PRIVATE
+                                ${CURL_INCLUDE_DIRS})
++elseif(CMAKE_SYSTEM_NAME STREQUAL Darwin)
++  find_package(CURL REQUIRED)
++  target_include_directories(CoreFoundation PRIVATE ${CURL_INCLUDE_DIRS})
++  find_package(LibXml2 REQUIRED)
++  target_include_directories(CoreFoundation PRIVATE ${LIBXML2_INCLUDE_DIR})
+ else()
+   target_include_directories(CoreFoundation
+                              PRIVATE
+@@ -365,6 +372,10 @@
+                         PRIVATE
+                           ${CURL_LIBRARIES}
+                           ${LIBXML2_LIBRARIES})
++elseif(CMAKE_SYSTEM_NAME STREQUAL Darwin)
++  target_link_libraries(CoreFoundation PRIVATE
++    ${CURL_LIBRARIES}
++    ${LIBXML2_LIBRARIES})
+ else()
+   target_link_libraries(CoreFoundation
+                         PRIVATE
+@@ -398,9 +400,19 @@
+   target_link_libraries(CoreFoundation
+                         PRIVATE
+                           icucore)
+-  set_target_properties(CoreFoundation
+-                        PROPERTIES LINK_FLAGS
+-                          -Xlinker;-alias_list;-Xlinker;Base.subproj/DarwinSymbolAliases;-twolevel_namespace;-sectcreate;__UNICODE;__csbitmaps;CharacterSets/CFCharacterSetBitmaps.bitmap;-sectcreate;__UNICODE;__properties;CharacterSets/CFUniCharPropertyDatabase.data;-sectcreate;__UNICODE;__data;CharacterSets/CFUnicodeData-L.mapping;-segprot;__UNICODE;r;r)
++  target_link_options(CoreFoundation
++                      PUBLIC
++                      "LINKER:-alias_list,../Base.subproj/DarwinSymbolAliases"
++                      "LINKER:-twolevel_namespace"
++                      "LINKER:-sectcreate,__UNICODE,__csbitmaps,../CharacterSets/CFCharacterSetBitmaps.bitmap"
++                      "LINKER:-sectcreate,__UNICODE,__properties,../CharacterSets/CFUniCharPropertyDatabase.data"
++                      "LINKER:-sectcreate,__UNICODE,__data,../CharacterSets/CFUnicodeData-L.mapping"
++                      "LINKER:-segprot,__UNICODE,r,r"
++                      "LINKER:-current_version,1454.90.0"
++                      "LINKER:-compatibility_version,150.0.0"
++                      "LINKER:-init,___CFInitialize")
++  set(CMAKE_SHARED_LIBRARY_PREFIX "")
++  set(CMAKE_SHARED_LIBRARY_SUFFIX "")
+ endif()
+ 
+ install(TARGETS
diff --git a/nixpkgs/pkgs/os-specific/darwin/swift-corelibs/0005-Fix-framework-installation-path.patch b/nixpkgs/pkgs/os-specific/darwin/swift-corelibs/0005-Fix-framework-installation-path.patch
new file mode 100644
index 000000000000..e771ab3c66f2
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/darwin/swift-corelibs/0005-Fix-framework-installation-path.patch
@@ -0,0 +1,23 @@
+diff -u aa/CoreFoundation/CMakeLists.txt b/CoreFoundation/CMakeLists.txt
+--- a/CoreFoundation/CMakeLists.txt	1969-12-31 19:00:01.000000000 -0500
++++ b/CoreFoundation/CMakeLists.txt	2023-06-29 18:59:19.492601179 -0400
+
+@@ -424,16 +424,11 @@
+   set(CMAKE_SHARED_LIBRARY_SUFFIX "")
+ endif()
+ 
+-install(TARGETS
+-          CoreFoundation
+-        DESTINATION
+-          "${CMAKE_INSTALL_FULL_LIBDIR}")
+ install(DIRECTORY
+           ${CoreFoundation_FRAMEWORK_DIRECTORY}
+         DESTINATION
+-          ${CMAKE_INSTALL_PREFIX}/System/Library/Frameworks
+-        USE_SOURCE_PERMISSIONS
+-        PATTERN PrivateHeaders EXCLUDE)
++          ${CMAKE_INSTALL_PREFIX}/Library/Frameworks
++        USE_SOURCE_PERMISSIONS)
+ 
+ 
+ # TODO(compnerd) formalize this
diff --git a/nixpkgs/pkgs/os-specific/darwin/swift-corelibs/0006-System-CF-framework-compatibility.patch b/nixpkgs/pkgs/os-specific/darwin/swift-corelibs/0006-System-CF-framework-compatibility.patch
new file mode 100644
index 000000000000..248cb5f60037
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/darwin/swift-corelibs/0006-System-CF-framework-compatibility.patch
@@ -0,0 +1,84 @@
+diff -u a/CoreFoundation/CMakeLists.txt b/CoreFoundation/CMakeLists.txt
+--- a/CoreFoundation/CMakeLists.txt	1969-12-31 19:00:01.000000000 -0500
++++ b/CoreFoundation/CMakeLists.txt	2023-06-29 18:59:08.659632504 -0400
+@@ -1,5 +1,5 @@
+ 
+-cmake_minimum_required(VERSION 3.4.3)
++cmake_minimum_required(VERSION 3.14)
+ list(APPEND CMAKE_MODULE_PATH
+      "${CMAKE_CURRENT_SOURCE_DIR}/cmake/modules")
+ 
+@@ -45,6 +45,8 @@
+                 ${FRAMEWORK_LIBRARY_TYPE}
+               FRAMEWORK_DIRECTORY
+                 CoreFoundation_FRAMEWORK_DIRECTORY
++              VERSION
++                A
+               MODULE_MAP
+                 Base.subproj/module.modulemap
+               PRIVATE_HEADERS
+diff -u a/CoreFoundation/cmake/modules/CoreFoundationAddFramework.cmake b/CoreFoundation/cmake/modules/CoreFoundationAddFramework.cmake
+--- a/CoreFoundation/cmake/modules/CoreFoundationAddFramework.cmake	1969-12-31 19:00:01.000000000 -0500
++++ b/CoreFoundation/cmake/modules/CoreFoundationAddFramework.cmake	2023-06-29 18:57:55.792860996 -0400
+@@ -3,7 +3,7 @@
+ 
+ function(add_framework NAME)
+   set(options STATIC SHARED)
+-  set(single_value_args MODULE_MAP FRAMEWORK_DIRECTORY)
++  set(single_value_args MODULE_MAP FRAMEWORK_DIRECTORY VERSION)
+   set(multiple_value_args PRIVATE_HEADERS PUBLIC_HEADERS SOURCES)
+   cmake_parse_arguments(AF "${options}" "${single_value_args}" "${multiple_value_args}" ${ARGN})
+ 
+@@ -14,26 +14,32 @@
+     set(AF_TYPE SHARED)
+   endif()
+ 
++  file(MAKE_DIRECTORY ${CMAKE_BINARY_DIR}/${NAME}.framework/Versions/${AF_VERSION})
++  file(CREATE_LINK ${AF_VERSION} ${CMAKE_BINARY_DIR}/${NAME}.framework/Versions/Current SYMBOLIC)
++
+   if(AF_MODULE_MAP)
+     file(COPY
+            ${AF_MODULE_MAP}
+          DESTINATION
+-           ${CMAKE_BINARY_DIR}/${NAME}.framework/Modules
++           ${CMAKE_BINARY_DIR}/${NAME}.framework/Versions/Current/Modules
+          NO_SOURCE_PERMISSIONS)
++    file(CREATE_LINK Versions/Current/Modules ${CMAKE_BINARY_DIR}/${NAME}.framework/Modules SYMBOLIC)
+   endif()
+   if(AF_PUBLIC_HEADERS)
+     file(COPY
+            ${AF_PUBLIC_HEADERS}
+          DESTINATION
+-           ${CMAKE_BINARY_DIR}/${NAME}.framework/Headers
++           ${CMAKE_BINARY_DIR}/${NAME}.framework/Versions/Current/Headers
+          NO_SOURCE_PERMISSIONS)
++    file(CREATE_LINK Versions/Current/Headers ${CMAKE_BINARY_DIR}/${NAME}.framework/Headers SYMBOLIC)
+   endif()
+   if(AF_PRIVATE_HEADERS)
+     file(COPY
+            ${AF_PRIVATE_HEADERS}
+          DESTINATION
+-           ${CMAKE_BINARY_DIR}/${NAME}.framework/PrivateHeaders
++           ${CMAKE_BINARY_DIR}/${NAME}.framework/Versions/Current/PrivateHeaders
+          NO_SOURCE_PERMISSIONS)
++    file(CREATE_LINK Versions/Current/PrivateHeaders ${CMAKE_BINARY_DIR}/${NAME}.framework/PrivateHeaders SYMBOLIC)
+   endif()
+   add_custom_target(${NAME}_POPULATE_HEADERS
+                     DEPENDS
+@@ -51,13 +57,15 @@
+   set_target_properties(${NAME}
+                         PROPERTIES
+                           LIBRARY_OUTPUT_DIRECTORY
+-                              ${CMAKE_BINARY_DIR}/${NAME}.framework)
++                              ${CMAKE_BINARY_DIR}/${NAME}.framework/Versions/Current)
+   target_compile_options(${NAME}
+                          PRIVATE
+                            -F;${CMAKE_BINARY_DIR}
+                            -I;${CMAKE_BINARY_DIR}/${NAME}.framework/PrivateHeaders)
+   add_dependencies(${NAME} ${NAME}_POPULATE_HEADERS)
+ 
++  file(CREATE_LINK Versions/Current/${NAME} ${CMAKE_BINARY_DIR}/${NAME}.framework/${NAME} SYMBOLIC)
++
+   if(AF_FRAMEWORK_DIRECTORY)
+     set(${AF_FRAMEWORK_DIRECTORY} ${CMAKE_BINARY_DIR}/${NAME}.framework PARENT_SCOPE)
+   endif()
diff --git a/nixpkgs/pkgs/os-specific/darwin/swift-corelibs/0007-Use-nixpkgs-icu.patch b/nixpkgs/pkgs/os-specific/darwin/swift-corelibs/0007-Use-nixpkgs-icu.patch
new file mode 100644
index 000000000000..78fa517ce76d
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/darwin/swift-corelibs/0007-Use-nixpkgs-icu.patch
@@ -0,0 +1,31 @@
+diff -ur d/CoreFoundation/CMakeLists.txt e/CoreFoundation/CMakeLists.txt
+--- d/CoreFoundation/CMakeLists.txt	1969-12-31 19:00:01.000000000 -0500
++++ e/CoreFoundation/CMakeLists.txt	2023-06-29 19:13:15.561253229 -0400
+@@ -343,6 +343,7 @@
+ elseif(CMAKE_SYSTEM_NAME STREQUAL Darwin)
+   find_package(CURL REQUIRED)
+   target_include_directories(CoreFoundation PRIVATE ${CURL_INCLUDE_DIRS})
++  find_package(ICU COMPONENTS uc i18n data REQUIRED)
+   find_package(LibXml2 REQUIRED)
+   target_include_directories(CoreFoundation PRIVATE ${LIBXML2_INCLUDE_DIR})
+ else()
+@@ -377,6 +378,9 @@
+ elseif(CMAKE_SYSTEM_NAME STREQUAL Darwin)
+   target_link_libraries(CoreFoundation PRIVATE
+     ${CURL_LIBRARIES}
++    ICU::uc
++    ICU::i18n
++    ICU::data
+     ${LIBXML2_LIBRARIES})
+ else()
+   target_link_libraries(CoreFoundation
+@@ -408,9 +412,6 @@
+                         PROPERTIES LINK_FLAGS
+                           -Xlinker;@${CMAKE_SOURCE_DIR}/linux.ld;-Bsymbolic)
+ elseif(CMAKE_SYSTEM_NAME STREQUAL Darwin)
+-  target_link_libraries(CoreFoundation
+-                        PRIVATE
+-                          icucore)
+   target_link_options(CoreFoundation
+                       PUBLIC
+                       "LINKER:-alias_list,../Base.subproj/DarwinSymbolAliases"
diff --git a/nixpkgs/pkgs/os-specific/darwin/swift-corelibs/0008-Dont-link-libcurl.patch b/nixpkgs/pkgs/os-specific/darwin/swift-corelibs/0008-Dont-link-libcurl.patch
new file mode 100644
index 000000000000..4207bf1a82f5
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/darwin/swift-corelibs/0008-Dont-link-libcurl.patch
@@ -0,0 +1,46 @@
+diff -u a/CoreFoundation/CMakeLists.txt b/CoreFoundation/CMakeLists.txt
+--- a/CoreFoundation/CMakeLists.txt	1969-12-31 19:00:01.000000000 -0500
++++ b/CoreFoundation/CMakeLists.txt	2023-06-29 19:39:30.074449222 -0400
+@@ -104,7 +104,6 @@
+                 # URL
+                 URL.subproj/CFURL.inc.h
+                 URL.subproj/CFURLPriv.h
+-                URL.subproj/CFURLSessionInterface.h
+               PUBLIC_HEADERS
+                 # FIXME: PrivateHeaders referenced by public headers
+                 Base.subproj/CFKnownLocations.h
+@@ -120,7 +119,6 @@
+                 String.subproj/CFRegularExpression.h
+                 String.subproj/CFRunArray.h
+                 URL.subproj/CFURLPriv.h
+-                URL.subproj/CFURLSessionInterface.h
+ 
+                 # AppServices
+                 AppServices.subproj/CFNotificationCenter.h
+@@ -280,8 +278,7 @@
+                 URL.subproj/CFURL.c
+                 URL.subproj/CFURLAccess.c
+                 URL.subproj/CFURLComponents.c
+-                URL.subproj/CFURLComponents_URIParser.c
+-                URL.subproj/CFURLSessionInterface.c)
++                URL.subproj/CFURLComponents_URIParser.c)
+ if(CMAKE_SYSTEM_NAME STREQUAL Linux OR CMAKE_SYSTEM_NAME STREQUAL Android)
+   target_compile_definitions(CoreFoundation
+                              PRIVATE
+@@ -341,8 +338,6 @@
+                              PRIVATE
+                                ${CURL_INCLUDE_DIRS})
+ elseif(CMAKE_SYSTEM_NAME STREQUAL Darwin)
+-  find_package(CURL REQUIRED)
+-  target_include_directories(CoreFoundation PRIVATE ${CURL_INCLUDE_DIRS})
+   find_package(ICU COMPONENTS uc i18n data REQUIRED)
+   find_package(LibXml2 REQUIRED)
+   target_include_directories(CoreFoundation PRIVATE ${LIBXML2_INCLUDE_DIR})
+@@ -377,7 +372,6 @@
+                           ${LIBXML2_LIBRARIES})
+ elseif(CMAKE_SYSTEM_NAME STREQUAL Darwin)
+   target_link_libraries(CoreFoundation PRIVATE
+-    ${CURL_LIBRARIES}
+     ICU::uc
+     ICU::i18n
+     ICU::data
diff --git a/nixpkgs/pkgs/os-specific/darwin/swift-corelibs/corefoundation.nix b/nixpkgs/pkgs/os-specific/darwin/swift-corelibs/corefoundation.nix
index 7c48d695e11d..d77976773c66 100644
--- a/nixpkgs/pkgs/os-specific/darwin/swift-corelibs/corefoundation.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/swift-corelibs/corefoundation.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, fetchurl, ninja, python3, curl, libxml2, objc4, ICU }:
+{ lib, stdenv, fetchFromGitHub, fetchurl, makeSetupHook, cmake, ninja, pkg-config, launchd, libdispatch, python3, libxml2, objc4, icu }:
 
 let
   # 10.12 adds a new sysdir.h that our version of CF in the main derivation depends on, but
@@ -21,29 +21,39 @@ stdenv.mkDerivation {
     sha256 = "17kpql0f27xxz4jjw84vpas5f5sn4vdqwv10g151rc3rswbwln1z";
   };
 
-  nativeBuildInputs = [ ninja python3 ];
-  buildInputs = [ curl libxml2 objc4 ICU ];
-
-  patches = [ ./0001-Add-missing-TARGET_OS_-defines.patch ];
+  nativeBuildInputs = [ cmake ninja pkg-config python3 ];
+  buildInputs = [ (lib.getDev launchd) libdispatch libxml2 objc4 icu ];
+
+  patches = [
+    ./0001-Add-missing-TARGET_OS_-defines.patch
+    # CFMessagePort.h uses `bootstrap_check_in` without declaring it, which is defined in the launchd headers.
+    ./0002-Add-missing-launchd-header.patch
+    # CFURLComponents fails to build with clang 16 due to an invalid pointer conversion. This is fixed upstream.
+    ./0003-Fix-incompatible-pointer-conversion.patch
+    # Fix `CMakeLists.txt` to allow it to be used instead of `build.py` to build on Darwin.
+    ./0004-Fix-Darwin-cmake-build.patch
+    # Install CF framework in `$out/Library/Frameworks` instead of `$out/System/Frameworks`.
+    ./0005-Fix-framework-installation-path.patch
+    # Build a framework that matches the contents of the system CoreFoundation. This patch adds
+    # versioning and drops the prefix and suffix, so the dynamic library is named `CoreFoundation`
+    # instead of `libCoreFoundation.dylib`.
+    ./0006-System-CF-framework-compatibility.patch
+    # Link against the nixpkgs ICU instead of using Apple’s vendored version.
+    ./0007-Use-nixpkgs-icu.patch
+    # Don’t link against libcurl. This breaks a cycle between CF and curl, which depends on CF and
+    # uses the SystemConfiguration framework to support NAT64.
+    # This is safe because the symbols provided in CFURLSessionInterface are not provided by the
+    # system CoreFoundation. They are meant to be used by the implementation of `NSURLSession` in
+    # swift-corelibs-foundation, which is not built because it is not fully compatible with the
+    # system Foundation used on Darwin.
+    ./0008-Dont-link-libcurl.patch
+  ];
 
   postPatch = ''
     cd CoreFoundation
 
     cp ${sysdir-free-system-directories} Base.subproj/CFSystemDirectories.c
 
-    # In order, since I can't comment individual lines:
-    # 1. Disable dispatch support for now
-    # 2. For the linker too
-    # 3. Use the legit CoreFoundation.h, not the one telling you not to use it because of Swift
-    substituteInPlace build.py \
-      --replace "cf.CFLAGS += '-DDEPLOYMENT" '#' \
-      --replace "cf.LDFLAGS += '-ldispatch" '#'
-
-    # Fix sandbox impurities.
-    substituteInPlace ../lib/script.py \
-      --replace '/bin/cp' cp
-    patchShebangs --build ../configure
-
     # Includes xpc for some initialization routine that they don't define anyway, so no harm here
     substituteInPlace PlugIn.subproj/CFBundlePriv.h \
       --replace '#if (TARGET_OS_MAC' '#if (0'
@@ -55,53 +65,27 @@ stdenv.mkDerivation {
     # The MIN macro doesn't seem to be defined sensibly for us. Not sure if our stdenv or their bug
     substituteInPlace Base.subproj/CoreFoundation_Prefix.h \
       --replace '#if DEPLOYMENT_TARGET_WINDOWS || DEPLOYMENT_TARGET_LINUX' '#if 1'
-
-    # Somehow our ICU doesn't have this, probably because it's too old (we'll update it soon when we update the rest of the SDK)
-    substituteInPlace Locale.subproj/CFLocale.c \
-      --replace '#if U_ICU_VERSION_MAJOR_NUM' '#if 0 //'
   '';
 
-  BUILD_DIR = "./Build";
-  CFLAGS = "-DINCLUDE_OBJC -I${libxml2.dev}/include/libxml2"; # They seem to assume we include objc in some places and not in others, make a PR; also not sure why but libxml2 include path isn't getting picked up from buildInputs
+  env.NIX_CFLAGS_COMPILE = toString [
+    # Silence warnings regarding other targets
+    "-Wno-error=undef-prefix"
+    # Avoid redefinitions when including objc headers
+    "-DINCLUDE_OBJC=1"
+  ];
 
-  # I'm guessing at the version here. https://github.com/apple/swift-corelibs-foundation/commit/df3ec55fe6c162d590a7653d89ad669c2b9716b1 imported "high sierra"
-  # and this version is a version from there. No idea how accurate it is.
-  LDFLAGS = "-current_version 1454.90.0 -compatibility_version 150.0.0 -init ___CFInitialize";
-
-  configurePhase = ''
-    ../configure release --sysroot UNUSED
-  '';
+  cmakeFlags = [
+    "-DBUILD_SHARED_LIBS=ON"
+    "-DCF_ENABLE_LIBDISPATCH=OFF"
+  ];
 
   enableParallelBuilding = true;
 
-  buildPhase = ''
-    runHook preBuild
-
-    ninja -j $NIX_BUILD_CORES
-
-    runHook postBuild
-  '';
-
-  # TODO: their build system sorta kinda can do this, but it doesn't seem to work right now
-  # Also, this includes a bunch of private headers in the framework, which is not what we want
-  installPhase = ''
-    base="$out/Library/Frameworks/CoreFoundation.framework"
-    mkdir -p $base/Versions/A/{Headers,PrivateHeaders,Modules}
-
-    cp ./Build/CoreFoundation/libCoreFoundation.dylib $base/Versions/A/CoreFoundation
-
-    # Note that this could easily live in the ldflags above as `-install_name @rpath/...` but
-    # https://github.com/NixOS/nixpkgs/issues/46434 thwarts that, so for now I'm hacking it up
-    # after the fact.
-    install_name_tool -id '@rpath/CoreFoundation.framework/Versions/A/CoreFoundation' $base/Versions/A/CoreFoundation
-
-    cp ./Build/CoreFoundation/usr/include/CoreFoundation/*.h $base/Versions/A/Headers
-    cp ./Build/CoreFoundation/usr/include/CoreFoundation/module.modulemap $base/Versions/A/Modules
-
-    ln -s A $base/Versions/Current
+  postInstall = ''
+    install_name_tool -id '@rpath/CoreFoundation.framework/Versions/A/CoreFoundation' \
+      "$out/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation"
 
-    for i in CoreFoundation Headers Modules; do
-      ln -s Versions/Current/$i $base/$i
-    done
+    mkdir -p "$out/nix-support"
+    substituteAll ${./pure-corefoundation-hook.sh} "$out/nix-support/setup-hook"
   '';
 }
diff --git a/nixpkgs/pkgs/os-specific/darwin/swift-corelibs/pure-corefoundation-hook.sh b/nixpkgs/pkgs/os-specific/darwin/swift-corelibs/pure-corefoundation-hook.sh
new file mode 100644
index 000000000000..d5539f50861a
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/darwin/swift-corelibs/pure-corefoundation-hook.sh
@@ -0,0 +1,7 @@
+usePureCoreFoundation() {
+# Avoid overriding value set by the impure CF
+    if [ -z "${NIX_COREFOUNDATION_RPATH:-}" ]; then
+        export NIX_COREFOUNDATION_RPATH=@out@/Library/Frameworks
+    fi
+}
+addEnvHooks "$hostOffset" usePureCoreFoundation
diff --git a/nixpkgs/pkgs/os-specific/darwin/utm/default.nix b/nixpkgs/pkgs/os-specific/darwin/utm/default.nix
index d763414f97c0..2a9879085b0c 100644
--- a/nixpkgs/pkgs/os-specific/darwin/utm/default.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/utm/default.nix
@@ -59,7 +59,7 @@ stdenvNoCC.mkDerivation rec {
     homepage = "https://mac.getutm.app/";
     changelog = "https://github.com/utmapp/${pname}/releases/tag/v${version}";
     mainProgram = "UTM";
-    license = licenses.apsl20;
+    license = licenses.asl20;
     platforms = platforms.darwin; # 11.3 is the minimum supported version as of UTM 4.
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     maintainers = with maintainers; [ rrbutani ];
diff --git a/nixpkgs/pkgs/os-specific/darwin/yabai/default.nix b/nixpkgs/pkgs/os-specific/darwin/yabai/default.nix
index 34cc787b9ed8..703916db553c 100644
--- a/nixpkgs/pkgs/os-specific/darwin/yabai/default.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/yabai/default.nix
@@ -18,7 +18,7 @@
 
 let
   pname = "yabai";
-  version = "5.0.4";
+  version = "5.0.6";
 
   test-version = testers.testVersion {
     package = yabai;
@@ -52,7 +52,7 @@ in
 
     src = fetchzip {
       url = "https://github.com/koekeishiya/yabai/releases/download/v${version}/yabai-v${version}.tar.gz";
-      sha256 = "sha256-2PH3Hi9x0323MjKHPybNmFddvNNlsaDb1LdiVcZTNJc=";
+      sha256 = "sha256-wpm9VnR4yPk6Ybo/V2DMLgRcSzDl3dWGSKDCjYfz+xQ=";
     };
 
     nativeBuildInputs = [
@@ -88,7 +88,7 @@ in
       owner = "koekeishiya";
       repo = "yabai";
       rev = "v${version}";
-      sha256 = "sha256-TCY0EvP0+2+U1k9kYIi8jMt4mj3ZRaQPsb1wtU3Z2U4=";
+      sha256 = "sha256-1/h8f1FQNHn5eVprPVd0can8XHjNyF7j4H3LSN0K8rI=";
     };
 
     nativeBuildInputs = [
diff --git a/nixpkgs/pkgs/os-specific/linux/9ptls/default.nix b/nixpkgs/pkgs/os-specific/linux/9ptls/default.nix
new file mode 100644
index 000000000000..20fa779ecf61
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/9ptls/default.nix
@@ -0,0 +1,28 @@
+{ lib
+, stdenv
+, tlsclient
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  inherit (tlsclient) src version enableParallelBuilding;
+  pname = "9ptls";
+
+  strictDeps = true;
+
+  buildFlags = [ "mount.9ptls" ];
+  installFlags = [ "PREFIX=$(out)" "SBIN=$(out)/bin" ];
+  installTargets = "mount.9ptls.install";
+
+  meta = with lib; {
+    description = "mount.9ptls mount helper";
+    longDescription = ''
+      mount.9ptls wraps the v9fs mount type in a dp9ik authenticated
+      tls tunnel using tlsclient.
+    '';
+    homepage = "https://git.sr.ht/~moody/tlsclient";
+    license = licenses.mit;
+    maintainers = with maintainers; [ moody ];
+    mainProgram = "mount.9ptls";
+    platforms = platforms.linux;
+  };
+})
diff --git a/nixpkgs/pkgs/os-specific/linux/afuse/default.nix b/nixpkgs/pkgs/os-specific/linux/afuse/default.nix
index 5bf32fbe6661..6d8bb81b99c2 100644
--- a/nixpkgs/pkgs/os-specific/linux/afuse/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/afuse/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "afuse";
-  version = "0.4.1";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "pcarrier";
     repo = "afuse";
     rev = "v${version}";
-    sha256 = "06i855h8a1w2jfly2gfy7vwhb2fp74yxbf3r69s28lki2kzwjar6";
+    sha256 = "sha256-KpysJRvDx+12BSl9pIGRqbJAM4W1NbzxMgDycGCr2RM=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
diff --git a/nixpkgs/pkgs/os-specific/linux/akvcam/default.nix b/nixpkgs/pkgs/os-specific/linux/akvcam/default.nix
index 6d916e0ff7fc..f2ea933bd5c5 100644
--- a/nixpkgs/pkgs/os-specific/linux/akvcam/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/akvcam/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
     rev = version;
     sha256 = "1f0vjia2d7zj3y5c63lx1r537bdjx6821yxy29ilbrvsbjq2szj8";
   };
-  sourceRoot = "source/src";
+  sourceRoot = "${src.name}/src";
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
   makeFlags = kernel.makeFlags ++ [
diff --git a/nixpkgs/pkgs/os-specific/linux/android-udev-rules/default.nix b/nixpkgs/pkgs/os-specific/linux/android-udev-rules/default.nix
index 5575ece33149..e74ef7739154 100644
--- a/nixpkgs/pkgs/os-specific/linux/android-udev-rules/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/android-udev-rules/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "android-udev-rules";
-  version = "20230303";
+  version = "20230614";
 
   src = fetchFromGitHub {
     owner = "M0Rf30";
     repo = "android-udev-rules";
     rev = version;
-    sha256 = "sha256-ddalOVt0gLuTcwk322fNNn6WNZx1Ubsa4MgaG0Lmn2k=";
+    sha256 = "sha256-TLQHZYcnO7VzIHH+aCj78plTwK5RrcsU/OfNXApAvdM=";
   };
 
   installPhase = ''
diff --git a/nixpkgs/pkgs/os-specific/linux/apfs/default.nix b/nixpkgs/pkgs/os-specific/linux/apfs/default.nix
index 70c344903f54..d03bd14d81a6 100644
--- a/nixpkgs/pkgs/os-specific/linux/apfs/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/apfs/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation {
     "INSTALL_MOD_PATH=$(out)"
   ];
 
-  passthru.tests.test = nixosTests.apfs;
+  passthru.tests.apfs = nixosTests.apfs;
 
   meta = with lib; {
     description = "APFS module for linux";
@@ -44,7 +44,6 @@ stdenv.mkDerivation {
     homepage = "https://github.com/linux-apfs/linux-apfs-rw";
     license = licenses.gpl2Only;
     platforms = platforms.linux;
-    broken = kernel.kernelOlder "4.9";
     maintainers = with maintainers; [ Luflosi ];
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/apparmor/default.nix b/nixpkgs/pkgs/os-specific/linux/apparmor/default.nix
index 33cdc0fb8450..b85392977c46 100644
--- a/nixpkgs/pkgs/os-specific/linux/apparmor/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/apparmor/default.nix
@@ -22,13 +22,13 @@
 }:
 
 let
-  apparmor-version = "3.1.4";
+  apparmor-version = "3.1.6";
 
   apparmor-meta = component: with lib; {
     homepage = "https://apparmor.net/";
     description = "A mandatory access control system - ${component}";
-    license = licenses.gpl2;
-    maintainers = with maintainers; [ julm thoughtpolice ];
+    license = with licenses; [ gpl2Only lgpl21Only ];
+    maintainers = with maintainers; [ julm thoughtpolice ajs124 ];
     platforms = platforms.linux;
   };
 
@@ -36,7 +36,7 @@ let
     owner = "apparmor";
     repo = "apparmor";
     rev = "v${apparmor-version}";
-    hash = "sha256-YWPdIUd+2x74tqiW+YX8NKh3jxSKhD+5zdiDMjhPzpE=";
+    hash = "sha256-VPgRmmQv+kgLduc6RTu9gotyjT6OImUXsPeatgG7m9E=";
   };
 
   aa-teardown = writeShellScript "aa-teardown" ''
@@ -128,9 +128,10 @@ let
     meta = apparmor-meta "library";
   };
 
-  apparmor-utils = stdenv.mkDerivation {
+  apparmor-utils = python.pkgs.buildPythonApplication {
     pname = "apparmor-utils";
     version = apparmor-version;
+    format = "other";
 
     src = apparmor-sources;
 
@@ -146,14 +147,25 @@ let
       libapparmor.python
     ];
 
+    propagatedBuildInputs = [
+      libapparmor.python
+
+      # Used by aa-notify
+      python.pkgs.notify2
+      python.pkgs.psutil
+    ];
+
     prePatch = prePatchCommon +
       # Do not build vim file
       lib.optionalString stdenv.hostPlatform.isMusl ''
         sed -i ./utils/Makefile -e "/\<vim\>/d"
       '' + ''
-      for file in utils/apparmor/easyprof.py utils/apparmor/aa.py utils/logprof.conf; do
-        substituteInPlace $file --replace "/sbin/apparmor_parser" "${apparmor-parser}/bin/apparmor_parser"
-      done
+      sed -i -E 's/^(DESTDIR|BINDIR|PYPREFIX)=.*//g' ./utils/Makefile
+
+      sed -i utils/aa-unconfined -e "/my_env\['PATH'\]/d"
+
+      substituteInPlace utils/aa-remove-unknown \
+       --replace "/lib/apparmor/rc.apparmor.functions" "${apparmor-parser}/lib/apparmor/rc.apparmor.functions"
     '';
     inherit patches;
     postPatch = "cd ./utils";
@@ -161,17 +173,6 @@ let
     installFlags = [ "DESTDIR=$(out)" "BINDIR=$(out)/bin" "VIM_INSTALL_PATH=$(out)/share" "PYPREFIX=" ];
 
     postInstall = ''
-      sed -i $out/bin/aa-unconfined -e "/my_env\['PATH'\]/d"
-      for prog in aa-audit aa-autodep aa-cleanprof aa-complain aa-disable aa-enforce aa-genprof aa-logprof aa-mergeprof aa-unconfined ; do
-        wrapProgram $out/bin/$prog --prefix PYTHONPATH : "$out/lib/${python.sitePackages}:$PYTHONPATH"
-      done
-
-      substituteInPlace $out/bin/aa-notify \
-        --replace /usr/bin/notify-send ${libnotify}/bin/notify-send \
-        --replace /usr/bin/perl "${perl}/bin/perl -I ${libapparmor}/${perl.libPrefix}"
-
-      substituteInPlace $out/bin/aa-remove-unknown \
-       --replace "/lib/apparmor/rc.apparmor.functions" "${apparmor-parser}/lib/apparmor/rc.apparmor.functions"
       wrapProgram $out/bin/aa-remove-unknown \
        --prefix PATH : ${lib.makeBinPath [ gawk ]}
 
diff --git a/nixpkgs/pkgs/os-specific/linux/aseq2json/default.nix b/nixpkgs/pkgs/os-specific/linux/aseq2json/default.nix
index 646e9f7b7b91..ac1a8220d564 100644
--- a/nixpkgs/pkgs/os-specific/linux/aseq2json/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/aseq2json/default.nix
@@ -1,6 +1,6 @@
 { stdenv, lib, fetchFromGitHub, pkg-config, alsa-lib, glib, json-glib }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
   pname = "aseq2json";
   version = "unstable-2018-04-28";
   src = fetchFromGitHub {
@@ -9,7 +9,7 @@ stdenv.mkDerivation {
     rev = "8572e6313a0d7ec95492dcab04a46c5dd30ef33a";
     sha256 = "LQ9LLVumi3GN6c9tuMSOd1Bs2pgrwrLLQbs5XF+NZeA=";
   };
-  sourceRoot = "source/aseq2json";
+  sourceRoot = "${finalAttrs.src.name}/aseq2json";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ alsa-lib glib json-glib ];
@@ -25,4 +25,4 @@ stdenv.mkDerivation {
     maintainers = [ maintainers.queezle ];
     platforms = platforms.linux;
   };
-}
+})
diff --git a/nixpkgs/pkgs/os-specific/linux/ax99100/default.nix b/nixpkgs/pkgs/os-specific/linux/ax99100/default.nix
index 91999c0113c6..761800cfd7ba 100644
--- a/nixpkgs/pkgs/os-specific/linux/ax99100/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/ax99100/default.nix
@@ -28,6 +28,7 @@ stdenv.mkDerivation {
     ./kernel-6.1-set_termios-const-ktermios.patch
   ] ++ lib.optionals (lib.versionAtLeast kernel.version "6.2") [
     ./kernel-6.2-fix-pointer-type.patch
+    ./kernel-6.4-fix-define-semaphore.patch
   ];
 
   patchFlags = [ "-p0" ];
diff --git a/nixpkgs/pkgs/os-specific/linux/ax99100/kernel-6.4-fix-define-semaphore.patch b/nixpkgs/pkgs/os-specific/linux/ax99100/kernel-6.4-fix-define-semaphore.patch
new file mode 100644
index 000000000000..434bb559e177
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/ax99100/kernel-6.4-fix-define-semaphore.patch
@@ -0,0 +1,14 @@
+--- ax99100_sp.c
++++ ax99100_sp.c
+@@ -2670,8 +2670,10 @@ static void serial99100_dma_tx_tasklet (unsigned long param)
+ 
+ #if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,37)
+ static DECLARE_MUTEX(serial99100_sem);
+-#else
++#elif LINUX_VERSION_CODE < KERNEL_VERSION(6,4,0)
+ static DEFINE_SEMAPHORE(serial99100_sem);
++#else
++static DEFINE_SEMAPHORE(serial99100_sem, 1);
+ #endif
+ 
+ static struct uart_driver starex_serial_driver = {
diff --git a/nixpkgs/pkgs/os-specific/linux/batman-adv/alfred.nix b/nixpkgs/pkgs/os-specific/linux/batman-adv/alfred.nix
index 96040f2828cf..ae7d784591d2 100644
--- a/nixpkgs/pkgs/os-specific/linux/batman-adv/alfred.nix
+++ b/nixpkgs/pkgs/os-specific/linux/batman-adv/alfred.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ gpsd libcap libnl ];
 
   preBuild = ''
-    makeFlags="PREFIX=$out PKG_CONFIG=${pkg-config}/bin/${pkg-config.targetPrefix}pkg-config"
+    makeFlags="PREFIX=$out"
   '';
 
   meta = {
diff --git a/nixpkgs/pkgs/os-specific/linux/batman-adv/batctl.nix b/nixpkgs/pkgs/os-specific/linux/batman-adv/batctl.nix
index 079624c10ad6..b01f48a242a6 100644
--- a/nixpkgs/pkgs/os-specific/linux/batman-adv/batctl.nix
+++ b/nixpkgs/pkgs/os-specific/linux/batman-adv/batctl.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ libnl ];
 
   preBuild = ''
-    makeFlags="PREFIX=$out PKG_CONFIG=${pkg-config}/bin/${pkg-config.targetPrefix}pkg-config"
+    makeFlags="PREFIX=$out"
   '';
 
   meta = {
diff --git a/nixpkgs/pkgs/os-specific/linux/batman-adv/version.nix b/nixpkgs/pkgs/os-specific/linux/batman-adv/version.nix
index 371d41b1c570..e1c026fb533a 100644
--- a/nixpkgs/pkgs/os-specific/linux/batman-adv/version.nix
+++ b/nixpkgs/pkgs/os-specific/linux/batman-adv/version.nix
@@ -1,9 +1,9 @@
 {
-  version = "2023.0";
+  version = "2023.1";
 
   sha256 = {
-    batman-adv = "sha256-LOTsBAYyUue/7DorP6KmGztCx7BNaYumATK/qx1gpc0=";
-    alfred = "sha256-xeytzlDoIoqRK0iUVnrUXW/x0ro5kcl4RW5L75t9utE=";
-    batctl = "sha256-EQcewCth4B4F74Awt72o/xXlxwspSmQgRZLFtssx7SI=";
+    batman-adv = "sha256-9GpyhmYKXsNQahvn72C0ccUaxwVQWX1ZgEBHmre5Nrg=";
+    alfred = "sha256-Q4BIJI83N1fTqL3ny8bbZoX00BBdEw2i9aVPKQkMaXQ=";
+    batctl = "sha256-5b9HMF2VWrsZkkS9Dl//q5YQixr/q9DZcFUz+AWTlfE=";
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/bcc/default.nix b/nixpkgs/pkgs/os-specific/linux/bcc/default.nix
index 65aef6940383..acdaa6796d65 100644
--- a/nixpkgs/pkgs/os-specific/linux/bcc/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/bcc/default.nix
@@ -1,13 +1,26 @@
-{ lib, stdenv, fetchFromGitHub
-, makeWrapper, cmake, llvmPackages
-, flex, bison, elfutils, python, luajit, netperf, iperf, libelf
-, bash, libbpf, nixosTests
-, audit
+{ audit
+, bash
+, bison
+, cmake
+, elfutils
+, fetchFromGitHub
+, flex
+, iperf
+, lib
+, libbpf
+, llvmPackages
+, luajit
+, makeWrapper
+, netperf
+, nixosTests
+, python3
+, stdenv
+, zip
 }:
 
-python.pkgs.buildPythonApplication rec {
+python3.pkgs.buildPythonApplication rec {
   pname = "bcc";
-  version = "0.26.0";
+  version = "0.28.0";
 
   disabled = !stdenv.isLinux;
 
@@ -15,7 +28,7 @@ python.pkgs.buildPythonApplication rec {
     owner = "iovisor";
     repo = "bcc";
     rev = "v${version}";
-    sha256 = "sha256-zx38tPwuuGU6px9pRNN5JtvBysK9fStOvoqe7cLo7LM=";
+    sha256 = "sha256-+ecSaVroDC2bWbio4JsuwEvHQdCMpxLt7hIkeREMJs8=";
   };
   format = "other";
 
@@ -31,8 +44,16 @@ python.pkgs.buildPythonApplication rec {
     ./fix-deadlock-detector-import.patch
   ];
 
-  propagatedBuildInputs = [ python.pkgs.netaddr ];
-  nativeBuildInputs = [ makeWrapper cmake flex bison llvmPackages.llvm.dev ];
+  propagatedBuildInputs = [ python3.pkgs.netaddr ];
+  nativeBuildInputs = [
+    bison
+    cmake
+    flex
+    llvmPackages.llvm.dev
+    makeWrapper
+    python3.pkgs.setuptools
+    zip
+  ];
 
   cmakeFlags = [
     "-DBCC_KERNEL_MODULES_DIR=/run/booted-system/kernel-modules/lib/modules"
@@ -59,6 +80,10 @@ python.pkgs.buildPythonApplication rec {
       --replace '$'{exec_prefix}/@CMAKE_INSTALL_LIBDIR@ @CMAKE_INSTALL_FULL_LIBDIR@
   '';
 
+  preInstall = ''
+    # required for setuptool during install
+    export PYTHONPATH=$out/${python3.sitePackages}:$PYTHONPATH
+  '';
   postInstall = ''
     mkdir -p $out/bin $out/share
     rm -r $out/share/bcc/tools/old
diff --git a/nixpkgs/pkgs/os-specific/linux/below/default.nix b/nixpkgs/pkgs/os-specific/linux/below/default.nix
index 53791e1a59ad..0a91fd585906 100644
--- a/nixpkgs/pkgs/os-specific/linux/below/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/below/default.nix
@@ -22,6 +22,12 @@ rustPlatform.buildRustPackage rec {
 
   cargoSha256 = "sha256-EoRCmEe9SAySZCm+QhaR4ngik4Arnm4SZjgDM5fSRmk=";
 
+  prePatch = ''sed -i "s,ExecStart=.*/bin,ExecStart=$out/bin," etc/below.service'';
+  postInstall = ''
+    install -d $out/lib/systemd/system
+    install -t $out/lib/systemd/system etc/below.service
+  '';
+
   # bpf code compilation
   hardeningDisable = [ "stackprotector" ];
 
@@ -37,5 +43,6 @@ rustPlatform.buildRustPackage rec {
     description = "A time traveling resource monitor for modern Linux systems";
     license = licenses.asl20;
     homepage = "https://github.com/facebookincubator/below";
+    mainProgram = "below";
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/blktrace/default.nix b/nixpkgs/pkgs/os-specific/linux/blktrace/default.nix
index 8ff4b16a1a53..d1b2376e7bd2 100644
--- a/nixpkgs/pkgs/os-specific/linux/blktrace/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/blktrace/default.nix
@@ -13,14 +13,15 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ libaio ];
 
-  preConfigure = ''
-    sed s,/usr/local,$out, -i Makefile
-  '';
+  makeFlags = [
+    "prefix=${placeholder "out"}"
+    "CC:=$(CC)"
+  ];
 
   meta = with lib; {
     description = "Block layer IO tracing mechanism";
-    maintainers = with maintainers; [ ];
-    license = licenses.gpl2;
+    maintainers = with maintainers; [ nickcao ];
+    license = licenses.gpl2Plus;
     platforms = platforms.linux;
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/bluez/default.nix b/nixpkgs/pkgs/os-specific/linux/bluez/default.nix
index 303eb801478c..acb484ba6b6a 100644
--- a/nixpkgs/pkgs/os-specific/linux/bluez/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/bluez/default.nix
@@ -85,7 +85,6 @@ in stdenv.mkDerivation rec {
     "--enable-mesh"
     "--enable-midi"
     "--enable-nfc"
-    "--enable-sap"
     "--enable-sixaxis"
     "--enable-btpclient"
     "--enable-hid2hci"
diff --git a/nixpkgs/pkgs/os-specific/linux/bpftune/default.nix b/nixpkgs/pkgs/os-specific/linux/bpftune/default.nix
new file mode 100644
index 000000000000..da1bd1b384bb
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/bpftune/default.nix
@@ -0,0 +1,73 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, clang
+, bpftools
+, docutils
+, libbpf
+, libcap
+, libnl
+, nixosTests
+}:
+
+stdenv.mkDerivation rec {
+  pname = "bpftune";
+  version = "unstable-2023-07-14";
+
+  src = fetchFromGitHub {
+    owner = "oracle-samples";
+    repo = "bpftune";
+    rev = "66620152bf8c37ab592e9273fe87e567126801c2";
+    hash = "sha256-U0O+F1DBF1xiaUKklwpZORBwF1T9wHM0SPQKUNaxKZk=";
+  };
+
+  postPatch = ''
+    # otherwise shrink rpath would drop $out/lib from rpath
+    substituteInPlace src/Makefile \
+      --replace /lib64   /lib \
+      --replace /sbin    /bin \
+      --replace ldconfig true
+    substituteInPlace src/bpftune.service \
+      --replace /usr/sbin/bpftune "$out/bin/bpftune"
+    substituteInPlace include/bpftune/libbpftune.h \
+      --replace /usr/lib64/bpftune/       "$out/lib/bpftune/" \
+      --replace /usr/local/lib64/bpftune/ "$out/lib/bpftune/"
+  '';
+
+  nativeBuildInputs = [
+    clang
+    bpftools
+    docutils # rst2man
+  ];
+
+  buildInputs = [
+    libbpf
+    libcap
+    libnl
+  ];
+
+  makeFlags = [
+    "prefix=${placeholder "out"}"
+    "confprefix=${placeholder "out"}/etc"
+    "BPFTUNE_VERSION=${version}"
+    "BPF_INCLUDE=${lib.getDev libbpf}/include"
+    "NL_INCLUDE=${lib.getDev libnl}/include/libnl3"
+  ];
+
+  hardeningDisable = [
+    "stackprotector"
+  ];
+
+  passthru.tests = {
+    inherit (nixosTests) bpftune;
+  };
+
+  enableParallelBuilding = true;
+
+  meta = with lib; {
+    description = "BPF-based auto-tuning of Linux system parameters";
+    homepage = "https://github.com/oracle-samples/bpftune";
+    license = licenses.gpl2Only;
+    maintainers = with maintainers; [ nickcao ];
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/cannelloni/default.nix b/nixpkgs/pkgs/os-specific/linux/cannelloni/default.nix
index fb7ad90259be..0a27c53eefc8 100644
--- a/nixpkgs/pkgs/os-specific/linux/cannelloni/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/cannelloni/default.nix
@@ -1,4 +1,5 @@
-{ stdenv, lib, fetchFromGitHub, cmake, lksctp-tools, sctpSupport ? true }:
+{ lib, stdenv, fetchFromGitHub, cmake, lksctp-tools, sctpSupport ? true }:
+
 stdenv.mkDerivation (finalAttrs: {
   pname = "cannelloni";
   version = "1.1.0";
@@ -8,10 +9,14 @@ stdenv.mkDerivation (finalAttrs: {
     rev = "v${finalAttrs.version}";
     hash = "sha256-pAXHo9NCXMFKYcIJogytBiPkQE0nK6chU5TKiDNCKA8=";
   };
-  buildInputs = [ cmake ] ++ lib.optionals sctpSupport [ lksctp-tools ];
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  buildInputs = lib.optionals sctpSupport [ lksctp-tools ];
 
   cmakeFlags = [
-    "-DCMAKE_BUILD_TYPE=Release"
     "-DSCTP_SUPPORT=${lib.boolToString sctpSupport}"
   ];
 
diff --git a/nixpkgs/pkgs/os-specific/linux/cfs-zen-tweaks/default.nix b/nixpkgs/pkgs/os-specific/linux/cfs-zen-tweaks/default.nix
index a894e0bd4b69..ef5dfe8e2e06 100644
--- a/nixpkgs/pkgs/os-specific/linux/cfs-zen-tweaks/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/cfs-zen-tweaks/default.nix
@@ -17,21 +17,16 @@ stdenv.mkDerivation rec {
     sha256 = "HRR2tdjNmWyrpbcMlihSdb/7g/tHma3YyXogQpRCVyo=";
   };
 
-  postPatch = ''
-    patchShebangs set-cfs-zen-tweaks.bash
-    chmod +x set-cfs-zen-tweaks.bash
+  preConfigure = ''
     substituteInPlace set-cfs-zen-tweaks.bash \
       --replace '$(gawk' '$(${gawk}/bin/gawk'
   '';
 
-  buildInputs = [
-    gawk
-  ];
+  preFixup = ''
+    chmod +x $out/lib/cfs-zen-tweaks/set-cfs-zen-tweaks.bash
+  '';
 
-  nativeBuildInputs = [
-    cmake
-    makeWrapper
-  ];
+  nativeBuildInputs = [ cmake ];
 
   meta = with lib; {
     description = "Tweak Linux CPU scheduler for desktop responsiveness";
diff --git a/nixpkgs/pkgs/os-specific/linux/conky/default.nix b/nixpkgs/pkgs/os-specific/linux/conky/default.nix
index a5fbc2817db0..2c2f21022a77 100644
--- a/nixpkgs/pkgs/os-specific/linux/conky/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/conky/default.nix
@@ -51,7 +51,7 @@ assert luaImlib2Support    -> luaSupport && imlib2Support
 assert luaCairoSupport     -> luaSupport && toluapp != null
                                          && cairo   != null;
 assert luaCairoSupport || luaImlib2Support
-                           -> lua.luaversion == "5.3";
+                           -> lua.luaversion == "5.4";
 
 assert wirelessSupport     -> wirelesstools != null;
 assert nvidiaSupport       -> libXNVCtrl != null;
@@ -67,28 +67,29 @@ with lib;
 
 stdenv.mkDerivation rec {
   pname = "conky";
-  version = "1.13.1";
+  version = "1.19.2";
 
   src = fetchFromGitHub {
     owner = "brndnmtthws";
     repo = "conky";
     rev = "v${version}";
-    sha256 = "sha256-3eCRzjfHGFiKuxmRHvnzqAg/+ApUKnHhsumWnio/Qxg=";
+    hash = "sha256-AKU2kHYwhSmNrqZQWLmY82U+WQiuYiZKCJC5c0jG3KQ=";
   };
 
   postPatch = ''
     sed -i -e '/include.*CheckIncludeFile)/i include(CheckIncludeFiles)' \
       cmake/ConkyPlatformChecks.cmake
   '' + optionalString docsSupport ''
-    # Drop examples, since they contain non-ASCII characters that break docbook2x :(
-    sed -i 's/ Example: .*$//' doc/config_settings.xml
-
     substituteInPlace cmake/Conky.cmake --replace "# set(RELEASE true)" "set(RELEASE true)"
 
     cp ${catch2}/include/catch2/catch.hpp tests/catch2/catch.hpp
   '';
 
-  NIX_LDFLAGS = "-lgcc_s";
+  env = {
+    # For some reason -Werror is on by default, causing the project to fail compilation.
+    NIX_CFLAGS_COMPILE = "-Wno-error";
+    NIX_LDFLAGS = "-lgcc_s";
+  };
 
   nativeBuildInputs = [ cmake pkg-config ];
   buildInputs = [ glib libXinerama ]
@@ -137,7 +138,8 @@ stdenv.mkDerivation rec {
   doCheck = true;
 
   meta = with lib; {
-    homepage = "https://conky.sourceforge.net/";
+    homepage = "https://conky.cc";
+    changelog = "https://github.com/brndnmtthws/conky/releases/tag/v${version}";
     description = "Advanced, highly configurable system monitor based on torsmo";
     maintainers = [ maintainers.guibert ];
     license = licenses.gpl3Plus;
diff --git a/nixpkgs/pkgs/os-specific/linux/conntrack-tools/default.nix b/nixpkgs/pkgs/os-specific/linux/conntrack-tools/default.nix
index a5416648a7c0..18a0b9972275 100644
--- a/nixpkgs/pkgs/os-specific/linux/conntrack-tools/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/conntrack-tools/default.nix
@@ -1,7 +1,7 @@
 { fetchurl, lib, stdenv, flex, bison, pkg-config, libmnl, libnfnetlink
 , libnetfilter_conntrack, libnetfilter_queue, libnetfilter_cttimeout
-, libnetfilter_cthelper, systemd
-, libtirpc
+, libnetfilter_cthelper, libtirpc
+, systemdSupport ? true, systemd
 }:
 
 stdenv.mkDerivation rec {
@@ -15,10 +15,16 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     libmnl libnfnetlink libnetfilter_conntrack libnetfilter_queue
-    libnetfilter_cttimeout libnetfilter_cthelper systemd libtirpc
+    libnetfilter_cttimeout libnetfilter_cthelper libtirpc
+  ] ++ lib.optionals systemdSupport [
+    systemd
   ];
   nativeBuildInputs = [ flex bison pkg-config ];
 
+  configureFlags = [
+    (lib.enableFeature systemdSupport "systemd")
+  ];
+
   meta = with lib; {
     homepage = "http://conntrack-tools.netfilter.org/";
     description = "Connection tracking userspace tools";
diff --git a/nixpkgs/pkgs/os-specific/linux/cpuid/default.nix b/nixpkgs/pkgs/os-specific/linux/cpuid/default.nix
index 381576492af4..396baa4b98c1 100644
--- a/nixpkgs/pkgs/os-specific/linux/cpuid/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/cpuid/default.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "cpuid";
-  version = "20230505";
+  version = "20230614";
 
   src = fetchurl {
     url = "http://etallen.com/cpuid/${pname}-${version}.src.tar.gz";
-    sha256 = "sha256-VdMEAM1rq5rPNZft/JpSeiWOOntcQMzJuLMrENPimzA=";
+    sha256 = "sha256-scgwRe/CYHYwd1HgZi1YAnf1+b+JzwJyMaeBIAPDpOg=";
   };
 
   # For pod2man during the build process.
diff --git a/nixpkgs/pkgs/os-specific/linux/cpupower/default.nix b/nixpkgs/pkgs/os-specific/linux/cpupower/default.nix
index cfc0ace8e0a0..13e2fc78b821 100644
--- a/nixpkgs/pkgs/os-specific/linux/cpupower/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/cpupower/default.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation {
   pname = "cpupower";
-  inherit (kernel) version src;
+  inherit (kernel) version src patches;
 
   nativeBuildInputs = [ gettext ];
   buildInputs = [ pciutils ];
diff --git a/nixpkgs/pkgs/os-specific/linux/cryptsetup/default.nix b/nixpkgs/pkgs/os-specific/linux/cryptsetup/default.nix
index 0e7988f4d99a..153719c8b841 100644
--- a/nixpkgs/pkgs/os-specific/linux/cryptsetup/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/cryptsetup/default.nix
@@ -1,5 +1,6 @@
 { lib, stdenv, fetchurl, lvm2, json_c, asciidoctor
 , openssl, libuuid, pkg-config, popt, nixosTests
+, libargon2, withInternalArgon2 ? false
 
   # The release tarballs contain precomputed manpage files, so we don't need
   # to run asciidoctor on the man sources. By avoiding asciidoctor, we make
@@ -37,11 +38,12 @@ stdenv.mkDerivation rec {
   NIX_LDFLAGS = lib.optionalString (stdenv.cc.isGNU && !stdenv.hostPlatform.isStatic) "-lgcc_s";
 
   configureFlags = [
-    "--enable-cryptsetup-reencrypt"
     "--with-crypto_backend=openssl"
     "--disable-ssh-token"
   ] ++ lib.optionals (!rebuildMan) [
     "--disable-asciidoc"
+  ] ++ lib.optionals (!withInternalArgon2) [
+    "--enable-libargon2"
   ] ++ lib.optionals stdenv.hostPlatform.isStatic [
     "--disable-external-tokens"
     # We have to override this even though we're removing token
@@ -51,7 +53,7 @@ stdenv.mkDerivation rec {
   ];
 
   nativeBuildInputs = [ pkg-config ] ++ lib.optionals rebuildMan [ asciidoctor ];
-  buildInputs = [ lvm2 json_c openssl libuuid popt ];
+  buildInputs = [ lvm2 json_c openssl libuuid popt ] ++ lib.optional (!withInternalArgon2) libargon2;
 
   # The test [7] header backup in compat-test fails with a mysterious
   # "out of memory" error, even though tons of memory is available.
@@ -76,7 +78,7 @@ stdenv.mkDerivation rec {
     description = "LUKS for dm-crypt";
     changelog = "https://gitlab.com/cryptsetup/cryptsetup/-/raw/v${version}/docs/v${version}-ReleaseNotes";
     license = lib.licenses.gpl2;
-    maintainers = with lib.maintainers; [ ];
+    maintainers = with lib.maintainers; [ raitobezarius ];
     platforms = with lib.platforms; linux;
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/dbus-broker/default.nix b/nixpkgs/pkgs/os-specific/linux/dbus-broker/default.nix
index c8c437a968a4..847f76a528ce 100644
--- a/nixpkgs/pkgs/os-specific/linux/dbus-broker/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/dbus-broker/default.nix
@@ -11,6 +11,7 @@
 }:
 
 let
+
   dep = { pname, version, hash, rev ? "v${version}", buildInputs ? [ ] }:
     stdenv.mkDerivation {
       inherit pname version;
@@ -30,22 +31,22 @@ let
   c-dvar = dep { pname = "c-dvar"; version = "1.0.0"; hash = "sha256-P7y7gUHXQn2eyS6IcV7m7yGy4VGtQ2orgBkS7Y729ZY="; buildInputs = [ c-stdaux c-utf8 ]; };
   c-ini = dep { pname = "c-ini"; version = "1.0.0"; hash = "sha256-VKxoGexMcquakMmiH5IJt0382TjkV1FLncTSyEqf4X0="; buildInputs = [ c-list c-rbtree c-stdaux c-utf8 ]; };
   c-list = dep { pname = "c-list"; version = "3.1.0"; hash = "sha256-fp3EAqcbFCLaT2EstLSzwP2X13pi2EFpFAullhoCtpw="; };
-  # TODO: Fetch c-rbtree from a tag after its next release
-  c-rbtree = dep { pname = "c-rbtree"; version = "unstable-2022-07-07"; rev = "431a4746705223673e43940ca1ad9b5f52473a4b"; hash = "sha256-ExSPgNqhTjSwRgYfZOAyoaehOpFNHKFqPYkcCfptkrs="; buildInputs = [ c-stdaux ]; };
+  c-rbtree = dep { pname = "c-rbtree"; version = "3.1.0"; hash = "sha256-ozVzL6FllAn8eHbso0RZc/+PGWwEp6r/R1MR+r4Bi/4="; buildInputs = [ c-stdaux ]; };
   c-shquote = dep { pname = "c-shquote"; version = "1.0.0"; hash = "sha256-Ze1enX0VJ6Xi5e4EhWzaiHc7PnuaifrUP+JuJnauv5c="; buildInputs = [ c-stdaux ]; };
-  c-stdaux = dep { pname = "c-stdaux"; version = "1.2.0"; hash = "sha256-/D+IFdqn1XHDfdOsDnLMO5IHQ5B4P4ELyMpRcPBg/4s="; };
+  c-stdaux = dep { pname = "c-stdaux"; version = "1.4.0"; hash = "sha256-gEqXVBAUE0dHD03ina9QbEP26NU12cHKRpuD7GoPmDs="; };
   c-utf8 = dep { pname = "c-utf8"; version = "1.0.0"; hash = "sha256-QEnjmfQ6kxJdsHfyRgXAlP+oGrKLYQ0m9r+D2L+pizI="; buildInputs = [ c-stdaux ]; };
 
 in
-stdenv.mkDerivation rec {
+
+stdenv.mkDerivation ( finalAttrs: {
   pname = "dbus-broker";
-  version = "32";
+  version = "33";
 
   src = fetchFromGitHub {
     owner = "bus1";
     repo = "dbus-broker";
-    rev = "v${version}";
-    hash = "sha256-PVdRyg/t6D3HjSHeap5L8AiEm39iSO5qXohLw2UAUYY=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-c5kEUB2k9CCuno9d4QOUUp1wbQfsvraGDLN6Yaa7T2w=";
   };
 
   patches = [ ./paths.patch ];
@@ -92,4 +93,4 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ peterhoeg ];
     platforms = platforms.linux;
   };
-}
+} )
diff --git a/nixpkgs/pkgs/os-specific/linux/dcgm/default.nix b/nixpkgs/pkgs/os-specific/linux/dcgm/default.nix
new file mode 100644
index 000000000000..36c7e3ca6880
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/dcgm/default.nix
@@ -0,0 +1,147 @@
+{ lib
+, callPackage
+, gcc11Stdenv
+, fetchFromGitHub
+, addOpenGLRunpath
+, catch2
+, cmake
+, cudaPackages_10_2
+, cudaPackages_11_8
+, cudaPackages_12
+, fmt_9
+, git
+, jsoncpp
+, libevent
+, plog
+, python3
+, symlinkJoin
+, tclap_1_4
+, yaml-cpp
+}:
+let
+  # Flags copied from DCGM's libevent build script
+  libevent-nossl = libevent.override { sslSupport = false; };
+  libevent-nossl-static = libevent-nossl.overrideAttrs (super: {
+    CFLAGS = "-Wno-cast-function-type -Wno-implicit-fallthrough -fPIC";
+    CXXFLAGS = "-Wno-cast-function-type -Wno-implicit-fallthrough -fPIC";
+    configureFlags = super.configureFlags ++ [ "--disable-shared" "--with-pic" ];
+  });
+
+  jsoncpp-static = jsoncpp.override { enableStatic = true; };
+
+  # DCGM depends on 3 different versions of CUDA at the same time.
+  # The runtime closure, thankfully, is quite small because most things
+  # are statically linked.
+  cudaPackageSetByVersion = [
+    {
+      version = "10";
+      # Nixpkgs cudaPackages_10 doesn't have redist packages broken out.
+      pkgSet = [
+        cudaPackages_10_2.cudatoolkit
+        cudaPackages_10_2.cudatoolkit.lib
+      ];
+    }
+    {
+      version = "11";
+      pkgSet = getCudaPackages cudaPackages_11_8;
+    }
+    {
+      version = "12";
+      pkgSet = getCudaPackages cudaPackages_12;
+    }
+  ];
+
+  # Select needed redist packages from cudaPackages
+  # C.f. https://github.com/NVIDIA/DCGM/blob/7e1012302679e4bb7496483b32dcffb56e528c92/dcgmbuild/scripts/0080_cuda.sh#L24-L39
+  getCudaPackages = p: with p; [
+    cuda_cccl
+    cuda_cudart
+    cuda_nvcc
+    cuda_nvml_dev
+    libcublas
+    libcufft
+    libcurand
+  ];
+
+  # Builds CMake code to add CUDA paths for include and lib.
+  mkAppendCudaPaths = { version, pkgSet }:
+    let
+      # The DCGM CMake assumes that the folder containing cuda.h contains all headers, so we must
+      # combine everything together for headers to work.
+      # It would be more convenient to use symlinkJoin on *just* the include subdirectories
+      # of each package, but not all of them have an include directory and making that work
+      # is more effort than it's worth for this temporary, build-time package.
+      combined = symlinkJoin {
+        name = "cuda-combined-${version}";
+        paths = pkgSet;
+      };
+      # The combined package above breaks the build for some reason so we just configure
+      # each package's library path.
+      libs = lib.concatMapStringsSep " " (x: ''"${x}/lib"'') pkgSet;
+    in ''
+      list(APPEND Cuda${version}_INCLUDE_PATHS "${combined}/include")
+      list(APPEND Cuda${version}_LIB_PATHS ${libs})
+    '';
+
+# gcc11 is required by DCGM's very particular build system
+# C.f. https://github.com/NVIDIA/DCGM/blob/7e1012302679e4bb7496483b32dcffb56e528c92/dcgmbuild/build.sh#L22
+in gcc11Stdenv.mkDerivation rec {
+  pname = "dcgm";
+  version = "3.1.8";
+
+  src = fetchFromGitHub {
+    owner = "NVIDIA";
+    repo = "DCGM";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-OXqXkP2ZUNPzafGIgJ0MKa39xB84keVFFYl+JsHgnks=";
+  };
+
+  # Add our paths to the CUDA paths so FindCuda.cmake can find them.
+  EXTRA_CUDA_PATHS = lib.concatMapStringsSep "\n" mkAppendCudaPaths cudaPackageSetByVersion;
+  prePatch = ''
+    echo "$EXTRA_CUDA_PATHS"$'\n'"$(cat cmake/FindCuda.cmake)" > cmake/FindCuda.cmake
+  '';
+
+  hardeningDisable = [ "all" ];
+
+  nativeBuildInputs = [
+    addOpenGLRunpath
+    cmake
+    git
+    python3
+
+    jsoncpp-static
+    jsoncpp-static.dev
+    libevent-nossl-static
+    libevent-nossl-static.dev
+    plog.dev # header-only
+    tclap_1_4 # header-only
+  ];
+
+  buildInputs = [
+    catch2
+    fmt_9
+    yaml-cpp
+  ];
+
+  # libcuda.so must be found at runtime because it is supplied by the NVIDIA
+  # driver. autoAddOpenGLRunpathHook breaks on the statically linked exes.
+  postFixup = ''
+    find "$out/bin" "$out/lib" -type f -executable -print0 | while IFS= read -r -d "" f; do
+      if isELF "$f" && [[ $(patchelf --print-needed "$f" || true) == *libcuda.so* ]]; then
+        addOpenGLRunpath "$f"
+      fi
+    done
+  '';
+
+  disallowedReferences = lib.concatMap (x: x.pkgSet) cudaPackageSetByVersion;
+
+  meta = with lib; {
+    description = "Data Center GPU Manager (DCGM) is a daemon that allows users to monitor NVIDIA data-center GPUs.";
+    homepage = "https://developer.nvidia.com/dcgm";
+    license = licenses.asl20;
+    maintainers = teams.deshaw.members;
+    mainProgram = "dcgmi";
+    platforms = platforms.linux;
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/digimend/default.nix b/nixpkgs/pkgs/os-specific/linux/digimend/default.nix
index 8a4a852a4732..11756dcbe85c 100644
--- a/nixpkgs/pkgs/os-specific/linux/digimend/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/digimend/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "digimend";
-  version = "10";
+  version = "unstable-2023-05-03";
 
   src = fetchFromGitHub {
     owner = "digimend";
     repo = "digimend-kernel-drivers";
-    rev = "v${version}";
-    sha256 = "0lifd6cx6aa6hcms4zn4hlla3alra08r0svj5x1l8nlsv0ydnl6i";
+    rev = "eca6e1b701bffb80a293234a485ebf6b4bc85562";
+    hash = "sha256-0mjIUgHvbNcVQVzU3xzaloe5R41a4eknDhdhruJH+6c=";
   };
 
   postPatch = ''
diff --git a/nixpkgs/pkgs/os-specific/linux/displaylink/default.nix b/nixpkgs/pkgs/os-specific/linux/displaylink/default.nix
index e8d1ff829e90..a6f0adc5df30 100644
--- a/nixpkgs/pkgs/os-specific/linux/displaylink/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/displaylink/default.nix
@@ -20,22 +20,22 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "displaylink";
-  version = "5.6.1-59.184";
+  version = "5.7.0-61.129";
 
   src = requireFile rec {
-    name = "displaylink-561.zip";
-    sha256 = "1hihsz35ccydzx04r8r9kz0hvqwj5fgr8zpzvwyhfxp2m549f9w9";
+    name = "displaylink-570.zip";
+    sha256 = "807f1c203ac1e71c6f1f826493b9bb32e277f07cb2cf48537bf8cfdc68dd1515";
     message = ''
       In order to install the DisplayLink drivers, you must first
       comply with DisplayLink's EULA and download the binaries and
       sources from here:
 
-      https://www.synaptics.com/products/displaylink-graphics/downloads/ubuntu-5.6.1
+      https://www.synaptics.com/products/displaylink-graphics/downloads/ubuntu-5.7
 
       Once you have downloaded the file, please use the following
       commands and re-run the installation:
 
-      mv \$PWD/"DisplayLink USB Graphics Software for Ubuntu5.6.1-EXE.zip" \$PWD/${name}
+      mv \$PWD/"DisplayLink USB Graphics Software for Ubuntu5.7-EXE.zip" \$PWD/${name}
       nix-prefetch-url file://\$PWD/${name}
     '';
   };
@@ -71,7 +71,7 @@ stdenv.mkDerivation rec {
     description = "DisplayLink DL-5xxx, DL-41xx and DL-3x00 Driver for Linux";
     homepage = "https://www.displaylink.com/";
     license = licenses.unfree;
-    maintainers = with maintainers; [ abbradar peterhoeg eyjhb ];
+    maintainers = with maintainers; [ abbradar ];
     platforms = [ "x86_64-linux" "i686-linux" ];
     hydraPlatforms = [];
   };
diff --git a/nixpkgs/pkgs/os-specific/linux/erofs-utils/default.nix b/nixpkgs/pkgs/os-specific/linux/erofs-utils/default.nix
deleted file mode 100644
index d84edfc56d95..000000000000
--- a/nixpkgs/pkgs/os-specific/linux/erofs-utils/default.nix
+++ /dev/null
@@ -1,25 +0,0 @@
-{ lib, stdenv, fetchurl, autoreconfHook, pkg-config, fuse, libuuid, lz4 }:
-
-stdenv.mkDerivation rec {
-  pname = "erofs-utils";
-  version = "1.6";
-  outputs = [ "out" "man" ];
-
-  src = fetchurl {
-    url =
-      "https://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs-utils.git/snapshot/erofs-utils-${version}.tar.gz";
-    sha256 = "sha256-2/Gtrv8buFMrKacsip4ZGTjJOJlGdw3HY9PFnm8yBXE=";
-  };
-
-  nativeBuildInputs = [ autoreconfHook pkg-config ];
-  buildInputs = [ fuse libuuid lz4 ];
-
-  configureFlags = [ "--enable-fuse" ];
-
-  meta = with lib; {
-    description = "Userspace utilities for linux-erofs file system";
-    license = with licenses; [ gpl2Plus ];
-    maintainers = with maintainers; [ ehmry ];
-    platforms = platforms.linux;
-  };
-}
diff --git a/nixpkgs/pkgs/os-specific/linux/esdm/default.nix b/nixpkgs/pkgs/os-specific/linux/esdm/default.nix
new file mode 100644
index 000000000000..42e20981872f
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/esdm/default.nix
@@ -0,0 +1,87 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, fetchpatch
+, protobufc
+, pkg-config
+, fuse3
+, meson
+, ninja
+, libselinux
+, jitterentropy
+  # A more detailed explaination of the following meson build options can be found
+  # in the source code of esdm.
+  # A brief explanation is given:
+, selinux ? false # enable selinux support
+, drngHashDrbg ? true  # set the default drng callback
+, drngChaCha20 ? false # set the default drng callback
+, ais2031 ? false # set the seeding strategy to be compliant with AIS 20/31
+, linuxDevFiles ? true # enable linux /dev/random and /dev/urandom support
+, linuxGetRandom ? true # enable linux getrandom support
+, esJitterRng ? true # enable support for the entropy source: jitter rng
+, esCPU ? true # enable support for the entropy source: cpu-based entropy
+, esKernel ? true # enable support for the entropy source: kernel-based entropy
+, esIRQ ? false # enable support for the entropy source: interrupt-based entropy
+, esSched ? false # enable support for the entropy source: scheduler-based entropy
+, esHwrand ? true # enable support for the entropy source: /dev/hwrng
+, hashSha512 ? false # set the conditioning hash: SHA2-512
+, hashSha3_512 ? true # set the conditioning hash: SHA3-512
+}:
+
+assert drngHashDrbg != drngChaCha20;
+assert hashSha512 != hashSha3_512;
+
+stdenv.mkDerivation rec {
+  pname = "esdm";
+  version = "0.6.0";
+
+  src = fetchFromGitHub {
+    owner = "smuellerDD";
+    repo = "esdm";
+    rev = "v${version}";
+    sha256 = "sha256-swBKVb5gnND76w2ULT+5hR/jVOqxEe4TAB1gyaLKE9Q=";
+  };
+
+  patches = [
+    (fetchpatch {
+      name = "arm64.patch";
+      url = "https://github.com/smuellerDD/esdm/commit/86b93a0ddf684448aba152c8f1b3baf40a6d41c0.patch";
+      sha256 = "sha256-gjp13AEsDNj23fcGanAAn2KCbYKA0cphhf4mCxek9Yg=";
+    })
+  ];
+
+  nativeBuildInputs = [ meson pkg-config ninja ];
+  buildInputs = [ protobufc fuse3 jitterentropy ]
+    ++ lib.optional selinux libselinux;
+
+  mesonFlags = [
+    (lib.mesonBool "b_lto" false)
+    (lib.mesonBool "ais2031" ais2031)
+    (lib.mesonEnable "linux-devfiles" linuxDevFiles)
+    (lib.mesonEnable "linux-getrandom" linuxGetRandom)
+    (lib.mesonEnable "es_jent" esJitterRng)
+    (lib.mesonEnable "es_cpu" esCPU)
+    (lib.mesonEnable "es_kernel" esKernel)
+    (lib.mesonEnable "es_irq" esIRQ)
+    (lib.mesonEnable "es_sched" esSched)
+    (lib.mesonEnable "es_hwrand" esHwrand)
+    (lib.mesonEnable "hash_sha512" hashSha512)
+    (lib.mesonEnable "hash_sha3_512" hashSha3_512)
+    (lib.mesonEnable "selinux" selinux)
+    (lib.mesonEnable "drng_hash_drbg" drngHashDrbg)
+    (lib.mesonEnable "drng_chacha20" drngChaCha20)
+  ];
+
+  doCheck = true;
+
+  strictDeps = true;
+  mesonBuildType = "release";
+
+  meta = {
+    homepage = "https://www.chronox.de/esdm.html";
+    description = "Entropy Source and DRNG Manager in user space";
+    license = with lib.licenses; [ gpl2Only bsd3 ];
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ orichter thillux ];
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/evdi/0000-fix-drm-path.patch b/nixpkgs/pkgs/os-specific/linux/evdi/0000-fix-drm-path.patch
new file mode 100644
index 000000000000..a389b73185dd
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/evdi/0000-fix-drm-path.patch
@@ -0,0 +1,31 @@
+diff --git a/module/Makefile b/module/Makefile
+index fe573de..c8022c8 100644
+--- a/module/Makefile
++++ b/module/Makefile
+@@ -50,7 +50,7 @@ ifneq ($(KERNELRELEASE),)
+ # inside kbuild
+ # Note: this can be removed once it is in kernel tree and Kconfig is properly used
+ CONFIG_DRM_EVDI := m
+-ccflags-y := -isystem include/uapi/drm include/drm $(CFLAGS) $(EL8FLAG) $(EL9FLAG) $(RPIFLAG)
++ccflags-y := -isystem include/uapi/drm $(CFLAGS) $(EL8FLAG) $(EL9FLAG) $(RPIFLAG)
+ evdi-y := evdi_platform_drv.o evdi_platform_dev.o evdi_sysfs.o evdi_modeset.o evdi_connector.o evdi_encoder.o evdi_drm_drv.o evdi_fb.o evdi_gem.o evdi_painter.o evdi_params.o evdi_cursor.o evdi_debug.o evdi_i2c.o
+ evdi-$(CONFIG_COMPAT) += evdi_ioc32.o
+ obj-$(CONFIG_DRM_EVDI) := evdi.o
+diff --git a/module/evdi_drm.h b/module/evdi_drm.h
+index 29b8427..5012693 100644
+--- a/module/evdi_drm.h
++++ b/module/evdi_drm.h
+@@ -12,12 +12,11 @@
+ 
+ #ifdef __KERNEL__
+ #include <linux/types.h>
++#include <drm/drm.h>
+ #else
+ #include <stdint.h>
+ #endif
+ 
+-#include "drm.h"
+-
+ /* Output events sent from driver to evdi lib */
+ #define DRM_EVDI_EVENT_UPDATE_READY  0x80000000
+ #define DRM_EVDI_EVENT_DPMS          0x80000001
diff --git a/nixpkgs/pkgs/os-specific/linux/evdi/default.nix b/nixpkgs/pkgs/os-specific/linux/evdi/default.nix
index f8f4f400ade2..71ab8bea79e0 100644
--- a/nixpkgs/pkgs/os-specific/linux/evdi/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/evdi/default.nix
@@ -1,21 +1,25 @@
-{ lib, stdenv, fetchFromGitHub, kernel, libdrm }:
-
+{ lib, stdenv, fetchFromGitHub, kernel, libdrm, python3 }:
+let
+  python3WithLibs = python3.withPackages (ps: with ps; [
+    pybind11
+  ]);
+in
 stdenv.mkDerivation rec {
   pname = "evdi";
-  version = "unstable-2022-10-13";
+  version = "1.13.1";
 
   src = fetchFromGitHub {
     owner = "DisplayLink";
     repo = pname;
-    rev = "bdc258b25df4d00f222fde0e3c5003bf88ef17b5";
-    hash = "sha256-mt+vEp9FFf7smmE2PzuH/3EYl7h89RBN1zTVvv2qJ/o=";
+    rev = "v${version}";
+    hash = "sha256-Or4hhnFOtC8vmB4kFUHbFHn2wg/NsUMY3d2Tiea6YbY=";
   };
 
   env.NIX_CFLAGS_COMPILE = "-Wno-error -Wno-error=sign-compare";
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
 
-  buildInputs = [ kernel libdrm ];
+  buildInputs = [ kernel libdrm python3WithLibs ];
 
   makeFlags = kernel.makeFlags ++ [
     "KVER=${kernel.modDirVersion}"
@@ -31,9 +35,13 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  patches = [
+    ./0000-fix-drm-path.patch
+  ];
+
   meta = with lib; {
     description = "Extensible Virtual Display Interface";
-    maintainers = with maintainers; [ eyjhb ];
+    maintainers = with maintainers; [ ];
     platforms = platforms.linux;
     license = with licenses; [ lgpl21Only gpl2Only ];
     homepage = "https://www.displaylink.com/";
diff --git a/nixpkgs/pkgs/os-specific/linux/fanout/default.nix b/nixpkgs/pkgs/os-specific/linux/fanout/default.nix
new file mode 100644
index 000000000000..3352f59a05f7
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/fanout/default.nix
@@ -0,0 +1,37 @@
+{ lib, stdenv, fetchFromGitHub, kernel, kmod }:
+
+stdenv.mkDerivation rec {
+  pname = "fanout";
+  version = "unstable-2022-10-17-${kernel.version}";
+
+  src = fetchFromGitHub {
+    owner = "bob-linuxtoys";
+    repo = "fanout";
+    rev = "69b1cc69bf425d1a5f83b4e84d41272f1caa0144";
+    hash = "sha256-Q19c88KDFu0A6MejZgKYei9J2693EjRkKtR9hcRcHa0=";
+  };
+
+  preBuild = ''
+    substituteInPlace Makefile --replace "modules_install" "INSTALL_MOD_PATH=$out modules_install"
+  '';
+
+  patches = [
+    ./remove_auto_mknod.patch
+  ];
+
+  hardeningDisable = [ "format" "pic" ];
+
+  nativeBuildInputs = [ kmod ] ++ kernel.moduleBuildDependencies;
+
+  makeFlags = kernel.makeFlags ++ [
+    "KERNELDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+  ];
+
+  meta = with lib; {
+    description = "Kernel-based publish-subscribe system";
+    homepage = "https://github.com/bob-linuxtoys/fanout";
+    license = licenses.gpl2Only;
+    maintainers = with maintainers; [ therishidesai ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/fanout/remove_auto_mknod.patch b/nixpkgs/pkgs/os-specific/linux/fanout/remove_auto_mknod.patch
new file mode 100644
index 000000000000..1f62e2b4633b
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/fanout/remove_auto_mknod.patch
@@ -0,0 +1,13 @@
+diff --git a/fanout.c b/fanout.c
+index f5d2a55..87125f4 100644
+--- a/fanout.c
++++ b/fanout.c
+@@ -13,7 +13,7 @@
+ /* Comment out to forgo the creation of /dev entries
+  * The companion udev rules 'fanout.rules' sets the special file mode
+  */
+-#define DEV_MKNOD
++// #define DEV_MKNOD
+ 
+ #include <linux/kernel.h>
+ #include <linux/module.h>
diff --git a/nixpkgs/pkgs/os-specific/linux/fbterm/default.nix b/nixpkgs/pkgs/os-specific/linux/fbterm/default.nix
index 9e89ad555317..f762eca36beb 100644
--- a/nixpkgs/pkgs/os-specific/linux/fbterm/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/fbterm/default.nix
@@ -35,6 +35,10 @@ stdenv.mkDerivation rec {
     ncurses
   ];
 
+  makeFlags = [
+    "AR:=$(AR)"
+  ];
+
   # preConfigure = ''
   #   sed -e '/ifdef SYS_signalfd/atypedef long long loff_t;' -i src/fbterm.cpp
   #   sed -e '/install-exec-hook:/,/^[^\t]/{d}; /.NOEXPORT/iinstall-exec-hook:\
diff --git a/nixpkgs/pkgs/os-specific/linux/firmware/ath9k/default.nix b/nixpkgs/pkgs/os-specific/linux/firmware/ath9k/default.nix
index 28da48c31cd7..ab342d68c135 100644
--- a/nixpkgs/pkgs/os-specific/linux/firmware/ath9k/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/firmware/ath9k/default.nix
@@ -9,9 +9,13 @@
 , enableUnstable ? false
 }:
 
+let
+  stableVersion = "1.4.0";
+in
+
 stdenv.mkDerivation (finalAttrs: {
   pname = "ath9k-htc-blobless-firmware";
-  version = if enableUnstable then "unstable-2022-05-22" else "1.4.0";
+  version = if enableUnstable then "unstable-2022-05-22" else stableVersion;
 
   src = fetchFromGitHub ({
     owner = "qca";
@@ -61,7 +65,10 @@ stdenv.mkDerivation (finalAttrs: {
 
   installPhase = ''
     runHook preInstall
-    install -Dt $out/lib/firmware/ath9k_htc/ target_firmware/*.fw
+    install -Dt "$out/lib/firmware/ath9k_htc/" target_firmware/*.fw
+    # make symlinks so that firmware will be automatically found
+    ln -s htc_7010.fw "$out/lib/firmware/ath9k_htc/htc_7010-${stableVersion}.fw"
+    ln -s htc_9271.fw "$out/lib/firmware/ath9k_htc/htc_9271-${stableVersion}.fw"
     runHook postInstall
   '';
 
diff --git a/nixpkgs/pkgs/os-specific/linux/firmware/firmware-updater/default.nix b/nixpkgs/pkgs/os-specific/linux/firmware/firmware-updater/default.nix
index 54b370415bc0..3d9e5fde481e 100644
--- a/nixpkgs/pkgs/os-specific/linux/firmware/firmware-updater/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/firmware/firmware-updater/default.nix
@@ -1,21 +1,21 @@
 { lib
-, flutter37
+, flutter
 , fetchFromGitHub
 }:
 
-flutter37.buildFlutterApplication {
+flutter.buildFlutterApplication {
   pname = "firmware-updater";
-  version = "unstable-2023-04-30";
+  version = "unstable-2023-06-20";
 
   pubspecLockFile = ./pubspec.lock;
   depsListFile = ./deps.json;
-  vendorHash = "sha256-cdMO+tr6kYiN5xKXa+uTMAcFf2C75F3wVPrn21G4QPQ=";
+  vendorHash = "sha256-+4Lu6yHH/Yhl58bxhsLanP5hyhXSg9LpCuG1ohAlM5g=";
 
   src = fetchFromGitHub {
     owner = "canonical";
     repo = "firmware-updater";
-    rev = "6e7dbdb64e344633ea62874b54ff3990bd3b8440";
-    sha256 = "sha256-s5mwtr5MSPqLMN+k851+pFIFFPa0N1hqz97ys050tFA=";
+    rev = "49ebcad241ed4964f1547c8da408bef13a8b4c69";
+    sha256 = "sha256-1BGcpcIJV0jqrj3nA7FJg36lMqpl281NGOgWppDUFCI=";
     fetchSubmodules = true;
   };
 
diff --git a/nixpkgs/pkgs/os-specific/linux/firmware/firmware-updater/deps.json b/nixpkgs/pkgs/os-specific/linux/firmware/firmware-updater/deps.json
index a4ab4fa8652f..de6a6a9d65f4 100644
--- a/nixpkgs/pkgs/os-specific/linux/firmware/firmware-updater/deps.json
+++ b/nixpkgs/pkgs/os-specific/linux/firmware/firmware-updater/deps.json
@@ -57,7 +57,7 @@
   },
   {
     "name": "test_api",
-    "version": "0.4.16",
+    "version": "0.5.1",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -75,15 +75,25 @@
   },
   {
     "name": "matcher",
-    "version": "0.12.13",
+    "version": "0.12.15",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
+      "async",
       "meta",
-      "stack_trace"
+      "stack_trace",
+      "term_glyph",
+      "test_api"
     ]
   },
   {
+    "name": "term_glyph",
+    "version": "1.2.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
     "name": "stack_trace",
     "version": "1.11.0",
     "kind": "transitive",
@@ -94,23 +104,33 @@
   },
   {
     "name": "path",
-    "version": "1.8.2",
+    "version": "1.8.3",
     "kind": "direct",
     "source": "hosted",
     "dependencies": []
   },
   {
     "name": "meta",
-    "version": "1.8.0",
+    "version": "1.9.1",
     "kind": "direct",
     "source": "hosted",
     "dependencies": []
   },
   {
-    "name": "term_glyph",
-    "version": "1.2.1",
+    "name": "async",
+    "version": "2.11.0",
     "kind": "transitive",
     "source": "hosted",
+    "dependencies": [
+      "collection",
+      "meta"
+    ]
+  },
+  {
+    "name": "collection",
+    "version": "1.17.1",
+    "kind": "direct",
+    "source": "hosted",
     "dependencies": []
   },
   {
@@ -134,13 +154,6 @@
     ]
   },
   {
-    "name": "collection",
-    "version": "1.17.0",
-    "kind": "direct",
-    "source": "hosted",
-    "dependencies": []
-  },
-  {
     "name": "stream_channel",
     "version": "2.1.1",
     "kind": "transitive",
@@ -150,16 +163,6 @@
     ]
   },
   {
-    "name": "async",
-    "version": "2.10.0",
-    "kind": "transitive",
-    "source": "hosted",
-    "dependencies": [
-      "collection",
-      "meta"
-    ]
-  },
-  {
     "name": "boolean_selector",
     "version": "2.1.1",
     "kind": "transitive",
@@ -171,7 +174,7 @@
   },
   {
     "name": "source_gen",
-    "version": "1.2.7",
+    "version": "1.3.2",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -187,7 +190,7 @@
   },
   {
     "name": "yaml",
-    "version": "3.1.1",
+    "version": "3.1.2",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -198,7 +201,7 @@
   },
   {
     "name": "glob",
-    "version": "2.1.1",
+    "version": "2.1.2",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -221,7 +224,7 @@
   },
   {
     "name": "dart_style",
-    "version": "2.3.0",
+    "version": "2.3.1",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -234,7 +237,7 @@
   },
   {
     "name": "pub_semver",
-    "version": "2.1.3",
+    "version": "2.1.4",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -244,14 +247,14 @@
   },
   {
     "name": "args",
-    "version": "2.4.0",
+    "version": "2.4.2",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": []
   },
   {
     "name": "analyzer",
-    "version": "5.11.1",
+    "version": "5.13.0",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -271,7 +274,7 @@
   },
   {
     "name": "watcher",
-    "version": "1.0.2",
+    "version": "1.1.0",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -290,7 +293,7 @@
   },
   {
     "name": "crypto",
-    "version": "3.0.2",
+    "version": "3.0.3",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -299,7 +302,7 @@
   },
   {
     "name": "typed_data",
-    "version": "1.3.1",
+    "version": "1.3.2",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -317,7 +320,7 @@
   },
   {
     "name": "_fe_analyzer_shared",
-    "version": "59.0.0",
+    "version": "61.0.0",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -326,7 +329,7 @@
   },
   {
     "name": "build",
-    "version": "2.3.1",
+    "version": "2.4.0",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -337,6 +340,7 @@
       "glob",
       "logging",
       "meta",
+      "package_config",
       "path"
     ]
   },
@@ -349,7 +353,7 @@
   },
   {
     "name": "code_builder",
-    "version": "4.4.0",
+    "version": "4.5.0",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -362,7 +366,7 @@
   },
   {
     "name": "built_value",
-    "version": "8.4.4",
+    "version": "8.6.1",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -388,7 +392,7 @@
   },
   {
     "name": "melos",
-    "version": "3.0.1",
+    "version": "3.1.0",
     "kind": "dev",
     "source": "hosted",
     "dependencies": [
@@ -418,7 +422,7 @@
   },
   {
     "name": "yaml_edit",
-    "version": "2.1.0",
+    "version": "2.1.1",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -490,7 +494,7 @@
   },
   {
     "name": "json_annotation",
-    "version": "4.8.0",
+    "version": "4.8.1",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -499,14 +503,13 @@
   },
   {
     "name": "http",
-    "version": "0.13.5",
+    "version": "0.13.6",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
       "async",
       "http_parser",
-      "meta",
-      "path"
+      "meta"
     ]
   },
   {
@@ -568,7 +571,7 @@
   },
   {
     "name": "graphs",
-    "version": "2.2.0",
+    "version": "2.3.1",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -584,7 +587,7 @@
   },
   {
     "name": "cli_util",
-    "version": "0.3.5",
+    "version": "0.4.0",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -620,13 +623,11 @@
       "flutter_test",
       "path",
       "vm_service",
-      "archive",
       "async",
       "boolean_selector",
       "characters",
       "clock",
       "collection",
-      "crypto",
       "fake_async",
       "file",
       "js",
@@ -640,18 +641,16 @@
       "sync_http",
       "term_glyph",
       "test_api",
-      "typed_data",
       "vector_math",
       "webdriver"
     ]
   },
   {
     "name": "webdriver",
-    "version": "3.0.1",
+    "version": "3.0.2",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
-      "archive",
       "matcher",
       "path",
       "stack_trace",
@@ -666,16 +665,6 @@
     "dependencies": []
   },
   {
-    "name": "archive",
-    "version": "3.3.2",
-    "kind": "transitive",
-    "source": "hosted",
-    "dependencies": [
-      "crypto",
-      "path"
-    ]
-  },
-  {
     "name": "vector_math",
     "version": "2.1.4",
     "kind": "transitive",
@@ -691,7 +680,7 @@
   },
   {
     "name": "js",
-    "version": "0.6.5",
+    "version": "0.6.7",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -717,14 +706,14 @@
   },
   {
     "name": "characters",
-    "version": "1.2.1",
+    "version": "1.3.0",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": []
   },
   {
     "name": "vm_service",
-    "version": "9.4.0",
+    "version": "11.3.0",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": []
@@ -792,13 +781,11 @@
       "meta",
       "vm_service",
       "webdriver",
-      "archive",
       "async",
       "boolean_selector",
       "characters",
       "clock",
       "collection",
-      "crypto",
       "js",
       "matcher",
       "material_color_utilities",
@@ -811,7 +798,6 @@
       "sync_http",
       "term_glyph",
       "test_api",
-      "typed_data",
       "vector_math"
     ]
   },
@@ -831,7 +817,7 @@
   },
   {
     "name": "freezed",
-    "version": "2.3.2",
+    "version": "2.3.5",
     "kind": "dev",
     "source": "hosted",
     "dependencies": [
@@ -871,7 +857,7 @@
   },
   {
     "name": "pubspec_parse",
-    "version": "1.2.2",
+    "version": "1.2.3",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -884,7 +870,7 @@
   },
   {
     "name": "checked_yaml",
-    "version": "2.0.2",
+    "version": "2.0.3",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -904,20 +890,20 @@
   },
   {
     "name": "lints",
-    "version": "2.0.1",
+    "version": "2.1.1",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": []
   },
   {
     "name": "build_runner",
-    "version": "2.3.3",
+    "version": "2.4.5",
     "kind": "dev",
     "source": "hosted",
     "dependencies": [
+      "analyzer",
       "args",
       "async",
-      "analyzer",
       "build",
       "build_config",
       "build_daemon",
@@ -980,7 +966,7 @@
   },
   {
     "name": "shelf_web_socket",
-    "version": "1.0.3",
+    "version": "1.0.4",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -991,7 +977,7 @@
   },
   {
     "name": "shelf",
-    "version": "1.4.0",
+    "version": "1.4.1",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -1031,7 +1017,7 @@
   },
   {
     "name": "build_runner_core",
-    "version": "7.2.7",
+    "version": "7.2.8",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -1078,7 +1064,7 @@
   },
   {
     "name": "build_daemon",
-    "version": "3.1.1",
+    "version": "4.0.0",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -1110,7 +1096,7 @@
   },
   {
     "name": "yaru_window",
-    "version": "0.1.1",
+    "version": "0.1.2",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -1123,7 +1109,7 @@
   },
   {
     "name": "yaru_window_web",
-    "version": "0.0.2",
+    "version": "0.0.3",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -1134,7 +1120,7 @@
   },
   {
     "name": "yaru_window_platform_interface",
-    "version": "0.1.0",
+    "version": "0.1.1",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -1169,7 +1155,7 @@
   },
   {
     "name": "yaru_window_manager",
-    "version": "0.1.0",
+    "version": "0.1.2",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -1181,7 +1167,7 @@
   },
   {
     "name": "window_manager",
-    "version": "0.3.2",
+    "version": "0.3.4",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -1201,7 +1187,7 @@
   },
   {
     "name": "yaru_window_linux",
-    "version": "0.1.1",
+    "version": "0.1.2",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -1255,7 +1241,7 @@
   },
   {
     "name": "gtk",
-    "version": "2.0.0",
+    "version": "2.1.0",
     "kind": "direct",
     "source": "hosted",
     "dependencies": [
@@ -1266,7 +1252,7 @@
   },
   {
     "name": "ffi",
-    "version": "2.0.1",
+    "version": "2.0.2",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": []
@@ -1294,7 +1280,7 @@
   },
   {
     "name": "xml",
-    "version": "6.2.2",
+    "version": "6.3.0",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -1305,7 +1291,7 @@
   },
   {
     "name": "petitparser",
-    "version": "5.1.0",
+    "version": "5.4.0",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -1324,7 +1310,7 @@
   },
   {
     "name": "ubuntu_service",
-    "version": "0.2.2",
+    "version": "0.2.3",
     "kind": "direct",
     "source": "hosted",
     "dependencies": [
@@ -1334,7 +1320,7 @@
   },
   {
     "name": "get_it",
-    "version": "7.3.0",
+    "version": "7.6.0",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -1344,9 +1330,9 @@
   },
   {
     "name": "ubuntu_logger",
-    "version": "0.0.1",
+    "version": "0.0.3",
     "kind": "direct",
-    "source": "git",
+    "source": "hosted",
     "dependencies": [
       "collection",
       "logging",
@@ -1369,11 +1355,12 @@
   },
   {
     "name": "intl",
-    "version": "0.17.0",
+    "version": "0.18.0",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
       "clock",
+      "meta",
       "path"
     ]
   },
@@ -1456,29 +1443,27 @@
   },
   {
     "name": "flutter_html",
-    "version": "3.0.0-alpha.6",
+    "version": "3.0.0-beta.2",
     "kind": "direct",
     "source": "hosted",
     "dependencies": [
       "html",
       "csslib",
       "collection",
-      "numerus",
+      "list_counter",
       "flutter"
     ]
   },
   {
-    "name": "numerus",
-    "version": "2.0.0",
+    "name": "list_counter",
+    "version": "1.0.2",
     "kind": "transitive",
     "source": "hosted",
-    "dependencies": [
-      "characters"
-    ]
+    "dependencies": []
   },
   {
     "name": "csslib",
-    "version": "0.17.2",
+    "version": "0.17.3",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -1487,7 +1472,7 @@
   },
   {
     "name": "html",
-    "version": "0.15.2",
+    "version": "0.15.4",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
diff --git a/nixpkgs/pkgs/os-specific/linux/firmware/firmware-updater/pubspec.lock b/nixpkgs/pkgs/os-specific/linux/firmware/firmware-updater/pubspec.lock
index 641ab9fd9778..f95c0a6ab34a 100644
--- a/nixpkgs/pkgs/os-specific/linux/firmware/firmware-updater/pubspec.lock
+++ b/nixpkgs/pkgs/os-specific/linux/firmware/firmware-updater/pubspec.lock
@@ -5,18 +5,18 @@ packages:
     dependency: transitive
     description:
       name: _fe_analyzer_shared
-      sha256: "8880b4cfe7b5b17d57c052a5a3a8cc1d4f546261c7cc8fbd717bd53f48db0568"
+      sha256: ae92f5d747aee634b87f89d9946000c2de774be1d6ac3e58268224348cd0101a
       url: "https://pub.dev"
     source: hosted
-    version: "59.0.0"
+    version: "61.0.0"
   analyzer:
     dependency: transitive
     description:
       name: analyzer
-      sha256: a89627f49b0e70e068130a36571409726b04dab12da7e5625941d2c8ec278b96
+      sha256: ea3d8652bda62982addfd92fdc2d0214e5f82e43325104990d4f4c4a2a313562
       url: "https://pub.dev"
     source: hosted
-    version: "5.11.1"
+    version: "5.13.0"
   ansi_styles:
     dependency: transitive
     description:
@@ -25,30 +25,22 @@ packages:
       url: "https://pub.dev"
     source: hosted
     version: "0.3.2+1"
-  archive:
-    dependency: transitive
-    description:
-      name: archive
-      sha256: "80e5141fafcb3361653ce308776cfd7d45e6e9fbb429e14eec571382c0c5fecb"
-      url: "https://pub.dev"
-    source: hosted
-    version: "3.3.2"
   args:
     dependency: transitive
     description:
       name: args
-      sha256: "4cab82a83ffef80b262ddedf47a0a8e56ee6fbf7fe21e6e768b02792034dd440"
+      sha256: eef6c46b622e0494a36c5a12d10d77fb4e855501a91c1b9ef9339326e58f0596
       url: "https://pub.dev"
     source: hosted
-    version: "2.4.0"
+    version: "2.4.2"
   async:
     dependency: transitive
     description:
       name: async
-      sha256: bfe67ef28df125b7dddcea62755991f807aa39a2492a23e1550161692950bbe0
+      sha256: "947bfcf187f74dbc5e146c9eb9c0f10c9f8b30743e341481c1e2ed3ecc18c20c"
       url: "https://pub.dev"
     source: hosted
-    version: "2.10.0"
+    version: "2.11.0"
   boolean_selector:
     dependency: transitive
     description:
@@ -61,10 +53,10 @@ packages:
     dependency: transitive
     description:
       name: build
-      sha256: "3fbda25365741f8251b39f3917fb3c8e286a96fd068a5a242e11c2012d495777"
+      sha256: "43865b79fbb78532e4bff7c33087aa43b1d488c4fdef014eaef568af6d8016dc"
       url: "https://pub.dev"
     source: hosted
-    version: "2.3.1"
+    version: "2.4.0"
   build_config:
     dependency: transitive
     description:
@@ -77,10 +69,10 @@ packages:
     dependency: transitive
     description:
       name: build_daemon
-      sha256: "757153e5d9cd88253cb13f28c2fb55a537dc31fefd98137549895b5beb7c6169"
+      sha256: "5f02d73eb2ba16483e693f80bee4f088563a820e47d1027d4cdfe62b5bb43e65"
       url: "https://pub.dev"
     source: hosted
-    version: "3.1.1"
+    version: "4.0.0"
   build_resolvers:
     dependency: transitive
     description:
@@ -93,18 +85,18 @@ packages:
     dependency: "direct dev"
     description:
       name: build_runner
-      sha256: b0a8a7b8a76c493e85f1b84bffa0588859a06197863dba8c9036b15581fd9727
+      sha256: "5e1929ad37d48bd382b124266cb8e521de5548d406a45a5ae6656c13dab73e37"
       url: "https://pub.dev"
     source: hosted
-    version: "2.3.3"
+    version: "2.4.5"
   build_runner_core:
     dependency: transitive
     description:
       name: build_runner_core
-      sha256: "14febe0f5bac5ae474117a36099b4de6f1dbc52df6c5e55534b3da9591bf4292"
+      sha256: "30859c90e9ddaccc484f56303931f477b1f1ba2bab74aa32ed5d6ce15870f8cf"
       url: "https://pub.dev"
     source: hosted
-    version: "7.2.7"
+    version: "7.2.8"
   built_collection:
     dependency: transitive
     description:
@@ -117,18 +109,18 @@ packages:
     dependency: transitive
     description:
       name: built_value
-      sha256: "31b7c748fd4b9adf8d25d72a4c4a59ef119f12876cf414f94f8af5131d5fa2b0"
+      sha256: "598a2a682e2a7a90f08ba39c0aaa9374c5112340f0a2e275f61b59389543d166"
       url: "https://pub.dev"
     source: hosted
-    version: "8.4.4"
+    version: "8.6.1"
   characters:
     dependency: transitive
     description:
       name: characters
-      sha256: e6a326c8af69605aec75ed6c187d06b349707a27fbff8222ca9cc2cff167975c
+      sha256: "04a925763edad70e8443c99234dc3328f442e811f1d8fd1a72f1c8ad0f69a605"
       url: "https://pub.dev"
     source: hosted
-    version: "1.2.1"
+    version: "1.3.0"
   charcode:
     dependency: transitive
     description:
@@ -141,10 +133,10 @@ packages:
     dependency: transitive
     description:
       name: checked_yaml
-      sha256: "3d1505d91afa809d177efd4eed5bb0eb65805097a1463abdd2add076effae311"
+      sha256: feb6bed21949061731a7a75fc5d2aa727cf160b91af9a3e464c5e3a32e28b5ff
       url: "https://pub.dev"
     source: hosted
-    version: "2.0.2"
+    version: "2.0.3"
   cli_launcher:
     dependency: transitive
     description:
@@ -157,10 +149,10 @@ packages:
     dependency: transitive
     description:
       name: cli_util
-      sha256: "66f86e916d285c1a93d3b79587d94bd71984a66aac4ff74e524cfa7877f1395c"
+      sha256: b8db3080e59b2503ca9e7922c3df2072cf13992354d5e944074ffa836fba43b7
       url: "https://pub.dev"
     source: hosted
-    version: "0.3.5"
+    version: "0.4.0"
   clock:
     dependency: transitive
     description:
@@ -173,18 +165,18 @@ packages:
     dependency: transitive
     description:
       name: code_builder
-      sha256: "0d43dd1288fd145de1ecc9a3948ad4a6d5a82f0a14c4fdd0892260787d975cbe"
+      sha256: "4ad01d6e56db961d29661561effde45e519939fdaeb46c351275b182eac70189"
       url: "https://pub.dev"
     source: hosted
-    version: "4.4.0"
+    version: "4.5.0"
   collection:
     dependency: "direct main"
     description:
       name: collection
-      sha256: cfc915e6923fe5ce6e153b0723c753045de46de1b4d63771530504004a45fae0
+      sha256: "4a07be6cb69c84d677a6c3096fcf960cc3285a8330b4603e0d463d15d9bd934c"
       url: "https://pub.dev"
     source: hosted
-    version: "1.17.0"
+    version: "1.17.1"
   conventional_commit:
     dependency: transitive
     description:
@@ -205,26 +197,26 @@ packages:
     dependency: transitive
     description:
       name: crypto
-      sha256: aa274aa7774f8964e4f4f38cc994db7b6158dd36e9187aaceaddc994b35c6c67
+      sha256: ff625774173754681d66daaf4a448684fb04b78f902da9cb3d308c19cc5e8bab
       url: "https://pub.dev"
     source: hosted
-    version: "3.0.2"
+    version: "3.0.3"
   csslib:
     dependency: transitive
     description:
       name: csslib
-      sha256: b36c7f7e24c0bdf1bf9a3da461c837d1de64b9f8beb190c9011d8c72a3dfd745
+      sha256: "831883fb353c8bdc1d71979e5b342c7d88acfbc643113c14ae51e2442ea0f20f"
       url: "https://pub.dev"
     source: hosted
-    version: "0.17.2"
+    version: "0.17.3"
   dart_style:
     dependency: transitive
     description:
       name: dart_style
-      sha256: "6d691edde054969f0e0f26abb1b30834b5138b963793e56f69d3a9a4435e6352"
+      sha256: f4f1f73ab3fd2afcbcca165ee601fe980d966af6a21b5970c6c9376955c528ad
       url: "https://pub.dev"
     source: hosted
-    version: "2.3.0"
+    version: "2.3.1"
   dbus:
     dependency: "direct main"
     description:
@@ -253,10 +245,10 @@ packages:
     dependency: transitive
     description:
       name: ffi
-      sha256: a38574032c5f1dd06c4aee541789906c12ccaab8ba01446e800d9c5b79c4a978
+      sha256: ed5337a5660c506388a9f012be0288fb38b49020ce2b45fe1f8b8323fe429f99
       url: "https://pub.dev"
     source: hosted
-    version: "2.0.1"
+    version: "2.0.2"
   file:
     dependency: "direct main"
     description:
@@ -287,10 +279,10 @@ packages:
     dependency: "direct main"
     description:
       name: flutter_html
-      sha256: "342c7908f0a67bcec62b6e0f7cf23e23bafe7f64693665dd35be98d5e783bdfd"
+      sha256: "02ad69e813ecfc0728a455e4bf892b9379983e050722b1dce00192ee2e41d1ee"
       url: "https://pub.dev"
     source: hosted
-    version: "3.0.0-alpha.6"
+    version: "3.0.0-beta.2"
   flutter_lints:
     dependency: "direct dev"
     description:
@@ -318,10 +310,10 @@ packages:
     dependency: "direct dev"
     description:
       name: freezed
-      sha256: e819441678f1679b719008ff2ff0ef045d66eed9f9ec81166ca0d9b02a187454
+      sha256: a9520490532087cf38bf3f7de478ab6ebeb5f68bb1eb2641546d92719b224445
       url: "https://pub.dev"
     source: hosted
-    version: "2.3.2"
+    version: "2.3.5"
   freezed_annotation:
     dependency: "direct main"
     description:
@@ -356,34 +348,34 @@ packages:
     dependency: transitive
     description:
       name: get_it
-      sha256: f9982979e3d2f286a957c04d2c3a98f55b0f0a06ffd6c5c4abbb96f06937f463
+      sha256: "529de303c739fca98cd7ece5fca500d8ff89649f1bb4b4e94fb20954abcd7468"
       url: "https://pub.dev"
     source: hosted
-    version: "7.3.0"
+    version: "7.6.0"
   glob:
     dependency: transitive
     description:
       name: glob
-      sha256: "4515b5b6ddb505ebdd242a5f2cc5d22d3d6a80013789debfbda7777f47ea308c"
+      sha256: "0e7014b3b7d4dac1ca4d6114f82bf1782ee86745b9b42a92c9289c23d8a0ab63"
       url: "https://pub.dev"
     source: hosted
-    version: "2.1.1"
+    version: "2.1.2"
   graphs:
     dependency: transitive
     description:
       name: graphs
-      sha256: f9e130f3259f52d26f0cfc0e964513796dafed572fa52e45d2f8d6ca14db39b2
+      sha256: aedc5a15e78fc65a6e23bcd927f24c64dd995062bcd1ca6eda65a3cff92a4d19
       url: "https://pub.dev"
     source: hosted
-    version: "2.2.0"
+    version: "2.3.1"
   gtk:
     dependency: "direct main"
     description:
       name: gtk
-      sha256: "517560d6ec625c114cbdcde9223e5ee6418d30860377347ee1b0513399e7a3f5"
+      sha256: e8ce9ca4b1df106e4d72dad201d345ea1a036cc12c360f1a7d5a758f78ffa42c
       url: "https://pub.dev"
     source: hosted
-    version: "2.0.0"
+    version: "2.1.0"
   handy_window:
     dependency: "direct main"
     description:
@@ -396,18 +388,18 @@ packages:
     dependency: transitive
     description:
       name: html
-      sha256: "79d498e6d6761925a34ee5ea8fa6dfef38607781d2fa91e37523474282af55cb"
+      sha256: "3a7812d5bcd2894edf53dfaf8cd640876cf6cef50a8f238745c8b8120ea74d3a"
       url: "https://pub.dev"
     source: hosted
-    version: "0.15.2"
+    version: "0.15.4"
   http:
     dependency: transitive
     description:
       name: http
-      sha256: "6aa2946395183537c8b880962d935877325d6a09a2867c3970c05c0fed6ac482"
+      sha256: "5895291c13fa8a3bd82e76d5627f69e0d85ca6a30dcac95c4ea19a5d555879c2"
       url: "https://pub.dev"
     source: hosted
-    version: "0.13.5"
+    version: "0.13.6"
   http_multi_server:
     dependency: transitive
     description:
@@ -433,10 +425,10 @@ packages:
     dependency: transitive
     description:
       name: intl
-      sha256: "910f85bce16fb5c6f614e117efa303e85a1731bb0081edf3604a2ae6e9a3cc91"
+      sha256: a3715e3bc90294e971cb7dc063fbf3cd9ee0ebf8604ffeafabd9e6f16abbdbe6
       url: "https://pub.dev"
     source: hosted
-    version: "0.17.0"
+    version: "0.18.0"
   io:
     dependency: transitive
     description:
@@ -449,26 +441,34 @@ packages:
     dependency: transitive
     description:
       name: js
-      sha256: "5528c2f391ededb7775ec1daa69e65a2d61276f7552de2b5f7b8d34ee9fd4ab7"
+      sha256: f2c445dce49627136094980615a031419f7f3eb393237e4ecd97ac15dea343f3
       url: "https://pub.dev"
     source: hosted
-    version: "0.6.5"
+    version: "0.6.7"
   json_annotation:
     dependency: transitive
     description:
       name: json_annotation
-      sha256: c33da08e136c3df0190bd5bbe51ae1df4a7d96e7954d1d7249fea2968a72d317
+      sha256: b10a7b2ff83d83c777edba3c6a0f97045ddadd56c944e1a23a3fdf43a1bf4467
       url: "https://pub.dev"
     source: hosted
-    version: "4.8.0"
+    version: "4.8.1"
   lints:
     dependency: transitive
     description:
       name: lints
-      sha256: "5e4a9cd06d447758280a8ac2405101e0e2094d2a1dbdd3756aec3fe7775ba593"
+      sha256: "0a217c6c989d21039f1498c3ed9f3ed71b354e69873f13a8dfc3c9fe76f1b452"
       url: "https://pub.dev"
     source: hosted
-    version: "2.0.1"
+    version: "2.1.1"
+  list_counter:
+    dependency: transitive
+    description:
+      name: list_counter
+      sha256: c447ae3dfcd1c55f0152867090e67e219d42fe6d4f2807db4bbe8b8d69912237
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.0.2"
   logging:
     dependency: transitive
     description:
@@ -489,10 +489,10 @@ packages:
     dependency: transitive
     description:
       name: matcher
-      sha256: "16db949ceee371e9b99d22f88fa3a73c4e59fd0afed0bd25fc336eb76c198b72"
+      sha256: "6501fbd55da300384b768785b83e5ce66991266cec21af89ab9ae7f5ce1c4cbb"
       url: "https://pub.dev"
     source: hosted
-    version: "0.12.13"
+    version: "0.12.15"
   material_color_utilities:
     dependency: transitive
     description:
@@ -505,18 +505,18 @@ packages:
     dependency: "direct dev"
     description:
       name: melos
-      sha256: "993ac467e7a36bd832a6cdabbe18a0487c30bc52b5cca14e476a824679ebdce0"
+      sha256: ccbb6ecd8bb3f08ae8f9ce22920d816bff325a98940c845eda0257cd395503ac
       url: "https://pub.dev"
     source: hosted
-    version: "3.0.1"
+    version: "3.1.0"
   meta:
     dependency: "direct main"
     description:
       name: meta
-      sha256: "6c268b42ed578a53088d834796959e4a1814b5e9e164f147f580a386e5decf42"
+      sha256: "3c74dbf8763d36539f114c799d8a2d87343b5067e9d796ca22b5eb8437090ee3"
       url: "https://pub.dev"
     source: hosted
-    version: "1.8.0"
+    version: "1.9.1"
   mime:
     dependency: transitive
     description:
@@ -549,14 +549,6 @@ packages:
       url: "https://pub.dev"
     source: hosted
     version: "1.0.0"
-  numerus:
-    dependency: transitive
-    description:
-      name: numerus
-      sha256: "436759d84f233b40107d0cc31cfa92d24e0960afeb2e506be70926d4cddffd9e"
-      url: "https://pub.dev"
-    source: hosted
-    version: "2.0.0"
   package_config:
     dependency: transitive
     description:
@@ -569,18 +561,18 @@ packages:
     dependency: "direct main"
     description:
       name: path
-      sha256: db9d4f58c908a4ba5953fcee2ae317c94889433e5024c27ce74a37f94267945b
+      sha256: "8829d8a55c13fc0e37127c29fedf290c102f4e40ae94ada574091fe0ff96c917"
       url: "https://pub.dev"
     source: hosted
-    version: "1.8.2"
+    version: "1.8.3"
   petitparser:
     dependency: transitive
     description:
       name: petitparser
-      sha256: "49392a45ced973e8d94a85fdb21293fbb40ba805fc49f2965101ae748a3683b4"
+      sha256: cb3798bef7fc021ac45b308f4b51208a152792445cce0448c9a4ba5879dd8750
       url: "https://pub.dev"
     source: hosted
-    version: "5.1.0"
+    version: "5.4.0"
   platform:
     dependency: transitive
     description:
@@ -633,10 +625,10 @@ packages:
     dependency: transitive
     description:
       name: pub_semver
-      sha256: "307de764d305289ff24ad257ad5c5793ce56d04947599ad68b3baa124105fc17"
+      sha256: "40d3ab1bbd474c4c2328c91e3a7df8c6dd629b79ece4c4bd04bee496a224fb0c"
       url: "https://pub.dev"
     source: hosted
-    version: "2.1.3"
+    version: "2.1.4"
   pub_updater:
     dependency: transitive
     description:
@@ -657,10 +649,10 @@ packages:
     dependency: transitive
     description:
       name: pubspec_parse
-      sha256: ec85d7d55339d85f44ec2b682a82fea340071e8978257e5a43e69f79e98ef50c
+      sha256: c63b2876e58e194e4b0828fcb080ad0e06d051cb607a6be51a9e084f47cb9367
       url: "https://pub.dev"
     source: hosted
-    version: "1.2.2"
+    version: "1.2.3"
   quiver:
     dependency: transitive
     description:
@@ -689,18 +681,18 @@ packages:
     dependency: transitive
     description:
       name: shelf
-      sha256: c24a96135a2ccd62c64b69315a14adc5c3419df63b4d7c05832a346fdb73682c
+      sha256: ad29c505aee705f41a4d8963641f91ac4cee3c8fad5947e033390a7bd8180fa4
       url: "https://pub.dev"
     source: hosted
-    version: "1.4.0"
+    version: "1.4.1"
   shelf_web_socket:
     dependency: transitive
     description:
       name: shelf_web_socket
-      sha256: a988c0e8d8ffbdb8a28aa7ec8e449c260f3deb808781fe1284d22c5bba7156e8
+      sha256: "9ca081be41c60190ebcb4766b2486a7d50261db7bd0f5d9615f2d653637a84c1"
       url: "https://pub.dev"
     source: hosted
-    version: "1.0.3"
+    version: "1.0.4"
   sky_engine:
     dependency: transitive
     description: flutter
@@ -710,10 +702,10 @@ packages:
     dependency: transitive
     description:
       name: source_gen
-      sha256: c2bea18c95cfa0276a366270afaa2850b09b4a76db95d546f3d003dcc7011298
+      sha256: "373f96cf5a8744bc9816c1ff41cf5391bbdbe3d7a96fe98c622b6738a8a7bd33"
       url: "https://pub.dev"
     source: hosted
-    version: "1.2.7"
+    version: "1.3.2"
   source_span:
     dependency: transitive
     description:
@@ -774,10 +766,10 @@ packages:
     dependency: transitive
     description:
       name: test_api
-      sha256: ad540f65f92caa91bf21dfc8ffb8c589d6e4dc0c2267818b4cc2792857706206
+      sha256: eb6ac1540b26de412b3403a163d919ba86f6a973fe6cc50ae3541b80092fdcfb
       url: "https://pub.dev"
     source: hosted
-    version: "0.4.16"
+    version: "0.5.1"
   timing:
     dependency: transitive
     description:
@@ -790,27 +782,26 @@ packages:
     dependency: transitive
     description:
       name: typed_data
-      sha256: "26f87ade979c47a150c9eaab93ccd2bebe70a27dc0b4b29517f2904f04eb11a5"
+      sha256: facc8d6582f16042dd49f2463ff1bd6e2c9ef9f3d5da3d9b087e244a7b564b3c
       url: "https://pub.dev"
     source: hosted
-    version: "1.3.1"
+    version: "1.3.2"
   ubuntu_logger:
     dependency: "direct main"
     description:
-      path: "packages/ubuntu_logger"
-      ref: HEAD
-      resolved-ref: f4ea41813779aff3b4dfb6a1b6c1382d2fb3ce81
-      url: "https://github.com/canonical/ubuntu-flutter-plugins.git"
-    source: git
-    version: "0.0.1"
+      name: ubuntu_logger
+      sha256: f6d663e5b9c33e90a7a77a2f15b7f76e90be1dd98a94b6640d7bd74db262060f
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.0.3"
   ubuntu_service:
     dependency: "direct main"
     description:
       name: ubuntu_service
-      sha256: "79b81c146c9fb1aedefa4a6f63724405de3aba0f525afe39b72c513df04a8c13"
+      sha256: f90582494cddd4c7325637930497f38598a7ec567f4f86f88fe1ac40a53832a1
       url: "https://pub.dev"
     source: hosted
-    version: "0.2.2"
+    version: "0.2.3"
   ubuntu_session:
     dependency: "direct main"
     description:
@@ -847,18 +838,18 @@ packages:
     dependency: transitive
     description:
       name: vm_service
-      sha256: e7fb6c2282f7631712b69c19d1bff82f3767eea33a2321c14fa59ad67ea391c7
+      sha256: f6deed8ed625c52864792459709183da231ebf66ff0cf09e69b573227c377efe
       url: "https://pub.dev"
     source: hosted
-    version: "9.4.0"
+    version: "11.3.0"
   watcher:
     dependency: transitive
     description:
       name: watcher
-      sha256: "6a7f46926b01ce81bfc339da6a7f20afbe7733eff9846f6d6a5466aa4c6667c0"
+      sha256: "3d2ad6751b3c16cf07c7fca317a1413b3f26530319181b37e3b9039b84fc01d8"
       url: "https://pub.dev"
     source: hosted
-    version: "1.0.2"
+    version: "1.1.0"
   web_socket_channel:
     dependency: transitive
     description:
@@ -871,42 +862,42 @@ packages:
     dependency: transitive
     description:
       name: webdriver
-      sha256: ef67178f0cc7e32c1494645b11639dd1335f1d18814aa8435113a92e9ef9d841
+      sha256: "3c923e918918feeb90c4c9fdf1fe39220fa4c0e8e2c0fffaded174498ef86c49"
       url: "https://pub.dev"
     source: hosted
-    version: "3.0.1"
+    version: "3.0.2"
   window_manager:
     dependency: transitive
     description:
       name: window_manager
-      sha256: "2b2572442b2a5178642730442dc625ac088244f5827b1f0811371b1b7485eb62"
+      sha256: "95096fede562cbb65f30d38b62d819a458f59ba9fe4a317f6cee669710f6676b"
       url: "https://pub.dev"
     source: hosted
-    version: "0.3.2"
+    version: "0.3.4"
   xml:
     dependency: transitive
     description:
       name: xml
-      sha256: "979ee37d622dec6365e2efa4d906c37470995871fe9ae080d967e192d88286b5"
+      sha256: "5bc72e1e45e941d825fd7468b9b4cc3b9327942649aeb6fc5cdbf135f0a86e84"
       url: "https://pub.dev"
     source: hosted
-    version: "6.2.2"
+    version: "6.3.0"
   yaml:
     dependency: transitive
     description:
       name: yaml
-      sha256: "23812a9b125b48d4007117254bca50abb6c712352927eece9e155207b1db2370"
+      sha256: "75769501ea3489fca56601ff33454fe45507ea3bfb014161abc3b43ae25989d5"
       url: "https://pub.dev"
     source: hosted
-    version: "3.1.1"
+    version: "3.1.2"
   yaml_edit:
     dependency: transitive
     description:
       name: yaml_edit
-      sha256: "0b968021754d8fbd3e9c83563b538ee417d88b2cc587606da5615546b7ee033b"
+      sha256: "1579d4a0340a83cf9e4d580ea51a16329c916973bffd5bd4b45e911b25d46bfd"
       url: "https://pub.dev"
     source: hosted
-    version: "2.1.0"
+    version: "2.1.1"
   yaru:
     dependency: "direct main"
     description:
@@ -951,42 +942,42 @@ packages:
     dependency: transitive
     description:
       name: yaru_window
-      sha256: "18b3df2922a068e5480048335e2585c134e29ac77baec19b26fa32851910bf2f"
+      sha256: "2effc86bfe7aae870384655c029e3bc36bf5dd32727474e502832a1edaeff75d"
       url: "https://pub.dev"
     source: hosted
-    version: "0.1.1"
+    version: "0.1.2"
   yaru_window_linux:
     dependency: transitive
     description:
       name: yaru_window_linux
-      sha256: "356903ebcb70c34f732dbb66ac8b504adb8e92289cdd89da86bed8957f43de38"
+      sha256: "9a813227137d1aafbc786d6455edc24c5febd17d6da04fe7ba2109c02bb60e69"
       url: "https://pub.dev"
     source: hosted
-    version: "0.1.1"
+    version: "0.1.2"
   yaru_window_manager:
     dependency: transitive
     description:
       name: yaru_window_manager
-      sha256: a5ea9db86cbca6306fdf139245fcd84f0df1fed0aead3450d34a9fe7be4d3020
+      sha256: "2d358263d19ae6598df21d6d8c0d25e75c79a82f459b63b0013a13e395c48b23"
       url: "https://pub.dev"
     source: hosted
-    version: "0.1.0"
+    version: "0.1.2"
   yaru_window_platform_interface:
     dependency: transitive
     description:
       name: yaru_window_platform_interface
-      sha256: "1a0256fc59cc46ad05de5840f01d548184ff900698c19dc24e6326c7911b0177"
+      sha256: "7845d7db91e1c1acbc0f8b2f9ba6082c00a98f06cabda1732bdb7c267edc5c89"
       url: "https://pub.dev"
     source: hosted
-    version: "0.1.0"
+    version: "0.1.1"
   yaru_window_web:
     dependency: transitive
     description:
       name: yaru_window_web
-      sha256: "77dacaaade6c2b5f94cf45b80f60c69876d62db02490e50dd025ce297cfc09ed"
+      sha256: "3ff30758a330d7626d54643df0cca6c179782f401aba7752da9cc0d60c9a6f74"
       url: "https://pub.dev"
     source: hosted
-    version: "0.0.2"
+    version: "0.0.3"
 sdks:
-  dart: ">=2.19.0 <3.0.0"
-  flutter: ">=3.7.0"
+  dart: ">=3.0.0 <4.0.0"
+  flutter: ">=3.10.0"
diff --git a/nixpkgs/pkgs/os-specific/linux/firmware/fwupd/add-option-for-installation-sysconfdir.patch b/nixpkgs/pkgs/os-specific/linux/firmware/fwupd/add-option-for-installation-sysconfdir.patch
index cb33eb1c214c..c5c0ebb00021 100644
--- a/nixpkgs/pkgs/os-specific/linux/firmware/fwupd/add-option-for-installation-sysconfdir.patch
+++ b/nixpkgs/pkgs/os-specific/linux/firmware/fwupd/add-option-for-installation-sysconfdir.patch
@@ -1,5 +1,5 @@
 diff --git a/data/bios-settings.d/meson.build b/data/bios-settings.d/meson.build
-index b0ff5b106..13ac380d0 100644
+index b0ff5b10..13ac380d 100644
 --- a/data/bios-settings.d/meson.build
 +++ b/data/bios-settings.d/meson.build
 @@ -1,5 +1,5 @@
@@ -10,20 +10,20 @@ index b0ff5b106..13ac380d0 100644
  )
  endif
 diff --git a/data/meson.build b/data/meson.build
-index 865b20e26..ff1c2657b 100644
+index 8999ee57..b57174dc 100644
 --- a/data/meson.build
 +++ b/data/meson.build
 @@ -26,7 +26,7 @@ endif
- 
+
  if build_standalone
-   install_data(['daemon.conf'],
--    install_dir: join_paths(sysconfdir, 'fwupd')
-+    install_dir: join_paths(sysconfdir_install, 'fwupd')
+   install_data(['fwupd.conf'],
+-    install_dir: join_paths(sysconfdir, 'fwupd'),
++    install_dir: join_paths(sysconfdir_install, 'fwupd'),
+     install_mode: 'rw-r-----',
    )
    plugin_quirks += files([
-     'power.quirk',
 diff --git a/data/pki/meson.build b/data/pki/meson.build
-index 3649fecea..c3462744b 100644
+index 3649fece..c3462744 100644
 --- a/data/pki/meson.build
 +++ b/data/pki/meson.build
 @@ -12,13 +12,13 @@ install_data([
@@ -41,7 +41,7 @@ index 3649fecea..c3462744b 100644
 +  install_dir: join_paths(sysconfdir_install, 'pki', 'fwupd-metadata')
  )
  endif
- 
+
 @@ -26,11 +26,11 @@ if supported_pkcs7
  install_data([
      'LVFS-CA.pem',
@@ -57,7 +57,7 @@ index 3649fecea..c3462744b 100644
  )
  endif
 diff --git a/data/remotes.d/meson.build b/data/remotes.d/meson.build
-index c20a1a05e..87b1fa930 100644
+index c20a1a05..5354bac7 100644
 --- a/data/remotes.d/meson.build
 +++ b/data/remotes.d/meson.build
 @@ -15,14 +15,14 @@ if build_standalone and get_option('lvfs') != 'false'
@@ -77,7 +77,7 @@ index c20a1a05e..87b1fa930 100644
    )
    i18n.merge_file(
      input: 'lvfs.metainfo.xml',
-@@ -54,12 +54,12 @@ configure_file(
+@@ -56,12 +56,12 @@ configure_file(
    output: 'vendor.conf',
    configuration: con2,
    install: true,
@@ -93,13 +93,13 @@ index c20a1a05e..87b1fa930 100644
 +  install_dir: join_paths(sysconfdir_install, 'fwupd', 'remotes.d'),
  )
 diff --git a/meson.build b/meson.build
-index d3e08af43..30011f548 100644
+index fa7a5599..5b53a407 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -193,6 +193,12 @@ endif
+@@ -191,6 +191,12 @@ endif
  mandir = join_paths(prefix, get_option('mandir'))
  localedir = join_paths(prefix, get_option('localedir'))
- 
+
 +if get_option('sysconfdir_install') != ''
 +  sysconfdir_install = join_paths(prefix, get_option('sysconfdir_install'))
 +else
@@ -109,8 +109,9 @@ index d3e08af43..30011f548 100644
  diffcmd = find_program('diff')
  gio = dependency('gio-2.0', version: '>= 2.45.8')
  giounix = dependency('gio-unix-2.0', version: '>= 2.45.8', required: false)
+
 diff --git a/meson_options.txt b/meson_options.txt
-index 204690640..6fc7e8437 100644
+index 81d373f8..d214cf64 100644
 --- a/meson_options.txt
 +++ b/meson_options.txt
 @@ -1,3 +1,4 @@
@@ -119,7 +120,7 @@ index 204690640..6fc7e8437 100644
  option('consolekit', type : 'feature', description : 'ConsoleKit support', deprecated: {'true': 'enabled', 'false': 'disabled'})
  option('static_analysis', type : 'boolean', value : false, description : 'enable GCC static analysis support')
 diff --git a/plugins/dell-esrt/meson.build b/plugins/dell-esrt/meson.build
-index 88c039f85..62a7691f3 100644
+index 88c039f8..62a7691f 100644
 --- a/plugins/dell-esrt/meson.build
 +++ b/plugins/dell-esrt/meson.build
 @@ -27,6 +27,6 @@ configure_file(
@@ -130,47 +131,8 @@ index 88c039f85..62a7691f3 100644
 +  install_dir: join_paths(sysconfdir_install, 'fwupd', 'remotes.d'),
  )
  endif
-diff --git a/plugins/msr/meson.build b/plugins/msr/meson.build
-index 23ec5ec82..b03826fc0 100644
---- a/plugins/msr/meson.build
-+++ b/plugins/msr/meson.build
-@@ -10,7 +10,7 @@ install_data(['fwupd-msr.conf'],
- endif
- 
- install_data(['msr.conf'],
--  install_dir: join_paths(sysconfdir, 'fwupd')
-+  install_dir: join_paths(sysconfdir_install, 'fwupd')
- )
- plugin_builtins += static_library('fu_plugin_msr',
-   sources: [
-diff --git a/plugins/redfish/meson.build b/plugins/redfish/meson.build
-index 1e35b6ce9..33ca1447f 100644
---- a/plugins/redfish/meson.build
-+++ b/plugins/redfish/meson.build
-@@ -35,7 +35,7 @@ plugin_builtin_redfish = static_library('fu_plugin_redfish',
- plugin_builtins += plugin_builtin_redfish
- 
- install_data(['redfish.conf'],
--  install_dir: join_paths(sysconfdir, 'fwupd'),
-+  install_dir: join_paths(sysconfdir_install, 'fwupd'),
-   install_mode: 'rw-r-----',
- )
- 
-diff --git a/plugins/thunderbolt/meson.build b/plugins/thunderbolt/meson.build
-index 71d930e62..399fb5781 100644
---- a/plugins/thunderbolt/meson.build
-+++ b/plugins/thunderbolt/meson.build
-@@ -19,7 +19,7 @@ plugin_builtin_thunderbolt = static_library('fu_plugin_thunderbolt',
- plugin_builtins += plugin_builtin_thunderbolt
- 
- install_data(['thunderbolt.conf'],
--  install_dir: join_paths(sysconfdir, 'fwupd')
-+  install_dir: join_paths(sysconfdir_install, 'fwupd')
- )
- # we use functions from 2.52 in the tests
- if get_option('tests') and run_sanitize_unsafe_tests and umockdev.found() and gio.version().version_compare('>= 2.52')
 diff --git a/plugins/uefi-capsule/meson.build b/plugins/uefi-capsule/meson.build
-index b4b038313..9c5407c3f 100644
+index f4657a6a..28ca0653 100644
 --- a/plugins/uefi-capsule/meson.build
 +++ b/plugins/uefi-capsule/meson.build
 @@ -20,7 +20,7 @@ if host_machine.system() == 'linux'
@@ -182,12 +144,5 @@ index b4b038313..9c5407c3f 100644
    )
  elif host_machine.system() == 'freebsd'
    backend_srcs += 'fu-uefi-backend-freebsd.c'
-@@ -87,7 +87,7 @@ if get_option('compat_cli') and get_option('man')
- endif
- 
- install_data(['uefi_capsule.conf'],
--  install_dir: join_paths(sysconfdir, 'fwupd')
-+  install_dir: join_paths(sysconfdir_install, 'fwupd')
- )
- 
- # add all the .po files as inputs to watch
+--
+2.40.1
diff --git a/nixpkgs/pkgs/os-specific/linux/firmware/fwupd/default.nix b/nixpkgs/pkgs/os-specific/linux/firmware/fwupd/default.nix
index 6ad4928cd8d0..371e13de589e 100644
--- a/nixpkgs/pkgs/os-specific/linux/firmware/fwupd/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/firmware/fwupd/default.nix
@@ -58,6 +58,7 @@
 
 let
   python = python3.withPackages (p: with p; [
+    jinja2
     pygobject3
     setuptools
   ]);
@@ -122,7 +123,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "fwupd";
-  version = "1.8.15";
+  version = "1.9.3";
 
   # libfwupd goes to lib
   # daemon, plug-ins and libfwupdplugin go to out
@@ -133,7 +134,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "fwupd";
     repo = "fwupd";
     rev = finalAttrs.version;
-    hash = "sha256-M7uCT8xJ6ym0X6iAgT3rM2ki0T6QgLJWlFU39aC64o4=";
+    hash = "sha256-IVP5RVHRxWkvPqndiuCxiguYWN5d32qJo9YzBOHoyUk";
   };
 
   patches = [
@@ -261,6 +262,7 @@ stdenv.mkDerivation (finalAttrs: {
   postPatch = ''
     patchShebangs \
       contrib/generate-version-script.py \
+      contrib/generate-man.py \
       po/test-deps
 
     substituteInPlace data/installed-tests/fwupdmgr-p2p.sh \
@@ -337,12 +339,11 @@ stdenv.mkDerivation (finalAttrs: {
   passthru = {
     filesInstalledToEtc = [
       "fwupd/bios-settings.d/README.md"
-      "fwupd/daemon.conf"
+      "fwupd/fwupd.conf"
       "fwupd/remotes.d/lvfs-testing.conf"
       "fwupd/remotes.d/lvfs.conf"
       "fwupd/remotes.d/vendor.conf"
       "fwupd/remotes.d/vendor-directory.conf"
-      "fwupd/uefi_capsule.conf"
       "pki/fwupd/GPG-KEY-Linux-Foundation-Firmware"
       "pki/fwupd/GPG-KEY-Linux-Vendor-Firmware-Service"
       "pki/fwupd/LVFS-CA.pem"
@@ -352,12 +353,6 @@ stdenv.mkDerivation (finalAttrs: {
       "grub.d/35_fwupd"
     ] ++ lib.optionals haveDell [
       "fwupd/remotes.d/dell-esrt.conf"
-    ] ++ lib.optionals haveRedfish [
-      "fwupd/redfish.conf"
-    ] ++ lib.optionals haveMSR [
-      "fwupd/msr.conf"
-    ] ++ lib.optionals isx86 [
-      "fwupd/thunderbolt.conf"
     ];
 
     # DisabledPlugins key in fwupd/daemon.conf
@@ -392,7 +387,7 @@ stdenv.mkDerivation (finalAttrs: {
           assert len(passthru_etc - package_etc) == 0, f'fwupd package lists the following paths in passthru.filesInstalledToEtc that are not contained in /etc: {passthru_etc - package_etc}'
 
           config = configparser.RawConfigParser()
-          config.read('${finalAttrs.finalPackage}/etc/fwupd/daemon.conf')
+          config.read('${finalAttrs.finalPackage}/etc/fwupd/fwupd.conf')
           package_disabled_plugins = config.get('fwupd', 'DisabledPlugins').rstrip(';').split(';')
           passthru_disabled_plugins = ${listToPy finalAttrs.passthru.defaultDisabledPlugins}
           assert package_disabled_plugins == passthru_disabled_plugins, f'Default disabled plug-ins in the package {package_disabled_plugins} do not match those listed in passthru.defaultDisabledPlugins {passthru_disabled_plugins}'
diff --git a/nixpkgs/pkgs/os-specific/linux/firmware/fwupd/efi-app-path.patch b/nixpkgs/pkgs/os-specific/linux/firmware/fwupd/efi-app-path.patch
index a91adc1a69b9..f9e65a10e657 100644
--- a/nixpkgs/pkgs/os-specific/linux/firmware/fwupd/efi-app-path.patch
+++ b/nixpkgs/pkgs/os-specific/linux/firmware/fwupd/efi-app-path.patch
@@ -1,13 +1,13 @@
 diff --git a/meson.build b/meson.build
-index 7ac8c937a..5a23d0c80 100644
+index b18108c74..7e674b4d2 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -419,7 +419,7 @@ if build_standalone and efiboot.found() and efivar.found()
-     conf.set('HAVE_EFI_TIME_T', '1')
-   endif
- 
+@@ -404,7 +404,7 @@ endif
+
+ # EFI
+ if build_standalone
 -  efi_app_location = join_paths(libexecdir, 'fwupd', 'efi')
 +  efi_app_location = join_paths(dependency('fwupd-efi').get_variable(pkgconfig: 'prefix'), 'libexec', 'fwupd', 'efi')
    conf.set_quoted('EFI_APP_LOCATION', efi_app_location)
- 
    if host_cpu == 'x86'
+     EFI_MACHINE_TYPE_NAME = 'ia32'
diff --git a/nixpkgs/pkgs/os-specific/linux/firmware/ipu6-camera-bins/default.nix b/nixpkgs/pkgs/os-specific/linux/firmware/ipu6-camera-bins/default.nix
index 7e0fb379107d..a4bbd6d2bb6b 100644
--- a/nixpkgs/pkgs/os-specific/linux/firmware/ipu6-camera-bins/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/firmware/ipu6-camera-bins/default.nix
@@ -11,7 +11,7 @@
 , ipuVersion ? "ipu6"
 }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
   pname = "${ipuVersion}-camera-bin";
   version = "unstable-2023-02-08";
 
@@ -22,7 +22,7 @@ stdenv.mkDerivation {
     hash = "sha256-QnedM2UBbGyd2wIF762Mi+VkDZYtC6MifK4XGGxlUzw=";
   };
 
-  sourceRoot = "source/${ipuVersion}";
+  sourceRoot = "${finalAttrs.src.name}/${ipuVersion}";
 
   nativeBuildInputs = [
     autoPatchelfHook
@@ -76,4 +76,4 @@ stdenv.mkDerivation {
     ];
     platforms = [ "x86_64-linux" ];
   };
-}
+})
diff --git a/nixpkgs/pkgs/os-specific/linux/firmware/linux-firmware/default.nix b/nixpkgs/pkgs/os-specific/linux/firmware/linux-firmware/default.nix
index a2229a0a60ce..b76a77fb3a60 100644
--- a/nixpkgs/pkgs/os-specific/linux/firmware/linux-firmware/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/firmware/linux-firmware/default.nix
@@ -11,7 +11,7 @@ stdenvNoCC.mkDerivation rec {
   version = source.version;
 
   src = fetchzip {
-    url = "https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/snapshot/linux-firmware-${version}.tar.gz";
+    url = "https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/snapshot/linux-firmware-${source.revision}.tar.gz";
     hash = source.sourceHash;
   };
 
diff --git a/nixpkgs/pkgs/os-specific/linux/firmware/linux-firmware/source.nix b/nixpkgs/pkgs/os-specific/linux/firmware/linux-firmware/source.nix
index e1d77a03200f..d0bc79eaa767 100644
--- a/nixpkgs/pkgs/os-specific/linux/firmware/linux-firmware/source.nix
+++ b/nixpkgs/pkgs/os-specific/linux/firmware/linux-firmware/source.nix
@@ -1,6 +1,7 @@
 # This file is autogenerated! Run ./update.sh to regenerate.
 {
-  version = "20230515";
-  sourceHash = "sha256-VcA873r9jVYqDqEcvz/PVGfCAhLXr0sMXQincWNLEIs=";
-  outputHash = "sha256-h3KDK3KiD88dvTvLlLL2XczY1ZeEVnYEzh9sqbo1dZ8=";
+  version = "20230804";
+  revision = "20230804";
+  sourceHash = "sha256-TejOQazlH0rBuFHkHooYjR5slpjoSF7TaXvCVUvzevs=";
+  outputHash = "sha256-lD31M1Vio/MJlfKeHGT21xBzQETwgdeiObxPq79SrvU=";
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/firmware/linux-firmware/update.sh b/nixpkgs/pkgs/os-specific/linux/firmware/linux-firmware/update.sh
index 1fccc03e86be..4b28d6e1374f 100755
--- a/nixpkgs/pkgs/os-specific/linux/firmware/linux-firmware/update.sh
+++ b/nixpkgs/pkgs/os-specific/linux/firmware/linux-firmware/update.sh
@@ -5,14 +5,20 @@ cd "$(dirname "$(readlink -f "$0")")" || exit
 repo="https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git"
 
 # step 1: figure out the latest version from the tags
-if [ -z "$1" ]; then
-  version="$(git ls-remote --refs --tags --sort refname "$repo" | tail -n1 | cut -f2 | cut -d '/' -f3)"
+if [ -z "${1:-}" ]; then
+  revision="$(git ls-remote --refs --tags --sort refname "$repo" | tail -n1 | cut -f2 | cut -d '/' -f3)"
+  version=$revision
 else
-  version=$1
+  revision=$1
+  if [ -z "${2:-}" ]; then
+    version="unstable-$(date "+%Y-%m-%d")"
+  else
+    version=$2
+  fi
 fi
 
 # step 2: prefetch the source tarball
-snapshotUrl="$repo/snapshot/linux-firmware-$version.tar.gz"
+snapshotUrl="$repo/snapshot/linux-firmware-$revision.tar.gz"
 hash="$(nix-prefetch-url --unpack "$snapshotUrl")"
 sriHash="$(nix --experimental-features nix-command hash to-sri "sha256:$hash")"
 
@@ -20,6 +26,7 @@ sriHash="$(nix --experimental-features nix-command hash to-sri "sha256:$hash")"
 cat > source.nix << EOF
 {
   version = "$version";
+  revision = "$revision";
   sourceHash = "$sriHash";
   outputHash = null;
 }
@@ -33,6 +40,7 @@ cat > source.nix << EOF
 # This file is autogenerated! Run ./update.sh to regenerate.
 {
   version = "$version";
+  revision = "$revision";
   sourceHash = "$sriHash";
   outputHash = "$outHash";
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/firmware/raspberrypi-wireless/default.nix b/nixpkgs/pkgs/os-specific/linux/firmware/raspberrypi-wireless/default.nix
index 126fd3dfc23c..428fbf9dc900 100644
--- a/nixpkgs/pkgs/os-specific/linux/firmware/raspberrypi-wireless/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/firmware/raspberrypi-wireless/default.nix
@@ -41,6 +41,13 @@ stdenvNoCC.mkDerivation {
     # See https://github.com/RPi-Distro/firmware-nonfree/issues/26
     ln -s "./cyfmac43455-sdio-standard.bin" "$out/lib/firmware/cypress/cyfmac43455-sdio.bin"
 
+    pushd $out/lib/firmware/brcm &>/dev/null
+    # Symlinks for Zero 2W
+    ln -s "./brcmfmac43436-sdio.bin" "$out/lib/firmware/brcm/brcmfmac43430b0-sdio.raspberrypi,model-zero-2-w.bin"
+    ln -s "./brcmfmac43436-sdio.txt" "$out/lib/firmware/brcm/brcmfmac43430b0-sdio.raspberrypi,model-zero-2-w.txt"
+    ln -s "./brcmfmac43436-sdio.clm_blob" "$out/lib/firmware/brcm/brcmfmac43430b0-sdio.clm_blob"
+    popd &>/dev/null
+
     runHook postInstall
   '';
 
diff --git a/nixpkgs/pkgs/os-specific/linux/firmware/rtl8723bs-firmware/default.nix b/nixpkgs/pkgs/os-specific/linux/firmware/rtl8723bs-firmware/default.nix
deleted file mode 100644
index 8e486e1c4b2c..000000000000
--- a/nixpkgs/pkgs/os-specific/linux/firmware/rtl8723bs-firmware/default.nix
+++ /dev/null
@@ -1,23 +0,0 @@
-{ lib, stdenvNoCC, linuxPackages }:
-with lib;
-stdenvNoCC.mkDerivation {
-  pname = "rtl8723bs-firmware";
-  version = linuxPackages.rtl8723bs.version;
-  inherit (linuxPackages.rtl8723bs) src;
-
-  dontBuild = true;
-
-  installPhase = ''
-    mkdir -p                "$out/lib/firmware/rtlwifi"
-    cp rtl8723bs_nic.bin    "$out/lib/firmware/rtlwifi"
-    cp rtl8723bs_wowlan.bin "$out/lib/firmware/rtlwifi"
-  '';
-
-  meta = with lib; {
-    description = "Firmware for RealTek 8723bs";
-    homepage = "https://github.com/hadess/rtl8723bs";
-    license = licenses.unfreeRedistributableFirmware;
-    maintainers = with maintainers; [ elitak ];
-    platforms = with platforms; linux;
-  };
-}
diff --git a/nixpkgs/pkgs/os-specific/linux/firmware/sof-firmware/default.nix b/nixpkgs/pkgs/os-specific/linux/firmware/sof-firmware/default.nix
index 60fa6dea9ecd..2f33a139c9d3 100644
--- a/nixpkgs/pkgs/os-specific/linux/firmware/sof-firmware/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/firmware/sof-firmware/default.nix
@@ -5,11 +5,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "sof-firmware";
-  version = "2.2.5";
+  version = "2.2.6";
 
   src = fetchurl {
     url = "https://github.com/thesofproject/sof-bin/releases/download/v${version}/sof-bin-v${version}.tar.gz";
-    sha256 = "sha256-V39FCHW9gzr5uLcW42jYc6rJE6Nd2ZbHqg9Srd3vku4=";
+    sha256 = "sha256-kyLCp2NtAoRcOyaYTVirj3jWP/THZtCEwxlqWF4ACQU=";
   };
 
   dontFixup = true; # binaries must not be stripped or patchelfed
diff --git a/nixpkgs/pkgs/os-specific/linux/freeipa/default.nix b/nixpkgs/pkgs/os-specific/linux/freeipa/default.nix
index 63e11c2950d3..c7d7d5af09b8 100644
--- a/nixpkgs/pkgs/os-specific/linux/freeipa/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/freeipa/default.nix
@@ -64,11 +64,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "freeipa";
-  version = "4.10.1";
+  version = "4.10.2";
 
   src = fetchurl {
     url = "https://releases.pagure.org/freeipa/freeipa-${version}.tar.gz";
-    sha256 = "sha256-q2rQzcBl1tI4/7+hxEwOY9ND86hObe7O7Y9EEH7cUoA=";
+    sha256 = "sha256-9DbfxJeEUGnBE7pULTPrVgqRePILUFk4Kn0WFNmcFVg=";
   };
 
   nativeBuildInputs = [
diff --git a/nixpkgs/pkgs/os-specific/linux/fwts/default.nix b/nixpkgs/pkgs/os-specific/linux/fwts/default.nix
index 27c600c47149..70bdfc8527f3 100644
--- a/nixpkgs/pkgs/os-specific/linux/fwts/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/fwts/default.nix
@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   pname = "fwts";
-  version = "23.03.00";
+  version = "23.05.00";
 
   src = fetchzip {
     url = "https://fwts.ubuntu.com/release/${pname}-V${version}.tar.gz";
-    sha256 = "sha256-loBlNQwsgv3n5qqvcT6w22Z/AshwIS7vQrBjLCL4z/Q=";
+    sha256 = "sha256-LRsxgvo7XQ62gPjdH4F+03MQyRZ1VxEwokI9RvVkpKI=";
     stripRoot = false;
   };
 
diff --git a/nixpkgs/pkgs/os-specific/linux/fwts/module.nix b/nixpkgs/pkgs/os-specific/linux/fwts/module.nix
index 72f25aa800eb..a4083d275465 100644
--- a/nixpkgs/pkgs/os-specific/linux/fwts/module.nix
+++ b/nixpkgs/pkgs/os-specific/linux/fwts/module.nix
@@ -6,7 +6,7 @@ stdenv.mkDerivation rec {
 
   inherit (fwts) src;
 
-  sourceRoot = "source/efi_runtime";
+  sourceRoot = "${src.name}/efi_runtime";
 
   postPatch = ''
     substituteInPlace Makefile --replace \
diff --git a/nixpkgs/pkgs/os-specific/linux/game-devices-udev-rules/default.nix b/nixpkgs/pkgs/os-specific/linux/game-devices-udev-rules/default.nix
new file mode 100644
index 000000000000..daaf23db6ce2
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/game-devices-udev-rules/default.nix
@@ -0,0 +1,38 @@
+{ lib
+, stdenv
+, fetchFromGitea
+, bash
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "game-devices-udev-rules";
+  version = "0.22";
+
+  src = fetchFromGitea {
+    domain = "codeberg.org";
+    owner = "fabiscafe";
+    repo = "game-devices-udev";
+    rev = finalAttrs.version;
+    hash = "sha256-1aOb8pJxB+/PM7spcvZcy/cwdEolHQ4+lwBLij+6iDk=";
+  };
+
+  postInstall = ''
+    install -Dm444 -t "$out/lib/udev/rules.d" *.rules
+    substituteInPlace $out/lib/udev/rules.d/71-powera-controllers.rules \
+    --replace "/bin/sh" "${bash}/bin/bash"
+  '';
+
+  meta = with lib; {
+    description = "Udev rules to make supported controllers available with user-grade permissions";
+    homepage = "https://codeberg.org/fabiscafe/game-devices-udev";
+    license = licenses.mit;
+    longDescription = ''
+      These udev rules are intended to be used as a package under 'services.udev.packages'.
+      They will not be activated if installed as 'environment.systemPackages' or 'users.user.<user>.packages'.
+
+      Additionally, you may need to enable 'hardware.uinput'.
+    '';
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ keenanweaver ];
+  };
+})
diff --git a/nixpkgs/pkgs/os-specific/linux/gasket/default.nix b/nixpkgs/pkgs/os-specific/linux/gasket/default.nix
index 1f9d60ad7b60..c0790ae6a278 100644
--- a/nixpkgs/pkgs/os-specific/linux/gasket/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/gasket/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
   installFlags = [ "INSTALL_MOD_PATH=${placeholder "out"}" ];
   installTargets = [ "modules_install" ];
 
-  sourceRoot = "source/src";
+  sourceRoot = "${src.name}/src";
   hardeningDisable = [ "pic" "format" ];
   nativeBuildInputs = kernel.moduleBuildDependencies;
 
diff --git a/nixpkgs/pkgs/os-specific/linux/gt/default.nix b/nixpkgs/pkgs/os-specific/linux/gt/default.nix
index e227b6b6bc91..85897b72585e 100644
--- a/nixpkgs/pkgs/os-specific/linux/gt/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/gt/default.nix
@@ -2,7 +2,7 @@
 , asciidoc
 , libusbgx
 }:
-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
   pname = "gt";
   version = "unstable-2022-05-08";
 
@@ -13,7 +13,7 @@ stdenv.mkDerivation {
     sha256 = "sha256-km4U+t4Id2AZx6GpH24p2WNmvV5RVjJ14sy8tWLCQsk=";
   };
 
-  sourceRoot = "source/source";
+  sourceRoot = "${finalAttrs.src.name}/source";
 
   preConfigure = ''
     cmakeFlagsArray+=("-DBASH_COMPLETION_COMPLETIONSDIR=$out/share/bash-completions/completions")
@@ -29,4 +29,4 @@ stdenv.mkDerivation {
     maintainers = with lib.maintainers; [ lheckemann ];
     platforms = lib.platforms.linux;
   };
-}
+})
diff --git a/nixpkgs/pkgs/os-specific/linux/hid-nintendo/default.nix b/nixpkgs/pkgs/os-specific/linux/hid-nintendo/default.nix
deleted file mode 100644
index 7b8c73fc0ccd..000000000000
--- a/nixpkgs/pkgs/os-specific/linux/hid-nintendo/default.nix
+++ /dev/null
@@ -1,42 +0,0 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, kernel
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "hid-nintendo";
-  version = "3.2";
-
-  src = fetchFromGitHub {
-    owner = "nicman23";
-    repo = "dkms-hid-nintendo";
-    rev = finalAttrs.version;
-    hash = "sha256-2a+95zwyhJsF/KSo/Pm/JZ7ktDG02UZjsixSnVUXRrA=";
-  };
-
-  setSourceRoot = ''
-    export sourceRoot=$(pwd)/source/src
-  '';
-
-  nativeBuildInputs = kernel.moduleBuildDependencies;
-
-  makeFlags = kernel.makeFlags ++ [
-    "-C"
-    "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
-    "M=$(sourceRoot)"
-  ];
-
-  buildFlags = [ "modules" ];
-  installFlags = [ "INSTALL_MOD_PATH=${placeholder "out"}" ];
-  installTargets = [ "modules_install" ];
-
-  meta = {
-    homepage = "https://github.com/nicman23/dkms-hid-nintendo";
-    description = "A Nintendo HID kernel module";
-    license = lib.licenses.gpl2Plus;
-    maintainers = [ ];
-    platforms = lib.platforms.linux;
-    broken = lib.versionOlder kernel.version "4.14";
-  };
-})
diff --git a/nixpkgs/pkgs/os-specific/linux/hostapd/default.nix b/nixpkgs/pkgs/os-specific/linux/hostapd/default.nix
index f1cd6b67165b..a35bd38add27 100644
--- a/nixpkgs/pkgs/os-specific/linux/hostapd/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/hostapd/default.nix
@@ -23,13 +23,21 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "man" ];
 
+  # Based on hostapd's defconfig. Only differences are tracked.
   extraConfig = ''
+    # Use epoll(7) instead of select(2) on linux
+    CONFIG_ELOOP_EPOLL=y
+
+    # Drivers
     CONFIG_DRIVER_WIRED=y
-    CONFIG_LIBNL32=y
+    CONFIG_DRIVER_NONE=y
+
+    # Integrated EAP server
     CONFIG_EAP_SIM=y
     CONFIG_EAP_AKA=y
     CONFIG_EAP_AKA_PRIME=y
     CONFIG_EAP_PAX=y
+    CONFIG_EAP_PSK=y
     CONFIG_EAP_PWD=y
     CONFIG_EAP_SAKE=y
     CONFIG_EAP_GPSK=y
@@ -38,28 +46,48 @@ stdenv.mkDerivation rec {
     CONFIG_EAP_IKEV2=y
     CONFIG_EAP_TNC=y
     CONFIG_EAP_EKE=y
-    CONFIG_RADIUS_SERVER=y
-    CONFIG_IEEE80211R=y
-    CONFIG_IEEE80211N=y
-    CONFIG_IEEE80211AC=y
-    CONFIG_FULL_DYNAMIC_VLAN=y
-    CONFIG_VLAN_NETLINK=y
+
     CONFIG_TLS=openssl
     CONFIG_TLSV11=y
     CONFIG_TLSV12=y
-    CONFIG_INTERNETWORKING=y
+
+    CONFIG_SAE=y
+    CONFIG_SAE_PK=y
+
+    CONFIG_OWE=y
+    CONFIG_OCV=y
+
+    # TKIP is considered insecure and upstream support will be removed in the future
+    CONFIG_NO_TKIP=y
+
+    # Misc
+    CONFIG_RADIUS_SERVER=y
+    CONFIG_FULL_DYNAMIC_VLAN=y
+    CONFIG_VLAN_NETLINK=y
+    CONFIG_GETRANDOM=y
+    CONFIG_INTERWORKING=y
     CONFIG_HS20=y
+    CONFIG_FST=y
+    CONFIG_FST_TEST=y
     CONFIG_ACS=y
-    CONFIG_GETRANDOM=y
-    CONFIG_SAE=y
+    CONFIG_WNM=y
+    CONFIG_MBO=y
+
+    CONFIG_IEEE80211R=y
+    CONFIG_IEEE80211W=y
+    CONFIG_IEEE80211N=y
+    CONFIG_IEEE80211AC=y
+    CONFIG_IEEE80211AX=y
   '' + lib.optionalString (sqlite != null) ''
     CONFIG_SQLITE=y
   '';
 
+  passAsFile = [ "extraConfig" ];
+
   configurePhase = ''
     cd hostapd
     cp -v defconfig .config
-    echo "$extraConfig" >> .config
+    cat $extraConfigPath >> .config
     cat -n .config
     substituteInPlace Makefile --replace /usr/local $out
     export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE $(pkg-config --cflags libnl-3.0)"
diff --git a/nixpkgs/pkgs/os-specific/linux/hwdata/default.nix b/nixpkgs/pkgs/os-specific/linux/hwdata/default.nix
index 59f9d368f2fd..af8cbf0aa829 100644
--- a/nixpkgs/pkgs/os-specific/linux/hwdata/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/hwdata/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "hwdata";
-  version = "0.370";
+  version = "0.372";
 
   src = fetchFromGitHub {
     owner = "vcrhonek";
     repo = "hwdata";
     rev = "v${version}";
-    sha256 = "sha256-fqhYPKqtuI+7h/SgdWI4i7jBTgluy/hI8Q6pq4LKtY4=";
+    hash = "sha256-XC0U5UsOjTveRj1b0e1TBlYv/tKebSOu/YEGt/rmAHw=";
   };
 
   postPatch = ''
diff --git a/nixpkgs/pkgs/os-specific/linux/iio-sensor-proxy/default.nix b/nixpkgs/pkgs/os-specific/linux/iio-sensor-proxy/default.nix
index d2dd66056017..05fd82401a29 100644
--- a/nixpkgs/pkgs/os-specific/linux/iio-sensor-proxy/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/iio-sensor-proxy/default.nix
@@ -1,51 +1,58 @@
-{ lib, stdenv, fetchFromGitLab, autoconf-archive, gettext, libtool, intltool, autoconf, automake
-, glib, gtk3, gtk-doc, libgudev, pkg-config, systemd }:
+{ lib
+, stdenv
+, fetchFromGitLab
+, cmake
+, libxml2
+, meson
+, ninja
+, pkg-config
+, libgudev
+, systemd
+, polkit
+}:
 
 stdenv.mkDerivation rec {
   pname = "iio-sensor-proxy";
-  version = "3.0";
+  version = "3.5";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
-    owner  = "hadess";
-    repo   = pname;
-    rev    = version;
-    sha256 = "0ngbz1vkbjci3ml6p47jh6c6caipvbkm8mxrc8ayr6vc2p9l1g49";
+    owner = "hadess";
+    repo = pname;
+    rev = version;
+    hash = "sha256-pFu+nJzj45s7yIKoLWLeiv2AT5vLf6JpdWWQ0JZfnvY=";
   };
 
-  configurePhase = ''
-    runHook preConfigure
-
-    ./autogen.sh --prefix=$out \
-      --with-udevrulesdir=$out/lib/udev/rules.d \
-      --with-systemdsystemunitdir=$out/lib/systemd/system
-
-    runHook postConfigure
+  postPatch = ''
+    # upstream meson.build currently doesn't have an option to change the default polkit dir
+    substituteInPlace data/meson.build \
+      --replace 'polkit_policy_directory' "'$out/share/polkit-1/actions'"
   '';
 
   buildInputs = [
-    glib
-    gtk3
-    gtk-doc
     libgudev
     systemd
+    polkit
   ];
 
   nativeBuildInputs = [
-    autoconf
-    autoconf-archive
-    automake
-    gettext
-    intltool
-    libtool
+    meson
+    cmake
+    libxml2
+    ninja
     pkg-config
   ];
 
+  mesonFlags = [
+    (lib.mesonOption "udevrulesdir" "${placeholder "out"}/lib/udev/rules.d")
+    (lib.mesonOption "systemdsystemunitdir" "${placeholder "out"}/lib/systemd/system")
+  ];
+
   meta = with lib; {
     description = "Proxy for sending IIO sensor data to D-Bus";
     homepage = "https://gitlab.freedesktop.org/hadess/iio-sensor-proxy";
-    license = licenses.gpl3 ;
-    maintainers = with maintainers; [ peterhoeg ];
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ _999eagle ];
     platforms = platforms.linux;
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/intel-compute-runtime/default.nix b/nixpkgs/pkgs/os-specific/linux/intel-compute-runtime/default.nix
index fe1bb139a10b..1615ae39f7a3 100644
--- a/nixpkgs/pkgs/os-specific/linux/intel-compute-runtime/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/intel-compute-runtime/default.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "intel-compute-runtime";
-  version = "23.17.26241.15";
+  version = "23.22.26516.18";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "compute-runtime";
     rev = version;
-    sha256 = "sha256-A0gtSM6e+VcfcGG/6zReV2LIXq6tGbWIwDQFlQ2TW28=";
+    sha256 = "sha256-SeNmCXqoUqTo1F3ia+4fAMHWJgdEz/PsNFEkrqM+0k4=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
@@ -35,6 +35,9 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "drivers" ];
 
+  # causes redefinition of _FORTIFY_SOURCE
+  hardeningDisable = [ "fortify3" ];
+
   postInstall = ''
     # Avoid clash with intel-ocl
     mv $out/etc/OpenCL/vendors/intel.icd $out/etc/OpenCL/vendors/intel-neo.icd
diff --git a/nixpkgs/pkgs/os-specific/linux/iproute/default.nix b/nixpkgs/pkgs/os-specific/linux/iproute/default.nix
index 18b314067961..83ff3fd4cc3b 100644
--- a/nixpkgs/pkgs/os-specific/linux/iproute/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/iproute/default.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "iproute2";
-  version = "6.3.0";
+  version = "6.4.0";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/net/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-37KpjbluemU8/8ZpMzWhpGbimjS2rFKL5I814dJ2ZzI=";
+    sha256 = "sha256-TFG43svH5NoVn/sGb1kM+5Pb+a9/+GsWR85Ct8F5onI=";
   };
 
   patches = [
@@ -22,8 +22,8 @@ stdenv.mkDerivation rec {
 
     # fix build on musl. applied anywhere to prevent patchrot.
     (fetchpatch {
-      url = "https://git.alpinelinux.org/aports/plain/main/iproute2/min.patch?id=4b78dbe29d18151402052c56af43cc12d04b1a69";
-      sha256 = "sha256-0ROZQAN3mUPPgggictr23jyA4JDG7m9vmBUhgRp4ExY=";
+      url = "https://git.alpinelinux.org/aports/plain/main/iproute2/include.patch?id=bd46efb8a8da54948639cebcfa5b37bd608f1069";
+      sha256 = "sha256-NpNnSXQntuzzpjswE42yzo7nqmrQgI5YcHR2kp9NEwA=";
     })
   ];
 
diff --git a/nixpkgs/pkgs/os-specific/linux/ipu6-drivers/default.nix b/nixpkgs/pkgs/os-specific/linux/ipu6-drivers/default.nix
index 04ddb0749279..2c3215271606 100644
--- a/nixpkgs/pkgs/os-specific/linux/ipu6-drivers/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/ipu6-drivers/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation {
   pname = "ipu6-drivers";
-  version = "unstable-2023-05-19";
+  version = "unstable-2023-06-02";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "ipu6-drivers";
-    rev = "8c02a846d1afe0e108964a2d3db4acb175712da9";
-    hash = "sha256-f2EuxVkCvEPyH0XbLCv5t/Mi0jdk7BOh1QluG/TxZr0=";
+    rev = "8e410803b5d31c2c5bf32961f786d205ba6acc5d";
+    hash = "sha256-6GiDSGqVBTQrVMd+Rz/Lckvec+mtbuQ1w/ymC4Cie4I=";
   };
 
   postPatch = ''
diff --git a/nixpkgs/pkgs/os-specific/linux/iwd/default.nix b/nixpkgs/pkgs/os-specific/linux/iwd/default.nix
index 358cfb1c67ba..b808fb208c4d 100644
--- a/nixpkgs/pkgs/os-specific/linux/iwd/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/iwd/default.nix
@@ -12,12 +12,12 @@
 
 stdenv.mkDerivation rec {
   pname = "iwd";
-  version = "2.4";
+  version = "2.7";
 
   src = fetchgit {
     url = "https://git.kernel.org/pub/scm/network/wireless/iwd.git";
     rev = version;
-    sha256 = "sha256-X7jPheVePOaLY2kaAdpBwi5b/YrRZVqswOBu2RzsuHc=";
+    sha256 = "sha256-UsyJYQB6YzwcL6H1nyCW8ZTpBzacZMAp39mCfsZqwHY=";
   };
 
   outputs = [ "out" "man" "doc" ]
diff --git a/nixpkgs/pkgs/os-specific/linux/jfbview/default.nix b/nixpkgs/pkgs/os-specific/linux/jfbview/default.nix
deleted file mode 100644
index eb61ff9d5130..000000000000
--- a/nixpkgs/pkgs/os-specific/linux/jfbview/default.nix
+++ /dev/null
@@ -1,73 +0,0 @@
-{ lib, stdenv, fetchFromGitHub
-, freetype, harfbuzz, jbig2dec, libjpeg, libX11, mupdf_1_17, ncurses, openjpeg
-, openssl
-
-, imageSupport ? true, imlib2 ? null }:
-
-let
-  package = if imageSupport
-    then "jfbview"
-    else "jfbpdf";
-  binaries = if imageSupport
-    then [ "jfbview" "jpdfcat" "jpdfgrep" ] # all require imlib2
-    else [ "jfbpdf" ]; # does not
-in
-
-stdenv.mkDerivation rec {
-  pname = package;
-  version = "0.5.7";
-
-  src = fetchFromGitHub {
-    repo = "JFBView";
-    owner = "jichu4n";
-    rev = version;
-    sha256 = "0ppns49hnmp04zdjw6wc28v0yvz31rkzvd5ylcj7arikx20llpxf";
-  };
-
-  postPatch = ''
-    substituteInPlace main.cpp \
-      --replace "<stropts.h>" "<sys/ioctl.h>"
-  '';
-
-  hardeningDisable = [ "format" ];
-
-  buildInputs = [
-    freetype harfbuzz jbig2dec libjpeg libX11 mupdf_1_17 ncurses openjpeg
-    openssl
-  ] ++ lib.optionals imageSupport [
-    imlib2
-  ];
-
-  configurePhase = ''
-    # Hack. Probing (`ldconfig -p`) fails with ‘cannot execute binary file’.
-    # Overriding `OPENJP2 =` later works, but makes build output misleading:
-    substituteInPlace Makefile --replace "ldconfig -p" "echo libopenjp2"
-
-    make config.mk
-  '';
-
-  buildFlags = binaries;
-  enableParallelBuilding = true;
-
-  installPhase = ''
-    mkdir -p $out/bin
-    install ${toString binaries} $out/bin
-  '';
-
-  meta = with lib; {
-    description = "PDF and image viewer for the Linux framebuffer";
-    longDescription = ''
-      A very fast PDF and image viewer for the Linux framebuffer with some
-      advanced and unique features, including:
-      - Reads PDFs (MuPDF) and common image formats (Imlib2)
-      - Supports arbitrary zoom (10% - 1000%) and rotation
-      - Table of Contents (TOC) viewer for PDF documents
-      - Multi-threaded rendering on multi-core machines
-      - Asynchronous background rendering of the next page
-      - Customizable multi-threaded caching
-    '';
-    homepage = "https://seasonofcode.com/pages/jfbview.html";
-    license = licenses.asl20;
-    platforms = platforms.linux;
-  };
-}
diff --git a/nixpkgs/pkgs/os-specific/linux/jool/cli.nix b/nixpkgs/pkgs/os-specific/linux/jool/cli.nix
index 67e1575ff7e9..e6a41ef31ecf 100644
--- a/nixpkgs/pkgs/os-specific/linux/jool/cli.nix
+++ b/nixpkgs/pkgs/os-specific/linux/jool/cli.nix
@@ -10,11 +10,6 @@ stdenv.mkDerivation {
 
   src = sourceAttrs.src;
 
-  patches = [ (fetchpatch {
-    url = "https://github.com/NICMx/Jool/commit/490ddb0933061cab3c2a7952dffc61789deed565.patch";
-    hash = "sha256-1dpMth0ocPHujlk+96St1a63RipcWiL/CdmSz4O87Lg=";
-  }) ];
-
   outputs = [
     "out"
     "man"
diff --git a/nixpkgs/pkgs/os-specific/linux/jool/default.nix b/nixpkgs/pkgs/os-specific/linux/jool/default.nix
index 2d1a44790814..2ee5f0d6e078 100644
--- a/nixpkgs/pkgs/os-specific/linux/jool/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/jool/default.nix
@@ -12,13 +12,6 @@ stdenv.mkDerivation {
   nativeBuildInputs = kernel.moduleBuildDependencies;
   hardeningDisable = [ "pic" ];
 
-  patches = [
-    (fetchpatch {
-      url = "https://git.launchpad.net/ubuntu/+source/jool/plain/debian/patches/0001-Linux-6.2.patch?id=3708a5b6c492b7d8e9f78596e61ae8f74ec9640f";
-      hash = "sha256-GkyDY6tcJp7Xd28mrDorEJHxsEowZBJP7BRAdPpsyF8=";
-    })
-  ];
-
   prePatch = ''
     sed -e 's@/lib/modules/\$(.*)@${kernel.dev}/lib/modules/${kernel.modDirVersion}@' -i src/mod/*/Makefile
   '';
diff --git a/nixpkgs/pkgs/os-specific/linux/jool/source.nix b/nixpkgs/pkgs/os-specific/linux/jool/source.nix
index b221598c0e74..d98747d890ec 100644
--- a/nixpkgs/pkgs/os-specific/linux/jool/source.nix
+++ b/nixpkgs/pkgs/os-specific/linux/jool/source.nix
@@ -1,11 +1,11 @@
 { fetchFromGitHub }:
 
 rec {
-  version = "4.1.9";
+  version = "4.1.10";
   src = fetchFromGitHub {
     owner = "NICMx";
     repo = "Jool";
     rev = "refs/tags/v${version}";
-    hash = "sha256-sKrjn/XQANiXfkjNiFfvAkmONyQjVigFBKgcGkuIPs0=";
+    hash = "sha256-98XbBdSmgcepPZxX6hoPim+18lHLbrjqlbipB92nyAc=";
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/kbd/default.nix b/nixpkgs/pkgs/os-specific/linux/kbd/default.nix
index f4290352c93d..fc7da8fe9baa 100644
--- a/nixpkgs/pkgs/os-specific/linux/kbd/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kbd/default.nix
@@ -23,7 +23,9 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-zN9FI4emOAlz0pJzY+nLuTn6IGiRWm+Tf/nSRSICRoM=";
   };
 
-  outputs = [ "out" "dev" ];
+  # vlock is moved into its own output, since it depends on pam. This
+  # reduces closure size for most use cases.
+  outputs = [ "out" "vlock" "dev" ];
 
   configureFlags = [
     "--enable-optional-progs"
@@ -55,6 +57,12 @@ stdenv.mkDerivation rec {
         --replace 'bzip2 ' '${bzip2.bin}/bin/bzip2 ' \
         --replace 'xz '    '${xz.bin}/bin/xz ' \
         --replace 'zstd '  '${zstd.bin}/bin/zstd '
+
+      sed -i '
+        1i prefix:=$(vlock)
+        1i bindir := $(vlock)/bin' \
+        src/vlock/Makefile.in \
+        src/vlock/Makefile.am
     '';
 
   postInstall = ''
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel-headers/default.nix b/nixpkgs/pkgs/os-specific/linux/kernel-headers/default.nix
index 83ad463239a1..b1c0d3ba50db 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel-headers/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel-headers/default.nix
@@ -111,12 +111,12 @@ let
 in {
   inherit makeLinuxHeaders;
 
-  linuxHeaders = let version = "6.3"; in
+  linuxHeaders = let version = "6.4"; in
     makeLinuxHeaders {
       inherit version;
       src = fetchurl {
         url = "mirror://kernel/linux/kernel/v${lib.versions.major version}.x/linux-${version}.tar.xz";
-        hash = "sha256-ujSR9e1r0nCjcMRAQ049aQhfzdUoki+gHnPXZX23Ox4=";
+        hash = "sha256-j6BYjwws7KRMrHeg45ukjJ8AprncaXYcAqXT76yNp/M=";
       };
       patches = [
          ./no-relocs.patch # for building x86 kernel headers on non-ELF platforms
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/common-config.nix b/nixpkgs/pkgs/os-specific/linux/kernel/common-config.nix
index 44997740aea3..3240fe93de19 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/common-config.nix
@@ -92,6 +92,22 @@ let
       X86_AMD_PSTATE                   = whenAtLeast "5.17" yes;
       # Intel DPTF (Dynamic Platform and Thermal Framework) Support
       ACPI_DPTF                        = whenAtLeast "5.10" yes;
+
+      # Required to bring up some Bay Trail devices properly
+      I2C                              = yes;
+      I2C_DESIGNWARE_PLATFORM          = yes;
+      PMIC_OPREGION                    = whenAtLeast "5.10" yes;
+      INTEL_SOC_PMIC                   = whenAtLeast "5.10" yes;
+      BYTCRC_PMIC_OPREGION             = whenAtLeast "5.10" yes;
+      CHTCRC_PMIC_OPREGION             = whenAtLeast "5.10" yes;
+      XPOWER_PMIC_OPREGION             = whenAtLeast "5.10" yes;
+      BXT_WC_PMIC_OPREGION             = whenAtLeast "5.10" yes;
+      INTEL_SOC_PMIC_CHTWC             = whenAtLeast "5.10" yes;
+      CHT_WC_PMIC_OPREGION             = whenAtLeast "5.10" yes;
+      INTEL_SOC_PMIC_CHTDC_TI          = whenAtLeast "5.10" yes;
+      CHT_DC_TI_PMIC_OPREGION          = whenAtLeast "5.10" yes;
+      MFD_TPS68470                     = whenBetween "5.10" "5.13" yes;
+      TPS68470_PMIC_OPREGION           = whenAtLeast "5.10" yes;
     };
 
     external-firmware = {
@@ -110,6 +126,16 @@ let
       CC_OPTIMIZE_FOR_SIZE = no;
     };
 
+    memory = {
+      DAMON = whenAtLeast "5.15" yes;
+      DAMON_VADDR = whenAtLeast "5.15" yes;
+      DAMON_PADDR = whenAtLeast "5.16" yes;
+      DAMON_SYSFS = whenAtLeast "5.18" yes;
+      DAMON_DBGFS = whenAtLeast "5.15" yes;
+      DAMON_RECLAIM = whenAtLeast "5.16" yes;
+      DAMON_LRU_SORT = whenAtLeast "6.0" yes;
+    };
+
     memtest = {
       MEMTEST = yes;
     };
@@ -144,6 +170,7 @@ let
       NET                = yes;
       IP_ADVANCED_ROUTER = yes;
       IP_PNP             = no;
+      IP_ROUTE_MULTIPATH = yes;
       IP_VS_PROTO_TCP    = yes;
       IP_VS_PROTO_UDP    = yes;
       IP_VS_PROTO_ESP    = yes;
@@ -255,18 +282,30 @@ let
     };
 
     wireless = {
-      CFG80211_WEXT         = option yes; # Without it, ipw2200 drivers don't build
-      IPW2100_MONITOR       = option yes; # support promiscuous mode
-      IPW2200_MONITOR       = option yes; # support promiscuous mode
-      HOSTAP_FIRMWARE       = option yes; # Support downloading firmware images with Host AP driver
-      HOSTAP_FIRMWARE_NVRAM = option yes;
-      ATH9K_PCI             = option yes; # Detect Atheros AR9xxx cards on PCI(e) bus
-      ATH9K_AHB             = option yes; # Ditto, AHB bus
-      B43_PHY_HT            = option yes;
-      BCMA_HOST_PCI         = option yes;
-      RTW88                 = whenAtLeast "5.2" module;
-      RTW88_8822BE          = mkMerge [ (whenBetween "5.2" "5.8" yes) (whenAtLeast "5.8" module) ];
-      RTW88_8822CE          = mkMerge [ (whenBetween "5.2" "5.8" yes) (whenAtLeast "5.8" module) ];
+      CFG80211_WEXT               = option yes; # Without it, ipw2200 drivers don't build
+      IPW2100_MONITOR             = option yes; # support promiscuous mode
+      IPW2200_MONITOR             = option yes; # support promiscuous mode
+      HOSTAP_FIRMWARE             = option yes; # Support downloading firmware images with Host AP driver
+      HOSTAP_FIRMWARE_NVRAM       = option yes;
+      ATH9K_PCI                   = option yes; # Detect Atheros AR9xxx cards on PCI(e) bus
+      ATH9K_AHB                   = option yes; # Ditto, AHB bus
+      # The description of this option makes it sound dangerous or even illegal
+      # But OpenWRT enables it by default: https://github.com/openwrt/openwrt/blob/master/package/kernel/mac80211/Makefile#L55
+      # At the time of writing (25-06-2023): this is only used in a "correct" way by ath drivers for initiating DFS radiation
+      # for "certified devices"
+      EXPERT                      = option yes; # this is needed for offering the certification option
+      CFG80211_CERTIFICATION_ONUS = option yes;
+      # DFS: "Dynamic Frequency Selection" is a spectrum-sharing mechanism that allows
+      # you to use certain interesting frequency when your local regulatory domain mandates it.
+      # ATH drivers hides the feature behind this option and makes hostapd works with DFS frequencies.
+      # OpenWRT enables it too: https://github.com/openwrt/openwrt/blob/master/package/kernel/mac80211/ath.mk#L42
+      ATH9K_DFS_CERTIFIED         = option yes;
+      ATH10K_DFS_CERTIFIED        = option yes;
+      B43_PHY_HT                  = option yes;
+      BCMA_HOST_PCI               = option yes;
+      RTW88                       = whenAtLeast "5.2" module;
+      RTW88_8822BE                = mkMerge [ (whenBetween "5.2" "5.8" yes) (whenAtLeast "5.8" module) ];
+      RTW88_8822CE                = mkMerge [ (whenBetween "5.2" "5.8" yes) (whenAtLeast "5.8" module) ];
     };
 
     fb = {
@@ -617,6 +656,11 @@ let
       RING_BUFFER_BENCHMARK = no;
     };
 
+    perf = {
+      # enable AMD Zen branch sampling if available
+      PERF_EVENTS_AMD_BRS       = whenAtLeast "5.19" (option yes);
+    };
+
     virtualisation = {
       PARAVIRT = option yes;
 
@@ -671,7 +715,7 @@ let
       MEDIA_PCI_SUPPORT        = yes;
       MEDIA_USB_SUPPORT        = yes;
       MEDIA_ANALOG_TV_SUPPORT  = yes;
-      VIDEO_STK1160_COMMON     = module;
+      VIDEO_STK1160_COMMON     = whenOlder "6.5" module;
     };
 
     "9p" = {
@@ -690,6 +734,7 @@ let
       ZRAM           = module;
       ZRAM_WRITEBACK = option yes;
       ZSWAP          = option yes;
+      ZPOOL          = yes;
       ZBUD           = option yes;
       ZSMALLOC       = module;
     };
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/generic.nix b/nixpkgs/pkgs/os-specific/linux/kernel/generic.nix
index 04f6cfc70ad3..660521349053 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/generic.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/generic.nix
@@ -130,8 +130,6 @@ let
 
     # e.g. "defconfig"
     kernelBaseConfig = if defconfig != null then defconfig else stdenv.hostPlatform.linux-kernel.baseConfig or "defconfig";
-    # e.g. "bzImage"
-    kernelTarget = stdenv.hostPlatform.linux-kernel.target or "vmlinux";
 
     makeFlags = lib.optionals (stdenv.hostPlatform.linux-kernel ? makeFlags) stdenv.hostPlatform.linux-kernel.makeFlags
       ++ extraMakeFlags;
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/hardened/config.nix b/nixpkgs/pkgs/os-specific/linux/kernel/hardened/config.nix
index 5a1a710ba3b7..92192eb79f89 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/hardened/config.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/hardened/config.nix
@@ -28,7 +28,7 @@ assert (versionAtLeast version "4.9");
   #
   # We set SECURITY_WRITABLE_HOOKS n primarily for documentation purposes; the
   # config builder fails to detect that it has indeed been unset.
-  SECURITY_SELINUX_DISABLE = no;
+  SECURITY_SELINUX_DISABLE = whenOlder "6.4" no; # On 6.4: error: unused option: SECURITY_SELINUX_DISABLE
   SECURITY_WRITABLE_HOOKS  = option no;
 
   STRICT_KERNEL_RWX = yes;
@@ -41,7 +41,7 @@ assert (versionAtLeast version "4.9");
   DEBUG_SG              = yes;
   SCHED_STACK_END_CHECK = yes;
 
-  REFCOUNT_FULL = whenOlder "5.5" yes;
+  REFCOUNT_FULL = whenOlder "5.4.208" yes;
 
   # Randomize page allocator when page_alloc.shuffle=1
   SHUFFLE_PAGE_ALLOCATOR = whenAtLeast "5.2" yes;
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/hardened/patches.json b/nixpkgs/pkgs/os-specific/linux/kernel/hardened/patches.json
index ceec23139f94..01d761a6eeb0 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/hardened/patches.json
@@ -2,61 +2,71 @@
     "4.14": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-4.14.316-hardened1.patch",
-            "sha256": "1j0yx7i742mgbdn0lqq4mvcywk9jlm5k3zp40fdarsa0kscijxn0",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.316-hardened1/linux-hardened-4.14.316-hardened1.patch"
+            "name": "linux-hardened-4.14.320-hardened1.patch",
+            "sha256": "1j457mfkxqzv996brwzxaib43s8fdpd5ngrnj61vs3vf8xcwk186",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.320-hardened1/linux-hardened-4.14.320-hardened1.patch"
         },
-        "sha256": "0xlg93va7dbz2w428kiw7vr2sds3542fqq57rwyf51ykq7qii0xc",
-        "version": "4.14.316"
+        "sha256": "09bn18jvazkc55bqdjbxy8fbca7vjhi9xl2h02w0sq3f1jf6g0pd",
+        "version": "4.14.320"
     },
     "4.19": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-4.19.284-hardened1.patch",
-            "sha256": "0xqdhbsckkyg007x4247da0zza1sqq1y5a6li4z11y3xjf71dlxn",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.284-hardened1/linux-hardened-4.19.284-hardened1.patch"
+            "name": "linux-hardened-4.19.289-hardened1.patch",
+            "sha256": "1bi0cf15nqbk5hkhy76cd1xbb3fsnrgz705lry19v467hn3c0fx3",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.289-hardened1/linux-hardened-4.19.289-hardened1.patch"
         },
-        "sha256": "0gnhgxcpx9s96wa3dqgxmdjb7x12i94yh0gmv7k9nbz5qwhfxfbz",
-        "version": "4.19.284"
+        "sha256": "1cx33aa9v2071gixvp68pqpp4vxcx61dqg04rf6xns1qg48p93qi",
+        "version": "4.19.289"
     },
     "5.10": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.10.182-hardened1.patch",
-            "sha256": "1230wh6wjvmv3mv2sylwcqvqbz83b4vwwpbn7zikd7mmz2619k5w",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.182-hardened1/linux-hardened-5.10.182-hardened1.patch"
+            "name": "linux-hardened-5.10.188-hardened1.patch",
+            "sha256": "10mnrnzg3b5iirvn9x241zxwlysrnv7i65hiil2h8f7lswwgb6ar",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.188-hardened1/linux-hardened-5.10.188-hardened1.patch"
         },
-        "sha256": "1xp9bxk2vyw29bq3z854ly4cj94z8i52yl5hq4a3l3j6564wb3ny",
-        "version": "5.10.182"
+        "sha256": "04k1mc23vqv3mr4m80rab1w7z1cwc0n1kcxzc5vfcfp26nmqnmf9",
+        "version": "5.10.188"
     },
     "5.15": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.15.115-hardened1.patch",
-            "sha256": "1gkmhhfv86vnja37xfrnl65n6hzq429lc5zlxjvjmrpagl2x1pfc",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.115-hardened1/linux-hardened-5.15.115-hardened1.patch"
+            "name": "linux-hardened-5.15.123-hardened1.patch",
+            "sha256": "0q942jcz22yq7lbhmbwpg12p75zb0ky36zp2waz30cixw7lmyx6b",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.123-hardened1/linux-hardened-5.15.123-hardened1.patch"
         },
-        "sha256": "050j9z0wg5glgxwbmzfq4l8lv8y7g3nc2rz8342yjdcjfxh6h1qv",
-        "version": "5.15.115"
+        "sha256": "14xzk4rn7fwgdysnd763rbl25krvq40wk3y5cf8hasifl529brid",
+        "version": "5.15.123"
     },
     "5.4": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.4.245-hardened1.patch",
-            "sha256": "0n5ifykd1gq8yiw3snw6lhpz2hhydj3nk9k2f80b9svmza2h4vi6",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.245-hardened1/linux-hardened-5.4.245-hardened1.patch"
+            "name": "linux-hardened-5.4.251-hardened1.patch",
+            "sha256": "148qyspyj4a6yrl45f358z64iqxf40zb71ccj5kvwbrn395xiwgs",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.251-hardened1/linux-hardened-5.4.251-hardened1.patch"
         },
-        "sha256": "195ixy9l18mhwvzj7v63fkyifb9mysq950afxh6ixlpvg0c8h1wn",
-        "version": "5.4.245"
+        "sha256": "1jhqnazgiyz1vvrhnq5byl3h1mxrr3555fpiz4byycc1sqz9bd5w",
+        "version": "5.4.251"
     },
     "6.1": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-6.1.32-hardened1.patch",
-            "sha256": "00sg3zmvvnyvc4j82lcj4r7yw5hwvc253w0g2fr1hqqvh4fhinhw",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.1.32-hardened1/linux-hardened-6.1.32-hardened1.patch"
+            "name": "linux-hardened-6.1.42-hardened1.patch",
+            "sha256": "0v5ja4q8wq3gwds0m8bzrxhx6vagg97lvcxrw3glm1d5sv1v94l6",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.1.42-hardened1/linux-hardened-6.1.42-hardened1.patch"
         },
-        "sha256": "0v0saai735jzaj3dbpgp6sbdi95n3lmv78pbg1xy9fd2kfhbg23w",
-        "version": "6.1.32"
+        "sha256": "1lqy72yvsbcv7an1gr8sam6ym3788ss811xb3sw7d2qwaldjdy5a",
+        "version": "6.1.42"
+    },
+    "6.4": {
+        "patch": {
+            "extra": "-hardened1",
+            "name": "linux-hardened-6.4.7-hardened1.patch",
+            "sha256": "1kzkx0i3hkq25rywl8xsf5i8716ycjspblk1hrkaq6a02ci0697b",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.4.7-hardened1/linux-hardened-6.4.7-hardened1.patch"
+        },
+        "sha256": "1n57qijg0m27wcrqll8rb1hi1n0n8ca3bzsnbz05d9ya3nv3q56y",
+        "version": "6.4.7"
     }
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/htmldocs.nix b/nixpkgs/pkgs/os-specific/linux/kernel/htmldocs.nix
index ef2abefb377b..ba641347c839 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/htmldocs.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/htmldocs.nix
@@ -51,6 +51,6 @@ stdenv.mkDerivation {
     homepage = "https://www.kernel.org/doc/htmldocs/";
     platforms = platforms.linux;
     inherit (linux_latest.meta) license;
-    maintainers = with maintainers; [ SuperSandro2000 ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/linux-4.14.nix b/nixpkgs/pkgs/os-specific/linux/kernel/linux-4.14.nix
index f164d2a5ae86..5d759c36acfe 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/linux-4.14.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/linux-4.14.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "4.14.317";
+  version = "4.14.320";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0c1wy0m0jnjpc6scrw1y97wsg2d18vb1bi31i1qzlxvgmrd8zwlc";
+    sha256 = "09bn18jvazkc55bqdjbxy8fbca7vjhi9xl2h02w0sq3f1jf6g0pd";
   };
 } // (args.argsOverride or {}))
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/linux-4.19.nix b/nixpkgs/pkgs/os-specific/linux/kernel/linux-4.19.nix
index e12b9c20c67f..e71cdee98da8 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/linux-4.19.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/linux-4.19.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "4.19.285";
+  version = "4.19.289";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "05nwivdk4w939vrrbn5p2yai1rz7kxqa4bl5f3n6d867b59pg8da";
+    sha256 = "1cx33aa9v2071gixvp68pqpp4vxcx61dqg04rf6xns1qg48p93qi";
   };
 } // (args.argsOverride or {}))
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/linux-5.10.nix b/nixpkgs/pkgs/os-specific/linux/kernel/linux-5.10.nix
index 4c01e8b9a743..a6baeaac8901 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/linux-5.10.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/linux-5.10.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.10.183";
+  version = "5.10.188";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "06b1nlwaqs7g3323zxp1bxfilqpbj700x591vqa9dx6a6p39g520";
+    sha256 = "04k1mc23vqv3mr4m80rab1w7z1cwc0n1kcxzc5vfcfp26nmqnmf9";
   };
 } // (args.argsOverride or {}))
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/linux-5.15.nix b/nixpkgs/pkgs/os-specific/linux/kernel/linux-5.15.nix
index fb654f7f2f5a..f57635d8a2a0 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/linux-5.15.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/linux-5.15.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.15.116";
+  version = "5.15.124";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "16hpdqlkz2g2pjcml7j55yfym6nbp0zg8f2r969wq9jkpg8wj5zn";
+    sha256 = "1v927z1grqwcwj6769qm14828fzjzi58lsd86al2l0ddc016l0q0";
   };
 } // (args.argsOverride or { }))
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/linux-5.4.nix b/nixpkgs/pkgs/os-specific/linux/kernel/linux-5.4.nix
index 93f48fdbebcc..5f3afdab8c2e 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/linux-5.4.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/linux-5.4.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.4.246";
+  version = "5.4.251";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "1snrgvpqpmc0d4aphq8flsmlcjjx9kgknymjlrmazl4ghl57jf09";
+    sha256 = "1jhqnazgiyz1vvrhnq5byl3h1mxrr3555fpiz4byycc1sqz9bd5w";
   };
 } // (args.argsOverride or {}))
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/linux-6.1.nix b/nixpkgs/pkgs/os-specific/linux/kernel/linux-6.1.nix
index 636e5725207f..a99218168a63 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/linux-6.1.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/linux-6.1.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "6.1.33";
+  version = "6.1.43";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v6.x/linux-${version}.tar.xz";
-    sha256 = "1kfj7mi3n2lfaw4spz5cbvcl1md038figabyg80fha3kxal6nzdq";
+    sha256 = "02588pl1z8jxgxpa03rsdyg5pr0r3v0aylzp8r5ykm32193lhli4";
   };
 } // (args.argsOverride or { }))
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/linux-6.3.nix b/nixpkgs/pkgs/os-specific/linux/kernel/linux-6.4.nix
index 5cbb872b6a41..f7b043939d20 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/linux-6.3.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/linux-6.4.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "6.3.7";
+  version = "6.4.8";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v6.x/linux-${version}.tar.xz";
-    sha256 = "1acpbddgxna1g8xzsil5r1fbsiw8z3wdr69y8xxjllkck51rfdpy";
+    sha256 = "1djqqhw542jphqsicpbn1259sgw9pwd08wwkdch31nw4kvhk97y5";
   };
 } // (args.argsOverride or { }))
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/linux-libre.nix b/nixpkgs/pkgs/os-specific/linux/kernel/linux-libre.nix
index 04b8d56c57c2..0681df9ceb31 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/linux-libre.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/linux-libre.nix
@@ -1,8 +1,8 @@
 { stdenv, lib, fetchsvn, linux
 , scripts ? fetchsvn {
     url = "https://www.fsfla.org/svn/fsfla/software/linux-libre/releases/branches/";
-    rev = "19308";
-    sha256 = "1rhg43z4fyyac12c1z9h83xlh7ar0k2lfzrs40q061jlmx8mkpbb";
+    rev = "19337";
+    sha256 = "1ps7f7dfxjsl6xj6fiz5nw01an44aqsjmfmjzs8y2h0jpb7il9s5";
   }
 , ...
 }:
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix b/nixpkgs/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
index cd8ed2a17572..19b46d873086 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
@@ -6,7 +6,7 @@
 , ... } @ args:
 
 let
-  version = "5.10.78-rt55"; # updated by ./update-rt.sh
+  version = "5.10.186-rt91"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
@@ -17,14 +17,14 @@ in buildLinux (args // {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${kversion}.tar.xz";
-    sha256 = "03q5lrv8gr9hnm7984pxi9kwsvxrn21qwykj60amisi2wac6r05y";
+    sha256 = "1qqv91r13akgik1q4jybf8czskxxizk6lpv4rsvjn9sx2dm2jq0y";
   };
 
   kernelPatches = let rt-patch = {
     name = "rt";
     patch = fetchurl {
       url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "1wcw682r238qi5jgn5zk9m6j2506p9ypfax13bzhjfyjzz3h98kp";
+      sha256 = "1h5p0p3clq0gmaszvddmfll17adv02wfp2bfrd5x3aigvigwfmjb";
     };
   }; in [ rt-patch ] ++ kernelPatches;
 
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/linux-rt-5.15.nix b/nixpkgs/pkgs/os-specific/linux/kernel/linux-rt-5.15.nix
index 53f9426904ac..08fefe0218b3 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/linux-rt-5.15.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/linux-rt-5.15.nix
@@ -6,7 +6,7 @@
 , ... } @ args:
 
 let
-  version = "5.15.113-rt64"; # updated by ./update-rt.sh
+  version = "5.15.119-rt65"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
@@ -18,14 +18,14 @@ in buildLinux (args // {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${kversion}.tar.xz";
-    sha256 = "1jmrnd0ri75gl0k80g93zqyg00lbf1gqai3dga383ms92799hkja";
+    sha256 = "1kygpqf6sgkrwg77sv01di23c3n3rn5d44g8k5apx5106pys19bs";
   };
 
   kernelPatches = let rt-patch = {
     name = "rt";
     patch = fetchurl {
       url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "0nxnviivsshs20zh8px657mr31wfsjdy70z793f56bf9s2m4kl31";
+      sha256 = "1lkr3l0gad30brdq7kdgvqr3zz4xrd7ai8jh94di6l5krhi7s1w0";
     };
   }; in [ rt-patch ] ++ kernelPatches;
 
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/linux-rt-5.4.nix b/nixpkgs/pkgs/os-specific/linux/kernel/linux-rt-5.4.nix
index 821e11802e50..064922fb3550 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/linux-rt-5.4.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/linux-rt-5.4.nix
@@ -6,7 +6,7 @@
 , ... } @ args:
 
 let
-  version = "5.4.242-rt81"; # updated by ./update-rt.sh
+  version = "5.4.248-rt83"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
@@ -14,14 +14,14 @@ in buildLinux (args // {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${kversion}.tar.xz";
-    sha256 = "0a7wfi84p74qsnbj1vamz4qxzp94v054jp1csyfl0blz3knrlbql";
+    sha256 = "0d9yn51rg59k39h0w6wmvjqz9n7najm9x8yb79rparbcwwrd3gis";
   };
 
   kernelPatches = let rt-patch = {
     name = "rt";
     patch = fetchurl {
       url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "1wszhzw9ic018x3jiz8x1ffxxg30wpy4db7hja44b661p9fjm1dc";
+      sha256 = "1rr4vnynxwmlgnm5xq1m0xhykh72lkv2lsginbh5nk60k3qwizh2";
     };
   }; in [ rt-patch ] ++ kernelPatches;
 
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix b/nixpkgs/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix
index 0a5b10e56484..6d77e5f87fe2 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix
@@ -6,7 +6,7 @@
 , ... } @ args:
 
 let
-  version = "6.1.28-rt10"; # updated by ./update-rt.sh
+  version = "6.1.33-rt11"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
@@ -18,14 +18,14 @@ in buildLinux (args // {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v6.x/linux-${kversion}.tar.xz";
-    sha256 = "1w56qgf1vgk3dmh4xw6699kjm5pdqvyfzr19ah5yy3xj50a4q2bs";
+    sha256 = "1kfj7mi3n2lfaw4spz5cbvcl1md038figabyg80fha3kxal6nzdq";
   };
 
   kernelPatches = let rt-patch = {
     name = "rt";
     patch = fetchurl {
       url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "1fwi113x85bq09y06jhmfn5wbfscb9l2cggvlzw4yam802vlp853";
+      sha256 = "0swzp6brk01r7pb73yada18vf6fhdqq4c78abq3abj6y8ay0awhh";
     };
   }; in [ rt-patch ] ++ kernelPatches;
 
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix b/nixpkgs/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix
index b6f897b024e0..0763ffda26b9 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix
@@ -2,10 +2,12 @@
 , stdenv
 , fetchpatch
 , kernel
-, commitDate ? "2023-02-01"
-, currentCommit ? "65960c284ad149cc4bfbd64f21e6889c1e3d1c5f"
-, diffHash ? "sha256-4wpY3aYZ93OXSU4wmQs9K62nPyIzjKu4RBQTwksmyyk="
-
+, commitDate ? "2023-06-28"
+# bcachefs-tools stores the expected-revision in:
+#   https://evilpiepirate.org/git/bcachefs-tools.git/tree/.bcachefs_revision
+# but this does not means that it'll be the latest-compatible revision
+, currentCommit ? "84f132d5696138bb038d2dc8f1162d2fab5ac832"
+, diffHash ? "sha256-RaBWBU7rXjJFb1euFAFBHWCBQAG7npaCodjp/vMYpyw="
 , kernelPatches # must always be defined in bcachefs' all-packages.nix entry because it's also a top-level attribute supplied by callPackage
 , argsOverride ? {}
 , ...
@@ -18,7 +20,13 @@
   extraMeta = {
     branch = "master";
     broken = stdenv.isAarch64;
-    maintainers = with lib.maintainers; [ davidak Madouura pedrohlc ];
+    maintainers = with lib.maintainers; [ davidak Madouura pedrohlc raitobezarius ];
+  };
+
+  structuredExtraConfig = with lib.kernel; {
+    BCACHEFS_FS = module;
+    BCACHEFS_QUOTA = option yes;
+    BCACHEFS_POSIX_ACL = option yes;
   };
 
   kernelPatches = [ {
@@ -29,7 +37,5 @@
         url = "https://evilpiepirate.org/git/bcachefs.git/rawdiff/?id=${currentCommit}&id2=v${lib.versions.majorMinor kernel.version}";
         sha256 = diffHash;
       };
-
-      extraConfig = "BCACHEFS_FS m";
     } ] ++ kernelPatches;
 }))
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/linux-testing.nix b/nixpkgs/pkgs/os-specific/linux/kernel/linux-testing.nix
index e30689cdd3ea..0851a72e010d 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/linux-testing.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/linux-testing.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "6.4-rc4";
+  version = "6.5-rc3";
   extraMeta.branch = lib.versions.majorMinor version;
 
   # modDirVersion needs to be x.y.z, will always add .0
@@ -11,7 +11,7 @@ buildLinux (args // rec {
 
   src = fetchzip {
     url = "https://git.kernel.org/torvalds/t/linux-${version}.tar.gz";
-    hash = "sha256-PlxGRb4wKjamEDrSWpKXLxa7aX9lQoDgrjjrWhArisk=";
+    hash = "sha256-z4y4eNkY458rxebey3eCG0CUDLJP9oQETVlH8Av3Lhs=";
   };
 
   # Should the testing kernels ever be built on Hydra?
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/manual-config.nix b/nixpkgs/pkgs/os-specific/linux/kernel/manual-config.nix
index d7ea4ac2c498..07325f0e10b0 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -232,7 +232,10 @@ stdenv.mkDerivation ({
     # replicated here to apply to older versions.
     # Makes __FILE__ relative to the build directory.
     "KCPPFLAGS=-fmacro-prefix-map=$(sourceRoot)/="
-  ] ++ extraMakeFlags;
+    kernelConf.target
+  ] ++ optional isModular "modules"
+    ++ optional buildDTBs "dtbs"
+    ++ extraMakeFlags;
 
   installFlags = [
     "INSTALL_PATH=$(out)"
@@ -373,11 +376,20 @@ stdenv.mkDerivation ({
 
     # Remove reference to kmod
     sed -i Makefile -e 's|= ${buildPackages.kmod}/bin/depmod|= depmod|'
+  ''
+  # unfortunately linux/arch/mips/Makefile does not understand installkernel
+  # and simply copies to $(INSTALL_PATH)/vmlinux-$(KERNELRELEASE)
+  + lib.optionalString stdenv.hostPlatform.isMips ''
+    mv $out/vmlinux-* $out/vmlinux || true
+    mv $out/vmlinuz-* $out/vmlinuz || true
+    mv $out/System.map-* $out/System.map
   '';
 
   preFixup = ''
     # Don't strip $dev/lib/modules/*/vmlinux
     stripDebugList="$(cd $dev && echo lib/modules/*/build/*/)"
+  '' + lib.optionalString (stdenv.hostPlatform.isMips) ''
+    $STRIP -s $out/vmlinux || true
   '';
 
   enableParallelBuilding = true;
@@ -397,16 +409,20 @@ stdenv.mkDerivation ({
   meta = {
     description =
       "The Linux kernel" +
-      (if kernelPatches == [] then "" else
+      (lib.optionalString (kernelPatches != []) (
         " (with patches: "
         + lib.concatStringsSep ", " (map (x: x.name) kernelPatches)
-        + ")");
+        + ")"
+      ));
     license = lib.licenses.gpl2Only;
     homepage = "https://www.kernel.org/";
     maintainers = lib.teams.linux-kernel.members ++ [
       maintainers.thoughtpolice
     ];
     platforms = platforms.linux;
+    badPlatforms =
+      lib.optionals (lib.versionOlder version "4.15") [ "riscv32-linux" "riscv64-linux" ] ++
+      lib.optional (lib.versionOlder version "5.19") "loongarch64-linux";
     timeout = 14400; # 4 hours
   } // extraMeta;
 } // optionalAttrs (pos != null) {
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/patches.nix b/nixpkgs/pkgs/os-specific/linux/kernel/patches.nix
index 972235c7f852..f941ca9f007a 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/patches.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/patches.nix
@@ -57,13 +57,4 @@
     name = "export-rt-sched-migrate";
     patch = ./export-rt-sched-migrate.patch;
   };
-
-  CVE-2023-32233 = rec {
-    name = "CVE-2023-32233";
-    patch = fetchpatch {
-      name = name + ".patch";
-      url = "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/patch/?id=c1592a89942e9678f7d9c8030efa777c0d57edab";
-      hash = "sha256-DYPWgraXPNeFkjtuDYkFXHnCJ4yDewrukM2CCAqC2BE=";
-    };
-  };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/xanmod-kernels.nix b/nixpkgs/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
index 8eaab5a6f8b1..4412bd56fadd 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
@@ -3,14 +3,14 @@
 let
   # These names are how they are designated in https://xanmod.org.
   ltsVariant = {
-    version = "6.1.31";
-    hash = "sha256-quYsp6h7IV6gUT0e55FeBlS8rH9OGrqdbM1XSIYNRV4=";
+    version = "6.1.42";
+    hash = "sha256-mOydloX5bff9wrFh40wf12GW+sION9SoGK2mAC1yNOw=";
     variant = "lts";
   };
 
   mainVariant = {
-    version = "6.3.5";
-    hash = "sha256-2+8WDj1VdmIdC0DjmKyY/fMi5zoiXDAWy7EAmkImvXk=";
+    version = "6.4.7";
+    hash = "sha256-0yOVCMqhoiWz8IlYRR0wXytAzjv81Cf5NoFa9qxGMm4=";
     variant = "main";
   };
 
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/zen-kernels.nix b/nixpkgs/pkgs/os-specific/linux/kernel/zen-kernels.nix
index 2e0a9cfd8c46..7c32a5dae5c4 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/zen-kernels.nix
@@ -1,19 +1,19 @@
-{ lib, fetchFromGitHub, buildLinux, ... } @ args:
+{ lib, stdenv, fetchFromGitHub, buildLinux, ... } @ args:
 
 let
   # comments with variant added for update script
   # ./update-zen.py zen
   zenVariant = {
-    version = "6.3.4"; #zen
+    version = "6.4.7"; #zen
     suffix = "zen1"; #zen
-    sha256 = "1dj5pk8fqf4plk5nri6cajwvdcs9b6gpfk1y620vi3g7w15p1gvx"; #zen
+    sha256 = "1xxznqkgn17sh134c4szjhk8im342zh7z6200k3csnqd9fink2r7"; #zen
     isLqx = false;
   };
   # ./update-zen.py lqx
   lqxVariant = {
-    version = "6.3.4"; #lqx
+    version = "6.4.7"; #lqx
     suffix = "lqx1"; #lqx
-    sha256 = "06xkcrd4wjpj23dnrfbyxyx1699vxzswb3r6p2xjwmpy44j5wjgf"; #lqx
+    sha256 = "055l8l83368858ap1pslxcs76hkms8ik627v7d7wczm9f1vldbln"; #lqx
     isLqx = true;
   };
   zenKernelsFor = { version, suffix, sha256, isLqx }: buildLinux (args // {
@@ -28,13 +28,84 @@ let
       inherit sha256;
     };
 
+    # This is based on the following sources:
+    # - zen: https://gitlab.archlinux.org/archlinux/packaging/packages/linux-zen/-/blob/main/config
+    # - lqx: https://github.com/damentz/liquorix-package/blob/6.4/master/linux-liquorix/debian/config/kernelarch-x86/config-arch-64
+    # - Liquorix features: https://liquorix.net/
+    # The list below is not exhaustive, so the kernels probably doesn't match
+    # the upstream, but should bring most of the improvements that will be
+    # expected by users
+    structuredExtraConfig = with lib.kernel; {
+      # Zen Interactive tuning
+      ZEN_INTERACTIVE = yes;
+
+      # FQ-Codel Packet Scheduling
+      NET_SCH_DEFAULT = yes;
+      DEFAULT_FQ_CODEL = yes;
+      DEFAULT_NET_SCH = freeform "fq_codel";
+
+      # Preempt (low-latency)
+      PREEMPT = lib.mkOverride 60 yes;
+      PREEMPT_VOLUNTARY = lib.mkOverride 60 no;
+
+      # Preemptible tree-based hierarchical RCU
+      TREE_RCU = yes;
+      PREEMPT_RCU = yes;
+      RCU_EXPERT = yes;
+      TREE_SRCU = yes;
+      TASKS_RCU_GENERIC = yes;
+      TASKS_RCU = yes;
+      TASKS_RUDE_RCU = yes;
+      TASKS_TRACE_RCU = yes;
+      RCU_STALL_COMMON = yes;
+      RCU_NEED_SEGCBLIST = yes;
+      RCU_FANOUT = freeform "64";
+      RCU_FANOUT_LEAF = freeform "16";
+      RCU_BOOST = yes;
+      RCU_BOOST_DELAY = freeform "500";
+      RCU_NOCB_CPU = yes;
+      RCU_LAZY = yes;
+
+      # Futex WAIT_MULTIPLE implementation for Wine / Proton Fsync.
+      FUTEX = yes;
+      FUTEX_PI = yes;
+
+      # Preemptive Full Tickless Kernel at 1000Hz
+      HZ = freeform "1000";
+      HZ_1000 = yes;
+    } // lib.optionalAttrs (isLqx) {
+      # Google's BBRv2 TCP congestion Control
+      TCP_CONG_BBR2 = yes;
+      DEFAULT_BBR2 = yes;
+      DEFAULT_TCP_CONG = freeform "bbr2";
+
+      # PDS Process Scheduler
+      SCHED_ALT = yes;
+      SCHED_PDS = yes;
+
+      # Swap storage is compressed with LZ4 using zswap
+      ZSWAP_COMPRESSOR_DEFAULT_LZ4 = yes;
+      ZSWAP_COMPRESSOR_DEFAULT = freeform "lz4";
+
+      # Fix error: unused option: XXX.
+      CFS_BANDWIDTH = lib.mkForce (option no);
+      PSI = lib.mkForce (option no);
+      RT_GROUP_SCHED = lib.mkForce (option no);
+      SCHED_AUTOGROUP = lib.mkForce (option no);
+      SCHED_CORE = lib.mkForce (option no);
+
+      # ERROR: modpost: "sched_numa_hop_mask" [drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.ko] undefined!
+      MLX5_CORE = no;
+    };
+
     passthru.updateScript = [ ./update-zen.py (if isLqx then "lqx" else "zen") ];
 
     extraMeta = {
       branch = lib.versions.majorMinor version + "/master";
-      maintainers = with lib.maintainers; [ ];
+      maintainers = with lib.maintainers; [ thiagokokada ];
       description = "Built using the best configuration and kernel sources for desktop, multimedia, and gaming workloads." +
-        lib.optionalString isLqx " (Same as linux_zen but less aggressive release schedule)";
+        lib.optionalString isLqx " (Same as linux_zen, but less aggressive release schedule and additional extra config)";
+      broken = stdenv.isAarch64;
     };
 
   } // (args.argsOverride or { }));
diff --git a/nixpkgs/pkgs/os-specific/linux/ksmbd-tools/default.nix b/nixpkgs/pkgs/os-specific/linux/ksmbd-tools/default.nix
index 2376dddbb34a..6813e773a959 100644
--- a/nixpkgs/pkgs/os-specific/linux/ksmbd-tools/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/ksmbd-tools/default.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ksmbd-tools";
-  version = "3.4.8";
+  version = "3.4.9";
 
   src = fetchFromGitHub {
     owner = "cifsd-team";
     repo = pname;
     rev = version;
-    sha256 = "sha256-R/OWZekAGtDxE71MrzjWsdpaWGBu0c+VP0VkPro6GEo=";
+    sha256 = "sha256-GZccOlp9zZMqtv3+u8JnKFfIe8sjwbZBLkDk8lt3CGk=";
   };
 
   buildInputs = [ glib libnl ] ++ lib.optional withKerberos libkrb5;
diff --git a/nixpkgs/pkgs/os-specific/linux/kvmfr/default.nix b/nixpkgs/pkgs/os-specific/linux/kvmfr/default.nix
index 6b5f31a1d350..a77d1290ca80 100644
--- a/nixpkgs/pkgs/os-specific/linux/kvmfr/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kvmfr/default.nix
@@ -1,11 +1,14 @@
-{ lib, stdenv, fetchFromGitHub, kernel, kmod, looking-glass-client }:
+{ lib, stdenv, kernel, looking-glass-client }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "kvmfr";
   version = looking-glass-client.version;
 
   src = looking-glass-client.src;
-  sourceRoot = "source/module";
+  sourceRoot = "${looking-glass-client.src.name}/module";
+  patches = lib.optional (kernel.kernelAtLeast "6.4") [
+    ./linux-6-4-compat.patch
+  ];
   hardeningDisable = [ "pic" "format" ];
   nativeBuildInputs = kernel.moduleBuildDependencies;
 
diff --git a/nixpkgs/pkgs/os-specific/linux/kvmfr/linux-6-4-compat.patch b/nixpkgs/pkgs/os-specific/linux/kvmfr/linux-6-4-compat.patch
new file mode 100644
index 000000000000..e57d1d27c36c
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/kvmfr/linux-6-4-compat.patch
@@ -0,0 +1,16 @@
+diff --git a/kvmfr.c b/kvmfr.c
+index 121aae5b..2f4c9e1a 100644
+--- a/kvmfr.c
++++ b/kvmfr.c
+@@ -539,7 +539,11 @@ static int __init kvmfr_module_init(void)
+   if (kvmfr->major < 0)
+     goto out_free;
+ 
++#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 4, 0)
+   kvmfr->pClass = class_create(THIS_MODULE, KVMFR_DEV_NAME);
++#else
++  kvmfr->pClass = class_create(KVMFR_DEV_NAME);
++#endif
+   if (IS_ERR(kvmfr->pClass))
+     goto out_unreg;
+ 
diff --git a/nixpkgs/pkgs/os-specific/linux/lenovo-legion/app.nix b/nixpkgs/pkgs/os-specific/linux/lenovo-legion/app.nix
index ba189767bca6..4f4c3c937254 100644
--- a/nixpkgs/pkgs/os-specific/linux/lenovo-legion/app.nix
+++ b/nixpkgs/pkgs/os-specific/linux/lenovo-legion/app.nix
@@ -11,7 +11,7 @@ python3.pkgs.buildPythonApplication rec {
     sha256 = "sha256-s4JFFmawokdC4qoqNvZDhuJSinhQ3YKSIfAYi79VTTA=";
   };
 
-  sourceRoot = "source/python/legion_linux";
+  sourceRoot = "${src.name}/python/legion_linux";
 
   nativeBuildInputs = [ wrapQtAppsHook ];
 
diff --git a/nixpkgs/pkgs/os-specific/linux/lenovo-legion/default.nix b/nixpkgs/pkgs/os-specific/linux/lenovo-legion/default.nix
index 375b835ac47d..527f1852f1e0 100644
--- a/nixpkgs/pkgs/os-specific/linux/lenovo-legion/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/lenovo-legion/default.nix
@@ -4,7 +4,7 @@ stdenv.mkDerivation {
   pname = "lenovo-legion-module";
   inherit (lenovo-legion) version src;
 
-  sourceRoot = "source/kernel_module";
+  sourceRoot = "${lenovo-legion.src.name}/kernel_module";
 
   hardeningDisable = [ "pic" ];
 
diff --git a/nixpkgs/pkgs/os-specific/linux/libbpf/default.nix b/nixpkgs/pkgs/os-specific/linux/libbpf/default.nix
index be1a1453e871..51f6ea471a6a 100644
--- a/nixpkgs/pkgs/os-specific/linux/libbpf/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/libbpf/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libbpf";
-  version = "1.2.0";
+  version = "1.2.2";
 
   src = fetchFromGitHub {
     owner = "libbpf";
     repo = "libbpf";
     rev = "v${version}";
-    sha256 = "sha256-NimK4pdYcai21hZHdP1mBX1MOlNY61iDJ+PDYwpRuVE=";
+    sha256 = "sha256-SDDdz2HKEfzHloLkb0sv5ldTo+1yJDVc9O7nj4Cjznk=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/nixpkgs/pkgs/os-specific/linux/libevdevc/default.nix b/nixpkgs/pkgs/os-specific/linux/libevdevc/default.nix
index 4998ee3e6b57..5e6b7cd47815 100644
--- a/nixpkgs/pkgs/os-specific/linux/libevdevc/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/libevdevc/default.nix
@@ -19,6 +19,9 @@ stdenv.mkDerivation rec {
 
   makeFlags = [ "DESTDIR=$(out)" "LIBDIR=/lib" ];
 
+  # causes redefinition of _FORTIFY_SOURCE
+  hardeningDisable = [ "fortify3" ];
+
   meta = with lib; {
     description = "ChromiumOS libevdev. Renamed to avoid conflicts with the standard libevdev found in Linux distros";
     license = licenses.bsd3;
diff --git a/nixpkgs/pkgs/os-specific/linux/libtraceevent/default.nix b/nixpkgs/pkgs/os-specific/linux/libtraceevent/default.nix
index 427f2eb69c49..5b8aa329b783 100644
--- a/nixpkgs/pkgs/os-specific/linux/libtraceevent/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/libtraceevent/default.nix
@@ -1,32 +1,27 @@
-{ lib, stdenv, fetchgit, pkg-config, asciidoc, xmlto, docbook_xml_dtd_45, docbook_xsl, coreutils }:
+{ lib, stdenv, fetchgit, pkg-config, asciidoc, xmlto, docbook_xml_dtd_45, docbook_xsl, meson, ninja, cunit }:
 
 stdenv.mkDerivation rec {
   pname = "libtraceevent";
-  version = "1.6.2";
+  version = "1.7.3";
 
   src = fetchgit {
     url = "https://git.kernel.org/pub/scm/libs/libtrace/libtraceevent.git";
     rev = "libtraceevent-${version}";
-    sha256 = "sha256-iLy2rEKn0UJguRcY/W8RvUq7uX+snQojb/cXOmMsjwc=";
+    sha256 = "sha256-poF+Cqcdj0KIgEJWW7XDAlRLz2/Egi948s1M24ETvBo=";
   };
 
-  # Don't build and install html documentation
   postPatch = ''
-    sed -i -e '/^all:/ s/html//' -e '/^install:/ s/install-html//' Documentation/Makefile
-    substituteInPlace scripts/utils.mk --replace /bin/pwd ${coreutils}/bin/pwd
+    chmod +x Documentation/install-docs.sh.in
+    patchShebangs --build check-manpages.sh Documentation/install-docs.sh.in
   '';
 
-  outputs = [ "out" "dev" "devman" ];
-  enableParallelBuilding = true;
-  nativeBuildInputs = [ pkg-config asciidoc xmlto docbook_xml_dtd_45 docbook_xsl ];
-  makeFlags = [
-    "prefix=${placeholder "out"}"
-    "doc"                       # build docs
-  ];
-  installFlags = [
-    "pkgconfig_dir=${placeholder "out"}/lib/pkgconfig"
-    "doc-install"
-  ];
+  outputs = [ "out" "dev" "devman" "doc" ];
+  nativeBuildInputs = [ meson ninja pkg-config asciidoc xmlto docbook_xml_dtd_45 docbook_xsl ];
+
+  ninjaFlags = [ "all" "docs" ];
+
+  doCheck = true;
+  checkInputs = [ cunit ];
 
   meta = with lib; {
     description = "Linux kernel trace event library";
diff --git a/nixpkgs/pkgs/os-specific/linux/libtracefs/default.nix b/nixpkgs/pkgs/os-specific/linux/libtracefs/default.nix
index 3cb79ae07780..3e9c9115645d 100644
--- a/nixpkgs/pkgs/os-specific/linux/libtracefs/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/libtracefs/default.nix
@@ -8,38 +8,50 @@
 , docbook_xml_dtd_45
 , docbook_xsl
 , coreutils
-, which
 , valgrind
 , sourceHighlight
+, meson
+, flex
+, bison
+, ninja
+, cunit
 }:
 
 stdenv.mkDerivation rec {
   pname = "libtracefs";
-  version = "1.6.4";
+  version = "1.7.0";
 
   src = fetchgit {
     url = "https://git.kernel.org/pub/scm/libs/libtrace/libtracefs.git";
     rev = "libtracefs-${version}";
-    sha256 = "sha256-fWop0EMkoVulLBzU7q8x1IhMtdnEJ89wMz0cz964F6s=";
+    sha256 = "sha256-64eXFFdnZHHf4C3vbADtPuIMsfJ85VZ6t8A1gIc1CW0=";
   };
 
   postPatch = ''
-    substituteInPlace scripts/utils.mk --replace /bin/pwd ${coreutils}/bin/pwd
-    patchShebangs check-manpages.sh
+    chmod +x samples/extract-example.sh
+    patchShebangs --build check-manpages.sh samples/extract-example.sh Documentation/install-docs.sh.in
   '';
 
   outputs = [ "out" "dev" "devman" "doc" ];
-  enableParallelBuilding = true;
-  nativeBuildInputs = [ pkg-config asciidoc xmlto docbook_xml_dtd_45 docbook_xsl which valgrind sourceHighlight ];
-  buildInputs = [ libtraceevent ];
-  makeFlags = [
-    "prefix=${placeholder "out"}"
-    "doc"                       # build docs
-  ];
-  installFlags = [
-    "pkgconfig_dir=${placeholder "out"}/lib/pkgconfig"
-    "install_doc"
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    asciidoc
+    xmlto
+    docbook_xml_dtd_45
+    docbook_xsl
+    valgrind
+    sourceHighlight
+    flex
+    bison
   ];
+  buildInputs = [ libtraceevent ];
+
+  ninjaFlags = [ "all" "docs" ];
+
+  doCheck = true;
+  checkInputs = [ cunit ];
 
   meta = with lib; {
     description = "Linux kernel trace file system library";
diff --git a/nixpkgs/pkgs/os-specific/linux/lttng-modules/default.nix b/nixpkgs/pkgs/os-specific/linux/lttng-modules/default.nix
index f7b5b3fd1fa1..89b49068d40c 100644
--- a/nixpkgs/pkgs/os-specific/linux/lttng-modules/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/lttng-modules/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "lttng-modules-${kernel.version}";
-  version = "2.13.8";
+  version = "2.13.10";
 
   src = fetchFromGitHub {
     owner = "lttng";
     repo = "lttng-modules";
     rev = "v${version}";
-    hash = "sha256-6ohWsGUGFz7QlHkKWyW5edpSsBTE9DFS3v6EsH9wNZo=";
+    hash = "sha256-R5qwB1ayw0KueMBSSxm0TwINt78N6w356kY7WGBX0zM=";
   };
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
diff --git a/nixpkgs/pkgs/os-specific/linux/mba6x_bl/default.nix b/nixpkgs/pkgs/os-specific/linux/mba6x_bl/default.nix
index 04a89ad038dd..3add5eb227f5 100644
--- a/nixpkgs/pkgs/os-specific/linux/mba6x_bl/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/mba6x_bl/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation {
   pname = "mba6x_bl";
-  version = "unstable-2016-12-08";
+  version = "unstable-2017-12-30";
 
   src = fetchFromGitHub {
     owner = "patjak";
     repo = "mba6x_bl";
-    rev = "b96aafd30c18200b4ad1f6eb995bc19200f60c47";
-    sha256 = "10payvfxahazdxisch4wm29fhl8y07ki72q4c78sl4rn73sj6yjq";
+    rev = "639719f516b664051929c2c0c1140ea4bf30ce81";
+    sha256 = "sha256-QwxBpNa5FitKO+2ne54IIcRgwVYeNSQWI4f2hPPB8ls=";
   };
 
   enableParallelBuilding = true;
diff --git a/nixpkgs/pkgs/os-specific/linux/microcode/intel.nix b/nixpkgs/pkgs/os-specific/linux/microcode/intel.nix
index cd11bcb9e210..03c8300dbfc8 100644
--- a/nixpkgs/pkgs/os-specific/linux/microcode/intel.nix
+++ b/nixpkgs/pkgs/os-specific/linux/microcode/intel.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "microcode-intel";
-  version = "20230512";
+  version = "20230613";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "Intel-Linux-Processor-Microcode-Data-Files";
     rev = "microcode-${version}";
-    hash = "sha256-Ay907cXbT+LlE4foK4TODcDB5Rx/Zo7HY17erem71rw=";
+    hash = "sha256-tP59wfZHCLwPb2FkHaa+0D4RW1Zmu9vKaIgbveP/nLI=";
   };
 
   nativeBuildInputs = [ iucode-tool libarchive ];
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/bash/default.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/bash/default.nix
new file mode 100644
index 000000000000..9c9682fdf9d5
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/bash/default.nix
@@ -0,0 +1,98 @@
+{ lib
+, buildPlatform
+, hostPlatform
+, fetchurl
+, bootBash
+, gnumake
+, gnused
+, gnugrep
+, gnutar
+, gawk
+, gzip
+, gcc
+, glibc
+, binutils
+, linux-headers
+, derivationWithMeta
+, bash
+, coreutils
+}:
+let
+  pname = "bash";
+  version = "5.2.15";
+
+  src = fetchurl {
+    url = "mirror://gnu/bash/bash-${version}.tar.gz";
+    sha256 = "132qng0jy600mv1fs95ylnlisx2wavkkgpb19c6kmz7lnmjhjwhk";
+  };
+in
+bootBash.runCommand "${pname}-${version}" {
+  inherit pname version;
+
+  nativeBuildInputs = [
+    gcc
+    binutils
+    gnumake
+    gnused
+    gnugrep
+    gnutar
+    gawk
+    gzip
+  ];
+
+  passthru.runCommand = name: env: buildCommand:
+    derivationWithMeta ({
+      inherit name buildCommand;
+      builder = "${bash}/bin/bash";
+      args = [
+        "-e"
+        (builtins.toFile "bash-builder.sh" ''
+          export CONFIG_SHELL=$SHELL
+          bash -eux $buildCommandPath
+        '')
+      ];
+      passAsFile = [ "buildCommand" ];
+
+      SHELL = "${bash}/bin/bash";
+      PATH = lib.makeBinPath ((env.nativeBuildInputs or []) ++ [
+        bash
+        coreutils
+      ]);
+    } // (builtins.removeAttrs env [ "nativeBuildInputs" ]));
+
+  passthru.tests.get-version = result:
+    bootBash.runCommand "${pname}-get-version-${version}" {} ''
+      ${result}/bin/bash --version
+      mkdir $out
+    '';
+
+  meta = with lib; {
+    description = "GNU Bourne-Again Shell, the de facto standard shell on Linux";
+    homepage = "https://www.gnu.org/software/bash";
+    license = licenses.gpl3Plus;
+    maintainers = teams.minimal-bootstrap.members;
+    platforms = platforms.unix;
+  };
+} ''
+  # Unpack
+  tar xzf ${src}
+  cd bash-${version}
+
+  # Configure
+  export CC="gcc -I${glibc}/include -I${linux-headers}/include"
+  export LIBRARY_PATH="${glibc}/lib"
+  export LIBS="-lc -lnss_files -lnss_dns -lresolv"
+  export ac_cv_func_dlopen=no
+  bash ./configure \
+    --prefix=$out \
+    --build=${buildPlatform.config} \
+    --host=${hostPlatform.config} \
+    --disable-nls \
+    --disable-net-redirections
+
+  # Build
+  make SHELL=bash
+
+  # Install
+  make install
+''
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/binutils/default.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/binutils/default.nix
new file mode 100644
index 000000000000..8722ff818297
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/binutils/default.nix
@@ -0,0 +1,118 @@
+{ lib
+, buildPlatform
+, hostPlatform
+, fetchurl
+, bash
+, gnumake
+, gnupatch
+, gnugrep
+, gnutar
+, gawk
+, bzip2
+, sed
+, mesBootstrap ? false, tinycc ? null
+, gcc ? null, glibc ? null, binutils ? null, linux-headers
+}:
+assert mesBootstrap -> tinycc != null;
+assert !mesBootstrap -> gcc != null && glibc != null && binutils != null;
+let
+  pname = "binutils" + lib.optionalString mesBootstrap "-mes";
+  version = "2.20.1";
+  rev = "a";
+
+  src = fetchurl {
+    url = "mirror://gnu/binutils/binutils-${version}${rev}.tar.bz2";
+    sha256 = "0r7dr0brfpchh5ic0z9r4yxqn4ybzmlh25sbp30cacqk8nb7rlvi";
+  };
+
+  patches = [
+    # Enables building binutils using TCC and Mes C Library
+    (fetchurl {
+      url = "https://git.savannah.gnu.org/cgit/guix.git/plain/gnu/packages/patches/binutils-boot-2.20.1a.patch?id=50249cab3a98839ade2433456fe618acc6f804a5";
+      sha256 = "086sf6an2k56axvs4jlky5n3hs2l3rq8zq5d37h0b69cdyh7igpn";
+    })
+
+    # Make binutils output deterministic by default.
+    ./deterministic.patch
+  ];
+
+  configureFlags = [
+    "--disable-nls"
+    "--disable-shared"
+    "--disable-werror"
+    "--prefix=${placeholder "out"}"
+
+    "--build=${buildPlatform.config}"
+    "--host=${hostPlatform.config}"
+
+    # Turn on --enable-new-dtags by default to make the linker set
+    # RUNPATH instead of RPATH on binaries.  This is important because
+    # RUNPATH can be overridden using LD_LIBRARY_PATH at runtime.
+    "--enable-new-dtags"
+
+    # By default binutils searches $libdir for libraries. This brings in
+    # libbfd and libopcodes into a default visibility. Drop default lib
+    # path to force users to declare their use of these libraries.
+    "--with-lib-path=:"
+  ];
+in
+bash.runCommand "${pname}-${version}" {
+  inherit pname version;
+
+  nativeBuildInputs = [
+    (if mesBootstrap then tinycc.compiler else gcc)
+    gnumake
+    gnupatch
+    gnugrep
+    gnutar
+    gawk
+    bzip2
+    sed
+  ] ++ lib.optional (!mesBootstrap) binutils;
+
+  passthru.tests.get-version = result:
+    bash.runCommand "${pname}-get-version-${version}" {} ''
+      ${result}/bin/ld --version
+      mkdir $out
+    '';
+
+  meta = with lib; {
+    description = "Tools for manipulating binaries (linker, assembler, etc.)";
+    homepage = "https://www.gnu.org/software/binutils";
+    license = licenses.gpl3Plus;
+    maintainers = teams.minimal-bootstrap.members;
+    platforms = platforms.unix;
+  };
+} ''
+  # Unpack
+  cp ${src} binutils.tar.bz2
+  bunzip2 binutils.tar.bz2
+  tar xf binutils.tar
+  rm binutils.tar
+  cd binutils-${version}
+
+  # Patch
+  ${lib.concatMapStringsSep "\n" (f: "patch -Np1 -i ${f}") patches}
+  # Clear the default library search path.
+  echo 'NATIVE_LIB_DIRS=' >> ld/configure.tgt
+
+  # Configure
+  ${if mesBootstrap then ''
+    export CC="tcc -B ${tinycc.libs}/lib -D __GLIBC_MINOR__=6 -D MES_BOOTSTRAP=1"
+    export AR="tcc -ar"
+  '' else ''
+    export CC="gcc -B ${glibc}/lib -I${glibc}/include -I${linux-headers}/include"
+    export CPP="gcc -E -I${glibc}/include -I${linux-headers}/include"
+    export AR="ar"
+    export LIBRARY_PATH="${glibc}/lib"
+    export LIBS="-lc -lnss_files -lnss_dns -lresolv"
+  ''}
+  export SED=sed
+  bash ./configure ${lib.concatStringsSep " " configureFlags}
+
+  # Build
+  make
+
+  # Install
+  make install
+''
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/binutils/deterministic.patch b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/binutils/deterministic.patch
new file mode 100644
index 000000000000..736e0aca6ce1
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/binutils/deterministic.patch
@@ -0,0 +1,12 @@
+diff -ur orig/binutils-2.23.1/ld/ldlang.c binutils-2.23.1/ld/ldlang.c
+--- orig/ld/ldlang.c
++++ new/ld/ldlang.c
+@@ -3095,6 +3095,8 @@
+                           ldfile_output_machine))
+     einfo (_("%P%F:%s: can not set architecture: %E\n"), name);
+ 
++  link_info.output_bfd->flags |= BFD_DETERMINISTIC_OUTPUT;
++
+   link_info.hash = bfd_link_hash_table_create (link_info.output_bfd);
+   if (link_info.hash == NULL)
+     einfo (_("%P%F: can not create hash table: %E\n"));
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/default.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/default.nix
index 3e4e9e7f5cb8..3b84795678ef 100644
--- a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/default.nix
@@ -15,6 +15,26 @@ lib.makeScope
 
     bash_2_05 = callPackage ./bash/2.nix { tinycc = tinycc-mes; };
 
+    bash = callPackage ./bash {
+      bootBash = bash_2_05;
+      gcc = gcc2;
+      glibc = glibc22;
+    };
+
+    binutils = callPackage ./binutils {
+      bash = bash_2_05;
+      gcc = gcc2;
+      binutils = binutils-mes;
+      glibc = glibc22;
+      sed = heirloom.sed;
+    };
+    binutils-mes = callPackage ./binutils {
+      bash = bash_2_05;
+      tinycc = tinycc-mes;
+      sed = heirloom.sed;
+      mesBootstrap = true;
+    };
+
     bzip2 = callPackage ./bzip2 {
       bash = bash_2_05;
       tinycc = tinycc-mes;
@@ -22,11 +42,42 @@ lib.makeScope
 
     coreutils = callPackage ./coreutils { tinycc = tinycc-mes; };
 
+    diffutils = callPackage ./diffutils {
+      bash = bash_2_05;
+      gcc = gcc2;
+      glibc = glibc22;
+    };
+
+    findutils = callPackage ./findutils {
+      bash = bash_2_05;
+      gcc = gcc2;
+      glibc = glibc22;
+    };
+
     gawk = callPackage ./gawk {
       bash = bash_2_05;
       tinycc = tinycc-mes;
+      gnused = gnused-mes;
     };
 
+    gcc2 = callPackage ./gcc/2.nix {
+      bash = bash_2_05;
+      gcc = gcc2-mes;
+      binutils = binutils-mes;
+      glibc = glibc22;
+    };
+    gcc2-mes = callPackage ./gcc/2.nix {
+      bash = bash_2_05;
+      tinycc = tinycc-mes;
+      binutils = binutils-mes;
+      mesBootstrap = true;
+    };
+
+    inherit (callPackage ./glibc {
+      bash = bash_2_05;
+      gnused = gnused-mes;
+    }) glibc22;
+
     gnugrep = callPackage ./gnugrep {
       bash = bash_2_05;
       tinycc = tinycc-mes;
@@ -38,17 +89,26 @@ lib.makeScope
 
     gnused = callPackage ./gnused {
       bash = bash_2_05;
+      gcc = gcc2;
+      glibc = glibc22;
+      gnused = gnused-mes;
+    };
+    gnused-mes = callPackage ./gnused {
+      bash = bash_2_05;
       tinycc = tinycc-mes;
+      mesBootstrap = true;
     };
 
     gnutar = callPackage ./gnutar {
       bash = bash_2_05;
       tinycc = tinycc-mes;
+      gnused = gnused-mes;
     };
 
     gzip = callPackage ./gzip {
       bash = bash_2_05;
       tinycc = tinycc-mes;
+      gnused = gnused-mes;
     };
 
     heirloom = callPackage ./heirloom {
@@ -58,6 +118,8 @@ lib.makeScope
 
     heirloom-devtools = callPackage ./heirloom-devtools { tinycc = tinycc-mes; };
 
+    linux-headers = callPackage ./linux-headers { bash = bash_2_05; };
+
     ln-boot = callPackage ./ln-boot { };
 
     mes = lib.recurseIntoAttrs (callPackage ./mes { });
@@ -70,19 +132,34 @@ lib.makeScope
     tinycc-bootstrappable = lib.recurseIntoAttrs (callPackage ./tinycc/bootstrappable.nix { });
     tinycc-mes = lib.recurseIntoAttrs (callPackage ./tinycc/mes.nix { });
 
+    xz = callPackage ./xz {
+      bash = bash_2_05;
+      tinycc = tinycc-mes;
+      inherit (heirloom) sed;
+    };
+
     inherit (callPackage ./utils.nix { }) derivationWithMeta writeTextFile writeText;
 
     test = kaem.runCommand "minimal-bootstrap-test" {} ''
+      echo ${bash.tests.get-version}
       echo ${bash_2_05.tests.get-version}
+      echo ${binutils.tests.get-version}
+      echo ${binutils-mes.tests.get-version}
       echo ${bzip2.tests.get-version}
+      echo ${diffutils.tests.get-version}
+      echo ${findutils.tests.get-version}
       echo ${gawk.tests.get-version}
+      echo ${gcc2.tests.get-version}
+      echo ${gcc2-mes.tests.get-version}
       echo ${gnugrep.tests.get-version}
       echo ${gnused.tests.get-version}
+      echo ${gnused-mes.tests.get-version}
       echo ${gnutar.tests.get-version}
       echo ${gzip.tests.get-version}
       echo ${heirloom.tests.get-version}
       echo ${mes.compiler.tests.get-version}
       echo ${tinycc-mes.compiler.tests.chain}
+      echo ${xz.tests.get-version}
       mkdir ''${out}
     '';
   })
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/diffutils/default.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/diffutils/default.nix
new file mode 100644
index 000000000000..7545a52524a3
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/diffutils/default.nix
@@ -0,0 +1,72 @@
+{ lib
+, buildPlatform
+, hostPlatform
+, fetchurl
+, bash
+, gcc
+, glibc
+, binutils
+, linux-headers
+, gnumake
+, gnugrep
+, gnused
+, gawk
+, gnutar
+, gzip
+}:
+let
+  pname = "diffutils";
+  version = "2.8.1";
+
+  src = fetchurl {
+    url = "mirror://gnu/diffutils/diffutils-${version}.tar.gz";
+    sha256 = "0nizs9r76aiymzasmj1jngl7s71jfzl9xfziigcls8k9n141f065";
+  };
+in
+bash.runCommand "${pname}-${version}" {
+  inherit pname version;
+
+  nativeBuildInputs = [
+    gcc
+    binutils
+    gnumake
+    gnused
+    gnugrep
+    gawk
+    gnutar
+    gzip
+  ];
+
+  passthru.tests.get-version = result:
+    bash.runCommand "${pname}-get-version-${version}" {} ''
+      ${result}/bin/diff --version
+      mkdir $out
+    '';
+
+  meta = with lib; {
+    description = "Commands for showing the differences between files (diff, cmp, etc.)";
+    homepage = "https://www.gnu.org/software/diffutils/diffutils.html";
+    license = licenses.gpl3Only;
+    maintainers = teams.minimal-bootstrap.members;
+    platforms = platforms.unix;
+  };
+} ''
+  # Unpack
+  tar xzf ${src}
+  cd diffutils-${version}
+
+  # Configure
+  export C_INCLUDE_PATH="${glibc}/include:${linux-headers}/include"
+  export LIBRARY_PATH="${glibc}/lib"
+  export LIBS="-lc -lnss_files -lnss_dns -lresolv"
+  bash ./configure \
+    --prefix=$out \
+    --build=${buildPlatform.config} \
+    --host=${hostPlatform.config}
+
+  # Build
+  make
+
+  # Install
+  make install
+''
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/findutils/default.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/findutils/default.nix
new file mode 100644
index 000000000000..cf26abd21383
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/findutils/default.nix
@@ -0,0 +1,72 @@
+{ lib
+, buildPlatform
+, hostPlatform
+, fetchurl
+, bash
+, gcc
+, glibc
+, binutils
+, linux-headers
+, gnumake
+, gnugrep
+, gnused
+, gawk
+, gnutar
+, gzip
+}:
+let
+  pname = "findutils";
+  version = "4.4.2";
+
+  src = fetchurl {
+    url = "mirror://gnu/findutils/findutils-${version}.tar.gz";
+    sha256 = "0amn0bbwqvsvvsh6drfwz20ydc2czk374lzw5kksbh6bf78k4ks3";
+  };
+in
+bash.runCommand "${pname}-${version}" {
+  inherit pname version;
+
+  nativeBuildInputs = [
+    gcc
+    binutils
+    gnumake
+    gnused
+    gnugrep
+    gawk
+    gnutar
+    gzip
+  ];
+
+  passthru.tests.get-version = result:
+    bash.runCommand "${pname}-get-version-${version}" {} ''
+      ${result}/bin/find --version
+      mkdir $out
+    '';
+
+  meta = with lib; {
+    description = "GNU Find Utilities, the basic directory searching utilities of the GNU operating system";
+    homepage = "https://www.gnu.org/software/findutils";
+    license = licenses.gpl3Plus;
+    maintainers = teams.minimal-bootstrap.members;
+    platforms = platforms.unix;
+  };
+} ''
+  # Unpack
+  tar xzf ${src}
+  cd findutils-${version}
+
+  # Configure
+  export C_INCLUDE_PATH="${glibc}/include:${linux-headers}/include"
+  export LIBRARY_PATH="${glibc}/lib"
+  export LIBS="-lc -lnss_files -lnss_dns -lresolv"
+  bash ./configure \
+    --prefix=$out \
+    --build=${buildPlatform.config} \
+    --host=${hostPlatform.config}
+
+  # Build
+  make
+
+  # Install
+  make install
+''
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gcc/2.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gcc/2.nix
new file mode 100644
index 000000000000..c879fd30aaf6
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gcc/2.nix
@@ -0,0 +1,140 @@
+{ lib
+, buildPlatform
+, hostPlatform
+, fetchurl
+, bash
+, gnumake
+, gnupatch
+, gnugrep
+, gnutar
+, gzip
+, heirloom
+, binutils
+, mesBootstrap ? false, tinycc ? null, mes-libc
+, gcc ? null, glibc ? null, linux-headers
+}:
+assert mesBootstrap -> tinycc != null;
+assert !mesBootstrap -> gcc != null && glibc != null;
+let
+  # Gcc-2.95.3 is the most recent GCC that is supported by what the Mes C
+  # Library v0.16 offers.  Gcc-3.x (and 4.x) place higher demands on a C
+  # library, such as dir.h/struct DIR/readdir, locales, signals...  Also,
+  # with gcc-2.95.3, binutils (2.14.0, 2.20.1a) and glibc-2.2.5 we found a
+  # GNU toolchain triplet "that works".
+  #   - from guix/gnu/packages/commencement.scm
+  pname = "gcc" + lib.optionalString mesBootstrap "-mes";
+  version = "2.95.3";
+
+  src = fetchurl {
+    url = "mirror://gnu/gcc/gcc-${version}/gcc-core-${version}.tar.gz";
+    sha256 = "1xvfy4pqhrd5v2cv8lzf63iqg92k09g6z9n2ah6ndd4h17k1x0an";
+  };
+
+  patches = [
+    # This patch enables building gcc-2.95.3 using TCC and Mes C Library.
+    #   * Disable building DOC
+    #   * Avoid running `fixproto'.
+    #   * Force running `fixinc'.
+    #   * Replace Makefile trickery of creating an libgcc1.a archive, then
+    #     extracting the .o files later to create a new libgcc2.a archive.
+    #     Instead, keep temporary .o files.
+    (fetchurl {
+      url = "https://git.savannah.gnu.org/cgit/guix.git/plain/gnu/packages/patches/gcc-boot-2.95.3.patch?id=50249cab3a98839ade2433456fe618acc6f804a5";
+      sha256 = "03l3jaxch6d76mx4zkn6ky64paj58jk0biddck01qd4bnw9z8hiw";
+    })
+  ];
+
+  makeFlags = [
+    "LANGUAGES=c"
+  ] ++ lib.optionals mesBootstrap [
+    "LIBGCC2_INCLUDES=\"-I ${mes-libc}/include\""
+    "BOOT_LDFLAGS=\" -B ${tinycc.libs}/lib\""
+  ] ++ lib.optionals (!mesBootstrap) [
+    "LIBGCC2_INCLUDES=\"-I ${glibc}/include -I ${linux-headers}/include\""
+  ];
+in
+bash.runCommand "${pname}-${version}" {
+  inherit pname version;
+
+  nativeBuildInputs = [
+    (if mesBootstrap then tinycc.compiler else gcc)
+    gnumake
+    gnupatch
+    gnugrep
+    gnutar
+    gzip
+    heirloom.sed
+    binutils
+  ];
+
+  passthru.tests.get-version = result:
+    bash.runCommand "${pname}-get-version-${version}" {} ''
+      ${result}/bin/gcc --version
+      mkdir $out
+    '';
+
+  meta = with lib; {
+    description = "GNU Compiler Collection, version ${version}";
+    homepage = "https://gcc.gnu.org";
+    license = licenses.gpl3Plus;
+    maintainers = teams.minimal-bootstrap.members;
+    platforms = platforms.unix;
+  };
+} ''
+  # Unpack
+  tar xzf ${src}
+  cd gcc-${version}
+
+  # Patch
+  ${lib.concatMapStringsSep "\n" (f: "patch -Np1 -i ${f}") patches}
+  # /build/glibc-2.2.5/intl/loadmsgcat.c:334: multiple definition of `_nl_load_domain'
+  # ../intl/libintl.a(loadmsgcat.o):/build/gcc-2.95.3/texinfo/intl/loadmsgcat.c:66: first defined here
+  rm -R texinfo
+  mkdir -p texinfo
+  echo 'all:'>texinfo/Makefile.in
+  echo 'install:'>>texinfo/Makefile.in
+
+  # Configure
+  ${if mesBootstrap then ''
+    export CC="tcc -B ${tinycc.libs}/lib -D __GLIBC_MINOR__=6"
+    export CPP="tcc -E"
+    export ac_cv_func_setlocale=no
+  '' else ''
+    export CC="gcc -I${glibc}/include -I${linux-headers}/include -I${gcc}/lib/gcc-lib/${hostPlatform.config}/${version}/include"
+    export CPP="gcc -E -I${glibc}/include -I${linux-headers}/include -I${gcc}/lib/gcc-lib/${hostPlatform.config}/${version}/include"
+    export LIBRARY_PATH="${glibc}/lib"
+    export LIBS="-lc -lnss_files -lnss_dns -lresolv"
+  ''}
+  export OLDCC="$CC"
+  export CC_FOR_BUILD="$CC"
+  export AR=ar
+  export RANLIB=ranlib
+  export ac_cv_c_float_format='IEEE (little-endian)'
+  bash ./configure \
+    --build=${buildPlatform.config} \
+    --host=${hostPlatform.config} \
+    --enable-static \
+    --disable-shared \
+    --disable-werror \
+    --prefix=$out
+  # no info at this stage
+  touch gcc/cpp.info gcc/gcc.info
+
+  # Build
+  make ${lib.concatStringsSep " " makeFlags}
+
+  # Install
+  make install
+  mkdir tmp
+  cd tmp
+  ar x ../gcc/libgcc2.a
+  ${lib.optionalString mesBootstrap "ar x ${tinycc.libs}/lib/libtcc1.a"}
+  ar r $out/lib/gcc-lib/${hostPlatform.config}/${version}/libgcc.a *.o
+  cd ..
+  cp gcc/libgcc2.a $out/lib/libgcc2.a
+  ${lib.optionalString mesBootstrap ''
+    ar x ${tinycc.libs}/lib/libtcc1.a
+    ar x ${tinycc.libs}/lib/libc.a
+    ar r $out/lib/gcc-lib/${hostPlatform.config}/${version}/libc.a libc.o libtcc1.o
+  ''}
+''
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/glibc/default.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/glibc/default.nix
new file mode 100644
index 000000000000..5c4ff386add5
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/glibc/default.nix
@@ -0,0 +1,121 @@
+{ lib
+, buildPlatform
+, hostPlatform
+, fetchurl
+, bash
+, gcc2-mes
+, gnumake
+, gnupatch
+, gnused
+, gnugrep
+, gnutar
+, gzip
+, gawk
+, heirloom
+, binutils-mes
+, linux-headers
+}:
+let
+  pname = "glibc";
+
+  buildGlibc = { version, src, patches, configureFlags, gcc, binutils, CC, CPP }:
+    bash.runCommand "${pname}-${version}" {
+      inherit pname version;
+
+      nativeBuildInputs = [
+        gcc
+        gnumake
+        gnupatch
+        gnused
+        gnugrep
+        gnutar
+        gzip
+        gawk
+        binutils
+      ];
+
+      meta = with lib; {
+        description = "The GNU C Library";
+        homepage = "https://www.gnu.org/software/libc";
+        license = licenses.lgpl2Plus;
+        maintainers = teams.minimal-bootstrap.members;
+        platforms = platforms.linux;
+      };
+    } ''
+      # Unpack
+      tar xzf ${src}
+      cd glibc-${version}
+
+      # Patch
+      ${lib.concatMapStringsSep "\n" (f: "patch -Np1 -i ${f}") patches}
+
+      # Configure
+      export CC="${CC}"
+      export CPP="${CPP}"
+      bash ./configure --prefix=$out ${lib.concatStringsSep " " (
+        [
+          "--build=${buildPlatform.config}"
+          "--host=${hostPlatform.config}"
+          "--with-headers=${linux-headers}/include"
+          "--enable-static"
+          "--disable-shared"
+        ] ++ configureFlags)}
+
+      # Build
+      make
+
+      # Install
+      # GNU sed w/ mes-libc crashes on certain stdio actions
+      export PATH="${heirloom.sed}/bin:$PATH"
+      make install
+    '';
+in
+{
+  glibc22 = buildGlibc rec {
+    # GNU C Library 2.2.5 is the most recent glibc that we managed to build
+    # using gcc-2.95.3.  Newer versions (2.3.x, 2.6, 2.1x) seem to need a newer
+    # gcc.
+    #   - from guix/gnu/packages/commencement.scm
+    version = "2.2.5";
+    src = fetchurl {
+      url = "mirror://gnu/glibc/glibc-${version}.tar.gz";
+      sha256 = "1vl48i16gx6h68whjyhgnn1s57vqq32f9ygfa2fls7pdkbsqvp2q";
+    };
+
+    patches = [
+      # This patch enables building glibc-2.2.5 using TCC and GNU Make 4.x and Mes C Library.
+      #   * Makefile: Do not assemble from stdin, use file indirection.
+      #   * Makefile: Add new target: install-lib-all.
+      #   * Makefile: Avoid building stub DOC.
+      #   * [_LIBC_REENTRANT]: Add missing guarding.
+      #   * [MES_BOOTSTRAP]: Disable some GCC extensions.
+      #   * [MES_BOOTSTRAP]: Add missing GCC div/mod defines.
+      (fetchurl {
+        url = "https://git.savannah.gnu.org/cgit/guix.git/plain/gnu/packages/patches/glibc-boot-${version}.patch?id=50249cab3a98839ade2433456fe618acc6f804a5";
+        sha256 = "1nyz2dr9g7scqwwygd6jvbl7xxpwh11ryvgdz8aikkkna02q1pm8";
+      })
+      # We want to allow builds in chroots that lack /bin/sh.  Thus, system(3)
+      # and popen(3) need to be tweaked to use the right shell.  For the bootstrap
+      # glibc, we just use whatever `sh' can be found in $PATH.  The final glibc
+      # instead uses the hard-coded absolute file name of `bash'.
+      (fetchurl {
+        url = "https://git.savannah.gnu.org/cgit/guix.git/plain/gnu/packages/patches/glibc-bootstrap-system-${version}.patch?id=50249cab3a98839ade2433456fe618acc6f804a5";
+        sha256 = "1l67w9rysrlsg2i0r210qxxn37h2969ba9lx7pp3ywlnikvi98m8";
+      })
+    ];
+
+    configureFlags = [
+      "--disable-sanity-checks"
+      "--enable-static-nss"
+      "--without-__thread"
+      "--without-cvs"
+      "--without-gd"
+      "--without-tls"
+    ];
+
+    gcc = gcc2-mes;
+    binutils = binutils-mes;
+    CC = "gcc -D MES_BOOTSTRAP=1 -D BOOTSTRAP_GLIBC=1 -L $(pwd)";
+    CPP = "gcc -E -D MES_BOOTSTRAP=1 -D BOOTSTRAP_GLIBC=1";
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gnused/default.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gnused/default.nix
index b6b1f9f198c7..b5647b96ee3c 100644
--- a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gnused/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gnused/default.nix
@@ -1,11 +1,16 @@
 { lib
+, buildPlatform
+, hostPlatform
 , fetchurl
 , bash
-, tinycc
 , gnumake
+, mesBootstrap ? false, tinycc ? null
+, gcc ? null, glibc ? null, binutils ? null, gnused ? null, linux-headers, gnugrep
 }:
+assert mesBootstrap -> tinycc != null;
+assert !mesBootstrap -> gcc != null && glibc != null && binutils != null && gnused != null;
 let
-  pname = "gnused";
+  pname = "gnused" + lib.optionalString mesBootstrap "-mes";
   # last version that can be compiled with mes-libc
   version = "4.0.9";
 
@@ -25,8 +30,15 @@ bash.runCommand "${pname}-${version}" {
   inherit pname version;
 
   nativeBuildInputs = [
-    tinycc.compiler
     gnumake
+  ] ++ lib.optionals mesBootstrap [
+    tinycc.compiler
+  ] ++ lib.optionals (!mesBootstrap) [
+    gcc
+    glibc
+    binutils
+    gnused
+    gnugrep
   ];
 
   passthru.tests.get-version = result:
@@ -43,13 +55,14 @@ bash.runCommand "${pname}-${version}" {
     mainProgram = "sed";
     platforms = platforms.unix;
   };
-} ''
+} (''
   # Unpack
   ungz --file ${src} --output sed.tar
   untar --file sed.tar
   rm sed.tar
   cd sed-${version}
 
+'' + lib.optionalString mesBootstrap ''
   # Configure
   cp ${makefile} Makefile
   catm config.h
@@ -59,6 +72,25 @@ bash.runCommand "${pname}-${version}" {
     CC="tcc -B ${tinycc.libs}/lib" \
     LIBC=mes
 
+'' + lib.optionalString (!mesBootstrap) ''
+  # Configure
+  export CC="gcc -I${glibc}/include -I${linux-headers}/include"
+  export LIBRARY_PATH="${glibc}/lib"
+  export LIBS="-lc -lnss_files -lnss_dns -lresolv"
+  chmod +x configure
+  ./configure \
+    --build=${buildPlatform.config} \
+    --host=${hostPlatform.config} \
+    --disable-shared \
+    --disable-nls \
+    --disable-dependency-tracking \
+    --without-included-regex \
+    --prefix=$out
+
+  # Build
+  make
+
+'' + ''
   # Install
   make install PREFIX=$out
-''
+'')
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/linux-headers/default.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/linux-headers/default.nix
new file mode 100644
index 000000000000..6addd11554d0
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/linux-headers/default.nix
@@ -0,0 +1,49 @@
+{ lib
+, fetchurl
+, bash
+, gnutar
+, xz
+}:
+let
+  # WARNING: You probably don't want to use this package outside minimal-bootstrap
+  #
+  # We need some set of Linux kernel headers to build our bootstrap packages
+  # (gcc/binutils/glibc etc.) against. As long as it compiles it is "good enough".
+  # Therefore the requirement for correctness, completeness, platform-specific
+  # features, and being up-to-date, are very loose.
+  #
+  # Rebuilding the Linux headers from source correctly is something we can defer
+  # till we have access to gcc/binutils/perl. For now we can use Guix's assembled
+  # kernel header distribution and assume it's good enough.
+  pname = "linux-headers";
+  version = "4.14.67";
+
+  src = fetchurl {
+    url = "mirror://gnu/gnu/guix/bootstrap/i686-linux/20190815/linux-libre-headers-stripped-4.14.67-i686-linux.tar.xz";
+    sha256 = "0sm2z9x4wk45bh6qfs94p0w1d6hsy6dqx9sw38qsqbvxwa1qzk8s";
+  };
+in
+bash.runCommand "${pname}-${version}" {
+  inherit pname version;
+
+  nativeBuildInputs = [
+    gnutar
+    xz
+  ];
+
+  meta = with lib; {
+    description = "Header files and scripts for Linux kernel";
+    license = licenses.gpl2;
+    maintainers = teams.minimal-bootstrap.members;
+    platforms = platforms.linux;
+  };
+} ''
+  # Unpack
+  cp ${src} linux-headers.tar.xz
+  unxz linux-headers.tar.xz
+  tar xf linux-headers.tar
+
+  # Install
+  mkdir $out
+  cp -r include $out
+''
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/bootstrap-sources.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/bootstrap-sources.nix
index f06db98a8efe..82ee4d12386e 100644
--- a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/bootstrap-sources.nix
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/bootstrap-sources.nix
@@ -1,13 +1,15 @@
+{
+}:
+
 rec {
   name = "stage0-posix-${version}-${rev}-source";
   # Pinned from https://github.com/oriansj/stage0-posix/commit/3189b5f325b7ef8b88e3edec7c1cde4fce73c76c
   version = "unstable-2023-05-02";
   rev = "3189b5f325b7ef8b88e3edec7c1cde4fce73c76c";
+  outputHashAlgo = "sha256";
+  outputHash = "sha256-FpMp7z+B3cR3LkQ+PooH/b1/NlxH8NHVJNWifaPWt4U=";
 
   # This 256 byte seed is the only pre-compiled binary in the bootstrap chain.
-  # While it is included in the stage0-posix source bundle and is synced with
-  # stage0-posix updates, we have split it out into its own derivation to highlight
-  # its unique status as a trusted binary seed.
   hex0-seed = import <nix/fetchurl.nix> {
     name = "hex0-seed-${version}";
     url = "https://github.com/oriansj/bootstrap-seeds/raw/b1263ff14a17835f4d12539226208c426ced4fba/POSIX/x86/hex0-seed";
@@ -15,20 +17,89 @@ rec {
     executable = true;
   };
 
-  # Packaged resources required for the first bootstrapping stage.
-  # Contains source code and 256-byte hex0 binary seed.
-  #
-  # We don't have access to utilities such as fetchgit and fetchzip since this
-  # is this is part of the bootstrap process and would introduce a circular
-  # dependency. The only tool we have to fetch source trees is `import <nix/fetchurl.nix>`
-  # with the unpack option, taking a NAR file as input. This requires source
-  # tarballs to be repackaged.
-  #
-  # To build see `make-bootstrap-sources.nix`
-  src = import <nix/fetchurl.nix> {
+  /*
+  Since `make-minimal-bootstrap-sources` requires nixpkgs and nix it
+  will create a circular dependency if it is used in place of the
+  binary bootstrap-files.  To break the circular dependency,
+  `minimal-bootstrap-sources` extends `make-minimal-bootstrap-sources`
+  by adding Fixed Output Derivation (FOD) attributes.  These cause
+  the builder to be skipped if the expected output is found (by
+  its hash) in the store or on a substituter.
+
+  # How do I update the hash?
+
+  Run the following command:
+  ```
+  nix hash path $(nix build --print-out-paths -f '<nixpkgs>' make-minimal-bootstrap-sources)
+  ```
+
+  # Why do we need this `.nar` archive?
+
+  This archive exists only because of a quirk/limitation of Nix: in
+  restricted mode the builtin fetchers can download only single
+  files; they have no way to unpack multi-file archives except for
+  NAR archives:
+
+  https://github.com/NixOS/nixpkgs/pull/232576#issuecomment-1592415619
+
+  # Why don't we have to upload this to tarballs.nixos.org like the binary bootstrap-files did?
+
+  Unlike this archive, the binary bootstrap-files contained binaries,
+  which meant that we had to:
+
+  1. Make sure they came from a trusted builder (Hydra)
+  2. Keep careful track of exactly what toolchain (i.e. nixpkgs
+     commit) that builder used to create them.
+  3. Keep copies of the built binaries, in case the toolchains that
+     produced them failed to be perfectly deterministic.
+
+  The curated archives at tarballs.nixos.org exist in order to
+  satisfy these requirements.
+
+  The second point created a significant burden: since the nixpkgs
+  toolchain used to build a given copy of the binary bootstrap-files
+  itself used a *previous* copy of the bootstrap-files, this meant
+  we had to track the provenance of all bootstrap-files tarballs
+  ever used, for all eternity.  There was no explanation of where
+  the "original" bootstrap-files came from: turtles all the way
+  down.  In spite of all this effort we still can't be sure of our
+  ability to reproduce the binary bootstrap-files, since the
+  compilers that built them don't always produce exactly bit-for-bit
+  deterministic results.
+
+  Since this archive contains no binaries and uses a format (NAR)
+  specifically designed for bit-exact reproducibility, none of the
+  requirements above apply to `minimal-bootstrap-sources`.
+  */
+  minimal-bootstrap-sources = derivation {
     inherit name;
-    url = "https://github.com/emilytrau/bootstrap-tools-nar-mirror/releases/download/2023-05-02/${name}.nar.xz";
-    hash = "sha256-ZRG0k49MxL1UTZhuMTvPoEprdSpJRNVy8QhLE6k+etg=";
-    unpack = true;
+    system = builtins.currentSystem;
+    outputHashMode = "recursive";
+    inherit outputHashAlgo outputHash;
+
+    # This builder always fails, but fortunately Nix will print the
+    # "builder", which is really the error message that we want the
+    # user to see.
+    builder = ''
+      #
+      #
+      # Neither your store nor your substituters seems to have:
+      #
+      #  ${builtins.placeholder "out"}
+      #
+      # You can create this path from an already-bootstrapped nixpkgs
+      # using the following command:
+      #
+      #   nix-build '<nixpkgs>' -A make-minimal-bootstrap-sources
+      #
+      # Or, if you prefer, you can create this file using only `git`,
+      # `nix`, and `xz`.  For the commands needed in order to do this,
+      # see `make-bootstrap-sources.nix`.  Once you have the manual
+      # result, do:
+      #
+      #   nix-store --add-fixed --recursive ${outputHashAlgo} ./${name}
+      #
+      # to add it to your store.
+    '';
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/default.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/default.nix
index 2b41261add3a..c15223a43d48 100644
--- a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/default.nix
@@ -3,7 +3,10 @@
 }:
 
 lib.makeScope newScope (self: with self; {
-  inherit (import ./bootstrap-sources.nix) version hex0-seed src;
+  inherit (self.callPackage ./bootstrap-sources.nix {})
+    version hex0-seed minimal-bootstrap-sources;
+
+  src = minimal-bootstrap-sources;
 
   m2libc = src + "/M2libc";
 
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/hex0.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/hex0.nix
index 43859b966add..b85b2f2cac14 100644
--- a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/hex0.nix
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/hex0.nix
@@ -9,7 +9,7 @@ derivationWithMeta {
   pname = "hex0";
   builder = hex0-seed;
   args = [
-    "${src}/bootstrap-seeds/POSIX/x86/hex0_x86.hex0"
+    "${src}/x86/hex0_x86.hex0"
     (placeholder "out")
   ];
 
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/kaem/minimal.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/kaem/minimal.nix
index e85efbbb0243..24fc77f8d345 100644
--- a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/kaem/minimal.nix
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/kaem/minimal.nix
@@ -9,7 +9,7 @@ derivationWithMeta {
   pname = "kaem-minimal";
   builder = hex0;
   args = [
-    "${src}/bootstrap-seeds/POSIX/x86/kaem-minimal.hex0"
+    "${src}/x86/kaem-minimal.hex0"
     (placeholder "out")
   ];
 
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/make-bootstrap-sources.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/make-bootstrap-sources.nix
index fec03f370bc3..2675d055aec6 100644
--- a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/make-bootstrap-sources.nix
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/make-bootstrap-sources.nix
@@ -1,5 +1,4 @@
-# Packaged resources required for the first bootstrapping stage.
-# Contains source code and 256-byte hex0 binary seed.
+# Packaged source files for the first bootstrapping stage.
 #
 # We don't have access to utilities such as fetchgit and fetchzip since this
 # is this is part of the bootstrap process and would introduce a circular
@@ -9,38 +8,42 @@
 #
 # To build:
 #
-#   nix-build pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/make-bootstrap-sources.nix
-#   => ./result/stage0-posix-$version-$rev-source.nar.xz
+#   nix-build '<nixpkgs>' -A make-minimal-bootstrap-sources
 #
 
-{ pkgs ? import ../../../../.. {} }:
+{ lib
+, fetchFromGitHub
+}:
+
 let
-  inherit (pkgs) callPackage runCommand fetchFromGitHub nix xz;
+  expected = import ./bootstrap-sources.nix { };
+in
 
-  inherit (import ./bootstrap-sources.nix) name rev;
+fetchFromGitHub {
+  inherit (expected) name rev;
+  owner = "oriansj";
+  repo = "stage0-posix";
+  sha256 = expected.outputHash;
+  fetchSubmodules = true;
+  postFetch = ''
+    # Seed binaries will be fetched separately
+    echo "Removing seed binaries"
+    rm -rf $out/bootstrap-seeds/*
 
-  src = fetchFromGitHub {
-    owner = "oriansj";
-    repo = "stage0-posix";
-    inherit rev;
-    sha256 = "sha256-ZRG0k49MxL1UTZhuMTvPoEprdSpJRNVy8QhLE6k+etg=";
-    fetchSubmodules = true;
-    postFetch = ''
-      # Remove vendored/duplicate M2libc's
-      echo "Removing duplicate M2libc"
-      rm -rf \
-        $out/M2-Mesoplanet/M2libc \
-        $out/M2-Planet/M2libc \
-        $out/mescc-tools/M2libc \
-        $out/mescc-tools-extra/M2libc
-    '';
-  };
-in
-runCommand name {
-  nativeBuildInputs = [ nix xz ];
+    # Remove vendored/duplicate M2libc's
+    echo "Removing duplicate M2libc"
+    rm -rf \
+      $out/M2-Mesoplanet/M2libc \
+      $out/M2-Planet/M2libc \
+      $out/mescc-tools/M2libc \
+      $out/mescc-tools-extra/M2libc
+  '';
 
-  passthru = { inherit src; };
-} ''
-  mkdir $out
-  nix-store --dump ${src} | xz -c > "$out/${name}.nar.xz"
-''
+  meta = with lib; {
+    description = "Packaged sources for the first bootstrapping stage";
+    homepage = "https://github.com/oriansj/stage0-posix";
+    license = licenses.gpl3Plus;
+    maintainers = teams.minimal-bootstrap.members;
+    platforms = platforms.all;
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/utils.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/utils.nix
index bba6edae973a..cc8c04619169 100644
--- a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/utils.nix
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/utils.nix
@@ -29,11 +29,9 @@ rec {
     , text
     , executable ? false # run chmod +x ?
     , destination ? ""   # relative path appended to $out eg "/bin/foo"
-    , allowSubstitutes ? false
-    , preferLocalBuild ? true
     }:
     derivationWithMeta {
-      inherit name text allowSubstitutes preferLocalBuild;
+      inherit name text;
       passAsFile = [ "text" ];
 
       builder = "${kaem}/bin/kaem";
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/xz/default.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/xz/default.nix
new file mode 100644
index 000000000000..92cb240c5f16
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/xz/default.nix
@@ -0,0 +1,78 @@
+{ lib
+, buildPlatform
+, hostPlatform
+, fetchurl
+, bash
+, tinycc
+, gnumake
+, gnugrep
+, gawk
+, sed
+}:
+let
+  pname = "xz";
+  # >=5.2 uses poll.h, unsupported by meslibc
+  version = "5.0.8";
+
+  src = fetchurl {
+    url = "https://tukaani.org/xz/xz-${version}.tar.bz2";
+    sha256 = "1nkb68dyrf16xwyqichcy1vhgbfg20dxz459rcsdx85h1gczk1i2";
+  };
+in
+bash.runCommand "${pname}-${version}" {
+  inherit pname version;
+
+  nativeBuildInputs = [
+    tinycc.compiler
+    gnumake
+    gnugrep
+    gawk
+    sed
+  ];
+
+  passthru.tests.get-version = result:
+    bash.runCommand "${pname}-get-version-${version}" {} ''
+      ${result}/bin/xz --version
+      mkdir $out
+    '';
+
+  meta = with lib; {
+    description = "A general-purpose data compression software, successor of LZMA";
+    homepage = "https://tukaani.org/xz";
+    license = with licenses; [ gpl2Plus lgpl21Plus ];
+    maintainers = teams.minimal-bootstrap.members;
+    platforms = platforms.unix;
+  };
+} ''
+  # Unpack
+  unbz2 --file ${src} --output xz.tar
+  untar --file xz.tar
+  rm xz.tar
+  cd xz-${version}
+
+  # Configure
+  export CC="tcc -B ${tinycc.libs}/lib -include${./stubs.h}"
+  export CPP="tcc -E"
+  export LD=tcc
+  export AR="tcc -ar"
+  export SED=sed
+  export ac_cv_prog_cc_c99=
+  export ac_cv_header_fcntl_h=yes
+  export ac_cv_header_limits_h=yes
+  export ac_cv_header_sys_time_h=yes
+  export ac_cv_func_utime=no
+  bash ./configure \
+    --prefix=$out \
+    --build=${buildPlatform.config} \
+    --host=${hostPlatform.config} \
+    --disable-shared \
+    --disable-nls \
+    --disable-threads \
+    --disable-assembler
+
+  # Build
+  make all
+
+  # Install
+  make install
+''
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/xz/stubs.h b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/xz/stubs.h
new file mode 100644
index 000000000000..cbf6f823299e
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/xz/stubs.h
@@ -0,0 +1,25 @@
+#define sig_atomic_t int
+
+#define SSIZE_MAX LONG_MAX
+
+#define O_NOCTTY 0400
+#define O_NONBLOCK 04000
+
+#define S_ISVTX 01000
+#define S_ISLNK(mode) (((mode) & S_IFMT) == S_IFLNK)
+
+int fchmod (int fd, int mode)
+{
+  return 0;
+}
+
+int fchown (int fd, int owner, int group)
+{
+  return 0;
+}
+
+#include <signal.h>
+int sigfillset (sigset_t * set)
+{
+  return 0;
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/mmc-utils/default.nix b/nixpkgs/pkgs/os-specific/linux/mmc-utils/default.nix
index ee172f81f6df..9580301eae9f 100644
--- a/nixpkgs/pkgs/os-specific/linux/mmc-utils/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/mmc-utils/default.nix
@@ -2,16 +2,19 @@
 
 stdenv.mkDerivation {
   pname = "mmc-utils";
-  version = "unstable-2023-04-17";
+  version = "unstable-2023-06-12";
 
   src = fetchzip rec {
     url = "https://git.kernel.org/pub/scm/utils/mmc/mmc-utils.git/snapshot/mmc-utils-${passthru.rev}.tar.gz";
-    passthru.rev = "145c74ab6f2e13a9a8ccdbbf1758afedb8a3965c";
-    sha256 = "cYLIO83uZHDe1COKtSN0SyFOoC3qrqMP0RNsOO9cQ70=";
+    passthru.rev = "6d593efc3cd00e4debd0ffc5806246390dc66242";
+    sha256 = "QOrU47cTPnvJHM40Bjq51VSSinmRnXCimk1h5mt4vNw=";
   };
 
   makeFlags = [ "CC=${stdenv.cc.targetPrefix}cc" "prefix=$(out)" ];
 
+  # causes redefinition of _FORTIFY_SOURCE
+  hardeningDisable = [ "fortify3" ];
+
   postInstall = ''
     mkdir -p $out/share/man/man1
     cp man/mmc.1 $out/share/man/man1/
diff --git a/nixpkgs/pkgs/os-specific/linux/musl/default.nix b/nixpkgs/pkgs/os-specific/linux/musl/default.nix
index e0d20c772e0c..9f7867065ea8 100644
--- a/nixpkgs/pkgs/os-specific/linux/musl/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/musl/default.nix
@@ -152,8 +152,8 @@ stdenv.mkDerivation rec {
     platforms   = [
       "aarch64-linux" "armv5tel-linux" "armv6l-linux" "armv7a-linux"
       "armv7l-linux" "i686-linux" "x86_64-linux" "m68k-linux"
-      "microblaze-linux" "microblazeel-linux" "mipsel-linux"
-      "mips64el-linux" "powerpc64-linux" "powerpc64le-linux"
+      "microblaze-linux" "microblazeel-linux" "mips-linux" "mips64-linux"
+      "mipsel-linux" "mips64el-linux" "powerpc64-linux" "powerpc64le-linux"
       "riscv64-linux" "s390x-linux"
     ];
     maintainers = with maintainers; [ thoughtpolice dtzWill ];
diff --git a/nixpkgs/pkgs/os-specific/linux/new-lg4ff/default.nix b/nixpkgs/pkgs/os-specific/linux/new-lg4ff/default.nix
index 26b0f67b6c43..a92ee9ae64b5 100644
--- a/nixpkgs/pkgs/os-specific/linux/new-lg4ff/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/new-lg4ff/default.nix
@@ -7,7 +7,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "berarma";
     repo = "new-lg4ff";
-    rev = "${version}";
+    rev = version;
     sha256 = "ZFwNdeJcSxzWtqjOF86SZpqhuz8jXZ2drvlQeIqsaNY=";
   };
 
diff --git a/nixpkgs/pkgs/os-specific/linux/nftables/default.nix b/nixpkgs/pkgs/os-specific/linux/nftables/default.nix
index 26c7b6a9ea34..f91dc84d2187 100644
--- a/nixpkgs/pkgs/os-specific/linux/nftables/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/nftables/default.nix
@@ -4,17 +4,18 @@
 , gmp, jansson, libedit
 , autoreconfHook
 , withDebugSymbols ? false
-, withPython ? false , python3
-, withXtables ? true , iptables
+, withPython ? false, python3
+, withXtables ? true, iptables
+, nixosTests
 }:
 
 stdenv.mkDerivation rec {
-  version = "1.0.7";
+  version = "1.0.8";
   pname = "nftables";
 
   src = fetchurl {
     url = "https://netfilter.org/projects/nftables/files/${pname}-${version}.tar.xz";
-    hash = "sha256-wSrJQf/5ra7fFzZ9XOITeJuYoNMUJ3vCKz1x4QiR9BI=";
+    hash = "sha256-k3N0DeQagtvJiBjgpGoHP664qNBon6T6GnQ5nDK/PVA=";
   };
 
   nativeBuildInputs = [
@@ -27,7 +28,10 @@ stdenv.mkDerivation rec {
     libmnl libnftnl libpcap
     gmp jansson libedit
   ] ++ lib.optional withXtables iptables
-    ++ lib.optional withPython python3;
+    ++ lib.optionals withPython [
+      python3
+      python3.pkgs.setuptools
+    ];
 
   configureFlags = [
     "--with-json"
@@ -37,6 +41,11 @@ stdenv.mkDerivation rec {
     ++ lib.optional withPython "--enable-python"
     ++ lib.optional withXtables "--with-xtables";
 
+  passthru.tests = {
+    inherit (nixosTests) firewall-nftables lxd-nftables;
+    nat = { inherit (nixosTests.nat.nftables) firewall standalone; };
+  };
+
   meta = with lib; {
     description = "The project that aims to replace the existing {ip,ip6,arp,eb}tables framework";
     homepage = "https://netfilter.org/projects/nftables/";
diff --git a/nixpkgs/pkgs/os-specific/linux/nix-ld/default.nix b/nixpkgs/pkgs/os-specific/linux/nix-ld/default.nix
index 6e0af1217219..84685e77aaea 100644
--- a/nixpkgs/pkgs/os-specific/linux/nix-ld/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/nix-ld/default.nix
@@ -12,13 +12,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "nix-ld";
-  version = "1.1.0";
+  version = "1.2.2";
 
   src = fetchFromGitHub {
     owner = "mic92";
     repo = "nix-ld";
     rev = version;
-    sha256 = "sha256-dM9YPN+yq6sHmRhJQinYdAVXBkTgEtrVQcsd/mIIX0o=";
+    hash = "sha256-+z9t7BLugZO1WhyYEq6FI38TMh2EwfgfAv3RDFSjwtc=";
   };
 
   doCheck = true;
diff --git a/nixpkgs/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh b/nixpkgs/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
index f90da9db3bf8..89871056c482 100755
--- a/nixpkgs/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
+++ b/nixpkgs/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
@@ -17,7 +17,7 @@ showSyntax() {
 
 # Parse the command line.
 origArgs=("$@")
-copyClosureFlags=()
+copyFlags=()
 extraBuildFlags=()
 lockFlags=()
 flakeFlags=(--extra-experimental-features 'nix-command flakes')
@@ -74,10 +74,10 @@ while [ "$#" -gt 0 ]; do
         upgrade=1
         upgrade_all=1
         ;;
-      --use-substitutes|-s)
-        copyClosureFlags+=("$i")
+      --use-substitutes|--substitute-on-destination|-s)
+        copyFlags+=("-s")
         ;;
-      -I|--max-jobs|-j|--cores|--builders)
+      -I|--max-jobs|-j|--cores|--builders|--log-format)
         j="$1"; shift 1
         extraBuildFlags+=("$i" "$j")
         ;;
@@ -192,12 +192,12 @@ copyToTarget() {
     if ! [ "$targetHost" = "$buildHost" ]; then
         if [ -z "$targetHost" ]; then
             logVerbose "Running nix-copy-closure with these NIX_SSHOPTS: $SSHOPTS"
-            NIX_SSHOPTS=$SSHOPTS runCmd nix-copy-closure "${copyClosureFlags[@]}" --from "$buildHost" "$1"
+            NIX_SSHOPTS=$SSHOPTS runCmd nix-copy-closure "${copyFlags[@]}" --from "$buildHost" "$1"
         elif [ -z "$buildHost" ]; then
             logVerbose "Running nix-copy-closure with these NIX_SSHOPTS: $SSHOPTS"
-            NIX_SSHOPTS=$SSHOPTS runCmd nix-copy-closure "${copyClosureFlags[@]}" --to "$targetHost" "$1"
+            NIX_SSHOPTS=$SSHOPTS runCmd nix-copy-closure "${copyFlags[@]}" --to "$targetHost" "$1"
         else
-            buildHostCmd nix-copy-closure "${copyClosureFlags[@]}" --to "$targetHost" "$1"
+            buildHostCmd nix-copy-closure "${copyFlags[@]}" --to "$targetHost" "$1"
         fi
     fi
 }
@@ -292,7 +292,7 @@ nixFlakeBuild() {
         drv="$(runCmd nix "${flakeFlags[@]}" eval --raw "${attr}.drvPath" "${evalArgs[@]}" "${extraBuildFlags[@]}")"
         if [ -a "$drv" ]; then
             logVerbose "Running nix with these NIX_SSHOPTS: $SSHOPTS"
-            NIX_SSHOPTS=$SSHOPTS runCmd nix "${flakeFlags[@]}" copy --derivation --to "ssh://$buildHost" "$drv"
+            NIX_SSHOPTS=$SSHOPTS runCmd nix "${flakeFlags[@]}" copy "${copyFlags[@]}" --derivation --to "ssh://$buildHost" "$drv"
             buildHostCmd nix-store -r "$drv" "${buildArgs[@]}"
         else
             log "nix eval failed"
@@ -480,7 +480,7 @@ if [[ -n $buildNix && -z $flake ]]; then
     if [ -a "$nixDrv" ]; then
         nix-store -r "$nixDrv"'!'"out" --add-root "$tmpDir/nix" --indirect >/dev/null
         if [ -n "$buildHost" ]; then
-            nix-copy-closure "${copyClosureFlags[@]}" --to "$buildHost" "$nixDrv"
+            nix-copy-closure "${copyFlags[@]}" --to "$buildHost" "$nixDrv"
             # The nix build produces multiple outputs, we add them all to the remote path
             for p in $(buildHostCmd nix-store -r "$(readlink "$nixDrv")" "${buildArgs[@]}"); do
                 remoteNix="$remoteNix${remoteNix:+:}$p/bin"
diff --git a/nixpkgs/pkgs/os-specific/linux/nvidia-x11/default.nix b/nixpkgs/pkgs/os-specific/linux/nvidia-x11/default.nix
index 1b47c400395f..8f1ca40aa97c 100644
--- a/nixpkgs/pkgs/os-specific/linux/nvidia-x11/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/nvidia-x11/default.nix
@@ -18,6 +18,8 @@ let
     else a;
 in
 rec {
+  mkDriver = generic;
+
   # Official Unix Drivers - https://www.nvidia.com/en-us/drivers/unix/
   # Branch/Maturity data - http://people.freedesktop.org/~aplattner/nvidia-versions.txt
 
@@ -25,14 +27,12 @@ rec {
   stable = if stdenv.hostPlatform.system == "i686-linux" then legacy_390 else latest;
 
   production = generic {
-    version = "525.116.04";
-    sha256_64bit = "sha256-hhDsgkR8/3LLXxizZX7ppjSlFRZiuK2QHrgfTE+2F/4=";
-    sha256_aarch64 = "sha256-k7k22z5PYZdBVfuYXVcl9SFUMqZmK4qyxoRwlYyRdgU=";
-    openSha256 = "sha256-dktHCoESqoNfu5M73aY5MQGROlZawZwzBqs3RkOyfoQ=";
-    settingsSha256 = "sha256-qNjfsT9NGV151EHnG4fgBonVFSKc4yFEVomtXg9uYD4=";
-    persistencedSha256 = "sha256-ci86XGlno6DbHw6rkVSzBpopaapfJvk0+lHcR4LDq50=";
-
-    ibtSupport = true;
+    version = "535.86.05";
+    sha256_64bit = "sha256-QH3wyjZjLr2Fj8YtpbixJP/DvM7VAzgXusnCcaI69ts=";
+    sha256_aarch64 = "sha256-ON++eWPDWHnm/NuJmDSYkR4sKKvCdX+kwxS7oA2M5zU=";
+    openSha256 = "sha256-qCYEQP54cT7G+VrLmuMT+RWIwuGdBhlbYTrCDcztfNs=";
+    settingsSha256 = "sha256-0NAxQosC+zPz5STpELuRKDMap4KudoPGWKL4QlFWjLQ=";
+    persistencedSha256 = "sha256-Ak4Wf59w9by08QJ0x15Zs5fHOhiIatiJfjBQfnY65Mg=";
   };
 
   latest = selectHighestVersion production (generic {
@@ -65,11 +65,11 @@ rec {
   # Vulkan developer beta driver
   # See here for more information: https://developer.nvidia.com/vulkan-driver
   vulkan_beta = generic rec {
-    version = "525.47.26";
+    version = "525.47.35";
     persistencedVersion = "525.116.04";
     settingsVersion = "525.116.04";
-    sha256_64bit = "sha256-QfxEUTi71Pav1qzO0mObmKbsyg6FHTAyc7jkOj9D4lY=";
-    openSha256 = "sha256-QFpFRPpBXAB7v2+NP/M/1T1qKDqjdhigHkktnVyWw20=";
+    sha256_64bit = "sha256-HnjCHsHHH/fqqyc8dXDx/wQhVkXWoH5Z9jJ+/zQWNFc=";
+    openSha256 = "sha256-/qkCMybr8sC/Da9zi2KbSkLBeQcSbVURnAg1IbjZiBk=";
     settingsSha256 = "sha256-qNjfsT9NGV151EHnG4fgBonVFSKc4yFEVomtXg9uYD4=";
     persistencedSha256 = "sha256-ci86XGlno6DbHw6rkVSzBpopaapfJvk0+lHcR4LDq50=";
     url = "https://developer.nvidia.com/downloads/vulkan-beta-${lib.concatStrings (lib.splitString "." version)}-linux";
@@ -81,23 +81,18 @@ rec {
 
   # Last one supporting Kepler architecture
   legacy_470 = generic {
-    version = "470.182.03";
-    sha256_64bit = "sha256-PbwUCPxIuGXT3azvxF9KP8E7kLg6Yo7lRrAIKrLD/Hk=";
-    sha256_aarch64 = "sha256-FEoWikgQjZKkHvAHgtkxnDhB41GdYplZTttEUBit4QQ=";
-    settingsSha256 = "sha256-TRKQ4brLnCbBZt1smGSIHTfwW+wEFPWWPEwDxjVXN7s=";
-    persistencedSha256 = "sha256-fSJMx49z9trdNxx0iPI45oG57smvvhaqVNxsRnfXKCI=";
+    version = "470.199.02";
+    sha256_64bit = "sha256-/fggDt8RzjLDW0JiGjr4aV4RGnfEKL8MTTQ4tCjXaP0=";
+    sha256_aarch64 = "sha256-UmF7LszdrO2d+bOaoQYrTVKXUwDqzMy1UDBW5SPuZy4=";
+    settingsSha256 = "sha256-FkKPE4QV5IiVizGYUNUYoEXRpEhojt/cbH/I8iCn3hw=";
+    persistencedSha256 = "sha256-JP71wt3uCNOgheLNlQbW3DqVFQNTC5vj4y4COWKQzAs=";
 
     patchFlags = [ "-p1" "-d" "kernel" ];
     patches = [
-      # source: https://gist.github.com/joanbm/d10e9cbbbb8e245b6e7e27b2db338faf
+      # source: https://gist.github.com/joanbm/dfe8dc59af1c83e2530a1376b77be8ba
       (fetchpatch {
-        url = "https://gist.github.com/joanbm/d10e9cbbbb8e245b6e7e27b2db338faf/raw/f5d5238bdbaa16cd4008658a0f82b9dd84f1b38f/nvidia-470xx-fix-linux-6.3.patch";
-        hash = "sha256-mR+vXDHgVhWC0JeLgGlbNVCH8XTs7XnhEJS6BV75tI8=";
-      })
-      # source: https://gist.github.com/joanbm/77f0650d45747b9a4dc8e330ade2bf5c
-      (fetchpatch {
-        url = "https://gist.github.com/joanbm/77f0650d45747b9a4dc8e330ade2bf5c/raw/688b612624945926676de28059fe749203b4b549/nvidia-470xx-fix-linux-6.4.patch";
-        hash = "sha256-OyRmezyzqAi7mSJHDjsWQVocSsgJPTW5DvHDFVNX7Dk=";
+        url = "https://gist.github.com/joanbm/dfe8dc59af1c83e2530a1376b77be8ba/raw/37ff2b5ccf99f295ff958c9a44ca4ed4f42503b4/nvidia-470xx-fix-linux-6.5.patch";
+        hash = "sha256-s5r7nwuMva0BLy2qJBVKqNtnUN9am5+PptnVwNdzdbk=";
       })
     ];
   };
diff --git a/nixpkgs/pkgs/os-specific/linux/oddjob/default.nix b/nixpkgs/pkgs/os-specific/linux/oddjob/default.nix
new file mode 100644
index 000000000000..bcbea9086488
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/oddjob/default.nix
@@ -0,0 +1,60 @@
+{ lib
+, fetchurl
+, stdenv
+, autoreconfHook
+, dbus
+, libxml2
+, pam
+, pkg-config
+, systemd
+}:
+
+stdenv.mkDerivation rec {
+  pname = "oddjob";
+  version = "0.34.7";
+
+  src = fetchurl {
+     url = "https://pagure.io/oddjob/archive/${pname}-${version}/oddjob-${pname}-${version}.tar.gz";
+     hash = "sha256-SUOsMH55HtEsk5rX0CXK0apDObTj738FGOaL5xZRnIM=";
+  };
+
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+  ];
+
+  buildInputs =[
+    libxml2
+    dbus
+    pam
+    systemd
+  ];
+
+  postPatch = ''
+    substituteInPlace configure.ac \
+      --replace 'SYSTEMDSYSTEMUNITDIR=`pkg-config --variable=systemdsystemunitdir systemd 2> /dev/null`' "SYSTEMDSYSTEMUNITDIR=${placeholder "out"}" \
+      --replace 'SYSTEMDSYSTEMUNITDIR=`pkg-config --variable=systemdsystemunitdir systemd`' "SYSTEMDSYSTEMUNITDIR=${placeholder "out"}"
+  '';
+
+  configureFlags = [
+    "--prefix=${placeholder "out"}"
+    "--sysconfdir=${placeholder "out"}/etc"
+    "--with-selinux-acls=no"
+    "--with-selinux-labels=no"
+    "--disable-systemd"
+  ];
+
+  postConfigure = ''
+    substituteInPlace src/oddjobd.c \
+      --replace "globals.selinux_enabled" "FALSE"
+  '';
+
+  meta = with lib; {
+    description = "Odd Job Daemon";
+    homepage = "https://pagure.io/oddjob";
+    changelog = "https://pagure.io/oddjob/blob/oddjob-${version}/f/ChangeLog";
+    license = licenses.bsd0;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ SohamG ];
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/open-iscsi/default.nix b/nixpkgs/pkgs/os-specific/linux/open-iscsi/default.nix
index 38912e0aa215..9306099213a9 100644
--- a/nixpkgs/pkgs/os-specific/linux/open-iscsi/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/open-iscsi/default.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "open-iscsi";
-  version = "2.1.8";
+  version = "2.1.9";
 
   src = fetchFromGitHub {
     owner = "open-iscsi";
     repo = "open-iscsi";
     rev = version;
-    hash = "sha256-JzSyX9zvUkhCEpNwTMneTZpCRgaYxHZ1wP215YnMI78=";
+    hash = "sha256-y0NIb/KsKpCd8byr/SXI7nwTKXP2/bSSoW8QgeL5xdc=";
   };
 
   nativeBuildInputs = [
@@ -55,7 +55,7 @@ stdenv.mkDerivation rec {
     "-Ddbroot=/etc/iscsi"
   ];
 
-  passthru.tests = { inherit (nixosTests) iscsi-root iscsi-multipath-root; };
+  passthru.tests = { inherit (nixosTests) iscsi-root; };
 
   meta = with lib; {
     description = "A high performance, transport independent, multi-platform implementation of RFC3720";
diff --git a/nixpkgs/pkgs/os-specific/linux/pam_dp9ik/default.nix b/nixpkgs/pkgs/os-specific/linux/pam_dp9ik/default.nix
new file mode 100644
index 000000000000..bd097caee497
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/pam_dp9ik/default.nix
@@ -0,0 +1,29 @@
+{ lib
+, tlsclient
+, stdenv
+, pkg-config
+, pam
+}:
+
+stdenv.mkDerivation {
+  inherit (tlsclient) src version enableParallelBuilding;
+
+  pname = "pam_dp9ik";
+
+  strictDeps = true;
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ pam ];
+
+  buildFlags = [ "pam_p9.so" ];
+  installFlags = [ "PREFIX=$(out)" ];
+  installTargets = "pam.install";
+
+  meta = with lib; {
+    description = "dp9ik pam module";
+    longDescription = "Uses tlsclient to authenticate users against a 9front auth server";
+    homepage = "https://git.sr.ht/~moody/tlsclient";
+    license = licenses.mit;
+    maintainers = with maintainers; [ moody ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/pam_rssh/default.nix b/nixpkgs/pkgs/os-specific/linux/pam_rssh/default.nix
new file mode 100644
index 000000000000..51cba4d84200
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/pam_rssh/default.nix
@@ -0,0 +1,71 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, pkg-config
+, openssl
+, pam
+, openssh
+}:
+
+rustPlatform.buildRustPackage {
+  pname = "pam_rssh";
+  version = "unstable-2023-03-18";
+
+  src = fetchFromGitHub {
+    owner = "z4yx";
+    repo = "pam_rssh";
+    rev = "92c240bd079e9711c7afa8bacfcf01de48f42577";
+    hash = "sha256-mIQeItPh6RrF3cFbAth2Kmb2E/Xj+lOgatvjcLE4Yag=";
+    fetchSubmodules = true;
+  };
+
+  cargoHash = "sha256-/AQqjmAGgvnpVWyoK3ymZ1gNAhTSN30KQEiqv4G+zx8=";
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    openssl
+    pam
+  ];
+
+  checkFlags = [
+    # Fails because it tries finding authorized_keys in /home/$USER.
+    "--skip=tests::parse_user_authorized_keys"
+  ];
+
+  nativeCheckInputs = [
+    openssh
+  ];
+
+  env.USER = "nixbld";
+
+  # Copied from https://github.com/z4yx/pam_rssh/blob/main/.github/workflows/rust.yml.
+  preCheck = ''
+    export HOME=$(mktemp -d)
+    mkdir $HOME/.ssh
+    ssh-keygen -q -N "" -t ecdsa -b 521 -f $HOME/.ssh/id_ecdsa521
+    ssh-keygen -q -N "" -t ecdsa -b 384 -f $HOME/.ssh/id_ecdsa384
+    ssh-keygen -q -N "" -t ecdsa -b 256 -f $HOME/.ssh/id_ecdsa256
+    ssh-keygen -q -N "" -t ed25519 -f $HOME/.ssh/id_ed25519
+    ssh-keygen -q -N "" -t rsa -f $HOME/.ssh/id_rsa
+    ssh-keygen -q -N "" -t dsa -f $HOME/.ssh/id_dsa
+    export SSH_AUTH_SOCK=$HOME/ssh-agent.sock
+    eval $(ssh-agent -a $SSH_AUTH_SOCK)
+    ssh-add $HOME/.ssh/id_ecdsa521
+    ssh-add $HOME/.ssh/id_ecdsa384
+    ssh-add $HOME/.ssh/id_ecdsa256
+    ssh-add $HOME/.ssh/id_ed25519
+    ssh-add $HOME/.ssh/id_rsa
+    ssh-add $HOME/.ssh/id_dsa
+  '';
+
+  meta = with lib; {
+    description = "PAM module for authenticating via ssh-agent, written in Rust";
+    homepage = "https://github.com/z4yx/pam_rssh";
+    license = licenses.mit;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ kranzes ];
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/pcm/default.nix b/nixpkgs/pkgs/os-specific/linux/pcm/default.nix
index d9b93eafdb0e..fc5902e719ba 100644
--- a/nixpkgs/pkgs/os-specific/linux/pcm/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/pcm/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pcm";
-  version = "202302";
+  version = "202307";
 
   src = fetchFromGitHub {
     owner = "opcm";
     repo = "pcm";
     rev = version;
-    hash = "sha256-69wdA6/bRN5gYl02GgA8mXnXxVZlHIGkhtC8vFKZVcA=";
+    hash = "sha256-GeLiJT5AwsMWw0ErdwD6C1jtUZjUxGw5GRSvenu3W18=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/nixpkgs/pkgs/os-specific/linux/plymouth/add-runtime-plugin-path.patch b/nixpkgs/pkgs/os-specific/linux/plymouth/add-runtime-plugin-path.patch
new file mode 100644
index 000000000000..e4bd095bfd83
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/plymouth/add-runtime-plugin-path.patch
@@ -0,0 +1,67 @@
+diff --git a/meson.build b/meson.build
+index 650ad189..1e1ebe1d 100644
+--- a/meson.build
++++ b/meson.build
+@@ -18,6 +18,11 @@ plymouth_time_dir = get_option('prefix') / get_option('localstatedir') / 'lib' /
+ 
+ plymouth_runtime_dir = get_option('runstatedir') / 'plymouth'
+ plymouth_runtime_theme_path = plymouth_runtime_dir / 'themes/'
++if get_option('runtime-plugins')
++  plymouth_runtime_plugin_path = plymouth_runtime_dir / 'plugins/'
++else
++  plymouth_runtime_plugin_path = plymouth_plugin_path
++endif
+ 
+ # Dependencies
+ cc = meson.get_compiler('c')
+@@ -76,7 +81,7 @@ conf.set('PLY_ENABLE_TRACING', get_option('tracing'))
+ conf.set_quoted('PLYMOUTH_RUNTIME_DIR', plymouth_runtime_dir)
+ conf.set_quoted('PLYMOUTH_THEME_PATH', plymouth_theme_path)
+ conf.set_quoted('PLYMOUTH_RUNTIME_THEME_PATH', plymouth_runtime_theme_path)
+-conf.set_quoted('PLYMOUTH_PLUGIN_PATH', plymouth_plugin_path)
++conf.set_quoted('PLYMOUTH_PLUGIN_PATH', plymouth_runtime_plugin_path)
+ conf.set_quoted('PLYMOUTH_POLICY_DIR', plymouth_policy_dir)
+ conf.set_quoted('PLYMOUTH_CONF_DIR', plymouth_conf_dir)
+ conf.set_quoted('PLYMOUTH_TIME_DIRECTORY', plymouth_time_dir)
+diff --git a/meson_options.txt b/meson_options.txt
+index 4f601bb0..61fccc12 100644
+--- a/meson_options.txt
++++ b/meson_options.txt
+@@ -28,6 +28,11 @@ option('runstatedir',
+   value: '/run',
+   description: 'runstatedir',
+ )
++option('runtime-plugins',
++  type: 'boolean',
++  value: false,
++  description: 'Use runstatedir for loading theme plugins',
++)
+ option('boot-tty',
+   type: 'string',
+   value: '/dev/tty1',
+diff --git a/src/libply-splash-core/meson.build b/src/libply-splash-core/meson.build
+index 69636b13..02bd5cbd 100644
+--- a/src/libply-splash-core/meson.build
++++ b/src/libply-splash-core/meson.build
+@@ -31,7 +31,7 @@ libply_splash_core_cflags = [
+   '-DPLYMOUTH_BACKGROUND_COLOR=@0@'.format(get_option('background-color')),
+   '-DPLYMOUTH_BACKGROUND_START_COLOR=@0@'.format(get_option('background-start-color-stop')),
+   '-DPLYMOUTH_BACKGROUND_END_COLOR=@0@'.format(get_option('background-end-color-stop')),
+-  '-DPLYMOUTH_PLUGIN_PATH="@0@"'.format(plymouth_plugin_path),
++  '-DPLYMOUTH_PLUGIN_PATH="@0@"'.format(plymouth_runtime_plugin_path),
+ ]
+ 
+ libply_splash_core = library('ply-splash-core',
+diff --git a/src/libply-splash-graphics/meson.build b/src/libply-splash-graphics/meson.build
+index 32fad963..02b8440b 100644
+--- a/src/libply-splash-graphics/meson.build
++++ b/src/libply-splash-graphics/meson.build
+@@ -20,7 +20,7 @@ libply_splash_graphics_cflags = [
+   '-DPLYMOUTH_BACKGROUND_COLOR=@0@'.format(get_option('background-color')),
+   '-DPLYMOUTH_BACKGROUND_START_COLOR=@0@'.format(get_option('background-start-color-stop')),
+   '-DPLYMOUTH_BACKGROUND_END_COLOR=@0@'.format(get_option('background-end-color-stop')),
+-  '-DPLYMOUTH_PLUGIN_PATH="@0@"'.format(plymouth_plugin_path),
++  '-DPLYMOUTH_PLUGIN_PATH="@0@"'.format(plymouth_runtime_plugin_path),
+ ]
+ 
+ libply_splash_graphics = library('ply-splash-graphics',
diff --git a/nixpkgs/pkgs/os-specific/linux/plymouth/default.nix b/nixpkgs/pkgs/os-specific/linux/plymouth/default.nix
index 4e755a28db8b..0365abba1432 100644
--- a/nixpkgs/pkgs/os-specific/linux/plymouth/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/plymouth/default.nix
@@ -1,97 +1,115 @@
 { lib
 , stdenv
-, fetchpatch
 , fetchFromGitLab
+, writeText
+, meson
 , pkg-config
-, autoreconfHook
-, libxslt
+, ninja
 , docbook-xsl-nons
 , gettext
+, libxslt
 , gtk3
-, systemd
-, pango
-, cairo
 , libdrm
+, libevdev
+, libpng
+, libxkbcommon
+, pango
+, systemd
+, xorg
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "plymouth";
-  version = "unstable-2021-10-18";
+  version = "unstable-2023-06-05";
 
-  outputs = [
-    "out"
-    "dev"
-  ];
+  outputs = [ "out" "dev" ];
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "plymouth";
     repo = "plymouth";
-    rev = "18363cd887dbfe7e82a2f4cc1a49ef9513919142";
-    sha256 = "sha256-+AP4ALOFdYFt/8MDXjMaHptkogCwK1iXKuza1zfMaws=";
+    rev = "a5eda165689864cc9a25ec14fd8c6da458598f42";
+    hash = "sha256-TpMZZ0naC4D0Knmclc8JpmXPfnpM6q8YotIkNX+aRVo=";
   };
 
+  patches = [
+    # do not create unnecessary symlink to non-existent header-image.png
+    ./dont-create-broken-symlink.patch
+    # add support for loading plugins from /run to assist NixOS module
+    ./add-runtime-plugin-path.patch
+  ];
+
+  strictDeps = true;
+
   nativeBuildInputs = [
-    autoreconfHook
+    meson
+    pkg-config
+    ninja
     docbook-xsl-nons
     gettext
     libxslt
-    pkg-config
   ];
 
   buildInputs = [
-    cairo
     gtk3
     libdrm
+    libevdev
+    libpng
+    libxkbcommon
     pango
     systemd
+    xorg.xkeyboardconfig
   ];
 
-  postPatch = ''
-    sed -i \
-      -e "s#plymouthplugindir=.*#plymouthplugindir=/etc/plymouth/plugins/#" \
-      -e "s#plymouththemedir=.*#plymouththemedir=/etc/plymouth/themes#" \
-      -e "s#plymouthpolicydir=.*#plymouthpolicydir=/etc/plymouth/#" \
-      -e "s#plymouthconfdir=.*#plymouthconfdir=/etc/plymouth/#" \
-      configure.ac
-  '';
-
-  configurePlatforms = [ "host" ];
-
-  configureFlags = [
-    "--enable-documentation"
-    "--enable-drm"
-    "--enable-gtk"
-    "--enable-pango"
-    "--enable-systemd-integration"
-    "--enable-tracing"
-    "--localstatedir=/var"
+  mesonFlags = let
+    # https://gitlab.freedesktop.org/plymouth/plymouth/-/blob/a5eda165689864cc9a25ec14fd8c6da458598f42/meson.build#L47
+    crossFile = writeText "cross-file.conf" ''
+      [binaries]
+      systemd-tty-ask-password-agent = '${lib.getBin systemd}/bin/systemd-tty-ask-password-agent'
+    '';
+  in [
     "--sysconfdir=/etc"
-    "--with-background-color=0x000000"
-    "--with-background-end-color-stop=0x000000"
-    "--with-background-start-color-stop=0x000000"
-    "--with-logo=/etc/plymouth/logo.png"
-    "--with-release-file=/etc/os-release"
-    "--with-runtimedir=/run"
-    "--with-systemdunitdir=${placeholder "out"}/etc/systemd/system"
-    "--without-rhgb-compat-link"
-    "--without-system-root-install"
-    "ac_cv_path_SYSTEMD_ASK_PASSWORD_AGENT=${lib.getBin systemd}/bin/systemd-tty-ask-password-agent"
+    "--localstatedir=/var"
+    "-Dlogo=/etc/plymouth/logo.png"
+    "-Dbackground-color=0x000000"
+    "-Dbackground-start-color-stop=0x000000"
+    "-Dbackground-end-color-stop=0x000000"
+    "-Drelease-file=/etc/os-release"
+    "-Dudev=enabled"
+    "-Drunstatedir=/run"
+    "-Druntime-plugins=true"
+    "--cross-file=${crossFile}"
   ];
 
-  installFlags = [
-    "localstatedir=\${TMPDIR}"
-    "plymouthd_confdir=${placeholder "out"}/etc/plymouth"
-    "plymouthd_defaultsdir=${placeholder "out"}/share/plymouth"
-    "sysconfdir=${placeholder "out"}/etc"
-  ];
+  postPatch = ''
+    substituteInPlace meson.build \
+      --replace "run_command(['scripts/generate-version.sh'], check: true).stdout().strip()" "'${finalAttrs.version}'"
+
+    # prevent installing unused non-$out dirs to DESTDIR
+    sed -i '/^install_emptydir/d' src/meson.build
+  '';
 
   postInstall = ''
-    # Makes a symlink to /usr/share/pixmaps/system-logo-white.png
-    # We'll handle it in the nixos module.
-    rm $out/share/plymouth/themes/spinfinity/header-image.png
+    # Move stuff from DESTDIR to proper location.
+    cp -a "$DESTDIR/etc" "$out"
+    rm -r "$DESTDIR/etc"
+    for o in $(getAllOutputNames); do
+        if [[ "$o" = "debug" ]]; then continue; fi
+        cp -a "$DESTDIR/''${!o}" "$(dirname "''${!o}")"
+        rm -r "$DESTDIR/''${!o}"
+    done
+    # Ensure the DESTDIR is removed.
+    rmdir "$DESTDIR/${builtins.storeDir}" "$DESTDIR/${builtins.dirOf builtins.storeDir}" "$DESTDIR"
   '';
 
+  # HACK: We want to install configuration files to $out/etc
+  # but Plymouth should read them from /etc on a NixOS system.
+  # With autotools, it was possible to override Make variables
+  # at install time but Meson does not support this
+  # so we need to convince it to install all files to a temporary
+  # location using DESTDIR and then move it to proper one in postInstall.
+  env.DESTDIR = "${placeholder "out"}/dest";
+
   meta = with lib; {
     homepage = "https://www.freedesktop.org/wiki/Software/Plymouth/";
     description = "Boot splash and boot logger";
@@ -99,4 +117,4 @@ stdenv.mkDerivation rec {
     maintainers = [ maintainers.goibhniu ] ++ teams.gnome.members;
     platforms = platforms.linux;
   };
-}
+})
diff --git a/nixpkgs/pkgs/os-specific/linux/plymouth/dont-create-broken-symlink.patch b/nixpkgs/pkgs/os-specific/linux/plymouth/dont-create-broken-symlink.patch
new file mode 100644
index 000000000000..7accb7c9efcb
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/plymouth/dont-create-broken-symlink.patch
@@ -0,0 +1,13 @@
+diff --git a/themes/spinfinity/meson.build b/themes/spinfinity/meson.build
+index f48e8e55..5a2050c8 100644
+--- a/themes/spinfinity/meson.build
++++ b/themes/spinfinity/meson.build
+@@ -53,8 +53,3 @@ install_data(
+   'throbber-33.png',
+   install_dir: plymouth_theme_path / 'spinfinity',
+ )
+-
+-install_symlink('header-image.png',
+-  install_dir: plymouth_theme_path / 'spinfinity',
+-  pointing_to: plymouth_logo_file,
+-)
diff --git a/nixpkgs/pkgs/os-specific/linux/prl-tools/default.nix b/nixpkgs/pkgs/os-specific/linux/prl-tools/default.nix
index 933622b68144..7e5fca7a354b 100644
--- a/nixpkgs/pkgs/os-specific/linux/prl-tools/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/prl-tools/default.nix
@@ -34,15 +34,15 @@ let
     "${util-linux}/bin"
   ];
 in
-stdenv.mkDerivation rec {
-  version = "18.3.0-53606";
+stdenv.mkDerivation (finalAttrs: {
   pname = "prl-tools";
+  version = "18.3.2-53621";
 
   # We download the full distribution to extract prl-tools-lin.iso from
   # => ${dmg}/Parallels\ Desktop.app/Contents/Resources/Tools/prl-tools-lin.iso
   src = fetchurl {
-    url = "https://download.parallels.com/desktop/v${lib.versions.major version}/${version}/ParallelsDesktop-${version}.dmg";
-    hash = "sha256-uthaY6266YJqh5UtlI6ifmJVZVC6JTlsEoxEUOihx4I=";
+    url = "https://download.parallels.com/desktop/v${lib.versions.major finalAttrs.version}/${finalAttrs.version}/ParallelsDesktop-${finalAttrs.version}.dmg";
+    hash = "sha256-mPETZiCI/i6xJ3+ououDKaVwrAxK5cr6L6A16oEgIqk=";
   };
 
   hardeningDisable = [ "pic" "format" ];
@@ -173,4 +173,4 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ catap wegank ];
     platforms = platforms.linux;
   };
-}
+})
diff --git a/nixpkgs/pkgs/os-specific/linux/rdma-core/default.nix b/nixpkgs/pkgs/os-specific/linux/rdma-core/default.nix
index d6d67d4d1d41..d793e87c6f29 100644
--- a/nixpkgs/pkgs/os-specific/linux/rdma-core/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/rdma-core/default.nix
@@ -1,22 +1,46 @@
-{ lib, stdenv, fetchFromGitHub, cmake, pkg-config, docutils
-, pandoc, ethtool, iproute2, libnl, udev, python3, perl
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, pkg-config
+, docutils
+, pandoc
+, ethtool
+, iproute2
+, libnl
+, udev
+, python3
+, perl
 } :
 
-
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "rdma-core";
-  version = "46.0";
+  version = "46.1";
 
   src = fetchFromGitHub {
     owner = "linux-rdma";
     repo = "rdma-core";
-    rev = "v${version}";
-    sha256 = "sha256-/mhaEACBAtKdjn5hIj7YnuzrwraiuA4sR9eHg3w0YZM=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-pVPWoLnWCGP+CZtG5bnOKUtjiuOa6Qic9wlGeY68w/8=";
   };
 
   strictDeps = true;
-  nativeBuildInputs = [ cmake pkg-config pandoc docutils python3 ];
-  buildInputs = [ libnl ethtool iproute2 udev perl ];
+
+  nativeBuildInputs = [
+    cmake
+    docutils
+    pandoc
+    pkg-config
+    python3
+  ];
+
+  buildInputs = [
+    ethtool
+    iproute2
+    libnl
+    perl
+    udev
+  ];
 
   cmakeFlags = [
     "-DCMAKE_INSTALL_RUNDIR=/run"
@@ -42,11 +66,11 @@ stdenv.mkDerivation rec {
     done
   '';
 
-  meta = with lib; {
+  meta = {
     description = "RDMA Core Userspace Libraries and Daemons";
     homepage = "https://github.com/linux-rdma/rdma-core";
-    license = licenses.gpl2Only;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ markuskowa ];
+    license = lib.licenses.gpl2Only;
+    platforms = lib.platforms.linux;
+    maintainers = [ lib.maintainers.markuskowa ];
   };
-}
+})
diff --git a/nixpkgs/pkgs/os-specific/linux/reptyr/default.nix b/nixpkgs/pkgs/os-specific/linux/reptyr/default.nix
index 0c58ca7b3b91..35516fdf0e69 100644
--- a/nixpkgs/pkgs/os-specific/linux/reptyr/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/reptyr/default.nix
@@ -3,14 +3,14 @@
 let
   python = python3.withPackages (p: [ p.pexpect ]);
 in stdenv.mkDerivation rec {
-  version = "0.9.0";
+  version = "0.10.0";
   pname = "reptyr";
 
   src = fetchFromGitHub {
     owner = "nelhage";
     repo = "reptyr";
     rev = "reptyr-${version}";
-    sha256 = "sha256-gM3aMEqk71RWUN1NxByd21tIzp6PmJ54Cqrh5MsjHtI=";
+    sha256 = "sha256-jlO/ykrwGJkgKiPxfRQEX4TSksrbPQhkQs+QddwqaQ4=";
   };
 
   makeFlags = [ "PREFIX=" "DESTDIR=$(out)" ];
diff --git a/nixpkgs/pkgs/os-specific/linux/rtl8192eu/default.nix b/nixpkgs/pkgs/os-specific/linux/rtl8192eu/default.nix
index c91353e465e3..32b97b59c52e 100644
--- a/nixpkgs/pkgs/os-specific/linux/rtl8192eu/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/rtl8192eu/default.nix
@@ -6,13 +6,13 @@ let modDestDir = "$out/lib/modules/${kernel.modDirVersion}/kernel/drivers/net/wi
 
 in stdenv.mkDerivation rec {
   pname = "rtl8192eu";
-  version = "${kernel.version}-4.4.1.20220614";
+  version = "${kernel.version}-4.4.1.20230613";
 
   src = fetchFromGitHub {
     owner = "Mange";
     repo = "rtl8192eu-linux-driver";
-    rev = "6ba1f320963376f15ea216238c0b62ff3e71fa82";
-    sha256 = "sha256-c5swRxSjWT1tCcR7tfFKdAdVVmAEYgMZuOwUxGYYESI=";
+    rev = "f2fc8af7ab58d2123eed1aa4428e713cdfc27976";
+    sha256 = "sha256-OgsxBcXoIP8h9Z0bLsG91/s/+r89Tdn2dPOt4p3sx8k=";
   };
 
   hardeningDisable = [ "pic" ];
@@ -38,7 +38,7 @@ in stdenv.mkDerivation rec {
     homepage = "https://github.com/Mange/rtl8192eu-linux-driver";
     license = licenses.gpl2Only;
     platforms = platforms.linux;
-    broken = stdenv.hostPlatform.isAarch64 || kernel.kernelAtLeast "5.18";
+    broken = stdenv.hostPlatform.isAarch64;
     maintainers = with maintainers; [ troydm ];
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/rtl8723bs/default.nix b/nixpkgs/pkgs/os-specific/linux/rtl8723bs/default.nix
deleted file mode 100644
index b6ab883ca751..000000000000
--- a/nixpkgs/pkgs/os-specific/linux/rtl8723bs/default.nix
+++ /dev/null
@@ -1,41 +0,0 @@
-{ lib, stdenv, fetchFromGitHub, nukeReferences, kernel }:
-with lib;
-stdenv.mkDerivation rec {
-  name = "rtl8723bs-${kernel.version}-${version}";
-  version = "2017-04-06";
-
-  src = fetchFromGitHub {
-    owner = "hadess";
-    repo = "rtl8723bs";
-    rev = "db2c4f61d48fe3b47c167c8bcd722ce83c24aca5";
-    sha256 = "0pxqya14a61vv2v5ky1ldybc0mjfin9mpvmajlmv0lls904rph7g";
-  };
-
-  hardeningDisable = [ "pic" ];
-
-  buildInputs = [ nukeReferences ];
-
-  makeFlags = [
-    "ARCH=${stdenv.hostPlatform.linuxArch}" # Normally not needed, but the Makefile sets ARCH in a broken way.
-    "KSRC=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build" # Makefile uses $(uname -r); breaks us.
-  ];
-
-  enableParallelBuilding = true;
-
-  # The Makefile doesn't use env-vars well, so install manually:
-  installPhase = ''
-    mkdir -p      $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/net/wireless
-    cp r8723bs.ko $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/net/wireless
-
-    nuke-refs $(find $out -name "*.ko")
-  '';
-
-  meta = {
-    description = "Realtek SDIO Wi-Fi driver";
-    homepage = "https://github.com/hadess/rtl8723bs";
-    license = lib.licenses.gpl2;
-    platforms = lib.platforms.linux;
-    broken = versionAtLeast kernel.version "4.12"; # Now in kernel staging drivers
-    maintainers = with maintainers; [ elitak ];
-  };
-}
diff --git a/nixpkgs/pkgs/os-specific/linux/rtl8812au/default.nix b/nixpkgs/pkgs/os-specific/linux/rtl8812au/default.nix
index 786bcab86c2f..9646886a6de1 100644
--- a/nixpkgs/pkgs/os-specific/linux/rtl8812au/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/rtl8812au/default.nix
@@ -1,14 +1,14 @@
 { lib, stdenv, fetchFromGitHub, kernel, bc, nukeReferences }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "rtl8812au";
-  version = "${kernel.version}-unstable-2023-05-11";
+  version = "${kernel.version}-unstable-2023-07-22";
 
   src = fetchFromGitHub {
     owner = "morrownr";
     repo = "8812au-20210629";
-    rev = "765d4e4bd5970f4c1c79e63bbe301667e5e029c9";
-    hash = "sha256-FF2LVfOpITMJ5LiwsGAudrWStlkKsZUlHvzZs03gb9g=";
+    rev = "b5f4e6e894eca8fea38661e2fc22a2570e0274ad";
+    hash = "sha256-3uPowesJVh/cnagMz/Uadb+U5rDUAWfU39tZaDNCoqg=";
   };
 
   nativeBuildInputs = [ bc nukeReferences ] ++ kernel.moduleBuildDependencies;
diff --git a/nixpkgs/pkgs/os-specific/linux/rtl8821au/default.nix b/nixpkgs/pkgs/os-specific/linux/rtl8821au/default.nix
index 37494d9c37ec..b89cddbfc73b 100644
--- a/nixpkgs/pkgs/os-specific/linux/rtl8821au/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/rtl8821au/default.nix
@@ -1,14 +1,14 @@
 { lib, stdenv, fetchFromGitHub, kernel, bc, nukeReferences }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "rtl8821au";
-  version = "${kernel.version}-unstable-2023-03-22";
+  version = "${kernel.version}-unstable-2023-07-23";
 
   src = fetchFromGitHub {
     owner = "morrownr";
     repo = "8821au-20210708";
-    rev = "a133274b0532c17318e8790b771566f4a6b12b7c";
-    hash = "sha256-xn2cmbtqQhLM9qLCEvVhCuoCa7y8LM4sevPqv3a6pBw=";
+    rev = "0dc022287b0ab534efa885881eaa65c5503291be";
+    hash = "sha256-pLRBWdqlv9A39VbCS8dymTCJHcwJooqD8v6mTbOsBz0=";
   };
 
   nativeBuildInputs = [ bc nukeReferences ] ++ kernel.moduleBuildDependencies;
diff --git a/nixpkgs/pkgs/os-specific/linux/rtl88x2bu/default.nix b/nixpkgs/pkgs/os-specific/linux/rtl88x2bu/default.nix
index eb5a795c933b..2775b1801889 100644
--- a/nixpkgs/pkgs/os-specific/linux/rtl88x2bu/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/rtl88x2bu/default.nix
@@ -1,14 +1,14 @@
 { lib, stdenv, fetchFromGitHub, kernel, bc }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "rtl88x2bu";
-  version = "${kernel.version}-unstable-2023-03-17";
+  version = "${kernel.version}-unstable-2023-07-23";
 
   src = fetchFromGitHub {
     owner = "morrownr";
     repo = "88x2bu-20210702";
-    rev = "f0a2c9c74045cf2c3701084f389e358f9236fc8c";
-    sha256 = "sha256-hquLmEOzdBQ6rJld5kkzVw+hXBFb/ZwpBI0eL0rUrkM=";
+    rev = "83db18e610845df9434a628ca3feb9004296b307";
+    sha256 = "sha256-as3S7WQkug3suJ5ovUbRu/UzO5GDrGLdgkiWrCrvztk=";
   };
 
   hardeningDisable = [ "pic" ];
@@ -34,6 +34,6 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/morrownr/88x2bu-20210702";
     license = licenses.gpl2Only;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ otavio ralith ];
+    maintainers = with maintainers; [ otavio ];
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/sch_cake/default.nix b/nixpkgs/pkgs/os-specific/linux/sch_cake/default.nix
deleted file mode 100644
index f93713344efb..000000000000
--- a/nixpkgs/pkgs/os-specific/linux/sch_cake/default.nix
+++ /dev/null
@@ -1,34 +0,0 @@
-{ stdenv, lib, fetchFromGitHub, kernel }:
-
-stdenv.mkDerivation {
-  pname = "sch_cake";
-  version = "unstable-2017-07-16";
-
-  src = fetchFromGitHub {
-    owner = "dtaht";
-    repo = "sch_cake";
-    rev = "e641a56f27b6848736028f87eda65ac3df9f99f7";
-    sha256 = "08582jy01j32b3mj8hf6m8687qrcz64zv2m236j24inlkmd94q21";
-  };
-
-  hardeningDisable = [ "pic" ];
-
-  makeFlags = [
-    "KERNEL_VERSION=${kernel.version}"
-    "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
-  ];
-
-  installPhase = ''
-    install -v -m 644 -D sch_cake.ko \
-      $out/lib/modules/${kernel.modDirVersion}/kernel/net/sched/sch_cake.ko
-  '';
-
-  meta = with lib; {
-    description = "The cake qdisc scheduler";
-    homepage = "https://www.bufferbloat.net/projects/codel/wiki/Cake/";
-    license = with licenses; [ bsd3 gpl2 ];
-    maintainers = with maintainers; [ fpletz ];
-    platforms = platforms.linux;
-    broken = lib.versionAtLeast kernel.version "4.13";
-  };
-}
diff --git a/nixpkgs/pkgs/os-specific/linux/sd-switch/default.nix b/nixpkgs/pkgs/os-specific/linux/sd-switch/default.nix
index 987f32664c11..b231f32d42a1 100644
--- a/nixpkgs/pkgs/os-specific/linux/sd-switch/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/sd-switch/default.nix
@@ -1,17 +1,18 @@
-{ lib, fetchFromGitLab, rustPlatform, pkg-config, dbus }:
+{ lib, fetchFromSourcehut, rustPlatform, pkg-config, dbus }:
 
-rustPlatform.buildRustPackage rec {
+let version = "0.3.0";
+in rustPlatform.buildRustPackage {
   pname = "sd-switch";
-  version = "0.2.3";
+  inherit version;
 
-  src = fetchFromGitLab {
-    owner = "rycee";
-    repo = pname;
+  src = fetchFromSourcehut {
+    owner = "~rycee";
+    repo = "sd-switch";
     rev = version;
-    sha256 = "12h2d7v7pdz7b0hrna64561kf35nbpwb2kzxa791xk8raxc2b72k";
+    hash = "sha256-mWrLbCUnoJ3hVtpSU/7dw91U5TLyw5kNchX5nmP9asA=";
   };
 
-  cargoSha256 = "12ny3cir2nxzrmf4vwq6sgc35dbpq88hav53xqdp44rigdf4vzbs";
+  cargoHash = "sha256-VK+kPX1pGhowbWKkUs1PL0DXIhDXJOFVoIHTtWQcWEs=";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ dbus ];
diff --git a/nixpkgs/pkgs/os-specific/linux/sgx/psw/default.nix b/nixpkgs/pkgs/os-specific/linux/sgx/psw/default.nix
index 4a5e50d9c6ab..fa4a7be01cf5 100644
--- a/nixpkgs/pkgs/os-specific/linux/sgx/psw/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/sgx/psw/default.nix
@@ -59,7 +59,10 @@ stdenv.mkDerivation rec {
     protobuf
   ];
 
-  hardeningDisable = lib.optionals debug [
+  hardeningDisable = [
+    # causes redefinition of _FORTIFY_SOURCE
+    "fortify3"
+  ] ++ lib.optionals debug [
     "fortify"
   ];
 
diff --git a/nixpkgs/pkgs/os-specific/linux/smemstat/default.nix b/nixpkgs/pkgs/os-specific/linux/smemstat/default.nix
index 5d78a3b30232..d8f8c1bc025f 100644
--- a/nixpkgs/pkgs/os-specific/linux/smemstat/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/smemstat/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "smemstat";
-  version = "0.02.11";
+  version = "0.02.12";
 
   src = fetchFromGitHub {
     owner = "ColinIanKing";
     repo = pname;
     rev = "V${version}";
-    hash = "sha256-RvHBrcyNB/zqxEY27twgMsjHNg8kzJryqnIAM7+vpg8=";
+    hash = "sha256-5gO26F80nZvZ6RIqX8o7bDSNo38EL8XywR8wMPFqHA8=";
   };
 
   buildInputs = [ ncurses ];
diff --git a/nixpkgs/pkgs/os-specific/linux/sssd/default.nix b/nixpkgs/pkgs/os-specific/linux/sssd/default.nix
index 6a02bd43aa89..96a3ace57d2d 100644
--- a/nixpkgs/pkgs/os-specific/linux/sssd/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/sssd/default.nix
@@ -13,13 +13,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "sssd";
-  version = "2.9.0";
+  version = "2.9.1";
 
   src = fetchFromGitHub {
     owner = "SSSD";
     repo = pname;
     rev = version;
-    sha256 = "sha256-H9Snh2RzbnjGPqvC9fJHeZvAkGX/O/vmVsl143yb194=";
+    sha256 = "sha256-OafSo28MN92py33foE8oMkPUmV9WUUOkKWJgm0i7MJU=";
   };
 
   postPatch = ''
diff --git a/nixpkgs/pkgs/os-specific/linux/sysdig/default.nix b/nixpkgs/pkgs/os-specific/linux/sysdig/default.nix
index 1a59244f8d4c..582dd939689d 100644
--- a/nixpkgs/pkgs/os-specific/linux/sysdig/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/sysdig/default.nix
@@ -5,8 +5,8 @@
 
 let
   # Compare with https://github.com/draios/sysdig/blob/dev/cmake/modules/falcosecurity-libs.cmake
-  libsRev = "0.11.0";
-  libsSha256 = "sha256-QvRTz3yMS6i+qdiSG51wvho9D7w/dMQhY72OYd3qOgU=";
+  libsRev = "0.11.3";
+  libsSha256 = "sha256-ph4ErNfgVv2aesZawCj+7kdqcYAnRgeNHfSrDMgm6Lo=";
 
   # Compare with https://github.com/falcosecurity/libs/blob/master/cmake/modules/valijson.cmake#L17
   valijson = fetchFromGitHub {
@@ -27,23 +27,15 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "sysdig";
-  version = "0.31.5";
+  version = "0.32.0";
 
   src = fetchFromGitHub {
     owner = "draios";
     repo = "sysdig";
     rev = version;
-    sha256 = "sha256-RuoPqVulATtn7jSga/8fECs7weNfjt/YFh7iHmfCKjw=";
+    sha256 = "sha256-R14uQdcZ2BnlgWjqvRQP8MDaKMk4Kfw17qTKYYlBg7o=";
   };
 
-  # to fix the build against the latest kernel
-  patches = [
-    (fetchpatch {
-      url = "https://github.com/draios/sysdig/compare/35ded9aab87801281e22898242e24e0bc63873b2...954e6fc6238f21d4870a491395d68a7dd3062aa9.patch";
-      sha256 = "sha256-gnLURnv8FW5LvqjbreCf9DPGdBcn7rfizGeznFqJ+Fk=";
-    })
-  ];
-
   nativeBuildInputs = [ cmake perl installShellFiles pkg-config ];
   buildInputs = [
     luajit
diff --git a/nixpkgs/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch b/nixpkgs/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch
index c0d38c60202c..08499a228344 100644
--- a/nixpkgs/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch
+++ b/nixpkgs/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch
@@ -10,10 +10,10 @@ container, so checking early whether it exists will fail.
  1 file changed, 2 insertions(+)
 
 diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
-index a697ea5cb9..65d9e7e398 100644
+index 3dabe12672..e5aa4feb1e 100644
 --- a/src/nspawn/nspawn.c
 +++ b/src/nspawn/nspawn.c
-@@ -5635,6 +5635,7 @@ static int run(int argc, char *argv[]) {
+@@ -5638,6 +5638,7 @@ static int run(int argc, char *argv[]) {
                                  goto finish;
                          }
                  } else {
@@ -21,7 +21,7 @@ index a697ea5cb9..65d9e7e398 100644
                          _cleanup_free_ char *p = NULL;
  
                          if (arg_pivot_root_new)
-@@ -5649,6 +5650,7 @@ static int run(int argc, char *argv[]) {
+@@ -5652,6 +5653,7 @@ static int run(int argc, char *argv[]) {
                                                      "Directory %s doesn't look like it has an OS tree (/usr/ directory is missing). Refusing.", arg_directory);
                                  goto finish;
                          }
diff --git a/nixpkgs/pkgs/os-specific/linux/systemd/0005-Add-some-NixOS-specific-unit-directories.patch b/nixpkgs/pkgs/os-specific/linux/systemd/0004-Add-some-NixOS-specific-unit-directories.patch
index b4a0da30c8f6..b4a0da30c8f6 100644
--- a/nixpkgs/pkgs/os-specific/linux/systemd/0005-Add-some-NixOS-specific-unit-directories.patch
+++ b/nixpkgs/pkgs/os-specific/linux/systemd/0004-Add-some-NixOS-specific-unit-directories.patch
diff --git a/nixpkgs/pkgs/os-specific/linux/systemd/0004-fsck-look-for-fsck-binary-not-just-in-sbin.patch b/nixpkgs/pkgs/os-specific/linux/systemd/0004-fsck-look-for-fsck-binary-not-just-in-sbin.patch
deleted file mode 100644
index 617cef50cc3c..000000000000
--- a/nixpkgs/pkgs/os-specific/linux/systemd/0004-fsck-look-for-fsck-binary-not-just-in-sbin.patch
+++ /dev/null
@@ -1,152 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Florian Klink <flokli@flokli.de>
-Date: Thu, 13 Apr 2023 22:54:54 +0200
-Subject: [PATCH] fsck: look for fsck binary not just in /sbin
-
-This removes remaining hardcoded occurences of `/sbin/fsck`, and instead
-uses `find_executable` to find `fsck`.
-
-We also use `fsck_exists_for_fstype` to check for the `fsck.*`
-executable, which also checks in `$PATH`, so it's fair to assume fsck
-itself is also available.
----
- man/systemd-fsck@.service.xml |  8 ++++----
- src/fsck/fsck.c               |  9 ++++++++-
- src/home/homework-luks.c      | 11 ++++++++++-
- src/shared/dissect-image.c    | 13 +++++++++++--
- 4 files changed, 33 insertions(+), 8 deletions(-)
-
-diff --git a/man/systemd-fsck@.service.xml b/man/systemd-fsck@.service.xml
-index e928aebdb3..403286829e 100644
---- a/man/systemd-fsck@.service.xml
-+++ b/man/systemd-fsck@.service.xml
-@@ -51,17 +51,17 @@
-     <para><filename>systemd-fsck</filename> does not know any details
-     about specific filesystems, and simply executes file system
-     checkers specific to each filesystem type
--    (<filename>/sbin/fsck.<replaceable>type</replaceable></filename>). These checkers will decide if
-+    (<filename>fsck.<replaceable>type</replaceable></filename>). These checkers will decide if
-     the filesystem should actually be checked based on the time since
-     last check, number of mounts, unclean unmount, etc.</para>
- 
-     <para><filename>systemd-fsck-root.service</filename> and <filename>systemd-fsck-usr.service</filename>
--    will activate <filename>reboot.target</filename> if <filename>/sbin/fsck</filename> returns the "System
--    should reboot" condition, or <filename>emergency.target</filename> if <filename>/sbin/fsck</filename>
-+    will activate <filename>reboot.target</filename> if <filename>fsck</filename> returns the "System
-+    should reboot" condition, or <filename>emergency.target</filename> if <filename>fsck</filename>
-     returns the "Filesystem errors left uncorrected" condition.</para>
- 
-     <para><filename>systemd-fsck@.service</filename> will fail if
--    <filename>/sbin/fsck</filename> returns with either "System should reboot"
-+    <filename>fsck</filename> returns with either "System should reboot"
-     or "Filesystem errors left uncorrected" conditions. For filesystems
-     listed in <filename>/etc/fstab</filename> without <literal>nofail</literal>
-     or <literal>noauto</literal> options, <literal>local-fs.target</literal>
-diff --git a/src/fsck/fsck.c b/src/fsck/fsck.c
-index e25c5d5efa..0e0e73c9ac 100644
---- a/src/fsck/fsck.c
-+++ b/src/fsck/fsck.c
-@@ -351,6 +351,7 @@ static int run(int argc, char *argv[]) {
-         if (r == 0) {
-                 char dash_c[STRLEN("-C") + DECIMAL_STR_MAX(int) + 1];
-                 int progress_socket = -1;
-+                _cleanup_free_ char *fsck_path = NULL;
-                 const char *cmdline[9];
-                 int i = 0;
- 
-@@ -371,7 +372,13 @@ static int run(int argc, char *argv[]) {
-                 } else
-                         dash_c[0] = 0;
- 
--                cmdline[i++] = "/sbin/fsck";
-+                r = find_executable("fsck", &fsck_path);
-+                if (r < 0) {
-+                        log_error_errno(r, "Cannot find fsck binary: %m");
-+                        _exit(FSCK_OPERATIONAL_ERROR);
-+                }
-+
-+                cmdline[i++] = fsck_path;
-                 cmdline[i++] =  arg_repair;
-                 cmdline[i++] = "-T";
- 
-diff --git a/src/home/homework-luks.c b/src/home/homework-luks.c
-index 2ea9887853..e267457b8e 100644
---- a/src/home/homework-luks.c
-+++ b/src/home/homework-luks.c
-@@ -215,6 +215,7 @@ static int block_get_size_by_path(const char *path, uint64_t *ret) {
- static int run_fsck(const char *node, const char *fstype) {
-         int r, exit_status;
-         pid_t fsck_pid;
-+        _cleanup_free_ char *fsck_path = NULL;
- 
-         assert(node);
-         assert(fstype);
-@@ -227,6 +228,14 @@ static int run_fsck(const char *node, const char *fstype) {
-                 return 0;
-         }
- 
-+        r = find_executable("fsck", &fsck_path);
-+        /* We proceed anyway if we can't determine whether the fsck
-+         * binary for some specific fstype exists,
-+         * but the lack of the main fsck binary should be considered
-+         * an error. */
-+        if (r < 0)
-+                return log_error_errno(r, "Cannot find fsck binary: %m");
-+
-         r = safe_fork("(fsck)",
-                       FORK_RESET_SIGNALS|FORK_RLIMIT_NOFILE_SAFE|FORK_DEATHSIG|FORK_LOG|FORK_STDOUT_TO_STDERR|FORK_CLOSE_ALL_FDS,
-                       &fsck_pid);
-@@ -234,7 +243,7 @@ static int run_fsck(const char *node, const char *fstype) {
-                 return r;
-         if (r == 0) {
-                 /* Child */
--                execl("/sbin/fsck", "/sbin/fsck", "-aTl", node, NULL);
-+                execl(fsck_path, fsck_path, "-aTl", node, NULL);
-                 log_open();
-                 log_error_errno(errno, "Failed to execute fsck: %m");
-                 _exit(FSCK_OPERATIONAL_ERROR);
-diff --git a/src/shared/dissect-image.c b/src/shared/dissect-image.c
-index 4749bdd230..2b6e1418dd 100644
---- a/src/shared/dissect-image.c
-+++ b/src/shared/dissect-image.c
-@@ -1423,6 +1423,7 @@ static int is_loop_device(const char *path) {
- static int run_fsck(int node_fd, const char *fstype) {
-         int r, exit_status;
-         pid_t pid;
-+        _cleanup_free_ char *fsck_path = NULL;
- 
-         assert(node_fd >= 0);
-         assert(fstype);
-@@ -1437,6 +1438,14 @@ static int run_fsck(int node_fd, const char *fstype) {
-                 return 0;
-         }
- 
-+        r = find_executable("fsck", &fsck_path);
-+        /* We proceed anyway if we can't determine whether the fsck
-+         * binary for some specific fstype exists,
-+         * but the lack of the main fsck binary should be considered
-+         * an error. */
-+        if (r < 0)
-+                return log_error_errno(r, "Cannot find fsck binary: %m");
-+
-         r = safe_fork_full(
-                         "(fsck)",
-                         &node_fd, 1, /* Leave the node fd open */
-@@ -1446,7 +1455,7 @@ static int run_fsck(int node_fd, const char *fstype) {
-                 return log_debug_errno(r, "Failed to fork off fsck: %m");
-         if (r == 0) {
-                 /* Child */
--                execl("/sbin/fsck", "/sbin/fsck", "-aT", FORMAT_PROC_FD_PATH(node_fd), NULL);
-+                execl(fsck_path, fsck_path, "-aT", FORMAT_PROC_FD_PATH(node_fd), NULL);
-                 log_open();
-                 log_debug_errno(errno, "Failed to execl() fsck: %m");
-                 _exit(FSCK_OPERATIONAL_ERROR);
-@@ -1454,7 +1463,7 @@ static int run_fsck(int node_fd, const char *fstype) {
- 
-         exit_status = wait_for_terminate_and_check("fsck", pid, 0);
-         if (exit_status < 0)
--                return log_debug_errno(exit_status, "Failed to fork off /sbin/fsck: %m");
-+                return log_debug_errno(exit_status, "Failed to fork off %s: %m", fsck_path);
- 
-         if ((exit_status & ~FSCK_ERROR_CORRECTED) != FSCK_SUCCESS) {
-                 log_debug("fsck failed with exit status %i.", exit_status);
diff --git a/nixpkgs/pkgs/os-specific/linux/systemd/0006-Get-rid-of-a-useless-message-in-user-sessions.patch b/nixpkgs/pkgs/os-specific/linux/systemd/0005-Get-rid-of-a-useless-message-in-user-sessions.patch
index 0a638dfbf0ea..e9f73d7c7726 100644
--- a/nixpkgs/pkgs/os-specific/linux/systemd/0006-Get-rid-of-a-useless-message-in-user-sessions.patch
+++ b/nixpkgs/pkgs/os-specific/linux/systemd/0005-Get-rid-of-a-useless-message-in-user-sessions.patch
@@ -13,10 +13,10 @@ in containers.
  1 file changed, 2 insertions(+), 1 deletion(-)
 
 diff --git a/src/core/manager.c b/src/core/manager.c
-index 380a4e30d7..817acb87b8 100644
+index 4bc8a06bd2..342892490e 100644
 --- a/src/core/manager.c
 +++ b/src/core/manager.c
-@@ -1437,7 +1437,8 @@ static unsigned manager_dispatch_stop_when_bound_queue(Manager *m) {
+@@ -1486,7 +1486,8 @@ static unsigned manager_dispatch_stop_when_bound_queue(Manager *m) {
                  if (!unit_is_bound_by_inactive(u, &culprit))
                          continue;
  
diff --git a/nixpkgs/pkgs/os-specific/linux/systemd/0007-hostnamed-localed-timedated-disable-methods-that-cha.patch b/nixpkgs/pkgs/os-specific/linux/systemd/0006-hostnamed-localed-timedated-disable-methods-that-cha.patch
index 2c4c3f6564e1..2c4c3f6564e1 100644
--- a/nixpkgs/pkgs/os-specific/linux/systemd/0007-hostnamed-localed-timedated-disable-methods-that-cha.patch
+++ b/nixpkgs/pkgs/os-specific/linux/systemd/0006-hostnamed-localed-timedated-disable-methods-that-cha.patch
diff --git a/nixpkgs/pkgs/os-specific/linux/systemd/0008-Fix-hwdb-paths.patch b/nixpkgs/pkgs/os-specific/linux/systemd/0007-Fix-hwdb-paths.patch
index 7777ba7e4259..7777ba7e4259 100644
--- a/nixpkgs/pkgs/os-specific/linux/systemd/0008-Fix-hwdb-paths.patch
+++ b/nixpkgs/pkgs/os-specific/linux/systemd/0007-Fix-hwdb-paths.patch
diff --git a/nixpkgs/pkgs/os-specific/linux/systemd/0009-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch b/nixpkgs/pkgs/os-specific/linux/systemd/0008-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
index 52733a4c4920..300906be04d9 100644
--- a/nixpkgs/pkgs/os-specific/linux/systemd/0009-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
+++ b/nixpkgs/pkgs/os-specific/linux/systemd/0008-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
@@ -88,10 +88,10 @@ index 9e79f84691..1a1c75718c 100644
          (void) mkdir_parents(etc_localtime, 0755);
          r = symlink_atomic(e, etc_localtime);
 diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
-index 65d9e7e398..dd44d529ca 100644
+index e5aa4feb1e..a7a8fae860 100644
 --- a/src/nspawn/nspawn.c
 +++ b/src/nspawn/nspawn.c
-@@ -1915,8 +1915,8 @@ int userns_mkdir(const char *root, const char *path, mode_t mode, uid_t uid, gid
+@@ -1918,8 +1918,8 @@ int userns_mkdir(const char *root, const char *path, mode_t mode, uid_t uid, gid
  static const char *timezone_from_path(const char *path) {
          return PATH_STARTSWITH_SET(
                          path,
diff --git a/nixpkgs/pkgs/os-specific/linux/systemd/0010-localectl-use-etc-X11-xkb-for-list-x11.patch b/nixpkgs/pkgs/os-specific/linux/systemd/0009-localectl-use-etc-X11-xkb-for-list-x11.patch
index fac9916cf3b4..fac9916cf3b4 100644
--- a/nixpkgs/pkgs/os-specific/linux/systemd/0010-localectl-use-etc-X11-xkb-for-list-x11.patch
+++ b/nixpkgs/pkgs/os-specific/linux/systemd/0009-localectl-use-etc-X11-xkb-for-list-x11.patch
diff --git a/nixpkgs/pkgs/os-specific/linux/systemd/0011-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch b/nixpkgs/pkgs/os-specific/linux/systemd/0010-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch
index eec57111b913..eec57111b913 100644
--- a/nixpkgs/pkgs/os-specific/linux/systemd/0011-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch
+++ b/nixpkgs/pkgs/os-specific/linux/systemd/0010-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch
diff --git a/nixpkgs/pkgs/os-specific/linux/systemd/0012-add-rootprefix-to-lookup-dir-paths.patch b/nixpkgs/pkgs/os-specific/linux/systemd/0011-add-rootprefix-to-lookup-dir-paths.patch
index 6e07928d5fbd..6e07928d5fbd 100644
--- a/nixpkgs/pkgs/os-specific/linux/systemd/0012-add-rootprefix-to-lookup-dir-paths.patch
+++ b/nixpkgs/pkgs/os-specific/linux/systemd/0011-add-rootprefix-to-lookup-dir-paths.patch
diff --git a/nixpkgs/pkgs/os-specific/linux/systemd/0013-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch b/nixpkgs/pkgs/os-specific/linux/systemd/0012-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
index 84ac0d882d6d..9d0565a6e767 100644
--- a/nixpkgs/pkgs/os-specific/linux/systemd/0013-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
+++ b/nixpkgs/pkgs/os-specific/linux/systemd/0012-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
@@ -10,10 +10,10 @@ This is needed for NixOS to use such scripts as systemd directory is immutable.
  1 file changed, 1 insertion(+)
 
 diff --git a/src/shutdown/shutdown.c b/src/shutdown/shutdown.c
-index 42111d2772..53467ac229 100644
+index 5dee1b3a92..c08cf80548 100644
 --- a/src/shutdown/shutdown.c
 +++ b/src/shutdown/shutdown.c
-@@ -335,6 +335,7 @@ static void init_watchdog(void) {
+@@ -339,6 +339,7 @@ static void init_watchdog(void) {
  int main(int argc, char *argv[]) {
          static const char* const dirs[] = {
                  SYSTEM_SHUTDOWN_PATH,
diff --git a/nixpkgs/pkgs/os-specific/linux/systemd/0014-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch b/nixpkgs/pkgs/os-specific/linux/systemd/0013-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
index 5fa3fb14f1ff..5fa3fb14f1ff 100644
--- a/nixpkgs/pkgs/os-specific/linux/systemd/0014-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
+++ b/nixpkgs/pkgs/os-specific/linux/systemd/0013-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
diff --git a/nixpkgs/pkgs/os-specific/linux/systemd/0015-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch b/nixpkgs/pkgs/os-specific/linux/systemd/0014-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
index b3d1db340ef8..b3d1db340ef8 100644
--- a/nixpkgs/pkgs/os-specific/linux/systemd/0015-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
+++ b/nixpkgs/pkgs/os-specific/linux/systemd/0014-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
diff --git a/nixpkgs/pkgs/os-specific/linux/systemd/0016-pkg-config-derive-prefix-from-prefix.patch b/nixpkgs/pkgs/os-specific/linux/systemd/0015-pkg-config-derive-prefix-from-prefix.patch
index 3fbfd7f10ab4..3fbfd7f10ab4 100644
--- a/nixpkgs/pkgs/os-specific/linux/systemd/0016-pkg-config-derive-prefix-from-prefix.patch
+++ b/nixpkgs/pkgs/os-specific/linux/systemd/0015-pkg-config-derive-prefix-from-prefix.patch
diff --git a/nixpkgs/pkgs/os-specific/linux/systemd/0017-inherit-systemd-environment-when-calling-generators.patch b/nixpkgs/pkgs/os-specific/linux/systemd/0016-inherit-systemd-environment-when-calling-generators.patch
index 236af4b2c97b..0f67abe795c3 100644
--- a/nixpkgs/pkgs/os-specific/linux/systemd/0017-inherit-systemd-environment-when-calling-generators.patch
+++ b/nixpkgs/pkgs/os-specific/linux/systemd/0016-inherit-systemd-environment-when-calling-generators.patch
@@ -16,10 +16,10 @@ executables that are being called from managers.
  1 file changed, 8 insertions(+)
 
 diff --git a/src/core/manager.c b/src/core/manager.c
-index 817acb87b8..3f31359f8a 100644
+index 342892490e..1117251fe0 100644
 --- a/src/core/manager.c
 +++ b/src/core/manager.c
-@@ -3714,9 +3714,17 @@ static int build_generator_environment(Manager *m, char ***ret) {
+@@ -3771,9 +3771,17 @@ static int build_generator_environment(Manager *m, char ***ret) {
           * adjust generated units to that. Let's pass down some bits of information that are easy for us to
           * determine (but a bit harder for generator scripts to determine), as environment variables. */
  
diff --git a/nixpkgs/pkgs/os-specific/linux/systemd/0018-core-don-t-taint-on-unmerged-usr.patch b/nixpkgs/pkgs/os-specific/linux/systemd/0017-core-don-t-taint-on-unmerged-usr.patch
index 18982ecd04bd..f509eb39ece5 100644
--- a/nixpkgs/pkgs/os-specific/linux/systemd/0018-core-don-t-taint-on-unmerged-usr.patch
+++ b/nixpkgs/pkgs/os-specific/linux/systemd/0017-core-don-t-taint-on-unmerged-usr.patch
@@ -17,10 +17,10 @@ See also: https://github.com/systemd/systemd/issues/24191
  1 file changed, 4 deletions(-)
 
 diff --git a/src/core/manager.c b/src/core/manager.c
-index 3f31359f8a..0c4ec0b4fb 100644
+index 1117251fe0..bf5600a6cf 100644
 --- a/src/core/manager.c
 +++ b/src/core/manager.c
-@@ -4556,10 +4556,6 @@ char* manager_taint_string(const Manager *m) {
+@@ -4617,10 +4617,6 @@ char* manager_taint_string(const Manager *m) {
          if (m->taint_usr)
                  stage[n++] = "split-usr";
  
diff --git a/nixpkgs/pkgs/os-specific/linux/systemd/0019-tpm2_context_init-fix-driver-name-checking.patch b/nixpkgs/pkgs/os-specific/linux/systemd/0018-tpm2_context_init-fix-driver-name-checking.patch
index 8d6eab5ed847..8d6eab5ed847 100644
--- a/nixpkgs/pkgs/os-specific/linux/systemd/0019-tpm2_context_init-fix-driver-name-checking.patch
+++ b/nixpkgs/pkgs/os-specific/linux/systemd/0018-tpm2_context_init-fix-driver-name-checking.patch
diff --git a/nixpkgs/pkgs/os-specific/linux/systemd/0019-bootctl-also-print-efi-files-not-owned-by-systemd-in.patch b/nixpkgs/pkgs/os-specific/linux/systemd/0019-bootctl-also-print-efi-files-not-owned-by-systemd-in.patch
new file mode 100644
index 000000000000..84fc6528b984
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/systemd/0019-bootctl-also-print-efi-files-not-owned-by-systemd-in.patch
@@ -0,0 +1,46 @@
+From bc0f378a1149b59e88e9345e579d62fec7f50cdf Mon Sep 17 00:00:00 2001
+From: Arian van Putten <arian.vanputten@gmail.com>
+Date: Wed, 31 May 2023 13:27:13 +0200
+Subject: [PATCH] bootctl: also print efi files not owned by systemd in status
+
+We should not skip over unknown entries in EFI/BOOT/ but
+also print them out in status so people are aware that they are there.
+
+(cherry picked from commit a680d4fb87bad829989949e5ea4fc6db90453456)
+---
+ src/boot/bootctl-status.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/src/boot/bootctl-status.c b/src/boot/bootctl-status.c
+index 2e2bf1f7e1..f1ac4a9c8a 100644
+--- a/src/boot/bootctl-status.c
++++ b/src/boot/bootctl-status.c
+@@ -225,9 +225,8 @@ static int enumerate_binaries(
+                         return log_error_errno(errno, "Failed to open file '%s' for reading: %m", filename);
+ 
+                 r = get_file_version(fd, &v);
+-                if (r == -ESRCH) /* Not the file we are looking for. */
+-                        continue;
+-                if (r < 0)
++
++                if (r < 0 && r != -ESRCH)
+                         return r;
+ 
+                 if (*previous) { /* Let's output the previous entry now, since now we know that there will be
+@@ -242,10 +241,10 @@ static int enumerate_binaries(
+                 /* Do not output this entry immediately, but store what should be printed in a state
+                  * variable, because we only will know the tree glyph to print (branch or final edge) once we
+                  * read one more entry */
+-                if (r > 0)
+-                        r = asprintf(previous, "/%s/%s (%s%s%s)", path, de->d_name, ansi_highlight(), v, ansi_normal());
+-                else
++                if (r == -ESRCH) /* No systemd-owned file but still interesting to print */
+                         r = asprintf(previous, "/%s/%s", path, de->d_name);
++                else /* if (r >= 0) */
++                        r = asprintf(previous, "/%s/%s (%s%s%s)", path, de->d_name, ansi_highlight(), v, ansi_normal());
+                 if (r < 0)
+                         return log_oom();
+ 
+-- 
+2.39.2 (Apple Git-143)
+
diff --git a/nixpkgs/pkgs/os-specific/linux/systemd/default.nix b/nixpkgs/pkgs/os-specific/linux/systemd/default.nix
index 7275d275f74b..ed4204b9d11a 100644
--- a/nixpkgs/pkgs/os-specific/linux/systemd/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/systemd/default.nix
@@ -82,6 +82,9 @@
 , bpftools
 , libbpf
 
+  # Needed to produce a ukify that works for cross compiling UKIs.
+, targetPackages
+
 , withAcl ? true
 , withAnalyze ? true
 , withApparmor ? true
@@ -145,7 +148,7 @@ assert withUkify -> withEfi;
 let
   wantCurl = withRemote || withImportd;
   wantGcrypt = withResolved || withImportd;
-  version = "253.3";
+  version = "253.6";
 
   # Bump this variable on every (major) version change. See below (in the meson options list) for why.
   # command:
@@ -162,7 +165,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "systemd";
     repo = "systemd-stable";
     rev = "v${version}";
-    hash = "sha256-iy1kyqiVeXIhFJAQ+nYorrXm/xb2gfakyrEfMyNR5l8=";
+    hash = "sha256-LZs6QuBe23W643bTuz+MD2pzHiapsBJBHoFXi/QjzG4=";
   };
 
   # On major changes, or when otherwise required, you *must* reformat the patches,
@@ -174,32 +177,22 @@ stdenv.mkDerivation (finalAttrs: {
     ./0001-Start-device-units-for-uninitialised-encrypted-devic.patch
     ./0002-Don-t-try-to-unmount-nix-or-nix-store.patch
     ./0003-Fix-NixOS-containers.patch
-    ./0004-fsck-look-for-fsck-binary-not-just-in-sbin.patch
-    ./0005-Add-some-NixOS-specific-unit-directories.patch
-    ./0006-Get-rid-of-a-useless-message-in-user-sessions.patch
-    ./0007-hostnamed-localed-timedated-disable-methods-that-cha.patch
-    ./0008-Fix-hwdb-paths.patch
-    ./0009-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
-    ./0010-localectl-use-etc-X11-xkb-for-list-x11.patch
-    ./0011-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch
-    ./0012-add-rootprefix-to-lookup-dir-paths.patch
-    ./0013-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
-    ./0014-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
-    ./0015-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
-    ./0016-pkg-config-derive-prefix-from-prefix.patch
-    ./0017-inherit-systemd-environment-when-calling-generators.patch
-    ./0018-core-don-t-taint-on-unmerged-usr.patch
-    ./0019-tpm2_context_init-fix-driver-name-checking.patch
-
-    (fetchpatch {
-      # https://github.com/systemd/systemd/pull/25948
-      #
-      # [Firmware file size bug]: Some UEFI firmwares fail on large
-      # reads. Now that systemd-boot loads initrd itself, systems with
-      # such firmware won't boot without this fix
-      url = "https://github.com/systemd/systemd/commit/3ed1d966f00b002ed822ca9de116252bd91fe6c3.patch";
-      hash = "sha256-pwXrLTScqgnvfddlzUBZpwsoMrvRLcZPp6e4whMcyL4=";
-    })
+    ./0004-Add-some-NixOS-specific-unit-directories.patch
+    ./0005-Get-rid-of-a-useless-message-in-user-sessions.patch
+    ./0006-hostnamed-localed-timedated-disable-methods-that-cha.patch
+    ./0007-Fix-hwdb-paths.patch
+    ./0008-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
+    ./0009-localectl-use-etc-X11-xkb-for-list-x11.patch
+    ./0010-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch
+    ./0011-add-rootprefix-to-lookup-dir-paths.patch
+    ./0012-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
+    ./0013-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
+    ./0014-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
+    ./0015-pkg-config-derive-prefix-from-prefix.patch
+    ./0016-inherit-systemd-environment-when-calling-generators.patch
+    ./0017-core-don-t-taint-on-unmerged-usr.patch
+    ./0018-tpm2_context_init-fix-driver-name-checking.patch
+    ./0019-bootctl-also-print-efi-files-not-owned-by-systemd-in.patch
   ] ++ lib.optional stdenv.hostPlatform.isMusl (
     let
       oe-core = fetchzip {
@@ -219,7 +212,6 @@ stdenv.mkDerivation (finalAttrs: {
       (musl-patches + "/0012-don-t-fail-if-GLOB_BRACE-and-GLOB_ALTDIRFUNC-is-not-.patch")
       (musl-patches + "/0013-add-missing-FTW_-macros-for-musl.patch")
       (musl-patches + "/0014-Use-uintmax_t-for-handling-rlim_t.patch")
-      (musl-patches + "/0015-test-sizeof.c-Disable-tests-for-missing-typedefs-in-.patch")
       (musl-patches + "/0016-don-t-pass-AT_SYMLINK_NOFOLLOW-flag-to-faccessat.patch")
       (musl-patches + "/0017-Define-glibc-compatible-basename-for-non-glibc-syste.patch")
       (musl-patches + "/0018-Do-not-disable-buffering-when-writing-to-oom_score_a.patch")
@@ -245,6 +237,16 @@ stdenv.mkDerivation (finalAttrs: {
     # BPF does not work with stack protector
     substituteInPlace src/core/bpf/meson.build \
       --replace "clang_flags = [" "clang_flags = [ '-fno-stack-protector',"
+  '' + lib.optionalString withUkify ''
+    substituteInPlace src/ukify/ukify.py \
+      --replace \
+      "'readelf'" \
+      "'${targetPackages.stdenv.cc.bintools.targetPrefix}readelf'"
+    # The objcopy dependency is removed in v254
+    substituteInPlace src/ukify/ukify.py \
+      --replace \
+      "'objcopy'" \
+      "'${targetPackages.stdenv.cc.bintools.targetPrefix}objcopy'"
   '' + (
     let
       # The following patches references to dynamic libraries to ensure that
@@ -518,9 +520,10 @@ stdenv.mkDerivation (finalAttrs: {
     "-Dsysvinit-path="
     "-Dsysvrcnd-path="
 
-    "-Dsulogin-path=${util-linux}/bin/sulogin"
-    "-Dmount-path=${util-linux}/bin/mount"
-    "-Dumount-path=${util-linux}/bin/umount"
+    "-Dsulogin-path=${util-linux.login}/bin/sulogin"
+    "-Dnologin-path=${util-linux.login}/bin/nologin"
+    "-Dmount-path=${lib.getOutput "mount" util-linux}/bin/mount"
+    "-Dumount-path=${lib.getOutput "mount" util-linux}/bin/umount"
     "-Dcreate-log-dirs=false"
 
     # Use cgroupsv2. This is already the upstream default, but better be explicit.
@@ -571,8 +574,8 @@ stdenv.mkDerivation (finalAttrs: {
             "man/systemd-makefs@.service.xml"
           ];
         }
-        { search = "/sbin/swapon"; replacement = "${lib.getBin util-linux}/sbin/swapon"; where = [ "src/core/swap.c" "src/basic/unit-def.h" ]; }
-        { search = "/sbin/swapoff"; replacement = "${lib.getBin util-linux}/sbin/swapoff"; where = [ "src/core/swap.c" ]; }
+        { search = "/sbin/swapon"; replacement = "${lib.getOutput "swap" util-linux}/sbin/swapon"; where = [ "src/core/swap.c" "src/basic/unit-def.h" ]; }
+        { search = "/sbin/swapoff"; replacement = "${lib.getOutput "swap" util-linux}/sbin/swapoff"; where = [ "src/core/swap.c" ]; }
         {
           search = "/bin/echo";
           replacement = "${coreutils}/bin/echo";
@@ -733,6 +736,11 @@ stdenv.mkDerivation (finalAttrs: {
     done
   '' + lib.optionalString withEfi ''
     mv $out/dont-strip-me $out/lib/systemd/boot/efi
+  '' + lib.optionalString withUkify ''
+    # To cross compile a derivation that builds a UKI with ukify, we need to wrap
+    # ukify with the correct binutils. When wrapping, no splicing happens so we
+    # have to explicitly pull binutils from targetPackages.
+    wrapProgram $out/lib/systemd/ukify --set PATH ${lib.makeBinPath [ targetPackages.stdenv.cc.bintools ] }
   '';
 
   disallowedReferences = lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform)
diff --git a/nixpkgs/pkgs/os-specific/linux/tp_smapi/default.nix b/nixpkgs/pkgs/os-specific/linux/tp_smapi/default.nix
index d9b4333d2490..d9c5921d4655 100644
--- a/nixpkgs/pkgs/os-specific/linux/tp_smapi/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/tp_smapi/default.nix
@@ -1,4 +1,15 @@
-{ stdenv, lib, fetchFromGitHub, kernel, writeScript, coreutils, gnugrep, jq, curl, common-updater-scripts, runtimeShell
+{ stdenv
+, lib
+, fetchFromGitHub
+, fetchpatch
+, kernel
+, writeScript
+, coreutils
+, gnugrep
+, jq
+, curl
+, common-updater-scripts
+, runtimeShell
 }:
 
 stdenv.mkDerivation rec {
@@ -6,13 +17,21 @@ stdenv.mkDerivation rec {
   version = "0.43";
 
   src = fetchFromGitHub {
-    owner = "evgeni";
+    owner = "linux-thinkpad";
     repo = "tp_smapi";
     rev = "tp-smapi/${version}";
     sha256 = "1rjb0njckczc2mj05cagvj0lkyvmyk6bw7wkiinv81lw8m90g77g";
-    name = "tp-smapi-${version}";
   };
 
+  patches = [
+    # update DEFINE_SEMAPHORE usage for linux 6.4+
+    # https://github.com/linux-thinkpad/tp_smapi/pull/45
+    (fetchpatch {
+      url = "https://github.com/linux-thinkpad/tp_smapi/commit/0c3398b1acf2a2cabd9cee91dc3fe3d35805fa8b.patch";
+      hash = "sha256-J/WvijrpHGwFOZMMxnHdNin5eh8vViTcNb4nwsCqsLs=";
+    })
+  ];
+
   nativeBuildInputs = kernel.moduleBuildDependencies;
 
   hardeningDisable = [ "pic" ];
@@ -39,7 +58,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "IBM ThinkPad hardware functions driver";
-    homepage = "https://github.com/evgeni/tp_smapi";
+    homepage = "https://github.com/linux-thinkpad/tp_smapi";
     license = lib.licenses.gpl2;
     maintainers = [ ];
     # driver is only ment for linux thinkpads i think  bellow platforms should cover it.
diff --git a/nixpkgs/pkgs/os-specific/linux/trace-cmd/default.nix b/nixpkgs/pkgs/os-specific/linux/trace-cmd/default.nix
index 6b349e70656f..371f66856de5 100644
--- a/nixpkgs/pkgs/os-specific/linux/trace-cmd/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/trace-cmd/default.nix
@@ -1,12 +1,12 @@
 { lib, stdenv, fetchgit, pkg-config, asciidoc, xmlto, docbook_xsl, docbook_xml_dtd_45, libxslt, libtraceevent, libtracefs, zstd, sourceHighlight }:
 stdenv.mkDerivation rec {
   pname = "trace-cmd";
-  version = "3.1.6";
+  version = "3.2";
 
   src = fetchgit {
     url    = "https://git.kernel.org/pub/scm/utils/trace-cmd/trace-cmd.git/";
     rev    = "trace-cmd-v${version}";
-    sha256 = "sha256-qjfeomeExjsx/6XrUaGm5szbL7XVlekGd4Hsuncv8NY=";
+    sha256 = "sha256-KlykIYF4uy1phgWRG5j76FJqgO7XhNnyrTDVTs8YOXY=";
   };
 
   # Don't build and install html documentation
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ libtraceevent libtracefs zstd ];
 
-  outputs = [ "out" "lib" "dev" "man" ];
+  outputs = [ "out" "lib" "dev" "man" "devman" ];
 
   MANPAGE_DOCBOOK_XSL="${docbook_xsl}/xml/xsl/docbook/manpages/docbook.xsl";
 
@@ -59,6 +59,6 @@ stdenv.mkDerivation rec {
     homepage    = "https://www.trace-cmd.org/";
     license     = with licenses; [ lgpl21Only gpl2Only ];
     platforms   = platforms.linux;
-    maintainers = with maintainers; [ thoughtpolice basvandijk ];
+    maintainers = with maintainers; [ thoughtpolice basvandijk wentasah ];
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/trace-cmd/kernelshark.nix b/nixpkgs/pkgs/os-specific/linux/trace-cmd/kernelshark.nix
index e492bc2403fd..23ebbae8d1cb 100644
--- a/nixpkgs/pkgs/os-specific/linux/trace-cmd/kernelshark.nix
+++ b/nixpkgs/pkgs/os-specific/linux/trace-cmd/kernelshark.nix
@@ -5,12 +5,12 @@
 
 mkDerivation rec {
   pname = "kernelshark";
-  version = "2.2.0";
+  version = "2.2.1";
 
   src = fetchgit {
     url = "https://git.kernel.org/pub/scm/utils/trace-cmd/kernel-shark.git/";
     rev = "kernelshark-v${version}";
-    sha256 = "sha256-VkUah8qAlOck9245f/zngtVpHmJdx6eQXqwzLwK2xjU=";
+    hash = "sha256-V25IzPDOt6V03wgIa/AJ0T8mRaGmXYuMCcvbSOKleY0=";
   };
 
   outputs = [ "out" ];
diff --git a/nixpkgs/pkgs/os-specific/linux/trelay/Makefile b/nixpkgs/pkgs/os-specific/linux/trelay/Makefile
new file mode 100644
index 000000000000..3206728dfbf7
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/trelay/Makefile
@@ -0,0 +1,14 @@
+KERNELRELEASE ?= $(shell uname -r)
+KERNEL_DIR  ?= /lib/modules/$(KERNELRELEASE)/build
+PWD := $(shell pwd)
+
+obj-m := trelay.o
+
+all:
+	$(MAKE) -C $(KERNEL_DIR) M=$(PWD) modules
+
+install:
+	$(MAKE) -C $(KERNEL_DIR) M=$(PWD) modules_install
+
+clean:
+	$(MAKE) -C $(KERNEL_DIR) M=$(PWD) clean
diff --git a/nixpkgs/pkgs/os-specific/linux/trelay/default.nix b/nixpkgs/pkgs/os-specific/linux/trelay/default.nix
new file mode 100644
index 000000000000..48148a0b1a0d
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/trelay/default.nix
@@ -0,0 +1,46 @@
+{ stdenv, lib, fetchgit, kernel, kmod }:
+let
+  version = "22.03.5";
+in
+stdenv.mkDerivation {
+  pname = "trelay";
+  version = "${version}-${kernel.version}";
+
+  src = fetchgit {
+    url = "https://git.openwrt.org/openwrt/openwrt.git";
+    rev = "v${version}";
+    hash = "sha256-5f9LvaZUxtfTpTR268QMkEmHUpn/nct+MVa44SBGT5c=";
+    sparseCheckout = [ "package/kernel/trelay/src" ];
+  };
+
+  sourceRoot = "openwrt/package/kernel/trelay/src";
+  hardeningDisable = [ "pic" "format" ];
+  nativeBuildInputs = [ kmod ] ++ kernel.moduleBuildDependencies;
+
+  postPatch = ''
+    cp '${./Makefile}' Makefile
+  '';
+
+  makeFlags = kernel.makeFlags ++ [
+    "KERNELRELEASE=${kernel.modDirVersion}"
+    "KERNEL_DIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+    "INSTALL_MOD_PATH=$(out)"
+  ];
+
+  meta = with lib; {
+    description = "For relaying IP packets between two devices to build a IP bridge between them";
+    longDescription = ''
+      A kernel module that relays ethernet packets between two devices (similar to a bridge),
+      but without any MAC address checks.
+
+      This makes it possible to bridge client mode or ad-hoc mode wifi devices to ethernet VLANs,
+      assuming the remote end uses the same source MAC address as the device that packets are
+      supposed to exit from.
+    '';
+    homepage = "https://github.com/openwrt/openwrt/tree/main/package/kernel/trelay";
+    license = licenses.gpl2Plus;
+    maintainers = [ maintainers.aprl ];
+    platforms = platforms.linux;
+    broken = lib.versionOlder kernel.version "5.10";
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/tuxedo-keyboard/default.nix b/nixpkgs/pkgs/os-specific/linux/tuxedo-keyboard/default.nix
index e6eccaa51d7e..353857de320d 100644
--- a/nixpkgs/pkgs/os-specific/linux/tuxedo-keyboard/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/tuxedo-keyboard/default.nix
@@ -1,14 +1,14 @@
 { lib, stdenv, fetchFromGitHub, kernel, linuxHeaders, pahole }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "tuxedo-keyboard-${kernel.version}";
-  version = "3.2.5";
+  version = "3.2.7";
 
   src = fetchFromGitHub {
     owner = "tuxedocomputers";
     repo = "tuxedo-keyboard";
-    rev = "v${version}";
-    hash = "sha256-pSGshUyim06Sqkp5QFzhUjeIz/N3aORvVt6DEyzQLaU=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-Q0wnejeLGLSDS0GPxQuYUKCAdzbYA66KT0DuWsEKIRs=";
   };
 
   buildInputs = [
@@ -19,25 +19,29 @@ stdenv.mkDerivation rec {
   makeFlags = [ "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build" ];
 
   installPhase = ''
+    runHook preInstall
+
     mkdir -p "$out/lib/modules/${kernel.modDirVersion}"
 
     for module in clevo_acpi.ko clevo_wmi.ko tuxedo_keyboard.ko tuxedo_io/tuxedo_io.ko uniwill_wmi.ko; do
         mv src/$module $out/lib/modules/${kernel.modDirVersion}
     done
+
+    runHook postInstall
   '';
 
-  meta = with lib; {
+  meta = {
+    broken = stdenv.isAarch64 || (lib.versionOlder kernel.version "5.5");
     description = "Keyboard and hardware I/O driver for TUXEDO Computers laptops";
+    homepage = "https://github.com/tuxedocomputers/tuxedo-keyboard/";
+    license = lib.licenses.gpl3Plus;
     longDescription = ''
       This driver provides support for Fn keys, brightness/color/mode for most TUXEDO
       keyboards (except white backlight-only models).
 
       Can be used with the "hardware.tuxedo-keyboard" NixOS module.
     '';
-    homepage = "https://github.com/tuxedocomputers/tuxedo-keyboard/";
-    license = licenses.gpl3Plus;
-    platforms = platforms.linux;
-    broken = stdenv.isAarch64;
-    maintainers = [ maintainers.blanky0230 ];
+    maintainers = [ lib.maintainers.blanky0230 ];
+    platforms = lib.platforms.linux;
   };
-}
+})
diff --git a/nixpkgs/pkgs/os-specific/linux/udisks/2-default.nix b/nixpkgs/pkgs/os-specific/linux/udisks/2-default.nix
index 9b56695e212b..07a9ceaa5173 100644
--- a/nixpkgs/pkgs/os-specific/linux/udisks/2-default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/udisks/2-default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, substituteAll, fetchpatch, pkg-config, gnused, autoreconfHook
+{ lib, stdenv, fetchFromGitHub, substituteAll, pkg-config, gnused, autoreconfHook
 , gtk-doc, acl, systemd, glib, libatasmart, polkit, coreutils, bash, which
 , expat, libxslt, docbook_xsl, util-linux, mdadm, libgudev, libblockdev, parted
 , gobject-introspection, docbook_xml_dtd_412, docbook_xml_dtd_43
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "udisks";
-  version = "2.9.4";
+  version = "2.10.0";
 
   src = fetchFromGitHub {
     owner = "storaged-project";
     repo = "udisks";
     rev = "${pname}-${version}";
-    sha256 = "sha256-MYQztzIyp5kh9t1bCIlj08/gaOmZfuu/ZOwo3F+rZiw=";
+    sha256 = "sha256-M0L2MjVKv7VmtML/JZx0I8vNj+m6KDWGezvcwFqoTNI=";
   };
 
   outputs = [ "out" "man" "dev" ] ++ lib.optional (stdenv.hostPlatform == stdenv.buildPlatform) "devdoc";
@@ -23,7 +23,6 @@ stdenv.mkDerivation rec {
     (substituteAll {
       src = ./fix-paths.patch;
       bash = "${bash}/bin/bash";
-      blkid = "${util-linux}/bin/blkid";
       false = "${coreutils}/bin/false";
       mdadm = "${mdadm}/bin/mdadm";
       mkswap = "${util-linux}/bin/mkswap";
@@ -40,11 +39,6 @@ stdenv.mkDerivation rec {
         xfsprogs ntfs3g parted util-linux
       ];
     })
-    # Fix crash on exit, remove on upgrade to 2.10.
-    (fetchpatch {
-      url = "https://github.com/storaged-project/udisks/commit/6464e3083c27b9e4d97848b9e69e862f265511d5.patch";
-      hash = "sha256-XGprXjJLIL8l4P5MRTHV8GOQR1hpaaFiLgexGnO9Lvg=";
-    })
   ];
 
   strictDeps = true;
@@ -89,7 +83,10 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
-  passthru.tests.vm = nixosTests.udisks2;
+  passthru = {
+    inherit libblockdev;
+    tests.vm = nixosTests.udisks2;
+  };
 
   meta = with lib; {
     description = "A daemon, tools and libraries to access and manipulate disks, storage devices and technologies";
diff --git a/nixpkgs/pkgs/os-specific/linux/udisks/fix-paths.patch b/nixpkgs/pkgs/os-specific/linux/udisks/fix-paths.patch
index 30bc08da8cfa..76d44b96d551 100644
--- a/nixpkgs/pkgs/os-specific/linux/udisks/fix-paths.patch
+++ b/nixpkgs/pkgs/os-specific/linux/udisks/fix-paths.patch
@@ -8,101 +8,12 @@ index ca802cce..bfd1c29e 100644
  #
 -SUBSYSTEM=="block", ENV{ID_FS_USAGE}=="raid", ENV{ID_FS_TYPE}=="linux_raid_member", ENV{UDISKS_MD_MEMBER_LEVEL}=="", IMPORT{program}="/bin/sh -c '/sbin/mdadm --examine --export $tempnode | /bin/sed s/^MD_/UDISKS_MD_MEMBER_/g'"
 +SUBSYSTEM=="block", ENV{ID_FS_USAGE}=="raid", ENV{ID_FS_TYPE}=="linux_raid_member", ENV{UDISKS_MD_MEMBER_LEVEL}=="", IMPORT{program}="@sh@ -c '@mdadm@ --examine --export $tempnode | @sed@ s/^MD_/UDISKS_MD_MEMBER_/g'"
- 
+
 -SUBSYSTEM=="block", KERNEL=="md*", ENV{DEVTYPE}!="partition", IMPORT{program}="/bin/sh -c '/sbin/mdadm --detail --export $tempnode | /bin/sed s/^MD_/UDISKS_MD_/g'"
 +SUBSYSTEM=="block", KERNEL=="md*", ENV{DEVTYPE}!="partition", IMPORT{program}="@sh@ -c '@mdadm@ --detail --export $tempnode | @sed@ s/^MD_/UDISKS_MD_/g'"
- 
+
  LABEL="udisks_probe_end"
- 
-diff --git a/modules/zram/data/udisks2-zram-setup@.service.in b/modules/zram/data/udisks2-zram-setup@.service.in
-index ac868e84..03fdd887 100644
---- a/modules/zram/data/udisks2-zram-setup@.service.in
-+++ b/modules/zram/data/udisks2-zram-setup@.service.in
-@@ -8,7 +8,7 @@ Requires=dev-%i.device
- Type=oneshot
- RemainAfterExit=no
- EnvironmentFile=-@zramconfdir@/%i
--ExecStart=-/bin/sh -c 'if [ -n "$ZRAM_NUM_STR" ]; then echo "$ZRAM_NUM_STR" > /sys/class/block/%i/max_comp_streams; fi'
--ExecStart=-/bin/sh -c 'if [ -n "$ZRAM_DEV_SIZE" ]; then echo "$ZRAM_DEV_SIZE" > /sys/class/block/%i/disksize; fi'
--ExecStart=-/bin/sh -c 'if [ "$SWAP" = "y" ]; then mkswap /dev/%i && swapon /dev/%i; fi'
--# ExecStop=-/bin/sh -c 'echo 1 > /sys/class/block/%i/reset'
-+ExecStart=-@sh@ -c 'if [ -n "$ZRAM_NUM_STR" ]; then echo "$ZRAM_NUM_STR" > /sys/class/block/%i/max_comp_streams; fi'
-+ExecStart=-@sh@ -c 'if [ -n "$ZRAM_DEV_SIZE" ]; then echo "$ZRAM_DEV_SIZE" > /sys/class/block/%i/disksize; fi'
-+ExecStart=-@sh@ -c 'if [ "$SWAP" = "y" ]; then @mkswap@ /dev/%i && @swapon@ /dev/%i; fi'
-+# ExecStop=-@sh@ -c 'echo 1 > /sys/class/block/%i/reset'
-diff --git a/modules/zram/udiskslinuxmanagerzram.c b/modules/zram/udiskslinuxmanagerzram.c
-index f647f653..df81e910 100644
---- a/modules/zram/udiskslinuxmanagerzram.c
-+++ b/modules/zram/udiskslinuxmanagerzram.c
-@@ -243,7 +243,7 @@ create_conf_files (guint64   num_devices,
- 
-       g_snprintf (tmp, 255, "zram%" G_GUINT64_FORMAT, i);
-       filename = g_build_filename (PACKAGE_ZRAMCONF_DIR, tmp, NULL);
--      contents = g_strdup_printf ("#!/bin/bash\n"
-+      contents = g_strdup_printf ("#!@bash@\n"
-                                   "# UDisks2 managed ZRAM configuration\n\n"
-                                   "ZRAM_NUM_STR=%" G_GUINT64_FORMAT "\n"
-                                   "ZRAM_DEV_SIZE=%" G_GUINT64_FORMAT "\n"
-diff --git a/src/tests/install-udisks/runtest.sh b/src/tests/install-udisks/runtest.sh
-index e7df4ed2..ab4356d9 100644
---- a/src/tests/install-udisks/runtest.sh
-+++ b/src/tests/install-udisks/runtest.sh
-@@ -1,4 +1,4 @@
--#!/bin/bash
-+#!@bash@
- # vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
- # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
- #
-diff --git a/src/tests/integration-test b/src/tests/integration-test
-index 07e4e029..3bd8ec51 100755
---- a/src/tests/integration-test
-+++ b/src/tests/integration-test
-@@ -299,7 +299,7 @@ class UDisksTestCase(unittest.TestCase):
-         if not device:
-             device = cls.devname(partition)
-         result = {}
--        cmd = subprocess.Popen(['blkid', '-p', '-o', 'udev', device], stdout=subprocess.PIPE)
-+        cmd = subprocess.Popen(['@blkid@', '-p', '-o', 'udev', device], stdout=subprocess.PIPE)
-         for l in cmd.stdout:
-             (key, value) = l.decode('UTF-8').split('=', 1)
-             result[key] = value.strip()
-@@ -437,7 +437,7 @@ class UDisksTestCase(unittest.TestCase):
-                 f.write('KERNEL=="sr*", ENV{DISK_EJECT_REQUEST}!="?*", '
-                         'ATTRS{model}=="scsi_debug*", '
-                         'ENV{ID_CDROM_MEDIA}=="?*", '
--                        'IMPORT{program}="/sbin/blkid -o udev -p -u noraid $tempnode"\n')
-+                        'IMPORT{program}="@blkid@ -o udev -p -u noraid $tempnode"\n')
-             # reload udev
-             subprocess.call('sync; pkill --signal HUP udevd || '
-                             'pkill --signal HUP systemd-udevd',
-@@ -1142,7 +1142,7 @@ class FS(UDisksTestCase):
-         self.assertFalse(os.access(f, os.X_OK))
- 
-         f = os.path.join(mount_point, 'simple.exe')
--        shutil.copy('/bin/bash', f)
-+        shutil.copy('@bash@', f)
-         self.assertTrue(os.access(f, os.R_OK))
-         self.assertTrue(os.access(f, os.W_OK))
-         self.assertTrue(os.access(f, os.X_OK))
-@@ -1155,7 +1155,7 @@ class FS(UDisksTestCase):
-         self.assertFalse(os.access(f, os.X_OK))
- 
-         f = os.path.join(mount_point, 'subdir', 'subdir.exe')
--        shutil.copy('/bin/bash', f)
-+        shutil.copy('@bash@', f)
-         self.assertTrue(os.access(f, os.R_OK))
-         self.assertTrue(os.access(f, os.W_OK))
-         self.assertTrue(os.access(f, os.X_OK))
-diff --git a/src/tests/storadectl/runtest.sh b/src/tests/storadectl/runtest.sh
-index f03885f9..baca6a93 100644
---- a/src/tests/storadectl/runtest.sh
-+++ b/src/tests/storadectl/runtest.sh
-@@ -1,4 +1,4 @@
--#!/bin/bash
-+#!@bash@
- # vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
- # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
- #
+
 diff --git a/src/tests/test.c b/src/tests/test.c
 index 3ddbdf2c..a87f960a 100644
 --- a/src/tests/test.c
@@ -110,7 +21,7 @@ index 3ddbdf2c..a87f960a 100644
 @@ -71,7 +71,7 @@ test_spawned_job_successful (void)
  {
    UDisksSpawnedJob *job;
- 
+
 -  job = udisks_spawned_job_new ("/bin/true", NULL, getuid (), geteuid (), NULL, NULL);
 +  job = udisks_spawned_job_new ("@true@", NULL, getuid (), geteuid (), NULL, NULL);
    udisks_spawned_job_start (job);
@@ -119,7 +30,7 @@ index 3ddbdf2c..a87f960a 100644
 @@ -84,10 +84,10 @@ test_spawned_job_failure (void)
  {
    UDisksSpawnedJob *job;
- 
+
 -  job = udisks_spawned_job_new ("/bin/false", NULL, getuid (), geteuid (), NULL, NULL);
 +  job = udisks_spawned_job_new ("@false@", NULL, getuid (), geteuid (), NULL, NULL);
    udisks_spawned_job_start (job);
@@ -128,9 +39,9 @@ index 3ddbdf2c..a87f960a 100644
 +                             (gpointer) "Command-line `@false@' exited with non-zero exit status 1: ");
    g_object_unref (job);
  }
- 
+
 @@ -119,7 +119,7 @@ test_spawned_job_cancelled_at_start (void)
- 
+
    cancellable = g_cancellable_new ();
    g_cancellable_cancel (cancellable);
 -  job = udisks_spawned_job_new ("/bin/true", NULL, getuid (), geteuid (), NULL, cancellable);
@@ -140,7 +51,7 @@ index 3ddbdf2c..a87f960a 100644
                               (gpointer) "Operation was cancelled (g-io-error-quark, 19)");
 @@ -144,7 +144,7 @@ test_spawned_job_cancelled_midway (void)
    GCancellable *cancellable;
- 
+
    cancellable = g_cancellable_new ();
 -  job = udisks_spawned_job_new ("/bin/sleep 0.5", NULL, getuid (), geteuid (), NULL, cancellable);
 +  job = udisks_spawned_job_new ("@sleep@ 0.5", NULL, getuid (), geteuid (), NULL, cancellable);
@@ -150,7 +61,7 @@ index 3ddbdf2c..a87f960a 100644
 @@ -197,7 +197,7 @@ test_spawned_job_premature_termination (void)
  {
    UDisksSpawnedJob *job;
- 
+
 -  job = udisks_spawned_job_new ("/bin/sleep 1000", NULL, getuid (), geteuid (), NULL, NULL /* GCancellable */);
 +  job = udisks_spawned_job_new ("@sleep@ 1000", NULL, getuid (), geteuid (), NULL, NULL /* GCancellable */);
    udisks_spawned_job_start (job);
diff --git a/nixpkgs/pkgs/os-specific/linux/uhk-agent/default.nix b/nixpkgs/pkgs/os-specific/linux/uhk-agent/default.nix
index f75d8578833c..435318842048 100644
--- a/nixpkgs/pkgs/os-specific/linux/uhk-agent/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/uhk-agent/default.nix
@@ -1,11 +1,11 @@
 { appimageTools, lib, fetchurl }:
 let
   pname = "uhk-agent";
-  version = "2.1.2";
+  version = "3.0.1";
   src = fetchurl {
     url = "https://github.com/UltimateHackingKeyboard/agent/releases/download/v${version}/UHK.Agent-${version}-linux-x86_64.AppImage";
     name = "${pname}-${version}.AppImage";
-    sha256 = "sha256-G/UT1ec7rWl8xONZnT+dpHAFOQh6/s0Vq7MTqAcmJSA=";
+    sha256 = "sha256-TX7mL6BWAZHZ2W9/BneOt1vxt2slC2Lv6eFWPAgS2a8=";
   };
 
   appimageContents = appimageTools.extract {
diff --git a/nixpkgs/pkgs/os-specific/linux/ulogd/default.nix b/nixpkgs/pkgs/os-specific/linux/ulogd/default.nix
index cb48d20043fd..a79a38389e4a 100644
--- a/nixpkgs/pkgs/os-specific/linux/ulogd/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/ulogd/default.nix
@@ -1,5 +1,6 @@
 { stdenv, lib, fetchurl, gnumake, libnetfilter_acct, libnetfilter_conntrack
 , libnetfilter_log, libmnl, libnfnetlink, automake, autoconf, autogen, libtool
+, postgresql, libmysqlclient, sqlite
 , pkg-config, libpcap, linuxdoc-tools, autoreconfHook, nixosTests }:
 
 stdenv.mkDerivation rec {
@@ -37,6 +38,9 @@ stdenv.mkDerivation rec {
     libmnl
     libnfnetlink
     libpcap
+    postgresql
+    libmysqlclient
+    sqlite
   ];
 
   nativeBuildInputs = [
diff --git a/nixpkgs/pkgs/os-specific/linux/ultrablue-server/default.nix b/nixpkgs/pkgs/os-specific/linux/ultrablue-server/default.nix
index 74a7fe9cfbcd..620189af361d 100644
--- a/nixpkgs/pkgs/os-specific/linux/ultrablue-server/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/ultrablue-server/default.nix
@@ -3,7 +3,7 @@
 , buildGoModule
 }:
 
-buildGoModule {
+buildGoModule rec {
   pname = "ultrablue-server";
   version = "unstable-fosdem2023";
 
@@ -16,7 +16,7 @@ buildGoModule {
     # rev = "6de04af6e353e38c030539c5678e5918f64be37e";
   };
 
-  sourceRoot = "source/server";
+  sourceRoot = "${src.name}/server";
 
   vendorSha256 = "sha256-249LWguTHIF0HNIo8CsE/HWpAtBw4P46VPvlTARLTpw=";
   doCheck = false;
diff --git a/nixpkgs/pkgs/os-specific/linux/unstick/default.nix b/nixpkgs/pkgs/os-specific/linux/unstick/default.nix
index 7856456a3c36..ee82679de4ea 100644
--- a/nixpkgs/pkgs/os-specific/linux/unstick/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/unstick/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "08la3jmmzlf4pm48bf9zx4cqj9gbqalpqy0s57bh5vfsdk74nnhv";
   };
 
-  sourceRoot = "source/src";
+  sourceRoot = "${src.name}/src";
 
   nativeBuildInputs = [ meson ninja pkg-config ];
   buildInputs = [ libseccomp ];
diff --git a/nixpkgs/pkgs/os-specific/linux/upower/default.nix b/nixpkgs/pkgs/os-specific/linux/upower/default.nix
index 9973b1ac5a8a..8772c081e037 100644
--- a/nixpkgs/pkgs/os-specific/linux/upower/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/upower/default.nix
@@ -2,6 +2,7 @@
 , stdenv
 , fetchFromGitLab
 , fetchpatch
+, makeWrapper
 , pkg-config
 , rsync
 , libxslt
@@ -23,27 +24,31 @@
 , useIMobileDevice ? true
 , libimobiledevice
 , withDocs ? (stdenv.buildPlatform == stdenv.hostPlatform)
+, nixosTests
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "upower";
-  version = "1.90.0";
+  version = "1.90.2";
 
-  outputs = [ "out" "dev" ]
+  outputs = [ "out" "dev" "installedTests" ]
     ++ lib.optionals withDocs [ "devdoc" ];
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "upower";
     repo = "upower";
-    rev = "v${version}";
-    hash = "sha256-+C/4dDg6WTLpBgkpNyxjthSdqYdaTLC8vG6jG1LNJ7w=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-7WzMAJuf1czU8ZalsEU/NwCXYqTGvcqEqxFt5ocgt48=";
   };
 
-  # Remove when this is fixed upstream:
-  # https://gitlab.freedesktop.org/upower/upower/-/issues/214
-  patches = lib.optional (stdenv.hostPlatform.system == "i686-linux")
-    ./i686-test-remove-battery-check.patch;
+  patches = lib.optionals (stdenv.hostPlatform.system == "i686-linux") [
+    # Remove when this is fixed upstream:
+    # https://gitlab.freedesktop.org/upower/upower/-/issues/214
+    ./i686-test-remove-battery-check.patch
+  ] ++ [
+    ./installed-tests-path.patch
+  ];
 
   strictDeps = true;
 
@@ -60,6 +65,7 @@ stdenv.mkDerivation rec {
     gettext
     gobject-introspection
     libxslt
+    makeWrapper
     pkg-config
     rsync
   ];
@@ -71,6 +77,14 @@ stdenv.mkDerivation rec {
     systemd
     # Duplicate from nativeCheckInputs until https://github.com/NixOS/nixpkgs/issues/161570 is solved
     umockdev
+
+    # For installed tests.
+    (python3.withPackages (pp: [
+      pp.dbus-python
+      pp.python-dbusmock
+      pp.pygobject3
+      pp.packaging
+    ]))
   ] ++ lib.optionals useIMobileDevice [
     libimobiledevice
   ];
@@ -98,6 +112,7 @@ stdenv.mkDerivation rec {
     "-Dudevhwdbdir=${placeholder "out"}/lib/udev/hwdb.d"
     "-Dintrospection=${if (stdenv.buildPlatform == stdenv.hostPlatform) then "auto" else "disabled"}"
     "-Dgtk-doc=${lib.boolToString withDocs}"
+    "-Dinstalled_test_prefix=${placeholder "installedTests"}"
   ];
 
   doCheck = true;
@@ -105,6 +120,9 @@ stdenv.mkDerivation rec {
   postPatch = ''
     patchShebangs src/linux/integration-test.py
     patchShebangs src/linux/unittest_inspector.py
+
+    substituteInPlace src/linux/integration-test.py \
+      --replace "/usr/share/dbus-1" "$out/share/dbus-1"
   '';
 
   preCheck = ''
@@ -126,35 +144,62 @@ stdenv.mkDerivation rec {
     runHook postCheck
   '';
 
+  postCheck = ''
+    # Undo patchShebangs from postPatch so that it can be replaced with runtime shebang
+    # unittest_inspector.py intentionally not reverted because it would trigger
+    # meson rebuild during install and it is not used at runtime anyway.
+    sed -Ei 's~#!.+/bin/python3~#!/usr/bin/python3~' \
+      ../src/linux/integration-test.py
+  '';
+
   postInstall = ''
     # Move stuff from DESTDIR to proper location.
     # We use rsync to merge the directories.
     for dir in etc var; do
-        rsync --archive "${DESTDIR}/$dir" "$out"
-        rm --recursive "${DESTDIR}/$dir"
+        rsync --archive "$DESTDIR/$dir" "$out"
+        rm --recursive "$DESTDIR/$dir"
     done
-    for o in out dev; do
-        rsync --archive "${DESTDIR}/''${!o}" "$(dirname "''${!o}")"
-        rm --recursive "${DESTDIR}/''${!o}"
+    for o in out dev installedTests; do
+        rsync --archive "$DESTDIR/''${!o}" "$(dirname "''${!o}")"
+        rm --recursive "$DESTDIR/''${!o}"
     done
     # Ensure the DESTDIR is removed.
-    rmdir "${DESTDIR}/nix/store" "${DESTDIR}/nix" "${DESTDIR}"
+    rmdir "$DESTDIR/nix/store" "$DESTDIR/nix" "$DESTDIR"
   '';
 
-  # HACK: We want to install configuration files to $out/etc
-  # but upower should read them from /etc on a NixOS system.
-  # With autotools, it was possible to override Make variables
-  # at install time but Meson does not support this
-  # so we need to convince it to install all files to a temporary
-  # location using DESTDIR and then move it to proper one in postInstall.
-  DESTDIR = "${placeholder "out"}/dest";
+  postFixup = ''
+    wrapProgram "$installedTests/libexec/upower/integration-test.py" \
+      --prefix GI_TYPELIB_PATH : "${lib.makeSearchPath "lib/girepository-1.0" [
+        "$out"
+        umockdev.out
+      ]}" \
+      --prefix PATH : "${lib.makeBinPath [
+        umockdev
+      ]}"
+  '';
+
+  env = {
+    # HACK: We want to install configuration files to $out/etc
+    # but upower should read them from /etc on a NixOS system.
+    # With autotools, it was possible to override Make variables
+    # at install time but Meson does not support this
+    # so we need to convince it to install all files to a temporary
+    # location using DESTDIR and then move it to proper one in postInstall.
+    DESTDIR = "${placeholder "out"}/dest";
+  };
+
+  passthru = {
+    tests = {
+      installedTests = nixosTests.installed-tests.upower;
+    };
+  };
 
   meta = with lib; {
     homepage = "https://upower.freedesktop.org/";
-    changelog = "https://gitlab.freedesktop.org/upower/upower/-/blob/v${version}/NEWS";
+    changelog = "https://gitlab.freedesktop.org/upower/upower/-/blob/v${finalAttrs.version}/NEWS";
     description = "A D-Bus service for power management";
     maintainers = teams.freedesktop.members;
     platforms = platforms.linux;
     license = licenses.gpl2Plus;
   };
-}
+})
diff --git a/nixpkgs/pkgs/os-specific/linux/upower/installed-tests-path.patch b/nixpkgs/pkgs/os-specific/linux/upower/installed-tests-path.patch
new file mode 100644
index 000000000000..367f3eab096b
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/upower/installed-tests-path.patch
@@ -0,0 +1,56 @@
+diff --git a/meson_options.txt b/meson_options.txt
+index eec3659..f064a1b 100644
+--- a/meson_options.txt
++++ b/meson_options.txt
+@@ -6,6 +6,10 @@ option('gtk-doc',
+        type : 'boolean',
+        value : 'true',
+        description : 'Build developer documentation')
++option('installed_test_prefix',
++       type: 'string',
++       value: '',
++       description: 'Prefix for installed tests')
+ option('introspection',
+        type : 'feature',
+        value : 'auto',
+diff --git a/src/meson.build b/src/meson.build
+index a2352ac..c1f25ac 100644
+--- a/src/meson.build
++++ b/src/meson.build
+@@ -85,6 +85,7 @@ install_subdir('does-not-exist', install_dir: historydir, strip_directory : true
+ 
+ cdata = configuration_data()
+ cdata.set('libexecdir', get_option('prefix') / get_option('libexecdir'))
++cdata.set('installed_test_bindir', get_option('installed_test_prefix') / 'libexec' / 'upower')
+ cdata.set('historydir', historydir)
+ 
+ configure_file(
+@@ -147,16 +148,16 @@ if os_backend == 'linux' and gobject_introspection.found()
+         'linux/integration-test.py',
+         'linux/output_checker.py',
+       ],
+-      install_dir: get_option('prefix') / get_option('libexecdir') / 'upower'
++      install_dir: get_option('installed_test_prefix') / 'libexec' / 'upower'
+     )
+     install_subdir('linux/tests/',
+-      install_dir: get_option('prefix') / get_option('libexecdir') / 'upower'
++      install_dir: get_option('installed_test_prefix') / 'libexec' / 'upower'
+     )
+ 
+     configure_file(
+       input: 'upower-integration.test.in',
+       output: 'upower-integration.test',
+-      install_dir: get_option('datadir') / 'installed-tests' / 'upower',
++      install_dir: get_option('installed_test_prefix') / 'share' / 'installed-tests' / 'upower',
+       configuration: cdata
+     )
+ endif
+diff --git a/src/upower-integration.test.in b/src/upower-integration.test.in
+index 151ded0..b0a9bec 100644
+--- a/src/upower-integration.test.in
++++ b/src/upower-integration.test.in
+@@ -1,3 +1,3 @@
+ [Test]
+ Type=session
+-Exec=@libexecdir@/upower/integration-test.py
++Exec=@installed_test_bindir@/integration-test.py
diff --git a/nixpkgs/pkgs/os-specific/linux/util-linux/default.nix b/nixpkgs/pkgs/os-specific/linux/util-linux/default.nix
index 7b98c6bcd9d2..9a335010c872 100644
--- a/nixpkgs/pkgs/os-specific/linux/util-linux/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/util-linux/default.nix
@@ -38,9 +38,24 @@ stdenv.mkDerivation rec {
       url = "https://github.com/util-linux/util-linux/commit/1bd85b64632280d6bf0e86b4ff29da8b19321c5f.diff";
       hash = "sha256-dgu4de5ul/si7Vzwe8lr9NvsdI1CWfDQKuqvARaY6sE=";
     })
+
+    # FIXME: backport bcache detection fixes, remove in next release
+    (fetchpatch {
+      url = "https://github.com/util-linux/util-linux/commit/158639a2a4c6e646fd4fa0acb5f4743e65daa415.diff";
+      hash = "sha256-9F1OQFxKuI383u6MVy/UM15B6B+tkZFRwuDbgoZrWME=";
+    })
+    (fetchpatch {
+      url = "https://github.com/util-linux/util-linux/commit/00a19fb8cdfeeae30a6688ac6b490e80371b2257.diff";
+      hash = "sha256-w1S6IKSoL6JhVew9t6EemNRc/nrJQ5oMqFekcx0kno8=";
+    })
   ];
 
-  outputs = [ "bin" "dev" "out" "lib" "man" ];
+  # We separate some of the utilities into their own outputs. This
+  # allows putting together smaller systems depending on only part of
+  # the greater util-linux toolset.
+  # Compatibility is maintained by symlinking the binaries from the
+  # smaller outputs in the bin output.
+  outputs = [ "bin" "dev" "out" "lib" "man" ] ++ lib.optionals stdenv.isLinux [ "mount" ] ++ [ "login" ] ++ lib.optionals stdenv.isLinux [ "swap" ];
   separateDebugInfo = true;
 
   postPatch = ''
@@ -95,7 +110,24 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  postInstall = ''
+  postInstall = lib.optionalString stdenv.isLinux ''
+    moveToOutput bin/mount "$mount"
+    moveToOutput bin/umount "$mount"
+    ln -svf "$mount/bin/"* $bin/bin/
+    '' + ''
+
+    moveToOutput sbin/nologin "$login"
+    moveToOutput sbin/sulogin "$login"
+    prefix=$login _moveSbin
+    ln -svf "$login/bin/"* $bin/bin/
+    '' + lib.optionalString stdenv.isLinux ''
+
+    moveToOutput sbin/swapon "$swap"
+    moveToOutput sbin/swapoff "$swap"
+    prefix=$swap _moveSbin
+    ln -svf "$swap/bin/"* $bin/bin/
+    '' + ''
+
     installShellCompletion --bash bash-completion/*
   '';
 
diff --git a/nixpkgs/pkgs/os-specific/linux/vdo/default.nix b/nixpkgs/pkgs/os-specific/linux/vdo/default.nix
index 669f67e09f34..11597c9ed653 100644
--- a/nixpkgs/pkgs/os-specific/linux/vdo/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/vdo/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vdo";
-  version = "8.2.0.2";  # bump this version with kvdo
+  version = "8.2.2.2";  # bump this version with kvdo
 
   src = fetchFromGitHub {
     owner = "dm-vdo";
     repo = pname;
     rev = version;
-    hash = "sha256-IP/nL4jQ+rIWuUxXUiBtlIKTMZCNelvxgTfTcaB1it0=";
+    hash = "sha256-+2w9jzJemI2xr+i/Jd5TIBZ/o8Zv+Ett0fbJbkOD7KI=";
   };
 
   nativeBuildInputs = [
diff --git a/nixpkgs/pkgs/os-specific/linux/virtio_vmmci/default.nix b/nixpkgs/pkgs/os-specific/linux/virtio_vmmci/default.nix
index d18818a10de8..7c6d57273be9 100644
--- a/nixpkgs/pkgs/os-specific/linux/virtio_vmmci/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/virtio_vmmci/default.nix
@@ -7,7 +7,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "voutilad";
     repo = "virtio_vmmci";
-    rev = "${version}";
+    rev = version;
     hash = "sha256-ZHslYYZFjM3wp0W5J3/WwCtQ2wDzT1jNc26Z/giTC8g=";
   };
 
diff --git a/nixpkgs/pkgs/os-specific/linux/vmm_clock/default.nix b/nixpkgs/pkgs/os-specific/linux/vmm_clock/default.nix
index 648a61b5e880..7ce99f40df1f 100644
--- a/nixpkgs/pkgs/os-specific/linux/vmm_clock/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/vmm_clock/default.nix
@@ -7,7 +7,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "voutilad";
     repo = "vmm_clock";
-    rev = "${version}";
+    rev = version;
     hash = "sha256-8z/N/dbkeFd40sH7jatNmSS62B88tC0jVgNljhxslOo=";
   };
 
diff --git a/nixpkgs/pkgs/os-specific/linux/wiringpi/default.nix b/nixpkgs/pkgs/os-specific/linux/wiringpi/default.nix
index eed71188eb07..e2412b37aab5 100644
--- a/nixpkgs/pkgs/os-specific/linux/wiringpi/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/wiringpi/default.nix
@@ -18,7 +18,7 @@ let
   }: stdenv.mkDerivation rec {
     pname = "wiringpi-${subprj}";
     inherit version src;
-    sourceRoot = "source/${subprj}";
+    sourceRoot = "${src.name}/${subprj}";
     inherit buildInputs;
     # Remove (meant for other OSs) lines from Makefiles
     preInstall = ''
diff --git a/nixpkgs/pkgs/os-specific/linux/wooting-udev-rules/default.nix b/nixpkgs/pkgs/os-specific/linux/wooting-udev-rules/default.nix
index f34e106727c1..8231e3e3ea33 100644
--- a/nixpkgs/pkgs/os-specific/linux/wooting-udev-rules/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/wooting-udev-rules/default.nix
@@ -2,9 +2,9 @@
 
 stdenv.mkDerivation rec {
   pname = "wooting-udev-rules";
-  version = "20210525";
+  version = "unstable-2023-03-31";
 
-  # Source: https://wooting.helpscoutdocs.com/article/68-wootility-configuring-device-access-for-wootility-under-linux-udev-rules
+  # Source: https://help.wooting.io/en/article/wootility-configuring-device-access-for-wootility-under-linux-udev-rules-r6lb2o/
   src = [ ./wooting.rules ];
 
   dontUnpack = true;
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    homepage = "https://wooting.helpscoutdocs.com/article/34-linux-udev-rules";
+    homepage = "https://help.wooting.io/en/article/wootility-configuring-device-access-for-wootility-under-linux-udev-rules-r6lb2o/";
     description = "udev rules that give NixOS permission to communicate with Wooting keyboards";
     platforms = platforms.linux;
     license = "unknown";
diff --git a/nixpkgs/pkgs/os-specific/linux/wooting-udev-rules/wooting.rules b/nixpkgs/pkgs/os-specific/linux/wooting-udev-rules/wooting.rules
index a243f68ed133..365627fa1aec 100644
--- a/nixpkgs/pkgs/os-specific/linux/wooting-udev-rules/wooting.rules
+++ b/nixpkgs/pkgs/os-specific/linux/wooting-udev-rules/wooting.rules
@@ -20,7 +20,6 @@ SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1101", MODE:="0660
 SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1102", MODE:="0660", GROUP="input"
 SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1102", MODE:="0660", GROUP="input"
 
-
 # Wooting Two
 SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1200", MODE:="0660", GROUP="input"
 SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1200", MODE:="0660", GROUP="input"
@@ -57,6 +56,19 @@ SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1222", MODE:="0660
 # Wooting Two HE update mode
 SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="122f", MODE:="0660", GROUP="input"
 
+# Wooting Two HE (ARM)
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1230", MODE:="0660", GROUP="input"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1230", MODE:="0660", GROUP="input"
+# Wooting Two HE Alt-gamepad mode
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1231", MODE:="0660", GROUP="input"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1231", MODE:="0660", GROUP="input"
+# Wooting Two HE 2nd Alt-gamepad mode
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1232", MODE:="0660", GROUP="input"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1232", MODE:="0660", GROUP="input"
+
+# Wooting Two HE (ARM) update mode
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="123f", MODE:="0660", GROUP="input"
+
 # Wooting 60HE
 SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1300", MODE:="0660", GROUP="input"
 SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1300", MODE:="0660", GROUP="input"
diff --git a/nixpkgs/pkgs/os-specific/linux/wpa_supplicant/default.nix b/nixpkgs/pkgs/os-specific/linux/wpa_supplicant/default.nix
index ba4fe8356ce7..621cd5d79a27 100644
--- a/nixpkgs/pkgs/os-specific/linux/wpa_supplicant/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/wpa_supplicant/default.nix
@@ -48,6 +48,7 @@ stdenv.mkDerivation rec {
     CONFIG_HS20=y
     CONFIG_HT_OVERRIDES=y
     CONFIG_IEEE80211AC=y
+    CONFIG_IEEE80211AX=y
     CONFIG_IEEE80211N=y
     CONFIG_IEEE80211R=y
     CONFIG_IEEE80211W=y
@@ -56,6 +57,7 @@ stdenv.mkDerivation rec {
     CONFIG_LIBNL32=y
     CONFIG_OWE=y
     CONFIG_P2P=y
+    CONFIG_SAE_PK=y
     CONFIG_TDLS=y
     CONFIG_TLS=openssl
     CONFIG_TLSV11=y
diff --git a/nixpkgs/pkgs/os-specific/linux/x86info/default.nix b/nixpkgs/pkgs/os-specific/linux/x86info/default.nix
index db5b040da3a2..f330fbbe6c7a 100644
--- a/nixpkgs/pkgs/os-specific/linux/x86info/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/x86info/default.nix
@@ -26,6 +26,9 @@ stdenv.mkDerivation rec {
     pciutils
   ];
 
+  # causes redefinition of _FORTIFY_SOURCE
+  hardeningDisable = [ "fortify3" ];
+
   postBuild = ''
     patchShebangs lsmsr/createheader.py
     make -C lsmsr
diff --git a/nixpkgs/pkgs/os-specific/linux/zfs/stable.nix b/nixpkgs/pkgs/os-specific/linux/zfs/stable.nix
index 77ea4bb84b4b..5680f93e21a0 100644
--- a/nixpkgs/pkgs/os-specific/linux/zfs/stable.nix
+++ b/nixpkgs/pkgs/os-specific/linux/zfs/stable.nix
@@ -2,6 +2,7 @@
 , kernel ? null
 , stdenv
 , linuxKernel
+, removeLinuxDRM ? false
 , ...
 } @ args:
 
@@ -11,10 +12,10 @@ in
 callPackage ./generic.nix args {
   # check the release notes for compatible kernels
   kernelCompatible =
-    if stdenv'.isx86_64
+    if stdenv'.isx86_64 || removeLinuxDRM
     then kernel.kernelOlder "6.4"
     else kernel.kernelOlder "6.2";
-  latestCompatibleLinuxPackages = linuxKernel.packages.linux_6_3;
+  latestCompatibleLinuxPackages = linuxKernel.packages.linux_6_1;
 
   # this package should point to the latest release.
   version = "2.1.12";
diff --git a/nixpkgs/pkgs/os-specific/linux/zfs/unstable.nix b/nixpkgs/pkgs/os-specific/linux/zfs/unstable.nix
index b8cf789e8ffa..832eb66c02e5 100644
--- a/nixpkgs/pkgs/os-specific/linux/zfs/unstable.nix
+++ b/nixpkgs/pkgs/os-specific/linux/zfs/unstable.nix
@@ -2,6 +2,7 @@
 , kernel ? null
 , stdenv
 , linuxKernel
+, removeLinuxDRM ? false
 , ...
 } @ args:
 
@@ -10,22 +11,19 @@ let
 in
 callPackage ./generic.nix args {
   # check the release notes for compatible kernels
-  # NOTE:
-  #   zfs-2.1.9<=x<=2.1.10 is broken with aarch64-linux-6.2
-  #   for future releases, please delete this condition.
-  kernelCompatible = if stdenv'.isx86_64
-    then kernel.kernelOlder "6.3"
+  kernelCompatible = if stdenv'.isx86_64 || removeLinuxDRM
+    then kernel.kernelOlder "6.4"
     else kernel.kernelOlder "6.2";
+
   latestCompatibleLinuxPackages = linuxKernel.packages.linux_6_1;
 
   # this package should point to a version / git revision compatible with the latest kernel release
   # IMPORTANT: Always use a tagged release candidate or commits from the
   # zfs-<version>-staging branch, because this is tested by the OpenZFS
   # maintainers.
-  version = "2.1.12-staging-2023-04-18";
-  rev = "e25f9131d679692704c11dc0c1df6d4585b70c35";
+  version = "2.1.12";
 
-  sha256 = "tJLwyqUj1l5F0WKZDeMGrEFa8fc/axKqm31xtN51a5M=";
+  sha256 = "eYUR5d4gpTrlFu6j1uL83DWL9uPGgAUDRdSEb73V5i4=";
 
   isUnstable = true;
 }
diff --git a/nixpkgs/pkgs/os-specific/windows/default.nix b/nixpkgs/pkgs/os-specific/windows/default.nix
index c34f97a17db2..12859de8a20f 100644
--- a/nixpkgs/pkgs/os-specific/windows/default.nix
+++ b/nixpkgs/pkgs/os-specific/windows/default.nix
@@ -20,7 +20,7 @@ lib.makeScope newScope (self: with self; {
   crossThreadsStdenv = overrideCC crossLibcStdenv
     (if stdenv.hostPlatform.useLLVM or false
      then buildPackages.llvmPackages_8.clangNoLibcxx
-     else buildPackages.gccCrossStageStatic.override (old: {
+     else buildPackages.gccWithoutTargetLibc.override (old: {
        bintools = old.bintools.override {
          libc = libcCross;
        };
@@ -33,6 +33,10 @@ lib.makeScope newScope (self: with self; {
     stdenv = crossThreadsStdenv;
   };
 
+  mcfgthreads_pre_gcc_13 = callPackage ./mcfgthreads/pre_gcc_13.nix {
+    stdenv = crossThreadsStdenv;
+  };
+
   mcfgthreads = callPackage ./mcfgthreads {
     stdenv = crossThreadsStdenv;
   };
diff --git a/nixpkgs/pkgs/os-specific/windows/mcfgthreads/default.nix b/nixpkgs/pkgs/os-specific/windows/mcfgthreads/default.nix
index 45c80ab89796..e0635efd0a54 100644
--- a/nixpkgs/pkgs/os-specific/windows/mcfgthreads/default.nix
+++ b/nixpkgs/pkgs/os-specific/windows/mcfgthreads/default.nix
@@ -2,22 +2,17 @@
 
 stdenv.mkDerivation {
   pname = "mcfgthreads";
-  version = "git";
+  version = "unstable-2023-06-06";
 
   src = fetchFromGitHub {
     owner = "lhmouse";
     repo = "mcfgthread";
-    rev = "c446cf4fcdc262fc899a188a4bb7136284c34222";
-    sha256 = "1ib90lrd4dz8irq4yvzwhxqa86i5vxl2q2z3z04sf1i8hw427p2f";
+    rev = "f0a335ce926906d634c787249a89220045bf0f7e";
+    hash = "sha256-PLGIyoLdWgWvkHgRe0vHLIvnCxFpmHtbjS8xRhNM9Xw=";
   };
 
   outputs = [ "out" "dev" ];
 
-  # Don't want prebuilt binaries sneaking in.
-  postUnpack = ''
-    rm -r "$sourceRoot/debug" "$sourceRoot/release"
-  '';
-
   nativeBuildInputs = [
     autoreconfHook
   ];
diff --git a/nixpkgs/pkgs/os-specific/windows/mcfgthreads/pre_gcc_13.nix b/nixpkgs/pkgs/os-specific/windows/mcfgthreads/pre_gcc_13.nix
new file mode 100644
index 000000000000..6be64814c93a
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/windows/mcfgthreads/pre_gcc_13.nix
@@ -0,0 +1,24 @@
+{ stdenv, fetchFromGitHub, autoreconfHook }:
+
+stdenv.mkDerivation {
+  pname = "mcfgthreads";
+  version = "git"; # unstable-2021-03-12, not in any branch
+
+  src = fetchFromGitHub {
+    owner = "lhmouse";
+    repo = "mcfgthread";
+    rev = "c446cf4fcdc262fc899a188a4bb7136284c34222";
+    sha256 = "1ib90lrd4dz8irq4yvzwhxqa86i5vxl2q2z3z04sf1i8hw427p2f";
+  };
+
+  outputs = [ "out" "dev" ];
+
+  # Don't want prebuilt binaries sneaking in.
+  postUnpack = ''
+    rm -r "$sourceRoot/debug" "$sourceRoot/release"
+  '';
+
+  nativeBuildInputs = [
+    autoreconfHook
+  ];
+}