Merge branch 'nixos-unstable-small' of https://github.com/NixOS/nixpkgs

Conflicts:
	nixpkgs/pkgs/build-support/go/module.nix

60 files changed, 571 insertions, 360 deletions

diff --git a/nixpkgs/pkgs/os-specific/bsd/netbsd/default.nix b/nixpkgs/pkgs/os-specific/bsd/netbsd/default.nix
index c44936ddcb47..79d46732bd6c 100644
--- a/nixpkgs/pkgs/os-specific/bsd/netbsd/default.nix
+++ b/nixpkgs/pkgs/os-specific/bsd/netbsd/default.nix
@@ -766,11 +766,11 @@ in makeScopeWithSplicing' {
     version = "9.2";
     sha256 = "0pd0dggl3w4bv5i5h0s1wrc8hr66n4hkv3zlklarwfdhc692fqal";
     buildInputs = with self; [ libterminfo ];
-    env.NIX_CFLAGS_COMPILE = toString [
+    env.NIX_CFLAGS_COMPILE = toString ([
       "-D__scanflike(a,b)="
       "-D__va_list=va_list"
       "-D__warn_references(a,b)="
-    ] ++ lib.optional stdenv.isDarwin "-D__strong_alias(a,b)=";
+    ] ++ lib.optional stdenv.isDarwin "-D__strong_alias(a,b)=");
     propagatedBuildInputs = with self; compatIfNeeded;
     MKDOC = "no"; # missing vfontedpr
     makeFlags = defaultMakeFlags ++ [ "LIBDO.terminfo=${self.libterminfo}/lib" ];
diff --git a/nixpkgs/pkgs/os-specific/darwin/aldente/default.nix b/nixpkgs/pkgs/os-specific/darwin/aldente/default.nix
index 245ba81e2914..a67efd3367d4 100644
--- a/nixpkgs/pkgs/os-specific/darwin/aldente/default.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/aldente/default.nix
@@ -6,11 +6,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "aldente";
-  version = "1.24";
+  version = "1.24.1";
 
   src = fetchurl {
     url = "https://github.com/davidwernhart/aldente-charge-limiter/releases/download/${finalAttrs.version}/AlDente.dmg";
-    hash = "sha256-5byGKtVgKiE8m0+GXDtUpTwQpuUj4lv0hPOl4jhH9wk=";
+    hash = "sha256-vOv52SrUki2f9vGzYy8dhVJVxna2ZvhtG6WbKjCv3gA=";
   };
 
   dontBuild = true;
diff --git a/nixpkgs/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix b/nixpkgs/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix
index fe0d0ca63ea9..a02445adb33b 100644
--- a/nixpkgs/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix
@@ -94,6 +94,7 @@ let
     Libsystem = callPackage ./libSystem.nix { };
     LibsystemCross = pkgs.darwin.Libsystem;
     libcharset = callPackage ./libcharset.nix { };
+    libcompression = callPackage ./libcompression.nix { };
     libunwind = callPackage ./libunwind.nix { };
     libnetwork = callPackage ./libnetwork.nix { };
     libpm = callPackage ./libpm.nix { };
diff --git a/nixpkgs/pkgs/os-specific/darwin/apple-sdk-11.0/libcompression.nix b/nixpkgs/pkgs/os-specific/darwin/apple-sdk-11.0/libcompression.nix
new file mode 100644
index 000000000000..92a45b7c5a50
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/darwin/apple-sdk-11.0/libcompression.nix
@@ -0,0 +1,20 @@
+{ stdenvNoCC, buildPackages, MacOSX-SDK }:
+
+let self = stdenvNoCC.mkDerivation {
+  pname = "libcompression";
+  version = MacOSX-SDK.version;
+
+  dontUnpack = true;
+  dontBuild = true;
+
+  installPhase = ''
+    mkdir -p $out/lib
+    cp ${MacOSX-SDK}/usr/lib/libcompression* $out/lib
+  '';
+
+  passthru = {
+    tbdRewrites = {
+      const."/usr/lib/libcompression.dylib" = "${self}/lib/libcompression.dylib";
+    };
+  };
+}; in self
diff --git a/nixpkgs/pkgs/os-specific/darwin/asitop/default.nix b/nixpkgs/pkgs/os-specific/darwin/asitop/default.nix
index 071b6324df3e..3ac385ec08ff 100644
--- a/nixpkgs/pkgs/os-specific/darwin/asitop/default.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/asitop/default.nix
@@ -5,14 +5,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "asitop";
-  version = "0.0.23";
+  version = "0.0.24";
   format = "setuptools";
 
   disabled = python3.pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-BNncgQRNAd6Pgur5D1xVQi3LSsijSAYIYvhsuiVyi9Q=";
+    hash = "sha256-Xfe1kwRXKpSPcc+UuHrcYThpqKh6kzWVsbPia/QsPjc=";
   };
 
   # has no tests
diff --git a/nixpkgs/pkgs/os-specific/darwin/raycast/default.nix b/nixpkgs/pkgs/os-specific/darwin/raycast/default.nix
index 94476ef303ea..6a466b6fd601 100644
--- a/nixpkgs/pkgs/os-specific/darwin/raycast/default.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/raycast/default.nix
@@ -6,12 +6,12 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "raycast";
-  version = "1.61.2";
+  version = "1.64.4";
 
   src = fetchurl {
     name = "Raycast.dmg";
     url = "https://releases.raycast.com/releases/${finalAttrs.version}/download?build=universal";
-    hash = "sha256-MHJbVIVVDcuXig3E52wCnegt1mmRh9+kYbEL6MWjdqQ=";
+    hash = "sha256-ZnDr4kld4hHojkr5qDhtR6LH2mstimX+ImkD6zxk5Oc=";
   };
 
   dontPatch = true;
diff --git a/nixpkgs/pkgs/os-specific/darwin/yabai/default.nix b/nixpkgs/pkgs/os-specific/darwin/yabai/default.nix
index 417d25400a47..fd63ee56d98f 100644
--- a/nixpkgs/pkgs/os-specific/darwin/yabai/default.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/yabai/default.nix
@@ -17,7 +17,7 @@
 
 let
   pname = "yabai";
-  version = "6.0.1";
+  version = "6.0.2";
 
   test-version = testers.testVersion {
     package = yabai;
@@ -53,7 +53,7 @@ in
 
     src = fetchzip {
       url = "https://github.com/koekeishiya/yabai/releases/download/v${version}/yabai-v${version}.tar.gz";
-      hash = "sha256-CXkGVoJcGSkooxe7eIhwaM6FkOI45NVw5jdLJAzgFBM=";
+      hash = "sha256-aFM0rtHrHsLEziDWhRwqeCy70dSAOAX4HDpqHqvnoWs=";
     };
 
     nativeBuildInputs = [
@@ -89,7 +89,7 @@ in
       owner = "koekeishiya";
       repo = "yabai";
       rev = "v${version}";
-      hash = "sha256-u+MkGd/rkT1RVkzC2IcAcFM9eClFdj3WBFnftUVwkwc=";
+      hash = "sha256-VI7Gu5Y50Ed65ZUrseMXwmW/iovlRbAJGlPD7Ooajqw=";
     };
 
     nativeBuildInputs = [
diff --git a/nixpkgs/pkgs/os-specific/linux/apparmor/default.nix b/nixpkgs/pkgs/os-specific/linux/apparmor/default.nix
index ed1e31cc40eb..99c1000f0e4c 100644
--- a/nixpkgs/pkgs/os-specific/linux/apparmor/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/apparmor/default.nix
@@ -28,7 +28,7 @@ let
     homepage = "https://apparmor.net/";
     description = "A mandatory access control system - ${component}";
     license = with licenses; [ gpl2Only lgpl21Only ];
-    maintainers = with maintainers; [ julm thoughtpolice ajs124 ];
+    maintainers = with maintainers; [ julm thoughtpolice ] ++ teams.helsinki-systems.members;
     platforms = platforms.linux;
   };
 
diff --git a/nixpkgs/pkgs/os-specific/linux/batman-adv/default.nix b/nixpkgs/pkgs/os-specific/linux/batman-adv/default.nix
index 4300d576b8d9..ac1e1f8038dd 100644
--- a/nixpkgs/pkgs/os-specific/linux/batman-adv/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/batman-adv/default.nix
@@ -1,7 +1,7 @@
 { lib
 , stdenv
 , fetchurl
-, fetchpatch
+, fetchpatch2
 , kernel
 }:
 
@@ -16,6 +16,14 @@ stdenv.mkDerivation rec {
     sha256 = cfg.sha256.${pname};
   };
 
+  patches = [
+    # batman-adv: compat: Fix skb_vlan_eth_hdr conflict in stable kernels
+    (fetchpatch2 {
+      url = "https://git.open-mesh.org/batman-adv.git/commitdiff_plain/be69e50e8c249ced085d41ddd308016c1c692174?hp=74d3c5e1c682a9efe31b75e8986668081a4b5341";
+      sha256 = "sha256-yfEiU74wuMSKal/6mwzgdccqDMEv4P7CkAeiSAEwvjA=";
+    })
+  ];
+
   nativeBuildInputs = kernel.moduleBuildDependencies;
   makeFlags = kernel.makeFlags ++ [
     "KERNELPATH=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
diff --git a/nixpkgs/pkgs/os-specific/linux/bpftune/default.nix b/nixpkgs/pkgs/os-specific/linux/bpftune/default.nix
index c2fd9d3f6a5e..86c706ac2702 100644
--- a/nixpkgs/pkgs/os-specific/linux/bpftune/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/bpftune/default.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "bpftune";
-  version = "unstable-2023-09-11";
+  version = "unstable-2023-12-20";
 
   src = fetchFromGitHub {
     owner = "oracle";
     repo = "bpftune";
-    rev = "22926812a555eac910eac0699100bac0f8776f1b";
-    hash = "sha256-BflJc5lYWYFIo9LzKfb34F4V1qOI8ywVjnzOLz605DI=";
+    rev = "0e6bca2e5880fcbaac6478c4042f5f9314e61463";
+    hash = "sha256-y9WQrQb9U5YdzKAR63FzC8V1+jZL027pzAmQPpgM3jM=";
   };
 
   postPatch = ''
diff --git a/nixpkgs/pkgs/os-specific/linux/dbus-broker/default.nix b/nixpkgs/pkgs/os-specific/linux/dbus-broker/default.nix
index 847f76a528ce..5180917623e9 100644
--- a/nixpkgs/pkgs/os-specific/linux/dbus-broker/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/dbus-broker/default.nix
@@ -28,28 +28,31 @@ let
   #
   # If that changes, we can always break them out, but they are essentially
   # part of the dbus-broker project, just in separate repositories.
-  c-dvar = dep { pname = "c-dvar"; version = "1.0.0"; hash = "sha256-P7y7gUHXQn2eyS6IcV7m7yGy4VGtQ2orgBkS7Y729ZY="; buildInputs = [ c-stdaux c-utf8 ]; };
-  c-ini = dep { pname = "c-ini"; version = "1.0.0"; hash = "sha256-VKxoGexMcquakMmiH5IJt0382TjkV1FLncTSyEqf4X0="; buildInputs = [ c-list c-rbtree c-stdaux c-utf8 ]; };
+  c-dvar = dep { pname = "c-dvar"; version = "1.1.0"; hash = "sha256-p/C+BktclVseCtZJ1Q/YK03vP2ClnYRLB1Vmj2OQJD4="; buildInputs = [ c-stdaux c-utf8 ]; };
+  c-ini = dep { pname = "c-ini"; version = "1.1.0"; hash = "sha256-wa7aNl20hkb/83c4AkQ/0YFDdmBs4XGW+WLUtBWIC98="; buildInputs = [ c-list c-rbtree c-stdaux c-utf8 ]; };
   c-list = dep { pname = "c-list"; version = "3.1.0"; hash = "sha256-fp3EAqcbFCLaT2EstLSzwP2X13pi2EFpFAullhoCtpw="; };
-  c-rbtree = dep { pname = "c-rbtree"; version = "3.1.0"; hash = "sha256-ozVzL6FllAn8eHbso0RZc/+PGWwEp6r/R1MR+r4Bi/4="; buildInputs = [ c-stdaux ]; };
-  c-shquote = dep { pname = "c-shquote"; version = "1.0.0"; hash = "sha256-Ze1enX0VJ6Xi5e4EhWzaiHc7PnuaifrUP+JuJnauv5c="; buildInputs = [ c-stdaux ]; };
-  c-stdaux = dep { pname = "c-stdaux"; version = "1.4.0"; hash = "sha256-gEqXVBAUE0dHD03ina9QbEP26NU12cHKRpuD7GoPmDs="; };
-  c-utf8 = dep { pname = "c-utf8"; version = "1.0.0"; hash = "sha256-QEnjmfQ6kxJdsHfyRgXAlP+oGrKLYQ0m9r+D2L+pizI="; buildInputs = [ c-stdaux ]; };
+  c-rbtree = dep { pname = "c-rbtree"; version = "3.2.0"; hash = "sha256-dTMeawhPLRtHvMXfXCrT5iCdoh7qS3v+raC6c+t+X38="; buildInputs = [ c-stdaux ]; };
+  c-shquote = dep { pname = "c-shquote"; version = "1.1.0"; hash = "sha256-z6hpQ/kpCYAngMNfxLkfsxaGtvP4yBMigX1lGpIIzMQ="; buildInputs = [ c-stdaux ]; };
+  c-stdaux = dep { pname = "c-stdaux"; version = "1.5.0"; hash = "sha256-MsnuEyVCmOIr/q6I1qyPsNXp48jxIEcXoYLHbOAZtW0="; };
+  c-utf8 = dep { pname = "c-utf8"; version = "1.1.0"; hash = "sha256-9vBYylbt1ypJwIAQJd/oiAueh+4VYcn/KzofQuhUea0="; buildInputs = [ c-stdaux ]; };
 
 in
 
-stdenv.mkDerivation ( finalAttrs: {
+stdenv.mkDerivation (finalAttrs: {
   pname = "dbus-broker";
-  version = "33";
+  version = "35";
 
   src = fetchFromGitHub {
     owner = "bus1";
     repo = "dbus-broker";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-c5kEUB2k9CCuno9d4QOUUp1wbQfsvraGDLN6Yaa7T2w=";
+    hash = "sha256-Qwi9X5jXHiQ3TOWefzv/p7x8/JkQW1QgdYji5SpLej0=";
   };
 
-  patches = [ ./paths.patch ];
+  patches = [
+    ./paths.patch
+    ./disable-test.patch
+  ];
 
   nativeBuildInputs = [ docutils meson ninja pkg-config ];
 
@@ -93,4 +96,4 @@ stdenv.mkDerivation ( finalAttrs: {
     maintainers = with maintainers; [ peterhoeg ];
     platforms = platforms.linux;
   };
-} )
+})
diff --git a/nixpkgs/pkgs/os-specific/linux/dbus-broker/disable-test.patch b/nixpkgs/pkgs/os-specific/linux/dbus-broker/disable-test.patch
new file mode 100644
index 000000000000..487967aea840
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/dbus-broker/disable-test.patch
@@ -0,0 +1,11 @@
+--- b/src/meson.build
++++ a/src/meson.build
+@@ -196,9 +195,6 @@
+ test_fdlist = executable('test-fdlist', ['util/test-fdlist.c'], dependencies: dep_bus)
+ test('Utility File-Desciptor Lists', test_fdlist)
+
+-test_fs = executable('test-fs', ['util/test-fs.c'], dependencies: dep_bus)
+-test('File System Helpers', test_fs)
+-
+ test_match = executable('test-match', ['bus/test-match.c'], dependencies: dep_bus)
+ test('D-Bus Match Handling', test_match)
diff --git a/nixpkgs/pkgs/os-specific/linux/displaylink/default.nix b/nixpkgs/pkgs/os-specific/linux/displaylink/default.nix
index e71062e8ac47..408dfa408e1d 100644
--- a/nixpkgs/pkgs/os-specific/linux/displaylink/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/displaylink/default.nix
@@ -8,7 +8,6 @@
 , makeWrapper
 , requireFile
 , substituteAll
-, nixosTests
 }:
 
 let
@@ -69,12 +68,6 @@ stdenv.mkDerivation rec {
   dontStrip = true;
   dontPatchELF = true;
 
-  passthru = {
-    tests = {
-      inherit (nixosTests) displaylink;
-    };
-  };
-
   meta = with lib; {
     description = "DisplayLink DL-5xxx, DL-41xx and DL-3x00 Driver for Linux";
     homepage = "https://www.displaylink.com/";
diff --git a/nixpkgs/pkgs/os-specific/linux/firmware/fwupd/default.nix b/nixpkgs/pkgs/os-specific/linux/firmware/fwupd/default.nix
index e96902a13029..ac1605f979e7 100644
--- a/nixpkgs/pkgs/os-specific/linux/firmware/fwupd/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/firmware/fwupd/default.nix
@@ -22,7 +22,6 @@
 , valgrind
 , meson
 , libuuid
-, colord
 , ninja
 , gnutls
 , protobufc
@@ -122,7 +121,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "fwupd";
-  version = "1.9.10";
+  version = "1.9.11";
 
   # libfwupd goes to lib
   # daemon, plug-ins and libfwupdplugin go to out
@@ -133,7 +132,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "fwupd";
     repo = "fwupd";
     rev = finalAttrs.version;
-    hash = "sha256-qB7SGkjPahZmLax8HrSdLvORAXTBcuN5NohT0KUjCnM=";
+    hash = "sha256-chPZ9nGhFcaExoJDJvFy8terIGZRU6S90RKBYkoWyGQ=";
   };
 
   patches = [
@@ -184,7 +183,6 @@ stdenv.mkDerivation (finalAttrs: {
     curl
     elfutils
     libgudev
-    colord
     libjcat
     libuuid
     json-glib
diff --git a/nixpkgs/pkgs/os-specific/linux/firmware/libreelec-dvb-firmware/default.nix b/nixpkgs/pkgs/os-specific/linux/firmware/libreelec-dvb-firmware/default.nix
index 9579ff11c739..d2e3696ea4c9 100644
--- a/nixpkgs/pkgs/os-specific/linux/firmware/libreelec-dvb-firmware/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/firmware/libreelec-dvb-firmware/default.nix
@@ -2,13 +2,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "libreelec-dvb-firmware";
-  version = "1.4.2";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     repo = "dvb-firmware";
     owner = "LibreElec";
     rev = version;
-    sha256 = "1xnfl4gp6d81gpdp86v5xgcqiqz2nf1i43sb3a4i5jqs8kxcap2k";
+    sha256 = "sha256-uEobcv5kqGxIOfSVVKH+iT7DHPF13OFiRF7c1GIUqtU=";
   };
 
   installPhase = ''
diff --git a/nixpkgs/pkgs/os-specific/linux/fwts/default.nix b/nixpkgs/pkgs/os-specific/linux/fwts/default.nix
index 43f7ed5cb3a1..bb4a1a1bd37c 100644
--- a/nixpkgs/pkgs/os-specific/linux/fwts/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/fwts/default.nix
@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   pname = "fwts";
-  version = "23.07.00";
+  version = "23.11.00";
 
   src = fetchzip {
     url = "https://fwts.ubuntu.com/release/${pname}-V${version}.tar.gz";
-    sha256 = "sha256-Fo5qdb0eT8taYfPAf5LQu0toNXcoVjNoDgeeAlUfbs4=";
+    sha256 = "sha256-3cusxMFIYGKJ+ocQPc77bzHkyQhikLo1szSgE59aK9s=";
     stripRoot = false;
   };
 
diff --git a/nixpkgs/pkgs/os-specific/linux/hdparm/default.nix b/nixpkgs/pkgs/os-specific/linux/hdparm/default.nix
index 12938dbac89a..3e23e3a7da7b 100644
--- a/nixpkgs/pkgs/os-specific/linux/hdparm/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/hdparm/default.nix
@@ -1,24 +1,25 @@
 { lib, stdenv, fetchurl }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "hdparm";
   version = "9.65";
 
   src = fetchurl {
-    url = "mirror://sourceforge/hdparm/hdparm-${version}.tar.gz";
+    url = "mirror://sourceforge/hdparm/hdparm-${finalAttrs.version}.tar.gz";
     sha256 = "sha256-0Ukp+RDQYJMucX6TgkJdR8LnFEI1pTcT1VqU995TWks=";
   };
 
-  preBuild = ''
-    makeFlagsArray=(sbindir=$out/sbin manprefix=$out)
-    '';
+  makeFlags = [
+    "sbindir=${placeholder "out"}/sbin"
+    "manprefix=${placeholder "out"}"
+  ];
 
   meta = with lib; {
     description = "A tool to get/set ATA/SATA drive parameters under Linux";
     homepage = "https://sourceforge.net/projects/hdparm/";
     platforms = platforms.linux;
     license = licenses.bsd2;
+    mainProgram = "hdparm";
     maintainers = [ ];
   };
-
-}
+})
diff --git a/nixpkgs/pkgs/os-specific/linux/ipp-usb/default.nix b/nixpkgs/pkgs/os-specific/linux/ipp-usb/default.nix
index 6dc63a7295b1..38d9afddaca6 100644
--- a/nixpkgs/pkgs/os-specific/linux/ipp-usb/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/ipp-usb/default.nix
@@ -1,13 +1,13 @@
 { buildGoModule, avahi, libusb1, pkg-config, lib, fetchFromGitHub, ronn }:
 buildGoModule rec {
   pname = "ipp-usb";
-  version = "0.9.23";
+  version = "0.9.24";
 
   src = fetchFromGitHub {
     owner = "openprinting";
     repo = "ipp-usb";
     rev = version;
-    sha256 = "sha256-sbPQWKqkTaD3kLNs0noVIzAN9cwDEaULsqO7SMQH2Jo=";
+    sha256 = "sha256-06Kb4s9oN53llz/Yya45ig5rd86VvlcK+vRh3bL/MAw=";
   };
 
   postPatch = ''
@@ -24,7 +24,7 @@ buildGoModule rec {
   nativeBuildInputs = [ pkg-config ronn ];
   buildInputs = [ libusb1 avahi ];
 
-  vendorHash = "sha256-KwW6KgopjF4tVo8eB4OtpXF5R8jfrJ9nibNmaN8U4l8=";
+  vendorHash = "sha256-61vCER1yR70Pn+CrfTai1sgiQQLU6msb9jxushus5W4=";
 
   postInstall = ''
     # to accomodate the makefile
diff --git a/nixpkgs/pkgs/os-specific/linux/iwd/default.nix b/nixpkgs/pkgs/os-specific/linux/iwd/default.nix
index bea03fc1e8a2..dab2f2290fc1 100644
--- a/nixpkgs/pkgs/os-specific/linux/iwd/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/iwd/default.nix
@@ -1,6 +1,5 @@
 { lib, stdenv
 , fetchgit
-, fetchpatch
 , autoreconfHook
 , pkg-config
 , ell
@@ -14,24 +13,14 @@
 
 stdenv.mkDerivation rec {
   pname = "iwd";
-  version = "2.11";
+  version = "2.12";
 
   src = fetchgit {
     url = "https://git.kernel.org/pub/scm/network/wireless/iwd.git";
     rev = version;
-    hash = "sha256-kE9GBVTKNpgEuE9jQ7k85OhEAN3VWgjmAgifvZfq46I=";
+    hash = "sha256-XlhzPEXYGmJvQ6ZfPK1nxbHibXLdNsDKhZ0UAIRmN6U=";
   };
 
-  # Revert test that's broken on aarch64
-  # FIXME: fix this properly
-  patches = [
-    (fetchpatch {
-      url = "https://git.kernel.org/pub/scm/network/wireless/iwd.git/patch/?id=aabedeeb6c20c0c053f11ef53413d542442a8f62";
-      revert = true;
-      hash = "sha256-hO4KzdLzW6Tn/4NNJEQO2OvgjSPVl46cwwZfv53R84U=";
-    })
-  ];
-
   outputs = [ "out" "man" "doc" ]
     ++ lib.optional (stdenv.hostPlatform == stdenv.buildPlatform) "test";
 
diff --git a/nixpkgs/pkgs/os-specific/linux/jool/source.nix b/nixpkgs/pkgs/os-specific/linux/jool/source.nix
index d98747d890ec..59c224cef6dc 100644
--- a/nixpkgs/pkgs/os-specific/linux/jool/source.nix
+++ b/nixpkgs/pkgs/os-specific/linux/jool/source.nix
@@ -1,11 +1,11 @@
 { fetchFromGitHub }:
 
 rec {
-  version = "4.1.10";
+  version = "4.1.11";
   src = fetchFromGitHub {
     owner = "NICMx";
     repo = "Jool";
     rev = "refs/tags/v${version}";
-    hash = "sha256-98XbBdSmgcepPZxX6hoPim+18lHLbrjqlbipB92nyAc=";
+    hash = "sha256-fTYUdtU51/zOBbd568QtfUYnqWl+ZN9uSbE29tJC6UM=";
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/hardened/config.nix b/nixpkgs/pkgs/os-specific/linux/kernel/hardened/config.nix
index 92192eb79f89..7aa9c5117352 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/hardened/config.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/hardened/config.nix
@@ -34,7 +34,7 @@ assert (versionAtLeast version "4.9");
   STRICT_KERNEL_RWX = yes;
 
   # Perform additional validation of commonly targeted structures.
-  DEBUG_CREDENTIALS     = yes;
+  DEBUG_CREDENTIALS     = whenOlder "6.6" yes;
   DEBUG_NOTIFIERS       = yes;
   DEBUG_PI_LIST         = whenOlder "5.2" yes; # doesn't BUG()
   DEBUG_PLIST           = whenAtLeast "5.2" yes;
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/hardened/patches.json b/nixpkgs/pkgs/os-specific/linux/kernel/hardened/patches.json
index c10c3e8286ff..3d95407fbe81 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/hardened/patches.json
@@ -2,52 +2,52 @@
     "4.19": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-4.19.302-hardened1.patch",
-            "sha256": "1qr0i1swrvbwxd7sx0fy6cg85k0aya518cdnmx2v1jpydvlkhn1a",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.302-hardened1/linux-hardened-4.19.302-hardened1.patch"
+            "name": "linux-hardened-4.19.303-hardened1.patch",
+            "sha256": "0bmf88vid8312rrdy4b1bnq4x2rhkiihp01b2j2jmpjbdsj2qbya",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.303-hardened1/linux-hardened-4.19.303-hardened1.patch"
         },
-        "sha256": "1kkkpm34p5rq0iijzrzwaq0cb62w543argargw5p1wzg8803rlsk",
-        "version": "4.19.302"
+        "sha256": "0dlbl47xs7z4yf9cxbxqzd7zs1f9070jr6ck231wgppa6lwwwb82",
+        "version": "4.19.303"
     },
     "5.10": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.10.204-hardened1.patch",
-            "sha256": "0a1hyf7sjsv9g47x7nznpn5nq7p5jkzy2f4nsiy3pp1853f00v1d",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.204-hardened1/linux-hardened-5.10.204-hardened1.patch"
+            "name": "linux-hardened-5.10.205-hardened1.patch",
+            "sha256": "0viz1pybmh8vld40s2gh73a63743c3v7g2dbrsbqqjkh8xvn28zk",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.205-hardened1/linux-hardened-5.10.205-hardened1.patch"
         },
-        "sha256": "1vnamiyr378q52xgkg7kvpx80zck729dim77vp06a3q6n580g5gz",
-        "version": "5.10.204"
+        "sha256": "0qw8g0h4k0b4dyvspbj51cwr68ihwjzsi2b2261ipy3l1nl1fln5",
+        "version": "5.10.205"
     },
     "5.15": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.15.143-hardened1.patch",
-            "sha256": "0rg37d21k0ab3nzaif46qc2ql9wd3v50n800kbpfa4g9qsq51j99",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.143-hardened1/linux-hardened-5.15.143-hardened1.patch"
+            "name": "linux-hardened-5.15.145-hardened1.patch",
+            "sha256": "0jip4c7r41a3nzgv6zzrkjg4flb0ri6ar60l246ixzyp9sv19x9r",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.145-hardened1/linux-hardened-5.15.145-hardened1.patch"
         },
-        "sha256": "00lyv7zsj97mkg9i7dkb1a6km22mnr0qr687d9zz4ckjq1pb2sq9",
-        "version": "5.15.143"
+        "sha256": "086nssif66s86wkixz4yb7xilz1k49g32l0ib28r8fjzc23rv95j",
+        "version": "5.15.145"
     },
     "5.4": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.4.264-hardened1.patch",
-            "sha256": "1rb3bc6c4qgdy1yysdl72qpizippimk1rfshajcsn7i034c9g4ca",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.264-hardened1/linux-hardened-5.4.264-hardened1.patch"
+            "name": "linux-hardened-5.4.265-hardened1.patch",
+            "sha256": "17bs86fxv5l1dm0knvcnj5940r06pq41gd3fp71rn1p1kwk622y3",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.265-hardened1/linux-hardened-5.4.265-hardened1.patch"
         },
-        "sha256": "1c5n47dq9khb15hz24a000k3hj913vv1dda6famnm8wpjbfr176k",
-        "version": "5.4.264"
+        "sha256": "05cvvwjiznn7hfd02qklklalg0chahvh5v18w64lcva6kzj9kbjd",
+        "version": "5.4.265"
     },
     "6.1": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-6.1.68-hardened1.patch",
-            "sha256": "020xh7zsdfyp7g1n3fp8mmsy4ayhw309fcb65jwmkd8ha2mzm1yc",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.1.68-hardened1/linux-hardened-6.1.68-hardened1.patch"
+            "name": "linux-hardened-6.1.69-hardened1.patch",
+            "sha256": "1dbwnf6bsxl9m03cngfpf3yb95j719r46dy9x8al59d9p8k0h9bn",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.1.69-hardened1/linux-hardened-6.1.69-hardened1.patch"
         },
-        "sha256": "1qc4cwqlfni9i6mzh6arghdsd842hp9lb7s832dxw1p261mg4prn",
-        "version": "6.1.68"
+        "sha256": "0hdm28k49kmy9r96hckps0bvvaq9m06l72n8ih305rccs6a2cgby",
+        "version": "6.1.69"
     },
     "6.5": {
         "patch": {
@@ -62,11 +62,11 @@
     "6.6": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-6.6.7-hardened1.patch",
-            "sha256": "16yk9wz19wn0fkxdwl05qw1hwnfvidh3nmj0pnf61hgwif4kg7l3",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.6.7-hardened1/linux-hardened-6.6.7-hardened1.patch"
+            "name": "linux-hardened-6.6.8-hardened1.patch",
+            "sha256": "0mjrp3bxvb1pprc5v2grxk1r3ifldch35lqsxyky1nvlzhphhgb9",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.6.8-hardened1/linux-hardened-6.6.8-hardened1.patch"
         },
-        "sha256": "0hfqdyxl4nqmm4pspfm1ang8616dbsaj0d968c0186ch0738xrhc",
-        "version": "6.6.7"
+        "sha256": "05i4ayj9wyjkd1s8ixx7bxwcyagqyx8rhj1zvbc3cjqyw4sc8djh",
+        "version": "6.6.8"
     }
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/kernels-org.json b/nixpkgs/pkgs/os-specific/linux/kernel/kernels-org.json
index 8940d8a08f2c..13fd2ed4d371 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -1,38 +1,38 @@
 {
     "testing": {
-        "version": "6.7-rc5",
-        "hash": "sha256:125zdj2sxcwkfvm2ckjk3mbwfll8950bn7kr38s5pvlx2a10zv04"
+        "version": "6.7-rc7",
+        "hash": "sha256:1w1np05mqyviykj0gyx6z2l9ql4f909dy0ximh0gkcpkgy6zz9qc"
     },
     "6.5": {
         "version": "6.5.13",
         "hash": "sha256:1dfbbydmayfj9npx3z0g38p574pmcx3qgs49dv0npigl48wd9yvq"
     },
     "6.1": {
-        "version": "6.1.68",
-        "hash": "sha256:1qc4cwqlfni9i6mzh6arghdsd842hp9lb7s832dxw1p261mg4prn"
+        "version": "6.1.69",
+        "hash": "sha256:0hdm28k49kmy9r96hckps0bvvaq9m06l72n8ih305rccs6a2cgby"
     },
     "5.15": {
-        "version": "5.15.143",
-        "hash": "sha256:00lyv7zsj97mkg9i7dkb1a6km22mnr0qr687d9zz4ckjq1pb2sq9"
+        "version": "5.15.145",
+        "hash": "sha256:086nssif66s86wkixz4yb7xilz1k49g32l0ib28r8fjzc23rv95j"
     },
     "5.10": {
-        "version": "5.10.204",
-        "hash": "sha256:1vnamiyr378q52xgkg7kvpx80zck729dim77vp06a3q6n580g5gz"
+        "version": "5.10.205",
+        "hash": "sha256:0qw8g0h4k0b4dyvspbj51cwr68ihwjzsi2b2261ipy3l1nl1fln5"
     },
     "5.4": {
-        "version": "5.4.264",
-        "hash": "sha256:1c5n47dq9khb15hz24a000k3hj913vv1dda6famnm8wpjbfr176k"
+        "version": "5.4.265",
+        "hash": "sha256:05cvvwjiznn7hfd02qklklalg0chahvh5v18w64lcva6kzj9kbjd"
     },
     "4.19": {
-        "version": "4.19.302",
-        "hash": "sha256:1kkkpm34p5rq0iijzrzwaq0cb62w543argargw5p1wzg8803rlsk"
+        "version": "4.19.303",
+        "hash": "sha256:0dlbl47xs7z4yf9cxbxqzd7zs1f9070jr6ck231wgppa6lwwwb82"
     },
     "4.14": {
-        "version": "4.14.333",
-        "hash": "sha256:0j5nrankrhi56qzmyjg1pznqx1zgk5f7cfa154smjbn3zlm7lcv6"
+        "version": "4.14.334",
+        "hash": "sha256:0iaaqdkszmfarvjfszc9rf7y9zsv3w82934xmvmzmsbiz86547ca"
     },
     "6.6": {
-        "version": "6.6.7",
-        "hash": "sha256:0hfqdyxl4nqmm4pspfm1ang8616dbsaj0d968c0186ch0738xrhc"
+        "version": "6.6.8",
+        "hash": "sha256:05i4ayj9wyjkd1s8ixx7bxwcyagqyx8rhj1zvbc3cjqyw4sc8djh"
     }
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/linux-libre.nix b/nixpkgs/pkgs/os-specific/linux/kernel/linux-libre.nix
index 9cf5f46cfb80..9308cba46f13 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/linux-libre.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/linux-libre.nix
@@ -1,8 +1,8 @@
 { stdenv, lib, fetchsvn, linux
 , scripts ? fetchsvn {
     url = "https://www.fsfla.org/svn/fsfla/software/linux-libre/releases/branches/";
-    rev = "19441";
-    sha256 = "1z0x8cw9nr7qf5qh3xjf6rg20q0i79bg71lik847sabyb6vcrk0z";
+    rev = "19453";
+    sha256 = "12jy0kyhl9dsp20yprbw27kzh1p4qxi5m5zy9j7sglm9ajrbnkar";
   }
 , ...
 }:
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix b/nixpkgs/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
index ce26a38ed069..58a1be131962 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
@@ -6,7 +6,7 @@
 , ... } @ args:
 
 let
-  version = "5.10.201-rt98"; # updated by ./update-rt.sh
+  version = "5.10.204-rt100"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
@@ -17,14 +17,14 @@ in buildLinux (args // {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${kversion}.tar.xz";
-    sha256 = "0642y6qj2d4aww6jcki81ba53pvjyfazjxgzgj8brqx8ixchdz3a";
+    sha256 = "1vnamiyr378q52xgkg7kvpx80zck729dim77vp06a3q6n580g5gz";
   };
 
   kernelPatches = let rt-patch = {
     name = "rt";
     patch = fetchurl {
       url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "1g7xbjsfrgins3agz9sq9ia13h5k9605gak7s14z5i4vd34y8pk8";
+      sha256 = "1zbpkira8wf3w46586af72k43j8xkj15f0dgq86z975vl60hdk68";
     };
   }; in [ rt-patch ] ++ kernelPatches;
 
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix b/nixpkgs/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix
index e57b2859b8cb..7f0fa9ff7e2a 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix
@@ -6,7 +6,7 @@
 , ... } @ args:
 
 let
-  version = "6.1.65-rt18"; # updated by ./update-rt.sh
+  version = "6.1.67-rt20"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
@@ -18,14 +18,14 @@ in buildLinux (args // {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v6.x/linux-${kversion}.tar.xz";
-    sha256 = "02mj394ina3npp6qqinc4pc6afp5pg1rlbjc90g4p902d29jjwj0";
+    sha256 = "11cjqll3b7iq3mblwyzjrd5ph8avgk23f4mw4shm8j6ai5rdndvm";
   };
 
   kernelPatches = let rt-patch = {
     name = "rt";
     patch = fetchurl {
       url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "0axy543q47xv5nsrw6prmy9dqvbp27wkn2brwygl05nl8grjvhr8";
+      sha256 = "1s7v4dc5hjl63h0z5nai2jpd0g739nc1573f1rlnc6cqy9y26gqg";
     };
   }; in [ rt-patch ] ++ kernelPatches;
 
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/xanmod-kernels.nix b/nixpkgs/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
index 3cad13a68fde..9a3a2a60c341 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
@@ -6,14 +6,14 @@ let
   # NOTE: When updating these, please also take a look at the changes done to
   # kernel config in the xanmod version commit
   ltsVariant = {
-    version = "6.1.66";
-    hash = "sha256-H3RTbBctvbKdsD1+G7zXVcTFb2NRON6nOzUgUW+zGxs=";
+    version = "6.1.69";
+    hash = "sha256-/uk2sS7g4REPtR/LSc7djjoc//m6QvrXfHO4OemQcy8=";
     variant = "lts";
   };
 
   mainVariant = {
-    version = "6.6.5";
-    hash = "sha256-lmJ5Gix+CEqIu+cyBeqBq6xLZ94PjhU+6SbzAE0D8SY=";
+    version = "6.6.8";
+    hash = "sha256-TtWTYuT3GMnQy1shkF+HTgv4Z1OSOLh4RXfG+Xj0n3M=";
     variant = "main";
   };
 
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/zen-kernels.nix b/nixpkgs/pkgs/os-specific/linux/kernel/zen-kernels.nix
index 55d32587766c..ab5b7c04e9f6 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/zen-kernels.nix
@@ -4,16 +4,16 @@ let
   # comments with variant added for update script
   # ./update-zen.py zen
   zenVariant = {
-    version = "6.6.6"; #zen
+    version = "6.6.9"; #zen
     suffix = "zen1"; #zen
-    sha256 = "13lxj1841mykfmbd8pwshr8jjxpxw1d8dyzkzq4ks6nviivnqfsn"; #zen
+    sha256 = "09vrkwyx4ri6ba48jfv8j4ssj0h0w2wgzqwwb8ribif1rkb59mw0"; #zen
     isLqx = false;
   };
   # ./update-zen.py lqx
   lqxVariant = {
-    version = "6.6.6"; #lqx
+    version = "6.6.9"; #lqx
     suffix = "lqx1"; #lqx
-    sha256 = "0p3ilsikd0v2k6d40n5s3smipww817yw2y47ayi1xj8m44rlp8gg"; #lqx
+    sha256 = "1ivf4iwxjp28xmfk8y3wxs64jqrjzgn6xwxkpad3mxc9n18yl8hz"; #lqx
     isLqx = true;
   };
   zenKernelsFor = { version, suffix, sha256, isLqx }: buildLinux (args // {
diff --git a/nixpkgs/pkgs/os-specific/linux/kexec-tools/default.nix b/nixpkgs/pkgs/os-specific/linux/kexec-tools/default.nix
index 2df5c0454ddc..c62f9047fc60 100644
--- a/nixpkgs/pkgs/os-specific/linux/kexec-tools/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kexec-tools/default.nix
@@ -34,6 +34,7 @@ stdenv.mkDerivation rec {
     description = "Tools related to the kexec Linux feature";
     platforms = platforms.linux;
     badPlatforms = [
+      "microblaze-linux" "microblazeel-linux"
       "riscv64-linux" "riscv32-linux"
       "sparc-linux" "sparc64-linux"
     ];
diff --git a/nixpkgs/pkgs/os-specific/linux/lenovo-legion/app.nix b/nixpkgs/pkgs/os-specific/linux/lenovo-legion/app.nix
index a409ad2fbf4d..6d6c604b1c05 100644
--- a/nixpkgs/pkgs/os-specific/linux/lenovo-legion/app.nix
+++ b/nixpkgs/pkgs/os-specific/linux/lenovo-legion/app.nix
@@ -7,8 +7,8 @@ python3.pkgs.buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "johnfanv2";
     repo = "LenovoLegionLinux";
-    rev = "v${version}-prerelese";
-    hash = "sha256-P4vqzNX2nF4LnoQDOV8WEiXAICQCyjj9xPpFNvMu93k=";
+    rev = "v${version}-prerelease";
+    hash = "sha256-PQdxfDfW3sn0wWjmsPoAt3HZ43PS3Tyez3/0KEVVZQg=";
   };
 
   sourceRoot = "${src.name}/python/legion_linux";
@@ -31,10 +31,8 @@ python3.pkgs.buildPythonApplication rec {
       --replace "FOLDER=/etc/legion_linux/" "FOLDER=$out/share/legion_linux"
     substituteInPlace ./legion_linux/legion.py \
       --replace "/etc/legion_linux" "$out/share/legion_linux"
-  '';
-
-  postInstall = ''
-    cp ./legion_linux/legion_logo.png $out/${python3.sitePackages}/legion_logo.png
+    substituteInPlace ./legion_linux/legion_gui{,_user}.desktop \
+      --replace "Icon=/usr/share/pixmaps/legion_logo.png" "Icon=legion_logo"
   '';
 
   dontWrapQtApps = true;
diff --git a/nixpkgs/pkgs/os-specific/linux/libsemanage/default.nix b/nixpkgs/pkgs/os-specific/linux/libsemanage/default.nix
index 2f5a0f7172ca..f289287743b8 100644
--- a/nixpkgs/pkgs/os-specific/linux/libsemanage/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/libsemanage/default.nix
@@ -6,12 +6,12 @@ with lib;
 
 stdenv.mkDerivation rec {
   pname = "libsemanage";
-  version = "3.5";
+  version = "3.6";
   inherit (libsepol) se_url;
 
   src = fetchurl {
     url = "${se_url}/${version}/libsemanage-${version}.tar.gz";
-    sha256 = "sha256-9TU05QJHU4KA7Q12xs6B2Ps5Ob1kytuJ2hDbpC5A3Zw=";
+    sha256 = "sha256-QROPRiIkOeEkLyfBWH6Vz1SgWSWarxaB22QswwxODWA=";
    };
 
   outputs = [ "out" "dev" "man" ] ++ optional enablePython "py";
diff --git a/nixpkgs/pkgs/os-specific/linux/libtraceevent/default.nix b/nixpkgs/pkgs/os-specific/linux/libtraceevent/default.nix
index 5b8aa329b783..74d7ce3a9153 100644
--- a/nixpkgs/pkgs/os-specific/linux/libtraceevent/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/libtraceevent/default.nix
@@ -1,13 +1,13 @@
-{ lib, stdenv, fetchgit, pkg-config, asciidoc, xmlto, docbook_xml_dtd_45, docbook_xsl, meson, ninja, cunit }:
+{ lib, stdenv, fetchgit, pkg-config, asciidoc, xmlto, docbook_xml_dtd_45, docbook_xsl, meson, ninja, cunit, gitUpdater }:
 
 stdenv.mkDerivation rec {
   pname = "libtraceevent";
-  version = "1.7.3";
+  version = "1.8.1";
 
   src = fetchgit {
     url = "https://git.kernel.org/pub/scm/libs/libtrace/libtraceevent.git";
     rev = "libtraceevent-${version}";
-    sha256 = "sha256-poF+Cqcdj0KIgEJWW7XDAlRLz2/Egi948s1M24ETvBo=";
+    hash = "sha256-zib2IrgtaDGDEO/2Kp9ytHuceW/7slRPDUClYgqemOE=";
   };
 
   postPatch = ''
@@ -23,6 +23,12 @@ stdenv.mkDerivation rec {
   doCheck = true;
   checkInputs = [ cunit ];
 
+  passthru.updateScript = gitUpdater {
+    # No nicer place to find latest release.
+    url = "https://git.kernel.org/pub/scm/libs/libtrace/libtraceevent.git";
+    rev-prefix = "libtraceevent-";
+  };
+
   meta = with lib; {
     description = "Linux kernel trace event library";
     homepage    = "https://git.kernel.org/pub/scm/libs/libtrace/libtraceevent.git/";
diff --git a/nixpkgs/pkgs/os-specific/linux/linux-wifi-hotspot/default.nix b/nixpkgs/pkgs/os-specific/linux/linux-wifi-hotspot/default.nix
index 01607be58fc4..17a00496a626 100644
--- a/nixpkgs/pkgs/os-specific/linux/linux-wifi-hotspot/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/linux-wifi-hotspot/default.nix
@@ -26,13 +26,13 @@
 
 stdenv.mkDerivation rec {
   pname = "linux-wifi-hotspot";
-  version = "4.6.0";
+  version = "4.7.0";
 
   src = fetchFromGitHub {
     owner = "lakinduakash";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-u9OdSpdxnjHOrK6PP/SFvGRtezssoZSoJFGVdRbOIPU=";
+    sha256 = "sha256-YwxVQNuxZib0yjG/+W0BZu39iS96UPYITV1vWsR7MzQ=";
   };
 
   nativeBuildInputs = [
diff --git a/nixpkgs/pkgs/os-specific/linux/linuxptp/default.nix b/nixpkgs/pkgs/os-specific/linux/linuxptp/default.nix
index e5a1443d3225..27a9ccb3303f 100644
--- a/nixpkgs/pkgs/os-specific/linux/linuxptp/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/linuxptp/default.nix
@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   pname = "linuxptp";
-  version = "4.1";
+  version = "4.2";
 
   src = fetchurl {
     url = "mirror://sourceforge/linuxptp/${pname}-${version}.tgz";
-    hash = "sha256-4XQ9RPggiJfjCJXaNXnmcP+Rm5FP60talJ8+Qh3d5TU=";
+    hash = "sha256-cOOOXSdk4CF0Q9pvFOiEb+QBpHIpOsE42EGcB6ZlRHo=";
   };
 
   postPatch = ''
diff --git a/nixpkgs/pkgs/os-specific/linux/lvm2/common.nix b/nixpkgs/pkgs/os-specific/linux/lvm2/common.nix
index 27a160033b11..7b9cc10be167 100644
--- a/nixpkgs/pkgs/os-specific/linux/lvm2/common.nix
+++ b/nixpkgs/pkgs/os-specific/linux/lvm2/common.nix
@@ -156,6 +156,6 @@ stdenv.mkDerivation rec {
     description = "Tools to support Logical Volume Management (LVM) on Linux";
     platforms = platforms.linux;
     license = with licenses; [ gpl2 bsd2 lgpl21 ];
-    maintainers = with maintainers; [ raskin ajs124 ];
+    maintainers = with maintainers; [ raskin ] ++ teams.helsinki-systems.members;
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/lxc/add-meson-options.patch b/nixpkgs/pkgs/os-specific/linux/lxc/add-meson-options.patch
new file mode 100644
index 000000000000..01aea4df2747
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/lxc/add-meson-options.patch
@@ -0,0 +1,153 @@
+diff --git a/meson.build b/meson.build
+index 21a8705d0..f12b81442 100644
+--- a/meson.build
++++ b/meson.build
+@@ -50,7 +50,7 @@ rootfsmount = get_option('rootfs-mount-path')
+ user_network_db_opt = get_option('usernet-db-path')
+ user_network_conf_opt = get_option('usernet-config-path')
+ 
+-bashcompletiondir = join_paths('/', 'usr', 'share', 'bash-completion', 'completions')
++bashcompletiondir = join_paths(prefixdir, get_option('datadir'), 'bash-completion', 'completions')
+ bindir = join_paths(prefixdir, get_option('bindir'))
+ datadir = join_paths(prefixdir, get_option('datadir'))
+ mandir = join_paths(prefixdir, get_option('mandir'))
+@@ -123,22 +123,6 @@ conf.set('PACKAGE_VERSION', meson.project_version())
+ conf.set('RUNTIME_PATH', runtimepath)
+ conf.set('SYSCONFDIR', sysconfdir)
+ 
+-# Set sysconfdir
+-fs = import('fs')
+-distrosysconfdir = get_option('distrosysconfdir')
+-if distrosysconfdir != ''
+-    distrosysconfdir = join_paths(sysconfdir, distrosysconfdir)
+-    conf.set('LXC_DISTRO_SYSCONF', distrosysconfdir)
+-elif fs.is_dir('/etc/sysconfig')
+-    distrosysconfdir = join_paths(sysconfdir, 'sysconfig')
+-    conf.set('LXC_DISTRO_SYSCONF', distrosysconfdir)
+-elif fs.is_dir('/etc/default')
+-    distrosysconfdir = join_paths(sysconfdir, 'default')
+-    conf.set('LXC_DISTRO_SYSCONF', distrosysconfdir)
+-else
+-    error('"distrosysconfdir" is not set')
+-endif
+-
+ # Cross-compile on Android.
+ srcconf.set10('IS_BIONIC', host_machine.system() == 'android')
+ 
+@@ -148,6 +132,7 @@ coverity = get_option('coverity-build')
+ init_script = get_option('init-script')
+ sanitize = get_option('b_sanitize')
+ want_examples = get_option('examples')
++want_install_init = get_option('install-init-files')
+ want_io_uring = get_option('io-uring-event-loop')
+ want_pam_cgroup = get_option('pam-cgroup')
+ want_mans = get_option('man')
+@@ -160,10 +145,30 @@ want_openssl = get_option('openssl')
+ want_selinux = get_option('selinux')
+ want_oss_fuzz = get_option('oss-fuzz')
+ want_seccomp = get_option('seccomp')
++want_spec = get_option('specfile')
++want_state_dirs = get_option('install-state-dirs')
+ want_thread_safety = get_option('thread-safety')
+ want_memfd_rexec = get_option('memfd-rexec')
+ want_sd_bus = get_option('sd-bus')
+ 
++# Set sysconfdir
++fs = import('fs')
++if want_install_init
++    distrosysconfdir = get_option('distrosysconfdir')
++    if distrosysconfdir != ''
++        distrosysconfdir = join_paths(sysconfdir, distrosysconfdir)
++        conf.set('LXC_DISTRO_SYSCONF', distrosysconfdir)
++    elif fs.is_dir('/etc/sysconfig')
++        distrosysconfdir = join_paths(sysconfdir, 'sysconfig')
++        conf.set('LXC_DISTRO_SYSCONF', distrosysconfdir)
++    elif fs.is_dir('/etc/default')
++        distrosysconfdir = join_paths(sysconfdir, 'default')
++        conf.set('LXC_DISTRO_SYSCONF', distrosysconfdir)
++    else
++        error('"distrosysconfdir" is not set')
++    endif
++endif
++
+ srcconf.set_quoted('DEFAULT_CGROUP_PATTERN', cgrouppattern)
+ if coverity
+     srcconf.set('ENABLE_COVERITY_BUILD', 1)
+@@ -926,14 +931,16 @@ if want_apparmor
+ endif
+ subdir('config/bash')
+ subdir('config/etc')
+-subdir('config/init/common')
+-subdir('config/init/systemd')
+-subdir('config/init/sysvinit')
+-subdir('config/init/upstart')
++if want_install_init
++    subdir('config/init/common')
++    subdir('config/init/systemd')
++    subdir('config/init/sysvinit')
++    subdir('config/init/upstart')
++    subdir('config/sysconfig')
++endif
+ if want_selinux
+     subdir('config/selinux')
+ endif
+-subdir('config/sysconfig')
+ subdir('config/templates')
+ subdir('config/templates/common.conf.d')
+ subdir('config/yum')
+@@ -963,21 +970,25 @@ pkg_config_file = pkgconfig.generate(liblxc,
+ )
+ 
+ # Empty dirs.
+-install_emptydir(join_paths(localstatedir, 'cache', 'lxc'))
+-install_emptydir(join_paths(localstatedir, 'lib', 'lxc'))
++if want_state_dirs
++    install_emptydir(join_paths(localstatedir, 'cache', 'lxc'))
++    install_emptydir(join_paths(localstatedir, 'lib', 'lxc'))
++endif
+ 
+ # RPM spec file.
+-specconf = configuration_data()
+-specconf.set('LXC_VERSION_BASE', meson.project_version())
+-specconf.set('LXC_VERSION_BETA', version_data.get('LXC_VERSION_BETA'))
+-specconf.set('PACKAGE', meson.project_name())
+-specconf.set('LXC_DISTRO_SYSCONF', conf.get('LXC_DISTRO_SYSCONF'))
+-
+-configure_file(
+-    configuration: specconf,
+-    input: 'lxc.spec.in',
+-    output: 'lxc.spec',
+-    install: false)
++if want_spec
++    specconf = configuration_data()
++    specconf.set('LXC_VERSION_BASE', meson.project_version())
++    specconf.set('LXC_VERSION_BETA', version_data.get('LXC_VERSION_BETA'))
++    specconf.set('PACKAGE', meson.project_name())
++    specconf.set('LXC_DISTRO_SYSCONF', conf.get('LXC_DISTRO_SYSCONF'))
++
++    configure_file(
++        configuration: specconf,
++        input: 'lxc.spec.in',
++        output: 'lxc.spec',
++        install: false)
++endif
+ 
+ # Build overview.
+ status = [
+diff --git a/meson_options.txt b/meson_options.txt
+index 9803473d2..84a6d45b5 100644
+--- a/meson_options.txt
++++ b/meson_options.txt
+@@ -120,3 +120,12 @@ option('memfd-rexec', type : 'boolean', value : 'true',
+ 
+ option('distrosysconfdir', type : 'string', value: '',
+        description: 'relative path to sysconfdir for distro default configuration')
++
++option('specfile', type : 'boolean', value: true,
++       description: 'whether to prepare RPM spec')
++
++option('install-init-files', type : 'boolean', value: true,
++       description: 'whether to install init files for local init (e.g. systemd, sysvinit)')
++
++option('install-state-dirs', type : 'boolean', value: true,
++       description: 'whether to create state directories on install')
diff --git a/nixpkgs/pkgs/os-specific/linux/lxc/default.nix b/nixpkgs/pkgs/os-specific/linux/lxc/default.nix
index 4192de0cfeab..4caf5b9aa943 100644
--- a/nixpkgs/pkgs/os-specific/linux/lxc/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/lxc/default.nix
@@ -1,102 +1,81 @@
-{ lib, stdenv, fetchurl, autoreconfHook, pkg-config, perl, docbook2x
-, docbook_xml_dtd_45, python3Packages, pam, fetchpatch
-
-# Optional Dependencies
-, libapparmor ? null, gnutls ? null, libselinux ? null, libseccomp ? null
-, libcap ? null, systemd ? null
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  docbook2x,
+  libapparmor,
+  libcap,
+  libseccomp,
+  libselinux,
+  meson,
+  ninja,
+  nix-update-script,
+  nixosTests,
+  openssl,
+  pam,
+  pkg-config,
+  systemd,
 }:
 
 stdenv.mkDerivation rec {
   pname = "lxc";
-  version = "4.0.12";
+  version = "5.0.3";
 
-  src = fetchurl {
-    url = "https://linuxcontainers.org/downloads/lxc/lxc-${version}.tar.gz";
-    sha256 = "1vyk2j5w9gfyh23w3ar09cycyws16mxh3clbb33yhqzwcs1jy96v";
+  src = fetchFromGitHub {
+    owner = "lxc";
+    repo = "lxc";
+    rev = "refs/tags/lxc-${version}";
+    hash = "sha256-lnLmLgWXt3pI2S+4OeHRlPP5gui7S7ZXXClFt+n/8sY=";
   };
 
   nativeBuildInputs = [
-    autoreconfHook pkg-config perl docbook2x python3Packages.wrapPython
+    docbook2x
+    meson
+    ninja
+    pkg-config
   ];
+
   buildInputs = [
-    pam libapparmor gnutls libselinux libseccomp libcap
-    python3Packages.python python3Packages.setuptools systemd
+    libapparmor
+    libcap
+    libseccomp
+    libselinux
+    openssl
+    pam
+    systemd
   ];
 
-  patches = [
-    ./support-db2x.patch
+  patches = [ ./add-meson-options.patch ];
 
-    # Backport of https://github.com/lxc/lxc/pull/4179 for glibc-2.36 build
-    (fetchpatch {
-      url = "https://github.com/lxc/lxc/commit/c1115e1503bf955c97f4cf3b925a6a9f619764c3.patch";
-      sha256 = "sha256-aC1XQesRJfkyQnloB3NvR4p/1WITrqkGYzw50PDxDrs=";
-      excludes = [ "meson.build" ];
-    })
+  mesonFlags = [
+    "-Dinstall-init-files=false"
+    "-Dinstall-state-dirs=false"
+    "-Dspecfile=false"
   ];
 
-  postPatch = ''
-    sed -i '/chmod u+s/d' src/lxc/Makefile.am
-  '';
-
-  XML_CATALOG_FILES = "${docbook_xml_dtd_45}/xml/dtd/docbook/catalog.xml";
-
-  configureFlags = [
-    "--enable-pam"
-    "--localstatedir=/var"
-    "--sysconfdir=/etc"
-    "--disable-api-docs"
-    "--with-init-script=none"
-    "--with-distro=nixos" # just to be sure it is "unknown"
-  ] ++ lib.optional (libapparmor != null) "--enable-apparmor"
-    ++ lib.optional (libselinux != null) "--enable-selinux"
-    ++ lib.optional (libseccomp != null) "--enable-seccomp"
-    ++ lib.optional (libcap != null) "--enable-capabilities"
-    ++ [
-    "--disable-examples"
-    "--enable-python"
-    "--disable-lua"
-    "--enable-bash"
-    (if doCheck then "--enable-tests" else "--disable-tests")
-    "--with-rootfs-path=/var/lib/lxc/rootfs"
-  ];
+  enableParallelBuilding = true;
 
-  doCheck = false;
+  doCheck = true;
 
-  installFlags = [
-    "localstatedir=\${TMPDIR}"
-    "sysconfdir=\${out}/etc"
-    "sysconfigdir=\${out}/etc/default"
-    "bashcompdir=\${out}/share/bash-completion/completions"
-    "READMEdir=\${TMPDIR}/var/lib/lxc/rootfs"
-    "LXCPATH=\${TMPDIR}/var/lib/lxc"
-  ];
-
-  postInstall = ''
-    wrapPythonPrograms
-
-    completions=(
-      lxc-attach lxc-cgroup lxc-console lxc-destroy lxc-device lxc-execute
-      lxc-freeze lxc-info lxc-monitor lxc-snapshot lxc-stop lxc-unfreeze
-    )
-    pushd $out/share/bash-completion/completions/
-      mv lxc lxc-start
-      for completion in ''${completions[@]}; do
-        ln -sfn lxc-start $completion
-      done
-    popd
-  '';
+  passthru = {
+    tests.incus = nixosTests.incus.container;
+    updateScript = nix-update-script {
+      extraArgs = [
+        "-vr"
+        "lxc-(.*)"
+      ];
+    };
+  };
 
   meta = {
     homepage = "https://linuxcontainers.org/";
     description = "Userspace tools for Linux Containers, a lightweight virtualization system";
-    license = lib.licenses.lgpl21Plus;
+    license = lib.licenses.gpl2;
 
     longDescription = ''
-      LXC is the userspace control package for Linux Containers, a
-      lightweight virtual system mechanism sometimes described as
-      "chroot on steroids". LXC builds up from chroot to implement
-      complete virtual systems, adding resource management and isolation
-      mechanisms to Linux’s existing process management infrastructure.
+      LXC containers are often considered as something in the middle between a chroot and a
+      full fledged virtual machine. The goal of LXC is to create an environment as close as
+      possible to a standard Linux installation but without the need for a separate kernel.
     '';
 
     platforms = lib.platforms.linux;
diff --git a/nixpkgs/pkgs/os-specific/linux/lxcfs/default.nix b/nixpkgs/pkgs/os-specific/linux/lxcfs/default.nix
index 28777d36e6be..ee923786c295 100644
--- a/nixpkgs/pkgs/os-specific/linux/lxcfs/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/lxcfs/default.nix
@@ -1,41 +1,58 @@
-{ config, lib, stdenv, fetchFromGitHub, autoreconfHook, pkg-config, help2man, fuse
-, util-linux, makeWrapper
-, enableDebugBuild ? config.lxcfs.enableDebugBuild or false }:
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  fuse3,
+  help2man,
+  makeWrapper,
+  meson,
+  ninja,
+  nixosTests,
+  pkg-config,
+  python3,
+  util-linux,
+}:
 
 stdenv.mkDerivation rec {
   pname = "lxcfs";
-  version = "4.0.12";
+  version = "5.0.4";
 
   src = fetchFromGitHub {
     owner = "lxc";
     repo = "lxcfs";
     rev = "lxcfs-${version}";
-    sha256 = "sha256-+wp29GD+toXGfQbPGYbDJ7/P+FY1uQY4uK3OQxTE9GM=";
+    sha256 = "sha256-vusxbFV7cnQVBOOo7E+fSyaE63f5QiE2xZhYavc8jJU=";
   };
 
-  postPatch = ''
-    sed -i -e '1i #include <sys/pidfd.h>' src/bindings.c
-  '';
+  patches = [
+    # skip RPM spec generation
+    ./no-spec.patch
 
-  nativeBuildInputs = [ pkg-config help2man autoreconfHook makeWrapper ];
-  buildInputs = [ fuse ];
+    # skip installing systemd files
+    ./skip-init.patch
+
+    # fix pidfd checks and include
+    ./pidfd.patch
+  ];
 
-  preConfigure = lib.optionalString enableDebugBuild ''
-    sed -i 's,#AM_CFLAGS += -DDEBUG,AM_CFLAGS += -DDEBUG,' Makefile.am
-  '';
 
-  configureFlags = [
-    "--with-init-script=systemd"
-    "--sysconfdir=/etc"
-    "--localstatedir=/var"
+  nativeBuildInputs = [
+    meson
+    help2man
+    makeWrapper
+    ninja
+    (python3.withPackages (p: [ p.jinja2 ]))
+    pkg-config
   ];
+  buildInputs = [ fuse3 ];
 
-  installFlags = [ "SYSTEMD_UNIT_DIR=\${out}/lib/systemd" ];
+  preConfigure = ''
+    patchShebangs tools/
+  '';
 
   postInstall = ''
     # `mount` hook requires access to the `mount` command from `util-linux`:
-    wrapProgram "$out/share/lxcfs/lxc.mount.hook" \
-      --prefix PATH : "${util-linux}/bin"
+    wrapProgram "$out/share/lxcfs/lxc.mount.hook" --prefix PATH : "${util-linux}/bin"
   '';
 
   postFixup = ''
@@ -43,6 +60,10 @@ stdenv.mkDerivation rec {
     patchelf --set-rpath "$(patchelf --print-rpath "$out/bin/lxcfs"):$out/lib" "$out/bin/lxcfs"
   '';
 
+  passthru.tests = {
+    incus-container = nixosTests.incus.container;
+  };
+
   meta = {
     description = "FUSE filesystem for LXC";
     homepage = "https://linuxcontainers.org/lxcfs";
diff --git a/nixpkgs/pkgs/os-specific/linux/lxcfs/no-spec.patch b/nixpkgs/pkgs/os-specific/linux/lxcfs/no-spec.patch
new file mode 100644
index 000000000000..ead4bfcf80f7
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/lxcfs/no-spec.patch
@@ -0,0 +1,24 @@
+diff --git a/meson.build b/meson.build
+index a0289ad..93fc61a 100644
+--- a/meson.build
++++ b/meson.build
+@@ -253,19 +253,6 @@ if want_tests == true
+         c_args: '-DRELOADTEST -DDEBUG')
+ endif
+ 
+-# RPM spec.
+-lxcfs_spec = custom_target(
+-    'lxcfs.spec',
+-    build_by_default: true,
+-    input: 'lxcfs.spec.in',
+-    output: 'lxcfs.spec',
+-    command: [
+-        meson_render_jinja2,
+-        config_h,
+-        '@INPUT@',
+-        '@OUTPUT@',
+-    ])
+-
+ # Man pages
+ if want_docs == true
+     help2man = find_program('help2man')
diff --git a/nixpkgs/pkgs/os-specific/linux/lxcfs/pidfd.patch b/nixpkgs/pkgs/os-specific/linux/lxcfs/pidfd.patch
new file mode 100644
index 000000000000..3d9b6faa57f9
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/lxcfs/pidfd.patch
@@ -0,0 +1,29 @@
+diff --git a/meson.build b/meson.build
+index a0289ad..211b01b 100644
+--- a/meson.build
++++ b/meson.build
+@@ -134,11 +134,13 @@ foreach ident: [
+      '''#include <stdlib.h>
+         #include <unistd.h>
+         #include <signal.h>
++        #include <sys/pidfd.h>
+         #include <sys/wait.h>'''],
+     ['pidfd_open',
+      '''#include <stdlib.h>
+         #include <unistd.h>
+         #include <signal.h>
++        #include <sys/pidfd.h>
+         #include <sys/wait.h>'''],
+ ]
+     have = cc.has_function(ident[0], prefix: ident[1], args: '-D_GNU_SOURCE')
+diff --git a/src/bindings.c b/src/bindings.c
+index 13259c1..e760330 100644
+--- a/src/bindings.c
++++ b/src/bindings.c
+@@ -1,5 +1,6 @@
+ /* SPDX-License-Identifier: LGPL-2.1+ */
+ 
++#include <sys/pidfd.h>
+ #include "config.h"
+ 
+ #include <dirent.h>
diff --git a/nixpkgs/pkgs/os-specific/linux/lxcfs/skip-init.patch b/nixpkgs/pkgs/os-specific/linux/lxcfs/skip-init.patch
new file mode 100644
index 000000000000..6e7cdc90d706
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/lxcfs/skip-init.patch
@@ -0,0 +1,12 @@
+diff --git a/meson.build b/meson.build
+index a0289ad..10c0a28 100644
+--- a/meson.build
++++ b/meson.build
+@@ -285,7 +285,6 @@ endif
+ 
+ 
+ # Include sub-directories.
+-subdir('config/init')
+ subdir('share')
+ subdir('tests')
+ 
diff --git a/nixpkgs/pkgs/os-specific/linux/macchanger/default.nix b/nixpkgs/pkgs/os-specific/linux/macchanger/default.nix
index c862fd4e1675..e998bfad9361 100644
--- a/nixpkgs/pkgs/os-specific/linux/macchanger/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/macchanger/default.nix
@@ -44,5 +44,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2Plus;
     homepage = "https://github.com/alobbs/macchanger";
     platforms = platforms.linux;
+    mainProgram = "macchanger";
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/nftables/default.nix b/nixpkgs/pkgs/os-specific/linux/nftables/default.nix
index 03e99441ec67..3680cd43efb7 100644
--- a/nixpkgs/pkgs/os-specific/linux/nftables/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/nftables/default.nix
@@ -61,7 +61,7 @@ stdenv.mkDerivation rec {
     homepage = "https://netfilter.org/projects/nftables/";
     license = licenses.gpl2Only;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ izorkin ajs124 ];
+    maintainers = with maintainers; [ izorkin ] ++ teams.helsinki-systems.members;
     mainProgram = "nft";
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/nix-ld/default.nix b/nixpkgs/pkgs/os-specific/linux/nix-ld/default.nix
index bb6489ecdb17..208c59ab7576 100644
--- a/nixpkgs/pkgs/os-specific/linux/nix-ld/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/nix-ld/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "nix-ld";
-  version = "1.2.2";
+  version = "1.2.3";
 
   src = fetchFromGitHub {
     owner = "mic92";
     repo = "nix-ld";
     rev = version;
-    hash = "sha256-+z9t7BLugZO1WhyYEq6FI38TMh2EwfgfAv3RDFSjwtc=";
+    hash = "sha256-h+odOVyiGmEERMECoFOj5P7FPiMR8IPRzroFA4sKivg=";
   };
 
   doCheck = true;
@@ -48,9 +48,5 @@ stdenv.mkDerivation rec {
     license = licenses.mit;
     maintainers = with maintainers; [ mic92 ];
     platforms = platforms.linux;
-
-    # 32 bit builds are broken due to a missing #define value:
-    # https://github.com/Mic92/nix-ld/issues/64
-    broken = stdenv.is32bit;
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/nvidia-x11/default.nix b/nixpkgs/pkgs/os-specific/linux/nvidia-x11/default.nix
index 54df7cbc6271..1b3847a0aad8 100644
--- a/nixpkgs/pkgs/os-specific/linux/nvidia-x11/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/nvidia-x11/default.nix
@@ -59,11 +59,11 @@ rec {
   # Vulkan developer beta driver
   # See here for more information: https://developer.nvidia.com/vulkan-driver
   vulkan_beta = generic rec {
-    version = "535.43.20";
+    version = "535.43.22";
     persistencedVersion = "535.98";
     settingsVersion = "535.98";
-    sha256_64bit = "sha256-PVs+AnVbJhriAHlxVEV81fqT4n92edv0cQyAGvuUgPw=";
-    openSha256 = "sha256-xqjitZRsIvbE98zzSQNorkCguDJt53eCxKYBxIZQwVM=";
+    sha256_64bit = "sha256-emam5bfYJeFi1+Z0Z1//luaY1JTKcQNYUP8GmG9480Q=";
+    openSha256 = "sha256-8Nz6LfEdAsm7d6Leqs+ikN0BpOPkLCcd7bckK0MOIFU=";
     settingsSha256 = "sha256-jCRfeB1w6/dA27gaz6t5/Qo7On0zbAPIi74LYLel34s=";
     persistencedSha256 = "sha256-WviDU6B50YG8dO64CGvU3xK8WFUX8nvvVYm/fuGyroM=";
     url = "https://developer.nvidia.com/downloads/vulkan-beta-${lib.concatStrings (lib.splitVersion version)}-linux";
@@ -81,6 +81,17 @@ rec {
     useFabricmanager = true;
   };
 
+  dc_535 = generic rec {
+    version = "535.129.03";
+    url = "https://us.download.nvidia.com/tesla/${version}/NVIDIA-Linux-x86_64-${version}.run";
+    sha256_64bit = "sha256-5tylYmomCMa7KgRs/LfBrzOLnpYafdkKwJu4oSb/AC4=";
+    persistencedSha256 = "sha256-FRMqY5uAJzq3o+YdM2Mdjj8Df6/cuUUAnh52Ne4koME=";
+    fabricmanagerSha256 = "sha256-5KRYS+JLVAhDkBn8Z7e0uJvULQy6dSpwnYsbBxw7Mxg=";
+    useSettings = false;
+    usePersistenced = true;
+    useFabricmanager = true;
+  };
+
   # Update note:
   # If you add a legacy driver here, also update `top-level/linux-kernels.nix`,
   # adding to the `nvidia_x11_legacy*` entries.
@@ -113,8 +124,8 @@ rec {
     aurPatches = fetchFromGitHub {
       owner = "archlinux-jerry";
       repo = "nvidia-340xx";
-      rev = "fa434fb5da47e9423db2b19577817eb8c65d2f4e";
-      hash = "sha256-KeMTYHGuZSAPGnYaERZSMu/4lWyB25ZCIv4nJhXxABY=";
+      rev = "7616dfed253aa93ca7d2e05caf6f7f332c439c90";
+      hash = "sha256-1qlYc17aEbLD4W8XXn1qKryBk2ltT6cVIv5zAs0jXZo=";
     };
     patchset = [
       "0001-kernel-5.7.patch"
@@ -131,6 +142,7 @@ rec {
       "0012-kernel-6.2.patch"
       "0013-kernel-6.3.patch"
       "0014-kernel-6.5.patch"
+      "0015-kernel-6.6.patch"
     ];
   in generic {
     version = "340.108";
@@ -140,7 +152,7 @@ rec {
     persistencedSha256 = "1ax4xn3nmxg1y6immq933cqzw6cj04x93saiasdc0kjlv0pvvnkn";
     useGLVND = false;
 
-    broken = kernel.kernelAtLeast "6.6";
+    broken = kernel.kernelAtLeast "6.7";
     patches = map (patch: "${aurPatches}/${patch}") patchset;
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/nvidia-x11/fabricmanager.nix b/nixpkgs/pkgs/os-specific/linux/nvidia-x11/fabricmanager.nix
index 58cf8c0e3557..d9865f00d22c 100644
--- a/nixpkgs/pkgs/os-specific/linux/nvidia-x11/fabricmanager.nix
+++ b/nixpkgs/pkgs/os-specific/linux/nvidia-x11/fabricmanager.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   pname = "fabricmanager";
   version = fmver;
   src = fetchurl {
-    url = "https://developer.download.nvidia.com/compute/cuda/redist/fabricmanager/" +
+    url = "https://developer.download.nvidia.com/compute/nvidia-driver/redist/fabricmanager/" +
           "${sys}/${pname}-${sys}-${fmver}-archive.tar.xz";
     inherit sha256;
   };
diff --git a/nixpkgs/pkgs/os-specific/linux/nvidia-x11/generic.nix b/nixpkgs/pkgs/os-specific/linux/nvidia-x11/generic.nix
index c8957d6193a5..e05400aec276 100644
--- a/nixpkgs/pkgs/os-specific/linux/nvidia-x11/generic.nix
+++ b/nixpkgs/pkgs/os-specific/linux/nvidia-x11/generic.nix
@@ -63,7 +63,7 @@ assert versionOlder version "391" -> sha256_32bit != null;
 assert useSettings -> settingsSha256 != null;
 assert usePersistenced -> persistencedSha256 != null;
 assert useFabricmanager -> fabricmanagerSha256 != null;
-assert useFabricmanager -> !(useSettings || usePersistenced);
+assert useFabricmanager -> !useSettings;
 
 let
   nameSuffix = optionalString (!libsOnly) "-${kernel.version}";
diff --git a/nixpkgs/pkgs/os-specific/linux/nvidia-x11/persistenced.nix b/nixpkgs/pkgs/os-specific/linux/nvidia-x11/persistenced.nix
index 03ad03a472d4..dcdd22044e2a 100644
--- a/nixpkgs/pkgs/os-specific/linux/nvidia-x11/persistenced.nix
+++ b/nixpkgs/pkgs/os-specific/linux/nvidia-x11/persistenced.nix
@@ -44,6 +44,6 @@ stdenv.mkDerivation rec {
     license = licenses.unfreeRedistributable;
     platforms = nvidia_x11.meta.platforms;
     maintainers = with maintainers; [ abbradar ];
-    mainProgram = pname;
+    mainProgram = "nvidia-persistenced";
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/openvswitch/generic.nix b/nixpkgs/pkgs/os-specific/linux/openvswitch/generic.nix
index 83749782d274..ce800a7ba992 100644
--- a/nixpkgs/pkgs/os-specific/linux/openvswitch/generic.nix
+++ b/nixpkgs/pkgs/os-specific/linux/openvswitch/generic.nix
@@ -96,6 +96,9 @@ in stdenv.mkDerivation rec {
 
   doCheck = true;
   preCheck = ''
+    export TESTSUITEFLAGS="-j$NIX_BUILD_CORES"
+    export RECHECK=yes
+
     patchShebangs tests/
   '';
 
diff --git a/nixpkgs/pkgs/os-specific/linux/pam_ssh_agent_auth/default.nix b/nixpkgs/pkgs/os-specific/linux/pam_ssh_agent_auth/default.nix
index f28cb28ef373..46587028f296 100644
--- a/nixpkgs/pkgs/os-specific/linux/pam_ssh_agent_auth/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/pam_ssh_agent_auth/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchpatch, fetchFromGitHub, pam, openssl, perl }:
+{ lib, stdenv, nixosTests, fetchpatch, fetchFromGitHub, pam, openssl, perl }:
 
 stdenv.mkDerivation rec {
   pname = "pam_ssh_agent_auth";
@@ -46,6 +46,8 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  passthru.tests.sudo = nixosTests.ssh-agent-auth;
+
   meta = {
     homepage = "https://github.com/jbeverly/pam_ssh_agent_auth";
     description = "PAM module for authentication through the SSH agent";
diff --git a/nixpkgs/pkgs/os-specific/linux/pcm/default.nix b/nixpkgs/pkgs/os-specific/linux/pcm/default.nix
index fc5902e719ba..15f54fb360a4 100644
--- a/nixpkgs/pkgs/os-specific/linux/pcm/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/pcm/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pcm";
-  version = "202307";
+  version = "202311";
 
   src = fetchFromGitHub {
     owner = "opcm";
     repo = "pcm";
     rev = version;
-    hash = "sha256-GeLiJT5AwsMWw0ErdwD6C1jtUZjUxGw5GRSvenu3W18=";
+    hash = "sha256-lWE7Gz/+LLMr3UyqfwBWEwpSvtdjMgdxVqc9hrZAYfk=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/nixpkgs/pkgs/os-specific/linux/plymouth/default.nix b/nixpkgs/pkgs/os-specific/linux/plymouth/default.nix
index d5d46e5de7ed..90f400defc2d 100644
--- a/nixpkgs/pkgs/os-specific/linux/plymouth/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/plymouth/default.nix
@@ -20,7 +20,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "plymouth";
-  version = "unstable-2023-06-17";
+  version = "23.360.11";
 
   outputs = [ "out" "dev" ];
 
@@ -28,8 +28,8 @@ stdenv.mkDerivation (finalAttrs: {
     domain = "gitlab.freedesktop.org";
     owner = "plymouth";
     repo = "plymouth";
-    rev = "b1d5aa9d2a6033bba52cf63643e5878f8a9b68a0";
-    hash = "sha256-8DXcwt8CZTni5Ma+I63LzNejlIB0Cr1ATA7Nl3z9z6I=";
+    rev = finalAttrs.version;
+    hash = "sha256-Uun4KtrbkFCiGq3WpZlZ8NKKCOnM+jcgYa8qoqAYdaw=";
   };
 
   patches = [
diff --git a/nixpkgs/pkgs/os-specific/linux/prl-tools/default.nix b/nixpkgs/pkgs/os-specific/linux/prl-tools/default.nix
index 314a95bd5548..f8196dba6157 100644
--- a/nixpkgs/pkgs/os-specific/linux/prl-tools/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/prl-tools/default.nix
@@ -36,13 +36,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "prl-tools";
-  version = "19.1.1-54734";
+  version = "19.2.1-54832";
 
   # We download the full distribution to extract prl-tools-lin.iso from
   # => ${dmg}/Parallels\ Desktop.app/Contents/Resources/Tools/prl-tools-lin.iso
   src = fetchurl {
     url = "https://download.parallels.com/desktop/v${lib.versions.major finalAttrs.version}/${finalAttrs.version}/ParallelsDesktop-${finalAttrs.version}.dmg";
-    hash = "sha256-02YxBkV9pZGfXuK6GvUDTgE9U5H2MOMk24h9qGJdFTM=";
+    hash = "sha256-PmQSGoJbB0+Q7t56FOFxOVQ86CJLqAa6PTnWLx5CzpA=";
   };
 
   hardeningDisable = [ "pic" "format" ];
diff --git a/nixpkgs/pkgs/os-specific/linux/raspberrypi-eeprom/default.nix b/nixpkgs/pkgs/os-specific/linux/raspberrypi-eeprom/default.nix
deleted file mode 100644
index 6cc93b8dd3c6..000000000000
--- a/nixpkgs/pkgs/os-specific/linux/raspberrypi-eeprom/default.nix
+++ /dev/null
@@ -1,62 +0,0 @@
-{ stdenvNoCC, lib, fetchFromGitHub, makeWrapper
-, python3, binutils-unwrapped, findutils, gawk, kmod, pciutils, libraspberrypi
-}:
-stdenvNoCC.mkDerivation rec {
-  pname = "raspberrypi-eeprom";
-  version = "2023.10.30-2712";
-
-  src = fetchFromGitHub {
-    owner = "raspberrypi";
-    repo = "rpi-eeprom";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-TKvby0qIXidM5Qk7q+ovLk0DpHsCbdQe7xndrgKrSXk=";
-  };
-
-  buildInputs = [ python3 ];
-  nativeBuildInputs = [ makeWrapper ];
-
-  postPatch = ''
-    # Don't try to verify md5 signatures from /var/lib/dpkg and
-    # fix path to the configuration.
-    substituteInPlace rpi-eeprom-update \
-      --replace 'IGNORE_DPKG_CHECKSUMS=''${LOCAL_MODE}' 'IGNORE_DPKG_CHECKSUMS=1' \
-      --replace '/etc/default' '/etc'
-  '';
-
-  installPhase = ''
-    mkdir -p "$out/bin"
-    cp rpi-eeprom-config rpi-eeprom-update rpi-eeprom-digest "$out/bin"
-
-    mkdir -p "$out/lib/firmware/raspberrypi"
-    for dirname in firmware-*; do
-        dirname_suffix="''${dirname/#firmware-}"
-        cp -rP "$dirname" "$out/lib/firmware/raspberrypi/bootloader-$dirname_suffix"
-    done
-  '';
-
-  fixupPhase = ''
-    patchShebangs $out/bin
-    for i in rpi-eeprom-update rpi-eeprom-config; do
-      wrapProgram $out/bin/$i \
-        --set FIRMWARE_ROOT "$out/lib/firmware/raspberrypi/bootloader" \
-        ${lib.optionalString stdenvNoCC.isAarch64 "--set VCMAILBOX ${libraspberrypi}/bin/vcmailbox"} \
-        --prefix PATH : "${lib.makeBinPath ([
-          binutils-unwrapped
-          findutils
-          gawk
-          kmod
-          pciutils
-          (placeholder "out")
-        ] ++ lib.optionals stdenvNoCC.isAarch64 [
-          libraspberrypi
-        ])}"
-    done
-  '';
-
-  meta = with lib; {
-    description = "Installation scripts and binaries for the closed sourced Raspberry Pi 4 and 5 bootloader EEPROMs";
-    homepage = "https://www.raspberrypi.com/documentation/computers/raspberry-pi.html#raspberry-pi-4-boot-eeprom";
-    license = with licenses; [ bsd3 unfreeRedistributableFirmware ];
-    maintainers = with maintainers; [ das_j Luflosi ];
-  };
-}
diff --git a/nixpkgs/pkgs/os-specific/linux/semodule-utils/default.nix b/nixpkgs/pkgs/os-specific/linux/semodule-utils/default.nix
index e6b8e778a77a..70de3cc6b60c 100644
--- a/nixpkgs/pkgs/os-specific/linux/semodule-utils/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/semodule-utils/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "semodule-utils";
-  version = "3.5";
+  version = "3.6";
 
   inherit (libsepol) se_url;
 
   src = fetchurl {
     url = "${se_url}/${version}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-yaVQpzcFHrrywQL2ZcfsL4XnIyhwmAqgBnmYRZtBQoM=";
+    sha256 = "sha256-7tuI8rISTlOPLWFL4GPA2aw+rMDFGk2kRQDKHtG6FvQ=";
   };
 
   buildInputs = [ libsepol ];
diff --git a/nixpkgs/pkgs/os-specific/linux/systemd/default.nix b/nixpkgs/pkgs/os-specific/linux/systemd/default.nix
index afb10b3c2fcb..f57e4039d203 100644
--- a/nixpkgs/pkgs/os-specific/linux/systemd/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/systemd/default.nix
@@ -105,6 +105,8 @@
 , withLibBPF ? lib.versionAtLeast buildPackages.llvmPackages.clang.version "10.0"
     && (stdenv.hostPlatform.isAarch -> lib.versionAtLeast stdenv.hostPlatform.parsed.cpu.version "6") # assumes hard floats
     && !stdenv.hostPlatform.isMips64   # see https://github.com/NixOS/nixpkgs/pull/194149#issuecomment-1266642211
+    # can't find gnu/stubs-32.h
+    && (stdenv.hostPlatform.isPower64 -> stdenv.hostPlatform.isBigEndian)
     # buildPackages.targetPackages.llvmPackages is the same as llvmPackages,
     # but we do it this way to avoid taking llvmPackages as an input, and
     # risking making it too easy to ignore the above comment about llvmPackages.
@@ -151,7 +153,7 @@ assert withImportd -> withCompression;
 assert withCoredump -> withCompression;
 assert withHomed -> withCryptsetup;
 assert withHomed -> withPam;
-assert withUkify -> withEfi;
+assert withUkify -> (withEfi && withBootloader);
 assert withRepart -> withCryptsetup;
 assert withBootloader -> withEfi;
 # passwdqc is not packaged in nixpkgs yet, if you want to fix this, please submit a PR.
diff --git a/nixpkgs/pkgs/os-specific/linux/uhk-agent/default.nix b/nixpkgs/pkgs/os-specific/linux/uhk-agent/default.nix
index 5ee485b09cf8..c8af2563d622 100644
--- a/nixpkgs/pkgs/os-specific/linux/uhk-agent/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/uhk-agent/default.nix
@@ -11,12 +11,12 @@
 
 let
   pname = "uhk-agent";
-  version = "3.2.1";
+  version = "3.2.2";
 
   src = fetchurl {
     url = "https://github.com/UltimateHackingKeyboard/agent/releases/download/v${version}/UHK.Agent-${version}-linux-x86_64.AppImage";
     name = "${pname}-${version}.AppImage";
-    sha256 = "sha256-qAZ92/iN5E+1KGPs6u9Bb6vLfi0Keog/yOcLtnRD7yc=";
+    sha256 = "sha256-0kNcpdYktgzIPVvfSitJ5aIuhJvCEcbubumHhW00QUE=";
   };
 
   appimageContents = appimageTools.extract {
diff --git a/nixpkgs/pkgs/os-specific/linux/upower/default.nix b/nixpkgs/pkgs/os-specific/linux/upower/default.nix
index 36d8a3b9c45f..b0b7b4f6776c 100644
--- a/nixpkgs/pkgs/os-specific/linux/upower/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/upower/default.nix
@@ -3,7 +3,6 @@
 , fetchFromGitLab
 , makeWrapper
 , pkg-config
-, rsync
 , libxslt
 , meson
 , ninja
@@ -69,7 +68,6 @@ stdenv.mkDerivation (finalAttrs: {
     libxslt
     makeWrapper
     pkg-config
-    rsync
     glib
   ] ++ lib.optionals withIntrospection [
     gobject-introspection
@@ -138,7 +136,6 @@ stdenv.mkDerivation (finalAttrs: {
     # Our gobject-introspection patches make the shared library paths absolute
     # in the GIR files. When running tests, the library is not yet installed,
     # though, so we need to replace the absolute path with a local one during build.
-    # We are using a symlink that will be overwitten during installation.
     mkdir -p "$out/lib"
     ln -s "$PWD/libupower-glib/libupower-glib.so" "$out/lib/libupower-glib.so.3"
   '';
@@ -159,21 +156,28 @@ stdenv.mkDerivation (finalAttrs: {
     # meson rebuild during install and it is not used at runtime anyway.
     sed -Ei 's~#!.+/bin/python3~#!/usr/bin/python3~' \
       ../src/linux/integration-test.py
+
+    # Undo preCheck installation since DESTDIR hack expects outputs to not exist.
+    rm "$out/lib/libupower-glib.so.3"
+    rmdir "$out/lib" "$out"
   '';
 
   postInstall = ''
     # Move stuff from DESTDIR to proper location.
-    # We use rsync to merge the directories.
-    for dir in etc var; do
-        rsync --archive "$DESTDIR/$dir" "$out"
-        rm --recursive "$DESTDIR/$dir"
-    done
-    for o in out dev installedTests; do
-        rsync --archive "$DESTDIR/''${!o}" "$(dirname "''${!o}")"
-        rm --recursive "$DESTDIR/''${!o}"
+    for o in $(getAllOutputNames); do
+        # devdoc is created later by _multioutDocs hook.
+        if [[ "$o" = "devdoc" ]]; then continue; fi
+        mv "$DESTDIR''${!o}" "$(dirname "''${!o}")"
     done
-    # Ensure the DESTDIR is removed.
-    rmdir "$DESTDIR/nix/store" "$DESTDIR/nix" "$DESTDIR"
+
+    mv "$DESTDIR/var" "$out"
+    # The /etc already exist so we need to merge it.
+    cp --recursive "$DESTDIR/etc" "$out"
+    rm --recursive "$DESTDIR/etc"
+
+    # Ensure we did not forget to install anything.
+    rmdir --parents --ignore-fail-on-non-empty "$DESTDIR${builtins.storeDir}"
+    ! test -e "$DESTDIR"
   '';
 
   postFixup = ''
@@ -194,7 +198,7 @@ stdenv.mkDerivation (finalAttrs: {
     # at install time but Meson does not support this
     # so we need to convince it to install all files to a temporary
     # location using DESTDIR and then move it to proper one in postInstall.
-    DESTDIR = "${placeholder "out"}/dest";
+    DESTDIR = "dest";
   };
 
   passthru = {
diff --git a/nixpkgs/pkgs/os-specific/linux/vdo/default.nix b/nixpkgs/pkgs/os-specific/linux/vdo/default.nix
index 11597c9ed653..625aa232cc66 100644
--- a/nixpkgs/pkgs/os-specific/linux/vdo/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/vdo/default.nix
@@ -60,6 +60,6 @@ stdenv.mkDerivation rec {
     # platforms are defined in https://github.com/dm-vdo/vdo/blob/master/utils/uds/atomicDefs.h
     platforms = [ "x86_64-linux" "aarch64-linux" "s390-linux" "powerpc64-linux" "powerpc64le-linux" ];
     license = with licenses; [ gpl2Plus ];
-    maintainers = with maintainers; [ ajs124 ];
+    maintainers = teams.helsinki-systems.members;
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/waydroid/default.nix b/nixpkgs/pkgs/os-specific/linux/waydroid/default.nix
index e8e0727b8dbf..97818ba9c4d4 100644
--- a/nixpkgs/pkgs/os-specific/linux/waydroid/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/waydroid/default.nix
@@ -1,5 +1,6 @@
 { lib
 , fetchFromGitHub
+, fetchpatch
 , python3Packages
 , dnsmasq
 , gawk
@@ -12,24 +13,28 @@
 , iptables
 , util-linux
 , wrapGAppsHook
-, xclip
+, wl-clipboard
 , runtimeShell
 }:
 
 python3Packages.buildPythonApplication rec {
   pname = "waydroid";
-  version = "1.4.1";
+  version = "1.4.2";
   format = "other";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "sha256-0AkNzMIumvgnVcLKX72E2+Eg54Y9j7tdIYPsroOTLWA=";
+    sha256 = "sha256-/dFvhiK3nCOOmAtrYkQEB8Ge8Rf1ea5cDO7puTwS5bI=";
   };
 
-  buildInputs = [
-    gtk3
+  patches = [
+    # https://github.com/waydroid/waydroid/pull/1218
+    (fetchpatch {
+      url = "https://github.com/waydroid/waydroid/commit/595e0e5b309a79fedaa07d90b9073ddcb156314c.patch";
+      hash = "sha256-A+rUmJbFFhMZ5WpT+QBCTEcn82wJuvmi8Wbcsio41Nk=";
+    })
   ];
 
   nativeBuildInputs = [
@@ -37,6 +42,10 @@ python3Packages.buildPythonApplication rec {
     wrapGAppsHook
   ];
 
+  buildInputs = [
+    gtk3
+  ];
+
   propagatedBuildInputs = with python3Packages; [
     dbus-python
     gbinder-python
@@ -61,18 +70,15 @@ python3Packages.buildPythonApplication rec {
     wrapProgram $out/lib/waydroid/data/scripts/waydroid-net.sh \
       --prefix PATH ":" ${lib.makeBinPath [ dnsmasq getent iproute2 iptables ]}
 
-    wrapPythonProgramsIn $out/lib/waydroid/ "${lib.concatStringsSep " " [
+    wrapPythonProgramsIn $out/lib/waydroid/ "${lib.concatStringsSep " " ([
       "$out"
-      python3Packages.dbus-python
-      python3Packages.gbinder-python
-      python3Packages.pygobject3
-      python3Packages.pyclip
+    ] ++ propagatedBuildInputs ++ [
       gawk
       kmod
       lxc
       util-linux
-      xclip
-    ]}"
+      wl-clipboard
+    ])}"
 
     substituteInPlace $out/lib/waydroid/tools/helpers/*.py \
       --replace '"sh"' '"${runtimeShell}"'